[kyle-sexton]

No related issue: owner decision Q316 (cohort hub)

Summary

The work-items tracker binding moves from the legacy root .work-item-tracker.json to the tracker key of docs/conventions/work-items.yaml, the convention home every work-items reader already checks first. This retires the legacy file so the plugins can drop their JSON fallback.

Fix

• Ran the work-items setup skill's migrate-binding.sh --root <worktree>, which wrote docs/conventions/work-items.yaml with the same schema_version, provider, docs and config values, after reading the copy back through the seam's parser.
• Deleted .work-item-tracker.json.
• Added docs/conventions/**/*.local.* to .gitignore, so a personal override (docs/conventions/work-items.local.yaml) stays untracked. The .work-item-tracker.local.json line stays: the work-items setup skill requires a legacy local override to stay ignored while any reader still uses it.
• Rewrote the README's agent-config paragraph to name the tracker key of docs/conventions/work-items.yaml and its docs/conventions/work-items.local.yaml overlay.

Verification

• migrate-binding.sh exited 0 and printed binding: copied ... and override: no-json ....
• awk -f yaml-subset.awk docs/conventions/work-items.yaml parsed tracker.schema_version 1.0, tracker.provider github, tracker.docs and tracker.config.lease_ttl_hours 24; no key outside the allowlist.
• git check-ignore -q docs/conventions/work-items.local.yaml exited 0.
• git ls-files .work-item-tracker.json is empty; git grep -nF .work-item-tracker.json finds only the kept .gitignore line for .work-item-tracker.local.json.
• Pending after merge: the contents API returns 404 for .work-item-tracker.json and 200 for docs/conventions/work-items.yaml on the default branch.

Related

Removing the reader fallback for the JSON file follows in https://github.com/melodic-software/claude-code-plugins.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VQb9Pz6CBRwjqpnFDbP9Rr

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T22:32:09.864530Z	fda39e1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed fda39e1fdf6ca150a2b092a0ab5b9ee176b22abd: 0 finding(s), 0 as inline comments.

No security findings. critical-findings: 0

I read the full diff (4 files) and found no security-relevant surface.

• Tracker binding move: the diff deletes .work-item-tracker.json and adds docs/conventions/work-items.yaml with the same content (provider: github, lease_ttl_hours: 24) under a tracker: key. It adds no secrets, tokens, commands, URLs or permission changes. It touches none of the trust controls: no trusted-actor list, token scope, kill switch, merge hold or .github/actions/ change.
• .gitignore: it adds docs/conventions/**/*.local.* and keeps the legacy .work-item-tracker.local.json ignore. This keeps per-operator overlays out of commits. It widens no trust and exposes nothing.
• README.md: documentation text only.
• Instruction surface: no standing instruction, rule, hook or allowlist is deleted or softened.
• Plugin manifests: none changed.

I did not read the work-items plugin's code that consumes work-items.yaml, because it is outside this PR. Whether the loader accepts the new location is a functional question, not a security one.

[github-actions]

claude-review reviewed fda39e1fdf6ca150a2b092a0ab5b9ee176b22abd: 0 finding(s), 0 as inline comments.

No findings.

The PR moves the work-items tracker binding from .work-item-tracker.json to the tracker key of docs/conventions/work-items.yaml.

• Values carried over: the new YAML has the same schema_version, provider, docs and config.lease_ttl_hours as the deleted JSON.
• Ignore rules: .gitignore adds docs/conventions/**/*.local.* and keeps the legacy .work-item-tracker.local.json line. .gitignore is owned by this repo, not synced from standards, so the edit is allowed.
• Stale references: a grep of the tree (excluding .git and .claude-lane) finds .work-item-tracker only in the kept .gitignore line. The docs/standards/ hit is prose that never names the file.
• README: the agent-config paragraph now names the tracker key and the docs/conventions/work-items.local.yaml overlay, matching the diff.
• Closing issue: the PR states No related issue: owner decision Q316, so there are no acceptance criteria to check.

Not checked: the diff reads fine, but I did not run migrate-binding.sh or the YAML parser. The PR body's verification claims, including the pending post-merge contents-API check, are the author's and unverified by me. I also did not confirm that readers in claude-code-plugins handle the new location. The PR says that work follows separately.