Audit Pass

---
description: "Run one coordinated, resumable audit pass over a repo: a three-scope inventory, then each owning plugin's checks lane by lane, presence-gated, with findings persisted per lane and one human gate for the whole pass. Read-only unless --fix. Use when: 'audit pass', 'run one pass over this repo', 'coordinate the audit skills', 'audit this repo end to end', 'resume the audit', 'one reconciled findings report', 'sweep all three scopes', or a release needs one diffable findings artifact."
argument-hint: "[target] [--fix] [--opinion] [--postures] [--lanes <list>] [--resume] [--report-to <dir>]"
user-invocable: true
disable-model-invocation: false
disallowed-tools: Edit, NotebookEdit
metadata:
  workflow-stage: anytime
  summary: Run one coordinated, resumable audit pass over a repo with a single human gate
---

## Purpose

One bounded, ordered pass over a target repository's Claude Code **instruction** surface, coordinated
across three scopes and resumable mid-run. It **adds no criteria of its own**: every check is
delegated to the plugin that owns it. What it contributes is what invoking those skills by hand
yields none of: a three-scope inventory before any check runs, a run-time-derived exclusion set,
stable finding identity, suppression memory, incremental persistence and resume, and one human gate
for the pass. All of it is specified in [reference/run-contract.md](reference/run-contract.md).

## Reference index. Load on demand

| File | Load when |
|---|---|
| [reference/terms.md](reference/terms.md) | Before any other contract file. Every one of them uses run, target, lane, scan set, live surface and live surface set without redefining them. |
| [reference/finding-identity.md](reference/finding-identity.md) | Emitting, comparing, or suppressing a finding: the `(check, claim, sites)` tuple, `surface`, `anchor`, and the derived `finding_id`. |
| [reference/run-contract.md](reference/run-contract.md) | Deciding which contract file owns a rule, or resolving a `§N` cross-reference from inside one. |
| [reference/arguments.md](reference/arguments.md) | A run is invoked with an argument whose precedence, default, or refusal is not settled by the `Arguments` table. |
| [reference/exclusion-set.md](reference/exclusion-set.md) | Deriving the scan set, or justifying why a path was skipped. |
| [reference/run-state-and-resumability.md](reference/run-state-and-resumability.md) | Starting, leasing, or resuming a run, and diagnosing a lock that outlived its holder. |
| [reference/report-location-and-schema.md](reference/report-location-and-schema.md) | Writing the report, or judging what `--report-to` may target. |
| [reference/determinism-tiers.md](reference/determinism-tiers.md) | Assigning a finding's tier, or running the self-check's comparison. |
| [reference/suppression.md](reference/suppression.md) | Reading or writing the target's `.claude/audit-pass.md` record. |
| [reference/doctor-handoff.md](reference/doctor-handoff.md) | Reaching the `/doctor` handoff, whether it is present or absent. |
| [reference/liveness-sources.md](reference/liveness-sources.md) | Inventorying Phase 1 liveness: which sources this run can reach, what each one establishes, and the three losses it names in `skipped`. |
| [reference/lane-catalog.md](reference/lane-catalog.md) | Dispatching Phase 3, or resolving what a `--lanes` id covers: every lane, what each delegated skill owns, what is not dispatched, and the substrate probe. |
| [reference/retired-conventions-sweep.md](reference/retired-conventions-sweep.md) | Running the one script lane: how installed manifests are discovered, what an undiscoverable manifest set reports, and how a helper exit maps to a finding. |

## Read-only contract, and where mutation can reach

Bare invocation reads and reports. `--fix` is the only mutation path, and it is bounded by scope:

| Scope | Posture under `--fix` |
|---|---|
| Managed policy | **Never remediated.** Read-only in every mode. A finding here reports "conflicts with org policy at `<path>`" and proposes no edit to either side; seeking a policy exception is an organizational decision, not a linting one. |
| User | **Routed as a recommendation, never edited in place.** A user-scope tree is commonly managed by a dotfiles manager, so an in-place edit is drift the operator's own sync path will fight. |
| Project | The only editable scope, per-finding confirmed. |

The frontmatter carries it mechanically too: `disallowed-tools: Edit, NotebookEdit` removes both
editing tools from the pool while this skill is active, so the report-only contract is a property of
the tool set, not of model obedience. `Write` is kept, since run state and the report persist under
`${CLAUDE_PLUGIN_DATA}`.

