Two of the 21 are already filed and are noted below as independent confirmation rather than repeated. The other 19 follow.
-
carried-instruction-file-guard/SKILL.md: the guard's file list omits .github/copilot-instructions.md. The guard names four files, while comment-and-doc-style/SKILL.md and references/carried-doc-references.md both classify the Copilot instructions as carried instruction content. A resync can therefore overwrite that file without running the probe, which is the exact failure the guard exists to prevent, and that file additionally carries a "Disproved Claims" ledger whose entries are per-repo. copilot-instructions-keeper covers the ledger but is a separate skill a resync is not required to load.
-
carried-instruction-file-guard/SKILL.md: the probe does not require a freshly fetched hub checkout. The exact-phrase probe is only sound against current canonical content. A stale checkout makes a local addition look absent from the canonical, which is the one reading that authorizes deleting it. Every other procedure doc already states the fetch-immediately-before-reading rule, so this is the one place it is load-bearing and missing.
-
resync-a-repo/SKILL.md step 3 routes intent-fidelity files through a verbatim re-vendor. "Verbatim re-vendors for CLAUDE.md and everything else the probe in step 1 cleared" reads as authorizing a full-file replace of AGENTS.md, GOVERNANCE.md, CODESTYLE.md and WORKFLOW.md once the probe has run, but the probe's own contract is that a local addition gets a destination first and the file is then merged rather than replaced. Naming only the declared verbatim files here, or stating the preservation merge explicitly, would close it.
-
drive-pr/SKILL.md and merge-and-release/SKILL.md: branch deletion is unconditional. Both capture and verify the branch tip, then run git push origin --delete with no expected object id, so a push landing between the two steps deletes unmerged work. A ref-scoped --force-with-lease keyed to the captured SHA closes the window.
-
git-commit-conventions/references/history-rewrite.md: the rewrite scope omits the descendant closure. Rewriting an ancestor changes every descendant's parent field, which invalidates each descendant's signature. The doc scopes re-identification to the rewritten commits themselves, so a recreated descendant can be pushed unsigned or signed by a key that does not match its committer.
-
git-commit-conventions/SKILL.md: the signing probe runs in a temporary repository. A temporary repo does not see the target's local config, so a commit.gpgsign=false or a user.email override in the target passes the probe and then produces an unsigned or wrongly-identified commit. The probe needs the target's effective configuration.
-
pr-review-conduct/SKILL.md: comment-only findings have no stated disposition path. The skill records that issue-level, CodeRabbit outside-diff, and Qodo comment-only findings open no resolvable thread, then requires every finding to be answered "in the thread". Following it literally leaves those findings untriaged. scripts/pr_review.py comment is what actually works, and naming it would close the gap. Hit directly on this pull request, where three Qodo review-body findings had to be answered in the conversation.
-
merge-and-release/SKILL.md: the run-correlation phase has no stop condition. It requires a bounded interval for the gh run list correlation but names no duration or poll count, so a run that never appears has no defined exit before the later long watch.
-
upstream-contribution-workflow/SKILL.md: the force-push names no remote or refspec. git push --force-with-lease alone targets whatever the current branch and push configuration resolve to, which does not enforce the one-branch boundary the surrounding text states.
-
python-codestyle/SKILL.md: the local hook's requirement level is stated two ways. It is described as strongly suggested and as not optional in the same guide, so a reader cannot tell whether a missing hook is a defect or a recommendation.
-
dotnet-codestyle/references/conventions.md: the library example awaits without ConfigureAwait(false). The example lives under Example.Project.Library and SKILL.md states the library rule, so the example teaches against the rule beside it.
-
AUDIT.md section 6: a multi-line Bash example opens without strict mode. GOVERNANCE.md "Workflow YAML Conventions" requires every multi-line Bash surface to open set -Eeuo pipefail, and this example starts at dependabot_content=..., so a failed gh api inside it continues rather than stopping and the audit reports an incomplete result as a clean one.
-
catalog/snippets/workflows/merge-bot-pull-request.yml: the caller stub's opening comment describes other repositories. The line reads:
# Thin caller: the merge-bot is the hub's reusable merge-bot-task.yml, which every fleet repo reaches rather than carries.
The clause "which every fleet repo reaches rather than carries" states a fact about the rest of the fleet, which a reader of any one repository has no use for, where the thing they do need is that this repository reaches the task by pin instead of carrying a copy. It is adjacent to the "sibling fleet repo named as an illustrative example" ban in comment-and-doc-style, without being literally that, since it names the class rather than a repository.
Raised against .github/workflows/merge-bot-pull-request.yml in the downstream repository, where the line is byte-identical to this snippet. It is filed here rather than reworded locally because both repositories that have adopted the task carry it verbatim, so a local edit would make one repository the only one phrased differently and the next re-vendor from this snippet would revert it:
PhotoCleaner carries the same line: 1
ESPHome-Config carries the same line: 1
Lowest-stakes item in this list, since it is a comment with no behavioral effect. Suggested wording: "a reusable task this repository reaches by pin rather than carrying".
-
operational-vs-release-workflow/references/branch-protection-and-promotion.md: the promotion recipe stops before the merge is completed. The EOL-conflict procedure ends at git checkout --theirs <file> and then says to open the branch into main. It never stages the resolved paths or creates the merge commit, so following it literally leaves the index conflicted and the branch with no merge to open. Hit while executing it: the git add for each resolved path, the git rm for the two modify/delete paths, and the git commit all had to be supplied. Worth stating the git rm case explicitly too, since a hub-only retirement makes modify/delete the normal shape here rather than an edge case.
-
git-commit-conventions/SKILL.md: the PowerShell equivalent uses &&. That is the pipeline chain operator, which needs PowerShell 7 or later and is a parse error in Windows PowerShell 5.1. GOVERNANCE.md "Supported Development Platforms" makes Windows a first-class target, and the fleet's own VS Code task guidance already avoids && chaining for the same 5.1 reason, so either declare the 7-or-later prerequisite or use explicit exit-code checks.
-
drive-pr/SKILL.md: the how-far answer is treated as merge authorization. The skill asks once whether the target is develop or a mergeable main promotion, then step 4 performs the feature-to-develop squash merge. Choosing a target says where the work is going, not that it may be merged now, and every other irreversible step in the fleet takes its own explicit go-ahead. Worth requiring a confirmation that names the merge itself.
-
repo-worktree/SKILL.md: GH_WRITE_GUARD_ALLOW_PRIMARY_CHECKOUT is not scoped to the approved path. The variable reads as a blanket allow for primary-checkout mutation rather than an allow for the one standalone-clone fallback it is described as enabling, so the guard stops covering the base checkout it exists to protect. Validating the approved path in the hook would keep the escape hatch narrow.
-
GOVERNANCE.md "Workflow YAML Conventions": the boolean-input contract is stated for the wrong context. A workflow_dispatch boolean stays a real boolean in the inputs context, and only github.event.inputs stringifies it, so the guidance to compare against 'true' is correct for one context and wrong for the other. Stating both, and which to prefer, would stop a caller writing a string comparison against a real boolean.
-
AUDIT.md: two prose-gate misses in carried text. Section 2 uses the British afterwards where the fleet convention is US English, and section 6 uses the compound all-drifts, which reads as a coined term rather than the "a pull request addressing all drift classes" it means.
All 21 were declined in their pull requests with the "Reviewing Carried Fleet Content" rule quoted. For the carried items the carry digest is the evidence that the content is unmodified:
sourceDigest: c5475deb46bfbf1f9253bc6128a40b7686687597ebe38a6cd1c580a39817f03e
targetDigest: c5475deb46bfbf1f9253bc6128a40b7686687597ebe38a6cd1c580a39817f03e
modified: [] extra: [] missing: []
Symptom
CodeRabbit, Copilot and Qodo reviews on ptr727/Utilities#451 (a hub resync carrying the current
.github/skills/tree andAUDIT.mdviascripts/carry.py, hub commita378121, version2.0.525) and on its promotion ptr727/Utilities#453 raised 21 findings against hub-owned content the downstream repository cannot fix locally. Twenty are carried content, where a local edit would break the carry digest. The remaining one, item 13 below, is a catalog snippet, where a local edit would instead leave one repository phrased differently from every other adopter. Filing per RESYNC.md section 2, in the same shape as #1089 and #1092.Two of the 21 are already filed and are noted below as independent confirmation rather than repeated. The other 19 follow.
Audit run stamp for the resync that surfaced these:
audit run 2026-08-30T03:27:29Z | hub a378121.Already filed, confirmed a second time
shell-codestyle/SKILL.md:set -Eeuo pipefailmandated forshshebangs, where-Eis not POSIX andpipefailis absent from manyshimplementations. This is 5 carried-skill defects surfaced by a downstream PR review (shell-codestyle, repo-worktree, standup-a-repo, merge-and-release) #1089 finding 1, raised again independently against a different downstream repo.standup-a-repo/SKILL.md:configure.sh checkexits non-zero for both drift and a read failure, so "apply only after check reports drift" cannot be followed from the exit code. This is 5 carried-skill defects surfaced by a downstream PR review (shell-codestyle, repo-worktree, standup-a-repo, merge-and-release) #1089 finding 3.New findings
carried-instruction-file-guard/SKILL.md: the guard's file list omits.github/copilot-instructions.md. The guard names four files, whilecomment-and-doc-style/SKILL.mdandreferences/carried-doc-references.mdboth classify the Copilot instructions as carried instruction content. A resync can therefore overwrite that file without running the probe, which is the exact failure the guard exists to prevent, and that file additionally carries a "Disproved Claims" ledger whose entries are per-repo.copilot-instructions-keepercovers the ledger but is a separate skill a resync is not required to load.carried-instruction-file-guard/SKILL.md: the probe does not require a freshly fetched hub checkout. The exact-phrase probe is only sound against current canonical content. A stale checkout makes a local addition look absent from the canonical, which is the one reading that authorizes deleting it. Every other procedure doc already states the fetch-immediately-before-reading rule, so this is the one place it is load-bearing and missing.resync-a-repo/SKILL.mdstep 3 routes intent-fidelity files through a verbatim re-vendor. "Verbatim re-vendors forCLAUDE.mdand everything else the probe in step 1 cleared" reads as authorizing a full-file replace ofAGENTS.md,GOVERNANCE.md,CODESTYLE.mdandWORKFLOW.mdonce the probe has run, but the probe's own contract is that a local addition gets a destination first and the file is then merged rather than replaced. Naming only the declared verbatim files here, or stating the preservation merge explicitly, would close it.drive-pr/SKILL.mdandmerge-and-release/SKILL.md: branch deletion is unconditional. Both capture and verify the branch tip, then rungit push origin --deletewith no expected object id, so a push landing between the two steps deletes unmerged work. A ref-scoped--force-with-leasekeyed to the captured SHA closes the window.git-commit-conventions/references/history-rewrite.md: the rewrite scope omits the descendant closure. Rewriting an ancestor changes every descendant's parent field, which invalidates each descendant's signature. The doc scopes re-identification to the rewritten commits themselves, so a recreated descendant can be pushed unsigned or signed by a key that does not match its committer.git-commit-conventions/SKILL.md: the signing probe runs in a temporary repository. A temporary repo does not see the target's local config, so acommit.gpgsign=falseor auser.emailoverride in the target passes the probe and then produces an unsigned or wrongly-identified commit. The probe needs the target's effective configuration.pr-review-conduct/SKILL.md: comment-only findings have no stated disposition path. The skill records that issue-level, CodeRabbit outside-diff, and Qodo comment-only findings open no resolvable thread, then requires every finding to be answered "in the thread". Following it literally leaves those findings untriaged.scripts/pr_review.py commentis what actually works, and naming it would close the gap. Hit directly on this pull request, where three Qodo review-body findings had to be answered in the conversation.merge-and-release/SKILL.md: the run-correlation phase has no stop condition. It requires a bounded interval for thegh run listcorrelation but names no duration or poll count, so a run that never appears has no defined exit before the later long watch.upstream-contribution-workflow/SKILL.md: the force-push names no remote or refspec.git push --force-with-leasealone targets whatever the current branch and push configuration resolve to, which does not enforce the one-branch boundary the surrounding text states.python-codestyle/SKILL.md: the local hook's requirement level is stated two ways. It is described as strongly suggested and as not optional in the same guide, so a reader cannot tell whether a missing hook is a defect or a recommendation.dotnet-codestyle/references/conventions.md: the library example awaits withoutConfigureAwait(false). The example lives underExample.Project.LibraryandSKILL.mdstates the library rule, so the example teaches against the rule beside it.AUDIT.mdsection 6: a multi-line Bash example opens without strict mode.GOVERNANCE.md"Workflow YAML Conventions" requires every multi-line Bash surface to openset -Eeuo pipefail, and this example starts atdependabot_content=..., so a failedgh apiinside it continues rather than stopping and the audit reports an incomplete result as a clean one.catalog/snippets/workflows/merge-bot-pull-request.yml: the caller stub's opening comment describes other repositories. The line reads:# Thin caller: the merge-bot is the hub's reusable merge-bot-task.yml, which every fleet repo reaches rather than carries.The clause "which every fleet repo reaches rather than carries" states a fact about the rest of the fleet, which a reader of any one repository has no use for, where the thing they do need is that this repository reaches the task by pin instead of carrying a copy. It is adjacent to the "sibling fleet repo named as an illustrative example" ban in
comment-and-doc-style, without being literally that, since it names the class rather than a repository.Raised against
.github/workflows/merge-bot-pull-request.ymlin the downstream repository, where the line is byte-identical to this snippet. It is filed here rather than reworded locally because both repositories that have adopted the task carry it verbatim, so a local edit would make one repository the only one phrased differently and the next re-vendor from this snippet would revert it:Lowest-stakes item in this list, since it is a comment with no behavioral effect. Suggested wording: "a reusable task this repository reaches by pin rather than carrying".
operational-vs-release-workflow/references/branch-protection-and-promotion.md: the promotion recipe stops before the merge is completed. The EOL-conflict procedure ends atgit checkout --theirs <file>and then says to open the branch intomain. It never stages the resolved paths or creates the merge commit, so following it literally leaves the index conflicted and the branch with no merge to open. Hit while executing it: thegit addfor each resolved path, thegit rmfor the two modify/delete paths, and thegit commitall had to be supplied. Worth stating thegit rmcase explicitly too, since ahub-onlyretirement makes modify/delete the normal shape here rather than an edge case.git-commit-conventions/SKILL.md: the PowerShell equivalent uses&&. That is the pipeline chain operator, which needs PowerShell 7 or later and is a parse error in Windows PowerShell 5.1.GOVERNANCE.md"Supported Development Platforms" makes Windows a first-class target, and the fleet's own VS Code task guidance already avoids&&chaining for the same 5.1 reason, so either declare the 7-or-later prerequisite or use explicit exit-code checks.drive-pr/SKILL.md: the how-far answer is treated as merge authorization. The skill asks once whether the target isdevelopor a mergeablemainpromotion, then step 4 performs the feature-to-develop squash merge. Choosing a target says where the work is going, not that it may be merged now, and every other irreversible step in the fleet takes its own explicit go-ahead. Worth requiring a confirmation that names the merge itself.repo-worktree/SKILL.md:GH_WRITE_GUARD_ALLOW_PRIMARY_CHECKOUTis not scoped to the approved path. The variable reads as a blanket allow for primary-checkout mutation rather than an allow for the one standalone-clone fallback it is described as enabling, so the guard stops covering the base checkout it exists to protect. Validating the approved path in the hook would keep the escape hatch narrow.GOVERNANCE.md"Workflow YAML Conventions": the boolean-input contract is stated for the wrong context. Aworkflow_dispatchboolean stays a real boolean in theinputscontext, and onlygithub.event.inputsstringifies it, so the guidance to compare against'true'is correct for one context and wrong for the other. Stating both, and which to prefer, would stop a caller writing a string comparison against a real boolean.AUDIT.md: two prose-gate misses in carried text. Section 2 uses the Britishafterwardswhere the fleet convention is US English, and section 6 uses the compoundall-drifts, which reads as a coined term rather than the "a pull request addressing all drift classes" it means.Downstream disposition
All 21 were declined in their pull requests with the "Reviewing Carried Fleet Content" rule quoted. For the carried items the carry digest is the evidence that the content is unmodified: