[kyle-sexton]

Closes #12692

Summary

Replaces #12719, the work-resolve-issue lane's pull request for #12692, with its commits merged onto current main. pr-unblock address-feedback ran three rounds on #12719 and left the five pr-verify threads unresolved; its last run ended red, and the merge gate refuses a verify:fail verdict, so the lane could not finish. This pull request settles each thread.

Fix

• plugins/planning/skills/design/SKILL.md:392-394 (threads on design/SKILL.md and audit-dead-code/SKILL.md): fixed. The stamp now opens its own line as as of 2026-10-11; recheck when that section changes the per-call question limit. Before this change check-stamps.sh --trigger-less already passed on it, because the trigger check reads the whole file (plugins/attribution/skills/audit/scripts/check-stamps.sh:451-464), but stamp and trigger now share a line as the issue asked. The gopls note in the same thread is not changed: the exit-code rule at audit-dead-code/SKILL.md:142-145 still covers gopls, and its command-line page documents no exit codes.
• plugins/code-tidying/skills/audit-dead-code/context/adjudication.md:32-33 and plugins/planning/skills/draft-goal-condition/SKILL.md:130-131: fixed. as of and the date were on different lines, so the stamp checker never saw either date as a stamp. The candidate count on the touched files rose from 47 to 49 after the join, which shows both are now parsed.
• plugins/planning/skills/plan/SKILL.md:320: not changed. The removed clause ("not gated behind a setting, though a host may lack it") restated upstream gating behavior on line 320, which row r357 names. The routing sentence keeps its If /plan is available in your session (gate basis: ...) shape; the native-overlap self-check passes (74 rows checked, no broken rows).
• plugins/repo-fleet-hygiene/skills/audit/SKILL.md:342-344 (r406): not changed. The page the issue named, github.com/git-for-windows/git/wiki/Symbolic-Links, now reads only "This wiki page has been migrated to a new location: https://gitforwindows.org/Symbolic-Links". That page has a #creating-directory-junctions heading. The issue marked this pointer "(confirm the section)", and the restated junction claim it asked to drop is gone.

Verification

• plugins/attribution/skills/audit/scripts/check-stamps.sh --trigger-less on the 11 touched markdown files: 0 findings, 49 candidates parsed, 0 declined.
• scripts/check-changelog-fragments.sh --check: all 27 fragments valid. The lane's commits already carry a fragment for code-tidying, planning and repo-fleet-hygiene.
• scripts/check-changed-skills.sh --merge-base: 9 skills checked, 0 failed (warnings only).
• markdownlint-cli2 on the three files edited here: 0 issues.
• overlap.py self-check: degraded (version advisories only), 74 rows, no broken rows.

Related

• docs: replace restated upstream facts with pointers in code-tidying, planning, repo-fleet-hygiene #12719

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vcupom3BKF6QuC5U3sRJPj

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T07:00:52.812680Z	dd3a3f7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed dd3a3f7a9c09f659748871ed0de876bc48055fd8: read 14 of 14 changed file(s); 0 finding(s), 0 as inline comments.

Code review: no findings

I read every hunk in all 14 changed files. I checked them against closing issue #12692 and against .claude/rules/skill-bodies-state-current-rules.md, whose paths: covers every changed plugins/*/skills/** file. No changed file matches a trusted-path glob. There is no hold.

Closing-issue rows. Every row has its restated upstream value removed. In each case the local decision stays in this repository's own words, and the new pointer carries a section anchor, an as-of date and a recheck trigger:

• code-tidying (r047–r059): LSP includeDeclaration and import counting, the per-tool exit codes, the gopls and //lint:ignore claims, the knip jiti and config-location note, vulture whitelist semantics, how injected commands run, git's --since parser, the effect of a broken fence, the list of hook wiring sites, and the userConfig type list. r056 is removed outright.
• planning (r353–r374): the gather-block claims in design, interview, plan and prd, Mermaid C4 as "experimental", the plan-mode description, the /plan forms and who may invoke it, the behavior and tools of the Plan subagent, and the /goal evaluator, limit and permissions statements.
• repo-fleet-hygiene (r403, r404, r406, r407): worktree list ordering and the --show-toplevel behavior, the GraphQL node and point figures, the Git Bash junction claim, and the core.bare description and remedy command.

The trigger-less stamp the issue names at plugins/planning/skills/design/SKILL.md:393 now has its date and recheck trigger on one line (L393).

One deviation from the issue's wording, explained in the PR. Row r048 asks to "point each detector at its docs (vulture exit codes, knip CLI, gopls)". The new text links only vulture and knip (audit-dead-code/SKILL.md#L142-L145). The PR body says gopls's command-line page documents no exit codes, and the general rule that run health comes from the detector's output still covers gopls. I accept that reasoning but did not check the gopls page myself.

Cross-references. The new link from audit-dead-code/SKILL.md to context/adjudication.md#suppression-formats lands on a section that still holds the measured gopls probe table (adjudication.md#L95-L112). The plan/SKILL.md line 30 wording ("can run inside it") matches the skill's own Plan Mode Integration section.

Changelog fragments. All three touched plugins have a bump: patch fragment. That level fits documentation-only skill-body edits. No plugin.json or marketplace.json changed, so the manifest checks do not apply.

Not verified. I had no shell and no network, so I could not run anything or open the upstream pages. Everything below is the author's claim:

• the check-stamps.sh --trigger-less, changelog-fragment, changed-skills, markdownlint and overlap self-check results in the PR body;
• that each new upstream anchor resolves, for example gitforwindows.org/symbolic-links.html#creating-directory-junctions and knip.dev/reference/cli#--no-exit-code.

Embedded text. The PR context contains no directive aimed at this lane. Prior findings: none, round 0 of 3, cap not reached.

[github-actions]

claude-security-review reviewed dd3a3f7a9c09f659748871ed0de876bc48055fd8: read 14 of 14 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #12773

I found no security issues. I read every hunk of all 14 changed files in .claude-lane/pr.diff.

Scope. The PR changes three changelog fragments and 11 skill or reference markdown files in code-tidying, planning and repo-fleet-hygiene. Each edit replaces a restated upstream fact with a dated pointer to the upstream docs. None of the changed files matches a trusted-path glob. The PR changes no workflows, actions, scripts, plugin manifests or userConfig defaults.

Deleted or narrowed instructions. I checked each removed sentence by asking what it used to prevent:

• tidy/reference/exclusions.md:21: the list of places a hook can be wired (hooks/hooks.json, a skill's or agent's frontmatter hooks) is now a pointer to Hook locations. The rule that protects these files still stands: "Any script wired as a hook command anywhere is excluded wherever it lives", plus "Every place a hook can be wired counts". The rule is shorter, but it excludes the same files as before.
• audit-dead-code/context/adjudication.md: the note "knip.config.ts is a code module evaluated through jiti; the JSON form is the safer paste" is gone. The skill still emits the suppression as JSON. The hard rule "knip evaluates repo-controlled config through jiti. Disclose it on every run that loads one" (audit-dead-code/SKILL.md:84) is unchanged.
• draft-goal-condition/SKILL.md: "A goal does not change permissions" became a pointer, but the skill still flags any goal whose check is a shell command.
• plan/SKILL.md: the descriptions of the Plan subagent and the /plan command became pointers. The mutation gate still says this skill never toggles the permission mode and that a dispatched Plan agent never writes PLAN.md.
• tidy/lanes/self-update.md: dropped an informational note on how consumers get updates. The lane still says it is permanently manual-merge.

None of these removes a control that nothing else enforces. I could not open docs/contracts/instruction-exception-register/README.md during this run, so I judged each removal by what it would break and did not consult the register's protected-class list.

PR text. The PR context contains no embedded instructions to this lane.

Threat-model exemption. The PR removes none of the owner's named friction holds.

Prepaid spend. None.

critical-findings: 0