PM board snapshot: a scheduled workflow archives every issue, comment and PR record to an orphan branch, so an account suspension destroys no record — with a restore recipe

[os-litant]

Filed by the skills seat (session session_01YKEjmbYNvYWJvWGSWx26zK, GitHub os-litant) on the maintainer's direct instruction in this seat's chat, 2026-09-10T10:5xZ, verbatim and untranslated: 「申诉过，10天没回复了；账号都是免费的；板面快照这个应该谁来处理？分诊吗？」 — answered: this lane (PM-loop tooling), not triage. Routed domain:skills · pm:queue · priority:p1 · Task under the maintainer direct-dispatch channel.

Why (measured, not inferred)

Three fleet accounts were suspended in two months; the appeals are unanswered after ten days. #17374 F3 measured what a suspension destroys: every issue, PR and comment the account authored — while every branch and commit survives (they belong to the repository). The board (issue bodies, labels, Claim: / ACCEPT / ruling comments) is the fleet's only state by rule (「GitHub 之外永不维护任何跟踪状态」), so today one suspension erases state that nothing else holds: #17297 (a p1 security decision card), #17128, #17150, #17276, #17313, #17318 are gone and not yet rebuilt.

Deliverable

1. scripts/pm/board-snapshot.mjs — reads, over repo-scoped REST with the token the caller supplies, every issue and PR of the repo (state all) updated since the previous run (since from the archive's own last-run stamp; the first run is full), and for each: the issue/PR object (number, title, body, state, state_reason, labels, assignees, type, milestone, timestamps, closed_by), the full comment thread, and for PRs the reviews and review comments. Writes one JSON file per number under a deterministic layout (e.g. issues/<n>.json, comments/<n>.jsonl, reviews/<n>.jsonl) plus a manifest.json (run stamp, counts, the since used, open_issues_count read at run time). Idempotent: a re-run with nothing changed writes nothing.
2. .github/workflows/board-snapshot.yml — scheduled at the half-state patrol's cadence (read its cron: and copy it), runs the script with the workflow's own GITHUB_TOKEN (identity github-actions[bot] — not a fleet account, cannot be suspended with one), and commits the result to an orphan branch board-archive in this repository (no new repo, no new credential; contents: write + issues: read + pull-requests: read only). Concurrency group so two runs never race the branch. The adoption rule from half-state-patrol.yml applies: a sibling repo adopts by copying the workflow, not by pointing this one at it.
3. --restore <n> — prints (does not post) the recreate payload for a destroyed card from the snapshot: the original body under a provenance header stating the original number, author, timestamps and 「rebuilt from the board snapshot at ; the original was destroyed with its author's account」, the labels to re-apply, and the comment thread as a second block — the 共享身份的限流纪律不存在：一次限流信号约束的是「身份」不是「客户端」，而规矩只说了不要重试 —— 2026-09-10 全 fleet 停摆事故 #17374 F3.4 rule that a rebuilt record must say it is a rebuild. Posting stays a seat's act.
4. Self-test (--self-test, offline fixtures) covering: incremental since selection, idempotence, the manifest counts, the restore header, and the refusal to run without a token.

Acceptance

• One real run on this repository (via the workflow or locally with GH_TOKEN) whose manifest count of open issues equals the repo's open_issues_count minus open PRs at the same stamp — the count check the REST channel table already requires of every enumeration; a mismatch is a red run, never a warning.
• A restore drill: pick one closed low-value card, run --restore, compare the printed body byte-for-byte with the live body — proof the recipe can be followed.
• Negative control: no seat reads the archive for state — the archive is a read-only backup (the one-board rule stands); the PR body says so and the script has no write path to GitHub.
• Budget: the scheduled run must fit the GITHUB_TOKEN per-repo rate limit at the measured update rate (the half-state anchor reports ~154–415 closed-issue updates/day); state the per-run request count in the PR body.

Governing text

.claude/skills/pm-dispatch/SKILL.md 全体座位的不变量 (「GitHub 之外永不维护任何跟踪状态」 — an archive is not a tracker; nothing here reads it for state); #17374 F3 (branches survive, records do not; a rebuilt record must self-declare); rest-channel.md (an enumeration without a count check is not a reading).

Not in scope

The identity architecture (GitHub App for fleet writes vs. paid machine accounts) — a maintainer decision, filed separately. Rebuilding the six destroyed cards named above — the services seat's, from its own container's fetched payloads where they survive; this tool prevents the next loss, it cannot recover this one.

Dedup

Open domain:skills titles scanned 2026-09-10T10:5xZ for snapshot / archive / backup / 快照 / 归档 / 备份: zero hits (control: the half-state anchor #9857's title carries "generated view"). Nearest: #17374 (the incident card; asks 3–5 are discipline text, this card is the tool).

---

Generated by Claude Code

[os-litant]

Claim: PM loop round 1
Session: session_01YKEjmbYNvYWJvWGSWx26zK (GitHub os-litant, skills seat), claimed at 2026-09-10T10:56Z
Branch: claude/issue-17390-board-snapshot
Worktree: objectstack-issue-17390
Domain: domain:skills (PM-loop tooling; maintainer direct dispatch — 「或者用 ci 写个定时任务备份？」, chat, same hour)
File surface (region-declared): new scripts/pm/board-snapshot.mjs (+ its self-test, wired in package.json and the lint workflow's self-test step per the repo's self-test-wired gate), new .github/workflows/board-snapshot.yml; ⛔ nothing under .claude/**, ⛔ no existing scripts/pm/* file (check-clause2-carriers.mjs is PR #17368's), ⛔ no SKILL.md / AGENTS.md (#17225 / #16851 in flight) (stop on breach; explain in the report)
Container & model: M (a new tool with layout and restore-recipe choices), mode:subagent, model: opus (default tier) — dispatch-gates.mjs --tier on the two new paths prints no path mandate; review = skills-seat self-review at the contract-review tier.
Clause-②: no — internal tooling; no accept set or public surface moves.
Thread-read: none (0 comments at claim time; body read in full — this seat wrote it).
Serial constraints cleared: both paths are new (ls at claim: neither exists; no board-archive branch on origin); the in-flight cards touch AGENTS.md (#16851) and SKILL.md + lane files (#17225); PR #17368 (at the terminal) touches check-clause2-carriers.mjs — disjoint; H17 hold index names neither path; verify-lock free.

---

Generated by Claude Code

[os-litant]

Dispatched — R1 wave 2 (third slot), 2026-09-10T10:58Z, mode:subagent, build tier opus (no path mandate), skills-seat review at the contract-review tier. Claim 5617561348 is the dev's identity; branch claude/issue-17390-board-snapshot, cut from eb7406ca. Maintainer direct dispatch (chat, verbatim: 「或者用 ci 写个定时任务备份？」). Constraints carried: REST only, resumable under the workflow token's 1,000/h budget, ⛔ no full-board pull on a user token, archive is read-only (one-board rule), --restore prints and never posts. Terminal: not governed ⇒ seat review → ready → queue. Disjoint from #16851 (AGENTS.md) and #17225 (SKILL.md + lane files).

---

Generated by Claude Code

[os-litant]

os-dev-report

{
  "issue": 17390,
  "status": "done",
  "branch": "claude/issue-17390-board-snapshot",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17404",
  "premise_still_valid": true,
  "summary": "New scripts/pm/board-snapshot.mjs archives the whole board over repo-scoped REST reads only: one JSON per number with fixed key order, comments and PR reviews as JSONL, and a manifest carrying the run stamp, the since used, counts by state, the repo's own open_issues_count read in the same run, the request count and a resume cursor. Runs are incremental from the previous manifest and idempotent (an unchanged board writes nothing); the page walk ends only on a short page, never on Link rel=next, and re-anchors since on the last row's value rather than incrementing an offset, which is what stops a mid-walk update from skipping the row at a page boundary permanently. New .github/workflows/board-snapshot.yml runs it four times a day at the half-state patrol's cadence as github-actions[bot] into the orphan branch board-archive, with contents:write + issues:read + pull-requests:read and nothing else. --restore N prints, never posts, the recreate payload with the provenance header #17374 F3.4 requires. The card's premise held in full: the six destroyed cards, the branch-survives-record-dies asymmetry and the one-board rule all check out against origin/main and the live board.",
  "tests": "All at head 0c5c3f08, exit codes captured before any pipe. GATES: node scripts/pm/dispatch-gates.mjs --commands derived 64 families; all 64 run; reconciled back through --ran -> 'dispatch-gates --ran: 64 derived famil(ies) accounted for - 59 run, 5 NOT-MEASURED (5 DERIVED from a recorded exit 3)', exit 0. The 5 are check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content, check:type-check-debt, each exit 3 PREREQUISITE NOT MET on an unbuilt tree; they are matched only through the Build Core job's package.json filter and this diff's package.json change is one scripts entry, so NOT MEASURED, not green, CI builds and runs them. check:pm-dispatch-gates FAILED on the first draft (3 of 1674 cases: the workflow was scheduled-only) and passes now (1674 cases). SELF-TEST: pnpm check:pm-board-snapshot -> 70 cases across 8 batteries, offline, no network, no token; wired into lint.yml's required job the way PR #17326 wired post-stamped; check:self-test-wired and check:self-test-workflow-commands both green. LINT: pnpm lint (eslint . --no-inline-config) run in FULL, not narrowed - exit 0, no output. GOVERNED: check-governed-merges.mjs --test on the final file list -> NOT governed, exit 0. LIVE DRILL (narrow window, per Zone 2D): snapshot over a 2h window with --limit=20 -> 20 numbers in 29 requests, 35 files written, resume cursor written, count check PENDING; identical re-run -> 'written 0 file(s), idempotent'; --verify-counts -> enumerated 584 open issues by walking pages to a short page, board reports open_issues_count 604 minus 20 open PRs = 584, 'count check ok - the enumeration is a reading', 9 requests. RESTORE DRILL: --restore 17350 on a closed low-value card, archived body vs live body byte-for-byte identical (both 8156 bytes, sha256 a7ae5631e03efd4fa7056a1d29a4ac2793c6c6b21348a504ba58ea2e680e665b, cmp clean); the 20648-byte payload contains that body verbatim, carries the provenance sentence, renders 3 comment blocks and makes zero network requests. No ablation was owed: this is a new file with no existing verdict to invert, and the self-test's two structural cases (no mutating method literal, exactly one fetch call site) are the failure instrument for the one-board property.",
  "mcp_calls": "0 - every GitHub read and write in this run went over repo-scoped REST after a green probe; no MCP tool was called at all, dedup included (the PM's dedup reading was taken as given and needed no increment)",
  "gates": "64 derived, 59 run green, 5 NOT MEASURED (exit 3, PREREQUISITE NOT MET, unbuilt tree), 0 unrun; reconciled with --ran, exit 0",
  "line_budget": "new scripts/pm/board-snapshot.mjs 1351 lines; new .github/workflows/board-snapshot.yml 250 lines; wiring +21 lines in lint.yml and +1 line in package.json; 1623 insertions, 0 deletions, no file outside the region-declared surface",
  "files_changed": [
    "scripts/pm/board-snapshot.mjs (new)",
    ".github/workflows/board-snapshot.yml (new)",
    ".github/workflows/lint.yml (+21: the self-test step)",
    "package.json (+1: check:pm-board-snapshot)"
  ],
  "deviations": [
    "Zone 2A MEASURED and it holds: GET /repos/objectstack-ai/objectstack/rulesets?includes_parents=true returns exactly one ruleset, name 'main', enforcement active, conditions.ref_name.include = [~DEFAULT_BRANCH], rules deletion/non_fast_forward/merge_queue/pull_request/required_status_checks, and no parent org ruleset. board-archive is not the default branch, so no rule covers it and a contents:write token pushes unrestricted. GET /repos/.../branches/main/protection answers 403 Resource not accessible by integration for this credential, so the classic protection API is declared UNREAD rather than assumed empty.",
    "Zone 2B holds: check:self-test-wired is green with the new step, and check:self-test-workflow-commands passes on the self-test's output.",
    "Zone 2C measured rather than estimated: 187 numbers updated in a real 6-hour window (listing walked to a short page, 2 requests) x 1.45 requests/number (drill: 20 numbers cost 29) + 2 listing pages + ~10 for the count check = ~285 requests per scheduled run, inside the 800 cap and the 1000/hour budget.",
    "Zone 2D obeyed: no full-board pull with the user token. Local drill cost 67 requests by the tool across three runs; roughly 21 more by hand for the readings above and the PR/label writes; ~90 REST requests for the whole run. The first full snapshot is left to the bot across resumable runs.",
    "ADDED beyond the card's four items: --verify-counts, which runs the same countCheck arithmetic against a LIVE enumeration instead of the archive. Reason: the archive's own count check only becomes a reading after the first full snapshot finishes (days of scheduled runs on this board), so the rule the whole enumeration rests on would have gone unexercised until then. It answers the acceptance criterion's arithmetic today in 9 requests.",
    "ADDED beyond the card: board/gone.json, a hand-written ledger of numbers known destroyed or transferred. Without it a legitimate loss makes the count check's SURPLUS verdict permanently red, and a scheduled alarm that is always red is silence.",
    "DEVIATION from the dispatch's stated workflow shape: board-snapshot.yml carries a pull_request paths trigger. The first draft deliberately omitted it (PR-time budget) and check:pm-dispatch-gates refused it - that gate pins that no discovered family is reachable only through a schedule, and its failure text named the remedy. A PR run is --dry-run into the runner's temp dir, capped at 5 numbers and 25 requests, with the archive checkout and the commit both skipped: a pull request writes to neither the board nor the archive.",
    "DECLARED ABSENCE: closed_by is present and null in every record. The listing endpoint does not carry it and buying it would cost one extra request per archived number - the whole budget, spent on a field no restore needs. The key is present so a reader can tell 'not carried by this archive' from 'nobody closed it'.",
    "PLATFORM READING, new: a REST EDIT of a PR body APPENDS the platform's own bare footer block. Measured on this PR - a PATCH carrying the session-URL footer read back with TWO footers, and a PATCH carrying none read back with exactly one. The body therefore ends in prose attribution naming the session, with the platform's block below it; the stored body is otherwise byte-exact against what was sent. This is the REST/edit cell of the PR-body table in platform-readings.md, which records that the cells disagree and must not be generalised."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: half-state-patrol.yml's adopt list documented copying TWO files where the sweeper's imports require THREE, already corrected in that file's own header on 2026-09-03. This diff copies the corrected posture (a four-file adopt list derived from the imports, with a line saying the imports decide it and not the comment) rather than touching that file. Successor: the next PR that edits half-state-patrol.yml or ports it to a sibling repo.",
    "noted, not filed: resolveSweepRepo falls back to a DEFAULT_SWEEP_REPO when neither PM_SWEEP_REPO nor GITHUB_REPOSITORY is set, and its callers accept that default. For a tool that WRITES an archive claiming to be a repo's board, that default is how a copied file produces a complete, well-formed, green archive of the wrong board, so board-snapshot.mjs refuses source === 'default' locally rather than changing the shared resolver. Not a defect in the resolver (its other callers only read), so no card. Successor: any future PR giving a sibling repo its own copy of these tools."
  ]
}

---

Generated by Claude Code

[os-litant]

ACCEPT — PR #17404 (head 0c5c3f08) reviewed in-seat at the contract-review tier (skills seat, session session_01YKEjmbYNvYWJvWGSWx26zK, 2026-09-10T12:09Z).

• Implemented-by: os-dev subagent on branch claude/issue-17390-board-snapshot (claim 5617561348; default build tier; mode:subagent). Reviewed-by: session_01YKEjmbYNvYWJvWGSWx26zK (the skills seat) — independence pair holds; the seat's harness reading is the tier evidence.
• PR shape: draft; base main; first line Fixes #17390; skip-changeset (nothing published). Changed files read from the PR: exactly the declared four — scripts/pm/board-snapshot.mjs (new, 1351), .github/workflows/board-snapshot.yml (new, 250), lint.yml (+21, the self-test step in the required job), package.json (+1). Path face: check-governed-merges.mjs --test on the four paths ⇒ NOT governed (run by this seat on a detached review worktree at 0c5c3f08) ⇒ this seat lands it through the queue.
• Diff vs the card's four items: ① the archiver reads over repo-scoped REST only (GH_TOKEN/GITHUB_TOKEN, refuses without one and refuses a defaulted repo), one JSON per number with stable key order, comments and PR reviews as JSONL, a manifest.json with run stamp, since, counts, open_issues_count read in the same run, request count and a resume cursor; incremental from the previous manifest, first run full; idempotent; the page walk ends only on a short page and re-anchors since on the last row (the mid-walk skip the card's channel table warns about). ② The workflow runs at the patrol's cadence (37 1,7,13,19 * * *) plus workflow_dispatch, permissions contents: write + issues: read + pull-requests: read only, concurrency group, commits as github-actions[bot] into the orphan branch board-archive (first run: orphan + refusal if any main file is still tracked; later runs: fetch + worktree), commits only on change, never writes main or any issue; a budget stop (--max-requests, default 800) exits 0 with the cursor so the first full snapshot completes green across runs, a rate-limit stop exits 4 (honest red) with what was read already committed, a count mismatch exits 2. ③ --restore N prints the recreate payload with the provenance sentence 「rebuilt from the board snapshot at ; the original was destroyed with its author's account」, labels and the comment thread — never posts. ④ --self-test offline, 70 cases across 8 batteries incl. the two structural properties (no mutating method literal; exactly one fetch call site — the one-board rule mechanically).
• Verified by this seat at 0c5c3f08: self-test 「70 cases pass」 exit 0; --help states the no-write property; --restore on a missing record prints a clear miss; action versions (checkout@v7, setup-node@v7) match the repo's other workflows. CI at 12:08Z: 56 check runs — 39 success, 16 skipped, 1 in progress (Lint & Repo Gates); the PR-time dry run 「Snapshot the board to the archive branch」 completed success (dry-run, 5 numbers, 25 requests, no archive checkout, no commit). Dev gates: 64 derived, 59 green, 5 NOT MEASURED (exit 3 on an unbuilt tree — build-closure families CI owns), --ran reconciled; pnpm lint full exit 0; check:pm-dispatch-gates 1674 pass after the workflow gained the PR-time trigger that gate requires.
• Acceptance drills accepted from the report: narrow-window live drill 20 numbers / 29 requests, idempotent re-run 「written 0 file(s)」; --verify-counts 584 enumerated = 604 open_issues_count − 20 open PRs, 9 requests; restore drill on docs(releases): curate the 17.4.0 release page — replace the machine draft with release notes in the 17.3.0 shape, and retire the "machine draft" notices on the v17 index #17350 byte-identical (sha256 a7ae5631…); workflow git mechanics rehearsed in a throwaway repo (orphan first run, exists path). Zone-2 A measured (one ruleset, main only; classic protection API 403 ⇒ UNREAD, declared); C measured ~285 requests per scheduled run; D obeyed (~90 user-token requests total, no full-board pull).
• Additions beyond the card, accepted with their reasons: --verify-counts (exercises the count rule before the first full snapshot completes); board/gone.json (a hand-written ledger so a legitimate loss does not keep the SURPLUS verdict red forever); the PR-time pull_request dry-run trigger (required by check:pm-dispatch-gates, capped, writes nothing). Declared absence: closed_by present and null (one extra request per number for a field no restore needs).
• noted, not filed (承接者: this seat, next touch of the file): --restore of a number the archive does not carry exits 0 with a message; a non-zero exit would let a script tell miss from hit. Dev's notes accepted as noted (the patrol adopt-list discipline; resolveSweepRepo's default refused locally).
• Terminal: not governed ⇒ landing by this seat: flip ready → auto-merge/queue once every check on 0c5c3f08 is green (flip point armed); on MERGED: landing record here + pm:dispatched / assignee cleared; the first scheduled run seeds board-archive — its first summaries are read at the next patrols, and the sibling repos adopt by copying the workflow (their seats).

---

Generated by Claude Code