@codedology/code-forge 0.11.0 → 0.13.0

package/CHANGELOG.md

@@ -6,6 +6,86 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.13.0] — 2026-10-14
+
+### Changed
+
+- The leak test in `test/worker/orphan.test.mjs` takes the current contents of the repo's `.code-forge` folder as its baseline, so `npm test` passes when that folder already holds files (B126).
+- Close check: a `review.cap` row is superseded by a later verified human `review.reopened` row followed by a signed
+  `review.round` of the file's current content; a superseded cap row adds no ids, so old stop findings need no
+  waiver after a reopen (B123)
+- `review-file --wait-block`: a file whose newest review left open findings and whose content changed after it is not
+  re-queued; the join answers `status: findings` with that ticket and writes one delivered marker; the next join
+  queues the latest content once, so a commit made blind to the findings never counts as a stall round (B122)
+- Worker registry: each worker writes `<repo>/.code-forge/workers/<pid>-<start_time>.json` next to `queue/worker.json`
+  and beats both; boot counts live entries and writes its entry under one cross-process lock (limit 1); boot
+  removes dead entries (a known start-time mismatch is dead); an unreadable entry blocks the boot and `doctor`
+  lists it; `liveWorker` keeps the B30 fresh-heartbeat rule (B106)
+- Watch mode holds rechecks: a commit of a file that already has a ticket gets no ticket, only a `watch.held`
+  row; `review-file --wait-block` queues one ticket for the latest content; older pending tickets are still
+  superseded (B121)
+- Locks now hold across processes (`src/util/file-locks.mjs`, `~/.code-forge/locks`): ticket claims, the per-file and
+  block locks, the budget row, schema fallback and autopilot actions; a dead owner's lock (pid + start time) is broken
+  under a per-key break mutex; `doctor` lists bad locks and crashed break mutexes (B105)
+- New opt-in key `review.fair_share` (boolean, default `false`): the worker pool gives each free slot to the
+  pending ticket whose block has the fewest running tickets; ties stay oldest first (B101)
+- `context pack` with no `context` key writes a pack with the block header and the built-in proof rule (300-line cap)
+  instead of refusing; a bad `context` value still refuses (B118)
+- `block close` prints `WARN block <id>: no green gates run for this block; …` when `gates.test` is set and the block's
+  last gate row is not a green `gate.done`; it still closes (B118)
+- `block close --transcript` reads a Codex JSON log (`codex exec --json`) by its commands and file writes only;
+  agent messages, reasoning, command output and non-item events are skipped; other logs are scanned as before (B119)
+
+### Fixed
+
+- `block open` refuses an `--owned` or `--tests` entry that contains whitespace and names no existing file or directory
+  (a shell quoting slip), naming the entry; nothing is written (B118)
+- `npm test -- --test-name-pattern=<p>` exits 0: six test files no longer call `rm(undefined)` in cleanup when
+  their setup was skipped by the pattern (B116, built with `code-forge run` itself)
+- The close reason names each transcript rule break once (`rule_break transcript line <n>: <id>`, at most 5,
+  then `+<k> more rule_break`) instead of repeating a bare `rule_break` (B119)
+- `gates run --run <r> --block <id>` with plain gates (no `{test_files}`, no `--changed`) writes its `gate.done` and
+  `gate.red` rows to the run's project ledger; before, it wrote none, so the B118 close warning fired after a green run (B120)
+
+## [0.12.0] — 2026-10-14
+
+### Added
+
+- `gates run --changed` (with `--run` and `--block`) narrows `{test_files}` to changed tests and stem-paired tests of
+  changed sources, and a new `{changed_files}` gate token passes the changed paths; it falls back with `reason`
+  `no_baseline`, `unpaired`, `threshold` or `no_changes`; a green `gate.done` records the owned file hashes as the next
+  baseline (B99, #16)
+- `review.file_loop: overlap` and `review-file --wait-block <id> --run <r> [--max]`: one wait for all owned changed
+  files of a block, one JSON line `{block, files: [{file, ticket, status}], done}`; a file changed after its ticket gets
+  its current content enqueued; timeout exits 0 with `reason: wait_timeout`, `not_queued` files give `reason:
+  not_queued`, no live worker exits 3 with `worker_down` (B100)
+- `review.file_loop: watch`: the worker watches the block's HEAD and queues owned files from new commits, with the same
+  ticket ids as `review-file`; an older pending ticket of the same file is marked `superseded`; problems write one
+  `watch.skipped` row per reason (B104)
+- every `code-forge context pack` carries a built-in `## proof rule (code-forge)` section that `context.max_lines` never
+  cuts: the red→green definition, no hand mutations, one exact test per clause, proof scales with risk, no extras the
+  acceptance does not ask for (B117)
+
+### Changed
+
+- `block close` reports `coder report FAILED: TESTS line malformed: <line>` for a `TESTS ` line that does not end in
+  `exit=<n>`; no line at all still gives `no TESTS line` (B114)
+- every review lens tells the reviewer not to ask for hand mutations or tests beyond the acceptance; a weak assertion is
+  fixed by a stronger assertion; over-engineering is at most a `nit` (B117)
+
+### Removed
+
+- the unused `proofRequirements` export in src/proof/tiers.mjs (B117)
+
+### Fixed
+
+- every fix-loop stop (stall, cap, split, stop-at, L3 exhaustion) records `stop_content_hash`, so `block reopen` works
+  after it; a stop with unknown content reopens when no verified `review.round` names the current hash (`from_hash:
+  null`), and the refusal no longer points to `block waive` (B114, #17)
+- paired tests: a Python `<stem>_test.py` file pairs with `<stem>.py`, like `test_<stem>.py` (B115)
+- `npm test -- <args>` passes the extra args to the main test phase again; the snapshot and final no-leak steps still
+  run (B115)
+
 ## [0.11.0] — 2026-10-13
 
 ### Added

package/README.md

@@ -8,10 +8,37 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 > `examples/` have all landed (`docs/reference/blocks.json` lists every build block). What changed
 > in each version is in [CHANGELOG.md](CHANGELOG.md).
 
-## What's new in 0.11
+## What's new in 0.13
 
 In the next release:
 
+In 0.13.0:
+
+- **Every block gets the proof rule, with or without a `context` key (B118).** `code-forge context pack` no longer refuses a config with no `context` key. The pack then holds the block header and the proof rule.
+- **Safer block open and close (B118).** `block open` refuses an owned or test path that has spaces and names no file, a common shell quoting slip. `block close` warns when the block has no green gates run.
+- **Clean rule checks on Codex logs (B119).** Run `codex exec --json` and pass the log to `block close --transcript`. code-forge then checks only the commands Codex ran and the files it wrote. Agent messages, reasoning and command output no longer give false rule breaks. The close reason names each rule break once.
+- **Gate results are recorded again (B120).** `gates run --run <r> --block <id>` now writes its `gate.done` row also when no gate uses `{test_files}`. Before, the row was missing, so `block close` warned after a green run and `status` showed no gate result.
+- **Fair share between blocks (B101).** Set `review.fair_share: true` and each free review slot goes to the block with the fewest running reviews. A block with many queued files no longer makes another block wait. Without the key, the order stays oldest first.
+- **Locks hold across processes (B105).** Ticket claims and the locks for files, blocks and the budget row now work across worker processes. Lock files live in `~/.code-forge/locks`. A lock of a dead process is taken over safely. A bad lock, or a break lock left by a crashed process, blocks its key until you remove it, and `code-forge doctor` names it.
+- **Watch waits for the whole fix (B121).** In watch mode, a file's first commit is reviewed at once. A later commit of a file that already has a review is held, and a `watch.held` row records it. `review-file --wait-block` then queues one review for the file's latest content. A half-done fix commit no longer uses up the file's review rounds.
+- **One registry file per worker (B106).** Each worker writes its own file in `.code-forge/workers/` and keeps it fresh with its heartbeat. A new worker starts only when the live count is under the limit, which is 1 for now. The count and the new file are written under one lock, so two workers that start at the same time cannot both run. A file of a dead worker is removed at the next start. A file that cannot be read blocks the start, and `code-forge doctor` names it.
+- **The join shows findings before it rechecks (B122).** Sometimes the coder commits again before reading the last review. At `review-file --wait-block`, such a file is not reviewed again yet. The join answers `findings` with the old ticket, so the coder reads and fixes them first. The next join rechecks the latest content once. A blind commit no longer counts as a stall round.
+- **A reopen clears old stop findings (B123).** After `block reopen` and a fresh review of the new content, the close no longer asks you to waive the findings of the old stop. Only the fresh review's findings count.
+- **The test suite passes on machines that use code-forge on itself (B126).** A leak test no longer counts files that were already in the repo's `.code-forge` folder.
+
+## What's new in 0.12
+
+In 0.12.0:
+
+- **Faster fix rounds (B99).** `code-forge gates run --run <r> --block <id> --changed` runs only the tests of files changed since the last green gate run, and `{changed_files}` passes only the changed files to lint or format gates. It falls back to the normal scope when it cannot be sure.
+- **Write while reviews run (B100).** With `review.file_loop: overlap`, the coder enqueues each green file and keeps working. Before it ends, `forge review-file --wait-block <id> --run <r>` waits once for every file of the block.
+- **Reopen after any stop (B114, #17).** Every review stop now records the content it reviewed. An older stop with unknown content can be reopened when the current content was never reviewed. A malformed `TESTS` line now gets its own clear error.
+- **Python `*_test.py` tests pair with their source (B115).** Fix rounds and review packets now find `widget_test.py` for `widget.py`, as they already found `test_widget.py`.
+- **Commit watch (B104).** Set `review.file_loop: watch` and the coder just commits each green file. The worker sees the new commits, queues each owned file for review and drops older pending reviews of the same file. `review-file --wait-block` waits for them all.
+- **The proof rule travels with every block (B117).** Every context pack and every reviewer now carry one rule. Red→green: each new or changed test must fail on the old code first, then pass on the new code. No hand mutations. Proof scales with risk, and nothing is added that the task did not ask for.
+
+## What's new in 0.11
+
 In 0.11.0:
 
 - **The release moves the README What's new list (B108).** `npm run release` now moves the "In the next release:" bullets under "In X.Y.Z:". A minor or major release starts a new "What's new in X.Y" heading. The empty anchor stays for the next block. The release refuses an empty CHANGELOG [Unreleased] or a missing anchor before it changes anything, and a failed check puts the README back with the other files. The checks now include `gen-config-doc --check`. `docs/releasing.md` has a releasing checklist.
@@ -381,7 +408,8 @@ CLI verbs like any other and every one of them is exercised by this package's ow
   you the full issue and sends nothing without your yes. `CODE_FORGE_NO_ERROR_LOG=1` turns the log,
   the warnings and the command list off. Every field is listed in [docs/privacy.md](docs/privacy.md).
 - **No mutation testing.** Neither this package's own tests nor the product it ships run mutation
-  testing (Ricardo's ruling R14/Q16, 2026-09-25). Proof is plain unit and feature tests with exact
+  testing (the owner's ruling R14/Q16, 2026-09-25). Coders do not make hand mutations either: each new
+  or changed test is proven red→green, and a weak assertion is fixed by a stronger assertion. Proof is plain unit and feature tests with exact
   assertions, plus a red→green runner that proves a new test fails before the fix and passes after (`node:test`
   built in; any other runner through a `proof.runners` entry that writes a JUnit report).
 

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 111,
+  "block_count": 128,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -1825,6 +1825,364 @@
         "B112"
       ],
       "note": "root-added 2026-10-13; bug; 226 orphan test workers drove load to 350-450 and broke the release test step"
+    },
+    "B99": {
+      "title": "Fix rounds check less: gates run --changed, {changed_files}",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "docs/reference/config.md",
+        "schema/code-forge.schema.json",
+        "skill/references/code.md",
+        "skill/references/proof.md",
+        "skill/templates/coder-brief.md",
+        "src/cli/gates.mjs",
+        "src/config/validate.mjs",
+        "src/gates/expand.mjs",
+        "src/gates/run.mjs",
+        "src/proof/lock.mjs",
+        "src/util/gate-token.mjs",
+        "test/gates/changed.test.mjs",
+        "test/gates/placeholders.test.mjs"
+      ],
+      "depends_on": [
+        "B113"
+      ],
+      "note": "root-added 2026-10-13; #16; owner D2=a: fix-round TESTS may use --changed, orchestrator runs full gates before close"
+    },
+    "B100": {
+      "title": "Overlap loop: review-file --wait-block, review.file_loop overlap",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "docs/reference/config.md",
+        "schema/code-forge.schema.json",
+        "skill/references/code.md",
+        "skill/templates/coder-brief.md",
+        "src/cli/review-file.mjs",
+        "src/config/validate.mjs",
+        "src/worker/queue.mjs",
+        "test/config/schema-coverage.test.mjs",
+        "test/worker/wait-block.test.mjs"
+      ],
+      "depends_on": [
+        "B99"
+      ],
+      "note": "run-speed E3a; round 1 approved, minors noted (wait-block test 2/4 assertions could be stricter)"
+    },
+    "B114": {
+      "title": "Stop with unknown content is no dead end (#17); TESTS line malformed",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "skill/references/code.md",
+        "skill/references/review.md",
+        "src/cli/block.mjs",
+        "src/review/fixloop.mjs",
+        "src/review/reopen.mjs",
+        "test/cli/block-tests-line.test.mjs",
+        "test/review/reopen-unknown.test.mjs",
+        "test/review/reopen.test.mjs"
+      ],
+      "depends_on": [
+        "B100"
+      ],
+      "note": "#17; round 1 approved; built in parallel with B115; minor noted: reopen row lost if worker crashes between round save and state save"
+    },
+    "B115": {
+      "title": "Small follow-ups: Python *_test.py pairing, npm test -- <args>, test cleanup errors",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "package.json",
+        "test/helpers/run-suite.sh",
+        "skill/references/review.md",
+        "src/review/paired.mjs",
+        "test/no-leak.test.mjs",
+        "test/no-leak-final.test.mjs",
+        "test/review/paired.test.mjs",
+        "test/router.test.mjs",
+        "test/worker/helper-cleanup.test.mjs",
+        "test/worker/helpers.mjs"
+      ],
+      "depends_on": [
+        "B114"
+      ],
+      "note": "owner 2026-10-13; 2 rounds; noted: 6 old test files call rm(undefined) in cleanup under --test-name-pattern (follow-up); no-leak-final pins report order only at beforeExit"
+    },
+    "B104": {
+      "title": "Commit watch: review.file_loop watch queues owned files from new commits",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "docs/reference/config.md",
+        "schema/code-forge.schema.json",
+        "skill/references/code.md",
+        "skill/references/review.md",
+        "skill/templates/coder-brief.md",
+        "src/config/validate.mjs",
+        "src/util/exec.mjs",
+        "src/worker/loop.mjs",
+        "src/worker/queue.mjs",
+        "src/worker/watch.mjs",
+        "test/skill/structure.test.mjs",
+        "test/worker/wait-block.test.mjs",
+        "test/worker/watch.test.mjs"
+      ],
+      "depends_on": [
+        "B115"
+      ],
+      "note": "3 rounds (r2 major fixed by the orchestrator with red→green); noted: activeTickets only from the scheduler pass; stop() during a watch tick still dispatches that pass; watch state reset after realpath; a file replaced by a directory stalls the watch after one skip row; enqueue passes the raw file to enqueueHash"
+    },
+    "B117": {
+      "title": "Proof rule in every context pack, review lens, skill and doc; red→green defined",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "docs/concepts.md",
+        "docs/how-it-works.md",
+        "docs/overview.md",
+        "docs/tutorial-first-test.md",
+        "skill/SKILL.md",
+        "skill/references/code.md",
+        "skill/references/proof.md",
+        "skill/references/rules-core.md",
+        "skill/templates/coder-brief.md",
+        "src/context/pack.mjs",
+        "src/install/wizard/flags.mjs",
+        "src/proof/rule.mjs",
+        "src/proof/tiers.mjs",
+        "src/review/gate-check.mjs",
+        "src/review/lenses/A.md",
+        "src/review/lenses/B.md",
+        "src/review/lenses/full.md",
+        "src/review/lenses/judge.md",
+        "src/review/lenses/quick.md",
+        "src/review/lenses/recheck.md",
+        "test/context/pack.test.mjs",
+        "test/proof/tiers.test.mjs",
+        "test/review/fixloop.test.mjs",
+        "test/review/packet.test.mjs",
+        "test/review/route.test.mjs",
+        "test/review/test-quality.test.mjs",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B104"
+      ],
+      "note": "owner 2026-10-13: pass the proof rule to every project built with code-forge; 1 round, 3 minors not-bug; removed dead proofRequirements (mutants: held)"
+    },
+    "B116": {
+      "title": "Test cleanup skips unset paths under --test-name-pattern (built with code-forge run)",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "test/config/cli-models.test.mjs",
+        "test/config/load.test.mjs",
+        "test/config/refresh.test.mjs",
+        "test/engines/isolation.test.mjs",
+        "test/ledger/outcome.test.mjs",
+        "test/skill/shim.test.mjs"
+      ],
+      "depends_on": [
+        "B117"
+      ],
+      "note": "dogfood: brief run, review.file_loop watch, worktree isolation; ~8 min wall; 0 findings"
+    },
+    "B118": {
+      "title": "Context pack without a context key; block open refuses whitespace paths that name no file; close warns without green gates",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "docs/brief-mode.md",
+        "skill/references/code.md",
+        "src/cli/block.mjs",
+        "src/cli/context.mjs",
+        "src/context/pack.mjs",
+        "test/cli/block-close-gates.test.mjs",
+        "test/cli/block-open-owned.test.mjs",
+        "test/context/pack.test.mjs",
+        "test/proof/worktree-flow.test.mjs"
+      ],
+      "depends_on": [
+        "B116"
+      ],
+      "note": "dogfood findings from B116, built with code-forge run; 0 review findings; the orchestrator updated the B62b malformed-record test for the new close warning"
+    },
+    "B119": {
+      "title": "Transcript grep reads Codex JSON logs by commands only; close names each rule break once",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/brief-mode.md",
+        "skill/references/code.md",
+        "src/review/gate-check.mjs",
+        "src/util/forbidden.mjs",
+        "test/cli/block-close-rule-break.test.mjs",
+        "test/review/external.test.mjs",
+        "test/util/transcript-codex.test.mjs"
+      ],
+      "depends_on": [
+        "B118"
+      ],
+      "note": "dogfood finding from B118, built with code-forge run; 1 review warning answered; named mutation (unknown item types fail closed) caught"
+    },
+    "B120": {
+      "title": "Plain gates runs with --run --block write their gate rows",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/proof/lock.mjs",
+        "test/cli/block-close-gates.test.mjs"
+      ],
+      "depends_on": [
+        "B119"
+      ],
+      "note": "dogfood finding from B119, built with code-forge run; 0 review findings; first dogfood close with no warning"
+    },
+    "B101": {
+      "title": "Opt-in fair share across blocks in the worker pool (review.fair_share)",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "docs/reference/config.md",
+        "schema/code-forge.schema.json",
+        "skill/references/review.md",
+        "src/worker/loop.mjs",
+        "test/config/schema-coverage.test.mjs",
+        "test/worker/fair-share.test.mjs"
+      ],
+      "depends_on": [
+        "B120"
+      ],
+      "note": "E4a; built with code-forge run; 0 review findings; the orchestrator re-pinned the schema path count (212 -> 213)"
+    },
+    "B105": {
+      "title": "Cross-process locks for ticket claims, files, blocks and the budget row (E4b part 1)",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "skill/references/review.md",
+        "src/autopilot/actions.mjs",
+        "src/doctor/index.mjs",
+        "src/doctor/local.mjs",
+        "src/ledger/spend.mjs",
+        "src/review/schema-fallback.mjs",
+        "src/util/file-locks.mjs",
+        "src/worker/engine.mjs",
+        "src/worker/loop.mjs",
+        "test/util/file-locks.test.mjs",
+        "test/worker/claim.test.mjs"
+      ],
+      "depends_on": [
+        "B101"
+      ],
+      "note": "attempt 1 refused at close (coder transcript read ~/.code-forge/runs); re-run clean; two stopped reviews reopened by the owner and approved"
+    },
+    "B121": {
+      "title": "Watch holds rechecks until the block join",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "docs/reference/config.md",
+        "schema/code-forge.schema.json",
+        "skill/references/code.md",
+        "skill/references/review.md",
+        "src/worker/watch.mjs",
+        "test/worker/watch.test.mjs"
+      ],
+      "depends_on": [
+        "B105"
+      ],
+      "note": "Watch mode queues a file's first commit at once; later commits of a file that already has a ticket are held (watch.held row) until review-file --wait-block queues one ticket for the latest content. Stops a half-done fix commit from using the file's review rounds."
+    },
+    "B106": {
+      "title": "Worker registry: one announcement per worker",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "skill/references/code.md",
+        "src/cli/review.mjs",
+        "src/doctor/local.mjs",
+        "src/doctor/worker-probe.mjs",
+        "src/worker/loop.mjs",
+        "src/worker/queue.mjs",
+        "test/worker/registry.test.mjs"
+      ],
+      "depends_on": [
+        "B105"
+      ],
+      "note": "Each worker writes <repo>/.code-forge/workers/<pid>-<start_time>.json next to worker.json and beats both; boot counts live entries and announces under one cross-process lock (limit 1); boot prunes dead entries (known start-time mismatch = dead); an unreadable entry blocks boot and doctor lists it; liveWorker keeps the B30 fresh-heartbeat rule."
+    },
+    "B122": {
+      "title": "Join delivers unseen findings before a recheck",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "skill/references/code.md",
+        "skill/references/review.md",
+        "src/cli/review-file.mjs",
+        "src/worker/queue.mjs",
+        "test/worker/wait-block.test.mjs"
+      ],
+      "depends_on": [
+        "B121"
+      ],
+      "note": "At review-file --wait-block, a file whose newest review found problems and that changed after it (a commit made blind to the findings) is not rechecked: the join answers status findings with that ticket and writes one delivered marker. The next join rechecks the latest content once. Stops a blind commit from counting as a stall round."
+    },
+    "B123": {
+      "title": "Reopen clears old cap ids after a fresh review",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/how-it-works.md",
+        "skill/references/review.md",
+        "src/review/gate-check.mjs",
+        "test/review/gate-check-reopen-cap.test.mjs"
+      ],
+      "depends_on": [
+        "B122"
+      ],
+      "note": "A review.cap row is superseded when a verified human review.reopened row comes after it and then a signed review.round of the file's current content. A superseded cap row adds no ids to the close check, so after a reopen only the fresh review's own findings need a fix, waiver or answer."
+    },
+    "B126": {
+      "title": "Leak test ignores files already in the repo's .code-forge",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "test/worker/orphan.test.mjs"
+      ],
+      "depends_on": [
+        "B113"
+      ],
+      "note": "The final-check test in orphan.test.mjs forged an empty baseline, so files already in the repo's .code-forge folder (normal when code-forge builds itself) showed up as leaks and failed npm test. The test now records the folder's current contents as the baseline and still checks the exact planted leak list."
     }
   }
 }

