@garygentry/feature-forge 0.2.3 → 0.2.4

package/adapters/copilot/references/stage-exit-protocol.md

@@ -0,0 +1,99 @@
+# Stage Exit Protocol
+
+The single source of truth for how every forge **authoring** stage closes. It
+replaces the old ad-hoc "Next steps:" bullet lists with one fixed, correctly-ordered
+sequence: **verify (if missing or stale) → `/clear` → run the next command.**
+
+Two principles this block encodes (do not relitigate — they are locked product
+decisions):
+
+1. **Clearing is recommended on its own merits at every stage boundary** — a clean
+   start for the next stage — *not* as a proxy for a full context window. Window
+   fullness only changes *how emphatically* the clear is recommended, never *whether*
+   it is.
+2. **Verify happens before the clear, never after.** Verify's clean-room subagent is
+   dispatched from the *current* session, so the findings digest and any fix decision
+   land where the context to act on them still exists. Clearing first throws that
+   context away.
+
+## How this file is used
+
+The blocks below are **stamped verbatim** into each stage skill's closing (a runtime
+`references/` include would not survive the adapter build, which flattens skills into
+`adapters/<agent>/`). A drift-guard test (`tests/test_stage_exit_protocol.py`) asserts
+each stamp site still contains its block, so an edit here must be mirrored into every
+stamp site (and vice-versa).
+
+Each stamp site fills three slots; everything else is identical across sites:
+
+- `{stage}` — the just-completed stage as a lowercase noun phrase (e.g. `the PRD`,
+  `the tech spec`, `the backlog`). Always used mid-sentence, never sentence-initial.
+- `{verify-command}` — the verify command for that stage (e.g.
+  `` `/feature-forge:forge-verify {feature}` ``).
+- `{next-command}` — the command that starts the next stage (e.g.
+  `` `/feature-forge:forge-2-tech {feature}` ``).
+
+`{feature}` / `{epic}` and similar remain runtime placeholders that pass through
+untouched — they are resolved by the skill at run time, not by this template.
+
+## Stamp sites
+
+| Stamp site | Block | `{stage}` |
+|---|---|---|
+| `forge-0-epic` (epic → first PRD) | standard | the epic decomposition |
+| `forge-1-prd` | standard | the PRD |
+| `forge-2-tech` | standard | the tech spec |
+| `forge-3-specs` | standard | the implementation specs |
+| `forge-4-backlog` | standard | the backlog |
+| `forge-5-loop` (step-6 epic-member handoff) | standard | feature `{feature}`'s loop |
+| `forge-5-loop` (all-done closing → docs) | warm | — |
+
+`forge-6-docs` is **terminal** — it stamps no exit block. It is the *target* of the
+warm variant, not a stamp site.
+
+---
+
+## Standard block
+
+Stamp this at every authoring-stage boundary. It self-adapts: step 1's verify gate
+only fires when verification is actually outstanding, so at a boundary where verify
+already ran (or was explicitly skipped, or auto-verify is on) it silently collapses to
+just the `/clear` → next-command steps.
+
+<!-- BEGIN: standard-exit-block -->
+**This stage is done — walk the user through the Stage Exit Protocol** before moving on. The order is fixed, and step 2 is something only the user can do:
+
+1. **Verify {stage} first — if it isn't already verified.** When this stage has no fresh verification on record (`verifyState` is **missing or stale**) **and** `autoVerify` is off for it, verify **now, before clearing**. If verify already ran, is pending under auto-verify, or the stage was explicitly skipped, say so and go straight to step 2. Present the **Standard Verify Gate** using `AskUserQuestion` with exactly these three options — but only when the host has a question mechanism **and** the clean-room path is available (the `Agent` tool plus a dispatchable `forge-verifier` subagent):
+   - **Verify {stage} now** *(recommended)* — dispatch the clean-room `forge-verifier` subagent from this session in require-clean mode; the digest returns here so any fix decision keeps its context. One-time — it does **not** change config.
+   - **Verify now + enable auto-verify going forward** — verify now **and** patch `"autoVerify": true` into `forge.config.json` in place (preserve formatting and every other key) so future stages verify automatically, no prompt. This complements the `forge-init` opt-in. **Do not auto-commit this config change** — treat it like `notes`: a user-facing edit the user commits on their own cadence, never folded into a stage's artifact commit.
+   - **Skip for now** — go straight to `/clear` and the next command without verifying. Record this stage's verify status as `"skipped"` in pipeline state (mirroring the existing skip handling) **only** on an explicit skip — a skip does not go stale.
+
+   **Host / clean-room fallback (not a user-selectable option):** if the question mechanism, the `Agent` tool, or the `forge-verifier` subagent is unavailable, do **not** run clean-room — degrade to printing `{verify-command}` for the user to run inline/manually (mirroring `autoInvokeNextStage`), and offer the auto-verify enable as plain text only if a config write is possible.
+2. **Then `/clear`.** Recommended **unconditionally** at this boundary for a clean start — independent of how full the context window is. Every artifact is on disk, so the work survives the clear. **I can't `/clear` for you — you have to run it yourself.**
+3. **Then run `{next-command}`** in the fresh session — or re-run `/feature-forge:forge` to let the navigator resume from disk.
+<!-- END: standard-exit-block -->
+
+---
+
+## Warm-acceptable variant
+
+Stamp this only at the `forge-5-loop → forge-6-docs` boundary (the all-done result
+report). Here clearing is **optional**: the docs stage benefits from the still-warm
+context of what the loop actually did, and impl-verify is already offered interactively
+by the loop itself, so this block defers rather than re-presenting a gate.
+
+> **Note — no literal `/clear` here.** The warm block lives in `result-reporting.md`, a
+> skill-*own* reference that the adapter build copies **verbatim** (unlike skill bodies,
+> it is not host-term translated), so a literal `/clear` would reach non-Claude adapters
+> undegraded. The warm variant says "clearing is optional" anyway, so it is phrased
+> host-neutrally without the token on purpose — do not reintroduce `/clear` here. (The
+> standard block *does* use `/clear`; that is fine because every standard stamp site is a
+> skill **body**, where `scripts/build-adapters.py` degrades it.)
+
+<!-- BEGIN: warm-exit-block -->
+**The loop is complete — this is the one boundary where clearing before the next stage is optional.**
+
+1. **Verify is already offered above.** Impl-verify is offered interactively right after this report (Step 5b for a standalone feature, Step 6.1 for an epic member) — run it there rather than as a second gate. It runs clean-room, so it needs no fresh session.
+2. **Clearing is optional here — warm is fine.** `forge-6-docs` benefits from the still-warm context of what the loop actually did, so continuing in this same session is the easy default. A cold start also works — every artifact is on disk — but there is no need to force it.
+3. **Then run `{next-command}`** — in this warm session, or a fresh one if you prefer.
+<!-- END: warm-exit-block -->

