[kyle-sexton]

Refs: melodic-software/claude-code-account-rotation#259

Summary

Registers the runner-policy contract for ci-workflows v0.63.0 pr-review-cli.yml (8778094736e414233110f3e0d6d9948628ba77b5), so claude-code-plugins can move its live security review lane onto it.

Fix

• policy.json: a hosted-only contract, fixedRunsOn: ["ubuntu-24.04"], the inputs lane, publish, role, model-args, allowed-bot-sender-ids, allowed-author-ids, docs-only-paths, incremental-review and cli-version, and both reviews-role secrets: CLAUDE_API_KEY from REVIEWS_CLAUDE_API_KEY (tried first) and CLAUDE_CODE_OAUTH_TOKEN from REVIEWS_CLAUDE_CODE_OAUTH_TOKEN (after a key handoff).
• README.md: the v0.63.0 entry.
• runner-policy.test.mjs: pins the contract; the secret expressions are escaped template literals.

Supersedes the key-only #847.

Verification

• node --test components/runner-policy/runner-policy.test.mjs: 336 pass, 0 fail.
• node components/runner-policy/runner-policy.mjs --root .: passed.
• This branch's analyzer run against the claude-code-plugins security caller that moves to pr-review-cli.yml@8778094 with both secrets: passed; the currently synced policy rejects the same caller with runner-target-contract.
• biome and markdownlint clean on the changed files.

Related

• feat(review): add pr-review-cli, a review lane on run-claude-cli ci-workflows#862
• feat(runner-policy): register ci-workflows v0.60.0 intake and review contracts #842 (precedent), feat(runner-policy): register the ci-workflows v0.63.0 pr-review-cli contract #847 (closed, key-only)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T03:53:05.210166Z	2d477ce	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 2d477cebde42420f448c280eb29908d646f54123: 0 finding(s), 0 as inline comments.

Code review: no findings

I reviewed all 3 files in PR #848 (policy.json, README.md, runner-policy.test.mjs), which register the ci-workflows v0.63.0 pr-review-cli contract. I found nothing to flag.

• Contract shape: the new policy.json entry has the same shape as the neighbouring hosted-only review contracts. It uses routing: hosted-only and fixedRunsOn: ["ubuntu-24.04"]. The secrets use the ${{ secrets.REVIEWS_* }} expression form already used by the existing entries.
• Docs and tests: the README paragraph matches the contract: the same SHA, the same nine inputs and both secrets. The new test pins the full contract and asserts exactly one entry for that SHA. The escaped template literals produce the same strings as the JSON.
• Closing issue: the PR uses Refs:, so it closes nothing and there are no acceptance criteria to check. The body follows the PR body contract (Refs: line, then Summary, Fix, Verification, Related).
• Not independently verified:
  • I could not run the test suite or the analyzer, because the sandbox blocked the commands. The "336 pass" and analyzer results in the PR body are author-claimed.
  • I did not check the input and secret lists against the upstream pr-review-cli.yml at 8778094, because that repo is outside this PR's scope.
• Minor observation, not a finding: the v0.62.0 README entry records its registration date, and the new v0.63.0 entry does not. It is not required by anything I could find.

[github-actions]

claude-security-review reviewed 2d477cebde42420f448c280eb29908d646f54123: 0 finding(s), 0 as inline comments.

Security review: PR 848 (head 2d477ce)

No security findings. No inline comments posted.

critical-findings: 0

Scope. The PR adds one hosted-only reusable-workflow contract for ci-workflows/.github/workflows/pr-review-cli.yml@8778094736e414233110f3e0d6d9948628ba77b5 to components/runner-policy/policy.json, plus a README entry and a pinning test. The policy file is the org's trust allowlist, so I reviewed it rather than applying the skip gate.

Checked (policy.json L756-L773):

• The reference is pinned to a full 40-character commit SHA.
• Routing is hosted-only with fixedRunsOn: ["ubuntu-24.04"], and no runner input is admitted, so a caller cannot redirect jobs to another runner.
• Only CLAUDE_API_KEY and CLAUDE_CODE_OAUTH_TOKEN are admitted, each mapped to a REVIEWS_-prefixed secret. This matches the existing AUTOMATIONS_ contracts, and the test at runner-policy.test.mjs line 3816 already has a REVIEWS_CLAUDE_API_KEY precedent.
• The nine admitted inputs include two caller-supplied trust lists, allowed-bot-sender-ids and allowed-author-ids. Whether the workflow honors them is a property of the pinned workflow, not of this diff.
• No instruction surfaces (CLAUDE.md, AGENTS.md, rules, skills, hooks) are changed, and no plugin manifests are touched, so there are no manifest <field> lines.
• The PR body contains no embedded instructions aimed at the reviewer.

Not verified. I could not read the pinned pr-review-cli.yml source or confirm that the SHA is the v0.63.0 tag commit, because the approval prompt for the gh api call went unanswered. I did not confirm what the workflow does with the two secrets (the README says the OAuth token is used only after the API-key handoff). This is a residual note for the merger, not a finding.

The instruction-exception register was not consulted, because the diff has no instruction-surface changes.