[theCodeDrift]

route no longer asks onboarding's forbidden questions.

• route.md (topic v10 → v11): a precondition says that when a question-limiting recipe like onboard sent the agent here, its limits override step 7's local-or-generation choice, the "two destinations both fit" clarifying question, and the failure fallback's confirmation.
• onboard.md (topic v11 → v12): step 8 says none of those are asked during onboarding (step 9 is the only clarifying question) and what to do instead: write the local rule over generation; skip a candidate whose destination is unclear; on a failing local rule, keep it as a Cloud candidate only if it needs runtime evidence; decide destination recipes' confirmations (exclusions, overlapping rule, which linter) from the repo, or skip.

For review:

1. The report has no field for skipped candidates, so onboard names them in one line beside the report summary.
2. The override also covers the destination recipes' questions (create-sg-rule, create-legacy-rule), since the issue's done-when covers every case route leads to.

Tests: assertions in onboard.test.ts and legacy-ladder.test.ts. typecheck, lint, pnpm test (3166 passed) pass.

Note: #674's PR also bumps the onboard topic to v12; whichever merges second goes to v13.

Commits are unsigned: the signing key couldn't be unlocked remotely, and the owner chose to ship unsigned.

Closes #675

[theCodeDrift]

@claude /review

[github-actions]

Claude finished @theCodeDrift's task in 4m 34s —— View job

---

Review complete

Review mode: incremental — read 0 prior review thread(s) before reviewing. .prior-review.json held no review threads, no reviews, and no top-level comments besides the trigger (@claude /review) itself, so this is the first review of this PR — there is nothing previously-raised to carry forward.

Assessment

This is a well-scoped doc fix. I read route.md, onboard.md, and (to answer the two "for review" questions in the PR body) the full text of create-sg-rule.md, create-legacy-rule.md, and create-vale-rule.md, since those are the destination recipes route leads to and the diff doesn't touch them.

On the two questions the author flagged for review:

1. Report has no field for skipped candidates. Confirmed against report.md's facts schema (window, history, rules, legacy, cloud, redaction — no skipped/unwritten field). Naming skipped candidates in a line beside the report summary (not inside the CLI's own printed summary, which report.md step 4 says to relay verbatim) is the right call and doesn't conflict with "do not add, drop, or reword facts," since that constraint is about the CLI's own printed text, not surrounding commentary.

2. Does the override reach the destination recipes (create-sg-rule, create-legacy-rule) too? Functionally, yes, for the paths onboard actually takes — but it's worth being precise about how. route.md's new precondition bullet only scopes itself to "every question below," i.e. the three points inside route.md itself (step 7, the two-destinations question, the failure fallback). It says nothing about the destination recipes. Coverage of those instead comes entirely from onboard.md's own step 8, which independently names each one: create-sg-rule's "confirm exclusions" (step 2) and "ask whether they'd rather improve" an overlapping rule (step 3) are covered by the "exclusions"/"overlapping rule" bullet; create-legacy-rule's "ask the user which tool should own it" (step 1) is covered by "which linter owns it". create-legacy-rule step 2's "ask before adding a [new] dependency" isn't named, but it's moot during onboarding since the pre-existing (unmodified) rule a few lines up already forbids adding a dependency at all. create-vale-rule.md asks the user nothing, so there's nothing to cover there. So every actual confirmation reachable from onboard → route → {create-sg-rule, create-legacy-rule, create-vale-rule} is accounted for — just via two independent lists (route's own 3, onboard's separate enumeration of the destination recipes' 3) rather than one structural guarantee. That's fine for this PR, but it means the completeness depends on onboard.md having manually read through the destination recipes; a different future limiting-recipe author who defers only to route.md's stated precondition would not know to also check create-sg-rule.md/create-legacy-rule.md for their own confirmations, since route.md never says those exist. Worth a documentation note if this pattern is meant to be reused.

[New] One inline finding posted on route.md around the ## Failure fallback section: step 7 and the "two destinations" question each got a local one-line reminder of the override right next to the question; the failure fallback didn't get the same treatment, relying solely on the preconditions bullet far above it. Minor consistency nit, not a functional bug.

Tests: the new assertions in legacy-ladder.test.ts and onboard.test.ts match the actual recipe text verbatim (checked both against the real files, not just the diff). No stray version-manifest file needs updating for the v10→v11 / v11→v12 bumps — recipes.ts builds the topic-version line from a template, it doesn't hardcode per-topic version numbers elsewhere.

No other correctness, security, or performance issues found in the diff.

[theCodeDrift]

Re: @github-actions — "Claude finished @theCodeDrift's task in 4m 34s"…
#686 (comment)

The inline failure-fallback finding is fixed in 1d27400. The note about route.md not pointing a future limiting recipe at the destination recipes' own confirmations is left as is for this PR; it is a reuse-pattern question for the owner, and onboard already covers every confirmation it can reach.

— AI Coding Agent

[theCodeDrift]

Re: @github-actions review summary, point 2: "a different future limiting-recipe author who defers only to route.md's stated precondition would not know to also check create-sg-rule.md/create-legacy-rule.md for their own confirmations"
#686 (comment)

Addressed in bddac10. route.md's "Another recipe may have sent you here" precondition now says the calling recipe's limits also cover the destination recipes, and lists what each one asks:

• create-sg-rule: exclusions, improving an overlapping rule, escalating a failed rule
• create-legacy-rule: which linter owns the rule, adding a new plugin; its per-linter pages ask the same, and Ruff's asks before turning on preview mode
• create-runtime-rule: whether the user wants an account
• create-remote-rule: an overlapping rule, the cases, and confirmation before spending a generation
• create-vale-rule: asks nothing

A new assertion in legacy-ladder.test.ts pins the list. Route stays at topic v11 (already bumped in this PR).

— AI Coding Agent