[kyle-sexton]

No related issue: owner-approved follow-up to the auto-ready plan; mirrors #7347 for /work-items:ship run.

Builds on #7345 (ready refuses held and superseded drafts) and #7346 (the AGENTS.md carve-out that lets the opening session flip its own PR); both are merged.

Summary

/work-items:ship run under per-item PRs opened each PR with create --pushed and left it in draft until the user said to land it. It now calls /source-control:pull-request ready right after create --pushed, the same step #7347 adds to /work-items:work, so its PRs leave draft once ready's checks pass.

Fix

• ship/actions/run.md, step "Land one at a time", per-item PRs: right after create --pushed, dispatch /source-control:pull-request ready into the item's worktree at the strong tier's current alias, resolved per the loop-lane convention's capability tiers. ready resolves the PR from the checked-out branch, so the brief names the PR create returned and stops on a mismatch. The dispatch is skipped when the consuming project reserves the ready flip for a person. A refusal (hold, superseded item, failed gate) leaves the draft and its reason goes into the report; the run never lifts the hold or flips another way. Landing still runs ready again (on a non-draft PR it refreshes the base and re-runs the reviews and verify gate without flipping, ready-for-review.md 2.5.1) and then merge, on the user's go-ahead.
• ship/evals/evals.json: cases 10 (ready dispatched after create --pushed) and 11 (a superseded-item refusal leaves the draft; a Hold: line holds only the merge, so it cannot be the refusal), worded like feat(work-items): ready the PR after the pre-PR gate in work #7347's cases 8 and 9.
• Changelog fragment for work-items (minor), worded like feat(work-items): ready the PR after the pre-PR gate in work #7347's.

Verification

• scripts/check-affected.sh --tests after merging main: 7 passed, 2 skipped (no shell or Python changed). Cross-plugin drift and shared-copy checks clean.
• evals.json parses; check-evals-quality.sh PASS. The new eval cases were not run against a model.

Related

• feat(source-control): refuse a held or superseded draft in pull-request ready #7345, docs: let the session that opened a PR flip it through pull-request ready #7346, feat(work-items): ready the PR after the pre-PR gate in work #7347
• fix(source-control): hold the babysit merge on a body line starting Hold: #7349 (babysit merge gate learns the same Hold: line)

🤖 Generated with Claude Code

https://claude.ai/code/session_01W6SjPvY7DmXBGzboeCq8nj

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T18:31:17.134388Z	f086e5f	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 2m 21s —— View job

---

Security review complete

Scope. All three changed files are prose/doc or test-data, no executable code:

• plugins/work-items/skills/ship/actions/run.md — the "Land one at a time" / per-item PRs step, now dispatching /source-control:pull-request ready right after create --pushed.
• plugins/work-items/skills/ship/evals/evals.json — two new eval cases.
• .changes/work-items/feat-ship-run-ready-c7d7b4a5.md — changelog fragment.

What this changes. ship run under per-item PRs now auto-dispatches the draft→ready flip instead of waiting for the user's "land it" signal. This is exactly the carve-out AGENTS.md documents (a session may flip ready on the PR its own create call returned, only via /source-control:pull-request ready running to completion) and mirrors the same pattern already landed for /work-items:work in #7347.

Trust-boundary checks examined, all present:

• PR identity confusion. The brief names the PR number create --pushed returned, and the dispatched agent is instructed to stop if ready resolves a different PR from the branch actually checked out in that worktree — guards against a stale/mismatched worktree flipping the wrong PR.
• Model floor for the security-sensitive step. The dispatch is pinned to the strong tier's current alias resolved via the loop-lane convention, explicitly "never this session's inherited model" — correct, since ready runs the code and security reviews per ready-for-review.md §2.5.3, and a reviewer should never run below the implementer's tier.
• No hold-bypass. A ready refusal (hold, superseded item, failed gate) is required to leave the PR in draft, carry the reason into the report, and the text explicitly forbids lifting the hold or flipping the PR "another way." This doesn't weaken the existing do-not-merge / superseded-PR checks owned by ready-for-review.md §2.5.1.
• No merge-authority change. Flipping ready is distinct from merging; the step still routes merge only on the user's go-ahead, consistent with the loop-lane convention's merge-authority ladder (human merge by default).
• Escape hatch is scoped correctly. "Unless the consuming project's instructions reserve the ready flip for a person" is a per-repository policy choice (e.g., via AGENTS.md/config), not something the tracker item's own (untrusted) body can influence — the item-body-is-data discipline the file's own "Gotchas" section already states is unaffected by this change.

New eval cases 10/11 cover the dispatch-after-create path and the superseded-refusal-leaves-draft path respectively; both check the right invariants (no auto-flip on hold/superseded, no merge without user go-ahead).

Findings: none. No logic flaws, trust-boundary gaps, or Actions-security issues identified in this diff.

claude-lane-summary: lane=claude-security-review sha=f086e5fdbf5d32672cb6aebd7cb2be4d20867b6a run=38447044638

[claude]

Claude finished @kyle-sexton's task in 5m 36s —— View job

---

Review in progress

• Gather context (PR diff, run.md, evals.json, changelog fragment)
• Read referenced conventions (loop-lane capability tiers, ready-for-review.md, pull-request SKILL.md)
• Review run.md changes for correctness/consistency
• Review evals.json new cases
• Review changelog fragment
• Verify one candidate finding adversarially
• Post findings

[github-actions]

claude-security-review has reviewed this pull request through f086e5f; a later push is reviewed from there.

[claude]

Claude finished @kyle-sexton's task in 4m 1s —— View job

---

Review complete

• Gather context (PR diff, CLAUDE.md/AGENTS.md, REVIEW.md, related skills)
• Understand the request (run /review:code-review per custom instructions)
• Review changed files for correctness/maintainability
• Adversarially validate candidate findings
• Post inline comments for findings tied to a line
• Post final summary

Scope: plugins/work-items/skills/ship/actions/run.md, plugins/work-items/skills/ship/evals/evals.json, .changes/work-items/feat-ship-run-ready-c7d7b4a5.md (per gh-style diff in .claude-lane/pr.diff).

Checks performed:

• Cross-read ready-for-review.md (2.5.1–2.5.6) against every behavior claim the diff adds to run.md (branch-based PR resolution, hold/supersede refusal semantics including the Hold: line holding only merge, re-run-without-reflip on an already-ready PR). All claims match.
• Cross-read the loop-lane convention's capability-tier table — the new text points at "the strong tier's current alias resolved per the loop-lane convention's capability tiers" rather than hardcoding an alias, satisfying .claude/rules/skill-bodies-state-current-rules.md.
• Compared eval cases 10–11 against the new run.md prose and check-evals-quality.sh's expectations shape used by cases 1–9; both new cases are structurally consistent and contain no raw transcript content (.claude/rules/eval-case-transcripts.md).
• Confirmed work-items is a scripts/fragment-plugins.txt plugin, so the added changelog fragment (rather than a direct CHANGELOG line) is the correct release record, and the PR body opens with a compliant No related issue: <reason> line plus ## Summary/## Fix/## Verification/## Related (.claude/rules/pr-body-contract.md).
• PR title feat(work-items): ready each PR after create in ship run is valid Conventional Commits form.

No correctness or maintainability issues found that a careful senior reviewer would block or flag. The change is a documentation-only addition to an existing skill action plus matching eval cases; its behavioral claims are all backed by the skill it dispatches to, and nothing it changes is a mechanical check a linter/typechecker would already catch.

0 findings.

claude-lane-summary: lane=claude-review sha=f086e5fdbf5d32672cb6aebd7cb2be4d20867b6a run=38447044934

[github-actions]

claude-review has reviewed this pull request through f086e5f; a later push is reviewed from there.