@codedology/code-forge 0.6.2 → 0.7.1

package/CHANGELOG.md

@@ -6,6 +6,40 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.7.1] — 2026-10-07
+
+### Fixed
+
+- A structured clean pass (passed: true, no findings, every hunk acknowledged, a non-blank summary) is no longer refused
+  as too_short on a larger diff: it needs 40 output tokens whatever the diff size (clean passes measured 108-121 tokens;
+  issue #6). An answer with any finding, or a blank summary, keeps review.min_tokens_out.
+
+## [0.7.0] — 2026-10-07
+
+### Fixed
+
+- block close checked no file at all when the block's owned_files were directories, or when the coder's work was
+  committed before block open or done in another worktree, and then closed with findings open. The gate's file set is
+  now the owned diff plus every owned file with review rows for the block, an owned entry with no glob owns the paths
+  below it, an empty diff with review rows prints a WARN naming the likely cause, and a block with no such file refuses
+  no_changes.
+- block close no longer passes a file whose approval a later review of the same content overrode: it refuses
+  not_approved <file> <finding> per open finding until the file is fixed and approved again or the finding is waived (a
+  critical only by the human's block waive; the severity the review recorded decides). The ledger review.result row now
+  carries approved and every open finding with its worst severity (a finding without a valid id as X<n>); an
+  "approved" result that lists a critical is recorded as not approved. An old ledger's review.result row is judged by
+  the ticket's signed result file, and refuses when that file is missing or fails its MAC. Triage never turns a
+  critical finding into a nit, a late-finding ruling clears only a warning or nit ruled nit, and review_cap stands
+  unless an approval of the current content comes after it.
+
+### Security
+
+- block close refuses unowned_change <file> for a file outside the block's owned files that changed after block open
+  (block open now records the tree) and that no other block of the run accounts for; it used to drop such a file from
+  the gate silently. Only .code-forge/ is exempt, and a file an open sibling block owns gets a WARN line naming it.
+  --no-require-reviews now needs the owner to confirm at a terminal: it has no --yes, exits 2 without
+  a terminal and is refused while an autopilot grant is active.
+
 ## [0.6.2] — 2026-10-07
 
 ### Changed

package/README.md

@@ -8,6 +8,22 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 > `examples/` have all landed (`docs/reference/blocks.json` lists every build block). What changed
 > in each version is in [CHANGELOG.md](CHANGELOG.md).
 
+## What's new in 0.7
+
+Next release:
+
+- **Short clean reviews count.** A clean pass (no findings, every hunk acknowledged, a summary)
+  needs only 40 output tokens on any diff size, so a correct short "no defect" review is no
+  longer refused as `too_short`.
+
+In 0.7.0:
+
+- **The close gate now checks every file.** `block close` could close a block with critical
+  findings still open: files inside an owned folder were skipped, and so was work committed
+  before `block open` or done in another worktree. Now every reviewed file is checked, a newer
+  failed review beats an older approval, a critical needs your waiver, a change outside the
+  block's files is refused, and `--no-require-reviews` asks you at a terminal.
+
 ## What's new in 0.6
 
 In 0.6.1:

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 54,
+  "block_count": 56,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -732,6 +732,36 @@
         "B49b"
       ],
       "note": "root-added 2026-10-06; also amends skill/SKILL.md, skill/references/{autopilot,decisions,ledger}.md, README.md, docs/*"
+    },
+    "B52": {
+      "title": "Block close gate hardening (issue #2 field note: a block closed with open criticals): the file set is the diff since base plus every file with a review row of the block, matched against owned paths including directories; an approval is stale after a later non-approved review of the same content; not_approved per open finding (a critical needs a human waiver); old-ledger rows judged by the signed result file; no_changes for an empty set; unowned_change for files changed after open outside owned paths (tree_at_open stamps); triage never demotes a critical; --no-require-reviews needs the owner at a terminal",
+      "wave": 12,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/review/gate-check.mjs",
+        "src/cli/block.mjs",
+        "test/review/close-gate.test.mjs",
+        "test/review/close-gate-field.test.mjs"
+      ],
+      "depends_on": [
+        "B50"
+      ],
+      "note": "root-added 2026-10-07; GitHub issue #2 field note 2026-10-07; also amends src/state/block.mjs, src/review/triage.mjs, src/worker/loop.mjs, skill/SKILL.md, skill/references/{code,review,decisions}.md, skill/references/adapters/{claude-code,solo}.md, docs/how-it-works.md, docs/tutorial-first-test.md, docs/concepts.md"
+    },
+    "B53": {
+      "title": "Clean-pass token floor for any diff size (issue #6): a structured clean pass (passed: true, no findings, hunks acknowledged in order, a non-blank summary) needs min(review.min_tokens_out, 40) output tokens; any finding, passed: false or a blank summary keeps the full floor",
+      "wave": 12,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/review/validate-review.mjs",
+        "test/review/validate-review.test.mjs"
+      ],
+      "depends_on": [
+        "B52"
+      ],
+      "note": "root-added 2026-10-07; GitHub issue #6; also amends src/review/engine.mjs (smallDiff removed), schema/code-forge.schema.json, docs/reference/config.md, docs/how-it-works.md, skill/references/review.md"
     }
   }
 }

package/docs/reference/config.md

@@ -105,7 +105,7 @@ Every other key defaults as shown, or is entirely absent from a minimal file. `a
 | `review.context.min_context_lines` | integer |  | `10` | min 0 |
 | `review.block_budget_tokens` | integer |  | `150000` | min 1 |
 | `review.block_budget_usd` | number \| null |  | `null` |  |
-| `review.min_tokens_out` | integer |  | `120` | min 1 |
+| `review.min_tokens_out` | integer |  | `120` | min 1; The stub guard: a review answer with fewer output tokens is unavailable (too_short). A clean pass (passed: true, no findings, a non-blank summary) needs only min(this, 40), whatever the diff size (B53). |
 | `review.batch_small_files` | boolean |  | `true` |  |
 | `review.session_timeout_s` | integer |  | `300` | min 1 |
 | `review.max_rounds_per_file` | integer |  | `4` | min 2; max 6 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",

package/schema/code-forge.schema.json

@@ -136,7 +136,7 @@
           "anyOf": [{ "type": "number", "exclusiveMinimum": 0 }, { "type": "null" }],
           "default": null
         },
-        "min_tokens_out": { "type": "integer", "minimum": 1, "default": 120 },
+        "min_tokens_out": { "type": "integer", "minimum": 1, "default": 120, "description": "The stub guard: a review answer with fewer output tokens is unavailable (too_short). A clean pass (passed: true, no findings, a non-blank summary) needs only min(this, 40), whatever the diff size (B53)." },
         "batch_small_files": { "type": "boolean", "default": true },
         "session_timeout_s": { "type": "integer", "minimum": 1, "default": 300 },
         "max_rounds_per_file": { "type": "integer", "minimum": 2, "maximum": 6, "default": 4 },

package/skill/SKILL.md

@@ -41,7 +41,7 @@ State lives in the plan file's header — `facts → planned → hardened → co
 4. Per block, in dispatch order, never more than `caps.coders` alive: `forge block open <id> --run <r> --level L<n> --owned <paths…> --acceptance <file> --brief <file> --lines <n> [--kind code|docs|contract]` prints the pointer `BRIEF <path> lines=<n> sha=<sha8> <<<EOM>>>`. Send the pointer per the engine's adapter — `solo` → `references/adapters/solo.md`, `harness` → `references/adapters/claude-code.md`, `subprocess` → `references/adapters/subprocess.md` — and wait for `ACK <sha8> lines=<n>`.
 5. The coder's first message is its **facts diff**, then its forecast (cases and lines, `templates/block-record.md`), then code, file by file: after each file `forge review-file <path> --block <id> --run <r>`, then `forge review-file --wait <ticket>` before the next file. Rounds ≥ 2 re-check only the fix hunks (`references/review.md`).
 6. `===BLOCK <id> COMPLETE===` or `===BLOCK <id> FAILED: <reason>===` ends the coder's turn. Its report is a claim sheet: re-measure it (`references/code.md` §5).
-7. `forge block close <id> --run <r> --report <coder report>` is the gate: a report without a `reviewed <path> ticket <id>` line per changed file is FAILED; a signed `review.approved` row per changed file, gates green, every clause covered, forecast vs actual, no `rule_break`. Red ⇒ `references/decisions.md` (S1 `next`, escalation). Green ⇒ one commit for the block in the project's house style; `forge block rebase <id> --run <r>` first when HEAD moved.
+7. `forge block close <id> --run <r> --report <coder report>` is the gate: a report without a `reviewed <path> ticket <id>` line per changed file is FAILED; a signed `review.approved` row per changed file that no later review of the same content overrode (`not_approved`), no `unowned_change`, no `no_changes` (the files are the owned diff plus every owned file reviewed for the block), gates green, every clause covered, forecast vs actual, no `rule_break`. Red ⇒ `references/decisions.md` (S1 `next`, escalation). Green ⇒ one commit for the block in the project's house style; `forge block rebase <id> --run <r>` first when HEAD moved.
 8. `forge run end --run <r>` when every block is `done`; `forge report --slug <slug>` prints cost per block, escalations, review rounds and the spend per run (`budget.usd`, `references/ledger.md` §3.1).
 
 ## §4 Hard rules (the headings of `references/rules-core.md`)

package/skill/references/adapters/claude-code.md

@@ -12,7 +12,7 @@ The harness's `Agent` tool runs the coder as a subagent; everything else — the
 
 The tool return is the completion signal; the report must begin with `ACK <sha8>` and end with `===BLOCK <id> COMPLETE===` (+ test summary + `git diff --stat`) or `===BLOCK <id> FAILED: <reason>===`. A report without the sentinel is a failed block, never a partial success.
 
-**Between completion and close come the review rounds.** The subagent ran `forge review-file <path> --block <id> --run <r>` per file and `--wait`ed on each ticket inside its turn, so most rounds happen before the sentinel; when the tool returns, first drain every `pending` ticket with `forge review-file --wait <ticket>` yourself — a pending ticket is a review in flight, not an open finding, and waiting on it costs no round. Then only an open `fix_now` finding, or a file the coder never submitted, starts a fix round (each one counts toward the file's cap): dispatch a new `Agent` call at the level the ladder says (`review.md` §5 — the coder is gone with its tool return, so the fix brief carries the open findings and the fix history) and it runs `review-file` again on the fixed file. Rounds are bounded: four rounds per file, then the L3 rung once, then `stopped: review_cap` for the human. Only when every changed file has a signed `review.approved` row do you run the re-measurement of `code.md` §5 and `forge block close <id> --run <r> --report <file>` (the subagent's final report, saved to a file) — the transcript grep reads `.code-forge/runs/<run>/<block>.log`; pass `--transcript <file>` when the harness saved the subagent's transcript elsewhere. Closing with a file still unreviewed is a human decision: `forge block waive <id> <finding> --run <r> --file <path> --reason "<why>"` per finding, or `forge block close … --no-require-reviews`, both audited as their own rows.
+**Between completion and close come the review rounds.** The subagent ran `forge review-file <path> --block <id> --run <r>` per file and `--wait`ed on each ticket inside its turn, so most rounds happen before the sentinel; when the tool returns, first drain every `pending` ticket with `forge review-file --wait <ticket>` yourself — a pending ticket is a review in flight, not an open finding, and waiting on it costs no round. Then only an open `fix_now` finding, or a file the coder never submitted, starts a fix round (each one counts toward the file's cap): dispatch a new `Agent` call at the level the ladder says (`review.md` §5 — the coder is gone with its tool return, so the fix brief carries the open findings and the fix history) and it runs `review-file` again on the fixed file. Rounds are bounded: four rounds per file, then the L3 rung once, then `stopped: review_cap` for the human. Only when every changed file has a signed `review.approved` row do you run the re-measurement of `code.md` §5 and `forge block close <id> --run <r> --report <file>` (the subagent's final report, saved to a file) — the transcript grep reads `.code-forge/runs/<run>/<block>.log`; pass `--transcript <file>` when the harness saved the subagent's transcript elsewhere. Closing with a file still unreviewed is a human decision: `forge block waive <id> <finding> --run <r> --file <path> --reason "<why>"` per finding, or `forge block close … --no-require-reviews`, which the human runs at their own terminal (it asks for a yes, has no `--yes`, and is refused under an active autopilot grant), both audited as their own rows.
 
 ## §2.1 Plan approval
 

package/skill/references/adapters/solo.md

@@ -22,7 +22,7 @@ Solo adds spawn, watch, timers, scratchpads, locks and `kv` on top of the CLI; i
 5. **Wake channels, event-driven, never fixed polls:** record your own pid once (`whoami` → `kv_set("forge:orchestrator_pid")`); coders that can call Solo carry the push contract (post-sentinel `kv_set("block:<id>", …)` + `timer_set(1s, body, delivery_process_id=<your pid>)`); for every group arm `timer_fire_when_idle_any([coders], max_wait≈20–25 min, delivery_process_id=<your pid>)` right after the launch gate (idle-any ignores already-idle processes, so arm while they are provably running); keep one long dead-man fallback per 30–40 min with an L0 triage first. On wake: sentinel ⇒ gate; no sentinel and active again ⇒ re-arm; no sentinel and idle ⇒ parked, intervene now.
 6. Completion = `search_output(pattern="===BLOCK <id> COMPLETE===")`, last occurrence (the `kv` key is the truncation backup). Completion is not closure.
 7. **Review rounds, with the coder still alive.** The coder ran `forge review-file <path> --block <id> --run <r>` per file and `--wait`ed on each ticket; read the ledger (`forge ledger tail --slug <slug>`) for what is still open — a `fix_now` finding, a `pending` ticket, a file never submitted. Each open finding is a fix round sent to the **warm coder** by `send_input` (the findings by id, `<<<EOM>>>`), which fixes and re-runs `review-file` on that file; round ≥ 2 re-checks only the fix hunks (`review.md` §5). **One ladder** (`decisions.md` §5): a stall or exhausted rounds *below L2* climbs one level — close this coder and respawn a fresh one at the higher level with the open findings and the fix history in its brief; **the respawn keeps the per-file round count**, the cap does not reset. L2 is the highest running level: a trigger at L2, or the four-round cap on a file, goes to the **L3 rung once** — a fresh L3 patch session, never this coder and never a coder at L3 — and if findings stay open after the `patch_check` round the file is `stopped: review_cap` for the human. No other path exists.
-8. **Close** only when every changed file has a signed `review.approved` row: the re-measurement of `code.md` §5, then `forge block close <id> --run <r> --report <file>` (the coder's final report) — the transcript grep reads the Solo output. Closing with a file still unreviewed is a human decision, audited: `forge block waive <id> <finding> --run <r> --file <path> --reason "<why>"` per finding, or `forge block close … --no-require-reviews`.
+8. **Close** only when every changed file has a signed `review.approved` row: the re-measurement of `code.md` §5, then `forge block close <id> --run <r> --report <file>` (the coder's final report) — the transcript grep reads the Solo output. Closing with a file still unreviewed is a human decision, audited: `forge block waive <id> <finding> --run <r> --file <path> --reason "<why>"` per finding, or `forge block close … --no-require-reviews`, which the human runs at their own terminal (it asks for a yes, has no `--yes`, and is refused under an active autopilot grant).
 9. **Reap after the close**: `close_process` the coder and confirm `lock_status` shows no lease before the next group. Locks: a coder that can call Solo holds `lock_acquire` on its file area while editing; coders that cannot never overlap another block.
 
 ## §4 Latency overlaps (standing)

package/skill/references/code.md

@@ -30,8 +30,8 @@ The coder's report is a claim sheet. The gate reproduces each number in the meas
 
 | claim | re-measured by |
 |---|---|
-| only owned paths touched | file set = tracked changes ∪ untracked, minus other active blocks' owned sets ⊆ `owned_files`; anything else is an orphan that stops every gate until `forge block claim <id> <path> --run <r>` or the human deletes it |
-| every file reviewed | the report names a `review-file` ticket id per changed file (`--report`, which the orchestrator always passes) and a **signed** `review.approved` row for the current content hash of every changed or new file, or an architect-ruled disposition to a named successor block |
+| only owned paths touched | file set = tracked changes since the base ∪ untracked (not ignored), listed from the repository top level, outside the repository top-level `.code-forge/` (keep transcripts and reports there; a subdirectory workspace's own `.code-forge/` is source tree except this run's record mirror and the block's default transcript: a `--transcript` or `--report` path in the source tree is a change like any other); each file must be in `owned_files`, unchanged since `block open` recorded the tree (`tree_at_open`; a path unreadable at open or at close never counts as unchanged), owned by another block of the run that is still **open**, or a closed block's file still exactly at the content its gate approved — else `unowned_change <file>` until `forge block claim <id> <path> --run <r>` or the human puts it back (not lifted by `--no-require-reviews`). The gate cannot tell which coder wrote a file an open sibling owns: it passes it to that sibling's gate and prints `WARN block <id>: <file> changed and is owned by open block <other>` for each one — read those lines |
+| every file reviewed | file set = owned files changed since the base ∪ owned files with any review row of the block (`review.result`/`round`/`approved`/`triage`/`cap`/`late_finding`), an owned entry with no glob covering the paths below it; every path is repo-root-relative (what the worker signs), and an owned entry also matches relative to a workspace in a subdirectory; an empty set refuses `no_changes` (only the owner's `--no-require-reviews`, confirmed at a terminal, lifts it), and an empty diff with review rows WARNs (work committed before `block open`, or in another worktree — open blocks on a base without the work, in the workspace the coder edits). The report names a `review-file` ticket id per changed file (`--report`, which the orchestrator always passes) and a **signed** `review.approved` row for the current content hash of every changed or new file that no later review of the same content overrode (a `review.result` with `approved: false`, a `review.round` with findings open, a `review.cap`): else `not_approved <file> <finding>` per open finding, cleared only by a fix and a fresh approval or a waiver — a critical only by the human's `block waive` — or an architect-ruled disposition to a named successor block |
 | tests green | every gate command run once in the export, each exit status read |
 | clauses covered | every clause names ≥ 1 test id; each test exists and passed in this run; S1 `scope` on the hunks outside the named tests says `false` |
 | test count | the filtered run's delta equals the new tests' own count |
@@ -39,9 +39,9 @@ The coder's report is a claim sheet. The gate reproduces each number in the meas
 | no rule break | the transcript grep for forbidden verbs and paths (`--transcript <file>`, else the run record's log); a missing transcript ⇒ a signed `gate.transcript_missing` row and a WARN, never silence |
 | high tier proven | every changed high-tier file (`proof.md` §1) has a signed, proven red→green row with `red_kind: assertion` for this block whose `covers` names it (light tier: optional), else `unproven <file>`; only the human's `block waive <id> proof --file <path>` clears it |
 | rows genuine | the MAC of every gate-relevant row verifies; the live worker matches the pinned pid |
-| nothing left open | no unruled `late_findings`; no file at `review_cap` without a signed `review.waived` row |
+| nothing left open | no unruled `late_findings` (a ruling clears only a warning or nit ruled `nit`; a critical late finding needs the human's waiver); no file at `review_cap` without a signed `review.waived` row |
 
-`--no-require-reviews` is the human's way out, written as its own audit row; the orchestrator runs it only after the human said so in chat. A finding counts only under the gate's own configuration; a tautology (an expected value computed by the code under test) is a finding. Reproduce disclosures: a coder that reports its own rule break did the hard part.
+`--no-require-reviews` is the human's way out, written as its own audit row. The human runs it themselves at a terminal: it asks for a yes, has no `--yes`, exits 2 unless stdin and stdout are both terminals, lifts `no_changes` and is refused while an autopilot grant is active — so never run it for them; tell them the command when they say so in chat. A finding counts only under the gate's own configuration; a tautology (an expected value computed by the code under test) is a finding. Reproduce disclosures: a coder that reports its own rule break did the hard part.
 
 ## §6 Budget — the stop is the feature (R6)
 

package/skill/references/decisions.md

@@ -50,6 +50,6 @@ A fresh L3 session receives the failure evidence — the last attempt's diff, th
 
 ## §7 What reaches the human
 
-`next = stop`, `review.over_budget`, an orphan file, `worker_down`, `review_cap`, `redecompose`, `ask_human`, a security question, consensus unavailable, and one budget raise per run. Everything else is decided by S1, S2 or the rules above and recorded. A change to a rule, limit or check is never decided here: it always reaches the owner (`rules-core.md` R17).
+`next = stop`, `review.over_budget`, an orphan file or `unowned_change`, a `not_approved` critical finding, `--no-require-reviews`, `worker_down`, `review_cap`, `redecompose`, `ask_human`, a security question, consensus unavailable, and one budget raise per run. Everything else is decided by S1, S2 or the rules above and recorded. A change to a rule, limit or check is never decided here: it always reaches the owner (`rules-core.md` R17).
 
 **Autopilot:** while a grant is active, a warning or nit waiver, one extra round at `review_cap` and a coder level go first to the delegate (`forge autopilot ask`, then `forge autopilot waive|round|level --decision <id>` only when it acted, `autopilot.md` §2). Never delegated: `next = stop`, `ask_human`, a security question, a critical finding, a budget raise, `redecompose` — they wait for the owner (`autopilot.md` §5).

package/skill/references/review.md

@@ -11,7 +11,7 @@ The topology is decided in one place (`planSessions`). Consensus (§6) runs only
 1. Tools on the file first: lint, types, the file's own tests. Red ⇒ `tools_red` back to the coder, no model review, ledger `gate.red`.
 2. S1 `risk` (path floors first; `confidence < check` ⇒ S2 picks the depth).
 3. Planned depth: `risk < 1` ⇒ one L2 `quick` · `1 ≤ risk < 2`, or `risk ≤ review.single_reviewer_max_risk` ⇒ one L2 `full`, no judge · otherwise two blind L2 sessions (lens A correctness, lens B contracts and security) plus an L3 judge that reads the two reports — and the diff only when `review.judge_sees_diff` is true.
-4. Triage: findings from a single L2 session go to S1 `defect` (`thresholds.findings.fix` fix now · mid-band batched to one L3 ruling per file · below `thresholds.findings.nit` a nit). Findings that come from a judge are final.
+4. Triage: findings from a single L2 session go to S1 `defect` (`thresholds.findings.fix` fix now · mid-band batched to one L3 ruling per file · below `thresholds.findings.nit` a nit). A `critical` finding is always fix now — neither S1 nor the L3 ruling makes it a nit. Findings that come from a judge are final.
 
 ## §3 Isolation and the packet
 
@@ -19,7 +19,7 @@ Every reviewer, recheck, judge and S2 session runs with cwd = a fresh empty temp
 
 ## §4 The stub guard — what counts as a review (R11)
 
-A result is a review only if the process exited 0, the JSON validates against the finding schema, `reviewed_hunks` equals the packet's hunk headers exactly and in order, and the output has at least `review.min_tokens_out` tokens. Anything else is ledger `review.unavailable` (`exit`, `schema`, `hunks_mismatch`, `too_short`, `timeout`, `budget` — the run reached `budget.usd`, `ledger.md` §3.1) and **is not approval**; the worker retries once on the level's fallback, then the file stays unreviewed and the block cannot close. A session that hangs is killed at `review.session_timeout_s` (default 300), process group and all, and is spawned once more on the same packet and level; only a second timeout is `unavailable: timeout`. Each timed-out attempt leaves a `review.session_timeout` ledger note with the last 4 KB of its stderr (redacted, never the packet) and only the byte count and last event types of its stdout.
+A result is a review only if the process exited 0, the JSON validates against the finding schema, `reviewed_hunks` equals the packet's hunk headers exactly and in order, and the output has at least `review.min_tokens_out` tokens (a clean pass — `passed: true`, no findings, a non-blank summary — needs only 40, whatever the diff size). Anything else is ledger `review.unavailable` (`exit`, `schema`, `hunks_mismatch`, `too_short`, `timeout`, `budget` — the run reached `budget.usd`, `ledger.md` §3.1) and **is not approval**; the worker retries once on the level's fallback, then the file stays unreviewed and the block cannot close. A session that hangs is killed at `review.session_timeout_s` (default 300), process group and all, and is spawned once more on the same packet and level; only a second timeout is `unavailable: timeout`. Each timed-out attempt leaves a `review.session_timeout` ledger note with the last 4 KB of its stderr (redacted, never the packet) and only the byte count and last event types of its stdout.
 
 ## §5 The convergence rule — bounded fix rounds (R15)
 
@@ -31,7 +31,7 @@ Per file, per block:
 3a. **Heavy rounds climb at once** (`review_warnings`, `decisions.md` §5 rule 3a): below L2, a round — round 1 included — that leaves ≥ `escalation.warning_threshold` (2) warnings or any `critical` open, `escalation.after_rounds_with_warnings` (1) times at the current level, climbs one level for the next fix. One round with a stronger model is faster and cheaper than three with a cheap one. The per-file cap (step 5) stays the outer limit.
 4. **Ladder**: the running ceiling is `min(L2, escalation.stop_at)` — L3 is never a *running* level. A trigger — rule 1 (`retries`), rule 2 (`escalation.review_rounds_per_level` exhausted with an open `fix_now`), rule 2b (`review_stall`) or step 3a (`review_warnings`) — below the ceiling climbs one level, coded by a fresh session with the open findings and the fix history in its brief (an L1 block's rounds 3–4 run at L2). At the ceiling — an L2 block, or an L1 block that has climbed to L2 — it takes the **L3 rung**: a patch ≤ 80 lines, owned files only, reviewed as a `patch_check` round outside the cap. Under `escalation.l3_mode: code` (opt-in) the rung is instead one L3 coding turn. Either way the rung fires **once per block** and the same post-patch order follows it. After it, in order: `patch_check` clean ⇒ complete; open set not smaller than before the patch ⇒ `stopped: l3_patch_exhausted` (`review_stall`); round ≥ `review.max_rounds_per_file` ⇒ `stopped: review_cap`; otherwise the fixes continue at L2 with `rounds_at_level` reset and the patch in the brief. Any later trigger in that block stops with its named reason (`l3_patch_exhausted`, `review_cap`) and never patches again.
 5. **Cap — four rounds per file** (`review.max_rounds_per_file`, default 4, range 2–6). Round 4 still open ⇒ the L3 rung if the block has not used it (same post-patch order as step 4), else `stopped: review_cap`. A stop means the block cannot close, the ledger lists the open findings, and the human decides — fix by hand, `forge block waive <id> <finding-id> --run <r> --file <path> --reason <text>` (a signed `review.waived` row, `by: human`), or re-decompose. The coder never sees a `waive` verb; it is on the forbidden list. **Autopilot:** under a grant, a warning or nit finding may be waived by the delegate (`forge autopilot waive … --decision <id>`, written `by: autopilot`) and a file at the cap may get one extra round (`forge autopilot round`); a critical or proof waiver is never delegated (`autopilot.md`).
-6. **Block-close sweep**: `forge block close` batches the `late_findings` per file to one L3 judge ruling (`fix_now | nit`); a `fix_now` opens a round on that file at the block's current level and counts toward its cap.
+6. **Block-close sweep**: `forge block close` batches the `late_findings` per file to one L3 judge ruling (`fix_now | nit`); a `fix_now` opens a round on that file at the block's current level and counts toward its cap. The gate counts a ruling only when it is `nit` on a warning or nit finding; a critical late finding stays open until the human waives it.
 7. Ledger: one `review.round` row per round with `open_before`, `closed`, `new_in_hunks`, `late`, `open_after`; `forge report` prints rounds per file and rounds that stalled.
 
 Rechecks are never degraded by the budget: a round-2+ packet is already the minimum.

package/skill/scripts/forge

@@ -10,7 +10,7 @@
 #      copied install with no package next to it); `test/skill/shim.test.mjs` asserts the pin
 #      equals package.json's version.
 # The shim holds no logic of its own: every verb, flag and message is the CLI's.
-PINNED_VERSION="0.6.2"
+PINNED_VERSION="0.7.1"
 set -eu
 
 self="$0"

package/src/cli/block.mjs

@@ -13,9 +13,26 @@
  *
  * `block close [--transcript <file>] [--report <file>] [--no-require-reviews]` also runs B12b's review rows
  * (`review/gate-check.mjs`): a signed `review.approved` row for the current content hash of every
- * changed owned file (deletions included) — `--no-require-reviews` is the human's way out, is
- * forbidden to coders (`mergeForbidden`), and leaves a signed `gate.reviews_waived {by: human}`
- * row before the close (never a silent skip); late findings ruled; `review_cap` findings waived; no
+ * changed owned file (deletions included) that no later review of the same content made stale
+ * (B52: `not_approved <file> <finding>` per open finding of that later review, unless waived — a
+ * critical only by the human's `block waive`) — `--no-require-reviews` is the human's way out, is
+ * forbidden to coders (`mergeForbidden`), needs the human to confirm at a terminal (B52: stdin
+ * or stdout not a TTY ⇒ exit 2, an active autopilot grant ⇒ refused, there is no `--yes`; a block
+ * that is not open is refused first, exactly as without the flag), lifts `no_changes`, and leaves a signed
+ * `gate.reviews_waived {by: human}` row before the close (never a silent skip; a declined prompt
+ * prints `block <id> close: cancelled …`). B52: a changed or new file no block of the run
+ * accounts for is `unowned_change <file>` (`unownedChanges`, listed from the repository top
+ * level; not lifted by `--no-require-reviews`; only the repository top-level `.code-forge/` is
+ * exempt — plus, for a workspace in a subdirectory, this run's record mirror and this block's
+ * default transcript there — never a `--transcript` or `--report` path in the source tree; a
+ * closed block's file still exactly at the content its gate approved is accounted for); a file another OPEN block of the run owns
+ * is left to that block's gate with one `WARN` line per file (the close cannot tell which coder
+ * wrote it); an old ledger's `review.result` rows are judged by their signed result files
+ * (`resultFilesFor`). B52 (field run): the file set is the diff since base ∪ every owned file
+ * with review rows of the block (`reviewedFiles`; an owned entry with no glob owns the paths below
+ * it, `ownsAt`), so work committed before `block open` or done in another worktree is still
+ * checked (with a WARN naming the likely cause when the diff shows none of it); an empty set is
+ * `no_changes`; late findings ruled; `review_cap` findings waived; no
  * `rule_break`, plus the transcript grep. The transcript is `--transcript`, else the block's
  * `transcript` in the run record, else `.code-forge/runs/<run>/<block>.log`; none ⇒ a signed
  * `gate.transcript_missing` row and a WARN line (never a silent pass, never a refusal). An id the
@@ -48,13 +65,13 @@ import path from 'node:path';
 import { parse as parseYAML } from 'yaml';
 import { approvalCheckText, expiryChecks } from '../autopilot/limits.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
-import { attemptBlock, claimPath, closeBlock, openBlock, rebaseBlock, stopBlock } from '../state/block.mjs';
+import { attemptBlock, claimPath, closeBlock, openBlock, rebaseBlock, repoTop, stopBlock } from '../state/block.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
-import { findOverlap } from '../state/registry.mjs';
 import { readRun, writeSigned } from '../state/run.mjs';
 import { loadKey, verifyRow } from '../state/signer.mjs';
-import { blockFileSet, reviewGateCheck, waiveFinding } from '../review/gate-check.mjs';
+import { blockFileSet, changedFiles, ownsAt, resultFilesFor, reviewedFiles, reviewGateCheck, unownedChanges, waiveFinding } from '../review/gate-check.mjs';
+import { checkExpiry } from '../autopilot/grant.mjs';
 import { writeSafe } from '../util/redact.mjs';
 import { DEFAULT_CONFIG_FILENAME, loadProjectConfig } from '../config/load.mjs';
 import { validateConfig } from '../config/validate.mjs';
@@ -73,8 +90,13 @@ const FLAG_VALUES = ['run', 'level', 'acceptance', 'brief', 'attempt', 'base', '
 
 /**
  * @param {string[]} args
- * @param {{stdout?: {write: (s: string) => unknown}, stderr?: {write: (s: string) => unknown}, probe?: import('../state/run.mjs').StartTimeProbe, now?: () => Date}} [deps] -
- *   `now` (B48): the clock of the autopilot expiry checks.
+ * @param {{
+ *   stdout?: {write: (s: string) => unknown}, stderr?: {write: (s: string) => unknown}, probe?: import('../state/run.mjs').StartTimeProbe, now?: () => Date,
+ *   isTTY?: boolean, stdinIsTTY?: boolean, stdoutIsTTY?: boolean,
+ *   ui?: {confirm: (o: {message: string, initialValue?: boolean}) => Promise<unknown>, isCancel: (v: unknown) => boolean},
+ * }} [deps] - `now` (B48): the clock of the autopilot expiry checks. `stdinIsTTY` / `stdoutIsTTY`
+ *   (default `process.stdin.isTTY` / `process.stdout.isTTY`; `isTTY` sets both) and `ui` (default
+ *   `@clack/prompts`): B52's confirmation of `--no-require-reviews`, which needs both to be TTYs.
  * @returns {Promise<number>}
  */
 export async function runBlock(args, deps = {}) {
@@ -167,13 +189,44 @@ export async function runBlock(args, deps = {}) {
     if (sub === 'close') {
       const entry = record.blocks?.[id];
       if (!entry) throw new StateError('unknown_block', `block ${id} is not in run ${runId}`);
-      const rows = (await readAllRows(record.project)).filter((row) => row.run === runId);
+      // B52: a block that is not open is refused here, with or without --no-require-reviews, by
+      // the same check and message as `closeBlock` — and the owner is never asked about it
+      if (entry.status !== 'open') throw new StateError('no-block', `block ${id} is not open in run ${runId}`);
       const reviewsWaived = flags['no-require-reviews'] === true;
-      // the block's file set is listed once and shared by the review and report checks; a failure
-      // there is the usual `git-failed` refusal
-      /** @type {ReturnType<typeof blockFileSet> | undefined} */
-      let fileSetOnce;
-      const blockFiles = () => (fileSetOnce ??= blockFileSet({ repoRoot: record.workspace, base: entry.base_sha, owned: entry.owned_files, matchOwned: (f) => findOverlap(entry.owned_files, [f]) !== null }));
+      // B52: the human's way out is confirmed by the human, at a terminal, before anything is written
+      if (reviewsWaived) {
+        const asked = await confirmNoReviews(runId, id, deps);
+        if (asked === 'cancelled') {
+          err(`block ${id} close: cancelled — the review checks stay on\n`);
+          return 1;
+        }
+      }
+      const rows = (await readAllRows(record.project)).filter((row) => row.run === runId);
+      // B52: ONE path base and ONE listing, memoised as a promise and shared by every check. The
+      // base is the repository top level: the worker signs every review row with a repo-root-
+      // relative `file` and keeps its queue and signed result files under `<top>/.code-forge/`
+      // (`repoRootOf`), and `tree_at_open` is stamped there too. An owned entry matches a path
+      // as given or, for a workspace in a subdirectory, relative to the workspace (`ownsAt`).
+      // A failure here is the usual `git-failed` refusal.
+      /** @type {Promise<{top: string, wsPrefix: string, owns: (owned: ReadonlyArray<string>, file: string) => boolean, changed: string[], fileSet: Array<{file: string, content_hash: string}>, reviewed: string[]}> | undefined} */
+      let treeOnce;
+      const tree = () =>
+        (treeOnce ??= (async () => {
+          const top = await repoTop(record.workspace);
+          // both sides as realpaths: git prints the top resolved (/private/var on macOS) while the
+          // run record may keep a symlinked spelling (/var)
+          const real = async (/** @type {string} */ p) => realpath(p).catch(() => path.resolve(p));
+          const wsPrefix = path.relative(await real(top), await real(record.workspace)).split(path.sep).join('/');
+          const owns = ownsAt(wsPrefix);
+          const isMine = (/** @type {string} */ f) => owns(entry.owned_files, f);
+          const changed = await changedFiles({ repoRoot: top, base: entry.base_sha });
+          // the file set is the diff since base ∪ every owned file with review rows of this block —
+          // work the diff cannot see (committed before `block open`, done in another worktree) is
+          // still checked, at its content in the workspace
+          const reviewed = reviewedFiles(rows, id).filter(isMine);
+          const fileSet = await blockFileSet({ repoRoot: top, base: entry.base_sha, owned: entry.owned_files, matchOwned: isMine, changed: [...new Set([...changed, ...reviewed])].sort() });
+          return { top, wsPrefix, owns, changed, fileSet, reviewed };
+        })());
       const reviews = reviewGateCheck(async () => {
         const transcript = await findTranscript(record, id, typeof flags.transcript === 'string' ? flags.transcript : null);
         if (transcript === null) {
@@ -184,14 +237,37 @@ export async function runBlock(args, deps = {}) {
         if (reviewsWaived) await writeSigned(runId, writeRow, { event: 'gate.reviews_waived', block: id, by: 'human' });
         // B20: the high paths come first — a base the workspace does not know refuses the close here
         const highPaths = await highPathsAt(record.workspace, entry.base_sha);
-        const fileSet = await blockFiles();
+        const { top, wsPrefix, owns, changed, fileSet, reviewed } = await tree();
+        const isMine = (/** @type {string} */ f) => owns(entry.owned_files, f);
+        const key = await loadKey(runId);
+        // B52: an empty diff with review rows is never silent — name the likely cause
+        if (reviewed.length > 0 && !changed.some(isMine)) {
+          err(`WARN block ${id}: no owned file differs from the block base in the workspace, but ${reviewed.length} owned file(s) have review rows — the work was likely committed before block open or done in another worktree; they are checked at their content in the workspace\n`);
+        }
+        // B52: only code-forge's own state is exempt — `<top>/.code-forge/`, where the worker keeps
+        // its queue and signed results — never a `--transcript` or `--report` path in the source
+        // tree. For a workspace in a subdirectory, `<workspace>/.code-forge/` is source tree like any
+        // other path, except the two files code-forge itself keeps there at fixed names: this run's
+        // record mirror and this block's default transcript (`.code-forge/runs/<run>.json`,
+        // `.code-forge/runs/<run>/<id>.log`)
+        const wsRel = (/** @type {string} */ p) => path.posix.join(wsPrefix, p);
+        const ownState = new Set([wsRel(`.code-forge/runs/${runId}.json`), wsRel(`.code-forge/runs/${runId}/${id}.log`)]);
+        const scope = await unownedChanges({ top, changed: changed.filter((f) => !ownState.has(f)), id, blocks: record.blocks, rows, key, isMine, owns, stateDir: '.code-forge' });
+        if (scope === null) err(`WARN block ${id}: opened before code-forge recorded the tree at block open; unowned changes were not checked\n`);
+        for (const { file, block: other } of scope?.siblings ?? []) err(`WARN block ${id}: ${file} changed and is owned by open block ${other}; not checked here (its own gate reviews it)\n`);
         return {
           block: id,
           runId,
           rows,
-          key: await loadKey(runId),
+          key,
           transcript,
+          // B52: a change no block of the run owns is refused — `--no-require-reviews` does not lift it
+          unowned: scope?.unowned ?? [],
+          // B52: an old ledger's review.result rows are judged by their signed result files
+          resultFiles: await resultFilesFor({ repoRoot: top, runId, block: id, rows }),
           files: reviewsWaived ? [] : fileSet,
+          // B52: nothing changed and nothing reviewed is never a pass (the owner's way out is --no-require-reviews)
+          noChanges: !reviewsWaived && fileSet.length === 0,
           // B20: high-tier files need a proven red→green row; `--no-require-reviews` does not lift it
           proofFiles: fileSet,
           highPaths,
@@ -206,8 +282,8 @@ export async function runBlock(args, deps = {}) {
         } catch {
           return { ok: false, reason: 'coder report FAILED: --report cannot be read' };
         }
-        const files = await blockFiles();
-        const missing = missingReviewTickets(text, files.map((f) => f.file));
+        const { fileSet } = await tree();
+        const missing = missingReviewTickets(text, fileSet.map((f) => f.file));
         return missing.length === 0 ? { ok: true } : { ok: false, reason: `coder report FAILED: no review-file ticket id for ${missing.join(', ')}` };
       };
       const result = await closeBlock({ runId, id, rows, writeRow, livePid: intFlag(flags['worker-pid'], 'worker-pid'), probe, extraChecks: [reviews, report] });
@@ -222,6 +298,35 @@ export async function runBlock(args, deps = {}) {
   return 2;
 }
 
+/** B52: the refusal when `--no-require-reviews` has no terminal to ask the human at. */
+export const NO_REVIEWS_NO_TTY = '--no-require-reviews needs the human at a terminal to confirm; the block stays open (there is no --yes)';
+
+/**
+ * B52: `--no-require-reviews` lifts every per-file review check, so it is the human's alone — the
+ * same rule as `autopilot approve`: a flag can be passed by any process (the orchestrator, a
+ * script, the delegate's tooling), so the human confirms at a terminal and there is NO `--yes`.
+ * No terminal — stdin AND stdout must both be TTYs (a piped stdout means nobody may see the
+ * question) — ⇒ `usage` (exit 2); an active autopilot grant on the run ⇒ `autopilot-active`
+ * (exit 1; the owner stops the grant first) — nothing is written either way. `deps.stdinIsTTY` /
+ * `deps.stdoutIsTTY` inject each side; `deps.isTTY` injects both at once.
+ * @param {string} runId @param {string} id
+ * @param {{isTTY?: boolean, stdinIsTTY?: boolean, stdoutIsTTY?: boolean, ui?: {confirm: (o: {message: string, initialValue?: boolean}) => Promise<unknown>, isCancel: (v: unknown) => boolean}, now?: () => Date}} deps
+ * @returns {Promise<'confirmed' | 'cancelled'>}
+ * @throws {StateError} `usage`, `autopilot-active`
+ */
+async function confirmNoReviews(runId, id, deps) {
+  const stdinTTY = deps.stdinIsTTY ?? deps.isTTY ?? process.stdin.isTTY === true;
+  const stdoutTTY = deps.stdoutIsTTY ?? deps.isTTY ?? process.stdout.isTTY === true;
+  if (!(stdinTTY && stdoutTTY)) throw new StateError('usage', NO_REVIEWS_NO_TTY);
+  const grant = await checkExpiry(runId, (deps.now ?? (() => new Date()))());
+  if (grant.state === 'active') {
+    throw new StateError('autopilot-active', `--no-require-reviews is refused while an autopilot grant is active on run ${runId} (stop it first: code-forge autopilot stop --run ${runId})`);
+  }
+  const ui = deps.ui ?? /** @type {any} */ (await import('@clack/prompts'));
+  const go = await ui.confirm({ message: `Close block ${id} of run ${runId} WITHOUT the per-file review checks? Only the owner may say yes.`, initialValue: false });
+  return ui.isCancel(go) || go !== true ? 'cancelled' : 'confirmed';
+}
+
 /**
  * B47: the level `autopilot level` chose for the block — the latest `autopilot.level` row of this
  * run for it whose MAC verifies — or null when there is none.

package/src/review/engine.mjs

@@ -33,7 +33,7 @@ import { blockKind, isDocsKind } from '../decide/escalation.mjs';
 import { fallbackRisk } from '../decide/fallback-rules.mjs';
 import { tierFor } from '../proof/tiers.mjs';
 import { assembleJudgePacket, assemblePacket, attachFiles, budgetFor, readFileDiff } from './packet.mjs';
-import { FINDING_SCHEMA, minTokensOut, SMALL_DIFF_ADDED_LINES, validateReview } from './validate-review.mjs';
+import { FINDING_SCHEMA, minTokensOut, validateReview } from './validate-review.mjs';
 import { spawnWithTimeoutRetry } from './session-retry.mjs';
 import { assertRowPath } from '../worker/ticket.mjs';
 
@@ -194,12 +194,11 @@ export async function reviewFile(input, deps) {
   if (diff.diffText.trim().length === 0) return { status: 'no_change', approved: false, ...head, sessions: [] };
   mkdirSync(workDir, { recursive: true, mode: 0o700 });
   const min = minTokensOut(cfg);
-  const smallDiff = diff.plusCount <= SMALL_DIFF_ADDED_LINES;
 
   /** @param {SessionSpec} spec @param {{text: string, hunkHeaders: string[], tokensIn: number, contextMode: string | null}} packet */
   const run = async (spec, packet) => {
     /** @type {Record<string, any>} */
-    let summary = await runOne(spec, packet.text, packet, { deps, workDir, min, smallDiff, cfg });
+    let summary = await runOne(spec, packet.text, packet, { deps, workDir, min, cfg });
     const needs = summary.review?.needs_file;
     if (spec.role === 'reviewer' && summary.status === 'ok' && Array.isArray(needs) && needs.length > 0) {
       const paths = safeNeeds(needs);
@@ -210,7 +209,7 @@ export async function reviewFile(input, deps) {
         extra = null;
       }
       if (extra === null) return { ...summary, status: 'unavailable', reason: 'needs_file-refused', review: null };
-      summary = { ...(await runOne(spec, `${packet.text}${extra}`, packet, { deps, workDir, min, smallDiff, cfg })), needs_file_round: true };
+      summary = { ...(await runOne(spec, `${packet.text}${extra}`, packet, { deps, workDir, min, cfg })), needs_file_round: true };
     }
     return summary;
   };
@@ -234,7 +233,7 @@ export async function reviewFile(input, deps) {
   if (judgeSpec) {
     const bySlot = Object.fromEntries(done.map((s) => [s.slot, s.review]));
     const packet = assembleJudgePacket({ diff, reports: { A: bySlot.A, B: bySlot.B }, cfg });
-    final = await runOne(judgeSpec, packet.text, packet, { deps, workDir, min, smallDiff, cfg });
+    final = await runOne(judgeSpec, packet.text, packet, { deps, workDir, min, cfg });
     sessions.push(publicSummary(final));
     if (final.status !== 'ok') {
       await note(deps, { event: 'review.unavailable', reason: final.reason, lens: 'judge' });
@@ -250,9 +249,9 @@ export async function reviewFile(input, deps) {
  * One session: packet file (0600, removed after), spawn, stub guard.
  * @param {SessionSpec} spec @param {string} text
  * @param {{hunkHeaders: string[], tokensIn: number, contextMode: string | null}} packet
- * @param {{deps: ReviewDeps, workDir: string, min: number, smallDiff?: boolean, cfg: Record<string, any>}} env
+ * @param {{deps: ReviewDeps, workDir: string, min: number, cfg: Record<string, any>}} env
  */
-async function runOne(spec, text, packet, { deps, workDir, min, smallDiff = false }) {
+async function runOne(spec, text, packet, { deps, workDir, min }) {
   const promptPath = path.join(workDir, `${spec.lens}-${randomBytes(6).toString('hex')}.md`);
   const base = { lens: spec.lens, role: spec.role, level: spec.level, slot: spec.slot, context_mode: packet.contextMode, ctx_tokens_in: packet.tokensIn };
   writeFileSync(promptPath, text, { mode: 0o600 });
@@ -285,7 +284,7 @@ async function runOne(spec, text, packet, { deps, workDir, min, smallDiff = fals
   } finally {
     rmSync(promptPath, { force: true });
   }
-  const verdict = validateReview(res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min, smallDiff });
+  const verdict = validateReview(res, { hunkHeaders: packet.hunkHeaders, minTokensOut: min });
   const meta = {
     ...base,
     provider: res?.provider ?? null,