[kyle-sexton]

Refs: melodic-software/ci-workflows#818
Refs: melodic-software/ci-workflows#819

Summary

Registers ci-workflows v0.56.0 (1bb8953644d16f21d10718962c6702f01ea3308a) contracts for intake-triage.yml and intake-label-needs-triage.yml. claude-code-plugins#8800 repins both intake callers to that SHA, and its runner-policy gate fails with runner-target-contract: the reusable workflow path@SHA has no reviewed runner-input contract (auto-approval declined: ... carries a reviewed allowedCallerPermissions grant; its steps cannot be proven unchanged by this surface diff, so auto-approval is declined) for both.

Owner sign-off pending. The README rollout line says "sign-off pending"; replace it with "signed off by hand on " when you sign off.

Fix

• components/runner-policy/policy.json:
  • intake-triage.yml@1bb8953: a verbatim copy of the v0.55.0 entry (3a2c748).
  • intake-label-needs-triage.yml@1bb8953: a verbatim copy of the v0.42.0 entry (182aca3), the newest reviewed SHA for that file.
• components/runner-policy/README.md: the v0.56.0 rollout line, sign-off pending.
• components/runner-policy/runner-policy.test.mjs: a test that both v0.56.0 entries equal their source entries and that they are the only two keys at that SHA.

Byte-identity evidence

Git blob SHA of each file, from gh api repos/melodic-software/ci-workflows/contents/.github/workflows/<file>?ref=<sha> --jq .sha:

File	182aca3	3a2c748 (v0.55.0)	1bb8953 (v0.56.0)
intake-triage.yml	fa4e86f8	d79b7e9e	d79b7e9e
intake-label-needs-triage.yml	8d274a66	8d274a66	8d274a66

gh api repos/melodic-software/ci-workflows/compare/3a2c748...1bb8953 is one commit (ci-workflows#836) touching nine files, all under .github/actions/pr-require-checks/ plus README.md; neither intake file is among them. Against 182aca3, the compare lists intake-triage.yml as modified (that file's reviewed SHA is 3a2c748, not 182aca3) and not intake-label-needs-triage.yml.

No input, secret, caller permission, or runs-on routing changes.

Verification

• npm run test:runner-policy: 323 pass, 0 fail, including ✔ both intake contracts at the v0.56.0 tag copy their reviewed entries forward verbatim. Adding an input to the new intake-label-needs-triage entry makes that test fail.
• npm run lint:runner-policy: Runner policy passed.
• Against the claude-code-plugins#8800 worktree (--repository-visibility public, worktree not modified):
  • with its vendored policy: the two runner-target-contract failures above, and no others;
  • with --policy set to this branch's policy.json: Runner policy passed.;
  • with this branch's runner-policy.mjs and policy.json: Runner policy passed.
• Every other ci-workflows reusable that #8800 calls stays on a SHA that already has a contract (pr-review and pr-review-security at v0.48.0, maintenance-check-links-online at v0.55.0). The other v0.56.0 pins are composite actions, which need no contract.
• lefthook pre-commit (typos, editorconfig, markdownlint, gitleaks, biome): clean.

Related

• claude-code-plugins#8800 passes its runner-policy gate once this merges and syncs.
• Precedent: feat(claude-lanes): pass allowed-author-ids at ci-workflows v0.55.0 #828 (v0.55.0 verbatim copies), feat(runner-policy): admit role-named secrets and register ci-workflows v0.51.0 intake #811, feat(runner-policy): register ci-workflows v0.49.0 intake contract #802.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Tje1j8KEYaYSxYe8RgJ3Lw

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T04:23:35.614391Z	65208d6	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 65208d6ca88e524870d6daf842c2d8187c081912: 0 finding(s), 0 as inline comments.

No findings. I reviewed all three changed files against .claude-lane/pr.diff and the PR context.

• policy.json: I read the new intake-triage.yml@1bb8953… entry and compared it by eye with the v0.55.0 entry (3a2c748…). Inputs, secrets, role and caller permissions are identical. The new intake-label-needs-triage.yml@1bb8953… entry is identical to the 182aca3… entry. Neither entry broadens a grant or changes routing.
• Test: The new test checks that each v0.56.0 entry deep-equals its source entry and that exactly two keys exist at that SHA. The constants it uses (REPINE_LANE_SHA_V0_42_0, REPINE_LANE_SHA_V0_55_0) are already defined, and both source entries exist in the policy.
• README: The rollout line is placed with the adjacent v0.5x paragraphs and matches the policy entries.

Not verified. I could not run the test suite or the lint because the sandbox required approval for those commands. The PR's reported results (323 passing, the policy lint) are the author's claims, and I did not confirm them. I also did not confirm the git-blob byte-identity table in the PR body, since that needs access to ci-workflows.

PR body. The body still says "Owner sign-off pending" and describes the README line as "sign-off pending". The README in the diff already says "signed off by hand on 2026-10-21". This is a stale description, not a code problem.

The Refs: lines and the section layout follow the PR body contract. There are no closing issues, so there are no acceptance criteria to check.

[github-actions]

claude-security-review reviewed 65208d6ca88e524870d6daf842c2d8187c081912: 0 finding(s), 0 as inline comments.

Security review: PR #829 (head 65208d6)

No security findings.

The PR changes three files: components/runner-policy/policy.json, components/runner-policy/README.md and runner-policy.test.mjs. It adds two allowlist entries for the ci-workflows v0.56.0 tag 1bb8953644d16f21d10718962c6702f01ea3308a:

• intake-triage.yml. It is identical to the existing 3a2c748… (v0.55.0) entry. I compared the two entries line by line. Both have the same routing, allowedInputs, allowedSecrets (the two AUTOMATIONS_* Claude credentials), and contents: read plus issues: write caller permissions.

• intake-label-needs-triage.yml. It is identical to the existing 182aca3… entry. Both allow runner, label, label-prefix and human-label, take no secrets, and grant only issues: write.

• Widening: No input, secret, caller-permission or routing widening versus the entries they copy.

• Pin: The new entries are keyed by a full 40-character commit SHA, not a mutable ref.

• Test: The new test asserts these entries stay deep-equal to the reviewed ones and that only these two entries exist for the new SHA. It guards against drift.

• README: It adds prose only and removes or softens no standing instruction.

Not verified: I could not fetch the ci-workflows blobs (the API calls needed approval I didn't have). I did not confirm the claim that the two workflow files are byte-identical at v0.56.0 and at the SHAs the copied entries reviewed. The PR's integrity rests on that claim and on the recorded owner sign-off. The policy diff itself adds nothing beyond what was already approved.

Because the PR is an allowlist addition for a pinned tag, I did not run the instruction-exception register check: no guardrail is removed or narrowed.