[kyle-sexton]

Closes #12697

Summary

Docs in eleven plugins restated upstream defaults, limits and behavior as fact, so they went stale whenever the vendor changed: actionlint, architecture, bash-format, context7, go-format, improvement, kindle-dedrm, machine-health, miro, playbooks and review. Each of the issue's 25 rows now points at the live upstream section, with an as-of date and a recheck trigger, or drops the claim where the row says so. The owner also settled how this sweep meets the eval rule for skill cuts, and that rule is now written down.

Fix

• All 25 rows applied. Two of the issue's anchors no longer exist upstream, so the live ones are used: #automatic-unix-windows-path-conversion (MSYS2) and #pkg-overview (pkg.go.dev).
• Row r326. The machine-health check catalog has no Microsoft docs page to point at. As the row asks, the 2047 User Path figure now reads as this audit's own CRIT threshold.
• Eval rule for pointer swaps (owner decision, recorded on this PR). Swapping a restated upstream fact for a pointer needs no before-and-after eval run. A removed sentence that gives a reason the skill acts on still needs one, or it stays. This is written into plugins/playbooks/skills/skill-authoring/reference/skill-criteria.md and docs/review/skills-and-agents.md.
• Reason sentences the rows removed are restored. A vendor version or limit inside a restored sentence is dropped. Two kinds were not restored:
  • claims the upstream page now contradicts: mermaid C4 "experimental", and "code-review only posts to the PR";
  • deletions an issue row orders: r002 and r326.
• Mermaid C4 claim. map-components and architecture/reference/config.md drop it too, since the mermaid page no longer carries it.
• Skill text outside the rows stays as it is. That covers actionlint setup, machine-health setup and kindle-dedrm manage. Their evals still check that text.
• Changelog. One fragment per plugin. No version bumps, matching the sibling PRs.

Verification

• plugins/attribution/skills/audit/scripts/check-stamps.sh --trigger-less on every changed plugin file: 0 findings.
• markdownlint-cli2 on the changed files: 0 issues.
• check-changelog-fragments --check and --check-required origin/main pass, covering 11 plugins.
• Fresh-context verifiers checked the rows, the fence, the fragments, 18 sampled pointer URLs with their anchors, and the rule text. A second pass flagged two restored claims the upstream pages contradict, and one bare deletion. All three are fixed on the current head.
• No evals.json, test, check script or workflow changed.
• Left out: the test suites, since only markdown changed and CI runs them.

Related

• Sibling slices of the same sweep: docs: replace restated upstream facts with pointers in work-items, context-budget #12810 and docs: replace restated upstream facts with pointers in knowledge and computer-use #12913.
• docs(contracts): re-derive mermaid for diagram_dialect.system now that C4 is no longer marked experimental #12998: docs/contracts/authoring-formats/README.md still quotes mermaid's old C4 "experimental" banner. Re-deriving whether mermaid becomes an allowed diagram_dialect.system value is a contract decision.
• fix(review): quality-gate pr mode assumes code-review always posts; it now outputs to the terminal by default #13010: the review plugin's quality-gate pr mode still gates code-review as if it always posts. Upstream now prints to the terminal by default.

🤖 Generated with Claude Code

https://claude.ai/code/session_015te8Cr8u7uFJG4tdeUACLz

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T00:08:36.800562Z	e5fe52a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e5fe52a071

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-security-review reviewed c314bbf42222f6de9dbaeb6f2a48b140e0ab7782: read 6 of 6 changed file(s); 0 finding(s), 0 as inline comments.

Security review (incremental since 51e7790): no security issues found

I read every hunk of all 6 files on the incremental list. All of them are markdown prose:

• .changes/architecture/docs-12697-restated-upstream-facts-pointers-3acb239e.md, .changes/context7/docs-12697-restated-upstream-facts-pointers-6a9194f5.md, .changes/review/docs-12697-restated-upstream-facts-pointers-1f29181d.md: changelog fragments.
• plugins/architecture/skills/map-components/SKILL.md, plugins/context7/skills/lookup/context/mcp.md, plugins/review/skills/quality-gate/context/pr.md: skill bodies and their context files.

None of these files is on a trusted path. No script, workflow, hook, action, plugin manifest or userConfig default changed, so there are no manifest <field> lines. No trust control or merge hold is touched.

Instruction changes, checked by what breaks if each rule is gone:

• map-components/SKILL.md: the edit drops the reason "because mermaid C4 is experimental" and adds a pointer to the Mermaid C4 page. The rule itself stays: diagram_dialect.system still refuses mermaid and has no default, and when it is unset the run still writes the tables with no diagram. Nothing a rule used to block is now let through.
• context7/.../mcp.md: adds one sentence saying the MCP and CLI transports are equivalent. Nothing is removed.
• quality-gate/context/pr.md: removes the claim that /code-review:code-review always posts to the PR. The Mutation gate still covers that plugin unconditionally and still requires explicit user opt-in before any surface that posts or edits. The protected action (publishing to the PR without consent) is still blocked by the rule as it stands, so this is not a finding. The PR description notes the upstream contradiction and leaves follow-up to fix(review): quality-gate pr mode assumes code-review always posts; it now outputs to the terminal by default #13010.

Settled threads, prior findings, round cap:

• Neither settled thread is on these files.
• This lane's only earlier post was a 0-finding summary, so nothing is repeated.
• The round cap was not reached.

PR context: it contains no text aimed at this review lane.

critical-findings: 0

[github-actions]

claude-review: 1 inline finding(s) on e5fe52a0719ec30afd8315e8f7d9ec229bcabaeb; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review reviewed c314bbf42222f6de9dbaeb6f2a48b140e0ab7782: read 6 of 6 changed file(s); 0 finding(s), 0 as inline comments.

Incremental code review: PR #12997, 51e77909 → c314bbf4

Verdict: no findings in this push.

Scope. I read every hunk of all 6 files on the incremental list in .claude-lane/incremental.diff. I used .claude-lane/pr.diff, .claude-lane/pr-context.md, the settled-threads file and the prior-findings file for context. None of the 6 files is on a trusted path.

What this push does, and why it is correct:

• Row r419 (plugins/review/skills/quality-gate/context/pr.md:11-18). The plugin's target, its parallel agents and confidence scoring, and the PR-comment posting are gone. The decision to treat the plugin as gated and run it only on opt-in stays. It still has the Commands pointer, an as-of date and a recheck trigger. This meets the row.
• Row r420 (pr.md:45-55). The Mutation gate drops "every run ends by posting" and "the managed service posts a full review". It keeps the gate-by-effect rule against the report-only contract, and the reads-and-edits pointer stays. This meets the row. These were the last two rows the previous round said were still unfixed in this file.
• plugins/architecture/skills/map-components/SKILL.md:234-242.
  • The "mermaid C4 is experimental" reason is gone, which matches its map-containers and map-context siblings.
  • The garbled "The / Every C4 view" sentence is fixed.
  • It gains the Mermaid C4 pointer with an as-of date and a recheck trigger.
  • The no-default key, the refusal of mermaid and the no-diagram fallback all stay.
  • I searched plugins/architecture for "experimental": the only hits are in CHANGELOG.md. No eval checks the dropped word.
• plugins/context7/skills/lookup/context/mcp.md:59. The "same input shape, same backend, only the transport differs" sentence is restored word for word from the base text. The removed query-argument requirement stays dropped, which is what row r091 asks.
• Changelog fragments (architecture, context7, review). Each one's new wording describes the matching hunk accurately. None of them bumps a version, which matches the PR's stated choice.

Closing issue #12697 (summary finding from earlier rounds). The previous round's blocking summary finding listed rows that keep a restated value beside the new pointer:

• r012 (map-landscape/SKILL.md:238)
• r092 (lookup/SKILL.md:82)
• r304 and r305 (kindle-dedrm/skills/manage/SKILL.md:41,45,70)
• r328
• r289, r290 and r326

This push fixes r419 and r420. Since that round, the owner recorded a decision in #12997 (comment), quoted in the settled thread on plugins/actionlint/skills/setup/SKILL.md. The decision: a removed sentence that gives a reason the skill acts on stays unless eval evidence supports cutting it. The branch restores those sentences on purpose. That decision covers the remaining rows, so I treat the point as settled and do not restate it as a finding.

Needs a person. The decision departs from the issue's own Done-when text: "A record beside a restated value does not fix it. A row marked Remove has no local dependency on the fact." The PR body also still says "All 25 rows applied". A person should confirm the issue closes under the recorded decision.

Context only, not a finding. The PR body says upstream's code-review plugin "now prints to the terminal by default" (#13010). If so, the recheck trigger on pr.md:17-18 has already fired against its 2026-11-03 as-of date, and the "covers the plugin unconditionally" gate at pr.md:45 has no stated basis left. Those lines did not change in this push, and #13010 tracks the work.

Prior findings. The prior-findings file lists two entries:

• The inline actionlint eval finding: its thread is resolved, the owner reply settles it, and its lines are unchanged.
• The summary finding: handled above.

The round cap did not apply (2 of 3 rounds used).

Verification. I read the diff and the head files only. I ran no linters or tests. The PR's verification results (check-stamps, markdownlint, changelog-fragment checks) are author-claimed and unverified.

[kyle-sexton]

Decision recorded. Owner, 2026-11-04, Lane 6 session, choosing option "Exempt pure swaps": a change that replaces a restated upstream fact with a pointer to the live upstream section, as .claude/rules/skill-bodies-state-current-rules.md requires, needs no before-and-after eval evidence. A removed sentence that gives a reason the skill acts on still needs eval evidence of no loss, or it stays. This PR writes the rule into docs/review/skills-and-agents.md and the skill criteria, and restores the reason lines its rows removed.