[melodic-automation-lanes]

Closes #13192

Summary

Opened by the work-resolve-issue lane. The run's own summary:

The config cascade's gitignored .local. layer was still called an overlay in 23 plugins of this slice: ai-briefing, ai-slop, architecture, autonomy, code-tidying, corrections, discovery, docs-hygiene, domain-driven-design, education, github, harness-config, implementation, instruction-placement, knowledge, mutation-testing, overengineering, playbooks, plugin-quality, session-flow, skill-quality, toolchain and verification. Their docs, skills, schemas, eval prose, script comments and test labels now say personal override, and each has a patch changelog fragment. No asserted string, identifier, key or emitted value changed. The other seven plugins listed in the issue (harness-ops, user-experience, computer-use, app-control, rate-limit-guard, guardrails, debugging) needed no edit outside their CHANGELOGs, because every overlay left in them has another meaning: the lane --settings overlay, UI and game overlays, video overlays, the --settings flag overlay. Design choices: the autonomy eval case is renamed su-check-reports-personal-override to match its name: field. The case's layer grader swaps the old word for 'personal override' instead of accepting both, because keeping the old word on a line that also has binding.local.json would fail the vocabulary checker. It still accepts 'local' and binding.local.json. Other overlay senses are left as they are: Kustomize overlays in architecture tests, ai-briefing's brand and UI overlays, harness-config unhobble's plugin overlay, harness-ops and rate-limit-guard's --settings overlay, Claude Code's settings.local.json overlay in autonomy's prerequisite-resolution, and visual overlays in knowledge, computer-use and app-control. Synced lib copies and CHANGELOG.md files are untouched.

Not verified

• scripts/check-vocabulary.py --sense overlay over the slice's plugins was not run, because this lane runs no interpreter; a Grep using the same rule stood in for it. Left to the PR's CI.
• Plugin test suites (shell and node tests for ai-slop, code-tidying, corrections, domain-driven-design, docs-hygiene and autonomy) were not executed here; only comments and test labels changed. Left to the PR's CI.
• plugins/evals validate-cases.py was not run on the renamed autonomy eval case (no interpreter in this lane). Its samples were checked by hand against the new grader regex. Left to the PR's CI.
• The autonomy layer grader no longer accepts the bare old word: it accepts 'local', binding.local.json or 'personal override'. Keeping the old word on that line would fail the vocabulary checker.
• Tidy not run: the change has 117 files and 23 areas, over the 10-file, 300-line and 1-area cutoffs.

