forge-workflow 0.0.10 → 0.1.0-beta.2

package/scripts/preflight-sonar.eslint.config.mjs

@@ -0,0 +1,44 @@
+// Isolated ESLint flat config for `forge preflight`'s SonarCloud-parity gate.
+//
+// Run ONLY via `eslint --no-config-lookup --config scripts/preflight-sonar.eslint.config.mjs`
+// on changed files, so these Sonar rules never merge with the repo's main
+// eslint.config.js. The point is deterministic parity with the SonarCloud
+// quality gate WITHOUT the full (slow) Sonar scanner, on the change blast radius.
+//
+// cognitive-complexity is pinned to 15 — the same threshold SonarCloud's default
+// "Cognitive Complexity" (S3776) gate uses, and the most common gate failure.
+//
+// Rule name ↔ Sonar rule ID (eslint-plugin-sonarjs v4):
+//   sonarjs/cognitive-complexity  S3776  (pinned to 15)
+//   sonarjs/void-use              S3735  (void should not be used)
+//   sonarjs/regex-complexity      S5843  (regex too complex)
+//
+// prefer-optional-chain (S6582) is intentionally omitted: sonarjs exposes it
+// only through the TypeScript type-checker path, which this fast JS-only gate
+// does not wire (it would require @typescript-eslint/parser + a project graph
+// and defeats the speed goal). CI's full Sonar scan still enforces it.
+import sonarjs from 'eslint-plugin-sonarjs';
+
+const sonarRules = {
+  'sonarjs/cognitive-complexity': ['error', 15],
+  'sonarjs/void-use': 'error',
+  'sonarjs/regex-complexity': 'error',
+};
+
+export default [
+  {
+    ignores: ['node_modules/', 'coverage/', 'dist/', 'build/', '**/*.min.js'],
+  },
+  {
+    files: ['**/*.mjs'],
+    languageOptions: { ecmaVersion: 2023, sourceType: 'module' },
+    plugins: { sonarjs },
+    rules: sonarRules,
+  },
+  {
+    files: ['**/*.js', '**/*.cjs'],
+    languageOptions: { ecmaVersion: 2023, sourceType: 'commonjs' },
+    plugins: { sonarjs },
+    rules: sonarRules,
+  },
+];

package/scripts/preflight.sh

@@ -1,8 +1,14 @@
 #!/usr/bin/env bash
 set -u
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -f "$SCRIPT_DIR/bootstrap-windows-tools.sh" ]; then
+  source "$SCRIPT_DIR/bootstrap-windows-tools.sh"
+fi
+
+FORGE_CLI="$SCRIPT_DIR/../bin/forge.js"
+
 exit_code=0
-have_bd=0
 have_gh=0
 
 ok() {
@@ -21,62 +27,6 @@ action() {
   exit_code=2
 }
 
-snapshot_hooks_dir() {
-  hooks_dir="$1"
-  hooks_snapshot_dir="$(mktemp -d 2>/dev/null || mktemp -d -t forge-preflight-hooks)"
-
-  if [ -d "$hooks_dir" ]; then
-    cp -pR "$hooks_dir"/. "$hooks_snapshot_dir"/
-  fi
-}
-
-restore_hooks_dir() {
-  hooks_dir="$1"
-  mkdir -p "$hooks_dir"
-
-  find "$hooks_dir" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
-
-  if [ -d "$hooks_snapshot_dir" ]; then
-    cp -pR "$hooks_snapshot_dir"/. "$hooks_dir"/
-    rm -rf "$hooks_snapshot_dir"
-  fi
-}
-
-write_beads_config() {
-  mkdir -p .beads
-  {
-    printf '%s\n' 'issue-prefix: forge'
-    printf '\n'
-    printf '%s\n' 'database:'
-    printf '%s\n' '  backend: dolt'
-    printf '\n'
-  } > .beads/config.yaml
-}
-
-write_beads_gitignore() {
-  mkdir -p .beads
-  {
-    printf '%s\n' '# Dolt database files (binary, not suitable for git)'
-    printf '%s\n' 'dolt/'
-    printf '%s\n' '*.db'
-    printf '%s\n' '*.lock'
-    printf '\n'
-  } > .beads/.gitignore
-}
-
-safe_bd_init() {
-  hooks_dir="$(git rev-parse --git-path hooks 2>/dev/null || printf '.git/hooks')"
-  write_beads_config
-  write_beads_gitignore
-  snapshot_hooks_dir "$hooks_dir"
-
-  bd init --database forge --prefix forge >/dev/null 2>&1
-  init_status=$?
-
-  restore_hooks_dir "$hooks_dir"
-  return "$init_status"
-}
-
 is_windows_shell() {
   case "$(uname -s 2>/dev/null || printf unknown)" in
     MINGW*|MSYS*|CYGWIN*)
@@ -107,10 +57,7 @@ check_tool() {
 }
 
 check_tools() {
-  if check_tool "bd" "install Forge/Beads tooling, then rerun: bunx forge setup --quick"; then
-    have_bd=1
-  fi
-
+  check_tool "node" "install Node.js (https://nodejs.org)" || true
   check_tool "jq" "winget install jqlang.jq" || true
 
   if check_tool "gh" "winget install GitHub.cli"; then
@@ -131,50 +78,30 @@ check_github_auth() {
   action "github-auth" "not logged in; run: gh auth login"
 }
 
-check_beads() {
-  if [ "$have_bd" -ne 1 ]; then
-    return 0
-  fi
-
-  init_ok=0
-  if bd list --json --limit 1 >/dev/null 2>&1; then
-    ok "beads-init" "Beads database is readable"
-    init_ok=1
+# Validate the Forge Kernel issue store. The kernel DB is a single-machine
+# SQLite store in the git common dir; any kernel issue command auto-migrates it
+# via broker.initialize(), so the ensure step is just a kernel read. `forge
+# doctor` then reports the filesystem class of that DB path (D19) — it only
+# reports, it does not init, which is why the ensure step runs first.
+check_kernel() {
+  if node "$FORGE_CLI" issue list --json >/dev/null 2>&1; then
+    ok "kernel-init" "Kernel issue store is readable"
   else
-    if safe_bd_init; then
-      fixed "beads-init" "ran hook-preserving bd init --database forge --prefix forge"
-      init_ok=1
-    else
-      action "beads-init" "bd init failed; inspect Beads setup manually"
-    fi
-  fi
-
-  if [ "$init_ok" -ne 1 ]; then
+    action "kernel-init" "kernel issue store not initializable; inspect: node bin/forge.js doctor"
     return 0
   fi
 
-  doctor_output="$(bd doctor --fix --yes 2>&1)"
-  doctor_status=$?
-  if [ "$doctor_status" -eq 0 ]; then
-    doctor_output_lower="$(printf '%s' "$doctor_output" | tr '[:upper:]' '[:lower:]')"
-    if [ "$exit_code" -eq 1 ] ||
-      [[ "$doctor_output_lower" == *fix* ]] ||
-      [[ "$doctor_output_lower" == *repair* ]] ||
-      [[ "$doctor_output_lower" == *migrat* ]] ||
-      [[ "$doctor_output_lower" == *updat* ]]; then
-      fixed "beads-doctor" "ran bd doctor --fix --yes after Beads repair"
-    else
-      ok "beads-doctor" "bd doctor --fix --yes succeeded"
-    fi
+  if node "$FORGE_CLI" doctor >/dev/null 2>&1; then
+    ok "kernel-doctor" "forge doctor reports a healthy filesystem for the kernel database"
   else
-    action "beads-doctor" "bd doctor --fix --yes failed; inspect Beads manually"
+    action "kernel-doctor" "forge doctor reports an unhealthy filesystem; inspect the kernel database path"
   fi
 }
 
 main() {
   check_tools
   check_github_auth
-  check_beads
+  check_kernel
   exit "$exit_code"
 }
 

package/scripts/protected-state-check.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+
+const { execFileSync } = require('node:child_process');
+const {
+	assertProtectedWriteAllowed,
+	recordProtectedStateAuditEvent,
+} = require('../lib/protected-state-surfaces');
+
+function parseNameStatus(output) {
+	const files = [];
+	for (const line of output.split(/\r?\n/)) {
+		const trimmed = line.trim();
+		if (!trimmed) continue;
+		const parts = trimmed.split('\t').filter(Boolean);
+		const status = parts[0] || '';
+		if (/^[RC]/.test(status)) {
+			files.push(...parts.slice(1, 3));
+		} else {
+			files.push(parts[1]);
+		}
+	}
+	return [...new Set(files.filter(Boolean))];
+}
+
+function getStagedFiles() {
+	if (process.env.FORGE_PROTECTED_STATE_STAGED_NAME_STATUS !== undefined) {
+		return parseNameStatus(process.env.FORGE_PROTECTED_STATE_STAGED_NAME_STATUS);
+	}
+
+	if (process.env.FORGE_PROTECTED_STATE_STAGED_FILES !== undefined) {
+		return process.env.FORGE_PROTECTED_STATE_STAGED_FILES
+			.split(/\r?\n/)
+			.map(line => line.trim())
+			.filter(Boolean);
+	}
+
+	const output = execFileSync('git', ['diff', '--cached', '--name-status', '--diff-filter=ACMRDT'], {
+		encoding: 'utf8',
+		stdio: ['ignore', 'pipe', 'pipe'],
+	});
+	return parseNameStatus(output);
+}
+
+function getAllowedSurfaces() {
+	return new Set(
+		String(process.env.FORGE_PROTECTED_STATE_ALLOWED_SURFACES || '')
+			.split(',')
+			.map(surface => surface.trim())
+			.filter(Boolean),
+	);
+}
+
+function main() {
+	const actor =
+		process.env.FORGE_PROTECTED_STATE_ACTOR ||
+		process.env.FORGE_ACTOR ||
+		process.env.USER ||
+		process.env.USERNAME ||
+		'unknown';
+	const allowedSurfaces = getAllowedSurfaces();
+	const decisions = getStagedFiles()
+		.map(file => {
+			const probe = assertProtectedWriteAllowed(file, { actor, operation: 'staged_edit' });
+			if (probe.requiredSurface && allowedSurfaces.has(probe.requiredSurface)) {
+				return assertProtectedWriteAllowed(file, {
+					actor,
+					operation: 'staged_edit',
+					viaForgeApi: true,
+					surface: probe.requiredSurface,
+				});
+			}
+			return probe;
+		})
+		.filter(decision => !decision.allowed);
+
+	for (const decision of decisions) {
+		const audit = recordProtectedStateAuditEvent(decision, { cwd: process.cwd() });
+		if (!audit.success) {
+			console.error(`WARN: Failed to record protected-state audit for ${decision.path}: ${audit.error}`);
+		}
+	}
+
+	if (decisions.length === 0) {
+		console.log('OK: No protected state edits detected.');
+		process.exit(0);
+	}
+
+	console.error('ERROR: Protected state edit detected. Direct edits to these paths are blocked:');
+	for (const decision of decisions) {
+		console.error(`  - ${decision.path} [${decision.requiredSurface}]`);
+		console.error(`    Decision: ${decision.decision}`);
+		console.error(`    Repair: ${decision.repairHint}`);
+	}
+	console.error('');
+	console.error('Use the owning Forge or Beads API surface, then stage the generated result if that command explicitly owns it.');
+	process.exit(1);
+}
+
+try {
+	main();
+} catch (error) {
+	console.error(`Protected state check failed: ${error.message}`);
+	process.exit(1);
+}

package/scripts/smart-status.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 # smart-status.sh — Workflow intelligence scoring engine
 #
-# Reads issues via `bd list --json --limit 0`, computes a composite score
-# for each issue, and outputs them sorted by score descending.
+# Reads issues via `forge issue list --json` (Forge Kernel), computes a composite
+# score for each issue, and outputs them sorted by score descending.
 #
 # Composite score:
 #   priority_weight * unblock_chain * type_weight * status_boost * epic_proximity * staleness_boost
@@ -11,7 +11,7 @@
 #   smart-status.sh [--json]
 #
 # Environment:
-#   BD_CMD  — override the bd command (for testing with mocks)
+#   FORGE_CMD— override the forge command (for testing with mocks)
 #   GIT_CMD — override the git command (for testing with mocks)
 #   DEFAULT_BRANCH — override the default branch name (default: auto-detect)
 #
@@ -25,7 +25,28 @@ set -euo pipefail
 # sync-utils.sh: get_session_identity for current developer identity
 
 _SMART_STATUS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -f "$_SMART_STATUS_DIR/bootstrap-windows-tools.sh" ]; then
+  source "$_SMART_STATUS_DIR/bootstrap-windows-tools.sh"
+fi
 NODE_CMD="${NODE_CMD:-node}"
+JQ_CMD="${JQ_CMD:-jq}"
+
+node_script_path() {
+  case "$1" in
+    /[A-Za-z]/*)
+      _drive="$(printf '%s' "${1:1:1}" | tr '[:lower:]' '[:upper:]')"
+      printf '%s:/%s\n' "$_drive" "${1:3}"
+      ;;
+    *)
+      if command -v cygpath >/dev/null 2>&1; then
+        cygpath -m "$1"
+      else
+        printf '%s\n' "$1"
+      fi
+      ;;
+  esac
+}
+
 if [ -f "$_SMART_STATUS_DIR/lib/sanitize.sh" ]; then
   source "$_SMART_STATUS_DIR/lib/sanitize.sh"
 fi
@@ -59,7 +80,7 @@ fi
 
 # ── Dependency check ────────────────────────────────────────────────────
 
-if ! command -v jq &>/dev/null; then
+if ! command -v "$JQ_CMD" &>/dev/null; then
   echo "Error: jq is required but not found." >&2
   echo "Install jq:" >&2
   echo "  macOS:   brew install jq" >&2
@@ -71,7 +92,7 @@ fi
 # Warn if jq < 1.6 (fromdateiso8601 and sub/2 require 1.6+)
 # Strip CR here as well because Windows jq.exe (or a CRLF-emitting wrapper in
 # tests) can affect the version probe before the jq() shim is defined below.
-_jq_version="$(command jq --version 2>/dev/null | tr -d '\r' | sed 's/jq-//')" || true
+_jq_version="$(command "$JQ_CMD" --version 2>/dev/null | tr -d '\r' | sed 's/jq-//')" || true
 if [ -n "$_jq_version" ]; then
   _jq_major="${_jq_version%%.*}"
   _jq_minor="${_jq_version#*.}"; _jq_minor="${_jq_minor%%.*}"
@@ -84,12 +105,12 @@ fi
 # numeric comparisons like `[ "$count" -gt 0 ]`. Strip trailing CRs from
 # all jq output after the dependency/version checks above.
 jq() {
-  command jq "$@" | tr -d '\r'
+  command "$JQ_CMD" "$@" | tr -d '\r'
 }
 
 # ── Configuration ───────────────────────────────────────────────────────
 
-BD="${BD_CMD:-bd}"
+FORGE="${FORGE_CMD:-forge}"
 GIT="${GIT_CMD:-git}"
 JSON_MODE=0
 
@@ -127,42 +148,16 @@ done
 
 # ── Fetch issues ────────────────────────────────────────────────────────
 
-# Auto-recover beads database if Dolt server lost the database (e.g. branch
-# switch, fresh clone, server restart).  Checks for the specific "database
-# not found" error, runs bd init --force + bd backup restore, then retries.
-# Capture stderr into variable (2>&1 redirects stderr to stdout for capture,
-# then >/dev/null discards original stdout so only errors remain).
-if ! command -v "$BD" >/dev/null 2>&1; then
-  echo "Error: bd is required but not found." >&2
-  exit 1
-fi
-
-_bd_list_err="$("$BD" list --json --limit 0 2>&1 >/dev/null || true)"
-if printf '%s' "$_bd_list_err" | grep -qi "database.*not found"; then
-  _repo_root="$("$GIT" rev-parse --show-toplevel 2>/dev/null || pwd)"
-  _metadata_path="$_repo_root/.beads/metadata.json"
-  _bd_prefix=""
-  if [ -f "$_metadata_path" ]; then
-    if _metadata_prefix="$(jq -r '(.dolt_database // "") | strings' "$_metadata_path" 2>/dev/null)"; then
-      _bd_prefix="$(printf '%s' "$_metadata_prefix" | tr -d '\r')"
-    fi
-  fi
-  if [ -z "$_bd_prefix" ]; then
-    _bd_prefix="$(basename "$_repo_root" | tr '[:upper:]' '[:lower:]' | tr -cs '[:alnum:]-' '-' | sed 's/^-//;s/-$//')"
-  fi
-  echo "Beads database not found - attempting auto-recovery..." >&2
-  if "$BD" init --force --prefix "$_bd_prefix" >/dev/null 2>&1; then
-    if [ -d "$_repo_root/.beads/backup" ] && ls "$_repo_root/.beads/backup"/*.jsonl >/dev/null 2>&1; then
-      "$BD" backup restore >/dev/null 2>&1 && echo "Beads: restored from backup." >&2 || echo "Beads: backup restore failed." >&2
-    else
-      echo "Beads: initialized fresh (no backup found)." >&2
-    fi
-  else
-    echo "Beads: auto-recovery failed - run 'bd doctor' manually." >&2
-  fi
-fi
-
-ISSUES_JSON="$("$BD" list --json --limit 0 2>/dev/null || echo '[]')"
+# Fetch issues from the Forge Kernel and normalize the envelope into the bare
+# array the scorer + grouping expect: extract .data.issues and drop terminal
+# (done/cancelled) issues so completed work never pollutes the work queue. The
+# kernel already supplies each issue's `dependents` (reverse-graph) and
+# `dependencies` arrays, so no per-issue reshaping is needed. The kernel
+# auto-migrates its single-machine SQLite store on read — nothing to recover.
+ISSUES_JSON="$("$FORGE" issue list --json 2>/dev/null | jq '[
+  .data.issues[]
+  | select(.status != "done" and .status != "cancelled")
+]' 2>/dev/null || echo '[]')"
 
