feat(plugins): rule the overlap candidates the fixed inventory surfaced

[kyle-sexton]

No related issue: follow-up to #5619, whose inventory fix exposed new and changed native descriptions on Claude Code 2.1.285.

Summary

After #5619, overlap.py detect on the 2.1.285 extraction listed 17 unruled pairs plus 12 dismissals that resurfaced because their native description text changed. This PR rules all 29: 12 re-dismissed, 14 dismissed, 3 route rows, 0 defer. Detect now reports 0 unruled and 0 resurfaced.

Native (class)	Component	Ruling	Reason
EnterWorktree (builtin-tool)	source-control:worktree	route row, complementary	Ours creates at an external root (never by name) and enters existing worktrees only after its claim check, both ending in EnterWorktree(path:)
ExitWorktree (builtin-tool)	source-control:worktree	route row, complementary	Tool leaves a worktree session; ours removes worktrees (cleanup)
ProposeGoal (builtin-tool)	planning:draft-goal-condition	route row, complementary	Ours drafts the condition and always emits the /goal line; it also proposes through the tool (ask_user true) in an interactive main-thread session outside plan mode, within the tool cap
ClaudeDesign (builtin-tool)	planning:design-handoff	dismissed	Design canvas projects vs. software design gate; shared word
ClaudeDesign	planning:design	dismissed	Canvas projects vs. types/contracts design; shared word
ClaudeDesign	evals:design	dismissed	Canvas projects vs. eval suite design; shared word
DesignSync (builtin-tool)	dometrain:sync	dismissed	Design-system sync vs. vendored-content drift check; shared word
DesignSync	repo-fleet-hygiene:sync	dismissed	Design-system sync vs. fleet checkout sync; shared word
ProposeGoal	performance:goal	dismissed	Session goal vs. performance target; shared word
ReadNotifications (builtin-tool)	desktop-notification:setup	dismissed	Queued webhook notifications vs. notification hook setup; shared word
ReportFindings (builtin-tool)	improvement:find	dismissed	Renders code-review findings in the host UI vs. ranks improvements; shared words
TestingPermission (builtin-tool)	claude-config:audit-permission-grants	dismissed	Internal test tool that always asks permission; shared word
TestingPermission	claude-config:audit-permission-state	dismissed	Same
TestingPermission	testing:test-value	dismissed	Same
TodoWrite (builtin-tool)	work-items:scan-todos	dismissed	Session checklist vs. TODO comment sweep; shared word
WaitForMcpServers (builtin-tool)	discipline:wait-what	dismissed	MCP connection wait vs. re-pitching a message; shared word
config (builtin-command)	claude-config:audit-permission-grants	dismissed	Settings UI vs. permission-grant audit; shared word
Bash (builtin-tool)	bash-format:setup	re-dismissed	Original reason holds: runs commands vs. formatter hook setup
Bash	bash-format:check	re-dismissed	Original reason holds: runs commands vs. binary check
PowerShell (builtin-tool)	powershell-format:setup	re-dismissed	Original reason holds
PowerShell	powershell-format:check	re-dismissed	Original reason holds
Workflow (builtin-tool)	session-flow:workflow	re-dismissed	Resolved text is the Workflow script reference; still a shared word
Workflow	songwriting:workflow	re-dismissed	Same
code-review (bundled-skill)	review:security-review	re-dismissed	Still correctness review vs. CI security lane; security pair recorded separately
config	claude-config:audit	re-dismissed	Now "Open settings"; still preferences UI vs. settings audit
config	claude-config:audit-permission-state	re-dismissed	Same
memory_read (builtin-tool)	claude-memory:audit	re-dismissed	Session memory store vs. CLAUDE.md/rules audit
workflow-authoring (bundled-skill)	playbooks:skill-authoring	re-dismissed	Workflow scripts vs. SKILL.md authoring
workflow-authoring	songwriting:workflow	re-dismissed	Workflow scripts vs. songwriting router

Fix

• docs/native-surfaces/records.json: 3 rows and 26 dismissal records; docs/native-surfaces.md regenerated.
• source-control:worktree: description phrase (source-control's route rows carry phrases), ## Boundary naming EnterWorktree and ExitWorktree, reference/native-worktree.md. Version 0.69.0.
• planning:draft-goal-condition: Boundary extended to ProposeGoal, Step 4 pointer, records in reference/native-goal.md. No description phrase, matching planning's other route row. Version 0.56.0.
• ProposeGoal's ask_user, 500-character cap, and session restrictions were read from the 2.1.285 binary's tool prompt; the tool is not on the tools reference.

Verification

• overlap.py detect --inventory <2.1.285 json> --repo .: 0 unruled, 0 resurfaced.
• overlap.py generate --check: in sync (69 rows, 93 dismissals). overlap.py self-check: degraded with the 2 advisories main already carries (recorded versions older than 2.1.286, upstream SHA not checked), no failures.
• node scripts/generate-catalog.mjs: no change. check-skill.sh PASS for worktree and draft-goal-condition. markdownlint clean.

