Skip to content

tooling(pm): the fleet relay's workflow_dispatch can start release.yml with refresh_version_pr: true only, so a seat refreshes the Version PR through the relay (#23177 ruling B, item 5) #23193

Closed

Description

@objectstack-fleet

Filing-gate category ③, a maintainer-ruled duty: #23177, ruling B (6139629628, the maintainer's 「同意」), item 5:

Operational, on the release path: after each fix merges to main, the acting seat dispatches Release with refresh_version_pr through the relay at once rather than waiting for the 6-hourly refresh.

Reader who acts: the domain:devx execution seat.

Why

  • WORKFLOW_DISPATCH_ALLOWLIST in scripts/pm/fleet-write/ops.mjs holds only shard-timings-refresh.yml. A relay stroke naming release.yml is refused with zero writes (execute.mjs self-test "an off-list workflow is refused here").
  • The op sends no inputs, and the header says so: "a workflow with inputs joins the list by the PR that also spells its inputs here".
  • Today this seat refreshed chore: version packages (next) #21988 twice from the linked account on the maintainer's order (runs 38351525685, 38357219168), not through the relay.

What done looks like

  • release.yml joins the allowlist with exactly one input spelled: refresh_version_pr: true. force is refused, as is refresh_version_pr: false, which would start the publish-repair lane. So the relay can start only the bookkeeping lane (release.yml:269-271), never the audit or publish lanes (:848-850, :1344-1346).
  • The ref stays main only. The stroke stays alone, and the actions: write grant is minted only for it, as for the existing entry.
  • The validator and executor self-tests pin the following: release.yml with refresh_version_pr: true is accepted; with force, with refresh_version_pr false or absent, or with any other input, it is refused with zero writes; and the started run is read back as today.
  • .claude/skills/pm-dispatch/references/rest-channel.md gains one line naming the new entry. That is a governed .claude/** hunk, so it is either the skills lane's or a Tier H split, per the landing rules.

Activity

  1. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    ContributorAuthor

    Claim: PM loop round 8 · domain:devx seat 1 · 2026-10-13T07:59Z · maintainer-ruled: #23177 ruling B, item 5 (6139629628, 「同意」)
    Session: session_012zwsLMxQBwHUYJgPyrpEvx
    Account: zhuangjianguo (the seat's linked user as GET /user answers it; the card's assignee)
    Branch: claude/issue-23193-relay-release-refresh
    Worktree: objectstack-issue-23193
    Domain: domain:devx
    Seat: domain:devx#1
    File surface: scripts/pm/fleet-write/** (the op table, validator, executor and their self-tests). ⛔ No .claude/**: the rest-channel line is carried by #23201. .github/workflows/fleet-write.yml only if measured necessary, and then the PR is Tier H (draft, maintainer approves). ⛔ No edit to release.yml
    Container & model: M, mode:subagent, model: opus (the default judgment tier)
    Clause-②: no (internal PM tooling)
    Responsibility: the relay can start only shard-timings-refresh.yml, so a seat cannot refresh the Version PR through its write channel | no platform path covers it: WORKFLOW_DISPATCH_ALLOWLIST is closed and the op sends no inputs | each fix on the release path waits for the 6-hourly tick or a seat's off-relay dispatch
    Thread-read: 6139629628
    Serial constraints cleared: no open PR touches scripts/pm/fleet-write/**, .github/workflows/fleet-write.yml, lint.yml or ci.yml (all open PRs' file lists read at this act).

  2. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    ContributorAuthor

    os-dev-report
    {
    "issue": 23193,
    "status": "done",
    "branch": "claude/issue-23193-relay-release-refresh",
    "pr": "#23209",
    "session": "session_012zwsLMxQBwHUYJgPyrpEvx — the harness-stamped Claude-Session id (subagent: the dispatching seat's)",
    "premise_still_valid": true,
    "summary": "The premises held on origin/main 9fbabd7. WORKFLOW_DISPATCH_ALLOWLIST held shard-timings-refresh.yml alone, the op sent no inputs, and release.yml declares force and refresh_version_pr (both boolean) under exactly the guards the card cites: :269-271, :848-850 and :1344-1346. Both PM runs, 38351525685 and 38357219168, ran Version PR maintenance with success and skipped the other five jobs. In ops.mjs, WORKFLOW_DISPATCH_INPUTS now closes each allowlisted file's inputs, and the allowlist is that table's keys. release.yml joins with exactly { refresh_version_pr: true }, and the shard-timings entry is null. The workflow_dispatch row gains an optional inputs key (a new field kind) and a closedInputs property. The validator refuses, by name and with zero writes, an absent input, false, force, the string "true" or any other input. The request body is built from the table, never from the action, with the value as the string "true" (the measured spelling). The validator self-test reads release.yml from disk and pins the declared inputs. It also evaluates every job's if: (three-valued logic, in needs order) for the relay's dispatch: version-pr runs and the other five are skipped, with schedule, push and repair controls and two in-memory mutations that must change the answer. Executor and seat batteries pin both the accept and the refuse side, the started-run read-back from release.yml's run list, and --dry-run. fleet-write.yml did not need to change: its mint step already reads the validator's permission_actions output generically. So the PR touches no governed surface: no .claude/, no workflow and no release.yml.",
    "tests": "All at PR head 961ec71 (no workspace package touched, so no build step). The relay self-tests: check:pm-fleet-write-validate "152 cases pass across 11 batteries" (130 on main), check:pm-fleet-write-execute "120 cases pass across 16 batteries" (111), check:pm-fleet-write-dispatch "222 cases pass across 20 batteries" (216). node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 37 families. All 37 ran with exit 0 each (pnpm check:pm-dispatch-gates "1833 cases pass", fast tier, 406.5s), and --ran over the exit-coded record answered "37 derived, 37 run, 0 NOT-MEASURED, 0 UNRUN" (a DERIVED zero). Lint was narrowed, with three pieces of evidence: eslint --print-config for these files shows 2 rules (no-restricted-imports, comment-swallow/no-code-inside-block-comment) and parserOptions without project or projectService, so type-aware linting is off and untouched files cannot move; eslint --format json over the 4 changed files gives 4 files, 0 errors, 0 warnings; repo-wide pnpm lint is CI's. Ablation via scripts/ablation-replace.mjs on the committed ops.mjs (blob 113cf0c32be4): the release entry gained force: false (anchor 1 to 0, blob to 90f51ebf8297). The validator went red with 10 of 152 failed (re-run at 8e3fa5f, after the first run exposed a crash on a refused stroke, now fixed) and the executor with 6 of 120 failed. The restore was proven: blob equals HEAD and git diff HEAD is empty. No live release.yml dispatch was sent. CI at 961ec71 when this report was written: Governed Surface Queue Guard success, Build Core skipped, Test Core 1-6 in_progress (the queue-required set has not converged; it is not awaited here).",
    "mcp_calls": "0 — no MCP GitHub tool was called",
    "api_writes": "3 — each POST /repos/objectstack-ai/objectstack/dispatches (the fleet-write relay, executed as objectstack-fleet[bot]): (1) pr_create with assignees, so POST /pulls (draft) then POST /issues/23209/assignees, run 38371902237, body read back identical at 8843 bytes, assignee zhuangjianguo; (2) label-write, POST /issues/23209/labels skip-changeset, run 38372009689, read back size/l plus skip-changeset; (3) this report, POST /issues/23193/comments via post-stamped. Plus git push (not REST).",
    "deviations": [
    "The harness attribution reminder asked for a model-named Co-Authored-By trailer and the emoji footer form. AGENTS.md (Commit message / attribution footer) requires the model-free pair and the session-URL footer, and pre-push refuses a model identifier, so the commits carry Claude-Session plus Co-authored-by: Claude and the PR body carries the AGENTS.md session-URL footer."
    ],
    "open_questions": [
    {
    "question": "AGENTS.md Prime Directive 15 still lists "workflow_dispatch-ing release.yml or any other publish-capable workflow" among the reserved release acts that no AI seat performs, while ruling B item 5 (6139629628) orders the acting seat to dispatch Release with refresh_version_pr through the relay. This PR builds the fence (the bookkeeping lane alone, measured from release.yml's guards) and dispatches nothing, but once it lands, the ruled operation contradicts the governing text a seat reads first ("AGENTS.md wins"). How should the text be brought into line?",
    "options": [
    "A — A Tier H one-sentence amendment to Prime Directive 15: the reserved act becomes dispatching release.yml in any lane except the relay's closed refresh stroke (WORKFLOW_DISPATCH_INPUTS, refresh_version_pr true alone). Cost: one governed hunk, the maintainer's approval, small effort.",
    "B — Leave AGENTS.md as is and treat the ruling as standing authorization. Cost: zero edits, but every seat meets a prohibition that the mechanism and the ruling both contradict; seats may refuse the duty or cite the ruling ad hoc.",
    "C — Land this PR but have no seat use the row until A lands. Cost: the operational duty waits on the Tier H edit, and each fix again waits for the 6-hourly refresh meanwhile."
    ],
    "recommendation": "A, on the four axes. Real business need: measured, with two hand refreshes today (runs 38351525685 and 38357219168) and the maintainer's ruling. Long-term soundness: one rule text that matches the one mechanism, with no tacit exception. Preventing AI error: the closed table is the enforcement, and naming it in the rule as the only door means what is declared is what is enforced, so no seat has to choose between AGENTS.md and a ruling comment. Startup focus: a one-sentence edit with no new gate and no staged window. A is a governed AGENTS.md hunk and lies outside this card's file surface, so the director seat routes it, with C as the interim posture if A cannot ride in this round's Tier H batch."
    }
    ],
    "out_of_scope_findings": [
    "carrier: director seat (Tier H AGENTS.md edit, see open_questions[0]) · noted in PR #23209 Acceptance notes, not filed · dedupe words: Prime Directive 15, workflow_dispatch release.yml, refresh_version_pr relay, reserved release act, ruling 6139629628 item 5",
    "carrier: #23201 (the rest-channel.md line naming the release.yml entry, governed .claude/
    ) · noted in PR #23209 Acceptance notes, not filed"
    ]
    }

  3. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    ContributorAuthor

    PR #23209 is held: ruling B item 5 contradicts AGENTS.md Prime Directive 15 as written · domain:devx seat 1 · session_012zwsLMxQBwHUYJgPyrpEvx · 2026-10-13T08:54Z

    Governing text: AGENTS.md Prime Directive 15 (:300-309 on main) reserves to the maintainer, among the release acts, "⛔ workflow_dispatch-ing release.yml or any other publish-capable workflow". Ruling B item 5 (6139629628) orders the acting seat to dispatch Release with refresh_version_pr through the relay. The dev's report (open_questions[0]) raised the conflict, and this seat confirms it on main.

    Disclosure. This seat itself dispatched release.yml twice today, from the linked account, on the maintainer's in-session order 「release 分支 是手动刷新的 ,你改完了可以手动帮我刷」:

    • run 38351525685 at 2026-10-13T05:28Z;
    • run 38357219168 at 2026-10-13T06:31Z.

    Both carried refresh_version_pr: true and ran only Version PR maintenance. The integrity, full-battery, publish and Docker jobs were skipped on both. That act is the one PD15 reserves. The seat should have raised the conflict with the maintainer before acting and did not. It is recorded here.

    Posture from now:

    Needs the maintainer's word. The dev's options, condensed:

    This seat recommends A: one rule text that matches one mechanism. The AGENTS.md hunk is governed, so it goes through the director seat or the maintainer's Tier H batch.

  4. objectstack-fleet commented on Oct 14, 2026

    @objectstack-fleet
    ContributorAuthor

    Ruling · letter A · the maintainer's word, verbatim: 「23209 A」 · recorded by domain:devx seat 1 (off duty; recording only) · session_012zwsLMxQBwHUYJgPyrpEvx · 2026-10-14T04:24Z

    This answers the options in 6141962120. A is a one-sentence Tier H amendment to AGENTS.md Prime Directive 15.

  5. objectstack-fleet commented on Oct 14, 2026

    @objectstack-fleet
    ContributorAuthor

    Release: 2026-10-14T04:29Z · session_012zwsLMxQBwHUYJgPyrpEvx (domain:devx seat 1, now off duty) · reason: the seat clocked out without releasing this claim. That was a half-state; this release corrects it. · next: pm:blocked on #23393

    (Clock-out brief: 6159121815 on #6023, 2026-10-14T01:52Z.)

    Blocked-by: #23393

  6. objectstack-fleet commented on Oct 14, 2026

    @objectstack-fleet
    ContributorAuthor

    Claim: PM loop round 1 (the maintainer's order)
    Session: session_01B7mrh59UAGffd7s9asUfoY
    Account: sunhaolin (the seat's linked user as GET /user answers it; the card's assignee from this act)
    Branch: claude/issue-23193-relay-release-refresh (continued: PR #23209, draft, head 961ec7100a, released by seat 1 in 6160919454)
    Worktree: objectstack-issue-23193
    Domain: domain:devx
    Seat: domain:devx#2
    Ruling-ref: 6160857949 (ruling A on this card, 「23209 A」) · 6139629628 (#23177 ruling B, item 5)
    File surface: scripts/pm/fleet-write/**, exactly the four files PR #23209 holds (dispatch.mjs, execute.mjs, ops.mjs, validate.mjs). No new code is expected. What is left is ruling A's step 2: after #23393 lands, merge main into #23209, re-check it, and land it. ⛔ No edit to release.yml or .github/workflows/fleet-write.yml. ⛔ No release.yml dispatch in any form until #23393 and #23209 have both landed.
    Container & model: n/a — no dev dispatch now; the seat reviews and lands. A patch round, if the re-check needs one, goes to an os-dev on this branch.
    Clause-②: no
    Responsibility: n/a — not a defect card
    Thread-read: 6160919454
    Serial constraints cleared: #23393 (this seat, in flight) lands first, per the ruling's order. No other open PR touches scripts/pm/fleet-write/**, release.yml or fleet-write.yml (9 open PRs' file lists read at 2026-10-14T08:17Z).
    Provenance: who — the maintainer; verbatim — 「23209 你也接管」; where — this seat's PM session chat (session_01B7mrh59UAGffd7s9asUfoY), received just before this act.

    Blocked-by: #23393
    Unlock-action: re-check PR #23209

    The card stays pm:blocked: the work is done and waits on #23393. The PR's assignee moves to sunhaolin in this act, and the seat subscribes to its activity.


    Generated by Claude Code

  7. objectstack-fleet commented on Oct 14, 2026

    @objectstack-fleet
    ContributorAuthor

    ACCEPT (landing held on #23393) — PR #23209 · domain:devx#2 · 2026-10-14T08:19Z

    Seat review of PR #23209 against GitHub, at head 961ec7100a on base 107853ced3. Report: 6141925804. Claim: 6164017046. Ruling-ref: 6160857949 (A) and 6139629628 (#23177 ruling B, item 5).

    Checklist conclusions

    • Shape: draft PR to main. Body line 1 is Fixes #23193, the body's only closing keyword. Clause-②: no is at line start. The assignee is sunhaolin from this seat's claim.
    • Files (pulls/23209/files): scripts/pm/fleet-write/{ops,validate,execute,dispatch}.mjs, +547 / −38. That is the claim's surface. check-governed-merges.mjs --pr 23209 says "NOT governed" and 585 lines, under the 3000 threshold. skip-changeset is right, since scripts/pm/** publishes nothing.
    • Contract review: not owed. The diff touches no published schema and no governed path, and the claim declares Clause-②: no. So CI and this seat's own read are the record.
    • CI at 961ec7100a: 43 check-runs, 32 success and 11 skipped, none red. Lint & Repo Gates and TypeScript Type Check are both success.

    Read in the diff

    • WORKFLOW_DISPATCH_INPUTS closes each file's inputs: release.yml → { refresh_version_pr: true }, shard-timings-refresh.yml → null. WORKFLOW_DISPATCH_ALLOWLIST is now that table's keys.
    • The request body's inputs are built from the table's entry, never from the action. So an action that slipped past the validator still could not put force or false on the wire.
    • closedInputsErrors refuses, each by name: a missing input, any input outside the entry, a different value, and an inputs key on a null entry. The inputs field kind refuses a non-object, an empty object and a non-boolean value (the string "true") before that.
    • alone, the main-only ref and the stroke-scoped actions: write mint are unchanged.

    Seat probe, one local run, the merged shape: a detached worktree at origin/main 4f81f31526 plus the PR's four files. main has moved release.yml once since the PR's base (c4ef17a0, #23313).

    • validate.mjs --self-test: 152 cases, 11 batteries, exit 0. It evaluates the if: of every job in that newer release.yml for the relay's dispatch, and still reaches version-pr alone.
    • execute.mjs --self-test: 120 / 16, exit 0. dispatch.mjs --self-test: 222 / 20, exit 0. Both match the report's counts.
    • On main, release-integrity, stale-prompts, full-battery and publish each still carry !inputs.refresh_version_pr, and version-pr carries inputs.refresh_version_pr.

    The report's open question (PD15 against ruling B item 5) is answered by ruling A. Its execution is #23393, in flight from this seat. Of the two out-of-scope notes, the AGENTS.md hunk is #23393. The rest-channel.md line naming the new entry was carried by #23201 "once #23193 lands", but #23201 closed completed at 2026-10-14T00:49Z without it (rest-channel.md:51 on main is the generic workflow_dispatch line). So it has no carrier today. Its trigger is this PR's merge: this seat files it for the domain:skills lane in the same act that records the landing. Corrected in place (domain:devx#2): this sentence first said the line was #23201's.

    Landing, in the ruling's order:

    1. governance(AGENTS.md PD15): carve the fleet relay's closed Version-PR refresh stroke (release.yml with refresh_version_pr: true alone) out of the reserved release act, per ruling A on #23193 #23393 lands, after its at-tier contract review and an authorized approval.
    2. This seat syncs PR tooling(pm): the fleet relay may start release.yml with refresh_version_pr true alone, so a seat refreshes the Version PR through the relay #23209 with main through the relay's pr_update_branch (with the full expected head sha) and re-reads CI on the new head. A change on either side since this review gets a delta review.
    3. On green, pr_ready and automerge_enable.

    ⛔ Until step 3 merges, no seat dispatches release.yml in any form.


    Generated by Claude Code

  8. objectstack-fleet commented on Oct 14, 2026

    @objectstack-fleet
    ContributorAuthor

    Unlock scan: pm:blocked → pm:dispatched · #23393 closed · PR #23209 may land · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-14T09:58Z

    The blocker #23393 (the PD15 carve-out for the relay's refresh stroke) closed completed. #23393's order: the amendment lands first, then PR #23209 merges main, is re-checked, and lands.

  9. objectstack-fleet commented on Oct 14, 2026

    @objectstack-fleet
    ContributorAuthor

    Landed — PR #23209 → 7cfc3400c1 · domain:devx#2 · 2026-10-14T10:07Z


    Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:devpathThe road — create, dev, verify, publish/install, connect an agent, iteratedomain:devxpriority:p1High: required for production / M2tooling

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions