Skip to content

feat(songwriting): finish Wave A verbatim cleanup and fix the <br> extraction bug - #2189

Merged
kyle-sexton merged 6 commits into
mainfrom
fix/songwriting-wave-a-verbatim-cleanup
Aug 11, 2026
Merged

feat(songwriting): finish Wave A verbatim cleanup and fix the <br> extraction bug#2189
kyle-sexton merged 6 commits into
mainfrom
fix/songwriting-wave-a-verbatim-cleanup

Conversation

@kyle-sexton

Copy link
Copy Markdown
Contributor

Wave A of the Pat Pattison chapter audit: finish the five research files the
previous pass left incomplete, settle four unconfirmed leads, and fix an
extractor bug that had been silently corrupting every quoted stanza.

songwriting 0.8.50.8.6. No skill bodies changed — this is research
context, the CHANGELOG and the version bump.

The extractor bug is the headline, and it reaches back into #2183

<br> carries attributes in these EPUBs. They are Calibre-produced and
write line breaks as <br class="calibre2"/>, which a <br\s*/?> pattern does
not match. The tag-stripper then removed them, so every lyric stanza arrived
as one run-together line
Losing the human raceFalling from heaven's grace…. Agents restoring those stanzas were inferring the line breaks and
calling the result verbatim.
Fixed to <br\b[^>]*>.

This is a correctness bug, not a formatting one: line count is what balance,
stability and scansion claims are about.
Re-verifying against the corrected
source immediately caught a real error — the stagnant sheriff Box 3 in
Writing Better Lyrics (2009) Chapter 6 is two printed lines, not one.

The four spine/image invariants do not detect it. All four passed cleanly
before and after. Future extractor gates need a stanza spot-check.

Not fixed here, recorded for the verification wave: the ~9,000 lines
restored in 0.8.5 were built with the buggy pattern and have not been
re-verified.

What the sweep found

The paraphrase-only rule that #2183 revoked did not merely omit Pat's text — it
replaced it with invented scaffolding: "Use when" lists, bullet "tests",
checklists, named axes and failure-mode tables that read like craft guidance and
cite nothing. This is the most common fabrication form found and the most
dangerous, because it looks like the useful part.

Concretely, in five files:

  • stable-unstable-meta.md — 201 lines, seven separate fabrications,
    including an invented "five motion controllers" table (melodic rhythm and
    harmonic rhythm return zero hits corpus-wide) and an epigraph falsely
    attributed to Berklee Online.
  • box-model.md — a fabricated "Other named division axes" table, invented
    travelogue and same-color "tests", invented POV and tense bullets, and
    editorializing Pat never wrote.
  • point-of-view.md — five invented "Use when" lists, an invented
    four-question "fact test", and a fabricated One walks into the room example.
  • repetition.md — invented hidden-question/command matrices, a silently
    truncated quote, and a categorical rule softened into a preference.
  • rhyme-types.md — an invented Pat quote ("Craft prepares you to be
    creative.") with zero corpus hits.

Everything above was replaced with Pat's actual printed text, or relabelled
unaudited where no book source exists. No quote was invented for a source that
cannot be read
point-of-view.md's Berklee Online material was deliberately
left paraphrased and is now explicitly marked unaudited.

The four leads, all settled

  1. rhyme-types.md "six rhyme types" — premise false. The line already read
    "six" against a six-item list. Left unchanged. (The invented quote above was
    found while checking.)
  2. The "central emotion" — Pat quote — CONFIRMED FABRICATED, zero hits
    across all four books.
  3. The 1991 consonance claim — CONFIRMED WRONG, narrowed not deleted. Family,
    additive and assonance are genuinely absent; Essential Guide to Lyric Form
    and Structure
    (1991) Chapter 4 does name Consonance Rhyme.
  4. Exercise 8.7 — genuinely absent from print. Essential Guide to Rhyming
    (2014) Chapter 8 runs 8.1-8.6, 8.8-8.10, verified against the page scans
    because a numbering gap is normally an omission detector. No edit needed.

Figure-only content recovered

Several passages in 1991 Chapter 6 exist only as images, after a dangling
colon in the text — the AABA statement/restatement/variation/return table, the
S1/S2/S3 bridge diagrams, the ABAB ballad-stanza principle, and the
Working/Gambling/Panhandling box diagram for "One More Dollar".

Verification

All green: typos, markdownlint-cli2 (103 files), lychee --offline
(770 links), check-changelog-parity.sh --check-bump, validate-plugins.sh,
and the Books? [1-4] citation regression grep. check-skill.sh not run — no
skill body changed.

_typos.toml was not edited; the two new exceptions ("Viet Nam" in a
verbatim lyric, and a scansion strip) use the inline
spellchecker:off / spellchecker:on block form.

Related

No linked issue.

…traction bug

Wave A of the Pat Pattison chapter audit: complete the five research files the
previous pass left unfinished, settle four unconfirmed leads, and fix an
extractor bug that had been silently corrupting every quoted stanza.

The extractor bug is the headline and it reaches back into #2183. These are
Calibre EPUBs and they write line breaks as `<br class="calibre2"/>`, which a
`<br\s*/?>` pattern does not match; the tag-stripper then removed them, so every
lyric stanza arrived as one run-together line and restoring agents were
inferring the line breaks. Corrected to `<br\b[^>]*>`. This is a correctness
bug, not a formatting one — line count is what balance, stability and scansion
claims are about, and re-verifying immediately caught the stagnant sheriff Box 3
in Writing Better Lyrics (2009) Chapter 6 as two printed lines, not one. The
four spine/image invariants passed cleanly before and after, so they do not
detect it.

