seathatflowsinourveins · Oct 11, 2026 · Oct 10, 2026 · Oct 10, 2026 · Oct 10, 2026 · Oct 10, 2026
@@ -2,7 +2,7 @@
   "allowed_actions": "selected",
   "github_owned_allowed": true,
   "verified_allowed": false,
-  "patterns_allowed": ["step-security/harden-runner@*", "ossf/scorecard-action@*", "anthropics/claude-code-action@*", "oven-sh/setup-bun@*"],
+  "patterns_allowed": ["step-security/harden-runner@*", "ossf/scorecard-action@*"],
   "sha_pinning_required": true,
   "enabled": true,
   "workflow_permissions": {

@@ -1,5 +1,7 @@
 # Bounded harness audit on the current Claude action pin — 2026-10-08
 
+**Superseded (2026-10-10).** Claude review inside GitHub is retired, and the workflow this record describes is removed (`docs/decisions/2026-10-10-retire-in-github-claude-review.md`). The record stays as the history of that workflow.
+
 `harness-audit.yml` moves from `anthropics/claude-code-action` v1.0.245 to v1.0.247 and becomes a bounded,
 read-only job: Claude gets Read, Glob and Grep under `--restricted`, at most 20 assistant turns (checked after the
 run) and a $5 client budget; the

@@ -1,5 +1,7 @@
 # On-demand, read-only pull request review by the Claude action — 2026-10-08
 
+**Superseded (2026-10-10).** Claude review inside GitHub is retired, and the workflow this record describes is removed (`docs/decisions/2026-10-10-retire-in-github-claude-review.md`). The record stays as the history of that workflow.
+
 `claude-pr-review.yml` lets a maintainer ask for a review of one pull request head. It is dispatched by hand from
 `main` with a pull request number and the exact head commit; Claude reads the diff and the files with Read, Glob and
 Grep, within a $5 client budget and at most 30 assistant turns; a model-free step copies the review to the job

@@ -4,6 +4,10 @@ This is the single navigation index for CC133934Z section5, extended by CC142518
 
 The13:39:56Z snapshot is47open PRs,15ready and32drafts, with132remote branches. The30-row premise was the native `gh pr list` default page. This index records that historical correction; current inventories use an explicit `--limit`. The shared API budget is5,000/hour: use native `gh api --cache` and check polling at120s or slower.
 
+**Supersession (2026-10-10).** Claude review inside GitHub is retired ([2026-10-10-retire-in-github-claude-review.md](2026-10-10-retire-in-github-claude-review.md)); the
+`harness-audit.yml` links in corrections 66 and 66a below point to a workflow that no longer exists, and the
+claude-actions records are kept as history.
+
 ## Today's published decisions
 
 | Record | Subject | Evidence boundary |

@@ -1,5 +1,7 @@
 # Pre-cue read of a pull request by Anthropic's pr-review-toolkit agents, in GitHub Actions — 2026-10-09
 
+**Superseded (2026-10-10).** Claude review inside GitHub is retired, and the workflow this record describes is removed (`docs/decisions/2026-10-10-retire-in-github-claude-review.md`). The record stays as the history of that workflow.
+
 `claude-pr-toolkit-review.yml` runs two agents from Anthropic's `pr-review-toolkit` plugin, `pr-test-analyzer` and
 `silent-failure-hunter`, on one pull request head, through `anthropics/claude-code-action` v1.0.247. A maintainer
 dispatches it by hand from `main` with the pull request number and the exact head commit. Each agent reads the diff,

@@ -1,5 +1,7 @@
 # Retain failed Claude federation diagnostics before acceptance — 2026-10-10
 
+**Superseded (2026-10-10).** Claude review inside GitHub is retired, and the three workflows this record describes are removed (`docs/decisions/2026-10-10-retire-in-github-claude-review.md`). The record stays as the history of those workflows.
+
 **Superseded for CI review (2026-10-10).** The owner then ruled that CI Claude review authenticates with an API key, `ANTHROPIC_API_KEY` of the main-only `claude-review` environment, and federation stays unconfigured (`docs/decisions/2026-10-08-claude-actions-pr-review.md`, "Authentication by API key"). This record stays as the diagnosis behind that move; its vendor snapshots stay retained and tested.
 
 The three federated workflows already select Claude Opus 5.5 through

@@ -0,0 +1,107 @@
+# Retire Claude review inside GitHub; AI reviews run locally — 2026-10-10
+
+## Decision
+
+The owner decided on 2026-10-10 at about 17:15Z (relayed by the command center; paraphrased) that Claude review no
+longer runs inside GitHub. AI reviews run on the local host, and GitHub enforces the gates. This change removes the
+three workflows that ran `anthropics/claude-code-action`:
+
+- `.github/workflows/claude-pr-review.yml` (scheduled and dispatched pull request review);
+- `.github/workflows/claude-pr-toolkit-review.yml` (the pr-review-toolkit read before the command center's cue);
+- `.github/workflows/harness-audit.yml` (the weekly harness-context audit).
+
+Their tests go with them (`tests/test_claude_pr_review_workflow.py`, `tests/test_claude_pr_toolkit_review_workflow.py`,
+`tests/test_claude_harness_audit_bounds.py`), as do their entries in the workflow-security coverage list and the
+local-pages inventory. `tests/test_claude_federation_diagnostics.py` keeps its retained-snapshot and decision-claim
+tests; its tests of the workflows' accounting shell go. `tests.test_workflow_hardening.InGitHubClaudeReviewRetiredTests`
+replaces the API-key tests: the three files must stay absent, and no workflow may run the Claude action, name an
+Anthropic key or deploy a job to the `claude-review` environment, read from each job's `environment` as a scalar or a
+mapping's `name`, without a decision that reverses this one.
+
+Before this change the command center disabled the three workflows (`disabled_manually`, 17:16Z) and deleted the
+`claude-review` environment's `ANTHROPIC_API_KEY` secret (17:16:48Z).
+
+## Cause (the command center's correction #141, measured)
+
+- The API refused every request that carried the action's attribution: a 400 "credit balance is too low" on each of
+  the five Console keys, while the same keys work from the Claude Code CLI and the Agent SDK. Request ids
+  `req_011Cftv64ZSQrFDAWwCTe1b1` and `req_011Cftv6611xXRySUeyhBAhH`; reproduction scripts
+  `ci_review_sdk_repro.sh` and `ci_review_oauth_repro.sh` in the command center's tool directory.
+- The attribution: the pinned action sets `CLAUDE_CODE_ENTRYPOINT=claude-code-github-action` for the session
+  (`anthropics/claude-code-action@2dca132ff0e0c4094ce6048b422c6915a071210b`, `base-action/src/parse-sdk-options.ts:284`,
+  read for this record), and the client then reports that entrypoint in its billing header (the command center's
+  measurement; not re-measured here).
+- The record of the workflows: `claude-pr-review` had no successful run (4 failed, 68 skipped), the toolkit read
+  never ran, and `harness-audit` failed its only run. Under federation, before 2026-10-10, the runs were refused as
+  well (`docs/decisions/2026-10-10-claude-federation-diagnostics.md`).
+
+## What remains
+
+- **Local AI reads:** the local Claude review worker (`tools/claude-review-worker`, #953, open), the command
+  center's and the co-op's GPT reads, and trading-cc's toolkit reads, all run on the host with the stored keys through
+  the credential runner.
+- **Codex's GitHub review**, which is not affected.
+- **GitHub's gates:** the required checks (`validate`, `sota-sources`, `verdict-review-gate` in
+  `pr-metadata.yml`, the supply-chain and security scans) and the landing scripts the command center is moving into
+  the repository (`tools/landing`, #975).
+
+**Follow-up (dated 2026-10-10).** The `claude-native-practice` skill rows for the retired route (its
+`github-action` row and the Actions part of `pr-review-pre-cue`, in `reference/git-github-automation.md`,
+`reference/slots.md` and `reference/slots.json`) are updated in a follow-up pull request (cc-native-practice), then
+re-pinned.
+
+## Revisit when
+
