ci: hourly Spec Shape Gate on main -- objectui main compiled against the spec built from the commit, read by the release gate, red attributed to the changing lane

[objectstack-fleet]

Fixes #23238
Clause-②: no

Executes ruling B on this card (comment 6145029395, batch 336 item 3, maintainer 「其他同意」 2026-10-13T11:58Z): the spec shape gate moves from objectui to objectstack -- hourly on main with the two-speed full battery, read by the release gate, a red attributed to the lane that moved the shape; objectui drops its copy after two consecutive agreeing hourly runs. The mechanism of ruling C on #19011 (consumer compilation as the one shape gate) is unchanged; only where it runs and who owns a red changed. Governed surface: .github/workflows/** is Tier H, so this PR stays a draft and lands only on the maintainer's approval. Not touched, by the card's terms: .github/workflows/release.yml (in flight under another card) and every objectui file (the objectui half is the objectui domain:devx lane's card).

What changed

• .github/workflows/spec-shape-gate.yml (new). One job, Spec Shape Gate: checkout objectstack, checkout objectstack-ai/objectui at main under objectui/, resolve both shas once, setup Node 22 + the repo's setup-pnpm composite, restore one pnpm store keyed on both lockfiles, run the gate script's self-test, pnpm install --filter @objectstack/spec..., pnpm --filter @objectstack/spec build, npm pack --ignore-scripts (the file set a release from this commit would ship), install objectui, inject the tarball into objectui's pnpm virtual store, TURBO_FORCE=true pnpm type-check --continue with the exit code captured before any pipe, then an always-run report step that carries the verdict. Triggers: schedule at 52 * * * * (off ci.yml's and lint.yml's :00), workflow_dispatch, and a pull_request trigger path-filtered to the gate's own three files -- so a change to the gate, a registration included, is exercised on its own PR and no other PR pays the ~13 minutes (two-speed rule 1). No merge_group. Permissions are reads only (contents, actions, pull-requests, issues). Concurrency keys on github.event_name so a dispatch and the hourly run on main never cancel each other; only PR runs cancel in progress.
• scripts/ci/spec-shape-gate.mjs (new). The objectstack port of objectui's scripts/spec-main-shape-gate.mjs with the direction reversed: inject writes into the DOWNSTREAM clone (--downstream), reads the dependencies the spec was built against from THIS checkout (--upstream-checkout), proves every workspace consumer resolves the injected copy, and re-points a store sibling the packed manifest's range refuses (the zod case). Workspace consumers and the turbo name-to-directory map are now derived from the downstream's pnpm-workspace.yaml rather than a hard-coded directory list. The artifact-reuse half is dropped: the spec is always the one from the tree under test. report parses the turbo log in both of turbo's log orders, dedupes the two tsc programs of one task, reads the retirement registry, splits diagnostics into known (registered) and new, attributes a new red to the commit range since this workflow's last green run on main and the domain:* lane of the card each pull fixes (unattributed when it cannot read one), writes the run summary, emits one annotation per new diagnostic (objectui path and objectstack sha in the title, no file= -- the platform re-homes an unresolvable file= onto the workflow file), and exits 0 green or known-only, 1 new break, 2 reading not taken. --self-test: 60 cases in 7 pinned batteries with the verdict-flag handshake (the check-agent-model-declared.mjs shape, copied not imported).
• scripts/ci/spec-shape-retirements.json (new). The intentional-retirement registry: one entry per retirement with retired, objectstack_pr, objectstack_commit (40-hex), downstream_card, registered_at and non-empty matches, each pattern a repo-relative objectui file (glob allowed) plus at least one of code / message. A file-only pattern, an empty matches, an unknown key or a malformed field is refused and the whole run is exit 2 -- the registry cannot become an ignore-all switch, and a registry that cannot be read is not an empty one. Entries that matched nothing in a run are listed for pruning. The first commit of this PR ships it EMPTY (positive control run 1, expected red); the second commit registers PR feat(spec)!: retire the view-level api data source — a view binds its object or static rows; an API call is the page element's binding (#23082) #23160 -> the view-level api data source is retired in @objectstack/spec (objectstack#23082): delete the ViewData.provider === 'api' readers, keep the approvals inbox's code-built ApiDataSource objectui#12325 (run 2, expected known).
• scripts/ci/scheduled-full-run.mjs. RELEASE_GATE_WORKFLOWS gains { file: 'spec-shape-gate.yml', name: 'Spec Shape Gate' }, so release.yml's existing full-battery job (--release-gate, unchanged) now refuses a publish unless this gate's newest schedule run at or before the version commit concluded success too. The self-test gains six cases (the recorded 2026-10-12 listing judged explicitly over the two workflows it recorded, a firing control that the default roster refuses that same listing naming Spec Shape Gate alone, a red / a missing / a dispatch-only Spec Shape Gate run on synthetic data, and a pin that every registered workflow file exists); floors rose 6→8, 14→17, 5→6, none lowered.
• package.json: check:spec-shape-gate alias (node scripts/ci/spec-shape-gate.mjs --self-test), run by the workflow's self-test step, so the script is a discoverable gate family and check-self-test-wired sees its self-test run in CI.

The PM's mechanism hypotheses, measured

1. Release-gate reading: scheduled-full-run.mjs enumerates RELEASE_GATE_WORKFLOWS by workflow FILE and reads GET /actions/workflows/{file}/runs?branch=main&event={schedule|push}&status=completed, picks the nearest commit with a non-cancelled run and the newest run on it, and requires success from every workflow. Registration is one row there; a known-only run concludes success, so a registered retirement does not block a release and an unregistered break does. Confirmed; floors raised, none lowered.
2. Hourly placement: ci.yml and lint.yml carry schedule: '0 * * * *'; this gate is its own workflow file at :52, not in ci.yml (no check-expected-skips roster change needed: a workflow-level paths: filter creates no check-run on a PR, so nothing shows as skipped).
3. Direction reversal: as described; the clone is actions/checkout with repository: objectstack-ai/objectui, ref: main, path: objectui, fetch-depth: 1. Measured on objectstack's pnpm-workspace.yaml: every glob is rooted at packages/, apps/ or examples/, so objectui/ is never swept into this repository's install.
4. Attribution: last green = this workflow's newest completed success run on main (schedule / workflow_dispatch / push) that is not this run and not this head; range = the compare API base...head; per commit the (#N) squash suffix -> pull labels + the pull body's closing keywords -> card labels; unattributed with the reason otherwise. Failure shape, printed not guessed: no earlier green (the first runs) -> "no range could be named"; compare truncated at 250 -> marked; pull-request lookups capped at 40 per run (printed when reached). A PR run has no range and says so. The verdict never depends on the attribution.
5. Registry: as described; the two positive-control readings are in the section below.
6. Positive control and minutes: the pull_request path filter makes this PR's own runs the measurement.
7. Self-test shape: three parts copied from scripts/check-agent-model-declared.mjs; no shared assertion module imported.
8. Permissions least-privilege and read-only; concurrency per event and ref; the ~11-minute downstream chain is not run locally (foreground cap), only the self-tests and the derived gates.

实测分钟数 -- measured minutes

Measured on this PR's own Spec Shape Gate runs (the pull_request path filter makes them the measurement): run 1 38411582655 (head 1c3bc822, empty registry) -- job wall 10.4 min; run 2 38413661014 (head fde9ac1c38, PR #23160 registered) -- job wall 13.9 min. 10.4 and 13.9 minutes of one ubuntu-latest runner per run; the uncached downstream build plus typecheck is 8.3 to 11.3 of them (build spec 63-83 s, type-check objectui 498-677 s); hourly on main that is roughly 250 to 335 runner-minutes a day on the public repo. Both runs restored the pnpm store from ci.yml's existing entries (objectui install 11-14 s); the save step runs only on main runs. Reported to the maintainer under the ruling's fork clause (the seat's ACCEPT on #23238 and the final 维护者速读 below); this PR takes no fallback to option C.

阳性对照 -- positive control, two runs

• Run 1 (commit with the EMPTY registry): expected RED on the retirement objectstack main carries since PR feat(spec)!: retire the view-level api data source — a view binds its object or static rows; an API call is the page element's binding (#23082) #23160 (view-level provider: 'api'), the same diagnostics objectui's hourly run shows -- packages/react/src/hooks/useViewData.ts TS2367 and packages/core/src/adapters/resolveDataSource.ts TS2678 / TS2339.
• Run 2 (commit registering PR feat(spec)!: retire the view-level api data source — a view binds its object or static rows; an API call is the page element's binding (#23082) #23160 -> the view-level api data source is retired in @objectstack/spec (objectstack#23082): delete the ViewData.provider === 'api' readers, keep the approvals inbox's code-built ApiDataSource objectui#12325): expected the same diagnostics read as known (registered: objectstack-ai/objectui#12325), zero new, job green.
• Readings (seat-verified from the runs' jobs and check-run annotations): run 1 38411582655 -- job failure, Report step failure (exit 1), 10 new-break annotations (spec shape break: objectui PATH:LINE (objectstack f435d694e9de), GitHub's 10-per-step cap; the full table is in the run summary) over packages/core/src/adapters/resolveDataSource.ts, packages/react/src/hooks/useViewData.ts, packages/plugin-calendar/src/ObjectCalendar.tsx, packages/plugin-gantt/src/ObjectGantt.tsx and two packages/types/src/__tests__/*.test.ts fixtures -- every row the PR feat(spec)!: retire the view-level api data source — a view binds its object or static rows; an API call is the page element's binding (#23082) #23160 retirement; run 2 38413661014 -- job success, report exit 0, 0 new-break annotations (the only failure-level annotations left are turbo's own task-failure lines), the known table in the run summary.

Verification

Local: node scripts/ci/spec-shape-gate.mjs --self-test (60/60 across 7 batteries), node scripts/ci/scheduled-full-run.mjs --self-test and --check-concurrency, pnpm check:nul-bytes, and the gate list derived by node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (58 commands) with exit codes captured before any pipe; the per-command table is in the report. The diff touches no published package, so the local build/test scope ① ② is empty. The downstream compile itself is measured by this PR's own CI runs, not locally.

维护者速读(草稿)

改了什么

把「拿平台当前代码编一份 spec、去编译下游 objectui」这道检查,从 objectui 搬到 objectstack:每小时在 main 上跑一次,结果进发版前必过的清单;红的那次会写明是哪些 objectstack 提交、哪条车道改坏了接口;有意的退役在「退役登记」里记一行,对应的报错就显示「已登记」而不再翻红。objectui 那边的同款检查暂不动,等这边连续两小时的结果和那边一致后由 objectui 车道删除。

为什么改

维护者裁决 B。现状是下游每个 PR 替上游做一次约 13 分钟的体检,红总在上游合并之后才出现在下游,而且有意的退役会让它连红好几天、盖住真正的意外破坏。搬到平台这边、定时跑、发版前必过,问题记在改动方名下,像出厂检验。

风险与代价(含回滚)

• 代价:objectstack 公共仓每小时多一次约 11–13 分钟的运行(实测分钟数见上文,由席位转交);发版门禁多读一道结果,这道结果红着(未登记的新破坏)就不能发版 —— 这正是裁决的意图。
• 风险:登记文件若被滥用成「全部忽略」会失去意义;脚本在结构上拒绝只写文件名不写判据的登记,也拒绝任何读不懂的登记(整次运行记作「没读到」,不是通过)。
• 回滚:删除这个 workflow 文件,并把 scripts/ci/scheduled-full-run.mjs 里 RELEASE_GATE_WORKFLOWS 的那一行去掉,发版门禁即回到只读 CI 与 Lint 两道的状态;objectui 侧的检查在此期间一直在跑,不会出现空档。

席位意见

(留空)

你要做的

1. 看上文「实测分钟数」:每小时一次的运行成本是否可接受。不可接受就在卡上说一声,⛔ 本 PR 不会自行退回方案 C。
2. 可接受则对本 PR 批准(.github/workflows/** 是 Tier H,需要你的一次 approve),之后由席位落地。

Acceptance notes

• objectui's own runs carry ten extra annotations re-homed onto .github: actions/setup-node registers a tsc problem matcher that parses the echoed typecheck log a second time with paths that do not resolve. Handled here by ::remove-matcher owner=tsc:: before the log is echoed. Observation on objectui's side, not filed; carrier: the objectui domain:devx deletion card, which removes that workflow anyway.
• scheduled-full-run-card.yml files a card for a red hourly CI / Lint & Type Check run with a fixed domain:devx label. This gate's red is reported in the run summary and annotations with its own lane attribution and files no card; wiring it into the card filer would label the card with the wrong lane. Recorded as an open question in the report, not changed here (the card's "no other check" term).
• scripts/ci/scheduled-full-run.mjs --release-gate reads schedule and push events; this workflow has no push trigger, so only its hourly runs are read by the release gate, and a workflow_dispatch run is attributed but not read -- the same rule the other two workflows live under.
• release.yml's full-battery job comment still names two workflows in prose; the script is the authority and is unchanged in release.yml by the card's terms (in flight under another card). Noted for that card's carrier.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: fde9ac1c384cb033f4713f725d656c9b1b08a7c1
Local-runs: none

Reviewed in seat by the dispatching skills seat (served tier read from get_session last_served_model this act, equal to the constant's value), on the PR diff (five files, +2085/−14; check-governed-merges --pr 23283: .github/workflows/** ×1, Tier H, 2099 changed lines), card #23238, ruling 6145029395 (batch 336 item 3, letter B) and the head's check-runs. Written 2026-10-14T01:15Z.

① Derived judgments

• Governed rule text, .github/workflows/spec-shape-gate.yml (new), judged clause by clause against ruling B. Triggers: schedule at 52 * * * *, workflow_dispatch, and a pull_request trigger path-filtered to the gate's own three files, no merge_group — the ruling's "hourly on main with the two-speed full battery" and two-speed rule 1 (no ordinary PR pays the downstream compile; a change to the gate proves itself on its own PR). Clone: objectstack-ai/objectui at main, not the pin — the ruling's "clones objectui at main"; the Console Pin Gate keeps the pin's question. Subject: @objectstack/spec built and npm packed from the commit under test, injected into objectui's virtual store — the ruling's "injects the spec built from the objectstack commit". Permissions are four reads (contents, actions, pull-requests, issues), nothing writes. Concurrency keys on event and ref and cancels only PR runs — an hourly reading is never cancelled by a dispatch. TURBO_FORCE=true pnpm type-check --continue with the exit captured before any pipe, the tsc matcher removed before the echo, and an if: always() report step that carries the verdict. Correct on every clause; nothing re-adjudicates ruling C on [ruling C] revert PR #18971 — the 12 MiB declaration-text snapshot comes out; consumer compilation against spec@main becomes the shape gate #19011.
• scripts/ci/spec-shape-gate.mjs (new): verdict() reads — status 0 with no diagnostic → 0; diagnostics absent on a failed compile → 2 (a failure no diagnostic attributes to a file is never a pass and never a shape break); any unregistered diagnostic → 1; registered only → 0. The registry reader refuses a non-JSON or array top level, an entry missing one of its six keys, an unknown key, an empty matches, and a file-only pattern (the ignore-all switch), and a refused registry is exit 2 for the whole run — a registry that cannot be read is not an empty one. Attribution runs only when unregistered rows exist on a schedule / workflow_dispatch / push run, picks the newest success run on main that is not this run or head, reads the compare range, the squash suffix's pull, its labels and the labels of the cards its body closes, and writes unattributed with the reason otherwise; the verdict never depends on it. Correct, and the direction is the narrow one: every unreadable input is a loud exit 2.
• scripts/ci/spec-shape-retirements.json (new): one entry, PR feat(spec)!: retire the view-level api data source — a view binds its object or static rows; an API call is the page element's binding (#23082) #23160 → objectstack-ai/objectui#12325, five patterns each naming a file plus a code and a message fragment; the two packages/** globs are held narrow by their code and the '"api"' literal. Matches the positive-control rows of run 38411582655 (read below).
• scripts/ci/scheduled-full-run.mjs: RELEASE_GATE_WORKFLOWS gains spec-shape-gate.yml / Spec Shape Gate, so release.yml's unchanged --release-gate call refuses a publish when this gate's newest schedule run at or before the version commit is not success or is absent; a workflow_dispatch run is not read (the same rule the other two workflows live under). The 2026-10-12 fixture cases now pass the two recorded workflows explicitly, with a firing control that the default roster refuses the same recording naming Spec Shape Gate alone; three synthetic cases (red refuses alone, missing refuses, dispatch run not read) and a wiring pin that every registered file exists. Battery floors 6→8, 14→17, 5→6, none lowered. Correct.
• package.json: check:spec-shape-gate alias to the script's --self-test, run by the workflow's self-test step and seen by check-self-test-wired (Lint & Repo Gates success on this head).
• Not touched, by the card's terms: .github/workflows/release.yml (release(v18): the version-pr lane refuses the major boundary at Validate the post-version tree, so #21988 never refreshes into 18.0.0-next.0 — wire the lane's major-only gates in, and stop prerelease cuts re-dating the last GA #22085's) and every objectui file. Fixes #23238 is the body's only closing keyword, and the card's objectstack half is this PR; the objectui deletion card is a seat act after two agreeing hourly runs, not a deliverable of this card. No published accept set, no spec path: Clause-②: no is correct.
• Positive control, read from the two runs' jobs and check-run annotations (not from the report): run 38411582655 (head 1c3bc822, empty registry) — job failure, Report step failure, 10 spec shape break: objectui … annotations naming the objectui path and objectstack sha, plus turbo's 10 untitled task-failure lines; run 38413661014 (head fde9ac1c38, registered) — job success, 0 spec shape break annotations, turbo's 10 untitled lines only. Red without the registration, known with it: the control holds.

② Semver level

None owed: the diff ships in no package (.github/**, scripts/ci/**, the root package.json scripts map); skip-changeset on the PR is correct and Check Changeset is the expected skip under it.

③ Boundary flags

• Open question 1 (should a red hourly run also file a card, as scheduled-full-run-card.yml does for CI / Lint): A — no card. The ruling named no card, the card's term forbade another check, and the red reaches its lane through the release-gate refusal, the run summary and the lane-attributed annotations; B stays a follow-up card if the first days show the lane missing a red. Seat decision, recorded here; not a maintainer question.
• Open question 2 (the objectui deletion card after two consecutive agreeing hourly runs): nothing to decide; the seat watches the first hourly runs after landing and files on the objectui board.
• Dev flag — the branch is 41 commits behind origin/main (merge-base b4d573a0) and was not merged forward: mergeable_state reads clean; the queue rebuilds on current main. Accepted.
• Dev flag — four gates NOT MEASURED locally (check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content, each exit 3 on an absent whole-workspace build): Lint & Repo Gates is success on this head, which runs them. Accepted.
• Dev flag — the measured minutes (10.4 and 13.9 minutes of one ubuntu-latest runner per run, about 250–335 runner-minutes a day hourly on main) go to the maintainer under the ruling's fork clause, no fallback to C: carried into the PR body and the final 维护者速读 by the seat in this stroke.
• Out-of-scope findings (three, carriers named: the objectui deletion card; release.yml's in-flight card; none) — noted on the card's ACCEPT, not this PR's.

Implemented-by: claude/issue-23238-spec-shape-gate-on-objectstack
Reviewed-by: session_013zGKMG1cRedVzWtqGGGZW9

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

维护者速读(终稿)· PR #23283 · head fde9ac1c38 · Tier H(.github/workflows/**)

skills 席 1(session_013zGKMG1cRedVzWtqGGGZW9,huangyiirene),写于 2026-10-14T01:16Z。席内契约复核 PASS 记录与卡 #23238 的 ACCEPT 同笔在案;本 PR 保持 draft,⛔ 席位不翻 ready、不入队。

改了什么

把「拿平台当前提交编一份 spec、去编译下游 objectui」这道检查从 objectui 搬到 objectstack:新增一个定时 workflow,每小时在 main 上跑一次(:52,错开整点),把结果接进发版前必过的清单(scheduled-full-run.mjs 的 RELEASE_GATE_WORKFLOWS 多一行;release.yml 本身没动)。红的那次会写明哪个 objectui 文件、对着哪个 objectstack 提交、归哪条车道;有意的退役在 scripts/ci/spec-shape-retirements.json 登记一行,对应报错显示「已登记」而不再翻红。首条登记就是今天 main 上 PR #23160 的那次退役(objectui 侧卡 objectui#12325)。objectui 那边的同款检查暂不动,等这边连续两小时结果与那边一致后由 objectui 车道删除。

为什么改

你在 #23238 批 #336 第 3 项选了 B(6145029395)。现状是下游每个 PR 替上游做一次约 13 分钟的体检,红总在上游合并之后才出现在下游,有意退役会让它连红好几天、盖住真正的意外破坏。搬到平台这边、定时跑、发版前必过,问题记在改动方名下。

风险与代价(含回滚)

• 实测分钟数(裁决的分叉条款要你看的数): 本 PR 自己的两次运行,单次占一台 ubuntu-latest 10.4 分钟(run 38411582655)与 13.9 分钟(run 38413661014),其中不走缓存的下游构建加类型检查占 8.3–11.3 分钟;每小时一次,公共仓一天约 250–335 runner 分钟。
• 阳性对照两跑:空登记表那次按预期翻红,10 条「spec shape break」注解各点名 objectui 文件与 objectstack 提交;登记 PR feat(spec)!: retire the view-level api data source — a view binds its object or static rows; an API call is the page element's binding (#23082) #23160 之后那次绿,0 条新破坏注解。
• 风险:登记表若被写成「全部忽略」就失去意义 —— 脚本在结构上拒绝只写文件名不写判据的登记、拒绝任何读不懂的登记(整次运行记作「没读到」,exit 2,不是通过)。发版门禁多读一道结果:这道红着(未登记的新破坏)就不能发版,这正是裁决的意图。
• 回滚:删 .github/workflows/spec-shape-gate.yml,去掉 scheduled-full-run.mjs 里 RELEASE_GATE_WORKFLOWS 的那一行;objectui 侧的检查在此期间一直在跑,不出现空档。

席位意见

同意落地。三点席位读数:① 每条判据都按裁决 B 逐句对过(契约复核记录在 PR 上),机制上没有一处能把「没读到」写成「通过」;② 分钟数在裁决预估(约 11 分钟)的上沿,代价是公共仓每天约 4–6 小时 runner 时间,换来红在上游、归属到车道、发版前必过 —— 席位认为值,但这是分叉条款点名由你拍的数;③ 红的小时跑不另立卡(dev 的开放问题 1):裁决没点名卡、卡面禁止另加检查,红走发版门禁拒绝加运行摘要加车道归属注解,这是席位的决定,头几天若有车道漏看红再立跟进卡。

你要做的

一个动作:看上面的分钟数能否接受 —— 能,就对本 PR Approve(.github/workflows/** 是 Tier H,需要你一次授权批准;批准后席位经中继落地);不能,就在 #23238 卡上说一声,⛔ 本 PR 不会自行退回方案 C。

---

Generated by Claude Code