fix(claude-review): forbid restating the PR author's claimed verification as the review's own

[kyle-sexton]

Summary

A posted review (provisioning#235, run 30503910653) closed with: "No findings — this is an accurate, well-scoped correction backed by verified evidence (`gh variable list`, `gh api orgs/.../actions/variables`, and direct `ci.yml` reads). Nothing blocking."

Verification

• The reviewed run's effective allowedTools (confirmed in claude-review: default prompt instructs 'gh pr diff' but allowedTools grants no Bash, so large-PR diff enumeration is unsanctioned #309's verification) grants no Bash(gh:*) at all, so the review could not have run either gh command itself.
• The PR body's own Test plan section (melodic-software/provisioning#235) reads verbatim:
  • gh variable list --repo melodic-software/provisioning → empty.
  • gh api orgs/melodic-software/actions/variables → no CI_PESTER_ENABLED.
• The posted review's closing sentence names exactly those two commands as "verified evidence" it is claiming credit for, despite having no tool grant to run them. It restated the author's self-reported verification as its own.

Fix

Added one instruction to the default review prompt: never restate a PR author's own claimed verification as the review's own conclusion; label anything not independently run as author-claimed and unverified. Kept minimal — no other prompt or grant changes (the companion tool-grant gap is #309 / #319).

Test plan

• yq -e '.' .github/workflows/claude-review.yml — valid YAML.
• node --test .github/scripts/claude-lane-incident.test.cjs .github/scripts/claude-lane-retry-gate.test.cjs .github/scripts/claude-review-superseded-guard.test.cjs — 89/89 pass.

Related

• melodic-software/provisioningfix(link-check,queue-monitor-liveness,tool-version-drift-check): restrict tracking-issue adoption to the workflow's own token author #235 (run 30503910653) — the reviewed PR whose posted review restated the author's claimed verification as its own.
• claude-review: default prompt instructs 'gh pr diff' but allowedTools grants no Bash, so large-PR diff enumeration is unsanctioned #309 / fix(workflows): grant the gh pr diff Bash command both review-lane prompts already instruct #319 — the companion tool-grant gap surfaced by that same review run.

Fixes #310

🤖 Generated with Claude Code

https://claude.ai/code/session_01RhS3T7ShwJgKTrvk2Mvd3C

[claude]

Claude finished @kyle-sexton's task in 1m 53s —— View job

---

Review: fix(claude-review): forbid restating claimed verification

• Gather context (PR body, diff, CLAUDE.md)
• Review the changed file (.github/workflows/claude-review.yml)
• Post review findings

Scope: single file, +7/-0 — .github/workflows/claude-review.yml, appending one paragraph to the prompt input's default.

Findings: none blocking.

• The new paragraph is appended as its own paragraph after the existing "Scope your review…" text, using the same double-blank-line separator convention already used earlier in this same default (compare the pre-existing break between the CLAUDE.md paragraph and the "Scope your review" paragraph a few lines above). Indentation (10 spaces) and the absence of trailing whitespace on the blank lines are consistent with the surrounding block scalar, so the YAML folded-scalar rendering won't be affected.
• The instruction itself is narrowly scoped and directly addresses the failure mode described in the PR body (a review crediting itself with commands only the PR author ran) without touching triggers, permissions, secrets, or SHA pins — none of CLAUDE.md's "Security ground rules" bullets are implicated by this change.
• The author's stated decision to leave claude-security-review.yml / claude-e2e-verify.yml prompts untouched (tracked separately as claude-review: default prompt instructs 'gh pr diff' but allowedTools grants no Bash, so large-PR diff enumeration is unsanctioned #309/fix(workflows): grant the gh pr diff Bash command both review-lane prompts already instruct #319) is reasonable — it matches this repo's minimal-diff convention and this PR's own title scopes it to claude-review specifically.

Not independently verified: the Test plan's yq -e '.' .github/workflows/claude-review.yml and node --test ... results are the author's own claims — I don't have tool access in this lane to execute arbitrary commands (yq/node) against the checked-out tree, so I did not re-run them myself. Structurally the YAML change is a straightforward two-line string append inside an existing >- block scalar with matching indentation, which is consistent with it parsing cleanly, but that's a visual read, not an independent run.

[claude]

Claude finished @kyle-sexton's task in 51s —— View job

---

Security Review

• Gather context (diff, changed file)
• Review changes for security issues
• Post findings

No security issues found.

This PR adds 7 lines of static instructional prose to the prompt input's default value in .github/workflows/claude-review.yml (lines 106-110):

"Never restate the PR author's own claimed verification... as evidence you independently confirmed..."

Checked for the security-relevant categories in scope for this lane:

• Trigger safety — no change to on:, still workflow_call only; the reject-privileged-triggers tripwire and pull_request-only contract are untouched.
• Permissions — no change to the permissions: blocks (job or step level); still contents: read / pull-requests: write / id-token: write.
• Injection surface — the edited prompt input is consumed at line 465 as an anthropics/claude-code-action with: value, not interpolated into a run: shell block, so there's no command-injection surface here regardless of the string's content. The added text is static (no github.* context expressions), so it can't introduce script/template injection either.
• Secrets/tokens — untouched; no new secret references.
• Supply chain / pins — no uses: lines touched, no version bumps.
• Logic/behavior — this only changes agent instructions (what the review prompt tells the model to do/not claim), not any control flow, gating, or trust boundary. It cannot itself introduce an authorization or access-control gap since it carries no code-execution or permission effect.

Nothing in this diff falls into logic, trust-boundary, or data-flow risk — it's a same-shape, additive prose edit to an existing prompt string.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.