feat(plugins): align instruction surfaces with the current prompting guide and add the posture-audit lane - #2018
Conversation
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
77b7a08 to
0184ebf
Compare
|
Claude finished @kyle-sexton's task in 3m 50s —— View job Review complete
This is a large, mostly-prose alignment PR (100 files) with unusually high internal cross-referencing, so I focused on verifying the specific consistency claims the PR body makes (row-ID renumbering, songwriting title-type reconciliation, machine-health approval-model fixes, CHANGELOG/ Finding posted inline: Checked and consistent:
Note (not a code defect, so not inline): the PR body's own summary says criteria bumps to "v1.17.0" with new rows "I23" and "I24," but the shipped diff bumps No architecture, error-handling, or test-coverage concerns beyond the above — this PR is prose/reference-doc alignment with one new (report-only, no- Branch: |
|
Claude finished @kyle-sexton's task in 2m 46s —— View job Security review
Scope reviewed: the full PR diff ( No security issues found. Details on what was checked:
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
Claude has reviewed this PR 5 times. The lane skips further automatic reviews after 5; deleting this comment resets the count. |
|
Claude finished @kyle-sexton's task in 3m 19s —— View job Security review
Scope reviewed: the full PR diff between No security issues found. Of the files with actual executable/data logic (as opposed to prose):
This PR remains almost entirely prose/reference-doc alignment across skill and agent markdown files, which carries no direct security surface on its own (no new tool grants, no changed trust boundaries, no new external data ingestion). |
|
Claude finished @kyle-sexton's task in 2m 36s —— View job Code review complete
This review covers what changed since the previous automated review: commit New commit (
New finding — incomplete fix (not inline-commentable; the affected line is unchanged by this PR): The commit fixes 7 sibling This is the same skill-relative-vs-plugin-root mismatch the fix commit addresses elsewhere, and ironically Still outstanding from the prior review: the No other correctness or CLAUDE.md-alignment issues found in the new commit; it's a narrowly-scoped, well-justified fix consistent with repo conventions. Branch: |
ad36ddf to
3a3d22d
Compare
|
Claude finished @kyle-sexton's task in 3m 10s —— View job Code review complete
What's new since the last code-review pass: nothing functional. The two commits added since ( Additional coverage this pass: the prior reviews' file lists were truncated before a few files that are genuinely part of this PR's diff ( Still open from earlier review passes (unaddressed by the two no-op commits since):
No new architecture, error-handling, or maintainability concerns. This PR remains ready modulo the two small stale-reference fixes above. |
|
Claude finished @kyle-sexton's task in 1m 38s —— View job Security review complete
Scope reviewed: full diff No security issues found. Confirmed during this pass:
This PR carries no direct security surface: it's prompting-guide alignment content plus one new report-only, no- |
|
Claude finished @kyle-sexton's task in 33s —— View job Security review complete
No security issues found. Scope of this pass: the only change since the last security review (at Full PR diff vs
This PR carries no direct security surface — it remains prompting-guide alignment content plus one new report-only skill and a doc-index update. Branch: |
|
Claude finished @kyle-sexton's task in 1m 24s —— View job Code review complete
What's new since the last review pass: one commit, New finding — stale skill count in the plugin's own README (not touched by this PR): While checking that the new skill's cross-references were fully propagated (this PR's own stated purpose), I found one the PR missed.
