[kyle-sexton]

No related issue: hub ledger L291 (state labels left on closed issues) and L290 (spec for Bot-filed issues).

Summary

#12865 strips only the queue labels (agent-ready, status: ready, admission-deferred; report-outcome.mjs:678) when an issue closes. Triage's status: labels and host-run stay: 15 of the 40 most recently updated closed issues carried one at 16:2xZ (for example #5946, #13238, #10022).

Fix

• stripStateLabels (report-outcome.mjs) removes status: confirmed, status: needs-decision, status: needs-info and host-run from a closed issue. attended stays, since only a listed human lifts it.
• Every close path calls it: work-unblock's close run (stripClosed), the split-parent close (closeDoneParent) and report-outcome's close route. On the two lanes App closes it runs after the PATCH, so a failed close never leaves an open issue without its state. The queue strip still runs before the close, as it did.
• The open-issue hand-off keeps its old label list.
• Cost: each removal fires intake-reenter and security-outside-actor on unlabeled, and both skip a closed issue's event at the job if (intake-reenter.yml:66-68, security-outside-actor.yml:70-72). That is two skipped runs per label and no runner. Nothing reads these labels on a closed issue: a search of .github/scripts for closed-issue label reads finds none.
• L290, docs only: the pr-pipeline README now says that a listed human's comment on, or edit of, a Bot-filed issue never makes it trusted spec. The gate requires a listed-human author (babysit_verify_evidence.py:2594-2613). The way to give such work a spec is a human-opened issue that restates it. No trust rule changes. 0 of 14 open PRs are blocked by this today.

Verification

• node --test .github/scripts/work-unblock/label-unblocked.test.mjs .github/scripts/work-resolve-issue/report-outcome.test.mjs: 715 pass, 0 fail. New tests cover the label order on the close run and on report-outcome's close, with state labels after the close and attended kept.
• scripts/check-affected.sh --base origin/main --no-fetch: 11 passed, 5 skipped.

Related

• Queue-label strip this extends: fix(ci): strip queue labels when an issue closes #12865

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T16:27:05.282244Z	13f9ec0	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review: 1 inline finding(s) on 13f9ec06e2b7499efeb69a0a9f0d061f60b67d02; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review reviewed 9682e17273f0ce574ea32ea1b83da00af221e657: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Code review: PR #13293, incremental (13f9ec0 → 9682e17)

No findings. This pass was blocking only, because the lane already reviewed an earlier head. I read the one file in scope, .github/scripts/work-unblock/label-unblocked.test.mjs, in full.

What changed

The push adds one test: closing a split parent removes its state labels after the close and keeps attended (label-unblocked.test.mjs#L4831).

• Setup. The parent carries agent-ready, status: confirmed, host-run and attended.
• Assertion. A deepEqual over the complete list of writes, in this order:
  1. the comment
  2. DELETE agent-ready
  3. the PATCH close
  4. DELETE status%3A%20confirmed
  5. DELETE host-run

What I checked

• Order. The test pins the queue strip before the close and the state strip after it. Moving the state strip above the PATCH would now fail the test, and so would dropping it.
• attended stays. The assertion covers every write, so a DELETE of attended would also fail it.
• Helpers. The test reuses splitWorld, writtenPaths and closeParentWrites (L4790–4805) the same way as the test beside it at L4818.
• Not run. I had no shell, so I ran no tests. The PR's pass counts are the author's claim and I have not confirmed them.

Prior and settled threads

• This push resolves the earlier advisory on label-unblocked.mjs:2208 (no test covered the split-parent state-label strip). That thread is settled with lines changed since resolution: no, and the new test is the case it asked for.
• I reviewed the PR's other files at 13f9ec0 and they are unchanged since then.

Other notes

• Closing issue. None. The PR cites hub ledger entries L290 and L291.
• Plugin manifests. None changed.
• Embedded instructions. None in the PR context, settled threads or prior findings.

[github-actions]

claude-security-review reviewed 9682e17273f0ce574ea32ea1b83da00af221e657: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #13293 (incremental, head 9682e17)

I found no security issues in this push.

Scope. This was an incremental review of the changes since 13f9ec06. One file changed: .github/scripts/work-unblock/label-unblocked.test.mjs. It isn't a trusted path, and I read its whole change.

What changed. The push adds one test, "closing a split parent removes its state labels after the close and keeps attended". It asserts the order of writes when a split parent is closed:

1. The queue label (agent-ready) comes off before the close.
2. status: confirmed and host-run come off after the close.
3. attended stays.

The test only uses mocks and touches no production code, gates or trust controls. It checks that the attended hold stays on the issue after a close, which matches what the last review found in stripStateLabels.

Prior findings. The last review had no findings, so there is nothing to carry forward or repeat. This review was blocking only: it would have reported only CRITICAL or IMPORTANT findings, and it found none.

critical-findings: 0