[objectstack-fleet]

Fixes #19762

What changed

Touches .github/workflows/**, so this is a draft the maintainer merges by hand.

1. The mint step grants permission-contents: write. In .github/workflows/fleet-write.yml, actions/create-github-app-token@v2 gains permission-contents: write beside the three existing permission-* inputs, with a comment naming the one consumer — GitHub's enablePullRequestAutoMerge / disablePullRequestAutoMerge mutations require contents: write on the token (measured on the relay's first live automerge_enable: "Resource not accessible by integration") — and stating that the op table has no contents op, so the grant is spent only by those two mutations. The header's permission list says the same.
2. The op table spends it truthfully. PERMISSIONS in scripts/pm/fleet-write/ops.mjs gains contents: 'write'; the automerge_enable and automerge_disable rows carry permission: 'contents', so the validator's permission read stays a true statement of what each row spends. The header paragraph on permissions is updated.
3. Self-tests (validate.mjs --self-test, the refused-by-construction battery, 9 → 14 pinned cases): the map is exactly issues / pull-requests / contents write and metadata read; the two auto-merge rows spend contents; no other row does; every contents spender is an auto-merge GraphQL mutation, never a REST path; and the workflow's permission-* inputs, read from the file on disk, mirror PERMISSIONS exactly — a grant added on one side without the other reds.
4. Nothing else. No new op, no change to the sender gate, caps, ceilings, the executor or the four write tools.

Verification record

Batteries, each run alone with its exit captured before any pipe (worktree at 182209b, base origin/main dc1b986):

command	exit	verdict line
pnpm check:pm-fleet-write-validate	0	74 cases pass across 7 batteries (was 69)
pnpm check:pm-fleet-write-execute	0	48 cases pass across 9 batteries
pnpm check:pm-fleet-write-dispatch	0	64 cases pass across 9 batteries
pnpm check:pm-with-fleet	0	31 cases pass
pnpm check:pm-post-stamped	0	596 cases pass across 20 batteries
pnpm check:pm-label-write	0	88 cases pass across 10 batteries
pnpm check:pm-issue-create	0	42 cases pass across 6 batteries
pnpm check:pm-close-cards	0	111 cases pass across 12 batteries
pnpm check:pm-write-pace	0	109 cases pass across 12 batteries
pnpm check:workflow-status-functions	0	OK (39 workflow files)
pnpm check:workflow-step-name-quoting	0	OK (39 workflow files + 2 composite actions)
pnpm check:required-contexts	0	OK

npx eslint --no-inline-config on the two changed .mjs files: exit 0.

Gates — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands on the edited tree derived 54 families (3 paths vs merge base dc1b986; 52 changed lines, under the human-merge threshold). Each was run alone with its exit code captured before any pipe; all 54 exited 0. --ran with the codes recorded: 54 derived famil(ies) accounted for — 54 run, 0 NOT-MEASURED (a DERIVED zero — all 54 recorded an exit code and none of them is 3). Repo-wide pnpm lint is CI's run; the changed files were linted directly (above).

The live grant itself cannot be proven before merge (a workflow change runs only once it is on main); the card's post-merge verification is the director seat's: a two-action relay request (pr_draft + pr_ready, or automerge_enable on the next queued PR) reading back enabledBy = objectstack-fleet[bot].

Changeset

None: .github/workflows/** and scripts/pm/** publish nothing from any released package, so skip-changeset applies. This dispatch forbids label writes, so the label is the seat's to apply.

Acceptance notes

• Branch cut from origin/main at dc1b986, not on top of the fleet-write: derive the seat session from the container (CLAUDE_CODE_REMOTE_SESSION_ID) so the allowed command spelling routes through the relay; the workflow's Actions state is the kill switch #19755 branch; PR fix(pm): fleet-write derives the seat session from the container; the workflow’s Actions state is the kill switch; size-routed direct for post-stamped #19760 is still landing and is not touched here. Both edit scripts/pm/fleet-write/ops.mjs in disjoint regions (the session constants there, the permission map and two rows here), so no textual conflict is expected once fix(pm): fleet-write derives the seat session from the container; the workflow’s Actions state is the kill switch; size-routed direct for post-stamped #19760 merges; if one appears, this branch rebases onto main.

---

Generated by Claude Code

[objectstack-fleet]

维护者速读(终稿)

席位:总监席(summon #27,session_0129ZpnaBcYZZ51rCvQiXg6C),2026-09-23T01:49Z。这是 #19762 的交付,.github/workflows/**(席位令牌无 workflows 范围),等您人合。

改了什么:fleet-write.yml 铸 token 那一步加 permission-contents: write(注释写明唯一消费者是 GitHub 的 enable/disablePullRequestAutoMerge,op 表没有任何 contents 类操作);ops.mjs 权限表同步加 contents: 'write',两条 auto-merge 行改为消耗它;validate.mjs 自测把权限表、两行、以及 workflow 里的 permission-* 输入与表逐项钉死相等。三个文件 +42/−10。

为什么改:#19755 落地后第一笔真实使用实测:中继翻 ready 成功,开 auto-merge 被拒「Resource not accessible by integration」——正是 #19701 里「先不预授、被拒再加」的那一条。没有它,车队入队的最后一步仍要用席位自己的用户身份。

风险与代价:token 多一项 contents: write,但 op 表没有写文件/分支/ref 的操作,自测钉死了表与 workflow 一致,能花掉它的只有两条 auto-merge mutation;token 仍是逐次铸造、窄到目标仓、步骤结束即撤销。回滚 = 撤这一行与表项。

席位意见:通过。CI 绿(Check Changeset 那次红是缺 skip-changeset 标签,席位已补);check-governed-merges --pr 19767 0/3 命中登记册。

你要做的:合并本 PR(Squash)。合并后我用下一张入队的 PR 回读 autoMergeRequest.enabledBy == objectstack-fleet[bot]。

---

Generated by Claude Code