forgedock 1.0.5 → 1.0.6

package/bin/labels.json

@@ -0,0 +1,152 @@
+[
+  {
+    "name": "priority:P0",
+    "color": "B60205",
+    "description": "Critical priority — production broken, data loss, security breach. Managed by ForgeDock."
+  },
+  {
+    "name": "priority:P1",
+    "color": "D93F0B",
+    "description": "High priority — major feature broken, no workaround. Managed by ForgeDock."
+  },
+  {
+    "name": "priority:P2",
+    "color": "FBCA04",
+    "description": "Medium priority — impaired functionality, workaround exists. Managed by ForgeDock."
+  },
+  {
+    "name": "priority:P3",
+    "color": "C2E0C6",
+    "description": "Low priority — minor issue or polish. Managed by ForgeDock."
+  },
+  {
+    "name": "workflow:investigating",
+    "color": "1D76DB",
+    "description": "Pipeline: investigation phase in progress. Managed by ForgeDock."
+  },
+  {
+    "name": "workflow:ready-to-build",
+    "color": "0075CA",
+    "description": "Pipeline: investigation complete, ready for build. Managed by ForgeDock."
+  },
+  {
+    "name": "workflow:building",
+    "color": "0052CC",
+    "description": "Pipeline: implementation in progress. Managed by ForgeDock."
+  },
+  {
+    "name": "workflow:in-review",
+    "color": "5319E7",
+    "description": "Pipeline: PR created, under review. Managed by ForgeDock."
+  },
+  {
+    "name": "workflow:merged",
+    "color": "0E8A16",
+    "description": "Pipeline: PR merged, issue closed. Managed by ForgeDock."
+  },
+  {
+    "name": "workflow:decomposed",
+    "color": "BFD4F2",
+    "description": "Pipeline: decomposed into sub-issues. Managed by ForgeDock."
+  },
+  {
+    "name": "workflow:invalid",
+    "color": "CCCCCC",
+    "description": "Pipeline: issue closed as invalid after investigation. Managed by ForgeDock."
+  },
+  {
+    "name": "needs-human",
+    "color": "E4E669",
+    "description": "Pipeline stalled — requires human intervention. Managed by ForgeDock."
+  },
+  {
+    "name": "review-finding",
+    "color": "D93F0B",
+    "description": "Defect or improvement found during automated PR review. Managed by ForgeDock."
+  },
+  {
+    "name": "needs-validation",
+    "color": "FBCA04",
+    "description": "Review finding awaiting human validation. Managed by ForgeDock."
+  },
+  {
+    "name": "validated",
+    "color": "0E8A16",
+    "description": "Review finding confirmed as a real issue. Managed by ForgeDock."
+  },
+  {
+    "name": "false-positive",
+    "color": "CCCCCC",
+    "description": "Review finding dismissed as a false positive. Managed by ForgeDock."
+  },
+  {
+    "name": "staging-review",
+    "color": "1D76DB",
+    "description": "Finding from a staging branch review before deploy to main. Managed by ForgeDock."
+  },
+  {
+    "name": "audit-finding",
+    "color": "D93F0B",
+    "description": "Security or compliance defect found during audit. Managed by ForgeDock."
+  },
+  {
+    "name": "orchestration-metrics",
+    "color": "5319E7",
+    "description": "Running log of persisted audit-agents efficiency summaries. Managed by ForgeDock."
+  },
+  {
+    "name": "health-report",
+    "color": "1D76DB",
+    "description": "Pipeline health report issue. Managed by ForgeDock."
+  },
+  {
+    "name": "bug",
+    "color": "D73A4A",
+    "description": "Something isn't working. Managed by ForgeDock."
+  },
+  {
+    "name": "enhancement",
+    "color": "A2EEEF",
+    "description": "New feature or request. Managed by ForgeDock."
+  },
+  {
+    "name": "feature",
+    "color": "0075CA",
+    "description": "New feature implementation. Managed by ForgeDock."
+  },
+  {
+    "name": "refactor",
+    "color": "FEF2C0",
+    "description": "Code restructuring without behavior change. Managed by ForgeDock."
+  },
+  {
+    "name": "dead-code",
+    "color": "E4E669",
+    "description": "Unused code to be removed. Managed by ForgeDock."
+  },
+  {
+    "name": "improvement",
+    "color": "C5DEF5",
+    "description": "Non-bug improvement to existing functionality. Managed by ForgeDock."
+  },
+  {
+    "name": "documentation",
+    "color": "0075CA",
+    "description": "Documentation addition or update. Managed by ForgeDock."
+  },
+  {
+    "name": "qa",
+    "color": "E99695",
+    "description": "Quality assurance or testing issue. Managed by ForgeDock."
+  },
+  {
+    "name": "security",
+    "color": "B60205",
+    "description": "Security vulnerability or hardening. Managed by ForgeDock."
+  },
+  {
+    "name": "performance",
+    "color": "F9D0C4",
+    "description": "Performance optimization or regression. Managed by ForgeDock."
+  }
+]

