claude-dev-env 1.82.0 → 1.84.0

package/skills/bugteam/SKILL.md

@@ -36,7 +36,8 @@ First match wins; respond with the quoted line exactly and stop:
   token `bugteam` (comma-separated, case-insensitive, whitespace-tolerant):
   `/bugteam is disabled via CLAUDE_REVIEWS_DISABLED.` The pre-flight script
   also exits 7 in this case so any caller invoking it directly halts on the
-  same signal.
+  same signal. Gate semantics live in the `reviewer-gates` skill
+  ([../reviewer-gates/SKILL.md](../reviewer-gates/SKILL.md)).
 - **No PR or upstream diff.** `No PR or upstream diff. /bugteam needs a target.`
 - **Dirty tree.** `Uncommitted changes detected. Stash, commit, or revert before
   /bugteam.`
@@ -46,74 +47,26 @@ First match wins; respond with the quoted line exactly and stop:
 
 ## Audit posting
 
-Every internal audit pass (CLEAN or DIRTY) ends with one call to
-`post_audit_thread.py`. The script POSTs a single review to
-`/repos/{owner}/{repo}/pulls/{N}/reviews` with `event=APPROVE` on CLEAN
-(the request event; GitHub stores it as `state=APPROVED`; empty
-`comments[]`, body documents "no findings") or
-`event=REQUEST_CHANGES` on DIRTY (one inline anchored comment per
-finding; each becomes its own resolvable thread). The mandate applies
-whether bugteam runs inside `/pr-converge` or standalone.
-
-**Self-PR auto-toggle.** GitHub rejects both `APPROVE` and
-`REQUEST_CHANGES` reviews with HTTP 422 when the authenticated identity
-matches the PR author ("Cannot approve/request changes on your own pull
-request"). `post_audit_thread.py` detects this case via `gh api user` +
-`gh api repos/<o>/<r>/pulls/<n>` and auto-resolves an alternate gh
-account's token for the reviews POST — the active `gh auth` account is
-not mutated; only the bearer token sent on the request changes. After
-the POST the active account is still whoever it was before, so no
-"swap back" step is needed.
-
-Configuration:
-
-- `GH_TOKEN` / `GITHUB_TOKEN` env vars take precedence over the toggle.
-  Set them when you need to pin a specific reviewer identity by token
-  rather than by account login.
-- `BUGTEAM_REVIEWER_ACCOUNT` env var names which authenticated alternate
-  to prefer when a toggle is needed (for example,
-  `BUGTEAM_REVIEWER_ACCOUNT=jl-cmd`). When unset, the script falls back
-  to the first alternate account `gh auth status` reports.
-- The named alternate must be logged in (`gh auth login -h github.com -u
-  <login>`) before the audit skill runs. The script exits 1 with a
-  pointing-at-`gh auth login` message when self-PR is detected and no
-  usable alternate is authenticated.
-
-```
-python "${CLAUDE_SKILL_DIR}/../../_shared/pr-loop/scripts/post_audit_thread.py" \
-  --skill bugteam \
-  --owner <owner> \
-  --repo <repo> \
-  --pr-number <N> \
-  --commit <head_sha> \
-  --state <CLEAN|DIRTY> \
-  --findings-json <path>
-```
-
-`--findings-json` points to a JSON file whose root is a list of objects
-shaped `{path, line, side, severity, description, fix_summary}`. The
-audit agent's persisted finding output maps as follows: finding `file`
-→ `path`, and the agent's `failure_mode` field carries both the failure
-narrative AND the `Fix:` / `Validation:` text per
-[`agents/code-quality-agent.md`](../../agents/code-quality-agent.md)
-("The `failure_mode` field is the audit-to-fix handoff"). Split
-`failure_mode` at the literal `Fix:` heading: the prefix (the failure
-narrative) becomes `description`, and the suffix starting at `Fix:`
-(including the trailing `Validation:` clause) becomes `fix_summary`.
-When the agent omits the `Fix:` heading on a given finding, write the
-full `failure_mode` text to BOTH `description` and `fix_summary` so the
-script's body template (`INLINE_COMMENT_BODY_TEMPLATE` in
-[`_shared/pr-loop/scripts/pr_loop_shared_constants/post_audit_thread_constants.py`](../../_shared/pr-loop/scripts/pr_loop_shared_constants/post_audit_thread_constants.py))
-still renders coherently. Set `side="RIGHT"` for every entry. On CLEAN,
-pass an empty array (`[]`) so the script posts an APPROVE review
-(GitHub stores it as `state=APPROVED`) with a "no findings" summary and
-zero inline comments.
-
-Exit codes: `0` on success (emits the new review's `html_url` to
-stdout); `1` on user input error; `2` on retry exhaustion (1s / 4s /
-16s backoff across four attempts total). Exit 2 is a hard blocker; the
-lead halts the loop and exits `error: post_audit_thread retry
-exhausted` without retrying.
+Every internal audit pass (CLEAN or DIRTY) ends with one posted GitHub PR
+review; the mandate applies whether bugteam runs inside `/pr-converge` or
+standalone. Apply the `post-audit-findings` skill
+([../post-audit-findings/SKILL.md](../post-audit-findings/SKILL.md)) with
+`--skill bugteam`: it covers the findings-JSON mapping (the `failure_mode`
+split at the literal `Fix:` heading), the anchored-vs-unanchored partition,
+the `post_audit_thread.py` invocation, the self-PR reviewer toggle
+(`BUGTEAM_REVIEWER_ACCOUNT`), the exit codes, and the id harvest.
+
+Bugteam-only obligations:
+
+- The lead runs the posting step; the FIX teammate waits for the harvested
+  ids before replying or resolving.
+- Record each harvested `{finding_comment_id, finding_comment_url,
+  thread_node_id}` triple into `loop_comment_index` (per-loop scope; see
+  [reference/team-setup.md](reference/team-setup.md) § Loop state block) so
+  the matching FIX action owns the reply-and-resolve unit.
+- Exit 2 from `post_audit_thread.py` is a hard blocker: the lead halts the
+  loop and exits `error: post_audit_thread retry exhausted` without
+  retrying.
 
 ## Progress checklist
 
@@ -143,13 +96,13 @@ end-to-end mental model before starting Step 0.
 | `--bugbot-retrigger` flag behavior | [reference/team-setup.md](reference/team-setup.md) |
 | AUDIT action and code-rules pre-audit gate, pre-cycle walk, cycle decision tree | [reference/audit-and-teammates.md](reference/audit-and-teammates.md) |
 | FIX action and verify-push semantics | [reference/audit-and-teammates.md](reference/audit-and-teammates.md) |
-| Posting the end-of-pass audit review via `post_audit_thread.py` (APPROVE on CLEAN — the request event; GitHub stores it as `state=APPROVED` — REQUEST_CHANGES with inline anchored comments on DIRTY) | [§ Audit posting](#audit-posting) |
+| Posting the end-of-pass audit review (APPROVE on CLEAN, REQUEST_CHANGES with inline anchored comments on DIRTY) | [§ Audit posting](#audit-posting), which applies [../post-audit-findings/SKILL.md](../post-audit-findings/SKILL.md) |
 | Posting per-finding fix replies via GitHub MCP `add_reply_to_pull_request_comment` (rendered with the unified template at [`_shared/pr-loop/audit-reply-template.md`](../../_shared/pr-loop/audit-reply-template.md)) | [reference/github-pr-reviews.md](reference/github-pr-reviews.md) |
-| Teardown, PR description rewrite via `pr-description-writer`, permission revoke, final report | [reference/teardown-publish-permissions.md](reference/teardown-publish-permissions.md) |
+| Teardown, PR description rewrite via `pr-description-writer`, permission revoke, final report | [../pr-loop-lifecycle/reference/teardown-publish-permissions.md](../pr-loop-lifecycle/reference/teardown-publish-permissions.md) |
 | Spawn-prompt XML, A–P category bindings, outcome XML schemas | [PROMPTS.md](PROMPTS.md) |
 | Per-category audit content (sub-buckets, decision criteria, ready-to-send Variant C templates) | `$HOME/.claude/audit-rubrics/{category_rubrics,prompts}/` |
 | Invariants and design rationale | [CONSTRAINTS.md](CONSTRAINTS.md), [reference/design-rationale.md](reference/design-rationale.md) |
-| Audit-contract finding shape (Shape A / B), Haiku secondary, post-fix self-audit | [reference/audit-contract.md](reference/audit-contract.md) |
+| Audit-contract finding shape (Shape A / B), Haiku secondary, post-fix self-audit | [../../_shared/pr-loop/audit-contract.md](../../_shared/pr-loop/audit-contract.md) |
 | Exit-scenario examples (converged, cap-reached, stuck, refusal, mixed-outcome) | [EXAMPLES.md](EXAMPLES.md) |
 | Doc URLs and verbatim quotes | [sources.md](sources.md) |
 | Historical Copilot gap analysis (superseded) | [reference/copilot-gap-analysis.md](reference/copilot-gap-analysis.md) |

package/skills/bugteam/reference/CLAUDE.md

@@ -7,11 +7,9 @@ Expanded workflow detail for the `bugteam` skill. Load a file from this director
 | File | Purpose |
 |---|---|
 | `README.md` | Index of all files in this directory with one-line domain summaries. |
-| `team-setup.md` | Permissions grant, PR scope resolution, run name, temp dir, and loop state. |
+| `team-setup.md` | Permissions grant, PR scope resolution (applies the `pr-scope-resolve` skill), run name, temp dir, and loop state. |
 | `audit-and-teammates.md` | Pre-audit CODE_RULES gate, full cycle numbering, AUDIT and FIX action detail. |
-| `audit-contract.md` | Finding shape (Shape A / B), Haiku secondary merge rules, post-fix self-audit. |
 | `github-pr-reviews.md` | Per-loop review posting, `jq`+`gh api` payloads, inline anchors, fallbacks, REST endpoints. |
-| `teardown-publish-permissions.md` | Teardown steps, PR description rewrite via `pr-description-writer`, permission revoke, final report. |
 | `design-rationale.md` | Why clean-room subagents, when `/bugteam` applies, refusal reasons. |
 | `copilot-gap-analysis.md` | Historical gap analysis (reference only). |
 

package/skills/bugteam/reference/README.md

@@ -8,7 +8,7 @@ Expanded material that used to live inline in `SKILL.md`. Load a file when the o
 | [`team-setup.md`](team-setup.md) | Permissions grant (`CLAUDE_SKILL_DIR`), PR scope, run name / temp dir / loop state |
 | [`github-pr-reviews.md`](github-pr-reviews.md) | Per-loop reviews, `jq` + `gh api` payloads, anchors, fallbacks, REST endpoints |
 | [`audit-and-teammates.md`](audit-and-teammates.md) | Pre-audit gate, full cycle numbering, AUDIT and FIX actions |
-| [`teardown-publish-permissions.md`](teardown-publish-permissions.md) | Utility scripts note, teardown, PR description rewrite, revoke, final report |
+| [`../../pr-loop-lifecycle/reference/teardown-publish-permissions.md`](../../pr-loop-lifecycle/reference/teardown-publish-permissions.md) | Utility scripts note, teardown, PR description rewrite, revoke, final report |
 
 Canonical documentation quotes: [`../sources.md`](../sources.md).
 

package/skills/bugteam/reference/audit-and-teammates.md

@@ -153,7 +153,7 @@ Agent(
 
 The teammate sees only the latest audit’s findings — each `Agent` call starts with a fresh context window; prior-loop findings, fix history, and chat stay in the lead.
 
-Pass finding comment URL, comment id, and thread node id for each finding (from `loop_comment_index`) in the XML prompt so the teammate owns both the reply and the thread resolution. After commit, the teammate posts one reply per finding using the unified template at [`../../../_shared/pr-loop/audit-reply-template.md`](../../../_shared/pr-loop/audit-reply-template.md) — the full header / horizontal rule / `<action_heading> ✅` / explanation / anchored-bullet / closing-paragraph skeleton, with `<status_line>` set per the path (`Fixed in <short_sha>` for `status=fixed`, `Could not address this loop` for `status=could_not_address`, `Hook blocked the fix commit` for `status=hook_blocked`). Per-thread reply and `resolve_thread` are atomic — see [`../../../_shared/pr-loop/fix-protocol.md`](../../../_shared/pr-loop/fix-protocol.md) step 12 for the exact sequence. Same identity model as bugfind: teammate posts; lead waits.
+Pass finding comment URL, comment id, and thread node id for each finding (from `loop_comment_index`) in the XML prompt so the teammate owns both the reply and the thread resolution. After commit, the teammate posts one reply per finding using the unified template at [`../../../_shared/pr-loop/audit-reply-template.md`](../../../_shared/pr-loop/audit-reply-template.md) — the full header / horizontal rule / `<action_heading> ✅` / explanation / anchored-bullet / closing-paragraph skeleton, with `<status_line>` set per the path (`Fixed in <short_sha>` for `status=fixed`, `Could not address this loop` for `status=could_not_address`, `Hook blocked the fix commit` for `status=hook_blocked`). Per-thread reply and `resolve_thread` are atomic; the mechanics follow the `pr-fix-protocol` skill ([`../../pr-fix-protocol/SKILL.md`](../../pr-fix-protocol/SKILL.md)), which frames the shared 13-step sequence in [`../../../_shared/pr-loop/fix-protocol.md`](../../../_shared/pr-loop/fix-protocol.md) (step 12 carries the exact reply-and-resolve sequence). Same identity model as bugfind: teammate posts; lead waits.
 
 After replies, the teammate writes outcome XML (schema in [`../PROMPTS.md`](../PROMPTS.md)).
 

package/skills/bugteam/reference/obstacles/fix-publish-summary.md

@@ -1,6 +1,6 @@
 # Publish fix summary
 
-Publish fix summary HTML via /doc-gist with commit SHA, files, per-fix descriptions
+Publish fix summary HTML via the Artifact tool with commit SHA, files, per-fix descriptions
 
 ## Self-population
 

package/skills/bugteam/reference/team-setup.md

@@ -8,7 +8,7 @@ Bugteam-specific utilities (preflight, fix_hookspath, grant, revoke) live in
 the skill-local [`scripts/`](../scripts/) directory. Shared utilities remain in
 [`_shared/pr-loop/scripts/`](../../_shared/pr-loop/scripts/) (run, do not paste
 into context). Utility scripts are **executed**, not loaded as primary context
-([`sources.md`](sources.md) § Progressive disclosure and utility scripts).
+([`sources.md`](../sources.md) § Progressive disclosure and utility scripts).
 
 ```bash
 python "${CLAUDE_SKILL_DIR}/scripts/bugteam_preflight.py"
@@ -53,7 +53,7 @@ the auto-remediation only applies to the `core.hooksPath` failure mode.
 Before spawning any subagents, grant the session write access to the project's `.claude/**` tree:
 
