finding: the live required-set diff shipped by #9642 has no standing caller — it needs a PM round-report slot (governed surface)

Recording, not claiming. Filed by the seat that landed #9642.

#9642 ships node scripts/check-required-contexts.mjs --verify-required-set: a report-only diff of the live ruleset's required set against REQUIRED_CONTEXTS, in both directions. Its posture is check-governed-merges.mjs's (a completed sweep exits 0 whether it found 0 or N; a non-zero exit classifies the environment), and it is deliberately off the required path — the settings half of any required-set change is maintainer-only and lands after the merge, so a merge-blocking version would be red on the very PR carrying the repo half.

That leaves it in the same position check-governed-merges.mjs is in: a sweep whose value is realized only when something runs it on a schedule. check-governed-merges's live sweep has a PM round-report slot; this one has none, so today the only thing wired into CI is its offline self-test.

The natural home is the PM round report, beside the governed-merges sweep — but the round-report checklist lives under .claude/skills/pm-dispatch/**, a governed surface a dev seat may not edit. Hence this card rather than a rider PR.

What a caller would surface, measured on the day #9642 landed:

required-set sweep: 6 live required context(s) on main, 2 registered-but-not-required, 0 required-but-unpinned.
  ⛔ direction A — registered here, NOT in the live required set (2).
       • Build Docs — ci.yml job 'build-docs'
       • Console Pin Gate — ci.yml job 'console-pin'

i.e. it re-derives #9533's open question on every run instead of once.

One environment note any caller needs: in an agent container all GitHub traffic goes through the session proxy and Node's global fetch does not read HTTPS_PROXY on its own, so the sweep must run as NODE_OPTIONS=--use-env-proxy ... or it answers HTTP 401 and correctly prints NOT VERIFIED. The script says so in its own diagnostics. check-governed-merges.mjs and scripts/pm/check-half-states.mjs reach the API the same way and share the trap (#7412).

Related: #9642, #9495, #9533, #7412.

Generated by Claude Code

Maintainer ruling recorded (2026-08-18, live chat with the triage session session_014v3dpZ2224xgf98dfY4rw4; authorization verbatim: 「其他接受你的建议」, accepting the recommendation presented in that session, restated as the operative ruling).

Ruling: approved — the sweep gets its standing caller. The PM round-report checklist in .claude/skills/pm-dispatch/** gains one line beside the governed-merges sweep: run NODE_OPTIONS=--use-env-proxy node scripts/check-required-contexts.mjs --verify-required-set each round and carry its output in the round report (the #7412 proxy trap noted in the same line, per this card's environment note).

Process constraints, all standing rules restated for the implementing seat: .claude/skills/pm-dispatch/** is a governed surface — draft-only PR, ⛔ human merge; mandatory model: claude-fable-5 per dispatch clause ①; the skill-line ratchet applies (new line paid for by deletion elsewhere, or the net-reduction rule). Serial note: two other open skills-lane cards may touch the same skill file (#9699 objectos-seat line; #9761 decision-inbox digest, filed today) — hard same-file serialization applies, name them in the claim.

Routing: relabeled domain:devx → domain:skills per the anchoring rule. Label: needs-user-decision → pm:queue, type Task.

Generated by Claude Code

方向意见(来源:#9677 交付复核,PR #9940 dev 报告;session ae0d8bd1-5667-5f58-8ff8-fa22ec154325):

#9940 实测确认了本卡缺口的另一半:dev 席位出网策略挡 api.github.com(403),--verify-required-set 的 live 半边在任何 dev 席上都跑不了 — 会注意到漂移的席位恰恰无法测量漂移。

派发本卡时按 A + B 收敛,不采 C:

A:把 --verify-required-set 接进 scheduled report-only workflow(never required),照 half-state-patrol.yml/feat(pm): give check-half-states a standing caller — scheduled patrol workflow + pinned anchor report #9862 先例 — token 在 workflow 里存在,registry-vs-live 漂移按节拍测量而不是按席位碰运气。该检查设计上就是 report-only(脚本头有长论证为何绝不能 required),接入零成本。
B:同批在脚本头记一行:dev 席跑不了 live 半边(session egress 403),避免下个 agent 把 403 读成树问题。
C(放开席位出网)不在本 repo 控制内,不采。

验收标准照此:workflow 只报告不阻塞,fail 仅限 cannot-run/cannot-deliver;header 注记一行。

Generated by Claude Code

Claim: session ae0d8bd1-5667-5f58-8ff8-fa22ec154325 · family dispatch #9678+#9979 · shared branch claude/family-9678-9979-required-contexts

串行解除:PR #9940 已 11:32Z 合并,check-required-contexts.mjs 空闲。折叠五门:① 同区 —— 两卡都改 scripts/check-required-contexts.mjs(本卡 B 半的 header 注记 + #9979 的根文件声明);② 两卡皆已裁(本卡 A+B 见上方方向评论;#9979 = 套用 #9978 已落地的声明模式);③ 全裁 ✓;④ 共享分支已名于两卡 claim;⑤ 排除清单:⛔ 不改 extractor/hintCovers(被拒类维持被拒)、⛔ workflow 只 report-only 永不 required、⛔ doc-anchors 覆盖范围不动(只加声明)。每卡独立 commit,单 PR 多 Fixes。模型档:scripts/** 无路径强制 → opus。

Generated by Claude Code

ci(#9678): give --verify-required-set a standing scheduled caller

chore(#9979): five more gates declare the repo-root file they really …

fix(#9678): the patrol wiring pins report their own verdict when it i…

{
  "family": [9678, 9979],
  "status": "done",
  "branch": "claude/family-9678-9979-required-contexts",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/10011",
  "pr_state": "draft",
  "head": "9b479c512",
  "premise_still_valid": true,
  "cards": {
    "9678": {
      "status": "done",
      "narrowed": false,
      "commits": [
        "ab5f3bfba ci(#9678): give --verify-required-set a standing scheduled caller",
        "9b479c512 fix(#9678): the patrol wiring pins report their own verdict when it is missing"
      ],
      "files": [
        ".github/workflows/required-set-patrol.yml (new)",
        "scripts/check-required-contexts.mjs (header note + wiring self-test)"
      ],
      "half_A": "New scheduled workflow required-set-patrol.yml. Cron '23 4,16 * * *' (twice daily) + workflow_dispatch + a pull_request run scoped to the patrol and the script it calls, per half-state-patrol.yml's posture. permissions: contents: read only. Findings NEVER fail: a completed sweep exits 0 whether it found 0 or N. The job fails ONLY on cannot-run/cannot-deliver; exit code captured with no pipe in between so the script's own 0-swept / 2-environment split survives. NEVER required and structurally so: no merge_group trigger, no REQUIRED_CONTEXTS row, both machine-pinned.",
      "report_destination": "Run log + run step summary, and nowhere else. Decided and stated in the workflow header: a NEW tracker is refused, and the one existing anchor (#9857) is owned end-to-end by half-state-patrol's generator, so a second writer would make each patrol silently discard the other's findings. Stated cost: a completed sweep that finds drift exits 0 and shows a green tick, so the run emits a ::warning:: annotation (annotations render on the Actions run list) keyed on the ABSENCE of the report's own clean mark — failing toward a false alarm, never a false all-clear. Routing findings to a durable surface is a governed-surface change and was left alone.",
      "half_B": "Header note in scripts/check-required-contexts.mjs: the live half is NOT runnable from a dev seat, with both measurements quoted. The pre-existing 'the ruleset answers 200 to an ordinary agent seat' paragraph is corrected in place rather than deleted (it was true for the seat class that measured it), and the usage block's now-misleading 'the same, from an agent container' line is replaced."
    },
    "9979": {
      "status": "done",
      "narrowed": false,
      "commits": [
        "95c175de2 chore(#9979): five more gates declare the repo-root file they really read"
      ],
      "files": [
        "scripts/pm/check-skill-id-lint.mjs        -> ROOT_FILE_WATCH_HINTS = ['AGENTS.md/**']",
        "scripts/pm/check-governed-merges.mjs      -> ['AGENTS.md/**', 'CLAUDE.md/**']",
        "scripts/pm/check-governed-prose.mjs       -> ['AGENTS.md/**']",
        "scripts/docs-audit/check-audit-scope.mjs  -> ['AGENTS.md/**']",
        "scripts/check-required-contexts.mjs       -> ['AGENTS.md/**']",
        "scripts/check-doc-anchors.mjs             -> ['README.md/**', 'ARCHITECTURE.md/**'] + the 'by judgment' docblock repointed",
        "scripts/pm/dispatch-gates.mjs             -> SELF-TEST ONLY (18 new cases); zero extractor / hintCovers changes"
      ],
      "note": "Every declaration is provenance, never a lookup key: each gate opens its real constant and the glob spelling appearing THERE would send it reading a path that does not exist — silently in doc-anchors' case, since existsSync filters the extra sources out. Both halves pinned per file (declaration covers the real population; nothing declared is a value the gate looks up). doc-anchors COVERAGE unchanged: 251 fragment links across 399 sources, identical before and after."
    }
  },
  "derivation_before_after": {
    "command": "node scripts/pm/dispatch-gates.mjs FILE",
    "AGENTS.md": "1 -> 7 (check:pm-skill-ratchet was the only one; now + docs-audit-scope, pm-governed-merges, pm-governed-prose, pm-skill-id-lint, required-contexts, and the new required-set-patrol.yml family from #9678)",
    "README.md": "0 -> 1 (check:doc-anchors, REQUIRED in lint.yml)",
    "ARCHITECTURE.md": "0 -> 1 (check:doc-anchors)",
    "CLAUDE.md": "0 -> 1 (check:pm-governed-merges)",
    "LICENSE (control)": "0 -> 0",
    "examples/AGENTS.md (control)": "0 -> 0",
    "totals": "114 families across 26 workflow files -> 115 across 27; the added family is the #9678 patrol"
  },
  "self_test_counts_before_after": {
    "scripts/pm/dispatch-gates.mjs": "314 -> 332 cases",
    "scripts/check-required-contexts.mjs": "115 -> 124 assertions (119 after #9678's first commit, 123 after #9979, 124 after the ablation fix)",
    "scripts/pm/check-governed-merges.mjs": "77 -> 81 assertions",
    "scripts/pm/check-governed-prose.mjs": "24 -> 28 cases",
    "scripts/docs-audit/check-audit-scope.mjs": "22 -> 24 cases (its sibling affected-docs untouched at 262)",
    "scripts/pm/check-skill-id-lint.mjs": "10 -> 14 cases",
    "scripts/check-doc-anchors.mjs": "17 -> 22 assertions (this file's self-test prints no case counter; counted from source)"
  },
  "gates": {
    "union_source": "node scripts/pm/dispatch-gates.mjs with NO path arguments, run at final head 9b479c512 — 8 paths vs merge base 6de17ea93, 15 families matched. Exit codes captured by redirect-then-$?, never across a pipe.",
    "verdict_lines": [
      "check:cross-package-test-inputs EXIT=0 — 'All 52 self-test cases passed.' / 'OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.'",
      "check:doc-anchors EXIT=0 — '✅ check-doc-anchors: 251 internal #fragment link(s) across 399 source file(s) all resolve to a real heading'",
      "check:docs-audit-scope EXIT=0 — '✓ check-audit-scope self-test: 24 cases pass.' / '✓ docs-accuracy-audit scope is in sync with content/docs/: 180 hand-written doc(s).'",
      "check:node-version EXIT=0 — 'check-node-version: OK (30 setup-node step(s) across 27 workflow(s), all on Node 22).'",
      "check:pm-dispatch-gates EXIT=0 — '✓ dispatch-gates self-test: 332 cases pass.'",
      "check:pm-governed-merges EXIT=0 — '✓ check-governed-merges --self-test: 81 assertions (...)'",
      "check:pm-governed-prose EXIT=0 — '✓ check-governed-prose: 2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md) and claim no others.'",
      "check:pm-skill-id-lint EXIT=0 — '✓ check-skill-id-lint: 15 file(s) clean (pattern /#[0-9]{3,}/g).'",
      "check:required-contexts EXIT=0 — '✓ check-required-contexts: 6 required context name(s) pinned across 2 workflow(s); 5 instruction surface(s) scanned against 2 retired name(s) (#9491).'",
      "check:shard-attestation EXIT=0 — '✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).'",
      "check:workflow-status-functions EXIT=0 — 'check-workflow-status-functions: OK (scanned 27 workflow file(s), 46 job(s), 24 job-level if: expression(s); 9 read needs.*.outputs.*, all naming a status function).'",
      "check:nul-bytes EXIT=0 — 'check-nul-bytes: OK (scanned 6341 text file(s) -- 6341 tracked, 0 untracked-not-ignored; skipped 5 binary; no raw ASCII control bytes).'",
      "node scripts/check-cross-package-test-inputs.mjs EXIT=0 — same verdict as its pnpm form",
      "node scripts/check-shard-attestation.mjs EXIT=0 — '✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).'",
      "node scripts/docs-audit/check-affected-docs.mjs EXIT=0 — completed, printed its unreachable-row census",
      "node scripts/check-required-contexts.mjs [required-set-patrol.yml family] EXIT=0 — the offline pin, same verdict as check:required-contexts"
    ],
    "workflow_lint": "NO actionlint exists in this repo — grepped lint.yml and package.json. Its workflow gates are check:workflow-status-functions, check:node-version, check:shard-attestation and check:required-contexts, all listed above and all green. Additional mechanical validation is in reverse_verification (iii)."
  },
  "reverse_verification": {
    "predictions_written_first": "Recorded to scratchpad BEFORE any ablation ran; five numbered predictions.",
    "(i) doc-anchors declaration emptied": {
      "predicted": "README/ARCHITECTURE derivation returns to zero; check:doc-anchors reddens in its SELF-TEST not its sweep; dispatch-gates reddens on the two positive halves only, negatives stay green.",
      "observed": "All three, exactly. 'No check family names the given paths in its own source' for both files; '❌ check-doc-anchors --self-test: every extra source declares a root-file watch hint: README.md, ARCHITECTURE.md vs ' (empty right side); '✗ dispatch-gates self-test: 2 of 332 case(s) failed' naming exactly the two doc-anchors positive halves.",
      "direction_note": "NOT uniform, and predicted as such: dispatch-gates' self-test reports MORE failures while README.md's derivation reports FEWER families.",
      "restored": "git checkout HEAD -- ; both gates re-run green (332 cases, 251 links)."
    },
    "(ii) patrol workflow deleted": {
      "predicted": "the new #9678 presence assertions redden by name; AGENTS.md derivation drops 7 -> 6.",
      "observed_first_run": "Derivation dropped to 6 as predicted. The assertions did NOT report — the block died on an uncaught ENOENT, so the 'exactly one workflow' failure was recorded and never printed, every later assertion never ran, and !/merge_group/ on an unread file is vacuously TRUE (a false green about a workflow that does not exist). That is a real defect in code this branch added; the ablation is what found it.",
      "fix": "9b479c512 — existsSync guard, absence is its own named assertion, each downstream case carries patrolPresent.",
      "observed_after_fix": "'✗ check-required-contexts --self-test — 4 failure(s)', each naming its own condition (exactly-one-caller / standing-caller-missing / no-merge_group / clean-mark-coupling). No throw.",
      "restored": "file moved back, self-test green at 124 assertions, git status clean."
    },
    "(iii) workflow validated mechanically (Actions cannot run locally)": {
      "yaml": "parses under the repo's own `yaml` package — 3 triggers, permissions {contents: read}, 1 job, 6 steps, merge_group absent.",
      "shell": "all four run: blocks pass `bash -n`.",
      "annotate_step_executed": "the step's real bash was run against real rendered reports from judgeRequiredSet: clean -> '::notice::required-set sweep: the live required set and REQUIRED_CONTEXTS agree in both directions.'; drift -> '::warning::required-set sweep found a registry-vs-live DISAGREEMENT. ...'"
    },
    "(iv) the #9678 defect class reproduced here (the card's own half)": {
      "bare": "node scripts/check-required-contexts.mjs --verify-required-set -> EXIT=2, 'required-set sweep: NOT VERIFIED — GET https://api.github.com/repos/objectstack-ai/objectstack answered HTTP 401', with the proxy hint printed.",
      "with_documented_remedy": "NODE_OPTIONS=--use-env-proxy ... -> EXIT=2, '... answered HTTP 403', and the proxy hint correctly goes SILENT — so a dev sees a bare 403 with no explanation of its seat class. That is the classified NOT VERIFIED the card asked for, and it is the container class, not the tree."
    }
  },
  "labels_read_back": {
    "method": "union write via issue_write (labels is a full PUT), then read back via search_pull_requests fields=[labels] — issue_read get_labels errors on PR numbers ('Could not resolve to an Issue with the number of 10011'), and pull_request_read get returns no labels field.",
    "before_write": ["ci/cd", "size/l"],
    "written": ["ci/cd", "size/l", "skip-changeset"],
    "after_read_back": ["ci/cd", "size/l", "skip-changeset"],
    "verdict": "skip-changeset present, no bot label lost. No changeset file: nothing here is published."
  },
  "exclusion_list_compliance": {
    "extractor_hintCovers": "untouched — dispatch-gates changes are self-test cases only; the bare-*.md widening stays refused and the new negative halves pin that these declarations bought no part of it (examples/AGENTS.md and the cross-root pairs stay unreached).",
    "workflow_never_required": "no merge_group trigger, no REQUIRED_CONTEXTS row, sole caller of the flag — all three machine-pinned, and the pins are shown reddening in reverse verification (ii).",
    "doc_anchors_coverage": "unchanged — 251 fragment links across 399 sources before and after; only the docblock prose and the declaration were added.",
    "governed_surfaces": "nothing under .claude/ or skills/ touched; this family is entirely non-governed."
  },
  "open_questions": [
    {
      "question": "Card #9678's original maintainer ruling (2026-08-18) put the standing caller in the PM round-report checklist under .claude/skills/pm-dispatch/** — a governed surface. The PM's later direction comment converged on A+B (scheduled workflow) and explicitly did not adopt C. I implemented A+B as dispatched, so the round-report line from the earlier ruling does NOT exist. Should it still be added?",
      "options": [
        "A. Leave as-is. The workflow is the standing caller; the round report would be a second, human-cadence caller of the same read, and a dev seat cannot run it anyway (measured 403), so a PM line would say 'read the patrol's run log'.",
        "B. File a follow-up governed-surface card adding one round-report line that POINTS AT the patrol's latest run rather than re-running the sweep — costs the skill-line ratchet one line, and the ratchet's own rule requires a deletion elsewhere or a net reduction.",
        "C. Treat the earlier ruling as superseded by the direction comment and record that explicitly on the card so the next reader does not re-open it."
      ],
      "recommendation": "C, plus A. The direction comment is the later ruling from the dispatching seat and it converged deliberately; the value the round-report line was meant to buy — 'something runs this on a cadence' — is now bought by the workflow, at zero governed-surface cost and zero ratchet cost. B remains available if drift is ever found to sit unread in run logs, but filing it now would spend a governed-surface merge on a line whose content is 'go look at the workflow'. What I did NOT do is silently drop the earlier ruling: it is flagged here for the PM to record on the card."
    },
    {
      "question": "The patrol adds a SECOND dispatch-gates family for the same script — an AGENTS.md card now derives both `pnpm check:required-contexts [lint.yml]` and `node scripts/check-required-contexts.mjs [required-set-patrol.yml]`. dispatch-gates drops flags from a direct invocation, so the second renders without `--verify-required-set`.",
      "options": [
        "A. Accept. half-state-patrol.yml set exactly this precedent (`node scripts/pm/check-half-states.mjs [half-state-patrol.yml]`), the provenance column names the workflow, and running the bare script is the offline pin — correct and green, never misleading.",
        "B. File a finding against dispatch-gates' runnableInvocation for dropping flags that change what a script does."
      ],
      "recommendation": "A, and I did not file B. The rendered command is harmless and correct here, and B would be a general claim about runnableInvocation that I have measured on exactly one instance — the header's own doctrine is that a fabricated or misleading lead must be priced before it is filed. Flagging it here rather than filing it is the honest middle."
    }
  ],
  "out_of_scope_findings": [
    "filed as #10012: dispatch-gates' residue prose still names `README.md` as the live specimen of an unreachable top-level-FILE population — after this PR that is the one root file in the repo that IS reachable, so a reader who tests the claim gets the opposite answer. Rule unchanged and correct; only the example went stale. Labelled `finding` + `domain:skills`, unassigned, no pm:queue. Two remedies with a recommendation are on the card."
  ],
  "cleanup": "worktree /home/user/objectstack-f9678 removed without --force after node_modules deletion; no background processes were started."
}

Generated by Claude Code

ACCEPT(族 #9678+#9979) — PR #10011 复核通过,已 flip ready + auto-merge(显式 SQUASH)。族派发首单,双卡全交付、每卡独立 commit、排除清单全项合规。

复核记录(session ae0d8bd1-5667-5f58-8ff8-fa22ec154325):

亲取全 diff。A 半(常设调用者):required-set-patrol.yml 的 report-only 不是口头的 —— 唯一调用者、无 merge_group、无 REQUIRED_CONTEXTS 行三条全被 check-required-contexts 自测钉住;drift 标注以 REQUIRED_SET_CLEAN_MARK 单源常量耦合(渲染改动只会误报警、永不假全清);exit 无管道捕获;least-privilege;报告落 run log + step summary,拒开第二跟踪器 / 拒当锚 [Half-state patrol] check-half-states live sweep — generated view (please pin) #9857 的第二写者的论证成立 ✓。B 半:header 注记带双实测,旧「200 可读」段就地修正而非删除 ✓。
finding: five more gates genuinely read a repo-root instruction file and still score silent for it — the root-file class that #9964 closed for only one gate #9979 半:五门禁 + doc-anchors 各自声明,逐文件「声明⊆真实人口 / 声明形非查找键」双向钉;dispatch-gates 仅加 18 自测例、抽取器零改动;派生实测 AGENTS.md 1→7、README/ARCH/CLAUDE 0→1、双对照恒 0 ✓。
反向验证含金量最高的一腿:删巡逻 workflow 的消融暴露自测块未捕获 ENOENT → 断言真空化(!/merge_group/ 对不存在的文件恒真)—— dev 当场修成命名的存在性断言 + patrolPresent 贯穿下游。消融找到真缺陷,这正是消融存在的意义 ✓。
Open question ① 裁 C+A:2026-08-18「轮报清单加行」的早裁定被后续方向评论(A+B)取代,在此记录在案 —— workflow 以零治理面、零棘轮成本买到了同一价值;若日后发现 drift 躺在 run log 没人读,选项 B(轮报指针行)再立卡。Open question ② 裁 A:同脚本第二 dispatch-gates 族照 half-state-patrol 先例接受,不为单例立普遍性 finding —— dev 「先掂量再立案」的克制是对的。
Out-of-scope finding: dispatch-gates' residue prose still names README.md as the live specimen of an unreachable top-level-FILE population — it is now declared #10012(residue 例证过时)已收,定级见该卡。

Generated by Claude Code

ci: a standing caller for the required-set sweep, and five gates that…

Navigation Menu

Repository navigation

finding: the live required-set diff shipped by #9642 has no standing caller — it needs a PM round-report slot (governed surface) #9678

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding: the live required-set diff shipped by #9642 has no standing caller — it needs a PM round-report slot (governed surface) #9678

Description

Activity

os-support-ai commented on Aug 18, 2026

os-warren commented on Aug 19, 2026

os-warren commented on Aug 19, 2026

os-warren commented on Aug 19, 2026

os-warren commented on Aug 19, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions