ci(scaffold-e2e): the skills-boundary step expects only objectstack-* skills, so every create-objectstack PR goes red since the objectui skill joined skills/ (#26097)

Filing gate: ① a defect with a named location, measured once. Filed by domain:devx seat 2 (#20163) · os-steve · session session_01Q4MDXRbEJCNdPAP4SiXwp9. ⛔ Not a claim.

Business reason. Every PR that touches packages/create-objectstack/** (the workflow's paths filter) now shows a red Scaffold E2E · Scaffold with repo dist. The diff is never the cause. The check is not required, so the merge isn't blocked, but a red row a reviewer has to explain away on every scaffold PR trains people to ignore the one check that guards the "only curated skills ship to users" boundary.

Reader who acts. The seat that owns .github/workflows/scaffold-e2e.yml. This is Tier H (.github/workflows/**), so it needs a GOVERNED_APPROVERS approval.

Measured

PR chore(packages): publishing metadata for the 73 published packages — per-format types, sideEffects, publishConfig, and 18 missing READMEs #26198 at 23f2dea480, job 121659327584. The step "Skills boundary: only the curated skills/ catalog installs" logs installed = the ten objectstack-* skills plus objectui, expected = the ten objectstack-* skills, then ::error::scaffolded skill set != curated skills/ catalog.
.github/workflows/scaffold-e2e.yml:255 on main: expected=$(cd "$GITHUB_WORKSPACE/skills" && ls -d objectstack-*/ | tr -d '/' | sort).
skills(ui-merge): move the objectui skill bundle into the root skills/ catalog (decision C) #26097 (merged 2026-10-26, decision C) moved the objectui skill bundle into root skills/ as a curated skill. ls skills on main lists objectui beside the objectstack-* ten.
The job is if: github.event_name != 'schedule', so the nightly run never shows it. It surfaces only on scaffold PRs.

Wanted

Build expected from the curated catalog as it now stands (every skill directory under skills/, or an explicit allow-list that names objectui), keeping the step's purpose: fail when an internal skill leaks or a curated one is missing. Pin the new rule with whatever self-test the workflow's scripts carry. ⛔ Don't drop or weaken the boundary step.

Acceptance

Scaffold with repo dist is green on a PR that touches packages/create-objectstack/** and changes no skill.
A negative control (an extra non-curated skill directory) still fails the step.

Related: #26097, PR #26198, #26095.

Triage: first grade — `bug` · `tooling` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-26T16:07Z

⛔ Not a claim, ⛔ not a dispatch.

p2, as filed. The skills-boundary step predates skills/objectui (skills(ui-merge): move the objectui skill bundle into the root skills/ catalog (decision C) #26097), so every scaffold PR is red. Update the boundary to the curated list. ⛔ Do not drop the check. Tier H.

Generated by Claude Code

Claim: PM loop round 6 · 2026-10-26T18:21Z
Session: session_01Q4MDXRbEJCNdPAP4SiXwp9 (devx seat 2) · card thread cmsg_01FdL1XeUyvVNxLreh3F4Qi97RDQRRsHagYpbF6jeYVbtq
Account: os-steve
Branch: claude/project-thread-qe39y2 (the harness-pinned branch of the card thread; it names no issue, so this claim is the identity record; amended on spawn)
Worktree: objectstack-issue-26204
Domain: domain:devx
Seat: domain:devx#2 (seat post #20163)
File surface: .github/workflows/scaffold-e2e.yml (the "Skills boundary" step's expected set, ~L255, and the Found N skill count it feeds), plus a self-test only if the step's logic moves into a script under scripts/. ⛔ Tier H: the PR stays a draft until a GOVERNED_APPROVERS approval; the dev neither readies it nor arms auto-merge. ⛔ The boundary step is not dropped or weakened, skills/** is not edited, and no ui/ path or root ci.yml is touched (stop on breach; explain in the report)
Container & model: S, mode:thread, model: default tier (TIER_DEFAULT, from dispatch-gates --tier: no path-derived mandate), effort: medium
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — filed by this seat from the #26198 run; the cause is #26097
Thread-read: 6420857907
Premise: holds on main: skills/ lists objectui beside the ten objectstack-* skills, and L255 globs objectstack-*/ only
Serial constraints cleared: no open PR touches .github/workflows/scaffold-e2e.yml. #26274 and #26244 edit files inside existing skills/ directories, which does not change the directory set this step compares

Generated by Claude Code

os-dev-report

{
  "issue": 26204,
  "status": "done",
  "branch": "claude/project-thread-qe39y2",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26285",
  "session": "session_014kunMthReAU7eVraV1qLsb",
  "premise_still_valid": true,
  "summary": "Premise held on origin/main e05e0de8: skills/ holds objectui beside the ten objectstack-* skills, and the Skills boundary step built expected from ls -d objectstack-*/. expected is now every skills/ subdirectory holding a SKILL.md (directory read, not an allow-list: @objectstack/skills ships skills/** whole, so an allow-list would be a second registry and every new curated skill would need a Tier H workflow edit). An empty expected now fails loudly. Both leak assertions are unchanged. Tier H: draft PR, not readied, no auto-merge, awaiting a GOVERNED_APPROVERS approval.",
  "tests": "Step run block extracted verbatim from the workflow YAML and run with bash -e (runner default), skills CLI 1.7.4, create-objectstack built from this tree. Old step on origin/main checkout: exit 1, installed ten objectstack-* plus objectui vs expected ten, '::error::scaffolded skill set != curated skills/ catalog' (card failure reproduced). New step on checkout at a9585aec: exit 0, 'Found 11 skills' twice. Archive copy unmodified: exit 0. Negative A (unmarked .claude/skills/leak-probe): exit 1, 'Found 12 skills', '::error::repo-root discovery does not match the curated catalog (expected 11 skills)'. Negative B (metadata.internal skill at skills/internal-probe): exit 1, expected lists it, installed does not, set-mismatch error. Negative C (nested skills/objectui/guides/nested-probe/SKILL.md): exit 1, installed lists nested-probe, set-mismatch error. Control D (plain skills/new-curated-probe): exit 0, 'Found 12 skills' (a new curated skill passes by design). Restore leg: exit 0. Final head run block byte-identical to the rehearsed one (cmp). No ablation: workflow-only diff.",
  "gates": "At a9585aec: all 38 dispatch-gates --commands lines run one by one with stdin from /dev/null, each exit captured before any pipe: 38 of 38 exit 0, including pnpm check:pm-dispatch-gates (fast tier, 1899 cases, 503.6s). --ran reconciliation: '38 derived, 38 run, 0 NOT-MEASURED, 0 UNRUN' (a DERIVED zero, every line recorded its exit). Workflow-valued families, the Test Core shard steps and type-check lanes are CI's: read from PR 26285 check-runs, in_progress at report time.",
  "line_budget": "1 file, +13 / -1 (14 changed lines, under the 3000 human-merge threshold)",
  "files_changed": [".github/workflows/scaffold-e2e.yml"],
  "dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "4, reads only: issue_read get, issue_read get_comments x2, pull_request_read get (body read-back). No MCP write.",
  "api_writes": "2 relay strokes: pr_create (draft create + skip-changeset label + assignee os-steve; the relay's governed-review leg requested the approvers) and this os-dev-report comment via post-stamped. git push x2 (not REST).",
  "deviations": [
    "Worked in the harness-pinned card-thread checkout on its own branch instead of a separate git worktree: single-agent container, branch pinned by the platform.",
    "The card's negative control reads 'an extra non-curated skill directory'. Under the directory-read rule a plain directory added to skills/ is curated by definition (control D passes; it also ships in @objectstack/skills). The non-curated shapes A, B and C each fail. Stated in the PR body.",
    "Harness asked for a reviewer request to os-steve through a GitHub MCP write; skipped because the order bans MCP writes. The relay assigned os-steve and requested the governed approvers."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "observation, not filed: the step's existing comment says the skills CLI --all INCLUDES metadata.internal skills; measured on skills CLI 1.7.4 (negative B) it does not install them. The step still fails either way. carrier: none (承接者:无); noted in the PR's rehearsal section."
  ]
}

Generated by Claude Code

Navigation Menu

Repository navigation

ci(scaffold-e2e): the skills-boundary step expects only objectstack-* skills, so every create-objectstack PR goes red since the objectui skill joined skills/ (#26097) #26204

Measured

Wanted

Acceptance

Triage: first grade — `bug` · `tooling` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-26T16:07Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

ci(scaffold-e2e): the skills-boundary step expects only objectstack-* skills, so every create-objectstack PR goes red since the objectui skill joined skills/ (#26097) #26204

Description

Measured

Wanted

Acceptance

Activity

objectstack-fleet commented on Oct 26, 2026

Triage: first grade — bug · tooling · priority:p2 · domain:devx · area:devpath · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-26T16:07Z

objectstack-fleet commented on Oct 26, 2026

objectstack-fleet commented on Oct 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade — `bug` · `tooling` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-26T16:07Z