chore(prompt-audit): close the 2026-09 prompt-audit follow-up ledger

[kyle-sexton]

No related issue: the follow-up ledger of the prompt-audit sweep is tracked by the record docs/specs/prompt-audit-skills-2026-09.md, not by an issue.

Summary

Closes the follow-up ledger of the 2026-09 prompt-audit sweep (#3770): every item F2 to F24 in docs/specs/prompt-audit-skills-2026-09.md ## Follow-ups now names its closing commit (20 lines prefixed "Closed"), F3 and F14 are recorded as not PR deliverables with owners, and F25 is inventoried. 43 plugins change across 121 commits plus 4 merge commits from origin/main. The small defects are fixed directly, the mechanism changes ship as scripts with tests, the verification debt is stamped with dates and recheck triggers, and the surfaces the sweep did not audit (plugin-level reference/ trees, hooks prompt text, the output style, .claude/rules, CLAUDE.md, AGENTS.md) were audited with the same method and applied the same way. Reports and decisions per follow-up are under the author's .work/prompt-audit-follow-ups/ and are summarized in the record's ## Follow-up PR section.

Fix

• One commit per plugin per follow-up, subjects naming the follow-up id; each carries a patch bump and a CHANGELOG bullet ending in (prompt-audit follow-up F<n>).
• Mechanism scripts with co-located tests: work-items/scripts/lane-telemetry-upsert.sh (F11), the synced compose-statusline-wiring.sh in context-guard and rate-limit-guard (F15), context-guard setup's pre-computed probes (F17), the synced plugin-quality/scripts/context-zone.sh with sync-context-zone.sh --check and --check-bump wired into CI's plugin-gate job (F19), mutation-testing/scripts/suppression-lint.sh (F21), pull-request Gate 5 parameterized on the discovered reviewer (F7), raw-URL cross-plugin citations and a link-free convention name in autonomy (F8).
• F6: every undated harness or upstream claim the record listed is stamped with a date and a recheck trigger, pointed at a dated owner record, or removed (122 rows: 80 stamped, 32 corrected, 9 removed, 1 no edit); the fleet gather-block claim has one dated record on the worktree skill.
• F10: every suite the record listed as failing on the author's Windows host now passes there after a portable fix, in five clusters; three recorded symptoms were real cross-platform defects (provenance list-corpus, knowledge's fence gate console encoding, education's teach workspace across worktrees) and several Windows-only test vacuums (a CRLF from jq that made checks pass without inspecting anything). One residual is verified on CI's Linux lane: repo-fleet-hygiene audit-fleet's 33 load-sensitive GitHub-evidence cases.
• F2: .claude/rules, the rendered AGENTS.md rules table, the one output style, and the user-facing strings of 70 hook scripts audited and applied; no hooks.json declares a prompt-type hook.
• The topic Brief graduated into the record as ## Follow-up PR and docs/topics/prompt-audit-follow-ups/ was pruned.
• One renumber pass lifts every branch-added CHANGELOG heading above origin/main's current version for the plugins main overtook; merge commits compose both sides of every content conflict (named in each merge commit message).

Verification

• The four scripts/check-changelog-parity.sh modes (--check, --check-bump origin/main, --check-preserved origin/main, --check-order): pass at the branch tip.
• check-purged-em-dashes.sh, check-skill-precompute-compose.sh --all, render-index.sh check --file AGENTS.md, validate-plugin-contracts.mjs, sync-context-zone.sh --check and --check-bump origin/main, check-shell-portability.sh origin/main, check-docs-only-gate.sh --check, check-skill-count-claims.sh --check, check-contract-slice-prune.sh --check-diff origin/main, typos, repo-wide markdownlint: pass.
• check-cross-plugin-source-drift.sh --check reports the same 20 unregistered clusters on a clean origin/main checkout on the author's Windows host, so that gate's verdict is CI's Linux lane.
• scripts/affected-tests.sh --run could not finish on the author's host under load; every suite each follow-up touched was run directly and is green there, and each dispatched change was checked by a fresh-context verifier against the diff and the run before commit (per-cluster reports name the counts). CI runs the whole corpus.
• Per plugin, before its commit: check-skill.sh on every touched skill, check-skill-precompute-compose.sh --paths, check-evals-quality.sh where evals changed, shellcheck and the portability check on every script, markdownlint, typos, and the ai-slop detector on every touched file.

Related

• Record: docs/specs/prompt-audit-skills-2026-09.md (## Follow-ups, ## Follow-up PR).
• Sweep PR: docs: apply the fleet-wide prompt-audit against Claude Fable 5.1 #3770 (merged as f62c1b3, this branch's fork point).
• ADR 0005 and ADR 0008 stay accepted; nothing here retires them.
• Pre-prune commit for the contract slice: fe3ada293f429da5416d89aa11555f4082222416 (gh api "repos/{owner}/{repo}/contents/docs/topics/prompt-audit-follow-ups/PLAN.md?ref=fe3ada293f429da5416d89aa11555f4082222416" --jq .size).
• Not filed: two playbooks work items the F2 audit surfaced ("Explore a deliberate thinking-off lane on Opus 5" and "Revisit push-down routing lanes when Opus 5 injection data lands") sit under "Not filed" in the author's .work/prompt-audit-follow-ups/reports/F2-playbooks-reference-applied.md for the playbooks maintainers to file through /playbooks:update; filing public issues was outside this PR's ask.
• F25 (babysit-readiness-gate.sh badge grammar) is inventoried in the record, not delivered here.
• Not applied here: the F2 root-surfaces finding that .claude/rules/pr-body-contract.md is the one rule with no YAML frontmatter. That file is sync-manifest-managed by melodic-software/standards (CI's managed-files-guard refuses direct edits), so the frontmatter belongs in that repository and lands through standards-sync.

Follow-ups (verbatim from the record)

Inventoried here as they arise and shipped in the PR body verbatim.

• F1. Write one superseding ADR covering every accepted ADR decision this audit contradicted (at minimum ADR 0004 D-1 and D-3, ADR 0006's applied-set gate); decide with the operator whether ADR 0005 and ADR 0008 are also retired.

• F2. Closed in 3cf0d69 (.claude/rules and the AGENTS.md row they render), b618ed3 (the one output style), c93b18c, 2ba9047, and fc0d3b7 (hooks prompt text in guardrails, disk-hygiene, and autonomy); no hooks.json declares a prompt-type hook, so the hooks surface was the user-facing strings of 70 hook scripts, 65 of them clean. Reports and decisions for both surfaces sit under .work/prompt-audit-follow-ups/ beside the six reference-tree ones. In progress: the six plugin-level reference trees are audited and applied (performance 61d3eb9 and d0ce988; autonomy 67e8244; architecture 1ca9d3c; coupling cdcee0e and review 075fc0a for the same topic-docs pointer regression; playbooks 4e2a0f4; context-guard 4906eed and 3452edf; rate-limit-guard b4264ea), with reports and decisions under .work/prompt-audit-follow-ups/; hooks prompt text, output styles, .claude/rules, CLAUDE.md, and AGENTS.md are still to audit. Audit the out-of-scope prompt surfaces the same way: hooks prompt text, output styles, .claude/rules, CLAUDE.md, AGENTS.md, and the plugin-level reference/ trees that skills load on invocation (autonomy, architecture, performance, playbooks, rate-limit-guard, context-guard); the performance auditor notes that snapshot and verify both mandate reading plugins/performance/reference/harness-integrity.md, which likely mirrors the archaeology the skill bodies shed.

• F3. Not a PR deliverable: the measurement runs through claude-config:unhobble on demand, and the operator owns when to run it. Behavior measurement beyond the wave-1 spot-check: route to claude-config:unhobble.
• F4. Done before the PR: docs/topics/prompt-audit-skills/PLAN.md graduated into Brief and the slice was pruned (contract-slice prune gate); the PR body names the pre-prune commit.
• F5. Closed in b8225f2 (the two residual surfaces). plugins/skill-quality/scripts/check-skill.sh check 3 hard-fails any trigger phrase dropped versus the base ref. That blocks prompt-audit's documented fix for trigger-case enumeration (near-synonym lists become intent categories). Change check 3 to a warning, update its tests, and record the deliberately dropped phrases per skill in this record. Must land before the PR so the skill-quality CI gate passes. Landed in a694011; two out-of-scope surfaces still describe check 3 as a hard-FAIL gate and should follow: the comment at plugins/docs-hygiene/skills/audit-noise/scripts/emit-findings.sh:220 and the eval fixture plugins/docs-hygiene/skills/audit-noise/evals/fixtures/negation-trigger-fence.md:9 (the docs-hygiene commit corrected the same script's header comment and its eval case 12).

• F6. Closed in six verifier groups, one commit per plugin: G1 446c276 (session-flow) and 47bace6 (source-control, which also owns the fleet gather-block record at skills/worktree/reference/gather-block.md, "The pre-compute block runs as one shell invocation"); G2 e564b9b (disk-hygiene), bf70d79 (performance), 4e0e4d8 (rate-limit-guard), 3ee8271 (work-items); G3 203fb36 (claude-memory), c0275b4 (claude-config, which owns the pre-v2.1.211 record), 7659e32 (claude-ops); G4 5404ba7 (context-budget), 4c792b9 (context-guard), 4532e37 (plugin-quality), 177b179 (skill-quality), 993ce43 (instruction-placement); G5 0d49296 (computer-use), f344689 (overengineering), 875b8da (improvement), 70dfe3e (code-tidying), 69a8819 (codebase-health), 1aa1dcf (architecture), caaa69c (mcp-tools), 22d20a4 (docs-hygiene), 1fd6561 (repo-hygiene); G6 da9b14a (autonomy, basis by class), 809617c and 32ebdee (discovery, six records in reference/parent-contract.md), 0bb93b9 (discipline), 577c359 (testing), 16a2604 (playbooks), 634ef1b (review), 69913c1 (planning). Across 122 claim rows: 80 stamped, 32 corrected and stamped, 9 removed as unverifiable from any reachable source, 1 needing no edit; 36 skill sites outside source-control now point at the gather-block record. Reports F6-G1.md to F6-G6.md under .work/prompt-audit-follow-ups/reports/ carry the per-claim basis and recheck trigger. Verify and stamp the undated harness-behavior claims the audit flagged as I12 items (session-flow: /recap trigger and the Skill-invocable allowlist, the usage-limit reset surface, cleanupPeriodDays default, /clear transcript and scheduled-task behavior). Each becomes a four-part upstream-drift record or a doc pointer. Collected per plugin as the waves run. source-control adds: GitHub mergeStateStatus precedence and baseRefOid staleness (freshness.md), the permission-mode and wrapper-strip claims in safety.md, and the ScheduleWakeup clamp, /loop expiry, Monitor-on-resume, and sandboxed-GraphQL claims across babysit-prs, babysit-loop, pull-request, and worktree. disk-hygiene adds four undated harness-version claims (safety-model.md:262, :313, :315 on 2.1.207 and 2.1.218 pluginConfigs scope and PowerShell hook firing; clean/SKILL.md:382 on the v2.1.211 auto-mode prompt). performance adds the undated benchstat -delta-test claim at snapshot/SKILL.md:94-96, and plugins/performance/reference/harness-integrity.md (out of audit scope, mandated reading for snapshot and verify) likely carries the run archaeology the four skill bodies shed (see F2).

• F7. Closed in b37b769 and e8f2f90 (Gate 5 keys on discovered reviewer logins; vendor shapes live in reference/reviewer-shapes.md as dated records; scripts/babysit-readiness-gate.sh still couples to one vendor's badge grammar and is its own follow-up). pull-request hardcodes one vendor's review bot (login, emoji signalling, timing) in reference/monitor.md gotchas and reference/readiness.md Gate 5, against the file's own "discover actors, don't hardcode them" rule. Parameterize Gate 5 on the discovered reviewer login and move the vendor shapes into a dated reference-shapes note with a recheck trigger.
• F8. Closed in f5d41ed (source-control), 2bd0a7c (review), 2173f85 (playbooks), and 38025be (autonomy, link-free by class). source-control cites sibling-plugin files by relative path (../../../../autonomy/..., ../../../../../prompts/...) in babysit-loop/reference/promotion-evidence-resolution.md and babysit-prs/reference/safety.md. Those resolve only in the marketplace checkout, never in an installed plugin. Convert to the raw-URL form the plugin already uses at babysit-loop/SKILL.md:40. review adds: agents/ecosystem-specialist.md:22, fanout/context/fix-pass-mode.md:7, quality-gate/context/close-out.md (four sites), and quality-gate/context/spec.md (three sites) cite marketplace docs/ paths or sibling-plugin files by relative path. review also adds two undated claims to F6: the bundled /code-review and managed Code Review service tiers in quality-gate/context/pr.md and code.md, and the "built-in /security-review is unusable in CI" claim in security-review/SKILL.md. The autonomy applier converted six of that plugin's own convention and sibling citations to marketplace URLs; those were reverted to the relative form before the PR because scripts/validate-plugin-contracts.mjs forbids the autonomy plugin naming the org or a vendor, so the autonomy sites stay under this follow-up.
• F9. Closed in e6fe01a. planning/skills/wayfind/SKILL.md pre-compute silently coerces a non-string container_label to work-map, which context/tracker-mechanics.md says is a configuration error that must never proceed. Make the pre-compute fail loud or surface the raw value, matching the doc.
• F11. Closed in 9dcae99 and d670543. work-items carries the same 60-line lane-telemetry upsert as a fenced shell block in work-loop/reference/telemetry-upsert.md and attend-queue/reference/telemetry-upsert.md, transcribed by the model on every cycle, with a classifier-fallback section asking it to re-derive gate order by hand (prompt-audit Group 4, an LLM executor for a deterministic plan). Extract it into plugins/work-items/scripts/lane-telemetry-upsert.sh with a co-located test, taking lane, instance, repo, issue, and body-file arguments and exiting non-zero on each refusal branch; both references then invoke it. Deferred from the audit because it is a mechanism change, not a prose hunk. work-items also adds six undated harness and gh claims to F6 (classifier refusals of permissions.allow widening and of the reclaim call, the compound-shell block, sandboxed GraphQL 403).
• F12. Closed in the 22 plugin commits of 2026-09-05 that name F12 (51 skills; claude-memory stateless keeps the key because it injects through a fenced block). shell: bash frontmatter selects the shell for !...`` injections. Skills whose pre-compute block became empty when the git lines moved into body calls still carry the key inert (debugging F5 found one). Sweep every SKILL.md: where no injection remains, drop the key; check-skill.sh check 19 stays green either way.
• F13. Closed in 2846cd1. playbooks:boris presents Fable 5 as the current top model and its launch-era classifier behavior as current (skills/boris/SKILL.md:58,133); upstream has not published Fable 5.1 tips. Re-sync through /playbooks:update when it does, and until then qualify the Model row "as of the 2026-07-24 sync".
• F14. Not a PR deliverable: the whole-pack regeneration is the playbooks maintainers' separate run through /playbooks:update; the fable-5-1.md chapter exists, the F8 tail closed under F8, and the F6 tail closes under F6. The fable-5 playbook's own regeneration trigger ("a model-version change", skills/update/SKILL.md:39) has fired with Fable 5.1. The audit adds the guide-backed minimum, a fable-5-1.md adaptation chapter; regenerating the whole pack from Fable 5.1 is the maintainers' larger call. playbooks also adds to F8: reference/model-adaptation/opus-5.md:207-208 cites a probe record (thinking-off-probe-2026-07-26.md) that exists nowhere in the repository. And to F6: the cache-pricing stamp at skills/fable-5/context/orchestration.md:97 carries a date but no recheck trigger.
• F15. Closed in 8e5edcb, 63c65a4, and 920b750. The statusline compose transform in unwrap-before-compose.md (synced between context-guard and rate-limit-guard) is a pure function of the effective statusLine string that the model hand-executes over roughly a hundred lines of prose, with eight eval cases checking the arithmetic (prompt-audit Group 4). Extract it into a synced scripts/compose-statusline-wiring.sh with the round-trip check inside, shrink the reference to the contract, and turn those eval cases into script tests. Deferred from the audit as a mechanism change. rate-limit-guard also adds to F6: the undated "Monitors is an experimental Claude Code component" claim in reference/reader-contract.md:206-209.
• F16. Closed by main's 39442ff (the probe re-verified against 2.1.261); its F6 and F10 tails stay under those items. claude-ops/skills/plugins/SKILL.md:268-276 records that its own probe's recheck trigger has fired (the CLI moved from 2.1.218 to 2.1.240 with the claim un-retested). Re-run the probe and refresh the stamp. claude-ops also adds nine undated harness and upstream-issue claims to F6 (bundled doctor gating, audit-native-overlap alias examples, inventory command aliases, the WebFetch truncation window, the CLAUDE_PLUGIN_DATA export claim, the lanes "verified on this machine" lines, the observability session_id and Stop-hook gotchas, upstream issue states in read-routing.md and sync.md, and the triggerless surfaces.md stamp) and two measured figures (backups/ retention, the 97 percent and 50 MB figures in observability). plugins/repo-fleet-hygiene/skills/audit/scripts/audit-fleet.test.sh fails 5 of 180 cases on this host (the worktree-root-unconfigured placement and header cases, the symlink discovery-root case, the intermediate-symlink case, and the unreadable discovery-root case); the scripts are untouched by the repo-fleet-hygiene commit and the finding-kind table assertion passes.
• F17. Closed in dae163f and 118e4a1 (three of the four probes pre-computed; the session-snapshot probe stays a body call because an unexpanded ${CLAUDE_SESSION_ID} must be visible to the consumer, per the reader contract). context-guard/skills/setup/SKILL.md runs four fixed read-only probes (jq presence, installed shim versus shipped source, session snapshot, zones.json) as model-issued Bash calls where a ## Pre-computed context block would run them before the body loads (prompt-audit Group 4). Adding one is a mechanism change: the block must pass scripts/check-skill-precompute-compose.sh and stay inside the worktree guard's rule that a composed block expands nothing but bare $HOME, so it is deferred from the audit. context-guard also adds to F6: the undated disableAllHooks / allowManagedHooksOnly claims in skills/setup/SKILL.md:93-96 and reference/reader-contract.md:503-507, the undated PowerShell routing note in statusline-edit.md:106-109, and the folklore-number paragraph at reader-contract.md:383-391, which is dated but has no recheck trigger.
• F18. Closed in 904de7e. autonomy/reference/autonomous-pipeline-reminder.md (out of audit scope; cited only by the README and a hook) rewords the vendor's autonomy block under the repo's no-copy rule and omits the Fable 5.1 clause "Do not stop because the context or session is long"; the guide calls the opening sentence load-bearing as written. Weigh the no-copy rule against that claim and add the missing clause in the plugin's own words. autonomy also adds to F6: the undated AGENTS.md-reachability claim stated three times (skills/setup/SKILL.md:267, context/prerequisite-resolution-slice.md:38-39, reference/prerequisite-resolution.md:86-88), the undated empirical telemetry claims in reference/telemetry.md, and the "shipped first-party mechanisms today" claims in reference/runner/escalation.md:140-152.
• F19. Closed in 81c6c0f and 8ebcf8d (the F6 additions in this line stay under F6; the reader-contract wording landed in e128c11; a CI step for sync-context-zone.sh --check lands in this PR's closing commits). plugin-quality/skills/audit/SKILL.md:58-92 has the model resolve the context zone by hand from inlined band tables, a staleness window, a version floor, and a combination rule that plugins/context-guard/scripts/context-zone.sh already implements (prompt-audit Group 1b and Group 4). Ship a byte-identical synced copy at plugins/plugin-quality/scripts/context-zone.sh with its test, register it in scripts/cross-plugin-source-registry.txt with a sync-context-zone.sh --check entry, and have the gate and setup/SKILL.md:28-30 call it. Deferred from the audit as a mechanism change. plugin-quality also adds to F6: two live doc-page titles quoted undated in agents/auditor.md:117-119, the context: fork and cloud-scoping claims in references/component-types/skill.md:18-24, and six dated stamps with no recheck trigger. skill-quality adds to F6: three undated harness claims outside the dated stamp in check/SKILL.md:160-172, and the setup/SKILL.md:16-20 stamp that has no recheck trigger. instruction-placement adds to F6: the undated "other agents resolve nearest-wins" claim in realign/context/apply-recipes.md:95-97. context-budget adds to F6: the v2.1.232 measurement at audit/SKILL.md:226-228, the /doctor availability and disableModelInvocation claim at audit/SKILL.md:34-36, the cited-but-undated mechanism claims in audit/reference/engine.md:25-30 with the dangling "verified version" referent at :52-53, and the wall-clock range at audit/SKILL.md:93. computer-use adds to F6: the dated surface table in diagnose/SKILL.md:62-63 and the dated basis in diagnose/reference/windows-quirks.md:5-6, both without a recheck trigger. overengineering adds to F6: the undated harness-behavior claim in the gather blocks of all three skills (audit/SKILL.md:20-23, delta/SKILL.md:19-23, realign/SKILL.md:19-22, covered by the one dated record the worktree skill will own) and the undated /loop capability claims in delta/context/recurring-wiring.md:37-38,51-53. improvement adds to F6: four undated GitHub REST and Claude Code CLI claims in find/context/ci-health.md:32-41, find/SKILL.md:235-237, and find/context/unattended.md:74-75. docs-hygiene adds to F6: the bundled /batch skill claim in extract-ssot/actions/batch.md:35,281, four undated external benchmark figures across extract-ssot/SKILL.md:27, context/anti-patterns.md:129, and context/decision-framework.md:27-59, and the undated upstream-publishing claim in audit-encapsulation/context/public-surface-contract.md:5. code-tidying adds to F6: the CodeScene agentic-refactoring figure in tidy/reference/scope-budget.md "Research lineage" has no resolvable source; the audit dropped the number and kept the qualitative claim until a publication URL and read date are recorded. repo-hygiene adds to F6: the sourced-but-undated ${CLAUDE_SKILL_DIR} substitution-scope claim in clean/reference/invocation-forms.md. disk-hygiene adds to F6: four undated harness-version claims across clean/SKILL.md and clean/reference/safety-model.md (report F15). codebase-health adds to F6: the undated harness-capability claim at audit/SKILL.md:25-28, verified true by the auditor on 2026-09-04 and needing only its dated record. architecture adds to F6: the undated pre-compute execution claim at improve/SKILL.md:25-28. mcp-tools adds to F6: three cited-but-undated Claude Code client-behavior values in audit/reference/checklist.md:38,105,106. performance adds to F6: the undated benchstat flag-set claim in snapshot/SKILL.md:94-96.
• F20. Closed in d84723f. provenance/skills/audit spells one tier two ways: not-found in SKILL.md:2,82,227 and source-not-identified in reference/rubric.md:297, and scripts/emit-findings.sh with its test asserts both. Pick one spelling, change the script and emit-findings.test.sh with it, and align the markdown in the same commit. Deferred from the audit because the fix crosses into a script and its suite.
• F21. Closed in 8f09c4f and 3e3dd3d. mutation-testing/skills/setup/SKILL.md:80-89 has the model re-derive a suppression entry's finding_id hash from its constituents and check node-kind membership by hand (prompt-audit Group 1b and Group 4, the same shape as F19). Ship plugins/mutation-testing/scripts/suppression-lint.sh with a test implementing the two published derivations and the membership check, have setup call it, and retarget setup eval 5 and audit eval 3 from "the model re-derives" to the script. Deferred from the audit as a mechanism change.
• F22. Closed in ea8569d. plugins/ai-briefing/skills/setup/evals/evals.json:33 prompts /ai-briefing:setup --with-build-deps, but the skill's contract is apply install-build-deps; the case exercises a flag the skill does not accept. Retarget the prompt to the contract form. Observed by the ai-briefing auditor outside the audit's markdown scope.
• F23. Closed in f871ca2. plugins/dometrain/skills/sync/context/update.md documents the maintainer-only --refresh-baseline command through ${CLAUDE_PLUGIN_ROOT}, which resolves to the installed plugin cache in a normal session, while the next paragraph forbids running it anywhere but a working clone; the script writes next to itself either way. Give the command as a clone-relative path, or document that the flag is only safe under --plugin-dir. A script-safety contradiction, not a prose hunk; observed by the dometrain auditor.
• F24. Closed in 52b2004. Add a criteria row to plugins/claude-config/skills/audit-instructions/reference/criteria.md for each recurring shape in Catalog gaps: dated stamps with no recheck trigger, migration-relative phrasing inside reference and context files, routing text that names a skill absent from plugins/, sibling-file meta-commentary, and maintainer rationale inside model-facing YAML comments; the rest are one-offs and stay listed.

• F10. Closed in 7ae8d36 (work-items), 8c0d3eb (planning), and 4f51193 (instruction-placement) for cluster C2, and in 9baa032 (repo-hygiene) for cluster C5, which captured the check-7 error after the merge of main at eba62c5 (seven fixture-side cases in three clean suites) and cleared it; the autonomy lane-stop-gate FIFO case passes on this host unchanged. One residual stays, not fixable on this host: repo-fleet-hygiene audit-fleet's 33 load-sensitive GitHub-evidence cases, verified on CI's Linux lane. Reports F10-C2.md and F10-C5.md under .work/prompt-audit-follow-ups/reports/. The status below is as recorded on 2026-09-07 before C2 landed. In progress: clusters C1, C3, and C4 landed (C1 1c75e31 and f385946 provenance, 037552c cloud-bootstrap; C3 eab3540 claude-ops, eec9018 claude-config; C4 6d34a94 knowledge, 09c8d00 education, 944e0cb disk-hygiene, e07b89d repo-fleet-hygiene). Three of the recorded symptoms were real cross-platform defects, not host quirks: provenance list-corpus subtracted the corpus root as a string, knowledge's fence gate wrote to a cp1252 console, and education's teach workspace split across a repo's worktrees. Four recorded symptoms did not reproduce (docs-hygiene emit-findings, claude-config emit-findings and permission-rule-check 6b, claude-ops fleet-state, the last resolved upstream by main's rewrite). Still open: cluster C2 (work-items generate-adapter case 116, planning interview-defenses digests, instruction-placement verify-load), the autonomy lane-stop-gate FIFO case held back from C4 while a verifier held that plugin, the interview-defenses frontmatter digest that F12's shell: bash removal moved and that needs re-pinning, repo-fleet-hygiene audit-fleet at 33 load-sensitive GitHub-evidence failures the C4 report characterizes, and one uncaptured error in repo-hygiene clean check 7 with main ahead of the branch in those scripts. Not an audit finding, recorded so it is not mistaken for one: .claude/hooks/cloud-bootstrap-plugins.test.sh fails 15 of 32 assertions on this Windows host ("not installed at user scope") with .claude/cloud-bootstrap.sh and the suite byte-identical to origin/main. The failure is environmental or pre-existing; confirm on CI and file separately if it reproduces there. Same status for plugins/docs-hygiene/skills/audit-noise/scripts/emit-findings.test.sh ("tier is looked up as IMPORTANT", "Location is repo-relative") and plugins/provenance/skills/audit/scripts/list-corpus.test.sh and emit-findings.test.sh ("a directory target lists its markdown"), which fail on this host with their scripts and suites byte-identical to origin/main. Same again for plugins/work-items/skills/onboard-adapter/scripts/generate-adapter.test.sh case 116, and for the nine eval-case digest assertions in plugins/planning/tests/interview-defenses.test.sh (interview/evals/evals.json unchanged since the digests were pinned; local jq 1.8.2), and for four Windows temp-path cases in plugins/instruction-placement/scripts/verify-load.test.sh (selected by a basename collision on typescript.md; the probe and suite are unchanged on this branch), and for plugins/claude-ops/skills/audit-install-state/scripts/install_state.test.sh (a Windows filename-syntax error on a fixture path) and plugins/claude-ops/skills/audit-skill-visibility/scripts/audit_skill_visibility.test.sh (no installed_plugins.json in the temp config), both with scripts and suites byte-identical to HEAD, and for plugins/claude-ops/skills/plugins/scripts/fleet-state.test.sh, which fails a varying subset of its 74 cases on this host (six inside a check-skill run, two when run alone) with the scripts byte-identical to origin/main. Same again for plugins/claude-config/skills/audit-instructions/scripts/restatement-scan.test.sh (two I29 fixture cases, script and fixtures byte-identical to origin/main) and the one emit-findings.test.sh case downstream of it ("Action names a body cut"), which reads the same scanner's output. Same again for plugins/claude-config/skills/audit-permission-grants/scripts/permission-rule-check.test.sh case 6b ("vendored copies excluded, exactly one finding"), whose script and suite no branch commit touched (main has since tidied the suite in ac7eeea). The fleet gather block itself ("the harness runs a skill's whole pre-compute block as one shell invocation") is an undated harness claim in about 55 skills; one dated four-part record on the worktree skill, which owns the mechanism, with the copies pointing at it, clears every site at once. discovery adds six undated claim families across thirteen files (silent preload failure, AskUserQuestion and plan-mode tools filtered from non-fork subagents, the Workflow tool absent from subagents, background as the default execution mode, spawns permission-classified before launch); the fix is one dated record per claim in the plugin's reference/parent-contract.md with the skills pointing at it. claude-config adds the undated pre-v2.1.211 boundary at six body sites (the dated owner is audit-permission-state/reference/criteria.md), dated-but-triggerless stamps across eight files, the conflict-scan.sh precision figures in conflict-criteria.md, and the "Fable 5 subpage" pointers in audit-prompting-postures/reference/postures.md that need a Fable 5.1 sibling once it exists. discipline adds five files of undated fork-mode harness claims (sweep-all/SKILL.md, its two references, scrutinize-dont-coast/SKILL.md, use-your-skills/SKILL.md). claude-memory adds the undated upstream-issue state at audit/reference/official-guidance.md:168. testing adds the xUnit v3 and .NET 10 framework-trap claims (diagnose/SKILL.md:68, diagnose/context/investigate.md:16, write/SKILL.md:74) and the playwright-cli version floor in run-e2e/context/e2e.md:12. planning also adds two undated harness claims to F6: the agent-teams "experimental, default-off" status in plan/SKILL.md and the "cannot read effort or advisor state" claim in interview/context/session-config.md. plugins/ai-slop/skills/audit/scripts/detect.test.sh fails its four "git absent" cases (4 of 202) on this Windows host because the test symlinks the shell builtin printf into a fake PATH directory (ln: failed to create symbolic link); the scripts are unchanged by the ai-slop commit. plugins/disk-hygiene/skills/clean/scripts/guard_launch_monitor.test.sh fails its two telemetry-sink cases and hygiene.test.sh fails test_stash_must_exist_in_an_independent_checkout and test_preview_allows_root_children_os_managed_snapshot on this host with the scripts byte-identical to HEAD; neither case reads markdown, and the frontmatter-belt assertions in test_hygiene.py that do read clean/SKILL.md pass after the disk-hygiene commit. plugins/code-tidying/skills/audit-comment-residue/scripts/detect.test.sh fails 4 of 53 cases on this host (embedded quote and backslash unescaping in the preview script, arrow-in-filename, tab-bearing path) with detect.sh and the suite byte-identical to HEAD; the code-tidying commit touches only prose the script does not read. plugins/knowledge/skills/docpage-digest/scripts/check-fences-exact.test.sh fails six cases on this host with a UnicodeEncodeError writing U+2265 to the cp1252 console, script and suite byte-identical to HEAD; the knowledge commit touches no fence, quote payload, or script. plugins/education/skills/teach/scripts/list-workspaces.test.sh fails "worktree lists the MAIN repo's workspace" on this worktree checkout with the script unchanged.

• F25. plugins/source-control/scripts/babysit-readiness-gate.sh matches P[0-3] severity badges, one vendor's finding-format grammar, the same coupling F7 removed from pull-request one skill over (it serves babysit-prs). Parameterize the badge grammar on the discovered reviewer shape that pull-request/reference/reviewer-shapes.md records, with the script's test updated in the same commit. A script change outside the F7 commit's blast radius (from the F7 applied report).

PLAN.md (graduated into the record and pruned; last held at fe3ada2)

prompt-audit-follow-ups

Brief

TLDR

Close every open follow-up the 2026-09 prompt-audit record inventories (F2 to F24, less the two already done) in one follow-up PR on top of the merged sweep: the small defects directly, the mechanism changes as scripts with tests, the verification debt as dated records, and the unaudited surfaces with the same audit method.

Goal

docs/specs/prompt-audit-skills-2026-09.md ## Follow-ups reads as a closed ledger: each of F2 to F24 either names the commit that closed it or states, in one sentence, why it stays open and who owns it. Every skill that loads a reference/ tree, hook prompt, output style, or rule has had those surfaces audited against Claude Fable 5.1. Every deterministic procedure the audit found the model transcribing by hand runs as a script with a test. Every undated harness or upstream claim the audit withheld is stamped with a date and a recheck trigger, pointed at a dated owner, or removed.

Constraints

• Branch chore/prompt-audit-follow-ups from main at f62c1b3, one worktree, one PR. One commit per follow-up (or per plugin inside a follow-up that spans plugins), each naming the follow-up id in its subject.
• Every touched plugin gets a patch bump and a CHANGELOG line in the same commit; versions land strictly above origin/main's current version at commit time and are renumbered once before the PR if main overtakes them.
• Per-plugin gates before each commit: check-skill.sh on every touched skill, check-skill-precompute-compose.sh --paths, check-evals-quality.sh where evals change, markdownlint, typos, the ai-slop detector; scripts get shellcheck and a co-located test that runs green on CI's Linux lane.
• The autonomy plugin never names the org, a fleet repository, or a vendor (scripts/validate-plugin-contracts.mjs); its citations get a link-free convention name, never a marketplace URL.
• Subagents run as Opus 5 with general-purpose; at most three concurrent; every dispatch held while ~/.claude/rate-limit-guard/rate-limits.json shows five_hour.used_percentage above 85.
• No worktree.baseRef in any settings file (.claude/rules/worktree-base-ref.md).
• ADR 0005 and ADR 0008 stay accepted (operator decision 2026-09-05).

Acceptance criteria

Direct fixes, lead:

• F5 residual: emit-findings.sh comment and the negation-trigger-fence.md fixture no longer describe check 3 as a hard-FAIL gate.
• F9: wayfind's pre-compute fails loud (or surfaces the raw value) on a non-string container_label, matching context/tracker-mechanics.md.
• F12: no SKILL.md carries a shell: frontmatter key with no !` injection left in the file; check-skill.sh check 19 stays green.
• F13: the boris playbook's Model row is qualified "as of the 2026-07-24 sync".
• F16: recorded as closed by main's 39442ff (probe re-verified against 2.1.261); its F6 items move under F6, its test failures under F10.
• F18: autonomous-pipeline-reminder.md carries the "do not stop because the context or session is long" clause in the plugin's own words.
• F20: one spelling of the neutral provenance tier across SKILL.md, reference/rubric.md, emit-findings.sh, and its test.
• F22: the ai-briefing setup eval prompts the contract form apply install-build-deps.
• F23: dometrain's --refresh-baseline is documented as a clone-relative command or as safe only under --plugin-dir.
• F24: criteria.md gains one row per recurring catalog-gap shape (dated stamp without recheck trigger; migration-relative phrasing in reference and context files; routing text naming a skill absent from plugins/; sibling-file meta-commentary; maintainer rationale in model-facing YAML comments).

Mechanism changes, one dispatched implementer each, script plus test plus the doc wiring:

• F11: plugins/work-items/scripts/lane-telemetry-upsert.sh with a test; both telemetry-upsert references invoke it.
• F15: synced scripts/compose-statusline-wiring.sh in context-guard and rate-limit-guard with the round-trip check inside; unwrap-before-compose.md shrinks to the contract; the arithmetic eval cases become script tests.
• F17: context-guard setup's four read-only probes run from a ## Pre-computed context block that passes check-skill-precompute-compose.sh and the worktree guard's $HOME-only expansion rule.
• F19: byte-identical synced plugins/plugin-quality/scripts/context-zone.sh with test, registry entry, and sync-context-zone.sh --check; the audit gate and setup/SKILL.md call it.
• F21: plugins/mutation-testing/scripts/suppression-lint.sh with a test; setup calls it; setup eval 5 and audit eval 3 retarget to the script.
• F7: pull-request Gate 5 parameterized on the discovered reviewer login; vendor shapes moved into a dated reference-shapes note with a recheck trigger.
• F8: every cross-plugin or marketplace-docs/ relative citation in source-control, review, and playbooks converted to the raw-URL form; the nonexistent probe record citation in opus-5.md removed or pointed at a real file; autonomy's six sites given a link-free convention name.

Audit and verification, dispatched per surface or per plugin:

• F2: the plugin-level reference/ trees of autonomy, architecture, performance, playbooks, rate-limit-guard, and context-guard, plus hooks prompt text, output styles, .claude/rules, CLAUDE.md, and AGENTS.md, audited with the same brief and applied the same way; reports under .work/prompt-audit-follow-ups/reports/.
• F6: every claim the record lists under F6 (including the per-plugin additions folded into F10, F11, F14 to F19) carries a date and a recheck trigger, points at a dated owner record, or is removed; the fleet gather-block claim gets one dated record on the worktree skill.
• F10: each suite the record lists fails on this Windows host either passes here after a portable fix or is declared Linux-only in the runner's own mechanism, with the reason; scripts/affected-tests.sh --run over this branch's diff reports no unexplained failure.

Closing:

• F3 is recorded as not a PR deliverable: behavior measurement runs through /claude-config:unhobble on demand.
• F14: the whole-pack regeneration from Fable 5.1 is recorded as the maintainers' separate run; its citation and stamp sub-items close under F8 and F6.
• The record's ## Follow-ups names the closing commit per item; this Brief graduates into the record as a ## Follow-up PR section and the slice is pruned; the PR body carries the closed ledger and the pre-prune commit.
• Static gates green: the four check-changelog-parity.sh modes, check-purged-em-dashes.sh, repo-wide markdownlint and typos, check-skill-precompute-compose.sh --all, render-index.sh check --file AGENTS.md, validate-plugin-contracts.mjs, check-contract-slice-prune.sh --check-diff origin/main, and CI on the PR.

Captured assumptions

• Claude Code 2.1.261 is the harness version claims are verified against; the bundled claude-api prompt-audit guide is unchanged since the sweep.
• Verification of a harness claim means reading the current official page (or the CLI's own output) on the day of the stamp; a claim that cannot be verified from a source is removed, not re-asserted.

Out-of-scope

• Regenerating the playbooks pack from Fable 5.1 (F14's larger call) and running behavior measurement (F3).
• Retiring ADR 0005 or ADR 0008.

Deferred questions

• None; the ADR question was decided 2026-09-05 (both stay accepted).

Plan

Phase A (lead, direct): F22, F23, F9, F20, F13, F18, F5 residual, F24, F12, F16 bookkeeping.
Phase B (dispatched implementers, three at a time): F11, F15, F21, then F19, F17, F7, F8.
Phase C (dispatched auditors and verifiers): F2 surfaces, F6 per plugin group, F10 per suite cluster.
Phase D (lead): record ledger, version renumber against current main, Brief graduation and prune, gates, PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01S1Vu8qA5MKiSnXrWMEdbFW

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T21:02:03.301191Z	68c7ffc	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Review in progress

• Gather context (PR body, changed files, repo conventions)
• Invoke /review:code-review and follow its instructions
• Post findings as inline PR comments (and cross-file findings in this summary)
• Final summary

View job run

[claude]

Claude finished @kyle-sexton's task in 4m 11s —— View job

---

Security review complete

• Gather context (PR diff, changed files)
• Run skip-gate checks
• Review diff for security-relevant surface
• Adversarial validation of candidate findings
• Post final findings

This PR is the 2026-09 prompt-audit follow-up ledger closure: 346 files changed across 43 plugins, overwhelmingly prose/reference/SKILL.md edits (dating claims, removing hardcoded vendor names, rewording hook messages) plus a handful of new mechanism scripts extracted from model-executed prose per the audit's Group 1b/4 findings.

I reviewed the actual diff (git diff origin/main...HEAD), focusing on the security-relevant surface: new/modified shell and Python scripts, the CI workflow change, and the hook scripts that run automatically.

No security issues found.

Specifically checked:

• New scripts with untrusted-ish input paths: plugins/work-items/scripts/lane-telemetry-upsert.sh — --repo/--instance are regex-validated before being interpolated into gh api URL paths or jq programs (rejects .. traversal and shell metacharacters), uses -F body=@file (not -f) to avoid literal-path injection, and fails closed on lookup errors. No injection surface.
• plugins/context-guard/scripts/compose-statusline-wiring.sh (also synced to rate-limit-guard) — explicitly designed to never hand an operator-controlled string to a shell (no eval), does its own quote-aware tokenizing instead. Sound.
• plugins/mutation-testing/scripts/suppression-lint.sh — pure awk/hashing over a markdown record, no shell execution of parsed content.
• plugins/plugin-quality/scripts/context-zone.sh — confirmed byte-identical to its canonical plugins/context-guard/scripts/context-zone.sh, matching the PR's sync claim.
• Cross-platform path fixes in list-corpus.sh, list-workspaces.sh (git rev-parse --show-prefix, cd && pwd -P) — correctness fixes, no new trust boundary.
• .claude/cloud-bootstrap.sh diff — cosmetic CRLF-stripping fix (tr -d '\r') around jq output comparison, no behavior change to trust logic.
• .github/workflows/ci.yml diff — two new steps calling scripts/sync-context-zone.sh --check[-bump], no new triggers, permissions, or untrusted-input interpolation into run: blocks.
• Hook scripts (lane-stop-gate.sh, cli-flag-verify.sh, workflow-resilience-check.sh) — wording-only changes to advisory messages (removing incident/issue-number references per .claude/rules/skill-bodies-state-current-rules.md), no logic change.
• source-control/skills/pull-request/reference/readiness.md Gate 5 rework (F7) — generalizes a hardcoded-vendor comment-wait into a discovered-reviewer lookup, and tightens the commit-scoping (original_commit_id instead of commit_id) to stop counting stale prior-round comments as current. This is a correctness improvement to the gate's anti-spoofing logic, not a regression.
• Repo-wide grep across all additions for eval, os.system, subprocess(shell=True), curl|sh, hardcoded secrets/tokens — no hits outside test fixture prose.

Per this lane's scope, GitHub Actions hardening (pull_request_target, permission-widening, unpinned actions) is zizmor's advisory lane, not re-reviewed here, and the ci.yml change in this PR adds no new triggers or permissions regardless.

[github-actions]

Last security-reviewed head: 68c7ffcee8041cc460605774e36bd7502d3bd9fc. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cf06fb335c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Claude has reviewed this PR 2 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[claude]

Claude finished @kyle-sexton's task in 3m 41s —— View job

---

CI code review complete

• Gather context (PR body, changed files, repo conventions)
• Invoke /review:code-review and follow its instructions
• Post findings as inline PR comments (and cross-file findings in this summary)
• Final summary

No high-signal findings. Skip-gate checks passed (PR is open, not a draft, and has real review surface), so I did a full pass per the review:code-review criteria: correctness and maintainability only, security left to the security lane (which already posted a clean pass on this branch).

Given the size (347 files vs. origin/main, 43 plugins), I concentrated on the actual code surface rather than the prose/reference edits: the five new mechanism scripts the follow-up ledger extracted from model-executed prose, the cross-platform test fixes, and the CI workflow addition.

Verified, not just read:

• plugins/mutation-testing/scripts/suppression-lint.sh — Codex's P2 finding (non-ISO date values passing as ok) is fixed at this head: suppression-lint.sh:417-424 now regex-validates YYYY-MM-DD and routes a bad value into cur_defects, which grade_entry folds into the malformed verdict (confirmed by tracing failures/verdict construction at suppression-lint.sh:300-306 — a malformed date can't slip through as ok).
• plugins/context-guard/scripts/compose-statusline-wiring.sh — Codex's P2 finding ((/) not recognized as control operators, producing a shell syntax error) is fixed: compose-statusline-wiring.sh:163 now includes both in the operator case. Confirmed the synced plugins/rate-limit-guard/scripts/compose-statusline-wiring.sh copy is still byte-identical (diff clean).
• plugins/plugin-quality/scripts/context-zone.sh vs. its canonical plugins/context-guard/scripts/context-zone.sh — confirmed byte-identical, matching the sync claim.
• Read plugins/work-items/scripts/lane-telemetry-upsert.sh in full: the pre-write gate, singleton lookup (paginated, startswith not contains), create/update via -F body=@ (not -f, avoiding literal-path injection), post-write read-back, and creation-race reconcile (lowest id canonical, tombstone only after the canonical write verifies) all match the header contract with no gap found.
• Spot-checked the portability fixes claimed under F10: plugins/provenance/skills/audit/scripts/list-corpus.sh (rev-parse --show-prefix replacing string subtraction against $ROOT — verified $ROOT and the per-call $top are both derived the same way, so the comparison is sound), plugins/education/skills/teach/scripts/list-workspaces.sh (cd && pwd -P plus a drive-letter-aware absolute-path test for --git-common-dir), and plugins/instruction-placement/scripts/verify-load.sh (per-process record files to avoid non-atomic concurrent appends, CRLF stripping, backslash/forward-slash path normalization).
• .github/workflows/ci.yml — the two new sync-context-zone.sh --check/--check-bump steps follow the exact pattern of the adjacent sync-unwrap-before-compose.sh and sync-resolve-convention-home.sh gates; no new triggers or permissions.
• .claude/cloud-bootstrap.sh — the two added | tr -d '\r' fixes are consistent with the pre-existing ones on the wanted/have lines a few lines above; the new comment accurately describes both.
• AGENTS.md's new plugins/playbooks/reference/model-adaptation/AGENTS.md catalog row points at a file that actually exists in the diff.

Nothing here rises to a blockable finding — the two real defects a prior automated pass (Codex) found were both already fixed and independently re-verified by the author with reproduction steps, and I re-confirmed both fixes are present and correct at head 68c7ffc. I did not find anything new in the same scripts, the other mechanism extractions, or the portability fixes.

Per this lane's scope, security-relevant surface (injection, trust boundaries) was already covered by the security-review lane's clean pass on this branch and is not re-litigated here.

Branch: chore/prompt-audit-follow-ups

[claude]

Claude finished @kyle-sexton's task in 1m 20s —— View job

---

Security review complete

• Gather context (PR body, changed files, repo conventions)
• Invoke /review:security-review and follow its instructions
• Review diff for security-relevant surface
• Post findings

Last security-reviewed head was cf06fb335c14d31ba22c301e8c12d4834c9a5ce3; the relevance gate scopes this run to the six commits since then, up to the requested head 68c7ffcee8041cc460605774e36bd7502d3bd9fc:

68c7ffc fix(performance): give ab.test.sh a measurable no-op
8cd680a fix(mutation-testing): make the suppression date check a calendar date and show the whole usage block
f492fe0 fix(context-guard): wrap POSIX grouping operators in sh -c
0f37e9e fix(mutation-testing): reject non-ISO suppression dates
8365ba5 fix(prompt-audit): catalog drift, MD012, and Windows path placeholder
b2cacd9 fix(prompt-audit): restore managed pr-body-contract.md

No security issues found.

This delta is exactly the fix-up for the two chatgpt-codex-connector findings from the prior review round, plus three unrelated non-security touch-ups. Checked each:

• plugins/mutation-testing/scripts/suppression-lint.sh#L417-L425 — the date key now requires the ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])$ shape; anything else (e.g. yesterday, 2026-13-45) is appended to cur_defects and reported malformed, not ok. Fixed regex, no catastrophic-backtracking risk, no shell interpolation of the parsed value — pure string comparison. The co-located test (suppression-lint.test.sh) pins both the non-ISO and the out-of-range case against the exact repro from the original finding.
• plugins/context-guard/scripts/compose-statusline-wiring.sh#L163 (and the byte-identical plugins/rate-limit-guard copy) — ( and ) join the top-level control-operator set, so a grouped renderer now gets the sh -c adapter instead of being split into ARGV words that the outer shell would reject. This only changes classification of a string that is later single-quoted for sh -c; the script still never evals or otherwise executes the parsed renderer itself, so this stays a formatting fix, not a new injection surface. New case 9 plus an idempotency case cover it in both plugins' test suites (confirmed byte-identical between the two copies).
• plugins/performance/scripts/ab.test.sh — swaps printf ok for sleep 0.01 as a measurable no-op; test-only, no production code path.
• plugins/provenance/skills/audit/scripts/list-corpus.sh — comment-only Windows path placeholder fix (.../repo → <user>/.../repo), no code change.
• .claude/rules/pr-body-contract.md — removes a YAML frontmatter block that had been added to a sync-manifest-managed file (per this PR's own "Not applied here" note); doc-only, not executed.

No injection, auth, secret-handling, or trust-boundary surface in this delta. Per this lane's scope, GitHub Actions hardening is zizmor's advisory lane and this delta touches no workflow file.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 68c7ffcee8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".