From 903586892be6b34616d0cd7ed695f5b9778a2bc5 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 16 Jul 2026 22:46:57 -0400
Subject: [PATCH 1/2] feat(runner-policy): register wave-3 runner-input
 contracts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Register three reusable-workflow contracts required by the Wave 3
per-repo floor conversion (github-iac#78):

- standards-sync.yml@3dfb1845 — runner input landed in
  ci-workflows#124 but the contract was never registered, blocking
  the standards repo's sync-lane exception drop.
- do-not-merge-gate.yml@8853021 (ci-workflows#108) and
  pr-issue-linkage.yml@f7e94a8 (ci-workflows#118) — both ship the
  runner/prerequisite-result shape; registration unblocks the
  fleet-routed caller rollouts (ci-workflows#120/#121).

The contract set is fail-closed: unregistered references make every
caller's runner-policy lane fail, so registration must precede the
caller PRs.

Full component suite passes (181/181).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01K3QehVwmWzkBLpKokNCkkt

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 components/runner-policy/policy.json | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json
index 19ecc40..03c23b5 100644
--- a/components/runner-policy/policy.json
+++ b/components/runner-policy/policy.json
@@ -187,6 +187,29 @@
         "contents": "read",
         "issues": "write"
       }
+    },
+    "melodic-software/ci-workflows/.github/workflows/standards-sync.yml@3dfb18452a8c6059a22e62456390d84feb10b42f": {
+      "routing": "runner-input",
+      "runnerInput": "runner",
+      "allowedInputs": ["runner", "manifest", "standards-ref", "dry-run", "targets"],
+      "allowedSecrets": {
+        "app-client-id": "${{ secrets.STANDARDS_SYNC_APP_CLIENT_ID }}",
+        "app-private-key": "${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }}"
+      }
+    },
+    "melodic-software/ci-workflows/.github/workflows/do-not-merge-gate.yml@885302176345486ca6c2c392d83131f9b5389251": {
+      "routing": "runner-input",
+      "runnerInput": "runner",
+      "selectorResultInput": "prerequisite-result",
+      "allowedInputs": ["runner", "prerequisite-result", "label"],
+      "allowedSecrets": {}
+    },
+    "melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@f7e94a80254fdca0aa85a600a07d784753b090e3": {
+      "routing": "runner-input",
+      "runnerInput": "runner",
+      "selectorResultInput": "prerequisite-result",
+      "allowedInputs": ["runner", "prerequisite-result"],
+      "allowedSecrets": {}
     }
   },
   "canonicalSelectorInputs": {

From 24a47a09c73ede74b771a689c0da6bf87afabf50 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 16 Jul 2026 23:14:51 -0400
Subject: [PATCH 2/2] fix(runner-policy): drop standards-sync contract pending
 secret waiver
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Codex review: a secret-bearing runner-input contract without
allowedCallerPermissions still fails privilegedHostedRequirement(), and
the write-permission rule forbids a read-only allowedCallerPermissions
map — so the standards-sync registration was unusable. Sync-lane fleet
routing is deferred behind a reviewed secret-capable waiver.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01K3QehVwmWzkBLpKokNCkkt

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 components/runner-policy/policy.json | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json
index 03c23b5..b23b397 100644
--- a/components/runner-policy/policy.json
+++ b/components/runner-policy/policy.json
@@ -188,15 +188,6 @@
         "issues": "write"
       }
     },
-    "melodic-software/ci-workflows/.github/workflows/standards-sync.yml@3dfb18452a8c6059a22e62456390d84feb10b42f": {
-      "routing": "runner-input",
-      "runnerInput": "runner",
-      "allowedInputs": ["runner", "manifest", "standards-ref", "dry-run", "targets"],
-      "allowedSecrets": {
-        "app-client-id": "${{ secrets.STANDARDS_SYNC_APP_CLIENT_ID }}",
-        "app-private-key": "${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }}"
-      }
-    },
     "melodic-software/ci-workflows/.github/workflows/do-not-merge-gate.yml@885302176345486ca6c2c392d83131f9b5389251": {
       "routing": "runner-input",
       "runnerInput": "runner",