feat(claude-config): complete the permission-state skill and add the auto-mode authoring lane

.gitattributes

@@ -59,3 +59,11 @@ packages.lock.json  -diff
 *.woff2  binary
 *.ttf    binary
 *.otf    binary
+
+###############################################################################
+# Byte-exact fixtures. This one reproduces a measured Claude Code defect: a RAW
+# control character inside a JSON string value, which `jq` rejects outright. Any
+# line-ending normalization would rewrite that byte and the fixture would become
+# valid JSON, silently turning its regression case into a test of nothing.
+###############################################################################
+plugins/claude-config/skills/audit-permission-state/evals/fixtures/automode-config-rawctl.json -text

.github/workflows/ci.yml

@@ -184,10 +184,23 @@ jobs:
           # the same corpus: it pins each fixture's trusted --credential-roots
           # (a real runner home) and expected not-under-root rejections, so it
           # necessarily carries those same host paths.
+          # audit-permission-state is the third case of the same kind: its
+          # C6-winPath check EXISTS to find Windows paths in permission rules,
+          # so its detector message quotes one, its criteria file quotes the
+          # settings page quoting one, and its fixtures must carry them or the
+          # check has nothing to detect. The oracle fixtures reproduce Claude
+          # Code's own [DEBUG] narration, which prints native Windows settings
+          # paths — rewriting those would make the fixture stop matching what
+          # the parser has to survive. The paths are invented (`alice`, `x`),
+          # not any operator's.
           exclude: >-
             :(exclude)plugins/guardrails/lib/path-detection/**
             :(exclude)plugins/autonomy/skills/setup/evals/fixtures/security-binding/**
             :(exclude)plugins/autonomy/skills/setup/scripts/check-security-binding.fixtures.test.manifest.json
+            :(exclude)plugins/claude-config/skills/audit-permission-state/reference/criteria.md
+            :(exclude)plugins/claude-config/skills/audit-permission-state/scripts/permission-plane-lint.sh
+            :(exclude)plugins/claude-config/skills/audit-permission-state/scripts/permission-plane-lint.test.sh
+            :(exclude)plugins/claude-config/skills/audit-permission-state/scripts/automode-entry-diff.test.sh
 
       - name: Check index-level EOL drift
         id: eol

docs/CATALOG.md

@@ -74,7 +74,7 @@ plugin manifests and kept in sync by CI — never hand-edit it; the category voc
 