This is exactly the class of stale cross-reference this PR's own description calls out fixing elsewhere (Pat's title types, machine-health's approval model, etc.) — it just wasn't caught here because No other issues. This commit is a minimal, correct, mechanical documentation-index update consistent with the rest of the PR. Branch: |
…guide and add the posture-audit lane Audit of every plugin's prompt-bearing surfaces against a verified 451-item inventory of the official prompting guide (best-practices page + Fable 5 / Sonnet 5 / Opus 5 / Opus 4.8 subpages, fetched 2026-08-08), with every finding re-adjudicated by independent fresh-context verifiers before edit. ~55 verified fixes across 21 plugins, each with a version bump and CHANGELOG entry. Downstream capability: audit-instructions criteria v1.17.0 (Opus 4.8 joins Sources; I8-e and I8 base promoted per the now-met promotion gates; new rows I23 over-aggressive trigger emphasis / blanket defaults and I24 retired sampling parameters, seeded in the pre-scan), plus the new claude-config:audit-prompting-postures skill — the additive lane detecting posture guidance a component's purpose needs but does not carry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LYm1iCn68WiKKsWbP994Co
The seven edited songwriting SKILL.md files carried a pre-existing backticked
`context/pat-pattison/` directory mention that check-5 resolves skill-relative;
now written plugin-root-relative (`${CLAUDE_PLUGIN_ROOT}/…`), matching the
rhyme skill's own datamuse precedent. The boris foundations worktree example
carries a portability-ok annotation: it names the example's own base branch
verbatim, not a branch default this repo assumes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LYm1iCn68WiKKsWbP994Co
The ci workflow never registered a run for 9ffeb5e (docs/CATALOG.md regeneration); pr_request-triggered lanes need a fresh head event. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LYm1iCn68WiKKsWbP994Co
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LYm1iCn68WiKKsWbP994Co
…ostures row Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LYm1iCn68WiKKsWbP994Co
…ups to completion Managed-settings coverage lands in the audit skill (issue #2026): Phase 1's check-structure.sh resolves the OS-specific machine-scope path and drop-in directory and reports them structure-only, and the checklist tick returns, now truthful. The audit-pass run contract splits into five per-topic reference files behind a routing index with the section numbering preserved and inbound links repointed (issue #2027). course-digest's two inconsistent self-estimated context-percentage handoff triggers become one qualitative signal set with the resume protocol untouched (issue #2028). The rhyme skill's latent skill-relative pat-pattison mention goes plugin-root-relative, completing the eight-file sweep. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LYm1iCn68WiKKsWbP994Co
…es after the 0.7.0 reconciliation Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LYm1iCn68WiKKsWbP994Co
26ca55b to
ce354c3
Compare
|
Claude finished @kyle-sexton's task in 1m 22s —— View job Security review complete
No security issues found. Scope of this pass: everything new since the last automated security review on this PR (at
Confirmed still true for the full PR diff ( |
|
Claude finished @kyle-sexton's task in 4m 59s —— View job Code review complete
What's new since the last review pass: two content commits, Rebase note (resolves a prior open finding): earlier review rounds on this PR flagged Confirmed still open (inline, carried forward again — now worse, not just stale): New finding (inline): Verified this pass, no issues:
Still outstanding from the previous review round (unchanged by No other architecture, error-handling, or maintainability concerns found in the new commits. |
The postures eval's routing example now names I28 — the row this branch actually adds after the parallel-lane renumbering — and the managed-settings structure logic gains test coverage: an env-var path seam (the real locations are absolute system paths a fixture cannot reach), a present case asserting counts without leaking key names or values, a drop-in count, and an absent case that never fails the run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LYm1iCn68WiKKsWbP994Co
|
Claude finished @kyle-sexton's task in 57s —— View job Security review complete
No security issues found. Scope of this pass: the single commit added since the last automated security review — Reviewed in detail:
Consistent with all five prior security passes on this PR: no This PR carries no security surface — prompting-guide-alignment content plus one new report-only skill, and this final commit is a clean, narrowly-scoped fix for the two review threads that were still open. |
Main absorbed PR #2018, which released claude-memory 0.5.8 with different content. This PR's entry moves from 0.5.8 to 0.5.9, above main's 0.5.8 entry; plugin.json follows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HbtPzLRe1yBavNpsmv5Tum
… 0.11.3 Main's discovery 0.11.2 (fan-out N cap) landed under the same version this branch claimed, so this branch's researcher-routing entry moves to 0.11.3 above it. research-deep's multi-topic paragraph now carries both sides: discovery:researcher dispatch with the full envelope AND the roughly-a-dozen N cap. plugin.json bumped to 0.11.3. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HbtPzLRe1yBavNpsmv5Tum
