[kyle-sexton]

Refs: melodic-software/ci-workflows#890

Summary

Registers the intake-triage.yml and pr-review-cli.yml reusable-workflow
contracts at ci-workflows
v0.65.12
(78ee7a2609a84b0073c5e09dfe3bc59613e689dc), so claude-code-plugins can repin
its intake and review callers and pass runner-policy.

Fix

• Copies the v0.65.11 intake-triage and pr-review-cli entries
  (@e5167fc29d948ab7d0923cf62f5ea9eeeef8e9e8) forward in
  components/runner-policy/policy.json and adds one secret to each:
  FALLBACK_CLAUDE_CODE_OAUTH_TOKEN mapped to
  ${{ secrets.FALLBACK_CLAUDE_CODE_OAUTH_TOKEN }}. Past entries stay.
• Why not a verbatim copy, as in feat(runner-policy): register the ci-workflows v0.65.11 intake-triage and pr-review-cli contracts #880: v0.65.12 includes
  ci-workflows#890,
  which adds that optional workflow_call secret to both workflows for the
  third, fallback job. runner-policy rejects a caller secret the contract does
  not list (exactCanonicalMap, "has unapproved properties"), so without the
  mapping the repinned callers could not pass the secret and the fallback leg
  would never run. Inputs and job permissions are unchanged between the two
  tags.
• Adds a test that each v0.65.12 entry equals its v0.65.11 entry plus exactly
  that secret, and a rollout line in the component README.

Verification

• node --test components/runner-policy/runner-policy.test.mjs: 354 pass, 0 fail.
• node components/runner-policy/runner-policy.mjs --root <worktree>: Runner policy passed.
• Pre-commit biome, markdownlint, typos and gitleaks: clean.

Related

• melodic-software/ci-workflows#890 and #891 (released as v0.65.12)
• #880 (v0.65.11 contracts)
• Next: the standards sync into claude-code-plugins, then the lane caller repin, which passes the fallback secret.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T01:29:09.756011Z	9b268af	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 9b268af8855ddfde5cf64758678bab4092628c25: 0 finding(s), 0 as inline comments.

No findings.

I read the whole diff (3 files) and the PR context. I also compared the new entries against the v0.65.11 entries in components/runner-policy/policy.json (lines 388 and 1198) by reading both side by side. I did not run the tests or the policy check, so the verification numbers in the PR body are author-claimed.

• intake-triage.yml@78ee7a26…: it has the same routing, runnerInput, role, allowedInputs and allowedCallerPermissions as the v0.65.11 entry. The only addition is FALLBACK_CLAUDE_CODE_OAUTH_TOKEN, mapped to ${{ secrets.FALLBACK_CLAUDE_CODE_OAUTH_TOKEN }}.
• pr-review-cli.yml@78ee7a26…: same result against its v0.65.11 entry. Routing, fixedRunsOn and allowedInputs are unchanged, and the only addition is the same secret mapping.
• Test: the new deepEqual test in runner-policy.test.mjs checks each v0.65.12 entry against its v0.65.11 entry plus that one secret. It also asserts exactly two entries exist at the new SHA, so a copy of the wrong base entry or a stray extra key would fail it.
• README: the rollout paragraph follows the existing per-tag pattern and states the change accurately, including that no input, permission or routing changed.
• Closing issue: the PR uses Refs: and closes nothing, so there are no acceptance criteria to check.
• Body contract: the body follows .claude/rules/pr-body-contract.md (a Refs: line, then ## Summary, ## Fix, ## Verification and ## Related).
• Held for a person: nothing. The change adds an org secret mapping to a policy allowlist and starts no billed resource.
• Plugin manifests: none are touched.

[github-actions]

claude-security-review reviewed 9b268af8855ddfde5cf64758678bab4092628c25: 0 finding(s), 0 as inline comments.

No security findings. PR #881 (head 9b268af) registers two new SHA-pinned ci-workflows v0.65.12 contracts (intake-triage.yml and pr-review-cli.yml @ 78ee7a26…) in components/runner-policy/policy.json, with matching README and test edits.

I read the diff with gh pr diff 881 (no FULL DIFF: file was named) and compared each new entry with its v0.65.11 predecessor in policy.json. Each is a field-for-field copy (routing, runner input, role, allowed inputs, caller permissions, fixedRunsOn). The only addition is allowedSecrets.FALLBACK_CLAUDE_CODE_OAUTH_TOKEN, mapped to the fixed expression ${{ secrets.FALLBACK_CLAUDE_CODE_OAUTH_TOKEN }}. There is no input, permission or routing widening, no unpinned reference, and no consumer-controlled path to the secret. The new test asserts the new entries equal the prior entries plus only that secret. No trusted-path file, plugin manifest or standing instruction is touched, so the instruction exception register wasn't consulted.

Design note, not a finding: the fallback secret is one org-wide credential shared by the intake lane (which reads untrusted issue content) and the review lane, where the other secrets are split per role. The README and test comment say this is intentional. The org secret's repository scoping is outside this diff.

critical-findings: 0