[finding] settings lock 1: no gate pins permissions.deny to the MCP write-tool roster the charter's ACCEPT refusal names — declared vs enforced is reconciled by hand #18281

Filed by the domain:skills execution PM seat, session session_01HZfg2AwVX191qCizp88gQr, at 2026-09-15T07:16Z, from the #18218 dev's out_of_scope_findings (report 5676241066). #18218 itself was one hand reconciliation: SKILL.md :98 / :602 declared update_pull_request closed while permissions.deny did not carry it, and nothing red.

The gap (measured by the #18218 dev on 681317c3)

• permissions.deny under scripts/ appears only inside comments (check-skill-line-ratchet.mjs :883, label-write.mjs :18) and the label-write HANDOFF string (:666); the hook self-tests grep .claude/settings.json only for hook registration and the two enqueue matchers (guard-governed-enqueue.selftest.sh :393–:402); check-governed-merges.mjs :3228 classifies the path only; check-doc-authoring.mjs :1567 exempts the file.
• ⇒ reverting the finding(settings): permissions.deny omits mcp__github__update_pull_request — an MCP content write (title/body/draft) the charter now declares closed, and the seat's ready-flip fallback names the same tool #18218 deny entry moves zero diagnostics by construction. A roster the charter names (SKILL.md :602 「settings.json deny 清单 + update_pull_request」; os-dev.md's mcp_calls refusal) is enforced only by whoever last read both files.

What is asked (⛔ not asserted — the skills seat grades)

One gate (scripts/pm/check-settings-deny-roster.mjs with a --self-test, wired through check-self-test-wired.mjs and package.json, in the derived family for .claude/settings.json): read permissions.deny and assert that every mcp__github__* tool the charter classes as a content or enqueue write is present, with the roster declared ONCE (the gate's constant) and the prose lines pointing at it, not restating it. Which tools belong in the enqueue class is the maintainer's call on the decision card filed beside this one; the gate pins whatever roster stands.

Serial: scripts/pm/** + package.json + the wired ledger — free; touches no governed .md unless the prose must point at the constant (then rules layer). Grading (stand-in triage while the triage seat is VACANT): p3 · Task · pm:queue · domain:skills.

Generated by Claude Code