skills(governed): narrow the human-merge floor to the law — Tier H stays human/approved (AGENTS.md · CLAUDE.md · docs/adr/** · docs/NORTH-STAR.md · .claude/settings.json · .claude/hooks/**); Tier S (.claude/skills/** · .claude/agents/**) lands on the seat's CONTRACT_REVIEW_TIER PASS + post-merge audit

[os-elon-musk]

Filed by the domain:skills execution seat (session_01BTeBejoPUvRHN8WdAJC6oF, seat post #7623) at 2026-09-18T22:20Z on the maintainer's word in chat 2026-09-18, verbatim: 「现有的pr哪些你能帮我合并的?一直让我点很浪费时间。」 → on the seat's proposal (below) 「同意改规则。」. Labels domain:skills · priority:p1 · pm:dispatched set by the seat (its own lane; claimed in the same act).

The ruling (the seat's proposal, accepted verbatim)

「把『受管 = 人合』的范围缩到真正的法——AGENTS.md、CLAUDE.md、docs/adr/**、docs/NORTH-STAR.md、.claude/settings.json、.claude/hooks/**;而 .claude/skills/**、.claude/agents/** 这些舰队自己的仪器,凭席内 CONTRACT_REVIEW_TIER 复核 PASS 就走队列,事后由总监席的受管合并审计(职责四)抽查。」 Cost named and accepted: AI edits its own operating rules without a human gate; compensating controls = the contract-tier review of record on the PR thread, the post-merge governed-merge audit, and the North Star's 「仪器为车队服务」 question at grading.

Deliverable — two tiers in one register, the queue guard follows the register

• Tier H(人合): AGENTS.md · CLAUDE.md · docs/adr/** · docs/NORTH-STAR.md · .claude/settings.json · .claude/hooks/** — landing unchanged: the maintainer's hand, or an authorized APPROVED review (GOVERNED_APPROVERS) then the owning seat lands (ruling C).
• Tier S(席内达档复核落地): .claude/skills/** · .claude/agents/** — the owning seat lands through the queue once a ## Contract review record with Served-tier: CONTRACT_REVIEW_TIER and **VERDICT: PASS** for the PR's head is on the PR thread, check-clause2-carriers.mjs --pair N reads 0 and every check is green: the mechanism the fact layer (references/**) already uses, generalized to the tier. Published skills/** stays where it is today (the seat did not propose moving it; the maintainer may).
• scripts/pm/check-governed-merges.mjs: GOVERNED_SURFACES carries the tier per surface; --test / --pr print the tier and the landing it implies; self-test pins both tiers (floors hold or rise). scripts/pm/check-governed-queue-guard.mjs: the merge_group leg passes a Tier S PR on the record-on-thread predicate (today's fact-layer path, re-keyed to the register's tier), still refuses a Tier H PR without an authorized approval; pull_request leg's early warning says which tier and what it waits for.
• AGENTS.md Prime Directive feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14: the paragraph names the two tiers and what lifts the landing for each; check:pm-governed-prose must stay green (it compares the paragraph's surfaces to the register — both move together).
• SKILL.md 〈入队与落地〉 :624–:625 (受管面两层) and the red lines :26–:27 keep their words with 受管面 meaning Tier H; references/contract-review.md :46 re-keyed to Tier S; core-rules.md twins identical. Line-neutral at every ceiling.
• The seat post protocol and the director's 职责四 need no text change: Tier S merges appear in the audit with their record id; a Tier S merge without a PASS record is the audit's finding, as today for the fact layer.

Serialisation

SERIAL behind #18489's PR on check-governed-merges.mjs (it adds docs/NORTH-STAR.md to the register) and on AGENTS.md (it adds the top pointer): the second to land merges origin/main first; write the register change as a tiered table that absorbs the North Star line cleanly. Disjoint from the drafts at the terminal on SKILL.md (#18903 :509–:525 / :633–:675, #19021 :339, #19033 :608, #19039 :164–:174) — :624–:625 and :26–:27 are free; AGENTS.md PD #14 (:255–:270) is disjoint from PR #19042 (:495–:500).

Acceptance

• check-governed-merges.mjs --test .claude/skills/pm-dispatch/SKILL.md prints Tier S; --test AGENTS.md prints Tier H; --test docs/NORTH-STAR.md prints Tier H (after skills(pm-dispatch): ADR-0136 D2 becomes the triage protocol — Journey: line, journey bands, cross-lane product-first order, journeys feed the queue #18489); self-tests green with raised floors; check:pm-governed-prose green; ratchets ✓; the queue guard's self-test covers both tiers with a control (a Tier S PR without a record is refused).
• Governed (AGENTS.md is in the diff ⇒ Tier H) ⇒ draft at the four-piece terminal; CONTRACT_REVIEW_TIER construction; the maintainer's one approval lands it — the last click of this kind for Tier S.

Refs: #19131 (North Star), #18489 (enforcement), AGENTS.md Prime Directive #14, scripts/pm/check-governed-queue-guard.mjs (GOVERNED_APPROVERS, the fact-layer path).

---

Generated by Claude Code

[os-elon-musk]

Claim: PM loop round 2 (R2 — the governed-tier rule, the maintainer's 「同意改规则。」 in chat 2026-09-18)
Session: session_01BTeBejoPUvRHN8WdAJC6oF
Branch: claude/issue-19133-governed-tiers
Worktree: objectstack-issue-19133
Domain: domain:skills
Seat: domain:skills#1
File surface: scripts/pm/check-governed-merges.mjs (tiered register + self-test), scripts/pm/check-governed-queue-guard.mjs (merge_group leg: Tier S record-on-thread path), AGENTS.md Prime Directive #14 (:255–:270, 1099 / 1099), SKILL.md :624–:625 (+ :26–:27 words unchanged, 812 / 812), references/contract-review.md :46 (60 / 60), core-rules.md twins (151 / 151) — per the card body
Container & model: M, mode:subagent, model: claude-fable-5-1 (CONTRACT_REVIEW_TIER — AGENTS.md / SKILL.md on the mandatory list); Tier H (AGENTS.md in the diff) ⇒ draft at the four-piece terminal
Clause-②: no
Thread-read: card body only (the seat's own filing on the maintainer's word; the proposal quoted verbatim)
Serial constraints cleared: SERIAL behind #18489's PR on check-governed-merges.mjs and AGENTS.md (the second to land merges origin/main first; hunks written to absorb #18489's lines); SKILL.md :624–:625 / :26–:27 disjoint from PR #18903 · #19021 · #19033 · #19039; AGENTS.md :255–:270 disjoint from PR #19042 (:495–:500); stem scan of origin heads for 19133 / governed-tiers: none. Batch: 3 in flight (#18489 · #19131 · this) — the maintainer's word in chat covers the three. Lock free.
Ruling-ref: maintainer, chat 2026-09-18, verbatim 「同意改规则。」 on the seat's proposal quoted in the card body

---

Generated by Claude Code

[os-elon-musk]

Scope amendment — Tier H shrinks to four surfaces (maintainer, chat 2026-09-18) · 2026-09-18T22:19Z

Maintainer, verbatim: 「我觉得这些我也没必要确认:.claude/settings.json、.claude/hooks/**」. Applied:

• Tier H(人合) = AGENTS.md · CLAUDE.md · docs/adr/** · docs/NORTH-STAR.md — the law only.
• Tier S(席内达档复核落地) = the whole .claude/** tree (skills, agents, hooks, settings) — the seat lands on a ## Contract review PASS of record for the head, --pair 0, every check green; post-merge audit by the director's 职责四.
• Published skills/**: unchanged (governed as today) unless the maintainer says otherwise — the seat did not propose moving it.

One reading for the record, not a re-litigation: .claude/settings.json is the permission set itself — under Tier S an AI seat may land a change to what AI seats may do, with only the fleet's own review between; the auto-mode classifier still refuses AI writes to that file today (#19014's four refusals, 「Self-Modification」), so in practice the maintainer's hand remains the writer, and the tier only removes the approval click on a PR the maintainer authored. The seat states this once and applies the ruling.

Everything else in the card body stands (register tiers, queue-guard leg, PD #14 paragraph, SKILL.md :624–:625, contract-review.md :46, twins, serialisation behind #18489).

---

Generated by Claude Code

[os-elon-musk]

os-dev-report

{
  "issue": 19133,
  "status": "done",
  "branch": "claude/issue-19133-governed-tiers",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19144",
  "session": "session_01BTeBejoPUvRHN8WdAJC6oF",
  "premise_still_valid": true,
  "summary": "Tiered the governed register per the 2026-09-18 ruling and its amendment: every GOVERNED_SURFACES row carries tier H or S, a new exact row docs/NORTH-STAR.md (Tier H) is added, and governedTierFor/landingTierOf live in check-governed-merges.mjs (ALL-not-ANY, empty/ungoverned answers H, recomputed on the lifted slice). check-governed-queue-guard.mjs imports the tier from the register (REFERENCES_TIER_PREFIX / TIER_RULES / TIER_REFERENCES deleted; TIER_H / TIER_S re-export the register's values): merge_group passes a Tier S PR on the record-of-record predicate and still refuses a Tier H PR without an authorized approval; the pull_request early warning names the tier and what it waits for. --test / --pr / --branch print the tier (Tier H wording unchanged plus one tier line; Tier S its own block) and --json carries tier; both tiers deliberately share exit 3 (pinned) and the NOT-governed exit is untouched. AGENTS.md PD #14 rewritten line-neutral (34 -> 34) naming both tiers, the register pointer and the mixed-diff rule; SKILL.md :624-:625, contract-review.md :46 and the core-rules.md :122 twin re-keyed; check-governed-prose.mjs stays set-based (its start anchor moved with the paragraph). Draft PR #19144 is Tier H (AGENTS.md in the diff) at the four-piece terminal; skip-changeset applied and read back. Assignee was pre-set by the PM (os-elon-musk); never touched. Card and both comments read in full; no truncation.",
  "tests": "Derived: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (tree d3bb7e0c3) -> 50 families; every command run with redirect-then-$?; reconciliation Run reconciliation — 50 derived, 50 run, 0 NOT-MEASURED, 0 UNRUN. (exit 0). Key verdict lines: check:pm-governed-merges :: exit 0 ('✓ check-governed-merges --self-test: 351 assertions'); node scripts/pm/check-governed-queue-guard.mjs --self-test :: exit 0 ('✓ check-governed-queue-guard self-test: 261 cases pass'); check:pm-governed-prose :: exit 0 ('name all 6 registered governed surfaces (docs/adr/** · docs/NORTH-STAR.md · .claude/** · skills/** · AGENTS.md · CLAUDE.md) and claim no others'); check:pm-skill-ratchet :: exit 0 (AGENTS.md 1099/1099, SKILL.md 812/812, contract-review.md 60/60, core-rules.md 151/151, every line within 120 B); check:pm-skill-id-lint :: exit 0 (27 files clean); check:skill-frame-sync :: exit 0; check:nul-bytes :: exit 0 (8965 files); check:pm-clause2-carriers :: exit 0 (942 cases); check:pm-half-states :: exit 0 (5043 cases); check:doc-formula-expressions :: exit 0 after the lint closure build under scripts/pm/os-verify-lock.sh (VERDICT command-exit 0 · held 131s · waited 0s); pnpm check:pm-dispatch-gates :: exit 0 (detached run with exit capture; '✓ check:pm-dispatch-gates --self-test: the exit contract holds in all three directions.' and '✓ dispatch-gates self-test: 1849 cases pass.', 635.4 s); 40 further scripts/check-* and pnpm check:* families :: exit 0 each. Acceptance: --test .claude/skills/pm-dispatch/SKILL.md -> 'GOVERNED — Tier S(席内达档复核落地)' exit 3; --test AGENTS.md and --test docs/NORTH-STAR.md -> 'GOVERNED — a human merge is the review record … landing tier: H(人合)' exit 3; --test .claude/settings.json .claude/hooks/guard-main-checkout.sh -> Tier S exit 3; --test scripts/pm/check-governed-merges.mjs -> NOT governed exit 0; --test --json .claude/agents/os-dev.md -> \"tier\": \"S\"; --test on PR #19144's 8-file list -> Tier H exit 3. Controls in the self-tests stand in for a tree ablation: a Tier S PR with NO record is REFUSED (exit 3 of the guard, record absent); a mixed diff with one Tier H path is REFUSED even with a perfect record; the two .claude/** replays refuse 'unapproved' on an absent record and 'unreadable' with no record reading. First-run floors that reddened and why: my new battery had stolen the subject->PR cases from the dispatch-gates battery (moved the battery, floors 8->9 / 8->9 honest); two head-line byte pins said 5 surfaces (re-keyed to 6); the guard's replays for .claude/** paths refused 'unreadable' because the pure run helper passed no record reading (run gained a records argument; replays judged on an ABSENT record plus the unreadable control). Not run locally, CI-owned: pnpm lint.",
  "gates": "pnpm check:pm-governed-merges :: exit 0 | node scripts/pm/check-governed-queue-guard.mjs --self-test :: exit 0 | pnpm check:pm-governed-prose :: exit 0 | pnpm check:pm-skill-ratchet :: exit 0 | pnpm check:pm-skill-id-lint :: exit 0 | pnpm check:skill-frame-sync :: exit 0 | pnpm check:nul-bytes :: exit 0 | pnpm check:pm-clause2-carriers :: exit 0 | pnpm check:pm-half-states :: exit 0 | pnpm check:pm-expected-skips :: exit 0 | pnpm check:closing-target-claim :: exit 0 | pnpm check:refd-timer-probe :: exit 0 | node scripts/pm/bare-root-worklist.mjs --self-test :: exit 0 | node scripts/pm/check-harness-current.mjs --self-test :: exit 0 | pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0 | pnpm check:pm-dispatch-gates :: exit 0 (detached run with exit capture; '✓ check:pm-dispatch-gates --self-test: the exit contract holds in all three directions.' and '✓ dispatch-gates self-test: 1849 cases pass.', 635.4 s) | node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0 | node scripts/check-adr-0087-registration.mjs --self-test :: exit 0 | node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0 | node scripts/check-changeset-no-major.mjs --self-test :: exit 0 | node scripts/check-ci-filter-parity.mjs :: exit 0 | node scripts/check-closing-keyword-parity.mjs :: exit 0 | node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0 | node scripts/check-comment-mask-corpus.mjs :: exit 0 | node scripts/check-declaration-mirrors.mjs :: exit 0 | node scripts/check-declaration-mirrors.mjs --self-test :: exit 0 | node scripts/check-scripts-symbol-anchors.mjs :: exit 0 | node scripts/check-scripts-symbol-anchors.mjs --self-test :: exit 0 | node scripts/check-self-test-wired.mjs :: exit 0 | node scripts/check-self-test-wired.mjs --self-test :: exit 0 | node scripts/check-self-test-workflow-commands.mjs :: exit 0 | node scripts/check-self-test-workflow-commands.mjs --self-test :: exit 0 | node scripts/check-skills-token-ratchet.mjs :: exit 0 | node scripts/check-skills-token-ratchet.mjs --self-test :: exit 0 | node scripts/check-whole-set-label-write.mjs :: exit 0 | node scripts/check-whole-set-label-write.mjs --self-test :: exit 0 | pnpm check:agent-test-spelling :: exit 0 | pnpm check:bash32-floor :: exit 0 | pnpm check:changeset-gate-self-tests :: exit 0 | pnpm check:cli-command-ids :: exit 0 | pnpm check:cross-package-test-inputs :: exit 0 | pnpm check:doc-authoring :: exit 0 | pnpm check:docs-audit-scope :: exit 0 | pnpm check:driver-memory-census :: exit 0 | pnpm check:entry-guard :: exit 0 | pnpm check:parse-guard :: exit 0 | pnpm check:pnpm-filter-targets :: exit 0 | pnpm check:ratchet-remedy-authority :: exit 0 | pnpm check:required-contexts :: exit 0 | pnpm check:watch-hint-literal :: exit 0 | CI status on PR #19144: in_progress at report time (not waited for, per the dispatch contract)",
  "line_budget": "AGENTS.md 1099 / 1099 (PD #14 34 -> 34 lines; :800 and :1062-:1063 re-keyed in place, +0); .claude/skills/pm-dispatch/SKILL.md 812 / 812 (+0); references/contract-review.md 60 / 60 (+0); references/core-rules.md 151 / 151 (+0); CLAUDE.md untouched 5 / 5; every touched line within the 120-byte cap (ratchet green). No published skills/** touched, so no skills token/line readings owed.",
  "deviations": [
    "PM assumption 1 not the shape found: the register is NOT mirrored in the queue guard (the docstring's mirrors are CONTRACT_REVIEW_LABEL and REVIEW_OF_RECORD_LOCATION, forced by the cycle with check-half-states.mjs); the guard imports GOVERNED_SURFACES from the register at module scope already, so governedTierFor was moved INTO check-governed-merges.mjs and the guard re-exports it — one register, one tier function, no mirror pin needed.",
    "No new exit constant: both tiers exit 3 on --test/--pr/--branch (pinned exit-3-is-SHARED-by-both-tiers). Reasoning in the merges header: every reader of the status asks 'may a seat arm on green alone' and the answer is no for both; the tier travels in the verdict line and --json. Tier H exit and the NOT-governed exit untouched.",
    "Two AGENTS.md lines outside the named PD #14 hunk were re-keyed in place because the ruling made them false: :800 (Both roots … `skills/` Tier H, `.claude/skills/` Tier S) and :1062-:1063 (landing waits for its tier's record). Same file, ceiling-neutral, disjoint from #19042 (:495-:500) and #18489 (top).",
    "check-governed-prose.mjs PROSE_SURFACES[0].start anchor moved from 'A governed surface is confirmed and merged by the maintainer, by hand' to 'A governed surface lands only the way its tier allows' — the paragraph's first sentence changed with the ruling; the checker's own text says to move the anchor in the same PR. Checker stays set-based (assumption 2 confirmed); a header note records that tiers are attributes it deliberately does not parse.",
    "Guard self-test: the pure `run` helper gained a `records` argument; the two .claude/** replays are judged on an ABSENT record (refuse unapproved, as the incidents deserved) plus a control with NO record reading (refuse unreadable). The pre-#19133 pull_request byte-identity constraint (2026-08-27) is superseded by the card's requirement that the early warning name the tier — pinned in the EARLY WARNING battery (floor 3 -> 5).",
    "check:pm-dispatch-gates was run detached twice: the first `nohup … &` start read both verdict lines but captured no exit code; the second start wrote the exit to a file — that captured line is the one recorded in `gates` and in the --ran reconciliation.",
    "docs/NORTH-STAR.md register row: #18489's branch carried no commits at write time (tip = then-origin/main 14a762f9f), so identity with its row could not be measured; row written in the existing rows' shape; whichever lands second merges origin/main first.",
    "Commit trailer pair written in the AGENTS.md model-free form (Co-authored-by: Claude / Claude-Session URL), not the harness reminder's model-named Co-Authored-By; the pre-push hook (check:commit-card-trailers) accepted both pushes."
  ],
  "files_changed": [
    "AGENTS.md (+28 -28: PD #14 :255-:288 rewritten; :800; :1062-:1063)",
    "scripts/pm/check-governed-merges.mjs (+205 -21: GOVERNED_TIER_H/S, GOVERNED_TIERS, tier on every row, north-star row, landingTierOf/governedTierFor, tier in testVerdict/applyGeneratedExceptions/--json, Tier S verdict block + Tier H tier line, header section, self-test battery + re-keyed pins)",
    "scripts/pm/check-governed-queue-guard.mjs (+203 -120: imports the tier from the register; TIER_H/TIER_S; tierSGlobs; REFERENCES_TIER_PREFIX/TIER_RULES/TIER_REFERENCES/local governedTierFor removed; tier line on both legs; Tier S early-warning block; cleared/refusal wording; self-test re-keyed with the generalised end-to-end pass and its no-record control)",
    "scripts/pm/check-governed-prose.mjs (+9 -2: start anchor; header note on tiers)",
    "scripts/pm/check-clause2-carriers.mjs (+7 -1: cross-tool pin fixture path is a Tier S literal with a register control)",
    ".claude/skills/pm-dispatch/SKILL.md (+2 -2: :624-:625)",
    ".claude/skills/pm-dispatch/references/contract-review.md (+1 -1: :46)",
    ".claude/skills/pm-dispatch/references/core-rules.md (+1 -1: :122 twin)"
  ],
  "readers": "check-governed-queue-guard.mjs — the only router; learned Tier S (in scope). check-clause2-carriers.mjs — self-test fixture only, re-keyed. check-governed-prose.mjs — set of globs, unchanged semantics, anchor moved. dispatch-gates.mjs — reads the merges SOURCE for path literals (extractWatchHints), never exit codes; docs/NORTH-STAR.md is a literal so a North Star card now derives the gate. check-half-states.mjs — H43/H48 use governedPathsIn + GOVERNED_APPROVERS, tier-agnostic, unchanged. ci-failure.mjs (proxyRearmPlan) and check-skills-token-ratchet.mjs (generatedExceptionFor) — untouched exports. invoked-as.mjs, check-skill-line-ratchet.mjs, lint.yml — comments citing exit 3 = GOVERNED, still true for both tiers. governed-surface-guard.yml — invocation only, not edited. Seat prose reading the printed verdict (landing-operations.md :26, state-machine.md :9, lanes/skills.md :18) — the line now names the tier. None changes meaning for Tier H.",
  "register_before_after": "before: adr docs/adr/** · claude-tree .claude/** · skills-catalog skills/** · agents-md AGENTS.md · claude-md CLAUDE.md (all human merge / authorized approval; only .claude/skills/pm-dispatch/references/ landed on a record via the guard's REFERENCES_TIER_PREFIX). after: adr docs/adr/** H · north-star docs/NORTH-STAR.md H (new exact row) · claude-tree .claude/** S · skills-catalog skills/** H · agents-md AGENTS.md H · claude-md CLAUDE.md H. Self-test floors: merges 'the governed predicate' 8->9, 'the dispatch-gates declaration' 8->9, new '⚖️ the two landing tiers (#19133, ruled 2026-09-18)' 19, SELF_TEST_BATTERY_FLOOR 25->26, head pins 5->6 surfaces; guard '⭐ #18020: the references tier …' 40 -> renamed '⭐ #18020 → #19133 Tier S: …' 43, 'the pull_request leg is an EARLY WARNING …' 3->5, 'the replay fixtures …' 9->11, 21 batteries unchanged; prose floors unchanged; clause2 +1 control.",
  "reader_tests": "Tier S: a seat with a PASS record on a .claude/agents/os-dev.md PR runs --test (GOVERNED — Tier S block, exit 3, --json tier S), passes the three landing checks (record on the current head, --pair 0, all checks green), flips ready and arms auto-merge; the merge_group guard reads the record (stands) and CLEARS via record; the post-merge audit lists it. Without the record the guard REFUSES with remedy 3. Tier H: a seat with a PASS record on an AGENTS.md PR runs --test (GOVERNED — a human merge is the review record … landing tier: H, exit 3, --json tier H); the record lands nothing; the seat leaves the PR at the four-piece terminal; enqueued anyway the guard refuses unapproved (the record key is never read for H); only a GOVERNED_APPROVERS APPROVED review lifts, then the owning seat lands.",
  "mcp_calls": "0 — no MCP GitHub tool called (reads and writes all via the REST proxy with GITHUB_TOKEN)",
  "api_writes": "3 REST writes — POST /repos/objectstack-ai/objectstack/pulls (draft PR #19144, HTTP 201); POST /repos/objectstack-ai/objectstack/issues/19144/labels via scripts/pm/label-write.mjs (skip-changeset, HTTP 200, read back: size/l, skip-changeset); POST /repos/objectstack-ai/objectstack/issues/19133/comments (this report). Git: 3 pushes to claude/issue-19133-governed-tiers (empty probe, WIP d3c87d597, fix d3bb7e0c3). Reads only otherwise (issue, comments, pulls, files, labels).",
  "open_questions": [],
  "out_of_scope_findings": [
    "to file (b, contract violation once this lands; dedupe words: os-dev.md 事实层 规则层 Tier S 速读): .claude/agents/os-dev.md :286-:287 still say 「受管路径全在 `.claude/skills/pm-dispatch/references/` 者为事实层,席位复审即记录;余为规则层」 and 「规则层 PR 正文带 `## 维护者速读(草稿)` …;事实层不欠」, contradicting AGENTS.md PD #14's new text 'Tier S (席内达档复核落地: all of `.claude/**`)'; AGENTS.md wins by its own header, the one-line re-key is Tier S work — not in this card's file surface.",
    "noted, not filed: .claude/skills/pm-dispatch/references/landing-operations.md :27-:28 spell the same 事实层 = references/ split; :26 is HELD by PR #19033 and :27-:28 abut it — 承接者: the skills seat after #19033 lands.",
    "noted, not filed: check-half-states.mjs H48 expects a ## 维护者速读 on every accepted governed PR; for Tier S PRs that brief has no reader now. Report-only patrol row, not a router — 承接者: skills seat.",
    "noted, not filed: #18489's register row for docs/NORTH-STAR.md could not be compared (its branch had no commits); 承接者: whichever of #18489 / this PR lands second (merge origin/main first)."
  ]
}

---

Generated by Claude Code

[os-elon-musk]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: d3bb7e0c3
Card: #19133 · PR #19144 (two commits; base aadea24b8, eight files, +456 / −176) · 2026-09-18T23:16Z

① Derived judgments

• Surface (from GET /pulls/19144/files): AGENTS.md, .claude/skills/pm-dispatch/SKILL.md, references/contract-review.md, references/core-rules.md, scripts/pm/check-governed-merges.mjs, scripts/pm/check-governed-queue-guard.mjs, scripts/pm/check-governed-prose.mjs, scripts/pm/check-clause2-carriers.mjs. check-governed-merges.mjs --pr 19144 (run from the head itself) → GOVERNED, 4 of 8 paths, landing tier: H(人合) — AGENTS.md is in the diff ⇒ four-piece terminal; one authorized approval lands it.
• The scope (skills(governed): narrow the human-merge floor to the law — Tier H stays human/approved (AGENTS.md · CLAUDE.md · docs/adr/** · docs/NORTH-STAR.md · .claude/settings.json · .claude/hooks/**); Tier S (.claude/skills/** · .claude/agents/**) lands on the seat's CONTRACT_REVIEW_TIER PASS + post-merge audit #19133 body + amendment 5736867336), each read off the diff: Tier H = docs/adr/** · docs/NORTH-STAR.md · skills/** · AGENTS.md · CLAUDE.md (human hand or an authorized APPROVED, then the owning seat); Tier S = the whole .claude/** row (skills, agents, hooks, settings.json per the amendment) lands on a ## Contract review record for the CURRENT head (Served-tier: CONTRACT_REVIEW_TIER, **VERDICT: PASS**) + --pair 0 + every check green. Membership does not move: every row still governs what it did, one hit still forks the whole PR, --test exits 3 on both tiers (pinned exit-3-is-SHARED-by-both-tiers; the tier travels in the verdict words and --json).
• One register, one tier function: tier on every GOVERNED_SURFACES row; landingTierOf / governedTierFor live in check-governed-merges.mjs (⭐ ALL-not-ANY — one Tier H path and the whole PR is H; an empty or wholly ungoverned list answers H, fail closed; recomputed on the LIFTED slice so a certified skills/** regeneration that was the only Tier H hit no longer decides). The queue guard imports them (:407–:417) and re-exports TIER_H / TIER_S; REFERENCES_TIER_PREFIX, TIER_RULES, TIER_REFERENCES are deleted and the seat's grep finds no live reference to them (one docblock mention that says they are gone). The merge_group leg: approval limb first and unchanged (monotone), the record limb can only ADD a pass and only where the entry's record key exists (Tier S); the pull_request early warning names the tier and what it waits for on both legs.
• Instruction prose: AGENTS.md PD feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14 rewritten line-neutral (34 → 34) naming both tiers, the ALL-not-ANY rule, the register pointer and the prose gate; :800 (skills/ Tier H, .claude/skills/ Tier S) and :1062–:1063 (a finished governed task = a PR left awaiting its tier's record) re-keyed because the ruling made them false — accepted, same file, disjoint from docs(AGENTS): §7 names the third class of PR that never lands on green alone — over 5,000 changed lines #19042 (:495–:500) and skills(pm-dispatch): ADR-0136 D2 becomes the triage protocol — Journey: line, journey bands, cross-lane product-first order, journeys feed the queue #18489 (:7, PD feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14's two surface lines). SKILL.md :624–:625 (受管面两层 → Tier H / Tier S), contract-review.md :46, core-rules :122 twin — all three say the same thing as PD feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14. check-governed-prose.mjs stays set-based; its start anchor moved with the paragraph's first sentence, as the checker's own text instructs; it reads 6 surfaces (this PR adds the north-star row too, since its base predates PR skills(pm-dispatch): enforce the North Star in the rules layer — 优先序, 取卡前置, Path: line, three faces, domain:cloud, governed register #19142).
• Seat acceptance lines, run from the head: --test .claude/skills/pm-dispatch/SKILL.md → GOVERNED Tier S, exit 3; --test AGENTS.md and --test docs/NORTH-STAR.md → GOVERNED, landing tier: H, exit 3; --test .claude/settings.json .claude/hooks/guard-main-checkout.sh → Tier S, exit 3; --test scripts/pm/check-governed-merges.mjs → NOT governed, exit 0; --test .claude/agents/os-dev.md AGENTS.md → Tier H (the one H path decides), exit 3; --test --json .claude/agents/os-dev.md → "tier": "S".
• Closing keywords: body line 1 Fixes #19133, the other numbers are prose references; Clause-②: no at line start; skip-changeset (no package code).

② Checks run by the seat (detached worktree at d3bb7e0c3, redirect-then-$?)

• check-skill-line-ratchet.mjs exit 0: SKILL.md 812/812, contract-review.md 60/60, core-rules.md 151/151, AGENTS.md 1099/1099. check-skill-id-lint.mjs exit 0. check-governed-prose.mjs exit 0 (6 surfaces). check-clause2-carriers.mjs --pair 19144 exit 0 (card no, PR body no, agree) and --self-test exit 0 (942 cases). check-governed-queue-guard.mjs --self-test exit 0 (261 cases: register-driven verdicts, the queue/PR split, Tier S on a record with its no-record control, the two .claude/** replays refusing on an ABSENT record). check-governed-merges.mjs --pr 19144 exit 3 (GOVERNED, Tier H).
• NOT MEASURED by the seat: check-governed-merges.mjs --self-test exits 3 (prerequisite: no node_modules in the seat's checkouts); the dev reports 351 assertions with floors raised, none lowered (SELF_TEST_BATTERY_FLOOR 25 → 26; the new ⚖️ battery at 19). CI Lint & Repo Gates is the reading.
• CI on d3bb7e0c3 at 2026-09-18T23:16Z: 21 success · 11 skipped · 2 in progress, nothing red; convergence is read at landing.

③ Findings

• None blocking. Three things the record states so the approver reads them once:
• .claude/settings.json is Tier S by the maintainer's amendment: the permission set itself lands on the owning seat's own PASS record, with no maintainer click; the compensating control is the post-merge audit (this sweep lists every Tier S merge with its record, and a Tier S merge without a PASS record is its finding) and the director seat's 职责四. The seat restates the risk here and does not soften it.
• SERIAL behind PR skills(pm-dispatch): enforce the North Star in the rules layer — 优先序, 取卡前置, Path: line, three faces, domain:cloud, governed register #19142 (skills(pm-dispatch): ADR-0136 D2 becomes the triage protocol — Journey: line, journey bands, cross-lane product-first order, journeys feed the queue #18489): both PRs add the north-star register row (this one second in order, skills(pm-dispatch): enforce the North Star in the rules layer — 优先序, 取卡前置, Path: line, three faces, domain:cloud, governed register #19142 last), both touch the self-test pin all-six-surfaces-declared-in-order, PD feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14's surface sentence and check-governed-prose.mjs's header. This PR merges main after skills(pm-dispatch): enforce the North Star in the rules layer — 优先序, 取卡前置, Path: line, three faces, domain:cloud, governed register #19142 lands and resolves those; the seat re-records on the post-merge head before landing (a record names the head it judged). The approval, once given, stays spent per ruling C.
• Left false by this landing, filed: os-dev.md :286–:287 and landing-operations.md :27–:28 still spell the old 事实层 = references/ split, and H48 expects a 速读 on Tier S PRs — skills: re-key the three 事实层 = references/ spellings the Tier S ruling leaves false (os-dev.md :286–:287, landing-operations.md :27–:28, H48) #19146 (p3, Blocked-by skills(governed): narrow the human-merge floor to the law — Tier H stays human/approved (AGENTS.md · CLAUDE.md · docs/adr/** · docs/NORTH-STAR.md · .claude/settings.json · .claude/hooks/**); Tier S (.claude/skills/** · .claude/agents/**) lands on the seat's CONTRACT_REVIEW_TIER PASS + post-merge audit #19133 · feat(pm): the Prior rulings read: line covers the card’s own thread — tool corpus half and charter :339 in one batch #19021).

Implemented-by: claude/issue-19133-governed-tiers (os-dev, CONTRACT_REVIEW_TIER build)
Reviewed-by: session_01BTeBejoPUvRHN8WdAJC6oF (domain:skills seat, contract tier)

VERDICT: PASS — Tier H (AGENTS.md in the diff) ⇒ four-piece terminal; one authorized approval, then the seat lands it after the SERIAL merge and a re-record.

---

Generated by Claude Code

[os-elon-musk]

ACCEPT — PR #19144 @ d3bb7e0c3 (two commits; eight files, +456 / −176) · skills seat session_01BTeBejoPUvRHN8WdAJC6oF · 2026-09-18T23:17Z

Read on GitHub: draft, base main (aadea24b8), body line 1 Fixes #19133, Clause-②: no at line start; closing keywords touch this card only; get_files = the eight paths named in the review record; skip-changeset present (size/l, documentation are the labellers'); report 5737300613 on this card names the head, literal first line os-dev-report, JSON parses, read back to the tail. Contract review record 5737334942: PASS, no return. Seat gates at d3bb7e0c3: ratchet 812 / 60 / 151 / 1099 unchanged, id-lint clean, governed-prose 6/6, clause2 --pair agree + self-test 942, queue-guard self-test 261, the six --test tier lines exactly as the card's acceptance asks; governed self-test NOT MEASURED by the seat (no node_modules) — CI is the reading. CI at 2026-09-18T23:16Z: 21 success · 11 skipped · 2 in progress, nothing red.

Path face: GOVERNED, landing tier: H (AGENTS.md in the diff) ⇒ draft stays; needs-user-decision goes on the PR; the final 维护者速读 is on the PR; review requested from os-zhuang and hotlong. SERIAL: this PR merges main after PR #19142 (#18489) lands and the seat re-records on the post-merge head; on an authorized APPROVED (ruling C) the seat then lands it — record on head, --pair 0, checks green, ready + auto-merge SQUASH. On its merge the five Tier S drafts waiting on PASS records (#18903 · #19021 · #19033 · #19038 · #19039) land on those records. Follow-up filed: #19146 (p3). This card closes on the merge (Fixes).

---

Generated by Claude Code

[os-elon-musk]

os-dev-report

{
  "issue": 19133,
  "status": "done",
  "branch": "claude/issue-19133-governed-tiers",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19144",
  "session": "session_01BTeBejoPUvRHN8WdAJC6oF",
  "premise_still_valid": true,
  "head": "8b8a6cf2e9e7c5c03f06bcb4570644fae8e5422f",
  "summary": "Follow-up: origin/main (4d1d9d9f9, PR #19142 for #18489) merged into the branch as merge commit 8b8a6cf2e (no rebase, no force-push) and pushed; PR #19144 is no longer conflicted. Resolution per the coordinator's guidance: AGENTS.md PD #14 keeps the tiered paragraph (it names docs/NORTH-STAR.md); main's :7 pointer and its Communication-section deletion came through untouched; ceiling 1099 holds. check-governed-merges.mjs keeps main's north-star row POSITION (last) with tier: GOVERNED_TIER_H added, main's register docblock merged with the tier sentence, main's ROOT_FILE_WATCH_HINTS text, main's order pin ('adr,claude-tree,skills-catalog,agents-md,claude-md,north-star'), ONE rootExacts filter and ONE separator assert (main's 'an-exact-row-with-a-separator-declares-no-hint'; mine dropped), the union of near-misses (docs/north-star.md, docs/NORTH-STAR.md.bak, examples/docs/NORTH-STAR.md, docs/NORTH-STAR.mdx, content/docs/concepts/north-star.mdx), one north-star-exact case (both sides had added it; the duplicate removed), and my Tier-H list pin re-keyed to main's order. Battery floors recounted: 'the governed predicate' 9, 'the dispatch-gates declaration' 9, '⚖️ the two landing tiers' 19, SELF_TEST_BATTERY_FLOOR 26 — each equals the landed count. check-governed-prose.mjs auto-merged (main's 'all six entries' + my tier note + the moved start anchor); SKILL.md, core-rules.md, contract-review.md, the queue guard and clause2-carriers auto-merged. No PR PATCH, no label writes.",
  "tests": "At head 8b8a6cf2e: pnpm check:pm-governed-merges :: exit 0 — '✓ check-governed-merges --self-test: 351 assertions'; node scripts/pm/check-governed-queue-guard.mjs --self-test :: exit 0 — '✓ check-governed-queue-guard self-test: 261 cases pass'; pnpm check:pm-governed-prose :: exit 0 — '✓ check-governed-prose: 2 instruction surface(s) name all 6 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md · docs/NORTH-STAR.md) and claim no others.'; pnpm check:pm-skill-ratchet :: exit 0 — AGENTS.md 1099/1099, SKILL.md 812/812, contract-review.md 60/60, core-rules.md 151/151 (headroom 0 each); pnpm check:pm-skill-id-lint :: exit 0 — '27 file(s) clean'; pnpm check:pm-clause2-carriers :: exit 0 — '942 cases pass'. Acceptance: --test .claude/skills/pm-dispatch/SKILL.md :: exit 3 'GOVERNED — Tier S(席内达档复核落地)'; --test AGENTS.md :: exit 3 and --test docs/NORTH-STAR.md :: exit 3 'GOVERNED — a human merge is the review record … landing tier: H(人合)' (--json tier H; docs/NORTH-STAR.md now exists on the tree); --test .claude/settings.json .claude/hooks/guard-main-checkout.sh :: exit 3 Tier S; --test scripts/pm/check-governed-merges.mjs :: exit 0 NOT governed. Not re-run after the merge: the other 43 derived families (all exit 0 at d3bb7e0c3) — CI on the PR re-runs them at this head.",
  "mcp_calls": "0",
  "api_writes": "1 additional REST write — POST /repos/objectstack-ai/objectstack/issues/19133/comments (this follow-up); plus 1 git push of the merge commit. Running total: 4 REST writes, 4 pushes.",
  "open_questions": [],
  "out_of_scope_findings": ["unchanged from the first report"]
}

---

Generated by Claude Code

[os-elon-musk]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 8b8a6cf2e
Card: #19133 · PR #19144 (three commits: the two reviewed at d3bb7e0c3 in record 5737334942 + merge commit 8b8a6cf2e of origin/main 4d1d9d9f9; base now 4d1d9d9f9, eight files, +446 / −173) · 2026-09-18T23:41Z

① Derived judgments — the merge delta only (everything else stands as recorded at d3bb7e0c3)

• The conflict was the one the seat named: PR skills(pm-dispatch): enforce the North Star in the rules layer — 优先序, 取卡前置, Path: line, three faces, domain:cloud, governed register #19142 (skills(pm-dispatch): ADR-0136 D2 becomes the triage protocol — Journey: line, journey bands, cross-lane product-first order, journeys feed the queue #18489) landed the north-star register row LAST, its order pin, its near-misses and the separator assert; this PR had inserted the row second. Resolution read off the head: main's row position kept (:956, last) with tier: GOVERNED_TIER_H added; the order pin reads adr,claude-tree,skills-catalog,agents-md,claude-md,north-star (:3367) and the Tier-H list pin is re-keyed to that order (:3416); ONE rootExacts filter, ONE separator assert (main's spelling), the union of near-misses, one north-star-exact case. Battery floors equal the landed counts (the dev's recount; the seat could not run the merges self-test — below).
• AGENTS.md: main's :7 pointer and its Communication-section deletion came through; PD feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14 is this PR's tiered paragraph (it names docs/NORTH-STAR.md); 1099 / 1099. check-governed-prose.mjs: main's six-entry wording + this PR's tier note and moved start anchor. SKILL.md (:624–:625 beside main's :42 / :254 / :357–:364 / :452–:461 / :605), core-rules (:122 beside main's :89), contract-review.md, the queue guard and clause2-carriers auto-merged.
• No rebase, no force-push: the merge commit keeps the approved commits (d3bb7e0c3 approved by os-zhuang, review 5253484411) as ancestors; ruling C — the approval is spent once per PR, later pushes included, the owning seat lands.
• Left false by this landing (unchanged from the first record): os-dev.md :286–:287, landing-operations.md :27–:28, H48 — skills: re-key the three 事实层 = references/ spellings the Tier S ruling leaves false (os-dev.md :286–:287, landing-operations.md :27–:28, H48) #19146 (p3).

② Checks run by the seat (detached worktree at 8b8a6cf2e, redirect-then-$?)

• check-skill-line-ratchet.mjs exit 0 (812 / 60 / 151 / 1099); check-skill-id-lint.mjs exit 0; check-governed-prose.mjs exit 0 (6 surfaces); check-governed-queue-guard.mjs --self-test exit 0 (261 cases); check-clause2-carriers.mjs --self-test exit 0 (942 cases) and --pair 19144 exit 0; check-governed-merges.mjs --pr 19144 exit 3 (GOVERNED, landing tier: H); the acceptance --test lines: SKILL.md → Tier S · AGENTS.md → H · docs/NORTH-STAR.md → H (the file exists on the tree now) · settings.json + hook → Tier S · check-governed-merges.mjs → NOT governed.
• NOT MEASURED by the seat: check-governed-merges.mjs --self-test (prerequisite node_modules); the dev reports 351 assertions at this head. CI Lint & Repo Gates is the reading.
• CI on 8b8a6cf2e at 2026-09-18T23:40Z: 10 success · 8 skipped · 11 in progress, nothing red; the landing waits for green.

③ Findings

• None. Landing: Tier H, approved (os-zhuang) — the seat lands it once every check is green: needs-user-decision cleared, auto-merge SQUASH armed on the ready PR, the queue guard judges the approval at merge_group.

Implemented-by: claude/issue-19133-governed-tiers (os-dev, CONTRACT_REVIEW_TIER build)
Reviewed-by: session_01BTeBejoPUvRHN8WdAJC6oF (domain:skills seat, contract tier)

VERDICT: PASS

---

Generated by Claude Code