ADR 0002 skip-actors drift: caller-side list removed by #1766 while the reusable default widened to four actors

[kyle-sexton]

Summary

PR #1766 (9ed2956a, re-pin claude lane callers to v0.9.1) removed the explicit caller-side skip-actors override that ADR 0002 ratifies, while re-pinning to a reusable whose default had widened from one actor to four.

The two figures are easy to conflate, so stated precisely:

	Actors	What it is
ci-workflows reusable default, before cf666f67	one — dependabot[bot]	the fallback a caller inherits when it states nothing
ci-workflows reusable default, after cf666f67 (2026-07-27)	four — adds claude[bot], melodic-ai[bot], melodic-standards-sync[bot]	same fallback, widened upstream
ADR 0002 caller-side ratified exception (2026-07-21)	two — dependabot[bot], melodic-standards-sync[bot]	the exception the operator actually deliberated and ratified

So the drift is not "two → four". It is: the ratified two-actor caller-side list stopped being stated, and the effective value silently fell through to the reusable's default, which had independently gone from one to four three days earlier. claude[bot] and melodic-ai[bot] thereby entered a required-check exception without the re-deliberation ADR 0002's own revisit trigger requires ("An actor is added to the caller's skip-actors list → the step-3 skip-actor exception widens; re-deliberate before landing"). ADR 0002 still describes a caller-side list that has not existed since 9ed2956a.

Neither added actor has exercised the exception (claude[bot] has authored no PRs in this org; melodic-ai[bot] none here since the lane went live), so this is a record defect, not an exploited one.

Repair status

Draft repair PR: #1896. It restores the explicit caller-side override on the security-review caller only, behavior-preservingly, and corrects the ADR's mechanism description and compensating-controls statement.

The matching restoration on claude-review.yml is deferred with a trigger: the pinned runner-policy contract for claude-review.yml@c136b27f permits exactly one input (runner), so declaring skip-actors there fails runner-target-contract and reds the required ci-status check. runner-policy is upstream-managed for this repo, so the contract entry cannot be edited here. Trigger to finish it: a re-pin of the review lane to a SHA whose contract lists skip-actors, or a standards-reviewed amendment to the c136b27f entry.

Scope note: before #1766 both callers carried the ratified two-actor list, so the review lane's inherited default is an unrepaired half of the same ratified declaration rather than an unrelated gap. It is bounded by consequence, not excluded by scope — the review lane is advisory and has no required check, so its inherited default cannot let a PR satisfy a required gate with no review. This issue closes on the security lane's repair; the review lane rides its own recorded trigger.

The actor-set question is presented in the ADR as an operator decision point — keep four vs revert to the ratified two — and is not decided by the PR.

Test plan

• Operator picks the actor set on docs(adr): repair ADR 0002's skip-actor exception record and mechanism #1896; the PR is amended if the pick is "revert to two", then marked ready and merged.
• Post-merge: the security lane's effective skip set matches the ADR text exactly; the ADR revisit trigger is satisfied for that lane, and the review lane's inherited default stands as a declared, triggered gap rather than undeclared drift.

Related

• Premise-refutation evidence: agent PRs are green-by-skip (not pinned red); narrowing skip-actors alone would wedge the fleet via checkHumanActor throw (allowed_bots hardcoded dependabot-only at the pin).
• ci-workflows#345 — the workflow-validation-skip gap surfaced while repairing this, tracked upstream.