[kyle-sexton]

Refs: #13586

Summary

The owner's Q2 pick "You add a maintenance key (Recommended)" (comment). claude-code-account-rotation reads this catalog at runtime (LaneCatalogStore.cs:111, LaneCatalog.cs:29-44) and refuses a key push to a role marked keyed: false (ApiKeyEndpoints.cs:274-279), so this flip lets the tool push MAINTENANCE_CLAUDE_API_KEY.

Fix

.github/lane-funding.json: the maintenance role (secretPrefix MAINTENANCE, keySecret MAINTENANCE_CLAUDE_API_KEY) goes from "keyed": false to "keyed": true. One line; no lane, currentSecrets or workflow changes. The role already has a run-claude-cli lane (propose), which the catalog test requires of a keyed role. The schema (.github/lane-funding.schema.json) has no per-role constraint beyond the boolean.

Verification

• node --test .github/actions/resolve-config/callers.test.mjs: 244 tests, 244 pass, 0 fail (after npm ci --ignore-scripts --prefix .github/actions/resolve-config).
• That suite includes "each catalog role names its secrets from its prefix, and is keyed only with a run-claude-cli lane" (callers.test.mjs:2247), which passes for the maintenance role.

Remaining

This PR delivers only the catalog flag that lets claude-code-account-rotation push MAINTENANCE_CLAUDE_API_KEY. What #13586 still needs:

• Push the key itself, through the rotation tool, after this merges.
• Key leg for the maintenance lanes: eval-browser-dispatch, eval-hill-climb-pass, and maintenance-measure-skill-edit's pass and propose jobs, including the claude plugin eval handoff classifier those lanes need for the fallback leg.
• Credit gate and empty-subscription rule for the lanes that already had three legs: ci(lanes): give every three-leg lane the key-credit gate and the empty-subscription handoff #13608, ci(lanes): hand an empty subscription token to the fallback leg ci-workflows#995 and ci(intake-triage): skip a credit-stopped key with the check-key-credit gate ci-workflows#996.
• Leg guard test: test(lanes): fail a model lane that lacks its key, subscription or fallback leg #13594.
• post-merge-test-mutation: move it to run-claude-cli, with the model step and the mutant runs in separate jobs.

Already merged: #13590 (the release lane's three legs, which replace its credit-stop skip; adjudicate-feedback, refine-issue and capture) and #13592 (tidy).

Related

• ci(lanes): run every model lane on the same key, subscription and fallback chain #13586

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T21:01:39.587050Z	cf9136a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed cf9136a04ade0d85c1eda291325941143b77b59b: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Code review: PR #13610, complete review (1 of 1 changed files read)

No findings.

The change sets "keyed": true on the maintenance role in .github/lane-funding.json. It is one line. I checked it against the rules that govern this field:

• Schema (.github/lane-funding.schema.json): keyed is a plain boolean, documented as "True only when one of its lanes runs on run-claude-cli." The maintenance role has such a lane: propose in maintenance-measure-skill-edit.yml (launcher: run-claude-cli, lane-funding.json#L133).
• Test: callers.test.mjs#L2247-L2254 requires a keyed role to have a run-claude-cli lane. From reading the code, the maintenance role meets that. The PR says the suite passed (244/244). That is the author's claim; I had no shell and did not run it.
• Convention: docs/conventions/pr-pipeline/README.md (Funding section) says "only a role with such a lane is keyed." The change follows it.
• Other readers of keyed: in this repository, only that test reads the field. The PR names an external reader, claude-code-account-rotation, whose code I could not see. Its effect, that a key push to this role is no longer refused, is the author's claim and I did not verify it.
• No lane's currentSecrets changes, so no workflow reads MAINTENANCE_CLAUDE_API_KEY yet.

Closing issue: none. The PR only references #13586 (Refs:) and closes no issue, so there are no acceptance criteria to check.

