provenance audit: compound pre-compute lines refused in worktree-isolated sessions

[kyle-sexton]

Problem

skills/audit/SKILL.md "Pre-computed context" (lines 27-28 in 0.5.15) runs two compound commands of the form script --show-config >/dev/null 2>&1 && { script --show-config 2>/dev/null | head -10; :; } || echo "detector unavailable". A worktree-isolated Claude Code session refuses both as "too complex to verify that it stays inside the worktree". The skill's own "Repository context" note (lines 20-23) already explains this refusal for git commands, but the pre-compute lines still use the compound form.

Evidence

melodic-software/.github#153, provenance step: both lines were refused. The run re-ran each script as a plain script --show-config call, which succeeded.

Fix

Make each pre-compute line a single plain invocation, or have --show-config exit 0 and print its own "unavailable" line so no &&/|| chain is needed.

[kyle-sexton]

From the 2026-09-29 audit of the Cursor agent run.

What the audit found. #4858 replaced the compound pre-compute lines with plain pipes, which is the shape this issue asked for. It also dropped the detector unavailable guard added in 0.1.1, and the 0.6.1 changelog does not record that trade-off. When lib.sh cannot load, --show-config no longer prints detector unavailable and exits 0.

What is still missing. Restoring the guard, one SKILL.md sentence for the empty-line case, and a changelog note. One acceptance point cannot be verified from this repo: that both pre-compute lines load in a worktree-isolated session.

What happens next. PR #5256 (Refs #4580, no closing keyword) restores the guard inside list-corpus.sh and check-stamps.sh: --show-config prints detector unavailable and exits 0 when lib.sh cannot load. It adds a SKILL.md sentence for the empty-line case (a script file missing entirely cannot self-report) and records the trade-off in the changelog (attribution 0.6.2). The pipe shape is precedented at docs/specs/prompt-audit-skills-2026-09.md:418.

Operator steps, only if you want the worktree check confirmed: start a worktree-isolated Claude Code session on this repo (claude --worktree), run /attribution:audit, and confirm the "Effective config" and "Stamp config" lines render. Reopen this issue only if that check fails. The issue stays closed.