[Decision] The required Test Core and Dogfood Regression Gate go red on superseded runs (139 in 51 h, 0 real catches): keep #16157's ruled reading, or decide by the cancel cause the platform records?

Ruled: 6097061442 · letter B · 2026-10-10T11:33Z

Filing gate ②: a decision only the maintainer can make. It re-opens a recorded ruling whose stated cost was left unmeasured and is now measured. Filed by the domain:devx seat 1 (seat post #6023) · marchtian · session_01Q7Fy4uVkvBWgj9CLihdATJ, from the dev measurement on #22606 (report 6095932568). Reader: the director seat, then the domain:devx execution seat. ⛔ Not a claim.

Dedupe: REST list repos/objectstack-ai/objectstack/issues?state=all&labels=domain:devx (18 pages, 1709 issues, open and closed), titles grepped for attest|supersed|cancel → 14 hits. The near ones are #16157 (closed, the ruling this re-opens), #22606 (open, the single-leg false green; it does not cover this), #11998, #16928 and #8409 (closed, other attestation and cancel defects). None is this question. The MCP issue search was not usable here: it answered 0 for attestation cancelled, which #22606 and #16157 both contain. Dedupe words: attestation partial cancel superseded false red · Test Core red superseded sha.

维护者速读

改了什么(提议): 两个必过检查(Test Core、Dogfood Regression Gate)在「部分分片已存证、其余被取消」时,不再一律判红,而是读 GitHub 在被取消任务上记录的取消原因:被新推送取代 ⇒ 放行;被自身超时杀掉 ⇒ 判红并点名;读不到或其它原因 ⇒ 判红(失败即关)。
为什么改: [finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled #16157 的裁定(A)用「有兄弟分片已存证」来推断「这次没被取代」。当时已写明它会在真取代场景误红,但误红率没测。现在测了:51 小时内误红 139 次(Test Core 117、Dogfood 22,其中约 71 次在 main 的 push 运行上),真命中 0 次。必过检查天天在死掉的提交上报红,席位会学会无视红灯。
风险与代价(含回滚): 需要给两个汇总任务加只读权限(actions: read、checks: read),只在少见路径上多一次 API 读;依赖 GitHub 的取消原文措辞,措辞一变就退回判红(等于今天的裁定 A),不会退成假绿。回滚 = 撤掉一个分支判断。
席位意见: 选 B。它是唯一既保住 [finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled #16157 真正要抓的「分片被自身超时杀掉 ⇒ 红」,又去掉取代误红的方案。ci: the required Dogfood Regression Gate goes green when its single-leg Dogfood Verify CLI is killed by its own job timeout mid-suite (#16157's split does not reach a 1/1 leg) #22606 已按同一机制修单腿那一半(不动 [finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled #16157 的已裁行为),本卡获批后只是把同一读取延伸到部分存证路径。
你要做的: 回一个字母:A(维持现裁)/ B(按平台记录的取消原因判)/ C(退回 CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668 的纯放行)。

Governing text

The ruling this re-opens, [finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled #16157 5559243179 (director seat, decision batch Prepare v0.2.0 release for ObjectStack packages #54; the maintainer's reply 「同意」): "when a leg's aggregate result is cancelled and at least one shard of that leg attested, the declared roster (1..N/N) is still knowable — count it, name every missing shard, and fail the required check. The whole-matrix-superseded case (aggregate cancelled, zero attestations) keeps CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668's behaviour: passes without counting."
The cost that ruling's options named and left open, triage 5556849727 (verbatim): 「代价是真的 supersession 场景里,若有 shard 抢在取消前 attest 完,会误红。⚠️ 这个误红率没人测过——它取决于 cancel-in-progress 触发时 shard 完成的分布,这是取卡人该先补的读数。」
AGENTS.md § Route & surface ownership, rule 3: "a verifier that silently degrades … is worse than no verifier, because it reports success. Prefer failing to falling back." This is why option B fails closed.
check-prior-rulings.mjs --card 16157 --terms attestation,superseded,cancelled,shard: the ADR hits (ADR-0087 D4, ADR-0106 D8) use "superseded" in other senses and do not govern this. The thread ruling is 5559243179.
Protocol: this changes no spec and no published contract. It changes the verdict logic of two required CI checks (scripts/check-shard-attestation.mjs) and the permissions of their two aggregate jobs in .github/workflows/ci.yml.

Premises (each with its re-check)

The ruled reading reds superseded runs, and caught nothing real in the window. Reading: 1000 most recent ci.yml runs, 329 non-success, created 2026-10-08T05:51Z..2026-10-10T08:50Z. The partial-attestation red fired 139 times (117 Test Core, 22 Dogfood; 52 PR runs and 65 push runs on main for Test Core). Every one was a supersession, and none was an own-timeout kill. Across the (run, gate) pairs where an attested sibling sat beside an unattested cancelled leg or shard, "a sibling attested ⇒ not superseded" held 1 time in 157. The method is in 6095932568. Spot check by this seat: run 38036705318 (PR fix(cli): os migrate reads the project .env files as os serve does, and names its database source (#22581) #22644, head 9a581420e) has Test Core (5/6) success, the five others cancelled, and the aggregate Test Core = failure. The newer run 38037199061 was created at 2026-10-10T08:14:38Z on the same PR. Re-check: gh api "repos/objectstack-ai/objectstack/actions/runs/38036705318/jobs?filter=latest&per_page=100" --jq '.jobs[]|select(.name|test("^Test Core"))|"\(.name) \(.conclusion)"'.
The platform records the cause on the cancelled job's check run. Read by this seat: job 114123251343 reads The job has exceeded the maximum execution time of 20m0s; job 114005072147 reads Canceling since a higher priority waiting request for ci-CI-push-refs/heads/main exists; job 114173074639 reads Canceling since a higher priority waiting request for ci-CI-pull_request-22645 exists. Re-check: gh api repos/objectstack-ai/objectstack/check-runs/114123251343/annotations --jq '.[].message' (positive control: the same call on 114005072147 must print the Canceling since line).
Nothing the gate step reads today carries the cause. judge() receives leg results, the filter result, the download outcome, the credentials and GITHUB_RUN_ID/ATTEMPT (6095932568). Re-check: read judge({ gate, legs, filterResult, present, runId, runAttempt, downloadOutcome }) in scripts/check-shard-attestation.mjs on origin/main.

The question

When a required test matrix is cancelled part-way and some shards already attested, how should the required check decide between "a newer push replaced this run" (nothing to report) and "a shard was killed by its own timeout" (a real gap to report)?

Options × real cost

	what it does	what a customer of the gate sees	workload
A keep the ruling	any partial attestation ⇒ red	measured: ~65 required-check reds a day on dead SHAs, about half of them on `main` push runs; a real own-timeout kill is red too (0 in the window)	none: 0 PRs
B read the recorded cause	on the ambiguous path only, read the cancelled jobs' check-run cause: superseded ⇒ pass (#3668), own-timeout ⇒ red naming the shard, unreadable or other (a manual cancel included) ⇒ red	the 139 false reds go; the real kill stays red; one read-only API call on a rare path; a GitHub wording change degrades to A, never to a false green	`domain:devx` · 1 PR (`judge()` partial path, its batteries, the `Test Core` aggregate job's `permissions`) · precedent: PR #22666 built the reader for the single-leg path (+660/−19, 2 files, not yet merged); B is a second caller of it
C back to #3668	any cancelled leg ⇒ pass	no false reds, but #16157's defect returns: a shard killed mid-suite turns the required check green over untested packages	`domain:devx` · 1 PR · precedent: the inverse of PR #16316 (+136/−21, 1 file)

Business meaning: A is a smoke alarm that rings whenever anyone walks out of the kitchen. B reads the shutdown log before it rings. C takes the battery out.

四维分析

项目长远合理性: B 用事实(平台记录的取消原因)替代推断,是唯一不再叠加「代理信号」的方案。A 保留一个实测 1/157 成立的推断。C 是倒退。
实际业务需求: 拉动是实测的。51 小时 139 次误红,落在每个被新推送取代的 PR 与 main push 运行上;真命中 0 次。[finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled #16157 要防的真实场景(分片被超时杀掉后检查变绿)仍需要保住,C 做不到。
防 AI 写代码犯错: 出错时谁看到什么。A:席位每天看到几十次必过检查在死提交上变红,学会无视红灯,真红到来时被当噪音放过。C:未测的包静默变绿进 main。B:两者都不发生;读不到原因时响亮判红,不会静默放行。
创业阶段不扩散: B 不新增门禁、不新增脚本,只在既有 judge() 的一条分支里多一个只读读数,加两个任务的只读权限。A 零改动,但持续付噪音成本。

os-decision-facets

① 长远合理性:B 以平台事实替代推断,收缩特例;A 保留实测 1/157 的代理;C 倒退。
② 业务拉动:实测 51h 内 139 次误红、0 次真命中;今天每个被取代的 PR 与 main push 都撞上。
③ 防 AI 犯错:B 读不到即响亮判红(失败即关);A 训练席位无视红灯;C 静默放行未测代码。
④ 不扩散:B 无新门禁、无新脚本,只加一个只读读数与两个任务的只读权限。
Prior rulings read: attestation,superseded,cancelled,shard → 4 hits; ADR-0087 D4, ADR-0106 D8 (other senses of "superseded", not governing); thread: 1 ruling(s) (5559243179 on [finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled #16157); repo: objectstack-ai/objectstack

Recommendation: B. Fallback: A, the current ruling. The end state in two years: the required checks decide by what the platform recorded, as GitHub's own required-check model does for its native statuses (a cancelled check is neither success nor failure until something states why). Only on ① it is B; do ②③④ flip it? No.
Confidence gap: the window is the API listing cap (about 51 h; about 96 earlier runs of 2026-10-08 were not read). Own-timeout kills outside it are unmeasured. B's reliance on GitHub's cancel wording is a platform fact, not a contract, which is why it fails closed.

After the ruling

B: one dispatch in the domain:devx lane extends the cause reader that ci: the required Dogfood Regression Gate goes green when its single-leg Dogfood Verify CLI is killed by its own job timeout mid-suite (#16157's split does not reach a 1/1 leg) #22606 introduces for the single-leg path to the partial-attestation path of both gates. That covers judge(), its batteries (a superseded partial matrix ⇒ pass; an own-timeout partial ⇒ red naming the shard; an unreadable cause ⇒ red), and permissions on the Test Core aggregate job. The PR carries Clause-②: yes, as [finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled #16157's ruling set for a required-check semantics change, and lands on a contract-review-tier review.
A: nothing changes. ci: the required Dogfood Regression Gate goes green when its single-leg Dogfood Verify CLI is killed by its own job timeout mid-suite (#16157's split does not reach a 1/1 leg) #22606's single-leg fix lands as its own card, and this card closes with the measurement recorded.
C: not recommended. It re-opens [finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled #16157's defect.

Addendum for the decision: the single-leg half is implemented; one more shape the same cause read would decide

domain:devx seat 1 (seat post #6023) · marchtian · session_01Q7Fy4uVkvBWgj9CLihdATJ · 2026-10-10T09:58Z. ⛔ Not a ruling and not a re-presentation. This adds two facts to the card as filed.

ci: the required Dogfood Regression Gate goes green when its single-leg Dogfood Verify CLI is killed by its own job timeout mid-suite (#16157's split does not reach a 1/1 leg) #22606's half is built and reviewed. PR fix(ci): judge a cancelled single-leg roster by its recorded cancel cause (Dogfood Regression Gate) #22666 reads the recorded cancel cause for a single-leg roster beside an attested sibling. The contract-review record 6096338720 reads PASS on head 80e3b2313, and the PR goes to the queue once CI is green. The mechanism option B would extend therefore exists: classifyCancelAnnotations and the attempt-jobs read in scripts/check-shard-attestation.mjs. B is a second caller of it, not a new reader.
A residual the review names, which only B's direction would reach: a run in which every leg of a gate reads cancelled with zero credentials still passes as a supersession under CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668, without a cause read. So a run whose dogfood matrix and dogfood-verify were both killed by their own timeouts, with nothing superseding it, still reads green. In the measured 51-hour window that shape occurred 0 times as an own-timeout. The 47 both-cancelled dogfood runs were all supersessions, and so was every all-shards-cancelled Test Core run. If B is chosen, the follow-up dispatch can read the cause on this shape too, so that "superseded" is a recorded fact rather than a count, at the cost of one read on a path that is today free.

The decision being asked is unchanged: A / B / C, as filed.

Triage: grade only, `tooling` · `priority:p1` · `domain:devx` · `area:devpath`. `needs-user-decision` stays: re-opening a recorded ruling (#16157 A) is the maintainer's

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-10T10:01Z. ⛔ Not a claim, ⛔ not a dispatch.

Lane: the attestation judge (scripts/check-shard-attestation.mjs) and the two aggregate jobs are domain:devx, as [finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled #16157 and ci: the required Dogfood Regression Gate goes green when its single-leg Dogfood Verify CLI is killed by its own job timeout mid-suite (#16157's split does not reach a 1/1 leg) #22606 were.
Why p1: two required contexts went red 139 times in 51 h with 0 real catches, about 71 of them on main pushes. A required red that is usually noise teaches every seat to ignore red. That is the failure mode the required gates exist to prevent.
For the presentation, from the card: the proposed reading fails closed. An unreadable or unknown cancel cause stays red, which is today's ruling A, so it can never turn into a false green.
The new grant is a security fact: actions: read and checks: read on the two aggregate jobs. It is read-only, but it is a workflow permission change, so the ruling should name it.
Not touched: ci: the required Dogfood Regression Gate goes green when its single-leg Dogfood Verify CLI is killed by its own job timeout mid-suite (#16157's split does not reach a 1/1 leg) #22606 (the single-leg killed leg) is being built on PR fix(ci): judge a cancelled single-leg roster by its recorded cancel cause (Dogfood Regression Gate) #22666 under the current ruling. It does not wait for this decision.

Ruling: batch #312 item 1 · letter B · maintainer 「同意」 2026-10-10T11:33Z

Director seat, summon #36, session_019fWAt2renophxLVg5aJXMH (GitHub hotlong; written as objectstack-fleet[bot] via the relay). Batch #312 (two cards, this one first) was presented in chat with this seat's own readings and the recommendation B, fallback A; the maintainer answered 「同意」, which takes the recommendation. Freshness gate: the body and both comments (the seat's addendum 6096349941 and triage's grade 6096366764) were re-read before this record; PR #22666 merged at 10:56Z and #22606 closed, so the cause reader B extends is on main. Thread-read: 6096366764.

The ruling

B — on the partial-attestation path, the required check decides by the cancel cause the platform recorded. When a leg's aggregate result is cancelled and at least one shard attested, judge() reads the cancelled jobs' check-run annotations through the reader PR fix(ci): judge a cancelled single-leg roster by its recorded cancel cause (Dogfood Regression Gate) #22666 landed (classifyCancelAnnotations and the attempt-jobs read in scripts/check-shard-attestation.mjs): superseded by a higher-priority request ⇒ pass, as CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668 passes a whole-matrix supersession; killed by its own timeout ⇒ red, naming the shard; unreadable, or any other cause (a manual cancel included) ⇒ red. Both gates (Test Core, Dogfood Regression Gate). The Test Core aggregate job gains actions: read and checks: read, read-only, named here because a workflow permission change is a security fact.
[finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled #16157's ruling (5559243179) is amended, not reversed. Its purpose, that a shard killed mid-suite never turns the required check green, stands; its proxy, "a sibling attested ⇒ not superseded", measured true 1 time in 157, is replaced by the recorded cause. A GitHub wording change degrades to that ruling's reading (red), never to a false green.
Not extended, decided here so nothing returns to the box: the whole-matrix-cancelled path with zero attestations keeps CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668's count-based pass without a cause read. The seat's addendum (6096349941) measured that shape 0 times as an own-timeout kill in the window; adding a read to a path that is free today is a new gate with no measured catch. It is an acceptance note on the execution, not a build.
⛔ Not taken: A (keep the ruling as read: about 65 required-check reds a day on dead SHAs, half on main pushes, teaching every seat to ignore red) and C (back to CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668: a shard killed mid-suite greens the required check over untested packages, the defect [finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled #16157 closed).

Why B on the first axis

It replaces an inference with the platform's recorded fact and fails closed where the fact is missing; it adds no gate and no script, one read on one branch of judge(). GitHub's own required-check model reads the same way: a cancelled check is neither a success nor a failure until something states why.

Prior rulings read: #16157 (5559243179, batch #54 「同意」) and its cost note (5556849727); #3668; #22606 and PR #22666 (merged 10:56Z, head 80e3b23, contract review PASS 6096338720); judge() at scripts/check-shard-attestation.mjs:264-340; the annotations on jobs 114005072147 (superseded) and 114123251343 (own timeout); run 38036705318 (Test Core (5/6) success, five cancelled, aggregate failure); AGENTS.md § Route & surface ownership, rule 3; thread: 6096366764. 自检:只看①选 B;②③④是否翻转:否。

State and execution

needs-user-decision → pm:queue in this act; tooling, priority:p1, domain:devx, area:devpath unchanged, no assignee. The body gains its Ruled: line in the same act.
Execution: one domain:devx dispatch on top of PR fix(ci): judge a cancelled single-leg roster by its recorded cancel cause (Dogfood Regression Gate) #22666's reader: the partial path of judge() for both gates, its batteries (a superseded partial matrix ⇒ pass; an own-timeout partial ⇒ red naming the shard; an unreadable cause ⇒ red), and the Test Core aggregate job's permissions. Clause-②: yes, as [finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled #16157 set for a required-check semantics change; one contract-review-tier review before the queue. Workload by precedent (PR fix(ci): judge a cancelled single-leg roster by its recorded cancel cause (Dogfood Regression Gate) #22666, +660/−19, 2 files): a second caller of the same reader, roughly 150–300 lines, 1 PR.

Generated by Claude Code

Claim: PM loop round 1
Session: session_01Q7Fy4uVkvBWgj9CLihdATJ
Account: marchtian (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22653-partial-cancel-cause
Worktree: objectstack-issue-22653
Domain: domain:devx
Seat: domain:devx#1
Ruling-ref: 6097061442 (batch #312 item 1 · letter B · maintainer 「同意」, re-read in this act)
Governing text: the ruling 6097061442, which amends #16157's ruling 5559243179; #3668's whole-matrix pass is kept as ruled.
File surface: scripts/check-shard-attestation.mjs (the partial-attestation branch of judge() and the --verify cause read for it, reusing classifyCancelAnnotations and the attempt-jobs read PR #22666 landed, plus their --self-test batteries) and .github/workflows/ci.yml, the Test Core aggregate job (test-gate) only: its permissions (actions: read, checks: read beside contents: read) and its verify step's env (GITHUB_TOKEN). The Dogfood Regression Gate job already carries both. ⛔ No job or step rename, ⛔ no new gate script, ⛔ no cause read on the whole-matrix zero-attestation path (ruled not extended). (Stop on breach; explain in the report.)
Container & model: M (a second caller of a landed reader on a required gate; batteries and an ablation), mode:subagent, model: opus — the default tier; dispatch-gates --tier: "no path-derived mandate"
Clause-②: yes
Responsibility: whose code: this repo's scripts/check-shard-attestation.mjs judge(), whose partial-attestation branch reds every partially attested cancelled matrix | covering path: none today; the cause reader PR #22666 landed covers only the single-leg path | who reaches it: every PR and main push whose Test Core or Dogfood matrix a newer push supersedes after a shard attested (139 in 51 h measured, about 71 on main)
Thread-read: 6097061442
Serial constraints cleared: no open PR touches .github/workflows/ci.yml or scripts/check-shard-attestation.mjs (8 open PRs' file lists read). PR #22666 (the reader) merged at 182ec26177; origin/main is 243dd3c625. — read at 2026-10-10T12:51Z

Labels in this act: pm:queue → pm:dispatched; assignee marchtian.

os-dev-report

{
  "issue": 22653,
  "status": "done",
  "branch": "claude/issue-22653-partial-cancel-cause",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22685",
  "session": "session_01Q7Fy4uVkvBWgj9CLihdATJ (subagent: the parent's id, as the dispatch names it)",
  "premise_still_valid": true,
  "summary": "Executed ruling 6097061442 (B) as draft PR #22685 at head 036dfe5894 (its body's first line is the closing keyword for this card, the second Clause-②: yes). On the partial-attestation path of judge() (a leg reads cancelled after at least one of its own shards attested), each unattested shard is now asked for the cause the platform recorded on its own check run, for both gates. If every one is a recorded supersession, the leg passes (#3668). A shard killed by its own job timeout is red, naming it. Any other cause, a manual cancel included, or an unreadable one is red. shardsNeedingCancelCause replaces legsNeedingCancelCause as one per-shard question keyed by attestation id, covering this path and #22606's single-leg path. readCancelCauses reuses the landed reader unchanged: one attempt-jobs list, then one annotations read per asked shard. It finds a matrix shard by its expanded name via workflowJobDisplayName(text, job, shard). The static guard is extended to every matrix leg, test-gate included. ci.yml test-gate gains actions: read, checks: read and GITHUB_TOKEN on its verify step; nothing is renamed and no other job is touched. The zero-attestation whole-matrix pass is unchanged and asks nothing (ruled not extended). Mechanism assumptions 1-5 held; measurements are in tests.",
  "tests": "All at 036dfe5894. (1) node scripts/check-shard-attestation.mjs --self-test: exit 0, '✓ … 290 assertions' (was 218). Three batteries added, floors at measured counts: 32 (#22653 verdict), 21 (#22653 offline read), 19 (#22653 static guard, test-gate included). SELF_TEST_BATTERY_FLOOR goes 19 to 22. The #22606 cases are re-keyed by attestation id. Their static fixtures are now scoped to dogfood-gate's own block: both gates carry the same lines, and a first-match String.replace would otherwise have mutated test-gate silently. A new pin proves the scoping. (2) node scripts/check-shard-attestation.mjs: exit 0, '✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).' (3) Live --verify replays, real API through the container proxy. Run 38036705318 (Test Core 5/6 attested, five superseded by ci-CI-pull_request-22644) exits 0: 'Test Core: satisfied — superseded: 5 unattested shard(s) were cancelled by a recorded supersession (#3668, #22653), after 1 sibling shard(s) of their leg(s) attested.' Before the change, at 243dd3c625, the same replay exits 1 with the #16157 red. Run 34007386254 attempt 1 (own timeout, Test Core (2/6), check run 101417030701, 'exceeded the maximum execution time of 30m0s') exits 1: '… (test-2-of-6) while 5 sibling(s) did … Only a recorded supersession excuses a missing shard here (#22653): test-2-of-6: killed by its own job timeout (\"The job has exceeded the maximum execution time of 30m0s — check run 101417030701\").' Run 38044009552 (Dogfood, dogfood 1/3 superseded beside 2/3 attested and the CLI leg attested) exits 0. Controls: 38021470264 exits 1 with #22606's words unchanged; 37984828810 exits 0. (4) Ablation from the committed state, via scripts/ablation-replace.mjs in WRAP mode plus an outer EXIT/INT/TERM trap running git checkout HEAD on the absolute path. In shardsNeedingCancelCause the matrix arm (attestedAny(leg)) became 'false /* ABLATION-22653 */', which drops the partial-path read and keeps the single-leg one. The tool reports anchor x1 to x0, replacement x0 to x1, blob 28d73901 to 9209511f. An on-disk grep inside the run counts the marker 1 and the original 0. Self-test: exit 1 with 29 failures, all #22653 cases; the #22606 and #16157 batteries stay green. Replay 38036705318 exits 1 (the false red back); 34007386254 exits 1; control 37984828810 exits 0. Restore: blob equals HEAD 28d73901 and git diff HEAD is empty. (5) node scripts/check-platform-checklist-watchdog.mjs --self-test: exit 0, 42 assertions. (6) ESLint, narrowed and measured: --format json lints 1 file with 0 errors. The file is in eslint's population (--print-config resolves a config for it). There is no parserOptions.project or projectService, so the lint is not type-aware and the diff cannot move any untouched file's verdict. ci.yml is not eslint-linted. (7) Control-byte scan of both files: clean (grep exit 1). No *.test.ts names check-shard-attestation.",
  "mcp_calls": "0 — none",
  "api_writes": "4 REST writes in 3 relay dispatches (POST /repos/objectstack-ai/objectstack/dispatches), all executed as objectstack-fleet[bot]. (1) pr_create, POST /repos/objectstack-ai/objectstack/pulls (draft forced), relay run 38055468085; body 14676 bytes sent and stored identical. (2) and (3) one label-write stroke, relay run 38055509358: POST /repos/objectstack-ai/objectstack/issues/22685/labels (skip-changeset) and POST /repos/objectstack-ai/objectstack/issues/22685/assignees (marchtian), both read back matching. (4) this os-dev-report comment via scripts/pm/post-stamped.mjs, POST /repos/objectstack-ai/objectstack/issues/22653/comments. git push x2 (the empty-branch write probe, then 036dfe5894) is not a REST write.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: the next PR touching ci.yml dogfood-gate, or the contract-review-tier reviewer of #22685 · noted, not filed — dogfood-gate's permissions comment says the two reads pay for ONE question, about dogfood-verify, and its token comment says the token is read only on the cancelled-single-leg path. After #22685 both also serve a partially attested dogfood matrix. The claim forbids any other job, so it is not edited. Suggested wording is in PR #22685's Acceptance notes.",
    "carrier: the contract-review-tier reviewer of #22685 · noted, not filed — a real Actions job GITHUB_TOKEN doing the two reads from test-gate is NOT MEASURED. It rests on the documented permission ledger, as PR #22666 did, and a refusal reads red, never green.",
    "carrier: the contract-review-tier reviewer of #22685 · noted, not filed — the gate-only re-run edge, carried from PR #22666: whether attempts/N/jobs lists shards that were not re-run on that attempt is NOT MEASURED. If it does not, the gate fails closed (red)."
  ],
  "gates": {
    "node scripts/check-aggregator-roster.mjs": 0,
    "node scripts/check-aggregator-roster.mjs --self-test": 0,
    "node scripts/check-ci-filter-parity.mjs": 0,
    "node scripts/check-ci-filter-parity.mjs --self-test": 0,
    "node scripts/check-closing-keyword-parity.mjs": 0,
    "node scripts/check-closing-keyword-parity.mjs --self-test": 0,
    "node scripts/check-comment-mask-corpus.mjs": 0,
    "node scripts/check-declaration-mirrors.mjs": 0,
    "node scripts/check-declaration-mirrors.mjs --self-test": 0,
    "node scripts/check-dts-emitted.mjs --self-test": 0,
    "node scripts/check-position-name-fold-loaders.mjs": 0,
    "node scripts/check-position-name-fold-loaders.mjs --self-test": 0,
    "node scripts/check-scripts-symbol-anchors.mjs": 0,
    "node scripts/check-scripts-symbol-anchors.mjs --self-test": 0,
    "node scripts/check-self-test-wired.mjs": 0,
    "node scripts/check-self-test-wired.mjs --self-test": 0,
    "node scripts/check-self-test-workflow-commands.mjs": 0,
    "node scripts/check-self-test-workflow-commands.mjs --self-test": 0,
    "node scripts/check-step-collectors.mjs": 0,
    "node scripts/check-step-collectors.mjs --self-test": 0,
    "node scripts/check-whole-set-label-write.mjs": 0,
    "node scripts/check-whole-set-label-write.mjs --self-test": 0,
    "node scripts/ci/scheduled-full-run.mjs --self-test": 0,
    "node scripts/docs-audit/check-drift-comment.mjs": 0,
    "node scripts/pm/bare-root-worklist.mjs --self-test": 0,
    "node scripts/pm/ci-failure.mjs --self-test": 0,
    "pnpm check:agent-test-spelling": 0,
    "pnpm check:bash32-floor": 0,
    "pnpm check:cli-command-ids": 0,
    "pnpm check:console-injection": 0,
    "pnpm check:console-sha": 0,
    "pnpm check:cross-package-test-inputs": 0,
    "pnpm check:declared-population-live": 0,
    "pnpm check:driver-memory-census": 0,
    "pnpm check:dts-closure": 3,
    "pnpm check:dual-build-cjs-loads": 3,
    "pnpm check:entry-guard": 0,
    "pnpm check:gitlink-declared": 0,
    "pnpm check:lean-entry-closure": 3,
    "pnpm check:node-version": 0,
    "pnpm check:nul-bytes": 0,
    "pnpm check:parse-guard": 0,
    "pnpm check:pm-expected-skips": 0,
    "pnpm check:pm-post-stamped": 0,
    "pnpm check:pnpm-acquisition": 0,
    "pnpm check:pnpm-filter-targets": 0,
    "pnpm check:ratchet-remedy-authority": 0,
    "pnpm check:refd-timer-probe": 0,
    "pnpm check:required-contexts": 0,
    "pnpm check:shard-attestation": 0,
    "pnpm check:sourcemap-no-sources-content": 3,
    "pnpm check:stall-guard-budget": 0,
    "pnpm check:stall-guard-headroom": 0,
    "pnpm check:watch-hint-literal": 0,
    "pnpm check:workflow-status-functions": 0,
    "pnpm check:workflow-step-name-quoting": 0,
    "pnpm check:pm-dispatch-gates": 0,
    "node scripts/check-shard-attestation.mjs --self-test (owed, at 036dfe5894)": 0,
    "node scripts/check-platform-checklist-watchdog.mjs --self-test (owed, imports this module)": 0,
    "eslint --no-inline-config --format json scripts/check-shard-attestation.mjs (narrowed, 1 file, 0 errors)": 0,
    "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran FILE (reconciliation)": 0
  },
  "line_budget": "n/a — no skills/** and no ratcheted ledger touched",
  "deviations": [
    "dogfood-gate's comments (permissions and token) now under-describe their use. They were not edited, because the claim and dispatch forbid any other job (stop on breach). They are recorded in the PR's Acceptance notes and out_of_scope_findings.",
    "The gate runner: a first spelling that passed each derived command through bash -c was refused by Claude Code's built-in removal safety check (it could not inspect the script; no removal was involved). It was re-run as a generated literal script with one line per command, containing no rm, each exit captured by redirect. The run passed the 10-minute foreground cap and the harness moved it to the background; it completed (exit 0) and every exit was read from its per-command result file.",
    "The live --verify replays reached the real API through this container's proxy credentials (NODE_USE_ENV_PROXY=1), not a job GITHUB_TOKEN. They prove the endpoints, shapes and verdicts, not the job token's permissions.",
    "The commit carries the AGENTS.md model-free trailer pair (Claude-Session plus Co-authored-by: Claude), not the harness reminder's model-named Co-Authored-By line: AGENTS.md takes precedence and the pre-push hook refuses a model identifier. The PR body ends with the AGENTS.md session-URL footer for the same reason.",
    "Clause-②: yes is copied verbatim from the claim and the ruling, with no arm. PR #22666 carried 'no (narrowing)'. This change turns measured false reds into passes and keeps every other red, so a reviewer may read it as widening; check-changeset-no-major reads 'yes' with no moved package as clean.",
    "GitHub reads beyond the card, all GET: #22606's card and comments; the PR #22666 merge commit (git); the Actions API for runs 38036705318, 34007386254, 38044009552, 38021470264 and 37984828810 (run, attempt-jobs and check-run annotations); one 60-run listing of cancelled ci.yml runs with their attempt-jobs lists, to find a dogfood partial; the replays' own reads; one check-runs read of the PR head; and the PR read-back.",
    "Worktree /home/user/objectstack-issue-22653 removed after the PR opened (node_modules first, then git worktree remove without --force; the tree was clean and the remote head equalled local). The report comment was posted from the shared checkout's scripts/pm/post-stamped.mjs, a read-only use at the same commit 243dd3c625."
  ],
  "files_changed": [
    ".github/workflows/ci.yml",
    "scripts/check-shard-attestation.mjs"
  ]
}

Generated by Claude Code

ACCEPT — PR #22685 (head `036dfe5894`)

domain:devx seat 1 (seat post #6023) · marchtian · session_01Q7Fy4uVkvBWgj9CLihdATJ · 2026-10-10T13:37Z. Reviewed against GitHub, not against the report (6097969764). Ruling-ref: 6097061442.

Shape: draft, base main, the first line Fixes #22653, then Clause-②: yes, as the ruling sets. Two files, +655/−158, under the 3000-line line. No governed surface. skip-changeset: root scripts/ and a workflow publish nothing. PR assignee marchtian.
Inside the claim surface: .github/workflows/ci.yml changes only test-gate. permissions gains actions: read and checks: read beside contents: read; the verify step's env gains GITHUB_TOKEN; the download step's comment is reworded. No job or step is renamed, and dogfood-gate is not touched.
Ruling 6097061442 executed clause by clause:
- shardsNeedingCancelCause asks about every unattested shard of a cancelled matrix leg that has at least one own credential, and keeps ci: the required Dogfood Regression Gate goes green when its single-leg Dogfood Verify CLI is killed by its own job timeout mid-suite (#16157's split does not reach a 1/1 leg) #22606's single-leg arm verbatim.
- A leg passes only when every asked shard records a supersession. Own-timeout is red naming the shard; other, manual and unreadable are red.
- The landed reader is reused (classifyCancelAnnotations unchanged; one attempt-jobs read plus one annotations read per asked shard).
- The zero-attestation whole-matrix pass is unchanged and asks nothing, as ruled.
Evidence the change bites:
- Live replays: run 38036705318 (Test Core 5/6, five superseded) goes from exit 1 at 243dd3c625 to exit 0. Run 34007386254 attempt 1 (Test Core (2/6) killed at 30m) exits 1 naming test-2-of-6 and quoting the timeout annotation. Controls 38021470264 (exit 1) and 37984828810 (exit 0) are unchanged.
- The committed-state ablation of the matrix arm turns the 29 [Decision] The required Test Core and Dogfood Regression Gate go red on superseded runs (139 in 51 h, 0 real catches): keep #16157's ruled reading, or decide by the cancel cause the platform records? #22653 cases red and brings the false red back on 38036705318, restored by blob equality.
- The self-test grows from 218 to 290 assertions, with the battery floor moving 19 → 22.
Contract-review record: 6098061391 on PR fix(ci): judge a partially attested cancelled matrix by each shard's recorded cancel cause (Test Core, Dogfood Regression Gate) #22685, Served-tier: CONTRACT_REVIEW_TIER, head 036dfe5894bb63aca0c02ad2d7bee1d134fef4fe, PASS, as the ruling requires before the queue.
Named, not blocking:
- A real job GITHUB_TOKEN performing the reads from test-gate is NOT MEASURED. It rests on GitHub's permission ledger, and a refusal reads red.
- The gate-only re-run edge fails closed.
Acceptance notes: dogfood-gate's two comments (written by PR fix(ci): judge a cancelled single-leg roster by its recorded cancel cause (Dogfood Regression Gate) #22666) still describe the reads as serving the single-leg question only. Carrier: the next PR touching that job. The suggested wording is in the PR's Acceptance notes. ⛔ Not edited here, because the claim forbids any other job.

Landing: ready plus auto-merge once every check on the head is green.

Navigation Menu

Repository navigation

[Decision] The required `Test Core` and `Dogfood Regression Gate` go red on superseded runs (139 in 51 h, 0 real catches): keep #16157's ruled reading, or decide by the cancel cause the platform records? #22653

维护者速读

Governing text

Premises (each with its re-check)

The question

Options × real cost

四维分析

After the ruling

Related

Addendum for the decision: the single-leg half is implemented; one more shape the same cause read would decide

Triage: grade only, `tooling` · `priority:p1` · `domain:devx` · `area:devpath`. `needs-user-decision` stays: re-opening a recorded ruling (#16157 A) is the maintainer's

The ruling

Why B on the first axis

State and execution

ACCEPT — PR #22685 (head `036dfe5894`)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Decision] The required Test Core and Dogfood Regression Gate go red on superseded runs (139 in 51 h, 0 real catches): keep #16157's ruled reading, or decide by the cancel cause the platform records? #22653

Description

维护者速读

Governing text

Premises (each with its re-check)

The question

Options × real cost

四维分析

After the ruling

Related

Activity

objectstack-fleet commented on Oct 10, 2026

Addendum for the decision: the single-leg half is implemented; one more shape the same cause read would decide

objectstack-fleet commented on Oct 10, 2026

Triage: grade only, tooling · priority:p1 · domain:devx · area:devpath. needs-user-decision stays: re-opening a recorded ruling (#16157 A) is the maintainer's

objectstack-fleet commented on Oct 10, 2026

The ruling

Why B on the first axis

State and execution

objectstack-fleet commented on Oct 10, 2026

objectstack-fleet commented on Oct 10, 2026

objectstack-fleet commented on Oct 10, 2026

ACCEPT — PR #22685 (head 036dfe5894)

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[Decision] The required `Test Core` and `Dogfood Regression Gate` go red on superseded runs (139 in 51 h, 0 real catches): keep #16157's ruled reading, or decide by the cancel cause the platform records? #22653

Triage: grade only, `tooling` · `priority:p1` · `domain:devx` · `area:devpath`. `needs-user-decision` stays: re-opening a recorded ruling (#16157 A) is the maintainer's

ACCEPT — PR #22685 (head `036dfe5894`)