From 75454e5023733ab05a62d846d6cbe86fbc997297 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 25 Oct 2026 19:46:32 -0400
Subject: [PATCH] feat(runner-policy): register the ci-workflows v0.65.11
 intake-triage and pr-review-cli contracts

Copies the v0.65.10 intake-triage and v0.65.9 pr-review-cli entries forward
verbatim to e5167fc29d948ab7d0923cf62f5ea9eeeef8e9e8 (ci-workflows#889),
keeping past pins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 components/runner-policy/README.md            |  5 ++
 components/runner-policy/policy.json          | 47 +++++++++++++++++++
 .../runner-policy/runner-policy.test.mjs      | 18 +++++++
 3 files changed, 70 insertions(+)

diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md
index 9ef73006..87b064e6 100644
--- a/components/runner-policy/README.md
+++ b/components/runner-policy/README.md
@@ -1433,6 +1433,11 @@ entry at `b0ecc273abe492d12f2efa98ee4741a84c219ed2`: the apply job keeps an
 existing Issue Type, a permission denial on an otherwise clean triage applies
 nothing, and the new `triage-deferred` output reports that deferral
 (ci-workflows#887), with no input, secret, permission or routing change.
+At the v0.65.11 tag `e5167fc29d948ab7d0923cf62f5ea9eeeef8e9e8`, the
+`intake-triage` contract is copied forward verbatim from v0.65.10 and the
+`pr-review-cli` contract from v0.65.9: the lane-outcome record gains the
+leg's token usage and rate-limit windows (ci-workflows#889), with no input,
+secret, permission or routing change.
 The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e`
 uses its reviewed `runner` input and checksum-verified native Linux binary, so
 enrolled consumers may route that advisory lane onto the managed fleet
diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json
index 4513089b..c4f0236d 100644
--- a/components/runner-policy/policy.json
+++ b/components/runner-policy/policy.json
@@ -385,6 +385,32 @@
         "issues": "write"
       }
     },
+    "melodic-software/ci-workflows/.github/workflows/intake-triage.yml@e5167fc29d948ab7d0923cf62f5ea9eeeef8e9e8": {
+      "routing": "runner-input",
+      "runnerInput": "runner",
+      "role": "intake",
+      "allowedInputs": [
+        "runner",
+        "allowed-labels",
+        "escalation-label",
+        "floor-label",
+        "instructions",
+        "cli-version",
+        "claude-args",
+        "issue-number",
+        "allowed-author-ids",
+        "allowed-bot-sender-ids",
+        "role"
+      ],
+      "allowedSecrets": {
+        "CLAUDE_API_KEY": "${{ secrets.INTAKE_CLAUDE_API_KEY }}",
+        "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.INTAKE_CLAUDE_CODE_OAUTH_TOKEN }}"
+      },
+      "allowedCallerPermissions": {
+        "contents": "read",
+        "issues": "write"
+      }
+    },
     "melodic-software/ci-workflows/.github/workflows/pr-review.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
       "routing": "runner-input",
       "runnerInput": "runner",
@@ -1142,6 +1168,27 @@
         "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.REVIEWS_CLAUDE_CODE_OAUTH_TOKEN }}"
       }
     },
+    "melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@e5167fc29d948ab7d0923cf62f5ea9eeeef8e9e8": {
+      "routing": "hosted-only",
+      "fixedRunsOn": ["ubuntu-24.04"],
+      "allowedInputs": [
+        "lane",
+        "publish",
+        "role",
+        "model-args",
+        "allowed-bot-sender-ids",
+        "allowed-author-ids",
+        "docs-only-paths",
+        "incremental-review",
+        "cli-version",
+        "hold-label",
+        "hold-paths"
+      ],
+      "allowedSecrets": {
+        "CLAUDE_API_KEY": "${{ secrets.REVIEWS_CLAUDE_API_KEY }}",
+        "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.REVIEWS_CLAUDE_CODE_OAUTH_TOKEN }}"
+      }
+    },
     "melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
       "routing": "runner-input",
       "runnerInput": "runner",
diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs
index 723a77cd..af791d52 100644
--- a/components/runner-policy/runner-policy.test.mjs
+++ b/components/runner-policy/runner-policy.test.mjs
@@ -10082,6 +10082,24 @@ test("the intake-triage contract at the v0.65.10 tag copies its b0ecc27 entry fo
   assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 1);
 });
 
+// v0.65.11 adds the leg's token usage and rate-limit windows to the
+// lane-outcome record (ci-workflows#889). Inputs, secrets and job permissions
+// are unchanged, so both lane contracts copy forward.
+test("the intake-triage and pr-review-cli contracts at the v0.65.11 tag copy their prior entries forward verbatim", () => {
+  const contracts = BASE_POLICY.approvedReusableWorkflowContracts;
+  const key = (wf, sha) => `melodic-software/ci-workflows/.github/workflows/${wf}@${sha}`;
+  const sha = "e5167fc29d948ab7d0923cf62f5ea9eeeef8e9e8";
+  assert.deepEqual(
+    contracts[key("intake-triage.yml", sha)],
+    contracts[key("intake-triage.yml", "215cec5c362f953f8b6196effb04451696c3f970")],
+  );
+  assert.deepEqual(
+    contracts[key("pr-review-cli.yml", sha)],
+    contracts[key("pr-review-cli.yml", "4fbceb4b75ffd568dfa5db31de0d0e753c0c64e6")],
+  );
+  assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 2);
+});
+
 // Convergence as a property, never as a hardcoded SHA. The daily
 // claude-lanes-repin lane rewrites these components on every ci-workflows
 // release, and a test naming one revision would go red by construction on