 ```bash
-python "${CLAUDE_SKILL_DIR}/scripts/grant_project_claude_permissions.py"
+python "${CLAUDE_SKILL_DIR}/../../_shared/pr-loop/scripts/grant_project_claude_permissions.py"
 ```
 
 `${CLAUDE_SKILL_DIR}` is a Claude Code host-managed token, pre-substituted by the runtime before any shell sees it. Unlike `${TMPDIR}` and similar shell parameter expansions, it does not depend on the shell’s expansion semantics, so it behaves the same on Unix and Windows shells.
@@ -64,11 +64,12 @@ This is the **first** action of every `/bugteam` invocation, before any subagent
 
 ## Step 1 — Resolve PR scope (detail)
 
-Same resolution path as `/findbugs`:
-
-1. Call `pull_request_read(method="get", pullNumber=N, owner=O, repo=R)` to fetch PR metadata; capture `number`, `headRefName`, `baseRefName`, and `url` from the response. Falls back to the merge-base diff path when no PR exists.
-2. Fall back to `git merge-base HEAD origin/<default>` then `git diff <merge-base>...HEAD`.
-3. Neither → refuse per refusal cases in `SKILL.md`.
+Apply the `pr-scope-resolve` skill
+([../../pr-scope-resolve/SKILL.md](../../pr-scope-resolve/SKILL.md)) with
+caller `bugteam`. Its resolution ladder hands back `owner`, `repo`, `number`,
+`head_ref`, `base_ref`, `url`, and `head_sha`; when no PR and no upstream
+diff exist, respond exactly `No PR or upstream diff. /bugteam needs a
+target.` and stop.
 
 Capture `<owner>/<repo>`, head branch, base branch, PR number, PR URL. This scope persists across every loop — `/bugteam` runs to completion from the single up-front confirmation.
 

package/skills/bugteam/scripts/CLAUDE.md

@@ -9,9 +9,6 @@ Python scripts executed by the bugteam lead or teammates at runtime. These are n
 | `bugteam_preflight.py` | Run pytest and optional `pre-commit` before the first loop. Skips pytest when `BUGTEAM_PREFLIGHT_SKIP=1` or no test files exist. |
 | `bugteam_fix_hookspath.py` | Auto-remediate a stale `core.hooksPath` override, set the canonical global value, re-run preflight. |
 | `bugteam_code_rules_gate.py` | Run `validate_content` from `code_rules_enforcer.py` on PR-scoped files. Exit 1 on mandatory rule failures. |
-| `grant_project_claude_permissions.py` | Grant Edit/Write/Read on `cwd/.claude/**` in `~/.claude/settings.json`. |
-| `revoke_project_claude_permissions.py` | Remove the matching grant entries from `~/.claude/settings.json`. |
-| `_bugteam_permissions_common.py` | Shared helpers for grant/revoke (atomic JSON writes, settings sections). |
 | `windows_safe_rmtree.py` | Remove a directory tree on Windows by stripping ReadOnly attributes and retrying on failure. |
 | `probe_code_rules_enforcer_check.py` | Load `code_rules_enforcer.py` and invoke a named check function against a fixture file. |
 | `reflow_skill_md.py` | Reflow the bugteam SKILL.md body to fit line-length limits. |
@@ -23,9 +20,6 @@ Python scripts executed by the bugteam lead or teammates at runtime. These are n
 | `test_bugteam_preflight.py` | `bugteam_preflight.py` |
 | `test_bugteam_code_rules_gate.py` | `bugteam_code_rules_gate.py` |
 | `test_bugteam_fix_hookspath.py` | `bugteam_fix_hookspath.py` |
-| `test_bugteam_permissions_common.py` | `_bugteam_permissions_common.py` |
-| `test__bugteam_permissions_common.py` | Internal helpers in `_bugteam_permissions_common.py` |
-| `test_agent_config_carveout.py` | `.claude/**` grant/revoke carveout logic |
 | `test_probe_code_rules_enforcer_check.py` | `probe_code_rules_enforcer_check.py` |
 | `test_windows_safe_rmtree.py` | `windows_safe_rmtree.py` |
 

package/skills/bugteam/scripts/README.md

@@ -7,10 +7,6 @@ Scripts in this directory are **executed** by the lead or teammates. They are no
 | `bugteam_preflight.py` | Run pytest (when configured) and optional `pre-commit` before `/bugteam`. |
 | `bugteam_fix_hookspath.py` | Auto-remediate a stale local `core.hooksPath` override, set canonical global value, re-run `bugteam_preflight.py`. Invoked by Claude when preflight reports a `core.hooksPath` failure. |
 | `bugteam_code_rules_gate.py` | Run `validate_content` from `code-rules-enforcer.py` on PR-scoped files (`git diff` vs merge-base). Exit `1` if any mandatory rule fails. Invoked **before each audit**; the fixer clears it before the auditor runs. |
-| `grant_project_claude_permissions.py` | Idempotent grant of Edit/Write/Read on `cwd/.claude/**` into `~/.claude/settings.json`. |
-| `revoke_project_claude_permissions.py` | Removes the matching grant entries from `~/.claude/settings.json`. |
-| `test_claude_permissions_common.py` | Pytest module for path normalization and glob-metacharacter guards in `_claude_permissions_common.py`. |
-| `_claude_permissions_common.py` | Shared helpers for the grant/revoke scripts (atomic JSON writes, settings sections). |
 | `windows_safe_rmtree.py` | Recursively remove a directory tree on Windows by stripping ReadOnly attributes and retrying the failing syscall. Invoked from SKILL.md Step 4 to delete `<run_temp_dir>` after teardown. |
 | `probe_code_rules_enforcer_check.py` | Dynamically load `~/.claude/hooks/blocking/code_rules_enforcer.py` and invoke a named check function against a fixture file. Used by the historical Copilot gap-analysis investigation as a verification shape (see `reference/copilot-gap-analysis.md`). |
 

package/skills/bugteam/scripts/bugteam_scripts_constants/CLAUDE.md

@@ -9,7 +9,6 @@ Python package of named constants imported by the bugteam scripts. Each module h
 | `bugteam_preflight_constants.py` | `bugteam_preflight.py` — env var name, hooks path suffix, exit codes, ignore dirs, argument tuples, config filenames. |
 | `bugteam_code_rules_gate_constants.py` | `bugteam_code_rules_gate.py` — gate-related path and exit-code constants. |
 | `bugteam_fix_hookspath_constants.py` | `bugteam_fix_hookspath.py` — canonical hooks path, remediation message strings. |
-| `claude_permissions_common_constants.py` | `_bugteam_permissions_common.py` — settings JSON keys, glob patterns for the grant/revoke scripts. |
 | `probe_code_rules_enforcer_check_constants.py` | `probe_code_rules_enforcer_check.py` — enforcer module path and function name constants. |
 | `reflow_skill_md_constants.py` | `reflow_skill_md.py` — line-length and formatting constants. |
 | `windows_safe_rmtree_constants.py` | `windows_safe_rmtree.py` — retry count and wait constants. |

package/skills/code/SKILL.md

@@ -138,6 +138,8 @@ def load_config(config_path: str) -> AppConfig:
     """
 ```
 
+For a public function whose behavior needs a picture, lead the narrative with a diagram: one summary line, then a `::` literal block or a doctest showing a concrete input and its marked outcome, then a couple of short prose lines, then the `Args:` / `Returns:` sections. See `../../rules/plain-illustrative-docstrings.md` for the shape and a worked example.
+
 ### 13. Build infrastructure
 
 The project under development must contain:

package/skills/copilot-review/CLAUDE.md

@@ -4,7 +4,7 @@ Spawns a background subagent that polls the GitHub Copilot reviewer on the curre
 
 ## Purpose
 
-The main session gathers PR context (number, HEAD SHA, owner/repo, branch), spawns a self-terminating background subagent with a fully filled-in prompt, and returns control at once. The subagent loops on a 5-minute `ScheduleWakeup` cadence: fetch Copilot's latest review, TDD-fix any inline findings, push a commit, reply inline, re-request review. It stops on convergence, a persistent blocker, `TaskStop`, or after 20 ticks.
+The main session gathers PR context (number, HEAD SHA, owner/repo, branch), spawns a self-terminating background subagent with a fully filled-in prompt, and returns control at once. The subagent loops on a 6-minute `ScheduleWakeup` cadence: fetch Copilot's latest review, TDD-fix any inline findings, push a commit, reply inline, resolve each addressed thread, re-request review. It stops on convergence, a persistent blocker, `TaskStop`, three consecutive ticks with no Copilot review at the current HEAD, or after 20 ticks.
 
 ## Key file
 

package/skills/copilot-review/SKILL.md

@@ -2,10 +2,11 @@
 name: copilot-review
 description: >-
   Spawns a background subagent that babysits the GitHub Copilot reviewer on the current
-  PR: each ~5-min tick it fetches the latest copilot-pull-request-reviewer[bot] review,
-  fixes unaddressed findings against HEAD (commit, push, inline replies), re-requests
-  review, and exits on convergence. Triggers: '/copilot-review', 'watch copilot',
-  'babysit copilot review', 'keep re-requesting copilot'.
+  PR: each ~6-min tick it fetches the latest copilot-pull-request-reviewer[bot] review,
+  fixes unaddressed findings against HEAD (commit, push, inline replies, thread
+  resolution), re-requests review, and exits on convergence. Triggers:
+  '/copilot-review', 'watch copilot', 'babysit copilot review', 'keep re-requesting
+  copilot'.
 ---
 
 # Copilot Review
@@ -20,20 +21,18 @@ The user is on a PR branch, wants Copilot (the GitHub Copilot reviewer bot) to k
 
 ### Step 0: Opt-out check
 
-Before any other work, inspect the `CLAUDE_REVIEWS_DISABLED` environment
-variable. Treat the value as a comma-separated list of skill tokens
-(case-insensitive, whitespace-tolerant). When the parsed list contains
-`copilot`, respond with the literal line `/copilot-review is disabled via
-CLAUDE_REVIEWS_DISABLED.` and stop — do not spawn the subagent, do not call
-the Copilot reviewer API, do not run any other step of this skill.
+Before any other work, run:
 
-PowerShell probe (Windows):
-
-```pwsh
-$disabled = ($env:CLAUDE_REVIEWS_DISABLED -split ',' | ForEach-Object { $_.Trim().ToLowerInvariant() })
-if ($disabled -contains 'copilot') { '/copilot-review is disabled via CLAUDE_REVIEWS_DISABLED.' }
+```bash
+python "$HOME/.claude/_shared/pr-loop/scripts/reviews_disabled.py" --reviewer copilot
 ```
 
+Exit 0 — Copilot reviews are disabled: respond with the literal line
+`/copilot-review is disabled via CLAUDE_REVIEWS_DISABLED.` and stop — do not
+spawn the subagent, do not call the Copilot reviewer API, do not run any
+other step of this skill. Exit 1 — continue. Gate semantics live in the
+`reviewer-gates` skill ([../reviewer-gates/SKILL.md](../reviewer-gates/SKILL.md)).
+
 ### Step 1: Gather PR context
 
 From the current repo:
@@ -74,25 +73,27 @@ Pass this verbatim to the subagent (substituting the bracketed values):
 > 2. Fetch latest Copilot review via `pull_request_read(method="get_reviews", pullNumber=[NUMBER], owner="[OWNER]", repo="[REPO]")`.
 >    Capture `commit_id`, `state`, `submitted_at`, `id`.
 > 3. Decide the branch:
->    - **No review exists:** re-request (step 4), schedule next wakeup, return.
->    - **Latest review's `commit_id` != current HEAD:** re-request (step 4), schedule next wakeup, return.
->    - **Latest review's `commit_id` == current HEAD with unresolved inline findings:** TDD-fix them, push, reply inline on each thread, re-request (step 4), schedule next wakeup, return.
+>    - **No review exists:** increment `no_review_count` (see escalation rule below), re-request (step 4), schedule next wakeup, return.
+>    - **Latest review's `commit_id` != current HEAD:** increment `no_review_count`, re-request (step 4), schedule next wakeup, return.
+>    - **Latest review's `commit_id` == current HEAD with unresolved inline findings:** reset `no_review_count` to 0, TDD-fix them, push, reply inline on each thread, resolve each addressed thread, re-request (step 4), schedule next wakeup, return.
 >    - **Latest review's `commit_id` == current HEAD and clean:** report convergence to the parent with a one-sentence summary and terminate. The loop is done; skip the ScheduleWakeup call.
+>
+>    **Escalation rule:** `no_review_count` starts at 0, counts consecutive ticks where no Copilot review exists at the current HEAD, and resets to 0 on every push and every review sighted at HEAD. When it reaches 3, Copilot is not delivering reviews — report the stall to the parent with the count and the last request timestamp, then terminate without scheduling another wakeup.
 > 4. Re-request Copilot via `request_copilot_review(owner="[OWNER]", repo="[REPO]", pullNumber=[NUMBER])`.
 >    The reviewer ID **must** be `copilot-pull-request-reviewer[bot]` with the `[bot]` suffix — empirically verified: `Copilot`, `copilot`, and `github-copilot` all return `requested_reviewers: []` with no error, silently no-op.
 > 5. Schedule the next wakeup with `ScheduleWakeup`:
->    - `delaySeconds: 300`
+>    - `delaySeconds: 360`
 >    - `reason`: one short sentence on what you are waiting for.
 >    - `prompt`: the literal sentinel `<<autonomous-loop-dynamic>>` so the next firing re-enters these instructions.
 >
 > **Fix protocol** (step 3, third branch):
 >
+> - Read `$HOME/.claude/skills/pr-fix-protocol/SKILL.md` and apply it — it carries the shared fix sequence, the reply-and-resolve unit, and the unresolved-thread sweep.
 > - Read each referenced file:line.
 > - Write a failing test first when the finding has behavior to test. For pure doc or comment nits that have no behavior, go straight to the fix.
-> - Implement the fix.
 > - Stage the fix and create one new commit on the existing branch: `git add <files> && git commit -m "fix(review): ..."`.
 > - Push the new commit: `git push origin [BRANCH]`.
-> - Reply inline on each comment thread with `add_reply_to_pull_request_comment(owner="[OWNER]", repo="[REPO]", pullNumber=[NUMBER], body="...", commentId=<comment_id>)`, referencing the new commit SHA.
+> - Reply inline via `add_reply_to_pull_request_comment(owner="[OWNER]", repo="[REPO]", pullNumber=[NUMBER], body="...", commentId=<comment_id>)`, referencing the new commit SHA; then resolve each addressed thread via `pull_request_review_write(method="resolve_thread", pullNumber=[NUMBER], owner="[OWNER]", repo="[REPO]", threadId="<PRRT id>")`, harvesting the `PRRT_…` id from `pull_request_read(method="get_review_comments", ...)`. Reply first, then resolve — atomic per thread, per the protocol.
 >
 > When a pre-push, pre-commit, or other hook rejects the change, solve it. Read the hook's error message, diagnose the root cause in the code or test, and fix that. Then rerun the commit or push. Hooks exist to catch real problems; treat each rejection as new evidence to act on.
 >
@@ -101,8 +102,9 @@ Pass this verbatim to the subagent (substituting the bracketed values):
 > - Convergence (clean review against HEAD): report one-sentence summary to parent and terminate.
 > - Blocker you have exhausted fix attempts on (API auth failure persists, CI regression whose root cause falls outside this PR, a hook you have investigated and cannot resolve in one commit): report the specific blocker and its diagnosis to the parent, then terminate without scheduling another wakeup.
 > - Parent sends `TaskStop`: terminate immediately.
+> - `no_review_count` reaches 3 (escalation rule above): report the stall and terminate.
 >
-> **Safety cap:** after 20 ticks without convergence, stop and report. That many rounds means something structural is wrong with the loop.
+> **Safety cap:** after 20 ticks without convergence, stop and report. This is the total-tick runaway guard, distinct from the 3-consecutive-no-review escalation; that many rounds means something structural is wrong with the loop.
 
 ### Step 4: Report back to the user
 
@@ -142,7 +144,7 @@ Subagent: [re-requests review, schedules next wakeup, returns]
 
 <example>
 Subagent tick fires, Copilot has 2 unaddressed inline findings on HEAD.
-Subagent: [TDD-fixes both, one commit, pushes, replies inline on both threads, re-requests review, schedules next wakeup]
+Subagent: [TDD-fixes both, one commit, pushes, replies inline on both threads, resolves both threads, re-requests review, schedules next wakeup]
 </example>
 
 <example>

package/skills/everything-search/SKILL.md

@@ -11,6 +11,11 @@ Search files instantly on Windows using the Everything command-line interface (e
 
 **Announce at start:** "I'm using the everything-search skill to find files."
 
+## Hard limits
+
+- **Scope every search.** Pass a project path, an `ext:`/`dm:`/`size:` filter, or a name pattern. A bare whole-drive scan or a network-share sweep is out of bounds.
+- **Fall back on failure.** When `es.exe` fails or returns nothing, try to start it. if that doesn't work, prompt the user to decide next steps: grep, debug further, etc.
+
 ## Instructions
 
 ### Command Syntax

package/skills/findbugs/CLAUDE.md

@@ -4,13 +4,13 @@ Audits the current branch's pull request for bugs by spawning the `code-quality-
 
 ## Purpose
 
-Read-only. The skill resolves PR scope, writes the diff to a scoped temp file, and spawns two `code-quality-agent` instances (primary sonnet + secondary haiku) with a self-contained, context-free prompt covering all A–P audit categories. After both return it merges findings (de-dup, max-wins severity), posts one audit review to the PR via `post_audit_thread.py` (APPROVE on clean, REQUEST_CHANGES with inline anchored comments on dirty), and reports totals and cleared categories to the user.
+Read-only. The skill resolves PR scope via the `pr-scope-resolve` skill, writes the diff to a scoped temp file, and spawns two `code-quality-agent` instances (primary sonnet + secondary haiku) with a self-contained, context-free prompt covering all A–P audit categories. After both return it merges findings (de-dup, max-wins severity), posts one audit review to the PR via the `post-audit-findings` skill (APPROVE on clean, REQUEST_CHANGES with inline anchored comments on dirty), and reports totals and cleared categories to the user.
 
 ## Key file
 
 | File | Purpose |
 |---|---|
-| `SKILL.md` | Five-step process: resolve scope, capture diff to a scoped temp path, spawn agents (clean-room prompt XML), post audit review via `post_audit_thread.py`, surface findings and offer `/fixbugs`. Includes refusals, output format, and the anchored-vs-unanchored finding split. |
+| `SKILL.md` | Five-step process: resolve scope (`pr-scope-resolve` skill), capture diff to a scoped temp path, spawn agents (clean-room prompt XML), post audit review (`post-audit-findings` skill), surface findings and offer `/fixbugs`. Includes refusals and the output format. |
 
 ## Constraints
 

package/skills/findbugs/SKILL.md

@@ -22,21 +22,21 @@ If the current branch has no associated PR and no diff against the default branc
 
 First match wins; respond with the quoted line exactly and stop:
 
-- **Disabled via environment.** When `CLAUDE_REVIEWS_DISABLED` contains the
-  token `bugteam` (comma-separated, case-insensitive, whitespace-tolerant):
-  `/findbugs is disabled via CLAUDE_REVIEWS_DISABLED.` `/findbugs` is a PR
-  bug-audit skill in the same family as `/bugteam` and `/qbug`, so the
-  shared `bugteam` token disables all three.
+- **Disabled via environment.** When `CLAUDE_REVIEWS_DISABLED` carries the
+  token `bugteam`:
+  `/findbugs is disabled via CLAUDE_REVIEWS_DISABLED.` Run the check via
+  `python "$HOME/.claude/_shared/pr-loop/scripts/reviews_disabled.py" --reviewer bugteam`
+  (exit 0 = disabled). `/findbugs` is a PR bug-audit skill in the same family
+  as `/bugteam` and `/qbug`, so the shared `bugteam` token disables all three.
+  The gate semantics live in the `reviewer-gates` skill (`../reviewer-gates/SKILL.md`).
 
 ## The Process
 
 ### Step 1: Resolve PR scope
 
-Determine the audit target in this order:
+Apply the `pr-scope-resolve` skill (`../pr-scope-resolve/SKILL.md`) with caller `findbugs`. Findbugs consumes the resolved `owner`, `repo`, `number`, `head_ref`, `base_ref`, and `url`; when no PR exists, the ladder's merge-base rung sets the audit scope. When no target exists, respond exactly with the sub-skill's canonical refusal line and stop:
 
-1. **Open PR for current branch.** Call `pull_request_read(method="get", pullNumber=N, owner=O, repo=R)` for the current branch (`N` comes from the parent skill's context, or fall back to `search_issues` MCP with the current branch name to recover the PR number). If a PR exists, capture its number, base ref, head ref, and URL.
-2. **No PR but a remote default branch exists.** Diff against the default branch's merge-base: `git merge-base HEAD origin/<default>` then `git diff <merge-base>...HEAD`. Treat this as the audit scope.
-3. **Neither.** Respond exactly: `No PR or upstream diff found. Push the branch or open a PR first.` and stop.
+`No PR or upstream diff. /findbugs needs a target.`
 
 ### Step 2: Capture the full PR diff
 
@@ -102,6 +102,8 @@ The XML prompt skeleton:
   L. Behavior-equivalence for refactors
   M. Producer/consumer cardinality vs collection-type contract
   N. Test-name scenario verifier
+  O. Docstring / fixture-prose vs implementation drift
+  P. Name / regex / word-list vs behavior-contract precision
 
   The category list above is a summary. The binding definition of each
   category is its rubric file under $HOME/.claude/audit-rubrics/category_rubrics/
@@ -117,7 +119,7 @@ The XML prompt skeleton:
 </constraints>
 
 <output_format>
-  Follow the shared audit contract at ../bugteam/reference/audit-contract.md:
+  Follow the shared audit contract at $HOME/.claude/_shared/pr-loop/audit-contract.md:
 
   - Severity: P0 = will not run / data corruption; P1 = regression or silent
     failure; P2 = dead code, minor smell.
@@ -139,81 +141,18 @@ returns findings without posting them as inline comments is invisible
 to the gate. Findbugs remains read-only on code — the review post is
 the only side effect.
 
-**Self-PR auto-toggle.** GitHub rejects both `APPROVE` and
-`REQUEST_CHANGES` reviews with HTTP 422 when the authenticated identity
-matches the PR author ("Cannot approve/request changes on your own pull
-request"). `post_audit_thread.py` detects this case via `gh api user` +
-`gh api repos/<o>/<r>/pulls/<n>` and auto-resolves an alternate gh
-account's token for the reviews POST — the active `gh auth` account is
-not mutated; only the bearer token sent on the request changes. After
-the POST the active account is still whoever it was before, so no
-"swap back" step is needed.
-
-Configuration:
-
-- `GH_TOKEN` / `GITHUB_TOKEN` env vars take precedence over the toggle.
-  Set them when you need to pin a specific reviewer identity by token
-  rather than by account login.
-- `BUGTEAM_REVIEWER_ACCOUNT` env var names which authenticated alternate
-  to prefer when a toggle is needed (for example,
-  `BUGTEAM_REVIEWER_ACCOUNT=jl-cmd`). The env var name is shared across
-  every skill that invokes `post_audit_thread.py`. When unset, the
-  script falls back to the first alternate account `gh auth status`
-  reports.
-- The named alternate must be logged in (`gh auth login -h github.com -u
-  <login>`) before the audit skill runs. The script exits 1 with a
-  pointing-at-`gh auth login` message when self-PR is detected and no
-  usable alternate is authenticated.
-
-After the agent (and Haiku secondary) return and the merge is complete,
-serialize the merged findings to a JSON file and call
-`post_audit_thread.py`:
-
-```
-python "${CLAUDE_SKILL_DIR}/../../_shared/pr-loop/scripts/post_audit_thread.py" \
-  --skill findbugs \
-  --owner <owner> \
-  --repo <repo> \
-  --pr-number <N> \
-  --commit <head_sha> \
-  --state <CLEAN|DIRTY> \
-  --findings-json <path>
-```
-
-The findings JSON root is a list of objects shaped
-`{path, line, side, severity, description, fix_summary}`. Before
-serializing, partition the merged findings into anchored (line appears
-in the captured diff) and unanchored (line is not in the diff) buckets.
-Only anchored findings are serialized to the JSON — the GitHub reviews
-API rejects the entire POST if any inline comment in `comments[]`
-targets a line not in the diff at `--commit`, so a single unanchored
-entry breaks the whole review. Unanchored findings are surfaced via
-Step 5's user-facing output rather than as inline anchored comments.
-For each anchored finding, map `file` → `path`; split the finding's
-`failure_mode` at the literal `Fix:` heading so the failure narrative
-becomes `description` and the suffix beginning at `Fix:` (including
-the trailing `Validation:` clause) becomes `fix_summary` (the
-`failure_mode` field carries the full audit-to-fix handoff per
-[`agents/code-quality-agent.md`](../../agents/code-quality-agent.md)).
-When a finding's `failure_mode` omits the `Fix:` heading, write the
-full text to BOTH `description` and `fix_summary`. Set `side="RIGHT"`
-for every entry. Zero anchored findings → `--state CLEAN` with the
-findings file holding an empty array (`[]`); one or more anchored
-findings → `--state DIRTY` with the full list. CLEAN posts an APPROVE review (the
-request event; GitHub stores it as `state=APPROVED`) with a "no
-findings" summary; DIRTY posts a REQUEST_CHANGES review with one inline
-anchored comment per finding (each becomes its own resolvable thread on
-the PR).
-
 Capture `<head_sha>` once at the start of Step 4 via `git rev-parse
 HEAD` in the worktree the diff was scoped against.
 
-Exit codes: `0` on success (emits the new review's `html_url` to
-stdout, surface alongside the totals in Step 5); `1` on user input
-error; `2` on retry exhaustion (1s / 4s / 16s backoff across four
-attempts). On exit 2, tell the user the review post failed and that
-the unresolved-thread gate will not see this audit pass; do not retry
-silently.
+After the agent (and Haiku secondary) return and the merge is complete,
+apply the `post-audit-findings` skill (`../post-audit-findings/SKILL.md`)
+with `--skill findbugs`. That skill owns the findings-JSON mapping, the
+anchored-only serialization (unanchored findings surface via Step 5's
+user-facing output), the CLEAN/DIRTY decision, the self-PR reviewer
+toggle, and the exit codes. On exit 0, surface the emitted review
+`html_url` alongside the totals in Step 5. On exit 2, tell the user the
+review post failed and that the unresolved-thread gate will not see this
+audit pass; do not retry silently.
 
 ### Step 5: Surface findings, then clean up
 
@@ -285,7 +224,7 @@ Claude: [resolves PR #42 from current branch, fetches full diff, spawns code-qua
 
 <example>
 User: `/findbugs`
-Claude: `No PR or upstream diff found. Push the branch or open a PR first.`
+Claude: `No PR or upstream diff. /findbugs needs a target.`
 </example>
 
 <example>

package/skills/fixbugs/SKILL.md

@@ -47,11 +47,9 @@ If the filtered set is empty, refuse per the refusal cases above.
 
 ### Step 2: Re-resolve PR scope
 
-Re-establish the same PR target `/findbugs` used:
+Apply the `pr-scope-resolve` skill (`../pr-scope-resolve/SKILL.md`) with caller `fixbugs` to resolve the same PR target `/findbugs` used — the fixes stay scoped to the files the `/findbugs` findings from Step 1 name. When no target exists, respond with the sub-skill's canonical refusal line and stop:
 
-1. `pull_request_read(method="get", pullNumber=N, owner=O, repo=R)` for the current branch (`N` comes from the parent skill's PR context, or fall back to `search_issues` MCP with the current branch name to recover the PR number).
-2. Fall back to `git merge-base HEAD origin/<default>` then `git diff <merge-base>...HEAD`.
-3. Neither → respond `No PR or upstream diff. Cannot scope fixes.` and stop.
+`No PR or upstream diff. /fixbugs needs a target.`
 
 Capture: `<owner>/<repo>`, head branch, base branch, PR number, PR URL.
 

package/skills/log-audit/CLAUDE.md

@@ -0,0 +1,20 @@
+# log-audit
+
+Reads this repository's own logs, finds recurring errors and timing regressions, and turns each real pattern into a tracked fix. Triggered by `/log-audit`, `audit the logs`, `what keeps failing`, or `what's getting slower`.
+
+## Purpose
+
+The skill runs as a background agent on a recurring schedule. Each cycle it reads the hook block log and the diagnostic extractor pipeline, clusters recurring errors and timing regressions, opens a grouped draft fix pull request or a tracked optimization issue per finding, and mines the defects Copilot and Bugbot keep catching into skill-edit proposals. Cycle state lives under `~/.claude/runtime/log-audit/`, so a restart resumes the same run.
+
+## Key files
+
+| File | Purpose |
+|---|---|
+| `SKILL.md` | Full instructions: the cycle steps, the three scripts and how to pipe them, the log sources in and out of scope, finding-filing rules, reviewer mining, cycle state, and cadence. |
+
+## Subdirectories
+
+| Directory | Role |
+|---|---|
+| `reference/` | The agent charter — the fixed contract the skill answers to. |
+| `scripts/` | The collect, cluster, and mine scripts and their constants package. |