[kyle-sexton]

No related issue: six PRs today (#13271, #13314, #13325, #13362, #13363, #13383) failed pr-verify for over-claiming Closes

Summary

/source-control:pull-request now checks each issue a PR body would close against the diff before writing the body (create) and before the flip (ready). pr-verify still judges the claim and stays the gate. This change makes the author run the same check first, so an over-claim no longer costs a verify run, a fail note, a dequeue and a re-push. Example: #13383 claimed an issue with 1 of 2 done-when items delivered, and #13368 closed an issue through a closing keyword on its Related line.

Fix

• reference/create.md §2.4.0: new "Close only what the diff finishes" paragraph. Before the siblings step, read each issue ${CLOSES_LINE} would close and mark each done-when or acceptance item and each open sub-issue as delivered or not. Delivered means already checked, delivered by this diff, or delivered by a merged Refs: sibling. An issue with any item not delivered moves to its own Refs: #N line (on the tracker-bound path, the adapter's refs text). Never write "does not close".
• reference/create.md §2.4.1: ## Remaining now covers each Refs: issue, including on a PR that also closes another issue. A new paragraph keeps closing keywords off every line except the linkage line; other issues are mentioned in forms like "delivered by #M".
• reference/ready-for-review.md §2.5.4: new "Closing claims" check after the hold re-check. It reads GitHub's closing references (any keyword anywhere in the body) and checks them against the head that will flip. On an over-claim it leaves the PR in draft and reports the Refs:/## Remaining change the body needs, since ready never writes the body. This is not a pre_ready step, so the step list and --skip cannot turn it off. Added to the 2.5.6 report lines.
• GitHub provider ready-for-review.md: new "Read the closing claims" section (gh pr view --json closingIssuesReferences).
• SKILL.md: the create and ready action rows now mention the check.

The change is skill text only. It adds no script, hook or new step.

Verification

• scripts/check-changed-skills.sh origin/main: PASS, 0 errors, 4 warnings, all existing ones (description and body size, and a missing TOC in ready-for-review.md, which was already past the TOC threshold before this change).
• scripts/check-changelog-fragments.sh --check: all fragments valid.
• scripts/validate-plugins.sh: all manifests and the catalog validated.
• markdownlint-cli2 on the 5 touched files: 0 issues.
• The eval case for Refs: #812 (single Refs: issue, ## Remaining listing the undelivered item) still matches the loosened ## Remaining rule.

Left out: paid eval runs. The skill's cases are legacy evals.json, which /evals:validate does not cover.

Related

• .claude/rules/pr-body-contract.md (Closes / Refs: / No related issue)
• pr-verify section of docs/conventions/pr-pipeline/README.md

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T22:17:39.615971Z	ad637fb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed da4813862a94d332558c0ba541605e22a52a13b4: read 3 of 3 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #13387 (incremental since ad637fb9)

I found no security issues in the incremental change.

Scope. I read every hunk of the 3 files in the incremental scope. All three are skill text only, and none matches a trusted-path glob:

• the GitHub provider ready-for-review.md
• pull-request/reference/create.md
• pull-request/reference/ready-for-review.md

This push changes no plugin manifest, workflow, script, hook or trust control. This lane already reviewed an earlier head, so this review was blocking only: it would have reported only CRITICAL and IMPORTANT findings.

What I checked

• The provider's new closing-claims read (ready-for-review.md#L111-L120):
  • $PR_NUMBER, $ISSUE_NUM and $ISSUE_REPO are all quoted.
  • The owner/name number pairs come from GitHub's own closingIssuesReferences. Owner logins and repository names cannot hold spaces or shell metacharacters, so read -r splits them safely.
  • The Siblings: grep is a fixed pattern over the PR body.
  • Reading each issue in its own repository can bring in an issue body from another repository. That only happens for an issue the PR body itself closes, and the session already wrote that body. Even a hostile issue body can only push the check toward "not delivered", which leaves the PR in draft. pr-verify still gates the merge.
• Instruction surface (create.md §2.4.0 and ready-for-review.md §2.5.4):
  • Credit for an earlier pull request now requires that PR to be on the body's own Siblings: line and its body to state what it delivered, the same rule pr-verify uses.
  • A failed or empty read now counts as not delivered instead of passing. That is fail-closed.
  • The rule on closing keywords outside the linkage line is now worded as a direct rule plus a docs pointer, and forbids the same thing as before.
  • Nothing is loosened and no gate becomes optional.

PR context. I found no embedded instructions aimed at the review lane.

Spend. Each create/ready run makes a few more gh reads per closed issue. That draws on prepaid or subscription usage only, so it is not a hold.

critical-findings: 0

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ad637fb90a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-review: 2 inline finding(s) on ad637fb90aa9bb9871f6dc93677717d9a00454f0; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review reviewed da4813862a94d332558c0ba541605e22a52a13b4: read 3 of 3 changed file(s); 0 finding(s), 0 as inline comments.

Code review: PR #13387 (incremental, blocking only)

I reviewed only the changes since ad637fb9: every hunk of the 3 files in the incremental list. This lane already reviewed an earlier head, so it reported blocking findings only. Advisory points were dropped.

No blocking findings.

Both earlier findings are addressed:

1. Sibling credit was wider than pr-verify's.
   • create.md §2.4.0 now runs the siblings step before the delivered check.
   • Earlier work counts only when its pull request is on ${SIBLINGS_LINE} and its body says it delivered the item. That is the credit pr-verify gives.
   • When an issue moves to Refs:, the siblings step runs again.
   • ready's "Closing claims" check now credits only pull requests on the body's own Siblings: line.
2. Cross-repo closes, and a gate that passed when the read failed.
   • The GitHub provider's "Read the closing claims" step now selects each closing reference's repository.owner.login/repository.name and reads each issue with --repo.
   • A failed gh pr view exits.
   • The text now says a non-zero exit or an empty body counts as not delivered.
   • Both create.md and ready-for-review.md say the same about a failed or empty read.

Other checks:

• The new GitHub keyword-docs pointer in create.md has an as-of date and a recheck trigger.
• ready-for-review.md now reports a failed read in its draft report.

Plugin manifests: none changed in this increment.

Verification: I had no shell, so I did not run the commands in the PR's Verification section. They are the author's claims and unverified.

Spend: none. The change is skill text only.

No embedded instructions were found in the PR context or prior-findings files.