给 governed-surface-guard 的 merge_group job 装依赖,启用生成物豁免重算 —— 纯再生成的 skills 指针行不再需要维护者批准

[os-sam]

裁决(2026-09-01,维护者,逐字)

纯生成的指针行(spec 源变更后再生成的 references/_index.md) 不需要我审核吧

语境:#13794(spec 源变更 + 4 个再生成的 skills/*/references/_index.md)在 merge_group 腿被 Governed Surface Queue Guard 拒绝,维护者被迫钉头批准一轮纯生成 diff。总监席提案「给 guard job 装依赖启用生成物豁免重算」,维护者以上句确认。

依据(脚本头注已归档的 trade,scripts/pm/check-governed-queue-guard.mjs)

⚠️ One measured limit […]: the #11705 rows (generator-owned files inside skills/**) recompute by running the generator's own --check, and THIS JOB INSTALLS NO DEPENDENCIES. Here they therefore fail closed — a spec PR carrying its regenerated references/_index.md is still governed at merge-group time and needs the approving review, even though the seat-side --test lifts it in a dev container. Giving this job a dependency install would close that, at a cost on every queue build, and no ruling covers that trade — it is filed, not taken.

本卡即把该 trade 从 filed 变为 taken;裁决已覆盖。

要求

1. .github/workflows/governed-surface-guard.yml 的 merge_group job 增加依赖安装(以及 recomputeProvenanceFor 跑生成器 --check 所需的最小构建),使 applyGeneratedExceptions 在队列构建里可实际重算 —— 座席侧 --test 与 queue 腿对同一 diff 恒同答([finding] skills/*/references/_index.md is generator-owned (gen:skill-refs) yet sits inside the skills/** governed-merge fence — every spec PR touching an indexed headline is forced to carry a governed-surface file #11705 ⛔ 不写第二机制,继续从 check-governed-merges.mjs 导入,不复制)。
2. fail-closed 语义一根不松:重算任何错误路径照旧拒绝(EXIT 语义与现状一致);豁免只对生成器认账的 byte-exact 再生成生效,手写 skills/** / .claude/** / ADR / AGENTS.md 改动照旧需要 GOVERNED_APPROVERS 钉头批准。
3. 自测更新:--self-test 对 workflow 名/结构的既有断言保持绿;为「装了依赖后豁免生效」「重算失败仍 fail closed」补 pin。
4. 报告队列构建的实测耗时增量(pnpm install + 构建),写进 PR 正文。
5. pull_request 早警腿行为不变(照旧 exit 0)。

验收

• Select an import-list doc block as module description only on an explicit @module marker, and re-attach the eight wedged schema comments #13794 形态的 diff(spec 源 + 纯再生成指针行)在 merge_group 腿零批准放行;
• 含任一手写受管文件的 diff 照旧被拒;
• 守卫自测绿;workflow 名 Governed Surface Queue Guard 不动(required context 钉的就是它)。

[os-sam]

Claim — dev seat, dispatched by PM session session_015adLit3ZYASJiXwxKG78Wi (director seat).

• branch: claude/issue-14063-guard-job-deps
• repo: objectstack-ai/objectstack
• dispatch tier as given by the PM: opus. Verbatim reading from my own run of node scripts/pm/dispatch-gates.mjs --tier on the shared checkout (no tier line is printed by this script build):

dispatch-gates: gate list derived from the tree of 'objectstack-ai/objectstack' at commit 2cce3fd3 (/home/user/objectstack).
 ⚠️ STALE TREE — this answer is derived from a tree at least 146 commit(s) behind origin/main ...
dispatch-gates: this branch changes nothing against 'origin/main' (merge base 2cce3fd30) — nothing to derive.

Gate derivation will be re-run inside the task worktree against a freshly fetched origin/main, on the real diff.

The assignee field is left as the PM set it (per the dev-seat contract, the dev never writes assignees); this comment plus the branch name is the identity marker. If another session claimed this issue before me, stop and say so — I found no prior comments at claim time.

Generated by Claude Code

---

Generated by Claude Code

[claude]

os-dev-report

{
 "issue": 14063,
 "status": "done",
 "branch": "claude/issue-14063-guard-job-deps",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/14069",
 "premise_still_valid": true,
 "summary": "The Governed Surface Queue Guard job now acquires pnpm through the shared ./.github/actions/setup-pnpm composite, restores the pnpm store from lint.yml's cache key, and runs a plain `pnpm install --frozen-lockfile` — no --filter (so the register's verify.pkg set is not restated in YAML and a new row is covered for free) and no build (measured: both verify rows run through tsx off TypeScript sources; nothing reads any dist/). Every toolchain step is continue-on-error, which is load-bearing rather than defensive: without it a registry or cache outage would newly redden merge groups touching nothing governed, and with it a broken install degrades to exactly the pre-existing fail-closed behaviour. Both legs install, because the pull_request leg is a forecast of the queue verdict and a leg that cannot recompute forecasts a refusal that will not happen; its exit-0 behaviour, head-read-free API surface and wording are unchanged. fail-closed semantics, the exit codes, the byte-exact recompute and the workflow name literal are all untouched. Two half-states worth reporting: the issue arrived with an EMPTY assignee field (PM-side half-state — the dev seat never writes assignees, so it was left as found and work proceeded); and the dispatch prompt's step 1 told me to assign myself, which conflicts with the binding dev-seat contract (assignee belongs to the PM) — I followed the contract and posted the claim comment with the dispatching session ID and branch instead, per the instruction that this file wins on conflict.",
 "tests": "All readings at the final commit 7d02199a, exit codes captured by redirecting first (never through a pipe). (1) `node scripts/pm/check-governed-queue-guard.mjs --self-test` -> its own verdict line `✓ check-governed-queue-guard self-test: 129 cases pass (...)`, exit 0. (2) Gate family derived from the real diff, not recalled: `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` (3 paths vs merge base 6643ba1ce) -> 31 families + 2 convention-triggered gates because the diff edits gate scripts; all 32 harvested commands were run, 30 exit 0, including check:pnpm-acquisition (its census now records this job at governed-surface-guard.yml:155 under `cached · composite`, 24 sites), check:node-version, check:required-contexts, check:pm-governed-merges, check:pm-dispatch-gates, bare-root-worklist --self-test, check:self-test-wired, check:self-test-workflow-commands, check:workflow-status-functions. The two non-zero results are NOT MEASURED, not red: check-test-completeness.mjs exits 3 with its own text 'the local reading for this gate is NOT MEASURED' (it needs a saved test-run log), and `node scripts/pm/check-governed-queue-guard.mjs` with no argument is the live CI invocation, which exits 1 `could not read GITHUB_EVENT_PATH` offline — its local reading is the --self-test above. (3) `pnpm lint` (repo-wide `eslint . --no-inline-config`, through the shared verify lock) -> exit 0 in 81s, so no narrowing and no narrowing argument is owed. (4) `node scripts/check-nul-bytes.mjs` -> OK over 7678 files, plus a direct grep -naP control-byte scan of the three edited files, zero hits. (5) `node scripts/pm/check-governed-merges.mjs --test` over the three changed paths -> `✅ NOT governed`, 0 of 3 hit the register, exit 0: this PR takes the ordinary queue lane, as the dispatch expected. (6) Live toolchain proof that the install is sufficient and no build is needed: in a fresh worktree with only `pnpm install --frozen-lockfile` run (7s wall, warm store, shared box), `pnpm --filter @objectstack/spec exec tsx scripts/build-skill-references.ts --check --generated-manifest=...` exits 0 in 1s and declares 9 outputs, and the seat-side `node scripts/pm/check-governed-merges.mjs --test skills/objectstack-ai/references/_index.md` lifts the path as a PURE REGENERATION. (7) REVERSE VERIFICATION, five legs, predicted direction red, all red. No build/dist is in the resolution path here — the guard script is executed directly by node and reads the workflow YAML from disk — so there is no rebuild leg to state; instead each leg proved the mutation reached DISK before reading anything: occurrence counts of both the injected text and the removed text, plus `git hash-object` differing from the HEAD blob (an empty hash would have been read as failure). Every leg then restored with `git checkout HEAD -- PATH` (never a bare checkout) under a trap using an absolute REPO_ROOT, and proved the restore by `git diff HEAD` being empty AND the blob hash equal to the HEAD blob. Legs and the assertion each one reddened: deleting the Install dependencies step -> `the-job-installs-the-workspace-dependencies-the-recompute-runs-on: (no pnpm install step)` plus the ordering pin; dropping continue-on-error -> `every-toolchain-step-DEGRADES-...: missing continue-on-error: Install dependencies`; adding `--filter @objectstack/objectui` -> `the-install-covers-the-register-row-without-restating-it` for both register rows; moving the install after the live judgment -> the ordering pin with {\"selfTest\":2,\"install\":7,\"judgment\":6}; and a fail-OPEN mutation of the lift (`stillGoverned = new Set()`) -> the new end-to-end fail-closed cases flip to {\"conclusion\":\"clear\",\"exitCode\":0} and catch it, which is what shows those cases measure the refusal rather than restate it.",
 "mcp_calls": "7 — issue_read(get), issue_read(get_comments), add_issue_comment(claim), search_issues(one targeted dedupe query), issue_write(create #14067), create_pull_request, add_issue_comment(this report). Channel note: repo-scoped REST is reachable from this container (GET /repos/objectstack-ai/objectstack -> 200) and was used for the skip-changeset label write plus its read-back, but /search/issues is refused for this session ('sessions are bound to their configured repositories'), so the one dedupe search went through MCP search_issues as the declared fallback. That query returned real hits (24 total, including this card's own neighbourhood), so the empty result for the specific duplicate is a read, not a blind spot.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #14067: AGENTS.md Prime Directive #14 still instructs seats that a pure-regeneration PR must request its pinned approval proactively because 'the queue-time leg installs no dependencies' — false the moment this PR lands. Not fixed here on purpose: AGENTS.md is itself a governed surface, so including it would fork this PR into the draft-only maintainer-merge lane, and the amendment must also reflow at net zero lines under the AGENTS.md ratchet (1162, headroom 0). Filed unassigned with Blocked-by: #14063."
 ]
}

Generated by Claude Code

---

Generated by Claude Code