package/adapters/copilot/scripts/epic-manifest.py

@@ -312,6 +312,16 @@ def atomic_write(path: Path, data: dict) -> None:
             handle.flush()
             os.fsync(handle.fileno())
         os.replace(tmp_path, path)
+        # fsync the parent dir so the rename itself is durable on crash, not just
+        # the file bytes (best-effort — some filesystems reject O_RDONLY dir fsync).
+        try:
+            dir_fd = os.open(parent, os.O_RDONLY)
+            try:
+                os.fsync(dir_fd)
+            finally:
+                os.close(dir_fd)
+        except OSError:
+            pass
     except OSError as exc:
         tmp_path.unlink(missing_ok=True)
         raise UsageError(f"atomic write to {path} failed: {exc}")

package/adapters/copilot/scripts/forge-bootstrap.py

@@ -26,6 +26,8 @@ import argparse
 import json
 import os
 import re
+import shlex
+import shutil
 import subprocess
 import sys
 import tempfile
@@ -281,6 +283,32 @@ def _json_text(obj: object) -> str:
     return json.dumps(obj, indent=2, ensure_ascii=False) + "\n"
 
 
+def contained_path(base: Path, *parts: str) -> Path:
+    """Join ``parts`` onto ``base`` and assert the result stays within ``base``.
+
+    Ports epic-manifest.py's ``contained_path`` guard: canonicalizes (symlink-
+    resolves) both ends and verifies containment so no scaffold write or verify
+    cwd can escape the target repo — defense in depth behind ``_validate_answers``
+    should a crafted member path slip through. Containment violations surface only
+    as exit-2 usage errors.
+
+    Args:
+        base: The containing directory (the target repo root), already known to exist.
+        *parts: Repo-relative segments to append (member path, artifact rel path).
+
+    Returns:
+        The resolved, contained absolute path.
+
+    Raises:
+        UsageError: If the resolved path escapes ``base`` (exit 2).
+    """
+    base_real = base.resolve()
+    resolved = (base_real / Path(*parts)).resolve()
+    if resolved != base_real and base_real not in resolved.parents:
+        raise UsageError(f"path escapes target dir: {os.path.join(*parts)}")
+    return resolved
+
+
 def _atomic_write_text(path: Path, text: str) -> None:
     """Write ``text`` to ``path`` atomically via a same-dir temp file + os.replace.
 
