skills: the published @objectstack/skills README and two skills/** pages still print npm install --save-dev "@objectstack/skills@…" as the only install line, which exits 1 in a pnpm-installed project (#24926's governed and published rows)

Filing gate ①: a documented command that fails, measured, with named locations. finding class a. Reader who acts: the domain:skills seat. skills/** is a governed surface (Tier H), and packages/skills is the package that publishes it; triage re-routes if the lane table says otherwise. Filed by domain:devx seat 1 (os-warren, session_01FM29ZqLTrnPNXxijioZwMp, seat post #6023). These are the rows of #24926 that its domain:devx PR #24973 does not touch. ⛔ Not a claim. Grade and area:* are triage's.

Measured (PR #24973's dev, Node 22.22.0, each scaffold in its own empty directory)

manager	scaffold	command	exit	wrote
pnpm 10.28.0	pnpm-installed `create-objectstack@18.0.0`	`npm install --save-dev "@objectstack/skills@$(node -p …)"`	1, `npm error Cannot read properties of null (reading 'edgesOut')`	nothing
pnpm 10.28.0	the same	`pnpm add -D "@objectstack/skills@$(node -p …)"`	0	`"18.0.0"`
npm 10.9.4	npm-installed `create-objectstack@18.0.0`	`npm install --save-dev "@objectstack/skills@$(node -p …)"`	0	`"^18.0.0"`
yarn 1.22.22	yarn-installed `create-objectstack@18.0.0`	`yarn add -D "@objectstack/skills@$(node -p …)"`	0	`"18.0.0"`

create-objectstack installs with pnpm when it is available, so a scaffolded app is commonly a pnpm project.

The sites (`main`)

path	note
`packages/skills/README.md` (≈`:28`)	in the package's `files[]`: this is the npm package page and the tarball text. It owes a patch changeset for `@objectstack/skills`
`skills/README.md` (≈`:11`)	governed
`skills/objectstack-upgrade/SKILL.md` (≈`:129`)	governed; the upgrade skill an agent follows for this exact move

The content/docs/** rows of #24926 are fixed by PR #24973, and content/docs/releases/v18/** by PR #24922. Those PRs give the precedent: the pnpm line in the block, a one-line comment giving npm and yarn, and the rule "add the package with the manager that installed the project".

Wanted

Each site gives the install line for the project's own package manager, in the same shape as the docs.
Where a site prints npx skills remove --all, it puts npx skills list before it, as the docs now do.
⛔ No new gate.

Dedupe

#24926 (this card's parent family; its skills/** rows are named there as domain:skills's). MCP search_issues earlier today for "npm install --save-dev @objectstack/skills fails pnpm project edgesOut": 0 hits besides it.

Dedupe words: @objectstack/skills README install npm pnpm; skills save-dev edgesOut; objectstack-upgrade skill install line.

Generated by Claude Code

Claim: PM loop round 1
Session: session_01M82feuetLzrCiBz41BJb7L
Account: huangyiirene
Branch: claude/issue-24974-skills-install-line-pm
Worktree: objectstack-issue-24974
Domain: domain:skills
Seat: domain:skills#1
File surface: packages/skills/README.md, skills/README.md, skills/objectstack-upgrade/SKILL.md, plus one .changeset/24974-*.md (patch, @objectstack/skills) (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: CONTRACT_REVIEW_TIER (dispatch-gates --tier packages/skills/README.md skills/README.md skills/objectstack-upgrade/SKILL.md: "Model tier — MANDATORY: claude-fable-5-1 (derived from the file surface, not recalled)"; the published skills/** root ships whole with npx skills add, so no one-line exit applies)
Clause-②: no
Responsibility: the three named pages, owned by this lane, print an npm install --save-dev line that exits 1 in a pnpm-installed project | the docs pages carry the per-manager line since PR #24973, but the npm package page and the shipped skills do not | every pnpm-scaffolded app user, and every agent following objectstack-upgrade, reaches it; measured exit 1 (card table, pnpm 10.28.0)
Thread-read: none
Serial constraints cleared: none — no open PR touches skills/** or packages/skills/** (19 open PRs, file lists read 2026-10-21T00:52Z); the lane's other in-flight surfaces are .claude/**, scripts/pm/check-half-states.mjs and docs/adr/0123-…, all disjoint

Landing path: skills/** is Tier H governed. The PR stays draft with the dev's 维护者速读 draft and owes an at-tier contract review; then the seat's record and the four-piece set go on, review is requested from both authorised approvers, and the seat lands it on an authorised approval. Net-line budget for skills/**: +4. Posted 2026-10-21T00:53Z.

Generated by Claude Code

os-dev-report

{
  "issue": 24974,
  "status": "done",
  "branch": "claude/issue-24974-skills-install-line-pm",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25023",
  "session": "session_01M82feuetLzrCiBz41BJb7L — subagent of the domain:skills seat 1 dispatch (parent's harness-stamped id; the relay's envelope read the same id from the container)",
  "premise_still_valid": true,
  "summary": "Draft PR #25023 (head f0b0ddc2d, one commit, assignee huangyiirene, no labels, Tier H untouched: not readied, no auto-merge, no reviewers). The three named sites now carry PR #24973's shape: the pnpm line in the block, one comment line with the npm and yarn spellings, and the rule 'add the package with the manager that installed the project'. packages/skills/README.md additionally names pnpm's ERR_PNPM_NO_MATCHING_VERSION beside npm's ETARGET (step 1 is pnpm now, so the npm-only code would have become a false statement this PR introduced) and runs npx skills list before npx skills remove --all (the card's second Wanted line; H2's only shipped hit). The upgrade skill's step sentence carries the rule and its prose drops the --all shortcut (the by-name command the block prints is always safe). A patch changeset for @objectstack/skills is included (README.md is in the package's files). Premise held on origin/main 62bc12930 (H1: all four line numbers re-measured; H2: one shipped site; H3: the upgrade SKILL.md ratchet had 16 tokens of headroom, now 17; H4: the docs' shape with the rule in the step's own sentence, reasons in the PR body).",
  "tests": "All on f0b0ddc2d, exit codes captured before any pipe. (1) bash scripts/pm/os-verify-lock.sh -c 'NODE_OPTIONS=--max-old-space-size=4096 pnpm --filter @objectstack/spec build' (what check:skill-docs reads): 'VERDICT command-exit 0 · held the lock 94s · waited 0s'. (2) pnpm --filter @objectstack/skills build (sync-catalog, byte-equality against skills/**): exit 0; the package declares no test or typecheck script, so neither was run (a zero-match filter run would exit 0 and measure nothing). (3) node scripts/check-skills-token-ratchet.mjs: 'skills/objectstack-upgrade/SKILL.md is 6171 tokens (ceiling 6188; headroom 17)' (was 6172 / 6188 on origin/main); '54 authored bundle file(s) within their ceilings'. (4) pnpm --filter @objectstack/spec run check:skill-docs: '✓ skills/README.md', exit 0. (5) pnpm check:doc-authoring: '53 published skill files clean', exit 0. (6) pnpm check:skill-identifier-liveness: '457 citation(s) over 53 published file(s)', exit 0. (7) grep -naP control-character scan over the four files: none. No ablation: the diff changes prose and a changeset, no tested behaviour. Dependency closure (①): @objectstack/skills has no workspace dependencies, so the closure build is empty; the spec build above was for the derived gate, not the closure.",
  "gates": "Local subset: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; change set from the merge base 62bc12930: 4 files, +43/−21) derived 71 commands on f0b0ddc2d; every one was run through a runner that records 'cmd :: exit N' before any pipe (log per command in the scratchpad). 68 exit 0. 3 exit 3 (PREREQUISITE NOT MET, unbuilt packages the diff never touches): 'pnpm --filter @objectstack/lint run check:doc-formula-expressions' (@objectstack/formula has no dist), 'pnpm check:dual-build-cjs-loads' (@objectstack/hono, account, setup, studio have no dist), 'pnpm check:lean-entry-closure' (packages/objectql/dist/core.mjs absent); none reads the four files here. 'node scripts/check-plugin-teardown-shape.mjs --self-test' refused once on the shallow clone (fixture pinned to 621a48760); after 'git fetch --depth=1 origin 621a4876…' it passed: '48 cases pass', exit 0. --ran verdict: '✓ dispatch-gates --ran: 71 derived famil(ies) accounted for — 68 run, 3 NOT-MEASURED (3 DERIVED from a recorded exit 3)', 0 UNRUN. Families CI runs, read from PR #25023's check-runs on f0b0ddc2d at report time (24 runs): 'No other open PR may claim the same issue' completed/success; '18.x upgrade harness (opt-in)' and 'Packed-tarball smoke (opt-in)' completed/skipped; in_progress: 'Lint · repo & tooling gates', 'Lint · docs & code guards', 'Lint · PM dispatch-gates', 'Lint · ESLint', 'Lint · CI, release & engine gates', 'Lint · scoped · tooling self-tests', 'Lint · scoped · slot lookup & corpus', 'Lint · scoped · query-options erasure', 'Type Check · workspace', 'Type Check · source gates', 'Type Check · consumer gates', 'Type Check · debt ledger', 'Governed Surface Queue Guard', 'Check Changeset', 'Check PR Size', 'Check Documentation Links', 'Flag docs affected by code changes', 'Part-of PR must not also close its card', 'The card this PR closes must claim this branch', 'No other open PR may claim the same single-writer path', 'filter'. Not re-run locally; CI convergence is the PM's to read. Local-only families (check:dev-prereqs, check:skill-frame-freshness) not run: the diff touches neither the spec build nor the four-axis frame files.",
  "line_budget": "skills/** net +2 against the +4 budget (git diff --numstat 62bc1293080968f0ec8c3d31dc1f9ed8da4077df -- skills/): skills/README.md +11/−8 = +3; skills/objectstack-upgrade/SKILL.md +6/−7 = −1. Paid by deleting content (the § 2.1 sentence that restated the table above it, the --all clause), not by re-wrap. Token ratchet on the upgrade SKILL.md: 6172 → 6171 tokens (ceiling 6188; headroom 16 → 17): +109 bytes comment line, +44 rule clause, −11 shorter prefix, −52 dropped --all clause, −96 deleted § 2.1 sentence. skills/README.md is outside the ratchet's population (its header, population 3). packages/skills/README.md carries no line or token ceiling: +14/−6.",
  "files_changed": [
    "packages/skills/README.md (+14/−6: step 1 pnpm line + npm/yarn comment line + rule paragraph with the measured npm error; bare-install warning names the pnpm spelling; ERR_PNPM_NO_MATCHING_VERSION beside ETARGET; npx skills list before npx skills remove --all)",
    "skills/README.md (+11/−8: pnpm line + comment line; the rule sentence in its short form opens the next paragraph)",
    "skills/objectstack-upgrade/SKILL.md (+6/−7: pnpm line + comment line; the step sentence carries the rule; --all clause dropped from the prose; one redundant sentence deleted in § 2.1 to pay the token ratchet)",
    ".changeset/24974-skills-install-line.md (new: '@objectstack/skills': patch, Clause-②: no)"
  ],
  "deviations": [
    "Upgrade SKILL.md prose: the clause '; --all when they are the project's only skills' was dropped. H2's grep did not name that site (it prints the flag in prose, not the command); dropping the branch satisfies the card's list-first intent at negative cost and leaves the agent one always-safe command. Stated in the PR body (H4).",
    "packages/skills/README.md 'Which versions exist': ETARGET → ERR_PNPM_NO_MATCHING_VERSION (npm: ETARGET; both print No matching version found). Not a Wanted line, but with step 1 now pnpm the npm-only code would be a false statement this PR introduced; the docs' exact wording from PR #24973 (M5).",
    "Upgrade SKILL.md § 2.1: one sentence deleted outside the named hunk ('Their consumer-facing projection is spec-changes.json and the chain's own --json output') to pay the token ratchet; it restated the table two paragraphs above (its 'Chain result' and 'D4 projection' rows).",
    "skills/README.md carries the rule sentence without the measured error text (the front page defers every detail to the Skills reference); the two other sites carry the docs' full sentence.",
    "Three derived gates NOT MEASURED locally (exit 3, prerequisite builds of untouched packages); CI's Lint & Repo Gates is their reading. One self-test needed the shallow clone deepened by one pinned commit (done, then green).",
    "origin/main moved to 05b28c199 (4 commits) during the run; none touches packages/skills/, skills/ or .changeset/, merge base unchanged; not merged, no re-derivation needed.",
    "Label writes: none. The dispatch named no labels, and skip-changeset does not apply (the diff publishes README.md of @objectstack/skills and carries its patch changeset).",
    "Commit trailer pair is the model-free pair AGENTS.md requires (Claude-Session + Co-authored-by: Claude); the harness attribution reminder's model-named Co-Authored-By line and its PR-footer form were not used, per the reminder's own precedence sentence. PR body footer is the AGENTS.md session-URL form; read back intact.",
    "dogfood_battery not run: docs-only diff, nothing to boot."
  ],
  "dogfood_battery": "NOT MEASURED by design: the diff is two READMEs, one SKILL.md and one changeset; no runtime behaviour, no app to boot. The install line itself was measured by PR #24973's dev on real scaffolds (card table: pnpm exit 0 writes 18.0.0; npm in a pnpm project exit 1 edgesOut; npm in an npm project exit 0; yarn exit 0) and is reproduced byte-for-byte from content/docs/ai/skills.mdx on origin/main; not re-measured here (no new command text was written).",
  "mcp_calls": "0 — no MCP GitHub tool was called; reads were gh api GET (issue, comments, PR 24973, PR 25023, files, check-runs), writes went through scripts/pm/with-fleet.sh --via dispatch (the fleet-write relay).",
  "api_writes": "3 REST writes in 2 relay strokes (each stroke one POST /repos/objectstack-ai/objectstack/dispatches, HTTP 204, executed by fleet-write.yml as objectstack-fleet[bot]): stroke 1 run 39527297516, pr_create = POST /repos/objectstack-ai/objectstack/pulls (#25023, draft forced by the relay) + POST /repos/objectstack-ai/objectstack/issues/25023/assignees (huangyiirene; read-back: 9565 bytes sent, 9565 stored, identical); stroke 2, comment = POST /repos/objectstack-ai/objectstack/issues/24974/comments (this os-dev-report). Plus 2 git push (not REST): the empty-branch probe and f0b0ddc2d, both exit 0.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed: packages/skills/CHANGELOG.md (two released entries) and packages/create-objectstack/CHANGELOG.md (two released entries) print the npm-only install line inside released text; both are release-owned, a correction would be a dedicated docs-only PR amending those entries. Not class a/b/c (released changelog prose, not a public door with a wrong answer). Dedupe words: skills CHANGELOG npm install save-dev released entry; create-objectstack CHANGELOG skills remove."
  ]
}

Generated by Claude Code

ACCEPT → PR #25023 comment 6305962025 · contract review PASS 6305865486 · domain:skills seat 1 · session_01M82feuetLzrCiBz41BJb7L · 2026-10-21T01:46Z

Tier H: pm:dispatched → needs-user-decision in this act. Review is requested from both authorised approvers (os-zhuang, hotlong). On an authorised APPROVED review the card returns to pm:dispatched and the seat lands the PR.

Generated by Claude Code

Authorised approval in · needs-user-decision → pm:dispatched · domain:skills seat 1 · session_01M82feuetLzrCiBz41BJb7L · 2026-10-21T01:48Z

PR #25023 carries an APPROVED review from os-zhuang (review 5593985055, 2026-10-21T01:47Z) on the current head f0b0ddc2d. That account is in GOVERNED_APPROVERS. The same account flipped the PR ready and armed auto-merge within 18 seconds of the approval. The seat follows it to MERGED, then closes out this card.

Generated by Claude Code

Landed · domain:skills seat 1 · session_01M82feuetLzrCiBz41BJb7L · 2026-10-21T05:13Z

reading	value
PR #25023	`merged: true` at 2026-10-21T02:52Z, merge commit `c0cde8bba` (queue entry 2026-10-21T01:49Z). Authorised approval: `os-zhuang`, review 5593985055
`origin/main`	`c0cde8bba docs(skills): give the @objectstack/skills install line for the project's own package manager (#25023)`, under tip `63085c380`

State: closed completed by the PR's Fixes; pm:dispatched is removed in this act. The patch changeset .changeset/24974-skills-install-line.md rides the next Version Packages release of @objectstack/skills, so the npm page shows the new line from that release on.

Generated by Claude Code

Navigation Menu

Repository navigation

skills: the published `@objectstack/skills` README and two `skills/**` pages still print `npm install --save-dev "@objectstack/skills@…"` as the only install line, which exits 1 in a pnpm-installed project (#24926's governed and published rows) #24974

Measured (PR #24973's dev, Node 22.22.0, each scaffold in its own empty directory)

The sites (`main`)

Wanted

Dedupe

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

skills: the published @objectstack/skills README and two skills/** pages still print npm install --save-dev "@objectstack/skills@…" as the only install line, which exits 1 in a pnpm-installed project (#24926's governed and published rows) #24974

Description

Measured (PR #24973's dev, Node 22.22.0, each scaffold in its own empty directory)

The sites (main)

Wanted

Dedupe

Activity

objectstack-fleet commented on Oct 21, 2026

objectstack-fleet commented on Oct 21, 2026

objectstack-fleet commented on Oct 21, 2026

objectstack-fleet commented on Oct 21, 2026

objectstack-fleet commented on Oct 21, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

skills: the published `@objectstack/skills` README and two `skills/**` pages still print `npm install --save-dev "@objectstack/skills@…"` as the only install line, which exits 1 in a pnpm-installed project (#24926's governed and published rows) #24974

The sites (`main`)