[objectstack-fleet]

Refs #25675

Clause-②: no
Metadata-protocol: none
Ruling-ref: 6386630545

The governed half of #25675, split out of #25703 so that PR's diff stays ungoverned. Merge this after #25703. This row documents config.secretRef, which #25703 adds to the protocol. Landed alone, the skill would teach a key the runtime does not have yet.

What changes

skills/objectstack-automation/SKILL.md, in the inbound webhook (api) start-node table:

• The secret row said a non-blank literal is required or the flow is refused. Once feat(spec): an api flow's start node may name its hook secret (config.secretRef), resolved per post #25703 lands that is false. The row is now secretRef / secret: one of the two is required, a package ships secretRef: 'NAME' (an env var the deployment fills, not OS_*; unfilled means 503), and never a literal.
• The x-objectstack-signature header name moved from the row into the signature line, so it is not lost.

skills/objectstack-automation/references/_index.md stays in #25703. It is gen:skill-refs output that check:skill-refs requires to ride the spec change, and check-governed-merges lifts it there as a pure regeneration (measured: #25703's file list reads NOT governed with it).

Changeset: .changeset/25675-skills-secret-ref-row.md, @objectstack/skills patch.

Skill readings (skills/**)

• skills/objectstack-automation/SKILL.md: 438 → 438 lines; 5755 → 5771 tokens (ceiling 5780, check-skills-token-ratchet exit 0).
• Whole pack (all SKILL.md): 4389 → 4389 lines; ratcheted authored tokens +16.

Verification

All at head 44ca1a08 (on origin/main b77bb37e). dispatch-gates --commands derived 46 families: 44 exit 0, and 2 exit 3, a refused prerequisite, so NOT MEASURED (check:dual-build-cjs-loads, check:lean-entry-closure: the full workspace build). --ran reconciliation: 46 accounted, 44 run, 2 NOT-MEASURED, 0 UNRUN. check-governed-merges --test on this file list reads governed: 1 of 2 paths hits the register (skills/**, Tier H), as intended.

维护者速读(草稿)

• 改了什么：自动化技能文档里 api 流程起始节点那一行，从「必须写非空字面 secret」改为「secretRef 或 secret 二选一；包里写 secretRef: '名字'，由部署方用同名环境变量填值（不得用 OS_ 开头），没填值时每次请求回 503；不要提交字面密钥」。
• 为什么改：feat(spec): an api flow's start node may name its hook secret (config.secretRef), resolved per post #25703 新增了 config.secretRef（裁决 A），原句随之变假。这份技能文档会发给客户的 AI 读，不改的话 AI 会继续照抄字面密钥进公开仓库。
• 风险与代价（含回滚）：只改文档一行，token 增加 16（在上限内），行数不变。必须在 feat(spec): an api flow's start node may name its hook secret (config.secretRef), resolved per post #25703 之后合并，否则文档先于运行时。回滚即还原本 PR。
• 席位意见：
• 你要做的：在 feat(spec): an api flow's start node may name its hook secret (config.secretRef), resolved per post #25703 合并后批准并合并本 PR（Tier H，需你的批准）。

🤖 Generated with Claude Code

https://claude.ai/code/session_01NZJKktPWaz2EZJ95a9XZa8

---

Generated by Claude Code

[objectstack-fleet]

维护者速读

改了什么
只改自动化技能文档（skills/objectstack-automation/SKILL.md）里 api 入站钩子起始节点表的一行。原文写「必须写非空的字面 secret，否则流程注册被拒」。新文写「secretRef 或 secret 二选一必填；包里写 secretRef: '名字'，由部署方用同名环境变量填值（不得用 OS_ 开头），没填值时每次请求回 503；不要提交字面密钥」。签名头名称 x-objectstack-signature 从这一行挪到下面的签名说明里，没有丢。另带一个 @objectstack/skills patch 变更集。共 2 个文件，+13/−2。

为什么改
#25703 按裁决 A（#25675 评论 6386630545，维护者「25635 25647 25675 同意」）新增了 config.secretRef，原句随之变假。这份技能文档会随包发给客户的 AI 读。不改的话，AI 会继续把字面密钥写进公开仓库，这正是裁决要消除的事。这一行原本在 #25703 里，席位要求拆出来单独成 PR，好让 #25703 的代码改动不受人合约束，也让你只需审这一行。

风险与代价(含回滚)
只改文档，不影响运行时。风险只在时序：#25703 没合或被回滚时，这一行会教一个运行时还没有的键，所以要等 #25703 合并后再合本 PR。行数不变（438 → 438），token +16，在上限内（5771 / 5780）。回滚就是 revert 本 PR。

席位意见
建议在 #25703 合并后合并。席位逐句对照 #25703 的 diff（head 088e442390）核过：「二选一必填、都没写则注册被拒（os validate 也拒）」对应 lint 规则 flow-api-trigger-secret-missing 与引擎注册检查；「不得用 OS_」对应 ApiTriggerSecretRefSchema 的第二条 pattern；「没填值回 503」对应 FlowCredentialUnresolvableError → trigger-api 的 503；「签名在 secret 之下」不变。表上方「起始节点 config 是没有 Zod 形状的自由记录」这句仍然成立：secretRef 的三条拒绝写在 FlowSchema 的 superRefine 里，不是 config 上的形状。对外契约的放宽由 #25703 上的契约复审（CONTRACT_REVIEW_TIER）判定，复审会一并对照这一行。

你要做的
在 #25703 合并后，批准本 PR。

席位核对

Tier H · #25675 (skill row) · domain:spec seat 2 (seat post #18549) · sunhaolin · session session_01PC4NPXPgPmpDRG9DdDnyXT · 2026-10-24T20:12Z · head 44ca1a0801 · report addendum 6388889634 (on #25675; cloud session session_01NZJKktPWaz2EZJ95a9XZa8) · this record stands in for ACCEPT; the maintainer merges.

1. Shape. Draft, base main, first line Refs #25675 with no closing keyword (PR feat(spec): an api flow's start node may name its hook secret (config.secretRef), resolved per post #25703 carries Fixes #25675). The body says it merges after feat(spec): an api flow's start node may name its hook secret (config.secretRef), resolved per post #25703. Two files: skills/objectstack-automation/SKILL.md (+2/−2) and .changeset/25675-skills-secret-ref-row.md (@objectstack/skills patch, Clause-②: no, Metadata-protocol: none). check-governed-merges --pr 25708: GOVERNED, skills/** ×1, Tier H. Both GOVERNED_APPROVERS (hotlong, os-zhuang) are requested reviewers. needs-user-decision is added in this stroke.
2. The row, measured against feat(spec): an api flow's start node may name its hook secret (config.secretRef), resolved per post #25703 at 088e442390.
   • "either one is required; without one the flow is refused at registration (os validate too)": flow-api-trigger-secret-missing accepts a usable reference in place of a literal, and so does the engine's registration check.
   • "not OS_*": the second pattern on ApiTriggerSecretRefSchema.
   • "unfilled ⇒ 503": hookSecretResolver throws FlowCredentialUnresolvableError (SERVICE_UNAVAILABLE), which trigger-api answers 503. An unfilled name does not block registration, and the row does not claim it does.
   • "never a literal" is the ruling's 「公开仓库里不再出现任何凭据」.
   • The signature line keeps the header name the row used to carry.
3. Gates. ci-failure --pr 25708 GREEN: 40 check-runs on 44ca1a0801, all completed, none failed. Local, per the addendum: 46 derived, 44 exit 0, 2 NOT MEASURED (full-build prerequisites), and --ran shows 0 UNRUN. Token ratchet 5771 / 5780, lines 438 → 438.
4. Deviations accepted. None on this PR. The generated references/_index.md stays on feat(spec): an api flow's start node may name its hook secret (config.secretRef), resolved per post #25703, where check:skill-refs needs it and the [finding] skills/*/references/_index.md is generator-owned (gen:skill-refs) yet sits inside the skills/** governed-merge fence — every spec PR touching an indexed headline is forced to carry a governed-surface file #11705 exception lifts it.
5. Landing. Tier H: the PR stays draft and out of the queue until an authorized approval. After that approval, and once PR feat(spec): an api flow's start node may name its hook secret (config.secretRef), resolved per post #25703 is MERGED on origin/main, the seat runs the pre-landing checks and sends pr_ready + automerge_enable through the relay. It is listed in the round report as awaiting a human merge.

---

Generated by Claude Code

[objectstack-fleet]

Review label cleared · approval of record os-zhuang APPROVED 2026-10-24T23:05:52Z · prerequisite PR #25703 merged 2026-10-24T21:53:34Z · 2026-10-25T01:40Z

Director seat, summon #49 (session session_0162wFwDdLFGhaSvDdSnZ9Sx, account os-zhuang; written as objectstack-fleet[bot] through the relay; ledger #12708). The seat record 6388999892 set two landing conditions — an authorized approval, and PR #25703 MERGED on origin/main — and both now hold; the head is unchanged at 44ca1a0801 with 35 check-runs success and 11 skipped, none failed. needs-user-decision leaves the PR in this act (the director's review-label clearance; this seat does not land). Landing — pre-landing checks, then automerge_enable through the relay — belongs to the domain:spec seat 2 that holds the card (#25675).

---

Generated by Claude Code

[objectstack-fleet]

Dequeued · domain:spec seat 2 (seat post #18549) · sunhaolin · session session_01PC4NPXPgPmpDRG9DdDnyXT · 2026-10-25T03:27Z

The merge group for this PR failed one check, Type Check · source gates (run 40141451659, job 121013874616), at the step "Published skills token ratchet (#10473)":

skills/objectstack-automation/SKILL.md is 5793 tokens; the ratchet ceiling is 5780 (over by 13).

On its own base (b1790841) this PR measured 5771 / 5780, and the head CI was green. Since then main has gained text in the same file, so the merged tree is over the ceiling. This is the PR's to fix, not a flake.

In progress: a patch round to the dev session. It merges origin/main and pays for the overage by genuine deletion in the same file, without raising the ceiling. The row's facts stay intact. The push will dismiss the approval of record (os-zhuang, 2026-10-24T23:05Z), so this PR will need it again before the seat re-runs the pre-landing checks and re-enables auto-merge.

---

Generated by Claude Code

[objectstack-fleet]

Re-approval asked · domain:spec seat 2 (seat post #18549) · sunhaolin · session session_01PC4NPXPgPmpDRG9DdDnyXT · 2026-10-25T03:41Z

The token-ratchet fix is pushed. The head moved from 44ca1a0801 to 6194271233: a merge of origin/main, plus a genuine deletion in skills/objectstack-automation/SKILL.md.

• The row is tightened. Every fact it teaches stays: one of secretRef / secret required, else refused at registration and os validate; secretRef: 'NAME' is an env var the deployment fills, not OS_*; unfilled ⇒ 503; never a literal.
• The parenthetical "(the start config is a free-form record with no Zod shape)" above the table is dropped. It was true, and it carried nothing the table needs.
• ci-failure --pr 25708: GREEN, 44 check-runs, none failed. That includes Type Check · source gates, whose token-ratchet step refused the merge group last time.

Asked: the approval of record (os-zhuang, 2026-10-24T23:05Z) is on 44ca1a0801, and the governed text changed after it. A GOVERNED_APPROVERS approval (os-zhuang or hotlong) on 6194271233 is needed. After that the seat re-runs the pre-landing checks and re-enables auto-merge.

---

Generated by Claude Code