[kyle-sexton]

Refs: #12526

Summary

The morning brief's KEY: line counts each lane's credit-stop records, but pr-review-main.yml was missing from its default lane list (plugins/work-items/skills/morning-brief/scripts/morning-brief.sh, DEFAULT_LANE_WORKFLOWS). A live run read that lane only when --lane-workflows named it. This was the gap the measurement comment on #12526 found.

The other part of #12526's follow-up, moving both workflows to the check-key-credit marker gate from melodic-software/ci-workflows#973, is not in this PR. It already ships in two other PRs:

• pr-review-main.yml: merged in #12838 (pinned at bc62beb, the disk-hygiene(test): isolate run_guard_powershell enabled flag from ambient argv in test_hygiene #973 merge commit, with the marker write and upload steps).
• pr-verify.yml: open in #12799, owned by another session.

Fix

• Add pr-review-main.yml to DEFAULT_LANE_WORKFLOWS.
• morning-brief.test.sh: the live-REST case's workflow list now includes pr-review-main.yml with one passing run, and the test asserts that the Lanes section reports it (runs=1 failed=0).
• Changelog fragment for work-items (patch).

Verification

• bash plugins/work-items/skills/morning-brief/morning-brief.test.sh: 532 pass, 0 fail. Before the fixture fix, the keys-live cap case failed twice, because the copied fixture gave pr-review-main a run inside the 200-run cap. It now gives pr-review-main no runs.
• bash plugins/work-items/skills/morning-brief/morning-brief-view.test.sh: 14 pass.
• No workflow file changed, so actionlint and the workflow tests were not re-run here.

#12526 stays open (Refs:, not Closes). Its last done-when step is a re-measure after #12799 merges, run from REST job lists the way the measurement comment on #12526 did:

• Key legs that called the model, per hour, per workflow (pr-verify, pr-review-main, pr-review-hosted, pr-review-security-hosted), against at most 1 per KEY_CREDIT_WINDOW_HOURS window. Before the marker gate, pr-verify made 45 calls in 2.6 h.
• Runner jobs per run, against 1.47 before and 2.46 after fix(pr-pipeline): skip a lane's key leg while its key is out of credit #12617.

Related

• fix(lanes): the CI API key is out of credit, so 45% of model legs fail instantly while reporting green #12526, the issue.
• #12617, the first credit gate.
• #12838, pr-review-main on the marker gate.
• #12799, pr-verify on the marker gate.
• melodic-software/ci-workflows#973, the marker gate.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T16:13:31.187845Z	b4dc9b6	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed b4dc9b6fd40924bce009161a447fda8512eb1ab4: read 3 of 3 changed file(s); 0 finding(s), 0 as inline comments.

Code review: no findings

I read every hunk of all 3 changed files: the changelog fragment, morning-brief.sh and morning-brief.test.sh.

What changed. pr-review-main.yml is now in DEFAULT_LANE_WORKFLOWS (morning-brief.sh#L214-L223). This list is only read on the live path when --lane-workflows is not given. There, it is filtered against the repo's actual workflow list (L2247-L2256), so a repo without pr-review-main.yml sees no change.

Tests.

• The live-REST fixture now lists pr-review-main.yml with one passing run, plus stubs for its jobs and annotations. A new assertion checks its Lanes row. That assertion would fail if the entry were removed from the default list, so the fix is covered.
• The keys-live case copies the REST fixtures. It now overrides pr-review-main's runs with an empty list (test#L1942-L1944). Without that override, the copied run would take a slot inside the 200-run read cap and shift the unread 3 counts. The override keeps the cap assertions as they were.
• The author reports 532 passing and 0 failing. I could not run the tests in this lane, so that result is the author's claim and is unverified.

Manifest and changelog. No plugin.json or marketplace.json changed. The fragment's bump: patch fits a bug fix that adds nothing new.

Closing issue. None. The PR uses Refs: #12526, not Closes, so there were no acceptance criteria to check.

Paved paths and rules. I did not resolve the project's standards index or read the paths: frontmatter of the rule files under .claude/rules/. So the change was not checked against any paved-path entry or path-scoped rule.

Prior findings. None (0 earlier rounds, cap 3). The PR context had no embedded instructions.

Spend (not a finding). Live morning-brief runs on repos that have pr-review-main.yml will make more GitHub REST calls: one runs list for the lane, plus a jobs read and annotation reads for each run. These count against the existing LANE_READ_LIMIT (200 runs) and cost nothing extra.

[github-actions]

claude-security-review reviewed b4dc9b6fd40924bce009161a447fda8512eb1ab4: read 3 of 3 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #12851

I found no security issues. I read the full diff for all 3 changed files.

What changed

• plugins/work-items/skills/morning-brief/scripts/morning-brief.sh adds "pr-review-main.yml" to DEFAULT_LANE_WORKFLOWS. With that, the brief's read-only telemetry pass reads that workflow's run, job and annotation records. It already reads the other default lanes, such as pr-review-hosted.yml and pr-verify.yml, the same way.
• morning-brief.test.sh changes only test fixtures and adds one assertion.
• The .changes/ file is a changelog fragment.

Checks

• Trust controls: none of the changed files matches a TRUSTED PATHS glob. Nothing here touches the trusted-trigger check, the token scope or broker, the kill switch, a merge hold or an .github/actions/ control.
• Data flow: the new list entry only adds one more workflow whose run, job and annotation records the brief reads and reports. That data comes from the owner's own repository, through the same parser that already handles the other lanes' records. There is no new sink, credential, write path or permission.
• Instruction surface: the diff removes or softens no standing instruction.
• Plugin manifests: no manifest changed.
• Prior findings: none (0 rounds, cap 3, not past the cap).
• Embedded text: the pull request description has no directives aimed at the review lane.

Spend: none beyond one more workflow's run, job and annotation records read through the GitHub REST API when the brief runs live. That is API quota, not a billed resource.

critical-findings: 0