[kyle-sexton]

No related issue: follow-up to the claude-code-plugins trust-root rollout so standards-sync PRs stop needing code-owner review for synced data files

Gate met: #6514 merged, pinning the required check-managed-files job (inside ci-status in .github/workflows/pr-require-checks.yml) to ci-workflows v0.39.1. Merging still needs code-owner review, since this PR edits .github/CODEOWNERS.

Summary

The org trust-root ruleset requires code-owner review for any path .github/CODEOWNERS assigns (github-iac OrgRulesets.cs:182, RequireCodeOwnerReview = true, with RequiredApprovingReviewCount = 0 so only owned paths need approval). /.github/standards/** @kyle-sexton owns every synced standards file, so each standards-sync PR waits on a human review even when it touches only synced data.

Fix

Add owner-less entries after /.github/standards/** (last match wins; an entry with no owner unowns the path) for the files that are both synced by the standards sync manifest and outside .github/workflows/:

• .github/standards/github-actions-conventions/vocabulary.json
• .github/standards/github-actions-conventions/vocabulary.schema.json
• .github/standards/pyright/pyrightconfig.json
• .github/standards/runner-policy/package-lock.json
• .github/standards/runner-policy/package.json
• .github/standards/runner-policy/policy.json
• .github/standards/runner-policy/policy.schema.json
• .github/standards/runner-policy/repository-policy.schema.json

Still owned: every .github/workflows/** file (including pr-review-hosted.yml, pr-review-security-hosted.yml, pr-check-managed-files-hosted.yml), .github/CODEOWNERS, runner-policy.mjs, trusted-actors.json, trusted-actors.schema.json. The trust-root paths list in docs/conventions/pr-pipeline/README.md is updated to match.

Verification

• Each unowned path appears in the paths: list of .github/workflows/pr-check-managed-files-hosted.yml and in melodic-software/standards distribution/sync-manifest.yml (main ee50a0e) under the github-actions-conventions, pyright and runner-policy components, all three in the claude-code-plugins managed: list.
• gh api repos/melodic-software/claude-code-plugins/codeowners/errors?ref=fix/codeowners-unown-synced-standards returns {"errors":[]}.
• A last-match simulation over every file under .github/standards/ shows the 8 paths above unowned and runner-policy.mjs plus both trusted-actors files owned by @kyle-sexton.
• The repo has no CODEOWNERS test or lint under scripts/ or .github/; markdownlint-cli2 passes on the edited README.

Related

• github-iac OrgRulesets.cs trust-root ruleset; ADR 0007 amendment extending it to claude-code-plugins.
• The check-managed-files job in .github/workflows/pr-require-checks.yml is required through ci-status (since ci: require check-managed-files sync verification in ci-status #6512). It fails a hand edit of any sync-managed file and passes a standards-sync PR only when every commit is the sync App's and the content matches the manifest; that check replaces code-owner review for these files. The synced pr-check-managed-files-hosted.yml runs the same guard advisory and paths-filtered.
• ci: require check-managed-files sync verification in ci-status #6512 (made the guard required), ci: repin ci-workflows to v0.39.0 #6514 (repinned it to ci-workflows v0.39.1).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T14:58:18.810625Z	36321ab	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 2m 53s —— View job

---

Code review (/review:code-review)

• Gather context (PR diff, CLAUDE.md/AGENTS.md, REVIEW.md)
• Understand the request (CI code-review lane)
• Review .github/CODEOWNERS changes
• Review docs/conventions/pr-pipeline/README.md changes
• Verify claims where tooling allows
• Post findings

No blocking findings.

What I checked

• Enumerated every file under .github/standards/ (find .github/standards -type f) and confirmed it matches exactly: the 8 newly-unowned paths, plus runner-policy.mjs, trusted-actors.json, and trusted-actors.schema.json, which the diff keeps owned. CODEOWNERS last-match-wins semantics work correctly here: none of the 8 unowned patterns is overridden by any later, more specific pattern in the file (the next patterns, .github/workflows/**, .github/scripts/**, .github/CODEOWNERS, etc., don't overlap).
• Independently cross-checked the file list against .github/workflows/pr-check-managed-files-hosted.yml lines 45-53, which separately enumerates the same managed/synced standards files (including runner-policy.mjs and the trusted-actors files). This corroborates that the PR's chosen unowned set is exactly "synced data files," while deliberately leaving the executable script and the security-sensitive trusted-actors list owned — consistent with the PR's stated rationale, not an oversight.
• Verified the check-managed-files job in .github/workflows/pr-require-checks.yml is pinned to ci-workflows v0.39.1 (line 2494), matching the PR's "Gate met" claim.
• docs/conventions/pr-pipeline/README.md edit (lines 247-248) accurately reflects the CODEOWNERS change and stays consistent with the rest of the Trust-root paths section.
• Only one CODEOWNERS file exists in the repo, so there's no competing pattern set elsewhere that could reintroduce ownership.

Not independently verified (author-claimed only)

• gh api repos/melodic-software/claude-code-plugins/codeowners/errors?ref=... returning {"errors":[]} — I didn't have network access to GitHub's API beyond gh pr diff in this sandbox, so I could not re-run this check myself.
• The cross-repo claim that all three components (github-actions-conventions, pyright, runner-policy) appear in melodic-software/standards' distribution/sync-manifest.yml — outside this repo, not re-verified.
• markdownlint-cli2 passing on the edited README — not re-run.

[claude]

Claude finished @kyle-sexton's task in 3m 2s —— View job

---

Security review complete — no issues found

• Load /review:security-review instructions
• Gather PR diff and changed files
• Check CODEOWNERS change against instruction-exception-register (standing-instruction deletion lens)
• Review docs/conventions/pr-pipeline/README.md change
• Post findings

Scope: .github/CODEOWNERS and docs/conventions/pr-pipeline/README.md.

Instruction-surface deletion lens applied. This PR removes a standing control — the code-owner-review requirement — for 8 specific files under .github/standards/. I read docs/conventions/instruction-exception-register/README.md and checked the change against the Gate 0 classes it adopts by reference (irreversible-action, secret-handling, data-integrity, external-publication, legal-compliance, agent-authority).

Removing a merge-gating human approval touches agent-authority/data-integrity territory, but the register's own test is whether another mechanism still enforces the protection it provided. It does here:

• The required check-managed-files job in .github/workflows/pr-require-checks.yml (fed into the required ci-status aggregate) already fails any pull request — sync-authored or hand-edited, from any actor — that changes a sync-manifest-managed file's content away from what the manifest specifies at the pinned standards ref. Its own code comment (lines 2466–2474) states explicitly: "That replaces code-owner review of sync pull requests, so the job is a trust boundary only while [the action is SHA-pinned, called from this code-owned file, with these exact permissions, full history, and no paths filter]." None of those preconditions are touched by this PR.
• I verified the 8 newly-unowned paths are exactly the entries in the dynamically-matched paths: filter of the advisory sibling workflow pr-check-managed-files-hosted.yml (lines 42–50), which that file states is contract-tested against the sync manifest's managed-destination set — so the set being unowned here lines up with the set the CI validator actually guards.
• Files that remain security-sensitive keep their owner: runner-policy.mjs (the executable policy script) and both trusted-actors files stay covered by /.github/standards/** @kyle-sexton (CODEOWNERS line 9), and .github/workflows/** is re-asserted as owned after the new unowned entries (line 21), so last-match-wins still protects workflow files. The unowned entries are exact file paths, not globs, so no broader directory is accidentally unowned.
• Because check-managed-files fails a hand-edit of a managed file regardless of CODEOWNERS/reviewer assignment, dropping the human-review requirement for these 8 data files does not open a path for an unreviewed, unvalidated content change to merge — the validator is the actual trust boundary, and it is unchanged by this diff.

Supply-chain concerns around the two npm manifests (.github/standards/runner-policy/package.json / package-lock.json) losing a human reviewer were considered, but the exploit path there runs through dependency-pin trust in the upstream melodic-software/standards sync, which is this lane's explicit hand-off to the Actions-hardening (zizmor) lane, not a new gap this diff introduces — the content-equality guard above is unchanged either way.

The doc update in docs/conventions/pr-pipeline/README.md accurately describes the new ownership split and introduces no new claims beyond it.

No CRITICAL, IMPORTANT, or SUGGESTION findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 36321abcd4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-review has reviewed this pull request through bffed98; a later push is reviewed from there.

[github-actions]

claude-security-review has reviewed this pull request through bffed98; a later push is reviewed from there.

[claude]

Claude finished @kyle-sexton's task in 55s —— View job

---

Code review (/review:code-review) — incremental

Scope: only docs/conventions/pr-pipeline/README.md changed since 36321abcd4 (this revision addresses the Codex P2 finding about the blanket no-owner claim). All other files were reviewed at 36321abcd4 and are unchanged.

• Gather context (incremental diff, CLAUDE.md/AGENTS.md, REVIEW.md)
• Review the README wording change against CODEOWNERS
• Verify claims where tooling allows
• Post findings

No blocking findings.

What changed and what I checked

• The .github/standards/** bullet in the trust-root paths list (docs/conventions/pr-pipeline/README.md:248) no longer makes the blanket "the standards-synced data files there ... have no code owner" claim Codex flagged — that claim is now scoped into the paragraph below instead.
• The replacement paragraph (docs/conventions/pr-pipeline/README.md:251-256) says the exception is "the eight synced data files .github/CODEOWNERS lists with no owner" and that "the runner-policy script and both trusted-actors files stay owned." I checked this against the current .github/CODEOWNERS (lines 9-20): exactly 8 unowned entries follow /.github/standards/** @kyle-sexton (the two vocabulary files, pyrightconfig.json, and five runner-policy files), and runner-policy.mjs / trusted-actors.json / trusted-actors.schema.json are not among them, so they remain owned via the @kyle-sexton catch-all. Matches the doc text exactly.
• "the required check-managed-files job in ci-status" — confirmed the job exists and is wired into the ci-status aggregate at .github/workflows/pr-require-checks.yml:2476 (and listed in the aggregate's needs at line 2506).
• This resolves Codex's concern: the bullet list no longer conflicts with the "every trust-root change requires human approval" framing, since the no-owner exception is now stated once, precisely, with its scope (8 named files) and its replacement control (check-managed-files).
• The unchanged sentence "pr-merge never merges a PR that touches a trust-root path, whatever its rung" (line 256-257) still applies to all of .github/standards/**, including the 8 unowned files — i.e., these files skip code-owner review but still need a human to actually merge via pr-merge's refusal rule. That's pre-existing text untouched by this diff, so out of scope here, and I didn't find it in tension with the new wording (it's a separate axis: auto-merge eligibility vs. review requirement).