fix(lychee): drop the redundant example-domain exclude and add check-links

[kyle-sexton]

No related issue: follow-up from the lychee online sweep requested by the repository owner.

Summary

Retest of the shared lychee.toml URL excludes after the GitHub-runner online run in claude-code-plugins. One exclude is dropped as redundant; every other exclude stays, because no runner evidence that it passes was obtainable. The README's manual online command now tells standards to skip its own fixtures, and the naming vocabulary gains check-links for the online link-check workflow.

Fix

• lychee.toml: remove '^https?://example\.(com|org)'. lychee 0.24.2 excludes example.com/.org/.net by default: a config-free lychee --dump --verbose over example.com, www.example.com, example.org and example.net URLs marks all four [excluded], while example.community stays checked (the removed regex would also have hidden that host).
• components/lychee/lychee.test.sh and fixtures/good/Exclusions.md: two placeholder URLs and three assertions prove the default still excludes them and the config carries no example-domain entry, so a lychee upgrade that changes the default fails the test.
• components/lychee/README.md: the manual online command notes --exclude-path '(^|/)components/lychee/fixtures/' for standards itself. The fixtures hold placeholder URLs and intentionally broken links that the offline harness reads; a shared exclude_path would reach every consumer, so the exclusion stays on the standards-only command.
• components/github-actions-conventions/vocabulary.json: add maintenance function check-links (claude-code-plugins maintenance-check-links-online.yml, #7124 there). No existing maintenance function fits: audit-link-check-excludes audits only the private-repo exclude list, while this workflow checks every Markdown link with the network on.

Excludes kept, with why:

• iso.org 78907 and the two medium.com entries: the claude-code-plugins runner run got 403 from other iso.org and medium.com pages, so the workstation pass recorded in the research does not carry over.
• docs.genius.com, cursor.com, lib.rs, ntia.gov, w3.org, x.com, LinkedIn, bsky.app, ACM, dev.mysql.com, help.miro.com, isdown.app, npmjs: their URLs are excluded in every run, so no runner result exists, and running a hand-picked URL list on a runner was out of scope for this sweep. Each still carries its recorded verification.

No shared exclude added: the row G logs propose none, and every new exception in claude-code-plugins is cited only there.

Verification

• bash components/lychee/lychee.test.sh: 101 PASS, 0 FAIL.
• bash components/lychee/private-repo-inventory.test.sh: 34 PASS.
• npm run test:github-actions-conventions: pass; npm run lint:github-actions-conventions: 0 findings.
• Online lychee 0.24.2 over standards' tracked Markdown with the fixtures path excluded, no token: 945 links, 0 errors except five man7.org timeouts (host refusing connections today; a rendering fetch returns the pages, transient outage, no exception) and one gnu.org 429 (answers 429 to the lychee User-Agent intermittently; passed on the runner and on retry in other rows).

Related

• docs: repair links reported by an online lychee run claude-code-plugins#7199 (link repairs), #7124 there (online workflow), standards#767, standards#769.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T16:57:47.663836Z	a344685	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 1m 6s —— View job

---

Security review — /review:security-review

• Gather context (PR diff, changed files)
• Review changed files for security-relevant issues
• Check for instruction-surface deletions (CLAUDE.md/AGENTS.md/rules)
• Post final findings

No security issues found.

This PR touches only link-checker configuration and test data:

• lychee.toml — drops a redundant example\.(com|org) exclude regex now that lychee's own default covers those hosts. The old regex had no trailing anchor, so it also incidentally hid example.community; removing it actually tightens link checking (that host is now checked again) rather than loosening anything.
• components/lychee/README.md — documents a manual, developer-run --exclude-path flag for the standards repo's own test fixtures. Not executed by CI, no injection surface.
• components/lychee/fixtures/good/Exclusions.md and components/lychee/lychee.test.sh — add placeholder test fixtures/assertions; static strings matched with grep -cF, no untrusted input, no shell injection surface.
• components/github-actions-conventions/vocabulary.json — adds one static vocabulary entry (check-links) to a linter-enforced allowlist; plain data, no code execution path.

No .github/workflows files, secrets, auth, or trust boundaries are touched. No CLAUDE.md/AGENTS.md/rules/skill/agent/hook files were deleted, narrowed, or softened, so the instruction-surface-deletion lens doesn't apply here.
· Branch: lychee-exclude-retest

[claude]

Claude finished @kyle-sexton's task in 7m 11s —— View job

---

Code review complete

• Gather context (PR diff, changed files)
• Review changed files against CLAUDE.md / REVIEW.md criteria
• Adversarially verify candidate findings
• Post findings / summary

No findings meet this lane's high-signal bar (nothing a careful senior reviewer would block on).

What I checked:

• lychee.toml — the removed example\.(com|org) exclude has no other literal example\. occurrence left in the file (confirmed by direct read), so the new assert_eq 'config carries no example-domain exclude' '0' "$(grep -cF 'example\.' "$config")" regression guard in lychee.test.sh is sound and won't false-pass.
• lychee.test.sh — the two new assert_not_contains assertions for example.com/example.org follow the exact idiom already used for every other exclude in this file (--dump output absence proves exclusion); argument order and quoting match the harness's label haystack needle signature.
• components/github-actions-conventions/vocabulary.json — check-links is schema-valid (check is a listed verb), alphabetically placed under the maintenance stage, and its purpose text correctly cross-references the real audit-link-check-excludes entry. Marking it "in-use" without a matching workflow file in this repo is consistent with existing entries (e.g. reconcile-pr-creation-policy also has no workflow under this repo's .github/workflows/) — vocabulary.json is shared org-wide, and the referenced maintenance-check-links-online.yml lives in claude-code-plugins. The pre-existing check-links job id example in the README/naming-lint fixtures is a different namespace (job ids aren't stage-registered) and doesn't collide.
• components/lychee/fixtures/good/Exclusions.md and components/lychee/README.md — new prose and fixture lines are internally consistent with the rest of each file.

Not independently verified: the underlying factual claim that lychee 0.24.2 excludes example.com/.org/.net by default (lychee isn't installed in this review sandbox, so I couldn't run lychee --dump). This is the author's claimed verification, not something I confirmed myself — but it's self-checking: if the claim is wrong, the new assert_not_contains assertions in lychee.test.sh fail CI rather than silently passing.

A second independent pass (separate agent, same diff) corroborated these conclusions and found nothing additional.

[github-actions]

claude-security-review has reviewed this pull request through a344685; a later push is reviewed from there.

[github-actions]

claude-review has reviewed this pull request through a344685; a later push is reviewed from there.