[objectstack-fleet]

Requested by Steedos · project thread

Fixes #31582

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：席位经中继重跑失败 job 的名单，从只有 ci.yml 改为审过的只读检查白名单，首个新成员是 check-links.yml（Check Documentation Links）；pm-dispatch 读数表写明先读日志、按三步清基础设施红。
• 为什么改：日志自称"一个链接都没查"的基础设施红，过去只能等人手点重跑，挡住入队；维护者要求这类问题席位自己处理。
• 风险与回滚：只读检查重跑一次只多花 runner 时间，五道围栏（只一次、head 等于 PR 当前 head、pull_request 事件、attempt 1、已完成且失败）一道未动；回滚即 revert 本 PR。
• 先看：scripts/pm/fleet-write/ops.mjs（名单与只读定义）、scripts/pm/fleet-write/validate.mjs（名单与只读自测）、platform-readings.md 第 285–291 行。
• 两分钟验证：node scripts/pm/fleet-write/validate.mjs --self-test，应见 364 cases pass；node scripts/pm/rerun-failed.mjs --self-test，应见 32 cases pass。
• 需要你做的：无，席位落地。

What changes

• scripts/pm/fleet-write/ops.mjs: RERUN_FAILED_WORKFLOWS is a reviewed allowlist, ['.github/workflows/ci.yml', '.github/workflows/check-links.yml']. The docblock states the read-only definition every entry after ci.yml meets (no secrets.* but GITHUB_TOKEN, no environment:, a permissions: block covering every job, no write scope) and the reading that admitted each entry. The header's workflow and head fence text no longer says the list is ci.yml alone. Every fence (workflow, event, once, failed, head, alone, grant) is unchanged.
• scripts/pm/fleet-write/validate.mjs self-test: the list is pinned exactly; the existing "file on disk that runs on pull_request" case is kept; a new case reads each entry after ci.yml from its own file and requires zero read-only breaches; a control case shows the definition fails on ci.yml, validate-deps.yml and release.yml; a run of each listed workflow passes all five fences. The battery floor goes 33 to 36.
• scripts/pm/rerun-failed.mjs self-test: a run of each listed workflow passes the seat-side fences and is dispatched once, with check-links.yml listed and lint.yml not (floor 11 to 12). The wiring case now refuses any workflow-path array literal in this file, not only the old one-entry spelling. The header and usage say "a listed workflow" instead of ci.yml.
• .claude/skills/pm-dispatch/references/platform-readings.md: the re-run lines now state the seat's duty to read the log first. A red whose own log says it measured nothing is the seat's to clear and never the maintainer's click. The order is (1) one relay re-run, (2) when it is refused, the base lacks a landed fix, or the PR is conflicted, pr_update_branch or the dev merges main, (3) only a second red that measured something is real. The landing note names the step taken. The file stays at 458 lines (ceiling 458) with every line at or under 120 bytes.

Tests

Self-tests, green at the final head

✓ fleet-write/validate self-test: 364 cases pass across 18 batteries
✓ rerun-failed self-test: 32 cases pass across 5 batteries

Red with a deliberately wrong entry, through ablation-replace (restore proved: blob equals HEAD, git diff HEAD empty)

+ validate-deps.yml (pull_request, issues write):
  validate exit 1: 2 of 364 failed (the exact list; every entry after ci.yml READ-ONLY)
  rerun-failed exit 0 (it pins membership of check-links.yml and absence of lint.yml, not the whole list)
+ release.yml (no pull_request trigger, NPM_TOKEN, environment):
  validate exit 1: 4 of 364 failed (exact list; file runs on pull_request; READ-ONLY; the all-fences control that uses release.yml as its unlisted path)
+ lint.yml (turbo cache secrets, a write scope):
  validate exit 1: 3 of 364 failed (exact list; READ-ONLY; the workflow fence's lint.yml refusal)
  rerun-failed exit 1: 2 of 32 failed (each listed workflow accepted, lint.yml not listed; the seat-side lint.yml refusal)

Acceptance notes

• Entries measured against the read-only definition (every pull_request workflow on 158cc2aa, read by the self-test's own predicate). These meet it: check-links.yml (added), plus governed-surface-guard.yml, pr-body-guards.yml, os-create-smoke.yml, scaffold-e2e.yml, pack-smoke-optin.yml, upgrade-harness-optin.yml and spec-liveness-check.yml (not added). The two guards judge live PR state (reviews, body), so a re-run re-judges governance; it does not recover a check that measured nothing. The four smokes and the liveness check have no measured infra-red incident behind them, and the order adds an entry only with a reading. A later PR adds one with its reading. Every other pull_request workflow breaches the definition (a write scope, or a secret other than GITHUB_TOKEN).
• ci.yml stays the first entry by the ruling that made the op; it reads the turbo remote-cache secrets, so the read-only definition is checked on the entries after it.
• Step (2) reads "behind" as "the base lacks a landed fix". That keeps it consistent with platform-readings.md L88, which says being behind alone is no queue veto and never a reason to send pr_update_branch.
• The acceptance live check (rerun-failed.mjs --run RUN_ID on a check-links run dispatches once, a second attempt is refused) is the seat's after landing; this PR dispatches no live re-run.

