Issues

• fix(lefthook): base.yml hint should say npm ci && npm run prepare and repos should track .npmrc ignore-scripts=true

  melodic-software/standards#823 · Filter by author kyle-sexton opened on Oct 20, 2026

• Align the dependabot-policy review tier with the owner rule on major updates

  area: security
  melodic-software/standards#821 · Filter by author kyle-sexton opened on Oct 20, 2026

• Add uv to the dependabot auto-merge ecosystems or record why not

  area: security
  melodic-software/standards#820 · Filter by author kyle-sexton opened on Oct 20, 2026

• Align zizmor fail-on-severity with the rest of the fleet

  area: security
  melodic-software/standards#819 · Filter by author kyle-sexton opened on Oct 20, 2026

• docs(pr-body-contract): ci-status also fails a body line that would break the squash signature

  melodic-software/standards#818 · Filter by author kyle-sexton opened on Oct 20, 2026

• fix(runner-policy): record intake-triage's fixed-hosted subscription job in its contract

  melodic-software/standards#817 · Filter by author kyle-sexton opened on Oct 20, 2026

• sync: let claude-code-plugins set merge=union on six append-only list files

  melodic-software/standards#815 · Filter by author kyle-sexton opened on Oct 19, 2026
  1

• dependabot-policy: make Dependabot major updates wait for a human (or add a majors-hold option)

  melodic-software/standards#806 · Filter by author kyle-sexton opened on Oct 18, 2026

• chore(deps): remove smol-toml and katex overrides once markdownlint-cli2 and micromark-extension-math allow the patched versions

  area: securitydependencies
  melodic-software/standards#805 · Filter by author kyle-sexton opened on Oct 18, 2026
  1

• fix(runner-policy): treat needs-derived job env as routing-relevant

  needs-triage
  melodic-software/standards#800 · Filter by author kyle-sexton opened on Oct 17, 2026

• refactor: rename conventions/ to standards/

  melodic-software/standards#790 · Filter by author kyle-sexton opened on Oct 15, 2026

• Decide whether knowledge-corpus runs the offline lychee lane with captured text excluded

  melodic-software/standards#780 · Filter by author kyle-sexton opened on Oct 11, 2026

• Justify the App-token half of the link-check excludes audit

  melodic-software/standards#779 · Filter by author kyle-sexton opened on Oct 11, 2026

• Deliver the canonical lychee.toml to songwriting, azure-iac and architecture without a write grant

  melodic-software/standards#778 · Filter by author kyle-sexton opened on Oct 11, 2026

• Sync attest: fail only the unreachable target and report extra App access instead of blocking

  melodic-software/standards#777 · Filter by author kyle-sexton opened on Oct 11, 2026

• Add verb file and maintenance function file-upstream-drift-issues to the Actions naming vocabulary

  melodic-software/standards#766 · Filter by author kyle-sexton opened on Oct 11, 2026

• Project-scope plugin installs drift behind releases; find a no-drift design

  melodic-software/standards#737 · Filter by author kyle-sexton opened on Oct 8, 2026

• Find out why the machine-path check missed C:/Users/KyleSexton in .chezmoi.toml.tmpl:57

  melodic-software/standards#736 · Filter by author kyle-sexton opened on Oct 8, 2026

• pr-convention-policy: bound negatedClosers.wordWindow in the schema

  melodic-software/standards#728 · Filter by author kyle-sexton opened on Oct 6, 2026

• code-review-rules: enroll the six URL-form sync targets in review-instructions

  melodic-software/standards#726 · Filter by author kyle-sexton opened on Oct 6, 2026