Skip to content

fix(docs-hygiene): compress caveman/taxonomy audit remediations (0.15.0) - #2805

Closed
kyle-sexton wants to merge 1 commit into
cursor/2735-route-sibling-8f91from
cursor/2745-compress-audit-8f91
Closed

fix(docs-hygiene): compress caveman/taxonomy audit remediations (0.15.0)#2805
kyle-sexton wants to merge 1 commit into
cursor/2735-route-sibling-8f91from
cursor/2745-compress-audit-8f91

Conversation

@kyle-sexton

@kyle-sexton kyle-sexton commented Aug 16, 2026

Copy link
Copy Markdown
Contributor

Summary

Remediates the plugin-quality audit findings for docs-hygiene:compress (#2745):

  • H1 — caveman Step B rewritten as numbered cross-tool-call steps (no EXIT trap / non-persistent env)
  • M1detect-caveman.sh requires enabled: true, prefers caveman@caveman; fixture tests for disabled/enabled
  • M2/M3/M4 — signal 6 owns its curated token list; drifted-skill niche annotated unreachable via signal 1; Purpose/LATITUDE/matrix aligned (batch = word-level; Edit fallback = full taxonomy)
  • M5 — yield circuit breaker (5 consecutive auto-reverts) + interview default downgraded to top-10 COMPRESS
  • M6 — eval 8 points at new terse-agent.md fixture; path coupling reduced on evals 9/10
  • M7scripts/audit-scan.sh + contract test; audit action calls it
  • L1–L6 / I1 — precomputed pipeline fix; version note; SOFT-BLOCK wording; fixture-gate conventions; deliberate disable-model-invocation: false

Bump docs-hygiene to 0.15.0.

Stacked on #2798 (path mutex — shared version line).

Test plan

  • bash plugins/docs-hygiene/skills/compress/scripts/detect-caveman.test.sh — 14/14
  • bash plugins/docs-hygiene/skills/compress/scripts/audit-scan.test.sh — 3/3
  • audit-scan.sh on terse-agent.md → SKIP (0/kw)

Closes #2745

Related

Rewrite caveman Step B for cross-tool Bash semantics, honor enabled+marketplace
identity in detect-caveman, ship audit-scan.sh, add yield circuit breaker and
top-10 interview default, and align taxonomy/LATITUDE/docs with the word-level
batch path vs Edit-fallback split.

Closes #2745

Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
@cursor

cursor Bot commented Aug 16, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@claude

claude Bot commented Aug 16, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 1m 31s —— View job


Security review (/review:security-review)

  • Gather context (PR diff, repo CLAUDE.md)
  • Run /review:security-review — reviewed all 13 changed files, with focus on the two new/modified shell scripts
  • Post findings

Scope reviewed: full diff origin/cursor/2735-route-sibling-8f91...HEAD (13 files). Primary security-relevant surface: scripts/audit-scan.sh (new), scripts/audit-scan.test.sh (new), and scripts/detect-caveman.sh (modified). Also checked the SKILL.md cross-tool-call rewrite (H1) for the tempdir/rm -rf sequence, the plugin.json version bump, and evals.json/context doc edits.

Findings: none.

  • Both scripts only ever operate on filesystem paths passed as CLI args or produced by their own mktemp -d — no network input, no secrets, no user-controlled string reaches eval, jq -r --arg-free interpolation, or an unquoted shell expansion. All variable file-path uses are double-quoted.
  • detect-caveman.sh's new enabled == true / pinned-caveman@caveman-preferred jq filter is a fixed program piped local claude plugin list --json output — no injection surface, and it correctly fails closed (disabled installs no longer report "available").
  • audit-scan.sh's FLAVOR_RE is a static alternation used only with grep -E, not attacker-influenced, no ReDoS-relevant nesting/backtracking blowup.
  • The SKILL.md Step B rewrite (mktemp tempdir → Skill call → copy-back/rm -rf) replaces an EXIT trap that doesn't survive across tool calls with an explicit rm -rf "$(dirname "<absolute-path-from-step-1>")" — the path is anchored to the just-created mktemp -d output from the same sequence, not externally controlled, so this isn't a path-traversal or arbitrary-delete risk.
  • No changes to GitHub Actions workflows, permissions, allowed-tools/disable-model-invocation gates (the new note on disable-model-invocation: false is documentation only, not a behavior change), secrets handling, or dependency/action pins in this diff.

This PR has no exploitable security-relevant surface — it's a docs-hygiene skill/prose + shell-heuristic change operating entirely on local, trusted inputs. Per the skip-gate criteria in /review:security-review, no inline findings are being posted.
· branch cursor/2745-compress-audit-8f91

@github-actions

Copy link
Copy Markdown

Last security-reviewed head: 9ad608af0bdd130c5ba3368db4935e46551fd818. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9ad608af0b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

is_signal1_path() {
local f="$1" base
base="$(basename "$f")"
[[ "$f" == *'/.claude/rules/'* || "$f" == */.claude/rules/* ]] && return 0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Recognize repo-root .claude/rules paths

When the audit receives the repo-relative paths produced by git status or git ls-files, a root rule such as .claude/rules/security.md matches neither pattern because both require a preceding slash. Signal 1 therefore does not force these always-loaded files to SKIP; a sufficiently flavor-heavy root rule can be reported as COMPRESS and included in the repo-wide candidate cohort. Accept .claude/rules/* in addition to absolute and nested forms.