Composed both sides: main's prompting-guide alignment (#2018, seven-skill description, eval 2 I27->I28) and this PR's eval-16 row-lookup rewrite. CHANGELOG entry retitled [0.26.1] -> [0.27.1] above main's [0.27.0]. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HbtPzLRe1yBavNpsmv5Tum
…ateless reference (#2040) No linked issue This fixes one row of the audit issue cited under `## Related`; that issue stays open for its remaining rows, so no closing keyword. ## Summary `plugins/claude-memory/skills/stateless/reference/official-guidance.md` carried attributed blockquotes whose text is not on the cited pages. This is a re-quoting pass against the live `code.claude.com/docs/en/settings.md` and `code.claude.com/docs/en/claude-directory.md`, fetched 2026-08-08. **Fixed — the flagged precedence quote.** Item 1 read `1. **Managed settings** (…)`. A bare ellipsis stood inside quote marks where real page words belong. It now reads `1. **Managed settings** (server-managed, MDM/OS-level policies, or managed settings)`, and the attribution note records the two normalizations: the three parenthetical links are flattened to their labels (the file's existing convention for every other quote), and each item's nested detail bullets are omitted. **Fixed — an unflagged truncation that inverted a claim.** The adjacent quote read `"Cannot be overridden by any other level, including command line arguments"`. The live sentence continues `, apart from the exceptions in the bullets below`. Truncating there turned a qualified statement into an absolute one. The full sentence is restored. The conclusion the skill actually needs is carried by prose stating a verified negative — none of item 1's exception bullets names `autoMemoryEnabled`, `CLAUDE_CODE_DISABLE_AUTO_MEMORY`, or auto memory at all, so no ordinary lower scope overrides a managed auto-memory value. Deliberately not an enumeration of the exception set: that set is long and varied (a within-managed-tier source ranking, an SDK-embedder merge path, several admin-source key exceptions), and summarizing it here would be the same defect class in the opposite direction. Readers go to the page for it. **Fixed — a sentence upstream has deleted.** The `claude project purge` quote asserted `"The command requires Claude Code v2.1.124 or later."` claude-directory no longer carries that sentence and cli-reference never did. It is out of the quote, and the note beside it labels the retained `v2.1.124+` floor a claim with no current upstream source. That label is added once, in this file; `SKILL.md` and `context/purge.md` still state the floor unqualified and are deliberately untouched — sweeping a version claim across the plugin is not this row's scope, and the docs dropping the sentence does not disprove the floor. **Unchanged — two of the three flagged quotes were already verbatim.** The `env` sentence and the `cleanupPeriodDays` description were compared character-for-character against the live page and match exactly (modulo the same link flattening). Their wording is untouched. Manufacturing edits to satisfy a stale premise would have made the file less accurate, not more. **Soft aggravator resolved.** `cleanupPeriodDays`' verbatim `"session files and other application data"` sat beneath prose stating `sessions/` is not age-swept, close enough to read as contradicting it. The live page still carries that tension, so the quote stays verbatim and new prose resolves the phrase against the table it links to — transcripts, `shell-snapshots/`, `debug/`, `tasks/`, `file-history/` — noting `sessions/` is not a row in it, which is what the quote two paragraphs down already established. Every settings and claude-directory verification stamp in the file moves to 2026-08-08, the date each quote was re-checked. Version bumped to `0.5.9` with a matching CHANGELOG entry. (Originally `0.5.8`; main then absorbed #2018, which released a different `0.5.8` for this plugin, so this branch merged `origin/main` and moved its entry to `0.5.9` above main's `0.5.8`.) ## Test plan - `scripts/check-changelog-parity.sh --check` — pass ("Every versioned plugin has a CHANGELOG.md"). - `scripts/check-changelog-parity.sh --check-bump origin/main` — pass (`## [0.5.9]` entry present at head, absent at ref). - `markdownlint-cli2` on both changed markdown files — 0 errors. - Quote fidelity verified mechanically, not by eye: every blockquote **citing the settings page or claude-directory** was substring-matched against that page's fetched raw markdown with link syntax flattened. All such quotes now match exactly; the two removals above are the strings that did not. The file's six `memory` blockquotes and one `env-vars` blockquote were **not** re-checked — those pages were not fetched, re-researching them is outside this row, and the file header already scopes its verification stamps accordingly. ## Related - #1989 row 247 — the three settings-page blockquotes attributed to `code.claude.com/docs/en/settings` that are not verbatim on that page. - Deviation from the row's spec: only one of the three flagged quotes was non-verbatim against the live page as of 2026-08-08. Two additional non-verbatim quotes in the same file were found and fixed instead. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01HbtPzLRe1yBavNpsmv5Tum --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
