feat(plugins): align instruction surfaces with the current prompting guide and add the posture-audit lane

docs/CATALOG.md

@@ -72,7 +72,7 @@ plugin manifests and kept in sync by CI — never hand-edit it; the category voc
 
 - [`desktop-notification`](../plugins/desktop-notification) — Alert you when Claude Code needs input — an audible terminal bell, an OSC 9 terminal notification, and an OS-native toast (macOS/Linux) on permission and idle prompts.
 - [`playbooks`](../plugins/playbooks) — Doctrine and knowledge playbooks as on-demand skills, plus a maintainer-facing update skill. boris — Boris Cherny's Claude Code workflow tips (howborisusesclaudecode.com); skill-authoring — Anthropic's internal skill-authoring playbook; fable-5 — Claude Fable 5's operating doctrine (self-authored, no upstream). The boris and skill-authoring packs vendor a verbatim upstream baseline; /playbooks:update drift-checks and syncs those baselines centrally (maintainers).
-- [`claude-config`](../plugins/claude-config) — Six configuration-health skills (plus setup) for a repo's Claude Code configuration: audit (settings.json / .mcp.json / hooks / plugins / permissions drift), audit-automation-gaps (evidence-gated verdicts on automation gaps), audit-permission-grants (allow-rule / allowed-tools grants for auto-mode durability and portability), audit-instructions (locally-owned instruction surfaces vs current model capability — proposes removals/rewrites of instructions the model no longer needs, and detects cross-surface instruction conflicts), audit-pass (one coordinated, ordered, resumable pass over a named target — three-scope inventory, run-time-derived exclusion set, stable finding identity, suppression memory, resume, one human gate — delegating every check to the plugin that owns it), and unhobble (the empirical bare-baseline experiment: reversibly strip a repo's standing instructions, log real stumbles against the current model, re-add only what evidence earns).
+- [`claude-config`](../plugins/claude-config) — Seven configuration-health skills (plus setup) for a repo's Claude Code configuration: audit (settings.json / .mcp.json / hooks / plugins / permissions drift), audit-automation-gaps (evidence-gated verdicts on automation gaps), audit-permission-grants (allow-rule / allowed-tools grants for auto-mode durability and portability), audit-instructions (locally-owned instruction surfaces vs current model capability — proposes removals/rewrites of instructions the model no longer needs, and detects cross-surface instruction conflicts), audit-prompting-postures (the additive lane — posture guidance the prompting guide says a component's purpose needs but the component does not carry), audit-pass (one coordinated, ordered, resumable pass over a named target — three-scope inventory, run-time-derived exclusion set, stable finding identity, suppression memory, resume, one human gate — delegating every check to the plugin that owns it), and unhobble (the empirical bare-baseline experiment: reversibly strip a repo's standing instructions, log real stumbles against the current model, re-add only what evidence earns).
 - [`claude-memory`](../plugins/claude-memory) — Keeps a repo's Claude Code memory layer healthy and under your control, against criteria derived from official Claude Code documentation. The audit skill checks the instruction/memory layer (CLAUDE.md, CLAUDE.local.md, .claude/rules/, auto-memory) with a deterministic script-backed spine plus judgment-tier checks. The stateless skill inspects, disables, and (confirm-gated) purges Claude-written auto memory across all settings scopes.
 - [`claude-ops`](../plugins/claude-ops) — Claude Code operations toolkit. Seven skills: observability (read locally captured telemetry — OTEL store, collector, hook-event JSONL, ccusage — with trend reports and store pruning), known-issues (search known Claude product GitHub bugs, check service health, maintain a persistent tracked-issue registry), changelog (ingest Claude Code changelog entries and integrate them into the current repo), plugins (bring a machine's plugin fleet current on demand — marketplace refresh, effective-scope updates including in-repo project/local installs, new-plugin install per policy, scope-divergence detection and explicit convergence), morning-brief (read-only gh-based operator morning view — queue-label counts, merge-ready PRs, parked decisions with their RECOMMENDED lines, and loop-lane telemetry freshness), lanes (start/restart/stop/status loop lanes as named background Claude Code sessions seeded from canonical prompt files, with per-lane model/effort, a repo-pull + marketplace-refresh launch step, and a consume-restarts action — an OS-schedulable reader that relaunches stopped lanes whose telemetry carries a restart_request), and a re-runnable setup action that settles where the known-issues registry lives. Plus a family of seven advisory *-audit telemetry-emitter hooks (API errors, config changes, instruction loads, permission denials, pre-compaction, skill usage, tool failures) that emit the shared hook-telemetry envelope, and a reference sink that maps envelopes into the hook-events.jsonl the observability skill reads.
 - [`rate-limit-guard`](../plugins/rate-limit-guard) — Shared rate-limit guard for loop lanes: a statusline wrapper tees the subscription rate-limit windows to a fixed machine-scope file, a StopFailure hook records rate-limit stops reactively, and a reader contract fixes how consuming sessions pause and resume.

