forge-orkes 0.77.0 → 0.80.0

package/template/.claude/hooks/tests/forge-context-migrate.test.sh

@@ -0,0 +1,166 @@
+#!/usr/bin/env sh
+# Self-contained fixture test for .claude/hooks/forge-context-migrate.sh
+# (phase 95 plan-01 task 1, issue #37 / ADR-033).
+#
+# Builds a small throwaway monolithic context.md fixture covering every
+# classification case the migrator has to get right: an `M{N}` heading, a
+# `m-{N}` heading, an id-less "drafting" heading, prefixed + unprefixed
+# Deferred/Discretion entries, Needs Resolution, and an Amendment Log. Proves:
+# one context/{id}.md per locked milestone heading, id-less content routed to
+# context-log.md (never a milestone), unprefixed Deferred/Discretion entries
+# routed to context/_shared.md (never guessed onto a milestone), and that
+# re-running against an already-migrated tree is a no-op (skips every id,
+# touches no existing file).
+#
+# Run:  ./.claude/hooks/tests/forge-context-migrate.test.sh
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+MIGRATE="$SCRIPT_DIR/../forge-context-migrate.sh"
+
+[ -x "$MIGRATE" ] || { printf 'FATAL: migrator not executable: %s\n' "$MIGRATE" >&2; exit 1; }
+
+ROOT="$(mktemp -d)"
+trap 'rm -rf "$ROOT"' EXIT INT TERM
+
+PASSED=0
+FAILED=0
+pass() { PASSED=$((PASSED + 1)); printf 'PASS: %s\n' "$1"; }
+fail() { FAILED=$((FAILED + 1)); printf 'FAIL: %s\n' "$1" >&2; }
+check_file() { [ -f "$1" ] && pass "$2" || fail "$2 (missing: $1)"; }
+check_absent_file() { [ -f "$1" ] && fail "$2 (should not exist: $1)" || pass "$2"; }
+check_has() { case "$2" in *"$3"*) pass "$1" ;; *) fail "$1 (missing substring '$3')" ;; esac; }
+check_absent() { case "$2" in *"$3"*) fail "$1 (must NOT contain '$3')" ;; *) pass "$1" ;; esac; }
+
+FIXDIR="$ROOT/src"
+mkdir -p "$FIXDIR"
+SOURCE="$FIXDIR/context.md"
+DEST="$ROOT/.forge"
+mkdir -p "$DEST"
+
+cat > "$SOURCE" <<'FIXTURE'
+# Locked Context
+
+Preamble prose that belongs to nobody — dropped, never carried anywhere.
+
+---
+
+## Locked Decisions
+
+### M7 — Widget Registry (locked 2026-01-01)
+
+Context: why m7 exists.
+
+- **Decision A**: Do the thing. Reason: because.
+
+### m-9 — Gadget Pipeline (locked 2026-01-02)
+
+- **Decision B**: Do the other thing. Reason: also because.
+
+### M? — Future Program (drafting)
+
+- **Draft idea**: not locked yet, no milestone id assigned.
+
+## Deferred Ideas
+
+- M7: narrower follow-up — Deferred because: out of scope. Revisit: later.
+- Cross-cutting idea with no milestone prefix — Deferred because: nobody owns
+  this yet. Revisit: when it does.
+
+## Discretion Areas
+
+- m-9: exact wording of the follow-up doc.
+- Generic discretion with no prefix at all.
+
+## Needs Resolution
+
+(none)
+
+---
+
+## Amendment Log
+
+| Date | Change | Rationale | Approved By |
+|------|--------|-----------|-------------|
+| 2026-01-01 | Added M7 | Fixture seed | Tester |
+FIXTURE
+
+# --- first run: real migration --------------------------------------------
+
+OUT1="$("$MIGRATE" --source "$SOURCE" --dest "$DEST" 2>&1)"
+RC1=$?
+check() { [ "$RC1" -eq 0 ] && pass "$1" || fail "$1 (exit $RC1)"; }
+check "migrator exits 0 on first run"
+
+check_file "$DEST/context/m-7.md" "context/m-7.md created (M7 heading normalized)"
+check_file "$DEST/context/m-9.md" "context/m-9.md created (m-9 heading)"
+check_absent_file "$DEST/context/m-future.md" "no file invented for the M? drafting block"
+check_file "$DEST/context-log.md" "context-log.md created"
+check_file "$DEST/context/_shared.md" "context/_shared.md created"
+
+m7="$(cat "$DEST/context/m-7.md" 2>/dev/null)"
+check_has "m-7.md carries its Locked Decision body" "$m7" "Do the thing"
+check_has "m-7.md carries its own Deferred entry (prefix match)" "$m7" "narrower follow-up"
+check_absent "m-7.md does NOT carry m-9's Discretion entry" "$m7" "exact wording of the follow-up doc"
+
+m9="$(cat "$DEST/context/m-9.md" 2>/dev/null)"
+check_has "m-9.md carries its Locked Decision body" "$m9" "Do the other thing"
+check_has "m-9.md carries its own Discretion entry (prefix match)" "$m9" "exact wording of the follow-up doc"
+
+log="$(cat "$DEST/context-log.md" 2>/dev/null)"
+check_has "context-log.md carries the id-less drafting block" "$log" "Future Program"
+check_has "context-log.md carries the Amendment Log verbatim" "$log" "Added M7"
+check_has "context-log.md carries Needs Resolution" "$log" "(none)"
+check_absent "context-log.md does NOT carry M7's locked content" "$log" "Do the thing"
+
+shared="$(cat "$DEST/context/_shared.md" 2>/dev/null)"
+check_has "_shared.md carries the unprefixed Deferred entry" "$shared" "Cross-cutting idea with no milestone prefix"
+check_has "_shared.md carries the unprefixed Discretion entry" "$shared" "Generic discretion with no prefix"
+check_absent "_shared.md does NOT carry M7's prefixed Deferred entry" "$shared" "narrower follow-up"
+
+# --- idempotency: second run must be a pure no-op --------------------------
+
+sum_before_7="$(cat "$DEST/context/m-7.md" | wc -c)"
+sum_before_log="$(cat "$DEST/context-log.md" | wc -c)"
+sum_before_shared="$(cat "$DEST/context/_shared.md" | wc -c)"
+
+OUT2="$("$MIGRATE" --source "$SOURCE" --dest "$DEST" 2>&1)"
+RC2=$?
+[ "$RC2" -eq 0 ] && pass "migrator exits 0 on re-run" || fail "migrator exits 0 on re-run (exit $RC2)"
+
+check_has "re-run reports a SKIP for m-7" "$OUT2" "SKIP"
+check_has "re-run names m-7 in a skip line" "$OUT2" "m-7"
+
+sum_after_7="$(cat "$DEST/context/m-7.md" | wc -c)"
+sum_after_log="$(cat "$DEST/context-log.md" | wc -c)"
+sum_after_shared="$(cat "$DEST/context/_shared.md" | wc -c)"
+
+[ "$sum_before_7" -eq "$sum_after_7" ] && pass "re-run left context/m-7.md byte-identical" || fail "re-run mutated context/m-7.md"
+[ "$sum_before_log" -eq "$sum_after_log" ] && pass "re-run left context-log.md byte-identical" || fail "re-run mutated context-log.md"
+[ "$sum_before_shared" -eq "$sum_after_shared" ] && pass "re-run left context/_shared.md byte-identical" || fail "re-run mutated context/_shared.md"
+
+file_count_after="$(ls "$DEST"/context/*.md 2>/dev/null | wc -l | tr -d ' ')"
+[ "$file_count_after" -eq 3 ] && pass "re-run created no duplicate files (still m-7, m-9, _shared)" || fail "re-run changed file count (got $file_count_after, want 3)"
+
+# --- dry-run touches nothing -------------------------------------------------
+
+DRYDEST="$ROOT/.forge-dry"
+mkdir -p "$DRYDEST/context"
+OUT3="$("$MIGRATE" --source "$SOURCE" --dest "$DRYDEST" --dry-run 2>&1)"
+RC3=$?
+[ "$RC3" -eq 0 ] && pass "dry-run exits 0" || fail "dry-run exits 0 (exit $RC3)"
+check_has "dry-run reports what it would do" "$OUT3" "DRY-RUN"
+check_absent_file "$DRYDEST/context/m-7.md" "dry-run creates no real file"
+check_absent_file "$DRYDEST/context-log.md" "dry-run creates no real context-log.md"
+
+# --- source file is never modified ------------------------------------------
+
+src_after="$(cat "$SOURCE" | wc -c)"
+[ -n "$src_after" ] && pass "source context.md still readable after migration" || fail "source context.md unreadable after migration"
+grep -q "### M7 — Widget Registry" "$SOURCE" && pass "source context.md left untouched" || fail "source context.md was modified"
+
+# --- summary -----------------------------------------------------------------
+
+printf '\n%s passed, %s failed\n' "$PASSED" "$FAILED"
+[ "$FAILED" -eq 0 ] || exit 1
+exit 0

package/template/.claude/hooks/tests/forge-size-gate.test.sh

@@ -0,0 +1,132 @@
+#!/usr/bin/env sh
+# Self-contained unit test for .claude/hooks/forge-size-gate.sh (issue #37).
+#
+# Proves the mechanical size gate: exactly one advisory line naming every
+# over-gate artifact (with size + gate), total silence when everything is
+# within gate, silent skip (no crash, no error) when a declared-gate artifact
+# is simply absent, and correct tiering of skill files (40KB for names listed
+# in skill-gate-tiers.txt, 20KB default for everything else).
+#
+# Builds throwaway git repos in mktemp dirs, NO remote configured. Isolated
+# from the developer's git config. Run:
+#   ./.claude/hooks/tests/forge-size-gate.test.sh
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+GATE="$SCRIPT_DIR/../forge-size-gate.sh"
+
+[ -x "$GATE" ] || { printf 'FATAL: hook not executable: %s\n' "$GATE" >&2; exit 1; }
+command -v git >/dev/null 2>&1 || { printf 'FATAL: git not found\n' >&2; exit 1; }
+
+GIT_CONFIG_GLOBAL=/dev/null
+GIT_CONFIG_SYSTEM=/dev/null
+export GIT_CONFIG_GLOBAL GIT_CONFIG_SYSTEM
+unset FORGE_ALLOW_HOOK_EDITS 2>/dev/null || true
+
+ROOT="$(mktemp -d)"
+trap 'rm -rf "$ROOT"' EXIT INT TERM
+
+PASSED=0
+FAILED=0
+pass() { PASSED=$((PASSED + 1)); printf 'PASS: %s\n' "$1"; }
+fail() { FAILED=$((FAILED + 1)); printf 'FAIL: %s\n' "$1" >&2; }
+check() { if [ "$2" = "$3" ]; then pass "$1"; else fail "$1 (got '$2', want '$3')"; fi; }
+check_has() { case "$2" in *"$3"*) pass "$1" ;; *) fail "$1 (got '$2', want substring '$3')" ;; esac; }
+check_absent() { case "$2" in *"$3"*) fail "$1 (got '$2', must NOT contain '$3')" ;; *) pass "$1" ;; esac; }
+
+# pad_to <path> <bytes> — write <path> with exactly <bytes> bytes of filler.
+pad_to() {
+  path="$1"; n="$2"
+  mkdir -p "$(dirname "$path")"
+  awk -v n="$n" 'BEGIN { for (i = 0; i < n; i++) printf "a"; printf "\n" }' | head -c "$n" > "$path"
+}
+
+REPO="$ROOT/repo"
+mkdir -p "$REPO"
+git -C "$REPO" init -q
+git -C "$REPO" symbolic-ref HEAD refs/heads/main
+git -C "$REPO" config user.email t@example.com
+git -C "$REPO" config user.name tester
+
+mkdir -p "$REPO/.forge"
+mkdir -p "$REPO/.claude/hooks"
+printf 'forge\nchief-of-staff\n' > "$REPO/.claude/hooks/skill-gate-tiers.txt"
+
+git -C "$REPO" add -A
+git -C "$REPO" commit -qm "chore(forge): seed empty repo" --allow-empty >/dev/null 2>&1
+
+# ===========================================================================
+# Case A — an artifact over its gate is named in the ONE advisory line, with
+# correct size + gate numbers.
+# ===========================================================================
+pad_to "$REPO/.forge/FORGE.md" 35800   # over the 35KB (35000B) gate
+out_a="$("$GATE" --project "$REPO" 2>&1)"
+check_has "over-gate artifact named" "$out_a" ".forge/FORGE.md"
+check_has "over-gate artifact shows actual bytes" "$out_a" "35800B"
+check_has "over-gate artifact shows its gate" "$out_a" "35KB"
+check_has "advisory line points at FORGE.md Size Gates" "$out_a" "FORGE.md § Size Gates"
+# exactly one line of output
+lc_a="$(printf '%s\n' "$out_a" | grep -c .)"
+check "advisory is exactly one line" "$lc_a" "1"
+rm -f "$REPO/.forge/FORGE.md"
+
+# ===========================================================================
+# Case B — every checked artifact within gate → zero output.
+# ===========================================================================
+pad_to "$REPO/.forge/FORGE.md" 100
+pad_to "$REPO/.forge/project.yml" 100
+out_b="$("$GATE" --project "$REPO" 2>&1)"
+check "all within gate → no output" "$out_b" ""
+rc_b=$?
+"$GATE" --project "$REPO" >/dev/null 2>&1
+check "all within gate → exit 0" "$?" "0"
+
+# ===========================================================================
+# Case C — a declared-gate artifact simply absent → no crash, no error, and
+# it is never named (context.md was never created in this fixture repo).
+# ===========================================================================
+out_c="$("$GATE" --project "$REPO" 2>&1)"; rc_c=$?
+check "missing artifact → exit 0" "$rc_c" "0"
+check_absent "missing artifact never named" "$out_c" "context.md"
+
+# ===========================================================================
+# Case D — tiered skill gate: same-sized file, different tier outcome.
+#   - "forge" is in skill-gate-tiers.txt → 40KB tier → 35KB file is fine.
+#   - "some-other-skill" is NOT listed → 20KB default tier → 35KB file is over.
+# ===========================================================================
+pad_to "$REPO/.claude/skills/forge/SKILL.md" 35000
+pad_to "$REPO/.claude/skills/some-other-skill/SKILL.md" 35000
+out_d="$("$GATE" --project "$REPO" 2>&1)"
+check_absent "entry-point skill under its 40KB tier → no violation" "$out_d" "skills/forge/SKILL.md"
+check_has "non-entry-point skill over the 20KB default tier → violation" "$out_d" "skills/some-other-skill/SKILL.md"
+check_has "non-entry-point violation shows the 20KB gate" "$out_d" "20KB"
+rm -rf "$REPO/.claude/skills"
+
+# ===========================================================================
+# Case E — missing tier-list file degrades to "every skill at 20KB", never
+# a crash.
+# ===========================================================================
+rm -f "$REPO/.claude/hooks/skill-gate-tiers.txt"
+pad_to "$REPO/.claude/skills/forge/SKILL.md" 25000   # over 20KB, would be fine under the 40KB tier
+out_e="$("$GATE" --project "$REPO" 2>&1)"; rc_e=$?
+check "missing tier-list → exit 0 (no crash)" "$rc_e" "0"
+check_has "missing tier-list → default 20KB tier applied even to 'forge'" "$out_e" "skills/forge/SKILL.md"
+rm -rf "$REPO/.claude/skills"
+printf 'forge\nchief-of-staff\n' > "$REPO/.claude/hooks/skill-gate-tiers.txt"
+
+# ===========================================================================
+# Case F — non-Forge repo / non-repo dir: silent no-op, exit 0.
+# ===========================================================================
+mkdir -p "$ROOT/plain"
+"$GATE" --project "$ROOT/plain" >"$ROOT/out_f" 2>&1; rc_f=$?
+check "non-git dir → exit 0" "$rc_f" "0"
+check "non-git dir → no output" "$(cat "$ROOT/out_f")" ""
+
+mkdir -p "$ROOT/emptygit"
+git -C "$ROOT/emptygit" init -q
+"$GATE" --project "$ROOT/emptygit" >"$ROOT/out_f2" 2>&1; rc_f2=$?
+check "git repo without .forge → exit 0, silent" "$rc_f2" "0"
+check "git repo without .forge → no output" "$(cat "$ROOT/out_f2")" ""
+
+printf '\n%d passed, %d failed\n' "$PASSED" "$FAILED"
+[ "$FAILED" -eq 0 ]

package/template/.claude/hooks/tests/protect-primary-checkout.test.sh

@@ -0,0 +1,147 @@
+#!/usr/bin/env bash
+# Scratch-repo test suite for .claude/hooks/protect-primary-checkout.sh (issue #21).
+#
+# Each case builds a throwaway git repo (and, where needed, a linked worktree), pipes
+# a PreToolUse JSON payload to the hook, and asserts the exit code. Exit 2 = deny,
+# exit 0 = allow. No network, no fixtures. Self-cleans on exit. Run:
+#   ./.claude/hooks/tests/protect-primary-checkout.test.sh
+# Prints `ALL PASS` and exits 0 iff every case passes; non-zero on any failure.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HOOK="$SCRIPT_DIR/../protect-primary-checkout.sh"
+[ -x "$HOOK" ] || { printf 'FATAL: hook not executable: %s\n' "$HOOK" >&2; exit 1; }
+command -v jq >/dev/null 2>&1 || { printf 'FATAL: jq required\n' >&2; exit 1; }
+
+ROOT="$(mktemp -d)"
+trap 'rm -rf "$ROOT"' EXIT INT TERM
+
+PASSED=0
+FAILED=0
+
+# new_repo <name> [default-branch] — fresh repo with one commit. Prints its path.
+new_repo() {
+  local d="$ROOT/$1" br="${2:-main}"
+  mkdir -p "$d"
+  git -C "$d" init -q
+  git -C "$d" symbolic-ref HEAD "refs/heads/$br"
+  [ "$br" != "main" ] && git -C "$d" config init.defaultBranch "$br"
+  git -C "$d" config user.email t@example.com
+  git -C "$d" config user.name tester
+  : > "$d/seed"
+  git -C "$d" add -A && git -C "$d" commit -qm init
+  printf '%s\n' "$d"
+}
+
+# run_hook <dir> <command> [env-assignment] — pipes a payload, returns the hook exit code.
+run_hook() {
+  local dir="$1" cmd="$2" envset="${3:-}"
+  local payload
+  payload=$(jq -nc --arg c "$cmd" --arg d "$dir" '{tool_input:{command:$c},cwd:$d}')
+  if [ -n "$envset" ]; then
+    printf '%s' "$payload" | env "$envset" "$HOOK" >/dev/null 2>&1
+  else
+    printf '%s' "$payload" | "$HOOK" >/dev/null 2>&1
+  fi
+  return $?
+}
+
+# assert <desc> <expected-exit> <dir> <command> [env]
+assert() {
+  local desc="$1" want="$2" dir="$3" cmd="$4" envset="${5:-}"
+  local got
+  run_hook "$dir" "$cmd" "$envset"; got=$?
+  if [ "$got" -eq "$want" ]; then
+    PASSED=$((PASSED + 1))
+    # printf '  PASS: %s\n' "$desc"
+  else
+    FAILED=$((FAILED + 1))
+    printf '  FAIL: %s (got exit %s, want %s)\n' "$desc" "$got" "$want" >&2
+  fi
+}
+
+DENY=2
+ALLOW=0
+
+# ── Primary checkout: DENY branch creation / orphan / detach / track ──────────────
+P="$(new_repo primary)"
+assert "primary: checkout -b denies"                "$DENY" "$P" "git checkout -b feature"
+assert "primary: checkout -B denies"                "$DENY" "$P" "git checkout -B feature"
+assert "primary: switch -c denies"                  "$DENY" "$P" "git switch -c feature"
+assert "primary: switch -C denies"                  "$DENY" "$P" "git switch -C feature"
+assert "primary: switch --create denies"            "$DENY" "$P" "git switch --create feature"
+assert "primary: checkout --orphan denies"          "$DENY" "$P" "git checkout --orphan gh-pages"
+assert "primary: checkout --detach denies"          "$DENY" "$P" "git checkout --detach"
+assert "primary: checkout --track denies"           "$DENY" "$P" "git checkout --track origin/x"
+assert "primary: checkout other-branch denies"      "$DENY" "$P" "git checkout somebranch"
+assert "primary: switch other-branch denies"        "$DENY" "$P" "git switch somebranch"
+
+# ── Global-option bypass regression (review m-49 F1/F2): git global options before ──
+# the subcommand must NOT slip the guard. These were live bypasses before the fix.
+assert "primary: -c global opt + checkout -b denies" "$DENY" "$P" "git -c core.editor=vi checkout -b evil"
+assert "primary: --no-pager + checkout -b denies"    "$DENY" "$P" "git --no-pager checkout -b evil"
+assert "primary: -p + checkout -b denies"            "$DENY" "$P" "git -p checkout -b evil"
+assert "primary: multi -c + switch -c denies"        "$DENY" "$P" "git -c a=b -c c=d switch -c evil"
+assert "primary: \$IFS substitution + -b denies"     "$DENY" "$P" "git checkout\$IFS-b evil"
+assert "primary: -c global opt + checkout main allows" "$ALLOW" "$P" "git -c x=y checkout main"
+
+# ── The UNCONDITIONAL delta: deny even with NO sibling worktree (P has exactly 1). ─
+# (P above already has no siblings — the denies above ARE the no-sibling case. Assert
+#  explicitly that worktree count is 1 here, so the intent is documented.)
+wt_n=$(git -C "$P" worktree list | wc -l | tr -d ' ')
+if [ "$wt_n" -eq 1 ]; then PASSED=$((PASSED+1)); else FAILED=$((FAILED+1)); printf '  FAIL: expected 1 worktree in fresh primary, got %s\n' "$wt_n" >&2; fi
+
+# ── Primary checkout: ALLOW safe forms ───────────────────────────────────────────
+assert "primary: checkout main allows (home)"       "$ALLOW" "$P" "git checkout main"
+assert "primary: switch main allows (home)"         "$ALLOW" "$P" "git switch main"
+assert "primary: checkout -- file allows (restore)" "$ALLOW" "$P" "git checkout -- seed"
+assert "primary: checkout . allows (restore)"       "$ALLOW" "$P" "git checkout ."
+assert "primary: checkout HEAD -- file allows"      "$ALLOW" "$P" "git checkout HEAD -- seed"
+assert "primary: bare checkout allows"              "$ALLOW" "$P" "git checkout"
+assert "primary: git status allows (fast-path)"     "$ALLOW" "$P" "git status"
+assert "primary: git commit allows (fast-path)"     "$ALLOW" "$P" "git commit -m x"
+assert "primary: git log allows (fast-path)"        "$ALLOW" "$P" "git log --oneline"
+
+# ── Worktree pass-through: git-dir != git-common-dir → never blocked ──────────────
+WT="$ROOT/primary-wt"
+git -C "$P" worktree add -q -b wtbranch "$WT" >/dev/null 2>&1
+assert "worktree cwd: checkout -b allows"           "$ALLOW" "$WT" "git checkout -b anything"
+assert "worktree cwd: switch -c allows"             "$ALLOW" "$WT" "git switch -c anything"
+# From the PRIMARY checkout, `git -C <worktree>` targets the worktree → allow.
+assert "primary + git -C worktree: checkout -b allows" "$ALLOW" "$P" "git -C $WT checkout -b anything"
+
+# ── master-default repo: home = master; create still denied ───────────────────────
+M="$(new_repo master-primary master)"
+assert "master repo: checkout master allows (home)" "$ALLOW" "$M" "git checkout master"
+assert "master repo: checkout -b denies"            "$DENY"  "$M" "git checkout -b x"
+assert "master repo: checkout main denies (main is not this repo's default... but seeded)" "$ALLOW" "$M" "git checkout main"
+# ^ main+master are BOTH always in the seed set, so `checkout main` is allowed even in
+#   a master-default repo. That's intentional (both are canonical default names).
+
+# ── Escape hatch ─────────────────────────────────────────────────────────────────
+assert "escape hatch: checkout -b allows"           "$ALLOW" "$P" "git checkout -b feature" "ALLOW_MAIN_BRANCHING=1"
+
+# ── Folded hard-reset guard (worktree-count gated) ───────────────────────────────
+# P now has 1 sibling worktree (WT added above) → count > 1 → hard reset denied.
+assert "primary +wt: reset --hard denies"           "$DENY"  "$P" "git reset --hard HEAD"
+assert "primary +wt: reset --keep denies"           "$DENY"  "$P" "git reset --keep HEAD"
+assert "primary +wt: reset --soft allows (not hard)" "$ALLOW" "$P" "git reset --soft HEAD"
+# A repo with a single worktree → hard reset is the operator's business → allow.
+S="$(new_repo solo)"
+assert "solo (1 wt): reset --hard allows"           "$ALLOW" "$S" "git reset --hard HEAD"
+
+# ── Fail-open cases ──────────────────────────────────────────────────────────────
+assert "fail-open: empty command allows"            "$ALLOW" "$P" ""
+assert "fail-open: non-checkout command allows"     "$ALLOW" "$P" "ls -la"
+# Non-git cwd → fail open. Use a plain temp dir with a checkout-shaped command.
+NG="$ROOT/notgit"; mkdir -p "$NG"
+assert "fail-open: non-git cwd allows"              "$ALLOW" "$NG" "git checkout -b x"
+
+# ── Summary ──────────────────────────────────────────────────────────────────────
+printf '\n%d passed, %d failed\n' "$PASSED" "$FAILED"
+if [ "$FAILED" -eq 0 ]; then
+  printf 'ALL PASS\n'
+  exit 0
+fi
+exit 1

package/template/.claude/settings.json

@@ -1,6 +1,6 @@
 {
   "forge": {
-    "version": "0.68.0",
+    "version": "0.80.0",
     "default_tier": "standard",
     "beads_integration": false,
     "context_gates": {
@@ -63,6 +63,10 @@
           {
             "type": "command",
             "command": "[ -x \"$CLAUDE_PROJECT_DIR/.claude/hooks/forge-state-rollup.sh\" ] && \"$CLAUDE_PROJECT_DIR/.claude/hooks/forge-state-rollup.sh\" || true"
+          },
+          {
+            "type": "command",
+            "command": "[ -x \"$CLAUDE_PROJECT_DIR/.claude/hooks/forge-size-gate.sh\" ] && \"$CLAUDE_PROJECT_DIR/.claude/hooks/forge-size-gate.sh\" || true"
           }
         ]
       }
@@ -141,6 +145,15 @@
             "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/block-dangerous-commands.sh\""
           }
         ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/protect-primary-checkout.sh\""
+          }
+        ]
       }
     ]
   }