[kyle-sexton]

Closes #6967

Summary

Intake's refine-issue was the last lane in intake-triage.yml still on anthropics/claude-code-action. It now runs on ci-workflows' run-claude-cli (the same v0.65.15 pin the other lanes use), as the intake role, with the INTAKE API key first. The job shape copies pr-verify's key-then-subscription jobs from e9e9c32 (#8577): the subscription job is gated directly on the key job's handoff and credential outputs. #9673 set the precedent for running a lane's key first.

• refine-issue runs on INTAKE_CLAUDE_API_KEY alone.
• refine-issue-subscription (new) runs the same steps on a fresh VM on INTAKE_CLAUDE_CODE_OAUTH_TOKEN alone. It runs only when the key leg hands off (a credit stop, or a 401 or 402) or the key is empty.
• apply-refinement reads whichever leg uploaded refinement-<attempt>.

Fix

• The prompt text and both JSON schemas (refine and size-split) are unchanged. They are now written to files under RUNNER_TEMP and passed as prompt-file and json-schema-file.
• Tools stay the same: Read on the context directory, plus Read, Grep and Glob in the default-branch checkout, plus WebFetch on the same six docs hosts. Bash, Edit, Write, NotebookEdit, WebSearch, Agent, Skill and mcp__* are denied. The run uses permission-mode: dontAsk.
• The context file now downloads under the workspace (refine-data/), because --restricted confines the file tools to the working directory.
• The structured output is kept only after check-permission-mode.sh confirms the leg ran in dontAsk.
• apply-claude-managed-settings runs before runner isolation, as the launcher requires. An empty (default) model fails the prompt step.
• Permissions are unchanged: each model job holds contents: read only, and the model gets no GitHub token. Writes still go only through apply-refinement's lanes App token.
• --setting-sources user is replaced by the launcher's --restricted, which loads no user, project or local settings. settings-json (CLAUDE_CODE_SUBAGENT_MODEL) is dropped; it had no effect because Agent is denied.
• lane-funding.json: refine-issue now uses launcher run-claude-cli with the key. refine-issue-subscription is added with the token.
• callers.test.mjs: replaces the claude-code-action assertions. The new ones cover the launcher pin, dontAsk, the exact tool, allow and deny lists, and that the allow list's hosts match the prompt's. They also check that both legs build the same prompt and differ only in the credential, and they cover the new job's needs, if:, permissions and concurrency.

Verification

• node --test .github/actions/resolve-config/callers.test.mjs: 194 pass, 0 fail.
• Other suites that inventory lanes or run-claude-cli callers all pass:
  • check-trusted-trigger: 370
  • intake-triage admit, apply-verdict, edges and refine: 275, 138, 74, 111
  • pr-verify workflow, write-verdict and probe parity: 17, 18, 20
  • pr-unblock workflow-gates: 28
  • maintenance-audit-lane-runs workflow and triage-sweep: 10, 24
  • reconcile: 89
  • report-outcome: 249
  • live-config and models: 40, 116
  • check-signed-commits: 38
  • collect-base-activity: 142
  • log-api-budget: 36
  • intake-reenter: 45
  • read-runner-dispatcher-gate.test.sh: 9
  • check-permission-mode.test.sh: pass
  • morning-brief.test.sh: 487
  • post-merge-demotion-alert.test.sh: 154
• node .github/standards/runner-policy/runner-policy.mjs --root .: passed.
• actionlint .github/workflows/intake-triage.yml: clean. zizmor --offline: no findings.
• scripts/check-changelog-fragments.sh --check and --check-required origin/main pass. No plugin or convention files changed, so no fragment is needed.
• test_merge_holds_sync.py: 10 passed.

Related

• Probe: does a self-written claude -p step in GitHub Actions draw the linked org's API credits? #6962 (credit-draw probe) and After every linked org's credits are spent, keep a capped paid backstop? #6966 (no paid backstop) are the reasons for this sweep.
• feat(pr-pipeline): run resolve-issue on run-claude-cli with an API key first and an OAuth fallback #9673 moved resolve-issue the same way.
• The fallback-token third leg (as in ci(pr-pipeline): run each read-runner lane once more on the central fallback token #10191) is not added here. Today refine-issue runs on the subscription token alone, and this change keeps that token as the second leg.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T00:28:54.320485Z	41743ee	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed afef76f01b11f2e62549eb31d8c4cedf0655a2c9: 0 finding(s), 0 as inline comments.

Incremental review of 41743ee..afef76f, covering .github/workflows/intake-triage.yml and .github/actions/resolve-config/callers.test.mjs. I found no security issues.

critical-findings: 0

• intake-triage.yml: The change adds id: handoff to the "Report a handoff" step and edits a comment. I checked that this step's if, env and run are unchanged and that the id grants no new access. The step's if still compares steps.run.outputs.handoff to the fixed string 'true'. Permissions, secrets, the token request and the tool allow and deny lists are not touched. The subscription leg's gating on the key leg's outputs is also unchanged.

• callers.test.mjs: This is a test file. resolve-config's tests are not a trust control, so I read it only to check it doesn't weaken a check. The new refineLegShape helper compares the two refine legs step by step, in order, and field by field. It leaves out only the credential check's env and run, the launcher's credential inputs, the key leg's handoff step, and the last step's if. That is stricter than the previous comparison, which looked only at the launcher's with inputs. The added mutation cases confirm it fails when:

  • a leg's continue-on-error is removed;
  • a leg's timeout or environment changes;
  • steps are reordered;
  • a step's run changes;
  • a leg's if changes;
  • a step is dropped.

  The existing assertions that check each leg's own credential reference are kept.

• Manifests: The diff touches no plugin manifest or marketplace file.

• Spend: The change adds no extra lane runs beyond what the earlier-reviewed PR already introduced. It spends only prepaid API credits or subscription usage, so it is not a hold.

[github-actions]

claude-review: 1 inline finding(s) on 41743eede27c009fe9e3a8c284628027613a74be; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review reviewed afef76f01b11f2e62549eb31d8c4cedf0655a2c9: 0 finding(s), 0 as inline comments.

Incremental review of 41743eed..afef76f0 (callers.test.mjs, intake-triage.yml): no findings.

• Workflow change: the only change is id: handoff on the key leg's "Report a handoff" step, plus a comment rewrite on refine-issue-subscription. Nothing references that id. It exists so the parity helper can filter the step out. No behaviour or permission changes.

• Parity helper: I compared refine-issue (lines 657–947) and refine-issue-subscription (lines 957–1213) by reading them. Apart from the step filtered out by id, they match step for step, in the same order. The only differences are the four the helper strips:

  • the "Check the credential" step's env and run;
  • the launcher's api-key or subscription-token input;
  • the key leg's "Report a handoff" step, which the subscription leg does not have;
  • the if on "Fail without a refinement".

  The new comment on the subscription job describes these accurately.

• Mutation checks: I traced each of the nine differs(...) cases against the helper. Each one changes a field the helper keeps, or the step count or order, so assert.notDeepEqual should hold. I did not run the tests, so the PR's pass counts are author-claimed.

• Remaining gap (not a finding): job-level fields (needs, if, outputs, permissions, concurrency) are outside the helper. The PR description says other assertions cover them.

• Trusted path: .github/actions/resolve-config/callers.test.mjs is a test file only. Nothing in this increment widens a token, permission or trust gate. The credential-isolation checks (each credential in its own leg only) still stand.

• Spend: no billing change. The key-first/subscription-second run structure was set in the earlier reviewed commit and is unchanged here.