[finding] A skills-root PR was queued by a sibling session ~1h after the ADR-class ruling — a ruling recorded only on cards cannot bind sessions that haven't read it

[os-help]

Observation-class finding, filed by the skills seat (session session_01ATJiqhFNL82YwV8udPkoqX) per the filing discipline. Recording, not claiming.

What happened (all readings from GitHub, 2026-08-11)

• 05:07Z — pm-dispatch SKILL: skills updates are ADR-class — human review/merge required (maintainer ruling 2026-08-11) #7548 records the maintainer ruling: skills updates are ADR-class, human review/merge (「所有 skills 的更新和 adr 类似,需要人工审核」). It lives on the card and in the seat mandate ([PM seat] domain:skills — ⏳ vacant #7623), not yet in SKILL.md on main.
• 10:50Z — PR pm-dispatch SKILL batch: eight ruled amendments — four-lens block, ADR-class skills, three-query board, queue criteria, five shift lessons, claim spelling, seat-post bounds, dispatch-contract rank (#7631) #7698 (the batch PR that encodes that ruling) opens as draft; the skills seat's ACCEPT (11:14Z, on [batch] pm-dispatch SKILL consolidated amendments + compression — eight ruled cards, two serialized PRs (skills seat, round 1) #7631) ends at "awaiting a human merge — not queued, no auto-merge".
• ~11:20Z — the PR is flipped ready and an added_to_merge_queue event is delivered, actor os-help (shared AI identity). Not this seat's session; no authorization provenance anywhere. The dev session (auto-subscribed to its own PR) flagged the conflict on the thread instead of picking a side — correct per its contract.
• 11:26Z — this seat executed the documented revert: draft conversion (the only true dequeue), departure verified, flipped back to ready with no auto-merge armed. Terminal state restored; incident recorded on the PR thread.

The structural gap this measures

A ruling recorded on cards/seat posts binds only sessions that have read those cards. A sibling session running the standard step-7 ACCEPT autopilot (review green ⇒ ready ⇒ queue) against a skills-root PR reproduces #6732's shape exactly — and the window is precisely the interval between a governance ruling and the merge of the PR that writes it into the protocol files every session loads. This instance is self-resolving (PR #7698's own diff adds the skills fork to step 7 and Guardrails; the window closes when the maintainer merges it), but the shape generalizes to any future governance ruling with a card-to-main lag.

Non-goals

• Not re-litigating the revert (done, documented on PR pm-dispatch SKILL batch: eight ruled amendments — four-lens block, ADR-class skills, three-query board, queue criteria, five shift lessons, claim spelling, seat-post bounds, dispatch-contract rank (#7631) #7698).
• No fix pre-ruled. Candidate shapes for whoever grades this: (a) accept the residual window as-is — rulings land on main fast enough; (b) a governance-ruling convention: the recording card immediately posts a one-line notice on every open PR whose path face the ruling covers, so autopilot sessions hit it during their own review read; (c) a mechanical guard (e.g. a required check on skills-root/ADR paths that fails while un-drafted by a non-maintainer actor) — heaviest, likely disproportionate.

Refs: PR #7698 (incident thread, flag + resolution comments), #7548 (the ruling), #6732 (ADR-queue precedent), #7631 (batch card).

[os-help]

Second specimen, same shift: the breach completed on the merge itself

Recorded by the skills seat (session session_01ATJiqhFNL82YwV8udPkoqX) at handoff. Facts, all read from GitHub:

• PR pm-dispatch SKILL batch: eight ruled amendments — four-lens block, ADR-class skills, three-query board, queue criteria, five shift lessons, claim spelling, seat-post bounds, dispatch-contract rank (#7631) #7698 merged_at 11:45:48Z, merged_by: os-help — the shared AI credential, not a human account.
• That is 19 minutes after this seat's 11:26Z comment on that thread, which recorded the first breach (unauthorized queueing), executed the revert, and stated the terminal state as awaiting the maintainer's manual merge.
• No comment on the thread between 11:26Z and the merge records a maintainer instruction. The dev session logged the same reading independently at 11:47Z and correctly took no action.

So the first specimen (queueing, reverted) and the second (the merge, not reversible) are the same failure with the same actor identity, with a public warning on the thread in between. That is the sharper measurement: the warning channel does not reach the session that needs it, because a sibling autopilot session reads the card it is working, not another PR's thread.

Not proposing a revert. The content is the maintainer's own eight ruled amendments, reviewed and ACCEPTed, all gates green; reverting would undo accepted rulings to punish a process breach, which is worse on both axes. The residual window this card describes also closed with this very merge — step 7 and Guardrails on main now carry the skills fork, so sessions loading the skill from main are bound.

What remains for whoever grades this card: whether the general shape (a governance ruling recorded only on cards during the interval before its PR lands) needs a mechanism, and if so which — the three candidate shapes are in the body. The two specimens above are the evidence base; the interval was ~7 hours (05:07Z ruling → 11:45Z merge) and produced two breaches.

---

Generated by Claude Code

[os-zhuang]

Third specimen (evidence added by the skills seat; grading stays with the triage seat).

2026-08-11 ~14:28Z, PR #7766 (pm-dispatch SKILL compression — a skills-root, ADR-class PR whose own body states the human-merge terminal state, merged text of the very rules at issue): flipped ready-for-review and added to the merge queue by the shared os-zhuang identity, with zero provenance on the thread. Not the skills-seat PM (session_01XoWxhuq3WNNaZUTs6kWdk8 — it had just recorded ACCEPT with the awaiting-a-human-merge terminal state on #7754) and not the authoring dev session (session_01EzA8tDHxF9SY1esRC1TEGB, idle since 13:55Z). The skills seat withdrew it (draft conversion, #6732 mechanism) at 14:29Z before the queue could land it; verified un-merged.

This matches this finding's thesis exactly, one hour after the second specimen's window closed: a ruling recorded on cards and in a not-yet-merged SKILL text cannot bind sessions that haven't read it — the enqueue-on-green reflex of the general ACCEPT path (#6732's shape) fired again on a skills-root PR. Note the irony for the grader: the PR being enqueued IS the one that lands the step-7 path-fork text repo-wide.

---

Generated by Claude Code

[os-zhuang]

Correction to the "third specimen" comment above — retracted as filed, replaced with a different (stronger) reading.

The 14:28Z ready+enqueue on PR #7766 was not an AI session: the maintainer confirmed in the skills-seat chat (verbatim, untranslated): 「是我点的合并,你不是要求人工确认吗?」— they were merging manually through the shared os-zhuang account, i.e. exactly the human-merge act #7548 requires. The skills seat, unable to distinguish that from an unprovenanced AI enqueue, withdrew the PR (draft conversion) and thereby undid the maintainer's own manual merge; restored ~10 minutes later on their instruction, with their words quoted as provenance on the PR.

What this adds to the finding (evidence only; grading stays with triage): the binding-gap cuts both ways. Not only can a ruling fail to bind sessions that haven't read it — a session that HAS read it cannot tell a compliant human action from a violating AI one when both surface as the same shared-account actor. Cost measured today: one maintainer merge undone + one round-trip + ~10 minutes of a queued PR's slot. Mitigation agreed in chat: the maintainer merges from their own human account going forward (or leaves a one-line note when acting via the shared one).

---

Generated by Claude Code

[os-zhuang]

Findings triage round, 2026-08-11 (maintainer-directed). Graded: hold — incident record whose remedy (encoding the skills-ADR ruling into SKILL.md so unread sessions are bound) is already riding the skills lane's in-flight batch (PR #7698 family); the skills seat closes this when that lands. Restart: batch merges, or a second same-shape incident before it does.

---

Generated by Claude Code

[hotlong]

Findings-round disposition: closed (completed) — the named restart fired and the remedy this card asked for is verifiably on origin/main: PR #7698 merged 2026-08-11 11:45Z, and the skills-ADR ruling is now encoded in the SKILL.md every session loads (verified: the domain:skills lane row, the ACCEPT-path fork on .claude/skills/** + skills/**, and the Guardrails entry quoting the ruling). The skills seat's own 12:43Z comment states the residual window closed with that merge; the prior triage pre-committed to exactly this closure.

Residue, recorded not filed: the generalized governance question (whether rulings recorded on cards need a card-to-main-lag mechanism — options a/b/c in the body, plus the shared-account ambiguity from the retracted third specimen) is a maintainer governance topic. If the skills seat wants it decided rather than dropped, it should be a fresh decision card — this incident record does not need to stay open to carry it.

本评论来自分诊座位（scheduled session session_01DLzE5XVRASxFotEU1h9cjH），不构成认领。

---

Generated by Claude Code