fix(claude-config): fix audit findings in audit-instructions, unhobble and permission lint

[kyle-sexton]

Refs: #3563
Refs: #3568
Refs: #4027
Refs: #4094
Refs: #4113
Refs: #4114
Refs: #4115
Refs: #4116
Refs: #4583
Refs: #4600
Refs: #4656

Summary

Fixes the plugins/claude-config findings from the audit of the unattended Cursor PR run. Every change is inside plugins/claude-config/; hooks/exec-bash.mjs is untouched.

• audit-instructions: the findings relay now follows criteria.md (I31 and I33 surfaces, I32 tier by arm), finding-ids.sh refuses non-instruction files under $HOME, SKILL.md records the subagent-window claim and the I33 dispatch rule, and execution-and-report.md (a second home for facts other files own) is deleted.
• unhobble: delivers the claude-config/unhobble: durable state, gate-aware strip plan, sourced carve-out, decide composition #4094 must-fix items (product-surface class, session branch, convention oracle test, readd refusal) and nice-to-have items (status fields, ledger grouping, decide), and removes silence as a deletion warrant (claude-config: design per-rule deletion-evidence attribution for unhobble's ledger grammar #3563).
• audit-permission-state: independent review of the chore: apply changelog rows for CLI surfaces and managed connectors (#4027) #5154 defaultMode lint, which reached main under a "Do not merge" body with no review.
• audit: the live-hook ask row carries the unattended-lane note (claude-config audit: baseline push ask rule contradicts a repo's declared autonomous merge lane #4600). conflict-criteria.md loses its dead repo-root link (docs: decide ownership for shared-surface instruction governance #3568).
• README.md and CHANGELOG.md are corrected; version 0.52.0.

Fix

• I15 link (docs: decide ownership for shared-surface instruction governance #3568): conflict-criteria.md used six ../ segments that resolved outside the repository, and an installed plugin does not carry docs/. It now names the path in code font.
• Relay (audit-instructions: adopt (check, claim, sites) finding identity and admit I30 to I33 to --persist-findings #4116, fix(claude-config): finish audit-instructions catalog gaps and dispatch plan #4656): emit-findings.sh admits I31 in any skill-directory file and I33 in any skill-loaded file except SKILL.md, names the nearest ancestor SKILL.md as the I33 hub, and tiers I32 CRITICAL under plugins/ and IMPORTANT elsewhere. The persist-admission text in criteria.md and persist-findings.md names the scanner (I28, I29) and lane (I30 to I33) intakes.
• finding-ids.sh surface_of() (audit-instructions: adopt (check, claim, sites) finding identity and admit I30 to I33 to --persist-findings #4116, the security-lane finding left open at merge of feat(claude-config): stable audit-instructions finding identity (#4116) #4851): the user surface stays home-wide, and now admits only instruction-file shapes. Basis: Claude Code reads CLAUDE.md, CLAUDE.local.md and AGENTS.md from the working directory and every directory above it, and follows imports to absolute paths, so narrowing to ${CLAUDE_CONFIG_DIR:-$HOME/.claude} would drop real user surfaces. Any markdown file, settings.json, settings.local.json and hooks.json inside a .claude tree or the resolved CLAUDE_CONFIG_DIR, and files beneath a skills/ directory in those trees are admitted; ~/.ssh/config, credentials, transcripts and dotfiles are refused as surface-not-an-instruction-file. The scope carries its four-part verification record in the code. This is the citation for dismissing the open PR-comment finding on feat(claude-config): stable audit-instructions finding identity (#4116) #4851. relativize_in_repo is unchanged.
• audit-instructions docs (claude-config: audit-instructions execution model, scanner calibration, report contract, and environment fit #4113, audit-instructions: token-budgeted lanes, --unattended, and --resume over per-lane run files #4114, audit-instructions: I6 pre-scan adopts the audit-noise gate set; I33 lane fences, excerpt anchors, and per-plugin presentation #4115, fix(claude-config): finish audit-instructions catalog gaps and dispatch plan #4656): lane sizing loses its ticket back-references, the subagent-window claim gets a four-part record, the read-only contract covers lane reports and run-state writes, I33 rows count as one dispatch outside per-lane verifier batches, and SKILL.md regains line headroom under the 500-line cap.
• audit-engine.sh (claude-config audit: baseline push ask rule contradicts a repo's declared autonomous merge lane #4600): the HOOKS_LIVE=1 row ends with $lane_note, like the other ask-rule rows.
• unhobble (claude-config/unhobble: durable state, gate-aware strip plan, sourced carve-out, decide composition #4094, claude-config: design per-rule deletion-evidence attribution for unhobble's ledger grammar #3563): the one-row watch disqualifier versus the two-row re-add grammar is this skill's own rule (SKILL.md Phase 4 step 1), not an upstream one. SKILL.md and evals/evals.json (evals 27 to 30 added; 18 and 22 tightened). Items 1 to 4 and 7 of claude-config/unhobble: durable state, gate-aware strip plan, sourced carve-out, decide composition #4094 were already on main (feat(claude-config): keep unhobble experiment state in the repo (#4094) #5081). Items 5, 6, 8, 9 and 10 to 12 land here.
• chore: apply changelog rows for CLI surfaces and managed connectors (#4027) #5154 review (Apply the Claude Code 2.1.257 to 2.1.263 changelog decisions: 20 corrections, 1 native nomination, 7 adoptions, 3 declines #4027): permission-state.sh classified a settings file invalid-json when the last key under permissions was a string, because jq -e reads only the last output of a per-key check, so C2-defaultMode and C5-disableType could not fire on real files. Fixed with tests that fail against the old reader. The masking claim now carries its condition, and the unsourced auto version boundary is removed. Claims were checked against pages fetched 2026-09-29 (recorded in the commit body).
• fix(claude-config): finish audit-instructions catalog gaps and dispatch plan #4656 equivalence proof: regenerated at the fix(claude-config): close audit-instructions catalog gaps (#4656) #4839 pair; every output matched byte for byte and the grep count is constant. Evidence only, no change committed.
• CHANGELOG.md (Apply the Claude Code 2.1.257 to 2.1.263 changelog decisions: 20 corrections, 1 native nomination, 7 adoptions, 3 declines #4027): the repeated 0.51.17 and 0.51.18 bodies became pointers, 0.51.7 records that it shipped through chore: apply changelog rows for CLI surfaces and managed connectors (#4027) #5154, and the header notes the unreleased reserved versions.
• Cross-group requests applied (Apply the Claude Code 2.1.257 to 2.1.263 changelog decisions: 20 corrections, 1 native nomination, 7 adoptions, 3 declines #4027): criteria.md I21 and the audit effort-pin row state the effort defaults from the model-config resolution order fetched 2026-09-28 (Opus 5.5 and Sonnet 5.5 default to medium, Opus 4.7 to xhigh; the first-run-hold clause is gone), with Verified, Source and the recheck trigger restamped. unhobble SKILL.md and eval 15 stop restating the block-hook-bypass exit code and heredoc coverage and defer to the hook.

In-place changelog corrections:

• 0.51.18: body replaced by a pointer; it repeated the 0.51.16 Fixed entry (released by fix(claude-config): apply 2.1.257–2.1.263 permission changelog corrections (#4027) #5159) and a reworded near-duplicate of the 0.51.10 Changed entry (released by feat: adopt Claude Code 2.1.257–2.1.263 changelog capabilities (#4027) #5161).
• 0.51.17: body replaced by a pointer; it repeated the 0.51.15 entry (released by chore: apply more Claude Code 2.1.257–2.1.263 changelog decisions (#4027) #5156).
• 0.51.7: states it shipped through chore: apply changelog rows for CLI surfaces and managed connectors (#4027) #5154 (commit 9c2db71), not fix(claude-config): flag project defaultMode bypassPermissions as dead (Refs #4027) #5059 (closed unmerged).
• File header: notes that 0.51.8 to 0.51.9 and 0.51.11 to 0.51.14 were reserved by parallel branches and never released.

No issue is closed by this PR. #4094 stays on Refs because its 14-item checklist is not verified complete here, and the others are decision-held or have leftovers in other groups.

Verification

Run in /home/kyle/worktrees/ccp-fix-claude-config after merging origin/main (aebb9bb):

• All 34 plugins/claude-config/**/*.test.sh suites: exit 0 (includes emit-findings.test.sh, finding-ids.test.sh, finding-identity.test.sh, permission-plane-lint.test.sh, permission-state.test.sh, audit-engine.test.sh, lane-runs.test.sh, instruction-files.test.sh).
• bash scripts/check-detector-findings-crosswalk.sh --check: OK, 38 rule rows.
• bash scripts/check-changed-skills.sh origin/main: 4 skills checked, 0 failed.
• bash scripts/check-changelog-parity.sh --check --check-order, --check-bump origin/main, --check-preserved origin/main (190 headings compared): pass.
• bash scripts/validate-plugins.sh: all manifests and the catalog validated.
• shellcheck on every changed .sh file (the SC2016 hit on the emit-findings.test.sh rule fixture line is suppressed with a reason) and check-evals-quality.sh on the changed evals pass; check-skill.sh warnings that remain were present on main.

#5154 review outcome (#4027):

• Claims checked: the defaultMode masking claim, the permissions key shapes the lint reads, and the auto-mode version boundary, each against Claude Code docs pages fetched 2026-09-29.
• Evidence: the masking claim holds only under a stated condition, now carried in the text; the auto version boundary had no source and is removed; permission-state.sh reproduced the invalid-json misclassification when the last permissions key was a string.
• Defect fixed: the per-key jq -e check counted only the last output, so C2-defaultMode and C5-disableType could not fire on real files. New tests in permission-state.test.sh fail against the old reader and pass now.

Related

Audit report: .work/audit/REPORT.md findings by issue number: #3563, #3568 (row 3c), #4027 (3b), #4094 (3b), #4113 (3b), #4114, #4115, #4116, #4583, #4600, #4656 (3c).

Cross-group requests (not done here):

• core-docs: docs/plugin-philosophy.md Name one owner for the hardcoded-consumer-specifics doctrine #4583 structure and citation defects, the docs/upstream/claude-code.md ledger re-point from fix(claude-config): flag project defaultMode bypassPermissions as dead (Refs #4027) #5059 to chore: apply changelog rows for CLI surfaces and managed connectors (#4027) #5154, fix(claude-config): apply 2.1.257–2.1.263 permission changelog corrections (#4027) #5159 and feat: adopt Claude Code 2.1.257–2.1.263 changelog capabilities (#4027) #5161, the row 257-089 status, the FORCE decline reconciliation, and review of the chore: apply changelog rows for CLI surfaces and managed connectors (#4027) #5154 philosophy changes.
• playbooks: review of the chore: apply changelog rows for CLI surfaces and managed connectors (#4027) #5154 boris changes.
• scripts: check-changelog-parity.sh should reject a CHANGELOG entry whose body is byte-identical to an earlier entry.
• source-control: a body containing "Do not merge" must block the unattended merge lane.
• review: closing comment on claude-config: record the security caveats of the unhobbling posture (guardrail deletion, notes poisoning) #3566.
• ci: reopen claude-config/unhobble: durable state, gate-aware strip plan, sourced carve-out, decide composition #4094 and comment that this PR delivers items 5, 6, 8, 9, 10 to 12.
• conventions: docs/conventions/detector-findings/README.md crosswalk rows for I31, I32 and I33 restate the surface set and the I32 tier as criteria.md defines them.

Cross-group requests received and not applied here:

• playbooks (docs/upstream row 257-083 rewrite): forwarded to core-docs, which owns docs/upstream/claude-code.md and already edits that row.
• ci (claude-config/unhobble: durable state, gate-aware strip plan, sourced carve-out, decide composition #4094): items 5, 6, 8, 9 and 10 to 12 already land in this PR.
• review (claude-config: record the security caveats of the unhobbling posture (guardrail deletion, notes poisoning) #3566): the review group posts that comment.
• tracker (fix(claude-config): finish audit-instructions catalog gaps and dispatch plan #4656): label removed and results noted on the issue.
• context-guard (row 260-002 home), context-budget (Items column), skill-quality and session-flow follow-ups: added to the Apply the Claude Code 2.1.257 to 2.1.263 changelog decisions: 20 corrections, 1 native nomination, 7 adoptions, 3 declines #4027 packet as open questions. decisions-docs (docs: decide ownership for shared-surface instruction governance #3568): both questions added to the docs: decide ownership for shared-surface instruction governance #3568 packet. Nothing implemented.

Issue operations done: #4027 and #4115 reopened with decision packets, packets on #3568 and #4027 extended, comments on #4113, #4116, #4656, #4583 and #3563.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB

[github-actions]

PR body contract — issue linkage

This PR body conforms to the issue-linkage contract. Nothing to do.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T15:59:35.949850Z	5cb0e0d	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 1m 46s —— View job

---

Security review

Reviewed all 25 changed files (gh pr diff 5311, base origin/main). No security issues found.

No findings. This PR is documentation/skill-instructions and test-script maintenance for
plugins/claude-config; every .sh change touches a detector/lint script, not application logic
that handles untrusted input, credentials, or trust boundaries. Two changes are worth calling out
as security-positive, since they're exactly the kind of thing this lane watches for:

• finding-ids.sh (skills/audit-instructions/scripts/finding-ids.sh, surface_of/instruction_shape) narrows what counts as a "surface" under $HOME. Previously any file under the home directory could be hashed into a finding anchor; now only instruction-file shapes (*.md, or settings.json/settings.local.json/hooks.json/skills/* inside a .claude tree or CLAUDE_CONFIG_DIR) qualify, and ~/.ssh/config, ~/.claude/.credentials.json, transcripts, and dotfiles are explicitly refused as surface-not-an-instruction-file. This reduces exposure to reading sensitive files, not the reverse.
• permission-state.sh (classify_json_file) fixes a real detection gap: the old jq -e per-key check only kept the last key's type verdict, so a settings.json whose last permissions key was a string (e.g. {"permissions":{"defaultMode":"bypassPermissions"}}) was misclassified invalid-json and silently skipped — meaning C2-defaultMode/C5-disableType findings for a real bypassPermissions/disableAutoMode pin could go undetected. The new check validates allow/ask/deny explicitly regardless of key order, with tests that fail against the old reader.

Instruction-surface deletion lens applied: the diff removes/rewords several standing rules
(unhobble's "silence is a deletion warrant" language, execution-and-report.md's deletion,
SKILL.md wording trims). None weaken an enforced guardrail:

• unhobble's ledger-silence rule is tightened, not loosened — an empty ledger now licenses deleting only an "editorial" candidate; a consequential rule the ledger didn't defend must go through a Deletion watch or be restored (skills/unhobble/SKILL.md, Phase 4 step 4 and "Deletion watch"). The "Security posture is out of scope" carve-out (policy-classified hooks kept, never stripped by default) is unchanged.
• context/execution-and-report.md is deleted, but its two contracts (lane sizing/resume, report identity) are relocated into SKILL.md and reference/finding-identity.md, not dropped — content moves, nothing is unenforced.
• The block-hook-bypass restatement removed from unhobble/SKILL.md's Gotchas is a restated-elsewhere case (the guardrails plugin's own hook and README still enforce/describe the block); no mechanism was weakened, only a redundant description of one.

Nothing in this PR touches hooks/exec-bash.mjs, credential handling, network calls, or GitHub
Actions workflow files.

[claude]

Claude finished @kyle-sexton's task in 3m 10s —— View job

---

Claude finished the code review

• Gather context (PR body, changed files, custom instructions)
• Invoke /review:code-review per custom instructions
• Post inline findings (none met the bar — see below)
• Final summary

Review scope

This is the CI code-review lane (/review:code-review): correctness and maintainability findings only, scoped to files changed in this PR, high-signal bar (a careful senior reviewer would block/flag, with a concrete failure scenario).

I focused on the code-bearing diffs, since the bulk of this PR (roughly 750 of ~840 added lines) is prose rewording in SKILL.md/reference/*.md/README.md/CHANGELOG.md with no executable logic:

• scripts/emit-findings.sh — the new hub_of(file, loc, ...) ancestor-SKILL.md walk and the widened in_rule_surfaces/rule_tier logic (I31/I33 surface widening, I32 tier-by-arm). Traced the base/h prefix arithmetic and the loop's empty-h exit condition; both check out for every path shape the new test Case 18 (emit-findings.test.sh) exercises, and I didn't find an input shape in real usage (relative, repo-rooted paths) that breaks it.
• scripts/finding-ids.sh — the new instruction_shape() gate and its two-case surface_of/site_of refusal plumbing (surface-not-an-instruction-file vs surface-outside-repository-and-home). Consistent with the new Case 6b tests, including the symlink-resolves-before-shape-test cases.
• scripts/permission-state.sh — verified the described defect is real and the fix is correct: the old to_entries[] | .value | type piped through as $kt produced one boolean per permissions key, and jq -e's exit status is keyed to the last emitted value, so a trailing string key (e.g. defaultMode) after an array-typed rule list masked the check. The new [.permissions.allow, .permissions.ask, .permissions.deny] | all(...) collapses this to a single boolean and is exercised by the new "trailing string key must not rescue a rule list of the wrong type" test.
• scripts/permission-plane-lint.sh, scripts/audit-engine.sh (the $lane_note addition — confirmed in scope on all four call sites), scripts/instruction-files.sh (comment-only) — no issues.

I also cross-checked the rewritten prose in criteria.md, finding-identity.md, persist-findings.md, conflict-criteria.md, and the unhobble SKILL.md additions (oracle test, product-surface class, readd refusal gate, ledger grouping, decide) for internal consistency with the code-level changes and with each other; nothing contradicted.

Result

No findings meet this lane's bar. Nothing here is a correctness bug I could reproduce, and the two behavior changes with real logic risk (the permission-state.sh jq fix and the emit-findings.sh I31/I33/I32 relay widening) are both backed by new tests that fail against the prior behavior, which is what I'd otherwise be asking for.
· branch

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5cb0e0dcdd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 6m 6s —— View job

---

Claude finished the code review

• Gather context (PR body, changed files, custom instructions)
• Invoke /review:code-review per custom instructions
• Post inline findings
• Final summary

Review scope

CI code-review lane (/review:code-review): correctness and maintainability only, scoped to files changed in this PR (git diff origin/main...HEAD), reviewed at HEAD 5be292f. Security is out of scope here (a separate security lane already ran on this PR).

The latest commit (5be292f) correctly addresses both prior Codex findings on this PR:

• The defaultMode-type-validation P1/P2 items: permission-state.sh's classify_json_file now rejects a non-string defaultMode as invalid-json, with a new test ({"permissions":{"defaultMode":{},"allow":[...]}} → invalid-json) that reproduces the exact shape from the review comment. The disable* keys are deliberately left to the separate C5-disableType lint (verified: emit_file_conf still forwards their raw JSON type via conf records regardless of shape, so C5-disableType's conf[k] != "\"disable\"" check still fires on a mistyped value — this isn't a gap, it's a different, already-correct enforcement path).
• The 200000-token lane-window fallback in audit-instructions/SKILL.md now carries the full four-part verification record (Claim/Basis/As of/Recheck), matching this repo's skill-bodies-state-current-rules convention.

Findings (posted inline)

1. emit-findings.sh:331-340 (hub_of) — wrong I33 remediation target when the script runs outside the repo root. The new ancestor-walk hub search derives base by checking whether file (CWD-relative) ends with loc (repo-relative) — backwards. relativize_in_repo() actually builds loc = <git-prefix>/file, so loc ends with file, not the reverse, whenever the invocation CWD isn't the repo root. The guard then never matches, base falls back to "", and every ancestor probe is opened as a repo-root-relative path against a non-root CWD — the real hub SKILL.md is never found even when it exists, and the Action text falls back to "the surface that points at this file." Traced through a concrete example (running from plugins/claude-config/skills/audit-instructions/). None of the new tests catch this because every fixture cds to the repo root first, where file == loc trivially passes.
2. emit-findings.sh:364-368 (in_rule_surfaces) — still under-admits I31/I33 per criteria.md's own surface text. criteria.md scopes both rules over "a file a memory surface points the model at to read," not only skills/<name>/... and context/reference/references directories, but the predicate only recognizes the latter. This PR's own Case 18 fixture (docs/notes.md) demonstrates the gap by asserting it gets declined rather than closing it. This was already flagged in a review comment on this PR (Codex, P2) and remains open at this HEAD — confirmed independently against criteria.md.

Everything else reviewed checked out: finding-ids.sh's new instruction_shape() gate (traced the .md-anywhere-under-$HOME vs. JSON/skills/-must-be-in-.claude-tree distinction against its own four-part record — consistent), the permission-plane-lint.sh wording update, and the audit-engine.sh $lane_note plumbing (all four call sites consistent, new Case 3b test exercises the right branch).
· branch

[claude]

Claude finished @kyle-sexton's task in 3m 9s —— View job

---

Security review

• Gather context (PR body, changed files, custom instructions)
• Invoke /review:security-review and follow it exactly
• Post findings
• Final summary

Reviewed the full diff against origin/main (git diff origin/main...HEAD, 25 files, matches the PR's changed-file list) at HEAD 5be292f, scoped to plugins/claude-config/ per this lane's criteria: logic/trust-boundary flaws, injection surfaces, and the instruction-surface deletion lens (checked against docs/conventions/instruction-exception-register/README.md, which is present in this checkout).

1 finding, IMPORTANT, posted inline on permission-state.sh#L288:

The latest commit (5be292f) adds a defaultMode-must-be-a-string check to classify_json_file(). That's the right fix for the Codex P2 comment on the prior revision, but it has a side effect: a malformed-defaultMode file now classifies invalid-json, and emit_file_conf() — which emits the disableAutoMode config record permission-plane-lint.sh's C5-disableType check depends on — only runs when status is present (permission-state.sh#L390-L392). So a settings file with both a malformed defaultMode and a mistyped disableAutoMode (e.g. {"permissions":{"defaultMode":{}},"disableAutoMode":true}) now has its disableAutoMode misconfiguration silently dropped from the audit, where before this commit it was correctly caught — disableAutoMode:true is exactly the "operator believes auto mode is disabled and it is not" case the script's own comments call out as the worst-case lock-out failure. This also makes the commit's own comment and CHANGELOG line ("The disable* keys are left to the C5-disableType lint, which reports a mistyped one") false for this compound case; no test in permission-state.test.sh exercises both defects in one fixture.

Other things checked, no findings:

• finding-ids.sh's narrowed instruction_shape()/surface_of() home-directory gate: narrows what's admitted (refuses ~/.ssh/config, credentials, dotfiles), no widening of exposure.
• emit-findings.sh's widened I31/I33 surface admission and I32 tier-by-arm split: relay/reporting logic only, no injection or trust-boundary surface (the existing Codex P2 comment about under-admitting memory-linked files is an accuracy gap, not a security issue, so out of this lane's scope).
• Instruction-surface deletions (execution-and-report.md removed, unhobble's "silence as deletion warrant" reworded, block-hook-bypass restatement trimmed): checked each against the instruction exception register's six Gate-0 classes (irreversible-action, secret-handling, data-integrity, external-publication, legal-compliance, agent-authority). None match — content is relocated (not dropped) or the rule is tightened, not loosened, and the security posture carve-out (policy-classified hooks never stripped by default) is unchanged.
• No GitHub Actions files, no secrets/credential handling, no hooks/exec-bash.mjs changes (confirmed untouched, matching the PR description).
  · branch

[claude]

Claude finished @kyle-sexton's task in 2m 13s —— View job

---

Security review

• Gather context (PR body, changed files, custom instructions)
• Invoke /review:security-review and follow it exactly
• Post findings
• Final summary

No findings. This is a re-review at HEAD ea8e674 after two follow-up commits (5be292f, ea8e674) that resolve both prior findings from this lane and the code-review lane on this PR:

1. disableAutoMode masking (the IMPORTANT finding posted earlier on this PR) — permission-state.sh#L275-L285. Commit 5be292f had added a defaultMode-must-be-a-string gate to classify_json_file(), which caused a file with a malformed defaultMode to classify invalid-json — skipping emit_file_conf() entirely and silently dropping the file's disableAutoMode conf record that permission-plane-lint.sh's C5-disableType check depends on (the exact lock-out scenario: {"permissions":{"defaultMode":{}},"disableAutoMode":true} would no longer surface the mistyped lock-out switch). Commit ea8e674 reverts the defaultMode type gate, restoring the file's present classification so emit_file_conf always runs. Verified against the new test in permission-state.test.sh#L168-L175, which fixtures both defects in one file and asserts the scope stays present and disableAutoMode true is still read. Traced the jq filter directly — confirmed only allow/ask/deny are checked now, defaultMode's shape no longer gates classification.

2. hub_of() wrong-directory bug (correctness/audit-integrity finding posted earlier on this PR) — emit-findings.sh#L331-L334. The base fallback (when file doesn't end with loc, i.e. the script runs from a repo subdirectory) now uses the absolute repo_root_pwd/repo_root instead of "". Traced REPO_ROOT/REPO_ROOT_PWD (lines 222-236): both are always absolute (git rev-parse --show-toplevel, or a pwd resolved from it), so every ancestor SKILL.md probe in the walk is now an absolute path regardless of invocation CWD. Confirmed by the new subdirectory-invocation test in emit-findings.test.sh#L898-L902.

No new security-relevant issues in the rest of the diff (plugins/claude-config/ only, hooks/exec-bash.mjs untouched). Re-checked the full changed-file set against this lane's criteria (injection surfaces, trust-boundary/authz logic, credential handling, instruction-surface deletions against the instruction exception register) — consistent with the earlier passes on this PR (5cb0e0d, 5be292f), which is unchanged for the ~20 files this commit didn't touch.

One remaining open item, not a security finding: in_rule_surfaces() in emit-findings.sh still under-admits some I31/I33 memory-linked files per criteria.md's own surface text (flagged by Codex and the code-review lane, acknowledged by the author as a scoped-out audit-completeness gap, not addressed in this commit). Under-admission only omits a persisted repair proposal — it doesn't emit an incorrect one or widen any exposure, and no standing guardrail is removed by it, so it's out of this lane's scope per its own criteria (security issues only).
· branch

[claude]

Claude finished @kyle-sexton's task in 2m 10s —— View job

---

Claude finished the code review

• Gather context (PR body, changed files, custom instructions)
• Invoke /review:code-review per custom instructions
• Post inline findings (none — see below)
• Final summary

Review scope

CI code-review lane (/review:code-review), triggered by synchronize. HEAD is ea8e674, one commit ahead of the last-reviewed 5be292f. That commit (ea8e674) is scoped entirely to fixing the two open findings from this lane's prior review round on this PR, so I focused verification there rather than re-reviewing the whole diff (already covered in prior rounds).

Verified fixes

1. permission-state.sh disableAutoMode masking (IMPORTANT, previously flagged) — fixed correctly. The commit reverts the defaultMode-type gate added in 5be292f entirely, so a malformed defaultMode (e.g. an object) no longer makes the file classify invalid-json; the file stays present, emit_file_conf still runs, and a mistyped disableAutoMode beside it is still emitted as a conf record for C5-disableType to catch. Traced permission-plane-lint.sh's C2-defaultMode check (lines 197-205): it only string-compares conf[k] against "\"auto\""/"\"bypassPermissions\"", so a non-string defaultMode (now serialized via tojson, e.g. "{}") neither crashes nor produces a false positive — it's simply not flagged by C2-defaultMode, which is the accepted trade-off from this thread. New test (permission-state.test.sh) covers {"permissions":{"defaultMode":{}},"disableAutoMode":true} → present + conf user settings disableAutoMode true, which reproduces the exact compound case from the prior finding.

2. emit-findings.sh hub_of() backwards subdirectory check (previously flagged) — fixed correctly. Traced the new fallback: when file (CWD-relative) doesn't end with loc (repo-relative) — i.e., the invocation CWD isn't the repo root — base now falls back to repo_root_pwd (or repo_root) plus /, an absolute path, instead of the empty string it fell back to before. Walked the concrete failure case from the original finding (running from plugins/claude-config/skills/audit-instructions/ with file=scripts/finding-ids.sh, loc=plugins/claude-config/skills/audit-instructions/scripts/finding-ids.sh): base now resolves to the absolute repo root, and the ancestor probe correctly opens <repo_root>/plugins/claude-config/skills/audit-instructions/SKILL.md via getline, regardless of CWD. The new emit-findings.test.sh case (cd "$SURFREPO/$SURFSKILL" then --from-lane with a relative path) exercises exactly this scenario.

Both fixes are consistent with the existing pattern elsewhere in the file (source_line() already opens file relative to the real CWD; relativize_in_repo() already prefers repo_root_pwd over repo_root for the symlink case), so nothing here is a one-off.

Not re-flagged

The third open comment (in_rule_surfaces() under-admitting memory-linked files outside skills//context/reference/references shapes) was addressed with reasoning by the author (no code change): under-admission only omits a persisted repair proposal — it's counted and visible as outside-rule-surfaces, never silently dropped, and never emits a wrong remediation. That's a scope/interface decision, not a correctness bug this lane's bar would block on, so I'm not re-raising it.

Not verified

I could not execute the test suites in this environment (bash tool execution was denied by the sandbox), so the above is verified by code trace only, not by running permission-state.test.sh / emit-findings.test.sh. The PR description's own Verification section (34 suites passing) is author-claimed and not independently confirmed by me.

No findings.
· branch