The revoked paraphrase-only rule did not merely omit Pat's text, it replaced it
with invented scaffolding — "Use when" lists, bullet tests, checklists and
unsourced tables that read like craft guidance and cite nothing. Removed across
five files, including a fabricated "five motion controllers" table, a fabricated
"Other named division axes" table, five invented "Use when" lists, an invented
direct-address fact test, and two invented Pat quotes with zero corpus hits.
Each replaced with Pat's printed text, or relabelled unaudited where no book
source exists. No quote was invented for a source that cannot be read.

All four leads settled: the "six rhyme types" premise was false; the "central
emotion" quote is confirmed fabricated; the 1991 consonance claim is confirmed
wrong and narrowed rather than deleted; Exercise 8.7 is genuinely absent from
print, verified against the page scans.

Also recovers figure-only content from 1991 Chapter 6 — the AABA
statement/restatement/variation/return table, the S1/S2/S3 bridge diagrams, the
ABAB ballad-stanza principle, and the "One More Dollar" box diagram — all of
which follow a dangling colon and exist nowhere in the running text.

songwriting 0.8.5 -> 0.8.6. No skill bodies changed. `_typos.toml` untouched;
the two new exceptions use the inline spellchecker:off/on block form.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@cursor

cursor Bot commented Aug 11, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@claude

claude Bot commented Aug 11, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 1m 13s —— View job


Security review — no findings

  • Gather context (git diff HEAD~1..HEAD, matches the 9 files listed on the PR)
  • Review each changed file for security issues
  • Post findings

Scope reviewed: all 9 changed files — plugin.json (version bump only), CHANGELOG.md, and the six Pat Pattison research markdown files under plugins/songwriting/context/pat-pattison/research/.

What I checked for:

  • Injection surfaces (command/SQL/path/template) — none present; no code or scripts changed.
  • GitHub Actions risk (pull_request_target/workflow_run with secrets, script injection via github context, permission widening) — no workflow files touched.
  • Secrets/tokens/credentials — none introduced.
  • Supply-chain / pin loosening — no dependency or action-pin changes; plugin.json's only change is the semver bump 0.8.50.8.6.
  • Prompt-injection payloads hidden in the research content (since these .md files are loaded as skill context for future agent runs) — scanned the diff for <script>, javascript:, eval(, shell/exec calls, embedded URLs, and "ignore instructions"/jailbreak-style phrasing. All additions are inert prose/HTML comments (provenance notes, blocks per the PR's own note) — no active content, no external links added.

Conclusion: This PR is a content-only change (research text restoration + a regex fix description in the changelog prose, not an actual code diff — the extractor script itself isn't part of the changed files). There is no code, configuration, or workflow surface here that introduces a vulnerability. No CRITICAL / IMPORTANT / SUGGESTION findings to report.

The file header said it names "the song and writers" for every excerpt. Three
of the songs Pat works with — "Sentimental Lady", "Digging for the Line" and
"As Each Year Ends" — carry no writer credit in his text or on the permissions
page, so the claim was false for them. Reworded to "the song, and the writers
where Pat names them."

Small, but it is the same class of defect this wave exists to remove: a
confident statement the source does not support.

CHANGELOG bullet added under 0.8.6.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@claude

claude Bot commented Aug 11, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 4m 21s —— View job


Review complete

Scope: the single commit 109c119 (9 files: plugin.json version bump, CHANGELOG.md, and 5 research files under plugins/songwriting/context/pat-pattison/research/). Per REVIEW.md, this is content/docs-only — no code paths, no security surface, so most of the standard architecture/error-handling/test-coverage checklist doesn't apply here; I focused on correctness (internal consistency, markdown structure, anchor integrity, and fidelity of the "verbatim" claim the PR is built on).

What I checked

  • Anchors and cross-references. Every ](#...) link in box-model.md, point-of-view.md, repetition.md, song-forms-examples.md, and stable-unstable-meta.md resolves to a heading that exists post-edit (spot-checked by extracting all ##/### headings and diffing against link targets). No broken internal links introduced.
  • spellchecker:off/:on block balance. All blocks across the changed files are paired; the two new exceptions described in the PR body ("Viet Nam" in song-forms-examples.md:634, the scansion strip in stable-unstable-meta.md:47-53) are exactly what's there.
  • CHANGELOG/version consistency. plugin.json 0.8.5 → 0.8.6 matches the new ## [0.8.6] CHANGELOG entry.
  • The four settled leads (rhyme-types count, the fabricated "central emotion" quote, the 1991 consonance narrowing, Exercise 8.7) — the diff matches what the PR body claims for each.
  • Read the full diffs of all 5 research files line-by-line rather than sampling, given the PR's own thesis is that partial/inferred restoration is exactly the failure mode being fixed.

I did not independently run typos, markdownlint-cli2, or lychee — this sandbox has no outbound network access (git fetch itself was blocked), so I could not install or invoke them. Those results in the PR body are author-claimed and unverified by me. I also could not check the restored quotes against the actual EPUB/print source (not present in this repo, as expected for copyrighted material), so my findings below are grammar-pattern-based, not source-verified.

Findings (posted inline)

Two related findings in point-of-view.md, both in newly-added blockquotes presented as Pat's verbatim printed text:

  • Line 399: "This sounds unnatural because you already knows all this stuff" — subject–verb agreement error.
  • Line 133: "a kind of universal feeling that you seems to add" — same error shape.

