Two docs still describe the governed-queue guard's retired sha pin — AGENTS.md and content/docs/guide/ci-cd-pipeline.md

[os-steve]

Found while implementing #7601 (the maintainer's 2026-09-04 ruling that an authorised human approval record satisfies the merge-queue leg regardless of commit_id). Filed rather than fixed in that PR: its dispatch scoped the file surface to scripts/check-governed-queue-guard.mjs only, and one of the two files below is a governed surface, so editing it there would have parked an otherwise ordinary PR for a human merge.

Blocked-by: #7601 — both statements are still accurate until that PR lands.

The drift

Once the guard's predicate stops reading commit_id, both of these describe a mechanism that no longer exists. Both fail in the worst direction: a seat reads them, believes an approval goes stale on the next push, and re-requests an approval the gate does not want.

1. AGENTS.md, in the 受管面 section (search for Governed Surface Queue Guard): says the merge_group leg 要求 GOVERNED_APPROVERS 的 APPROVED review 钉在当前 head. After check-governed-queue-guard: an authorised APPROVED review satisfies the merge-queue leg regardless of commit_id — maintainer 2026-09-04: a human approval record suffices, never pinned to the latest commit #7601 it is not pinned to any head. ⚠️ AGENTS.md is itself a governed surface, so this correction is a draft PR that parks for a human merge — that is the regime, not an obstacle.

2. content/docs/guide/ci-cd-pipeline.md, in the Governed Surface Guard section: three consecutive claims go stale together — that the review's commit_id must equal the pull request's current head sha; that "the sha pin is what makes the approval an approval of something"; and that "a push after the approval goes stale and reopens the refusal". This file is NOT governed, so it is an ordinary PR.

Also worth checking in the same pass, though it may already read correctly: the same section's cost paragraph describes the guard's API surface. After #7601 the pull-request head read is gone, so a governed pull request costs exactly one review lookup rather than two.

Suggested shape

One PR per file, because the two have different merge routes. The replacement wording is already written and reviewed in the guard's own header under "What satisfies the queue leg" — copy the predicate and the accepted-cost sentence from there rather than paraphrasing, so the three places cannot drift again.

Filed by the objectui dev seat working #7601, session session_019RfFHiRCSs3JXLK4cwcfox, under a shared GitHub identity — the branch on that card's PR is the identifying detail, not the author field. Left unassigned and unlabelled for PM triage.

[claude]

Triage — skills seat (session session_019RfFHiRCSs3JXLK4cwcfox, os-steve), 2026-09-04T06:07Z (the seat grades its own programme's follow-ups while the objectui triage seat is vacant, per the #7359 precedent). Graded priority:p3, domain:skills, documentation, state pm:queue. Applied and read back after this comment.

Scope as queued (XS, serial behind PR #7606 — the pin it describes): rewrite the two passages that describe the governed-queue guard's sha pin — AGENTS.md (governed: draft PR, both approvers, human merge) and content/docs/guide/ci-cd-pipeline.md — to the ruled predicate (an authorised APPROVED review record counts on whichever commit it was left; dismissed and superseded never count), quoting the guard's own header sentence rather than paraphrasing; one PR, since the guide is not governed but the pair is one fact. ⛔ No other prose.

---

Generated by Claude Code

[claude]

Claim: PM loop round 5
Session: session_019RfFHiRCSs3JXLK4cwcfox
Branch: claude/issue-7605-guard-docs-unpinned-approval
Worktree: objectui-issue-7605
Domain: domain:skills
File surface: AGENTS.md (受管面 section — the sentence saying the merge_group leg requires an APPROVED review by GOVERNED_APPROVERS pinned to the current head) and content/docs/guide/ci-cd-pipeline.md (§ Governed Surface Guard — the three consecutive sha-pin claims and the cost paragraph), rewritten to the ruled predicate by copying the guard header's own sentences (scripts/check-governed-queue-guard.mjs § "What satisfies the queue leg" at 0d8fd7c), never paraphrased; one PR (one fact, two files). ⛔ No other prose, ⛔ no change to the guard.
Container & model: XS, mode:subagent, model: opus (governance prose that must keep the rule's force)
Clause-②: no (prose only; the gate's behaviour changed in PR #7606)
Serial constraints cleared: objectui PR #7606 (#7601) MERGED 0d8fd7ce 07:09:49Z — the pin is retired on main, so both statements are now false and the card's own Blocked-by: #7601 is released; no open PR touches either file (PR #7608 edits skills/objectui/** only). GOVERNED (AGENTS.md) ⇒ draft PR, in-seat review, both authorized approvers requested by the seat, human merge — ⛔ never ready / queue / auto-merge from the seat.

Decision re-read (07:22Z): the maintainer's 2026-09-04 instruction is executed as written on #7601; this card is its documentation residue, scoped by the 06:07Z triage — no ruling owed.

---

Generated by Claude Code

[claude]

os-dev-report

{
"issue": 7605,
"status": "done",
"branch": "claude/issue-7605-guard-docs-unpinned-approval",
"pr": "#7616",
"premise_still_valid": true,
"summary": "Both passages were still the pre-ruling text at origin/main 0d8fd7c and are rewritten to the ruled predicate by COPYING scripts/check-governed-queue-guard.mjs's own header sentences (§ "What satisfies the queue leg" L52-59, the ruling at L66 lifted byte-for-byte out of that line, the accepted cost at L83-87) rather than paraphrasing. AGENTS.md § 受管面: the one clause rewritten, language and voice kept, ruling quoted verbatim and untranslated, accepted cost stated once; no neighbouring sentence touched. content/docs/guide/ci-cd-pipeline.md § Governed Surface Guard: the three stale claims replaced with the header's predicate plus the accepted cost, and the workflow-inventory table row near L43 corrected — it stated the same pin. THE COST PARAGRAPH WAS ALREADY RIGHT AND IS LEFT UNTOUCHED: it claims only that a clear diff costs zero API calls (still true) and never stated the governed-PR count that #7606 changed; verified in the source, not assumed — runGuard early-returns apiCalls: 0 when nothing is governed, takes one fetchReviews per governed PR, and L677 states 'There is no fetchPullHead parameter any more', which the guard's own self-test prints as 'the retired head read measured ABSENT at one lookup per governed PR'. GOVERNED regime honoured: PR #7616 is a DRAFT, never flipped ready, never enqueued, no auto-merge, no reviewer requested, no approval submitted; assignees untouched. No changeset added — check-changeset-presence.mjs says none is owed and its verdict was followed. objectui has NO scripts/check-governed-merges.mjs (that script lives in the sibling objectstack as scripts/pm/...); the equivalent local answer is node scripts/check-governed-queue-guard.mjs --test, run below. Stop condition did not fire: the guard header at origin/main still carries the sentences PR #7606 landed, verbatim as quoted.",
"tests": "All verdicts below are at the FINAL commit 8d78dbd with git status --porcelain empty (measured tree == HEAD). Exit codes captured by redirecting to a file first, never through a pipe.\n\nGATES: pnpm lint (whole repo, turbo, 47 tasks, 4m32s) EXIT=0 — '✖ 2878 problems (0 errors, 2878 warnings)', warnings pre-existing no-explicit-any in app-shell, unrelated to this md-only diff · pnpm check:control-bytes EXIT=0 '✅ check-control-bytes: OK (scanned 6228 tracked text file(s); skipped 85 binary).' · pnpm check:governed-queue-guard EXIT=0 'OK check-governed-queue-guard self-test: 132 cases pass (... the authorized-approval-record predicate on the queue leg per the 2026-09-04 ruling — counts on an OLDER commit, on no commit_id and on an unparsable one; ... the retired head read measured ABSENT at one lookup per governed PR ...)' · pnpm check:doc-fences EXIT=0 · pnpm check:doc-types EXIT=0 '✅ Every documented component type is registered.' · pnpm check:doc-snippets EXIT=0 'Semantic phase: 452 of 452 block(s) judged, 0 failed.' — first run answered EXIT=2 'PRECONDITION NOT MET ... The snippet program was NOT run', read as NOT MEASURED, not as green: its --build-filter closure was built (turbo run build --concurrency=2, 34/34 tasks, 3m19s, EXIT=0) and the gate re-run · pnpm check:docs-route-closure EXIT=0 (all three verdicts green) · pnpm check:skills-paths EXIT=0 '88/89 stated path(s) resolve' · pnpm check:shell-escape-residue EXIT=0 '0 occurrence(s) outside a fence' · node scripts/check-doc-links.mjs EXIT=0 'Links are valid across 17 scan roots.' · node scripts/check-changeset-presence.mjs EXIT=0 '✅ No source or published contract of a released package changed in this range, so no changeset is owed.' — verdict followed, NO changeset added · node scripts/check-governed-queue-guard.mjs --test AGENTS.md content/docs/guide/ci-cd-pipeline.md EXIT=3 '⛔ GOVERNED — 1 of 2 path(s) are on a governed surface: AGENTS.md x1', as expected and the reason the PR stays draft.\n\nPIN TESTS (the suites that read the two edited files, owed in addition to the path-derived families): pnpm exec vitest run --maxWorkers=2 scripts/tests/ci-cd-pipeline-doc.test.ts scripts/tests/check-governed-queue-guard.test.ts scripts/tests/merge-queue-reporting.test.ts EXIT=0 — 'Test Files 3 passed (3)', 'Tests 69 passed (69)'.\n\nNO ABLATION was run: this is a prose-only diff with no predicate to mutate; the guard's own self-test already measures the retired pin in both directions (older commit / absent commit_id / unparsable counts; dismissed, superseded, unauthorised and unreadable refuse).\n\nBUDGET: no objectui gate pins AGENTS.md's line or byte count — searched .github/workflows/ and scripts/*.mjs for a ceiling, ratchet or governed-prose shape check on AGENTS.md and found none (the only workflow references to AGENTS.md are comments and the shell-escape scan root), and every gate above is green on the longer clause. So no line was bought and nothing was re-wrapped or deleted to pay for the rewrite.\n\nBEFORE/AFTER — AGENTS.md § 受管面 (one clause of the long line, was L496 at 0d8fd7c):\nBEFORE: 「merge_group 腿才是会拒绝的那条 —— 它要求 GOVERNED_APPROVERS(os-zhuang / hotlong)的 APPROVED review 钉在当前 head。」\nAFTER: 「merge_group 腿才是会拒绝的那条 —— 它要求 GOVERNED_APPROVERS(os-zhuang / hotlong)里某个账号的一条 latest-decisive APPROVED review,留在哪个 commit 上都算;DISMISSED 与被顶掉的批准(同一 reviewer 后续给了 CHANGES_REQUESTED)不算,该集合之外账号的 APPROVED 不算,review 列表为空或读不到则 fail closed —— 判定读的是有没有一条人工批准记录,不问它是对哪些字节给的(维护者 2026-09-04 裁,逐字未译:「你的门禁有问题，只需要有人工批准记录就行，不需要卡最新的提交。」;sha pin 是退休不是放宽,守卫里已没有任何判定读 commit_id)。⚠️ 已接受的代价:批准之后的 push 不再被这道门重审,一个已批准的受管 PR 可以带着批准者没读过的字节落地 —— 维护者接受这一点,而这道拒绝先印的补救仍是转回 draft、交人类合并。」\n\nBEFORE/AFTER — content/docs/guide/ci-cd-pipeline.md § Governed Surface Guard (was L1254-1257):\nBEFORE: 'What clears the queue leg is an APPROVED review by an account in GOVERNED_APPROVERS whose commit_id equals the pull request's current head sha. The sha pin is what makes the approval an approval of something: a push after the approval goes stale and reopens the refusal, so a clearance cannot outlive the bytes it was given for. Dismissed and superseded approvals never count.'\nAFTER: 'What clears the queue leg is a latest-decisive APPROVED review by an account in GOVERNED_APPROVERS, on whichever commit it was left. Dismissed and superseded approvals (a later CHANGES_REQUESTED by the same reviewer) never count; an APPROVED review by an account outside that set never counts; an empty or unreadable review list fails closed. The predicate is the existence of a human approval record, and says nothing about which bytes it was given for — the maintainer ruled the sha pin out on 2026-09-04, quoted verbatim and untranslated because rewriting a ruling is rewriting the ruling: 「你的门禁有问题，只需要有人工批准记录就行，不需要卡最新的提交。」 The pin is retired, not softened: no predicate reads commit_id, there is no stale bucket, and the pull-request head read that existed only to feed the pin is gone with it. The accepted cost, stated out loud rather than left to be discovered: a push after an approval is no longer re-reviewed by this gate, so an approved governed pull request can land carrying bytes its approver never read.' (the following sentence, 'The remedy the refusal prints first ... leave the merge to the maintainer.', is unchanged)\n\nBEFORE/AFTER — the same file's workflow-inventory table row (L43), which stated the same pin:\nBEFORE: '... a governed-surface diff with no authorized approval pinned to the PR's current head is refused there ...'\nAFTER: '... a governed-surface diff with no authorized approval record (on any commit) is refused there ...'\n\nUNCHANGED, ON PURPOSE — the cost paragraph: 'What it costs when nothing is governed: nothing. The path test runs before any request is constructed, so an ordinary pull request produces a CLEAR verdict and zero GitHub API calls ...'. It carries no stale claim, so ⛔ no other prose was touched.\n\nPR BODY READ BACK IN FULL after creation: byte-identical to what was sent except the platform's appended session-URL signature footer; nothing was eaten by the sanitizer, first line is still 'Fixes #7605'.",
"mcp_calls": "0 — every GitHub read and write went through repo-scoped REST with $GITHUB_TOKEN (issue read, comments read, PR create, PR read-back, two pages of open issues for dedup, issue create, this comment); zero MCP GitHub calls for the whole run",
"open_questions": [],
"out_of_scope_findings": [
"filed as #7618: AGENTS.md § 受管面 never states the guard header's normative seat rule — '⛔ An agent seat never submits an approving review on a governed-surface pull request, under any account' — which the retired pin made weightier ('one approval now clears every later push'); AGENTS.md carries only the adjacent never-ready/never-enqueue/never-auto-merge/never-self-merge list. Unassigned, unlabelled, dedup'd against 195 open issues (control word 'governed' returned 11 hits, so the scan was live).",
"NOT filed, reported to PM instead — open card #7089 (pm:queue, priority:p1, the domain:ui execution-seat handover) states the retired pin in its own body: 'Governed surfaces (never ready/queue/auto-merge without a pinned GOVERNED_APPROVERS approval on the current head)'. It is a queued card's body, not a repo file, and the next PM seat is exactly its audience; the fix is a correction on that card, which its owner should make — a seat rewriting another queued card's body is not my call, and a card about a card is noise."
]
}

---

Generated by Claude Code

[claude]

ACCEPT — governed terminal. Contract-tier review of PR #7616, head 8d78dbd (skills seat, 2026-09-04T07:47Z).

Implemented-by: claude/issue-7605-guard-docs-unpinned-approval (os-dev subagent, task aba63a70bf5085d33)
Reviewed-by: session_019RfFHiRCSs3JXLK4cwcfox (skills seat)

Verified in a detached compare worktree at 8d78dbd (merge base = origin/main 0d8fd7c, git merge-tree clean), not from the report:

• Exactly the two files, exactly the stale clauses. AGENTS.md +1/−1 (one clause of the 受管面 line: 「钉在当前 head」 → the ruled predicate in the section's language, the ruling quoted verbatim and untranslated, the accepted cost stated once; the rest of the line byte-identical by word-diff). content/docs/guide/ci-cd-pipeline.md +12/−5: the three sha-pin claims replaced by the header's predicate plus the accepted cost, and the workflow-inventory row (L43) that stated the same pin corrected; the cost paragraph left untouched because it never stated the head read — checked against runGuard (zero calls on a clear diff, one review read per governed PR).
• Copied, not paraphrased. The maintainer's sentence is byte-identical in all three places (grep -c = 1 in the guard header, in AGENTS.md, in the guide); the guide's predicate paragraph is the header's § "What satisfies the queue leg" (L52–59) and its accepted-cost sentence (L83–87) in prose form. No stale phrase remains in either file (钉在当前 head / pinned to the PR's current head / commit_id equals / goes stale: zero hits).
• Gates on the head: check-governed-queue-guard --self-test 132 cases; check-governed-queue-guard --test AGENTS.md content/docs/guide/ci-cd-pipeline.md → exit 3, GOVERNED, 1 of 2 paths (the expected answer and the reason the PR stays draft); check-control-bytes OK (6228 files); the dev's run adds pnpm lint 0 errors, doc-fences / doc-types / doc-snippets (452/452) / docs-route-closure / skills-paths (88/89) / shell-escape-residue / doc-links green, the three pin suites 69/69, and check-changeset-presence "no changeset is owed" — followed, none added. CI on 8d78dbd: 25 success, 3 skipped.

Governed terminal, four pieces: ① this verdict; ② the PR stays a DRAFT, visibly pending for the maintainer — ⛔ the seat never flips it ready, never enqueues, never arms auto-merge; ③ review requested from os-zhuang and hotlong on the PR; ④ seat post refreshed. Landing is a human merge, or an authorized approval and then the queue (this repo's guard already carries the unpinned predicate, so the approval may sit on any commit).

Two residues the dev surfaced, dispositioned: #7618 (AGENTS.md never states the never-approve seat rule) triaged into this lane's queue behind this PR; the retired-pin sentence in objectui#7089's body reported to that card's owner as a cross-lane note (5537365534), not edited.

---

Generated by Claude Code