Skip to content

chore(upstream): the cloud pin moves by hand; the bump workflow moves only objectstack (#433) - #434

Merged
objectstack-fleet[bot] merged 43 commits into
mainfrom
claude/project-thread-u7eoxi
Nov 3, 2026
Merged

objectstack-fleet[bot] merged 43 commits into
mainfrom
claude/project-thread-u7eoxi

Conversation

@objectstack-fleet

Copy link
Copy Markdown
Contributor

Requested by Steedos · project thread

Fixes #433

Clause-②: no
Metadata-protocol: none

维护者速读

  • 改了什么:.cloud-sha 改为手工更新:AGENTS.md「Upstream pins」写明时机(升级文档、对齐生产时)、完整 SHA 的取法(cloud 的 v* tag 或 deploy-cloud-prod run;health 头只有 8 位)、PR 正文要贴的 git log <旧>..<新> -- CHANGELOG.md .changeset/。bump-upstream-docs.yml 只剩 objectstack,bump-upstream-pin.mjs 拒绝 --upstream cloud 并指向这些步骤。
  • 为什么改:维护者在 The cloud pin (.cloud-sha) moves by hand when the docs are refreshed: no UPSTREAM_BUMP_TOKEN, no dispatch from cloud (maintainer ruling 2026-11-03) #433 裁定 cloud pin 手工更新、不配 UPSTREAM_BUMP_TOKEN、cloud 不再 dispatch(cloud#3531 删掉了发送端)。
  • 风险与回滚:只改文档、工作流头注释和一个脚本的 cloud 分支;objectstack 的 bump 与它对 UPSTREAM_BUMP_TOKEN 的要求不变。回滚即 revert。
  • 先看:AGENTS.md 的「Upstream pins」一节,然后 bump-upstream-pin.mjs 里新增的 bumpable()。
  • 两分钟验证:node .github/scripts/bump-upstream-pin.mjs --self-test 通过;--upstream cloud --sha <40位> --body x 以「moved by hand」拒绝;--check 对手写的 40 位 .cloud-sha 通过。
  • 需要你做的:contract review owed(待复核 PASS 后再求批)。

What changes

Where Old New
AGENTS.md "Upstream pins" One paragraph: both pins move by bump-upstream-docs.yml; the cloud pin "after a successful cloud production deploy"; "⛔ Don't edit a pin by hand". Three parts. Both pins and the review input. The objectstack pin: unchanged rule, still ⛔ not by hand, and its PR needs UPSTREAM_BUMP_TOKEN. The cloud pin moves by hand (#433), in three steps: take the full SHA (git rev-parse vX.Y.Z^{commit} on cloud's v* tag, or the deploy-cloud-prod run; the health header has only 8 characters); write .cloud-sha; paste git log <old>..<new> -- CHANGELOG.md .changeset/ from a local cloud checkout (the first hand update from unpinned lists nothing). The pins job checks format only.
.github/workflows/bump-upstream-docs.yml Header covers both upstreams; input upstream: [objectstack, cloud]; token needed to read cloud and to open the PR; NOT CONFIGURED message asks for cloud read access. Header: moves only objectstack; the cloud pin is moved by hand (#433) and the helper refuses it; pins reads neither upstream. Input upstream: [objectstack]. The token only pushes the branch and opens the PR; the message no longer asks for cloud access. Triggers, jobs and steps are unchanged.
.github/scripts/bump-upstream-pin.mjs Header: cloud moves after a production deploy, --sha required. --upstream objectstack|cloud. A cloud fetch failure hints UPSTREAM_TOKEN. Header: cloud moves by hand, with the steps; --check validates both by format alone. UPSTREAMS.cloud.byHand: true; a new bumpable() refuses --upstream cloud, naming the git log to paste and AGENTS.md. The cloud-only --sha refusal and the token hint are removed. Self-test: objectstack is bumpable, and cloud is refused with "moved by hand" and the git log command.

Measured on main 32ee782 (claim premise): the pins job (--check) already reads no upstream, so item 3 of the card needed no code change. A hand-written .cloud-sha with 40 hex characters passes --check. The objectstack bump also needs UPSTREAM_BUMP_TOKEN (the Require step runs for either upstream, and a GITHUB_TOKEN PR runs no CI). This PR leaves that as it is, as the card asks. CONTRIBUTING.md does not mention the pins. The first hand update of .cloud-sha (item 4) needs a cloud checkout. It belongs to whoever does the first alignment, not to this PR.

Tests

On head 4185047 (the content commit; f29c119 adds only an ours-merge of the old branch head):

  • node .github/scripts/bump-upstream-pin.mjs --self-test: ✓ self-test: 17 pin/input case(s), upstream names, the hand-moved cloud pin, tag resolution, plan, body bounds and token carriage.
  • Ablation: with byHand: false on cloud, the self-test fails on both new checks (bump: cloud: expected a refusal containing "moved by hand" and … names the git log to paste), 2 checks, exit 1.
  • --check on main's pins: ✓ .objectstack-sha: 4e4e881…, ✓ .cloud-sha: unpinned. On a tree with a hand-written 40-hex .cloud-sha: ✓ .cloud-sha: bbbb….
  • --upstream cloud --sha <40 hex> --body …: exit 1, ✗ .cloud-sha is moved by hand, not by this script (docs.objectos.ai#433): write the full SHA production serves and paste git log OLD..NEW -- CHANGELOG.md .changeset ….
  • node tools/ci-scripts/run-self-tests.mjs: 14 self-tests passed.
  • The workflow YAML parses.

Acceptance notes

  • The objectstack bump still needs UPSTREAM_BUMP_TOKEN, which is not set (the 2026-11-02 run failed). The card leaves that to a separate maintainer decision.
  • tools/ci-scripts/run-self-tests.mjs has a comment about this script ("fetches an upstream repository"). It is still accurate, so I left it alone.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

zhuangjianguo and others added 30 commits October 29, 2026 10:17
…ions, use)

Phase 1 of the other-locale plan. Adds ja translations of the 19
entry-path pages (index, why, start/*, editions/*, use/*) and the ja
sidebar labels for start/ and editions/. Every heading keeps its
English id, fences match the English byte for byte, terms follow the
glossary's ja column, and each page carries a --stamp.

check-translations: ja 0 stale, 79 missing (was 98).

Fixes #386

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
Phase 2 of the other-locale plan, first batch: ja for the build/ top
level (index, agents, ai-builder, ai-skills, extend-existing-systems,
marketplace, packages, reports, templates) and build/data/ (index,
relationships, formulas, validation-rules). Same rules as #386: English
heading ids, fences byte for byte, glossary ja column, UI labels in
English, one line per paragraph, each page stamped.

check-translations: ja 0 stale, 66 missing (was 79).

Refs #388

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
…388, PR 2 of 7)

Adds ja translations for the 11 automation and interface pages:
build/automation/{index,flows,workflows,approvals} and
build/interface/{index,apps,views,forms,dashboards,pages,actions}.
Both sections' meta.ja.json already match the English pages list.

Refs #388

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
…tput (#393)

/api/search kept every locale's Orama index (30-40 MB each) and every
page module page.data.load() imported, so one Worker isolate grew from
58 MB after its first locale to 283 MB after all eight, and #390's ja
pages tipped it past 128 MB into 503s.

- scripts/gen-search-data.mjs computes each page's structuredData before
  next build with fumadocs-mdx's own remark chain and writes one gzipped
  module per locale to apps/docs/.search/; the route reads that instead
  of importing page modules.
- The route keeps the most recently used locale's index only.
- check-search-heap.mjs asks the built route in every locale twice and
  fails above 100 MB or when the second pass keeps growing; it runs in
  ci.yml after check-search-locales and its --self-test is in SELF_TESTED.

Measured on the built route: levels at 50-54 MB across both passes.

Fixes #393

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
The tree is unchanged: the diff against main is the #393 commit only.

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
…388, PR 2 of 7)

Reverts #392, which reverted #390 because /api/search ran out of Worker
memory. #394 (#393) fixed that, so the same 11 ja pages come back
unchanged.

Refs #388

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
The tree is unchanged: the diff against main is the re-landed ja pages only.

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
Six route handlers (search, og, sitemap, llms.txt, llms-full.txt,
llms.mdx) import lib/source.ts, whose fumadocs-mdx collection holds a
lazy import() of every compiled page. Turbopack compiles route handlers
as their own module graph, so the Worker carried a second copy of every
page module: ~20 MB of upload, and each translated page cost ~170-235 KiB
instead of ~86. #388's PR 3 would have gone over the 61,440 KiB budget.

- scripts/gen-route-data.mjs (was gen-search-data.mjs) also writes
  .route-data/collection.ts: .source/server.ts with each page's body
  import replaced by a read of generated data, and markdown.ts, the
  English pages' processed Markdown the llms routes serve. With --dev it
  re-exports the full collection so next dev sees new pages.
- lib/source.ts builds its loader on that collection; the page route
  loads bodies through lib/page-body.ts, the only module that imports
  the full collection.
- lib/packed.ts unpacks the generated gzip+base64 strings.
- The Worker budget step prints a per-page projection from the bundle's
  metafile (check-worker-page-cost.mjs, in SELF_TESTED).

Measured, same machine: main f7e4a57 59,173 KiB, this change 38,909 KiB;
with every ja page filled in, 43,700 KiB.

Fixes #395

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
The tree is unchanged: the diff against main is the #395 commit only.

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
Adds ja translations for the 14 configure/ pages: index, ai, api-access,
authentication, data-sources, email, localization, mcp, notifications,
runtime, storage, system-settings, users and webhooks. configure/
meta.ja.json already matches the English pages list. Same rules as the
earlier batches: English heading ids, fences byte for byte, glossary ja
column, UI labels in English, one line per paragraph, each page stamped.

check-translations: ja 0 stale, 41 missing (was 55).

Refs #388

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
… PR 4 of 7)

Adds ja translations for the 7 configure/permissions/ pages (index,
managing-access, permission-sets, positions, record-access,
field-level-security, hierarchy-visibility) and the 8 cloud/ pages
(organization, environments, plans-and-seats, ai-credits-and-limits,
storage-and-limits, domains, apps, cloud-connection), plus a new
cloud/meta.ja.json whose pages match the English. configure/permissions/
meta.ja.json already matched. Same rules as the earlier batches.

check-translations: ja 0 stale, 26 missing (was 41).

Refs #388

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
Adds ja translations for the 4 deploy/ pages (index, docker, kubernetes,
air-gapped) and the 7 operate/ pages. Both sections' meta.ja.json
already match the English pages list. Same rules as the earlier batches.

check-translations: ja 0 stale, 15 missing (was 26).

Refs #388

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
…388, PR 6 of 7)

Adds ja translations for the 9 reference/ pages and the two root pages,
architecture and ontology. reference/meta.ja.json already matches the
English pages list; the root sidebar has only meta.json. Same rules as
the earlier batches.

check-translations: ja 0 stale, 4 missing (was 15).

Refs #388

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
… PR 7 of 7)

Adds ja translations for the 4 resources/ pages: changelog, faq,
glossary and support. resources/meta.ja.json already matches the
English pages list. Same rules as the earlier batches.

With this batch every English page has a ja translation.
check-translations: ja 0 stale, 0 missing (was 4).

Fixes #388

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
#403 changed step 1 of "Start on ObjectOS Cloud" to link the console's
register and sign-in pages instead of www.objectos.ai. This carries the
same change into zh-Hans and ja, restamps both, and regenerates zh-Hant
with gen:zh-hant.

check-translations: zh-Hans and ja 0 stale, 0 missing.

Fixes #404

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
…-Hant and ja (#414)

#410 added subscription management, AI seat changes and Paddle as the
seller to cloud/plans-and-seats and cloud/ai-credits-and-limits. #413
moved the sales contact to sales@objectos.ai on editions/license,
resources/support, resources/faq and start/enterprise. This carries only
the changed parts into zh-Hans and ja, restamps all twelve pages, and
regenerates zh-Hant with gen:zh-hant. Paddle, emails and URLs are copied
byte for byte.

check-translations: zh-Hans and ja 0 stale, 0 missing.

Fixes #414

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
objectstack#26148 replaced the README sentence OBJECTOS_DEFINITION
quoted ("...the commercial runtime environment built on this stack")
with one naming three editions: ObjectOS Community, shipped by the
repository, free and self-hosted; ObjectOS Cloud, hosted; ObjectOS
Enterprise, self-managed and licensed.

- OBJECTOS_DEFINITION quotes README lines 27-31 from "To run it", with
  three declared changes: "this repository" spelled out as "the
  ObjectStack repository", the Markdown dropped, and the in-README
  "(Ship it)" link left out.
- OBJECTOS_EDITIONS keeps only the #171 Q2 export clause, naming Cloud
  and Enterprise instead of "either edition".
- POSITIONING_SHORT (152 characters) names the three editions in the
  README's words.
- The index.mdx opening paragraph and description follow, and the
  zh-Hans and ja siblings are re-translated and restamped; zh-Hant is
  regenerated.

check-positioning passes after a build.

Fixes #341

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
…418)

#407 added Team's annual price ($20 / AI seat / month billed annually)
to the Price row of editions/compare and editions/license. This adds
the same to the zh-Hans and ja Price cells, in the annual-price wording
each locale uses on cloud/plans-and-seats, restamps the four pages and
regenerates zh-Hant.

check-translations: zh-Hans and ja 0 stale, 0 missing.

Fixes #418

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
zhuangjianguo and others added 13 commits November 2, 2026 02:04
The layer table on architecture still called ObjectOS "the commercial
runtime environment built on the framework" with two editions, the
definition objectstack#26148 retired and #416 removed from the
positioning constants. The row now uses only positioning.ts's terms:
ObjectOS Community free and self-hosted, ObjectOS Cloud the hosted
edition, ObjectOS Enterprise the self-managed, licensed one. zh-Hans
and ja use the wording their index.mdx carries since #416; both are
restamped and zh-Hant is regenerated.

check-positioning rule (c) now lists "commercial runtime environment"
as a stale sentence, with a fixture, so the phrase cannot come back to
an English source.

Fixes #417

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
…nd entry pages (#421)

On ObjectStack 17.7 the scaffolder refuses todo, compliance, content,
contracts and procurement as retired, yet the docs listed them as
templates and catalog apps. Per the ruling on #334 Q5 they are removed,
and build/templates' "--template todo is refused as retired" stays as
the one mention.

- build/templates: seoTitle and description name helpdesk, hr and
  project; the five catalog rows and the three pick-table rows that
  pointed at them are gone.
- index: the marketplace example names Helpdesk only.
- start/community and build/marketplace: the same five rows leave their
  app tables, and the template clone example uses helpdesk.
- build/index names none of the five and is untouched.

zh-Hans and ja get the same removals and are restamped; zh-Hant is
regenerated.

Fixes #421

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
#423)

Per the ruling on #334 Q4, the upgrade page's "Rotate the JWT signing
keys" step gains one sentence: how the keys are rotated depends on how
the deployment supplies them, so follow the deployment's own procedure.
It names no mechanism, variable or command. zh-Hans and ja carry the
same sentence and are restamped; zh-Hant is regenerated.

Q2 and Q3 of the same ruling need no change; the seat measured both
pages against it.

Fixes #423

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
…en runtime is planned (#334 Q1)

No mechanism exports a Cloud or Enterprise tenant's ontology to run on the
open-source ObjectStack runtime yet. OBJECTOS_EDITIONS, the index opening
paragraph, /llms.txt and 13 sentences across index, security, glossary, why,
architecture and ontology now say the export is planned, and keep what is
true today: the ontology is ordinary ObjectStack metadata, ObjectStack is
Apache-2.0, and ObjectOS Community runs on your own machine. zh-Hans and ja
follow, restamped; zh-Hant regenerated.

Ruling-ref: #334 comment 6568804196

Fixes #425

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
…ent per organization, re-sync cloud/organization (zh-Hans, zh-Hant, ja)

#428 deleted the zh-Hans, zh-Hant and ja siblings of cloud/apps, domains,
environments, plans-and-seats, storage-and-limits and editions/compare. They
are translated from the current English: every sentence #428 changed is new,
and wording is reused only where the English sentence is unchanged.
cloud/organization is re-synced in both locales. zh-Hant regenerated.

Part of #429

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
…editions/license fresh

Re-sync cloud/plans-and-seats and editions/compare to #431's English, and
translate editions/license, whose siblings #431 deleted, from the current
English, reusing wording only where the English sentence is unchanged.
Re-sync configure/mcp, deploy/index, index and start/enterprise.
zh-Hant regenerated.

Fixes #429

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
… only objectstack

Maintainer ruling on #433: .cloud-sha is updated by hand when the docs are
aligned with production, with no repository_dispatch from cloud and no
UPSTREAM_BUMP_TOKEN for cloud. AGENTS.md 'Upstream pins' now gives the steps:
the full SHA from cloud's v* tag or its deploy-cloud-prod run (the health
header has only 8 characters), and the git log of CHANGELOG.md and
.changeset/ pasted into the PR body. bump-upstream-pin.mjs refuses
--upstream cloud with those steps, and its self-test proves the refusal;
--check still validates both pins by format alone. The workflow offers only
objectstack, and its token message no longer asks for cloud read access.
objectstack's bump and its token requirement are unchanged.

Fixes #433

Claude-Session: https://claude.ai/code/session_01QsR2jRsjbApbf83iyTDDXm

Co-Authored-By: Claude <noreply@anthropic.com>
@objectstack-fleet

Copy link
Copy Markdown
Contributor Author

维护者速读

  • 改了什么:.cloud-sha 改为手工更新。AGENTS.md「Upstream pins」写明三件事:什么时候更新(升级文档、和生产对齐时,不随每次发版);完整 SHA 怎么取(cloud 的 v* tag 或 deploy-cloud-prod run,health 头的 x-objectstack-build-sha 只有 8 位);PR 正文要贴什么(本地 cloud 检出里跑的 git log <旧>..<新> -- CHANGELOG.md .changeset/)。bump-upstream-docs.yml 只剩 objectstack 一条路径,bump-upstream-pin.mjs 遇到 --upstream cloud 会拒绝,并在拒绝信息里给出这些步骤。
  • 为什么改:你在 The cloud pin (.cloud-sha) moves by hand when the docs are refreshed: no UPSTREAM_BUMP_TOKEN, no dispatch from cloud (maintainer ruling 2026-11-03) #433 裁定 cloud pin 改为手工、不配 UPSTREAM_BUMP_TOKEN、cloud 不再 dispatch。
  • 风险与回滚:只改 3 个文件(+87/−48):AGENTS.md 的一节、工作流的头注释和输入、脚本的 cloud 分支。objectstack 的自动 bump 和它对 UPSTREAM_BUMP_TOKEN 的要求都没动。回滚就是 revert 本 PR。
  • 先看:AGENTS.md「Upstream pins」,然后看 bump-upstream-pin.mjs 新增的 bumpable()。
  • 两分钟验证:node .github/scripts/bump-upstream-pin.mjs --self-test 通过;把 cloud 的 byHand 改成 false,self-test 会在两条新检查上变红;--upstream cloud --sha <40位> --body x 以「moved by hand」拒绝。
  • 需要你做的:在项目线程的决策卡上同意落地(Head-sha f29c119)。
  • 席位意见:建议落地。本次复核由写这张 PR 的线程按你的指示用 pm-dispatch 完成,所以不是独立复核。我对照 diff 逐行读过,没有发现问题。一个遗留:objectstack 的 bump 也缺 UPSTREAM_BUMP_TOKEN(11-02 的运行失败了),卡上说由你另行决定,本 PR 不碰。

席位核对 · 2026-11-03T14:17Z · session_01QsR2jRsjbApbf83iyTDDXm · Head-sha f29c119

  1. Shape. A draft PR against main 32ee782, opened through the fleet relay. Head f29c119: content commit 4185047, plus an ours-merge of the old branch head that adds no content. Files: AGENTS.md, .github/workflows/bump-upstream-docs.yml and .github/scripts/bump-upstream-pin.mjs, exactly the claim's file surface. +87/−48. The body opens with Fixes #433, and no closing keyword sits beside any other number.
  2. Premise, measured. On main 32ee782, --check reads no upstream and validates by format alone, so a hand-written 40-hex .cloud-sha passes. A temporary tree with .cloud-sha = b×40 prints ✓ .cloud-sha: bbbb…. That is why item 3 needed no code. CONTRIBUTING.md does not mention the pins. The objectstack bump also needs UPSTREAM_BUMP_TOKEN: the Require step runs before either upstream, and a GITHUB_TOKEN PR runs no CI.
  3. Gates, check-runs at f29c119. Upstream pins are well-formed success (it runs the self-test and --check) · Ownership & freshness success · Node floor success · build success · Bump an upstream pin and Deploy docs skipped, as designed on pull_request. Locally: the self-test passes 17 cases plus the new hand-moved-cloud checks; with byHand: false the ablation reds exactly the 2 new checks (exit 1); run-self-tests.mjs passes 14; the workflow YAML parses.
  4. Accepted deviations. repository_dispatch stays a trigger, because an objectstack release may still send one. A stray upstream: cloud payload is refused twice: first by the Require UPSTREAM_BUMP_TOKEN step while the secret is unset, then by the helper's bumpable(). Its UPSTREAMS.cloud entry stays, with byHand: true, so that --check still validates .cloud-sha and the refusal can name the paths to git log.
  5. Out of scope. The objectstack bump's missing UPSTREAM_BUMP_TOKEN goes to the maintainer, as The cloud pin (.cloud-sha) moves by hand when the docs are refreshed: no UPSTREAM_BUMP_TOKEN, no dispatch from cloud (maintainer ruling 2026-11-03) #433 asks (Acceptance notes). The first hand update of .cloud-sha, from unpinned to production's v* commit, needs a cloud checkout and belongs to whoever does the first alignment. The comment about this script in tools/ci-scripts/run-self-tests.mjs is still accurate. Skills-docs: none (no skill or published docs page touched).
  6. Landing. Tier H, because the claim puts AGENTS.md and .github/** under governance. check-governed-merges --pr answers that docs.objectos.ai is outside the governed register, so the gate is the lane rule: the maintainer's go-ahead before landing. On the go-ahead: clear needs-user-decision, then pr_ready + automerge_enable through the relay, follow it to MERGED, post the landing note on The cloud pin (.cloud-sha) moves by hand when the docs are refreshed: no UPSTREAM_BUMP_TOKEN, no dispatch from cloud (maintainer ruling 2026-11-03) #433 and clear pm:dispatched.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

The cloud pin (.cloud-sha) moves by hand when the docs are refreshed: no UPSTREAM_BUMP_TOKEN, no dispatch from cloud (maintainer ruling 2026-11-03)

1 participant