pm-dispatch: card threads write to GitHub only through the relay (pr_create and the other ops), never GitHub MCP; the dispatch order carries that line verbatim; review flags a PR not authored by the fleet bot (maintainer's word 2026-10-23) #25457

Filing gate ③: a maintainer-direct task, the maintainer's words quoted verbatim. Filed by domain:skills seat 2 (seat post #19287, session session_01REMuzhz6MWRjg8uohedMnM, account os-elon-musk) on the project coordinator's relay of the maintainer's word. ⛔ Not a claim. Lane self-applied under exception 二; grade suggested S, p2; triage may regrade.

Reader (who acts): the domain:skills seat, one PR on .claude/skills/pm-dispatch/** (Tier S) plus ratchet ceiling rows if needed. Contract review at CONTRACT_REVIEW_TIER.

The maintainer's words (2026-10-23 14:43Z, Claude Code project "Objectstack", verbatim)

如何更新 skills ：在环境级（项目根会加载的那层）设置里禁掉 MCP 写，并放行中继命令。这一步要你来改配置。

1. 在每张卡的派发令里写明「PR 只经中继 pr_create 开，禁用 MCP」。

What was measured (2026-10-23)

• PR docs(pm-dispatch): the project layer — one project form, 「pm-dispatch <席位…>」 as the summon, seats read from the seat posts' 🟢 line, takeover that never waits for a walled account, mailbox PRs, a generated roster board #25427 (card pm-dispatch: project forms — lane project and director project, lanes read from the seat post's 🟢 line, the maintainer's one-sentence assignment, takeover of a walled account, mailbox PRs, generated roster board (maintainer's word 2026-10-23) #25412) was opened by its card thread through the GitHub MCP create_pull_request tool, so the PR's author is the personal login os-elon-musk, not objectstack-fleet[bot]. Every other PR this project opened went through scripts/pm/fleet-write/dispatch.mjs pr_create and is authored by the bot (e.g. docs(pm-dispatch): Tier S landed from a project needs a review of record by another account; the 分诊席 shrinks to bare cards; decision cards stay in their repo and the 总监席 scans every repo #25422, docs(adr-0126): list the six sys_metadata_activation.metadata_type values written on main #25432).
• Cause: a Claude Code project rooted at the parent of several checkouts does not load objectstack/.claude/settings.json (CLAUDE_PROJECT_DIR unset in three readings), so the repo's deny on MCP writes and its PreToolUse guards are inert there. Each repo's CLAUDE.md does load. In that layout the skill text is the only line of defence.
• references/execution-duties.md L130 today: 「派发令恒带 Writes: 行:只走 REST 代理、写预算(端点清单)、mcp_calls 计数,dev 两数都报。」 — it says REST relay but does not name pr_create or forbid the MCP write tools by name.

Wanted

1. references/execution-duties.md Writes: line: PR only through the relay's pr_create; comments, labels, body edits only through the relay tools (post-stamped.mjs, label-write.mjs, fleet-write/dispatch.mjs); ⛔ GitHub MCP writes by name (create_pull_request, update_pull_request, issue_write, add_issue_comment, …); one clause that in a multi-repo project the repo settings.json deny does not load, so this line is the guard.
2. references/dispatch-runbook.md 〈卡线程〉: the card thread's opening message (the dispatch order, per pm-dispatch: a project-run seat form — seat post as a stub, posture and ledger in the Claude Code project, dispatch order in the card thread, branch named before the thread opens; 项目总监 → 总监席 (maintainer's word 2026-10-23) #25379) carries that Writes: line verbatim.
3. references/contract-review.md or review-checklist.md: a PR whose author is not objectstack-fleet[bot] is flagged in the review record (③ note, with the author login), so the seat sees an off-relay write before landing.

Out of scope: the environment-level settings the maintainer will change himself (first sentence of his message); any scripts/** check (a devx card if wanted).

Acceptance

• The three files carry the text; line-neutral or paid in the same file; pnpm check:pm-skill-ratchet, check:pm-skill-id-lint, check:skill-frame-sync, check:skill-frame-freshness green.
• git grep -n 'create_pull_request' -- .claude/skills/pm-dispatch names it only as forbidden.
• Serial: lands after docs(pm-dispatch): the project layer — one project form, 「pm-dispatch <席位…>」 as the summon, seats read from the seat posts' 🟢 line, takeover that never waits for a walled account, mailbox PRs, a generated roster board #25427 (card pm-dispatch: project forms — lane project and director project, lanes read from the seat post's 🟢 line, the maintainer's one-sentence assignment, takeover of a walled account, mailbox PRs, generated roster board (maintainer's word 2026-10-23) #25412) and docs(pm-dispatch): Tier S landed from a project needs a review of record by another account; the 分诊席 shrinks to bare cards; decision cards stay in their repo and the 总监席 scans every repo #25422 (card pm-dispatch: Tier S PR landed from a project needs a contract-review record by another account; triage shrinks to bare cards in the director project; decision cards stay in their repo, the director scans every repo (maintainer's word 2026-10-23) #25414), which edit dispatch-runbook.md, contract-review.md and execution-duties.md's neighbours; start from main after they land, or merge main before review.
• Tier S landing per the current rule (review PASS + green checks; the maintainer's standing word in the seat thread of 2026-10-23 14:14Z).

Dedupe

MCP search_issues, objectstack, "card thread opened PR through GitHub MCP write, PR author not fleet bot, dispatch order Writes line relay only pr_create" → 59 hits; top: #25412, #23423 (closed), #25417, #21892 (closed: label-write fell back to a personal-login write — the same identity hazard on a different path), #25415, #25416, #25379 (closed), #24145, #20791, #20063 (closed: PR assignee rule). None names the MCP write tools or the dispatch-order line. New.

Dedupe words: GitHub MCP write ban · Writes: line pr_create · PR author not objectstack-fleet[bot].

Generated by Claude Code