[finding] A contract-review PASS leaves ZERO trace on the PR itself — verdict on the card, label cleared, no review object — so a legitimate un-park is indistinguishable from an intruder from the PR side

Filed by the director seat (session session_01DxbNgzPMo4YuRBmGmCQp9m) out of the #13412 incident. Unassigned — recording for the skills lane's own triage.

The measured cost

#13412 (p1, security) was filed, investigated and adjudicated because two PRs (#13371, #13409) were un-parked by a legitimate contract-review PASS and the observing seat could not tell: get_reviews → [], no PR comment, label gone. The PASS verdicts existed — on cards #10025 (10:22:09Z) and #12020 (10:23:29Z), pinned to the exact heads — but nothing on the PR pointed at them. The observer did the reasonable read (PR side) and concluded "no review happened".

Cost of the gap in this one instance: one p1 security card, two good-faith re-parks reverting completed reviews, one director investigation, ~40 minutes of two PRs sitting re-parked after passing review.

The gap

The review-chain protocol (references/contract-review.md) says "结论一行写卡" — the verdict lands on the CARD. The PASS disposition (清标即落地) then clears the label on both carriers and flips the PR ready. Net effect on the PR: state changes with no attached explanation. The card→PR pointer exists (verdict names the PR); the PR→verdict pointer does not.

Proposed mechanical fix (skills lane to grade)

One sentence in the PASS disposition: post a one-line comment on the PR itself ("Contract review PASS at head <sha> — verdict: ") in the same stroke as the label clear. Same family as #13410 (the label-side visibility defect measured the same day: parked clause-② PRs invisible to reviewer scans because the label sat on the card only).

Refs: #13412 (the incident and its adjudication) · #13410 (label-side sibling) · #10025 / #12020 (the two verdicts) · references/contract-review.md (载体纪律)

Hold released — pm:on-hold → pm:queue (this stroke, 2026-09-12T13:48Z) — skills seat, session session_01MCLBsUgfykL74aU716rzVK (GitHub os-sales), working the 13:45Z half-state patrol rows that name this card (H52 open question; the H9 mention row on the Restart-when: line).

Release double-check (state-machine, both legs mechanical):

The condition of the LAST transition comment (5473083515, 2026-08-31T02:49Z): 「Restart-when: audit PM corpus audit (maintainer-directed): classify every instruction line — keep / duplicate / demote / delete — then rewrite and re-lock every ratchet #13597 Phase 2 rules the contract-review.md row.」 — fired: PM corpus audit (maintainer-directed): classify every instruction line — keep / duplicate / demote / delete — then rewrite and re-lock every ratchet #13597's Phase 2 was ruled through decision batch 3 ([Decision] Skills optimization program — batch 3 (5 items): DATA-F-07 defineHook() vs the platform's own examples · #13597 Phase-2 — X0 quote policy · CLAUDE.md excerpt form · the four-copy decision frame · cross-file line-budget moves #14685 items 2–5) and recorded on the audit at 2026-09-03T05:29Z (comment 5520981526); Phase 3 then rewrote references/contract-review.md (2a7feb96d, 2026-09-05, rules-only rewrite) and the file has moved eleven more times since (latest bc2bf01c8, 2026-09-11). The 48/48 ceiling this hold was parked on no longer exists: the file is 60 lines on origin/main 9c577c18 at 13:47Z.
No merged PR on this card newer than that comment (the card has no PR at all; the blocked-run branch claude/issue-13417-pass-pr-pointer carried no commits) ⇒ the release is not against a later landing.

Premise re-verified on the ref before re-queueing (origin/main = 9c577c18, 2026-09-12T13:47Z): the PASS disposition still posts NO PR-side pointer — git grep -n -i -E 'PASS at head|PR 上|指针|pointer' origin/main -- .claude/skills/pm-dispatch/references/contract-review.md → 0 hits, lit control in the same file git grep -c '清标' … → 4. The gap the card measured (#13412: one p1, two good-faith re-parks, ~40 min) is intact; the reader-side half (get_reviews reads empty ≠ not reviewed) is still the only half present.

The open question the H52 row names is answered by the ruling this hold waited for: the 2026-09-03 Phase-2 ruling item 5 (cross-file line-budget moves → A) admits a same-PR cross-file move under the no-total-increase gate, so the pointer sentence is funded by density or by a cross-file move, ⛔ not by a ceiling raise and ⛔ not by a new decision card. The dispatch word will carry that as the funding route; the dev derives the file's live ceiling from scripts/pm/check-skill-line-ratchet.mjs at dispatch time.

State after this stroke: priority:p2 · pm:queue · domain:skills · Task · no assignee (read back). Next: claimed by this seat in the lane's total order (p2 Task, oldest first; references/contract-review.md is touched by no open PR at 13:48Z).

Generated by Claude Code

Claim: PM loop round 1
Session: session_01MCLBsUgfykL74aU716rzVK (GitHub os-sales, skills seat), claimed at 2026-09-12T13:50Z
Branch: claude/issue-13417-pass-pr-pointer
Worktree: objectstack-issue-13417
Domain: domain:skills (graded p2 Task on 2026-08-31 by the skills seat, 5472805430; hold released this check-in, 5646283047, after its Restart-when fired)
File surface (region-declared): .claude/skills/pm-dispatch/references/contract-review.md — the PASS disposition line :38 「清标即落地:PASS ⇒ 同席同笔剥双载体;凡清标同笔留 provenance 评论,引记录 id 与所判 head。」 (currently 119 B). Scope narrowed on the ref before this claim: the Phase-3 rewrite already requires a provenance comment at every clear, and C6 of check-clause2-carriers.mjs reads the review record on the PR OR the card (「复核记录 = 一条评论落 PR 或卡」) — what the card measured is still open only in that the provenance comment's CARRIER is unpinned, so a clear recorded on the card side leaves the PR as blind as #13412 found it. The remaining delta is one wording change inside :38 pinning that comment to the PR (the un-parked carrier), ≤120 B, 60 → 60 lines (ceiling 60 in scripts/pm/check-skill-line-ratchet.mjs :475, headroom 0) — ⛔ no raise, ⛔ no second line; if the pinned wording cannot fit 120 B, the dev pays by density inside the same file (the 2026-09-03 Phase-2 ruling item 5 also admits a same-PR cross-file move under the no-total-increase gate, if density fails). Nothing else in the file; ⛔ no script change (C6 already reads both threads). SKILL.md's clause-② gate paragraph is untouched.
Container & model: S, mode:subagent, model: opus (references/** — default tier; the seat reviews at the contract-review tier); governed ⇒ draft PR at the human terminal with the four-piece, ⛔ never flipped ready by the seat
Clause-②: no
Thread-read: 5646283047 (the release record; six comments on the card at 2026-09-12T13:50Z, the newest is that release)
Serial constraints cleared: all 20 open PRs' file lists scanned at 13:48Z — none touches references/contract-review.md or check-skill-line-ratchet.mjs; verify lock free at 13:45Z; H17 index (13:45Z sweep) ∩ this face = ∅; disjoint from the in-flight #17728 face (SKILL.md, core-rules.md, seat-post-protocol.md). Premise on origin/main 9c577c18 (13:47Z): PR-side pointer wording absent (anchored grep 0, lit control 清标 ×4); the blocked-run branch of 2026-08-31 carried no commits — the dev starts the branch fresh from origin/main (force-with-lease is fine on an empty remote branch; if the remote branch exists with zero commits beyond main, reuse it).

