feat(runner-policy): register prerequisite gate runner contracts

[kyle-sexton]

Summary

• register the exact merged melodic-software/ci-workflows prerequisite-gate contracts at 380612ae1d4e0cc9741efbac7b6ffb3d3da63a04
• preserve each workflow's reviewed runner, prerequisite-result, allowed-input, and empty-secret boundaries
• lock the production inventory in the runner-policy regression suite and document the strict-selector sentinel caveat

Why

ci-workflows#177 moved semantic-pr, do-not-merge-gate, and pr-issue-linkage to the caller-selected runner for every prerequisite outcome. Private consumers cannot repin to that immutable merge until the canonical standards runner policy recognizes the exact reviewed contracts.

The canonical components/runner-policy/policy.json is the source of truth. Its managed downstream copies will flow through the normal standards synchronization process; no generated or consumer copy is edited here.

Validation

• focused production-contract test: 1 passed
• complete runner-policy suite: 228 passed
• runner-policy self-audit: passed
• markdownlint: 0 errors
• pre-commit: Biome, EditorConfig, markdownlint, typos, and gitleaks passed

No linked issue: this PR is the required standards registration follow-up to an already completed ci-workflows issue.

Related

• Campaign: flip private-repo selector recovery fallbacks to the managed fleet label ci-workflows#177
• fix: preserve caller runner for failed prerequisites ci-workflows#207

[claude]

Claude finished @kyle-sexton's task in 2m 27s —— View job

---

PR Review

• Gather context and read changed files
• Review policy.json changes
• Review runner-policy.test.mjs changes
• Review README.md changes
• Check against REVIEW.md criteria
• Post findings

---

Summary

Clean, narrowly scoped registration. The three new contracts at 380612ae are internally consistent with the established prerequisite-gate pattern, the SHA is identical across policy.json, the test constant, and the README prose, and no secrets are introduced. No blocking issues found.

REVIEW.md "Always check" pass

Criterion	Result
Object-level authorization	N/A — config-only change
Tenant-scoped data access	N/A
Secrets in tracked source	Clean — all three new contracts carry "allowedSecrets": {}
Injection via external input	N/A
Audit logging for high-risk actions	N/A
Atomicity across related writes	N/A

Observations

Test loop departs from surrounding flat-assertion style — a minor consistency note, not a defect.

The rest of the "production contracts pin" test block uses individual assert.deepEqual calls. The three new contracts are verified through a for...of loop:

// runner-policy.test.mjs:3254-3271
for (const [workflow, allowedInputs] of [
  ["semantic-pr.yml", ["runner", "prerequisite-result"]],
  ...
]) {
  assert.deepEqual(
    contracts[`.../${workflow}@${PREREQUISITE_GATE_RUNNER_SHA}`],
    { ... allowedInputs, ... },
  );
}

The loop is functionally correct — assert.deepEqual inside a loop still pinpoints which workflow failed — and reduces repetition of an identical shape. The departure is worth noting, but it's a reasonable authoring choice, not something to change.

pr-issue-linkage@d7734df not covered by the production-contracts test — pre-existing gap, not introduced here. Line 400–405 of policy.json shows this contract exists, but the production-contracts test block has no corresponding assertion for it. This PR follows the same approach for the three new 380612ae entries (they are asserted), so the gap isn't widened.

No allowedCallerPermissions on any of the three new contracts — this matches every other prerequisite-gate contract at prior SHAs and is correct; the selection privilege flows via the selector result, not a caller-token permission.

Verdict

No blocking, important, or nit-level issues under the REVIEW.md criteria that survive verification. The PR is ready to merge.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9df202167

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kyle-sexton]

🔒 babysit-prs lane claiming this PR for on-branch fix work this cycle (amendment-round: 16, safe tier). Will fix clear branch-owned findings and push; will not resolve threads or merge (safe tier).

[claude]

Claude encountered an error after 1s —— View job

---

I'll analyze this and get back to you.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/standards/actions/runs/29992661109
• Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":538,"total_cost_usd":0}

Re-running the job, or pushing a new commit, will retry the review.