Supply required lane and source metadata for catalog freshness PRs

[seathatflowsinourveins]

Scope

Catalog-freshness proposals currently omit the lane label and required SOTA-sources section, as observed on PR #527. This change supplies both, preserves an existing single supported lane, defaults new/unlabeled reports covering both catalogs to lane:shared, and stops metadata updates for ambiguous labels. The generated description stays independent of individual workflow runs. The guide and workflow summary explain the one-time human body edit that an older PR may need to refresh its source-gate event payload.

• Base commit: 18eea2c1de992b46c266d79ef0cc40f93c9fb943
• Lane: lane:foundation
• Owned paths: .github/workflows/catalog-freshness.yml, docs/github-automation.md, tests/test_catalog_freshness_propose.py, docs/decisions/2026-10-02-catalog-freshness-pr-metadata.md, and mechanical registration of the three previously registered changed files in manifests/evidence.json (last commit).

SOTA sources

• cli/cli v2.102.0 at fc4b137cdef0a6bd28fd461b7cf9c84a5812a8cd: pkg/cmd/pr/create/create.go and pkg/cmd/pr/edit/edit.go; native help verifies --label, --add-label and --body-file.
• Native create and edit interfaces.
• GitHub workflow trigger semantics, read 2026-10-02: workflow-token body edits create no new run. The existing gate evaluates the triggering event payload.
• kjanat/actionlint v1.17.0, the repository CI selection; upstream release checksums and release API digests matched before execution.
• Existing repository .github/pull_request_template.md, docs/lanes.md, docs/decisions/2026-09-23-bot-pr-dispatch.md and unchanged SOTA gate.

Evidence-class table

Claim	Evidence class	Command / receipt
Supported metadata flags	source_review	Pinned GitHub CLI source and native help
Revised proposal behavior and repository registration	local_integration	127 tests passed across proposal, pin and trading modules; initial stale-registration failure and retry are preserved in the decision
Changed workflow syntax	local_integration	Native actionlint v1.17.0, exit 0
Generated description and lane/race behavior	local_integration	Actual metadata shell runs with synthetic gh; unchanged source gate checks rendered body; valid/missing/invalid labels and create race covered
Workflow audit	local_integration	Native zizmor 1.30.1 offline, exit 0, []
Publication integrity	local_integration	python3 scripts/validate.py, exit 0
Future bot create/update behavior	source_review	Native interfaces reviewed; hosted behavior remains unverified

Local commands run

python3 -m unittest tests.test_catalog_freshness_propose tests.test_catalog_freshness_pins tests.test_catalog_freshness_trading
exit 0; 127 tests passed on revised behavior

actionlint .github/workflows/catalog-freshness.yml
exit 0; upstream v1.17.0 staged release

zizmor --offline --no-progress --format json .github/workflows/catalog-freshness.yml
exit 0; native v1.30.1; []

python3 scripts/validate.py
exit 0; 69 components, 9315 hashed files, 4 profiles, 186 receipts

The initial 80-test run had one stale-registration failure, corrected through the supported registrar and targeted retry. A subsequent native Claude review identified behavior changes, which justified the full 127-test run above. Earlier rendered-body byte counts in the decision apply to the initial head, not the revision.

Decision record

docs/decisions/2026-10-02-catalog-freshness-pr-metadata.md records the failed attempt, corrections, native reviewer counters, alternatives and overturn conditions. A read-only native Claude Opus/max review of the initial head found follow-ups; the revision preserves existing labels, handles create races, corrects the lane rationale/version wording and documents the event migration. Independent review of the revised head is requested. No hosted bot create/update, runtime-pin acceptance or new-target provider E2E is claimed.

Host evidence

No host receipt or platform status change.

Checklist

• Action pins preserved; no new action dependency.
• Existing top-level read permission and scoped job permissions preserved.
• No secrets printed, logged or committed; no new secret required.
• No paid hosting, subscription or billing surface introduced.
• Peer-owned files and worktrees preserved.

[seathatflowsinourveins]

Native Claude Opus/max follow-up review approves the bounded source change, subject to hosted acceptance, with no remaining blocking correctness finding. The coordinator independently bound the four files the reviewer read to exact Git blobs at 0907065fa2eebf0d24ae08e207143053f360150b; the worktree is clean. The review itself had only Read/Glob/Grep and did not verify Git or run tests.

The existing returned unittest output says Ran 127 tests in 56.540s and OK, with no skipped-test count. Native actionlint1.17.0, zizmor1.30.1 offline ([]), repository validation and the three pre-push checks also passed. No unchanged test was rerun for this follow-up. New metadata tests execute the real shell against a synthetic gh, so they remain local integration evidence.

