[kyle-sexton]

No related issue: follow-up to #986 (owner-approved issue-body contract design)

Summary

#986 synced the issue-body contract into two plugin directories of claude-code-plugins. Its sync PR, melodic-software/claude-code-plugins#15429, cannot pass: scripts/check-cross-plugin-source-drift.sh refuses a file byte-identical across two plugins unless the same change registers it, and a registry entry cannot land first because the check also refuses an entry with fewer than two copies (STALE BASELINE). A sync PR cannot carry that registration.

Fix

• sync-manifest.yml: issue-body-contract-bugs and issue-body-contract-work-items become one component, issue-body-contract-plugins, delivering contract.json to docs/contracts/issue-body/contract.json in claude-code-plugins. That repository's sync-shared-copies.sh fans the canonical into each plugin's reference/, registered in the same change, as it already does for docs/contracts/standards/README.md.
• The hosted managed-files guard lists the new destination instead of the two plugin paths.
• The component README names the new path.

Verification

• bash distribution/sync-manifest.sh validate: valid, 52 components, 15 targets.
• components/managed-files-guard/managed-files-guard.test.sh: passes.
• In a claude-code-plugins checkout, a registry entry for reference/issue-body-contract.json without the copies fails check-cross-plugin-source-drift.sh --check with STALE BASELINE (exit 1), which rules out registering first.

Related

• feat(issue-body-contract): add the issue-body contract and generate the org issue forms from it #986
• chore: sync standards components claude-code-plugins#15429 (the sync PR this push refreshes)

🤖 Generated with Claude Code

https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T22:12:32.300019Z	acc4105	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed acc410526df713f2be4553aa86ccc9ca4e97cb3b: 0 finding(s), 0 as inline comments.

No security issues found in this pull request (head acc4105).

The change has three files: it re-registers the issue-body contract sync as one canonical file, docs/contracts/issue-body/contract.json, in place of two per-plugin copies. It updates the managed-files-guard caller's paths list to match and edits a README table.

• Trust controls: none of the listed controls changed. The diff does not touch the trusted-actor list, the token request or broker code, the kill switch, a merge hold or any .github/actions/ action. It also does not touch CODEOWNERS or .gitmodules. The managed-files-guard caller is not one of those controls, and its header says it is advisory during soak and not aggregated into ci-status.
• Guard path list: the guard drops the two plugins/*/reference/issue-body-contract.json paths and adds docs/contracts/issue-body/contract.json. The guard comment says paths is a trigger filter that must track the managed destinations in the sync manifest, and the manifest moves in the same diff. The comment also says a contract test fails if the two drift apart, though I did not run that test. I found no way for an untrusted input to reach a secret, a token, trusted code or a charge through this edit. Whether the plugin copies are protected from hand-edits in claude-code-plugins is decided in that repository's sync-shared-copies.sh, which is outside this diff.
• Sync manifest: two components merge into issue-body-contract-plugins, with the same source components/issue-body-contract/contract.json and one new destination. The target list is updated to match. I found no leftover references to the removed component names in the checked-out tree. The check was an unfiltered grep that warned about unreadable paths, so it may have skipped directories.
• Plugin manifests and instruction surfaces: no plugin.json or marketplace.json is changed, and no CLAUDE.md, AGENTS.md, rules file, skill or hook is changed. The protected-class register was not consulted because no instruction was removed.
• Throughput-phase hold removals: none to name.

manifest: no hits.
critical-findings: 0

[github-actions]

claude-review reviewed acc410526df713f2be4553aa86ccc9ca4e97cb3b: 0 finding(s), 0 as inline comments.

No findings. I read the full diff (.claude-lane/pr.diff) and the PR context file.

• Stale references: a repo-wide grep finds no remaining mention of issue-body-contract-bugs, issue-body-contract-work-items, or the two old plugin destination paths outside the removed diff lines. The README, the managed-files guard path list and the sync manifest now agree on docs/contracts/issue-body/contract.json.
• Manifest and guard: the target's component list swaps the two old entries for issue-body-contract-plugins. The guard's path list stays alphabetical (docs/contracts/… sorts before docs/conventions/…).
• Closing issue: the PR has no closing issue (No related issue: …), so there are no criteria to check.
• Rules: .claude/rules/pr-body-contract.md is the only rule file. The PR title is Conventional Commits and the body has Summary, Fix, Verification and Related sections.
• Not verified: I did not run sync-manifest.sh validate or the guard test. The Verification section's results are the author's claims. The claim that the downstream claude-code-plugins sync script fans the file into each plugin's reference/ is outside this repository and unchecked.