Follow-up from #224 (bundle work-item-tracker seam, shape A). Deferred by author delegation; tracked here.
Finding (P2)
Source: #224 review thread on plugins/work-items/tools/work-item-tracker/adapters/github/common.sh.
For the normal bundled-adapter path, the github adapter resolves its bot wrapper to ${CLAUDE_PLUGIN_ROOT}/tools/github-auth/gh-bot.sh, but the CONTRACT says a consuming repository can provide its wrapper at ${CLAUDE_PROJECT_DIR}/tools/github-auth/gh-bot.sh. Since the plugin does not ship that wrapper, repository-provided bot attribution is never used and all tracker writes (item create, lease/reclaim comments) fall back to the ambient gh (session-user) identity.
Why deferred (not fixed in #224)
This is exactly the gap #224's own PR body documents as dependency #1 ("gh-bot identity on tracker WRITES"), with option (c) recommended as a separate plugin PR: enhance the plugin's github adapter to also look for a consumer-root wrapper (${CLAUDE_PROJECT_DIR}/tools/github-auth/gh-bot.sh), resolved consumer-local-first, independent of the adapter location. It was deliberately not built in #224 because it changes the live adapter's documented identity/write path and is not one of the enumerated shape-A deliverables (#1505). claude[bot]'s review independently reached the same conclusion.
Suggested fix
Resolve the bot wrapper consumer-local-first (${CLAUDE_PROJECT_DIR}/tools/github-auth/gh-bot.sh), then plugin-bundled, independent of where the adapter itself resolved from — mirroring the two-rule adapter resolution. This lets a non-vendoring consumer (e.g. medley) keep bot-attributed tracker writes with zero vendoring.
Follow-up from #224 (bundle work-item-tracker seam, shape A). Deferred by author delegation; tracked here.
Finding (P2)
Source: #224 review thread on
plugins/work-items/tools/work-item-tracker/adapters/github/common.sh.For the normal bundled-adapter path, the github adapter resolves its bot wrapper to
${CLAUDE_PLUGIN_ROOT}/tools/github-auth/gh-bot.sh, but the CONTRACT says a consuming repository can provide its wrapper at${CLAUDE_PROJECT_DIR}/tools/github-auth/gh-bot.sh. Since the plugin does not ship that wrapper, repository-provided bot attribution is never used and all tracker writes (item create, lease/reclaim comments) fall back to the ambientgh(session-user) identity.Why deferred (not fixed in #224)
This is exactly the gap #224's own PR body documents as dependency #1 ("gh-bot identity on tracker WRITES"), with option (c) recommended as a separate plugin PR: enhance the plugin's github adapter to also look for a consumer-root wrapper (
${CLAUDE_PROJECT_DIR}/tools/github-auth/gh-bot.sh), resolved consumer-local-first, independent of the adapter location. It was deliberately not built in #224 because it changes the live adapter's documented identity/write path and is not one of the enumerated shape-A deliverables (#1505). claude[bot]'s review independently reached the same conclusion.Suggested fix
Resolve the bot wrapper consumer-local-first (
${CLAUDE_PROJECT_DIR}/tools/github-auth/gh-bot.sh), then plugin-bundled, independent of where the adapter itself resolved from — mirroring the two-rule adapter resolution. This lets a non-vendoring consumer (e.g. medley) keep bot-attributed tracker writes with zero vendoring.