fix(songwriting): adjudicate form, song-forms, process, and co-writing against Writing Better Lyrics chapters 20-24 + appendix

[kyle-sexton]

Continues the per-chapter source-fidelity pass. Chapters 20-24 and the
Appendix of Writing Better Lyrics (2009) read in full — Chapter 20 with its
figure, Chapter 21 across all four of its split spine items, Chapter 24 with
both of its figures. This finishes Book 2. Paraphrase only; no chapter
prose, example writes, or student work reaches this public repository.

Two scopes, two commits, two version bumps: 0.8.1 (Ch 20-23 vs
song-forms.md / form.md) and 0.8.2 (Ch 24 + Appendix vs process.md /
co-writing.md / the co-write opener template).

The main finding

song-forms.md carried a late-appended block that restated the Chapter 22
and 23 repair strategies and got four of the six wrong — each one
contradicting the correct statement earlier in the same file:

Strategy	The block said	The chapter says
Ch 22 repair 3	Give four verses four different jobs	Merge two verses into one that shifts internally — two verses result
Ch 22 repair 2	"Same content," recast structurally	Change structure and the kind of information
Ch 23 alt 2	Verse three still builds normally	The bridge replaces the third verse
Ch 23 alt 1 → 3	Convert to AABA by dropping the third verse	Convert to AABA precisely so all three verse ideas survive

The first is the consequential one: a writer following it keeps the
v/v/ch/v/v/ch shape that Chapter 22 exists to dismantle. The fourth inverts
the condition that selects the form.

Each repair now states its resulting form explicitly, so the two descriptions
in the file cannot silently drift apart again.

Also fixed

• "Four times is a lot." was attributed to Essential Guide to Lyric Form
  and Structure (1991) Chapter 6 and labelled a paraphrase. It is verbatim
  from Writing Better Lyrics (2009) Chapter 22. The claim that the 1991
  chapter shares the warning is left standing but flagged unverified — that
  chapter has not been read yet.
• "Im(potent) Packages" parenthesised the wrong half of Pat's pun.

Added

Five claims the files were missing, all checked against the chapters:

• form.md — Pattison names both readings of form-follows-function: on one
  section it is prosody, on two compared sections it is contrast. The
  mechanics were present; the link to the plugin's own prosody vocabulary was
  not.
• form.md — the musical-bar mechanism behind the "Years" chorus. The stress
  arithmetic (6 and 6) was there, but the prosody is in the setting: both
  groups get four bars, so three phrases occupy the space two had and the final
  phrase compresses to one bar exactly where the lyric says time moves fastest.
• form.md — a contrast-audit caution from the "Southern Comfort" chorus:
  three-stress phrases and a "3+" opening can look like contrast while still
  leaning toward the verse's common meter.
• song-forms.md — an AABA song's last system is bridge/verse, not a lone
  verse (Ch 23); diagnose an unearned return across the whole B-to-final-A unit.
• song-forms.md — the cost Ch 23 attaches to its first alternative: returning
  to a full verse before the last chorus can still read as long.

Checked and found correct

form.md's Chapter 20/21 coverage is otherwise accurate — the balance rule
keeps its two qualifiers, the four balance jobs match, the "Exercises to
preserve" list already carries Ch 20's Exercise 44 and Ch 21's three-verse
condition. phrasing.md and bridge.md were checked and needed no change.
The image-inventory claims are now verified rather than assumed: Ch 20 links
image_rsrcAUG (a verse/chorus rhyme-column comparison), and Chapters 21-23
link no images.

Chapter 24 + Appendix (0.8.2)

The Appendix finding is an attribution one. The No-Free-Zone method was
credited to Pat throughout co-writing.md and the printable session opener. It
is Stan Webb's — he taught it to Pat in Pat's first professional co-write,
and the Appendix thanks him by name. Pat carried it into Berklee and added two
of the four rules (stay inside the song; no technical talk). Both files now
credit Webb.

Two more in the same area:

• The opener collapsed Webb's two distinct rules into one. "Say everything"
  and "nobody says no / silence means more" do different jobs; merging them
  left "write crap" occupying a numbered slot as though it were a third rule
  rather than the encouragement attached to the first two.
• co-writing.md contradicted itself on solo application — one section
  says two of four rules apply when writing alone, another says all four. The
  Appendix supports the looser reading, so the disagreement is now stated with
  its evidence instead of left for a reader to hit.

