feat(re-anchor): add scrutinize-dont-coast corrector

[kyle-sexton]

What

Adds scrutinize-dont-coast to the re-anchor plugin (0.4.0 → 0.5.0): a drift corrector for adversarial self-scrutiny — the general "don't coast on your own recent output" re-look, distinct from the plugin's content-axis correctors (research, incumbency, terseness, …). The user hits the brakes; the skill stops, re-examines whether the recent output is actually sound (not merely confidently produced), and remediates with the user.

Design

Re-anchors a meta discipline rather than a single content axis. It runs the shared re-anchor / audit / correct-forward loop (context/re-anchor-audit-correct.md) with two deliberate, documented deltas — flagged in the SKILL.md rather than silently diverging:

1. Stop first. The failure mode is over-confident forward momentum, so it halts the trajectory before auditing. No sibling prepends a stop.
2. Remediate with the user, not autonomously. The shared loop's step 3 corrects forward on its own; here it becomes collaborative — the remedy for runaway momentum can't be more unilateral momentum.

The load-bearing adversarial pass is delegated to a fresh-context (non-fork) subagent blind to the reasoning that produced the output, satisfying the philosophy's fresh-eyes rule that a same-context self-check cannot. Findings return and remediation proceeds with the user — composing the fresh-eyes constraint and the collaborative-remediation intent instead of trading one off. An optional focus scopes the pass without suppressing a serious out-of-focus flaw.

Negative routing (explicit in the skill): pre-implementation plan stress-tests → /planning:devils-advocate (guarded, degrades to prose when absent); review checkpoints → /review:quality-gate; single-axis flaws → the sibling that owns them.

Naming tournament

Research-backed tournament via naming:name-it-better — 5 blind fresh-context generators (responsibility-literal, moment-of-use, domain-lore, physical-metaphor, family-idiom-fit), each seeded only with a structured brief (temporal-neutrality constraint, sentence-form test, negative boundary vs devils-advocate/quality-gate, word blocklist: audit/gate/review/devil/advocate/bare-check).

• Winner (provisional, user-confirmable pre-merge): scrutinize-dont-coast — top-2 in 3 of 5 lenses, including the two most decision-relevant (responsibility-literal, family-idiom-fit). Verb-dont-verb family shape (shared with reason-dont-recite, point-dont-copy, reuse-or-replace); temporally neutral (a standing principle, not a presupposition of existing flawed work); names both the action and the failure mode.
• Runners-up: distrust-your-momentum (co-convergent — top-2 in 3 lenses; evocative, but names the cause not the action and reads weaker at the call site); red-team-your-own-work (exact term of art, but longer and security-jargon-tinged). Also surfaced: prove-it-holds, pump-the-brakes, stop-and-look-hard.
• My-pick-vs-tournament note: my own same-context pick before the blind round was stop-and-scrutinize; it did not surface in any lens, and the judging confirms the convergent winner scores higher on family-idiom fit, temporal-neutrality, and sentence-form. Dogfooding the blind method overrode the author's anchored pick — exactly this skill's own thesis.

Gates

• claude plugin validate . — PASS
• skill-quality check scrutinize-dont-coast — PASS (0 errors, 0 warnings; markdownlint clean; 133/500 lines; description 529/1536 chars)
• evals: 5 cases (trigger+fresh-context happy path, clean-guardrail, devils-advocate negative-routing, focus-scoping, conversation-start posture), schema-valid
• Independent fresh-context review (blind to author rationale): verdict SHIP-WITH-FIXES, no CRITICAL; all findings folded (quality-gate ref guarded; fresh-context rationale pointed-not-copied at the method doc; audit list reframed as the fresh-pass brief; eval ci: onboard to the CI platform (ci-workflows + standards) #4 reworded to a disposition check). The review's skill-quality dimension is the check-skill.sh PASS above.
• Plugin-acceptance security review: ACCEPT — prompt-only skill, zero trust surface added (no hooks/scripts/MCP/userConfig/bin/settings-agent; only internal ${CLAUDE_PLUGIN_ROOT} ref). Additive 0.4.0→0.5.0 bump touches no trust surface.

Scope

plugins/re-anchor/skills/scrutinize-dont-coast/{SKILL.md,evals/evals.json} (new); plugin.json (version, description, keywords); README.md catalog entry; plugins/re-anchor/CHANGELOG.md. marketplace.json untouched (version lives in plugin.json; adding a skill to an existing plugin does not change its catalog entry).

Open questions for the user

1. Precedent — first family skill to override shared-loop steps (needs a user ruling). This is the first corrector to declare deltas to the shared re-anchor / audit / correct loop: it prepends a STOP and makes step 3 collaborative ("remediate with the user") where every sibling corrects forward autonomously. Resolved here as documented per-skill deltas — context/re-anchor-audit-correct.md was NOT touched. Two ways to settle the precedent, your call: (a) sanction declared per-skill step-overrides by adding an allowance to the shared method doc (so future correctors may do this cleanly), or (b) reconsider — fold the behavior back to the autonomous family default. If instead STOP-first + collaborative-remediation should become the family norm, that's a method-doc change touching all 13 skills — a separate decision, not made unilaterally here.
2. Name. scrutinize-dont-coast is the provisional tournament winner; distrust-your-momentum is the co-convergent alternative. Confirm or swap before merge (trivial rename).

Cross-lane note

Lane 3's planning:devils-advocate incumbent extension is in flight concurrently. This skill's boundary text keys on the stable contract (devils-advocate = plans/proposals before implementation; this = output already produced, mid-flight), which is robust to that extension — no coordination edit needed.

