governance: .github/workflows/** joins this repository's governed surfaces — the AGENTS.md 受管面 list (five → six) and the queue guard's GOVERNED_SURFACES register — a workflow PR waits for an authorised approval (ruled A)

Filed by the director seat (summon #37, session_01LqNgdPZB2Jnr5HpGbaqLeB) on the maintainer's word 「两仓加治理行」 (2026-10-12), the answer A to the seat's question. Filing gate ③: maintainer-directed. ⛔ Not a claim. Tier H: AGENTS.md is in the diff, so the PR stays a draft until a GOVERNED_APPROVERS member approves it; the seat then lands it.

Why

AGENTS.md's section 「⛔ 受管面」 lists five surfaces (AGENTS.md, CLAUDE.md, .claude/**, skills/**, docs/adr/**) and scripts/check-governed-queue-guard.mjs's GOVERNED_SURFACES has the same five rows; --test over PR #12232's and PR #12250's twelve workflow paths answered NOT GOVERNED (objectui#12214 report 6123124321; objectui#12240 report 6124777533). This round every CI PR here waited for the maintainer's approval, and cloud wrote the row into its table (cloud#2809, PR #2810); the objectstack sibling card adds the same row to its register in the same act.

What to build

The register row in scripts/check-governed-queue-guard.mjs: { id: 'workflows', prefix: '.github/workflows/', glob: '.github/workflows/**', what: 'CI, deploy and release workflows: what runs on every push, what deploys, what gates the queue' }, and its test (scripts/__tests__/check-governed-queue-guard.test.ts): a workflow path → GOVERNED; .github/ISSUE_TEMPLATE/** and .github/dependabot.yml → not.
AGENTS.md 「本仓的受管面 —— 五项」 → six, one bullet in the section's own wording (CI、部署与发版 workflow 决定每次 push 跑什么、拿什么门禁挡合并队列，改它们由维护者批准), and the sentences that say "五项" or enumerate the five move with it; the header comment of the guard (its restated list) likewise.
Consumers: scripts/dependabot-merge-gate.mjs, merge-queue-reporting.test.ts, ci-cd-pipeline-doc.test.ts and check-doc-snippet-types.mjs read the register or the list (grep GOVERNED_SURFACES): move any enumeration honestly; .github/workflows/governed-surface-guard.yml's paths: filter, if it enumerates the surfaces, gains the glob (⛔ the guard must still fire on a workflow-only PR).
Nothing else: no tier mechanism exists here (the two legs stay as they are), no change to GOVERNED_APPROVERS.

Acceptance

node scripts/check-governed-queue-guard.mjs --self-test exit 0 and --test .github/workflows/ci.yml answers GOVERNED; the guard's pull_request leg on the PR itself reads GOVERNED (the PR touches AGENTS.md); the PR body lists the six surfaces and every file touched.

Related: cloud#2809 (PR #2810) · the objectstack sibling card (filed in the same act) · objectui#12214 · objectui#12240 · scripts/check-governed-queue-guard.mjs · AGENTS.md 「受管面」.

Claim: PM loop round 1 · the director seat dispatching on the maintainer's words, verbatim 「两仓加治理行」 and the standing order 「三仓的 ci 优化卡你负责派发」 (this seat's session, 2026-10-12T13:39Z)
Session: session_01LqNgdPZB2Jnr5HpGbaqLeB
Account: os-zhuang
Branch: claude/issue-12255-workflows-governed
Worktree: objectui-issue-12255
Domain: domain:devx
Seat: domain:devx#9
File surface: AGENTS.md (the 「受管面」 section: five → six and the sentences that count or enumerate them), scripts/check-governed-queue-guard.mjs (the register row and its header list) and scripts/__tests__/check-governed-queue-guard.test.ts, the consumers that enumerate the surfaces (scripts/check-doc-snippet-types.mjs, scripts/__tests__/merge-queue-reporting.test.ts, scripts/__tests__/ci-cd-pipeline-doc.test.ts, content/docs/guide/ci-cd-pipeline.md if it lists them), .github/workflows/governed-surface-guard.yml paths: only if it enumerates the surfaces; ⛔ not ci.yml (objectui#12222 in flight; objectui#12208 PR-2 queued), ⛔ not spec-main-shape-gate.yml (objectui#12252), ⛔ no change to GOVERNED_APPROVERS (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus (the default judgment tier; no path-derived mandate). Tier H (AGENTS.md): draft until a GOVERNED_APPROVERS member approves; the seat then lands it.
Clause-②: no
Responsibility: n/a — not a defect card
Thread-read: none
Ruling-ref: the card (the maintainer's word verbatim 「两仓加治理行」, answer A); cloud#2809 (PR #2810) as the precedent row; the objectstack sibling objectstack#23048 (claimed in this act)
Serial constraints cleared: PR #12250 (objectui#12240) is in the merge queue and touches scripts/dependabot-merge-gate.mjs and ci-cd-pipeline-doc.test.ts: the dev waits for its merge (minutes) and merges origin/main before the first commit; objectui#12222 (in flight) edits ci.yml and turbo.json only. Merge origin/main before opening the PR.

Released to the lane by the director seat, 2026-10-12T14:00Z: the maintainer's word this hour, verbatim 「你主要负责 ci 的优化，其他任务是车道经理的」, takes this governance card off the director seat. The dev dispatched on claim 6125447720 was stopped before any edit: it pushed only the empty claim-marker branch claude/issue-12255-workflows-governed at 6fb281d6 (= origin/main at branching; no commit, no PR, no comment, no label; worktree removed). The claim is withdrawn in this act (pm:dispatched → pm:queue, assignee released); the branch may be deleted or reused by the next seat. ⛔ Not a claim.

Facts the stopped dev read for whoever picks this up (reads only, nothing changed):

PR ci: Spec Main Shape Gate leaves the required set — advisory on PRs, hourly on main; the required-check pin declares the seven ruled names (objectui#12240) #12250 (objectui#12240) is merged, so the wait the claim named is over.
.github/workflows/governed-surface-guard.yml has no paths: filter, and the guard's self-test and test file both require that: the card's "paths: gains the glob if it enumerates" clause does not apply.
The card's H2 is wrong as written: scripts/dependabot-merge-gate.mjs does not read GOVERNED_SURFACES. After the change, a Dependabot github-actions bump would still be approved by github-actions[bot] (not an authorised approver) and queued by dependabot-auto-merge.yml; the merge_group leg would then refuse it (exit 3). The gate script's comment "such a diff touches no governed path" becomes false and is outside the claim's file surface; the next claim names it.
Text that moves with the row: the guard's register header comment (it says .github/workflows/** is NOT governed) and its comment near carrierVerdict on restraint for workflows; the guard's self-test (the five-surfaces count, the glob string, the this-guards-own-workflow-is-NOT-governed case, the OK summary text); scripts/__tests__/check-governed-queue-guard.test.ts (the five-surfaces case and "does not govern its own workflow, or CI configuration generally"); content/docs/guide/ci-cd-pipeline.md (the fixed-list sentence and the same "does not govern" sentence); AGENTS.md (the 五项 heading and 「上面五项已含 skills/**」).
Nothing to change in check-doc-snippet-types.mjs, merge-queue-reporting.test.ts or ci-cd-pipeline-doc.test.ts: none lists the surfaces.

Claim: PM loop round R85 · domain:devx @ objectui seat 1, on the director seat's release 6125821034 (the maintainer's word, verbatim 「你主要负责 ci 的优化，其他任务是车道经理的」) and the card's ruling 「两仓加治理行」 (answer A) · 2026-10-13T01:10Z
Session: session_011oKFDZMRoPGDbStvxQa172
Account: os-justin
Branch: claude/issue-12255-workflows-governed
Worktree: objectui-issue-12255
Domain: domain:devx
Seat: domain:devx#1
File surface: scripts/check-governed-queue-guard.mjs (the register row, its header list and the comment near carrierVerdict, the self-test cases), scripts/__tests__/check-governed-queue-guard.test.ts, AGENTS.md (the 「⛔ 受管面」 section only: the 五项 heading → six, and the sentences that count or enumerate the surfaces), content/docs/guide/ci-cd-pipeline.md (the fixed-list sentence and the "does not govern" sentence), scripts/dependabot-merge-gate.mjs (the comment that says a Dependabot diff touches no governed path); ⛔ no .github/workflows/** file, ⛔ no change to GOVERNED_APPROVERS, ⛔ no AGENTS.md text outside that section (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus (the default judgment tier; dispatch-gates --tier --repo objectstack-ai/objectui over the five paths: no path-derived mandate). Tier H (AGENTS.md): draft until a GOVERNED_APPROVERS member approves; the seat then lands it.
Clause-②: no
Responsibility: n/a — not a defect card
Thread-read: 6125821034
Ruling-ref: the card body (the maintainer's word verbatim 「两仓加治理行」, answer A); the release 6125821034 (re-read this act)
Serial constraints cleared: PR objectui#12253 (domain:skills, objectui#12224, open) edits AGENTS.md section 1 only (hunk at line 19 on 74964ad6), a region disjoint from 「受管面」 (line 512 on): ordinary concurrency. objectui#12278 (this round, this seat) edits AGENTS.md section 9 (line 180): disjoint region. objectstack#23048 (in the decision box) edits objectstack files only. Merge origin/main before opening the PR.
Candidate note: the card is a tooling card without an Unblocks: line or a named published surface; it is taken on the maintainer-directed provenance above (filing gate ③), which outranks the candidate filter.

Generated by Claude Code

os-dev-report

{
 "issue": 12255,
 "status": "done",
 "branch": "claude/issue-12255-workflows-governed",
 "pr": "https://github.com/objectstack-ai/objectui/pull/12289",
 "session": "session_011oKFDZMRoPGDbStvxQa172 — the dispatching seat's session (subagent run; the harness stamped this id on the commits' Claude-Session trailer)",
 "premise_still_valid": true,
 "summary": "`.github/workflows/**` is the sixth row of GOVERNED_SURFACES in scripts/check-governed-queue-guard.mjs, with the card's exact row literal. The guard's header comment, the carrierVerdict comment, the self-test (six surfaces, the six globs verbatim, the own-workflow NOT GOVERNED case reversed into a GOVERNED pin, the rest-of-.github negatives, a near-miss, and the Dependabot github-actions bump's queue refusal) and the pin test move with it; AGENTS.md 「受管面」 goes 五项 to 六项 with one bullet and 「上面六项」; ci-cd-pipeline.md's fixed-list and does-not-govern sentences move; dependabot-merge-gate.mjs's 'touches no governed path' comment now splits npm from github-actions bumps (no behaviour change). Draft PR #12289 (Tier H, touches AGENTS.md), assignee os-justin; origin/main f228d710 merged in before the PR opened; CI not waited for (in_progress at report time).",
 "tests": "All at final HEAD d5f0181e. `pnpm exec vitest run --maxWorkers=2 scripts/` via os-verify-lock: VERDICT command-exit 0, `Test Files 187 passed | 2 skipped (189)`, `Tests 5622 passed | 2 skipped (5624)`. The four package tests the markdown-test-inputs ledger records as reading content/docs/**: exit 0, `Test Files 4 passed (4)`, `Tests 175 passed (175)`. `pnpm type-check:scripts` (lock) exit 0, pin test and guard both in --listFilesOnly. Guard --self-test exit 0, `193 cases pass (the six ruled surfaces …` (188 on origin/main). Ablation: the fix committed first; objectstack's `scripts/ablation-replace.mjs` deleted the workflows row through a literal anchor that hit once (blob 81a9eef6 to abf64d8b, row count on disk 1 to 0), and in the mutant --self-test exited 1 with `4 of 192 case(s) failed`, the pin test exited 1 with 3 failed, and `--test .github/workflows/ci.yml` went back to NOT GOVERNED, exit 0. Restore proven: blob == HEAD 81a9eef6 and `git diff HEAD` empty. Direction: red, as expected. No build/dist involved (the guard is plain node, no install).",
 "gates": [
  {
   "cmd": "node scripts/check-governed-queue-guard.mjs --self-test",
   "exit": 0,
   "verdict": "OK check-governed-queue-guard self-test: 193 cases pass (the six ruled surfaces pinned in both directions …",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-governed-queue-guard.mjs --test .github/workflows/ci.yml",
   "exit": 3,
   "verdict": "⛔ GOVERNED — 1 of 1 path(s) are on a governed surface: .github/workflows/** x1",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-governed-queue-guard.mjs --test (the PR's six files)",
   "exit": 3,
   "verdict": "⛔ GOVERNED — 1 of 6 path(s) are on a governed surface: AGENTS.md x1",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-governed-queue-guard.mjs --test .github/dependabot.yml .github/labeler.yml .github/ISSUE_TEMPLATE/bug_report.md .github/pull_request_template.md",
   "exit": 0,
   "verdict": "✅ NOT GOVERNED — 4 path(s) checked against 6 governed surface(s); none matched.",
   "head": "d5f0181e"
  },
  {
   "cmd": "bash os-verify-lock.sh -c 'pnpm exec vitest run --maxWorkers=2 scripts/'",
   "exit": 0,
   "verdict": "Test Files 187 passed | 2 skipped (189); Tests 5622 passed | 2 skipped (5624); VERDICT command-exit 0",
   "head": "d5f0181e"
  },
  {
   "cmd": "bash os-verify-lock.sh -c 'pnpm exec vitest run (4 package tests reading content/docs/**)'",
   "exit": 0,
   "verdict": "Test Files 4 passed (4); Tests 175 passed (175); VERDICT command-exit 0",
   "head": "d5f0181e"
  },
  {
   "cmd": "bash os-verify-lock.sh -c 'pnpm type-check:scripts'",
   "exit": 0,
   "verdict": "VERDICT command-exit 0",
   "head": "d5f0181e"
  },
  {
   "cmd": "pnpm exec eslint --format json scripts/__tests__/check-governed-queue-guard.test.ts scripts/check-governed-queue-guard.mjs scripts/dependabot-merge-gate.mjs",
   "exit": 0,
   "verdict": "files 3 errors 0 warnings 0",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-control-bytes.mjs",
   "exit": 0,
   "verdict": "✅  check-control-bytes: OK (scanned 8573 tracked text file(s); skipped 85 binary).",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-new-cross-file-line-citations.mjs",
   "exit": 0,
   "verdict": "VERDICT new-cross-file-line-citations: 0 new citation(s), enforcement report-only -> exit 0",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-doc-links.mjs",
   "exit": 0,
   "verdict": "Links are valid across 17 scan roots.",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-shell-escape-residue.mjs",
   "exit": 0,
   "verdict": "✅  check-shell-escape-residue: OK (5/5 root(s) resolved …",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-doc-fence-languages.mjs --self-test",
   "exit": 0,
   "verdict": "✓ check-doc-fence-languages self-test: 26 cases pass",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-doc-fence-languages.mjs",
   "exit": 0,
   "verdict": "✅  check:doc-fences — every TypeScript block in 227 document(s) is fenced ts/tsx/typescript …",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-doc-example-ids.mjs",
   "exit": 0,
   "verdict": "✅ 415 real reference(s) all resolve in the catalog registry.",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-doc-component-types.mjs",
   "exit": 0,
   "verdict": "✅  Every documented component type is registered.",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-pre-install-import-graph.mjs --self-test",
   "exit": 0,
   "verdict": "✓ check-pre-install-import-graph self-test: 16 cases pass",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-pre-install-import-graph.mjs",
   "exit": 0,
   "verdict": "✅  check-pre-install-import-graph: OK — 39 pre-install step(s) in 19 job(s) run 34 scripts/ gate(s) …",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/markdown-test-inputs.mjs --audit",
   "exit": 0,
   "verdict": "markdown-test-inputs: 123 candidate test files, all adjudicated; 87 declared entries, all present.",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-changeset-presence.mjs",
   "exit": 0,
   "verdict": "✅  No source or published contract of a released package changed in this range, so no changeset is owed.",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-changeset-no-major.mjs",
   "exit": 0,
   "verdict": "✅  No changeset declares a `major` bump.",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-changeset-claims.mjs",
   "exit": 0,
   "verdict": "✅  No pending changeset names a file this change touches.",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-pending-changeset-literals.mjs",
   "exit": 0,
   "verdict": "(exit 0; last line: Asked of every markdown literal `scripts/markdown-test-inputs.mjs` resolves out of a test source.)",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-test-path-roots.mjs",
   "exit": 0,
   "verdict": "✅  check-test-path-roots: OK (2545 filesystem call(s) in 542 of 5026 test file(s) …",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-entry-guard.mjs",
   "exit": 0,
   "verdict": "✓ check:entry-guard: 114 scripts/ file(s) — no entry guard outside the baseline …",
   "head": "d5f0181e"
  },
  {
   "cmd": "node scripts/check-action-ref-convention.mjs",
   "exit": 0,
   "verdict": "✅  check-action-ref-convention: 109 action reference(s) in 29 workflow file(s), 13 distinct; 0 off-convention and undeclared …",
   "head": "d5f0181e"
  },
  {
   "cmd": "NOT MEASURED: Repo Gates built-package steps (check-doc-snippet-types, check-doc-example-types, check-doc-json-fences, check-skill-examples) and `pnpm lint`",
   "exit": null,
   "verdict": "reason: they need a turbo build of packages/*; the diff adds no fenced code block and eslint was run narrowed (3 files; tseslint.configs.recommended, no parserOptions.project/projectService, so type-aware linting is off and no untouched file's verdict can move). CI runs them.",
   "head": "d5f0181e"
  }
 ],
 "line_budget": "n/a — objectui has no AGENTS.md line or bytes-per-line cap: a file-name probe for a line ratchet answers nothing in objectui and answers scripts/pm/check-skill-line-ratchet.mjs in the objectstack checkout (control). AGENTS.md 618 to 619 lines on the branch.",
 "files_changed": [
  ".changeset/12255-governed-workflows.md",
  "AGENTS.md",
  "content/docs/guide/ci-cd-pipeline.md",
  "scripts/__tests__/check-governed-queue-guard.test.ts",
  "scripts/check-governed-queue-guard.mjs",
  "scripts/dependabot-merge-gate.mjs"
 ],
 "deviations": [
  "The self-test gained one pin beyond the card's minimum, inside the claimed surface: a Dependabot github-actions bump approved only by github-actions[bot] is REFUSED at the queue (exit 3) and only warned on its pull request. It pins H3's consequence as the ruling's.",
  "My first hand-derived vitest union (43 files: every scripts/__tests__ file naming the guard or the gate, plus the markdown-test-inputs ledger's readers of AGENTS.md and ci-cd-pipeline.md) missed the tree-scanning audit. `markdown-test-inputs.mjs --audit` then flagged the pin test's `.github/prompts/component.prompt.md` literal as an unadjudicated document. The pin test now uses YAML paths only (`.github/ISSUE_TEMPLATE/config.yml` stands in for the card's ISSUE_TEMPLATE/**), the self-test keeps the prompts negative, and I ran the whole scripts/ directory instead of the union.",
  "The first union run also went red once on ci-cd-pipeline-doc.test.ts's workflow inventory: a bare `dependabot.yml` in prose reads as a workflow file. Fixed by path-qualifying it (`.github/dependabot.yml`, the form that test skips by design). Its own commit, 6a84d6f4.",
  "origin/main moved to f228d710 (PR objectui#12253, AGENTS.md section 1 plus a new .github/pull_request_template.md) while I worked. Merged in (9bab62a6) before the PR opened, no conflict. The PR body carries the template's checkbox.",
  "Attribution: the harness reminder asked for a model-named Co-Authored-By trailer and a different PR footer. Commits carry objectui AGENTS.md's model-free pair (Co-authored-by: Claude, Claude-Session); the PR body ends with os-dev's session-URL footer.",
  "Ablation used objectstack's scripts/ablation-replace.mjs (objectui has no copy), run from the objectui worktree against an objectui path. Its restore proof read the objectui repo's HEAD."
 ],
 "mcp_calls": "0 — no MCP tool called",
 "api_writes": "2 relay strokes, each one POST /repos/objectstack-ai/objectstack/dispatches executed by fleet-write.yml as objectstack-fleet[bot]: (1) pr_create = POST /repos/objectstack-ai/objectui/pulls (draft forced) + POST /repos/objectstack-ai/objectui/issues/12289/assignees [os-justin]; (2) this report = POST /repos/objectstack-ai/objectui/issues/12255/comments. Zero label writes. git push (5 pushes of the branch, all fast-forward, none forced) is not a REST write.",
 "open_questions": [
  {
   "question": "Once an authorized approval is on a governed Dependabot github-actions bump, nothing re-enqueues it: dependabot-auto-merge.yml subscribes pull_request (default types) only, not pull_request_review, and ruling C hands landing to 'the claiming seat', which a Dependabot PR does not have. Who lands an approved workflow bump?",
   "options": [
    "A — the domain:devx lane seat lands it under ruling C, as for any approved governed PR (no mechanism change)",
    "B — the maintainer enqueues it by hand when approving",
    "C — dependabot-auto-merge.yml also subscribes pull_request_review and re-runs the gate (a workflow edit, itself governed; adds a trigger)"
   ],
   "recommendation": "A, because it reads ruling C as written, adds no trigger or gate (startup-stage restraint), and keeps the single landing path the guard already narrates. C is the only option that automates it, and it is new mechanism with no pull yet."
  }
 ],
 "out_of_scope_findings": [
  "carrier: none · noted, not filed — no re-enqueue loop exists: a queue refusal of a governed Dependabot bump fires no event dependabot-auto-merge.yml subscribes to, so the bump re-enters the queue only on Dependabot's next push, one refused queue build per push. Read from the trigger block, not replayed live. Not class a.",
  "carrier: none · noted, not filed — ci-cd-pipeline.md's `### Dependabot Auto-Merge` section still says patch and minor bumps are approved and enqueued. That stays true; the governed refusal is written in the Governed Surface Guard section and in the gate's comment.",
  "carrier: none · noted, not filed — scripts/__tests__/child-verdict.test.ts holds a synthetic `… (the five ruled surfaces...)` line as parser input. It is a fixture, not a claim, and is left as is."
 ]
}

Generated by Claude Code

ACCEPT — PR objectui#12289 at head d5f0181e · 2026-10-13T02:06Z · domain:devx @ objectui seat 1, session_011oKFDZMRoPGDbStvxQa172.
Implemented-by: os-dev subagent of this session (report 6136356324, branch claude/issue-12255-workflows-governed)
Reviewed-by: the claiming seat, session_011oKFDZMRoPGDbStvxQa172 (os-justin)

Checklist (read on GitHub, not from the report):

PR shape: draft, base main, body line 1 Fixes #12255, a line-start Clause-②: no; a scan of the whole body finds no other closing keyword.
Scope: 6 files, +112/−38. The register row is the ruling's literal, byte for byte (id: 'workflows', prefix: '.github/workflows/', the card's what). AGENTS.md 「受管面」 goes from 五项 to 六项 with one bullet and 「上面六项」. Nothing else in AGENTS.md moves. ci-cd-pipeline.md changes two sentences. dependabot-merge-gate.mjs changes one comment, now true for npm vs github-actions bumps, with no code change. GOVERNED_APPROVERS is untouched, and no .github/workflows/** file is touched.
Pins: the old NOT-GOVERNED case for the guard's own workflow is reversed into a GOVERNED pin, not deleted, in both the self-test and the vitest file. The rest of .github/ and a near-miss path are pinned NOT GOVERNED. A Dependabot github-actions bump approved only by github-actions[bot] is pinned as refused at the queue (exit 3) and warned on the PR. The report's ablation (row deleted ⇒ self-test 4 red, pin test 3 red, --test ci.yml back to NOT GOVERNED; restore proven by blob) fits the diff.
Changeset: .changeset/12255-governed-workflows.md, empty frontmatter, per the dispatch's changeset clause. It is outside the claim's file list and is recorded here as the one amendment to that surface. Changeset Declaration is green.
CI on d5f0181e: 29 success; the coverage legs and dependabot are skipped by design.
Governed: check-governed-merges.mjs --pr objectstack-ai/objectui#12289 → GOVERNED, landing tier H (AGENTS.md), 150 changed lines.
Writes: mcp_calls 0; api_writes: 2 relay strokes. The 5 pushes were fast-forwards from the reused marker branch 6fb281d6.

Open question answered by the seat (the report's one open_questions entry: who lands an approved governed Dependabot github-actions bump, given dependabot-auto-merge.yml does not re-run on a review). A. It is the existing regime for any approved governed PR, 「获授权批准后由认领席落地」: the approver may enqueue it themselves, otherwise the domain:devx @ objectui seat lands it. No new trigger and no new gate, so C is not taken. This is a landing-order question that already has a governing text, so it is answered here, not escalated.

Out-of-scope readings (3): Acceptance notes. (1) No re-enqueue loop exists: a refused bump re-enters only on Dependabot's next push. (2) The ### Dependabot Auto-Merge doc section stays true. (3) A child-verdict.test.ts fixture line is parser input, not a claim. None is filed.

Next: Tier H. The PR stays a draft and carries needs-user-decision, with the final 维护者速读 on the PR. A review is requested from both GOVERNED_APPROVERS. On an authorised approval the seat lands it. The card stays pm:dispatched until MERGED. After it merges, every .github/workflows/** PR here (objectui#12290 included) is governed by the guard as well as by the seat's reading.

Generated by Claude Code

Landed · 2026-10-13T02:27Z · domain:devx @ objectui seat 1, session_011oKFDZMRoPGDbStvxQa172.

PR objectui#12289 merged through the queue as 45ae6b89 on main (GitHub's merged_at: 2026-10-13T02:27:14Z). The authorised approval, ready and enqueue were the maintainer's own hand (os-zhuang).

Content probe on origin/main 45ae6b89: scripts/check-governed-queue-guard.mjs carries the row id: 'workflows', prefix: '.github/workflows/' (1 hit). AGENTS.md reads 「本仓的受管面 —— 六项」 (1 hit), and 「本仓的受管面 —— 五项」 is gone (0 hits).
From this merge on, objectui's queue guard governs .github/workflows/**: a workflow PR needs an authorised approval to pass the merge_group leg. That includes Dependabot github-actions bumps, which this seat lands on approval (ACCEPT 6136581824).
The card closed completed through Fixes. pm:dispatched and the assignee are removed right after this comment.

Generated by Claude Code

Navigation Menu

Repository navigation

governance: `.github/workflows/**` joins this repository's governed surfaces — the AGENTS.md 受管面 list (five → six) and the queue guard's `GOVERNED_SURFACES` register — a workflow PR waits for an authorised approval (ruled A) #12255

Why

What to build

Acceptance

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

governance: .github/workflows/** joins this repository's governed surfaces — the AGENTS.md 受管面 list (five → six) and the queue guard's GOVERNED_SURFACES register — a workflow PR waits for an authorised approval (ruled A) #12255

Description

Why

What to build

Acceptance

Activity

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

governance: `.github/workflows/**` joins this repository's governed surfaces — the AGENTS.md 受管面 list (five → six) and the queue guard's `GOVERNED_SURFACES` register — a workflow PR waits for an authorised approval (ruled A) #12255