[melodic-automation-lanes]

Closes #11873

Summary

Opened by the work-resolve-issue lane. The run's own summary:

The tracker seam now bundles only the github and local-markdown adapters. jira, gitea and linear moved to tools/work-item-tracker/seeds/, and the new seed-copy.sh copies one into <repo root>/tools/work-item-tracker/adapters/<provider>/ with a .seed-hash record. On a re-run it fast-forwards an untouched copy, and for an edited copy (or one with no record) it prints the diff, writes nothing and exits 1. /work-items:setup apply runs the copy for a seeded provider, and the dispatcher exits 3 pointing at setup when a seeded provider has no copy. Choices made on evidence: the hash record is a .seed-hash file inside the copy (the issue rules out a version header, and the manifest's schema_version handshake still covers versions). The copy leaves out the seed's *.test.sh, mock.sh and linear's schema-check/, because they need the plugin's test helpers and conformance bindings. The jira seed now sources WIT_SEAM_LIB_DIR as gitea and linear already did, so a copy runs outside the plugin. The bump is major because an existing jira, gitea or linear binding stops dispatching until setup apply copies the seed.

The run went past its turn budget (turns=150 max-turns=113): the work may be too big for one run.

Not verified

• The shell test suites (seed-copy.test.sh, work-item-tracker.test.sh, generate-adapter.test.sh, the moved seed tests, conformance/bindings/jira.test.sh) were not run here: this lane has no test-runner wrapper. Left to the PR's CI (scripts/run-test-file.sh).
• The issue's done-when commands python3 plugins/evals/skills/validate/scripts/validate-cases.py plugins/work-items/evals and bash plugins/skill-quality/scripts/check-skill.sh plugins/work-items/skills have no wrapper in this lane and were not run. check-affected skipped its changed-skills step as
• tidy skipped: the change is 87 files and spans plugins/work-items, scripts/ and .changes, over the 10-file, 300-line and 1-area cutoffs, and it touches the shared path scripts/
• Docs not updated: docs/test-wall-clock-baseline.md is a dated timing snapshot and still lists the old adapters/ test paths. The onboard-adapter README.md.tmpl and the gitea/linear seed READMEs still say the skeleton tracks 'the bundled jira adapter', and still give in-plugin test commands that a con
• A fast-forward does not keep a consumer's chmod changes, since file modes are not hashed. A copy checked out with core.autocrlf reports 'edited' every time. Both cases fail safe.
• review-venue.txt was absent, so the review ran locally in one subagent, not in the CI code-review lane

Fix

• plugins/work-items/tools/work-item-tracker/adapters/{jira,gitea,linear}/ -> seeds/{jira,gitea,linear}/: moved with git mv
• plugins/work-items/tools/work-item-tracker/seeds/README.md: new; what a seed is, what the copy leaves out, and the re-run outcome table
• plugins/work-items/tools/work-item-tracker/seed-copy.sh: new copy script with the content-hash fast-forward and the edited-copy diff stop; staging and a backup swap so a failed move never loses the existing copy
• plugins/work-items/tools/work-item-tracker/seed-copy.test.sh: new test covering first copy, up-to-date, fast-forward, edited copy stops with a diff, an added file, a missing hash record, the real jira seed dispatching from its copy, and the dispatcher's exit 3 with no copy
• plugins/work-items/tools/work-item-tracker/work-item-tracker.sh: exit 3 naming /work-items:setup apply when the bound provider has a seed but no copy
• plugins/work-items/tools/work-item-tracker/seeds/jira/common.sh: sources seam libs from WIT_SEAM_LIB_DIR, falling back to ../../lib
• plugins/work-items/tools/work-item-tracker/seeds/{jira,gitea,linear}/list-items.test.sh: test-scope headers point at seeds/
• plugins/work-items/tools/work-item-tracker/seeds/linear/schema-check/README.md: path updated to seeds/
• plugins/work-items/tools/work-item-tracker/CONTRACT.md: Adapter resolution names the two bundled adapters and adds the Seeds rule; conformance notes how to run a seed; gitea README path; 'bundled adapter and seed' wording
• plugins/work-items/tools/work-item-tracker/conformance/bindings/jira.test.sh: exports WIT_ADAPTERS_DIR to seeds/ and updates test-scope
• plugins/work-items/tools/work-item-tracker/work-item-tracker.test.sh: branch-grammar loop also covers seeds/*/capabilities.json
• plugins/work-items/skills/onboard-adapter/scripts/generate-adapter.test.sh: verb-drift loop also covers seeds/*/capabilities.json and adapter-spec.json
• plugins/work-items/README.md: requirements and skills table say github and local-markdown are bundled and jira, gitea and linear are seeds setup copies
• plugins/work-items/skills/setup/SKILL.md: Provider binding names the bundled pair and the seeds; step 4 runs seed-copy.sh for a seeded provider, whether the binding was just written or kept, and handles each outcome
• plugins/work-items/skills/setup/reference/check.md: a seeded provider passes the binding probe only when its consumer-local copy exists
• plugins/work-items/skills/setup/reference/providers.md: bundled vs seed paths and README locations
• plugins/work-items/skills/onboard-adapter/SKILL.md, reference/live-exploration.md, reference/adapter-spec.md: 'jira seed' wording; the description says 'Shipped providers'
• plugins/work-items/skills/onboard-adapter/evals/evals.json: case 5 expectations name jira as a shipped seed
• plugins/work-items/evals/oa-bundled-provider-routes-to-setup/case.yaml and samples/says-bundled.json: the grader accepts 'ships as a seed' wording, with a pass sample for it
• scripts/suite-seconds.txt, scripts/affected-tests-no-suite.txt, scripts/em-dash-purged-paths.txt: moved paths re-sorted under seeds/, plus the new test

Verification

The runner ran each check from the base copy against 637b983:

• scripts/check-changelog-fragments.sh --check: passed

The run reports:

• check-changelog-fragments: all 108 fragments valid (run before and after the review fixes)
• check-affected: 12 passed, 6 skipped over 87 changed files; the first run caught shellcheck SC2329 in seed-copy.sh, which I fixed
• check-evals-quality plugins/work-items/skills/onboard-adapter/evals/evals.json: PASS with one warning about case 4, which this change does not touch
• fresh-context subagent review of the whole diff: it traced every seed-copy.test.sh assertion against the script and found them consistent; I fixed its findings on error handling, check.md, the kept-binding copy path and the two test globs
• The lane run: https://github.com/melodic-software/claude-code-plugins/actions/runs/41303613656

Left out: the items under Not verified.

Related

#11873

[github-actions]

claude-security-review reviewed 637b983df7caaf5493e30979ab04a33d41b3b07e: read 87 of 87 changed file(s); 0 finding(s), 0 as inline comments.

Security review: no security issues found

I read every hunk of the 87 changed files in .claude-lane/pr.diff. None of them matches a TRUSTED PATHS glob. None is a trust control (trusted-trigger, lane token, kill switch, token broker, merge holds or other .github/actions/), and no plugin manifest (plugin.json / marketplace.json) changed, so no manifest <field> lines apply.

What I checked:

• seed-copy.sh (new):
  • The provider name has to match ^[a-z][a-z0-9-]*$ before any path is built from it (L83), so ../ traversal is refused. The test covers this case.
  • The copy goes into a mktemp -d staging directory beside the destination and is swapped in through a backup. find -type f skips symlinks, and rm -rf on the backup does not follow them, so a consumer-placed symlink cannot redirect a write or a delete outside the adapter directory.
  • A copy with no hash record, or one that was edited, is never overwritten.
  • WIT_SEEDS_DIR and --root come from the caller's own environment and arguments. Neither crosses a trust boundary.
• Dispatcher (work-item-tracker.sh): the new branch only tests whether $SCRIPT_DIR/seeds/$WIT_PROVIDER exists and then fails with exit 3. It runs nothing from seeds/.
• Adapter resolution: a consumer-local adapter at <repo root>/tools/work-item-tracker/adapters/<provider>/ already took precedence over the bundled one before this change, so letting jira, gitea and linear resolve only from there does not let new code run that the base would have stopped. The fast-forward only writes plugin-shipped seed content over a copy whose hash shows nobody edited it.
• seeds/jira/common.sh: it now sources its libraries from ${WIT_SEAM_LIB_DIR:-…/../../lib}, which the gitea and linear seeds already did. Whoever controls that variable already controls the process environment, so this adds no new attack path. Credential handling (the token is read from the environment variable the binding names) is unchanged.
• Instruction surfaces (setup and onboard-adapter SKILL.md, check.md, providers.md): the setup skill's "does NOT do" list now allows copying a seed into the consumer repo, and nothing else. The rules against storing secrets and against writing the plugin cache or user settings are still there, and the edited-copy path tells the skill never to delete or overwrite. No guardrail in a protected class was removed. The instruction exception register was not consulted: I judged by consequence.
• Mode changes: common.sh and mock.sh changed from 644 to 755. This has no security impact.
• PR context: it contains no embedded directives aimed at the review lane.

critical-findings: 0

[github-actions]

claude-review reviewed 637b983df7caaf5493e30979ab04a33d41b3b07e: read 87 of 87 changed file(s); 1 finding(s), 0 as inline comments.

Code review: PR #11928, jira, gitea and linear ship as seeds that setup copies

I read every hunk of all 87 changed files. 72 of them are pure renames with no content change. I also checked the code around the change:

• lib/binding.sh provides wit_project_root.
• The dispatcher's WIT_SEAM_LIB_DIR export is in place.
• Every seed verb script loads the shared libraries through its own common.sh.
• The skew block in conformance/run-conformance.sh still works when jira.test.sh exports WIT_ADAPTERS_DIR.

seed-copy.sh checks out. Traced by hand:

• The provider name is checked against a regex before it becomes part of any path.
• New content is built in a staging directory beside the target, so the final step is a rename on the same filesystem.
• The hash of the files in the copy (minus .seed-hash) is compared with the recorded hash before anything is overwritten. A missing record counts as edited, so a hand-written local adapter is never replaced.
• A fast-forward first moves the old copy aside as a backup, so a failed move puts it back.
• Every assertion in seed-copy.test.sh matches what the script does.

Dispatcher. The new exit 3 in work-item-tracker.sh fires only when no adapter directory resolves and a seed of that name exists. Other providers keep the existing "no adapter" message.

Finding (whole PR, no changed line can carry it)

1. The moved gitea and linear READMEs give commands that fail in the consumer's copy. seed-copy.sh copies README.md into <repo>/tools/work-item-tracker/adapters/<provider>/ but leaves out *.test.sh and mock.sh. The copied README's "Verifying" section still says:

   • bash adapters/gitea/common.test.sh. That file is not in the copy, and it has also moved away from that path inside the plugin.
   • for t in adapters/gitea/*.test.sh on gitea/README.md#L87-L91. Nothing matches the glob, so bash runs the literal adapters/gitea/*.test.sh and fails.

   The same lines are in linear/README.md#L87-L91.

   Line 42 of both READMEs, and README.md.tmpl#L42, still say the skeleton "tracks the bundled jira" adapter.

   To reproduce: run seed-copy.sh gitea --root <repo>, then from <repo>/tools/work-item-tracker run bash adapters/gitea/common.test.sh. It fails with "No such file or directory".

   The PR's "Not verified" section already discloses this. Fix: rewrite the Verifying sections for a consumer-owned copy (or point them at the plugin's seeds/<provider>/ path), and drop the word "bundled" in the template.

Closing issue #11873

• Bundled adapters are github and local-markdown only, and the README and CONTRACT say so: met. If jira came back under adapters/, the "an uncopied seed → exit 3" case in seed-copy.test.sh would fail.
• A seed-copy test shows fast-forward and the edited-copy stop with a diff, and passes under scripts/run-test-file.sh: the test exists and covers both cases. I could not run it; it is left to CI.
• validate-cases.py, check-skill.sh and check-changelog-fragments.sh pass with a work-items fragment:
  • The fragment exists with bump: major, which fits the breaking change: existing jira, gitea and linear bindings exit 3 until setup apply runs.
  • The PR's runner reports that the fragment check passed. I did not confirm that myself.
  • The author says the other two commands were not run, and I could not run them. They are unverified, not met.

Not covered

• No plugin.json or marketplace.json changed, so none of the manifest checks applied.
• I found no embedded instructions in the PR context.
• No spend, so nothing to hold for.

[melodic-automation-lanes]

Unattended merge: native auto-merge leaves this pull request unarmed at head 637b983df7caaf5493e30979ab04a33d41b3b07e. A person must clear this reason, so the pr-merge lane added the needs-human label: fix the reason, then remove the label, and the next scheduled run judges it again.

pr-merge's gate holds it on its risk score
  (unreviewed-patch:plugins/work-items/tools/work-item-tracker/seeds/gitea/common.sh: no patch, and
  its mode gains execute; a person reads it;
  unreviewed-patch:plugins/work-items/tools/work-item-tracker/seeds/gitea/mock.sh: no patch, and its
  mode gains execute; a person reads it;
  unreviewed-patch:plugins/work-items/tools/work-item-tracker/seeds/jira/mock.sh: no patch, and its
  mode gains execute; a person reads it;
  unreviewed-patch:plugins/work-items/tools/work-item-tracker/seeds/linear/common.sh: no patch, and
  its mode gains execute; a person reads it;
  unreviewed-patch:plugins/work-items/tools/work-item-tracker/seeds/linear/mock.sh: no patch, and
  its mode gains execute; a person reads it)

[kyle-sexton]

Cleared the pr-merge risk hold after reading the flagged files. Every unreviewed-patch entry is a 100% rename from adapters/ to seeds/ (git diff -M --summary against the merge base) with only a mode change from 100644 to 100755 and no content change, which is why the gate saw no patch. The renamed adapters are the same code already on main, reviewed there; the new files (seed-copy.sh, its test, seeds/README.md) were read by both review lanes, which reported 0 findings at this head. No security or billing risk, so needs-human comes off and the PR is armed.

[github-actions]

Post-merge mutation testing

• Range: be80854..b218382
• Merged pull request: #11928
• Outcome: reported

Killed 4, survived 3, timeout 0, no coverage 0, invalid 0, not run 0.
Covered-code score 57%; mutation score 57%.

File	Killed	Survived	Timeout	No coverage	Invalid	Not run
plugins/work-items/tools/work-item-tracker/seed-copy.sh	2	2	0	0	0	0
plugins/work-items/tools/work-item-tracker/seeds/jira/common.sh	1	1	0	0	0	0
plugins/work-items/tools/work-item-tracker/work-item-tracker.sh	1	0	0	0	0	0

Surviving mutants

Location	Operator	Disposition	Cause
plugins/work-items/tools/work-item-tracker/seeds/jira/common.sh:34	SBR	productive	input-gap
plugins/work-items/tools/work-item-tracker/seed-copy.sh:83	SBR	productive	input-gap
plugins/work-items/tools/work-item-tracker/seed-copy.sh:112	SBR	productive	no-assertion

The run's summary has the full report.