Generated by Claude Code

os-dev-report

{
  "issue": 13417,
  "status": "done",
  "branch": "claude/issue-13417-pass-pr-pointer",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17856",
  "premise_still_valid": true,
  "summary": "Premise VERIFIED on origin/main 9c577c18a before editing: :28 and :38 read exactly as the dispatch quoted them, the anchored pointer grep over references/contract-review.md returned 0 hits (exit 1) with the lit control '清标' at 4. One line changed, :38, 60 lines in and 60 lines out, 119 B in and 119 B out: 「凡清标同笔留 provenance 评论」 becomes 「清标同笔落 PR provenance 评论」, so the provenance comment is pinned to the PR (the carrier that gets un-parked) while still citing the record id and the judged head. WORDING ADJUSTED from the dispatch's suggested shape, which does not fit: 「清标同笔在 PR 上留 provenance 评论…」 measures 126 B and the cheapest 「在 … 留」 spelling 123 B, both over check-skill-line-ratchet's MAX_LINE_BYTES = 120. Two byte-level adjustments, no rule dropped: the emphatic 「凡」 goes (its subject 「清标」 stays, so the clause still speaks about every clear rather than only this PASS stroke) and the pin uses the file's own verb for a comment landing on a carrier, 「落 PR」 as at :28 「一条评论落 PR 或卡」. No ceiling raise, no second line, no in-file density payment, no cross-file move, no script change, no SKILL.md or landing-operations.md edit, no changeset (.claude/** publishes nothing; skip-changeset applied on the PR and read back). Card assignee was os-sales on arrival (the PM's dispatch step 1); never written by me. PR is DRAFT and stays draft: governed surface (.claude/**).",
  "tests": "All readings in the dedicated worktree /home/user/objectstack-issue-13417, BASE 9c577c18a, exits captured before any pipe. (1) ON-DISK EDIT PROOF: the replacement asserted exactly 1 occurrence of the old line before writing and aborted otherwise; grep -cF old = 0 and new = 1 after, blob hash moved cdfe8d54b902cfa538eaef88031e2295c1dbd596 to 026294dbe3f0790ed4eb305aa80333e988419e02, HEAD blob control still carries the old line (count 1). (2) WIDTH AND COUNT: wc -l = 60; LC_ALL=C awk 'length($0)>120' over the file prints nothing; :38 measures 119 B (node Buffer.byteLength, same number). (3) GATES: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 14 commands from the tree (no paths passed by hand); all 14 run, all exit 0. One needed a re-run: pnpm --filter @objectstack/lint run check:doc-formula-expressions exited 3 (PREREQUISITE NOT MET, NOT a measurement) until @objectstack/formula + @objectstack/lint were built under bash scripts/pm/os-verify-lock.sh (its own line: 'VERDICT command-exit 0 · held the lock 1s · waited 0s'), then exit 0. Reconciled with --ran carrying each exit code: '14 derived famil(ies) accounted for — 14 run, 0 NOT-MEASURED (a DERIVED zero — all 14 recorded an exit code and none of them is 3)'. Gate verdict lines quoted, never a bare $?: '✓ check-skill-line-ratchet: .claude/skills/pm-dispatch/references/contract-review.md is 60 lines (ceiling 60; headroom 0).' and '… widest table row is 0 bytes (pin 0; headroom 0).'; 'check-nul-bytes: OK (scanned 8483 text file(s) … no raw ASCII control bytes)'; '✓ check-skill-id-lint: 27 file(s) clean'. The ratchet family was RE-RUN after the final commit on b54e3954e with a clean worktree: exit 0, same two lines. (4) CONTROL READING, no script changed: node scripts/pm/check-clause2-carriers.mjs --self-test exit 0, '546 cases pass'. (5) CONTROL-CHAR SELF-SCAN beyond the gate: grep -naP over the edited file, exit 1 (no match). (6) ACCEPTANCE GREP: pointer wording 0 hits on origin/main, 1 hit at :38 on this head; lit control '清标' 4 on both. (7) NOT MEASURED and stated as such: no ABLATION was run and none applies — nothing new is gated by this diff (C6 already reads both threads and is untouched), the ratchet's fail-at-61-lines direction was already proven on this card's 2026-08-31 run, and this edit adds no line; no package build, test or typecheck is owed either, because the diff touches no package (dispatch-gates scored 1 path, .claude/** only). Repo-wide scans (pnpm lint and the 52 artifact-roster, 11 wide-population, 14 changeset-dependent families) are CI's runs, named here rather than claimed.",
  "mcp_calls": "0 — no MCP GitHub call this run. Card body and all 7 comments, the PR create, the body read-back, the label write and its read-back all went through container REST (repo-scoped, probed green by the first-minute branch push); file and history reads were local git.",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: two script comments quote the OLD :38 verbatim and go stale with this edit — scripts/pm/check-half-states.mjs (H61 header, the whole line, labelled 'verbatim and untranslated') and scripts/pm/check-clause2-carriers.mjs (C6 docblock, 「凡清标同笔留 provenance 评论,引记录 id 与所判 head」). Not gate-enforced: no script reads contract-review.md at runtime except the ratchet for line counts, and H61's own pin asserts only 「清标即落地」, which survives; neither quote contradicts the new text, each is just less specific (no carrier pin). Left untouched because the dispatch fences this card to references/contract-review.md with no script change, and touching either would pull its self-test surface into this PR. Successor: whoever next edits H61 or C6 — named in the PR's Acceptance notes so the ACCEPT read has it.",
    "noted, not filed: the dispatch's suggested wording for :38 does not fit the 120-byte rule (126 B measured). Not a defect in anything shipped — recorded because the next dispatch on this file will hit the same arithmetic: the pin costs 7 bytes over the bare 「留」 spelling and the line had 1 byte of headroom."
  ]
}

Generated by Claude Code

ACCEPT — skills seat (session session_01MCLBsUgfykL74aU716rzVK, GitHub os-sales), contract-review tier, read on PR #17856 head b54e3954e at 2026-09-12T14:08Z (report 5646374200 read after the head).

Scope against the claim (5646288955): one file, one line. references/contract-review.md :38 「- 清标即落地:PASS ⇒ 同席同笔剥双载体;凡清标同笔留 provenance 评论,引记录 id 与所判 head。」 → 「- 清标即落地:PASS ⇒ 同席同笔剥双载体;清标同笔落 PR provenance 评论,引记录 id 与所判 head。」. The provenance comment is now pinned to the PR — the carrier that gets un-parked — and still cites the record id and the judged head; 「落 PR」 is the file's own verb for a comment landing on a carrier (:28). The wording deviation from the dispatch's suggested shape is accepted: the suggested spelling measures 126 B against the 120-B rule, and dropping the emphatic 「凡」 keeps the subject (every clear), so no rule is lost.

Read on the head, not the report: 60 → 60 lines (ceiling 60, headroom 0, no raise); :38 is 119 B in and 119 B out; no line over 120 B; no three-digit card id; single-parent commit on 9c577c18a (main has since moved to 7f625364 — no overlap, the file is untouched there); anchored grep for the pin → 1 hit at :38 on the head, 0 on origin/main, lit control 清标 → 4 on both; draft, no reviewers, no auto-merge; body carries Fixes #13417, no model identifier. Gates: 14 derived / 14 run / all exit 0 per the report, check-clause2-carriers.mjs --self-test 546 cases pass as a control (no script changed); CI at 2026-09-12T14:08Z: 12 success, 5 in progress (the human terminal sees the final state).

Acceptance: a PASS clear that follows this text leaves the PR thread carrying a comment naming the record id and the head, so get_reviews → [] no longer reads as "no review happened" — the exact blindness #13412 measured. C6 of check-clause2-carriers.mjs already reads the record on the PR or the card and needs no change.

Follow-up recorded on the seat post, not filed: two script comments quote the OLD :38 verbatim and go one clause stale (scripts/pm/check-clause2-carriers.mjs :274 docblock and :1963 message string; check-half-states.mjs H61 header). Neither contradicts the new text and none is gate-enforced; they ride the next PR that touches those scripts (named in the PR's Acceptance notes).

Governed ⇒ human terminal: needs-user-decision on PR #17856, 速读 posted there, reviews requested from os-zhuang and hotlong. ⛔ Not flipped ready, queued or approved by this seat. The card stays pm:dispatched + assigned until MERGED (landing record + residue clear then).

Generated by Claude Code

Landed — PR #17856 MERGED 2026-09-12T15:52:25Z as 4351033e7 (merged by os-zhuang through the merge queue after approval at the human terminal). Skills seat stay-behind record, session session_01MCLBsUgfykL74aU716rzVK (GitHub os-sales), 2026-09-12T15:53Z.

Verified on origin/main by git: the merge commit is an ancestor of origin/main and single-parent; references/contract-review.md :38 now reads 「- 清标即落地:PASS ⇒ 同席同笔剥双载体;清标同笔落 PR provenance 评论,引记录 id 与所判 head。」 — the PASS clear's provenance comment is pinned to the PR; 60 lines (ceiling 60, no raise). ACCEPT 5646385507, 速读 5646385743. The gap #13412 measured (a legitimate un-park indistinguishable from an intruder from the PR side) is closed by text; the two stale script quotations of the old :38 (check-clause2-carriers.mjs :274 / :1963, check-half-states.mjs H61 header) ride the next PR touching those scripts, as recorded on the ACCEPT.

Residue cleared in this stroke: pm:dispatched off, assignee cleared (read back). domain:skills and type stay. GitHub closes the card on the Fixes keyword.

Generated by Claude Code

fix(pm): H9's issue-ref class requires the reference at the declarati…

skills(pm-dispatch): the contract-review PASS leaves its provenance c…

Navigation Menu

Repository navigation

[finding] A contract-review PASS leaves ZERO trace on the PR itself — verdict on the card, label cleared, no review object — so a legitimate un-park is indistinguishable from an intruder from the PR side #13417

The measured cost

The gap

Proposed mechanical fix (skills lane to grade)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] A contract-review PASS leaves ZERO trace on the PR itself — verdict on the card, label cleared, no review object — so a legitimate un-park is indistinguishable from an intruder from the PR side #13417

Description

The measured cost

The gap

Proposed mechanical fix (skills lane to grade)

Activity

claude commented on Sep 12, 2026

claude commented on Sep 12, 2026

claude commented on Sep 12, 2026

claude commented on Sep 12, 2026

claude commented on Sep 12, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions