@codedology/code-forge 0.10.0 → 0.12.0

package/CHANGELOG.md

@@ -6,6 +6,80 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.12.0] — 2026-10-14
+
+### Added
+
+- `gates run --changed` (with `--run` and `--block`) narrows `{test_files}` to changed tests and stem-paired tests of
+  changed sources, and a new `{changed_files}` gate token passes the changed paths; it falls back with `reason`
+  `no_baseline`, `unpaired`, `threshold` or `no_changes`; a green `gate.done` records the owned file hashes as the next
+  baseline (B99, #16)
+- `review.file_loop: overlap` and `review-file --wait-block <id> --run <r> [--max]`: one wait for all owned changed
+  files of a block, one JSON line `{block, files: [{file, ticket, status}], done}`; a file changed after its ticket gets
+  its current content enqueued; timeout exits 0 with `reason: wait_timeout`, `not_queued` files give `reason:
+  not_queued`, no live worker exits 3 with `worker_down` (B100)
+- `review.file_loop: watch`: the worker watches the block's HEAD and queues owned files from new commits, with the same
+  ticket ids as `review-file`; an older pending ticket of the same file is marked `superseded`; problems write one
+  `watch.skipped` row per reason (B104)
+- every `code-forge context pack` carries a built-in `## proof rule (code-forge)` section that `context.max_lines` never
+  cuts: the red→green definition, no hand mutations, one exact test per clause, proof scales with risk, no extras the
+  acceptance does not ask for (B117)
+
+### Changed
+
+- `block close` reports `coder report FAILED: TESTS line malformed: <line>` for a `TESTS ` line that does not end in
+  `exit=<n>`; no line at all still gives `no TESTS line` (B114)
+- every review lens tells the reviewer not to ask for hand mutations or tests beyond the acceptance; a weak assertion is
+  fixed by a stronger assertion; over-engineering is at most a `nit` (B117)
+
+### Removed
+
+- the unused `proofRequirements` export in src/proof/tiers.mjs (B117)
+
+### Fixed
+
+- every fix-loop stop (stall, cap, split, stop-at, L3 exhaustion) records `stop_content_hash`, so `block reopen` works
+  after it; a stop with unknown content reopens when no verified `review.round` names the current hash (`from_hash:
+  null`), and the refusal no longer points to `block waive` (B114, #17)
+- paired tests: a Python `<stem>_test.py` file pairs with `<stem>.py`, like `test_<stem>.py` (B115)
+- `npm test -- <args>` passes the extra args to the main test phase again; the snapshot and final no-leak steps still
+  run (B115)
+
+## [0.11.0] — 2026-10-13
+
+### Added
+
+- `npm run release` moves the README "In the next release:" bullets under the new version, refuses an empty [Unreleased]
+  or a missing README anchor in preflight, restores README on a failed check, and runs `gen-config-doc --check`;
+  `docs/releasing.md` gets a releasing checklist (B108).
+- `pairsFor` and `summarize` (src/review/paired.mjs) and an optional `## paired` packet section after `## context`,
+  dropped first over budget; `attachFiles` attaches an untracked file only when it is an owned, changed file of the
+  block and not ignored or secret-like (B97).
+- The review engine, the fix-loop recheck and the worker send `## paired` (the block's owned changed peers and
+  `test_files`); the needs_file path passes the block's owned and changed files so a new untracked owned test file can
+  be attached; the lenses say a test named in `## paired` exists (B98).
+
+### Changed
+
+- `block close` prints the `reviewed <path> ticket <id>` lines itself, for every file the review gate accepts; `--json`
+  and the done file carry `reviewed: [{file, ticket, via}]`; the coder report no longer needs hand ticket lines, and a
+  mismatched hand line under `--report` is a WARN, not a refusal (B96, #16).
+- A quick review packet over `quick_in` steps up to one full L2 session when it fits `full_in`, before `split_required`;
+  the `review.plan` row carries `step_up: {from, tokens_in, budget}` (B109, #16).
+- A cached round-1 `split_required` is re-queued by `review-file` (`retry: true`) and by `review-file --fresh`, with the
+  same ticket id; a recheck `split_required` stop still needs `block reopen` or `block waive` (B110, #16).
+- A recheck with no fix hunks counts no round and returns `reviewed`, `approved: false`, `reason: 'no-fix-hunks'`; a
+  recheck answer that lacks a `resolved` entry for an open finding of its packet is a `schema` miss; the worker's
+  recheck summary adds `status`, `tokens_in`, `tokens_out` and `reason` (B111, #16).
+- A review ticket reads the diffs of the block's other changed files only when the review asks for them, once per ticket
+  (B112)
+
+### Fixed
+
+- A worker stops by itself, without taking a new ticket, when its run record or its HOME is removed (B113)
+- Tests stop every worker they start, also when a test fails or times out; the final no-leak step of `npm test` fails
+  when a worker from this suite is still alive (B113)
+
 ## [0.10.0] — 2026-10-13
 
 ### Added

package/README.md

@@ -8,10 +8,37 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 > `examples/` have all landed (`docs/reference/blocks.json` lists every build block). What changed
 > in each version is in [CHANGELOG.md](CHANGELOG.md).
 
-## What's new in 0.9
+## What's new in 0.12
 
 In the next release:
 
+In 0.12.0:
+
+- **Faster fix rounds (B99).** `code-forge gates run --run <r> --block <id> --changed` runs only the tests of files changed since the last green gate run, and `{changed_files}` passes only the changed files to lint or format gates. It falls back to the normal scope when it cannot be sure.
+- **Write while reviews run (B100).** With `review.file_loop: overlap`, the coder enqueues each green file and keeps working. Before it ends, `forge review-file --wait-block <id> --run <r>` waits once for every file of the block.
+- **Reopen after any stop (B114, #17).** Every review stop now records the content it reviewed. An older stop with unknown content can be reopened when the current content was never reviewed. A malformed `TESTS` line now gets its own clear error.
+- **Python `*_test.py` tests pair with their source (B115).** Fix rounds and review packets now find `widget_test.py` for `widget.py`, as they already found `test_widget.py`.
+- **Commit watch (B104).** Set `review.file_loop: watch` and the coder just commits each green file. The worker sees the new commits, queues each owned file for review and drops older pending reviews of the same file. `review-file --wait-block` waits for them all.
+- **The proof rule travels with every block (B117).** Every context pack and every reviewer now carry one rule. Red→green: each new or changed test must fail on the old code first, then pass on the new code. No hand mutations. Proof scales with risk, and nothing is added that the task did not ask for.
+
+## What's new in 0.11
+
+In 0.11.0:
+
+- **The release moves the README What's new list (B108).** `npm run release` now moves the "In the next release:" bullets under "In X.Y.Z:". A minor or major release starts a new "What's new in X.Y" heading. The empty anchor stays for the next block. The release refuses an empty CHANGELOG [Unreleased] or a missing anchor before it changes anything, and a failed check puts the README back with the other files. The checks now include `gen-config-doc --check`. `docs/releasing.md` has a releasing checklist.
+- **The close writes the ticket lines (B96).** The coder's final report no longer needs a `reviewed <path> ticket <id>` line per file. `block close` prints one for every file the review gate accepts (approved, waived or answered), with the queue's ticket. `--json` and the block's done file carry them as `reviewed: [{file, ticket, via}]`. With `--report`, a hand line that names another ticket prints `WARN report ticket mismatch <path>` on stderr, and the close goes on.
+- **A big-diff file steps up to a full review (B109).** A low-risk file whose diff is too big for the quick review budget used to stop with `split_required`, and splitting it only made the diff bigger. Now the review plans again as one full L2 session. If the diff fits the full budget, the file is reviewed. The `review.plan` row records the step as `step_up`.
+- **A file that was too big can be reviewed again (B110).** A first-round `split_required` result ran no review. After you raise the budget and run `run reload`, `review-file` (or `review-file --fresh`) tries again with the same ticket. A recheck stop still needs `block reopen` or `block waive`.
+- **A recheck that did not really review never stalls (B111).** A recheck on unchanged content runs no session and counts no round; it returns `reason: 'no-fix-hunks'`. A recheck answer that skips an open finding is a broken answer, not a "still open". So the stall rule sees only real rechecks. The recheck summary now shows each session's status and tokens.
+- **Paired files for the reviewer, part 1 (B97).** code-forge can now find a changed file's test file (or a test's source file) by name, and list its test names or exported symbols in a small `## paired` packet section. The section is dropped first when the packet is too big. A reviewer can also ask for a new, untracked test file when the block owns and changed it. B98 sends these to the reviewers.
+- **Reviewers see the paired test file (B98).** When a block changes `src/a.mjs` and `test/a.test.mjs`, the reviewer of `src/a.mjs` now gets the test names in a `## paired` section, in the first review and in rechecks. Tests named with `block open --tests` count too. The reviewer is told those tests exist, so it no longer reports them as missing. It can still ask for a test file's body, even a new untracked one the block owns.
+- **Faster reviews (B112).** A review ticket reads the diffs of the block's other changed files only when the review asks for them, and only once.
+- **No leftover workers (B113).** A worker stops by itself when its run record or its HOME is removed. `npm test` now fails when a test leaves a worker running.
+
+## What's new in 0.10
+
+In 0.10.0:
+
 - **Choose how long a 1Password key stays cached (B84).** Set `keys.cache_hours` (1 to 24, default 8) in `.code-forge.yml`, or `keys set <name> --op <ref> --cache-hours <n>` for one key. A lower value shortens keys that are already cached at the next read.
 - **Warnings before a cached key runs out (B85).** `keys list` and `doctor` warn when a 1Password key has less than 1 hour left. When the cached key expired and 1Password does not answer, `jev ask` prints the exact command to re-link it: `code-forge keys set jev --op <ref>`.
 - **A test report reader for red-green proof (B86).** code-forge can now read a JUnit XML test report (XCTest, Swift Testing, PHPUnit, Pest, pytest). A missing, broken or empty report, or an error that is not a failed assertion, never counts as red. B87 connects it to `proof red-green`.
@@ -27,6 +54,8 @@ In the next release:
 - **One fix round per block (B94).** The skill now waits for every review and test of a block. Then it sends the coder ONE fix message with every failing test and every open finding. It never sends findings one at a time.
 - **Waive and reopen ask you at a terminal (B80).** `block waive` and `block reopen` now ask the human for a yes in their own terminal. There is no `--yes`. With no terminal they record nothing. The prompt is a speed bump, not proof of a human: a pseudo-terminal passes it.
 
+## What's new in 0.9
+
 In 0.9.0:
 
 - **A lost review state is rebuilt, not reset.** When the review state file of a file is gone (for example, macOS cleaned its temp folder), the worker rebuilds it from the signed ledger and writes a `review.state_restored` row. Rounds, open findings and stops stay as they were. If the ledger cannot rebuild it, the ticket is refused as `review-state-lost`, not `tampered` (#15).
@@ -363,7 +392,8 @@ CLI verbs like any other and every one of them is exercised by this package's ow
   you the full issue and sends nothing without your yes. `CODE_FORGE_NO_ERROR_LOG=1` turns the log,
   the warnings and the command list off. Every field is listed in [docs/privacy.md](docs/privacy.md).
 - **No mutation testing.** Neither this package's own tests nor the product it ships run mutation
-  testing (Ricardo's ruling R14/Q16, 2026-09-25). Proof is plain unit and feature tests with exact
+  testing (the owner's ruling R14/Q16, 2026-09-25). Coders do not make hand mutations either: each new
+  or changed test is proven red→green, and a weak assertion is fixed by a stronger assertion. Proof is plain unit and feature tests with exact
   assertions, plus a red→green runner that proves a new test fails before the fix and passes after (`node:test`
   built in; any other runner through a `proof.runners` entry that writes a JUnit report).
 
@@ -411,5 +441,6 @@ depends on, kept in sync with the maintainer's design plan.
 
 Releasing: record changes with `npm run changelog -- <type> "<text>"` and fixed error reports with
 `npm run known-fix -- add <fp> <version> "<summary>"`, then `npm run release -- <patch|minor|major|x.y.z> [--dry-run]`
-bumps, commits and tags (it never pushes or publishes). Publish with `npm publish` from your
+bumps, moves the README's "In the next release:" bullets under the new version, checks the config
+doc, commits and tags (it never pushes or publishes). Publish with `npm publish` from your
 machine, then push the tag: CI only creates the GitHub release. See [docs/releasing.md](docs/releasing.md).

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 102,
+  "block_count": 117,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -1623,6 +1623,365 @@
         "B94"
       ],
       "note": "root-added 2026-10-13; issue #10 owner item 1 (plans/iteration/plan.md B80, D1 = a); block waive and block reopen ask the human for a yes at a terminal, no --yes, no terminal exits 2 and records nothing; pre-checks run before the question; a pseudo-terminal passes the check (honest limit in security.md §3); D1 (b) is a later option"
+    },
+    "B108": {
+      "title": "Release moves the README What's new bullets and checks the docs",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "README.md",
+        "docs/releasing.md",
+        "scripts/release.mjs",
+        "test/release-readme.test.mjs",
+        "test/release.test.mjs"
+      ],
+      "depends_on": [
+        "B80"
+      ],
+      "note": "root-added 2026-10-13; process fix after the 0.10.0 README miss (plans/field-bugs/plan.md B108); npm run release moves the 'In the next release:' bullets under 'In X.Y.Z:' (new '## What's new in X.Y' on a minor or major), keeps an empty anchor, refuses an empty [Unreleased] or a missing anchor in preflight, rolls README back with the other files, and runs gen-config-doc --check"
+    },
+    "B96": {
+      "title": "The close writes the reviewed ticket lines",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/concepts.md",
+        "docs/how-it-works.md",
+        "docs/tutorial-first-test.md",
+        "skill/SKILL.md",
+        "skill/references/code.md",
+        "skill/templates/coder-brief.md",
+        "src/cli/block.mjs",
+        "src/review/reviewed-lines.mjs",
+        "src/state/block-end.mjs",
+        "test/cli/close-report.test.mjs",
+        "test/cli/status.test.mjs",
+        "test/engines/sentinel-tests.test.mjs",
+        "test/integration/review-flow.test.mjs",
+        "test/review/answers.test.mjs",
+        "test/review/close-gate.test.mjs",
+        "test/review/external.test.mjs",
+        "test/review/gate-check.test.mjs",
+        "test/review/reopen.test.mjs",
+        "test/review/waived-all.test.mjs",
+        "test/session/plan-sections.test.mjs",
+        "test/skill/structure.test.mjs",
+        "test/state/block.test.mjs",
+        "test/worker/deletion-review.test.mjs"
+      ],
+      "depends_on": [
+        "B108"
+      ],
+      "note": "root-added 2026-10-13; issue #16 item 6 (Group E); block close prints `reviewed <path> ticket <id>` for every file the review gate accepts, --json and the done file carry reviewed [{file, ticket, via}]; the coder report needs no hand ticket lines; a mismatched hand line under --report prints a held WARN; no-ticket, bad-ticket and lines-unavailable WARNs are held and print only on a successful close"
+    },
+    "B109": {
+      "title": "Step up from quick to one full review before split_required",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "skill/references/review.md",
+        "src/review/engine.mjs",
+        "test/review/budget-step-up.test.mjs",
+        "test/review/test-quality.test.mjs"
+      ],
+      "depends_on": [
+        "B96"
+      ],
+      "note": "root-added 2026-10-13; issue #16 item 1 (plans/field-bugs/plan.md B109, D1 = a); a non-Markdown quick packet over quick_in is planned again at risk 1; if that plan is one full session and fits full_in it reviews with it (review.plan step_up {from: 'quick', tokens_in, budget}); otherwise split_required with the full packet's size; first block built by Codex at high effort"
+    },
+    "B110": {
+      "title": "Re-run a cached round-1 split_required",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "skill/references/code.md",
+        "skill/references/review.md",
+        "src/cli/review-file.mjs",
+        "test/skill/structure.test.mjs",
+        "test/worker/fresh-split.test.mjs",
+        "test/worker/fresh.test.mjs"
+      ],
+      "depends_on": [
+        "B109"
+      ],
+      "note": "root-added 2026-10-13; issue #16 item 2 (plans/field-bugs/plan.md B110); a cached round-1 split_required ran no session and counts no round: plain review-file re-queues it with retry: true and --fresh re-queues it, same ticket id; a recheck stop (status stopped, stopped split_required) still needs block reopen or waive; built by Codex at high effort"
+    },
+    "B111": {
+      "title": "An unchanged or incomplete recheck never counts or stalls",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "skill/references/review.md",
+        "src/review/fixloop.mjs",
+        "src/worker/engine.mjs",
+        "test/review/recheck-real.test.mjs",
+        "test/autopilot/actions.test.mjs",
+        "test/cli/block-human-confirm.test.mjs",
+        "test/review/fixloop.test.mjs",
+        "test/review/moved-wiring.test.mjs",
+        "test/review/patch-progress.test.mjs",
+        "test/review/reopen.test.mjs",
+        "test/worker/fixloop-wiring.test.mjs",
+        "test/worker/pool.test.mjs",
+        "test/worker/review-state-durable.test.mjs",
+        "test/worker/review-state-restore.test.mjs"
+      ],
+      "depends_on": [
+        "B110"
+      ],
+      "note": "root-added 2026-10-13; issue #16 item 3 (plans/field-bugs/plan.md B111, D3 = a); P1: a recheck with no fix hunks runs no session, counts no round and returns reviewed, approved false, reason no-fix-hunks; P2: a recheck answer without a resolved entry for each open finding of its packet is a schema miss (B55/B91 second level at the second broken result, else unavailable); the worker recheck summary gains status, tokens_in, tokens_out and reason; 10 fixtures now answer resolved explicitly; built by Codex at high effort in 2 rounds"
+    },
+    "B97": {
+      "title": "Paired-file names in the packet; untracked owned files can be attached",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "skill/references/review.md",
+        "src/review/packet.mjs",
+        "src/review/paired.mjs",
+        "test/review/engine.test.mjs",
+        "test/review/packet.test.mjs",
+        "test/review/paired.test.mjs"
+      ],
+      "depends_on": [
+        "B111"
+      ],
+      "note": "root-added 2026-10-13; Group E E5 part 1 (plans/run-speed/plan.md B97, D4 = a); pairsFor by stem for .mjs/.ts/PHP/Go/Python/Swift; summarize lists at most 40 unique test names or exported symbols of at most 120 chars, redacted before truncation; assemblePacket takes paired and renders ## paired after ## context, dropped first over budget, never split_required; attachFiles attaches an untracked file only when owned and changed in the block and not ignored or secret-like; builders wire it in B98; built by Codex at high effort in 2 rounds"
+    },
+    "B98": {
+      "title": "The packet builders send the paired files; the lenses use them",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "skill/references/review.md",
+        "src/review/engine.mjs",
+        "src/review/fixloop.mjs",
+        "src/review/lenses/A.md",
+        "src/review/lenses/B.md",
+        "src/review/lenses/full.md",
+        "src/review/lenses/recheck.md",
+        "src/worker/engine.mjs",
+        "test/review/fixloop.test.mjs",
+        "test/review/paired-wiring.test.mjs",
+        "test/review/route.test.mjs",
+        "test/review/sections.test.mjs"
+      ],
+      "depends_on": [
+        "B97"
+      ],
+      "note": "root-added 2026-10-13; Group E E5 part 2 (plans/run-speed/plan.md B98); pairedContext builds ## paired from the block's owned changed peers plus its test_files (glob entries dropped) in round 1, full rounds and rechecks; the worker passes ownedFiles/changedFiles so needs_file can attach a new untracked owned test file; a failing peer listing is fail-soft (empty context); the four lenses say a test named in ## paired exists; built by Codex at high effort in 2 rounds"
+    },
+    "B112": {
+      "title": "Suite speed: peer diffs read lazily again (B98 regression); bench test load-proof",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/worker/engine.mjs",
+        "test/worker/peer-diffs-lazy.test.mjs",
+        "test/bench-review.test.mjs"
+      ],
+      "depends_on": [
+        "B98"
+      ],
+      "note": "root-added 2026-10-13; velocity; review.test.mjs 89 s -> 44 s"
+    },
+    "B113": {
+      "title": "No leaked workers: orphan stop, failure-safe test cleanup, no-leak worker check",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "package.json",
+        "src/worker/loop.mjs",
+        "test/cli/review.test.mjs",
+        "test/docs-marketing.test.mjs",
+        "test/harness-isolation.test.mjs",
+        "test/helpers/isolate.mjs",
+        "test/helpers/worker-processes.mjs",
+        "test/no-leak.test.mjs",
+        "test/router.test.mjs",
+        "test/worker/cli-cleanup.test.mjs",
+        "test/worker/helper-cleanup.test.mjs",
+        "test/worker/helpers.mjs",
+        "test/worker/orphan-guard.test.mjs",
+        "test/worker/orphan.test.mjs",
+        "test/worker/process-list.test.mjs"
+      ],
+      "depends_on": [
+        "B112"
+      ],
+      "note": "root-added 2026-10-13; bug; 226 orphan test workers drove load to 350-450 and broke the release test step"
+    },
+    "B99": {
+      "title": "Fix rounds check less: gates run --changed, {changed_files}",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "docs/reference/config.md",
+        "schema/code-forge.schema.json",
+        "skill/references/code.md",
+        "skill/references/proof.md",
+        "skill/templates/coder-brief.md",
+        "src/cli/gates.mjs",
+        "src/config/validate.mjs",
+        "src/gates/expand.mjs",
+        "src/gates/run.mjs",
+        "src/proof/lock.mjs",
+        "src/util/gate-token.mjs",
+        "test/gates/changed.test.mjs",
+        "test/gates/placeholders.test.mjs"
+      ],
+      "depends_on": [
+        "B113"
+      ],
+      "note": "root-added 2026-10-13; #16; owner D2=a: fix-round TESTS may use --changed, orchestrator runs full gates before close"
+    },
+    "B100": {
+      "title": "Overlap loop: review-file --wait-block, review.file_loop overlap",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "docs/reference/config.md",
+        "schema/code-forge.schema.json",
+        "skill/references/code.md",
+        "skill/templates/coder-brief.md",
+        "src/cli/review-file.mjs",
+        "src/config/validate.mjs",
+        "src/worker/queue.mjs",
+        "test/config/schema-coverage.test.mjs",
+        "test/worker/wait-block.test.mjs"
+      ],
+      "depends_on": [
+        "B99"
+      ],
+      "note": "run-speed E3a; round 1 approved, minors noted (wait-block test 2/4 assertions could be stricter)"
+    },
+    "B114": {
+      "title": "Stop with unknown content is no dead end (#17); TESTS line malformed",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "skill/references/code.md",
+        "skill/references/review.md",
+        "src/cli/block.mjs",
+        "src/review/fixloop.mjs",
+        "src/review/reopen.mjs",
+        "test/cli/block-tests-line.test.mjs",
+        "test/review/reopen-unknown.test.mjs",
+        "test/review/reopen.test.mjs"
+      ],
+      "depends_on": [
+        "B100"
+      ],
+      "note": "#17; round 1 approved; built in parallel with B115; minor noted: reopen row lost if worker crashes between round save and state save"
+    },
+    "B115": {
+      "title": "Small follow-ups: Python *_test.py pairing, npm test -- <args>, test cleanup errors",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "package.json",
+        "test/helpers/run-suite.sh",
+        "skill/references/review.md",
+        "src/review/paired.mjs",
+        "test/no-leak.test.mjs",
+        "test/no-leak-final.test.mjs",
+        "test/review/paired.test.mjs",
+        "test/router.test.mjs",
+        "test/worker/helper-cleanup.test.mjs",
+        "test/worker/helpers.mjs"
+      ],
+      "depends_on": [
+        "B114"
+      ],
+      "note": "owner 2026-10-13; 2 rounds; noted: 6 old test files call rm(undefined) in cleanup under --test-name-pattern (follow-up); no-leak-final pins report order only at beforeExit"
+    },
+    "B104": {
+      "title": "Commit watch: review.file_loop watch queues owned files from new commits",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "docs/reference/config.md",
+        "schema/code-forge.schema.json",
+        "skill/references/code.md",
+        "skill/references/review.md",
+        "skill/templates/coder-brief.md",
+        "src/config/validate.mjs",
+        "src/util/exec.mjs",
+        "src/worker/loop.mjs",
+        "src/worker/queue.mjs",
+        "src/worker/watch.mjs",
+        "test/skill/structure.test.mjs",
+        "test/worker/wait-block.test.mjs",
+        "test/worker/watch.test.mjs"
+      ],
+      "depends_on": [
+        "B115"
+      ],
+      "note": "3 rounds (r2 major fixed by the orchestrator with red→green); noted: activeTickets only from the scheduler pass; stop() during a watch tick still dispatches that pass; watch state reset after realpath; a file replaced by a directory stalls the watch after one skip row; enqueue passes the raw file to enqueueHash"
+    },
+    "B117": {
+      "title": "Proof rule in every context pack, review lens, skill and doc; red→green defined",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "docs/concepts.md",
+        "docs/how-it-works.md",
+        "docs/overview.md",
+        "docs/tutorial-first-test.md",
+        "skill/SKILL.md",
+        "skill/references/code.md",
+        "skill/references/proof.md",
+        "skill/references/rules-core.md",
+        "skill/templates/coder-brief.md",
+        "src/context/pack.mjs",
+        "src/install/wizard/flags.mjs",
+        "src/proof/rule.mjs",
+        "src/proof/tiers.mjs",
+        "src/review/gate-check.mjs",
+        "src/review/lenses/A.md",
+        "src/review/lenses/B.md",
+        "src/review/lenses/full.md",
+        "src/review/lenses/judge.md",
+        "src/review/lenses/quick.md",
+        "src/review/lenses/recheck.md",
+        "test/context/pack.test.mjs",
+        "test/proof/tiers.test.mjs",
+        "test/review/fixloop.test.mjs",
+        "test/review/packet.test.mjs",
+        "test/review/route.test.mjs",
+        "test/review/test-quality.test.mjs",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B104"
+      ],
+      "note": "owner 2026-10-13: pass the proof rule to every project built with code-forge; 1 round, 3 minors not-bug; removed dead proofRequirements (mutants: held)"
     }
   }
 }

package/docs/reference/config.md

@@ -136,6 +136,7 @@ Every other key defaults as shown, or is entirely absent from a minimal file. `a
 | `review.provider_concurrency.openai` | integer |  | `2` | min 1 |
 | `review.provider_concurrency.xai` | integer |  | `2` | min 1 |
 | `review.parallel_tickets` | integer |  | `3` | min 1; max 16; B42: how many review tickets the worker runs at once (oldest first); 1 = one at a time. Tickets for the same file never overlap. |
+| `review.file_loop` | enum: `wait`, `overlap`, `watch` |  | `"wait"` | After each green file, enqueue its review. wait (default): wait for its ticket before the next file. overlap: continue coding, then run review-file --wait-block <id> --run <run> before the completion sentinel; inspect findings with --wait <ticket>. watch: commit each green file instead of running review-file; the worker queues committed owned content, supersedes pending older tickets, and --wait-block joins before the sentinel. |
 | `review.external` | object |  | — |  |
 | `review.external.required` | boolean |  | `false` | B58: true ⇒ block close skips the local per-file review checks (and the --report ticket check), with no terminal and under autopilot, and writes a signed gate.reviews_waived {by: config} row. Unowned changes, proof, no_changes and the transcript grep still refuse. No block may own .code-forge.yml. |
 | `review.external.name` | string |  | — | minLength 1; B58: the outside reviewer, written in the review.external and gate.reviews_waived rows. Required when required is true: run start refuses a missing or blank name. |
@@ -149,15 +150,15 @@ Every other key defaults as shown, or is entirely absent from a minimal file. `a
 | `caps` | object |  | — |  |
 | `caps.coders` | integer |  | `2` | min 1 |
 | `gates` | object |  | — |  |
-| `gates.test` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. |
-| `gates.lint` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. |
-| `gates.types` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. |
-| `gates.format` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. |
+| `gates.test` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. With gates run --run --block --changed, {test_files} expands to changed tests plus stem-paired tests of changed sources, and {changed_files} expands to changed paths for lint or format. Both tokens must be whole argv items and cannot be the command or the only item. Config validation refuses a gate whose command or only item is {changed_files}. Deleted files count for pairing and the threshold, but both tokens receive only files that exist now. Without --changed, {changed_files} is dropped. Changed rows carry scope changed; narrowed rows have no reason. Only fallback rows carry a reason: no_baseline uses today's scope, unpaired uses today's test scope, threshold runs the full suite above the changed-file threshold, and no_changes uses today's scope when nothing is left to run. Gates without either token run unchanged. Any green gates run --run --block records owned file hashes on gate.done, including runs without --changed. When --slug is omitted, these rows go to the run's project ledger. More than 200 owned files means no record, so the next --changed falls back with no_baseline; unreadable inputs also leave no record. A fix-round TESTS line may use --changed; the orchestrator runs full gates before block close. |
+| `gates.lint` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. With gates run --run --block --changed, {test_files} expands to changed tests plus stem-paired tests of changed sources, and {changed_files} expands to changed paths for lint or format. Both tokens must be whole argv items and cannot be the command or the only item. Config validation refuses a gate whose command or only item is {changed_files}. Deleted files count for pairing and the threshold, but both tokens receive only files that exist now. Without --changed, {changed_files} is dropped. Changed rows carry scope changed; narrowed rows have no reason. Only fallback rows carry a reason: no_baseline uses today's scope, unpaired uses today's test scope, threshold runs the full suite above the changed-file threshold, and no_changes uses today's scope when nothing is left to run. Gates without either token run unchanged. Any green gates run --run --block records owned file hashes on gate.done, including runs without --changed. When --slug is omitted, these rows go to the run's project ledger. More than 200 owned files means no record, so the next --changed falls back with no_baseline; unreadable inputs also leave no record. A fix-round TESTS line may use --changed; the orchestrator runs full gates before block close. |
+| `gates.types` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. With gates run --run --block --changed, {test_files} expands to changed tests plus stem-paired tests of changed sources, and {changed_files} expands to changed paths for lint or format. Both tokens must be whole argv items and cannot be the command or the only item. Config validation refuses a gate whose command or only item is {changed_files}. Deleted files count for pairing and the threshold, but both tokens receive only files that exist now. Without --changed, {changed_files} is dropped. Changed rows carry scope changed; narrowed rows have no reason. Only fallback rows carry a reason: no_baseline uses today's scope, unpaired uses today's test scope, threshold runs the full suite above the changed-file threshold, and no_changes uses today's scope when nothing is left to run. Gates without either token run unchanged. Any green gates run --run --block records owned file hashes on gate.done, including runs without --changed. When --slug is omitted, these rows go to the run's project ledger. More than 200 owned files means no record, so the next --changed falls back with no_baseline; unreadable inputs also leave no record. A fix-round TESTS line may use --changed; the orchestrator runs full gates before block close. |
+| `gates.format` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. With gates run --run --block --changed, {test_files} expands to changed tests plus stem-paired tests of changed sources, and {changed_files} expands to changed paths for lint or format. Both tokens must be whole argv items and cannot be the command or the only item. Config validation refuses a gate whose command or only item is {changed_files}. Deleted files count for pairing and the threshold, but both tokens receive only files that exist now. Without --changed, {changed_files} is dropped. Changed rows carry scope changed; narrowed rows have no reason. Only fallback rows carry a reason: no_baseline uses today's scope, unpaired uses today's test scope, threshold runs the full suite above the changed-file threshold, and no_changes uses today's scope when nothing is left to run. Gates without either token run unchanged. Any green gates run --run --block records owned file hashes on gate.done, including runs without --changed. When --slug is omitted, these rows go to the run's project ledger. More than 200 owned files means no record, so the next --changed falls back with no_baseline; unreadable inputs also leave no record. A fix-round TESTS line may use --changed; the orchestrator runs full gates before block close. |
 | `gates.extra` | object |  | — |  |
 | `gates.extra.secret_scan` | boolean |  | `true` |  |
 | `gates.extra.safe_edit` | boolean |  | `true` |  |
 | `gates.extra.invariants` | string |  | — |  |
-| `gates.full_suite_threshold_files` | integer |  | `10` | min 1; A block that owns more files than this runs the full suite for a {test_files} gate (reason threshold), not its related tests. Owned files are counted this way. A glob or a directory counts the tracked and new (not ignored) files it covers. A path not created yet counts as 1. Outside git each entry counts 1. A git failure runs the full suite. block open --tests names the test files precisely. |
+| `gates.full_suite_threshold_files` | integer |  | `10` | min 1; A block that owns more files than this runs the full suite for a {test_files} gate (reason threshold), not its related tests. Owned files are counted this way. A glob or a directory counts the tracked and new (not ignored) files it covers. A path not created yet counts as 1. Outside git each entry counts 1. A git failure runs the full suite. block open --tests names the test files precisely. With gates run --changed, the threshold counts changed files since the last green gates run --run --block instead. |
 | `proof` | object |  | — |  |
 | `proof.tiers` | object |  | — |  |
 | `proof.tiers.high` | object |  | — |  |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",
@@ -38,7 +38,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "CODE_FORGE_NO_LEAK=snapshot node --import ./test/helpers/isolate.mjs --test test/no-leak.test.mjs && node --import ./test/helpers/isolate.mjs --experimental-test-module-mocks --test 'test/**/*.test.mjs' && CODE_FORGE_NO_LEAK=final node --import ./test/helpers/isolate.mjs --test test/no-leak.test.mjs",
+    "test": "sh test/helpers/run-suite.sh",
     "typecheck": "tsc --checkJs --noEmit",
     "release": "node scripts/release.mjs",
     "changelog": "node scripts/changelog.mjs",

package/schema/code-forge.schema.json

@@ -185,6 +185,7 @@
           }
         },
         "parallel_tickets": { "type": "integer", "minimum": 1, "maximum": 16, "default": 3, "description": "B42: how many review tickets the worker runs at once (oldest first); 1 = one at a time. Tickets for the same file never overlap." },
+        "file_loop": { "type": "string", "enum": ["wait", "overlap", "watch"], "default": "wait", "description": "After each green file, enqueue its review. wait (default): wait for its ticket before the next file. overlap: continue coding, then run review-file --wait-block <id> --run <run> before the completion sentinel; inspect findings with --wait <ticket>. watch: commit each green file instead of running review-file; the worker queues committed owned content, supersedes pending older tickets, and --wait-block joins before the sentinel." },
         "external": {
           "type": "object",
           "additionalProperties": false,
@@ -240,7 +241,7 @@
           "type": "integer",
           "minimum": 1,
           "default": 10,
-          "description": "A block that owns more files than this runs the full suite for a {test_files} gate (reason threshold), not its related tests. Owned files are counted this way. A glob or a directory counts the tracked and new (not ignored) files it covers. A path not created yet counts as 1. Outside git each entry counts 1. A git failure runs the full suite. block open --tests names the test files precisely."
+          "description": "A block that owns more files than this runs the full suite for a {test_files} gate (reason threshold), not its related tests. Owned files are counted this way. A glob or a directory counts the tracked and new (not ignored) files it covers. A path not created yet counts as 1. Outside git each entry counts 1. A git failure runs the full suite. block open --tests names the test files precisely. With gates run --changed, the threshold counts changed files since the last green gates run --run --block instead."
         }
       }
     },
@@ -511,7 +512,7 @@
       }
     },
     "argvOrNull": {
-      "description": "An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason.",
+      "description": "An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. With gates run --run --block --changed, {test_files} expands to changed tests plus stem-paired tests of changed sources, and {changed_files} expands to changed paths for lint or format. Both tokens must be whole argv items and cannot be the command or the only item. Config validation refuses a gate whose command or only item is {changed_files}. Deleted files count for pairing and the threshold, but both tokens receive only files that exist now. Without --changed, {changed_files} is dropped. Changed rows carry scope changed; narrowed rows have no reason. Only fallback rows carry a reason: no_baseline uses today's scope, unpaired uses today's test scope, threshold runs the full suite above the changed-file threshold, and no_changes uses today's scope when nothing is left to run. Gates without either token run unchanged. Any green gates run --run --block records owned file hashes on gate.done, including runs without --changed. When --slug is omitted, these rows go to the run's project ledger. More than 200 owned files means no record, so the next --changed falls back with no_baseline; unreadable inputs also leave no record. A fix-round TESTS line may use --changed; the orchestrator runs full gates before block close.",
       "anyOf": [
         { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
         {