Governed-merge audit: detection stays every-seat, the authoritative window and disposition move to the Director seat (no new label)

[os-litant]

Filed by the skills seat (session_01MnijPVVDakqK2J335JoJtq) executing a maintainer ruling from live PM chat, 2026-08-27.

Ruling (verbatim, untranslated)

The maintainer's question: 「governed 合并审计，目前流程是怎样？是不是也应该都汇报给项目总监。是否建议新增加一个label ？」

The seat's recommendation: keep the three-layer regime (--test pre-arm gate + human-merge-as-review-record + after-the-fact sweep) and split the third layer 检测双层、处置单席 — lane seats keep the per-round sweep as near-zero-cost early warning; the Director seat runs the AUTHORITATIVE consolidated audit on every summon, --since-ref-anchored at the tips recorded by the previous Director audit (anchor = one line in the Director seat post's 说明 section — gap-free, duplicate-free); the list is presented inside the adjudication batch (per entry: recognize / don't); an unrecognized entry is filed as a needs-user-decision card on the spot (the #9495 incident regime). NO new label: enumeration is tree-derived (local git, zero API, cannot drift — a label would be a second corruptible index), and disposition reuses the Director's existing inbox.

The maintainer's execution ruling, verbatim: 「合并审计归总监那件事，同意你的建议」.

Already live: the Director's first consolidated run executed 2026-08-27 ~13:00Z (7 governed merges enumerated across 2/2 checked-out repos, all attributed via MCP, presented in the summon's batch report); the anchor tips are recorded on the Director seat post. This card lands the charter text so the practice is versioned, not oral.

The two changes

1. SKILL.md 轮次报告 clause (one-sentence amendment): the governed 合并审计清单 line stays a lane-round duty (early warning, own window, ⛔ 不凭记忆 unchanged), with the authoritative consolidated window and the recognize/rollback disposition named as the Director seat's (pointer to references/lanes/director.md, no mechanics copied).
2. references/lanes/director.md fourth duty: anchored governed-merge audit — each summon runs the sweep --since-ref-anchored at the previous audit's recorded tips (anchor line lives in the Director seat post 说明 section; the script itself prints the exact next-round flags and stores nothing), folds the list into the adjudication batch (one line per entry, recognize y/n), files an unrecognized entry as needs-user-decision in the same stroke, and records the new tips. INCOMPLETE (exit 2) is reported as INCOMPLETE, never as clean. Attribution channels that 403 in-container are completed via MCP per entry. ⛔ No new label; ⛔ no cron (human-invoked cadence is the audit cadence, parked windows are the designed-safe state — same trade as the other three duties).

Non-goals (binding)

• The --test pre-arm predicate, the queue guard, and the human-merge-as-review-record regime (2026-08-18 「同意」) untouched.
• Lane seats' round-report audit line NOT removed (defense in depth); only the authoritative window/disposition centralize.
• check-governed-merges.mjs itself untouched — protocol text only.
• No new labels, no new title words, no script changes.

File surface

.claude/skills/pm-dispatch/SKILL.md (one sentence in the 轮次报告 clause) + .claude/skills/pm-dispatch/references/lanes/director.md (fourth duty). Both at zero-headroom ratchets (1005/1005; 75/75) — net 0, cut ledger with surviving homes; if director.md cannot absorb the duty at net 0 without destroying meaning, STOP and report the precise shortfall (a ceiling bump is the maintainer's decision).

Acceptance

• A Director summon replayed under the new text: one anchored sweep, list inside the batch, unrecognized ⇒ card + incident question in the same batch, anchor advanced on the seat post.
• Lane round reports unchanged except the pointer sentence.
• Ratchets hold; id-lint (no issue numbers in protocol files), frame-sync, governed-prose green; governed draft PR + human merge four-piece.

[os-litant]

Claim: skills-lane PM dispatch (ruling execution; filed and claimed by the same seat)
Session: session_01MnijPVVDakqK2J335JoJtq
Branch: claude/issue-12709-governed-audit-director
Worktree: ../objectstack-12709 (dev-created from origin/main)
Domain: skills
File surface: .claude/skills/pm-dispatch/SKILL.md (one sentence, 轮次报告 clause) + .claude/skills/pm-dispatch/references/lanes/director.md (fourth duty). Zero-headroom ratchets on both — net 0 per file, cut ledger with surviving homes mandatory; director.md is the tight one (75/75) — STOP and report the shortfall rather than force a meaning-destroying cut.
Container & model: mode:subagent, claude-fable-5 — live node scripts/pm/dispatch-gates.mjs --tier output for this surface (run this session): "Model tier — MANDATORY: claude-fable-5 … .claude/skills/pm-dispatch/SKILL.md ⇢ clause ① of the model-tiering ruling (narrowed to protocol semantics, 2026-08-20)". Multi-clause semantic change — no one-liner exit. Clause-② content limb: no (PM protocol text).
Serial constraints cleared: PR #12682 (the prior SKILL.md holder) merged 2026-08-27T10:18:30Z (merged:true + merged_at read back); no open PR holds either file (single-writer check runs on the PR); director.md's only prior PR (#12664) merged 05:36Z.
Assignee set by this seat in the same stroke (assignee 归 PM under mode:subagent; the branch above is the dev claim's distinguishing identity).

---

Generated by Claude Code

[os-litant]

os-dev-report

{
 "issue": 12709,
 "status": "done",
 "branch": "claude/issue-12709-governed-audit-director",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/12713",
 "premise_still_valid": true,
 "summary": "Both ruled changes landed at net 0 per file, no shortfall report needed: the SKILL.md round-report audit line keeps the lane duty verbatim (own --since window, 不凭记忆汇总) and names the authoritative window plus recognize/rollback disposition as the Director seat's with a pointer to references/lanes/director.md; director.md gains 职责四 (anchored sweep from the seat post's recorded tips, list folded into the adjudication batch one line per entry recognize y/n, unrecognized entry filed as needs-user-decision in the same stroke under the 2026-08-18 after-the-fact-audit regime, tips re-recorded, INCOMPLETE exit 2 reported as INCOMPLETE, in-container 403 attribution completed via MCP, no new label, no cron). Three-duty phrasing updated to four in both files (SKILL.md invocation table and Director paragraph, director.md 档位 bullet); full cut ledger with each cut's surviving home is in the PR body — one cut flagged there for the maintainer's eye: the 授权源 bullet's two lead-in ruling sentences dropped (the binding third sentence kept byte-identical). Draft PR 12713 stays draft with skip-changeset applied and read back (labels now size/s + skip-changeset, nothing stripped); human merge only.",
 "tests": "All at commit 4c8ac62f3, clean tree, exits captured before any pipe. pnpm check:pm-skill-ratchet exit 0, per-file verdicts: 'SKILL.md is 1005 lines (ceiling 1005; headroom 0)' / 'widest table row is 765 bytes (pin 765)' / 'director.md is 75 lines (ceiling 75; headroom 0)' / 'widest table row is 0 bytes (pin 0)'. check:pm-skill-id-lint exit 0 ('23 file(s) clean'); check:skill-frame-sync exit 0 ('4 copies structurally isomorphic across 3 files'); check:skill-frame-freshness exit 0 ('frame itself is unchanged'); check:pm-governed-prose exit 0 ('2 instruction surface(s) name all 5 registered governed surfaces'). Derived union via node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (stderr pinned the answer to this repo at 4c8ac62f3): check:agent-test-spelling exit 0; check:doc-authoring exit 0 ('391 files clean'); lint-package check:doc-formula-expressions exit 0 after building @objectstack/formula and @objectstack/lint under os-verify-lock ('22 record-scoped formula examples judged clean'); check:pm-governed-merges exit 0 (self-test, 204 assertions); check:nul-bytes exit 0 (7055 files). check-governed-queue-guard is CI-only in this container: NOT MEASURED locally. First doc-authoring run was PREREQUISITE NOT MET (background pnpm install had silently never run: its redirect target directory did not exist at spawn, exit 0 with nothing done) — install rerun under the lock, gate then green; prerequisite runs not reported as red.",
 "mcp_calls": "5 GitHub MCP calls total including this comment (create_pull_request, pull_request_read get x2, issue_write labels, add_issue_comment); card and comments read via the zero-quota public-repo payload channel.",
 "open_questions": [],
 "out_of_scope_findings": ["not filed, handed to PM instead: dispatch-gates.mjs prints on every derivation that 9 spec-package check families (api-surface, dual-source-exports, entry-nameability, export-origins, exported-any, meta-url-spelling, spec-changes, strictness-ledger, upgrade-guide) declare populations the tree no longer has (layout moved under packages/spec/scripts/lib and packages/spec/src) — a standing repo fact the tool self-reports each run and PM-visible on every card derivation; flagged here rather than filed to avoid duplicating a fact already surfaced per-run, and because this seat's one dedupe search was not spent on it"]
}

Generated by Claude Code

---

Generated by Claude Code

[os-litant]

ACCEPT — seat review done on the full diff (PR #12713, head 4c8ac62f3, 2 files, net 0 at both zero-headroom ratchets).

• Both ruled changes land faithfully: the SKILL.md round-report audit line keeps the lane early-warning duty byte-for-byte (own window, ⛔ 不凭记忆汇总) and names the authoritative window + recognize/rollback disposition as the Director's with the pointer; director.md's 职责四 carries every ruled element — anchored sweep from the seat post's recorded tips (script self-prints next-round params, stores nothing), tips re-recorded in the same stroke, list folded into the adjudication batch one line per entry, an unrecognized entry = seat violation filed as needs-user-decision in the same stroke under the 2026-08-18 after-the-fact-audit regime (cited by date, no issue numbers), INCOMPLETE reported as INCOMPLETE, in-container 403 attribution completed via MCP, ⛔ no new label, ⛔ no cron. Matches the first consolidated run already executed this summon.
• Cut ledger audited against real surviving homes: the 「1A 2B …」 reply-format examples live verbatim in decision-analysis.md's batch-flow section; the PASS-branch landing chain lives in contract-review.md's 清标即落地; the 2026-08-26 ownership quote survives in SKILL.md's Director paragraph (the 交接台账 now points there); the by-construction exit rule lives in state-machine.md; the duty-label enumeration survives as the three duty section headers themselves. Three-duty phrasing updated to four consistently in both files.
• One substantive cut, correctly flagged rather than hidden: the 授权源 bullet drops the two conversational lead-in quotes and keeps the binding third sentence byte-identical; the dropped quotes remain permanently on the charter card and its PR. The maintainer ratifies this trade by merging — it is named in the PR body for exactly that reading.
• Gates: ratchet verdicts quoted per file (1005/1005, row 765; 75/75, row 0), id-lint 23 clean, frame-sync isomorphic, governed-prose 2 surfaces × 5 registered, derived union green; queue guard CI-only as declared. The out-of-scope note about dispatch-gates' self-reported stale spec-family populations is already filed (the standing card the earlier claim comments cite) — no duplicate filing needed, correctly handed up.

Four-piece end state (same stroke): PR stays draft; review requested from os-zhuang with the draft bit passed explicitly; awaiting the maintainer's human merge. Fixes #12709 closes this card on merge.

---

Generated by Claude Code