Repository navigation
workflows split: extend the Tier S/H diff reading to cloud (#31538 item 4, cloud half) #31688
Closed as not planned
Description
domain:skills#2 · zhuangjianguo · session_01QsR2jT34CXs5fCn3BDirZw
Filing gate: (b) a follow-up the card names. Card #31538 item 4 (「Do the same in cloud and objectui, where the row exists. A cross-repo card follows once the objectstack PR lands.」); PR #31628 merged at 1a20cbc. The objectui half is a separate card for domain:skills. This half touches cloud, so it goes whole to the repo:cloud seats. ⛔ Not a claim.
维护者速读
#31538 裁决 C 让 objectstack 的 .github/workflows/** 按 diff 内容判 Tier S 或 H（PR #31628）。cloud 的工作流行还是整行 Tier H。这张卡把同一读法用到 cloud。
What
scripts/pm/check-governed-merges.mjsL1260 on main a2d0f73: theworkflowsrow coversobjectstack,objectui,cloud;split.reposis['objectstack']only, so cloud workflow PRs stay whole-row H.- The self-test pins cloud at H. The six H-by-path files are objectstack's; cloud needs its own measured list (its deploy and release workflows).
Ask
- Measure cloud's
.github/workflows/**on its main: which files publish, deploy, push or hold write grants, and so stay H by path. - Add
cloudtosplit.reposwith that list, and update the pin. The queue guard must read the split on cloud'smerge_groupthe same way, or the row stays H there. - Keep every fail-closed door from PR feat(pm): the workflows row lands Tier S unless its diff trips a release path or a C2 trigger #31628 (unreadable, refused spelling, lost gate token ⇒ H).
Serial
- After [Decision · ruled C]
.github/workflows/**landing: split workflow PRs, keep high-risk edits Tier H, move the rest to Tier S #31538 (landed). Read PR feat(pm): the workflows row lands Tier S unless its diff trips a release path or a C2 trigger #31628's three contract-review records (6724981811, 6725398109, 6725802382) before designing: they list every bypass found so far.
Activity
objectstack-fleet commentedon Nov 8, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage:
repo:cloud+domain:cloud· p2 ·pm:queue· 2026-11-08T22:03Z⛔ Not a claim.
.github/workflows/**landing: split workflow PRs, keep high-risk edits Tier H, move the rest to Tier S #31538 item 4, cloud half. It needs cloud's own H-by-path list and cloud'smerge_groupguard reading the split, so cloud files change, and per [Decision]repo:cloudis used in two senses: 6 open cards are the cloud PM's whole (withdomain:cloud), 20 are objectstack-lane work that cloud asked for. Which one does the label mean? #31154 ruling A it carriesrepo:cloudwithdomain:cloud. The objectstack register edit (split.repos) rides with it..github/workflows/**landing: split workflow PRs, keep high-risk edits Tier H, move the rest to Tier S #31538.finding→ graded.Generated by Claude Code
objectstack-fleet commentedon Nov 8, 2026
repo:cloud#2 · os-warren · session_01JQwxbWTyRFQwYN1hZXbCHL
Claim: PM loop round 2 · 2026-11-08T22:56Z
Session:
session_01JQwxbWTyRFQwYN1hZXbCHL(seat); card threadsession_01JQwxbWef7CyzA8S3WtGftGAccount:
os-warrenBranch:
claude/project-thread-n2ti4g(objectstack; the same name in objectstack-ai/cloud only if step 2 shows a cloud change is needed)Worktree:
objectstack-issue-31688Domain:
domain:cloud(repo:cloud)Seat:
repo:cloud#2File surface: objectstack
scripts/pm/check-governed-merges.mjs(theworkflowsrow'ssplit),scripts/pm/check-governed-queue-guard.mjsif the guard needs it, their self-tests; cloud.github/workflows/**only after the thread reports the shape and the seat says go (stop on breach; explain in the report)Container & model: M,
mode:thread,model: CONTRACT_REVIEW_TIER (reason: per-card seat call — the gate decides which cloud PRs need a human, a misread is a governance bypass; dispatch-gates --tier: no path-derived mandate),effort: xhighClause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (follow-up #31538 item 4, ruling C)
Thread-read: 6727742758
Premise: holds (
split.reposis['objectstack']only incheck-governed-merges.mjson main b126c13, read this round)Serial constraints cleared: no open objectstack PR claimed on
scripts/pm/check-governed-*seen; open cloud PR #3898 edits ten cloud workflow files (content, not identity) — not serial for the H-by-path list; the thread re-checks.Branch is the platform-assigned card-thread branch. Contract review at CONTRACT_REVIEW_TIER owed before any hand-off. Order: /mnt/project-files/pm-orders/cloud/seat2/order-31688.md.
objectstack-fleet commentedon Nov 8, 2026
repo:cloud#2 · os-warren · session_01JQwxbWef7CyzA8S3WtGftG
os-dev-report
{ "issue": 31688, "status": "done", "branch": "claude/project-thread-n2ti4g", "pr": null, "session": "session_01JQwxbWef7CyzA8S3WtGftG", "premise_still_valid": false, "summary": "Ask 2 rests on a precondition cloud does not have: the queue guard cannot read the split on cloud's merge_group, because cloud's merge_group reaches no queue guard at all. On cloud main d8af96b the only merge_group workflow is test.yml (its two required jobs), there is no governed-surface guard, no CODEOWNERS and no scripts/pm guard, and cloud AGENTS.md says in words that no mechanical check guards its governed table and that governed PRs stay draft for the maintainer, with no Tier S arm. objectstack's check-governed-queue-guard.mjs diffs the checkout it lives in (repoRoot = its own tree, no root override; its self-test reads its own guard workflow and CODEOWNERS from that root), so even a cloud workflow that checked out objectstack and ran the guard would diff objectstack's tree. The card's own arm applies: the workflows row stays Tier H in cloud. No code was changed, nothing pushed, no PR. Seat call A (the seat thread), recorded here with the step 1 and step 2 readings; option B (a cloud guard, then the split) is noted under out_of_scope_findings, not filed.", "readings": { "measured_against": "cloud origin/main d8af96b (workflow files byte-identical to 2ca78f5); objectstack origin/main b126c130 (carries PR 31628, merge 1a20cbc846); full reading at /mnt/project-files/pm-orders/cloud/seat2/shape-31688.md", "step1_h_by_path_files": [ "deploy-cloud-prod.yml — environment: name: production (L135-136); packages: write (L140); step 'Schema migration — production DB' (L302), then wrangler deploy of the production control plane", "deploy-cloud-staging.yml — packages: write (L146); 'Schema migration — staging DB' (L462); wrangler containers push and wrangler deploy (header L11, L20)", "deploy-objectos-prod.yml — environment: name: production (L137-138); packages: write (L142); step 'Deploy PRODUCTION (wrangler deploy)' (L381)", "deploy-objectos-staging.yml — packages: write (L113); 'Push image via wrangler' (L405) and wrangler deploy", "deploy-staging.yml — the staging deploys' one trigger: uses: ./.github/workflows/deploy-cloud-staging.yml (L242) and deploy-objectos-staging.yml (L266), each with packages: write (L241, L265)", "deploy-heartbeat.yml — pnpm exec wrangler deploy --config wrangler.toml (L115) on every push to main touching apps/heartbeat/**", "release-objectos-ee.yml — push: true to ghcr.io (L167); packages: write and id-token: write (L58-59); cosign sign (L198): the EE release", "migrate-control-db.yml — os_migrate apply --yes (L577) against secrets OS_DATABASE_URL / OS_DATABASE_URL_STAGING (L357-358); packages: write (L259)", "migrate-environment-types.yml — OS_MIGRATE_AND_EXIT=1 schema sync (L186) plus the backfill against DSN_PROD (L137); packages: write (L59)", "migrate-package-categories.yml — 'apply = true: writes the rows' (L21); job 'production approval' with environment: name: production (L125-130); DSN_PRODUCTION (L244)", "provision-p0.yml — 'apply Cloudflare zone-level controls (WAF rate-limit + Logpush)' (L3) with secrets CLOUDFLARE_API_TOKEN (L40); bash apps/cloud/scripts/provision-p0.sh (L45)" ], "step1_not_pinned": [ "half-state-patrol.yml — top-level permissions issues: write (L128) makes the workflow owner a write owner whose serialization is the whole file, so ANY edit reads H by content already (seen in the replay)", "queue-red-card.yml — job card issues: write (L57), an owner; top-level permissions is empty", "test.yml — the required-check gate: a job rename is a check-run name change (H), the draft gate is a job-level if (H), daily-red-card issues: write (L1287) and the TURBO_TOKEN steps are owners; a timeout, path-filter or comment edit reads S, the ruling's intent", "install-kit-acceptance.yml — packages: read (L66); helm install on a throwaway kind cluster (L284, L304): a test harness, not a deploy; github.token login steps are credential owners", "install-kit-offline-bundle.yml — rehearsal on pull_request, no secret, no write", "neon-rtt-probe.yml — read probe; packages: read 'pull (never push)' (L94); the staging DSN step is a credential owner", "verify-objectos-ee-image.yml — push: false (L140), load: true", "actionlint.yml, eval-golden-prompts.yml, golden-journey.yml, perf-probe.yml, pin-smoke.yml — read-only grants; secret-holding steps are credential owners" ], "step1_pr_3898": "open cloud PR 3898 edits 10 workflow files: the 4 deploy-*, the 3 migrate-*, release-objectos-ee (all on the list) plus neon-rtt-probe and verify-objectos-ee-image (not on it). File identity decides the list, so it is not serial with this card — confirmed. Its edits to the two unpinned files would read H by content anyway (changed steps holding github.token / FRAMEWORK_READ_PAT).", "step2_queue_guard_shape": [ "cloud main has 23 workflows and no governed-surface guard; .github/ holds no CODEOWNERS and no actions/; scripts/pm/ holds only ensure-pinned-framework.mjs; package.json has no governed gate and scripts/check-all.mjs names none", "the only cloud workflow with a merge_group trigger is test.yml (types: checks_requested); its jobs typecheck-and-gates and build-and-test are the ruleset's required checks (ruleset main 20184398, cloud AGENTS.md rule 7); nothing in them reads the register", "cloud AGENTS.md, governed section, verbatim: 「本仓没有任何机械检查在守这条规则 … report-only 的 governed-merges 审计存在于 sibling 仓 objectstack … 它只审计那个仓,没有跨仓覆盖到这里 … 本仓也没有 CODEOWNERS」; governed PRs 「保持 draft,等维护者人工合并」; no Tier S arm exists", "objectstack check-governed-queue-guard.mjs: repoRoot = resolve(scriptDir, '..', '..') (L670) — it diffs its own checkout; GITHUB_REPOSITORY picks the register rows only (guardRepository L1121, a cloud slug resolves to cloud, pin L3126); there is no root override, and the self-test reads .github/workflows/governed-surface-guard.yml and .github/CODEOWNERS from the same root (L4427, L5419)", "what reads a cloud diff today: the path-only post-merge sweep (check:pm-governed-merges via the sibling checkout ../cloud; classifyCommit hands testVerdict no workflowDiff, so every cloud workflow merge lists as Tier H); --pr objectstack-ai/cloud#N reads the diff only on a checkout that IS cloud (pullWorkflowDiff sameCheckout, i.e. --root CLOUD_CHECKOUT holding both commits), else NOT MEASURED = H; --branch REF --root ../cloud would read it. Each moves the tier only once split.repos names cloud", "cloud's framework pin .objectstack-sha = 6ed533f6 (2026-11-08 14:36Z) predates PR 31628: its check-governed-merges.mjs has 0 hits of readWorkflowDiff; test.yml checks out objectstack at that pin (L298-303)", "objectstack's own self-tests pin today's state in words: merges L5334 'the-same-reading-moves-nothing-in-objectui-or-cloud-whose-guards-have-no-split-arm'; queue guard L5480 'objectui-and-cloud-stay-Tier-H-on-the-same-reading-the-split-names-objectstack-alone'", "therefore: reading the split on cloud's merge_group needs a governed cloud workflow (a new guard, or a step in test.yml's required typecheck-and-gates), an objectstack queue-guard root override that keeps the self-test's own-tree reads, a pin bump or a main checkout, pull-requests: read for the token, a cloud AGENTS.md Tier S arm (a Tier H edit), and a ruleset edit if the guard is a new workflow — every leg maintainer-gated" ], "replay": "cloud main, first-parent merges since 2026-10-08 (clone deepened to 2026-10-05): 591 merges, 49 touched .github/workflows/** (15 workflow-only, 34 mixed). Driving objectstack main's readWorkflowDiff over each (base = first parent, inventory = first parent) with the 11-file list applied: 7 S, 42 H; 20 of the 42 are H by the pin list alone, content otherwise S. Top content reasons: a changed owner holding a secret or write token 74, an existing job lost a gate token 73, a gate invocation dropped 72, a credential line moved 48, an if: in an existing job 38. The ruled split (deploys stay H) would relieve about 7 cloud merges a month. S merges: cloud PRs 3627, 3243, 3079, 3056, 2823, 2752, 2695. Instrument: a read-only node script in the card thread's scratchpad importing check-governed-merges.mjs from the objectstack checkout at b126c130 and driving git against the cloud checkout; not committed." }, "tests": "none run and none owed: no code changed. The replay instrument above is a reading, not a test; exit 0, 49 rows read, 0 unmeasured.", "gates": "none owed: no diff (dispatch-gates --commands has nothing to derive); no self-test touched. NOT MEASURED by design.", "dogfood_battery": "n/a — no PR", "mcp_calls": "0 — no GitHub MCP tool was called. REST reads via gh api: issues 31688 and 31538 with comments, PR 31628 with files, comments 6724981811 6725398109 6725802382 6728321351, cloud PR 3898 with files, open cloud PRs list.", "api_writes": "1 — POST repos/objectstack-ai/objectstack/issues/31688/comments (this report, through post-stamped.mjs). No git push, no label, no PR.", "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "cloud governed-surface guard + split (option B of shape-31688.md): a cloud guard workflow or a step in test.yml's required job, an objectstack queue-guard root override, a pin bump, a cloud AGENTS.md Tier S arm and a ruleset edit, then cloud into split.repos with the 11-file list above — only if the maintainer names it (a new gate in cloud; relief about 7 merges a month against two maintainer-merged governance PRs and one guard job per queue run). carrier: none · noted, not filed", "class: none (observation) · the objectstack register header says 'objectui and cloud stay Tier H by path' without saying why; the reason measured here (cloud has no queue guard; its guards have no split arm) is in the self-test pin names only. carrier: none · noted, not filed" ] }objectstack-fleet commentedon Nov 8, 2026
repo:cloud#2 · os-warren · session_01JQwxbWTyRFQwYN1hZXbCHL
Closing as not planned · 2026-11-08T23:11Z
The card's own step 2 gives the outcome: "The queue guard must read the split on cloud's
merge_groupthe same way, or the row stays H there." The thread measured that cloud'smerge_groupreaches no governed-surface guard at all (onlytest.yml's two required jobs; the objectstack queue guard diffs its own checkout and has no root override; cloud's pin predates PR #31628). So theworkflowsrow stays Tier H in cloud andsplit.reposstays['objectstack']. No code changes.pm-orders/cloud/seat2/shape-31688.md.pm:dispatchedremoved in the same stroke.