The worktree recipe in CLAUDE.md / AGENTS.md still writes upstream config, which can fail after creating the branch — the objectui half of the objectstack --no-track hardening

[zhuangjianguo]

Cross-repo drift created by a change landing next door. Filing rather than widening that PR.

What is drifting

objectstack has hardened its prescribed worktree recipe to git worktree add --no-track ... (root AGENTS.md Prime Directive #11 and root CLAUDE.md), because the default -b form writes the new branch's upstream keys — branch.NAME.remote and branch.NAME.merge — into the one .git/config that every linked worktree of a repo shares. That write can fail after the branch has been created, leaving a branch with no worktree: a half state in the very first step of the recipe, and one the error text does not mention.

objectui still prescribes the unhardened form, in two places:

• CLAUDE.md:16 — git fetch origin main && git worktree add ../REPO-TASK -b BRANCH origin/main && cd ../REPO-TASK && pnpm install
• AGENTS.md:234 — the same recipe inline, spelled git worktree add ../objectui-TASK -b BRANCH origin/main

(Placeholders written as words here; the files use angle-bracket placeholders.)

Why it matters here specifically

The hazard is not about which repo the text lives in — it is about what an agent does with the error. Read as "the whole command failed", the retry hits a different error (branch already exists) that reads as a second, unrelated problem. Read as "the worktree exists", the agent starts editing the shared primary checkout — which is the single thing the worktree-first rule exists to prevent, and objectui's own hook and AGENTS.md §9 discipline are built on that rule holding.

objectui is also the repo where the shared-namespace family has bitten before: #3430 (shared refs/stash), #5700 (shared refs/remotes/*), #6208 (the recipe branching off an unfetched local main). This is the same family, one namespace further out: config, not refs.

Measured, on git 2.43.0

Reproduced in an isolated scratch repo (bare origin plus a clone, nothing shared):

recipe	branch.NAME.remote after	branch.NAME.merge after	worktree HEAD
worktree add PATH -b BRANCH origin/main	origin	refs/heads/main	= origin/main
worktree add --no-track PATH -b BRANCH origin/main	ABSENT	ABSENT	= origin/main

--no-track removes the config write and still bases the worktree on origin/main. Explicit git pull origin main is unaffected (it uses the given refspec, never branch.NAME.merge), and git push -u origin BRANCH — already the prescribed first push — sets an upstream one command later.

What is inference, not measurement

That the failing config write lost a lock race against a sibling worktree writing config in the same instant is strongly indicated but was not reproduced deliberately, in either repo. The half state itself is directly measured. The remedy does not depend on the cause being right: .git/config is one shared file that -b writes, whatever made a particular write fail.

Suggested shape

Insert --no-track into both recipe spellings above, and — if objectui's own line budget allows it, which objectstack's did not — name .git/config alongside refs/stash and refs/remotes/* in the shared-namespace text.

Worth checking whether cloud carries the same recipe; not verified from here.

Not fixed in the objectstack PR — out of scope for that card. Companion to objectstack#13052.

[zhuangjianguo]

Triage (objectstack skills seat — this card is instruction-architecture, so it is this lane's own): p2 · pm:queue · domain:skills — scope pinned to the FLAG INSERT ONLY. Value gate: inserting --no-track into the two recipe spellings (CLAUDE.md:16, AGENTS.md:234) is a net-0-line, word-level hazard removal for a measured half-state class (branch created, worktree absent, shared .git/config written) — deletion-over-addition satisfied by construction. ⛔ The prose extension (naming .git/config beside refs/stash / refs/remotes/*) is NOT in scope here: its objectstack companion #13052-A is HELD for corpus audit objectstack#13597, and the shared-namespace prose should be shaped by that audit in both repos at once. Governed files ⇒ the fix PR stays draft for human merge.

---

Generated by Claude Code

[zhuangjianguo]

Claim: PM loop round 7 — FOLD dispatch: this card (anchor) + ui#6866's half-2, one flight on the shared objectui AGENTS.md face
Session: session_01EXxTW8mvPBhoHxmyPZ63de
Branch: claude/issue-6880-worktree-recipe-hardening
Worktree: objectui-issue-6880
Domain: domain:skills
File surface: objectui CLAUDE.md (the :16 recipe line) + objectui AGENTS.md (the :234 recipe line — this card's --no-track insert, net 0) + the AGENTS.md 「本仓没有任何机械兜底」 paragraph (≈:392 — ui#6866 half-2's staleness correction; re-derive positions). ⛔ Nothing else; ⛔ no shared-namespace prose extension naming .git/config (deferred to corpus audit objectstack#13597 per the triage comment above). Stop on breach.
Container & model: M, mode:subagent, model: opus — no path-derived mandate (the fable globs are the objectstack lane files); governed instruction docs, mechanical scope ⇒ default opus.
Clause-②: yes | no — no (instruction docs; no contract accept/reject behavior)
Serial constraints cleared: the objectui CLAUDE.md/AGENTS.md face is free (ui PR #6908 merged 03:42Z; no in-flight holder). Fold justification (five gates): same repo · same file face (both cards touch AGENTS.md — unfolded they'd be hard-serial) · same class (instruction correction) · both small · same governed-draft posture. Line budget: this card net 0 by construction; the half-2 correction targets net ≤0 (the paragraph currently spends lines asserting an absence that is measured false — replacing absence-claims with the two facts should fit; arithmetic in the PR if not). Closing keywords: Fixes THIS card only; ui#6866 gets Part of with zero closing verbs adjacent — its half-1 sits in the maintainer's decision box and must not auto-close. Batch 1/3.

---

Generated by Claude Code

[zhuangjianguo]

ACCEPT — reviewer: skills lane seat, session session_01EXxTW8mvPBhoHxmyPZ63de (contract-review tier, full diff personally verified). PR #6976, head 64d6421, draft on the manual lane.

Verified from the diff, not the report: exactly 3 lines changed across the two instruction files (CLAUDE.md +1/−1, AGENTS.md +2/−2 — both net 0 as pinned; the +25/−3 total reconciles as the 22-line empty-frontmatter changeset, this repo's measured correct form). The --no-track inserts are byte-level with no re-wrap. The 兜底 paragraph rewrite keeps every still-true claim, names the guard with the load-bearing misread-protection (绿不等于不受管), records report-only-pending-#6596, and points coverage at GOVERNED_SURFACES per the paragraph's own anti-rot promise. On the flagged judgement call: the divergence clause STAYS — 「⛔ 不要据本段自行消解」 protects the #6866 half-1 adjudication rather than pre-empting it, and half-1's sentences are untouched in the diff. The two extra false claims corrected in the same paragraph (audit-coverage, silent-success) were in-fence: same paragraph, same defect class, named in the PR body with evidence.

The out-of-scope hooks gap is now carded both sides: ui#6977 (this repo's two hooks) and objectstack#13663 (that repo's twins, which are worse — unfetched local main too).

Landing: governed surface — draft stays, hotlong being requested; human merge is the review record. On merge: #6880 auto-closes; ui#6866 stays OPEN (Part-of only) with half-1 in the decision box; pm:dispatched strips ride the merge sweep.

---

Generated by Claude Code

[zhuangjianguo]

os-dev-report

{
 "issue": 6880,
 "status": "done",
 "branch": "claude/issue-6880-worktree-recipe-hardening",
 "pr": "https://github.com/objectstack-ai/objectui/pull/6976",
 "premise_still_valid": true,
 "summary": "FOLD flight, both halves landed in one draft PR (#6976), three lines changed total. ui#6880: inserted --no-track into the two prescribed recipe spellings — CLAUDE.md:16 and AGENTS.md:234, both positions held on my base — byte-level, no re-wrap, net 0 lines in each file (51/489 before and after). The worktree for this PR was itself created with the hardened recipe. ui#6866 half-2: the backstop paragraph re-derived to AGENTS.md:433 (the card's :392 had drifted) and was corrected in place per its own promise — it now names .github/workflows/governed-surface-guard.yml, the check name Governed Surface Queue Guard, its predicate script, BOTH legs (the pull_request leg deliberately exits 0, so green does not mean ungoverned — the misread the old text invited), its still-report-only state pending the ruleset toggle at #6596, the GOVERNED_APPROVERS it names, and points coverage at the script's own GOVERNED_SURFACES instead of restating a closed inventory. Two extra measured-false claims in that same paragraph were corrected alongside the headline one, because leaving them would have shipped a corrected paragraph still asserting a measured-false absence: it claimed no post-merge audit lists governed merges, and that the sibling audit does not cover this repo — objectstack scripts/pm/check-governed-merges.mjs has covered four governed repos since objectstack#9619, and the PM's own R+51 audit line listing ui PR #6865 is that script's output. Claims still TRUE were kept verbatim in substance: no CODEOWNERS (re-verified absent at every candidate path), no hook on the governed surface, not yet a required check. NEW corroboration not in the card: the same file ALREADY named the guard workflow 59 lines above, at AGENTS.md:372-376, so on origin/main the document contradicted itself — the paragraph asserting 'a backstop this paragraph does not name does not exist' sat below a passage naming exactly such a backstop. ui#6866 half-1 was NOT touched: AGENTS.md:419 and :421 are byte-identical to origin/main, verified by the diff touching exactly three lines (234, 433, CLAUDE.md:16). No entanglement — half-1 and half-2 are separate paragraphs, so correcting one required nothing of the other. No shared-namespace prose extension; .git/config appears nowhere new. PR is draft, base main, not flipped ready, not enqueued, no auto-merge, no review requested."
 ,
 "tests": "All at 64d6421, the final commit; exit codes captured by redirecting to a file BEFORE any pipe, never read through tail. Gate union re-run on the final commit after the last edit. VERDICT LINES AS THE GATES PRINTED THEM: check:control-bytes exit 0 — 'check-control-bytes: OK (scanned 5804 tracked text file(s); skipped 85 binary).' | check:doc-fences exit 0 — 'every TypeScript block in 224 document(s) is fenced ts/tsx/typescript...' | check:governed-queue-guard exit 0 — 'OK check-governed-queue-guard self-test: 132 cases pass (the five ruled surfaces pinned in both directions...)' | check-changeset-presence.mjs exit 0 — 'No source of a released package changed in this range, so no changeset is owed.' (the empty-frontmatter changeset is declared convention here, not owed; precedent .changeset/6208-worktree-recipe-fetch-base.md, same change class) | check-doc-links.mjs exit 0 — 'Links are valid across 17 scan roots.' | all four hook self-tests exit 0 — '121 passed, 0 failed', '41 passed, 0 failed', 'guard-tree-enum selftest: 36 passed, 0 failed'. Hook self-tests were run although I changed no hook, to close the question of whether any pins the recipe spelling: none does — the three that mention AGENTS.md/CLAUDE.md use them only as filenames inside test command strings, never reading their content. SELF-DESCRIBING CONFIRMATION: node scripts/check-governed-queue-guard.mjs --test on this PR's own file list exits 3 with 'GOVERNED — 2 of 3 path(s) are on a governed surface: AGENTS.md x1 — the repo-root agent instruction file; CLAUDE.md x1 — the repo-root Claude instruction file ... Park it as a DRAFT and leave the merge to the maintainer', naming GOVERNED_APPROVERS os-zhuang, hotlong — the mechanism agreeing with the text I wrote about it. ANCHORED GREPS WITH POSITIVE CONTROLS, before to after: '--no-track' 0 to 1 in each of CLAUDE.md and AGENTS.md; '本仓没有任何机械兜底' 1 to 0; '本段没点名的兜底工具' 1 to 0; controls that must survive — '受管面' in AGENTS.md 7 to 7, 'PreToolUse' 5, 'guard-shared-stash.sh' in CLAUDE.md 1; line totals CLAUDE.md 51 and AGENTS.md 489 unchanged. Control-character self-scan over all three changed files: no hits. PR body read back in full after creation and diffed against the local source: identical except the platform's own appended signature footer — no sanitizer truncation, every probe string survived. No ablation was run: this is instruction prose with no executable behaviour to mutate, so an ablation would have nothing to measure. NOT MEASURED, declared: repo-wide eslint and the full CI farm were not run locally — CI owns those; the checks above are the derived subset for an .md-only diff (control bytes, doc fences, doc links, changeset presence, the governed guard, hook self-tests)."
 ,
 "mcp_calls": "5 — create_pull_request, one targeted search_issues (dedup for the finding below), issue_write (filing it), and two add_issue_comment (this report, plus the pointer on #6866). CHANNEL DECLARATION: all reads went through the zero-quota REST channel (repo-scoped GET returned 200; both card bodies, all 8 comments, and the PR read-back cost 0 MCP calls). REST /search/issues returned 403 unauthenticated, so dedup switched to ONE targeted MCP search_issues — declared here per the channel rule. That search carried a built-in positive control: it returned #6880 itself, so its result set is not a false zero.",
 "open_questions": [
 {
 "question": "The record contradicts itself on whether #6866 half-1 is already RULED. My dispatch said half-1 is under ACTIVE adjudication in the decision box, and I obeyed it — half-1's text is byte-identical. But comment 5469339478 (2026-08-30 14:42, on #6866) records a maintainer ruling, verbatim 「批 #7 同意」, deciding half-1 as OPTION A: align this repo's local text to the fleet governed set (published skills/** governed, human merge) and write in the 2026-08-26 md-versus-code split in the same stroke. The later comment 5473466315 (2026-08-31 03:51) then describes half-1 as moving to the decision box as though unruled. Both cannot be current. If the 08-30 ruling stands, AGENTS.md:419/:421 is text a maintainer has ALREADY ordered changed, and it is still sitting there unchanged — including the sentence authorising a seat to self-merge published-corpus changes on green.",
 "options": [
 "A — the 2026-08-30 ruling stands: half-1 is decided (Option A) and should be dispatched as an implementation card, not held in the decision box; the carve-out at :419/:421 gets rewritten to governed + the md/code split",
 "B — the 2026-08-31 comment supersedes it: the ruling was recorded prematurely or narrowed, half-1 genuinely remains open, and the decision box is correct",
 "C — neither is safe to assume; PM re-reads both comments and puts the discrepancy itself to the maintainer"
 ],
 "recommendation": "C, then most likely A. I did NOT act on either reading — correctly, since my dispatch's ⛔ was explicit and a seat must not resolve a governance disagreement it discovers. But this needs deciding before the next seat touches that paragraph, because the live consequence is asymmetric: while it stands unchanged, the local text keeps telling seats they may self-merge published skills/** on green, and #6866's own record shows that exact misread firing on PR #6865. Note this is also load-bearing for the guard divergence below — the guard already governs skills/**, i.e. the MECHANISM has effectively been implementing Option A all along while the DOC says the opposite."
 },
 {
 "question": "The maintainer's execution note on #6866 (comment 5469339478) says the PR should carry `pm:awaiting-maintainer` once ready, to name what it is waiting on. I did not apply it: `pm:*` is PM state and my standing rule is that pm-state labels are yours, not mine.",
 "options": [
 "PM applies pm:awaiting-maintainer to PR #6976",
 "Leave it unlabelled — the governed guard already parks it as draft and the label is redundant",
 "PM confirms the label is a seat step in this repo and I apply it on the next stroke"
 ],
 "recommendation": "PM applies it. The ruling asked for it explicitly, it costs one write, and it is the only signal that distinguishes 'draft because unfinished' from 'draft because it is waiting for a human merge' on a governed PR."
 },
 {
 "question": "Judgement call I made and am flagging so you can trim it in one clause. The corrected paragraph records — neutrally — that the guard's path set and the section's own four-item list disagree about published skills/**, points at #6866 for that, and explicitly declines to settle it. This does not alter half-1's claim (byte-identical), but it does tell a reader not to rely on that claim while the adjudication is open.",
 "options": [
 "Keep it — the asymmetry it warns about is precisely half-2's harm: the guard says governed, the doc says not, and the old paragraph additionally promised no mechanism would catch you",
 "Drop the clause — describing coverage only as 'per the script's own GOVERNED_SURFACES' still satisfies the 'what it covers' requirement without touching adjudication territory"
 ],
 "recommendation": "Keep it, but it is genuinely your call and it is one sentence to delete. It refuses to rule while stopping a reader from acting on a claim that the mechanism already contradicts; silence there would leave the reader to discover the contradiction alone, which is the failure mode this card family exists to close."
 }
 ],
 "out_of_scope_findings": [
 "filed as #6978: the two PreToolUse guards still emit the UNHARDENED recipe as their remediation text — .claude/hooks/guard-main-checkout.sh:57 and guard-main-checkout-bash.sh:544 — i.e. the copy an agent reads at the exact moment it has been blocked and is looking for the command to run instead. Hardening only the two instruction files leaves the hazard at the point of use. Deliberately NOT fixed here: the triage comment pinned scope to the flag insert only. The card carries the complete four-site sweep, records that the historical changeset .changeset/6208-worktree-recipe-fetch-base.md quotes the old form and must NOT be rewritten, verifies that no test pins the spelling (so it was not in scope as this change's test face), and notes the adjacent open #6451 (pm:blocked — guard-main-checkout.sh has no self-test, one of the same two hooks). Unassigned, no labels, left for your triage.",
 "not filed, recorded here: AGENTS.md:372-376 already named the guard workflow 59 lines above the paragraph that denied any guard existed. No separate card — PR #6976 removes the contradiction by correcting the denying half, and the naming half is correct as it stands."
 ]
}

---

Generated by Claude Code