package/commands/audit-agents.md

@@ -343,9 +343,11 @@ This step posts a structured `<!-- FORGE:AUDIT-AGENTS -->` summary comment to th
 **Step 4E.1 — Locate or create the tracking issue**:
 
 ```bash
-# Ensure the label exists before using it (gh issue create fails with GraphQL error if label is absent)
+# Ensure the label exists before using it (gh issue create fails with GraphQL error if label is absent).
+# Color and description match the canonical ForgeDock label manifest (bin/labels.json).
+# Run `npx forgedock labels setup` to bootstrap all managed labels at once.
 gh label create "orchestration-metrics" -R {FORGE_REPO} \
-  --color "5319E7" --description "Running log of persisted audit-agents efficiency summaries" \
+  --color "5319E7" --description "Running log of persisted audit-agents efficiency summaries. Managed by ForgeDock." \
   --force 2>/dev/null || true
 
 TRACKING_ISSUE=$(gh issue list -R {FORGE_REPO} \

package/commands/autopilot.md

@@ -56,9 +56,9 @@ gh issue list --state closed --json number,title,labels,closedAt \
   --jq '[.[] | select(.closedAt > "'$(date -u -d '3 days ago' +%Y-%m-%dT%H:%M:%SZ)'")] | length' 2>/dev/null || echo "0"
 
 # Open issue count by priority
-gh issue list --state open --label P0 --json number --jq 'length'
-gh issue list --state open --label P1 --json number --jq 'length'
-gh issue list --state open --label P2 --json number --jq 'length'
+gh issue list --state open --label "priority:P0" --json number --jq 'length'
+gh issue list --state open --label "priority:P1" --json number --jq 'length'
+gh issue list --state open --label "priority:P2" --json number --jq 'length'
 
 # Stale issues (open, no workflow label, older than 7 days)
 gh issue list --state open --limit 200 --json number,title,labels,createdAt \
@@ -77,7 +77,7 @@ Store these as `BASELINE` metrics for the cycle report.
 ### 0B: Check for open P0s
 
 ```bash
-gh issue list --state open --label P0 --json number,title --jq '.[] | "#\(.number) \(.title)"'
+gh issue list --state open --label "priority:P0" --json number,title --jq '.[] | "#\(.number) \(.title)"'
 ```
 
 If any P0 issues exist:
@@ -334,7 +334,7 @@ Pick the top `FIX_LIMIT` issues by this priority:
 ```bash
 # Get candidates
 gh issue list --state open --label "bug" --limit 50 --json number,title,labels,createdAt \
-  --jq 'sort_by(.labels | map(select(.name | startswith("P"))) | .[0].name) | .[:{FIX_LIMIT}] | .[] | "#\(.number) \(.title)"'
+  --jq 'sort_by(.labels | map(select(.name | startswith("priority:P"))) | .[0].name) | .[:{FIX_LIMIT}] | .[] | "#\(.number) \(.title)"'
 ```
 
 ### 4B: Present fix plan to user

package/commands/incident-response.md

@@ -39,7 +39,7 @@ You are the pipeline's incident response coordinator. When production goes down
 gh issue view {NUMBER} --json number,title,body,labels,state,comments,assignees,createdAt
 
 # If "active" — find most recent open P0
-gh issue list --state open --label "P0" --limit 5 --json number,title,createdAt,labels \
+gh issue list --state open --label "priority:P0" --limit 5 --json number,title,createdAt,labels \
   --jq 'sort_by(.createdAt) | reverse | .[0]'
 ```
 