Chapter 24 contributed material that existed nowhere in the plugin: five named
rhyme-rejection criteria (including the "seems to mean more than it conveys"
clunker test), the rule that the rhyming syllable must carry primary rather
than secondary stress, pattern lock as a named failure mode (the chapter's
bridge came out in the verses' meter on autopilot, and it catches itself
borrowing a specific Paul Simon bridge), and the form option that lost —
dumping a verse is tested first and rejected on cause.

image_rsrcAUJ.jpg turned out to be load-bearing: the prose lists the
worksheet's five column headings and nothing under them, so the columns exist
only in the figure — which independently confirms the
one-undifferentiated-column-per-core-word layout that 0.7.4 established in
worksheets.md.

Verification

typos, markdownlint-cli2, lychee --offline --include-fragments (729 links,
0 errors), validate-plugins.sh, and check-changelog-parity.sh (--check,
--check-order, --check-bump origin/main) all pass. Context-file and
template only, so the skill-quality gate does not apply.

Two review findings on the earlier commits were fixed in place: a P2 where a
new contrast note asserted an "eight lines" verse count that collided with an
emphatic seven-phrase claim in song-forms-examples.md (the 2009 and 1991
books genuinely read that verse two ways, so the note now asserts neither
count), and a P3 bare surname that broke this file's title-only attribution
convention.

Plugin bumped to 0.8.1 then 0.8.2. A 0.8.0 landed on main mid-branch
(the skill frontmatter name removal); this branch was renumbered accordingly
and main was merged in, so the gates above were re-run after the merge.

Related

No linked issue — this is a turn of the standing per-chapter source-fidelity
pass over the Pattison context files.

• fix(songwriting): adjudicate worksheets.md against Writing Better Lyrics chapters 2, 4, 5 #2093 (0.7.4, Chapters 2/4/5), fix(songwriting): adjudicate prosody.md against Writing Better Lyrics chapters 18-19 #2071 (0.7.3, Chapters 18-19), fix(songwriting): adjudicate meter.md against Writing Better Lyrics chapters 14-17 #2063 (0.7.2,
  Chapters 14-17) — prior turns of the same pass.
• Plugin cache is keyed by version number, so post-install commits under the same version are invisible #2061 — plugin cache is keyed by version number, not commit; until it is
  fixed, testing 0.8.2 in a running session needs an
  uninstall/install/enable cycle.

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 51s —— View job

---

Security review complete

• Gather context (diff, changed files)
• Review changed files for security issues
• Report findings

Scope reviewed (gh pr diff 2114, all 4 changed files):

• plugins/songwriting/.claude-plugin/plugin.json — version bump only (0.7.4 → 0.7.5)
• plugins/songwriting/CHANGELOG.md — new changelog entry (prose)
• plugins/songwriting/context/pat-pattison/research/form.md — added prose paragraphs
• plugins/songwriting/context/pat-pattison/research/song-forms.md — corrected/expanded prose

Findings

None. This PR is a content-fidelity correction to static Markdown reference material (songwriting craft notes) plus a corresponding version bump and changelog entry. There is:

• No code execution path, script, or hook touched.
• No GitHub Actions workflow, permissions:, or CI config touched.
• No .mcp.json, tool definition, or skill frontmatter/contract surface touched — only prose bodies.
• No secrets, tokens, credentials, URLs, or external references introduced.
• No user-controllable input flows into these files; they are static context consumed by the plugin.
• No injection surface (command, SQL, path, template) — the diff is plain Markdown text about song-form repair strategies and citation corrections.

I also checked the new prose for anything that could function as a prompt-injection payload against a future agent reading this context file (since these files are consumed by Claude as skill context); the added text is ordinary craft-book paraphrase content with no embedded instructions directed at an AI reader.

No security concerns to report for this PR.

Branch: fix/song-forms-chapters-20-23

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d1c09bde12

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 3m 47s —— View job

---

Claude's Review Progress

• Gather context (PR body, diff, changed files)
• Read changed files in full
• Verify claims against chapters/context (where feasible)
• Check CLAUDE.md / AGENTS.md alignment
• Post inline findings (if any)
• Post final summary

Summary

This is a documentation/content-fidelity PR (song-forms.md, form.md, CHANGELOG.md, plugin.json version bump). No code, hooks, or plugin-manifest contract surface is touched, so the fresh-docs mandate in CLAUDE.md doesn't apply here — correctly self-scoped by the author as "Context-file-only pass."

What I checked:

• Internal arithmetic/consistency of the restated repair diagrams. song-forms.md adds explicit Result: diagrams to the "Four times is a lot" and "Third-system risk" repair lists (L537-572). I traced each diagram's section count against the original v/v/ch/v/v/ch and v/ch/v/ch/v/ch risk shapes. One diagram (v / v / ch / v / ch / br / ch at L545) looked like it had an extra ch at first glance, but it turns out to be copied verbatim from the file's own pre-existing, unmodified "V/V/Ch Risk Repair" section (L63-67) — exactly the drift-prevention goal the PR states. Not a defect introduced by this diff.
• Cross-references (prosody.md link in form.md) resolve to an existing file.
• CHANGELOG ↔ diff ↔ PR-body consistency: the [0.7.5] entry's Fixed/Added bullets match the actual diff content and the version bump (0.7.4 → 0.7.5) in plugin.json, and follow the existing changelog's heading/format conventions (no dates, matches prior entries).
• AABA and "Third-system risk" additions are consistent with the diagrams and prose already in the file — no contradictions introduced.

What I could not verify: the substantive claims of book fidelity (e.g., that Chapter 22/23 actually say what the corrected text now says, the "Years"/"Southern Comfort" musical-bar and stress-count details) depend on the Writing Better Lyrics (2009) source text itself, which I don't have access to. Those are author-claimed per the PR's described chapter-reading process, not independently confirmed by me — flagging per review instructions rather than treating the author's verification as my own.

No blocking issues found. No inline comments posted — nothing in the changed lines rose to a confirmed correctness defect after tracing the structural diagrams and cross-file references. One non-blocking style note: the new Result: diagrams use inline code spans while the file's earlier "V/V/Ch Risk Repair" section uses fenced ```text blocks for the same kind of section-shape diagram — a minor presentation inconsistency, not a lint failure (author reports markdownlint-cli2 passing, which I did not re-run myself in this environment).

[github-actions]

Claude has reviewed this PR 5 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[claude]

Claude finished @kyle-sexton's task in 45s —— View job

---

Security review complete

• Gather context (gh pr diff 2114, all 4 changed files)
• Review changed files for security issues
• Report findings

Scope reviewed (diff against origin/main, HEAD cba0037):

• plugins/songwriting/.claude-plugin/plugin.json — version bump only (0.7.4 → 0.7.5)
• plugins/songwriting/CHANGELOG.md — new [0.7.5] prose entry
• plugins/songwriting/context/pat-pattison/research/form.md — added prose paragraphs
• plugins/songwriting/context/pat-pattison/research/song-forms.md — corrected/expanded prose, one mislabelled citation fixed

Findings

None. Every changed line is static Markdown reference prose (songwriting craft/repair-strategy notes) plus a version bump and matching changelog entry — there is no executable surface in this diff.

Specifically checked and ruled out:

• No code, hooks, or scripts touched — nothing in .claude/hooks, no shell, no JS/TS.
• No GitHub Actions workflow touched — no permissions:, pull_request_target, workflow_run, or run:/github context changes (zizmor's advisory lane covers this class of risk statically for workflow files anyway; N/A here since none changed).
• No .mcp.json, tool definition, or skill frontmatter/contract surface touched — only prose bodies inside two existing context files.
• No secrets, tokens, credentials, or new external URLs/references introduced. The only URLs present were already in the repo (keepachangelog.com, the JSON Schema Store manifest URL, both pre-existing and unchanged).
• No injection surface (command, SQL, path, template) — nothing in this diff is interpreted as code or a path at runtime.
• Prompt-injection check on the new context-file prose, since form.md/song-forms.md are loaded as skill context for a future agent session: the added paragraphs are ordinary paraphrased craft-book content (verse/chorus/bridge repair strategies, citation corrections) with no embedded directives, no instructions addressed to an AI reader, and no attempt to alter tool-use behavior.
• plugin.json version bump is a plain semver string change with no schema or permission implications.

No security concerns to report for this PR. (Note: a Codex bot comment flags a possible content-accuracy discrepancy in the Southern Comfort verse-phrase count in form.md — that's a book-fidelity/content question, not a security issue, and is out of scope for this review.)

Branch: fix/song-forms-chapters-20-23

[claude]

Claude finished @kyle-sexton's task in 4m 3s —— View job

---

Claude's Review Progress

• Gather context (PR diff, changed files)
• Read changed files in full
• Verify Codex's Southern Comfort phrase-count finding
• Check internal consistency of new claims (form.md, song-forms.md)
• Check CLAUDE.md / AGENTS.md alignment
• Post inline findings (if any)
• Post final summary

Summary

Content/prose-only PR against song-forms.md and form.md, plus a matching CHANGELOG.md entry and plugin.json version bump (0.7.4 → 0.7.5). No hook, manifest, or skill-frontmatter contract surface is touched, so the fresh-docs mandate in root CLAUDE.md correctly doesn't apply — the author self-scoped this right as "Context-file-only pass."

