From 37b2e08960d50cfb7907ed02ef1d02f01219d67e Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 25 Oct 2026 11:08:13 -0400
Subject: [PATCH] feat(runner-policy): register the ci-workflows v0.65.10
 intake-triage contract

Copies the intake-role entry at b0ecc27 forward verbatim to the v0.65.10
tag 215cec5. The release adds the triage-deferred output and changes no
input, secret or job permission (ci-workflows#887).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 components/runner-policy/README.md            |  6 +++++
 components/runner-policy/policy.json          | 26 +++++++++++++++++++
 .../runner-policy/runner-policy.test.mjs      | 12 +++++++++
 3 files changed, 44 insertions(+)

diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md
index 7e95dcf6..9ef73006 100644
--- a/components/runner-policy/README.md
+++ b/components/runner-policy/README.md
@@ -1427,6 +1427,12 @@ At the v0.64.1 tag `9aca743c4ed9aaf7870288a36586c3994e9321e4`, the
 keeps valid review comments past a malformed one and fails the status job in
 comments mode when no review happened (ci-workflows#868), with no input,
 secret, permission or routing change.
+At the v0.65.10 tag `215cec5c362f953f8b6196effb04451696c3f970`, the
+`intake-triage` contract is copied forward verbatim from its `intake`-role
+entry at `b0ecc273abe492d12f2efa98ee4741a84c219ed2`: the apply job keeps an
+existing Issue Type, a permission denial on an otherwise clean triage applies
+nothing, and the new `triage-deferred` output reports that deferral
+(ci-workflows#887), with no input, secret, permission or routing change.
 The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e`
 uses its reviewed `runner` input and checksum-verified native Linux binary, so
 enrolled consumers may route that advisory lane onto the managed fleet
diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json
index e3ced7a4..4513089b 100644
--- a/components/runner-policy/policy.json
+++ b/components/runner-policy/policy.json
@@ -359,6 +359,32 @@
         "issues": "write"
       }
     },
+    "melodic-software/ci-workflows/.github/workflows/intake-triage.yml@215cec5c362f953f8b6196effb04451696c3f970": {
+      "routing": "runner-input",
+      "runnerInput": "runner",
+      "role": "intake",
+      "allowedInputs": [
+        "runner",
+        "allowed-labels",
+        "escalation-label",
+        "floor-label",
+        "instructions",
+        "cli-version",
+        "claude-args",
+        "issue-number",
+        "allowed-author-ids",
+        "allowed-bot-sender-ids",
+        "role"
+      ],
+      "allowedSecrets": {
+        "CLAUDE_API_KEY": "${{ secrets.INTAKE_CLAUDE_API_KEY }}",
+        "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.INTAKE_CLAUDE_CODE_OAUTH_TOKEN }}"
+      },
+      "allowedCallerPermissions": {
+        "contents": "read",
+        "issues": "write"
+      }
+    },
     "melodic-software/ci-workflows/.github/workflows/pr-review.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
       "routing": "runner-input",
       "runnerInput": "runner",
diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs
index daeb7547..723a77cd 100644
--- a/components/runner-policy/runner-policy.test.mjs
+++ b/components/runner-policy/runner-policy.test.mjs
@@ -10070,6 +10070,18 @@ test("the pr-review-cli contract at the v0.65.9 tag copies its v0.65.8 entry for
   assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 1);
 });
 
+// v0.65.10 keeps an existing Issue Type, applies nothing on a permission
+// denial over an otherwise clean triage, and adds the triage-deferred output
+// (ci-workflows#887). Inputs, secrets and job permissions are unchanged, so
+// the intake-role contract at b0ecc27 copies forward.
+test("the intake-triage contract at the v0.65.10 tag copies its b0ecc27 entry forward verbatim", () => {
+  const contracts = BASE_POLICY.approvedReusableWorkflowContracts;
+  const key = (sha) => `melodic-software/ci-workflows/.github/workflows/intake-triage.yml@${sha}`;
+  const sha = "215cec5c362f953f8b6196effb04451696c3f970";
+  assert.deepEqual(contracts[key(sha)], contracts[key("b0ecc273abe492d12f2efa98ee4741a84c219ed2")]);
+  assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 1);
+});
+
 // Convergence as a property, never as a hardcoded SHA. The daily
 // claude-lanes-repin lane rewrites these components on every ci-workflows
 // release, and a test naming one revision would go red by construction on