Related

• No linked issue — this skill was locked from the batch-3 interview ledger (re-anchor item 2); it was never tracked as a GitHub issue, so this PR closes nothing.
• Plugin plugins/re-anchor (0.4.0 → 0.5.0).
• Concurrent batch-3 lanes (independent PRs): session-flow orientation + keep-going hardening; planning:devils-advocate incumbent extension — see the cross-lane note above.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[claude]

Claude finished @kyle-sexton's task in 2m 17s —— View job

---

PR #838 Review — scrutinize-dont-coast corrector

• Gather context (PR description, changed files)
• Read changed files
• Review SKILL.md for correctness and design alignment
• Review plugin.json version bump and schema
• Review evals.json coverage
• Review README.md and CHANGELOG.md entries
• Post final review

---

Overall Assessment

This is a well-architected, carefully documented addition to the re-anchor family. The skill's design is internally consistent, the security surface is clean, and the two deliberate deltas to the shared loop are explicitly flagged rather than silently diverging. Two open questions from the PR description warrant a decision before merge — both called out below.

---

SKILL.md

Structure: Follows the family pattern exactly — frontmatter with user-invocable: true / disable-model-invocation: false, shared loop reference via ${CLAUDE_PLUGIN_ROOT}, then skill-specific content. Consistent with siblings like reuse-or-replace. ✓

Fresh-context subagent constraint (line 69–74): Correctly distinguishes a fork (inherits parent context, carries the same bias) from a clean-start subagent, and makes the clean-start mandatory in the skill rather than leaving it to the invoker. This is the load-bearing correctness property of the skill, and it's well-articulated.

A fork inherits the parent conversation and carries the same bias forward,
so it does not satisfy this — the subagent must start clean.

✓

Two deltas (lines 47–59): Both are documented inline. Delta 1 (stop first) is unambiguous. Delta 2 (collaborative remediation) is the meaningful family departure — addressed under "Open Questions" below.

Negative routing (lines 108–120): All three routing targets are named, the devils-advocate degradation-to-prose fallback is explicit, and the timeline distinction ("output already produced, reactively" vs. "a plan before the work is built") is clear and robust to the in-flight lane-3 devils-advocate extension the PR mentions.

Optional focus non-suppression guarantee (lines 83–86):

A focus narrows aim; it never suppresses a serious flaw the pass finds
outside it — surface that too.

Correctly stated. ✓

Gotchas (lines 125–133): The clarification that "'Stop' means stop the trajectory, not stop the conversation" is exactly the nuance a reader would stumble on. Well placed.

Line count: 133 lines body + frontmatter — within the 500-line cap. ✓

---

plugin.json

Version bump: 0.4.0 → 0.5.0. Additive, non-breaking — minor bump is correct. ✓

Description update: The new entry appended at the end matches the style of every existing entry (parenthetical summary, named deltas, key constraint noted). ✓

Keywords: self-scrutiny and adversarial added. Appropriate and non-duplicative. ✓

One observation: the plugin description field is now extremely long (~2,300 chars). It's a single string, so it passes schema validation, but worth monitoring as more skills are added.

---

evals.json

Five evals covering:

ID	Case	Verdict
1	Happy path — stop + fresh-context subagent + collaborative remediation	✓ Core contract
2	Clean pass — no fabricated finding	✓ "A clean result is not a failure"
3	Negative routing — pre-implementation plan → devils-advocate	✓ Primary negative boundary
4	Focus scoping — narrows without suppressing out-of-scope flaw	✓ Focus semantic
5	Conversation-start posture — no audit when no output exists	✓ Shared loop's start case

Coverage gap (non-blocking): The skill's "What this skill does NOT do" section names a fourth routing case — single-axis flaw to the owning sibling (e.g. /re-anchor:do-your-research for an unverified claim). None of the five evals covers this path. Given that the 5-eval set already covers the more decision-sensitive boundaries, this is acceptable, but an eval 6 testing "routes a squarely-research flaw to do-your-research while keeping the general scrutiny" would close the gap.

---

CHANGELOG.md and README.md

Both are clean additive entries, format-consistent with prior entries. CHANGELOG follows Keep a Changelog 1.1.0. README catalog entry matches the plugin.json description (modulo minor wording). ✓

---

Security (plugin-acceptance review)

Confirmed from the files:

• Zero hooks, scripts, MCP servers, userConfig refs, or bin/ entries
• Only internal reference: ${CLAUDE_PLUGIN_ROOT}/context/re-anchor-audit-correct.md (plugin-form-safe)
• No outward egress — the skill drafts and routes, never files

Accept. ✓

---

CLAUDE.md alignment

Rule	Status
Repo-agnostic	✓ No hardcoded paths; ${CLAUDE_PLUGIN_ROOT} only
Configurable without editing	✓ No userConfig required
Plugin-form-safe	✓ No ../ escapes
No PII/secrets	✓ Pure prompts
Versioned	✓ Explicit semver 0.5.0
Security-reviewed	✓ Documented, clean

---

Open Questions (from PR body — need decisions before merge)

1. Collaborative-remediation contract (delta 2)

This is the only skill in the 13-corrector family where step 3 is collaborative rather than autonomous. The departure is well-documented and the rationale is coherent ("the remedy for runaway momentum can't be more unilateral momentum"), but it creates a family inconsistency that a consumer relying on uniform corrector behavior will notice.

The PR correctly flags this as a decision point rather than making it unilaterally. Confirm: is this a documented per-skill exception, or should the shared method doc be updated to allow optional collaborative remediation across the family? The current approach (per-skill documented delta) is the safer choice — it doesn't touch the 12 existing skills.