PR #2018 landed a songwriting 0.7.1 while this branch was open and claimed the same version, so this branch's entry becomes 0.7.2 and the manifest follows. meter-prosody's pre-flight composes both sides: this branch's reroute from response-filter §6 Form to §3 Critique, and main's allowance that the box narration may live in reasoning rather than the visible response. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
… exit-2 table (#2041) ## Summary `plugins/claude-config/skills/audit-instructions/reference/conflict-criteria.md` adjudicated a hook-half conflict pair by splitting hook events into two named lists — "Blockable events" (`PreToolUse`, `UserPromptSubmit`, `Stop`, `SubagentStop`, `PreCompact`, `UserPromptExpansion`) and "Non-blockable events" (`PostToolUse`, `Notification`, `SubagentStart`, `SessionStart`, `SessionEnd`) — phrased as an exhaustive partition. That phrasing is the defect: the event set is upstream-owned and grows. **Upstream evidence.** The hooks page's `#### Exit code 2 behavior per event` table (<https://code.claude.com/docs/en/hooks#exit-code-2-behavior-per-event>, fetched 2026-08-08 via the raw-markdown channel) carries 31 rows, not 11. Events this repository's own hooks register that appeared in neither list: | Hook event | Can block? | What happens on exit 2 (upstream cell) | | --- | --- | --- | | `ConfigChange` | Yes | Blocks the configuration change from taking effect (except `policy_settings`) | | `PostToolBatch` | Yes | Stops the agentic loop before the next model call | | `StopFailure` | No | Output and exit code are ignored | | `PermissionDenied` | No | Exit code and stderr are ignored because the denial already occurred | | `InstructionsLoaded` | No | Exit code is ignored | Under the old text an auditor could grade none of these. Two further rows also show why a copied list is the wrong shape even when complete: `PostToolBatch` prevents "the agentic loop before the next model call" and `TaskCreated` "rolls back the task creation" — neither is a tool call or a prompt, so "the act it blocks" needs the row's own cell to supply it. **The fix (pointer-not-copy).** The bullet now names that table as the sole authority and restates none of its rows in either direction. The procedure: resolve the handler's event, read its row, and pair on the row's own `Can block?` cell — taking the paired content from what the row states is prevented rather than assuming a tool call or prompt; pairing as nothing when the cell says no; and recording an event with no row (or an unreachable table) as `blockability-unresolved`, reusing the file's existing `text-unresolved` / `liveness-unresolved` report-rather-than-infer shape instead of inventing a third vocabulary. The criterion keeps its detection function. Both worked examples survive, now marked as examples: `PostToolUse` (blocks nothing, the tool already ran, with the `plugins/actionlint/hooks/actionlint-check.sh` pointer) and the `PreToolUse` counterfactual that eval 16 turns on. The `SubagentStop` subagent-scoping sentence is kept as its own standing rule rather than a list member. Also updated: the file's recheck trigger, which fired on "a change to which events exit 2 can actually block" — now scoped to the table's removal, renaming, or restructuring, since a row added upstream can no longer stale anything here. Review follow-up: the exemption is narrowed so that a change to the `SubagentStop`, `PostToolUse`, or `PreToolUse` rows — the three the worked examples cite — does fire a recheck. **Files changed** - `plugins/claude-config/skills/audit-instructions/reference/conflict-criteria.md` — the partition rewrite, the recheck trigger, and the file header (1.3.0 → 1.4.0, 2026-08-08) - `plugins/claude-config/skills/audit-instructions/evals/evals.json` — eval 16's `expected_output` and second expectation now test the row lookup rather than the memorized split; the `PostToolUse` verdict the eval exists to check is unchanged, ids are not renumbered - `plugins/claude-config/.claude-plugin/plugin.json` — 0.25.0 → 0.27.1 (re-versioned twice after merges of main: first to 0.26.1 when 0.26.0 landed, then to 0.27.1 when 0.27.0 landed via #2018) - `plugins/claude-config/CHANGELOG.md` — `## [0.27.1]` entry, placed above main's `## [0.27.0]` **Deviations from the row brief** - The row says the same claims appear in `SKILL.md`. They do not. A grep for `blockable|non-blocking|blocks nothing|UserPromptExpansion|SessionEnd|PostToolUseFailure|Notification` across `audit-instructions/` returns only `conflict-criteria.md` and `evals.json` for the partition; `SKILL.md:157` carries a generic "the act it blocks under its event and `matcher`" (event-agnostic, still correct) and `SKILL.md:160`/`:164` concern stdout and `additionalContext` scoping, not blockability. No `SKILL.md` edit was manufactured to satisfy the row's wording. - The centrally allocated version was 0.21.11, which is behind this plugin's current version on `main` and would have regressed the changelog order — the exact failure class `check-changelog-parity.sh --check-order` exists to catch. Used the reallocated 0.25.2, then re-versioned to 0.26.1 (via a merge of `origin/main`, not a rebase) after 0.26.0 landed on main, then to 0.27.1 via a second merge of `origin/main` after #2018 landed 0.27.0 (that merge also composed #2018's evals.json changes — eval 2's I27 → I28 — with this PR's eval-16 rewrite). - No new eval was added for an event outside the old lists. It would prove the fix, but the row asks only that evals stay consistent, and `evals.json` is contended by sibling PRs. ## Test plan - `scripts/check-changelog-parity.sh --check` — PASS ("Every versioned plugin has a CHANGELOG.md") - `scripts/check-changelog-parity.sh --check-bump origin/main` — PASS (version entry present at head, absent at base; re-run at 0.27.1 after the second merge of main) - `scripts/check-changelog-parity.sh --check-order` — PASS (all 72 changelogs newest-first) - `scripts/check-changed-skills.sh origin/main` — PASS, 0 errors, 2 warnings, both pre-existing and untouched by this diff (`SKILL.md` 398 lines vs the 200-line soft target; `reference/criteria.md:976` fresh-eyes declaration) - `markdownlint-cli2` over the changed markdown — 0 errors - `evals.json` validated against `plugins/skill-quality/reference/evals.schema.json` via `ajv-cli` (draft 2020-12) — valid; 16 eval cases parse - Discriminating check: an auditor holding only `conflict-criteria.md` can now grade an event named nowhere in the file (`Elicitation`, `FileChanged`, `PostToolBatch`) — look up its row, quote the cell, or mark it `blockability-unresolved`. ## Related No linked issue — this PR closes nothing. It fixes one row (row 244) of the multi-row umbrella issue #1989, which stays open for its remaining rows, so a closing keyword would be wrong here. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 participant
Summary
Aligns the marketplace's prompt-bearing surfaces with the current official prompting guide
(best-practices page + the Fable 5 / Sonnet 5 / Opus 5 / Opus 4.8 subpages, all fetched
2026-08-08), and ships the tooling downstream consumers need to run the same alignment on their
own repos. Rebased over — and reconciled with — the parallel alignment PRs #2000 (Fable 5) and
#2015 (Sonnet 5): where those landed the same catalog change first (Opus 4.8 in Sources, I8-e
unscoping, a sampling-parameter row), this PR keeps main's version and contributes only what
remained novel.
Repo alignment (audit → adversarial verification → fix): every plugin's instruction surfaces
were audited against a 30-item checklist distilled from a verified 451-item inventory of the
guide; every finding was re-adjudicated by independent fresh-context verifiers before any edit.
~55 verified fixes across 21 plugins (each with a version bump and CHANGELOG entry), including:
described the pre-
approvals.jsonapproval model (checkbox-driven TODO.md, writes into theplugin install directory); plus a broken markdown fence-nesting bug in the report template and a
wrong-schema pointer in setup
four files — reconciled to
hook.md's canonical list/model→/effort, missingxhigh, supersededmodel recommendations) corrected per the pack's own supersession-note conventions, verified
against live docs
fix step) gained anti-test-gaming guards (guide: "Avoid focusing on passing tests and
hardcoding")
scope explicitness) and removals of forced status-cadence and fabricated context-percentage
triggers
Downstream capability:
claude-config:audit-instructionscriteria 1.18.0 → 1.19.0: new row I27 (over-aggressivetrigger emphasis / blanket tool defaults — the one guide concern no parallel PR had covered);
I8 base promoted to unscoped via the model-agnostic prefer-general-instructions statement,
with the delegation-throttle worked instance kept
fable-5-scoped (the Opus guides recommendthe opposite shape); I21 gains the calibration-staleness-vs-level-adequacy distinction.
instruction-scan.shnow seeds I27 (both arms) and the existing I25 sampling-parameter row.claude-config:audit-prompting-postures— the additive lane: detects posture guidance(delegation criteria, minimal-scope/anti-test-gaming guardrails, grounding, autonomy/destructive
postures, etc.) that the guide says a component's purpose needs but the component does not
carry; report-only, applicability-predicated, wording fetched live (pointer-not-copy)
docs/OFFICIAL-DOCS.md: new "Prompting doctrine (platform docs)" section indexing the guidepages + Thinking page, composed with feat(evals): align the marketplace with Anthropic's evaluation guidance and ship it to consumers #2014's evaluation-guidance section
Follow-ups worked to completion in this PR (originally filed as issues, then implemented here
on approval instead of being left parked):
claude-config:auditPhase 1 now reads machine-scope managed settings(OS-resolved path +
managed-settings.d/drop-in, structure-only, no-secrets posture); thechecklist tick is restored, now truthful
audit-pass's 892-linerun-contract.mdsplit into five per-topic referencefiles behind a routing index, §-numbering preserved, inbound links repointed, last
history-narration clause reframed
course-digest's two inconsistent self-estimated context-percentage handofftriggers replaced with one qualitative signal set (long/degraded session, compaction, module
boundary); resume protocol untouched
lib/hook-utils.shis the canonical source and CI'shook-utils-syncrequired check already gates every plugin copyAlso swept: the
rhymeskill's latent skill-relativecontext/pat-pattison/mention (same defectthe CI gate caught on its seven edited siblings) is now plugin-root-relative.
Related
🤖 Generated with Claude Code
https://claude.ai/code/session_01LYm1iCn68WiKKsWbP994Co