Related

• fix(claude-ops): resolve built-in descriptions the inventory left unresolved #5619 (inventory fix that surfaced these)
• claude-ops inventory: replace the regex bundle reader with a JavaScript parser #5640 (parser follow-up)

🤖 Generated with Claude Code

[claude]

Claude finished @kyle-sexton's task in 33s —— View job

---

Security review complete

• Gather context (PR diff, changed files)
• Run skip-gate check
• Review changed files for security-relevant surface
• Check instruction-surface deletions against protected classes
• Report findings

No security issues found.

This PR is documentation and plugin-skill metadata only: docs/native-surfaces.md and docs/native-surfaces/records.json (data rows recording tool/skill overlap rulings), two SKILL.md files, two new reference/native-*.md verification-record files, two plugin.json version bumps, and two CHANGELOG.md entries. There is no code execution path, no credential or secret handling, no injection surface (command/SQL/path/template), and no GitHub Actions workflow touched.

The ## Boundary sections added to plugins/planning/skills/draft-goal-condition/SKILL.md and plugins/source-control/skills/worktree/SKILL.md are additive — they introduce new routing guidance for the ProposeGoal/EnterWorktree/ExitWorktree built-in tools alongside the existing skill behavior. No standing instruction, guardrail, or mutation gate is deleted, narrowed, or softened by this diff: the "Mutation gate" paragraphs are preserved and, if anything, tightened (e.g. draft-goal-condition's gate now explicitly also covers ask_user false). The instruction-exception-register lens was applied; no removed rule qualifies as a finding.

[claude]

Claude finished @kyle-sexton's task in 6m 3s —— View job

---

Code review complete

• Gather context (diff, CLAUDE.md, REVIEW.md)
• Review changed files for correctness / maintainability
• Post findings

This PR is a review:code-review CI lane pass per /review:code-review. Security is scoped out (a claude-security-review-hosted.yml lane exists in this repo).

Summary

This is primarily generated/data content (docs/native-surfaces/records.json + regenerated docs/native-surfaces.md) plus the two skills it routes into (source-control:worktree, planning:draft-goal-condition). I independently re-derived the record counts rather than trusting the PR body: records.json gained exactly 14 new dismissal entries and 12 re-dated (re-dismissed) ones, plus 3 new route entries — matching the PR's "12 re-dismissed, 14 dismissed, 3 route" claim exactly. The source-control:worktree Boundary section's EnterWorktree/ExitWorktree routing is consistent with the rest of the skill (e.g. create's existing pre-flight already told users to run ExitWorktree first).

I posted two findings on planning:draft-goal-condition's SKILL.md, both introduced by this PR's ProposeGoal routing:

1. Step 3's length check validates against the wrong limit for the new ProposeGoal path. I fetched the live /goal docs page and confirmed its condition limit is actually 4,000 characters, while ProposeGoal's own cap (recorded in this PR's reference/native-goal.md) is 500 characters. Step 3 only checks against the 4,000-char limit, so a condition between 501–4,000 chars will pass the skill's own "counter-passed" gate and then be rejected by ProposeGoal in Step 4, which has no fallback handling for that case.
2. Minor wording inconsistency between Step 4 ("Emit ... as a paste-ready invocation", unconditional) and the Boundary's Routing paragraph (paste-ready line offered only when ProposeGoal "does not resolve or refuses"), both touched by this PR, leaving it unclear whether the /goal <condition> block still appears when ProposeGoal succeeds.

I could not execute overlap.py detect/generate/self-check, check-skill.sh, or markdownlint myself in this sandbox (non-git commands require approval I wasn't granted), so the PR body's verification claims for those are author-claimed and unverified by me; I instead independently cross-checked the JSON data and the ProposeGoal character-limit claim against the live docs, as noted above.
· Branch

[claude]

Claude finished @kyle-sexton's task in 1m 6s —— View job

---

Security review complete

• Gather context (PR diff, changed files)
• Run skip-gate check
• Review changed files for security-relevant surface
• Check instruction-surface deletions against protected classes
• Report findings

No security issues found.

This PR is documentation and plugin-skill metadata only, confirmed by diffing origin/main against this head limited to the PR's 10 changed files (570 insertions / 56 deletions, matching the PR body): docs/native-surfaces.md and docs/native-surfaces/records.json (generated overlap-ruling data), two plugin.json version bumps, two CHANGELOG.md entries, two SKILL.md files, and two new reference/native-*.md verification-record files. There is no code execution path, no credential/secret handling, and no injection surface (command/SQL/path/template) anywhere in the diff. No GitHub Actions workflow is touched.

