0.2.6 — what the first live run found

The first release shaped by running the plugin against a real Google Ads account rather than against fixtures.

v0.2.5 was proven on files: 21 mocked eval cases, a tools-only ablation, structure tests, both validators. None of that had touched a live account from the published build. On 2026-10-07 it did — seven surfaces, driven by blind agents that had not seen the test plan so they could not grade their own answers. Every run was read-only; 0 writes in all seven transcripts.

Eight candidate findings went through first-hand verification against primary sources, and the two highest-severity ones through two adversarial passes each. Three survived as plugin defects.

Fixed

adcopilot-seo let the rows become a verdict. Asked where the site ranks for its own name, the reply opened "Wherever people search '…', Google shows you at or near the top" and closed "Your name already wins where people search for it." It had followed the skill exactly — refused to read the average position out as a rank, narrowed by country — and its own middle section explained why the headline was unsafe: Search Console has a row only for a search where the site was shown, so the rows cannot say where people searched and did not see you. The skill's rules were scoped to the number; nothing covered the verdict drawn from it. One sentence in "What breaks" now does.

/adcopilot:audit answered from the saved profile instead of a read. It stated a budget, a split and a lost-impression share from saved decisions, and was wrong on all three — projecting a month from a split that had been raised days earlier, and calling a campaign budget-limited on a thirty-day average that spanned the change. The rule that prevents this was written into adcopilot-review and nowhere else, and /adcopilot:audit loads no skill, so nothing stood between a stale note and the reply. The rule is now on this path, with the window clause the review skill never needed: a thirty-day share describes those thirty days' budgets, not today's.

The auditor never said where the yes happens. Its definition states the constraint, but as a rule about its own behaviour — the report section never asked it to tell the reader. A priced proposal with an undo beside it reads as a change already made. It also gains a read-only change_history, so a change can be attributed instead of listed as unknown.

And a guard that was claimed and absent. Nothing held the auditor's tool list to reads, although the whole safety case for an unattended subagent rests on it. The new AuditorToolList bans write verbs rather than enumerating reads, so a read added later passes and a write fails however the server names it — verified by injecting write tools and Bash and watching the guards fire.

What the gate measured, and what it did not

Validators pass; 54 structure tests. The three cases whose inputs changed were re-run under claudeVersion 2.1.292: seo-discovered-is-not-a-verdict 1.000, seo-two-numbers-that-lie 0.926, audit-stale-tools 0.905 — 3/3 above the 0.8 threshold, overall 0.944. The seo ablation was re-run on both arms under the same build: +0.250 and +0.148, both cases gated, skill ok.

The other eighteen cases are carried over from the 2.1.289 run against byte-identical text. There is no whole-suite run under 2.1.292. Stated plainly because this project's own rule is that scores compare only within a build.

Release checklist step 6 — the scheduled run's Run now — was not run for this version. It needs an interactive click. Nothing in this release touches the daily or scheduled path.

A finding about the harness, not the plugin

seo-two-numbers-that-lie scored 0.852 on the tools-only arm under 2.1.289 — above the line, so a regression guard, excluded from the delta, which is what left adcopilot-seo with no gated case and threw 0.2.5's first ablation FAIL. Under 2.1.292 the same case text with the same judge scores 0.778, so it is now a gated case and the skill has two.

Nothing in the case or the skill changed between those numbers. A case's class is a property of the build as much as of the case, and a skill can pass or fail the gate on a client upgrade alone. Never carry a class verdict across builds.

Known and tracked

#10 relaying a conditional connector finding as an instruction · #11 the price rule says three different things (README vs skill vs an eval grader's name) · #12 plugin.json's "Needs approval" names a claude.ai control Claude Code has no equivalent for · #13 eval coverage gaps, including that the auditor subagent has no case at all · #14 claude mcp list in setup

Three eval cases are sketched in #13 and deliberately not added in this release: a new case needs a 5-run baseline to know whether it gates or is only a regression guard, and an unbaselined case can silently fail a skill's gate.