[kyle-sexton]

Refs: #12619

Summary

Replaces #12641, the work-resolve-issue lane's fold of audit-size, audit-complexity and
audit-type-debt into one code-metrics:audit router (wave 1 of the #12491 plan). The lane
could not finish it: main moved two generated docs under it, so the PR went DIRTY, and
pr-unblock's apply-conflict-patch failed twice. This branch merges #12641's head onto current
main, resolves the conflicts, settles its review thread, and finishes two items the lane was
denied.

Fix

Conflict resolutions:

• docs/skill-cheat-sheet.md: kept main's removal of the bash-format:check and
  biome-format:check rows and the branch's single /code-metrics:audit row in place of
  audit-complexity.
• docs/upstream/cursor-pstack.md: kept main's re-pinned rows (pin ae5650febf) and applied the
  branch's only change, the interrogate row's two code-metrics:audit-size references
  repointed to code-metrics:audit size and skills/audit/actions/size.md.
• Semantic check: main has no change under plugins/code-metrics since refactor(code-metrics)!: fold audit-size, audit-complexity and audit-type-debt into the audit router #12641's merge base, and
  no reference to the three removed skills remains outside changelogs and fragments.

Review thread:

• plugins/code-metrics/skills/audit/SKILL.md Spoke paths (claude-review, advisory): valid under
  .claude/rules/skill-bodies-state-current-rules.md. The section now states our decision in the
  same words as plugins/code-metrics/skills/principles/SKILL.md:146-153 and keeps the pointer,
  as-of date and recheck trigger.

Items #12641 listed as not done:

• .claude/skills/control-claude-code-plugins/features/code-metrics/README.md: Parts list names
  audit with its size, complexity and type-debt actions in place of the three leaf rows.
• plugins/code-metrics/README.md Listing budget: re-measured with check-listing-budget.sh on
  2026-11-03: five listing-eligible descriptions, 2,728 characters alone, marketplace aggregate
  141,819 with the plugin.
• .changes/skill-quality/...-8a92d296.md: the removed skill is named without a leading slash,
  as the sibling fragments do; the pre-push reference verifier read /code-metrics:audit-complexity
  as an invocation that must resolve.

Verification

• scripts/check-affected.sh --base origin/main --no-fetch: 15 passed, 0 skipped over 46 changed
  files.
• audit-size.test.sh 14/14, audit-complexity.test.sh 27/27, audit-type-debt.test.sh 41/41,
  audit-coverage.test.sh 48/48, scripts/test_check_code_metrics_skill_prose.py 5/5.
• plugins/skill-quality/scripts/check-skill.test.sh: all assertions passed.
• Not run: the eval non-inferiority comparison from refactor(code-metrics)!: fold audit-size, audit-complexity and audit-type-debt into the audit router #12641's remaining work, and the post-merge
  probe.

Related

• refactor(code-metrics)!: fold audit-size, audit-complexity and audit-type-debt into the audit router #12641 (replaced)
• refactor(code-metrics): audit router wave 1 of 5 (router, size, complexity, type-debt) #12619, refactor(code-metrics): give the six audit-* skills distinct, trimmed descriptions #12491

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vcupom3BKF6QuC5U3sRJPj

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T09:31:52.205891Z	db588ce	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: db588cef52

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-security-review reviewed d92b022661de900b4d95e37a71a747c4b5cce037: read 46 of 46 changed file(s); 0 finding(s), 0 as inline comments.

Chunk 1 of 2 (37 files)

Security review: chunk 1 of 2 (37 files)

I found no security issues in this chunk.

This chunk merges the audit-size, audit-complexity and audit-type-debt skills into one code-metrics:audit router with three actions. I read every hunk of all 37 files. Two renames are 100% similarity (audit-complexity.test.sh, audit-type-debt.test.sh); for those I read the rename header.

Since the last review of this lane (head db588cef), the only change the PR context names is a merge of main. It touched the audit-suppressions description, which now points at /code-metrics:audit complexity. That is description text only.

