Repository navigation
fix(harness-config): align audit references, the permission reader and the effort pin check with the docs - #13288
Merged
Merged
Conversation
… with the docs The settings page reads the shared project file from the primary working directory, so permission-state.sh now reads it there and resolves the local file's repository root from the same place. A new suite runs the reader over real git trees, since the fixture seam sets both directories to one path. The remaining findings correct references toward the pages read on 2026-11-04, and the effort table baseline moves to the current hash with its levels unchanged. Refs: #10456 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Clears the inherited git environment, matches the local file by its tail so a Windows git path spelling cannot fail the case, and rewords two markdown and fragment lines the linters reported. Refs: #10456 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…aseline check-effort-pins.sh hashed the list item numbered 3. The page now puts `Launching with --effort` at item 3 and the model defaults at item 5, so the baseline written for this page did not cover the defaults. The script now hashes every numbered item of the section that says "default", and reports no-defaults-item (exit 3) when none does. Proof on real pages: the fixed script still prints the old baseline 8e796135 for the 2026-10-11 copy of the page, so nothing else moved. The 2026-11-04 page hashes 07672ad7; a copy with only the Opus 4.7 default edited hashes 2a4dfd1b. A live fetch reports table status=same against the new baseline. Rebaseline reading (audit SKILL.md Rebaseline step). This reading stands in for the person that step names: an agent read the rows and decided, no human did. Compared the three hashed parts of the 2026-10-11 copy (which hashes to the old baseline) with the 2026-11-04 page using diff: - Levels table: no change. - Level rows of the Choose table: no change. - Defaults item: moved from 3 to 5 and reworded. Same values: high on every model that supports effort, medium on Opus 5.5, Sonnet 5.5 and Haiku 5.5, xhigh on Opus 4.7, and an organization default still applies to its default model. - Outside the hash: the resolution order split its first item, so --effort now ranks below a level picked in the session. Decisions: every pin keeps its level, because the guidance each was chosen against is unchanged. All 54 pins name a listed level. - Lanes keep their levels. harness-ops lanes config: work high, work-2 high, decide high, babysit medium. loop-lane-prompts launch lines: high, medium, high. An unattended lane has nobody picking a level, so --effort holds; an operator who picks one in the attended queue is making that choice. The merge lane's medium is still the launching model's default on Opus 5.5. - Implementers, medium, day-to-day engineering with a clear scope: implementation implementer, scoped-implementer; workflow workers in research-sweep, docpage-digest-batch, drift-audit, plan-panel and fix-until-green. - Mechanical or bounded readers, medium: code-tidying comment-reviewer, discovery explorer, performance go-faster-sweeper, planning upload-reader, review ecosystem-specialist, songwriting object-writer; retrieval roles in fanout-sweep and fix-until-green. - Verdicts and verification, high: discovery intent-tracer, research-verifier, researcher; implementation phase-verifier; plugin-quality auditor; review architecture-guardian, brief-reviewer, ci-log-auditor, code-reviewer, doc-drift-detector, security-reviewer; user-experience evaluator; verification confirm; workflow verifier and orchestrator roles in research-sweep, docpage-digest-batch, drift-audit, plan-panel and fix-until-green. - planning plan-reviewer stays medium. It renders findings on a plan, which reads closer to the high row, but the page does not settle that and nothing it rests on changed, so it is reported, not changed. Refs: #10456 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…epository root A Bash cd inside the project moves the reader's working directory and not the session's primary one, so after a cd the reader took a subdirectory's file as the project scope and left the primary directory's rules out, denies included. The reader cannot tell that case from a session started in the subdirectory, whose shared file really is the subdirectory's. Falling back to the root would drop that session's denies, and $PWD alone drops the other's. Reading both omits neither and can only over-report, so below the root it now also reads the root's file as `project toplevel`, and a note names both directories. A root or outside-repository run reads $PWD alone and reports the surface not-applicable. It stays a surface of the project scope so the merge and lint stages treat it as project settings. Refs: #10456 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rovals land The grants check's comment now points at the settings section instead of stating where a prompt approval lands. The two audit-instructions records whose claims this branch edited take today's date, after rereading the sections they cite: the residency table's memory, skills, subagents, hooks and output-styles sections, and the thinking table, troubleshooting page and extended-thinking section. Refs: #10456 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… note With two project files, the lint held one value per scope and key, so a value in one file hid the other's: a boolean disableAutoMode in the working directory gave no finding when the root file set "disable". The root file is now its own entry, named project:toplevel in findings. Other scopes stay last-wins, because a later managed drop-in does replace an earlier value. --merge-only dropped the reader's note that the merged set can over-report one project file, while its effective lines read scopes=project either way. It now keeps that note and still drops the others. Refs: #10456 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… root rule findings The audit engine read the fallbackModel chain cap from settings-reference's fallbackModel section, which no longer states one, so every chain got a skip row. It now reads the Fallback model chains section of model-config, requested as a linked page only when a settings file sets fallbackModel. An unread page, or one without that section, gives a not-inspectable row. The permission plane lint named a rule finding from the repository root's shared file as `project`; it now names it `project:toplevel`, as conf findings already were. The permission-state wording no longer implies the session's own shared file is always read: after a cd from a subdirectory that is not the root, it is not, so run the reader from the start directory. The suppression for the bare `Bash(git push)` ask row goes, since the engine no longer emits that claim. Refs: #13286 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kyle-sexton
marked this pull request as ready for review
November 4, 2026 15:52
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
…urce Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
claude-security-review reviewed Security review (incremental, blocking only): no security issues foundcritical-findings: 0 Scope. This review covers only what changed since What changed. One paragraph in the audit-pass doctor-handoff reference was reworded:
What I checked:
|
Contributor
|
claude-review reviewed Code review: PR #13288, incremental since
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ef71958791
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
6 tasks
…ls page Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Nov 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs: #13286
Summary
Brings harness-config's audit references, the permission reader and the effort pin check in line with the Claude Code docs as read on 2026-11-04, for the 2.1.297 to 2.1.318 changelog recheck.
Fix
/harness-config:audit-permission-state: the reader takes the project file from the primary working directory. Below the repository root it also reads the root's shared file as theproject toplevelsurface, because a Bashcdmoves the reader and not the session. The lint keys values and rule findings by file (project:toplevelfor the root file).--merge-onlykeeps the note that one of the two files may be over-reported. The skill says to run the reader from the session's start directory: after acdfrom a subdirectory that is not the root, that directory's file is not read./harness-config:audit:check-effort-pins.shfinds the defaults item by content, not by item number, and the baseline is rebaselined. ThefallbackModelchain cap is read from model-config's Fallback model chains section, where the page now states it. The staleBash(git push)suppression is removed from.claude/audit-pass.mdanddocs/conventions/harness-config.yaml./harness-config:audit-instructions,audit-passandaudit-permission-grants, plus the plugin README: references corrected toward the pages, and dates refreshed where a claim was rechecked.Verification
Suites, all green on the final head: permission-state 96, primary-dir 36, permission-plane-lint 121, permission-merge 92, automode-entry-diff 76, audit entry point 37, audit-engine 536, check-effort-pins 80, permission-rule-check 434, guardrails coverage-manifest 32. Earlier this round, on code these last commits did not touch: managed-conformance 39, no-writes 12. Changelog checks: parity
--check,--check-bump,--check-preserved,--check-orderand fragments--check-requiredall pass. Each behavior change was written test first and failed before its fix.Disclosures:
project topleveland not underproject settings.settings-referencefallbackModelsection no longer states the cap, matching the live page. It now links model-config, and the fixture gains a model-config page and an index line. Case 52 was rewritten around that page. Case 10 is unchanged and still passes, now reading the cap from model-config.permission-rule-check.shroots are unchanged. It reads the worktree root and the git toplevel, so it misses the main checkout's local file and a subdirectory's shared file.plan-reviewerstays pinned atmedium. It renders findings, and thehighrow reads closer, but the page does not settle it.audit-automation-gapsstill takes its root from--show-toplevel(inventory.sh:151-152), so it does not follow the primary-working-directory rule either.plugins/harness-config/skills/audit/SKILL.md:67now names model-config as thefallbackModelcap's source (commitbb8683ff, wording only).Related
Bot-written tracking issue for the docs-conformance recheck: #10456.
🤖 Generated with Claude Code