You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
--plugin-dir smoke test in a clean non-source scratch repo (headless claude -p): skill invoked as discovery:explore, body loaded (six dimensions + artifact name reported correctly), no permission prompts.
Local lanes: markdownlint-cli2 0 errors (8 files), typos clean, git diff --check clean. No shell scripts, hooks, or workflows added.
Security review (playbook plugin-acceptance)
Code execution: none — no hooks, no bundled scripts, no MCP/LSP servers, skills only.
Remote MCP servers: none shipped (deny by default).
userConfig: one non-sensitive string (notes_dir, a project-relative path); no credentials, correctly NOT sensitive.
Cache isolation: all internal references via ${CLAUDE_PLUGIN_ROOT}; no ../ reach-outs; state written only inside the consumer's project at the configured notes dir.
Data egress: the research skills instruct use of whatever research tools the consumer session already provides (WebSearch/WebFetch/MCP); the plugin itself adds no outbound calls.
Provenance: authored in-org from the medley originals; MIT.
Merge ⇒ marketplace entry present + README catalog row added; medley originals remain until the cutover issue.
Worker: melo-desk-001-6837229512
Note
Low Risk
Markdown-only plugin (no hooks, scripts, or MCP servers); research skills direct the agent to use the consumer's existing web tools and write notes under a configurable project path.
Overview
Adds the discovery plugin to the marketplace and root README catalog, shipping four repo-agnostic skills for pre-change discovery.
Local exploration:/discovery:explore runs a six-dimension codebase workflow (code, git, structure, tests, config, environment), optional blindspot mode, routing to built-in Explore subagents vs inline vs /discovery:explore-deep (context: fork). Artifacts land as EXPLORE.md under configurable notes_dir (default .claude/notes), with sidecar files when needed. ecosystem-discovery.md replaces repo-specific tables with multi-ecosystem globs/greps.
External research:/discovery:research enforces a chained 3-phase discipline (broad → targeted + mandatory falsification → preferred sources), source tiers, recency, and a binary outcome gate; discipline.md is the in-plugin SSOT. RESEARCH.md is the handoff artifact. /discovery:research-deep dispatches to workflow engine, forked subagent, or inline, with a multi-topic fan-out before single-blob deep runs.
Medley-specific paths and rules are removed in favor of ${CLAUDE_PLUGIN_ROOT} references, consumer CLAUDE.md/rules, and capability detection with documented graceful degradation.
Reviewed by Cursor Bugbot for commit 3617330. Bugbot is set up for automated code reviews on this repo. Configure here.
Four skills migrated from the medley repo and generalized to be
repo-agnostic: explore, explore-deep (forked variant), research,
research-deep (dispatcher). Project-specific behavior routes through the
consumer's CLAUDE.md/rules; artifact location is a single notes_dir
userConfig option (default .claude/notes).
Co-Authored-By: Claude <noreply@anthropic.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not provide a clean automated review signal. Human review is needed; no reviewers were assigned because no suitable non-author maintainers were identified in this repository.
Sent by Cursor Approval Agent: Pull Request Router and Approver
plugin.json correctly uses name, version: 0.1.0, author, license, keywords, $schema, and a valid userConfig.notes_dir (type string, required title + description, non-sensitive, default set). Marketplace entry has category: development and matching tags. No hooks, MCP servers, LSP, or monitors. All four skills are in skills/<name>/SKILL.md subdirectories. ${CLAUDE_PLUGIN_ROOT} used for all internal references — no ../ reach-outs. Structure: clean.
Findings
HIGH — context: fork subagents have no conversation history
Confirmed against current docs:"The skill content becomes the prompt driving the subagent. It has no access to conversation history."
"a forked subagent that inherits the conversation, loads project memory, and persists EXPLORE.md"
context: fork does NOT inherit conversation history. The fork gets CLAUDE.md and the pre-computed shell context (branch name, git status, project root) only. A consumer routing to explore-deep expecting carry-through of the main session's task context will find a subagent that has none.
"If $ARGUMENTS is empty, infer scope from the context the main session passed."
There is no such context in a fork. Without arguments the fork's only scope cues are the pre-computed git substitutions at the top of the file. The instruction should say so explicitly.
HIGH — Bare sibling skill names in routing directive
Confirmed against current docs:"Plugin skills use a plugin-name:skill-name namespace, so they cannot conflict with other levels."
explore/SKILL.md line 21 contains an actionable routing directive: the model is told to route to /explore-deep when the deep variant is appropriate. When this plugin is installed from the marketplace, the actual invocable name is /discovery:explore-deep. The model following this directive will either fail to find the skill or, worse, invoke an unrelated project-level explore-deep skill if one happens to exist in the consumer's workspace.
The same issue appears in informational cross-references that the model may also act on:
Note: research-deep/SKILL.md already correctly uses /discovery:research in its Tier 2 agent-dispatch template (line 56), confirming this is an inconsistency rather than a deliberate design choice.
