Add an on-demand Claude security review and a model-free flag on risky paths

[seathatflowsinourveins]

Scope

• What this PR changes, in one or two sentences: adds security-review-flag.yml, which on pull requests touching workflows, scripts/hooks/, tools/credentials/, the credential inventory or the paper-trading blueprints only writes a notice with the exact dispatch command (no model, no checkout, no token scope), and claude-security-review.yml, an on-demand, read-only security review of one same-repository pull request head by anthropics/claude-code-action v1.0.247, bounded at 30 assistant turns and a $5 client budget. The review runs only while CLAUDE_SECURITY_REVIEW_ENABLED is true, so merging this starts no model run.

• Effort (added 2026-10-08 at head 7a131b5): --effort max in claude_args, because judgment work (designated reads, adjudication, pull request and security reviews, audits) runs at max under the command center's effort mapping, and every job records its level and reason. The level has to be in claude_args: --restricted ignores the settings files that would otherwise carry it, and Opus 5.5 runs at medium on the API when a request leaves effort unset. The bounds test now requires the flag; removing it fails the test.

• Fixes from the pre-cue read of the sibling Bound the harness audit and move it to claude-code-action v1.0.247 #892 (2026-10-09, head 459777d): the record names every behaviour of both new workflows, including the slug, owner, first-attempt and variable guards, the timeout and grants, the guard and binding exits, the explicit action inputs display_report and track_progress (defaults in the pinned action.yml) and the 14-day usage artifact. The bounds step now uses an allow-list, fails on a start record without lists or on an empty result, and names each unmet bound. The review cut is character-safe and says when it cut. The step tests no longer skip without PyYAML. The evidence line states the fence receipt's flags. The 2026-10-03 cooldown waiver is cited.

• Fixes at df440f4 (not described here until now): a final step, "Require the run's execution file", fails a success without an execution file; the optional paths expand safely under set -u on bash before 4.4; the record gains a Visibility section (a public run's summary is public); ci-least-privilege.md is edited in place (the write-grant and per-workflow table rows, and the exemption sentence) as well as given an addendum.

• Pre-cue toolkit read of this PR (J8 on 459777d, 2026-10-09; pr-test-analyzer and silent-failure-hunter): every finding at confidence 80 or above, and its status at head fbe30ad.

  Finding	Status at fbe30ad	Fixing commit and evidence
  pr-test-analyzer (90): the record links Add an on-demand, read-only pull request review by the Claude action #894's record, absent from this tree	fixed	fbe30ad: the link says the file comes with Add an on-demand, read-only pull request review by the Claude action #894, which lands first, and resolves once Add an on-demand, read-only pull request review by the Claude action #894 has landed
  silent-failure-hunter (90): the same dangling reference	fixed	fbe30ad, as above
  pr-test-analyzer (85): the docs/github-automation.md bullet describes an absent workflow	fixed	fbe30ad: the bullet names Add an on-demand, read-only pull request review by the Claude action #894 as where the shared pin, federation, fence and bounds are defined, and says Add an on-demand, read-only pull request review by the Claude action #894 lands first
  pr-test-analyzer (90): the cited fence receipt is absent	declared; resolves at landing	receipt.json is added by Bound the harness audit and move it to claude-code-action v1.0.247 #892 and Add an on-demand, read-only pull request review by the Claude action #894, which land first; this description already said so, and fbe30ad says it in the record too
  silent-failure-hunter (90): the same receipt	declared; resolves at landing	as above
  pr-test-analyzer (90): the binding step's id: bind is unused	fixed	fbe30ad: removed (no step or test referred to it)
  silent-failure-hunter (90): the description does not match the head	fixed	this description: the base and check lines at fbe30ad, 34 tests, df440f4's changes (the bullet above), and the in-place ci-least-privilege.md edits

• R4, debug logging set as a repository secret or variable (2026-10-09; the cc-native-practice lane's L3 read against anthropics/claude-code-action v1.0.247 practice): the guard binds (secrets.ACTIONS_STEP_DEBUG || vars.ACTIONS_STEP_DEBUG) == 'true' and (secrets.ACTIONS_RUNNER_DEBUG || vars.ACTIONS_RUNNER_DEBUG) == 'true' as booleans and refuses either before any token is requested; a test pins both bindings, and six weakened copies each fail at least one test. This is hardening: the action step already pins ACTIONS_STEP_DEBUG: 'false', which is what the action's full-output switch reads. zizmor's auditor persona reports secrets-outside-env on the two reads; CI runs the regular persona with --no-ignores, which reports nothing. The R4 lines are byte-identical in Bound the harness audit and move it to claude-code-action v1.0.247 #892, Add an on-demand, read-only pull request review by the Claude action #894, Add an on-demand Claude security review and a model-free flag on risky paths #895, Add a weekly lane triage: the model proposes, a model-free job applies #896 and Add a pre-cue read by Anthropic's pr-review-toolkit agents in Actions #909, and R5 leaves them unchanged.

• The report notice at the cap (2026-10-09; the J8 micro read of Bound the harness audit and move it to claude-code-action v1.0.247 #892): the publish step wrote with jq -r, which adds a newline, so a 60,000-byte report was announced as cut. It writes with jq -j now; a test publishes exactly 60,000 and 60,001 bytes, and a copy that writes with jq -r fails it.

• From the J8 micro read of fbe30ad (2026-10-09; id: bind fixed, the cross-PR items partly fixed because they rested on Add an on-demand, read-only pull request review by the Claude action #894 being present): the record and the docs bullet now stand alone. They state the action pin, the federation variables, the fence flags and the bounds themselves; name the pull request review's record by plain path instead of a link; and cite receipt.json from this PR's own tree, a byte-identical copy of the one Bound the harness audit and move it to claude-code-action v1.0.247 #892 and Add an on-demand, read-only pull request review by the Claude action #894 add.

• R5 (2026-10-09, at 5903cee): the symbolic-link step, exact pins, non-string tool entries, the caps from measurement and the corrected "what has run"; see the R5 section below.

• Base commit: aba02ec3 (merge base at 5903cee, as at f5f1fd2; at the last local fetch main is at 861c475e, twelve commits on, through Scope research Hindsight skills and make wiring checks fail closed #835; only manifests/evidence.json overlaps, and the one rebase happens at landing)

• Lane: lane:foundation

• Owned paths touched: .github/workflows/claude-security-review.yml (new), .github/workflows/security-review-flag.yml (new), tests/test_claude_security_review_workflow.py (new), tests/test_workflow_policy.py (one inventory entry, one exemption), tests/test_workflow_security_coverage.py (coverage set and two zizmor tests), docs/decisions/2026-10-08-claude-actions-security-review.md (new), docs/decisions/2026-10-04-ci-least-privilege.md (two table rows and the exemption sentence edited in place, and a dated addendum), docs/github-automation.md (current-practice bullet), manifests/evidence.json (registration, last commit). R5 touches the review workflow, its test module, the record, the docs/github-automation.md bullet and manifests/evidence.json.

R5 (2026-10-09), at 5903cee

R5 makes the changes asked for by the command center's security read and the GPT designated read of f5f1fd2, and by the command center's caps from measurement, all on 2026-10-09. It is limited to quality and correctness.

• claude-security-review.yml:
  • Symbolic links (the security read's P2): a new model-free step, "Remove symbolic links from the pull request head", runs right after the head checkout: find pr-head -path pr-head/.git -prune -o -type l -exec rm -f {} + under set -euo pipefail. A link in the head to /proc/self/environ or ../.git/config could otherwise carry what it points at into the review and the public job summary. --restricted confines the file tools to the working directories, and claude --help on 2.1.295 does not say whether a link's target is resolved before that check or the deny rules apply. The step's comment says why it is there.
  • Non-string tool entries (the GPT read's P2): the numbers step no longer filters entries that are not strings out of the session's tool list, which let {"name":"Bash"}, null or 17 pass every bound in a synthetic transcript. Each such entry is now a forbidden tool, named non-string tool entry in usage.json, in the summary's tools column and in the bounds message; string entries are checked against Read, Glob and Grep as before, and the step's comment names the new case.
  • Caps from measurement: --max-turns goes from 12 to 30 and --max-budget-usd from 3 to 5. The numbers step's bounds become 1 to 30 assistant turns and at most $5, the prompt says "at most 30 turns", and the opening comment carries the new values. A cap bounds a runaway; it never trims a normal run. This review has no runs of its own yet and takes the caps of the pull request review (Add an on-demand, read-only pull request review by the Claude action #894), which has the same fence, model and effort with a different prompt. Add an on-demand, read-only pull request review by the Claude action #894's prompt and claude_args reading one pull request in full used 12 of 12 assistant turns and cost $2.23, so 12 is a floor: 2.5 times it gives 30 turns, and twice $2.23 is about $4.5, rounded up to $5. Four delta re-reads took 5 to 7 turns and $0.73 to $1.75. Expected cost per run: about $2, by that shape, not yet measured.
• tests/test_claude_security_review_workflow.py (36 to 42 tests):
  • New tests:
    • test_symbolic_links_in_the_head_are_removed_and_nothing_else
    • test_the_symbolic_link_step_has_no_condition_and_a_fixed_script
    • test_claude_args_are_exactly_the_reviewed_list
    • test_settings_are_exactly_the_reviewed_json
    • test_a_tool_entry_that_is_not_a_string_is_a_forbidden_tool, which refuses {"name":"Bash"}, null and 17
    • test_the_caps_hold_at_the_bound_and_fail_just_above_it, where 30 turns and $5 pass and 31 turns and $5.01 fail
  • Changed tests:
    • test_steps_run_in_the_order_the_binding_depends_on requires the new step right after the head checkout.
    • test_no_step_executes_anything_from_the_pull_request_head exempts that step by name, pins its script, and checks working-directory on every step.
    • test_claude_has_three_read_tools_and_fixed_bounds checks 30 and 5, and the prompt's turn count.
    • test_an_unmet_bound_fails_after_the_numbers_were_kept, test_the_step_names_every_unmet_bound and test_the_turn_bound_counts_assistant_turns_not_transcript_messages now go just past the caps (31 turns, $5.01 or $5.50).
  • New module helpers: STRIP, STRIP_RUN, RUNNER_TEMP_STAND_IN, SETTINGS, CLAUDE_ARGS and claude_args().
• docs/decisions/2026-10-08-claude-actions-security-review.md:
  • By-name bullets for the new step and for the numbers step's non-string rule and new bounds; the new caps in the claude_args bullet.
  • The last sentence of "Effort" now says the figures come from runs at max.
  • "Cost of one run" restates the caps' derivation with its measured figures and the expected cost, and withdraws the earlier $0.70 to $1.30 dry estimate.
  • "Evidence class" is corrected. The fence smoke did run --setting-sources user, in two of its three runs. The workflow's model-free steps have run locally under the unit tests. The action step's own configuration has not run, locally or hosted.
  • The test count goes from 36 to 42.
  • A new section, "Symbolic links, exact pins, non-string tool entries, caps and what has run (2026-10-09, R5)", names every change and the weakened copies, and holds the two sentences below.
• docs/github-automation.md: the "Security review on demand" bullet now says 30 turns and a $5 client budget.
• manifests/evidence.json: the four changed rows are rehashed.
• security-review-flag.yml: unchanged.
• Weakened copies. 22 weakened copies of the review workflow were run on 2026-10-09 by a script kept outside the repository, with PyYAML 6.0.3 present, as the Linux validate job has it. All 22 fail at least one test. Six weaken the new step, six the arguments, two the tool check and eight the caps. Five of the six argument copies pass f5f1fd2's tests.
• Without PyYAML, as on the macOS validate job, the module's shape tests skip. Of the new tests, three run there: the symbolic-link behaviour, non-string entry and caps tests, together with the three changed bounds tests. The step pin and both exact pins skip, and 10 of the 22 copies still fail a test.
• Two record sentences shared with the other W4 records, byte for byte:
  • "In agent mode the action rewrites the checkout's origin URL with the job token (src/github/operations/git-config.ts:129-134, called from src/modes/agent/index.ts:52-61 at 2dca132f), so persist-credentials: false does not keep the token out of .git/config; the deny rules Read(./.git/**) and Read(./**/.git/**) are what keep the model from reading it, as two 2026-10-09 probes on the installed 2.1.295 measured."
  • "Security hardening from the 2026-10-09 read (flag-path additions, a fork notice, debug-value widening, tool-list shape, extra deny rules, token-source and guard-step assertions) is filed as follow-ups before any enabling variable is set."
• Not part of R5:
  • The hardening in the second sentence above is filed as follow-ups. For the tool-list shape, only the non-string part landed here; requiring a non-empty list and checking tool_use names remain.
  • The macOS coverage gap is in the same follow-ups register: without PyYAML, 12 of the 22 weakened copies pass, all of them changes that only the skipped shape tests read.
  • A planted-symbolic-link case in the fence smoke needs a model run and is not done.
  • --setting-sources user beside --restricted is pinned as it stands, pending Add a weekly lane triage: the model proposes, a model-free job applies #896's ruling on that pair.

