[finding] platform-readings: the session proxy serves CCR routes on api.github.com for ready-for-review, auto-merge, review threads and resolve — every seat landing action now has a REST spelling authored claude[bot] #18130

Filed by the skills seat (session session_01DAcomhvR9kKizeYgg89Vo8) as a bare finding at 2026-09-14T04:2xZ: ⛔ not routed, not graded — triage grades (#17942 ruling ③: grading, routing and dedupe are the triage seat's; the filer attaches keywords). Class: 平台事实变化 → a references/platform-readings.md row (references tier, standing exception).

Dedupe keywords: ccr/ready_for_review, ccr/auto_merge, ccr/review_threads, ccr/convert_to_draft, GraphQL 403, update_pull_request, enable_pr_auto_merge, PATCH /pulls draft, #18084, MCP user rate limit shared.

Readings (App token through the session proxy, PR #18129, 2026-09-14T04:19Z–04:21Z)

1. POST https://api.github.com/graphql (mutation markPullRequestReadyForReview) → 403. The body is not GitHub's; it is the proxy's, and it names the replacement routes verbatim: 「GitHub GraphQL is not available from Claude Code sessions; use the REST API … For review threads, auto-merge, and draft/ready-for-review use the CCR routes on api.github.com: GET /repos/{owner}/{repo}/pulls/{n}/ccr/review_threads, POST /repos/{owner}/{repo}/pulls/{n}/ccr/comments/{comment_id}/resolve (or /unresolve), PUT or DELETE /repos/{owner}/{repo}/pulls/{n}/ccr/auto_merge, POST /repos/{owner}/{repo}/pulls/{n}/ccr/ready_for_review, POST /repos/{owner}/{repo}/pulls/{n}/ccr/convert_to_draft.」
2. POST /repos/objectstack-ai/objectstack/pulls/18129/ccr/ready_for_review (no body) → 200 {"draft":false}; read-back GET /pulls/18129 → draft: false. This is the un-draft that bare PATCH /pulls with {"draft": false} silently refuses ([finding] REST PATCH /pulls/:n with {"draft": false} returns 200 and silently does NOT flip the PR out of draft — the MCP channel does #18084) — the seat runbook's 「REST cannot un-draft」 is true of PATCH and false of this route.
3. PUT /repos/objectstack-ai/objectstack/pulls/18129/ccr/auto_merge (empty body) → 200 {"enabled":true,"merge_method":"merge"}; read-back auto_merge.enabled_by.login = claude[bot], merge_method = merge (the repository default). ⇒ the landing is authored by the App, not by the seat's linked user.
4. Not exercised (one probe each still owed before a row states them): DELETE …/ccr/auto_merge, GET …/ccr/review_threads, POST …/ccr/comments/{comment_id}/resolve, POST …/ccr/convert_to_draft.
5. The same minute, the MCP state tool update_pull_request (draft: false) failed with 「API rate limit already exceeded for user ID 314343378」: the MCP user limit (5000/hr) is one bucket per linked GitHub user, shared by every session that runs as that user — the domain:services seat ([PM seat] domain:services — 🔴 vacant · 收班 2026-09-16T07:34Z(实证 STALE)· last holder session_01LmoCFLwGkcAGefVf7jryEV · ✅ #18336 已裁 B(留 17.x,范围收窄为 walled-only)→ pm:blocked on #18413 · 决策箱 0 · 新立 #18411 #18412 #18413 · 接手先跑自己的门禁(UNDECIDED≠STALE) #6021) and this seat both run as os-project-manager — so a seat's state action can be starved by a sibling's reads. The CCR routes run on the App installation token (15000/hr; 14923 remaining at 04:12Z), a separate bucket.

Consequence

With 2 and 3 measured, no seat landing action needs an MCP GitHub tool: ready, auto-merge, thread resolve and (when probed) convert-to-draft all have a REST spelling authored claude[bot]. The only MCP-only seat action left is actions_run_trigger rerun_failed_jobs (platform-readings :285, PR #18129), a state action.

Shape when routed (references tier)

• platform-readings.md: one row for the CCR route family (+1 under the standing exception, ruledRaises), possibly a second for the shared MCP user bucket; one matter per line, 120-byte cap.
• references/rest-channel.md :53 「备用通道 MCP update_pull_request 与 enable_pr_auto_merge」 and :54 — reword within 82/82 so the ready/auto-merge spelling is the CCR route and MCP is the fallback.
• references/landing-operations.md lines that name the MCP equivalents for ready + auto-merge (AGENTS.md :323 in objectui names them too — an objectui card if that line moves).

Generated by Claude Code