fix(finding-triage,done-check,gh-body-audit,implement,review-pipeline): close a finding by its disposition

[ultimatile]

Summary

A gate that could not get a finding fixed let it through on a waiver worded in the gate itself, and the two gates that did this disagreed on who may waive: skills/done-check/SKILL.md let a concern through when "explicitly waived by the user with reasoning", and skills/gh-body-audit/SKILL.md when it had "an inline waiver with a one-line justification", which names nobody. The disposition catalogue in skills/finding-triage/SKILL.md had no entry for a finding whose validity stays unknown, or whose fix is not a local edit, once the user stops work on it.

The escape is now a disposition. The catalogue gains abandoned and a definition of a closed finding, and both gates take their closing terms from that definition.

Closes #173

Changes

skills/finding-triage/SKILL.md

• abandoned is a disposition: the user directs that no further work be done on the finding in this run, and either its validity is not known or it is valid and its fix is not a local edit. The decision is the user's alone, and a follow-up is kept where the user directs one.
• A finding is closed when it holds false-positive, defer, wontfix or abandoned and the run has done what that entry directs.
• What an entry tells the run to do binds only while the finding holds that entry, so the instruction in uncertain-validity to keep investigating, and the one in opens-a-question to re-enter research, stop binding a finding the user has taken to abandoned.
• invariant-premise-check states its two outcomes as what follows once the premise is verified, not as the entry's only exits.
• wontfix contrasts a reason to postpone with "a reason to drop the fix", which leaves the word "abandon" to the new slug.
• A pre-existing instance of the same flaw does not license abandoned, as it does not license the other three closing entries.

skills/done-check/SKILL.md

• Step 5 does not proceed "until each concern is resolved or closed, as finding-triage defines closed".
• Step 4 says only that step 5 binds cross-cutting concerns as it binds a ⚠ row; step 5 alone states the terms.

skills/gh-body-audit/SKILL.md

• Step 4 iterates "until clean, or each remaining ⚠ is closed, as finding-triage defines closed; a closed ⚠ does not block".

skills/implement/SKILL.md, skills/review-pipeline/SKILL.md

• Each tells its caller to wait for done-check's step 5 gate and says nothing further about what closes a concern there.

.claude-plugin/marketplace.json

• metadata.version is 2026.10.12.

Impact

Three behaviors change for a run that reaches one of these gates.

• A deferral at done-check needs what the defer entry asks for, an issue or a note kept on the user's direction. The gate used to ask for a follow-up issue filed with the user's approval.
• A ⚠ at gh-body-audit that is valid, or whose validity is unsettled, passes unfixed only on the user's direction. The old wording, "an inline waiver with a one-line justification", named no actor.
• A concern can no longer pass either gate while work on it continues in the same run. One the user wants worked on later is taken to abandoned with a follow-up kept.

skills/file-issue/SKILL.md, skills/file-pullreq/SKILL.md and skills/research/SKILL.md block on gh-body-audit step 4's terms and state none of their own, so they follow without an edit. skills/review-telemetry/SKILL.md takes its disposition values from the catalogue by reference, and skills/copilot-review/SKILL.md has replies name whichever slug a finding holds; neither is edited.

Verification

• pre-commit run --all-files on the branch: ruff check and ruff format report Passed. mdformat reports Failed because it rewrites CLAUDE.md, which this change does not touch and which it rewrites the same way on main.
• rg -n -i 'waiv' skills README.md CLAUDE.md returns four files: the repeat step of skills/codex-review/SKILL.md, and three whose object is not a finding (skills/code-review-gate/SKILL.md waives a missing review, skills/review-pipeline/SKILL.md refers to that waiver, skills/review-telemetry/SKILL.md uses the word of a telemetry entry).
• Three reading checks, each put to a reader given only the named files from the branch:
  • skills/finding-triage/SKILL.md alone. A finding whose validity rests on an external system the run cannot execute, with the user directing no more work on it in this run, takes abandoned with no second candidate. With the user declining only that verification, the reader gave keeping the entry the finding held as the more literal reading, and noted that no sentence supports reading that answer as abandoned.
  • That file and skills/done-check/SKILL.md. Step 5 lets the run proceed past a concern closed as wontfix and past a row whose auditor quoted no rule clause, closed as abandoned, and not past a concern at uncertain-validity with no direction from the user.
  • That file and skills/gh-body-audit/SKILL.md. The run may not, on its own judgment, proceed past a ⚠ it considers valid.

Notes

• skills/codex-review/SKILL.md's repeat step keeps its own waiver. That sentence is also the only statement that a user's decision holds across the loop's iterations, and a replacement needs a criterion for when a finding in a later iteration is the same finding. Reviewer loop exits pass a finding whose disposition is unsettled #169 covers that loop.
• The loops in skills/codex-review/SKILL.md and skills/review-pipeline/SKILL.md that continue on a count of actionable findings still pass a finding that is not closed. Reviewer loop exits pass a finding whose disposition is unsettled #169.
• done-check step 5 says a deferred row "stays ⚠ with the deferral recorded in its Note" and says nothing for a row closed as wontfix, abandoned or false-positive. done-check: step 5 states a deferred row's verdict but not a waived row's #176.
• Step 4 of done-check and of gh-body-audit still triage into actionable and false-positive only, and done-check step 5 still opens "If any ⚠ remains, fix before proceeding". done-check, gh-body-audit: concern triage names two of seven finding-triage dispositions #166.
• Nothing says where the reasoning wontfix and abandoned require is recorded, and gh-body-audit no longer says where a closed ⚠'s disposition is recorded. finding-triage: wontfix's required reasoning has no receiving surface #177.
• The restraint "a finding at critical does not ordinarily warrant wontfix" does not mention abandoned. finding-triage: severity restrains wontfix but no tier need exist #180.

[Copilot]

🟢 Approval recommended

The disposition model and its gate references are consistent and appropriately centralized.

0 open findings

What changed in this PR

Centralizes finding closure in finding-triage and updates consuming gates to use that shared definition.

Changes:

• Adds the abandoned disposition and defines closed findings.
• Aligns audit and implementation gates with the centralized closure contract.
• Bumps the plugin version to 2026.10.12.

File	Description
skills/​finding-triage/​SKILL.md	Defines abandonment and finding closure.
skills/​done-check/​SKILL.md	Uses centralized closure rules.
skills/​gh-body-audit/​SKILL.md	Replaces inline waivers with defined closure.
skills/​implement/​SKILL.md	Removes duplicated closure guidance.
skills/​review-pipeline/​SKILL.md	Delegates closure semantics to done-check.
.claude-plugin/​marketplace.json	Bumps the plugin version.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.