Wave 7: API fuzzing, committed-data check, offline Scorecard, CI liveness rule, audit-pr area budget

.claude/skills/INDEX.md

@@ -126,6 +126,7 @@ Run `python3 <skill>/scripts/<name>` (`bash` for `.sh`). `name: purpose — argu
 
 ### deep-code-review
 - ci_cost_advisor.py: estimate a repo's GitHub Actions minutes and dollars, and… — [ROOT] [--visibility…
+- committed_personal_data.py: count distinct email addresses per tracked file and report the… — [--threshold N] [--repo-threshold N]…
 - context_pack.py: bounded context pack for a DIFF review. — [--base REF] [--repo DIR] [--intent…
 - coverage_ledger.py: completeness check for a machine-report coverage map. — [--domains SPEC] <findings.json>
 - derived_numbers.py: bind a doc number to the counter that derives it. — [--fix] [--selftest] [ROOT]

.claude/skills/communication-structure/INDEX.md

@@ -6,7 +6,7 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing
 
 | File | Read this when... | Tok |
 |---|---|---|
-| `references/artifact-templates.md` | you draft a status update, PR body, release note, decision memo or executive summary, incident summ… | 2308 |
+| `references/artifact-templates.md` | you draft a status update, PR body, release note, decision memo or executive summary, incident summ… | 2360 |
 | `references/leadership-status-update.md` | you write any status update a non-technical leader will read: a tracker project update, an issue st… | 500 |
 
 ## Scripts

.claude/skills/communication-structure/evals/evals.json

@@ -231,6 +231,19 @@
         "One 'Key figure:' line states 1,840 documents exactly, near the top",
         "No invented number, date, owner or recommendation"
       ]
+    },
+    {
+      "id": "audit-pr-multi-area-body-budget",
+      "prompt": "Write the PR body for a security-hardening PR on the Acme API. Eight areas, each with its directory and test: auth (src/auth/, test/auth.test.ts), uploads (src/upload/, test/upload.test.ts), exports (src/export/, test/export.test.ts), webhooks (src/webhooks/, test/webhooks.test.ts), logging (src/log/, test/log.test.ts), rate limits (src/limits/, test/limits.test.ts), CORS (src/cors/, test/cors.test.ts), dependencies (package.json, test/deps.test.ts). Exports and uploads now need sign-in. 14 findings fixed; 3 not fixed (1 high, 2 medium), tracked privately. npm test on this head: 212/212 pass.",
+      "expected_output": "An audit-pr body with Summary, What changes for reviewers and users, Changes by area, How to verify and Not fixed. Changes by area has one bullet or one '### <Area>' heading per area, each naming its directory and test, and no '###' area is over 200 words. Everything outside Changes by area fits 1200 words and 160 lines, and the whole body stays under 3000 words. Not fixed gives counts only.",
+      "expectations": [
+        "All five required headings are present: Summary, What changes for reviewers and users, Changes by area, How to verify, Not fixed",
+        "Each of the eight areas is its own bullet or '### <Area>' heading under Changes by area, naming its directory (or package.json) and its test",
+        "No '###' area runs past 200 words; a long area is cut or split, not moved into the Summary",
+        "Everything outside Changes by area is within 1200 words and 160 lines, and the whole body is under 3000 words",
+        "What changes for reviewers and users lists the sign-in now needed for exports and uploads",
+        "Not fixed gives counts by severity only (1 high, 2 medium) with no file, route or exploit detail, and How to verify claims only the 212/212 npm test result"
+      ]
     }
   ]
 }

.claude/skills/communication-structure/references/artifact-templates.md

@@ -43,7 +43,7 @@ verified and command. Fenced code does not count toward the budget.
 empty (items, or `None`), or `Not fixed` carries a file:line, route, URL or file path (counts only). A closing footer
 (`---` or `🤖 Generated`, then only blank, `Generated with` and `Co-Authored-By:` lines, any of them in `<sub>`, `<sup>`,
 `<small>`, `*` or `_` markup) is not checked; other text after a `---` is. With `--range BASE..HEAD` it also fails when a changed file is not named under `Changes by area`, by full path
-or by a containing directory with a trailing slash. The guard hook picks this kind when the `gh pr create|edit` title says audit, security
+or by a containing directory with a trailing slash. The 1200-word, 160-line budget counts everything outside `Changes by area`, where an area may be a bullet or a `### <Area>` heading; each `### ` area fails above 200 words and the whole body above 3000 words. The guard hook picks this kind when the `gh pr create|edit` title says audit, security
 or harden, and for `create` passes the diff against `--base` (default `origin/HEAD`).
 
 ## Templates

.claude/skills/communication-structure/scripts/comms_lint.py

@@ -5,7 +5,8 @@
 (the one source of truth; `--list` prints it). Always checked: lead (line 1 is the answer: <=60 words, first
 sentence <=35, no greeting/background opener), budget (fails only above BUDGET_SLACK x the table value), dates (a
 weekday must fit its date, computed from the calendar), filler (AI-slop phrases), placeholder (TBD, [owner], and the
-stand-ins "owner unassigned", "no deadline", "not stated"), vague (numberless "significantly", "on track"). Advisory
+stand-ins "owner unassigned", "no deadline", "not stated"; a run of capital Xs inside a single-backtick span on one line, a
+mktemp template such as `drain.XXXXXX`, is not one), vague (numberless "significantly", "on track"). Advisory
 WARNs that never put a draft below the bar: hedge, length (over the table value), markers (check/hourglass lines),
 numbers (a figure in the first 4 content lines), verified, timezone, and ask (runs only with --source, only when the
 source has an ask, and flags a missing owner or date only if the source gives one: nothing demands what the input
@@ -19,7 +20,9 @@
 `audit-pr` (the body of an audit, security or hardening PR) adds `sections`, a failing rule at any length: every
 AUDIT_SECTIONS heading is present, "What changes for reviewers and users" is not empty (items, or "None"), "Not fixed"
 holds counts only (no file:line, route or URL), and, with --range BASE..HEAD, every file the range changes is named
-under "Changes by area" by its full path or by a containing directory with a trailing slash. A trailing attribution footer
+under "Changes by area" by its full path or by a containing directory with a trailing slash. Its budget counts everything
+outside "Changes by area", whose `### ` areas fail above AREA_WORDS words each and the whole body above TOTAL_WORDS (a hard
+cap, no BUDGET_SLACK); the reported words and lines are the ones the budget counts. A trailing attribution footer
 (a `---` rule or `🤖 Generated` line, then only blank, `---`, `Generated with/by` and `Co-Authored-By:` lines; those lines
 may sit in `<sub>`, `<sup>`, `<small>`, `*` or `_` markup) is not part of the last section; any other text after a `---` is
 still checked.
@@ -52,6 +55,7 @@
 BUDGET_SLACK = 1.5  # budget fails only above this multiple of the table value; between 1x and the slack it is a WARN (length)
 AUDIT_SECTIONS = ("Summary", "What changes for reviewers and users", "Changes by area", "How to verify", "Not fixed")  # the one home of the audit-pr heading names; the template in artifact-templates.md spells them out
 _, S_BEHAVIOR, S_AREAS, _, S_NOT_FIXED = AUDIT_SECTIONS
+AREA_WORDS, TOTAL_WORDS = 200, 3000  # audit-pr: the most words in one `### ` area under `## Changes by area` and in the whole body; both fail above, with no slack. The table budget covers everything outside that section.
 AUDIT_TITLE = re.compile(r"\b(?:audit\w*|security|harden\w*)\b", re.I)  # a PR title the guard hook checks as `audit-pr`
 
 
@@ -82,7 +86,7 @@ def load_kinds(path=REFERENCE):
                    r"(?:vast|great) majority|majority of|mostly|nearly|almost all|on track|going well|(?:good|great|strong) progress|"
                    r"a lot of|lots of|numerous|huge|massive|(?:major|large|big) improvements?|(?<!statistically )significant)\b", re.I)
 PLACEHOLDER = re.compile(r"\bTBD\b|\bTODO\b|\bXXX+\b|\blorem ipsum\b|\[(?:owner|date|name|link|number|your name|insert[^\]]*)\]|"
-                         r"<(?:owner|date|name|link|number|who|when)>|\bowner unassigned\b|\bunassigned owner\b|"
+                         r"<(?:owner|date|name|link|number|who|when|fill(?: in| me)?)>|\bowner unassigned\b|\bunassigned owner\b|"
                          r"\bno deadline(?: given| set| stated)?\b|\bnot (?:stated|specified)\b|\bnone given\b", re.I)
 OPENER = re.compile(r"^(?:hi|hello|hey|dear|thanks?|thank you|hope|i (?:just |wanted|am writing|['’]m writing)|just\b|(?:a )?quick\b|"
                     r"as (?:discussed|per|promised|requested)|following up|per our|so[, ]|"
@@ -146,6 +150,13 @@ def _words(s):
     return len(s.split())
 
 
+def _no_templates(ln):
+    """`ln` with each run of 3+ capital Xs inside a single-backtick span on this line blanked: a mktemp template such as
+    `drain.XXXXXX` is not a placeholder. Anywhere else (prose, a double-backtick span, a span split across lines, an unclosed
+    backtick) the line is unchanged, so a lone XXX in prose still is one. One linear pass (no nested quantifier)."""
+    return re.sub(r"`[^`]*`", lambda m: re.sub(r"X{3,}", "_", m.group()), ln)
+
+
 def _skip(ln):
     """True for a line that carries no answer (heading, rule, greeting, subject, bare label)."""
     s = ln.strip()
@@ -289,6 +300,24 @@ def _sections(text):
     return out
 
 
+def _areas(text, prose):
+    """(inside, areas) for the audit-pr budget. `inside` = line numbers in the `## Changes by area` section; `areas` =
+    [(heading line, heading text, words)] for each `### ` heading in it; the words are those under it up to the next heading of
+    level 1-3 (prose only: the heading, blank and fenced lines count 0). Empty when the body has no such section, so the whole
+    body is then counted."""
+    body = _sections(text).get(S_AREAS.lower(), (None, []))[1]
+    words, areas, fence, cur = dict(prose), [], False, None
+    for n, ln in body:
+        fence ^= ln.lstrip().startswith("```")
+        m = None if fence else HEADING.match(ln)
+        if m and len(m.group(1)) <= 3:
+            cur = [n, m.group(2).strip(), 0] if len(m.group(1)) == 3 else None
+            areas += [cur] if cur else []
+        elif cur:
+            cur[2] += _words(words.get(n, ""))
+    return {n for n, _ in body}, [tuple(a) for a in areas]
+
+
 def _covers(area, path):
     """True when `area` names repo path `path` as a whole path (not part of a longer one) or a directory holding it, written
     with a trailing slash. Whole = not glued to a path character (a word character or one of @ + ~ / . -) on the left (a `./`
@@ -346,7 +375,8 @@ def changed_files(rng, cwd=None):
 
 def lint(kind, text, source=None, files=None):
     """Score `text` as artifact `kind` (see load_kinds). Returns {kind, ok, score:[passed, total], words, lines,
-    budget:[words, lines], rules:[{rule, ok, advisory, hits:[{line, problem, fix}]}]}. Pure apart from reading the
+    budget:[words, lines], rules:[{rule, ok, advisory, hits:[{line, problem, fix}]}]}; `words` and `lines` are what the
+    budget counts: the whole body, but for audit-pr everything outside `## Changes by area` (see _areas). Pure apart from reading the
     table. `status` text with LONG_FORM_LABELS or more leadership labels is checked as `leadership`. `files` (paths
     changed by the PR, from changed_files) turns on the audit-pr coverage check; None skips it, [] has nothing to cover.
     Raises KeyError for a kind outside the table."""
@@ -389,15 +419,24 @@ def lint(kind, text, source=None, files=None):
         if _words(ln) > LEAD_WORDS or _words(first) > SENTENCE_WORDS:
             res["lead"].append(_hit(n, f"lead is {_words(ln)} words (first sentence {_words(first)}); the answer is buried",
                                     f"rewrite line {n} as one sentence of {SENTENCE_WORDS} words or fewer: outcome + number + ask; move the rest below it"))
-    over = f"{words} words / {len(prose)} lines against {max_words} / {max_lines} for {kind}"
-    cut = f"cut {max(words - max_words, 0)} words and {max(len(prose) - max_lines, 0)} lines: drop process narration and background, move detail behind one link; keep every fact the reader needs"
-    if words > max_words * BUDGET_SLACK or len(prose) > max_lines * BUDGET_SLACK:
+    inside, areas = _areas(text, prose) if "sections" in res else (set(), [])  # audit-pr: the budget skips `## Changes by area`, which has caps of its own
+    counted = [(n, t) for n, t in prose if n not in inside]
+    cwords = sum(_words(t) for _, t in counted)
+    where = f" outside `## {S_AREAS}`" if inside else ""
+    over = f"{cwords} words / {len(counted)} lines{where} against {max_words} / {max_lines} for {kind}"
+    cut = f"cut {max(cwords - max_words, 0)} words and {max(len(counted) - max_lines, 0)} lines: drop process narration and background, move detail behind one link; keep every fact the reader needs"
+    if cwords > max_words * BUDGET_SLACK or len(counted) > max_lines * BUDGET_SLACK:
         res["budget"].append(_hit(None, over, cut))
-    elif words > max_words or len(prose) > max_lines:
+    elif cwords > max_words or len(counted) > max_lines:
         res["length"] = [_hit(None, over, cut)]  # advisory: a ceiling at BUDGET_SLACK x, so a needed fact is never cut for the target
+    res["budget"] += [_hit(n, f"area '{h}' is {w} words against {AREA_WORDS} for a `###` area", f"cut {w - AREA_WORDS} words, or split it into two `###` areas; move detail behind one link")
+                      for n, h, w in areas if w > AREA_WORDS]
+    if "sections" in res and words > TOTAL_WORDS:
+        res["budget"].append(_hit(None, f"{words} words against the {TOTAL_WORDS} hard cap for {kind}", f"cut {words - TOTAL_WORDS} words: move detail behind one link"))
     res["dates"] = [_hit(n, f"'{m}' is a {day}", "check the date: fix the weekday or the date, or ask the author") for n, m, day in _bad_weekdays(prose)]
+    plain = [(n, _no_templates(ln)) for n, ln in prose]
     for rule, rx, fix in (("filler", FILLER, "delete the phrase"), ("placeholder", PLACEHOLDER, "delete it, or fill it from the source; leave an unknown part out instead of writing a stand-in")):
-        res[rule] = [_hit(n, f"'{rx.search(ln).group(0)}'", fix) for n, ln in prose if rx.search(ln)]
+        res[rule] = [_hit(n, f"'{rx.search(ln).group(0)}'", fix) for n, ln in plain if rx.search(ln)]
     for n, ln in prose:
         for sent in re.split(r"(?<=[.!?;])\s+", ln):
             m = VAGUE.search(sent)
@@ -457,7 +496,7 @@ def lint(kind, text, source=None, files=None):
              "placeholder", "vague", "grounded", "hedge")
     rules = [{"rule": r, "ok": not res[r], "advisory": r in ADVISORY, "hits": res[r]} for r in order if r in res]
     return {"kind": kind, "ok": all(r["ok"] or r["advisory"] for r in rules), "score": [sum(r["ok"] for r in rules), len(rules)],
-            "words": words, "lines": len(prose), "budget": [max_words, max_lines], "rules": rules}
+            "words": cwords, "lines": len(counted), "budget": [max_words, max_lines], "rules": rules}
 
 
 def render(res):

.claude/skills/deep-code-review/INDEX-scripts.md

@@ -4,11 +4,12 @@ Generated by `scripts/skill_index.py` (do not hand-edit). The script half of `IN
 
 | File | Trigger | CLI (— = open the header) |
 |---|---|---|
-| `scripts/app_pentest.sh` | app_pentest.sh [--active] URL: ZAP baseline + nuclei over a RUNNING app you own | — |
+| `scripts/app_pentest.sh` | app_pentest.sh [--active] [--openapi SPEC] URL: ZAP, nuclei, schemathesis over a RUNNING app you own | — |
 | `scripts/binaries_gate.py` | no git-tracked file at a banned image/media/archive/ build-output extension. | — |
 | `scripts/ci_cost_advisor.py` | estimate a repo's GitHub Actions minutes and dollars, and print a local-first plan with a ready pat… | ci_cost_advisor.py [ROOT] [--visibility auto\|public\|private] [--plan free\|pro\|team\|enterprise] [--required FILE[,FILE]\|… |
 | `scripts/ci_cost_lint.py` | flag GitHub Actions workflows that waste CI runner minutes. | — |
 | `scripts/closes_lint.py` | a closing keyword may only reference an issue/PR this change owns. | — |
+| `scripts/committed_personal_data.py` | count distinct email addresses per tracked file and report the path and the count, never an address. | committed_personal_data.py [--threshold N] [--repo-threshold N] [--include-reserved] [--strict] [--stdin] [--max-bytes… |
 | `scripts/context_pack.py` | bounded context pack for a DIFF review. | context_pack.py [--base REF] [--repo DIR] [--intent FILE\|-] [--cap N] [--max-bytes N] |
 | `scripts/coverage_ledger.py` | completeness check for a machine-report coverage map. | coverage_ledger.py [--domains SPEC] <findings.json> |
 | `scripts/derived_numbers.py` | bind a doc number to the counter that derives it. | python3 derived_numbers.py [--fix] [--selftest] [ROOT] Exit codes: 0 ok (or fixed); 1 drift or bad marker; 2 usage or s… |