[kyle-sexton]

No related issue: closes the review exemption #12601 opened for #12558's one-time add

Hold: merge only after #12558 is on main. Until then this carries do-not-merge; merging it first would leave #12558's review partial again.

Summary

Removes verify-legacy-fails.json from scripts/review-generated-data.txt, so both review lanes read every later change to it in full.

Fix

• ci(review): count the legacy FAILs file as read through generated-data #12601 listed the file so feat(source-control): commit the legacy FAILs file to turn on FAIL index mode #12558's review could count the 184 KB add as read. The listing was only for that add.
• The file's loader checks structure, not content (babysit_verify_evidence.py Reader._legacy). An exempt rewrite over the 7500-byte floor could therefore drop FAIL records unreviewed, which the security lane flagged on ci(review): count the legacy FAILs file as read through generated-data #12601.
• With the entry gone, a small edit is reviewed and a whole-file rewrite fails the lanes as partial.

Verification

• The list file keeps its header and no entries, which declares nothing (ci-workflows#971: an empty list exempts nothing).

Related

• feat(source-control): commit the legacy FAILs file to turn on FAIL index mode #12558: adds the file.
• ci(review): count the legacy FAILs file as read through generated-data #12601: the listing this removes.
• ci-workflows#971: the generated-data input.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VcupomBPg7kuobwLoNpxEW

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T03:12:10.690183Z	1ef80fb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 1ef80fb925b54867955b1afe8dc6e197b915b3c8: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Code review: no findings

Scope: I read the full diff. It changes one file, scripts/review-generated-data.txt, and deletes its only entry, plugins/source-control/skills/babysit-prs/verify-legacy-fails.json.

Checks:

• The file now holds only its header comment. The header still describes how the list is meant to work: a path stays listed only while the commit that adds the file lands, and later edits get a full review. Removing the entry follows that rule.
• Two workflows use the list, both as the generated-data input: .github/workflows/pr-review-hosted.yml:247 and .github/workflows/pr-review-security-hosted.yml:247. The header says the list is read at the merge base. So the removal takes effect only once this PR is on main, and it does not affect how this PR itself is reviewed.
• No script or test in scripts/ reads the list, so nothing breaks when it has no entries. The PR says an empty list exempts nothing, citing ci-workflows#971. That claim comes from the author and I did not verify it.

Merge order: The PR description says to merge only after #12558 is on main, and that a do-not-merge label enforces this. That is a sequencing decision for a person. The diff itself is correct either way.

Prior findings: none. Round 0 of 3, so the round cap does not apply.

Spend: none.

[github-actions]

claude-security-review reviewed 1ef80fb925b54867955b1afe8dc6e197b915b3c8: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #12632

No security issues found.

What changed: the PR deletes one line from scripts/review-generated-data.txt: plugins/source-control/skills/babysit-prs/scripts/verify-legacy-fails.json. That file lists generated data the review lanes count as read without reading them (the ci-workflows generated-data input).

Effect on review coverage: this makes review stricter, not looser. After the change, any later edit to verify-legacy-fails.json gets read in full. A whole-file rewrite would fail the lanes as partial, so it could not pass unread. The file now has only its six-line comment header and no entries, so it exempts nothing (head file).

Trust controls:

• scripts/review-generated-data.txt matches none of the listed trusted-path globs.
• The change adds no trusted actor and grows no token scope.
• No new untrusted text reaches a credentialed lane, and no merge hold is weakened.
• No plugin manifest is touched.

Ordering note (not a finding): the PR description says this should merge only after #12558 is on main and that it carries do-not-merge until then. Merging it first would make #12558's review partial, but that is a coverage effect and not a security risk. The ordering is up to the owner and their label.

No embedded instructions were found in the PR context.

critical-findings: 0

[github-actions]

Post-merge mutation testing

• Range: 67b9d57..2b9cbd9
• Merged pull request: #12632
• Outcome: reported

Killed 6, survived 1, timeout 0, no coverage 0, invalid 0, not run 0.
Covered-code score 86%; mutation score 86%.

File	Killed	Survived	Timeout	No coverage	Invalid	Not run
.github/scripts/maintenance-code-tidying-upkeep/upkeep.mjs	2	1	0	0	0	0
plugins/code-tidying/skills/tidy/scripts/open-pr-count.sh	1	0	0	0	0	0
plugins/code-tidying/skills/tidy/scripts/upkeep-setting.sh	3	0	0	0	0	0

Surviving mutants

Location	Operator	Disposition	Cause
.github/scripts/maintenance-code-tidying-upkeep/upkeep.mjs:109	ROR	productive	input-gap

The run's summary has the full report.