[kyle-sexton]

No related issue: lane-funding roles plan (D)5, owner-approved 2026-10-24.

Summary

Registers intake-triage.yml@b0ecc273abe492d12f2efa98ee4741a84c219ed2 on the intake funding role, so claude-code-plugins' intake caller can read INTAKE_CLAUDE_API_KEY and INTAKE_CLAUDE_CODE_OAUTH_TOKEN instead of the AUTOMATIONS_* pair.

Fix

A contract carries one role, and its caller must pass that literal (runner-policy.mjs, the role check in the reusable-call audit). Changing the v0.65.0 entry in place would fail runner-policy on claude-code-plugins' sync PR, whose caller still passes role: automations. So this adds a contract at a new SHA and leaves the v0.65.0 entry until the caller repins, as the v0.51.0 registration did.

b0ecc27 is ci-workflows main, one commit past v0.65.0 that changes only docs/conventions/source-control/commit-convention.yml (git diff v0.65.0 b0ecc27 -- .github is empty). It is untagged, so the caller pin takes the pin-comment convention's fallback form. The entry is the v0.65.0 entry with role: intake and the two INTAKE_* secrets; inputs, routing and caller permissions are unchanged.

Verification

• node --test runner-policy.test.mjs in components/runner-policy: 342 pass. That count includes the new test, which checks the b0ecc27 entry deep-equals the v0.65.0 entry apart from role and secrets, and that one contract names the new SHA.

Related

• Same shape as #856 (v0.65.0).
• Next: the standards sync into claude-code-plugins, then that repository's intake, pr-unblock and pr-verify wiring PR.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T02:26:50.478268Z	449f502	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 449f502cb28c65c56db1cb3059eebedf901d4a45: 0 finding(s), 0 as inline comments.

Security review: PR #863 at 449f502

Result: no security findings.

The PR adds one allowlist entry to components/runner-policy/policy.json. The entry is intake-triage.yml@b0ecc273abe492d12f2efa98ee4741a84c219ed2. It also adds a test that checks the entry against the prior one.

• Copied contract: The new entry is the d02b8697… entry copied over. Only two things change: role goes from automations to intake, and the two secret mappings go from AUTOMATIONS_* to INTAKE_CLAUDE_API_KEY and INTAKE_CLAUDE_CODE_OAUTH_TOKEN. The allowed inputs and the caller permissions (contents: read, issues: write) are the same as the prior entry's. Nothing is widened.
• Pin: The reference is a full 40-character commit SHA, not a tag or branch.
• Secrets: The entry names exact secret mappings, not secrets: inherit or a wildcard. This moves the workflow onto a separate funding role. It does not give it a wider credential.
• Test: The new test asserts exact deep-equality with the prior entry plus the role and secrets override. It also asserts the new SHA appears exactly once, so any other difference in the entry would fail it.
• intake role: This is the first "role": "intake" in policy.json (the other nine are automations). I didn't find anywhere else in the policy that defines or validates role names. A role that doesn't exist yet would fail the approved-contract check, so it can't be used to bypass it. This is not a finding.
• Instruction surfaces and manifests: The diff doesn't touch AGENTS.md, rules files, hooks, a skill or agent body, or any plugin manifest. No manifest <field> lines apply.
• Trust-gate paths: It doesn't touch .github/standards/trusted-actors/**, check-trusted-trigger, CODEOWNERS or .gitmodules. No hold is needed.
• Not checked: The commit message says b0ecc27 has no .github change from v0.65.0. I couldn't check that from this checkout, so I took it from the message.

critical-findings: 0

[github-actions]

claude-review reviewed 449f502cb28c65c56db1cb3059eebedf901d4a45: 0 finding(s), 0 as inline comments.

No findings. I reported nothing inline.

What the PR does. It adds a contract in components/runner-policy/policy.json for intake-triage.yml@b0ecc273… on the intake funding role, plus one test in runner-policy.test.mjs.

What I checked.

• Contract content. The new entry (policy.json:336-361) matches the d02b8697… entry (policy.json:310-335) in routing, runnerInput, allowedInputs and allowedCallerPermissions. The only differences are role: "intake" and the two secrets, as the PR says.
• Secret names. runner-policy.mjs:243-246 accepts the plain secret name or one prefixed with the role in upper case. For intake, INTAKE_CLAUDE_API_KEY and INTAKE_CLAUDE_CODE_OAUTH_TOKEN fit that rule. allowedInputs includes role, which runner-policy.mjs:234 requires when a role is declared.
• Role is a free literal. Nothing in runner-policy.mjs lists the valid roles. A caller must pass the contract's role as a literal (runner-policy.mjs:977). Registering a new SHA and leaving the v0.65.0 entry matches the stated reason: the old caller still passes role: automations.
• New test. It looks at the right entries and would catch drift in the new entry's inputs, routing or permissions. It also checks that exactly one contract names the new SHA.

Not verified.

• I could not run node --test runner-policy.test.mjs. The sandbox refused the command, so the PR's "342 pass" is author-claimed and I did not reproduce it.
• The claim that git diff v0.65.0 b0ecc27 -- .github is empty concerns another repository, so I did not check it.

PR body contract. The body has the No related issue: line and the Summary, Fix, Verification and Related sections. There is no closing issue, so there were no acceptance criteria to check.

Hold classes. None apply. The change adds no model spend, touches no trusted-actor or CODEOWNERS files, and has no critical security finding.