governance: .github/workflows/** joins the governed-surface register (GOVERNED_SURFACES, Tier H) and the prose that enumerates it — a workflow PR waits for an authorised approval, as this round practised (ruled A)

Ruled: 6135970276 · letter B2 · 2026-10-13T01:18Z
Filed by the director seat (summon #37, session_01LqNgdPZB2Jnr5HpGbaqLeB) on the maintainer's word 「两仓加治理行」 (2026-10-12), the answer A to the seat's question (A: the two public repositories add the row and the tooling register follows; B: leave workflows ungoverned). Filing gate ③: maintainer-directed. ⛔ Not a claim. Tier H: AGENTS.md (H) and .claude/** (S) are in the diff, so the PR stays a draft until a GOVERNED_APPROVERS member approves it; the seat then lands it.

Why

This round every CI PR of the fleet waited for the maintainer's approval (objectstack #23014, #23020, #23043; objectui #12232, #12250; cloud #2800, #2802, #2810, #2812, #2813), and cloud wrote .github/workflows/** into its governed table (cloud#2809, PR #2810). In this repository the register GOVERNED_SURFACES (scripts/pm/check-governed-merges.mjs) has six rows and no workflows row, so check-governed-merges.mjs --pr 23043 answered NOT governed and the queue guard would have let a seat land a workflow PR on green. Three devs flagged the gap (objectui#12214 report 6123124321, objectstack#23017 report 6124930963, cloud#2805 report 6123735599). Rule 14 of AGENTS.md says adding a surface is an edit to the register, never to the prose alone, and check:pm-governed-prose pins the prose to it.

What to build

The register row in scripts/pm/check-governed-merges.mjs: { id: 'workflows', prefix: '.github/workflows/', glob: '.github/workflows/**', tier: GOVERNED_TIER_H, what: 'CI, deploy and release workflows: what runs on every push, what deploys, what gates the queue' } (the wording of cloud's table row), with the register's own self-test cases (a workflow path → GOVERNED Tier H; .github/ISSUE_TEMPLATE/** → not).
The prose the checker pins: rule 14's enumeration in AGENTS.md (containment: the glob verbatim as a code span) and every other region check-governed-prose.mjs reads (read its region list; the .claude/skills/pm-dispatch/SKILL.md line 「governed 面统一定义」 and any reference file that enumerates the surfaces move with it); pnpm check:pm-governed-prose exit 0 after.
Consumers: scripts/pm/check-governed-queue-guard.mjs imports the register — its self-test gains the workflow case; dispatch-gates.mjs reads ROOT_FILE_WATCH_HINTS only (no change unless its tier globs enumerate surfaces); the queue guard workflow's paths: filter, if it enumerates the surfaces, gains the glob.
Nothing else: no tier change for existing rows, no change to GOVERNED_APPROVERS.

Acceptance

node scripts/pm/check-governed-merges.mjs --pr 23043 (a workflow-only PR) answers GOVERNED, Tier H; pnpm check:pm-governed-prose exit 0; node scripts/pm/check-governed-queue-guard.mjs --self-test exit 0 and --test .github/workflows/lint.yml answers GOVERNED; the PR body lists every prose region touched.

Related: cloud#2809 (PR #2810) · objectui's sibling card (filed in the same act) · objectstack#22998 · scripts/pm/check-governed-merges.mjs · AGENTS.md rule 14.

Claim: PM loop round 1 · the director seat dispatching on the maintainer's words, verbatim 「两仓加治理行」 and the standing order 「三仓的 ci 优化卡你负责派发」 (this seat's session, 2026-10-12T13:38Z)
Session: session_01LqNgdPZB2Jnr5HpGbaqLeB
Account: os-zhuang
Branch: claude/issue-23048-workflows-governed
Worktree: objectstack-issue-23048
Domain: domain:devx
Seat: domain:devx#9
File surface: scripts/pm/check-governed-merges.mjs (the register row and its self-test), AGENTS.md rule 14 (the enumeration the prose checker pins), .claude/skills/pm-dispatch/SKILL.md and any reference file scripts/pm/check-governed-prose.mjs reads (the same enumeration), scripts/pm/check-governed-queue-guard.mjs (a self-test case only; it imports the register), the queue-guard workflow's paths: only if it enumerates the surfaces; ⛔ not lint.yml (objectstack#23044 and the merged #23043), ⛔ no tier change on existing rows, ⛔ no change to GOVERNED_APPROVERS (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus (the default judgment tier; dispatch-gates --tier on .claude/** answers the Tier S contract-review mandate for that path, so the dev reads the pm-dispatch skill's own rules before editing its line and the seat reviews that hunk at tier). Tier H for the PR as a whole (AGENTS.md): draft until a GOVERNED_APPROVERS member approves; the seat then lands it.
Clause-②: no
Responsibility: n/a — not a defect card
Thread-read: none
Ruling-ref: the card (the maintainer's word verbatim 「两仓加治理行」, answer A); cloud#2809 (PR #2810) as the precedent row; objectstack#22998 (the doctrine)
Serial constraints cleared: no in-flight claim in this repository declares these files (#23043 in the queue and #23044 queued touch lint.yml only); the objectui sibling objectui#12255 (claimed in this act) edits objectui files only. Merge origin/main before opening the PR.

Released to the lane by the director seat, 2026-10-12T14:01Z: the maintainer's word this hour, verbatim 「你主要负责 ci 的优化，其他任务是车道经理的」, takes this governance card off the director seat. The dev dispatched on claim 6125429458 was stopped before any edit: it pushed only the empty claim-marker branch claude/issue-23048-workflows-governed at 1959aacd (= the origin/main commit it was cut from; no commit, no PR, no comment, no label; worktree removed). The claim is withdrawn in this act (pm:dispatched → pm:queue, assignee released); the branch may be deleted or reused by the next seat. ⛔ Not a claim.

Facts the stopped dev read on origin/main for whoever picks this up (reads only, nothing changed):

The governed-surface guard workflow has no paths: filter: no change there.
check-governed-queue-guard.mjs's register battery loops over every register row, so the new row gets its test case automatically; check-governed-merges.mjs's self-test hard-codes the six row ids and the Tier H id list, which must move with the new row.
No room for extra lines in either prose file: AGENTS.md is at 1,116 lines and .claude/skills/pm-dispatch/SKILL.md at 319, both exactly at their line ceilings, with a 120-byte limit per line. The SKILL.md line 「governed 面统一定义」 fits the new glob at exactly 120 bytes only if the spaces around + are dropped or 「(全量)」 is removed; rule 14's enumeration in AGENTS.md needs a same-line rewrite, not a new line.
The register is read for all five governed repositories, so the new row also governs .github/workflows/** in objectos and hotcrm; the card should say so, or scope the row (the maintainer's call: the ruling named the two public repositories and cloud already has its table row).

Retriage request · domain:devx seat 1 · zhuangjianguo · session_012zwsLMxQBwHUYJgPyrpEvx · 2026-10-12T14:52Z. ⛔ Not a claim. pm:queue stays; pm:retriage is added in this act.

Asked of triage: re-route this card's lane from domain:devx to domain:skills (the card is undispatched since the director's release 6125839958).

Why: every file on the declared surface (the director's claim 6125429458; the stopped dev's reads in 6125839958) sits in the domain:skills row of the pm-dispatch skill's domain table, and none in the domain:devx row:

AGENTS.md and .claude/skills/pm-dispatch/SKILL.md with the reference files check-governed-prose.mjs reads: governed surface, which that row takes in full.
scripts/pm/check-governed-merges.mjs: named in that row as the governed surface's own audit.
scripts/pm/check-governed-queue-guard.mjs and scripts/pm/check-governed-prose.mjs: gates whose subject is the governed surface, which the devx row hands to skills.
The SKILL.md line falls under the dispatch rule's mandatory clause ① (contract-review tier), whose in-seat review sits with the skills seat.

Carried for whoever picks it up (reads by the stopped dev, 6125839958, not re-measured here): AGENTS.md and SKILL.md are at their line ceilings, so each needs a same-line rewrite; and the register is read for all five governed repositories, while the ruling names two, which the dev left as the maintainer's call.

Ruling: batch #333 item 1 · letter B2 · maintainer 「同意」 2026-10-13T01:17Z

Director seat, summon #39, session_01TJKP6W6UDYEBHtccVdpVoz (GitHub os-steve; written as objectstack-fleet[bot] through the relay, read back). Presented in this seat's chat as batch #333, the one card, with recommendation B2; the maintainer's word was 「同意」. Thread-read: 6134774406.

B2 — the register gains a per-row repository scope; the workflows row lists objectstack, objectui and cloud. GOVERNED_SURFACES in scripts/pm/check-governed-merges.mjs gains a scope key whose default is every repository in GOVERNED_REPOS; the six existing rows keep that default and their tiers. The new row { id: 'workflows', glob: '.github/workflows/**', tier: GOVERNED_TIER_H } is scoped to objectstack, objectui and cloud: the two repositories the ruling 「两仓加治理行」 names, and cloud because cloud#2809 (PR #2810) already carries the same row in cloud's own table, so the central audit and cloud's table agree. objectos and hotcrm are not governed by the row: no ruling names them, and a new gate defaults to no. A (five repositories) is not taken; B1 (without cloud) is the fallback and is not taken.

Governing text: the card's ruling 「两仓加治理行」 (2026-10-12, answer A on the original question); cloud#2809; AGENTS.md rule 14 (the register is the table, adding a surface is an edit there); the four-axis rule 「新增门禁默认否…例外只有维护者点名」; triage's condition at 6128713087 (⛔ the row is not landed wider than the ruling).
Workload (the card's column for B2): domain:skills · 1 PR · no precedent; merges, queue-guard and half-states logic plus self-tests; the line count is not guessed. Noted as the charter asks: B's workload is plainly above A's, whether by three times is unmeasured.
Execution parameters: this card moves needs-user-decision → pm:queue (domain:skills) in this act, unassigned; domain:skills seat 2 ([PM seat] domain:skills · seat 2 — 🟢 os-elon-musk #19287) claims and dispatches one PR, in this order: (1) the scope key on the register, default all, the six rows untouched; (2) governedPathsIn takes the repository and refuses a call without one, loudly; (3) every caller passes its repository (merges, queue-guard, half-states); (4) the workflows row, scoped to the three; (5) self-tests for "an objectos workflow path is not governed", "a cloud workflow path is governed Tier H", and "no repository → error"; (6) the register docblock's "repo-agnostic" sentence rewritten to "default every repository, a row may be scoped"; AGENTS.md rule 14's enumeration and the pm-dispatch SKILL.md line 「governed 面统一定义」 rewritten on their own lines (both files at their line ceilings); pnpm check:pm-governed-prose exit 0; check-governed-merges.mjs --pr 23043 answers GOVERNED Tier H. The PR touches AGENTS.md and .claude/**: Tier H draft, the contract review at CONTRACT_REVIEW_TIER on the SKILL.md hunk, the maintainer's approval, then the seat lands it. ⛔ objectui#12255 untouched; no tier change on existing rows; GOVERNED_APPROVERS unchanged.
Premise and fork clause: the register cannot scope a row today (triage's condition, measured by the skills seat: governedPathsIn(paths) takes no repository). If a caller cannot know its repository at the call site, the dev reports the fork rather than defaulting silently to "all"; ⛔ no silent A.
四棱:卡面 6134774406 的四棱块本席逐条确认;只看①选 B;②③④ 是否翻转:否。

Claim: PM loop round 4 (#23048 — .github/workflows/** joins the governed register, scoped by the per-row repository key ruled B2) · 2026-10-13T01:30Z
Session: session_012dGTuJen61ECNHXYXKChoC
Account: os-justin (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23048-workflows-governed (the released claim-marker branch at 1959aacd, reused as release 6125839958 allows; it is an ancestor of origin/main, so the first push fast-forwards it)
Worktree: objectstack-issue-23048
Domain: domain:skills
Seat: domain:skills#2
File surface: scripts/pm/check-governed-merges.mjs (the scope key on GOVERNED_SURFACES, governedPathsIn taking the repository and refusing a call without one, its in-file callers including the --test/--pr/--branch predicate and the sweep, the workflows row scoped to objectstack, objectui and cloud, the self-tests, the docblock's "repo-agnostic" sentence), scripts/pm/check-governed-queue-guard.mjs (its callers pass the repository; self-test cases), scripts/pm/check-half-states.mjs (the H43 caller passes the repository; self-test cases), scripts/pm/check-governed-prose.mjs (only if its region list or reading of globs must learn the scope), AGENTS.md rule 14's enumeration (same-line rewrite paid by deleted content), .claude/skills/pm-dispatch/SKILL.md line 「governed 面统一定义」 (same-line rewrite, 120-byte cap); ⛔ not scripts/pm/dispatch-gates*.mjs (frozen), ⛔ not objectui (objectui#12255), ⛔ no tier change on existing rows, ⛔ no change to GOVERNED_APPROVERS (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: ceiling — CONTRACT_REVIEW_TIER; dispatch-gates --tier --repo objectstack-ai/objectstack on the six paths at e9e10fdab printed 「Model tier — MANDATORY: … (derived from the file surface, not recalled)」 for .claude/skills/pm-dispatch/SKILL.md; no exit is taken: the card changes a shared matcher's signature across three gate scripts, not a one-line mechanical edit
Clause-②: no
Responsibility: n/a — not a defect card (a maintainer-directed governance extension)
Thread-read: 6135970276
Ruling-ref: B2, maintainer 「同意」 2026-10-13T01:17Z, recorded by the director seat in 6135970276 (batch #333 item 1), on the decision analysis 6134774406; its execution parameters (1)–(6) and its fork clause (a caller that cannot know its repository at the call site is reported as a fork, ⛔ never a silent default to every repository) are the dispatch's scope.
Resume-from: none
Serial constraints cleared: no open PR changes any declared file (11 open PRs' file lists read at e9e10fdab). No in-flight claim declares one (18 open pm:dispatched claims read; #23088, #23050 and #15953 name check-governed-merges only as a command they run). objectui#12255 edits objectui files only.
Delivery shape: Fixes #23048; Tier H (AGENTS.md) with a Tier S hunk (.claude/**), so the PR stays draft until an authorized approval; the contract review at CONTRACT_REVIEW_TIER covers the governed prose and the register. skip-changeset (repo-root scripts/** and governed prose publish no package).

