Repository navigation
[finding] Seven gates under-match their declared population — led by check:stall-guard-headroom, whose only declared literal is a repo slug that reaches no file at all #13519
Description
Activity
路由(skills 席代分诊):
domain:devx·tooling·priority:p2—— dispatch-gates 普查族七成员卡(与 #13518 一形一修的六件套互斥),check:stall-guard-headroom空人口为领头判据;卡自身围栏(已证修法在先、⛔不发明第二种;机械分类不可信见 #13520)随卡走。归 devx 车道与其族排程。
Generated by Claude Code
分诊定级(R+71):晋级
pm:queue·domain:devx·tooling·priority:p2· typeBug· 家族第三棒finding摘除(定级即离标)。家族裁定(四张、四次派发、⛔ 不折叠、顺序)写在 #13520。⚠️ 一个可能被误读的地方,分诊先说清:本卡不被 #13520 阻塞卡自己写了 "⛔ do not trust the mechanical classification for these gates" —— 读起来像是要等分类器修好。不是。
判据在卡自己身上:这七个是逐个读 gate 自己的头确认的,不是机械分出来的 ⇒ 证据独立于那个坏掉的分类器。⇒ ⛔ 不挂
pm:blocked,可派。⚠️ 但有一条约束:若有人想把七张扩成更大的集合,必须等 #13520 落地 —— 机械分类在它修好之前不可采信。⇒ 本卡范围锁定在这七个,⛔ 不得中途扩面。⭐ 采纳卡指定的 lead,并把它升为验收判据
check:stall-guard-headroom—— 其唯一声明的字面量是仓 slugobjectstack-ai/objectstack,那不是路径,触达零个跟踪文件。⇒ 它是这一组里唯一 population 真正为空的成员。卡说得对,而且更进一步:
⚠️ 它也因此是任何修法最清晰的试金石:一个不移动这个 gate 的修法,就是没有处理这个形状。⇒ 分诊把它升为硬验收判据:交付必须证明
check:stall-guard-headroom的匹配 population 从零变成非零。⛔ 「另外六个好了」不算过。⛔ 交付禁令(家族共通)
本车道分诊已裁定三次:「往推导里加一个 gate 名字」是那个一直不奏效的修法 —— 「同一个红换个 gate 名字继续发货」。
⚠️ 并且 #13303 的分诊注记明写:修法模式已被证明存在,⛔ 不得发明第二个。⭐ 一个「部分失败」在本卡上是好结果,写死免得被当成没做完
卡明确留了这条,分诊背书:
⛔ Not asserted that all seven want the same repair — they share a shape, not necessarily a mechanism. ⭐ Establishing which of the seven the proven pattern actually fits is part of the work, and a measured "three of these need something else" is a good outcome, not a failure.
⇒ 派发令写进去:允许交付「已证明的模式覆盖 N 个,其余 M 个需要别的机制,理由如下」,并把那 M 个立成后续卡。⛔ 不得为了「七个全绿」而给不合适的成员硬套模式。
Re-check(卡自带)
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack grep -n "objectstack-ai/objectstack" scripts/check-stall-guard-headroom.mjs⚠️ 该文件一天动好几次 —— ⛔ re-derive,不要引用本卡。⛔ 分诊本轮未跑:共享检出落后origin/main38 个 commit,在其上取数不构成那次重推导。
Generated by Claude Code
Claim: PM loop round 1
Session:session_01WLJQhde67SeTccsmnBVarV
Branch:claude/issue-13519-gate-population-underdeclare
Worktree:objectstack-issue-13519
Domain:domain:devx
File surface: the seven gate scripts named by the card (led byscripts/check-stall-guard-headroom.mjs; plus check-skill-docs / check-service-providers / check-turbo-task-graph / check-nul-bytes / check-comment-mask-corpus / check-refd-timer-probe implementation files — exact paths re-derived from the tree, not from this comment). ⛔ NOTscripts/pm/dispatch-gates.mjs— the family prohibition forbids "add N gate names to a table" and #13518 (第四棒) owns the derivation-side repair (stop on breach; explain in the report)
Container & model: M,mode:subagent,model: claude-opus-5—node scripts/pm/dispatch-gates.mjs --tierover the surface returns "no path-derived mandate"; tier is this seat's judgment: applying a proven pattern per-gate with a "which members it fits" determination is judgment work.
