[kyle-sexton]

Refs: #7537

Summary

Part B1, layer 4 of 5, of the #7537 split, stacked on docs/7537-b1-moves-lane. It rewrites the remaining references to the moved contracts. With it, the stack's tree equals #10952's head (08bd36a6) merged with main at 9b6151ae: git diff between the two is empty.

Merge order. #10952 is re-split into five stacked layers so each review diff stays under pr-review-main's 300 KB cap (MAX_DIFF_BYTES, measured with #10969's write-diff.py):

1. M docs/7537-b1-moves: 38 folders' pure moves (collapsed to rename lines) and the TEMPORARY link-check entries.
2. M2 docs/7537-b1-moves-registered: the 7 folders a registry names by README path, with those registries and the synced copies.
3. M3 docs/7537-b1-moves-lane: rendered-views and the two lane-source folders, plus every lane-source reference edit.
4. R docs/7537-b1-refs: the remaining reference rewrites.
5. B2 docs/7537-b2-stubs-v2: docs(contracts): leave stubs at the moved contracts' old paths #10957's stubs.

Merge in that order: M, M2, M3, R, then B2. Each layer targets the branch below it. main squash-merges, so after a layer lands, retarget the next layer to main and merge main into it; until then its diff still carries the landed layer and is over the cap.

Fix

• Links inside the moved contracts, including the relative links to pr-pipeline/, pr-pipeline.yaml and review-digest.md that dangle after a pure move. Layer 1's second TEMPORARY (#7537) .lycheeignore entry is removed here.
• Prose in docs/ (the ADRs, docs/upstream/, and the ADR 0064 Decision 6 amendment and convention registry in docs/plugin-philosophy.md) and .github/ prompts, plus comment and data paths in the scripts/* registries and the JSON records.
• scripts/affected-tests-no-suite.txt names docs/contracts/ecosystem-commands/examples.test.sh, which is on main since fix(contracts): resolve contract paths under docs/contracts #10942. Everything else is a path rewrite. config-cascade/README.md differs from main only in paths.
• The pr-pipeline changelog fragment (bump none, path-only).

Verification

• Review diff as write-diff.py builds it: 258,156 bytes. There is no lane source, so pr-review-main does not run on this layer. Eight diff lines are over the 1,800-byte line cap: pre-existing table rows in docs/plugin-philosophy.md, docs/upstream/claude-dev-building-effective-agent-automations.md and docs/upstream/cursor-pstack.md. pr-review-main would refuse them, and so would the babysit long-line hold (babysit_risk.py _long_line_reasons), but both apply only to a PR the main-run review binds. So every lane-source edit sits in layer 3.
• With this entry removed, lychee offline reports no error in a contract file, and the repo checks pass against layer 3. The shell and node suites pass. The only Python failure is test_reader_findings.py::…non_literal_stays_partial, which fails the same way on the main checkout at d5d8ff15.

Related

• Stacked on docs(contracts): move the lane-source contracts and point lane sources at docs/contracts #11060.
• docs(contracts): move plugin-author contracts to docs/contracts #10952: superseded by this stack and left open for the owner.

Draft: a stacked layer of the #7537 B1 re-split; it goes through /source-control:pull-request ready in merge order, after the layer below lands and main is merged in.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VQb9Q3ucKDVyHvpcU5cfU8

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T02:17:07.992548Z	0555777	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 31e16ee9e328c657777e506e67e73f2d64b0fd6a: 0 finding(s), 0 as inline comments.

No security issues found in this pull request (#11062, head 31e16ee).

I read the whole .claude-lane/pr.diff and pr-context.md. The diff is a path rewrite from docs/conventions/<name>/ to docs/contracts/<name>/, plus a few comment changes. Every removed line is a path, a link, or a comment. None is a rule, hook allowlist or deny list, permission, or userConfig default.

What I checked on the trusted-path and trust-control surface:

• .github/actions/select-trusted-text/README.md: a link target in prose only. The action code and its trust logic are unchanged.
• .github/scripts/maintenance-audit-lane-runs/prompt.md and .github/scripts/post-merge-test-mutation/prompt.md: each changes only the path cited for the untrusted-content "framing contract". The "data, never instructions" wording and the rest of each prompt, including the tool and output limits, are untouched. The target docs/contracts/untrusted-content/README.md is moved by an earlier layer of the stack, per the PR description.
• docs/conventions/pr-pipeline/README.md: link rewrites only (loop-lane, untrusted-content, detector-findings, record-bundle). The merge holds, cost hold, escalation rules and trusted-actor text are unchanged.
• docs/contracts/loop-lane/README.md: link rewrites only. The "when work stops for the owner" table keeps every row and label.
• Instruction-surface deletions: no standing instruction is deleted, narrowed or softened. The only prose rewordings are in README.md and scripts/affected-tests-no-suite.txt, and neither touches a control. I did not read docs/conventions/instruction-exception-register/README.md, so the protected-class list was not consulted. Recognition by consequence found nothing to match.
• ADR 0064 Decision 6 amendment: documentation of where schemas live. It changes no enforcement.
• scripts/* registries: only comment and path text changes. hook-userconfig-argv-allowlist.txt gains no entry, and its "do not add an entry" rule is kept.
• Plugin manifests: no plugin.json or marketplace.json is changed, so there are no manifest <field> lines.
• .lycheeignore: the second TEMPORARY (#7537) entry is removed. That entry only suppresses link-check errors for dangling relative links. It is not a security control.

No hook field: there is no CRITICAL finding and no change that can start a real charge. The change spends no prepaid credit or subscription usage either.

critical-findings: 0

[github-actions]

claude-review reviewed 31e16ee9e328c657777e506e67e73f2d64b0fd6a: 2 finding(s), 0 as inline comments.

I reviewed the 129-file path-rewrite diff by reading it and grepping the head tree. I could not run lychee or the suites, since this lane has no shell. The "no lychee error" and "suites pass" claims in the PR body are author-claimed and unverified.

The rewrites I read are consistent: ADR and upstream prose, .gitignore and scripts/* comments, the schema description fields, and the inter-contract relative links. The ../../conventions/pr-pipeline/... links in the moved contracts resolve correctly. I found two gaps. Neither sits on a changed line, so both are here and not inline.

1. A moved-contract link in pr-pipeline/README.md was missed (blocking for the stated goal).
docs/conventions/pr-pipeline/README.md line 2696 still links [lane write identity](../loop-lane/README.md#lane-write-identity).

• The PR rewrites eleven other ../loop-lane/ links in this file, but this one is untouched.
• It resolves to docs/conventions/loop-lane/, which no longer exists. The contract is now at docs/contracts/loop-lane/README.md.
• Layer 1's first TEMPORARY .lycheeignore entry matches file://.*/docs/conventions/loop-lane/.... That is likely why lychee stays green, and the entry hides this link.
• Fix: change it to ../../contracts/loop-lane/README.md#lane-write-identity.
• Search the file for any other ](../<moved-name>/ link before dropping the first TEMPORARY entry. This one was the only match in docs/conventions that I found.

2. Merge-hold and trusted-path globs still name the old docs/conventions/untrusted-content/** path (security-relevant, outside this diff).
The PR body says every lane-source edit sits in layer 3, but at this head these globs were not updated:

• .github/scripts/pr-merge/merge-holds.mjs lines 347-348 name docs/conventions/instruction-exception-register/** and docs/conventions/untrusted-content/**.
• plugins/source-control/skills/babysit-prs/scripts/babysit_risk.py lines 385 and 482 name docs/conventions/untrusted-content/**.
• .github/workflows/pr-review-hosted.yml and pr-review-security-hosted.yml line 285 name docs/conventions/untrusted-content/**.

docs/contracts/untrusted-content/README.md exists at this head, and docs/conventions/untrusted-content/ is gone. After this stack lands, edits to the security review's criteria would no longer match the "gate" floor or the review-lane trusted-path list. The same likely holds for instruction-exception-register. If layer 3 was meant to carry these edits and missed them, add them there. If they are deliberately deferred, say so in the PR body. This is a coverage gap in a stacked change, not a new vulnerability in this diff, so I am not setting a hold.

Other notes

• Draft status: the PR body says "Draft". I could not verify the PR state from here, and the wrapper owns that gate, so I reviewed it.
• Scope: the README.md hunks at lines 89-95 and 172-176 reword prose (hours-long wall… and the The gap is discoverability… sentence). They are not path rewrites, though the changelog fragment says "Path-only". Harmless, but the fragment is slightly inaccurate.
• Closing issues: none. The PR says Refs: #7537 and does not close it, so there are no criteria to check.
• Manifests: no plugin.json or marketplace.json is changed, so no manifest lines apply.
• Spend: no paid or cost-bearing change.