Retire Claude review inside GitHub; AI reviews run locally - #981

…ew (#1001)

* Retire the skill's Claude-in-GitHub rows and point them to local review

The claude-native-practice skill still selected the route that
docs/decisions/2026-10-10-retire-in-github-claude-review.md retired:
the github-action row (anthropics/claude-code-action at a pin) and the
Actions part of pr-review-pre-cue.

- slots.json, slots.md and the layer pages: `retired` joins the status
  vocabulary; github-action becomes retired with a dated block (record,
  correction #141, scope, the three workflows, the former default, route,
  alternatives, evidence and notes as a snapshot, the revisit triggers);
  pr-review-pre-cue becomes default (scoped) and lists the routes
  available now (local Claude reads, GPT reads, Codex's GitHub review,
  the required verdict-review-gate) apart from the open #953 worker.
- The scope is the owner's repositories (the command center's ruling of
  2026-10-10), not "this repository": a hermetic A/B showed a session in
  another repository concluding that the action was still fine there.
  The same ruling retires the managed Claude Code Review GitHub App.
- Stale texts the independent pre-read and the stricter check found: the
  release-tracking note (Dependabot as the action's tracker), the
  scheduled-tasks route (GitHub Actions schedules only for jobs that run
  no model) and its source mapping, the usage-cost-monitoring note
  (Actions under WIF), and the pre-cue source mapping (in Actions through
  #909). The pre-cue route no longer lists a read the record does not name.
- tests/test_native_practice_retired_routes.py: no current row selects a
  retired route; a retired route is named elsewhere only in a sentence or
  list item that says it is retired; every line of slots.json, slots.md,
  the layer pages and cross-client.md is read (duplicates kept, the source
  mappings of live slots included); only the dated snapshots are exempt.
  Positive controls are the rows as they stood; the mutation table is in
  the pull request description.
- The slot manifest of #923 is relabeled against the new slots.json
  bytes, so the exact-difference check of the provenance test runs again
  instead of skipping.
- docs/decisions/2026-10-09-claude-code-native-practice.md: a dated
  pointer to the retirement, as #981 did for the older records.

Source read for this change: anthropics/claude-code-action at
2dca132ff0e0c4094ce6048b422c6915a071210b, base-action/src/
parse-sdk-options.ts:283-284 (CLAUDE_CODE_ENTRYPOINT is set to
claude-code-github-action).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Close the holes in the retirement guard and qualify the one-default rule for retired slots

Answers the Codex review in GitHub of #1001 at ba6ab3a (four P2s) and the co-op's GPT first read at the same head (three P2s, the first three below); each was reproduced before the change.
- Sentence units split at a full stop or a semicolon whatever follows, and at a line break: "This route was retired; the current default is claude-code-action." was one unit that said retired.
- The generic phrases "in Actions", "through Actions" and "under WIF" count as the retired route only with Claude context, judged per leaf string; the named workflows, "through #909" and the managed app count
  everywhere. The routes the decision retains (every bullet of its "What remains" section, a catalog job in GitHub Actions, a non-model gate under WIF) are accepted.
- The skill's entry point SKILL.md is scanned, and a test requires every file of the skill folder to be read by a check.
- The one-default rule names the retired exception in slots.json, in the slots.md copy and in step 3 of SKILL.md (a retired row has none and says what replaced the route).
- The ruled default text is pinned exactly (the read's measured boundary: the date changed on all three surfaces passed), and a check compares every row's Overturn when across slots.json, the index and the
  layer pages (one step wider than the review of #1005, where an edit left the index cell behind).
Each finding fails its own test when its fix is undone alone, and 43 single-edit mutations are caught; the old guard accepts the four bad scenarios of the read and rejects its two legitimate ones.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Bind the manifest label to the shipped slots file and close the remaining holes of the retirement guard

