Skip to content

fix(songwriting): adjudicate phrasing, song-forms, bridge, and exercises against Essential Guide to Lyric Form and Structure chapters 1, 2, and 6 - #2155

Merged
kyle-sexton merged 7 commits into
mainfrom
fix/book1-chapters-1-2-6
Aug 10, 2026
Merged

fix(songwriting): adjudicate phrasing, song-forms, bridge, and exercises against Essential Guide to Lyric Form and Structure chapters 1, 2, and 6#2155
kyle-sexton merged 7 commits into
mainfrom
fix/book1-chapters-1-2-6

Conversation

@kyle-sexton

@kyle-sexton kyle-sexton commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Opens Book 1. Essential Guide to Lyric Form and Structure (1991)
Chapters 1, 2, and 6 read in full with every figure, plus Chapter 5's
bridge and song-system span read to adjudicate two attributions.

Book 2 is complete (0.8.2). This is the first pass over Book 1, and it settles
both claims the previous pass had to leave standing — both turned out to be
wrong.

The two parked claims

"Four times is a lot" was credited to 1991 Chapter 6 as a shared warning.
It is 2009's alone. Chapter 6 never discusses V/V/Ch/V/V/Ch, never counts
verses, and never names four. Its related-but-different claim is about
pattern-size monotony — running one structural pattern too long "gets boring
fast," remedy a bridge — which he makes twice, once for AABA and once for
verse/chorus. song-forms.md now scopes the warning to Writing Better
Lyrics
(2009), Chapter 22 and states what 1991 actually says instead.

"Southern Comfort" was read as seven phrases with the eighth withheld. The
verse has eight, rhyming x a x a x a b b, and the eighth arrives. It
refuses the three-stress common-meter close and the rhyme resolution the first
seven set up — that refusal is the Deceptive Closure. Nothing is withheld in
phrase count.

That also dissolves the standoff 0.8.2 recorded in form.md. 2009 Chapter
20's "two complete common-meter systems" and 1991 Chapter 6 both read eight;
they differ only in vocabulary (extra stress in the final phrase vs. deceptive
closure). The instruction to cite one book and not merge the counts is removed
rather than re-hedged.

Why the error survived

song-forms.md recorded 1991 Chapter 6 as having no linked images. It has
37, and they carry the argument — the chapter's entire scansion and
rhyme-column analysis lives in figures while the prose trails off at dangling
colons ("…the seventh phrase only continues the pattern:"). A text-only audit
of this chapter will miscount phrases. The image inventory now says so.

The same falsehood was sitting in form.md for Chapter 5, which has 32.
Both are fixed. form.md's entry also now records that Chapter 5 has not been
read in full, so claims sourced to it are not mistaken for verified.

Book 1 runs ~6× Book 2's figure density. Chapter 1 alone had three
dangling-colon sites whose content exists only in images.

Other fixes

  • The three bridge functions were cited to Chapter 5; they are Chapter 6's.
    Book 1 carries two different bridge lists and the plugin had merged their
    labels. Chapter 5 gives a five-point characterization of what a bridge is;
    Chapter 6 gives three purposes that adding one accomplishes. bridge.md
    now records both and says which to cite for what.
  • "Different-size system" had been relocated from the song system to the
    bridge.
    The claim is about the song system's size, and Pat's word is
    different, not shorter: in verse/chorus a short bridge shrinks the last
    system, but in verse/refrain and AABA the bridge-plus-final-verse system is
    longer than the verse-only ones. bridge.md and song-forms-examples.md
    had it as the bridge's own phrase count — which contradicted form.md, where
    it was already correct.
  • phrasing.md stated Chapter 1's spotlight use twice and got it wrong the
    second time.
    The early section is right (the balancing position is the last
    phrase of an even section; stopping is what spotlights). The appended block
    said the balance shift is the spotlight — that is Chapter 1's third use,
    not its first. Fourth file found with this correct-early/wrong-late shape,
    after song-forms.md and co-writing.md.
  • The even/odd balance rule shipped without either of Pattison's own
    overrides.
    Nesting rescues an odd count (the five-phrase "Fathers and Sons"
    verse seems balanced because two short phrases add up to one long one);
    closure behavior unbalances an even one ("Southern Comfort" at eight). Applied
    mechanically the bare rule misdiagnoses both of his examples.
  • Acceleration and deceleration were an exclusive choice. "Slow Healing
    Heart" speeds up, returns to pace, then slows; Pattison says explicitly that
    more than one blank gets filled.
  • "The spotlight effect is multiplicative, not additive" is invented. He
    says the surprise phrase spotlights both lines, especially the last.
  • Chapter 2's exercises were missing entirely. exercises.md claims to
    preserve Chapters 1-7 but ran 1, 2, 3, 4 then jumped to 8. The gap is exactly
    Chapter 2's three. Added Ex 5-7, generalized in the style of Ex 1-4.
    (Corroboration: five-compositional-elements.md states the book has 44
    exercises.)
  • Two doubled-year headings left by a mechanical title substitution.

Three small additions: odd sections can balance each other in pairs; the
reversal test (swap a verse pair, see if the push survives); and the
Common Meter / Ballad Stanza half of Chapter 6's paired form mapping.

What was considered and NOT changed

  • bridge.md's "must serve at least one, often all three" is left alone.
    Pat's "It would accomplish three things" describes what a bridge does for
    that lyric, not a requirement on every bridge. Tightening it to "all three"
    would be generalizing past the evidence in the opposite direction.
  • Two suspected omissions were false positives, killed by reading the
    destination file end to end
    — the bridge-sourcing method is already at
    song-forms.md:304,434, and the limerick/ABAB material is already at
    song-forms.md:170-180,375-386,492-502.
  • phrasing.md's duplicated taxonomy blocks are not collapsed here. Same
    restructuring-vs-content-fix split the fix(songwriting): adjudicate form, song-forms, process, and co-writing against Writing Better Lyrics chapters 20-24 + appendix #2114 reviewer scoped as a follow-up;
    it joins that item.
  • bridge.md:39 attaches the four-times risk to V/Ch/V/Ch (two verses),
    contradicting song-forms.md. Real, but 2009-sourced — not a Book 1 finding,
    so it is carried as a follow-up rather than smuggled in here.

Verification

typos ✅ · markdownlint ✅ 0 errors / 103 files · lychee ✅ 0 errors (exit
checked, not tail-piped) · check-changelog-parity --check-bump origin/main
· validate-plugins.sh ✅. No SKILL.md body changed, so check-skill.sh is not
required.

changelog-parity-gate fails in CI and I believe the gate is at fault, not
this changelog
— see the two comments on this PR. Short version: #2154 landed
a rewritten gate two minutes after this branch's first run passed; the failing
--check-bump reaches the heading check through rendered_lines - (stdin)
while --check, which passed in the same job on the same file, reaches it
through rendered_lines "$1" (file path). That one line is the whole
difference, and it affects every plugin bump, not just this one. The same
command passes locally on the identical tree. Not worked around and not patched
from here.

check-changelog-parity.sh also hangs locally under Git Bash (--check-order
before #2154, --check as well after it) — on clean main too, so it is a
local MSYS issue. Order and uniqueness verified by hand: 0.8.3 → 0.8.2 → 0.8.1
→ 0.8.0 → 0.7.4 …, no repeated version.

The typos gate again rejected hyphenated mis- prefixes (mis-count,
mis-diagnoses), as it did on mis-transcribed previously — closed forms used.

Scope

Book 1 Chapters 3, 4, 7 and the bulk of Chapter 5 remain unread; they hit
meter.md, prosody.md, the rhyme files, and hook.md — a disjoint file set,
so they belong in a separate pass. exercises.md also skips Ex 32-33
(Chapter 5); left alone until Chapter 5 is read in full.

Figure counts for the rest of Book 1, measured while fixing the two false
inventories: Chapter 3 has 59, Chapter 4 has 40, Chapter 7 has 27.
Chapter 3 is the meter chapter, so the next pass is figure-heavy by definition.

Related

No linked issue

…ses against Essential Guide to Lyric Form and Structure chapters 1, 2, and 6

Opens Book 1. Chapters 1, 2, and 6 read in full with every figure, plus
Chapter 5's bridge and song-system span. Settles the two claims the 0.8.2
pass had to leave standing, both of which turned out to be wrong.

"Four times is a lot" is 2009's warning alone; 1991 Chapter 6 never counts
verses. "Southern Comfort" has eight verse phrases, not seven with an eighth
withheld -- the eighth arrives and refuses the expected close, which is what
makes it a Deceptive Closure. That also dissolves the form.md standoff: both
books read eight, differing only in vocabulary.

song-forms.md had recorded Chapter 6 as having no linked images. It has 37,
and the chapter's entire scansion argument lives in them -- which is how the
seven-phrase error survived a previous pass.

Also: the three bridge functions are Chapter 6's, not Chapter 5's (Book 1
carries two different bridge lists); "different-size system" belongs to the
song system, not the bridge; phrasing.md's appended block restated Chapter 1's
spotlight use and got it wrong where the earlier section had it right; the
even/odd balance rule shipped without either of Pattison's own overrides; and
Chapter 2's three exercises were missing from a file claiming to preserve
Chapters 1-7.

Paraphrase only. No chapter prose, example lyrics, or exercise answers.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@cursor

cursor Bot commented Aug 10, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@claude

claude Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 4m 7s —— View job


Review complete

Scope: the 9 changed files (plugin.json version bump, CHANGELOG.md, and the 7 context/pat-pattison/research/*.md content files). This lane covers correctness/consistency per CLAUDE.md; security is out of scope here (no code, hooks, or manifests with security surface changed — only a version string and prose research content).

  • Gather context
  • Read repo CLAUDE.md / AGENTS.md guidelines
  • Fetch full diff (gh pr diff 2155)
  • Review each changed content file for internal/cross-file consistency
  • Check CHANGELOG.md and plugin.json version bump consistency
  • Post findings

Note on the fresh-docs mandate: this PR only edits prose bodies of skill-context research files plus a version bump — no plugin manifest schema, hook contract, or skill/subagent frontmatter field changed — so the mandate's contract-surface scope doesn't apply here.

Finding — form.md's bridge-functions section still cites the chapter this PR says is wrong

form.md#L525-L543

This PR's own thesis is that the three bridge functions (break monotony / different-size system / new perspective) belong to Essential Guide to Lyric Form and Structure (1991) Chapter 6, not Chapter 5 — and it corrects that attribution in bridge.md (now "Three bridge functions (... Chapter 6)"), song-forms.md, and song-forms-examples.md. But form.md was also touched in this PR (the "Southern Comfort" phrase-count fix), and its separate "Bridge — three functions" section at L525-543 was left unchanged:

  • L527: *Essential Guide to Lyric Form and Structure* (1991), Chapter 5 names three jobs a bridge can do.
  • L543: > "A bridge isn't a verse." — Pat (... Chapter 5)

Before this PR, bridge.md and form.md agreed (both said Chapter 5). After this PR, they actively disagree — bridge.md:39 even now explicitly says "Do not confuse this list with Chapter 5's" — so a reader bouncing between the two files sees a direct contradiction the PR itself introduces. The Function 2 wording in form.md's table ("Insert a non-matching unit between matching units") is also the pre-fix framing the PR replaced elsewhere with the system-level explanation (a bridge shorter than a verse makes the song system shorter, not "the bridge's own phrase count"), and the same form.md cross-reference is what bridge.md:166 and song-forms-examples.md:170 still point readers to for "three bridge functions origin."

Since this is content the PR's own diff didn't touch, it can't be verified as intentionally out-of-scope the way the PR body's "What was considered and NOT changed" section explains other deferrals — it reads like an oversight in an otherwise very thorough pass. Worth a follow-up (or a quick addition to this PR) updating form.md L525-543 to match Chapter 6 and the corrected Function 2 description.

