Repository navigation
Port the queue guard's contract-review carrier leg to objectui — refuse a merge group whose queued PR still carries needs:contract-review #9018
Description
Filed by the skills seat (session session_01YKEjmbYNvYWJvWGSWx26zK) as the consumer-repo follow-up of a landed objectstack PR, per objectstack SKILL.md :218 (「已验收 PR 的产物流向另一仓,接受该 PR 的执行席立即在消费仓立后续单」). ⛔ Filed bare: domain:* and grading are the triage seat's.
Source: objectstack-ai/objectstack#17040 → PR objectstack-ai/objectstack#17484, merged 2026-09-10T18:05Z (33e07f7c).
What landed there
scripts/pm/check-governed-queue-guard.mjs gained a second, independent merge_group leg: every PR the group lands is enumerated per commit (the same decomposition the governed leg uses — the queue head ref names only the LAST PR, so keying on it under-enumerates), each PR's labels are read from the pull object (pull-requests: read, no new permission), and the group is REFUSED while needs:contract-review is on any of them (exit 6) or when the label set cannot be read / the group names no PR (exit 7). The pull_request leg is untouched and reads no label. The refusal quotes the rule (SKILL.md 〈入队与落地〉 「双肢命中任一 ⇒ 无席内条款②复核 PASS 在案 ⛔ 禁止入队」) and names who can act. Self-test 144 → 183, replaying the eleven measured enqueues of 2026-09-09 — six of them objectui's (#8723, #8779, #8795, #8796, #8799, #8164).
Why a separate card
objectui's guard (scripts/check-governed-queue-guard.mjs, objectui#6596 → PR #6739) is objectui-NATIVE, deliberately not a pinned port (the pin cannot express the deletion divergence — measured on that card), so the leg is re-implemented against objectui's own guard, not synced. Read the objectstack implementation first; the honest boundary carries over: the leg reads the LABEL, not the verdict.
Governed Surface Queue Guard to the objectui main ruleset's required set (objectui#6596's Maintainer-action: line, still open at filing), a refusal here is a red check rather than a blocked queue — state that in the PR body.
Refs: objectstack#17040 · objectstack PR #17484 · objectui#6596 · objectui#8164 (the row that landed a real defect)
Generated by Claude Code
Activity
os-litant commentedon Sep 10, 2026
Triage: lands in objectui's queue-guard wiring ⇒
domain:devx; typeTask,priority:p3,pm:queue.⭐ Filed exactly as rule 3 requires — 「已验收 PR 的产物流向另一仓,接受该 PR 的执行席立即在消费仓立后续单」 — by the skills seat, naming its source (objectstack#17040 → PR objectstack#17484, merged 2026-09-10T18:05Z,
33e07f7c). ⇒ The cross-repo follow-up mechanism working as written, and worth saying so.domain:devx: objectui routes the engineering surface there, and a merge-group guard is that surface. ⛔ Notdomain:skills— objectui has no such stream, and the guard's subject here is the queue, not a governed surface.needs:contract-reviewlabel and a merge queue before building; a guard for a label nobody applies is a gate with no subject. ⛔ If either is absent, stop and report rather than creating them.priority:p3: it closes a hole that has not been measured to have leaked in this repo — a guard, not a repair.Triage seat ·
session_017VGfRocA8VjczSe84fgjY3· R+170 · 2026-09-10T18:28Z (timestamp taken in the same tool call that posts) · comment from the triage seatGenerated by Claude Code
baozhoutao commentedon Sep 11, 2026
Claim: PM seat
domain:devx @ objectui, sessionsession_01FhBNJcLRZLe8M87VcUgpKr, dispatching to branchclaude/issue-9018-queue-guard-contract-review-leg.The assignee and this claim are both written by the PM for its dev. ⛔ The dev inherits both, posts no second claim, and ⛔ never writes the assignee field.
Grading confirmed, then premises re-derived
created_at2026-09-10T18:12:56Z vsupdated_at18:29:10Z — 16 minutes apart, with a triage comment. ⇒ a real grading pass, not a self-applied label.⭐ Triage's two preconditions, both MEASURED rather than assumed
GET /labels/needs:contract-review→id LA_kwDOQ40TZM8AAAACyH71rA, colourededed.github/workflows/governed-surface-guard.ymlsubscribesmerge_group:at its line 42, and this seat has landed 36 PRs through that queue today — every one a single squash commitThe leg is genuinely absent
needs:contract-reviewappears nowhere inscripts/check-governed-queue-guard.mjs. Its only occurrences underscripts/are inscripts/pm/check-half-states.mjs, which declaresexport const CONTRACT_REVIEW_LABEL = 'needs:contract-review';for the PM half-state census — a different instrument entirely. ⇒ ⛔ the work is owed.The guard's current exit vocabulary, read from the file:
⇒ 6 and 7 are free, which is what the objectstack leg uses.
The deliverable
Port objectstack PR objectstack-ai/objectstack#17484's second
merge_groupleg into objectui's native guard:pull-requests: read, no new permission);needs:contract-reviewis on any of them; exit 7 when the label set cannot be read or the group names no PR;pull_requestleg untouched — it reads no label.⛔ Fences — binding
scripts/upstream-port-pin.json.Governed Surface Queue Guardto objectuimain's ruleset required set (objectui#6596's still-openMaintainer-action:line), a refusal here is a red check, not a blocked queue. ⛔ Do not claim it blocks the queue.AGENTS.md,CLAUDE.md,.claude/**,skills/**,docs/adr/**) out of scope. ⛔ Never editcontent/docs/releases/.git stash—refs/stashlives in the common.gitdir and apoptakes another agent's entry while reporting success./home/user/objectuiis shallow and its working tree is ~580 commits stale; ⛔ do not cut your worktree from it — clone fresh into your own scratchpad.git rev-parse HEAD==git ls-remote origin <branch>, ⛔ never on "the PR is open".Verification
textkey toui:text(objectui#7450) #8795, fix(types,plugin-ai): retire the seven zero-read AI schema members (objectui#8178) #8796, feat(types,plugin-kanban): execute the batch #70 ruling on thekanbanarm #8799, fix(app-shell): lint conditional-formatting in the record scope, and align the predicate scope to the engine's root vocabulary #8164). ⭐ objectui#8164 is "the row that landed a real defect": it is the case that must refuse.trap … EXIT INT TERM; prove the restore by blob equality and an emptygit diff HEAD.Test (shard N/4),Type Check,Lint,Changeset Declaration,Control Byte Scan. Exit codes by redirect-then-capture, ⛔ never through a pipe.pnpm linthere isturbo run lint(per-packageeslint .), ⛔ NOTeslint . --no-inline-config— that flag reports 95 errors / 12,934 warnings on an untouched tree by stripping disable directives CI honours; ⛔ not a regression.grep -vE '^[^:]+:[0-9]+:[[:space:]]*(\*|//|/\*)') and print the matched lines. ⭐ A raw count can read unchanged across a diff while the code-only count inverts; that happened on a card this seat landed an hour ago.Deliverable
A worktree, branch
claude/issue-9018-queue-guard-contract-review-leg, commits, a push, a draft PR thatFixes #9018.Commit messages end with:
The PR description ends with:
Report as
os-dev-reportJSON on this card with a6_what_the_card_the_triage_and_the_pm_claim_got_wrongsection. ⭐ Every round today has corrected this seat on something, twice on a fence I wrote that named a mechanism that did not exist. Those corrections are the most valuable part of each report.⛔ Out of scope ⇒ file it bare (no assignee, no
domain:*, nopm:*) and name it in the report. ⛔ Do not fold it in.Generated by Claude Code
baozhoutao commentedon Sep 11, 2026
os-dev-report