Two independent you [verb]+s slips in one file's newly-restored quotes is a pattern, not a single typo — worth a quick re-check against the source rather than assuming both are faithful transcription, since verbatim fidelity is the entire point of this PR.

Other observations (non-blocking)

  • The <br class="calibre2"/> extractor itself isn't in this repo (expected — it's presumably local tooling operating on copyrighted EPUB sources, not something that can be checked in), so the regex fix described in the PR body can't be verified from the diff; it's necessarily author-claimed.
  • The PR is explicit that the ~9,000 lines restored in 0.8.5 have not been re-verified against the corrected extractor and defers that to a future wave — flagging this only to confirm I read it, not as a gap in this PR.

@claude

claude Bot commented Aug 11, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 59s —— View job


Security review

  • Gather context (gh pr diff, changed files)
  • Understand the request (security review of this PR's changes)
  • Review changed files for security issues
  • Post findings

No security issues found.

This PR's diff (git diff origin/main...HEAD, 9 files) is confined to:

  • plugins/songwriting/.claude-plugin/plugin.json — a version bump only (0.8.50.8.6), no other manifest fields touched.
  • plugins/songwriting/CHANGELOG.md — prose changelog entry.
  • plugins/songwriting/context/pat-pattison/research/*.md (7 files) — verbatim-text restoration and fabrication cleanup in research/context content consumed by the songwriting skills.

None of the categories in scope for this lane apply here:

  • No workflow (.github/workflows/**), hook, .mcp.json, or subagent/skill-frontmatter contract changes — everything modified is prose/context content or a version string.
  • No command/SQL/path/template construction, no shell invocation, no dynamic code execution anywhere in the diff.
  • No tokens, credentials, secrets, or API keys introduced or handled.
  • No authorization/access-control logic touched — this plugin has none.
  • No permissions: or trigger changes (pull_request_target, workflow_run) — no workflow files are touched at all.
  • I also scanned the diff for embedded prompt-injection-style text (e.g. "ignore previous instructions," hidden HTML/script payloads) given that this content is loaded into model context by the songwriting skills — found only legitimate and provenance comments consistent with the PR's stated purpose. No hidden instructions or executable content.

This PR is pure content/documentation correctness work (fixing a <br>-attribute extraction bug and restoring verbatim source text), with nothing that changes a contract surface or introduces an attack surface. No supply-chain, injection, or access-control concerns to report.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 109c119ad6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread plugins/songwriting/context/pat-pattison/research/point-of-view.md Outdated
Comment thread plugins/songwriting/context/pat-pattison/research/point-of-view.md Outdated
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown

Claude has reviewed this PR 5 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

@claude

claude Bot commented Aug 11, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 2m 45s —— View job


Code review in progress

  • Gather context (diff, CLAUDE.md, REVIEW.md)
  • Spot-check cross-file anchors/links touched by the diff
  • Deep pass for structural/consistency issues (running in background agent)
  • Post findings

Note: this PR is almost entirely a content-accuracy rewrite of markdown research
files (no extractor source code is checked into this repo), so the code-review
lane's usual checks (error handling, atomicity, tests) mostly don't apply. Focusing
on markdown/link/structural correctness and internal self-consistency instead.

…ungrammatical

PR review flagged "you already knows all this stuff" and "a kind of universal
feeling that you seems to add" as subject-verb agreement errors in blockquotes
presented as Pat's exact words. Good catch, wrong conclusion: the raw XHTML
wraps `you` in an emphasis span in both cases. Pat is referring to the *word*
`you` as a mentioned term, which takes a singular verb, so both sentences are
correct exactly as printed. Italics restored.

This is a second, subtler failure mode of the same extractor. The `<br>` bug
destroyed line breaks; stripping emphasis spans destroys the cue that a word is
being mentioned rather than used — which makes correct verbatim text look
broken and invites a "correction" that would corrupt Pat's actual words.

The earlier assessment that stripped italics change no factual claim was wrong,
and is corrected in the audit ledger and handoff. Standing rule added: when a
restored quote looks ungrammatical, check the raw XHTML for italics before
changing anything. Blanket span-to-emphasis conversion is still refused —
Essential Guide to Rhyming (2014) is fixed-layout and uses spans for its
per-word text layer, so that rule would corrupt every page of it.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@claude

claude Bot commented Aug 11, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 1m 19s —— View job


Security review — no findings

  • Gather context (gh pr diff 2189, matches the 9 files listed on the PR)
  • Review each changed file for security issues
  • Post findings

Scope reviewed: all 9 changed files — plugins/songwriting/.claude-plugin/plugin.json (version bump only, 0.8.50.8.6), plugins/songwriting/CHANGELOG.md, and the seven Pat Pattison research markdown files under plugins/songwriting/context/pat-pattison/research/.

What I checked:

  • Injection surfaces (command / SQL / path / template) — none present; no code, scripts, or executable content anywhere in the diff.
  • GitHub Actions risk (pull_request_target / workflow_run with secrets, script injection via the github context in run: blocks, permissions: widening) — no workflow files are touched by this PR at all.
  • Secrets / tokens / credentials — none introduced.
  • Supply-chain / pin loosening — no dependency or action-pin changes; the only manifest change is the semver bump.
  • Prompt-injection payloads hidden in the research content — this content is loaded as skill context for future agent runs, so it's a real trust boundary. I grepped the full diff for <script>, javascript:, on*= handlers, eval(/exec(, shell invocations, and instruction-override phrasing ("ignore previous instructions", "system prompt", etc.), and separately extracted every added URL. Found none — all additions are inert prose, blockquoted verbatim text, and paired / HTML comments matching the PR's own description. No active or executable content, no new external links.