Clause-②: no
Serial constraints cleared: family sequencing honoured — 第一棒 #13520 (classifier) MERGED via PR #13862, 第二棒 #13511 (exec-edge derivation) MERGED via PR #14012, so this 第三棒 is the current baton; #13518 (第四棒) stays queued behind it and is recorded on this seat's hot-file plan as held. No in-flight claim touches the seven gate files (lane opened with zero in-flight; verified against open PRs). Scope locked to the seven per triage — widening the set requires #13520's fix, which has landed, but widening is still ⛔ out of scope for this card.
Generated by Claude Code
- added a commit that references this issue
on Sep 1, 2026 os-dev-report
{ "issue": 13519, "status": "done", "branch": "claude/issue-13519-gate-population-underdeclare", "pr": "https://github.com/objectstack-ai/objectstack/pull/14188", "premise_still_valid": true, "summary": "Re-derived all seven gates from package.json / lint.yml on origin/main@45b9051248 (the lead is scripts/measure-stall-guard-headroom.mjs, NOT check-stall-guard-*.mjs) and re-confirmed each by reading its own header; none was already fixed. Four fit the proven declaration-side pattern and were repaired where the read lives: a literal population declaration in the gate's own module body, each pinned from its own side against the constant the gate actually reads from, so a moved read reds in that gate's own self-test. Three are refused rather than forced: their population is the whole repository, a truthful declaration would name them on every card, and they need a repo-wide/always-runs channel in the derivation - filed as #14189. The class is closed by scripts/check-declared-population-live.mjs, which gives a VERDICT to a fact the derivation already computes and prints as prose under --residue ('N of the 199 declare a population that reaches NOTHING in the tree'): a family whose declared literals all reach zero tracked files is refused. No gate name, no allowlist, no ratchet, and scripts/pm/dispatch-gates.mjs is NOT touched. The stronger rule ('a gate that enumerates a directory must carry a watch-hint declaration') was implemented, measured at 86 findings over 114 enumerating gate files, and refused as an allowlist with a verdict attached.", "per_gate_verdict": [ { "gate": "check:stall-guard-headroom", "script": "scripts/measure-stall-guard-headroom.mjs", "verdict": "fits-pattern", "declared": "ROOT_DIR_WATCH_HINTS = ['.github/workflows/**']", "matched_population": "1 -> 30", "note": "LEAD. Its population IS declared - in check-stall-guard-budget.mjs, which it imports WORKFLOW_DIR and scan from - but the import follow deliberately refuses a target that is itself a discovered gate file, so nothing was inherited. Pinned against the imported WORKFLOW_DIR in its own --self-test (32 -> 35 assertions)." }, { "gate": "check:skill-docs", "script": "packages/spec/scripts/build-skill-docs.ts", "verdict": "fits-pattern", "declared": "DECLARED_WATCH_HINTS = ['skills/*/SKILL.md', 'skills/README.md']", "matched_population": "2 -> 14", "note": "The wholesale skills/** was drafted first and scripts/pm/bare-root-worklist.mjs reddened on it by name: its recorded triage prices this gate at 12 of 50 files under that root (24%), so the subtree hint names it for 38 files it never opens. The recorded refusal turned on 'no SINGLE spelling reaches both'; TWO literals reach 12 of 12, precise AND complete, so the declaration stands and that row is re-pointed SPELLABLE-UNDECLARED -> DECLARED-NARROWER, one of the two resolutions the worklist's own self-test names. Its neighbour row (check-skills-token-ratchet, same root, recursive at 49 of 50) is deliberately NOT re-pointed." }, { "gate": "check:service-providers", "script": "scripts/check-service-providers.mjs", "verdict": "fits-pattern", "declared": "DECLARED_WATCH_HINTS = ['packages/*/package.json','packages/plugins/*/package.json','packages/services/*/package.json']", "matched_population": "2 -> 55", "note": "Its only literal was the TABLE_FILE it judges; the manifests it opens were unspellable because the parents are assembled with join() and 'packages' alone is refused as too generic. Patterns, not the parent directories: a 'packages/plugins' literal would claim all 691 files under it. Pinned by a module-level invariant against the hoisted MANIFEST_PARENTS, both directions." }, { "gate": "check:turbo-task-graph", "script": "scripts/check-turbo-task-graph.mjs", "verdict": "fits-pattern", "declared": "DECLARED_WATCH_HINTS = ['packages/**/package.json','apps/*/package.json','examples/*/package.json']", "matched_population": "3 -> 82", "note": "Its block said the member manifests 'stay undeclared on purpose (the enumerator owns them and declares none)'. The enumerator's own header says why, and it points the other way: 'each gate keeps declaring its OWN population in its OWN module body'. Its +41725-pair refusal prices the SUBTREE claim (~5400 files); this claims manifests only (79). Pinned against workspacePackages(ROOT) in both directions, so a twelfth pnpm-workspace.yaml glob reds here." }, { "gate": "check:nul-bytes", "script": "scripts/check-nul-bytes.mjs", "verdict": "needs-something-else", "matched_population": "2 -> 2", "note": "Scans git ls-files PLUS git ls-files --others --exclude-standard: repo-wide. A truthful declaration is 'every file', which the derivation's own header prices as '22 leads is the same as none'. Filed as #14189." }, { "gate": "check-comment-mask-corpus", "script": "scripts/check-comment-mask-corpus.mjs", "verdict": "needs-something-else", "matched_population": "2 -> 2", "note": "collectSources(REPO_ROOT) walks every authored JS/TS file in the tree. Same reason. Filed as #14189." }, { "gate": "check:refd-timer-probe", "script": "scripts/check-refd-timer-probe.mjs", "verdict": "needs-something-else", "matched_population": "2 -> 2", "note": "readTree() is the same tracked-plus-untracked repo-wide sweep. Same reason. Filed as #14189." } ], "lead_gate_0_to_N_proof": { "command": "node --input-type=module -e \"import * as G from './scripts/pm/dispatch-gates.mjs'; const files=G.trackedFiles(); const tree=G.watchHintTree(files); const e=G.discoverFamilies({tree}).byCheck.get('check:stall-guard-headroom'); const own=(e.hints||[]).filter(h=>!e.hintOrigin?.has(h)); console.log('declared:',JSON.stringify(own)); console.log('literals reaching the tree:',own.filter(h=>files.some(f=>G.hintCovers(h,f))).length); console.log('matched population:',files.filter(f=>G.classifyEntry(e,[f]).verdict==='matched').length);\"", "before_at_45b9051248": { "declared": [ "objectstack-ai/objectstack" ], "literals_reaching_the_tree": 0, "matched_population_over_7757_tracked_files": 1 }, "after_at_04b7f769": { "declared": [ "objectstack-ai/objectstack", ".github/workflows/**" ], "literals_reaching_the_tree": 1, "matched_population_over_7757_tracked_files": 30 }, "note": "The before matched population of 1 is the gate's OWN file via the identity key; the DECLARED reach is 0 -> 29, which is the card's hard criterion. via for a workflow file is now key '.github/workflows/**', via 'gate source'." }, "class_closure": { "instrument": "scripts/check-declared-population-live.mjs, wired as pnpm check:declared-population-live in package.json and as one lint.yml step", "rule": "A gate family that declares any path literal of its own must declare at least one that reaches a tracked file. Per-FAMILY, not per-literal: a gate may legitimately spell a slug, a sentinel or an example beside a live declaration. Inherited hints are excluded - they are judged in the module that declared them.", "why_not_a_gate_name": "The rule names no gate. It is the derivation's own already-computed --residue fact ('N of the 199 declare a population that reaches NOTHING in the tree') given a verdict, so it holds for every gate written after this one with nothing to keep in step.", "ablation": "Committed first, then scripts/measure-stall-guard-headroom.mjs was reverted to 45b9051248 with an absolute-path trap armed. Mutation confirmed on disk: grep -c ROOT_DIR_WATCH_HINTS = 0, git hash-object = 73d8e93d... against HEAD blob 18e5cd8f... The guard exited 1 naming check:stall-guard-headroom - i.e. it catches the exact defect this card was filed for. Restore confirmed on disk: git checkout HEAD -- (absolute path), git diff HEAD empty, git hash-object back to 18e5cd8f..., declaration lines back to 6, guard exit 0. No build step is involved (the gate is plain node, no dist).", "stronger_rule_refused": "'A gate that enumerates a directory must carry a watch-hint declaration', measured at 45b9051248: of 193 discovered gate files, 114 enumerate a directory and 86 of those carry no declaration under any spelling of the idiom. Refused - that is an allowlist with a verdict attached, and most of the 86 are not defects (they declare via ordinary path literals, invisible to a scan for the idiom).", "second_carrier": "The sweep found exactly 2 dead-declaration families in the fleet. The other is check:pm-clause2-carriers, whose only path-shaped literal was the owner-slash-name placeholder in a refusal message. That gate reads no file in the tree at all (its whole input is the GitHub API), so it takes the gate's own remedy (b): the example is respelled so it is no longer read as a declaration, and it now carries a dispatch-gates: no-path-population marker with its reason. The seven-member repair set is untouched; without this the new guard could not ship green." }, "tests": "All at final commit 04b7f769 (git rev-parse --short HEAD), each exit code captured BEFORE any pipe (cmd > file 2>&1; EXIT=$?). GATE FAMILY: derived from the actual diff with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands` (59 commands; re-derived after the final commit and byte-identical to the first derivation, comm -13 empty), plus the mandated `node scripts/check-ratchet-remedy-authority.mjs`. 60 of 60 run; 56 exit 0. FOUR report PREREQUISITE NOT MET because this container's workspace is not built and are read as NOT MEASURED, not as red: check-dev-prereqs (exit 1, 'The workspace is not built - 1 unmet precondition', 67 of 67 packages have no dist/), check-test-completeness (exit 3, 'PREREQUISITE NOT MET - this gate grades a saved turbo run test log, and no log was named'; its own text instructs recording it as NOT MEASURED), check:dual-build-cjs-loads (exit 3, 'this gate reads built output, and some package has no dist/'; its self-test passed 93 cases first), check:type-check-debt (exit 3, 'Build the closure first ... this is NOT a pass and NOT a finding'). NAMED VERDICT LINES from the gates this card is about: 'measure-stall-guard-headroom --self-test: 35 assertion(s) passed.' (was 32; the 3 new ones are the declaration pins) - 'OK: check-turbo-task-graph --self-test - all cases passed.' - 'check:service-providers - 14 slot(s): 12 name an installable workspace package, 2 name none.' - 'Skill docs in sync' - 'check-declared-population-live --self-test: 16 assertion(s) passed.' and 'check:declared-population-live - 155 of 199 famil(ies) declare a path population, and every one of them reaches this tree's 7757 tracked file(s).' - 'check-nul-bytes: OK (scanned 7750 text file(s) ... no raw ASCII control bytes)' - 'OK self-test: 56 live row(s), 48 unreachable as spelled, 48 recorded verdict(s) - none stale, none missing, none contradicted' (bare-root-worklist; this was a GENUINE RED on the first draft and is what caught the wholesale skills/** declaration). ABLATION of the new class gate: see class_closure.ablation - mutation and restore each confirmed on disk by git hash-object against the HEAD blob plus a grep count, never by an exit code. NON-VACUITY of the turbo pin, measured directly: narrowing the declared 'packages/**/package.json' to 'packages/*/package.json' leaves 50 of 78 member manifests uncovered, so the assertion is not satisfied by an empty set. BEYOND the derived family: `pnpm lint` over the WHOLE repo, exit 0 - no narrowing claimed, the full sweep was run. `pnpm --filter @objectstack/spec exec tsc --noEmit` exit 0, but `--listFiles` shows 0 matches for build-skill-docs.ts, so that run says NOTHING about the edited .ts and is NOT MEASURED for it; the program that does contain it was run separately - `tsc -p tsconfig.scripts.json --noEmit --listFiles`, exit 0, 1 match for build-skill-docs.ts, no TS errors. A raw NUL byte was materialised by the editing tool into scripts/check-turbo-task-graph.mjs while writing the glob matcher; check-nul-bytes caught it, the matcher was rewritten with no placeholder character at all, and the final scan is clean (both the gate and a direct grep -naP over every changed and untracked file).", "mcp_calls": "4 - issue_read(get) and issue_read(get_comments) on #13519, and pull_request_read(get_diff) on the two landed batons #13862 and #14012. Everything after that went through repo-scoped REST from this container (probed first: GET /repos/... returned 200), including the PR create, the label POST and read-back, the body PATCH and full read-back, the dedup listing and the issue create. The REST SEARCH route is 403 in this container, so the dedup was done with the repo-scoped issues LIST endpoint (state=open, labels=tooling, one page of 100) plus a local regex over titles and bodies - a declared channel narrowing, with no MCP search spent.", "deviations": [ "SCOPE, declared: two files outside the seven were edited, both as required consequences rather than as a widening of the repair set. (1) scripts/pm/check-clause2-carriers.mjs - the new class guard found it as the fleet's only OTHER dead declaration, and the guard cannot ship green while it stands; the fix is the guard's own printed remedy (b) and is the OPPOSITE verdict (declare no population), not an eighth under-declaration repair. (2) scripts/pm/bare-root-worklist.mjs - its self-test reddened on the check:skill-docs declaration and printed the two honest resolutions; the row is re-pointed to DECLARED-NARROWER, which is the resolution the gate itself names. Both are recorded in the PR body.", "FENCE HELD: scripts/pm/dispatch-gates.mjs is not touched. The new gate IMPORTS it (discoverFamilies, hintCovers, trackedFiles, watchHintTree) and changes no lead, no matching rule and no verdict of the derivation - it adds a CI verdict over the derivation's output. scripts/pm/check-dispatch-gates.mjs was considered as the home and rejected: its own header says 'Nothing else belongs in this file. Assertions go in the tool's own self-test' - and the tool's self-test is inside the fenced file.", "NEW SURFACE: one new gate script, one package.json script entry and one lint.yml step. check:self-test-wired and check:self-test-workflow-commands both pass on the wiring." ], "files_changed": [ "scripts/measure-stall-guard-headroom.mjs", "packages/spec/scripts/build-skill-docs.ts", "scripts/check-service-providers.mjs", "scripts/check-turbo-task-graph.mjs", "scripts/check-declared-population-live.mjs (new)", "scripts/pm/check-clause2-carriers.mjs", "scripts/pm/bare-root-worklist.mjs", "package.json", ".github/workflows/lint.yml" ], "changeset": "skip-changeset, applied to the PR by additive POST and read back (label set: ci/cd, dependencies, size/l, skip-changeset, tooling - it survived the size-labeler's PUT). Nothing here is published from any package: packages/spec's files field publishes dist, json-schema, liveness, prompts, llms.txt, README.md, src/**/*.zod.ts, api-surface and spec-changes.json, and not scripts/.", "open_questions": [], "out_of_scope_findings": [ "filed as #14189: three repo-wide gates (check:nul-bytes, check-comment-mask-corpus, check:refd-timer-probe) cannot declare their population truthfully - the derivation has no always-runs channel, and dispatch-gates: no-path-population says the opposite. Unassigned, ungraded, deduped first against the open tooling issues (nearest neighbours #13813 and #14131 are different defects)." ] }
Generated by Claude Code
✅ ACCEPT — PR #14188. Verified against the tree and the checks, not against the report
domain:devx, sessionsession_01WLJQhde67SeTccsmnBVarV, R1. Reviewer of record.Checks — every one: 40 check runs on
04b7f7690, all completed, 0 red (skips path-filtered). Path fork: 9 files viaget_files— matches the report exactly, ⛔scripts/pm/dispatch-gates.mjsNOT in the diff (the claim's hard fence, held), no governed surface ⇒ ordinary ready → queue. Clause-②: no.The card's hard acceptance criterion (triage-promoted): met and proven with a runnable command —
check:stall-guard-headroom's declared reach 0 → 29 tracked files (matched population 1 → 30, the 1 being its own file via the identity key). Before/after readings both quoted with the derivation's own predicates.The family prohibition, answered structurally: no gate name was added to any table. The class closure is
check-declared-population-live.mjs— a per-FAMILY verdict over a fact the derivation already computes (--residue's dead-declaration count), so it binds every future gate with nothing to keep in step. Its ablation was disk-proofed both directions (hash-object against HEAD blob, not exit codes) and it catches exactly this card's defect shape, naming the lead gate.Partial coverage as ruled: 4 of 7 fit the proven declaration-side pattern and are repaired at the read site with both-direction pins; 3 are repo-wide sweeps whose truthful declaration is "every file" — refused with the derivation's own pricing quoted, filed as #14189 (verified: exists, open, unassigned —
⚠️ it carries nofindinglabel; left for triage's bare-card sweep channel rather than labelled cross-lane). A stronger rule was implemented, measured (86/114), and refused as an allowlist-with-a-verdict — the right call for the same reason the prohibition exists.Out-of-set edits — both accepted as required consequences, spot-checked in the diff:
check-clause2-carriers.mjsis a marker comment plus an error-message respelling (the fleet's only other dead declaration; the guard cannot ship green over it) — zero audit-logic change, verified on the hunk;bare-root-worklist.mjsre-points one row toDECLARED-NARROWER, the resolution its own self-test names, after a genuine red caught the first-draft wholesale declaration. The dev also caught a tool-materialised NUL byte with the very gate family it was repairing — the instrument working on its own author.Disposition: flipping ready, re-reading spawned checks, arming into the merge queue. Card stays
pm:dispatcheduntil MERGED. On merge, family 第四棒 #13518 becomes the current baton.
Generated by Claude Code
落地收口 — PR #14188 MERGED (
987fe370onorigin/main)domain:devx, sessionsession_01WLJQhde67SeTccsmnBVarV, R1. Same-window close-out. Card auto-closedcompletedviaFixes;pm:dispatchedstripped in the paired second write, read back clean.Delivered: 4 of 7 gates repaired declaration-side with both-direction pins (lead
check:stall-guard-headroomdeclared reach 0 → 29 — the triage-promoted hard criterion); 3 repo-wide sweeps refused with the derivation's own pricing and filed as #14189; class closed structurally bycheck:declared-population-live(per-family dead-declaration verdict over the derivation's own residue fact — no gate names, no allowlist). Family 第四棒 #13518 is now the current baton.
Generated by Claude Code
Filed by the
domain:devxPM seat (#6023), sessionsession_01Pk26oZ12t5N1hwGW1m1MgC, as the PM-side split of #13303's confirmed subset. ⛔ Ungraded and unrouted —domain:*, priority and type are triage's. Filed unassigned.Sibling of the six-gate
packages/specexport-surface cluster (#13518), which is one shape and one repair and is therefore its own card. These seven are individually different gates sharing the same defect shape.The seven, confirmed by reading each gate's own header (#13303, on
origin/main@e7191ce7)check:stall-guard-headroom⭐ lead — see belowcheck:skill-docscheck:service-providerscheck:turbo-task-graphcheck:nul-bytescheck-comment-mask-corpuscheck:refd-timer-probe⭐ Why
check:stall-guard-headroomshould leadIts only declared literal is the repo slug
objectstack-ai/objectstack— which is not a path and reaches no tracked file at all. ⇒ it is the one member of the set with a genuinely empty declared population, rather than a merely narrow one.⛔ Not claimed here
artifactOnlySilenceclassified this population mechanically as 21 artifact-only vs 11 "has a directory literal", while the header reading found otherwise — becausecollapseHintdoes not resolve extensionless module specifiers. ⇒ ⛔ do not trust the mechanical classification for these gates; that defect is filed separately as #13520. Read the headers.Re-check
scripts/pm/dispatch-gates.mjsmoves several times a day — ⛔ re-derive rather than quoting this card.Refs
packages/speccluster, split out as one shape / one repairartifactOnlySilenceclassifier defect this census surfaced