@@ -381,7 +409,7 @@ def run(
 
 
 # --------------------------------------------------------------------------- #
-# Subcommand stubs (filled by later backlog items 003/006/008/009/010)
+# Subcommands: check / scaffold / verify / commit / status (02 §8.2)
 # --------------------------------------------------------------------------- #
 
 
@@ -476,6 +504,7 @@ def _write_artifact(
     """
     if rel_path in sentinel["artifactsWritten"]:
         return
+    contained_path(target, rel_path)  # never write outside the target repo (exit 2)
     dest = target / rel_path
     if dest.exists():
         return
@@ -529,7 +558,7 @@ def _resolve_commands(member: Member) -> tuple[str, str]:
 
 
 def write_config(answers: Answers, target: Path, sentinel: Sentinel) -> None:
-    """Write forge.config.json equivalent to forge-init's output (02 §4.3, 00 §7)."""
+    """Write forge.config.json == forge-init's field set + loopRunner (02 §4.3, 00 §7)."""
     config: dict = {
         "specsDir": "./specs",
         "docsDir": "./docs/architecture",
@@ -540,6 +569,14 @@ def write_config(answers: Answers, target: Path, sentinel: Sentinel) -> None:
         "typeCheckCommand": None,
         "testCommand": None,
         "loopIterationMultiplier": 1.5,
+        # Navigator keys — kept in lockstep with forge-init.sh's emitted field set
+        # (00 §7, REQ-CFG-02) so a bootstrapped config == forge-init's + loopRunner.
+        "autoInvokeNextStage": True,
+        "contextWindowTokens": None,
+        "contextWarnThreshold": 0.7,
+        "autoVerify": False,
+        "autoVerifyStages": {},
+        "autoFix": False,
         "loopRunner": {"name": "rauf", "bin": "rauf"},
     }
     if answers["layout"] == "single":
@@ -697,9 +734,9 @@ def scaffold(target: Path, answers: Answers) -> list[str]:
 def toolchain_present(required: list[str]) -> bool:
     """Return True iff every required tool is on PATH (REQ-LIFE-03).
 
-    Probes each binary with ``command -v`` via the run wrapper (a shell builtin,
-    invoked through ``sh -c``). A single missing tool yields False, driving the
-    distinct missing-toolchain outcome (exit 2, 00 §9): the skill then offers
+    Probes each binary with :func:`shutil.which` (a pure PATH lookup, no shell
+    spawned). A single missing tool yields False, driving the distinct
+    missing-toolchain outcome (exit 2, 00 §9): the skill then offers
     scaffold-anyway-unverified vs abort and marks the baseline unverified
     (REQ-LIFE-04). Bootstrap NEVER installs a toolchain (tech-spec §9).
 
@@ -708,17 +745,10 @@ def toolchain_present(required: list[str]) -> bool:
             already {pm}-substituted.
 
     Returns:
-        True iff ``command -v`` succeeds for every entry.
+        True iff every entry resolves on PATH.
     """
     for tool in required:
-        try:
-            proc = run(["sh", "-c", f"command -v {tool}"], cwd=Path.cwd(), check=False)
-        except UsageError:
-            # The probe itself could not be launched (e.g. an empty PATH leaves no
-            # `sh`): treat that as the tool being absent, the missing-toolchain
-            # outcome, never an internal error (REQ-LIFE-03/04).
-            return False
-        if proc.returncode != 0:
+        if shutil.which(tool) is None:
             return False
     return True
 
@@ -763,9 +793,11 @@ def verify(target: Path, answers: Answers) -> VerifyResult:
     test: list[CommandOutcome] = []
     for member in answers["members"]:
         lint_cmd, test_cmd = _resolve_commands(member)
-        cwd = target / member["path"]
+        cwd = contained_path(target, member["path"])  # never run outside the target
         for bucket, cmd in ((lint, lint_cmd), (test, test_cmd)):
-            proc = run(["sh", "-c", cmd], cwd=cwd, check=False)
+            # STACK_COMMANDS templates with an allow-listed {pm} (see _validate_answers)
+            # — split into an argv token list and run without a shell (no `sh -c`).
+            proc = run(shlex.split(cmd), cwd=cwd, check=False)
             bucket.append(
                 {"command": cmd, "ok": proc.returncode == 0, "member": member["path"]}
             )
@@ -867,9 +899,55 @@ def _parse_answers(raw: str) -> Answers:
         raise UsageError(f"malformed --answers JSON: {exc}")
     if not isinstance(parsed, dict):
         raise UsageError("--answers must be a JSON object")
+    _validate_answers(parsed)
     return parsed
 
 
+def _validate_answers(answers: Answers) -> None:
+    """Reject non-allowlisted stack/packageManager and unsafe member paths (exit 2).
+
+    Runs before any ``{pm}`` substitution, ``STACK_COMMANDS[...]`` subscript, or
+    artifact write so a malformed ``--answers`` payload fails with a stderr
+    diagnostic, never a KeyError traceback or a path escape. Mirrors the
+    input-validation rigor epic-manifest.py applies via ``assert_safe_name`` /
+    ``contained_path``:
+
+    - ``stack`` must be a known :data:`Stack` (a ``STACK_COMMANDS`` key).
+    - ``packageManager`` must be in ``PACKAGE_MANAGERS[stack]`` for a stack that
+      has a choice; stacks with no choice (go/rust/generic) must leave it ``None``.
+    - ``path`` must be a repo-relative string — no absolute path, no ``..``
+      component, no backslash — so it can never resolve outside the target.
+    """
+    members = answers.get("members")
+    if not isinstance(members, list) or not members:
+        raise UsageError("--answers must include a non-empty members[] array")
+    for member in members:
+        stack = member.get("stack")
+        if stack not in STACK_COMMANDS:
+            raise UsageError(
+                f"unknown stack {stack!r}: expected one of {sorted(STACK_COMMANDS)}"
+            )
+        pm = member.get("packageManager")
+        choices = PACKAGE_MANAGERS.get(stack)
+        if choices is not None:
+            if pm not in choices:
+                raise UsageError(
+                    f"invalid packageManager {pm!r} for stack {stack!r}: "
+                    f"expected one of {choices}"
+                )
+        elif pm is not None:
+            raise UsageError(
+                f"stack {stack!r} takes no packageManager, got {pm!r}"
+            )
+        path = member.get("path")
+        if not isinstance(path, str) or not path:
+            raise UsageError(f"member path must be a non-empty string, got {path!r}")
+        if os.path.isabs(path) or "\\" in path or ".." in Path(path).parts:
+            raise UsageError(
+                f"unsafe member path {path!r}: must be repo-relative with no '..'"
+            )
+
+
 def _dispatch(args: argparse.Namespace, target: Path) -> int:
     """Route a parsed command to its handler, translating outcomes into exit codes.
 

package/adapters/copilot/scripts/forge-init.sh

@@ -24,7 +24,10 @@ cat > "$CONFIG_FILE" << 'EOF'
   "loopIterationMultiplier": 1.5,
   "autoInvokeNextStage": true,
   "contextWindowTokens": null,
-  "contextWarnThreshold": 0.7
+  "contextWarnThreshold": 0.7,
+  "autoVerify": false,
+  "autoVerifyStages": {},
+  "autoFix": false
 }
 EOF
 
@@ -43,6 +46,9 @@ echo "  loopIterationMultiplier: 1.5 (multiplier for loop iterations)"
 echo "  autoInvokeNextStage: true (navigator auto-starts the next stage after you confirm)"
 echo "  contextWindowTokens: null (infer; set to 1000000 on a 1M-context model)"
 echo "  contextWarnThreshold: 0.7 (suggest a clean session past this fraction of the window)"
+echo "  autoVerify:          false (set true to run forge-verify automatically after each stage)"
+echo "  autoVerifyStages:    {} (per-stage overrides for autoVerify)"
+echo "  autoFix:             false (set true to chain forge-fix after an auto-verify finds issues)"
 echo ""
 echo "The loop runner defaults to rauf. To target a different ralph-style runner,"
 echo "add a \"loopRunner\" block (see references/forge-config-schema.json)."

package/adapters/copilot/scripts/forge-session.py

@@ -37,7 +37,7 @@ from __future__ import annotations
 import argparse
 import json
 import sys
-from datetime import datetime
+from datetime import datetime, timezone
 from pathlib import Path
 from typing import Final, TypedDict
 
@@ -102,6 +102,10 @@ class FeatureRow(TypedDict):
     nextCommand: str | None
     verifyPending: bool
     verifyCommand: str | None
+    verifyStage: str | None
+    verifyState: str
+    autoVerify: bool
+    autoFix: bool
 
 
 class UsageError(Exception):
@@ -181,13 +185,52 @@ def next_stage(state: dict) -> str | None:
     return None
 
 
-def pending_verify(state: dict) -> str | None:
-    """Return the production stage whose verify is outstanding, if any.
+def _stage_version(state: dict, stage: str) -> int | None:
+    """Return the recorded ``version`` of a stage entry, or None if absent."""
+    stages = state.get("stages")
+    if not isinstance(stages, dict):
+        return None
+    entry = stages.get(stage)
+    if not isinstance(entry, dict):
+        return None
+    version = entry.get("version")
+    return version if isinstance(version, int) else None
+
 
-    The most recently completed production stage whose corresponding
-    ``forge-verify-*`` is neither resolved (passed/findings-applied/skipped) nor
-    already run. Surfaced so the navigator can offer "verify before continuing"
-    as an alternative to advancing. Returns ``None`` when nothing needs verify.
+def _verify_entry(state: dict, verify_key: str) -> dict:
+    """Return the ``forge-verify-*`` entry dict, or ``{}`` if absent."""
+    stages = state.get("stages")
+    if not isinstance(stages, dict):
+        return {}
+    entry = stages.get(verify_key)
+    return entry if isinstance(entry, dict) else {}
+
+
+def verify_state(state: dict) -> tuple[str | None, str]:
+    """Classify verify freshness for the most-recently-completed stage.
+
+    Returns ``(stage, state_label)`` where ``state_label`` is one of:
+
+    - ``fresh``   — verify is resolved AND its ``verifiedStageVersion`` matches the
+      stage's current ``version`` (so no re-verify is needed).
+    - ``stale``   — verify was resolved once, but the stage version has since moved
+      (artifact revised) OR the entry predates the freshness ledger (no
+      ``verifiedStageVersion``). A revised artifact must be re-verified.
+    - ``failing`` — verify ran and reported findings that are not yet applied
+      (``findings-reported``).
+    - ``never``   — the stage completed but verify has not run at all.
+    - ``skipped`` — the user explicitly chose to proceed without verifying. A
+      resolved, non-pending state: it is deliberately NOT re-offered or
+      auto-verified, and (unlike a genuine verification result) it does not go
+      stale on an artifact revision — skip writers record no version to compare
+      against, and re-surfacing would override an explicit human decision.
+    - ``none``    — no completed verify-capable stage (nothing to verify), stage
+      is ``None``.
+
+    Only the most-recent completed production stage is considered, matching the
+    navigator's "verify before continuing" gate. Absent ``verifiedStageVersion``
+    on a ``passed``/``findings-applied`` entry (legacy state) is deliberately
+    treated as ``stale`` — verify rather than skip.
     """
     for stage in reversed(PRODUCTION_STAGES):
         if _stage_status(state, stage) != _DONE_STATUS:
@@ -195,11 +238,41 @@ def pending_verify(state: dict) -> str | None:
         token = VERIFY_TOKEN_BY_STAGE.get(stage)
         if token is None:
             continue  # forge-6-docs has no verify step
-        verify_status = _stage_status(state, f"forge-verify-{token}")
-        if verify_status not in _VERIFY_RESOLVED:
-            return stage
-        return None  # most-recent complete stage is already verified
-    return None
+        entry = _verify_entry(state, f"forge-verify-{token}")
+        status = entry.get("status")
+        if status == "skipped":
+            # An explicit skip is resolved and non-pending — preserve the user's
+            # decision. It never goes stale (no recorded version to compare), so
+            # the freshness check below deliberately does not apply.
+            return stage, "skipped"
+        if status not in _VERIFY_RESOLVED:
+            if status == "findings-reported":
+                return stage, "failing"
+            return stage, "never"
+        verified_version = entry.get("verifiedStageVersion")
+        stage_version = _stage_version(state, stage)
+        if (
+            isinstance(verified_version, int)
+            and stage_version is not None
+            and verified_version == stage_version
+        ):
+            return stage, "fresh"
+        return stage, "stale"
+    return None, "none"
+
+
+def pending_verify(state: dict) -> str | None:
+    """Return the production stage whose verify is outstanding, if any.
+
+    Outstanding means the most-recently-completed production stage's verify is not
+    ``fresh`` (never run, reported findings, or gone stale after an artifact
+    revision). An explicit ``skipped`` is treated as resolved (never outstanding).
+    Surfaced so the navigator can offer "verify before continuing" as an
+    alternative to advancing. Returns ``None`` when the latest stage is fresh,
+    skipped, or there is nothing to verify.
+    """
+    stage, label = verify_state(state)
+    return stage if label not in ("fresh", "none", "skipped") else None
 
 
 def _parse_ts(value: str | None) -> datetime | None:
@@ -207,25 +280,37 @@ def _parse_ts(value: str | None) -> datetime | None:
     if not isinstance(value, str):
         return None
     try:
-        return datetime.fromisoformat(value.replace("Z", "+00:00"))
+        dt = datetime.fromisoformat(value.replace("Z", "+00:00"))
     except ValueError:
         return None
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=timezone.utc)
+    return dt
 
 
-def build_rows(specs_dir: Path) -> list[FeatureRow]:
+def build_rows(specs_dir: Path, config: dict | None = None) -> list[FeatureRow]:
     """Build the recency-ranked active-feature rows (the rank-features payload).
 
     Active features (``pipelineStatus == "active"``, the default when absent) are
     sorted by ``updatedAt`` descending — most recently touched first — so the
     navigator's recency default is row 0.
+
+    ``config`` is the loaded forge.config.json (or ``{}``); it drives the effective
+    ``autoVerify``/``autoFix`` per stage so the navigator can branch without
+    re-reading config.
     """
+    config = config or {}
+    # Fail closed: only a literal JSON ``true`` enables artifact-mutating autoFix.
+    global_auto_fix = config.get("autoFix") is True
     rows: list[FeatureRow] = []
     for name, epic, state in _scan_features(specs_dir):
         status = state.get("pipelineStatus", "active")
         if status != "active":
             continue
         nxt = next_stage(state)
-        verify_stage = pending_verify(state)
+        vstage, vlabel = verify_state(state)
+        verify_pending = vstage is not None and vlabel not in ("fresh", "none", "skipped")
+        effective_auto_verify = auto_verify_for(config, vstage) if vstage else False
         branch = state.get("branch")
         updated = state.get("updatedAt")
         rows.append({
@@ -237,12 +322,16 @@ def build_rows(specs_dir: Path) -> list[FeatureRow]:
             "complete": nxt is None,
             "nextStage": nxt,
             "nextCommand": f"/feature-forge:{nxt} {name}" if nxt else None,
-            "verifyPending": verify_stage is not None,
-            "verifyCommand": f"/feature-forge:forge-verify {name}" if verify_stage else None,
+            "verifyPending": verify_pending,
+            "verifyCommand": f"/feature-forge:forge-verify {name}" if verify_pending else None,
+            "verifyStage": vstage,
+            "verifyState": vlabel,
+            "autoVerify": effective_auto_verify,
+            "autoFix": global_auto_fix and effective_auto_verify,
         })
     # Sort by updatedAt desc; rows without a parseable timestamp sort last.
     rows.sort(
-        key=lambda r: (_parse_ts(r["updatedAt"]) or datetime.min.replace(tzinfo=None)),
+        key=lambda r: (_parse_ts(r["updatedAt"]) or datetime.min.replace(tzinfo=timezone.utc)),
         reverse=True,
     )
     return rows
@@ -308,12 +397,17 @@ def _last_usage(transcript: Path) -> tuple[int, str | None] | None:
         usage = message.get("usage") if isinstance(message, dict) else record.get("usage")
         if not isinstance(usage, dict):
             continue
-        total = (
-            int(usage.get("input_tokens", 0) or 0)
-            + int(usage.get("cache_creation_input_tokens", 0) or 0)
-            + int(usage.get("cache_read_input_tokens", 0) or 0)
-            + int(usage.get("output_tokens", 0) or 0)
-        )
+        # A malformed transcript may carry a non-numeric usage field; skip that
+        # record rather than crash the whole context-usage read (ValueError/TypeError).
+        try:
+            total = (
+                int(usage.get("input_tokens", 0) or 0)
+                + int(usage.get("cache_creation_input_tokens", 0) or 0)
+                + int(usage.get("cache_read_input_tokens", 0) or 0)
+                + int(usage.get("output_tokens", 0) or 0)
+            )
+        except (TypeError, ValueError):
+            continue
         if total <= 0:
             continue
         model = message.get("model") if isinstance(message, dict) else record.get("model")
@@ -328,13 +422,53 @@ def _infer_window(model: str | None) -> int:
     return _DEFAULT_WINDOW
 
 
-def _config_value(config_path: Path, key: str):
-    """Read a single key from forge.config.json, or None if absent/unreadable."""
+def _load_config(config_path: Path) -> dict:
+    """Read forge.config.json into a dict, tolerating missing/corrupt files.
+
+    A missing, unreadable, or non-object config downgrades to ``{}`` so callers
+    read every key through absent-safe ``.get`` defaults.
+    """
     try:
         config = json.loads(config_path.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError):
-        return None
-    return config.get(key) if isinstance(config, dict) else None
+        return {}
+    return config if isinstance(config, dict) else {}
+
+
+def _config_value(config_path: Path, key: str):
+    """Read a single key from forge.config.json, or None if absent/unreadable."""
+    return _load_config(config_path).get(key)
+
+
+def auto_verify_for(config: dict, stage: str) -> bool:
+    """Return the effective auto-verify setting for ``stage``.
+
+    Per-stage override in ``autoVerifyStages`` wins over the global ``autoVerify``;
+    both default to off, so a config with neither key means "no auto-verify".
+
+    Parsing is strict and **fails closed**: only a literal JSON ``true`` enables
+    auto-verify. A non-boolean value (e.g. the string ``"false"``, which is truthy
+    in Python) is treated as off, not on. The schema already rejects non-booleans
+    at author time; this guards a hand-edited config from silently enabling
+    automation.
+    """
+    stages = config.get("autoVerifyStages")
+    if isinstance(stages, dict) and stage in stages:
+        return stages[stage] is True
+    return config.get("autoVerify") is True
+
+
+def invalid_auto_verify_keys(config: dict) -> list[str]:
+    """Return ``autoVerifyStages`` keys outside the verify-capable stage ids.
+
+    An unknown/typo key (e.g. ``forge-1-prod``) would silently never take effect,
+    turning an intended off-switch into a no-op. Surfacing it lets the navigator
+    warn instead of failing quietly. Mirrors the schema's ``propertyNames.enum``.
+    """
+    stages = config.get("autoVerifyStages")
+    if not isinstance(stages, dict):
+        return []
+    return [key for key in stages if key not in VERIFY_TOKEN_BY_STAGE]
 
 
 def context_usage(
@@ -449,6 +583,7 @@ def main() -> int:
 
     p_rank = sub.add_parser("rank-features", help="Rank active features by recency")
     p_rank.add_argument("--specs-dir", default="./specs", help="Specs directory")
+    p_rank.add_argument("--config", default="./forge.config.json", help="forge.config.json path")
     p_rank.add_argument("--json", action="store_true", dest="json_output")
 
     p_ctx = sub.add_parser("context-usage", help="Report live context-window usage")
@@ -462,12 +597,22 @@ def main() -> int:
     try:
         if args.cmd == "rank-features":
             specs_dir = Path(args.specs_dir)
-            rows = build_rows(specs_dir)
+            config = _load_config(Path(args.config))
+            rows = build_rows(specs_dir, config)
             counts = _counts(specs_dir)
+            invalid_keys = invalid_auto_verify_keys(config)
             if args.json_output:
-                print(json.dumps({"active": rows, "counts": counts}, indent=2, ensure_ascii=False))
+                payload = {"active": rows, "counts": counts}
+                if invalid_keys:
+                    payload["invalidAutoVerifyKeys"] = invalid_keys
+                print(json.dumps(payload, indent=2, ensure_ascii=False))
             else:
                 _print_rank_table(rows, counts)
+                if invalid_keys:
+                    print(
+                        "  ! invalid autoVerifyStages keys (ignored): "
+                        + ", ".join(invalid_keys)
+                    )
             return 0
 
         if args.cmd == "context-usage":