[kyle-sexton]

Refs: #12491

Summary

This delivers the probes part of #12491: plugins/code-metrics/probes now holds held-out trigger probes for the three remaining audit-* leaves, written blind by an author who never saw the rewrites. It ships no description change. The preregistered measurement found no control that detected a loss, so all three leaves keep their before text under the issue's own rule (preregistration, result).

Fix

• New plugins/code-metrics/probes/audit-coverage.json, audit-duplication.json and audit-suppressions.json.
• A changelog fragment with bump: none, since no shipped behavior changes.

Verification

• All 9 counted arms read verdict: VALID under run-validity.py, as the result comment records. Every should-trigger case fired 27 of 27 in the before, after and control arms; the control's mean fall was 0.000 with no case drop.
• scripts/validate-plugins.sh passed on the head before the fragment's bump change, and the fragment checks passed on this head (worker report). git diff --stat on this head shows these four files only.
• Left out: the six-leaf count is not met and stays open (see Remaining). The first audit-coverage attempt lost two arms to OAuth token revoked, cause unverified, and its one preregistered re-run is what the result reports.

Related

• refactor(architecture): give the nine map-* skills distinct, trimmed descriptions #12490 and test(architecture): give four map-* skills probes a description cut can fail, then trim them #13050: the same method on architecture:map-*, where controls also failed to detect a loss.

Remaining

• Done-when "ls -d plugins/code-metrics/skills/audit-* | wc -l is still 6": it reads 3, because PR 12803 folded size, complexity and type-debt into the audit router before the owner's option 3 decision. The owner decides between restoring the leaves and amending the issue.
• Trimming the three descriptions, which stay over the 419-character warn line until a control can detect a loss.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T06:20:32.211151Z	08b4d5b	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 08b4d5b92529588370479c5356fdf23e91941eff: read 4 of 4 changed file(s); 0 finding(s), 0 as inline comments.

Security review: no security issues found

I read every hunk of all 4 changed files. Each one is a new data file:

• .changes/code-metrics/refactor-12491-code-metrics-audit-descriptions-dbcc5296.md: a changelog fragment that sets bump: none.
• plugins/code-metrics/probes/audit-coverage.json, audit-duplication.json and audit-suppressions.json: held-out trigger-probe sets. Each holds a skill name, a list of competitor skills, and benign should-trigger / should-not-trigger request strings for eval runs.

Skip gate 2 applies. The change has no security-relevant surface:

• It adds no executable code, workflow, action, hook or MCP server.
• No .claude-plugin/plugin.json or marketplace.json changes, so there are no manifest items to rate.
• No userConfig keys change.
• No standing instruction (skill body, CLAUDE.md, rules file, allowlist) is deleted or narrowed.
• No trust control is touched: the trusted-actor list, trusted-trigger check, lane token, kill switch and merge holds are all unchanged.
• None of the changed files matches a TRUSTED PATHS glob.

The probe request strings are short, realistic developer requests. They contain no embedded directives aimed at a lane or reviewer. The PR description has no embedded text telling the lane to pass the PR, skip a check, drop a finding or post elsewhere.

Spend: none. The probe files are inputs for eval runs that have already happened, and this change adds no new runs or schedules.

critical-findings: 0

[github-actions]

claude-review reviewed 08b4d5b92529588370479c5356fdf23e91941eff: read 4 of 4 changed file(s); 0 finding(s), 0 as inline comments.

Code review: no findings

I read all 4 changed files in full: three new probe sets under plugins/code-metrics/probes/ and one changelog fragment.

What I checked

• Probe schema. Each probe file has the same top-level fields as the existing probes, such as plugins/architecture/probes/map-flow.json: skill, plugin, skill_dir, ranking_note, competitors and queries. Each query carries id, split, expect_trigger and request. Every skill_dir points to a leaf that exists: audit-coverage, audit-duplication and audit-suppressions.
• Splits. Each file has 9 positive cases (5 train, 4 validation) and 9 negative cases (5 train, 4 validation). No id repeats within a file.
• Competitors. Every named competitor has a SKILL.md in the repository: code-metrics:audit, verification:measure, testing:plan, testing:audit, mutation-testing:audit, docs-hygiene:extract-ssot, toolchain:ratchet and toolchain:lint. Each negative case plausibly belongs to one of these, or to the audit router, which now holds size, complexity and type-debt.
• Changelog fragment. bump: none is a value the tooling accepts: scripts/check-changelog-fragments.sh validates it and scripts/release-plugins.sh handles it. It fits a change that alters no shipped skill text.

Other notes

• Closing issue. The PR only says Refs: #12491 and closes no issue, so there were no acceptance criteria to check. The PR body says the "six audit leaves" done-when condition is unmet and leaves the choice to the owner. This PR doesn't claim to meet it.
• Unverified claims. The trigger-rate results, the run-validity.py verdicts and the validate-plugins.sh pass come from the author, and I did not check them. This lane has no shell, so I ran nothing.
• Embedded text. I found no directive aimed at the review lane in the PR context.
• Paved paths and manifests. I read no standards index or rule files, because the scope limit kept me from looking beyond the changed files. The diff changes no plugin.json or marketplace.json, so the manifest checks don't apply.
• Prior findings. There were none. This is round 0 of 3, so the round cap did not apply.