v1.7.0 — measured, not asserted

Twenty-one commits since v1.0.0. Almost all of them came from running this
protocol against real codebases and watching where it failed, rather than from
reading it and deciding it could be better.

What changed, in order of how much it mattered

The plugin could not deliver its own fixes. The cache is keyed on version
and the version had never moved — nine content commits were unreachable to
anyone who had already installed. claude plugin update reported success and
changed nothing. Fixed, and CI now fails any payload change without a bump.

The skill did not fire. Measured three times across two models and two
languages: an agent asked to audit a change reviewed it by hand instead, while
the skill sat installed and unused. Its own words afterwards: "I should have
loaded it rather than improvising a review shape." The description now
instructs instead of describing, and closes that escape hatch by name.

Audits reported phases as passed that they could not run. An audit now
declares its evidence sources before selecting phases, and any phase needing a
source it lacks is reported PARTIAL — never passed, with the missing source
named. Verified in the wild: a refused test run and an absent deployed
environment both produced honest PARTIALs rather than quiet passes.

Overlays age, and nothing audited them. The document that makes an audit
specific to a project was the one document in the loop nobody checked. A
deferral whose reason has expired reads exactly like a current decision. Two
independent agents found this class on two unrelated codebases the same day.

The publication gate read only files. Publishing a repository also publishes
commit messages, ref names and authorship, and none of those appear in a diff.
The gate now reads all four surfaces, and checks authorship against an
allowlist rather than a denylist — the identity that leaks is the one nobody
thought to list.

The fail-open suite was itself fail-open. Three of four scan categories had
no test, a case named "untracked file is scanned" did not test untracked files,
and a failed mktemp made the suite report success with eight of nine cases
silently gone. Every check added since is mutation-tested before landing.

Also

Tier and scope are now documented as two separate dials, with worked commands
for each. HOWTO.md gained a fifth mistake. README states plainly that this
is not a Claude Code tool — it is one markdown file that any agent can read.

Install

claude plugin marketplace add sturec5/code-audit-protocol
claude plugin install audit-protocol@code-audit-protocol

Or skip all of that and put AUDIT_PROTOCOL.md in your repository.