A target with no .git of its own under cwd shares cwd's git root, so the
v8.1.1 rule alone called it own: an installed package under a repo and a
plugin-cache copy still had their .llm-security-ignore / policy.json read.
Chosen (PM rule, order 20260922T192716Z): a target is additionally foreign
when the path from cwd to it has a node_modules segment, or when it lies
under $CLAUDE_CONFIG_DIR/plugins (default ~/.claude/plugins). Because those
are the two concrete places foreign code lands under a user's working
directory, the failure direction is safe (foreign means more findings), and
a general "no .git of its own" rule would shut out ordinary subdirectories
of the caller's own repo. git archive exports stay indistinguishable from
own subdirectories; documented as a known limit in the module header.
Red first: 6 unit + 6 orchestrator assertions failed before the fix;
known-positives (plain subdir, workspace package dir, rest of config dir)
passed before and after.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