Path-scoped rules: no rule under .claude/rules/ matches .github/lane-funding.json.

Plugin manifests: none changed.

Spend (not a hold, not a finding): marking the role keyed lets an API key be stored for the maintenance role. Later runs of the maintenance run-claude-cli lane could then draw on prepaid API credits once the lane's wiring reads the key. This PR changes no wiring.

Embedded instructions: none found in the PR context or the prior-findings file.

[github-actions]

claude-security-review reviewed cf9136a04ade0d85c1eda291325941143b77b59b: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #13610, no security issues found

This PR changes one line in .github/lane-funding.json: the maintenance role goes from "keyed": false to "keyed": true (L127). The file isn't on the trusted-path list, but the change touches how lanes are funded, so I checked what actually reads it.

Who reads the flag in this repository. I searched for lane-funding.json. Only docs and .github/actions/resolve-config/callers.test.mjs refer to it. The test is the only code that reads role.keyed (callers.test.mjs#L2252), and it only checks that a keyed role has a run-claude-cli lane. The role has one: propose, at L133. No workflow, action or token-broker code decides anything from this flag, so the change doesn't affect the trusted-trigger check, the scope of the lanes App token, the kill switch, any merge hold, or what resolve-config mints.

Secret exposure. I searched .github/ for MAINTENANCE_CLAUDE_API_KEY. It appears only as the catalog's keySecret at L126; no workflow uses it. Every maintenance lane still lists only MAINTENANCE_CLAUDE_CODE_OAUTH_TOKEN in currentSecrets (L130-L135). That includes the eval lane, the only one triggered by pull_request (L130). So even once the external rotation tool pushes the key, no pull-request-triggered or other lane receives it. No token leak, compromise or billing path comes from this diff.

Spend (not a hold, not counted): the flag only lets the external rotation tool push a MAINTENANCE_CLAUDE_API_KEY secret. API-key use would draw API credit, but only after some later change wires the key into a lane's currentSecrets or a workflow. That later change is the one to review for a charge.

PR context: no embedded directives found. Prior findings: none, and this is not a blocking-only review. No plugin manifests were touched.

critical-findings: 0

[github-actions]

The pr-verify verifier failed head cf9136a04ade0d85c1eda291325941143b77b59b. What it wrote, as data:

Summary: Refs #13586 (partial delivery). The diff changes one line: the `maintenance` role in
  `.github/lane-funding.json` goes from `keyed: false` to `keyed: true`. That fits the owner's Q2
  decision in the issue comments to add a maintenance key, so it is within the issue's scope. The
  change looks correct on its own. test-node passed on the judged head
  (https://github.com/melodic-software/claude-code-plugins/actions/runs/42108595552/job/127530143857),
  and per the body that suite includes the catalog check requiring a keyed role to have a
  run-claude-cli lane. check-catalog also passed. I found no safety or takeover concern and no
  steering text. It still fails on one point. For a `refs` pull request, the body must say what part
  of the issue it delivers and what remains for later work. This body names the delivered part but
  not the remaining work. It only says there are no lane, currentSecrets or workflow changes, and
  lists #13586 under Related.
- PR body: add a section naming the #13586 work that remains for later pull requests. That includes
  adding the maintenance key leg to eval-browser-dispatch, eval-hill-climb-pass and
  maintenance-measure-skill-edit. It also includes the three-leg chain for the other listed
  workflows, the test that fails when a leg is missing, removing the release-lane credit-stop skip,
  check-key-credit on every lane, per-leg telemetry, moving post-merge-test-mutation to
  run-claude-cli, and the eval handoff classifier.

This pull request leaves the merge queue, and ci-status holds it out while it carries pr-verify-failed. A pr-verify pass removes the label, at a new commit or at this same head: once a trusted person edits the body, and only trusted people have edited it since the fail, this head is judged again, so a fail on the body or the issues it links needs only the body fixed, no new commit.