[objectstack-fleet]

Requested by Sales · project thread

Clause-②: no
Metadata-protocol: none

Part of objectstack-ai/objectstack#25936 (step 2). Step 1, the one-time landing of #13028, is on that pull request.

维护者速读(草稿)

• 改了什么： 每周刷新分片耗时的 workflow，推分支和开 PR 不再用 Actions 自带的 token，改为在 runner 上用 fleet App（objectstack-fleet[bot]）临时铸一个 token：只对 objectui 一个仓、只给 contents / pull-requests / workflows 写权限，job 结束即吊销。job 自己的 token 降为只读。文档 ci-cd-pipeline.md 同步改写那一节，并在密钥表里登记这对组织级凭据。
• 为什么改： Actions token 发出的事件 GitHub 不触发 CI，所以刷新 PR 每周都拿不到 CI，只能等人推一下。chore(test): refresh the per-file test timings (objectui#12208) #13028 从 10-19 等到 10-23，这期间分片不均 1.3–1.8 倍，拖慢每一张 PR。
• 风险与代价（含回滚）： objectui 的一个 workflow 步骤开始读组织密钥 OS_FLEET_PRIVATE_KEY，这是唯一新增的信任面；PR 跑（含 fork）不铸 token、不读密钥。凭据对本仓不可见时，周一那次 run 会红并写明原因，不会悄悄退回旧 token。回滚就是 revert 这一个提交。
• 席位意见：
• 你要做的： 确认组织密钥 OS_FLEET_PRIVATE_KEY 与变量 OS_FLEET_APP_ID 对 objectui 可见，并确认 [finding] The changeset release PR runs no CI at all — every ci.yml run on changeset-release/main is action_required, so the release commit reaches main unvalidated #5397 对 App token 的否决只管 release PR；两点都同意就批准本 PR。

What changed

.github/workflows/test-shard-timings-refresh.yml:

• New step Check the fleet App credential is visible to this repository: reads vars.OS_FLEET_APP_ID != '' and secrets.OS_FLEET_PRIVATE_KEY != '' as booleans (nothing printed) and goes red with a message naming the missing one. It also writes the token's one repository name.
• New step Mint the fleet App token, narrowed to this repository: actions/create-github-app-token@v3 (the same action and credential pair objectstack's fleet-write.yml mints with), repositories = this repository only, permission-contents, permission-pull-requests and permission-workflows write. The last is there because the weekly force-push moves the branch from last week's base to today's main, across whatever workflow files landed in between, which GitHub refuses for an App token without it; the workflow writes no workflow file.
• Open or update the refresh pull request now uses that token (gh auth setup-git for the push), commits as objectstack-fleet[bot], and its pull request body says the PR runs its own CI instead of asking for a human push.
• The job's GITHUB_TOKEN drops from contents: write + pull-requests: write to contents: read (plus the existing actions: read); checkout no longer persists a credential.
• Both new steps share the existing github.event_name != 'pull_request' guard, so a pull-request run (including a fork's) never reads the App secret.
• The header's "The cost it carries, stated" section is rewritten as "Whose identity opens the pull request, and why", carrying the [finding] The changeset release PR runs no CI at all — every ci.yml run on changeset-release/main is action_required, so the release commit reaches main unvalidated #5397 / ci(test-shard-timings-refresh): the weekly refresh opens its PR with the Actions token, so the PR gets no CI and waits for a human push — #13028 has sat since 10-19 with 585 newly measured files while the shards run 1.3–1.8× unbalanced objectstack#25936 reasoning and the two prohibitions (no personal access token, no fallback to GITHUB_TOKEN).

content/docs/guide/ci-cd-pipeline.md: the workflow's section, its inventory row, and the secrets table.

No changeset: node scripts/check-changeset-presence.mjs says no released package's source or contract moved.

Governing text

• The ruling recorded on ci(test-shard-timings-refresh): the weekly refresh opens its PR with the Actions token, so the PR gets no CI and waits for a human push — #13028 has sat since 10-19 with 585 newly measured files while the shards run 1.3–1.8× unbalanced objectstack#25936 (Sales, 2026-10-23, option A), and the two maintainer confirmations it asks for there: the organization credential's visibility to this repository, and [finding] The changeset release PR runs no CI at all — every ci.yml run on changeset-release/main is action_required, so the release commit reaches main unvalidated #5397's rejection read as scoped to the release pull request.
• objectui#5397 (no personal access token in automation): kept.

Verification

At head c543446, exit codes captured before any pipe:

• pnpm exec vitest run scripts/__tests__ :: exit 0 (190 files passed, 2 skipped; 5727 tests passed)
• node scripts/check-action-ref-convention.mjs :: exit 0 (14 distinct refs, 0 off-convention)
• pnpm run check:control-bytes / check:doc-fences / docs:check-links / check:new-line-citations :: exit 0 each
• node scripts/check-changeset-presence.mjs :: exit 0 (no changeset owed)
• YAML parses.

Not observable before merge, stated plainly: the mint, the push and the pull request open only on schedule / workflow_dispatch on main. The first proof is a workflow_dispatch of this workflow after merge (or the Monday 06:47 UTC run): the refresh PR should show check runs within minutes with no human push. The workflows: write need on a force-push across workflow-file changes is GitHub's documented App-token behaviour, not measured here.

Acceptance notes

• chore(test): refresh the per-file test timings (objectui#12208) #13028's run on its synced head (17b3796, a full-suite PR run) put the 16 test legs at 6.7 to 11.9 minutes of wall clock, about 1.8x. The card's ≤1.2x reading belongs to the first full battery on main after chore(test): refresh the per-file test timings (objectui#12208) #13028 lands; the card session reads it and reports on ci(test-shard-timings-refresh): the weekly refresh opens its PR with the Actions token, so the PR gets no CI and waits for a human push — #13028 has sat since 10-19 with 585 newly measured files while the shards run 1.3–1.8× unbalanced objectstack#25936.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01Cr2pnminvpXPZAG6sKgzgN

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c543446859b1ab7b3b29285edf122136402dbb68
Local-runs: none
Scope: .github/workflows/test-shard-timings-refresh.yml + objectstack .github/workflows/fleet-write.yml (the mint it claims to copy, lines 111-143), scripts/test-file-timings.mjs (the two node steps that run before the mint), scripts/__tests__/test-file-timings.test.ts (reads the workflow at line 216: the --shards width only), scripts/check-action-ref-convention.mjs (DEFAULT_SPELLING, DECLARED_EXCEPTIONS), scripts/dependabot-merge-gate.mjs (lines 233-234, the pull_request leg it describes), scripts/__tests__/ci-cd-pipeline-doc.test.ts (the inventory-row reader), objectui#5397 (body, the ruling comment and the dispatch order), content/docs/guide/ci-cd-pipeline.md (the three hunks, lane-seat prose face, read for consistency with the workflow)

Isolated review of the net diff origin/main...pr13362 (merge-base 2c4e5f5, one commit), the card and its four comments, PR #13362's body and file list, and the head's check-runs. Written 2026-10-23T12:37Z.

① Derived judgments

1. Job GITHUB_TOKEN narrowed, not widened — right. The job block drops contents: write + pull-requests: write for contents: read + the existing actions: read; the top-level permissions: contents: read is untouched; actions/checkout@v7 gains persist-credentials: false. With contents: read a push on GITHUB_TOKEN is refused by GitHub, so the header's "⛔ No fallback to GITHUB_TOKEN" is mechanically true, not a promise.
2. App token scope — right, least privilege for the three acts. owner: github.repository_owner + repositories: ${{ steps.credential.outputs.repository }} (${GITHUB_REPOSITORY#*/} → objectui) pins the installation token to this one repository; grants are exactly contents, pull-requests, workflows write. The action's own default (omit both owner and repositories) would scope to the current repository with one fewer computed output; the diff's form reaches the same set and its comment about an empty list widening to the whole installation is correct given owner is set. Not a defect.
3. permission-workflows: write — accepted, unmeasured, and bounded. It is the widest grant. The reason (a force-push of ci/test-shard-timings-refresh from last week's base to today's main crosses workflow files main changed, which GitHub refuses to an App token without workflows) is GitHub's documented behaviour for ref updates; the PR body states plainly it is not measured here. The token exists as steps.fleet.outputs.token and is read by one step whose run: is inline git/gh only; the workflow writes no workflow file. The first scheduled or dispatched run after merge is the proof, and the dev names it as such.
4. Private key reach — right. secrets.OS_FLEET_PRIVATE_KEY is read by exactly two places: the boolean != '' test in the credential step's env: (yields true/false, the value is never echoed) and the private-key: input of actions/create-github-app-token@v3. Both repo-controlled node scripts/test-file-timings.mjs steps (select, merge) run before the mint with GITHUB_TOKEN only; no repo code ever holds the key or the App token. This is the same action and the same vars.OS_FLEET_APP_ID / secrets.OS_FLEET_PRIVATE_KEY pair objectstack's fleet-write.yml:113-118 mints with, as the header claims; objectui main has no prior create-github-app-token use, so this is the repository's first.
5. Triggers — right; one observation (③.c). on: is schedule, workflow_dispatch (no inputs, nothing reaches a shell), and pull_request path-filtered to the workflow and its two scripts. No pull_request_target in this workflow (the repo's two uses are changeset-presence.yml and cross-repo-issue-closer.yml, untouched). The credential, mint and open steps all carry github.event_name != 'pull_request', so a pull-request run — fork or not — reaches none of them; a fork run has no secrets regardless. The check-run Regenerate the per-file test timings on this head is the pull_request leg of the edited workflow itself, green: the YAML parses and the unchanged selection/download/regenerate steps ran.
6. Missing credential fails loud and names the missing one — right, and it matches the ruling. OS_FLEET_APP_ID/OS_FLEET_PRIVATE_KEY not visible ⇒ ::error naming which is unset, exit 1, nothing pushed. The card's ruling comment asks for visibility to be confirmed rather than assumed; the code is correct under either answer (see ③.a).
7. Action refs follow the convention — right. All three uses: are @vN (checkout@v7, setup-node@v7, create-github-app-token@v3), which is DEFAULT_SPELLING = /^v\d+$/ in scripts/check-action-ref-convention.mjs; no DECLARED_EXCEPTIONS entry is needed or added. No scripts/__tests__/ test names create-github-app-token; the only test reading this workflow (test-file-timings.test.ts:216) pins the --shards 16 width, untouched.
8. Commit identity — right. objectstack-fleet[bot] / 332303061+objectstack-fleet[bot]@users.noreply.github.com: 332303061 is the bot's user.id as the card's own comments carry it. Nothing in the tree keys on the refresh PR's author or branch outside this workflow (ci/test-shard-timings-refresh and github-actions[bot] outside it occur only in board-snapshot.yml, changelog.yml, the dependabot gate and the governed-queue-guard self-tests, none about this PR); dependabot-merge-gate.mjs:233-234 describes the pull_request leg, which is unchanged.
9. [finding] The changeset release PR runs no CI at all — every ci.yml run on changeset-release/main is action_required, so the release commit reaches main unvalidated #5397 — not contradicted; the narrowing is the maintainer's to confirm (③.b). The text relied on, [finding] The changeset release PR runs no CI at all — every ci.yml run on changeset-release/main is action_required, so the release commit reaches main unvalidated #5397 ruling comment (2026-08-22): "Ruled: Option A — run the version step's validation inside changeset-release.yml ... with zero new token/trust surface (rejecting B's PAT/App-token route and C's per-artifact mechanical guarantees)"; its dispatch order adds "B is rejected — a PAT / GitHub App token widens the supply-chain trust surface and adds credential-rotation obligations." That rejection chose A over B for the release PR, where A existed. The diff claims only what the card's ruling claims: the header keeps "⛔ Never a personal access token: objectui#5397's ruling keeps one out of this repository's automation" and attributes the App route to "#13349's ruling (Sales, 2026-10-23), which reads [finding] The changeset release PR runs no CI at all — every ci.yml run on changeset-release/main is action_required, so the release commit reaches main unvalidated #5397's rejection as scoped to the release pull request". No new credential is created or rotated here — the fleet App key already exists at the organization for objectstack's relay; the new surface is its visibility to objectui, which the PR body names as "the only new trust surface". Accurate.
10. Doc hunks consistent with the workflow — right. The inventory row keeps its .yml first cell (the reader in ci-cd-pipeline-doc.test.ts finds it); the section text and the new secrets-table row state the same three grants, the one-repository scope, the organization level, the red-on-missing behaviour and the two prohibitions the workflow header states. The old "arrives without CI / push once" paragraph and the PR-body sentence at the old :182 are both replaced, which is the card's step 3.
11. Unchanged and still right: concurrency group, the NOT MEASURED exit-3 path, the byte-identical early return (which exits before gh auth setup-git, so a no-op run never configures a credential helper), gh pr list/edit/create flow.

Check-runs on the head: 34 total, all completed: 31 success (every required context — Lint, Type Check, Build & E2E, Build Docs, Test with its 16 shards and dist pins, Changeset Declaration, Governed Surface Queue Guard — plus Repo Gates, Line Citation Gate, Changeset Fixed Group Check, Changeset Claim Re-read, label, Live E2E (informational), and this workflow's own pull_request leg Regenerate the per-file test timings); 3 skipped by design on this PR (dependabot, Test (coverage), Test (coverage shard …/8)); 0 failed. Conclusions read from /commits/c543446…/check-runs after polling to completion.

② Semver level

No changeset owed, and the declaration matches. The diff touches .github/workflows/** and content/docs/** only — no src/, no files-listed file, none of the eight contract fields of any fixed-group package.json (objectui AGENTS.md §9, authority scripts/check-changeset-presence.mjs). PR body: Clause-②: no · Metadata-protocol: none, as the card's work-estimate line declares. Changeset Declaration and Changeset Claim Re-read are green on this head.

③ Boundary flags

a. Maintainer confirmation 1 — secret visibility of OS_FLEET_PRIVATE_KEY / OS_FLEET_APP_ID to objectui: escalated, not a FAIL. A session cannot read an organization secret's repository access, and neither can this review. The code is correct under both answers: visible ⇒ the Monday run opens a PR that runs CI; not visible ⇒ the run goes red naming the missing one, nothing pushed. Approving the PR is the maintainer's answer; if restricted, granting objectui access is the one settings action.
b. Maintainer confirmation 2 — #5397 read as scoped to the release PR: escalated, not a FAIL. See ①.9: the diff's text is faithful to both rulings and claims no more than the card's. A PAT stays out either way. Tier H governed approval on .github/workflows/** is still owed and this record does not substitute for it.
c. Reviewer's flag, non-blocking — no ref guard on the mint. The PR body says the push and PR "open only on schedule / workflow_dispatch on main", but nothing pins workflow_dispatch to main: a write-access collaborator dispatching on any branch mints the token and force-pushes ci/test-shard-timings-refresh from that branch's tree. Same shape the workflow had with GITHUB_TOKEN (contents: write before this PR), the actor is a trusted collaborator, and an organization secret's reach is per-repository not per-workflow, so a guard does not change what the key can reach — it only makes the PR body's sentence true. A one-line && github.ref == 'refs/heads/main' on the three guarded steps (or an environment bound to main) is the cheap hardening; it may land as a follow-up.
d. Dev's open point — workflows: write unmeasured: accepted as stated (①.3). The first workflow_dispatch after merge, or the Monday 06:47 UTC run, is the proof: a refresh PR with check runs and no human push.
e. Dev's acceptance note — the card's ≤1.2x spread belongs to the first full battery on main after #13028 lands; #13028 is still open (author github-actions[bot], head 17b3796, every required context green). Not this PR's gate; the card session reports it on objectstack-ai/objectstack#25936.

Implemented-by: claude/issue-13349-refresh-pr-ci
Reviewed-by: session_01WJozybDmRH8z2c5SD7vJkj

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

维护者速读

• 改了什么： 每周刷新分片耗时的 workflow 推分支、开 PR 时，不再用 Actions 自带的 token，改为在 runner 上用 fleet App（objectstack-fleet[bot]）临时铸一个 token。这个 token 只对 objectui 一个仓，只有 contents / pull-requests / workflows 写权限。job 自己的 token 降为只读（contents: read + actions: read），并关掉 persist-credentials。文档 ci-cd-pipeline.md 同步改写那一节，并在密钥表里登记这对组织级凭据。
• 为什么改： Actions token 产生的事件，GitHub 不会再触发 CI。所以刷新 PR 每周都拿不到 CI，只能等人推一下。chore(test): refresh the per-file test timings (objectui#12208) #13028 从 10-19 一直等到 10-23，这期间分片不均 1.3–1.8 倍，拖慢每一张 PR。
• 风险与代价（含回滚）： 新增的信任面只有一处：objectui 的一个 workflow 步骤开始读组织密钥 OS_FLEET_PRIVATE_KEY。密钥只交给 actions/create-github-app-token@v3（与 objectstack fleet-write.yml 同一个 action、同一对凭据）。仓库里的脚本都在铸 token 之前、用只读 token 跑完。PR 跑（含 fork）不铸 token，也不读密钥；没有 pull_request_target。凭据对本仓不可见时，周一那次 run 会变红并写明缺哪个，不会悄悄退回旧 token。回滚就是 revert 这一个提交。
• 席位意见： 同意合并。fable 档隔离复核 PASS（comment 6365048185），34 项检查无一失败。另有一个不阻断的后续：铸 token 的步骤没有限定只在 main 上跑，有写权限的协作者可以在任意分支手动触发。这与旧 token 的权限形状相同，也是可信的人，但正文说的「只在 main 上」要成立，还需另加一行 github.ref 条件。席位建议合并后另开一个小 PR 补上，不在本 PR 里改，以免复核作废重来。
• 你要做的： 确认两点：组织密钥 OS_FLEET_PRIVATE_KEY 与变量 OS_FLEET_APP_ID 对 objectui 可见；[finding] The changeset release PR runs no CI at all — every ci.yml run on changeset-release/main is action_required, so the release commit reaches main unvalidated #5397 对 App token 的否决只管 release PR。两点都同意，就在 PR ci(test-shard-timings-refresh): push and open the refresh pull request as the fleet App so it runs CI #13362 上点 Approve。

席位核对

Seat: domain:ui#1 · Clause-②: no · head c543446859b1ab7b3b29285edf122136402dbb68 · 2026-10-23T12:39Z

项	读数
形态	2 个文件：.github/workflows/test-shard-timings-refresh.yml（受治理面，Tier H）、content/docs/guide/ci-cd-pipeline.md。不欠 changeset。正文写的是 Part of objectstack-ai/objectstack#25936：验收要在合并后读周一那次刷新 PR 的 check run，以及 main 全量跑的分片比例。
前提实测	卡上的裁决：Sales 选 A，已记在 objectstack-ai/objectstack#25936。三个 action 引用都按仓库的 @vN 约定。bot id 332303061 与 fleet bot 的 user.id 一致。仓库里没有任何东西按刷新 PR 的作者或分支做判断。
门禁 check-runs	34 项全部完成：31 success、3 按设计跳过、0 失败。本 workflow 自己的 PR 跑也是 success，并按设计停在铸 token 之前。
契约复核	CONTRACT_REVIEW_TIER 隔离复核 PASS，comment 6365048185，Local-runs: none。
接受的偏差	跨 workflow 文件的 force-push 需要 workflows: write，这一点有 GitHub 文档依据，但还没实测，合并后第一次运行即是验证。缺少 main 限定，见速读里的后续建议。
范围外去向	分片比例 ≤ 1.2× 的验收要等 #13028 落地后的第一次全量跑，不是本 PR 的门。补 github.ref 限定由席位在合并后另立小 PR。
落地条款	本 PR 同笔挂 needs-user-decision，保持草稿，等授权批准人（os-zhuang / hotlong）批准，并确认速读里的两点。获批后席位 pr_ready + automerge_enable。⛔ 席位不批准。

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 93b598db0f65f6568b2dbbf33d118df28456898d
Local-runs: none
Scope: .github/workflows/test-shard-timings-refresh.yml + objectstack .github/workflows/fleet-write.yml (the mint it claims to copy, lines 111-143), scripts/test-file-timings.mjs (the two node steps that run before the mint), scripts/__tests__/test-file-timings.test.ts (reads the workflow at line 216: the --shards width only), scripts/check-action-ref-convention.mjs (DEFAULT_SPELLING, DECLARED_EXCEPTIONS), scripts/dependabot-merge-gate.mjs (lines 233-234, the pull_request leg it describes), scripts/__tests__/ci-cd-pipeline-doc.test.ts (the inventory-row reader), objectui#5397 (body, the ruling comment and the dispatch order), content/docs/guide/ci-cd-pipeline.md (the four hunks, lane-seat prose face, read for consistency with the workflow)

Isolated review of the whole net diff origin/main...pr13362 at this head (merge-base 2c4e5f5, unchanged; two commits; 2 files, +99/−25), the card and its four comments, PR #13362's body (unchanged since the previous head) and file list, and this head's check-runs. The previous record on c543446 (comment 6365048185) is superseded by this one; every judgment below was re-read against the new tree, not inherited. Written 2026-10-23T12:57Z.

① Derived judgments

1. The new github.ref == 'refs/heads/main' condition is on every step that touches the secret or writes, and on no step that must run on main — right. At this head the workflow has six conditional steps. Download and Regenerate carry steps.select.outputs.status == '0' only: they read with GITHUB_TOKEN (actions: read) and write the working tree, nothing else. Check the fleet App credential (reads secrets.OS_FLEET_PRIVATE_KEY != ''), Mint the fleet App token (reads secrets.OS_FLEET_PRIVATE_KEY) and Open or update the refresh pull request (holds steps.fleet.outputs.token, runs git push --force, gh pr edit/create) carry the identical three-term guard steps.select.outputs.status == '0' && github.event_name != 'pull_request' && github.ref == 'refs/heads/main'. No other step names a secret other than GITHUB_TOKEN, and no other step leaves the runner. Because the three guards are byte-identical, the token consumer can never run with the mint skipped (an empty GH_TOKEN).
2. A scheduled run still passes the guards — right. A schedule run executes on the default branch with github.ref = refs/heads/main and github.event_name = schedule; a workflow_dispatch chosen on main has github.ref = refs/heads/main. Both reach the mint and the push. A pull_request run has github.ref = refs/pull/N/merge and is already excluded by the event term; a dispatch on any other branch (or a tag) runs selection, downloads and regeneration, prints the diff stat and the summary, and skips the three guarded steps — the behaviour the new header paragraph and the doc sentence both state. The only cost is that such a dispatch is a quiet green no-op; a ::notice naming the skip would be a courtesy, not a requirement.
3. Job GITHUB_TOKEN narrowed, not widened — right. contents: read + actions: read; top-level permissions: contents: read untouched; actions/checkout@v7 with persist-credentials: false. A push on GITHUB_TOKEN is now refused by GitHub, so the header's "⛔ No fallback to GITHUB_TOKEN" is mechanically true.
4. App token scope — right, least privilege for the three acts. owner: github.repository_owner + repositories: ${{ steps.credential.outputs.repository }} (${GITHUB_REPOSITORY#*/} → objectui) pins the installation token to this one repository; grants are exactly contents, pull-requests, workflows write. The action's default (omit both owner and repositories) reaches the same single-repository set with one fewer computed output; the diff's form is not a defect, and its comment that an empty list would widen to the whole installation is correct given owner is set.
5. permission-workflows: write — accepted, unmeasured, bounded. The widest grant; the reason (a force-push of ci/test-shard-timings-refresh across workflow files main changed since last week is refused to an App token without workflows) is GitHub's documented ref-update behaviour; the PR body says plainly it is not measured here. The token is read by one step whose run: is inline git/gh; the workflow writes no workflow file. The first main run after merge is the proof.
6. Private key reach — right. secrets.OS_FLEET_PRIVATE_KEY appears in exactly two places: the boolean != '' test in the credential step's env: (yields true/false, never the value) and the private-key: input of actions/create-github-app-token@v3. Both repo-controlled node scripts/test-file-timings.mjs steps (select, merge) run before the mint on GITHUB_TOKEN only; no repository code ever holds the key or the App token. Same action and same vars.OS_FLEET_APP_ID / secrets.OS_FLEET_PRIVATE_KEY pair as objectstack fleet-write.yml:113-118; objectui main has no prior create-github-app-token use.
7. Triggers — right, and the previous record's ③.c is closed. on: is schedule, inputless workflow_dispatch (nothing reaches a shell), and pull_request path-filtered to the workflow and its two scripts; no pull_request_target here (the repo's two uses, changeset-presence.yml and cross-repo-issue-closer.yml, are untouched). A fork run has no secrets and is excluded by the event term regardless. With the ref term, the PR body's "only on schedule / workflow_dispatch on main" is now literally what the YAML does. The check-run Regenerate the per-file test timings on this head is the edited workflow's own pull_request leg, green: the YAML parses and the unguarded steps ran.
8. Missing credential fails loud and names the missing one — right; matches the ruling. Not visible ⇒ ::error naming which of the two is unset, exit 1, nothing pushed; no return to GITHUB_TOKEN.
9. Action refs follow the convention — right. All three uses: are @vN (checkout@v7, setup-node@v7, create-github-app-token@v3) = DEFAULT_SPELLING /^v\d+$/ in scripts/check-action-ref-convention.mjs; no DECLARED_EXCEPTIONS entry needed or added; Repo Gates green. No test under scripts/__tests__/ names create-github-app-token; the one test reading this workflow (test-file-timings.test.ts:216) pins the --shards 16 width, untouched.
10. Commit identity — right. 332303061 in the committer email is the fleet bot's user.id as the card's own comments carry it. Nothing in the tree keys on the refresh PR's author or branch outside this workflow; dependabot-merge-gate.mjs:233-234 describes the pull_request leg, unchanged.
11. [finding] The changeset release PR runs no CI at all — every ci.yml run on changeset-release/main is action_required, so the release commit reaches main unvalidated #5397 — not contradicted; the narrowing is the maintainer's to confirm (③.b). Text relied on, [finding] The changeset release PR runs no CI at all — every ci.yml run on changeset-release/main is action_required, so the release commit reaches main unvalidated #5397 ruling comment (2026-08-22): "Ruled: Option A — run the version step's validation inside changeset-release.yml ... with zero new token/trust surface (rejecting B's PAT/App-token route and C's per-artifact mechanical guarantees)"; its dispatch order: "B is rejected — a PAT / GitHub App token widens the supply-chain trust surface and adds credential-rotation obligations." That chose A over B for the release PR, where A existed. The header keeps "⛔ Never a personal access token: objectui#5397's ruling keeps one out of this repository's automation" and attributes the App route to "#13349's ruling (Sales, 2026-10-23), which reads [finding] The changeset release PR runs no CI at all — every ci.yml run on changeset-release/main is action_required, so the release commit reaches main unvalidated #5397's rejection as scoped to the release pull request". No new credential is created or rotated: the fleet App key already exists at the organization for objectstack's relay; the new surface is its visibility to objectui, which the PR body names as the only one. Accurate.
12. Doc hunks consistent with the workflow — right. Inventory row keeps its .yml first cell (the reader in ci-cd-pipeline-doc.test.ts still finds it); the section text, the new secrets-table row and the rewritten "writes nothing" sentence ("neither does a manual dispatch on any branch but main ... skips the mint, the push and the pull request") state exactly the three grants, one-repository scope, organization level, red-on-missing, the two prohibitions, and the new ref rule. The old "arrives without CI / push once" paragraph and the PR-body sentence at the old :182 are gone — the card's step 3.
13. Unchanged and still right: concurrency group, the NOT MEASURED exit-3 path, the byte-identical early return (exits before gh auth setup-git, so a no-op run never configures a credential helper), the gh pr list/edit/create flow.

Check-runs on the head: 34 total, all completed: 31 success (every required context — Lint, Type Check, Build & E2E, Build Docs, Test with its 16 shards and dist pins, Changeset Declaration, Governed Surface Queue Guard — plus Repo Gates, Line Citation Gate, Changeset Fixed Group Check, Changeset Claim Re-read, label, Live E2E (informational), and this workflow's own pull_request leg Regenerate the per-file test timings); 3 skipped by design on this PR (dependabot, Test (coverage), Test (coverage shard …/8)); 0 failed. Conclusions read from /commits/93b598d…/check-runs after polling to completion.

② Semver level

No changeset owed, and the declaration matches. The diff touches .github/workflows/** and content/docs/** only — no src/, no files-listed file, none of the eight contract fields of any fixed-group package.json (objectui AGENTS.md §9, authority scripts/check-changeset-presence.mjs). PR body: Clause-②: no · Metadata-protocol: none, as the card's work-estimate line declares. Changeset Declaration and Changeset Claim Re-read are green on this head.

③ Boundary flags

a. Maintainer confirmation 1 — visibility of OS_FLEET_PRIVATE_KEY / OS_FLEET_APP_ID to objectui: escalated, not a FAIL. A session cannot read an organization secret's repository access and neither can this review. The code is correct under both answers: visible ⇒ the Monday run opens a PR that runs CI; not visible ⇒ a red run naming the missing one, nothing pushed. Approving the PR is the maintainer's answer; if restricted, granting objectui access is the one settings action.
b. Maintainer confirmation 2 — #5397 read as scoped to the release PR: escalated, not a FAIL. See ①.11: the diff's text is faithful to both rulings and claims no more than the card's. A PAT stays out either way. Tier H governed approval on .github/workflows/** is still owed and this record does not substitute for it.
c. Previous record's ③.c (no ref guard on the mint): closed by this head. The three guarded steps now carry github.ref == 'refs/heads/main'; ①.1-2 above check that a schedule run still passes and that nothing that must run on main is skipped.
d. Dev's open point — workflows: write unmeasured: accepted as stated (①.5). The first workflow_dispatch on main after merge, or the Monday 06:47 UTC run, is the proof: a refresh PR with check runs and no human push.
e. Dev's acceptance note — the card's ≤1.2x spread belongs to the first full battery on main after #13028 lands (#13028 still open, head 17b3796, required contexts green). Not this PR's gate; the card session reports it on objectstack-ai/objectstack#25936.

Implemented-by: claude/issue-13349-refresh-pr-ci
Reviewed-by: session_01WJozybDmRH8z2c5SD7vJkj

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · 新 head 更新

Seat: domain:ui#1 · Clause-②: no · head 93b598db0f65f6568b2dbbf33d118df28456898d · 2026-10-23T12:58Z

上一条席位记录（6365081599）是对 c543446 写的，它的速读和核对表仍然有效，只有以下几处更新：

• 速读「席位意见」那条后续已经做完。 dev 在本 PR 里补上了 github.ref == 'refs/heads/main' 条件，凭据检查、铸 token、推送开 PR 这三步都带上了。现在非 main 分支上手动触发，不读密钥，也不写任何东西；main 上的定时任务和手动触发照常执行。
• 契约复核： 新 head 上 CONTRACT_REVIEW_TIER 隔离复核 PASS，comment 6365413824，Local-runs: none。它取代了对 c543446 的那条 6365048185。
• 门禁 check-runs： 34 项全部完成，31 success、3 按设计跳过、0 失败。
• 你要做的： 不变。请确认两点：组织密钥 OS_FLEET_PRIVATE_KEY 与变量 OS_FLEET_APP_ID 对 objectui 可见；[finding] The changeset release PR runs no CI at all — every ci.yml run on changeset-release/main is action_required, so the release commit reaches main unvalidated #5397 对 App token 的否决只管 release PR。都同意就在 PR ci(test-shard-timings-refresh): push and open the refresh pull request as the fleet App so it runs CI #13362 上点 Approve。