@codedology/code-forge 0.7.7 → 0.9.0

package/CHANGELOG.md

@@ -6,6 +6,103 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.9.0] — 2026-10-12
+
+### Added
+
+- review-file --answers <ids> --of <source>: a fresh L2 session judges a fix made in another owned file; resolved ids
+  get signed review.answered rows bound to both content hashes, and the close gate counts a still-current answer like a
+  waiver (answered list on gate.review_waived_all).
+- block reopen <id> --run <r> --file <path> --reason <text>: a human-only verb that restarts a stopped file on changed
+  content (or a lost one on its current content) with a full round 1; signed review.reopened row, one per anchor seq;
+  refusal codes reopen-same-content, reopen-tampered, reopen-not-stopped, reopen-block-not-open, reopen-not-owned,
+  reopen-config, reopen-already-recorded, reopen-write-failed.
+- A stopped `review-file` answer carries `exits`, and the gate's `review_cap` and stopped-file `unreviewed` detail end
+  with the same exits (B73, issue #12).
+- The review packet of a deleted owned file carries a `## deleted file` note: up to 20 tracked or untracked paths that
+  still name its basename (one bounded `git grep`, secret-like and control-character paths left out), `no references
+  found`, or `references not checked` (B74, issue #8).
+- `review-file --fresh` drops a cached result that never counted and queues the ticket again; counted results refuse
+  `fresh-needs-reopen`, tampered ones `fresh-tampered`, and the cached marker is never moved (B75, issue #10 item 4).
+
+### Changed
+
+- Review state is saved under ~/.code-forge/runs/<run>/review-state/ instead of the temp root; older state files are
+  moved once after an anchor check; doctor warns about missing state files of active runs (#15)
+- Review state: the reviewed text is stored as a git blob (reviewed_content_blob in the signed review.state body), so a
+  restored state keeps reviewed_content after the file changed; a missing, malformed or mismatching blob falls back to
+  the full-file review.
+- A `patch_check` that closes at least one finding open before the patch (by id) and is under
+  `review.max_rounds_per_file` continues the fix loop at L2; a patch that closes nothing still stops
+  `l3_patch_exhausted` (B73, issue #12).
+- The skill and docs name the review exits in order, say where review state lives and how the ledger rebuilds it; the
+  coder brief names `review-file --answers`, and the security reference lists `block reopen` as forbidden to a coder
+  (B76).
+
+### Fixed
+
+- A lost review state file is rebuilt from the signed ledger and recorded as review.state_restored; rounds, findings and
+  stops stay; with no ledger copy the ticket is refused as review-state-lost, not tampered (#15)
+- A file whose every finding is cleared by accepted waivers counts as reviewed (reviewed_by_waiver) and block close
+  writes a signed gate.review_waived_all row; unknown severities are human-only (#9)
+- Test isolation guard: new files of a run that existed before the test process (its lock, key or run directory) no
+  longer count as leaks; a new run id or any other new path still fails the process.
+- `review-file --answers` reads the severity of every `review.cap` id from the signed refusal rows, so an id the close
+  cannot count is refused before a reviewer session (B79).
+- The answers packet checks the source file with the secret-path rule, redacts each part before it is cut, keeps every
+  part and the whole packet inside the budget, and refuses `packet-too-large` when the fixed text alone is over it
+  (B79).
+- `block reopen` refuses a non-string `tmp.root` as `reopen-config`, and `reopen-write-failed` names the error code,
+  never a path (B79).
+- The ledger rotation race test forces the order of the two racers with an `afterLink` hook instead of scheduling them,
+  so it no longer fails at random under load (B81).
+- The worker restart test waits up to 5 s for killed sessions to exit instead of checking once, so it no longer fails at
+  random under load (B82).
+- `review-file --fresh`: a failed restore of the done marker no longer leaves the ticket looking pending; it writes a
+  refused `fresh-restore-failed` marker or keeps the claim, `block reopen` clears leftover claims, and the messages say
+  which state was left (B83).
+
+## [0.8.0] — 2026-10-12
+
+### Added
+
+- B60: related-test gates (issue #13 item 3). block open --tests <paths> names the test files of a block; a gate argv
+  item exactly {test_files} becomes those files, or the full suite runs when the block owns more than
+  gates.full_suite_threshold_files files or no test file is known. Gate rows carry scope, reason and test_count. A gate
+  can be {argv, env}; env values are never printed or recorded, and child output masks values of 8 or more characters.
+- B61: Laravel under export isolation is verified. A Laravel or plain PHP project on PHPUnit without Pest is detected as
+  php-phpunit. Export copies a Composer vendor folder instead of linking it, so PHP autoloads the code of the block and
+  not the main tree. An opt-in live check (CODE_FORGE_LIVE_PHP=1) runs a Laravel app on PHPUnit and on Pest through the
+  export.
+- proof.isolation: worktree — each block gets its own git worktree and branch (proof.worktree.dir/branch/base); owned
+  files need to be disjoint only inside one tree; block close --remove-worktree removes the tree and keeps the branch
+  (issue #13)
+- Worktree blocks: gates run --block, review-file, the worker, block close and proof export/red-green all measure the
+  block's own tree (against its base), never the main checkout; a missing, malformed, off-branch or foreign tree is
+  refused (issue #13)
+- Context pack: a top-level `context` key (rules, lessons, commands, max_lines) and `code-forge context pack --run
+  --block [--json]`, which writes the pack, prints its path and token estimate and appends a signed `context.pack` row;
+  review packets carry the rules and lessons (issue #13)
+- Coder test proof: the coder report may carry `TESTS <command> exit=<n>`; with `context.require_coder_tests: true`
+  (fixed at run start) `block close --report` refuses a report without a green TESTS line and writes a signed
+  `coder.tests` row (issue #13)
+- code-forge status: at most 10 lines per run (state, mode, spend, open blocks with level, model, last gate, open
+  findings) or one --json line; every block verb takes --json and prints one JSON line (issue #13)
+- Block-end signal: every block end writes <run root>/blocks/<id>.done.json; hooks.on_block_end runs a command once per
+  block end (no shell, timeout, signed hook.ran row); a failing hook only warns (issue #13)
+- ledger outside-review records an outside reviewer's rounds and findings per PR (signed outside_review row, link
+  redacted); report gets a 14th section, outside_review, with the code-forge cost of the PR's blocks next to the rounds
+  (issue #13)
+- docs/brief-mode.md walks a brief-only run with an outside reviewer, related tests, a worktree, the context pack and
+  the no-poll flow; a test runs the page's config and steps; the skill says when to use brief mode or plan mode (issue
+  #13)
+
+### Changed
+
+- BREAKING: autonomy.coder_may_push and autonomy.coder_may_open_draft_pr now default to false, so a coder no longer
+  pushes or opens a draft PR unless the config allows it; init asks both (default no) and takes --coder-may-push /
+  --coder-may-open-draft-pr yes|no; set both to true to keep the old behaviour (issue #13)
+
 ## [0.7.7] — 2026-10-11
 
 ### Added

package/README.md

@@ -8,9 +8,75 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 > `examples/` have all landed (`docs/reference/blocks.json` lists every build block). What changed
 > in each version is in [CHANGELOG.md](CHANGELOG.md).
 
+## What's new in 0.8
+
+In the next release:
+
+- **A lost review state is rebuilt, not reset.** When the review state file of a file is gone (for example, macOS cleaned its temp folder), the worker rebuilds it from the signed ledger and writes a `review.state_restored` row. Rounds, open findings and stops stay as they were. If the ledger cannot rebuild it, the ticket is refused as `review-state-lost`, not `tampered` (#15).
+- **Review state no longer lives in the temp folder.** It is saved under `~/.code-forge/runs/<run>/review-state/`, so a temp cleanup or a worker restart does not touch it. A state file from an older run is moved there once, after a check against its signed anchor. `code-forge doctor` warns when a state file of an active run is missing and says whether the ledger can rebuild it (#15).
+- **Waiving every finding is a real way out.** A file whose signed review on its current content left findings, all cleared by accepted waivers, now counts as reviewed (`reviewed_by_waiver`, never approved). `block close` writes one signed `gate.review_waived_all` row for it. A critical still needs a human waiver, and a finding with an unknown severity does too (#9).
+- **Tests no longer fail because of your own live run.** The test guard used to fail when a code-forge run you had open wrote its lock file during `npm test`. Now new files of a run that existed before the tests are not counted as leaks. A new run or any other new file still fails the tests.
+- **A restore brings back the exact reviewed text.** The reviewed text is now also kept as a git object, and the signed ledger points to it. After a lost state file is rebuilt, the next round reviews only what changed since the last review, even when the file changed. If git has removed the object, the round reviews the full file, as before (#15).
+- **A fix in another file can answer a finding.** `review-file <file> --block <id> --answers <ids> --of <source>` asks a fresh reviewer whether a change in another owned file of the block fixes findings of the source file. Each finding it judges `resolved` gets a signed `review.answered` row, and the source file can then close as `reviewed_by_waiver` with an `answered` list. If either file changes later, the answer no longer counts. The answering file still needs its own approval (#9).
+- **`block reopen` restarts a stopped file.** After you change a file whose review stopped, `code-forge block reopen <id> --run <r> --file <path> --reason <text>` starts a fresh round 1 for it. A file whose review state is lost can be reopened on its current content. Only a human may run it: a coder's command line is blocked, like `block waive`. The block's one L3 step stays used. The same content is refused, so you cannot simply roll again (#12, #15).
+- **Safer answers packets and clearer reopen errors (B79).** An id named only by a `review.cap` row with no recorded severity is refused before any reviewer session. The answers packet checks the source file for secrets, stays inside the packet budget and refuses `packet-too-large` instead of going over it. `block reopen` refuses a bad `tmp.root` and names the cause of a failed write.
+- **A last-chance patch that fixes something is progress (B73).** When the L3 patch closes at least one old finding and the file is under the round cap, the fix loop goes on at L2 instead of stopping `l3_patch_exhausted`. A stopped answer from `review-file` and the gate's `review_cap` detail now list the exits: `block reopen`, `block waive`, `review-file --answers`, re-decompose.