+- Anthropic accepts Console API keys for requests that carry the action's attribution (a dispatch with a stored key
+  returns a review with `total_cost_usd` above zero and a non-empty `modelUsage`);
+- outside contributors open pull requests, so a review needs to run on GitHub's side rather than the owner's host;
+- the repository moves to an organization, where GitHub's native merge queue becomes available: "Pull request merge
+  queues are available in any public repository owned by an organization" (GitHub Docs, Managing a merge queue,
+  read 2026-10-10).
+
+## Inverse
+
+1. Revert this change (the three workflows and their tests come back as they were at
+   `9d4c00cd05d79b3fd5074df2e46bacab87ee67ff`, #968).
+2. Re-set the `claude-review` environment secret from slot `anthropic-api-3` through `credential_run.py`, with the
+   value on `gh secret set`'s standard input only (the procedure in `docs/secret-storage.md`).
+3. Re-enable the three workflows (`gh workflow enable`) and keep their repository variables set.
+4. Put the Claude action's two patterns back in `.github/actions-permissions.json` (`anthropics/claude-code-action@*`,
+   and `oven-sh/setup-bun@*`, which its composite bootstrap uses) and in the live selected-actions setting.
+
+## Actions allow-list
+
+`.github/actions-permissions.json` drops `anthropics/claude-code-action@*` and `oven-sh/setup-bun@*`: no workflow uses
+them now, and `test_every_allowed_pattern_is_used_by_a_workflow` keeps every remaining pattern in use. The command
+center applies the live selected-actions change after this lands.
+
+## Alternatives considered
+
+- **Keep the workflows with an OAuth token** (`claude_code_oauth_token`): the command center's OAuth reproduction is
+  among the measured refusals, and a subscription token in CI was already ruled out.
+- **Keep them disabled in place:** dead workflows still carry tests, policy exemptions and documentation that describe
+  a path that does not run; removing them keeps the repository's description true.
+
+## What would overturn it
+
+Any revisit trigger above, with a measured successful hosted run.
+
+## SOTA sources
+
+- GitHub Docs, Workflow syntax for GitHub Actions, `jobs.<job_id>.environment`,
+  <https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idenvironment> (read 2026-10-11T00:44Z; page sha256
+  `a5f79ab5ead969939f973c1ab3a8dc4c39e41733d53935557dd8e3c771185dd8`, 2,095,606 bytes): a job's environment is "only
+  the environment `name`, or ... an environment object with the `name` and `url`". The retirement guard reads both.
+- YAML 1.2.2, <https://yaml.org/spec/1.2.2/> (read 2026-10-11T00:44Z; page sha256
+  `2fe1bf40792df22ef8b8a5972a34c48e639969222e0bbae605aa9bb2ca85e9ab`, 383,078 bytes): 8.2.2 Block Mappings, 7.4.2 Flow
+  Mappings, 7.3 Flow Scalar Styles (quoted keys) and 6.6 Comments, the forms of the guard's regression cases; PyYAML
+  6.0.3 is the parser its cross-check uses.
+
+- anthropics/claude-code-action at `2dca132ff0e0c4094ce6048b422c6915a071210b` (v1.0.247),
+  `base-action/src/parse-sdk-options.ts:283-284`: "Set the entrypoint for Claude Code to identify this as the GitHub
+  Action" and `env.CLAUDE_CODE_ENTRYPOINT = "claude-code-github-action"`.
+- GitHub Docs, Managing a merge queue,
+  <https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue>
+  (read 2026-10-10): availability for organization-owned public repositories.
+- The command center's correction #141 (measured 2026-10-10; request ids above), relayed to the coordinator; its raw
+  records stay in the command center's private state.
@@ -29,7 +29,7 @@ The committed target [`.github/main-ruleset.json`](../.github/main-ruleset.json)
 The adoption macOS policy below follows the [2026-10-10 retirement decision](decisions/2026-10-10-retire-macos-ci.md).
 Other settings observations retain their stated dates.
 
-The Actions allow-list and harness description below were checked against live settings and pinned sources on 2026-10-08.
+The Actions allow-list below was checked against live settings and pinned sources on 2026-10-08.
 
 - **Required checks** (job IDs from GitHub Actions, app ID 15368; strict up-to-date checks off): `validate`,
   `token-report`, `secret-scan`, `dependency-review`, `osv-scanner`, `verdict-review-gate` and
@@ -59,63 +59,23 @@ The Actions allow-list and harness description below were checked against live s
   carries the osv-scanner, zizmor and Scorecard SARIF. Dependabot version updates cover GitHub Actions only (weekly,
   7-day cooldown), and Dependabot security updates are on.
 - **Actions.** Every `uses:` is pinned to a full commit SHA, which the repository also requires. The allow-list is
-  GitHub-owned actions plus the four external patterns `step-security/harden-runner@*`, `ossf/scorecard-action@*`,
-  `anthropics/claude-code-action@*` and `oven-sh/setup-bun@*`; verified-publisher actions are not separately allowed.
-  The pinned Claude action's composite bootstrap uses `oven-sh/setup-bun` when no custom Bun executable is supplied;
-  the repository has no direct workflow reference to it. Only the catalog-freshness `propose` job holds
+  GitHub-owned actions plus the two external patterns `step-security/harden-runner@*` and `ossf/scorecard-action@*`;
+  verified-publisher actions are not separately allowed. The Claude action's two patterns left with its workflows
+  (2026-10-10). Only the catalog-freshness `propose` job holds
   `pull-requests: write`, and no workflow reviews or approves a pull
   request (`test_pull_requests_write_is_granted_only_to_the_propose_job`,
   `test_no_workflow_reviews_or_approves_a_pull_request`).
-- **Harness audit.** The weekly and manually dispatched [`harness-audit.yml`](../.github/workflows/harness-audit.yml)
-  runs only in `seathatflowsinourveins/native-agent-stack` and only on `main`, using `anthropics/claude-code-action`
-  v1.0.247 at
-  [`2dca132ff0e0c4094ce6048b422c6915a071210b`](https://github.com/anthropics/claude-code-action/blob/2dca132ff0e0c4094ce6048b422c6915a071210b/action.yml),
-  only while the repository variable `CLAUDE_HARNESS_AUDIT_ENABLED` is `true`, only on a run's first attempt, and,
-  when dispatched by hand, only when the repository owner is both `github.actor` and `github.triggering_actor`.
-  Its job grants `contents: read` over an empty workflow permission default.
-  It authenticates with `ANTHROPIC_API_KEY`, a secret of the main-only `claude-review` environment (the owner's ruling
-  of 2026-10-10, which replaced
-  workload identity federation; [decision](decisions/2026-10-08-claude-actions-pr-review.md));
-  the workflow fetches a pinned, SHA-256-verified audit prompt and asks for a project-scoped read-only audit. Claude
-  has Read, Glob and Grep only, at most 20 assistant turns (checked after the run) and a $5 client budget; a
-  model-free step copies the report to the
-  job summary and keeps the run's token and cost numbers
-  ([decision](decisions/2026-10-08-claude-actions-harness-audit-bounds.md)). Hosted acceptance remains open after
-  [run 37739403956 failed](https://github.com/seathatflowsinourveins/native-agent-stack/actions/runs/37739403956).
-  That run, and the review dispatch of 2026-10-10 (run 38056354892), were refused under federation; the likely cause
-  is a rule subject that does not match the repository's immutable OIDC subject. The API key replaces federation.
-- **Pull request review, every head and on demand.** [`claude-pr-review.yml`](../.github/workflows/claude-pr-review.yml)
-  reviews each open, non-draft, same-repository pull request head targeting main until one review of it completes
-  (a trusted completion marker, kept 90 days), from a 15-minute schedule (at
-  most 2 heads a tick, up to the daily ceiling `CLAUDE_PR_REVIEW_DAILY_USD`, default 55), and can be dispatched by
-  hand from `main` with a pull request number and the exact head commit. It runs only while the repository variable
-  `CLAUDE_PR_REVIEW_ENABLED` is `true`, and the schedule only while `CLAUDE_PR_REVIEW_EVERY_PR` is also `true`; a
-  tokenless resolve job chooses the heads, and the review is advisory. It uses the action pin v1.0.247 (`2dca132f`) and the
-  `ANTHROPIC_API_KEY` of the main-only `claude-review` environment (since 2026-10-10; no federation input). `main` is at the workspace root and the pull request head is data under `pr-head/`; Claude has Read, Glob
-  and Grep only, a $5 client budget and at most 30 assistant turns; the job grants `contents: read`, `pull-requests: read` and
-  `actions: read`. A model-free step copies the review to the job summary; nothing is posted to the pull request
-  ([decision](decisions/2026-10-08-claude-actions-pr-review.md)).
-  [Scheduled run 37988961127](https://github.com/seathatflowsinourveins/native-agent-stack/actions/runs/37988961127)
-  completed with failure on 2026-10-09 under federation; this is execution evidence, not accepted model usage.
-  All three Claude workflows retain `zero_cost_error_without_model_usage` when an error result has zero cost
-  and empty model usage, and still fail their bounds check. Raw provider messages are excluded. The class does not
-  identify a deny reason; see the [federation diagnosis](decisions/2026-10-10-claude-federation-diagnostics.md),
-  kept as the record of why the owner moved CI review to an API key.
-- **Pre-cue toolkit read** (`claude-pr-toolkit-review.yml`, added 2026-10-09): Anthropic's pr-review-toolkit agents
-  `pr-test-analyzer` and `silent-failure-hunter`, from `anthropics/claude-code` at
-  `602df92bf481ed904533e95c09f740f40aab5aed` (checked out with its three files' SHA-256 verified, loaded with
-  `--plugin-dir`, never installed from a marketplace at run time), read one pull request head in parallel and list
-  every behaviour and test change its description does not declare. Dispatched by hand from `main` by the owner, and
-  only while `CLAUDE_PR_TOOLKIT_ENABLED` is `true`; Opus 5.5 at `max` effort, Read, Glob, Grep and the Agent tool, a
-  $22 client budget and a time limit scaled by the diff's size; a model-free step copies both reports to the job
-  summary and nothing is posted to the pull request ([decision](decisions/2026-10-09-claude-actions-pr-toolkit-review.md)).
-  Its output is an input before the command center's cue, never a designated read. No hosted run has been made.
+- **Claude review inside GitHub: retired (2026-10-10).** The owner decided that AI reviews run on the local host and
+  GitHub enforces the gates ([decision](decisions/2026-10-10-retire-in-github-claude-review.md)). The three workflows that ran
+  `anthropics/claude-code-action` (`claude-pr-review.yml`, `claude-pr-toolkit-review.yml`, `harness-audit.yml`) are
+  removed: the API refused every request that carried the action's attribution, on every stored Console key, while
+  the same keys work from the CLI and the Agent SDK. Reviews now come from the local Claude review worker, the GPT
+  and trading reads, and Codex's GitHub review; the required checks and the landing scripts enforce the gates.
 - **Against the final catalog of 2026-10-01** (`docs/final-catalog-20261001.md`, #595): the picks each blind model
   family made for these layers. The clean-room definitive round announced there decides one pick per slot.
   - git-github-automation: both families picked git, gh, Worktrunk and sem (the Claude pick keeps sem only if a
     structural-diff comparison shows a gain); one picked difftastic and claude-code-action. difftastic remains the
-    selection of record; decision M45 recorded claude-code-action as unadopted. The later configured harness above
-    still awaits hosted acceptance.
+    selection of record; decision M45 recorded claude-code-action as unadopted.
   - ci-supply-chain: both families picked attest, Syft, Dependabot, actionlint (kjanat) and zizmor, all in use;
     `github/codeql-action`, picked by one, is the `upload-sarif` step above.
   - secrets-credentials: both families picked betterleaks, and one picked trufflehog. gitleaks stays the required