forge-workflow 0.1.0-beta.5 → 0.1.0-beta.6

package/scripts/test-profile.js

@@ -159,6 +159,17 @@ function finalizeSignalMetrics(metrics, fileDurations) {
   };
 }
 
+function parseJUnitTestcases(content) {
+  if (typeof content !== 'string') return [];
+  return Array.from(
+    content.matchAll(/<testcase\b([^>]*?)(?:\/>|>([\s\S]*?)<\/testcase>)/g),
+    (match) => ({
+      attrs: parseAttributes(match[1] || ''),
+      body: match[2] || '',
+    }),
+  );
+}
+
 function parseJUnitFiles(files) {
   const fileDurations = new Map();
   const timedOutFiles = new Set();
@@ -177,9 +188,7 @@ function parseJUnitFiles(files) {
       suiteDurationMs += Math.round(Number.parseFloat(attrs.time || '0') * 1000);
     }
 
-    for (const caseMatch of content.matchAll(/<testcase\b([^>]*)>([\s\S]*?)<\/testcase>|<testcase\b([^>]*)\/>/g)) {
-      const attrs = parseAttributes(caseMatch[1] || caseMatch[3] || '');
-      const body = caseMatch[2] || '';
+    for (const { attrs, body } of parseJUnitTestcases(content)) {
       const durationMs = Math.round(Number.parseFloat(attrs.time || '0') * 1000);
       const fallbackFile = path.basename(file);
       const testcase = classifyTestcase({
@@ -273,6 +282,7 @@ module.exports = {
   parseArgs,
   parseAttributes,
   parseJUnitFiles,
+  parseJUnitTestcases,
   selectPrimaryBucket,
   walk,
 };

package/scripts/test.js

@@ -23,11 +23,13 @@ const fs = require('node:fs');
 const {
   getAffectedTestFiles,
   getChangedFiles,
+  isFullSuiteRequiredFile,
 } = require('../lib/commands/test');
 const { createProcessTree, signalExitCode } = require('./process-tree');
 
 const PACKAGE_LEVEL_PATHS = new Set([
   'package.json',
+  'bun.lock',
   'bun.lockb',
   'pnpm-lock.yaml',
   'yarn.lock',
@@ -41,8 +43,49 @@ const KNOWN_TARGETABLE_PREFIXES = [
   '.github/agentic-workflows/',
   '.github/workflows/',
   'test/',
+  // Source trees with a dedicated suite; see PREFIX_TEST_TARGETS in
+  // lib/commands/test.js for the tests each one resolves to. Without both halves
+  // (targetable here + a resolved test there) a change falls to the full-suite lane.
+  'validation/',
+  'eval/',
+  'rules/',
+  'plugin/',
 ];
 
+// Individually mapped root files (see DIRECT_TEST_CANDIDATES in lib/commands/test.js).
+const KNOWN_TARGETABLE_FILES = new Set([
+  'lefthook.yml',
+  'eslint.config.js',
+  '.coderabbit.yaml',
+  'CODING_STANDARDS.md',
+  '.claude-plugin/marketplace.json',
+  'lib/kernel/schema.js',
+  'lib/kernel/migrations.js',
+  'lib/kernel/sqlite-driver.js',
+  'lib/commands/shepherd.js',
+  'lib/commands/github.js',
+  'lib/github-context.js',
+  'lib/commands/_registry.js',
+  'lib/commands/pr.js',
+  'lib/commands/ship.js',
+  'lib/commands/merge.js',
+  'lib/commands/team.js',
+  'lib/commands/clean.js',
+  'scripts/github-context-bridge.sh',
+  'lib/commands/push.js',
+  'lib/commands/hooks.js',
+  'lib/commands/serve.js',
+  'lib/commands/skill.js',
+  'scripts/lib/behavioral-eval-runtime.js',
+  'web/dashboard/generate-snapshot.mjs',
+  'lib/pr-monitor/watch-owner.js',
+  'lib/pr-monitor/reconcile.js',
+  'lib/pr-monitor/reconcile-executor.js',
+  'lib/pr-monitor/watch-lifecycle.js',
+  'lib/pr-monitor/shepherd-lease.js',
+  'lib/pr-monitor/monitor.js',
+]);
+
 const ALWAYS_RUN_RISK_TEST_TARGETS = [
   // Windows + concurrent filesystem locking has failed post-merge; keep this
   // in the fast PR lane until enough full-matrix runs prove it stable.
@@ -64,14 +107,29 @@ const isWindows = process.platform === 'win32';
 // wedged). Raise it with FORGE_TEST_TIMEOUT_MS for slow machines.
 const DEFAULT_TEST_COMMAND_TIMEOUT_MS = 5 * 60 * 1000;
 
-// Wall-clock budget for the FULL-SUITE fallback lane (`scripts/test-full-suite.js`),
-// which runs on package-level, unmapped, or zero-resolved changes. Unlike a
-// targeted lane, a healthy full suite legitimately takes 5-10 min, so the 5-min
-// fail-fast ceiling would kill a good-but-slow full run. Kept at 10 min to stay
-// aligned with the local-validation budget (VALIDATION_COMMAND_TIMEOUT_MS = 600000
-// in lib/commands/validate.js and its "long enough subprocess timeout for the
-// full local suite" regression test). FORGE_TEST_TIMEOUT_MS still overrides.
-const DEFAULT_FULL_SUITE_TIMEOUT_MS = 10 * 60 * 1000;
+// Measured wall-clock runtime of a HEALTHY, fully passing full suite on a
+// developer Windows machine with pinned Bun 1.3.12 (2026-08-26):
+//
+//   8005 pass, 32 skip, 1 todo, 0 fail — 8038 tests across 594 files [602.43s]
+//
+// Any full-suite budget must clear this by a wide margin. Treat it as a floor to
+// measure against, never as the budget itself.
+const OBSERVED_FULL_SUITE_RUNTIME_MS = 602_430;
+
+// Wall-clock budget for the FULL-SUITE lane (`scripts/test-full-suite.js` and the
+// package-level `test` script run by `forge push`), used on package-level,
+// unmapped, or zero-resolved changes.
+//
+// This ceiling exists to catch an INDEFINITE HANG (issue 8aef79e8: a synchronous
+// git/bash spawn wedged during git mid-push state, observed ~50 min), not to
+// bound normal runtime. So it is sized as ~2x the measured healthy runtime above,
+// not fitted to it. The previous 10-min value was BELOW the 602.43s measurement,
+// so it SIGKILLed passing suites — `forge push` died mid-suite with no summary
+// and never pushed. 25 min is the next round number clearing 2x the measurement
+// (1_204_860 ms). Do not shave this back toward the observed runtime; if a
+// slower machine needs more, raise FORGE_TEST_TIMEOUT_MS (which still overrides)
+// and re-measure before changing this default.
+const DEFAULT_FULL_SUITE_TIMEOUT_MS = 25 * 60 * 1000;
 
 // Conventional shell exit code for a command terminated by a timeout.
 const TIMEOUT_EXIT_CODE = 124;
@@ -114,9 +172,10 @@ function resolveCommandTimeoutMs(env = process.env) {
 }
 
 /**
- * Resolves the wall-clock budget for the full-suite fallback lane. An explicit
+ * Resolves the wall-clock budget for the full-suite lane. An explicit
  * FORGE_TEST_TIMEOUT_MS override wins; otherwise it uses the larger,
- * validation-aligned budget so a healthy-but-slow full run is not failed fast.
+ * measurement-derived budget (~2x OBSERVED_FULL_SUITE_RUNTIME_MS) so a healthy
+ * full run is never failed fast.
  *
  * @param {NodeJS.ProcessEnv} [env=process.env] Environment to read the override from.
  * @returns {number} Timeout in milliseconds (defaults to DEFAULT_FULL_SUITE_TIMEOUT_MS).
@@ -183,6 +242,10 @@ function isKnownTargetablePath(file) {
     return true;
   }
 
+  if (KNOWN_TARGETABLE_FILES.has(file)) {
+    return true;
+  }
+
   if (file === 'README.md'
     || file === 'bin/forge.js'
     || file === 'bin/forge-cmd.js'
@@ -202,7 +265,11 @@ function isKnownTargetablePath(file) {
     // SKILL_TEST_TARGETS in lib/commands/test.js); a skills-only PR stays on the
     // targeted lane instead of the full suite.
     || file.startsWith('skills/')
-    || file.startsWith('.agents/skills/')) {
+    || file.startsWith('.agents/skills/')
+    // Maintainer-only contributor skills (tracked, never published). They map to
+    // the AGENTS.md docs-bleed gate in lib/commands/test.js, so a contributor-docs
+    // PR stays on the targeted lane instead of the full suite.
+    || file.startsWith('.forge/contributor-skills/')) {
     return true;
   }
 
@@ -248,17 +315,28 @@ function buildTestExecutionPlan(projectRoot, execFileSync = defaultExecFileSync,
     sinceUpstream: options.sinceUpstream !== false,
   };
   const changedFiles = getChangedFiles(execFileSync, diffOptions);
-  const affectedTestTargets = getAffectedTestFiles(projectRoot, execFileSync, fs, diffOptions);
+  const affectedTestTargets = getAffectedTestFiles(projectRoot, execFileSync, fs, {
+    ...diffOptions,
+    changedFiles,
+  });
 
   let runFullSuite = false;
   let runTestEnv = false;
   let runE2E = false;
   let runWorkflowTests = includesWorkflowTarget(affectedTestTargets);
   let hasUnmappedFiles = false;
+  let hasFullSuiteRequiredFiles = false;
+  let hasPackageLevelChanges = false;
   const hasUnknownChangedFiles = changedFiles.length === 0 && affectedTestTargets.length === 0;
 
   for (const file of changedFiles) {
+    if (isFullSuiteRequiredFile(file)) {
+      hasFullSuiteRequiredFiles = true;
+      runFullSuite = true;
+    }
+
     if (PACKAGE_LEVEL_PATHS.has(file) || file.startsWith('packages/')) {
+      hasPackageLevelChanges = true;
       runFullSuite = true;
       runTestEnv = true;
       runE2E = true;
@@ -309,8 +387,10 @@ function buildTestExecutionPlan(projectRoot, execFileSync = defaultExecFileSync,
       ? 'changed files could not be resolved safely'
       : hasZeroResolvedTests
         ? 'known changes did not resolve runnable tests'
-      : runFullSuite
+      : hasPackageLevelChanges
         ? 'package-level changes detected'
+      : hasFullSuiteRequiredFiles
+        ? 'shared authority changes require full unit coverage'
         : 'known changes mapped to targeted tests';
 
   return {
@@ -464,7 +544,7 @@ async function runTestExecutionPlan(plan, deps = {}) {
   const label = deps.label || 'tests';
   const timeout = resolveCommandTimeoutMs(env);
   const laneOptions = { env: childEnv, killSignal: 'SIGKILL', timeout, processTree };
-  // The full-suite fallback gets a larger, validation-aligned budget so a
+  // The full-suite fallback gets the larger, measurement-derived budget so a
   // healthy-but-slow full run is not failed fast by the targeted-lane ceiling.
   const fullSuiteOptions = {
     env: childEnv,
@@ -566,6 +646,7 @@ module.exports = {
   ALWAYS_RUN_RISK_TEST_TARGETS,
   DEFAULT_FULL_SUITE_TIMEOUT_MS,
   DEFAULT_TEST_COMMAND_TIMEOUT_MS,
+  OBSERVED_FULL_SUITE_RUNTIME_MS,
   QUICK_LANE_ENV_VAR,
   QUICK_LANE_VALUE,
   buildTestExecutionPlan,

package/skills/coverage.json

@@ -58,6 +58,7 @@
     "team": { "exempt": "team skill pending (plan §3.2 B: new `team` skill)" },
 
     "setup": "setup",
+    "github": "setup",
     "init": "setup",
     "upgrade": "setup",
     "doctor": "setup",

package/skills/review/SKILL.md

@@ -28,6 +28,8 @@ This skill handles ALL issues that arise after creating a pull request.
 
 ## What This Skill Does
 
+Before reviewing a diff, read `CODING_STANDARDS.md` from the repository root and apply every relevant rule.
+
 ### Step 1: Fetch Complete PR Status
 ```bash
 # Get full PR details including all checks

package/skills/review/evals/scorecard.json

@@ -4,8 +4,8 @@
   "static": {
     "token_cost": {
       "desc_chars": 261,
-      "body_lines": 476,
-      "score": 40
+      "body_lines": 478,
+      "score": 39
     },
     "caps": {
       "desc_within": true,

package/skills/setup/SKILL.md

@@ -30,6 +30,24 @@ forge setup --path <dir> --dry-run                   # preview against another d
 
 `forge setup` is **interactive by default**. In any automated/agent context pass `--yes` (or `--non-interactive`) so it never blocks on a prompt.
 
+# Optional GitHub accounts per clone
+
+Only when the user opts into multiple accounts: sign in once per account with
+native `gh auth login`, then select inside each intended clone:
+
+```bash
+forge github use <login>       # verify stored account/access before binding this clone
+forge github status           # safe identity and transport diagnostics; --json supported
+forge github run -- <harness>  # explicitly give a trusted child the selected GitHub identity
+forge github unset            # remove this binding, not stored logins
+```
+
+Ordinary setup stays unbound. Never paste or persist tokens, automatically log in
+or switch accounts, or change Git author/remotes/SSH/helper configuration.
+Git transport is separate; HTTPS using `gh auth git-credential` can inherit the
+explicit child session's account. See the repository reference guide
+`docs/reference/github-accounts.md` for concurrent sessions and recovery.
+
 # Initialize a fresh repo
 
 ```bash

package/skills/setup/evals/scorecard.json

@@ -4,8 +4,8 @@
   "static": {
     "token_cost": {
       "desc_chars": 1021,
-      "body_lines": 74,
-      "score": 43
+      "body_lines": 92,
+      "score": 41
     },
     "caps": {
       "desc_within": true,
@@ -37,5 +37,5 @@
     "variance": null,
     "note": "behavioral — W5 (LLM judge): semantic recall/precision/chain/outcome/variance, not deterministic"
   },
-  "composite": 83
+  "composite": 82
 }

package/skills/shepherd/SKILL.md

@@ -27,7 +27,7 @@ Forge owns your open PRs. A singleton daemon converges every open PR toward merg
 `shepherd` is the PR-ownership utility, not a workflow stage. It has two modes over the **single `forge shepherd` verb**:
 
 - **Daemon (default ownership):** `forge shepherd daemon` is a machine-wide singleton for this repo. It heartbeats and converges the whole PR world every ~60s — self-registering hand-opened PRs, restarting killed watchers, reaping verified orphans, converging CI check state into kernel verdicts, retiring merged/closed PRs — then self-retires (releases the lease, kills its children, exits) once no PRs remain open. You do NOT poll by hand; the daemon does.
-- **One-shot pass:** `forge shepherd <pr>` reads one PR's state, takes at most one idempotent Tier-A action, and exits. Use it for a point-in-time question about a single PR.
+- **One-shot convergence:** `forge shepherd <pr>` runs the local review preflight, reads one PR's current-head state, takes at most one idempotent Tier-A action, persists bounded deltas/receipts, and exits. Use it for a point-in-time question or one bounded convergence attempt on a single PR.
 
 ## Which mode? (decision rule)
 
@@ -57,12 +57,22 @@ forge shepherd events <pr> --since <seq>   # only the new events since sequence
 
 `--pull` is strictly read-only (dry-run pass: no rerun, no rebase, no merge, no thread resolution). It returns one bounded, actionable-only payload — `blockers[]`, classified `requiredChecks`, failed-check log `failures[]` (matrix-deduped), and every unresolved `reviewThreads[]` — so you get "everything blocking this PR + what to fix" in one call. Passing checks and satisfied policy are omitted.
 
+A plain `forge shepherd <pr>` also returns a consolidated `localPreflight`, at
+most 128 `deltas`, `receiptIds`, and one explicit `handoff`. The preflight probes
+CodeRabbit and runs strict lint, Sonar parity, structural drift, and affected
+tests. An unavailable or unauthenticated CodeRabbit CLI is reported as
+`UNAVAILABLE`/`INCOMPLETE`, never as a fabricated pass; deterministic failures or
+actual review findings make the remote decision read-only for that pass. A
+checkout that is not the exact PR head is `NOT_APPLICABLE`, never reviewed as if
+it were authoritative.
+
 ### Verdict vocabulary (collapsed, W-S1)
 
 | Verdict | Meaning |
 | --- | --- |
 | `MERGE_READY` | Required checks green, branch up to date — hand off to a human to merge. |
 | `PENDING` | A Tier-A action was taken, or checks are still running — await the next tick/pass. |
+| `INCOMPLETE` | Exact-head local review or durable convergence evidence is unavailable — fail closed and retry after evidence is restored. |
 | `BLOCKED` | Something actionable blocks merge (failing/missing/skipped required check, conflict, behind, unresolved threads, changes requested). Read `blockers[]`. |
 | `CI_DEAD_HEAD` | The head has no required checks running (e.g. an auto-update authored by `GITHUB_TOKEN` never re-triggered CI). Recovery is an **escalation, not an autonomous Tier-A rerun**: it needs a maintainer-provided `FORGE_PR_TOKEN` (contents + pull-requests + checks) to re-author the push so CI re-triggers. |
 | `ESCALATE` | A Tier-C condition (conflict, unreadable required set, persistent failure, oscillation, budget exhaustion). Context is posted to the PR. |
@@ -109,4 +119,11 @@ before lease, Kernel-state, or process work. All leave the manual
 
 ## State
 
-Progress is durable in GitHub (PR comments, labels, `git`). The one local store is the per-PR journal under `.forge/pr-monitor/<repo>-<pr>/` (append-only `events.ndjson` + snapshot/consumer cursors) — the replay surface for `events --since`. The bounded one-shot pass keeps no separate local state.
+Public Memory is the durable monitor authority and public Flow reducers restore
+its bounded event and watcher-process checkpoints after restart. The per-PR
+journal under `.forge/pr-monitor/<repo>-<pr>/` remains a compatibility delivery
+surface for `events --since`, not authority. Merged/closed evidence produces one
+idempotent terminal MonitorReceipt; conflicting or incomplete replay fails
+closed. For 0.1 no receipt grants continuing lease authority: live ownership is
+re-probed at consequential boundaries, and canonical LeaseReceipt epoch/scope
+plus the same-actor/session ABA fix remain explicitly deferred.

package/skills/shepherd/evals/scorecard.json

@@ -4,8 +4,8 @@
   "static": {
     "token_cost": {
       "desc_chars": 987,
-      "body_lines": 92,
-      "score": 43
+      "body_lines": 109,
+      "score": 41
     },
     "caps": {
       "desc_within": true,
@@ -37,5 +37,5 @@
     "variance": null,
     "note": "behavioral — W5 (LLM judge): semantic recall/precision/chain/outcome/variance, not deterministic"
   },
-  "composite": 83
+  "composite": 82
 }

package/skills/validate/SKILL.md

@@ -105,6 +105,9 @@ bun run lint    # or: npm run lint, eslint ., etc.
 - Best practices compliance
 
 ### Step 3: Code Review (if available)
+
+Read `CODING_STANDARDS.md` from the repository root before invoking the reviewer so the review applies the repository's diff-level contract.
+
 ```bash
 /code-review:code-review
 ```

package/skills/validate/evals/scorecard.json

@@ -4,7 +4,7 @@
   "static": {
     "token_cost": {
       "desc_chars": 995,
-      "body_lines": 300,
+      "body_lines": 303,
       "score": 21
     },
     "caps": {