docs: replace restated upstream facts with pointers in harness-config (part 2 of 2), autonomy #12688

Refs: #7292

Outcome

28 passages in 12 files state a fact an external source owns. Rewrite each as a pointer to the live upstream section, or remove it, so the next upstream change cannot leave a stale copy here. Plugins: harness-config, autonomy.

Done when

• Every row below is fixed: the restated value is deleted, the local decision stays in this repository's own words, and the pointer goes to the exact upstream section with an as-of date and a recheck trigger, per .claude/rules/skill-bodies-state-current-rules.md. A record beside a restated value does not fix it. A row marked Remove has no local dependency on the fact.
• The PR passes check-stamps.sh --trigger-less (plugins/attribution/skills/audit/scripts/check-stamps.sh) on the files it touches.
• Each touched plugin has a changelog fragment.

Rows

harness-config

• plugins/harness-config/skills/audit-permission-state/reference/gotchas.md:34-40 (r230). Pointer: https://code.claude.com/docs/en/settings#where-claude-code-keeps-the-local-file-in-a-git-repository Drop the worktree-resolution and SDK helper behavior statements; keep the decision that the reader resolves the file location, names which condition applied, and does not guess, with a pointer. Same text also at: plugins/harness-config/skills/audit-permission-state/reference/criteria.md:41, plugins/harness-config/skills/audit-permission-state/SKILL.md:349-353; a row of its own covers it only if listed.
• plugins/harness-config/skills/audit-permission-state/reference/gotchas.md:44-47 (r231). Pointer: https://code.claude.com/docs/en/settings#where-claude-code-keeps-the-local-file-in-a-git-repository Drop how the two copies combine; keep that the reader reports both copies so live rules are not under-reported, with a pointer to the section. Same text also at: plugins/harness-config/skills/audit-permission-state/reference/criteria.md:42-47; a row of its own covers it only if listed.
• plugins/harness-config/skills/audit-permission-state/reference/gotchas.md:48-51 (r232). Pointer: https://code.claude.com/docs/en/settings#settings-in-cloud-sessions Drop what a cloud session reads and what arrives; keep the decision to emit and carry the container note instead of presenting the file as the operator's, with a pointer. Same text also at: plugins/harness-config/skills/audit-permission-state/reference/criteria.md:73-88; a row of its own covers it only if listed.
• plugins/harness-config/skills/audit-prompting-postures/SKILL.md:82-90 (r233). Pointer: https://code.claude.com/docs/en/memory#choose-which-instruction-files-load Drop the claude-md-and-agents-md loading behavior and displacement explanation; keep that the audit's instruction set follows the recorded mode and the body does not restate it, with a pointer.
• plugins/harness-config/skills/audit/context/procedures.md:11-16 (r235). Pointer: https://code.claude.com/docs/en/permissions#read-and-edit Drop the claim about which file commands Read denies cover; keep the decision that the audit emits counts never values and warns the cat|jq recipes may be blocked, with a pointer.
• plugins/harness-config/skills/audit/context/procedures.md:21-24 (r236). Pointer: https://code.claude.com/docs/en/sandboxing#how-sandboxing-relates-to-permissions-and-permission-modes Drop the statement that a Read deny merges into the sandbox boundary and blocks child processes; keep that counts are not guaranteed under sandbox, with a pointer.
• plugins/harness-config/skills/audit/context/procedures.md:65-71 (r237). Pointer: https://code.claude.com/docs/en/permission-modes#what-the-classifier-blocks-by-default Drop the classifier category names and which operations auto mode refuses; keep the fallback that the operator applies the edit or re-run and pastes output, never retrying around a refusal.
• plugins/harness-config/skills/audit/context/procedures.md:79-82 (r238). Pointer: https://code.claude.com/docs/en/settings-reference#strictpluginonlycustomization Drop the list of settings that switch hooks off; keep that installed and enabled is not enough and the check reads the Category D pointer, adding this section as the pointer. Same text also at: plugins/harness-config/skills/audit/context/validation-categories.md:129-138; a row of its own covers it only if listed.
• plugins/harness-config/skills/audit/context/procedures.md:89-94 (r239). Pointer: https://code.claude.com/docs/en/permissions#precedence-among-rules-hooks-and-mods Drop the evaluation claims about deny/ask rules versus PreToolUse hooks and exit 2; keep the check on whether an addition suppresses a project gate, with a pointer.
• plugins/harness-config/skills/audit/context/validation-categories.md:113-114 (r240). Pointer: https://code.claude.com/docs/en/hooks#timeouts Drop the unit and no-maximum statements about timeout; keep the decision to flag recognizably millisecond-scale figures, with a pointer to the section.
• plugins/harness-config/skills/audit/context/validation-categories.md:291-293 (r241). Pointer: https://code.claude.com/docs/en/settings-reference#skilllistingbudgetfraction Drop the budget fraction, override and per-entry cap mechanics; keep the pointers to the playbooks authoring limit and the skill-quality check, adding this section for the settings.
• plugins/harness-config/skills/audit/context/validation-categories.md:306-313 (r242). Pointer: https://code.claude.com/docs/en/skills#skill-descriptions-are-cut-short Drop what /doctor and /context report and the TTY requirement; keep the decision to prompt the user or use the debug-log route when headless, with the existing pointer.
• plugins/harness-config/skills/audit/context/validation-categories.md:348-353 (r243). Pointer: https://code.claude.com/docs/en/settings#compare-the-scope-of-each-settings-file Drop the scope description of the home-directory local file and the /skills save behavior; keep the info-level finding and its advice, with a pointer to the scope table.
• plugins/harness-config/skills/audit/context/validation-categories.md:403-408 (r244). Pointer: https://code.claude.com/docs/en/settings-reference (confirm the section) Drop the schema's enum typing and the startup-versus-first-prompt discrepancy; keep the decision to cite the docs page for behavior, not the schema, pointing at the page.
• plugins/harness-config/skills/audit/reference/audit-checklist.md:51 (r245). Pointer: Claude Code ignores deny rules in .claude/settings.local.json - security vulnerability anthropics/claude-code#8961 Drop the description that deny rules in local are silently ignored; keep the checklist rule to put deny rules in settings.json, pointing at the issue. Same text also at: plugins/harness-config/skills/audit/context/validation-categories.md:67, plugins/harness-config/skills/audit/context/procedures.md:42, plugins/harness-config/skills/audit/context/procedures.md:96; a row of its own covers it only if listed.
• plugins/harness-config/skills/audit/reference/native-update-config.md:25-27 (r246). Pointer: https://code.claude.com/docs/en/settings-reference#disablebundledskills Drop the list of settings that remove or hide bundled skills; keep the decision that routing reads 'when the surface resolves in this session', and point at the section.
• plugins/harness-config/skills/draft-auto-mode-rules/SKILL.md:49-51 (r247). Pointer: https://code.claude.com/docs/en/auto-mode-config#generate-environment-entries-with-auto-mode-setup Drop the description of what the built-in command drafts, saves and who runs it; keep the contrast with this skill's interview and the pointer.
• plugins/harness-config/skills/draft-auto-mode-rules/SKILL.md:57-59,69-71 (r248). Pointer: https://code.claude.com/docs/en/commands#all-commands Drop the gate-basis description (hidden, plan, version, platform); keep 'offer it when it resolves in this session, never assume it', and point at the section.
• plugins/harness-config/skills/draft-auto-mode-rules/SKILL.md:171-172 (r250). Pointer: https://code.claude.com/docs/en/cli-reference#cli-commands Drop the statement of what reset strips from settings; keep the rule that the skill never runs it and the chezmoi-managed-home reason, and point at the section.
• plugins/harness-config/skills/unhobble/SKILL.md:187-190,197-202 (r251). Pointer: https://code.claude.com/docs/en/plugins/manifest-reference#standard-layout Drop the enumerated component types; keep the decision that a plugin with no hook wiring is inventoried by every component type and non-derivable capabilities classify it, pointing at the layout section.
• plugins/harness-config/skills/unhobble/SKILL.md:246-254 (r252). Pointer: https://code.claude.com/docs/en/memory#when-claude-code-reads-agentsmd Drop the claim about when a session reads AGENTS.md and the shim behavior; keep the decision that both AGENTS.md names are strip candidates, and point at the section.

autonomy

• plugins/autonomy/README.md:143-151 (r013). Pointer: https://code.claude.com/docs/en/goal#how-evaluation-works Drop the description of how the /goal evaluator runs and what a command hook cannot trigger; keep the sentinel or marker signal and the use-/goal-versus-gate choice, with the existing pointers.
• plugins/autonomy/README.md:176-178 (r014). Pointer: https://code.claude.com/docs/en/settings-reference#pluginconfigs Drop the inline pluginConfigs JSON shape; keep the instruction to run the arm helper and pass its id through --settings, and point at the section.
• plugins/autonomy/README.md:191-195 (r015). Pointer: https://code.claude.com/docs/en/plugins/manifest-reference#reference-a-saved-value Drop the description of how an option value reaches the hook as an env variable; keep that a --settings-only enable is not honored and the gate's visible notice.
• plugins/autonomy/reference/prerequisite-resolution.md:73-78 (r019). Pointer: https://code.claude.com/docs/en/mcp#project-server-approvals-and-workspace-trust Drop the three enablement setting names and the settings-gated claim; keep that presence and enablement are reported separately, owned by the config-audit surface, and point at the section.
• plugins/autonomy/skills/setup/SKILL.md:116-125 (r021). Pointer: https://code.claude.com/docs/en/monitoring-usage#common-configuration-variables Drop the telemetry-enable and exporter variable names; keep the autonomy.work_item.url resource attribute decision, optional spans and the join, and point at the section.
• plugins/autonomy/skills/setup/templates/ci-otlp-artifact.md:59-61 (r025). Pointer: https://code.claude.com/docs/en/monitoring-usage#configuration-details Drop the claim about how the agent CLI exports OTLP; keep the decision to run a per-job collector writing JSON-lines, and point at the section.
• plugins/autonomy/skills/setup/templates/ci-otlp-artifact.md:91-99 (r026). Pointer: https://code.claude.com/docs/en/monitoring-usage#quick-start Drop the telemetry variable list and keep only the local autonomy.work_item.url attribute and the export-so-the-child-inherits instruction; point at the quick start for the variables.

Notes

Lines are as of 3bd42cabfe (https://github.com/melodic-software/claude-code-plugins/blob/3bd42cabfe6bdef37a05778d396869af0381bb51); locate each passage by its text if main has moved. Each rNNN is that row's number in the order of #7292's "Findings by plugin". Every row was upheld by three blind judges and survived a refutation pass, run report-only for #12072. Pointers are candidates: fetch each before writing it, and confirm the section still documents the fact.

Parent: #7292