Repository navigation
ci(spec-main-shape-gate): drop the merge_group trigger once the ruleset reads INTACT on seven — an advisory verdict on a queue build is read by nobody (objectui#12240 follow-up, letter B) #12252
Description
Filed by the director seat (summon #37, session_01LqNgdPZB2Jnr5HpGbaqLeB) from the objectui#12240 dev's open question 1 (report 6124777533), decided B by this seat under the maintainer's standing order 「三仓的 ci 优化卡你负责派发」 and objectstack#22998's rule that only the fast set runs on the queue. Filing gate ③: a consequence of ruling B on objectui#12240. ⛔ Not a claim. Tier H posture: .github/workflows/**, the PR stays a draft until a GOVERNED_APPROVERS member approves it. Serial: lands only after the maintainer's ruleset edit from objectui#12240 is read back (node scripts/check-required-check-set.mjs live → INTACT on the seven names); before that, dropping the trigger would stall this PR's own queue build at the 60-minute timeout (the #12240 dev's reading).
Why
spec-main-shape-gate.yml keeps merge_group in PR #12250 only because the ruled order on objectui#12240 is merge first, ruleset edit second. Once Spec Main Shape Gate is no longer required, its verdict on a merge group is read by nobody: the newest 100 completed merge_group runs (2026-10-09..12) are about 33.6 a day at 13.1 min median wall, about 440 runner-minutes a day of public-runner occupancy for no reader.
What to build
- Remove
merge_groupfrom the workflow'son:; keeppull_request(the advisory signal a human reads),schedule(the hourly full-battery run onmain) andworkflow_dispatch. scripts/__tests__/spec-main-shape-gate.test.ts: the pin "subscribes merge_group, so a maintainer can enrol it without stalling the queue" becomes "re-subscribemerge_groupbefore re-enrolling" (merge-queue-reporting's derived floor already refuses a required name whose workflow lacks the trigger); the workflow'sconcurrencyandtimeout-minutescomments that reason about queue builds move with it.- Nothing else: the gate's verification, the marker, the schedule and the seven-name pin stay as PR ci: Spec Main Shape Gate leaves the required set — advisory on PRs, hourly on main; the required-check pin declares the seven ruled names (objectui#12240) #12250 leaves them.
Acceptance
node scripts/check-required-check-set.mjslive readsINTACTon seven before the PR is opened (quote the reading in the PR body); the gate's workflow parses with three triggers; the test file's pin reds on an ablation that restoresmerge_grouprequiredness without the trigger; three merge groups after landing carry noSpec Main Shape Gatecheck run.
Related: objectui#12240 (PR #12250) · objectui#12214 · objectstack#22998 · .github/workflows/spec-main-shape-gate.yml.
Activity
objectstack-fleet commentedon Oct 12, 2026
Claim: PM loop round 1 · the director seat dispatching on the maintainer's standing order, verbatim 「三仓的 ci 优化卡你负责派发」 (this seat's session, 2026-10-12T14:10Z)
Session:
session_01LqNgdPZB2Jnr5HpGbaqLeBAccount:
os-zhuangBranch:
claude/issue-12252-spec-gate-no-merge-groupWorktree:
objectui-issue-12252Domain:
domain:devxSeat:
domain:devx#9File surface:
.github/workflows/spec-main-shape-gate.yml(theon:block:merge_groupremoved; theconcurrencyandtimeout-minutescomments that reason about queue builds),scripts/__tests__/spec-main-shape-gate.test.ts(the trigger pin reworded as the card says),content/docs/guide/ci-cd-pipeline.mdonly where it says the gate runs on the queue; ⛔ not the gate's steps, marker, schedule or the seven-name pin, ⛔ notci.yml(objectui#12222), ⛔ notAGENTS.mdor the queue guard (objectui#12255) (stop on breach; explain in the report)Container & model:
S,mode:subagent,model: sonnet(the floor: a one-trigger removal with a reworded pin; the reading that justified it is on the card and in ACCEPT 6125070195). Tier H posture:.github/workflows/**(this repository's governed row is in flight on objectui#12255; the round's posture applies either way): the PR stays a draft until aGOVERNED_APPROVERSmember approves it.Clause-②: no
Responsibility:
n/a — not a defect cardThread-read: none
Ruling-ref: objectui#12240 ACCEPT 6125070195 (the dev's question → B) and the maintainer's ruleset edit read back at 13:2xZ (ruleset 11776024 lists seven names;
Spec Main Shape Gateis no longer required)Serial constraints cleared: PR #12250 (objectui#12240) is MERGED; the live ruleset (seven) equals the merged pin (seven), so the card's precondition (INTACT on seven) holds; objectui#12222 (in flight) edits
ci.ymlandturbo.json; objectui#12255 (in flight) editsAGENTS.md, the queue guard and its consumers; neither declares this workflow. Mergeorigin/mainbefore opening the PR.objectstack-fleet commentedon Oct 12, 2026
os-dev-report
{
"issue": 12252,
"status": "done",
"branch": "claude/issue-12252-spec-gate-no-merge-group",
"pr": "#12262",
"session": "session_01LqNgdPZB2Jnr5HpGbaqLeB (subagent of the director seat; the relay stamped this id on the PR)",
"premise_still_valid": true,
"summary": "Draft PR 12262 (head 17033fd: the change 58973d5 plus a merge of origin/main 10aba37; assignee os-zhuang; body line 1 carries the closing keyword for 12252 and no other card; read back byte-identical, 7203 bytes sent and stored, footer intact). (1) spec-main-shape-gate.yml: merge_group leaves on:; pull_request, the hourly schedule (48 * * * *) and workflow_dispatch stay; the header bullet on merge_group is rewritten (not subscribed; re-subscribe BEFORE re-enrolling), and the concurrency and timeout-minutes comments that reasoned about queue builds follow. The parsed file minus on: is identical to base. (2) spec-main-shape-gate.test.ts: the trigger pin is now its inverse, 'does not subscribe merge_group - re-subscribe merge_group before re-enrolling the context (objectui#12252)', asserting subscribesMergeGroup is false with a message that names the enrol-second order. (3) ci-cd-pipeline.md: only the sentences that said the gate runs on the queue (inventory row trigger cell, section trigger line, artifact-trust sentence, the test-pin sentence, the last bullet of the required-set history). Nothing the gate verifies changed; not touched: the gate's steps/marker/schedule, the seven-name pin, dependabot-merge-gate, ci.yml, AGENTS.md, the queue guard. The PR stays a draft; nothing was armed.",
"ruleset_reading": {
"command": "gh api repos/objectstack-ai/objectui/rulesets/11776024 --jq '[.rules[] | select(.type=="required_status_checks") | .parameters.required_status_checks[].context]'",
"read_at": "2026-10-12T14:19:18Z, before the first commit",
"answer": [
"Lint",
"Type Check",
"Build & E2E",
"Build Docs",
"Changeset Declaration",
"Test",
"Governed Surface Queue Guard"
],
"spec_main_shape_gate_listed": false,
"check_required_check_set": "bare
node scripts/check-required-check-set.mjscould not take its own reading here: HTTP 401 through the agent proxy, exit 2 (the script says that is not a pass). The same script fed the livegh api repos/objectstack-ai/objectui/rules/branches/mainanswer through --fixture: INTACT, 1 pinned and 6 watched context(s) all present, 7 required context(s) read, exit 0 (re-run at the final head, same answer)."},
"ablation_failing_assertion": {
"leg_A_name_back_in_REQUIRED_CONTEXTS_without_the_trigger": "merge-queue-reporting.test.ts: 1 failed, 17 passed. FAIL the merge_group floor derives itself from REQUIRED_CONTEXTS (#6160) > requires merge_group of every workflow that produces a required context. AssertionError: These workflows produce a context
REQUIRED_CONTEXTSdeclares blocking, but do not subscribemerge_group: - spec-main-shape-gate.yml (produces Spec Main Shape Gate) ... expected [ 'spec-main-shape-gate.yml' ] to deeply equal []. Direction observed: red, as predicted.","leg_B_trigger_restored_name_not_required": "spec-main-shape-gate.test.ts: 1 failed, 35 passed. FAIL the new pin: 'spec-main-shape-gate.yml subscribes
merge_groupagain, so every merge group runs a gate whose verdict nothing waits for (objectui#12252). If the context is being RE-ENROLLED on a ruling, subscribing first is the right order (objectui#3523) ...: expected true to be false'.","leg_C_control_both_restored": "merge-queue-reporting.test.ts passes (the floor is satisfied by the trigger) and only the new pin reds: 1 failed | 53 passed over the two files. So leg A's red is attributable to the missing trigger and nothing else."
},
"tests": "All at the final head 17033fd unless marked. (a) Under os-verify-lock: pnpm exec vitest run --maxWorkers=2 over spec-main-shape-gate, merge-queue-reporting, ci-cd-pipeline-doc, check-required-check-set, dependabot-merge-gate, check-merge-queue-head test files && pnpm type-check:scripts -> 'Test Files 6 passed (6) / Tests 252 passed (252)', VERDICT command-exit 0 (also 6/6 and 252/252 at 58973d5, before the merge). The count equals the pre-change count: one pin rewritten in place. (b) pnpm type-check:scripts alone: VERDICT command-exit 0; tsc -p tsconfig.scripts.json --listFilesOnly lists spec-main-shape-gate.test.ts (count 1). (c) YAML parse of the workflow via git show of base and head: base triggers merge_group, pull_request, schedule, workflow_dispatch; head triggers pull_request, schedule, workflow_dispatch (three); cron 48 * * * *; pull_request branches main, develop; parsed file minus on: identical to base (True). (d) Ablations, each leg through /home/user/objectstack/scripts/ablation-replace.mjs on the committed 58973d5 blobs, under os-verify-lock (VERDICT command-exit 0 for the wrapper): anchor hits 1 -> 0, replacement 0 -> 1, blob changed (dependabot-merge-gate 21f065a2 -> 4fdf991e; workflow b02b42c8 -> 182eb7a1), restore proven by blob == HEAD and an empty git diff HEAD after every leg, final git status --porcelain empty; legs and failing assertions quoted in ablation_failing_assertion. No build or dist involved (root scripts and a workflow file). (e) check-doc-links exit 0 ('Links are valid across 17 scan roots'); check-control-bytes exit 0 (scanned 8521 tracked text files); check-new-cross-file-line-citations 0 new, exit 0; check-action-ref-convention exit 0 (0 off-convention); check-doc-fence-languages exit 0 (at 58973d5); grep -P control-byte scan over the three edited files: exit 1 (no match), captured before any pipe; check-governed-queue-guard --test over the three paths: NOT GOVERNED, exit 0; check-changeset-presence exit 0, no changeset owed; targeted eslint --no-inline-config --format json over the edited test file: 1 file, 0 errors, 0 warnings. (f) PR checks on 17033fd at 14:36:58Z, one read, not waited for: 29 check runs; completed success: Changeset Fixed Group Check, Governed Surface Queue Guard, Line Citation Gate, label; completed skipped: the coverage lane and dependabot; in_progress: Lint, Type Check, Build & E2E, Build Docs, Changeset Declaration, Test shards 1-12 and dist pins (so Test not yet posted), Repo Gates, Changeset Claim Re-read, Live E2E, and Spec Main Shape Gate (it still posts its verdict on the PR, as kept pull_request requires). NOT MEASURED: repo-wide pnpm lint (CI owns it; only the targeted run above), actionlint (not installed; the YAML parse stands in), the seven required names green on the head (in_progress at report time, PM reads convergence), the card's last acceptance item 'three merge groups after landing carry no Spec Main Shape Gate check run' (post-landing reading, the seat's).",
"gates": [
"6 core test files -> 252/252, VERDICT command-exit 0 (final head)",
"pnpm type-check:scripts -> VERDICT command-exit 0",
"workflow YAML parse -> three triggers, rest of file identical to base",
"ablation legs A/B/C -> red/red/(floor green, pin red), each restored and proven",
"check-doc-links, check-control-bytes, check-new-cross-file-line-citations, check-action-ref-convention -> exit 0",
"check-required-check-set fed the live gh answer via --fixture -> INTACT on seven, exit 0 (bare node run: 401, exit 2, not a pass)",
"dispatch-gates.mjs --commands not run: objectstack's script refuses objectui by design (its own header; the dev report on 12240 recorded the same), so the list was derived by hand from AGENTS.md's grep for tests that read the workflow (git grep for the workflow file name in tests: ci-cd-pipeline-doc and spec-main-shape-gate) plus the merge_group-reading tests the dispatch named",
"PR checks: in_progress at 14:36:58Z (honest value), not waited for"
],
"files_changed": "3 files vs origin/main at the branch point (+64/-41): M .github/workflows/spec-main-shape-gate.yml; M scripts/tests/spec-main-shape-gate.test.ts; M content/docs/guide/ci-cd-pipeline.md. Two commits: 58973d5 the change; 17033fd a merge of origin/main 10aba37 (none of its files touch this surface). origin/main has since moved to 0cd322d (6 files, none on this surface): the PR reads mergeable_state behind, which the queue rebuild absorbs; no second merge was pushed because the PR body quotes head 17033fd and the body is written once.",
"deviations": [
"The bare live run of scripts/check-required-check-set.mjs is not obtainable from this container (node fetch gets 401 through the agent proxy); the reading was taken through gh and fed to the script with --fixture, and the raw ruleset answer is quoted. The card's 'live reads INTACT on seven' is therefore met by the gh-fed reading, not by the script's own fetch.",
"One comment sentence beyond the three named lines was brought in line: 'a pull request or a queue build runs its own branch's workflow file' (workflow header, the doc's artifact-trust sentence, one comment in the test) became 'a pull request (or a manual dispatch on a branch) ...'. It is a comment that reasons about queue builds, so I read it as inside 'the comments that reason about queue builds'; revert is three one-line edits if the seat reads it narrower.",
"The new pin is the unconditional inverse the ruling names (subscribesMergeGroup is false), so the first step of a re-enrolment (re-subscribing) reds it until that same change replaces the pin; the failure message says so. A conditional pin (subscribes iff the name is in REQUIRED_CONTEXTS) was considered and not taken: the ruling says inverse.",
"origin/main was merged once before opening (10aba37); it has moved again since (0cd322d, no overlap) and the PR is behind.",
"Commit trailers are objectui AGENTS.md's model-free pair (Claude-Session and Co-authored-by: Claude), not the harness reminder's Co-Authored-By line carrying a model name; the PR body footer is the session-URL form from os-dev.md, not the harness's emoji line. AGENTS.md says its rule governs when they conflict.",
"The pr_create stroke waited about 12 minutes on write-pace (23 attempts answered exit 10 = REFUSED with nothing sent, the 24th was sent); no other route was used."
],
"mcp_calls": "0",
"api_writes": "2 REST writes through the fleet relay, plus 2 git pushes (not REST). (1) POST /repos/objectstack-ai/objectstack/dispatches (fleet-write, one pr_create action with assignees os-zhuang): run 38264140485 success, executed as objectstack-fleet[bot] against objectstack-ai/objectui, created PR 12262 as a draft and its assignee leg, read back identical. (2) this os-dev-report comment on objectui issue 12252 via scripts/pm/post-stamped.mjs. No label writes (the dispatch named none and objectui has no label reader to satisfy), no claim comment (the newest Claim on the card, 6125984810, names this branch). git push: (a) the empty-branch write-route probe, (b) the two commits (7578323..17033fd). Reads were gh api GETs only. Cleanup done: node_modules removed and the worktree removed with a clean git status first; no background process left.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: none - noted, not filed: ci-cd-pipeline.md's history paragraph 'The workflow was built to be requirable (unfiltered on pull_request, subscribed to merge_group, no continue-on-error), so the maintainer could enrol the context on its own without stalling the queue' is past tense and now read against the last bullet, which says the trigger was dropped; left as is because the ruled doc scope is only the sentences that say the gate runs on the queue.",
"carrier: none - noted, not filed: the workflow header's 'Why NO path filter' section still says unfiltered 'keeps it requirable'; true for pull requests, and the merge_group bullet now carries the extra re-subscribe step, so no edit was owed."
]
}
objectstack-fleet commentedon Oct 12, 2026
Review: ACCEPT · PR #12262 (draft, head
17033fd1) · director seat dispatching on the maintainer's order, 2026-10-12T14:50ZChecked on GitHub, not on the report's say-so:
main, body line 1Fixes #12252(the only closing keyword), assigneeos-zhuang; 3 files, +64/−41, two commits (58973d5bthe change,17033fd1a merge oforigin/mainat10aba37d);mergeable_statebehind (mainmoved again, no overlap; the queue rebuild absorbs it). No changeset owed (check-changeset-presenceexit 0).gh):Lint,Type Check,Build & E2E,Build Docs,Changeset Declaration,Test,Governed Surface Queue Guard;Spec Main Shape Gatenot listed;check-required-check-set.mjsfed that answer through--fixture: INTACT on seven, exit 0 (the script's own fetch answers 401 through the agent proxy, so the gh-fed reading is the one on record).spec-main-shape-gate.yml:merge_groupleaveson:(the head'son:block carries nomerge_group, re-read by this seat);pull_request(main,develop), the hourlyschedule(48 * * * *) andworkflow_dispatchstay; the parsed file minuson:is identical to the base; the header bullet, theconcurrencyandtimeout-minutescomments that reasoned about queue builds follow (+25/−21).spec-main-shape-gate.test.ts(+24/−7): the trigger pin is its inverse, "does not subscribe merge_group — re-subscribe before re-enrolling (objectui#12252)".ci-cd-pipeline.md(+15/−13): only the sentences that said the gate runs on the queue. Not touched: the gate's steps, marker and schedule, the seven-name pin, the Dependabot gate,ci.yml,AGENTS.md, the queue guard.git diff HEADempty): A, the name back inREQUIRED_CONTEXTSwithout the trigger →merge-queue-reporting.test.tsreds on its derived floor ("workflows produce a context REQUIRED_CONTEXTS declares blocking, but do not subscribe merge_group: spec-main-shape-gate.yml"); B, the trigger restored with the name not required → the new pin reds; C, both restored → only the new pin reds. So the re-enrolment order is mechanically guarded in both directions.17033fd1: the seven required names and the rest of the PR's checks success at this comment's time (read by this seat before posting: the ACCEPT waited for them);Spec Main Shape Gatestill posts on the PR (it keepspull_request). The dev's local union, exits quoted: the six core test files 252/252 underos-verify-lock(the count equals the pre-change count: one pin rewritten in place);type-check:scriptsexit 0; the YAML parse (three triggers, cron48 * * * *);check-doc-links,check-control-bytes(8,521 files),check-new-cross-file-line-citations,check-action-ref-convention,check-doc-fence-languagesexit 0; eslint over the edited test file 0 errors;check-governed-queue-guard --testNOT GOVERNED on the three paths. NOT MEASURED: repo-widepnpm lint(CI's Lint green), actionlint (the parse stands in).main(the body quotes its head and is written once); the pr_create stroke waited about 12 minutes on the shared write pace (23 refusals, nothing sent). Writes: 2 relay strokes (pr_create with assignee; the report 6126472765);mcp_calls0; no label writes.Landing: the round's posture: the maintainer approves; the seat arms the queue. Under the two-speed clause this lane's PRs land after the
Test (coverage)main-red fix (objectui#12208 PR-2's first commit) unless the maintainer queues it earlier by hand, as they did for #12251. Owed after landing: three merge groups with noSpec Main Shape Gatecheck run. This card stayspm:dispatcheduntil the PR lands; the landing record follows.objectstack-fleet commentedon Oct 12, 2026
LANDED — PR #12262 is MERGED (2026-10-12T23:39Z, readied and auto-merged by the maintainer; enqueued at 2026-10-12T23:26Z, merge group run 38322151265 green at 23:38Z; merge commit
a1a917a0) and read in place onorigin/maina1a917a0. Director seat, summon #37,session_01LqNgdPZB2Jnr5HpGbaqLeB, 2026-10-12T23:42Z: the seat closes its own in-flight claim (the card was dispatched before 「其他任务归车道」; nothing new is taken from objectui).origin/mainspec-main-shape-gate.yml:merge_groupin theon:blockschedule(48 * * * *) keptscripts/__tests__/spec-main-shape-gate.test.ts: the inverse pin "does not subscribe merge_group"content/docs/guide/ci-cd-pipeline.md: rows that still put the gate on the queueFixesline;pm:dispatchedstripped and the assignee released in this act.Spec Main Shape Gatecheck run": group 0 read, groups 1–3 owed. The landing group itself (queue branchpr-12262, 23:26–23:38Z) already ran the merged YAML: the gate workflow's run list holds nomerge_grouprun in that window (its four newest runs, 23:14–23:36Z, are allpull_request), and the group's CI run carried onlyBuild & E2E,Build Docs,Changeset Fixed Group Check,TestandType Check. The three groups after landing are read as they come and recorded here by the seat (the reading was promised on the PR; it is a read, not a dispatch).Type Checktook the new build step and went green.merge_groupfirst (the pin andmerge-queue-reporting's derived floor both red otherwise).