 - [`desktop-notification`](../plugins/desktop-notification) — Alert you when Claude Code needs input — an audible terminal bell, an OSC 9 terminal notification, and an OS-native toast (macOS/Linux) on permission and idle prompts.
 - [`playbooks`](../plugins/playbooks) — Doctrine and knowledge playbooks as on-demand skills, plus a maintainer-facing update skill. boris — Boris Cherny's Claude Code workflow tips (howborisusesclaudecode.com); skill-authoring — Anthropic's internal skill-authoring playbook; fable-5 — Claude Fable 5's operating doctrine (self-authored, no upstream). The boris and skill-authoring packs vendor a verbatim upstream baseline; /playbooks:update drift-checks and syncs those baselines centrally (maintainers).
-- [`claude-config`](../plugins/claude-config) — Eight configuration-health skills (plus setup) for a repo's Claude Code configuration: audit (settings.json / .mcp.json / hooks / plugins / permissions drift), audit-automation-gaps (evidence-gated verdicts on automation gaps), audit-permission-grants (allow-rule / allowed-tools grants for auto-mode durability and portability), audit-permission-state (which settings scopes exist and what rules each one holds — managed policy, user-global, project, local, and the pre-v2.1.211 start-directory copy), audit-instructions (locally-owned instruction surfaces vs current model capability — proposes removals/rewrites of instructions the model no longer needs, and detects cross-surface instruction conflicts), audit-prompting-postures (the additive lane — posture guidance the prompting guide says a component's purpose needs but the component does not carry), audit-pass (one coordinated, ordered, resumable pass over a named target — three-scope inventory, run-time-derived exclusion set, stable finding identity, suppression memory, resume, one human gate — delegating every check to the plugin that owns it), and unhobble (the empirical bare-baseline experiment: reversibly strip a repo's standing instructions, log real stumbles against the current model, re-add only what evidence earns).
+- [`claude-config`](../plugins/claude-config) — Nine configuration-health skills (plus setup) for a repo's Claude Code configuration: audit (settings.json / .mcp.json / hooks / plugins / permissions drift), audit-automation-gaps (evidence-gated verdicts on automation gaps), audit-permission-grants (allow-rule / allowed-tools grants for auto-mode durability and portability), audit-permission-state (the permission rules actually in effect — every settings scope merged with per-rule provenance, what auto mode drops on entry, config written where nothing reads it, and which managed intents are enforced versus loosenable), draft-auto-mode-rules (interview and draft a paste-ready autoMode classifier block; prints only, never writes), audit-instructions (locally-owned instruction surfaces vs current model capability — proposes removals/rewrites of instructions the model no longer needs, and detects cross-surface instruction conflicts), audit-prompting-postures (the additive lane — posture guidance the prompting guide says a component's purpose needs but the component does not carry), audit-pass (one coordinated, ordered, resumable pass over a named target — three-scope inventory, run-time-derived exclusion set, stable finding identity, suppression memory, resume, one human gate — delegating every check to the plugin that owns it), and unhobble (the empirical bare-baseline experiment: reversibly strip a repo's standing instructions, log real stumbles against the current model, re-add only what evidence earns).
 - [`claude-memory`](../plugins/claude-memory) — Keeps a repo's Claude Code memory layer healthy and under your control, against criteria derived from official Claude Code documentation. The audit skill checks the instruction/memory layer (CLAUDE.md, CLAUDE.local.md, .claude/rules/, auto-memory) with a deterministic script-backed spine plus judgment-tier checks. The stateless skill inspects, disables, and (confirm-gated) purges Claude-written auto memory across all settings scopes.
 - [`claude-ops`](../plugins/claude-ops) — Claude Code operations toolkit. Ten skills: inventory (read-only enumeration of the complete invocable surface — every built-in CLI command with aliases and hidden/gated status, every bundled skill, and every component of every installed plugin across all marketplaces; reads the shipped binary because upstream publishes no built-in command list, and carries an integrity verdict so a drifted build reports counts as floors rather than silently short totals), audit-install-state (read-only audit of the machine-scope ~/.claude installation directory and ~/.claude.json — full inventory split into an authored surface and rolled-up bulk trees, product-managed retention vs genuinely unmanaged state, filename-scheme resolution before any process-liveness check, and deliberate/mid-experiment detection; reports, never deletes), audit-performance (read-only slowness-diagnostic capture run at the moment the machine or a session feels slow — CLI version, retention-sweep health including the silent unparsable-settings pause, a timed census walk of the install tree as a sweep-cost proxy, active-session and plugin-fleet counts, a process census, and a bundled known-performance-issues reference; separates the three documented suspects — accumulated state, version regression, component bloat — and routes remediation out; reports, never mutates), observability (read locally captured telemetry — OTEL store, collector, hook-event JSONL, ccusage — with trend reports and store pruning), known-issues (search known Claude product GitHub bugs, check service health, maintain a persistent tracked-issue registry), changelog (ingest Claude Code changelog entries and integrate them into the current repo), plugins (bring a machine's plugin fleet current on demand — marketplace refresh, effective-scope updates including in-repo project/local installs, new-plugin install per policy, scope-divergence detection and explicit convergence), morning-brief (read-only gh-based operator morning view — queue-label counts, merge-ready PRs, parked decisions with their RECOMMENDED lines, and loop-lane telemetry freshness), lanes (start/restart/stop/status loop lanes as named background Claude Code sessions seeded from canonical prompt files, with per-lane model/effort, a repo-pull + marketplace-refresh launch step, and a consume-restarts action — an OS-schedulable reader that relaunches stopped lanes whose telemetry carries a restart_request), and a re-runnable setup action that settles where the known-issues registry lives. Plus a family of seven advisory *-audit telemetry-emitter hooks (API errors, config changes, instruction loads, permission denials, pre-compaction, skill usage, tool failures) that emit the shared hook-telemetry envelope, and a reference sink that maps envelopes into the hook-events.jsonl the observability skill reads.
 - [`rate-limit-guard`](../plugins/rate-limit-guard) — Shared rate-limit guard for loop lanes: a statusline wrapper tees the subscription rate-limit windows to a fixed machine-scope file, a StopFailure hook records rate-limit stops reactively, and a reader contract fixes how consuming sessions pause and resume.

docs/MIGRATION-PLAYBOOK.md

@@ -683,6 +683,19 @@ plugins-reference, and hooks pages 2026-07-17; re-verify per the `CLAUDE.md` fre
    **advisory** (exits 0, never blocks) vs gating; no `eval` / `curl … | sh` / outbound network; untrusted
    input (file contents, tool args, PR/issue text) never flows unquoted into a shell; a kill switch
    (a per-hook `userConfig` boolean with a `default` of `true`) exists.
+   - **A skill's frontmatter `allowed-tools` is a prompt-free execution grant, and workspace trust does
+     not gate it.** Measured on Claude Code 2.1.225: a marketplace-installed skill's `allowed-tools`
+     entry takes effect at **user scope** in a **never-trusted** workspace, under `-p` where no trust
+     dialog can appear — the covered command ran without a prompt, the uncovered one blocked with
+     `This command requires approval`, and a no-grant baseline confirmed that shape blocks. Bounds on
+     the measurement: a local-directory marketplace, and user scope only.
+     **Consequence: the install-time plugin trust prompt is the only gate in front of such a grant —
+     there is no second, per-workspace one.** Review every `allowed-tools` entry with the scrutiny a
+     hook command gets, and deny by default anything broader than the specific command the skill's own
+     scripts invoke. A wildcard interpreter grant (`Bash(python*)`, `Bash(*)`, bare `Bash`) is a deny
+     outright: it is arbitrary code execution in a workspace the consumer never trusted.
+     `claude-config:audit-permission-grants` check P1 detects exactly these shapes and is the
+     mechanical half of this criterion.
 2. **MCP servers — `.mcp.json` / inline in `plugin.json`.** `miro` is the only plugin that ships a
    **local** `stdio`, bundled server (see its §2 trust accept above); `dometrain` is the only plugin
    that ships a **remote** server (see its review record below), which remains the higher-scrutiny

