finding(tooling): check-upstream-port-parity reserves --rewrite-governed-file for the merging human, but a provably content-neutral re-sync is what the red gate demands of a dev

Filed by the skills seat (session session_01MCLBsUgfykL74aU716rzVK, GitHub os-sales) at sign-off, 2026-09-12T15:4xZ, from the os-dev report on objectui#7775 (comment 5646904538) — a finding for the next skills seat to grade under the lane's self-triage exception; ⛔ not graded here.

The reading

scripts/check-upstream-port-parity.mjs's usage header reserves --rewrite-governed-file by name for 「the human merging it」. On PR #9300 the six pinned hook entries had drifted because the card's change was hand-edited; the gate's own --resync was the required act, it needed that flag because .claude/** is governed here, and a dev typed it on the seat's instruction. The rewrite was provably content-neutral: every re-synced file came back byte-identical to the committed one, and every new upstreamSha256 equalled the sha256 of git show origin/main:PATH in the objectstack checkout, computed independently before the re-sync ran. The PR body records who typed the flag.

The question (dev's options, recommendation B)

A. Leave the header; the seat's per-card ruling routes it each time and the PR body records the actor.
B. Reword the header so the reservation names the real condition — a re-sync may be typed by whoever can PROVE it content-neutral (digests computed independently beforehand equal the pinned result), and stays reserved for the merging human otherwise.
C. Keep the reservation absolute: a dev reports the red gate and does not clear it.

The reservation's real target is a silent rewrite from another repository's bytes, not the actor; this run shows the hazard is decidable in advance and the check is cheap. Governed surface ⇒ the maintainer's word decides; filed so the question has a card rather than a chat line.

Dedup

Same-session control: the objectui open-issue listing (single-label domain:skills, 4 rows at 15:15Z) carries no card on the parity gate's flag reservation; the objectui 15:1xZ probe's list_issues control (pm:queue, 0 rows for this lane) was live. git grep -n 'rewrite-governed-file' origin/main -- scripts → the header and the flag parser only (lit control: --resync hits the same file).

Generated by Claude Code

Graded under the lane's self-triage exception — finding → needs-user-decision · priority:p3 · Task (skills seat, session session_01DAcomhvR9kKizeYgg89Vo8, GitHub os-project-manager, 2026-09-13T07:19Z). Class (b) is not met — no declared contract is violated: the usage header reserves the flag by role, and the dev typed it on the seat's instruction with the content-neutrality proof recorded on PR #9300. The open question is who may run a rewrite of governed-file digests, which is governance strength ⇒ the maintainer's word, as the filer read it. Landing once ruled: the usage header of scripts/check-upstream-port-parity.mjs (objectui; SUBJECT is the governed port pin ⇒ this lane).

维护者速读

事情 —— objectui 的 check-upstream-port-parity 把 --rewrite-governed-file 这个开关的使用者写死为「合并的人」。PR #9300 的 dev 在席位指令下用了它做一次可证明内容不变的重同步(每个文件字节相同、六个摘要事先独立算出并相等)。要你定:这个保留写给谁。

选项 —— A 不改头注,每张卡由席位裁一次并在 PR 正文记录操作者;B 头注改为「谁能事先证明内容不变(事前独立算出的摘要与钉住的结果相等)谁可以用,证明不了的仍归合并的人」;C 保留绝对,dev 遇红只报告不清。

推荐 —— B:保留的真正目标是「用另一个仓的字节静默重写」,不是操作者;B 把规则收窄到真实危害并要求可核的证明。A 让每张卡重裁一次;C 把一个可机械证明的动作推回人工。

你要做的 —— 回一个字母:A / B / C。

os-decision-facets

① 项目长远合理性:B 把保留条件写成可证伪的判据(事前摘要相等),缩小特例;A 留裁量;C 加一个人工环节。
② 实际业务拉动:PR hooks: the three remaining guards name the environment their hatch variable must be set in, never a command prefix #9300 一次实例;每次上游 pin 漂移都会重现。
③ 防 AI 犯错:B 的失败方向响亮——摘要不等即拒绝重写;A 的失败静默(席位口头裁);C 无误写风险,代价是人工。
④ 创业阶段不扩散:一句头注,不加工具。
推荐:B;回退:C。置信缺口:头注是否被任何门禁读取未测;若有门禁读它,B 的措辞要与门禁判据同改。

Generated by Claude Code

Ruling recorded — B: the `--rewrite-governed-file` reservation names its real condition — whoever can PROVE the re-sync content-neutral beforehand (independently computed digests equal to the pinned result) may run it; otherwise it stays with the merging human (director seat, decision batch #131 item 4, 2026-09-13)

Maintainer, verbatim (live PM chat, reply received 2026-09-13T07:3xZ), to decision batch #131 presented as 1A(+三类表)·2(1)·3A·4B: 「同意」.

Derived first from the long-term axis: the reservation's target is a silent rewrite from another repository's bytes, not the actor; a condition stated as a falsifiable check narrows the special case and makes the failure loud (digest mismatch ⇒ refused). A leaves discretion per card; C pushes a mechanically provable act back to a person. ②③④ do not overturn ①.

What is ruled

The usage header of scripts/check-upstream-port-parity.mjs states the condition above; if any gate reads the header, its criterion changes in the same edit (check first — the card's one confidence gap). PR #9300's run is the worked example: every re-synced file byte-identical, every upstreamSha256 equal to the sha256 of git show origin/main:PATH computed before the re-sync.

State

needs-user-decision → pm:queue; domain:skills / priority:p3 kept (governed).

Generated by Claude Code

Ruling recorded — B

Maintainer, verbatim (live chat with the skills seat, between 2026-09-13T07:52Z and this write, replying to the seat's five-item explanation): 「以上接受你的建议。」 The accepted text, verbatim:

B(荐):头注改成「能事先证明内容不变(事前独立算出的摘要与钉住的结果相等)的人可以用;证明不了的仍归合并的人」——把规则收窄到真实危害(用另一个仓的字节静默重写)。

What is ruled. The usage header of scripts/check-upstream-port-parity.mjs reserves --rewrite-governed-file for whoever can PROVE the re-sync content-neutral beforehand — digests computed independently before the run equal the pinned result — and stays reserved for the merging human otherwise. Landing: the header text only (objectui scripts/, not a governed path — the seat measures with node scripts/check-governed-queue-guard.mjs --test before landing); if the header is read by any gate or self-test, that reader changes in the same PR.

State: needs-user-decision → pm:queue in this stroke; priority:p3 · Task kept. Dispatched by the total order once a slot frees. Blocked-by: liveness: none. Freshness gate: comments newer than the body at this write = 5651901728 (the skills seat's grading + facets) only.

Generated by Claude Code

Claim: PM loop round 1
Session: session_01DAcomhvR9kKizeYgg89Vo8 (GitHub os-project-manager, skills seat), claimed at 2026-09-13T08:39Z
Branch: claude/issue-9303-resync-reservation-names-its-condition
Worktree: objectui-issue-9303
Domain: domain:skills (graded p3 Task by this seat, 5651901728; ruled B by the director seat, batch #131 item 4, with the maintainer's 「同意」; this seat's verbatim supplement 5652079514)
Ruling-ref: 5651977208
File surface: scripts/check-upstream-port-parity.mjs — the usage header's --rewrite-governed-file reservation (currently 「…when the ported file is GOVERNED SURFACE and you are the human merging it」) restated as its real condition: whoever can PROVE the re-sync content-neutral beforehand (digests computed independently before the run equal the pinned result) may run it; otherwise it stays reserved for the merging human. If the header text is read by any gate, self-test or other file, that reader changes in the same PR (rewrite-governed-file appears in no other tracked file on origin/main 69aa9c01; inside the file the mentions are the usage header and the flag's own parsing/refusal text — the dev reads which). ⛔ No behaviour change to the flag, ⛔ no touch to the pinned copies.
Landing path: objectui scripts/ is not a governed path — the seat measures it with node scripts/check-governed-queue-guard.mjs --test before landing ⇒ in-seat contract-tier review → ready → auto-merge after all checks green (the Doc Snippet Type Check red on main, objectui#9346, is judged by signature per #17934 shape 1)
Container & model: S, mode:subagent, model: opus (no path mandate)
Clause-②: no
Thread-read: 5652079514 (this seat's ruling record, 2026-09-13T07:57Z — the newest comment at this claim)
Serial constraints cleared: no open objectui PR touches scripts/check-upstream-port-parity.mjs (22 open-PR file lists read at 2026-09-13T08:27Z); last touch on origin/main b1777ae; objectui has no verify-lock script and no hold names this file in its Restart-touch: lines as far as this seat has read.