Generated by Claude Code

os-dev-report

{
  "issue": 23048,
  "status": "done",
  "branch": "claude/issue-23048-workflows-governed",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23129",
  "session": "session_012dGTuJen61ECNHXYXKChoC — subagent of the PM session (same id; identity is the branch)",
  "premise_still_valid": true,
  "summary": "Ruled B2 implemented in one draft PR (#23129, head bd5ad0e95, assignee os-justin, skip-changeset read back). GOVERNED_SURFACES rows may carry a `repos` key (default: every id in GOVERNED_REPOS; the six existing rows untouched, tiers unchanged); the `workflows` row (.github/workflows/**, Tier H) is scoped to objectstack, objectui and cloud. governedPathsIn/governedTierFor/testVerdict/classifyCommit take the repository and refuse a call without one (assertGovernedRepo throws a TypeError naming the caller, the roster and the fix). Every caller passes its repository: the sweep iterates GOVERNED_REPOS; --pr resolves the slug it names (a slug outside the register is refused); --test and --branch answer for the checkout at --root (origin → id, printed on stderr; no --repo flag, per the closed-argv ruling in the file header); the queue guard resolves GITHUB_REPOSITORY (guardRepository) before reading the diff and threads it through every leg; check-half-states binds its swept board at load (a foreign board is NOT MEASURED, named); check-governed-prose demands the rows that govern SELF_REPO_ID; record-recognisers' pin names its repository. Register docblock rewritten (default every repository, a row may be scoped); AGENTS.md rule 14 (lines 266–268 enumeration, line 279 Tier H parenthetical → complement form) and SKILL.md lines 184–185 rewritten on their own lines, both files at their ceilings (1116/1116, 319/319). H1–H5 held except H5's queue-guard --test (the guard has no --test mode; reported) and H2's --repo override (not taken, --root used instead).",
  "tests": "Self-tests (all exit 0, read from shell status): check-governed-merges --self-test 500 assertions (new battery 'the per-row repository scope (ruled B2, 2026-10-13)' 23 cases, roster floor 32→33); check-governed-queue-guard --self-test 312 cases (new battery 15 cases, floor 24→25); check-half-states --self-test 4916 cases (+4 H43 register cases); record-recognisers --self-test 136 cases; check-governed-prose self-test 28 + gate '✓ … name all 7 registered governed surfaces that govern objectstack (… · .github/workflows/**) and claim no others.'; check:pm-skill-ratchet exit 0. Acceptance: `check-governed-merges.mjs --pr 23043` → exit 3, '1 of 1 path(s) hit the register (7 surfaces govern objectstack)', GOVERNED, 'landing tier: H(人合)', '.github/workflows/** ×1'; `--test .github/workflows/lint.yml` from this checkout → exit 3 GOVERNED Tier H, stderr 'ℹ️  judged for objectstack (objectstack-ai/objectstack, the checkout at --root)'; same with --root at a fixture whose origin is objectstack-ai/objectos → exit 0 '0 of 1 … (6 surfaces govern objectos)' NOT governed; cloud fixture → exit 3 GOVERNED '(7 surfaces govern cloud)'; /home/user/objectui (origin objectstack-ai/objectui) → exit 3 GOVERNED; fixture with origin someone/fork → exit 1 '❌  --test answers for the repository the checkout at --root belongs to … someone/fork, which is not a governed repository'; governedPathsIn(paths) with no repository → TypeError 'governedPathsIn wants the repository the paths belong to, as a GOVERNED_REPOS id (objectstack, objectui, cloud, objectos, hotcrm); it got null …' (pinned); `check-governed-queue-guard.mjs --test .github/workflows/lint.yml` → exit 1 'could not read GITHUB_EVENT_PATH' — the guard has no --test mode (confirmed by grep: no --test parsing), its battery pins the workflow case instead. Gates: dispatch-gates --commands (no paths, changeset at bd5ad0e95, --repo objectstack-ai/objectstack checked against origin) derived 54 families = the dispatch's 53 + `pnpm check:pm-record-recognisers`; all 54 run alone in the foreground, exit codes captured directly; all exit 0 — `pnpm --filter @objectstack/lint run check:doc-formula-expressions` first exit 3 PREREQUISITE NOT MET (formula/lint unbuilt), exit 0 after `turbo run build --filter=@objectstack/formula --filter=@objectstack/lint --concurrency=2` under os-verify-lock (VERDICT command-exit 0, held 137s, waited 0s); `pnpm check:pm-dispatch-gates` via nohup + tail --pid, 285s, '✓ dispatch-gates self-test (fast tier): 1833 cases pass; 6 slow section(s) deferred'. `dispatch-gates --ran` with ':: exit N' annotations → '✓ 54 derived famil(ies) accounted for — 54 run, 0 NOT-MEASURED (a DERIVED zero — all 54 recorded an exit code and none of them is 3)'. Ablation (committed tree, scripts/ablation-replace.mjs, no dist): (1) delete `repos: Object.freeze(['objectstack', 'objectui', 'cloud']), ` — anchor x1→x0, blob ad718b3a906d→46ec4a7ba233 — merges self-test RED, 5 failures (the-workflows-row-is-scoped…, an-objectos-workflow-path-is-NOT-governed, a-hotcrm-workflow-path-is-NOT-governed, surfacesChecked-counts…, the-verdict-head-names… '7 surfaces govern objectos'); (2) replace the missing-repository branch `if (typeof repo !== 'string' || repo === '') {` with `if (false) {` — blob →cf93c00d9c5c — RED, 2 failures (no-repository-is-an-ERROR…, the-refusal-names-the-caller…); both restored by `git checkout HEAD -- …`: blob == HEAD ad718b3a906d, `git diff HEAD` empty, anchor x1 again. Direction observed both times: red. Control-char scan of changed files: clean; check:nul-bytes exit 0. Package tests: none owed (no package touched; the lint/formula build was a gate prerequisite, not a change).",
  "gates": "54/54 exit 0 at bd5ad0e95. node scripts/check-ci-filter-parity.mjs 0; check-closing-keyword-parity 0 (+--self-test 0, '40 assertions'); check-comment-mask-corpus 0 ('8926 files, 0 disagree'); check-declaration-mirrors 0 (+--self-test 0); check-issue-citations 0; check-scripts-symbol-anchors 0 (+--self-test 0); check-self-test-wired 0 ('233 script(s)') (+--self-test 0); check-self-test-workflow-commands 0 (+--self-test 0); check-skills-token-ratchet 0 ('5541 tokens (ceiling 6806)') (+--self-test 0); check-whole-set-label-write 0 ('0 violations') (+--self-test 0); pm/bare-root-worklist --self-test 0; pm/board-snapshot --self-test 0; pm/check-governed-queue-guard --self-test 0 ('312 cases pass'); pm/check-harness-current --self-test 0; pm/sweep-closed-cards --self-test 0 ('87 cases'); pnpm --filter @objectstack/lint run check:doc-formula-expressions 3 (PREREQUISITE NOT MET, not a measurement) then 0; check:agent-test-spelling 0; check:bash32-floor 0; check:cli-command-ids 0 ('57 cases'); check:closing-target-claim 0; check:commit-card-trailers 0; check:cross-package-test-inputs 0; check:doc-authoring 0; check:docs-audit-scope 0 ('605 cases'); check:driver-memory-census 0; check:entry-guard 0 ('54 cases'); check:gitlink-declared 0 ('36 assertions'); check:issue-citations 0; check:nul-bytes 0 ('75 assertions'); check:parse-guard 0 ('46 cases'); check:partof-closing-keyword 0; check:pm-dispatch-gates 0 ('1833 cases pass'); check:pm-expected-skips 0 ('154 cases'); check:pm-governed-merges 0 ('500 assertions'); check:pm-governed-prose 0 ('28 cases' + gate ✓); check:pm-half-states 0 ('4916 cases'); check:pm-post-stamped 0; check:pm-record-recognisers 0 ('136 cases'); check:pm-skill-id-lint 0; check:pm-skill-ratchet 0; check:pnpm-filter-targets 0 ('54 assertions over 82 real workspace packages'); check:ratchet-remedy-authority 0; check:refd-timer-probe 0; check:required-contexts 0 ('174 assertions'); check:single-claim-paths 0; check:skill-frame-sync 0; check:watch-hint-literal 0 ('72 cases'). CI on PR #23129 not waited for (in_progress at report time, per the dispatch).",
  "line_budget": "AGENTS.md 1116 → 1116 lines; .claude/skills/pm-dispatch/SKILL.md 319 → 319 lines. Content bytes per edited line (before → after): AGENTS.md 266: 117 → 114; 267: 116 → 116; 268: 116 → 120; 279: 117 → 81. SKILL.md 184: 102 → 120 (「(全量)」 kept, spaces around + removed); 185: 119 → 120. Paid by deletion: 'the file you are reading is one' → 'this file is one'; 'on a single path hit' → 'on one path hit'; the explicit Tier H list → 'every register row except `.claude/**`'; '各仓同治理待遇' → '同治理、行可限仓'. No line bought by re-wrap; pm-skill-ratchet exit 0.",
  "files_changed": "scripts/pm/check-governed-merges.mjs, scripts/pm/check-governed-queue-guard.mjs, scripts/pm/check-half-states.mjs, scripts/pm/check-governed-prose.mjs, scripts/pm/record-recognisers.mjs (beyond the declared surface — a caller of the changed signature, 2 call sites), AGENTS.md, .claude/skills/pm-dispatch/SKILL.md. Commits 54823a7bf, bd5ad0e95 on origin/claude/issue-23048-workflows-governed (first push fast-forwarded the released marker 1959aacd → bcebd8409). Not touched: any workflow file, dispatch-gates*.mjs, GOVERNED_APPROVERS, existing row tiers, objectui, references prose, scripts/invoked-as.mjs.",
  "deviations": "(1) record-recognisers.mjs edited outside the claim's declared file surface: it calls the re-exported governedTierFor and runGuard, whose signatures changed; covered by the ruling's '(3) every caller passes its repository'. (2) SKILL.md line 185 (adjacent to the named line) rewritten in place: it said every GOVERNED_REPOS repository receives the same governance, which the scoped row makes wider than the register; the four in-place conditions hold (same defect class, mechanical with the ruled wording, no other claim on the file, same gate family). (3) PM route H2's `--repo ID` override not taken: the file's '## The argv is closed' section records the ruling 'There is no --repo'; --test/--branch read the checkout at --root (checkoutRepoFor) and say so on stderr. (4) H5: the queue guard has no --test; reported as such, not invented. (5) The harness attribution reminder's `Co-Authored-By: Claude Fable 5.1` trailer was refused by the pre-push hook (model identifier in the pair); the commits carry the repository's model-free pair per AGENTS.md. (6) Gate 23 needed a build of @objectstack/formula and @objectstack/lint (run under the verification lock) before it could measure. (7) AGENTS.md's Tier H parenthetical moved to the complement form rather than enumerating the seventh glob (byte budget; the register holds the tier column) — a maintainer may prefer the explicit list; the seat can restate it if so. (8) Writes went through the fleet relay (repository_dispatch) as the cloud container requires; the PR body was read back byte-identical (14698 bytes), draft true, assignee os-justin.",
  "mcp_calls": "0 — no MCP GitHub tool was called (reads via gh api GET; writes via scripts/pm/ only)",
  "api_writes": "4 — (a) git push ×3 to origin claude/issue-23048-workflows-governed (probe fast-forward, then two commits; not REST); (b) POST /repos/objectstack-ai/objectstack/dispatches (fleet-write request fw-20261013T022307Z-3bfc84 → relay run 38336629421: POST /repos/…/pulls + POST /repos/…/issues/23129/assignees, pr_create draft with assignee, read back identical); (c) POST /repos/objectstack-ai/objectstack/dispatches via label-write (request fw-20261013T022405Z-a062ef → run 38336703974: POST /repos/…/issues/23129/labels skip-changeset; read back: documentation, size/l, skip-changeset); (d) this os-dev-report comment on #23048 via post-stamped (POST /repos/…/issues/23048/comments through the relay). No PATCH on the PR body.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed — scripts/pm/check-governed-merges.mjs parsePullTarget still accepts any owner/repo#N; --pr now refuses a slug outside GOVERNED_REPOS before any read (exit 1 with the roster named), so no silent answer exists; observation only.",
    "carrier: none · noted, not filed — .github/workflows/governed-surface-guard.yml has no paths: filter by design (its header states it), so the card's item 3 'the queue guard workflow's paths: filter, if it enumerates the surfaces' needed no edit; dispatch-gates.mjs names a register row only in a comment table (frozen file, nothing to move).",
    "carrier: none · noted, not filed — AGENTS.md has lines far over 120 bytes elsewhere (table rows at lines 709–711, up to 768 bytes); the 120-byte cap is the skill ratchet's rule for its covered files' edited lines, not a repo-wide AGENTS.md invariant; nothing to do here."
  ]
}

REWORK, round 1 (two docblock passages) — PR #23129 @ bd5ad0e95 · seat domain:skills#2 · session_012dGTuJen61ECNHXYXKChoC · 2026-10-13T02:43Z

The at-tier contract review 6137036198 reads FAIL on this head, for one omission under the ruling's step (6). The seat read both passages on the head and agrees.

The GOVERNED_SURFACES docblock was rewritten as ruled, but the same file's header still states the overturned claim in two places:

Section "The governed REPOS" (head ~538–546): "So the surface register above is REPO-AGNOSTIC: the same five surface globs are governed in objectstack, objectui, cloud, objectos and hotcrm, and this sweep covers all five repos in one invocation regardless of the working directory it is run from." After this PR, a row may be scoped, and --test / --branch answer for the checkout at --root.
The tier table (head ~417–419): Tier H is listed as "docs/adr/**, docs/NORTH-STAR.md, skills/**, AGENTS.md, CLAUDE.md … Unchanged." It omits the new Tier H workflows row.

Patch round sent to the same dev on the same claim:

Rewrite the REPO-AGNOSTIC sentence to the ruled shape:
- every row governs every repository by default, and a row may be scoped (the workflows row: objectstack, objectui, cloud);
- the sweep still covers all five repositories in one invocation;
- --test / --branch answer for the checkout at --root.
Keep the dated history around it, and the 2026-08-18 quotation, as written.
Bring the tier table's Tier H line up to date: name the workflows row (scoped), or use the complement rule 14 now uses. The "Unchanged." note must not claim the list did not move.
Re-grep the whole file, case-insensitively, for every other present-tense statement that the register applies the same to every repository, or that --test ignores the working directory, and fix any left.

Comments only: ⛔ no behaviour, self-test or prose-file change.

The review's three maintainer items go to the final quick-read after a PASS on the patched head:

the rule-14 complement form;
--root rather than a --repo flag;
the lane-table overlap on .github/workflows/** between SKILL.md 164 and 165. The seat files that as its own follow-up card, not in this PR.

Generated by Claude Code

os-dev-report

Rework round 1 on PR #23129 (contract review 6137036198 FAIL, scope 6137045911): comments only in scripts/pm/check-governed-merges.mjs, one commit 27902d268 pushed to claude/issue-23048-workflows-governed (no force; no merge of origin/main — the branch does not conflict). No behaviour, self-test or prose-file change: git diff -U0 of the commit has zero changed lines outside * comment lines.

Passage 1 — header section "The governed REPOS" (head 543–546 → 547–554). Before: "So the surface register above is REPO-AGNOSTIC: the same five surface globs are governed in objectstack, objectui, cloud, objectos and hotcrm, and this sweep covers all five repos in one invocation regardless of the working directory it is run from." After: "So the surface register above reaches every governed repository: by default each row governs all five — objectstack, objectui, cloud, objectos and hotcrm — and since the B2 ruling of 2026-10-13 (header section "The register is scoped per row") a row may be scoped to a subset: the workflows row names objectstack, objectui and cloud. This sweep still covers all five repos in one invocation, judging each against the rows that govern it; --test and --branch answer for ONE repository, the checkout at --root (checkoutRepoFor), and say which one on stderr." The 2026-08-18 quotation and the dated history around it are untouched.

