apply one-fix audit gaps in plan-task's fix loop instead of asking

[bborbe]

What

/vault-cli:plan-task's step-6 fix loop put every auditor finding to the operator as an AskUserQuestion, including gaps whose only defensible outcome was the one already written down. This adds a classification step: a gap carrying a stated fix and no genuine alternative is applied and reported; only a real fork is asked.

Why

Recurring operator gate. Measured 2026-10-17 over a 22-hour window: 338 plan-task runs across 113 sessions, 146 of them (43%) containing at least one AskUserQuestion. Three workers hit the same pattern that day; in two of them the operator picked the recommended option every time, and the goal's manager independently gave the same answers.

Changes

• commands/plan-task.md § 6 — classify-then-apply rule, plus the distinguishing test: write the second answer down before you ask. Cannot name an alternative you would defend → one-fix gap, apply it. Can name two → fork, ask. A gap whose options would read "(Recommended) do X · 2. do nothing" is named as a one-fix gap wearing a menu — "do nothing" is a refusal to decide, not an alternative.
• commands/plan-task.md § Notes — the "Conversational on purpose" note rewritten. It claimed every change came from an explicit answer, which the new rule contradicts; it now distinguishes substance (always the owner's) from ratification (no longer asked).
• Consistency sweep in the same file. § 5 lists nine hard checks while the prose said "five" in five places — corrected, with § 5 declared the source of truth for the count. Two checks whose sibling sentences lacked a step-6 classification pointer (subtask-goal alignment, empirical premises) now carry one. The always-ask set is stated as three: unevidenced premise, misread operator quote, scope change.

What is unchanged

• --non-interactive — the NO-ASK short-circuit still edits nothing. The new rule is explicitly scoped to ASK mode, and says so in its own first sentence.
• AskUserQuestion stays in allowed-tools — step 1 ambiguity, step 3 todo approval, the template-verdict differs branch, and step 6 real forks all still ask.
• The ≥ 8 gate and the loop's exit condition — applied fixes re-enter the same Score: X → Y cycle. The gate does not relax because nobody was asked.
• The audit trail — every applied fix is printed; any that changed a criterion's claim is recorded in the task's # Progress.

Checks

• make precommit — PASS (exit 0): 8 Go packages ok, 131 script tests passed / 0 failed, golangci-lint v2.14.0 0 issues, go vet clean, osv-scanner 0 vulnerabilities, trivy 0 vulnerabilities / 0 secrets, CHANGELOG structure OK.
• Slash-command audit — 5/10 FAIL. One Critical (the gate-count inconsistency) is fixed above. The other (size: 271 lines against the guide's ~100-line agent-cmd/command-thin MUST) is pre-existing — the file was 258 lines before this change, +13 net — and its prescribed repair (extract § 5 into vault-cli:task-auditor) is outside this change's scope and adjacent to a separate open concern.

Outstanding

Isolated-env end-to-end verification ([[Verify Claude Code Marketplace Plugin Before Merge]]) has not been run. The behavioural checks require the released plugin loaded in a fresh session, so they are scheduled after merge, release and claude plugin update.

[ben-s-pull-request-reviewer]

The worktree was already cleaned up. Here is the final verdict:

{
  "verdict": "approve",
  "summary": "PR #300 applies the `agent-cmd/no-user-prompts` rule to plan-task's own fix loop, reducing unnecessary operator interruptions by auto-applying one-fix gaps. Two judgment rules were applicable — `agent-cmd/no-user-prompts` (the rule being applied) and `changelog/conventional-prefix-required` — and both are satisfied. The changed command files are well-specified with clear enumeration of the three always-ask gap types and a concrete enforcement mechanism (write the second answer down). No violations found.",
  "comments": [],
  "concerns_addressed": [
    {
      "concern": "correctness: classification test \"is there a second answer I would defend?\" is subjective — an agent could misclassify a real fork as a one-fix gap",
      "disposition": "not-an-issue",
      "detail": "The diff adds a concrete enforcement mechanism: 'write the second answer down before you ask.' The agent must explicitly state the alternative it would have offered; cannot name one → one-fix gap, apply it. This converts the subjective test into a documented output requirement."
    },
    {
      "concern": "correctness: Three gap types \"always ask\" must be correctly identified at runtime or the one-fix auto-apply logic will skip them incorrectly",
      "disposition": "not-an-issue",
      "detail": "The three always-ask cases are explicitly enumerated in the diff: unevidenced premise (fix is a read only the operator can vouch for), misread operator quote (operator's own words), and scope change. Each is described with sufficient specificity to identify at runtime."
    },
    {
      "concern": "correctness: \"do nothing\" is classified as a refusal to decide, not an alternative — but an operator explicitly choosing option 1 reads identically to auto-application",
      "disposition": "not-an-issue",
      "detail": "The diff addresses this directly: a gap whose options would read '(Recommended) do X · 2. do nothing' is named as 'a one-fix gap wearing a menu.' The rationale is that 'do nothing' is a refusal to decide, not a defensible alternative, and an operator who always picks option 1 is signaling the menu should not have been built. This classification is sound."
    },
    {
      "concern": "correctness: Notes section \"Conversational on purpose\" updated to say plan-task never silently rewrites, but auto-apply is a form of silent rewrite in the sense no explicit approval is obtained",
      "disposition": "not-an-issue",
      "detail": "The diff explicitly revises the Notes section to state 'about substance, not about ratification.' Every applied fix is printed in the run's output, and any that changed a criterion's claim is recorded in '# Progress'. The operator can see and reverse what was decided on their behalf — silent rewrite is avoided by disclosure, not by avoiding the decision."
    },
    {
      "concern": "correctness: non-interactive flag behavior unchanged, but classification logic must be robust to adversarial or ambiguous gap descriptions",
      "disposition": "not-an-issue",
      "detail": "Under --non-interactive, plan-task short-circuits: it reports gaps and stops, never entering the fix loop or applying anything. The classification logic only runs in interactive mode. No adversarial input can reach it in non-interactive execution."
    }
  ]
}