forgedock 1.0.16 → 1.0.18

package/commands/resume.md

@@ -0,0 +1,264 @@
+---
+description: Recover full pipeline context after compaction — find the last active issue, reconstruct FORGE annotations, and resume work
+argument-hint: [issue number (optional — auto-detects if omitted)]
+---
+
+# /resume — Context Recovery After Compaction
+
+**Input**: $ARGUMENTS
+
+You are the context-recovery agent. When a session ends or context is compressed, all working state is lost. Your job is to restore it instantly — find the most recently active issue, read all FORGE annotations, reconstruct the current pipeline phase, and re-enter the pipeline exactly where it left off.
+
+**Agent model policy**: Default `model: "sonnet"`. Fallback: `model: "opus"` if Sonnet is rate-limited.
+**NEVER use plan mode (EnterPlanMode).**
+
+---
+
+## Phase 0: Config Resolution
+
+Read `forge.yaml` to configure all project-specific variables before running any commands:
+
+```bash
+CONFIG_FILE="${FORGE_CONFIG:-forge.yaml}"
+GH_REPO=$(yq '.project.owner + "/" + .project.repo' "$CONFIG_FILE")
+GH_FLAG="-R $GH_REPO"
+REPO_PATH=$(yq '.paths.root' "$CONFIG_FILE")
+STAGING_BRANCH=$(yq '.branches.staging' "$CONFIG_FILE")
+```
+
+If `forge.yaml` is missing: stop and tell the user to run `npx forgedock init` to generate it.
+
+---
+
+## Phase 1: Find Active Issue
+
+### 1A: Parse input
+
+Check `$ARGUMENTS`:
+
+- **Explicit issue number** (e.g., `610`, `#610`): strip `#`, set `TARGET_NUMBER={number}`, skip to Phase 2.
+- **Empty**: proceed with auto-detection below.
+
+### 1B: Query for in-progress issues
+
+The `gh issue list --label` flag uses AND filtering when multiple labels are given. To find issues with ANY active workflow label, run one query per label and merge results:
+
+```bash
+# Find open issues with any active workflow label, sorted by most recently updated
+# (gh --label uses AND, so query each label separately and merge)
+ACTIVE_ISSUES=$(
+  for LABEL in "workflow:investigating" "workflow:ready-to-build" "workflow:building" "workflow:in-review"; do
+    gh issue list {GH_FLAG} \
+      --state open \
+      --label "$LABEL" \
+      --limit 10 \
+      --json number,title,labels,updatedAt
+  done | jq -s '
+    flatten |
+    unique_by(.number) |
+    sort_by(.updatedAt) | reverse |
+    .[] | {
+      number,
+      title,
+      phase: (.labels | map(.name | select(startswith("workflow:"))) | first // "unknown"),
+      updatedAt
+    }
+  ')
+echo "$ACTIVE_ISSUES"
+```
+
+### 1C: Select issue
+
+**If one result**: use it — set `TARGET_NUMBER={number}`.
+
+**If multiple results**: display a ranked list (most recently updated first), then select the top entry:
+
+```
+## Active Issues Found (most recent first)
+
+| # | Issue | Phase | Last Updated |
+|---|-------|-------|--------------|
+| 1 | #{number}: {title} | {phase} | {updatedAt} |
+| 2 | #{number}: {title} | {phase} | {updatedAt} |
+...
+
+Auto-selecting #1 (most recently updated). Pass an explicit issue number to override.
+```
+
+Set `TARGET_NUMBER` to the top-ranked issue number.
+
+### 1D: Fallback — no active label found
+
+If `ACTIVE_ISSUES` is empty, search recent issues by FORGE annotation presence:
+
+```bash
+# Look for recently updated open issues with FORGE annotations (pipeline may have stalled pre-label)
+RECENT_ISSUES=$(gh issue list {GH_FLAG} \
+  --state open \
+  --limit 20 \
+  --json number,title,updatedAt \
+  --jq 'sort_by(.updatedAt) | reverse | .[0:5] | .[] | {number, title, updatedAt}')
+
+# For each candidate, check if it has FORGE annotations
+for NUMBER in $(echo "$RECENT_ISSUES" | jq -r '.number'); do
+  HAS_FORGE=$(gh api repos/{GH_REPO}/issues/$NUMBER/comments \
+    --jq '[.[] | select(.body | test("<!-- FORGE:"))] | length > 0' 2>/dev/null || echo "false")
+  if [ "$HAS_FORGE" = "true" ]; then
+    TARGET_NUMBER=$NUMBER
+    break
+  fi
+done
+```
+
+If still no candidate: display `No recent active issues found. To resume work on a specific issue, run: /resume {issue-number}` and STOP.
+
+---
+
+## Phase 2: Reconstruct Context
+
+### 2A: Load issue state
+
+```bash
+ISSUE=$(gh issue view {TARGET_NUMBER} {GH_FLAG} \
+  --json number,title,body,labels,state,milestone,updatedAt)
+
+ISSUE_TITLE=$(echo "$ISSUE" | jq -r '.title')
+ISSUE_STATE=$(echo "$ISSUE" | jq -r '.state')
+ISSUE_LABELS=$(echo "$ISSUE" | jq -r '[.labels[].name] | join(", ")')
+ISSUE_MILESTONE=$(echo "$ISSUE" | jq -r '.milestone.title // "none"')
+
+echo "Issue: #${TARGET_NUMBER} — $ISSUE_TITLE"
+echo "State: $ISSUE_STATE | Labels: $ISSUE_LABELS | Milestone: $ISSUE_MILESTONE"
+```
+
+If issue is CLOSED and has `workflow:merged` or `workflow:invalid` label: display completion status and STOP — no work remaining.
+
+### 2B: Read all FORGE annotations
+
+Fetch all comments and extract the FORGE-annotated ones in pipeline order:
+
+```bash
+COMMENTS=$(gh api repos/{GH_REPO}/issues/{TARGET_NUMBER}/comments \
+  --jq '.[] | select(.body | test("<!-- FORGE:")) | {
+    id: .id,
+    created_at: .created_at,
+    type: (.body | capture("<!-- FORGE:(?<t>[A-Z_:]+)") | .t),
+    body: .body
+  }')
+```
+
+Extract specific annotations:
+
+```bash
+# Investigation report
+FORGE_INVESTIGATOR=$(gh api repos/{GH_REPO}/issues/{TARGET_NUMBER}/comments \
+  --jq '.[] | select(.body | contains("FORGE:INVESTIGATOR")) | .body' 2>/dev/null || echo "")
+
+# Builder contract
+FORGE_CONTRACT=$(gh api repos/{GH_REPO}/issues/{TARGET_NUMBER}/comments \
+  --jq '.[] | select(.body | contains("FORGE:CONTRACT")) | .body' 2>/dev/null || echo "")
+
+# Implementation context
+FORGE_CONTEXT=$(gh api repos/{GH_REPO}/issues/{TARGET_NUMBER}/comments \
+  --jq '.[] | select(.body | contains("FORGE:CONTEXT")) | .body' 2>/dev/null || echo "")
+
+# Architecture plan
+FORGE_ARCHITECT=$(gh api repos/{GH_REPO}/issues/{TARGET_NUMBER}/comments \
+  --jq '.[] | select(.body | contains("FORGE:ARCHITECT")) | .body' 2>/dev/null || echo "")
+
+# Builder implementation report
+FORGE_BUILDER=$(gh api repos/{GH_REPO}/issues/{TARGET_NUMBER}/comments \
+  --jq '.[] | select(.body | contains("FORGE:BUILDER")) | .body' 2>/dev/null || echo "")
+```
+
+### 2C: Determine current pipeline phase
+
+Read labels and annotation presence to identify where the pipeline was interrupted:
+
+```bash
+# Extract active workflow label
+WORKFLOW_LABEL=$(echo "$ISSUE_LABELS" | grep -oP 'workflow:[a-z:-]+' | grep -v 'workflow:merged\|workflow:invalid\|workflow:decomposed' | head -1)
+
+# Check annotation completion markers
+HAS_INVESTIGATION=$([ -n "$FORGE_INVESTIGATOR" ] && echo "$FORGE_INVESTIGATOR" | grep -q "INVESTIGATION:COMPLETE" && echo "YES" || echo "NO")
+HAS_CONTRACT=$([ -n "$FORGE_CONTRACT" ] && echo "YES" || echo "NO")
+HAS_CONTEXT=$([ -n "$FORGE_CONTEXT" ] && echo "YES" || echo "NO")
+HAS_ARCHITECT=$([ -n "$FORGE_ARCHITECT" ] && echo "YES" || echo "NO")
+HAS_BUILDER=$([ -n "$FORGE_BUILDER" ] && echo "$FORGE_BUILDER" | grep -q "FORGE:BUILDER:COMPLETE" && echo "YES" || echo "NO")
+
+# Check for open PR on this issue's branch
+OPEN_PR=$(gh pr list {GH_FLAG} --state open --search "#{TARGET_NUMBER}" --limit 1 --json number,headRefName --jq '.[0]' 2>/dev/null || echo "")
+```
+
+Map to current phase:
+
+| Condition | Current Phase | Resume Action |
+|-----------|---------------|---------------|
+| `HAS_INVESTIGATION=NO` | Phase 1: Investigating | Reinvestigate |
+| `HAS_INVESTIGATION=YES`, `WORKFLOW_LABEL=workflow:ready-to-build` | Phase 3: Build | Enter build from 3A |
+| `HAS_INVESTIGATION=YES`, `HAS_BUILDER=NO`, `WORKFLOW_LABEL=workflow:building` | Phase 3: Build in progress | Enter build from 3A (will skip completed sub-phases) |
+| `HAS_BUILDER=YES`, PR not found | Phase 4: PR Creation | Push branch + create PR |
+| `OPEN_PR` found, `WORKFLOW_LABEL=workflow:in-review` | Phase 5: Auto-Review | Invoke review-pr |
+| PR merged, issue still open | Phase 6: Close | Close issue, update board |
+
+### 2D: Display context summary
+
+Emit a structured context block before resuming — this is what anchors the agent's working memory:
+
+```
+## Context Recovered — Issue #${TARGET_NUMBER}
+
+**Title**: {ISSUE_TITLE}
+**Lane**: {fast-lane | feature-lane (milestone: {MILESTONE})}
+**Current Phase**: {CURRENT_PHASE}
+**Active Label**: {WORKFLOW_LABEL}
+
+### Investigation Summary
+{if HAS_INVESTIGATION=YES: extract "### What We Found" + "### Root Cause" + "### Affected Files" blocks from FORGE_INVESTIGATOR}
+{if HAS_INVESTIGATION=NO: "Not yet investigated."}
+
+### Contract
+{if HAS_CONTRACT=YES: extract "### Proposed Approach" + "### Deliverables" table from FORGE_CONTRACT}
+{if HAS_CONTRACT=NO: "Contract not yet written."}
+
+### Architecture Plan
+{if HAS_ARCHITECT=YES: extract "### Affected Paths" table + "### Implementation Order" from FORGE_ARCHITECT}
+{if HAS_ARCHITECT=NO: "Architecture plan not yet written."}
+
+### Build Status
+{if HAS_BUILDER=YES: extract "### Changes" + "### Acceptance Criteria Status" from FORGE_BUILDER}
+{if HAS_BUILDER=NO: "Implementation not yet started."}
+
+### Open PR
+{if OPEN_PR: "PR #{pr_number} → {headRefName} (open)"}
+{if not OPEN_PR: "No PR yet."}
+
+### Resume Entry Point
+→ Will invoke /work-on {TARGET_NUMBER} — pipeline re-enters at {CURRENT_PHASE}
+```
+
+---
+
+## Phase 3: Resume
+
+Invoke `/work-on` to re-enter the pipeline. Work-on reads GitHub state independently and routes to the correct phase automatically.
+
+```
+Skill("work-on", args="{TARGET_NUMBER}")
+```
+
+**Why delegation works**: `/work-on` Phase 0B already implements "Determine resume point" — it reads issue labels and FORGE annotations to route to the correct phase. `/resume` provides the human-readable context summary, then hands off to `/work-on` for execution.
+
+**Do NOT re-implement pipeline logic here.** The context summary above is for the agent's working memory only — the actual phase routing and execution is owned by `/work-on`.
+
+---
+
+## Error Handling
+
+| Condition | Response |
+|-----------|----------|
+| `forge.yaml` missing | Stop: "Run \`npx forgedock init\` to generate forge.yaml" |
+| No active issues + no FORGE annotations found | Stop: "No recent active issues found. Run \`/resume {number}\` with an explicit issue number, or \`/work-on next\` to start a new issue." |
+| Issue is closed with `workflow:merged` | Stop: "Issue #{number} is already merged. Nothing to resume." |
+| Issue is closed with `workflow:invalid` | Stop: "Issue #{number} was closed as invalid. Nothing to resume." |
+| Issue has `needs-human` label | Stop: "Issue #{number} is blocked (needs-human). Review the blocking comment and resolve it manually before resuming." |

