Repository navigation
The cloud pin (.cloud-sha) moves by hand when the docs are refreshed: no UPSTREAM_BUMP_TOKEN, no dispatch from cloud (maintainer ruling 2026-11-03) #433
Description
coordinator#1 · hotlong · session_6eb9ec2e0e3f410b91239dab7a337b9e
立卡门类别：③ 维护者直派。维护者 2026-11-03 在会话里讨论 cloud#3336（生产发版后自动更新本仓的 .cloud-sha，需要两把令牌）时问：「每次文档仓库升级的时候手工设置这个不行吗？」，看过方案后答「同意」。
Reader: repo:docs.objectos.ai 车道。本卡改的 AGENTS.md、.github/** 在本仓也是受治理面，按本仓的规矩由维护者合并。建议档 p3，由分诊定。
Dedupe:
repo:objectstack-ai/docs.objectos.ai is:issue cloud-sha命中 8 条（含 closed）。最近的是 Sync cloud'scontent/docs/into this site and pin both upstreams (objectstack, cloud) so alignment is a bounded diff review, not a periodic re-read (cloud#3199 ruling D) #337（已关）：它建立了两个 pin 和自动 bump，本卡只把其中 cloud 那半改成手工。其余是内容卡，无同题。repo:objectstack-ai/docs.objectos.ai is:issue UPSTREAM_BUMP_TOKEN命中 1 条，同是 Sync cloud'scontent/docs/into this site and pin both upstreams (objectstack, cloud) so alignment is a bounded diff review, not a periodic re-read (cloud#3199 ruling D) #337。repo:objectstack-ai/docs.objectos.ai is:issue bump-upstream-docs manual命中 0 条。
裁决
.cloud-sha不再由 cloud 的生产部署通过repository_dispatch自动推动，本仓也不配UPSTREAM_BUMP_TOKEN。- 改为：每次升级文档、要和生产对齐时，由动手的人手工更新
.cloud-sha。 .objectstack-sha不受影响：它读的是公开仓库，现有流程照旧。如果它的自动 bump 也依赖UPSTREAM_BUMP_TOKEN，请在本卡说明，由维护者另定。
cloud 侧已经在做：draft PR cloud#3531 删掉了 deploy-cloud-prod.yml 里给本仓发通知的那一步（受治理面，等维护者合并）；cloud#3532 改了 cloud 的部署文档。cloud#3336 按「改为手工、不配令牌」关闭。
要做的
AGENTS.md「Upstream pins」一节：现在写的是「⛔ Don't edit a pin by hand」，以及「the cloud pin moves after a successful cloud production deploy」。改成：- cloud pin 由人手工更新，时机是升级文档、和生产对齐的时候，不跟每次发版走；
- 当前生产提交的取法：
curl -sI https://cloud.objectos.ai/api/v1/health的x-objectstack-build-sha只有前 8 位；完整 40 位在 cloud 的v*tag 上（git rev-parse vX.Y.Z^{commit}），或在 cloud 的 deploy-cloud-prod run 里取； - PR 正文要贴上
git log <旧>..<新> -- CHANGELOG.md .changeset/的结果，作为对齐检查的依据（就是自动 bump 原来生成的那份清单），动手的人在本地 cloud 检出里跑。
bump-upstream-docs.yml：去掉 cloud 这条路径，或者标明只给 objectstack 用。Require UPSTREAM_BUMP_TOKEN那一步不应再挡住 objectstack 的 bump（如果它会挡）。pins检查（改到 pin 文件的 PR 会跑）：确认它对手改的.cloud-sha只校验格式（40 位十六进制），不需要读私有的 cloud 仓库；如果需要，就改成只校验格式。.cloud-sha现在仍是占位值unpinned。第一次手工更新时，写当前生产v*tag 对应的完整提交，PR 正文不必附差异清单。- 如果
.github/scripts/bump-upstream-pin.mjs文件头和CONTRIBUTING.md里也有同样的说法，一并改掉。
验收
- 本仓没有任何地方要求
UPSTREAM_BUMP_TOKEN才能更新.cloud-sha。 - 手工改
.cloud-sha的 PR 能通过本仓 CI。 AGENTS.md写清楚了手工更新的时机、完整 SHA 的取法，以及 PR 正文要附的差异清单。
相关
cloud#3336（关闭）、cloud#3531、cloud#3532、本仓 #337、#348
🤖 Generated with Claude Code
Activity
objectstack-fleet commentedon Nov 3, 2026
Claim: the cloud pin moves by hand · 2026-11-03T12:25Z
Session:
session_01QsR2jTaZ2GeyfjANMwstiw(seat thread; the dev is card threadsession_01QsR2jRsjbApbf83iyTDDXm, identity by branch)Account:
zhuangjianguoBranch:
claude/project-thread-u7eoxi(platform-assigned; restarted frommain)Worktree: the card thread's own
docs.objectos.aicheckoutDomain:
domain:docs(single-lane repository)Seat:
repo:docs.objectos.ai#1File surface:
AGENTS.md(the "Upstream pins" section),.github/workflows/bump-upstream-docs.yml,.github/scripts/bump-upstream-pin.mjs(header and the cloud path, with its self-test). If the work goes beyond this surface, stop and explain why in the report.Container & model: S,
mode:thread,model: default tier (TIER_DEFAULT — sister repository, hand-derived: no packages/spec, no protocol-semantic surface),effort: project defaultClause-②: no
Metadata-protocol: none
Responsibility: n/a — maintainer-assigned (③)
Thread-read: none
Premise: measured on
main32ee782.AGENTS.md:106says "⛔ Don't edit a pin by hand" and "the cloud pin moves after a successful cloud production deploy".upstream: [objectstack, cloud]by hand or byrepository_dispatch.pinsjob (bump-upstream-pin.mjs --check, on PRs that touch a pin) already checks format only: a 40-hex SHA orunpinned. It reads no upstream, so a hand-edited.cloud-shaalready passes it. Item 3 needs no code change.CONTRIBUTING.mddoes not mention the pins.UPSTREAM_BUMP_TOKEN. TheRequire UPSTREAM_BUMP_TOKENstep runs for either upstream, because a PR opened withGITHUB_TOKENruns no CI. With the secret unset, the objectstack bump cannot open its PR either (the workflow_dispatch run on 2026-11-02 failed). This card leaves that as is, and the maintainer decides separately, as the card asks..cloud-shato production'sv*tag commit, needs a cloud checkout. That is for the person who does the first alignment, not this PR.Tier: H.
AGENTS.mdand.github/**are governed here: the ACCEPT carries a maintainer brief, and the maintainer gives the go-ahead before landing.Serial constraints cleared: the lane is serial, and this is the only card in flight. No open PR touches these files.
chore(upstream): the cloud pin moves by hand; the bump workflow moves…
objectstack-fleet commentedon Nov 3, 2026
Landed · repo:docs.objectos.ai · 2026-11-03T15:47Z
PR #434 merged through the merge queue as
0c3a0ff. The user gave the Tier H go-ahead in the card thread at 2026-11-03T15:28Z. Main CI run 41665370687 on0c3a0ffis green: build, Upstream pins (format-only), Deploy docs / Publish the tested Worker, and Deploy docs / Smoke-check the live site. Rollback was skipped.What changed: in
AGENTS.md"Upstream pins",.cloud-shanow moves by hand. The section covers when to move it, how to get the full SHA (the cloudv*tag or the deploy-cloud-prod run; the health header has only 8 characters), and thegit log <old>..<new> -- CHANGELOG.md .changeset/output the PR body must include.bump-upstream-docs.ymlnow moves only objectstack.bump-upstream-pin.mjsrefuses--upstream cloudand points to those steps.Left open on purpose:
.cloud-shafromunpinnedneeds a cloud checkout. It belongs to whoever does the first alignment.UPSTREAM_BUMP_TOKEN, which is not set. This card left that to a separate maintainer decision.pm:dispatchedcleared.Generated by Claude Code