fix(scripts): re-exec check:single-claim-paths through the session proxy so its verdict is readable outside CI

[os-elon-musk]

Fixes #18844

Clause-②: no

What changes

scripts/check-single-claim-paths.mjs re-execs itself once with node's proxy flag when HTTPS_PROXY (or https_proxy) is set and the process was not started with it — argv, env and stdio forwarded, the child's exit code returned. Nothing else in the file moves: no new exit code, no change to the verdict layer, and no change to the EXIT_NOT_WIRED routing PR #17362 landed.

The decision is imported, never restated — PROXY_FLAG, PROXY_REARM_GUARD and proxyRearmPlan from the half-states patrol, the same import post-stamped.mjs and check-prior-rulings.mjs take — so this gate and they cannot come to disagree about whether this container's fetch reaches the API. Only the guard variable OS_SINGLE_CLAIM_PATHS_PROXY_REARMED is this file's own: one shared variable would let another instrument's re-exec suppress this one's, and the symptom would be the silent 401 the shim exists to close (a case the self-test pins in both directions).

Before / after, measured in an agent container

Readings at 0dca68d1e, every exit code captured before any pipe (cmd > log 2>&1; EXIT=$?).

run	before	after
GITHUB_REPOSITORY=objectstack-ai/objectstack PR_NUMBER=18921 node scripts/check-single-claim-paths.mjs	exit 1 — Error: GitHub API 401 for /repos/objectstack-ai/objectstack/pulls/18921/files?per_page=100&page=1, thrown and unhandled	exit 0 — ℹ️ re-exec with --use-env-proxy: HTTPS_PROXY is set (http://127.0.0.1:45311) and node's fetch does not read it. then ✓ check:single-claim-paths: PR #18921 modifies none of the 1 declared at-most-one-writer path(s), so there is nothing to serialise.
node scripts/check-single-claim-paths.mjs (no PR context)	exit 2, the NOT WIRED text	exit 2, byte-identical text (diff -q on both logs), no re-exec line, no child spawned
node --use-env-proxy … PR_NUMBER=18921 (the child leg, standalone)	n/a	exit 0, the same verdict line — the routed process is what answers
the same live run with OS_SINGLE_CLAIM_PATHS_PROXY_REARMED=1	n/a	exit 1, GitHub API 401 — the loop guard holds in a real process, not only in the pure function
the same live run with HTTPS_PROXY/https_proxy unset	exit 1, GitHub API 401	exit 1, GitHub API 401 — no behaviour change when the variable is absent (the CI-runner leg)

⛔ No token value is printed anywhere above or in the code. This container sets both GITHUB_TOKEN and GH_TOKEN; the script reads GITHUB_TOKEN, unchanged, and the credential that makes the routed leg answer is the proxy's, not that variable's.

Which run of this gate the probe exercised: package.json's check:single-claim-paths is the self-test; the live verdict belongs to the single-claim-path-guard.yml workflow. The table's live rows drive that live path by hand with the workflow's own variables; the self-test is the last row of the gate table further down.

Where the guard sits — and the hypothesis that falsifies

The dispatch takes the routing decision after the PR-context read and only when a read is imminent:

• --self-test is offline by contract and never routes;
• a run with no PR_NUMBER, or with PR_NUMBER but no GITHUB_REPOSITORY/GITHUB_TOKEN, exits EXIT_NOT_WIRED having made no request, so it spawns nothing — which is why its text stays byte-identical and no informational line lands in front of it.

A "top-of-file guard, before anything else" was the shape proposed for this card. Two landed spellings say otherwise and this one mirrors them: post-stamped.mjs dispatches --self-test in a branch the re-exec cannot reach and skips the re-exec on --dry-run ("that path makes no request, so re-execing it would spawn a second process to prove a route nothing is about to use"), and check-prior-rulings.mjs places the call at its card read, "after argument validation so a bad-usage run never pays for a child". The condition is a request is about to happen, not the process is starting.

Verified the other half of that hypothesis too: post-stamped.mjs's re-exec line does come from the patrol's exports (its import block names PROXY_FLAG, proxyRearmPlan, EXIT_PREREQUISITE_NOT_MET), and the guard variable is per-file there as well.

Self-test

node scripts/check-single-claim-paths.mjs --self-test: 65 cases / 7 batteries → 83 cases / 8 batteries, exit 0 both. The base count was taken by running the pre-change copy of the file out of git show HEAD:… and deleting it again, not by counting t( calls. The battery roster's own size pin rises 7 → 8, so deleting the new battery reds exactly as zeroing it does.

The new battery pins the decision, offline, with no proxy present and no request made: proxy set routes (and names the variable in its reason); the lowercase spelling counts; no proxy routes nothing (the runner leg, unchanged); the flag already in execArgv, in NODE_OPTIONS, or NODE_USE_ENV_PROXY=1 routes nothing again; this file's guard stops a loop; the patrol's guard does not suppress this file's re-exec; a node that will not take the flag hints instead of re-execing. And where the decision is taken: a wired live run yes; --self-test no; no PR context no; an incomplete context no.

The census the triage asked for — 13 candidates, read BY CALL PATH, ⛔ none fixed here

The triage's keyword sweep (files under scripts/ naming api.github.com and carrying none of HTTPS_PROXY | use-env-proxy | ProxyAgent | EnvHttpProxyAgent) returned 13, and declared itself a candidate lower bound rather than a verdict. Read by call path, the 13 are four different things:

file	how its GitHub read reaches the network (read from the code)	proxy-aware
scripts/pm/changeset-deadline-census.mjs	bare fetch in its API helper, but the dispatch calls a local rearmThroughProxy built on the imported plan	yes — re-execs; the keyword sweep missed it because the flag literal lives in the patrol, not here
scripts/pm/check-clause2-carriers.mjs	same shape: fetch, imported plan, spawnSync re-exec	yes — matches the seat's live HTTP 200 --pair reads in this container
scripts/check-single-claim-paths.mjs	this card	yes, as of this PR
scripts/check-whole-set-label-write.mjs	no network at all — the api.github.com strings are self-test fixtures of the curl -X PUT spelling it scans source text for	n/a — not a GitHub reader
scripts/check-cross-repo-closer-outcome.mjs	no network at all — transport is execFileSync('git', …); the API URL is a fixture, and its double harness carries an unstubbed('fetch') tripwire	n/a — not a GitHub reader
scripts/check-closing-target-claim.mjs	bare fetch in a githubApi(token) helper byte-identical in shape to this card's; a throw is caught and declared UNDETERMINED	no — the one row worth a card, see below
scripts/check-issue-citations.mjs	bare fetch (injectable fetchImpl), not routed — but it imports the plan and prints the route as the remedy, refusing with EXIT_PREREQUISITE_NOT_MET (3) so "could not resolve" can never pass for "resolves"	no transport, yes diagnosis
scripts/measure-stall-guard-headroom.mjs	bare fetch in fetchRunJobs, throws on a non-ok response with a remedy naming the token and its offline --from payload path	no — loud, and it has an offline input
scripts/pr-labels.mjs	fetch with retry/backoff; a 4xx breaks the loop and the failure is rethrown carrying an indeterminate class	no — CI writer (pr-automation.yml, lint.yml), no local flow
scripts/ci/select-shard-timings-run.mjs	fetch in api(), throws on a non-ok response	no — CI only, needs run ids from ci.yml / shard-timings-refresh.yml
scripts/pm/check-governed-queue-guard.mjs	fetch in its reader factories; a read failure becomes unreadableApproval(…), whose state: 'unreadable' is not satisfied and carries its own exit class	no — CI only (event payload); degrades to a named non-pass, never to a pass
scripts/release-github-releases.mjs	fetch in createReleasesClient; a failure is collected into failed and printed as ::error::	no — release / cut-rc workflows only
scripts/report-unmeasured-gate-tail.mjs	fetch in fetchRunJobs throws, and the caller catches it into an empty judgement whose reason is "the jobs API could not be read: …", always exit 0	no — CI only (run id + runner name); the degradation is printed, not silent

What made the 13 not 13: two are already routed through the shared shim (an import leaves no keyword — exactly the blind spot the triage declared), and two read no network at all. Nine remain proxy-blind readers, this card's file included.

The triage's escalation condition, applied

The condition: a candidate a LOCAL flow depends on and that would give a WRONG verdict rather than a loud 401 ⇒ p1.

No row satisfies both. The two candidates a local flow really depends on today (check-clause2-carriers, changeset-deadline-census) are already routed. Of the rest, every one either never runs outside CI — where no proxy exists, so the shim would change nothing — or fails loudly: a throw, exit 3 with the route named, or a state that is explicitly not a pass.

The closest row, and the one worth a p2 card rather than p1: scripts/check-closing-target-claim.mjs. Measured here, not inferred —
GITHUB_REPOSITORY=objectstack-ai/objectstack PR_NUMBER=18921 PR_HEAD_REF=claude/issue-18844-probe PR_BODY='Closes #18844' node scripts/check-closing-target-claim.mjs → exit 0, with ::warning::UNDETERMINED — #18844 was not judged: its comment thread could not be read above a ✓ headline and a 1 closing target(s) could not be judged tail. So the read failure is named, annotated and counted — deliberately, as a transport hiccup is not something a PR author did — but a reader who takes the exit code alone reads a pass. Its only local wiring is --self-test; the live verdict is closing-target-claim-guard.yml's. That is the same class as this card and the same one-line fix, so it is card material for the seat, not p1, and ⛔ not fixed here.

Reader test

A dev running the derived gate list in a container now reads a verdict from this gate instead of recording NOT MEASURED.

skip-changeset, measured rather than assumed

29 workspace package manifests, 23 declaring files[]; no entry in any of them can reach a repo-root scripts/ path (npm packs from the package directory, and the root manifest is private: true with no files[]). Positive control: packages/spec's files[] reads dist, json-schema, liveness, prompts, llms.txt, README.md, src/**/*.zod.ts, CHANGELOG.md, api-surface, spec-changes.json. And the symbol check-single-claim-paths appears in zero publishable trees (packages/, apps/, plugins/, skills/). Nothing published moves.

Gates

Derived from this worktree with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (the tool's own change set, not a hand-written list): 29 commands, every one run, every one exit 0, re-run in full on the rebased head 0dca68d1e with the codes recorded as command :: exit code, then reconciled with --ran (29 derived, 29 run, 0 unrun). The first derivation warned STALE TREE, so the branch was rebased onto origin/main 54145ccec and the whole union re-derived (identical 29) and re-run there.

Named in the dispatch and green: check:self-test-wired, check:self-test-workflow-commands, check:scripts-symbol-anchors, check:bash32-floor, check:single-claim-paths, check:pm-dispatch-gates. Outside the derived 29 and stated as such by the tool: the artifact-roster families, the declared-wide families, the pending-changeset families and the path-scheduled CI job.

Also run, beside the derived union: npx eslint --no-inline-config --format json scripts/check-single-claim-paths.mjs — 1 file linted, 0 errors, 0 warnings. That narrowing is a measurement, not an omission: the file count is read from eslint's own JSON output, the universe is this repo's single eslint.config.mjs, and that config states in its own prose that it "never enables type-aware linting (no parserOptions.project, no typed @typescript-eslint rules) for ANY file" — so this diff cannot move the verdict on any file it does not touch. The repo-wide scan remains CI's run. Control-byte self-scan over the changed file (grep -naP over the C0 range and DEL): no match; check:nul-bytes green.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BTeBejoPUvRHN8WdAJC6oF

---

Generated by Claude Code

[os-elon-musk]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0dca68d1e1c99bedcebbea00631ef6b480b7ba40

① Derived judgments

• Surface: scripts/check-single-claim-paths.mjs only (+132 / −1, 786 → 917 lines), one commit, rebased onto origin/main 54145ccec before the PR existed (AGENTS.md §3's five criteria read by the seat: the branch is the dev's own, no PR or reviewer existed, lease spelled against the last pushed sha). Off the governed register (check-governed-merges.mjs --test: NOT governed); no published package moves; no contract's accept/reject set moves.
• The mechanism: the file imports PROXY_FLAG, PROXY_REARM_GUARD and proxyRearmPlan from ./pm/check-half-states.mjs (the shared decision; the import direction already proven by check-issue-citations.mjs), maps its OWN guard variable OS_SINGLE_CLAIM_PATHS_PROXY_REARMED onto the shared plan's guard so the logic stays single-sourced while the guards stay independent, and re-execs itself once with --use-env-proxy (argv / env / stdio forwarded, the child's exit code returned) — only when transportRouteApplies says a wired live run is about to read the API: never on --self-test, never on a NOT WIRED or empty context. That placement falsifies the dispatch's 「top-of-file guard」 hypothesis on the stated ground (a path making no request must not pay for a child; the NOT WIRED output stays byte-identical) — the seat agrees. No new exit code; the EXIT_NOT_WIRED routing is untouched; a node that cannot take the flag hints instead of re-execing; a failed spawn falls back in-process with a loud line.
• Seat readings on a scratch worktree at this head: --self-test exit 0, 83 cases (the dev's before: 65 / 7 batteries; the new battery floors at 18); the LIVE probe GITHUB_REPOSITORY=objectstack-ai/objectstack PR_NUMBER=18921 node scripts/check-single-claim-paths.mjs in this container: exit 0, the re-exec line, then the gate's own verdict 「PR skills(pm-dispatch): a passing control certifies the instrument, not the question — a zero-hit reading names the instrument's reach and one known target outside it #18921 modifies none of the 1 declared at-most-one-writer path(s)」; the control with HTTPS_PROXY / https_proxy unset: exit 1 on GitHub API 401 — the mechanism is load-bearing, and the CI-runner leg is unchanged. check-scripts-symbol-anchors, check-self-test-wired, check:entry-guard, check:parse-guard, check:bash32-floor exit 0.
• The census the triage asked for, read by call path (the dev's, re-read by the seat on the PR body): 13 candidates resolve into four groups — already routed through the shared shim (changeset-deadline-census, check-clause2-carriers: an import leaves no keyword, exactly the triage's declared blind spot), no network read at all (check-whole-set-label-write, check-cross-repo-closer-outcome: fixtures; transport is git), fixed here, and proxy-blind but CI-only and loud (six files). The triage's escalation condition (a LOCAL flow depends on it AND it would give a WRONG verdict) is met by no row — p1 does not arise. Two class-(a) findings for the seat to file: check-closing-target-claim.mjs (same helper shape, no route; measured: exits 0 with an annotated UNDETERMINED warning — a reader of the exit code alone reads a pass) and check-issue-citations.mjs (imports the plan but uses it as a hint only; exits 3 with the route named).

② Semver level

• skip-changeset is correct: root scripts/ ships in no package's files[] (the dev measured it). Clause-②: no on the claim (5726072431) and in the body; PM_SWEEP_REPO=objectstack-ai/objectstack node scripts/pm/check-clause2-carriers.mjs --pair 18945 at 2026-09-18T07:25Z: exit 0, one live claim, no widening tell.

③ Boundary flags

• Dev flags: no open questions; two to file findings (above, filed by the seat) and three noted, not filed (the census table's CI-only readers with no carrier; report-unmeasured-gate-tail's named degradation; the 401 leg's exit 1 colliding with EXIT_CONFLICT — recorded, not acted on, the exit-code contract being out of this card's scope and the collision now reachable only off the proxy route). Deviations accepted: the derived union run in declared chunks with every exit captured; the pre-PR rebase and lease push; the guard placed at the imminent-request site. Gates: 29 derived / 29 run / 0 NOT-MEASURED at this head (identical list after the rebase); eslint on the one file 0 / 0 as a declared narrowing. 0 MCP calls; 3 REST writes.
• CI on this head at 2026-09-18T07:25Z: 17 success · 11 skipped · 5 in_progress — nothing red; the landing act reads it again. Two commits behind origin/main at review time on paths this file does not touch — no merge owed; the queue rebuild validates.

Implemented-by: claude/issue-18844-single-claim-paths-env-proxy
Reviewed-by: session_01BTeBejoPUvRHN8WdAJC6oF

VERDICT: PASS

---

Generated by Claude Code

[os-elon-musk]

Landing record — every pre-check met, blocked at the channel (skills seat, session_01BTeBejoPUvRHN8WdAJC6oF) · 2026-09-18T07:47Z

Every check on 0dca68d1e1 completed with none red (35 runs: 24 success, 11 rostered skips, read at 2026-09-18T07:47Z); the review of record is 5726677457 (PASS); --pair 18945 exit 0; ACCEPT 5726678164 on #18844. The landing act (POST …/pulls/18945/ccr/ready_for_review then PUT …/pulls/18945/ccr/auto_merge {"merge_method":"SQUASH"}) is not attempted here: the same act was refused by this session's auto-mode classifier on PR #18934 at 2026-09-18T07:03Z (record 5726459594 there) and a classifier refusal is 「no channel」 per references/rest-channel.md. The PR stays draft, ACCEPTED, and lands the moment a channel exists — this seat's once the maintainer allows the two CCR calls, or the maintainer's own hand. ⛔ Nothing here is a finding against the PR.

---

Generated by Claude Code

[os-elon-musk]

Superseded — closed by the seat, not landed (skills seat, session_01BTeBejoPUvRHN8WdAJC6oF) · 2026-09-18T08:00Z

The same fix landed on main through PR #18935 (#18314, domain:spec seat 4; merged 2026-09-18T07:25:16Z, 16cb493d5): scripts/check-single-claim-paths.mjs now carries OWN_PROXY_REARM_GUARD = 'OS_SINGLE_CLAIM_PATHS_PROXY_REARMED', proxyPlanEnv() mapping it onto the shared plan, rearmThroughProxy() called once, only for a wired context and never on --self-test — functionally what this PR adds (transportRouteApplies / proxyRearmDecision are the same decisions under other names). Read by the seat at 2026-09-18T07:59Z: this head is mergeable: false (dirty) against that main, and the residual diff against main is naming and comment wording with no behaviour the landed file lacks. ⇒ nothing here is owed to main; this PR closes and #18844 closes as fixed by PR #18935.

The seat's own miss, recorded here and on #18844: #18314 (same file, same defect, filed 2026-09-15T16:07Z, triaged 2026-09-17T10:10Z) was claimed by the spec seat at 2026-09-18T05:50Z, thirty-four minutes before this seat claimed #18844; the seat's serial check read open PRs' file lists (none existed yet on either side) and did not scan origin's heads by the file's stem, which would have shown claude/issue-18314-single-claim-paths-proxy… already pushed. The review of record 5726677457 stands as a reading of this head; the dev's work was sound and is not the cause. Findings filed by the seat: the triage-side dedupe (two cards on one file graded two days apart in two lanes) and the claim-time shadow scan.

---

Generated by Claude Code