Operator-gated drift tail of the plugin-sync cluster (#3688 follow-ups, post-wipe tracking)

[kyle-sexton]

Tracking issue for the operator-gated tail of the claude-ops plugin-sync cluster (#3733, #3728, #3734, #3681, #3688, closed 2026-09-08). Filed because the authoring host is being wiped on 2026-09-15 and this list lived only in gitignored .work/handoffs/ files there. Everything below waits on an explicit operator go; nothing is in flight. The last open thread of the cluster itself is #3835 (host-local probe, re-plant recipe on that issue).

Adjacent drift list, one worktree and PR each, only after a go

• (a) claude-code-account-rotation gets a .claude/settings.json with the SessionStart hook and marketplace, delivered by the standards sync manifest like claude-settings-github-iac (a standards change plus one sync). Unprobed whether this is already tracked: gh issue list -R melodic-software/standards --search "account-rotation settings" and the same in claude-code-plugins and github-iac.
• (b) ci-workflows release.yml:126 error text points at a file that exists (workflow-string edit, no logic change).
• (c) ci-workflows README ~line 89 "v0.7.0" version line.
• (d) standards managed-files-guard README acceptance bullet (~166-170) naming the dependabot[bot] arm.
• (e) github-iac .github/dependabot.yml:61-62 ignore widened to melodic-software/ci-workflows/* like the other four.
• (f) the ci-workflows fix(repo-hygiene): git-tree-reset AppliedClean no longer claims success when git clean failed (#395) #590 header sentence on consumer repins, one clause.
• (g) the claude-bot plugin SessionEnd hook path (upstream claude-community marketplace bug; disable the hook or file it).

Waiting on a ci-workflows release

• Structural managed-files-guard fix: move actions/checkout into the composite action and drop the step from the standards component. Operator-gated on the release.

Operator-only

• Add "Bash(gh pr merge *)" beside the other gh pr rules in ~/.claude/settings.json (only the --auto variants exist; a session cannot add it, the classifier denies it as self-modification). On a fresh host this is part of settings seeding.

Context a cold agent needs

• Same-plugin PRs in this repo conflict by construction on the plugin version bump and the CHANGELOG top-insert; never stack two claude-ops PRs on one branch or run them in parallel.
• Every hop of this chain used one Opus implementer per item with a fresh-context verifier; gh pr merge may be classifier-denied once, then ask.
• save_point.py in session-flow < 0.35.18 drops Original-goal bullets below Opening ask:; 0.35.18 fixes it (fix(session-flow): carry amendment bullets below the predecessor's Opening ask #4164).

[kyle-sexton]

This was generated by AI during triage.

Human-gated. Open decision: explicit operator go required per item (existing status: needs-decision label holds)

[kyle-sexton]

Owner decision (2026-09-29): Decide with evidence. Re-verify each item (a)-(g), the ci-workflows follow-up, and the settings rule against its own repo's current main before any go; only the items still real go forward.

Next: an agent re-verifies each item on current main and posts the per-item result (still open, stale, or already fixed, with file and line evidence) on this issue. It opens no PRs in other repos. The issue keeps needs-human for the final per-item go, and the ~/.claude/settings.json rule stays owner-only.

[kyle-sexton]

Re-verified against each repo's current main (read through the GitHub API and fresh clones). No PRs were opened in other repos.

Item	Verdict	Evidence
(a) claude-code-account-rotation .claude/settings.json (SessionStart hook + marketplace)	Still open, untracked	.claude/settings.json returns 404 on main (.claude/ holds only cloud-bootstrap.sh and rules/). standards distribution/sync-manifest.yml:141-143 defines claude-settings-github-iac (one target, the github-iac file); the account-rotation entry (sync-manifest.yml:432-451) manages cloud-bootstrap but no claude-settings component, so no delivery exists. Issue search (account-rotation settings, claude-settings account-rotation, all states) in standards, github-iac and claude-code-plugins finds nothing besides this issue. Merged standards PRs (#477, #550, #607) only cover github-iac.
(b) ci-workflows release.yml error text points at an existing file	Still open (line moved from 126 to 99)	.github/workflows/release.yml:99 ends "See .github/workflows/release-tag-drift-check.yml and its tracking issue." That workflow no longer exists: .github/workflows/ on main has only release.yml; commit 7af4ab8 (ci-workflows#585) removed the drift trackers. release.yml is 113 lines, so line 126 no longer exists.
(c) ci-workflows README "v0.7.0" line	Still open	README.md:99 "This repository is v0.7.0 at the time of writing"; latest release is v0.30.1 (2026-09-28, gh release list -R melodic-software/ci-workflows).
(d) standards managed-files-guard README acceptance bullet naming the dependabot[bot] arm	Still open (lines moved to 184-189)	components/managed-files-guard/README.md:184-189 ("Acceptance during soak") names only the standards-sync label and the melodic-standards-sync[bot] exemption and says a green on a hand-edit is a defect. The action also skips dependabot[bot]/dependabot (ci-workflows .github/actions/managed-files-guard/action.yml:40), and the README states that at lines 44 and 207-210 but not in the acceptance bullet.
(e) github-iac .github/dependabot.yml:61-62 ignore widened to melodic-software/ci-workflows/*	Still open, but it reads as a policy divergence, not a typo	Lines 61-62 ignore only melodic-software/ci-workflows/.github/workflows/*; lines 56-60 say composite actions "stay Dependabot-managed". Six repos ignore melodic-software/ci-workflows/* (claude-code-plugins, dotfiles, medley, provisioning, .github, standards); github-iac and ci-runner ignore only .../.github/workflows/*. Live effect: Dependabot PR github-iac#576 (open, 2026-09-29) bumps six ci-workflows composites 0.27.1 to 0.30.1; #533 did the same for 0.24.0 to 0.26.0. The issue's "other four" is now six. Whether github-iac should join them is the owner's call.
(f) ci-workflows #590 header sentence on consumer repins	Already fixed	ci-workflows#590 merged 2026-09-15. release.yml:18-26 now says a release repins nothing and names the standards claude-lanes-repin.yml lane (exists, .github/workflows/claude-lanes-repin.yml), the repin-callers.sh enumeration (exists, components/claude-lanes/repin-callers.sh:23-41, now including both managed-files-guard callers), this repo's github-actions Dependabot group (no ignore in .github/dependabot.yml), and "by hand everywhere else". One residual: that last clause omits github-iac, whose Dependabot does bump composites (see (e)); it is only wrong until (e) is decided.
(g) claude-bot plugin SessionEnd hook path	Still open, not filed, not disabled	claude-community lists claude-bot at michaelslain/claude-bot sha 44ac5138 (marketplace.json), which is upstream main HEAD (2026-06-08). The plugin ships no hooks.json: its MCP server writes bun run <import.meta.dir>/bin/collect-hook.ts into ~/.claude/settings.json hooks.SessionEnd on every start (server.ts:803-866), so the command embeds an install path that goes stale when the plugin cache directory changes. michaelslain/claude-bot has no issues; anthropics/claude-plugins-community has no claude-bot issue. The plugin is not in this machine's ~/.claude/plugins/installed_plugins.json. Whether a stale entry exists in any host's ~/.claude/settings.json was not checked (owner-only).
Follow-up: structural managed-files-guard fix (checkout into the composite action, step dropped from the standards component)	Not started; the release it waits on does not exist	ci-workflows .github/actions/managed-files-guard/action.yml has no consumer-checkout step or input (its only actions/checkout, line 49, fetches the standards manifest source); latest release v0.30.1 (2026-09-28, #634/#635) does not change that. standards components/managed-files-guard/managed-files-guard.yml:51 and managed-files-guard-fleet.yml:55 still carry actions/checkout@3d3c42e5 # v7.0.1. No open issue or PR on either side covers it; the README still describes it as pending (lines 44-48, 207-214).
Settings rule: Bash(gh pr merge *) in ~/.claude/settings.json	Owner-only, not checked	The file is owner-only; not read or edited.
Context: #3835	Open, needs-human, priority: low	Owner decision 2026-09-29 17:21Z: re-plant the probe on the new host, recheck 14 days after the new .orphaned_at marker; the owner runs the four commands.
Context: #4164 fix	Confirmed	#4164 merged 2026-09-15; plugins/session-flow/CHANGELOG.md:317 [0.35.18]; plugins/session-flow/.claude-plugin/plugin.json on main is 0.38.29.

Summary: (a)-(e) and (g) are still real; (f) is already fixed apart from the residual tied to (e). Nothing was already done, so no item is stale in the "should be dropped" sense.

The final per-item go stays with the owner. No PRs were opened in other repos. The ~/.claude/settings.json rule stays owner-only. This issue stays open with needs-human.

[kyle-sexton]

Owner decision (2026-09-29): approved consensus

Question: The final per-item go stays with the owner. Which of items (a) through (e) and (g), the structural managed-files-guard follow-up, and the Bash(gh pr merge *) settings rule get a go? ((f) is already fixed.)

Chosen answer: "Q1 (go on b, c, d only): GO, one small draft PR per item, in ci-workflows (b, c) and standards (d), each merged separately. Q2 (e, github-iac dependabot ignore): HOLD. This is a policy decision, not a typo. Do nothing until the owner picks widen or keep; if kept, (f)'s "by hand everywhere else" clause needs a one-line follow-up. Q3 (a, account-rotation claude-settings via the standards sync manifest): HOLD. It changes the standards manifest and a sync, which touches many repos, so it needs its own design and PR. Q4 (g, claude-bot SessionEnd hook path): the safest action is to file an upstream issue on michaelslain/claude-bot, or do nothing. Enabling and disabling the hook is a per-host, owner-only step. The plugin is not installed on this machine. Q5 (structural managed-files-guard fix): NO GO. It is blocked because the ci-workflows release it needs does not exist. Q6 (Bash(gh pr merge *) in ~/.claude/settings.json): OWNER-ONLY, and the recommendation is not to add it. Without it, each merge still prompts, so a human stays in the loop, and there is nothing to roll back. Add it only if merge prompts become a real cost."

Rationale: Items (b), (c) and (d) are one-line text changes in one repo each, with no logic change, so a revert restores the prior state. Re-checked on current main: ci-workflows release.yml still points at the removed release-tag-drift-check.yml, and its README still says v0.7.0 while the latest release is v0.30.1. Item (e) is a live policy divergence, not a typo: github-iac dependabot.yml lines 52-62 deliberately keep composite actions Dependabot-managed and it still receives bump PRs (#576, #533). Item (a) changes the standards sync manifest and could spread across repos, and the structural fix has no release to build on yet.

Next: The go items (b), (c), (d) are handled by a separate cross-repo step (draft PRs in ci-workflows and standards). This issue stays open with needs-human for the owner-only items: decide (e) widen or keep, decide whether (a) gets its own design, optionally file the upstream claude-bot issue for (g), and leave the gh pr merge rule unset unless merge prompts become costly. The structural managed-files-guard fix waits on a ci-workflows release.

[kyle-sexton]

Owner-approved doc fixes opened as draft PRs (not merged, not flipped ready):

• (b) docs(release): drop pointer to removed release-tag-drift-check workflow ci-workflows#644
• (c) docs(readme): replace stale v0.7.0 with the v0.x line ci-workflows#645
• (d) docs(managed-files-guard): name the dependabot[bot] arm in the acceptance bullet standards#655

Held: (a), (e), the managed-files-guard structural fix, and the settings rule.