[kyle-sexton]

Refs: melodic-software/claude-code-plugins#12286

Summary

The source-control plugin reads its team settings from docs/conventions/source-control.yaml (claude-code-plugins ADR 0064) and will stop reading .claude/source-control.md once claude-code-plugins#9737 lands. Without this move, this repository loses commit-subject enforcement, its PR-body section list and its c3-autonomous merge rung.

Fix

• Adds docs/conventions/source-control.yaml with every key the legacy file set (subject_pattern, pr_title_pattern, pr_body_required_sections, babysit_loop_merge), values unchanged.
• Deletes .claude/source-control.md.
• Moves the one reader in this repository: .github/scripts/pr-section-drift.mjs (the advisory check-pr-sections lane) now reads pr_body_required_sections from the YAML's top-level block sequence instead of the legacy H2. Its tests cover the YAML shape: key-scoped read that stops at the next key, quoted and unindented items, a nested key of the same name ignored, missing, empty and repeated keys.
• Updates the path in CLAUDE.md, README.md and the pr-require-checks.yml comment above check-pr-sections.

Verification

Value parity, from a script that parses every H2 of the legacy file and every key of the YAML:

Legacy .claude/source-control.md at origin/main vs docs/conventions/source-control.yaml at HEAD:

Key	Old value	New value	Result
subject_pattern	Conventional Commits	Conventional Commits	MATCH
pr_title_pattern	Same as `subject_pattern`.	Same as `subject_pattern`.	MATCH
pr_body_required_sections	[Summary, Fix, Verification, Related]	[Summary, Fix, Verification, Related]	MATCH
babysit_loop_merge	c3-autonomous	c3-autonomous	MATCH

4 legacy keys, 4 YAML keys, 0 not MATCH

• node --test .github/scripts/pr-section-drift.test.mjs: 27 pass, 0 fail.
• node .github/scripts/pr-section-drift.mjs on this branch: local mirrors match ...check-contract/run.sh@594987abe8657a40bccc13d301f1f0d5cccb5348 section_report calls [Summary, Fix, Verification, Related].
• claude-code-plugins origin/main readers on this branch: convention-key.sh layer prints yaml for all four keys; resolve-convention-pattern.sh expands Conventional Commits for subject_pattern and pr_title_pattern, now from docs/conventions/source-control.yaml.
• babysit_repo_config.py loop-keys melodic-software/.github before this PR: babysit_loop_merge = c3-autonomous from .claude/source-control.md (legacy), adopted: true. Rerun after merge is recorded on claude-code-plugins#12286.
• check-jsonschema==0.39.0 against plugins/source-control/schemas/source-control.schema.json: ok.

Related

• Refs chore: move other repositories' .claude/source-control.md keys to docs/conventions/source-control.yaml claude-code-plugins#12286 (this migration across repositories)
• Refs chore: drop the one-release .claude config reads and this repository's old config files claude-code-plugins#9737 (removes the legacy reads)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T16:54:03.847873Z	3704144	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 370414420e4913bd7f7a2df92797b9550e52f041: 0 finding(s), 0 as inline comments.

No security findings.

This PR moves the team-layer source-control settings from .claude/source-control.md to docs/conventions/source-control.yaml. It also updates the pr-section-drift.mjs parser and tests, a comment in pr-require-checks.yml, and the README and CLAUDE.md references.

• Trust controls: The diff doesn't touch any trust control: no trusted-actor list, token scope, kill switch, merge hold, .github/actions/* file or docs/conventions/pr-pipeline.yaml. The only workflow change is a comment.
• Settings carried over: subject_pattern: Conventional Commits, the four required PR-body sections (Summary, Fix, Verification, Related) and babysit_loop_merge: c3-autonomous are the same as in the deleted file. pr_title_pattern goes from "Same as subject_pattern." in the old Markdown to the same string quoted in YAML. The merge-lane setting is not widened.
• Instruction-surface deletion: The deleted .claude/source-control.md held configuration values, not a guardrail. The new file keeps every rule, so nothing is removed. I did not read the instruction exception register, which is not in this diff.
• Parser change: The new YAML parsing in pr-section-drift.mjs is a line-based read of repo-tracked files. It uses a fixed regex, with no command, path, template or SQL injection surface, and no secrets or tokens. A malformed file fails the drift lane closed (DriftError) rather than passing. Failing closed is the safe direction for a lane that only compares section lists.
• Not checked: Whether the external source-control plugin reads the new docs/conventions/source-control.yaml path is outside this repository and this diff.
• Manifests: No plugin manifest is touched.

critical-findings: 0

[github-actions]

claude-review reviewed 370414420e4913bd7f7a2df92797b9550e52f041: 0 finding(s), 0 as inline comments.

No blocking or advisory findings on #228. I read the full diff and the PR context, and grepped the repo for leftover references to the old path. I did not run the tests; the "27 pass" and parity-table results are author-claimed and unverified.

• Parser logic: I traced the new parseSourceControlSections by hand.
  • A top-level pr_body_required_sections: key, with an optional trailing comment, starts the read.
  • Blank and comment lines are skipped, indented or unindented - item lines are collected, and an unindented non-- line ends the list.
  • A nested key of the same name is not matched, a repeated key throws, and quoted items are unquoted.
  • The new tests cover each of those cases.
• Stale references: none. The only remaining .claude/source-control.md mentions in tracked files were the ones the PR updates (CLAUDE.md, README.md, the workflow comment, the script header). The check-contract comparison still reports the right file name in drift errors (source-control.yaml).
• Value parity: the four keys in the YAML match the deleted markdown file.
• Unverified (not counted as findings):
  • The README still says the source-control settings resolve a "gitignored *.local.* overlay", but .gitignore only covers .claude/*.local.* (.gitignore:23). If the new overlay sits beside docs/conventions/source-control.yaml, nothing ignores it, so it could be committed by accident. I could not check the plugin's overlay location, so please confirm. If it is next to the YAML, add an ignore rule.
  • The YAML header links the loop-lane doc at docs/contracts/loop-lane/README.md, where the old file used docs/conventions/loop-lane/README.md. This is probably an upstream rename, but I could not fetch it to confirm.
• Scope: .claude-lane/, .claude/source-control.md and the CLAUDE.md modification in the local working tree are not part of the PR diff.