Conclusion: This PR is a content-only change (research-file text restoration, an extractor-bug writeup in prose, and a version bump) with no code, configuration, or workflow surface. No CRITICAL / IMPORTANT / SUGGESTION security findings.

(Note: a licensing/redistribution concern about verbatim copyrighted book/lyric text was raised in a separate review comment on this PR — that's a content-provenance/licensing question, not a security vulnerability, and is out of scope for this security-review lane.)

Branch: fix/songwriting-wave-a-verbatim-cleanup

@claude

claude Bot commented Aug 11, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 4m 29s —— View job


Code review complete

  • Gather context (diff 3906c03..HEAD — the effective PR diff, 9 files, matches the PR's stat exactly; read CLAUDE.md/AGENTS.md/REVIEW.md)
  • Review each changed file for correctness / maintainability
  • Check internal consistency (anchors, spellchecker blocks, CHANGELOG/version parity, cross-file references)
  • Post findings

Scope: all 9 files across the full branch diff (3906c03..HEAD, which includes the two follow-up commits 06909f3 and ab80670 pushed after the earlier review rounds — I re-verified those too, not just the original 109c119). Per REVIEW.md, this lane owns correctness/design/conventions/documentation and explicitly excludes security (this repo has a claude-security-review lane).

Findings (posted inline)

Two complete third-party song lyrics are reproduced verbatim in box-model.md, contradicting the plugin's own README:

  • box-model.md:113-151 — "Strawberry Wine" (Matraca Berg / Gary Harrison), all three verses, the bridge, and three chorus repeats.
  • box-model.md:326-363 — Gillian Welch's "One More Dollar," also complete.

README.md:76-79 (unchanged by this PR) states the license scope this content ships under: "the plugin contains distilled craft guidance and short verified anchor quotes, not book text." A full commercial lyric is neither, and this plugin is MIT-licensed and publicly distributed via the marketplace. This overlaps with what Codex already flagged on song-forms-examples.md:12 for the same underlying pattern — I independently confirmed it and located a second, distinct instance in box-model.md that Codex's comment didn't call out. I'd treat this as one finding to resolve, not two.

What I checked and found consistent

  • The <br> extractor fix's downstream effects — spot-checked the "stagnant sheriff" Box 3 example in repetition.md:490-492, which the PR body says the fix caught as two printed lines rather than one; the file now correctly shows two lines.
  • The four settled leadsrhyme-types.md's invented "Craft prepares you to be creative" quote is now the real Tiger Woods passage; five-compositional-elements.md's 1991-consonance claim is now narrowed (names Chapter 4's one passing "Consonance Rhyme" mention) rather than flatly denied.
  • The fabricated "central emotion" — Pat quote in stable-unstable-meta.md — confirmed removed and replaced with sourced Chapter 18 quotes; the file's cross-references (rhyme-strategy.md, prosody.md, meter.md, form.md, phrasing.md, point-of-view.md, hook.md, five-compositional-elements.md, lyric-melodic-roadmaps.md) all resolve to real files.
  • The two follow-up commits (06909f3, ab80670) — the header over-claim fix in point-of-view.md and the italics restoration are both correct: the raw-XHTML explanation for "you already knows" / "you seems to add" (mentioned-word-as-subject taking a singular verb) is internally consistent, and this properly supersedes the grammar concern raised in an earlier review round on this PR.
  • CHANGELOG/version parityplugin.json 0.8.5 → 0.8.6 matches the new ## [0.8.6] entry; fence counts are balanced in every changed research file (box-model.md 28, repetition.md 62, song-forms-examples.md 56, stable-unstable-meta.md 8).

I did not independently run typos, markdownlint-cli2, or lychee (no tool access in this lane for that); those results in the PR body are author-claimed and unverified by me.

Comment thread plugins/songwriting/context/pat-pattison/research/box-model.md
Comment thread plugins/songwriting/context/pat-pattison/research/box-model.md
…done

Delayed idle notifications revealed that two Wave A agents did not finish — they
died with "Output blocked by content filtering policy" and their last reports
named unfinished work. I had read their files going quiet as completion. It was
death, which is exactly the failure mode the handoff warns about, and I misread
it.

The consequence was real and shipped in 109c119. stable-unstable-meta.md
correctly replaced the fabricated "central emotion" quote near the top, but the
agent died before reaching the three sections that key off the same invented
phrase — the worked diagnostic, the coaching prompts and the anti-patterns. The
committed file therefore debunked "central emotion" as fabricated and then went
on using it as a diagnostic key three more times.

All three now use Pat's actual wording from Writing Better Lyrics (2009)
Chapter 18: "central intent, idea, and emotion". Verified in source at
corpus/book2/025_c4U6.txt — "The elements all join together to support the
central intent, idea, and emotion of the work."

Also adds a provenance section naming the two things in that file that are not
Pat's: the tone-of-voice axis (non-book, 0 hits across all four books) and the
worked diagnostic (the file's own applied example, not a case Pat prints).

repetition.md needed no repair. Its remaining task was inserting the full
"Strawberry Wine" lyric; the section already carries Pat's box-weight test
quoting only short fragments, which is the correct treatment and the one PR
review is asking for elsewhere. The agent dying prevented a defect rather than
causing one.

Both files re-checked for mid-edit damage: code fences balanced, spellchecker
guards paired, no placeholders. typos, markdownlint and lychee all clean.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@claude

claude Bot commented Aug 11, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 1m 15s —— View job


Security review — no findings

  • Gather context (git diff 3906c03..HEAD, matches the PR's stated stats exactly: 9 files, +2441/-824)
  • Review each changed file for security issues
  • Post findings

Scope reviewed: all 9 changed files at HEAD b60f844plugins/songwriting/.claude-plugin/plugin.json (version bump only, 0.8.50.8.6), plugins/songwriting/CHANGELOG.md, and the seven Pat Pattison research markdown files under plugins/songwriting/context/pat-pattison/research/. This included the newest commit (b60f844, the stable-unstable-meta.md "central emotion" → "central intent, idea, and emotion" fix) which post-dates the prior security-review rounds on this PR.

What I checked:

  • Injection surfaces (command / SQL / path / template) — none present; no code, scripts, or executable content anywhere in the diff.
  • GitHub Actions risk (pull_request_target / workflow_run with secrets, script injection via the github context, permissions: widening) — no workflow files are touched by this PR.
  • Secrets / tokens / credentials — grepped all changed files for API-key/token/secret patterns; none found.
  • Supply-chain / pin loosening — no dependency or action-pin changes; the only manifest change is the semver bump.
  • Prompt-injection payloads hidden in the research content — this content is loaded as skill context for future agent runs, so it's a real trust boundary. Grepped the full diff and the current file contents for <script>, javascript:/vbscript:/data:text, <img>/<iframe>/<embed>/<object>, on*= handlers, eval(/exec(, shell invocations, and instruction-override phrasing ("ignore previous instructions", "system prompt"). No matches in any of the 7 changed research files. Also checked for embedded URLs (https?://) — none added.

Conclusion: This PR remains a content-only change (verbatim-text restoration, an extractor-bug writeup in prose, and a version bump) with no code, configuration, or workflow surface. No CRITICAL / IMPORTANT / SUGGESTION security findings.

(Note: a licensing/redistribution concern about verbatim third-party lyric text — "Strawberry Wine" and "One More Dollar" in box-model.md — is already tracked in this PR's review threads as a content-provenance/licensing question, not a security vulnerability, and is out of scope for this lane.)

Branch: fix/songwriting-wave-a-verbatim-cleanup

@claude

claude Bot commented Aug 11, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 2m 1s —— View job


Code review complete

  • Gather context (git log/git show on the new commit b60f844, which is what triggered this round; re-checked prior review threads)
  • Review the new commit against the bug it claims to fix
  • Check for regressions or new correctness issues
  • Post findings

Scope: this round was triggered by a new push, commit b60f844 ("finish the work a content-filtered agent left half-done"), which touches only CHANGELOG.md and stable-unstable-meta.md. The prior three code-review rounds on this PR already covered the other 7 files in depth, so I focused on what's new rather than re-reviewing unchanged content.

What the new commit does, and whether it's correct

stable-unstable-meta.md had replaced the fabricated "central emotion" — Pat quote near the top of the file (in 109c119), but three downstream sections — Worked diagnostic, Coaching prompts, and Anti-patterns — kept using the invented phrase as a diagnostic key, i.e. the file debunked its own fabrication and then kept relying on it. This commit replaces all three with Pat's actual Chapter 18 wording, "central intent, idea, and emotion," and adds a Provenance of this file section naming the two non-Pat elements (the tone-of-voice axis, the worked diagnostic itself).

I verified:

  • All three of the flagged occurrences (stable-unstable-meta.md:205, :225, :242) are updated consistently and read grammatically.
  • grep -rn "central emotion" across context/pat-pattison/research/ turns up no remaining fabricated-quote usages in this file; the only hit left in the file is the provenance section's own reference to the removed fabrication, which is intentional.
  • The new `` comment at line 245 is consistent with (if slightly differently worded than) the pre-existing tone-of-voice caveat at line 81 — both correctly mark it non-book/unattributed. Not a defect, just a minor duplication of the same caveat in two places in one file.
  • CHANGELOG.md's new bullet accurately describes the diff; no version/changelog mismatch (plugin.json stays 0.8.6, matching the existing ## [0.8.6] header — this commit doesn't re-bump).
  • Code fences and spellchecker:off/on blocks in the touched region remain balanced; no placeholder text.

I did not independently run typos/markdownlint-cli2/lychee (not available in this sandbox) — the commit message's claim that all three are clean is author-claimed and unverified by me.

Non-blocking observation (out of scope for this commit, flagging for awareness)

The commit message frames "central emotion" as a fabricated phrase that "was carried here for eight handoffs." The exact phrase (without Pat-attribution) also appears as working terminology in several files not touched by this PRbeyond-books.md, variations.md, response-filter.md, workflows.md, and the templates/*-prompt.md files. None of those are in this PR's diff, so this is outside this review's scope, but it may be worth a look in the verification wave the PR body already promises for the ~9,000 unre-verified lines, to confirm none of those other usages are the same fabricated-quote pattern rather than legitimate shorthand.

Status of previously-flagged items (unchanged by this commit)

Both blocking items raised in earlier review rounds are still open as of HEAD — this commit doesn't touch either file:

  • README.md's license-scope claim ("distilled craft guidance... not book text") vs. the actual verbatim book content now shipped.
  • Complete third-party lyrics ("Strawberry Wine," "One More Dollar") reproduced in full in box-model.md.

Both are already tracked in open review threads with the author's own acknowledgment that they're pending an owner decision, not something to fix silently inside this cleanup — nothing further to add there.
· Branch: fix/songwriting-wave-a-verbatim-cleanup

…defect

Audits audit-checklist.md, bridge.md and every book-attributed block quote in
the research files, and measures how far the <br> line-break bug actually
reached.

audit-checklist.md was nearly half wrong. 192 lines carrying 26 chapter
citations and zero reproduced text — pure checkbox scaffolding attributed to
specific chapters. All 83 boxes were tallied against those chapters: 42
traceable, 15 distorted, 26 invented. Traceable boxes now quote Pat's actual
sentence, distorted ones are corrected, and invented ones are relabelled as the
file's own synthesis rather than deleted, so the owner can see which is which.
11 false section attributions fixed.

bridge.md opened on a bare uncited "A bridge isn't a verse." The sentence is
real but truncated; Pat's full Chapter 23 passage goes on to contrast bridge
against verse and chorus. Restored and cited, along with Exercises 49 and 50
which were entirely absent, plus two numbered lists that had been flattened
into prose run-ons. Also removed a fabricated alias pair — the file claimed
"channel" and "runway" as pre-chorus names; the figure lists only Pre-Chorus,
Climb or Lift, Vest, Verse Extension, Ramp and Prime. That one was catchable
only by reading the image.

Also fixes a fabricated quote in response-filter.md, a quote misattributed to
Chapter 1 that is really Chapter 5, and two couplets in cliche.md presented as
displayed stanzas when Pat quotes them inline, slash-separated.

The line-break damage is narrower than reported. It was flagged as potentially
affecting all ~9,000 lines restored in #2183. Measured across 1,109 consecutive
line-pairs in every quoted block in all 49 files, 27 candidates surfaced and
nearly all were legitimate — 14 are Pat's own deliberate split into eight short
phrases in phrasing.md, the rest are dialogue split per speaker, contrasted
variants, and a wrapped thesaurus entry. Only cliche.md needed correcting.

A proposed fix to hook.md was checked against the raw XHTML and rejected: there
is a <br> between every line there, so those are genuinely separate printed
lines and joining them would have introduced the corruption being hunted.

Two files were completed by a second toolchain after the output content filter
killed the agent working on them mid-task. Its output was verified against
source rather than trusted — it was wrong once, on the hook.md case above.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@claude

claude Bot commented Aug 11, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 3m 7s —— View job


Code review complete

  • Gather context (diff origin/main...HEAD; focused on what's new since the last review round)
  • Review what's new since the last review round (commit 24a895c, "second verbatim sweep, and measure the scaffolding defect")
  • Check for regressions or new correctness issues
  • Post findings

Scope: this round was triggered by the new commit 24a895c, which touches CHANGELOG.md, audit-checklist.md (+489/-108), bridge.md (+306/-133), cliche.md, metaphor.md, object-writing.md, response-filter.md, rhyme-fundamentals.md, rhyme-sonic-bonding.md, and beyond-books.md. Five prior code-review rounds already covered the earlier commits in depth (README license-scope contradiction, full third-party lyrics in box-model.md, the you knows/you seems italics fix) — I focused on what's new rather than re-litigating those, which remain open per the existing threads.

What I checked

  • audit-checklist.md — read the full 597-line diff. This is the file's most substantial correction: 26 chapter-cited boxes tallied against source, invented ones now explicitly relabelled / rather than silently kept or silently deleted. Spot-checked several of the "corrected" citations against sibling files already audited in this PR (e.g. the transitional-bridge six-name list matches bridge.md's own restored figure list; the "central emotion" hedge language is consistent with stable-unstable-meta.md's prior fix) — internally consistent.
  • bridge.md — full diff read. Heading structure is well-formed (no level jumps: ######### throughout, verified by extracting all headings). The "channel"/"runway" alias removal is cross-checked against the same six-name list now in audit-checklist.md's transitional-bridge section — the two files agree.
  • Structural integrity across all 9 touched research files: code-fence counts are even in every file that has fences (metaphor.md 32, cliche.md 22, rhyme-sonic-bonding.md 100, rhyme-fundamentals.md 50, object-writing.md 18); spellchecker:off/:on pairs are balanced; HTML comment markers (``) are balanced per-file (27/27).
  • Cross-file consistency of the corrected quotes: response-filter.md's "Sense-bound is universal..." quote and chapter (now Ch 5, not Ch 1) now matches the same quote/chapter fixed in beyond-books.md in this same commit — previously these two files disagreed on the attribution.
  • No fragment-anchored (#heading) links point into bridge.md or audit-checklist.md from elsewhere in the plugin, so the heading-text edits in this commit can't have broken an external anchor reference.

No new correctness issues found in this commit. It reads as careful, well-cited work — each edit that reclassifies content as "this file's synthesis" rather than Pat's text is doing real work distinguishing invented scaffolding from sourced material, which is the whole point of this PR.

Status of previously-flagged items (unchanged by this commit, not touched here)

Both still open per existing threads, not addressed by 24a895c:

  • README.md:76-79's license-scope claim ("distilled craft guidance... not book text") vs. the verbatim book/lyric text this PR now ships.
  • Complete third-party lyrics ("Strawberry Wine," "One More Dollar") still reproduced in full in box-model.md — both already acknowledged by the author as pending an owner decision.

I did not independently run typos, markdownlint-cli2, or lychee (no tool access in this lane for that); the PR body's verification results are author-claimed and unverified by me.
· Branch: fix/songwriting-wave-a-verbatim-cleanup

@claude

claude Bot commented Aug 11, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 1m 35s —— View job


Security review — no findings

  • Gather context (diff against origin/main base 3906c03 matches the PR's stated stats exactly: 18 files, +3307/-1093; also isolated the newest commit 24a895c since the prior five security-review rounds already covered everything through b60f844)
  • Review each changed file for security issues
  • Post findings

Scope reviewed: the full PR diff (18 files: plugin.json version bump, CHANGELOG.md, and 16 Pat Pattison research markdown files under plugins/songwriting/context/pat-pattison/research/), with focused attention on what's new in 24a895caudit-checklist.md (597 lines), bridge.md (439 lines), CHANGELOG.md, and small edits to beyond-books.md, cliche.md, metaphor.md, object-writing.md, response-filter.md, rhyme-fundamentals.md, and rhyme-sonic-bonding.md. plugin.json is untouched by this commit (stays 0.8.6).

What I checked:

  • Injection surfaces (command / SQL / path / template) — none present; no code, scripts, or executable content anywhere in the diff.
  • GitHub Actions risk (pull_request_target / workflow_run with secrets, script injection via the github context, permissions: widening) — no workflow files touched by this PR at all.
  • Secrets / tokens / credentials — none found.
  • Supply-chain / pin loosening — no dependency or action-pin changes; the only manifest change across the whole PR is the earlier semver bump.
  • Prompt-injection payloads hidden in the research content — this content is loaded as skill context for future agent runs, so it's a real trust boundary. Grepped the newest commit's full diff (1,175 lines across audit-checklist.md and bridge.md alone) plus the smaller files for <script>, javascript:/vbscript:/data:text, on*= handlers, <iframe>/<embed>/<object>, eval(/exec(, shell invocations, instruction-override phrasing ("ignore previous instructions", "system prompt"), and embedded URLs. No matches anywhere in the new commit. All additions are inert prose, blockquoted verbatim/paraphrased text, and citation corrections consistent with the PR's stated purpose (correcting quote attribution, restoring truncated passages, removing a fabricated alias pair and a fabricated quote).

Conclusion: This PR remains a content-only change (verbatim-text restoration, citation corrections, and a <br>-extraction bug writeup) with no code, configuration, or workflow surface. No CRITICAL / IMPORTANT / SUGGESTION security findings.

(Note: the licensing/redistribution concern about verbatim third-party lyric text — "Strawberry Wine" and "One More Dollar" in box-model.md — and the README license-scope contradiction are already tracked in this PR's open review threads as content-provenance/licensing questions, not security vulnerabilities, and remain out of scope for this lane. Neither is touched by the newest commit.)

Branch: fix/songwriting-wave-a-verbatim-cleanup

…mposed lyrics rule

The owner has settled the scope question directly: he owns all four books, he is
the only user of these plugins, and he wants the lyrics Pat analyses reproduced
in full. Two things in the repo contradicted that.

README.md's License paragraph claimed the plugin "contains distilled craft
guidance and short verified anchor quotes, not book text." That stopped being
true at 0.8.5. A false statement in a License section is worse than an
unfashionable true one, so it now says what is actually here: MIT covers the
plugin's own code, skills and prompts and does not extend to quoted material;
the research files reproduce Pat's text and the lyrics he analyses verbatim as a
deliberate personal-reference decision; Pat's writing remains his and the lyrics
remain their writers'; where Pat quotes a lyric his publisher licensed it and
that license is not this repo's; and a reader who is not the owner gets no
rights to any of it from the MIT header. It points at the four books.

point-of-view.md had invented its own rule — "Complete third-party song lyrics
are not reproduced" — and cut lyrics down to fragments. That rule was never the
owner's, and it left the file inconsistent with box-model.md, which reproduces
the lyrics Pat works with in full. Header corrected, and the "As Each Year Ends"
stanza restored to Pat's full six lines. Remaining short excerpts in that file
are now recorded there as a known gap rather than presented as policy.

Note for the next session: this material cannot be delegated to the codex
fallback. Codex declines to reproduce full third-party song lyrics regardless of
ownership or personal-use rationale, so the escape hatch that covers filtered
book prose does not cover lyrics. Restoring those remains hand work in small
increments.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@claude

claude Bot commented Aug 11, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 1m 19s —— View job


Security review — no findings

  • Gather context (gh pr diff 2189; confirmed full diff 3906c03..3bbd0d4 matches the PR's stated stats exactly — 19 files, +3366/-1096)
  • Review each changed file for security issues
  • Post findings

Scope reviewed: all 19 changed files — plugins/songwriting/.claude-plugin/plugin.json (version bump, 0.8.50.8.6), plugins/songwriting/CHANGELOG.md, plugins/songwriting/README.md, and 16 Pat Pattison research markdown files under plugins/songwriting/context/pat-pattison/research/. This trigger fired on the newest commit, 3bbd0d4 ("make the License section true, and revoke a self-imposed lyrics rule"), which touches only three files versus the prior security-review round — CHANGELOG.md, README.md, and point-of-view.md. I diffed those three in isolation as well as re-confirming the full-branch diff.

What's new in this commit, specifically:

  • README.md — rewrites the License section prose. No links, scripts, or executable content added; pure explanatory text about MIT scope vs. quoted third-party material.
  • CHANGELOG.md — prose changelog entry describing the README and point-of-view.md changes.
  • point-of-view.md — revokes a self-imposed "no full lyrics" rule and restores three more lines to an already-present blockquoted lyric excerpt.