docs/OFFICIAL-DOCS.md

@@ -99,14 +99,29 @@ SDK-based host.
 | Permission modes | <https://code.claude.com/docs/en/permission-modes> | 2026-08-06 |
 | Environment variables | <https://code.claude.com/docs/en/env-vars> | 2026-08-06 |
 
-## Evaluation guidance (platform docs)
+## Prompting doctrine (platform docs)
 
-The only rows in this index outside `code.claude.com`: this marketplace authors model-graded eval
-fixtures for its skills (see the migration playbook's eval warrant policy) and ships the `evals`
-plugin distilling this guidance, so the platform-side evaluation pages are plugin-relevant here.
-The platform docs' own self-updating master list is
+The instruction text a plugin ships — skill bodies, agent definitions, hook-injected prose,
+embedded sample prompts — is authored against these pages. They live on `platform.claude.com`
+(model behavior), not `code.claude.com` (harness behavior); the platform docs' own self-updating
+master list is
 [`https://platform.claude.com/docs/llms.txt`](https://platform.claude.com/docs/llms.txt).
 
+| Page | Official doc page | Verified date |
+|---|---|---|
+| Prompting best practices (all current models) | <https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-prompting-best-practices> | 2026-08-08 |
+| Prompting Claude Fable 5 | <https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-fable-5> | 2026-08-08 |
+| Prompting Claude Sonnet 5 | <https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-sonnet-5> | 2026-08-08 |
+| Prompting Claude Opus 5 | <https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-opus-5> | 2026-08-08 |
+| Prompting Claude Opus 4.8 | <https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-opus-4-8> | 2026-08-08 |
+| Thinking (adaptive thinking, `display`, disable-rejection set, sampling-param 400 set) | <https://platform.claude.com/docs/en/build-with-claude/thinking> | 2026-08-08 |
+
+## Evaluation guidance (platform docs)
+
+This marketplace authors model-graded eval fixtures for its skills (see the migration playbook's
+eval warrant policy) and ships the `evals` plugin distilling this guidance, so the platform-side
+evaluation pages are plugin-relevant here alongside the prompting-doctrine rows above.
+
 | Page | Official doc page | Verified date |
 |---|---|---|
 | Define success criteria and build evaluations | <https://platform.claude.com/docs/en/test-and-evaluate/develop-tests> | 2026-08-08 |

docs/SKILL-CHEAT-SHEET.md

@@ -139,6 +139,7 @@ owned by [docs/CATALOG-TAXONOMY.md](CATALOG-TAXONOMY.md).
 | [`/claude-config:audit-instructions`](../plugins/claude-config/skills/audit-instructions/SKILL.md) | `claude-config` | Find instructions current models no longer need across CLAUDE.md, rules, and skill bodies |
 | [`/claude-config:audit-pass`](../plugins/claude-config/skills/audit-pass/SKILL.md) | `claude-config` | Run one coordinated, resumable audit pass over a repo with a single human gate |
 | [`/claude-config:audit-permission-grants`](../plugins/claude-config/skills/audit-permission-grants/SKILL.md) | `claude-config` | Audit permission grants for portability and auto-mode durability |
+| [`/claude-config:audit-prompting-postures`](../plugins/claude-config/skills/audit-prompting-postures/SKILL.md) | `claude-config` | Find posture guidance the prompting guide says a component needs but does not carry |
 | [`/claude-config:unhobble`](../plugins/claude-config/skills/unhobble/SKILL.md) | `claude-config` | Strip instructions to a bare baseline, log real stumbles, re-add only what evidence earns |
 | [`/claude-memory:audit`](../plugins/claude-memory/skills/audit/SKILL.md) | `claude-memory` | Audit CLAUDE.md, rules, and auto-memory against the official-docs checklist |
 | [`/claude-memory:stateless`](../plugins/claude-memory/skills/stateless/SKILL.md) | `claude-memory` | Inspect, disable, or purge Claude Code's per-repo auto memory |

plugins/claude-config/.claude-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "claude-config",
-  "version": "0.26.0",
-  "description": "Six configuration-health skills (plus setup) for a repo's Claude Code configuration: audit (settings.json / .mcp.json / hooks / plugins / permissions drift), audit-automation-gaps (evidence-gated verdicts on automation gaps), audit-permission-grants (allow-rule / allowed-tools grants for auto-mode durability and portability), audit-instructions (locally-owned instruction surfaces vs current model capability — proposes removals/rewrites of instructions the model no longer needs, and detects cross-surface instruction conflicts), audit-pass (one coordinated, ordered, resumable pass over a named target — three-scope inventory, run-time-derived exclusion set, stable finding identity, suppression memory, resume, one human gate — delegating every check to the plugin that owns it), and unhobble (the empirical bare-baseline experiment: reversibly strip a repo's standing instructions, log real stumbles against the current model, re-add only what evidence earns).",
+  "version": "0.27.0",
+  "description": "Seven configuration-health skills (plus setup) for a repo's Claude Code configuration: audit (settings.json / .mcp.json / hooks / plugins / permissions drift), audit-automation-gaps (evidence-gated verdicts on automation gaps), audit-permission-grants (allow-rule / allowed-tools grants for auto-mode durability and portability), audit-instructions (locally-owned instruction surfaces vs current model capability — proposes removals/rewrites of instructions the model no longer needs, and detects cross-surface instruction conflicts), audit-prompting-postures (the additive lane — posture guidance the prompting guide says a component's purpose needs but the component does not carry), audit-pass (one coordinated, ordered, resumable pass over a named target — three-scope inventory, run-time-derived exclusion set, stable finding identity, suppression memory, resume, one human gate — delegating every check to the plugin that owns it), and unhobble (the empirical bare-baseline experiment: reversibly strip a repo's standing instructions, log real stumbles against the current model, re-add only what evidence earns).",
   "author": {
     "name": "Melodic Software",
     "email": "info@melodicsoftware.com"

plugins/claude-config/CHANGELOG.md

@@ -3,6 +3,69 @@
 All notable changes to the `claude-config` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.27.0]
+
+### Added
+
+- **New skill `audit-prompting-postures` — the additive lane of prompting-guide alignment.** The
+  existing `audit-instructions` catalog detects instruction text that is present and wrong; nothing
+  detected posture guidance that is absent and needed. The new skill classifies each locally-owned
+  component by purpose (orchestrating, code-changing, long-running, destructive-capable, …) and
+  judges ten guide-prescribed postures (`reference/postures.md`: delegation criteria/caps,
+  minimal-scope, anti-test-gaming, investigate-before-answering, progress-claim grounding,
+  autonomy/checkpoint, destructive-action confirmation, context-budget reassurance, multi-window
+  state, parallel-call steering) against applicability predicates, defaulting to NOT-APPLICABLE.
+  Report-only; proposal wording comes from a live fetch of the guide, never from the catalog
+  (pointer-not-copy).
+- **`audit-instructions`: catalog row I28 — over-aggressive trigger emphasis and blanket tool
+  defaults** (criteria 1.20.0 → 1.21.0). Detects forced-compliance emphasis ("CRITICAL: You MUST
+  use…") and blanket tool defaults ("If in doubt, use [tool]") — unscoped, sourced to the
+  best-practices page's Tool-usage, Overthinking, and Migration sections, fenced for
+  destructive-gate emphasis and stated hard preconditions. `instruction-scan.sh` now seeds it
+  (`I28-a` case-sensitive emphasis, `I28-b` blanket defaults) and also seeds the existing I25
+  sampling-parameter row (`temperature`/`top_p`/`top_k` prescriptions).
+
+### Changed
+
+- **`audit-instructions`: I8 base (over-prescriptive scaffolding) is now unscoped** (criteria
+  1.20.0 → 1.21.0) via the model-agnostic best-practices statement ("Prefer general instructions
+  over prescriptive steps…"); the delegation-throttle worked instance keeps its own `fable-5`
+  scope because the Opus 5 and Opus 4.8 guides recommend the opposite shape (caps) on their
+  targets. **I21** gains a sentence separating calibration staleness (its subject) from level
+  adequacy (the Opus 4.8 guide's `xhigh` recommendation for coding and agentic lanes, which is
+  the surface's sizing decision).
+- **`setup` and `audit-pass` prose carry their reasoning.** `setup`'s read-only instruction is
+  stated as what the check does rather than as a bare prohibition, and its repo-root anchoring rule
+  now says why a CWD-relative read is wrong (it resolves a different — or missing — file depending
+  on the invoking subdirectory or worktree). Five passages in `audit-pass`'s run contract that
+  narrated the authoring session's own history are restated as present-tense rejected-alternative
+  rationale, keeping the anti-relitigation content.
+- **`audit`'s Phase 4 report table carries a worked example row**, so a model generating the report
+  has a concrete shape to match rather than a bare header.
+- **`audit-pass`: the 892-line run contract is split per topic.** `reference/run-contract.md` is
+  now a routing index over five topic files that follow the contract's own section structure —
+  `terms.md`, `finding-identity.md` (§1), `report-location-and-schema.md` (§2, §7),
+  `run-state-and-resumability.md` (§3, §5), `suppression.md` (§4), `determinism-tiers.md` (§6) —
+  so a lane needing one mechanic loads that file, not the whole contract. Content moved verbatim,
+  the §-numbering travels with it, inbound links repointed to the owning files, and the one
+  remaining authoring-history clause is restated in present tense.
+
+### Fixed
+
+- **`audit` now actually covers machine-scope managed settings, closing the false coverage claim
+  its checklist made.** Phase 1's `check-structure.sh` resolves the OS-specific managed-settings
+  path (macOS `/Library/Application Support/ClaudeCode/`, Linux/WSL `/etc/claude-code/`, Windows
+  `%ProgramFiles%\ClaudeCode\`; the pre-v2.1.75 ProgramData location deliberately unprobed) and
+  reports the file and its `managed-settings.d/` drop-in directory structure-only — same
+  no-secrets posture as `settings.local.json` — with the Config Files table naming the layer as
+  report-only routing that `--fix` never edits. The checklist's "+ managed settings" tick is
+  restored, now truthful. Paths verified against the live settings doc 2026-08-08.
+- **`audit-automation-gaps`' checklist replaced two unmeasurable thresholds with the real gate.**
+  "cost > 2× expected benefit" and "false-positive risk > 30% on representative sample" appeared
+  only in the template; neither cost, benefit, nor a representative sample is defined or measured
+  anywhere in the skill. The three anti-noise ticks fold into one that points at SKILL.md §2.3's
+  eight named gates, each of which states the evidence it requires.
+
 ## [0.26.0]
 
