Repository navigation
skills(checklist-test): the section-4 extraction bullet restates the reproduction obligation with no pointer at rule 2's access-control carve-out #9607
Description
Filed unassigned from the work on #9507 (PR #9606), which aligned the two docs/qa/platform-checklist READMEs with RUNNER.md rule 2's authentication/authorization carve-out. .claude/skills/** is a governed, human-merge-only surface, so this was reported rather than edited.
The asymmetry
.claude/skills/checklist-test/SKILL.md does carry the carve-out — in its Guardrails section (around line 223), where the clause explicitly names what it overrides: section 4's rule that every fail owes a reproduction rule, and RUNNER rule 2's identical requirement. That much is correct and needs no change.
What it does not name is section 4's extraction bullet (around line 141-144), which tells the runner to extract each product defect into a standalone card with "reproduction and mechanism itemized". PR #9506 added exactly such a pointer to the corresponding paragraph in RUNNER.md:
not carry `qa-run`; it enters triage first-touch normally. An authentication or
authorization defect is extracted under rule 2's carve-out — item, clause, `detail
withheld pending maintainer`, no recipe. The extracted card is public too.
So RUNNER.md pins the carve-out at both the record bullet and the extraction bullet; the skill pins it at the record bullet only.
How much this matters
Less than it looks, which is why this is a finding rather than a queued defect. The Guardrails clause already says the reproduction goes "not into the run issue, not into a tracking card, not into a comment" — the extracted card is covered in substance. The gap is purely one of reading path: a runner who lands on section 4's extraction bullet alone gets the unconditional instruction and no hint that a carve-out exists. That is the same shape #9507 and #9471 exist to close, one level weaker.
Suggested shape, if a maintainer takes it
One clause on the section 4 extraction bullet pointing at the skill's own Guardrails carve-out — not a third copy of the policy. #9506's treatment of RUNNER.md is the precedent.
Verification bound
Found by grepping the repo for both the English (reproduc) and Chinese phrasings of the obligation. The English-only sweep reads clean across .claude/skills/**, since those skills are written in Chinese; that is worth knowing for anyone repeating the search. Positive controls were run on every file that reported no match.
Generated by Claude Code
Activity
os-support-ai commentedon Aug 18, 2026
Triage routing:
domain:devx→domain:skills— the fix lands in.claude/skills/checklist-test/SKILL.md, which is the skills lane's surface per the maintainer's 2026-08-18 ruling (all skills-related work belongs to that seat). Left asfinding; the skills seat self-grades its own lane.Generated by Claude Code
os-warren commentedon Aug 19, 2026
First-touch graded by the skills seat (own-lane exception; session
session_01AeA3nU1B5Q2pgxqxgUrexd): PROMOTED →pm:queue, S mechanical. Rationale: real reading-path gap with an exact landed precedent (#9506's treatment of RUNNER.md); scope is one pointer clause on the section-4 extraction bullet of.claude/skills/checklist-test/SKILL.md— a pointer at the skill's own Guardrails carve-out, ⛔ not a third copy of the policy. Governed surface ⇒ draft PR, human merge. Dispatch when the queue reaches it (no hot-file conflict — checklist-test SKILL.md has no other traffic).Generated by Claude Code
os-warren commentedon Aug 19, 2026
Claim: PM loop round 1
Session:
session_01AeA3nU1B5Q2pgxqxgUrexdBranch:
claude/issue-9607-extraction-carveout-pointerWorktree:
objectstack-issue-9607Domain:
domain:skillsFile surface:
.claude/skills/checklist-test/SKILL.mdonly (stop on breach; explain in the report)Container & model: S,
mode:subagent,model: opus— this dispatch'snode scripts/pm/dispatch-gates.mjs --tier .claude/skills/checklist-test/SKILL.mdrun: "no path-derived mandate … tier stays the PM's per-card judgment call"; PM call = opus (governed instruction prose, same call as the sibling os-dev.md pointer card this round)Clause-②: no
Serial constraints cleared: no other open card or PR touches
.claude/skills/checklist-test/**(lane hot-file queue has no entry for this file; open-PR list re-checked this round). Premise re-verified onorigin/main: the 收束抽取 bullet lives at lines ~142–146 ("复现与机制条目化") with no pointer at the Guardrails carve-out (~line 223); RUNNER.md's corresponding paragraph got exactly such a pointer via the precedent PR named in the card.Generated by Claude Code
os-warren commentedon Aug 19, 2026
{ "issue": 9607, "status": "done", "branch": "claude/issue-9607-extraction-carveout-pointer", "pr": "https://github.com/objectstack-ai/objectstack/pull/9843", "premise_still_valid": true, "summary": "Re-verified the premise on a fresh origin/main (merge base 1408ae337) before editing: the section 4 收束抽取 bullet at lines 142-146 carried 复现与机制条目化 unconditionally, with no pointer at the Guardrails carve-out, which sits correct and complete at lines 223-229. Added exactly one pointer clause to the tail of the extraction bullet, following the precedent's shape: '⛔ 认证 / 授权漏洞的抽取卡不写复现,见 Guardrails。' It names which defects and where the rule lives and nothing else — a pointer, not a third copy of the policy. The Guardrails clause is unchanged. Diff is 1 insertion, 1 deletion, one file; no other line in the file moved.", "tests": "No unit tests — the change is Chinese instruction prose in a governed skill file, so the gate families are the evidence. All runs at final commit 51c5981fa, exit codes captured before any pipe (redirect-then-tail), and every verdict below is the gate's own printed line, never a bare $?. Gate set derived by 'node scripts/pm/dispatch-gates.mjs' with no paths (script takes the change set from the merge base itself: '1 path(s) vs merge base 1408ae337'); re-derived after the final commit and identical both times, 5 families matched. Ran those 5 plus the two named in the dispatch words and the always-owed one. (1) pnpm check:pm-skill-ratchet -> '✓ check-skill-line-ratchet: .claude/skills/checklist-test/SKILL.md is 232 lines (ceiling 232; headroom 0).' (2) pnpm check:pm-skill-id-lint -> '✓ check-skill-id-lint: 9 file(s) clean (pattern /#[0-9]{3,}/g).' (3) pnpm check:doc-authoring -> '✓ doc authoring guard: 377 files clean — no bare metadata literals.' (4) pnpm check:pm-governed-merges -> '✓ check-governed-merges --self-test: 77 assertions'. (5) pnpm check:skill-frame-sync -> '✓ check-skill-frame-sync: 4 copies of the decision frame are structurally isomorphic across 3 files'. (6) pnpm --filter @objectstack/lint run check:doc-formula-expressions -> first run RED with ERR_MODULE_NOT_FOUND on @objectstack/formula/dist/index.mjs (the unbuilt-dependency-closure trap in a fresh worktree, not a defect in the change); after 'pnpm --workspace-concurrency=2 --filter @objectstack/lint^... build' under the shared /tmp/os-heavy-verify.lock, GREEN: '✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 396 files / 1413 TS blocks judged clean by @objectstack/formula.' (7) pnpm check:nul-bytes -> 'check-nul-bytes: OK (scanned 6280 text file(s) -- 6280 tracked, 0 untracked-not-ignored; skipped 5 binary; no raw ASCII control bytes).' Also hand-scanned the edited file for control bytes outside the gate: grep -naP over the ASCII control ranges returned exit 1 (no match).", "gates_run": [ { "gate": "pnpm check:pm-skill-ratchet", "source": "dispatch-gates derived + dispatch words", "verdict_line": "✓ check-skill-line-ratchet: .claude/skills/checklist-test/SKILL.md is 232 lines (ceiling 232; headroom 0)." }, { "gate": "pnpm check:pm-skill-id-lint", "source": "dispatch words (not derived by dispatch-gates)", "verdict_line": "✓ check-skill-id-lint: 9 file(s) clean (pattern /#[0-9]{3,}/g)." }, { "gate": "pnpm check:doc-authoring", "source": "dispatch-gates derived", "verdict_line": "✓ doc authoring guard: 377 files clean — no bare metadata literals." }, { "gate": "pnpm check:pm-governed-merges", "source": "dispatch-gates derived", "verdict_line": "✓ check-governed-merges --self-test: 77 assertions" }, { "gate": "pnpm check:skill-frame-sync", "source": "dispatch-gates derived", "verdict_line": "✓ check-skill-frame-sync: 4 copies of the decision frame are structurally isomorphic across 3 files" }, { "gate": "pnpm --filter @objectstack/lint run check:doc-formula-expressions", "source": "dispatch-gates derived", "verdict_line": "✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 396 files / 1413 TS blocks judged clean by @objectstack/formula.", "note": "red on first run from an unbuilt dependency closure; green after building it" }, { "gate": "pnpm check:nul-bytes", "source": "always owed on any edit", "verdict_line": "check-nul-bytes: OK (scanned 6280 text file(s); no raw ASCII control bytes)." } ], "line_budget": { "file": ".claude/skills/checklist-test/SKILL.md", "before": 232, "after": 232, "ceiling": 232, "headroom_after": 0, "paid_by_deletion": false, "note": "No payment was needed and no re-wrap was performed. The clause was sized to the bullet's existing final line: that line held 31 display columns against the file's 80-column prose wrap, and the 49-column clause lands it at exactly 80, matching its neighbours (lines 143 and 147 are 81). Verified by measuring every line's display width (CJK counted double) rather than by eye." }, "files_changed": [".claude/skills/checklist-test/SKILL.md"], "deviations": [ "None on scope: the file surface is exactly the one file the ruling fixed, and the Guardrails clause was left untouched as instructed.", "check:pm-skill-id-lint was named in the dispatch words but is NOT among the 5 families dispatch-gates derives for this path. Ran it anyway; green. Reporting the discrepancy rather than silently picking a side.", "The PM's mechanism assumption 'a net added line must be paid by deletion' was not exercised — the clause fit inside the existing line count, so the ratchet stayed at 232/232 with nothing deleted. The assumption itself is confirmed correct (headroom measured at 0)." ], "open_questions": [], "out_of_scope_findings": [] }Governed surface: PR #9843 is open as draft and left draft — ready was not flipped, auto-merge was not enabled. A human merges it.
skip-changesetapplied by read-then-write union (bots had already addeddocumentationandsize/xs; final label set read back asdocumentation,size/xs,skip-changeset). Worktree removed without--force.Generated by Claude Code
Generated by Claude Code
os-warren commentedon Aug 19, 2026
ACCEPT — reviewed against GitHub, not the report. PR: #9843
.claude/**) ⇒ terminal three-step: review recorded here; the PR stays draft, visibly awaiting the maintainer's merge; the round report lists it under "awaiting a human merge".Generated by Claude Code