MEDIUM — explore-deep fork doesn't reference ecosystem-discovery.md
explore-deep/SKILL.md Step 2 instructs the fork to cover dimensions 3–6 "exactly" as the sibling /explore skill does. But the forked subagent doesn't have that skill's content — and critically, it never reads ${CLAUDE_PLUGIN_ROOT}/skills/explore/reference/ecosystem-discovery.md, which carries the per-ecosystem test globs, build-config file lists, dependency grep tokens, and runtime-version commands. Without this, dimensions 3–6 fall back to generic file-scanning rather than ecosystem-targeted discovery.
Suggested fix: add an explicit instruction to Read ${CLAUDE_PLUGIN_ROOT}/skills/explore/reference/ecosystem-discovery.md at the start of Step 2, or inline its content via a !`cat ...` substitution.
LOW — CLAUDE_CODE_FORK_SUBAGENT is not a Claude Code built-in and is undocumented in the plugin README
explore/SKILL.md line 21 and the explore-deep description both reference CLAUDE_CODE_FORK_SUBAGENT=1 as the condition for routing to the deep variant. This env var doesn't appear in the Claude Code docs — it's a consumer convention, not a harness gate. The harness will fork whenever context: fork is set in the frontmatter (unconditionally for direct invocations of /discovery:explore-deep). The env var only governs the model's routing decision inside the explore skill body. The current plugin README.md doesn't mention it, leaving consumers no way to discover this requirement. At a minimum it should appear in the README's configuration section.
What looks correct
Security posture: no code execution, no remote MCP, no bundled scripts. notes_dir is a non-sensitive path string. Data egress uses only consumer-provided session tools — consistent with the PR's own security review section.
${CLAUDE_PLUGIN_ROOT} isolation: correctly used in discipline.md and ecosystem-discovery.md references throughout; no external path reach-outs.
disable-model-invocation: false: appropriate for four read-only discovery skills.
Binary outcome gates: both explore and research self-check artifacts against concrete criteria before handoff — a genuine quality mechanism, not a recap.
research-deep Tier 2 dispatch prompt: correctly uses /discovery:research (line 56) — this is the pattern the HIGH finding above should bring the rest of the plugin into alignment with.
research/discipline.md: source-tier table, recency gates, falsification recipes, and confidence calibration are thorough and repo-agnostic.
Graceful degradation: research skill documents tool-substitution and gap-reporting when session tools are absent.
Summary
Two HIGH findings should be fixed before merge: the incorrect context: fork capability claim ("inherits the conversation") and the bare /explore-deep routing directive that will fail or misfire when installed as the discovery plugin. The MEDIUM finding (missing ecosystem-discovery.md reference in the fork) degrades explore-deep's ecosystem-targeted discovery depth. The LOW finding (undocumented CLAUDE_CODE_FORK_SUBAGENT convention) is a documentation gap. The plugin's security posture, structure, and research discipline are otherwise solid.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not provide a clean automated review signal. Human review is needed; no reviewers were assigned because no suitable non-author maintainers were identified in this repository.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Assess prior review findings against new HEAD (347e648)
Post findings
Status: prior HIGH/MEDIUM findings unresolved
The most recent commit (347e648) is a merge from origin/main that pulls in unrelated plugins (thariq-skills, boris, docs-hygiene, fable-5-playbook). None of the discovery plugin files changed. All four findings from the previous review remain open at current HEAD.
HIGH — Incorrect context: fork capability claims
Confirmed current: two claims describe fork behavior that doesn't exist.
"a forked subagent that inherits the conversation, loads project memory, and persists EXPLORE.md"
Per the Claude Code skills docs, context: fork delivers only the skill content as the prompt plus pre-computed shell substitutions. It does not inherit conversation history. A consumer routing here expecting the fork to know what the main session was working on will find a subagent with no such knowledge.
"If $ARGUMENTS is empty, infer scope from the context the main session passed."
There is no such context available in a fork. The only cues are the three pre-computed git substitutions in the frontmatter (branch, status, project root). The instruction should say so.
HIGH — Bare sibling skill names in actionable routing directive
The primary problem: explore/SKILL.md L21 tells the model to route to /explore-deep when deep exploration is warranted. When installed from the marketplace, the actual invocable name is /discovery:explore-deep. The model following this directive will either fail (skill not found) or, worse, invoke an unrelated project-level explore-deep skill if one exists in the consumer's workspace.
The same namespace gap appears in cross-references throughout the plugin:
The correct form already exists in the codebase — research-deep/SKILL.md line 54's Tier 2 dispatch template correctly uses /discovery:research. The other occurrences should match.
Two problems: the fork has no access to the sibling skill's content (it receives only this file as its prompt), and the phrasing implies an implicit follow-through to ecosystem-discovery.md that won't happen. That reference file carries per-ecosystem test globs, build-config file lists, dependency grep tokens, and runtime-version commands for Dimensions 3–6. Without an explicit instruction to Read it, the fork falls back to generic file-scanning.
Suggested fix: add at the start of Step 2, before the bullet list:
Before starting, Read `${CLAUDE_PLUGIN_ROOT}/skills/explore/reference/ecosystem-discovery.md` for
per-ecosystem test globs, build-config file lists, dependency grep tokens, and runtime-version
commands used by Dimensions 3–6.
Also update the wording to reference ecosystem-discovery.md directly rather than deferring to "the sibling skill," since that content isn't available to the fork.
LOW — CLAUDE_CODE_FORK_SUBAGENT undocumented in README configuration section
README.md L10 surfaces CLAUDE_CODE_FORK_SUBAGENT=1 as a requirement for explore-deep in the skill table. The Configuration section (L40–44) only documents notes_dir. Consumers have no way to discover what this env var is, whether it's a harness gate or a consumer convention, or how to set it. At minimum the README should explain it is a consumer convention (not a Claude Code built-in) that enables the /explore routing to /discovery:explore-deep, and note how to set it in the project environment.
LOW — TypeScript test globs missing co-located JSX/TSX patterns
ecosystem-discovery.md L37–39 covers only *.test.ts, *.spec.ts, and __tests__/**. React/Vitest/Jest repositories commonly co-locate tests as *.test.tsx or *.spec.tsx; pure-JS projects as *.test.js/*.spec.js. Missing these patterns causes the test-discovery dimension to silently miss co-located component tests in any TypeScript React repo, producing a false coverage gap in EXPLORE.md.
Suggested addition to the typescript.test-globs list:
Security posture: no hooks, no MCP servers, no bundled scripts. notes_dir is a non-sensitive path string. Data egress uses only whatever web/MCP tools the consumer session provides — no outbound calls added by the plugin itself.
${CLAUDE_PLUGIN_ROOT} isolation: all internal file references correctly use this variable; no ../ reach-outs; no hardcoded paths.
Binary outcome gates: both explore (L145–152) and research (L132–149) implement concrete artifact self-checks with FAIL-returns-to-named-phase, not summary recaps.
Namespace consistency in Tier 2 dispatch: research-deep/SKILL.md L54 already correctly uses /discovery:research inside the agent prompt template — the correct pattern exists and the other references should align.
research/discipline.md: source-tier table, recency gates, falsification recipes, confidence calibration, graceful degradation, and observed failure patterns are thorough, actionable, and repo-agnostic.
explore-deep fork conventions correctly stated where present: L27 correctly notes that path-scoped rules do NOT auto-load in subagent contexts. The Step 1 self-discovery instruction to explicitly Read relevant rule files is a good pattern.
Summary
Two HIGH issues should be fixed before merge: the incorrect fork capability claim ("inherits the conversation") and the bare /explore-deep routing directive that will misfire in an installed plugin context. The MEDIUM issue (missing explicit ecosystem-discovery.md Read in the fork) degrades Dimensions 3–6 ecosystem targeting in explore-deep. The two LOW issues (undocumented env var, missing TSX test globs) are documentation/completeness gaps. The plugin's security posture, manifest, and research discipline are solid.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not provide a clean automated review signal. Human review is needed; no reviewers were assigned because no suitable non-author maintainers were identified in this repository.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Fetch fresh docs per CLAUDE.md mandate (skills, plugins-reference)
Assess prior HIGH/MEDIUM/LOW findings at current HEAD (c26bde0)
Review for any new issues not caught in previous passes
Post findings
Status: all prior findings unresolved
c26bde0 is a merge from origin/main that pulled in unrelated plugins (firecrawl, fable-5-playbook, docs-hygiene). None of the discovery plugin files changed. Every finding from the two prior Claude reviews (posted at 421b6da and 347e648) remains open at current HEAD.
Fresh docs fetch confirms: context: fork skills — "The skill content becomes the prompt that drives the subagent. It won't have access to your conversation history." Plugin skills are namespaced as plugin-name:skill-name.
HIGH — Fork incorrectly described as inheriting conversation history
"a forked subagent that inherits the conversation, loads project memory, and persists EXPLORE.md"
Per current docs, context: fork delivers the SKILL.md content as the prompt plus pre-computed shell substitutions. It explicitly does not inherit conversation history. A consumer routing to explore-deep expecting the fork to know what the main session was working on will find a subagent that has none of that context — only branch name, git status, and project root.
"If $ARGUMENTS is empty, infer scope from the context the main session passed."
No such context is available in a fork — the only scope cues are the three pre-computed !`` git... ` `` substitutions in the frontmatter (branch, status, root). The instruction should name them explicitly.
Suggested fixes:
L21: replace "a forked subagent that inherits the conversation, loads project memory" → "a forked subagent that loads CLAUDE.md and project memory but has no access to the main session's conversation history"
L29: replace "infer scope from the context the main session passed" → "infer scope from the pre-computed context above (current branch and working-tree status) — the fork has no access to the main session's conversation history"
HIGH — Bare sibling skill names in actionable routing directives
When this plugin is installed from the marketplace, the correct invocable name includes the discovery: namespace prefix. Several actionable directives use bare names that will either fail (skill not found) or invoke an unrelated consumer-workspace skill of the same name.
The pattern already exists correctly at research-deep/SKILL.md L55 (/discovery:research in the Tier 2 dispatch template) — the other occurrences should match.
The fork receives only this SKILL.md as its prompt — it has no access to the sibling skill's content. As a result, the implicit reference to ecosystem-discovery.md via "follow the sibling" never materializes: the fork falls back to generic file-scanning for Dimensions 3–6 rather than using the per-ecosystem test globs, build-config lists, dependency grep tokens, and runtime-version commands that reference file provides.
Suggested fix — add before the bullet list in Step 2:
Before starting, Read `${CLAUDE_PLUGIN_ROOT}/skills/explore/reference/ecosystem-discovery.md`
for per-ecosystem test globs, build-config file lists, dependency grep tokens, and
runtime-version commands used by Dimensions 3–6.
Also update the wording from "Follow the sibling /explore skill exactly" to something that doesn't imply access to that skill's content in the fork context.
LOW — CLAUDE_CODE_FORK_SUBAGENT undocumented in README Configuration section
README.md L10 surfaces CLAUDE_CODE_FORK_SUBAGENT=1 as a requirement in the skill table, but the Configuration section (L40–44) documents only notes_dir. Consumers have no way to discover what this env var is, whether it's a Claude Code harness gate or a consumer convention, or how to set it. The README should explain it is a consumer convention that controls the /explore routing decision to /discovery:explore-deep.
LOW — Missing co-located test patterns for TypeScript (TSX, JS, JSX)
ecosystem-discovery.md L37–39 covers only *.test.ts, *.spec.ts, and __tests__/**. React/Vitest/Jest repositories commonly co-locate tests as *.test.tsx, *.spec.tsx, *.test.js, and *.spec.js. These are missing, causing the test-discovery dimension to silently miss co-located component tests in TypeScript React repos.
Security posture — no hooks, no MCP servers, no bundled scripts; notes_dir is a non-sensitive path string; data egress uses only consumer-session tools — no outbound calls added by the plugin itself.
${CLAUDE_PLUGIN_ROOT} isolation — all internal file references correctly use this variable; no ../ reach-outs; no hardcoded paths.
Binary outcome gates — explore (L145–152) and research (L130–149) both implement concrete artifact self-checks with FAIL-returns-to-named-phase rather than recaps.
research-deep Tier 2 dispatch — L55 correctly uses /discovery:research inside the agent prompt template — the correct pattern exists and the other references should align to it.
research/discipline.md — source-tier table, recency gates, falsification recipes, confidence calibration, graceful degradation, and observed failure patterns are thorough, actionable, and repo-agnostic.
explore-deep fork convention at L27 — correctly notes that path-scoped project rules do NOT auto-load in subagent contexts; the Step 1 instruction to explicitly Read rule files is the right pattern.
Multi-topic fan-out check in research-deep — the N ≥ 2 separable-topics guard (L27) correctly routes to parallel per-topic agents instead of feeding a blob to the engine.
Summary
No changes were made to the discovery plugin files in c26bde0. All findings from prior reviews remain open:
2 HIGH must be fixed before merge: the incorrect context: fork capability claim ("inherits the conversation") and the bare skill name routing directives that will misfire in any installed-plugin context.
1 MEDIUM: explore-deep Step 2 needs an explicit Read of ecosystem-discovery.md since the fork can't follow the sibling skill's content.
2 LOW: the undocumented CLAUDE_CODE_FORK_SUBAGENT convention and missing TSX/JS test globs.
The plugin's security posture, manifest schema, and research discipline are solid — these are correctness and usability issues in the skill instruction text, not structural problems.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not provide a clean automated review signal. Human review is needed; no reviewers were assigned because no suitable non-author maintainers were identified in this repository.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Check what changed at current HEAD vs prior reviews
Read discovery plugin files
Assess prior HIGH/MEDIUM/LOW findings
Scan for any new issues
Post findings
Status: all prior findings remain open; one clarification + two new LOWs
d4800f9 is a merge from origin/main that pulled in the claude-config-audit plugin. No discovery plugin files changed. Every finding from the three prior Claude reviews remains open at current HEAD.
Fresh file reads below confirm the current state.
HIGH — Fork described as inheriting conversation history
Per the Claude Code skills docs: "The skill content becomes the prompt driving the subagent. It won't have access to your conversation history."
"a forked subagent that inherits the conversation, loads project memory, and persists EXPLORE.md"
context: fork does not inherit conversation history. Only the SKILL.md content and pre-computed shell substitutions are available. A consumer routing here expecting carry-through of the main session's task context will find none.
"If $ARGUMENTS is empty, infer scope from the context the main session passed."
No such context reaches the fork. The only scope cues are the three pre-computed git substitutions in the frontmatter (branch, status, project root). The instruction should name them explicitly.
Suggested fixes:
L21: replace "a forked subagent that inherits the conversation, loads project memory" → "a forked subagent that loads CLAUDE.md and project memory but has no access to the main session's conversation history"
L29: replace "infer scope from the context the main session passed" → "infer scope from the pre-computed context above (current branch and working-tree status) — the fork has no access to the main session's conversation history"
HIGH — Bare sibling skill names in actionable routing directives
Plugin skills installed from the marketplace are namespaced as plugin-name:skill-name. Bare references in actionable directives will either fail (skill not found) or invoke an unrelated consumer-workspace skill of the same name.
The correct form already exists at research-deep/SKILL.md L55 (/discovery:research in the Tier 2 dispatch template). All other occurrences should align.
Clarification vs prior reviews: L71 (Run \/research` inline in this session.) is the most critical bare reference in research-deep` — it is a direct execution instruction that will misfire when the plugin is installed. Prior reviews cited L73/L85 for this file; L71 is the actionable one.
The fork receives only this SKILL.md as its prompt — it has no access to the sibling's content. The implicit follow-through to ecosystem-discovery.md never materializes: the fork falls back to generic file-scanning for Dimensions 3–6 rather than using the per-ecosystem test globs, build-config lists, dependency grep tokens, and runtime-version commands that file provides.
Suggested fix — add before the bullet list in Step 2:
Before starting, Read `${CLAUDE_PLUGIN_ROOT}/skills/explore/reference/ecosystem-discovery.md`
for per-ecosystem test globs, build-config file lists, dependency grep tokens, and
runtime-version commands used by Dimensions 3–6.
Also update the wording from "Follow the sibling /explore skill exactly" since that content is unavailable in the fork context.
LOW — CLAUDE_CODE_FORK_SUBAGENT undocumented in README Configuration section
README.md surfaces CLAUDE_CODE_FORK_SUBAGENT=1 as a requirement in the skill table but the Configuration section documents only notes_dir. Consumers have no way to discover what this variable is (consumer convention, not a Claude Code harness gate), how to set it, or what it controls. At minimum the README should explain it governs the /explore routing decision to /discovery:explore-deep.
LOW — Missing co-located TSX/JS test globs for TypeScript
ecosystem-discovery.md L37–39 lists only *.test.ts, *.spec.ts, __tests__/**. React/Vitest/Jest repos commonly co-locate tests as *.test.tsx, *.spec.tsx, *.test.js, *.spec.js. Missing these causes the test-discovery dimension to silently miss co-located component tests in TS React repos.
LOW (new) — Blindspot runs always fail the outcome gate
explore/SKILL.md L145–150 — the outcome gate fires "Before writing EXPLORE.md or returning the summary" and requires "Every Output-format section populated with specifics" (7 sections). Blindspot mode (L129) produces blindspot cards — a different deliverable that doesn't populate the 7-section format — yet "returning the summary" applies to that mode too. A strict reading means every blindspot run fails criterion 1 of the gate and loops infinitely. The gate needs an explicit blindspot carve-out (skip criterion 1, or define a separate blindspot gate for the cards format).
dependency-grep: "^\\s*\"[^\"]+\"$ in import blocks"
The trailing in import blocks is prose appended after the $ end-anchor. Used directly as a grep/ripgrep pattern this matches nothing (the prose text can't follow $ on the same line). The pattern and the scope clarification should be separated — either move the clarification to a dependency-grep-note field, or split it as "^\\s*\"[^\"]+\"" with prose on a separate comment line.
Security posture — no hooks, no MCP servers, no bundled scripts; notes_dir is a non-sensitive path string; data egress uses only consumer-session tools.
${CLAUDE_PLUGIN_ROOT} isolation — all internal file references correctly use this variable; no ../ reach-outs; no hardcoded paths.
Binary outcome gates — both explore (L145–152) and research (L130–149) implement concrete artifact self-checks with FAIL-returns-to-named-phase.
research-deep Tier 2 dispatch template — L55 correctly uses /discovery:research; the correct namespace pattern exists and the other references should align.
research/discipline.md — source-tier table, recency gates, falsification recipes, confidence calibration, graceful degradation, and observed failure patterns are thorough, actionable, and repo-agnostic.
explore-deep fork conventions at L27 — correctly notes path-scoped rules do NOT auto-load in subagent contexts; explicit Read of rule files is the right pattern.
Multi-topic fan-out check in research-deep — the N ≥ 2 separable-topics guard (L27) correctly routes to parallel per-topic agents.
Summary
No discovery plugin files changed in d4800f9. All prior findings remain open:
2 HIGH (must fix before merge): incorrect context: fork capability claim and bare skill-name routing directives that will misfire in any installed-plugin context — with a clarification that research-deep L71 is the critical bare reference, not L73/L85 as previously cited
1 MEDIUM: explore-deep Step 2 needs an explicit Read of ecosystem-discovery.md since the fork cannot follow the sibling skill's content
4 LOW (2 carried forward, 2 new): undocumented CLAUDE_CODE_FORK_SUBAGENT, missing TSX/JS test globs, blindspot outcome-gate always failing, and the Go dependency-grep mixing regex with unparseable prose
The plugin's security posture, manifest schema, and research discipline are solid — all findings are correctness and usability issues in the skill instruction text.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not provide a clean automated review signal. Human review is needed; no reviewers were assigned because no suitable non-author maintainers were identified in this repository.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Forked explore-deep requires explicit scope (a fork does not see the
parent conversation); blindspot runs skip the explore outcome gate;
TSX/JSX test globs; Go/Rust discovery entries are valid regexes with the
in-source-test pattern split into test-content-grep; recency gate
clarified for stable projects (fetch latest changelog this turn, window
bounds doc staleness); outcome gate requires HIGH confidence on every
accepted claim.
Co-Authored-By: Claude <noreply@anthropic.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not provide a clean automated review signal. Human review is needed; no reviewers were assigned because no suitable non-author maintainers were identified in this repository.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Status of prior findings at current HEAD (3617330)
3617330 is a merge from origin/main. The last substantive commit to the discovery plugin files was ad10d71. Here's what was fixed vs. what remains.
FIXED since initial filing
The following findings from prior reviews were addressed:
Finding
Fix
HIGH — explore/SKILL.md claimed fork "inherits the conversation"
L21 now correctly reads "a fork does not see the parent conversation"
HIGH — explore-deep/SKILL.md L29 said "infer scope from the context the main session passed"
L29 now reads "Scope comes exclusively from $ARGUMENTS — a forked skill does not see the parent conversation" with a defined fallback to repository-orientation pass
LOW — Missing TSX/JS test globs for TypeScript
typescript.test-globs now uses brace expansion {ts,tsx,js,jsx} covering all four extensions
LOW — Blindspot runs always failed the 7-section outcome gate
Outcome gate now opens with explicit blindspot exemption
LOW — Go dependency-grep mixed regex with unparseable prose
Now a pure regex (`^import
LOW — Rust test-globs had no path to embedded #[cfg(test)] tests
Now uses a dedicated test-content-grep sub-key; reference header documents the distinction
Gate criterion 6 now explicitly states "a stable project whose latest release is older than the window passes once that release is confirmed as current"
LOW — Outcome gate could pass with MEDIUM-confidence claims
Criterion 7 now requires every accepted claim to be HIGH confidence; discipline.md enforces this with an explicit "A MEDIUM or LOW claim is a Gap" rule
Both HIGH findings from prior reviews are now fixed. The plugin's correctness posture has meaningfully improved.
Remaining concerns
HIGH (design decision, not a mistake) — Bare sibling skill names in actionable routing directives
The PR author resolved this as "Intentional per the migration issue's locked decisions: sibling-skill refs inside this plugin stay bare." That design choice is documented; this finding is not a blocker if the team accepts the risk. But the risk is real and I'm flagging it here for explicit acknowledgment before merge.
When this plugin is installed from the marketplace, the model's invocation namespace is discovery:. Three prior Claude reviews and the Codex reviewer all independently confirmed that bare references in actionable positions will misfire on a consumer who doesn't happen to have a project-level skill of the same name:
Direct execution instruction: "Run /research inline in this session"
The informational cross-references (/research in the "does not do" section, /explore in the purpose section, etc.) are lower-risk since the model won't try to invoke them, but the two above are directives that could cause a failed skill lookup or, worse, invoke an unrelated consumer-workspace skill of the same name.
The correct form already exists in the codebase: research-deep/SKILL.md L56 uses /discovery:research inside the Tier 2 agent dispatch prompt — that template-call context was clearly considered. The inline Tier 3 at L71 was not.
If the bare-ref convention is kept intentionally, at minimum document it explicitly in the plugin README or a comment in each skill so future maintainers understand why the asymmetry exists.
MEDIUM — explore-deep fork has no path to ecosystem-discovery.md dimensions
The fork receives only this SKILL.md as its prompt — it does not receive the sibling skill's content. The sibling's Dimension 3, 4, 5, and 6 sections each carry explicit ${CLAUDE_PLUGIN_ROOT}/skills/explore/reference/ecosystem-discovery.md references; a model following "follow the sibling skill exactly" in the fork has no way to act on those references without inventing the path.
ecosystem-discovery.md carries per-ecosystem test globs, build-config file lists, dependency grep tokens, and runtime-version commands. Without an explicit Read instruction in explore-deep, the fork falls back to generic file-scanning for Dimensions 3–6.
Suggested fix — add before the bullet list in Step 2:
Before starting Dimensions 3–6, Read `${CLAUDE_PLUGIN_ROOT}/skills/explore/reference/ecosystem-discovery.md`
for per-ecosystem test globs, build-config file lists, dependency grep tokens, and
runtime-version commands.
Also update "Follow the sibling /explore skill exactly" to something that doesn't imply access to that skill's content in the fork.
LOW — CLAUDE_CODE_FORK_SUBAGENT undocumented in README Configuration section
README.md Configuration section documents only notes_dir. CLAUDE_CODE_FORK_SUBAGENT=1 appears in the skill table description but no explanation is provided. Consumers have no way to learn:
Whether it's a Claude Code harness gate (it isn't — the harness always forks on context: fork) or a consumer convention that controls the model's routing decision
How to set it (e.g. in .env, shell profile, or a project-level env declaration)
What happens when it's unset (fall back to built-in Explore subagent or inline, but this detail is buried in explore/SKILL.md)
At minimum the README should add a row to the Configuration table (or a new "Environment" section) explaining this variable and its scope.
"Before writing, run the Outcome gate the /explore workflow defines — the binary artifact self-check, not a 'did I explore enough?' recap; any FAIL → fix first."
The fork receives only explore-deep/SKILL.md as its prompt; it has no access to the four binary criteria specified in explore/SKILL.md L149–152 (every section populated, every area covered or listed as a gap, claims Read-verified, open questions surfaced). The instruction is partially self-explanatory ("binary artifact self-check") but a model without the specific criteria may apply a weaker self-check than the /explore workflow intends.
Suggested fix: restate the four binary criteria from explore/SKILL.md's Outcome gate inline in Step 3, or direct the fork to Read them from ${CLAUDE_PLUGIN_ROOT}/skills/explore/SKILL.md.
What looks correct at current HEAD
Both prior HIGH findings fixed — the fork capability description is now accurate; scope handling is explicit.
Security posture — no hooks, no MCP servers, no bundled scripts; notes_dir is a non-sensitive path string; data egress uses only consumer-session tools — no outbound calls added by the plugin itself.
${CLAUDE_PLUGIN_ROOT} isolation — all internal file references correctly use this variable; no ../ reach-outs; no hardcoded paths.
TypeScript brace-expansion globs — {ts,tsx,js,jsx} covers all four extensions concisely.
Rust test-content-grep — #\\[cfg\\(test\\)\\] in its own sub-key, with the reference header documenting why it's separate from test-globs.
Go dependency-grep — clean pure regex; the two-alternative pattern correctly handles both top-level import statements and quoted module paths inside import ( ... ) blocks.
Recency gate and confidence gate — both now correctly handle the stable-project edge case and enforce HIGH-confidence-only acceptance.
Blindspot exemption — both the outcome gate and the Final step now have consistent carve-outs.
research-deep Tier 2 dispatch template — correctly uses /discovery:research (L56); this is the pattern the Tier 3 inline instruction at L71 should match.
Summary
Net change since first review: substantial improvement. Both prior HIGH correctness issues are fixed; five of seven LOW issues are resolved. Two findings remain for author decision before merge:
MEDIUM (should fix): explore-deep Step 2 needs an explicit Read of ecosystem-discovery.md since the fork can't follow the sibling skill's content — this degrades Dimensions 3–6 to generic file-scanning.
HIGH → author says intentional: Bare sibling skill names at explore/SKILL.md L21 and research-deep/SKILL.md L71 — the design is deliberate but carries real risk of misfired routing in installed contexts; document the convention if keeping it.
2 LOW: CLAUDE_CODE_FORK_SUBAGENT undocumented in README; explore-deep outcome gate references criteria the fork can't see.
| Branch: feat/publish-discovery
The reason will be displayed to describe this comment to others. Learn more.
Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not provide a clean automated review signal. Human review is needed; no reviewers were assigned because no suitable non-author maintainers were identified in this repository.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Understand how the pieces fit together before moving any of them.
- **Directory layout** — if the project documents its repository structure, verify the doc matches reality; otherwise map the tree yourself
- **Project references / imports** — map the dependency graph by grepping the ecosystem's import/reference token across its build-config files (per-ecosystem tokens: `${CLAUDE_PLUGIN_ROOT}/skills/explore/reference/ecosystem-discovery.md`)
The reason will be displayed to describe this comment to others. Learn more.
Search source files for import edges
When /discovery:explore deps follows this instruction in TypeScript/Python/Go/Rust/Java repos, it restricts the dependency grep to build-config files even though the configured dependency-grep patterns are source import/use syntax. That omits the actual source files where module edges live, so the dependency graph can falsely report no internal imports; the reference header already describes this grep as spanning source/project files, so this line should not narrow it to build configs.
The reason will be displayed to describe this comment to others. Learn more.
* Include pytest _test.py files
This Python test list only finds test_*.py plus direct children of a tests/ directory; when a pytest project uses pytest's other default filename form, *_test.py (for example src/foo_test.py or tests/unit/foo_test.py), /discovery:explore tests misses those files and can report false coverage gaps. Add a recursive **/*_test.py pattern or have the skill read the project's pytest discovery config before concluding tests are absent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
Publishes the
discoveryplugin per melodic-software/medley#1279 (EPIC melodic-software/medley#1273) anddocs/MIGRATION-PLAYBOOK.md.Contents
Four skills migrated from the medley repo and generalized to be repo-agnostic:
/discovery:explore— six-dimension local codebase exploration (+ blindspot mode), persistsEXPLORE.md/discovery:explore-deep— the same workflow in acontext: forkgeneral-purpose subagent (requiresCLAUDE_CODE_FORK_SUBAGENT=1; documented fallbacks)/discovery:research— 3-phase multi-source external research (broad → targeted+falsification → preferred sources) with source tiers, recency gate, and a binary outcome gate; persistsRESEARCH.md/discovery:research-deep— dispatcher routing deep research to workflow engine / forked subagent / inline, with a multi-topic fan-out checkDe-coupling notes (locked decisions applied)
.claude/rules/*cites replaced by an in-plugin canonical source-tier table (skills/research/context/discipline.md);.work/<slug>/artifact convention replaced by oneuserConfigknobnotes_dir(string, default.claude/notes) with consumer working-notes conventions taking precedence; medley's.NET-primary ecosystem tables replaced by a generic multi-ecosystem discovery reference + self-discovery guidance (llms.txt / sitemap probing); medley workflow-engine and agent-loop dependencies replaced by capability detection + graceful degradation./explore,/research); no refs to other plugins.disable-model-invocationstaysfalse.version: 0.1.0inplugin.jsononly; marketplace entrycategory: development, tagsdiscovery+ per-component.Gate evidence
claude plugin validate --strict ./plugins/discovery— PASS;claude plugin validate --strict .(catalog manifest) — PASS.claude plugin details— always-on ~500 tokens (explore ~110, explore-deep ~140, research ~130, research-deep ~120); on-invoke ~5.1k / ~1.2k / ~6.2k / ~2.1k.--plugin-dirsmoke test in a clean non-source scratch repo (headlessclaude -p): skill invoked asdiscovery:explore, body loaded (six dimensions + artifact name reported correctly), no permission prompts.git diff --checkclean. No shell scripts, hooks, or workflows added.Security review (playbook plugin-acceptance)
notes_dir, a project-relative path); no credentials, correctly NOTsensitive.${CLAUDE_PLUGIN_ROOT}; no../reach-outs; state written only inside the consumer's project at the configured notes dir.DONE criteria mapping (melodic-software/medley#1279)
Merge ⇒ marketplace entry present + README catalog row added; medley originals remain until the cutover issue.
Worker: melo-desk-001-6837229512
Note
Low Risk
Markdown-only plugin (no hooks, scripts, or MCP servers); research skills direct the agent to use the consumer's existing web tools and write notes under a configurable project path.
Overview
Adds the
discoveryplugin to the marketplace and root README catalog, shipping four repo-agnostic skills for pre-change discovery.Local exploration:
/discovery:exploreruns a six-dimension codebase workflow (code, git, structure, tests, config, environment), optional blindspot mode, routing to built-in Explore subagents vs inline vs/discovery:explore-deep(context: fork). Artifacts land asEXPLORE.mdunder configurablenotes_dir(default.claude/notes), with sidecar files when needed.ecosystem-discovery.mdreplaces repo-specific tables with multi-ecosystem globs/greps.External research:
/discovery:researchenforces a chained 3-phase discipline (broad → targeted + mandatory falsification → preferred sources), source tiers, recency, and a binary outcome gate;discipline.mdis the in-plugin SSOT.RESEARCH.mdis the handoff artifact./discovery:research-deepdispatches to workflow engine, forked subagent, or inline, with a multi-topic fan-out before single-blob deep runs.Medley-specific paths and rules are removed in favor of
${CLAUDE_PLUGIN_ROOT}references, consumerCLAUDE.md/rules, and capability detection with documented graceful degradation.Reviewed by Cursor Bugbot for commit 3617330. Bugbot is set up for automated code reviews on this repo. Configure here.