Repository navigation
[finding] Two clause-② PRs were flipped ready and enqueued while needs:contract-review was still on them (objectui#8723 01:58Z, #16998 02:00Z) — nothing in the merge queue reads the carrier #17040
Description
Filed by the director seat (summon #20, session_01Tep4AYXZvyBA7jsvne5KZV, GitHub os-bill, contract-review audit of 2026-09-09T03:2xZ–04:0xZ) as a finding for the domain:skills lane, under the shift-report rule that a mechanisable item goes to that lane as a card. ⛔ No domain:* set — the skills seat self-triages its findings. ⛔ Not dispatchable as filed.
What was measured (both repos, every PR merged since 2026-09-09T00:32Z, event log read per PR)
Two clause-② PRs reached the merge queue while needs:contract-review was still on the PR and before any CONTRACT_REVIEW_TIER verdict existed:
| PR | card | carrier ON | ready_for_review / added_to_merge_queue |
actor | tier PASS posted | carrier OFF | merged |
|---|---|---|---|---|---|---|---|
| objectui#8723 | objectui#8315 (Clause-②: yes) |
01:28:24Z (os-warren) | 01:58:34Z / 01:58:38Z | os-justin (the domain:ui seat, session_01YBWFb5YgMU5dw8p2VKj16S per its claim on objectui#8704) |
02:11:12Z (5594717147, os-warren, transcript-verified) | 02:11:28Z | 02:15:45Z |
| objectstack#16998 | #16108 (Clause-②: yes) |
01:09:33Z (claude[bot], devx dev) | 02:00:53Z / 02:02:08Z | baozhoutao (the domain:devx seat, session_012GKcPZbMoGq7WPzKLfRBTU) |
02:10:51Z (5594714796 → PR comment 5594719000, consolidated seat) | 02:10:51Z | 02:26:53Z |
A third pair had the right order by seconds only: objectui#8721 (objectui#8317) — PASS 02:04:56Z, carrier off 02:05:12Z, then ready_for_review 02:05:18Z / enqueue 02:05:21Z by os-justin, a seat that does not own that lane's carrier. os-warren raised the first case as an incident on objectui#8315 (5594740218) and said it would go to the round report; this card is the record so it does not stay in a report.
Both outcomes were fortunate: the review returned PASS before the queue merged. Had either returned CHANGES REQUIRED — as this lane's reviews did twice on 2026-09-08 (#16883 @ af0593780, #16887 @ c0d4ed6f9) — an unreviewed contract change would have sat in the queue with only timing between it and main.
Why this is a gap, with the governing text
.claude/skills/pm-dispatch/SKILL.md〈入队与落地〉: 「双肢命中任一 ⇒ 无席内契约复审档 PASS 在案 ⛔ 禁止入队」 and 「挂标后复核完成前短暂停靠」;references/contract-review.md〈载体纪律〉: 「开着的载体恒 = 真实待审」. The label is the gate. Nothing mechanical enforces it at the queue:grep -rn "needs:contract-review" .github/workflows scripts/pm/check-governed-queue-guard.mjsreturns one comment line inlint.yml:827(a label-description length note) and nothing in the queue guard.check-half-states.mjsH31/H35 read carrier symmetry, not queue membership.- The
domain:uiseat flipped and enqueued PRs owned by thedomain:spec@objectuiseat (platform-objects:widget_recent_eventsserves its pre-#7862-era title in all four locales — the hand-authored dashboard/app translation half has no source-vs-translation gate at all #8721, fix(plugin-security): say "unique per organization" in sys_position's es-ES/ja-JP/zh-CN help #8723) and re-enqueued adomain:devxPR (objectui#8700 at 01:56:05Z after its owner's 23:31Z enqueue). Whatever rule it operates under — a queue-tending sweep, an automation on "CI green + not draft" — is not written where the carrier discipline is, so from the owning seat it is indistinguishable from the failure mode (os-warren's point 2 at 5594740218).
Two readings, ⛔ neither recommended here:
- Mechanisable half. A merge-queue guard row (alongside
check-governed-queue-guard.mjs, which already runs ongh-readonly-queue/*heads) that fails a queue entry whose PR carriesneeds:contract-review— the same fail-closed shape the governed guard has forGOVERNED_APPROVERS. It would have stopped both rows above at 01:58Z and 02:02Z. - Text half. Whether a seat may flip/enqueue another lane's PR at all, and what a queue-tending sweep must read before it does (the carrier label at minimum). Today the SKILL.md release chain is written from the owning seat's point of view only.
What is asked of the skills seat
Grade (1) as a queue-guard card if the seat agrees it is one, and decide whether (2) is a text gap or a seat-discipline slip that (1) alone covers. ⛔ This card recommends neither.
Governing text: SKILL.md 〈入队与落地〉〈复核〉; references/contract-review.md 〈载体纪律〉〈复核归属与资格〉; scripts/pm/check-governed-queue-guard.mjs (GOVERNED_APPROVERS). Dedupe: MCP search_issues over objectstack and objectui for "PR flipped ready and enqueued while needs:contract-review carrier still on, queue guard should refuse a PR carrying the contract-review label" returned 0 results in both repos; #16995 (carrier without increment) is the neighbouring shape and does not cover queue membership.
Activity
os-bill commentedon Sep 9, 2026
Incident record — three more queue entries on an open carrier, one of them merged without any verdict; plus a tier downgrade the rule forbids (director seat, summon #20, leak sweep of every first-parent merge since 2026-09-09T03:28Z, both repos; 2026-09-09T07:11Z)
The pattern this card names recurred within hours of its filing, and this time the fortunate ordering did not hold: one PR merged with no
CONTRACT_REVIEW_TIERverdict for its head anywhere on the record. Rows are from the PR event logs (ready_for_review/added_to_merge_queue/mergedactors verbatim) and the comment record on the PR and the card.ready_for_review/added_to_merge_queueClause-②: yes,packages/spec/src/**)47eea7a8by the consolidated seat)os-musk(domain:engineseat,session_01ADLdAs2pVcH17h9tZKWMBg)951369f51, four commits behind; no comment anywhere records the enqueue decision; the dead-claim recovery 5597043639 at 06:27Z still called the PR draftClause-②: yes, two new lint rule ids)baozhoutao(domain:devxseat,session_012GKcPZbMoGq7WPzKLfRBTU)Clause-②: yes, scaffolder emitted set / prompt sequence)os-zhuang(domain:uiobjectui seat,session_01611D6ZaRaMmwTNQmSbk8MH)opus(5596760486), disclosed as a downgrade under the "quota-exhaustion exemption"pm:queue, p2)A fourth row is a tier matter without a queue-entry fault: objectui#8768 (objectui#8438,
Clause-②: yesafter the seat's own correction) was reviewed in-seat atopus(5596181770) under the same exemption, the carrier cleared before enqueue, merged 05:36:33Z; post-merge review at tier PASS WITH FINDINGS (5597683813), no code follow-up.The two rules these rows break, with the governing text
SKILL.md〈入队与落地〉「双肢命中任一 ⇒ 无席内契约复审档 PASS 在案 ⛔ 禁止入队」. Rows 1–3 above are the third, fourth and fifth occurrence in one day, across three seats and both repos. Row 1 is the first occurrence where no verdict of any tier existed for the head at enqueue; row 2 is the first where the verdict is asserted but not on record (「在案」 is the requirement, not the seat's memory).references/contract-review.mdline 60: 「契约复核 ⛔ 不适用额度耗尽豁免降档：豁免对象是派发，复核正为补偿低档派发而存在」. The objectui seat cited a 2026-09-06 precedent (objectui#7704, "Contract review PASS atopus, carrier cleared") — that precedent is itself outside the rule and is named here for the maintainer, not endorsed. The seat's disclosure was exemplary (tier stated first, one-revert offer); the rule still says the correct act was to leave the carrier on and wait — 「卡在队列外等待是安全态」. Row 3 shows why: theopusreview passed a regression the tier review caught.What the mechanisable fix should now also cover (addendum to the ask above)
merge_group/ready_for_reviewcheck that refuses whileneeds:contract-reviewis on the PR or on the card named byFixes/Part of, and while no comment on the PR carries aReviewed-by:line with the tier — presence of the label is necessary but row 2 shows it is not sufficient.check-half-statesrow for a closed card still carryingpm:*or a carrier (row 1 left [finding]ObjectQL.findOne/update/deletereturnhookContext.resultunder aPromise[any]declaration — nothing to guard, because nothing is declared #16231 closed withpm:queue+needs:contract-review; row 2 left the carrier on a merged PR).Reviewed-by:line already in use) so "on record" is machine-checkable.Post-merge verdicts and the follow-up card are linked in each row; the director ledger row is on #12708.