2. Name: scrutinize-dont-coast vs distrust-your-momentum

The tournament rationale is solid and the verb-dont-verb family shape is a real advantage. distrust-your-momentum names the cause rather than the action, which is the weaker choice at the call site (/re-anchor:scrutinize-dont-coast reads as an imperative instruction; /re-anchor:distrust-your-momentum reads as a diagnosis). Confirm scrutinize-dont-coast before merge.

---

Summary

Ready to merge once the two open questions are confirmed. No blocking correctness or security issues. One non-blocking eval coverage gap (single-axis routing). The skill is internally consistent, the documentation is thorough, and the fresh-context subagent constraint is correctly mandatory rather than advisory.

[claude]

Claude finished @kyle-sexton's task in 1m 11s —— View job

---

Security Review

• Gather PR diff and changed files
• Review SKILL.md for injection / prompt-manipulation surfaces
• Review evals/evals.json for unsafe patterns
• Review plugin.json for trust-surface changes
• Review README.md and CHANGELOG.md
• Synthesize findings and post security report

---

Findings

No security issues found.

All five changed files were reviewed against the full threat model: injection surfaces (command, path, template, prompt), authorization/access-control gaps, unsafe credential/token handling, dangerous GitHub Actions patterns, and supply-chain risk from loosened or unpinned dependencies.

---

Per-file notes

plugins/re-anchor/skills/scrutinize-dont-coast/SKILL.md

Prompt-only skill. Zero executable surface. Key properties checked:

• Trust surface: No hooks, scripts, MCP servers, userConfig, bin, or settings-agent references. The only external reference is ${CLAUDE_PLUGIN_ROOT}/context/re-anchor-audit-correct.md — a correct, sandboxed internal-plugin path variable, not a reach-out.
• Subagent delegation: The skill mandates spawning a fresh-context (non-fork) subagent to examine the user's produced artifacts. The subagent receives the artifact for adversarial analysis only — it is never instructed to execute, run, or deploy the content. No command-injection path exists; the subagent's output is findings text returned to the parent thread.
• Outward-artifact gate: Explicitly restated in the skill at line 62: "nothing here files a PR, issue, or published comment without the user's explicit opt-in." The delta-2 collaborative-remediation design additionally prevents autonomous in-tree rewrites for judgment-call findings. Both constraints are load-bearing.
• Prompt injection via artifact content: A malicious artifact passed to the subagent cannot trigger harmful autonomous actions — the subagent is scoped to analysis, the outward-artifact gate is in place, and all judgment-call remediation is gated on user collaboration. Risk: not exploitable given the design constraints.
• Trigger phrase breadth: The description field includes conversational phrases ("wait, stop", "are you sure about this") that could match inadvertent input. This is a UX/false-positive concern, not a security concern — the skill takes no autonomous external action and requires user collaboration for non-trivial remediation.
• No PII or secrets anywhere in the skill text.

plugins/re-anchor/skills/scrutinize-dont-coast/evals/evals.json

Pure data. No executable code, no external references, no credentials. Eval prompts are abstract (cache invalidation, migration scripts by description only). No security concerns.

plugins/re-anchor/.claude-plugin/plugin.json

Version bump 0.4.0 → 0.5.0, description update, two new keywords (self-scrutiny, adversarial). No new hooks, MCP servers, scripts, external dependencies, or permission widening. No security concerns.

README.md / plugins/re-anchor/CHANGELOG.md

Documentation text only. No security concerns.

---

Supply chain / GitHub Actions

No changes to .github/workflows/, action pins, dependency versions, or settings.json permission grants. Trust surface is additive-zero relative to 0.4.0.

[claude]

Claude finished @kyle-sexton's task in 2m 8s —— View job

---

PR #838 Review — scrutinize-dont-coast corrector

• Gather context (PR description, changed files)
• Read changed files
• Review SKILL.md for correctness and design alignment
• Review plugin.json version bump and schema
• Review evals.json coverage
• Review README.md and CHANGELOG.md entries
• Post final review

---

Overall Assessment

Well-constructed addition to the re-anchor family. The skill's two deliberate deltas to the shared loop are properly documented inline rather than diverging silently. Security surface is zero. One minor grammar issue in the description string (present in both plugin.json and README.md), one non-blocking eval gap, and two open questions from the PR body that need a decision before merge.

---

SKILL.md

Structure and frontmatter. Follows the family pattern exactly — user-invocable: true, disable-model-invocation: false, shared loop reference via ${CLAUDE_PLUGIN_ROOT}. ✓

Fresh-context subagent (lines 64–74). The mandatory non-fork requirement is correctly stated and the reasoning is load-bearing: a fork inherits the producing context's bias, so it cannot satisfy the fresh-eyes constraint. The distinction between "fork" and "clean-start subagent" is explicit. ✓

Two deltas (lines 47–59). Both are documented inline with rationale. Delta 1 (stop first) is unambiguous. Delta 2 (collaborative remediation) is the meaningful family departure — the PR flags it as an open question for the author, which is the right call rather than making it unilaterally. ✓

Negative routing (lines 107–121). All three routing targets named, the devils-advocate prose-degradation fallback is explicit, and the timeline distinction between "output already produced" vs. "plan before work is built" is clear and robust. ✓

Optional focus non-suppression (lines 83–86). Correctly stated: focus narrows aim, never hard-filters. ✓

Gotchas (lines 125–133). The "'Stop' means stop the trajectory, not stop the conversation" clarification is exactly the nuance a reader would stumble on. Well placed. ✓

Line count. 135 lines including frontmatter — well within the 500-line cap. ✓

---

plugin.json

Version bump. 0.4.0 → 0.5.0. Additive, non-breaking — minor bump correct. ✓

Keywords. self-scrutiny and adversarial added, non-duplicative. ✓

Double-"and" in description list (non-blocking, minor). The description appended , and scrutinize-dont-coast after what was previously the final list item (reuse-or-replace), which itself carries an and. The result is a serial list where both the penultimate and final items are introduced with and:

...and reuse-or-replace (...), and scrutinize-dont-coast (...).

Conventional serial lists place and only before the final item. The current form is grammatically awkward and will re-appear with every future skill addition unless the pattern is adjusted. The simplest fix for this PR is to drop the and from reuse-or-replace's position, leaving it only on the new final item. [Fix this →](https://claude.ai/code?q=In%20plugins%2Fre-anchor%2F.claude-plugin%2Fplugin.json%20and%20README.md%2C%20on%20branch%20feat%2Fre-anchor-adversarial-scrutiny%2C%20the%20description%20string%20currently%20reads%20%22...and%20reuse-or-replace%20(...%29%2C%20and%20scrutinize-dont-coast%20(...%29.%22%20%E2%80%94%20two%20consecutive%20%22and%22%20connectors.%20Remove%20the%20%22and%20%22%20before%20%22reuse-or-replace%22%20so%20only%20the%20final%20item%20carries%20it%3A%20%22...reuse-or-replace%20(...%29%2C%20and%20scrutinize-dont-coast%20(...%29.%22&repo=melodic-software/claude-code-plugins)

The same issue is present in README.md (same string). ✓ otherwise.

Description length. The description field is now ~2,300 chars as a single string. Passes schema validation today, but worth establishing a convention (split into a separate skills array in the manifest, or cap per-entry summaries) before the next skill addition. Not a blocker for this PR.

---

evals.json

Five evals covering:

ID	Case	Status
1	Happy path — stop + fresh-context subagent + collaborative remediation	✓ Core contract
2	Clean pass — no fabricated finding	✓ Non-fabrication guarantee
3	Negative routing — pre-implementation plan → devils-advocate	✓ Primary negative boundary
4	Focus scoping — narrows without suppressing out-of-focus flaw	✓ Focus semantic
5	Conversation-start posture — no audit when no output exists	✓ Shared loop's start case

Coverage gap (non-blocking). The SKILL.md "What this skill does NOT do" section (line 118) names a fourth routing case — single-axis flaw to the owning sibling (e.g., an unverified claim → /re-anchor:do-your-research). No eval exercises this boundary. An eval 6 of the form "unverified number in the output, no broader momentum issue → routed to do-your-research" would close it. Not a merge blocker given the existing coverage of the more decision-sensitive boundaries.

---

CHANGELOG.md and README.md

Both are clean additive entries, format-consistent with prior entries. CHANGELOG follows Keep a Changelog 1.1.0. README catalog entry matches plugin.json description. ✓

---

Security

• Zero hooks, scripts, MCP servers, userConfig refs, or bin/ entries
• Only internal reference: ${CLAUDE_PLUGIN_ROOT}/context/re-anchor-audit-correct.md — confirmed present on disk, plugin-form-safe
• Subagent is scoped to analysis only; outward-artifact gate is explicitly restated in the skill (line 61–62)
• No PII or secrets

Accept. ✓

---

CLAUDE.md alignment

Rule	Status
Repo-agnostic	✓ ${CLAUDE_PLUGIN_ROOT} only
Configurable without editing	✓ No userConfig required
Plugin-form-safe	✓ No ../ escapes
No PII/secrets	✓ Pure prompts
Versioned	✓ Explicit semver 0.5.0
Security-reviewed	✓ Accept

---

Open Questions (decisions needed before merge)

1. Collaborative-remediation contract (delta 2)

This is the only skill in the 14-corrector family where step 3 is collaborative rather than autonomous. The rationale is coherent ("the remedy for runaway momentum can't be more unilateral momentum"), and the PR correctly flags this as a decision point. The current per-skill documented-delta approach is the safer choice — it leaves the 13 existing skills untouched. Confirm: documented per-skill exception, or shared-method-doc update to allow optional collaborative remediation across the family?

2. Name: scrutinize-dont-coast vs distrust-your-momentum

The tournament rationale is solid. At the call site, scrutinize-dont-coast reads as an imperative instruction; distrust-your-momentum reads as a diagnosis — that's a real advantage for the winner. Confirm scrutinize-dont-coast before merge.

---

Summary

Ready to merge once:

1. The two open questions above are confirmed (or acted on)
2. Optionally: double-"and" grammar fix in the description string

No blocking correctness or security issues. Non-blocking: one eval gap (single-axis sibling routing) and the growing description-string length to track.

[claude]

Claude finished @kyle-sexton's task in 1m 34s —— View job

---

Security Review — PR #838 scrutinize-dont-coast

• Gather PR diff and changed files
• Review SKILL.md for injection / prompt-manipulation surfaces
• Review evals/evals.json for unsafe patterns
• Review plugin.json for trust-surface changes
• Review README.md and CHANGELOG.md
• Synthesize and post security findings

---

Findings

No blocking security issues found.

All five changed files were reviewed against the threat model: command/path/template/prompt injection, authorization and access-control gaps, unsafe handling of credentials/secrets, dangerous GitHub Actions patterns, and supply-chain risk from loosened or unpinned dependencies.

---

Per-surface notes

plugins/re-anchor/skills/scrutinize-dont-coast/SKILL.md

Zero executable surface. Key properties confirmed:

• Trust surface: No hooks, scripts, MCP servers, userConfig, bin, or settings-agent references. The only external reference — ${CLAUDE_PLUGIN_ROOT}/context/re-anchor-audit-correct.md — is the correct sandboxed plugin-path variable; no ../ escape.
• Outward-artifact gate: Explicitly restated at line 61–62: "nothing here files a PR, issue, or published comment without the user's explicit opt-in." Binding.
• No PII or secrets anywhere in the skill text.

One theoretical surface worth noting — rated SUGGESTION, confidence LOW:

SUGGESTION (confidence: LOW) — Artifact-relay prompt injection surface

The skill mandates passing the user's produced artifact to a fresh-context subagent at lines 71–74: "handed the artifact and the requirement, not the story of how the work was reached, and told to find what is wrong." A malicious artifact (e.g., user-supplied text containing embedded instructions) could attempt to redirect the subagent's behavior beyond its analysis scope.

Why this is LOW confidence of exploitation: (1) the subagent is scoped to analysis/critique — it is explicitly told to find what is wrong, not to act; (2) the outward-artifact gate (line 61) prevents autonomous external action; (3) delta 2 (collaborative remediation) gates all judgment-call changes on the user; (4) this threat surface is inherent to any skill that passes user content to a subagent and is managed adequately by the existing design constraints. No code change is recommended — flagged for awareness only.

plugins/re-anchor/skills/scrutinize-dont-coast/evals/evals.json

Pure data file. No executable code, no external references, no credentials. Eval prompts use abstract placeholders ("cache-invalidation function", "migration script"). No security concerns.

plugins/re-anchor/.claude-plugin/plugin.json

Version bump 0.4.0 → 0.5.0, description update, two new keywords (self-scrutiny, adversarial). No new hooks, MCP servers, scripts, bin entries, external dependencies, or permission widening. Trust surface is additive-zero relative to 0.4.0. No security concerns.

README.md / plugins/re-anchor/CHANGELOG.md

Documentation text only. No security concerns.

---

GitHub Actions / Supply chain

No changes to .github/workflows/, action pins, dependency versions, or settings.json permission grants. No security concerns.

---

Accept. The plugin-acceptance security review passes: prompt-only skill, zero trust surface added.

[claude]

Claude finished @kyle-sexton's task in 2m 39s —— View job

---

PR #838 Review — scrutinize-dont-coast corrector

• Gather context (PR description, trigger, changed files list)
• Read changed files
• Review SKILL.md for design correctness and family alignment
• Review plugin.json and CHANGELOG.md
• Review evals.json coverage
• Review context/re-anchor-audit-correct.md delta
• Synthesize and post final review

---

Overall

Well-structured addition. Security surface is zero (prompt-only), CLAUDE.md design rules all pass, and the two deliberate loop deltas are properly declared in the skill rather than diverging silently. The open question about per-skill step-delta precedent (PR body Q1) is resolved by commit 619b097 — the shared method doc now sanctions declared deltas, which is the correct governance call. One remaining decision (name, PR body Q2) still needs a user ruling before merge. One grammar nit and one eval gap are both non-blocking.

---

context/re-anchor-audit-correct.md

The new "Declared step deltas" section is well-governed:

A skill that diverges without declaring the delta is in violation of this doc,
not exercising this allowance. The Non-negotiables below are never overridable.

The placement between step 4 and "Conversation-start case" is logical — it reads as a meta-rule about the loop before the edge-case cases. The boundary ("Non-negotiables below are never overridable") correctly seals the escape hatch. ✓

This resolves PR body Q1 (option a: sanction declared per-skill overrides). The CHANGELOG correctly classifies it as "Changed" rather than "Added." ✓

---

SKILL.md

Structure: Follows the family pattern exactly — frontmatter, shared-loop reference via ${CLAUDE_PLUGIN_ROOT}, then skill-specific content. Consistent with reuse-or-replace. ✓

Fresh-context subagent (lines 64–74): The mandatory non-fork requirement is the load-bearing correctness property and is stated correctly with its reason. The explicit "A fork inherits the parent conversation and carries the bias forward, so it does not satisfy this" is the key distinction a reader could miss, and it's in exactly the right place. ✓

Two deltas (lines 47–59): Both declared with reasons. Delta 2 (collaborative remediation) notes the correct carve-out — "Purely mechanical, unambiguous corrections (a typo the pass surfaced) are still fixed directly; anything carrying a judgment call is proposed and worked jointly" — which prevents the delta from becoming a blanket passivity rule while honoring its intent. ✓

"Audit — what to look for" (lines 88–105): Framing this section as the brief handed to the fresh-context pass (not an in-context self-audit list) is the right call. The six items are concrete and attack-mode, not reassurance-seeking. ✓

Negative routing (lines 107–121): All three named. The timeline distinction ("output already produced, reactively, mid-flight" vs. "a plan before the work is built") correctly identifies the stable contract boundary with devils-advocate — robust to the in-flight lane-3 extension. ✓

Gotchas (lines 125–133): "'Stop' means stop the trajectory, not stop the conversation" is the right clarification to surface; a reader would otherwise interpret delta 1 as "abort the session." ✓

One structural note (non-blocking): The skill declares in its opening paragraph that it follows the shared loop and adds "two deliberate deltas," but the two deltas (Section "Two deltas to the shared loop") appear after the "The discipline this re-anchors" section. A reader parsing the file top-to-bottom hits the discipline before the loop modifications. This isn't wrong, but a sibling skill like reuse-or-replace has a tighter discipline-then-loop flow. Not a blocking issue — just noting the read-order.

---

plugin.json

Version bump: 0.4.0 → 0.5.0. Additive, non-breaking — minor bump correct. ✓

Keywords: self-scrutiny and adversarial added, non-duplicative. ✓

🟡 Nit — double "and" in description string: The new entry appends , and scrutinize-dont-coast after what was already the final list item (reuse-or-replace), which itself carries an and:

...and reuse-or-replace (...), and scrutinize-dont-coast (...).

Conventional serial lists place and only before the final item. The fix is to drop and from in front of reuse-or-replace so only the new final item carries it. The same issue is present in README.md (same string). [Fix this →](https://claude.ai/code?q=In%20plugins%2Fre-anchor%2F.claude-plugin%2Fplugin.json%20and%20README.md%2C%20on%20branch%20feat%2Fre-anchor-adversarial-scrutiny%2C%20the%20description%20string%20ends%20with%20%22...and%20reuse-or-replace%20(...%29%2C%20and%20scrutinize-dont-coast%20(...%29.%22%20%E2%80%94%20two%20consecutive%20%22and%22%20connectors.%20Remove%20%22and%20%22%20before%20%22reuse-or-replace%22%20so%20only%20the%20final%20item%20carries%20it%3A%20%22...reuse-or-replace%20(...%29%2C%20and%20scrutinize-dont-coast%20(...%29.%22&repo=melodic-software/claude-code-plugins)

Description length: Now ~2,300 chars as a single string. Passes schema validation. Worth establishing a per-entry summary cap or a structured skills array in the manifest before the next addition — not a blocker for this PR.

---

evals.json

ID	Case	Verdict
1	Happy path — stop + fresh-context subagent + collaborative remediation	✓ Core contract
2	Clean pass — no fabricated finding	✓ Non-fabrication guarantee
3	Negative routing — pre-implementation plan → devils-advocate	✓ Primary negative boundary
4	Focus scoping — narrows without suppressing out-of-focus flaw	✓ Focus semantic
5	Conversation-start posture — no audit when no output exists	✓ Shared loop's start case

🟡 Nit — missing eval for single-axis sibling routing: The SKILL.md line 118–121 names a fourth routing case — a squarely-single-axis flaw hands that part to the owning sibling (/re-anchor:do-your-research) while keeping general scrutiny here. No eval exercises this boundary. An eval 6 on the order of "unverified number, no broader momentum issue → routes to do-your-research while keeping the general scrutiny" would close the gap. Non-blocking given the existing coverage.

---

CHANGELOG.md

Correct: 0.5.0 has both a "Changed" section (shared loop doc) and an "Added" section (new skill). Format consistent with prior entries, follows Keep a Changelog 1.1.0. ✓

---

Security (CLAUDE.md plugin-acceptance review)

Check	Result
Hooks / scripts / MCP / bin	None
userConfig refs	None
Internal-plugin path only	${CLAUDE_PLUGIN_ROOT}/context/re-anchor-audit-correct.md — correct, confirmed present on disk
Outward-artifact gate	Restated at line 61–62
PII / secrets	None
REVIEW.md blocking criteria	N/A — no handlers, data-access paths, multi-record writes, or credentials

Accept. ✓

---

CLAUDE.md alignment

Rule	Status
Repo-agnostic	✓ ${CLAUDE_PLUGIN_ROOT} only, no hardcoded paths
Configurable without editing	✓ No userConfig required
Plugin-form-safe	✓ No ../ escapes
No PII/secrets	✓ Pure prompts
Versioned	✓ Explicit semver 0.5.0
Security-reviewed	✓ Accept

---

Open questions (carry-forward from PR body)

Q1 (per-skill delta precedent): Resolved by commit 619b097 — option (a) chosen. The shared method doc now sanctions declared deltas; undeclared divergence remains a violation; Non-negotiables are never overridable. The correct governance call.

Q2 (name): scrutinize-dont-coast is implemented throughout. The tournament rationale is sound — verb-dont-verb family shape, temporally neutral, names both action and failure mode. The runner-up distrust-your-momentum names the cause rather than the action, which is weaker at the call site. Confirm the name before merge.

---

Summary

Ready to merge once Q2 (name) is confirmed. No blocking correctness or security issues found. Two nits, both non-blocking: the double-"and" grammar in the description string (trivially fixable) and the missing eval for single-axis sibling routing.

[claude]

Claude finished @kyle-sexton's task in 1m 32s —— View job

---

Security Review — PR #838 scrutinize-dont-coast

• Gather PR diff and changed files
• Review SKILL.md for injection / prompt-manipulation surfaces
• Review re-anchor-audit-correct.md additions (10 new lines — new "Declared step deltas" section)
• Review evals/evals.json for unsafe patterns
• Review plugin.json for trust-surface changes
• Review README.md and CHANGELOG.md
• Synthesize and post findings

---

Findings

No blocking security issues found.

All six changed files were reviewed against the full threat model: command/path/template/prompt injection, authorization and access-control gaps, unsafe handling of credentials/secrets, dangerous GitHub Actions patterns, and supply-chain risk from loosened or unpinned dependencies.

---

Per-surface notes

plugins/re-anchor/skills/scrutinize-dont-coast/SKILL.md

Zero executable surface. Confirmed:

• No hooks, scripts, MCP servers, userConfig, bin, or settings-agent references. The only external reference — ${CLAUDE_PLUGIN_ROOT}/context/re-anchor-audit-correct.md — is the correct sandboxed plugin-path variable; no ../ escape.
• Outward-artifact gate explicitly restated at line 61–62: "nothing here files a PR, issue, or published comment without the user's explicit opt-in." Binding.
• Delta 2 (collaborative remediation) at lines 52–59 gates judgment-call changes on user collaboration — a second constraint against autonomous outward action, composing with the artifact gate.
• No PII or secrets anywhere in the skill text.

One theoretical surface noted — rated SUGGESTION, confidence LOW:

SUGGESTION (confidence: LOW) — Artifact-relay prompt injection

Lines 71–74 mandate passing the user's produced artifact to a fresh-context subagent "blind to the reasoning that produced the output... told to find what is wrong." A malicious artifact could embed instructions to redirect the subagent's behavior.

Why LOW confidence of exploitation: (1) the subagent scope is analysis-only — find what is wrong, not act; (2) the outward-artifact gate (line 61) prevents autonomous external action; (3) delta 2 gates all judgment-call remediation on user collaboration. These constraints compose and adequately contain the surface. This threat is inherent to any skill that relays user content to a subagent and is appropriately managed here. No code change recommended.

---

plugins/re-anchor/context/re-anchor-audit-correct.md — the addition warranting independent scrutiny

The 10 added lines (the new "Declared step deltas" section) loosen a previously-implied constraint: all correctors now may modify a loop step if and only if the delta is declared in the skill's own SKILL.md alongside the reason.

Security-relevant question: does this allowance open a path to override the Non-negotiables (no outward artifacts without opt-in, never fabricate)?

Answer: No. The text is explicit — line 69: "The Non-negotiables below are never overridable." The allowance is strictly scoped to step-procedure modification; the two binding security invariants (no autonomous outward artifact; no fabrication) are called out as exempt from the delta mechanism. The constraint hierarchy is clear and correctly ordered. No security concern.

---

plugins/re-anchor/skills/scrutinize-dont-coast/evals/evals.json

Pure data file. No executable code, no external references, no credentials. Eval prompts use abstract placeholders. No security concerns.

plugins/re-anchor/.claude-plugin/plugin.json

Version bump 0.4.0 → 0.5.0, description update, two new keywords (self-scrutiny, adversarial). No new hooks, MCP servers, scripts, bin entries, external dependencies, or permission widening. Trust surface is additive-zero. No security concerns.

README.md / plugins/re-anchor/CHANGELOG.md

Documentation text only. No security concerns.

---

GitHub Actions / Supply chain

No changes to .github/workflows/, action pins, dependency versions, or settings.json permission grants.

---

Accept. Plugin-acceptance security review passes: prompt-only skill, zero trust surface added, Non-negotiables preserved and explicitly non-overridable through the new delta mechanism.

[claude]

Claude finished @kyle-sexton's task in 2m 16s —— View job

---

PR #838 Review — scrutinize-dont-coast corrector (HEAD: 97b2f1c)

• Gather context (PR description, changed files, prior reviews)
• Read changed files at HEAD
• Review latest commits (97b2f1c, 619b097, b88e3b2)
• Synthesize incremental review vs prior feedback
• Post final review

---

Incremental assessment (commits since last review)

Prior reviews covered the initial add (ac6efb5). Three follow-up commits have since landed:

Commit	Description	Status
b88e3b2	Fold independent-review findings	✓ All four findings addressed
619b097	Sanction declared per-skill step deltas in shared method doc	✓ PR body Q1 resolved
97b2f1c	Broaden "modify" → "modify/insert/reorder" in shared method doc	✓ Correct precision fix

---

97b2f1c — precision fix on declared-step-delta allowance

This commit closes a real gap: the shared method doc at 619b097 said "modify a step" but the STOP delta in scrutinize-dont-coast is an insertion (a new step between steps 1 and 2), not a modification of an existing step. The final commit:

1. Broadens the clause to modify, insert, or reorder in re-anchor-audit-correct.md lines 64–68
2. Adds the position-declaration requirement ("for an inserted step, where it sits relative to the numbered steps")
3. Pins the STOP's position in SKILL.md line 47: "An inserted step between the loop's step 1 and step 2"

The method doc and the skill are now consistent — the skill satisfies the method doc's own constraint on inserted steps. ✓

---

b88e3b2 — four prior findings folded

All four independent-review findings were addressed cleanly:

• /review:quality-gate guard — the bare cross-plugin ref now has a degrade-to-prose fallback per PLUGIN-PHILOSOPHY. ✓ (SKILL.md line 117)
• Point-not-copy on fresh-context rationale — the skill's section now points at the method doc's rule (lines 68–69) rather than restating it; only the skill-specific "core step" escalation is kept. ✓
• Audit list reframed — the six items are now explicitly framed as the brief handed to the fresh-context pass (method doc step 2 running in a fresh context), not an in-context self-audit. ✓
• Eval ci: onboard to the CI platform (ci-workflows + standards) #4 reworded — now a disposition check ("focus narrows aim, not a hard filter"), correctly removing the overreach that assumed a planted out-of-scope flaw with files: []. ✓

---

619b097 — Q1 (per-skill delta precedent) resolved

The PR body flagged this as a user decision. Option (a) was chosen: the shared method doc now sanctions declared deltas with an explicit non-overridable carve-out for the Non-negotiables. The governance constraint is correctly ordered — the allowance clause ends with "The Non-negotiables below are never overridable" at line 71–72. ✓

---

Remaining items (carry-forward from prior reviews)

🟡 Non-blocking nit — double "and" in description strings

Still present in both plugin.json and README.md at HEAD. The description ends with:

...and reuse-or-replace (...), and scrutinize-dont-coast (...).

Serial lists place and only before the final item. The fix is to drop and before reuse-or-replace. This has been flagged in every prior review run. It's a one-character-word edit — trivially fixable now before merge rather than carrying forward to the next skill addition. [Fix this →](https://claude.ai/code?q=In%20plugins%2Fre-anchor%2F.claude-plugin%2Fplugin.json%20and%20README.md%2C%20on%20branch%20feat%2Fre-anchor-adversarial-scrutiny%2C%20the%20description%20string%20ends%20with%20%22...and%20reuse-or-replace%20(...%29%2C%20and%20scrutinize-dont-coast%22%20%E2%80%94%20two%20consecutive%20%22and%22%20connectors.%20Remove%20%22and%20%22%20before%20%22reuse-or-replace%22%20so%20only%20the%20final%20entry%20carries%20it.&repo=melodic-software/claude-code-plugins)

🟡 Non-blocking — missing eval for single-axis sibling routing

SKILL.md line 121–123 names a routing case — a squarely-single-axis flaw hands that part to the owning sibling (e.g., /re-anchor:do-your-research for an unverified claim) while general scrutiny stays here. No eval covers this boundary. An eval 6 would close it; acceptable to defer post-merge.

---

Q2 (name) — confirm before merge

scrutinize-dont-coast is the provisional tournament winner and is implemented throughout. Confirm before merge. The runner-up distrust-your-momentum remains available if preferred; at the call site the current name reads as an imperative, which is the stronger choice.

---

Summary

Ready to merge once Q2 (name) is confirmed. All blocking issues from prior reviews have been addressed across four clean follow-up commits. The final 97b2f1c commit is the right precision fix — the STOP is an insertion, not a step modification, and the method doc now says so. Two non-blocking items remain (double-"and" nit, single-axis sibling routing eval), neither blocks merge.

[claude]

Claude finished @kyle-sexton's task in 1m 39s —— View job

---

Security Review — PR #838 scrutinize-dont-coast

• Gather context (PR description, trigger, changed files list)
• Fetch PR diff
• Read changed files
• Review SKILL.md for injection / prompt-manipulation surfaces
• Review re-anchor-audit-correct.md additions (new "Declared step deltas" section)
• Review evals/evals.json for unsafe patterns
• Review plugin.json for trust-surface changes
• Review README.md and CHANGELOG.md
• Synthesize and post security findings

---

Findings

No blocking security issues found.

All six changed files were reviewed against the full threat model: command/path/template/prompt injection, authorization and access-control gaps, unsafe handling of credentials/secrets, dangerous GitHub Actions patterns, and supply-chain risk from loosened or unpinned dependencies.

---

Per-surface notes

plugins/re-anchor/skills/scrutinize-dont-coast/SKILL.md

Zero executable surface. Key properties confirmed:

• Trust surface: No hooks, scripts, MCP servers, userConfig, bin/, or settings-agent references. The only external reference — ${CLAUDE_PLUGIN_ROOT}/context/re-anchor-audit-correct.md — is a correct, sandboxed plugin-path variable; no ../ escape.
• Outward-artifact gate explicitly restated at lines 63–64: "nothing here files a PR, issue, or published comment without the user's explicit opt-in." Binding.
• Delta 2 (collaborative remediation) at lines 54–61 gates all judgment-call changes on user collaboration — a second independent constraint against autonomous outward action, composing with the artifact gate.
• No PII or secrets anywhere in the skill text.

One theoretical surface, rated SUGGESTION / confidence LOW:

SUGGESTION (confidence: LOW) — Artifact-relay prompt injection

Lines 73–76 mandate passing the user's produced artifact to a fresh-context subagent "handed the artifact and the requirement, not the story of how the work was reached, and told to find what is wrong." A malicious artifact (e.g., user-supplied text containing embedded instructions) could attempt to redirect the subagent's behavior beyond its analysis scope.

Why LOW confidence: (1) The subagent is scoped to analysis/critique only — it is told to find what is wrong, not to act. (2) The outward-artifact gate (line 63) prevents autonomous external action. (3) Delta 2 gates all judgment-call remediation on user collaboration, so even if the subagent returned a manipulated "finding," acting on it requires the user's explicit participation. These three constraints compose and adequately contain the surface. This threat is inherent to any skill that relays user content to a subagent; no code change is recommended.

---

plugins/re-anchor/context/re-anchor-audit-correct.md — the governance change warranting independent scrutiny

The 12 added lines (the new "Declared step deltas" section) loosen a previously-implied constraint: correctors may now modify a loop step if and only if the delta is declared in the skill's own SKILL.md alongside the reason.

The security-relevant question is whether this allowance opens a path to override the Non-negotiables (no outward artifacts without opt-in; never fabricate). It does not. The text is explicit at line 71: "The Non-negotiables below are never overridable." The allowance is strictly scoped to step-procedure modification; the two binding security invariants are explicitly sealed out of the delta mechanism. The constraint hierarchy is correct and unambiguous. No security concern.

---

plugins/re-anchor/skills/scrutinize-dont-coast/evals/evals.json

Pure data file. No executable code, no external references, no credentials. Eval prompts use abstract, non-PII placeholders ("cache-invalidation function", "migration script"). No security concerns.

---

plugins/re-anchor/.claude-plugin/plugin.json

Version bump 0.4.0 → 0.5.0, description update, two new keywords (self-scrutiny, adversarial). No new hooks, MCP servers, scripts, bin/ entries, external dependencies, or permission widening. Trust surface is additive-zero relative to 0.4.0. No security concerns.

---

README.md / plugins/re-anchor/CHANGELOG.md

Documentation text only. No security concerns.

---

GitHub Actions / Supply chain

No changes to .github/workflows/, action pins, dependency versions, or settings.json permission grants.

---

Accept. Plugin-acceptance security review passes: prompt-only skill, zero trust surface added, Non-negotiables preserved and explicitly non-overridable through the new declared-delta mechanism.