package/commands/review-pr-agents.md

@@ -1,3 +1,6 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios -->
+<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
+
 # Agent Catalog for `/review-pr`
 
 This file is the Agent Catalog referenced by the `/review-pr` orchestrator. It is read via the `Read` tool during Phase 3C (agent dispatch). It contains:
@@ -1171,9 +1174,10 @@ If no API context is configured above, derive conventions from the changed files
     BASE=$(gh pr view [PR_NUMBER] --json baseRefName --jq '.baseRefName')
 
     # Find PRs merged to this base in the last 48 hours
+    CUTOFF="$(date -u -d '48 hours ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-48H +%Y-%m-%dT%H:%M:%SZ)"
     RECENT_MERGED=$(gh pr list --base "$BASE" --state merged --limit 20 \
       --json number,title,mergedAt,files \
-      --jq --arg cutoff "$(date -u -d '48 hours ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-48H +%Y-%m-%dT%H:%M:%SZ)" \
+      2>/dev/null | jq --arg cutoff "$CUTOFF" \
       '.[] | select(.mergedAt > $cutoff) | {number, title, schema_files: [.files[].path | select(test("schemas?/|scrape\\.py|models\\.py"))]}' \
       2>/dev/null | head -40)
 

package/commands/review-pr-staging.md

@@ -3,6 +3,8 @@ description: Staging review mode — comprehensive review of staging branch befo
 argument-hint: [PR number or "staging"]
 allowed-tools: Task, Bash, Read, Grep, Glob, WebFetch
 ---
+<!-- SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios -->
+<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
 
 # Staging Review
 
@@ -24,9 +26,13 @@ GH_REPO=$(yq '.project.owner + "/" + .project.repo' "$CONFIG_FILE")
 GH_FLAG="-R $GH_REPO"
 DEFAULT_BRANCH=$(yq '.branches.default' "$CONFIG_FILE")
 STAGING_BRANCH=$(yq '.branches.staging' "$CONFIG_FILE")
+
+# Test-gate config (Phase 6.5) — read here so vars are available before first use
+GATE_POSTURE=$(yq '.verification.test_gate.posture // "blocking"' "$CONFIG_FILE" 2>/dev/null || echo "blocking")
+OVERRIDE_PHRASE=$(yq '.verification.test_gate.override_phrase // "OVERRIDE: shipping with test failures —"' "$CONFIG_FILE" 2>/dev/null || echo "OVERRIDE: shipping with test failures —")
 ```
 
-All `$DEFAULT_BRANCH` and `$STAGING_BRANCH` references below are populated from `forge.yaml`.
+All `$DEFAULT_BRANCH`, `$STAGING_BRANCH`, `$GATE_POSTURE`, and `$OVERRIDE_PHRASE` references below are populated from `forge.yaml`.
 
 ---
 
@@ -340,6 +346,132 @@ Agent maps dependencies, assesses integration points (service boundaries, env va
 
 ---
 
+## Phase 6.5: Runtime Test Gate (BLOCKING — runs after static analysis, before finding triage)
+
+**Purpose**: Verify the integrated bundle's acceptance criteria against running code before the deploy verdict. Catches runtime defects (cross-PR interactions, container/startup failures, regression in tested behaviour) that static review cannot surface.
+
+**Why here**: Phase 6 completes all static analysis (regression risk, security, quality). Phase 6.5 adds the runtime dimension before Phase 7 triages findings — so any test-gate failures can be filed as `test-failure` issues by `/test-gate` itself, then surface in Phase 7's triage pass.
+
+**Posture**: Controlled by `verification.test_gate.posture` in `forge.yaml` (resolved in Config Resolution as `$GATE_POSTURE`). Default: `blocking`. Set to `advisory` to surface failures without preventing deploy. <!-- Added: forge#906 -->
+
+```bash
+echo "=== Phase 6.5: Runtime Test Gate ==="
+echo "Bundle PRs: $(echo $ALL_PR_NUMBERS | tr '\n' ' ')"
+echo "Posture: ${GATE_POSTURE}"
+
+# Initialize test-gate verdict (default SKIP — safe if Phase 6.5 is bypassed)
+TEST_GATE_VERDICT="SKIP"
+TEST_GATE_REASON="Phase 6.5 not yet run"
+
+# Invoke /test-gate with the bundle PRs already computed in Phase 0A
+# ALL_PR_NUMBERS is the de-duplicated union of both scan methods (commit log + merge subjects)
+GATE_OUTPUT=$(Skill("test-gate", "--prs \"$(echo $ALL_PR_NUMBERS | tr '\n' ' ' | xargs)\" --base $DEFAULT_BRANCH"))
+
+# Extract machine-readable verdict from Skill output
+TEST_GATE_VERDICT=$(echo "$GATE_OUTPUT" | grep -oP '(?<=FORGE:TEST_GATE:RESULT=)(BLOCK|PASS|SKIP)' | tail -1 || echo "SKIP")
+
+echo "Test-gate verdict: ${TEST_GATE_VERDICT}"
+```
+
+**Verdict handling**:
+
+```bash
+case "$TEST_GATE_VERDICT" in
+
+  SKIP)
+    echo "ℹ️  Test gate: SKIP — no executable changes or tests not configured."
+    echo "   This gap will appear in the Phase 8 summary. No deploy impact."
+    TEST_GATE_REASON="SKIP — no runtime tests ran (docs-only bundle, no integration tests configured, or manual-only criteria)"
+    ;;
+
+  PASS)
+    echo "✅ Test gate: PASS — all test clusters passed. Deploy may proceed."
+    TEST_GATE_REASON="PASS — all automated test clusters passed"
+    ;;
+
+  BLOCK)
+    # Check for override comment on the staging→main PR (mirrors Phase 0A pattern)
+    if [ -n "$PR_NUMBER" ]; then
+      TG_OVERRIDE=$(gh pr view "$PR_NUMBER" ${GH_FLAG} \
+        --json comments \
+        --jq "[.comments[].body | select(startswith(\"${OVERRIDE_PHRASE}\"))] | length" 2>/dev/null || echo 0)
+    else
+      TG_OVERRIDE=0
+    fi
+
+    if [ "${TG_OVERRIDE:-0}" -gt 0 ]; then
+      OVERRIDE_REASON=$(gh pr view "$PR_NUMBER" ${GH_FLAG} \
+        --json comments \
+        --jq "[.comments[].body | select(startswith(\"${OVERRIDE_PHRASE}\"))] | last" 2>/dev/null || echo "(reason not captured)")
+      echo "⚠️  Test gate: BLOCK — but override comment detected on PR #${PR_NUMBER}."
+      echo "   Override: ${OVERRIDE_REASON}"
+      echo "   Proceeding with deploy. Override is logged in Phase 8 summary."
+      TEST_GATE_VERDICT="PASS"
+      TEST_GATE_REASON="BLOCK downgraded to PASS by override: ${OVERRIDE_REASON}"
+
+    elif [ "$GATE_POSTURE" = "advisory" ]; then
+      echo "⚠️  Test gate: BLOCK (advisory posture) — runtime failures detected but deploy is NOT prevented."
+      echo "   Switch verification.test_gate.posture to 'blocking' in forge.yaml to enforce this gate."
+      TEST_GATE_REASON="BLOCK (advisory) — runtime failures detected; deploy allowed by advisory posture"
+
+    else
+      # blocking posture (default) — STOP
+      echo "⛔ DEPLOY BLOCKED — /test-gate returned BLOCK verdict."
+      echo ""
+      echo "Runtime failures were detected in the staging→${DEFAULT_BRANCH} bundle."
+      echo "The failures were batch-introduced (not pre-existing on ${DEFAULT_BRANCH} baseline)."
+      echo ""
+      echo "Options:"
+      echo "  1. Fix the failing tests and merge fixes to staging before retrying the deploy."
+      echo "  2. Post a comment on this PR starting with \"${OVERRIDE_PHRASE} <reason>\" to bypass this gate."
+      echo "  3. Set verification.test_gate.posture: advisory in forge.yaml to downgrade to a warning."
