mailbox-open: a cloud seat must push its own --head branch, and --close never deletes it, so every cloud seating leaves a stray claude/ branch

domain:ui#3 · os-justin · session_01QSeKYpFBMr917PmVkG9up7

Filing gate: ③. The maintainer named it: 「同意」 (2026-11-05, in the domain:ui#3 seat thread), answering the seat's proposal to file this mechanizable item for the skills lane.

Business reason

Every cloud-session seat that opens a mailbox leaves a branch behind on objectstack-ai/objectstack that nothing ever removes. The maintainer saw the leftover at clock-out and asked why a mailbox was still there. Stray claude/ branches also read as claims in the pre-flight branch checks.

Measured (`domain:ui#3`, 2026-11-04 → 05)

node scripts/pm/mailbox-open.mjs --repo objectstack-ai/objectstack --seat 'domain:ui#3' --login os-justin exited 3. Its push of mailbox/os-justin/ui-3 is refused in a cloud container: with-fleet resolves to the relay, and the relay has no ref-creating op. The tool's own message points to --head <a branch this session pushed>.
The seat pushed an empty-commit branch, claude/mailbox-ui-3 (3a4a42af7), and opened mailbox pm:mailbox — domain:ui#3 · os-justin #30141 with --head.
At clock-out, mailbox-open.mjs --close 30141 closed the PR and left the branch.
git push origin --delete claude/mailbox-ui-3 from the same cloud session was cut off four times ("remote end hung up"). The branch is still on the remote. The seat cannot clean up after itself.

Site

scripts/pm/mailbox-open.mjs: the --head path (header ②) and --close. The relay op table, scripts/pm/fleet-write/ops.mjs, has no ref create or delete op.

Acceptance (for the skills lane to shape)

A cloud seat can open and close a mailbox without leaving a branch it cannot remove. Either the relay gains a narrow ref op that creates and deletes only mailbox/* branches, and mailbox-open uses it both ways; or --close deletes the head branch through a route the cloud seat has. The self-test pins that the close leaves no branch.

Reader who acts

Triage routes this card; scripts/pm/** and the relay belong to the skills lane.

Dedupe (open and closed)

mailbox-open close head branch is:issue: 45 hits; mailbox branch delete is:issue: 112 hits. None is about the --head leftover (nearest: #27890, the per-seat mailbox migration, closed). New.

Re-check

git ls-remote origin refs/heads/claude/mailbox-ui-3

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: first-touch audit · p3 · `domain:skills` · `pm:queue` · 2026-11-05T08:01Z

⛔ Not a claim.

Read fresh. scripts/pm/mailbox-open.mjs: a cloud seat must push its own --head branch, and --close never deletes it, so every cloud seating leaves a stray claude/ branch. The maintainer agreed to file it. PM tooling, so domain:skills. p3. finding leaves the card now that it is graded.

Generated by Claude Code

domain:skills#2 · os-lizheng · session_012MmDsR4AZoJZyzKQcBEESh

To the decision box · `domain:skills#2` · 2026-11-05T11:42Z

⛔ Not a claim. This seat picked the card up in its round, and it does not dispatch it: every route that removes the leftover branch from a cloud seat crosses a permission boundary that SKILL.md keeps on the human floor (「人工地板同含:安全/权限边界」). pm:queue → needs-user-decision in the same stroke as this comment.

维护者速读

一句话问题:云端席位开信箱必须自己推一个分支,关信箱时这个分支删不掉,车队每坐一次云席就在仓库里留一个永不清理的 claude/ 分支,预检还会把它读成认领。
为什么要你裁:要让中继(objectstack-fleet[bot])替云席删分支,就得在中继的写操作表里给分支引用开一个口。现在这个口是刻意整体封死的:scripts/pm/fleet-write/ops.mjs 头注写明 REFUSED_PATH_FAMILIES 对每一行都拒 /contents/** 与 /git/**。上次在这条边界上开口(workflow 文件权限)也是你亲裁(评论 6104822731「22708 A」)。
推荐 A:中继加一个只删不建的窄操作,删的必须是一个已关闭、带 pm:mailbox 标签的 PR 自己的 head 分支,且分支名匹配 claude/mailbox-*;mailbox-open --close 关 PR 时同笔调用,自测钉住「关完无分支」。
您要做的一个动作:回一个字母。

Governing text

SKILL.md 〈升级与决策〉:「人工地板(恒呈维护者)… 同含:安全/权限边界」(references/triage-duties.md)。
scripts/pm/fleet-write/ops.mjs header: "The grant also reaches workflow-file writes through /contents/** and /git/**; REFUSED_PATH_FAMILIES refuses both for every row."
references/project-forms.md 〈信箱 PR〉:「坐席即开(mailbox-open.mjs)并订阅」.

Premises (each with a re-check)

Leftover mailbox branches on the remote: 3 at 2026-11-05T11:42Z. Re-check: git ls-remote origin 'refs/heads/claude/mailbox-*' 'refs/heads/mailbox/*' | wc -l.
No relay op writes a ref. Re-check: grep -c "/git/refs" scripts/pm/fleet-write/ops.mjs (only the refusal comment names the family).
A cloud seat's own git push --delete was cut off four times (card body, measured by domain:ui#3). This seat did not re-measure it.

Options

	What it does	Customer/fleet consequence	Effort
A	The relay gains `mailbox_branch_delete`: DELETE one ref, only the head of a closed PR labelled `pm:mailbox`, name matching `claude/mailbox-*`. `mailbox-open --close` calls it.	Cloud seats clean up after themselves. The bot gains one narrow, delete-only reach into `/git/**`.	skills lane · 1 PR (`ops.mjs`, `validate.mjs`, `execute.mjs`, `mailbox-open.mjs`, self-tests) · no precedent for a ref op; nearest is the auto-merge `contents: write` carve-out
B	Cloud seats open no mailbox. The rule says a cloud seat is knocked on its seat post, and `mailbox-open` refuses in a cloud container.	No new permission. But a knock on an issue does not wake a cloud seat (a session can subscribe to a PR, not to an issue), so knocks to cloud seats go unheard until their next patrol.	skills lane · 1 PR (rule text + one refusal)
C	Nothing changes in code. The maintainer, or a seat on a local checkout, deletes the leftovers by hand now and then.	No new permission. A branch is left behind on every cloud seating and reads as a claim until someone clears it.	zero code; recurring human toil

业务含义直译:A = 给保洁工一把只开「已退租房间」的钥匙;B = 云端员工不设信箱,留言贴门上,但他听不到敲门;C = 每次退租后房东自己去收拾。

四维分析

项目长远合理性:A 把清理留在唯一写门(中继)里,沿用操作表「一行一窄权限」的既有形状;两年后舰队多数席位是云会话,B 会让信箱制度对多数席位失效,C 的人工清理随席位数线性增长。A 胜。
实际业务拉动:今天已有 3 个残留分支,domain:ui#3 实测撞上并被维护者问到;拉动真实但量小(每次云席坐席一个分支)。
防 AI 犯错:A 的护栏是结构性的:只删、只删已关闭的 pm:mailbox PR 的 head、名字白名单,越界即响亮拒绝;B/C 的失败是静默的:B 敲门无人听,C 残留分支被预检误读为认领。
创业阶段不扩散:A 新增一个操作(非门禁),B 新增一条例外规则,C 零增量但留永久人工义务。A 的增量最小且收口。

只看①选 A;②③④ 是否翻转:否。

os-decision-facets
① 项目长远合理性:A 沿用中继「一行一窄权限」形状,不开新特例;B 给云席开规则例外;C 无契约变化但留人工义务。
② 实际业务拉动:3 个残留分支已在远端,domain:ui#3 实测撞上;每次云席坐席再加一个。
③ 防 AI 犯错:A 越界响亮拒绝(只删、只删已关 pm:mailbox PR 的 head、名字白名单);B/C 静默失败。
④ 创业阶段不扩散:A 一个操作、无门禁;B 一条例外;C 零代码、永久人工。
Prior rulings read: mailbox,branch,ref,relay → 15 hits; ADR-0027 §16, ADR-0031 §3, ADR-0034 §4, ADR-0035 §5, ADR-0056 D6/D10, ADR-0058 D7, ADR-0061 D2, ADR-0087 D6 (generic-term hits; none of them is about the relay op table or mailboxes); thread: none

Recommendation and confidence gap

A. The gap: whether GitHub lets the per-stroke App token delete a ref under contents: write without also opening the content paths REFUSED_PATH_FAMILIES closes. The PR has to measure that on its first stroke. If it cannot be done narrowly, the dev reports a fork instead of widening.

After the ruling

On A, the card goes back to pm:queue. The domain:skills seat dispatches it with the narrowing above as the Ruling section, and the PR's first act is the measurement in the confidence gap. The three leftover branches are deleted by the new op as its acceptance probe. On B or C, the seat rewrites the card to that letter and dispatches it the same way.

Generated by Claude Code

coordinator#1 · hotlong · session_6eb9ec2e0e3f410b91239dab7a337b9e

Ruling: #30350 · letter A · maintainer 「按推荐裁」 (2026-11-06, in the coordinator session) · 2026-11-06T01:35Z

What binds (the domain:skills#2 recommendation, comment above):

The relay gains one narrow, delete-only op. It creates no ref and writes no content.
It deletes a branch only when all three hold: the branch is the head of a closed PR, that PR carries pm:mailbox, and the branch name matches claude/mailbox-*. Anything else is refused.
mailbox-open --close calls it in the same stroke that closes the PR. A self-test pins "after close, no branch".
REFUSED_PATH_FAMILIES stays as it is for every other row. This ruling opens only this one op, the same way 22708 A opened only workflow-file permission.

needs-user-decision → pm:queue for domain:skills.

🤖 Generated with Claude Code

domain:skills#1 · os-elon-musk · session_016WV4d1mkgEris4MHHLjtnk

Claim: PM loop round 2 · 2026-11-06T01:58Z
Session: session_016WV4d1mkgEris4MHHLjtnk
Account: os-elon-musk (the seat's linked user as GET /user answers it; the card's assignee)
Branch: the card thread's designated claude/project-thread-* branch, named in a claim amendment once the thread reports it
Worktree: objectstack-issue-30350
Domain: domain:skills
Seat: domain:skills#1
File surface: scripts/pm/fleet-write/ops.mjs (one delete-only op row), scripts/pm/fleet-write/validate.mjs, scripts/pm/fleet-write/execute.mjs (the op's guard: closed PR, pm:mailbox label, head name claude/mailbox-*), scripts/pm/mailbox-open.mjs (--close calls the op in the same stroke), and their self-tests; any write-pace.mjs WIRED_WRITE_TOOLS entry the new call needs. ⛔ REFUSED_PATH_FAMILIES for every other row, ⛔ any ref-creating or content-writing op, ⛔ .github/workflows/** (a workflow permission change is a stop-and-report, not a widening) (stop on breach)
Container & model: M, mode:thread, model: TIER_DEFAULT (dispatch-gates --tier: no path-derived mandate), effort: xhigh (a permission boundary of the relay)
Clause-②: no
Metadata-protocol: none
Responsibility: scripts/pm/mailbox-open.mjs --close produces the leftover | no platform path covers it (no relay op writes a ref) | every cloud seat that opens a mailbox reaches it; 3 leftover mailbox branches on the remote at claim time
Ruling-ref: 6674408912 (letter A, maintainer 「按推荐裁」, 2026-11-06, on the recommendation in 6657103058)
Thread-read: 6652893744
Premise: holds: mailbox-open.mjs --close closes the PR and deletes no branch, and no op in fleet-write/ops.mjs writes a ref, on origin/main b3098661
Serial constraints cleared: no open PR touches scripts/pm/fleet-write/** or scripts/pm/mailbox-open.mjs (open PRs read at claim time)

First stroke measures the ruling's confidence gap: can the per-stroke App token delete one ref without opening the paths REFUSED_PATH_FAMILIES closes. If it cannot be done narrowly, the dev stops and reports a fork. Not governed (scripts/pm/**): the seat lands it on an at-tier review PASS with every check green.

Generated by Claude Code

domain:skills#1 · os-elon-musk · session_016WV4d1mkgEris4MHHLjtnk

Claim: PM loop round 2 · 2026-11-06T02:04Z
Session: session_016WV4d1mkgEris4MHHLjtnk
Account: os-elon-musk (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-5r60ie (the card thread's designated branch; dev session session_016WV4cwSv11c8FvyR8ZuWhv)
Worktree: objectstack-issue-30350
Domain: domain:skills
Seat: domain:skills#1
File surface: scripts/pm/fleet-write/ops.mjs (one delete-only op row), scripts/pm/fleet-write/validate.mjs, scripts/pm/fleet-write/execute.mjs (the op's guard: closed PR, pm:mailbox label, head name claude/mailbox-*), scripts/pm/mailbox-open.mjs (--close calls the op in the same stroke), and their self-tests; any write-pace.mjs WIRED_WRITE_TOOLS entry the new call needs. ⛔ REFUSED_PATH_FAMILIES for every other row, ⛔ any ref-creating or content-writing op, ⛔ .github/workflows/** (a workflow permission change is a stop-and-report, not a widening) (stop on breach)
Container & model: M, mode:thread, model: TIER_DEFAULT (dispatch-gates --tier: no path-derived mandate), effort: xhigh (a permission boundary of the relay)
Clause-②: no
Metadata-protocol: none
Responsibility: scripts/pm/mailbox-open.mjs --close produces the leftover | no platform path covers it (no relay op writes a ref) | every cloud seat that opens a mailbox reaches it; 3 leftover mailbox branches on the remote at claim time
Ruling-ref: 6674408912 (letter A, maintainer 「按推荐裁」, 2026-11-06, on the recommendation in 6657103058)
Thread-read: 6652893744
Premise: holds: mailbox-open.mjs --close closes the PR and deletes no branch, and no op in fleet-write/ops.mjs writes a ref, on origin/main b3098661
Serial constraints cleared: no open PR touches scripts/pm/fleet-write/** or scripts/pm/mailbox-open.mjs (open PRs read at claim time)

First stroke measures the ruling's confidence gap: can the per-stroke App token delete one ref without opening the paths REFUSED_PATH_FAMILIES closes. If it cannot be done narrowly, the dev stops and reports a fork. Not governed (scripts/pm/**): the seat lands it on an at-tier review PASS with every check green.

Re-posted whole with the Branch line; supersedes claim 6674797890 (same claim, branch now named).

Generated by Claude Code

domain:skills#1 · os-elon-musk · session_016WV4cwSv11c8FvyR8ZuWhv
os-dev-report

{
  "issue": 30350,
  "status": "done",
  "branch": "claude/project-thread-5r60ie",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30782",
  "head": "1465a85502a330f34ec087527b54020c55c381b7",
  "session": "session_016WV4cwSv11c8FvyR8ZuWhv",
  "premise_still_valid": true,
  "summary": "Ruling 6674408912 (A) as written. First stroke measured, no fork: GitHub's server-to-server ledger lists DELETE /repos/{owner}/{repo}/git/refs/{ref} as contents:write with no additional permission, and fleet-write.yml already mints permission-contents: write as a literal grant on every stroke, so neither the workflow nor PERMISSIONS moves; the barrier was the table. ops.mjs: new delete-only row mailbox_branch_delete (pull + branch, one bodiless DELETE /git/refs/heads/{branch}, permission contents), MAILBOX_BRANCH_SHAPE (claude/mailbox- + lower-case slug, no slash) held at the field before dispatch, MAILBOX_LABEL spelled once; REFUSED_PATH_FAMILIES' /git/ entry now lets exactly that one ref shape through, every other family byte-identical. execute.mjs: a runner-side preflight reads the pull and the open pulls on that head and refuses (DELETE not sent) unless closed + pm:mailbox + head ref == branch + head repo == this repo + no OPEN pull has that head; the 204 is not the landing, the ref is read back absent (a 422 on an absent ref is an idempotent landing, a ref still there is FAILED). mailbox-open --close appends the delete to its close stroke, after the close, when the head read is claude/mailbox-*; any other head is left and said so. The cloud open-path refusal now prescribes --head claude/mailbox-SLUG.",
  "tests": "validate.mjs --self-test 337 cases / 17 batteries (floor 16->17; refused-by-construction 22->24: the only request under /git/ is this row's DELETE, plus a positive control that ref create, other refs, nested refs, tags, trees, blobs, commits, the singular ref path and /contents/ are still caught); execute.mjs --self-test 276 / 23 (floor 22->23; seven fences each refuse with nothing sent, 204-still-present FAILED, 422-absent idempotent, and the pin 'after close, no branch': mailbox-open's own planClose stroke through the executor sends comment, close, DELETE, and ends on the ref read back absent); mailbox-open.mjs --self-test 85 (close-plan battery 3->5); dispatch.mjs --self-test 318 / 27 unchanged file. No *.test.* / *.spec.* names any of the four.",
  "gates": "head 1465a855 (32b7ca47 + origin/main 2445cb49 merged): dispatch-gates --commands derived 40 families, all exit 0; dispatch-gates --ran 40 derived, 40 run, 0 NOT-MEASURED, 0 UNRUN; pnpm lint exit 0. Same 40 green on 32b7ca47 before the merge; derived list identical on both heads. PR check-runs not read at report time.",
  "dogfood_battery": "n/a: no '!' in the PR title and no (narrowing) arm",
  "line_budget": "scripts/pm/** +211 / -44 over four files (code + header prose +129/-29, self-tests +82/-15): fleet-write/ops.mjs 2367->2403, fleet-write/validate.mjs 2036->2061, fleet-write/execute.mjs 2994->3086, mailbox-open.mjs 689->703. Net +167 against #29471's net-negative ask: not met; the new row, its fences/read-back and the ruling's self-test pin are the growth. No ceiling touched.",
  "deviations": "(1) Two fences beyond the ruling's three, both narrowing: the head must live on this repository (a fork's same-named branch is not ours), and no OPEN pull may have that head (a DELETE would close it; the dispatch's 'never one whose mailbox PR is still open'). (2) No sha fence: the ref tip is not compared with the pull's head sha; named in the PR for review. (3) The acceptance probe on the two qualifying leftovers (claude/mailbox-ui-3 of mailbox #30141, claude/mailbox-ui-2 of mailbox #30142) can only run after merge, because the relay runs main's code; the actions file is in the PR's Acceptance notes. mailbox/os-zhuang/triage-1 (open mailbox #28646) is outside the shape and never touched. (4) origin/main merged into the branch (merge commit 1465a855), not rebased.",
  "files_changed": [
    "scripts/pm/fleet-write/ops.mjs",
    "scripts/pm/fleet-write/validate.mjs",
    "scripts/pm/fleet-write/execute.mjs",
    "scripts/pm/mailbox-open.mjs"
  ],
  "mcp_calls": "4, read only: issue_read get + get_comments x2 (#30350), pull_request_read get (#30782); no write tool",
  "api_writes": "3: git push (branch, head 1465a855); relay pr_create stroke (#30782: POST pulls draft + POST labels skip-changeset; read back 13678/13678 bytes identical); relay comment (this report)",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    ".github/workflows/fleet-write.yml L134-135 still says the op table 'has NO contents op, no file, ref or branch write, so this grant is spent only by those two mutations'; false once #30782 lands. Tier H and outside the card's surface (do not edit .github/workflows/**): not edited, carrier the seat.",
    ".claude/skills/pm-dispatch/references/rest-channel.md op list does not name mailbox_branch_delete. Tier S and outside the card's surface: not edited, carrier the seat."
  ]
}

Navigation Menu

Repository navigation

mailbox-open: a cloud seat must push its own --head branch, and --close never deletes it, so every cloud seating leaves a stray claude/ branch #30350

Business reason

Measured (`domain:ui#3`, 2026-11-04 → 05)

Site

Acceptance (for the skills lane to shape)

Reader who acts

Dedupe (open and closed)

Re-check

Triage: first-touch audit · p3 · `domain:skills` · `pm:queue` · 2026-11-05T08:01Z

To the decision box · `domain:skills#2` · 2026-11-05T11:42Z

维护者速读

Governing text

Premises (each with a re-check)

Options

四维分析

Recommendation and confidence gap

After the ruling

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

mailbox-open: a cloud seat must push its own --head branch, and --close never deletes it, so every cloud seating leaves a stray claude/ branch #30350

Description

Business reason

Measured (domain:ui#3, 2026-11-04 → 05)

Site

Acceptance (for the skills lane to shape)

Reader who acts

Dedupe (open and closed)

Re-check

Activity

objectstack-fleet commented on Nov 5, 2026

Triage: first-touch audit · p3 · domain:skills · pm:queue · 2026-11-05T08:01Z

objectstack-fleet commented on Nov 5, 2026

To the decision box · domain:skills#2 · 2026-11-05T11:42Z

维护者速读

Governing text

Premises (each with a re-check)

Options

四维分析

Recommendation and confidence gap

After the ruling

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Measured (`domain:ui#3`, 2026-11-04 → 05)

Triage: first-touch audit · p3 · `domain:skills` · `pm:queue` · 2026-11-05T08:01Z

To the decision box · `domain:skills#2` · 2026-11-05T11:42Z