Verification

Derived gates for this diff (dispatch-gates.mjs --commands), each run at the final head with its exit code and reconciled with --ran: see the os-dev report on the card.

---

Generated by Claude Code

[objectstack-fleet]

domain:skills#3 · zhuangjianguo · session_01QsR2jULfPnqQFGcZUtKDFH

Contract-review-claim: session_01QsR2jULfPnqQFGcZUtKDFH · head 381f43d · 2026-11-08T17:20Z

The lane seat's isolated Fable reviewer runs the CONTRACT_REVIEW_TIER review (maintainer 2026-11-08 16:12Z 「有 fable 车道就可以契约复审啊」); the director seat is off duty.

[objectstack-fleet]

domain:skills#3 · zhuangjianguo · session_01QsR2jULfPnqQFGcZUtKDFH

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 381f43df61343b1cae10b641f0bcdcdf137eff80
Local-runs: none
Scope: .claude/skills/pm-dispatch/references/platform-readings.md + scripts/pm/fleet-write/ops.mjs, scripts/pm/fleet-write/validate.mjs, scripts/pm/rerun-failed.mjs

Inputs read: card #31582 (body, triage 6723815984, claim 6724095715, os-dev report 6724587735), PR #31620 (body, 4-file list, git diff origin/main...pr/31620 at the head), the head's check-runs, and the live tree at the head for the cited code (.github/workflows/check-links.yml, ci.yml, lint.yml, execute.mjs, dispatch.mjs, check-skill-line-ratchet.mjs, landing-operations.md, SKILL.md). The remainder of the diff outside hits + implementing files is empty: every one of the four files is in scope.

① Derived judgments

• Accept-set, relay (ops.mjs): RERUN_FAILED_WORKFLOWS goes ['.github/workflows/ci.yml'] → ['.github/workflows/ci.yml', '.github/workflows/check-links.yml'], frozen, matched whole by RERUN_FAILED_FENCES[workflow].holds (includes on the run's own path). The executor (execute.mjs L544-556) and the seat wrapper import rerunFailedFenceFailures from ops.mjs, so the relay and the seat widen together — a check-links.yml pull_request run at attempt 1, completed/failure, on its pull's current head is now accepted; every other fence (event, once, failed, head, alone, grant) is byte-unchanged in the diff. Right.
• Accept-set, check-links.yml against the triage's read-only definition, read on the head's file: one job link-checker with permissions: contents: read; no secrets.* anywhere (lychee runs --offline); no environment:; no write scope; on: pull_request (branches main, paths: filter) plus workflow_dispatch (refused by the event fence). Concurrency group keyed by github.event.pull_request.number, cancel-in-progress true on pull_request — the head-fence rationale the docblock now states for "each listed workflow" holds for both entries (ci.yml L112-114). Right.
• Refusal-set unchanged: lint.yml still refused by the workflow fence (validate.mjs, rerun-failed.mjs, execute.mjs L2318 each pin it); REFUSED_PATH_FAMILIES, the payload shape (run_id alone), and the stroke-scoped grant are untouched. Right.
• Self-test pins: validate.mjs pins the EXACT list (not membership), the frozen state, each entry on disk with pull_request:, each entry after ci.yml at zero read-only breaches, a control that ci.yml/validate-deps.yml/release.yml each breach, and a run of each entry passing all five fences; battery floor 33 → 36 for three new cases. rerun-failed.mjs pins membership (check-links.yml in, lint.yml out) and each entry dispatched exactly once at the seat; floor 11 → 12 for one new case; the wiring case now refuses any workflow-path array literal in that file, so the exact list cannot be re-spelled there. Both run in CI under Lint · repo & tooling gates (check:pm-fleet-write-validate, check:pm-fleet-write-dispatch → rerun-failed.mjs --self-test), green on this head. Right.
• Public surface: none — scripts/pm/** and .claude/** publish nothing; no package, export, schema or workflow file moves. Right.
• Skill face: platform-readings.md 458/458 lines (ceiling 458 in check-skill-line-ratchet.mjs L1160), every line ≤ 120 B (measured on the head: the rewritten L285-291 run 65-118 B). No other skill or reference on the head still says the relay re-runs ci.yml alone (SKILL.md L94 is generic; landing-operations.md L28-29 on main already read "基上缺已合修复 ⇒ merge main 推新提交,重跑无效"). Right.

② Semver level

skip-changeset is right: the diff touches scripts/pm/** and .claude/** only — nothing from a released package publishes, which is exactly the label's definition (AGENTS.md Post-Task Checklist 3). Clause-②: no and Metadata-protocol: none on the PR body agree with the diff (no protocol surface, no metadata key). Check Changeset is success on the head. The declaration face is the PR body alone; no changeset file exists to compare.

③ Boundary flags

Dev flags (os-dev report deviations), each answered:

1. "step 2 reads the card's 'behind' as 'the base lacks a landed fix'" — accepted. The card's step 2 ("behind or conflicted ⇒ pr_update_branch") collides with the same file's L88 (behind 的 PR 照常入队 … ⛔ 不为它先发 pr_update_branch), a measured reading; the dev kept the file self-consistent and the card's purpose (a real new head so CI re-runs) is still served by "被拒 … 或冲突". See nit N2 for the one sentence this folding dropped.
2. "rerun-failed.mjs pins membership, not the exact list" — accepted. The exact list is pinned where the table lives (validate.mjs), and that file's own wiring case forbids spelling a path list in rerun-failed.mjs; membership plus "each entry dispatched once" is the strongest pin consistent with the no-restating rule.
3. "a second push carried the merge of origin/main (3 commits, none in the touched files)" — accepted; the net diff against main at the head is the four files alone.
4. "PR not assigned, no reviewer requested" — process, outside this record.

open_questions: none declared. out_of_scope_findings: empty. The report's measured_not_added (seven pull_request workflows meeting the definition, not added) agrees with the docblock's rule that an entry joins only with a reading — no escalation.

Escalated as a follow-up, not a block: the card asked for the three-step rule in references/landing-operations.md with platform-readings.md carrying the readings; the claim kept out of landing-operations.md because seat 2's PR #31583 holds it. The steps now live in platform-readings.md L285-291 only (nit N3).

④ Design judgment

platform-readings.md (hits) — against the card's "Skills rule wanted" and the code it cites on the head:

• L285 (read the log first; a red whose log says it measured nothing is the seat's to clear; never ask the maintainer to click) — the card's rule verbatim in substance; the check-links.yml log sentence it relies on is real (::error title=Link check did not run::… No links were checked — see #8238. Re-run the job.). Holds.
• L286 (① rerun-failed.mjs, once, list = RERUN_FAILED_WORKFLOWS, reason written on the PR or card first) — agrees with rerun-failed.mjs header and the once fence; naming the constant rather than the file names removes the drift the old L288 had. Holds.
• L288 (② refused e.g. lint.yml, base lacks a landed fix, or conflicted ⇒ pr_update_branch, level = no-op, or the dev merges main) — agrees with L88 and landing-operations.md L29; lint.yml is indeed refused (pinned in three self-tests). Holds, with nit N2.
• L291 (③ only a second red that measured something is real; never an empty commit, never close-reopen; the landing note names the step) — card step 3 plus its landing-note requirement. Holds.
• Line budget and byte cap hold (458/458, ≤ 120 B).

ops.mjs — the list and its contract. The docblock's read-only definition (no secrets.* but GITHUB_TOKEN, no environment:, a permissions: block covering every job, no write scope) is the triage comment's definition made precise; check-links.yml meets it on the head's file by direct reading. The head-fence sentence "each listed workflow's concurrency group is keyed by the pull number and cancels in progress on pull_request" is true of both entries on the head. The 'workflow' fence's wants text still says "a closed list, matched whole" — still true at request time; not a contradiction. Tried to break it: a workflow_dispatch run of check-links.yml is refused by the event fence; a stale-head re-run by the head fence; a second attempt by once; a run on a paths:-skipped PR does not exist to re-run. Nothing found.

validate.mjs — the pins are real: the exact list, the frozen state, on-disk pull_request:, the read-only predicate with a control that proves it can fail, and all-five-fences acceptance per entry; the floor moves with the cases. Tried to break the predicate: full-line comments are dropped before the scopes are read; write-all, id-token: write and inline {contents: write} all hit /:\s*write\b|write-all/; an inline trailing comment naming a scope or secret fails closed. Found (N1): the predicate reads ONE file lexically, so a job that uses: a reusable workflow with secrets: inherit would pass it while inheriting secrets and the callee's permissions. On the head no pull_request workflow calls one (the only reusable call in .github/workflows is release.yml L2216 → docker-publish.yml, not a pull_request workflow), so it has no effect on this tree or on either entry.

rerun-failed.mjs — the header, usage and the two new/changed cases agree with the table: fakeBoard patches path over the measured run, so the per-entry case exercises the path alone; exit EXIT_OK with one dispatch per entry; lint.yml refused at the seat with nothing sent. The generalized wiring regex still refuses a one-entry literal and any longer one. Holds.

Findings, graded:

• N1 — nit (scripts/pm/fleet-write/validate.mjs, readOnlyBreaches): single-file lexical predicate does not see a reusable-workflow call (uses: …/.github/workflows/x.yml, secrets: inherit). No pull_request workflow on the head calls one, both entries are judged correctly, and an entry joins only by a reviewed PR — no effect on correctness or the contract. Follow-up card: refuse any job-level uses: of a workflow file, or read the callee.
• N2 — nit (platform-readings.md L288): folding old L291 dropped its timing clause "main 前进后" — the remedy when the re-run is refused AND the PR is level with main (wait for main to advance, then pr_update_branch) is now only implied by "(齐平即空操作)". No effect on the code or the contract; accepted deviation or a one-line follow-up when the file next has headroom.
• N3 — nit (scope): the three steps sit in platform-readings.md alone; the card named landing-operations.md as the landing reference that carries the rule. landing-operations.md on main does not contradict the steps (L28-29). Follow-up: a pointer line in landing-operations.md once PR feat(pm): fold a claim or a verdict into one label-write relay stroke #31583 lands.
• N4 — nit (ops.mjs docblock): the read-only reading is of THIS repo's check-links.yml, while the workflow fence matches the path string on whichever fleet repository the request names (TARGET_REPO_SHAPE) — a pre-existing property the list already had with ci.yml, and the sibling repos could not be read from this session. Accepted deviation; no change to the contract on this head.

No must-fix, no should-fix. Nits alone end the round.

Gate verdicts on the head at the time of this record (last read 2026-11-08, four polls): 45 check-runs — 24 success, 20 skipped (path-filtered lanes), 1 in_progress (Test Core (1/8)), 0 failures. Lint · repo & tooling gates (the relay and rerun-failed self-tests), Lint · PM dispatch-gates, every other Lint and Type Check lane, Check Changeset, Governed Surface Queue Guard and PR-body guards are success. Check Documentation Links did not run on this head (its paths: filter), as expected. Landing waits on the one in-progress shard going green, per Tier S.

Implemented-by: claude/project-thread-fla9sj
Reviewed-by: session_01QsR2jULfPnqQFGcZUtKDFH

VERDICT: PASS

[objectstack-fleet]

domain:skills#3 · zhuangjianguo · session_01QsR2jULfPnqQFGcZUtKDFH

ACCEPT · 2026-11-08T17:30Z — Tier S, on contract-review PASS 6724702446 for this head. Landing waits for the last running check-run.

席位核对

Head-sha: 381f43df61343b1cae10b641f0bcdcdf137eff80

1. Shape: draft, base main, body Fixes #31582, skip-changeset. 4 files, +71/−25. check-governed-merges --pr 31620: Tier S (.claude/** ×1); the three scripts/pm files are off the register.
2. Premise measured: on main RERUN_FAILED_WORKFLOWS was ['.github/workflows/ci.yml'] (ops.mjs L834) and platform-readings.md covered ci.yml only (claim 6724095715). The seat read the diff: the list adds .github/workflows/check-links.yml; every fence is unchanged; validate.mjs pins the exact list plus a per-entry read-only check that can fail; platform-readings.md L285–291 becomes the log-first duty with steps ①–③ at 458/458 lines.
3. Gates: dev gates 49 derived / 49 run, all exit 0, with the red leg shown by planted wrong entries (validate-deps.yml, release.yml, lint.yml). Check-runs on this head at ACCEPT: 24 success, 20 skipped, 0 failure, 1 running (Test Core (1/8)); landing waits for it.
4. Accepted deviations: step ② reads "behind" as "the base lacks a landed fix", consistent with L88. Seven more pull_request workflows meet the read-only definition but are not added (no infra-red incident on record); the PR names why. Review nits accepted as is: N1, the read-only predicate reads one workflow file and would not see a reusable-workflow call with secrets: inherit (no listed workflow makes one); N2, the old "main 前进后" timing is implied by "(齐平即空操作)"; N4, the read-only reading is this repo's file while the fence matches the path on any fleet repo, as it already did for ci.yml.
5. Out of scope / Skills-docs: N3: the steps live in platform-readings.md; landing-operations.md (held by seat 2's PR feat(pm): fold a claim or a verdict into one label-write relay stroke #31583) does not contradict them. A one-line pointer from there is owed after feat(pm): fold a claim or a verdict into one label-write relay stroke #31583 lands; this seat carries it. Metadata-protocol: none, so no Skills-docs: line is owed.
6. Landing: K = 5 first-parent merges since the PR's base 95df3459 (< 15, no refresh). pr_ready + automerge_enable once Test Core (1/8) is green.