What I checked, across the full diff:

  • Injection surfaces (command / SQL / path / template) — none present; no code, scripts, or executable content anywhere in the diff.
  • GitHub Actions risk (pull_request_target / workflow_run with secrets, script injection via the github context, permissions: widening) — no workflow files touched by this PR at all (grepped the full diff for pull_request_target, workflow_run, permissions: — no hits).
  • Secrets / tokens / credentials — none found.
  • Supply-chain / pin loosening — no dependency or action-pin changes; the only manifest change across the whole PR is the semver bump.
  • Prompt-injection payloads hidden in the research content — this content is loaded as skill context for future agent runs, so it's a real trust boundary. Grepped the full diff for <script>, javascript:/vbscript:/data:text, on*= handlers, eval(/exec(, shell invocations, and instruction-override phrasing ("ignore previous instructions", "system prompt") — no matches anywhere in the 19 changed files. All additions are inert prose and blockquoted verbatim/lyric text.

Conclusion: This PR remains a content-only change (verbatim-text restoration, a <br>-extraction bug writeup, a License-section rewrite, and a version bump) with no code, configuration, or workflow surface. No CRITICAL / IMPORTANT / SUGGESTION security findings.

(Note: the licensing/redistribution question about verbatim third-party lyric text in box-model.md and the now-corrected README license-scope wording were already raised and resolved on the record in this PR's review threads — both are content-provenance/licensing matters, not security vulnerabilities, and remain out of scope for this lane.)
· Branch: fix/songwriting-wave-a-verbatim-cleanup

@kyle-sexton
kyle-sexton merged commit 9a2307c into main Aug 11, 2026
33 checks passed
@kyle-sexton
kyle-sexton deleted the fix/songwriting-wave-a-verbatim-cleanup branch August 11, 2026 04:25
kyle-sexton added a commit that referenced this pull request Aug 17, 2026
…sub-threshold miss (#2905)

Closes #2865.

## What this fixes

`scripts/silent-revert-incidents.txt` pins a `clean` row that is
supposed to be the closest a non-incident got to the 200-line threshold
without crossing it — the row that breaks first if a threshold change
starts taxing ordinary development. The pinned commit was not that, and
its note named a number that is not a pull request.

**Defect 1 (the re-pin).** Measured over the file's own 500-commit
corpus (`7b47d2253~500..7b47d22`) at the pinned invocations (#2843,
`GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1`), the pinned
`c8470efd0` scores **136** blamed lines — sixth-closest of the eight
commits in the 100–199 band. The true closest miss is **`9a2307c43`
(#2189) at 195 lines** from `3584ae1fa` (#2183) — a margin of 5 lines,
not the ~71 the old row implied. `9a2307c43` is now the lead `clean`
row.

**Defect 2 (the wrong PR number).** The old note credited the deleted
content to #2679, which is a closed issue in this repository, not a pull
request (`gh pr view 2679` cannot resolve it). The blamed lines trace to
`6370a44e7`, the squash commit that landed #2715 — `gh api
.../commits/6370a44e7/pulls` returns only #2715, and the commit's own
body says `Builds on merged #2715#2692#2690`. The row is kept as a
second guard with its note corrected, rather than dropped: it is still a
verified-legitimate quiet commit, and keeping it costs a few lines of
prose.

**Defect 3 (the "once a month" rate)** was already fixed by #2847, which
removed the rate claim from `scripts/check-silent-revert.sh` entirely.
Nothing in this PR touches it.

## What this does NOT do

Neither clean-row figure is CI-asserted, before or after this change.
`clean` rows carry no bracketed attribution field (#2879) — their
assertion is the absence of findings, which has no per-culprit count to
pin — so the 195 and 136 are hand-measured prose, not watched numbers.
The old row's recorded 129 drifting to a measured 136 under the pinned
invocations without anything going red is exactly that gap, and the
section comment now states it so a reader does not mistake the re-pin
for an assertion. Both counts are written as floors ("no fewer than")
because `attribute_file` drops `git blame`'s stderr (#2880), so any line
blame fails on is silently not counted.

## Verification

- Spot-checked both figures against PR #2843's pinned invocations before
editing: `9a2307c43` reproduces **195** (75 lines
`song-forms-examples.md`, 67 `box-model.md`, culprit `3584ae1fa`),
`c8470efd0` reproduces **136** (109 lines `persist-findings.md`, culprit
`6370a44e7`).
- `bash scripts/check-silent-revert.test.sh`: **101 passed, 0 failed**
on this branch.
- `scripts/check-silent-revert.sh --verify-known-incidents`: exit 0 —
all three `fires` rows reproduce their attributions exactly, and both
`clean` rows stay quiet.
- `scripts/check-silent-revert.sh --verify-restoration`: exit 0 — all 5
markers present.
- A fresh-context verifier independently swept all 500 corpus commits
twice (complete coverage: 487 `ok` + 2 `acknowledged` + 11 finding
commits = 500) and reproduced every figure in the file. Its verdict:
**195 at `9a2307c43` is the highest sub-threshold score** — the next
highest is 188 (`3d69448cb`) — so the lead `clean` row pins the true
closest miss. The two acknowledged commits were re-run with the ack file
disabled and score 447 and 323, both above the threshold, so neither
could displace it.

## Related

- #2843, #2847, #2873 — the three PRs that reshaped the canary and this
file ahead of this change; the figures here are measured under #2843's
pinned invocations.
- #2879 — records that `clean` rows carry no bracketed attribution
field, which is why neither figure in this PR is CI-asserted.
- #2880 — records that `attribute_file` drops `git blame`'s stderr,
which is why both counts are written as floors.
- #2831 / #2832 — the same wrong-PR-number defect shape, corrected
earlier on the `fires` rows.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01LwdkpWf6bptu3AqTMoeg2H

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant