[objectstack-fleet]

Requested by Warren · project thread
Fixes #29517

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:ci.yml 的 Test UI 全量腿加挂逐文件耗时 reporter 并在全量电池事件上传每片报告;新增每周一的 ui-test-timings-refresh.yml,把最新合格运行的报告合并成 ui/scripts/test-shard-timings.json 并以 fleet App 开 PR。
• 为什么改:ui/ 并入时 reporter 与 refresh 都没搬过来,该数据集自 2026-10-19 冻结,CI 读不到 Test UI 各文件耗时,tests: 56.5% of spec files are per-issue pins costing 52.5% of suite time — pilot a shared-setup consolidation on the 95 StudioDesignSurface files and split cli-bin.test.ts (74.6 s) #25911 试点与 Tests grow 2.5 times faster than source: measure the per-fix test weight and the #25911 pilot, then roll the shared-setup merge out to the heaviest components or retire it #29469 的四个折叠无法在 CI 复核,分片也按旧数据切。
• 风险与回滚:只报不判(按裁决无阈值、无新红门);上传步 continue-on-error,缺报告只是 warning,不会让分片转红;回滚即 revert 本 PR。
• 先看:.github/workflows/ci.yml(test-ui 的 Run the ui tests 与新的上传步)、.github/workflows/ui-test-timings-refresh.yml、ui/scripts/test-file-timings.mjs(shardJobName 改为 Test UI (N/M))。
• 两分钟验证:cd ui && pnpm exec vitest run scripts/__tests__/test-file-timings.test.ts,预期 15 passed。
• 需要你做的:受管面(.github/workflows/**,Tier H),请你审批并合并;合并后首个全量电池跑完,在 Actions 里手动触发一次 UI Test Timings Refresh 即可拿到首个刷新 PR。

What changes

• .github/workflows/ci.yml, job test-ui:

  • Run the ui tests (shard N/16): on the whole-suite branch (MODE=full: push, schedule, workflow_dispatch, and a pull request that failed open) it now also passes --reporter="${GITHUB_WORKSPACE}/ui/scripts/test-file-timings.mjs" beside default and github-actions, and the step sets OBJECTUI_TEST_TIMINGS_OUT to RUNNER_TEMP/test-file-timings/shard-N.json. The affected speed passes no reporter.
  • New step Publish this shard's per-file test timings: actions/upload-artifact@v7, name test-file-timings-N, only when the event is neither pull_request nor merge_group (the file's own deny-list for the full battery), continue-on-error: true, if-no-files-found: warn, retention 7 days on schedule and 2 otherwise.
  • The comment that said the reporter and refresh were not ported is replaced by one that says what runs and why.

• .github/workflows/ui-test-timings-refresh.yml (new), job Regenerate the per-file test timings: Mondays 05:47 UTC, workflow_dispatch, and pull_request on its own file and the three scripts it loads. It runs test-file-timings.mjs select --shards 16 --limit 6, downloads each run's test-file-timings-* artifacts with gh run download, drops a run whose download fails or comes back with fewer than 16 reports, runs merge into ui/scripts/test-shard-timings.json, and when the bytes changed pushes claude/ui-test-timings-refresh-RUN and opens the PR with skip-changeset as the fleet App. On pull_request every outward act is a dry run. With no eligible run (the state until a full-battery run uploads reports) it reads NOT MEASURED, warns, and stays green. It mirrors shard-timings-refresh.yml (Test Core, chore(ci): refresh the Test Core shard-timings dataset #28978) in shape, without that lane's ceilings, coverage accumulation and bin pins, which the ui dataset does not have.

• ui/scripts/test-file-timings.mjs: shardJobName now spells the root job, Test UI (N/M) (it spelled objectui's Test (shard N/M), so the selector could never find a shard here). generated_by names the workflow that exists. Header and one comment updated to the root paths.

• ui/scripts/__tests__/test-file-timings.test.ts: the pins its retirement note promised back, now against the root ci.yml (parsed) and the refresh: the shard job name, the reporter on the whole suite and not on the affected speed, the upload name and path and its report-only shape, the refresh's --shards against the matrix width, its download pattern, and that the workflow generated_by names exists.

• scripts/pm/dispatch-gates.self-test.mjs: the live population-marker census names every declaration by file and line, and its comment asks the author of a new one to add the row. The refresh's no-check-families declaration is the tenth row (count 9 to 10). Outside the claim's file surface, and the only file outside it.

Why

ui/scripts/test-shard-timings.json is what the Test UI sequencer splits on. On main 399df5bb its measured.at is 2026-10-19T…, its generated_by names .github/workflows/test-shard-timings-refresh.yml, which does not exist in this repository, and the ci.yml comment above Run the ui tests said the reporter and refresh were not ported. The writer, selector and generator were all present in ui/scripts/test-file-timings.mjs; only the CI wiring was missing, and the selector's job name still spelled objectui's.

Tests

• cd ui && pnpm exec vitest run scripts/__tests__/test-file-timings.test.ts scripts/__tests__/select-affected-tests-wiring.test.ts: 2 files, 25 tests passed (the wiring test runs the edited step as written).
• The writer under vitest 4.1.12, through the exact CI spelling: GITHUB_WORKSPACE=$PWD OBJECTUI_TEST_TIMINGS_OUT=… pnpm --dir ui run test --shard=1/1 --reporter=default --reporter=github-actions --reporter="$PWD/ui/scripts/test-file-timings.mjs" scripts/__tests__/test-file-timings.test.ts exited 0 and wrote {"schema":"objectui.test-file-timings/1","shard":"1/1",…,"files":[{"file":"scripts/__tests__/test-file-timings.test.ts","project":"unit",…}]}.
• Writer to generator: two files' report fed to merge --runs-file … --out COPY --summary … wrote a valid dataset (the reader's own datasetWeights check runs inside buildDataset) carrying the new generated_by.
• No ablation: the diff changes CI wiring and a name, not a tested behaviour of a package.

Acceptance notes

• The committed ui/scripts/test-shard-timings.json still carries the old generated_by string. It is generator output and is never hand-edited; the first refresh PR rewrites it from the corrected generator, together with a measurement date after this card. That refresh PR is what closes the card's "Done when".
• The reporter is spelled from the workspace root, not as ./scripts/test-file-timings.mjs relative to ui/ (objectui's spelling): check-self-test-wired keys a ./scripts/ path in a workflow to the root scripts/, so the relative spelling minted a key with no file behind it and redded its --self-test (measured on the first gate pass).
• The refresh carries the dispatch-gates: no-check-families declaration: it is path-filtered and runs a generator, not a named check; the scripts it loads are pinned by Test UI's test-file-timings.test.ts.
• Push runs feed the dataset as well as scheduled ones: unlike Test Core, a push run that starts Test UI runs the whole ui suite (mode=full), so it is a measurement. The selector already reads both.
• The refresh's pull_request leg on this PR will read NOT MEASURED (no run has uploaded reports yet) and stay green.
• ui/scripts/dependabot-merge-gate.mjs lists Regenerate the per-file test timings among its optional contexts; the new job carries that name. That file is otherwise not touched.

Verification

All readings at head 82d9d267 (branch off 399df5bb, then origin/main merged after PR #29556 landed, since that PR also edits scripts/pm/dispatch-gates.self-test.mjs).

dispatch-gates: 69 derived, 69 exit 0

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 69 commands, each run with its exit code captured before any pipe.
• 68 exited 0 on the first pass. pnpm --dir ui exec vitest run scripts/ exited 1 on the first pass after the merge (5 cases in check-doc-json-fences.test.ts, TypeError: fn is not a function inside zod, a file this diff does not touch); after re-running the seven-package @objectstack build the ui jobs run (turbo replay, 1 s under the lock) it exited 0: Test Files 170 passed | 2 skipped (172), Tests 4976 passed | 2 skipped (4978). Read as stale build state after the merge.
• pnpm check:pm-dispatch-gates exit 0: dispatch-gates self-test (fast tier): 1945 cases pass, including the live tree carries the ten declarations measured for this census.
• dispatch-gates --ran: "69 derived famil(ies) accounted for — 69 run, 0 NOT-MEASURED", exit 0.
• Two reds on the first gate pass (head b117998e) shaped the final diff: check-self-test-wired --self-test (the ./scripts/ reporter spelling) and the dispatch-gates coverage guard (the refresh's missing no-check-families declaration). Both are described under Acceptance notes.

outside the derived set

• pnpm --dir ui run type-check:scripts (what Type Check UI runs for ui/scripts): exit 0, 0 errors.
• pnpm --dir ui exec eslint scripts/test-file-timings.mjs scripts/__tests__/test-file-timings.test.ts: exit 0.
• Both workflow files parse with the yaml package the ui pins use.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes. (eslint on the two ui files: exit 0; repo-wide lint is CI's)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset. (publishes nothing: CI wiring and a private ui script; skip-changeset)
• 6. packages/spec touched: n/a.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.

---

Generated by Claude Code

[objectstack-fleet]

domain:devx#1 · os-warren · session_01JQwxbaBjisxkQo9hht9bFB

Contract-review-claim: session_01JQwxbaBjisxkQo9hht9bFB · head 82d9d26 · 2026-11-02T20:20Z

[objectstack-fleet]

domain:devx#1 · os-warren · session_01JQwxbaBjisxkQo9hht9bFB

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 82d9d267e895a74f2206d827b9e91038ba2cfb2a
Local-runs: none
Scope: .github/workflows/ci.yml, .github/workflows/ui-test-timings-refresh.yml + ui/scripts/test-file-timings.mjs, ui/scripts/tests/test-file-timings.test.ts, ui/scripts/tests/helpers/root-ci.ts, ui/scripts/tests/select-affected-tests-wiring.test.ts, ui/scripts/select-affected-tests.mjs, ui/scripts/test-shard-sequencer.mjs, ui/scripts/test-shard-partition.mjs, ui/scripts/test-shard-timings.json, ui/scripts/vitest-invocation-guard.mjs, ui/vitest.config.mts, ui/package.json, ui/scripts/dependabot-merge-gate.mjs, .github/workflows/shard-timings-refresh.yml, .github/workflows/lint.yml (schedule-gate), scripts/pm/dispatch-gates.mjs, scripts/pm/dispatch-gates.self-test.mjs, scripts/pm/check-expected-skips.mjs, scripts/check-self-test-wired.mjs, scripts/ci-shard-matrix.mjs

Inputs read: card #29517 body and all four comments (triage 6583780380, claim 6583993194, surface note 6585439229, os-dev-report 6587495139), PR #29588 body, file list and net diff (5 files, 511+/40-, against merge-base dbca3ef), the check-runs on 82d9d26 (refreshed read-only: 56 completed, every completed one success or an expected skipped; Lint UI, Test Core (1/8) and Type Check · consumer gates still in progress at the time of this record). Ruling 6583487846 on #29469 Q2 A governs: a reporter and a dataset only, no new failing check, no threshold. The two hits files were judged against the tree at pr-29588, never the PR body's account.

① Derived judgments

• ci.yml test-ui, whole-suite leg (MODE=full: push, schedule, workflow_dispatch, and a pull request or queue build that failed open) now passes a third reporter, ui/scripts/test-file-timings.mjs, beside default and github-actions; the affected speed passes none. Right: a slice is not a measurement, and the selector only ever reads push/schedule runs.
• New step Publish this shard's per-file test timings: always() AND the THE TWO SPEEDS deny-list, continue-on-error: true, if-no-files-found: warn, retention 7 (schedule) / 2 (else). Right: it can never red a shard; a cancelled or failed shard's partial upload is rejected by the selector because judgeRun demands every Test UI (N/16) job concluded success and every artifact present and unexpired. check-expected-skips and the dispatch-gates self-test both read the deny-list spelling and are green on this head.
• Test UI (N/16) job name, the Test UI required context (test-ui-gate, name:, if: always()), its OS_AGGREGATOR_MEMBERS / OS_AGGREGATOR_NON_MEMBERS roster and the 16-wide matrix are byte-unchanged; the ci.yml diff is confined to the test-ui job's run step, one new step and the comment above them. Right.
• New workflow UI Test Timings Refresh: Mondays 05:47 UTC, workflow_dispatch, pull_request filtered to its own file and the three scripts it loads. It publishes one check-run context, Regenerate the per-file test timings, that appears only on PRs editing those four paths and reds only on the refresh's own breakage (select exit other than 0/3, every download dropped, push/PR failure). Right under the ruling: nothing grades a duration and no threshold exists anywhere in the lane; the context is the same optional one ui/scripts/dependabot-merge-gate.mjs already lists, and the shape is shard-timings-refresh.yml's (which dispatch-gates.mjs requires: a lane reachable only on a schedule is refused).
• The refresh declares dispatch-gates: no-check-families on line 64, a whole one-line reason followed by a blank line; the self-test census names it as the tenth row (:64, sorted position correct). Lint · PM dispatch-gates is green. Right.
• shardJobName now spells Test UI (N/M) (was objectui's Test (shard N/M), which no job here carries, so select could never have taken a run); generated_by names the workflow that exists. Private ui script exports, consumers are the selector and its test. Right.
• The committed ui/scripts/test-shard-timings.json keeps the stale generated_by and measured.at 2026-10-19: generator output, rewritten by the first refresh PR, which is what closes the card's Done-when. Right, and the PR body says so.
• Accept-set outside hits: scripts/pm/dispatch-gates.self-test.mjs census 9 to 10 (surface note 6585439229, accepted by the seat; lane ACCEPT at TIER_DEFAULT). Read, not reviewed.

② Semver level

skip-changeset label present. The diff publishes nothing: two workflow files, a private ui script and its test, a pm self-test census row. Clause-②: no on the PR body matches the claim (6583993194) and the diff; no (narrowing) arm and no published spec or schema surface is touched. Right.

③ Boundary flags

• Deviation 1 (reporter spelled "${GITHUB_WORKSPACE}/ui/scripts/test-file-timings.mjs", not ./scripts/...): answered. scripts/check-self-test-wired.mjs's INVOCATION_RE strips a leading ./ and keys scripts/... to the ROOT scripts/, so the relative spelling mints a path with no file behind it. The absolute spelling is read by neither that regex nor the invocation guard (a --flag=value token is self-delimiting there). The test pins the exact spelling in argv.
• Deviation 2 (PR body footer form): cosmetic, no bearing.
• open_questions: [], security_findings: none: see ④ for the reviewer's own security reading; nothing to escalate.
• Out-of-scope note (dependabot-merge-gate.mjs OPTIONAL_CONTEXTS row describes objectui's workflow): legacy prose, the context name matches, left alone. Agreed.
• Surface widening (dispatch-gates self-test row): seat-accepted, the census comment assigns the row to the declaring author. Agreed.

④ Design judgment

ci.yml (test-ui): holds against the code it cites.

• The reporter writes $OBJECTUI_TEST_TIMINGS_OUT from onTestRunEnd, catches every error into one stderr line, and reads config.root (ui/, since pnpm --dir ui run test sets cwd) so report paths are relative to the vitest root, the same root test-shard-sequencer.mjs uses for pathKey. Keys will match the sequencer's.
• Upload gating: the deny-list is the file's own full-battery spelling; workflow_dispatch runs also upload but the selector takes only push/schedule, harmless. filter sets ui: 'true' on schedule (paths-filter skipped, || 'true'), so every 4-hourly run runs all 16 shards in mode=full; lint.yml's schedule-gate is that workflow's and does not touch ci.yml. The 7-day retention therefore comfortably covers a quiet weekend. Push runs only run Test UI when the diff touches ui or a ui-consumed package; others are skipped by name.
• Nothing here or in the refresh grades a duration or adds a threshold; the only new red surface on ci.yml is none (continue-on-error and warn).
• should-fix (A): no runner-side evidence on this head that vitest loads the reporter by absolute path. This PR's own Test UI shards ran the affected speed (select-affected-tests.mjs: workflows and scripts/ reach tests only through the always-on set), and select-affected-tests-wiring.test.ts records argv through a stand-in pnpm, so the sixteen green Test UI (N/16) prove the step's shell, not the reporter load. A reporter that fails to LOAD reds the vitest run at the load boundary, unlike one that fails to write; the first proof is the first push or scheduled run on main (failure direction: an immediately visible main-red, revert is the PR). Recommend a workflow_dispatch of ci.yml right after merge, watched, or a vitest-spawning smoke in test-file-timings.test.ts that passes the exact spelling against one file.
• should-fix (B): the upload carries no overwrite: true (ci.yml's own shard-attestation uploads do). On a re-run of a failed shard, the second attempt's upload of the same name errors, continue-on-error absorbs it, and the selector (jobs filter=latest, artifacts by name) merges the FIRST attempt's report of that shard. Per-file medians make the harm small, but overwrite: true is the one-line fix.
• should-fix (C, prose): the step comment's window arithmetic ("newest fifty completed runs ... so a push run's report needs two days and a scheduled run's a week") mislabels the bound: with main merges every 9-16 minutes (this file's own concurrency note) the newest fifty completed main runs span hours on a weekday and the selector examines at most 30 push/schedule candidates; retention is over-provisioned, which is the safe direction, but the next reader should not derive the window from retention.

ui-test-timings-refresh.yml: holds against the precedent and the ruling.