 ### Added

plugins/claude-config/skills/audit-automation-gaps/templates/checklist.md

@@ -11,9 +11,7 @@ Copy into your working task notes. Tick as each phase completes.
 
 ## Anti-noise doctrine (applied throughout Phase 2)
 
-- [ ] Skip candidate if implementation cost > 2× expected benefit
-- [ ] Skip candidate if false-positive risk > 30% on representative sample
-- [ ] Skip candidate if same concern already enforced higher up the hierarchy
+- [ ] Each candidate cleared every quality gate in SKILL.md §2.3, with the required evidence cited
 
 ## Skip criteria
 

plugins/claude-config/skills/audit-instructions/SKILL.md

@@ -19,7 +19,7 @@ locally-owned instruction surfaces, cites each finding to current official promp
 it by how confident the evidence can be, and packages proposed removals or rewrites as a human-gated
 diff — so instruction surfaces shrink as models get better instead of only ever growing.
 
-The check catalog — the checks I1–I27, their evidence tier, authority tag, severity, per-surface
+The check catalog — the checks I1–I28, their evidence tier, authority tag, severity, per-surface
 applicability, and the `OPINION`-tier enablement policy — lives in
 [reference/criteria.md](reference/criteria.md); the deterministic pre-scan is
 `${CLAUDE_PLUGIN_ROOT}/skills/audit-instructions/scripts/instruction-scan.sh`.
@@ -46,7 +46,7 @@ concerns its siblings already cover — route rather than re-answer:
   against doctrine; unhobble measures the *model*.
 
 On **memory-layer surfaces** (CLAUDE.md, CLAUDE.local.md, `.claude/rules/`, `~/.claude/rules/`),
-this skill runs only the model-era checks I6–I27. It never runs or reports the hygiene checks
+this skill runs only the model-era checks I6–I28. It never runs or reports the hygiene checks
 I1–I5 (line-necessity, length, placement, inferable content, rule-to-hook) on these surfaces —
 that instruction-memory hygiene layer belongs to the `claude-memory` plugin. When that plugin is
 installed, route memory-layer hygiene to its `audit` skill; when it is not installed, emit a single
@@ -272,8 +272,10 @@ assumptions, whose phrasings are too varied for a pattern that would earn its fa
 `I8-e` forced interim-status cadence is likewise unseeded, but on a narrower ground — its skeleton is
 patternable, and it waits only on an attested instance to calibrate the interval forms against), I23
 (self-estimated context-budget phrasing — the budget clause alone, never the stop/summarize/hand-off
-verb it licenses, which routinely sits in a different sentence), and I27 (effort-for-brevity: an
-effort-lowering directive paired with a brevity token on one line); `--count` prints the row count.
+verb it licenses, which routinely sits in a different sentence), I25 (retired sampling parameters),
+I27 (effort-for-brevity: an effort-lowering directive paired with a brevity token on one line), and
+the I28 families (`I28-a` forced-compliance emphasis, case-sensitive; `I28-b` blanket tool
+defaults); `--count` prints the row count.
 Advisory — a grep cannot judge whether a rationale is genuinely present, whether a restraint clause
 is a reporting gate, whether a budget mention is a directive or the counter-steer against one, or
 which model a row targets, so the lane refines every candidate against the catalog's fences and the