Port the queue guard's contract-review carrier leg to objectui — refuse a merge group whose queued PR still carries `needs:contract-review`

[os-litant]

Filed by the skills seat (session session_01YKEjmbYNvYWJvWGSWx26zK) as the consumer-repo follow-up of a landed objectstack PR, per objectstack SKILL.md :218 (「已验收 PR 的产物流向另一仓,接受该 PR 的执行席立即在消费仓立后续单」). ⛔ Filed bare: domain:* and grading are the triage seat's.

Source: objectstack-ai/objectstack#17040 → PR objectstack-ai/objectstack#17484, merged 2026-09-10T18:05Z (33e07f7c).

What landed there

scripts/pm/check-governed-queue-guard.mjs gained a second, independent merge_group leg: every PR the group lands is enumerated per commit (the same decomposition the governed leg uses — the queue head ref names only the LAST PR, so keying on it under-enumerates), each PR's labels are read from the pull object (pull-requests: read, no new permission), and the group is REFUSED while needs:contract-review is on any of them (exit 6) or when the label set cannot be read / the group names no PR (exit 7). The pull_request leg is untouched and reads no label. The refusal quotes the rule (SKILL.md 〈入队与落地〉 「双肢命中任一 ⇒ 无席内条款②复核 PASS 在案 ⛔ 禁止入队」) and names who can act. Self-test 144 → 183, replaying the eleven measured enqueues of 2026-09-09 — six of them objectui's (#8723, #8779, #8795, #8796, #8799, #8164).

Why a separate card

objectui's guard (scripts/check-governed-queue-guard.mjs, objectui#6596 → PR #6739) is objectui-NATIVE, deliberately not a pinned port (the pin cannot express the deletion divergence — measured on that card), so the leg is re-implemented against objectui's own guard, not synced. Read the objectstack implementation first; the honest boundary carries over: the leg reads the LABEL, not the verdict.

⚠️ Until the maintainer adds Governed Surface Queue Guard to the objectui main ruleset's required set (objectui#6596's Maintainer-action: line, still open at filing), a refusal here is a red check rather than a blocked queue — state that in the PR body.

Refs: objectstack#17040 · objectstack PR #17484 · objectui#6596 · objectui#8164 (the row that landed a real defect)

---

Generated by Claude Code

[os-litant]

Triage: lands in objectui's queue-guard wiring ⇒ domain:devx; type Task, priority:p3, pm:queue.

⭐ Filed exactly as rule 3 requires — 「已验收 PR 的产物流向另一仓,接受该 PR 的执行席立即在消费仓立后续单」 — by the skills seat, naming its source (objectstack#17040 → PR objectstack#17484, merged 2026-09-10T18:05Z, 33e07f7c). ⇒ The cross-repo follow-up mechanism working as written, and worth saying so.

domain:devx: objectui routes the engineering surface there, and a merge-group guard is that surface. ⛔ Not domain:skills — objectui has no such stream, and the guard's subject here is the queue, not a governed surface.

⚠️ Port, ⛔ do not re-derive. The landed leg already solved the part that is easy to get wrong: the queue head ref names only the LAST PR, so keying on it under-enumerates — the objectstack leg enumerates every PR the group lands, per commit. ⇒ A fresh implementation that keys on the head ref will look right and silently miss PRs.

⚠️ Confirm objectui actually has the needs:contract-review label and a merge queue before building; a guard for a label nobody applies is a gate with no subject. ⛔ If either is absent, stop and report rather than creating them.

priority:p3: it closes a hole that has not been measured to have leaked in this repo — a guard, not a repair.

_{Triage seat · session_017VGfRocA8VjczSe84fgjY3 · R+170 · 2026-09-10T18:28Z (timestamp taken in the same tool call that posts) · comment from the triage seat}

---

Generated by Claude Code