The ## Boundary sections added to plugins/source-control/skills/worktree/SKILL.md and plugins/planning/skills/draft-goal-condition/SKILL.md are purely additive routing guidance for the EnterWorktree/ExitWorktree/ProposeGoal built-in tools. I applied the instruction-exception-register lens (the register README is present at docs/conventions/instruction-exception-register/README.md and was read): no standing instruction, guardrail, or mutation gate is deleted, narrowed, or softened here. If anything, both Mutation gate paragraphs are tightened by this PR — draft-goal-condition's now explicitly also forbids setting ask_user false, and worktree's now explicitly scopes EnterWorktree/ExitWorktree to directory changes only, reserving deletion for cleanup under its own confirmation.

This PR's latest commit (0acd82a) also resolves the two correctness findings a prior code-review pass on this PR raised (the Step 3 length check now re-runs at ProposeGoal's 500-char cap before proposing, and the paste-ready /goal line is now unconditionally emitted) — those are correctness fixes, not security-relevant, and are noted here only for completeness.
· Branch

[claude]

Claude finished @kyle-sexton's task in 2m 24s —— View job

---

Code review complete

• Gather context (diff, CLAUDE.md, REVIEW.md)
• Run skip-gate check
• Review changed files for correctness/maintainability
• Verify candidate findings adversarially
• Post findings

Summary

This PR is a review:code-review CI lane pass per /review:code-review. Security is scoped out (a dedicated security lane runs in this repo).

New commit 0acd82a landed since the prior review on this PR (which had flagged two issues on planning:draft-goal-condition's SKILL.md: Step 3's length check validating against the wrong limit for the ProposeGoal path, and a wording inconsistency over whether the paste-ready /goal line still shows when ProposeGoal succeeds). I re-reviewed the delta.

Both prior findings are correctly resolved:

• Step 4 now re-runs the length counter at ProposeGoal's own 500-character cap (--limit 500) before proposing through the tool, so a condition that only "passes Step 3" at the live 4,000-char /goal limit can no longer be handed to a tool that will reject it — SKILL.md:94-98. I confirmed goal-condition-length.sh takes an arbitrary --limit, so this is mechanically sound.
• Step 4 and the Boundary's Routing paragraph now agree: the paste-ready /goal <condition> line is always emitted, and ProposeGoal is additionally used only when it resolves and the condition passes the tool's own cap — SKILL.md:118-122.

New finding posted inline on reference/native-goal.md:15: SKILL.md's new Step 4 text cites the 500-character ProposeGoal cap as sourced "per reference/native-goal.md", but that file's verification-record table (added by this same PR) has no claim/basis/as-of/recheck row for the cap — only for ask_user defaults and refusal contexts. The 500-char figure is recorded instead in docs/native-surfaces.md/records.json. This breaks the citation the skill body makes to its own reference file, and leaves the cap as an undated, untraceable specific exactly where .claude/rules/skill-bodies-state-current-rules.md requires a four-part record.

The source-control:worktree portion of this PR was unchanged by the new commit and already passed the prior review; I did not re-review it.

Verification note: I could not run overlap.py, check-skill.sh, or markdownlint myself (no shell network/tool access in this pass), so the PR body's verification claims remain author-claimed and unverified by me. I did independently re-derive the diff stat (570/-56 across 10 files, matches) and the content of the changed files above via git diff/git show.
· Branch

[kyle-sexton]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0acd82a856

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-01T13:44:50.145137Z	6a97237	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 1m 9s —— View job

---

Security review complete

• Gather context (PR diff vs. base 96119e1, full stat matches PR body: 577/-56 across 10 files)
• Invoke /review:security-review and follow its instructions
• Review changed files for security-relevant surface, with extra attention to the newest commit 525b8a5
• Check instruction-surface deletions against protected classes (docs/conventions/instruction-exception-register/README.md is present and was read)
• Report findings

No security issues found.

This PR remains documentation and plugin-skill metadata only: docs/native-surfaces.md / docs/native-surfaces/records.json (generated overlap-ruling data), two plugin.json version bumps, two CHANGELOG.md entries, two SKILL.md files, and two reference/native-*.md verification-record files. No code execution path, no credential/secret handling, no injection surface (command/SQL/path/template), and no GitHub Actions workflow is touched.

The latest commit, 525b8a5, addresses the Codex P1 finding from the prior round by routing existing-worktree entry through source-control:worktree's claim gate before EnterWorktree(path:), rather than letting routing text send that case straight to the built-in tool. I checked that the check-enter step the new Routing text points to actually exists in the skill (SKILL.md:118-126) and is wired correctly — this closes the concurrent-entry gap the Codex comment described, it does not introduce one. The same commit also tightens planning:draft-goal-condition's ProposeGoal routing to require main-thread/interactive/non-plan-mode conditions (addressing Codex's P2 suggestion), consistent with the Boundary section's own description of the tool's refusal conditions and with its unchanged Mutation gate ("This skill never sets ask_user false, and never sets, replaces, or clears a goal on the person's behalf" — SKILL.md:126-128).

