feat(pm): fleet-write transfer op and an issue-transfer door — a card moves with its history

.claude/skills/pm-dispatch/references/cross-repo-coordination.md

@@ -22,7 +22,7 @@
 - 工装只答被告知的仓,缺 `--repo`/`PM_SWEEP_REPO` 即答 objectstack;⛔ 不答手上那张卡的仓。
 - 规则 1:issue 住在修复落地的仓,分诊时按判据严格执行。
 - 判据:正文抽掉 objectstack 还成立 ⇒ 当场转仓(console/UI 缺陷即转 objectui);不成立才是缝卡。
-- transfer 不可用时重建:出处头 + 裸 `#N` 改全名 + 关源单为 moved。
+- 转仓走 `issue-transfer.mjs`;名册外或平台拒才重建:出处头 + 裸 `#N` 改全名 + 关源单为 moved。
 - 缝卡收窄为真协调卡:留 objectstack 带 `repo:*`,正文点名读者(哪个座位、哪一步)。
 - 决策收件箱按仓:平台在 objectstack / objectui,元数据项目在本仓;在飞卡 ⛔ 不中途转仓。
 - 规则 2:跨层功能点或 objectui 消费的 `Seam:` 卡恒由分诊立父单 + 逐层子单,spec/后端先行。

.github/workflows/fleet-write.yml

@@ -16,11 +16,12 @@
 # need in front.
 #
 # ⛔ The token this run WRITES with is the App installation token step 3
-# mints — narrowed to the one target repository and to the permissions the
-# op table declares (`issues: write`, `pull-requests: write`, the
-# `contents: write` GitHub's auto-merge mutations require, and the
-# `metadata: read` the sender gate's permission read needs) — and revoked by
-# that action's post step. The workflow's own `GITHUB_TOKEN` gets nothing
+# mints — narrowed to the payload's repository (and, for a `transfer` stroke
+# alone, that transfer's one target too: `transferIssue` needs issues write on
+# both ends) and to the permissions the op table declares (`issues: write`,
+# `pull-requests: write`, the `contents: write` GitHub's auto-merge mutations
+# require, and the `metadata: read` the sender gate's permission read needs)
+# — and revoked by that action's post step. The workflow's own `GITHUB_TOKEN` gets nothing
 # (`permissions: {}` below); the job grants it `contents: read` for the
 # checkout and nothing else, so the run's ONLY write path is the App token,
 # and it exists only inside the execute step's environment.
@@ -82,7 +83,8 @@ jobs:
       # unknown key, an unknown op, a target outside the organization, a
       # non-integer number, an over-cap string or an over-cap payload with
       # every reason in the step summary and zero writes; on success it hands
-      # the target's NAME to the mint below through `$GITHUB_OUTPUT`.
+      # the mint below the repository NAMES its token must reach through
+      # `$GITHUB_OUTPUT` — one for every stroke, two for a transfer stroke.
       - name: Validate the payload (closed schema, zero writes on refusal)
         id: validate
         env:
@@ -92,18 +94,22 @@ jobs:
       # The fleet identity, minted on the runner and never held by a seat:
       # `OS_FLEET_APP_ID` is an organization variable, `OS_FLEET_PRIVATE_KEY`
       # an organization secret (both set by the maintainer). `repositories`
-      # narrows the token to the ONE repository the payload named — the
-      # validator's output, never the payload read again here — and the
-      # `permission-*` inputs narrow it to what `scripts/pm/fleet-write/ops.mjs`
-      # declares. The action revokes the token in its post step.
+      # narrows the token to the list the validator computed — the payload's
+      # ONE repository, or for a `transfer` stroke that repository plus the
+      # transfer's one target from the governed roster — the validator's
+      # output, never the payload read again here; its `--self-test` pins one
+      # name for every other op. The `permission-*` inputs narrow it to what
+      # `scripts/pm/fleet-write/ops.mjs` declares. A target the App's
+      # installation does not cover fails THIS step, loudly, with zero writes.
+      # The action revokes the token in its post step.
       - name: Mint the fleet App token, narrowed to the target and the op table
         id: token
         uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.OS_FLEET_APP_ID }}
           private-key: ${{ secrets.OS_FLEET_PRIVATE_KEY }}
           owner: objectstack-ai
-          repositories: ${{ steps.validate.outputs.repo_name }}
+          repositories: ${{ steps.validate.outputs.repositories }}
           permission-issues: write
           permission-pull-requests: write
           # ONE consumer: GitHub's `enablePullRequestAutoMerge` / `disablePullRequestAutoMerge`

package.json

@@ -90,6 +90,7 @@
     "check:pm-write-pace": "node scripts/pm/write-pace.mjs --self-test",
     "check:pm-fleet-token": "node scripts/pm/fleet-token.mjs --self-test",
     "check:pm-issue-create": "node scripts/pm/issue-create.mjs --self-test",
+    "check:pm-issue-transfer": "node scripts/pm/issue-transfer.mjs --self-test",
     "check:pm-with-fleet": "bash scripts/pm/with-fleet.sh --self-test",
     "check:pm-post-stamped": "node scripts/pm/post-stamped.mjs --self-test",
     "check:pm-label-write": "node scripts/pm/label-write.mjs --self-test",