[governance] `ADR maintainer approval` is unsatisfiable on any PR the maintainer authored — GitHub forbids self-approval, so the gate is permanently red exactly when the human IS driving

[hotlong]

Filed by the domain:devx PM seat (#6023) after the maintainer stated in session on 2026-08-12 ~18:2xZ that they judge the #7960 blockage to be a CI-rule defect rather than a PR defect. Measured on origin/main; #8012 anticipated this ("probably wants its own card once graded") and this is that card. Unassigned — recording only.

The deadlock, mechanically

scripts/check-adr-merge-approval.mjs has exactly one pass condition. From decide():

• latestMaintainerReviewState(reviews) walks the PR's reviews, keeps only those whose author matches MAINTAINER_APPROVERS by numeric account id, keeps only the state-setting kinds (APPROVED / CHANGES_REQUESTED / DISMISSED), and returns the last one;
• the gate returns ok: true only when that value is APPROVED. There is no other exit that passes.

scripts/check-adr-merge-approval.mjs:101:

export const MAINTAINER_APPROVERS = [{ login: 'hotlong', id: 50353452 }];

One entry. And scripts/check-required-contexts.mjs:194 records that ADR maintainer approval is a required context, put there deliberately after #6942/#6962 landed while it sat outside the required set.

Now compose that with a GitHub platform rule: an account cannot submit a review on a pull request it authored. So for any PR whose user.login is hotlong:

• the only account whose approval the gate accepts is the one account GitHub will not let approve;
• therefore latestMaintainerReviewState can never return APPROVED;
• therefore a required context is permanently red;
• therefore the PR cannot be merged through the normal path, or enter the merge queue, no matter what anyone does on it.

Live instance: PR #7960 (ADR-0001 tombstone, #7866). user.login is hotlong. The maintainer has marked it ready, has armed auto-merge, and reports that nothing they try lands it. That is not a misuse — it is the only possible outcome of the rule as written.

Why this is a rule defect and not "the gate doing its job"

The ruling the gate implements (#6741) is 「adr 只能由维护者自己确认，人工合并，ai 不得擅自合并。」 The gate does not measure that. It measures a proxy: "an APPROVED review exists from account 50353452". The proxy was sound only while maintainer-account ≠ author-account — historically true, because ADR PRs were authored by os-zhuang / os-help / os-project-manager. Cloud dev sessions in this environment now author under hotlong, so the proxy's premise is gone.

⚠️ The proxy is not merely broken — it is inverted. Under the current single shared identity:

case	what the gate should do	what it does
PR authored by hotlong (the human is the one driving it)	pass once the human confirms	can never pass — self-approval is impossible
PR authored by some other account, with an AI seat holding the hotlong credential	refuse — an AI must not confirm on the maintainer's behalf	passes — the seat can submit the approving review itself

So the gate is closed on the case it was meant to admit and open on the case it was meant to stop. #8012 recorded the second row already; this card is the first. Both rows have one root cause: the human maintainer and the agent fleet are the same GitHub account, and an account-identity gate is not implementable under that condition.

Shapes a fix could take — not choosing, this is a governance surface

1. Fix the identity (closes both rows, and #8012 with them). Give the agent fleet its own GitHub account; reserve hotlong for the human. Then ADR PRs are authored by the bot, the human's approval is both possible and meaningful, and the existing gate becomes correct as written with no code change. Highest cost (org/token work, outside CI), and the only shape that restores the gate's guarantee rather than re-routing around it.

2. Admit a second maintainer signal that self-approval does not block. Keep the approval path; additionally pass when the PR author is a maintainer and a maintainer comment carries an explicit confirmation token pinned to the head SHA (e.g. a literal marker plus ac278e6). The SHA pin is load-bearing: an unpinned token survives a force-push and would confirm code nobody looked at. Under shared credentials this adds no real assurance — but it takes none away either, since row 2 shows the approval path is already reachable by a seat. Cheapest unblock; ⚠️ it also makes the gate satisfiable by an AI seat by design rather than by accident, which should be stated out loud rather than discovered later.

3. Ruleset-side bypass for this one PR. Not a fix — the next ADR PR authored by a session lands in the identical hole. Listed only so it is not mistaken for one.

⛔ What must not be done, and why it is the tempting one: "the PR author is a maintainer ⇒ pass". Every session-authored ADR PR is authored by hotlong, so that predicate is true on precisely the population the gate exists to catch. It would weld the gate permanently open while still reporting green. Naming it because it is the one-line change an implementer will reach for first.

Establishment

• Gate logic read at origin/main, not from memory: MAINTAINER_APPROVERS at :101, isMaintainer at :123 (id-first comparison), latestMaintainerReviewState at :140, the single ok: true return at :190.
• Required-context status read from scripts/check-required-contexts.mjs:194.
• .github/workflows/adr-merge-approval.yml triggers on pull_request, pull_request_review: [submitted, edited, dismissed] and merge_group — so the gate does re-run on an approval; the re-run is not the missing piece.
• PR docs(adr),chore(devx): tombstone ADR-0001 — retire the number, empty the citation allowlist (#7866) #7960 state read by fresh fetch: open, not draft, not merged, not enqueued, head ac278e6, author hotlong, ADR maintainer approval red.
• ⛔ No action taken on docs(adr),chore(devx): tombstone ADR-0001 — retire the number, empty the citation allowlist (#7866) #7960 by this seat, and none will be: ADR-class PRs are not AI-merged, AI-enqueued or AI-auto-merged (⛔ Discipline: ADRs are confirmed and merged by the maintainer only — no AI seat may merge, queue, or auto-merge a docs/adr/** PR #6741). Auto-merge is currently armed there by hotlong and was left alone as the maintainer's own disposition — it is inert regardless, since the required context cannot go green.

[hotlong]

Already ruled — 2026-08-12 (live PM chat, session_01GxKQfv3k8b6a2d2QrZU411; maintainer sam, verbatim: 「接受你的全部建议。」, accepting the decision-box analysis in full). Moved out of the decision box → pm:queue (domain:devx). This card was filed ~18:21Z, minutes after the ruling landed on #8012, and is that card's row 1 written up separately — the ruling covers both rows.

Ruling: shape 1 — fix the identity. The agent fleet gets its own GitHub account; hotlong is reserved for the human maintainer. The existing gate then becomes correct as written, with no change to its logic. ⛔ Shape 2 (a SHA-pinned confirmation token) is not taken — as this card states, it makes the gate satisfiable by an AI seat by design, which is the guarantee the gate exists to provide. ⛔ Shape 3 (a one-off ruleset bypass for #7960) is not a fix. ⛔ And the tempting one-liner this card correctly flags — "PR author is a maintainer ⇒ pass" — stays forbidden: it is true on precisely the population the gate exists to catch.

Sequencing (from the #8012 ruling): fleet identity first → then the arming-side hardening (fail the gate when auto-merge is armed on a docs/adr/** PR without a qualifying approval) → then re-open PR #7960 under the fleet identity, which both unblocks it and proves the fix end-to-end. Until the identity lands, #7960 stays as it is; ⛔ no admin merge, no bypass.

Duplicate handling: keep this card as the implementation card (its mechanical write-up is the better one — gate line numbers, required-context status, the inverted-proxy table) and treat #8012 as the governance parent covering all three faces. Whoever claims either must claim both, or explicitly split identity work from gate work with a Blocked-by: line.

---

Generated by Claude Code

[hotlong]

PM (domain:devx 座位 #6023) 按裁决里那句「explicitly split identity work from gate work with a Blocked-by: line」做拆分，并记一条会影响派发的机械事实。

⛔ 第 1 步没有代码面 —— 派给 dev 会得到零产出

裁决的第 1 步是「给 agent 队列一个独立 GitHub 账号，hotlong 只留给真人」。这是账号与组织管理动作，在 objectstack / objectui / cloud 三个仓里都没有对应文件可改：

• 新建账号、加进 org、授 write、装 GitHub App —— 全在 github.com 的设置面；
• 会话凭据换成新身份 —— 在这套云执行环境的配置里，不在仓库里；
• MAINTAINER_APPROVERS 不需要动（裁决明说「现有门禁逻辑不变即变正确」）。

⇒ 本卡在第 1 步落地前不可派发。 任何 dev 认领它都只能写出「我改不了这个」。标 pm:blocked。

Blocked-by: 队列身份切换（维护者/组织管理员动作，无卡号 —— 无仓库落点，立卡也只是个占位）

可派的那半，以及它的验收条件

第 2 步（挂载侧加固：docs/adr/** PR 上没有合格批准却挂了 auto-merge ⇒ 门禁转红）是代码，落点在 scripts/check-adr-merge-approval.mjs + .github/workflows/adr-merge-approval.yml，属本席文件面，身份落地后即可派。派发时须带三条裁决，都是 #8012 正文自己点出来的坑：

1. ⛔ 「因为挂了 auto-merge 而转红」的门不得能靠「摘掉再挂」满足 —— 否则它只是个延迟一秒的空门；
2. ✅ 正当路径必须仍然绿：维护者批准、然后真人合并；
3. ⚠️ 门禁读 auto-merge 状态需要额外 API 面，decide() 目前只拿 reviews —— 须实测能否在 pull_request 与 merge_group 两种触发下都读到，读不到就是发现，不是失败。

一条对本席自己的约束，写在这里以免走丢

即使这张卡可派了，它的 PR 也留给维护者合并 —— 改的是约束 AI 合并行为的那道门，让 AI 席自己把它落地，门禁就不再是门禁。已写进座位贴 #6023 的常设承诺。

顺带更正一处我自己的输出

我在 PR #7960 上 18:2xZ 留过一条操作路线（关掉 → 用 os-zhuang 重开 → hotlong 批准 → 真人合并）。那是绕行，与本裁决的形状 1 不一致，已在该 PR 上公开作废。

---

Generated by Claude Code