package/docs/reference/config.md

@@ -136,6 +136,8 @@ Every other key defaults as shown, or is entirely absent from a minimal file. `a
 | `review.provider_concurrency.openai` | integer |  | `2` | min 1 |
 | `review.provider_concurrency.xai` | integer |  | `2` | min 1 |
 | `review.parallel_tickets` | integer |  | `3` | min 1; max 16; B42: how many review tickets the worker runs at once (oldest first); 1 = one at a time. Tickets for the same file never overlap. |
+| `review.fair_share` | boolean |  | `false` | Give each free ticket slot to the block with the fewest running tickets; ties stay oldest first. |
+| `review.file_loop` | enum: `wait`, `overlap`, `watch` |  | `"wait"` | After each green file, enqueue its review. wait (default): wait for its ticket before the next file. overlap: continue coding, then run review-file --wait-block <id> --run <run> before the completion sentinel; inspect findings with --wait <ticket>. watch: commit each green file instead of running review-file. A file's first commit is queued at once. Later commits of a file that already has a ticket of this block are held (a watch.held row) until --wait-block, which queues the latest content once before the sentinel. Older pending tickets are still superseded. |
 | `review.external` | object |  | — |  |
 | `review.external.required` | boolean |  | `false` | B58: true ⇒ block close skips the local per-file review checks (and the --report ticket check), with no terminal and under autopilot, and writes a signed gate.reviews_waived {by: config} row. Unowned changes, proof, no_changes and the transcript grep still refuse. No block may own .code-forge.yml. |
 | `review.external.name` | string |  | — | minLength 1; B58: the outside reviewer, written in the review.external and gate.reviews_waived rows. Required when required is true: run start refuses a missing or blank name. |
@@ -149,15 +151,15 @@ Every other key defaults as shown, or is entirely absent from a minimal file. `a
 | `caps` | object |  | — |  |
 | `caps.coders` | integer |  | `2` | min 1 |
 | `gates` | object |  | — |  |
-| `gates.test` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. |
-| `gates.lint` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. |
-| `gates.types` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. |
-| `gates.format` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. |
+| `gates.test` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. With gates run --run --block --changed, {test_files} expands to changed tests plus stem-paired tests of changed sources, and {changed_files} expands to changed paths for lint or format. Both tokens must be whole argv items and cannot be the command or the only item. Config validation refuses a gate whose command or only item is {changed_files}. Deleted files count for pairing and the threshold, but both tokens receive only files that exist now. Without --changed, {changed_files} is dropped. Changed rows carry scope changed; narrowed rows have no reason. Only fallback rows carry a reason: no_baseline uses today's scope, unpaired uses today's test scope, threshold runs the full suite above the changed-file threshold, and no_changes uses today's scope when nothing is left to run. Gates without either token run unchanged. Any green gates run --run --block records owned file hashes on gate.done, including runs without --changed. When --slug is omitted, these rows go to the run's project ledger. More than 200 owned files means no record, so the next --changed falls back with no_baseline; unreadable inputs also leave no record. A fix-round TESTS line may use --changed; the orchestrator runs full gates before block close. |
+| `gates.lint` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. With gates run --run --block --changed, {test_files} expands to changed tests plus stem-paired tests of changed sources, and {changed_files} expands to changed paths for lint or format. Both tokens must be whole argv items and cannot be the command or the only item. Config validation refuses a gate whose command or only item is {changed_files}. Deleted files count for pairing and the threshold, but both tokens receive only files that exist now. Without --changed, {changed_files} is dropped. Changed rows carry scope changed; narrowed rows have no reason. Only fallback rows carry a reason: no_baseline uses today's scope, unpaired uses today's test scope, threshold runs the full suite above the changed-file threshold, and no_changes uses today's scope when nothing is left to run. Gates without either token run unchanged. Any green gates run --run --block records owned file hashes on gate.done, including runs without --changed. When --slug is omitted, these rows go to the run's project ledger. More than 200 owned files means no record, so the next --changed falls back with no_baseline; unreadable inputs also leave no record. A fix-round TESTS line may use --changed; the orchestrator runs full gates before block close. |
+| `gates.types` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. With gates run --run --block --changed, {test_files} expands to changed tests plus stem-paired tests of changed sources, and {changed_files} expands to changed paths for lint or format. Both tokens must be whole argv items and cannot be the command or the only item. Config validation refuses a gate whose command or only item is {changed_files}. Deleted files count for pairing and the threshold, but both tokens receive only files that exist now. Without --changed, {changed_files} is dropped. Changed rows carry scope changed; narrowed rows have no reason. Only fallback rows carry a reason: no_baseline uses today's scope, unpaired uses today's test scope, threshold runs the full suite above the changed-file threshold, and no_changes uses today's scope when nothing is left to run. Gates without either token run unchanged. Any green gates run --run --block records owned file hashes on gate.done, including runs without --changed. When --slug is omitted, these rows go to the run's project ledger. More than 200 owned files means no record, so the next --changed falls back with no_baseline; unreadable inputs also leave no record. A fix-round TESTS line may use --changed; the orchestrator runs full gates before block close. |
+| `gates.format` | array<string> \| object \| null |  | — | An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. With gates run --run --block --changed, {test_files} expands to changed tests plus stem-paired tests of changed sources, and {changed_files} expands to changed paths for lint or format. Both tokens must be whole argv items and cannot be the command or the only item. Config validation refuses a gate whose command or only item is {changed_files}. Deleted files count for pairing and the threshold, but both tokens receive only files that exist now. Without --changed, {changed_files} is dropped. Changed rows carry scope changed; narrowed rows have no reason. Only fallback rows carry a reason: no_baseline uses today's scope, unpaired uses today's test scope, threshold runs the full suite above the changed-file threshold, and no_changes uses today's scope when nothing is left to run. Gates without either token run unchanged. Any green gates run --run --block records owned file hashes on gate.done, including runs without --changed. When --slug is omitted, these rows go to the run's project ledger. More than 200 owned files means no record, so the next --changed falls back with no_baseline; unreadable inputs also leave no record. A fix-round TESTS line may use --changed; the orchestrator runs full gates before block close. |
 | `gates.extra` | object |  | — |  |
 | `gates.extra.secret_scan` | boolean |  | `true` |  |
 | `gates.extra.safe_edit` | boolean |  | `true` |  |
 | `gates.extra.invariants` | string |  | — |  |
-| `gates.full_suite_threshold_files` | integer |  | `10` | min 1; A block that owns more files than this runs the full suite for a {test_files} gate (reason threshold), not its related tests. Owned files are counted this way. A glob or a directory counts the tracked and new (not ignored) files it covers. A path not created yet counts as 1. Outside git each entry counts 1. A git failure runs the full suite. block open --tests names the test files precisely. |
+| `gates.full_suite_threshold_files` | integer |  | `10` | min 1; A block that owns more files than this runs the full suite for a {test_files} gate (reason threshold), not its related tests. Owned files are counted this way. A glob or a directory counts the tracked and new (not ignored) files it covers. A path not created yet counts as 1. Outside git each entry counts 1. A git failure runs the full suite. block open --tests names the test files precisely. With gates run --changed, the threshold counts changed files since the last green gates run --run --block instead. |
 | `proof` | object |  | — |  |
 | `proof.tiers` | object |  | — |  |
 | `proof.tiers.high` | object |  | — |  |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",
@@ -38,7 +38,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "export CODE_FORGE_TEST_SUITE=${CODE_FORGE_TEST_SUITE:-$(node -e 'process.stdout.write(require(\"node:crypto\").randomUUID())')}; CODE_FORGE_NO_LEAK=snapshot node --import ./test/helpers/isolate.mjs --test test/no-leak.test.mjs && { node --import ./test/helpers/isolate.mjs --experimental-test-module-mocks --test 'test/**/*.test.mjs'; cf_test_status=$?; CODE_FORGE_NO_LEAK=final node --import ./test/helpers/isolate.mjs --test test/no-leak.test.mjs; cf_leak_status=$?; [ \"$cf_test_status\" -eq 0 ] && [ \"$cf_leak_status\" -eq 0 ]; }",
+    "test": "sh test/helpers/run-suite.sh",
     "typecheck": "tsc --checkJs --noEmit",
     "release": "node scripts/release.mjs",
     "changelog": "node scripts/changelog.mjs",

package/schema/code-forge.schema.json

@@ -185,6 +185,8 @@
           }
         },
         "parallel_tickets": { "type": "integer", "minimum": 1, "maximum": 16, "default": 3, "description": "B42: how many review tickets the worker runs at once (oldest first); 1 = one at a time. Tickets for the same file never overlap." },
+        "fair_share": { "type": "boolean", "default": false, "description": "Give each free ticket slot to the block with the fewest running tickets; ties stay oldest first." },
+        "file_loop": { "type": "string", "enum": ["wait", "overlap", "watch"], "default": "wait", "description": "After each green file, enqueue its review. wait (default): wait for its ticket before the next file. overlap: continue coding, then run review-file --wait-block <id> --run <run> before the completion sentinel; inspect findings with --wait <ticket>. watch: commit each green file instead of running review-file. A file's first commit is queued at once. Later commits of a file that already has a ticket of this block are held (a watch.held row) until --wait-block, which queues the latest content once before the sentinel. Older pending tickets are still superseded." },
         "external": {
           "type": "object",
           "additionalProperties": false,
@@ -240,7 +242,7 @@
           "type": "integer",
           "minimum": 1,
           "default": 10,
-          "description": "A block that owns more files than this runs the full suite for a {test_files} gate (reason threshold), not its related tests. Owned files are counted this way. A glob or a directory counts the tracked and new (not ignored) files it covers. A path not created yet counts as 1. Outside git each entry counts 1. A git failure runs the full suite. block open --tests names the test files precisely."
+          "description": "A block that owns more files than this runs the full suite for a {test_files} gate (reason threshold), not its related tests. Owned files are counted this way. A glob or a directory counts the tracked and new (not ignored) files it covers. A path not created yet counts as 1. Outside git each entry counts 1. A git failure runs the full suite. block open --tests names the test files precisely. With gates run --changed, the threshold counts changed files since the last green gates run --run --block instead."
         }
       }
     },
@@ -511,7 +513,7 @@
       }
     },
     "argvOrNull": {
-      "description": "An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason.",
+      "description": "An argv array (never a shell string), an {argv, env} object, or null. An argv item that is exactly {test_files} is replaced by the block's test files. It must be a whole item. It cannot be the command or the only item. The test files are the block open --tests paths, else the owned entries that are concrete test files. The item is dropped, and the full suite runs, in two cases. The block owns more files than full_suite_threshold_files (reason threshold). Or no test file is known, or the gate runs without --run/--block (reason no_tests). The gate.red and gate.done rows then carry scope related with test_count, or scope full with reason. With gates run --run --block --changed, {test_files} expands to changed tests plus stem-paired tests of changed sources, and {changed_files} expands to changed paths for lint or format. Both tokens must be whole argv items and cannot be the command or the only item. Config validation refuses a gate whose command or only item is {changed_files}. Deleted files count for pairing and the threshold, but both tokens receive only files that exist now. Without --changed, {changed_files} is dropped. Changed rows carry scope changed; narrowed rows have no reason. Only fallback rows carry a reason: no_baseline uses today's scope, unpaired uses today's test scope, threshold runs the full suite above the changed-file threshold, and no_changes uses today's scope when nothing is left to run. Gates without either token run unchanged. Any green gates run --run --block records owned file hashes on gate.done, including runs without --changed. When --slug is omitted, these rows go to the run's project ledger. More than 200 owned files means no record, so the next --changed falls back with no_baseline; unreadable inputs also leave no record. A fix-round TESTS line may use --changed; the orchestrator runs full gates before block close.",
       "anyOf": [
         { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
         {

package/skill/SKILL.md

@@ -64,6 +64,8 @@ State lives in the plan file's header — `facts → planned → hardened → co
 - **R16** Proof is exact assertions on the main behaviour
 - **R17** Never relax a rule alone
 
+Red→green means an assertion failure on old code, then a pass on new code; no hand mutations; proof scales with risk; no extras beyond acceptance (R16).
+
 ## §5 Where to read more
 
 | when | read |