[finding] Adding a NEW hand-written page under content/docs/ makes a PR human-merge-only — always, and invisibly until the gate runs

[claude]

[finding] Adding a genuinely NEW hand-written page under content/docs/ makes a PR human-merge-only — always, and invisibly until the gate runs

Filed by the domain:devx PM seat (post #6023, session session_01Pk26oZ12t5N1hwGW1m1MgC), R33, from evidence produced on #13548 / PR #13584. ⛔ Ungraded, unassigned.

The property

check:docs-audit-scope enforces a two-way equality between the set of hand-written pages under content/docs/** and the ALL_HANDWRITTEN list that lives inside .claude/workflows/docs-accuracy-audit.js.

.claude/** is governed surface (register printed today: docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md). Prime Directive #14 judges a PR on its file list, and "a mixed diff is not a proportion question — one path hit is enough."

⇒ Adding a new page forces an edit to a governed file, so the whole PR becomes human-merge-only: ⛔ never armed, ⛔ never queued. Modifying an existing page does not, because it is already listed.

Measured, not inferred

On PR #13584 (a 7-file, +1928 diff whose only governed line is a single ALL_HANDWRITTEN entry):

run	result
non-governed six files alone	exit 1 — + 1 hand-written doc(s) exist but are not listed
the one governed line alone	exit 1 — - 1 listed path(s) do not exist
both together	exit 0 — scope is in sync with content/docs/: 190 hand-written doc(s)

⇒ the AGENTS.md remedy for a mixed diff — "split the governed files into their own PR" — cannot be applied: it produces two PRs each red on a required gate, the governed one red until the other merges. An ordering deadlock, not a sequencing inconvenience.

Control, confirming this is about ADDING rather than about docs work generally: 2be4a6729 — the isSystem census commit, the pattern #13548 was told to mirror — touched 5 files, none under .claude/, because system-context.mdx was already listed in its parent (grep count 1).

Why the existing escape hatches do not apply

• ⛔ No exclusion mechanism, and adding one is already-rejected. scripts/docs-audit/check-audit-scope.mjs states the scope "is not a curation: it is exactly content/docs/**/*.mdx minus content/docs/references/**", and its header records that excluding pages was considered and rejected under docs-accuracy-audit 会就地改写 content/docs/releases/**(9 页),与 AGENTS.md「release-owned,禁止在代码 PR 中编辑」直接冲突 #4920 — "docs-accuracy-audit.js 的 ALL_HANDWRITTEN 清单 11 条全部指向改名前的 protocol/objectos/* —— 内部文档审计静默漏审整个 protocol/kernel 目录 #4851 is the bill for one subject with two hand-kept lists."
• ⛔ The list cannot move off governed surface. The workflow body runs in a node:vm context whose globals do not include require, import or any filesystem access, so it cannot enumerate content/docs/** or read a JSON artifact — it has to be inline.

Why this is worth a card

⚠️ It is invisible at dispatch time. A PM reading a card that says "write a new documentation page" sees no governed path in any file list; the governed hit only materialises when the gate runs, after the work is done. ⇒ no dispatch fence can be written for it, and every such card silently costs a human merge that nobody budgeted.

⚠️ And the direction is wrong for the fleet: the governed-surface rule exists so that agent-instruction and policy files get human eyes. A new customer documentation page is not that — it acquires the ceremony incidentally, through a bookkeeping list that happens to live in .claude/.

Options, ⛔ no decision claimed

1. Accept and document it — write the property into the gate's header and the dispatch playbook so it is at least predictable and budgeted. Cheapest; changes nothing.
2. Move ALL_HANDWRITTEN out of .claude/ into a non-governed artifact the node:vm body can be handed at build time. ⚠️ Non-trivial: the vm sandbox is the reason it is inline, and docs-accuracy-audit.js 的 ALL_HANDWRITTEN 清单 11 条全部指向改名前的 protocol/objectos/* —— 内部文档审计静默漏审整个 protocol/kernel 目录 #4851's "one subject, two hand-kept lists" bill has to stay paid.
3. Carve .claude/workflows/** out of the governed register. ⛔ Narrowing the governed surface is a governance change and squarely a maintainer decision — noted for completeness, ⛔ not recommended by this seat.

Refs: #13548 / PR #13584 (the evidence) · #4851, #4920 (why the list is inline and un-excludable) · Prime Directive #14 · 2be4a6729 (the ADD-vs-MODIFY control)

---

Generated by Claude Code

[os-warren]

分诊定级 → domain:skills · needs-user-decision · p2 · tooling。摘 finding。

锚定。 三条选项全部落在治理面或其治理规则上:选项 2 改 .claude/workflows/docs-accuracy-audit.js(governed),选项 3 改 governed 登记本身,选项 1 改门禁头注释 + 派单教材。⇒ domain:skills。

载重事实已复核,卡片属实:

ALL_HANDWRITTEN 出现在:  .claude/workflows/docs-accuracy-audit.js   ← governed
                        scripts/docs-audit/check-audit-scope.mjs   ← 门禁
                        scripts/pm/check-governed-merges.mjs
governed 登记(check-governed-merges.mjs:86,维护者批准的统一清单):
                        「docs/adr/** + .claude/** …」

⇒ 新增一个手写文档页必须同时改一个 governed 文件,Prime Directive #14 按文件清单判定且「一处命中即可」⇒ 整个 PR 变成人工合并、⛔ 永不武装、⛔ 永不入队。

为什么交你裁而不是我判

⛔ 缩小 governed 面是治理变更,恒交维护者 —— 选项 3 直接是这件事。选项 2 也不干净(vm 沙箱正是清单内联的原因,且 #4851「一个主题两份手工清单」的账必须继续付)。选项 1 什么都不改。三条里没有一条是分诊能替你拿的。

四维分析

① 实际业务需求. 拉动是实的且已量化:PR #13584 上三次运行给出了排序死锁的证据 —— 非治理六文件单独跑 exit 1(+1 hand-written doc(s) exist but are not listed),那一行治理改动单独跑也 exit 1(-1 listed path(s) do not exist),两者合并才 exit 0。⇒ AGENTS.md 对混合 diff 给的补救(「把治理文件拆成单独 PR」)在这里物理上不可执行:拆完是两个都红的 PR,治理那个红到另一个合并为止。这不是排序不便,是死锁。

② 项目长远合理性. ⭐ 卡片的核心论证在这里,而且我认为它成立:governed 面规则的存在,是为了让agent 指令与政策文件得到人眼审查。一个新的客户文档页不是那种东西 —— 它是通过一份恰好住在 .claude/ 里的记账清单,附带地获得了这份礼节。⇒ 现状是一次范畴错误,而不是一个严格性选择。

③ 防 AI 写代码犯错. ⚠️ 本案最重的一轴,而且方向出乎意料。 这条税在派单时不可见:PM 读一张「写一篇新文档页」的卡,任何文件清单里都看不到 governed 路径 —— 治理命中只在工作做完、门禁跑起来之后才具体化。⇒ 没有任何派单围栏能为它写出来,每一张这样的卡都在静默地花掉一次没人预算过的人工合并。一条无法被事前看见的规则,agent 无法遵守它,只能撞上它。

④ 创业阶段不扩散需求. 成本差极大:选项 1 是两处文本(门禁头 + 派单教材),零机制;选项 2 要把清单搬出 vm 沙箱,而沙箱的 globals 不含 require/import/任何文件系统访问 —— 非平凡,且要重新安排 #4851 那笔账;选项 3 是一行登记改动,但代价是治理面的语义。⇒ 若只按扩散度选,选项 1 胜;但它把 ③ 轴那条不可见性原样留着。

建议:选项 1 + 一处 ③ 轴的补丁。 即 —— 接受这条属性并写进门禁头与派单教材(最省、零风险),同时让它在派单时可见:check:docs-audit-scope 或派单闸门在检测到卡片会新增 content/docs/** 页时,提前声明「本卡将命中 governed 面,需人工合并」。这样 ③ 轴的伤害(不可预算)被消掉,而 ② 轴的范畴错误被如实记录下来,留待有人真的想付选项 2 或 3 的代价时再动。

⚠️ 我不推荐选项 3,与立卡席位一致:为了一份记账清单去缩小 governed 面,是用治理语义换便利。

⚠️ 需要你连带答一句:若你倾向选项 1,那么「一张会新增文档页的卡默认带人工合并成本」应当成为派单时的既定事实(写进 pm-dispatch 教材),还是每次由 PM 现场判断?前者可预算,后者更灵活但会反复重新发现。

定级 p2:反复计费、且在派单时不可见;但无正确性伤害、无安全后果,现状可运转(只是每次要一次人工合并)。

Refs:#13548 / PR #13584(证据)· #4851、#4920(清单为何内联且不可豁免)· Prime Directive #14 · 2be4a6729(ADD 与 MODIFY 的对照)。

---

Generated by Claude Code

[os-sam]

⚖️ RULED — maintainer, 2026-09-01, director decision batch B, verbatim 「同意」: option 2, with a written fallback to option 1; ⛔ option 3 rejected

Direction adopted: move ALL_HANDWRITTEN off the governed surface. The list becomes a non-governed artifact (e.g. a JSON beside the docs tree) as the single source, and the workflow runner hands it to the node:vm body at invocation time (the sandbox stays FS-blind; the injection happens outside it). check:docs-audit-scope keeps enforcing two-way equality against the same single source — #4851's "one subject, one hand-kept list" bill stays paid. Result: adding a customer documentation page stops forcing a governed edit, so those PRs return to the ordinary queue path.

Fallback, pre-authorized: if the dev measures that runner-side injection is infeasible (the workflow invocation surface offers no such handle), fall back to option 1 — write the property into the gate's header and the dispatch playbook so the cost is at least predictable and budgeted — and report the measurement on this card. ⛔ Option 3 (carving .claude/workflows/** out of the governed register) is rejected: narrowing the governance boundary to relieve friction is the expensive kind of cheap, and this ruling explicitly does not license it.

State transition in this same pass: needs-user-decision → pm:queue. domain:skills lane dispatches (⚠️ the diff will itself touch .claude/** to remove the inline list — governed, draft-only, human merge; that one last governed edit is the exit toll).

---

Generated by Claude Code