Codex's P2 finding (Southern Comfort verse-count collision): already resolved. It was raised against commit d1c09bd, and the very next commit (cba0037) removed the colliding "eight lines" claim and replaced it with an explicit note that Chapter 20 (2009) and the 1991 book's Chapter 6 read the same verse two different ways, instructing the reader to cite whichever book is in hand rather than merge the counts. Confirmed by reading the current form.md (lines 198–212) against song-forms-examples.md (lines 61–68, "Seven phrases of Common Meter... NOT eight").

What I independently checked beyond the two prior Claude passes and Codex:

• Traced every repair-strategy diagram newly added at the end of song-forms.md (the v/v/ch/v/ch, v/v/ch/v/ch/br/ch, v/ch/v/ch triple, and the Three-System-Risk v/ch/v/ch/br/v/ch / v/ch/v/ch/br/ch pair) against the pre-existing, unmodified diagrams earlier in the same file (V/V/Ch Risk Repair and Three-System Verse/Chorus Risk). All match verbatim — the stated goal ("so the two descriptions... cannot silently drift apart again") holds.
• Checked the new "last system is bridge/verse, not a lone verse" AABA note (song-forms.md#L243-L251) against the Limerick-principle section's "A returns" framing (L500-L504) and the AABA verse/refrain Option 3 diagram (L139-L147). The new text explicitly frames itself as a system-level (vs. section-level) count and is consistent with the file's existing use of "system" as a functional pairing (verse+chorus elsewhere) — not a contradiction.
• Verified plugin.json version (0.7.5) matches the new CHANGELOG.md heading, and confirmed both prosody.md and song-forms-examples.md (the two new relative links added in form.md) exist in the same directory.
• Confirmed CHANGELOG.md's Fixed/Added bullets match the actual diff content.

New finding posted inline (form.md:247, P3): the new "Years" bar-mechanism paragraph refers to the songwriter as "Chapman" with no antecedent anywhere in form.md — every other worked example in this file (including "Years" itself, two paragraphs earlier) is referenced by song title only, never by artist surname. The full name only exists in a different, independently-loaded context file (phrasing.md). Minor clarity/maintainability issue, not a factual error.

Not independently verified (no environment access to run them in this sandbox — same limitation the second prior Claude pass noted): typos, markdownlint-cli2, lychee, validate-plugins.sh, and check-changelog-parity.sh. These are author-claimed as passing in the PR body; I was blocked from re-running them here (script/npx invocations required approval that wasn't grantable in this session). If re-verification of those is wanted, --allowedTools would need to permit direct script execution.

No blocking correctness issues found.
· Branch: fix/song-forms-chapters-20-23

[claude]

Claude finished @kyle-sexton's task in 1m 0s —— View job

---

Security review complete

• Gather context (gh pr diff 2114, all 4 changed files)
• Review changed files for security issues
• Report findings

Scope reviewed (gh pr diff 2114, HEAD 18ba7bc):

• plugins/songwriting/.claude-plugin/plugin.json — version bump only (0.7.4 → 0.7.5)
• plugins/songwriting/CHANGELOG.md — new [0.7.5] prose entry
• plugins/songwriting/context/pat-pattison/research/form.md — added prose paragraphs
• plugins/songwriting/context/pat-pattison/research/song-forms.md — corrected/expanded prose, one mislabelled citation fixed

Findings

None. Every line in this diff is static Markdown reference prose (songwriting craft/repair-strategy notes) plus a version bump and matching changelog entry — there is no executable surface here.

Specifically checked and ruled out:

• No code, hooks, or scripts touched.
• No GitHub Actions workflow touched — no permissions:, triggers, or run: blocks changed (out of scope for this diff regardless; zizmor's advisory lane covers that class statically).
• No .mcp.json, tool definition, or skill frontmatter/contract surface touched — only prose bodies inside two existing context files.
• No new URLs, secrets, tokens, or credentials introduced. The only relative links added (form.md → prosody.md, song-forms-examples.md) resolve to existing files in the same directory; searched both changed files for http(s)://, script tags, and shell-invocation patterns — the only hits were incidental matches on the word "system"/"System" (Pattison's own terminology), nothing else.
• No injection surface (command, SQL, path, template) — nothing in this diff is interpreted as code or a path at runtime.
• Prompt-injection check on the new context-file prose, since form.md/song-forms.md are loaded as skill context for a future agent session: the added paragraphs are ordinary paraphrased craft-book content (form-follows-function, chorus prosody, repair-strategy corrections) with no embedded directives, no instructions addressed to an AI reader, and no attempt to alter tool-use behavior.
• plugin.json version bump is a plain semver string change with no schema or permission implications.

No security concerns to report for this PR.

Branch: fix/song-forms-chapters-20-23

[claude]

Claude finished @kyle-sexton's task in 2m 56s —— View job

---

Claude's Review Progress

• Gather context (PR diff against merge-base 30be2a0, matches PR's stated 124/-20 across 4 files)
• Read changed files in full (song-forms.md, form.md, CHANGELOG.md, plugin.json)
• Review correctness and CLAUDE.md alignment
• Post inline findings
• Post final summary

Summary

This lane covers correctness/architecture/maintainability; security is out of scope here (already cleared by the security lane in this thread). Content is prose-only against two existing context files plus a matching CHANGELOG.md entry and plugin.json version bump (0.7.4 → 0.7.5) — no hook, manifest, or skill-frontmatter contract surface is touched, so CLAUDE.md's fresh-docs mandate correctly doesn't apply, matching the author's own "Context-file-only pass" framing.

Both prior review findings on this PR are now resolved in the current HEAD (18ba7bc):

• Codex's P2 (Southern Comfort verse-count collision) — fixed in cba0037, replacing the merged "eight lines" claim with an explicit note that the two books read the verse two ways and shouldn't be merged. Confirmed against current form.md:206-211.
• Claude's P3 (bare "Chapman" surname with no antecedent) — fixed in 18ba7bc, reworded to "The song gives both groups the same four bars," matching the file's title-only attribution convention everywhere else. Confirmed against current form.md:247.

Independently re-checked (not just re-reading prior passes' conclusions):

• Traced both restated repair-strategy blocks in song-forms.md (L537-549, L563-576) line-by-line against the file's own earlier, unmodified V/V/Ch Risk Repair and Three-System Verse/Chorus Risk sections. All six restated items now agree with the earlier canonical description.
• Confirmed the new relative links (prosody.md, song-forms-examples.md) resolve to files that exist in the same directory.
• Confirmed no other file in the plugin (including .claude-plugin/marketplace.json) pins the songwriting plugin's version, so the plugin.json bump needs no companion update.
• Confirmed CHANGELOG.md's new [0.7.5] entry follows the same no-date, ### Fixed/### Added structure as the surrounding [0.7.4]/[0.7.3] entries, and its bullets match the actual diff.

New finding (posted inline, non-blocking): the "late-appended block" this PR fixes (song-forms.md:537-549) still duplicates content that lives in full earlier in the same file rather than referencing it. Adding explicit Result: diagrams makes future manual cross-checking easier but doesn't remove the two-places-for-one-fact structure that let four of six items drift wrong in the first place — worth a follow-up to fold one block into a reference to the other. The PR correctly scoped itself to the content fix rather than this structural cleanup, so this is not blocking.

Not independently re-run in this sandbox: typos, markdownlint-cli2, lychee, validate-plugins.sh, check-changelog-parity.sh — script execution required approval that wasn't grantable in this environment (same limitation a prior pass on this PR hit). These remain author-claimed and unverified by me; treat their "all pass" status in the PR body accordingly.

No blocking issues found.
· Branch: fix/song-forms-chapters-20-23

[claude]

Claude finished @kyle-sexton's task in 1m 3s —— View job

---

Security review complete

• Gather context (gh pr diff, all 4 changed files, checked for new commits since prior reviews)
• Review changed files for security issues
• Report findings

Scope reviewed (HEAD 7313192, merge-base a013d20):

• plugins/songwriting/.claude-plugin/plugin.json — version bump only
• plugins/songwriting/CHANGELOG.md — new prose entry
• plugins/songwriting/context/pat-pattison/research/form.md — added prose paragraphs
• plugins/songwriting/context/pat-pattison/research/song-forms.md — corrected/expanded prose

What changed since the last security review (at 18ba7bc)

The current HEAD (7313192) is a merge of origin/main into this branch. Diffing the four changed files against 18ba7bc shows:

• form.md and song-forms.md — byte-identical, no new content.
• plugin.json — version renumbered from 0.7.5 to 0.8.1 (merge conflict resolution: this branch's 0.7.4→0.7.5 bump reconciled against main's independent 0.8.0 bump from #2104). Plain semver string, no schema/permission implications.
• CHANGELOG.md — the [0.7.5] heading was renumbered to [0.8.1], and main's [0.8.0] entry (unrelated: dropping a redundant skill-frontmatter name field) now sits above it. No new prose content from this PR's own changes.

