feat(codebase-health): route the audit's Boundary to the seven sibling drift lanes

plugins/codebase-health/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "codebase-health",
-  "version": "0.8.9",
+  "version": "0.9.0",
   "description": "Repo-wide drift audit between docs, config, code, and architecture: verifies every factual claim against reality via parallel subagent fan-out, severity-rates findings, and reports read-only, delegating remediation to the implementation/verification lanes. Audit dimensions are configurable through a tracked .claude/codebase-health.md config file written by the setup skill.",
   "author": {
     "name": "Melodic Software",

plugins/codebase-health/CHANGELOG.md

@@ -3,6 +3,35 @@
 All notable changes to the `codebase-health` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.9.0]
+
+### Added
+
+- **`audit`:** a `Boundary, the adjacent drift lanes` section routes the seven sibling drift lanes,
+  one table row each: the `review` plugin's `doc-drift-detector` agent, `/session-flow:reanchor`,
+  `/discipline:recheck-against-upstream`, `/provenance:audit`, `/claude-config:audit`,
+  `/instruction-placement:delta`, and `/overengineering:delta`. The table is a **router for the
+  operator, not a dispatch list for the skill**: a request owned by another lane is reported as
+  uncovered and that lane is named as the next thing to run, never invoked from inside a bare
+  read-only `audit`. That keeps the verb contract intact, since several of these lanes mutate,
+  `/discipline:recheck-against-upstream` most directly ("Correct each forward now"), and `--fix`
+  authorizes remediation of this skill's own findings only. Lanes are named whether or not their
+  plugin is installed, and an absent one is never asserted as available. Each row states its own
+  invocation form, because one route is an agent (Agent tool) and the rest are skills. The two rows
+  that overlap this skill say where the line falls: the `doc-drift-detector` route is scoped to
+  whether a page deserves to exist, its derivability admission gate, while whether a page's claims
+  are true stays here repo-wide, so `--docs-only` runs this skill's exhaustive claim pass and never
+  routes out; that row also names `/review:fanout run-everything` explicitly, since fanout's default
+  lifecycle-tiered mode never dispatches the agent. The `claude-config` row adds
+  `/claude-config:audit-instructions` for the instruction surfaces Phase 0 reads only as the
+  convention lens. The prior claude-config-only scope notes in the skill body and the README are
+  folded into the table rather than stated three times, and the README points at the section instead
+  of repeating it. Frontmatter description unchanged (#3810).
+
+  The read-only routing contract, and the observation that automatic dispatch was scope the
+  implementation added rather than anything #3810 asked for, come from the parallel independent work
+  on this issue in #3829 (closed as a duplicate), ported here with attribution.
+
 ## [0.8.9]
 
 ### Changed

plugins/codebase-health/README.md

@@ -4,9 +4,15 @@ A Claude Code plugin for repo-wide drift auditing: it verifies that a codebase's
 ground truth via a parallel per-file subagent fan-out, findings are severity-rated, and the audit
 reports them read-only. Remediation is delegated to the implementation/verification lanes.
 
-Distinct from diff/PR review (which judges a change) and from Claude Code configuration audits (which
-check `settings.json` / hooks / permissions): this plugin verifies whether the repo's own written
-claims about itself are true.
+Distinct from diff/PR review (which judges a change): this plugin verifies whether the repo's own
+written claims about itself are true.
+
+Other kinds of drift belong to other lanes. The audit skill's
+[Boundary](skills/audit/SKILL.md#boundary-the-adjacent-drift-lanes) section routes seven of them
+(doc drift in a change under review or in a repo-wide sweep, stale session assumptions, currency
+against upstream docs, prose copied from an external source, Claude Code's own configuration and
+instruction surfaces, and the placement and enforcement delta lanes) to the sibling that owns each,
+presence-gated on that plugin being installed.
 
 | Skill | What it does |
 |---|---|

plugins/codebase-health/skills/audit/SKILL.md

@@ -62,13 +62,37 @@ optional; using one when your setup provides it is not, per Phase 2's external-r
 such tool, follow the inline graceful-degrade guidance, which confidence-tags the
 externally-unverifiable part `needs-review` rather than guessing.
 
-Scope boundary with adjacent audit lanes: this skill verifies **factual claims** in docs/config
-against code state. Claude Code configuration files (`settings.json`, `.mcp.json`, hooks,
-permissions) and automation-landscape gap analysis are different lanes, when the
-`claude-config` plugin is installed, route those to `/claude-config:audit` and
-`/claude-config:audit-automation-gaps`, invoked via the Skill tool; otherwise state they are out of
-scope rather than
-running claim-extraction over them.
+---
+
+## Boundary, the adjacent drift lanes
+
+This skill verifies **factual claims** in a repo's docs, config, code, and architecture notes
+against the repo's actual state. Seven adjacent lanes each own a different kind of drift, and this
+skill owns none of them.
+
+**This table is a router for the operator, not a dispatch list for this skill.** Bare `audit` is
+READ-ONLY, and some of these lanes mutate: `/discipline:recheck-against-upstream` says to "Correct
+each forward now: fix gaps toward upstream", and others carry a fix mode. Invoking one from inside a
+read-only run would let this skill edit the repo through a sibling, which its own verb contract
+forbids. So a request that belongs to another lane is **reported as uncovered**, and that lane is
+**named as the next thing the operator can run** rather than invoked here. Name the lane whether or
+not its plugin is installed, and never assert that an absent one is available. `--fix` authorizes
+remediation of this skill's own findings only; it does not extend to running a sibling's.
+
+Each row states its own invocation form, since one row is an agent and the rest are skills.
+
+| The drift is about | Owner |
+|---|---|
+| Whether a page **deserves to exist**: derivable from the code it describes, aspirational, or redundant. Also doc freshness scoped to a change under review | the `review` plugin's `doc-drift-detector` **agent**, so invoke it with the Agent tool as `@review:doc-drift-detector`, or run `/review:fanout run-everything`. Name that mode: fanout's default lifecycle-tiered mode never dispatches this agent, only `run-everything` does (`plugins/review/skills/fanout/context/run-everything-mode.md`), so an unqualified `/review:fanout` can finish without ever reaching the owner. **The dispatch rule is the question asked, not the scope swept:** whether a page should exist is the agent's, it runs a derivability admission gate this skill has no equivalent of; whether a page's claims are TRUE is always this skill's, repo-wide included. `--docs-only` is this skill's own exhaustive claim pass and never routes out |
+| A session's own working assumptions: base-branch movement, a stale handoff, a referenced PR, issue, or branch whose state has since changed | `/session-flow:reanchor` |
+| Whether the surface in flight still matches the CURRENT official upstream docs | `/discipline:recheck-against-upstream` |
+| Prose restating an external source with no pointer, and verification stamps past their expiry window | `/provenance:audit` |
+| Claude Code's own configuration and instruction surfaces: `settings.json`, `.mcp.json`, hooks, permissions, environment variables, and the text of `CLAUDE.md`, `AGENTS.md`, and `.claude/rules/` judged against current model capability or against how Claude Code actually behaves | `/claude-config:audit`, with `/claude-config:audit-automation-gaps` for automation-landscape gaps and `/claude-config:audit-instructions` for instruction-surface drift. Phase 0 reads those instruction files here too, but only as the convention lens: a claim they make about this repo is this skill's to verify, a claim they make about the harness or a prescription aimed at the model is not |
+| What moved in the instruction-placement findings since the last placement audit | `/instruction-placement:delta` |
+| What moved in the enforcement surface since the last enforcement audit | `/overengineering:delta` |
+
+The last two are delta lanes over their own prior runs, not over this audit's findings. This skill
+keeps no baseline and reports no deltas: each run is a full pass.
 
 ---