refine: propose adjustments to 1 rule(s)

[claude]

⚠️ Human review required. This PR mutates NLPM's own rulebook.
Evaluate each proposed change against the evidence. Merge the
sound ones; close the rest. Do not merge without reading
every rule section.

---

R19 — noisy

Current metrics: hits=4, merged/contributed=0/0, self-FP=3, maintainer-rejected=0, downstream-suppressions=0

Evidence:

• Maintainer quotes: (none)
• Rule-gap signals (3 identical reports):
  • The no-empty-input-handling rule should not penalise commands whose body is a single unconditional message.
• Downstream suppressions: (none)

Proposed change: Added a "Does not apply to" paragraph after the R19 principle clarifying that standalone commands — including commands whose body is a single unconditional message — are not shared partials and do not require user-invocable: false. The rule's scope is restricted to fragments designed to be imported by other commands. This narrows the checker trigger so it cannot misidentify a simple, self-contained command as a partial lacking the flag. 75% of R19's validated hits (3/4) were self-false-positives attributable to this pattern.

Note: The rule-gap strings describe this as "the no-empty-input-handling rule," but the target rule_id maps to R19 (user-invocable: false). This may reflect a scoring-system vs. rules-catalog ID mismatch. The exception added is semantically sound for R19 regardless: any artifact simple enough to look like a partial but actually functioning as a command should be excluded. If the intent was R15 (Handle empty input), the human reviewer should redirect accordingly.

---

Proposals not found in skills/nlpm/rules/SKILL.md

The following rule IDs from the input do not appear in skills/nlpm/rules/SKILL.md (they likely live in skills/nlpm/security/SKILL.md or another skill file, which is out of scope for this workflow). No edits were made; a separate refinement run scoped to the relevant file is needed.

• CC-stale-count — disputed (context_missed ×4); hits=48, merged/contributed=1/7. Maintainer context: findings were superseded by a consolidated structural fix (scripts/sync-rule-bookkeeping.js COUNT_FILES extension) rather than being wrong per se.
• SEC-unpinned-semver — noisy (intentional_pattern ×3, context_missed ×2); hits=110, merged/contributed=1/18. Maintainer: "this is intentional" on fix(deps): pin production dependencies to exact versions krodak/clickup-cli#63. Needs an Exception paragraph for deliberately unpinned semver ranges.
• SEC-curl-pipe-sh — noisy (high self_fp=8); hits=39. Rule-gaps: should exclude curl|sh inside echo/printf strings, test fixtures, and inert heredoc/string literals printed to stdout vs. executed code.
• SEC-hardcoded-api-key — noisy (self_fp=3); hits=3. Rule-gaps: should exempt public client-side analytics keys (PostHog, Segment, Mixpanel write keys) that are public by design from the hardcoded-credentials pattern.

Proposals without usable evidence

• R31 — disputed; all downstream suppressions are threshold_adjustment type with "(no reason given)"; no maintainer quotes; no rule-gap signals. Skipped per the "no usable evidence" policy.

[github-actions]

🔍 Preview deploy

Preview URL: https://nlpm.com/_pr/417/

Built from 3131056 at 2026-06-22T02:42:43.029Z.

It may take 30–60s for the GitHub Pages CDN to serve the new content. The preview is removed automatically when the PR closes.