Useful? React with 👍 / 👎.


tick_pairs=$(grep -o '`' "$file" 2>/dev/null | wc -l | tr -d ' ')
tick_pairs=$((tick_pairs / 2))
path_hits=$(grep -Eoc '(@|[a-z][a-z0-9._/-]+\.(md|cs|sh|json|yaml))' "$file" 2>/dev/null || echo 0)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Count every cross-reference occurrence

When a paragraph contains several references on the same line, grep -c counts that line once rather than counting each regex match. For example, 11 .md references on one line in a 148-word flavor-heavy file produce a computed density of 6/kw and COMPRESS, although the documented occurrence density is 74/kw and should make the result UNCERTAIN. Use occurrence output such as grep -Eo ... | wc -l so prose line wrapping cannot change classification.

Useful? React with 👍 / 👎.

kyle-sexton added a commit that referenced this pull request Aug 16, 2026
## Summary
- Hoist and export convention-root resolution once per `detect.sh` run
so `AUDIT_NOISE_CONTRACT_ROOT` is not lost to command-substitution
subshells (auditor F6: configured contract root bare
`reviews/`/`handoffs/` no longer falsely exempt).
- Restructure the per-line hot path to use nameref helpers
(`detect_shapes_into`, `shape_tier_into`, `trim_excerpt`) instead of 2+
`$()` forks per markdown line.
- Add `--offset` / `--limit` so repo-wide orchestration can chunk
without a per-file shell loop; document in SKILL.md clean-tree defaults.
- Bump docs-hygiene to 0.14.4.

## Test plan
- [x] `bash
plugins/docs-hygiene/skills/audit-noise/scripts/detect.test.sh` — 48/48
pass (includes F6 contract-bare regression + chunk affordance)
- [x] Perf smoke: single non-CHANGELOG scan path no longer pays per-line
`parse-concern-value.sh` forks; 40×885-line corpus ~7.8s in this
environment

Closes #2741

## Related

- Base of the docs-hygiene stack (#2794#2795#2798#2805).

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
kyle-sexton added a commit that referenced this pull request Aug 16, 2026
….7) (#2798)

## Summary
- Re-scanned all 38 audit-noise-routed paths: 32 clean under current
exemptions, 6 CHANGELOG basename-exempt, 1 Tier-2 ghost-ref remediated
(`docs/conventions/commit-convention/README.md` design cite → `##
Sources`).
- Added `plugins/docs-hygiene/context/derivability-route-followups.md`
triage board for the 136 extract-ssot routes (synced artifact-protocol
cluster already registered; checklists/scaffolds; changelog-parity;
pending candidates) — no new issues.
- Recorded false-keep sampling backlog as deferred (ephemeral ledger
unavailable).
- Bump docs-hygiene to 0.14.7.

Stacked on #2795 (path mutex — shared version line).

## Test plan
- [x] `detect.sh docs/conventions/commit-convention/README.md` → T1=0
T2=0 T3=0
- [x] Full 38-path noise re-scan → only the one remediated finding
before the Sources move

Closes #2735

## Related

- Stacked on #2795; process-derivability route-to-sibling batch ahead of
#2805.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
@kyle-sexton
kyle-sexton deleted the branch cursor/2735-route-sibling-8f91 August 16, 2026 00:38
@claude

claude Bot commented Aug 16, 2026

Copy link
Copy Markdown

Claude encountered an error —— View job


I'll analyze this and get back to you.

@github-actions

Copy link
Copy Markdown

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

Re-run the job, or workflow_dispatch this workflow with the PR number, to retry the review. A new push re-triggers this lane only if the caller's pull_request triggers include synchronize (the canonical caller omits it).
An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator (auth).

@kyle-sexton

Copy link
Copy Markdown
Contributor Author

Superseded by #2811 after stack-base deletion. No new issue.

kyle-sexton added a commit that referenced this pull request Aug 16, 2026
…14.6) (#2795)

## Summary
- Add `plugins/docs-hygiene/context/clean-tree-fallback.md` — shared
offer/confirm/no-op skeleton for bare audit invocations.
- Cite it from `audit-noise`, `audit-derivability`,
`audit-encapsulation`, `compress`, and `extract-ssot`; record deliberate
divergences (compress mutating; encapsulation "no inherited scope").
- `compress audit` on a clean tree now offers the confirmation-gated
free corpus audit (report-only) instead of the friendly no-op.
- Bump docs-hygiene to 0.14.6.

Stacked on #2794 (path mutex — shared `plugin.json` / CHANGELOG version
line).

## Test plan
- [x] Relative cite paths resolve from each skill directory
- [x] `compress/context/target-types.md` row updated for
audit+clean-tree

Closes #2734

## Related

- Stacked on #2794; shares clean-tree fallback for later stack PRs
(#2798, #2805).

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
kyle-sexton added a commit that referenced this pull request Aug 16, 2026
….0) (#2814)

Closes #2745

## Summary

Re-lands docs-hygiene 0.15.0 compress caveman/taxonomy audit
remediations on main after #2812. Replaces #2805/#2811, which were
auto-closed when stack bases were deleted.

## Related

- Completes the docs-hygiene stack after #2792#2794#2795#2812.
- Supersedes closed #2805 and #2811.

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants