[kyle-sexton]

No related issue: owner direction 2026-10-26 (a person only for intent, design or HIGH/CRITICAL security)

Summary

The lanes App adds needs-human when a pr-unblock lane stops, and today only a person can take it off. That holds even after the cause is gone. Scheduled pr-merge run 40407031993 kept every App-labeled pull request: three ci-fix-escalated (#10174, #10120, #10307), three feedback-uncertain (#10125, #10326, #10321), and one workflow-staged (#9835).

This change extends the existing clear step, .github/scripts/pr-merge/clear-escalations.mjs (run by pr-merge.yml's "Clear escalations whose reason no longer holds"). It adds no new workflow.

Fix

Each pr-unblock reason below now has a cause-gone check. Every check reads evidence that comment text cannot forge:

Reason	Cleared when
workflow-staged	as before (main changes no workflow since the merge base), or a trusted move took the head off every resume key and the head contains main as it was when the lane escalated (commits?sha=main&until=<escalation>, then compare it to the head: behind by 0)
ci-fix-round-cap, ci-fix-empty, ci-fix-invalid, ci-fix-not-applied, ci-fix-escalated	a trusted move, and at the new head no check other than ci-status fails, is still running or was cancelled, each check's latest run ended success, neutral or skipped (so action_required, stale or no conclusion keeps the label), and at least one passed. The check uses fix-ci's own failingChecks over filter=all, so a later skipped run cannot hide a failure. ci-status is excluded because the label itself fails it

A trusted move requires all of the following:

• The PR head is in this repository.
• The head is none of the recorded resume keys.
• The branch activity API (/repos/{repo}/activity?ref=refs/heads/<branch>) shows every activity since the label went on was by an id the base trusted-actors.json lists as human. A lanes App push never counts, so the App cannot lift its own stop (every lane that sets denied-actor-ids denies the App's sender id).
• The newest of those activities landed the current head.
• The activity page reaches back past the label time.

A failed read keeps the label and logs ::warning; the run stays green.

The "org member" test is the base trusted-actors.json humans, matched by numeric id, the same list ci-status uses. The org membership API is not called, because it may need a members scope the lanes token lacks.

The following reasons are never lifted, even after a trusted move with every check green:

• Security, intent or decision: feedback-uncertain, feedback-disputed, feedback-unadjudicated, feedback-question-*, feedback-round-cap, feedback-not-converging, dependency-security-close, dependency-escalate.
• Protected-path or own-patch stops: ci-fix-protected-path, unexpected-path-staged, conflict-patch-invalid, conflict-patch-not-applied, conflict-patch-protected-path.
• No reliable cause-gone evidence yet: repeat-cap, feedback-not-landed, feedback-invalid, feedback-partial, feedback-incomplete, and the other dependency-* stops.

clear-escalations.mjs now imports .github/scripts/pr-unblock/fix-ci-context.mjs and .github/scripts/maintenance-reconcile-lost-runs/infra-failure.mjs, so both join the enforcement floor beside it, in every copy of that list: merge-holds.mjs HOLD_PATH_CLASSES, babysit_risk.py, the hold_patterns of pr-require-checks.yml, and pr-review-hosted.yml and pr-review-security-hosted.yml. This only adds floor entries; it removes none.

Permissions and tokens are unchanged:

• The label write still uses the lanes App token the step already uses.
• The new reads use the merge job's own github.token, already passed to the step as BABYSIT_VERIFY_GH_TOKEN. The job already holds contents: read and checks: read.
• The step gains one env line, TRUSTED_ACTORS_PATH, pointing at the base copy.

Basis for those two permissions: GitHub's permissions required for GitHub Apps page lists GET /repos/{owner}/{repo}/activity under Contents (read) and the check-runs listing under Checks.

Pushes by the lanes App, Dependabot or github-actions[bot] are not trusted moves, so their ci-fix-* stops still wait for a person.

Does an App unlabel launder approval?

No. An App removal does not satisfy any floor that needs a trusted person:

• ci-status "Fail a pull request carrying the human-gated label" (pr-require-checks.yml:4086) treats any removal as clearing that one step.
• The next step, "Fail a review-lane hold an untrusted account lifted" (pr-require-checks.yml:4159), requires the first removal after a review-lane hold to be by a human on trusted-actors.json. An App removal fails it. clear-escalations.mjs also keeps the label while openReviewHold finds a hold.
• The cost-hold window opens only on a removal with performed_via_github_app == null by a trusted human id (pr-require-checks.yml:3886).
• Hold paths (HOLD_PATH_FLOOR) on a lanes App PR are lifted only by a trusted person's approving review of the head (pr-require-checks.yml:4650, merge-holds.mjs). They never read unlabeled.
• pr-merge's gate counts a removal as a lift only from a trusted User with performed_via_github_app None (babysit_merge.py:3810).
• enable-auto-merge liftedByPerson requires actor __typename == "User" (enable-auto-merge.mjs:665), so it puts its person-refusal label back after an App removal.
• The merge-queue unlabeled reader (pr-require-checks.yml:4599) reads only an untrusted-work label on linked issues, and requires a trusted User with no App behind the removal.
• intake-reenter/reenter.mjs skips pull requests (liftReenters returns false on issue.pull_request).

Verification

• node --test .github/scripts/pr-merge/clear-escalations.test.mjs: 70 pass, 0 fail at the merged head. The activity-page reach guard was mutation-checked: deleting it turns its test red. New tests that failed on the code before them: workflow-staged trusted move, ci-fix lift, and (security-review follow-up) the lanes App push is not a trusted move, an action_required, stale or null check keeps a ci-fix stop, and ci-fix-protected-path stays. A neutral check does not block the lift. The rest pin the keep cases:
  • an untrusted pusher, the lanes App, the claude[bot] App, or a spoofed login with the wrong id
  • ci-fix-protected-path, unexpected-path-staged and the conflict-patch-* stops, even when mergeable after a trusted move
  • a head that lacks main as of the escalation
  • a newest push that is not the head, or no push
  • an activity page that does not reach the label
  • the head still at the resume key, a fork head, a missing trusted list or job token
  • a failing, running or cancelled check, a failure hidden behind a later skip, or no passed check
  • a failed read (run stays green)
  • every security, intent or decision reason
• node --test .github/scripts/pr-merge/clear-escalations.test.mjs .github/scripts/pr-merge/merge-holds.test.mjs: 109 pass, 0 fail at the merged head.
• python3 -m unittest discover over the babysit-prs tests: 3225 run, 3224 pass; the one error is test_babysit_lane_room failing to git commit in a temp repo on this host (not a file this PR touches).
• actionlint .github/workflows/pr-merge.yml: clean.
• bash scripts/ci-lanes-pr-hold.test.sh: PASS=218 FAIL=0 at the merged head.
• scripts/check-affected.sh: 10 passed, 4 skipped. markdownlint and typos are clean on the changed docs.
• Live probe of the evidence, read with gh this session:
  • #9835: kyle-sexton pushed it from resume key 2fc9ba91ea to 841aebc3ad, and the head is 207 ahead and 0 behind main as of the escalation, so it clears under the new path.
  • #10120: kyle-sexton moved it off its resume key, and only ci-status fails at its head, so it clears unless a person commented since the label. The log stopped at the reason check, so that rule was not reached there.
  • #10307: test-bash fails at its head, so it stays.
  • #10174: checks were still running at probe time, so it stays until they finish.
  • The three feedback-uncertain PRs stay by design.

Related

• Builds on #10198 and #9826, which added refusal-cleared and head-moved to the same script.
• Docs: docs/conventions/pr-pipeline/README.md, the clear table and the reasons that still wait for a person.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T00:46:00.754867Z	b86fa72	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review: 1 inline finding(s) on b86fa724380e46c48c5c8f130264e8e867a5098e; the summary is in this lane's pull request comment.

claude-lane: claude-security-review

[github-actions]

claude-security-review reviewed b70cc23d37d29911bdccd661d412f2d05ae7d47d: 1 finding(s), 1 as inline comments.

Security review of #10389

critical-findings: 0

Scope read: the whole diff (15 files), the PR context, clear-escalations.mjs end to end, and loadTrustedList in check-trusted-trigger.mjs. The PR changes a merge hold: the lanes App can now take off its own needs-human label for workflow-staged and the ci-fix-* stops. I treated that as a trust-control change and checked what it lets through.

Controls I checked, all fail closed:

• The trusted list is the base copy, .base/.github/standards/trusted-actors/trusted-actors.json. It is read through loadTrustedList, which validates the schema, and only kind == "human" ids are used. The lanes App is kind: bot, so its own push can never count as a trusted move.
• The activity check (clear-escalations.mjs:317) requires every activity since the label to be by a trusted human id. The newest activity must have after == head. The page must reach back past the label time, so a page of 100 newer items fails closed. Fork heads, resume-key heads, a missing token or list, and any thrown read all keep the label.
• The ci-fix check-run test runs failingChecks over filter=all, so a later skipped or passing run cannot hide a failure. It also needs every latest run in success/neutral/skipped, no run still going, and at least one success. A read capped at 3 pages returns null and keeps the label.
• Security, intent, decision, protected-path and own-patch reasons are not in CHECKS, so they are never lifted. This includes ci-fix-protected-path, which is explicitly excluded from CI_FIX.
• The new job-token reads use BABYSIT_VERIFY_GH_TOKEN, which the step already received. The label write is unchanged. The workflow change adds one env line pointing at the base copy and widens no permissions.
• The added entries in the merge-holds.mjs hold list, babysit_risk.py, the pr-require-checks.yml hold_patterns, and the two hosted review workflows only extend the enforcement floor. They remove nothing. The two newly imported modules, fix-ci-context.mjs and infra-failure.mjs, are now floored.
• I did not re-verify the PR's claims about the downstream unlabeled readers in pr-require-checks.yml, babysit_merge.py and enable-auto-merge.mjs, since they are outside this diff. The review-lane hold check, the cost-hold window and the hold-path approval requirement all sit outside this diff and are unchanged.

Finding (IMPORTANT, 1): a trusted push is treated as the person's approval to lift the stop. See the inline comment.

manifest: no plugin manifests changed, so nothing is flagged.

Spend: none. This is label logic and CI reads on the job token. I found no billing, plan or paid-resource change, so I set no hold.

[github-actions]

claude-security-review holds this pull request for a person (critical-security) at b86fa724380e46c48c5c8f130264e8e867a5098e.

The PR weakens a merge-hold control, .github/scripts/pr-merge/clear-escalations.mjs. It now lifts needs-human automatically for workflow-staged, the ci-fix-* stops, unexpected-path-staged and the conflict-patch-* stops, which previously waited for a person. The review command classes a change that weakens a merge hold as CRITICAL regardless of the PR's own argument. A person should confirm the policy change and that the downstream floors still apply.

claude-lane: claude-security-review

[github-actions]

claude-review reviewed b70cc23d37d29911bdccd661d412f2d05ae7d47d: 0 finding(s), 0 as inline comments.

Code review: PR #10389 (head b70cc23)

No correctness or maintainability findings. I read the full diff (.claude-lane/pr.diff, all 829 lines) and the PR context. I also read failingChecks in fix-ci-context.mjs, loadTrustedList in check-trusted-trigger.mjs, and the .base checkout in pr-merge.yml. I ran no tests or commands. The test counts in the PR body are author-claimed and unverified by me.

Checked and found sound

• Trusted move (clear-escalations.mjs, trustedMove):
  • It fails closed. It returns null on a missing trusted list, a head at a resume key, a fork head, an unreadable page, or a page that doesn't reach back past the label time (recent.length === activity.length).
  • It returns null if the newest activity isn't the head, or if any activity since the label is by an id off the human set. The lanes App has kind: bot, so it can never lift its own stop.
• ci-fix-* check (ciPasses):
  • It is stricter than failingChecks: it needs every latest run in PASSING, nothing still running, and at least one success.
  • failingChecks prefers a non-silent run over a later skipped one, so a failure behind a later skip is still caught.
  • A read that reaches the page cap returns null and keeps the label.
• workflow-staged: the old "main changes no workflow" path is unchanged. The new path runs only when that check does not clear, and mainMergedAt needs behind_by === 0 against main as of the escalation.
• Never-lifted reasons: these stay out of CHECKS, so Object.hasOwn(CHECKS, reason) keeps them with a person. ci-fix-protected-path is deliberately excluded.
• Enforcement floor: the two new files appear in every copy I could see in the diff: merge-holds.mjs, babysit_risk.py, pr-require-checks.yml hold_patterns, pr-review-hosted.yml, pr-review-security-hosted.yml, and the Python and shell test counts (25 to 27, 55 to 57).
• Workflow: the .base checkout is a full checkout, so TRUSTED_ACTORS_PATH resolves. The job token is already in BABYSIT_VERIFY_GH_TOKEN, and no permissions change.
• Changelog fragments: bump: minor for the new capability and bump: patch for the floor additions match the change.

Cost: none. This adds a few extra read calls per scheduled pr-merge run, at most five clears per run.

Not covered: whether GET /repos/{repo}/activity returns the shape the code assumes in production. The tests use a stub reader, and the PR's live probes are author-claimed.

[github-actions]

claude-security-review holds this pull request for a person (critical-security) at c6453afda7ff4ea540f6392c5ba5f383f02953ff.

Trust-control change: .github/scripts/pr-merge/clear-escalations.mjs (a merge-hold control) now lets the lanes App remove the human-gated needs-human label with no person acting. It does so for workflow-staged (even while main still changes workflows) and for six ci-fix-* stops, on evidence of a trusted pusher id (including the lanes App's own id) plus passing checks. The content a person would have reviewed is never checked. The review rules treat a change that may widen what a merge hold lets through as CRITICAL.

claude-lane: claude-security-review

[github-actions]

claude-security-review: 1 inline finding(s) on 9bcfb251673aade3c6a2a69262f37917b7b9f082; the summary is in this lane's pull request comment.

claude-lane: claude-security-review

[github-actions]

claude-security-review holds this pull request for a person (critical-security) at 9bcfb251673aade3c6a2a69262f37917b7b9f082.

Trust control: this PR extends .github/scripts/pr-merge/clear-escalations.mjs (a listed merge-hold script) so the lanes App lifts the human-gated needs-human label on the six ci-fix-* stops and on a second workflow-staged path with no person involved, based on a trusted-actor push and green checks. Stops that waited for a person are now cleared by automation. The trusted set also skips the denied-actor-id list that check-trusted-trigger applies. Per the review rules, a hold the code now lifts without a person is a CRITICAL weakening, so it needs an owner decision.

claude-lane: claude-security-review

[melodic-automation-lanes]

The pr-unblock lane stopped on this pull request and needs a person: a conflicted path is a workflow, submodule config or a settings file, which the lane does not resolve.

• Reason: protected-path-conflict
• Resume key: 9bcfb251673aade3c6a2a69262f37917b7b9f082 (the head the lane stopped on)

To resume, deal with the reason above, remove the needs-human label (and do-not-merge, if set), then dispatch the pr-unblock workflow with pr-number=10389 and activity=resolve-conflicts:

gh workflow run pr-unblock.yml -R melodic-software/claude-code-plugins -f pr-number=10389 -f activity=resolve-conflicts

[github-actions]

claude-review: 1 inline finding(s) on 8ed9cbc8ebf0b540d7b36bbaa83c93ec16f0caaf; the summary is in this lane's pull request comment.

claude-lane: claude-review

[melodic-automation-lanes]

The pr-unblock lane escalated this pull request as protected-path-conflict, and that no longer holds at 8ed9cbc8ebf0b540d7b36bbaa83c93ec16f0caaf: GitHub reports no conflict with main. pr-merge removed needs-human, so the lanes run on it again. To keep a person on it, add needs-human back: a label a person adds is never removed.

[github-actions]

claude-review: 1 inline finding(s) on 1069436fd9a612210b8c2a7f49360880f9de169c; the summary is in this lane's pull request comment.

claude-lane: claude-review

[melodic-automation-lanes]

The pr-unblock lane stopped on this pull request and needs a person: the merge stages a change under .github/workflows/, which the lane does not push.

• Reason: workflow-staged
• Resume key: 1069436fd9a612210b8c2a7f49360880f9de169c (the head the lane stopped on)

To resume, deal with the reason above, remove the needs-human label (and do-not-merge, if set), then dispatch the pr-unblock workflow with pr-number=10389 and activity=resolve-conflicts:

gh workflow run pr-unblock.yml -R melodic-software/claude-code-plugins -f pr-number=10389 -f activity=resolve-conflicts

[github-actions]

claude-security-review: 1 inline finding(s) on b70cc23d37d29911bdccd661d412f2d05ae7d47d; the summary is in this lane's pull request comment.

claude-lane: claude-security-review

[github-actions]

Post-merge mutation testing

• Range: 9638b55..ebfd5bd
• Merged pull request: #10389
• Outcome: reported

Killed 0, survived 0, timeout 0, no coverage 0, invalid 0, not run 8.
Covered-code score n/a; mutation score n/a.

File	Killed	Survived	Timeout	No coverage	Invalid	Not run
.github/scripts/pr-merge/clear-escalations.mjs	0	0	0	0	0	6
.github/scripts/pr-merge/merge-holds.mjs	0	0	0	0	0	1
plugins/source-control/skills/babysit-prs/scripts/babysit_risk.py	0	0	0	0	0	1

The run's summary has the full report.