Answers the CC's Claude first read of #1001 at 6e97620 (two P2s, six P3s) and Codex's second review in GitHub of the same head (two P2 threads); each was reproduced before the change.
- P2-1: the slot manifest was labeled against the slots.json of ba6ab3a, so the exact-difference check of the provenance test skipped at the head (OK, skipped=1). The label is the sha256 of the shipped file again,
  the check no longer skips, and a new test fails when a change to slots.json does not carry its label (the CC's ruling: a silent skip is this defect's class, so it fails loud).
- P2-2: a live source mapping (skills-library, primary_sources[5]) still ran `claude -p` "in a GitHub workflow ... plus a nightly cron"; the guard had no such form. It is reworded to say the run is retired,
  and "in a GitHub workflow" (also from, via, through, using, as) counts as the retired route when the sentence is about Claude.
- P3-1: the Claude Code GitHub Action, /install-github-app and an @claude mention are the retired route under other names (claude-code-security-review stays out: a documented rejection).
- P3-4: the Former default exemption of a layer page applies to a retired slot only.
- P3-5: a retired slot's own source mapping is read, and now says retired.
- P3-2: "e.g." and "i.e." no longer end a sentence, and wrapped lines of prose are one paragraph (the slots.md prose and SKILL.md were judged line by line).
- P3-6: the manifest prose lists the fields beyond the exported ones that differ from the snapshot.
- P3-7: the entry point directs ("a retired row has no default, so follow the replacement it names"), and the step-3 pin no longer fails with an IndexError on a renumbering.
Each correction fails its own test when it is undone alone, and the mutation table is extended.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Judge retired-route prose one physical line at a time and close the guard's other gaps

Answers the command center's Claude micro of #1001 at ef3f3e7 (P2-1, P3-1 to P3-5) and Codex's four threads of the same head (:43, :63, :122, :211). Each case was reproduced before the change:
compare-guards-ef3f3e7b-vs-third-commit.txt runs 19 scenarios through the guard of ef3f3e7 and this one; the old guard is wrong on 13 (it accepts a retired route that is reintroduced), this one on none.
- P2-1 (correction #160): joining wrapped lines into one paragraph let "Retired 2026-10-10" followed by a line that says the current default is claude-code-action pass on four prose surfaces (SKILL.md, slots.md,
  cross-client.md, layer-page preambles), the scenario Codex raised at ba6ab3a line 41. Prose is judged one physical line at a time again, a line break ends a unit, and the message of every line-judged surface
  states the rule (RULE; the legend of slots.md states it too and a test pins the two to each other).
- P3-1 and Codex :43: three more names of the same route, all in the vendor's own text: the page's title "Claude Code GitHub Actions" and its "installs the Claude GitHub App"
  (code.claude.com/docs/en/github-actions.md, capture sha256 87b99aef, lines 5, 9, 33, 63-64), the mirror claude-code-base-action (anthropics/claude-code-action@2dca132ff0e0:
  .github/scripts/check_workflow_hardening.py:18, .github/workflows/sync-base-action.yml:1 and 43, CLAUDE.md:20) and the carrier named first ("Use the GitHub Action for Claude reviews", generic
  like "in Actions": it counts when the field or unit is about Claude). The families "in Actions" and "through Actions" take on, with, inside and via.
- Codex :122 and the command center's P3-3 and P3-5: a unit that negates the retirement outright ("not retired", "never retired", "no longer retired", "isn't retired", "unretired") no longer counts as saying
  retired. The other half of that scenario, "was retired, but is now current", is the boundary the command center ruled (the guard is a tripwire for stale text; review reads what it accepts); the module names it.
- Codex :211 and P3-3: a layer-page section with a label twice (a second Route or Overturn when bullet) is a violation, because the page-to-slots.json comparison keeps the first bullet only.
- Codex :63 and P3-4: the target of every slots.md row is checked against <page>#<id>, from the layer of the slot.
- The description line of SKILL.md names the topic that invokes the skill; it is pinned by sha256 to the text the routing was measured with and read as a topic, not as a route.
- Scheduled-tasks (Codex on #1005, scheduling-supervision.md:9, and the command center's ruling): the route no longer bans every model-backed job. The retirement record
  (docs/decisions/2026-10-10-retire-in-github-claude-review.md:5-6, :43) retires Claude review inside GitHub and keeps Codex's GitHub review, so the route says GitHub Actions schedules repository jobs and a
  scheduled Claude task runs locally; a test pins the wording on slots.json, the layer page and the alternatives.
The label of claude-native-slot-manifest.json equals the sha256 of the shipped slots.json again (relabel last); test_the_label_names_the_shipped_slots_file and test_no_other_exported_field_differs
(no skip) are unchanged from ef3f3e7. 72 of 72 single-edit mutants of the guard and its data are caught and 5 controls pass (mutations-v4-forward-commit-3.md).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Align the manifest's scheduled-tasks note, state the rule in every explaining unit, split units after a closing delimiter and pin the scope of the name patterns

The final fix round of #1001 under the command center's convergence ruling: its Claude micro at efaa077 (blockers B1 to B3, P3-2) and its adjudication of 2026-10-11T13:50Z of Codex's third review. Each item was reproduced on that
head before the change.
- claude-native-slot-manifest.json:47 (Codex P2, B1, a text of this PR that is false at the head): the note on the differences from the snapshot still said the route of scheduled-tasks was narrowed "to jobs that run no model",
  while the shipped route says that GitHub Actions schedules repository jobs, that Claude runs inside GitHub are retired (2026-10-10, docs/decisions/2026-10-10-retire-in-github-claude-review.md:5-6, :43) and that a scheduled
  Claude task runs locally. The note says so now, and test_the_scheduled_tasks_route_retires_the_claude_routes_and_not_every_model_backed_job reads the manifest as well as the route (fails with the note undone: M79).
- B2: the module claims that the message of every line-judged surface states the rule, and it did not for the labelled bullets of a layer page or for the Overturn when cell of an index row. Every explaining unit states it now
  (a selecting field names no unit and states nothing); the three expected messages carry the rule and test_every_explaining_unit_of_a_layer_page_and_of_the_index_states_the_rule_and_a_selecting_field_does_not pins all three
  kinds (mutants M83 to M85).
- tests/test_native_practice_retired_routes.py:83 (Codex P2, P3-2): a closing quote, parenthesis or bracket between the full stop and the white space kept `The route was "retired." The current default is claude-code-action.` in one
  unit that said retired. The sentence pattern takes closing delimiters (the curly quotes are built with chr(), so the file stays ASCII); test_a_closing_quote_parenthesis_or_bracket_after_the_full_stop_does_not_join_two_claims fails
  without it (M78, M82) and keeps `claude-code-action was retired (see the record.) No row selects it.` accepted (control C6).
- :48 (Codex P2, workflow-first phrasing) is a follow-up and the class closes (rule 4 of the convergence ruling): the module states that the guard pins the named retired artifacts and the retired slot rows, that generic phrasing of a
  Claude run in a GitHub workflow cannot be enumerated and is out of its scope (the retirement record governs it), and test_generic_workflow_phrasing_is_out_of_scope_and_the_module_says_so pins the boundary. No pattern is added.
- B3 is the description: the two earlier command blocks name the 37 modules they ran (the 46 of the first block without the nine tests.test_local_pages_* modules).
80 single-edit mutants of the guard and its data are caught and 6 controls pass (mutations_retire_v6.py).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Close the sentence-splitter class by documentation, pin the module's ASCII and the scope list

The command center's confirmation micro of #1001 at bdf60fc (research-cc-role-20261008/pr1001-claude-micro-bdf60fc6.md: blockers 1 and 2, P3s) and its correction #163 of 2026-10-11T16:18Z on Codex's three threads of 15:39:21Z.
No code of the guard changes in this commit.
- Blocker 2: the module said that it stays ASCII and held one U+2026 in a comment (added by efaa077). It is three full stops now, and test_the_source_of_this_module_is_printable_ascii pins the claim; it fails on the module
  of bdf60fc (['U+2026'] != []).
- Blocker 1 (the pull request description, and this message corrects the message of bdf60fc): the earlier statement that the 37 modules ran "without its nine tests.test_local_pages_* modules" was false. They are the first 37
  modules of the 46-module list, and the nine left out are its last nine (tests.test_local_pages_fleet_execution to tests.test_local_pages_workstation, 144 tests, run and counted); 29 of the 46 are local-pages modules.
- Codex :92 (an exclamation mark or a question mark does not end a unit) is not patched: the sentence splitter has drawn findings in five consecutive rounds (the lowercase clause, "e.g.", the joined lines, the closers,
  the exclamation mark and the question mark) and was patched four times, so rule 4 of the convergence ruling closes the class the way line 48 closed. The module docstring states exactly what the guard accepts as a unit end
  and that review reads everything else; test_the_unit_ends_and_the_scope_of_the_name_patterns_are_documented pins the sentence and the behavior, and fails on the module of bdf60fc, where the sentence is missing.
  A pinned upstream sentence segmenter is a research-queue item (rule 8, layer instructions-skills).
- Codex :51 (a carrier-first name of the managed Code Review app) is confirmed within the closed class: the same scope paragraph says that reordered phrasings of a pinned artifact are out of the guard's scope.
- P3-1: the scope list named 11 of the 17 patterns; it names all 17 now, and test_the_scope_of_the_name_patterns_names_every_pattern compares the list itself with PATTERNS (it fails on the module of bdf60fc).
  P3-2: the right single quotation mark closer is tested (its mutant survived). P3-3: the comment at the sentence pattern says what the code does.
- Codex :170 (retired.on is checked for its shape only) is a follow-up under rule 5: the shipped value is the date of the record, so 2099-12-31 is a mutant and not a reproduced failure of the shipped state.
88 single-edit mutants of the guard and its data are caught and 6 controls pass (mutations_retire_v9.py).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

#981 (8bffa2c) removed the in-GitHub Claude workflows. The worker's
README, comments and decision record still described claude-pr-review.yml
as live or as an optional cloud path; each reference now says it was
removed by #981, and the record's overturn condition names an owner
decision to bring a cloud review back instead of the federation fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

#981 (8bffa2c) removed the in-GitHub Claude workflows. The worker's
README, comments and decision record still described claude-pr-review.yml
as live or as an optional cloud path; each reference now says it was
removed by #981, and the record's overturn condition names an owner
decision to bring a cloud review back instead of the federation fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

#981 (8bffa2c) removed the in-GitHub Claude workflows. The worker's
README, comments and decision record still described claude-pr-review.yml
as live or as an optional cloud path; each reference now says it was
removed by #981, and the record's overturn condition names an owner
decision to bring a cloud review back instead of the federation fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Add a local Claude review worker for essential pull request heads

A systemd user timer reviews each essential head of us-equities-trading and native-agent-stack with Claude Code
headless (Opus 5.5 at max) on an Anthropic API key, injected by the credential runner, in a bubblewrap sandbox with no
home directory. Main's checkout is the working directory and the head is data; CLAUDE_CODE_DISABLE_CLAUDE_MDS=1 keeps
every instruction file out. It posts a claude-review/local commit status (and a sanitized comment on the private
repository), debits the api-actions ledger before each run, and carries the upstream-alignment rule for trading heads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Harden the review worker after the security review and the live probes

Fixes from the security-reviewer pass and the coordinator's live probe run on #953:

- Upstream citation labels come from the pull request, so they no longer enter the
  prompt's instructions: they go to the data file /review/input/upstream-citations.txt
  (each label capped at 200 characters, each list at 50), and the prompt gives counts only.
- The private repository's comment shows the findings inside one fenced code block,
  with every backtick replaced, so no image, link, HTML or reference in model text renders.
- The native-agent-stack essential paths cover the gate itself: this tool, the credential
  inventory and schema, the guard and git hooks, .gitleaks.toml and the agent instruction
  files (command center decision on #953, 2026-10-10 01:17Z).
- The masked-credential bound reads the whole raw stream, tool results and unparseable
  lines included, for both [REDACTED: and [REDACTED-PARTIAL: markers.
- A stream line that fails to parse for any reason (RecursionError included) is counted,
  and an unreadable stream still settles its debit as unknown.
- A head already in main, or with an empty diff, gets no attempt and no status and is not
  selected again. A head over 40,000 files or 600,000,000 bytes is refused before anything
  is extracted or spent.
- A budget stop posts error; the next tick deletes a stopped run's leftover scratch.
- The service refreshes the live clone in a fail-closed ExecStartPre and drops
  PYTHONDONTWRITEBYTECODE (python3 -I ignores it).
- probes.py offline adds /proc and /dev/fd routes, links in main's checkout (L11), the
  head's own .claude rules and skill facts, and a CLAUDE_CONFIG_DIR check (O8); all 18
  checks pass (receipt readers/crw-probes/probes/20261010T013330Z).
- The record states the live native_proven set (P1, P2, P6, P11; P4 was vacuous), the
  command center's decisions, residual risks R1-R3 and the head export's known limits.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Run the review worker on one key, with the other two as cold spares

Owner direction relayed by the command center (2026-10-10 01:49Z): anthropic-api-4 is the one key; api-3 and api-2 are
tried only after a credit-exhausted refusal, and a run on a spare is logged at journal warning priority. The key is
still injected per command by the credential runner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Close a review's ledger ref only while its debit is open

The worker's settle, settle_unknown and void now take the ledger lock, read the
ref's latest row, and append only when that row is its open debit, as the
api-actions harness's _open_debit does. The key and the unknown amount come from
that debit. Recovery rechecks each ref under the lock and leaves a ref another
writer closed meanwhile (GPT P2-5 at 4b8027b).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Keep the reservation when a review's output has no readable record

A nonempty stream in which no line parses was classified no_stream, so its
debit was voided at zero and its attempt went uncounted. It is now
unreadable_stream: the reservation settles as unknown and the attempt counts
toward the two-attempt limit. Only an empty or absent stream is voided
(GPT P2-4 at 4b8027b).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Post a review only while its head is current, and never post it twice

publish() reads the pull request just before the status POST and again before
the comment POST; a head that moved, or a closed PR, marks what is unsent
superseded. If the head moves after both were posted, the comment gets a
superseded line (PATCH). Each POST is saved as "sending" first and "posted"
after; a retry of a sending or failed POST first looks on GitHub for the
commit's latest claude-review/local status and for this attempt's comment,
found by a hidden marker line, by the same gh login (GPT P2-1 and P2-2 at
4b8027b).

The test stand-in for gh now keeps statuses and comments across ticks and can
move a head, close a PR, or accept a write and lose its reply.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Make the offline L7, L8 and L9 checks fail when their calls are missing

Each check was exercised by any tool call at all, so removing the calls it
stands on left it PASS. required_calls() now names, per check, the scripted
calls and whether each must be denied; a check fails when any of them, or its
result, is missing, or when a required denial was answered. A subtest removes
each call, each result, and flips each denial on its own: every one turns its
check FAIL (GPT P2-6 at 4b8027b). The offline probes still pass 18/18 against
the pinned 2.1.296 client (7, 2 and 6 required calls answered).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Record the fixes after the GPT read, and paraphrase the routing row

The decision record's upstream-alignment section quoted the command center's
routing row verbatim; it now gives a dated, attributed paraphrase with the same
source citation (GPT P2-7 at 4b8027b). The record also describes the
publication checks, the reconcile before a retry, the unreadable-stream class,
the ledger's open-debit check, the stricter L7 to L9 grader and its offline
receipt, narrows the cleanup claim to a tick that passes preflight, and marks
R2 open for the command center's decision on the network boundary (P2-3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Run each review inside Anthropic's sandbox runtime, allowing only the API host

The worker's bwrap shared the host network: the open internet, host loopback,
the LAN and host abstract sockets were all reachable from the sandbox (GPT P2-3
at 4b8027b, measured). Per the command center's ruling, srt
(@anthropic-ai/sandbox-runtime 0.0.79, from the pinned npm tarball) now sits
between the credential runner and bwrap. srt unshares the network and its host
proxy passes api.anthropic.com only; the inner bwrap stays the filesystem fence.

Each run gets a private directory under XDG_RUNTIME_DIR (srt's settings,
TMPDIR, HOME and an empty working directory), removed afterwards. Preflight
refuses the tick, before any key is read, when node (>= 22.12, the mise
install), the srt install (version and npm integrity), socat or the socket
path room is wrong, and when a keyless check through the same chain does not
show lo alone, the API reachable through the proxy, example.com refused, no
direct route and no reach to a host loopback listener. probes.py offline
runs the static checks only; live runs all of them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Record the network boundary, its measurements and its limits