**`scripts/run-state.sh` writes under that same plugin data directory and nowhere else**, never
inside a target repository. It takes the data directory as an argument rather than discovering one,
and validates both path segments it contributes: `lib/state-key.sh` refuses a remote URL that would
become traversing directory components, and a `--run-id` outside `[A-Za-z0-9][A-Za-z0-9_.-]*` is
refused here.

**The run mechanics are scripts, not prose to re-derive per run.** Four of them, each with tests
beside it, and each is the *only* correct source for what it computes: a mechanic described in prose
and performed by the model is a different mechanic per run, which is precisely what makes a
determinism property unfalsifiable.

| Script | Owns |
|---|---|
| `scripts/run-state.sh` | The run directory, the lease and its verdict, and the append-only partial. |
| `scripts/state-digest.sh` | `state-digest/v1` and `input-digest/v1`: the comparability input and every lane's resume digest. |
| `scripts/finding-identity.sh` | `anchor/v1` normalization, `finding_id/v1`, `group/v1`, and `guarded-append`: the guard, on the append path rather than beside it, so no record reaches the partial without passing it. |
| `scripts/assemble.sh` | Partial-to-report assembly, and the `report.md` rendering of the assembled document. |

They read and write nothing inside the target: the digest scripts hash files the run names and print
a hex string, and the rest write only under the run directory.

## Scope boundary (route out)

- **One instruction surface against the model-capability catalog** → `/harness-config:audit-instructions`
  directly. This pass dispatches that skill by invoking it via the Skill tool; it does not
  re-answer it.
- **Config-file correctness** is a delegated lane, not a route-out: this pass invokes
  `/harness-config:audit` and appends the findings rows it persists (Phase 3).
- **Grant portability** is a delegated lane at its `frontmatter` scope only (Phase 3). Its
  settings-file scope routes out to `/harness-config:audit-permission-grants` directly, because the
  permission plane as it is in effect is `audit-permission-state`'s lane here.
- **Automation landscape** → `/harness-config:audit-automation-gaps`. Not in this pass's surface set:
  it proposes automation that does not exist, so it reports over no inventoried surface.

## Arguments

Parse `$ARGUMENTS`. The names and their one-line meanings:

| Argument | Meaning |
|---|---|
| `target` | The git repository to audit. Defaults to the active project root; a `target` resolving anywhere else is refused non-zero. |
| `--fix` | The explicit mutation override. Absent, the pass writes nothing into the target. |
| `--opinion` | Run the `OPINION`-tier checks the delegated catalogs declare default-off. |
| `--postures` | Dispatch the opt-in posture lane. Off by default: it is the additive catalog and the largest fan-out in the pass. |
| `--lanes <list>` | Run only the named lanes, comma-separated. Narrows dispatch, never the inventory; an unknown lane id is refused non-zero. |
| `--resume` | Resume the most recent incomplete run for this target's state key. |
| `--report-to <dir>` | Redirect **both** report artifacts into that directory, subject to the destination gate. A directory, never a file path. |

Flag semantics, precedence between them, and what `--fix` and `--resume` change about the phases
below are in [reference/arguments.md](reference/arguments.md). Read it when a run is invoked with
more than one flag, or with any flag whose effect on a later phase you are about to assume.