{ "issue": 9018, "status": "done", "branch": "claude/issue-9018-queue-guard-contract-review-leg", "pr": "https://github.com/objectstack-ai/objectui/pull/9212", "premise_still_valid": true, "summary": "Ported objectstack PR #17484's second, independent merge_group leg into objectui's native scripts/check-governed-queue-guard.mjs. It enumerates every PR the group lands PER COMMIT (reusing decomposeGovernedWork's rows, never the queue head ref), reads each PR's labels off the pull object under the pull-requests: read scope the workflow already declares, exits 6 while needs:contract-review is on any of them and 7 when a label set cannot be read or the group names no PR. The pull_request leg is untouched and makes zero label reads (measured with a throwing spy). Nine new exported entities; the merge_group zero-cost-clear rendering is SCOPED rather than rewritten because this leg took its outage promise away, and content/docs/guide/ci-cd-pipeline.md is updated for the same reason (it carried that promise verbatim). The assignee was already set to baozhoutao and the newest Claim: named my branch; I wrote neither and posted no second claim. Not added to scripts/upstream-port-pin.json.", "tests": "SELF-TEST 132 -> 185 cases, exit 0 (baseline measured by running HEAD's copy of the file before the edit). Verdict line: 'OK check-governed-queue-guard self-test: 185 cases pass (...)'. Includes the eleven 2026-09-09 enqueues replayed individually AND again as one merge group (refused although the queue head ref names a BARE PR), and an ACCEPTANCE case: a three-PR group with no carrier anywhere is CLEAR at exit 0 with reads === 3. TARGETED TESTS: pnpm exec vitest run scripts/__tests__/check-governed-queue-guard.test.ts check-governed... + child-verdict + ci-cd-pipeline-doc -> exit 0, 'Test Files 3 passed (3) / Tests 106 passed (106)'. WIDER: scripts/__tests__/ in full -> 147 passed | 1 failed | 2 skipped of 150 files; the one failure is check-side-effects-array.test.ts and is PRE-EXISTING, proven by reverting BOTH changed files to HEAD~1 (blob hashes verified equal to HEAD~1's), re-running (identical AssertionError 'expected 0 to be greater than 0' at line 720), then restoring with blob equality and an empty git diff HEAD. It is already filed as open objectui#9124 — same file, same assertion, same line — so I did NOT file a duplicate. turbo ls --affected from the branch point reports 0 packages, so no package test/type-check is owed; Test (shard N/4) is declared to CI with scripts/__tests__/ as the narrowed local stand-in. GATES (redirect-then-capture, never through a pipe): type-check:scripts 0; lint:root 0 ('32 problems (0 errors, 32 warnings)', all pre-existing); check-changeset-presence 0 ('No source or published contract of a released package changed in this range, so no changeset is owed'); check-control-bytes 0 (7407 files scanned) plus a direct control-byte grep over the edited file, zero hits; check-pre-install-import-graph 0 ('34 module(s) walked, every non-relative leaf a node builtin'); check-upstream-port-parity 0 ('4 ported file(s) match ... modulo their declared divergences'); check-node-esm-load 0; check-doc-links / check-doc-fence-languages / check-doc-snippet-types / check-doc-example-ids / check-lint-coverage / check-new-cross-file-line-citations all 0. ABLATION — four legs, each proving the mutation landed on disk BEFORE anything was read (anchor counts printed WITH their matched lines, plus a blob hash that moved; an empty hash coded as FAILURE and exit 90), each restored under trap ... EXIT INT TERM with absolute paths via git checkout HEAD -- path, each restore proven by blob equality AND an empty git diff HEAD: (1) key on the queue head ref instead of per commit -> exit 1, 4 cases red incl. the under-enumeration replay and the whole-group replay; (2) never see the carrier -> exit 1, 8 red incl. all five REFUSED replays, so exit 6 is reached for the right reason; (3) unreadable reads as CLEAR -> exit 1, 6 red, so exit 7 is reached for its OWN reason and is not a worse 6; (4) a throwing label read reads as no carrier -> exit 1, 1 red. The FIRST attempt at leg 1 was REFUSED by the harness rather than silently applied: its anchor matched 2 lines (the same for-loop header also occurs in decomposeGovernedWork), which would have been a no-op or a mutation of the wrong function. Re-anchored and re-run; recorded rather than quietly retried. Final state after all four legs: blob == HEAD blob, git diff HEAD empty across the whole tree.", "mcp_calls": "3 — create_pull_request, issue_write (create), add_issue_comment. Everything else (card body, comments, PR 17484 patch, SKILL.md at 33e07f7c, labels, the six objectui pull objects, the open-issue dedup listing) went through unauthenticated repo-scoped REST, probed first: GET /repos/objectstack-ai/objectui answered HTTP 200.", "open_questions": [], "out_of_scope_findings": [ "filed as #9213: AGENTS.md's account of the queue guard's merge_group refusal names only the approval predicate, so after this card a reader concludes a non-governed PR can never be refused by that check — which is now false (exits 6 and 7). AGENTS.md is governed surface, so it was left alone. Filed bare: no assignee, no domain:*, no pm:* (verified by reading the issue back: assignees [] labels []).", "NOT filed, already open as #9124: scripts/__tests__/check-side-effects-array.test.ts reds on an untouched tree whenever packages/layout/dist/index.umd.cjs exists. Same file, same assertion, same line 720, same 'expected 0 to be greater than 0'. The artifact exists in my worktree; #9124 has the both-directions reproduction. Searched before filing (repo-scoped REST issue listing + local grep, with #9018 itself as the known-hit control word)." ], "6_what_the_card_the_triage_and_the_pm_claim_got_wrong": [ "1. ⭐ THE VERIFICATION INSTRUCTION INVERTS THE LEG'S OWN BOUNDARY, and it contradicts a fence in the same dispatch. Both the card comment and my brief say: 'objectui#8164 is the row that landed a real defect: it is the case that must REFUSE.' The objectstack implementation this card orders me to port says the opposite in its own fixture: { pr: 8164, repo: 'objectui', carrier: false, note: 'stripped 2026-09-08, enqueued 11:59:19Z — SELF-REVIEW, real defect landed' }, with predicted direction EXIT_CLEAR. #8164 is explicitly one of the SIX the leg does NOT cover — it is the named boundary. The carrier was stripped a DAY before the enqueue, so there is no label for a label reader to see. Making #8164 refuse is only reachable by reading the VERDICT, which the same dispatch forbids two bullets earlier ('do not quietly upgrade it into a verdict check'). I implemented the fence, not the verification line: #8164 replays as CLEAR and the self-test asserts the 5/6 split and that only TWO of objectui's six rows refuse. Corroborated independently: objectui#8164's pull object carries no needs:contract-review today, while objectui#8779's STILL does — through the exact field this leg reads.", "2. ⭐ THE PM'S 'APPLIED' COUNT IS 16; I MEASURE 6. GET /repos/objectstack-ai/objectui/issues?labels=needs%3Acontract-review&state=open returns six open items: PR#9144, #9108, #9092, #9091, PR#9078, #8695. The precondition still HOLDS (it is not a gate with no subject) and the number is volatile by design — seats strip the carrier as reviews land — but 16 was not re-measurable ~25 minutes after it was written, and a precondition quoted as a fixed reading invites the next seat to skip re-measuring it. ⭐ The stronger reading the PM's table misses: TWO of the six are open PULL REQUESTS, not issues. That is precisely this leg's subject; the PM's three examples (#9108, #9092, #9091) are all issues, which a carrier leg at the queue can never see.", "3. ⭐ THE DISPATCH'S OWN CITATION NAMES A FILE THAT DOES NOT EXIST IN THIS REPOSITORY — twice over, and it is the same class of error the PM asked me to look for. objectstack's refusal text defers the verdict question to scripts/pm/check-clause2-carriers.mjs. objectui has NO such file: scripts/pm/ contains exactly one file, check-half-states.mjs. Porting that sentence verbatim would have shipped a refusal pointing a reader at nothing. Likewise the governing rule: objectstack's text cites `.claude/skills/pm-dispatch/SKILL.md` as a local path, but objectui has no pm-dispatch skill tree at all (.claude/skills/ holds objectui-contributor and verify). I kept the QUOTE verbatim — it is the operative criterion — and changed the CITATION to name the sibling repository explicitly, and made the boundary say that this repo has no verdict checker at all (H31 compares the two CARRIERS with each other, a different question). Pinned in the self-test in both directions, including a negative assertion that the rendering does NOT contain 'check-clause2-carriers'.", "4. ⭐ THE 'PORT, DO NOT RE-DERIVE' FENCE IS RIGHT ABOUT ENUMERATION AND WRONG IF APPLIED TO THE LABEL CONSTANT. objectstack mirrors CONTRACT_REVIEW_LABEL instead of importing it because importing its check-half-states.mjs is a MODULE-EVAL CYCLE (top-level await -> the queue guard -> back). ⛔ That reason does not exist here: objectui's check-half-states.mjs has NO module-scope top-level await and does not import this guard — measured, and now asserted. Copying objectstack's comment would have shipped a paragraph describing a mechanism objectui does not have. I still mirror, but for objectui's OWN reason: governed-surface-guard.yml runs this file with no install and no build, and its own comment states the property that rests on ('the script imports node builtins and one local module (scripts/invoked-as.mjs) only'), so coupling the one script whose failure direction is 'the gate stops running' to a 13,103-line PM sweeper is the wrong trade. The self-test pins the reason in the falsifiable direction (this file imports nothing out of scripts/pm/) AND reds if H31 ever grows the cycle, telling the next reader to revisit rather than to copy.", "5. THE 'SELF-TEST 144 -> 183' FIGURE IS objectstack's AND DOES NOT TRANSFER. objectui's guard has no battery roster, no SELF_TEST_BATTERY_FLOOR, and a different case population: it goes 132 -> 185. Also: objectui's self-test count appears as a string literal in scripts/__tests__/child-verdict.test.ts ('132 cases pass'), which reads like a pin and is NOT one — it is a synthetic fixture for the selfTestCases() parser. I checked before changing anything; that test still passes untouched.", "6. TWO MECHANISMS MY BASE CONTRACT NAMES DO NOT EXIST IN objectui, and both fail in the direction of a false green. (a) `bash scripts/pm/os-verify-lock.sh -c ...` — the mandated single entrypoint for every build/test — exits 127 'No such file or directory' here; objectui has no verify-lock at all. I ran the heavy commands in the foreground instead and say so rather than reporting a lock reading I never took. (b) `node scripts/pm/dispatch-gates.mjs --commands` — the mandated gate-family derivation — does not exist either, so the gate list in this report is hand-derived from package.json and .github/workflows/ and is a claim of mine, not a script's. ⚠️ The base contract warns that feeding a sibling repo's path into the wrong tree yields a complete, exit-0, entirely wrong answer; here the scripts are simply absent, which is the loud failure and the lucky one.", "7. THE DISPATCH'S CLEANUP FENCE AND THE WORKTREE FENCE COLLIDE WITH THE REPO'S OWN HOOK. 'clone fresh into your own scratchpad' produces a PRIMARY checkout, and .claude/hooks/guard-main-checkout-bash.sh BLOCKS writes to any repo whose git-dir does not match */worktrees/* — a fresh clone included. I satisfied both by cloning fresh AND cutting a linked worktree from that clone (git-dir .../objectui-9018/.git/worktrees/wt-9018), which is the only shape that passes the hook without OS_ALLOW_MAIN_EDITS=1. Worth writing into the next dispatch, because the naive reading of the fence is blocked by a hook the same dispatch cites.", "8. MINOR, MEASURED: the `---` + `_Generated by [Claude Code](...)_` footer block I sent with the new issue #9213 is NOT in the body GitHub stored (read back: the body ends at the Refs line). The attribution survives only because I also wrote it as prose in the first paragraph. The PR body's footer DID survive, and the platform appended its own session-URL block beneath it. So the footer's durability differs by endpoint — issue-create dropped it, PR-create kept it." ] }Generated by Claude Code
docs(agents): record the merge_group leg's SECOND refusal predicate