Add an on-demand, read-only pull request review by the Claude action - #894

The bounds step failed the job unless the result's num_turns was at most
the --max-turns value. On Claude Code 2.1.295 num_turns counts transcript
messages, tool results included: a local run with #894's prompt and
claude_args (api-actions LR, 2026-10-08) made 12 API requests under
--max-turns 12 and reported num_turns 57. The step now counts distinct
assistant message ids in the execution file and checks that count against
20; num_turns stays in the record and the job summary as "messages". The
test fixture emits two messages per turn id, as the client does, and a new
test passes a 20-turn run that reports 57 messages and fails a 21-turn one.
Three mutants (bound on num_turns, count forced to 0, count without
de-duplicating ids) each fail the tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The bounds step failed the job unless the result's num_turns was at most
the --max-turns value. On Claude Code 2.1.295 num_turns counts transcript
messages, tool results included: a local run with #894's prompt and
claude_args (api-actions LR, 2026-10-08) made 12 API requests under
--max-turns 12 and reported num_turns 57. The step now counts distinct
assistant message ids in the execution file and checks that count against
12; num_turns stays in the record and the job summary as "messages". The
test fixture emits two messages per turn id, as the client does, and a new
test passes a 12-turn run that reports 57 messages and fails a 13-turn one.
Three mutants (bound on num_turns, count forced to 0, count without
de-duplicating ids) each fail the tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The bounds step failed the job unless the result's num_turns was at most
the --max-turns value. On Claude Code 2.1.295 num_turns counts transcript
messages, tool results included: a local run with #894's prompt and
claude_args (api-actions LR, 2026-10-08) made 12 API requests under
--max-turns 12 and reported num_turns 57. The step now counts distinct
assistant message ids in the execution file and checks that count against
6; num_turns stays in the record and the job summary as "messages". The
test fixture emits two messages per turn id, as the client does, and a new
test passes a 6-turn run that reports 57 messages and fails a 7-turn one.
Three mutants (bound on num_turns, count forced to 0, count without
de-duplicating ids) each fail the tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ay is missing

In the local J8 run on #894 the coordinator hit --max-budget-usd 5
(error_max_budget_usd) after both agents had handed back their full
reports through SubagentHandback, so it never relayed them and the
workflow would have withheld two complete reviews. The numbers and
report steps now take the coordinator's relay when it carries both
sections, and otherwise assemble the reports from each agent's own
SubagentHandback message in the execution file (model-free); with
neither, the relay text stays. The usage record says which source was
used. All three J8 streams so far carry SubagentHandback calls.

Three new tests cover a coordinator that stopped before relaying, a
missing handback and a complete relay preferred to the handbacks (37
tests); three mutants of the fallback each fail them; actionlint and
zizmor report nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The command center approved a machine-readable trailer for the "defects
caught before a cue" ledger: each agent ends its report with one line,
J8-SUMMARY {"undeclared": <n>, "confidences": [...]}, so counts come
from the agents' own numbers and never from prose. The review itself is
unchanged. A test asserts the trailer in the prompt.

The sweep of the W4 drafts for the classes #894's pre-cue read found,
applied here: the empty paths array is expanded safely on bash before
4.4; a read step that succeeds without an execution file fails the
job; display_report and track_progress are asserted; the record states
that a public run's summary is public. 39 tests; actionlint and zizmor
report nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The sweep of the W4 drafts for the classes #894's pre-cue toolkit read
found, applied here: the empty paths array is expanded safely on bash
before 4.4; a review step that succeeds without an execution file fails
the job; display_report and track_progress are asserted; the record
states that a public run's summary is public and when a finding belongs
on the local route instead; ci-least-privilege lists the review job and
the flag workflow in its tables and names each exempt job (in place).
34 tests; actionlint and zizmor report nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The sweep of the W4 drafts for the classes #894's pre-cue toolkit read
found, applied here: an audit step that succeeds without an execution
file now fails the job instead of leaving it green with nothing checked;
display_report and track_progress are asserted; the record states that
a public run's summary is public. The workflow has no paths input, so
the bash 3.2 empty-array class does not apply. 22 tests; actionlint and
zizmor report nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The sweep of the W4 drafts for the classes #894's pre-cue toolkit read
found, applied here: when there were items to classify, a classify step
that succeeds without an execution file now fails the job (with no
items the step is skipped by design); show_full_output, display_report
and track_progress are asserted; the record states that a public run's
summary is public; ci-least-privilege lists both triage jobs in its
tables and names each exempt job (in place). The workflow has no paths
input, so the bash 3.2 empty-array class does not apply. 19 tests;
actionlint and zizmor report nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ding findings

The pre-cue toolkit read of 459777d left findings standing at df440f4:

- The record's link to the pull request review's record, and its receipt
  citation, now say that #894 (and #892) add those files and land first.
- The docs bullet names #894 as where the shared pin, federation, fence and
  bounds are defined.
- The binding step's unused id `bind` is removed; nothing referred to it.
- The record's by-name list now names what df440f4 added: the final
  execution-file step, the bash 3.2 expansion and the Visibility section.
  It also names this PR's edits outside the record.
- The test count, stale at 32, is 34.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The pre-cue toolkit read of 4d0a14d left six findings only partly fixed at
89d05dd, and the test count was stale again.

- The record now lists every flag difference between the fence receipt and
  this workflow's claude_args. The receipt's runs set claudeMdExcludes, so
  they do not show that --restricted alone keeps instruction files out, and
  native_proven is limited to the receipt's own flag set.
- The .git deny rules: a 2026-10-09 local subscription probe measured Read
  and Grep into .git as refused. Whether the empty Glob results come from the
  rules is pending a control run. Whether
  blockReadsOutsideWorkingDirectories binds Glob and Grep stays not
  established.
- The numbers step records the result's subtype through its name filter, in
  the usage record, the summary table and the failure message, so a
  turn-limit stop and a budget stop read apart. Two new tests; seven weakened
  copies are each caught.
- The by-name list now names the execution-file step 89d05dd added, and the
  other inputs and messages it had left out.
- The docs bullet adds the slug, first-attempt and owner-only guards. The
  record says why the triggering-actor clause stays.
- The source list adds action.yml's lines for track_progress,
  display_report and show_full_output.
- The test count is now 24.
- local-parity-receipt.json's LR entry gains its target pull request #897
  at 24821c5, its report's two blocking findings and the report's sha256.
  This is a marked 2026-10-09 amendment from the run's harness receipt, and
  #894's record cites it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

… the record stand alone

- R4: the guard binds the ACTIONS_STEP_DEBUG and ACTIONS_RUNNER_DEBUG
  secrets and variables as booleans, the secret first, and refuses either.
  A test pins both bindings, and six weakened copies each fail it.
- The publish step writes the review with `jq -j`, so a 60,000-byte review
  is no longer announced as cut. A boundary test covers it.
- From the J8 micro read of fbe30ad: the record and the docs bullet no
  longer rest on #894 being present.
  - They state the action pin, the federation variables, the fence flags
    and the bounds themselves.
  - They name the pull request review's record by plain path, not by link.
  - They cite receipt.json from this PR's own tree, a byte-identical copy of
    the one #892 and #894 add.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…g, and share the cost-factor wording

R6. The numbers step fails unless both called agents handed back (a
handback counts only under the coordinator's Agent call for that agent,
once per agent); relay headings no longer count anywhere (GPT designated
read of 7aa2c12, P2). The report step publishes the two handbacks,
pr-test-analyzer's then silent-failure-hunter's, and never the
coordinator's relay; the coordinator prompt no longer asks for a relay and
ends with one line, which saves its output tokens. Publishing is gated on
!cancelled() and the numbers step's success, as in the other W4 workflows.
The exact --settings pin compares canonical JSON, so 1 or 0 no longer
passes for true or false (J8 R5 micro of #894, N1). The record adopts the
shared cost-factor paragraph ($22 budget, $24.20 bound) and declares the
eight R5 changes the J8 R5 micro read found undeclared. 57 tests; 49 of 49
weakened copies fail a test.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…o 30 minutes

R7. With --max-turns removed in R6, the numbers step's bound of 30 assistant
turns is the turn limit. At the one measured pace of this shape (LR: 12 turns
in 512,670 ms, Opus 5.5 at max) 30 turns take about 21.4 minutes before
checkout and setup, so a 20-minute job timeout would cancel a run inside the
approved bounds before execution_file exists. A new test pins 30, and a
weakened copy setting it back to 20 fails it; #892 and #894 use 30.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ay is missing

In the local J8 run on #894 the coordinator hit --max-budget-usd 5
(error_max_budget_usd) after both agents had handed back their full
reports through SubagentHandback, so it never relayed them and the
workflow would have withheld two complete reviews. The numbers and
report steps now take the coordinator's relay when it carries both
sections, and otherwise assemble the reports from each agent's own
SubagentHandback message in the execution file (model-free); with
neither, the relay text stays. The usage record says which source was
used. All three J8 streams so far carry SubagentHandback calls.

Three new tests cover a coordinator that stopped before relaying, a
missing handback and a complete relay preferred to the handbacks (37
tests); three mutants of the fallback each fail them; actionlint and
zizmor report nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The command center approved a machine-readable trailer for the "defects
caught before a cue" ledger: each agent ends its report with one line,
J8-SUMMARY {"undeclared": <n>, "confidences": [...]}, so counts come
from the agents' own numbers and never from prose. The review itself is
unchanged. A test asserts the trailer in the prompt.

The sweep of the W4 drafts for the classes #894's pre-cue read found,
applied here: the empty paths array is expanded safely on bash before
4.4; a read step that succeeds without an execution file fails the
job; display_report and track_progress are asserted; the record states
that a public run's summary is public. 39 tests; actionlint and zizmor
report nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…g, and share the cost-factor wording

R6. The numbers step fails unless both called agents handed back (a
handback counts only under the coordinator's Agent call for that agent,
once per agent); relay headings no longer count anywhere (GPT designated
read of 7aa2c12, P2). The report step publishes the two handbacks,
pr-test-analyzer's then silent-failure-hunter's, and never the
coordinator's relay; the coordinator prompt no longer asks for a relay and
ends with one line, which saves its output tokens. Publishing is gated on
!cancelled() and the numbers step's success, as in the other W4 workflows.
The exact --settings pin compares canonical JSON, so 1 or 0 no longer
passes for true or false (J8 R5 micro of #894, N1). The record adopts the
shared cost-factor paragraph ($22 budget, $24.20 bound) and declares the
eight R5 changes the J8 R5 micro read found undeclared. 57 tests; 49 of 49
weakened copies fail a test.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ay is missing

In the local J8 run on #894 the coordinator hit --max-budget-usd 5
(error_max_budget_usd) after both agents had handed back their full
reports through SubagentHandback, so it never relayed them and the
workflow would have withheld two complete reviews. The numbers and
report steps now take the coordinator's relay when it carries both
sections, and otherwise assemble the reports from each agent's own
SubagentHandback message in the execution file (model-free); with
neither, the relay text stays. The usage record says which source was
used. All three J8 streams so far carry SubagentHandback calls.

Three new tests cover a coordinator that stopped before relaying, a
missing handback and a complete relay preferred to the handbacks (37
tests); three mutants of the fallback each fail them; actionlint and
zizmor report nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The command center approved a machine-readable trailer for the "defects
caught before a cue" ledger: each agent ends its report with one line,
J8-SUMMARY {"undeclared": <n>, "confidences": [...]}, so counts come
from the agents' own numbers and never from prose. The review itself is
unchanged. A test asserts the trailer in the prompt.

The sweep of the W4 drafts for the classes #894's pre-cue read found,
applied here: the empty paths array is expanded safely on bash before
4.4; a read step that succeeds without an execution file fails the
job; display_report and track_progress are asserted; the record states
that a public run's summary is public. 39 tests; actionlint and zizmor
report nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…g, and share the cost-factor wording

R6. The numbers step fails unless both called agents handed back (a
handback counts only under the coordinator's Agent call for that agent,
once per agent); relay headings no longer count anywhere (GPT designated
read of 7aa2c12, P2). The report step publishes the two handbacks,
pr-test-analyzer's then silent-failure-hunter's, and never the
coordinator's relay; the coordinator prompt no longer asks for a relay and
ends with one line, which saves its output tokens. Publishing is gated on
!cancelled() and the numbers step's success, as in the other W4 workflows.
The exact --settings pin compares canonical JSON, so 1 or 0 no longer
passes for true or false (J8 R5 micro of #894, N1). The record adopts the
shared cost-factor paragraph ($22 budget, $24.20 bound) and declares the
eight R5 changes the J8 R5 micro read found undeclared. 57 tests; 49 of 49
weakened copies fail a test.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…#909)

* Add a pre-cue read by Anthropic's pr-review-toolkit agents in Actions

claude-pr-toolkit-review.yml runs pr-test-analyzer and
silent-failure-hunter from anthropics/claude-code's pr-review-toolkit
plugin on one pull request head, through claude-code-action v1.0.247.
Both agents list every behaviour and test change the description does
not declare, with a confidence on every finding. It is the command
center's J8 pre-cue step (W4 draft f), the same agents and settings that
found six undeclared changes in #892 and two verifier defects in #900.

The toolkit is checked out at anthropics/claude-code@602df92b, sparse to
its plugin directory, moved outside the workspace, verified file by file
against recorded SHA-256 values (git blob ids matched GitHub's at the
pin), and loaded with --plugin-dir; the action's plugins and
plugin_marketplaces inputs install unpinned code at run time and are
not used. Sonnet 5.5 at max effort; Read, Glob, Grep and the Agent tool;
CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0 so background agents are awaited;
a $5 budget; a review time limit of 20 or 35 minutes by diff size.

The bounds step counts the coordinator's own turns only, allows the
budget plus a $2 allowance for the agents' last requests, requires both
reports, uses an allow-list and names every unmet bound. Dispatch only,
owner only, first attempt only, gated by CLAUDE_PR_TOOLKIT_ENABLED; no
write scope beyond the OIDC token; nothing is posted to the pull request.

34 tests run the steps as written (without PyYAML too); eight weakened
copies each fail them; actionlint and zizmor (pedantic) report nothing.
openai/codex-action is recorded as WATCH with its pin and overturn
condition.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Publish the toolkit agents' reports from their handbacks when the relay is missing

In the local J8 run on #894 the coordinator hit --max-budget-usd 5
(error_max_budget_usd) after both agents had handed back their full
reports through SubagentHandback, so it never relayed them and the
workflow would have withheld two complete reviews. The numbers and
report steps now take the coordinator's relay when it carries both
sections, and otherwise assemble the reports from each agent's own
SubagentHandback message in the execution file (model-free); with
neither, the relay text stays. The usage record says which source was
used. All three J8 streams so far carry SubagentHandback calls.

Three new tests cover a coordinator that stopped before relaying, a
missing handback and a complete relay preferred to the handbacks (37
tests); three mutants of the fallback each fail them; actionlint and
zizmor report nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Add the J8-SUMMARY trailer and the sweep fixes to the toolkit read

The command center approved a machine-readable trailer for the "defects
caught before a cue" ledger: each agent ends its report with one line,
J8-SUMMARY {"undeclared": <n>, "confidences": [...]}, so counts come
from the agents' own numbers and never from prose. The review itself is
unchanged. A test asserts the trailer in the prompt.

The sweep of the W4 drafts for the classes #894's pre-cue read found,
applied here: the empty paths array is expanded safely on bash before
4.4; a read step that succeeds without an execution file fails the
job; display_report and track_progress are asserted; the record states
that a public run's summary is public. 39 tests; actionlint and zizmor
report nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Bind repository debug settings in the guard and fix the cap notice

- R4, from the cc-native-practice lane's L3 read against claude-code-action
  v1.0.247 practice: the guard binds the ACTIONS_STEP_DEBUG and
  ACTIONS_RUNNER_DEBUG secrets and variables as booleans, the secret first,
  and refuses either. A test pins both bindings, and six weakened copies
  each fail it.
- The publish step writes the reports with `jq -j`, so a 60,000-byte report
  is no longer announced as cut, as the J8 micro read of #892 found for the
  same step. A boundary test covers it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Run the toolkit review on Opus with a $22 budget, check every result record and remove links from the head

R5, quality and correctness only. The coordinator moves to Opus 5.5 at max
with a $22 client budget; the cost bound is the budget times the measured
overrun factor 1.10 ($24.20), re-derived after the first three runs. The
numbers step reads every result record: each must be a success, or a budget
stop after both agents handed back, and a budget stop at or under the bound
publishes both reports. Publishing is gated on the numbers step's outcome.
The coordinator must call both toolkit agents and no other (retries
allowed), replayed on three J8 streams. A tool-list entry that is not a
string is a forbidden tool. A model-free step removes symbolic links from
the pull request head right after its checkout (GPT designated read of
b80a6eb, P2). New tests pin claude_args and --settings exactly; the module
goes from 41 to 56 tests. The record names every change and states that the
hosted file ends at the first result record, so a run whose agents have not
handed back by then fails closed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Publish only the agents' own handbacks, require both before publishing, and share the cost-factor wording

R6. The numbers step fails unless both called agents handed back (a
handback counts only under the coordinator's Agent call for that agent,
once per agent); relay headings no longer count anywhere (GPT designated
read of 7aa2c12, P2). The report step publishes the two handbacks,
pr-test-analyzer's then silent-failure-hunter's, and never the
coordinator's relay; the coordinator prompt no longer asks for a relay and
ends with one line, which saves its output tokens. Publishing is gated on
!cancelled() and the numbers step's success, as in the other W4 workflows.
The exact --settings pin compares canonical JSON, so 1 or 0 no longer
passes for true or false (J8 R5 micro of #894, N1). The record adopts the
shared cost-factor paragraph ($22 budget, $24.20 bound) and declares the
eight R5 changes the J8 R5 micro read found undeclared. 57 tests; 49 of 49
weakened copies fail a test.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>

The bounds step failed the job unless the result's num_turns was at most
the --max-turns value. On Claude Code 2.1.295 num_turns counts transcript
messages, tool results included: a local run with #894's prompt and
claude_args (api-actions LR, 2026-10-08) made 12 API requests under
--max-turns 12 and reported num_turns 57. The step now counts distinct
assistant message ids in the execution file and checks that count against
20; num_turns stays in the record and the job summary as "messages". The
test fixture emits two messages per turn id, as the client does, and a new
test passes a 20-turn run that reports 57 messages and fails a 21-turn one.
Three mutants (bound on num_turns, count forced to 0, count without
de-duplicating ids) each fail the tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The sweep of the W4 drafts for the classes #894's pre-cue toolkit read
found, applied here: an audit step that succeeds without an execution
file now fails the job instead of leaving it green with nothing checked;
display_report and track_progress are asserted; the record states that
a public run's summary is public. The workflow has no paths input, so
the bash 3.2 empty-array class does not apply. 22 tests; actionlint and
zizmor report nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The pre-cue toolkit read of 4d0a14d left six findings only partly fixed at
89d05dd, and the test count was stale again.

- The record now lists every flag difference between the fence receipt and
  this workflow's claude_args. The receipt's runs set claudeMdExcludes, so
  they do not show that --restricted alone keeps instruction files out, and
  native_proven is limited to the receipt's own flag set.
- The .git deny rules: a 2026-10-09 local subscription probe measured Read
  and Grep into .git as refused. Whether the empty Glob results come from the
  rules is pending a control run. Whether
  blockReadsOutsideWorkingDirectories binds Glob and Grep stays not
  established.
- The numbers step records the result's subtype through its name filter, in
  the usage record, the summary table and the failure message, so a
  turn-limit stop and a budget stop read apart. Two new tests; seven weakened
  copies are each caught.
- The by-name list now names the execution-file step 89d05dd added, and the
  other inputs and messages it had left out.
- The docs bullet adds the slug, first-attempt and owner-only guards. The
  record says why the triggering-actor clause stays.
- The source list adds action.yml's lines for track_progress,
  display_report and show_full_output.
- The test count is now 24.
- local-parity-receipt.json's LR entry gains its target pull request #897
  at 24821c5, its report's two blocking findings and the report's sha256.
  This is a marked 2026-10-09 amendment from the run's harness receipt, and
  #894's record cites it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

)

* Bound the harness audit and move it to claude-code-action v1.0.247

The audit job ran with 60 turns, no budget, a `gh issue create` shell tool and
`issues: write`. It now gets Read, Glob and Grep, 20 turns and a $3 client
budget, holds only `contents: read` and `id-token: write`, and runs only while
CLAUDE_HARNESS_AUDIT_ENABLED is 'true'. A model-free step keeps the run's token
and cost numbers and fails the job when a bound or the cache-read check is
unmet; a second copies the report to the job summary, escaped and capped.

The pin moves from v1.0.245 to v1.0.247 (two one-commit releases that bump the
bundled Claude Code to 2.1.295). Federation stays the only authentication.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Harden the bounded audit after an independent workflow audit

Claude Code now runs under --restricted with --permission-prompts none, and
the deny rules travel in --settings, because --restricted ignores the settings
file the action's `settings` input writes. The job runs on a first attempt
only (a re-run would spend again), for the owner as actor and triggering
actor. The numbers step also reads the session's own tool list and fails on a
shell, write, web, subagent or MCP tool, writes its record atomically and
replaces names that are not plain identifiers. Step debugging is pinned off in
the action step's environment.

The flag set was run on the installed 2.1.295 client against a planted tree;
the receipt is under evidence/artifacts.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Set the harness audit's effort level explicitly

The audit job now passes `--effort max` in claude_args. Under the command
center's effort mapping of 2026-10-08, judgment work (designated reads,
adjudication, pull request and security reviews, audits) runs at `max`, and
every job records its level and the reason. The level has to be in
claude_args because `--restricted` ignores the settings files that would
otherwise carry it, and Opus 5.5 runs at `medium` on the API when a request
leaves effort unset. A loopback dry run of the installed 2.1.295 client with
this workflow's claude_args sent `output_config.effort: "max"` on every
request. The bounds test now requires the flag (removing it fails the test).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Bound the harness audit's turns by assistant turns, not num_turns

The bounds step failed the job unless the result's num_turns was at most
the --max-turns value. On Claude Code 2.1.295 num_turns counts transcript
messages, tool results included: a local run with #894's prompt and
claude_args (api-actions LR, 2026-10-08) made 12 API requests under
--max-turns 12 and reported num_turns 57. The step now counts distinct
assistant message ids in the execution file and checks that count against
20; num_turns stays in the record and the job summary as "messages". The
test fixture emits two messages per turn id, as the client does, and a new
test passes a 20-turn run that reports 57 messages and fails a 21-turn one.
Three mutants (bound on num_turns, count forced to 0, count without
de-duplicating ids) each fail the tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Fix the harness audit's bounds and declare every change it makes

A pre-cue read by Anthropic's pr-review-toolkit agents (J8, on 4d0a14d)
found gaps in this PR; this commit fixes them.

Bounds step: the tool check is an allow-list (any tool outside Read,
Glob and Grep fails, not only the nine named ones); a session start
record without its tool or MCP lists fails instead of passing as empty;
a run without result text fails; and the step names every bound it finds
unmet instead of a bare exit 1. The report step takes the last non-empty
result, cuts on a character boundary (iconv -c, whose exit 1 for a cut
character no longer fails the step) and says when the report was cut.

Tests: the step tests read the workflow with the policy test's own
loader when PyYAML is absent, so they no longer skip; new tests cover an
unknown tool, a start record without lists, an empty result, the named
failures, the character-safe cap and its notice, and the last non-empty
result (21 tests).

Record: every behaviour change against main is named (timeout 45 to
30, the slug, first-attempt, variable and owner-only guards, the guard
step's exit 2, the display name and prompt, no issue, the two explicit
action inputs verified in the pinned action.yml, the usage artifact);
the fence receipt's flags are stated instead of "the same flag set"; the
cooldown waiver of 2026-10-03 is cited; and a numbers-only receipt of
local runs of this workflow's own prompt and claude_args at max effort
(10 of 20 turns, about $2.03 of $3) and of the num_turns measurement is
added. ci-least-privilege's stale issues-write lines are fixed in place.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Apply the pre-cue read's fix classes to the harness audit

The sweep of the W4 drafts for the classes #894's pre-cue toolkit read
found, applied here: an audit step that succeeds without an execution
file now fails the job instead of leaving it green with nothing checked;
display_report and track_progress are asserted; the record states that
a public run's summary is public. The workflow has no paths input, so
the bash 3.2 empty-array class does not apply. 22 tests; actionlint and
zizmor report nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Close the harness audit's partly fixed pre-cue findings

The pre-cue toolkit read of 4d0a14d left six findings only partly fixed at
89d05dd, and the test count was stale again.

- The record now lists every flag difference between the fence receipt and
  this workflow's claude_args. The receipt's runs set claudeMdExcludes, so
  they do not show that --restricted alone keeps instruction files out, and
  native_proven is limited to the receipt's own flag set.
- The .git deny rules: a 2026-10-09 local subscription probe measured Read
  and Grep into .git as refused. Whether the empty Glob results come from the
  rules is pending a control run. Whether
  blockReadsOutsideWorkingDirectories binds Glob and Grep stays not
  established.
- The numbers step records the result's subtype through its name filter, in
  the usage record, the summary table and the failure message, so a
  turn-limit stop and a budget stop read apart. Two new tests; seven weakened
  copies are each caught.
- The by-name list now names the execution-file step 89d05dd added, and the
  other inputs and messages it had left out.
- The docs bullet adds the slug, first-attempt and owner-only guards. The
  record says why the triggering-actor clause stays.
- The source list adds action.yml's lines for track_progress,
  display_report and show_full_output.
- The test count is now 24.
- local-parity-receipt.json's LR entry gains its target pull request #897
  at 24821c5, its report's two blocking findings and the report's sha256.
  This is a marked 2026-10-09 amendment from the run's harness receipt, and
  #894's record cites it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Record that the deny rules bind Glob and Grep, measured against a control

A control run of the 2026-10-09 probe, with the same fence flags and the
deny rules removed, lists the .git files, finds both markers, returns the
.env marker through Grep, and reads every marker. With the rules, the same
calls returned nothing or were refused. So the empty Glob and Grep results
come from the deny rules, not from the tools skipping hidden paths. The
record now shows probe against control step by step, and the bounds table
and evidence classes say so.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Bind repository debug settings in the guard, fix the cap notice, keep the probe receipt

- R4, from the cc-native-practice lane's L3 read against claude-code-action
  v1.0.247 practice: the guard binds
  (secrets.ACTIONS_STEP_DEBUG || vars.ACTIONS_STEP_DEBUG) == 'true' and the
  same for ACTIONS_RUNNER_DEBUG. Only a boolean reaches the shell, and the
  guard refuses either setting. A test pins both bindings, and six weakened
  copies each fail it.
- From the J8 micro read of 61494a3: the publish step wrote the report with
  `jq -r`, which adds a newline, so a 60,000-byte report was announced as
  cut. It now uses `jq -j`, and a boundary test covers exactly 60,000 and
  60,001 bytes. The step comment now says it publishes the last non-empty
  result.
- The deny-rule probe and its control are kept as deny-probe-receipt.json:
  flags, client, model and authentication, every call and its outcome, and
  each stream's sha256.
- The record states that the workflow is unchanged from e48de2e to the
  merge base aba02ec, and no longer says the documentation exceeds the runs
  for the deny-rule question.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Refuse non-string tool entries, pin the client flags exactly and raise the audit budget to $5

R5, quality and correctness only. The numbers step counts every tool-list
entry that is not a string as a forbidden tool, named "non-string tool
entry", instead of dropping it (GPT designated read of #895, P2). A new
test pins the whole claude_args list and the whole --settings JSON. The
client budget moves from $3 to $5 with the turn limit at 20, from the
command center's measurement-based caps: the one measured run used 10
turns and $2.03. The shape tests now read the workflow with the policy
test's strict loader, so none skips without PyYAML. The record gains a
dated R5 section, the cap derivation, the shared agent-mode origin-URL
sentence and the follow-ups line, and withdraws the earlier dry estimate.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Bound the audit's cost at the budget times 1.10, publish within-bound budget stops, and drop --max-turns

R6. The cost bound becomes the budget times the measured overrun factor 1.10
($5.50); a budget stop at or under it publishes and is named, and the
publish step runs on the bounds step's own outcome because the action
fails its step on any budget stop. --max-turns 20 leaves claude_args:
the pinned action fails a success whose num_turns exceeds it, and on
Claude Code 2.1.295 num_turns counts transcript messages (57 for 12
requests); the bounds step's check of 1 to 20 assistant turns stays. The
exact --settings pin compares canonical JSON, so 1 no longer passes for
true. The record gains the shared cost paragraph and an upstream-issue
draft (not filed).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Fix the harness audit's J8 R5-R6 findings: exemption scope, budget-stop note, stale turn text

The budget-stop exemption is tested to waive only the success and result-text checks (a stop that breaks any other
bound fails, named). The budget-stop note moves to the publish step, so it is written only once every bound passed.
Record and workflow comments no longer describe a client turn limit or an error_max_turns stop. N5-N9 are
dispositioned in the record's R7 section.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Pin the harness audit's action inputs and budget-stop floor that R7 claimed were held

The GPT read of 0cf13fc found R7's N8/N9 disposition overstated the tests. The action step's complete input set is
now compared, and budget stops at $0.01, $1 and $4.99 must pass, so an added input or a cost floor fails. The record
corrects the disposition.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Add the R8 source resolution for the harness audit's input-set and budget-floor pins

The record names the pinned upstream sources the two R8 tests rely on (the action's input declarations at 2dca132f,
the Agent SDK 0.3.295 result type, Python 3.13 unittest assertEqual and subTest), states that the 10-input set and the
absent cost floor are this repository's acceptance policy over an unchanged workflow, and labels the mutation results
synthetic.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Publish a budget-stopped audit's written text and keep instruction files out of the audit session

R10, the two Codex P2 threads at b41b969:
- harness-audit.yml:231: after a budget stop without result text, the bounds and publish steps use the text the
  model wrote until then, as claude-pr-review.yml does; every other subtype still gets result text only.
- harness-audit.yml:125: the audit step sets CLAUDE_CODE_DISABLE_CLAUDE_MDS=1 (documented); a measured 2.1.295
  probe shows project, imported, rules and nested instruction files load only without both --restricted and
  --setting-sources user, and not at all with the switch.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>