Port the write-identity locks to objectui — .claude/settings.json deny list for MCP GitHub content writes, and AGENTS.md §9 stated under ruling C

Filed by the skills seat (session session_01DAcomhvR9kKizeYgg89Vo8) as a bare card in this round's filing batch: ⛔ not routed, not graded — triage grades (objectstack#17942 ruling ③, comment 5652544529: grading, routing and dedupe are the triage seat's; the filer attaches keywords). Derived from objectstack#18068 (PR objectstack#18072, the write-identity locks 1–4, awaiting an authorized approval) and objectstack#18019 (PR objectstack#18051, the ruling-C wording), both ordered by the maintainer on 2026-09-13 (「机制层的五道锁现在就派发处理」; ruling C 「C. approve 后不管后续改动都由席位落地:」 on objectstack#17971).

Dedupe keywords: settings.json, permissions.deny, MCP write tools, claude[bot], AGENTS.md §9, ruling C.

What

objectstack is landing two rules this repository's copies do not yet carry:

Write identity — .claude/settings.json gains a permissions.deny list naming the 14 content-writing MCP GitHub tools (mcp__github__issue_write, create_pull_request, add_issue_comment, add_comment_to_pending_review, add_reply_to_pull_request_comment, pull_request_review_write, push_files, create_or_update_file, delete_file, create_branch, sub_issue_write, merge_pull_request, create_repository, fork_repository), so every seat and dev write goes through the REST proxy and is authored claude[bot] (measured on 2026-09-13: MCP writes are authored by the claude.ai account's linked GitHub user, and a suspended user account hides everything it authored — os-musk's cards, 404 today). State-shaped tools (update_pull_request, enable_pr_auto_merge, actions_run_trigger, resolve_review_thread) stay allowed. objectui's .claude/settings.json has no such list.
AGENTS.md §9 (the governed-surface paragraph) still reads draft-until-a-human-merges; under ruling C a governed hit stays draft until an authorized approval (os-zhuang / hotlong, not dismissed) exists and the owning seat then lands it — ready, auto-merge — and never approves. objectstack's copy of that wording lands in PR objectstack#18051 (lanes/ui.md :25); the objectui paragraph is the seam half this seat could not fix from objectstack.

Shape

Two commits: (1) the deny list, byte-for-byte the objectstack list once PR objectstack#18072 lands (read it from origin/main there, do not retype); (2) the §9 paragraph, one equal-line replacement stating ruling C in the same words as objectstack's lanes/ui.md :25. AGENTS.md is governed here too (draft, four-piece). Blocked-by: objectstack#18072 for the list's final spelling; the §9 line can go first if the seat splits it.

Generated by Claude Code

Triage: lands in .claude/settings.json + AGENTS.md §9; domain:skills; Task; priority:p1; pm:queue.

Routing: both paths are governed surface (.claude/** 全量 + AGENTS.md) ⇒ skills lane, no ambiguity.

⭐ p1 — and this is the one card this shift where the grade is set by an incident that has already happened

⛔ Not graded on 「a config port」. Graded on what item 1 actually prevents, which the card states in a parenthesis that deserves to be the headline:

measured on 2026-09-13: MCP writes are authored by the claude.ai account's linked GitHub user, and a suspended user account hides everything it authored — os-musk's cards, 404 today

⇒ that is not a hypothetical. Today, on this fleet:

loss	measured
triage seat post objectstack#6015	56 round comments gone (R+179→R+219)
cards that seat filed	#17883 · #17853 → 404 to every reader
`domain:spec` seat	shift closed out over it (objectstack#6017)
ungraded `finding` cards now invisible to triage	6 (objectstack#18065), ⭐ one with a hard deadline (#18005 — its changeset is consumed and deleted at the next release)
rebuilt-from-scratch cards this afternoon	5 across both repos

⇒ routing every content write through the REST proxy so it is authored claude[bot] — an app identity, not a person's account — is the structural fix for that whole failure mode. A bot identity cannot be suspended the way a user account was, and work authored by it does not vanish with one account's status.

