diff --git a/.github/workflows/ci-bisect-caller.yml b/.github/workflows/ci-bisect-caller.yml
index bc344aa..d08efba 100644
--- a/.github/workflows/ci-bisect-caller.yml
+++ b/.github/workflows/ci-bisect-caller.yml
@@ -1,11 +1,10 @@
-name: CI Bisect Caller
+name: CI Bisect Caller v2
 
 on:
   push:
     branches: ['claude/**']
 
-permissions:
-  contents: write
+# NO permissions block — testing if job-level write in called workflow works
 
 jobs:
   ci:
diff --git a/.github/workflows/ci-bisect.yml b/.github/workflows/ci-bisect.yml
index ec9e054..3efc789 100644
--- a/.github/workflows/ci-bisect.yml
+++ b/.github/workflows/ci-bisect.yml
@@ -1,4 +1,4 @@
-name: CI Bisect Test
+name: CI Bisect Test v2
 
 on:
   workflow_call:
@@ -16,8 +16,7 @@ on:
         required: false
         default: true
 
-permissions:
-  contents: write
+# NO top-level permissions block here
 
 jobs:
   lint-php:
@@ -30,6 +29,14 @@ jobs:
     steps:
       - run: echo "lint php ${{ matrix.php }}"
 
+  phpcs:
+    name: PHPCS
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write  # job-level write for phpcbf commit-back only
+    steps:
+      - run: echo "phpcs"
+
   file-size:
     name: 300-line rule
     runs-on: ubuntu-latest