Repository navigation
ci: Spec Main Shape Gate leaves the required set — hourly on main as part of the full battery, advisory on PRs; the required-check pin goes 8 → 7 and the maintainer removes the check from the ruleset (two-speed CI, objectstack#22998; ruled B) #12240
Description
Protects: this repository's required check set (ruleset 11776024), the published check-run names every PR and merge group of @object-ui/* passes through; this card removes one name from the set on the maintainer's ruling and keeps the other seven byte-identical.
Filed by the director seat (summon #37, session_01LqNgdPZB2Jnr5HpGbaqLeB) on the maintainer's word 「我接受你的建议」 (2026-10-12) to the open question the objectui#12214 dev raised (report 6123124321, question 1): letter B. Filing gate ③: maintainer-directed. ⛔ Not a claim. The PR stays a draft for the maintainer (the CI cards' posture). Lands after objectui#12232, which edits spec-main-shape-gate.yml.
What is measured (the #12214 dev, the jobs API)
Spec Main Shape Gatewalls 12.8 min median onpull_requestand 13.3 onmerge_group(13.7 on PR ci: two-speed CI — affected tests on PR and queue runs, full suite and coverage on main's push and hourly schedule, spec gate reuse by objectstack sha, fifteen gate workflows folded into Repo Gates (objectui#12214) #12232's own run): build@objectstack/specfrom objectstackmain1.3 min, pack 0.3, then a forced type-check of this repository against it 10.6–11.5 min. The inject step writes the sha and the injection time into the turbo-hashed marker, so the compile is never served from a cache, by design (its defence against a false green).- After ci: two-speed CI — affected tests on PR and queue runs, full suite and coverage on main's push and hourly schedule, spec gate reuse by objectstack sha, fifteen gate workflows folded into Repo Gates (objectui#12214) #12232, this gate is the PR's critical path (13 min);
Type Check(9.3–10.6, objectui#12222) is next. - The gate's verdict is about seven tenths objectstack's drift: objectstack
mainmoves about 70 times a day, this repository pins objectstack by sha for its ownType Check, and the gate compiles against the unpinnedmain.
The ruling (B) and what to build
- The gate keeps running: hourly on
main'sschedule(already added by ci: two-speed CI — affected tests on PR and queue runs, full suite and coverage on main's push and hourly schedule, spec gate reuse by objectstack sha, fifteen gate workflows folded into Repo Gates (objectui#12214) #12232) as part of the full battery, and onpull_request/merge_groupas an advisory check (it still posts its verdict; it no longer blocks). Nothing in its verification changes; the anti-false-green marker stays. scripts/check-required-check-set.mjsand its test: the required set becomes seven names (Lint,Type Check,Build & E2E,Build Docs,Changeset Declaration,Test,Governed Surface Queue Guard),Spec Main Shape Gateremoved with a tombstone comment naming this card's ruling;required-check-set-patrolstays green on the new set.- A red on the hourly gate is a main-red for the
domain:devx@ objectui lane (objectstack#22998's rule): the lane's next PR carries the fix or the pin bump. - Maintainer's act, in the same sitting as the merge: remove
Spec Main Shape Gatefrom the required status checks of ruleset 11776024 (Settings → Rules → Rulesets →main). The PR body carries the before/after list.
Expected: the PR wall drops from about 13 min to the Type Check bound (about 10 min, then lower with objectui#12222).
Acceptance
- Three consecutive PRs: all required checks green within the
Type Checkbound;Spec Main Shape Gatestill appears on the PR as a non-required check; the hourly run onmaincarries it. - The PR body lists the seven required names (byte-identical to the live ruleset after the maintainer's edit).
Related: objectui#12214 (PR #12232) · objectui#12222 · objectui#12208 · objectstack#22998 · scripts/check-required-check-set.mjs.
Activity
objectstack-fleet commentedon Oct 12, 2026
Claim: PM loop round 1 · the director seat dispatching on the maintainer's standing order, verbatim 「三仓的 ci 优化卡你负责派发」 (this seat's session, 2026-10-12T12:30Z)
Session:
session_01LqNgdPZB2Jnr5HpGbaqLeBAccount:
os-zhuangBranch:
claude/issue-12240-spec-gate-advisoryWorktree:
objectui-issue-12240Domain:
domain:devxSeat:
domain:devx#9File surface:
.github/workflows/spec-main-shape-gate.yml(the advisory posture on PR runs; the hourlyscheduleas landed by PR #12232 stays),scripts/check-required-check-set.mjsand its test (the pin 8 → 7 with a tombstone naming the ruling),.github/workflows/required-check-set-patrol.ymlonly if the patrol pins the count, any other script or doc line that enumerates the eight required names; ⛔ notci.yml(objectui#12222 owns itstype-checkjob, objectui#12208 PR-2 itstestjob), ⛔ not the ruleset (the maintainer's act) (stop on breach; explain in the report)Container & model:
S,mode:subagent,model: opus(the default judgment tier; objectstack'sdispatch-gates --tier --repo objectstack-ai/objectuion the paths answers no path-derived mandate). Tier H:.github/workflows/**is a governed surface in this repository; the PR stays a draft until aGOVERNED_APPROVERSmember approves it.Clause-②: no
Responsibility:
n/a — not a defect cardThread-read: none
Ruling-ref: objectui#12214 ACCEPT 6123370050 (its open question 1 → B on the maintainer's word verbatim 「我接受你的建议」) and objectstack-ai/objectstack#22998 (the doctrine)
Serial constraints cleared: PR #12232 (objectui#12214, the last PR on
spec-main-shape-gate.yml) is MERGED (21fdeb34); objectui#12222 (claimed in this act) editsci.ymlandturbo.jsononly; no other in-flight claim in this repository declares these files. Mergeorigin/mainbefore opening the PR.objectstack-fleet commentedon Oct 12, 2026
os-dev-report
{
"issue": 12240,
"status": "done",
"branch": "claude/issue-12240-spec-gate-advisory",
"pr": "#12250",
"session": "session_01LqNgdPZB2Jnr5HpGbaqLeB (subagent of the director seat; the relay stamped this id on the PR)",
"premise_still_valid": true,
"summary": "Draft PR #12250 (head 2212437, three commits on main 923504f, no main merge needed: origin/main had not moved). (1) spec-main-shape-gate.yml: header only (parsed YAML identical to main's) - advisory on pull_request, the hourly schedule on main is its full-battery place and a red there is a main-red for the domain:devx lane under objectstack#22998 rule 3, merge_group kept with the reason, no continue-on-error. (2) scripts/check-required-check-set.mjs: PINNED Type Check plus WATCHED Lint, Build & E2E, Test, Build Docs, Changeset Declaration, Governed Surface Queue Guard = the seven ruled names; Spec Main Shape Gate under a tombstone naming objectui#12240 and ACCEPT 6123370050 answer B; its test pins the merge-then-edit window on a verbatim live reading of 2026-10-12 (DRIFTED, exit 0). (3) H1 partly refuted: scripts/dependabot-merge-gate.mjs held the name in REQUIRED_CONTEXTS, a second in-tree blocking mechanism (Dependabot auto-merge waited for it); moved to NOT_A_GATE with its reason and a by-name pin. (4) Every other enumeration moved: repo-gates.yml header, the patrol's comment counts, the pipeline guide (row, section, fold paragraph, patrol counts), the doc test's two ledger reasons. H2 (drop merge_group) not taken: the ruled merge-then-edit order would stall this PR's own queue build at the 60-minute timeout, and spec-main-shape-gate.test.ts pins the trigger; proposed as a follow-up in open_questions.",
"tests": "On head 2212437: pnpm exec vitest run scripts/ eslint-rules/ under os-verify-lock = 191 files passed, 2 skipped, 1 failed (dollar-dialect-alias-census.test.ts timed out at 15000ms, import phase 344.73s on the shared box; it reads none of the changed files; rerun alone 37/37 passed in 8.11s, VERDICT command-exit 0), 5778 tests passed, VERDICT command-exit 1. Core six files (check-required-check-set, dependabot-merge-gate, merge-queue-reporting, spec-main-shape-gate, ci-cd-pipeline-doc, check-merge-queue-head): 6 files, 252/252, VERDICT command-exit 0. node scripts/check-required-check-set.mjs --self-test: 32 cases pass, exit 0. pnpm type-check:scripts: VERDICT command-exit 0, --listFilesOnly includes the 3 edited test files. Ablations, each committed first and run through objectstack's scripts/ablation-replace.mjs (anchor hit 1 → 0, blob changed, restored blob == HEAD, git diff HEAD empty): (a) Spec Main Shape Gate re-added to WATCHED_CONTEXTS → check-required-check-set.test.ts 6 failed / 25 passed, restored 76373853; (b) Spec Main Shape Gate put back in REQUIRED_CONTEXTS → 4 failed / 53 passed (dependabot-merge-gate + merge-queue-reporting; merge-queue-reporting stays green because merge_group is kept), restored 21f065a2; (c) merge_group trigger deleted → 1 failed / 211 passed over the five affected files (spec-main-shape-gate.test.ts 'subscribes merge_group, so a maintainer can enrol it without stalling the queue'), restored ba27aba4. Direction observed: red in all three, as predicted. No dist involved (root scripts, no build).",
"gates": [
"objectstack dispatch-gates.mjs --commands --repo objectstack-ai/objectui → exit 2, REFUSING (derives only from an objectstack checkout, by design); list hand-derived from objectui package.json and workflows; --tier --repo on the 12 paths → no path-derived mandate",
"pnpm exec vitest run scripts/ eslint-rules/ → VERDICT command-exit 1 (one unrelated load timeout, rerun alone exit 0) on 2212437",
"6 core test files → 252/252, VERDICT command-exit 0",
"node scripts/check-required-check-set.mjs --self-test → exit 0 (32 cases)",
"check-required-check-set live: node fetch → exit 2 (HTTP 401 through the agent proxy); gh api rules/branches/main fed via --fixture → DRIFTED, exit 0, 'Required but not declared here: Spec Main Shape Gate.'; ruling-12240.json → INTACT, exit 0",
"pnpm type-check:scripts → exit 0",
"eslint --no-inline-config --format json over the 5 changed .mjs/.ts → 5 files, 0 errors, 0 warnings; population from eslint.config.js (flat default js/mjs + files */*.{ts,tsx}, no ignore covers scripts/), count from JSON, type-aware linting off and no eslint-rules/ rule reads disk ⇒ no untouched file's verdict can move",
"pnpm lint (turbo, repo-wide): NOT MEASURED locally, reason: no package source changed; CI owns the repo-wide run",
"check-governed-queue-guard --self-test → 0 (188 cases); --test over the 12 paths → NOT GOVERNED",
"check-merge-queue-head --self-test → 0; check-changeset-presence → 0 (no changeset owed); check-control-bytes → 0; check-doc-links → 0; check-doc-fence-languages → 0; check-action-ref-convention → 0; check-new-cross-file-line-citations → 0 new, exit 0; check-pre-install-import-graph → 0; check-lint-coverage → 0; check-test-path-roots → 0",
"YAML parse of the 3 touched workflows → ok; each parses identical to main's (comment-only); actionlint NOT MEASURED, not installed",
"control-byte self-scan (grep -P) of the edited workflow and PR body → no hits",
"PR #12250 CI on 2212437 at 12:58Z: in_progress (Changeset Fixed Group Check success, label success; Spec Main Shape Gate running on the PR as before; the rest in_progress). Not waited for, per the dispatch contract."
],
"required_checks": {
"before": "Live, 2026-10-12, ruleset 11776024 via gh api repos/objectstack-ai/objectui/rules/branches/main, endpoint order: Lint, Type Check, Build & E2E, Build Docs, Changeset Declaration, Test, Spec Main Shape Gate, Governed Surface Queue Guard",
"after": "After the maintainer's edit: Lint, Type Check, Build & E2E, Build Docs, Changeset Declaration, Test, Governed Surface Queue Guard (byte-identical to the pin and to fixture ruling-12240.json)",
"maintainer_act": "Settings → Rules → Rulesets → 11776024 (main) → required status checks: remove Spec Main Shape Gate. Either order vs the merge is safe because merge_group stays subscribed; edit first only if the gate is red at enqueue time."
},
"trigger_decision": "merge_group KEPT (H2 refuted on sequencing). Reading: the ruled order is merge first, ruleset edit second, and this PR lands through the queue; a merge group runs its own head's workflow file, so with the trigger dropped this PR's queue build and every entry built on it (max_entries_to_build 5) would never report a still-required context and would fail at check_response_timeout_minutes 60. Pin: spec-main-shape-gate.test.ts 'subscribes merge_group' reds on the drop (ablation c). merge-queue-reporting's derived floor no longer binds once the name is NOT_A_GATE. Cost of keeping: newest 100 completed merge_group runs (2026-10-09T12:50Z..2026-10-12T12:17Z, total_count 1255) = about 33.6/day at 13.1 min median wall = about 440 runner-min/day, public repo, unbilled; pull_request: 100 runs in 1.08 days, 12.1 min median. pull_request, workflow_dispatch and schedule unchanged. H3 confirmed: the schedule (cron 48 * * * ) is in spec-main-shape-gate.yml itself; no ci.yml line touched; first scheduled run NOT MEASURED (none listed at 12:55Z; PR #12232 merged 12:10Z).",
"patrol_between_merge_and_edit": "GREEN, proven from the script: an undeclared required context gives verdict drifted, exitCodeFor('drifted') = 0, and the patrol's fail step runs only on a non-zero exit. Measured with this branch's script over today's live answer: DRIFTED, 'Required but not declared here: Spec Main Shape Gate.', exit 0; pinned by the test on live-2026-10-12.json. After the edit: INTACT on seven, exit 0. Today on main (before the PR) the patrol already reads DRIFTED naming Governed Surface Queue Guard as undeclared; this PR declares it. Edit-before-merge: main's old pin reads DRIFTED naming both halves, exit 0. The only pinned name, Type Check, is untouched, so no order makes it red.",
"files_changed": "12 files as GitHub counts them (+236/−148; the two retired fixtures pair with the two new ones as renames), 14 paths vs 923504f: M .github/workflows/spec-main-shape-gate.yml (header comment), M .github/workflows/repo-gates.yml (header comment), M .github/workflows/required-check-set-patrol.yml (two comment counts), M scripts/check-required-check-set.mjs, M scripts/tests/check-required-check-set.test.ts, A scripts/tests/fixtures/required-check-set/live-2026-10-12.json, A .../ruling-12240.json, M .../type-check-removed.json, D .../ruling-9499.json, D .../ruling-9969.json, M scripts/dependabot-merge-gate.mjs, M scripts/tests/dependabot-merge-gate.test.ts, M scripts/tests/ci-cd-pipeline-doc.test.ts (two ledger reason strings), M content/docs/guide/ci-cd-pipeline.md. Three commits: e457d3d workflow header, e9617ea pin + Dependabot gate + other enumerations, 2212437 docs.",
"deviations": [
"H2's suggested route (drop merge_group) not taken; reason in trigger_decision; proposed as a post-edit follow-up in open_questions.",
"File surface beyond the claim's named files, each an enumeration of the required set or the H1 mechanism: scripts/dependabot-merge-gate.mjs and its test (REQUIRED_CONTEXTS → NOT_A_GATE; the workflow header called that line the in-tree half of the enrolment), repo-gates.yml header (present-tense list of required names), the pipeline guide, and two reason strings in ci-cd-pipeline-doc.test.ts's command-parity ledger (keys unchanged).",
"required-check-set-patrol.yml edited although it pins no count mechanically (the claim's condition): its comments carried present-tense counts ('requires nine check contexts', 'the eight WATCHED contexts'); comment-only, parsed YAML identical.",
"Governed Surface Queue Guard added to WATCHED_CONTEXTS: the ruled seven include it and it was never declared (live patrol reading on main already DRIFTED on it).",
"Two fixtures retired (ruling-9499.json, ruling-9969.json): read by nothing after the control moved to ruling-12240.json and the #9969 window test was replaced by the #12240 one.",
"dispatch-gates refused for objectui by design; the gate list was hand-derived (os-dev local-scope rules). Repo-wide pnpm lint not run locally.",
"PR body line 2 carries 'Clause-②: no' copied from the claim's Clause-② line.",
"Commit trailers use AGENTS.md's model-free pair (Co-authored-by: Claude, Claude-Session) rather than the harness reminder's model-named Co-Authored-By; PR footer uses os-dev's session-URL form."