+      echo ""
+      echo "RESULT: BLOCK DEPLOY"
+
+      # Post structured FORGE:GATE_FAILURE comment for pipeline-health tracking
+      GATE_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+      if [ -n "$PR_NUMBER" ]; then
+        gh pr comment "$PR_NUMBER" ${GH_FLAG} --body "<!-- FORGE:GATE_FAILURE -->
+## Deploy Gate: BLOCKED
+
+**Gate**: test-gate
+**Timestamp**: ${GATE_TIMESTAMP}
+**Bundle PRs**: $(echo $ALL_PR_NUMBERS | tr '\n' ' ')
+**Posture**: ${GATE_POSTURE}
+
+### What Happened
+
+\`/test-gate\` detected runtime failures in the staging→\`${DEFAULT_BRANCH}\` bundle that were NOT present on the \`${DEFAULT_BRANCH}\` baseline. These are batch-introduced regressions.
+
+\`/test-gate\` has filed \`test-failure\` issues for each failing cluster — check the issue tracker for details.
+
+### Resolution
+
+1. Fix the failing tests and merge fixes to staging.
+2. Retry the staging→\`${DEFAULT_BRANCH}\` deploy.
+
+To override (ship known failures with documented reason), post a comment containing:
+\`${OVERRIDE_PHRASE} <reason>\`
+
+<!-- FORGE:GATE_FAILURE:TYPE=test-gate|BUNDLE=$(echo $ALL_PR_NUMBERS | tr '\n' ' ' | xargs) -->" 2>/dev/null || true
+      fi
+      exit 1
+    fi
+    ;;
+
+  *)
+    echo "⚠️  Test gate: unrecognised verdict '${TEST_GATE_VERDICT}' — treating as SKIP."
+    TEST_GATE_VERDICT="SKIP"
+    TEST_GATE_REASON="SKIP — unrecognised verdict from /test-gate (treated as SKIP)"
+    ;;
+
+esac
+```
+
+If the gate exits with `RESULT: BLOCK DEPLOY` → **STOP**. A `<!-- FORGE:GATE_FAILURE -->` structured comment is automatically posted on the staging→main PR (if `$PR_NUMBER` is set) for pipeline-health tracking. `/test-gate` will have filed `test-failure` issues for each failing cluster before returning BLOCK.
+
+---
+
 ## Phase 7: Finding Triage & Issue Creation
 
 ### 7A: Extract Findings
@@ -422,10 +554,36 @@ Labels: `review-finding` + `needs-validation` + `staging-review` + priority (`pr
 Post summary with verdict:
 1. CI failed + autofix failed → BLOCK DEPLOY
 2. CI failed + autofix succeeded → continue
+2.5. Test gate returned BLOCK (blocking posture, no override) → BLOCK DEPLOY *(handled in Phase 6.5 — if Phase 8 is reached, BLOCK was either overridden or posture is advisory)*
 3. CONFIRMED CRITICAL (non-CI) → BLOCK DEPLOY
 4. CONFIRMED HIGH blocking (crashes, data loss) → NEEDS FIXES FIRST
 5. All else → APPROVE FOR DEPLOY
 
-Include: Material Changes Summary, Risk Matrix (CI, Build, Bugs, Security, Billing, Quality, Regression), Finding Triage Results, Blocking Issues, Deployment Checklist (pre-deploy, deploy, post-deploy verification, rollback triggers), Stats.
+Include: Material Changes Summary, Risk Matrix (CI, Build, Bugs, Security, Billing, Quality, Regression, **Test Gate**), Finding Triage Results, Blocking Issues, Deployment Checklist (pre-deploy, deploy, post-deploy verification, rollback triggers), Stats.
+
+**Risk Matrix must include a Test Gate row** (use `$TEST_GATE_VERDICT` and `$TEST_GATE_REASON` set in Phase 6.5):
+
+| Domain | Result | Notes |
+|--------|--------|-------|
+| CI | ... | ... |
+| Build | ... | ... |
+| Bugs | ... | ... |
+| Security | ... | ... |
+| Billing | ... | ... |
+| Quality | ... | ... |
+| Regression | ... | ... |
+| **Test Gate** | `${TEST_GATE_VERDICT:-SKIP}` | `${TEST_GATE_REASON:-Phase 6.5 not run}` |
+
+If `TEST_GATE_VERDICT` is `SKIP`, surface the gap explicitly in the summary:
+
+> **Test Gate: SKIP** — No runtime tests ran for this bundle. This means acceptance criteria were NOT verified against running code before deploy. Cause: `${TEST_GATE_REASON}`. To enable runtime testing, configure `verification.integration_tests` in `forge.yaml`.
+
+If `TEST_GATE_VERDICT` is `PASS`, note it as a positive signal:
+
+> **Test Gate: PASS** — Acceptance criteria verified against running code. No batch-introduced runtime failures detected.
+
+If `TEST_GATE_VERDICT` is `BLOCK` and Phase 8 was reached (advisory posture or override active), note it as a risk:
+
+> **Test Gate: BLOCK (override/advisory)** — Runtime failures were detected but deploy is proceeding. Reason: `${TEST_GATE_REASON}`. Filed `test-failure` issues track the failures.
 
 **CRITICAL**: This review NEVER merges staging → main. User makes deploy decision via GitHub web UI.

package/commands/review-pr.md

@@ -3,6 +3,8 @@ description: Context-aware PR review — analyzes what the PR touches, spawns do
 argument-hint: [PR number, URL, "open", or "staging" for feature→main review]
 allowed-tools: Task, Bash, Read, Grep, Glob, WebFetch, Skill
 ---
+<!-- SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios -->
+<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
 
 # PR Review — Orchestrator
 
@@ -124,6 +126,9 @@ while [ "$MERGE_HEALTH" = "UNKNOWN" ] && [ "$MERGE_RETRY" -lt 3 ]; do
 done
 # MERGE_HEALTH: MERGEABLE | CONFLICTING | UNKNOWN (still async after retries)
 # MERGE_HEALTH_STATE: CLEAN | DIRTY | BLOCKED | UNSTABLE | UNKNOWN
+
+# Resolve repo name early — used in Phases 5, 6, 8B, 9A (clean-review skip path bypasses Phase 6A) <!-- Added: forge#820 -->
+REPO=$(gh repo view --json nameWithOwner --jq '.nameWithOwner')
 ```
 
 ### 1B: Classify
@@ -731,7 +736,6 @@ If synthesis needed, launch a `general-purpose` Task (model: resolved per policy
 ### 6A: Extract Findings
 
 ```bash
-REPO=$(gh repo view --json nameWithOwner --jq '.nameWithOwner')
 HAS_SYNTHESIS=$(gh api "repos/${REPO}/issues/${PR_NUMBER}/comments" --jq '.[].body' | grep -c 'REVIEW-FINDINGS-SYNTHESIZED-START' || echo 0)
 
 if [ "$HAS_SYNTHESIS" -gt 0 ]; then
@@ -786,8 +790,8 @@ fi
 
 if [ -n "$MILESTONE_BRANCH" ]; then
     BRANCH_SLUG=$(echo "$MILESTONE_BRANCH" | sed 's|^milestone/||')
-    MILESTONE_NUMBER=$(gh api repos/${REPO}/milestones --jq --arg slug "$BRANCH_SLUG" '.[] | select((.title | ascii_downcase | gsub("[^a-z0-9]+"; "-")) == $slug) | .number' 2>/dev/null | head -1)
-    [ -z "$MILESTONE_NUMBER" ] && MILESTONE_NUMBER=$(gh api repos/${REPO}/milestones --jq --arg slug "$BRANCH_SLUG" '.[] | select((.title | ascii_downcase | gsub("[^a-z0-9]+"; "-")) | test($slug)) | .number' 2>/dev/null | head -1)
+    MILESTONE_NUMBER=$(gh api repos/${REPO}/milestones 2>/dev/null | jq --arg slug "$BRANCH_SLUG" '.[] | select((.title | ascii_downcase | gsub("[^a-z0-9]+"; "-")) == $slug) | .number' 2>/dev/null | head -1)
+    [ -z "$MILESTONE_NUMBER" ] && MILESTONE_NUMBER=$(gh api repos/${REPO}/milestones 2>/dev/null | jq --arg slug "$BRANCH_SLUG" '.[] | select((.title | ascii_downcase | gsub("[^a-z0-9]+"; "-")) | test($slug)) | .number' 2>/dev/null | head -1)
     [ -n "$MILESTONE_NUMBER" ] && MILESTONE_FLAG="--milestone $(gh api repos/${REPO}/milestones/${MILESTONE_NUMBER} --jq '.title')"
 fi
 ```
@@ -1060,12 +1064,89 @@ fi
 
 **Important**: Phase 8 ONLY merges the PR. It does NOT close the issue, update labels, or clean up worktrees. When invoked via `/work-on`, those responsibilities belong to `work-on/close.md` — which runs after the router detects state 4 (MERGE_COMPLETE: PR merged + issue open). Doing them here would cause the router to hit TERMINAL_MERGED (state 1) and skip the close phase entirely.
 
+### 8B: Post-Merge Review Finding Demilestoning (Milestone PRs Only)
+
+**Skip if**: `IS_MILESTONE_TO_STAGING` is false or `MERGE_STATE != "MERGED"`. Runs only when a milestone→staging PR was just successfully merged.
+
+**Purpose**: Review-finding issues created during a milestone PR review (Phase 6C) inherit the milestone. Once the milestone PR merges, those findings should flow through the fast lane independently — not remain stranded on a closed milestone. This step clears their milestone assignment automatically.
+
+```bash
+if [ "${IS_MILESTONE_TO_STAGING:-false}" = "true" ] && [ "${MERGE_STATE:-}" = "MERGED" ]; then
+    echo "Phase 8B: Clearing milestone from open review-finding issues referencing PR #${PR_NUMBER}..."
+
+    # Find open review-finding issues whose body references this PR number
+    # The title template in Phase 6C always includes: "review finding — PR #${PR_NUMBER}"
+    FINDINGS_TO_DEMILESTONE=$(gh issue list -R "${REPO}" \
+        --state open \
+        --label "review-finding" \
+        --limit 200 \
+        --json number,title,milestone \
+        --jq ".[] | select(.milestone != null) | select(.title | test(\"PR #${PR_NUMBER}\")) | .number" \
+        2>/dev/null || echo "")
+
+    if [ -z "$FINDINGS_TO_DEMILESTONE" ]; then
+        echo "Phase 8B: No open review-finding issues with milestones found referencing PR #${PR_NUMBER}."
+    else
+        MOVED_COUNT=0
+        echo "$FINDINGS_TO_DEMILESTONE" | while IFS= read -r FINDING_NUM; do
+            [ -z "$FINDING_NUM" ] && continue
+            FINDING_TITLE=$(gh issue view "$FINDING_NUM" -R "${REPO}" --json title --jq '.title' 2>/dev/null || echo "#${FINDING_NUM}")
+            gh issue edit "$FINDING_NUM" -R "${REPO}" --milestone "" 2>/dev/null && \
+                echo "  Moved to fast lane: #${FINDING_NUM} — ${FINDING_TITLE}" || \
+                echo "  WARNING: Failed to clear milestone for #${FINDING_NUM}"
+            MOVED_COUNT=$((MOVED_COUNT + 1))
+        done
+        echo "Phase 8B: Review finding demilestoning complete."
+    fi
+fi
+```
+
+<!-- Added: forge#815 -->
+
 ---
 
 ## Phase 9: Integrity Check & Summary (LAST)
 
 **Run AFTER Phase 6 (issues created), Phase 7 (verdict posted), Phase 8 (merge if applicable).**
 
+### 9A: Post-Merge Review Finding Demilestoning Fallback (Milestone PRs Only)
+
+**Skip if**: `IS_MILESTONE_TO_STAGING` is false. Runs when `AUTO_MERGE=false` but the PR was merged manually — Phase 8B did not run in this case, so Phase 9 handles cleanup.
+
+**Detection**: Check if the PR is now MERGED. If so and `IS_MILESTONE_TO_STAGING=true`, run the same demilestoning logic as Phase 8B.
+
+```bash
+if [ "${IS_MILESTONE_TO_STAGING:-false}" = "true" ]; then
+    PR_MERGE_STATE=$(gh pr view $ARGUMENTS --json state --jq '.state' 2>/dev/null || echo "")
+    if [ "$PR_MERGE_STATE" = "MERGED" ]; then
+        echo "Phase 9A: Checking for open review-finding issues to demilestone (fallback — manual merge path)..."
+
+        FINDINGS_TO_DEMILESTONE=$(gh issue list -R "${REPO}" \
+            --state open \
+            --label "review-finding" \
+            --limit 200 \
+            --json number,title,milestone \
+            --jq ".[] | select(.milestone != null) | select(.title | test(\"PR #${PR_NUMBER}\")) | .number" \
+            2>/dev/null || echo "")
+
+        if [ -z "$FINDINGS_TO_DEMILESTONE" ]; then
+            echo "Phase 9A: No open review-finding issues with milestones found referencing PR #${PR_NUMBER} (already cleared or none created)."
+        else
+            echo "$FINDINGS_TO_DEMILESTONE" | while IFS= read -r FINDING_NUM; do
+                [ -z "$FINDING_NUM" ] && continue
+                FINDING_TITLE=$(gh issue view "$FINDING_NUM" -R "${REPO}" --json title --jq '.title' 2>/dev/null || echo "#${FINDING_NUM}")
+                gh issue edit "$FINDING_NUM" -R "${REPO}" --milestone "" 2>/dev/null && \
+                    echo "  Moved to fast lane: #${FINDING_NUM} — ${FINDING_TITLE}" || \
+                    echo "  WARNING: Failed to clear milestone for #${FINDING_NUM}"
+            done
+            echo "Phase 9A: Fallback demilestoning complete."
+        fi
+    fi
+fi
+```
+
+<!-- Added: forge#815 -->
+
 ```bash
 CURRENT_SHA=$(gh pr view $ARGUMENTS --json headRefOid --jq '.headRefOid')
 REVIEW_IS_STALE="false"
@@ -1118,4 +1199,5 @@ Review complete for PR #X. Verdict: [VERDICT].
 - Integration checks: [pass/N broken paths found]
 - Issues created: [M]
 {IF AUTO_MERGE: "PR merged and issue closed." / "Merge FAILED — see issue."}
+{IF IS_MILESTONE_TO_STAGING: "Review findings demilestoned: [N] issues moved to fast lane." / ""}
 ```

package/commands/rollback.md

@@ -2,6 +2,8 @@
 description: Create a revert PR to roll back a shipped feature or fix that caused a production incident
 argument-hint: [PR number to revert, or "last" for most recent deploy]
 ---
+<!-- SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios -->
+<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
 
 # /rollback — Automated Revert PR Creation