fix(platform-objects): enabling two-factor and copying an invitation link are human-only identity actions - #28386

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

domain:server#4 · os-zhuang · session_01QUs3BtyH9zgxKzYrJiH18J

Contract-review-claim: session_01QUs3BtyH9zgxKzYrJiH18J · head cbd2319 · 2026-10-31T09:29Z

domain:server#4 · os-zhuang · session_01QUs3BtyH9zgxKzYrJiH18J

Contract-review-handoff: triage — CONTRACT_REVIEW_TIER unavailable (HTTP 429 rate_limit, request req_011Cga5gPg2uE7VRPve6wDjK, 2026-10-31T09:31Z) · head cbd2319

• The seat's at-tier reviewer was refused by quota before it rendered a record; ⛔ no lower-tier review stands in (contract-review.md). needs:contract-review is added. The review is owed on this head: the ADR-0011 addendum (scope docs/adr/0011-actions-as-ai-tools.md + the three identity object files and systemObjectActionExposureError it cites), and, since the diff also changes code, the sentence-by-sentence judgment of the check-empty-changeset DELIBERATE CORRECTION to .changeset/27900-identity-actions-ai-exposure.md.
• The seat's own TIER_DEFAULT review of the remainder follows as ## 席位核对 once the head's check-runs settle. Tier H: the maintainer's approval is owed after a PASS.

domain:server#4 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract-review-claim: session_01L9qibw58ehQ2gRHP2h2Puz · head cbd231941209c68ff5881ba988b77222e7b5976c · 2026-10-31T11:44Z

domain:server#4 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: cbd231941209c68ff5881ba988b77222e7b5976c
Local-runs: none
Scope: packages/platform-objects/src/identity/sys-user.object.ts and sys-two-factor.object.ts (the enable_two_factor action of each loses its ai block), sys-invitation.object.ts (copy_invitation_link keeps none, now with the bucket comment), docs/adr/0011-actions-as-ai-tools.md (the 2026-10-31 amendment note, the H/C/E name lists, the counts, the "not assessed" paragraph, the MCP paragraphs), .changeset/28368-identity-two-factor-invite-link-human-only.md (new, platform-objects patch) and the DELIBERATE CORRECTION of .changeset/27900-identity-actions-ai-exposure.md (the pending #27900 changeset's counts and name lists)

Inputs: card #28368 (the three items of ruling 6540309323 on #27900, the maintainer's 「其他同意」 of 2026-10-31T06:53Z: copy_invitation_link assessed H, both enable_two_factor moved E to H, sys_approval_request's 9 actions noted unassessed and human-only), PR #28386 (body with the three items, the amended counts and the two changesets, the Metadata-protocol amendment 6541378586 to none, the seat's hand-off 6541730064; 6 files, +40/−28, the diff read whole), the 54 check-runs on this head (read 2026-10-31T11:50Z: 54 runs on this head, 35 success, 17 skipped, 2 failure; the 2 failures are both runs of Check Changeset, the designed check-empty-changeset DELIBERATE CORRECTION refusal of .changeset/27900-identity-actions-ai-exposure.md, red until a person confirms the correction at landing; every other latest run per name is green: Build Core, Check Documentation Links, Dogfood Regression Gate, Flag docs affected by code changes, Governed Surface Queue Guard, Lint & Repo Gates, Lint · CI, release & engine gates, Lint · ESLint, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · repo & tooling gates, Lint · scoped · query-options erasure, Lint · scoped · slot lookup & corpus, Lint · scoped · tooling self-tests, Live E2E UI, PR-body guards (claim · duplicate · Part-of · single-writer path), Plan Test Core shards, Test Core, Test Core (all 8), Test UI, Type Check · consumer gates, Type Check · debt ledger, Type Check · source gates, Type Check · workspace, TypeScript Type Check, filter; skipped: 18.x upgrade harness (opt-in), Auto Label, Build & E2E UI, Build Docs, Build UI Deps, Check PR Size, Dogfood Regression Gate (matrix shard/3), Dogfood Verify CLI, Lint UI, Packed-tarball smoke (opt-in), Schedule gate · skip when a green push run covers the commit, Temporal Conformance (live PG + MySQL), Test UI (matrix shard/16), Type Check UI, UI Published Artifacts), the job log of the red Check Changeset run (124502062205: check-empty-changeset refuses .changeset/27900-identity-actions-ai-exposure.md because it exists on the merge base and was not added by this PR; check-adr-0087-registration and the no-major check in the same job passed), and the tree at this head for the counts: the three ADR name lists hold 23, 17 and 19 unique names (59), and ai: { occurs 36 times across the identity objects (sys-user 7, sys-two-factor 0, sys-invitation 5, the rest unchanged). No file of this PR moved on main since the merge-base; the head is mergeable.

① Derived judgments

• The ruling is applied exactly, nothing more - right. Item 2: the two enable_two_factor declarations drop ai: { exposed: true, description } and carry the bucket-H comment, so systemObjectActionExposureError (ADR-0066 D4) no longer lists them over MCP and run_action refuses them by name; the Console runs them as before, since the ai block never gated a signed-in person. Item 1: copy_invitation_link was already undeclared; the PR adds the comment only, which is what bucket H means in the ADR table (no ai block). The card's item 1 wording 「gets an ai block, tier H」 reads as shorthand for "assessed into bucket H"; the ruling text and the ADR's H row both say no block, and the diff follows them. Item 3: the "Not assessed" paragraph now names sys_approval_request's 9 actions, with the prior copy_invitation_link sentence retired since it is assessed. No action gains exposure, so no new MCP surface opens.
• The ADR addendum is the amended record and its arithmetic holds - right. The amendment note cites the ruling by id and date, the H list adds the three names (20 → 23), the E list loses the two (21 → 19), C is untouched (17), and 23 + 17 + 19 = 59 = the 58 of the 2026-10-30 assessment plus copy_invitation_link. Declared blocks 36 = C 17 + E 19, which matches the tree's 36 ai: { occurrences; the MCP paragraphs' 38 → 36 and 37 → 35 (36 less the one REST-route forward, revoke_api_key) follow. The paragraph keeping the 2026-10-30 figures (58 / 38, the card's H 19 / E 22 headers) is kept as history, not as the current count.
• The DELIBERATE CORRECTION of the [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 changeset is accurate sentence by sentence - right. [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900's changeset is pending (unreleased), so its text is what the release notes will say; the correction changes the header counts (58/38 → 59/36), drops "enabling two-factor authentication" from the Exposed (19) sentence, adds "enabling two-factor authentication" and "copying an invitation's accept link" to the Human-only (23) sentence, and removes the sentence that said copy_invitation_link "was not part of the assessment", which would now be false. Every other sentence is byte-identical. The new changeset carries the same three facts as a fix on @objectstack/platform-objects at patch.
• Clause-② no and Metadata-protocol: none - accepted. The ai block is a platform-object declaration, not a spec key; the schema of ActionSchema.ai is untouched; what changes is which shipped actions declare it. The symmetric [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 (feat(platform-objects): the identity actions an agent may reach declare it — additive acts exposed, destructive lifecycle acts behind confirmation, credential and ownership acts human-only #28270) declared no for the additions, so the removals declare no too; the amendment 6541378586 from narrowed to none is the right reading (nothing an author writes changes). The behaviour change for an MCP agent (two actions no longer listed) is the declared fix and is why this review is served at CONTRACT_REVIEW_TIER.
• Check-runs as gate verdicts - read as above. Every latest run per name on this head is green or skipped except Check Changeset, which is red on both of its runs for one reason: check-empty-changeset refuses a PR that edits a changeset it did not add. That refusal is the gate's designed DELIBERATE CORRECTION door (a correction of another PR's pending changeset stays red until a person confirms it at landing); the correction here is the whole point of the PR and is judged accurate above. The rest of that job passed. This record does not clear that door; the human approver does.

② Semver level

• @objectstack/platform-objects patch - accepted. Two actions lose a declaration and nothing else moves; the fix title names the behaviour change for an agent. The corrected [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 changeset keeps its own patch.

③ Boundary flags

• Tier H, human approval owed - docs/adr/0011-actions-as-ai-tools.md is a GOVERNED surface, so this PR lands only with a GOVERNED_APPROVER's approval (os-zhuang or hotlong); no reviewer is requested on the PR yet, and Tesla's routing asks for os-zhuang to be requested when he is the approver. That approval is also where the DELIBERATE CORRECTION of .changeset/27900-identity-actions-ai-exposure.md is confirmed, so the red Check Changeset leg is expected to stay red until then; it is not a defect of this head.
• Ordering against [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 - this PR edits the changeset [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 (feat(platform-objects): the identity actions an agent may reach declare it — additive acts exposed, destructive lifecycle acts behind confirmation, credential and ownership acts human-only #28270, merged) added, so it lands after it, which the merge-base already satisfies. If [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900's changeset were consumed by a release before this lands, the correction would need to move into this PR's own changeset instead; nothing suggests that today.
• sys_approval_request - the 9 actions are now recorded unassessed and human-only; a later assessment is a ruling, not a code change, and no card exists for it.