No functional or content changes were introduced by the merge itself — it's a pure version-bump reconciliation.

Findings

None. Every changed line remains static Markdown reference prose (songwriting craft/repair-strategy notes) plus a version bump and matching changelog entry — no executable surface in this diff.

Specifically checked and ruled out (consistent with the prior four security passes on this PR):

• No code, hooks, or scripts touched.
• No GitHub Actions workflow touched — no permissions:, triggers, or run: blocks changed.
• No .mcp.json, tool definition, or skill frontmatter/contract surface touched — only prose bodies in two existing context files, plus a plain version-string bump.
• No secrets, tokens, credentials, or new external URLs/references introduced. Only pre-existing links (relative prosody.md/song-forms-examples.md, keepachangelog.com, the JSON Schema Store manifest URL).
• No injection surface (command, SQL, path, template).
• Prompt-injection check on the prose (these files load as skill context for a future agent): ordinary paraphrased craft-book content, no embedded directives or AI-targeted instructions.

No security concerns to report for this PR.

Branch: fix/song-forms-chapters-20-23

[claude]

Claude finished @kyle-sexton's task in 1m 59s —— View job

---

Claude's Review Progress

• Gather context (diff against origin/main at HEAD 7313192, matches PR's stated 124/-20 across 4 files)
• Read changed files in full (song-forms.md, form.md, CHANGELOG.md, plugin.json)
• Review correctness and CLAUDE.md/AGENTS.md alignment
• Post inline findings
• Post final summary

Summary

Content/prose-only PR against two existing context files (song-forms.md, form.md) plus a matching CHANGELOG.md entry and a plugin.json version bump. No hook, manifest, or skill-frontmatter contract surface is touched, so CLAUDE.md's fresh-docs mandate correctly doesn't apply — matches the author's own "Context-file-only pass" framing. Security is out of scope for this lane (already cleared by the security lane in this thread).

What changed since the last review pass on this PR (18ba7bc): only a merge of origin/main (a013d20, the unrelated frontmatter-name removal from plugin skills) plus the resulting rebase of the version bump from 0.7.5 to 0.8.1 (since main had already advanced to 0.8.0). The content of song-forms.md and form.md is byte-identical to what was already reviewed and found sound. I independently re-verified the rebase itself rather than trusting it:

• Confirmed origin/main's current plugin.json is at 0.8.0 and its CHANGELOG.md has a matching [0.8.0] entry — 0.8.1 is the correct next version, not a collision.
• Confirmed the new [0.8.1] entry sits above [0.8.0] in CHANGELOG.md (correct reverse-chronological order) and its Fixed/Added bullets still match the diff content.
• Re-confirmed the two prior findings on this PR are still resolved in current content: Codex's Southern Comfort verse-count collision (form.md:206-211) and the earlier "Chapman" bare-surname finding (form.md:247).
• Re-traced both restated repair-strategy blocks in song-forms.md (L537-549, L563-576) line-by-line against the file's own earlier, unmodified V/V/Ch Risk Repair (L47-83) and Three-System Verse/Chorus Risk (L100-151) sections. All six restated items still agree with the earlier canonical description; the fixes hold.
• Confirmed all relative links added in this diff (prosody.md, song-forms-examples.md) resolve to files that exist in the same directory, and that no other file (including .claude-plugin/marketplace.json) pins this plugin's version, so the bump needs no companion update.

Standing non-blocking note (carried over, not new): the restated repair blocks in song-forms.md (L537-549, L563-576) still duplicate content that lives in full earlier in the same file rather than referencing it — a structural point already raised on this PR and correctly left out of scope by the author, who fixed the content mismatch rather than the underlying duplication.

No new issues found; no inline comments posted this pass — the only change since the last review is an unrelated merge commit and its consequent version-bump rebase, both verified correct above.

Not independently run in this sandbox: typos, markdownlint-cli2, lychee, validate-plugins.sh, check-changelog-parity.sh — remain author-claimed and unverified by me (no tooling available in this environment to execute them without additional approval).

No blocking issues found.

Branch: fix/song-forms-chapters-20-23

[claude]

Claude finished @kyle-sexton's task in 1m 1s —— View job

---

Security review complete

• Gather context (git diff a013d20...5fbfdde, all 7 changed files)
• Review changed files for security issues
• Report findings

Scope reviewed (HEAD 5fbfdde, merge-base with origin/main at a013d20):

• plugins/songwriting/.claude-plugin/plugin.json — version bump only (0.8.0 → 0.8.2)
• plugins/songwriting/CHANGELOG.md — new [0.8.1]/[0.8.2] prose entries
• plugins/songwriting/context/pat-pattison/research/form.md, song-forms.md — already covered by five prior security passes on this PR; byte-identical to what was reviewed then
• plugins/songwriting/context/pat-pattison/research/co-writing.md (+54/-8) — new since last review
• plugins/songwriting/context/pat-pattison/research/process.md (+59/-3) — new since last review
• plugins/songwriting/context/pat-pattison/templates/co-write-session-opener.md (+30/-14) — new since last review

What's new since the last security pass (at 7313192)

Commit a8713a7 (the Chapter 24 + Appendix work) added changes to co-writing.md, process.md, and the co-write-session-opener.md template, followed by a merge commit (5fbfdde) reconciling the version bump to 0.8.2. I read all three new/changed files in full plus their diffs.

Findings

None. Every changed line across all 7 files is static Markdown reference prose (co-writing methodology, rhyme-rejection criteria, session-opener template text) plus a version bump and matching changelog entries — no executable surface anywhere in this diff.

Specifically checked and ruled out for the three newly-touched files:

• No code, hooks, or scripts touched.
• No GitHub Actions workflow touched.
• No .mcp.json, tool definition, or skill frontmatter/contract surface touched — co-write-session-opener.md is a plain prose template (a printable session-opener script for human co-writers), not a skill/hook definition; its frontmatter is unchanged.
• No secrets, tokens, credentials, or URLs introduced — grepped all three files for https?://, <script, javascript:, data:text and found zero matches.
• No injection surface (command, SQL, path, template) — nothing in this diff is interpreted as code or a path at runtime.
• Prompt-injection check on the new prose, since these files load as skill context for a future agent session: the added text is ordinary paraphrased craft-book content (attribution correction to Stan Webb, rhyme-rejection criteria, a "pattern lock" failure mode, session-opener rule text) with no embedded directives, no instructions addressed to an AI reader, and no attempt to alter tool-use behavior. The session-opener template's imperative-sounding lines ("Say everything...", "No technical talk while drafting...") are explicitly human-facing session-ritual copy meant to be read aloud by co-writers, not agent instructions, and are unchanged in kind from the pre-existing template.
• plugin.json version bump (0.8.0 → 0.8.2) is a plain semver string change with no schema or permission implications; confirmed no other file pins this plugin's version.

No security concerns to report for this PR.

Branch: fix/song-forms-chapters-20-23

[claude]

Claude finished @kyle-sexton's task in 3m 38s —— View job

---

Claude's Review Progress

• Gather context (diff against origin/main, HEAD 5fbfdde, matches PR's stated 327/-45 across 7 files)
• Read changed files in full (co-writing.md, process.md, co-write-session-opener.md, plus the previously-reviewed song-forms.md/form.md/CHANGELOG.md/plugin.json)
• Review correctness and CLAUDE.md/AGENTS.md alignment
• Post inline findings
• Post final summary

Summary

This pass covers the 0.7.6/0.8.2 scope (co-writing.md, process.md, co-write-session-opener.md) that hadn't been reviewed by this lane yet — the 0.8.1 scope (song-forms.md, form.md) was already covered in earlier passes on this thread and is unchanged since (confirmed byte-identical against the last-reviewed commit). Content/prose-only PR against context files, a template, a changelog entry, and a version bump (0.8.0 → 0.8.2 after the origin/main merge). No hook, manifest, or skill-frontmatter contract surface is touched, so CLAUDE.md's fresh-docs mandate correctly doesn't apply. Security is out of scope for this lane (already cleared repeatedly by the security lane in this thread).

New finding (posted inline): co-writing.md:29-30 says Pat's contribution to the No-Free-Zone method was "adding one rule of his own (§ Stay inside the song)." That contradicts the same file's own "four rules" section 141 lines later (line 170, also new in this diff): "Rules 3 and 4 are Pat's addition to Stan Webb's original two." Every other surface this PR touches agrees on two rules — CHANGELOG.md ("added two rules of his own (stay inside the song; no technical talk)") and co-write-session-opener.md:7-9 ("rules 3 and 4 below are Pat's addition"). Only the Core-idea sentence undercounts it and silently drops "no technical talk" from what's credited to Pat.

Independently checked, no issues found:

• Traced the image_rsrcAUJ.jpg "load-bearing" claim in process.md:9-15 against worksheets.md's existing one-undifferentiated-column-per-core-word description — consistent, no contradiction.
• Verified all new cross-references resolve: meter.md, worksheets.md, form.md, prosody.md, stable-unstable-meta.md, title-game.md, title-game-prompt.md all exist in their referenced locations.
• Checked the numbered-rule mechanics in co-write-session-opener.md — the "collapsed two rules into one" fix the PR describes is actually applied: rule 1 (say everything) and rule 2 (nobody says no) are now split, and "write crap" sits as an unnumbered addendum under rule 2 rather than occupying its own numbered slot, matching the PR body's description.
• Checked process.md's "Form alternatives" section: the new "which option won and lost" paragraph is consistent with the pre-existing (unmodified) bullet list and "second verse" rationale — the combine-verses-3-and-4 option becoming "the second verse" of the reduced v/v/ch/v/ch/br/ch shape checks out.
• Confirmed plugin.json (0.8.2) matches the new CHANGELOG.md [0.8.2] heading and sits above the pre-existing [0.8.1]/[0.8.0] entries in correct reverse-chronological order.
• Traced the co-writing.md "Inner critic operating under No-Free Zone" vs. "Solo applications" reconciliation (lines 205-217 vs. 270-278) the PR body describes — the new paragraph correctly identifies and resolves the disagreement in favor of the Appendix's looser reading. Non-blocking side note: § Solo applications's own parenthetical ("the other two (silence-means-keep-going; yes advances the line) are co-write-only") only glosses Rule 2's text and never actually names Rule 3 ("stay inside the song") — a pre-existing wording gap this PR didn't introduce and doesn't need to fix, since the rule count still resolves correctly by elimination (4 rules total, 2 named explicitly).

Not independently run in this sandbox: typos, markdownlint-cli2, lychee, validate-plugins.sh, check-changelog-parity.sh — script execution required approval that wasn't grantable in this environment. These remain author-claimed and unverified by me.

One blocking-adjacent correctness issue found (see inline comment) — everything else checked out clean.
· Branch: fix/song-forms-chapters-20-23

[claude]

Claude finished @kyle-sexton's task in 1m 17s —— View job

---

Security review complete

• Gather context (git diff origin/main...HEAD, all 7 changed files, diff since last security pass at 5fbfdde)
• Review changed files for security issues
• Report findings

Scope reviewed (HEAD de8d9e6, merge-base with origin/main at a013d20, matches PR's stated 329/-45 across 7 files):

• plugins/songwriting/.claude-plugin/plugin.json — version bump only (0.8.0 → 0.8.2)
• plugins/songwriting/CHANGELOG.md — new [0.8.1]/[0.8.2] prose entries
• plugins/songwriting/context/pat-pattison/research/co-writing.md, form.md, process.md, song-forms.md — prose corrections/expansions
• plugins/songwriting/context/pat-pattison/templates/co-write-session-opener.md — prose template edits

What's new since the last security pass (at 5fbfdde)

Only one commit: de8d9e6, touching co-writing.md only (+6/-4 lines). It reconciles a correctness issue flagged by the code-review lane on this same thread — the attribution paragraph said Pat added "one rule of his own" where the file's own four-rule section, the changelog, and the template all say two. The fix rewords the sentence to say "adding rules 3 and 4 below — stay inside the song, and no technical talk," resolving the internal contradiction. Confirmed via git show de8d9e6: pure prose edit, no structural or reference changes.

Findings

None. Every changed line across all 7 files remains static Markdown reference prose (songwriting craft/repair-strategy notes, co-writing methodology, session-opener template text) plus a version bump and matching changelog entries — no executable surface anywhere in this diff, consistent with all six prior security passes on this PR.

Re-verified for this final commit specifically:

• No code, hooks, or scripts touched.
• No GitHub Actions workflow touched.
• No .mcp.json, tool definition, or skill frontmatter/contract surface touched.
• No secrets, tokens, credentials, or URLs introduced — grepped all six non-JSON changed files for https?://, <script, javascript:, data:text, eval(, exec(: zero matches except the file's own pre-existing keepachangelog.com boilerplate link in CHANGELOG.md, unrelated to this diff's content.
• No injection surface (command, SQL, path, template).
• Prompt-injection check on the reworded prose: the new sentence is ordinary attribution/correction text ("adding rules 3 and 4 below — stay inside the song, and no technical talk") with no embedded directives or AI-targeted instructions.
• plugin.json version bump (0.8.0 → 0.8.2) is a plain semver string change with no schema or permission implications; confirmed no other file pins this plugin's version.

No security concerns to report for this PR.

Branch: fix/song-forms-chapters-20-23