fix(docs-hygiene): compress caveman/taxonomy audit remediations (0.15.0)

[kyle-sexton]

Closes #2745

Summary

Re-lands docs-hygiene 0.15.0 compress caveman/taxonomy audit remediations on main after #2812. Replaces #2805/#2811, which were auto-closed when stack bases were deleted.

Related

• Completes the docs-hygiene stack after fix(docs-hygiene): speed audit-noise detect hot path (0.14.4) #2792 → fix(docs-hygiene): close audit-noise scanner exemption gaps (0.14.5) #2794 → docs(docs-hygiene): share clean-tree fallback across audit skills (0.14.6) #2795 → docs(docs-hygiene): process derivability route-to-sibling batch (0.14.7) #2812.
• Supersedes closed fix(docs-hygiene): compress caveman/taxonomy audit remediations (0.15.0) #2805 and fix(docs-hygiene): compress caveman/taxonomy audit remediations (0.15.0) #2811.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 1m 12s —— View job

---

Security review — no issues found

Ran /review:security-review (org CI security-review lane) against this PR (origin/main...HEAD, head 43ccce7).

• Gather context (PR diff, changed files)
• Run /review:security-review skill per custom instructions
• Post findings / summary

Skip gate: the change set has no security-relevant surface. All 13 changed files are within plugins/docs-hygiene/ (a docs-compression skill) and consist of:

• Prose/instruction edits to SKILL.md and context/*.md (compression methodology, temp-file handling docs)
• evals.json / new eval fixture (evals/fixtures/terse-agent.md)
• Plugin version bump + CHANGELOG.md
• Two shell scripts: new scripts/audit-scan.sh (read-only markdown classifier) and modified scripts/detect-caveman.sh, plus their .test.sh companions

I checked the shell scripts specifically for the usual trust-boundary issues (command injection via filenames, unsafe eval, unquoted expansion, unsafe temp-file/trap handling):

• audit-scan.sh rejects any arg starting with - before use, quotes all path variables ("$f", "$file") through grep/wc/basename, and only reads/classifies files — no writes, no network, no credential handling.
• detect-caveman.sh's change actually tightens trust: it now requires enabled == true (preferring the pinned caveman@caveman id) instead of accepting any caveman@* install, so a disabled/rogue plugin can no longer report as available. claude plugin list --json output is piped through jq (no eval), so untrusted JSON content can't be interpreted as shell.
• SKILL.md's Step B rewrite removes a stale trap ... EXIT (which doesn't persist across separate tool calls) in favor of explicit rm -rf cleanup on both success and failure paths of the tempdir copy — a correctness fix, not a new risk; the target file is still only overwritten on backend success.

No injection, auth/access-control, secret-handling, or GitHub Actions permission/trigger issues in this diff. Per the skip-gate rule, no further findings to report.

[github-actions]

Last security-reviewed head: 43ccce72c23df3d46741f6ab6bfa962c349b0b48. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 43ccce72c2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 22s —— View job

---

Code review — skip gate triggered

• Gather context
• Check skip gate conditions
• Post result

Result: skipped. This PR is MERGED (closed), and the /review:code-review skip gate stops before deep review whenever "PR is closed or not open." No inline comments were posted.

If a fresh review is needed, please open it as a new PR or re-open this one and re-trigger @claude.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.