What I checked

• New router skill (plugins/code-metrics/skills/audit/SKILL.md):
  • allowed-tools: the grant is the union of the three removed skills' grants: Bash(${CLAUDE_SKILL_DIR}/scripts/audit-size.sh:*), audit-complexity.sh:*, audit-type-debt.sh:* and Bash(git branch --show-current:*). Each of those already existed in this plugin. The change adds no new command, wildcard or tool class.
  • Arguments: $ARGUMENTS reaches the same scripts under the same patterns.
  • Model invocation: disable-model-invocation: false is the same value the old skills had.
  • Pre-computed context: the git branch --show-current call is unchanged from the old skills.
  • Spoke paths: the <skill-dir> / <plugin-root> placeholders in the actions/ files only replace ${…} tokens in documentation. They change no grant and no execution path.
• Instruction-surface lens: the old "What this skill does not do" rules move to the action files and the router's "Standing rules": no installs, no tests, no edits, no verdict. The removed ## Next sections only pointed at other skills, and the router restates them. No guardrail is removed or weakened, so I did not need to consult the instruction exception register.
• Scripts:
  • audit-coverage.sh now sets COMPLEXITY to $PLUGIN_ROOT/skills/audit/scripts/audit-complexity.sh, which follows the rename.
  • The renamed .sh and .test.sh files change only header comments, test-scope lines and the provenance-test target path.
  • dispatch.sh changes only comments.
• Trusted path: .claude/skills/control-claude-code-plugins/features/code-metrics/README.md matches **/.claude/**. I read its whole change: three documentation rows in the parts list become one audit row. It gates nothing.
• Other files: these only rename references and change no tokens, trust or executed code:
  • prerequisites.json (for and degrade text)
  • the two probe JSONs (competitor names)
  • docs/*
  • the changelog fragments
  • code-reviewer.md
  • the deleted and added evals.json files

Plugin manifests

• manifest description: pass. In plugins/code-metrics/.claude-plugin/plugin.json, only description changes, and that field is in the inert set.

Notes

• Settled thread: the one settled thread (audit/SKILL.md lines 31-34, about eval evidence) is not a security point and is not raised again.
• Prior findings: the prior-findings file holds only this lane's earlier clean summary with no findings. I am re-posting nothing, and the round cap does not apply (0 of 3 rounds).
• PR context: I found no embedded instructions in the PR context or the settled threads.
• Cost: the change has no cost implications.

critical-findings: 0

Chunk 2 of 2 (9 files)

Security review: chunk 2 of 2 (PR #12803)

I found no security issues in this chunk. I read every hunk of all 9 files in .claude-lane/chunks/chunk-2.patch.

What the chunk changes. Every edit repoints a reference from one of the removed audit-size, audit-complexity and audit-type-debt skills to the code-metrics:audit router and its actions, which chunk 1 adds.

• Review skill prose (plugins/review/skills/fanout/context/default-mode.md, plugins/review/skills/quality-gate/context/code.md): both now run /code-metrics:audit size instead of /code-metrics:audit-size. The conditions around the call are unchanged: it runs only when the skill is available, the quality-gate path still skips it under --worktree, and it uses the same --base <base>. No guardrail is removed or softened. The new wording only says which skill to check for and which action to call.
• Eval text and test fixtures (plugins/review/skills/quality-gate/evals/evals.json, plugins/skill-quality/scripts/check-skill.test.sh): only the skill names in expected outputs and in the heredoc fixtures change. Nothing about how they execute changes.
• Verification context (plugins/verification/skills/measure/context/metrics.md): the invocations are renamed and the INCONCLUSIVE rules are kept word for word.
• Repo scripts and data (scripts/affected-tests-live.sh, scripts/check-code-metrics-skill-prose.py, scripts/suite-seconds.txt): fixed path strings are updated to the moved files. No input handling, command construction or execution changes.
• scripts/skill-leaf-name-registry.txt: adds code-metrics to the audit verb's namespace list, with a rationale comment. This is a naming registry and grants no trust.

Trust controls / trusted paths: none of the 9 files match a TRUSTED PATHS: glob. No trust control, token scope, kill switch or merge hold is touched.

Plugin manifests: this chunk has no manifest changes.

Settled threads: the settled thread on plugins/code-metrics/skills/audit/SKILL.md (eval non-inferiority) is in chunk 1, is not a security point, and is not raised again.

Prior findings: the prior round reported 0 findings. The round cap does not apply (0 of 3 rounds).

Embedded text: none found in the PR context or the settled threads.

Cost: none.

critical-findings: 0

[github-actions]

claude-review reviewed d92b022661de900b4d95e37a71a747c4b5cce037: read 46 of 46 changed file(s); 0 finding(s), 0 as inline comments.

Chunk 1 of 2 (37 files)

Code review, chunk 1 of 2 (37 files)

No findings in this chunk.

I read every hunk of all 37 files in chunk 1:

• the six .changes/ fragments;
• the control-plugin feature README, docs/catalog.md, docs/skill-cheat-sheet.md, docs/test-wall-clock-baseline.md and docs/upstream/cursor-pstack.md;
• the code-metrics plugin.json, README, prerequisites.json and dispatch.sh;
• the three deleted eval files;
• the new audit router SKILL.md and its actions/ files (renamed from the old SKILL.md files);
• the new audit/evals/evals.json;
• the six renamed scripts and tests;
• the sibling audit-coverage, audit-duplication, audit-suppressions, principles and setup skills;
• the two probe files and review/agents/code-reviewer.md.

Since the last review (db588cef to d92b0226). This head adds a merge of main. The one conflict was in the audit-suppressions description, which now ends Complexity: /code-metrics:audit complexity.. That target is the router's real action.

Fold correctness (checked at this head):

• No stale references. I searched the repository for code-metrics:audit-(size|complexity|type-debt) and skills/audit-(size|complexity|type-debt). The only matches are in changelogs, .changes/ fragments and .claude-lane/ inputs. A search for skill:audit-* under plugins/ found nothing.
• Script paths. audit-coverage.sh now points COMPLEXITY at skills/audit/scripts/audit-complexity.sh. The moved scripts are still at skills/<x>/scripts/, so their $SCRIPT_DIR/../../.. path to the plugin root still works.
• Links in the action files. The ../../../reference/collectors.md links in actions/complexity.md are one level deeper to match the new location. audit-size.test.sh reads the provenance sentence from actions/size.md and the description from line 2 of the router's SKILL.md, and its test-scope lists both files.
• README skill count. The README says five listing-eligible descriptions. The skills on disk are audit, audit-coverage, audit-duplication, audit-suppressions, principles and setup, and setup is model-hidden, so five is right. The 2,728 / 141,819 character figures are the author's numbers; I did not re-measure them.
• Dispatcher ids. The router's Gotchas and the code-metrics fragment both say on purpose that report skill values and dispatcher ids keep their old names.

Path-scoped rules.

• .claude/rules/skill-bodies-state-current-rules.md covers the changed skill and agent files. The router's ## Next uses the bullet form, and no removed skill appears in any ## Next section.
• .claude/rules/eval-case-transcripts.md covers the new audit/evals/evals.json, which holds only synthetic prompts.
• .claude/rules/ruff-pin.md covers join.py, but only its docstring changed.
• .claude/rules/cost-claims.md covers the docs and skills, and none of the changed text states a price.

Settled thread. The audit/SKILL.md lines 31-34 thread (Spoke paths, and the eval non-inferiority question) is settled by the owner's posted before-and-after eval run. Its lines are unchanged since resolution, so I did not raise it again.

Manifest:

• manifest description: pass. It names audit size, audit complexity and audit type-debt, and matches the docs/catalog.md entry.
• manifest keywords: pass. The diff only regroups capabilities; it adds and removes none.
• manifest version: pass. Releases come from fragments, and .changes/code-metrics/...-3b93eb62.md declares bump: major for the removed skills.
• No userConfig changes.

Closing issue. None. The PR says only Refs: #12619, and the context file has no closing-issue sections, so there were no acceptance criteria to check.

Prior findings. None. 0 rounds before this one; the round cap is 3 and was not reached.

Spend. None. This change touches no billed resource and no lane spend.

Verification. I ran no tests. The test results in the PR body (audit-size.test.sh 14/14, audit-complexity.test.sh 27/27, audit-type-debt.test.sh 41/41, audit-coverage.test.sh 48/48, check-affected.sh 15 passed) are the author's claims and I did not verify them.

Chunk 2 of 2 (9 files)

Code review, chunk 2 of 2 (9 files)

No findings in this chunk. I read every hunk of all 9 files.

Every change here repoints a reference from one of the three removed leaf skills to the new code-metrics:audit router or its moved files. I checked each new target against the head tree:

• Prose references. These are plugins/review/skills/fanout/context/default-mode.md, plugins/review/skills/quality-gate/context/code.md, plugins/review/skills/quality-gate/evals/evals.json (cases 19 and 20) and plugins/verification/skills/measure/context/metrics.md. They now call /code-metrics:audit size or /code-metrics:audit complexity. The router's argument-hint (plugins/code-metrics/skills/audit/SKILL.md:3) accepts <size|complexity|type-debt> [--json] [--all] [--base <ref>] [<path>...]. So the --base <base> and --json flags those callers pass still apply. Under plugins/, code-metrics:audit-(size|complexity|type-debt) now appears only in CHANGELOGs.
• check-skill.test.sh fixtures. The ## Next single-shape check in plugins/skill-quality/scripts/check-skill.sh:2465 uses ^`?/[a-z0-9-]+:[a-z0-9-]+(`|[[:space:]]|[.,;:]|$). `/code-metrics:audit complexity` still matches it through the [[:space:]] branch. So next-single still passes silently, next-late still warns only on placement, and next-operative still warns on its prose-first opening. All three assertions are unaffected. I worked this out from the regex; I did not run the test.
• scripts/check-code-metrics-skill-prose.py. The new path plugins/code-metrics/skills/audit/actions/type-debt.md exists. Its line 71 holds (`type_debt.reference`, `null` by default), which matches the expected phrase for a null default.
• scripts/affected-tests-live.sh and scripts/suite-seconds.txt. They point at the renamed skills/audit/scripts/*.test.sh paths. In suite-seconds.txt the new rows sort after audit-duplication/... (/ sorts after -), and the timings carried over unchanged. Under scripts/, the old skill paths appear only in a comment in the registry rationale.
• scripts/skill-leaf-name-registry.txt. code-metrics joins the audit verb row with a recorded rationale. The existing namespace list was not alphabetical before this change (harness-* comes before codebase-health), so adding a name in the middle breaks no ordering.

Path-scoped rules. These rules match files in this chunk:

• .claude/rules/skill-bodies-state-current-rules.md and .claude/rules/cost-claims.md match the skill context files. The edits state current invocations and make no cost claims.
• .claude/rules/eval-case-transcripts.md matches the quality-gate evals.json. Its prompts are still synthetic.
• .claude/rules/ruff-pin.md matches the .py change, which only edits a string literal.

Settled threads. The one settled thread (plugins/code-metrics/skills/audit/SKILL.md lines 31-34, lines changed since resolution: no) is about chunk 1 and the eval non-inferiority evidence. I did not re-raise it.

Prior findings. The only prior post is the previous round's summary, which reported 0 findings. Rounds with findings before this one: 0; round cap 3, not reached.

Closing issue. None. The PR says only Refs: #12619, so there are no acceptance criteria to check.

Embedded text. No instructions aimed at this lane appear in the PR context, settled-threads or prior-findings files.

Trusted paths. No file in this chunk matches a trusted-path glob.

Spend. None. This chunk touches no billed resource and no lane spend.

Verification. I ran no tests. The PR body's results (check-skill.test.sh all passed, test_check_code_metrics_skill_prose.py 5/5, check-affected.sh 15 passed) are the author's claims and I did not verify them.

[melodic-automation-lanes]

Unattended merge: risk MED at head db588cef5213d99ff2e66926ca111860420ead51. Only LOW, or MED on class, size and reported review-finding reasons alone, merges without a human. The lanes clear its holding reasons (a size reason holds nothing); pr-merge judges it again each run.

MED evidence-unbound:claude-review: not bound: evidence-missing
MED evidence-unbound:claude-security-review: not bound: evidence-missing
MED no-patch:plugins/code-metrics/skills/audit/scripts/audit-complexity.test.sh: no patch: line counts unknown
MED no-patch:plugins/code-metrics/skills/audit/scripts/audit-type-debt.test.sh: no patch: line counts unknown

[melodic-automation-lanes]

pr-unblock / address-feedback finished round 1 of max 4 on db588ce.

[melodic-automation-lanes]

The pr-unblock lane stopped address-feedback on this pull request: the lane left a review finding open and no adjudicator verdict settled it: none was recorded, it found the finding does not hold where the lane had not disputed it (an UNCERTAIN or VALID-defer reply), which only an INCORRECT reply lets a verdict resolve, it found the finding asks only for tests whose covering check runs had not all passed when the round began, or it raised a security question on a finding the security-review lane rated below CRITICAL; so a session builder takes it. The lane labels it needs-session for a session builder, who makes the change this lane cannot, and the run ends in a failing pr-unblock/address-feedback status on the head the lane gated.

• Reason: feedback-unadjudicated
• Head: db588cef5213d99ff2e66926ca111860420ead51
• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/41701500578

When a retry on this head can change the outcome, the lane runs one on its own, up to its per-head cap, and edits this comment if it stops again; a run that does not stop clears the status. When no retry can (a review thread the lane does not take or settle, or a failing check after the retries are spent), a person resolves the threads or gets the checks green, then dispatches the workflow below: that run finds the cause gone and clears the status. On a pull request the lanes App opened, the dispatchers start that run once per stop; on any other, a person does. A new commit to the branch starts clean.

To run it again on this head now, dispatch the pr-unblock workflow:

gh workflow run pr-unblock.yml -R melodic-software/claude-code-plugins -f pr-number=12803 -f activity=address-feedback