ccsn-find-simplifications

Finding CC Safety Net Simplifications

This skill turns a broad "find things to simplify" request into evidence-backed candidates that remove or collapse existing surface area. It is guidance, not a checklist: follow the code, keep judgment active, and prefer a few well-proven candidates over many thin ones.

Over-engineering is this repo's documented dominant failure mode (see Scope Discipline in AGENTS.md), so simplification proposals have a tailwind — but the same discipline applies to the proposals themselves: each one must name the concrete cost the current code carries, not just "this looks complex."

Start With Repo Context

• Read AGENTS.md (Scope Discipline, Style Guide, Knip rules), REVIEW.md (threat model and review boundary), and SECURITY.md (the standard/strict/paranoid mode contract).
• Read docs/residual-risk.md before judging anything in src/parser, src/analyzer, or src/rules. Adjudicated bypass families are settled decisions; fixtures pinning them are load-bearing even when nothing else references them.
• The mode contract is the repo's central seam: standard mode blocks recognizable accidental destruction and is explicitly not bypass-proof; strict/paranoid fail closed. Complexity that exists only to chase crafted adversarial shapes in standard mode exceeds the documented contract — REVIEW.md forbids adding it, which makes any existing instance a prime simplification candidate. Conversely, fail-closed machinery in strict/paranoid is contract, not bloat.

Treat As Intentional By Default

• The per-tool integrations in src/integrations (Claude Code, OpenCode, Codex, Copilot CLI, Cursor, Amp, Pi, Kimi Code, Gemini CLI, OpenClaw, Antigravity, Hermes, …). Each exists because a real host tool needs it; propose deleting one only if the user says the tool is dropped. Removing an unused hook or method inside one is still fair game.
• The residual-risk registry pair (docs/residual-risk-registry.json + docs/residual-risk.md) and the strict/paranoid fail-closed fixtures that back its families.
• The single-runtime-dependency posture (zod only). Hand-rolled shell parsing is the product, not a hand-rolling smell — this is a security hook with a deliberately minimal supply chain. Do not propose swapping the parser or a guard for an npm package; a new dependency is a maintainer decision to propose separately, never a "low effort" cleanup.
• Adversarial-looking strings in tests are analyzer input data, never executed. Do not propose removing them as dangerous or redundant without checking which contract or residual-risk family they pin.