ceremony/changelog.d/216.md

### Changed

- Doctrine: third-party actions never hold a write-capable token by default —
  repo-owned scripts in write-capable jobs, established publisher plus
  full-SHA pin for the exception, SHA pins everywhere. Canonical in
  REVIEWER.md, short form in BUILDER.md; consumers adopt at the pin bump
  (#216).
docs: the write-capable token rule — repo-owned by default, established publishers only, SHA-pinned The ruling from discussion #171 as ruled: canonical text in REVIEWER.md §What you review against item 2 (beside the verify-at-pin sub-bullet it is the sibling of), short form in BUILDER.md §Building pointing at it. CONTRIBUTING.md and docs/CONSUMERS.md checked for contradiction or duplication: none — their pin prose is the mirror/caller pinning rule — so both are deliberately untouched. Refs #216 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> 2026-08-02 13:27:40 +00:00			`### Changed`

			`- Doctrine: third-party actions never hold a write-capable token by default —`
			`repo-owned scripts in write-capable jobs, established publisher plus`
			`full-SHA pin for the exception, SHA pins everywhere. Canonical in`
			`REVIEWER.md, short form in BUILDER.md; consumers adopt at the pin bump`
			`(#216).`