refactor(toolchain): move the ratchet skill from review to toolchain and delete three empty baselines #8543

Refs: #7584
Depended on PR #8182 (merged 2026-10-20T06:19:51Z); start from main after it.

Agent Brief

Type: Task
Summary: Move /review:ratchet to /toolchain:ratchet with every reference updated, add the rule that a baseline or allowlist reaching zero entries is deleted with its reading code, and apply that rule to the three empty baselines no workflow file reads.

Current behavior:

• The skill lives at plugins/review/skills/ratchet/ (SKILL.md, evals/evals.json, scripts/ratchet.py, scripts/suppression-scan.py). Both scripts are generated copies: plugins/performance/scripts/ratchet.py and lib/suppression-scan.py are their sources (scripts/shared-copies.txt:155, 455).
• Plugin-level evals and probes sit in review: plugins/review/evals/ratchet-{lint-count,refuses-duration,existing-performance-file,zero-lands-rule}/, plugins/review/probes/ratchet.json.
• A search of plugins and docs for review:ratchet, leaving out every CHANGELOG.md and .changes/**, finds references in: plugins/review/skills/audit-enforceability/ (SKILL.md:186, context/stub-shape.md:38, 99, scripts/emit-stubs.sh:1267, scripts/emit-stubs.test.sh:1039-1040, evals/evals.json), plugins/review/skills/setup/SKILL.md:59, plugins/review/README.md:95, 199, 219, plugins/review/.claude-plugin/plugin.json:30 (ratchet_offer), plugins/review/schemas/review.schema.json:11, plugins/review/probes/{audit-enforceability,quality-gate,fanout,explain-change}.json, plugins/performance/skills/protect/ (SKILL.md:45, 215, 233, evals/evals.json), plugins/performance/probes/protect.json, plugins/performance/evals/pr-ratchets-verified-spawn-count/case.yaml, plugins/code-metrics/skills/audit-suppressions/ (SKILL.md:117, 159, evals/evals.json), docs/skill-cheat-sheet.md:174 (generated) and docs/upstream/cursor-pstack.md:98.
• Five baselines have zero entries. Three are read only by scripts and docs: scripts/changelog-parity-baseline.txt (read at scripts/check-changelog-parity.sh:114, 149; test scripts/check-changelog-parity.test.sh:31), scripts/hook-userconfig-argv-allowlist.txt (scripts/check-hook-userconfig-argv.sh:24, 47; test scripts/check-hook-userconfig-argv.test.sh:165-202; doc docs/conventions/hook-config-delivery/README.md:140), scripts/skill-description-cap-baseline.txt (scripts/check-changed-skills.sh:78-79; test scripts/check-changed-skills.test.sh:449-521). Comments naming them: scripts/check-silent-revert.sh:245, scripts/check-shell-portability.sh:446.
• The other two, scripts/test-tmp-cleanup-baseline.txt and scripts/verb-contract-baseline.txt, are named in .github/workflows/pr-require-checks.yml:415, 448, 2255.

Desired behavior:

• git mv the skill directory to plugins/toolchain/skills/ratchet/, the four eval cases to plugins/toolchain/evals/, and the probe to plugins/toolchain/probes/ratchet.json. The name stays ratchet; its invocation becomes /toolchain:ratchet.
• scripts/shared-copies.txt:155, 455 name the new copy paths, and scripts/sync-shared-copies.sh regenerates them.
• Every reference above names /toolchain:ratchet and the new path. ratchet_offer stays a review setting (audit-enforceability makes the offer); only its description text changes.
• The moved skill gains a reference file stating the zero-entry rule: a baseline or allowlist that reaches zero entries is deleted in the same change, with the code that reads it and the tests of that code. SKILL.md gains one line pointing to it. Inside the skill text the checked-in limit is called "the ceiling".
• The three script-only baselines are deleted, with their reading code, their test cases and the doc and comment lines naming them.
• The skill body text is moved, not cut: apart from the invocation name, paths and the one added pointer line, SKILL.md is unchanged.
• The generated docs (the catalog and docs/skill-cheat-sheet.md) match the moved skill; the PR's CI checks they are current.

Key interfaces:

• plugins/toolchain/skills/ratchet/ (new home), plugins/toolchain/evals/, plugins/toolchain/probes/.
• scripts/shared-copies.txt, scripts/sync-shared-copies.sh.
• scripts/check-changelog-parity.sh, scripts/check-hook-userconfig-argv.sh, scripts/check-changed-skills.sh and their tests.

Acceptance criteria:

• The directory plugins/toolchain/skills/ratchet exists and plugins/review/skills/ratchet does not.
• No file under plugins or docs mentions review:ratchet, leaving out every CHANGELOG.md and .changes/**.
• scripts/changelog-parity-baseline.txt, scripts/hook-userconfig-argv-allowlist.txt and scripts/skill-description-cap-baseline.txt do not exist, and no file under scripts, plugins or docs/conventions mentions changelog-parity-baseline, hook-userconfig-argv-allowlist, skill-description-cap-baseline, CHANGELOG_PARITY_BASELINE or SKILL_DESC_CAP_BASELINE.
• The reference file under plugins/toolchain/skills/ratchet states the zero-entry rule and uses the words "zero entries".
• scripts/sync-shared-copies.sh --check exits 0. The PR's CI runs the version-bump check and scripts/validate-plugins.sh (which includes the catalog and cheat sheet currency checks) and they pass.
• scripts/check-changelog-fragments.sh --check passes. The PR's CI runs the required-fragment check and it passes, with fragments: review major (a skill leaves the plugin), toolchain minor, performance patch, code-metrics patch.
• CI's check-plugins (copies, fragments, plugin validation), check-skills (skill gate, eval sets) and test-bash (the three changed check suites and emit-stubs.test.sh) pass.

Out of scope:

• Deleting scripts/test-tmp-cleanup-baseline.txt and scripts/verb-contract-baseline.txt: their removal needs edits to .github/workflows/pr-require-checks.yml, a protected path; file a follow-up for the owner.
• The stale comment at .github/workflows/pr-require-checks.yml:1687 that names changelog-parity-baseline.txt (same reason; name it in the follow-up).
• The per-file baseline mode, lint rollout rule and break-glass team setting (later ratchet slice).
• Running the ratchet's model-graded evals; the move changes no behavior, and check-skills validates the eval sets.
• /review:fanout changes (sibling slices fanout-spec-first, fanout-eval-and-cap).
• ADR 0043's mention of the description-cap baseline; an accepted ADR is a dated record.

Origin:

• /review:ratchet moves to /toolchain:ratchet, name kept: owner's, D63, D81.
• The limit is called "the ceiling" inside the skill: owner's, D81, Q513.
• Delete any baseline or allowlist that reaches zero entries, with its reading code, starting with the empty ones; the rule lives in the ratchet reference: ours, Q181, D82, B8.
• Hold the three .github-named baselines for a follow-up: ours, this triage (protected path).

Do not run with: #7573 (corrections moves audit-enforceability, which this slice edits); the pstack-recheck slice of #7588 (both edit docs/upstream/cursor-pstack.md); the ladder-v2 slice of #7572 (both edit audit-enforceability and plugins/review/README.md).

Slice of #7584, drafted by the Issue Triage session from the thread's recorded decisions.