[kyle-sexton]

Refs: #13586

Summary

Step 2 of the intake-grant expand/contract. standards#950 lets the runner-policy contract list the old and new intake-triage caller maps, and #13630 synced it here. This PR grants the new map's actions: read on the intake-triage caller job, so the ci-workflows reusable can list this repository's credit-stop markers before it spends a key (melodic-software/ci-workflows#996).

Fix

• .github/workflows/intake-triage.yml: the intake-triage caller job grants actions: read # list this repository's credit-stop markers.

Verification

• node .github/standards/runner-policy/runner-policy.mjs --root . on this branch after merging main: Runner policy passed.

Related

• standards#950 (list of exact caller maps), chore: sync standards components #13630 (sync), next: a standards PR dropping the old intake-triage map, then ci-workflows#996.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-06T05:23:05.295312Z We couldn’t complete this review. Comment @codex review to try again.	0ceeddf	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

claude-review reviewed 7ced3c78a74f6abc37605c38228df681cf34d793: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Code review: PR #13660 (incremental since 0ceeddf1)

Scope: This review covers only what changed since 0ceeddf1. That is one file, .github/actions/resolve-config/callers.test.mjs, which is on the trusted-path list. I read its whole change and the test around it at head (lines 390–410). This lane had already reviewed an earlier head, so the review was blocking only.

Change: The test intake-triage.yml: each job keeps its own least-privilege permissions now expects the intake-triage caller job's permissions to be { actions: "read", contents: "read", issues: "write" }.

Assessment: No findings.

• The expected map now matches the workflow change reviewed at the earlier head, which added actions: read to the intake-triage job in .github/workflows/intake-triage.yml.
• The test still compares every job's whole permission map with deepEqual. Adding, dropping or widening any job's grant still fails the test, so the new grant is pinned exactly and nothing becomes looser.
• No other job's expected permissions changed.

Closing issue: None. The PR refers to #13586 (Refs:) and closes no issue, so there were no acceptance criteria to check.

Verification: I did not run the test, because this run has no shell. The runner-policy.mjs result in the PR body is the author's claim, and I did not check it.

Prior findings: The only earlier post is this lane's summary at 0ceeddf1, which had 0 findings. There is nothing to carry forward.

[github-actions]

claude-security-review reviewed 7ced3c78a74f6abc37605c38228df681cf34d793: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Security review: no security issues found

Scope: this was an incremental review covering changes since 0ceeddf1, and it reported blocking findings only, because this lane has already reviewed an earlier head. One file is in scope, .github/actions/resolve-config/callers.test.mjs, and I read its single hunk.

The change: the test that checks each intake-triage.yml job keeps its own least-privilege permissions now expects the intake-triage caller job to have { actions: "read", contents: "read", issues: "write" } (callers.test.mjs#L399). The workflow grant this matches, actions: read, was reviewed at the previous head with no findings.

Why this is not a finding:

• Trusted path, but not the control. The file matches .github/actions/resolve-config/**. The control there is resolve.mjs and its sibling modules and rule files. This file is a test, and the trust-control rules exclude resolve-config's tests. The change does not alter what the broker mints or who it trusts.
• The test stays strict. It still compares the whole permissions map for each job, so a future widening of that job beyond actions: read would still fail the test.
• No security effect. The change grants nothing, exposes no secret and adds no path for untrusted text to reach a lane.

PR context: the description (step 2 of the intake-grant expand/contract, refs #13586) matches the change. It contains no embedded instructions to the lane.

Prior findings: the lane's earlier post was a summary with no findings, so nothing carries over.

Spend: none.

critical-findings: 0