 # Bail early on empty
 if [ "$(printf '%s' "$ISSUES_JSON" | jq 'length')" = "0" ]; then
@@ -185,9 +180,14 @@ if [ -n "$EPIC_IDS" ]; then
   # Process each epic (bash 3.2 compatible — read line by line)
   while IFS= read -r epic_id; do
     [ -z "$epic_id" ] && continue
-    CHILDREN_JSON="$("$BD" children "$epic_id" --json 2>/dev/null || echo '[]')"
-    TOTAL="$(printf '%s' "$CHILDREN_JSON" | jq 'length')"
-    CLOSED="$(printf '%s' "$CHILDREN_JSON" | jq '[.[] | select(.status == "closed")] | length')"
+    # Kernel `forge issue children` returns the rollup envelope; read total + the done
+    # count straight from the kernel-computed rollup (the kernel `done` status replaces
+    # the beads `closed` this math used to count). EPIC_STATS keeps its { total, closed }
+    # shape, so smart-status-score.js / scoring.js:getEpicProximity stay untouched.
+    CHILDREN_JSON="$("$FORGE" issue children "$epic_id" --json 2>/dev/null || echo '{}')"
+    [ -z "$CHILDREN_JSON" ] && CHILDREN_JSON='{}'
+    TOTAL="$(printf '%s' "$CHILDREN_JSON" | jq -r '(.data.rollup.total // 0)')"
+    CLOSED="$(printf '%s' "$CHILDREN_JSON" | jq -r '(.data.rollup.done // 0)')"
     EPIC_STATS="$(printf '%s' "$EPIC_STATS" | jq --arg id "$epic_id" --argjson total "$TOTAL" --argjson closed "$CLOSED" '. + {($id): {total: $total, closed: $closed}}')"
   done <<EOF
 $EPIC_IDS
@@ -201,7 +201,7 @@ if ! command -v "$NODE_CMD" >/dev/null 2>&1; then
   exit 1
 fi
 
-SCORED_JSON="$(printf '{"issues":%s,"epicStats":%s}' "$ISSUES_JSON" "$EPIC_STATS" | "$NODE_CMD" "$_SMART_STATUS_DIR/smart-status-score.js")"
+SCORED_JSON="$(printf '{"issues":%s,"epicStats":%s}' "$ISSUES_JSON" "$EPIC_STATS" | "$NODE_CMD" "$(node_script_path "$_SMART_STATUS_DIR/smart-status-score.js")")"
 
 # ── Session detection ─────────────────────────────────────────────────
 
@@ -218,16 +218,15 @@ WORKTREE_PORCELAIN="$("$GIT" worktree list --porcelain 2>/dev/null || echo '')"
 # only performs command execution and rendering.
 IN_PROGRESS_JSON="[]"
 if [ -n "$WORKTREE_PORCELAIN" ]; then
-  IN_PROGRESS_JSON="$("$BD" list --status in_progress --json --limit 0 2>/dev/null || echo '')"
-  if [ -z "$IN_PROGRESS_JSON" ] || ! printf '%s' "$IN_PROGRESS_JSON" | jq empty 2>/dev/null; then
-    IN_PROGRESS_JSON="$(printf '%s' "$ISSUES_JSON" | jq '[.[] | select(.status == "in_progress")]')"
-  fi
+  # In-progress issues come straight from the already-fetched kernel list (it
+  # includes in_progress; only done/cancelled were dropped during the fetch).
+  IN_PROGRESS_JSON="$(printf '%s' "$ISSUES_JSON" | jq '[.[] | select(.status == "in_progress")]')"
 fi
 
 SESSIONS_JSON="$(printf '{"baseBranch":%s,"worktreePorcelain":%s,"inProgressIssues":%s}' \
   "$(printf '%s' "$BASE_BRANCH" | jq -R '.')" \
   "$(printf '%s' "$WORKTREE_PORCELAIN" | jq -Rs '.')" \
-  "$IN_PROGRESS_JSON" | "$NODE_CMD" "$_SMART_STATUS_DIR/smart-status-sessions.js")"
+  "$IN_PROGRESS_JSON" | "$NODE_CMD" "$(node_script_path "$_SMART_STATUS_DIR/smart-status-sessions.js")")"
 SESSION_COUNT="$(printf '%s' "$SESSIONS_JSON" | jq 'length')"
 
 if [ "$SESSION_COUNT" -ge 2 ]; then
@@ -246,7 +245,7 @@ if [ "$SESSION_COUNT" -ge 2 ]; then
 $_session_branches
 BRANCHEOF
 
-  SESSIONS_JSON="$(printf '{"sessions":%s,"branchFiles":%s}' "$SESSIONS_JSON" "$BRANCH_FILES_JSON" | "$NODE_CMD" "$_SMART_STATUS_DIR/smart-status-sessions.js")"
+  SESSIONS_JSON="$(printf '{"sessions":%s,"branchFiles":%s}' "$SESSIONS_JSON" "$BRANCH_FILES_JSON" | "$NODE_CMD" "$(node_script_path "$_SMART_STATUS_DIR/smart-status-sessions.js")")"
 fi
 
 TIER2_ENABLED=0
@@ -294,7 +293,7 @@ if [ "$TIER2_ENABLED" = "1" ]; then
 $_conflict_pairs
 PAIRSEOF
 
-    SESSIONS_JSON="$(printf '{"sessions":%s,"mergeTreeResults":%s}' "$SESSIONS_JSON" "$MERGE_TREE_RESULTS_JSON" | "$NODE_CMD" "$_SMART_STATUS_DIR/smart-status-sessions.js")"
+    SESSIONS_JSON="$(printf '{"sessions":%s,"mergeTreeResults":%s}' "$SESSIONS_JSON" "$MERGE_TREE_RESULTS_JSON" | "$NODE_CMD" "$(node_script_path "$_SMART_STATUS_DIR/smart-status-sessions.js")")"
   fi
 fi
 
@@ -478,14 +477,18 @@ else
       # Group assignment (priority order: RESUME > UNBLOCK_CHAINS > BLOCKED > BACKLOG > READY_WORK)
       # Note: in_progress issues with active blockers still show in RESUME (you started
       # the work, you need to see it) but get a "BLOCKED" annotation in the output.
+      # Counts come from the scorer output: dependents is the reverse-graph
+      # array it computes, dependencies is the normalized { depends_on_id }
+      # list. done/cancelled were dropped at fetch; the status guards below stay
+      # as defense-in-depth so a terminal issue can never land in BLOCKED.
       (if .status == "in_progress" then "RESUME"
-       elif (.dependent_count // 0) >= 2 then "UNBLOCK_CHAINS"
-       elif (.dependency_count // 0) > 0 and .status != "closed" then "BLOCKED"
+       elif ((.dependents // []) | length) >= 2 then "UNBLOCK_CHAINS"
+       elif ((.dependencies // []) | length) > 0 and .status != "done" and .status != "cancelled" then "BLOCKED"
        elif (.priority == "P4" or .priority == 4) then "BACKLOG"
        else "READY_WORK"
        end) as $group |
       # Flag in_progress issues that have active blockers
-      (if .status == "in_progress" and (.dependency_count // 0) > 0 then true else false end) as $blocked_resume |
+      (if .status == "in_progress" and ((.dependencies // []) | length) > 0 then true else false end) as $blocked_resume |
       $item + { group: $group, days_ago: $days_ago, blocked_resume: $blocked_resume }
     ] |
 

package/scripts/spikes/config-race-bench.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+'use strict';
+
+const { performance } = require('node:perf_hooks');
+
+function readNumberFlag(args, name, fallback) {
+  const index = args.indexOf(name);
+  if (index === -1) return fallback;
+  const value = Number(args[index + 1]);
+  if (!Number.isFinite(value) || value < 0) {
+    throw new Error(`${name} must be a non-negative number`);
+  }
+  return value;
+}
+
+function assertPositiveInteger(name, value) {
+  if (!Number.isInteger(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer`);
+  }
+}
+
+function machinePatch(trial, machine) {
+  const sharedValue = trial % 10 === 0 ? `shared-${trial}` : undefined;
+  const conflictingValue = trial === 37 ? `${machine}-conflict-${trial}` : undefined;
+  return {
+    machine,
+    global: {
+      ...(sharedValue ? { 'stage.review.timeout': sharedValue } : {}),
+      ...(conflictingValue ? { 'stage.dev.parallelism': conflictingValue } : {}),
+    },
+    machineLocal: {
+      [`${machine}.shell`]: machine === 'machine-a' ? 'git-bash' : 'pwsh',
+      [`${machine}.workspace`]: `.forge/machines/${machine}`,
+    },
+  };
+}
+
+function mergeTrial(trial) {
+  const left = machinePatch(trial, 'machine-a');
+  const right = machinePatch(trial, 'machine-b');
+  const merged = { global: {}, machineLocal: {} };
+  const conflicts = [];
+
+  for (const patch of [left, right]) {
+    Object.assign(merged.machineLocal, patch.machineLocal);
+  }
+
+  const globalKeys = new Set([...Object.keys(left.global), ...Object.keys(right.global)]);
+  for (const key of globalKeys) {
+    const leftHas = Object.prototype.hasOwnProperty.call(left.global, key);
+    const rightHas = Object.prototype.hasOwnProperty.call(right.global, key);
+    if (leftHas && rightHas && left.global[key] !== right.global[key]) {
+      conflicts.push(key);
+      continue;
+    }
+    merged.global[key] = leftHas ? left.global[key] : right.global[key];
+  }
+
+  return {
+    trial,
+    manualResolve: conflicts.length > 0,
+    conflicts,
+    mergedKeyCount: Object.keys(merged.global).length + Object.keys(merged.machineLocal).length,
+  };
+}
+
+function runBench(options = {}) {
+  const trials = options.trials ?? 50;
+  const threshold = options.threshold ?? 0.05;
+  assertPositiveInteger('trials', trials);
+
+  const start = performance.now();
+  const results = Array.from({ length: trials }, (_, index) => mergeTrial(index + 1));
+  const manualResolves = results.filter((result) => result.manualResolve);
+  const manualResolveRate = manualResolves.length / trials;
+  const elapsedMs = performance.now() - start;
+
+  return {
+    spike: 'cross-machine-config-race',
+    trials,
+    manualResolves: manualResolves.length,
+    manualResolveRate,
+    threshold,
+    passed: manualResolveRate < threshold,
+    elapsedMs: Number(elapsedMs.toFixed(3)),
+    complexity: 'O(trials * changed keys); machine-local files avoid shared-file git conflicts',
+    conflictTrials: manualResolves.map((result) => ({
+      trial: result.trial,
+      conflicts: result.conflicts,
+    })),
+  };
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  const result = runBench({
+    trials: readNumberFlag(args, '--trials', 50),
+    threshold: readNumberFlag(args, '--threshold', 0.05),
+  });
+
+  console.log(JSON.stringify(result, null, args.includes('--json') ? 0 : 2));
+  if (!result.passed) {
+    process.exitCode = 1;
+  }
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = { runBench, mergeTrial };

package/scripts/spikes/harness-capability-matrix.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+'use strict';
+
+const { buildHarnessCapabilityEvidence } = require('../../lib/harness-capability-matrix');
+
+function main() {
+  const evidence = buildHarnessCapabilityEvidence();
+  console.log(JSON.stringify(evidence, null, 2));
+}
+
+if (require.main === module) {
+  main();
+}