forge-orkes 0.55.0 → 0.58.2

package/template/.claude/hooks/tests/forge-release-fold.test.sh

@@ -0,0 +1,773 @@
+#!/usr/bin/env sh
+# Fixture-repo test suite for .claude/hooks/forge-release-fold.sh (m-30, plan 50-01).
+#
+# Contract under test (plan-01 "Locked interface" — do not re-derive):
+#   forge-release-fold.sh <unit-id> [--sha <sha>] [--main <ref>] [--project <path>]
+#   stdout: release_state=unmerged|merged|validated [reason=<code>]
+#           reason codes: not-on-main | no-approval | no-signoff | bad-signature |
+#                         not-contained | legacy-complete | signed-off
+#   exit:   0 = computed (ANY of the three states — unmerged is an answer, not an
+#           error); 2 = bad invocation / unknown unit (never a false verdict).
+#   Landed-sha resolution when --sha absent: (1) live branch recorded for the unit
+#   (main-tree state/milestone-{id}.yml lifecycle.worktree_branch, else main-tree
+#   streams/m-{id}.yml runtime.branch) → branch tip; (2) tracked-only → the LAST
+#   COMMIT TOUCHING the state file on main, NEVER main's tip; (3) unknown → exit 2.
+#   All YAML field reads go through `git show main:...` — never the working tree.
+#
+# Builds throwaway git repos in mktemp dirs with NO remote configured anywhere —
+# the whole suite is offline by construction (NFR-030). SSH-signed signoff tags
+# reuse the key-gen pattern from verify-signoff.test.sh. Needs ssh-keygen + git
+# with SSH signing support (git >= 2.34).
+#
+# Usage:
+#   ./.claude/hooks/tests/forge-release-fold.test.sh             # all cases
+#   ./.claude/hooks/tests/forge-release-fold.test.sh ordering    # ordering controls
+# Filter tags (one arg, selects matching case blocks):
+#   unmerged merged grandfather human-verified signoff-tag stored-field
+#   exit-2 stable-sha ordering promotion forgery
+# `promotion` + `forgery` (plan 51-01): validation_event=promotion_approval —
+# a CI-signed tag on a deploy sha CONTAINING the unit's landed sha validates;
+# tag deletion reverts; unsigned/wrong-key lookalikes and non-containing tags
+# never validate. Tag pattern FROZEN 2026-07-16: promotion/{sha} (full deploy
+# sha) — Track B must emit it byte-exactly.
+# `ordering` maps to plan truth check 3: the unmerged/merged/validated ladder can
+# never skip (unmerged never renders merged/validated; merged never validated).
+#
+# RED-phase friendly (TDD): a missing/non-executable helper does NOT abort the
+# suite — every selected case FAILS with "(helper missing ...)" as the got-value
+# and the suite exits non-zero. No FATAL short-circuit on the script under test.
+# Exits 0 iff every selected case passes. Self-cleans on exit.
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/../forge-release-fold.sh"
+
+command -v ssh-keygen >/dev/null 2>&1 || { printf 'FATAL: ssh-keygen not found\n' >&2; exit 1; }
+
+[ -x "$HELPER" ] || printf 'NOTE: %s missing or not executable — RED phase, every selected case below should FAIL\n' "$HELPER" >&2
+
+ROOT="$(mktemp -d)"
+trap 'rm -rf "$ROOT"' EXIT INT TERM
+
+# Isolate from the developer's global/system git config — no $HOME leakage into
+# fixture repos or into the helper's git invocations.
+GIT_CONFIG_GLOBAL=/dev/null
+GIT_CONFIG_SYSTEM=/dev/null
+export GIT_CONFIG_GLOBAL GIT_CONFIG_SYSTEM
+
+PASSED=0
+FAILED=0
+SELECTED=0
+FILTER="${1:-}"
+
+pass() { PASSED=$((PASSED + 1)); printf 'PASS: %s\n' "$1"; }
+fail() { FAILED=$((FAILED + 1)); printf 'FAIL: %s\n' "$1" >&2; }
+check() { # desc, actual, expected (exact match)
+  if [ "$2" = "$3" ]; then pass "$1"; else fail "$1 (got '$2', want '$3')"; fi
+}
+check_prefix() { # desc, actual, expected-prefix
+  case "$2" in
+    "$3"*) pass "$1" ;;
+    *) fail "$1 (got '$2', want prefix '$3')" ;;
+  esac
+}
+check_absent() { # desc, actual, forbidden-substring
+  case "$2" in
+    *"$3"*) fail "$1 (got '$2', must NOT contain '$3')" ;;
+    *) pass "$1" ;;
+  esac
+}
+
+running() { # tag... — 0 if this case block is selected by $FILTER (empty = all)
+  if [ -z "$FILTER" ]; then SELECTED=$((SELECTED + 1)); return 0; fi
+  for _t in "$@"; do
+    if [ "$_t" = "$FILTER" ]; then SELECTED=$((SELECTED + 1)); return 0; fi
+  done
+  return 1
+}
+
+# Run the helper from a given cwd; sets OUT (stdout) and RC (exit code). When the
+# helper is absent (RED phase) each assertion fails with a clear got-value instead
+# of the suite aborting.
+run_fold() { # cwd, helper-args...
+  rf_cwd="$1"; shift
+  if [ -x "$HELPER" ]; then
+    if OUT="$(cd "$rf_cwd" && "$HELPER" "$@" 2>/dev/null)"; then RC=0; else RC=$?; fi
+  else
+    OUT="(helper missing or not executable: $HELPER)"
+    RC=127
+  fi
+}
+
+# One allowed-signer keypair (the "operator") + one non-allowed keypair (the
+# "agent") shared across cases — the verify-signoff.test.sh pattern.
+gen_key() { # path, comment
+  ssh-keygen -t ed25519 -N "" -C "$2" -f "$1" -q
+}
+gen_key "$ROOT/operator_key" "operator@example.com"
+gen_key "$ROOT/agent_key" "agent@example.com"
+gen_key "$ROOT/ci_key" "ci@example.com"
+
+allowed_signers="$ROOT/allowed_signers"
+printf 'operator@example.com namespaces="git" %s\n' "$(cat "$ROOT/operator_key.pub")" > "$allowed_signers"
+
+# Promotion signers: the CI key ONLY (the host-side, Environment-scoped key).
+# agent_key stays out — it is the rogue key for the forgery neg controls.
+promotion_signers="$ROOT/promotion_signers"
+printf 'ci@example.com namespaces="git" %s\n' "$(cat "$ROOT/ci_key.pub")" > "$promotion_signers"
+
+evidence="cafef00d5511c0deba5eba11cafef00d5511c0deba5eba11cafef00d5511c0de"
+
+# NO `git remote add` anywhere in this suite: fixtures are remote-less by
+# construction, so any network dependency in the fold breaks here (NFR-030).
+new_repo() { # name → prints repo path (main branch, one root commit)
+  d="$ROOT/repo.$1"
+  mkdir -p "$d"
+  git -C "$d" init -q
+  git -C "$d" symbolic-ref HEAD refs/heads/main
+  git -C "$d" config user.email t@example.com
+  git -C "$d" config user.name tester
+  git -C "$d" commit --allow-empty -qm init
+  printf '%s\n' "$d"
+}
+
+write_milestone() { # repo, N, yaml-body — writes + commits .forge/state/milestone-N.yml on the current branch
+  mkdir -p "$1/.forge/state"
+  printf '%s\n' "$3" > "$1/.forge/state/milestone-$2.yml"
+  git -C "$1" add ".forge/state/milestone-$2.yml"
+  git -C "$1" commit -qm "chore(forge): state milestone-$2"
+}
+
+write_stream() { # repo, unit-id (m-N), branch — commits .forge/streams/m-N.yml with runtime.branch
+  mkdir -p "$1/.forge/streams"
+  printf 'version: 1\n\nstream:\n  id: %s\n  status: active\n  milestone: %s\n\nruntime:\n  branch: %s\n  worktree: ""\n' \
+    "$2" "$2" "$3" > "$1/.forge/streams/$2.yml"
+  git -C "$1" add ".forge/streams/$2.yml"
+  git -C "$1" commit -qm "chore(forge): stream $2"
+}
+
+mint_tag() { # repo, unit-id, signing-key, head, evidence — SSH-signed signoff/<unit-id>
+  git -C "$1" -c gpg.format=ssh -c "user.signingkey=$3" \
+    tag -s "signoff/$2" -m "wu: $2
+head: $4
+evidence: $5"
+}
+
+landed_sha() { # repo, N — last commit touching the unit's state file on main (the contract's stable identity)
+  git -C "$1" log -1 --format=%H main -- ".forge/state/milestone-$2.yml"
+}
+
+# --- promotion_approval fixture helpers (plan 51-01) ---------------------------
+
+# write_promotion_binding <repo> <signers-path> — the locked B3 binding shape,
+# working-tree project.yml (the mode file is a working-tree read by design;
+# protected-path-held per the contract). Tag pattern FROZEN: promotion/{sha}.
+write_promotion_binding() {
+  mkdir -p "$1/.forge"
+  cat > "$1/.forge/project.yml" <<EOF
+forge:
+  validation_event: promotion_approval
+  promotion:
+    tag_pattern: "promotion/{sha}"
+    allowed_signers: "$2"
+EOF
+}
+
+# mint_promotion_tag <repo> <deploy-sha> <signing-key> — SSH-signed
+# promotion/<deploy-sha> pointing AT the deploy sha. The tag's target commit +
+# containment IS the binding — no extra metadata (no head:/evidence: lines).
+mint_promotion_tag() {
+  git -C "$1" -c gpg.format=ssh -c "user.signingkey=$3" \
+    tag -s "promotion/$2" -m "promotion: approved deploy $2" "$2"
+}
+
+# advance_main <repo> <msg> — one unrelated commit on main; prints the new tip
+# (a deploy point containing everything landed so far).
+advance_main() {
+  printf '%s\n' "$2" >> "$1/DEPLOY.txt"
+  git -C "$1" add DEPLOY.txt
+  git -C "$1" commit -qm "$2"
+  git -C "$1" rev-parse main
+}
+
+# --- case 1: unmerged — live branch not ancestor of main --------------------
+if running unmerged ordering; then
+  printf '\n--- case 1: unmerged (live branch not ancestor of main) ---\n'
+  d="$(new_repo unmerged)"
+  write_milestone "$d" 91 'milestone:
+  id: 91
+  name: "fixture: unmerged unit"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active
+  worktree_branch: "forge/m-91"'
+  git -C "$d" checkout -qb forge/m-91
+  git -C "$d" commit --allow-empty -qm "work on forge/m-91 (never merged)"
+  git -C "$d" checkout -q main
+  check "fixture repo has no remote (offline by construction)" "$(git -C "$d" remote)" ""
+  run_fold "$d" m-91
+  check "unmerged: exit 0 (a computed state, not an error)" "$RC" "0"
+  check "unmerged: stdout" "$OUT" "release_state=unmerged reason=not-on-main"
+
+  # Ordering negative control: the main-tree file LOOKS validated (complete +
+  # populated human_verified) but the unit's live branch never landed on main →
+  # still unmerged. validated REQUIRES merged — checked first, always. The live
+  # branch resolves via streams/m-92.yml runtime.branch (the `else` route of
+  # resolution rule 1: no lifecycle.worktree_branch in the state file).
+  d2="$(new_repo unmerged-control)"
+  write_milestone "$d2" 92 'milestone:
+  id: 92
+  name: "fixture: unmerged unit with validation-looking YAML"
+
+current:
+  tier: standard
+  status: complete
+  completed_at: "2026-07-10"
+  last_updated: "2026-07-10"
+  human_verified:
+    at: "2026-07-10"
+    method: "smoke test"
+    notes: "looks signed off — but the branch never landed"
+
+lifecycle:
+  worktree_mode: active'
+  write_stream "$d2" m-92 forge/m-92
+  git -C "$d2" checkout -qb forge/m-92
+  git -C "$d2" commit --allow-empty -qm "work on forge/m-92 (never merged)"
+  git -C "$d2" checkout -q main
+  run_fold "$d2" m-92
+  check "ordering control: exit 0" "$RC" "0"
+  check "ordering control: unmerged despite complete+human_verified in main tree" "$OUT" "release_state=unmerged reason=not-on-main"
+fi
+
+# --- case 2: merged but not validated ----------------------------------------
+if running merged ordering; then
+  printf '\n--- case 2: merged-but-not-validated (no approval artifact) ---\n'
+  d="$(new_repo merged)"
+  write_milestone "$d" 93 'milestone:
+  id: 93
+  name: "fixture: merged unit, no approval"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active
+  worktree_branch: "forge/m-93"'
+  git -C "$d" checkout -qb forge/m-93
+  git -C "$d" commit --allow-empty -qm "work on forge/m-93"
+  git -C "$d" checkout -q main
+  git -C "$d" merge -q --no-ff -m "merge forge/m-93" forge/m-93
+  run_fold "$d" m-93
+  check "merged: exit 0" "$RC" "0"
+  check "merged: stdout (never validated without approval)" "$OUT" "release_state=merged reason=no-signoff"
+
+  # --project <path>: same answer when invoked from outside the repo.
+  run_fold "$ROOT" m-93 --project "$d"
+  check "merged via --project from outside: exit 0" "$RC" "0"
+  check "merged via --project from outside: stdout" "$OUT" "release_state=merged reason=no-signoff"
+fi
+
+# --- case 3: legacy-complete grandfather --------------------------------------
+if running grandfather ordering; then
+  printf '\n--- case 3: legacy-complete grandfather (complete, no tag, no human_verified) ---\n'
+  d="$(new_repo grandfather)"
+  write_milestone "$d" 1 'milestone:
+  id: 1
+  name: "fixture: pre-gate closed milestone"
+
+current:
+  tier: standard
+  status: complete
+  completed_at: "2025-11-01"
+  last_updated: "2025-11-01"
+
+lifecycle:
+  worktree_mode: retired'
+  run_fold "$d" m-1
+  check "grandfather: exit 0" "$RC" "0"
+  check "grandfather: stdout" "$OUT" "release_state=validated reason=legacy-complete"
+
+  # Explicit `human_verified: null` is NOT "set" — still the grandfather route.
+  write_milestone "$d" 2 'milestone:
+  id: 2
+  name: "fixture: closed milestone with explicit null human_verified"
+
+current:
+  tier: standard
+  status: complete
+  completed_at: "2025-12-01"
+  last_updated: "2025-12-01"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: retired'
+  run_fold "$d" m-2
+  check "grandfather (human_verified: null): exit 0" "$RC" "0"
+  check "grandfather (human_verified: null): reason stays legacy-complete" "$OUT" "release_state=validated reason=legacy-complete"
+fi
+
+# --- case 4: human_verified set, not yet complete ------------------------------
+if running human-verified; then
+  printf '\n--- case 4: human_verified populated, status not complete ---\n'
+  d="$(new_repo human-verified)"
+  write_milestone "$d" 4 'milestone:
+  id: 4
+  name: "fixture: human-verified unit still in reviewing"
+
+current:
+  tier: standard
+  status: reviewing
+  last_updated: "2026-07-16"
+  human_verified:
+    at: "2026-07-16"
+    method: "device smoke test"
+    notes: "operator walked the flow"
+
+lifecycle:
+  worktree_mode: active'
+  run_fold "$d" m-4
+  check "human_verified: exit 0" "$RC" "0"
+  check_prefix "human_verified: validated" "$OUT" "release_state=validated"
+fi
+
+# --- case 5: SSH-signed signoff tag, allowed vs non-allowed key ----------------
+if running signoff-tag; then
+  printf '\n--- case 5: signoff tag (operator-signed vs wrong key) ---\n'
+  # 5a: operator-signed signoff/<id> at the landed sha → validated reason=signed-off
+  d="$(new_repo signoff)"
+  git -C "$d" config gpg.ssh.allowedSignersFile "$allowed_signers"
+  write_milestone "$d" 95 'milestone:
+  id: 95
+  name: "fixture: signed-off unit"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active'
+  landed="$(landed_sha "$d" 95)"
+  mint_tag "$d" m-95 "$ROOT/operator_key" "$landed" "$evidence"
+  run_fold "$d" m-95
+  check "signed tag: exit 0" "$RC" "0"
+  check "signed tag: stdout" "$OUT" "release_state=validated reason=signed-off"
+
+  # 5b: same shape, tag signed by a NON-allowed key, no YAML fallback → the tag
+  # route must not validate; the unit stays merged.
+  d2="$(new_repo signoff-badkey)"
+  git -C "$d2" config gpg.ssh.allowedSignersFile "$allowed_signers"
+  write_milestone "$d2" 96 'milestone:
+  id: 96
+  name: "fixture: lookalike tag from a non-allowed key"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active'
+  landed2="$(landed_sha "$d2" 96)"
+  mint_tag "$d2" m-96 "$ROOT/agent_key" "$landed2" "$evidence"
+  run_fold "$d2" m-96
+  check "wrong-key tag (no fallback): exit 0" "$RC" "0"
+  check_prefix "wrong-key tag (no fallback): merged, never validated" "$OUT" "release_state=merged"
+
+  # 5c: wrong-key tag but human_verified IS set in the main tree → validated via
+  # the YAML route — and never attributed to the tag (reason=signed-off forbidden).
+  d3="$(new_repo signoff-badkey-fallback)"
+  git -C "$d3" config gpg.ssh.allowedSignersFile "$allowed_signers"
+  write_milestone "$d3" 97 'milestone:
+  id: 97
+  name: "fixture: wrong-key tag with a real human_verified fallback"
+
+current:
+  tier: standard
+  status: reviewing
+  last_updated: "2026-07-16"
+  human_verified:
+    at: "2026-07-16"
+    method: "device smoke test"
+    notes: "verified in session"
+
+lifecycle:
+  worktree_mode: active'
+  landed3="$(landed_sha "$d3" 97)"
+  mint_tag "$d3" m-97 "$ROOT/agent_key" "$landed3" "$evidence"
+  run_fold "$d3" m-97
+  check "wrong-key tag (YAML fallback): exit 0" "$RC" "0"
+  check_prefix "wrong-key tag (YAML fallback): validated via YAML route" "$OUT" "release_state=validated"
+  check_absent "wrong-key tag (YAML fallback): never reason=signed-off" "$OUT" "reason=signed-off"
+fi
+
+# --- case 6: a stored release_state field cannot stick -------------------------
+if running stored-field; then
+  printf '\n--- case 6: stored release_state ignored; main-tree reads only ---\n'
+  d="$(new_repo stored-field)"
+  write_milestone "$d" 61 'milestone:
+  id: 61
+  name: "fixture: adversarial stored release_state"
+
+release_state: validated
+
+current:
+  tier: standard
+  status: executing
+  release_state: validated
+  last_updated: "2026-07-16"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active'
+  run_fold "$d" m-61
+  check "stored field: exit 0" "$RC" "0"
+  check "stored field: recomputed from git truth, stored value ignored" "$OUT" "release_state=merged reason=no-signoff"
+
+  # 6b: working-tree tamper — an uncommitted edit flips status + human_verified.
+  # The fold reads `git show main:...`, so the render must not change (an
+  # agent-writable working tree must not flip the result).
+  printf 'current:\n  status: complete\n  human_verified:\n    at: "2026-07-16"\n    method: "tampered"\n    notes: "uncommitted working-tree edit"\n' \
+    > "$d/.forge/state/milestone-61.yml"
+  run_fold "$d" m-61
+  check "working-tree tamper: exit 0" "$RC" "0"
+  check "working-tree tamper: main-tree read unchanged" "$OUT" "release_state=merged reason=no-signoff"
+fi
+
+# --- case 7: exit 2 — never a false verdict ------------------------------------
+if running exit-2; then
+  printf '\n--- case 7: exit 2 on unknown unit / bad invocation ---\n'
+  d="$(new_repo exit2)"
+  run_fold "$d" m-404
+  check "unknown unit: exit 2" "$RC" "2"
+  check_absent "unknown unit: no verdict on stdout" "$OUT" "release_state="
+
+  write_milestone "$d" 70 'milestone:
+  id: 70
+  name: "fixture: known unit for flag parsing"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null'
+  run_fold "$d" m-70 --bogus
+  check "bad flag: exit 2" "$RC" "2"
+  check_absent "bad flag: no verdict on stdout" "$OUT" "release_state="
+
+  run_fold "$d"
+  check "no unit-id: exit 2" "$RC" "2"
+  check_absent "no unit-id: no verdict on stdout" "$OUT" "release_state="
+fi
+
+# --- case 8: stable landed sha (anti-flap, operator ruling 2026-07-16) ----------
+if running stable-sha; then
+  printf '\n--- case 8: landed sha is stable — advancing main must not flap the state ---\n'
+  d="$(new_repo stable-sha)"
+  git -C "$d" config gpg.ssh.allowedSignersFile "$allowed_signers"
+  write_milestone "$d" 80 'milestone:
+  id: 80
+  name: "fixture: tracked unit, signed at its landed sha"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active'
+  landed="$(landed_sha "$d" 80)"
+  mint_tag "$d" m-80 "$ROOT/operator_key" "$landed" "$evidence"
+  run_fold "$d" m-80
+  check "stable sha (before advance): exit 0" "$RC" "0"
+  check "stable sha (before advance): signed-off at the landed sha" "$OUT" "release_state=validated reason=signed-off"
+
+  # Advance main with an unrelated commit. The unit's landed sha must remain the
+  # last commit touching ITS state file — never main's moving tip. A tip-resolving
+  # fold flaps here: the tag's head: no longer matches → tag route dies → merged.
+  printf 'unrelated\n' > "$d/UNRELATED.txt"
+  git -C "$d" add UNRELATED.txt
+  git -C "$d" commit -qm "unrelated: advance main past the landed sha"
+  run_fold "$d" m-80
+  check "stable sha (after advance): exit 0" "$RC" "0"
+  check "stable sha (after advance): still signed-off — identity did not move" "$OUT" "release_state=validated reason=signed-off"
+
+  # Same anti-flap for a plain merged unit: state + reason unchanged across the advance.
+  write_milestone "$d" 81 'milestone:
+  id: 81
+  name: "fixture: tracked merged unit, no approval"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null'
+  run_fold "$d" m-81
+  check "stable sha (merged unit, before advance): exit 0" "$RC" "0"
+  check "stable sha (merged unit, before advance): stdout" "$OUT" "release_state=merged reason=no-signoff"
+  printf 'more\n' >> "$d/UNRELATED.txt"
+  git -C "$d" add UNRELATED.txt
+  git -C "$d" commit -qm "unrelated: advance main again"
+  run_fold "$d" m-81
+  check "stable sha (merged unit, after advance): exit 0" "$RC" "0"
+  check "stable sha (merged unit, after advance): unchanged" "$OUT" "release_state=merged reason=no-signoff"
+fi
+
+# --- case 9: promotion_approval — CI-signed containing tag validates ------------
+if running promotion; then
+  printf '\n--- case 9: promotion_approval (containment; delete reverts; isolation; anti-flap) ---\n'
+  # 9a: positive — unit landed sha CONTAINED IN a deploy sha carrying a genuine
+  # CI-signed promotion tag → validated. Containment, not tip-equality (operator
+  # ruling 2026-07-16): the tag approves a deploy; every unit inside it is covered.
+  d="$(new_repo promotion)"
+  write_milestone "$d" 101 'milestone:
+  id: 101
+  name: "fixture: promotion-approved unit"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active'
+  landed="$(landed_sha "$d" 101)"
+  deploy="$(advance_main "$d" "deploy: ship it")"
+  mint_promotion_tag "$d" "$deploy" "$ROOT/ci_key"
+  write_promotion_binding "$d" "$promotion_signers"
+  check "promotion fixture has no remote (offline by construction)" "$(git -C "$d" remote)" ""
+  run_fold "$d" m-101
+  check "promotion positive: exit 0" "$RC" "0"
+  check_prefix "promotion positive: validated via containing CI-signed tag" "$OUT" "release_state=validated"
+
+  # 9b: delete-reverts (acceptance 2) — the operator deletes the tag, re-runs,
+  # and the same unit reverts to merged. Nothing stored anywhere to un-stick.
+  git -C "$d" tag -d "promotion/$deploy" >/dev/null 2>&1
+  run_fold "$d" m-101
+  check "delete-reverts: exit 0" "$RC" "0"
+  check "delete-reverts: merged reason=no-approval" "$OUT" "release_state=merged reason=no-approval"
+
+  # 9c: not-contained — a genuinely signed tag whose deploy commit does NOT
+  # contain the unit's landed sha (sibling history) must not validate it.
+  d2="$(new_repo promotion-notcontained)"
+  base="$(git -C "$d2" rev-parse main)"
+  write_milestone "$d2" 103 'milestone:
+  id: 103
+  name: "fixture: unit outside the approved deploy"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active'
+  git -C "$d2" checkout -qb sibling "$base"
+  git -C "$d2" commit --allow-empty -qm "sibling deploy line (does not contain the unit)"
+  sibling_sha="$(git -C "$d2" rev-parse sibling)"
+  git -C "$d2" checkout -q main
+  mint_promotion_tag "$d2" "$sibling_sha" "$ROOT/ci_key"
+  write_promotion_binding "$d2" "$promotion_signers"
+  run_fold "$d2" m-103
+  check "not-contained: exit 0" "$RC" "0"
+  check "not-contained: merged reason=not-contained" "$OUT" "release_state=merged reason=not-contained"
+  check_absent "not-contained: never validated" "$OUT" "release_state=validated"
+
+  # 9d: binding-absent isolation — same repo shape, genuine containing signed
+  # tag, but NO promotion binding → in_session_signoff routes apply and the
+  # promotion tag alone must NOT validate a default-binding repo.
+  d3="$(new_repo promotion-nobinding)"
+  write_milestone "$d3" 104 'milestone:
+  id: 104
+  name: "fixture: promotion tag on a default-binding repo"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active'
+  deploy3="$(advance_main "$d3" "deploy: ship it")"
+  mint_promotion_tag "$d3" "$deploy3" "$ROOT/ci_key"
+  # no project.yml written — validation_event absent ⇒ in_session_signoff
+  run_fold "$d3" m-104
+  check "binding-absent: exit 0" "$RC" "0"
+  check "binding-absent: promotion tag alone does not validate (no-signoff)" "$OUT" "release_state=merged reason=no-signoff"
+  check_absent "binding-absent: never validated" "$OUT" "release_state=validated"
+
+  # 9e: anti-flap (the ruling's motivating case) — validate via a containing
+  # signed tag, then advance main PAST the promotion with unrelated commits.
+  # Containment is stable forever; tip-equality would flap validated off here.
+  d4="$(new_repo promotion-antiflap)"
+  write_milestone "$d4" 105 'milestone:
+  id: 105
+  name: "fixture: promoted unit, main advances afterwards"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active'
+  deploy4="$(advance_main "$d4" "deploy: ship it")"
+  mint_promotion_tag "$d4" "$deploy4" "$ROOT/ci_key"
+  write_promotion_binding "$d4" "$promotion_signers"
+  run_fold "$d4" m-105
+  check "anti-flap (at promotion): exit 0" "$RC" "0"
+  check_prefix "anti-flap (at promotion): validated" "$OUT" "release_state=validated"
+  first_out="$OUT"
+  advance_main "$d4" "unrelated: main moves past the promotion" >/dev/null
+  advance_main "$d4" "unrelated: and again" >/dev/null
+  run_fold "$d4" m-105
+  check "anti-flap (after advance): exit 0" "$RC" "0"
+  check_prefix "anti-flap (after advance): STILL validated — containment is stable" "$OUT" "release_state=validated"
+  check "anti-flap (after advance): render is identical, no flap" "$OUT" "$first_out"
+fi
+
+# --- case 10: forgery neg controls — lookalike tags compute nothing -------------
+if running forgery; then
+  printf '\n--- case 10: forgery (unsigned / lightweight / wrong-key lookalikes) ---\n'
+  # 10a: annotated-but-UNSIGNED lookalike tag at a genuine deploy point →
+  # verification fails → merged reason=bad-signature; validated is impossible.
+  d="$(new_repo forgery-unsigned)"
+  write_milestone "$d" 111 'milestone:
+  id: 111
+  name: "fixture: unsigned lookalike promotion tag"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active'
+  deploy="$(advance_main "$d" "deploy: ship it")"
+  git -C "$d" tag -a "promotion/$deploy" -m "promotion: approved deploy $deploy" "$deploy"
+  write_promotion_binding "$d" "$promotion_signers"
+  run_fold "$d" m-111
+  check "forgery-unsigned (annotated): exit 0" "$RC" "0"
+  check "forgery-unsigned (annotated): merged reason=bad-signature" "$OUT" "release_state=merged reason=bad-signature"
+  check_absent "forgery-unsigned (annotated): never validated" "$OUT" "release_state=validated"
+
+  # 10b: LIGHTWEIGHT lookalike (no tag object at all — nothing to verify).
+  d2="$(new_repo forgery-lightweight)"
+  write_milestone "$d2" 112 'milestone:
+  id: 112
+  name: "fixture: lightweight lookalike promotion tag"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active'
+  deploy2="$(advance_main "$d2" "deploy: ship it")"
+  git -C "$d2" tag "promotion/$deploy2" "$deploy2"
+  write_promotion_binding "$d2" "$promotion_signers"
+  run_fold "$d2" m-112
+  check "forgery-lightweight: exit 0" "$RC" "0"
+  check "forgery-lightweight: merged reason=bad-signature" "$OUT" "release_state=merged reason=bad-signature"
+  check_absent "forgery-lightweight: never validated" "$OUT" "release_state=validated"
+
+  # 10c: tag SSH-signed by a key NOT in the promotion allowed-signers (the
+  # agent-minted lookalike, acceptance 5) → merged reason=bad-signature.
+  d3="$(new_repo forgery-wrongkey)"
+  write_milestone "$d3" 113 'milestone:
+  id: 113
+  name: "fixture: rogue-key promotion tag"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-16"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active'
+  deploy3="$(advance_main "$d3" "deploy: ship it")"
+  mint_promotion_tag "$d3" "$deploy3" "$ROOT/agent_key"
+  write_promotion_binding "$d3" "$promotion_signers"
+  run_fold "$d3" m-113
+  check "forgery-wrong-key: exit 0" "$RC" "0"
+  check "forgery-wrong-key: merged reason=bad-signature" "$OUT" "release_state=merged reason=bad-signature"
+  check_absent "forgery-wrong-key: never validated" "$OUT" "release_state=validated"
+
+  # 10d: signers-file tamper (root-of-trust hardening) — the allowed-signers
+  # file is COMMITTED in-repo and points at the CI key only. An agent appends
+  # its own key to the WORKING-TREE copy and mints an own-key-signed tag. The
+  # fold reads the signers CONTENT from main-tree (like every other field), so
+  # the working-tree key is not trusted → merged reason=bad-signature. Proves
+  # an in-repo signers file cannot be forged from the working tree.
+  d4="$(new_repo forgery-signers-tamper)"
+  # committed signers file (CI key only), referenced by a repo-relative path.
+  mkdir -p "$d4/.forge"
+  printf 'ci@example.com namespaces="git" %s\n' "$(cat "$ROOT/ci_key.pub")" > "$d4/.forge/promotion_signers"
+  git -C "$d4" add ".forge/promotion_signers"
+  git -C "$d4" commit -qm "chore: commit CI-only promotion signers"
+  cat > "$d4/.forge/project.yml" <<'EOF'
+forge:
+  validation_event: promotion_approval
+  promotion:
+    tag_pattern: "promotion/{sha}"
+    allowed_signers: ".forge/promotion_signers"
+EOF
+  git -C "$d4" add ".forge/project.yml"
+  git -C "$d4" commit -qm "chore: promotion binding (in-repo signers)"
+  write_milestone "$d4" 114 'milestone:
+  id: 114
+  name: "fixture: in-repo signers, working-tree tampered"
+
+current:
+  tier: standard
+  status: executing
+  last_updated: "2026-07-17"
+  human_verified: null
+
+lifecycle:
+  worktree_mode: active'
+  deploy4="$(advance_main "$d4" "deploy: ship it")"
+  # positive control: genuine CI-signed tag validates via the MAIN-TREE signers.
+  mint_promotion_tag "$d4" "$deploy4" "$ROOT/ci_key"
+  run_fold "$d4" m-114
+  check "signers-tamper (control): CI tag validates via main-tree signers" "$OUT" "release_state=validated reason=promotion-approved"
+  # attack: append the rogue key to the WORKING-TREE signers (uncommitted),
+  # swap the tag for one signed by that rogue key.
+  git -C "$d4" tag -d "promotion/$deploy4" >/dev/null
+  printf 'agent@example.com namespaces="git" %s\n' "$(cat "$ROOT/agent_key.pub")" >> "$d4/.forge/promotion_signers"
+  mint_promotion_tag "$d4" "$deploy4" "$ROOT/agent_key"
+  run_fold "$d4" m-114
+  check "signers-tamper: exit 0" "$RC" "0"
+  check "signers-tamper: working-tree key NOT trusted → bad-signature" "$OUT" "release_state=merged reason=bad-signature"
+  check_absent "signers-tamper: never validated from a working-tree signers edit" "$OUT" "release_state=validated"
+fi
+
+# --- summary -------------------------------------------------------------------
+if [ -n "$FILTER" ] && [ "$SELECTED" -eq 0 ]; then
+  printf 'ERROR: filter "%s" matched no cases (tags: unmerged merged grandfather human-verified signoff-tag stored-field exit-2 stable-sha ordering promotion forgery)\n' "$FILTER" >&2
+  exit 2
+fi
+
+printf '\n%d passed, %d failed (%d case blocks selected)\n' "$PASSED" "$FAILED" "$SELECTED"
+[ "$FAILED" -eq 0 ]