fix(claude-config): audit-prompting-postures contract coherence

[kyle-sexton]

Refs #2281 — takes CC-F3, CC-F4, CC-F5, CC-F6, CC-F7, CC-F8, CC-F10. CC-F11 (informational) remains open.

Summary

• Verdict schema adds wording-unverified and info
• Phase A defers model-specific fetches until Phase C needs them; aborts when best-practices page unreachable
• Phase B inventories hook scripts and settings deny/ask for P7 presence evidence
• Documents output-styles as out of scope (CC-F6)
• P8 row carries explicit model condition (CC-F7)
• disallowed-tools: Edit, NotebookEdit enforces read-only contract (CC-F4)
• audit-instructions routes additive posture lane here (CC-F8)

Related

• fix(claude-config): audit-prompting-postures' contract disagrees with itself in eight places #2281 — CC-F11 informational row not taken

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 1m 9s —— View job

---

Security Review Complete

• Gather context (PR diff via gh pr diff 2410, changed files)
• Review changed files for security issues
• Post findings

Scope reviewed: plugin.json, CHANGELOG.md, audit-instructions/SKILL.md, audit-prompting-postures/SKILL.md, audit-prompting-postures/reference/postures.md.

Findings

No security issues found.

This PR is a documentation/instruction-only change to a Claude Code skill (audit-prompting-postures) plus a version bump and changelog entry. It does not touch application code, GitHub Actions workflows, secrets/credential handling, or any executable logic — there's no command/SQL/path/template injection surface, no authorization logic, and no CI/CD configuration in the diff to assess against this lane's mandate.

Notable changes I looked at specifically for security implications, all benign:

• disallowed-tools: Edit, NotebookEdit (SKILL.md#L4) — this is a least-privilege improvement, mechanically enforcing the skill's read-only contract rather than relying on prose alone.
• Phase A's WebFetch targets remain hardcoded to fixed platform.claude.com documentation pages both before and after this change (SKILL.md#L40-L46) — deferring when the model-specific subpage fetch happens doesn't introduce a new fetch target or any user/attacker-controlled URL.
• Phase B's new instruction to inspect hooks.json and permissions.deny/permissions.ask for P7 evidence (SKILL.md#L56-L59) is a read-only inspection instruction, not execution of the hook scripts themselves.

No workflow files, unpinned dependencies, or permission grants were touched in this PR.

[claude]

Claude finished @kyle-sexton's task in 4m 52s —— View job

---

Code Review

Reviewed the diff (plugin.json, CHANGELOG.md, audit-instructions/SKILL.md, audit-prompting-postures/SKILL.md, audit-prompting-postures/reference/postures.md) against the PR's stated goal of closing CC-F3–F8/F10 contract-coherence gaps. Scope is entirely documentation/skill-instruction prose, so this review focuses on internal coherence and whether the described mechanisms actually deliver the claimed guarantee — no security-lane findings apply here.

Most of the change lands cleanly: the verdict-vocabulary additions (wording-unverified, info) are used consistently everywhere referenced, the P7 hook/settings inventory addition in Phase B is a reasonable extension, the output-styles-out-of-scope note correctly documents a real divergence from audit-instructions, and the audit-instructions routing line is a correct pointer.

Two findings posted inline, both on newly-added content:

1. reference/postures.md (P8 "Model condition") — Important. The new bullet hardcodes the guide's current context-aware model list into the catalog. This contradicts two explicit statements already in this skill: the catalog's own header ("Pointers only — wording is fetched live... the recheck trigger for every row is a change to its cited section") and SKILL.md's "What this skill does NOT do" ("Never copies guide text into its own catalog"). Nothing forces this list to be re-verified against a live fetch, so it will silently drift as new context-aware models ship, producing false NOT-APPLICABLE verdicts until someone manually notices. Given the PR's purpose is contract coherence, this is a self-contradiction worth fixing before merge (a pointer-style condition instead of an embedded snapshot).
2. SKILL.md line 6 (disallowed-tools: Edit, NotebookEdit) — Suggestion. The CHANGELOG says this "enforces the read-only contract mechanically," but Write and Bash remain in the tool pool (both needed elsewhere — report persistence, state-key.sh), and either could still overwrite an audited component's file. Not blocking, since path-scoped enforcement isn't achievable via disallowed-tools alone, but the "mechanically" framing overstates the actual guarantee.

Permalinks for reference:

• claude-code-plugins/plugins/claude-config/skills/audit-prompting-postures/reference/postures.md

  Lines 85 to 88 in b59e10d

  	Sonnet 5, Claude Sonnet 4.6, Claude Sonnet 4.5, and Claude Haiku 4.5 per the guide's context-
  	awareness section on platform.claude.com). Proposals for other models must be NOT-APPLICABLE or
  	carry the same condition explicitly.
  	- **Present when:** the surfaced figure is accompanied by do-not-wrap-up-early framing (or the

• claude-code-plugins/plugins/claude-config/skills/audit-prompting-postures/SKILL.md

  Line 6 in b59e10d

  disallowed-tools: Edit, NotebookEdit

Version bump and CHANGELOG entry are accurate and consistent with the actual changes.

• Gather context (PR diff, CLAUDE.md, REVIEW.md)
• Understand the request
• Review changed files for correctness & maintainability
• Post inline findings
• Post summary comment
  · Branch: cursor/audit-prompting-postures-coherence-63e1

[claude]

🔴 Important: This "Model condition" bullet hardcodes a snapshot of the guide's context-aware model list (Claude Sonnet 5, Claude Sonnet 4.6, Claude Sonnet 4.5, and Claude Haiku 4.5) directly into the catalog.

Two things this file's own contract says should not happen:

1. The file header (line 6) states: "Pointers only — wording is fetched live per SKILL.md Phase A; the recheck trigger for every row is a change to its cited section." This list isn't a pointer, it's an answer copied from the guide.
2. SKILL.md's "What this skill does NOT do" section (line 165) is explicit: "Never copies guide text into its own catalog — wording comes from the run's live fetch."

Because the list is embedded rather than fetched, there's no mechanism that will catch it going stale — the "recheck trigger = change to the cited section" only works when the row holds a pointer, not a copied answer. If the guide adds another context-aware model, this row silently keeps producing incorrect NOT-APPLICABLE verdicts for that model until someone manually notices and edits this file — exactly the "prior-model-era scar tissue" class of problem audit-instructions (this same plugin) exists to catch.

Consider making the condition a pointer instead (e.g. "applies only on models the guide's context-awareness section names as context-aware — verify against a live fetch, do not assume this list is current") rather than embedding the current answer.

[claude]

🟡 Suggestion: The CHANGELOG frames this as enforcing the read-only contract "mechanically," but disallowed-tools only removes Edit and NotebookEdit from the pool. Write is still available (it has to be — Phase D's report persistence at ${CLAUDE_PLUGIN_DATA}/.../last-audit.md needs it), and so is Bash, which the skill also uses (lib/state-key.sh). Either tool can overwrite an audited component's file directly, so the mechanical guarantee is narrower than "never edits a component" (SKILL.md line 164) — it blocks the two most obvious edit paths, not all of them.

Not blocking (full mechanical enforcement of read-only against Write/Bash isn't achievable with path-scoped precision via disallowed-tools alone, and prose already carries most of the weight here), but worth either softening the CHANGELOG's "mechanically" claim or noting the residual gap explicitly in the skill's read-only contract section.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[kyle-sexton]

Superseded by #2408, which carries the full #2281/#2283 contract stack.