[objectstack-fleet]

Requested by Steedos · project thread

Fixes #31689

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：工作流按 diff 判档的读法补两处缺口。一是「已在用的 action」清单只认 .github/workflows/**，不再认不受管的 .github/actions/**；二是门禁写法多认四种（git diff --exit-code / --quiet、npx X、node / bash / sh 跑任意路径的脚本），这类门禁被挪出原 job 时判 H。
• 为什么改：PR feat(pm): the workflows row lands Tier S unless its diff trips a release path or a C2 trigger #31628 的复核（N3、N5）指出，先在 .github/actions/** 里引入第三方 action、再让工作流采用它，会被判成 Tier S；以那几种写法写的门禁被挪走也认不出。今天都没被利用。
• 风险与回滚：只会让更多工作流改动判 H，不会让任何改动从 H 变 S。重放 feat(pm): the workflows row lands Tier S unless its diff trips a release path or a C2 trigger #31628 名单里的 13 个 Tier S 合并和近 40 个工作流合并，判档一个没变。回滚即 revert 本 PR。
• 先看：scripts/pm/check-governed-merges.mjs 的 WORKFLOW_INVOCATIONS（新增三条模式）与 readWorkflowDiff 里清单那一行，再看 self-test 里 N3 / N5 两组新 pin。
• 两分钟验证：node scripts/pm/check-governed-merges.mjs --self-test，预期 618 assertions 且退出 0。
• 需要你做的：无，席位落地。

What changes

• N3. readWorkflowDiff builds the "already in use" inventory from .github/workflows/** files only. .github/actions/** is not a register row, so an action used there alone no longer lets a workflow adopt it at Tier S. The listing argv is unchanged, because check-governed-queue-guard.mjs pins it as read once per run by its exact argv; the reader drops every path outside .github/workflows/ before reading one. .github/actions/** is not made a register row (that is a ruling).
• N5. WORKFLOW_INVOCATIONS gains three spellings, so the per-job loss rule tracks them:
  • git diff ... --exit-code / --quiet, with its arguments kept in the token, since a narrowed pathspec is a narrowed gate;
  • npx X, with the package's version dropped, since a version bump is not a lost gate;
  • node / bash / sh on the first file path after them, with any path prefix, not only scripts/.
• The header's C2 line says .github/actions/** vouches for nothing. The run-text known limit now lists the tracked spellings and names the ones still untracked (python3 -c, /bin/bash x.sh, an inline test, a bin that pnpm exec names).
• No change to the six H-by-path files, the split repos, or any .claude/** or AGENTS.md text. A grep found no line there that says the inventory includes .github/actions.

Tests

• node scripts/pm/check-governed-merges.mjs --self-test: 609 assertions before, 618 after, exit 0. The workflows split battery floor rises from 66 to 75. Floor 76 reds with "registered 75 case(s), below its pinned floor of 76".
• New pins:
  • ⛔ N3-a-workflow-adopting-an-action-used-only-under-github-actions-on-the-base-is-H
  • N3-control-an-action-a-base-workflow-already-uses-is-S
  • six ⛔ N5-a-gate-spelled-TOKEN-moved-out-of-its-job-is-H cases: git diff --exit-code -- packages/spec/json-schema, git diff --quiet -- sdui.manifest.json, npx publint, npx @arethetypeswrong/cli, node ui/e2e/check-gate.mjs, bash tools/verify.sh
  • N5-near-miss-an-npx-version-bump-and-a-dropped-dot-slash-are-S
• The existing fresh-token near-miss pin (near-miss-a-new-job-with-a-fresh-name-and-its-own-if-is-S) stays S.
• The self-test's fake git ls-tree now honours its pathspecs, as git does, so the inventory's directory reading is under test.
• One-time check in a scratch copy, not committed: with the old directory list and without the three new patterns, the 7 new H pins fail and nothing else does.
• check-governed-queue-guard.mjs --self-test exits 0 (433 cases). check-governed-prose, check-owed-reviews, check-half-states, check-skill-line-ratchet, ci-failure and post-stamped --self-test each exit 0.

Acceptance notes

• Replay. Old reader (main e81636ce) against new reader (this head), with each merge read against its first parent as readWorkflowDiff does:
  • The 13 Tier S merges named in PR feat(pm): the workflows row lands Tier S unless its diff trips a release path or a C2 trigger #31628 (ci(lint): describe the query-options test ratchet as one-sided #27115, ci(filter): start the jobs that run setup-workspace, setup-pnpm and .nvmrc on a diff confined to them #27709, ci(scaffold-e2e): give the image run an explicit database (Refs #30120) #30714, ci(test-core): build declarations on one CLI slice only — pin the CLI's declaration readers into slice 1/n #27018, ci(fleet-patrols): prose and comments stop naming the four retired patrol workflow files #27122, refactor(ui-types): one source for the filter-builder field-type list; close the three K4 review should-fixes #27400, fix(turbo): hash the ui tree root build and test inputs in the root turbo.json; guards read the live config #27571, ci: schedule the ui jobs, Build Docs and Test Core for the root inputs they read (package.json, five ui test inputs) #28089, feat(console): installable desktop PWA with an offline app shell and a push-ready Service Worker #29326, ci(live-e2e): derive the Live E2E UI ceiling from its first population (40 → 45) and pin it; the saved-view-filter header names the workspace backend #30869, chore(ci): census the call sites that set the vouched-reference mark #31086, ci(required-contexts): register Dogfood Regression Gate as a required context again #31133, ci(mcp): a diff confined to packages/mcp runs the Console SKILL.md mirror pin #31138): 13 S before and 13 S after. The reasons are byte-identical, and the whole-PR tier is unchanged (refactor(ui-types): one source for the filter-builder field-type list; close the three K4 review should-fixes #27400 and ci(required-contexts): register Dogfood Regression Gate as a required context again #31133 stay H through other Tier H paths).
  • The last 40 first-parent merges touching .github/workflows before 1a20cbc846: 16 S before and 16 S after, 0 verdicts or reasons changed. That window has 4 newer S merges (ci(test): check out Test Core and Test UI at depth 1 and fetch only the history they read #31429, ci(glue): narrow the Merge Queue Triage and Scheduled Full Run Card workflow_run triggers by branch #31544, ci(lint): say the ADR index step reds on a dropped header field #31282, ci(lint): raise the full-history checkout budget from 20 to 25 minutes #31329) and misses ci(test-core): build declarations on one CLI slice only — pin the CLI's declaration readers into slice 1/n #27018, which is older.
• Deviation: the first commit dropped .github/actions from the ls-tree argv. That broke the queue guard's read-once pin (the-inventory-of-the-merge-base-is-read-ONCE-per-run), which sits outside this card's file surface. The second commit keeps the argv and filters in the reader instead. Dropping the directory from the argv as well is a one-line pin edit in check-governed-queue-guard.mjs for whoever owns that file. dispatch-gates does not derive that self-test for this diff.

Verification

• Head e60354d1a (main merged at 204cc46e8). node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 33 commands, and all 33 exited 0. --ran reconciled 33 derived, 33 run, 0 NOT-MEASURED, 0 UNRUN. eslint scripts/pm/check-governed-merges.mjs is clean.

---

Generated by Claude Code

[objectstack-fleet]

domain:skills#2 · zhuangjianguo · session_01QsR2jT34CXs5fCn3BDirZw

维护者速读

• 改了什么：补上 feat(pm): the workflows row lands Tier S unless its diff trips a release path or a C2 trigger #31628 复核留下的两处读法缺口。一是「已在用的 action」清单不再算 .github/actions/**，只认合并基点上工作流里用过的 action，所以只在本地 action 里出现过的第三方 action 被工作流引入时判 H。二是门禁写法认得更多：git diff --exit-code/--quiet（保留参数）、npx X（忽略版本号）、node/bash/sh 跑任意路径的文件；把这些门禁步挪出原 job 一律判 H。仍认不出的写法在头注里点名。
• 为什么改：两处今天都没人用，但都是把危险改动判成 S 的路子（复核记录 6724981811 N3、6725802382 N5）。
• 风险与回滚：只会把更多改动判成 H，不会让任何改动从 H 变 S。回放：原 13 个 S 合并仍是 S，最近 40 个工作流合并 16 个 S 不变，判定和理由零变化。只动 scripts/pm/check-governed-merges.mjs 一个文件。回滚即 revert 本 PR。
• 先看：WORKFLOW_INVOCATIONS 新增的三条、清单读取那一行的过滤、新增的 9 个钉子。
• 两分钟验证：node scripts/pm/check-governed-merges.mjs --self-test（需先 pnpm install），618 条全过。
• 需要你做的：无。未受管的 scripts/pm，席位 ACCEPT 即落地。
• 席位意见：ACCEPT。

席位核对

Head-sha: e60354d1a45c78dfb5c20ae9e7c9f7147c4e9670

1. Shape: draft, base main, body carries Fixes #31689, skip-changeset. 1 file (scripts/pm/check-governed-merges.mjs, +54 −9), inside the claim's file surface. Ungoverned: TIER_DEFAULT, the seat's ACCEPT. No .claude/** or AGENTS.md text names the inventory's directories.
2. Premise measured: on main 9bf32864 L2074 counted .github/actions in the in-use inventory, and WORKFLOW_INVOCATIONS had no git diff --exit-code, npx or non-scripts/ node/bash pattern.
3. Code read: the inventory keeps the ls-tree argv and filters on WORKFLOWS_PREFIX, so the queue guard's read-once pin stands unchanged. Every change only adds H reasons: new tokens can only be lost (H), never vouch for anything. The npx version strip and the ./ normalisation keep a version bump or a path respelling S (near-miss pin). The fake ls-tree now honours pathspecs, so the inventory pin tests the real directory list.
4. Gates: dev: 33 derived, 33 exit 0, --ran 0 NOT MEASURED; self-test 609 → 618, battery floor 66 → 75; the 7 new H pins fail on the old code. The seat ran the queue-guard self-test (433 pass) and the relay's (306 pass) at this head. The merges self-test needs node_modules (exit 3, prerequisite) in this container, so its verdict is CI's Lint · scoped · tooling self-tests on this head; auto-merge waits for it. Replay: 13 → 13 S, last 40 workflow merges 16 → 16 S, 0 changes. K = 0.
5. Accepted deviations: the .github/actions drop is a filter, not an argv change, to keep the guard's pin. Still-untracked spellings (python3 -c, /bin/bash x.sh, inline test/[, pnpm exec bins) are named in the header beside the run-text limit.
6. Landing: ungoverned, seat lands. pr_ready + automerge_enable on this head. Serial: fix(pm): the relay reads the workflows split before requesting governed review #31710 imports readWorkflowDiff from this file but does not edit it; workflows split: extend the Tier S/H diff reading to objectui (#31538 item 4) #31687 is dispatched after this lands.