[kyle-sexton]

Refs: melodic-software/ci-workflows#887

Summary

Registers the intake-triage.yml reusable-workflow contract at ci-workflows
v0.65.10
(215cec5c362f953f8b6196effb04451696c3f970), so claude-code-plugins can repin
its intake caller from b0ecc273abe492d12f2efa98ee4741a84c219ed2 and pass
runner-policy.

Fix

• Copies the intake-role entry at @b0ecc273abe492d12f2efa98ee4741a84c219ed2
  forward verbatim in components/runner-policy/policy.json. The b0ecc27 and
  earlier entries stay as history.
• Adds the matching copy-forward test in runner-policy.test.mjs and a
  rollout line in the component README.
• v0.65.10 (ci-workflows#887)
  keeps an existing Issue Type, applies nothing on a permission denial over an
  otherwise clean triage, adds the triage-deferred workflow_call output, and
  logs denied tools inside ::stop-commands::. git diff b0ecc27 215cec5 -- .github/workflows/intake-triage.yml changes no input, secret or job
  permission.

Verification

• node --test components/runner-policy/runner-policy.test.mjs: 352 pass, 0 fail.
• node components/runner-policy/runner-policy.mjs --root <worktree>: Runner policy passed.
• biome ci on the two changed code files and markdownlint-cli2 on the README: clean.

Related

• melodic-software/ci-workflows#887 (released as v0.65.10)
• #863 (the b0ecc27 intake-role contract)
• Next: the standards sync into claude-code-plugins, then its intake caller repin.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T15:09:38.400321Z	37b2e08	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 37b2e08960d50cfb7907ed02ef1d02f01219d67e: 0 finding(s), 0 as inline comments.

Security review: PR #879 (head 37b2e08)

No security findings.

critical-findings: 0

Scope. The PR changes three files: components/runner-policy/policy.json, components/runner-policy/runner-policy.test.mjs and the component README. It adds one allowlist entry, for intake-triage.yml at ci-workflows v0.65.10 (215cec5c…). The test and README additions are documentation and test only.

What I checked.

• The new policy.json entry matches the existing intake-triage.yml@b0ecc273… entry field for field, by reading both. It has the same routing, runner-input, the same role intake, and the same 11 allowed inputs. The secrets are INTAKE_CLAUDE_API_KEY and INTAKE_CLAUDE_CODE_OAUTH_TOKEN, and the caller permissions are contents: read and issues: write. Nothing is widened.
• The new contract is pinned to a full 40-character commit SHA, not a tag or branch.
• The new test asserts that the entry is a deep copy of the b0ecc27 entry and that exactly one entry exists for the new SHA. That keeps the copy-forward from drifting silently.
• No pull_request_target, workflow_run, expression-injection or permission-widening change, and no unpinned action or dependency pin.
• This is a policy allowlist that approves a reusable-workflow ref for callers. It is not a trusted-path change (not trusted-actors, check-trusted-trigger, CODEOWNERS or .gitmodules), and it removes no instruction or guardrail. No plugin manifest changed, so no manifest <field> lines apply.

Not verified. The PR claims that git diff b0ecc27 215cec5 -- .github/workflows/intake-triage.yml changes no input, secret or job permission. I tried to confirm this against the upstream compare, but the sandbox required approval for that call. I did not run it, so that claim rests on the PR description. If it is wrong, the copied entry could under-describe the new contract's inputs or secrets. That would make the policy stricter than the workflow, not looser. A new input the policy didn't list would be rejected by the policy check. I did not run the policy check or its tests.

Hold. No hold field applies.

[github-actions]

claude-review reviewed 37b2e08960d50cfb7907ed02ef1d02f01219d67e: 0 finding(s), 0 as inline comments.

No findings.

This PR registers the intake-triage.yml contract at ci-workflows v0.65.10 (215cec5) by copying the intake-role entry from b0ecc27.

• Policy entry: I read policy.json lines 336–387 and the new entry matches the b0ecc27 entry field for field. That covers routing, role, the 11 allowed inputs, both secret mappings and the caller permissions (contents: read, issues: write). This confirms the PR's "verbatim copy" claim.
• Test: the new copy-forward test compares the two entries with deepEqual and asserts exactly one key ends in the new SHA. It follows the existing v0.65.9 pattern.
• README: the rollout line states the SHA and the behaviour change, and says no input, secret, permission or routing change. The new policy.json entry supports that last claim.
• Other files: the b0ecc27 SHA appears only in policy.json, README.md and runner-policy.test.mjs, which are the three files this PR changes. No other file cites it.
• Closing issue: the PR uses Refs: melodic-software/ci-workflows#887, so no issue closes and there are no acceptance criteria to check.
• PR body: it follows the contract (Refs:, Summary, Fix, Verification, Related).

I did not run the test suite or the runner-policy check. The Bash tool refused my node and cd commands pending approval. The 352-pass result in the PR's Verification section is the author's claim and I have not checked it. I also did not compare the v0.65.10 workflow file itself against b0ecc27, so the claim that no input, secret or permission changed is also the author's.