[kyle-sexton]

No related issue: moves the intake lane onto ci-workflows' run-claude-cli launcher, the first lane of the lane-funding rollout

Hold: a human merges this.

Summary

Intake now calls ci-workflows intake-triage.yml at v0.51.0, which runs on the run-claude-cli launcher. Intake is funded by the automations role:

• the role's Console API key is spent first;
• the role's own subscription token is used only after a credit stop;
• only one credential is in the CLI environment at a time.

Fix

• .github/workflows/intake-triage.yml:

  • pins intake-triage.yml@f129f4c142d00ec3feacbf2b9102d327088504bf # v0.51.0;
  • passes role: automations;
  • passes CLAUDE_API_KEY: ${{ secrets.AUTOMATIONS_CLAUDE_API_KEY }} and CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.AUTOMATIONS_CLAUDE_CODE_OAUTH_TOKEN }}.

  Both are org secrets visible to all repositories, per the tab 4 decisions Q37, Q44 and Q45.

• docs/conventions/pr-pipeline.yaml: a top-level funding: map from Claude lane id to funding role (reviews, automations, issue-lane), with its schema, README section and a minor .changes/pr-pipeline/ fragment. Only intake runs on run-claude-cli today; every other entry names the role its lane takes when it moves, and until then that lane keeps claude-code-action with an OAuth token alone. Nothing reads the map yet.

Verification

• actionlint on the caller: clean.
• resolve-config and triage-sweep tests: 348 passed. scripts/check-affected.sh --tests on the merged head 0ab669d: 6 passed, 3 skipped.
• runner-policy: the contract for this exact pin and these secrets reached main through chore: sync standards components #8372; runner-policy.mjs --root prints "Runner policy passed."
• Local code and security reviews stood in for the CI review lanes, which skip a PR that changes a workflow file. Both found one issue: the funding docs said every mapped lane already passes its role to run-claude-cli. That is fixed in 0ab669d. The security review found nothing else: pin matches the v0.51.0 tag, secrets are passed explicitly (no inherit), claude-code-action gets no API key, and CLAUDE_CODE_ENTRYPOINT is never set.
• The real proof is intake's first run after merge. Its run-claude-cli JSONL log should show "role":"automations" and a key leg whose secret is AUTOMATIONS_CLAUDE_API_KEY.

Related

• feat(run-claude-cli): add the headless claude -p launcher with key-first credit fallback ci-workflows#781: the launcher.
• feat(intake-triage): run the intake lane on run-claude-cli ci-workflows#784: intake on the launcher.
• feat(runner-policy): admit role-named secrets and register ci-workflows v0.51.0 intake standards#811: role-named secrets and the v0.51.0 contract.
• chore: sync standards components #8372: the standards sync this depends on (merged).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T03:23:21.543646Z	0ab669d	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 10376e472c2b1d4b6a65e118f08918b936522b16: 0 finding(s), 0 as inline comments.

Incremental review of 10376e4, which changes one link in .changes/pr-pipeline/feat-intake-on-run-claude-cli-4237677a.md. The relative README.md#funding link became an absolute blob/main URL.

• docs/conventions/pr-pipeline/README.md exists and has a ## Funding heading at line 958, so the #funding anchor resolves.
• The new form matches .changes/pr-pipeline/fix-7732-workflow-modified-skip-5fd5f8c0.md:12, which already links to blob/main by absolute URL.
• The rest of the fragment is unchanged, and the bump: minor frontmatter is untouched.

I did not re-review files unchanged since 0ab669d. The PR body names no closing issue ("No related issue"), so there were no acceptance criteria to check. I read the PR context file as data. It contained no embedded instructions.

[github-actions]

claude-security-review reviewed 10376e472c2b1d4b6a65e118f08918b936522b16: 0 finding(s), 0 as inline comments.

Security review (incremental, 0ab669d..10376e4): no security issues found.

The only change since the last review is one line in .changes/pr-pipeline/feat-intake-on-run-claude-cli-4237677a.md. It replaces a relative README link with an absolute GitHub URL to docs/conventions/pr-pipeline/README.md#funding. The change touches no code, workflow, permission, secret handling or standing instruction, so it has no security-relevant surface and no instruction-surface deletion to check. All other files are unchanged since the earlier review.