[objectstack-fleet]

Fixes #27017
Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:release.yml 发布步骤上方的注释现在按顺序写清 scripts/release-publish.sh 实际做的三件事(先跑 @object-ui 发布产物的 tooling 扫描、再 changeset publish、最后一次性推 tag);删掉 ui/package.json 里没人调用的 changeset:publish 别名;它的接线测试改为钉住真实发布路径。
• 为什么改:发布路径的说明要和真正运行的脚本一致;一个无人调用的别名会让人以为还有第二个发布入口,而且它跑的扫描不带 --no-build,与真实发布读的不是同一批产物。
• 风险与回滚:无运行时影响。release.yml 只改注释,发布逻辑一个字节没动;ui/package.json 是私有工作区根(private: true),不发布。回滚即 revert 本 PR。
• 先看:① ui/scripts/__tests__/check-published-dist-tooling.test.ts 的 runs on the publish path 用例(钉的东西从别名换到 scripts/release-publish.sh,断言没有放松);② .github/workflows/release.yml 发布步骤注释;③ ui/package.json 删的那一行。
• 两分钟验证:pnpm --dir ui exec vitest run scripts/__tests__/check-published-dist-tooling.test.ts,预期 35/35 通过。
• 需要你做的:审阅并批准本 PR(release.yml 属 Tier H,需授权审批)。

What changes

1. .github/workflows/release.yml — comment only. The text over the publish step said scripts/release-publish.sh "is changeset publish followed by ONE atomic git push origin --tags". Measured on origin/main: since the four-gate port the script first runs node ui/scripts/check-published-dist-tooling.mjs --no-build and refuses to publish when it is red, and since the npm-record change it records npm's per-package answers for scripts/release-verify-npm.mjs. The comment now lists the three things the script runs, in order. No step, run: line or condition changed. ⛔ The release workflow was not run, dispatched or re-run to test this (Prime Directive 15); the edit is text.
2. ui/package.json — the changeset:publish alias is removed, not re-described. Nothing invokes it: git grep -n 'changeset:publish' outside ui/package.json hits only the wiring test, a past-tense history line in scripts/release-publish.sh's comment, and released CHANGELOG.md entries (release-owned, untouched). No workflow and no script under .github/ or scripts/ calls it. JSON carries no comments, so "make it say what it is for" has no spelling here, and what it ran (the scan without --no-build, then changeset publish) is a second publish door that reads a different build from the release's. ui/package.json is private: true, so nothing publishes.
3. ui/scripts/__tests__/check-published-dist-tooling.test.ts — the wiring pin keeps its invariant (the gate runs before changeset publish on the publish path) and moves to the live path: the workspace root's release script ends in bash scripts/release-publish.sh, and that script (comment lines dropped) runs the gate as if ! node ui/scripts/check-published-dist-tooling.mjs --no-build; then before its changeset publish line. The old comment's claim that changesets/action runs changeset:publish was false (release.yml runs pnpm run release) and is gone.

The whole card rides one PR in lane domain:skills, as triage ordered; the two ui/** files are the ui lane's tree, carried here because they describe the same publish path as the release.yml comment.

Tests

Edited test file, and the reverse check (three mutations, each red, then green again)

• pnpm --dir ui exec vitest run --maxWorkers=2 scripts/__tests__/check-published-dist-tooling.test.ts (under the verify lock): Test Files 1 passed (1), Tests 35 passed (35), VERDICT command-exit 0.
• Reverse check on the real files (the test reads fixed paths), each through scripts/ablation-replace.mjs with the fix committed, anchor hit counted, git checkout HEAD trap, and blob-hash restore check:
  • --no-build dropped from the gate line in scripts/release-publish.sh → runs on the publish path failed (expected … to match /^if ! node ui\/scripts\/check…/), exit 1; restored, blob equals HEAD.
  • root release script's && bash scripts/release-publish.sh replaced by && changeset publish → failed (expected false to be true), exit 1; restored.
  • a changeset publish line put ahead of the gate in scripts/release-publish.sh → failed (expected 43 to be less than 19), exit 1; restored.
  • Re-run on the restored tree: 35/35, exit 0.

Acceptance notes

• scripts/release-publish.sh's own header (lines 25–27) still says it is "Run as the publish: command of changesets/action", which release.yml says it is not. Same family of stale text, outside this card's three files; noted, not edited here.
• ui/scripts/__tests__ full directory on the final head 7076bbdd: 175 files passed, 2 skipped; 5019 tests passed. On a fresh worktree it first needs @objectstack/spec, @objectstack/formula and @objectstack/client built: before those builds, 3 files failed on missing dist/ (none of them reads a file this PR changes).

Verification

Head 7076bbdd (merged with origin/main). dispatch-gates --commands derived 62 families; all 62 ran locally with exit 0, including pnpm check:pm-dispatch-gates and pnpm --dir ui exec vitest run scripts/. --ran reconciliation: 62 derived, 62 run, 0 NOT-MEASURED. Outside the derivation: eslint on the edited test exit 0. CI check-runs were not awaited. Full readings are in the os-dev report on #27017.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 7076bbdd79803a7e02a6643d991179a1c608f6c9
Local-runs: none
Scope: .github/workflows/release.yml (comment block over the publish step), ui/package.json (one script line removed), ui/scripts/tests/check-published-dist-tooling.test.ts (the runs on the publish path pin) + scripts/release-publish.sh L73/L92–L112 and the root package.json release script — read as the pinned targets, not reviewed

Read at 2026-10-28T07:45Z by the domain:skills#2 seat on the fetched head (merge-base 6817bf1e): three files, +27/−11. Read-only readings taken in this act: node scripts/pm/check-governed-merges.mjs --pr 27131 → exit 0 (Tier H by .github/workflows/release.yml; 38 changed lines ≤ 3000); git grep -n 'changeset:publish' origin/claude/issue-27017-ui-publish-check-texts -- . ':!**/CHANGELOG.md' → one hit, the past-tense history line scripts/release-publish.sh L65. Tier H by path (.github/workflows/**); the approval of record is os-zhuang's APPROVED review 5679210902 on this head (2026-10-28T07:31Z), who also readied the PR (2026-10-28T07:31Z) and enqueued it (2026-10-28T07:43Z) — the seat flipped nothing. Both GOVERNED_APPROVERS were requested by the relay pr_create run (timeline, 2026-10-28T07:29Z); hotlong remains requested. This record is the surface-owed review; it lands after the approver's own ready and enqueue, which outran the seat's review window.

① Derived judgments

• No accept set and no runtime surface moves. release.yml: 13 lines inside one # block, no step, run:, if: or env: line touched (diff read line by line; the step Publish to npm + push version tags and its run: body are byte-identical). ui/package.json is private: true; the removed changeset:publish alias had no caller (reading above: zero invocations outside its own definition, a history comment and release-owned CHANGELOG entries). skip-changeset is the right declaration.
• The corrected text is true on the head: scripts/release-publish.sh L73 if ! node ui/scripts/check-published-dist-tooling.mjs --no-build; then refuses the publish; L92 starts the npm record, L98 changeset publish, L102 prints npm's answers for scripts/release-verify-npm.mjs, L112 git push origin --tags — the three items in the order the comment now lists them. The old sentence omitted the gate the script refuses on.
• The alias was a second publish door that scanned a different build: its scan ran without --no-build (so it rebuilt and inspected its own artifacts), while the release inspects the artifacts the workflow's build step packed. Removing it rather than re-describing it is the enforce-or-remove shape; a JSON manifest carries no comment spelling anyway.
• The moved pin keeps the invariant it protected (gate before changeset publish on the publish path) and now reads the live path: root release ends in bash scripts/release-publish.sh; the script, comment lines stripped first (its header names changeset publish in prose), matches ^if ! node ui/scripts/check-published-dist-tooling.mjs --no-build; then$ and that line precedes ^changeset publish\b. The regex is anchored and the gate string is escaped. The old pin's premise (changesets/action runs changeset:publish) was false — release.yml runs pnpm run release — and is gone.
• The dev's reverse check is the right one for a pin that reads fixed files: three mutations of the real targets (gate without --no-build; root release ending in changeset publish; a changeset publish line ahead of the gate) each went red with the asserted message, then 35/35 green on the restored tree with blob hashes equal to HEAD. Read from the report, the method is sound; the seat did not re-run it (no ui/node_modules in the shared checkout; the Test UI lanes on this head run the file).

② Semver level

• None owed: a workflow comment, a private workspace manifest and a test. Clause-②: no, Metadata-protocol: none on the PR body match the claim; no Skills-docs: line owed.

③ Boundary flags

• Cross-lane files: ui/package.json and ui/scripts/__tests__/** are domain:ui's tree, carried in this lane's PR by the triage order (one PR, domain:skills); the PR body declares them. The ui lane's in-flight claims were intersected at dispatch (no hit on these two files).
• scripts/release-publish.sh header L25–27 still says the script is run "as the publish: command of changesets/action" — stale prose outside the card's three files, zero runtime effect; recorded under Acceptance notes, not filed (no class a/b/c reach).
• Dev deviations accepted: base moved from 5fe0b967 to a27f889a with two origin/main merges (the touched comment text unchanged across the range); the ui scripts suite needed three package builds on a fresh worktree (outside the diff); the first pnpm check:pm-dispatch-gates run lacked exit capture and was re-run with capture (EXIT 0 twice).
• ⛔ The release workflow was not run, dispatched or re-run by the dev or the seat (Prime Directive 15); the edit is text.
• Author objectstack-fleet[bot] through the relay; mcp_calls: 0.

④ Design judgment

• Against the scenario the card names (a reader of release.yml asking what guards the publish): the comment now names the gate, the order and the reason for --no-build, and the only other spelling of the publish path (the alias) is gone, so there is one door and one description of it. Against ADR-0049 enforce-or-remove: a declared-but-uncalled alias was removed rather than documented. Holds. Residual: the stale header in scripts/release-publish.sh (noted above) is the same family and will mislead the next reader of the script until someone touches that file.

Implemented-by: claude/issue-27017-ui-publish-check-texts
Reviewed-by: session_01QSeKYmhU5KEj1nukYhp1Tg

VERDICT: PASS

[objectstack-fleet]

维护者速读 — 席位终稿 · PR #27131 · head 7076bbdd · domain:skills#2 · 2026-10-28T07:46Z

• 改了什么:release.yml 发布步骤上方的注释按真实顺序写清 scripts/release-publish.sh 做的三件事(先跑 @object-ui 发布产物的 tooling 扫描并在红时拒发、再 changeset publish 并记录 npm 逐包应答、最后一次性推 tag);删掉 ui/package.json 里无人调用的 changeset:publish 别名;它的接线测试改为钉住真实发布路径(根 release 脚本 → scripts/release-publish.sh 的 --no-build 门在 changeset publish 之前)。
• 为什么改:原注释漏掉了脚本会拒发的那道门;别名是第二个发布入口,且它跑的扫描不带 --no-build,读的不是发版真正打包的那批产物。
• 风险与回滚:零运行时影响 —— release.yml 只动 # 注释(席位逐行核过,step/run/if/env 一字节未动);ui/package.json 是 private: true 的工作区根,不发布;测试断言没有放松(锚定正则 + 顺序断言)。回滚 = revert。
• 先看:ui/scripts/__tests__/check-published-dist-tooling.test.ts 的 runs on the publish path 用例;release.yml 注释块;ui/package.json 删的那一行。
• 两分钟验证:pnpm --dir ui exec vitest run scripts/__tests__/check-published-dist-tooling.test.ts,预期 Tests 35 passed (35)。
• 需要你做的:无 —— os-zhuang 已于 2026-10-28T07:31Z 批准并翻 ready、2026-10-28T07:43Z 入队(Tier H 人批在案);席位未动它,跟到 MERGED。
• 席位意见:ACCEPT。三条前提(注释漏门、别名零调用、旧 pin 前提为假)席位在取回的 head 上逐条实测成立;dev 对真实文件做的三次反向突变各自变红,是对「读固定路径的 pin」正确的验证法。

席位核对 — ACCEPT · domain:skills#2 · session_01QSeKYmhU5KEj1nukYhp1Tg · 2026-10-28T07:46Z

1. 形态:ready(os-zhuang 翻)→ main,已入队,首行 Fixes #27017,Clause-②: no、Metadata-protocol: none 行首在;三个文件 +27/−11;assignee os-justin;skip-changeset 正确;ui/** 两文件为跨车道面,PR 正文已申报,分诊令「一张 PR、domain:skills」在案(6458605256)。
2. 前提实测:席位在取回的 head 上核 —— scripts/release-publish.sh L73 门行、L98 changeset publish、L112 git push origin --tags 顺序与新注释一致;git grep changeset:publish(排除 CHANGELOG)仅余 L65 历史注释;根 release 脚本以 && bash scripts/release-publish.sh 结尾;新 pin 的正则与顺序断言读过。
3. 门禁 check-runs(head 7076bbdd,本笔读数 2026-10-28T07:46Z):61 check-runs,45 success · 16 skipped · 0 in progress · 0 failure(mergeable_state: clean)。Nightly Tiers 未在本 head 触发(其 paths: 不含本 PR 文件)。dev 本地并集 62/62 exit 0 钉 7076bbdd(报告 6463331056)。
4. 接受的偏差:① base 自 5fe0b967 移到 a27f889a 并两次合入 origin/main,所改注释文本跨该范围未变;② 新鲜 worktree 跑 ui 脚本套件需先构建三包(diff 之外);③ 席位未本地重跑该测试(共享检出无 ui/node_modules),以 head 上 Test UI lane 为读数。
5. 范围外去向:none filed;scripts/release-publish.sh L25–27 的 changesets/action 陈旧头注记 Acceptance notes(无 a/b/c 触达)。Skills-docs: 不欠(kind none)。
6. 落地条款:Tier H;授权批准(os-zhuang APPROVED 5679210902,head 7076bbdd)在案,本人已 ready + 入队;契约复核 PASS 评论 6463562292(晚于入队:审批人动作快于席位复核窗口,记录仍钉同一 head);席位不再动它,MERGED 后关卡摘 pm:dispatched。