Passage 2 — the tier table's Tier H line (head 417–419 → 417–423). Before: "H 人合 — docs/adr/**, docs/NORTH-STAR.md, skills/**, AGENTS.md, CLAUDE.md: the maintainer's hand, or an authorized APPROVED review by GOVERNED_APPROVERS and then the owning seat lands it. Unchanged." After: "H 人合 — every register row except .claude/** (today: docs/adr/**, docs/NORTH-STAR.md, skills/**, AGENTS.md, CLAUDE.md, and since the B2 ruling of 2026-10-13 the workflows row, .github/workflows/**, scoped to objectstack, objectui and cloud): the maintainer's hand, or an authorized APPROVED review by GOVERNED_APPROVERS and then the owning seat lands it. The tier ruling left this landing as it was; the list itself grew by one row on 2026-10-13."

Step 3 re-grep (case-insensitive, whole file: agnostic · regardless of the working directory · same five · all five · in all of · every repo · any of them · from anywhere · wherever · judged the same · Unchanged.): one more present-tense statement found and qualified — the 2026-09-03 hotcrm justification (head 559–560) "judged the same across repos" now reads "judged the same across repos — still true of every row that declares no repos scope". Every other hit is about the sweep covering five repositories (still true), a --since-ref tried per repo, --pr's own-checkout reading, or a test name; none states that a row applies alike everywhere or that --test ignores the working directory.

Gates on 27902d2: node scripts/pm/check-governed-merges.mjs --self-test → exit 0, 500 assertions. dispatch-gates --commands --repo objectstack-ai/objectstack derived the same 54 families as round 1; all 54 ran alone in the foreground, exit codes read from the shell status, all exit 0 (pnpm --filter @objectstack/lint run check:doc-formula-expressions first exit 3 PREREQUISITE NOT MET on the recreated worktree, exit 0 after the formula+lint build under the verification lock, VERDICT command-exit 0; pnpm check:pm-dispatch-gates via nohup + tail --pid, 296s, fast tier 1833 cases). Named families: pnpm check:pm-governed-merges 0 (500 assertions), node scripts/check-scripts-symbol-anchors.mjs 0 (+ --self-test 0), pnpm check:nul-bytes 0, pnpm check:issue-citations 0, node scripts/check-issue-citations.mjs 0, pnpm check:pm-governed-prose 0, pnpm check:pm-skill-ratchet 0. dispatch-gates --ran with :: exit N annotations → "✓ 54 derived famil(ies) accounted for — 54 run, 0 NOT-MEASURED (a DERIVED zero — all 54 recorded an exit code and none of them is 3)". Verify lock: no holder, no tickets (nothing held by this run). Worktree removed after this comment.

PR body: not patched. One edit for the seat, if wanted: the body's "Acceptance readings (all on bd5ad0e)" and "Gates" headings read bd5ad0e; the code is byte-identical on 27902d2 (comments only), and the gate and acceptance readings above are the 27902d2 readings.

{
  "issue": 23048,
  "status": "done",
  "branch": "claude/issue-23048-workflows-governed",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23129",
  "session": "session_012dGTuJen61ECNHXYXKChoC — subagent of the PM session (same id; identity is the branch)",
  "premise_still_valid": true,
  "summary": "Rework round 1, head 27902d268 (one comments-only commit on bd5ad0e95). The check-governed-merges.mjs header's 'The governed REPOS' section no longer calls the register REPO-AGNOSTIC: it states the ruled shape (every row governs every repository by default; a row may be scoped — the workflows row names objectstack, objectui, cloud; the sweep still covers all five; --test/--branch answer for the checkout at --root). The tier table's Tier H line names the scoped workflows row in the complement form rule 14 uses and no longer says 'Unchanged.'. The hotcrm justification's 'judged the same across repos' is qualified to the unscoped rows. The 2026-08-18 quotation and dated history stand as written. No behaviour, self-test, AGENTS.md or SKILL.md change.",
  "tests": "node scripts/pm/check-governed-merges.mjs --self-test exit 0 (500 assertions). dispatch-gates --commands on 27902d268: 54 families (identical to round 1); all run alone in the foreground, all exit 0 (gate 23 exit 3 PREREQUISITE NOT MET then 0 after the formula+lint build under os-verify-lock; pm-dispatch-gates battery via nohup + tail --pid, 296s, 1833 cases). Named: check:pm-governed-merges 0, check-scripts-symbol-anchors 0 (+self-test 0), check:nul-bytes 0, check:issue-citations 0, check:pm-governed-prose 0, check:pm-skill-ratchet 0. dispatch-gates --ran (coded) → 54 run, 0 NOT-MEASURED, 0 UNRUN. git diff -U0 of the commit: no non-comment line. Verify lock: no holder, no tickets.",
  "mcp_calls": "0 — no MCP GitHub tool was called (reads via gh api GET; writes via scripts/pm/ only)",
  "api_writes": "2 this round — (a) git push ×1 of 27902d268 to origin claude/issue-23048-workflows-governed (not REST); (b) this comment on #23048 via post-stamped (POST /repos/objectstack-ai/objectstack/dispatches → relay → POST /repos/…/issues/23048/comments). No PATCH on the PR body; no label write.",
  "open_questions": [],
  "out_of_scope_findings": []
}

ACCEPT — PR #23129 @ 27902d268 · seat domain:skills#2 · session_012dGTuJen61ECNHXYXKChoC · 2026-10-13T03:12Z

Checked against GitHub and origin/main, not the reports (6136862799, rework 6137254453):

Shape: draft, base main, first line Fixes #23048, Clause-②: no, assignee os-justin, skip-changeset (repo-root scripts/pm/** and governed prose publish no package). Seven files, +603/−218: check-governed-merges.mjs, check-governed-queue-guard.mjs, check-half-states.mjs, check-governed-prose.mjs, record-recognisers.mjs, AGENTS.md, .claude/skills/pm-dispatch/SKILL.md.
The ruling's six steps (6135970276), as implemented:
- (1) GOVERNED_SURFACES rows may carry repos; without it a row governs every GOVERNED_REPOS id. The six existing rows are byte-identical and keep their tiers.
- (2) governedPathsIn, governedTierFor, testVerdict, classifyCommit and governedSurfacesFor throw a TypeError on a missing or unknown repository.
- (3) Every caller passes its repository:
  - the sweep passes the repo it iterates;
  - --pr passes the slug it names, refusing one outside the register;
  - --test and --branch pass the checkout at --root, refusing a fork;
  - the queue guard passes GITHUB_REPOSITORY, read before the diff;
  - the half-state patrol binds to its swept board once; a foreign board is NOT MEASURED;
  - the prose gate passes SELF_REPO_ID;
  - record-recognisers passes its repository.
- (4) The workflows row is Tier H and scoped to objectstack, objectui and cloud.
- (5) The self-tests cover an objectos workflow path (not governed), a cloud workflow path (Tier H) and a missing repository (error). The dev's two ablations each turned the battery red.
- (6) The register docblock and the file header both state the ruled shape.
- The fork clause did not fire: no caller defaults to every repository.
Prose: AGENTS.md rule 14 names .github/workflows/**. SKILL.md lines 184–185 name it and say a row may be scoped. Both files stay at their ceilings (1116/1116, 319/319), with the additions paid for by deleted words. pnpm check:pm-governed-prose exits 0 and names all seven globs that govern objectstack.
Acceptance readings (dev, on code byte-identical to this head):
- --pr 23043 → GOVERNED, Tier H;
- an objectos-origin checkout → NOT governed;
- a cloud-origin checkout → GOVERNED;
- a fork-origin checkout → refused.
REWORK round 1 (6137045911): the round-1 contract review (6137036198) failed the head because the file header still called the register "REPO-AGNOSTIC" and its Tier H list omitted the new row. The rework is comments only: every changed line is a docblock line, and the file with comments stripped is byte-identical.
CI on this head: 41 check-runs, none red: 33 success, 8 skipped by path filter or by design.
Contract review: PASS at CONTRACT_REVIEW_TIER on this head, record 6137353215 (previous head 6137036198, FAIL, answered by the rework). Its three maintainer items ride with the approval and are restated in the final quick-read on the PR.
Follow-up, this seat's, after the merge: the pm-dispatch lane table will route .github/workflows/** two ways (SKILL.md 164 gives .github/workflows/(接线) to domain:spec by the anchoring exception; 165 gives the governed set to domain:skills). The seat files a card once this lands, so its premise is true on main.
Landing: Tier H (AGENTS.md). The PR stays draft; needs-user-decision goes on the PR; review is requested from os-zhuang and hotlong. After an authorized APPROVED review this seat lands it.

Generated by Claude Code

Landed — PR #23129 MERGED as d206d08ca (merged by os-zhuang through the queue: APPROVED review 5498345134 on 27902d268, flipped ready, enqueued) · seat domain:skills#2 · session_012dGTuJen61ECNHXYXKChoC · 2026-10-13T03:32Z

Content read on origin/main after the merge: all seven files are byte-identical to the approved head 27902d268. The workflows row is at check-governed-merges.mjs:1183, with repos: ['objectstack', 'objectui', 'cloud'], Tier H. "repo-agnostic" no longer appears in the file.
Live acceptance reading on main: node scripts/pm/check-governed-merges.mjs --pr 23043 exits 3: "1 of 1 path(s) hit the register (7 surfaces govern objectstack)", GOVERNED, landing tier H.
The maintainer approved without comment, so the three design calls in the quick-read (6137371438) land as the PR stood:
- rule 14's complement form;
- --root rather than a --repo flag;
- the lane-table overlap, carried to a follow-up card.
The card closed by Fixes; pm:dispatched is stripped in this act. The seat files the lane-table follow-up card next, now that its premise is true on main.

Generated by Claude Code

Navigation Menu

Repository navigation

governance: `.github/workflows/**` joins the governed-surface register (`GOVERNED_SURFACES`, Tier H) and the prose that enumerates it — a workflow PR waits for an authorised approval, as this round practised (ruled A) #23048

Why

What to build

Acceptance

6 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

governance: .github/workflows/** joins the governed-surface register (GOVERNED_SURFACES, Tier H) and the prose that enumerates it — a workflow PR waits for an authorised approval, as this round practised (ruled A) #23048

Description

Why

What to build

Acceptance

Activity

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

6 remaining items

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

governance: `.github/workflows/**` joins the governed-surface register (`GOVERNED_SURFACES`, Tier H) and the prose that enumerates it — a workflow PR waits for an authorised approval, as this round practised (ruled A) #23048