Repository navigation
workflows split reader: .github/actions feeds the in-use inventory ungoverned, and gate spellings it cannot see #31689
Description
domain:skills#2 · zhuangjianguo · session_01QsR2jT34CXs5fCn3BDirZw
Filing gate: (b) a follow-up a review names. Contract review of PR #31628 (card #31538, merged 1a20cbc): nit N3 in record 6724981811 and nit N5 in record 6725802382. ⛔ Not a claim.
维护者速读
PR #31628 让 objectstack 的工作流改动按 diff 判 Tier S 或 H。复核留下两处读法缺口，今天都没被利用：一是 .github/actions/** 不受管，却被算作「已在用的 action」清单；二是有几种门禁写法读法认不出。这张卡补上这两处，或明确写成已知限度。
What
- N3.
scripts/pm/check-governed-merges.mjsL2074 (main a2d0f73) countsuses:under.github/actionsas already in use..github/actions/**is not a register row. So an ungoverned composite-action edit can bring in a third-party action, and a later workflow edit can then adopt it at Tier S. - N5.
WORKFLOW_INVOCATIONS(L1637) has no pattern forgit diff --exit-code,npx, ornode/bashon a path outsidescripts/. A gate written that way is not tracked per job, so moving it out of its job reads S. No gate on main is written that way today.
Ask
- N3: either make
.github/actions/**a register row (that is a ruling: a decision card first, per [Decision] Keepdomain:devxanddomain:serveras separate lanes, or merge them? Measured load and boundary friction, 2026-11-08 #31424 rule 6) or drop it from the in-use inventory. Recommend the second, since it needs no ruling and only adds H. - N5: widen
WORKFLOW_INVOCATIONSto those spellings, or name them in the header as a known limit next to the run-text limit. Pin whichever it is.
Activity
objectstack-fleet commentedon Nov 8, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage:
domain:skills· p2 ·pm:queue· 2026-11-08T22:03Z⛔ Not a claim.
domain:skills, forscripts/pm/check-governed-merges.mjs, the [Decision · ruled C].github/workflows/**landing: split workflow PRs, keep high-risk edits Tier H, move the rest to Tier S #31538 reader (internal rules, [Decision] Keepdomain:devxanddomain:serveras separate lanes, or merge them? Measured load and boundary friction, 2026-11-08 #31424 rule 6)..github/actions/**from the in-use inventory) only adds H and needs no ruling..github/actions/**a governed register row is a rule change (「新增门禁默认否」), so it needs a decision card first. Triage does not file one unasked.finding→ graded.Generated by Claude Code
objectstack-fleet commentedon Nov 8, 2026
domain:skills#2 · zhuangjianguo · session_01QsR2jT34CXs5fCn3BDirZw
Claim: PM loop round 15 · 2026-11-08T22:11Z
Session:
session_01QsR2jT34CXs5fCn3BDirZwAccount:
zhuangjianguo(the seat's linked user; the card's assignee)Branch: the card thread's designated branch, named by claim amendment once the thread reports it (a measured platform exception to
claude/issue-<n>-<slug>)Worktree:
objectstack-issue-31689Domain:
domain:skillsSeat:
domain:skills#2File surface:
scripts/pm/check-governed-merges.mjs(code, header, self-test) (stop on breach; explain in the report)Container & model:
S,mode:thread,model: TIER_DEFAULT(ungovernedscripts/pm; lane seat lands on ACCEPT),effort: mediumClause-②: no
Metadata-protocol: none
Responsibility: the workflows split reader (#31538 C) | review nits N3 (6724981811) and N5 (6725802382):
.github/actionsvouches for actions in the in-use inventory; some gate spellings are not tracked per jobThread-read: 6727747499
Premise: holds. On
main9bf32864L2074 lists.github/actionsin the inventory andWORKFLOW_INVOCATIONS(L1637) has nogit diff --exit-code/npx/ non-scripts/node or bash pattern.Serial constraints cleared: no open PR edits
check-governed-merges.mjs; #31687 waits for this card.Dispatch order: pasted verbatim into the card thread's opening message (common rules + order, from the seat folder
skills-seat-2/of the project files). Writes: PR only via relaypr_create; comments, labels and bodies only viascripts/pmwrite tools; no GitHub MCP writes.objectstack-fleet commentedon Nov 8, 2026
domain:skills#2 · zhuangjianguo · session_01QsR2jT34CXs5fCn3BDirZw
Claim amendment · 2026-11-08T22:14Z · amends Claim 6727843748 (same session). Branch:
claude/project-thread-c5qolp(the card thread's designated branch, a measured platform exception toclaude/issue-<n>-<slug>; dev sessionsession_01QsR2jSxQuMCd6U7w4Rj8jd). Nothing else changes.objectstack-fleet commentedon Nov 8, 2026
domain:skills#2 · zhuangjianguo · session_01QsR2jSxQuMCd6U7w4Rj8jd
os-dev-report
{ "issue": 31689, "status": "done", "branch": "claude/project-thread-c5qolp", "pr": "https://github.com/objectstack-ai/objectstack/pull/31713", "head": "e60354d1a", "session": "session_01QsR2jSxQuMCd6U7w4Rj8jd", "premise_still_valid": true, "files_changed": ["scripts/pm/check-governed-merges.mjs"], "diff": "+54 / -9, 1 file", "self_test": { "before": 609, "after": 618, "battery_floor_workflows_split": "66 -> 75", "floor_probe_76": "red, registered 75" }, "new_pins": [ "⛔ N3-a-workflow-adopting-an-action-used-only-under-github-actions-on-the-base-is-H", "N3-control-an-action-a-base-workflow-already-uses-is-S", "⛔ N5-a-gate-spelled-git diff --exit-code -- packages/spec/json-schema-moved-out-of-its-job-is-H", "⛔ N5-a-gate-spelled-git diff --quiet -- sdui.manifest.json-moved-out-of-its-job-is-H", "⛔ N5-a-gate-spelled-npx publint-moved-out-of-its-job-is-H", "⛔ N5-a-gate-spelled-npx @arethetypeswrong/cli-moved-out-of-its-job-is-H", "⛔ N5-a-gate-spelled-node ui/e2e/check-gate.mjs-moved-out-of-its-job-is-H", "⛔ N5-a-gate-spelled-bash tools/verify.sh-moved-out-of-its-job-is-H", "N5-near-miss-an-npx-version-bump-and-a-dropped-dot-slash-are-S" ], "kept_pin": "near-miss-a-new-job-with-a-fresh-name-and-its-own-if-is-S stays S", "pins_fail_on_old_code": "7 of 7 new H pins fail in a scratch copy with the old dir list and without the 3 new patterns; nothing else fails", "replay": { "named_13_from_pr_31628": { "S_before": 13, "S_after": 13, "verdicts_changed": 0, "reasons_changed": 0, "whole_pr_tier_changed": 0 }, "last_40_workflow_merges_before_1a20cbc846": { "S_before": 16, "S_after": 16, "verdicts_changed": 0, "reasons_changed": 0 }, "old_reader": "e81636ce", "new_reader": "e60354d1a" }, "gates": "dispatch-gates --commands derived 33; 33 exit 0 at e60354d1a; --ran: 33 derived, 33 run, 0 NOT-MEASURED, 0 UNRUN; eslint exit 0", "extra_self_tests": "check-governed-queue-guard 433 cases exit 0; check-governed-prose, check-owed-reviews, check-half-states, check-skill-line-ratchet, ci-failure, post-stamped exit 0", "deviations": [ "the first commit dropped .github/actions from the ls-tree argv and broke check-governed-queue-guard's read-once pin (outside the file surface); the second commit keeps the argv and filters in the reader; dispatch-gates does not derive that self-test for this diff", "replay window: the dev's 13 are matched by PR; the last-40 window holds 4 newer S merges (31429, 31544, 31282, 31329) and not 27018" ], "dogfood_battery": "n/a — no ! in the title and no (narrowing) arm", "mcp_calls": "8 — reads only: issue_read x4, get_session x1, pull_request_read x1, ToolSearch-loaded tools not counted", "api_writes": "3 — git push x3 (not REST), relay pr_create x1 (dispatch 204), this comment via post-stamped", "security_findings": "none", "out_of_scope_findings": ["carrier: check-governed-queue-guard.mjs owner · the read-once pin spells .github/actions in the inventory argv; dropping it from the argv is a one-line pin edit there · noted, not filed"] }Generated by Claude Code
objectstack-fleet commentedon Nov 9, 2026
domain:skills#2 · zhuangjianguo · session_01QsR2jT34CXs5fCn3BDirZw
Landed · 2026-11-09T00:32Z — PR #31713 merged through the merge queue (merge commit 1108509), on the seat's ACCEPT 6728445787 (ungoverned
scripts/pm,TIER_DEFAULT)..github/workflows/**only. An action used only under.github/actions/**on the base vouches for nothing, so a workflow that adopts it reads H.WORKFLOW_INVOCATIONSnow tracksgit diff --exit-code/--quiet(arguments kept),npx X(version dropped) andnode/bash/shon any file path. Moving one of these out of its job reads H. The header names the spellings still untracked.Self-test 609 → 618; replay unchanged (13 S, last 40 workflow merges 16 S).
pm:dispatchedremoved. Nothing left on this card.