Fix this →

Everything else checked out

  • plugin.json version bump (0.8.2 → 0.8.3) matches the new CHANGELOG.md [0.8.3] entry; format follows the existing Keep a Changelog / ### Fixed / ### Added convention.
  • The "Southern Comfort" eight-phrase correction is applied consistently across form.md, phrasing.md, song-forms.md, and song-forms-examples.md — no other stale "seven phrases" references remain.
  • The "four times is a lot" rescoping to Writing Better Lyrics (2009) Ch. 22 is applied consistently in song-forms.md (both the top pull-quote and the "V/V/Ch/V/V/Ch risk" section).
  • exercises.md's new Ex 5-7 fill exactly the pre-existing Ex-5-7 numbering gap (the file already jumped from Ex 4 straight to Ex 8) — no renumbering collision, and the intro line correctly attributes Ex 1-4 to Chapter 1 / Ex 5-7 to Chapter 2.
  • The known, intentionally-deferred items called out in the PR body (Ex 32-33 gap, phrasing.md's duplicated taxonomy blocks, bridge.md:39's 2009-sourced V/Ch/V/Ch contradiction) are genuinely out of this PR's diff and correctly left alone.
  • I did not independently run typos, markdownlint, lychee, or the changelog-parity scripts — the PR body's verification results are author-claimed and unverified by me.

@claude

claude Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 1m 13s —— View job


Security review complete

  • Gather context (PR diff, changed files)
  • Review changed files for security issues (injection, secrets, access control, GitHub Actions risk)
  • Post findings

No security issues found.

All 9 changed files are non-executable content/metadata:

  • plugins/songwriting/.claude-plugin/plugin.json — version bump only (0.8.20.8.3)
  • plugins/songwriting/CHANGELOG.md — prose changelog entry
  • 7 files under plugins/songwriting/context/pat-pattison/research/*.md — Markdown research notes (song-form/lyric-theory content) with corrected attributions and added exercises

There are no GitHub Actions workflow changes, no scripts, no .mcp.json/hook/config changes, no dependency or permission changes, and no secrets/tokens/credentials touched by this PR. The plugin manifest change is a version string only. Since the diff contains no code execution paths, no external data ingestion, and no trust-boundary changes, there is no injection surface, authorization surface, or supply-chain risk to evaluate here — this PR is out of scope for this security lane by content, not by omission.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2d19e2ed44

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread plugins/songwriting/context/pat-pattison/research/bridge.md
Comment thread plugins/songwriting/context/pat-pattison/research/bridge.md Outdated
Comment thread plugins/songwriting/context/pat-pattison/research/exercises.md Outdated
@github-actions

github-actions Bot commented Aug 10, 2026

Copy link
Copy Markdown

Claude has reviewed this PR 5 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

…aded consumer

Addresses three review findings on #2155.

"Different-size song system" said the final system gets shorter. That holds
for verse/chorus, where systems 1 and 2 are verse-to-chorus and a short bridge
shrinks system 3. It is backwards for verse/refrain and AABA, where the bridge
groups with the last verse and makes that system LONGER than the verse-only
ones before it. Pat's word is "different"; only the direction is form-specific,
and what arrives early there is the final verse, not the system's end.

The Chapter 5 -> Chapter 6 attribution and the phrase-count reading of
function 2 had survived in form.md and bridge-writing-prompt.md, which
/songwriting:song-form bridge loads alongside bridge.md. A single invocation
would have supplied contradictory sourcing and diagnostics. Also corrected in
audit-checklist.md and audit-checklist-prompt.md, found by sweeping for the
same attribution rather than only the files the review named.

Exercise 5 asserted that any honest four-section sample contains a mixed-speed
section. The writer picks the sections, so nothing guarantees it, and the
assertion pressures inventing a change that is not there. Multiple labels are
now permitted rather than required.

Two more caught by the same sweep: form.md attributed "A bridge isn't a verse"
to 1991 Chapter 5, but the phrase is absent from Book 1's text layer and
song-forms.md and bridge-writing-prompt.md both source it to 2009 Chapter 23.
And response-filter.md said V/V/Ch/V/V/Ch runs the chorus four times; it runs
the verse four times and the chorus twice.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@claude

claude Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 55s —— View job


Security review complete

  • Gather context (PR diff via gh pr diff 2155, changed files)
  • Review changed files for security issues (injection, secrets, access control, GitHub Actions risk)
  • Post findings

No security issues found.

All 13 changed files at HEAD d6000f9 are non-executable content/config:

  • plugins/songwriting/.claude-plugin/plugin.json — version bump only (0.8.20.8.3)
  • plugins/songwriting/CHANGELOG.md — prose changelog entry
  • 11 files under plugins/songwriting/context/pat-pattison/{research,templates}/*.md — Markdown research notes and prompt templates (song-form/lyric-theory content), correcting bridge-chapter attributions and propagating that correction across every jointly loaded consumer (bridge.md, form.md, song-forms.md, song-forms-examples.md, phrasing.md, exercises.md, five-compositional-elements.md, audit-checklist.md, response-filter.md, audit-checklist-prompt.md, bridge-writing-prompt.md)

No GitHub Actions workflow changes, no scripts, no .mcp.json/hook/permission changes, no dependency pins, and no secrets/tokens/credentials touched. The templates/bridge-writing-prompt.md and audit-checklist-prompt.md changes are static prompt text edited directly in this PR (not runtime-constructed from external/untrusted input), so there's no template-injection surface either. The plugin manifest change is a version string only — no permission or trust-boundary widening. This PR is out of scope for this security lane by content, not by omission.

@claude

claude Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 2m 51s —— View job


Code review complete

Scope: all 13 changed files across both commits (2d19e2e + the follow-up d6000f9 that propagates the bridge correction). Focused on correctness and cross-file consistency per CLAUDE.md; security is out of scope for this lane.

  • Gather context (gh pr diff 2155, repo CLAUDE.md/AGENTS.md)
  • Review changed content files for correctness/consistency
  • Cross-check the two open findings from the prior review pass + Codex's inline comments against the new commit
  • Post findings

Prior findings — now resolved by d6000f9

The d6000f9 commit ("propagate the bridge correction to every jointly loaded consumer") addresses everything flagged in the earlier review round:

  • My own prior finding (form.md L525-543 still citing Chapter 5) — fixed. form.md now cites Chapter 6 for the three functions, and the "bridge isn't a verse" quote was re-attributed to Writing Better Lyrics (2009) Ch. 23, which matches the existing citation for the same quote at song-forms.md:161 — so this reattribution is internally consistent, not a new error.
  • Codex's "update every loaded consumer" finding — fixed. form.md, audit-checklist.md, audit-checklist-prompt.md, and templates/bridge-writing-prompt.md all now cite Chapter 6 and describe "different-size song system" instead of the bridge's own phrase count/line length.
  • Codex's "do not call the bridge-plus-verse system shorter" finding — fixed. bridge.md (and the propagated copies) now correctly split the claim by form: verse/chorus → final system shorter; verse/refrain or AABA → bridge+final-verse system longer.
  • Codex's "do not require mixed pacing in an arbitrary sample" finding (exercises.md Ex 5) — fixed. The old wording ("At least one section in any honest sample will speed up somewhere and slow down somewhere else") is gone; it now explicitly allows constant-only or single-direction sections and says "do not invent a change that is not there."

New finding

Posted as an inline comment: form.md:535 — the "Bridge — three functions" table's row 2 "Effect" cell still reads "Insert a non-matching unit between matching units" (the bridge's-own-phrase-count framing this PR rejects), directly contradicted by the corrective note two lines below it in the same hunk. A reader scanning just the table gets the old, wrong diagnosis.

Minor, not flagged inline (optional)

response-filter.md:380 ("add a different-size system") wasn't touched by this PR and still uses the untouched-but-imprecise short form, unlike audit-checklist.md/audit-checklist-prompt.md which were updated to "different-size song system." Low severity — it's checklist shorthand, not a full claim — leaving it as an FYI rather than a blocking finding.

Everything else checked out

  • All previously-flagged Chapter 5→6 attribution sites are now consistent across bridge.md, form.md, song-forms.md, song-forms-examples.md, audit-checklist.md, audit-checklist-prompt.md, and templates/bridge-writing-prompt.md.
  • exercises.md Ex 5-7 numbering still fills the pre-existing Ex-5-7 gap cleanly; no collision with Ex 8+.
  • Doubled-year heading fixes in exercises.md and five-compositional-elements.md are correct.
  • phrasing.md's new nesting/closure overrides, the reversal test, and the two-unbalanced-sections-can-balance-each-other addition are internally consistent with the rest of the file and don't conflict with other files' worked examples.
  • CHANGELOG.md's new [0.8.3] entry accurately reflects the diff, including the d6000f9 follow-up work.
  • I did not independently run typos, markdownlint, lychee, or the changelog-parity scripts — the PR body's verification results are author-claimed and unverified by me.

Comment thread plugins/songwriting/context/pat-pattison/research/form.md Outdated
Picks up #2154's tightened changelog-parity gate, which is what CI was
running against this branch.
@claude

claude Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 47s —— View job


Security review complete

  • Gather context (git diff origin/main...HEAD at HEAD 35137c7, repo CLAUDE.md/AGENTS.md)
  • Review changed files for security issues (injection, secrets, access control, GitHub Actions risk)
  • Post findings

No security issues found.

This synchronize event's diff (origin/main...HEAD) still touches the same 13 non-executable content/config files as the prior review pass, now merged with origin/main:

  • plugins/songwriting/.claude-plugin/plugin.json — version bump only (0.8.20.8.3), no schema/permission changes
  • plugins/songwriting/CHANGELOG.md — prose changelog entry
  • 11 files under plugins/songwriting/context/pat-pattison/{research,templates}/*.md — Markdown research notes and prompt templates (song-form/lyric-theory content), correcting bridge-chapter attributions and propagating that correction across every jointly loaded consumer

No GitHub Actions workflow changes, no scripts, no .mcp.json/hook/permission changes, no dependency pins, and no secrets/tokens/credentials touched anywhere in the diff. I also confirmed the three files in this plugin that do contain shell/script content or live URLs (scripts/datamuse.sh, research/rhyme-types.md, research/ai-tools.md) are untouched by this PR — nothing in this change adds a new code-execution or network-egress surface. The plugin manifest change is a version string only, with no trust-boundary or permission widening.

This PR remains out of scope for this security lane by content, not by omission — consistent with the three prior security-review passes on this branch.

@claude

claude Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 1m 21s —— View job


Code review complete

Scope: re-review triggered by a pull request synchronize event. The new HEAD (35137c7) is a merge of origin/main into this branch — I diffed d6000f9 (previously reviewed) against 35137c7 and confirmed the merge touched only unrelated files pulled in from main: .github/workflows/ci.yml, plugins/docs-hygiene/CHANGELOG.md, plugins/source-control/*, and scripts/check-changelog-parity*. None of the 13 songwriting-plugin files this PR is about changed in this sync.

  • Gather context
  • Confirm what changed since the last review pass (d6000f935137c7)
  • Re-verify the previously open finding against current content
  • Post findings

Status of the earlier finding

The finding from the prior pass — form.md:535 — is still present, unchanged by this sync (expected, since no songwriting file moved):

Row 2 of the "Bridge — three functions" table still reads "Insert a non-matching unit between matching units," which is the bridge's-own-phrase-count framing this PR rejects. The corrective note two lines below (L538-540) and bridge.md's rewritten Function 2 both say the claim is about the system's size and is form-dependent (shorter in V/Ch, longer in V/Refrain/AABA) — but a reader who only scans the table still gets the old, wrong diagnosis. Not re-filing as a new inline comment since it's already tracked on this thread from the previous pass; flagging here so it isn't lost now that the PR has a new HEAD SHA.

Everything else re-checked against current HEAD

  • All 13 PR-scope files (git diff origin/main...HEAD --stat) match the file list already reviewed; bridge.md, song-forms.md, song-forms-examples.md, exercises.md, phrasing.md, response-filter.md, audit-checklist.md, audit-checklist-prompt.md, and bridge-writing-prompt.md remain internally consistent with each other on the Chapter 6 bridge-function attribution and the eight-phrase "Southern Comfort" correction.
  • No new correctness or consistency issues found in this sync.
  • I did not independently run typos, markdownlint, lychee, or the changelog-parity scripts — the PR body's verification results are author-claimed and unverified by me.
    · Branch: fix/book1-chapters-1-2-6

@kyle-sexton

Copy link
Copy Markdown
Contributor Author

Blocked by the new changelog-parity gate, not by this PR's content

31 of 33 checks pass. The two failures are changelog-parity-gate and
ci-status (its aggregator). I believe the gate is misfiring, and the timing is
the clearest evidence:

#2154 (fix(ci): close the reverse direction of the changelog-parity gate) merged 15:19:18Z
This branch's first CI run started — gate PASSED 15:17:07Z
Every run since — gate FAILS after 15:19Z

Nothing about the changelog heading changed between those runs.

The failure

UNDOCUMENTED BUMP: songwriting went 0.8.2 -> 0.8.3 but
plugins/songwriting/CHANGELOG.md has no '## [0.8.3]' entry at head.

But ## [0.8.3] is the first heading in the file, at line 6, outside any
code fence or HTML comment, LF endings, no BOM:

1  # Changelog
2
3  All notable changes to the `songwriting` plugin are documented here. Format follows
4  [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
5
6  ## [0.8.3]

What I checked

  • bash scripts/check-changelog-parity.sh --check-bump origin/main passes
    locally
    (gawk 5.4) on the identical tree — both before and after merging
    main in to pick up fix(ci): close the reverse direction of the changelog-parity gate #2154's script.
  • Merged origin/main into the branch so CI and local run the same script.
    Still passes locally, still fails in CI.
  • Re-ran the failed job: deterministic, not flaky.
  • head_version/base_version resolve correctly (the message itself reports
    0.8.2 -> 0.8.3), so the failure is specifically the heading lookup.

Probable cause

The rewritten gate routes the heading check through a new helper the old one
did not have:

has_heading() { rendered_lines - | awk -v h="$heading" 'index($0,h)==1{...}' ; }

rendered_lines() ends in awk '…' "$1", so this is awk '…' - fed by a
stdin redirect. That works under gawk locally; something about it does not
under the runner's awk. #2154's 55-case suite passes because it exercises
rendered_lines on temp fixtures via the file path, never a real plugin
changelog through the - stdin path.

What I have deliberately NOT done

  • Not hand-edited the changelog to satisfy the matcher. The entry is
    already correct; contorting it would hide the bug and mislead the next author.
  • Not patched the CI script inside this PR. A source-fidelity content pass
    is the wrong place for a CI gate fix, and it would need its own test case.

Happy to open a separate PR against scripts/check-changelog-parity.sh if
that's wanted — say the word. Flagging first because this will block every
plugin version bump in the repo until it's resolved
, not just this one.

…pe two overreaching claims

form.md recorded 1991 Chapter 5 as having no linked images. It has 32
(image_rsrc31Z-32Y), and like Chapter 6's 37 they carry the scansion and
rhyme-scheme analysis while the prose stops at dangling colons. This is the
same false-inventory defect this branch already fixed in song-forms.md for
Chapter 6 -- and the same one that let the seven-phrase "Southern Comfort"
error survive an earlier pass. The entry now also records that Chapter 5 has
not been read in full, so claims sourced to it are not mistaken for verified.

form.md's header still attributed only Chapter 5 while its body now cites
Chapter 6 for the three bridge functions; book-references.md requires the
header to name its sources.

bridge.md said that in verse/refrain and AABA the final verse "arrives early."
Chapter 6 uses the early-arrival language only in the verse/chorus passage; the
verse/refrain passage claims the size change alone. Scoped to what the source
says.

Ex 5 asked for four sections "you did not write" and then offered the writer's
own back catalogue.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@claude

claude Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 2m 5s —— View job


Code review complete

Scope: re-review triggered by the latest push (35137c78aa2e94, "correct form.md's Chapter 5 image inventory and scope two overreaching claims"). Diffed that commit in isolation and re-checked the full PR diff against origin/main for consistency. Focused on correctness/consistency per CLAUDE.md; security is out of scope for this lane.

  • Gather context
  • Diff the new commit since the last review pass
  • Verify the previously-open form.md table finding
  • Check the "two overreaching claims" scoping in the latest commit
  • Review full PR diff for other correctness/consistency issues
  • Post findings

Latest commit (8aa2e94) — checked out

  • form.md's Chapter 5 image inventory now correctly records 32 linked images (was "no linked images" — the same false-inventory defect this branch already fixed for Chapter 6 in song-forms.md), and explicitly flags that Chapter 5 itself hasn't been read in full, so claims sourced to it stay marked unverified. The header now cites Chapters 5-6, matching the body's Chapter 6 citation for the three bridge functions (book-references.md requires header/body source agreement).
  • bridge.md's verse/refrain-or-AABA bullet no longer claims "the final verse arrives early" — Chapter 6 only uses early-arrival language in the verse/chorus passage; the verse/refrain passage claims the size change alone. I checked every other consumer of this claim (song-forms.md, templates/bridge-writing-prompt.md, audit-checklist.md and its prompt) and none of them carry the now-corrected "early" claim for verse/refrain/AABA — bridge-writing-prompt.md:47-48 already said "LONGER system... Different, not shorter" with no early-arrival language, so it didn't need a matching edit.
  • exercises.md Ex 5 no longer contradicts itself: it previously said "take four sections you did not write" and then offered "your own back catalogue" as a source in the same sentence. Now reads "sections you are not currently working on," which is coherent with reusing old drafts.
  • CHANGELOG.md's [0.8.3] entry was updated to describe both image-inventory fixes (Ch. 5 and Ch. 6) together and matches the diff.

Outstanding finding (posted inline, carried over from the prior review pass)

form.md:541 — the "Bridge — three functions" table's row 2 "Effect" cell still reads "Insert a non-matching unit between matching units," the bridge's-own-phrase-count framing this PR rejects elsewhere (the corrective note right below it, and bridge.md's rewritten Function 2, both say the claim is about the system's size and is form-dependent). This line wasn't touched by 8aa2e94 and remains unresolved from the review pass at 35137c7. Re-posted as a fresh inline comment since the PR has moved to a new HEAD SHA.

