fix(docs-hygiene): Form 14 matches title-cased ATX headings

[kyle-sexton]

Fixes #1394

What

Form 14's ATX and Setext title alternatives now embed (?i) so # Re-Anchor matches a container named re-anchor instead of missing Form 14 and falling through to bare Form 2 (which defaulted to Certain for non-verb tokens). Manifest/catalog declaration alternatives stay case-sensitive; audit.md warns against global -i.

Related

• docs-hygiene(rename-references): Form 14 is case-sensitive, so a title-cased heading falls through to a LESS safe classification #1394

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 42s —— View job

---

Security Review

• Gather context (diff, changed files)
• Review changed files for security issues
• Report findings

Scope reviewed: git diff origin/main...HEAD — 4 files: plugin.json (version bump), CHANGELOG.md (prose), context/audit.md, context/patterns.md (regex pattern docs for the rename-references skill).

No security issues found.

This PR is documentation-only for a Claude Code skill's pattern library — it adds a (?i) case-insensitivity flag to two regex alternatives (Form 14's ATX/Setext title patterns) documented in markdown, plus a matching CHANGELOG entry and version bump. These patterns are not executable code: they're substituted into ripgrep queries an agent issues via the Grep tool when running the skill, never via shell interpolation or eval.

Checked specifically for the classes called out in the review brief, none apply here:

• No GitHub Actions workflow files touched — no pull_request_target/workflow_run, no permissions: changes, no script-injection surface via the github context.
• No command/SQL/path/template injection surface — nothing in this diff constructs a shell command or file path from user input.
• No secrets/token/credential handling touched.
• No ReDoS concern — the widened alternatives ((?i)^#{1,6}\s+??\s*(#+\s*)?$ and its Setext counterpart) have no nested/overlapping quantifiers; (?i) alone doesn't introduce backtracking risk.
• The change is scoped correctly and intentionally: audit.md/patterns.md explicitly call out that the manifest/catalog declaration alternatives (Form 14's other 4 regex lines) stay case-sensitive and warn against a global -i, which is the right call — those alternatives key off exact registered identifiers (name/id fields), and case-folding them could cause the skill to match/rewrite an unrelated declaration.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d687343902

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 3m 53s —— View job

---

Code Review

• Gather context (CLAUDE.md, REVIEW.md, PR diff)
• Review changed files for correctness
• Check alignment with docs-hygiene skill conventions
• Post findings

Reviewed the 4 changed files against REVIEW.md's code-review-lane scope (correctness, conventions, error handling, tests, documentation). This repo has no active claude-security-review.yml check on this PR, but the change has no security surface (regex-pattern docs only), so nothing was withheld for that lane.

The core fix is sound. Confining (?i) to the ATX/Setext title alternatives (not the manifest/catalog declaration alternatives) is the right scope — declared name/title/id fields are exact identifiers and should stay case-sensitive, while a heading's entire content still has to equal <old> (the $-anchor discipline described in patterns.md), so case-insensitivity doesn't reopen the false-positive risk Form 2's ambiguous bucket exists to catch. The docs in audit.md and patterns.md are updated consistently with the regex change, and the CHANGELOG.md entry accurately describes it.

Two findings posted inline, both non-blocking:

1. plugin.json:4 — version jumps 0.11.0 → 0.11.2, skipping 0.11.1. Every other version bump in this plugin's CHANGELOG.md history (0.3.0 through 0.11.0) increments by exactly one step; this is the first gap. Possibly an unintentional double-bump.
2. patterns.md:296 — evals/evals.json has dedicated regression cases for other Form 14 edge cases (Setext titles, closed ATX), but no case was added for the title-cased-heading bug this PR fixes (docs-hygiene(rename-references): Form 14 is case-sensitive, so a title-cased heading falls through to a LESS safe classification #1394), so nothing in the suite guards against it regressing.

No blocking issues found.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[github-actions]

Warning

Automated security review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31561914645
• Failure class: other
• Last SDK result: (no execution file was produced)

The check is green on purpose, and it is not evidence. It certifies that a security pass ran, and this one did not complete — but the cause is outside this PR's control, so merging is deliberately left unblocked rather than locking every merge for the length of the outage. Nothing was reviewed at this head. Where this check is required, it is satisfied without that evidence; a human should review security-sensitive changes here before merging.

Re-run the job to retry the review; a new push also retries it only if the caller's pull_request triggers include synchronize (the canonical security caller keeps it). An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator.

Re-running does NOT help for every class:

• rate-limit that persists across re-runs, or auth — the credential or usage budget needs an operator; retrying will not clear it.
• a run that exhausted its turn budget ("subtype":"error_max_turns" above) will exhaust it again. As the PR author, split the change into smaller PRs; raising --max-turns is a change to the caller workflow, not something you can set on this PR.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31561914591
• Failure class: other
• Last SDK result: (no execution file was produced)

Re-run the job to retry the review. A new push re-triggers this lane only if the caller's pull_request triggers include synchronize (the canonical caller omits it).
An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator (auth).