Fix

• plugins/ai-briefing/{README.md,skills/generate/SKILL.md,skills/setup/SKILL.md,skills/setup/evals/evals.json}: personal override for the .local. cascade layer (brand and UI overlays kept)
• plugins/ai-slop/skills/audit/scripts/{detect.sh,detect.test.sh}: comments and assertion labels only; expected strings unchanged
• plugins/ai-slop/skills/setup/{SKILL.md,evals/evals.json}: personal override
• plugins/architecture/skills/map-{context,data,components,containers,deployment}/SKILL.md: 'There is no personal override.'
• plugins/autonomy/{README.md,reference/binding-seam.md,skills/setup/SKILL.md,skills/setup/evals/evals.json}: personal override
• plugins/autonomy/evals/su-check-reports-overlay-layer -> su-check-reports-personal-override (git mv): case.yaml name, description, expected_outcome and grader regex; sample answers and why text; scaffold.sh comment
• plugins/code-tidying/{README.md,reference/config.md,schemas/code-tidying.schema.json,skills/tidy/SKILL.md,skills/setup/SKILL.md,skills/remove-comments/SKILL.md,skills/remove-comments/scripts/settings.sh,skills/remove-comments/scripts/settings.test.sh,evals/su-apply-private-lane/samples/no-local-var…
• plugins/corrections/{scripts/codify-settings.mjs,scripts/codify-settings.test.sh,scripts/findings-buffer.mjs,skills/codify/SKILL.md,tools/findings-buffer/CONTRACT.md,tools/findings-buffer/buffer.sh,schemas/corrections.schema.json,schemas/findings-buffer.schema.json}: personal override in comments,…
• plugins/discovery/{reference/config.md,skills/explore/SKILL.md,skills/setup/SKILL.md}: personal override
• plugins/docs-hygiene/{reference/config.md,skills/setup/SKILL.md,skills/audit-noise/scripts/detect.test.sh,skills/audit-noise/evals/fixtures/recall-paraphrases.md}: personal override; the fixture text after the bold-roster dash changes in both copies, which the detector does not read
• plugins/domain-driven-design/{README.md,schemas/domain-driven-design.schema.json,scripts/glossary-settings.mjs,tests/glossary-settings.test.mjs,skills/curate-language/context/glossary-contract.md}: personal override in prose, comments, a test name and the schema description
• plugins/education/{reference/config.md,skills/setup/SKILL.md}: personal override
• plugins/github/{README.md,reference/change-routing.md,reference/conventions-file.md,reference/recipes/billing.md,reference/recipes/security-posture.md,skills/setup/SKILL.md,skills/setup/evals/evals.json}: personal override, including the layer tables
• plugins/harness-config/skills/{setup/SKILL.md,audit/context/procedures.md,audit-pass/reference/suppression.md}: personal override
• plugins/implementation/reference/config.md, plugins/knowledge/reference/config.md, plugins/playbooks/reference/config.md: personal override
• plugins/instruction-placement/{reference/consumer-config.md,skills/realign/SKILL.md,skills/delta/evals/evals.json,skills/realign/evals/evals.json}: personal override
• plugins/mutation-testing/{README.md,skills/setup/SKILL.md,skills/setup/templates/config-template.md,skills/setup/evals/evals.json,skills/audit/evals/evals.json}: personal override
• plugins/overengineering/{reference/consumer-config.md,context/findings-artifact.md}: personal override, two paragraphs re-wrapped
• plugins/plugin-quality/{reference/config.md,retirements.yaml,skills/audit/SKILL.md,skills/audit/evals/evals.json,skills/setup/SKILL.md,skills/setup/evals/evals.json}: personal override; r002 note text only (detection fields unchanged); setup eval renamed…
• plugins/session-flow/{reference/config.md,skills/setup/SKILL.md}, plugins/verification/{reference/config.md,skills/setup/SKILL.md}: personal override

Verification

The runner ran each check from the base copy against bba95d6:

• scripts/check-changelog-fragments.sh --check: passed
• scripts/check-changed-skills.sh --merge-base: passed

The run reports:

• Grep with the checker's overlay rule (\boverlays?\b with personal|layers?|layered|cascade|gitignored? or .local\b on the same line) over all 30 plugins of this slice, CHANGELOG.md excluded: no matches (stands in for check-vocabulary --sense overlay, which this lane cannot run)
• Grep for \boverlays?\b over the slice's plugins: each remaining hit outside CHANGELOGs was read and has another meaning (Kustomize, brand, UI, video, settings flag, plugin overlay)
• check-changelog-fragments: all 27 fragments valid
• check-changed-skills: every changed skill PASS, 0 errors (warnings only, all present before this change)
• check-affected: 13 passed, 6 skipped, 0 failed over 117 changed files
• check-evals-quality on the 11 changed evals.json files: PASS, 24 warnings, all present before this change, none FAIL
• Fresh-context review subagent over the full diff: no behavior change found in scripts, tests or JSON. The autonomy grader checked against every sample: pass samples match, fail samples do not. No references to the old case or eval names remain. Two fragment wordings and one toolchain sentence were…
• The lane run: https://github.com/melodic-software/claude-code-plugins/actions/runs/41889164077

Left out: the items under Not verified.

Related

#13192

[github-actions]

claude-security-review reviewed bba95d6e0e6c634ee8bfe75368e35a343eb539f0: read 118 of 118 changed file(s); 0 finding(s), 0 as inline comments.

Chunk 1 of 3 (40 files)

Security review, chunk 1 of 3 (PR #13337)

No security issues found in this chunk.

What I read: all 40 files in .claude-lane/chunks/chunk-1.patch, every hunk:

• 20 changelog fragments under .changes/.
• The ai-briefing, ai-slop and architecture map-* skill docs and evals.
• ai-slop's detect.sh and detect.test.sh.
• The autonomy README.
• The renamed su-check-reports-personal-override eval case and its samples. Two of the samples are pure renames with no content change.

What changed: every change is a wording swap from "overlay" to "personal override" in prose, comments, eval expectations, test assertion labels and grader text. Nothing that runs changed:

• In plugins/ai-slop/skills/audit/scripts/detect.sh only comment lines changed. No executable line differs.
• In detect.test.sh only comments and the first argument of assert_contains (the label) changed. The expected strings are unchanged.
• In the autonomy case.yaml the names-overlay-value grader regex swaps the alternative overlay for personal override. That only changes how the eval grades an answer. It is not a security surface.

Instruction surface: the skill text that changed (ai-slop setup, the architecture map-* skills, ai-briefing setup and generate) renames the layer without softening any rule. For example, "Never write the personal override on the user's behalf" keeps its original meaning, and "There is no personal override" still states the same one-layer resolution. No guardrail is removed or narrowed.

Trusted paths: no file in this chunk matches a TRUSTED PATHS glob.

Plugin manifests: this chunk changes no plugin.json or marketplace.json.

Identical copies:

• The education fragment is also copied to .changes/session-flow/...0b852cef.md and .changes/verification/...81e65bb9.md.
• The implementation fragment is also copied to .changes/knowledge/...f1992ae2.md and .changes/playbooks/...dc996c27.md.

All of these are .changes/<plugin>/ changelog fragments. Their path does not change what they do; each only feeds a changelog entry for its own plugin.

Embedded text: the PR context has no instructions aimed at the review lane.

Prior findings: none, and the review was not blocking-only.

critical-findings: 0

Chunk 2 of 3 (40 files)

Security review, chunk 2 of 3 (40 files): no security issues found.

I read every hunk of all 40 files in this chunk. Every change swaps the term "overlay" (or "local overlay") for "personal override" when it names the gitignored *.local.* config-cascade layer. The changes fall into four groups:

• Prose: README, SKILL.md and reference docs, plus the description strings in three JSON schemas.
• Code comments: script comments in settings.sh, codify-settings.mjs, findings-buffer.mjs, buffer.sh and glossary-settings.mjs, and the comment in the renamed autonomy scaffold.sh.
• Test labels: labels in settings.test.sh, codify-settings.test.sh and glossary-settings.test.mjs. The expected values and grep patterns did not change.
• Eval and fixture text: the autonomy eval expected_output, a code-tidying sample answer, the docs-hygiene fixture line, and the matching printf specimen in detect.test.sh. The em-dash bold-roster shape the detector matches is unchanged.

What I checked:

• Code and config paths: none of the changes touches executable logic, a path or glob, a schema property, additionalProperties, an emitted value, or a layer name such as "local". The .gitignore lines the docs recommend are unchanged (.claude/**/*.local.*, docs/conventions/**/*.local.*).
• Instruction-surface lens: I checked the changes to standing instructions, the rules each one states, against the protected classes by consequence, because the register file was not read in this lane. No rule is deleted, narrowed or softened. In plugins/github/reference/change-routing.md, the policy-floor rule still says the same thing: personal layers may only tighten the team's write-posture keys. The findings-buffer contract still limits the adapter to the plugin's own tools/findings-buffer/adapters/. The code-tidying "declared deviation" text still says no *.local.* lane variant is loaded.
• Trusted paths: no file in this chunk matches a TRUSTED PATHS glob. No trust control, merge hold, token scope or kill switch is touched.
• Plugin manifests: no plugin.json or marketplace.json change is in this chunk.
• PR context: it matches the change and contains no embedded instructions aimed at the lane.
• Identical files: the copies in identical.txt are changelog fragments under .changes/, all in chunk 1. None is in this chunk, and their paths are not hook, workflow, settings or manifest paths.
• Prior findings: none (first review, not blocking only).

critical-findings: 0

Chunk 3 of 3 (34 files)

Security review: chunk 3 of 3 (34 files)

I found no security issues in this chunk.

I read every hunk of all 34 files in .claude-lane/chunks/chunk-3.patch:

• github setup (skill and evals)
• harness-config (setup, audit procedures, audit-pass suppression)
• implementation, knowledge, playbooks, session-flow and verification config docs and setup skills
• instruction-placement (consumer config, realign skill, delta and realign evals)
• mutation-testing (README, setup skill, template, evals)
• overengineering (consumer config, findings artifact)
• plugin-quality (config, retirements.yaml, audit and setup skills and evals)
• skill-quality schema
• toolchain (resolution ladder, check and setup skills, setup evals)

What changed. Every hunk renames the cascade's *.local.* layer from "overlay" / "local overlay" to "personal override". The edits are in skill prose, reference docs, eval prompts and expectations, one eval name, one schema description, and the note text of a retirements.yaml entry.

Instruction-surface check. Several hunks edit standing skill instructions, so I checked whether any guardrail was removed or weakened. Every rule these lines carry is still there with the same meaning:

• No git or gitignore side effects: the skills still check that the personal override is gitignored before writing it, still never stage it, and still never edit the consumer's .gitignore. This holds in github setup, harness-config setup, mutation-testing setup and toolchain setup. github setup also keeps its "remove from git (git rm --cached) and rotate any credential that was committed" fix.
• Personal entries still suppress nothing: a personal-only suppression entry is still reported personal-only, not applied, and team-layer precedence still holds for policy-floor keys (instruction-placement, overengineering, mutation-testing, harness-config).
• Retired plugin-quality files are still never read: the retired .local.md and user-global files stay unread and still produce a WARN.

One wording change goes beyond the rename. In plugins/toolchain/reference/resolution-ladder.md, "A consumer overlay can also flip enabled back" now says "A later layer can also flip enabled back" (L51). That matches the per-key override rule stated a few lines above it. It changes which ecosystems run, which is not a trust boundary, and it adds no new layer or input. Not a finding.

Other checks:

• Retirement record: only the note text of the plugin-quality-r002 entry in plugins/plugin-quality/retirements.yaml changed. Its kind, path and action fields, which drive detection and deletion, are unchanged.
• Schema: the skill-quality.schema.json change is to description only. No property, type or additionalProperties changed.
• Manifests: this chunk touches no plugin manifest (plugin.json / marketplace.json).
• Trusted paths: this chunk touches none (no workflow, CLAUDE.md, AGENTS.md, .claude/**, or merge or trust-control script).
• Instruction exception register: I did not open the protected-class list in docs/contracts/instruction-exception-register/README.md. Because nothing was removed or narrowed, the "judge by what breaks if the rule is gone" check was enough.
• PR context: contains no embedded instructions aimed at this review lane.
• Identical files: the identical-copy groups listed for this PR are .changes/ fragments in chunk 1, so none apply here.

No usage-spend or cost effects.

critical-findings: 0

[github-actions]

claude-review reviewed bba95d6e0e6c634ee8bfe75368e35a343eb539f0: read 118 of 118 changed file(s); 0 finding(s), 0 as inline comments.

Chunk 1 of 3 (40 files)

Chunk 1 of 3: no findings. I read every hunk of all 40 files in this chunk. Those are 20 changelog fragments (19 new, 1 edited) and the prose, script-comment, test-label and eval edits in ai-briefing, ai-slop, architecture and autonomy.

What I checked

• Fragments. All 23 plugins of the slice have a bump: patch fragment in .changes/<plugin>/, and each one describes what its plugin changes.
  • From identical.txt: the education fragment is copied to session-flow and verification. All three change exactly reference/config.md and skills/setup/SKILL.md.
  • The implementation fragment is copied to knowledge and playbooks. All three change only reference/config.md.
  • Each copy sits under its own plugin's .changes/ directory. Being a copy does not change what the content does at that path.
  • The edited bump: none fragment for test(evals): add eval cases for pointer-swept skills that have none - part 2 of 9 #13304 only rewords its prose.
• ai-slop detect.sh / detect.test.sh. Only comments and assert_contains labels changed. The expected strings, including the [layer: …ai-slop.local.yaml] values, are byte-identical. No behavior changes.
• Autonomy eval case rename (su-check-reports-overlay-layer → su-check-reports-personal-override). The name: field matches the new directory. A grep of the repository finds no remaining reference to the old case name.
  • The grader still has the name names-overlay-value, and its sample file name is unchanged, so they still pair up.
  • I checked the new regex against every sample by hand; I ran nothing. Both pass samples match, through personal override … paid-opt-in and paid-opt-in | personal override (…binding.local.json).
  • All three fail samples still fail. Fail sample 2 puts paid-opt-in and personal override on separate lines, and [^\n]{0,160} blocks the match. Fail sample 3 has only local-machine, which (?!-machine) excludes.
  • The grader drops the bare word "overlay", so it is a little stricter. The PR states this as intentional, and the updated setup skill text (chunk 2) uses "personal override".
• Path-scoped rules. I checked these files against .claude/rules/eval-case-transcripts.md and .claude/rules/skill-bodies-state-current-rules.md. These are wording-only edits: they add no transcript, no volatile upstream specific and no skill rename that would need a ## Next sweep.
• Plugin manifests. No plugin.json or marketplace.json is in this chunk, so there are no manifest lines.

Closing issue #13192

• Release records follow AGENTS.md: the fragments are present for every touched plugin in this slice.
• Checker over the slice exits 0 and tests / evals validate: I could not run these. The PR body says a Grep stood in for check-vocabulary --sense overlay, and that check-changelog-fragments and check-changed-skills passed. That is the author's claim and I did not verify it; CI is left to confirm it.
• No embedded instructions were found in the PR context or the prior-findings file.

No hold applies: the change is documentation and eval wording only, with no cost and no security impact.

Chunk 2 of 3 (40 files)

Code review, chunk 2 of 3 (40 files): no findings

I read every hunk of all 40 files in this chunk. They cover autonomy (the renamed eval scaffold.sh, binding-seam.md, setup SKILL.md and evals.json), code-tidying, corrections, discovery, docs-hygiene, domain-driven-design, education, and the github reference docs and README.

What I checked

• Wording only. Every change in this chunk renames the cascade's *.local.* layer from "overlay" or "local overlay" to "personal override". The words change in prose, schema description strings, script comments and test labels.
  • No asserted value changed. Examples: 5 local docs/conventions/corrections.local.yaml in codify-settings.test.sh, the grep pattern for stderr, and the $PERSONAL / $TEAM expectations in settings.test.sh.
  • No identifier, key or emitted provenance value changed. The "local" layer name in codify-settings.mjs and glossary-settings.mjs is unchanged.
• Detector fixture. In docs-hygiene, the recall-paraphrases.md fixture and the BOLD_ROSTER line in detect.test.sh both still use the - **Name** — role em-dash shape the detector matches. Only the text after the dash changed, so the enum-list assertion still holds.
• Eval rename. The autonomy eval's scaffold.sh moved to su-check-reports-personal-override/. A Grep over plugins/ finds no remaining reference to the old su-check-reports-overlay-layer name.
• Other senses of "overlay". The edited sentences change only the cascade-layer sense of the word. Two sentences were reworded so they still read correctly with the new term:
  • code-tidying: "user-global layers or *.local.* personal overrides"
  • autonomy evals.json: "user-global and project layers and the personal override"

Path-scoped rules: skill-bodies-state-current-rules.md, eval-case-transcripts.md and cost-claims.md match some of these files. No changed line restates a volatile upstream specific, adds a transcript, or makes a cost claim.

Closing issue #13192: this chunk changes no line that fails its acceptance criteria. Whether the vocabulary checker and the plugin test suites pass is left to the PR's CI; the author says so too, and I could not run them.

Not covered here: plugin manifests (no plugin.json or marketplace.json is in this chunk) and trusted paths (no file in this chunk matches one).

Chunk 3 of 3 (34 files)

Code review: chunk 3 of 3 (34 files). No findings.

I read every hunk of all 34 files in this chunk. They cover github setup, harness-config, implementation, instruction-placement, knowledge, mutation-testing, overengineering, playbooks, plugin-quality, session-flow, skill-quality, toolchain and verification. Every change is a wording change: the cascade's gitignored *.local.* layer is now called "personal override" instead of "local overlay" or "overlay". This happens in prose, layer tables, eval prompts, expected outputs and expectations, one schema description, and the retirements.yaml note.

What I checked:

• Behavior. Nothing in this chunk changes how anything runs. No key, path, regex, glob, identifier or emitted value changed.
• plugins/plugin-quality/retirements.yaml. Only the free-text note changed. kind, path and action are untouched, and I found nothing else in the repository that matches the old note text.
• Renamed eval case. The case retirement-r002-overlay-warns-never-silent in plugins/plugin-quality/skills/setup/evals/evals.json is now retirement-r002-personal-override-warns-never-silent. A Grep found no remaining reference to the old name.
• Leftover uses of "overlay". A Grep for \boverlays?\b over these 13 plugins found matches only in CHANGELOG.md files and in other meanings: knowledge's video and screenshot overlays, the overlay variable in run-args.js, and harness-config unhobble's plugin overlay. Those other meanings are left alone on purpose, as the issue's decision D8 says.
• Toolchain wording. In plugins/toolchain/reference/resolution-ladder.md, "A consumer overlay can also flip enabled" now reads "A later layer can also flip enabled". That is still accurate, since the layers apply per key.
• Changelog fragments. Every plugin with a change in this chunk has a fragment. Those for github, harness-config, implementation, instruction-placement, mutation-testing, overengineering, plugin-quality, skill-quality and toolchain are in chunk 1. Those for session-flow, verification, knowledge and playbooks are copies of the education and implementation fragments listed in identical.txt. All copies are .changes/<plugin>/ fragments, so their location does not change what they do.
• Plugin manifests. No plugin.json or marketplace.json changes in this chunk.

Closing issue #13192. Its acceptance criteria are: the vocabulary checker exits 0 over this slice's plugins, the plugins' tests and evals pass, and each plugin's release record follows AGENTS.md. I could not run the checker, tests or eval validation because this lane has no shell. My Grep stood in for the checker on this chunk's plugins and found no cascade-sense matches. The PR body says the author also ran a Grep in place of the checker, plus check-changelog-fragments, check-changed-skills and check-affected. Those results are the author's and I did not verify them; CI has to confirm them.

Embedded text. I found no embedded instructions in the PR context or prior-findings files. This review covered all findings, not just blocking ones, because this lane has not reviewed an earlier head.

Spend. None in this chunk: it adds no run, schedule or model change.

[melodic-automation-lanes]

The unattended merge path armed native auto-merge at head bba95d6e0e6c634ee8bfe75368e35a343eb539f0.

[melodic-automation-lanes]

The pr-unblock lane stopped resolve-conflicts on this pull request: the lane could not resolve every conflict. The lane sets no label: the run ends in a failing pr-unblock/conflict status on the head the lane gated.

• Reason: unresolved-conflict
• Head: bba95d6e0e6c634ee8bfe75368e35a343eb539f0
• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/41903104941

When a retry on this head can change the outcome, the lane runs one on its own, up to its per-head cap, and edits this comment if it stops again; a run that does not stop clears the status. When no retry can (a review thread the lane does not take or settle, or a failing check after the retries are spent), a person resolves the threads or gets the checks green, then dispatches the workflow below: that run finds the cause gone and clears the status. On a pull request the lanes App opened, the dispatchers start that run once per stop; on any other, a person does. A new commit to the branch starts clean.

To run it again on this head now, dispatch the pr-unblock workflow:

gh workflow run pr-unblock.yml -R melodic-software/claude-code-plugins -f pr-number=13337 -f activity=resolve-conflicts

[melodic-automation-lanes]

Unattended merge: native auto-merge leaves this pull request unarmed at head bba95d6e0e6c634ee8bfe75368e35a343eb539f0. The lanes clear this reason on their own; the next scheduled run judges it again.

a pr-unblock lane stopped its head (pr-unblock/conflict is failure), which clears when the lane runs
  again

[kyle-sexton]

Hold: resolve-conflicts escalated (unresolved-conflict, run 41903104941) after #13338 renamed the same term in overlapping files. PR Lane is building an owner-login replacement from origin/main that merges this head. Releases when: the replacement merges, then this PR closes as superseded.

[kyle-sexton]

Superseded by #13368, merged 2026-11-04T21:25:36Z, which carries this PR's #13192 rename merged onto main after #13338 (resolve-conflicts had escalated with unresolved-conflict).