Repository navigation
pm: the post-merge governed audit has no owner or schedule, and shows a seat landing through the low-risk arm as a breach #33603
Description
domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb
Filing gate: ① (follow-up F of a Fable evaluation of the low-risk Tier H delegation that Leehom asked for, write-up /mnt/project-files/pm-orders/review/33531-delegation-review.md, read on PR #33531 head e2b1cabc; rated not blocking the merge of #33531). reach: AGENTS.md Prime Directive 14 names the post-merge audit as the compensating control for seat-landed merges, but no one runs it and its report cannot tell an arm landing from a violation.
What is wrong. scripts/pm/check-governed-merges.mjs is a manual, report-only script with no schedule. It classifies merges by path, so a skills PR the seat lands through the low-risk arm shows as "Tier H merged without approval", indistinguishable from a breach (record 6886787995 nit N3 on PR #33531, not carded until now).
What lands. The audit lists arm landings apart, and for each one checks a same-head at-tier PASS record exists. A weekly owner runs it (a patrol step or a scheduled workflow, whichever the fleet's rules allow) and the result is posted where the maintainer reads it.
scripts/pm/**, possibly .github/workflows/** (governed); skip-changeset. Clause-②: no. Blocked-by: #33501 (PR #33531). Dedupe: is:issue check-governed-merges audit weekly → none. New.
Activity
objectstack-fleet commentedon Nov 15, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: first touch →
domain:skills· p2 · 2026-11-15T02:47Z⛔ Not a claim.
The post-merge governed audit named by Prime Directive 14 as the compensating control has no owner or schedule, and it reads a delegated landing as a breach. The control is missing in practice, so tooling p2.
objectstack-fleet commentedon Nov 15, 2026
domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb
Scope added (from the at-tier contract review 6888257144 on PR #33616, card #33605, nit N5; outside that PR's honest-failure boundary): the tier-evidence verifier
scripts/pm/verify-review-tier.mjsdoes not compareadvisorModel; refuses an at-tier run whose model value carries a context suffix; does not follow a nested sub-agent's transcript; and passes a cleanly truncated prefix of a transcript. Judge each and close or pin it, after #33616 merges.objectstack-fleet commentedon Nov 15, 2026
domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb
Scope added (from the at-tier contract review 6888257144 on PR #33616, card #33605, nit N5; outside that PR's honest-failure boundary): the tier-evidence verifier
scripts/pm/verify-review-tier.mjsdoes not compareadvisorModel; refuses an at-tier run whose model value carries a context suffix; does not follow a nested sub-agent's transcript; and passes a cleanly truncated prefix of a transcript. Judge each and close or pin it, after #33616 merges.