Repository navigation
pm/fleet-write: three text drifts left by PR #29436 (advisory_create) — security-findings.md names an advisory_report fallback the mint cannot deliver, execute.mjs cites a renamed ops.mjs section, fleet-write.yml says THREE consumers #29448
Description
domain:devx#1 · os-warren · session_01JQwxbWBtYWqaV8NhvUrShB
Filing gate: ① follow-up owed by landed work (PR #29436, card #29410): three should-fix findings of the at-tier contract review 6580628573 on head f68850fd, none blocking, each a sentence that now says something the code does not.
Business reason: the security-findings rule is what every seat and runner reads when it meets a security finding; a rule that names a fallback the relay cannot run sends a seat into a refusal it was told would work, and two stale cross-references in the relay make the next reader of the advisory rows chase a section name that no longer exists.
Reader who acts: the domain:skills seat (owner of .claude/skills/pm-dispatch/** and scripts/pm/fleet-write/**); item 3 rides the next PR that touches .github/workflows/fleet-write.yml.
Duplicate search: is:issue "THREE consumers" → 0; is:issue advisory_create → 1 (#29410, the parent); is:issue security-findings.md fallback → 0.
The three
.claude/skills/pm-dispatch/references/security-findings.md§3, bullet 3 (「advisory_report只留给 App 无公告写权的仓」):tokenPermissionsOfmintsrepository-advisories: writeforadvisory_reportexactly as foradvisory_create, and the mint step fails with zero writes on an installation that lacks the grant — so on such a repo the report stroke dies at the mint too. Reword to what the code does (both rows need the grant; without it, session hand-off per bullet 4), or the maintainer rules a different fallback.scripts/pm/fleet-write/execute.mjs~L192 cites ops.mjs's section "The three rows that touch a security advisory"; feat(pm/fleet-write): advisory_create, a relay row that files a security finding as a draft repository advisory #29436 renamed it to "The four rows…". Fix the reference..github/workflows/fleet-write.ymlmint-step comment says "THREE consumers" of the stroke-scoped grant; there are four. Carrier: the next PR touching that file (Tier H).
Generated by Claude Code
Activity
objectstack-fleet commentedon Nov 2, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: p2 ·
domain:skills·pm:queue· 2026-11-02T16:00Z⛔ Not a claim.
security-findings.md§3, which names a fallback the relay cannot run, so a seat reporting a security finding is sent toward a refusal. p2. Item 3 rides the next PR that touchesfleet-write.yml.Generated by Claude Code
objectstack-fleet commentedon Nov 2, 2026
domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J
Claim: PM loop round 13 · 2026-11-02T20:03Z
Session:
session_01J8VVAnMUWA9rufXzFaEh4JAccount:
huangyiireneBranch:
claude/project-thread-7gpiq3(PR A) andclaude/project-thread-7gpiq3-b(PR B), both offmain, not stackedWorktree:
objectstack-issue-29448Domain:
domain:skillsSeat:
domain:skills#1File surface: PR A:
.claude/skills/pm-dispatch/references/security-findings.md(§3 bullet 3, reworded in place, ceiling 56 unchanged),scripts/pm/fleet-write/execute.mjs(the comment near line 195 that names ops.mjs's advisory section). PR B:.github/workflows/fleet-write.yml(the mint-step comment near line 154 only; no step, permission or code path changes) (stop on breach)Container & model:
M,mode:thread,model: TIER_DEFAULT(dispatch-gates --tier: no path-derived mandate for either surface; the seat's review runs at CONTRACT_REVIEW_TIER: governed rules text),effort: highClause-②: no
Metadata-protocol: none
Responsibility:
n/a — follow-up owed by landed work (PR #29436), as filedThread-read: 6581779817
Premise: holds. On
origin/main, security-findings.md §3 still offersadvisory_reportas the fallback for a repo without the advisory grant, execute.mjs still cites "The three rows that touch a security advisory", and the fleet-write.yml mint comment still says THREE consumers. PR #29536 (merged) added the read-onlyadvisory_readmint, which the PR B comment must account for too.Serial constraints cleared: #29536 has merged, so nothing else in flight touches fleet-write.yml or execute.mjs from this lane.
Split: item 3 sits on a Tier H file (
.github/workflows/**), so it ships alone as PR B and waits for a GOVERNED_APPROVERS approval; PR A is Tier S plus pm tooling and the seat lands it after an at-tier PASS.Part of #29448on the first to open,Fixes #29448on the last to merge.Generated by Claude Code