feat(tracker): bind the work-items tracker seam (github provider)

[kyle-sexton]

Summary

Adds .work-item-tracker.json — the work-items plugin's tracker-seam binding: github provider, 24-hour lease TTL. role_labels is deliberately omitted so the canonical defaults (agent-ready, needs-human, recurring) apply; the label set is IaC-owned and now fully declared in github-iac (melodic-software/github-iac#211).

Phase 5 of the ci-workflows work-loop plan (claude-code-plugins docs/topics/ci-workflows-work-loop/PLAN.md). Pre-flight consumer check: no ci-workflows workflow or script reads this file (new surface; seam tooling is the only reader).

Test plan

Run in this checkout with the file present (all passed pre-PR):

• seam capabilities verb: exit 0, full verb/feature envelope
• list-frontier --autonomous: exit 0, JSON envelope (19 items at test time)
• Concurrent claim race on [git-hygiene] Review orphaned branch fix/pr-issue-linkage-bot-exemption (no PR) #198: two parallel claim calls — exactly one exit 0 (lease acquired), one exit 7 (backed off on live foreign lease); test claim unassigned afterward

Related

No linked issue.

[claude]

Claude finished @kyle-sexton's task in 57s —— View job

---

Review: feat(tracker): bind the work-items tracker seam (github provider)

• Read changed files and REVIEW.md criteria
• Check blocking security criteria
• Review configuration correctness and alignment
• Post findings

---

Scope: single file — .work-item-tracker.json

---

Blocking checks

All REVIEW.md blocking criteria assessed against the diff:

Check	Result
No secret/token/credential in tracked source	✅ — file contains only provider name and an integer TTL
Object-level authorization	✅ N/A — static config, no handler
Tenant-scoped data access	✅ N/A
Injection / parameterization	✅ N/A
High-risk action audit log	✅ N/A
Atomicity for multi-record writes	✅ N/A — single file, no paired state

No blocking findings.

---

Observations

The configuration is intentionally minimal and internally consistent with the PR description. Three things worth verifying against the seam schema spec (since that spec isn't in this repo):

🟡 Nit — schema_version type (line 2)
The value is a string "1.0". If the seam schema spec defines schema_version as a number, this will be rejected at parse time. If it expects a semver string, this is correct. Confirming this against the plugin's schema definition before the file is live is low-effort and worth doing.

🟡 Nit — 24-hour lease is the only config key (line 5)
24 hours is a long lease window if the work-loop runs continuously — a stale claim from a crashed run would block re-assignment for up to a day. This is a policy decision and may be intentional (the PR description implies it is), but it's worth verifying the seam has a force-unclaim or expiry-override path before the TTL causes a stuck item in practice.

🟡 Nit — no repo or owner scoping in config (line 3–6)
The provider is github with no explicit repository context in the config block. If the seam infers the target repo from the checkout's git remote or the GITHUB_REPOSITORY env var, this is fine — just confirm the seam resolves to melodic-software/ci-workflows rather than whatever repo happens to be configured in CI at call time.

---

Summary

Change is correct and minimal. No secrets, no injection surface, no multi-file atomicity risk. The three nits above are all "confirm against the seam spec" items, not defects in the file itself. If the pre-PR test run's capabilities / list-frontier / concurrent-claim results are from this exact file on this repo, those nits are already resolved in practice — consider adding a brief note in the PR description pointing to the schema spec version the seam consumed to close the loop for future reviewers.