Documentation sources-of-truth table omits CONTRIBUTING.md, SECURITY.md, and the PR template

[dmccoystephenson]

What's wrong

CLAUDE.md's "Documentation sources of truth" table lists three files:

File	What to verify
create-dev-loop.md	Steps, template placeholders, and substitution table are internally consistent
README.md	Described behavior matches what create-dev-loop.md actually does
RESEARCH.md	Empirical findings are accurate, citations resolve, confidence levels reflect the current state of the evidence

Since that table was written, the repo gained four more contributor-facing docs that make verifiable claims about how the project works: CONTRIBUTING.md (#63), SECURITY.md (#68), .github/PULL_REQUEST_TEMPLATE.md and .github/ISSUE_TEMPLATE/* (#64). None of them is in the table.

Why it matters — this already caused drift

The generated dev-loop skill's Phase 7 (documentation accuracy check) and Phase 2 Stage A (repo-wide sweep) both iterate the table. A doc that isn't in the table is never checked by either, and scripts/check_docs.py only validates placeholder rows, README/Step 1:1, and relative links — not prose accuracy.

Concrete instance: PR #65 added CI, and PR #70 correctly updated CONTRIBUTING.md's validation step to say CI runs scripts/check_docs.py and catches doc drift but not behavior. .github/PULL_REQUEST_TEMPLATE.md carried the identical pre-CI framing ("There is no automated test suite for this repo") and was missed, because nothing in the loop looks at it. It stayed stale for seven merged PRs until the Stage A sweep in PR #72 caught it by hand.

CONTRIBUTING.md is the higher risk of the two going forward: it restates four of CLAUDE.md's conventions verbatim (phase-number stability, the placeholder/substitution-table rule, README 1:1, the RESEARCH.md update rule) and duplicates CLAUDE.md's five-item validation checklist. Any change to those rules has to land in three places, and only two of them are currently checked.

Suggested fix

Add rows to CLAUDE.md's table, roughly:

File	What to verify
CONTRIBUTING.md	Restated conventions and the validation checklist still match CLAUDE.md
SECURITY.md	The trust model still matches what Step 2 actually reads from the target repo
.github/PULL_REQUEST_TEMPLATE.md	Doc-sync checkboxes and test-plan guidance match the current CI scope and CLAUDE.md

Authorization needed

This requires editing CLAUDE.md, which the loop's own Phase 1 classifies as agent-loaded config requiring explicit, separate user authorization — so it is filed rather than attempted. A maintainer should confirm they want these rows before anyone opens the PR.

Research grounding

No RESEARCH.md finding applies. This is a project-bookkeeping gap, not a claim about agent behavior — stating that explicitly rather than reaching for a citation.

How this was found

Stage A documentation-accuracy sweep (PR #72), which fixed the stale PR-template line but could not close the underlying reason it went stale.

---

drafted by Claude on behalf of Daniel Stephenson