[kyle-sexton]

Refs: melodic-software/claude-code-plugins#12286

Summary

The source-control plugin reads its team settings from docs/conventions/source-control.yaml (claude-code-plugins ADR 0064) and will stop reading .claude/source-control.md once claude-code-plugins#9737 lands. Without this move, /source-control:pull-request create loses this repository's PR-body section list.

Fix

• Adds docs/conventions/source-control.yaml with the one key the legacy file set, pr_body_required_sections (Summary, Fix, Verification, Related), unchanged. The legacy file's note on keeping the list in step with the pr-contract composite moves into the YAML as a comment.
• Deletes .claude/source-control.md.
• Nothing else in this repository reads the legacy file (git grep source-control.md finds nothing).
• Config-only change: no plugin, skill or catalog file changes, so the plugin-work PR checklist in AGENTS.md does not apply.

Verification

Value parity, from a script that parses every H2 of the legacy file and every key of the YAML:

Legacy .claude/source-control.md at origin/main vs docs/conventions/source-control.yaml at HEAD:

Key	Old value	New value	Result
pr_body_required_sections	[Summary, Fix, Verification, Related]	[Summary, Fix, Verification, Related]	MATCH

Prose lines in legacy sections, not values: pr_body_required_sections 4

1 legacy keys, 1 YAML keys, 0 not MATCH

Ran against claude-code-plugins origin/main's readers on this branch:

• plugins/source-control/lib/convention-key.sh layer <repo> pr_body_required_sections prints yaml, and list prints Summary, Fix, Verification, Related, the same four bullets the legacy section held.
• Commit-subject enforcement is unchanged: it still resolves from docs/conventions/source-control/commit-convention.yml on main and on this branch.
• check-jsonschema==0.39.0 against plugins/source-control/schemas/source-control.schema.json: ok.

Related

• Refs chore: move other repositories' .claude/source-control.md keys to docs/conventions/source-control.yaml claude-code-plugins#12286 (this migration across repositories)
• Refs chore: drop the one-release .claude config reads and this repository's old config files claude-code-plugins#9737 (removes the legacy reads)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T16:47:41.134570Z	9a36052	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 9a36052e9be1b76fc2d2a9b6b53f30571af9f005: 0 finding(s), 0 as inline comments.

No findings on PR #164 (head 9a36052).

What the PR does. It moves the pr_body_required_sections list (Summary, Fix, Verification, Related) from .claude/source-control.md to docs/conventions/source-control.yaml. The list is unchanged, and the explanatory note moves into a YAML comment.

What I checked, by running it myself.

• git grep "source-control" finds no remaining reader of .claude/source-control.md. The only other hits are the managed-files workflow entry and the commit-convention file, both for docs/conventions/source-control/commit-convention.yml, which this PR does not touch.
• The new docs/conventions/source-control.yaml sits beside the existing docs/conventions/source-control/ directory without a path conflict.
• The four section names match the sections the .claude/rules/pr-body-contract.md rule requires. That rule's glob does not match either changed file, so it is not review criteria for them.
• No closing issue exists. The PR uses Refs:, so there are no acceptance criteria to check.

Not verified. The PR's claims about the claude-code-plugins readers, convention-key.sh and the JSON-schema check, are author-claimed. I did not run them, and I did not check the schema URL in the file's yaml-language-server header.

The PR body has all four expected sections and a Refs: line, as the PR body contract asks.

[github-actions]

claude-security-review reviewed 9a36052e9be1b76fc2d2a9b6b53f30571af9f005: 0 finding(s), 0 as inline comments.

Security review: PR #164 (head 9a36052)

No security findings.

critical-findings: 0

What changed. .claude/source-control.md is deleted and docs/conventions/source-control.yaml is added. The pr_body_required_sections list is the same in both: Summary, Fix, Verification, Related. The only addition is a yaml-language-server schema comment and reworded prose.

Checks run:

• Trust controls: The diff touches none of the trust controls the skill lists. It does not touch the trusted-actor list, check-trusted-trigger, request-lane-token, check-kill-switch, the token broker or its signer, the merge-hold scripts, pr-require-checks.yml, pr-merge.yml, or docs/conventions/pr-pipeline.yaml. It adds no CODEOWNERS or .gitmodules change, so no trusted-path glob matches.
• Instruction-surface lens: The deleted file is plugin configuration, not a standing instruction (CLAUDE.md, AGENTS.md, a rules file, a skill or agent body, or a hook list). Its content moves unchanged, so no rule is deleted or narrowed. The key only selects which PR-body headings produce an advisory comment and the needs-issue-linkage label. The comment in the file says this check is advisory and does not turn ci-status red. Dropping the list would therefore not remove a gate or widen any authority. I did not consult the instruction exception register, because no rule is removed.
• Schema reference: The comment-only $schema URL points at raw.githubusercontent.com/melodic-software/claude-code-plugins/main/..., an unpinned main ref. Only an editor's YAML language server reads it. No workflow, script, or installed code fetches or runs it, so it cannot execute code or reach a secret.
• Plugin manifests: No plugin.json or marketplace.json changed, so no manifest <field> lines apply.
• Secrets, injection, token scope, billing: The diff adds no code, workflow, secret handling, token request, or billable resource.

I did not read plugins/source-control/reference/config-resolution.md upstream to confirm that the plugin reads docs/conventions/source-control.yaml. That is a functional question for the maintainers, not a security one. If the plugin does not read the new path, the list silently falls back to inference, which is still only the advisory PR-body check.

Nothing is already posted or settled. The summary carries no embedded instructions from the PR text.