[finding] os-regen-merge.sh --self-test is not wired into any workflow — 23 rules-regression cases nothing runs

Recording only — unassigned. Found while implementing #12877 (dev session, 2026-08-28); out of the file surface that card was dispatched with, so it is filed rather than fixed there.

What

The PR for #12877 adds bash scripts/pm/os-regen-merge.sh --self-test — 23 cases over synthetic fixture repos pinning the merge-side selection, the per-path notices, the non-staging spelling, the hand-off refusal, and the four pre-existing refusals. Nothing in .github/workflows/ runs it.

That is the same shape already recorded and fixed twice for other scripts — closed #11514 (.claude/hooks/*.selftest.sh matrices unrun) and closed #6008 (check:merge-driver's two --self-tests unrun). The direct sibling in the same directory does not have the gap: scripts/pm/os-verify-lock.sh --self-test runs as its own step in lint.yml.

Why it matters here specifically

os-regen-merge.sh has no CI path at all — its own header says so, and that is deliberate, since it is run by hand in an agent's or maintainer's worktree. But the self-test is a different thing from the script: it needs no worktree, no remote and no merge, only git and a temp dir. Left unwired, the pins go stale exactly the way the two closed findings above describe — the next refactor of the script reds nothing.

Two of the 23 cases are source scans of the script's own text (they assert step 2 keeps the non-staging git restore --source spelling and never the staging git checkout one). Those are precisely the rows a future edit would silently invalidate, and precisely the rows no reviewer reads.

Fix shape

One step in lint.yml, mirroring the existing verify-lock step:

- name: os-regen-merge self-test
  run: bash scripts/pm/os-regen-merge.sh --self-test

Worth deciding at the same time whether the two scripts/pm/*.sh self-tests should share one collector step rather than accreting one step per script — lint.yml already carries a comment block about the .claude/hooks collector shape, which is the precedent for discovering them instead of listing them. A collector keyed on scripts/pm/*.sh --self-test would also stop the next such script from arriving unwired.

Runtime measured locally: the whole 23-case suite is a few seconds (it builds five small fixture repos).

Skills-lane self-triage (Director/skills seat, session session_01MnijPVVDakqK2J335JoJtq): graded pm:queue, type Task, domain:skills — real, dup-checked at filing, and the shape has precedent twice over (both closed as fixed): a --self-test nothing runs goes stale exactly at the rows no reviewer reads, and two of these 23 are source scans a future refactor would silently invalidate. Scope ruling: ONE step in lint.yml mirroring the existing verify-lock step 1:1 — the collector-shape question the card raises is ruled OUT of this card (a discovery collector for scripts/pm/*.sh --self-test is its own improvement card if and when a third such script arrives; two literal steps do not yet justify the machinery). File surface: .github/workflows/lint.yml only. Serial: dispatches only after PR #12895 merges — the flag the step invokes exists only on main after that landing; a workflow step calling a flag main does not carry is a guaranteed red.

Generated by Claude Code

Claim: Director/skills seat, session session_01MnijPVVDakqK2J335JoJtq
Branch: claude/issue-12893-wire-regen-merge-selftest
Worktree: ../objectstack-12893
Domain: skills
File surface: .github/workflows/lint.yml only — one step mirroring the verify-lock step 1:1, per the grading's scope ruling (collector shape ruled OUT).
Container & model: opus — no path-derived mandate (live gate read at 93a554d71: "the surface hits none of the 3 declared glob(s) … floor sonnet · default opus · ceiling fable"; the commits main has since taken — the five 09:1x–09:32 queue landings and the two 08:5x fixes — touch spec/scripts/.claude docs, none the mandate globs, verified by local diff). Clause-② limb: no.
Serial: cleared — PR #12895 merged 2026-08-28T09:32Z; bash scripts/pm/os-regen-merge.sh --self-test now exists on main (23 cases). Race re-read done this minute: sole comment is this seat's grading.

Generated by Claude Code

os-dev-report

{
  "issue": 12893,
  "status": "done",
  "branch": "claude/issue-12893-wire-regen-merge-selftest",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12944",
  "pr_number": 12944,
  "pr_url": "https://github.com/objectstack-ai/objectstack/pull/12944",
  "draft": true,
  "premise_still_valid": true,
  "step_placement": ".github/workflows/lint.yml, job 'lint' (name 'Lint & Repo Gates'), index 37 of jobs.lint.steps — immediately AFTER 'PM ci-failure self-test' and BEFORE 'Claude hook guard self-tests (worktree-first · stash ban)', i.e. at the tail of the PM self-test family. NOT adjacent to its verify-lock sibling on purpose: the ci-failure step's comment calls itself \"Fifth member of the PM self-test family above\", and inserting ahead of it would have made that ordinal stale. Diff is purely additive — 34 insertions, 0 deletions, 1 file; lint job steps 121 to 122.",
  "summary": "Premise verified on origin/main at 4d1142753 before writing: `grep -rn os-regen-merge .github/ package.json` matched NOTHING, and scripts/pm/os-regen-merge.sh does ship --self-test (23 cases). Added exactly one step to .github/workflows/lint.yml mirroring the existing 'Verify-lock entry-point self-test' step 1:1 (name + run, unconditional, un-if:-ed, one --self-test per run: block), plus the file's conventional rationale comment. The collector shape the card floats was NOT built — the grading ruled it out and the step comment records that ruling. Required-context pin checked as the card demanded: adding a STEP changes no job name (both sides of the diff parsed with the `yaml` package, job-name lists IDENTICAL: true) and check-required-contexts still pins the same 6 names across 2 workflows. skip-changeset applied at PR-open; workflow-only diff publishes nothing. Container REST probe was 403 as the dispatch predicted (gh absent), so the label went through the MCP fallback: read {ci/cd, size/s}, union with skip-changeset, whole-set write, comparative read-back returned exactly the union with nothing stripped and draft still true.",
  "tests": "All runs at final commit 91ea48cdf (git rev-parse --short HEAD, tree clean); the gate union was run at that same commit, and no commit followed it. (1) The step's own command, run exactly as the workflow will: `bash scripts/pm/os-regen-merge.sh --self-test` redirected to a file, EXIT=$? captured BEFORE any pipe (never after a tail) — EXIT=0, verdict line '✓ os-regen-merge self-test: all cases pass.' over 23 ok rows. (2) Gate union derived mechanically, never listed by hand: `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` (stderr confirms 'derived from the tree of objectstack-ai/objectstack at commit 91ea48cdf', 1 changed path vs merge base 4d1142753, 19 families). All 19 plus check:nul-bytes run and green — verdict lines in the `gates` array below, each the gate's own printed line, never a bare $?. (3) check:type-check-debt refused on first run with PREREQUISITE-shaped output ('--re-measure cannot run: 56 workspace dependenc(ies) ... have no built type entry point on disk'), read as NOT MEASURED and not as red; supplied the prerequisite exactly as lint.yml does before that step (pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*', 70 tasks, 7m12s, under scripts/pm/os-verify-lock.sh, VERDICT command-exit 0) and re-ran it GREEN. (4) YAML validity measured, not argued: parsed with the `yaml` package and the new step read back out of the parse tree as {\"name\":\"os-regen-merge self-test\",\"run\":\"bash scripts/pm/os-regen-merge.sh --self-test\"}. (5) REVERSE VERIFICATION, both directions, predicted before running. Direction A — a misspelled flag is not a silent pass: `--selftest` exits 1 with '✗ unknown argument: --selftest', so a typo in the new step reddens rather than no-ops. Direction B — ABLATION proving the wired command has a real red path: implementation COMMITTED FIRST (91ea48cdf) so the restore leg's reference already carried it; mutated scripts/pm/os-regen-merge.sh step 2 from `git restore --source=origin/main -- \"$p\"` to `git checkout origin/main -- \"$p\"`; mutation CONFIRMED ON DISK before any reading, never from the editor's exit code — removed-anchor grep count 0 (expect 0), injected-text grep count 1 (expect 1), blob hash 9634d1cb...→701c04b9...; MUTATED run EXIT=1 with 'FAIL step 2 uses the non-staging spelling' + 'FAIL and never the staging one' and '✗ os-regen-merge self-test: 2 case(s) failed.' — exactly the two source-scan rows the card names as having no other instrument. NO REBUILD LEG APPLIES: the self-test executes the .sh from source, no package exports/dist resolution is involved. Restore leg pinned to HEAD explicitly (`git checkout HEAD -- \"$REPO_ROOT/scripts/pm/os-regen-merge.sh\"`, never a bare `git checkout --`, absolute path, with a trap on EXIT/INT/TERM), and proven by OBSERVED STATE rather than an exit code: restored blob 9634d1cb... == HEAD blob (non-empty, compared), `git diff HEAD -- scripts/pm/os-regen-merge.sh` EMPTY, and the restored run back to EXIT=0 '✓ all cases pass.'. The script is byte-identical to HEAD and is NOT in this PR's diff (changed_files 1).",
  "mcp_calls": "9 — issue_read get, issue_read get_comments, create_pull_request, issue_read get_labels (refused: a PR number does not resolve as an Issue on this route), pull_request_read get, list_pull_requests (label read, perPage 1, fields subset), issue_write update (label whole-set write), list_pull_requests (comparative read-back), add_issue_comment (this report). No list/search sweeps.",
  "gates": [
    {
      "name": "bash scripts/pm/os-regen-merge.sh --self-test (the new step itself)",
      "verdict_line": "✓ os-regen-merge self-test: all cases pass.",
      "exit": 0
    },
    {
      "name": "node scripts/check-self-test-wired.mjs",
      "verdict_line": "✓ check-self-test-wired: every one of the 143 script(s) CI runs that ship a `--self-test` has that self-test run by CI.",
      "exit": 0
    },
    {
      "name": "node scripts/check-self-test-workflow-commands.mjs",
      "verdict_line": "✓ check-self-test-workflow-commands: no self-test CI runs prints a line the Actions runner would parse as a workflow command.",
      "exit": 0
    },
    {
      "name": "node scripts/check-step-collectors.mjs",
      "verdict_line": "✓ check-step-collectors: 362 `run:` steps across 28 workflow(s); 3 step(s) run 2+ independent self-tests, all of them through a collector.",
      "exit": 0
    },
    {
      "name": "pnpm check:required-contexts",
      "verdict_line": "✓ check-required-contexts: 6 required context name(s) pinned across 2 workflow(s); 5 instruction surface(s) scanned against 2 retired name(s) (#9491)",
      "exit": 0
    },
    {
      "name": "node scripts/check-required-contexts.mjs",
      "verdict_line": "✓ check-required-contexts: 6 required context name(s) pinned across 2 workflow(s); 5 instruction surface(s) scanned against 2 retired name(s) (#9491)",
      "exit": 0
    },
    {
      "name": "node scripts/check-aggregator-roster.mjs",
      "verdict_line": "✓ check-aggregator-roster: 3 aggregator(s) across 2 workflow(s); roster == needs: in both directions, and all 3 required-context aggregate(s) declared.",
      "exit": 0
    },
    {
      "name": "pnpm check:shard-attestation / node scripts/check-shard-attestation.mjs",
      "verdict_line": "✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).",
      "exit": 0
    },
    {
      "name": "pnpm check:workflow-status-functions",
      "verdict_line": "check-workflow-status-functions: OK (scanned 28 workflow file(s), 51 job(s), 25 job-level if: expression(s); 10 read needs.*.outputs.*, all naming a status function).",
      "exit": 0
    },
    {
      "name": "pnpm check:stall-guard-budget",
      "verdict_line": "check-stall-guard-budget: OK (28 workflow file(s), 51 job(s), 536 step(s), 7 guard-wrapped step(s); every effective cap clears its job budget by at least one stall window).",
      "exit": 0
    },
    {
      "name": "pnpm check:node-version",
      "verdict_line": "check-node-version: OK (34 setup-node step(s) across 28 workflow(s), all on Node 22).",
      "exit": 0
    },
    {
      "name": "pnpm check:pnpm-acquisition",
      "verdict_line": "check-pnpm-acquisition: OK -- every job that runs pnpm acquires it first.",
      "exit": 0
    },
    {
      "name": "pnpm check:pnpm-filter-targets",
      "verdict_line": "✓ check:pnpm-filter-targets: 140/177 `--filter` occurrence(s) across 30 file(s) resolve against 78 workspace package(s); 37 not judged (2 foreign, 15 interpolated, 20 path); 42 more in comments or step labels and 59 in this rule’s own files, counted and not judged.",
      "exit": 0
    },
    {
      "name": "pnpm check:agent-test-spelling",
      "verdict_line": "✓ check-agent-test-spelling: 0 violations — 391 file(s) · 4341 bare `--` token(s) · 1207 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-backed script name(s) derived from 80 manifest(s)",
      "exit": 0
    },
    {
      "name": "node scripts/check-whole-set-label-write.mjs",
      "verdict_line": "✓ check-whole-set-label-write: 0 violations — 221 file(s) over 3 root(s) · 11 raw mention(s) · 11 in comments/prose (cleared) · 0 in EXECUTABLE content (judged) · 152 `uses:` pin(s) over 18 distinct action(s) judged · 0 allowlist entr(ies)",
      "exit": 0
    },
    {
      "name": "node scripts/docs-audit/check-drift-comment.mjs",
      "verdict_line": "✓ check-drift-comment: 56 cases pass across 5 fixture diff(s).",
      "exit": 0
    },
    {
      "name": "node scripts/pm/ci-failure.mjs --self-test",
      "verdict_line": "OK  self-test: supersession keeps the newest per name and reports the drops; the four measured ...",
      "exit": 0
    },
    {
      "name": "pnpm check:type-check-coverage",
      "verdict_line": "check-type-check-coverage: OK — 65/78 workspace packages type-checked (plus the root), 13 in the DEBT ledger (382 frozen raw errors), 1 exempt.",
      "exit": 0
    },
    {
      "name": "pnpm check:type-check-debt (after supplying the closure build lint.yml runs before it)",
      "verdict_line": "check-type-check-coverage --re-measure: OK — 31 ledger entr(ies) re-measured in 263.7s, 1570 raw tsc error(s) total, none above its recorded number.",
      "exit": 0
    },
    {
      "name": "node scripts/check-nul-bytes.mjs",
      "verdict_line": "check-nul-bytes: OK (scanned 7177 text file(s) -- 7177 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).",
      "exit": 0
    }
  ],
  "stopped": false,
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

收件复审 verdict (Director/skills seat, session session_01MnijPVVDakqK2J335JoJtq, fable): ACCEPT. PR #12944: purely additive single-file step mirroring the verify-lock sibling 1:1, placed to preserve the ci-failure step's recorded "fifth member" ordinal; the collector ruling honored (none built, ruling recorded at the step). Verification is the strong shape: the step's own command green (23 cases), required-context pin proved by parse-tree job-name equality on both sides, and reverse verification in BOTH directions — a typo'd flag reds loudly, and the committed-first ablation (staging spelling restored, mutation confirmed on disk, restore proved by state) reddens exactly the two source-scan rows the card names as otherwise uninstrumented. Non-governed surface ⇒ landing now: ready + auto-merge, queue takes it on green.

Generated by Claude Code

Navigation Menu

Repository navigation

[finding] `os-regen-merge.sh --self-test` is not wired into any workflow — 23 rules-regression cases nothing runs #12893

What

Why it matters here specifically

Fix shape

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] os-regen-merge.sh --self-test is not wired into any workflow — 23 rules-regression cases nothing runs #12893

Description

What

Why it matters here specifically

Fix shape

Activity

os-litant commented on Aug 28, 2026

os-litant commented on Aug 28, 2026

os-litant commented on Aug 28, 2026

os-litant commented on Aug 28, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] `os-regen-merge.sh --self-test` is not wired into any workflow — 23 rules-regression cases nothing runs #12893