Applying the instruction-exception-register lens to this commit and the PR as a whole: no standing instruction, guardrail, or mutation gate is deleted, narrowed, or softened. Both ## Boundary/Routing edits in this PR only add restrictions on when a native tool may be used (claim-gate-first for worktree entry; main-thread/non-plan-mode for ProposeGoal), which is a tightening, not a weakening, of the existing controls.
· Branch

[claude]

Claude finished @kyle-sexton's task in 2m 54s —— View job

---

Code review complete

• Gather context (diff, CLAUDE.md/AGENTS.md, prior review threads)
• Invoke /review:code-review and follow its instructions
• Review the delta introduced by the latest commit (525b8a5)
• Post findings as inline PR review comments

Summary

This is a review:code-review CI lane pass (security scoped out to the dedicated lane). HEAD is 525b8a5, new since the prior two review rounds on this PR, so skip gate doesn't apply. That commit addresses both Codex findings from the previous round:

• Worktree claim gate (P1): source-control:worktree's description and Boundary/Routing text no longer tell the model to call the built-in EnterWorktree(path:) directly for an existing worktree; entering now routes through this skill's check-enter claim check first. Verified against SKILL.md:202-207 and the pre-existing check-enter procedure it now points back to.
• ProposeGoal in plan mode (P2): planning:draft-goal-condition's Step 4 and Boundary/Routing now gate the ProposeGoal call on "main thread of an interactive local session (not a subagent), plan mode is not active," matching the restrictions reference/native-goal.md records for the tool (SKILL.md:119-124).

Both of the earlier Claude-lane findings on this file (Step 3's wrong length limit, and the paste-ready-line ambiguity) were already fixed in the prior commit (0acd82a) and remain fixed.

One finding from the prior round is not yet resolved — posted inline on reference/native-goal.md:15: SKILL.md still cites the 500-character ProposeGoal cap as sourced "per reference/native-goal.md," but that file's verification table has no row recording that number (it's only in docs/native-surfaces.md/records.json). 525b8a5 fixed the other two findings on SKILL.md but didn't touch this file, so the citation still resolves to nothing.

New finding, lower severity, posted inline on plugins/planning/CHANGELOG.md:14: the still-unreleased [0.55.0] entry doesn't mention the subagent/plan-mode gate 525b8a5 just added to SKILL.md's ProposeGoal routing, unlike the sibling source-control CHANGELOG, which was updated in-place in the same commit for its equivalent change.

Verification note: I did not run overlap.py, check-skill.sh, or markdownlint myself (no shell execution available to me in this pass beyond git/grep/file reads); the PR body's and prior reviewers' verification claims for those tools remain author-claimed and unverified by me. I independently re-derived the diff for 525b8a5 via git show and cross-checked both fixes and the carried-over citation gap against the current file contents.
· Branch

[kyle-sexton]

@codex review

[kyle-sexton]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ac52778738

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kyle-sexton]

@codex review

[claude]

Claude finished @kyle-sexton's task in 3m 26s —— View job

---

Code review complete

• Gather context (PR diff, prior review threads, CLAUDE.md/AGENTS.md)
• Invoke /review:code-review and follow its instructions
• Review the delta since the last reviewed commit (525b8a5)
• Post findings as inline PR review comments
• Final summary

Summary

This is a review:code-review CI lane pass (security scoped out to the dedicated lane). HEAD is 1bf500e. New since the last Claude review round (which covered 525b8a5): 6202b39 (unrelated upstream commit, merged in — see below), ac52778, b0b660a, and the merge commit 1bf500e itself.

I re-derived the PR's actual commit set rather than trusting git log across the merge at face value: 6fee9db, 0acd82a, 525b8a5, ac52778, b0b660a, and the merge 1bf500e are this PR's own 6 commits; 6202b39, 7af7062, and 4bb1d8e are unrelated commits from main that 1bf500e pulled in and are interleaved in git log only because this is a real merge, not a rebase. I confirmed the merge itself is clean for this PR's files: plugins/planning/.claude-plugin/plugin.json and plugins/source-control/.claude-plugin/plugin.json still read 0.55.0/0.69.0 with no duplicate CHANGELOG entries, and a conflict-marker grep across plugins/planning, plugins/source-control, and the docs/native-surfaces* files came back clean. docs/native-surfaces.md and docs/native-surfaces/records.json are byte-identical from 525b8a5 onward (not touched by this round's commits), so I relied on the prior rounds' already-verified count match for those rather than re-deriving it.

Both fixes in this round's two PR-authored commits check out:

• ac52778 added the missing four-part verification record for ProposeGoal's 500-character cap to reference/native-goal.md:15, resolving the citation gap two prior review rounds flagged. SKILL.md's Step 4 citation to that file now resolves to a real row.
• b0b660a closes the Codex P2 finding (tab expansion understating the tool's cap): SKILL.md:98-99 now withholds the ProposeGoal call from any condition containing a tab character, and reference/native-goal.md:15's cap row was updated in the same commit (ac52778, landed first) to record that the tool measures "after canonicalizing for display (tabs expand to spaces)" — the two files agree. goal-condition-length.sh itself intentionally counts raw characters with no tab expansion, so gating in the skill body (rather than the script) is the right place for this check.

New finding, posted inline on plugins/planning/CHANGELOG.md:13: the still-unreleased [0.55.0] entry lists three ProposeGoal gating conditions but not the tab exclusion b0b660a added as a fourth. This is the same gap class a prior round flagged on this identical entry (missing the main-thread/plan-mode gates), which the author fixed in-place via ac52778 — b0b660a landed after that fix but didn't touch the changelog, so the entry is incomplete again.

The source-control:worktree portion of this PR is untouched since 525b8a5 (already reviewed and fixed); I re-read SKILL.md's Boundary/Routing section and confirmed the claim-gate-before-EnterWorktree(path:) fix still holds.

Verification note: I could not run overlap.py, check-skill.sh, node scripts/generate-catalog.mjs, or markdownlint myself (non-git shell commands required approval I wasn't granted in this pass); the PR body's verification claims for those remain author-claimed and unverified by me. I independently verified JSON/merge integrity via git diff/git grep and cross-checked the two new commits' content directly against the file contents above.
· Branch

[claude]

Claude finished @kyle-sexton's task in 59s —— View job

---

Security review complete

• Gather context (PR diff vs. origin/main's merged-in state 6202b39, confirmed against the local, shallow checkout since origin/main...HEAD has no merge base here; diffstat matches the PR body exactly: 580/-56 across 10 files)
• Invoke /review:security-review and follow its instructions
• Review changed files for security-relevant surface
• Check instruction-surface deletions against protected classes
• Report findings

No security issues found.

This PR remains documentation and plugin-skill metadata only: docs/native-surfaces.md / docs/native-surfaces/records.json (generated overlap-ruling data), two plugin.json version bumps, two CHANGELOG.md entries, two SKILL.md files, and two reference/native-*.md verification-record files. No code execution path, no credential/secret handling, no injection surface (command/SQL/path/template), and no GitHub Actions workflow is touched.

HEAD (1bf500e) adds two commits since the prior security-review pass on this PR (which covered through 525b8a5): ac52778 (adds the four-part verification row for ProposeGoal's 500-character cap to reference/native-goal.md) and b0b660a (skips the ProposeGoal proposal when the drafted condition contains a tab character, since the tool expands tabs before counting and the skill's raw-text counter would otherwise understate the length). Both are doc/guard tightening, not weakening: b0b660a closes a gap where a tab-containing condition could pass the skill's own length gate and still be rejected by the tool, and ac52778 only adds a recorded claim/basis/as-of/recheck row, matching what the prior review round asked for.

Applying the instruction-exception-register lens (docs/conventions/instruction-exception-register/README.md is present in this checkout and was read) across the full PR diff against the merged-in main state: no standing instruction, guardrail, or mutation gate is deleted, narrowed, or softened. Both ## Boundary sections this PR adds (plugins/source-control/skills/worktree/SKILL.md, plugins/planning/skills/draft-goal-condition/SKILL.md) only add restrictions on when a native tool may be used (claim-gate-first for worktree entry via EnterWorktree(path:); main-thread/non-plan-mode/tab-free/within-cap for ProposeGoal), and both Mutation gate paragraphs remain intact and explicit that the model never arms a goal or deletes a worktree on the person's behalf.
· Branch

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1bf500eb77

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kyle-sexton]

@codex review

[claude]

Claude finished @kyle-sexton's task in 3m 31s —— View job

---

Code review complete

• Gather context (PR diff, prior review threads, CLAUDE.md/AGENTS.md)
• Invoke /review:code-review and follow its instructions
• Review the delta since the last reviewed commit (1bf500e)
• Post findings as inline PR review comments
• Final summary

Summary

This is a review:code-review CI lane pass (security scoped out to the dedicated lane). HEAD is f58c28e, a merge of origin/main (bringing in 8f9a939, an unrelated planning-interview-ledger commit, #5652) into this branch since the last reviewed commit 1bf500e. The merge commit's own message records a conflict only in plugins/planning/CHANGELOG.md; I confirmed no leftover conflict markers anywhere under plugins/planning or plugins/source-control.

All four findings carried over from prior rounds on this PR are now resolved at f58c28e:

1. Step 3's length check vs. ProposeGoal's cap — fixed in 0acd82a (still holds).
2. Paste-ready /goal line ambiguity — fixed in 0acd82a (still holds).
3. The 500-char ProposeGoal cap citation in SKILL.md resolving to nothing in reference/native-goal.md — fixed in ac52778 (still holds: reference/native-goal.md:15 now carries the row).
4. The unreleased [0.55.0] CHANGELOG entry undercounting ProposeGoal's gating conditions (missing the tab exclusion b0b660a added) — resolved by this merge's conflict resolution: plugins/planning/CHANGELOG.md:6-15 now carries the fix as a renumbered [0.56.0] entry (conflicting with #5652's own unrelated 0.55.0 entry, which is kept intact below it), and does name all four gates including "contains no tab." plugins/planning/.claude-plugin/plugin.json is bumped to match (0.56.0).

Also now resolved, Codex's P1 finding from the last round ("Add upstream pointers to binary-derived tool records"): both reference/native-goal.md:14-15 and reference/native-worktree.md:9-11 now cite the official tools-reference page (or explicitly note its absence) alongside the binary-extraction basis. This content arrived in this branch via the merge: 8f9a939 (#5652) already contained it, evidently built from a later state of this same work.

I re-derived plugin.json/CHANGELOG.md version alignment directly rather than trusting it: planning is 0.56.0 matching its CHANGELOG header, source-control is 0.69.0 matching its CHANGELOG header. I spot-checked docs/native-surfaces/records.json for the ProposeGoal rows (exactly 2: the draft-goal-condition route row and the performance:goal dismissal, matching the PR body, no duplicates from the merge) and for leftover conflict markers (none).

Verification note: I could not execute overlap.py, check-skill.sh, node, or python3 myself in this pass (non-git shell commands required approval I wasn't granted); the PR body's and prior reviewers' tool-verification claims remain author-claimed and unverified by me. I verified the above through direct file reads, git diff/git show against origin/main, and grep for conflict markers.

No new findings. · Branch

[claude]

Claude finished @kyle-sexton's task in 1m 17s —— View job

---

Security review complete

• Gather context (PR diff vs. origin/main, prior review threads; diffstat matches PR body exactly: 583/-56 across 10 files)
• Invoke /review:security-review and follow its instructions exactly
• Review changed files for security-relevant surface, with focus on the delta since the last reviewed head
• Check instruction-surface deletions against protected classes
• Report findings

No security issues found.

HEAD is f58c28e, a merge of origin/main since the last security-review pass on this PR (which covered through 1bf500e). I isolated the merge commit's effect on this PR's 10 files with git diff 1bf500e..f58c28e -- <PR files>: it touches exactly four of them, and only to add upstream citations —

• plugins/planning/skills/draft-goal-condition/reference/native-goal.md:15-16 and plugins/source-control/skills/worktree/reference/native-worktree.md:9-11 now note "no upstream page documents the tool" / add the upstream tools-reference URL to the EnterWorktree/ExitWorktree basis column, resolving Codex's P1 "add upstream pointers" finding from the 1bf500e round.
• plugins/planning/.claude-plugin/plugin.json bumps 0.55.0 → 0.56.0, and plugins/planning/CHANGELOG.md's merge conflict resolves by keeping both the unrelated 0.55.0 entry pulled in from main and folding this PR's tab-exclusion changelog bullet into a new 0.56.0 entry — no content lost, no entry dropped.

No other PR file changed in this merge: SKILL.md for both skills, docs/native-surfaces.md/records.json, and source-control's plugin.json/CHANGELOG.md are byte-identical to the state the 1bf500e review already covered, so I relied on that round's already-verified analysis for those rather than re-deriving it.

This remains documentation and plugin-skill metadata only: no code execution path, no credential/secret handling, no injection surface (command/SQL/path/template), and no GitHub Actions workflow touched. Applying the instruction-surface lens (docs/conventions/instruction-exception-register/README.md is present in this checkout and was read) to this delta specifically: neither touched reference file is a ## Boundary, Mutation gate, or other standing-instruction surface — both are append-only citation/basis columns in verification-record tables, and no ## Boundary/Routing/Mutation-gate text changed in this commit. The full-PR instruction-surface analysis from the prior rounds (both ## Boundary sections only add restrictions on native-tool use, tightening rather than weakening) still applies unchanged, since those files weren't touched here.
· Branch

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: f58c28e8b7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kyle-sexton]

@codex review

[claude]

Claude finished @kyle-sexton's task in 1m 11s —— View job

---

Code review complete

• Gather context (PR diff, prior review threads, CLAUDE.md/AGENTS.md)
• Invoke /review:code-review and follow its instructions
• Review the delta since the last reviewed commit (f58c28e)
• Post findings as inline PR review comments
• Final summary

Summary

This is a review:code-review CI lane pass (security scoped out to the dedicated lane). HEAD is 9723433, a merge of origin/main into this branch since the last Claude review round on this PR (which covered through f58c28e).

