[objectstack-fleet]

Requested by Tesla · project thread

Fixes #30857

Clause-②: no
Metadata-protocol: none

Refs #30120 · PR #30720 (the Skills-docs: follow-up it named as owed).

维护者速读

• 改了什么:平台技能的运维参考页。部署目标表的 Docker / Kubernetes 行写明官方镜像必须在运行时给出 OS_DATABASE_URL、OS_AUTH_SECRET、OS_SECRET_KEY 三项,否则拒绝启动,显式指向挂载卷的 file: 地址可以过;「Common ops pitfalls」新增一行:镜像启动即退出并点名这三项时怎么办,升级时沿用旧容器 /home/node/.objectstack 下已生成的值(auth-secret、dev-crypto-key、data/objectstack.db),不要换新。另加评测用例 16 和 changeset。
• 为什么改:PR fix(cli, service-settings, console): the official image refuses to start without its database and secrets; administrators see what a production server keeps on its own disk #30720 之后镜像的行为变了,技能还按旧文写,AI 照抄会写出镜像拒启的 docker run;更糟的是升级时换上新密钥,所有已保存的凭据都读不出来、所有人被登出。
• 风险与回滚:只改技能文字与一个评测用例,不动 SKILL.md;token 额度靠删同文件里在别处有家的重复文字支付(3116 → 3108,上限 3119 → 3108 下调,不抬);回滚即撤这个 PR。
• 先看:skills/objectstack-platform/references/operations.md 的 Docker / Kubernetes 行与「Common ops pitfalls」最后一行;其次被删的 Testing pattern 代码块(改为指向 plugin-development.md 的两节)。
• 两分钟验证:node scripts/check-skills-token-ratchet.mjs | grep operations.md 应打印 3108 / 3108;对照 docker/README.md「What the image presets」与 packages/cli/src/commands/start.ts 的 formatDurabilityRefusal,三个变量名与三个文件名应一致。
• 需要你做的:批准这个 Tier H PR(skills/** 需受管审批人 os-zhuang 或 hotlong 批准),之后席位落地。

What changes

skills/objectstack-platform/references/operations.md (212 → 181 lines, 3116 → 3108 tokens, ceiling 3119 → 3108):

• Deployment targets, Docker / Kubernetes row: the official image (ghcr.io/objectstack-ai/objectstack) refuses to start unless OS_DATABASE_URL, OS_AUTH_SECRET and OS_SECRET_KEY are set at runtime, never baked in; an explicit OS_DATABASE_URL=file:/path/on/a/mounted/volume/app.db passes, so SQLite on a volume still works.
• Common ops pitfalls, new last row: symptom "the official image exits at start naming the three"; cause: the image presets OS_DEPLOYMENT_DURABILITY_CHECK_ENABLED=true, under which os start exits 1 before it writes a database file or a secret when any of the three is unset; fix: set them on the run command, and on an upgrade keep the generated values from the old container's /home/node/.objectstack (docker exec CONTAINER cat FILE, or its volume): OS_AUTH_SECRET is the contents of auth-secret, OS_SECRET_KEY the contents of dev-crypto-key, the data is data/objectstack.db (OS_DATABASE_URL=file:… on the kept volume, or migrate it); fresh values leave every saved credential unreadable and sign everyone out.

Every sentence is read off main: docker/README.md ("What the image presets"), content/docs/deployment/self-hosting.mdx ("When the three are not set"), and the check itself in packages/cli/src/commands/start.ts (readDurabilityCheckSignal, missingDurableVariables — an explicit file: URL counts as chosen, isDefaultedDatabase; formatDurabilityRefusal prints the three file paths and exits 1 before readOrCreateAuthSecret runs).

Paid inside the file (the headroom was 3 tokens). Each deletion, and where the content lives:

1. The intro sentence ("Every project gets the same os command surface — npm install does not need to be re-run when commands are added"): no rule and no author action; the command tables under it are the content.
2. "In a scaffolded project these are npm run validate / npm run build" in Verify your work: the Verify section of every domain skill carries the scaffolded spelling (objectstack-ai, -api, -automation, -data, -formula, -query, -ui SKILL.md).
3. The cloud-connection blockquote's plugin roster (CloudConnectionPlugin/createCloudConnectionPlugin, MarketplaceProxyPlugin, RuntimeConfigPlugin, "ship the Installed Apps page and marketplace Setup nav"): no author action; kept are the package, the ADRs and the one fact os package install needs — MarketplaceInstallLocalPlugin serves the install-local endpoint (also on the docs page deployment/cli, under os package install); createCloudConnectionPlugin stays in plugin-development.md § Well-Known Plugin Names.
4. The Testing pattern vitest block: the LiteKernel + vitest shape (describe/it, silent logger, bootstrap(), getService, shutdown()) is plugin-development.md § Testing Plugins, and the ObjectQLPlugin / DriverPlugin / InMemoryDriver imports are § Using Plugins. What was unique stays as prose: which three plugins a stack boot assembles, that AppPlugin is in @objectstack/runtime and stack is the config's default export, with links to both sections.
5. The "Seed in tests" bullet: the os data row already says the data: collection loads at boot, and objectstack-data references/seeds.md carries the env: ['dev', 'test'] scoping.

No line was re-wrapped to win room. The section headings are unchanged, so SKILL.md L402's section list still holds and no SKILL.md edit is needed.

skills/objectstack-platform/evals/config-plugins-ops.json: case 16 (the platform evals cover deployment: case 6), spliced before the closing bracket so the file's formatting is untouched. Prompt: the official image on a kept volume, nothing set, exits after pulling the new tag; expected: set the three on the run command, carry auth-secret, dev-crypto-key and data/objectstack.db over from /home/node/.objectstack, never fresh secrets. must_contain the three file names and the home path; must_not_contain OS_DEV_CRYPTO_KEY (it does not count for OS_SECRET_KEY, PR #30720 acceptance notes).

scripts/check-skills-token-ratchet.mjs: the operations.md row 3119 → 3108, pinned at the landed count (down only).

.changeset/30857-image-secrets-refuse-start.md: '@objectstack/skills': patch, both declaration lines.

Why

Since PR #30720 (ruling A3 on #30120) an agent that follows the skill as written produces a docker run the image refuses, and on an existing deployment may set fresh secrets, which makes every encrypted saved credential unreadable. The triage audit (6679092587) asks for the text to say keep the existing secrets on an upgrade; the pitfall row says it in bold.

Tests

• node scripts/check-skills-token-ratchet.mjs: exit 0; skills/objectstack-platform/references/operations.md 3108 / 3108 (+0); --self-test 97 cases pass.
• skills/objectstack-platform/evals/config-plugins-ops.json parses; 16 cases, ids unique.
• The derived gate battery and its --ran reconciliation: see Verification.

Acceptance notes

• The os start row ("It does not validate env or apply migrations") is unchanged: outside the image's preset that is still what os start does; the Docker row and the pitfall carry the preset's refusal. Left as is, scope.
• Verify your work still says a bare field ref in a predicate "evaluates to null and silently hides an action/validation", while the formula skill's Verify section says the engine throws at runtime and the rule fails loudly. One of the two is stale; not this card's surface, noted for the skills seat.
• /home/node/.objectstack is the image's home for the node user; the refusal prints the actual paths (and marks the ones present), so a custom OS_HOME is covered by reading the refusal.
• The OS_DEPLOYMENT_DURABILITY_CHECK_ENABLED=false escape is not taught; neither docker/README.md nor self-hosting.mdx teaches it.
• Whole-package readings (skills/**): the sum of every SKILL.md is 4523 lines before and after (no SKILL.md touched); the ratchet's shipped-bundle total is 227058 → 227374 tokens (+316: the eval fixture +324, operations.md −8).
• Relay writes only: git push, pr_create, the os-dev-report comment. The harness's assignee / reviewer step is skipped (no MCP writes); the seat sets them at hand-over.

Verification

Head bc38b673 (9db88a2 plus the merge of main cf478ea). Exit codes captured before any pipe, one COMMAND :: exit CODE line per command, then reconciled:

• bash scripts/pm/os-verify-lock.sh -c "pnpm build --filter='./packages/**' --concurrency=2": VERDICT command-exit 0, held the lock 402 s.
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; the change set from the merge base): 62 commands, all 62 :: exit 0 — among them check:skills-token-ratchet and its --self-test (97 cases), check:skill-identifier-liveness, check:skill-frame-sync, check:skill-compatibility, check:skill-refs, check:pm-skill-id-lint, check:doc-authoring, check:empty-changeset, check:changeset-no-major, check:adr-0087-registration, check:doc-formula-expressions (after the packages build), check:comment-mask-corpus, check:pm-dispatch-gates, check:pm-governed-merges.
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran LIST: "62 derived famil(ies) accounted for — 62 run, 0 NOT-MEASURED"; changed lines 78 (+36 / −42) against the 3000 threshold.
• pnpm lint, test:repo and the artifact-roster families are CI's run: the PR's check-runs.
• main moved by four commits after the push (to 18870c9); none touches the four files and a git merge-tree of the two is clean.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (packages/spec untouched.)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint is CI's run.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (Not touched.)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

---

Generated by Claude Code

[objectstack-fleet]

domain:skills#2 · os-tesla · session_01L9qibz5RLVEYDFco93jZ7u

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: bc38b67360b512448bca960c5405cd8d3eb38428
Local-runs: none
Scope: skills/objectstack-platform/evals/config-plugins-ops.json, skills/objectstack-platform/references/operations.md + packages/cli/src/commands/start.ts, packages/cli/src/utils/internal-crypto-key-file-channel.ts, packages/services/service-settings/src/local-crypto-provider.ts, docker/Dockerfile, docker/README.md, content/docs/deployment/self-hosting.mdx, skills/objectstack-platform/references/plugin-development.md, skills/objectstack-platform/SKILL.md, skills/objectstack-data/references/seeds.md, scripts/check-skills-token-ratchet.mjs, ui/scripts/check-skill-eval-tokens.mjs

Inputs: card #30857 (body, triage 6679092587, Claim 6679846916, os-dev-report 6680471472), PR #30875 body and file list, the three-dot diff against main at the head, and the head's check-runs. The remainder of the diff (.changeset/30857-image-secrets-refuse-start.md, the one CEILINGS row in scripts/check-skills-token-ratchet.mjs) is the lane seat's ACCEPT at TIER_DEFAULT; the ratchet row is read here as the gate the operations.md shrink moves.

① Derived judgments

• Published skill text (@objectstack/skills, operations.md) now states the image's refusal. Right. Read against packages/cli/src/commands/start.ts on main: readDurabilityCheckSignal turns the check on for true/1; missingDurableVariables names OS_DATABASE_URL only when isDefaultedDatabase(source) (unified-default or legacy-file), so an env file: URL is a choice and passes; OS_AUTH_SECRET is read through readEnvWithDeprecation (legacy AUTH_SECRET / BETTER_AUTH_SECRET count), OS_SECRET_KEY from the env alone (OS_DEV_CRYPTO_KEY does not count, which is what the eval's must_not_contain pins); formatDurabilityRefusal is written to stderr and process.exit(1) runs before readOrCreateAuthSecret(homeDir) and before the serve child opens any database. docker/Dockerfile sets OS_DEPLOYMENT_DURABILITY_CHECK_ENABLED=true in its ENV, USER node, WORKDIR /srv/app with no objectstack.config.ts, so os start runs in global mode and its home is ~/.objectstack = /home/node/.objectstack. The three file names hold: auth-secret (readOrCreateAuthSecret, path.join(homeDir, 'auth-secret')), dev-crypto-key (keyFilePath in local-crypto-provider.ts is join(home, 'dev-crypto-key'); the legacy candidate in internal-crypto-key-file-channel.ts is the same name under start's home), data/objectstack.db (the --database flag's stated default file:HOME/data/objectstack.db). The row's wording matches docker/README.md "What the image presets" and self-hosting.mdx "When the three are not set" sentence for sentence.
• Pitfall row: keep the generated values on an upgrade. Right, and it is the triage's one explicit requirement (6679092587: "The text must say to keep the existing secrets on an upgrade"); the row says it in bold and names the loss (every saved credential unreadable, everyone signed out), which is what the refusal text itself says.
• Accept-set of the eval fixture: one new graded case (id 16). Right. Ids 1 to 16 unique; shape matches cases 1 to 15 (id, prompt, expected_output, files: [], assertions). All four must_contain tokens (auth-secret, dev-crypto-key, objectstack.db, /home/node/.objectstack) occur verbatim, as whole tokens, in the branch's operations.md, which is what ui/scripts/check-skill-eval-tokens.mjs requires; OS_DEV_CRYPTO_KEY is taught nowhere in skills/objectstack-platform/, so the must_not_contain cannot be contradicted by the bundle. Note: that gate runs in the Lint UI job, which was skipped on this head (no ui/** change), so this reading is mine, not a check-run's.
• Token ratchet: operations.md 3119 to 3108. Right by the ratchet's own discipline (shrink-only; a ceiling may be lowered by any PR that shrinks its file, pinned at the measurement). No raise, no ruling needed. Zero headroom after landing is the pinned-at-measurement form the script's header asks for. The derived gate is green: every Lint · and Type Check · family on the head has concluded success.
• Each of the five in-file deletions has the home the PR body names. Checked on main: npm run validate in every domain skill's Verify section (objectstack-ai L411, -api L435, -automation L443, -data L456, -formula L476, -query L400, -ui L278); createCloudConnectionPlugin in plugin-development.md Well-Known Plugin Names (L295); MarketplaceInstallLocalPlugin really is the mount of POST/GET/DELETE /api/v1/marketplace/install-local (cloud-connection-route-ledger.ts L198 to L221) that packages/cli/src/commands/package/install.ts L274 targets; the vitest shape (LiteKernel, silent logger, describe/it) is plugin-development.md Testing Plugins (L245 to L279) and the ObjectQLPlugin / DriverPlugin / InMemoryDriver imports are Using Plugins (L224 to L244); the data: collection loading at boot is the os data row (operations.md L92) and the env: ['dev', 'test'] scoping is seeds.md L37 and L161. AppPlugin is in neither plugin-development section, and the new prose keeps it with its package. The dropped intro sentence carried no rule.
• No SKILL.md edit needed. Right: the eleven section headings of operations.md are unchanged and match SKILL.md L404's list; no anchor any skill links to was removed.
• Check-runs on the head at record time: 27 success, 13 skipped, 1 in progress (Test Core (1/8), a vitest shard; the diff holds no source or test file). No failure.

② Semver level

.changeset/30857-image-secrets-refuse-start.md: '@objectstack/skills': patch, with Clause-②: no and Metadata-protocol: none in the changeset body and the PR body. Right: the diff publishes skill text and an eval fixture from a released package, no spec key, export or protocol moves, so patch under none; skip-changeset would be wrong for skills/** and was not used. Clause-②: no — matches, no accept-set widens or narrows at any consumer. Check Changeset concluded success.

③ Boundary flags

• open_questions: [] in the os-dev-report. Nothing to answer.
• Dev flag, os start row unchanged ("does not validate env or apply migrations"): correct outside the image's preset (start.ts prints formatDurabilityBootBlock and keeps booting when the signal is off); the Docker row and the pitfall carry the preset's refusal. Accepted as scoped.
• Dev flag, the Verify-your-work sentence on a bare predicate ref versus the formula skill's Verify section: no hunk of this PR touches that sentence (the Verify hunk removes only the "In a scaffolded project" spelling), and the card's surface is the Docker row and one pitfall row. Not judged here; carried to the skills seat in the hand-over.
• Dev flag, custom OS_HOME: the refusal prints the resolved authSecretFile, dataKeyFile and defaultDatabaseFile with "(present in this container)" marks (formatDurabilityRefusal), so the taught /home/node/.objectstack is the image's default and the refusal covers the rest. Accepted.
• Dev flag, OS_DEPLOYMENT_DURABILITY_CHECK_ENABLED=false not taught: consistent with docker/README.md and self-hosting.mdx, neither of which teaches it. Accepted.
• Claim file surface (6679846916): operations.md, at most one eval case, the ratchet row down only, one changeset, no SKILL.md, no other skill, no ceiling raise. The diff is exactly those four files; the in-file deletions are the ratchet's own payment path. Held.
• Serial constraint (seat 1's PR docs(skills): teach one naming rule, every package-authored metadata name starts with its namespace #30831): docs(skills): teach one naming rule, every package-authored metadata name starts with its namespace #30831 merged at 08:18Z as 0e73de82, after this head merged main at 07:51Z, so main has since moved on skills/objectstack-platform/evals/config-plugins-ops.json (and SKILL.md, untouched here). docs(skills): teach one naming rule, every package-authored metadata name starts with its namespace #30831's hunks edit cases 1 and 9; this PR appends case 16 before the closing bracket: the hunks do not overlap, the three-dot diff against main is still the single +17 hunk, so a merge is clean. The os-dev-report's "none touches the four files" is stale on this point. Action for the seat before landing: merge origin/main once more and confirm 16 unique ids.

④ Design judgment

skills/objectstack-platform/references/operations.md against the card's scenario (an agent writes a docker run for the official image, and an upgrade on a kept volume) and against the spec it teaches on main (start.ts, docker/Dockerfile, docker/README.md, self-hosting.mdx).

• Tried to break the Docker row: a reader who sets OS_DATABASE_URL=file:/path/on/a/mounted/volume/app.db and nothing else still gets refused for the two secrets, and the row says all three are required, so no false pass is taught. A reader with the three set but OS_DEPLOYMENT_DURABILITY_CHECK_ENABLED=yes would be refused as invalid; the row does not mention the switch at all, so it teaches nothing wrong about it (the switch is the image's business, as the sources have it).
• Tried to break the pitfall row: an upgrade from a container that booted with a --home or OS_HOME other than the default would look in the wrong directory, but the row says the refusal names the files, and the refusal prints the resolved paths and marks the present ones; a reader who follows the row reads the refusal first (the symptom column is the refusal itself). An upgrade where the old container had OS_SECRET_KEY set but the auth secret generated: the row says set the named ones and carry over the generated values, which is per-variable, so no over-reach. OS_DATABASE_URL=file:… on the kept volume versus migrating: both named, matching self-hosting.mdx. Held.
• The Testing pattern rewrite keeps every fact that had no other home (the three plugins a stack boot assembles, AppPlugin's package, stack as the config's default export) and points to the two plugin-development.md anchors that exist on main (#testing-plugins, #using-plugins). An agent following it still assembles the same kernel; nothing taught was lost.
• The cloud-connection blockquote keeps the one fact os package install needs and the ADR pointers; the roster it dropped lives in Well-Known Plugin Names. Held.
• Must-fix: none. Should-fix: none.

skills/objectstack-platform/evals/config-plugins-ops.json case 16 against the card's eval prompt and the text it grades. The prompt is the card's scenario exactly (official image, kept volume at /home/node/.objectstack, no OS_* set, exits after a new tag, keep logins and stored credentials). The expected_output is read off the same code as the row: preset switch, exit before any write, set all three on the run command, the three files by name, file: URL on the kept volume or migrate, the loss otherwise. The assertions grade the four names a correct answer cannot omit and refuse the one wrong variable an answer could reach for; none of the four must_contain tokens is gradeable by accident (all are distinctive, none is a common word). Tried to break it: an answer that says "regenerate the secrets" and still names the four tokens would pass the string grade, but the grade is the harness's shape for every case in this file and the expected_output carries the rule in words; within that shape the case is as tight as cases 6 and 12. Must-fix: none. Should-fix: none.

Implemented-by: claude/project-thread-b3vyir
Reviewed-by: session_01L9qibz5RLVEYDFco93jZ7u

VERDICT: PASS

[objectstack-fleet]

