[objectstack-fleet]

Requested by Warren · project thread
Fixes #26066
Clause-②: no
Metadata-protocol: none

What changed

The governed queue guard's merge_group leg now passes a governed pull request when EITHER an account in GOVERNED_APPROVERS holds a latest-decisive APPROVED review (the 2026-09-04 predicate, unchanged and read first) OR that account put the entry in the queue. The maintainer's own "Merge when ready" from os-zhuang or hotlong is the human review; no separate Approve is owed. The approver set is unchanged and is still the single constant.

• scripts/pm/check-governed-queue-guard.mjs
  • enqueuerFromTimeline / authorizedEnqueueVerdict / undeterminedEnqueue (pure) and makeTimelineReader (paged GET /issues/N/timeline, throws on truncation because the newest event is on the last page).
  • runGuard reads the enqueuer SECOND, only for an entry the approval did not satisfy (monotone, free for approved entries), before any Tier S record read. entrySatisfied gains the enqueue limb between the approval and the record; satisfiedBy names the leg.
  • Log line (card §3): ✅ enqueued by an authorized account: LOGIN (added_to_merge_queue at T), a third CLEARED wording ("The ENQUEUE leg satisfied N of them: #N (enqueued by LOGIN)") so the clear never claims an approval it did not read, and on refusal ⛔ enqueued by LOGIN, outside GOVERNED_APPROVERS or ⛔ enqueuer UNDETERMINED — reason.
  • Size limb (card §4): runSizeGuard hands the enqueue reading beside the approval verdict to the sibling's lift; a governed and oversized PR costs one timeline read, not two. Remedies on both legs name the enqueue landing; the bypass-rules option stays named.
  • Header: a dated section for the 2026-10-26 ruling (verbatim quotes), the measured reading, why this is not the actor-field attribution [finding] The governed-surface enqueue guard gap is still unmeasured two instances on — and the incident card that recorded it was closed completed 4 minutes after filing with both items unanswered #11704 retracted, the accepted cost, and the exit-table rows for 0 / 3 / 8.
• scripts/pm/check-governed-merges.mjs (claim amendment, those two functions and their pins only): sizeLiftFrom reads an authorized enqueue as a second lift after the approval lift; renderLiftApprovals renders it; new SIZE_ENQUEUE_LIFT_RULING.
• AGENTS.md, inside its line ratchet (1,117 lines before and after, no line over 120 bytes): Prime Directive 14 says Tier H lands "by the maintainer's hand (merge or enqueue) or an authorized approval"; one sentence adds "An authorized account's enqueue is a review record too: ⛔ never a seat's."; and Multi-agent §7 (c) says the size line lands by "the maintainer's merge or enqueue". The details (for that queue entry only, undetermined never passes) are in the guard header, which is where the rule's detail lives.

The enqueuer reading, measured (card §2)

Measured on 2026-10-26 against the live REST API of this repository:

• Newest added_to_merge_queue timeline event's actor.login answers both paths. feat(spec)!: refuse an SLA escalateTo that no approver acts under, at registration #26154 and feat(spec,console): a type: 'flow' action may declare onSuccess, and the console navigates after a run that completes #26011: armed through auto-merge, and the add event's actor is the account that armed it. fix(app-shell): draw the app no-access screen with the shared DataEmptyState #26166: direct enqueue, add event present, and no auto_merge_enabled event at all.
• auto_merge.enabled_by.login is null on a direct enqueue (fix(app-shell): draw the app no-access screen with the shared DataEmptyState #26166 never had one) and on every merged PR read, so it answers only the armed path. Not used.
• GET /issues/N/timeline answers X-Accepted-GitHub-Permissions: issues=read; pull_requests=read. The workflow's existing pull-requests: read covers it, so .github/workflows/governed-surface-guard.yml is untouched.
• Not measured: a merge_group run's own token reading the timeline, and an enqueue armed from an authorized account reaching the queue (feat(spec,cli)!: retire the ≤16.x retirement kits; the strict unknown-key refusal names the protocol upgrade guide #26138 was armed by os-zhuang and not yet queued at read time). The first live queue build after this lands prints the reading either way, and an unreadable one is UNDETERMINED, which is today's behaviour.

UNDETERMINED is never a pass: no add event, an actorless add, an unreadable or truncated timeline, and a newest queue event that is a removal (the current entry is not on the timeline yet, so the earlier add belongs to an entry that left) all leave the approval leg to decide alone, on its own exit code (3, not 4).

Tests

At head 9e0ae37b (the last commit touched only AGENTS.md; both self-tests re-run there):

• node scripts/pm/check-governed-queue-guard.mjs --self-test: 373 cases pass (was 345). New battery "the 2026-10-26 ENQUEUE leg" with 28 cases, floor 27 to 28. It covers the card's four fixtures (authorized enqueue with no review passes and names the leg; seat enqueue with no review is refused on 3 with today's words; seat enqueue with an authorized approval passes on the review leg and never reads the timeline; unreadable enqueuer with no review is refused on 3 naming UNDETERMINED). It also covers a stale add before a removal, no reader, an unreadable review list beside an authorized or a seat enqueue (0 and 4), the PR leg reading nothing, a Tier S entry clearing without a record read, the size lift and its refusal, main()'s wiring at one timeline read, and the reader's paging, truncation and non-2xx paths.
• node scripts/pm/check-governed-merges.mjs --self-test: 537 assertions pass, including 3 new enqueue-lift pins.
• Ablation 1, enqueue limb of entrySatisfied mutated (scripts/ablation-replace.mjs, blob ecad10abe0f0 to e05e95b1cbb5): 5 of 373 cases red (fixture 1, its words, the unreadable-review case, the Tier S case, the governed-and-oversized case). Restored, blob equals HEAD, git diff HEAD empty.
• Ablation 2, the removal-newest guard in enqueuerFromTimeline mutated: the stale-add case red (1 of 373). Restored, blob equals HEAD. The first attempt hit an anchor miss (wrong indentation), wrote nothing, and was re-run on the right anchor.

Gates

Derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; 3 changed paths vs merge base fbb75998b): 42 families.

• At head 9e0ae37b: 41 of 42 run locally, all exit 0 (exit captured before any pipe), including node scripts/pm/check-governed-queue-guard.mjs --self-test, pnpm check:pm-governed-prose, pnpm check:pm-governed-merges, pnpm check:pm-skill-ratchet, pnpm check:pm-skill-id-lint, pnpm check:required-contexts, pnpm check:nul-bytes. --ran reconciliation: 42 derived, 41 run, 0 NOT-MEASURED, 1 UNRUN.
• The UNRUN one is pnpm check:pm-dispatch-gates. It ran at 8258383f (the head before the AGENTS.md-only rewrap commit) and exited 0: fast tier, 1917 cases, 618 s. It was not re-run on 9e0ae37b; CI runs it.
• The first run at 8258383f had one red, pnpm check:pm-skill-ratchet: AGENTS.md was over its 1,117-line ceiling (1,121) and had two lines over 120 bytes. The sentences were rewritten to fit the existing lines (no ceiling raised, no unrelated re-wrap). It is green at 9e0ae37b.
• ESLint (pnpm exec eslint --no-inline-config) on the two changed scripts: exit 0. Repo-wide pnpm lint is left to CI.

Acceptance notes

• The dispatch order names pnpm check:governed-queue-guard-self-test. No such script exists in package.json; the guard's --self-test is in the derived list and was run directly. Repo-wide pnpm lint is CI's per .claude/agents/os-dev.md; ESLint ran locally on the two changed scripts (exit 0).
• An enqueue counts for that queue entry only: a seat's re-enqueue after an ejection is a new entry by a seat account and is refused without the approval or another authorized click. That is the card's "newest" reading; carrying the click across ejections the way ruling C carries an approval would be a separate maintainer decision.
• Tier H (AGENTS.md). This PR stays draft and lands by the maintainer's hand. Chicken-and-egg: until this change is in main, that hand is an APPROVED review or the bypass-rules merge, not the enqueue.

维护者速读(草稿)

改了什么:合并队列守卫多认一种"人工审核":PR 若是由授权账号(os-zhuang 或 hotlong)点"Merge when ready"送进队列的,队列守卫直接放行,不再要求先点 Approve。体积超 3000 行的 PR 同样适用。其他账号(包括车队机器人)入队仍然必须有授权 Approve。

为什么改:您在手机上原来要先点核准再点合并;按您的要求("大部分我还是希望入队，但是我想省掉 Approve"),以后直接点合并(入队)即可。

风险与代价(含回滚):守卫读的是 PR 时间线上最新一次"入队"事件的操作账号。① 授权账号若被智能体代操作,入队就等于放行,所以 AGENTS.md 同步写明:任何智能体席位都不得以任何账号在未获批的受管 PR 上入队或开自动合并。② 入队后到落地前再推的提交不会被重新审核,与"批准在任意提交上都算"的代价相同。③ 读不到入队者时不放行,仍按原规则判。回滚:还原本 PR 即可,无数据迁移。

席位意见:

你要做的:本 PR 改了 AGENTS.md,属 Tier H,需要您亲手落地:点 Approve 后由席位落地,或直接合并。新规则要等本 PR 进 main 后才生效,所以这一次还不能只靠入队。

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Reviewed at 2026-10-26T16:38Z — PR #26230 at head 9e0ae37b, card #26066, by the independent contract reviewer at the ceiling tier. Adversarial read of the net diff, the card body and its five comments (6415485094, 6419998540, 6420084843, 6420143505, 6421174633), the head's check-runs, the cited code on origin/main (df8aac41) and on the head, and the live timelines the body cites plus eight Tier H landings of my own choosing. Nothing was built, run or re-run.

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 9e0ae37b3fde6565599aca84d0352162ab505550
Local-runs: none
Scope: AGENTS.md + scripts/pm/check-governed-queue-guard.mjs (the enforcement file, its whole diff and header), scripts/pm/check-governed-merges.mjs (sizeLiftFrom, renderLiftApprovals, their pins, and lines 327-340, the 2026-08-18 regime header), .github/workflows/governed-surface-guard.yml (permissions), .github/CODEOWNERS (the mirror), .github/workflows/lint.yml (which job carries which gate), scripts/pm/check-skill-line-ratchet.mjs (the AGENTS.md ceiling row and MAX_LINE_BYTES), package.json (the scripts the order names), and the REST timelines of #26154 #26011 #26166 #26138 and of #26097 #26058 #25971 #26017 #25969 #25816 #25930 #25717

① Derived judgments

Check-runs on 9e0ae37b, read three times until none was open. At 2026-10-26T16:24Z: 48 runs, 7 in progress. At 2026-10-26T16:27Z: 50 runs, 1 in progress. At 2026-10-26T16:30:47Z: 51 runs, 34 success, 17 skipped, 0 in progress, 0 failure. The gate-carrying ones: Governed Surface Queue Guard success at 2026-10-26T16:21:15Z (its first step runs the head's own check-governed-queue-guard.mjs --self-test under bash -e, so a red predicate reds the check; its live step is the pull_request early-warning leg, exit 0 on this governed draft); Lint · scoped · tooling self-tests success at 2026-10-26T16:22:46Z (check-self-test-workflow-commands.mjs spawns every CI-run script that ships a --self-test, both governed scripts among them); Lint · repo & tooling gates success at 2026-10-26T16:24:55Z (lint.yml lines 1041, 1051, 1538, 1559: check:pm-skill-ratchet, check:pm-skill-id-lint, check:pm-governed-merges which IS the sibling's --self-test, check:pm-governed-prose); Lint · PM dispatch-gates success at 2026-10-26T16:26:05Z; Lint · ESLint success at 2026-10-26T16:23:45Z; Lint · docs & code guards success at 2026-10-26T16:25:00Z; Check Changeset success.

Every rule the diff adds, removes or narrows, judged against the order, the triage boundary and the guard's regime:

1. ADDS the enqueue limb to entrySatisfied: approval.state === 'approved' first, then enqueue.state === 'authorized', then the Tier S record — RIGHT. The order is 「大部分我还是希望入队，但是我想省掉 Approve」 with the logins 「os-zhuang 或 hotlong」; GOVERNED_APPROVERS is Object.freeze(['os-zhuang', 'hotlong']) on origin/main (line 621) and on the head (line 689), unchanged, and the limb reads it through GOVERNED_APPROVERS.includes, never a copy. Only the merge_group leg consults it: runGuard reads the timeline under event === EVENT_MERGE_GROUP alone, and guardVerdict attaches the enqueue key on that event alone. An enqueue by any other account is unauthorized and the entry still needs the review.
2. ADDS enqueuerFromTimeline, authorizedEnqueueVerdict, undeterminedEnqueue (pure) and makeTimelineReader (paged GET /repos/{slug}/issues/{n}/timeline) — RIGHT; traced under (a).
3. ADDS the same predicate to the SIZE limb through the sibling: sizeLiftFrom reads the approval lift first, then enqueue.state === 'authorized' with a non-empty login; unauthorized and undetermined lift nothing; renderLiftApprovals prints the enqueuer — RIGHT against card §4 and the claim amendment. check-governed-merges.mjs moved in exactly four hunks: the new SIZE_ENQUEUE_LIFT_RULING constant (the citation string sizeLiftFrom returns, beside SIZE_LIFT_RULING), sizeLiftFrom, renderLiftApprovals, and three self-test pins; the authorizedVerdict helper already took extra on origin/main (line 6393). Nothing else in the file moved.
4. NARROWS nothing. The pull_request leg, the 2026-09-04 approval predicate, the Tier S record leg, the fork rule, GOVERNED_APPROVERS, .github/CODEOWNERS and governed-surface-guard.yml are unchanged (git diff origin/main 9e0ae37b on the workflow and CODEOWNERS is empty).
5. CHANGES the rendering only where card §3 asks: the enqueue-leg line names the leg and the account, a third CLEARED wording never claims an approval it did not read, and a refusal names unauthorized or UNDETERMINED with the reason — RIGHT.
6. AGENTS.md: three edits, judged under (d).

(a) Fail-closed — the code on the head, not the body. runGuard reads the approval first and reaches the timeline only when approvals.get(pr)?.state !== 'approved'; an unreadable review list reaches it too, because an authorized enqueue is a record of its own, as an approval is. Fixture 3 pins that an authorized approval never reads the timeline (apiCalls === 2). UNDETERMINED never passes: entrySatisfied passes on the literal 'authorized' and nothing else; undeterminedEnqueue is the value for no reader, a throw (non-2xx, non-array body, truncation), no add event, an actorless add, and a newest queue event that is a removal; entryUnreadable is untouched and reads only approval.state === 'unreadable' and the Tier S record, so the exit code stays today's — 3 with no review (fixture 4), 4 with an unreadable review list beside a seat enqueue (pinned). Unauthorized never passes (fixture 2: exit 3 with today's words "NO authorized APPROVED review on this pull request" plus the new reason line). A verdict built with no enqueues entry for a non-approved queue entry is filled with undeterminedEnqueue, never a default pass. The loop has no continue that skips both readings: a fetchPull throw is a head note only, a fetchReviews throw lands in unreadableApproval, and the enqueue block runs after either.

Stale adds and ordering: enqueuerFromTimeline keeps the LAST add-or-remove event in array order; a removal newest is UNDETERMINED, so an earlier authorized add is never carried onto a re-entry whose add is not yet recorded; a re-queue after an ejection reads its own actor, so a seat's re-enqueue is unauthorized and needs the approval or another click. Measured on #26011: three add/remove cycles, every removal recorded with actor github-merge-queue[bot], every add attributed to the arming account and never to the queue bot, so the "enqueued by GitHub's own actor" shape does not occur on this repository — and if it ever did, the queue bot's login is outside the constant and refuses. A merge group carrying several PRs is judged per entry.pr, each with its own timeline read, so one authorized enqueue carries no sibling; the existing partial approval case pins that loop shape and there is no enqueue-specific mixed-group case (non-blocking gap).

Attribution of an auto-merge-armed entry, re-measured. The body's fleet cases hold: #26154 auto_merge_enabled actor objectstack-fleet[bot] at 2026-10-26T14:44:16Z, added_to_merge_queue actor objectstack-fleet[bot] at 2026-10-26T14:46:53Z. The case the body left unmeasured — a HUMAN arming — I measured on eight Tier H landings: armed then enqueued, auto_merge_enabled actor os-zhuang then added_to_merge_queue actor os-zhuang (#26017 at 2026-10-26T09:20:48Z then 2026-10-26T09:23:25Z; #25969; #25930); direct enqueue with no auto_merge_enabled event and add actor os-zhuang (#26097, #26058, #25971, #25816, #25717). merged_by read os-zhuang on all eight: on a queue landing merged_by IS the enqueuer, which is the column the post-merge audit lists. auto_merge is null on every merged PR read, so the body is right not to read enabled_by.

Paging: per_page=100, pages 1 to 10, returns on the first short page, throws past 1,000 events. The timeline is oldest-first on every read above (ascending created_at), so the newest event is on the last page and the walk reaches it; a cut walk throws and the caller turns it into UNDETERMINED. Pinned by the two-page walk, the truncation throw and the HTTP 403 throw. Token scope: the route answers X-Accepted-GitHub-Permissions: issues=read; pull_requests=read on four timelines I read; the workflow holds contents: read and pull-requests: read and is untouched. Unmeasured by anyone: the merge_group job's own GITHUB_TOKEN making that read; if refused, the leg prints enqueuer UNDETERMINED — the timeline could not be read (HTTP 403) and the approval leg decides, which is today's behaviour, loud, never a pass. Non-blocking: array order is trusted over created_at (the header says so); the API is chronological and the pure function is pinned on that order.

(b) Identity floor. PD14 already carries "before that record no AI seat merges, queues, or arms auto-merge" and "⛔ never queue, ⛔ never arm auto-merge"; the new sentence 「An authorized account's enqueue is a review record too: ⛔ never a seat's.」 sits directly after the approving-review prohibition ("under any account — an authorized account is agent-operated too") and inherits "under any account" by construction, so the floor is stated where the rule lives. The guard header states it in the approval side's own words and names the exposure honestly: the prohibition "is the ONLY thing between an agent seat holding an authorized account and a governed landing it cleared for itself". On #11704: the new section quotes the founding ruling (check-governed-merges.mjs line 330, verbatim 「人工合并即人工审核:governed PR 的审核记录 = 你按下合并/入队那个动作本身」) and rests the leg on the normative floor; the material difference — a push is authorship, open to every seat, while the enqueue click is a deliberate, timestamped act on the PR that PD14 reserves exactly as it reserves the approval — is said in substance. FLAG, prose only: the older bound at header lines 120-123 of the head ("attribution from the GitHub actor field is not a reading … never on who pushed or merged") survives unamended and now reads as contradicted by the new section; by the header's own convention the dated later layer governs, but that sentence should be marked superseded-in-part the way the 2026-09-04 section marks the sha-pin half. Same class as the stale "pinned to the current head" bullet the dev reported out of scope.

(c) Scope kept. PR leg: no timeline read, no enqueue key, output free of the line by construction (pinned). Tier S: unchanged except that the enqueue limb sits between approval and record, so a Tier S entry the maintainer enqueued clears without a record read — the symmetric case of an authorized approval, which already cleared it. GOVERNED_APPROVERS unchanged; CODEOWNERS and codeownersMirrorVerdict unchanged, self-test green twice. Size lift: the enqueue lift is read after the approval lift and nothing wider; an unreadable review list beside an authorized enqueue lifts exactly as the governed leg passes it, and a seat enqueue on an oversized PR still exits 8 (pinned). The sibling touched only as the amendment allows. No widening found.

(d) AGENTS.md. 1,117 lines on origin/main and on the head (measured); the six changed lines are 118, 118, 118, 118, 113 and 38 bytes under MAX_LINE_BYTES = 120; the widest row (a table row, structurally exempt) is 768 bytes on both; the ceiling row ['AGENTS.md', 1117] is unmoved. The three edits say the guard's rule: line 264 "Tier H by the maintainer's hand (merge or enqueue) or an authorized approval"; line 290 the new sentence; §7 (c) lines 519-520 "or the maintainer's merge or enqueue" for "or a human merge". Nothing the old sentences carried is lost: the register enumeration, the Tier S clause, the fork clause and the get_files / author / size reading all survive, and no date, number or quotation entered a rule line. The ratchet's job, Lint · repo & tooling gates, is green on the head; so is check:pm-governed-prose in the same job.

(e) Self-test and ablation. The battery ⭐ the 2026-10-26 ENQUEUE leg pins 28 and I count 28 assertions in the hunk; the roster floor moves 27 to 28 with its row. It pins what (a) requires — the four card fixtures, the stale add (pure, and through runGuard on exit 3), no reader, truncation, non-2xx — and beyond them: an unreadable review list beside an authorized enqueue (0) and a seat enqueue (4), the API-call count, the PR leg reading nothing, a clear diff reading nothing, Tier S clearing without a record read, approval-first, the oversized lift (0) and its refusal (8), one timeline read across both limbs, main()'s wiring read from its own source, and the paged walk. The sibling's three pins cover the authorized lift, no-lift on unauthorized / undetermined / empty login, and approval-first. Verdicts on the head: the guard's self-test green in Governed Surface Queue Guard and in the tooling self-tests lane; the sibling's green in Lint · repo & tooling gates. The body's 373 / 537 counts and the two ablations (5 and 1 red, restored, blob equal to HEAD) are the dev's report, consistent with the diff, not re-run here.

② Semver level

skip-changeset is right: the three paths are scripts/pm/** and AGENTS.md, and neither ships in a released package; Check Changeset success on the head. Clause-②: no and Metadata-protocol: none stand line-initial after Fixes #26066 (the relay's two attribution lines precede it) and are right: no spec, export or authorable key moves.

③ Boundary flags

• PR object, read: user.login = objectstack-fleet[bot] (type Bot, relay-written); draft = true; head 9e0ae37b on claude/project-thread-5nnncj, base main; 3 files, +489 / -54; labels documentation, size/l, skip-changeset; reviewers requested hotlong, os-zhuang; auto_merge null. Tier H: it stays draft and lands by the maintainer's hand.
• Body "Not measured" ①, the merge_group token reading the timeline: still unmeasured; fail-closed as traced in (a); the first queue build after this lands prints which way. Ask: a seat reads that first enqueue-leg log line and, if it says HTTP 403, files the one-line issues: read widening of the workflow as its own governed card — not pre-authorised here.
• Body "Not measured" ②, an entry armed from an authorized account reaching the queue: CLOSED by this review's reading of ci(shard-timings-refresh): push and open the refresh PR as the fleet App so it runs CI #26017, ci: run main's full battery every 4 hours and CodeQL daily (maintainer ruling Q6 = C) #25969 and docs(skills, spec): every published package declares one anchor-safe isDefault permission set #25930 (armed) and five direct ones — the add actor is the human.
• Open question A / B (pnpm lint, check:governed-queue-guard-self-test): A stands. package.json has no such script (verified; check:pm-governed-merges and check:pm-governed-prose exist, the guard's self-test is a derived family and ran in CI), and Lint · ESLint ran the repo-wide lint on the head. os-dev.md wins the conflict, as the order itself says.
• The first ratchet red at 8258383f (1,121 lines, two lines over 120 bytes): fixed in 9e0ae37b by rewriting inside the existing lines, no ceiling raised; measured above; green.
• UNRUN pnpm check:pm-dispatch-gates on the head: Lint · PM dispatch-gates success on the head.
• Dev's out-of-scope finding (the stale "pinned to the current head" header bullet): accepted; add to it the lines 120-123 sentence from (b). Carrier: the next PR on check-governed-queue-guard.mjs, or a patch round on this branch if the maintainer asks for one; neither blocks this landing.
• Accepted cost, for the maintainer's eye and already stated in the header and the 维护者速读 ②: a push after the click and before the entry lands is not re-reviewed, the 2026-09-04 shape. It is real on this repository: feat(spec,cli)!: retire the ≤16.x retirement kits; the strict unknown-key refusal names the protocol upgrade guide #26138 was armed from os-zhuang at 2026-10-26T14:14:54Z while red, and seat commits followed for two hours; under the new leg those would land under the click, as they already would under his approval.
• Landing this PR: today's guard refuses a bare enqueue of it (AGENTS.md hit, no approval), so it lands by Approve then enqueue (or the claiming seat), or by the bypass merge. Every Tier H landing measured today was approve-then-enqueue by os-zhuang, so no new motion is asked of him this once.
• Scope floor, as the tool reads it: record-recognisers.mjs --template --paths over the three files answers the rules face, CONTRACT_REVIEW_TIER, with hits = AGENTS.md alone; the brief named all three paths as hits. The two scripts are therefore listed as cited files, read whole, and the floor is met either way.
• Escalations: none required for the verdict.

Implemented-by: claude/project-thread-5nnncj
Reviewed-by: session_01LqKsGyMNFwwnbF5FTAqyPn

VERDICT: PASS

[objectstack-fleet]

席位核对 — ACCEPT · domain:skills#2 · session_01LqKsGyMNFwwnbF5FTAqyPn · 2026-10-26T16:40Z

Seat review of record for #26066 on head 9e0ae37b, against GitHub, not the report's own account. Governed PR (AGENTS.md hit ⇒ Tier H for the whole PR; scripts/pm/check-governed-queue-guard.mjs is the governed-surface enforcement file this lane owns). The record of substance is the independent ## Contract review at comment 6421581636 (Served-tier: CONTRACT_REVIEW_TIER, head 9e0ae37b, VERDICT: PASS, drafted by a reviewer other than the implementer, with its own live re-measurement of the enqueuer reading on eight Tier H landings). This seat adds the landing read, not a second contract read; implemented in card thread session session_01XDSBMAmqzG7QYwCD7qAGty on claude/project-thread-5nnncj.

1. Shape. Draft, base main, mergeable: true; body line 1 after the attribution block Fixes #26066, no closing keyword beside any other card number; Clause-②: no, Metadata-protocol: none. Files (GET …/pulls/26230/files): scripts/pm/check-governed-queue-guard.mjs (+438/−41), scripts/pm/check-governed-merges.mjs (+45/−7, the two functions and their pins the claim amendment names), AGENTS.md (+6/−6), all inside the claimed surface. check-governed-merges.mjs --pr 26230: GOVERNED, Tier H, 543 changed lines, under 3000. Labels documentation, size/l, skip-changeset — correct, nothing published ships from these paths.
2. Record, measured. The reviewer traced the new enqueue limb on the head: read only after the approval leg did not satisfy; passes only on the literal authorized from GOVERNED_APPROVERS.includes (the constant unchanged); UNDETERMINED (no add event, actorless add, unreadable or truncated timeline, non-2xx, newest queue event a removal) never passes and keeps today's exit codes; an unauthorized enqueuer is refused with today's words; a re-queue after ejection reads its own actor; a merge group with several PRs is judged per entry. The PR leg is untouched; CODEOWNERS mirror untouched; the size lift reads the enqueue after the approval and nothing wider. The seat re-read the three AGENTS.md hunks against the ruling: 「by the maintainer's hand (merge or enqueue) or an authorized approval」, 「An authorized account's enqueue is a review record too: ⛔ never a seat's.」, §7 (c) 「the maintainer's merge or enqueue」 — the rule the guard enforces, inside the 1,117-line ratchet, every changed line ≤ 120 bytes.
3. Gates, pinned to head 9e0ae37b. 51 check-runs, 34 success and 17 skipped, none red or pending — among them Governed Surface Queue Guard (runs the head's own --self-test), Lint · scoped · tooling self-tests, Lint · repo & tooling gates (ratchet, id-lint, check:pm-governed-merges, check:pm-governed-prose), Lint · PM dispatch-gates, Lint · ESLint, Lint · docs & code guards, Lint & Repo Gates, TypeScript Type Check, Test Core, Check Changeset.
4. 维护者速读. 这张 PR 让队列守卫把「授权账号(os-zhuang / hotlong)按下 Merge when ready」当作人工审核:受管 PR 在 merge group 里,要么有授权账号的 APPROVED review(今天的规则,不变,先读),要么入队动作本身来自授权账号;两者都没有照旧拒收。授权集不扩,读不出入队者(时间线不可读、被踢后未重入、add 事件无 actor)一律按今天的拒收走;席位入队无批准的受管 PR 仍拒。超 3000 行的 size 门同样认授权入队。AGENTS.md 三句同步。接受的代价(复审者点名、头注写明):点击之后、落地之前的再推送不再复审——与今天批准后再推送同形;今天 feat(spec,cli)!: retire the ≤16.x retirement kits; the strict unknown-key refusal names the protocol upgrade guide #26138 就出现过这种形状。
5. Accepted deviations and follow-ups. (a) The merge_group job's own token reading the timeline is unmeasured by anyone; fail-closed (HTTP 403 ⇒ UNDETERMINED, loud, the approval leg decides). The seat reads the first live queue build's enqueue-leg log line after landing and, if it reads 403, files the one-line issues: read widening of governed-surface-guard.yml as a governed card. (b) Prose only, non-blocking: the guard header's older sentence (lines ~120–123, "never on who pushed or merged") and the stale "pinned to the current head" bullet now read as superseded-in-part by the dated 2026-10-26 section; carrier = the next PR on the guard, or a patch round on this branch if the maintainer asks. (c) Open question on pnpm lint / check:governed-queue-guard-self-test: no such script; os-dev.md wins, the guard's --self-test and repo ESLint ran, both green in CI. (d) First head's AGENTS.md ratchet red fixed by rewording inside existing lines, no ceiling raised.
6. Landing — Tier H, the maintainer's hand. The PR stays draft; ⛔ the seat neither readies, enqueues nor arms it. Note for the maintainer: until this PR lands, today's guard refuses a bare enqueue of it (AGENTS.md hit, no approval), so it lands by Approve then enqueue, or by the bypass-rules direct merge. On MERGED the seat strips pm:dispatched on the card, posts the landing record, and reads the first live queue build's enqueue-leg line per 5(a).

---

Generated by Claude Code