The reviewer confirmed the lane resolver, create/race re-read, real-shell tests and migration docs by source inspection. It also noted that ambiguous labels fail after the branch push, leaving metadata to be repaired before retry; that fail-closed boundary is intentional and is not an atomic remote label lock. Future authorized hosted proposals still need their actual label/body/source-gate outcomes inspected. No hosted workflow was dispatched to manufacture acceptance, and no source or runtime-selection gate is waived.

The native follow-up returned exit0, success, no permission denials, six turns and duration187,176ms. Private native-output SHA-256: 964479d4fdfbc4843b924dbea3981d83a7b8f4de756b91e8bc9cdb6e38a472a6 (180,110bytes). This call's usage fields are input4, cache creation43,421, cache read260,864, output19,646 including18,214 thinking tokens. Its modelUsage and USD2.9025842 list-basis total are cumulative for the resumed session and are not added to the initial review's counters or cost. This is a native review observation, not a token-efficiency comparison or billing receipt.

Primary source bindings remain the pinned GitHub CLI files, repository lane policy and GitHub event semantics cited in the decision. Complete required hosted checks on this exact head remain a landing gate.

[seathatflowsinourveins]

The reviewed patch now incorporates current main (73ca1e8b53383f5bd5e1a59a06eade50a0086370) at b34aaf28c0815e4f96d52d2741c1543db9c0615d, through the supported merge form of the hot-file protocol. Main's registry was taken and the three owned files re-registered; both supported report generators ran, followed by repository validation (exit0, 69 components/9,315 hashed files/four profiles/186 receipts) and the three passing native pre-push registry tests.

Native git diff 0907065fa2eebf0d24ae08e207143053f360150b b34aaf28c0815e4f96d52d2741c1543db9c0615d -- .github/workflows/catalog-freshness.yml tests/test_catalog_freshness_propose.py docs/github-automation.md docs/decisions/2026-10-02-catalog-freshness-pr-metadata.md is empty. The prior Claude source review therefore carries over under the documented rule; no unchanged model review or 127-test suite was repeated. All eight checks had passed at the prior head, but the new head is being watched separately and must pass its own required contexts before merge. The clean worktree and remote head match.

Hosted proposal create/update acceptance remains open for the next authorized bot proposal, including the documented old-body migration boundary. This base update makes no new hosted behavior claim.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seathatflowsinourveins]

Current head is 05a2c67fc04176ca24681f2da6080fc745cc5f68, integrating newly published main b5079894cb08508b09214613dac5774e0fb017ef through the documented hot-file protocol. Main's registry was taken and the three owned registered files reapplied; report generators and repository validation returned0, and all three native pre-push checks passed. The four reviewed source files remain byte-identical to 0907065fa2eebf0d24ae08e207143053f360150b, preserving the native Claude source review under the lane rule.

The worktree is clean and the remote head matches. Current-head CI is running. The existing native watcher remains live and follows the current last PR commit at gh2.102.0 (upstream query); no observation timeout caused a restart. Final merge still requires all eight current buckets to be pass, a fresh head/base read and the full reviewed-head guard. Hosted proposal acceptance remains open.

[seathatflowsinourveins]

PR611 is merged as 5803017249ad2a5e90ace4ab4e33e443ae00b66e at 2026-10-02T20:15:13Z, from reviewed head 05a2c67fc04176ca24681f2da6080fc745cc5f68. The native guarded squash command returned exit 0, and remote state/merge identity readback returned exit 0.

Immediately before merge, the complete eight required contexts were present with bucket=pass. Native git diff --exit-code returned 0 for all four reviewed source files against accepted source 0907065fa2eebf0d24ae08e207143053f360150b; the owned worktree was clean. The retained required-check JSON is 1,370 bytes, SHA-256 4cbe2330251753bdfeb626a462bc4eeb6fc80d7af69a268f06fdcb250ddccbbc. Existing native Claude source acceptance and the previously passed 127 scoped tests, actionlint, zizmor, repository validation and pre-push checks retain their original scope.

The next authorized hosted catalog proposal still needs observation for its body/source/lane metadata. This merge is source publication, not that hosted behavioral result. No manual dispatch, installation or target configuration was performed.

Integration handoff to the PR613 owner: current main now contains the reviewed catalog-freshness body/lane handling and its three-file evidence registration. Please preserve that source while integrating your distinct currency-check workflow edits and follow the shared-registry protocol. PR612 remains owned here and will receive this main change without altering its accepted SDK source bytes. Builder target/configuration/manifest custody is unchanged.