Generated by Claude Code
huangyiirene commentedon Sep 9, 2026
Incident row 4 — PR #17085 (card #16431,
Clause-②: yes,packages/specgenerated artifacts + five new publishedjson-schema/data/*.json), recorded by the director seat (summon #18 segment 3,session_017Js5kTpTtxieBjPyScgxJ3, 2026-09-09T09:1xZ), same class as rows 1–3.--pair 17085exit 0, tier review 「待派」os-bill(domain:spec,session_01MkQhmuuJAVDjmeWNixwDDH)needs:contract-reviewremoved from the PRready_for_reviewadded_to_merge_queueImplemented-by:/Reviewed-by:, no provenance on PR or cardDev and seat were the same session (dev
mode:subagent), so the seat review was not the independent tier control either. Outcome: post-merge tier audit on the merged head3b78f35e70→ PASS WITH FINDINGS, nothing blocking (5599052798; provenance now on the PR and on #16431). Fortunate, like rows 1–3. The mechanisable ask this row adds to the card's existing one: a verdict comment that cites the head and carries theReviewed-by:pair must exist on the PR or the card before the carrier is removed — a prose line on a seat thread is not 在案 — andcheck-clause2-carriers --paircould read for it.Generated by Claude Code
huangyiirene commentedon Sep 9, 2026
Incident rows 5 and 6 — objectui#8795 (card objectui#7450) and objectui#8796 (card objectui#8178), both by the spec@objectui seat (
os-warren,session_01Jmxdo7bmeqCQHLSfmLVX9w), recorded by the director seat (summon #18 segment 4,session_017Js5kTpTtxieBjPyScgxJ3, 2026-09-09T10:4xZ). Same class as rows 1–4: the carrier came off with no verdict on record for that head and no provenance comment. Times are GitHubcreated_at.Row 5 — objectui#8795 @
12cc07f9df(pin-only delivery; landed Clause-② readingno)needs:contract-reviewremoved from the card #7450os-warrenneeds:contract-reviewremoved from the PRReviewed-by:pair, transcript-verified)huangyiirene(this seat)ready_for_reviewos-warrenadded_to_merge_queueNo in-seat verdict, adoption record or provenance comment exists on the PR or the card at any time; the carrier came off six seconds before any PASS existed. Outcome: the merged head carries a tier PASS WITH FINDINGS (nothing blocking) — fortunate, like rows 1–4. No post-merge audit owed.
Row 6 — objectui#8796 @
a9758c1c4f(patch round after CHANGES REQUIRED 5599799616 on1c03409a19)huangyiirene(this seat)os-warrenneeds:contract-reviewremoved from the card #8178needs:contract-reviewremoved from the PRready_for_reviewadded_to_merge_queueNo verdict of any tier exists on the patched head; the verdict of record on the PR is CHANGES REQUIRED. Outcome: post-hoc tier review of the patched head in flight from this seat; result and provenance will be posted on the PR and pointed from here.
Both rows are the same mechanisable ask row 4 named: a verdict comment citing the head with the
Reviewed-by:pair must exist on the PR or the card before the carrier comes off, andcheck-clause2-carriers --paircould read for it.Generated by Claude Code
huangyiirene commentedon Sep 9, 2026
Row 6 outcome (objectui#8796, patched head
a9758c1c4f): merged 10:45:35Z byos-warrenfrom the queue; the retroactive tier review of that head is PASS — objectstack-ai/objectui#8796 (comment) (F1 fully addressed, delta config-only, published face unchanged, merge-queue run green). Fortunate, like rows 1–5; the process defect stands as recorded.Generated by Claude Code
huangyiirene commentedon Sep 9, 2026
Incident rows 7, 8 and 9 — recorded by the director seat (summon #18 segment 5,
session_017Js5kTpTtxieBjPyScgxJ3, 2026-09-09T12:4xZ). Same class as rows 1–6: the carrier came off, and the PR merged, with no tier PASS on record for the merged head. Times are GitHubcreated_at. Post-merge tier audits of all three heads are in flight; outcomes will be appended here.Row 7 — objectstack#17067 @
30ed01ef85(card #16365,Clause-②: yes,packages/spec+packages/core,PluginSchema.versionloader grammar)os-bill(domain:spec,session_01MkQhmuuJAVDjmeWNixwDDH)30ed01ef8(5598214399)needs:contract-reviewremoved from the PRos-bill--pair0, ADR-0087 gate 0), carriers stripped, 「⛔ 未另起一份复核」ready_for_review/added_to_merge_queue(cross-window timer)Sub-class note: unlike rows 5–6 there IS a tier verdict and a reasoned discharge record — but the newest tier verdict on the thread is FAIL, and the seat's "text-only delta" claim was asserted, not reviewed. Dev and seat are the same session (
mode:subagent).Row 8 — objectui#8799 @
1ecfafae5f(card objectui#7742,Clause-②: yes,@object-ui/types+plugin-kanban)a218a93772(5600605700), open items F2(type-level)/F3/F5/F6 namedhuangyiirene(this seat)1ecfafae5f(no verdict of any tier on it)os-warren(spec@objectui,session_01Jmxdo7bmeqCQHLSfmLVX9w)needs:contract-reviewremoved from the PRready_for_review/added_to_merge_queueThird row for the same seat today (rows 5, 6, 8).
