[kyle-sexton]

Refs: melodic-software/claude-code-plugins#13586

Summary

Contract step of the intake-triage permission expand/contract. #950 listed the old and new caller maps; melodic-software/claude-code-plugins#13660 moves the only caller to the new map (actions: read). This PR drops the old map, so the contract is again one exact map.

Draft until melodic-software/claude-code-plugins#13660 merges: its sync would otherwise reject the caller still on main.

Fix

• components/runner-policy/policy.json: intake-triage's allowedCallerPermissions is the single map {actions: read, contents: read, issues: write}.

Verification

• node --test components/runner-policy/runner-policy.test.mjs: 232 pass, 0 fail.

Related

• feat(runner-policy): accept a list of exact caller permission maps for a migration #950, chore: sync standards components claude-code-plugins#13630, ci(intake): grant intake-triage's caller job actions: read claude-code-plugins#13660, then ci(intake-triage): skip a credit-stopped key with the check-key-credit gate ci-workflows#996.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-06T06:09:29.136354Z We couldn’t complete this review. Comment @codex review to try again.	5be5214	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

claude-review reviewed 5be5214861c141ff0ce797d3547f03f6282a00c6: 0 finding(s), 0 as inline comments.

No findings. The PR is open and not a draft.

The diff is one change in components/runner-policy/policy.json. intake-triage's allowedCallerPermissions goes from a two-element array to the single map {actions: read, contents: read, issues: write}. The README's expand/contract procedure (components/runner-policy/README.md, step 3) calls for exactly this follow-up, and the schema already accepts the single-map form. Every other contract entry in policy.json already uses a single map.

• Closing issue: the PR uses Refs: and names no closing issue, so there are no acceptance criteria to check. The linked issue is in another repo and was not read.
• Manifests: the diff touches no plugin manifests.
• Rules: the only rule file under .claude/rules/ is the PR body contract, and the body follows it.
• Not run: I did not run the test suite, because the command needed an approval that wasn't granted. The "232 pass, 0 fail" in the PR body is the author's claim and I have not checked it.
• Merge order: the PR body says the sync would reject the old caller map if this merged before ci(intake): grant intake-triage's caller job actions: read claude-code-plugins#13660. That is a sequencing risk for the author, not a defect in the diff.

[github-actions]

claude-security-review reviewed 5be5214861c141ff0ce797d3547f03f6282a00c6: 0 finding(s), 0 as inline comments.

Security review: PR #951 (head 5be5214)

No security findings. critical-findings: 0

The diff is one change to components/runner-policy/policy.json. For the intake-triage.yml reusable-workflow contract, allowedCallerPermissions goes from a two-entry list to the single map {actions: read, contents: read, issues: write}. The old list also accepted {contents: read, issues: write}.

• Narrowing, not widening. The checker (exactCallerPermissionsError in runner-policy.mjs, around line 909) matches a caller's effective permissions exactly against the allowed maps. Dropping one map means callers that declare only contents: read plus issues: write no longer pass. The accepted map is also one the base already allowed. No new actor, token scope, secret, input or SHA is admitted. allowedSecrets, allowedInputs and approvedShas are unchanged.
• Shape still valid. policy.schema.json (around line 138) accepts either a single permission map or an array of them. The loader (callerPermissionMapEntries, around line 167) normalizes both forms. The remaining map has issues: write, which meets the rule that a runner-input contract with allowed caller permissions must include at least one write permission (runner-policy.mjs, around line 185).
• Expand/contract. The code comment says the list form exists so a permission change can land expand then contract. This diff is the contract step. It does not weaken any gate. A caller left on the dropped map would now fail the policy check rather than pass it. That is an availability and compatibility risk, not a security one.
• Owner threat model. The change touches no merge hold, kill switch, trusted-actor list, token broker or other trust control.

Not consulted: the instruction exception register. The diff changes no instruction surface.

No manifest lines apply. No hold is needed.