feat(codebase-health): route the audit Boundary to the sibling drift lanes

plugins/codebase-health/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "codebase-health",
-  "version": "0.8.9",
+  "version": "0.8.10",
   "description": "Repo-wide drift audit between docs, config, code, and architecture: verifies every factual claim against reality via parallel subagent fan-out, severity-rates findings, and reports read-only, delegating remediation to the implementation/verification lanes. Audit dimensions are configurable through a tracked .claude/codebase-health.md config file written by the setup skill.",
   "author": {
     "name": "Melodic Software",

plugins/codebase-health/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to the `codebase-health` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.8.10]
+
+### Added
+
+- **`audit`:** a `## Boundary. The sibling drift lanes` section naming the seven adjacent drift lanes with one line each on what that lane owns: review's `doc-drift-detector` agent, `/session-flow:reanchor`, `/discipline:recheck-against-upstream`, `/provenance:audit`, `/claude-config:audit` (plus `/claude-config:audit-automation-gaps`), `/instruction-placement:delta`, and `/overengineering:delta`. The section routes the operator and is never a dispatch list for the skill itself: a dimension owned by another lane is reported as uncovered and the lane is named as a suggestion to run next, whether or not its plugin is installed. The skill does not invoke a sibling, because several of them mutate (`/discipline:recheck-against-upstream` corrects divergences forward as it finds them) and a bare `audit` is read-only under its own verb contract. `--fix` authorizes remediation of this skill's own findings and does not extend to a sibling lane (#3810).
+
+### Changed
+
+- **`audit`:** the "Scope boundary with adjacent audit lanes" paragraph in "Adapting to your environment" is now a pointer to the new Boundary section, which absorbed its `claude-config` routing so the reference is stated once. What the audit detects and how it reports are unchanged.
+- README: the "Distinct from" paragraph names the sibling drift lanes the audit's Boundary routes to.
+
 ## [0.8.9]
 
 ### Changed

plugins/codebase-health/README.md

@@ -8,6 +8,13 @@ Distinct from diff/PR review (which judges a change) and from Claude Code config
 check `settings.json` / hooks / permissions): this plugin verifies whether the repo's own written
 claims about itself are true.
 
+Other kinds of drift belong to sibling lanes, and the audit skill's **Boundary** section routes an
+operator to each one: review's documentation-freshness agent, session-premise re-anchoring,
+upstream-conformance rechecking, provenance of copied prose, Claude Code configuration and
+automation-gap audits, instruction-placement movement, and enforcement-surface movement. Every one of
+those routes is presence-gated. It applies when that plugin is installed, and the dimension is
+reported as uncovered when it is not.
+
 | Skill | What it does |
 |---|---|
 | `/codebase-health:audit` | Runs the audit. Prime conventions, fan out claim-extraction per file, independently validate, severity-rate, and report read-only; remediation is delegated to the implementation/verification lanes. |

plugins/codebase-health/skills/audit/SKILL.md

@@ -62,13 +62,49 @@ optional; using one when your setup provides it is not, per Phase 2's external-r
 such tool, follow the inline graceful-degrade guidance, which confidence-tags the
 externally-unverifiable part `needs-review` rather than guessing.
 
-Scope boundary with adjacent audit lanes: this skill verifies **factual claims** in docs/config
-against code state. Claude Code configuration files (`settings.json`, `.mcp.json`, hooks,
-permissions) and automation-landscape gap analysis are different lanes, when the
-`claude-config` plugin is installed, route those to `/claude-config:audit` and
-`/claude-config:audit-automation-gaps`, invoked via the Skill tool; otherwise state they are out of
-scope rather than
-running claim-extraction over them.
+Scope boundary with adjacent audit lanes: see [Boundary](#boundary-the-sibling-drift-lanes) below.
+
+---
+
+## Boundary. The sibling drift lanes
+
+This skill owns ONE kind of drift: the **factual claims a repo makes about itself** in docs, config,
+code, and architecture notes, verified against that repo's own ground truth. Seven adjacent lanes own
+the other kinds, and an operator who reached this skill is often standing in one of them.
+
+This section is a router for the operator, not a dispatch list for this skill. A bare `audit` is
+READ-ONLY, and some of these lanes mutate: `/discipline:recheck-against-upstream` corrects
+divergences forward as it finds them, and several others carry an explicit fix mode. Invoking one
+from inside a read-only run would let this skill edit the repository through a sibling, which its own
+verb contract forbids. So a dimension that belongs to another lane is reported as **uncovered**, and
+the lane is **named as a suggestion the operator can run next**, whether or not its plugin is
+installed. Under `--fix` the operator has authorized mutation for this skill's own findings only;
+that authorization does not extend to running a sibling lane's remediation.
+
+- **Documentation freshness inside a review pass** → the `review` plugin's `doc-drift-detector`
+  agent, a dispatchable reviewer for stale references, outdated conventions, and pages that no longer
+  earn their existence. It overlaps this skill's `documentation` dimension: that dimension is the
+  exhaustive per-file claim fan-out with an independent validation gate, the agent is the review
+  lane's single-pass sweep.
+- **A session's own working premises** → `/session-flow:reanchor`, which verifies that the PRs,
+  issues, branches, plans, and cited skills a session is building on are still in the state it
+  assumes. Premises about the work in flight, not claims written in the repo.
+- **Divergence from current upstream documentation** → `/discipline:recheck-against-upstream`, which
+  audits the surface in flight against the vendor's own current official docs and classifies each
+  divergence. This skill checks claims against the repo; that lane checks the repo against upstream.
+- **Prose restating an external source** → `/provenance:audit`, which finds passages copied from a
+  source someone else owns with no pointer or stamped record, and converts them into links,
+  citations, or stamped records. Ownership of the text, not truth of the claim.
+- **Claude Code's own configuration** → `/claude-config:audit` for settings files, `.mcp.json`,
+  hooks, plugins, permissions, and environment variables, and
+  `/claude-config:audit-automation-gaps` for automation-landscape gap analysis. Neither is this
+  skill's `configuration` dimension, which reads the consuming repo's own build, CI, and tool config.
+- **Instruction content sitting on the wrong load surface** → `/instruction-placement:delta`, which
+  re-runs the placement audit and reports only what moved: new demote/promote candidates, rule globs
+  that stopped resolving, and index drift.
+- **The enforcement surface's own accumulation** → `/overengineering:delta`, which re-runs the
+  enforcement-surface audit (hooks, CI lanes, gate scripts, branch protections) and reports only what
+  moved since the last run. Whether a guard still earns its keep, not whether a claim is true.
 
 ---