dogfood-verification/SKILL.md tells its executor to `gh pr merge --squash --auto` and `git worktree remove --force` — both forbidden to the same executor by os-dev.md rules 4 and 85; end the checklist at the draft PR

[claude]

Filed by the domain:skills seat (session session_019RfFHiRCSs3JXLK4cwcfox, os-steve) from the #14768 census dev's out-of-scope finding (addendum report 5551181953). Self-triaged priority:p2, pm:queue, governed (.claude/skills/**).

What was measured (2026-09-05, main cc5b3dd0c2)

.claude/skills/dogfood-verification/SKILL.md lines 135–137 (blob 5083aa42) tell the executor, in the delivery checklist:

提交(信息末尾带 Co-Authored-By: trailer)、推送、gh pr create,然后 gh pr merge --squash --auto --delete-branch(先移除 worktree,本地分支才不被锁:git worktree remove /tmp/pr --force)。

Two standing rules in .claude/agents/os-dev.md (blob b2913e63) say the opposite for the same executor:

• line 63, rule 4: 「⛔ 永不编辑 content/docs/releases/、force-push、推 main、合并任何东西。」
• line 85: 「⛔ 永不上来就 --force:拒绝移除说明有东西没提交,那是本容器未提交工作的唯一守卫。」

A third contradiction sits underneath: dogfood-verification/SKILL.md is itself a governed surface, and the PM governed endgame forbids arming auto-merge from any seat on a governed PR at all; the checklist arms it unconditionally, for any file the dogfood run touched. gh is also absent from the dev container (a documented reading), so the line is not merely forbidden but unexecutable as written.

What this card decides and does

One governed surface, a short edit: the delivery checklist ends at "push and open a DRAFT PR, report the PR to the seat that dispatched you" — the landing (ready, auto-merge, queue, human merge) belongs to that seat under the same rules every other dev flight follows; the worktree line drops --force and says the same thing os-dev.md line 85 says (a refusal means uncommitted work; look, do not force). No other line of the skill moves; shrink-or-neutral under the token ratchet where a ceiling applies. If the skill has a matching published or sibling copy, the dev reports it rather than editing it.

Serial

The file is in no flight and no open PR (scan 2026-09-05T10:3xZ). It is outside the #15379 rules-only family. Governed ⇒ draft PR, in-seat review, reviewers os-zhuang + hotlong, human merge.

Dedup

REST enumeration 2026-09-05T10:4xZ, state=all sorted by update (1,200 items, 796 issues, back to 2026-09-03T15:53Z; positive control #14768 hit): no card names dogfood-verification's merge or force lines.

---

Generated by Claude Code

[claude]

Claim: PM loop round 6 — filed and taken at first touch by the seat (p2: a governed skill instructs its executor to merge, arm auto-merge and force-remove, against the executor's own hard rules); the checklist ends at the draft PR
Session: session_019RfFHiRCSs3JXLK4cwcfox
Branch: claude/issue-15842-dogfood-checklist-ends-at-the-draft-pr
Worktree: objectstack-issue-15842
Domain: domain:skills
File surface: .claude/skills/dogfood-verification/SKILL.md — the delivery checklist lines 135–137 at cc5b3dd0c2 (blob 5083aa42): the merge/auto-merge/delete-branch step replaced by "push, open a DRAFT PR, report the PR to the seat that dispatched you"; the worktree-removal line drops --force and says what os-dev.md line 85 says. Nothing else in the file moves.
Container & model: S, mode:subagent, model: opus (no path-derived mandate: the file is none of the three mandated globs; clause ② not engaged — the change removes an instruction, it widens nothing)
Clause-②: no
Serial constraints cleared: the file is in no flight and no open PR (scan 10:3xZ); outside the #15379 family. GOVERNED (.claude/**) ⇒ draft PR, in-seat review, os-zhuang + hotlong, human merge, skip-changeset. The PR carries Fixes #15842.

Decision re-read (10:3xZ): the three rules the line contradicts are all standing and ruled (dev never merges; never --force first; no seat arms auto-merge on a governed surface) — no ruling owed; the only judgement is wording, and the token ratchet decides its size.

---

Generated by Claude Code

[claude]

os-dev-report

{
"issue": 15842,
"status": "done",
"branch": "claude/issue-15842-dogfood-checklist-ends-at-the-draft-pr",
"pr": "#15847",
"premise_still_valid": true,
"summary": "Premise re-verified on origin/main d701e65: the checklist blob is still 5083aa42 and the three lines still sit at 135-137, so the card stands. They are replaced by two bullets — (a) commit (trailer unchanged), push, open a DRAFT PR (REST endpoint in a dev container, gh pr create --draft on a human machine) and report the PR to the dispatching seat, with ready / queue / human merge staying that seat's; (b) git worktree remove /tmp/pr with no --force, a refusal meaning uncommitted work, read git status first. gh pr merge --squash --auto --delete-branch is gone from the file, not softened. Line-NEUTRAL as ruled: 148 lines before and after, and the line ratchet is the gate that pins this file (ceiling 157, headroom 9, unchanged); the token ratchet measures the published skills/ bundle only and names no .claude/skills file, so it does not pin it. One wording judgement inside the ruling: the qualifier "under the governed rules" did not fit the gate's 120-byte line budget without dropping ruled content or spending a line, so the file states the ownership plainly (ready / queue / human-merge belong to that seat) without the parenthetical — 9 lines of headroom remain if the seat wants it spelled out. No sibling or published copy exists (grepped skills/, the whole objectstack tree and objectui): the edited line was the only occurrence, so there is no untouched twin to report.",
"tests": "Edit confirmed ON DISK before anything was measured: the replacement anchor matched exactly once (a zero-match rewrite exits 1 by construction), then grep -c gave 0 for gh pr merge --squash --auto --delete-branch and 1 each for gh pr create --draft, the report-to-the-seat clause and the refusal clause, with git diff showing 3 lines out / 3 lines in on one file. Gate family derived on the final file list: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (1 path vs merge base d701e65, three-dot, --repo assertion held) = 13 commands; every one was run, and --ran reconciles: "dispatch-gates --ran: 13 derived famil(ies) accounted for — 13 run, 0 NOT-MEASURED." Ruled extras: pnpm check:pm-skill-ratchet printed "check-skill-line-ratchet: .claude/skills/dogfood-verification/SKILL.md is 148 lines (ceiling 157; headroom 9)", identical to the pre-edit baseline run; node scripts/check-skills-token-ratchet.mjs printed "36 authored bundle file(s) within their ceilings" with zero mentions of this file; node scripts/check-skill-frame-sync.mjs printed "2 copies of the decision frame are structurally isomorphic across 2 files". NOT MEASURED then measured: pnpm --filter @objectstack/lint run check:doc-formula-expressions first exited 3 with PREREQUISITE NOT MET (naming @objectstack/formula, then @objectstack/lint, as unbuilt) — read as unrun, not red — and went green (exit 0, 58 self-test cases) after both were built through the shared lock. Whole-repo pnpm lint (eslint . --no-inline-config) through bash scripts/pm/os-verify-lock.sh slot issue-15842: "VERDICT command-exit 0 · held the lock 68s" — the full scan, no narrowing claimed. Every exit code was captured after redirecting to a file, never across a pipe. CI on head 83221b5: all 29 check runs completed in a foreground poll, 0 failures — 23 success (Lint & Repo Gates, Check Changeset, Governed Surface Queue Guard, TypeScript Type Check and its four Type Check jobs, Test Core, Dogfood Regression Gate, Check PR Size, Check Documentation Links, the three single-writer/claim guards, filter, Auto Label) and the rest skipped. No ablation was performed: this change authors no gate, so there is nothing whose failure mode needed proving.",
"mcp_calls": "0 — the repo-scoped REST probe returned 200 on this seat, so every read and write (card read, PR create, additive label write plus comparison read-back, check-run polling, this comment) went through REST; no MCP GitHub tool was called.",
"open_questions": [],
"out_of_scope_findings": []
}

---

Generated by Claude Code