feat(codebase-health): route the audit Boundary to the sibling drift lanes

[kyle-sexton]

Summary

The codebase-health audit skill covers doc, config, code, and architecture claim drift. Seven sibling lanes each own a different kind of drift, and nothing in the audit skill named them — an operator who reached this skill had no path to the others.

This adds a ## Boundary. The sibling drift lanes section to plugins/codebase-health/skills/audit/SKILL.md naming all seven with one line each on what that lane owns, every route presence-gated with a stated fallback per docs/conventions/seam-phrasing.

The pre-existing "Scope boundary with adjacent audit lanes" paragraph becomes a pointer to the new section, which absorbed its claude-config routing so that reference is stated once rather than twice. What the audit detects and how it reports are unchanged, no sibling skill is edited, and the frontmatter description is untouched.

Acceptance criteria

• The Boundary section names all seven sibling drift lanes, each with one line on what it owns. SKILL.md ## Boundary. The sibling drift lanes — the review plugin's doc-drift-detector agent (documentation freshness inside a review pass), /session-flow:reanchor (a session's own working premises), /discipline:recheck-against-upstream (divergence from current upstream documentation), /provenance:audit (prose restating an external source), /claude-config:audit plus /claude-config:audit-automation-gaps (Claude Code's own configuration), /instruction-placement:delta (instruction content on the wrong load surface), /overengineering:delta (the enforcement surface's own accumulation). Each ownership line was derived by reading that lane's own SKILL.md / agent definition in this repo, not from memory.
• Every sibling reference is presence-gated in its wording. One gate governs the whole list at the instructed invocation site: "Route to one when its plugin is installed, invoking the skill via the Skill tool (the agent lane via the Agent tool). When the plugin is absent, say that dimension is out of scope for this run and report it as uncovered, rather than running claim-extraction over it here." Gate names the plugin only (no marketplace qualification); fallback is stated, not "skip silently"; each bullet carries the ownership framing the convention's element 3 asks for.
• /skill-quality:check passes for the codebase-health audit skill, including the listing-entry cap check. CHECK-SKILL audit: PASS — 0 errors, 7 warning(s); INFO: description length 562/1536 chars; INFO: all 4 base-ref trigger phrase(s) preserved. All 7 warnings pre-date this change (soft 200-line target, no Gotchas surface, four fresh-eyes hand-verify notes in untouched sections/spokes, completion-criteria note on untouched numbered procedures).
• markdownlint passes on the changed files. Summary: 0 issues in 0 files over the three changed markdown files.
• The codebase-health plugin version is bumped per repo convention. plugin.json 0.8.9 → 0.8.10, with a matching ## [0.8.10] CHANGELOG.md entry citing #3810 (Added + Changed), mirroring the 0.8.6 reference pattern.
• The plugin README and any reference doc listing the plugin's skills reflect the change. plugins/codebase-health/README.md "Distinct from" paragraph now names the sibling lanes the Boundary routes to and states the presence gate. docs/CATALOG.md (mirrors plugin.json description) and docs/SKILL-CHEAT-SHEET.md (mirrors metadata.summary) need no edit — both fields are unchanged, and their generators confirm it: Catalog is in sync with the manifests. / Cheat sheet is in sync with skill frontmatter.

Out of scope, respected

No change to what the audit detects or how it reports; no sibling skill edited; no router added to any other skill.

Verification

$ CHECK_SKILL_SKILLS_ROOT=plugins/codebase-health/skills bash plugins/skill-quality/scripts/check-skill.sh audit
INFO: description length 562/1536 chars
INFO: all 4 base-ref trigger phrase(s) preserved
INFO: SKILL.md 305/500 lines
INFO: markdownlint clean
CHECK-SKILL audit: PASS — 0 errors, 7 warning(s)

$ bash scripts/check-changed-skills.sh main
CHECK-SKILL audit: PASS — 0 errors, 7 warning(s)
1 skill(s) checked, 0 failed.

