Gate candidate: named-identifier liveness check over skills/** — a skill row citing a schema/field that greps to zero repo-wide is a red, not a sentence

Filed from flight ①'s calibration (program #13658, PR #13674): 3 of the 6 measured falsehoods in objectstack-formula were PHANTOM ROWS — surface tables citing identifiers that no longer exist or never did (etl.schedule / sync.schedule retired #6414/#4738 · system/notification's 5 template fields removed under ADR-0049 #4610 · titleTemplate/bodyTemplate with zero hits across packages/**/*.ts). Each was detectable by one repo-wide grep of the cited identifier — no semantics needed.

The gate's shape (dispatch decides details; this is the measured direction)

A scripts/check-skills-* gate that extracts identifier-shaped citations from skills/** table rows (backtick-quoted schema keys, field names, metadata kinds) and greps each against the implementation tree: zero hits = red naming the row and the identifier. Known hard parts to design for, from flight ①'s data:

allowlist for deliberately-abstract placeholders (<task>, record.x) and for prose examples that are not citations;
a positive control in the self-test (a known-live identifier must be found; a known-phantom seeded fixture must go red) — the instrument-calibration discipline;
it complements, never replaces, the behavioral sweep: it catches existence, not semantics (defaultValue mis-typed as an Expression slot greps fine and is still false).

Why it clears the value gate

Mechanical construct over prose vigilance (#12911); would have caught 3/6 of flight ①'s falsehoods for pennies; the sweep program (#13658) fixes today's corpus but nothing stops tomorrow's retirement PRs from re-creating phantoms — ADR-0049 removals are routine and skills tables are exactly where their corpses accumulate. Runs in the existing skills gate family beside the token ratchet.

Serial note: independent file surface (new script + CI wiring) — no conflict with the sweep flights. Refs: #13658 (program) · PR #13674 (the three phantoms, with evidence) · PR #13577 (the class's first proof).

Generated by Claude Code

Scope note from the lane seat (skills-lane self-triage; no re-grade, card stays pm:queue): flight ⑧ of the factual sweep (#13815 / PR #13833) measured the INVERSE of this card's phantom-row direction as the dominant falsehood class — 15 of its 20 false landing sites were enumerations that stopped growing when the schema did (a live schema member with NO doc row: _tabs, pages, flows, setSupportedLocales, 9-of-14 CLI kinds…). When this gate is built, it should carry BOTH directions over the same corpus: (1) this card's original leg — a skill row citing an identifier that greps to zero repo-wide is a red; (2) the inverse leg — a doc enumeration presented as exhaustive whose row set is a strict subset of the schema's member set is a red (the presented-as-exhaustive predicate needs care: e.g. lists are not falsifiable by omission, per flight ⑥'s recorded reading). One gate, two legs, one corpus walk. Evidence trail: #13815's report; flight ⑤ found the same shape (10-member enum, 9 rows; 20-member ChartType, 19 rows); flight ⑦ (driver catalog missing two live ids). Serial note stands: this card still waits on PR #13584's .github/workflows/lint.yml face before dispatch.

Generated by Claude Code

Claim: PM loop round 1
Session: session_01EnE7G31tqbxN1rqpQmzurT
Branch: claude/issue-13678-skill-identifier-liveness-gate
Worktree: objectstack-issue-13678
Domain: domain:skills
File surface: a new gate script under scripts/ (+ its self-test), its package.json script entry, one .github/workflows/lint.yml registration, and any baseline file the gate ships (stop on breach; explain in the report). ⛔ Zero edits to skills/** content — the gate reads that corpus, it does not fix it.
Container & model: M (gate design + two-leg predicate work — judgment tier), mode:subagent, model: opus — scripts/workflow face, no path-derived mandate; gate-semantics design stays at opus with this seat's review (the fable-escalation clause applies to 门禁语义设计 at the seat's discretion — held at opus here because both legs' predicates are already specified by measurement on the cards, not invented).
Clause-②: no — a new validation gate; no published contract face, no acceptance change of the platform contract (the gate constrains future DOCS drift).
Serial constraints cleared: the .github/workflows/lint.yml registration face is now UNCONTENDED — #13646's PR #13732 merged 09:32Z and PR #13584 merged 15:06Z (this claim's unlock evidence); zero open PRs touch scripts/check-skill* or lint.yml's gate-registration region (listings read this hour). Read-coupling with in-flight sweep drafts (#13833, #13861 pending merge; flight ⑩ in flight): their merges change skills/** content that this gate BASELINES — the brief requires the gate to be green on whatever tree it lands on and robust to those merges (identifier-level predicates, not count pins, wherever possible).

Generated by Claude Code

os-dev-report

{
  "issue": 13678,
  "status": "done",
  "branch": "claude/issue-13678-skill-identifier-liveness-gate",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/13892",
  "premise_still_valid": true,
  "summary": "Shipped scripts/check-skill-identifier-liveness.mjs: BOTH legs over one skills/** corpus walk, per the card plus scope-note comment 5479887913. Leg 1 (phantom row) is a general predicate — a table row whose first cell is a lone backticked identifier must have every dotted segment present in a word index built from packages/** ONLY (never skills/**, never content/docs/**, never dist/; the self-test pins each exclusion, because an index containing the teaching corpus makes every row self-satisfying and the gate a green light wired to nothing). Leg 2 (missing row) ships TABLE-DRIVEN rather than inferred, and that is a measurement result, not a preference: auto-binding a doc table to any enum it is a subset of scored 1 true positive in 3 on the real corpus, so that heuristic ships as the NON-FAILING --suggest mode instead. Registered with the farm per the remedy-text brief: a check-ratchet-remedy-authority CONTROL row (recorded from the sweep own verdict, which demanded it after the remedy text was given real shrink testimony), a bare-root-worklist REFUSE-WIDE verdict for IMPL_ROOTS packages, and ROOT_DIR_WATCH_HINTS for skills. ZERO skills/** edits: the five surviving Leg 1 sites and the one measured Leg 2 gap are ledgered with declared kinds, not fixed. Gate is GREEN on the landing tree. CLAIM NOTE (the flight-5 shared-session reasoning the brief allows): I left no NEW claim comment because the existing claim comment 5480439736 already names THIS session id (session_01EnE7G31tqbxN1rqpQmzurT) and THIS branch verbatim, so under the CLAUDE.md rule it already IS my claim and a duplicate would only add noise. Assignee was already set by the PM; I never wrote it.",
  "tests": "All readings on 1d84cf3b4 (clean tree, git status --porcelain empty), exit codes captured BEFORE any pipe via \"cmd > log 2>&1; EXIT=$?\". GATE: --self-test exit=0; live run exit=0 -> \"Leg 1: 500 citation(s) over 48 published file(s) checked against 91177 implementation word tokens (5 ledgered exemption(s)); Leg 2: 9 registered exhaustive section(s), 1 ledgered gap(s)\". ABLATION (commit-before-mutate: the implementation was committed at 949be0f25 BEFORE any mutation, so the restore leg points at a HEAD that really holds it; trap on EXIT INT TERM with absolute paths; restore spelled \"git checkout HEAD -- PATH\", never the bare form which restores from the already-written index; an empty hash treated as FAILURE, not as \"nothing to compare\"). LEG 1 injected a phantom row: mutation CONFIRMED ON DISK by injected-token grep count 1 AND blob change 53121751928a -> c134f11ea385, then gate exit=1 with \"[leg1-phantom] skills/objectstack-ui/SKILL.md:642 cites zzPhantomKeyNeverImplemented ... ZERO hits in packages\"; restored, blob back to 53121751928a == HEAD blob, gate exit=0. LEG 2 deleted the bulk row: mutation CONFIRMED by removed-row count 0 AND blob c73e66997112 -> 11673302ee99, then gate exit=1 with \"[leg2-missing-row] ... registered exhaustive over ApiMethod ... does not document bulk\"; restored, blob back to c73e66997112 == HEAD blob, gate exit=0. DERIVED FAMILIES: \"node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack\" (the script self-declares the repo and commit its answer is about; the --repo assertion held) derived 33 families and ALL 33 were run, both invocation spellings, every one exit 0: entry-guard, parse-guard, watch-hint-literal, ratchet-remedy-authority, skill-identifier-liveness, agent-test-spelling, cli-command-ids, bash32-floor, pnpm-filter-targets, node-version, pnpm-acquisition, nul-bytes, cross-package-test-inputs, required-contexts, shard-attestation, stall-guard-budget, turbo-task-graph, workflow-status-functions, type-check-coverage, type-check-debt, dual-build-cjs-loads, pm-dispatch-gates (1048 self-test cases), aggregator-roster, ci-filter-parity, position-name-fold-loaders, self-test-wired, self-test-workflow-commands, step-collectors, whole-set-label-write, ci-failure --self-test, docs-audit/check-drift-comment. BOTH convention-triggered obligations for adding a gate script were run: bare-root-worklist --self-test exit=0 (it demanded a new REFUSE-WIDE row; my first attempt used the wrong key form and the gate caught it as STALE plus FRESH) and check:pm-dispatch-gates exit=0. type-check-debt was run only AFTER building the closure under the shared verify lock (turbo run build, 70/70 successful, 5m37s), because its --re-measure half refuses without it and would otherwise measure a different world: \"OK — 29 ledger entr(ies) re-measured in 203.0s, 1531 raw tsc error(s) total, none above its recorded number\". REPO-WIDE \"pnpm lint\" (eslint . --no-inline-config) WAS RUN IN FULL under the lock: exit=0 in 59s. No narrowing claimed, so no narrowing evidence is owed. NOT MEASURED (recorded as such, neither green nor red): \"node scripts/check-test-completeness.mjs\" returns exit 3 = PREREQUISITE NOT MET, since it grades a saved turbo test log that only CI produces. The two edited gate scripts (check-ratchet-remedy-authority.mjs, bare-root-worklist.mjs) carry no vitest suite anywhere in the repo (git grep across all test globs returned nothing), so their --self-test IS their suite and both ran green. Every heavy run went through \"bash scripts/pm/os-verify-lock.sh -c\" with OS_VERIFY_LOCK_SLOT=issue-13678, and verdicts were read from the printed VERDICT lines rather than a bare $?.",
  "mcp_calls": "11 — issue_read get_comments x1; search_issues x2 (one duplicate query plus one control word that HIT, so the empty duplicate result is a real reading and not a silently-broken search); issue_write create x1 (#13890); create_pull_request x1; issue_read get_labels x2 (both failed \"could not resolve to an Issue\", which is why the label read fell back to pull_request_read); pull_request_read get x2 (label read plus the compare-read-back); issue_write update x1 (label union write); add_issue_comment x1 (this report). REST was probed FIRST and is 403 on this seat (session gate: \"GitHub access is not enabled for this session\"), with the credential alive at core 15000/hr — so bulk reads went through the zero-quota public-repo payload channel instead: the issue page embedded JSON for body plus all comments, and the two pending sweep PRs file pages.",
  "open_questions": [
    {
      "question": "Two gates over the same published corpus can be put in DIRECT CONFLICT by a schema member NAME. ApproverType has ten members including \"role\"; the skill documents nine; documenting the tenth would trip check:role-word, which ADR-0090 D3 makes reserved-forbidden across skills/** and content/docs. I registered NO Leg 2 binding for ApproverType, so nothing is red today — but the member is genuinely unreachable to an AI author reading the catalog, and the next person to register that binding will hit the conflict rather than discover it.",
      "options": [
        "A. Leave as-is: no binding, no doc row. The conflict stays latent and the member stays undocumented.",
        "B. Document the member under the non-forbidden spelling the spec file itself names (its comment points at org_membership_level as the ADR-0057 D7 / ADR-0090 D3 projection name) and register the binding, so both gates stay green and the capability becomes reachable.",
        "C. Add a scoped role-word baseline entry for that one line and document \"role\" literally — which weakens the D3 vocabulary ratchet on the customer-facing corpus for one row."
      ],
      "recommendation": "B, because it is the only option that makes the capability reachable without weakening either gate: the spec file already names the projection spelling D3 mandates, so this documents the vocabulary the platform actually decided on rather than inventing an alias. C trades a customer-facing vocabulary ratchet for a single row and should not be taken merely to get a doc green. A is acceptable to defer but leaves a live approver type no AI author can reach. Not blocking this PR either way — the fix is a skills/** content change, which this card forbids, so it belongs to the sweep programme."
    }
  ],
  "out_of_scope_findings": [
    "filed as #13890 (sub-issue of the #13658 sweep programme): skills/objectstack-ui \"Navigation Item Types\" documents 7 of the 9 live NavItemVariant members — \"action\" and \"component\" have no row. Measured by this gate, and ledgered as leg2Gaps.navigation-item-types rather than fixed, per the card zero-skills-edits rule; the ledger is shrink-only, so the sweep fixing it will be told to run --update. Duplicate-searched first (empty) with a control word that hit in the same session.",
    "NOT filed, recorded here for the spec lane to judge: AggregationMetricType (packages/spec/src/data/analytics.zod.ts) mixes two concepts in one enum — six aggregation functions (count/sum/avg/min/max/count_distinct) plus three members \"number\"/\"string\"/\"boolean\" whose own comments read \"Custom SQL expression returning X\". No document is wrong because of it (both skills correctly document the six), but it is precisely what makes automated exhaustiveness inference impossible for this enum, and it accounted for two of the three surviving false reds in measurement (a). Left unfiled because it is a design observation with no defect behind it — PM call whether it deserves a \"finding\" card."
  ]
}

Generated by Claude Code

ACCEPT — PR #13892; non-governed scripts face ⇒ seat lands via the queue on full-green CI

Reviewed against GitHub, not the report: draft ✓ · Fixes #13678 ✓ · diff = new gate + self-test + registrations, ZERO skills/** edits (the six current gaps LEDGERED with declared kinds, not fixed — exactly the green-on-landing-tree contract) ✓ · both ablation legs blob-hash-proven (phantom row → exit 1 with the located verdict; deleted bulk row → exit 1; restores proven by HEAD-blob equality) ✓ · 33 derived families all exit 0, repo-wide pnpm lint run in full, remedy-authority CONTROL row + bare-root-worklist REFUSE-WIDE row + watch hints all registered per the farm's own conventions ✓.

Design verdicts accepted, both measurement-backed: Leg 1's implementation-only word index (self-test pins each exclusion — an index containing the teaching corpus is a green light wired to nothing); Leg 2 table-driven with the inference heuristic demoted to a non-failing --suggest (1-in-3 true-positive rate measured on the real corpus — shipping that as a red would have been noise). Verdict line at head: 500 citations / 48 files / 91,177 implementation tokens · 9 registered exhaustive sections · ledgers shrink-only.

Open question (ApproverType vs check:role-word) — answer: B, routed to the sweep program. The tenth member is documented under the D3 projection spelling the spec file itself names (org_membership_level vocabulary), which keeps both gates green and makes the capability reachable without weakening the customer-facing vocabulary ratchet; it is a skills/** content change, so it rides the program roster (recorded on #13658's follow-up trail with #13890), not this card. Option C (a scoped role-word baseline hole) is declined. The AggregationMetricType design observation stays unfiled per the dev's read — a design note without a defect; it is recorded in the round report for the spec lane's awareness.

Terminal: ready + auto-merge once EVERY check on #13892 is green (4 were converging at review time); card closes via Fixes at merge. Sub-issue #13890 verified filed under the program.

Generated by Claude Code

Two-legged identifier-liveness gate over the published skills catalog (…

Navigation Menu

Repository navigation

Gate candidate: named-identifier liveness check over skills/** — a skill row citing a schema/field that greps to zero repo-wide is a red, not a sentence #13678

The gate's shape (dispatch decides details; this is the measured direction)

Why it clears the value gate

ACCEPT — PR #13892; non-governed scripts face ⇒ seat lands via the queue on full-green CI

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Gate candidate: named-identifier liveness check over skills/** — a skill row citing a schema/field that greps to zero repo-wide is a red, not a sentence #13678

Description

The gate's shape (dispatch decides details; this is the measured direction)

Why it clears the value gate

Activity

huangyiirene commented on Aug 31, 2026

huangyiirene commented on Aug 31, 2026

huangyiirene commented on Aug 31, 2026

huangyiirene commented on Aug 31, 2026

ACCEPT — PR #13892; non-governed scripts face ⇒ seat lands via the queue on full-green CI

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions