From e4d9005aca2dd7d2e0f602b395e1f0d164bfb6d2 Mon Sep 17 00:00:00 2001
From: codex-bot-andresmgsl
 <224985780+codex-bot-andresmgsl@users.noreply.github.com>
Date: Thu, 23 Jul 2026 16:52:58 +0000
Subject: [PATCH] fix: keep labels caller within pinned feature set

---
 .github/labeler.yml          | 2 +-
 .github/labels.conf          | 1 -
 .github/workflows/ci.yml     | 6 +++---
 .github/workflows/labels.yml | 2 --
 4 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/.github/labeler.yml b/.github/labeler.yml
index e523415..ad49b77 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -1,4 +1,4 @@
-# path → scope:* map for actions/labeler — the PR half of LABELS.md's scope
+# path → scope:* map for actions/labeler — the PR half of .ceremony/LABELS.md's scope
 # story (issues are hand-scoped at triage; paths only exist on PRs). Additive
 # only: sync-labels stays off in labels.yml, so a hand-applied scope survives.
 "scope:cli":
diff --git a/.github/labels.conf b/.github/labels.conf
index dc5432c..fcf4e06 100644
--- a/.github/labels.conf
+++ b/.github/labels.conf
@@ -1,5 +1,4 @@
 panel=claude-bot-andresmgsl codex-bot-andresmgsl grok-bot-andresmgsl kimi-bot-andresmgsl
-triage-actors=dan-claude-bot
 scope:cli|C5DEF5|bin/box — the command surface
 scope:installer|C5DEF5|install.sh, versioned installs, upgrade/uninstall
 scope:host|C5DEF5|host/ — setup, teardown, firewall, isolation stack
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1740489..bae2194 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,9 +32,9 @@ jobs:
         # `.github/` — and the whole release path (changelog-armed.sh, which
         # gates every PR, release-notes.sh, labels-reconcile.sh) went unlinted
         # while the comment above told the next author it was covered.
-        # Measured on this tree: dotglob adds exactly those three and nothing
-        # else — a checkout's `.git` carries no `*.sh` (its hooks ship as
-        # `*.sample`), so `**/*.sh` does not wander into it.
+        # Measured when this invariant was introduced: dotglob added exactly
+        # those three and nothing else — a checkout's `.git` carries no `*.sh`
+        # (its hooks ship as `*.sample`), so `**/*.sh` does not wander into it.
         #
         # The sweep below is the CLASS check, same shape as the eof_guard_sweep
         # in test/cli.sh (#112): the one-time fix is `dotglob`, but what keeps
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 8f3f5d5..a55e775 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -4,8 +4,6 @@ on:
   workflow_dispatch:                 # bootstraps missing labels on a fresh repo
   pull_request_target:
     types: [opened, reopened, ready_for_review, converted_to_draft, synchronize, labeled, unlabeled]
-  issues:
-    types: [opened, labeled, unlabeled, assigned, unassigned, closed]
 permissions:
   contents: read
   issues: write