artifact-audit: 2026-08-25 pass — 8 editorial fixes, 9 hard-stop-adjacent flags

[espi]

Artifact drift

Monthly artifact-audit pass (2026-08-25). Four parallel agents audited skills / templates / guardrails / runbooks+docs against knowledge/ (source of truth, read-only) and primary docs read this pass (cli-reference, goal, scheduled-tasks, routines, claude-code-on-the-web — load-bearing facts independently spot-verified by the orchestrator). No prior artifact-audit PR was open. Open update-knowledge PR #17 touches only knowledge/ files, which this audit never edits — no conflict. Clean (no drift): guardrails/budget.env, the self-edit gate (.github/workflows/self-edit-guard.yml + self-edit-guard.py — fully consistent with CLAUDE.md and the SKILL.md sentinels), .claude/skills/update-knowledge/SKILL.md, README.md, CLAUDE.md, runbooks/babysit-prs.md, templates/ralph/PROMPT.md, ui-audit PREFLIGHT/PAGES/FINDINGS.

Fixed (editorial, High-confidence, no control changed)

File	What was stale	Evidence
templates/ralph/run.sh	cost-meter comment pointed at nonexistent claude cost	cli-reference read this pass: no such subcommand; /cost is in-session only — High
templates/goal/recipes.md	/goal clear alias list missing none; /clear also removes the goal	goal docs read this pass — High
templates/loop/loop.md	/loop 15m /review 1234	/review is an alias of /code-review since v2.1.223 (KB primer §4, High) — canonical name used
templates/ui-audit/PROMPT.md	referenced RUN.md twice — file doesn't exist anywhere in the repo; hard-stop caps were reachable only through the dead pointer	filesystem check — High; caps live in runbooks/ui-audit-overnight.md's launch invocation
runbooks/overnight-build.md	--remote presented as the cloud flag	--cloud is current; "The older --remote spelling still works as a deprecated alias" (web docs read this pass) — High
runbooks/first-loop.md + guardrails/checklist.md	"Ctrl+C for /goal" as the stop command	goal docs read this pass: interactive stop is /goal clear; Ctrl+C stops a non-interactive goal — High. (Checklist edit is in guardrails/ — flagging that location for your attention; it corrects a kill-switch instruction, doesn't touch the three hard stops or budget.env.)
runbooks/staying-current.md	"Schedule → Monthly" preset for this audit's own Routine	routines docs read this pass: presets are hourly/daily/weekdays/weekly; custom intervals = closest preset + /schedule update cron — High

Flagged for you (hard-stop / control-adjacent — not edited)

1. Removed CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION still presented as a live cap in 3 artifacts (high) — the var's default-200 cap was removed in v2.1.224 and it is gone from the docs entirely (primer §4, re-verified 2026-08-17; you already approved the same correction for update-knowledge/SKILL.md in PR knowledge: Aug 10–17 pass — CC v2.1.227–233, Practical Loop Engineering, Agent Plugins GA, roborev v0.65.0 #16 / a829697). Still cited as a working control in:
   • .claude/skills/artifact-audit/SKILL.md:92–93 — claims it "bounds the ~4-agent fan-out" (this skill's own iteration hard stop);
   • guardrails/README.md:40–46 — lists the default-200 per-session cap as current and says "set them lower explicitly";
   • runbooks/staying-current.md:79, 88–90, 143 — recommends =12 as both Routines' fan-out hard cap (that env var now does nothing).
     Suggested replacement everywhere: the surviving native backstops CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS (default 20, concurrency) and CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH (default 3, depth — flipped twice in one week, re-verify), with an explicit note that no native cap on total lifetime spawns remains.
2. templates/ralph/run.sh budget hard stop is a silent no-op by default (high) — cost_so_far() returns 0 unless the user wires a meter, so the ceiling check can never fire; the header still says "ALL THREE hard stops baked in". Options: add per-call --max-budget-usd to AGENT_CMD (print-mode; subagent spend counts; total exposure = per-call cap × MAX_ITERATIONS), and/or refuse to start (or warn loudly) when the meter is unwired — mirroring SUCCESS_CHECK's fail-closed default.
3. templates/goal/recipes.md carries none of the three hard stops (high) — no recipe has a bound; the goal docs' own pattern is a turn clause ("…or stop after 20 turns"), and the headless recipe can take --max-budget-usd / --max-turns (both print-mode, verified this pass). Suggested: a "Bound it" rule + capped headless example.
4. runbooks/staying-current.md:78 describes the branch-push floor via a toggle that doesn't exist (high) — current routines docs have no "Allow unrestricted branch pushes" option. Real mechanism: claude/-prefixed pushes always accepted; other branches rejected only if protected / carry someone else's commits / have someone else's open PR. The "human merges every PR" floor is only real if main has GitHub branch protection — recommend enabling it and rewording the cell.
5. guardrails/README.md gateway/ceiling section behind the KB (medium) — still recommends Helicone (in maintenance mode since the Mintlify acquisition — KB says don't build new guardrails on it); missing Databricks Unity AI Gateway (GA Aug 4, enforced proactive budgets); missing --max-budget-usd halting background subagents (v2.1.217) and in-product gateway spend-limit surfacing (v2.1.225).
6. guardrails/checklist.md missing a Routines item (medium) — Routines run with no permission prompts (primer §4, High); the checklist steers laptop-closed runs to Routines without saying so. Suggested checkbox: scope the environment's network access, repos, and connectors tightly.
7. .claude/skills/new-loop/SKILL.md:58–59 (medium) — budget step offers "or remind the user of the session budget" — an alert, not a ceiling (contradicts CLAUDE.md's non-negotiable). Suggested: name --max-budget-usd (v2.1.217+) / SDK max_budget_usd for the /goal+/loop patterns instead of the reminder.
8. .claude/skills/loop-guardrails/SKILL.md:32–35 (medium) — hard stop knowledge: 2026-06-22 update pass (7-day delta from Jun 15) #3's mechanism list predates --max-budget-usd enforcement; an agent auditing an in-session loop today would miss the canonical native fix. Suggested: add the flag (headless) + gateway-enforced budget options.
9. templates/loop/loop.md (medium) — no budget note, and /loop genuinely has no native $ ceiling (--max-budget-usd is print-mode only, verified). Suggested honest note: bounds are the 7-day expiry + session scope; watch /usage; for enforced budgets run headless via ralph.

Notes (no action taken)

• Whether /code-review remains invocable from a scheduled /loop fire is Medium-confidence — verify in a live session before relying on loop.md's third starter invocation.
• runbooks/babysit-prs.md optional addition: docs now warn auto-fix replies post under your GitHub account and can trip comment-triggered automation (Atlantis, Terraform Cloud).
• KB primer §4 itself still says --remote — a candidate for the next update-knowledge pass (this audit never edits knowledge/).
• Pending PR knowledge: Aug 17–24 pass — /goal check-in backoff, Skills API GA, MCP roadmap, Osmani "Human judgment relocates", roborev v0.66.0, VB Pulse enforcement-gap survey #17 facts (e.g. --max-budget-usd now includes the 1.1× data-residency premium, v2.1.239) contradict nothing here; revisit guardrails wording after it merges.

The ui-audit overnight runbook's alert-only budget on its recommended interactive path is a documented trade-off (it already concedes this and points at run.sh) — it becomes fixable if you take flag 2.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ERMTeuPfKdgfgMTCVgdRpK

---

Generated by Claude Code