Generated by Claude Code

os-dev-report

{
  "issue": 9303,
  "status": "done",
  "branch": "claude/issue-9303-resync-reservation-names-its-condition",
  "pr": "https://github.com/objectstack-ai/objectui/pull/9383",
  "premise_still_valid": true,
  "summary": "Ruling B landed as text only. The usage header of scripts/check-upstream-port-parity.mjs now reserves --rewrite-governed-file for whoever can PROVE the re-sync content-neutral beforehand (digests computed independently before the run, equal to what the pin holds after it), and for the merging human otherwise. The actor framing was repeated in FOUR places, not the two the card listed: the usage header, the '--resync REFUSES to rewrite governed surface' prose (which also now carries PR 9300 as the worked example, plus the note that the same digests computed afterwards do not qualify), the doc comment on RESYNC_GOVERNED_FLAG, and the refusal's own instruction line. All four restated; no behaviour change: resyncWriteVerdict, the governed set borrowed from check-governed-queue-guard.mjs, the pin ledger and every pinned copy are untouched.",
  "tests": "All exits captured before any pipe (cmd > log 2>&1; EXIT=$?). check-upstream-port-parity --self-test exit 0, 58 cases pass (58 before the edit too). check-upstream-port-parity live verify exit 0: 11 ported files match modulo their declared divergences, each at its own pinned ref (5 distinct refs). check-bash32-floor --self-test exit 0 (160 cases); live exit 0. check-governed-queue-guard --test scripts/check-upstream-port-parity.mjs exit 0: NOT GOVERNED. check-changeset-presence exit 0: no changeset owed. check-control-bytes exit 0 (7539 text files); manual sweep grep -naP over the edited file: 0 hits. check-entry-guard --self-test and live: 0/0. check-lint-coverage exit 0 (46/46). check-new-cross-file-line-citations exit 0 (0 new). vitest run on the four test files naming this script (upstream-port-parity-wiring, child-verdict, check-half-states, ci-cd-pipeline-doc): exit 0, 4 files / 131 tests pass. eslint --no-inline-config --format json on the changed file: exit 0, 1 result object, 0 errors, 0 warnings — a DECLARED NARROWING with its three readings: population (lint is turbo run lint per package; a scripts/*.mjs matches no typed rule block in eslint.config.js, whose blocks target ts/tsx), count (1 from --format json), invariance (no parserOptions.project and no projectService anywhere in eslint.config.js, so no type-aware linting can move a verdict on an untouched file). The repository-wide sweep is CI's run. No ablation was run: the change is comment and message text with no predicate to mutate; the reader question was answered by measurement instead (see premise_checks).",
  "mcp_calls": "0 — every GitHub read and write in this run went through REST (curl / urllib); no MCP GitHub tool was called",
  "gates": [
    {
      "command": "node scripts/check-upstream-port-parity.mjs --self-test",
      "exit": 0,
      "evidence": "check-upstream-port-parity self-test: 58 cases pass"
    },
    {
      "command": "node scripts/check-upstream-port-parity.mjs",
      "exit": 0,
      "evidence": "11 ported file(s) match objectstack-ai/objectstack modulo their declared divergences, each at its own pinned ref"
    },
    {
      "command": "node scripts/check-bash32-floor.mjs --self-test",
      "exit": 0,
      "evidence": "check-bash32-floor self-test: 160 cases pass"
    },
    {
      "command": "node scripts/check-bash32-floor.mjs",
      "exit": 0,
      "evidence": "census: 13 by .sh extension, 19 constructs checked, floor bash 3.2"
    },
    {
      "command": "node scripts/check-governed-queue-guard.mjs --test scripts/check-upstream-port-parity.mjs",
      "exit": 0,
      "evidence": "NOT GOVERNED - 1 path(s) checked against 5 governed surface(s); none matched"
    },
    {
      "command": "node scripts/check-changeset-presence.mjs",
      "exit": 0,
      "evidence": "1 file(s) changed, 0 of them published source of a package the release covers; no changeset is owed"
    },
    {
      "command": "node scripts/check-control-bytes.mjs",
      "exit": 0,
      "evidence": "OK (scanned 7539 tracked text file(s); skipped 85 binary)"
    },
    {
      "command": "node scripts/check-entry-guard.mjs --self-test",
      "exit": 0,
      "evidence": "63 cases pass"
    },
    {
      "command": "node scripts/check-entry-guard.mjs",
      "exit": 0,
      "evidence": "94 scripts/ file(s) - no entry guard outside the baseline"
    },
    {
      "command": "node scripts/check-lint-coverage.mjs",
      "exit": 0,
      "evidence": "46/46 packages linted, 0 with outstanding errors"
    },
    {
      "command": "node scripts/check-new-cross-file-line-citations.mjs",
      "exit": 0,
      "evidence": "0 new citation(s), enforcement report-only"
    },
    {
      "command": "pnpm exec vitest run scripts/__tests__/upstream-port-parity-wiring.test.ts scripts/__tests__/child-verdict.test.ts scripts/__tests__/check-half-states.test.ts scripts/__tests__/ci-cd-pipeline-doc.test.ts",
      "exit": 0,
      "evidence": "Test Files 4 passed (4); Tests 131 passed (131)"
    },
    {
      "command": "pnpm exec eslint --no-inline-config --format json scripts/check-upstream-port-parity.mjs",
      "exit": 0,
      "evidence": "1 result object, 0 errors, 0 warnings (declared narrowing, three readings recorded)"
    }
  ],
  "files_changed": [
    "scripts/check-upstream-port-parity.mjs (+28 / -7; git diff --stat origin/main shows exactly this file)"
  ],
  "acceptance_readings": {
    "grep_on_scripts/check-upstream-port-parity.mjs": {
      "the human merging it": "1 -> 0",
      "human doing the merge": "2 -> 0",
      "human doing that merge": "1 -> 0",
      "merging human (the fallback, in the ruling's own words)": "0 -> 3",
      "content-neutral": "0 -> 5",
      "RESYNC_GOVERNED_FLAG = '--rewrite-governed-file'": "1 -> 1 (unchanged)",
      "rewrite-governed-file (lines, all forms)": "3 -> 3 (unchanged)",
      "file length (lines)": "834 -> 855"
    },
    "stated_exactly": "The actor phrasing did not survive as the sole condition AND did not survive in that spelling at all. The fallback is now spelled 'the merging human', which is the ruling's own wording ('stays reserved for the merging human otherwise'), so 'the human merging it' reads 0.",
    "git diff --stat origin/main": "scripts/check-upstream-port-parity.mjs | 35 +++-- ; 1 file changed, 28 insertions(+), 7 deletions(-)",
    "changeset": "none owed (measured with check-changeset-presence.mjs, exit 0); no skip-changeset label applied"
  },
  "premise_checks": {
    "P1 (file shape at 69aa9c01)": "CONFIRMED. 834 lines; rewrite-governed-file at 12 (usage header), 129 (prose), 366 (the export). The actor wording 'the human merging it' at 14. Anchored by content, not by line number.",
    "P2 (readers of the wording)": "CONFIRMED AND EXTENDED. Outside this file the string appears only in scripts/check-bash32-floor.mjs (one prose mention by name) and scripts/upstream-port-pin.json (the same sentence stored as the 'ported' side of one of that file's declared divergences). Neither reads THIS file's header text, so neither changes here - and check-bash32-floor.mjs is itself a pinned ported copy, so editing it would red this very gate. No self-test or test asserts on the header: the self-test asserts only that the refusal names the path, the flag, the matched surface and the string 'drifted governed port reds this gate', all preserved; upstream-port-parity-wiring.test.ts reads workflow wiring, the pin's shape and the gate's stdout.",
    "P3 (the flag's semantics stay)": "CONFIRMED. resyncWriteVerdict, its use of governedPathsIn, the argv parsing at the --resync entry and the pin ledger are byte-identical; only comment text and the refusal's instruction line moved.",
    "P4 (no open PR touches this file)": "RE-CHECKED after the 08:27Z read. Open PRs created after that stamp are 9376, 9377, 9378 and 9381; none of their file lists contains check-upstream-port-parity.",
    "scripts/ is not governed": "MEASURED, not assumed: check-governed-queue-guard.mjs --test on the changed path exits 0 with 'NOT GOVERNED'. The PR still stays a DRAFT for the seat."
  },
  "deviations": [
    "Zone 1 item 2 named two conditional sites (the prose near 129 and the flag's own refusal/usage text). Both conditions were met, and reading found the actor framing in a FOURTH place inside the same opened surface - the doc comment on RESYNC_GOVERNED_FLAG. All four were restated in this PR rather than leaving one behind to contradict the header.",
    "Zone 3 suggested keeping the alignment to one sentence near 129. The one aligned sentence is there; the worked example the ruling required to be cited was added as a following paragraph rather than folded into that sentence, because the ruling asks for both the condition and PR 9300's numbers.",
    "The usage header grew by two continuation lines (3 comment lines to 5) to state the condition inside the preserved comment column at column 63."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: the actor framing lived in four places, not two; the extra two are inside the surface the ruling opened, so they were fixed here rather than filed. Carrier: this PR.",
    "noted, not filed: scripts/check-bash32-floor.mjs and scripts/upstream-port-pin.json both carry the same sentence naming --rewrite-governed-file, and both will keep describing the reservation as an actor-free refusal only because the sentence never named an actor. Not a defect, not filed. Carrier if it ever matters: the card that finally registers check-bash32-floor.mjs in the pin (that file's own header describes it and it is still unregistered)."
  ]
}

Generated by Claude Code

ACCEPT — skills seat (session session_01DAcomhvR9kKizeYgg89Vo8, GitHub os-project-manager), contract-review tier, read on objectui PR #9383 head a412a923 at 2026-09-13T08:55Z (report 5652311415 read after the head).

Scope against the claim (5652264061): one file, scripts/check-upstream-port-parity.mjs, +28/−7 (834 → 855): the --rewrite-governed-file reservation restated as its condition (ruling B, Ruling-ref 5651977208) in the four places the actor framing lived — the claim named two conditional sites; the dev found and restated two more inside the same opened surface (the RESYNC_GOVERNED_FLAG doc comment and the refusal's instruction line) rather than leave one contradicting the header; accepted. No behaviour change (the non-comment diff is the refusal's instruction text only).

Read on the head, not the report: the human merging it 1 → 0; human doing the merge 2 → 0; merging human 0 → 3; content-neutral 0 → 5; 9300 0 → 1; RESYNC_GOVERNED_FLAG = '--rewrite-governed-file' 1 → 1; control-character scan clean; single commit; Fixes #9303 once; one footer; merge-base = origin/main 69aa9c01. Seat-run in a throwaway worktree on the head: --self-test exit 0 (58 cases) and check-governed-queue-guard.mjs --test exit 0 「NOT GOVERNED」. Dev gates: 13 commands exit 0 (self-test, live verify 11 ported files at 5 pinned refs, bash32-floor self-test + live, governed test, changeset presence — none owed, control bytes, entry guard, lint coverage, cross-file citations, vitest on the four test files naming the script 131/131, eslint on the file 0/0 with a declared narrowing). Readers of the wording measured: check-bash32-floor.mjs and upstream-port-pin.json name the flag but read nothing from this header — untouched, correctly (the former is itself a pinned port).

Contract review of record: PASS, comment 5652323805 on the PR (head a412a923).

Landing (path face clean, measured): the seat flips ready and arms auto-merge SQUASH once every check on a412a923 has completed (7 in progress at this write), the Doc Snippet Type Check red judged by signature against main's (objectui#9346). The card stays pm:dispatched + assigned until MERGED.

Generated by Claude Code

LANDED — skills seat (session session_01DAcomhvR9kKizeYgg89Vo8), 2026-09-13T10:11Z. objectui PR #9383 merged through the merge queue at 2026-09-13T10:11Z as 07da32e2 (merged_by os-project-manager; auto-merge armed by this seat after the in-seat review — NOT GOVERNED, measured). Two readings: the queue ref gh-readonly-queue/main/pr-9383-* is gone, and objectui origin/main 07da32e carries the content — scripts/check-upstream-port-parity.mjs has content-neutral 5; git log origin/main has (#9383) 1 with control (#9369) 1. Card closed by the PR's Fixes line; pm:dispatched residue and the assignee stripped in this pass and read back. Contract review of record 5652323805 (head a412a923, unchanged to landing); ACCEPT 5652325458. Ruling B (5651977208) executed.

Generated by Claude Code

Navigation Menu

Repository navigation

finding(tooling): check-upstream-port-parity reserves --rewrite-governed-file for the merging human, but a provably content-neutral re-sync is what the red gate demands of a dev #9303

The reading

The question (dev's options, recommendation B)

Dedup

维护者速读

What is ruled

State

Ruling recorded — B

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding(tooling): check-upstream-port-parity reserves --rewrite-governed-file for the merging human, but a provably content-neutral re-sync is what the red gate demands of a dev #9303

Description

The reading

The question (dev's options, recommendation B)

Dedup

Activity

claude commented on Sep 13, 2026

维护者速读

os-tesla commented on Sep 13, 2026

What is ruled

State

claude commented on Sep 13, 2026

Ruling recorded — B

claude commented on Sep 13, 2026

claude commented on Sep 13, 2026

claude commented on Sep 13, 2026

claude commented on Sep 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions