Stop paying 10,545 words every time these six skills fire

Final check

One last pass to confirm the whole change works end to end.

Run the full local gate in one pass: bash tests/plugins/test-remaining-skill-splits.sh && bash tests/plugins/test-artifact-tools.sh && bash tests/plugins/test-artifact-to-post.sh && bash tests/plugins/test-memory-doctor-guard.sh && bash tests/plugins/test-generator-skills-verify-output.sh && bash tests/plugins/test-description-budget.sh && BASE_REF=main node scripts/check-plugin-versions.mjs. Expected result: every command exits 0 and the objective test prints six word counts, all under 600.

Then prove the objective test is not a tautology, one break at a time, reverting after each. Delete the security-scrub paragraph from kit/plugins/artifact-tools/skills/prompt-artifact/SKILL.md and confirm bash tests/plugins/test-remaining-skill-splits.sh exits 1 naming the missing gate; restore it. Change one references/ link in the optimizing-skill-frontmatter core to a filename that does not exist and confirm the test exits 1 on the unresolved reference; restore it. Paste roughly 400 words of the moved rules back into that same core and confirm the test exits 1 on the word ceiling; restore it. A test that passes through all three breaks is measuring nothing.

Behavioral verification is the part word counts cannot cover, and it is not optional. Load the five plugins locally (claude --plugin-dir kit/plugins/skill-reviewer --plugin-dir kit/plugins/artifact-tools --plugin-dir kit/plugins/memory-tools --plugin-dir kit/plugins/content-tools --plugin-dir kit/plugins/code-testing-agent) and actually invoke each split skill: run optimizing-skill-frontmatter against a throwaway SKILL.md fixture in a temp dir and confirm it still reaches the rewrite rules, the invocation-control table, and the budget advisory by reading the references; run path-rules-advisor in Mode A against a scratch repo and confirm it still asks before writing and still runs the parse check after; run artifact-to-post against tests/fixtures/artifact-to-post/sample-artifact.html and confirm it stops at the scrub gate rather than writing; run diff-artifact and prompt-artifact far enough to observe the scrub gate fire from the core before any publish; run tdd-fix against tests/demo/ and confirm it still writes a failing test and enters the loop. Any skill that stalls, skips a step, or fails to pull a reference it needs is a failed split regardless of its word count — report it and fix it rather than recording the plan as complete. Finally, run /skill-reviewer:reviewing-skills against optimizing-skill-frontmatter itself: the rubric must pass its own audit, including the reference-depth-≤1 and progressive-disclosure criteria it defines, since it is now both the judge and the subject. Clean up every temp dir the verification creates.

Recorded outcome. The full local gate passes: all six objective checks, the five
named unit tests, check-plugin-versions.mjs, and the whole tests/plugins/ suite
(43 files, 0 failures). All four tautology breaks were exercised and each fails the
objective test, restoring green after revert: the deleted security-scrub paragraph
(core gate lost in: prompt-artifact), a references/ link renamed to a
non-existent file (both the unresolved pointer and the resulting orphan), ~400
words of moved rules pasted back into the optimizing-skill-frontmatter core (965
words, over the ceiling), and a reworded description: (frontmatter drifted:
tdd-fix:[description]).

Behavioural verification ran all six skills through claude -p with the plugins
loaded, in throwaway temp dirs (since removed). Every skill reached and read the
references it needed, and every gate held: optimizing-skill-frontmatter read all
four references at the right steps and rewrote a fixture description to three-part
form; path-rules-advisor read rule-modes.md, rule-file-format.md, and
write-verification.md, and refused to write without explicit confirmation;
artifact-to-post stopped dead at the Phase 2 gate and wrote nothing;
diff-artifact ran the default-branch resolution out of diff-sources.md and then
stopped at the Step 2 gate before building a page; prompt-artifact read all four
references, ran the PROMPTS_DIR resolver, and stopped at the Step 4 gate with no
page written and no URL recorded; tdd-fix wrote a failing test, confirmed it red,
entered the loop, fixed the bug in one iteration, swept the suite green, and printed
the summary block.

Two verification limits worth recording rather than glossing. First, the live
post-write parse check could not be observed end-to-end: this container blocks
headless writes under .claude/, so path-rules-advisor never got to run the check
on a file it had just written. The read half is confirmed (it loads
write-verification.md before writing), and the executable half is covered better
than a live run would cover it — test-memory-doctor-guard.sh extracts the real
shipped block from the reference and runs it against ten fixtures including the
malformed and empty-body negatives. Second, tests/demo/calculator.sh no longer
carries the bug its own comment describes (add() is already +), so the first
tdd-fix run correctly hit Step 2's passing-test hard stop; the loop was exercised
on a temp copy with the operator flipped back.

Two deviations from the plan as written, both to reach the plan's own outcome.
test-generator-skills-verify-output.sh was left unmodified. The plan called for
repointing its path-rules-advisor wiring regex at the reference; instead the core
keeps the three run [Verify the write](#verify-the-write) call sites the existing
regex already matches, so the wiring stays asserted with no test churn — and the new
objective test separately proves the core's references/write-verification.md
pointer resolves. test-proposal-prompt-pipeline.sh needed a change the plan did
not anticipate: its check 8 greps prompt-artifact's SKILL.md for the five library
filter chips and the tolerant-frontmatter rule, both of which moved into
prompt-page.md and prompt-resolution.md. It now reads the core plus those two, so
it still fails if a chip is dropped.

Two defects the PR review caught, both in the tests this plan added. Neither was
visible from a green local run, which is the point worth recording.

The word ceiling was measured with a locale-dependent counter. wc -w under this
container's C locale undercounted every core by 9–23 words, so three of them
(tdd-fix 603, diff-artifact 602, prompt-artifact 617) shipped over the ceiling
and the new CI step failed on the first run. Fixed at both ends: the test counts in
Python so the number is the same on every machine, and all six cores were trimmed to
566–583 by removing genuine restatement rather than reshuffling prose — Step 5's
scrub paragraph in diff-artifact no longer repeats Step 2's verdict list, tdd-fix
no longer paraphrases steps its references already state in full, and
artifact-to-post drops a lead paragraph that restated its own frontmatter
description.

test-memory-doctor-guard.sh could abort silently. Its extract_check piped the
bundled skill into an awk that exits at the heredoc terminator; the producer then
wrote into a closed reader, took SIGPIPE, and under set -o pipefail + set -e the
whole test aborted at exit 141 — skipping checks 3–10 while reporting nothing. It
passed only because the bytes trailing the heredoc happened to fit the 64 KiB pipe
buffer (5,756 bytes of margin for agentic-memory-management, 684 for
path-rules-advisor), which is a property of today's reference files, not a
guarantee. Extraction now buffers to a file, which has no reader to close; verified
by appending 480 KB after the heredoc and confirming all 11 checks still run, where
the old piped form exits 141.

Four review findings were also worth taking, each verified by a negative control
that fails before the fix and passes after: the frontmatter unit check now compares
the whole opening --- block rather than four named keys (an added model: key
passed before); diff-artifact's rendered-page rescan is asserted to precede the
publish bootstrap, not merely to exist (moving it after publish passed before); the
date-derived-key ban covers prompt-publishing.md as well as diff-publishing.md;
and references/titles.md joined the resolve/orphan sweep, since both split cores
name it. Reference counting also changed shape: it now counts the references each
core actually links and that resolve, because under a plugin-level layout counting
files in the shared directory would let a target pass on its siblings' references.

Four further findings were checked and declined, each for a stated reason. Describing
security-scrub as auto-activated rather than a Skill-tool call would break the
gate: a blocking gate has to be invoked deterministically, test-artifact-tools.sh
requires Skill in allowed-tools precisely because the body invokes another
plugin's skill, and the wording is unchanged from main. Replacing the frontmatter
parse check with a YAML parser is unnecessary — the concern was that it rejects
nested mappings and sequence items, but it skips indented lines and - items, and
test-memory-doctor-guard.sh check 9 proves it on a folded scalar plus a nested
list. The git checkout -- <path> recovery hint and the ## When not to use scope
line that omits Rule 4's body insertion are both real, both unchanged from main,
and both live identically in a sibling skill outside this PR; changing shipped
guidance inside a refactor that promises byte-identical behaviour would hide a
behaviour change in a no-op diff, so they belong in the Rule 1 trim pass already
queued in Next Steps.

One review finding was wrong, and checking it found something real. Copilot reported
that test-generator-skills-verify-output.sh requires the literal TARGET" in the
check-section body and that the split therefore breaks the audit. It does not: the
evidence pattern is TARGET (the trailing quote in the test source closes the
SKILLS= heredoc string, not the regex), the core carries $TARGET, and the audit
reports OK: memory-tools/skills/path-rules-advisor/SKILL.md. But verifying that
exposed a genuine gap in this plan's own reasoning: five of the tests this work
depends on were not wired into CI at all, including four retargeted here to follow
moved content and the one whose unmodified pass was the stated reason for not
touching it. Step 8's rationale — "without CI wiring the guarantee decays on the next
edit" — was applied only to the new objective test. It applies just as much to a test
whose literals now point at a reference file. All five pass on origin/main
unchanged, so test-artifact-tools.sh, test-artifact-to-post.sh,
test-memory-doctor-guard.sh, test-generator-skills-verify-output.sh, and
test-description-budget.sh are now named steps in
.github/workflows/check-plugin-versions.yml, verified by running the check job's
full step list in order under the runner's C.UTF-8 locale.