④ Design judgment

• Tried: whether dropping ai on sys_user.enable_two_factor leaves sys_user.disable_two_factor consistent (it was H already, so the pair is now H/H, which reads right: both sides of a sign-in factor are human-only); whether any test pinned the 38 or 21 counts (none in the tree; the ADR says no automatic check by the maintainer's choice); whether the two identical enable_two_factor descriptions were referenced elsewhere (no). Nothing to add.

Verdict reasoning. The three items of ruling 6540309323 are applied exactly, the ADR's amended lists and counts are arithmetically and textually consistent with the tree, the correction of the pending #27900 changeset is accurate in every sentence it touches, the levels and declarations are right, and the one red check is the designed deliberate-correction door that only the Tier H approver clears at landing.

Implemented-by: claude/project-thread-nsguxo
Reviewed-by: session_01L9qibw58ehQ2gRHP2h2Puz

VERDICT: PASS

domain:server#4 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: cbd231941209c68ff5881ba988b77222e7b5976c
Local-runs: none
Scope: packages/platform-objects/src/identity/sys-user.object.ts and sys-two-factor.object.ts (the enable_two_factor action of each loses its ai block), sys-invitation.object.ts (copy_invitation_link keeps none, now with the bucket comment), docs/adr/0011-actions-as-ai-tools.md (the 2026-10-31 amendment note, the H/C/E name lists, the counts, the "not assessed" paragraph, the MCP paragraphs), .changeset/28368-identity-two-factor-invite-link-human-only.md (new, platform-objects patch) and the DELIBERATE CORRECTION of .changeset/27900-identity-actions-ai-exposure.md (the pending #27900 changeset's counts and name lists)

Inputs: card #28368 (the three items of ruling 6540309323 on #27900, the maintainer's 「其他同意」 of 2026-10-31T06:53Z: copy_invitation_link assessed H, both enable_two_factor moved E to H, sys_approval_request's 9 actions noted unassessed and human-only), PR #28386 (body with the three items, the amended counts and the two changesets, the Metadata-protocol amendment 6541378586 to none, the seat's hand-off 6541730064; 6 files, +40/−28, the diff read whole), the 54 check-runs on this head (read 2026-10-31T11:51Z: 54 runs on this head, 35 success, 17 skipped, 2 failure; the 2 failures are both runs of Check Changeset, the designed check-empty-changeset DELIBERATE CORRECTION refusal of .changeset/27900-identity-actions-ai-exposure.md, red until a person confirms the correction at landing; every other latest run per name is green: Build Core, Check Documentation Links, Dogfood Regression Gate, Flag docs affected by code changes, Governed Surface Queue Guard, Lint & Repo Gates, Lint · CI, release & engine gates, Lint · ESLint, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · repo & tooling gates, Lint · scoped · query-options erasure, Lint · scoped · slot lookup & corpus, Lint · scoped · tooling self-tests, Live E2E UI, PR-body guards (claim · duplicate · Part-of · single-writer path), Plan Test Core shards, Test Core, Test Core (all 8), Test UI, Type Check · consumer gates, Type Check · debt ledger, Type Check · source gates, Type Check · workspace, TypeScript Type Check, filter; skipped: 18.x upgrade harness (opt-in), Auto Label, Build & E2E UI, Build Docs, Build UI Deps, Check PR Size, Dogfood Regression Gate (matrix shard/3), Dogfood Verify CLI, Lint UI, Packed-tarball smoke (opt-in), Schedule gate · skip when a green push run covers the commit, Temporal Conformance (live PG + MySQL), Test UI (matrix shard/16), Type Check UI, UI Published Artifacts), the job log of the red Check Changeset run (124502062205: check-empty-changeset refuses .changeset/27900-identity-actions-ai-exposure.md because it exists on the merge base and was not added by this PR; check-adr-0087-registration and the no-major check in the same job passed), and the tree at this head for the counts: the three ADR name lists hold 23, 17 and 19 unique names (59), and ai: { occurs 36 times across the identity objects (sys-user 7, sys-two-factor 0, sys-invitation 5, the rest unchanged). No file of this PR moved on main since the merge-base; the head is mergeable.

① Derived judgments

• The ruling is applied exactly, nothing more - right. Item 2: the two enable_two_factor declarations drop ai: { exposed: true, description } and carry the bucket-H comment, so systemObjectActionExposureError (ADR-0066 D4) no longer lists them over MCP and run_action refuses them by name; the Console runs them as before, since the ai block never gated a signed-in person. Item 1: copy_invitation_link was already undeclared; the PR adds the comment only, which is what bucket H means in the ADR table (no ai block). The card's item 1 wording 「gets an ai block, tier H」 reads as shorthand for "assessed into bucket H"; the ruling text and the ADR's H row both say no block, and the diff follows them. Item 3: the "Not assessed" paragraph now names sys_approval_request's 9 actions, with the prior copy_invitation_link sentence retired since it is assessed. No action gains exposure, so no new MCP surface opens.
• The ADR addendum is the amended record and its arithmetic holds - right. The amendment note cites the ruling by id and date, the H list adds the three names (20 → 23), the E list loses the two (21 → 19), C is untouched (17), and 23 + 17 + 19 = 59 = the 58 of the 2026-10-30 assessment plus copy_invitation_link. Declared blocks 36 = C 17 + E 19, which matches the tree's 36 ai: { occurrences; the MCP paragraphs' 38 → 36 and 37 → 35 (36 less the one REST-route forward, revoke_api_key) follow. The paragraph keeping the 2026-10-30 figures (58 / 38, the card's H 19 / E 22 headers) is kept as history, not as the current count.
• The DELIBERATE CORRECTION of the [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 changeset is accurate sentence by sentence - right. [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900's changeset is pending (unreleased), so its text is what the release notes will say; the correction changes the header counts (58/38 → 59/36), drops "enabling two-factor authentication" from the Exposed (19) sentence, adds "enabling two-factor authentication" and "copying an invitation's accept link" to the Human-only (23) sentence, and removes the sentence that said copy_invitation_link "was not part of the assessment", which would now be false. Every other sentence is byte-identical. The new changeset carries the same three facts as a fix on @objectstack/platform-objects at patch.
• Clause-② no and Metadata-protocol: none - accepted. The ai block is a platform-object declaration, not a spec key; the schema of ActionSchema.ai is untouched; what changes is which shipped actions declare it. The symmetric [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 (feat(platform-objects): the identity actions an agent may reach declare it — additive acts exposed, destructive lifecycle acts behind confirmation, credential and ownership acts human-only #28270) declared no for the additions, so the removals declare no too; the amendment 6541378586 from narrowed to none is the right reading (nothing an author writes changes). The behaviour change for an MCP agent (two actions no longer listed) is the declared fix and is why this review is served at CONTRACT_REVIEW_TIER.
• Check-runs as gate verdicts - read as above. Every latest run per name on this head is green or skipped except Check Changeset, which is red on both of its runs for one reason: check-empty-changeset refuses a PR that edits a changeset it did not add. That refusal is the gate's designed DELIBERATE CORRECTION door (a correction of another PR's pending changeset stays red until a person confirms it at landing); the correction here is the whole point of the PR and is judged accurate above. The rest of that job passed. This record does not clear that door; the human approver does.

② Semver level

• @objectstack/platform-objects patch - accepted. Two actions lose a declaration and nothing else moves; the fix title names the behaviour change for an agent. The corrected [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 changeset keeps its own patch.

③ Boundary flags

• Tier H, human approval owed - docs/adr/0011-actions-as-ai-tools.md is a GOVERNED surface, so this PR lands only with a GOVERNED_APPROVER's approval (os-zhuang or hotlong); no reviewer is requested on the PR yet, and Tesla's routing asks for os-zhuang to be requested when he is the approver. That approval is also where the DELIBERATE CORRECTION of .changeset/27900-identity-actions-ai-exposure.md is confirmed, so the red Check Changeset leg is expected to stay red until then; it is not a defect of this head.
• Ordering against [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 - this PR edits the changeset [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 (feat(platform-objects): the identity actions an agent may reach declare it — additive acts exposed, destructive lifecycle acts behind confirmation, credential and ownership acts human-only #28270, merged) added, so it lands after it, which the merge-base already satisfies. If [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900's changeset were consumed by a release before this lands, the correction would need to move into this PR's own changeset instead; nothing suggests that today.
• sys_approval_request - the 9 actions are now recorded unassessed and human-only; a later assessment is a ruling, not a code change, and no card exists for it.

④ Design judgment

• Tried: whether dropping ai on sys_user.enable_two_factor leaves sys_user.disable_two_factor consistent (it was H already, so the pair is now H/H, which reads right: both sides of a sign-in factor are human-only); whether any test pinned the 38 or 21 counts (none in the tree; the ADR says no automatic check by the maintainer's choice); whether the two identical enable_two_factor descriptions were referenced elsewhere (no). Nothing to add.

Verdict reasoning. The three items of ruling 6540309323 are applied exactly, the ADR's amended lists and counts are arithmetically and textually consistent with the tree, the correction of the pending #27900 changeset is accurate in every sentence it touches, the levels and declarations are right, and the one red check is the designed deliberate-correction door that only the Tier H approver clears at landing.

Implemented-by: claude/project-thread-nsguxo
Reviewed-by: session_01L9qibw58ehQ2gRHP2h2Puz

VERDICT: PASS

domain:server#4 · os-zhuang · session_01QUs3BtyH9zgxKzYrJiH18J

ACCEPT · PR #28386 · Head-sha cbd231941209c68ff5881ba988b77222e7b5976c · 2026-10-31T11:52Z · Tier H, approval owed

维护者速读

• 改了什么： 两个 enable_two_factor 动作（sys_user 与 sys_two_factor）删掉 ai 块，从 E 档移到 H 档；sys_invitation.copy_invitation_link 评为 H 档，保持不写 ai 块。ADR-0011 附记更新三档名单（H23 / C17 / E19，共 36 个 ai 块、59 个动作），并加一行：sys_approval_request 的 9 个动作未评估，评估前一律仅限人工。同时更正尚未发布的 [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 changeset 里的计数与名单。
• 为什么改： 执行您在 [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 上的裁决「其他同意」。启用双因素要用户密码、返回新的登录因子；邀请链接本身就是凭据。两者都不该让 agent 拿到。
• 风险与回滚： 只收窄 agent 能看到的动作，Console 里登录用户的操作不变。回滚即 revert 本 PR。
• 先看： docs/adr/0011-actions-as-ai-tools.md 的修订注记与名单；packages/platform-objects/src/identity/sys-user.object.ts 的 enable_two_factor。
• 两分钟验证： grep -c "ai: {" packages/platform-objects/src/identity/*.object.ts 合计应为 36，且 enable_two_factor 下不再有 ai:。
• 需要你做的： 批准本 PR（触及 ADR，Tier H）。达档合约审查 PASS：comment 6542995471，Head-sha cbd231941209c68ff5881ba988b77222e7b5976c。批准后席位落地。

席位意见：三条裁决逐字落实，ADR 计数与代码树一致，#27900 changeset 的更正逐句核过；唯一的红是有意设计的"更正他人待发 changeset"门，可带红入队。

席位核对

• Form: 6 files, +40/−28. check-governed-merges.mjs --pr 28386: 1 of 6 paths governed (docs/adr/**), so Tier H: maintainer approval from GOVERNED_APPROVERS before landing. Clause-②: no; Metadata-protocol: none (amendment 6541378586); the contract review accepts both.
• Premise measured: ruling 6540309323 on [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 (the maintainer's 「其他同意」). Contract review 6542995471 (Served-tier CONTRACT_REVIEW_TIER, same head, VERDICT: PASS) checks the three items against the tree: 36 ai: { blocks, lists of 23/17/19 = 59.
• Gates (check-runs at the pinned head): 54 runs: 35 success, 17 skipped, 2 failure. Both failures are Check Changeset, the designed check-empty-changeset DELIBERATE CORRECTION refusal of .changeset/27900-identity-actions-ai-exposure.md. Its confirmation is on record: the same-head at-tier PASS (6542995471, ① third bullet) judges each rewritten sentence of that note. Three conditions for entering the queue red, all met: the script states the red is by design (scripts/check-empty-changeset.mjs "Past a designed red"); pr-automation.yml (which runs Check Changeset) has no merge_group trigger; this comment records the gate and its cause.
• Accepted deviations: card item 1's wording 「gets an ai block, tier H」 is read as "assessed into bucket H", which per the ruling and the ADR's H row means no block. The diff follows the ruling.
• Out of scope and where it goes: the assessment of sys_approval_request's 9 actions is a later ruling with no card yet. Skills-docs: none.
• Landing clause: Tier H endgame. needs-user-decision goes on this PR and the approver review is requested now. Once an authorized approver approves, the seat removes the label, flips ready, enables auto-merge, then confirms MERGED and closes out #27900 follow-up: copy_invitation_link and both enable_two_factor identity actions become human-only (H), and ADR-0011 notes sys_approval_request's 9 actions as unassessed #28368.