Three seat-run tools ask windowed history questions with no shallow guard, so each answers plausibly and wrongly in an agent container

[os-steve]

Found while building the scripts/pm/git-history.mjs helper for #9878. Reported, not fixed — #9878's dispatch scoped the census to "report them, do not fix them all".

The census

37 pre-existing history-reading call sites across 17 files in scripts/ and .github/workflows/, classified by what a shallow clone does to each:

class	count	behaviour on a shallow clone
windowed date questions over a branch	3	silently wrong — real, plausible, exit 0, no warning
files already carrying an explicit shallow guard	6 files	refuse or repair
range / merge-base questions	the rest	fail loudly, or degrade visibly to ?

The sharpest result: CI is not the exposure, the agent container is

All seven workflows that ask history questions check out with fetch-depth: 0. Every remaining exposure is in seat-run tooling — run by an agent, in a shallow container:

1. scripts/pm/check-governed-merges.mjs:443 — git log --first-parent --since=(iso) (ref) enumerates governed merges in a window. CI runs only its --self-test; the real enumeration is a PM-seat command. Under-enumeration reads as compliance, which is the worst direction for this particular tool to be wrong in.
2. scripts/check-engine-split-ratio.mjs:63 — the ADR-0076 D7 repo-split trigger metric. Its own workflow is fetch-depth: 0, so the scheduled run is fine; a seat running it locally gets a truncated window. Worse, total === 0 ? 0 turns an empty scan into a healthy-looking 0.0% ratio.
3. scripts/collect-release-notes.sh:120 — --since/--until over the cloud checkout. It has no workflow caller at all; it runs at release time, from a seat.

Why this is worth a card rather than a note

The six already-guarded files include #9555's and #9408's fixes. So the repo has been closing this family one instance at a time, and the census says three are left — all in tooling whose output is evidence (compliance enumeration, an ADR trigger metric, release notes).

The remedy now exists and is one line each: scripts/pm/git-history.mjs (landing for #9878) proves window coverage, deepens only when the shallow floor intrudes, re-proves, and otherwise refuses with an empty stdout so a captured number is empty rather than plausible.

Related: #9878 (the helper and the full census) · #9555 · #9408

Generated by Claude Code

[claude]

Claim: PM loop round 13
Session: session_01XqDQYVU5smx29ts9pAErja
Branch: claude/issue-9902-shallow-guard-seat-tools
Worktree: objectstack-issue-9902
Domain: domain:devx
File surface: scripts/pm/check-governed-merges.mjs, scripts/check-engine-split-ratio.mjs, scripts/collect-release-notes.sh (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: fable (node scripts/pm/dispatch-gates.mjs --tier <the three paths> run this round returned "no path-derived mandate … This line is a FLOOR, never a clearance" — the tier below is set by the CONTENT limb, not by that line)
Clause-②: yes
Serial constraints cleared: swept all open PRs for any touching check-governed-merges / check-engine-split-ratio / collect-release-notes — none. Predecessors on the first of those, PR #9897 (#9777), is MERGED; PR #9903 (#9878), which shipped scripts/pm/git-history.mjs, is MERGED and is this card's intended tool.

Why yes, and why the dispatch tier is contract-review tier: check-governed-merges.mjs is a CI gate (check:pm-governed-merges). A shallow guard that REFUSES where the tool currently answers changes its accept/reject behaviour — the same shape as #9698, where a new lint rule refusing previously-clean metadata was correctly declared yes. Dispatching AT contract-review tier rather than below it, so the 条款② entry gate's "派发档位低于契约复审档位" limb does not bind and this PR is not held out of the queue the way PR #9890 is.

---

Generated by Claude Code

[claude]

PM: dispatch aborted — Fable 5 quota exhausted mid-run. Releasing this card back to pm:queue, unstarted.

The agent I dispatched at contract-review tier was killed by the API before doing any work: "You've reached your Fable 5 limit." No branch was created, no worktree, no commits — nothing to salvage. Un-assigning and restoring pm:queue.

Why I am NOT re-dispatching this on opus right now

The 額度耗尽豁免 (maintainer 2026-08-13: 「fable 如果用完了,可以用 opus」) does cover this — the exemption's object is dispatch, and fable is measurably unavailable. So an opus re-dispatch would be sanctioned.

But the consequence is fixed by the same rule, and it is not worth taking at the end of a session:

双肢命中任一 且派发档位低于契约复审档位 ⇒ ⛔ 禁止入队

This card's claim declares Clause-②: yes (a shallow guard that refuses where check:pm-governed-merges currently answers changes its accept/reject behaviour). Dispatch it at opus and the finished PR is held out of the queue, needing a contract-review-tier seat that is not this one to clear it — and

契约复审 ⛔ 不适用额度耗尽豁免降档(豁免的对象是派发;复审的存在意义就是补偿一次低于地板的派发)

⇒ the reviewing seat cannot downgrade either. So the PR would sit behind the same fable availability that just blocked the dispatch, plus a second seat's round trip. PR #9890 is already in that queue.

The judgement

卡在队列外等待是安全态 — held is a safe state, not a failure. But producing a second held PR at end of session, when the work could instead go to a card that can merge today, is worse throughput for identical effort. The lesson from #9890 was pay the tier at dispatch time; the corollary is when you cannot pay it, do not start.

For whoever picks this up

• Dispatch at contract-review tier when fable is available again — that is the cheap path, and it is why the declaration is already on the card.
• Or dispatch at opus deliberately, accepting needs:contract-review and the review round trip. Either is legitimate; the first is cheaper.
• ⛔ Do not re-declare Clause-②: no to route around the gate. The declaration is a mandatory content-limb declaration, and a wrong no is 记录在案、可审计的假申报 — an auditable false declaration, which is strictly worse than the hold it avoids.

The dispatch prompt's rulings and hypotheses stand as written; nothing about the card's substance changed.

---

Generated by Claude Code