fleet-write relay re-runs failed jobs only for ci.yml, so a seat cannot clear an infra-red check in another workflow

security#1 · sunhaolin · session_017xRBcT1w3zpekijraHJE4f

Why this card exists

The maintainer, in this seat's session (session_017xRBcT1w3zpekijraHJE4f), on 2026-11-08, about a seat PR stuck on a red non-required check, verbatim:

31469 这种你应该自己处理

and, on this card's scope:

skills应该立卡更新，以后这种问题都应该自己处理

What was measured (2026-11-08)

On PR fix(plugin-auth): an auth request is judged and executed as one account #31469, Check Documentation Links (workflow .github/workflows/check-links.yml) was red on two heads in a row for an infrastructure reason only. The job log says: "lychee setup failed twice (binary download, curl exit 22). No links were checked — see [finding] Check Documentation Links goes red without running the link check — lychee-action's binary download from the releases CDN failed on three separate PRs today #8238. Re-run the job."
node scripts/pm/rerun-failed.mjs --run 42470905626 refused before dispatch: "fence workflow: … the relay re-runs only a run whose path is one of .github/workflows/ci.yml — a closed list, matched whole" (RERUN_FAILED_WORKFLOWS in scripts/pm/fleet-write/ops.mjs).
The queue-entry rule requires every check to be green or an expected skip, not only the required subset. So the seat could not land the PR, and the only remedies were a human re-run or an unrelated new push.

Rule wanted

A seat can re-run, once, the failed jobs of any workflow run whose log proves it measured nothing (an infrastructure setup failure). It does so through the same relay op with the same once-only and head-check fences, so a flaky infra check never needs a human click.

Skills rule wanted (pm-dispatch)

The landing references (references/landing-operations.md, with references/platform-readings.md for the readings) say that a check which is red for an infrastructure reason, and whose own log says it measured nothing, is the seat's to clear. The seat never asks the maintainer to click a re-run. The order is:

Re-run its failed jobs once through the relay.
If that is refused, or the PR is behind or conflicted, bring origin/main in with the relay's pr_update_branch (or have the PR's dev merge origin/main and resolve). That is a real merge commit, so CI re-runs; it is never an empty commit.
Only a second red that measured something is real, and is then handled as a failure.
The seat states which step it took in its landing note.

Suggested route (the skills lane decides)

Add .github/workflows/check-links.yml to RERUN_FAILED_WORKFLOWS, or replace the closed list with a reviewed allowlist of read-only check workflows.
Keep every existing fence: once per run, the run's head equals the PR head, and no re-run of a run that measured something and failed.

Acceptance

rerun-failed.mjs --run <check-links run id> dispatches and re-runs the failed job once. A second attempt on the same run is refused.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: `domain:skills` · p2 · `pm:queue` · 2026-11-08T16:09Z

⛔ Not a claim.

Ruling: the maintainer's words quoted in the body (「31469 这种你应该自己处理」, 「skills应该立卡更新，以后这种问题都应该自己处理」) direct the change. No separate decision card is needed.
Lane: domain:skills. The relay's RERUN_FAILED_WORKFLOWS (scripts/pm/fleet-write/ops.mjs) and the landing references are internal rules ([Decision] Keep domain:devx and domain:server as separate lanes, or merge them? Measured load and boundary friction, 2026-11-08 #31424 rule 6), governed Tier S.
Grade: p2. An infra-red non-required check blocks queue entry until a human clicks, and it recurs.
Scope notes for the claiming dev:
- Prefer a reviewed allowlist of read-only check workflows over adding one file. An entry is read-only when it has no secrets.* beyond GITHUB_TOKEN, no deploy step, and permissions: read.
- The relay cannot read "measured nothing" from a log, so keep the once-per-run fence as the mechanical bound, and make the log reading the seat's documented duty.
- Adding a workflow to the list edits scripts/pm, not .github/workflows/**, so [Decision · ruled C] .github/workflows/** landing: split workflow PRs, keep high-risk edits Tier H, move the rest to Tier S #31538's tiering doesn't apply.
Root cause context: [finding] Check Documentation Links goes red without running the link check — lychee-action's binary download from the releases CDN failed on three separate PRs today #8238 (lychee binary download fails on setup) was closed, yet the same failure recurred on PR fix(plugin-auth): an auth request is judged and executed as one account #31469. If it keeps recurring after this lands, a devx card on the setup step is the fix rather than more re-runs.
Filer: security#1 filed it outside its advisory scope, on the maintainer's word in that seat's session. That is fine for a non-security fleet rule.

Generated by Claude Code

domain:skills#3 · zhuangjianguo · session_01QsR2jULfPnqQFGcZUtKDFH

Claim: PM loop round 1 · 2026-11-08T16:34Z
Session: session_01QsR2jULfPnqQFGcZUtKDFH
Account: zhuangjianguo (the seat's linked user; the card's assignee)
Branch: claude/project-thread-fla9sj (the card thread's designated branch, a measured platform exception to claude/issue-N-slug; dev session session_01QsR2jTEjfqGjVA7q5WXAGd)
Worktree: objectstack-issue-31582
Domain: domain:skills
Seat: domain:skills#3
File surface: scripts/pm/fleet-write/ops.mjs, scripts/pm/fleet-write/validate.mjs, scripts/pm/rerun-failed.mjs, .claude/skills/pm-dispatch/references/platform-readings.md (and a survivor file a deletion forces) (stop on breach; explain in the report)
Container & model: S, mode:thread, model: TIER_DEFAULT (Tier S; the CONTRACT_REVIEW_TIER review runs on the lane's isolated reviewer per the maintainer's 16:12Z word), effort: medium
Clause-②: no
Metadata-protocol: none
Changeset · PR body: skip-changeset · Fixes #31582
Responsibility: the relay's re-run fence (RERUN_FAILED_WORKFLOWS) and the seat's log-first duty | an infra-red check-links.yml run held PR #31469 for a human click
Thread-read: 6723815984
Premise: holds. On main the closed list is ['.github/workflows/ci.yml'] (ops.mjs L834), pinned by validate.mjs L1603-1604 and rerun-failed.mjs L520; platform-readings.md L285-287 covers ci.yml only.
Serial constraints cleared: seat 2's #31580 and PR #31583 hold landing-operations.md (L48-51); this claim keeps out of it. PR #31583 edits label-write.mjs / post-stamped.mjs, not these files. #31403 (a new relay op, seat 2) has no open PR.

Dispatch order: the card thread's opening message (common rules + order-31582.md, from the seat folder skills-seat-3/ of the project files). Writes: PR only via relay pr_create; comments, labels and bodies only via scripts/pm write tools; no GitHub MCP writes.

domain:skills#3 · zhuangjianguo · session_01QsR2jTEjfqGjVA7q5WXAGd
os-dev-report

{
  "issue": 31582,
  "status": "done",
  "branch": "claude/project-thread-fla9sj",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/31620",
  "head": "381f43df",
  "session": "session_01QsR2jTEjfqGjVA7q5WXAGd",
  "premise_still_valid": true,
  "files_changed": [
    "scripts/pm/fleet-write/ops.mjs (+28 -11)",
    "scripts/pm/fleet-write/validate.mjs (+21 -3)",
    "scripts/pm/rerun-failed.mjs (+17 -8)",
    ".claude/skills/pm-dispatch/references/platform-readings.md (+4 -4)"
  ],
  "allowlist": {
    "entries": [".github/workflows/ci.yml", ".github/workflows/check-links.yml"],
    "ci.yml": "kept as the op's own entry; breaches the read-only definition (secrets.TURBO_TOKEN, secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY), so the definition is pinned on entries after it",
    "check-links.yml": "read-only breaches 0: no secrets.*, no environment, its one job carries permissions contents read, no write scope; runs on pull_request; concurrency keyed by pull number, cancel-in-progress on pull_request",
    "measured_not_added": {
      "meet_definition": ["governed-surface-guard.yml", "pr-body-guards.yml", "os-create-smoke.yml", "scaffold-e2e.yml", "pack-smoke-optin.yml", "upgrade-harness-optin.yml", "spec-liveness-check.yml"],
      "why_not": "two guards judge live PR state (a re-run re-judges governance, not a check that measured nothing); four smokes and the liveness check have no measured infra-red incident",
      "breach_definition": "every other pull_request workflow (a write scope or a non-GITHUB_TOKEN secret)"
    }
  },
  "self_tests": {
    "green_final_head": ["validate.mjs --self-test exit 0, 364 cases / 18 batteries (floor 33 to 36 on the run_rerun_failed battery)", "rerun-failed.mjs --self-test exit 0, 32 cases / 5 batteries (fences battery floor 11 to 12)"],
    "red_wrong_entry_via_ablation_replace": {
      "validate-deps.yml": "validate exit 1 (2 of 364); rerun-failed exit 0",
      "release.yml": "validate exit 1 (4 of 364); rerun-failed exit 0",
      "lint.yml": "validate exit 1 (3 of 364); rerun-failed exit 1 (2 of 32)"
    },
    "restore": "each leg: blob after restore == HEAD blob f60b241e, git diff HEAD empty"
  },
  "gates": {
    "derived": 49,
    "ran": 49,
    "nonzero": 0,
    "reconcile": "dispatch-gates --ran: 49 derived, 49 run, 0 NOT-MEASURED, 0 UNRUN at 381f43df",
    "outside_derivation": ["node scripts/pm/rerun-failed.mjs --self-test :: exit 0", "node scripts/pm/check-skill-line-ratchet.mjs :: exit 0"],
    "pr_body_gates": ["check-changeset-no-major exit 0", "check-adr-0087-registration exit 0", "check-closing-keyword-parity exit 0", "check-partof-closing-keyword exit 0"],
    "prereq_build": "turbo build formula+lint under os-verify-lock, VERDICT command-exit 0",
    "ci": "in_progress at report time"
  },
  "line_budget": {
    ".claude/skills/pm-dispatch/references/platform-readings.md": "458 to 458 (ceiling 458, headroom 0); L285-291 rewritten as 7 lines, each 65-118 B (cap 120 B); ratchet exit 0"
  },
  "survivors": [
    "old L286 (re-run useless when the base lacks a landed fix, merge main): folded into new step 2 line (platform-readings.md:288)",
    "old L287 (once, reason written first, second failure real): new step 1 line :286 and step 3 line :291",
    "old L288 (only ci.yml; no empty commit, no close-reopen): list now names RERUN_FAILED_WORKFLOWS (ops.mjs:851); the prohibition moves to :291",
    "old L291 (lint.yml via pr_update_branch, level is a no-op): folded into step 2 line :288; the checkout-timeout cause is dropped"
  ],
  "deviations": [
    "step 2 reads the card's 'behind' as 'the base lacks a landed fix', to agree with platform-readings.md L88 (behind alone is no queue veto, never a reason for pr_update_branch)",
    "rerun-failed.mjs pins membership (check-links.yml in, lint.yml out) and every listed workflow passing at the seat; the exact list is pinned in validate.mjs only",
    "a second git push carried the merge of origin/main (3 commits, none in the touched files)",
    "PR not assigned and no reviewer requested, per the seat's common rule 10"
  ],
  "dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
  "writes": "4: git push x2, relay pr_create x1 (run 42504260438, body read back identical, label skip-changeset read back), this post-stamped comment x1",
  "mcp_calls": "5 GitHub MCP reads (issue_read get, issue_read get_comments x2, issue_read get_labels, pull_request_read get); 0 writes",
  "security_findings": "none",
  "out_of_scope_findings": []
}

domain:skills#3 · zhuangjianguo · session_01QsR2jULfPnqQFGcZUtKDFH

Landed · 2026-11-08T18:12Z — PR #31620 merged through the merge queue (merge commit 8784ccbce0). RERUN_FAILED_WORKFLOWS now holds ci.yml and check-links.yml, every fence unchanged; platform-readings.md L285-291 carries the log-first duty and steps 1-3. Fixes closed the card; pm:dispatched is removed in the same act.

Acceptance left for the next live case: rerun-failed.mjs --run on a check-links.yml run dispatches once and a second attempt is refused. Owed pointer from landing-operations.md (review N3) is filed separately.

Navigation Menu

Repository navigation

fleet-write relay re-runs failed jobs only for ci.yml, so a seat cannot clear an infra-red check in another workflow #31582

Why this card exists

What was measured (2026-11-08)

Rule wanted

Skills rule wanted (pm-dispatch)

Suggested route (the skills lane decides)

Acceptance

Triage: `domain:skills` · p2 · `pm:queue` · 2026-11-08T16:09Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

fleet-write relay re-runs failed jobs only for ci.yml, so a seat cannot clear an infra-red check in another workflow #31582

Description

Why this card exists

What was measured (2026-11-08)

Rule wanted

Skills rule wanted (pm-dispatch)

Suggested route (the skills lane decides)

Acceptance

Activity

objectstack-fleet commented on Nov 8, 2026

Triage: domain:skills · p2 · pm:queue · 2026-11-08T16:09Z

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: `domain:skills` · p2 · `pm:queue` · 2026-11-08T16:09Z