fix(audit): pass p8-install-all only when skill install declares --all

[brettdavies]

Summary

p8-install-all applies to a project that ships a skill bundle and a skill subcommand. It passed when skill install --help contained the characters --all anywhere, so each of these passed without the flag:

• a longer flag: --allow <HOST>, --all-features
• a usage line: Usage: tool skill install [--all] [HOST]
• a sentence in another argument's description: Required unless `--all` is set

The audit now asks the definition query whether that help declares --all. A single-dash -all counts in a help that declares no double-dash name, and beside double-dash names the warn says why it does not. The warn names what was searched.

This is the last behavioral audit that decided a flag's presence by searching raw help text. Three matchers still read raw text on purpose and are outside this series: error_probe.rs gates a probe on --output appearing with json, paired_examples.rs reads example lines, and no_pager_behavioral.rs looks for pager words.

Changelog

Fixed

• Fix p8-may-install-all passing when skill install --help only mentions --all: inside a longer flag such as --allow, in a usage line, or in another argument's description. It passes when an option definition declares --all.

Changed

• p8-may-install-all warn evidence now reads no option definition in `skill install --help` declares `--all`; usage lines are not read.

Type of Change

• fix: Bug fix (non-breaking change which fixes an issue)

Related Issues/Stories

• Story: n/a
• Issue: n/a
• Architecture: docs/plans/2026-10-06-0034-fix-help-flag-names-across-frameworks-plan.md (unit U10, the install_all.rs PR)
• Related PRs: fix(audit): detect an output flag from definitions and probe it as spelled #178 (p2-json-output), fix(audit): credit a non-interactive flag only when the help declares it #173, fix(audit): pass p1-flag-existence only when the help declares a gate flag #172, fix(audit): pass p7-quiet only when the help declares --quiet or -q #171, fix(audit): match a declared confirm flag against the definitions the help declares #170, fix(audit): find flag definitions at column 0, in box tables, and behind brackets #169, fix(audit): stop reading wrapped description lines as flag definitions #168, fix(audit): read names from a second column and descriptions after a marker #167, fix(audit): read every flag name a help declares whole #165, refactor(audit): look flags up through one model and one query #164, test(audit): pin what the flag parser reads from a capture of every help layout #163, feat(docker/score): compare two anc builds over the registry in one pinned image agentnative-site#455 (the corpus harness)

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing completed
• All tests passing

Test Summary:

• Unit tests: four in install_all.rs, the audit's first. The grading moved into a helper that takes the help text, so it can be tested without a binary. anc's own --all line passes. Three helps that carry the characters without declaring the flag warn. The warn evidence is asserted whole. -all passes in a help with no double-dash name and warns, with the reason, beside one.
• 1315 passing across the suite. Self-audit: cargo test --test dogfood passes, and anc audit . on this repository keeps its p8-may-install-all pass under the base and head builds.
• Snapshots: none change.

Negatives observed failing. The new tests, run against the base (#178) with the helper in place and the substring match still inside it:

---- audits::behavioral::install_all::tests::a_single_dash_all_follows_the_help_s_own_convention stdout ----
assertion `left == right` failed
  left: Warn("no `--all` flag found in `skill install --help`. MAY-tier — a single `skill install --all` invocation across detected runtimes is convenient for multi-agent setups.")
 right: Pass
---- audits::behavioral::install_all::tests::the_warn_names_what_was_searched stdout ----
assertion `left == right` failed
  left: Warn("no `--all` flag found in `skill install --help`. MAY-tier — a single `skill install --all` invocation across detected runtimes is convenient for multi-agent setups.")
 right: Warn("no option definition in `skill install --help` declares `--all`; usage lines are not read. MAY-tier — a single `skill install --all` invocation across detected runtimes is convenient for multi-agent setups.")
---- audits::behavioral::install_all::tests::all_named_but_not_declared_warns stdout ----
["longer flags that start with --all", "a usage line", "another flag's description"]
test result: FAILED. 1 passed; 3 failed; 0 ignored; 0 measured; 1046 filtered out; finished in 0.00s

Expected moves. Written before the corpus run.

None. All 95 scored tools pass this row before and after, because the row passes outright for a target with no skill bundle beside it, and the corpus audits installed binaries. Replaying the full registry capture set through the base and head builds moves no row.

Corpus before/after. Run after the table above was written. Base 4697a3c24879, head 8a8ae3ef2419. Image sha256:05db16cf226cd14a93a2682aea41b72d3e6b4d240cadba006f2881d3ffa996b3, network bridge. 98 tools selected, 95 scored under both builds, 1 rerun three times (mods).

Moved rows (0)

None.

Derived fields moved (0)

None.

No row and no derived field moved, as expected. No row is unstable, no harness bug is flagged, and no tool failed to score under one build only. mods p3-should-about-long-about, the one row on the A/A noise list, did not move: both builds returned pass and warn for it (base runs warn, pass, pass, warn; head runs warn, pass, pass, pass). cursor, nvidia-smi and xai-grok-build are absent from the image and ran under neither build.

Files Modified

Modified:

• src/audits/behavioral/install_all.rs: audit_install_help grades the help text through the definition query; audit_install_all runs the probe and hands it over.

Created:

• None.

Renamed:

• None.

Deleted:

• None.

Breaking Changes

• No breaking changes

A project whose skill install --help mentions --all without declaring it loses this MAY-tier pass. The scorecard schema and JSON shape are unchanged.

Deployment Notes

• No special deployment steps required

Checklist

• Code follows project conventions and style guidelines
• Commit messages follow Conventional Commits
• Self-review of code completed
• Tests added/updated and passing
• No new warnings or errors introduced
• Changes are backward compatible (or breaking changes documented)