[kyle-sexton]

No related issue: code-tidying upkeep sweep.

Summary

Replaces #12763, an ad hoc tidy of the two plugin-quality audit collectors that the lanes App opened. pr-verify failed its head only because the pull request had no spec: the body said "No related issue" and no trusted title or body was recorded, so spec-text.json was empty. It named no defect in the code. pr-unblock could not change pull request metadata, left both fail-note threads open, and labeled it needs-session. This owner-login pull request carries the same change with a trusted title and body, which is the spec: a structure-only tidy that keeps every collector's output the same, plus a test that pins the folded regex.

Fix

• plugins/plugin-quality/skills/audit/scripts/collect-categories.sh: the per-heading marker / items / finding_open reset runs once after close_section() instead of in both heading branches.
• plugins/plugin-quality/skills/audit/scripts/collect-standards.sh: cite()'s missing-file branch becomes [[ -f "$file" ]] || return 0; the windows-path-emit probe folds its three declaration forms into (export|declare[[:space:]]+-x|typeset[[:space:]]+-x)[[:space:]]+(MSYS_NO_PATHCONV|MSYS2_ARG_CONV_EXCL).
• plugins/plugin-quality/skills/audit/scripts/collect-standards.test.sh (new in this replacement): cases that flag declare -x MSYS2_ARG_CONV_EXCL and typeset -x MSYS_NO_PATHCONV at their line, and leave a per-command MSYS_NO_PATHCONV=1 tool.exe ungraded. Before this, only the export form was tested, so the folded alternation could drop a form unnoticed.
• .changes/plugin-quality/ patch fragment, updated to name the test.

Verification

• collect-standards.test.sh and collect-categories.test.sh: all cases pass on the merged head.
• Mutation check: removing typeset[[:space:]]+-x from the regex makes the two new typeset assertions fail; the script was restored afterwards.
• scripts/check-affected.sh --base origin/main --no-fetch: 14 passed, 1 skipped (ruff, no changed .py).
• The pr-verify fail notes on refactor(plugin-quality): fold repeated resets and patterns in the audit collectors #12763 found no defect: collect-categories.sh:225 reset equivalent, collect-standards.sh:117 and :275 equivalent.

Related

• Replaces refactor(plugin-quality): fold repeated resets and patterns in the audit collectors #12763.
• Withheld from the original sweep (not a pure tidying): scripts/packet-seal.sh has two near-identical digest loops that differ in their manifest-name filter and symlink error text.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vcupom3BKF6QuC5U3sRJPj

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T10:26:10.752379Z	fed01f9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed fed01f9e1df69d866987a2af22ea9c40639ae921: read 4 of 4 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #12811

No security issues found.

I read every hunk of all 4 changed files. None of them match a trusted-path glob, and none touch a trust control, a merge hold, a token request, a workflow, a plugin manifest or a standing instruction.

• plugins/plugin-quality/skills/audit/scripts/collect-categories.sh: the awk per-heading reset (marker, items, finding_open) now runs once after close_section() instead of in both branches. The state is the same on every path, and nothing new reaches input handling.
• plugins/plugin-quality/skills/audit/scripts/collect-standards.sh: in cite(), printf ''; return becomes [[ -f "$file" ]] || return 0. Stdout and the exit status are unchanged on the missing-file path. The windows-path-emit grep pattern folds its three alternatives into (export|declare[[:space:]]+-x|typeset[[:space:]]+-x)[[:space:]]+(MSYS_NO_PATHCONV|MSYS2_ARG_CONV_EXCL), which matches the same strings as before. It is still a single-quoted grep -E pattern on a quoted "$COMPONENT" path, so the change adds no way to inject a command or a path.
• plugins/plugin-quality/skills/audit/scripts/collect-standards.test.sh: the new test cases write fixture files under the test's own $ROOT. No new security surface.
• .changes/plugin-quality/...md: a changelog fragment (prose only).

The pull request context contains no embedded directives aimed at this lane. There were no prior findings (round 0 of 3), so the round cap did not apply.

critical-findings: 0

[github-actions]

claude-review reviewed fed01f9e1df69d866987a2af22ea9c40639ae921: read 4 of 4 changed file(s); 0 finding(s), 0 as inline comments.

Code review: no findings

I read every hunk of all 4 changed files, plus the surrounding head code in each script.

collect-categories.sh. The marker / items / finding_open reset now runs once, right after close_section() (L224-L227). Before, each ## heading branch did its own reset. close_section() reads these variables before the reset, both before and after the change. Nothing between the new reset and either next reads them. Every path through a heading still ends with the same state, so behaviour is unchanged.

collect-standards.sh.

• cite() now uses [[ -f "$file" ]] || return 0. The old branch was printf ''; return, which returned printf's status of 0 and printed nothing. Same output, same exit status.
• The windows-path-emit regex (export|declare[[:space:]]+-x|typeset[[:space:]]+-x)[[:space:]]+(MSYS_NO_PATHCONV|MSYS2_ARG_CONV_EXCL) matches exactly what the old three-way alternation matched. Neither version anchors to word boundaries, so that hasn't changed either.

collect-standards.test.sh. The new cases go through the windows-path-emit probe on non-SKILL.md components:

• invocation-mode reports not-applicable for them.
• They have no seam or ingest signals, so the only finding is the suppressor. That gives the expected run 1, and run.sh:1 note=exported path-conversion suppressor matches the probe's component=$COMPONENT:$export_line note=... format.
• The typeset -x case uses two spaces, which tests the [[:space:]]+ part of the regex.
• The per-command form MSYS_NO_PATHCONV=1 tool.exe correctly reaches not-graded with exit 0.

Changelog fragment. The bump: patch level fits a behaviour-preserving tidy plus a test. No plugin manifest changed, so the manifest checks don't apply.

Spec and context.

• There is no closing issue. The PR body is the spec: a structure-only tidy that keeps output the same, plus a test that pins the folded regex. The diff matches it.
• The PR body's verification (test runs, the mutation check, check-affected.sh) is the author's claim. This lane has no shell, so I did not run any of it.
• The prior-findings file lists no earlier posts, and the round cap does not apply.
• None of the changed files match a trusted-path glob.

[github-actions]

Post-merge mutation testing

• Range: b3d61fb..d967840
• Merged pull request: #12811
• Outcome: reported

Killed 3, survived 2, timeout 0, no coverage 0, invalid 0, not run 2.
Covered-code score 60%; mutation score 60%.

File	Killed	Survived	Timeout	No coverage	Invalid	Not run
.github/actions/resolve-config/resolve.mjs	0	0	0	0	0	1
.github/scripts/work-resolve-issue/limits.mjs	0	0	0	0	0	1
.github/scripts/work-unblock/label-unblocked.mjs	2	0	0	0	0	0
plugins/plugin-quality/skills/audit/scripts/collect-categories.sh	0	1	0	0	0	0
plugins/plugin-quality/skills/audit/scripts/collect-standards.sh	0	1	0	0	0	0
plugins/visualization/skills/present/scripts/check-deck.mjs	1	0	0	0	0	0

Surviving mutants

Location	Operator	Disposition	Cause
plugins/plugin-quality/skills/audit/scripts/collect-categories.sh:226	SBR	productive	input-gap
plugins/plugin-quality/skills/audit/scripts/collect-standards.sh:117	SBR	arid	none

The run's summary has the full report.