R6 (2026-10-09), at e57d8eb

• Cost bound: the budget × 1.10 = $5.50, answering the command center's read of 5903cee (P2), from four measured J8 runs on a $5 budget, re-derived after the first three hosted runs. A budget stop at or under it publishes and is named. Publishing is gated on !cancelled() && steps.numbers.outcome == 'success'.
• --max-turns 30 removed: the pinned action (base-action/src/run-claude-sdk.ts:241-250 at 2dca132f, since 6ef6450f) fails a success whose num_turns exceeds it. On Claude Code 2.1.295 num_turns counts transcript messages: 57 for 12 requests under --max-turns 12. That is a code reading plus a local measurement, not a hosted run. The numbers step's 1-to-30 assistant-turn check and the prompt's "at most 30 turns" stay.
• Exact pins: both compare canonical JSON.
• Record: the shared cost paragraph, and an upstream-issue draft (not filed).
• Local checks at e57d8eb:
  • validate.py and the manifest check pass (10,906 files);
  • six modules, 263 tests, OK;
  • this module, 44 tests (19 skip without PyYAML);
  • actionlint and zizmor are clean;
  • 35 of 35 weakened copies fail a test with PyYAML.
• Hosted checks at e57d8eb: not read yet.

R7 (2026-10-09), at 02b80c6

• Job timeout: 20 → 30 minutes. With --max-turns removed in R6, the numbers step's 30-assistant-turn bound is the turn limit, and 30 turns at the measured pace (12 turns in 512,670 ms) take about 21.4 minutes before setup. A new test pins 30, and a weakened copy set back to 20 fails it. Bound the harness audit and move it to claude-code-action v1.0.247 #892 and Add an on-demand, read-only pull request review by the Claude action #894 use 30.
• Local checks: validate.py and the manifest check pass; 264 tests across six modules, OK; this module, 45 tests; actionlint and zizmor are clean; 36 of 36 weakened copies fail a test with PyYAML.

SOTA sources

• anthropics/claude-code-action, v1.0.247 at 2dca132ff0e0c4094ce6048b422c6915a071210b (https://github.com/anthropics/claude-code-action/tree/2dca132ff0e0c4094ce6048b422c6915a071210b): docs/solutions.md ("Security Review" example, the source of the general checklist), docs/security.md ("Do not check out an untrusted ref into the workspace root before this action"; base ref at the root and head ref in a subdirectory), docs/setup.md (federation inputs; "a static credential takes precedence and federation will not be used"), action.yml (inputs and the execution_file output), base-action/src/parse-sdk-options.ts (argument parsing with shell-quote, default setting sources, debug forcing full output), src/github/operations/git-config.ts (git authentication in the root checkout; lines 129-134 rewrite the origin URL with the job token), src/modes/agent/index.ts (lines 52-61: agent mode calls that git configuration). R5 read the last two at v1.0.246 (38c80c1); per the command center's compare, v1.0.247 changes only the bundled Claude Code version, so neither file differs at the pin.
• Claude Code 2.1.295, the version the pin installs, claude --help: --restricted ("removes the built-in tools that run commands or code ... and ignores user, project and local settings files ... Also confines the file tools to the working directories (--add-dir included)"; the help says nothing about symbolic links, read 2026-10-09), --permission-prompts none ("anything that would prompt is denied automatically"), --tools, --settings, --strict-mcp-config, --max-budget-usd.
• GNU findutils find 4.10.0, as installed where the R5 tests ran: -path ... -prune, -type l and -exec ... {} +, the semantics the symbolic-link step relies on.
• anthropics/claude-code-security-review at 0c6a49f1fa56a1d472575da86a94dbc1edb78eda, its only pin (no release or tag; last commit 2026-02-11), read and not adopted: action.yml (API key only), claudecode/constants.py (default claude-opus-4-1-20250805), scripts/comment-pr-findings.js (submits a PR review), README.md ("not hardened against prompt injection attacks"); Anthropic, Model deprecations (https://platform.claude.com/docs/en/about-claude/model-deprecations): that model retired 2026-08-05.
• GitHub, OpenID Connect reference, "Filtering for pull_request events" and "Filtering for a specific branch" (https://docs.github.com/en/actions/reference/security/oidc); GitHub Security Lab, Preventing pwn requests (https://securitylab.github.com/research/github-actions-preventing-pwn-requests/).
• Anthropic documentation read 2026-10-08: Workload identity federation (https://platform.claude.com/docs/en/manage-claude/workload-identity-federation); How Claude Code uses prompt caching (https://code.claude.com/docs/en/prompt-caching); Pricing (https://platform.claude.com/docs/en/about-claude/pricing).

Evidence-class table

Claim	Evidence class	Command / receipt
The fence flags (--restricted, --tools/--allowedTools Read,Glob,Grep, --strict-mcp-config, --permission-prompts none, --settings with hooks off and three deny rules; Haiku 5.5, 10 turns, $0.50, as the receipt lists; two of its three runs also passed --setting-sources, run2-user with user) give a read-only session (tools Glob, Grep, Read; reads outside the tree and of .git/config denied; planted hooks and instruction files without effect)	native_proven on the installed 2.1.295 client (not through the action, not on a GitHub runner)	evidence/artifacts/claude-actions-fence-smoke-20261008/receipt.json, carried byte-identical by this PR, #892 and #894
This workflow's own configuration (that fence plus --add-dir, --effort max, blockReadsOutsideWorkingDirectories and four more deny rules; Opus 5.5, 30 turns, $5; through the action) holds	not established	it has not run, locally or hosted
The review's guard, binding, symbolic-link, diff, numbers and report steps, and the flag's notice, behave as described	synthetic	tests/test_claude_security_review_workflow.py, 42 tests; each step's shell is taken from the workflow file and executed. Without PyYAML the 19 shape and flag tests skip and the 23 step tests run
Symbolic links under pr-head/ are gone before the model starts, while regular files and pr-head/.git stay	synthetic	test_symbolic_links_in_the_head_are_removed_and_nothing_else (links to /proc/self/environ, to ../.git/config and from a subdirectory); test_the_symbolic_link_step_has_no_condition_and_a_fixed_script
A tool-list entry that is not a string fails the bounds and is named	synthetic	test_a_tool_entry_that_is_not_a_string_is_a_forbidden_tool: {"name":"Bash"}, null and 17 each exit 1 with non-string tool entry
The caps: 30 assistant turns and $5 pass; 31 turns and $5.01 fail and are named	synthetic	test_the_caps_hold_at_the_bound_and_fail_just_above_it
The caps are a multiple of the measured need (#894's prompt reading one pull request in full: 12 of 12 turns, $2.23; four delta re-reads: 5 to 7 turns, $0.73 to $1.75)	measured for #894's prompt and claude_args on the installed 2.1.295 client, not through the action; applied to this workflow by task shape, not measured on it	the command center's caps from measurement, 2026-10-09; the run receipts are kept outside the repository
The tests detect a weakened workflow	synthetic	11 mutated copies on 2026-10-08 (that day's bounds), 11 failed at least one test; on 2026-10-09 three turn-bound mutants each failed; at R5, 22 weakened copies run by a script outside the repository: 22 of 22 fail a test with PyYAML 6.0.3 and 10 of 22 without it, and five of the six argument copies pass f5f1fd2's tests
Both workflows are well formed and have no audit finding	local_integration	actionlint 1.17.0 exit 0; zizmor 1.30.1 offline, regular (--no-ignores) and pedantic, no findings (2 suppressed), at R5
A hosted run authenticates, stays in bounds and reads the cache	not established	no hosted run is part of this PR

Local commands run

$ python3 scripts/validate.py            # on the R5 tree (5903ceed)
{"components": 70, "hashed_files": 10906, "profiles": 4, "receipts": 239, "status": "passed"}   exit 0
$ python3 scripts/evidence_manifest.py --check
{"files": 10906, "status": "passed"}   exit 0
$ UV_OFFLINE=1 uv run --quiet --no-project --python 3.12 --with pyyaml==6.0.3 python -m unittest tests.test_claude_security_review_workflow tests.test_workflow_policy tests.test_workflow_security_coverage tests.test_workflow_hardening tests.test_github_automation_practice tests.test_adoption_docs_consistency
Ran 261 tests ... OK (skipped=2)   exit 0
$ UV_OFFLINE=1 uv run --quiet --no-project --python 3.12 --with pyyaml==6.0.3 python -m unittest tests.test_claude_security_review_workflow
Ran 42 tests ... OK   exit 0
$ UV_OFFLINE=1 uv run --quiet --no-project --python 3.12 python -m unittest tests.test_claude_security_review_workflow   # without PyYAML
Ran 42 tests ... OK (skipped=19)   exit 0
$ actionlint .github/workflows/claude-security-review.yml .github/workflows/security-review-flag.yml
exit 0
$ zizmor --offline --no-config --persona=pedantic .github/workflows/claude-security-review.yml .github/workflows/security-review-flag.yml
No findings to report. Good job! (2 suppressed)   exit 0
$ zizmor --offline --no-config --no-ignores --persona regular .github/workflows/claude-security-review.yml .github/workflows/security-review-flag.yml
No findings to report. Good job! (2 suppressed)   exit 0

Hosted checks at 5903cee: not read yet.

Decision record

docs/decisions/2026-10-08-claude-actions-security-review.md (why not anthropics/claude-code-security-review, why the flag and the review are separate, the prompt, the caps and their derivation under "Cost of one run", changed test contracts, alternatives, what would overturn it, and the dated R4 and R5 sections). docs/decisions/2026-10-04-ci-least-privilege.md lists the review job in its write-grant table and both workflows in its per-workflow table, names each exempt job in its federation-exemption sentence, and gets a dated addendum naming this job on the federation rule.

Host evidence

Not applicable: no file under evidence/hosts/ changes.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a
  version comment (no floating tags).
• New/changed workflows declare top-level permissions: {} and grant each job
  only what it needs (contents: read, or an explicitly justified addition).
• No secrets are printed, logged or committed; no new required secret was
  added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted,
  moved or overwritten).

Activation is a separate step after landing: an owner sets CLAUDE_SECURITY_REVIEW_ENABLED to true; the flag then names the dispatch command on each matching pull request. Runs authenticate by workload identity federation and spend from the Console organization the four ANTHROPIC_* repository variables name; no Anthropic key is stored in GitHub. Each run is bounded by the $5 client budget and 30 assistant turns, the owner's per-run spend limit once the variable is set. The review workflow and its tests share their guard and accounting steps with #894 (on-demand pull request review); this PR, #892 and #894 all edit the write-grant inventory and the evidence manifest, so each later one rebases once.

🤖 Generated with Claude Code

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

[seathatflowsinourveins]

Parked: Claude review inside GitHub is retired (owner decision 2026-10-10, ~17:15Z); see #981 and docs/decisions/2026-10-10-retire-in-github-claude-review.md. No further pushes.

[seathatflowsinourveins]

Closing as superseded, with the owner's OK (CC, 2026-10-11).

It adds .github/workflows/claude-security-review.yml, which runs the Claude action. main's tests.test_workflow_hardening.InGitHubClaudeReviewRetiredTests now forbids any workflow that runs it.

Claude review inside GitHub was retired by #981 (8bffa2c, docs/decisions/2026-10-10-retire-in-github-claude-review.md). The Anthropic API refuses the action's entry point on Console keys (CC correction #141; the action never had a successful run). AI reviews now run locally, and GitHub enforces them as required checks. The local route is #953 (the review worker).

Nothing is lost: this PR can be reopened, and any model-free part of it can come back as a new PR under the local-review route. Evidence: the CC's PR triage (research-cc-role-20261008/pr-triage-20261011.md, class CLOSE).