From 449f502cb28c65c56db1cb3059eebedf901d4a45 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Fri, 23 Oct 2026 22:25:32 -0400
Subject: [PATCH] feat(runner-policy): register the intake-triage contract on
 the intake funding role

Adds intake-triage.yml@b0ecc273abe492d12f2efa98ee4741a84c219ed2, the
v0.65.0 entry with role intake and INTAKE_CLAUDE_API_KEY and
INTAKE_CLAUDE_CODE_OAUTH_TOKEN. b0ecc27 is one docs-only commit past
v0.65.0 with no .github change. The v0.65.0 entry stays until
claude-code-plugins repins its caller, so neither side goes red first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 components/runner-policy/policy.json          | 26 +++++++++++++++++++
 .../runner-policy/runner-policy.test.mjs      | 21 +++++++++++++++
 2 files changed, 47 insertions(+)

diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json
index 8f7c94a6..838037c1 100644
--- a/components/runner-policy/policy.json
+++ b/components/runner-policy/policy.json
@@ -333,6 +333,32 @@
         "issues": "write"
       }
     },
+    "melodic-software/ci-workflows/.github/workflows/intake-triage.yml@b0ecc273abe492d12f2efa98ee4741a84c219ed2": {
+      "routing": "runner-input",
+      "runnerInput": "runner",
+      "role": "intake",
+      "allowedInputs": [
+        "runner",
+        "allowed-labels",
+        "escalation-label",
+        "floor-label",
+        "instructions",
+        "cli-version",
+        "claude-args",
+        "issue-number",
+        "allowed-author-ids",
+        "allowed-bot-sender-ids",
+        "role"
+      ],
+      "allowedSecrets": {
+        "CLAUDE_API_KEY": "${{ secrets.INTAKE_CLAUDE_API_KEY }}",
+        "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.INTAKE_CLAUDE_CODE_OAUTH_TOKEN }}"
+      },
+      "allowedCallerPermissions": {
+        "contents": "read",
+        "issues": "write"
+      }
+    },
     "melodic-software/ci-workflows/.github/workflows/pr-review.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
       "routing": "runner-input",
       "runnerInput": "runner",
diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs
index 6ebd1985..565177aa 100644
--- a/components/runner-policy/runner-policy.test.mjs
+++ b/components/runner-policy/runner-policy.test.mjs
@@ -9943,6 +9943,27 @@ test("the intake-triage and pr-review-cli contracts at the v0.65.0 tag copy thei
   assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 2);
 });
 
+// b0ecc27, one docs commit past v0.65.0 with no .github change, moves
+// intake-triage onto the intake funding role: the v0.65.0 entry with role
+// intake and INTAKE_* secrets. The v0.65.0 entry stays until
+// claude-code-plugins repins its caller.
+test("the intake-triage contract at b0ecc27 is the v0.65.0 entry on the intake role", () => {
+  const contracts = BASE_POLICY.approvedReusableWorkflowContracts;
+  const key = (sha) => `melodic-software/ci-workflows/.github/workflows/intake-triage.yml@${sha}`;
+  const sha = "b0ecc273abe492d12f2efa98ee4741a84c219ed2";
+  const prior = contracts[key("d02b8697e092705153f0996549b05f95a446bb52")];
+  assert.equal(prior.role, "automations");
+  assert.deepEqual(contracts[key(sha)], {
+    ...prior,
+    role: "intake",
+    allowedSecrets: {
+      CLAUDE_API_KEY: `\${{ secrets.INTAKE_CLAUDE_API_KEY }}`,
+      CLAUDE_CODE_OAUTH_TOKEN: `\${{ secrets.INTAKE_CLAUDE_CODE_OAUTH_TOKEN }}`,
+    },
+  });
+  assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 1);
+});
+
 // Convergence as a property, never as a hardcoded SHA. The daily
 // claude-lanes-repin lane rewrites these components on every ci-workflows
 // release, and a test naming one revision would go red by construction on