docs(rate-limit-guard,session-flow): cloud degraded-mode + orchestrate fallback

[kyle-sexton]

Summary

Closes the rate-limit cloud observability cluster in-repo by landing the degraded-mode reader contract and the orchestration fallback that consumes it — not by shipping a live cloud statusline producer.

• rate-limit-guard 0.7.5: reference/reader-contract.md adds "Cloud / remote sessions (expected degraded mode)" — absent tee → unknown → reactive-only (expected, not a misconfig); reactive signals (own-session errors, sibling-automation 429s, stop-events.jsonl when present); thin-by-default orchestration fallback; documented residual that a live cloud producer remains out of scope.
• session-flow 0.23.7: /session-flow:orchestrate imperative 7, gotchas, and sources wire the thin-by-default concurrent cap and sibling-429 backoff to that contract.
• README capability-detection bullet points at the new section.

Closes #2697
Closes #2736
Closes #2747

Test plan

• scripts/check-changelog-parity.sh --check (exit 0)
• scripts/check-changelog-parity.sh --check-bump origin/main (exit 0)
• scripts/check-changelog-parity.sh --check-preserved origin/main (exit 0)
• Manifest versions match changelog headings: rate-limit-guard 0.7.5, session-flow 0.23.7
• Grep confirms cloud section + imperative 7 thin-by-default / residual wording

Related

• Residual (documented in the reader contract, not a new issue): live statusline / equivalent producer that would restore proactive window telemetry inside cloud / remote containers.
• Addresses rate-limit-guard: expose rate-limit telemetry to cloud sessions for dynamic orchestration scaling #2736 candidate shape (2) and cloud sessions: no rate-limit telemetry available in-session — agents cannot dynamically scale concurrency #2747 ask (c); does not implement cloud producer wiring (a/b).

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 40s —— View job

---

Security Review (/review:security-review)

• Gather context (PR diff, changed files)
• Invoke /review:security-review per custom instructions
• Post findings / summary

Skip gate hit — no review performed.

All 9 changed files are documentation-only: CHANGELOG.md entries, README.md prose, reference/reader-contract.md / SKILL.md / context/*.md body text, and two plugin.json version-number bumps (rate-limit-guard, session-flow).

Checked specifically for the skill's flagged risk surfaces and found none in this diff:

• No .github/workflows/* files touched.
• No skill frontmatter changes (e.g. allowed-tools, permissions) — only prose bodies changed in orchestrate/SKILL.md.
• No code, scripts, commands, credentials, or executable logic added — this is a docs-only landing of a reader contract and an orchestration-imperative wording update.
• No injection surfaces, auth/access-control logic, or dependency/action pins touched.

This satisfies skip-gate condition 2 ("change has no security-relevant surface after reading the diff"). No findings to report.

[github-actions]

Last security-reviewed head: a84211567e3eb71627fb0af90ec7c7fd40611b4b. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a84211567e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 2m 1s —— View job

---

Claude code review

• Gather context (PR diff, CLAUDE.md, REVIEW.md)
• Review changed files for correctness / maintainability
• Post inline findings (if any)
• Final summary

Scope: This is a docs-only PR across rate-limit-guard (0.7.4 → 0.7.5) and session-flow (0.23.6 → 0.23.7): a new "Cloud / remote sessions (expected degraded mode)" section in reference/reader-contract.md, a matching orchestrate imperative-7 fallback clause, gotcha/source entries, and README/changelog updates. No executable code paths changed.

Checks performed:

• Manifest version bumps match the new CHANGELOG.md headings in both plugins (rate-limit-guard 0.7.5, session-flow 0.23.7).
• plugins/rate-limit-guard/.claude-plugin/plugin.json is valid JSON (visually verified — I could not run the changelog-parity script myself since Bash required interactive approval in this sandbox, so the author's test-plan checkmarks for that script are author-claimed and unverified by me).
• Cross-references resolve: the README's [reference/reader-contract.md](reference/reader-contract.md) relative link is correct from plugins/rate-limit-guard/README.md; the new contract section is referenced (by prose, not as a broken markdown anchor) from SKILL.md, gotchas.md, and sources.md.
• The new reader-contract section's item 3 ("same read cadence as the reactive fallback below") correctly points at the ## Detection records (reactive fallback) section, which is positioned later in the file.
• orchestrate's compact export mode only emits the seven headline lines, not imperative bodies, so the new fallback prose doesn't need duplicating there — checked, no gap.

No high-signal findings. The new content is internally consistent, the versioning/changelog parity holds, and the cross-plugin references (session-flow → rate-limit-guard) are accurate. This is a narrow, well-scoped documentation change with no behavior/code impact, so there's nothing here a careful reviewer would block on.

[github-actions]

Claude has reviewed this PR 2 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[claude]

Claude finished @cursor[bot]'s task in 40s —— View job

---

Code Review (/review:code-review)

• Gather context (PR diff, changed files)
• Invoke /review:code-review per custom instructions
• Post findings / summary

Skip gate hit — no review performed.

Per the pre-fetched context for this invocation, PR #2791's state is MERGED. The /review:code-review skill's skip gate (condition 1: "PR is closed or not open") applies here, so per the skill's own instructions I'm stopping early and posting nothing else — no inline findings, no gh pr review.

For reference, this PR already went through this lane while open: the prior code-review pass (posted 2026-08-16T00:10:15Z, reviewing commit a84211567e) found no high-signal issues on this docs-only change (rate-limit-guard 0.7.4 → 0.7.5, session-flow 0.23.6 → 0.23.7). The only open item on record is Codex's P2 suggestion on orchestrate/SKILL.md:91 about defining a freshness/expiry window for sibling-429 signals — worth a look in a follow-up if it hasn't been addressed, but not something to act on here since the PR is already merged.