• Token scope and secret use: top-level contents: read; the job adds actions: read; persist-credentials: false. The App token is minted only when changed == 'true' AND event != pull_request, narrowed by owner + repositories (this repo by name; an empty list would widen to the installation) to contents: write + pull-requests: write, lives only in the write step's env: as GH_TOKEN, and is revoked by the action's post step. No workflows grant; the branch is cut from the checked-out ref and adds one commit touching only the dataset. Same pair and action as fleet-write.yml and shard-timings-refresh.yml.
• Can a pull_request reach the write path: no. pull_request never reaches the credential or mint steps; its write step runs with DRY_RUN=true and GH_TOKEN=github.token (read-only), every network act (gh auth setup-git, git push, gh pr create, gh pr view, both label calls) is behind outward, and the script refuses any DRY_RUN spelling other than true/false and refuses false on a pull_request. No pull_request_target.
• Untrusted input to shells: no ${{ }} inside any run:; all GitHub-context values enter through env:. Run ids are numeric from the Actions API (listing filtered to branch=main, event push/schedule, status=completed), split by whitespace only. Artifact contents come from main's own ci.yml runs (uploads are off on pull_request and merge_group), are parsed by readRunReports (schema-tagged) and validated by datasetWeights; report file names reach only summary.md and the PR body via --body-file (no shell) and the selector's stderr reaches the step summary sed-escaped. gh run download --pattern 'test-file-timings-*' places each artifact in its own subdirectory under a per-run directory.
• NOT MEASURED and partial data: select exit 3 writes not_measured=true, a warning and a summary, exits 0; download, generate, compose, credential, mint, write and nothing-changed steps all skip (their if: chains read empty outputs). A run whose download fails or returns other than 16 reports is dropped by name and kept-runs.json is rewritten to the kept set, so measured.runs describes exactly what was merged; zero kept is a red, correctly a finding. The Regenerate the per-file test timings check-run on this head is green on exactly the NOT MEASURED path (no main run has uploaded reports yet), which also proves the script's import closure resolves without a pnpm install (node builtins and sibling scripts only).
• Opens a PR, never pushes main: git switch -c claude/ui-test-timings-refresh-$NEWEST, gh pr create --base main, additive skip-changeset POST with a read-back and one re-apply, the precedent's shape line for line.
• Reporter can never red a shard: see ci.yml above; the refresh's own red is only its own breakage, as its header states.
• UI_TEST_SHARDS: '16' is pinned to shardTotal(ci, 'test-ui') by the test; the download pattern is pinned to artifactName.
• should-fix (D, inherited from the precedent): no guard that workflow_dispatch runs on refs/heads/main. A dispatch on another branch cuts the bot branch from that ref, so the opened PR would carry that branch's commits under the fleet identity against main. Operator-only (dispatch needs write), the selector still reads main's runs, and the precedent has the same hole; a one-line github.ref == 'refs/heads/main' conjunct on the credential/mint/write steps (or an early refusal) closes it in both lanes.
• Observation, no action: unlike the precedent there is no self-test step before the generator is trusted; the scripts carry no --self-test and are pinned instead by Test UI's test-file-timings.test.ts (15 cases, run on any change to them via the always-on set), which the no-check-families reason states.

Security-relevant observation, stated plainly: the write path is reachable on schedule and workflow_dispatch only; a pull_request run of this lane cannot mint or use the fleet App credential and cannot push, open or label; the credential is narrowed to this repository and two write permissions and never reaches a script argument or the log; no external string reaches a shell unquoted.

Must-fix: none. Should-fix: A (runner proof of the reporter load), B (overwrite: true on the upload), C (window prose), D (main-ref guard on dispatch, inherited).

Implemented-by: claude/project-thread-f33d6x
Reviewed-by: session_01JQwxbaBjisxkQo9hht9bFB

VERDICT: PASS

[objectstack-fleet]

domain:devx#1 · os-warren · session_01JQwxbaBjisxkQo9hht9bFB

Contract-review-claim: session_01JQwxbaBjisxkQo9hht9bFB · head 5f0c784 · 2026-11-02T20:57Z

[objectstack-fleet]

domain:devx#1 · os-warren · session_01JQwxbaBjisxkQo9hht9bFB

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 5f0c784fe69e44879a3fe73e2384e64c4f6a66f4
Local-runs: none
Scope: .github/workflows/ci.yml, .github/workflows/ui-test-timings-refresh.yml + ui/scripts/test-file-timings.mjs, ui/scripts/tests/test-file-timings.test.ts, ui/scripts/tests/helpers/root-ci.ts, ui/scripts/tests/helpers/child-vitest-env.ts, ui/scripts/tests/spawned-vitest-child-env-8616.test.ts, ui/scripts/tests/select-affected-tests-wiring.test.ts, ui/scripts/select-affected-tests.mjs, ui/scripts/test-shard-sequencer.mjs, ui/scripts/test-shard-partition.mjs, ui/scripts/test-shard-timings.json, ui/scripts/vitest-invocation-guard.mjs, ui/vitest.config.mts, ui/package.json, ui/scripts/dependabot-merge-gate.mjs, .github/workflows/shard-timings-refresh.yml, .github/workflows/lint.yml (schedule-gate), scripts/pm/dispatch-gates.mjs, scripts/pm/dispatch-gates.self-test.mjs, scripts/pm/check-expected-skips.mjs, scripts/check-self-test-wired.mjs, scripts/ci-shard-matrix.mjs

Second record on this PR; the first (6587756255, on 82d9d26) returned PASS with four should-fixes. This head is 82d9d26 plus one commit (3 files, 60+/4-) taking all four. The whole PR is judged here on 5f0c784, carrying forward what still holds; the delta was read as git diff 82d9d267 pr-29588c, the tree as pr-29588c. Inputs: card #29517 body and comments (card-comments2.json: no comment since the os-dev-report 6587495139), PR body (byte-identical to the one reviewed on 82d9d26), file list, the net diff against merge-base (5 files, 567+/40-), and the check-runs on 5f0c784 (checks2.json: 58 check-runs, all completed, 50 success, 8 expected skipped; none in progress). Ruling 6583487846 on #29469 Q2 A governs: a reporter and a dataset only, no new failing check, no threshold.

① Derived judgments

Carried forward unchanged from 6587756255, re-read on this tree, all still right:

• ci.yml test-ui whole-suite leg passes the third reporter; the affected speed passes none.
• The upload step is always() AND the THE TWO SPEEDS deny-list, continue-on-error: true, if-no-files-found: warn, retention 7/2; now also overwrite: true (the shard-attestation uploads' setting), so a re-run shard replaces its report instead of leaving the first attempt's under a continue-on-error warning. Right: still cannot red a shard; check-expected-skips and the dispatch-gates self-test are green on this head.
• Test UI (N/16), the Test UI required context, its roster env and the 16-wide matrix are byte-unchanged; the ci.yml diff is confined to the test-ui job.
• The new workflow's one context Regenerate the per-file test timings is optional, appears only on PRs editing its four paths and reds only on its own breakage. Right under the ruling.
• dispatch-gates: no-check-families is still on line 64 (the delta inserts after line 101), whole, blank line after; census row ten; Lint · PM dispatch-gates green.
• shardJobName spells Test UI (N/M); generated_by names the live workflow; the committed dataset stays generator output until the first refresh PR.
• New this head: a workflow_dispatch on any ref but refs/heads/main is refused before anything runs. Right: narrows the accept set of the write path to main only; schedule and pull_request skip the step.
• New this head: test-file-timings.test.ts gains one case that spawns the real vitest CLI with --reporter=ABSOLUTE_PATH in a scratch root. Right: it is a unit test in Test UI's always-on set, not a check family, and grades no duration.
• Outside hits (unchanged): scripts/pm/dispatch-gates.self-test.mjs census row, seat-accepted at TIER_DEFAULT.

② Semver level

Unchanged: skip-changeset label present, the diff publishes nothing, Clause-②: no matches claim 6583993194 and the diff. Right.

③ Boundary flags

• Deviations 1 and 2 of the os-dev-report: answered as before (the absolute reporter spelling is what check-self-test-wired.mjs's key regex requires; footer form cosmetic).
• open_questions: [], security_findings: none: nothing to escalate; see ④.
• The four should-fixes of 6587756255: A (runner proof of the reporter load), B (overwrite: true), C (window prose), D (main-ref guard) are each taken in this head and judged below. D was asked of both lanes; core's shard-timings-refresh.yml is deliberately untouched here and the seat cards it separately. Agreed: outside this card's surface.
• Surface widening and the dependabot-merge-gate prose note: unchanged, agreed.

④ Design judgment

ci.yml (test-ui): holds.

• Everything judged on 82d9d26 still reads the same in this tree: the reporter never throws into vitest, writes under config.root (ui/), and the selector rejects any run with a non-success shard or a missing/expired artifact.
• B taken: overwrite: true on the upload. With it, a re-run of a shard replaces that shard's artifact, so the selector's filter=latest jobs and the artifacts it merges describe the same attempt. The test's upload pins (uses, path, name, continue-on-error, if-no-files-found, the two deny-list conjuncts) are unaffected.
• C taken: the comment now says the selector reads only the newest completed push/schedule runs on main up to its own cap and that retention is deliberately wider than that window, not a measurement of it. Accurate against selectRuns (per_page 50, examined cap limit x 5).
• A taken, judged under the test file: on this head's PR CI the shards again ran the affected speed (every Test UI (N/16) log: Affected speed: 683 vitest filter(s)), so the ci.yml reporter flag itself was still not executed by a shard, as expected on a pull request; the load is now proven by the smoke instead (below).

ui-test-timings-refresh.yml: holds.

• D taken: Refuse a dispatch on any ref but main is the FIRST step of the job (line 107), before Checkout repository (115), Setup Node.js (120), the selector (125), and long before the credential check (262), the token mint (275) and the write (290). Its if: reads only github.event_name and github.ref; the ref reaches the shell through env: REF, inside double quotes, as an ::error annotation text; exit 1 reds the run with nothing checked out, nothing regenerated and no credential read. On schedule and pull_request the step is skipped and the lane runs as judged before. A tag or any non-main branch dispatch is refused alike.
• Token scope, secret use, the pull_request dry-run posture, the NOT MEASURED path, the drop-by-name on partial downloads, the opens-a-PR-never-pushes-main write step: all unchanged from 6587756255 and re-read unchanged in this tree. The Regenerate the per-file test timings check-run on this head is green on the NOT MEASURED path.

ui/scripts/tests/test-file-timings.test.ts (read as the gate of the ci.yml hunk; A's instrument):

• What it does: resolves vitest's bin through createRequire from the ui tree, writes a scratch root with an empty vitest.config.mjs and one smoke.test.mjs, spawns node VITEST run --root DIR --config DIR/vitest.config.mjs --globals --reporter=default --reporter=ABSOLUTE_PATH_TO_test-file-timings.mjs with OBJECTUI_TEST_TIMINGS_OUT set, and asserts exit 0, the schema tag and files equal to ['smoke.test.mjs']. This is the load boundary the first record said nothing on a PR proved: vitest's own CLI resolving a reporter by absolute path, the spelling ci.yml passes.
• Did it run in this head's PR CI: yes. The job log of Test UI (11/16) (check-run 125536096129) shows unit scripts/__tests__/test-file-timings.test.ts (16 tests) 830ms, green: the file's fifteen cases plus this one. The other fifteen shards did not carry the file (the always-on set is partitioned across the sixteen legs).
• Can it red or hang a shard: it cannot hang. spawnSync carries timeout: 120_000 (the child is killed and status becomes null, which fails the toBe(0) assertion with the child's output attached), the case carries its own 180 s vitest timeout, and the shard's timeout-minutes: 30 stands above both. It reds a shard only when the reporter fails to load or to write under the real CLI, which is precisely the failure the ruling's "never red a Test UI shard on main" guarantee wants caught on the PR that introduces it, in the affected speed, rather than on main's next full battery. Observed cost on CI: under a second for the whole file. The spawn builds its environment with childVitestEnv() (the VITEST* scrub and the agent-marker scrub), which spawned-vitest-child-env-8616.test.ts pins for every vitest spawn in the test tree; that pin is in the same green shard set. The scratch root's empty config means the ui tree's projects, setup files, sequencer and invocation guard are not in the child, so the case measures the reporter load and nothing else.
• Residual, not a finding: a runner so slow that a trivial vitest CLI run exceeds 120 s would red this case; the observed 830 ms for the whole file puts that two orders of magnitude away, and the failure would be a visible red on the PR's affected speed, never a hang and never main's full battery.

Security-relevant observation, stated plainly: unchanged from 6587756255 and strengthened by D. The write path is reachable on schedule and on a workflow_dispatch from refs/heads/main only; any other dispatch ref is refused before checkout; a pull_request run never mints or uses the fleet App credential and cannot push, open or label; the credential is narrowed to this repository with contents and pull-requests write only, lives in the write step's env alone and is revoked by the action's post step; no ${{ }} inside any run:; the only external inputs are numeric run ids from the Actions API (branch main, event push/schedule) and artifact contents produced by main's own ci.yml, reaching only the PR body via --body-file and the sed-escaped step summary. The new ci.yml overwrite: true and the new test add no network act and no credential.

Must-fix: none. Should-fix: none. The four should-fixes of 6587756255 are taken and hold against the tree; the core-lane half of D is carded separately by the seat.

Implemented-by: claude/project-thread-f33d6x
Reviewed-by: session_01JQwxbaBjisxkQo9hht9bFB

VERDICT: PASS

[objectstack-fleet]

domain:devx#1 · os-warren · session_01JQwxbaBjisxkQo9hht9bFB

维护者速读

• 改了什么:ci.yml 的 Test UI 全量腿加挂逐文件耗时 reporter,并在全量电池事件(push / schedule)上传每片报告;新增每周一的 ui-test-timings-refresh.yml,把最新合格运行的报告合并成 ui/scripts/test-shard-timings.json 并以 fleet App 开 PR(只在 main 上触发,其他分支的手动触发直接拒绝)。
• 为什么改:ui/ 并入时 reporter 与 refresh 都没搬过来,该数据集自 2026-10-19 冻结,CI 读不到 Test UI 各文件耗时,tests: 56.5% of spec files are per-issue pins costing 52.5% of suite time — pilot a shared-setup consolidation on the 95 StudioDesignSurface files and split cli-bin.test.ts (74.6 s) #25911 试点与 Tests grow 2.5 times faster than source: measure the per-fix test weight and the #25911 pilot, then roll the shared-setup merge out to the heaviest components or retire it #29469 的四个折叠无法在 CI 复核,分片也按旧数据切。
• 风险与回滚:只报不判(按裁决 6583487846 无阈值、无新红门);上传步 continue-on-error 且 overwrite: true,缺报告只是 warning;reporter 以绝对路径加载已由 PR 内的冒烟用例实跑证明(Test UI 11/16);回滚即 revert 本 PR。
• 先看:.github/workflows/ci.yml(test-ui 的 Run the ui tests 与新的上传步)、.github/workflows/ui-test-timings-refresh.yml(第一步拒绝非 main 的手动触发;写入路径的 App token 只限本仓 contents/pull-requests 写)、ui/scripts/test-file-timings.mjs。
• 两分钟验证:cd ui && pnpm exec vitest run scripts/__tests__/test-file-timings.test.ts,预期 16 passed。
• 需要你做的:受管面(.github/workflows/**,Tier H),请审批:契约复审 PASS 评论 6588359667,Head-sha: 5f0c784fe69e44879a3fe73e2384e64c4f6a66f4。批准后席位落地;合并后首个全量电池跑完,可在 Actions 手动触发一次 UI Test Timings Refresh(main)拿到首个刷新 PR。
• 席位意见:同意合并。两轮契约复审(6587756255 → 6588359667)无 must-fix,首轮四条 should-fix 已在 5f0c784f 全部采纳。

席位核对

ACCEPT · domain:devx#1 · head 5f0c784fe69e44879a3fe73e2384e64c4f6a66f4 · 2026-11-02T21:03Z

1. Shape: 5 files: .github/workflows/ci.yml (Test UI full-battery reporter, upload step), new .github/workflows/ui-test-timings-refresh.yml, ui/scripts/test-file-timings.mjs (shardJobName now Test UI (N/M), generated_by names a workflow that exists) and its test, scripts/pm/dispatch-gates.self-test.mjs (census row ten for the refresh's no-check-families declaration; the surface widening accepted in 6585439229). Merged origin/main after PR fix(dispatch-gates): a package-root vitest config or manifest edit derives check-console-intercept-disarm #29556, as the serial required.
2. Premise, measured: seat read on main 399df5bb before dispatch (dataset measured.at 2026-10-19; its generated_by named a workflow absent here). The reviewer found the old Test (shard N/M) job name could never have matched a job here, so select could not have taken a run.
3. Gates: dev's union at 82d9d267: 69 derived, 69 exit 0; at 5f0c784f the ui scripts vitest, check:pm-dispatch-gates, eslint and type-check:scripts. CI on this head: 58 runs, 50 success, 8 expected skips, none red, none in progress, including all 16 Test UI shards (the new smoke ran in 11/16), Lint · PM dispatch-gates and Regenerate the per-file test timings (green on its NOT MEASURED path).
4. Accepted deviations: the dispatch-gates.self-test.mjs surface widening (6585439229). The ci.yml reporter flag itself only executes on main's full battery; its load is proven by the smoke instead.
5. Out of scope: core's .github/workflows/shard-timings-refresh.yml has the same missing main-ref guard on workflow_dispatch (record 6587756255 should-fix D); the seat cards it separately. Skills-docs: none owed (Metadata-protocol: none, no narrowing).
6. Landing: Tier H (.github/workflows/**): the maintainer approves. Hand-off now: pr_request_reviewers to GOVERNED_APPROVERS, needs-user-decision on the PR while it waits. On an authorised APPROVED review the seat lands it (pr_ready + automerge_enable, every check on the then-current head green or an expected skip); a head move before that returns it to review.