],
"mcp_calls": "0",
"api_writes": "2 strokes through the fleet-write relay: (1) pr_create = POST /repos/objectstack-ai/objectui/pulls (draft) + POST /repos//issues/12250/assignees [os-zhuang], carried by POST /repos/objectstack-ai/objectstack/dispatches (run 38252398167, read-back identical 13756 bytes, assignee os-zhuang); (2) this os-dev-report comment POST /repos//issues/12240/comments. git push x2 (empty-branch probe, then the three commits; not REST). Zero label writes: objectui labels are path-driven (labeler applied documentation, configuration, ci/cd, tests) and no gate reads a dev-applied label.",
"open_questions": [
{
"question": "After the maintainer's ruleset edit, should Spec Main Shape Gate stop running on merge_group? Kept here only because the ruled merge-then-edit order makes dropping it unsafe until the edit.",
"options": [
"A: keep merge_group permanently: an advisory verdict on every queue build nobody waits for; re-enrolment stays a settings click; about 440 runner-min/day, unbilled, occupying runner slots",
"B: once the patrol reads INTACT on seven, a one-line follow-up drops merge_group and rewords spec-main-shape-gate.test.ts's pin to 're-subscribe before re-enrolling' (merge-queue-reporting's derived floor already enforces that if the name ever returns to REQUIRED_CONTEXTS); re-enrolment then needs a workflow PR first"
],
"recommendation": "B, because objectstack#22998 puts only the fast set on the queue and nobody reads an advisory verdict on a merge group; the ordering hazard is gone once the edit is read back, and the re-enrolment guard is already mechanical."
}
],
"out_of_scope_findings": [
"carrier: PM (claim text) · noted, not filed · the claim calls .github/workflows/ Tier H in objectui; node scripts/check-governed-queue-guard.mjs --test answers NOT GOVERNED for all 12 paths (the same reading objectui#12214's dev reported). The PR stays a draft regardless, as a dispatched PR.",
"carrier: the merge_group follow-up (open question 1), 承接者 if B is taken · noted in PR Acceptance notes · spec-main-shape-gate.yml's concurrency and timeout-minutes comments reason about queue builds; true while merge_group is subscribed and the context required, moot after.",
"carrier: 承接者:无 · noted in PR body, not filed · scripts/tests/dollar-dialect-alias-census.test.ts 'is asymmetric, measured by ABLATION...' timed out at 15 s inside the full scripts/ run (import phase 344.73 s on a loaded shared box), passed alone 37/37 in 8.11 s; one observation, not reproduced, reads no file of this diff."
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 12, 2026
Review: ACCEPT · PR #12250 (draft, head
22124378) · director seat dispatching on the maintainer's order, 2026-10-12T13:17ZChecked on GitHub, not on the report's say-so:
main(923504f4, nomainmerge needed), body line 1Fixes #12240(the only closing keyword), assigneeos-zhuang; 12 files, +236/−148, three commits (e457d3dfthe workflow header,e9617eabthe pin, the Dependabot gate and every other enumeration,22124378docs); labels path-driven. No changeset owed (check-changeset-presenceexit 0).spec-main-shape-gate.yml,repo-gates.yml,required-check-set-patrol.yml) parse identical tomainwithout comments: comment-only, nocontinue-on-error, the hourlyschedule(48 * * * *) and the anti-false-green marker untouched.scripts/check-required-check-set.mjs: the one list line swapsSpec Main Shape GateforGoverned Surface Queue Guard(the seven ruled names:Type Checkpinned, the six watched), under a tombstone naming this card and ACCEPT 6123370050's answer B.scripts/dependabot-merge-gate.mjs: H1 partly refuted and acted on: the name sat inREQUIRED_CONTEXTS(a second in-tree blocking mechanism, Dependabot auto-merge waited for it) and moves toNOT_A_GATEwith its reason. The pipeline guide, the patrol's comment counts and the doc test's two ledger strings move with it; two fixtures retired, two added (live-2026-10-12.json,ruling-12240.json).22124378: every check run completed, none failed or cancelled (Lint, Type Check, Repo Gates, the twelve Test shards, Governed Surface Queue Guard, Build & E2E, Build Docs, Changeset Declaration, andSpec Main Shape Gatestill posting its verdict on the PR as before). The dev's local union, exits quoted: the six core test files 252/252;check-required-check-set.mjs --self-test32 cases exit 0; the live ruleset fed throughghas a fixture:DRIFTEDnamingSpec Main Shape Gateas required-but-undeclared, exit 0, andruling-12240.jsonINTACTexit 0;type-check:scriptsexit 0; eslint over the five changed scripts 0 errors;check-governed-queue-guard --self-test188 cases and--testover the 12 paths NOT GOVERNED; the repo-widevitest run scripts/ eslint-rules/5,778 passed with one unrelated load timeout (dollar-dialect-alias-census, 37/37 alone in 8 s); three ablations committed and restored by blob hash, each red as predicted (the name back in WATCHED → 6 failed; back in REQUIRED_CONTEXTS → 4 failed; themerge_grouptrigger deleted → the trigger pin failed).drifted, exit 0; the fail step runs only on a non-zero exit); today onmainthe patrol already reads DRIFTED onGoverned Surface Queue Guard, which this PR declares.Lint,Type Check,Build & E2E,Build Docs,Changeset Declaration,Test,Spec Main Shape Gate,Governed Surface Queue Guard; after the maintainer's edit the same minusSpec Main Shape Gate, byte-identical to the pin. Either order against the merge is safe becausemerge_groupstays subscribed; edit first only if the gate is red at enqueue time.merge_group) rightly not taken here: the ruled order (merge, then edit) makes dropping the trigger unsafe until the edit is read back (this PR's own queue build would stall at the 60-minute timeout); cost of keeping it about 440 runner-min a day of public, unbilled runner occupancy. The dev's question → B: a one-line follow-up drops the trigger once the patrol reads INTACT on seven; filed as a card in this act, serial behind the maintainer's edit.Governed Surface Queue Guardadded to the watched list (ruled, never declared); two fixtures retired;dispatch-gates --commandsrefused for objectui by design, the list hand-derived; repo-widepnpm lintnot run locally (CI owns it); actionlint not installed (YAML parse instead; the workflow diffs are comment-only). Writes: 2 relay strokes (pr_create with assignee; the report 6124777533);mcp_calls0; no label writes..github/workflows/**Tier H in objectui while the queue guard answers NOT GOVERNED (this repository's governed table has no workflows row; put to the maintainer); the gate'sconcurrencyandtimeout-minutescomments reason about queue builds, moot after the follow-up.Landing: green and ACCEPTed, not governed by the register. The maintainer asked this hour why the seat waits (「这些pr 你为什么不自己合并，都要等我」); the seat's attempt to flip this PR ready and arm the queue without a human review was refused by its own harness, so the landing waits for one of two things: an approving review from a
GOVERNED_APPROVERSaccount (the seat arms the queue on it at once, as on cloud PR #2812) or a permission rule that lets the seat land unreviewed PRs. The ruleset edit (removeSpec Main Shape Gatefrom ruleset 11776024) stays the maintainer's. This card stayspm:dispatcheduntil the PR lands; the landing record follows.objectstack-fleet commentedon Oct 12, 2026
LANDED — PR #12250 is MERGED (2026-10-12T13:38Z, approved by the maintainer, readied and queued by this seat on that approval, merged by the queue; merge commit
5039e811) and read in place onorigin/main(6fb281d6, one commit after it). Director seat, summon #37,session_01LqNgdPZB2Jnr5HpGbaqLeB, 2026-10-12T13:55Z.origin/mainscripts/check-required-check-set.mjs:PINNED_CONTEXTS=Type Check;WATCHED_CONTEXTS=Lint,Build & E2E,Test,Build Docs,Changeset Declaration,Governed Surface Queue Guard;Spec Main Shape Gateunder a tombstonescripts/dependabot-merge-gate.mjs:Spec Main Shape GateinNOT_A_GATEspec-main-shape-gate.ymltriggerspull_request,merge_group,schedule(+workflow_dispatch)Spec Main Shape Gateat about 13:2xZ; seven names, INTACTmerge_group, so the order was safe, as the PR said. The card was closed by the PR'sFixesline;pm:dispatchedstripped and the assignee released in this act.merge_groupnow that the patrol reads INTACT on seven) is claimed and dispatched in this act; objectui#12255 (the governed row) was waiting on this merge for two shared files and proceeds.Type Checkbound (about 10 min today; objectui#12222 lowers it),Spec Main Shape Gatestill posting as a non-required check; recorded here when read.Fixes #12240alone.