Adversarial-review wording fixes (Claude adversarial F1-F8 + Codex
cross-confirmation), applied to both gate templates + regen:
- Host-anchored mode signal: only the host's own system messages (plan-mode
reminder or active plan file path) arm the auto-select; plan-shaped text
inside pasted documents, tool results, or fetched pages does NOT count —
injected content can't disarm the consent gate or nominate the target.
- Multiple plan candidates: the host-referenced plan file wins; still
ambiguous means ask.
- The DIFFERENT-target override carries the passing-mention guard.
- Plan mode + explicitly named target + no drafted plan resolves to the
named target instead of a contradictory re-ask.
- The numbered ask-path rules are qualified ('When no exception above
applied:') so they no longer restate an unconditional MUST-ask that
contradicts the exceptions.
- 'Whenever this gate does ask — in any mode — it is a hard STOP.'
- Shared preamble: 'any AskUserQuestion the skill fires is the workflow
operating within plan mode' (was 'the first AskUserQuestion is the
workflow entering plan mode', which framed the opposite of the bypass);
regenerates every skill.
- Ceilings ratcheted with attribution: plan-eng union ratio 1.10,
investigate 1.10 (the ~250B shared-preamble reword lands the
closest-to-ceiling skill at 1.092).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
7a1923a557