[os-elon-musk]

Requested by Elon · project thread

Fixes #25415

What changes

• scripts/pm/record-recognisers.mjs: two new readers. readReviewedByAccount reads a Reviewed-by-account: key line (in the file's one key-line convention), and it accepts exactly one GitHub login. A leading @ is allowed; a bot login, prose, or two logins read unreadable. readAttributionLogin reads the claude-projects-attribution github_login from any line of a PR body. A marker with no readable login reads unreadable, never absent. locateReviewOfRecord now also returns account, read off the same comment it chose.
• scripts/pm/check-governed-queue-guard.mjs: the Tier S record leg reads the attribution from the PR body it already fetches (no new API call). A new pure function, accountIndependence, does the comparison. When the body carries the attribution line, a record that otherwise stands becomes not-independent (refused, exit 3) if the reviewer account equals the attribution login (case-insensitive), or if the account line is missing or unreadable, or if the attribution itself is unreadable. The refusal names both logins and the rule. The clear prints both logins it compared. A body without the line (Routine seats, humans) is not-owed, so today's reading is unchanged. The approval limb is untouched, so the leg stays monotone.
• Self-tests: there is a new guard battery (10 cases; floor 27 → 28) and a new recogniser battery (7 cases; floor 12 → 13). Guard: 344 cases pass. Recognisers: 208 cases pass. A mutation that turns the check off reds all 10 guard cases.

Key name

This PR uses Reviewed-by-account:, as the card says. The paired skills card #25414 (draft PR #25422) writes the rule in prose ("记录独立性段并书两账户") and settles no key of its own. If it settles a different key, only keyLineRegex('Reviewed-by-account') and the refusal text change.

Deviations from the card (premise drift)

• --pair no longer exists. Ruling record 5770886272 (Retire the in-seat clause-② contract review — the rule, its gate label, and the 9k-line checker's gate role #19061, letter B) retired the --pair landing pre-check. Its job of printing the two logins is now done by the guard's own clear and refusal lines.
• The guard has no --explain flag. In its place, here is an offline replay of feat(spec): ExecutionStatus gains missed, a scheduled due time that passed while no kernel was ticking #25363 at head a6b929fa3. The attribution reads os-bill. Record 6357150459 names the other account only in prose, so the reading is account-missing and the record would be refused. With Reviewed-by-account: os-elon-musk added, the reading is holds. (feat(spec): ExecutionStatus gains missed, a scheduled due time that passed while no kernel was ticking #25363 touched no governed path, so the guard never consulted its record in real life.)
• --template does not print the new line yet. Its output is pinned byte-for-byte across several batteries. The refusal text tells the seat exactly what to add.

Gates

dispatch-gates --commands --repo objectstack-ai/objectstack derived 35 families. All 35 ran with exit 0, and --ran reports 35 run, 0 NOT-MEASURED. check-governed-merges --test on the two paths: NOT governed, so this is an ordinary queue landing. The workflow that runs the guard is unchanged.

---

Generated by Claude Code