Keep the Why

Privilege evidence is solid: all CI workflows declare read-only contents: read tokens and pin actions by SHA; dedicated PathConfinement tests prove the linter refuses to read outside the project tree (../, absolute paths, symlink escapes all trigger E009), and dashboard tests show symlinked and external directories are never read — least_privilege earns 3. Write confirmation is supported via config (capture-confirmation, confirm-when-unsure) but the confirmation flow itself is not shown in the provided files: 2. Data flow (plain Markdown, no DB/daemon) and sensitive-data handling (anonymize tests, script-tag escaping, hidden-character detection) are test-backed but cover only the dashboard side: 2 each. Dependencies: black is pinned in CI, but the dashboard tests install jsdom@24 without a full pin and no lockfile is provided: 2. External effects are limited to in-repo file writes and optional PyPI linter installation with an ask-first option: 2. Rollback rests on Git itself plus superseded/pinned-version mechanisms — reasonable but indirect: 2. Source attribution is thorough (git attribution, .mailmap merging, Evidence/Source fields, author-statistics tests): 3.

test_version.py hard-tests that the version prefix equals SUPPORTED_SCHEMA and that all schema gates are covered — self_consistency earns 3. The core linter claims stdlib-only and frontend tests claim no dependencies, but no complete dependency manifest appears in the provided files: 2. Failure output has structured codes (E001–E301) and a GITHUB_ACTIONS annotation mode; the tests claim 'never a traceback and never a guess', but that is a self-description in test comments, not independent evidence: 2.

Audiences (maintainers, teams, legacy projects) and four modes are covered, with honest limits on retrospective recovery ('history gives back only part'), but the scenario description is largely narrative: 2. Boundaries are stated in several places ('has not been measured, not failed'; honest eval failure analysis) — 2 rather than 3 because the boundary statements mostly point to off-repo pages not verifiable here. Trigger precision is deliberately designed: activation only on conversation match, setup only from an explicit request, hook/entry-point loading statistics (10/10, 3/3) recorded but self-reported: 2. Environment fit is the strongest: 70+ agents, a per-agent directory table, shared-path fallbacks, and Windows path-parsing platform differences all test-covered: 3.

Information architecture is excellent: a 'Where this fits' table separates README/docs/CHANGELOG/context responsibilities, and the lettered index skeleton has full lint rules (E205/E206): 3. Install notes cover skills CLI, gh, asm, plugin marketplaces, and manual-clone fallback with pitfalls explained: 3. Naming stability has a fixed directory-name requirement and pinned-version/pinned-path validation tests, but legacy-format migration appears only in tests: 2. The examples/ directory and per-mode walkthroughs are referenced but not present in the provided files: 2. Known limitations are stated (eval caveats, retrospective limits) but mostly off-repo: 2. The MIT license file is complete and matches metadata: 3. Versioning: CHANGELOG is linked and the four-segment scheme is test-locked, but the CHANGELOG itself is not in the provided files: 2. Maintenance: named maintainer, 48-hour security response commitment, one-issue-per-problem policy — but a documented solo commitment: 2.

Output is plain Markdown plus index plus a self-contained dashboard export (script-tag escaping tested); usability is good but unverified by execution: 2. Marginal value is backed by the 20-session controlled experiment (10/10 no longer re-proposing the rejected change); the transcripts are claimed to live in-repo but were not provided, so it is a self-reported experiment: 2. The cost-benefit argument (reasoning as a byproduct, token savings) is plausible but likewise rests on self-reported measurement: 2.

The core claim points to full transcripts and grades under experiments/rejected-change/, so traceability is designed in, but those files were not part of this review: 2. Cross-source corroboration lists multiple registries and security-scan badges, none independently verified here; the agent matrix is off-repo: 2. Fact/inference separation is a first-class schema requirement (Evidence: confirmed/inferred/unknown; E111 forces explanations for contradicted claims) with tests proving it — but as a self-assessment instrument it says more about the product's design than about the project's own claims: 2.