The decision record now describes srt as the worker's network boundary (the
command center's ruling on P2-3): its source pin, the chain, the settings, the
fail-closed preflight, the keyless check and its control, the live probe run
through srt (native_proven, $0.6252 on api-4), R2 closed, R1's wider set of
processes holding the key, and the untested items as known limits. The README
covers the srt install, its two settings, posting and the inverse. probes.py
now copies the worker's settings whole (dataclasses.replace), so its runs keep
the srt and node paths.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Settle superseded comments durably and start srt without the key

The GPT read at d784fe0 asked for changes with four P2 findings:

- Supersession was not durable: an accepted comment whose reply was lost,
  then a head move, ended superseded with no PATCH, and a failed superseding
  PATCH was never retried. The marker lookup and the PATCH are now open work
  in the attempt marker (comment_marked false) until GitHub's side is
  settled, and every tick finds open posting work from the stored attempts,
  not from the listed heads.
- The key reached srt's node process, its shell and its socat bridges,
  because the runner injected it before srt started (srt spawns its command
  with shell: true and the inherited environment, src/cli.ts:545-548 at
  d9aac209). srt now starts without the key; the inventory runner is srt's
  command and injects it into bwrap and the client only. A native test reads
  every process environment during a run with a fake key: the client holds
  it, srt's node, shells and bridges do not; with the runner outside srt, node,
  sh, bash and three socat processes held it.
- The records correction had no regression test: RecordRuleTest rejects a
  restored quotation (straight, curly or block) in the direction sections,
  on synthetic text; the 4b8027b form of the section fails it.
- The ledger reference was unpinned: the harness common.py (not in git) is
  pinned by sha256 with line locators and a read-only copy, and the worker
  was run against it on one temporary ledger. A close of another workload's
  debit is now refused too.

85 tests; 25 weakened copies of the code guards each fail their test. The
offline probes and a live probe run through the reordered chain pass
(20 of 20, native_proven, $0.7766 on api-4).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Catch wrapped quotations and keep the final head check as open work

The command center's read at 3d0bead found that RecordRuleTest's detector
stopped at a line break, so the 4b8027b quotation, wrapped across lines,
gave no span; the prior form failed the test only on its other assertions.
The detector now lets a quotation span line breaks (not a blank line),
collapses whitespace before counting words, and joins consecutive block-quote
lines. New wrapped cases cover straight, curly and block forms, and a
paragraph break ends a span. On the 4b8027b section the detector finds one
25-word span, and that form spliced back fails the test on the detector's
own assertion; a line-bound detector fails the new cases. The record and the
PR body now say exactly that.

The GPT read at 3d0bead found that with both parts posted, a head move during
posting and a failed final head read left the comment unmarked for good. Before
any POST the attempt is now marked verify: pending, cleared only by a head read
that settles the outcome; publish_pending finds it from the stored attempts.
Regressions cover the failed final read and a tick stopped before it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Take up the command center's P3 notes from its read at 3d0bead

- R1 now says the runner holds the key in memory, while bwrap and the client
  hold it in their environment, and the client's children inherit it. It
  names CLAUDE_CODE_SUBPROCESS_ENV_SCRUB as present in 2.1.296 and
  unmeasured here, and it weighs srt's own credential masking: that needs
  tlsTerminate, so srt's proxy would read every request.
- Boundary.prefix's docstring no longer says the key passes through srt.
- A superseding PATCH now ends: HTTP 404 marks the comment deleted, and after
  24 failed tries the worker gives up with a warning, so a broken PATCH is no
  longer retried every tick for good. A new regression fails on the pushed
  worker.
- The ledger reference is now also pinned by commit: the api-actions harness
  is under local git (d97aad49), and common.py's content hash is unchanged.
- The mutation accounting is corrected: 21 weakened copies, 25 failing test
  runs. Later fixes were checked against the worker before them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Cite the Python behaviour the records-rule detector rests on

The GPT read at 0d08404 asked for the upstream source of the corrected
detector's matching. The test and the decision record now cite the Python 3.13
documentation (the tests ran on 3.13.16): the complemented set and the negative
lookahead in re's syntax, re.MULTILINE's line-start ^, and str.split()'s
whitespace collapsing. The splice result is labelled as the coordinator's
external measurement.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Fill the keys first, in order, and record each run's tokens

The owner's direction of 2026-10-10 (about 14:19Z, relayed by the command
center) replaces single-key mode with fill-first. The default order is api-4,
api-5, anthropic-api, api-2, then api-6 to api-10. anthropic-api-3 is CI
review's (the main-only claude-review environment secret) and is no longer
listed.

The worker stays on a key until Anthropic reports it out of credit (402, or
400 credit too low) or revoked (401), and never round-robins, since prompt
caches never cross organizations (anthropics/skills@dbd4588f
skills/claude-api/shared/prompt-caching.md:130). A slot the credential runner
refuses (--check) is skipped before any debit. Each move writes a switch row
(the harness's schema) and a warning journal line. Each settle records
per-model tokens and the run's cache hit rate (prompt-caching.md:186-192).
The attempt record keys off the run's first debit, not the first key's index.

The probes' O6 requires the first key, and reports later slots as O6i (info).
Five new tests fail on the previous worker; 91 tests pass, and the offline
probes pass with the default order (16 PASS, 8 INFO).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Put anthropic-api-3 second in the fill-first order, and label each close

The owner's direction of about 15:12Z (relayed by the command center): the
order is api-4, api-3, api-5, anthropic-api, api-2, then api-6 to api-10.
anthropic-api-3 serves CI review first and local quality work second. Each
settle and void row carries a human use_case read from its debit ("PR review
nas#953", "review-worker probe (facts-control)").

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Correct the worker's text that #981 made false

#981 (8bffa2c) removed the in-GitHub Claude workflows. The worker's
README, comments and decision record still described claude-pr-review.yml
as live or as an optional cloud path; each reference now says it was
removed by #981, and the record's overturn condition names an owner
decision to bring a cloud review back instead of the federation fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Answer the CC's micro at a3881b1, with the owner's key order and caching

- B3: fake_boundary and the no-node case put a stand-in socat on their
  own search path, so the boundary tests pass on a runner without socat
  (ubuntu-24.04 has none; validate-shard-0 failed on it).
- B4: when credential_run.py --check refuses every key, the run is
  key_check_refused: one error status per head saying so, an uncounted,
  non-final attempt, no ledger row, and no claim about credit. Before,
  each tick posted "every configured key is out of credit" again. When
  some keys were skipped and the rest refused, the status now says
  "every usable key"; a mix of credit and revoked refusals says both.
  The co-op's GPT read at 1a610ba reproduced the same defect (a loop
  that only skips still ends in its else suite: CPython 3.13.16
  Doc/reference/compound_stmts.rst:165, :173); the CC ruled it into
  this commit. Two regressions: two ticks with every slot refused give
  one uncounted attempt and one non-credit status; a key usable on a
  later tick reviews the head as usual.
- B2: the record says no hosted run had succeeded (run 37988961127 ran
  on main on 2026-10-09 and failed).
- B5: the record counts the module's tests (94 at this commit).
- The gh-login comment is back on self.login (a P3 of both reads).
- Owner direction of 2026-10-11 ~22:33Z (via the CC): the default key
  order is api-4, api-3, api-2, api-5, anthropic-api, api-6 to api-10.
- Prompt caching (CC): the prompt puts its stable part (rules, task,
  upstream rule, answer shape) first and the pull request's line and
  citation counts last (anthropics/skills@dbd4588f prompt-caching.md:7,
  :27), and the settings set promptCacheTtl "1h" (anthropics/claude-code
  CHANGELOG.md:2970, 2.1.243); subagents keep the default.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

… spare

The command center's ruling of 2026-10-12 (20:34Z): the owner's
fill-first order exists to fill distinct credit pools first, and
anthropic-api-6 holds a second key of anthropic-api-5's account, so it
caps exactly when anthropic-api-5 caps. It leaves the order and stays in
the inventory as anthropic-api-5's spare, used only to replace that key.

- The review worker's DEFAULT_KEYS drops anthropic-api-6; the test that
  pins the order fails on main's worker.
- The inventory's anthropic-api-6 label and notes say it is a spare of
  anthropic-api-5's account (the command center's key-practice record,
  table row anthropic-api-6), and docs/secret-storage.md's table row
  follows the label.
- docs/secret-storage.md item 10 now states the current order:
  anthropic-api-4, -3, -2, -5, anthropic-api, then -7 to -10. That
  includes the owner's 2026-10-11 move of anthropic-api-2 to third (the
  command center's 10-11 ruling, which the worker already followed but
  the page did not), and that anthropic-api-3 serves local work only
  since #981.
- The key-slots decision's follow-up section and the review-worker
  record say the same; the 2026-10-10 decision text stays as history
  with a pointer.

Five dispositions locators into docs/secret-storage.md move by two more
lines; the files are re-registered.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The command center's read of #969 at 28c99ca passed with three quality
notes. The commit that answered them (ea7f3638, 2026-10-10) stayed on a
local follow-up branch and never reached the merged PR. This is that
commit, ported to current main:

- anthropic-api-6 holds a second key of anthropic-api-5's account, so it
  adds no credit; the slot table and the next-key step say so (next:
  anthropic-api-7, from a new account). Checked 2026-10-12 with
  credential_run.py --check: anthropic-api-6 stored, anthropic-api-7
  missing.
- anthropic_key_health.py reports a 429 that carries retry-after as
  rate_limited and exits 0 for it, so a daily timer does not alarm on
  throttling. A 429 without retry-after is the tier's spend cap
  (Anthropic's errors and rate-limits pages: no retry-after, usage paused
  until the next month), reported as spend_capped, and it fails, as do
  every other non-2xx answer and main's probe_failed. Only the header's
  presence is kept. The tests fail on main's tool (3 failures, 1 error).

The third note, a planned CI fallback to anthropic-api-4, lapsed when
Claude review inside GitHub was retired (#981); the record says so. The
decision cites the command center's refreshed key-practice record
(sha256 ee25fc91..., unchanged). Five dispositions locators into
docs/secret-storage.md move by five lines; the files are re-registered.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… spare

The command center's ruling of 2026-10-12 (20:34Z): the owner's
fill-first order exists to fill distinct credit pools first, and
anthropic-api-6 holds a second key of anthropic-api-5's account, so it
caps exactly when anthropic-api-5 caps. It leaves the order and stays in
the inventory as anthropic-api-5's spare, used only to replace that key.

- The review worker's DEFAULT_KEYS drops anthropic-api-6; the test that
  pins the order fails on main's worker.
- The inventory's anthropic-api-6 label and notes say it is a spare of
  anthropic-api-5's account (the command center's key-practice record,
  table row anthropic-api-6), and docs/secret-storage.md's table row
  follows the label.
- docs/secret-storage.md item 10 now states the current order:
  anthropic-api-4, -3, -2, -5, anthropic-api, then -7 to -10. That
  includes the owner's 2026-10-11 move of anthropic-api-2 to third (the
  command center's 10-11 ruling, which the worker already followed but
  the page did not), and that anthropic-api-3 serves local work only
  since #981.
- The key-slots decision's follow-up section and the review-worker
  record say the same; the 2026-10-10 decision text stays as history
  with a pointer.

Five dispositions locators into docs/secret-storage.md move by two more
lines; the files are re-registered.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…te records by name only

Fix round 1 of #1050, after Astra's first read at 116ebd9 and the command center's requests of 2026-10-12.

- anthropic-api-7 holds the owner's Max-plan API credit (a personal key scoped to one workspace, read valid by
  the command center at 23:28:51Z), so it fills first: 7, 4, 3, 2, 5, anthropic-api, then 8 to 10. The worker's
  DEFAULT_KEYS, its README, the inventory notes, the slot table and both decision records say so; the
  organization's name and id are not recorded. The order test pins the new order and fails on the old worker.
- P1: the key-slot records no longer publish digests of private command-center records (the key-practice record,
  anthropic_key_health.sh, the 2026-10-11 ruling); they are cited by name. Each public-page digest is labelled a
  capture of a public page (the command center's ruling of 22:44Z). KeySlotRecordDigestTests fails on 116ebd9
  (13 sites in the decision record, 1 in secret-storage.md) and passes here.
- P3 #4: anthropic-api-3's purpose, rotation and the CI paragraphs say the claude-review environment is gone
  (#981; the repository's environment list, read 2026-10-12); the slot table gives each slot's place in the order.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>