docs(agents): record that seats cannot delete remote branches (proxy 403, false Everything-up-to-date receipt)

[os-litant]

Fixes#6756

One knowledge line in AGENTS.md, per triage grading comment 5460872090. No code, no branch touched.

落点

AGENTS.md, section ### 多 agent 协作纪律(并行修改本仓库,务必遵守) under ## 9. Operational Rules — inserted as line 276, directly after the 绝不 git push --force / 绝不推 main bullet. That neighbour is the closest kin: both are "what a seat's push may and may not do against the shared remote", and the card itself cites the force-push ban (#5239) and the shared refs/stash fact (#3430) as its own family. ⛔ Deliberately not a new file — triage ruled the home is this section.

before

The section had no line at all about ref deletion. A seat that tried to delete its own probe branch had to rediscover the refusal by attempting it; the card records one dev seat spending four attempts doing exactly that.

after

One bullet (one physical line, matching the section's unwrapped-bullet format). It carries five things, all required by the ruling:

1. The fact — a seat can push a branch but cannot delete a remote ref; the agent proxy refuses every ref-deletion push with error: RPC failed; HTTP 403. No bypass: the GitHub MCP tool surface has create_branch with no delete counterpart, and there is no gh CLI in the container.
2. The false-success receipt, verbatim — after the 403, git prints Everything up-to-date. Triage called this the most valuable sentence on the card, above the 403 itself, and the reason is in the line: a caller that reads only the tail of the output, or treats a non-empty last line as success, reads a refused deletion as a completed one. Knowing it 403s does not protect you from that.
3. The claim-signal consequence (from comment 5468280978) — the cost is not tidiness. An orphan sibling branch left by a rename-and-retry on one card is invisible from every surface a seat normally reads: not on the card, not in the PR list, not in any queue view. Only a per-card prefix glob shows it, and the line carries that command. The measured near-miss on card 4934 read for a moment as a second seat working the same card concurrently — the one thing the claim discipline exists to prevent.
4. The four unmeasured points kept unmeasured, marked as such in the line itself: which layer returns the 403 (proxy policy / token scope / branch protection), whether other seats or environments can delete, whether tags are restricted the same way, and how many stale claude/* branches exist. ⛔ None was converted into an assertion.
5. An explicit non-authorization — the line records a capability gap and authorizes no branch cleanup, no census, and no lifecycle policy. Those are the maintainer's.

In the line, the card number inside the glob is written as this repo's usual angle-bracket placeholder, matching the neighbouring bullets' own placeholder style (the objectui-TASK worktree path and the PATHS argument in the stash-alternative recipes). Spelled as placeholder words here on purpose — see the sanitizer note below.

Measured, not assumed

• No line ratchet over AGENTS.md. The dispatch flagged this as an assumption to test. Verified: nothing under scripts/ computes a line budget or ratchet over this file, so the new line owes no compensating deletion. What does exist and was NOT anticipated: scripts/check-governed-queue-guard.mjs (governed-surface, AGENTS.md is row agents-md) and scripts/check-shell-escape-residue.mjs (scans this file's fences). Both are content/policy gates, not size gates.
• The gate union was derived, not guessed.scripts/check-shell-escape-residue.mjs's own header documents the derived union for a change to AGENTS.md; the governed-surface guard was added to it later by Machine-enforce human review on governed-surface paths — so the no-bypass rule stops resting on seat discipline alone #6596.
• No changeset is owed, and that is the gate's own verdict rather than my reading: check-changeset-presence reports 0 of them published source of a package the release covers for this diff. ⛔ No label was requested — objectui has no skip-changeset mechanism.
• The bullet was written with the Write tool, not a shell heredoc.scripts/check-shell-escape-residue.mjs exists because a git commit -F - example in this very section shipped with its heredoc terminator wrapped in a shell escape run (AGENTS.md §9 的 git commit -F - 示例带着 shell 转义残留落地(<<'\"'\"'EOF'\"'\"'),照抄得到一条不会终止的 heredoc #5150). Repeating that mechanism to author a line in the same section seemed like a poor idea.
• The GitHub body sanitizer ate two placeholder fragments from the first version of this description — the angle-bracket spellings were removed even inside backticks, leaving an empty pair of backticks. Caught by reading the stored body back after creating the PR; this revision spells them as words. The file itself is unaffected: the sanitizer touches GitHub bodies, not the committed diff.

Gates run — all on head e362056

gate	exit	verdict line
check-control-bytes	0	✅ OK (scanned 5996 tracked text file(s); skipped 85 binary).
check-doc-links	0	Links are valid across 17 scan roots.
check-changeset-presence	0	✅ No source or published contract of a released package changed in this range, so no changeset is owed.
check-changeset-no-major	0	✅ No changeset declares a major bump.
check-shell-escape-residue	0	✅ OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ... 0 occurrence(s) outside a fence)
check-governed-queue-guard --self-test	0	OK ... 132 cases pass
check-governed-queue-guard --test AGENTS.md	3	One governed path governs the WHOLE pull request

Exit codes captured by redirecting to a file first, then reading $? — never through a pipe.

⛔ This PR STAYS DRAFT

The exit 3 above is the correct verdict, not a red gate. AGENTS.md is a governed surface, and the guard states the disposition itself:

⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the merge to the maintainer; a human merge IS the review record for a governed surface.

⛔ Not marking ready, not enqueueing, not arming auto-merge. The merge is the maintainer's.

Note on the one body edit above: governed-surface-guard.yml's header records that on PR #6183 an MCP update_pull_request call passing only reviewers silently set draft: false, and the PR entered the queue and landed unreviewed. The revision was therefore sent with draft: true passed explicitly, and the stored state read back afterwards to confirm it is still a draft.

Out of scope, untouched

claude/probe-6716a-writecheck is still there. Deleting it needs someone with a working delete path — which, per the line this PR adds, is not this seat. Triage already routed it to the maintainer.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[os-litant]

Fixes#6756

One knowledge line in AGENTS.md, per triage grading comment 5460872090. No code, no branch touched.

落点

AGENTS.md, section ### 多 agent 协作纪律(并行修改本仓库,务必遵守) under ## 9. Operational Rules — inserted as line 276, directly after the 绝不 git push --force / 绝不推 main bullet. That neighbour is the closest kin: both are "what a seat's push may and may not do against the shared remote", and the card itself cites the force-push ban (#5239) and the shared refs/stash fact (#3430) as its own family. ⛔ Deliberately not a new file — triage ruled the home is this section.

before

The section had no line at all about ref deletion. A seat that tried to delete its own probe branch had to rediscover the refusal by attempting it; the card records one dev seat spending four attempts doing exactly that.

after

One bullet (one physical line, matching the section's unwrapped-bullet format). It carries five things, all required by the ruling:

1. The fact — a seat can push a branch but cannot delete a remote ref; the agent proxy refuses every ref-deletion push with error: RPC failed; HTTP 403. No bypass: the GitHub MCP tool surface has create_branch with no delete counterpart, and there is no gh CLI in the container.
2. The false-success receipt, verbatim — after the 403, git prints Everything up-to-date. Triage called this the most valuable sentence on the card, above the 403 itself, and the reason is in the line: a caller that reads only the tail of the output, or treats a non-empty last line as success, reads a refused deletion as a completed one. Knowing it 403s does not protect you from that.
3. The claim-signal consequence (from comment 5468280978) — the cost is not tidiness. An orphan sibling branch left by a rename-and-retry on one card is invisible from every surface a seat normally reads: not on the card, not in the PR list, not in any queue view. Only a per-card prefix glob shows it, and the line carries that command. The measured near-miss on card 4934 read for a moment as a second seat working the same card concurrently — the one thing the claim discipline exists to prevent.
4. The four unmeasured points kept unmeasured, marked as such in the line itself: which layer returns the 403 (proxy policy / token scope / branch protection), whether other seats or environments can delete, whether tags are restricted the same way, and how many stale claude/* branches exist. ⛔ None was converted into an assertion.
5. An explicit non-authorization — the line records a capability gap and authorizes no branch cleanup, no census, and no lifecycle policy. Those are the maintainer's.

In the line, the card number inside the glob is written as this repo's usual angle-bracket placeholder, matching the neighbouring bullets' own placeholder style (the objectui-TASK worktree path and the PATHS argument in the stash-alternative recipes). Spelled as placeholder words here on purpose — see the sanitizer note below.

Measured, not assumed

• No line ratchet over AGENTS.md. The dispatch flagged this as an assumption to test. Verified: nothing under scripts/ computes a line budget or ratchet over this file, so the new line owes no compensating deletion. What does exist and was NOT anticipated: scripts/check-governed-queue-guard.mjs (governed-surface, AGENTS.md is row agents-md) and scripts/check-shell-escape-residue.mjs (scans this file's fences). Both are content/policy gates, not size gates.
• The gate union was derived, not guessed.scripts/check-shell-escape-residue.mjs's own header documents the derived union for a change to AGENTS.md; the governed-surface guard was added to it later by Machine-enforce human review on governed-surface paths — so the no-bypass rule stops resting on seat discipline alone #6596.
• No changeset is owed, and that is the gate's own verdict rather than my reading: check-changeset-presence reports 0 of them published source of a package the release covers for this diff. ⛔ No label was requested — objectui has no skip-changeset mechanism.
• The bullet was written with the Write tool, not a shell heredoc.scripts/check-shell-escape-residue.mjs exists because a git commit -F - example in this very section shipped with its heredoc terminator wrapped in a shell escape run (AGENTS.md §9 的 git commit -F - 示例带着 shell 转义残留落地(<<'\"'\"'EOF'\"'\"'),照抄得到一条不会终止的 heredoc #5150). Repeating that mechanism to author a line in the same section seemed like a poor idea.
• The GitHub body sanitizer ate two placeholder fragments from the first version of this description — the angle-bracket spellings were removed even inside backticks, leaving an empty pair of backticks. Caught by reading the stored body back after creating the PR; this revision spells them as words. The file itself is unaffected: the sanitizer touches GitHub bodies, not the committed diff.

Gates run — all on head e362056

gate	exit	verdict line
check-control-bytes	0	✅ OK (scanned 5996 tracked text file(s); skipped 85 binary).
check-doc-links	0	Links are valid across 17 scan roots.
check-changeset-presence	0	✅ No source or published contract of a released package changed in this range, so no changeset is owed.
check-changeset-no-major	0	✅ No changeset declares a major bump.
check-shell-escape-residue	0	✅ OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ... 0 occurrence(s) outside a fence)
check-governed-queue-guard --self-test	0	OK ... 132 cases pass
check-governed-queue-guard --test AGENTS.md	3	One governed path governs the WHOLE pull request

Exit codes captured by redirecting to a file first, then reading $? — never through a pipe.

⛔ This PR STAYS DRAFT

The exit 3 above is the correct verdict, not a red gate. AGENTS.md is a governed surface, and the guard states the disposition itself:

⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the merge to the maintainer; a human merge IS the review record for a governed surface.

⛔ Not marking ready, not enqueueing, not arming auto-merge. The merge is the maintainer's.

Note on the one body edit above: governed-surface-guard.yml's header records that on PR #6183 an MCP update_pull_request call passing only reviewers silently set draft: false, and the PR entered the queue and landed unreviewed. The revision was therefore sent with draft: true passed explicitly, and the stored state read back afterwards to confirm it is still a draft.

Out of scope, untouched

claude/probe-6716a-writecheck is still there. Deleting it needs someone with a working delete path — which, per the line this PR adds, is not this seat. Triage already routed it to the maintainer.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[os-litant]

Fixes#6756

One knowledge line in AGENTS.md, per triage grading comment 5460872090. No code, no branch touched.

落点

AGENTS.md, section ### 多 agent 协作纪律(并行修改本仓库,务必遵守) under ## 9. Operational Rules — inserted as line 276, directly after the 绝不 git push --force / 绝不推 main bullet. That neighbour is the closest kin: both are "what a seat's push may and may not do against the shared remote", and the card itself cites the force-push ban (#5239) and the shared refs/stash fact (#3430) as its own family. ⛔ Deliberately not a new file — triage ruled the home is this section.

before

The section had no line at all about ref deletion. A seat that tried to delete its own probe branch had to rediscover the refusal by attempting it; the card records one dev seat spending four attempts doing exactly that.

after

One bullet (one physical line, matching the section's unwrapped-bullet format). It carries five things, all required by the ruling:

1. The fact — a seat can push a branch but cannot delete a remote ref; the agent proxy refuses every ref-deletion push with error: RPC failed; HTTP 403. No bypass: the GitHub MCP tool surface has create_branch with no delete counterpart, and there is no gh CLI in the container.
2. The false-success receipt, verbatim — after the 403, git prints Everything up-to-date. Triage called this the most valuable sentence on the card, above the 403 itself, and the reason is in the line: a caller that reads only the tail of the output, or treats a non-empty last line as success, reads a refused deletion as a completed one. Knowing it 403s does not protect you from that.
3. The claim-signal consequence (from comment 5468280978) — the cost is not tidiness. An orphan sibling branch left by a rename-and-retry on one card is invisible from every surface a seat normally reads: not on the card, not in the PR list, not in any queue view. Only a per-card prefix glob shows it, and the line carries that command. The measured near-miss on card 4934 read for a moment as a second seat working the same card concurrently — the one thing the claim discipline exists to prevent.
4. The four unmeasured points kept unmeasured, marked as such in the line itself: which layer returns the 403 (proxy policy / token scope / branch protection), whether other seats or environments can delete, whether tags are restricted the same way, and how many stale claude/* branches exist. ⛔ None was converted into an assertion.
5. An explicit non-authorization — the line records a capability gap and authorizes no branch cleanup, no census, and no lifecycle policy. Those are the maintainer's.

In the line, the card number inside the glob is written as this repo's usual angle-bracket placeholder, matching the neighbouring bullets' own placeholder style (the objectui-TASK worktree path and the PATHS argument in the stash-alternative recipes). Spelled as placeholder words here on purpose — see the sanitizer note below.

Measured, not assumed

• No line ratchet over AGENTS.md. The dispatch flagged this as an assumption to test. Verified: nothing under scripts/ computes a line budget or ratchet over this file, so the new line owes no compensating deletion. What does exist and was NOT anticipated: scripts/check-governed-queue-guard.mjs (governed-surface, AGENTS.md is row agents-md) and scripts/check-shell-escape-residue.mjs (scans this file's fences). Both are content/policy gates, not size gates.
• The gate union was derived, not guessed.scripts/check-shell-escape-residue.mjs's own header documents the derived union for a change to AGENTS.md; the governed-surface guard was added to it later by Machine-enforce human review on governed-surface paths — so the no-bypass rule stops resting on seat discipline alone #6596.
• No changeset is owed, and that is the gate's own verdict rather than my reading: check-changeset-presence reports 0 of them published source of a package the release covers for this diff. ⛔ No label was requested — objectui has no skip-changeset mechanism.
• The bullet was written with the Write tool, not a shell heredoc.scripts/check-shell-escape-residue.mjs exists because a git commit -F - example in this very section shipped with its heredoc terminator wrapped in a shell escape run (AGENTS.md §9 的 git commit -F - 示例带着 shell 转义残留落地(<<'\"'\"'EOF'\"'\"'),照抄得到一条不会终止的 heredoc #5150). Repeating that mechanism to author a line in the same section seemed like a poor idea.
• The GitHub body sanitizer ate two placeholder fragments from the first version of this description — the angle-bracket spellings were removed even inside backticks, leaving an empty pair of backticks. Caught by reading the stored body back after creating the PR; this revision spells them as words. The file itself is unaffected: the sanitizer touches GitHub bodies, not the committed diff.

Gates run — all on head e362056

gate	exit	verdict line
check-control-bytes	0	✅ OK (scanned 5996 tracked text file(s); skipped 85 binary).
check-doc-links	0	Links are valid across 17 scan roots.
check-changeset-presence	0	✅ No source or published contract of a released package changed in this range, so no changeset is owed.
check-changeset-no-major	0	✅ No changeset declares a major bump.
check-shell-escape-residue	0	✅ OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ... 0 occurrence(s) outside a fence)
check-governed-queue-guard --self-test	0	OK ... 132 cases pass
check-governed-queue-guard --test AGENTS.md	3	One governed path governs the WHOLE pull request

Exit codes captured by redirecting to a file first, then reading $? — never through a pipe.

⛔ This PR STAYS DRAFT

The exit 3 above is the correct verdict, not a red gate. AGENTS.md is a governed surface, and the guard states the disposition itself:

⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the merge to the maintainer; a human merge IS the review record for a governed surface.

⛔ Not marking ready, not enqueueing, not arming auto-merge. The merge is the maintainer's.

Note on the one body edit above: governed-surface-guard.yml's header records that on PR #6183 an MCP update_pull_request call passing only reviewers silently set draft: false, and the PR entered the queue and landed unreviewed. The revision was therefore sent with draft: true passed explicitly, and the stored state read back afterwards to confirm it is still a draft.

Out of scope, untouched

claude/probe-6716a-writecheck is still there. Deleting it needs someone with a working delete path — which, per the line this PR adds, is not this seat. Triage already routed it to the maintainer.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[os-litant]

Fixes#6756

One knowledge line in AGENTS.md, per triage grading comment 5460872090. No code, no branch touched.

落点

AGENTS.md, section ### 多 agent 协作纪律(并行修改本仓库,务必遵守) under ## 9. Operational Rules — inserted as line 276, directly after the 绝不 git push --force / 绝不推 main bullet. That neighbour is the closest kin: both are "what a seat's push may and may not do against the shared remote", and the card itself cites the force-push ban (#5239) and the shared refs/stash fact (#3430) as its own family. ⛔ Deliberately not a new file — triage ruled the home is this section.

before

The section had no line at all about ref deletion. A seat that tried to delete its own probe branch had to rediscover the refusal by attempting it; the card records one dev seat spending four attempts doing exactly that.

after

One bullet (one physical line, matching the section's unwrapped-bullet format). It carries five things, all required by the ruling:

1. The fact — a seat can push a branch but cannot delete a remote ref; the agent proxy refuses every ref-deletion push with error: RPC failed; HTTP 403. No bypass: the GitHub MCP tool surface has create_branch with no delete counterpart, and there is no gh CLI in the container.
2. The false-success receipt, verbatim — after the 403, git prints Everything up-to-date. Triage called this the most valuable sentence on the card, above the 403 itself, and the reason is in the line: a caller that reads only the tail of the output, or treats a non-empty last line as success, reads a refused deletion as a completed one. Knowing it 403s does not protect you from that.
3. The claim-signal consequence (from comment 5468280978) — the cost is not tidiness. An orphan sibling branch left by a rename-and-retry on one card is invisible from every surface a seat normally reads: not on the card, not in the PR list, not in any queue view. Only a per-card prefix glob shows it, and the line carries that command. The measured near-miss on card 4934 read for a moment as a second seat working the same card concurrently — the one thing the claim discipline exists to prevent.
4. The four unmeasured points kept unmeasured, marked as such in the line itself: which layer returns the 403 (proxy policy / token scope / branch protection), whether other seats or environments can delete, whether tags are restricted the same way, and how many stale claude/* branches exist. ⛔ None was converted into an assertion.
5. An explicit non-authorization — the line records a capability gap and authorizes no branch cleanup, no census, and no lifecycle policy. Those are the maintainer's.

In the line, the card number inside the glob is written as this repo's usual angle-bracket placeholder, matching the neighbouring bullets' own placeholder style (the objectui-TASK worktree path and the PATHS argument in the stash-alternative recipes). Spelled as placeholder words here on purpose — see the sanitizer note below.

Measured, not assumed

• No line ratchet over AGENTS.md. The dispatch flagged this as an assumption to test. Verified: nothing under scripts/ computes a line budget or ratchet over this file, so the new line owes no compensating deletion. What does exist and was NOT anticipated: scripts/check-governed-queue-guard.mjs (governed-surface, AGENTS.md is row agents-md) and scripts/check-shell-escape-residue.mjs (scans this file's fences). Both are content/policy gates, not size gates.
• The gate union was derived, not guessed.scripts/check-shell-escape-residue.mjs's own header documents the derived union for a change to AGENTS.md; the governed-surface guard was added to it later by Machine-enforce human review on governed-surface paths — so the no-bypass rule stops resting on seat discipline alone #6596.
• No changeset is owed, and that is the gate's own verdict rather than my reading: check-changeset-presence reports 0 of them published source of a package the release covers for this diff. ⛔ No label was requested — objectui has no skip-changeset mechanism.
• The bullet was written with the Write tool, not a shell heredoc.scripts/check-shell-escape-residue.mjs exists because a git commit -F - example in this very section shipped with its heredoc terminator wrapped in a shell escape run (AGENTS.md §9 的 git commit -F - 示例带着 shell 转义残留落地(<<'\"'\"'EOF'\"'\"'),照抄得到一条不会终止的 heredoc #5150). Repeating that mechanism to author a line in the same section seemed like a poor idea.
• The GitHub body sanitizer ate two placeholder fragments from the first version of this description — the angle-bracket spellings were removed even inside backticks, leaving an empty pair of backticks. Caught by reading the stored body back after creating the PR; this revision spells them as words. The file itself is unaffected: the sanitizer touches GitHub bodies, not the committed diff.

Gates run — all on head e362056

gate	exit	verdict line
check-control-bytes	0	✅ OK (scanned 5996 tracked text file(s); skipped 85 binary).
check-doc-links	0	Links are valid across 17 scan roots.
check-changeset-presence	0	✅ No source or published contract of a released package changed in this range, so no changeset is owed.
check-changeset-no-major	0	✅ No changeset declares a major bump.
check-shell-escape-residue	0	✅ OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ... 0 occurrence(s) outside a fence)
check-governed-queue-guard --self-test	0	OK ... 132 cases pass
check-governed-queue-guard --test AGENTS.md	3	One governed path governs the WHOLE pull request

Exit codes captured by redirecting to a file first, then reading $? — never through a pipe.

⛔ This PR STAYS DRAFT

The exit 3 above is the correct verdict, not a red gate. AGENTS.md is a governed surface, and the guard states the disposition itself:

⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the merge to the maintainer; a human merge IS the review record for a governed surface.

⛔ Not marking ready, not enqueueing, not arming auto-merge. The merge is the maintainer's.

Note on the one body edit above: governed-surface-guard.yml's header records that on PR #6183 an MCP update_pull_request call passing only reviewers silently set draft: false, and the PR entered the queue and landed unreviewed. The revision was therefore sent with draft: true passed explicitly, and the stored state read back afterwards to confirm it is still a draft.

Out of scope, untouched

claude/probe-6716a-writecheck is still there. Deleting it needs someone with a working delete path — which, per the line this PR adds, is not this seat. Triage already routed it to the maintainer.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[os-litant]

Fixes#6756

One knowledge line in AGENTS.md, per triage grading comment 5460872090. No code, no branch touched.

落点

AGENTS.md, section ### 多 agent 协作纪律(并行修改本仓库,务必遵守) under ## 9. Operational Rules — inserted as line 276, directly after the 绝不 git push --force / 绝不推 main bullet. That neighbour is the closest kin: both are "what a seat's push may and may not do against the shared remote", and the card itself cites the force-push ban (#5239) and the shared refs/stash fact (#3430) as its own family. ⛔ Deliberately not a new file — triage ruled the home is this section.

before

The section had no line at all about ref deletion. A seat that tried to delete its own probe branch had to rediscover the refusal by attempting it; the card records one dev seat spending four attempts doing exactly that.

after

One bullet (one physical line, matching the section's unwrapped-bullet format). It carries five things, all required by the ruling:

1. The fact — a seat can push a branch but cannot delete a remote ref; the agent proxy refuses every ref-deletion push with error: RPC failed; HTTP 403. No bypass: the GitHub MCP tool surface has create_branch with no delete counterpart, and there is no gh CLI in the container.
2. The false-success receipt, verbatim — after the 403, git prints Everything up-to-date. Triage called this the most valuable sentence on the card, above the 403 itself, and the reason is in the line: a caller that reads only the tail of the output, or treats a non-empty last line as success, reads a refused deletion as a completed one. Knowing it 403s does not protect you from that.
3. The claim-signal consequence (from comment 5468280978) — the cost is not tidiness. An orphan sibling branch left by a rename-and-retry on one card is invisible from every surface a seat normally reads: not on the card, not in the PR list, not in any queue view. Only a per-card prefix glob shows it, and the line carries that command. The measured near-miss on card 4934 read for a moment as a second seat working the same card concurrently — the one thing the claim discipline exists to prevent.
4. The four unmeasured points kept unmeasured, marked as such in the line itself: which layer returns the 403 (proxy policy / token scope / branch protection), whether other seats or environments can delete, whether tags are restricted the same way, and how many stale claude/* branches exist. ⛔ None was converted into an assertion.
5. An explicit non-authorization — the line records a capability gap and authorizes no branch cleanup, no census, and no lifecycle policy. Those are the maintainer's.

In the line, the card number inside the glob is written as this repo's usual angle-bracket placeholder, matching the neighbouring bullets' own placeholder style (the objectui-TASK worktree path and the PATHS argument in the stash-alternative recipes). Spelled as placeholder words here on purpose — see the sanitizer note below.

Measured, not assumed

• No line ratchet over AGENTS.md. The dispatch flagged this as an assumption to test. Verified: nothing under scripts/ computes a line budget or ratchet over this file, so the new line owes no compensating deletion. What does exist and was NOT anticipated: scripts/check-governed-queue-guard.mjs (governed-surface, AGENTS.md is row agents-md) and scripts/check-shell-escape-residue.mjs (scans this file's fences). Both are content/policy gates, not size gates.
• The gate union was derived, not guessed.scripts/check-shell-escape-residue.mjs's own header documents the derived union for a change to AGENTS.md; the governed-surface guard was added to it later by Machine-enforce human review on governed-surface paths — so the no-bypass rule stops resting on seat discipline alone #6596.
• No changeset is owed, and that is the gate's own verdict rather than my reading: check-changeset-presence reports 0 of them published source of a package the release covers for this diff. ⛔ No label was requested — objectui has no skip-changeset mechanism.
• The bullet was written with the Write tool, not a shell heredoc.scripts/check-shell-escape-residue.mjs exists because a git commit -F - example in this very section shipped with its heredoc terminator wrapped in a shell escape run (AGENTS.md §9 的 git commit -F - 示例带着 shell 转义残留落地(<<'\"'\"'EOF'\"'\"'),照抄得到一条不会终止的 heredoc #5150). Repeating that mechanism to author a line in the same section seemed like a poor idea.
• The GitHub body sanitizer ate two placeholder fragments from the first version of this description — the angle-bracket spellings were removed even inside backticks, leaving an empty pair of backticks. Caught by reading the stored body back after creating the PR; this revision spells them as words. The file itself is unaffected: the sanitizer touches GitHub bodies, not the committed diff.

Gates run — all on head e362056

gate	exit	verdict line
check-control-bytes	0	✅ OK (scanned 5996 tracked text file(s); skipped 85 binary).
check-doc-links	0	Links are valid across 17 scan roots.
check-changeset-presence	0	✅ No source or published contract of a released package changed in this range, so no changeset is owed.
check-changeset-no-major	0	✅ No changeset declares a major bump.
check-shell-escape-residue	0	✅ OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ... 0 occurrence(s) outside a fence)
check-governed-queue-guard --self-test	0	OK ... 132 cases pass
check-governed-queue-guard --test AGENTS.md	3	One governed path governs the WHOLE pull request

Exit codes captured by redirecting to a file first, then reading $? — never through a pipe.

⛔ This PR STAYS DRAFT

The exit 3 above is the correct verdict, not a red gate. AGENTS.md is a governed surface, and the guard states the disposition itself:

⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the merge to the maintainer; a human merge IS the review record for a governed surface.

⛔ Not marking ready, not enqueueing, not arming auto-merge. The merge is the maintainer's.

Note on the one body edit above: governed-surface-guard.yml's header records that on PR #6183 an MCP update_pull_request call passing only reviewers silently set draft: false, and the PR entered the queue and landed unreviewed. The revision was therefore sent with draft: true passed explicitly, and the stored state read back afterwards to confirm it is still a draft.

Out of scope, untouched

claude/probe-6716a-writecheck is still there. Deleting it needs someone with a working delete path — which, per the line this PR adds, is not this seat. Triage already routed it to the maintainer.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[os-litant]

Fixes#6756

One knowledge line in AGENTS.md, per triage grading comment 5460872090. No code, no branch touched.

落点

AGENTS.md, section ### 多 agent 协作纪律(并行修改本仓库,务必遵守) under ## 9. Operational Rules — inserted as line 276, directly after the 绝不 git push --force / 绝不推 main bullet. That neighbour is the closest kin: both are "what a seat's push may and may not do against the shared remote", and the card itself cites the force-push ban (#5239) and the shared refs/stash fact (#3430) as its own family. ⛔ Deliberately not a new file — triage ruled the home is this section.

before

The section had no line at all about ref deletion. A seat that tried to delete its own probe branch had to rediscover the refusal by attempting it; the card records one dev seat spending four attempts doing exactly that.

after

One bullet (one physical line, matching the section's unwrapped-bullet format). It carries five things, all required by the ruling:

1. The fact — a seat can push a branch but cannot delete a remote ref; the agent proxy refuses every ref-deletion push with error: RPC failed; HTTP 403. No bypass: the GitHub MCP tool surface has create_branch with no delete counterpart, and there is no gh CLI in the container.
2. The false-success receipt, verbatim — after the 403, git prints Everything up-to-date. Triage called this the most valuable sentence on the card, above the 403 itself, and the reason is in the line: a caller that reads only the tail of the output, or treats a non-empty last line as success, reads a refused deletion as a completed one. Knowing it 403s does not protect you from that.
3. The claim-signal consequence (from comment 5468280978) — the cost is not tidiness. An orphan sibling branch left by a rename-and-retry on one card is invisible from every surface a seat normally reads: not on the card, not in the PR list, not in any queue view. Only a per-card prefix glob shows it, and the line carries that command. The measured near-miss on card 4934 read for a moment as a second seat working the same card concurrently — the one thing the claim discipline exists to prevent.
4. The four unmeasured points kept unmeasured, marked as such in the line itself: which layer returns the 403 (proxy policy / token scope / branch protection), whether other seats or environments can delete, whether tags are restricted the same way, and how many stale claude/* branches exist. ⛔ None was converted into an assertion.
5. An explicit non-authorization — the line records a capability gap and authorizes no branch cleanup, no census, and no lifecycle policy. Those are the maintainer's.

In the line, the card number inside the glob is written as this repo's usual angle-bracket placeholder, matching the neighbouring bullets' own placeholder style (the objectui-TASK worktree path and the PATHS argument in the stash-alternative recipes). Spelled as placeholder words here on purpose — see the sanitizer note below.

Measured, not assumed

• No line ratchet over AGENTS.md. The dispatch flagged this as an assumption to test. Verified: nothing under scripts/ computes a line budget or ratchet over this file, so the new line owes no compensating deletion. What does exist and was NOT anticipated: scripts/check-governed-queue-guard.mjs (governed-surface, AGENTS.md is row agents-md) and scripts/check-shell-escape-residue.mjs (scans this file's fences). Both are content/policy gates, not size gates.
• The gate union was derived, not guessed.scripts/check-shell-escape-residue.mjs's own header documents the derived union for a change to AGENTS.md; the governed-surface guard was added to it later by Machine-enforce human review on governed-surface paths — so the no-bypass rule stops resting on seat discipline alone #6596.
• No changeset is owed, and that is the gate's own verdict rather than my reading: check-changeset-presence reports 0 of them published source of a package the release covers for this diff. ⛔ No label was requested — objectui has no skip-changeset mechanism.
• The bullet was written with the Write tool, not a shell heredoc.scripts/check-shell-escape-residue.mjs exists because a git commit -F - example in this very section shipped with its heredoc terminator wrapped in a shell escape run (AGENTS.md §9 的 git commit -F - 示例带着 shell 转义残留落地(<<'\"'\"'EOF'\"'\"'),照抄得到一条不会终止的 heredoc #5150). Repeating that mechanism to author a line in the same section seemed like a poor idea.
• The GitHub body sanitizer ate two placeholder fragments from the first version of this description — the angle-bracket spellings were removed even inside backticks, leaving an empty pair of backticks. Caught by reading the stored body back after creating the PR; this revision spells them as words. The file itself is unaffected: the sanitizer touches GitHub bodies, not the committed diff.

Gates run — all on head e362056

gate	exit	verdict line
check-control-bytes	0	✅ OK (scanned 5996 tracked text file(s); skipped 85 binary).
check-doc-links	0	Links are valid across 17 scan roots.
check-changeset-presence	0	✅ No source or published contract of a released package changed in this range, so no changeset is owed.
check-changeset-no-major	0	✅ No changeset declares a major bump.
check-shell-escape-residue	0	✅ OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ... 0 occurrence(s) outside a fence)
check-governed-queue-guard --self-test	0	OK ... 132 cases pass
check-governed-queue-guard --test AGENTS.md	3	One governed path governs the WHOLE pull request

Exit codes captured by redirecting to a file first, then reading $? — never through a pipe.

⛔ This PR STAYS DRAFT

The exit 3 above is the correct verdict, not a red gate. AGENTS.md is a governed surface, and the guard states the disposition itself:

⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the merge to the maintainer; a human merge IS the review record for a governed surface.

⛔ Not marking ready, not enqueueing, not arming auto-merge. The merge is the maintainer's.

Note on the one body edit above: governed-surface-guard.yml's header records that on PR #6183 an MCP update_pull_request call passing only reviewers silently set draft: false, and the PR entered the queue and landed unreviewed. The revision was therefore sent with draft: true passed explicitly, and the stored state read back afterwards to confirm it is still a draft.

Out of scope, untouched

claude/probe-6716a-writecheck is still there. Deleting it needs someone with a working delete path — which, per the line this PR adds, is not this seat. Triage already routed it to the maintainer.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[os-litant]

Fixes#6756

One knowledge line in AGENTS.md, per triage grading comment 5460872090. No code, no branch touched.

落点

AGENTS.md, section ### 多 agent 协作纪律(并行修改本仓库,务必遵守) under ## 9. Operational Rules — inserted as line 276, directly after the 绝不 git push --force / 绝不推 main bullet. That neighbour is the closest kin: both are "what a seat's push may and may not do against the shared remote", and the card itself cites the force-push ban (#5239) and the shared refs/stash fact (#3430) as its own family. ⛔ Deliberately not a new file — triage ruled the home is this section.

before

The section had no line at all about ref deletion. A seat that tried to delete its own probe branch had to rediscover the refusal by attempting it; the card records one dev seat spending four attempts doing exactly that.

after

One bullet (one physical line, matching the section's unwrapped-bullet format). It carries five things, all required by the ruling:

1. The fact — a seat can push a branch but cannot delete a remote ref; the agent proxy refuses every ref-deletion push with error: RPC failed; HTTP 403. No bypass: the GitHub MCP tool surface has create_branch with no delete counterpart, and there is no gh CLI in the container.
2. The false-success receipt, verbatim — after the 403, git prints Everything up-to-date. Triage called this the most valuable sentence on the card, above the 403 itself, and the reason is in the line: a caller that reads only the tail of the output, or treats a non-empty last line as success, reads a refused deletion as a completed one. Knowing it 403s does not protect you from that.
3. The claim-signal consequence (from comment 5468280978) — the cost is not tidiness. An orphan sibling branch left by a rename-and-retry on one card is invisible from every surface a seat normally reads: not on the card, not in the PR list, not in any queue view. Only a per-card prefix glob shows it, and the line carries that command. The measured near-miss on card 4934 read for a moment as a second seat working the same card concurrently — the one thing the claim discipline exists to prevent.
4. The four unmeasured points kept unmeasured, marked as such in the line itself: which layer returns the 403 (proxy policy / token scope / branch protection), whether other seats or environments can delete, whether tags are restricted the same way, and how many stale claude/* branches exist. ⛔ None was converted into an assertion.
5. An explicit non-authorization — the line records a capability gap and authorizes no branch cleanup, no census, and no lifecycle policy. Those are the maintainer's.

In the line, the card number inside the glob is written as this repo's usual angle-bracket placeholder, matching the neighbouring bullets' own placeholder style (the objectui-TASK worktree path and the PATHS argument in the stash-alternative recipes). Spelled as placeholder words here on purpose — see the sanitizer note below.

Measured, not assumed

• No line ratchet over AGENTS.md. The dispatch flagged this as an assumption to test. Verified: nothing under scripts/ computes a line budget or ratchet over this file, so the new line owes no compensating deletion. What does exist and was NOT anticipated: scripts/check-governed-queue-guard.mjs (governed-surface, AGENTS.md is row agents-md) and scripts/check-shell-escape-residue.mjs (scans this file's fences). Both are content/policy gates, not size gates.
• The gate union was derived, not guessed.scripts/check-shell-escape-residue.mjs's own header documents the derived union for a change to AGENTS.md; the governed-surface guard was added to it later by Machine-enforce human review on governed-surface paths — so the no-bypass rule stops resting on seat discipline alone #6596.
• No changeset is owed, and that is the gate's own verdict rather than my reading: check-changeset-presence reports 0 of them published source of a package the release covers for this diff. ⛔ No label was requested — objectui has no skip-changeset mechanism.
• The bullet was written with the Write tool, not a shell heredoc.scripts/check-shell-escape-residue.mjs exists because a git commit -F - example in this very section shipped with its heredoc terminator wrapped in a shell escape run (AGENTS.md §9 的 git commit -F - 示例带着 shell 转义残留落地(<<'\"'\"'EOF'\"'\"'),照抄得到一条不会终止的 heredoc #5150). Repeating that mechanism to author a line in the same section seemed like a poor idea.
• The GitHub body sanitizer ate two placeholder fragments from the first version of this description — the angle-bracket spellings were removed even inside backticks, leaving an empty pair of backticks. Caught by reading the stored body back after creating the PR; this revision spells them as words. The file itself is unaffected: the sanitizer touches GitHub bodies, not the committed diff.

Gates run — all on head e362056

gate	exit	verdict line
check-control-bytes	0	✅ OK (scanned 5996 tracked text file(s); skipped 85 binary).
check-doc-links	0	Links are valid across 17 scan roots.
check-changeset-presence	0	✅ No source or published contract of a released package changed in this range, so no changeset is owed.
check-changeset-no-major	0	✅ No changeset declares a major bump.
check-shell-escape-residue	0	✅ OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ... 0 occurrence(s) outside a fence)
check-governed-queue-guard --self-test	0	OK ... 132 cases pass
check-governed-queue-guard --test AGENTS.md	3	One governed path governs the WHOLE pull request

Exit codes captured by redirecting to a file first, then reading $? — never through a pipe.

⛔ This PR STAYS DRAFT

The exit 3 above is the correct verdict, not a red gate. AGENTS.md is a governed surface, and the guard states the disposition itself:

⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the merge to the maintainer; a human merge IS the review record for a governed surface.

⛔ Not marking ready, not enqueueing, not arming auto-merge. The merge is the maintainer's.

Note on the one body edit above: governed-surface-guard.yml's header records that on PR #6183 an MCP update_pull_request call passing only reviewers silently set draft: false, and the PR entered the queue and landed unreviewed. The revision was therefore sent with draft: true passed explicitly, and the stored state read back afterwards to confirm it is still a draft.

Out of scope, untouched

claude/probe-6716a-writecheck is still there. Deleting it needs someone with a working delete path — which, per the line this PR adds, is not this seat. Triage already routed it to the maintainer.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[os-litant]

Fixes#6756

One knowledge line in AGENTS.md, per triage grading comment 5460872090. No code, no branch touched.

落点

AGENTS.md, section ### 多 agent 协作纪律(并行修改本仓库,务必遵守) under ## 9. Operational Rules — inserted as line 276, directly after the 绝不 git push --force / 绝不推 main bullet. That neighbour is the closest kin: both are "what a seat's push may and may not do against the shared remote", and the card itself cites the force-push ban (#5239) and the shared refs/stash fact (#3430) as its own family. ⛔ Deliberately not a new file — triage ruled the home is this section.

before

The section had no line at all about ref deletion. A seat that tried to delete its own probe branch had to rediscover the refusal by attempting it; the card records one dev seat spending four attempts doing exactly that.

after

One bullet (one physical line, matching the section's unwrapped-bullet format). It carries five things, all required by the ruling:

1. The fact — a seat can push a branch but cannot delete a remote ref; the agent proxy refuses every ref-deletion push with error: RPC failed; HTTP 403. No bypass: the GitHub MCP tool surface has create_branch with no delete counterpart, and there is no gh CLI in the container.
2. The false-success receipt, verbatim — after the 403, git prints Everything up-to-date. Triage called this the most valuable sentence on the card, above the 403 itself, and the reason is in the line: a caller that reads only the tail of the output, or treats a non-empty last line as success, reads a refused deletion as a completed one. Knowing it 403s does not protect you from that.
3. The claim-signal consequence (from comment 5468280978) — the cost is not tidiness. An orphan sibling branch left by a rename-and-retry on one card is invisible from every surface a seat normally reads: not on the card, not in the PR list, not in any queue view. Only a per-card prefix glob shows it, and the line carries that command. The measured near-miss on card 4934 read for a moment as a second seat working the same card concurrently — the one thing the claim discipline exists to prevent.
4. The four unmeasured points kept unmeasured, marked as such in the line itself: which layer returns the 403 (proxy policy / token scope / branch protection), whether other seats or environments can delete, whether tags are restricted the same way, and how many stale claude/* branches exist. ⛔ None was converted into an assertion.
5. An explicit non-authorization — the line records a capability gap and authorizes no branch cleanup, no census, and no lifecycle policy. Those are the maintainer's.

In the line, the card number inside the glob is written as this repo's usual angle-bracket placeholder, matching the neighbouring bullets' own placeholder style (the objectui-TASK worktree path and the PATHS argument in the stash-alternative recipes). Spelled as placeholder words here on purpose — see the sanitizer note below.

Measured, not assumed

• No line ratchet over AGENTS.md. The dispatch flagged this as an assumption to test. Verified: nothing under scripts/ computes a line budget or ratchet over this file, so the new line owes no compensating deletion. What does exist and was NOT anticipated: scripts/check-governed-queue-guard.mjs (governed-surface, AGENTS.md is row agents-md) and scripts/check-shell-escape-residue.mjs (scans this file's fences). Both are content/policy gates, not size gates.
• The gate union was derived, not guessed.scripts/check-shell-escape-residue.mjs's own header documents the derived union for a change to AGENTS.md; the governed-surface guard was added to it later by Machine-enforce human review on governed-surface paths — so the no-bypass rule stops resting on seat discipline alone #6596.
• No changeset is owed, and that is the gate's own verdict rather than my reading: check-changeset-presence reports 0 of them published source of a package the release covers for this diff. ⛔ No label was requested — objectui has no skip-changeset mechanism.
• The bullet was written with the Write tool, not a shell heredoc.scripts/check-shell-escape-residue.mjs exists because a git commit -F - example in this very section shipped with its heredoc terminator wrapped in a shell escape run (AGENTS.md §9 的 git commit -F - 示例带着 shell 转义残留落地(<<'\"'\"'EOF'\"'\"'),照抄得到一条不会终止的 heredoc #5150). Repeating that mechanism to author a line in the same section seemed like a poor idea.
• The GitHub body sanitizer ate two placeholder fragments from the first version of this description — the angle-bracket spellings were removed even inside backticks, leaving an empty pair of backticks. Caught by reading the stored body back after creating the PR; this revision spells them as words. The file itself is unaffected: the sanitizer touches GitHub bodies, not the committed diff.

Gates run — all on head e362056

gate	exit	verdict line
check-control-bytes	0	✅ OK (scanned 5996 tracked text file(s); skipped 85 binary).
check-doc-links	0	Links are valid across 17 scan roots.
check-changeset-presence	0	✅ No source or published contract of a released package changed in this range, so no changeset is owed.
check-changeset-no-major	0	✅ No changeset declares a major bump.
check-shell-escape-residue	0	✅ OK (4/4 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s) ... 0 occurrence(s) outside a fence)
check-governed-queue-guard --self-test	0	OK ... 132 cases pass
check-governed-queue-guard --test AGENTS.md	3	One governed path governs the WHOLE pull request

Exit codes captured by redirecting to a file first, then reading $? — never through a pipe.

⛔ This PR STAYS DRAFT

The exit 3 above is the correct verdict, not a red gate. AGENTS.md is a governed surface, and the guard states the disposition itself:

⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the merge to the maintainer; a human merge IS the review record for a governed surface.

⛔ Not marking ready, not enqueueing, not arming auto-merge. The merge is the maintainer's.

Note on the one body edit above: governed-surface-guard.yml's header records that on PR #6183 an MCP update_pull_request call passing only reviewers silently set draft: false, and the PR entered the queue and landed unreviewed. The revision was therefore sent with draft: true passed explicitly, and the stored state read back afterwards to confirm it is still a draft.

Out of scope, untouched

claude/probe-6716a-writecheck is still there. Deleting it needs someone with a working delete path — which, per the line this PR adds, is not this seat. Triage already routed it to the maintainer.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1