docs(plugin-quality): point restated upstream docs at live sections by kyle-sexton · Pull Request #7267 · melodic-software/claude-code-plugins

kyle-sexton · 2026-10-11T23:05:42Z

No related issue: part of the upstream-pointer sweep over the Claude Code docs.

Summary

Fixed the evals drift about Write/Edit grants needing a sandbox backend and converted audit checks, MCP limits and scopes, and plugin-evals specifics into anchored pointer records.

Fix

docs(plugin-quality): address review findings on upstream pointers
docs(plugin-quality): cite the section behind each monitor and settings scope claim
docs(plugin-quality): anchor and date internal record relays
docs(plugin-quality): point audit checks at anchored Claude Code sections
docs(mcp-tools): read client limits and MCP scopes at anchored pointers
docs(evals): point at live plugin-evals sections instead of restating them

Verification

Fresh-context phase-verifier passed at d35e4fc after 2 fix round(s).
Review findings (quality-gate pr mode) addressed in e1a7e03; not re-reviewed.
The changed-skills gate has not been run on this branch (earlier runs timed out under concurrent load): run it before ready.
Eval run owed before ready: "methodology (evals)", "audit-posture", "audit (plugin-quality)".
Not done: scripts/check-changed-skills.sh was not run, as the brief instructed; it runs later, one row at a time.
Not done: no new .changes fragment, because the existing .changes/plugin-quality fragment on the branch already covers this pointer work.

… them Fixes the drift that said Write or Edit grants need a sandbox backend; which grants run sandboxed is now read from the Grant tools section. Frontmatter bounds, grader targets, exit codes, JSON fields, the version floor and the platform evaluation sources become anchored pointer records. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

C17 and C18 grade against the ceiling and effective approval value read live from the MCP page, not a copied number; duplicates cite the one record. Posture prose points at the scope, precedence and managed-server sections instead of restating file locations and entry checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ions Hook exit codes, PostToolUse and matchers, placeholder resolution, plugin validate --json, monitors, mod calls, name precedence, forked and cloud skill loading, subagent model order and settings scopes become pointer records. The PostToolUse, placeholder and report-filename records live once in evidence-packet.md; the agent, skill and packet-seal.sh cite them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Give each internal relay added in this row a section anchor (or a no-heading note), an as-of date and its own recheck trigger, and point the evals sandbox relay at a record that covers the Linux backend. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…gs scope claim Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…gin-quality

chatgpt-codex-connector · 2026-10-12T03:14:54Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T03:18:46.935805Z	`ca6c5a1`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

claude · 2026-10-12T03:17:45Z

Claude finished @kyle-sexton's task in 1m 35s —— View job

Security review (`/review:security-review`)

Gather context (PR metadata, diff)
Apply skip gate
Review changed files for security-relevant surface
Check for instruction-surface deletions against protected classes
Post findings

Skip gate: triggered. This PR has no security-relevant surface. All 27 changed files are
documentation: 24 .md reference/skill files, one shell script (packet-seal.sh, comment-only
edit, no logic change — diff), and three new .changes/ fragments. The change converts restated
upstream specifics (exit codes, flag defaults, annotation values, sandbox-backend requirements,
hook exit-code semantics, settings-scope precedence) into dated, anchored pointer records per
this repo's own skill-bodies-state-current-rules convention. No application logic, auth/access
control, injection surface, or secret handling is touched.

Instruction-surface deletion check. Several hunks remove explicit restated detail from
standing guardrail text in plugins/plugin-quality/agents/auditor.md (e.g. "never silently drop
the packet write," the write-once-evidence packet guardrail, the untrusted-content posture) and
audit checklists (hook.md exit-code semantics, recurring-concerns.md settings-scope
resolution). In each case the directive/guardrail itself is preserved verbatim; only the citation
of a volatile upstream specific is replaced with a live pointer + as-of date + recheck trigger —
this is the pattern the register's own consumer table (docs/conventions/instruction-exception-register/README.md,
read this session) expects review:security-review to check for, and none of these edits
narrows what the guardrail forbids or removes a Gate 0 class (irreversible-action,
secret-handling, data-integrity, external-publication, legal-compliance,
agent-authority). No finding.

No security issues found.

claude · 2026-10-12T03:18:29Z

Claude finished @kyle-sexton's task in 4m 47s —— View job

Code review complete

Gather context (PR diff, CLAUDE.md/AGENTS.md, REVIEW.md, standards)
Run skip-gate checks (open, not draft, non-trivial change — proceeding)
Review changed files for correctness/maintainability per /review:code-review criteria
Adversarially verify candidate findings (dispatched review:lane-verifier)
Post inline comments for anchored findings
Post final summary

Summary

This PR converts restated upstream-doc specifics across the evals, mcp-tools, and
plugin-quality plugins into anchored pointer records (link + as-of date + recheck trigger), per
.claude/rules/skill-bodies-state-current-rules.md.
I checked every converted record's pointer anchors against the actual headings in the target
files (all internal cross-file anchors resolve correctly — no dangling #anchor links), checked
the .changes/ fragments match the three touched plugins, and reviewed the diff for correctness
per REVIEW.md (this lane owns non-security findings; no security-relevant changes here, this is all documentation).

One finding posted inline (verified independently by a review:lane-verifier subagent, which was
not the producer of the finding):

plugins/mcp-tools/skills/audit-posture/SKILL.md:89 — the provided_by paragraph still
restates the volatile upstream claude mcp remove removal behavior ("which the user cannot
remove") immediately beside its own new Pointer/As-of/Recheck block, which is exactly the
anti-pattern this PR is otherwise fixing elsewhere (the project rule: "a record never cures a
restatement"). A sibling conversion a few lines later in the same file (the stdio
sandboxed = no Gotcha) got the correct treatment — the restated reason was dropped and only
the pointer kept — so this one spot wasn't brought in line with the rest of the PR's own pattern.

No other correctness issues found. The rest of the pointer conversions (evals grader targets and
frontmatter bounds, mcp-tools audit-posture/audit checklists, plugin-quality auditor/evidence-packet
records) consistently drop the restated upstream specific and keep only the pointer, matching the
project's convention.

Note: per the PR body, the changed-skills gate and the three named eval runs have not been run on
this branch yet — those are the author's own stated verification gaps, not something I re-ran or
can independently confirm here.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ca6c5a1223

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

github-actions · 2026-10-12T03:19:45Z

claude-security-review has reviewed this pull request through 787797a; a later push is reviewed from there.

github-actions · 2026-10-12T03:23:41Z

claude-review has reviewed this pull request through 787797a; a later push is reviewed from there.

…tings pointer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude · 2026-10-12T03:46:30Z

Claude finished @kyle-sexton's task in 34s —— View job

Security review (`/review:security-review`) — incremental

Gather context (PR metadata, incremental diff)
Apply skip gate
Review changed lines for security-relevant surface
Check for instruction-surface deletions against protected classes
Post findings

Scope. This lane last reviewed ca6c5a1223d88967af122c6750d2f634ec7b98ec. Only one file changed
since then: plugins/mcp-tools/skills/audit-posture/SKILL.md, per .claude-lane/incremental.diff.
All other files in the PR are unchanged since that commit and were covered by the prior review.

The change. This is exactly the fix for the finding this lane posted on the prior commit: it
drops the restated upstream fact ("which the user cannot remove") that duplicated the adjacent
Pointer/As-of/Recheck block, and generalizes the Recheck trigger from a specific current-state
description ("claude mcp remove starts removing an organization-provided server") to a
broader one ("changes how organization-provided servers are attributed or removed, or is
renamed") — current text.

Skip gate: triggered. No security-relevant surface. The edit is documentation wording only —
removing a restated fact and broadening a recheck trigger — and does not touch application logic,
auth/access control, injection surface, or secret handling.

Instruction-surface deletion check. The only candidate guardrail text in this hunk is "no
P1-P5 criterion reads it," which is unchanged and preserved verbatim. The Recheck trigger wording
changed, but the new version fires on a strictly wider set of conditions (attribution change,
removal-behavior change, or section rename) than the old version (removal-behavior change only),
so this is a strengthening, not a narrowing or softening of the guardrail. No protected-class match
(docs/conventions/instruction-exception-register/README.md consulted this session).

No security issues found.

claude · 2026-10-12T03:46:33Z

Claude finished @kyle-sexton's task in 52s —— View job

Code review complete

Gather context (incremental diff, PR metadata)
Read .claude-lane/incremental.diff scoped to plugins/mcp-tools/skills/audit-posture/SKILL.md
Run /review:code-review procedure on the incremental change
Post inline findings (none needed)
Post final summary

Summary

Incremental review scoped to the only change since ca6c5a1223 (the commit this lane last
reviewed): plugins/mcp-tools/skills/audit-posture/SKILL.md.

This commit (787797a) directly fixes the finding this lane posted on the prior revision
(ca6c5a1): the provided_by paragraph restated the volatile upstream claude mcp remove
removal behavior ("which the user cannot remove") right beside its own Pointer/As-of/Recheck
block, and the Recheck trigger itself baked in the current removal fact instead of only
describing what would invalidate the pointer.

The fix:

Drops "which the user cannot remove" from the provided_by sentence, leaving only the topic
name — matching the sibling stdio sandboxed = no conversion a few lines later that was
already correct.
Rewrites the Recheck trigger from a stated current fact (claude mcp remove starts removing an
organization-provided server) to a condition-based trigger ("that section changes how
organization-provided servers are attributed or removed, or is renamed") consistent with the
other two Recheck triggers in this same file (lines 184, 197).

No restated upstream specific remains in this hunk, and no new issues were introduced. No other
file changed since ca6c5a1223 per this lane's scope, confirmed via
git diff ca6c5a1223...787797a2 -- plugins/mcp-tools/skills/audit-posture/SKILL.md, which matches
.claude-lane/incremental.diff exactly.

No findings.

kyle-sexton and others added 7 commits October 11, 2026 11:26

docs(plugin-quality): cite the section behind each monitor and settin…

d35e4fc

…gs scope claim Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs(plugin-quality): address review findings on upstream pointers

e1a7e03

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/main' into upstream-pointers-plu…

ca6c5a1

…gin-quality

kyle-sexton marked this pull request as ready for review October 12, 2026 03:14

chatgpt-codex-connector Bot reviewed Oct 12, 2026

View reviewed changes

Comment thread plugins/evals/skills/methodology/SKILL.md

Comment thread plugins/evals/skills/plugin-eval/reference/case-authoring.md

claude Bot reviewed Oct 12, 2026

View reviewed changes

Comment thread plugins/mcp-tools/skills/audit-posture/SKILL.md Outdated

fix(mcp-tools): drop the restated removal rule beside its managed-set…

787797a

…tings pointer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kyle-sexton mentioned this pull request Oct 12, 2026

Run the eval suites deferred by the upstream-pointer sweep PRs #7296

Open

26 tasks

kyle-sexton added this pull request to the merge queue Oct 12, 2026

Merged via the queue into main with commit 4c36044 Oct 12, 2026
34 of 36 checks passed

kyle-sexton deleted the upstream-pointers-plugin-quality branch October 12, 2026 04:16

Navigation Menu

Repository navigation

docs(plugin-quality): point restated upstream docs at live sections - #7267

docs(plugin-quality): point restated upstream docs at live sections#7267
kyle-sexton merged 8 commits into
mainfrom
upstream-pointers-plugin-quality

kyle-sexton commented Oct 11, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

kyle-sexton commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Fix

Verification

Related

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

claude Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security review (/review:security-review)

Uh oh!

claude Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code review complete

Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security review (/review:security-review) — incremental

Uh oh!

claude Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code review complete

Summary

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

kyle-sexton commented Oct 11, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 12, 2026 •

edited

Loading

claude Bot commented Oct 12, 2026 •

edited

Loading

Security review (`/review:security-review`)

claude Bot commented Oct 12, 2026 •

edited

Loading

github-actions Bot commented Oct 12, 2026 •

edited

Loading

github-actions Bot commented Oct 12, 2026 •

edited

Loading

claude Bot commented Oct 12, 2026 •

edited

Loading

Security review (`/review:security-review`) — incremental

claude Bot commented Oct 12, 2026 •

edited

Loading