+- **A steadier test suite (B81).** The ledger rotation race test forces the race order through a test hook, so it no longer fails at random under load.
+- **Deleted files get a useful review (B74).** When a block deletes an owned file, the review packet says the file is deleted and lists up to 20 files that still name it, so the reviewer can look for dangling references. A deletion still needs an approval.
+- **`review-file --fresh` (B75).** Runs a file's review again only when the cached result never counted (`stale`, `unavailable`, or a non-verdict refusal such as `other-run`). A counted result is refused `fresh-needs-reopen` and names `block reopen` and `block waive`; a tampered one is refused `fresh-tampered`. A coder may use it.
+- **Another steadier test (B82).** The worker restart test waits for killed sessions to exit instead of checking once, so it no longer fails at random under load.
+- **The review exits, in one place (B76).** `skill/references/review.md` §5, `code.md` and `docs/how-it-works.md` name the ways out of a stopped file in order: fix and the human's `block reopen`, `review-file --answers`, `block waive`, re-decompose. They also say `block attempt` never resets review state and that a lost state file is rebuilt from the ledger.
+- **`review-file --fresh` fails closed (B83).** When a cached result cannot be put back, the ticket gets a refused `fresh-restore-failed` marker (or keeps its claim), so the worker does not run it by itself. `block reopen` clears it. Messages name the error code only.
+
+In 0.8.0:
+
+- **Run only the tests a block touches.** `block open --tests <paths>` names the block's test
+  files. A gate argv item exactly `{test_files}` becomes those files. When the block owns more
+  files than `gates.full_suite_threshold_files`, or no test file is known, the full suite runs.
+  The ledger row says which one ran. A gate can also be `{argv, env}`. Env values are never
+  printed. Gate env is not a secret store.
+- **Laravel works under export, checked live.** A Laravel app on PHPUnit (no Pest) is now
+  detected. Export copies the Composer `vendor` folder instead of linking it, so the tests load
+  the block's code, not the main tree's. A live check (`CODE_FORGE_LIVE_PHP=1`) runs a Laravel
+  app on PHPUnit and on Pest through the export.
+- **One git worktree per block.** With `proof.isolation: worktree`, `block open` gives each block
+  its own git worktree and branch (`proof.worktree.dir`, `branch`, `base`). Blocks in different
+  trees may own the same files. Nothing is pushed. `block close --remove-worktree` removes the
+  tree and keeps the branch. Gates, reviews, the close check and the mutation proof of that
+  block all run on the block's tree, never on the main checkout.
+- **A context pack for coders.** Set `context: {rules, lessons, commands, max_lines}`.
+  `code-forge context pack --run <r> --block <id>` writes one file with the block's header,
+  the build and test commands, the project rules and the lessons, cut to `max_lines`. It prints
+  the path and a token estimate, and writes a signed `context.pack` row. Review packets now
+  carry the same rules and lessons. With no `context` key, nothing changes.
+- **Coders prove a green test run.** A coder prints `TESTS <command> exit=<n>` just before its
+  COMPLETE sentinel. With `context.require_coder_tests: true` (fixed at `run start`),
+  `block close --report` refuses a report with no such line or a non-zero exit, even when
+  reviews are waived, and writes a signed `coder.tests` row when it passes.
+- **Short status.** `code-forge status [--run <id>] [--json]` prints at most 10 lines per run:
+  state, mode, spend, and one line per open block with its level, model, last gate and open
+  findings. It is read-only. Every `block` verb takes `--json` and prints one JSON line, so an
+  orchestrator never has to read logs or poll transcripts.
+- **A signal when a block ends.** Every block end writes `~/.code-forge/runs/<run>/blocks/<id>.done.json`
+  (status, commit, spend, open findings). With `hooks.on_block_end` (fixed at `run start`),
+  code-forge also runs your command once per block end, with the block id, status and file path
+  in its env, under a timeout, and writes a signed `hook.ran` row. A failing hook only warns.
+- **Breaking: coders no longer push or open draft PRs by default.** `autonomy.coder_may_push` and
+  `autonomy.coder_may_open_draft_pr` now default to `false`. `init` asks both (default no) and
+  writes your answers. To keep the old behaviour, set both to `true` in `.code-forge.yml`.
+- **Outside review rounds next to code-forge cost.** `code-forge ledger outside-review --run <r>
+  --pr <n> --rounds <n> --findings <n> [--link <url>] [--block <id>]…` records how many rounds an
+  outside reviewer needed on a PR (a later call for the same PR replaces it). `report` gets a
+  14th section, `outside_review`: per PR, the rounds and findings next to the code-forge cost
+  of its blocks.
+- **A walk-through for brief-only runs.** [docs/brief-mode.md](docs/brief-mode.md) walks one task
+  from a brief to a closed block with an outside reviewer: related tests, a worktree, the context
+  pack, the done file and hook, `status`, and the outside review rounds in `report`. A test runs
+  the page's own config and steps, so the page and the CLI stay the same.
