Conciseness

The body is dense and almost every line carries non-obvious domain knowledge (e.g. 'a package runner can resolve the name to an unrelated package that prints a greeting and exits 0', 'a wrapper may rewrite diff output'), assuming Claude's competence rather than teaching basics. It falls just short of the 5 anchor because several checklist items are run-on compound sentences with stacked parentheticals (e.g. the range-guard item) and a few points repeat between step 0, the 'Highest yield first' paragraph, and the checklist — minor trimming opportunities, matching the 4 anchor.

Actionability

Guidance is copy-paste executable throughout: concrete commands ('git log origin/<default>..HEAD', 'git config --show-origin --get-all core.hooksPath', 'grep -rnE '\''git.*(init|commit)\'' tests/'', 'cmp'), a severity table with examples, defined status vocabulary ('proven', 'unproven', 'n/a', 'not verified'), a report form, and a bundled worked example (secret-scan.sh). For an instruction-only skill this fully matches the 5 anchor — specific, executable guidance covering the common cases.

Workflow Clarity

Steps 0–4 are clearly sequenced (Orientation → Inventory → Gap analysis → Tighten → Evidence report) with explicit validation checkpoints ('After each push, fetch the CI log for that exact commit and quote the evidence line', re-check staleness 'right before fixing'), feedback loops ('Run the same hunt over your own patch before reporting: a fix that adds 2>/dev/null || echo 1 has only moved the gap'), a full checklist, and a definition of done. This matches the 5 anchor exactly; the destructive-operation cap does not apply because validation is pervasive.

Progressive Disclosure

The SKILL.md holds the core method (workflow, checklist, report form) and delegates per-topic depth to ten references, each well-signaled with a one-phrase content description ('Evidence per tool class and a loop to pull it from every step log: log-evidence.md'). All ten referenced files exist in references/, references are exactly one level deep with no orphans or broken links, matching the 5 anchor.

Specificity

The description lists multiple concrete, specific actions — 'checks that every gate really verifies something (non-zero counts in the log, a must-fail proof), covers every file, runs at a strict level, and is pinned and ratcheted' — comprehensively covering the audit/tighten domain. It matches the top anchor ('lists multiple specific concrete actions; comprehensive coverage') and exceeds the 4 anchor, which expects minor coverage gaps; none are evident.

Completeness

Both 'what' and 'when' are explicit: multiple 'Use when…' clauses with concrete trigger scenarios (a gate 'logs 0 items', 'has no self-test or must-fail proof', 'green for a long time without ever catching anything'), a clear what-clause, and an explicit negative boundary ('Not for setting up a new pipeline or closing local/CI drift — that is ci-local-parity'). This clearly matches the 5 anchor; the 4 anchor's caveat ('when' could be more explicit) does not apply.

Trigger Term Quality

Natural trigger phrases are comprehensive: 'auditing, reviewing or tightening an existing CI pipeline', 'secret scan', 'make CI "stricter", "more reliable" or "trustworthy"', plus platform names (Woodpecker, GitHub Actions, GitLab CI) acting like file-extension equivalents. Coverage includes synonyms users would actually say, matching the 5 anchor rather than the 4 anchor ('a few natural terms missing').

Distinctiveness Conflict Risk

It carves a clear niche (verifying that existing CI gates really check something) and explicitly de-conflicts with the nearest neighbor skill ('that is ci-local-parity'), with distinct triggers like must-fail proofs and vacuous scan counts. Minimal conflict risk, matching the 5 anchor; the 4 anchor's 'minor overlap risk' is addressed by the explicit boundary clause.