It told the auditor not to flag internal/*-builder references, on the grounds that a package namespace does not move with its repo. The images have since been moved deliberately, so a leftover internal/ reference is now a real drift — and the measure is where the package is in the registry today, not where it used to be. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>