check-governed-queue-guard: an authorised APPROVED review satisfies the merge-queue leg regardless of commit_id — maintainer 2026-09-04: a human approval record suffices, never pinned to the latest commit

[claude]

Filed by the domain:skills seat (session session_019RfFHiRCSs3JXLK4cwcfox, os-steve) on a maintainer instruction given in the live PM chat on 2026-09-04 at ~05:1xZ, verbatim and untranslated: 「你的门禁有问题，只需要有人工批准记录就行，不需要卡最新的提交。」 — said while objectstack PR #15057 (approved three times by an authorised approver, enqueued three times) kept falling out of the merge queue. The seat's reading of that PR's failure is a different check (check-skill-frame-sync, root cause on the PR); but the instruction names a real property of THIS guard, measured: the merge_group leg of scripts/check-governed-queue-guard.mjs (pinnedApprovalVerdict) counts an authorised APPROVED review only when its commit_id equals the pull request's CURRENT head sha, so any push after the approval — a merge of main, a patch round, a rebase — turns the approval STALE and the queue refuses until the approver approves again. The maintainer rules that a human approval record on the pull request suffices and must not be pinned to the latest commit.

What changes

• pinnedApprovalVerdict: an authorised (GOVERNED_APPROVERS) reviewer's latest-decisive review that is APPROVED satisfies the queue leg regardless of commit_id; DISMISSED and superseded reviews still never count; the staleApprovers bucket is retired or kept as a printed reading only (never a refusal); an unreadable review list still fails closed; GOVERNED_APPROVERS itself is unchanged (the instruction says a HUMAN approval record — the authorised set is the technical control that it is one).
• The script header's "What satisfies the queue leg" paragraph and the refusal text are rewritten to the ruled predicate, with the ruling quoted verbatim and dated beside it, and the accepted cost stated out loud in one sentence (a push after an approval is no longer re-reviewed by the gate — the maintainer accepts this, as the 2026-08-12 ruling on the retired per-PR gate accepted a comparable cost).
• The self-test cases that pin the sha pin flip to pin the new predicate: an authorised approval on an OLDER sha passes; a dismissed one still refuses; an unauthorised one still refuses; an empty review list still refuses.
• ⛔ Nothing else in the guard moves: the path test, the pull_request early-warning leg, the exit contract, the check-run name, the generated-surface register.

Refs

objectstack PR #15057 · objectui PR #7473 (approved repeatedly by os-zhuang while its head moved) · #11704 (the guard's regime) · #8161 (the 2026-08-12 ruling on the retired gate's approval predicate).

---

Generated by Claude Code

[claude]

Claim: PM loop round 5 — maintainer instruction (2026-09-04 chat, verbatim on the card)
Session: session_019RfFHiRCSs3JXLK4cwcfox
Branch: claude/issue-7601-queue-guard-unpinned-approval
Worktree: objectui-issue-7601
Domain: domain:skills
File surface: scripts/check-governed-queue-guard.mjs only — the merge_group predicate, its header paragraph and refusal text, and the self-test cases that pin it (stop on breach; explain in the report). ⛔ No workflow file, no GOVERNED_APPROVERS change, no change to the path test, the early-warning leg, the exit contract or the check-run name.
Container & model: S, mode:subagent, model: opus (a governance predicate whose every sentence must keep the rule's force; opus)
Clause-②: no (the gate's accept/reject behaviour DOES change — by the maintainer's explicit instruction, which is the ruling this card executes; the seat reviews at the contract tier)
Serial constraints cleared: no open PR touches scripts/check-governed-queue-guard.mjs; the guard's own workflow runs it in merge_group on every queue build, so the PR proves itself on its own queue build. Not a governed surface (scripts/**; the dev confirms with the governed --test) ⇒ draft PR, in-seat contract-tier review, ready + auto-merge by the seat.

Decision re-read (05:31Z): the maintainer's instruction 「你的门禁有问题，只需要有人工批准记录就行，不需要卡最新的提交。」 is executed as written on the card — an authorised latest-decisive APPROVED review satisfies the queue leg regardless of commit_id; dismissed, superseded, unauthorised and unreadable still refuse; the ruling quoted verbatim and dated in the header with the accepted cost stated once; the self-test pins the new predicate in both directions.

---

Generated by Claude Code

[os-steve]

os-dev-report

{
  "issue": 7601,
  "status": "done",
  "branch": "claude/issue-7601-queue-guard-unpinned-approval",
  "pr": "https://github.com/objectstack-ai/objectui/pull/7606",
  "premise_still_valid": true,
  "summary": "The merge_group leg's pinnedApprovalVerdict(reviews, headSha) becomes authorizedApprovalVerdict(reviews): an account in GOVERNED_APPROVERS whose latest-decisive review is APPROVED satisfies the queue leg on whichever commit that review was left, per the maintainer's 2026-09-04 ruling, quoted verbatim and dated in the header's rewritten 'What satisfies the queue leg' with the accepted cost stated out loud. Dismissed, superseded, unauthorised, non-decisive and absent reviews still never count; an unreadable review list still fails closed at exit 4. The staleApprovers bucket is RETIRED rather than kept as an inert printed reading — under the new predicate every authorised approval lands in approvers, so it could never be non-empty again and its only renderer was a refusal line that can no longer print; an always-empty field would read as evidence the gate still measures staleness. The pull-request head read went with the pin (makePullHeadReader deleted, runGuard takes no fetchPullHead), so a governed PR now costs one review lookup instead of two and no verdict line names traffic that does not happen. One file changed: scripts/check-governed-queue-guard.mjs. GOVERNED_APPROVERS, the path test, the pull_request early-warning leg, the exit contract, the check-run name and the workflow file are untouched. The guard is NOT governed by itself (measured, exit 0 NOT GOVERNED), so the PR can take the ordinary route. The card arrived correctly claimed by the PM (assignee os-steve, labels pm:dispatched) and I touched no labels or assignees.",
  "tests": "All on head a3f3035, clean tree, every exit captured by redirect-then-read before any pipe. (1) node scripts/check-governed-queue-guard.mjs --self-test exit 0 -> 'OK check-governed-queue-guard self-test: 132 cases pass' (132 before, 132 after: every case a flip or rename plus exactly one replacement; nothing added, nothing dropped). (2) node scripts/check-governed-queue-guard.mjs --test scripts/check-governed-queue-guard.mjs exit 0 -> 'NOT GOVERNED - 1 path(s) checked against 5 governed surface(s); none matched.'; same answer for the PR's whole file list. (3) pnpm exec vitest run scripts/__tests__/check-governed-queue-guard.test.ts exit 0 -> 'Test Files 1 passed (1)' / 'Tests 15 passed (15)' (run under the shared verify lock, VERDICT command-exit 0). (4) pnpm lint exit 0 -> 'Tasks: 47 successful, 47 total' (full repo-wide turbo run, no narrowing claimed); pnpm lint:root exit 0 -> '33 problems (0 errors, 33 warnings)', pre-existing warning debt. Coverage of the changed file measured rather than assumed: pnpm exec eslint --format json on it reports 'files linted: 1', 0 errors, 0 warnings, because a zero-match lint run also exits 0. (5) pnpm check:control-bytes exit 0 -> 'check-control-bytes: OK (scanned 6227 tracked text file(s); skipped 85 binary)', plus a direct grep -naP control-byte scan of the changed file: no hits. (6) node scripts/check-changeset-presence.mjs exit 0 -> 'No source or published contract of a released package changed in this range, so no changeset is owed.' No skip-changeset label applied: objectui has no such mechanism. (7) pnpm check:esm-specifiers exit 0, pnpm check:node-esm-load exit 0 (only by-design CSS exclusions already in the ledger), pnpm type-check:scripts exit 0. ABLATION, predicted direction RED, observed RED: implementation committed FIRST (a3f3035), then the sha pin reinstated inside authorizedApprovalVerdict against the self-test HEAD constant. NO REBUILD STEP EXISTS AND NONE WAS FAKED - this is a plain .mjs run directly by node with no dist and no package build in its resolution path, so the mutated bytes on disk are the bytes executed. Mutation confirmed ON DISK by grepping the exact text I meant to change, not by an editor exit code: injected marker ABLATION_PIN present 1 time, the original predicate line present 0 times. Mutated self-test: 'FAIL check-governed-queue-guard self-test: 7 of 132 case(s) failed' - exactly the six flipped cases plus the one replacement, while every 'still never counts' case (unauthorised, dismissed, superseded, empty, non-decisive) stayed GREEN, so the flip did not widen the gate open. Restore proven by state, not exit code: git checkout HEAD -- absolute path, then git hash-object equal to the HEAD blob c79bb39a92bbc00b46c3661941bb5e01f520e699, git diff HEAD empty, 0 residual ABLATION_PIN, and the restored tree back to 132 pass. The mutation script carried trap on EXIT/INT/TERM with an absolute repo-root path.",
  "mcp_calls": "3 - issue_write (filed 7605), create_pull_request (7606), add_issue_comment (this report). All card, comment, repo and dedup reads went through the zero-quota repo-scoped REST channel, which was probed working (HTTP 200) before use; REST /search/issues is 403 in this container by the egress proxy's path allowlist, so dedup used the repo-scoped issues list plus a local grep, with a positive control (this card, 7601, present in the enumeration) so the empty keyword result is a reading rather than a confident absence.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #7605: AGENTS.md and content/docs/guide/ci-cd-pipeline.md both still describe the sha pin this PR retires; AGENTS.md is a governed surface so its correction is a separate draft PR that parks for a human merge, which is exactly why folding it in here was wrong - it would have parked this ordinary PR too"
  ]
}

Notes the PM may want beyond the JSON, all verified rather than assumed:

1. The dispatch's mechanism assumption about the vitest suite did not hold, in the harmless direction. It said scripts/__tests__/check-governed-queue-guard.test.ts "must be updated with the predicate and stay green". Measured: that suite pins the gate's wiring and the governed surface only. It imports CHECK_CONTEXT_NAME, CHECK_JOB_ID, CHECK_WORKFLOW, GOVERNED_SURFACES and governedPathsIn — no predicate export at all — so the rename reaches nothing in it and no edit was owed. It is green at 15/15 against the changed script, including its own case that shells out to --self-test.

2. The staleApprovers choice the card left open was decided by reading, and the reading is in the PR body. Retired, not kept as a printed reading.

3. The blast radius was enumerated, not guessed. git grep for the script's filename and for every export I touched finds exactly two files repo-wide — the script and its vitest suite — plus the workflow (untouched) and two prose files (filed as Two docs still describe the governed-queue guard's retired sha pin — AGENTS.md and content/docs/guide/ci-cd-pipeline.md #7605). No other script imports it.

4. node scripts/pm/dispatch-gates.mjs was deliberately NOT used. That script lives only in objectstack; feeding objectui paths into the objectstack checkout returns objectstack's gate families — shape-complete, exit 0, entirely wrong. objectui's family was derived by hand from this repo's own package.json and .github/workflows/.

5. The PR body picked up a second attribution footer on creation — the documented create_pull_request mutation. Left alone deliberately: a PATCH to "repair" it would downgrade the session URL to the bare form and append yet another one. Read back to the tail; the body is byte-for-byte what was sent plus that footer, and the maintainer's quote survived verbatim.

Generated by Claude Code

---

Generated by Claude Code

[claude]

ACCEPT — skills seat (session session_019RfFHiRCSs3JXLK4cwcfox), reviewer of record, 2026-09-04T06:07Z, verified against GitHub and a compare worktree at the PR head, not against the report.

• Implemented-by: claude/issue-7601-queue-guard-unpinned-approval
• Reviewed-by: session_019RfFHiRCSs3JXLK4cwcfox

PR #7606 @ a3f3035 — draft, base main (merge base 24e027e9), first line Fixes #7601, one file (scripts/check-governed-queue-guard.mjs, +221/-183), one commit, one footer, no model name, no control bytes, no changeset owed (the presence script decided; no label — this repository has no such mechanism). Local git merge-tree --write-tree origin/main (e62c44e) at 06:05Z: clean; mergeable_state reads behind, which the queue's own merge absorbs. The guard is not governed by itself — the seat re-ran --test on the file: "An ordinary pull request".

What landed, re-verified at the head: pinnedApprovalVerdict(reviews, headSha) → authorizedApprovalVerdict(reviews) — an account in GOVERNED_APPROVERS whose latest-decisive review is APPROVED satisfies the merge_group leg on whichever commit that review was left; dismissed, superseded, unauthorised, non-decisive and absent still never count; an unreadable review list still fails closed at exit 4; the staleApprovers bucket is retired outright (under the new predicate it could never be non-empty, and an always-empty field would read as evidence the gate still measures staleness — the right call), and the PR-head read that fed only the pin is gone with it (one lookup per governed PR instead of two). The header's "What satisfies the queue leg" is rewritten around the maintainer's instruction, quoted verbatim and dated, with the accepted cost stated out loud; the refusal texts say the new rule; the DRAFT remedy stays first; GOVERNED_APPROVERS, the path test, the pull_request early-warning leg, the exit contract, the check-run name and the workflow are untouched. The seat ran the self-test at the head: 132 cases pass, and the OK line names the new predicate's cases — an authorised approval counts on an OLDER commit, on no commit_id, on an unparsable one; never for an unauthorised, dismissed, superseded, non-decisive or absent review. The ablation (pin reinstated) reds exactly the six flipped cases plus the one replacement while every "still never counts" case stays green — the flip did not widen the gate open — and restores by blob hash.

Gates as reported at a3f3035: self-test 132/132, --test NOT GOVERNED, the guard's vitest suite 15/15 under the lock, pnpm lint 47/47 (coverage of the changed file measured, 1 file linted), check:control-bytes, check-changeset-presence (none owed), check:esm-specifiers, check:node-esm-load, type-check:scripts all green. The out-of-scope finding #7605 (AGENTS.md and the CI/CD guide still describe the retired pin) is correctly not folded in — AGENTS.md is governed and would have parked this ordinary PR; triaged into pm:queue (XS, governed, serial behind this PR). Report mcp_calls: 3 — within contract.

CI at 06:07Z on a3f3035: 29 check runs, 18 success + 3 skipped, 8 in progress; nothing red.

Terminal: pure code (scripts/**, not governed) ⇒ flipped ready and auto-merge armed (SQUASH) by the seat once every check is green — this PR's own queue build runs the guard it changes; on MERGED the card closes by Fixes and is label-cleaned. The objectstack twin (#15187) lands separately.

---

Generated by Claude Code