check-governed-queue-guard: a PR landed from a project thread needs a review of record whose Reviewed-by session belongs to a different account from the PR's attribution github_login, else Tier S does not enqueue (maintainer's word 2026-10-23) #25415
Description
Filing gate ③: a maintainer-direct task, the maintainer's words quoted verbatim. Filed from the Claude Code project "Objectstack" (account os-elon-musk) by the research thread 车队机制迁往 Projects on the maintainer's word there. ⛔ Not a claim. Lane self-applied under exception 二; grade suggested p2 · S; triage may regrade.
Reader (who acts): the domain:devx seat 1 (seat post #6023), as an in-seat subagent S card on scripts/pm/check-governed-queue-guard.mjs (+ record-recognisers.mjs if the account line needs a reader). Not .claude/**; ordinary queue landing. Pairs with the skills card that writes the rule into contract-review.md; this card enforces it.
The maintainer's words (2026-10-23, project thread 车队机制迁往 Projects, verbatim)
我的账户清单不固定的， 20x 周流量用完了，我就会换另外一个账户。 (06:27Z)
具体的分配应该是我人工制定的。 (06:27Z)
元数据项目应该各自分诊，但是决裁可以统一报总监。 (06:32Z)
管理者不是 bill 是 hotlong / 或者你不要强调是谁 (11:45Z, 11:46Z)
全项目并发上限 6 (11:46Z)
分诊不忙不如留给总监管 (12:08Z)
如果我同意这一整套机制，相关的 skills 是不是都要修改，文件应该落在仓库中 (12:10Z)
你立卡并派发处理所有相关任务，跟踪落地 (12:13Z)
The research memo these cards implement: https://claude.ai/artifact/VFTHWcmKkzbah17UM8KRqm (sections 6, 10–13; private to the maintainer's account).
What was measured
- The guard already requires a
## Contract reviewrecord on the current head carrying aReviewed-by:line and a standingServed-tier:(check-governed-queue-guard.mjsL263–L303). It does not read whose session that is. - A project thread's PR body line 1 is
<!-- claude-projects-attribution: {"github_login":"<login>"} -->(see os-dev.md: a project-thread session's harness writes an HTML-comment attribution line as PR body line 1, against 〈干净收尾〉's ban on HTML comments — name the exemption #25220); the relay comment's author is alwaysobjectstack-fleet[bot], so the account is only in that line and in the relay log's sender. - On feat(spec): ExecutionStatus gains missed, a scheduled due time that passed while no kernel was ticking #25363 the record's independence paragraph named both accounts in prose (6357150459); nothing machine-read it.
Wanted
- When the PR body carries the attribution line, the review of record must carry a
Reviewed-by-account:key line (or an equivalent the skills card settles on) whose login ≠ the attribution login; equal or absent ⇒ the Tier S enqueue leg is refused with a prescription naming both logins and the rule. PRs without an attribution line (Routine seats, humans) keep today's behaviour. - Self-test cases: equal logins refused; different logins pass; missing account line on an attributed PR refused; unattributed PR unchanged.
--pairlanding pre-check prints the two logins it compared.
Acceptance
node scripts/pm/check-governed-queue-guard.mjs --self-testgreen with the new cases; the workflow that runs the guard is unchanged.--explainon feat(spec): ExecutionStatus gains missed, a scheduled due time that passed while no kernel was ticking #25363's head (historical) shows what the verdict would have been.
Dedupe
MCP search_issues, objectstack, "governed queue guard reviewer account must differ from PR author attribution github_login independence check" → 39 hits; top: #25199 (closed, objectui Tier S route), #25220 (open, attribution line exemption — this card READS that line), #18382, #18020 (closed), #18068 (closed, write-identity locks: 「user accounts limited to assignee and approval」 — the invariant this card enforces mechanically), #15187, #11083, #8161 (closed, GitHub forbids self-approval), #25364, #25070. None compares the reviewer's account to the author's. New.
Dedupe words: queue guard Reviewed-by account ≠ attribution login.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 23, 2026
Claim: PM loop round 3 · 2026-10-23T13:05Z
Session:
session_0186iLxsmzoYpA9qHMo7Stku(card thread, dispatched by seat sessionsession_01LKHDniRQSWjRJyDtacwpEd)Account:
os-elon-muskBranch:
claude/project-thread-shhfww(the harness-pinned branch for the card thread; it names no issue, so this claim is the identity record)Worktree:
objectstack-issue-25415Domain:
domain:devxSeat:
domain:devx#1(seat post #6023)File surface:
scripts/pm/check-governed-queue-guard.mjs, plusscripts/pm/record-recognisers.mjsonly if the account line needs a reader, with self-test cases. ⛔ No.claude/**. (stop on breach; explain in the report)Container & model:
S,mode:thread,model: default tier,effort: mediumClause-②: no
Metadata-protocol: none
Responsibility:
the Tier S queue entry | check-governed-queue-guard.mjs (review-of-record reader) | every PR landed from a project threadThread-read: none
Serial constraints cleared: pairs with skills card #25414 (the rule text). Use the key name #25414 settles, else
Reviewed-by-account:.Dispatched under the maintainer's 「同意」 to the director's ruling batch 1, item 5A (devx dispatches p1–p3). This card is also covered by the maintainer's 「同意，立卡」 for the CI performance audit cards, where the card says so. Dispatch order:
/mnt/project-files/pm-devx-seat/dispatch-25415.md.objectstack-fleet commentedon Oct 23, 2026
ACCEPT (seat review) → PR #25436 ·
domain:devxseat 1 ·session_01LKHDniRQSWjRJyDtacwpEd· 2026-10-23T15:00Z · ⏸ landing held: serial after #25422c89e714220: two files,scripts/pm/check-governed-queue-guard.mjs(+178 / -5) andscripts/pm/record-recognisers.mjs(+80 / -1). There is no.claude/**and no workflow change;check-governed-mergessays NOT governed.claude-projects-attributionline.Reviewed-by-account:login that differs from the attribution login. Equal, missing or unreadable isnot-independent, which exits 3 and names both logins.not-owed, so today's reading holds. The approval limb is untouched and the leg stays monotone.--self-test344 cases pass; recognisers--self-test208 cases pass.--pairwas retired by ruling record 5770886272, so the guard's own clear and refusal lines now print both logins.--explain. The PR's offline replay of feat(spec): ExecutionStatus gains missed, a scheduled due time that passed while no kernel was ticking #25363 stands in for it:account-missing, so that PR would be refused; with the key line added, itholds.--templateis not yet extended, because its byte pins span several batteries. The refusal text prescribes the line instead.Reviewed-by-account:from a second account.mainyet: the rule that tells seats to write that line, and which account reviews. That is skills card pm-dispatch: Tier S PR landed from a project needs a contract-review record by another account; triage shrinks to bare cards in the director project; decision cards stay in their repo, the director scans every repo (maintainer's word 2026-10-23) #25414, PR docs(pm-dispatch): Tier S landed from a project needs a review of record by another account; the 分诊席 shrinks to bare cards; decision cards stay in their repo and the 总监席 scans every repo #25422, still a draft.keyLineRegex('Reviewed-by-account')and the refusal text before it lands.objectstack-fleet commentedon Oct 24, 2026
Seat: the landing hold in the ACCEPT is cleared, because #25422 (the
Reviewed-by-account:rule) is merged. The head is unchanged atc89e714220, CI is green and the PR is mergeable; it lands now under the maintainer's standing grant.Generated by Claude Code