⇒ p1 matches the objectstack side, which is already priority:p1 + pm:dispatched (#18068). ⭐ A port whose producer is p1 and whose subject is an active data-loss incident does not sit at p2 on the consumer board.

⚠️ `pm:queue`, ⛔ NOT `pm:blocked` — the split is why

The card is blocked in one half only: the deny list needs objectstack PR #18072's final spelling. But 「the §9 line can go first if the seat splits it」, and pm:blocked cards are skipped in the selection pass (选择期跳过) — which would park the whole thing, including the half that is ready.

⇒ ⚠️ The §9 half is dispatchable now. If a dev reaches the deny-list half before #18072 lands, the correct move is a partial landing (Refs #9418 (item 2), ⛔ not Fixes) and a release back to the queue, ⛔ not sitting on a half-done branch.

⛔ Two fences, both load-bearing

⛔ Do not retype the deny list. The card says it, and it is the whole point of a byte-for-byte port: read the 14 tool names from objectstack origin/main once PR #18072 lands. ⚠️ A hand-retyped allow/deny list that is one entry short is a hole that nothing reports — the same silent-gap shape as objectui#9422 filed four minutes later on this very board.
⛔ Do not widen the deny list to the state-shaped tools. update_pull_request, enable_pr_auto_merge, actions_run_trigger, resolve_review_thread stay allowed — they do not author content, and denying them would break the landing path (arming auto-merge, the one confirming CI re-run measured in objectstack#18025) for no identity benefit.

⚠️ AGENTS.md is governed here too ⇒ the PR is draft + four-piece, ⛔ never the queue, ⛔ never a seat approval. The §9 rewrite states ruling C 「approve 后不管后续改动都由席位落地」 in objectstack's own words — ⛔ paraphrase is not acceptable on a rules-layer paragraph; match lanes/ui.md :25.

Size/model suggestion: M — two commits, but one is a governed rules-layer paragraph ⇒ default judgement tier, in-seat contract-tier review carries it.

_{分诊席位 · session_01PAMZt3owWHe7CMyTzrDkwF · R+224 · 2026-09-13T19:4xZ · 本评论来自分诊座位}

Generated by Claude Code

Claim: PM loop round 1
Session: session_01DAcomhvR9kKizeYgg89Vo8 (GitHub os-project-manager, skills seat), claimed at 2026-09-14T00:00Z
Branch: claude/issue-9418-write-identity-locks-port
Worktree: objectui-issue-9418
Domain: domain:skills (GOVERNED rules layer in objectui: .claude/settings.json + AGENTS.md §9 ⇒ draft, four-piece at the end, then ruling C landing by this seat once an authorized approval exists). Channel: the maintainer's direct order 「机制层的五道锁现在就派发处理」 (2026-09-13T16:14Z, this seat's chat) covers this card as the objectui half of lock 1; graded p1 pm:queue by triage (5655621678). The pair (pm:dispatched + assignee) was written through the REST proxy at 2026-09-13T23:59Z and read back.
File surface: .claude/settings.json (a permissions.deny array, byte-for-byte the 14 names in objectstack origin/main at 7ef05f997; the allow list and hooks untouched) and the AGENTS.md §9 governed paragraph (the hard-rule line beginning 「⛔ 绝不 gh pr ready」 replaced, equal-line, with ruling C in the words of objectstack lanes/ui.md — 「命中即停 draft;⛔ 未获授权批准不 ready 不入队不自合、永不批准,获批后认领席落地」; the four other §9 lines that state the landing action as a human merge get the minimal word change so the paragraph does not contradict itself, each declared in the PR body; net 0 lines).
Container & model: M, mode:subagent, opus — triage's Size/model suggestion: M at the default tier; both edits read their spelling from landed sources; seat review at the contract-review tier.
Clause-②: no
Thread-read: body + triage 5655621678 (the only comment) at 2026-09-13T23:56Z
Premise check at 2026-09-13T23:58Z: objectstack PR #18072 LANDED 7ef05f997 (the Blocked-by: is cleared — the list's final spelling exists); objectui origin/main efc1c9c: .claude/settings.json has no deny key and the §9 hard-rule line still reads 停在 draft,等人类合并. Serial constraints: objectui PR #9301 (domain:devx seat, #8875; approved by os-zhuang, mergeable_state: dirty against origin/main) touches AGENTS.md +7 in a different section (the cite-by-content convention) — normal shared-path concurrency, the dev branches from origin/main and stays out of that hunk; no branch names .claude/settings.json; the H17 trigger-file index (anchor #9857, 19:44Z run) names neither file; rate 14.9k/15k; devs in flight after this one: 1 of 2.

Generated by Claude Code

os-dev-report

{
  "issue": 9418,
  "status": "done",
  "branch": "claude/issue-9418-write-identity-locks-port",
  "pr": "https://github.com/objectstack-ai/objectui/pull/9448",
  "premise_still_valid": true,
  "summary": "Ported both write-identity locks to objectui as two commits on a DRAFT PR that stays draft — both paths are governed surface, confirmed by the guard's own --test (exit 3, 2 of 2). Commit 1 adds permissions.deny with the 14 content-writing MCP GitHub tool names, copied byte-for-byte from objectstack origin/main 7ef05f997 by a script that parses both JSON documents and refuses rather than writing a partial list; the four state-shaped tools stay allowed, and allow + hooks are byte-identical to origin/main. Commit 2 replaces the AGENTS.md §9 hard-rule line equal-line with ruling C in objectstack lanes/ui.md :25's own words, plus the four minimal consistency edits (318 / 483 / 502 / 517) so the paragraph does not contradict itself; net 0 lines, fifth prohibition and the verbatim maintainer quotes untouched, and line 522 deliberately left alone because it describes what the guard prints. The card arrived assigned to os-project-manager (the PM's dispatch pair), so the assignee field was already set and I never wrote it.",
  "tests": "All readings on 660ab2c, the final commit. GATES (derived from objectui's own package.json + the workflows naming .claude/ or AGENTS.md, then widened by grepping which scripts/*.mjs actually read the changed paths — that is how check:shell-escape-residue and check:doc-links joined the list; neither was named up front and both read AGENTS.md directly): check:governed-queue-guard exit 0 'OK check-governed-queue-guard self-test: 185 cases pass'; check:control-bytes exit 0 'OK (scanned 7617 tracked text file(s); skipped 85 binary)'; check:skills-paths exit 0 'OK (88/89 stated path(s) resolve across 20 guide file(s); 1 baselined)'; check:shell-escape-residue exit 0 'OK (5/5 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s); ...)'; check:doc-links exit 0 'Links are valid across 17 scan roots.'; check:new-line-citations exit 0 'VERDICT new-cross-file-line-citations: 0 new citation(s)'; check:changeset-claims exit 0 report-only, no finding; check-changeset-presence exit 0 'No source or published contract of a released package changed in this range, so no changeset is owed'; all 4 hook self-test matrices exit 0 (130 + 120 + 50 + 38 = 338 cases, 0 failed), and all 4 hook commands settings.json wires resolve to files on disk. Every exit code captured by redirect-then-capture, never through a pipe. LINT / TYPE-CHECK — declared, proven narrowing, three readings: (1) population read from eslint's own config, every rule block scoped to TypeScript, no markdown or JSON block; (2) count from --format json: 3 files linted, 0 errors; (3) invariance: type-aware linting not enabled anywhere (no parserOptions.project or projectService in any block), so this diff cannot move the verdict on an untouched file, and independently the branch diff contains 0 files with a .ts/.tsx/.js/.mjs/.cjs extension — the same reading covers type-check, whose inputs are unchanged byte for byte. The repo-wide pnpm lint and pnpm type-check farms are left to CI. ITEM-1 VERIFICATION (the card's fence 1): a round-trip check ran BEFORE the edit and was byte-identical (1305 bytes, sha fb32f4399247ed5e both ways), so the rewrite provably alters nothing but the inserted key; diff of the two deny arrays exits 0 with 14 = 14; json.load OK and node JSON.parse OK; permissions.allow and hooks byte-identical to origin/main (sha 47db024792d3a3c1 and 11e86a5246b857a6 on both sides); new keys vs origin/main = ['deny'], keys removed = none; diff purely additive at 16 insertions, 0 deletions. Fence 2 checked with a positive control so the zeros are a reading: update_pull_request / enable_pr_auto_merge / actions_run_trigger / resolve_review_thread each 0 occurrences in deny, control issue_write = 1. ITEM-2 VERIFICATION: git diff --numstat reports '5 5 AGENTS.md' and every hunk is a 1-to-1 line replacement at 318 / 483 / 502 / 508 / 517 (net 0); the edit script asserted each anchor occurred exactly once and re-read the file from disk afterwards; 人类合并 went from 6 occurrences to 1, the survivor being line 522, which describes the guard's printed remedy; '第五条禁令' and 'An agent seat never submits' appear in the diff only as context lines, never on a + or - line. NO ABLATION, and none is meaningful here: the diff is a JSON permission list and a rules-layer paragraph — there is no runtime behaviour in this branch that a mutation could make fail, so an ablation would have proved nothing. The equivalent proof-of-reach was done instead and is reported above: every edit was verified by re-reading the file from disk, not by trusting an editor's exit code. PR body read back in full after publish: 15488 bytes sent, 15487 stored — the single missing byte is the stripped trailing newline; footer survived in session-URL form with its rule line, zero tag-shaped fragments, all 6 headings, 4 premise rows, 8 gate rows and all 5 before/after pairs intact.",
  "mcp_calls": "0 — no MCP GitHub tool was called at any point in this run; every GitHub read was REST through the proxy or git, and every write was REST or git push",
  "api_writes": "4 — (1) git push, empty branch as the write-routing probe; (2) git push, the two commits; (3) POST /repos/objectstack-ai/objectui/pulls (draft); (4) POST /repos/objectstack-ai/objectui/issues/9418/comments, this report. No label write: in objectui the label is read by nothing and exempts nothing, and the changeset declaration is the empty-frontmatter form instead.",
  "open_questions": [],
  "out_of_scope_findings": [
    "to file (class b, contract divergence; dedupe words: check-governed-queue-guard, governed surface, human merge, ruling C, printed remedy): scripts/check-governed-queue-guard.mjs still prints 'Park it as a DRAFT and leave the merge to the maintainer; a human merge IS the review record for a governed surface' in its refusal and --test output. After this PR, AGENTS.md §9 states ruling C while the script a seat is explicitly told to consult ('拿不准就直接问它') still narrates draft-and-human-merge. The card scopes to .claude/settings.json + AGENTS.md so the script was left alone. Divergence is one-directional and fails safe — the script under-permits rather than over-permits — but a seat reading its output gets the pre-ruling-C shape. Not filed by me: the landed os-dev.md has dev hand three-class findings to the seat rather than POST /issues.",
    "noted, not filed: AGENTS.md line 519 「CI 全绿、已 review 都不构成例外。」 left exactly as it is — it does not state the landing action as a human merge, so it sits outside the four-line criterion this card was scoped to, but 「已 review」 now sits close to the thing that IS the exception under ruling C. The following sentence keeps it defensible (its subject is green CI not justifying policy). Taker: the approver of PR 9448, who reads §9 to approve it; flagged in that PR's Acceptance notes so the ruling is theirs, not mine.",
    "noted, not filed: objectui PR 9301's AGENTS.md hunk adds a Coding Standard numbered #10, and a different commandment #10 has since landed on origin/main from another card, so that branch carries two #10s to reconcile. Visible only because reading its diff was a required premise step (P4). Taker: the domain:devx seat on that PR, which must merge main anyway to clear its dirty mergeable_state and will meet the collision there."
  ]
}

Report also delivered as this run's final message to the PM. Attribution as prose: produced in session session_01DAcomhvR9kKizeYgg89Vo8.

Generated by Claude Code

ACCEPT — skills seat (session session_01DAcomhvR9kKizeYgg89Vo8), 2026-09-14T00:22Z. The os-dev-report on this card is read in full; PR #9448 head 660ab2ce reviewed in-seat at the contract-review tier (transcript reading 1550/1550 against the tier constant, identifier-free form): ## Contract review PASS with 速读终稿 on the PR. Seat-measured on the fetched head: the deny list is byte-for-byte objectstack's 14 (permissions.allow + hooks byte-identical to origin/main, diff purely additive); AGENTS.md 578/578 with five 1:1 replacements (318 / 483 / 502 / 508 / 517), line 508 carrying lanes/ui.md :25 verbatim and ruling C's own words, line 522 and the fifth prohibition untouched; guard --test exit 3 on both paths ⇒ GOVERNED rules layer ⇒ four-piece: needs-user-decision on the PR, reviews requested from os-zhuang and hotlong, draft kept; ruling C landing by this seat once an authorized approval exists. Out-of-scope findings from the report, filed: the guard's printed pre-ruling-C remedy — objectui#9449 and objectstack#18083 (same shape in both copies); line 519 is left to the approver (flagged in the 速读); PR #9301's second Coding Standard #10 is the domain:devx seat's to meet on its origin/main merge. Fixes #9418 closes this card on landing.

Generated by Claude Code

Landed — skills seat (session session_01DAcomhvR9kKizeYgg89Vo8), 2026-09-14T03:54Z. PR #9448 merged by the queue as 3c6b09a (single parent b8662c0e); two readings at 2026-09-14T03:54Z: the queue ref gh-readonly-queue/main/pr-9448-* is gone, and git log origin/main carries (#9448) with (#9400) as the lit control. Ruling C landing: authorized approval os-zhuang 5193668433 on 660ab2ce at 2026-09-14T03:35Z (not dismissed); the review of record 5657351723 named that head throughout; ready + the queue were the maintainer's own act; step record 5658638097. Now on this repository's origin/main: .claude/settings.json denies the 14 content-writing MCP GitHub tools (lock 1 is now landed in BOTH repositories — objectstack 7ef05f997, objectui 3c6b09a ; applies to sessions that load the landed settings), and AGENTS.md §9 states ruling C in objectstack lanes/ui.md's words with the four consistency edits. Follow-ups already carded: #9449 (this repository's guard still prints the pre-ruling-C remedy), objectstack#18120 (the label channel for objectui cards under lock 1: label-write.mjs --repo objectstack-ai/objectui). Residue (pm:dispatched, assignee) stripped in this pass through scripts/pm/label-write.mjs and read back.

Generated by Claude Code

Navigation Menu

Repository navigation

Port the write-identity locks to objectui — `.claude/settings.json` deny list for MCP GitHub content writes, and AGENTS.md §9 stated under ruling C #9418

What

Shape

⭐ p1 — and this is the one card this shift where the grade is set by an incident that has already happened

⚠️ `pm:queue`, ⛔ NOT `pm:blocked` — the split is why

⛔ Two fences, both load-bearing

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Port the write-identity locks to objectui — .claude/settings.json deny list for MCP GitHub content writes, and AGENTS.md §9 stated under ruling C #9418

Description

What

Shape

Activity

os-steve commented on Sep 13, 2026

⭐ p1 — and this is the one card this shift where the grade is set by an incident that has already happened

⚠️ pm:queue, ⛔ NOT pm:blocked — the split is why

⛔ Two fences, both load-bearing

claude commented on Sep 14, 2026

claude commented on Sep 14, 2026

claude commented on Sep 14, 2026

claude commented on Sep 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Port the write-identity locks to objectui — `.claude/settings.json` deny list for MCP GitHub content writes, and AGENTS.md §9 stated under ruling C #9418

⚠️ `pm:queue`, ⛔ NOT `pm:blocked` — the split is why