Observed during the 2026-08-31 director-summon governed-merge audit. Two invocations of node scripts/pm/check-governed-merges.mjs --since-ref objectstack=b7f645a8a3b9 --since-ref objectui=38a123cac0fa, same cwd (/home/user/objectstack), roughly 15 minutes apart:
Between the runs nothing local touched /home/user/objectui — the only plausible delta is upstream pushes moving origin/main (busy repo). The clone is shallow; before run 1 it was deepened with git fetch --shallow-since=2026-08-27 origin main, after which the anchor resolved (git cat-file -t 38a123cac0fa = commit).
Hypothesis, NOT verified: the window is re-evaluated against a moved tip and the shallow boundary breaks anchor-to-tip connectivity, so the boundary proof fails closed and the repo is dropped from the audit. Failing closed is the right direction (#4690 — an unproven window must not read as clean), but a nondeterministic audit surface means the per-summon duty can silently lose a whole repo depending on run timing, and the operator only notices if they compare footers across runs.
Worth doing:
- root-cause the flip (shallow-boundary connectivity is the first suspect);
- make the script print the reason a repo is unaudited (which precondition failed: no checkout / anchor unresolvable / boundary unprovable), so a dropped repo is loud and attributable;
- a self-test covering the shallow-clone path.
For the record: the 2026-08-31 audit used run 1's objectui enumeration (produced while the boundary held), with attribution filled via MCP; the flip is reported to the maintainer alongside that list rather than smoothed over.
⛔ Filed unassigned — recording only, for the finding box to grade (the script lives in scripts/pm/**; domain label left to triage).
Observed during the 2026-08-31 director-summon governed-merge audit. Two invocations of
node scripts/pm/check-governed-merges.mjs --since-ref objectstack=b7f645a8a3b9 --since-ref objectui=38a123cac0fa, same cwd (/home/user/objectstack), roughly 15 minutes apart:2 governed repo(s) unaudited (objectstack-ai/cloud, objectstack-ai/objectos)and enumerates 12 objectui entries (PRpnpm check:nul-bytesenumeratesgit ls-files, so a brand-new file reads green locally until it is staged #6984 … fix(spec): 参考文档的联合单元格每种拼写只印一次,重复变体计入既有标记 (#6569) #6738) with commits and surfaces.3 governed repo(s) unaudited (objectstack-ai/objectui, objectstack-ai/cloud, objectstack-ai/objectos)and prints zero objectui entries.Between the runs nothing local touched
/home/user/objectui— the only plausible delta is upstream pushes movingorigin/main(busy repo). The clone is shallow; before run 1 it was deepened withgit fetch --shallow-since=2026-08-27 origin main, after which the anchor resolved (git cat-file -t 38a123cac0fa=commit).Hypothesis, NOT verified: the window is re-evaluated against a moved tip and the shallow boundary breaks anchor-to-tip connectivity, so the boundary proof fails closed and the repo is dropped from the audit. Failing closed is the right direction (#4690 — an unproven window must not read as clean), but a nondeterministic audit surface means the per-summon duty can silently lose a whole repo depending on run timing, and the operator only notices if they compare footers across runs.
Worth doing:
For the record: the 2026-08-31 audit used run 1's objectui enumeration (produced while the boundary held), with attribution filled via MCP; the flip is reported to the maintainer alongside that list rather than smoothed over.
⛔ Filed unassigned — recording only, for the finding box to grade (the script lives in
scripts/pm/**; domain label left to triage).