package/commands/orchestrate.md

@@ -738,7 +738,7 @@ for FINDING_NUM in {spawned_finding_numbers}; do
   FINDING_DATA=$(gh issue view $FINDING_NUM -R {GH_REPO} --json labels,title,body \
     --jq '{labels: [.labels[].name], title: .title, body: .body}')
 
-  PRIORITY=$(echo "$FINDING_DATA" | jq -r '.labels[] | select(startswith("P")) | .' | head -1)
+  PRIORITY=$(echo "$FINDING_DATA" | jq -r '.labels[] | select(startswith("priority:P")) | ltrimstr("priority:")' | head -1)
   TITLE=$(echo "$FINDING_DATA" | jq -r '.title')
 
   # Heuristic 1: Generation check — source issue has review-finding label (always defer, even for P1/P2)

package/commands/review-pr-staging.md

@@ -290,9 +290,11 @@ Keep ALL findings (CONFIRMED/LIKELY/POSSIBLE). Deduplicate by file:line (keep hi
 
 ### 7C: Ensure Labels
 ```bash
-gh label create "review-finding" --color "D93F0B" --force 2>/dev/null
-gh label create "needs-validation" --color "FBCA04" --force 2>/dev/null
-gh label create "staging-review" --color "1D76DB" --force 2>/dev/null
+# Colors match the canonical ForgeDock label manifest (bin/labels.json).
+# Run `npx forgedock labels setup` to bootstrap all managed labels at once.
+gh label create "review-finding" --color "D93F0B" --description "Defect or improvement found during automated PR review. Managed by ForgeDock." --force -R {GH_REPO} 2>/dev/null
+gh label create "needs-validation" --color "FBCA04" --description "Review finding awaiting human validation. Managed by ForgeDock." --force -R {GH_REPO} 2>/dev/null
+gh label create "staging-review" --color "1D76DB" --description "Finding from a staging branch review before deploy to main. Managed by ForgeDock." --force -R {GH_REPO} 2>/dev/null
 ```
 
 ### 7D: Milestone Detection
@@ -304,6 +306,50 @@ Check for open review-finding issues at same file:line → skip. Closed issues a
 ### 7F: Create Issues
 Sequential creation. Title: `Staging Review: {summary} (staging → main)`. Labels: review-finding, needs-validation, staging-review, P1/P2/P3. Body includes: source branch context (`staging`), code context, evidence, validation checklist.
 
+**For each finding** (that passes dedup), create issue:
+```bash
+ISSUE_NUM=$(gh issue create \
+  -R {GH_REPO} \
+  --title "chore: [summary] (staging review — PR #${PR_NUMBER})" \
+  --label "review-finding,needs-validation,staging-review,{priority}" \
+  --body "$(cat <<'ISSUE_EOF'
+## Problem
+
+[One sentence: what bug or issue was found. Where it occurs (`file:line`) and what it causes.]
+
+**Source**: PR #[PR_NUMBER] — [TITLE]
+**Confidence**: [CONFIRMED/LIKELY/POSSIBLE]
+**Severity**: [CRITICAL/HIGH/MEDIUM/LOW]
+**Review comment**: [permalink to agent comment]
+
+## Affected Files
+
+Files that need changes:
+1. `[file:line]` — [what needs to change to fix this finding]
+
+## Source Branch Context
+
+**Code branch**: `staging`
+**Worktree base**: `origin/staging`
+
+> When fixing: `git worktree add ../fix-{slug} -b fix/{slug} origin/staging`
+
+## Code Context
+[10 lines around finding]
+
+## Evidence
+[From agent comment]
+
+## Acceptance Criteria
+
+- [ ] Finding validated: VALIDATED / FALSE_POSITIVE / INCONCLUSIVE
+- [ ] If VALIDATED: fix implemented and tested on correct branch
+ISSUE_EOF
+)" --json number --jq '.number')
+```
+
+Labels: `review-finding` + `needs-validation` + `staging-review` + priority (`priority:P1` CONFIRMED, `priority:P2` LIKELY, `priority:P3` POSSIBLE).
+
 **No pre-filtering**: Every finding becomes an issue. Validation agents sort out false positives downstream.
 
 ### 7G: Add to Project Board

package/commands/review-pr.md

@@ -616,10 +616,12 @@ If still 0: review is clean — skip to Phase 7.
 ### 6C: Create Issues
 
 ```bash
-gh label create "review-finding" --color "D93F0B" --force 2>/dev/null
-gh label create "needs-validation" --color "FBCA04" --force 2>/dev/null
-gh label create "validated" --color "0E8A16" --force 2>/dev/null
-gh label create "false-positive" --color "CCCCCC" --force 2>/dev/null
+# Colors match the canonical ForgeDock label manifest (bin/labels.json).
+# Run `npx forgedock labels setup` to bootstrap all managed labels at once.
+gh label create "review-finding" --color "D93F0B" --description "Defect or improvement found during automated PR review. Managed by ForgeDock." --force -R {GH_REPO} 2>/dev/null
+gh label create "needs-validation" --color "FBCA04" --description "Review finding awaiting human validation. Managed by ForgeDock." --force -R {GH_REPO} 2>/dev/null
+gh label create "validated" --color "0E8A16" --description "Review finding confirmed as a real issue. Managed by ForgeDock." --force -R {GH_REPO} 2>/dev/null
+gh label create "false-positive" --color "CCCCCC" --description "Review finding dismissed as a false positive. Managed by ForgeDock." --force -R {GH_REPO} 2>/dev/null
 ```
 
 **Milestone detection:**
@@ -693,7 +695,7 @@ else
     ' 2>/dev/null | head -1)
     if [ -n "$REGRESSION" ]; then
         echo "REGRESSION: Previously fixed in #${REGRESSION} — elevating priority"
-        # Create with regression warning and P1 priority
+        # Create with regression warning and priority:P1 label
     fi
 fi
 ```
@@ -701,7 +703,7 @@ fi
 **Rules:**
 - Open `review-finding` issue at same file within ±5 lines → **skip** (do not create duplicate)
 - Open `review-finding` issue at same file with similar title (3+ shared keywords) → **skip** (likely same finding despite line drift)
-- Closed `review-finding` at same file within ±5 lines → create with regression warning, elevate to P1
+- Closed `review-finding` at same file within ±5 lines → create with regression warning, elevate to `priority:P1`
 
 **For each finding** (that passes dedup), create issue:
 ```bash
@@ -757,7 +759,7 @@ ISSUE_EOF
 )" --json number --jq '.number')
 ```
 
-Labels: `review-finding` + `needs-validation` + priority (`P1` CONFIRMED, `P2` LIKELY, `P3` POSSIBLE).
+Labels: `review-finding` + `needs-validation` + priority (`priority:P1` CONFIRMED, `priority:P2` LIKELY, `priority:P3` POSSIBLE).
 
 **Add to project board:**
 ```bash

package/commands/rollback.md

@@ -192,7 +192,7 @@ fi
 
 ```bash
 gh issue create --title "fix: {original_title} (reverted — needs new approach)" \
-  --label "bug,P1" \
+  --label "bug,priority:P1" \
   --body "$(cat <<'BODY_EOF'
 ## Problem
 

package/commands/security-audit.md

@@ -7,7 +7,7 @@ argument-hint: [--repo <prefix>] [--phase 1|2|3|4|all] [--dry-run]
 
 **Input**: $ARGUMENTS
 
-You are the security posture auditor. Run a scripted 4-phase checklist against the **current state** of the target repository (not a PR diff). Each check uses bash/grep against repo files. Confirmed findings are posted as GitHub issues in the target repo, labeled `security,audit-finding,P1/P2/P3`.
+You are the security posture auditor. Run a scripted 4-phase checklist against the **current state** of the target repository (not a PR diff). Each check uses bash/grep against repo files. Confirmed findings are posted as GitHub issues in the target repo, labeled `security,audit-finding,priority:P1/priority:P2/priority:P3`.
 
 This command is designed to be run:
 - **Manually** after a pen test engagement
@@ -119,7 +119,7 @@ done
 
 **Confirm**: For each hit, verify the port is NOT a web-facing port (80, 443, 8080, 3000). Ports like 6432 (PgBouncer), 6379 (Redis), 5432 (Postgres), 27017 (MongoDB) bound to `0.0.0.0` are confirmed findings.
 
-**Severity**: P1 if no external firewall documented; P2 otherwise.
+**Severity**: `priority:P1` if no external firewall documented; `priority:P2` otherwise.
 
 **Issue title**: `security: {SERVICE} port {PORT} bound to 0.0.0.0 — exposed beyond localhost`
 
@@ -142,7 +142,7 @@ done
 
 **Confirm**: Check if the Dockerfile is for a long-running service (not a one-shot build image). If service container with no USER → confirmed finding.
 
-**Severity**: P2 (standard finding; exploitability depends on runtime isolation).
+**Severity**: `priority:P2` (standard finding; exploitability depends on runtime isolation).
 
 **Issue title**: `security: {SERVICE} Dockerfile has no USER directive — runs as root`
 
@@ -167,7 +167,7 @@ done
 
 **Manual review**: Check for `POSTGRES_PASSWORD` and `requirepass` in compose environment sections. Flag any service using a blank/trivial password as a documented value.
 
-**Severity**: P3 for dev compose; P1 if the compose file is used in production.
+**Severity**: `priority:P3` for dev compose; `priority:P1` if the compose file is used in production.
 
 **Issue title**: `security: {SERVICE} in {FILE} has no authentication configured`
 
@@ -198,7 +198,7 @@ done
 
 **Confirm**: Verify the flagged step is indeed a security scanner step (not a notification or deploy step). Confirmed if scanner produces failure exit codes that are being swallowed.
 
-**Severity**: P2 (scanner present but findings are silently ignored).
+**Severity**: `priority:P2` (scanner present but findings are silently ignored).
 
 **Issue title**: `security: {SCANNER} step in {WORKFLOW} has continue-on-error: true — findings silently ignored`
 
@@ -219,7 +219,7 @@ done
 
 **Confirm**: Distinguish intentional comments (documentation) from disabled access control rules. Confirmed if the commented line is a functional directive that would restrict access.
 
-**Severity**: P1 if the endpoint is publicly accessible; P2 otherwise.
+**Severity**: `priority:P1` if the endpoint is publicly accessible; `priority:P2` otherwise.
 
 **Issue title**: `security: commented-out access control in {FILE} — {DIRECTIVE} disabled`
 
@@ -242,7 +242,7 @@ done
 
 **Confirm**: Verify the CSP header applies to the production site (not just dev/storybook). Check if a nonce-based approach is already in use (nonce + unsafe-inline is still a finding but lower severity).
 
-**Severity**: P2 (XSS protection materially weakened).
+**Severity**: `priority:P2` (XSS protection materially weakened).
 
 **Issue title**: `security: CSP script-src includes unsafe-inline in {FILE} — XSS protection bypassed`
 
@@ -261,9 +261,9 @@ for f in $HEADER_FILES; do
 done
 ```
 
-**Confirm**: Check if the header is set in a response (not just read). If set in outbound responses → confirmed finding. Internal-only APIs (not publicly routed) are P3; public APIs are P2.
+**Confirm**: Check if the header is set in a response (not just read). If set in outbound responses → confirmed finding. Internal-only APIs (not publicly routed) are `priority:P3`; public APIs are `priority:P2`.
 
-**Severity**: P2 for public APIs; P3 for internal.
+**Severity**: `priority:P2` for public APIs; `priority:P3` for internal.
 
 **Issue title**: `security: {HEADER} response header leaks deployment/version information`
 
@@ -291,7 +291,7 @@ grep -rn '@router.get\("/health"\|@app.route("/health"\|@router.get\("/metrics"\
 
 **Confirm**: Manually verify the route has no authentication dependency. Check if it's behind a network-level gate (traefik middleware, nginx ACL). Confirmed if publicly routable and returns system state.
 
-**Severity**: P2 (information disclosure enables targeted attacks).
+**Severity**: `priority:P2` (information disclosure enables targeted attacks).
 
 **Issue title**: `security: unauthenticated {ROUTE} endpoint exposes system state`
 
@@ -326,7 +326,7 @@ grep -rn "new Map\(\)" "$REPO_PATH/web" --include="*.ts" --include="*.tsx" --inc
 
 **Confirm**: Verify the rate limiter is not backed by Redis, a database, or a distributed cache. Confirmed if per-process store with no TTL-based external backend.
 
-**Severity**: P2 (rate limit bypass possible in scaled deployments).
+**Severity**: `priority:P2` (rate limit bypass possible in scaled deployments).
 
 **Issue title**: `security: in-memory rate limiter in {FILE} has no cross-replica enforcement`
 
@@ -363,9 +363,9 @@ grep -rn "document\.cookie\s*=\|res\.cookie(" "$REPO_PATH/web" --include="*.ts"
   done
 ```
 
-**Confirm**: Verify the cookie stores user-controlled data or authentication state. Internal-only cookies (debug flags, feature flags with no sensitive data) are P3. Auth/session cookies without flags are P1.
+**Confirm**: Verify the cookie stores user-controlled data or authentication state. Internal-only cookies (debug flags, feature flags with no sensitive data) are `priority:P3`. Auth/session cookies without flags are `priority:P1`.
 
-**Severity**: P1 for auth/session tokens; P2 for user-controlled data; P3 for non-sensitive cookies.
+**Severity**: `priority:P1` for auth/session tokens; `priority:P2` for user-controlled data; `priority:P3` for non-sensitive cookies.
 
 **Issue title**: `security: {COOKIE_NAME} cookie missing {FLAGS} — vulnerable to XSS/CSRF/MITM`
 
@@ -395,7 +395,7 @@ grep -rn '||\s*["'"'"'][a-zA-Z0-9]\{4,\}["'"'"']\|default.*password\|default.*se
 
 **Confirm**: Verify the fallback value is a real credential (not a placeholder like `""` or `"REPLACE_ME"` which would fail explicitly). Confirmed if a non-trivial value would silently succeed authentication.
 
-**Severity**: P1 if the credential protects a production service; P2 otherwise.
+**Severity**: `priority:P1` if the credential protects a production service; `priority:P2` otherwise.
 
 **Issue title**: `security: credential placeholder fallback in {FILE} — {VAR} defaults to hardcoded value`
 
@@ -445,7 +445,7 @@ done
 
 **Confirm**: Verify the event type appears in a handler dispatch (not just a comment). Confirmed if the event would change user entitlements or financial state but has no handler.
 
-**Severity**: P1 for events that affect billing state (subscription.deleted, payment_failed, dispute); P2 for informational events.
+**Severity**: `priority:P1` for events that affect billing state (subscription.deleted, payment_failed, dispute); `priority:P2` for informational events.
 
 **Issue title**: `security: Stripe event {EVENT_TYPE} not handled in {FILE} — financial state may diverge`
 
@@ -466,7 +466,7 @@ grep -rn "pre_reserve\|prereserve\|reserve_credits\|MAX_COST\|max_cost\|PRE_RESE
 
 **Manual review required**: Compare the pre-reserve amount against the maximum operation cost for the highest-tier model. If pre-reserve < max possible cost, users can overdraw.
 
-**Severity**: P2 (financial loss; users can consume credits they don't have).
+**Severity**: `priority:P2` (financial loss; users can consume credits they don't have).
 
 **Issue title**: `security: pre-reservation credit cap {AMOUNT} is below maximum operation cost {MAX_COST}`
 
@@ -483,8 +483,8 @@ After all phases complete, produce a summary table:
 
 | # | Phase | Finding | File | Severity | Status |
 |---|-------|---------|------|----------|--------|
-| 1 | 1A | Port binding | docker-compose.prod.yml:12 | P1 | CONFIRMED |
-| 2 | 1B | No USER directive | services/worker/Dockerfile | P2 | CONFIRMED |
+| 1 | 1A | Port binding | docker-compose.prod.yml:12 | priority:P1 | CONFIRMED |
+| 2 | 1B | No USER directive | services/worker/Dockerfile | priority:P2 | CONFIRMED |
 ...
 ```
 
@@ -492,12 +492,14 @@ If `--dry-run` was passed, print the table and STOP. Do not create issues.
 
 ### 5B: Ensure labels exist in target repo
 
-Before creating any issues, ensure all required labels exist:
+Before creating any issues, ensure all required labels exist. Colors match the canonical ForgeDock label manifest (`bin/labels.json`). Run `npx forgedock labels setup` to bootstrap all managed labels at once.
 
 ```bash
-for label in "security" "audit-finding" "P1" "P2" "P3"; do
-  gh label create "$label" --color "d73a4a" --force -R "{GH_REPO}" 2>/dev/null || true
-done
+gh label create "security" --color "B60205" --description "Security vulnerability or hardening. Managed by ForgeDock." --force -R "{GH_REPO}" 2>/dev/null || true
+gh label create "audit-finding" --color "D93F0B" --description "Security or compliance defect found during audit. Managed by ForgeDock." --force -R "{GH_REPO}" 2>/dev/null || true
+gh label create "priority:P1" --color "D93F0B" --description "High priority — major feature broken, no workaround. Managed by ForgeDock." --force -R "{GH_REPO}" 2>/dev/null || true
+gh label create "priority:P2" --color "FBCA04" --description "Medium priority — impaired functionality, workaround exists. Managed by ForgeDock." --force -R "{GH_REPO}" 2>/dev/null || true
+gh label create "priority:P3" --color "C2E0C6" --description "Low priority — minor issue or polish. Managed by ForgeDock." --force -R "{GH_REPO}" 2>/dev/null || true
 ```
 
 ### 5C: Create GitHub issues for CONFIRMED findings
@@ -559,9 +561,9 @@ gh issue comment "{CALLER_ISSUE}" -R {FORGE_REPO} --body "$(cat <<'COMMENT_EOF'
 
 | Severity | Count |
 |----------|-------|
-| P1 | {P1_COUNT} |
-| P2 | {P2_COUNT} |
-| P3 | {P3_COUNT} |
+| priority:P1 | {P1_COUNT} |
+| priority:P2 | {P2_COUNT} |
+| priority:P3 | {P3_COUNT} |
 
 ### Issues Created
 

package/commands/sync-ecosystem.md

@@ -217,7 +217,7 @@ Create issues in the affected repos:
 # For satellite repos (separate GitHub repos):
 gh issue create -R {TARGET_REPO} \
   --title "feat(sync): {description of what API change needs to be reflected}" \
-  --label "feature,P2" \
+  --label "feature,priority:P2" \
   --body "$(cat <<'BODY_EOF'
 ## Problem
 
@@ -254,7 +254,7 @@ BODY_EOF
 # For monorepo issues (SDKs, packages inside a single repo):
 gh issue create \
   --title "feat(sync): {description of what API change needs to be reflected}" \
-  --label "feature,P2" \
+  --label "feature,priority:P2" \
   --body "$(cat <<'BODY_EOF'
 ## Problem