ci!: remove issue-opening reusables, drift trackers and zero-caller Claude lanes

[kyle-sexton]

Summary

Owner decision 2026-09-14: no automated process opens GitHub issues on its own, and stale or overengineered automation goes. This removes every issue-opening reusable and scheduled tracker in ci-workflows, plus the scripts, tests, fixtures, CI steps, render targets and docs that existed only for them.

Consumers pin this repository by SHA, so nothing changes for a caller until it re-pins.

Fix

Removed workflows:

• link-check.yml (reusable)
• pulumi-version-drift-check.yml (reusable)
• standards-sync-stuck-automerge-alert.yml (reusable)
• claude-lane-incident-aggregator.yml
• release-gap-check.yml, release-tag-drift-check.yml, tool-version-drift-check.yml

Removed zero-caller reusables (owner direction 2026-09-14: delete stale automation; no org repository calls them):

• approval-agent.yml, approval-agent-self.yml, approval-agent-guardrails.cjs and test, approval-agent-ADR.md, app-approval-count-probe.md
• claude-assistant.yml, claude-assistant-self.yml, claude-assistant.test.cjs, claude-assistant-ADR.md (medley keeps its own local copy)
• claude-e2e-verify.yml, claude-e2e-verify-self.yml, .github/test-fixtures/e2e-demo/
• dependabot-lock-regen.yml

Removed support files:

• claude-lane-incident.cjs, claude-lane-incident.test.cjs, claude-lane-incident-write-gate.cjs, claude-lane-incident-write-job.pinned.yml, claude-lane-incident-mint-step.pinned.yml, claude-lane-incident-aggregator.test.cjs, fixtures/claude-lane-incident-write-gate/
• find-tracking-issue.sh, find-tracking-issue.test.sh, find-tracking-issue-render.test.cjs, render-find-tracking-issue.cjs (and its render.cjs target)
• release-tag-drift.sh and test, osv-release-digest.sh and test (used only by tool-version-drift-check.yml)
• link-check.test.cjs, link-check-tracking-author.test.cjs, standards-sync-stuck-automerge-alert.test.cjs

Coupled edits:

• ci.yml: dropped the three removed shell test steps.

• Contract tests (network-timeout-policy, pulumi-deploy-guard, go-quality, osv-scanner-pin, render-compose): dropped assertions against the deleted workflows. tool-version-drift-contract.test.cjs kept only its Python-defaults test, renamed python-version-agreement.test.cjs.

• claude-lane-outcome/outcome-step.test.cjs asserts the class= token directly instead of through the deleted incident parser. The action's annotation and the marker comment are unchanged; comments in the action, classify.cjs, claude-security-review.yml and README no longer describe an aggregator.

• osv-scanner-pin.json drops update.driftWorkflow; CODEOWNERS drops the aggregator entry.

• README, SECURITY.md, and stale comments in markdown/action.yml, check-action-metadata-filename.sh, composite-run-shellcheck.sh, claude-e2e-verify.yml, standards-sync.yml, .gitignore.

• One-line amendment notes in docs/topics/claude-review-lanes/PLAN.md (Phase 4 and step 3d) and docs/topics/ci-fanout-consolidation/ADR.md.

• claude-lane-retry-gate.test.cjs checks parity across the two review lanes; README drops the e2e/assistant lane contract text; PLAN.md TLDR gets an amendment line.

Kept: issue-triage-label.yml, claude-lane-marker-comment, claude-lane-outcome.

Left as is:

• release.yml:126 still names release-tag-drift-check.yml in an error message; release.yml is out of scope for this change.
• lychee.toml lines 2-3 and 32 still mention an "online advisory lane". The file is a standards-synced component (every commit to it is chore: sync standards components), so that wording must change in melodic-software/standards components/lychee, not here.

Secrets and labels left for cleanup (not deleted here):

• Repository secrets CLAUDE_LANE_INCIDENT_APP_CLIENT_ID and CLAUDE_LANE_INCIDENT_APP_PRIVATE_KEY (used only by the aggregator).
• The standards caller of the stuck-automerge alert passes its own App client ID and private key secrets; those belong to that caller's cleanup.
• The claude-lane-incident label, declared in github-iac (GovernedRepositories.cs, LabelContractTests.cs).
• Now referenced by no workflow here: PUSH_TOKEN (Dependabot secret, lock-regen), MELODIC_APP_ID / MELODIC_PRIVATE_KEY (approval-agent dogfood caller), variables CLAUDE_E2E_VERIFY_DISABLED and CLAUDE_ASSISTANT_DISABLED. CLAUDE_CODE_OAUTH_TOKEN and CLAUDE_LANES_DISABLED stay in use by the review lanes.
• Open issues filed by the removed automation, for the coordinator to close after merge: [Incident] Claude lane infrastructure failure #584 (lane incident), [Maintenance] Unreleased main: release gap #583 (release gap), [Maintenance] Tool-version drift #511 (tool-version drift).

Verification

• node --test .github/scripts/*.test.cjs: 272 pass, 0 fail (307 before the zero-caller removals)
• node --test .github/actions/claude-lane-outcome/*.test.cjs: 15 pass, 0 fail
• node .github/scripts/render.cjs --check: clean
• actionlint -config-file .github/actionlint.yaml (embedded shellcheck disabled locally): clean
• shellcheck on the two edited shell scripts: clean
• git grep for every deleted name: only release.yml and the dated amendment context in docs/topics remain

Related

Callers are being removed in parallel PRs in .github, ci-runner, claude-code-plugins, dotfiles, github-iac, medley, provisioning and standards. This PR should merge after those.

Refs: #583
Refs: #511

🤖 Generated with Claude Code

https://claude.ai/code/session_019mo9xaZ53JHHy4aBjgd8wK

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T19:01:33.974232Z	6665010	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 1s —— View job

---

I'll analyze this and get back to you.

[github-actions]

Warning

Automated security review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/ci-workflows/actions/runs/34885181003
• Failure class: rate-limit
• Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":409,"total_cost_usd":0,"api_error_status":429,"error_type":null,"class":"rate-limit"}

The check is green on purpose, and it is not evidence. It certifies that a security pass ran, and this one did not complete — but the cause is outside this PR's control, so merging is deliberately left unblocked rather than locking every merge for the length of the outage. Nothing was reviewed at this head. Where this check is required, it is satisfied without that evidence; a human should review security-sensitive changes here before merging.

Re-run the job, or workflow_dispatch this workflow with the PR number, to retry the review (ci-workflows#227). A new push also retries it only if the caller's pull_request triggers include synchronize (the canonical security caller keeps it). An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator.

Re-running does NOT help for every class:

• rate-limit that persists across re-runs, or auth — the credential or usage budget needs an operator; retrying will not clear it.
• a run that exhausted its turn budget ("subtype":"error_max_turns" above) will exhaust it again. As the PR author, split the change into smaller PRs; raising --max-turns is a change to the caller workflow, not something you can set on this PR.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/ci-workflows/actions/runs/34884103660
• Failure class: rate-limit
• Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":537,"total_cost_usd":0,"api_error_status":429,"error_type":null,"class":"rate-limit"}

Re-run the job, or workflow_dispatch this workflow with the PR number, to retry the review. A new push re-triggers this lane only if the caller's pull_request triggers include synchronize (the canonical caller omits it).
An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator (auth).

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.