[audit] gate census — every check-*.mjs, check:* script, hook and required job on one table: what it guards, real catches since landing, blast radius — and the retirement list (maintainer ruling F)

[hotlong]

Filed and dispatched by the director seat (summon #24, session_01Wj1HUjzyeiBQ8atRf1ZhaL) under the maintainer's ruling F on the direct channel, 2026-09-16 ~14:4xZ — question, verbatim: 「现在有各种门禁的开发在浪费我的各种时间,我们的项目是不是门禁用的太重了。有这个必要吗?」; reply to the three-part proposal, verbatim: 「F」. ⛔ No domain:* set by the filer: the deliverable is a report under docs/audits/** (无固定归属,按落点分诊) — triage names the lane; the director dispatches directly under the order.

Dedup terms: gate census · 门禁普查 · check-*.mjs inventory · retirement list · zero-catch gate

The readings that produced the ruling (director, origin/main, 2026-09-16)

reading	value
package.json check:* scripts	164
scripts/**/check-*.mjs files	182 · .github/workflows/lint.yml 6,599 lines · 37 workflows · 12 .claude/hooks/*
first-parent merges on main, last 7 days	597, of which 255 (42%) are gate/process-shaped (pm, hooks, ratchets, self-tests, dispatch, governed audits)
dispatch-gates.mjs families	52, of which 13 run only their own --self-test and cannot judge a diff
protocol asymmetry	SKILL.md:391 puts weakening a gate on the human floor; adding one is free (具名不升级类「门禁内部参数与扫描器盲区修复(加强,非削弱)」) ⇒ a one-way ratchet toward more gates

Deliverable — ONE table, report-only, no gate removed in this PR

docs/audits/gate-census-2026-09.md, one row per gate, where a gate = each scripts/**/check-*.mjs (and packages/*/scripts/check-*.mjs), each package.json check:* script that is not a thin alias of one of those, each .claude/hooks/*, and each job/context in main's required_status_checks (read via GET /repos/objectstack-ai/objectstack/rules/branches/main). Columns:

1. name (path or script)
2. class — contract (validates a published packages/spec contract or generated artefact) · correctness (typecheck, unit/integration tests, build) · process (PM loop, hooks, ratchets, governed audits, checker self-tests, labelers)
3. guards — the published contract path, the incident/card number that produced it, or none
4. required — is it (or the job that runs it) in main's required contexts? does its failure red a whole-repo job (Lint & Repo Gates style) or a path-scoped one?
5. real catches since landing — count of PR CI failures attributable to THIS check on PRs other than the one that introduced/edited it, excluding its own --self-test; method: Actions runs (event=pull_request, conclusion=failure) since the gate's landing commit, job annotations / first error line naming the check (MCP get_job_logs read tool is allowed; the REST log redirect is proxied 403). Where the count cannot be taken in the budget, write unmeasured (<why>) — ⛔ never a guessed number.
6. verdict — keep (contract or correctness, or a process gate with ≥1 real catch that names a published contract) · report-only (advisory today, no fail-closed role) · retire (process class, zero real catches, guards no published contract)

Plus three sections: retirement list (the retire rows, each with the files to delete and the rosters/workflow lines to update), report-only list, and method + limits (what was sampled, what was not).

Rules of the census

• Zod validation inside packages/spec and the runtime is the PRODUCT, not a gate — out of scope, and the report says so in one line.
• The merge_group governed guard (check-governed-queue-guard.mjs) is the maintainer's approval mechanism — keep, by ruling.
• Fixture files, mirrors and generated baselines are counted as what they serve, not as gates.
• The first retirement instance is already ruled: objectstack#18095 → E (check-reference-carrier-shape retires; its one real defect class moves to the reader's fail-loud). List it as retire (ruled).
• ⛔ No removals in this PR; the retirement batch follows as its own card(s) after the maintainer's one-word 「认可」 on the table (the director presents it as a governed-audit batch).

Acceptance

• The table's row count equals the union of the four inventories (state the four counts and the union; a row missing from the union is a defect).
• Every retire row has catches = 0 or unmeasured (<why>) AND guards = none; every keep row states why in column 3 or 5.
• Normal PR (docs path); skip-changeset.

Refs #18468 · #18470 · #18095 · the protocol-flip card filed alongside

---

Generated by Claude Code

[hotlong]

Claim: PM loop round 1 — maintainer direct dispatch to the director seat
Session: session_01Wj1HUjzyeiBQ8atRf1ZhaL
Branch: claude/issue-18472-gate-census
Worktree: objectstack-issue-18472
Domain: (unset — docs/audits/** has no fixed lane; triage names it; the director dispatches under the order)
File surface: docs/audits/gate-census-2026-09.md (new) and, only if the census needs a reusable counter, one read-only script under scripts/pm/ that writes nothing (stop on breach; explain in the report)
Container & model: L (report; wide read surface, zero product code), mode:subagent, model: claude-fable-5-1 — dispatch-gates.mjs --tier: no path-derived mandate for a docs path; the director dispatches at the session's own tier because the deliverable is a judgement table the maintainer acts on in one word; no downgrade exit taken
Clause-②: no
Thread-read: none
Serial constraints cleared: no open PR touches docs/audits/** (git ls-remote --heads origin 'claude/issue-1847*' shows only #18470's branch and #18468's); os-verify-lock.sh --status read no holder, no tickets at 14:2xZ; the two in-flight director dispatches (#18468 → PR #18476, #18470) touch .claude/** and scripts/pm/* only — this card writes neither

Authority for a director claim: the maintainer's ruling and order on this session's channel, verbatim — 「F」 (on the three-part proposal: flip the gate asymmetry, run one census, freeze new meta-gates meanwhile), following 「现在有各种门禁的开发在浪费我的各种时间,我们的项目是不是门禁用的太重了。有这个必要吗?」 (2026-09-16 ~14:4xZ), and the standing instruction on this session that the director dispatches such cards directly (「你现在就派卡处理」 / 「这个卡你也直接派发」).

---

Generated by Claude Code

[hotlong]

os-dev-report

{
  "issue": 18472,
  "status": "done",
  "branch": "claude/issue-18472-gate-census",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18497",
  "session": "session_01Wj1HUjzyeiBQ8atRf1ZhaL — subagent of the director seat's session (harness-stamped id inherited)",
  "premise_still_valid": true,
  "summary": "Delivered docs/audits/gate-census-2026-09.md: one six-column table over the union of the four inventories — 182 check files (178 scripts/** + 4 packages/*/scripts) + 26 non-alias root check:* scripts (of 164; 138 thin aliases collapsed onto their file row) + 10 .claude/hooks files + 7 required contexts read from GET /rules/branches/main = 225 rows, the table has 225 rows. The card's readings held at the base tree 85c6d76e (164 / 182 / 12 hooks / 7 contexts); origin/main moved seven commits before the PR opened and #18478 removed guard-governed-enqueue.sh plus its self-test, so the branch merged bf61f0a1 and the census was re-derived on the merged tree (12 to 10 hooks, 227 to 225 rows, Drift paragraph in the file). Verdicts: retire 59 (58 rule-derived + check-reference-carrier-shape retire (ruled), #18095 E), report-only 16, keep 150 (133 plain, 2 ruled incl. check-governed-queue-guard, 5 too new, 5 session hooks + 5 hook self-tests); classes process 115 / contract 60 / correctness 50. Column 5 sampled the last 30 days of failed PR CI (2026-08-17..09-16): 1,230 failed runs in the eight PR-triggered gate workflows, 1,287 failed jobs read step by step, 1,287 annotation reads, 9 job-log reads, attribution by step name split by annotation tag, distinct PRs, self-editing PRs excluded; every zero is measured, 23 rows read unmeasured with the reason stated, none guessed. Top three by blast radius: check-changeset-no-major 74 PRs, check-partof-closing-keyword 31 PRs (advisory workflow), check-system-context-census 21 PRs (required, whole-repo); the inline Require-a-changeset step (not a row) reddened 107 PRs. No gate removed, disabled or edited; draft PR #18497 carries skip-changeset (read back: documentation, size/m, skip-changeset) and the Chinese maintainer digest. The assignee was set by the dispatch (hotlong); I wrote no assignee.",
  "tests": "Dispatch-derived gates (node scripts/pm/dispatch-gates.mjs --commands docs/audits/gate-census-2026-09.md --repo objectstack-ai/objectstack, 17 families), each run with stdout/stderr redirected to a file and the exit code captured before any pipe, on the merged tree a22464ae/bf4d0c18: check:nul-bytes 0 (8735 text files, no control bytes) · check:doc-authoring 0 · check:watch-hint-literal 0 · check-closing-keyword-parity --self-test 0 · check-closing-keyword-parity 0 · check-ci-filter-parity 0 · check:merge-driver 0 · check:pm-widening-tells 0 · check:refd-timer-probe 0 · check:driver-memory-census 0 · check-comment-mask-corpus 0 (6796 files, 0 disagree) · spec check:empty-state 0 · spec check:liveness 0 · spec check:strictness-ledger 0 · spec check:variant-docs 0 · lint check:doc-formula-expressions first exit 3 (PREREQUISITE NOT MET: @objectstack/formula and @objectstack/lint not built; not a measurement) then, after building both through os-verify-lock.sh (VERDICT command-exit 0), exit 0 · check:cross-package-test-inputs exit 1 at the base and again on the merged tree — FINDING on the tree, not this diff: 'FAIL: cross-package test inputs are not declared consistently. @objectstack/cli descends a directory tree from packages/spec/dist/ ... rooted in packages/cli/test/init-created-files-summary.e2e.test.ts (no declared glob reaches inside it)'; the @objectstack/cli scan was pulled in because the local diff base read scripts/sync-template-versions.mjs as touched; Lint & Repo Gates on main at bf61f0a1 is success, so this surfaces only on PRs that pull the scan in. Reconciliation: node scripts/pm/dispatch-gates.mjs --ran (17 lines with ':: exit N') → exit 0, '17 derived families accounted for — 17 run, 0 NOT-MEASURED (a DERIVED zero — all 17 recorded an exit code and none of them is 3)'; the tool also flagged STALE TREE before the merge (4 scripts/pm files moved on main), cleared by merging origin/main. Prerequisite builds via the lock: pnpm --filter @objectstack/spec build (held 143s, command-exit 0), turbo build formula+lint (command-exit 0). Local verification scope: one new docs file, no package touched, so no ① build closure and no ② package tests are owed; pnpm lint (repo-wide eslint) is CI's. Acceptance self-check on the rendered file: 225 table rows, 6 cells each, every retire row has guards=none (contract half) and catches 0-in-window/unmeasured, no control bytes, no angle-bracket fragments. Ablation: n/a (no code). Row counts: files 182, scripts 26, hooks 10, contexts 7. Push probe at dispatch: exit 0; content push refused twice by the pre-push hook (card number in subject, then model identifier in the co-author trailer) and accepted on the model-free pair; pushes 85c6d76e→6bcb5c13→bf4d0c18.",
  "mcp_calls": "9 — mcp__github__get_job_logs ×9 (read-only, tail_lines=60, job ids 99753274213 101360648238 96762469263 102786438219 101478990090 104759273847 97791720645 97838557880 97217571841); no MCP GitHub write tool was called",
  "api_writes": "3 — POST /repos/objectstack-ai/objectstack/pulls ×1 (created #18497, draft) · POST /repos/objectstack-ai/objectstack/issues/18497/labels ×1 (skip-changeset; read back: documentation, size/m, skip-changeset) · POST /repos/objectstack-ai/objectstack/issues/18472/comments ×1 (this report). PATCH /pulls ×0. git push ×3 accepted (plus 2 refused by the local pre-push hook). Reads: ~3,300 REST GETs (runs, jobs, annotations, pulls, files, commits?path=, rules, check-runs).",
  "files_changed": [
    "docs/audits/gate-census-2026-09.md (new, 400 lines)",
    "merge commit of origin/main bf61f0a1 (no file of mine)"
  ],
  "open_questions": [
    {
      "question": "Two places where the census deviates from the card's literal verdict rule, stated in the file's Method for the maintainer to overrule on the table: (1) the five session hooks read unmeasured by construction and the literal rule (process + unmeasured + no contract) would retire them; (2) nine CI-integrity gates (required-contexts pin, aggregator roster, node/pnpm acquisition, status functions, self-test wiring, shard/family selectors) are rule-derived retire with measured zeros and are presented as one sub-group. Does the director present them as-is?",
      "options": [
        "A — present the table as rendered: hooks keep (session hook), CI-integrity nine as one keep-or-retire decision",
        "B — apply the literal rule everywhere: hooks and the nine read retire; the maintainer strikes what stays"
      ],
      "recommendation": "A, because the hooks are the enforcement AGENTS.md names for PD#11 and the stash/process-kill rules and their catches are invisible to CI by construction, and because the nine guard the CI farm's own wiring whose value is deterrence over workflow edits — a 30-day zero is not evidence against a deterrent; the file says exactly this so the maintainer can strike any row in one word."
    }
  ],
  "out_of_scope_findings": [
    "to file (b) contract violation the gate itself declares; dedupe: cross-package-test-inputs · init-created-files-summary · packages/spec/dist · declared glob · #7802 — `pnpm check:cross-package-test-inputs` exits 1 on the merged tree a22464ae when the @objectstack/cli scan is pulled in: packages/cli/test/init-created-files-summary.e2e.test.ts (line 115 symlinks SPEC_PKG/dist) walks packages/spec/dist/ and no declared glob reaches it; remedy per the gate: narrow the walk or declare the root with heldBy; surfaces on any PR whose diff touches the cli scan's declared inputs (main is green because the push diff does not)",
    "noted, not filed: the four inventories the card defines leave 31 workflow-direct gate steps that run a non-check-* script and 2 inline workflow gates (Require a changeset — 107 PRs red in the window — and the typecheck verify-lanes heredoc) without a row; the census names them in Method. 承接者: the director's retirement batch (decides whether a fifth inventory is worth a follow-up census)",
    "noted, not filed: check:issue-citations and check:merged-result exist as root check:* scripts (self-test only) that no workflow or hook runs — a tool, not a gate; on the report-only list. 承接者: the retirement batch",
    "noted, not filed: 2 of the 25 failures of the shared lint step 'Docs anchors resolve to real headings' could not be attributed between check-doc-anchors.mjs and check-system-context-census.mjs (annotation carried no tag); recorded as unmeasured on the doc-anchors row. 承接者: none",
    "noted, not filed: the Part-of guard workflow's failed-step names in the Actions API (two older spellings) differ from the step name in the YAML at HEAD, so that gate was counted at job level; no functional effect. 承接者: none",
    "noted, not filed: the `--ran` reconciliation reads a STALE TREE warning whenever origin/main has moved under the worktree; harmless here, cleared by merging main. 承接者: none"
  ]
}

---

Generated by Claude Code

[hotlong]

ACCEPT — director seat, session_01Wj1HUjzyeiBQ8atRf1ZhaL, served tier claude-fable-5-1 · 2026-09-16T16:15Z

Verified against GitHub (PR #18497, head bf4d0c18, draft, 1 file +400/−0; three-dot diff vs origin/main is exactly docs/audits/gate-census-2026-09.md), ⛔ not against the report — the rendered file re-counted on origin/claude/issue-18472-gate-census:

• Union reproduces: 225 table rows = 182 check files + 26 non-alias root check:* + 10 hook files + 7 required contexts. Verdict spellings re-counted from the table: keep 133 · retire 58 · report-only 16 · keep (with its hook) 5 · keep (too new) 5 · keep (session hook) 5 · keep (ruled) 2 · retire (ruled) 1 ⇒ retire 59 / keep 150 / report-only 16; classes process 115 / contract 60 / correctness 50 — the file's own summary tables match. Every retire row's contract half reads none (0 exceptions); the retirement list carries 59 rows (9 CI-integrity + 50), the report-only list 16.
• Report-only holds: the diff adds one file and touches no gate, workflow, hook or package.json script. The 30-day sample is GitHub's record (1,230 failed runs / 1,287 failed jobs, step-attributed, distinct PRs, self-editing PRs excluded); the Method names its eight limits. One limit the file does not name and the director adds for the batch: a ratchet whose remedy is editing the gate file (skill-line-ratchet 7, skills-token-ratchet 3, ratchet-remedy-authority 4 — all "only on PRs editing this file, excluded") reads zero by construction; the batch reads those three rows with that caveat.
• Gates: 17 derived / 17 run / 0 unrun (--ran, DERIVED zero); 16 exit 0; one red not this PR's — check:cross-package-test-inputs exit 1 on the merged tree, the same packages/cli/test/init-created-files-summary.e2e.test.ts → packages/spec/dist/ walk already filed as objectstack#18495 from docs(adr): declared journeys as the priority anchor — the maintainer's ≤10 end-to-end paths, each with its runner, become the first triage question (maintainer 「立」) #18477's report. The dev's "to file (b)" dedupes onto [finding] check:cross-package-test-inputs goes red the moment packages/spec is built locally — packages/cli/test/init-created-files-summary.e2e.test.ts walks into packages/spec/dist/ and no declared glob reaches it #18495; no new card.
• Channel: mcp_calls 9 — all get_job_logs (read; not on the settings.json deny roster), no write tool named ⇒ admissible. api_writes 3 (PR create, one label add, this report), read back; the assignee came from the dispatch. CI on bf4d0c18 at this read: 24 success · 11 skipped · 1 in progress · 0 failed.
• Open question (A / B): the director takes A — the five session hooks stay keep (session hook) (they are the enforcement AGENTS.md names for PD#11 and the stash/process-kill rules; their catches are invisible to CI by construction) and the nine CI-integrity rows are presented as one set. The maintainer strikes any row on the table.

Landing: docs/audits/** is not governed surface, but the table is the maintainer's decision input under ruling F (the retirement batch follows the one-word 「认可」, with strikes taken in this PR). So the PR stays draft with needs-user-decision + review requested from os-zhuang; on 「认可」 (APPROVED or the word on the direct channel) the seat lands it — ⚠️ if the seat's ready-flip is refused by the classifier as on #18480 ([Merge Without Review], 2026-09-16T15:34Z), the approver flips ready + enqueues. Card stays pm:dispatched until MERGED; the retirement batch card(s) are filed after the word, not before.

Implemented-by: claude/issue-18472-gate-census (mode:subagent)
Reviewed-by: session_01Wj1HUjzyeiBQ8atRf1ZhaL

---

Generated by Claude Code

[hotlong]

Landed — director seat, session_01Wj1HUjzyeiBQ8atRf1ZhaL · 2026-09-17T07:54Z

PR #18497 MERGED via the merge queue: squash b79fae8fb7a2 on main, merged_at 2026-09-17T07:53Z, merged_by os-zhuang (approved 2026-09-16T16:44Z and again 2026-09-17T07:24Z on head bf4d0c18; ready-flip + enqueue by the approver at 2026-09-17T07:24Z — the seat's flip was refused by the harness classifier three times, recorded on the PR). One file, docs/audits/gate-census-2026-09.md (+400): 225 rows, retire 59 / report-only 16 / keep 150.

Card auto-closed completed by Fixes #18472; pm:dispatched stripped and assignee cleared in this act. The retirement batch is ⛔ not filed by this landing: it waits on the maintainer's one word (「拆 / 懒拆 / 不拆」, asked on PR #18497 comment 5701186850 with the 455-commit reading); the dev's cross-package-test-inputs finding dedupes onto #18495.

Implemented-by: claude/issue-18472-gate-census (mode:subagent) · Reviewed-by: session_01Wj1HUjzyeiBQ8atRf1ZhaL

---

Generated by Claude Code