[kyle-sexton]

Refs: melodic-software/ci-workflows#889

Summary

Registers the intake-triage.yml and pr-review-cli.yml reusable-workflow
contracts at ci-workflows
v0.65.11
(e5167fc29d948ab7d0923cf62f5ea9eeeef8e9e8), so claude-code-plugins can repin
its intake and review callers and pass runner-policy.

Fix

• Copies the v0.65.10 intake-triage entry (@215cec5c362f953f8b6196effb04451696c3f970)
  and the v0.65.9 pr-review-cli entry (@4fbceb4b75ffd568dfa5db31de0d0e753c0c64e6)
  forward verbatim in components/runner-policy/policy.json. Past entries stay.
• Adds the matching copy-forward test in runner-policy.test.mjs and a
  rollout line in the component README.
• v0.65.11 (ci-workflows#889)
  passes log-file to report-lane-outcome, which records per-leg token usage
  and rate-limit windows. In both workflows the diff adds only that with:
  line: no input, secret or job permission changes.

Verification

• node --test components/runner-policy/runner-policy.test.mjs: 353 pass, 0 fail.
• node components/runner-policy/runner-policy.mjs --root <worktree>: Runner policy passed.
• Pre-commit biome and markdownlint: clean.

Related

• melodic-software/ci-workflows#889 (released as v0.65.11)
• #879 (v0.65.10 intake contract), #878 (v0.65.9 review contract)
• Next: the standards sync into claude-code-plugins, then the lane caller repin.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T23:48:04.809535Z	75454e5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 75454e5023733ab05a62d846d6cbe86fbc997297: 0 finding(s), 0 as inline comments.

No findings.

What I checked

• components/runner-policy/policy.json: I compared the new intake-triage.yml@e5167fc… entry with the @215cec5c… entry (lines 362-387). Routing, role, allowed inputs, secrets and caller permissions are identical. I compared the new pr-review-cli.yml@e5167fc… entry with the @4fbceb4b… entry (lines 1150-1170). Routing, fixed runner, inputs and secrets are identical. This matches the PR's "verbatim copy-forward, no input/secret/permission/routing change" claim. Older entries are kept.
• components/runner-policy/runner-policy.test.mjs: the new test asserts deep equality against the same two source SHAs the PR names. It also asserts that exactly two contracts end in the new SHA. A drifted copy would fail it.
• components/runner-policy/README.md: the rollout line gives the tag SHA and the source version of each copied contract, which matches the policy entries.
• Closing issue: the PR uses Refs: for ci-workflows#889, which is in another repo and is not closed. There is no closing-issue section in the context file, so there were no acceptance criteria to check.
• PR body: it follows the contract (Refs line, Summary, Fix, Verification, Related).
• Path-scoped rules: .claude/rules/pr-body-contract.md has no paths: glob that matches a changed file.

Not verified

• I could not run node --test or the policy validator here, because the sandbox refused the compound Bash commands. The PR's "353 pass" and "Runner policy passed" are author-claimed and unverified by me.
• I did not read the upstream ci-workflows v0.65.11 diff, so the claim that only a log-file line changed is author-claimed.

[github-actions]

claude-security-review reviewed 75454e5023733ab05a62d846d6cbe86fbc997297: 0 finding(s), 0 as inline comments.

No security findings.

critical-findings: 0

The PR adds two approved-workflow contract entries to components/runner-policy/policy.json for the ci-workflows v0.65.11 pin (e5167fc29d948ab7d0923cf62f5ea9eeeef8e9e8). It also adds a README paragraph and a test asserting the copy-forward.

• intake-triage.yml@e5167fc: the entry matches the existing @215cec5 entry field for field (routing, runnerInput, role, allowedInputs, allowedSecrets, allowedCallerPermissions). I compared them by reading both blocks side by side (policy.json lines 362-387 against the new block). It widens no input, secret, permission or routing.
• pr-review-cli.yml@e5167fc: the entry matches the existing @4fbceb4 entry (hosted-only, fixedRunsOn: ubuntu-24.04, same inputs, same secrets). Nothing is widened.
• New test: it asserts deepEqual between each new entry and its predecessor, and that exactly two contracts end in the new SHA. This guards against drift between the entries.
• No plugin manifest changes and no instruction-surface deletions. No trusted-path globs matched.
• Not verified: I could not check that e5167fc… is the actual v0.65.11 tag commit in ci-workflows. The sandbox blocked the extra gh api and node calls, so this rests on the PR's claim. The pin is a full 40-character SHA, and the claims about inputs, secrets and permissions being unchanged are consistent with the diff.
• Instruction-exception register: not consulted, because the diff removes no instructions.