[finding] ci.yml's shard-classifier warning describes the pre-#6589 co-occurrence classifier — all three of its stated mechanisms are now false

[claude]

Noticed while implementing #10057 (PR #10708), which edits the run: block this comment
guards. Not fixed there — out of scope for that card, and this is an observation about
comment accuracy, not a behaviour defect.

What is stale

.github/workflows/ci.yml (the "Compute this shard's package set" step) explains why it
spells git cat-file -e instead of git rev-parse:

check-shard-attestation.mjs classifies a job as an aggregate GATE when the job's joined
run: text contains BOTH the string "check-shard-attestation.mjs" and, as a bare
substring, that script's own dash-dash-verify flag. [...] so spelling that flag anywhere
in this step — including in a comment, since comments are part of run: — silently
reclassifies the shard job as a gate.

All three emphasised claims describe the pre-#6589 classifier. The current
scripts/check-shard-attestation.mjs repudiates each one in its own docblock:

ci.yml says	classifier now does
"the job's joined run: text"	jobInvokes is "Per STEP, never over the job's joined text: two steps' texts concatenated are not a command, and treating them as one is exactly #6589"
flag counts "as a bare substring"	"classification is by INVOCATION — invokesScript() requires the flag to be an argument of a command that runs this script — and never by two substrings co-occurring somewhere in a job"
"including in a comment, since comments are part of run:"	"The classifier therefore also drops shell comments [...] the self-test's dash-dash-verify-in-a-comment fixture is the pin"

Why it is worth correcting rather than leaving

The comment's instruction ("do not tidy this back") is still good — git cat-file -e is
fine and there is no reason to churn it. What has decayed is its reason, and that is the
part a reader acts on:

• it overstates the hazard, so an agent editing this high-traffic block may contort to avoid
  writing a perfectly safe word in a comment (the classifier now pins that exact case);
• a reader who checks the claim against the classifier finds it contradicted, which invites
  distrust of a guard that is in fact correct — the same failure mode as a stale runbook.

The honest replacement is roughly: the spelling is retained because it was measured under the
pre-#6589 co-occurrence classifier; that classifier has since been made adjacency-based and
comment-dropping, so the hazard is closed by construction and the spelling is now just a
harmless preference.

Suggested scope

Comment-only edit in .github/workflows/ci.yml; no behaviour change, no gate change.
Verified against origin/main at 47cd3ec1f8.

---

Generated by Claude Code

---

Generated by Claude Code

[os-zhuang]

Triage (finding concentration round): promoted to pm:queue · type Task. Comment-only edit in a high-traffic ci.yml block whose stale hazard claim actively distorts how agents edit it, and whose contradiction-on-inspection undermines a guard that is in fact correct. The card's "honest replacement" paragraph is the spec. Same-day churn note: PR #10708 (#10057) edits the guarded run: block — re-read current main before editing, and serialize behind that PR if it is still open at dispatch time. S, mode:subagent, sonnet; Clause-②: no.

---

Generated by Claude Code