Governance: a platform defect is fixed in the platform, not worked around in an app repo; claims name the carrier, devs stop on a platform premise, and a check flags PRs whose cross-repo premise closed after they opened

repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

Filing gate: ③ a task on the maintainer's word.

The maintainer's question in the repo:cloud#3 seat session (2026-11-06), verbatim: 「以后如何避免类似的问题？平台的问题应该在平台处理」.
On the seat's three-part proposal they selected, verbatim: 「三条都立卡（推荐）」.

Owner. The skills seat owns governance text (.claude/skills/pm-dispatch/**, .claude/agents/os-dev.md). Both are a governed face: .claude/** is Tier S. The check script lives in scripts/pm/. Triage routes this card.

维护者速读

这次的教训：cloud#3595 在 cloud 另写了一套绕行，起因是平台入口在托管环境上返回 501（objectstack#30192），而这个 501 是平台缺陷，16 分钟后就在平台修好了。PR 却一直按旧前提挂着，+3,018 行。现有规程只要求「协议错了改 spec、不在运行时加兜底」，没有规定「平台缺陷必须在平台修」，也没有人负责回头检查前提过期。本卡补三条：

认领时写明由哪个仓修；
开发发现前提是平台缺陷就停；
一个机械检查：PR 引用的别仓前提卡已关闭时，自动标出来。

The case (evidence)

objectstack-ai/cloud#3595 was opened 2026-11-05T01:54Z. Its body says it builds a cloud-only path because "the environment's HTTP door answered 501 (objectstack#30192)". That path is a new /_admin/environments/:id/member-access route, a control-plane column with /observed reporting, and control-plane prompt/decision routes.
rest: on the hosted multi-environment runtime the /security routes read the HOST kernel, so no owner can accept an installed app's default permission set and every invited member gets 403 on its data (sixth door of #29999) #30192 closed at 02:10Z through PR fix(rest): the /security routes answer from the request's environment kernel on a hosted runtime, so an owner can accept an installed app's default permission set (#30192) #30195, which fixed the kernel door. Its merge commit 1a3ea0c0 is cloud main's pin.
The kernel already owns the capability: ADR-0090 D5 (packages suggest, admins confirm), confirmAudienceBindingSuggestion, and the Setup page.
The same seat filed the kernel card and wrote the cloud workaround. No rule asked either side to choose one carrier, and nothing re-checked the premise. Seat review note: cloud PR feat(spec)!: delete DEFAULT_DISPATCHER_ROUTES + sweep last graphql fixture debris (#3586) #3595 comment 6674352813.
Today's rules cover only the metadata half: fix the producer or the spec, never a runtime fallback (cloud AGENTS.md lines 50–57; pm-dispatch's anchoring rule "domain:* = the domain of the package the fix lands in"). They do not cover a platform defect hit from an app repo.

Asked

pm-dispatch: name the carrier at claim. The claim states where the failing behaviour's code lives. When it lives in the platform (objectstack packages, kernel, runtime, rest, ui):
- the fix is a platform card in the owning domain:* lane;
- the app-repo card goes pm:blocked with Blocked-by: that card;
- the app repo adds only what is genuinely app-side. For cloud that means the control plane, the cloud console, and the hosted install.
A workaround in the app repo needs a recorded maintainer ruling, plus a removal card filed in the same stroke. The ACCEPT checks the same thing: does the diff re-implement a platform capability?
os-dev: stop on a platform premise. When a card's premise turns out to be a platform defect, the dev stops and reports carrier: objectstack with the evidence. It does not code around it in the app repo. This sits beside the existing carrier: field for out-of-scope findings (os-dev.md ~:53).
A premise-freshness check. This is a check-half-states row or a standalone scripts/pm/ reader. It flags an open PR, in any fleet repo, whose body cites a cross-repo issue as its premise ("because objectstack#N …", "blocked by", "answers 501 (#N)") when that issue closed after the PR was opened. The flag means: re-measure before ACCEPT or human hand-off. Pin it with a battery case built on the feat(spec)!: delete DEFAULT_DISPATCHER_ROUTES + sweep last graphql fixture debris (#3586) #3595 / rest: on the hosted multi-environment runtime the /security routes read the HOST kernel, so no owner can accept an installed app's default permission set and every invited member gets 403 on its data (sixth door of #29999) #30192 timeline. ⛔ It reports and writes nothing.

Acceptance

The rule text exists in .claude/skills/pm-dispatch/ and .claude/agents/os-dev.md, short and in the house style.
The check carries a self-test battery, including the feat(spec)!: delete DEFAULT_DISPATCHER_ROUTES + sweep last graphql fixture debris (#3586) #3595 / rest: on the hosted multi-environment runtime the /security routes read the HOST kernel, so no owner can accept an installed app's default permission set and every invited member gets 403 on its data (sixth door of #29999) #30192 case, and is wired where the seat's half-state readers run.
The cloud half, a one-line pointer in cloud AGENTS.md (Tier H), is a separate cloud card blocked on this one.

Dedupe (2026-11-06): repo:objectstack-ai/objectstack carrier platform defect cloud workaround is:issue → 88 hits, none a rule on carrier choice. premise closed issue PR stale is:issue → broad, and no premise-freshness reader among the hits. fix belongs in platform not cloud is:issue → broad, no governance card.

Suggested-grade: p2 · one recurrence cost a +3,018-line PR on the governed review route.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: audit · p2 kept · `domain:skills` · 2026-11-06T01:52Z

⛔ Not a claim.

This executes the maintainer's 「三条都立卡（推荐）」 on 「平台的问题应该在平台处理」 (2026-11-06). There are three parts: a claim names the repo that carries the fix; a dev stops on a platform premise; and a mechanical check flags a PR whose cross-repo premise card has closed.
Lane domain:skills, which owns .claude/skills/pm-dispatch/** and .claude/agents/os-dev.md, plus scripts/pm/ for the check. repo:cloud stays as its provenance.
Under the standing rule 「新增门禁默认否」, part 3 is a report-only patrol that lists such PRs. A merge-blocking gate needs the maintainer's separate word.

Generated by Claude Code

domain:skills#1 · os-elon-musk · session_016WV4d1mkgEris4MHHLjtnk

Claim: PM loop round 2 · 2026-11-06T01:59Z
Session: session_016WV4d1mkgEris4MHHLjtnk
Account: os-elon-musk (the seat's linked user as GET /user answers it; the card's assignee)
Branch: the card thread's designated claude/project-thread-* branch, named in a claim amendment once the thread reports it
Worktree: objectstack-issue-30765
Domain: domain:skills
Seat: domain:skills#1
File surface: .claude/skills/pm-dispatch/** (the carrier rule at claim and the ACCEPT check: SKILL.md and the reference page that owns the claim fields), .claude/agents/os-dev.md (the stop on a platform premise, beside carrier: L53-54), and one report-only reader in scripts/pm/ (a check-half-states.mjs row preferred over a new file) with its self-test battery case built on the cloud#3595 / #30192 timeline. ⛔ every ceiling (compress, do not raise), ⛔ any merge-blocking gate (report-only, triage 6674714854), ⛔ AGENTS.md and the cloud repo (the cloud pointer is a separate card) (stop on breach)
Container & model: M, mode:thread, model: TIER_DEFAULT (.claude/** rule text: the contract-review tier is owed; exit taken = the proactive low-headroom downgrade under the maintainer's standing posture of this project: develop on the default tier, the contract-review tier runs the final contract review; the compensating control is the seat's at-tier review before landing), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a maintainer task: 「三条都立卡（推荐）」 on 「平台的问题应该在平台处理」, the repo:cloud#3 session, 2026-11-06)
Thread-read: 6674714854
Premise: holds: os-dev.md L53-54 define carrier: for out-of-scope findings only, and no pm-dispatch rule names the carrier repo of a platform defect, on origin/main b3098661
Serial constraints cleared: no open PR touches .claude/skills/pm-dispatch/**, .claude/agents/os-dev.md or scripts/pm/check-half-states.mjs (open PRs read at claim time)

Tier S (.claude/**) plus scripts/pm/** (not governed): the seat lands it on an at-tier contract-review PASS with every check green.

Generated by Claude Code

domain:skills#1 · os-elon-musk · session_016WV4d1mkgEris4MHHLjtnk

Claim: PM loop round 2 · 2026-11-06T02:03Z
Session: session_016WV4d1mkgEris4MHHLjtnk
Account: os-elon-musk (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-bidfhi (the card thread's designated branch; dev session session_016WV4cx6mK6DjBVWmPbTcX5)
Worktree: objectstack-issue-30765
Domain: domain:skills
Seat: domain:skills#1
File surface: .claude/skills/pm-dispatch/** (the carrier rule at claim and the ACCEPT check: SKILL.md and the reference page that owns the claim fields), .claude/agents/os-dev.md (the stop on a platform premise, beside carrier: L53-54), and one report-only reader in scripts/pm/ (a check-half-states.mjs row preferred over a new file) with its self-test battery case built on the cloud#3595 / #30192 timeline. ⛔ every ceiling (compress, do not raise), ⛔ any merge-blocking gate (report-only, triage 6674714854), ⛔ AGENTS.md and the cloud repo (the cloud pointer is a separate card) (stop on breach)
Container & model: M, mode:thread, model: TIER_DEFAULT (.claude/** rule text: the contract-review tier is owed; exit taken = the proactive low-headroom downgrade under the maintainer's standing posture of this project: develop on the default tier, the contract-review tier runs the final contract review; the compensating control is the seat's at-tier review before landing), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a maintainer task: 「三条都立卡（推荐）」 on 「平台的问题应该在平台处理」, the repo:cloud#3 session, 2026-11-06)
Thread-read: 6674714854
Premise: holds: os-dev.md L53-54 define carrier: for out-of-scope findings only, and no pm-dispatch rule names the carrier repo of a platform defect, on origin/main b3098661
Serial constraints cleared: no open PR touches .claude/skills/pm-dispatch/**, .claude/agents/os-dev.md or scripts/pm/check-half-states.mjs (open PRs read at claim time)

Tier S (.claude/**) plus scripts/pm/** (not governed): the seat lands it on an at-tier contract-review PASS with every check green.

Re-posted whole with the Branch line; supersedes claim 6674818074 (same claim, branch now named).

Generated by Claude Code

domain:skills#1 · os-elon-musk · session_016WV4cx6mK6DjBVWmPbTcX5
os-dev-report

{
 "issue": 30765,
 "status": "done",
 "branch": "claude/project-thread-bidfhi",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/30778",
 "session": "session_016WV4cx6mK6DjBVWmPbTcX5",
 "premise_still_valid": true,
 "summary": "Pin 1: the SKILL.md claim template's Responsibility: first answer now names the repo the failing code lives in (objectstack ⇒ a platform card carries the fix) and applies to cards whose premise is a failing behaviour; cross-repo-coordination.md rule 1 gains three lines (claim names the carrier; platform defect ⇒ platform card in the owning domain lane, app card pm:blocked + Blocked-by it; app repo adds only the app side, a workaround needs a recorded ruling plus a removal card in the same stroke); review-checklist.md makes an app-repo re-implementation of a platform capability without that record REWORK. Pin 2: os-dev.md beside the carrier: line, a premise that is a platform defect ⇒ stop, report carrier: objectstack with evidence, no code-around. Pin 3: check-half-states.mjs row H75 (report-only, band stall) flags an open PR whose body cites a cross-repo issue on a because / blocked by / answers NNN line when that issue closed after the PR opened; targets ride H19's resolver and cache, unresolved targets fire UNJUDGED.",
 "premise_reading": "Measured on origin/main b3098661: os-dev.md L53-54 define carrier: for out-of-scope findings only; SKILL.md L314 Responsibility: asked whose code produces the risk with no repo answer, defect cards only; check-half-states.mjs already lists open PRs (listOpenPullRequests) and already resolves cross-repo targets (resolveBlockerTarget via blockerTargetKey, per-target cache, sibling-repo readability probe), so the reader needed no new fetch path.",
 "tests": "node scripts/pm/check-half-states.mjs --self-test: exit 0, '5240 cases pass', battery 'H75 premise freshness 16/15' (baseline before the edit: 5224 cases, exit 0). The battery fixture is the measured timeline offline (cloud PR created 2026-11-05T01:54Z, body citing objectstack#30192 on an 'answered 501' line; that card closed 02:10Z): fires; controls clean for closed-before-open, open, local ref (bare and repo-qualified), unanchored line; cap = H4_PROSE_CANDIDATE_CAP; UNJUDGED leg; band stall + emitted (familyRegistryCoverage); not loud; wiring through the one resolver read off source; roster floor. No ablation: script edit (os-dev.md).",
 "gates": "Head a086eb0a: dispatch-gates --commands derived 59 families, all 59 exit 0 (check:doc-formula-expressions first exit 3 PREREQUISITE NOT MET, re-run exit 0 after turbo build of @objectstack/formula + @objectstack/lint under os-verify-lock); dispatch-gates --ran: '59 derived famil(ies) accounted for — 59 run, 0 NOT-MEASURED'; pnpm lint exit 0; check:pm-skill-ratchet exit 0 (every touched ceiling at headroom 0, unchanged). CI check-runs on PR #30778: in_progress at report time. Record: skills-lane-seat1/30765/gates-ran-a086eb0a.txt + reconcile.txt in the project folder.",
 "line_budget": "5 files, +107/-6 (GitHub additions 107, deletions 6, changed_files 5). Rule files line-neutral, ceilings unmoved: SKILL.md 319/319, cross-repo-coordination.md 47/47 (+3 rule lines, -3 restatements of SKILL.md's domain:ui and domain:cloud rows), review-checklist.md 76/76 (one line rewritten, the premise_still_valid clause restated SKILL.md 报告契约), os-dev.md 405/405 (+1 stop line, -1 foreground-cap pointer that restated resource rule 1 and the local-verification section). scripts/pm: check-half-states.mjs 36900 → 37001 (+101), the only scripts/pm file touched (card #29471 net-negative tracker).",
 "files_changed": [
  ".claude/agents/os-dev.md",
  ".claude/skills/pm-dispatch/SKILL.md",
  ".claude/skills/pm-dispatch/references/cross-repo-coordination.md",
  ".claude/skills/pm-dispatch/references/review-checklist.md",
  "scripts/pm/check-half-states.mjs"
 ],
 "deviations": [
  "Branch is the card thread's platform branch claude/project-thread-bidfhi (not claude/issue-30765-*), named in the re-posted claim 6674879610; pushed only after that amendment. Worktree objectstack-issue-30765 off origin/main b3098661; the shared checkout was detached so the two trees do not share the branch.",
  "pnpm lint was run locally (os-dev.md assigns it to CI; the seat's standing lines ask for it).",
  "The harness asked for a model-named Co-Authored-By trailer, an assignee and a reviewer on the PR: none applied, per AGENTS.md (model-free trailer pair) and os-dev rule 2 / the seat's standing lines (no assignees, no reviewers).",
  "No changeset: .claude/** and scripts/pm/** publish nothing; skip-changeset rode pr_create's labels and reads back on the PR."
 ],
 "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
 "mcp_calls": "4 — mcp__github__issue_read get + get_comments on #30765, issue_read get_labels on 30778 (answered not-an-issue), pull_request_read get on #30778; no write tool",
 "api_writes": "2 — git push (not REST); relay pr_create → objectstack-ai/objectstack#30778 with label skip-changeset (POST /repos/objectstack-ai/objectstack/dispatches, run 42150348048, read-back identical 9886 bytes); this os-dev-report comment via post-stamped (relay) is the third write",
 "open_questions": [],
 "security_findings": "none",
 "out_of_scope_findings": [
  "carrier: cloud · noted, not filed — H75 reads the swept repo's own open PRs, so it reaches cloud PRs only once cloud runs this script (verbatim-copy adoption of check-half-states.mjs + half-state-patrol.yml); the cloud AGENTS.md pointer is already the separate cloud card the issue names"
 ]
}

domain:skills#1 · os-elon-musk · session_016WV4d1mkgEris4MHHLjtnk

ACCEPT → PR #30778 comment 6675615911 (head 35d79fd8), contract review PASS 6675356032 then delta PASS 6675423577. Tier S: ready for review and auto-merge enabled by the seat.

Navigation Menu

Repository navigation

Governance: a platform defect is fixed in the platform, not worked around in an app repo; claims name the carrier, devs stop on a platform premise, and a check flags PRs whose cross-repo premise closed after they opened #30765

维护者速读

The case (evidence)

Asked

Acceptance

Triage: audit · p2 kept · `domain:skills` · 2026-11-06T01:52Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Governance: a platform defect is fixed in the platform, not worked around in an app repo; claims name the carrier, devs stop on a platform premise, and a check flags PRs whose cross-repo premise closed after they opened #30765

Description

维护者速读

The case (evidence)

Asked

Acceptance

Activity

objectstack-fleet commented on Nov 6, 2026

Triage: audit · p2 kept · domain:skills · 2026-11-06T01:52Z

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: audit · p2 kept · `domain:skills` · 2026-11-06T01:52Z