Land the verified REST-operations mapping table as a references fact sheet — every fleet operation's channel (REST endpoint / GraphQL-only / git zero-quota), session-verified 2026-08-23

[claude]

Authorized: maintainer 2026-08-23, live PM chat, verbatim: 「可走 REST 的操作清单，同意立卡」. Filed by the skills seat (session 5213b871-5164-5bc3-8874-28b336bbcd40), self-triaged under the skills-lane exception. Sibling of the quota trio #11364/#11365/#11366 (one ruling stroke earlier the same day): #11364 flips the POLICY (REST as default read path); this card lands the CONTENT — the concrete operation-to-channel mapping the policy needs to be executable without rediscovery.

What lands

A new small references file (suggested: references/rest-channel.md, own ratchet ceiling at landed count, headroom 0 — same Q1=A precedent as state-machine.md / contract-review.md), carrying the mapping below; platform-readings.md's API-quota section gets a one-line pointer (paid inside #11364's rewrite of the same section — fold candidate, see Serial). Every ✓ row was executed in a real session on 2026-08-23; rows must carry that provenance date per platform-readings conventions.

Read side (all migratable — the MCP list/search family is the GraphQL burner)

• ✓ List by label/state: GET /repos/{o}/{r}/issues?state=open&labels=a,b&per_page=N — labels= is true AND (MCP list_issues array is OR)
• ✓ Card / PR metadata: GET .../issues/{n} · GET .../pulls/{n} (assignees, labels, body all present)
• ✓ Full comment thread: GET .../issues/{n}/comments?per_page=100
• ✓ Timeline events: GET .../issues/{n}/timeline (cross-refs, added_to_merge_queue, ready_for_review)
• ✓ PR diff / files: GET .../pulls/{n} with Accept application/vnd.github.diff · .../pulls/{n}/files
• ✓ File at ref: GET .../contents/{path}?ref=... (raw accept)
• ✓ Ancestry / compare: GET .../compare/{base}...{head}
• ✓ Checks / workflows: GET .../commits/{sha}/check-runs · .../actions/runs
• ✓ Quota self-read: GET /rate_limit (zero-cost)

Write side (all migratable)

• ✓ Comments: POST/PATCH .../issues/{n}/comments
• ✓ Labels: additive POST .../issues/{n}/labels + targeted DELETE .../labels/{name} — safer than MCP issue_write whole-set replace (cannot strip a concurrent seat's labels)
• ✓ Create issue with labels: POST .../issues · edit body/state: PATCH · assign: POST .../assignees
• ✓ Request reviewers: POST .../pulls/{n}/requested_reviewers · open PR: POST .../pulls

NOT migratable (the only four — plan around them)

1. Draft → ready flip: GraphQL-only mutation; the egress proxy serves only the pinned PR-review GraphQL set (measured refusal). Outage path: wait for MCP recovery or a human clicks.
2. Auto-merge / queue enqueue: GraphQL mutation (MCP enable_pr_auto_merge).
3. Semantic search: /search/* blocked by the egress proxy by design (repo-scoped paths only); fallback = REST list + local grep (existing discipline).
4. Projects field_values: GraphQL-only — not needed by the fleet; the MCP server's unconditional fetch of it is the leak, not a requirement.

Third bucket — git zero-quota equivalents (ask git before REST)

Branch existence (ls-remote), merge-queue branches, landing-by-content (git grep ... origin/main), squash verification — already doctrine rows in platform-readings; the new file points at them rather than restating.

Boundary

The container curl channel = App installation token (independent 15,000/hr REST bucket); the egress proxy admits repo-scoped paths (/repos/{o}/{r}/...) plus /rate_limit only — org-level endpoints unverified.

Serial constraint & fold

Queues BEHIND the #11086 restructuring PRs (pm-dispatch hot-file chain). Strong fold candidate with #11364 (+#11366): same quota family, same ruling day, overlapping file surface — the claiming seat must answer fold-or-serial per the five-gate test at claim time; folding this card's table with #11364's policy flip into one PR is the likely PASS shape.

Tier: references-only ⇒ opus build + contract-review-tier acceptance.

---

Generated by Claude Code

[os-zhuang]

Scope addendum — fold from #11621 (skills seat, session 5213b871-5164-5bc3-8874-28b336bbcd40; authorization: maintainer 2026-08-24 「动手吧」 on #11621's proposed actions). Two platform-reading rows join this card's fact sheet, provenance 2026-08-24, measured in objectui during PR objectstack-ai/objectui#5963's landing (readings tabled in #11621):

1. merged_by is the enqueuing actor, ⛔ not bypass evidence. GitHub attributes a queue merge to whoever enqueued it; the field cannot distinguish a queue merge from a direct merge. Three seats in one week independently read a human-shaped merged_by as "we bypassed the queue" — measured false.
2. The distinguishing reading for "does auto-merge route through the queue here": (a) attempt the direct merge — PUT /repos/{o}/{r}/pulls/{n}/merge returns 405 "Changes must be made through the merge queue" iff a queue ruleset is enforced; (b) the added_to_merge_queue timeline event on the PR (already a doctrine row — compose, don't restate); (c) repo-wide GET .../actions/runs?event=merge_group count — zero on an enforced queue means the required-check set is empty and the queue merges without validating anything (objectui#4986's state until 2026-08-24).

No new file surface — rows in the same fact sheet, same ceiling arithmetic. Fold-or-serial with #11364 unchanged; the claiming seat still answers the five-gate test at claim time.

---

Generated by Claude Code

[os-zhuang]

Fold-claim: folded into #11364 (primary) per the five-gate test recorded there — same branch claude/issue-11364-rest-default-read-path, session 5213b871-5164-5bc3-8874-28b336bbcd40, skills seat direct dispatch (maintainer 2026-08-24 「一堆skills 的任务是不是应该派发处理了。」). This card's own acceptance criterion stands separately: the mapping table lands verbatim as references/rest-channel.md with per-row 2026-08-23 provenance dates, its ratchet ceiling at landed count with headroom 0, and the 2026-08-24 scope-addendum rows (comment 5394097785). Closes via the fold PR.

---

Generated by Claude Code