domain:skills#2 · os-tesla · session_01L9qibz5RLVEYDFco93jZ7u

维护者速读

• 改了什么：平台技能的运维参考页 operations.md。部署目标表 Docker / Kubernetes 一行写明：官方镜像在运行时必须给出 OS_DATABASE_URL、OS_AUTH_SECRET、OS_SECRET_KEY 三项，否则拒绝启动；显式指向挂载卷的 file: 地址算已指定。「Common ops pitfalls」加一行：镜像启动即退出并点名这三项时，在运行命令里补上；升级时沿用旧容器 /home/node/.objectstack 下已生成的 auth-secret、dev-crypto-key、data/objectstack.db，不要换新。评测加第 16 题。
• 为什么改：PR fix(cli, service-settings, console): the official image refuses to start without its database and secrets; administrators see what a production server keeps on its own disk #30720 之后镜像默认开启持久性检查，技能还是旧写法，AI 照着写出的 docker run 会被镜像拒绝；升级时换新密钥会让已存的凭据全部读不出、所有人被登出。
• 风险与回滚：只改技能参考文字、一道评测题、changeset，不碰运行时和 SKILL.md。篇幅靠同文件五处删除支付（每处在 PR 正文里写明内容的去处），实测 3116 → 3108，上限 3119 下调到 3108，没有上调。回滚即 revert。
• 先看：skills/objectstack-platform/references/operations.md 的 Docker / Kubernetes 行和「Common ops pitfalls」最后一行。
• 两分钟验证：node scripts/check-skills-token-ratchet.mjs | grep operations.md 应打印 3108 / 3108；三个变量名、三个文件名与 packages/cli/src/commands/start.ts 的 formatDurabilityRefusal 一致。
• 需要你做的：改的是 skills/**，属于 Tier H，需要 os-zhuang（或 hotlong）批准后才能合并。契约复审 PASS 记录 6680689068。

席位意见：契约复审 PASS，无必改、无建议修改。复审逐句对照了 start.ts、docker/Dockerfile、docker/README.md 和 self-hosting.mdx，五处删除的去处也逐一核过。可以批准。

席位核对

ACCEPT · seat domain:skills#2 · head 199fc0dc · 2026-11-06T09:19Z

1. Shape: Fixes #30857, draft, base main, 4 files (skills/objectstack-platform/references/operations.md +10/−41, skills/objectstack-platform/evals/config-plugins-ops.json case 16, scripts/check-skills-token-ratchet.mjs one row 3119 → 3108, .changeset/30857-image-secrets-refuse-start.md '@objectstack/skills': patch), +36/−42, one content commit 9db88a29 plus two merges of main.
2. Ruling: filing gate ① on skills: operations.md does not say the official image refuses to start without OS_DATABASE_URL, OS_AUTH_SECRET and OS_SECRET_KEY #30857, the Skills-docs: follow-up PR fix(cli, service-settings, console): the official image refuses to start without its database and secrets; administrators see what a production server keeps on its own disk #30720 (ruling A3 on [Decision] os start in production mode runs on a local SQLite file and self-generated secrets, with no warning #30120) named as owed; triage 6679092587 (p1); Claim 6679846916. Ceiling moved down only.
3. Contract review: PASS 6680689068 at bc38b673 (Fable, no must-fix, no should-fix). The head moved to 199fc0dc by a merge of origin/main only (c50e0dfa); the PR's three-dot diff is unchanged (4 files, +36/−42), so the record carries on. The merge brought PR docs(skills): teach one naming rule, every package-authored metadata name starts with its namespace #30831's edits to cases 1 and 9 of config-plugins-ops.json; case 16 still appends at the end and ids stay unique (16 cases). Clause-②: no, Metadata-protocol: none.
4. Gates / check-runs: dev reports 62/62 derived families exit 0 at bc38b673, --ran reconciled with 0 NOT-MEASURED (report 6680471472); at 199fc0dc the 29 families derived for the eval file plus check-skills-token-ratchet and its --self-test re-ran, 31/31 exit 0 (operations.md 3108 / 3108). check:skill-eval-tokens sits in the Lint UI job, which is skipped on this diff; the reviewer checked by reading that all four must_contain tokens appear verbatim in the branch's operations.md and OS_DEV_CRYPTO_KEY is taught nowhere in the bundle. On head 199fc0dc: 42 check-runs, 29 success, 13 skipped, 0 failed; mergeable_state clean.
5. Accepted deviations: none. Residue outside this card, owned by the seat: the "bare predicate ref evaluates to null and hides the rule" wording in operations.md Verify your work (also in objectstack-data SKILL.md and objectstack-ui SKILL.md) is stale against main; it becomes one follow-up card for the three files.
6. Landing: check-governed-merges --pr 30875: GOVERNED, Tier H (skills/**). The seat readies the PR and the relay's governed-review leg requests the approvers; no auto-merge is armed by the seat.