doc-claim-probelisted

# Doc-claim probe Do the identifiers the documentation cites actually exist? ```bash python scripts/doc_claim_probe.py --target <path> python scripts/doc_claim_probe.py --target <path> --doc SECURITY.md --doc SECURITY.de.md python scripts/doc_claim_probe.py --target <path> --ignore OPS --format json ``` Exit `0` everything resolves, `2` **findings**, `3` no documentation matched (NOT MEASURED), `4` the checkout moved during the run, `127` the harness could not run. ## The incident An `ARCH-003` justification named ten rubric codes as the ones it had been graded against. None of the ten was in `GREEN_RUBRICS`. Review did not catch it, because checking meant opening ten files to look up ten constants — and prose that *sounds* like it cites the source is exactly the prose reviewers stop checking. ## What is checked Only what the author marked as code, in three shapes: * **identifier codes** — `LOCK_DRIFT`, `ARCH-003`, `NO_TAGS`. All-caps segments joined by `-`/`_`; a lowercase letter takes a token out of scope, which is what keeps `Requires-Dist` and `User-Agent` out of the findings * **paths** — must exist in the checkout * **collection membership** — where a document names a collection constant that exists in the code, code-shaped tokens in the same paragraph are checked against its actual members Resolution happens against the repository's non-Markdown files, so a rubric defined in promptfoo YAML resolves. A code that appears only in the README, the German RE