# drift_check.py check-2 allowlist — verified prose false-positives only.
# One entry per line: "<group>" ignores the group everywhere,
# "<group> <command>" ignores that exact pair. Do NOT add real commands
# here to silence the gate — fix the skill instead.

# "wxcli commands" — English prose inside code spans, not a group
commands
# "all wxcli cucm commands" — prose; cucm's real subcommands resolve
cucm commands
# call-control/SKILL.md checklist item "wxcli call-controls accessible" —
# prose inside a fenced checklist template
call-controls accessible
# wxc-calling-builder.md:591 — deliberately fake group used to TEACH the
# --help verification gate (audit: "harmless as written")
locations-api
# wxc-calling-builder.md:772 — deliberate negative example ("users
# assign-license doesn't exist — use licenses instead")
users assign-license
# manage-devices/SKILL.md:31,640 — deliberate negative examples ("Do NOT
# use user-call-settings — that group does not exist; use user-settings")
user-call-settings
# provision-calling/SKILL.md gotcha #6 — deliberate stale-guidance warning
# ("the older update-location-calling guidance is stale — do not promise it")
location-settings update-location-calling
# (2026-07-14) Removed: `customer-assist show-queue-recording` /
# `update-queue-recording`. Those names were fabricated and never existed, but
# the ENDPOINT is real — proven live (GET 200 / PUT-then-read-back). It is now
# generated from specs/overlays/webex-cloud-calling.overlay.json as
# `show-call-recordings` / `update-call-recordings`, so no allowlist entry is
# needed: the real commands resolve against the CLI on their own.
# query-live/domains/routing.md:120 — deliberate negative examples ("Do NOT
# use wxcli trunk / wxcli route-group — those groups don't exist; use
# call-routing list-trunks / list-route-groups")
trunk
route-group

# ---------------------------------------------------------------- check 7
# Format: "prose-flag <path> <flag>" — file-scoped, not line-scoped, so an
# unrelated edit above the line does not rot the entry.
#
# Every entry below is a doc that names a flag IN ORDER TO SAY IT DOES NOT
# EXIST. Check 7 cannot tell "use `--x`" from "there is no `--x`", so without
# these it would report the repo's best anti-footgun docs as bugs and pressure
# someone into deleting them. Each was verified against `--help` on 2026-07-14.
#
# Adding an entry here is a claim that the line DENIES the flag. If you are
# adding one to silence the gate on a line that RECOMMENDS a flag, stop — that
# line is a bug; fix the doc.

# "validate-a-list has NO --macs flag ... use --json-body '{"macs":[...]}'"
prose-flag .claude/skills/manage-devices/SKILL.md --macs
# "create-base-stations has NO --base-station-macs flag — use --json-body"
prose-flag .claude/skills/manage-devices/SKILL.md --base-station-macs
# "the people create command does not have a --emails CLI option"
prose-flag .claude/skills/manage-identity/SKILL.md --emails
# same denial, reference-doc side
prose-flag docs/reference/admin-identity-scim.md --emails
# "Do NOT use wxcli cleanup — it has no --exclude-devices flag"
prose-flag .claude/skills/teardown/SKILL.md --exclude-devices
# "Gotcha — there is no --calling-only filter" (cited twice on one line)
prose-flag docs/reference/admin-licensing.md --calling-only
# "Required for the invitees array — there is no --invitees flag"
prose-flag docs/reference/meetings-core.md --invitees
# "There is no --files flag" — the API's files field is real (POST /messages,
# array of public URLs) but arrays are not rendered as flags, so an agent will
# reach for it; the gotcha exists to redirect to --json-body
prose-flag docs/reference/messaging-spaces.md --files
