NOT RELEASED. No version bump - versions stay at 2.0.0 across all 9 plugins and
marketplace.json, because bumping is the release action and this ships only after
it has been tested. On a branch for the same reason.
WHY A SKILL AND NOT A FOURTH COMMAND. /security-audit-static is already mature -
sink analysis, self-refutation with attacker/victim rules, OWASP backstop, fan-out.
Rebuilding that inside something new would duplicate it. The hole in this plugin is
CORRECTNESS: there is no bug-finding review at all. So this is one skill with three
independently activated dimensions that defers to the existing command for security
and points at intended-vs-implemented for the doc-vs-code axis.
THE ANCHOR IS THE AGREEMENT, NOT THE FILE. The defects reviewers miss are rarely
visible inside one file - they are disagreements between two participants that each
read sensibly alone. Engine: map a flow, identify an obligation, inspect EVERY
participant, construct a violating execution, trace the consequence, refute, report.
Two lenses get a forced probe rather than a checklist mention: authority
reconciliation (a requested value is not an applied value) and identity correlation
(is the key unique, stable and live under overlap and reuse).
Refutation discipline is deliberately stricter than the security command's: a
correctness defect can harm only the person who triggered it and still be serious,
so the attacker/victim test does not transfer, and 'keep unless disproved' is too
permissive. Keep / Drop / Unresolved, with unresolved kept out of the findings list.
Parallelism fans out over complete flows, never over files - partitioning by file is
exactly the split that hides cross-boundary defects. Overlapping reads are allowed
and encouraged.
Coverage reports work performed in four states; zero findings is not 'not covered'.
Co-designed with GPT-6 Astra (Codex CLI). Contains no project-specific content: no
repo names, no paths, no bug identifiers, no defect text - verified by scan.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G42vsxSKL7je39AsHZ5aJm
