forge-orkes 0.56.0 → 0.58.2

package/bin/create-forge.js

@@ -709,6 +709,12 @@ async function upgrade() {
   //    merged separately by upgradeSettings().
   upgradeAdditiveDir('.claude/hooks', results);
   upgradeAdditiveDir('.claude/rules', results);
+  // 2-checks. Sync the merge-floor CI check scripts + fixture suites (0.58.2).
+  //    Tracked in installed projects (unlike .claude/hooks/, which many projects
+  //    gitignore as per-developer files) so CI can run them and the hold check's
+  //    protected set (.forge/checks/**) can guard them. Additive for the same
+  //    reason as above: never delete a project-local extra check.
+  upgradeAdditiveDir('.forge/checks', results);
 
   // 2a. Confirm stale framework-file removals before deleting (R066a). Defaults
   //     to yes (cleanup is the normal case); auto-confirms when non-interactive

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forge-orkes",
-  "version": "0.56.0",
+  "version": "0.58.2",
   "description": "Set up the Forge meta-prompting framework for Claude Code in your project",
   "bin": {
     "create-forge": "./bin/create-forge.js"

package/template/.claude/settings.json

@@ -1,6 +1,6 @@
 {
   "forge": {
-    "version": "0.1.0",
+    "version": "0.58.2",
     "default_tier": "standard",
     "beads_integration": false,
     "context_gates": {

package/template/.claude/skills/upgrading/SKILL.md

@@ -40,6 +40,7 @@ Read the source version (`{source}/packages/create-forge/package.json` `version`
 | **Import-managed** | `CLAUDE.md` | Never overwrite content; migrate legacy forge sections + guarantee the `@.forge/FORGE.md` import line (Step 5) |
 | **Merge-owned** | `.claude/settings.json` | Smart-merge `forge.*` keys only (Step 5) |
 | **Template-only** | `.forge/templates/**`, `.forge/migrations/**`, `.forge/gitignore` → `.forge/.gitignore` | Overwrite |
+| **Additive-sync** | `.claude/hooks/**` (incl. `tests/`), `.claude/rules/**`, `.forge/checks/**` (incl. `tests/`) | Add + overwrite template-shipped files; never delete local extras (Step 4a) |
 
 **Never touch** user-generated files: `.forge/project.yml`, `.forge/state/`, `.forge/constitution.md`, `.forge/context.md`, `.forge/requirements/`, `.forge/roadmap.yml`, `.forge/design-system.md`, `.forge/refactor-backlog.yml`.
 
@@ -87,6 +88,22 @@ Same process as Step 3 for `.forge/templates/**`, `.forge/migrations/**`, and `.
 
 **Sync the framework prose file `.forge/FORGE.md`** (framework-owned single file — it holds the `# Forge` prose, formerly embedded in CLAUDE.md). Copy/refresh `{source}/packages/create-forge/template/.forge/FORGE.md` → `.forge/FORGE.md` (overwrite when different; report added/updated/unchanged). **Run this BEFORE the Step 5 CLAUDE.md pass** so a migrated import line never points at a missing file.
 
+## Step 4a: Sync Hooks + Rules + Checks (additive — mirrors the npm bin)
+
+The template ships the safety-guardrail hook scripts (ADR-017), the always-on rules layer (ADR-018), and — since 0.58.2 — the merge-floor CI check scripts: `.claude/hooks/**` — **including the `tests/` subtree** — `.claude/rules/**`, and `.forge/checks/**` (incl. `tests/`). The npm bin has additively synced hooks + rules since those ADRs landed (`upgradeAdditiveDir`); this skill previously synced neither, so a project upgraded only via `/upgrading` never received `.claude/hooks/` at all — while its settings.json wires guards like `protect-files.sh` and skills invoke `forge-release-fold.sh`, none of which existed on disk.
+
+For every file under `{source}/packages/create-forge/template/.claude/hooks/`, `.../.claude/rules/`, and `.../.forge/checks/` (recursive):
+
+1. Absent locally → copy, report **added**.
+2. Present but differs → overwrite, report **updated**.
+3. Identical → report **unchanged**.
+4. **Additive only** — never delete a local file the template lacks. Project-local and experimental hooks (e.g. M10 `forge-claim-check*.sh`) and pack-installed path-scoped rules are preserved; no "removed from template" verdicts in this pass.
+5. `chmod +x` every synced `*.sh` (a copy can strip the execute bit; guard hooks and CI checks must be runnable).
+
+The two subtrees differ in tracked-ness, and the sync respects it: `.forge/checks/**` is **committed** project content (CI must clone it; the hold check's protected set guards `.forge/checks/**`), while `.claude/hooks/**` is a **machine-local carve-out** in many projects (gitignored as per-developer files — host-verified on ptnrkit). Sync both to disk identically; stage only what the project's own `.gitignore` admits — never `git add -f` a hook file past a project's ignore rules. The old `.claude/hooks/` copies of `forge-hold-check.sh` / `forge-check-lint.sh` (+ their two `tests/*.test.sh` suites) are relocation leftovers on upgraded projects — the migration guide `0.58.2-merge-floor-checks-relocation.md` covers removing them and re-pointing CI.
+
+The settings.json *wiring* for these hooks is not written here — Step 5's smart-merge owns it.
+
 ## Step 4b: Codex Adapter (presence-gated — detect + offer, never auto)
 
 Forge ships a **Codex/AGENTS adapter** (`.agents/skills/` + `.codex/` wiring) for projects run on Codex. It is a *derived translation* of the canonical `.claude/` skills (ADR-014) and drifts whenever core moves — but `upgrading` syncs only `.claude/`, so the Codex adapter would silently rot. This step makes that staleness visible and one-keystroke-fixable, **without** ever generating it here (only an agent-as-Codex can author it natively).
@@ -120,6 +137,7 @@ No manual-merge prompt for forge sections; migration is silent except the report
 2. Compare `forge.*` keys only
 3. If different → update `forge.*` keys in local, preserve user's `hooks` and custom keys
 4. Set `forge.version` to match the source package version
+5. **Additively merge the template's framework hook wiring** (ADR-017, mirrors the bin's `upgradeSettingsHooks`): for each hook group in the template's `hooks`, add it to the local `hooks` unless a deep-equal group already exists. Never remove or rewrite a user's own hook entries. Without this, the scripts synced in Step 4a exist on disk but never fire on projects whose settings.json predates the wiring.
 
 ## Step 6: Report
 

package/template/.forge/checks/forge-check-lint.sh

@@ -0,0 +1,383 @@
+#!/usr/bin/env sh
+# forge-check-lint — the merge-floor check-quality lint (m-31, Brief-R2 step 2 Track A).
+#
+# M23 promoted to the merge floor: a check that cannot fail manufactures fake
+# evidence — worse than no check. This lints the PR diff's CI/check/test
+# definitions with the planning skill's heuristics ported to an executable
+# (a SECOND CONSUMER of the same rules — the planning-time prose stays where it
+# is). P16's teeth. HONEST LIMIT: the lint is line/unit-heuristic over YAML and
+# diffs, not a parser — what it can't catch, your UAT stands behind.
+#
+#   forge-check-lint.sh <base>...<head>
+#
+#   stdout (machine-parseable):
+#     lint=clean
+#     lint=fail                                     + finding=<rule>:<file>[:<line>]
+#     lint=justified justify="<trailer line>"       + finding=<rule>:<file>[:<line>] justified
+#     rule ∈ cannot-fail|silent-fail|existence-only|deleted-assertion|feature-removal|skip-marker
+#   exit: 0 = clean or justified; 1 = fail; 2 = bad invocation. Logs → stderr.
+#
+# Targets (nothing else is scanned):
+#   CI definitions (.github/workflows/*.yml|yaml, .gitlab-ci.yml) — check UNITS
+#     (a `run:` scalar, a `run: |` block, a `script:` list) parsed from the HEAD
+#     side of each changed file, REPORTED only when the unit's lines intersect
+#     the diff's added lines (lint the diff, not the world).
+#   Test files (*_test.*, *.test.*, test_*.*, *.spec.*) — added/removed diff lines.
+#
+# Rules:
+#   (a) cannot-fail   — every command in the unit is `true`, `:`, `exit 0`, or an
+#                       echo/printf-only pipeline. ALWAYS a failure — the
+#                       Lint-Justify trailer NEVER lifts it (M23 rule a verbatim).
+#   (c) existence-only— every command is a bare file-existence test (test -f/-e/-d).
+#   (b) silent-fail   — every command is silent conjuncts (grep -q / diff -q /
+#                       test / [) with no `||` diagnostic branch. Checked after (c).
+#   deleted-assertion — NET loss of assertion-bearing lines in a gating test
+#                       (base-side hold-config `gating_tests:` globs when present,
+#                       else EVERY test file in the diff — raise-only default).
+#                       Net-count, so a moved/edited line that keeps its assertion
+#                       does not fire.
+#   feature-removal   — a deleted-assertion whose test correlates with a same-stem
+#                       source FILE deletion in the same diff. Reclassified from
+#                       test-gaming to "feature removal — confirm intended". A
+#                       CLASSIFIER, not an allowlist: the finding still fires and
+#                       still requires the recorded operator act (Lint-Justify / PR
+#                       approval) — only the label changes, so the operator confirms
+#                       an intended removal instead of being warned of gaming.
+#                       Bright line (raise-only): only a WHOLE matching-stem source
+#                       *file* deletion downgrades the label; a partial source
+#                       shrink is ambiguous and keeps the stricter deleted-assertion.
+#   skip-marker       — an ADDED .only( / .skip( / it.skip / describe.only / xit( /
+#                       xdescribe( / @pytest.mark.skip / t.Skip() line.
+#
+# Justification channel (pure git, host-agnostic): a commit-message trailer
+#   Lint-Justify: <one line>
+# in ANY commit of merge-base..head lifts (b)/(c)/deleted-assertion/feature-removal/
+# skip-marker → exit 0 `lint=justified`. It never lifts (a).
+#
+# Host-agnostic + offline (NFR-032): POSIX sh over git plumbing only.
+set -u
+
+usage() { printf 'usage: forge-check-lint.sh <base>...<head>\n' >&2; }
+
+RANGE="${1:-}"
+[ $# -le 1 ] || { printf 'forge-check-lint: unexpected arguments\n' >&2; usage; exit 2; }
+[ -n "$RANGE" ] || { usage; exit 2; }
+case "$RANGE" in
+  *...*) : ;;
+  *) printf 'forge-check-lint: range must be three-dot BASE...HEAD (got: %s)\n' "$RANGE" >&2; exit 2 ;;
+esac
+BASE_REF="${RANGE%%...*}"
+HEAD_REF="${RANGE#*...}"
+[ -n "$BASE_REF" ] && [ -n "$HEAD_REF" ] || { usage; exit 2; }
+
+git rev-parse --verify --quiet "$BASE_REF^{commit}" >/dev/null 2>&1 \
+  || { printf 'forge-check-lint: cannot resolve base ref: %s\n' "$BASE_REF" >&2; exit 2; }
+git rev-parse --verify --quiet "$HEAD_REF^{commit}" >/dev/null 2>&1 \
+  || { printf 'forge-check-lint: cannot resolve head ref: %s\n' "$HEAD_REF" >&2; exit 2; }
+MB="$(git merge-base "$BASE_REF" "$HEAD_REF" 2>/dev/null)" \
+  || { printf 'forge-check-lint: no merge-base for %s\n' "$RANGE" >&2; exit 2; }
+
+# Justification trailer (first one wins), from commit messages in the range.
+# Strip any embedded double-quote: it is echoed inside justify="..." on stdout,
+# and an unescaped " from an attacker-authored commit would produce malformed,
+# machine-parseable output a downstream CI parser could mis-read.
+JUSTIFY="$(git log --format=%B "$MB..$HEAD_REF" 2>/dev/null \
+  | sed -n 's/^Lint-Justify:[[:space:]]*//p' | head -1 | tr '"' "'")"
+
+# Base-side gating_tests globs (same additive config the hold check reads).
+GATING="$(git show "$MB:.forge/hold-config.yml" 2>/dev/null \
+  | awk '
+      /^[A-Za-z_]+:/ { insec = (index($0, "gating_tests:") == 1) ? 1 : 0; next }
+      insec && /^[[:space:]]*-[[:space:]]*/ {
+        v = $0
+        sub(/^[[:space:]]*-[[:space:]]*/, "", v)
+        gsub(/["\047]/, "", v)
+        sub(/[[:space:]]*(#.*)?$/, "", v)
+        if (v != "") print v
+      }')"
+
+in_gating() { # path → 0 when gating set is empty (default: everything gates) or a glob matches
+  [ -n "$GATING" ] || return 0
+  ig_path="$1"
+  while IFS= read -r ig_g; do
+    [ -n "$ig_g" ] || continue
+    case "$ig_path" in
+      $ig_g) return 0 ;;
+    esac
+  done <<EOF
+$GATING
+EOF
+  return 1
+}
+
+added_lines() { # file → new-side line numbers added by the diff, one per line
+  git diff --unified=0 "$MB" "$HEAD_REF" -- "$1" 2>/dev/null | awk '
+    /^@@/ {
+      plus = $3
+      sub(/^\+/, "", plus)
+      n = split(plus, a, ",")
+      start = a[1] + 0
+      count = (n > 1) ? a[2] + 0 : 1
+      for (i = 0; i < count; i++) print start + i
+    }'
+}
+
+# Test-file basename → feature stem (drops the test marker + extension). Used to
+# correlate a shrinking test with its source going away.
+stem_of_test() { # basename
+  awk -v b="$1" 'BEGIN {
+    if (b ~ /\.(test|spec)\.[^.]+$/)  sub(/\.(test|spec)\.[^.]+$/, "", b)
+    else if (b ~ /_test\.[^.]+$/)     sub(/_test\.[^.]+$/, "", b)
+    else if (b ~ /^test_/)          { sub(/^test_/, "", b); sub(/\.[^.]+$/, "", b) }
+    else                              sub(/\.[^.]+$/, "", b)
+    print b
+  }'
+}
+
+# Correlated source deletion? True when the diff DELETES a whole non-test, non-CI
+# file whose basename stem matches the test's — the signal that a shrinking test
+# reflects a feature being removed, not a gating test being gamed. Whole-file
+# deletion is the deliberate bright line (raise-only): a partial source shrink is
+# ambiguous and keeps the stricter deleted-assertion label. Classifier, not
+# allowlist — the caller still emits a finding either way.
+has_correlated_source_deletion() { # stem (non-empty)
+  git diff --diff-filter=D --name-only "$MB" "$HEAD_REF" 2>/dev/null | awk -v stem="$1" '
+    function base(p,  b) { b = p; sub(/^.*\//, "", b); return b }
+    function is_test(b) { return (b ~ /_test\./ || b ~ /\.test\./ || b ~ /\.spec\./ || b ~ /^test_/) }
+    function is_ci(p) { return (p ~ /^\.github\/workflows\/.*\.(yml|yaml)$/ || p == ".gitlab-ci.yml") }
+    function srcstem(b,  s) { s = b; sub(/\.[^.]+$/, "", s); return s }
+    { b = base($0); if (is_test(b) || is_ci($0)) next; if (srcstem(b) == stem) { found = 1; exit } }
+    END { exit(found ? 0 : 1) }
+  '
+}
+
+# Parse the HEAD side of a CI definition file into check units and classify each.
+# Emits: <class> <startline> <endline> per unit (class: cannot-fail|existence-only|silent-fail|clean).
+classify_units() { # file
+  git show "$HEAD_REF:$1" 2>/dev/null | awk '
+    function indent_of(s,  t) { t = s; sub(/[^ ].*$/, "", t); return length(t) }
+    function trim(s) { sub(/^[[:space:]]+/, "", s); sub(/[[:space:]]*$/, "", s); return s }
+    # Drop a trailing shell comment before classification so a cosmetic "# note"
+    # cannot slip a cannot-fail command past rule (a) (raise-only: the evasion
+    # must not make a fact disappear). Only strips a # preceded by whitespace or
+    # at line start — never a # mid-token (e.g. a URL fragment). Safe for echo/
+    # printf units too: the classifier keys on the command PREFIX, which survives.
+    function strip_comment(s) { sub(/[ \t]#.*$/, "", s); sub(/^#.*$/, "", s); return s }
+    function strip_quotes(s) {
+      if (s ~ /^".*"$/ || s ~ /^\047.*\047$/) s = substr(s, 2, length(s) - 2)
+      return s
+    }
+    # --- per-command predicates (heuristic, documented in the header) ---------
+    function seg_split(cmd, segs) { return split(cmd, segs, /&&|\|\||;|\|/) }
+    # cannot-fail = EVERY non-empty segment is one of the enumerated trivial
+    # commands {true, :, exit 0} or echo/printf-only. Per-segment (not a
+    # whole-string exact match) so a trailing separator ("exit 0 ;") or a
+    # multi-trivial form ("true || true") cannot evade the enumerated set. Scope
+    # is the ratified set ONLY — a real command guarded by "|| true" is NOT
+    # rule (a) (its non-trivial segment fails the test), matching the contract.
+    function is_cannot(cmd,  segs, n, i, s, any) {
+      cmd = trim(strip_comment(trim(cmd)))
+      n = seg_split(cmd, segs); any = 0
+      for (i = 1; i <= n; i++) {
+        s = trim(segs[i]); if (s == "") continue
+        any = 1
+        # Whitespace/zero-tolerant so "exit  0" (doubled space/tab) and "exit 00"
+        # cannot evade — both always exit 0, so both ARE rule (a).
+        if (s == "true" || s == ":") continue
+        if (s ~ /^exit[ \t]+0+$/) continue
+        if (s ~ /^(echo|printf)([ \t]|$)/) continue
+        return 0
+      }
+      return any
+    }
+    function is_exist(cmd,  segs, n, i, s, any) {
+      cmd = trim(cmd)
+      if (cmd ~ /\|\|/) return 0
+      n = seg_split(cmd, segs); any = 0
+      for (i = 1; i <= n; i++) {
+        s = trim(segs[i]); if (s == "") continue
+        any = 1
+        if (s !~ /^(test|\[\[?)[ \t]+-[efd][ \t]/) return 0
+      }
+      return any
+    }
+    function is_silent(cmd,  segs, n, i, s, any, sig) {
+      cmd = trim(cmd)
+      if (cmd ~ /\|\|/) return 0
+      n = seg_split(cmd, segs); any = 0; sig = 0
+      for (i = 1; i <= n; i++) {
+        s = trim(segs[i]); if (s == "") continue
+        any = 1
+        if (s ~ /^(grep[ \t]+(-[A-Za-z]+[ \t]+)*-q|diff[ \t]+(-[A-Za-z]+[ \t]+)*-q)/) { sig = 1; continue }
+        if (s ~ /^(test|\[\[?)[ \t]/) continue
+        return 0
+      }
+      return any && sig
+    }
+    # --- unit lifecycle -------------------------------------------------------
+    function flush(  i, c, all_cannot, all_exist, all_silent, cls) {
+      if (ucount == 0) { inunit = 0; return }
+      all_cannot = 1; all_exist = 1; all_silent = 1
+      for (i = 1; i <= ucount; i++) {
+        c = ucmd[i]
+        if (!is_cannot(c)) all_cannot = 0
+        if (!is_exist(c))  all_exist = 0
+        if (!is_silent(c) && !is_exist(c)) all_silent = 0
+      }
+      if (all_cannot) cls = "cannot-fail"
+      else if (all_exist) cls = "existence-only"
+      else if (all_silent) cls = "silent-fail"
+      else cls = "clean"
+      print cls, ustart, uend
+      ucount = 0; inunit = 0
+    }
+    BEGIN { inunit = 0; ucount = 0; mode = ""; uind = 0 }
+    {
+      line = $0
+      ind = indent_of(line)
+      t = trim(line)
+
+      if (inunit) {
+        if (mode == "block") {
+          if (t == "" || ind > uind) {
+            if (t != "") { ucmd[++ucount] = strip_quotes(t); uend = NR }
+            next
+          }
+          flush()
+        } else if (mode == "list") {
+          if (t == "" || (ind > uind && t ~ /^-[ \t]/)) {
+            if (t != "") { sub(/^-[ \t]+/, "", t); ucmd[++ucount] = strip_quotes(t); uend = NR }
+            next
+          }
+          flush()
+        }
+      }
+
+      # run: scalar or block start (optional leading "- ")
+      if (match(t, /^(-[ \t]+)?run:[ \t]*/)) {
+        rest = substr(t, RSTART + RLENGTH)
+        rest = trim(rest)
+        # Block scalar header: |, >, and their chomping/explicit-indent forms
+        # (|-, |+, |2, >2-, ...). An explicit-indent header like "|2" must open a
+        # block, not be read as a bogus inline command (which would flush clean
+        # and skip the real body — a cannot-fail body could then slip through).
+        if (rest == "" || rest ~ /^[|>][0-9]*[+-]?$/) {
+          inunit = 1; mode = "block"; uind = ind; ustart = NR; uend = NR; ucount = 0
+        } else {
+          inunit = 1; mode = ""; ustart = NR; uend = NR; ucount = 0
+          ucmd[++ucount] = strip_quotes(rest)
+          flush()
+        }
+        next
+      }
+      # script: list start (gitlab; also before_script/after_script)
+      if (t ~ /^(before_|after_)?script:[ \t]*$/) {
+        inunit = 1; mode = "list"; uind = ind; ustart = NR; uend = NR; ucount = 0
+        next
+      }
+    }
+    END { if (inunit) flush() }'
+}
+
+FINDINGS=""
+HAS_A=0
+add_finding() { # rule, file, line("" ok)
+  if [ -n "$3" ]; then
+    FINDINGS="${FINDINGS}${1}:${2}:${3}
+"
+  else
+    FINDINGS="${FINDINGS}${1}:${2}
+"
+  fi
+  [ "$1" = "cannot-fail" ] && HAS_A=1
+}
+
+CHANGED="$(git diff --name-only "$MB" "$HEAD_REF" 2>/dev/null)" \
+  || { printf 'forge-check-lint: git diff failed for %s\n' "$RANGE" >&2; exit 2; }
+
+while IFS= read -r path; do
+  [ -n "$path" ] || continue
+  base_name="$(basename "$path")"
+
+  # --- CI definition files: unit-classify HEAD side, report diff-touched units
+  case "$path" in
+    .github/workflows/*.yml|.github/workflows/*.yaml|.gitlab-ci.yml)
+      ADDED="$(added_lines "$path")"
+      [ -n "$ADDED" ] || continue
+      classify_units "$path" | while IFS=' ' read -r cls ustart uend; do
+        [ "$cls" != "clean" ] || continue
+        hit=""
+        while IFS= read -r ln; do
+          [ -n "$ln" ] || continue
+          if [ "$ln" -ge "$ustart" ] && [ "$ln" -le "$uend" ]; then hit=1; break; fi
+        done <<EOF2
+$ADDED
+EOF2
+        [ -n "$hit" ] && printf '%s %s %s\n' "$cls" "$path" "$ustart"
+      done > "${TMPDIR:-/tmp}/fcl_units.$$" || true
+      while IFS=' ' read -r cls p ln; do
+        [ -n "$cls" ] && add_finding "$cls" "$p" "$ln"
+      done < "${TMPDIR:-/tmp}/fcl_units.$$"
+      rm -f "${TMPDIR:-/tmp}/fcl_units.$$"
+      continue
+      ;;
+  esac
+
+  # --- test files: skip-markers on added lines; NET assertion loss on gating tests
+  case "$base_name" in
+    *_test.*|*.test.*|test_*.*|*.spec.*)
+      DIFF="$(git diff --unified=0 "$MB" "$HEAD_REF" -- "$path" 2>/dev/null)"
+      [ -n "$DIFF" ] || continue
+
+      added_body="$(printf '%s\n' "$DIFF" | grep '^+' | grep -v '^+++' | sed 's/^+//')"
+      removed_body="$(printf '%s\n' "$DIFF" | grep '^-' | grep -v '^---' | sed 's/^-//')"
+
+      if printf '%s\n' "$added_body" \
+        | grep -qE '\.only\(|\.skip\(|it\.skip|describe\.only|xit\(|xdescribe\(|@pytest\.mark\.skip|t\.Skip\(\)'; then
+        add_finding skip-marker "$path" ""
+      fi
+
+      if in_gating "$path"; then
+        removed_asserts=$(printf '%s\n' "$removed_body" \
+          | grep -cE 'assert|expect\(|\.should|\.to(Be|Equal)|t\.(Error|Fatal)' || true)
+        added_asserts=$(printf '%s\n' "$added_body" \
+          | grep -cE 'assert|expect\(|\.should|\.to(Be|Equal)|t\.(Error|Fatal)' || true)
+        if [ "$removed_asserts" -gt "$added_asserts" ]; then
+          hcs_stem="$(stem_of_test "$base_name")"
+          if [ -n "$hcs_stem" ] && has_correlated_source_deletion "$hcs_stem"; then
+            printf 'forge-check-lint: %s: assertion loss correlates with deletion of same-stem source (%s) — classified as feature removal, confirm intended (NOT test-gaming); the operator act is still required\n' "$path" "$hcs_stem" >&2
+            add_finding feature-removal "$path" ""
+          else
+            add_finding deleted-assertion "$path" ""
+          fi
+        fi
+      fi
+      ;;
+  esac
+done <<EOF
+$CHANGED
+EOF
+
+FINDINGS="$(printf '%s' "$FINDINGS" | sort -u)"
+
+if [ -z "$FINDINGS" ]; then
+  printf 'lint=clean\n'
+  exit 0
+fi
+
+if [ "$HAS_A" -eq 0 ] && [ -n "$JUSTIFY" ]; then
+  printf 'lint=justified justify="%s"\n' "$JUSTIFY"
+  printf '%s\n' "$FINDINGS" | while IFS= read -r f; do
+    [ -n "$f" ] && printf 'finding=%s justified\n' "$f"
+  done
+  exit 0
+fi
+
+[ "$HAS_A" -eq 1 ] && [ -n "$JUSTIFY" ] \
+  && printf 'forge-check-lint: Lint-Justify present but rule (a) cannot-fail is never justifiable\n' >&2
+
+printf 'lint=fail\n'
+printf '%s\n' "$FINDINGS" | while IFS= read -r f; do
+  [ -n "$f" ] && printf 'finding=%s\n' "$f"
+done
+exit 1