Trim linked_repositories to 5, our plan's limit

.coderabbit.yaml

@@ -1,4 +1,4 @@
 # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
 #
 # CodeRabbit organization config for the `coreruleset` GitHub org.
 #
@@ -29,7 +29,7 @@
 # Tone guidance appended to every review prompt. Max 250 chars (silently
 # truncated beyond that).
 tone_instructions: >-
   Be direct, with respect. Be concise. Assume positive intent. Flag bugs, security issues, false-positive risk and regressions, with a fix. Cite rule IDs, paranoia levels and affected variables. Skip style nits. No praise.
 
 # Opt in to early-access / beta features org-wide.
 early_access: true
@@ -367,7 +367,7 @@
         `crs-toolchain regex update <id>`.
 
     - path: "plugins/*.conf"
       # CRS plugins: coreruleset/plugins/ and the *-rule-exclusions-plugin repos.
       instructions: |
         This is a CRS plugin's seclang. Every invariant that applies to core
         rules applies here too: metadata completeness, approved tags, a
@@ -418,9 +418,9 @@
         Changed default without justification — anomaly score thresholds
         (`tx.inbound_anomaly_score_threshold`,
         `tx.outbound_anomaly_score_threshold`), `tx.blocking_paranoia_level`,
         `tx.detection_paranoia_level`, `tx.critical/error/warning/notice_anomaly_score`,
         sampling percentage, `tx.enforce_bodyproc_urlencoded`, allowed methods,
         allowed content types, request body limits, or `tx.crs_validate_utf8_encoding`.
         Each of these is a behaviour change for every default deployment and
         needs the reasoning in the PR description.
 
@@ -972,15 +972,15 @@
       - name: "OWASP Security (Web, API & LLM)"
         mode: warning
         instructions: |
           Flag ⚠️ WARNING: <description> — <fix> on any affected line or block for:
 
           ## Web (OWASP Top 10)
 
           Broken Access Control — missing authorization checks, insecure direct object references,
           CORS misconfiguration, privilege escalation paths, forced browsing to authenticated resources.
 
           Cryptographic Failures — hardcoded secrets or API keys, weak algorithms (MD5, SHA1, DES),
           unencrypted sensitive data in transit or at rest, weak or expired TLS configuration,
           secrets committed to version control.
 
           Identification and Authentication Failures — missing MFA on sensitive operations, weak
@@ -1460,13 +1460,6 @@
         `crs-plugin-test-action`, and by every plugin repo's tests. A change to
         flags, output format, or exit codes breaks those callers, so treat
         those as cross-repo breaking changes.
-    - repository: "coreruleset/ftw-tests-schema"
-      instructions: >
-        The authoritative YAML schema for go-ftw test files. Every file under
-        `tests/regression/tests/` in coreruleset and in the plugin repos must
-        conform to it. Use it to decide whether a field in a test file is
-        valid, required, or deprecated, rather than inferring the shape from
-        neighbouring tests.
     - repository: "coreruleset/crs-toolchain"
       instructions: >
         Compiles `regex-assembly/*.ra` sources into the `@rx` patterns in
@@ -1486,25 +1479,6 @@
         before claiming a metadata issue will or will not fail CI, and note
         that a change to the linter itself can retroactively fail existing
         rules in coreruleset.
-    - repository: "coreruleset/plugin-registry"
-      instructions: >
-        The registry of official and third-party CRS plugins, including the
-        rule ID range reserved for each plugin. This is the authority for
-        whether a plugin rule sits in its own range or is squatting on a core
-        CRS range or another plugin's. A new plugin, or a plugin claiming a
-        new range, must be reflected here.
-    - repository: "coreruleset/actions"
-      instructions: >
-        Reusable CRS composite GitHub Actions shared across the org's
-        workflows. When reviewing a workflow change, check whether an inline
-        step reimplements something this repo already provides, and whether a
-        change here affects the workflows that call it.
-    - repository: "coreruleset/renovate-config"
-      instructions: >
-        The shared Renovate preset that every repo's `renovate.json` extends
-        via `github>coreruleset/renovate-config`. Consult it to see what the
-        preset already handles before suggesting repo-local `packageRules`,
-        and treat a change here as affecting dependency updates org-wide.
     # Renamed from coreruleset/coreruleset-documentation; GitHub redirects the
     # old name, but use the canonical one here.
     - repository: "coreruleset/documentation"

AGENTS.md

@@ -96,15 +96,20 @@ PR conventions). Keep the two in sync when either changes.
   be reviewed.
 - `allow_non_org_members: true` and `enable_free_tier: true` are deliberate: CRS takes drive-by
   community contributions.
-- **`linked_repositories` is capped at 20** and is selected by dependency edge, not by
-  relevance — a repo earns a slot when something can break across the boundary. The nine here:
-  `coreruleset` (rule IDs, approved tags, PL policy), `go-ftw` + `ftw-tests-schema` (test runner
-  and its YAML schema), `crs-toolchain` (`.ra` directive semantics), `crs-linter` (what actually
-  fails CI), `plugin-registry` (reserved plugin ID ranges), `actions`, `renovate-config`,
-  `documentation`. `documentation` carries the longest entry on purpose: it is the source of
-  truth for everything operators are told (configuration, PL guidance, exclusion recipes,
-  upgrade notes), so it outranks anything inferred from the rules when the question is what a
-  user is supposed to do — and it is the counterpart obligation for any user-visible change.
-  Note it was renamed from `coreruleset-documentation`; GitHub redirects, but the config uses
-  the canonical name. Deliberately excluded: `template-plugin` and `modsecurity-crs-docker` —
-  they consume the rule set but nothing breaks across the edge.
+- **`linked_repositories` is capped at 5 by our CodeRabbit plan** (the schema itself allows up
+  to 20). The five kept, chosen for the checks that fire across the whole org rather than one
+  repo: `coreruleset` (rule IDs, approved tags, PL policy — everything else is downstream of
+  it), `crs-toolchain` (`.ra` directive semantics, backing the regex-assembly source-of-truth
+  check), `crs-linter` (what actually fails CI), `go-ftw` (the test runner every repo's tests
+  depend on), and `documentation` (the counterpart-obligation check: flag a PR that changes
+  documented behavior without a matching docs change). `documentation` carries the longest
+  entry on purpose: it is the source of truth for everything operators are told (configuration,
+  PL guidance, exclusion recipes, upgrade notes), so it outranks anything inferred from the
+  rules when the question is what a user is supposed to do. Note it was renamed from
+  `coreruleset-documentation`; GitHub redirects, but the config uses the canonical name.
+  Dropped to fit the cap: `ftw-tests-schema` (overlaps `go-ftw`), `plugin-registry` (only backs
+  the plugin ID-range check, scoped to plugin repos), `actions` and `renovate-config` (only
+  relevant to workflow/dependency-policy discussions). Revisit if plugin repos start seeing
+  frequent drive-by PRs — `plugin-registry` backs the one blocker-severity check among the four
+  that were cut. Deliberately excluded regardless of the cap: `template-plugin` and
+  `modsecurity-crs-docker` — they consume the rule set but nothing breaks across the edge.