A Claude review that posted nothing no longer finishes green: read-only tools end the denial churn, the job fails when no verdict was submitted, and the transcript survives the runner

[erikdarlingdata]

The lie

A Claude review run that posted nothing — no comment, no inline note, no verdict — finished green. Tonight that happened on three PRs across roughly thirteen paid runs (#3618, #3642 ×6, #3646); the guard (#2229/#3492) caught each one after the fact, and each cost a run, a guard cycle and a human's time.

The mechanism (verified from the swallowed runs' own result blocks)

num_turns 50 / permission_denials_count 18, 39 / 21, 18 / 17 — denials ≈ turns, then subtype: success and zero posts. The prompt says "The PR branch is already checked out in the working directory" and asks for a correctness / parity / security review, while --allowedTools permitted only the inline-comment tool and four gh pr verbs — no Read, Grep, Glob, no git. Every file open was a denial; after enough, the session ends without reaching the VERDICT PROTOCOL. Stochastic, so small diffs sometimes got lucky and a 37-file diff did not, five times on one head.

The change — one file, .github/workflows/claude-review.yml, byte-identical to #3656

1. --allowedTools gains read-only tools: Read, Grep, Glob, Bash(git diff:*), Bash(git log:*), Bash(git show:*). Nothing that writes.
2. The job fails when it posted no verdict: a stamp before the action, and after it a count of claude[bot] reviews with submitted_at >= stamp and a non-empty body (the inline-comment tool's carrier reviews are bodiless — The interval-hourly refresh recomputes one fleet-wide bucket per dirty hour and paid twelve index inserts per row for eleven indexes nothing reads; the capture-down alert read decompressed a server's whole collection_log to learn two statuses (#3597, partial) #3647 has two of them — while both verdict shapes must carry a body). Zero → exit 1 naming Claude review runs finish green having posted nothing: the allowlist forbids every read tool the prompt invites, denial churn ends sessions without a verdict, and the job never checks that it posted #3650/[CI] Review workflow can execute fully (real token spend) and post nothing - green check with vanished output #2229, result block in the log; "never ran" (this file ≠ default branch's copy) is named separately. Review step not success → notice, exit 0 (its own outcome is the story). gh api failure → UNCONFIRMED warning, exit 0 per [CI] Review guard hard-fails on an unguarded lookup 404 — a lookup failure becoming the verdict its own comments forbid #2309, so a transient API error cannot force a paid re-run; the guard stays the enforcement. A clean review is never silent on this repo (the prompt mandates an LGTM review), so zero is never legitimate and there is no false red.
3. Transcript retained: claude-execution-output.json → artifact claude-review-transcript, 7 days.

Not changed: prompt, verdict protocol, model, the Claude review step name the guard couples to, fetch-depth, permissions.

Landing — read #3656 first

claude-code-action refuses to run whenever a branch's claude-review.yml differs from the default branch's (main), so this file cannot land on dev alone without disabling review on every PR until the next release. #3656 lands the same commit on main first; this PR lands the instant its required checks are green afterwards, restoring main == dev for the file. Sequenced by hand — no auto-merge. Until #3656 merges, the guard here reads "Expected: this PR edits the workflow"; after it merges, this PR's copy equals main's and the guard passes on a re-run. The review itself refuses on this PR (cause 1 on the PR fixing it) and the new post-step reds the non-required review job with "Claude never ran" — expected; a human has reviewed the 150-line, one-file diff.

Verified

actionlint+shellcheck clean; yaml.safe_load ok; sentinel and step name unchanged; the post-step's shell run locally against live PR data in six cases (details on #3656); no test pins reference the workflow.

Closes #3650