[melodic-automation-lanes]

Refs: #12689

Summary

Opened by the work-resolve-issue lane. The run's own summary:

27 of the issue's 28 rows are fixed in work-items and context-budget. Each restated upstream value (permission rule matching, when git sets core.worktree, gh flags and --limit defaults, GitHub search qualifiers, REST pagination and assignee responses, closing keywords and linkage, includeClosedPrs, cloud-session API refusals, issue form labels, what /context, /skill-doctor and /doctor cover, the skill listing budget unit) is deleted. The local decision stays in the repo's own words, and a pointer to the upstream section carries an as-of 2026-11-03 date and a recheck trigger. I read each pointer this run. Where the upstream page does not document the fact, the pointer goes to the local record instead and says so: the Jira resolution search (setup to providers.md "jira", because the Atlassian page renders only in JavaScript), explain-usage (native-explain-usage.md, after finding no upstream page), and the System tools skill-listing effect (engine.md now records it as the engine's own observation, since the /context row does not itemize the bucket). Row r478 (attend-queue rate-limit floor) is left open: that block must stay byte-identical with the rate-limit-guard reader contract and four copies in other plugins.

Remaining work

• r478: plugins/work-items/skills/attend-queue/SKILL.md 'Account switch' floor (lines ~318-333). The block must stay byte-identical with plugins/rate-limit-guard/reference/reader-contract.md and its copies in work-loop, source-control babysit-loop and watch-handoff, docs-hygiene extract-ssot and…

Not verified

• check-stamps.sh --trigger-less was not run: this lane's Bash runs only the named wrappers. I checked its trigger condition by hand (see verification); left to the PR's CI or a reviewer
• Tidy skipped: the change is 14 files across 2 areas (work-items, context-budget), over the tidy cutoffs of 10 files and 1 area
• verify step skipped: docs-only change, and no test runner is available in this lane. The adapter's common.test.sh reads the README's rest-search-filter and open-linked-prs-filter sentinel blocks, which are unchanged. Left to the PR's CI
• The jq pointer (jqlang.org/download/) and the gh api placeholder pointer link pages with no section anchor: the install list and the gh api description are each the whole page or its lead section
• Restatements outside the issue's rows are unchanged: adapter README 'first:100 ... caps at 100' and 'the connection retains MERGED nodes'; context-budget levers.json 'subtraction artifact', measure.mjs's reason string and evals.json:47; audit SKILL.md lines 38-42, 69, 83 and 105 (the issue lists…
• Pointer anchors (＃options, ＃json-fields on cli.github.com; ＃issue on the GraphQL issues reference; the search-section anchors) come from the page headings the fetch returned, not from raw HTML ids

Fix

• plugins/work-items/reference/permission-preflight.md: removed what a bare-exact Bash rule matches, kept 'only an open-glob grant is coverage' and pointed at permissions § Wildcard patterns; removed the claims about when git writes or leaves unset core.worktree, kept the three-candidate order and…
• plugins/work-items/reference/tracker-seam.md: removed the Git Bash/Windows jq parenthetical (the install link stays, now stamped); removed 'GraphQL-backed' from the body-read note; updated the provider-gotcha list to the adapter README's new wording
• plugins/work-items/skills/attend-queue/SKILL.md: replaced the literal --remove-assignee spelling with the adapter README pointer plus gh issue edit § Options
• plugins/work-items/skills/setup/SKILL.md: removed the Jira endpoint path and the pagination claim; the discovery step now points at reference/providers.md "jira", which holds the call and the Atlassian pointer
• plugins/work-items/skills/work-loop/reference/telemetry-upsert.md: removed what -f body=FILE transmits; kept -F body= for create and update and pointed at gh api § Options
• plugins/work-items/tools/work-item-tracker/adapters/github/README.md: rows r485-r497 and r499. Removed which APIs cloud sessions refuse (the GitHub proxy pointer stays, re-dated); removed the gh --limit defaults and max page size; deleted the search-qualifier table and pointed at GitHub's…
• plugins/work-items/skills/track/actions/search.md, plugins/work-items/skills/track/actions/list.md: the qualifier list is now described as 'linked from' the adapter reference, since the README no longer tabulates it
• plugins/context-budget/README.md: removed what /context attributes or shows only as totals, kept that the plugin attributes the built-in tool pools per tool, and pointed at the /context row; removed the skill-frontmatter subtraction parenthetical and pointed at engine.md Comparability rules
• plugins/context-budget/skills/audit/SKILL.md: removed explain-usage's description and invocability (now in native-explain-usage.md, with a stamped note that no upstream page documents it); removed the subtraction explanation and the safe-mode example and kept the never-hand-compare rule
• plugins/context-budget/skills/audit/reference/engine.md: removed the claim that System tools has skill-frontmatter tokens subtracted; the signature rule now rests on the engine's observation, with the /context row pointer noting it does not itemize the bucket
• plugins/context-budget/skills/audit/reference/report.md: removed 'the listing cap is characters' and pointed at skills § Skill descriptions are cut short; removed what /skill-doctor and /doctor cover and pointed at SKILL.md Scope boundary; the line-37 relay stamp now reads 'recheck when' so the…
• .changes/work-items/work-resolve-issue-issue-12689-41587864264-1-f7210283.md: new patch fragment
• .changes/context-budget/work-resolve-issue-issue-12689-41587864264-1-6441cda6.md: new patch fragment

Verification

The runner ran each check from the base copy against 4ec5632:

• scripts/check-changelog-fragments.sh --check: passed
• scripts/check-changed-skills.sh --merge-base: passed

The run reports:

• read https: //code.claude.com/docs/en/permissions: § Wildcard patterns says a rule with no * matches one exact command, Bash(ls ) also matches bare ls, and : is equivalent
• read https: //git-scm.com/docs/git-config: the core.worktree entry (anchor Documentation/git-config.txt-coreworktree) says a relative value resolves against the .git directory and GIT_WORK_TREE/--work-tree override it
• read https: //jqlang.org/download/: per-platform install sections including Windows (winget, Scoop, Chocolatey); no Git Bash mention
• read https: //cli.github.com/manual/gh_issue_edit: Options lists --add/--remove-label and --add/--remove-assignee, with me for self
• read https: //cli.github.com/manual/gh_api: -f adds static strings, -F does typed conversion, a value starting with is read from a file; {owner}/{repo}/{branch} placeholders resolve from the current repo or GH_REPO
• read https: //code.claude.com/docs/en/cloud-environments: § GitHub proxy says the proxy rejects GraphQL with a 403 starting 'GitHub GraphQL is not available from Claude Code sessions', including gh pr and gh issue
• read https: //cli.github.com/manual/gh_issue_list: Options gives --limit default 30 and no maximum
• read https: //cli.github.com/manual/gh_label_list: Options gives --limit default 30
• read https: //docs.github.com/en/search-github/searching-on-github/searching-issues-and-pull-requests: separate sections for label, assignee, missing metadata, title/body and created/updated; sort is only linked under Further reading
• read https: //docs.github.com/en/rest/using-the-rest-api/using-pagination-in-the-rest-api: § About pagination covers the 30-item default subset, the link header and per_page
• read https: //cli.github.com/manual/gh_issue_close: Options gives --reason {completed|not planned|duplicate} and --duplicate-of
• read https: //docs.github.com/en/rest/issues /assignees: § Add assignees to an issue says assignees are silently ignored without push access and returns 201
• read https: //docs.github.com/en/issues /tracking-your-work-with-issues/using-issues/linking-a-pull-request-to-an-issue: § About linked issues and § using a keyword give the keyword list and say keywords count only when the PR targets the default branch
• read https: //docs.github.com/en/graphql/reference/issues: Issue.closedByPullRequestsReferences has includeClosedPrs (default false) and orderByState
• read https: //cli.github.com/manual/gh_issue_view: JSON Fields lists subIssues, parent and blockedBy but not their node shape
• read https: //docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-issue-forms: § Top-level syntax says labels are added automatically to issues created with the template
• read https: //code.claude.com/docs/en/commands: § All commands /context row says nothing about System tools or skill frontmatter; /doctor and /skill-doctor rows describe their coverage; no /explain-usage row
• read https: //code.claude.com/docs/en/skills: § Skill descriptions are cut short says the listing has a character budget scaling at 1% of the context window; no explain-usage mention
• read https: //code.claude.com/docs/llms.txt: no explain-usage entry
• read https: //developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-issue-resolutions/: page is JavaScript-rendered (38 characters of text), so the setup step points at providers.md, which already carries the Atlassian pointer
• The lane run: https://github.com/melodic-software/claude-code-plugins/actions/runs/41587864264

Left out: the items under Not verified.

Related

#12689

[github-actions]

claude-security-review needs no new review of 4a0b6a3ac23b2eab91cda2091685b9fd7eb5a833: no file of this pull request changed since the review of 4ec5632.

Security review: no issues found

This pull request changes Markdown only: two changelog fragments, plus docs and skill or reference text in context-budget and work-items. It replaces facts copied from upstream docs with dated pointers to the upstream pages. It changes no workflow, action, script, plugin manifest or trusted-path file, and no token, permission or trust control.

Instruction-surface lens. The diff removes and shortens wording in skill bodies and references. I checked each removed passage against the instruction exception register (docs/contracts/instruction-exception-register/README.md), which uses the six Gate 0 classes: irreversible-action, secret-handling, data-integrity, external-publication, legal-compliance and agent-authority. Every rule that matters for security or data integrity is still there in its own words; only the upstream explanation behind it moved to a pointer:

• Permission preflight: a bare-exact or flag-scoped rule still does not count as coverage, and the fix is still the open-glob grant.
• Telemetry upsert: create and update still pass the body as -F body=@<file>, never -f. The read-back after the write is unchanged.
• Open linked PRs: the filter that keeps only OPEN nodes whose head is in the item's own repository is kept, along with its reason (a fork's pull request must not park an item). The select(.state=="OPEN") filter stays next to includeClosedPrs:false.
• Assignee claim: claim still re-reads the assignees and exits with code 4 when its assignment did not land. @me is still turned into an explicit login.
• Attend-queue: the order is unchanged: role-label flip first, then clear @me, then release. The new adapter line gh issue edit … --remove-assignee "@me" only clears the session's own assignment.
• Issue creation: labels must still be applied explicitly when an item is created programmatically.
• Cloud sessions: a 403 still means switch to REST, not re-authenticate. REST search is still not used as a fallback.

The pointers added are https links to documentation only (code.claude.com, cli.github.com, docs.github.com, git-scm.com, jqlang.org). None of them runs anything or brings in a dependency.

Embedded text. Neither the pull request context nor the diff contains text telling the review to pass, skip or drop anything.

The prior-findings file lists no earlier posts (0 rounds before this one, cap 3, not past the cap).

critical-findings: 0

[github-actions]

claude-review needs no new review of 4a0b6a3ac23b2eab91cda2091685b9fd7eb5a833: no file of this pull request changed since the review of 4ec5632.

Code review: no findings (complete review, 14 of 14 files)

I read every hunk of all 14 changed files. The change is documentation only, in work-items and context-budget. It deletes facts the docs restated from upstream sources and replaces each with a pointer that carries an as-of date and a recheck trigger. Each local rule stays in the repo's own words.

What I checked

• Adapter README tests: common.test.sh reads two sentinel blocks from the adapter README, rest-search-filter and open-linked-prs-filter. The diff leaves both untouched, so the tests that read them are unaffected.
• Preflight messages: plugins/work-items/skills/work/scripts/preflight.sh:598 emits the bare-exact gap message. The reworded permission-preflight.md still describes it correctly: the grant covers argumentless calls, and the fix is to grant the open glob.
• New cross-references: each target the change links to exists:
  • reference/native-explain-usage.md, which already holds the explain-usage description and invocability record
  • engine.md "Comparability rules"
  • SKILL.md "Scope boundary (route out)"
  • providers.md "jira"
• Adapter README recipe: the new --remove-assignee "@me" line agrees with what attend-queue now points to.
• Changelog fragments: both are bump: patch, which fits a docs-only change. No plugin.json or marketplace.json changed, so the manifest checks don't apply.

Closing issue: the PR body says Refs: #12689 and the PR context file has no closing-issue section, so there are no acceptance criteria to check. The PR body says row r478 (the attend-queue rate-limit floor) is deliberately left open.

Not verified by me: the PR body says check-changelog-fragments.sh --check and check-changed-skills.sh --merge-base passed, and that each upstream pointer was fetched. That comes from the author and I did not confirm it. I could not open the upstream pages to check that the anchors resolve.

Not counted (minor): the new SKILL.md text says no upstream page documents explain-usage (as of 2026-11-03, covering the commands and skills pages and the docs index). The record row that backs this claim, native-explain-usage.md#L11, still reads as of 2026-10-11 and names only the commands page and changelog. The two can be brought into line when the record is next touched.

No embedded instructions were found in the PR context or prior-findings files. This is the first round, under the cap of 3.

[melodic-automation-lanes]

The pr-unblock lane stopped address-feedback on this pull request: the reply job failed before it decided anything (a lane token it could not get, or a script error), so no reply was posted. The lane sets no label: the run ends in a failing pr-unblock/address-feedback status on the head the lane gated.

• Reason: feedback-publish-failed
• Head: 4ec5632c2ab6ad4c338540a480777f5e82b52e57
• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/41600480430

When a retry on this head can change the outcome, the lane runs one on its own, up to its per-head cap, and edits this comment if it stops again; a run that does not stop clears the status. When no retry can (a review thread the lane does not take or settle, or a failing check after the retries are spent), a person resolves the threads or gets the checks green, then dispatches the workflow below: that run finds the cause gone and clears the status. On a pull request the lanes App opened, the dispatchers start that run once per stop; on any other, a person does. A new commit to the branch starts clean.

To run it again on this head now, dispatch the pr-unblock workflow:

gh workflow run pr-unblock.yml -R melodic-software/claude-code-plugins -f pr-number=12783 -f activity=address-feedback

[melodic-automation-lanes]

Unattended merge: native auto-merge leaves this pull request unarmed at head 4a0b6a3ac23b2eab91cda2091685b9fd7eb5a833. The lanes clear this reason on their own; the next scheduled run judges it again.

pr-merge's gate refuses its verifier verdict (verify:earlier-fail)

[melodic-automation-lanes]

A lane run on this pull request's head failed to get its lane token (lane-token-denied 503 github-rate-limited), a failure the next run may not meet, and no dispatcher retries this activity on the same head. pr-merge pushes an empty commit so the activity can start again. It does this once per failed run and at most 2 times per change, so if runs keep failing the same way, a person looks at it. The push starts no run itself: both review lanes review the new head, and an address-feedback run starts after them if an unresolved thread is left for it.

[kyle-sexton]

Hold: superseded by #12810, which answers the earlier pr-verify FAIL with a new change. Releases when: #12810 merges, then this PR closes.

[kyle-sexton]

Superseded by #12810, which merged at 2026-11-03T17:39:57Z.