## Phase 0: Resolve, key, lock

Resolve the target root, compute the state key, and take the lock posture for the mode. Read-only
runs take no lock and run concurrently; an applying run takes an exclusive advisory lock and refuses
rather than queues. All specified in
[reference/run-state-and-resumability.md](reference/run-state-and-resumability.md). With `--resume`,
read the lease, then read the partial's lane records and carry forward every lane whose input digest
is unchanged.

**Do not derive the run directory or hand-write the lease.** `scripts/run-state.sh` does both, which
is what makes this phase a mechanism rather than a description of one:

```bash
S="${CLAUDE_PLUGIN_ROOT}/skills/audit-pass/scripts/run-state.sh"
D="${CLAUDE_PLUGIN_DATA}"
bash "$S" paths --plugin-data "$D" --run-id "<run-id>"
bash "$S" lease acquire --run-dir "<run-dir>" --run-id "<run-id>" --plugin-data "$D"
```

`paths` derives `<plugin-data>/runs/<state-key>/<run-id>` through the plugin's own `lib/state-key.sh`,
the library whose header records the keying scheme. Pass `--plugin-data` explicitly: `${CLAUDE_PLUGIN_DATA}`
substitutes in this text but is **not** exported to the Bash tool's environment, so a shell cannot
expand it. `acquire` takes it too, and refuses a `--run-dir` that is not under
`<plugin-data>/runs/`. It is the only command that *creates* a directory, so it is where the write
tree is pinned; a wrong or invented run dir would otherwise be created and written into.

**`--resume` never attaches to a run that is still going.** Concurrent read-only runs are safe
because each owns its own partial artifact; resume is the one operation that reaches into *another*
run's artifact, so the no-lock policy that makes concurrency safe is exactly what leaves resume
unable to tell a live run from an interrupted one. Both would then append lane attempts and
terminating records to one file, and highest-terminated-attempt assembly becomes race-dependent,
the interruption-tolerance mechanism producing a report neither run performed.

So every active run, read-only included, maintains a **lease**, and `--resume` reads it before it
reads the partial. `run-state.sh lease classify --run-dir <run-dir>` prints the verdict:
a **live** lease means the run is still going, and resume exits non-zero naming the run id rather
than attaching; a **stale** lease means the run was interrupted and its artifact is resumable; a
`released` tombstone is resumable immediately; `missing` means there is nothing to attach to. The
lease is not a lock: it excludes nothing, blocks no concurrent read-only run, and grants no
exclusivity; it answers the one question resume has to ask.

Refresh it at every lane's persistence point (`lease heartbeat`) and write the tombstone on a clean
exit (`lease release`). The full specification, covering path, contents, the two-sided liveness window, and an
explicit statement of **which clauses the script enforces and which remain the run's own discipline**,
is in [reference/run-state-and-resumability.md](reference/run-state-and-resumability.md) §3. Read
that split before relying on any of it: a clause the script does not enforce is the run's own
discipline, not a guarantee.

**The scan baseline is captured after the inventory is frozen and before any lane reads.** The
digest spans every inventoried scope, so it cannot be computed before Phase 1 has produced that
inventory. Taking it at the top of Phase 0 would either omit the user and managed surfaces, which
are exactly the mid-run external edits the gate exists to detect, or force an unspecified second
inventory. So Phase 0 resolves, keys, and locks; Phase 1 freezes the inventory; the **scan baseline**,
the target's HEAD commit and the run's state digest, is taken at that boundary, and the matching
**audit endpoint** capture is taken when the last lane completes, before any Phase 5 mutation.

Baseline to endpoint is therefore exactly the window in which lanes read, which is what the
determinism gate is a claim about. A run that never measures it cannot claim it held. The digest
pairs each path with a hash of its current content, because a *count* holds still while a dirty
file's contents change underneath the run.

## Phase 1: Three-scope inventory, before any check

**Nothing is checked until all three scopes are inventoried.** A project-only inventory cannot see a
project-versus-user conflict, so a fix from one would be applied against half the picture.
Native-first: the filesystem walk produces a **candidate** set, never the answer.

**Liveness sources are the ones this run can actually reach, and a source it cannot reach is named
rather than required.** Which sources this run can hold, which are out of reach and why, what each
one establishes, and the three coverage losses named in `skipped` rather than absorbed, are in
[reference/liveness-sources.md](reference/liveness-sources.md). Read it before recording any
liveness basis.

**A liveness claim carries its basis, and the report marks a single-sourced one.** A single-sourced
inventory is usable; silently presenting it as a multi-source result is the under-coverage-reads-as-
clean failure the rule exists to prevent. The liveness basis records which sources were live, so a
run with an `InstructionsLoaded` producer and a run without are **not comparable** and cannot fail
P1 against each other.

Record, per scope, every surface found **and every surface skipped with its reason**. The inventory
is a reported derived-tier artifact, so a surface that silently drops out of scope between two runs
fails the determinism property rather than looking like an improvement.

**Output styles are the case a walk alone cannot get right.** They modify the system prompt directly,
a custom one drops the built-in software-engineering instructions unless
`keep-coding-instructions: true`, and a
plugin's `force-for-plugin` "overrides the user's `outputStyle` setting", so a walk plus settings
reports a selection as live when it is not ([output styles](https://code.claude.com/docs/en/output-styles),
verified 2026-08-04). Report the resolved live style and what resolved it.

**Shadowed definitions fall out of this inventory, not out of a catalog.** Skills, subagents, and MCP
servers override *by name*: where two share a name across scopes, exactly one is live. That is name
comparison across a fixed precedence order, deterministic, model-free and derived tier, reported at
`info` in its own section naming the live definition and the shadowed one. It is not a conflict
finding and is never merged into one.

## Phase 2: Derive the exclusion set

**Derived at run time from the target's own state. Never transcribed, and no count of any class is
ever carried in this skill.** A count written down is wrong on the next commit and wrong in every
other repository. Four classes: registered byte-identical cluster copies, vendored upstream
materializations, worktrees, and the pass's own artifacts. Each class's derivation, its fallback on a
failed read, and the hard error when a suppression targets an excluded path are in
[reference/exclusion-set.md](reference/exclusion-set.md).

## Phase 3: Lanes and dispatch

**A lane is one delegated invocation at the finest filter that skill's own interface accepts**, the
granularity the pass can actually dispatch, since it invokes skills and never reaches inside one. A
finer lane is unbuildable, not merely inconvenient: per-lane persistence, input digests, and
selective resume all key on something the pass can re-invoke on its own.

So the split falls out of the delegated interfaces rather than being asserted over them: a skill
taking a **surface-class filter** yields one lane per filter value it is given, and a skill taking
only an action verb yields **one lane** covering everything it audits. Where a skill runs its whole
catalog per invocation, the lane carries that whole catalog; the pass never splits a catalog it
cannot address. Extending a delegated interface to accept a finer filter is a change to that skill,
and until it lands the lane stays at the coarser grain.

**What earns a lane, stated as a criterion rather than a list.** A skill is dispatched when it
produces findings **over surfaces the Phase 1 inventory already enumerates**, keyed to a site this
pass can anchor. That is what makes its rows joinable with the inventory, suppressible under this
pass's identity, and comparable across runs. `harness-config:audit-automation-gaps` fails the
criterion in both halves and is routed out: it is forward-looking, proposing automation that does not
exist, so it has no inventoried surface to report over and no site to anchor a finding at.

**Lane ids are what `--lanes` names**, one per lane in
[reference/lane-catalog.md](reference/lane-catalog.md), plus one per surface-class value for the
instruction catalog: `instructions:<class>`, `conflicts`, `permission-state`, `permission-grants`,
`config`, `memory`, `retirements`, and `postures`. A `--lanes` value naming an id outside that set is
refused non-zero.

Dispatch, in inventory order, with every skill invoked via the Skill tool, each invocation
presence-gated with its fallback stated. Every lane, what each delegated skill owns, why each is
exactly one lane (or one per surface-class value), what is deliberately left undispatched, and the
substrate probe that decides whether a lane can spawn its own verifier, are in
[reference/lane-catalog.md](reference/lane-catalog.md). Load it before dispatching a lane, before
answering what a `--lanes` id covers, and before assuming a lane can verify itself.

Persist each lane's findings to the partial artifact **as that lane completes**, never buffered to
the end. A lane is complete when its terminating record is in the partial, and every record carries
its attempt id so an abandoned re-attempt is discardable rather than merely older. The write is one
call per record, and it goes through the guard rather than past it:

```bash
FI="${CLAUDE_PLUGIN_ROOT}/skills/audit-pass/scripts/finding-identity.sh"
bash "$FI" guarded-append --run-dir "<run-dir>" --record '<json-line>' --epoch "<held>"
```

`guarded-append` runs `validate-record` and appends only if it passes, so **no record reaches the
partial without clearing §1**; `run-state.sh partial append` is what it calls and is never the call a
lane makes itself. **Exit 4 is the guard's refusal and nothing was written**: a null identity, three
or more sites, two sites with no pairwise declaration, an anchor outside the grammar, or a
`finding_id/v1` disagreeing with its constituents. Fix the lane, never the record. The lease is
refreshed at the same boundary; a lease must exist, so a record resume could not attribute to a
live-or-abandoned run is never written. **Pass the epoch you hold**: the filename is the writer's
epoch, not whatever the lease now carries, which keeps a fenced writer's rows out of its adopter's
file. The record is also validated as well-formed single-line JSON rather than sniffed by its first
character, because a malformed row here is permanent and resume is its only reader.

**Exit 3 means FENCED: stop this run.** The record was written safely to your own epoch file, but the
lease has moved on and another run has adopted the artifact, so continuing dispatches lanes whose
output nothing will assemble. Stop and report the run as superseded. Never retry the append, and never
read that exit as transient.

**The lane count is bounded by the delegated interfaces, not chosen here**, at one per scope value the
instruction catalog accepts plus one each for the permission plane, grants, config, the memory layer,
the retirements sweep, and the opt-in posture lane, so it is a handful, and a per-run
dispatch ceiling would never bind. What is *not* bounded here is the fan-out inside a lane: the
delegated catalogs spawn their own subagents, and this pass cannot reach inside one to cap it. So cap
concurrency at 3–5 lanes and let incremental persistence carry the rest. It is what degrades a blown
session ceiling into a resumed run.

The guarded-append call above bounds nothing inside a lane; what it buys is that an intra-lane
overrun costs the lanes still running rather than the whole pass.

## Phase 4: The `/doctor` handoff

`/doctor` owns the `CLAUDE.md` trim-and-migrate half, for which this pass builds no replacement,
and `/doctor prompt-audit` is the instruction-file audit this pass hands off rather than runs.
**Both are operator-run, so neither is dispatched.** Their records (version floors, write posture),
what the presence check verifies versus probes, and the absence classification are in
[reference/doctor-handoff.md](reference/doctor-handoff.md).
When `/doctor` is absent, name it as the missing capability and state what goes unchecked.

**Phase 4 records the handoff; it does not stop the pass.** Halting here would mean a `--fix` run
never reaches Phase 5 and no run reaches the Phase 6 report, so an optional collaborator would
cancel the coordinated pass that is this skill's purpose. `reference/doctor-handoff.md` says to
finish the pass's own phases first.

So Phase 4 opens the `delegated` lane, records the instruction in the report, and continues. Phases 5
and 6 run normally, and the assembled report carries the handoff as an outstanding item with its lane
marked `open`, routed and not yet returned. The operator runs `/doctor` when they choose; a later
`--resume` closes that lane by re-prompt rather than re-scan, because nothing about it needs the
sweep to run again.

**`open` is an assembly terminator, not a completion.** The two are distinct and conflating them
would have made the promised resume impossible: §7 needs a terminating record to assemble a report at
all, while §5 skips any lane whose state is complete and whose digest is unchanged, so a lane that
was both terminated *and* complete would be carried forward untouched on every resume, and the
outstanding handoff would never close. So the record terminates the attempt for assembly and marks
the lane's state **incomplete**. `--resume` therefore re-runs it, which for a delegated lane means
re-prompting rather than re-scanning. `handed-back` and `declined` are completions; only `open` is
not.

**That instruction to the operator is only true if the terminating record is actually written.**
`--resume` reads the partial, not the report, so a report telling the operator to come back with
`--resume` against a partial nothing wrote is a false instruction in the one artifact they act on. So
the `open` terminator is written at the moment Phase 4 records the handoff, never deferred to Phase 6
assembly, which is exactly where a run that does not reach Phase 6 loses it. It goes through
`guarded-append` like every other record: the guard short-circuits on anything that is not a
`finding`, so guarding a terminator costs nothing, and **one write command for the whole skill** is
what keeps Phase 3's rule from reading as advice a coordinator may opt out of.

## Phase 5: Apply, only under `--fix`

Per-finding confirmation, project scope only, bounded by the scope table under "Read-only contract, and where mutation can reach". Refuse and name the
canonical source if a fix or a suppression would write into a derived-exclusion path.

The apply-verify step judges work this same run produced, so it is delegated: hand the applied diff
and the finding it claims to resolve, the artifact rather than this run's reasoning, to a cross-vendor
advisor when one is installed and set up (the OpenAI Codex plugin, say, invoked per its own docs),
with a **fresh-context (non-fork) subagent** as the stated fallback.

### When dispatch is unavailable

The apply-verify step and delegated lanes that mandate subagent dispatch **require** that dispatch.
When the Agent tool is blocked, unavailable, or the probed depth budget does not permit the spawn a
step needs:

1. **Record per-lane verification mode** in the lane's terminating record and the assembled report (`verified` |
   `inline` | `skipped`) for every lane that mandates independent verification.
2. **Mark unverified findings.** Proposals or applied fixes that did not receive an independent
   verifier carry an `(unverified)` marker and are never presented as resolved.
3. **Do not silently complete.** The `skipped` section and report header name dispatch
   unavailability, and the probed depth budget, when either prevented a mandated verification phase.
4. **The main-session pass is the one that survives a lowered depth budget**, because it spawns from
   the top of the session rather than from inside a lane. A run that could verify no lane inline can
   usually still verify the assembled set, so `inline` per lane and a completed Phase 6 verification
   is the ordinary shape on a depth-1 host, not a degraded one.

## Phase 6: Assemble, verify the assembled set, report

**Assemble first.** An append-only `findings.partial.<owner_epoch>.jsonl` during the run becomes
`findings.json` here, epoch-scoped so a fenced writer cannot interleave into its adopter's file, with
assembly reading only the highest epoch present and, per lane, the highest-ordinal attempt carrying a
terminating record. `scripts/assemble.sh` performs it. Both schemas, the identity-versus-presentation
field split, and the sections are in
[reference/report-location-and-schema.md](reference/report-location-and-schema.md); the tier
memberships are in [reference/determinism-tiers.md](reference/determinism-tiers.md). Tiers stay in
separate sections because their guarantees differ.

### Main-session verification, after assembly

**A verification pass runs here, in the main session, on the assembled set, and its justification is
scope rather than inability.** A lane can only ever verify its own findings; several relations exist
only once every lane's output is in one document, and nothing inside a lane can see them:

- a finding two catalogs both raised at one site, which is the overlap note's whole subject;
- a finding contradicting a suppression the record carries for a different lane;
- a lane reporting clean over a surface another lane reported unreadable;
- a split group whose sites landed in two lanes, where the `group` value is the only thing tying
  them together.

So this pass runs even where every lane already verified itself. It records `verified`, `inline`, or
`skipped` **per lane** in the `verification` section, which is what keeps a lane that could not
verify itself distinguishable from one that did.

**Tell the verifier to flag only gaps affecting correctness or a stated requirement.** A reviewer
asked for gaps will find some, and a verification pass that returns stylistic observations on every
run adds noise the operator has to re-triage each time while burying the class of gap it exists to
catch. The instruction is part of the dispatch, not an afterthought in the report.

### Report

**Two artifacts, `findings.json` and `report.md`**, written side by side in the run directory and
redirected together by `--report-to <dir>`. The run prints `report.md`'s headline inline and offers
the file; it does not print the report, which is the cost the second artifact exists to avoid.
Before the headline, the inline message names what waits on the operator: the pass's human gate,
the `/doctor` handoff when Phase 4 produced one, and any lane that stopped fenced or unverified.

Every run also emits, in **one line**, how many `OPINION`-tier checks were
available, how many were not run, and the argument that enables them (`--opinion`). Without it the
tier ships unreachable.

**Overlap notes are emitted here and never merge the findings they name.** Where two catalogs
independently flag the same site, the note names **both** `finding_id`s and leaves both findings
standing. Merging them would cross a plugin boundary the identity tuple keeps explicit: `check` is
plugin-qualified, the two lanes persist independently, and an operator suppressing a merged finding
would be suppressing a catalog they never saw judged. The note sits in its own **note tier**,
excluded from the derived identity set and from P1-P3, because its inputs are judged findings held
only to P4's tolerance and a legitimate judged wobble must not fail a determinism property for
behavior P4 already licenses.

## The suppression record

A deliberately-kept finding is recorded at `.claude/audit-pass.md` in the target repository, layered
per the config-cascade convention. **It is the only suppression mechanism, and there is no inline
marker**, at any target: a marker would have to carry the same constituents, could not express a
two-site finding at all, and would write into a tree the pass must leave clean. An entry stores the
finding's **constituents**, meaning `check`, `claim`, and every `(surface, anchor)` site, under the
`finding_id` derived from them, never a bare id: an id is a one-way hash, so a record built on one
cannot compute a tiered match. Keys, layer merge, precedence inversion, and the four entry
dispositions are in [reference/suppression.md](reference/suppression.md); the cross-consumer key
contract is this marketplace's separately published **finding-suppression** convention.

**Only the team layer enacts a suppression.** A personal entry for an id the team layer does not
carry is reported as `personal-only, not applied` rather than applied, since absence from the team layer
is the team's *unsuppressed* state, so honoring a personal-only entry would hide a finding the team
never accepted. A suppression is a decision about the repository, so it belongs in the layer the
repository tracks; a personal layer drafts one for promotion.

Two report obligations. Every entry names its reason, its date, and **which cascade layer supplied
it**. And **only an exact match is silent**: a one-sided anchor change carries forward as
`needs-reconfirmation`, a deeper change closes the old entry and opens the new finding, and a
vanished finding must be accounted for as a fix, a successor, a **retirement with its check** when
the check that raised it is absent or renamed in this run's detection configuration, or an
**unexplained disappearance that fails the self-check**, the only detector the convergence property
has. Retirement is a reported disposition, not an exemption: it names the retiring check and the
version transition, because letting findings vanish silently on a catalog edit is the exact shape
this accounting exists to detect.

## Self-check

<!-- fresh-eyes-exempt: deterministic-gate -- the tolerance comparison is set arithmetic over two runs' identity sets; its pass/fail IS the verdict and no judgment enters it -->
**Establish the precondition first.** If HEAD or the state digest moved between the **scan-baseline**
and **audit-endpoint** captures, or if two lanes recorded different content for a path they share, the
tree did not hold still and the gate reports **`indeterminate`**, never `passed`. A shared checkout
is the normal case, and an unfalsifiable pass manufactures confidence out of a basis nobody measured.

**The audit endpoint is taken before Phase 5, not after it.** Under `--fix`, Phase 5 edits project
files *by design*, so an endpoint captured after it necessarily differs from Phase 0, which would
mark **every successful mutating run** `indeterminate` and skip P1–P3, the gate firing hardest on
runs that did exactly what was asked. What the precondition is about is whether the tree held still
*while the lanes were reading it*, and that window closes when the last lane completes. So the
capture bounds the read window, Phase 0 to end-of-lanes; Phase 5's writes fall outside the measured
interval rather than needing to be subtracted from it, which also avoids having to tell an accepted
mutation apart from a coincidental identical one.

A **third** capture is taken after Phase 5 and compared against the audit endpoint, for a different
purpose: it confirms the applied set matches the accepted set, so a `--fix` run that changed
something nobody approved is visible. That is a mutation-integrity check, reported separately from
the determinism one.

When it held, any derived-tier inequality is a defect, and judged-tier growth beyond the tolerance in
[reference/determinism-tiers.md](reference/determinism-tiers.md) **fails the self-check as an
instability finding against this skill**, naming the checks that moved, never absorbed by
recalibration.

**Recheck trigger:** re-verify the `output-styles` doc citation in Phase 1 above if the
`keep-coding-instructions` default, the `force-for-plugin` override behavior, or the built-in
software-engineering instructions it names change; re-verify the `memory` doc citation below if
`code.claude.com/docs/en/memory` changes its claim that `@path` imports load at launch (and so
splitting into imports does not defer or reduce context).

## Spoke paths

The `reference/` files write this skill's directory as `<skill-dir>`, which is
`${CLAUDE_SKILL_DIR}`, and the plugin's root directory as `<plugin-root>`, which is
`${CLAUDE_PLUGIN_ROOT}`. Put those paths in place of the placeholders before running a command or
writing one into a brief. Those files arrive through the Read tool as plain bytes, so a `${…}` token
in them would reach the Bash tool unsubstituted, and the Bash tool's environment has no
`CLAUDE_SKILL_DIR` or `CLAUDE_PLUGIN_ROOT` to expand it from. Basis: the plugins reference,
<https://code.claude.com/docs/en/plugins-reference#where-each-variable-resolves>, verified
2026-09-30; recheck when that table adds supporting files to where a `${…}` reference resolves.

## Gotchas

- **A suppression naming a registered cluster copy is a hard error, not a warning.** The copy is
  excluded from the scan set, so an entry against it is stale by construction and the finding it
  claims to hold belongs to the canonical source. Refuse; name that source.
- **A whole-surface (`s:`) suppression survives every edit to the file and dies on a rename.** Not a
  bug: a finding about a file *as a whole* must not be retired by editing a line inside it.
- **A judged finding does not contribute to the determinism gate, which is the norm rather than a weakness.** Every
  delegated check passes through model refinement first; the gate belongs to the derived tier.
- **Never propose an `@path` import as a context saving.** Splitting into imports "helps organization
  but doesn't reduce context, since imported files load at launch"
  ([memory](https://code.claude.com/docs/en/memory), verified 2026-08-10). A split remediation must
  name a load-deferring destination and price what it costs.

## What this skill does NOT do

- Never defines a check. Adding criteria here rather than to the owning plugin's catalog is the
  defect this skill's whole shape exists to avoid.
- Never reads another plugin's files. Invocation-only cooperation, with one declared exception:
  `retirements.yaml` is a published data file, read by the sweep lane via this plugin's own helper.
- Never edits managed policy or a user-scope file, in any mode.
- Never scans what it wrote. Where either resolved report path, `findings.json` or `report.md`, is
  contained in the target, by `--report-to` or by `${CLAUDE_PLUGIN_DATA}` resolving under `~` for a
  target at or above it, **both** paths are excluded before the write and the containment is
  disclosed. Never silently, and never one of the two.
- Never audits a target that is not a git repository. It refuses, and says what the refusal costs.