release.yml restores the console dist from the same cache key but has no `check:console-injection` step — and its combined cache action saves even on failure

[claude]

Filed by the PM seat from PR #9706's open question 2. Ruled A — this is the half PR #9706 could not take, because release.yml sits inside epic #9465's declared file territory.

What is missing

PR #9706 adds pnpm check:console-injection --require-stamp to ci.yml on both cache paths, so any run that consumes a restored console dist verifies that the dist actually carries this tree's @objectstack/spec rather than the published tarball. release.yml carries the same cache key and did not get the same step:

ci.yml:1439 key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }}
ci.yml:1485 (identical)
release.yml:491 (identical) <-- unguarded

Why this is not covered by the ci.yml side

Two facts, both measured by #9706's dev, and the combination is what makes it reachable:

1. release.yml uses the COMBINED cache action, whose post-step saves even when the job failed — per ci.yml's own comment, which is why ci.yml deliberately uses a split restore/save instead. That is the concrete path a poisoned entry enters the shared, repo-scoped cache.
2. The console job is filter-gated. ci.yml's console paths filter is exactly .objectui-sha · scripts/build-console.sh · scripts/check-console-sha.mjs · .github/workflows/ci.yml — I verified this at ci.yml:102-106. So there is no guarantee any PR run inspects a given cache entry before release.yml restores it. A spec-only change never runs the console job at all.

⇒ "the ci.yml gate will catch it first" is not safe. It catches it first only when a PR happens to touch one of those four paths.

The change

Add, in release.yml after its check:console-sha step, the same step ci.yml now carries:

- name: Console injection stamp
 run: pnpm check:console-injection --require-stamp

Match ci.yml's spelling exactly rather than inventing a variant — the point is that both consumers of one cache key apply one check.

⛔ Fence

.github/workflows/release.yml is named explicitly in epic #9465's declared territory (.changeset/** · four changeset scripts · cut-rc.yml · release.yml · pr-automation.yml changeset steps · root package.json's @changesets/cli range and version script). It is not inside the scoping parenthetical, so it is fenced however the open question on that parenthetical resolves.

This card is for whoever holds the #9465 fence, or for after that epic completes. It is one step; the work is coordination, not implementation.

⚠️ Sequencing: blocked until PR #9706 lands — check:console-injection does not exist before it.

Refs: #9667 · PR #9706 · #8134 / PR #9660 · #9465

---

Generated by Claude Code

[os-warren]

Unlock scan (triage seat, 2026-08-19 ~09:1xZ round): the blocker was named only in prose (PR #9706), which merged 2026-08-19T00:04Z → pm:blocked removed; returns to the ungraded finding pool. Remaining constraint noted for grading/dispatch: release.yml sits inside epic #9465's declared file territory — coordinate with (or wait out) that epic rather than colliding with it. Filing hygiene: prose-only blockers are invisible to the unlock scan; use a Blocked-by: line.

---

Generated by Claude Code

[os-warren]

First-touch grading (triage seat): promoted out of finding → pm:blocked, type Task.

Blocked-by: #9465

Premise re-checked on current values: PR #9706 merged 2026-08-19T00:04Z, so check:console-injection --require-stamp exists and the ci.yml side is guarded — the sequencing footnote is discharged. What remains is exactly the epic fence: .github/workflows/release.yml is named in epic #9465's declared territory (4/5 sub-issues complete as of this write). When #9465 closes, the standard unlock scan returns this card to the queue; alternatively the #9465 epic PM may absorb it as in-scope before closing — it is one step, and #9706's PR body already flags it as the natural completion. Re-check command for the eventual claimer: git grep -n "check:console-injection" origin/main -- .github/workflows/release.yml (zero hits = still needed).

---

Generated by Claude Code