T01

The repair belongs in source selection, with tests and operator documentation coupled to it. No implementation or checks were executed.

In src/gzkit/commands/config_paths.py, _collect_source_path_literal_issues receives GzkitConfig but constructs project_root / "src" / "gzkit". If that directory is absent, it returns no literal issues. Meanwhile, check_config_paths_cmd already validates config.paths.source_root as a required directory and passes that same configuration to the scanner. Consequently, a valid relocated tree can pass the directory check while its Python literals are never examined; a leftover default tree is audited instead.

src/gzkit/config.py supplies the existing PathConfig.source_root default and loads overrides from .gzkit.json; commands/common.py::ensure_initialized loads that file from the current project root. No new option, config key, package discovery, or manifest precedence mechanism is needed. Replace the scanner’s directory expression with project_root / config.paths.source_root / "gzkit". Preserve the missing-package behavior and recursive, sorted Python traversal. The configured tree replaces the default: no fallback and no union. Update the scanner docstring’s fixed-location statement.

Preserve the audit’s meaning exactly:

• Keep _PATH_SEGMENT_RE unchanged. The source directory selects files; it does not define which string prefixes represent auditable paths.
• Keep manifest flattening, derived manifest parents, and the shared segment-boundary coverage predicate. Config flattening contributes declared values without deriving parents; the combined coverage predicate still recognizes ancestor/descendant relationships. Calling config coverage wholly “exact” would overstate the implementation.
• Keep the two explicit exempt literals and normalized, exact, per-module _AUDIT_SUBJECT_LITERALS exemptions. Retain module-level assignment restrictions, declaration-name exactness, and no exemption leakage to other modules or descendants.
• Preserve string/URL/length filtering, unreadable or syntactically invalid file handling, project-relative issue paths, JSON shape, and exit behavior.

The manpage’s “What It Checks” currently omits source-literal scanning. Add the configured scope, default, replacement behavior, and governed/exempt distinction there, with a relocation example. Update the operator runbook’s verification guidance so a clean report is interpreted against the configured package. These are same-patch obligations under .gzkit/rules/gate5-runbook-code-covenant.md, not optional follow-ups.

Review the wielding .gzkit/skills/gz-check-config-paths/SKILL.md alongside those changes: its current generic procedure says only to confirm context and run the command. Add the relevant scope judgment or point to the command contract, without duplicating the classifier specification or adding redundant mechanical verification. Alignment is required by tool-skill-runbook-alignment.md; no new verb means the seven new-subcommand registration obligations do not automatically apply. If the skill changes, skill-surface-sync.md requires canonical-first editing, a metadata version and review-date bump, then generated package/vendor synchronization. skill-authoring.md identifies skill repair as operator-only; include that review in the eventual repair route rather than silently editing mirrors.

Proposed verification, not execution evidence:

1. Add failing unit regressions in tests/test_config_paths.py: a nested configured source root containing an unmapped literal must report its relocated file; a bad leftover src/gzkit must contribute nothing; a missing configured package must not fall back. Retain default-root coverage.
2. Exercise governed manifest/config literals, explicit exemptions, module declaration scope and negative sibling/descendant controls under relocation. A bad literal elsewhere in the same fixture prevents empty-scan false passes.
3. Extend tests/commands/test_audit.py through actual .gzkit.json loading, with other required paths valid. Assert failure exit and JSON issue location for the relocated bad file, then success after correcting it. Verify human output too.
4. Later run focused tests, the audit, full repository quality checks, documentation/CLI/skill alignment and mirror checks. Apply required Heavy documentation/BDD verification to the behavior change; use receipt-producing evidence if attestation is needed.

Uncertainty: historical ownership, live brief disposition and repair authorization cannot be established from this bounded corpus. Resolve those before implementation. Absolute/out-of-project source roots are not specified here; do not introduce new containment semantics incidentally.

Read inventory (all relative paths below are under /tmp/gzkit-remedy-snapshot): AGENTS.md; .gzkit.json; src/gzkit/config.py; src/gzkit/commands/{config_paths,common}.py; src/gzkit/cli/parser_maintenance.py; tests/test_config_paths.py; tests/commands/test_audit.py; .gzkit/skills/gz-check-config-paths/SKILL.md; .gzkit/rules/{cli,skill-authoring,skill-surface-sync,tool-skill-runbook-alignment,gate5-runbook-code-covenant}.md; docs/user/{runbook.md,manpages/check-config-paths.md,skills/gz-check-config-paths.md}; src/gzkit/chores/hardcoded-root-eradication/CHORE.md. Some reads were excerpts. Additional searches inspected matching lines under src, tests, .gzkit, docs, and pyproject.toml; these were not whole-file reads. Also read /tmp/gzkit-remedy-inputs/T01.md.

Actual shell/read call count: 8, including task read and this response write. Assessment complete; implementation and verification remain unperformed by instruction.