Everything else re-checked at current HEAD

  • No other stale "arrives early" / Chapter 5 bridge-function attributions found anywhere in the plugin (grep-verified across context/pat-pattison/).
  • response-filter.md:380's untouched "add a different-size system" shorthand (flagged as a low-severity FYI in the prior pass, not this PR's diff) is unchanged — still just checklist shorthand, not a full claim.
  • I did not independently run typos, markdownlint, lychee, or the changelog-parity scripts — the PR body's and thread's verification claims (including the changelog-parity gate discussion) are author-claimed and unverified by me.
    · Branch: fix/book1-chapters-1-2-6

@kyle-sexton

Copy link
Copy Markdown
Contributor Author

Narrowing the gate failure to a single code path

Follow-up to my comment above — the CI log already contains the discriminator,
so this is no longer a hypothesis.

In the same job, on the same file, in the same process, with the same awk:

Step Path through the helper Result
--check changelog_versions()rendered_lines "$1"file path ✅ passed
--check-bump has_heading()rendered_lines -stdin ❌ failed

Both read plugins/songwriting/CHANGELOG.md. --check parsed its version
headings successfully (it printed "Every versioned plugin has a CHANGELOG.md …
and none documents a version above its manifest"
, which requires it to have
found ## [0.8.3]). --check-bump then reported that same heading absent.

That isolates the defect to one line:

has_heading() { rendered_lines - | awk -v h="$heading" 'index($0,h)==1{...}' ; }

rendered_lines() ends in awk '…' "$1", so rendered_lines - becomes
awk '…' - fed by a stdin redirect, whereas every other caller passes a real
path. Under gawk 5.4 locally - reads stdin and the whole gate passes; on the
runner that path yields nothing, so has_heading returns false for any
plugin.

has_heading is not songwriting-specific — it runs per plugin in the
--check-bump loop — so every plugin version bump will fail this gate until
it's fixed. #2154's 55-case suite passes because it drives rendered_lines
through the file-path form and never exercises the - stdin form.

The likely fix is to have rendered_lines read stdin directly when given -
(or have has_heading write to a temp file / use a process substitution
instead), plus a regression case that runs a real changelog through
has_heading.

Still not patching it from this PR — but the offer stands if a maintainer would
rather I open the fix against scripts/check-changelog-parity.sh separately.

@claude

claude Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 1m 0s —— View job


Security review complete

  • Gather context (git diff origin/main...HEAD at HEAD 8aa2e94, repo CLAUDE.md/AGENTS.md)
  • Review changed files for security issues (injection, secrets, access control, GitHub Actions risk)
  • Post findings

No security issues found.

All 13 changed files at HEAD 8aa2e94 are non-executable content/config, matching every prior security pass on this branch:

  • plugins/songwriting/.claude-plugin/plugin.json — version bump only (0.8.20.8.3); no $schema, permission, or manifest-shape change.
  • plugins/songwriting/CHANGELOG.md — prose changelog entry.
  • 11 files under plugins/songwriting/context/pat-pattison/{research,templates}/*.md — Markdown research notes and prompt templates (song-form/lyric-theory content), correcting bridge-chapter attributions and propagating the correction across every jointly loaded consumer.

Checked specifically for this lane's concerns:

  • No GitHub Actions workflow changes (nothing under .github/workflows/), so no pull_request_target/workflow_run or permissions: risk in this diff.
  • No scripts, .mcp.json, hook, or config files touched — no new command-injection or trust-boundary surface.
  • No secrets, tokens, or credentials introduced.
  • Scanned all added lines across the research/template files for URLs, script tags, or shell-injection patterns (http, <script, javascript:, curl/wget, eval(/exec() — none present.
  • templates/bridge-writing-prompt.md and audit-checklist-prompt.md changes are static prompt text edited directly by the author (not runtime-constructed from external/untrusted input), so there's no template-injection surface.
  • No dependency, pin, or supply-chain-relevant file touched.

This PR is out of scope for this security lane by content, not by omission — consistent with the four prior security-review passes on this branch.
· Branch: fix/book1-chapters-1-2-6

Comment thread plugins/songwriting/context/pat-pattison/research/form.md Outdated
kyle-sexton added a commit that referenced this pull request Aug 10, 2026
…y gate (#2159)

Closes #2158

## Problem

`changelog-parity-gate` failed PR #2130 twice with `UNDOCUMENTED BUMP:
markdown-format went 0.11.3 -> 0.11.4 ...` even though
`plugins/markdown-format/CHANGELOG.md` carries `## [0.11.4]` at line 6,
column one — a required merge gate confidently asserting the opposite of
the truth, while the same command passed locally. PR #2135 then failed
the same gate on **every one of its sixteen bumped plugins** (smallest
flagged changelog: 15 KB). The regression landed on `main` at 15:19:19Z
in #2154 and blocks **every PR that bumps a plugin whose changelog
exceeds roughly one stdio buffer (~4 KB)** — which newest-first ordering
makes essentially all of them.

## Blast radius — precisely

Confined to the `--check-bump` path: `has_heading` is defined inside
that branch and called in exactly two places (the head-side check and
the base-side `git show "$base:$changelog" | has_heading`). `--check`
and `--check-order` read changelogs through `changelog_versions`, whose
`grep -oE` stages drain stdin with no early exit and cannot take
SIGPIPE. So the failure class is exactly "PRs that bump a manifest
version"; both failing call sites go through the one function this PR
fixes.

## Root cause

`has_heading` runs a pipeline under `set -o pipefail` whose reader
`exit`s on first match:

```bash
rendered_lines - | awk -v h="$heading" 'index($0, h) == 1 { found = 1; exit } END { exit !found }'
```

The newest heading sits near the top, so the reader exits while
`rendered_lines` is still writing; the writer dies of SIGPIPE (141) and
pipefail reports the pipeline — the FOUND heading — as a failure.
Reproduced deterministically in an `ubuntu:24.04` container at the exact
CI merge commit `ba4b72fb`: `PIPESTATUS=141 0` and the byte-identical CI
error under **gawk** (what the `ubuntu-24.04` runner resolves
`/usr/bin/awk` to — gawk outranks mawk in the alternatives system, and
only the gawk mechanism explains CI failing 15 KB files). mawk survives
the closed pipe and passes at every size tested, and Windows/MSYS
process timing lets the writer finish first — which is why the failure
existed only in CI. The suite's 55 fixtures all fit in one buffer —
hence `PASS=55` in the very job that then failed on the real file.

## Fix

The reader consumes to EOF; `END { exit !found }` decides. Correct **by
construction**: no reader exits early, so no writer can ever take
SIGPIPE, under any awk — the failure is impossible, not rarer. Chosen
over restoring the pre-#2154 single-awk form because it preserves the
one-tracker-three-modes property (`rendered_lines` shared by all modes,
so they cannot drift). Both `has_heading` call sites are covered (same
function); the script has no other early-exiting reader downstream of a
pipe (`changelog_versions` greps drain stdin; the `grep -m1` format
probe reads a file directly, not a pipe).

## Regression fixture — with its fails-against-unfixed proof, per engine

New `--check-bump` case: ~260 KB changelog, new `## [1.1.0]` entry near
the top, expected pass. 260 KB deliberately exceeds the 64 KB pipe
**capacity**, so against the unfixed script the writer blocks mid-write
and the SIGPIPE is deterministic, not a winnable race.

| script | gawk | mawk |
|---|---|---|
| unfixed | **FAIL=1** (exact #2130 error text) | PASS (mawk survives
the closed pipe) |
| fixed | 56/56 | 56/56 |

The fixture's guard is therefore **engine-conditional — it discriminates
only where `awk` resolves to gawk**, which is what the runner resolves;
this is recorded in the fixture comment. The fix itself is
engine-independent. Windows local: 56/56 fixed.

## Related

- #2158 — the defect issue this closes
- #2154 — shipped the early-exit reader; this is its first contact with
a production-size changelog
- #2130, #2135, #2155 — blocked by this regression; once this lands,
their recomputed merge refs carry the fixed gate and need no branch-side
changes
- Known adjacent gap, tracked separately and deliberately NOT fixed
here: the gate cannot see a **deleted** predecessor heading — a change
set that renames the top heading in place (rather than adding a new one
above it) destroys a shipped release section while `--check` and
`--check-order` both pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
kyle-sexton and others added 2 commits August 10, 2026 13:18
…missing

--check-bump reported "UNDOCUMENTED BUMP: songwriting went 0.8.2 -> 0.8.3 but
plugins/songwriting/CHANGELOG.md has no '## [0.8.3]' entry at head" while that
heading was the file's first, at line 6, outside any fence.

Root cause, reproduced: has_heading runs `rendered_lines | awk` under
`set -o pipefail` (line 63), and the matcher exited on its first hit. That
closes the pipe while rendered_lines is still writing, rendered_lines takes
SIGPIPE and exits 141, and pipefail promotes 141 to the status of the whole
pipeline -- so a FOUND heading reports as absent. It only bites once the
unread remainder outgrows the pipe buffer, which is why it passed on short
changelogs and on the author's machine and failed in CI on the repo's longest
changelog. Against a 79KB fixture the old shape returns 141 and the new one
returns 0.

Fixed by reading to EOF instead of exiting early. At these sizes that costs
nothing.

Also hardened the call form it depended on. has_heading passed `-` to mean
stdin, but a `-` file operand is a convention rather than something every awk
guarantees, and where it is taken literally the helper emits nothing and every
heading looks absent. rendered_lines now forwards "$@", so a zero-argument call
reaches awk as a zero-operand call -- stdin in every awk. Both defects produce
the identical symptom; both are closed.

The existing --check-bump pass test used a three-line changelog, which is why
this shipped: with the heading on line 3 there is nothing left to write after
the matcher stops, so neither defect can fire. Added a >64KiB fixture with the
matched heading first, a cross-check that --check (which reaches rendered_lines
by path, not stdin) agrees on the same file, and a direct probe that
rendered_lines with no argument reads stdin.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Takes main's scripts/check-changelog-parity.sh and its test suite verbatim.

#2159 landed the same root-cause fix this branch had staged -- dropping
has_heading's early exit so the matcher cannot SIGPIPE rendered_lines under
pipefail -- so the local change is redundant and main's version wins. This
branch goes back to being a pure songwriting content pass.

The one piece not in #2159 is hardening the `-` stdin operand into a
zero-argument call. That was defensive rather than demonstrated: the SIGPIPE
race is the confirmed cause and is now fixed, and nothing has shown a `-`
operand failing anywhere. Left out rather than carried on speculation; it can
be raised on its own if evidence for it ever appears.
@claude

claude Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 1m 8s —— View job


Code review complete

Scope: re-review triggered by a pull request synchronize event. New HEAD is f8122ac (merge of origin/main), following the previously-reviewed 8aa2e94.

  • Gather context
  • Confirm what changed since the last review pass (8aa2e94f8122ac)
  • Re-verify the previously open form.md:541 finding against current content
  • Post findings

What changed in this sync

git diff 8aa2e94..HEAD -- plugins/songwriting/ is empty — none of the 13 songwriting-plugin files this PR touches changed. The merge pulled in two unrelated origin/main commits:

  • 416a61ffix(ci): stop has_heading's early exit from SIGPIPE-failing the parity gate (#2159)
  • bb9585efix(ci): stop the changelog-parity gate reporting a present entry as missing

Worth flagging for the thread: bb9585e looks like it directly fixes the changelog-parity-gate CI failure discussed above by @kyle-sexton — it rewrites has_heading() in scripts/check-changelog-parity.sh to read rendered_lines() to EOF instead of exiting on first match (closing a pipefail/SIGPIPE race that turned a found heading into a false "absent") and switches the stdin call from a literal - operand to a bare zero-argument call. That matches the root cause the author isolated in the thread. This is unrelated to PR 2155's own diff, so it's not a finding against this PR — noting it only because it's now merged into this branch and appears to resolve the blocking gate.

Outstanding finding (posted inline, unchanged since the last two passes)

form.md:541 — the "Bridge — three functions" table's row 2 "Effect" cell still reads "Insert a non-matching unit between matching units," the bridge's-own-phrase-count framing this PR rejects elsewhere. The corrective note three lines below (L544) contradicts it directly, but a reader who only scans the table gets the old, wrong diagnosis. Same finding as the prior two review passes (at 35137c7 and 8aa2e94); re-posted inline at the new HEAD SHA since GitHub review comments don't carry across commits.

Everything else re-checked at current HEAD

  • All 13 PR-scope files (git diff origin/main...HEAD --stat) match the file list already reviewed in prior passes; content is byte-identical to the 8aa2e94 review.
  • No new correctness or consistency issues found in this sync.
  • I did not independently run typos, markdownlint, lychee, or the changelog-parity scripts — the PR body's and thread's verification claims are author-claimed and unverified by me.
    · Branch: fix/book1-chapters-1-2-6

@claude

claude Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 1m 21s —— View job


Security review complete

  • Gather context (git diff origin/main...HEAD at HEAD f8122ac, repo CLAUDE.md/AGENTS.md)
  • Review changed files for security issues (injection, secrets, access control, GitHub Actions risk)
  • Post findings

No security issues found.

This synchronize event's diff (origin/main...HEAD) touches the same 13 files as every prior security pass on this branch, and the content is unchanged since the last-reviewed commit (8aa2e94) — I confirmed git diff 8aa2e94..HEAD -- plugins/songwriting is empty. The two commits added since then (bb9585e, a CI script fix; f8122ac, a merge of origin/main) only bring in unrelated upstream changes to scripts/check-changelog-parity.sh and its test file, which land in origin/main itself and so don't appear in this PR's diff against it.

All 13 PR-scope files remain non-executable content/config:

  • plugins/songwriting/.claude-plugin/plugin.json — version bump only (0.8.20.8.3), no $schema/permission/manifest-shape change
  • plugins/songwriting/CHANGELOG.md — prose changelog entry, matches the diff
  • 11 files under plugins/songwriting/context/pat-pattison/{research,templates}/*.md — Markdown research notes and prompt templates (song-form/lyric-theory content), correcting bridge-chapter attributions and propagating that correction across every jointly loaded consumer

Checked specifically for this lane's concerns:

  • No GitHub Actions workflow changes (nothing under .github/workflows/) — no permissions:, pull_request_target, or workflow_run risk in this diff.
  • No scripts, .mcp.json, hook, or config files touched — no new command-injection or trust-boundary surface.
  • No secrets, tokens, or credentials introduced.
  • Scanned the full diff for URLs, script tags, or injection-like patterns (http(s)://, <script, javascript:, curl/wget, eval(/exec() — the only matches are the pre-existing, unmodified plugin.json $schema URL and the Keep a Changelog URL in CHANGELOG.md's header (both context lines, not new content).
  • templates/bridge-writing-prompt.md and audit-checklist-prompt.md changes are static prompt text edited directly by the author, not runtime-constructed from external/untrusted input — no template-injection surface.
  • No dependency, pin, or supply-chain-relevant file touched.

This PR remains out of scope for this security lane by content, not by omission — consistent with all five prior security-review passes on this branch.
· Branch: fix/book1-chapters-1-2-6

Comment thread plugins/songwriting/context/pat-pattison/research/form.md Outdated
…ote under it

Review raised this three times and I kept answering it in prose beneath the
table. form.md's function-2 "Effect" cell still read "Insert a non-matching unit
between matching units" -- the bridge's-own-phrase-count framing this branch
exists to reject -- with the correction sitting three lines below as an
addendum. A table is the format readers scan, so the row was still handing out
the wrong diagnosis to anyone who did not read past it.

The row now carries the corrected claim: the SYSTEM changes size, shorter in
verse/chorus and longer in verse/refrain and AABA. The paragraph below keeps
only the explanation of why the direction differs.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@claude

claude Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 35s —— View job


Security review complete

  • Gather context (git diff f8122ac..HEAD and git diff origin/main...HEAD at HEAD 6f4f832)
  • Review changed files for security issues (injection, secrets, access control, GitHub Actions risk)
  • Post findings

No security issues found.

This synchronize event's only change since the last-reviewed commit (f8122ac) is a single edit to plugins/songwriting/context/pat-pattison/research/form.md — the "Bridge — three functions" table's row 2 "Effect" cell now states the corrected system-level, form-dependent claim directly (rather than relying on the caveat paragraph below it), resolving the correctness finding raised in prior review passes. It's a prose-only edit to a Markdown research file: no code, no links, no shell/script content, nothing executable.

The full PR diff (origin/main...HEAD) still touches the same 13 non-executable content/config files as every prior security pass on this branch:

  • plugins/songwriting/.claude-plugin/plugin.json — version bump only (0.8.20.8.3), no $schema/permission/manifest-shape change
  • plugins/songwriting/CHANGELOG.md — prose changelog entry
  • 11 files under plugins/songwriting/context/pat-pattison/{research,templates}/*.md — Markdown research notes and prompt templates (song-form/lyric-theory content)

Checked specifically for this lane's concerns:

  • No GitHub Actions workflow changes — no permissions:, pull_request_target, or workflow_run risk in this diff.
  • No scripts, .mcp.json, hook, or config files touched — no new command-injection or trust-boundary surface.
  • No secrets, tokens, or credentials introduced.
  • templates/bridge-writing-prompt.md and audit-checklist-prompt.md remain static prompt text edited directly by the author, not runtime-constructed from external/untrusted input — no template-injection surface.
  • No dependency, pin, or supply-chain-relevant file touched.

This PR remains out of scope for this security lane by content, not by omission — consistent with all six prior security-review passes on this branch.
· Branch: fix/book1-chapters-1-2-6

@kyle-sexton
kyle-sexton merged commit e40aa1d into main Aug 10, 2026
33 checks passed
@kyle-sexton
kyle-sexton deleted the fix/book1-chapters-1-2-6 branch August 10, 2026 17:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant