Repository navigation
pm-dispatch skills: the security seat's triage of a non-finding, its ledger states after the close-on-merge order, a release's contents read by ancestry, and the CI recoveries the relay leaves #30111
Description
security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj
What
The security seat's working rounds of 2026-11-03/04 used five steps that the skills do not state, or state differently. This card writes each one into the reference that owns it. Every line stays at rule level: ⛔ no advisory id, mechanism, path or object name, per the charter header of lanes/security.md.
Sequencing: card #30110 is editing lanes/security.md and security-findings.md now. Dispatch this card only after #30110 merges, and rebase onto it.
The five additions
-
A report that is not a finding (
lanes/security.md, 接收与台账). Today, intake is only a finder'sNotify: securitydoorbell for a draft the finder created. An advisory can also arrive intriagewith no doorbell: an outside report, or a relay live test such as the one card 29402 runs.- The seat reads it through
advisory_read. - The seat claims it as a
receivedrow on the seat post. - The seat judges it.
- For a non-finding, the seat moves it to
closedthroughadvisory_stateand records the row as closed, not a finding, with no detail. - For a finding, the seat moves it to
draftand follows the fix path.
The maintainer had the seat run this flow on 2026-11-04: 「你试试看认领处理关闭的流程」.
- The seat reads it through
-
Ledger states (
lanes/security.md). The state vocabulary isreceived → fixing → merged → awaiting publish → published, and the charter says the seat stops atawaiting publish. The maintainer's standing orders since then:- 「目前的修复都关闭」 / 「你处理完的可以都先关闭」: close once the fix merges.
- 「哪些高危要发布应该在我版本发布前决策吧」: the maintainer decides the publish list before each release.
- pm/fleet-write: the relay publishes a security advisory on the maintainer's list: reopen, set the affected and patched versions, publish #30110: the relay publishes on the maintainer's list.
Reconcile the vocabulary so that it contains
closed(fix merged) and states which publish step is whose. If pm/fleet-write: the relay publishes a security advisory on the maintainer's list: reopen, set the affected and patched versions, publish #30110 has already rewritten the publish half, keep only what remains. -
A release's contents are read by ancestry (
lanes/security.mdorrelease-aftercare.md, whichever owns the post-release publish list). A fix is "in version X" only if its merge commit is an ancestor of the commit tagged for X. Check withgit merge-base --is-ancestor <merge> <release commit>; ⛔ a merge time earlier than the tag time is not proof. On 18.3.0 this check sorted four fixes merged on the release day out of the release. -
A change that moves work after the response (
review-checklist.mdortrue-green.md). The Dogfood Regression Gate does not run onpull_requestormerge_group(by design, ci.yml THE TWO SPEEDS). So a PR that moves a send or write to after the response can pass every pre-merge check and still redmainon its push battery: main-red main red: Dogfood Regression Gate (2/3) fails signup-organization-census.dogfood.test.ts since PR #29975 (a7293f74) — the test reads the verification-mail row the sign-up now writes after its response #29991 → forward fix fix(qa): signup-organization-census waits for the verification mail sent after the sign-up answer #29992. Before landing such a PR, the seat grepspackages/qa/dogfood/testfor readers of that side effect straight after the answer, and has them wait within a bound in the same PR. -
CI recoveries the relay leaves (
platform-readings.mdorrest-channel.md):run_rerun_failedre-runsci.ymlruns only. A flake in another workflow cannot be re-run through it:lint.yml(a checkout timeout) andpr-automation.yml(aCheck Changesetcancelled with no superseding run).- Recovery for
pr-automation.yml: aneditedevent re-runsCheck Changeset. A seat body edit that records the flake reason (the reason the rerun rule already requires) is that event. - Recovery for
lint.yml: a relaypr_update_branchoncemainhas moved produces a real new head with a full run. While the head is level withmain, the update is a no-op. - ⛔ Never an empty commit, never close and reopen.
- A merge-group removal whose failed step is
Checkout repositorytiming out is re-queued once, with the reason recorded on the PR.
Acceptance
- Each addition lands in the one reference that owns its topic. No rule is restated in two places, and the hot files' line ratchets are respected.
lanes/security.mdstill carries no finding, id, path, object or mechanism.- The skills gates the diff derives are green.
Activity
objectstack-fleet commentedon Nov 4, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: first-touch audit · p2 kept ·
domain:skillskept ·pm:queue· 2026-11-04T14:54Z⛔ Not a claim.
lanes/security.mdand its references, at rule level only. p2 kept.Generated by Claude Code
objectstack-fleet commentedon Nov 4, 2026
security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj
Claim: maintainer-directed dispatch · 2026-11-04T16:45Z
Session:
session_01QSeKYn5CmmdShCJifm6WYjAccount:
os-justin(the card's assignee)Branch:
claude/issue-30111-security-seat-skillsWorktree:
objectstack-issue-30111Domain:
domain:skillsSeat:
security#1File surface:
.claude/skills/pm-dispatch/references/{lanes/security.md,security-findings.md,release-aftercare.md,review-checklist.md,true-green.md,platform-readings.md,rest-channel.md}(one owner per addition; stop on breach)Container & model:
M,mode:subagent,model: opus,effort: highClause-②: no
Metadata-protocol: none
Thread-read: none
Premise: holds (#30110 merged as PR #30135 at 16:39Z, so the hot file is free)
Ruling carried: the maintainer asked for this card (「需要立卡更新你的skills吗」 → filed); the triage flow is the maintainer's 「你试试看认领处理关闭的流程」.
objectstack-fleet commentedon Nov 4, 2026
security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj
os-dev-report
{
"issue": 30111,
"status": "done",
"branch": "claude/issue-30111-security-seat-skills",
"pr": "#30155",
"session": "session_01QSeKYn5CmmdShCJifm6WYj",
"premise_still_valid": true,
"summary": "The five security-seat steps each landed in the one reference that owns them. (1) lanes/security.md 接收与台账 gained a second intake route: a triage advisory with no doorbell. The seat reads it via advisory_read, claims a received row, and judges it: a finding goes to draft and the fix path, a non-finding goes to closed with the row marked non-finding. (2) After #30135 the only residue was who moves which state, now on the publish line: the maintainer's approval is awaiting publish, the seat's relay publish is published. (3) Release contents by ancestry went to lanes/security.md 呈维护者, beside the publish list; release-aftercare.md owns roll-out duties, not the list. (4) The PR that moves a send or write to after the response went to review-checklist.md 测试与门禁证据. (5) The relay's CI recoveries went to platform-readings.md, directly under the rerun-failed.mjs rule. The merge-group Checkout-repository timeout was folded into the existing known-flaky re-queue line. Every file holds its ceiling (53/76/458, headroom 0); the added lines are paid for by deleting text the same file or a sibling already states (table in the PR body). No ceiling was raised.",
"tests": "Prose-only skill-reference change; no test file and no ablation (no tested behaviour changed). Line widths measured before writing: every added or rewritten line is 120 bytes or less. check-skill-line-ratchet at head 2e3dbd3: lanes/security.md 53 (ceiling 53), review-checklist.md 76 (76), platform-readings.md 458 (458), exit 0. Control-byte self-scan over the three files: no match (grep exit 1).",
"gates": "Head 2e3dbd3. dispatch-gates --commands --repo objectstack-ai/objectstack derived 20 families, and all 20 ran locally, each with its exit captured before any pipe; all exited 0. check:doc-formula-expressions ran after building @objectstack/formula and @objectstack/lint under os-verify-lock (first attempt VERDICT queue-timeout 99, second VERDICT command-exit 0). --ran: '20 derived famil(ies) accounted for — 20 run, 0 NOT-MEASURED (a DERIVED zero — all 20 recorded an exit code and none of them is 3)'. Roster gates under .claude, also run: check:pm-settings-deny-roster 0, check-skills-token-ratchet 0, check-published-list-mirrors 0. CI families: PR #30155 check-runs were in_progress at report time (Lint ×7, Type Check ×4, Governed Surface Queue Guard, PR-body guards, Check PR Size); Check Changeset was skipped on the opened run (skip-changeset label). NOT MEASURED: the CI-only families, reason: still running when this report was written.",
"dogfood_battery": "n/a — no
!in the PR title and no (narrowing) arm","mcp_calls": "0",
"api_writes": "2 relay writes so far — pr_create (POST /repos/objectstack-ai/objectstack/pulls, draft, plus POST .../issues/30155/labels skip-changeset; run 41876320915) and this os-dev-report comment through post-stamped (POST .../issues/30111/comments); plus one git push of the branch",
"open_questions": [],
"security_findings": "none",
"out_of_scope_findings": ["carrier: security#1 · noted, not filed — SKILL.md still names MCP rerun_failed_jobs as the one exception to 'no MCP writes', while platform-readings.md routes a seat re-run through rerun-failed.mjs (the relay). The two lines may disagree; SKILL.md is at headroom 0 and outside this card's file surface. Dedupe words: rerun_failed_jobs, MCP write exception, rerun-failed.mjs, run_rerun_failed"]
}