fix(claude-config): declare dispatch-unavailable posture in audit skills

[kyle-sexton]

Fixes #2279.

Three audit skills mandate independent subagent verification but previously had no degraded mode. Each now requires disclosure when dispatch is unavailable, (unverified) marking for unverified proposals, and per-lane verification attestation in the report.

Related

• fix(claude-config): three audit skills mandate independent verification and none states a posture for dispatch being unavailable #2279

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 38s —— View job

---

Security Review — No Issues Found

• Gather context (PR diff, changed files)
• Review changed files for security issues
• Post findings

Scope: All 6 changed files are non-executable — SKILL.md prose documentation, a CHANGELOG.md entry, a reference-doc table row, and a plugin.json version bump (0.34.0 → 0.34.1). No scripts, no GitHub Actions workflows, no code paths that execute commands, handle secrets/tokens, parse untrusted input, or touch permissions/config settings.

Reviewed for the categories in scope for this lane (logic/authorization flaws, injection surfaces, secret handling, trust-boundary issues) — none apply here, as there is no executable surface introduced or modified. The plugin.json diff is a version string only; no manifest permissions, commands, or hooks changed.

Verdict: No security findings. This PR is documentation-only and carries no security risk.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: da83854252

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 2m 32s —— View job

---

Code review complete

• Gather context (PR diff, changed files)
• Read repo CLAUDE.md / REVIEW.md guidelines
• Review changed skill files for correctness & alignment
• Post inline findings
• Post final summary

This is a docs/prompt-instructions change (three SKILL.md files plus a schema reference), so REVIEW.md's security-lane checks (authz, tenancy, secrets, injection) don't apply here — there's no executable code path touching untrusted input. I scoped the review to correctness and cross-file consistency of the new "when dispatch is unavailable" guidance, since that's exactly the kind of thing audit-instructions/audit-pass themselves would flag.

Findings (posted inline):

1. audit-pass/SKILL.md:309 — the new instruction says to record per-lane verification mode "in the run manifest," but the manifest's canonical schema in reference/run-state-and-resumability.md:175 (a closed-looking three-field list) wasn't updated to include it — unlike the findings.json schema in reference/report-location-and-schema.md, which this PR did update to add a verification row. The manifest-side half of this instruction currently has no matching schema definition.
2. audit-prompting-postures/SKILL.md:86 vs :165 — a real contradiction: the new dispatch-unavailable section says to add the verifier attestation line specifically because Phase D didn't run, but the unchanged report-tail sentence (now with an appended clause) gates that same line on "When Phase D ran". As written, a dispatch-unavailable run would, per line 165, omit the disclosure line 86 requires.

Both are docs-only inconsistencies (no schema/version conflicts elsewhere) — plugin.json version bump and CHANGELOG.md entry are correctly formatted and consistent with prior entries. The verified | inline | skipped enum is used consistently across all three skill files and the schema reference except for the two spots above.
· Branch

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[github-actions]

Warning

Automated security review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31563990749
• Failure class: other
• Last SDK result: (no execution file was produced)

The check is green on purpose, and it is not evidence. It certifies that a security pass ran, and this one did not complete — but the cause is outside this PR's control, so merging is deliberately left unblocked rather than locking every merge for the length of the outage. Nothing was reviewed at this head. Where this check is required, it is satisfied without that evidence; a human should review security-sensitive changes here before merging.

Re-run the job to retry the review; a new push also retries it only if the caller's pull_request triggers include synchronize (the canonical security caller keeps it). An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator.

Re-running does NOT help for every class:

• rate-limit that persists across re-runs, or auth — the credential or usage budget needs an operator; retrying will not clear it.
• a run that exhausted its turn budget ("subtype":"error_max_turns" above) will exhaust it again. As the PR author, split the change into smaller PRs; raising --max-turns is a change to the caller workflow, not something you can set on this PR.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31563990820
• Failure class: other
• Last SDK result: (no execution file was produced)

Re-run the job to retry the review. A new push re-triggers this lane only if the caller's pull_request triggers include synchronize (the canonical caller omits it).
An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator (auth).