[kyle-sexton]

No related issue: owner decision Q316 (cohort hub)

Summary

The work-items tracker binding moves from the legacy root .work-item-tracker.json to the tracker key of docs/conventions/work-items.yaml, the convention home every work-items reader already checks first. This retires the legacy file so the plugins can drop their JSON fallback.

Fix

• Ran the work-items setup skill's migrate-binding.sh --root <worktree>, which wrote docs/conventions/work-items.yaml with the same schema_version, provider and config values, after reading the copy back through the seam's parser.
• Deleted .work-item-tracker.json.
• Added docs/conventions/**/*.local.* to .gitignore, so a personal override (docs/conventions/work-items.local.yaml) stays untracked.

Verification

• migrate-binding.sh exited 0 and printed binding: copied ... and override: no-json ....
• awk -f yaml-subset.awk docs/conventions/work-items.yaml parsed tracker.schema_version 1.0, tracker.provider github and tracker.config.lease_ttl_hours 24; no key outside the allowlist.
• git check-ignore -q docs/conventions/work-items.local.yaml exited 0.
• git ls-files .work-item-tracker.json is empty, and git grep -nF .work-item-tracker.json finds no reference.
• Pending after merge: the contents API returns 404 for .work-item-tracker.json and 200 for docs/conventions/work-items.yaml on the default branch.

Related

Removing the reader fallback for the JSON file follows in https://github.com/melodic-software/claude-code-plugins.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VQb9Pz6CBRwjqpnFDbP9Rr

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T22:26:58.086438Z	4016f04	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 4016f0405bbb47ae78a08929569daf1e067fec0c: read 2 of 2 changed file(s); 0 finding(s), 0 as inline comments.

No security issues found.

critical-findings: 0

I read every hunk of the diff, including the deleted .work-item-tracker.json, plus the PR context and the prior-findings file. This is the first review of this PR, so it is not blocking-only.

• Tracker binding move. .work-item-tracker.json is deleted and the same values (schema_version: "1.0", provider: "github", config.lease_ttl_hours: 24) are added under tracker: in docs/conventions/work-items.yaml. The provider, TTL and schema are unchanged, so no token scope, secret, trusted actor, merge hold or kill switch is affected. The file is data only and holds no credentials or commands.
• Trust controls and trusted paths. None of the changed files is a trust-control file or a trusted-path match (.github/actions/**, trusted-actors, CODEOWNERS, .gitmodules, pr-pipeline.yaml, the merge-hold scripts). The widening checks do not apply.
• .gitignore addition. docs/conventions/**/*.local.* only keeps untracked personal override files out of commits. It cannot hide a tracked file, because git keeps tracking files that are already tracked. It adds no path by which an attacker's input reaches a lane. The local override is read only from the contributor's own checkout, which is not an untrusted source.
• Plugin manifests and instruction surfaces. No manifest, CLAUDE.md, skill or rules file is touched, so those lenses do not apply.
• Cost. The change has no billing impact.

[github-actions]

claude-review reviewed 4016f0405bbb47ae78a08929569daf1e067fec0c: read 2 of 2 changed file(s); 0 finding(s), 0 as inline comments.

No findings.

The PR moves the work-items tracker binding from the root .work-item-tracker.json to tracker: in docs/conventions/work-items.yaml, and adds docs/conventions/**/*.local.* to .gitignore.

• Values: schema_version: "1.0", provider: "github" and lease_ttl_hours: 24 carry over unchanged from the deleted JSON.
• Stale references: I grepped the repository for work-item-tracker. The only hits are plugin-repo URLs in docs/standards/issue-tracker.md (lines 24 and 80), none pointing at the deleted file. The PR's "no reference" claim holds for the repository content I searched.
• Ignore glob: docs/conventions/**/*.local.* does not match the tracked source-control.yaml, source-control/commit-convention.yml or work-items.yaml. It only covers *.local.* files, such as work-items.local.yaml.
• Closing issue: none (owner decision Q316), so there are no acceptance criteria to check.
• Not verified: I did not run migrate-binding.sh, the awk parser or git check-ignore. Those results are author-claimed. Whether the plugin readers prefer the YAML home is also author-claimed, since the reader code is in the other repository.
• Cost: no billable change.