docs/OFFICIAL-DOCS.md

@@ -47,7 +47,7 @@ components are declared in, not a component, so it has no row.
 | Monitors (`monitors/monitors.json`) | <https://code.claude.com/docs/en/plugins-reference#monitors> | 2026-08-06 |
 | Channels (`channels` manifest field) | <https://code.claude.com/docs/en/channels> | 2026-08-06 |
 | Executables (`bin/`) | <https://code.claude.com/docs/en/plugins-reference#file-locations-reference> | 2026-08-06 |
-| Settings (`settings.json` defaults) | <https://code.claude.com/docs/en/settings> | 2026-08-06 |
+| Settings (`settings.json` defaults) | <https://code.claude.com/docs/en/settings> | 2026-08-12 |
 | Dependencies (`dependencies` manifest field) | <https://code.claude.com/docs/en/plugin-dependencies> | 2026-08-06 |
 
 ## Authoring
@@ -104,14 +104,14 @@ SDK-based host.
 
 | Page | Official doc page | Verified date |
 |---|---|---|
-| Settings | <https://code.claude.com/docs/en/settings> | 2026-08-06 |
+| Settings | <https://code.claude.com/docs/en/settings> | 2026-08-12 |
 | Server-managed settings | <https://code.claude.com/docs/en/server-managed-settings> | 2026-08-06 |
 | Control MCP server access for your organization | <https://code.claude.com/docs/en/managed-mcp> | 2026-08-06 |
 | Memory — CLAUDE.md, `.claude/rules/`, auto memory | <https://code.claude.com/docs/en/memory> | 2026-08-06 |
 | The `.claude` directory | <https://code.claude.com/docs/en/claude-directory> | 2026-08-06 |
-| Permissions | <https://code.claude.com/docs/en/permissions> | 2026-08-06 |
-| Permission modes | <https://code.claude.com/docs/en/permission-modes> | 2026-08-06 |
-| Configure auto mode (`autoMode`, `claude auto-mode`) | <https://code.claude.com/docs/en/auto-mode-config> | 2026-08-09 |
+| Permissions | <https://code.claude.com/docs/en/permissions> | 2026-08-12 |
+| Permission modes | <https://code.claude.com/docs/en/permission-modes> | 2026-08-12 |
+| Configure auto mode (`autoMode`, `claude auto-mode`) | <https://code.claude.com/docs/en/auto-mode-config> | 2026-08-12 |
 | Environment variables | <https://code.claude.com/docs/en/env-vars> | 2026-08-10 |
 
 ## Prompting doctrine (platform docs)

docs/SKILL-CHEAT-SHEET.md

@@ -143,8 +143,9 @@ owned by [docs/CATALOG-TAXONOMY.md](CATALOG-TAXONOMY.md).
 | [`/claude-config:audit-instructions`](../plugins/claude-config/skills/audit-instructions/SKILL.md) | `claude-config` | Find instructions current models no longer need across CLAUDE.md, rules, and skill bodies |
 | [`/claude-config:audit-pass`](../plugins/claude-config/skills/audit-pass/SKILL.md) | `claude-config` | Run one coordinated, resumable audit pass over a repo with a single human gate |
 | [`/claude-config:audit-permission-grants`](../plugins/claude-config/skills/audit-permission-grants/SKILL.md) | `claude-config` | Audit permission grants for portability and auto-mode durability |
-| [`/claude-config:audit-permission-state`](../plugins/claude-config/skills/audit-permission-state/SKILL.md) | `claude-config` | Report which permission scopes exist and what rules each one holds |
+| [`/claude-config:audit-permission-state`](../plugins/claude-config/skills/audit-permission-state/SKILL.md) | `claude-config` | Report the permission rules actually in effect and what auto mode drops |
 | [`/claude-config:audit-prompting-postures`](../plugins/claude-config/skills/audit-prompting-postures/SKILL.md) | `claude-config` | Find posture guidance the prompting guide says a component needs but does not carry |
+| [`/claude-config:draft-auto-mode-rules`](../plugins/claude-config/skills/draft-auto-mode-rules/SKILL.md) | `claude-config` | Interview and draft a paste-ready autoMode block, never writing settings |
 | [`/claude-config:unhobble`](../plugins/claude-config/skills/unhobble/SKILL.md) | `claude-config` | Strip instructions to a bare baseline, log real stumbles, re-add only what evidence earns |
 | [`/claude-memory:audit`](../plugins/claude-memory/skills/audit/SKILL.md) | `claude-memory` | Audit CLAUDE.md, rules, and auto-memory against the official-docs checklist |
 | [`/claude-memory:stateless`](../plugins/claude-memory/skills/stateless/SKILL.md) | `claude-memory` | Inspect, disable, or purge Claude Code's per-repo auto memory |