Repository navigation
lanes: record trigger facts as pointers #7592
Description
Parent
Refs #7555. Source: PLAN Phase 24, topic poteto-review. Thread: Outer loop and communication
(buildable part).
Outcome
Every triggered lane frames outer-loop text as data under the untrusted-content convention and runs
under ADR 0049's limits, and the trigger facts are recorded as pointers with as-of date and recheck
trigger.
Decisions
- Untrusted outer-loop text is framed as data under the untrusted-content convention; triggered agents
run under ADR 0049 limits (Q577). Origin: ours. - Facts recorded: routines trigger on schedule, API and GitHub PR/release events; Slack is Claude Tag
(Team and Enterprise); cloud sessions carryccr.session.id(D46, D116). These go in as pointers,
not restated values. communicationis its own plugin, lowest priority, covering all personal written communication;
chat adapters live there as seeds conforming to the trigger-dispatch contract (D89, Q154, Q156;
owner's). Its details are the parked communication item.- Replies are drafts only, always reviewed before sending, easy to paste (Q142; owner's).
- Rejected: a convention with no plugin; trigger-dispatch owning the port; routines banned from write
work; silence as consent (D45). - Security review applies (untrusted text, lanes with push credentials).
Key interfaces
Variation verdicts: "Chat and communication providers: abstract now; communication seeds on the
trigger-dispatch contract (Q156, D89); details deferred." Conventions followed: ADR 0049, the
untrusted-content convention.
Done when
-
rg --files-without-match 'untrusted' .github/workflows/intake-triage.yml .github/workflows/work-resolve-issue.yml
prints nothing, and each fixed entry point has a test showing an instruction in issue text is not
followed. - The trigger facts appear as pointers with as-of date and recheck trigger in the owning
convention.
Out of scope
- Building the
communicationplugin (parked item).
Related
- config-cascade: settings resolution and convention home #7571 Settings resolution and convention home (parent thread; no sequence edge, see the re-triage comment)
- bugs: frame scanned-repo and tracker text as untrusted data; author-check scan's lane cursor and dedupe #7394 frame scanned-repo and tracker text as untrusted data (sub-issue of this thread).
Activity
github-actions commentedon Oct 16, 2026
Proposed work class: work-class: scoped
Basis: automated intake triage; the lanes App applied this class.
Size: Medium
Complexity: Medium
Uncertainty: Knowable
Flags: none
Blocked by: none
I understood this as a bounded change with two parts. Add tests showing that an instruction in issue text is not followed at the entry points that frame it as untrusted. Add the Slack and cloud-session trigger facts as pointers, each with an as-of date and a recheck trigger. I found no likely duplicates.
#7592 (comment)
This decision settles the open questions.
Automated triage, applied by the lanes App.
kyle-sexton commentedon Oct 24, 2026
Released for re-triage under the owner's 2026-10-24 rule: an issue stops for a person only for an intent or vision question, a security call, a host or attended run, or spend outside prepaid credit. The hold label came off and intake triage runs again now; it re-applies a hold, with a numbered question, when one of those applies.
To hold this issue again, add
needs-human(orstatus: needs-decision) and say why in a comment.27 remaining items
kyle-sexton commentedon Oct 31, 2026
Decision recorded.
This supersedes the record above after
/discovery:research. Its verifier failed rows 4, 7 and 12: the exact redirect from the code.claude.com Claude Tag URL, one sitemap date, and restatement labels. The page quotes used here held at their links, so this record stops relying on that redirect and points at the docs page directly. It also adds one correction: the "Routine triggers" entry says GitHub triggers do not cover issues, but Supported events now lists Issue, which is that entry's own recheck trigger. The Slack page describes a separate earlier version, so the new pointer keeps the two products apart. Agents decided this on evidence under standing direction §1.Done when
plugins/autonomy/skills/setup/templates/trigger-adapters.mdhas a pointer to https://claude.com/docs/claude-tag/overview for Claude Tag and to https://code.claude.com/docs/en/slack for the earlier Claude Code in Slack version, as two products, with an as-of date and a recheck trigger, in the form of its "Routine triggers" entry.plugins/autonomy/skills/setup/context/agent-session-telemetry.mdhas a pointer to the "Attribute telemetry to cloud sessions" section of https://code.claude.com/docs/en/monitoring-usage forccr.session.id, with an as-of date and a recheck trigger.scripts/check-changelog-fragments.sh --checkpasses with an autonomy fragment.github-actions commentedon Oct 31, 2026
github-actions commentedon Oct 31, 2026