+
 ## What's new in 0.7
 
-Next release:
+In 0.7.7:
 
 - **Work from a brief, with no plan.** `run start --mode brief` marks the run as brief-only.
   Then `block open` without `--level` picks the lane from the rules: the owned files,
@@ -219,7 +285,7 @@ usage line.
 
 | Verb | Usage |
 |---|---|
-| `init` | `code-forge init [--no-interaction] [--tools recommended\|current] [--yes-tool <tool>]… [--harness a,b] [-g\|-p] [--copy] [--provider P] [--level Ln=model[:effort][@provider]]… [--refresh-models] [--multimodel on\|off] [--second-provider P] [--jev-ref <item-id\|link\|op://…> \| --jev-env NAME \| --no-jev] [--engine auto\|solo\|harness] [--solo-project N] [--gate name=cmd]… [--proof isolation=export\|lock \| high=a,b \| link_dirs=a,b \| copy_untracked=a,b]… [--skip-doctor]` |
+| `init` | `code-forge init [--no-interaction] [--tools recommended\|current] [--yes-tool <tool>]… [--harness a,b] [-g\|-p] [--copy] [--provider P] [--level Ln=model[:effort][@provider]]… [--refresh-models] [--multimodel on\|off] [--second-provider P] [--jev-ref <item-id\|link\|op://…> \| --jev-env NAME \| --no-jev] [--engine auto\|solo\|harness] [--solo-project N] [--gate name=cmd]… [--proof isolation=export\|lock \| high=a,b \| link_dirs=a,b \| copy_untracked=a,b]… [--coder-may-push yes\|no] [--coder-may-open-draft-pr yes\|no] [--skip-doctor]` |
 | `doctor` | `code-forge doctor [--quick] [--json] [--cwd <dir>]` |
 | `tools` | `code-forge tools [--json]` · `code-forge tools install [<id>…] [--yes] [--dry-run]` — see and install the recommended tools (claude, codex, gemini, grok, op, solo) |
 | `validate` | `code-forge validate [--file <path>]` |

package/docs/README.md

@@ -15,11 +15,12 @@ disagree, the verb is right: each verb prints its own usage line when its argume
 | 5 | [tutorial-first-test.md](tutorial-first-test.md) | run one real end-to-end test: build the code-forge marketing site in a new repo |
 | 5a | [review-only.md](review-only.md) | only review code you already wrote: a branch, uncommitted work or some files, with CI exit codes |
 | 5b | [autopilot.md](autopilot.md) | step away while a run goes on: grant a delegate a few decisions for a set time, and review the live log (Binnacle and Full log) when you return |
+| 5c | [brief-mode.md](brief-mode.md) | code one small task from a brief, with no plan: a brief-mode run with an outside reviewer, related tests, worktrees, the context pack and the done file, step by step |
 | 6 | [examples/marketing-site/brief.md](examples/marketing-site/brief.md) | copy the brief the tutorial uses |
 | 7 | [marketing.md](marketing.md) | read the product story: the problem, the promise, the honest limits |
 
 New to the tool? Read 1 → 3 → 4, then do 5. Keep 2 open as a glossary. Only want reviews? Read 4,
-then 5a. Going away while a run goes on? Read 5b.
+then 5a. Going away while a run goes on? Read 5b. One small task, no plan? Read 5c.
 
 ## Reference pages (already in the repo)
 

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 62,
+  "block_count": 88,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -850,6 +850,395 @@
         "B58"
       ],
       "note": "root-added 2026-10-11; GitHub issue #13 adoption plan (plans/adoption-13/plan.md); also amends src/state/{run,block,config-snapshot}.mjs, src/cli/{run,block,report}.mjs, src/ledger/report.mjs, src/review/engine.mjs (shared migration/policy path checks), docs/{how-it-works,concepts}.md, skill/SKILL.md, skill/references/plan.md"
+    },
+    "B60": {
+      "title": "Related-test gates (issue #13 item 3): block open --tests <paths> sets the block's test files (exact paths or directories; * ? and a leading - refused); a gate argv item exactly {test_files} expands to them (else owned entries that look like tests) and is dropped for the full suite when the block owns more than gates.full_suite_threshold_files files (tracked and new, not ignored; globs and directories count the files they cover) or no test file is known; gate.red/gate.done carry scope, reason, test_count, run and block; a gate may be {argv, env}: env values are never printed or recorded, and child output masks values of 8+ characters; plain gates run exactly as before",
+      "wave": 13,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/gates/expand.mjs",
+        "src/gates/owned-count.mjs",
+        "src/util/gate-token.mjs",
+        "test/gates/placeholders.test.mjs"
+      ],
+      "depends_on": [
+        "B59"
+      ],
+      "note": "root-added 2026-10-11; GitHub issue #13 adoption plan (plans/adoption-13/plan.md); also amends src/gates/{run,detect}.mjs, src/proof/{export,lock}.mjs, src/cli/{gates,block}.mjs, src/state/{block,registry}.mjs, src/config/validate.mjs, src/doctor/local.mjs, src/install/wizard/{answers,steps,summary}.mjs, src/autopilot/binnacle.mjs, schema/code-forge.schema.json, docs/reference/config.md, docs/{how-it-works,concepts}.md, skill/SKILL.md, skill/references/{proof,code,ledger}.md"
+    },
+    "B61": {
+      "title": "Laravel under export, verified (issue #13 item 3): composer.json + vendor/bin/phpunit without Pest is the php-phpunit stack (php artisan test --compact with artisan, else vendor/bin/phpunit; PHP is detected before Node); export copies a Composer vendor (link_dirs entry holding composer/autoload_real.php, resolved through realpath, reflink when possible) instead of linking it, because PHP resolves __DIR__ through symlinks and a linked vendor autoloaded app code from the main tree; absolute links into the main tree are pointed into the export; an opt-in live test (CODE_FORGE_LIVE_PHP=1) runs a Laravel skeleton on PHPUnit and on Pest green through the export while the main tree is red; proof.md marks PHP under export VERIFIED",
+      "wave": 13,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "test/proof/laravel-live.test.mjs"
+      ],
+      "depends_on": [
+        "B60"
+      ],
+      "note": "root-added 2026-10-11; GitHub issue #13 adoption plan (plans/adoption-13/plan.md); also amends src/gates/detect.mjs, src/proof/export.mjs, src/install/wizard/answers.mjs (comment), test/gates/detect.test.mjs, test/proof/export.test.mjs, test/init/fix-r3.test.mjs (Laravel+PHPUnit now php-phpunit), docs/{how-it-works,concepts,getting-started}.md, skill/references/proof.md"
+    },
+    "B62a": {
+      "title": "Worktree isolation, open and close (issue #13 item 4): proof.isolation worktree gives each block its own git worktree and branch (proof.worktree {dir, branch, base}, dir resolved from the repository top level, <repo-name> is its basename, a symlinked dir is recorded by its realpath); both keys are read from the run's config snapshot and run reload refuses to change them; block open adds the tree (GIT_* stripped), re-checks the branch just before the add, rolls the tree and its own branch back on a later failure and names any leftover; a re-open reuses or re-adds the tree on the same branch and keeps the tree's base (a different --base is refused, block rebase refuses a worktree block); owned files must be disjoint only inside one tree; block close --remove-worktree removes the tree (never the branch) and writes worktree.removed or a signed worktree.remove_failed; --remove-worktree is on the coder forbidden list",
+      "wave": 13,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/proof/worktree.mjs",
+        "test/proof/worktree.test.mjs"
+      ],
+      "depends_on": [
+        "B61"
+      ],
+      "note": "root-added 2026-10-11; GitHub issue #13 adoption plan (plans/adoption-13/plan.md); also amends src/state/{block,registry,run,config-snapshot}.mjs, src/cli/block.mjs, src/util/forbidden.mjs, schema/code-forge.schema.json, docs/reference/config.md, docs/{how-it-works,concepts}.md, skill/references/{proof,code,ledger,security}.md, test/state/registry.test.mjs, test/util/forbidden.test.mjs, test/config/schema-coverage.test.mjs, test/engines/{codex-home,builders/argv-snapshots,builders/forbidden-rendering}.test.mjs"
+    },
+    "B62b": {
+      "title": "Worktree isolation, gates, reviews and the close check (issue #13 item 4): for a block with a worktree, gates run --block runs in the tree (--cwd must name the workspace's place in the tree, else exit 2; --cwd=<dir> is refused), {test_files} and the threshold count in the tree, gate rows name the tree; review-file queues in the main tree but hashes the tree's content, the ticket id includes the tree, and the worker reads content and the diff against worktree.base_sha from the run record's tree (a mismatch, a missing, malformed, off-branch or foreign tree is unavailable or refused); block close measures changed and unowned files in the tree against its base with no sibling or tree_at_open exemption; proof export and red-green build the export from the tree and never write to it, and proof lock is refused for a worktree block; nothing is pushed, merged or checked out, and the main tree's HEAD and index stay unchanged; blocks without a worktree behave as before",
+      "wave": 13,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "test/proof/worktree-flow.test.mjs"
+      ],
+      "depends_on": [
+        "B62a"
+      ],
+      "note": "root-added 2026-10-12; GitHub issue #13 adoption plan (plans/adoption-13/plan.md); also amends src/cli/{block,gates,proof,review-file}.mjs, src/proof/worktree.mjs, src/review/gate-check.mjs, src/worker/{engine,loop,queue,ticket}.mjs, test/proof/worktree.test.mjs, test/review/engine.test.mjs, test/worker/queue.test.mjs, docs/{how-it-works,concepts}.md, skill/references/{proof,review,code,ledger}.md"
+    },
+    "B63a": {
+      "title": "Context pack (issue #13 item 5, issue #10 item 2): a top-level context key (rules, lessons, commands, max_lines default 300); code-forge context pack --run --block [--json] writes <run-root>/context/<block>.md with a header, the redacted commands in POSIX quoting, the rules and the lessons, cut to max_lines (lessons first, then rules from the last file back, each cut marked), prints the path and a token estimate, and appends a signed context.pack row unless the block's last row has the same sha256; paths outside the repository, missing files and control characters are refused with nothing written; review packets (first and recheck) carry the rules and lessons from the main tree in the 60-line digest slot, read from the live config, and an unreadable file makes the ticket unavailable (context-unreadable); with no context key everything behaves as before",
+      "wave": 13,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/context/pack.mjs",
+        "src/cli/context.mjs",
+        "src/worker/engine.mjs",
+        "test/context/pack.test.mjs"
+      ],
+      "depends_on": [
+        "B62b"
+      ],
+      "note": "root-added 2026-10-12; GitHub issue #13 adoption plan (plans/adoption-13/plan.md); also amends src/util/breadcrumbs.mjs, schema/code-forge.schema.json, test/config/schema-coverage.test.mjs, docs/{how-it-works,concepts}.md, docs/reference/config.md, skill/SKILL.md, skill/references/{code,review,ledger}.md"
+    },
+    "B63b": {
+      "title": "Coders prove a green test run (issue #13 item 5, issue #10 item 1): parseSentinel returns tests {command, exit} from the last whole-line TESTS <command> exit=<n> in the returned sentinel's segment (after the previous sentinel of any block; 0-255, no leading zeros); context.require_coder_tests (run-start snapshot only, run reload refuses a change) makes block close refuse with no --report, an unreadable report, no COMPLETE sentinel, no TESTS line or a non-zero exit, even when reviews are waived or external, and on a pass writes a signed coder.tests row with the close rows; the coder brief template gets a context pack slot and the TESTS line; with the key false or absent close behaves as before",
+      "wave": 13,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "test/engines/sentinel-tests.test.mjs"
+      ],
+      "depends_on": [
+        "B63a"
+      ],
+      "note": "root-added 2026-10-12; GitHub issue #13 adoption plan (plans/adoption-13/plan.md); also amends src/engines/sentinel.mjs, src/cli/block.mjs, src/context/pack.mjs, src/state/{config-snapshot,run}.mjs, schema/code-forge.schema.json, test/config/schema-coverage.test.mjs, test/skill/structure.test.mjs, docs/{how-it-works,concepts}.md, docs/reference/config.md, skill/SKILL.md, skill/references/{code,ledger}.md, skill/templates/coder-brief.md"
+    },
+    "B64a": {
+      "title": "Short status (issue #13 item 6, part 1): code-forge status [--run] [--json] is read-only and prints at most 10 lines per run (run id, state, mode, spend; one line per open block with level, coder model, last gate and the open findings the close gate would refuse; an overflow line and a closed/stopped tally), or one JSON line; every block verb takes --json and prints one JSON line, with stdout empty on failure except a gate-refused close; without --json block output is unchanged",
+      "wave": 13,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/cli/status.mjs",
+        "src/state/brief-status.mjs",
+        "test/cli/status.test.mjs"
+      ],
+      "depends_on": [
+        "B63b"
+      ],
+      "note": "root-added 2026-10-12; GitHub issue #13 adoption plan (plans/adoption-13/plan.md); also amends src/cli/block.mjs, docs/{how-it-works,concepts}.md, skill/SKILL.md, skill/references/code.md"
+    },
+    "B64b": {
+      "title": "Block-end signal (issue #13 item 6, part 2): every block end (close, stop, a stop from close) writes <run root>/blocks/<id>.done.json atomically (status, event, reason, commit, block spend, open findings, time); hooks.on_block_end {argv, timeout_s}, fixed at run start, runs once per end outside the run lock with no shell and four CODE_FORGE_* env vars, its process group killed at the timeout, and writes one signed hook.ran row; a failing hook only warns; a coder transcript running the hook command is refused at close",
+      "wave": 13,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/state/block-end.mjs",
+        "src/review/open-findings.mjs",
+        "test/state/block-end.test.mjs"
+      ],
+      "depends_on": [
+        "B64a"
+      ],
+      "note": "root-added 2026-10-12; GitHub issue #13 adoption plan (plans/adoption-13/plan.md); also amends src/cli/block.mjs, src/cli/status.mjs, src/state/{block,config-snapshot,run}.mjs, src/util/forbidden.mjs, schema, docs/{how-it-works,concepts}.md, docs/reference/config.md, skill/SKILL.md, skill/references/{code,ledger}.md"
+    },
+    "B65": {
+      "title": "Safer push and draft-PR defaults (issue #13 item 7): autonomy.coder_may_push and autonomy.coder_may_open_draft_pr default to false; init asks both (default no, the draft-PR question only after a push yes, pre-filled on a re-run), writes both keys, and takes --coder-may-push / --coder-may-open-draft-pr yes|no; a draft PR without push is refused; the skill gates every hand-back, push or PR on the same checks",
+      "wave": 13,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "test/init/autonomy.test.mjs"
+      ],
+      "depends_on": [
+        "B64b"
+      ],
+      "note": "root-added 2026-10-12; GitHub issue #13 adoption plan (plans/adoption-13/plan.md); breaking default change; also amends src/install/wizard/{answers,flags,project-file,run,steps}.mjs, schema, docs/{how-it-works,concepts,getting-started,overview}.md, docs/reference/config.md, skill/references/code.md, test/init/{flags,settings}.test.mjs, test/fixtures/repos/laravel-vue/expected.code-forge.yml"
+    },
+    "B66": {
+      "title": "Outside review rounds per PR next to code-forge cost",
+      "wave": 13,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/ledger/outside-review.mjs",
+        "test/ledger/outside-review.test.mjs"
+      ],
+      "depends_on": [
+        "B65"
+      ],
+      "note": "root-added 2026-10-12; GitHub issue #13 adoption plan (plans/adoption-13/plan.md); also amends src/cli/ledger.mjs, src/cli/report.mjs, src/ledger/report.mjs, src/ledger/export.mjs and the 14-section pins"
+    },
+    "B67": {
+      "title": "Docs and skill for brief-only runs, context packs and the no-poll flow",
+      "wave": 13,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "docs/brief-mode.md",
+        "test/integration/brief-mode-walkthrough.test.mjs"
+      ],
+      "depends_on": [
+        "B66"
+      ],
+      "note": "root-added 2026-10-12; GitHub issue #13 adoption plan (plans/adoption-13/plan.md); also amends skill/SKILL.md, skill/references/code.md, docs/README.md, docs/how-it-works.md and test/skill/structure.test.mjs"
+    },
+    "B68": {
+      "title": "A lost review-state file is rebuilt from the signed ledger, never reset",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/worker/review-state.mjs",
+        "test/worker/review-state-restore.test.mjs"
+      ],
+      "depends_on": [
+        "B67"
+      ],
+      "note": "root-added 2026-10-12; GitHub issue #15 review-exits plan (plans/review-exits/plan.md); review.state anchors carry a slim signed state_body; also amends src/worker/engine.mjs, src/worker/loop.mjs, skill/references/review.md, skill/references/ledger.md and test/worker/fixloop-wiring.test.mjs"
+    },
+    "B69": {
+      "title": "Review state lives under the code-forge home, not the temp root",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/worker/review-state.mjs",
+        "src/doctor/local.mjs",
+        "test/worker/review-state-durable.test.mjs"
+      ],
+      "depends_on": [
+        "B68"
+      ],
+      "note": "root-added 2026-10-12; GitHub issue #15 review-exits plan (plans/review-exits/plan.md); state at <home>/runs/<run>/review-state, one-time checked move from the temp root, doctor review-state row; also amends src/util/tmp.mjs (runRootPath), src/worker/engine.mjs, src/doctor/index.mjs, skill/references/review.md, docs/how-it-works.md, docs/getting-started.md and the B68/fixloop-wiring tests"
+    },
+    "B70": {
+      "title": "A fully waived review counts as reviewed",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/review/gate-check.mjs",
+        "test/review/waived-all.test.mjs"
+      ],
+      "depends_on": [
+        "B69"
+      ],
+      "note": "root-added 2026-10-12; GitHub issue #9 review-exits plan (plans/review-exits/plan.md); reviewed_by_waiver status and signed gate.review_waived_all row before block.close; unknown severity is human-only; also amends src/cli/block.mjs, skill/references/review.md, skill/references/ledger.md, docs/how-it-works.md and docs/concepts.md"
+    },
+    "B77": {
+      "title": "Test guard ignores live runs of the developer",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "test/helpers/isolate.mjs",
+        "test/helpers-isolate.test.mjs"
+      ],
+      "depends_on": [
+        "B70"
+      ],
+      "note": "root-added 2026-10-12; tool fix found while building (plans/pipeline.md); leakedEntries: a new path of a run whose record was in the baseline is not a leak; also amends test/no-leak.test.mjs"
+    },
+    "B78": {
+      "title": "Full reviewed text comes back after a restore",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/worker/review-state.mjs",
+        "test/worker/review-state-restore.test.mjs"
+      ],
+      "depends_on": [
+        "B77"
+      ],
+      "note": "root-added 2026-10-12; tool fix found while building (plans/pipeline.md), follows B68 (issue #15); reviewed_content_blob in the signed state_body, git hash-object/cat-file with a discovery ceiling, sha-checked, falls back to B68; also amends src/worker/engine.mjs, skill/references/review.md and skill/references/ledger.md"
+    },
+    "B71": {
+      "title": "review-file --answers: a reviewer judges a fix made in another owned file",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/review/answers.mjs",
+        "test/review/answers.test.mjs"
+      ],
+      "depends_on": [
+        "B78"
+      ],
+      "note": "root-added 2026-10-12; GitHub issue #9 review-exits plan (plans/review-exits/plan.md); answers ticket kind, signed review.answered rows bound to both content hashes, gate counts a still-current answer like a waiver (answered list on gate.review_waived_all), unknown severities fail closed; also amends src/review/gate-check.mjs, src/cli/review-file.mjs, src/cli/block.mjs, src/worker/queue.mjs, src/worker/engine.mjs, src/worker/loop.mjs, skill/references/review.md, skill/references/ledger.md and docs/how-it-works.md"
+    },
+    "B72": {
+      "title": "block reopen: a human restarts a stopped or lost file on new content",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/review/reopen.mjs",
+        "test/review/reopen.test.mjs"
+      ],
+      "depends_on": [
+        "B71"
+      ],
+      "note": "root-added 2026-10-12; GitHub issues #12 and #15 review-exits plan (plans/review-exits/plan.md); human-only verb on CODER_ONLY_FORBIDDEN, signed review.reopened row bound to the latest anchor seq, stop_content_hash in the state, one row per at_seq, L3 rung stays spent; also amends src/cli/block.mjs, src/util/forbidden.mjs, src/worker/engine.mjs, src/worker/queue.mjs, the forbidden-list pin tests, skill/references/review.md, skill/references/ledger.md, skill/references/code.md and docs/how-it-works.md"
+    },
+    "B79": {
+      "title": "Review-exit leftovers: cap-row severity, answers packet secrets and budget, reopen config and write cause",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/review/answers.mjs",
+        "src/review/gate-check.mjs",
+        "src/cli/block.mjs",
+        "src/review/reopen.mjs",
+        "test/review/answers.test.mjs",
+        "test/review/reopen.test.mjs"
+      ],
+      "depends_on": [
+        "B72"
+      ],
+      "note": "root-added 2026-10-12; leftovers from the B71 and B72 round-3 reviews; also amends B71 (answers packet, openAt) and B72 (reopen config, write failure)"
+    },
+    "B73": {
+      "title": "A patch check that closes findings is progress; stop answers name the exits",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/review/fixloop.mjs",
+        "src/review/stop-exits.mjs",
+        "src/cli/review-file.mjs",
+        "src/review/gate-check.mjs",
+        "test/review/patch-progress.test.mjs",
+        "test/worker/fix-list.test.mjs",
+        "test/autopilot/actions.test.mjs",
+        "docs/how-it-works.md",
+        "skill/references/review.md"
+      ],
+      "depends_on": [
+        "B79"
+      ],
+      "note": "root-added 2026-10-12; issue #12 items 9-10; also amends B71 (review-file stopped answer) and the gate review_cap/unreviewed detail"
+    },
+    "B81": {
+      "title": "Deterministic ledger rotation race test",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/ledger/write.mjs",
+        "test/ledger/write.test.mjs"
+      ],
+      "depends_on": [
+        "B73"
+      ],
+      "note": "root-added 2026-10-12; the claimRotatedName two-racers test failed once under full-suite load during the B73 land; an afterLink hook forces the race order"
+    },
+    "B74": {
+      "title": "A deleted owned file is reviewed with a deletion note",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/review/engine.mjs",
+        "src/review/deletion.mjs",
+        "test/worker/deletion-review.test.mjs",
+        "docs/how-it-works.md",
+        "skill/references/review.md"
+      ],
+      "depends_on": [
+        "B81"
+      ],
+      "note": "root-added 2026-10-12; issue #8; the deletion flow already worked end to end (pinned by test); adds the deletion note with bounded reference search"
+    },
+    "B75": {
+      "title": "review-file --fresh re-runs only results that never counted",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/cli/review-file.mjs",
+        "src/worker/queue.mjs",
+        "test/worker/fresh.test.mjs",
+        "test/worker/queue.test.mjs",
+        "skill/references/review.md",
+        "skill/references/code.md"
+      ],
+      "depends_on": [
+        "B74"
+      ],
+      "note": "root-added 2026-10-12; issue #10 item 4; classify the done marker in place, claim only a re-runnable one by atomic rename, restore by link; leftovers in B83"
+    },
+    "B82": {
+      "title": "Deterministic worker restart kill test",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "test/worker/worker.test.mjs"
+      ],
+      "depends_on": [
+        "B75"
+      ],
+      "note": "root-added 2026-10-12; the 'new worker re-reads 3 queued tickets' test checked a killed pid once and failed under load (zombie window); it now waits for ESRCH with a 5 s deadline"
+    },
+    "B76": {
+      "title": "the skill and docs name the review exits in order",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "skill/references/review.md",
+        "skill/references/code.md",
+        "skill/references/security.md",
+        "skill/templates/coder-brief.md",
+        "docs/how-it-works.md",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B75"
+      ],
+      "note": "root-added 2026-10-12; group A docs; exits in order (fix + block reopen, --answers, block waive, re-decompose), block attempt never resets review state, a lost state is rebuilt from the ledger, when --fresh helps"
+    },
+    "B83": {
+      "title": "review-file --fresh fails closed when a marker cannot be restored",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/worker/queue.mjs",
+        "src/cli/review-file.mjs",
+        "test/worker/fresh.test.mjs"
+      ],
+      "depends_on": [
+        "B76"
+      ],
+      "note": "root-added 2026-10-12; B75 leftovers (plans/reviews/b75/r3.txt a-d); a failed link-back writes a refused fresh-restore-failed marker or keeps the claim; a kept claim holds the ticket; block reopen clears claims"
     }
   }
 }