fix(claude-config): let unhobble classify and trim hybrid hook entries

[kyle-sexton]

No linked issue

Summary

Aligns the unhobble skill's classification contract with the hybrid hook rubric merged in #2033 — the follow-up promised on that PR's codex thread. Previously a hook entry carrying both a policy gate and behavioral prose could only be over-stripped (wiring removed whole) or over-kept, contradicting the rubric's trim-not-delete rule.

Fix

• Phase 1 adds the hybrid class per hook entry, delegating the rubric itself (mechanism vs class, trim-not-delete, ground-truth-oracle carve-out) to PLUGIN-PHILOSOPHY "Classifying a hook" rather than restating it.
• Phase 2: a hybrid entry's behavioral surface strips via the hook's own kill switch or config where one exists; otherwise the entry stays wired and is recorded unstripped-hybrid-hook with the observe-phase confound noted. Wiring is never removed whole.
• Manifest classification enum gains hybrid.
• claude-config 0.27.2 → 0.27.3 with changelog.

Verification

Docs-contract change only (no scripts); catalog/cheat-sheet regeneration produced no diff; changelog-parity satisfied by the stacked 0.27.3 entry.

Related

Refs #2033 (the rubric this aligns to; its codex P2 thread is the finding), #2021 (the audit whose hybrid rows motivated the rule).

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 38s —— View job

---

Security Review

• Gather context (diff, changed files)
• Review plugins/claude-config/.claude-plugin/plugin.json
• Review plugins/claude-config/CHANGELOG.md
• Review plugins/claude-config/skills/unhobble/SKILL.md
• Post findings

No security issues found.

This PR is a docs/prose-only change to the unhobble skill's classification contract, plus a version bump and changelog entry:

• plugins/claude-config/.claude-plugin/plugin.json — version bump 0.27.2 → 0.27.3 only. No manifest schema fields with security implications (permissions, MCP servers, hooks) were touched.
• plugins/claude-config/CHANGELOG.md — additive changelog prose, no code.
• plugins/claude-config/skills/unhobble/SKILL.md — adds a hybrid classification value to the skill's documented rubric and expands Phase 1/Phase 2 prose describing how a hybrid hook entry should be trimmed rather than deleted whole. This is instructional prose consumed by the model at skill-invocation time, not executable code: no shell commands, no scripts, no changes to allowed-tools/frontmatter, no workflow files, no secrets or tokens handled.

There is no code execution path, no injection surface (command/SQL/path/template), no credential handling, and no GitHub Actions workflow in the diff. Nothing here falls under CI-static-tool coverage either (no unpinned actions, no permission changes, no trigger changes) since no workflow files are touched.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 90590760aa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 2m 53s —— View job

---

Review: PR #2067 — unhobble hybrid hook classification

• Gather context (diff, CLAUDE.md, PLUGIN-PHILOSOPHY "Classifying a hook")
• Review plugins/claude-config/skills/unhobble/SKILL.md changes
• Review plugin.json version bump and CHANGELOG.md
• Post findings

Summary

This is a docs-contract-only change (no scripts/schemas), consistent with CLAUDE.md's fresh-docs mandate for contract surfaces — it correctly cites and defers to PLUGIN-PHILOSOPHY's "Classifying a hook" section (docs/PLUGIN-PHILOSOPHY.md:498-527) rather than restating the rubric, and I confirmed that section does define hybrid as policy+behavioral with a "trim, never delete whole" remedy, matching what's added here. Version bump (0.27.2 → 0.27.3) and CHANGELOG.md entry are properly formatted and match the plugin's existing Keep-a-Changelog / semver conventions.

Finding (inline)

Left one inline comment on SKILL.md (lines 81–101): Phase 1 declares hybrid a classification value that applies uniformly across every surface type ("hooks, rules, instruction files, ... and project-enabled plugins alike"), then delegates the classification rubric to PLUGIN-PHILOSOPHY's "Classifying a hook" section — which is explicitly scoped to hooks only (its own text says "score every wired hook entry," and its mechanism axis — deny-gate/context-injection/deterministic-transform/notification-infra — is hook-specific vocabulary with no clear analogue for a rule file or skill). Phase 2 backs this up: only hook entries get an operationalized hybrid trim path (lines 114–118); tracked instruction files only branch on behavioral/mixed (no hybrid case), and the plugins bullet still uses separate mixed/unstripped-mixed-plugin language where plugins are kept whole rather than trimmed (structurally can't be trimmed, per that bullet's own note) — in tension with hybrid's stated "trimmed, never removed whole" remedy if it's meant to generalize to plugins.

Given the PR title/description frame this as specifically about "hybrid hook entries," this may just need the Phase 1 language narrowed to say the hybrid rubric (and its philosophy-doc citation) applies to hook entries, while other surface types keep using the plain policy/behavioral/convention/mixed vocabulary that Phase 2 already operationalizes for them.

No other correctness, error-handling, or maintainability issues found in the reviewed diff. Security posture (kill-switch-first remediation, policy residue never dropped) is unchanged and out of this lane's scope.

[github-actions]

Claude has reviewed this PR 3 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[claude]

Claude finished @kyle-sexton's task in 59s —— View job

---

Security Review: PR #2067

• Gather context (gh pr diff, changed files)
• Review plugins/claude-config/.claude-plugin/plugin.json
• Review plugins/claude-config/CHANGELOG.md
• Review plugins/claude-config/skills/unhobble/SKILL.md
• Post findings

No security issues found.

All three changed files are non-executable, docs-contract content:

• plugin.json — version bump 0.27.2 → 0.27.3 only. No changes to permissions, hooks, MCP servers, or any other security-relevant manifest field.
• CHANGELOG.md — additive prose changelog entry, no code or scripts.
• SKILL.md — adds a hybrid classification value and expands Phase 1/Phase 2 prose describing how the unhobble skill (an audit/experiment workflow that reversibly disables a target repo's instruction surfaces) should trim a hybrid hook entry rather than deleting it whole. This is instructional prose read by the model at skill-invocation time:
  • No new shell commands, scripts, or executable payloads are introduced.
  • No allowed-tools/frontmatter/permission fields changed.
  • No workflow files touched, so no pull_request_target/workflow_run/permissions:/action-pin surface applies.
  • The described mechanism (strip via "the hook's own kill switch or config," else leave wired and record unstripped-hybrid-hook) is fail-safe by construction: the documented default on ambiguity is to keep wiring, not remove it — consistent with the existing policy-preservation posture and introducing no new authorization or data-egress surface.

There is no injection surface (command/SQL/path/template), no credential or token handling, and no trust-boundary change in this diff. Out of scope for this security lane (already covered by other review threads on this PR): whether the hybrid rubric's scope/wording is internally consistent across hooks vs. rules/skills/plugins (a correctness/completeness question, not a security one) — see the existing Codex and Claude review-comment threads on this PR for that discussion.

[kyle-sexton]

Both findings fixed in 99f9c89: the rubric delegation is now scoped to hook entries (non-hook surfaces classify by the class definitions, with hybrid applying to any in-place-splittable unit), and a kept-whole mixed plugin's behavioral/hybrid hooks can now be individually stripped via the plugin's own per-hook kill switches where exposed — recorded as a partial strip with the prior value for restore, else unstripped-hybrid-hook.

[claude]

Claude finished @kyle-sexton's task in 4m 22s —— View job

---

Code Review: PR #2067 — hybrid hook classification

• Gather context (diff, CLAUDE.md, PLUGIN-PHILOSOPHY "Classifying a hook")
• Review plugins/claude-config/skills/unhobble/SKILL.md changes
• Review plugin.json version bump and CHANGELOG.md
• Post findings

Summary

This is a docs-contract-only change, and the second commit (99f9c89) does resolve the two prior review threads on 9059076: the hook-classification rubric is now explicitly delegated to PLUGIN-PHILOSOPHY's "Classifying a hook" section for hook entries specifically (SKILL.md:86-90), and a hybrid/behavioral hook nested inside a kept-whole mixed plugin now gets an individual per-hook-kill-switch strip path (SKILL.md:127-132) rather than being silently kept loaded with no remediation attempt. Version bump (0.27.2 → 0.27.3) and the CHANGELOG.md entry follow the plugin's existing Keep-a-Changelog/semver conventions.

Two inline findings, both narrower recurrences of the same scope-mismatch class the prior review round raised — the fix commit closed it for the two cases the PR title/description name (hook rubric delegation, plugin-nested hooks) but the surrounding prose still has two loose ends:

1. SKILL.md:90-92 — Phase 1 still lets non-hook surfaces (rule files, skills, agents) classify hybrid, but Phase 2's "Tracked instruction files" bullet only operationalizes behavioral/mixed, never hybrid — so that classification has nowhere to act for those surface types.
2. SKILL.md:127-132 — the new per-hook fallback tags a plain-behavioral hook (no per-hook switch) as unstripped-hybrid-hook, conflating it with the genuinely-hybrid case that term was defined for.

Cross-file, not anchorable to a changed line: evals/evals.json isn't touched by this PR, but the PR adds a new judgment-bearing classification value (hybrid) plus two new Phase-2 decision branches (hook-level trim-via-kill-switch, and the per-hook carve-out inside a kept-whole mixed plugin). None of the 11 existing eval cases exercise any of these — eval 9 (mixed-plugin-kept-whole) covers only the pre-existing whole-plugin-kept case. Per PLUGIN-PHILOSOPHY's warrant rule (docs/MIGRATION-PLAYBOOK.md:304) and "Evals outlive instructions" (docs/PLUGIN-PHILOSOPHY.md:487-490), this skill already carries a judgment-bearing behavioral contract and an eval set — worth adding at least one case for the hybrid-hook trim path and the per-hook-kill-switch-inside-a-kept-plugin path before this class of decision drifts unverified.

Security review is out of this lane's scope (already covered by the security-review comments above — no issues found there).

[kyle-sexton]

Both fixed in the follow-up commit: tracked files gained the hybrid branch (operationalizes like the mixed split; the classes differ in the residue, not the mechanics), and the no-switch fallback now records by class — unstripped-behavioral-hook vs unstripped-hybrid-hook — so the manifest distinguishes whether any of the hook is legitimately loaded.

[claude]

Claude finished @kyle-sexton's task in 47s —— View job

---

Security Review: PR #2067 (HEAD bfd38c9)

• Gather context (git diff origin/main HEAD, changed files)
• Review plugins/claude-config/.claude-plugin/plugin.json
• Review plugins/claude-config/CHANGELOG.md
• Review plugins/claude-config/skills/unhobble/SKILL.md
• Post findings

No security issues found.

All three changed files remain non-executable, docs-contract content at the current HEAD (bfd38c9):

• plugin.json — version bump 0.27.2 → 0.27.3 only. No changes to permissions, hooks, MCP server entries, or any other security-relevant manifest field.
• CHANGELOG.md — additive prose changelog entry, no code or scripts.
• SKILL.md — expands the hybrid classification and its Phase 2 remediation for hook entries, tracked instruction files, and hooks nested in a kept-whole mixed plugin. Reviewed the latest changes specifically:
  • No new shell commands, scripts, or executable payloads.
  • No allowed-tools/frontmatter/permission fields changed.
  • No workflow files touched — no pull_request_target/workflow_run/permissions:/action-pin surface applies.
  • The new per-hook kill-switch mechanism (<hook>_enabled-style userConfig flip, SKILL.md:127-133) only disables behavior via the plugin's own existing config surface — it introduces no new write path, no arbitrary command execution, and no privilege change. The documented default on ambiguity (no per-hook switch) is still to keep wiring loaded and record the confound, not silently drop it — consistent with the prior fail-safe posture.
  • The manifest enum change (hybrid classification) is a descriptive/audit-trail value only; it doesn't alter what data is read, written, or transmitted.

There is no injection surface (command/SQL/path/template), no credential or token handling, and no trust-boundary change in this diff. This lane's scope is security only — the correctness/completeness questions raised in the other review threads on this PR (rubric scope, unstripped-hybrid-hook vs unstripped-behavioral-hook labeling, eval coverage) are out of scope here and already tracked there.

[claude]

Claude finished @kyle-sexton's task in 2m 37s —— View job

---

Code Review: PR #2067 — hybrid hook classification

• Gather context (diff, CLAUDE.md, PLUGIN-PHILOSOPHY "Classifying a hook")
• Review plugins/claude-config/skills/unhobble/SKILL.md changes
• Review plugin.json version bump and CHANGELOG.md
• Check eval coverage for new hybrid decision branches
• Post findings

Summary

Reviewed the full cumulative diff (gh pr diff 2067, all 3 commits vs origin/main) against docs/PLUGIN-PHILOSOPHY.md §"Classifying a hook" (docs/PLUGIN-PHILOSOPHY.md:498-527), which I fetched fresh to confirm the delegation text is accurate — it correctly reflects the mechanism/class axes, the hybrid trim-not-delete rule, and the ground-truth-oracle carve-out with no drift from the source.

The three scope-mismatch findings raised by Codex and the prior Claude review rounds on commit 9059076 all read as resolved by the follow-up commits:

• The hook-classification rubric delegation is now explicitly scoped to hook entries (SKILL.md:86-90), with non-hook surfaces classifying by the plain inline definitions instead.
• Tracked instruction files now have an operationalized hybrid branch (SKILL.md:114-116), not just behavioral/mixed.
• The unstripped-hybrid-hook vs. plain-behavioral mislabeling is fixed — the per-hook fallback now branches on the hook's own class (unstripped-behavioral-hook vs. unstripped-hybrid-hook, SKILL.md:133-136).
• Codex's plugin-provided-hook gap is addressed too: a hybrid/behavioral hook nested in a kept-whole mixed plugin can now be individually stripped via its own per-hook kill switch (SKILL.md:129-132).

Version bump (0.27.2 → 0.27.3) and the CHANGELOG.md entry are correctly formatted and match this plugin's existing Keep-a-Changelog/semver conventions; the manifest classification enum referenced in the PR description is the documented enum in SKILL.md:65 (there's no separate machine-readable schema file for manifest.json in this skill to keep in sync).

One inline finding posted (naming/vocabulary consistency, non-blocking).

Cross-file finding — not anchorable to a changed line:

evals/evals.json is untouched by this PR (confirmed via the changed-files list and git diff — it isn't one of the 3 modified files). This PR adds a new judgment-bearing classification value (hybrid) plus three new Phase-2 decision branches: the hook-level kill-switch trim (SKILL.md:118-122), the tracked-instruction-file hybrid split (SKILL.md:114-116), and the per-hook carve-out inside a kept-whole mixed plugin (SKILL.md:129-136). None of the existing 11 eval cases exercise any of these — eval 9 (mixed-plugin-kept-whole) only covers the pre-existing whole-plugin-kept case, with no hybrid hook inside it and no kill-switch present. Per this repo's own "Evals outlive instructions" principle (docs/PLUGIN-PHILOSOPHY.md:487-490) and the warrant rule (docs/MIGRATION-PLAYBOOK.md:304), a judgment-bearing behavioral contract change like this should generally add at least one eval case covering the new decision path before it ships, so the hybrid-trim behavior doesn't drift unverified. (This was already flagged as author-context in an earlier automated review round on this PR; repeating it here since it's still true at the current HEAD and squarely in this lane's test-coverage focus.)

No other correctness, error-handling, or maintainability issues found in the reviewed diff. Security posture is out of this lane's scope (already covered by the security-review comments above — no issues found there).

[kyle-sexton]

Fixed — the plugin bullet now names the class (hybrid), notes "mixed" as the older strip-plan term for the same class, and keeps the unstripped-mixed-plugin manifest label for continuity.

[claude]

Claude encountered an error after 1s —— View job

---

I'll analyze this and get back to you.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31320002154
• Failure class: rate-limit
• Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":1004,"total_cost_usd":0,"api_error_status":429,"class":"rate-limit"}

Re-run the job to retry the review. A new push does not re-trigger this lane.
An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator (auth).