Repository navigation
ci(lanes): run every model lane on the same key, subscription and fallback chain #13586
Description
No related issue: owner decision in the Automation Lanes session, 2026-11-05.
Owner decision (verbatim)
The owner asked, in session: "if anything fails on API credit, it should always roll back to the subscription. If that fails, there's a fallback subscription. Did we have that in place for all of these automations?"
Asked as an AskUserQuestion pick, Q1, which named the release lane's outside-authored changelog input and rule R220. Owner's pick, verbatim: "All nine (Recommended)".
Then, verbatim: "I want them all to be consistent and uniform."
This loosens R220 for upstream-apply-changelog.yml: that lane now gets the subscription and fallback legs. The owner made this pick in their own words, in the session.
Gap (read at origin/main, 2026-11-05)
Every other model lane already runs API key, then role subscription, then FALLBACK_CLAUDE_CODE_OAUTH_TOKEN. It hands off on a credit stop or a 401/402, and on the subscription leg also on a limit stop (ci-workflows run-claude-cli action.yml:7-16; pr-run-activity-read.yml:10-17). These do not:
| Workflow | Legs today |
|---|---|
upstream-apply-changelog.yml (both model legs) |
key only (:352, :634; :152-156 skips a credit-stopped key) |
pr-unblock.yml adjudicate-feedback |
key only (:1858-1862) |
intake-triage.yml refine-issue |
key, then subscription, with no fallback (:1116-1120) |
pr-verify-capture.yml |
key, then subscription, with no fallback (:37-38) |
post-merge-test-mutation.yml |
subscription only |
maintenance-tidy-code-upkeep.yml |
subscription only |
maintenance-measure-skill-edit.yml |
subscription only |
eval-browser-dispatch.yml |
subscription only |
eval-hill-climb-pass.yml |
subscription only |
Done when
- Every model-running workflow runs the same three-leg chain through the same mechanism: role API key, then role subscription, then
FALLBACK_CLAUDE_CODE_OAUTH_TOKEN, with the same handoff triggers. No lane keeps its own variant. - A test fails when a model-running workflow lacks a leg, or passes credentials outside that mechanism.
- The release lane's credit-stop skip is removed or reduced to the shared key-credit gate, and its header no longer says it has no subscription leg.
Activity
kyle-sexton commentedon Nov 5, 2026
Owner confirmation (in the Automation Lanes session, 2026-11-05). A side agent raised that the release lane would also hold
FALLBACK_CLAUDE_CODE_OAUTH_TOKEN, and that nobody had checked which account owns it. The owner answered, verbatim:Two scope additions, from the key owner (GitHub Support hub):
check-key-creditgate. A key whose last outcome was a credit stop is then skipped for the key-credit window rather than refused on each run.github-actions commentedon Nov 5, 2026
Proposed work class: work-class: structural
Basis: automated intake triage; the lanes App applied this class.
Size: Medium
Complexity: Medium
Uncertainty: Known
Flags: security
Blocked by: none
I understand this as a request to give all nine model-running workflows the same three-leg credential chain. The chain is role API key, then role subscription, then
FALLBACK_CLAUDE_CODE_OAUTH_TOKEN. It also asks for a test that fails when a lane lacks a leg or passes credentials outside the shared mechanism, and for the release lane's credit-stop skip and header to be cleaned up.The body cites an owner decision to loosen R220 for
upstream-apply-changelog.yml. No**Decision recorded.**comment backs it, so I can't treat it as settled. That lane reads outside-authored changelog input. Giving it subscription tokens widens the credential exposure on an untrusted-input path, which is a trust-boundary choice for a person.upstream-apply-changelog.ymlget the subscription and fallback legs despite R220?RECOMMENDED: Yes, but only behind the same shared mechanism and only if the lane's untrusted-input handling is unchanged. The body records the owner's "All nine" and "consistent and uniform" picks.
The other eight workflows are ordinary work.
To answer, post a comment that starts with this line:
Automated triage, applied by the lanes App.
melodic-automation-lanes commentedon Nov 5, 2026
The triage verdict left this issue at
status: needs-decision:Reason:
securitytest(lanes): fail a model lane that lacks its key, subscription or fa…
ci(lanes): probe the release's scrub on every credential its model ma…
test(lanes): count a leg only where a job runs on it
kyle-sexton commentedon Nov 5, 2026
Owner decision Q2 (AskUserQuestion, Automation Lanes session, 2026-11-05). The maintenance role's lanes (eval-browser-dispatch, eval-hill-climb-pass, maintenance-measure-skill-edit) have no key leg, because the org has no
MAINTENANCE_CLAUDE_API_KEYsecret. Owner's pick, verbatim: "You add a maintenance key (Recommended)". The owner creates the org secret, with visibilityalllike the other role keys. Then the key leg is added like every other role's.Still open in this issue:
claude plugin evallanes need a handoff classifier for the fallback leg.2 remaining items
ci(lanes): start the fallback leg only when the fallback token is set
Merge origin/main into test/model-lane-leg-guard
ci(lanes): run the reuse summary on the third call's token and record…
test(lanes): exempt a lane only for the exact legs it lacks
ci(lanes): skip a credit-stopped key in the read runner and the lane …
ci(lanes): grant the intake triage caller actions: read for its key-c…
ci(lanes): read the credit-stop marker off the handoff path
kyle-sexton commentedon Nov 5, 2026
Maintenance key pushed (Q2). After #13610 merged, the claude-code-account-rotation leader reloaded the lane catalog. It then pushed claudeautomations@yahoo.com's stored Console key to MAINTENANCE:
POST /api/accounts/claudeautomations%40yahoo.com/api-key/push, roles[MAINTENANCE], auto-reload off, extra usage off, per the standing direction s3.gh api orgs/melodic-software/actions/secrets/MAINTENANCE_CLAUDE_API_KEYreadsvisibility=all updated=2026-11-05T22:11:11Z. The tool's catalog row readskeyed: truewithkeySecret: MAINTENANCE_CLAUDE_API_KEY, so this key half is operated through the tool like every other role's.Next: give the maintenance lanes (eval-browser-dispatch, eval-hill-climb-pass, maintenance-measure-skill-edit) their key leg, then move post-merge-test-mutation to run-claude-cli.
style(lanes): format the leg tests with the repository's biome
fix(runner-policy): admit actions: read on intake-triage.yml callers (#…
ci(intake): grant the intake-triage caller actions: read
feat(runner-policy): accept a list of exact caller permission maps fo…
feat(runner-policy): drop the old intake-triage caller map
feat(runner-policy): drop the old intake-triage caller map (#951)
kyle-sexton commentedon Nov 6, 2026
Intake leg landed: melodic-software/ci-workflows#996 merged (key-credit gate plus a
!cancelled()guard so a failed gate job still runs the key leg), after melodic-software/standards#950 and melodic-software/standards#951 and #13630 / #13660 (the caller'sactions: read). The mutation lane landed in #13632.One gap keeps the first box open: the plugin-eval key leg does not hand off on
auth_failed. Run https://github.com/melodic-software/claude-code-plugins/actions/runs/42172606678 endedpartial (auth_failed)while the handoff classifier printedoutcome=success, so the subscription leg never ran (#12035). The fix is in progress onfix/eval-auth-failed-handoff; this issue closes when it merges.