Codify org-wide: caller-stub input forwarding across channel pins (channel-skew prevention) #736

Codify: caller-stub input forwarding across channel pins (channel-skew prevention)

Companion to combsmith/.github-private#1254 (part E) / parent epic combsmith/.github-private#1052.

The .github-private repo has codified a rule in its AGENTS.md and enforced it via a dev-lead prompt guardrail (part C, #1254) plus a CI guard (part A, #1253). This issue promotes the canonical org-wide standard so it applies to all consumer repos.

Rule to add

Under standards/ci-standards.md → "Reusable workflow versioning — the stable channel", add a subsection "Caller-stub input forwarding across channel pins":

A thin caller stub pins its first-party reusable at a moving channel tag (e.g. …@dev-lead/v1-stable), which resolves to a specific commit. The stub may only forward (with:) inputs that the reusable at that pinned commit declares under workflow_call.inputs. Forwarding an input the pinned channel does not yet declare is a channel-skew defect: the reusable call fails at runtime with an "unexpected input" error even though every ref looks valid.

Never add or modify a with: forward on a channel-pinned caller stub to pass an input the pinned channel does not yet declare.

Sequencing for a new workflow_call input (in order):

1. Land the input in the reusable's workflow_call.inputs on main.
2. Promote the pinned channel to a commit that declares it (cut-release.sh <agent> <version> --channel <name>).
3. Only then teach the stub to forward it with with:.

Acceptance

• standards/ci-standards.md updated with the subsection above, and consumer repos defer to it.

Cross-references

• Rule + sequencing already documented repo-locally: .github-private/AGENTS.md → "Release channel tags & the mutable-ref exception" → "Caller-stub input forwarding across channel pins".
• Prompt guardrail: [#1052 C+E] dev-lead prompt guardrail (no undeclared channel-stub input forward) + codify in AGENTS.md & org ci-standards .github-private#1254 (part C).
• CI guard: [#1052 A] CI guard: forwarded caller inputs ⊆ declared inputs at the pinned @ref (+ #1034 regression) .github-private#1253 (part A).