$ npx markdownlint-cli2 plugins/codebase-health/skills/audit/SKILL.md plugins/codebase-health/README.md plugins/codebase-health/CHANGELOG.md
Summary: 0 issues in 0 files

$ node scripts/validate-plugin-contracts.mjs
Plugin contracts validated: 53 setup skills, 3 retirement manifests, and 3330 plugin files checked.   (exit 0)

$ bash scripts/check-changelog-parity.sh --check
Every versioned plugin has a CHANGELOG.md ... and none documents a version above its manifest.   (exit 0)

$ bash scripts/check-changelog-parity.sh --check-bump main
Every plugin whose version changed vs main has a '## [<version>]' CHANGELOG.md entry.   (exit 0)

$ node scripts/generate-catalog.mjs --check
Catalog is in sync with the manifests.   (exit 0)

$ node scripts/generate-cheatsheet.mjs --check
Cheat sheet is in sync with skill frontmatter.   (exit 0)

Closes #3810

🤖 Generated with Claude Code

https://claude.ai/code/session_012jiwedVq2GxuzN7siXQbr4

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-06T08:22:17.002973Z	29e5510	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 4m 10s —— View job

---

Code review complete

• Gather context (PR diff, changed files, CLAUDE.md/AGENTS.md)
• Check skip gate (draft/closed/trivial/already-reviewed) — none apply, reviewed fully
• Review changed files for correctness and maintainability
• Adversarially validate candidate findings
• Post inline comments for anchorable findings
• Post final summary

Scope: plugin.json, CHANGELOG.md, README.md, skills/audit/SKILL.md. This is docs-only: no change to what the audit detects or how it reports.

No high-signal findings. I independently verified the claims this PR makes rather than restating its own test-plan output:

• Cross-checked all seven sibling-lane routes (review's doc-drift-detector agent, /session-flow:reanchor, /discipline:recheck-against-upstream, /provenance:audit, /claude-config:audit + /claude-config:audit-automation-gaps, /instruction-placement:delta, /overengineering:delta) against each target's own frontmatter description. Every one-line ownership summary in the new Boundary section accurately reflects the real skill/agent, and the bullet order matches between SKILL.md and the README.md "Distinct from" paragraph.
• Confirmed the gate phrasing ("Route to one when its plugin is installed... invoking the skill via the Skill tool (the agent lane via the Agent tool). When the plugin is absent, say that dimension is out of scope...") conforms to docs/conventions/seam-phrasing/README.md's three-element shape (gate names the plugin only, fallback stated, ownership framing per bullet).
• Confirmed /instruction-placement:delta and /overengineering:delta are the right routing targets even for an operator with no prior baseline: both explicitly fall back to a full audit/self-contained run on a missing baseline rather than producing an empty or misleading delta, so routing to the incremental skill isn't a footgun for first-time use.
• Verified the internal anchor [Boundary](#boundary-the-sibling-drift-lanes) resolves to the new ## Boundary. The sibling drift lanes heading under GitHub's slug rules, and that claude-config routing now appears exactly once in SKILL.md (the old paragraph's duplicate was removed, matching the changelog's "stated once rather than twice" claim).
• Confirmed the frontmatter (description, etc.) is byte-for-byte unchanged and no sibling skill file was touched, matching the stated out-of-scope claims.
• CHANGELOG.md's #3810 reference is correctly placed (changelog entries are exempt from the skill-body no-issue-numbers rule; the SKILL.md body itself carries none).

I did not re-run check-skill.sh, markdownlint-cli2, or the catalog/cheatsheet generators myself (not available in this sandbox), so those results are author-claimed and unverified by me — but the substantive content I could check independently (routing accuracy, convention conformance, anchor integrity, no-duplication) all checked out.
· Branch

[claude]

Claude finished @kyle-sexton's task in 44s —— View job

---

Security review complete

• Gather context (PR diff, changed files)
• Check skip gate
• Perform security review of changed files
• Report findings

Skip gate hit: no security-relevant surface.

All four changed files are documentation/manifest content with no executable logic:

• plugins/codebase-health/.claude-plugin/plugin.json — version bump only (0.8.9 → 0.8.10)
• plugins/codebase-health/CHANGELOG.md — changelog entry
• plugins/codebase-health/README.md — prose addition naming sibling drift lanes
• plugins/codebase-health/skills/audit/SKILL.md — new ## Boundary. The sibling drift lanes section, replacing an inline scope-boundary paragraph with a pointer to it

No code paths, permissions, hooks, CI/Actions workflows, secrets handling, or trust boundaries are touched. The new text only names other skills/agents to route to (gated on "when its plugin is installed") — it does not invoke anything, add tool grants, or change allowed-tools. There is no injection, authz, or credential-handling surface in this diff.

No security findings. This lane's review is complete.

[github-actions]

Last security-reviewed head: 29e5510de40d9021016827f161a91e84328ba574. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 29e5510de4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[github-actions]

PR body contract — issue linkage

This PR body does not yet satisfy the issue-linkage contract:

• Missing a "## Fix" section. State the concrete change and how it addresses the problem.
• Missing a "## Related" section. List related PRs, ADRs, or decision-log entries this PR does not close.

Edit the body and this comment updates itself on the next run.

[kyle-sexton]

Closing as superseded by #3828 — same issue, same diff, independent duplicate lanes

Head pinned at ee167e88a23c779fe8053fcf556f2a731cefa31b. Posted by the merge lane (ccr-session-babysit-loop-20260906).

The duplication, verified against both PRs rather than assumed

Two autonomous worker-lane sessions worked #3810 independently and neither saw the other:

	#3828	#3829 (this PR)
Closes	#3810	#3810
Session in body	session_01ViPsHkL3ng9xWt2GjEQJob	session_012jiwedVq2GxuzN7siXQbr4
Branch	claude/3810-audit-boundary-routing	feat/3810-codebase-health-drift-routes
Files touched	4	the same 4
New section	## Boundary, the adjacent drift lanes in skills/audit/SKILL.md	## Boundary. The sibling drift lanes, same file
Lanes named	the same seven	the same seven
codebase-health bump	0.8.9 → 0.9.0	0.8.9 → 0.8.10

Both add one Boundary section to plugins/codebase-health/skills/audit/SKILL.md routing to the same seven sibling drift lanes, both fold the pre-existing claude-config-only paragraph into it, both edit the plugin README, and both bump the manifest off the same 0.8.9. The two bumps are mutually exclusive: whichever merged second would conflict on all four files.

Why #3828 is the survivor

The multi-instance convention both lanes follow makes the lowest-numbered PR canonical. That is a tiebreak, not a quality judgment, and it is the repo owner's call to overrule. Two secondary signals point the same way: #3828's body satisfies the pr-issue-linkage contract (Closes, ## Summary, ## Fix, ## Verification, ## Related all present and non-empty), while this PR's body drew a contract failure for a missing ## Fix section, and #3828 carries the full AI review lanes on its head SHA where this PR's current head ran only the light lanes.

What this PR did better, and where it is going

This PR is ahead of #3828 on the substance of one P1, and that work is not being discarded. Codex raised the same finding on both — that routing an upstream-divergence request to /discipline:recheck-against-upstream lets a bare, read-only audit invoke a corrector that says "Correct each forward now". This PR fixed it in ee167e88a by turning the section into an operator-facing router rather than a dispatch list, reporting the uncovered dimension and naming the lane as a suggestion, and stating that --fix authorizes remediation of this skill's own findings only. That thread is resolved here; on #3828 the identical finding is still open and is one of the three unresolved conversations holding it at blocked.

That remediation is being ported into #3828 with attribution to this PR, not presented as the merge lane's own reasoning.

Closed as a duplicate, not as rejected work.

---

Merge lane ccr-session-babysit-loop-20260906. Canonical: #3828.

---

Generated by Claude Code