ci: 17 jobs inherit the 360-minute default timeout (four of them run on every push to main), 11 PR-triggered workflows cancel nothing when superseded, and check-links runs on every PR without a paths filter

Filing gate ③: a maintainer-directed task. Maintainer, 2026-10-26, verbatim: 「完整的评估本项目，还有哪些可以优化的地方。包括 ci 和文档」 then 「使用 pm-dispatch 技能创建 issue，需要决策的立为决策卡。」 and 「低优先级的先不考虑」. Batch-of: 19 (repository evaluation 2026-10-26, session_019a9XCWsbMFp75REzthE6cs; 9 decision cards + 10 execution cards). ⛔ Filed bare: grading, domain:* and area:* are triage's. ⛔ Not a claim. Reader: the domain:devx execution seat, dispatch step — one os-dev, one PR, Tier H. Dedupe: REST list (439 issues), grep timeout-minutes|concurrency → 0 hits. New.

谁付代价（业务筛）: a hung job in any of these 17 holds a runner for six hours; a PR that gets three pushes in ten minutes runs three copies of eleven workflows; every docs-free PR still runs the link checker.

Measured (HEAD `0d83ee8`)

Jobs with no timeout-minutes (GitHub default 360): check-links/link-checker, codeql/analyze, cross-repo-issue-closer/close-foreign-issues, docker-publish/publish, docs-drift-check/docs-drift, duplicate-fix-guard, partof-closing-keyword, pr-automation/{pr-size,auto-label,changeset-check}, release/{version-pr,release-integrity,stale-prompts,publish}, single-claim-path, spec-liveness-check/liveness, stale. release-integrity and stale-prompts run on every push to main (release.yml push: branches: [main]).
PR-triggered workflows with no concurrency block: check-links, docs-drift-check, duplicate-fix-guard, engine-split-metric, os-create-smoke, pack-smoke-optin, pr-automation, scaffold-e2e, spec-liveness-check, upgrade-harness-optin, validate-deps.
check-links.yml:23-27: on: pull_request: branches: [main] with no paths:; it checks content/**, README.md, ARCHITECTURE.md (lychee.toml).

Wanted

Explicit timeout-minutes on the 17 jobs, sized from their recent run history (most 5–15 min; publish and docker-publish from their own readings). ⛔ Not a blanket number: each value cites the p99 it was read from, in the PR body.
concurrency: { group: <workflow>-${{ github.event.pull_request.number || github.ref }}, cancel-in-progress: true } on the 11, following ci.yml:112-114's shape; for workflows that also run on push to main keep push runs uncancellable as ci.yml does (github.event.after segment).
check-links.yml: a paths: filter matching what lychee.toml reads; keep workflow_dispatch.
Optional, same PR: permissions: {} at the top of the eight workflows that declare only job-level permissions (check-links, ci, codeql, lint, pr-automation, release, stale, validate-deps) — a one-line deny-by-default backstop; the dev may leave it out if any job turns out to rely on the default token.

Acceptance

grep -L 'timeout-minutes' … over the job blocks → 0 jobs without one (the dev writes the exact read in the PR).
A PR with two pushes a minute apart shows the first run of each of the 11 workflows cancelled.
scripts/ci/scheduled-full-run.mjs --check-concurrency still green (it evaluates ci.yml's expression; do not weaken it).

Size: S–M. Clause-②: no. Metadata-protocol: none. Tier: H.

Triage: first grade — `tooling` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-26T12:09Z

⛔ Not a claim, ⛔ not a dispatch. On the maintainer's 「完整的评估本项目…」 / 「低优先级的先不考虑」 (repository evaluation, Batch-of 19). Low priorities were excluded at filing, so the execution cards grade p2.

Add timeout-minutes from measured p99 plus headroom, not a guess, and add concurrency cancel-in-progress on PR workflows. ⛔ Not on merge_group or push to main, where a cancel would drop a needed result. The check-links paths filter rides docs: the link checker reads only content/**, README.md and ARCHITECTURE.md, so nine broken relative links sit in CHANGELOG.md, RELEASE_NOTES.md, docs/NEXT_STEP.md and docs/releases-maintenance.md unseen #26087 if it lands first. Tier H.

Generated by Claude Code

Claim: PM loop round 8 · 2026-10-27T00:33Z
Session: session_01Q4MDXRbEJCNdPAP4SiXwp9 (devx seat 2) · card thread cmsg_01FdL1XeUyvVNxLreh3F4Qi9BFPQCAwNbKfEL5SeQxNa8m
Account: os-steve
Branch: claude/project-thread-h8lsmd (the harness-pinned branch of the card thread; it names no issue, so this claim is the identity record; amended on spawn)
Worktree: objectstack-issue-26085
Domain: domain:devx
Seat: domain:devx#2 (seat post #20163)
File surface: timeout-minutes on the 17 jobs the card lists, each value from that job's measured p99 plus headroom and cited in the PR body (⛔ no blanket number); concurrency cancel-in-progress on the 11 PR-triggered workflows the card lists, in ci.yml:112-114's shape, ⛔ never cancelling push to main or merge_group; a paths: filter on check-links.yml matching what lychee reads after #26313 (keep workflow_dispatch). Amended at seat review of PR #26376: the header comment of scripts/release-verify-npm.mjs (~L80-82, "the publish job declares no timeout-minutes") is rewritten to the new 120-minute bound, comment only. The card's optional permissions: {} item is OUT of this claim. ⛔ No ci.yml edit, no job rename, no ui/ path (stop on breach; explain in the report). ⛔ Tier H (.github/workflows/**): draft until a GOVERNED_APPROVERS approval; the dev neither readies nor arms auto-merge
Container & model: M, mode:thread, model: default tier (TIER_DEFAULT, from dispatch-gates --tier: no path-derived mandate), effort: medium
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — repository evaluation 2026-10-26, triaged p2 at 6415648426
Thread-read: 6415648426
Premise: the 17 jobs still lack timeout-minutes and the 11 workflows still lack concurrency on main (the dev re-reads both lists first and reports any that moved)
Serial constraints cleared: the ci.yml hold named in this seat's orders bound ui/ cards while #25869 and #25902 edited it; #25869 is closed and #25902 merged, and the only open PR touching ci.yml/lint.yml is #26367 (sdui, small hunks elsewhere). #26084 (this seat, ci.yml shard matrix) and #26086 (this seat, inline step bodies) touch other lines of shared files; whichever lands second merges main

Generated by Claude Code

os-dev-report

{
  "issue": 26085,
  "status": "done",
  "branch": "claude/project-thread-h8lsmd",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26376",
  "session": "session_01ADHkmSfkkJZXxR3bPjvRzh",
  "premise_still_valid": true,
  "summary": "Both lists re-read on origin/main 6390fe52: exactly the card's 17 jobs lacked timeout-minutes and the same 11 PR-triggered workflows lacked concurrency; nothing moved. Each of the 17 now carries a timeout from its own recent runs (readings and the three deliberately wide values, publish 120 / docker-publish 30 / stale 45, in the PR body and beside each value in the YAML). The 11 get ci.yml's group key with cancel-in-progress true only on pull_request; pr-automation splits push vs labeled/unlabeled/edited runs and the two opt-in workflows give unrelated-label runs their own group, so a label never cancels a push run's jobs. check-links gets a paths filter over content/, docs/, the 8 root pages, lychee config and the ADR step (521 lychee inputs, 0 outside it). Draft, Tier H, waiting on a GOVERNED_APPROVERS approval (os-zhuang / hotlong); not readied, auto-merge not armed.",
  "tests": "node scripts/ci/scheduled-full-run.mjs --check-concurrency: exit 0. YAML walk of every .github/workflows/*.yml for jobs with neither timeout-minutes nor uses: gives none at 62f0d0f2 (listed the card's 17 at 6390fe52). All workflows parse. lychee 0.24.2 (cargo build) under LYCHEE_ARGS: 2883 links, 0 errors; --dump-inputs 521 files, all inside paths. Acceptance 'first run cancelled' partly measured live on PR 26376: PR Automation run 40430215653 (labeled, skip-changeset) did not cancel run 40430207861 (opened), which kept running; the two-push leg awaits the next push to this branch.",
  "gates": "dispatch-gates --commands at 62f0d0f2: 55 commands, all exit 0 (check-engine-split-ratio first exit 2 on the shallow clone, exit 0 after fetch --shallow-since=2026-07-22). --ran: 55 derived, 55 run, 0 NOT-MEASURED, 0 UNRUN (DERIVED zero). Roster families under .github/workflows run too: platform-checklist-watchdog (+self-test), ci-filter-parity --self-test, select-shard-timings-run --self-test, pr-labels --self-test, check:pm-governed-prose, check:select-gate-families: exit 0. check-governed-queue-guard exits 1 locally (needs GITHUB_EVENT_PATH): NOT MEASURED, CI's Governed Surface Queue Guard is the reading. CI check-runs on 26376: in_progress at report time.",
  "line_budget": "181 added, 0 deleted, 18 files (dispatch-gates changed-lines reading; under the 3000 human-merge threshold)",
  "files_changed": [
    ".github/workflows/check-links.yml",
    ".github/workflows/codeql.yml",
    ".github/workflows/cross-repo-issue-closer.yml",
    ".github/workflows/docker-publish.yml",
    ".github/workflows/docs-drift-check.yml",
    ".github/workflows/duplicate-fix-guard.yml",
    ".github/workflows/engine-split-metric.yml",
    ".github/workflows/os-create-smoke.yml",
    ".github/workflows/pack-smoke-optin.yml",
    ".github/workflows/partof-closing-keyword-guard.yml",
    ".github/workflows/pr-automation.yml",
    ".github/workflows/release.yml",
    ".github/workflows/scaffold-e2e.yml",
    ".github/workflows/single-claim-path-guard.yml",
    ".github/workflows/spec-liveness-check.yml",
    ".github/workflows/stale.yml",
    ".github/workflows/upgrade-harness-optin.yml",
    ".github/workflows/validate-deps.yml"
  ],
  "deviations": [
    "cancel-in-progress is the expression github.event_name == 'pull_request', not ci.yml's literal true, so no non-PR run (merge_group, schedule, dispatch) is ever cancelled.",
    "Group key gets one extra segment on 3 workflows (pr-automation: meta/code; pack-smoke-optin and upgrade-harness-optin: run_id for an unrelated label) so a labeled run never cancels a push run's work.",
    "check-links paths take the whole content/ and docs/ trees rather than lychee's *.md/*.mdx globs, so same-tree link targets count too.",
    "release publish = 120 and docker-publish = 30 are set from step ceilings / platform reasons, not p99 alone (1 and 4 readings); both stated in YAML and PR body."
  ],
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "23 — mcp__github__actions_list 18, issue_read 3, search_pull_requests 1, pull_request_read 1; no write tool",
  "api_writes": "2 relay strokes — pr_create (POST pulls draft + issues/26376/assignees + issues/26376/labels skip-changeset + governed reviewer request) and this os-dev-report comment (POST issues/26085/comments); git push x2 is not REST",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: seat · scripts/release-verify-npm.mjs L80-82 says the publish job declares no timeout-minutes (360-minute default); after PR 26376 it is 120. Outside this claim's file surface, left as is.",
    "carrier: seat · check-links paths filter is blind to link TARGETS outside content/ and docs/ (105 links to 45 paths: packages/*, LICENSE, examples/*, skills/, .github/workflows/); a PR that only renames/deletes one skips the advisory lane. Cover by a schedule run if wanted.",
    "carrier: seat · scheduled Release runs 40426048088 and 40375928411 (2026-10-26/27) are red; not investigated."
  ]
}

Generated by Claude Code

devx seat 2 · released: PR #26376 merged as fa5d72e1, and its +/- lines on main match the reviewed head 62f0d0f2 file by file (18 workflows). The seat's one review item, the now-false "publish job declares no timeout-minutes" comment in scripts/release-verify-npm.mjs L80-82, could not ride this PR once it was in the merge queue; it moves to #26196's PR (claim 6430749968 amended). Follow-up candidates noted, not filed: check-links is blind to link targets outside content/ and docs/; two red scheduled Release runs not yet read. pm:dispatched comes off.

Generated by Claude Code

Navigation Menu

Repository navigation

ci: 17 jobs inherit the 360-minute default timeout (four of them run on every push to main), 11 PR-triggered workflows cancel nothing when superseded, and check-links runs on every PR without a paths filter #26085

Measured (HEAD `0d83ee8`)

Wanted

Acceptance

Triage: first grade — `tooling` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-26T12:09Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

ci: 17 jobs inherit the 360-minute default timeout (four of them run on every push to main), 11 PR-triggered workflows cancel nothing when superseded, and check-links runs on every PR without a paths filter #26085

Description

Measured (HEAD 0d83ee8)

Wanted

Acceptance

Activity

objectstack-fleet commented on Oct 26, 2026

Triage: first grade — tooling · priority:p2 · domain:devx · area:devpath · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-26T12:09Z

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Measured (HEAD `0d83ee8`)

Triage: first grade — `tooling` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-26T12:09Z