docs-hygiene:audit-progressive-disclosure proposes treatments for upstream-owned files without checking ownership

[kyle-sexton]

Problem

docs-hygiene:audit-progressive-disclosure (0.23.1) proposes treatments without checking whether the target file is owned upstream or whether a recorded decision set its tier. A session following the skill can offer an edit that the next sync reverts.

Observed in the melodic-software/.github hygiene sweep (melodic-software/.github#153): the audit flagged .claude/rules/pr-body-contract.md as tier-mismatch (always-loaded, only relevant at PR time) and the session offered "move it out of .claude/rules/". The file is sync-managed from melodic-software/standards (distribution/sync-manifest.yml), and standards ADR-0008 made it always-loaded on purpose. The consumer repo says the file is synced in README.md:66 and in the .claude/ai-slop.json _comment, both outside the audited targets (CLAUDE.md .claude/). The synced file itself carries no marker. The correct disposition was an upstream issue (melodic-software/standards#641).

Evidence

• SKILL.md:51 (tier-mismatch row) and hard rules SKILL.md:98-114: no ownership or decision check before a treatment. "Skip surfaces" (SKILL.md:110) excludes only vendor/.
• context/tier-model.md:30-33: the "must apply broadly, in every session" test has no exemption for a recorded reason to stay always-loaded.
• scripts/detect.sh emits no ownership fact.
• Secondary (low): SKILL.md:101-102 says Tier 3 carries no treatment, and the tier-mismatch row allows only T1/T2, but nothing in the output schema enforces it; the session emitted a T3 with a treatment.
• No shared ownership check exists to reuse. Partial, skill-local precedents: audit-noise/SKILL.md:141 (vendored-verbatim baseline, dismissed rather than redirected), audit-derivability/context/rubric.md:179 (check git log for a recorded decision), extract-ssot/context/lessons.md Lesson 14 (generator-owned regions). compress, audit-derivability, and extract-ssot share the exposure (inferred, not run).
• claude plugin validate and skill-quality:check both pass; this is a behavioral gap, not a static one.

Proposed fix (cheapest first)

1. SKILL.md hard rule next to "Skip surfaces": before any treatment, grep the repo for the target path near synced|sync-managed|vendored|generated|upstream, and check docs/adr/ / docs/decisions/. On a hit, keep the finding and set its treatment to "file with the owner, citing the decision". Bash(grep:*) is already allowed.
2. context/tier-model.md "Boundaries": a recorded reason to stay always-loaded (for example, sessions without the plugin must see it) satisfies the every-session test.
3. Eval case in evals/evals.json: an always-loaded synced rule expects an "upstream" disposition and no local edit.
4. Lift the rule into a plugin-root context/upstream-ownership.md and point compress, audit-derivability, extract-ssot, and audit-noise at it, as SKILL.md:82 already does for clean-tree-fallback.md.
5. (Larger) a consumer-declared ownership key that detect.sh reports.

Add a Gotchas line: the ownership statement usually lives outside the audited targets (a README inventory, a tool config comment).

Acceptance

• Re-running the skill on melodic-software/.github with targets CLAUDE.md .claude/ routes the pr-body-contract.md finding to the owner instead of proposing a local move.
• A Tier 3 row never carries a treatment.

Audit packet: plugin-quality evidence run 20260928T150734Z (local to the auditing machine).

[kyle-sexton]

This was generated by AI during triage.

Agent Brief

Type: Bug
Summary: audit-progressive-disclosure never proposes a local edit for an upstream-owned or decision-tiered file.

Current behavior:
The tier-mismatch finding and the skip-surfaces list have no ownership or recorded-decision check, so the audit proposes treatments for synced, vendored or generated files.

Desired behavior:
A hard rule: before proposing a treatment, check for synced/vendored/generated/upstream markers and recorded decisions (docs/adr); such files get an upstream disposition that files with the owner citing the decision. The tier model states the exemption. Tier 3 rows never carry a treatment.

Acceptance criteria:

• An eval case with a synced always-loaded rule expects an upstream disposition.
• A Tier 3 row never carries a treatment.

Out of scope:

• A shared ownership context file across the four sibling docs-hygiene skills and a detect.sh key (separate issue).

[kyle-sexton]

This was generated by AI during triage.

Decision defaulted: ship fixes 1-3 and enforce Tier-3-no-treatment; defer the shared context file and detect.sh key to a separate issue — veto before merge
Basis: judgment, smallest reversible fix; the deferred item crosses four skills

[kyle-sexton]

Owner decision (2026-09-30): Close #5173 as completed. PR #5437 (merged, commit 74843a9) shipped fixes 1-3 and the Tier-3-no-treatment rule, which is the scope the 2026-09-29 triage decision set. Verified on origin/main: plugins/docs-hygiene/skills/audit-progressive-disclosure/SKILL.md carries the Ownership check hard rule (synced|sync-managed|vendored|generated|upstream grep, docs/adr and docs/decisions check, upstream disposition, Treatment "file with the owner, citing the decision") and states that a Tier 3 row's Treatment cell is only "awareness only"; evals/evals.json has the synced-rule fixture (eval 8). The items the triage brief put out of scope (shared ownership context file for compress, audit-derivability, extract-ssot and audit-noise; a detect.sh ownership key) have no separate issue and stay deferred. Residual gaps disclosed in PR #5437: eval 8 was never run against a model, and no eval fixture exercises a Tier 3 row. Both are follow-up quality items, not blockers. Nothing here needs credentials.

Approved by the owner with all consensus recommendations on 2026-09-30 (three read-only researchers, majority or judge).

Next: closing as completed. File one follow-up issue for the deferred shared context file and detect.sh key if wanted; otherwise they stay declined.