I scoped the delta to this PR's own 10 files rather than the whole merge: git diff f58c28e..9723433 --stat -- <10 PR files> touches exactly two of them —

• plugins/planning/CHANGELOG.md gains two unrelated upstream entries ([0.55.2], [0.55.1], from #5652's merge) inserted below this PR's own [0.56.0] entry.
• plugins/source-control/CHANGELOG.md gains one unrelated upstream entry ([0.68.2]) inserted below this PR's own [0.69.0] entry.

Both insertions land in correct descending version order, with no duplicate or out-of-order entries, and I confirmed each plugin.json version (planning 0.56.0, source-control 0.69.0) still matches its CHANGELOG's own top entry. No conflict markers remain in either file. None of this PR's other 8 files (SKILL.md × 2, reference/native-*.md × 2, plugin.json × 2, docs/native-surfaces.md, docs/native-surfaces/records.json) changed in this merge — they're byte-identical to the f58c28e state that prior rounds already reviewed and found clean (all four earlier findings — Step 3's wrong length limit, the paste-ready-line ambiguity, the unresolved reference/native-goal.md citation, and the CHANGELOG gating-condition undercounts — were fixed in prior commits and remain fixed).

The full-PR diff stat (git diff origin/main...HEAD) still matches the PR body exactly: 583 insertions / 56 deletions across 10 files.

No new findings.

Verification note: I could not execute overlap.py, check-skill.sh, node, or python3 myself in this pass (non-git shell commands required approval I wasn't granted); the PR body's and prior reviewers' tool-verification claims remain author-claimed and unverified by me. I verified the above through git diff/git log against origin/main and f58c28e, direct file reads, and a grep for conflict markers.
· Branch

[claude]

Claude finished @kyle-sexton's task in 1m 3s —— View job

---

Security review complete

• Gather context (PR diff, changed files)
• Invoke /review:security-review and follow its instructions exactly
• Review changed files for security-relevant surface
• Check instruction-surface deletions against protected classes
• Report findings

No security issues found.

Skip gate applies (condition 3): this head already has a successful security review that still applies. HEAD is 9723433 (merge of origin/main's 6908075 into this branch), the only new commit since the last security-review pass on this PR (which covered through f58c28e).

I independently re-derived this rather than trusting the merge: git diff origin/main...HEAD --stat limited to this PR's own 10 files still reports exactly 583 insertions / 56 deletions across 10 files — identical to the PR body's own totals and to what the f58c28e round already reviewed. The merge commit 6908075 touches none of this PR's substantive files; it only pulls in 81 unrelated files from main (an unrelated #5645 fix), and its only overlap with this PR's file set is appending unrelated, already-shipped entries ([0.55.1], [0.55.2] in plugins/planning/CHANGELOG.md; [0.68.2] in plugins/source-control/CHANGELOG.md) above or below this PR's own unchanged [0.56.0] / [0.69.0] entries during conflict resolution. I confirmed:

• No leftover conflict markers (<<<<<<</=======/>>>>>>>) anywhere under plugins/planning, plugins/source-control, or docs/native-surfaces*.
• This PR's own CHANGELOG content is byte-identical to what the f58c28e round reviewed, just renumbered to [0.56.0]/[0.69.0] (unchanged from f58c28e) to sit above the newly-merged-in unrelated entries.
• plugins/planning/.claude-plugin/plugin.json (0.56.0) and plugins/source-control/.claude-plugin/plugin.json (0.69.0) still match their respective CHANGELOG headers.

This PR remains documentation and plugin-skill metadata only: docs/native-surfaces.md / docs/native-surfaces/records.json (generated overlap-ruling data), two plugin.json version bumps, two CHANGELOG.md entries, two SKILL.md files, and two reference/native-*.md verification-record files. No code execution path, no credential/secret handling, no injection surface (command/SQL/path/template), and no GitHub Actions workflow touched. The full instruction-surface analysis from prior rounds (both ## Boundary sections only add restrictions on native-tool use — claim-gate-first for EnterWorktree/ExitWorktree, main-thread/non-plan-mode/tab-free/within-cap for ProposeGoal — tightening rather than weakening, with both Mutation gate paragraphs intact) still applies unchanged, since none of those files moved in this merge.
· Branch

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 97234334bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kyle-sexton]

@codex review

[claude]

Claude finished @kyle-sexton's task in 1m 49s —— View job

---

Code review complete

• Gather context (PR diff, prior review threads, CLAUDE.md/AGENTS.md)
• Invoke /review:code-review and follow its instructions
• Review the delta since the last reviewed commit (9723433)
• Post findings as inline PR review comments
• Final summary

Summary

This is a review:code-review CI lane pass (security scoped out to the dedicated lane). HEAD is 6a97237, one new commit since the last Claude review round on this PR (which covered through 9723433).

That commit, fix(source-control): record ExitWorktree's remove action and the lock check, addresses Codex's P2 finding from the 97234334bc round ("Gate the worktree-tool boundary on resolution"): the Boundary intro and Routing paragraph in plugins/source-control/skills/worktree/SKILL.md:190-209 are now explicitly conditional on each named tool resolving in the session ("When built-in worktree tools resolve...", "When ExitWorktree resolves...", "when EnterWorktree resolves...") rather than asserting the tools are shipped, matching the docs/conventions/native-references/README.md rule Codex cited.

The same commit also corrects a substantive accuracy gap: ExitWorktree actually takes an action parameter ("keep" vs. "remove", the latter deleting the worktree's branch too), which the prior SKILL.md/reference text didn't record. I checked this for internal consistency across all five touched files and found it sound:

• SKILL.md's Mutation gate now states this skill never passes action: "remove" and that only cleanup deletes a worktree — consistent with context/cleanup.md, which never calls ExitWorktree at all (it removes via its own git-level procedure).
• reference/native-worktree.md:12-13 carries proper four-part records (claim/basis/as-of/recheck) for both the new action claim and the lock-reason-matcher claim, satisfying .claude/rules/skill-bodies-state-current-rules.md.
• docs/native-surfaces.md and records.json's ExitWorktree/EnterWorktree reason text, evidence, and recheck triggers were updated in lockstep with the SKILL.md/reference changes — no drift between the three.
• plugins/source-control/CHANGELOG.md's still-unreleased [0.69.0] entry was amended in place (not re-versioned, correctly, since it hasn't shipped) to mention the action: "keep" specificity and the remove exclusion.

No new findings. All four prior-round findings on this PR remain resolved and unaffected by this delta (the draft-goal-condition portion of the PR is untouched since f58c28e).

Verification note: I could not execute overlap.py, check-skill.sh, node, or python3 myself in this pass (non-git shell commands required approval I wasn't granted); the PR body's and prior reviewers' tool-verification claims for those remain author-claimed and unverified by me. git diff origin/main...HEAD also fails here (no merge base, a shallow-clone artifact noted in earlier rounds too) — I instead diffed directly against the last-reviewed commit (9723433..6a97237) and read the changed files in full.
· Branch

[claude]

Claude finished @kyle-sexton's task in 38s —— View job

---

Security review complete

• Gather context (PR diff, changed files, trigger comment)
• Invoke /review:security-review and follow its instructions exactly
• Review changed files for security-relevant surface
• Check instruction-surface deletions against protected classes
• Report findings

No security issues found.

Skip gate applies (condition 3): this PR's head already has a successful security review covering everything except its single newest commit. HEAD is 6a97237 (fix(source-control): record ExitWorktree's remove action and the lock check), the only commit landed since the last security-review pass (which covered through 9723433). I scoped this round to that one commit's diff (git diff 9723433..6a97237 --stat: 5 files, +37/-25).

The new commit touches docs/native-surfaces.md, docs/native-surfaces/records.json, plugins/source-control/CHANGELOG.md, plugins/source-control/skills/worktree/SKILL.md, and plugins/source-control/skills/worktree/reference/native-worktree.md — all documentation and plugin-skill metadata. No code execution path, no credential/secret handling, no injection surface, and no GitHub Actions workflow touched.

The substantive change is a factual correction to the ## Boundary section at SKILL.md:188-217: the prior text claimed ExitWorktree "removes nothing," but the 2.1.285 binary's tool schema shows it takes an action — "keep" (no deletion) or "remove" (deletes the worktree and branch, refused for a worktree entered by path). The commit corrects the record and explicitly tightens the Mutation gate: "ExitWorktree with action: 'remove' deletes a worktree and its branch, so this skill never passes it. Only cleanup deletes a worktree, under its own confirmation." The Routing text now also pins the leave-step call to action: "keep" specifically, and both the description frontmatter and reference/native-worktree.md are updated to match. This closes a latent gap (a prior reader could have assumed ExitWorktree was always non-destructive and passed "remove" without realizing it) rather than opening one — a tightening, not a weakening, of the existing guardrail. records.json/docs/native-surfaces.md changes are the matching data-row updates (reason text, evidence, recheck trigger); no verdict or integration type changed.

Applying the instruction-exception-register lens (docs/conventions/instruction-exception-register/README.md is present in this checkout and was read) to this delta: no standing instruction, guardrail, or mutation gate is deleted, narrowed, or softened — the Mutation gate paragraph gains an explicit prohibition it previously lacked.

Branch ·

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 6a97237e10

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".