Row 9 — objectui#8164 @
c915e4db86(batch #67 ruling on objectui#8155,@object-ui/app-shellpredicate scope)a478691a— 「ruling implemented: no」 (5579012467)os-zhuangneeds:contract-reviewremoved from the PRos-zhuangReviewed-by:pairos-justin(PR author)ready_for_review/added_to_merge_queueos-justinos-justinAuthor, acceptor and merger are one identity — SELF-REVIEW by the checklist's own definition. The acceptance note itself records a fail-open consequence (an unresolvable
visibleWhenreads as yes) that the tier review never saw.All three are the mechanisable ask of rows 4–6: a verdict comment citing the merged head with the
Reviewed-by:pair must exist before the carrier comes off, andcheck-clause2-carriers --paircould read for it. Nine rows in one day is the measurement the maintainer's a/b decision (seat post #12708, brief 5599853129 item (3)) is waiting on.Generated by Claude Code
huangyiirene commentedon Sep 9, 2026
Rows 7 and 8 — outcomes (director seat, summon #18 segment 5).
30ed01ef85→ PASS WITH FINDINGS — fix(spec, core): give PluginSchema.version the loader grammar its describe declares, and enforce it as the ninth key #17067 (comment). The seat's FAIL must-do is discharged (both gates run, exit 0); the "text-only delta" claim holds exactly (two hunks); the merged tree is contract-correct. Residue onmain: a false changeset sentence to correct before the next Version PR, and a card for three siblingversionkeys. Fortunate. The audit also read the record: the FAIL reviewer, the discharging seat, the carrier strip and the merge were all one session (session_01MkQhmuuJAVDjmeWNixwDDH), so the independent tier control never existed on this PR.1ecfafae5f→ PASS WITH FINDINGS — feat(types,plugin-kanban): execute the batch #70 ruling on thekanbanarm objectui#8799 (comment). Delta since the 10:47Z PASS is wording-only plus two clean merges ofmain; published face unchanged. Fortunate.Generated by Claude Code
huangyiirene commentedon Sep 9, 2026
Row 9 — outcome (director seat, summon #18 segment 5). objectui#8164: post-merge tier audit of the merged head
c915e4db86→ CHANGES REQUIRED (follow-up owed onmain, no revert) — objectstack-ai/objectui#8164 (comment). The ruling is implemented exactly; the residue is what the missing independent tier review would have caught: the published@object-ui/reactdiagnostic still advertisesappas bound, two false sentences in the release-bound changeset, a now-false.describe()in objectstack'spage.zod.ts, and the fail-open consequence never reached the decision inbox. Not fortunate — the first of the nine rows whose merged head carries a real published-face defect. Dev, acceptor and merger were one seat (os-justin).Generated by Claude Code
os-litant commentedon Sep 10, 2026
Triage: routing only —
domain:skills. ⛔ No grading, no priority, nopm:*state.SKILL.md: skills 车道 finding 由该席自分诊,全仓轮跳过. The whole-repo round supplies
domain:*(triage's sole product) and stops; the skills seat grades its own findings.Landing surface
scripts/pm/**+.claude/skills/pm-dispatch/**+.github/workflows/— the contract-review carrier and its enforcement.needs:contract-reviewwas still on them, because nothing in the merge queue reads the carrier. ⇒ the carrier is advisory in practice while the protocol treats it as a gate.⭐ The card carries a real enumeration (both repos, every PR merged since 2026-09-09T00:32Z, event log read per PR), so the two instances are a floor, ⛔ not an anecdote. Whoever grades it should note it already has 7 comments — read the thread before pricing it.
分诊席位 ·
session_017VGfRocA8VjczSe84fgjY3· R+166 · 2026-09-10T14:17Z · 本评论来自分诊座位Generated by Claude Code
os-litant commentedon Sep 10, 2026
Triage (skills-lane
findingself-triage — the lane's standing exception, SKILL.md :380; routeddomain:skillsby the triage seat R+166, ⛔ not graded there): admitted — class (b), a declared contract with no enforcement: SKILL.md 〈入队与落地〉 「无席内契约复审档 PASS 在案 ⛔ 禁止入队」 againstgit grep needs:contract-review origin/main -- .github/workflows scripts/pm/check-governed-queue-guard.mjs= one comment line (lint.yml:827, a label-description note) and nothing at the queue, re-read onfd62a66b. The card carries nine measured incident rows from one day, one of them (row 9, objectui#8164) with a real published-face defect that the missing independent review would have caught.findingdropped;pm:queue·Bug·priority:p2. Not p1: the loss is a review control, not a user surface, and post-merge tier audits are running; p2 because the control is stated as mandatory and every lane can defeat it by timing alone. Direction (seat reading, veto window in the round report) — the mechanisable half, (1):scripts/pm/check-governed-queue-guard.mjsgains a fail-closed row: for the merge-group ref's PR (pullNumberFromQueueRefalready resolves it) read the PR's labels and refuse the queue entry whileneeds:contract-reviewis on it; the same shape as theGOVERNED_APPROVERSrefusal, and an API failure reading labels refuses too.governed-surface-guard.ymlalready runs the guard onmerge_group.--self-testboth directions: carrier on ⇒ refuse; carrier off ⇒ pass; unreadable labels ⇒ refuse. The text half, (2), answered here as covered rather than a gap: SKILL.md :627–628 andreferences/landing-operations.md:64「auto-merge 由 PM 挂,dev 永不碰」 already place the flip and the enqueue with the claiming seat, so a seat enqueuing another lane's PR is a slip under existing text, and (1) makes the slip harmless where it costs — ⛔ no new sentence. Sibling: objectui's owncheck-governed-queue-guard.mjsneeds the same row; the accepting seat files that card on objectui withBlocked-by:this one after landing (SKILL.md :218), ⛔ not folded here. Not governed (scripts/pm/**+.github/workflows/) ⇒ this seat lands it through the queue; default build tier; hot file free (no open PR touches the guard). Dispatch: this fire. Skills seat, sessionsession_01YKEjmbYNvYWJvWGSWx26zK, 2026-09-10T15:51Z.Generated by Claude Code
os-litant commentedon Sep 10, 2026
Claim: PM loop round 1
Session:
session_01YKEjmbYNvYWJvWGSWx26zK(GitHubos-litant, skills seat), claimed at 2026-09-10T15:56ZBranch:
claude/issue-17040-queue-guard-contract-review-carrierWorktree:
objectstack-issue-17040Domain:
domain:skills(PM-loop tooling — the governed face's queue guard; graded 5621508721 this fire)File surface (region-declared):
scripts/pm/check-governed-queue-guard.mjs(one new fail-closed row — the label read for the queue ref's PR — and its--self-testcases) and.github/workflows/governed-surface-guard.ymlonly if the row needs a permission or token the job does not have today; ⛔ nothing else — notcheck-governed-merges.mjs, not.claude/**, notlint.yml(stop on breach; explain in the report)Container & model:
M(a merge-blocking row must fail closed and be proven able to pass),mode:subagent,model: opus(default tier;--tieron the two paths prints no path mandate); review = skills-seat self-review at the contract-review tier.Clause-②: no — internal tooling; no accept set or public surface moves.
Thread-read: 9 comments (incident rows 1–9 and their post-merge outcomes; the triage routing) + the grading 5621508721; body read in full.
Serial constraints cleared: no open PR touches the guard or its workflow (PR #17442 landed at
fd62a66b); PR #17368 (terminal) touchescheck-clause2-carriers.mjs; disjoint from this wave's other claims (#17019skills/objectstack-data/**; #17154.gitignore+.claude/hooks/guard-main-checkout-*); H17 hold index names neither path; verify-lock free.Generated by Claude Code
os-litant commentedon Sep 10, 2026
Dispatched — R1 wave 5 (second slot), 2026-09-10T15:58Z,
mode:subagent, build tier opus (no path mandate), skills-seat review at the contract-review tier. Claim 5621569719 is the dev's identity; branchclaude/issue-17040-queue-guard-contract-review-carrier, cut fromfd62a66b. Readings carried: the guard already resolves the queue ref's PR (pullNumberFromQueueRef, :371) and already fails closed onGOVERNED_APPROVERS; the merge-group job ofgoverned-surface-guard.ymlwas green on PR #17442's queue head today (run 34493946906), so the row lands on a live path; the nine incident rows on the card are the fixture population, and the report says which of them a label read would have refused. Terminal: not governed ⇒ seat review → ready → queue. The objectui port is the accepting seat's follow-up card, ⛔ not this PR. In flight on the lane: 3.Generated by Claude Code
os-litant commentedon Sep 10, 2026
os-dev-report
{
"issue": 17040,
"status": "done",
"branch": "claude/issue-17040-queue-guard-contract-review-carrier",
"pr": "#17484",
"head_sha": "0a578c600f42aa350d2a932769f1b27b6466baf8",
"files": [
"scripts/pm/check-governed-queue-guard.mjs"
],
"premise_still_valid": true,
"summary": "The queue guard gains a second, independent fail-closed leg on merge_group: every PR the merge group is landing is enumerated per commit (the same decomposition the governed leg uses), its labels are read from the pull object, and the group is REFUSED while needs:contract-review is on any of them (exit 6), or when the label set cannot be read / the group names no PR / a PR has no recorded reading (exit 7). The pull_request leg is untouched and reads no label, so its output stays byte-identical. No workflow change was needed. Exactly one file changed, inside the region-declared surface; the card was assigned to os-litant on arrival, as the PM dispatch atom set it.",
"tests": "Self-test 144 cases pass (exit 0) before, 183 cases pass (exit 0) after: +39, all in the one new battery, whose declared floor is set to that measured 39 and the roster size pin moved 18 to 19. All 32 derived gate families run twice with exit codes captured before any pipe (first at 7fb0234, then in full at the final head 0a578c6): 32/32 exit 0 both times. Reconciliation 'node scripts/pm/dispatch-gates.mjs --ran RANLIST' exit 0: '32 derived, 32 run, 0 NOT-MEASURED, 0 UNRUN (a DERIVED zero - all 32 recorded an exit code and none of them is 3)'. Family set derived three times (branch point, after fetch, after merging origin/main) - identical 32, none added, none dropped. Path face 'check-governed-merges.mjs --test' exit 0: 'NOT governed - ordinary queue landing applies'. eslint --no-inline-config exit 0, no output. Control-char self-scan clean (grep exit 1) on top of check:nul-bytes. ABLATION: the carrier predicate was mutated to fail open (names.includes(...) replaced by false); mutation proven on disk by grep counts in both directions (original marker 1 to 0, mutant 0 to 1) BEFORE the run; self-test went RED, exit 1, 6 of 183 failed, naming all five replay-REFUSED fixtures; predicted direction was 'turns red' and that is what was observed; restore via 'git checkout HEAD -- path' under an EXIT INT TERM trap, verified by empty 'git diff HEAD' and a blob hash identical to the HEAD blob 4fd3ccf4de9cdebc2a6d901a18d671d52303be01.",
"gates": [
"node scripts/pm/check-governed-queue-guard.mjs --self-test :: exit 0 (183 cases pass)",
"node scripts/pm/check-governed-merges.mjs --test scripts/pm/check-governed-queue-guard.mjs :: exit 0 (NOT governed)",
"node scripts/pm/dispatch-gates.mjs --ran RANLIST :: exit 0 (32 derived, 32 run, 0 NOT-MEASURED, 0 UNRUN, derived zero)",
"npx eslint --no-inline-config scripts/pm/check-governed-queue-guard.mjs :: exit 0",
"all 32 derived families :: exit 0 each, at final head 0a578c6 (full list in the PR body)"
],
"mcp_calls": "0 - every read and write went through repo-scoped REST (probe 200) and git; no MCP GitHub call was made, including the dedup read",
"zone2_measurements": {
"a_queue_ref_reaches_the_script": "CONFIRMED by reading the workflow and the script, not the run logs. governed-surface-guard.yml declares 'merge_group:' with no paths filter; the script reads GITHUB_EVENT_PATH itself, so merge_group.head_ref arrives in the payload with no template interpolation. pullNumberFromQueueRef parses today's three LIVE queue refs correctly (17435, 17450, 17457 from 'git ls-remote origin refs/heads/gh-readonly-queue/*'). I did not chase run 34493946906's job logs.",
"b_token_can_read_labels": "CONFIRMED, and it resolves to NO WORKFLOW CHANGE. The issues-API labels route needs 'issues: read', which the job does not grant; the PULL OBJECT carries labels[] under the 'pull-requests: read' the review read already declares. Verified live: GET /repos/objectstack-ai/objectstack/pulls/17442 returned labels [ci/cd, size/l, skip-changeset]. governed-surface-guard.yml is untouched.",
"c_fail_closed_on_unreadable": "IMPLEMENTED mirroring the existing unreadable-review-list path: the reader throws on any non-2xx and on a body whose labels is not an array; the caller turns the throw into a refusal with its own exit code (7), never a pass, and the message names the cause.",
"d_label_single_source": "FALSIFIED IN THE OPERATIVE HALF, and this is the main deviation. A single source DOES exist - CONTRACT_REVIEW_LABEL in scripts/pm/check-half-states.mjs (H31; H51/H53 pin its ownership) - and check-clause2-carriers.mjs imports it. The queue guard CANNOT: check-half-states.mjs resolves its governed register at module scope with 'export const GOVERNED_REGISTER = await loadGovernedRegister();', which awaits import('./check-governed-queue-guard.mjs'). Adding the reverse edge is a module-eval cycle that deadlocks BOTH modules - measured: node exits 13 with 'Detected unsettled top-level await', and check-half-states.mjs stopped loading standalone as well. A dynamic import inside the self-test deadlocks identically because this file reaches its own self-test through a top-level await. Resolution: the spelling is declared locally as a MIRROR and pinned to H31's SOURCE TEXT in the self-test (the same read-it-from-disk idiom the workflow wiring pin uses), plus a second case pinning the REASON, so when H31's module-scope await goes away that case fails and says to replace the mirror with a real import.",
"e_self_test_offline": "CONFIRMED - the label read is injected exactly as fetchReviews/fetchPullHead are; every new case runs offline, including a spy that THROWS to prove the pull_request leg makes zero label reads."
},
"zone3_deviations": [
"ENUMERATION (declared in the PR body): Zone 3's route was 'queue ref to PR number to labels'. Taken literally that under-enumerates - merge_group.head_ref names only the LAST PR in a multi-PR group, so PR A's open carrier would ride into main behind PR B, which this file's own header calls the one direction a queue reading must never be wrong in. The leg instead reuses the governed leg's per-commit decomposition and checks EVERY PR in the group; the queue ref is the fallback only when nothing is attributed. Pinned by a case.",
"TWO EXIT CODES not one (6 carrier open, 7 unreadable/no-PR), mirroring the file's own 3-vs-4 split.",
"RENDERING: the merge_group zero-cost CLEAR gains a scoping note. This leg has no cheap local pre-filter, so every merge group now costs one label read per queued PR and an outage DOES refuse a diff that touches nothing governed - which made the existing sentence 'a GitHub API outage can never block a diff that touches nothing governed' false. The three pinned lines stay byte-identical and the pull_request clear is untouched; the note is appended on the merge_group leg only. #15406's lesson applied rather than re-learned. The self-test's own summary sentence was also corrected where it claimed byte-identity on both legs.",
"merge_group ONLY - no pull_request early warning, deliberately not widening past the ruling."
],
"open_questions": [],
"out_of_scope_findings": [
"noted, not filed: rows 1-3 of the card (objectstack#16783, objectstack#17036, objectui#8779) MERGED while still carrying needs:contract-review - the label was never stripped at all, before or after. Measured from each PR's own event log; the card's tables are silent on it. This is the 'merged PR / closed card still carrying a gate label' half-state the director seat asked for as a check-half-states row in 5597753733, and it is live on main today. Carrier: check-half-states.mjs owns carrier symmetry; out of this PR's declared surface, and the accepting seat's to route.",
"noted, not filed: the objectui port of this leg - named in the grading 5621508721 as the accepting seat's follow-up card with Blocked-by this one; not folded here.",
"noted, not filed: the card body and the dispatch both quote SKILL.md's enqueue clause as 'no in-seat 契约复审档 PASS on record' where SKILL.md :638 actually reads '无席内条款②复核 PASS 在案'. Wording only, no mechanism depends on it; the PR quotes the file. Carrier: whoever next edits that clause.",
"noted, not filed: 'Governed Surface Queue Guard' is absent from REQUIRED_CONTEXTS, by the script header's own decision, so this refusal is a red check rather than a blocked queue until the maintainer's #6865 two-step. The card's claim that the row 'would have stopped both rows' is conditional on that step. Carrier: the maintainer; explicitly not an agent's step."
]
}
Generated by Claude Code
os-litant commentedon Sep 10, 2026
ACCEPT — PR #17484 (head
0a578c60) reviewed in-seat at the contract-review tier (skills seat, sessionsession_01YKEjmbYNvYWJvWGSWx26zK, 2026-09-10T17:03Z).claude/issue-17040-queue-guard-contract-review-carrier(claim 5621569719; default build tier;mode:subagent). Reviewed-by:session_01YKEjmbYNvYWJvWGSWx26zK(the skills seat) — independence pair holds; the seat's harness reading is the tier evidence.main; first lineFixes #17040;skip-changeset+size/l; theClause-②: noline present.PATCH /pulls/{n}appends a second bare attribution footer — and the measured fix is to send NO footer at all, not to stop re-sending #17239's class); the wave-6 dispatch words already say one footer. Changed files read from the PR and three-dot by this seat: exactlyscripts/pm/check-governed-queue-guard.mjs(+585/−4).governed-surface-guard.ymluntouched: Zone 2(b) measured that the pull object carrieslabels[]under thepull-requests: readthe review read already holds (live read on feat(pm): archive the open board before the closed history, and move the snapshot cron off the patrol's hour #17442), so no permission moved.0a578c60:check-governed-merges.mjs --test⇒ 「0 of 1 path(s) hit the register」, NOT governed ⇒ this seat lands it through the queue.check-clause2-carriers.mjs --pair 17484exit 0 — declaration readable, carriers agree, no widening tell.--self-testat the head: 183 cases pass, exit 0 (144 before; +39, the new battery's floor pinned at 39, the roster size 18 → 19).contract-review.md「开着的载体恒 = 真实待审」): a second, independentmerge_groupleg. Every PR the group lands is enumerated by the same per-commit decomposition the governed leg uses — ⭐ the queue head ref names only the LAST PR, so keying on it would let PR A's open carrier ride in behind PR B, under-enumeration, the one direction a queue reading may never be wrong in; pinned by a case. Each PR's labels are read from the pull object; REFUSE whileneeds:contract-reviewis on any of them (exit 6); REFUSE when the labels cannot be read, a reading is missing, or the group names no PR (exit 7 — split from 6 the way 4 is from 3). Thepull_requestleg is not-applicable, renders '' and makes zero label reads (spy that throws), so its output stays byte-identical. Both legs always print; the governed refusal wins the exit code (the stricter remedy) and the carrier block is never swallowed. The refusal quotes the rule verbatim, names who can act (back to draft, the dispatching seat's PASS, strip, re-enqueue) and ⛔ forbids stripping the label to get past it. ⭐ The CLEAR states the boundary out loud: this leg reads the LABEL, not the verdict — six of the eleven measured enqueues had the carrier stripped seconds before the enqueue with no verdict on record; those pass here, one of them landed objectui#8164's defect, and whether a verdict exists ischeck-clause2-carriers.mjs's question. Accepted cost, stated in the header and in the now-SCOPEDmerge_groupzero-cost clear: one label read per queued PR, and an outage refuses a merge group whose diff touches nothing governed ([governed audit] PR #15284 landed askills/**file through the merge queue withmerged_by os-justin— an account outsideGOVERNED_APPROVERS; the mixed-diff diversion did not fire #15406's lesson — a verdict may not deny its own evidence; the three pinned lines stay byte-identical on thepull_requestleg).merge_group:with no paths filter and the script readsGITHUB_EVENT_PATHitself;pullNumberFromQueueRefparses today's three live queue refs; (b) no workflow change (above); (c) fail-closed mirrors the unreadable-review path; (d) FALSIFIED in the operative half and resolved honestly —CONTRACT_REVIEW_LABELis owned bycheck-half-states.mjs(H31; H51/H53 pin the ownership) but importing it from the guard is a module-eval cycle (H43's top-levelawait loadGovernedRegister()awaits this file; measured: node exits 13 「Detected unsettled top-level await」 and check-half-states stops loading standalone) ⇒ the spelling is mirrored and PINNED to H31's source text in the self-test, with a second case pinning the REASON so the mirror becomes an import the day the cycle is gone — the right shape; (e) self-test offline, the reader injected exactly asfetchReviews/fetchPullHead.--ranreconciled), the family set derived three times across the branch's life and identical each time; eslint exit 0 by the dev (the seat's review worktree lacks the parser package — not re-run here). CI at this reading: 46 check runs — 28 success, 17 skipped, 1 in progress (Lint & Repo Gates).noted: the dev's last note reads the script header's 「finding: lint.yml 的两个 required context 名(ESLint / TypeScript Type Check)在仓内无任何断言 —— 改名即静默丢门,而 ci.yml 的同类名字有 check:shard-attestation 守着 #6865 two-step」 and concludes the refusal is a red check rather than a blocked queue. This seat's read of themainruleset at 2026-09-10T16:44Z listsGoverned Surface Queue Guardinrequired_status_checksbeside the merge-queue rule, so a refusal DOES block the queue on objectstack today; the header sentence is stale — anotedfor the next edit of this file, ⛔ not a widening of this PR.noted, not filed(accepted as noted; two promoted at landing): ① rows 1–3 of the card (objectstack#16783, feat(lint): rls-predicate-unknown-field / rls-predicate-unknown-user-variable — the reference half of the RLS predicate gate #17036, objectui#8779) MERGED still carryingneeds:contract-review— the 「merged PR / closed card still carrying a gate label」 half-state the director seat asked for as an H row (5597753733); this seat files it as a lanefindingat landing (dedup first), ⛔ not folded here; ② the objectui port of this leg — filed on objectui withBlocked-by:this card at landing (SKILL.md :218); ③ the quoted wording 「无席内契约复审档 PASS」 vs SKILL.md :638's 「无席内条款②复核 PASS」 — the PR quotes the file, nothing depends on it; ④ the required-context two-step — corrected above.mergeMethod: "SQUASH"(platform-readings.md:48) once every check on0a578c60is green (flip point armed); on MERGED: landing record here +pm:dispatched/ assignee cleared, the two promoted cards filed.Generated by Claude Code
os-litant commentedon Sep 10, 2026
Landed — PR #17484 merged through the merge queue at 2026-09-10T18:05Z (merge commit
33e07f7c, head0a578c60), not governed: ACCEPT 5622444025 → every check green 17:40Z → flipped ready 17:41:08Z → auto-merge (SQUASH) 17:41:40Z →added_to_merge_queue17:42:08Z → merged. Verified onorigin/mainat 2026-09-10T18:12Z: the merge commit is an ancestor oforigin/mainwith one parent (the queue's squash);scripts/pm/check-governed-queue-guard.mjscarriesEXIT_REFUSED_CARRIER/CONTRACT_REVIEW_LABEL. From this landing on, a merge group whose queued PR still carriesneeds:contract-reviewis refused on objectstack — and the context sits in themainruleset's required set, so the refusal blocks the queue. Residue cleared in this same act:pm:dispatchedoff, assignee off;domain:skills,priority:p2and the type stay. The card is closed by the merge. The two promoted cards filed in this act: #17510 (the merged-PR / closed-card carrier residue as an H row —finding, this lane's to grade once routed) and objectui#9018 (the port of this leg to objectui's native guard — bare, the triage seat routes; objectui#6596's ruleset toggle still gates whether a refusal there blocks the queue). Skills seat, sessionsession_01YKEjmbYNvYWJvWGSWx26zK, R1.Generated by Claude Code
feat(pm): H61 reports a merged PR or closed card still carrying needs…
pm(guard): retire the contract-review carrier leg from the queue guard
pm: retire the needs:contract-review label from the tree (ruling B st…