fix(work-items): re-key triage scope on state, not authorship (#486) by kyle-sexton · Pull Request #802 · melodic-software/claude-code-plugins

kyle-sexton · 2026-07-21T06:28:11Z

Summary

plugins/work-items/skills/triage/SKILL.md scoped raw intake as "items the team did not author (bug reports, incoming feature requests, unsolicited PRs)." That authorship-based boundary contradicted the plugin's own self-observation / dogfood filing contract (reference/dogfood-filing.md): the team files issues it notices while operating with only the raw marker (needs-triage), and the attention view surfaces every raw-marker item regardless of author. Read literally, the scope prose excluded exactly the items the queue is built from — a self-contradiction surfaced by a real cycle holding 7 team-authored dogfood issues (#459, #475, #477, #478, #479, #480, #481) that needed the same triage treatment as external intake.

Fix

Re-key the scope definition on triage state, not authorship, in three places that carried the same defining phrase — the "Scope: raw intake only" section, the Purpose, and the frontmatter description:

Raw intake is now defined as any untriaged item carrying the raw marker, whoever authored it. The "did not author" phrasing is demoted to an illustrative list of common sources; a team-authored dogfood issue carrying only the raw marker is explicitly named as in-scope raw intake.
The paired exclusion is re-keyed too: "never re-triage already-triaged output" now turns on classification-labels-at-creation (decompose output, or track add items born labeled) rather than track add authorship. The prior blanket "team-authored track add items are born triaged" was itself part of the contradiction — dogfood items are filed through track add yet carry only the raw marker. The exclusion now correctly keeps born-triaged items out while admitting raw-marker-only dogfood items.

No triage routing logic changed — this is a scope-prose consistency fix. The external "raw intake" framing is preserved for genuinely external items; only the authorship-based contradiction is removed.

Verification

skill-quality:check static contract gate (18 checks) over the edited skill, run from the worktree against the plugin's skills root:

INFO: description length 858/1536 chars
INFO: all 9 base-ref trigger phrase(s) preserved
INFO: SKILL.md 168/500 lines
INFO: markdownlint clean
WARN: no Gotchas surface (inline '## Gotchas' or context/gotchas.md) — confirm the skill has no observed failure history
INFO: no metadata.category in frontmatter (optional — category not machine-readable)

CHECK-SKILL triage: PASS — 0 errors, 1 warning(s)

PASS, 0 errors. Description grew but stays well within the listing budget (858/1536).
All 9 trigger phrases preserved vs base ref — auto-invocation triggers intact (the Use when: list was untouched).
The single WARN (no Gotchas surface) is pre-existing and unrelated to this prose change.

Commit is SSH-signed (verified) and messaged via git commit -F -.

Closes #486

work-items(triage): "raw intake = items the team did not author" scope prose excludes team-authored self-observation/dogfood issues that legitimately need triage #486 — this fix.
Triggering example: the 7 team-authored dogfood issues from the 2026-07-19 triage cycle — work-items(triage): step-2 "wait for user direction" gate contradicts the skill's own autonomous/agent triage mode #459, source-control:babysit-prs: babysit-readiness-gate.sh exits 4 without FETCH_COMMENTS_OWNER/FETCH_COMMENTS_REPO env vars, undocumented in worker contract #475, source-control(babysit-prs): absorb v4 loop-prompt operating rules into the skill #477, work-items(triage): absorb v4 loop-prompt routing rules into the skill #478, work-items(work): absorb v4 loop-prompt execution rules into the skill #479, feat(claude-ops or session-flow): loop-prompt authoring skill — generate and maintain standing loop-lane prompts #480, feat: /goal prompt-crafting skill — docs-conformant goal shape + mechanical length check #481 — that were queued with only the raw marker and needed the same triage treatment as external intake.
work-items(triage): step-2 "wait for user direction" gate contradicts the skill's own autonomous/agent triage mode #459 (autonomous-mode contract) and work-items(triage): absorb v4 loop-prompt routing rules into the skill #478 (routing-rule absorption) remain distinct: this change is specifically the authorship-based scope boundary, not routing logic.

🤖 Generated with Claude Code

https://claude.ai/code/session_01K1V3gkrfSf75isB8MiDy3o

The triage skill defined raw intake as "items the team did not author," which contradicted the plugin's own self-observation filing contract: team-authored dogfood issues carry only the raw marker, surface in the same attention view, and genuinely need triage. Redefine raw intake as any untriaged item carrying the raw marker, whoever authored it, across the scope section, Purpose, and frontmatter description. Re-key the paired "never re-triage already-triaged output" exclusion on classification-labels-at-creation rather than track-add authorship, so a dogfood issue carrying only the raw marker is in scope while born-triaged items stay out. No routing-logic change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K1V3gkrfSf75isB8MiDy3o

claude · 2026-07-21T06:28:26Z

Claude finished @kyle-sexton's task in 1m 4s —— View job

PR Review — `fix(work-items): re-key triage scope on state, not authorship (#486)`

Gather context and understand the PR
Read changed files
Review diff for correctness and consistency
Post review findings

Summary

This is a scope-prose consistency fix across three files — no routing logic changes. The change is well-reasoned and cleanly executed.

Verdict: Approve. The fix is correct, internally consistent, and the rationale is airtight. One minor observation below, but it does not block merge.

Review

`plugins/work-items/skills/triage/SKILL.md` — core change

The three sites that carried the authorship-based definition are now consistent:

Frontmatter description — changed from "items the team did not author" to "any untriaged item carrying the raw marker, whoever authored it (…and team-authored self-observation/dogfood issues)." Correct. The new wording is also within the 1536-char listing budget per the verification run (858 chars).
Purpose — identically updated. Consistent with frontmatter.
Scope section — the new opening paragraph is the clearest and most durable form of the rule. The key insight is stated plainly: "The boundary is untriaged vs. already-triaged, never external vs. team-authored."

The paired exclusion bullet (Never re-triage already-triaged output) is correctly re-keyed. The old wording — "team-authored track add items are born triaged" — was a blanket claim that was false for dogfood items. The new wording gates exclusion on classification-labels-at-creation, not authorship. The inline callout that distinguishes a track add item with classification labels (out of scope) from a dogfood issue with only the raw marker (in scope) is precise and necessary — it pre-answers the exact question a reader is likely to have after the main rule.

Cross-referencing with reference/dogfood-filing.md: the filing contract explicitly sets needs-triage on freshly filed dogfood items and says "the filer does not self-triage." The updated scope text is now in direct agreement with that contract.

One minor nit (non-blocking): The attention-view section (line 80) still says:

"surface only external PRs (a collaborator's in-flight PR is not triage work…)"

This residual "external" qualifier for the PR filter in the attention view is distinct from the authorship gate that was the bug — it is a UX filter for in-flight work, not a claim about what counts as raw intake. So it is not a contradiction introduced by this PR. But if a future reader scans the file for authorship-related wording, it may momentarily read as inconsistent with the new definition. A parenthetical like "(this is a display filter, not a scope definition)" could forestall the confusion. Not required for this fix. [Fix this →](https://claude.ai/code?q=In+plugins%2Fwork-items%2Fskills%2Ftriage%2FSKILL.md+around+line+80%2C+the+attention+view+section+says+%22surface+only+external+PRs%22+as+a+display+filter.+Add+a+short+parenthetical+like+%22(this+is+a+display+filter%2C+not+a+scope+boundary%22+to+prevent+confusion+with+the+updated+authorship-neutral+scope+definition.+Branch%3A+fix%2F486-triage-scope-prose-dogfood&repo=melodic-software/claude-code-plugins)

`plugins/work-items/.claude-plugin/plugin.json` — version bump

0.18.0 → 0.18.1. Correct — this is a backwards-compatible prose/documentation fix, so a patch bump is appropriate.

`plugins/work-items/CHANGELOG.md` — new `[0.18.1]` entry

The entry accurately summarizes: what changed (three locations), why (self-contradiction with dogfood-filing.md), the new invariant, the re-keyed exclusion, and the no-routing-logic-change statement. Format follows the existing Keep-a-Changelog pattern in the file.

Checklist

Check	Result
Authorship contradiction resolved	✅
Three sites consistent with each other	✅
Consistent with `reference/dogfood-filing.md`	✅
Born-triaged exclusion correctly re-keyed on state, not authorship	✅
No routing logic changed	✅
Version bump appropriate (patch)	✅
Changelog entry accurate and format-consistent	✅
Trigger phrases / `Use when:` list untouched	✅ (per verification run)

claude · 2026-07-21T06:28:32Z

Claude finished @kyle-sexton's task in 1m 1s —— View job

Security Review — PR #802

Read PR diff and changed files
Analyze for security vulnerabilities

No security issues found.

This PR touches three files:

File	Nature of change
`plugins/work-items/.claude-plugin/plugin.json`	Version bump `0.18.0` → `0.18.1` only
`plugins/work-items/CHANGELOG.md`	Prose changelog entry
`plugins/work-items/skills/triage/SKILL.md`	Prose scope-definition rewrite

All changes are pure prose/documentation. I checked each relevant attack surface:

Injection (command, SQL, path, template): The new paragraph at line 35 of SKILL.md introduces one ${CLAUDE_PLUGIN_ROOT}/reference/dogfood-filing.md reference in a markdown link. This template variable is the Claude Code SDK's plugin-root resolver — the same pattern used on lines 17, 44, 50, 70, 126, 140, and 142 that already existed. It is not user-controlled input and introduces no new injection surface.
Token / secret / credential handling: None present.
Authorization / access-control gaps: No routing logic changed. The edit narrows the scope prose from an authorship test to a triage-state test; no gate or permission check is weakened or bypassed.
GitHub Actions patterns: No workflow files changed.
Supply-chain / dependency risk: No dependency pins or action refs changed.
Permission widening: No permissions: block, settings file, or config modified.

Verdict: clean. No findings to report.

kyle-sexton · 2026-07-21T06:31:41Z

Post-green review classification (work lane):

Finding	Source	Classification	Disposition
Attention-view's "external PRs" qualifier (line ~80) could momentarily read as inconsistent with the new authorship-neutral scope definition	PR review	Explicitly non-blocking — reviewer confirms it's a display filter, not a scope boundary, and not a contradiction this PR introduced	No action needed
Everything else	PR review + security review	8/8 checklist items pass; "Verdict: Approve." Security: "clean, no findings."	No action needed

No DEFER-FORBIDDEN class applies (no data-loss, no gate, no security-posture finding, no silently-wrong output — this is a prose-only scope-definition fix with zero routing-logic change, confirmed by both reviews).

No inline review threads exist on this PR (GraphQL query returned empty) — nothing to resolve.

Handing off to the babysit lane for ongoing watch.

claude · 2026-07-21T06:31:56Z

Claude finished @kyle-sexton's task in 1m 24s —— View job

PR Review — `fix(work-items): re-key triage scope on state, not authorship (#486)`

Gather context and understand the PR
Read changed files and diff
Review for correctness, consistency, and CLAUDE.md alignment
Post final review findings

Summary

Prose-only scope fix across three sites in the triage skill. The change is correct, internally consistent, and resolves a genuine self-contradiction with the plugin's own dogfood-filing contract. Verdict: Approve.

File-by-file findings

`plugins/work-items/skills/triage/SKILL.md`

Three sites updated, all consistent with each other:

Frontmatter description (line 3) — old: "items the team did not author"; new: "any untriaged item carrying the raw marker, whoever authored it." Correct and within the 1536-char listing budget (858 chars per the verification run).
Purpose (line 24) — identical update. Consistent with frontmatter.
Scope section (line 35) — the new opening paragraph is the clearest statement of the invariant: "The boundary is untriaged vs. already-triaged, never external vs. team-authored." The link to ${CLAUDE_PLUGIN_ROOT}/reference/dogfood-filing.md follows the same variable-substitution pattern used throughout the file — no plugin-form isolation concern.

The re-keyed exclusion (line 40) is the most precise part of the fix: the old wording ("team-authored track add items are born triaged") was a blanket claim that was false for dogfood items. The new wording correctly gates exclusion on classification-labels-at-creation, not authorship. The inline clarification distinguishing a labeled track add item (out of scope) from a dogfood issue carrying only the raw marker (in scope) directly pre-answers the question a reader will have after the main rule.

Alignment with reference/dogfood-filing.md: Confirmed. That contract explicitly states (line 45–46): "A self-filed item is raw intake: the filer records what it observed, not a verified diagnosis" and (line 57): "The filer does not self-triage." The updated scope text is in direct agreement — dogfood items enter the triage queue with only needs-triage, and the skill is now correctly scoped to evaluate them.

The attention-view line 80 "external PRs" display filter is not a concern. The existing parenthetical — "this filter is discovery-only, and an explicitly named PR is always triaged regardless of author" — already makes clear this is a display filter, not a scope boundary. The "regardless of author" clause even reinforces the new authorship-neutral definition. No change needed.

`plugins/work-items/.claude-plugin/plugin.json`

Version bump 0.18.0 → 0.18.1. Correct — patch bump is appropriate for a backwards-compatible prose fix. The plugin-level description field does not carry the authorship-based definition, so no change needed there.

`plugins/work-items/CHANGELOG.md`

New [0.18.1] entry. Follows the existing Keep-a-Changelog format. Accurately covers: what changed (three locations), why (self-contradiction with dogfood-filing.md), the new invariant, the re-keyed exclusion, and the no-routing-logic-change statement.

Checklist

Check	Result
Authorship contradiction resolved	✅
Three sites mutually consistent	✅
Consistent with `reference/dogfood-filing.md`	✅
Born-triaged exclusion correctly re-keyed on state, not authorship	✅
No routing logic changed	✅
`${CLAUDE_PLUGIN_ROOT}` reference follows existing plugin-form pattern	✅
Version bump appropriate (patch)	✅
Changelog entry accurate and format-consistent	✅
Trigger phrases / `Use when:` list untouched	✅

claude · 2026-07-21T06:32:00Z

Claude finished @kyle-sexton's task in 1m 6s —— View job

Security Review — PR #802

Read PR diff and changed files
Analyze for security vulnerabilities
Report findings

No security issues found.

This PR modifies three files, all pure prose:

File	Change
`plugins/work-items/.claude-plugin/plugin.json`	Version bump `0.18.0` → `0.18.1` only
`plugins/work-items/CHANGELOG.md`	Prose changelog entry
`plugins/work-items/skills/triage/SKILL.md`	Prose scope-definition rewrite

Each relevant attack surface checked:

Injection (command, path, template): The new paragraph at line 35 introduces one ${CLAUDE_PLUGIN_ROOT}/reference/dogfood-filing.md reference as a markdown link. This is the same system-provided plugin-root resolver used on lines 17, 44, 50, 70, 126, 140, and 142 — it is not user-controlled input, resolves to the plugin's isolated cache directory, and introduces no new injection surface.
Token / secret / credential handling: None present.
Authorization / access-control gaps: No routing logic changed. The prose narrows the scope boundary from an authorship test to a triage-state test; no gate or permission check is weakened or bypassed.
GitHub Actions patterns: No workflow files changed.
Supply-chain / dependency risk: No dependency pins or action refs changed.
Permission widening: No permissions: block, settings file, or config modified.

Verdict: clean. No findings to report.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7c3265eba7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

The re-keyed "never re-triage already-triaged output" exclusion turned on "classification labels at creation," but a `track add` dogfood item and a plain `track add` item both carry a default `priority:` label — the label's presence cannot discriminate them. Only the raw marker (`status:needs-triage`) does, and a dogfood item carries it alongside that default priority label, so the old wording could read a dogfood issue as already-triaged and exclude the very items this scope fix admits. Re-key the exclusion on absence of the raw marker: the raw marker (or being unlabeled) puts an item in scope even alongside default labels, while an item carrying classification labels but no raw marker is born-triaged and out. Drop the over-broad "role-labeled and briefed from birth" claim, which held only for decompose and `--agent-ready` output, not plain `track add`. Align the CHANGELOG entry. No routing-logic change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fgx6EDAL4cGAFwTNgLpsus

claude · 2026-07-21T07:11:01Z

Claude finished @kyle-sexton's task in 1m 37s —— View job

PR Review — `fix(work-items): re-key triage scope on state, not authorship (#486)`

Gather context and read PR diff
Read changed files and dogfood-filing contract
Evaluate Codex finding on classification-label exclusion
Post review findings

Summary

This PR now has two commits. The second commit (42cde3e) was pushed in direct response to the Codex P2 finding and resolves it cleanly. Verdict: Approve. The branch is correct end-to-end.

Codex P2 finding — evaluated and closed

The Codex review identified a residual flaw in the first commit's (7c3265e) exclusion wording: keying on "classification labels at creation" could still wrongly exclude dogfood items, because a track add dogfood item and a plain track add item both receive a default priority: label — label presence cannot discriminate between them.

The second commit (42cde3e) directly fixes this. The new exclusion at line 40 reads:

"This exclusion keys on absence of the raw marker, not authorship and not the mere presence of classification labels: the raw marker (status:needs-triage, or being unlabeled) puts an item in scope even alongside default labels, so a team-authored dogfood issue filed with a default priority: label and the raw marker is in scope (the marker wins), while a track add item that carries classification labels but no raw marker is out of scope…"

This is the correct discriminator. The dogfood-filing contract (reference/dogfood-filing.md, lines 54–59) confirms the sequence: categorize → file via track add → apply status:needs-triage. An item exits that sequence carrying a priority: label and the raw marker. Only the raw marker's presence/absence distinguishes in-scope from out-of-scope — which is exactly what the new wording tests.

The CHANGELOG was also updated in 42cde3e to replace "classification-labels-at-creation" with "absence of the raw marker" language, keeping CHANGELOG and SKILL.md consistent.

Codex P2 finding: resolved.

Full diff checklist (both commits)

Check	Result
Authorship contradiction resolved (3 sites: frontmatter, Purpose, Scope)	✅
Three sites mutually consistent with each other	✅
Consistent with `reference/dogfood-filing.md` filing sequence	✅
Exclusion keys on raw-marker absence, not authorship, not classification labels	✅ (`42cde3e`)
Dogfood item with default `priority:` label + raw marker explicitly called in-scope	✅
CHANGELOG updated to match final exclusion wording	✅
No routing logic changed	✅
Version bump appropriate (patch)	✅
Trigger phrases / `Use when:` list untouched	✅

claude · 2026-07-21T07:11:01Z

Claude finished @kyle-sexton's task in 1m 15s —— View job

Security Review — PR #802

Read PR diff
Read changed files
Analyze for security vulnerabilities
Report findings

No security issues found.

This PR touches three files, all pure prose/documentation/configuration:

File	Change
`plugins/work-items/.claude-plugin/plugin.json`	Version bump `0.18.0` → `0.18.1` only
`plugins/work-items/CHANGELOG.md`	Prose changelog entry
`plugins/work-items/skills/triage/SKILL.md`	Prose scope-definition rewrite (3 sites)

Each relevant attack surface checked:

Injection (command, path, template): The new paragraph at SKILL.md line 35 introduces one ${CLAUDE_PLUGIN_ROOT}/reference/dogfood-filing.md reference as a markdown link. This is the same system-provided plugin-root resolver already in use on lines 17, 44, 50, 70, 126, 140, and 142 of the same file. It is not user-controlled input, resolves to the plugin's isolated cache directory, and introduces no new injection surface.
Token / secret / credential handling: None present in any changed file.
Authorization / access-control gaps: The scope boundary is moved from an authorship test to a triage-state test. No gate or permission check is weakened or bypassed. SKILL.md is an instruction document for Claude, not an enforcement mechanism.
GitHub Actions patterns: No workflow files changed.
Supply-chain / dependency risk: No dependency pins or action refs changed. The version field in plugin.json is a semantic-versioning bump only.
Permission widening: No permissions: block, settings file, or config modified.

Verdict: clean. No findings to report.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 42cde3ea00

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…ope (#486) The `triage-never-reprocesses-decompose-output` eval still defined raw intake as "items the team did not author" and claimed "born-labeled items never land in the unlabeled or needs-triage buckets." Both are stale after the scope was re-keyed on triage state: a dogfood item is now born with a default `priority:` label AND the raw marker, so it does land in the needs-triage bucket — the same label-vs-marker confusion already fixed in the skill body. Re-key the eval's expected_output and expectations on absence of the raw marker rather than authorship or label presence. The scenario (decompose output declined) is unchanged; only the explanations align with the shipped behavior. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fgx6EDAL4cGAFwTNgLpsus

claude · 2026-07-21T07:44:55Z

Claude finished @kyle-sexton's task in 1m 46s —— View job

PR Review — `fix(work-items): re-key triage scope on state, not authorship (#486)`

Gather context and read PR diff
Read changed files (all 4)
Review for correctness, consistency, and CLAUDE.md alignment
Post final review findings

Summary

This is a three-commit prose fix. All four changed files are internally consistent and consistent with each other. No routing logic changed. Verdict: Approve — nothing new to flag.

The prior review cycles caught and resolved both Codex findings in-flight (P2 label-vs-marker confusion in commit 42cde3e; stale eval in commit 3b5ff1a). What follows is a clean full-diff pass over the final state.

File-by-file

`plugins/work-items/skills/triage/SKILL.md` — core fix

Three sites updated, all mutually consistent:

Frontmatter description (line 3) — old: "items the team did not author"; new: "any untriaged item carrying the raw marker, whoever authored it (…and team-authored self-observation/dogfood issues)." Correct. 858/1536 chars.
Purpose (line 24) — same update, consistent with frontmatter.
Scope section / exclusion (lines 35–40) — the invariant is correctly stated at line 35: "The boundary is untriaged vs. already-triaged, never external vs. team-authored." The paired exclusion at line 40 correctly keys on absence of the raw marker, not authorship and not the mere presence of classification labels. The inline clarification that a dogfood issue with a default priority: label plus the raw marker is in scope (marker wins) is exactly right — it directly pre-empts the re-confusion the Codex P2 found in the first draft.

Attention-view line 80 — the "surface only external PRs" qualifier is already paired with "this filter is discovery-only, and an explicitly named PR is always triaged regardless of author". The "regardless of author" clause reinforces the new authorship-neutral definition. No issue.

`plugins/work-items/skills/triage/evals/evals.json` — stale-eval fix

Only eval id=3 (triage-never-reprocesses-decompose-output) changed. Correctly targeted:

expected_output (line 36) — drops the old authorship framing, now says "triage covers raw intake only (untriaged items carrying the raw marker, regardless of authorship) and that the exclusion keys on absence of the raw marker." Matches SKILL.md line 35.
Exclusion-rule expectation (line 40) — correctly updated to "the exclusion keys on absence of the raw marker (born triaged), not authorship and not the mere presence of classification labels." Matches SKILL.md line 40.
Attention-view expectation (line 42) — drops the false "born-labeled items never land in the needs-triage bucket" claim (which would reject correctly-behaving dogfood items) for "carries a routing decision and no raw marker, so being neither unlabeled nor raw-marked it falls in none of the view's buckets." This is precise and correct.

Evals 1, 2, 4, 5, 6 reference "external bug report" or "outside contributor" only in their scenario prompts (not in expected behavior), so they don't need updating — those are scenario setups, not scope definitions.

`plugins/work-items/.claude-plugin/plugin.json`

Version bump 0.18.0 → 0.18.1. Correct — backwards-compatible prose/doc fix warrants a patch bump.

`plugins/work-items/CHANGELOG.md`

The [0.18.1] entry accurately covers: three sites changed, reason (contradiction with dogfood-filing.md), the new invariant (raw marker wins over coexisting default labels), the re-keyed exclusion (absence of the raw marker, not track add authorship), and the no-routing-logic-change statement. Follows Keep-a-Changelog format correctly.

Checklist

Check	Result
Three SKILL.md sites mutually consistent	✅
Consistent with `reference/dogfood-filing.md`	✅
Exclusion keys on raw-marker absence, not authorship, not label presence	✅
Dogfood item with default `priority:` label + raw marker explicitly in scope	✅
Stale eval `triage-never-reprocesses-decompose-output` updated (expected_output + exclusion + attention-view expectations)	✅
Other evals untouched (scenario prompts, not scope definitions)	✅
No routing logic changed	✅
Version bump appropriate (patch)	✅
Changelog entry accurate and format-consistent	✅
Trigger phrases / `Use when:` list untouched	✅
`${CLAUDE_PLUGIN_ROOT}` references follow existing plugin-form pattern	✅

claude · 2026-07-21T07:44:55Z

Claude finished @kyle-sexton's task in 1m 28s —— View job

Security Review — PR #802

Gather context and understand the PR
Read PR diff and changed files
Analyze for security vulnerabilities
Post review findings

No security issues found.

This PR touches four files, all pure prose / documentation / configuration:

File	Change
`plugins/work-items/.claude-plugin/plugin.json`	Version bump `0.18.0` → `0.18.1` only
`plugins/work-items/CHANGELOG.md`	Prose changelog entry
`plugins/work-items/skills/triage/SKILL.md`	Prose scope-definition rewrite (3 sites + new `${CLAUDE_PLUGIN_ROOT}` link)
`plugins/work-items/skills/triage/evals/evals.json`	Updated eval `expected_output` strings (id=3, two expectation bullets)

Each relevant attack surface checked:

Injection (command, path, template): The new paragraph at SKILL.md line 35 introduces one ${CLAUDE_PLUGIN_ROOT}/reference/dogfood-filing.md reference as a markdown link. This is the same system-provided plugin-root resolver already in use on lines 17, 44, 50, 70, 126, 140, and 142 of the same file. It resolves to the plugin's isolated cache directory and is not user-controlled input; it introduces no new injection surface.
evals.json: The updated expected_output and expectations strings in evals.json are pure prose consumed by a model-grading harness as comparison targets. No code execution path runs through them.
Token / secret / credential handling: None present in any changed file.
Authorization / access-control gaps: The scope boundary is re-keyed from an authorship test to a triage-state test. This is an instruction-prose change affecting AI behavior guidance — no technical gate or permission check is weakened or bypassed.
GitHub Actions patterns: No workflow files changed. No pull_request_target, workflow_run, run: injection, or permissions: widening.
Supply-chain / dependency risk: No dependency pins or action refs changed. The version field in plugin.json is a semantic-versioning bump only.
Permission widening: No permissions: block, settings file, or config modified.

Verdict: clean. No findings to report.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b5ff1a6f2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-21T08:42:50Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

claude · 2026-07-21T08:43:01Z

Claude finished @kyle-sexton's task in 1m 19s —— View job

Security Review — PR #802

Gather context and understand the PR
Read PR diff (git diff origin/main...HEAD)
Read changed files
Analyze for security vulnerabilities
Post review findings

No security issues found.

This PR touches four files, all pure prose / documentation / configuration:

File	Change
`plugins/work-items/.claude-plugin/plugin.json`	Version bump `0.18.0` → `0.18.1` only
`plugins/work-items/CHANGELOG.md`	Prose changelog entry
`plugins/work-items/skills/triage/SKILL.md`	Prose scope-definition rewrite (3 sites + 1 new `${CLAUDE_PLUGIN_ROOT}` link)
`plugins/work-items/skills/triage/evals/evals.json`	Updated eval `expected_output` and `expectations` strings (id=3 only)

Each relevant attack surface checked:

Injection (command, path, template): The new paragraph at SKILL.md line 35 introduces one ${CLAUDE_PLUGIN_ROOT}/reference/dogfood-filing.md reference as a markdown link. This is the same system-provided plugin-root resolver already in use on lines 17, 44, 50, 70, 126, 140, and 142 of the same file. It resolves to the plugin's isolated cache directory, is not user-controlled input, and introduces no new injection surface.
evals.json: The updated expected_output and expectations strings are pure prose consumed by a model-grading harness as comparison targets. No code execution path runs through them — no injection surface.
Token / secret / credential handling: None present in any changed file.
Authorization / access-control gaps: The scope boundary is re-keyed from an authorship test to a triage-state test. This is an instruction-prose change affecting AI behavior guidance — no technical gate or permission check is weakened or bypassed.
GitHub Actions patterns: No workflow files changed. No pull_request_target, workflow_run, run: injection, or permissions: widening.
Supply-chain / dependency risk: No dependency pins or action refs changed. The version field in plugin.json is a semantic-versioning bump only.
Permission widening: No permissions: block, settings file, or config modified.

Verdict: clean. No findings to report.

claude · 2026-07-21T08:43:03Z

Claude finished @kyle-sexton's task in 1m 45s —— View job

PR Review — `fix(work-items): re-key triage scope on state, not authorship (#486)`

Gather context and understand the PR
Read PR diff and changed files
Review for correctness, consistency, and CLAUDE.md alignment
Post final review findings

Summary

This PR is in clean, correct final state. All four changed files are internally consistent and align with reference/dogfood-filing.md. The two prior Codex P2 findings were both resolved in-flight. Verdict: Approve.

Final diff pass

`plugins/work-items/skills/triage/SKILL.md`

All three sites are consistent with each other and with reference/dogfood-filing.md:

Frontmatter description (line 3) — correctly updated to "any untriaged item carrying the raw marker, whoever authored it." Within the 858/1536-char listing budget.
Purpose (line 24) — matches frontmatter verbatim.
Scope opening paragraph (line 35) — the invariant is well-stated: "The boundary is untriaged vs. already-triaged, never external vs. team-authored."
Exclusion bullet (line 40) — correctly keys on absence of the raw marker, not authorship, not label presence. The inline clarification (dogfood issue with default priority: label + raw marker is in scope; marker wins) directly pre-empts the label-vs-marker confusion Codex caught in the first draft.

The dogfood-filing.md contract confirms (lines 45–46, 54–57): a self-filed item gets status:needs-triage applied after categorization — meaning it carries a priority: label and the raw marker. The scope definition is now in direct agreement.

`plugins/work-items/skills/triage/evals/evals.json`

Eval triage-never-reprocesses-decompose-output (id=3) correctly updated:

expected_output (line 36) — drops old authorship framing; now says "exclusion keys on absence of the raw marker, regardless of authorship." Matches SKILL.md line 35.
expectations[1] (line 40) — correctly says "keys on absence of the raw marker (born triaged), not authorship and not the mere presence of classification labels." Matches SKILL.md line 40.
expectations[3] (line 42) — drops the false "born-labeled items never land in the needs-triage bucket" claim; replaced with the correct mechanical reason ("carries a routing decision and no raw marker, so being neither unlabeled nor raw-marked it falls in none of the view's buckets").

Evals 1, 2, 4, 5, 6 reference "external bug report" / "outside contributor" only in scenario prompts, not in scope-defining expectations — no update needed. ✅

`plugins/work-items/.claude-plugin/plugin.json`

Patch bump 0.18.0 → 0.18.1. Correct for a backwards-compatible prose fix. ✅

`plugins/work-items/CHANGELOG.md`

[0.18.1] entry covers all three fix iterations (three sites changed; authorship contradiction; raw marker wins over default labels; exclusion keyed on marker absence; no routing-logic change). Keep-a-Changelog format followed. ✅

Deferred item (not a blocker)

The last Codex round flagged that the Scope section now names priority:needs-triage as a valid raw marker, but the attention view (line 77) only buckets status:needs-triage. A consuming repo filing via the priority axis could have items missed by the no-arg view. This was correctly classified as fail-safe under-surfacing (missed items wait un-triaged; no irreversible action taken) and deferred to #657. Confirmed: this repo uses status:needs-triage, so it does not bite here.

Checklist

Check	Result
Authorship contradiction resolved (3 sites: frontmatter, Purpose, Scope)	✅
Three sites mutually consistent	✅
Consistent with `reference/dogfood-filing.md`	✅
Exclusion keys on raw-marker absence, not authorship, not label presence	✅
Dogfood item with default `priority:` label + raw marker explicitly in scope	✅
Stale eval `triage-never-reprocesses-decompose-output` updated (3 fields)	✅
Other evals untouched (scenario prompts only — no scope definitions)	✅
No routing logic changed	✅
Version bump appropriate (patch)	✅
Changelog accurate and format-consistent	✅
`${CLAUDE_PLUGIN_ROOT}` reference follows existing plugin-form pattern	✅
Merge commit introduced no conflicts or regressions	✅

kyle-sexton · 2026-07-21T08:48:01Z

Unblock summary (tower-dispatched)

Cleared the two remaining blockers (unresolved Codex threads + branch behind main) and merged.

Review threads — 3 resolved after independent verification against files at PR head:

(P2, outdated) "Keep labeled raw dogfood items triageable" — VALID / FIXED. Verified fix commit 42cde3e: the SKILL.md exclusion now keys on absence of the raw marker, not label presence, so a dogfood issue with a default priority: label + the raw marker stays in scope. Resolved.
(P2) "Update the stale triage eval" — VALID / FIXED. Verified fix commit 3b5ff1a: eval triage-never-reprocesses-decompose-output re-keyed on raw-marker absence; the authorship framing and the false "born-labeled items never land in needs-triage" claim are gone. Resolved.
(P2, previously unaddressed) "Include priority-axis raw markers in the attention view" — VALID / DEFERRED (fail-safe). This PR added dual-axis priority:needs-triage marker language to the Scope section but did not propagate it to the attention-view buckets (still Unlabeled + status:needs-triage + needs-info). Deferred rather than fixed on-branch because it is fail-safe under-surfacing, not a must-fix class: a missed item waits un-triaged (recoverable — an explicitly named item is always triaged), and the autonomous /work-items:work lane selects from the role-labeled frontier (list-frontier --autonomous), not this view, so nothing acts irreversibly on the omission. It also does not bite this repo (its raw marker is status:needs-triage, already bucketed). Deduped to the triage paper-cut batch lane sweep: triage — week of 7/20 (rolling paper-cut batch) #657 (line added with repro + fix direction), replied with classification + link, resolved.

Branch: updated via GitHub update-branch (signed merge commit) — no conflict.

Checks: all green after the re-run on the new merge commit (review, security-review, hygiene, plugin-gate, and the rest). No new Codex review re-fired.

Merge: squash auto-merge armed; all gates already satisfied, so it merged immediately (commit be1b819, closes #486).

Refused/blocked: nothing.

This was generated by AI (tower-dispatched unblock worker).

…th live labels (#922) ## Summary `plugins/work-items/skills/triage/SKILL.md` had two docs-match-reality gaps against shipped state: - The "Attention view (no number)" bucket list named only the status-axis raw marker (`status:needs-triage`), leaving a repo that files raw intake on the priority axis (`priority:needs-triage`, per PR #802's already-merged dual-axis Scope wording) invisible to the no-arg attention view. - `status:needs-decision` is a live, actively-used label (e.g. issue #505, per CHANGELOG `[0.16.1]`/`#562`), and the closing invariant already referenced it as a routing outcome that clears the raw marker — but the state machine itself never introduced it as a side exit, unlike `needs-info`, human-gated, and close. ## Fix - Attention-view bucket 2 now reads "Raw marker — `status:needs-triage` / `priority:needs-triage`, whichever axis the repo files it under", mirroring the Scope section's exact dual-axis wording (SKILL.md line 35). - The "Side exits from any state" sentence and the state-machine ASCII diagram now name `status:needs-decision` ("awaiting a human or maintainer judgment call" — the label's live GitHub description) alongside the existing side exits. - Version-bumped `work-items` 0.21.0 → 0.21.1 (patch, matching the `#562` precedent for the same doc-only shape) with a matching CHANGELOG entry. Scope note: the raw-state table row (line 48, `unlabeled or status:needs-triage`) is intentionally left single-axis — broader raw-marker axis canonicalization across that table, evals, and reference docs is issue #818's job, not this one. Also intentionally out of scope: adding `needs-decision` to step 2's "Target state" list or step 5's outcome table — doing so would require defining when triage applies it vs. the human-gated role, which the label's live usage does not settle (it appears both with and without `needs-human` across open issues) and which this issue scoped as pure docs-match-reality, not a design decision. ## Verification - Confirmed PR #802's merged Scope-section wording verbatim (`gh pr view 802`): "carrying the raw marker (`status:needs-triage` / `priority:needs-triage`, whichever axis the repo files it under)" — the attention-view bucket now mirrors this exactly. - Confirmed `status:needs-decision` is a live label via `gh issue list --label "status: needs-decision"` (21+ open/closed issues, e.g. #881, #718, #664, #551) and confirmed its GitHub description ("Awaiting a human or maintainer judgment call") used verbatim in the new SKILL.md text. - Confirmed issue #505's prior routing to `status:needs-decision` via the plugin's own CHANGELOG `[0.16.1]` entry (`#562`), which already treated `needs-decision` as a routing outcome in the closing invariant — this PR closes the gap between that reference and the state machine's own introduction of the label. - Traced the ASCII diagram's pipe/branch alignment by hand to confirm the new `status:needs-decision` line reads correctly as a side exit at the same indentation level as `close`. Closes #817 ## Related - #817 (this fix) - #802 (source of the dual-axis raw-marker wording mirrored here) - #505 (live example of `status:needs-decision` usage; see also CHANGELOG `#562`) - #818 — separate, unopened-PR item covering raw-marker axis canonicalization across the state table, evals, and reference docs; deliberately not touched here to avoid overlap. Re-checked immediately before opening this PR: no PR exists yet for #818. - #853 — open draft PR (labeled `do-not-merge`, stale at plugin version 0.19.0) also touches `plugins/work-items/.claude-plugin/plugin.json` and `CHANGELOG.md` for an unrelated shell-test-helper doc change. Re-checked immediately before opening this PR: no version-bump collision — #853 is stale relative to current `main` (0.21.0) and will need to rebase regardless of this PR. Claude-Session: https://claude.ai/code/session_01K1V3gkrfSf75isB8MiDy3o Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

…triage docs + evals (#923) ## Summary The live raw-intake marker is applied on whichever axis a consuming repo files it under — `priority: needs-triage` (the current live label, applied by `.github/workflows/issue-triage-label.yml`) or `status: needs-triage`. `SKILL.md`'s "Scope: raw intake only" section already documents this dual-axis treatment (landed in #802), but several other spots in the same skill, its evals, and reference docs still described or asserted the marker as status-axis-only — a priority-axis label documented as status-only. ## Fix Brought every remaining occurrence in line with #802's already-merged dual-axis wording (`status:needs-triage` / `priority:needs-triage`, whichever axis the repo files it under): - `plugins/work-items/skills/triage/SKILL.md` — Triage-states table (`raw` row) and Attention-view bucket 2, both previously `status:needs-triage` only. - `plugins/work-items/reference/dogfood-filing.md` — step 4 ("Label `needs-triage`, then hand off") previously instructed filers to always `Apply status:needs-triage`; now applies the raw marker on whichever axis the repo files it under, resolved from the live label set. - `plugins/work-items/reference/label-taxonomy.md` and `plugins/work-items/reference/tracker-seam.md` — the axis-grammar tables listed `needs-triage` as a Status-axis example only; added a note that it is dual-axis with a pointer to SKILL.md's "Scope: raw intake only". - `plugins/work-items/skills/triage/evals/evals.json` — evals 4 and 5 asserted "clears `status:needs-triage`" without acknowledging the marker's dual-axis nature; reworded to "clears the raw-intake marker (here `status:needs-triage`)" so the assertion doesn't imply that's the only valid axis. - Version bump `work-items` `0.21.0` → `0.21.1` + matching `CHANGELOG.md` entry. No routing logic changed — this is a doc/eval consistency fix matching an already-ratified decision. ## Verification - `skill-quality:check` static contract gate (18 checks) over the `triage` skill: **PASS — 0 errors, 1 warning** (pre-existing "no Gotchas surface" warning, unrelated to this change). All 9 base-ref trigger phrases preserved; markdownlint clean. - `check-jsonschema` against the bundled `evals.schema.json`: `ok -- validation done`. - Manually cross-checked every edit against PR #802's diff to confirm the dual-axis phrasing (`status:needs-triage` / `priority:needs-triage`, whichever axis the repo files it under) is reused verbatim, not reinvented. - Confirmed the live label is priority-axis via `.github/workflows/issue-triage-label.yml` ("Applies the `priority: needs-triage` floor label..."). Closes #818 ## Related - #818 — this fix. The issue body already carries a ratified/defaulted decision (dual-axis treatment, maintainer-vetoable alternative was single-canonical-axis migration — not implemented here per the issue's explicit instruction), satisfying rule 4d's citation requirement. - #802 — the ratifying source for the dual-axis wording; this PR's phrasing is copied verbatim from its already-merged "Scope: raw intake only" section. - **Version-bump collision with PR #922 (issue #817):** #922 also bumps `work-items` `0.21.0` → `0.21.1` and touches `SKILL.md`'s state-machine/attention-view sections — the same lines this PR's dual-axis fix touches, since the marker lives in those sections. Both PRs are currently open against the same `0.21.0` base. Opening this PR as **draft + `do-not-merge`** until the version numbers and any overlapping `SKILL.md` lines are reconciled by whoever merges second (normal git-merge conflict resolution, per the collision-serialization protocol). - PR #853 (issue #820, unrelated) also touches `work-items/plugin.json` and `CHANGELOG.md` with a stale bump (`0.19.0` → `0.20.1`, already behind current `origin/main`) — noted for visibility, not a live collision with this change. Claude-Session: https://claude.ai/code/session_01K1V3gkrfSf75isB8MiDy3o

kyle-sexton added the automated Opened by automation. label Jul 21, 2026

kyle-sexton marked this pull request as ready for review July 21, 2026 06:31

kyle-sexton mentioned this pull request Jul 21, 2026

ops: loop-lane telemetry — running per-lane status (babysit / triage / work) #502

Open

chatgpt-codex-connector Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread plugins/work-items/skills/triage/SKILL.md Outdated

chatgpt-codex-connector Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread plugins/work-items/skills/triage/SKILL.md

chatgpt-codex-connector Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread plugins/work-items/skills/triage/SKILL.md

kyle-sexton mentioned this pull request Jul 21, 2026

lane sweep: triage — week of 7/20 (rolling paper-cut batch) #657

Open

77 tasks

Merge branch 'main' into fix/486-triage-scope-prose-dogfood

fc92826

kyle-sexton merged commit be1b819 into main Jul 21, 2026
22 checks passed

kyle-sexton deleted the fix/486-triage-scope-prose-dogfood branch July 21, 2026 08:47

kyle-sexton mentioned this pull request Jul 22, 2026

docs(work-items): canonicalize raw-intake marker as dual-axis across triage docs + evals #923

Merged

Uh oh!

Conversation

kyle-sexton commented Jul 21, 2026

Summary

Fix

Verification

Related

Uh oh!

claude Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review — fix(work-items): re-key triage scope on state, not authorship (#486)

Summary

Review

plugins/work-items/skills/triage/SKILL.md — core change

plugins/work-items/.claude-plugin/plugin.json — version bump

plugins/work-items/CHANGELOG.md — new [0.18.1] entry

Checklist

Uh oh!

claude Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security Review — PR #802

Uh oh!

kyle-sexton commented Jul 21, 2026

Uh oh!

claude Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review — fix(work-items): re-key triage scope on state, not authorship (#486)

Summary

File-by-file findings

plugins/work-items/skills/triage/SKILL.md

plugins/work-items/.claude-plugin/plugin.json

plugins/work-items/CHANGELOG.md

Checklist

Uh oh!

claude Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security Review — PR #802

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

claude Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review — fix(work-items): re-key triage scope on state, not authorship (#486)

Summary

Codex P2 finding — evaluated and closed

Full diff checklist (both commits)

Uh oh!

claude Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security Review — PR #802

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

claude Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review — fix(work-items): re-key triage scope on state, not authorship (#486)

Summary

File-by-file

plugins/work-items/skills/triage/SKILL.md — core fix

plugins/work-items/skills/triage/evals/evals.json — stale-eval fix

plugins/work-items/.claude-plugin/plugin.json

plugins/work-items/CHANGELOG.md

Checklist

Uh oh!

claude Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security Review — PR #802

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Jul 21, 2026

claude Bot commented Jul 21, 2026 •

edited

Loading

PR Review — `fix(work-items): re-key triage scope on state, not authorship (#486)`

`plugins/work-items/skills/triage/SKILL.md` — core change

`plugins/work-items/.claude-plugin/plugin.json` — version bump

`plugins/work-items/CHANGELOG.md` — new `[0.18.1]` entry

claude Bot commented Jul 21, 2026 •

edited

Loading

claude Bot commented Jul 21, 2026 •

edited

Loading

PR Review — `fix(work-items): re-key triage scope on state, not authorship (#486)`

`plugins/work-items/skills/triage/SKILL.md`

`plugins/work-items/.claude-plugin/plugin.json`

`plugins/work-items/CHANGELOG.md`

claude Bot commented Jul 21, 2026 •

edited

Loading

claude Bot commented Jul 21, 2026 •

edited

Loading

PR Review — `fix(work-items): re-key triage scope on state, not authorship (#486)`

claude Bot commented Jul 21, 2026 •

edited

Loading

claude Bot commented Jul 21, 2026 •

edited

Loading

PR Review — `fix(work-items): re-key triage scope on state, not authorship (#486)`

`plugins/work-items/skills/triage/SKILL.md` — core fix

`plugins/work-items/skills/triage/evals/evals.json` — stale-eval fix

`plugins/work-items/.claude-plugin/plugin.json`

`plugins/work-items/CHANGELOG.md`

claude Bot commented Jul 21, 2026 •

edited

Loading

claude Bot commented Jul 21, 2026 •

edited

Loading

claude Bot commented Jul 21, 2026 •

edited

Loading

PR Review — `fix(work-items): re-key triage scope on state, not authorship (#486)`

`plugins/work-items/skills/triage/SKILL.md`

`plugins/work-items/skills/triage/evals/evals.json`

`plugins/work-items/.claude-plugin/plugin.json`

`plugins/work-items/CHANGELOG.md`