forgedock 1.0.6 → 1.0.7

package/commands/rollback.md

@@ -9,6 +9,7 @@ argument-hint: [PR number to revert, or "last" for most recent deploy]
 
 **Config variables used by this command** (set in `forge.yaml`):
 - `{REPO_PATH}` ← `paths.root` — project repository root
+- `{DEPLOY_WORKFLOW}` ← `deploy.workflow` (optional) — GitHub Actions workflow filename for fast-track deploys (e.g., `hotfix-deploy.yml`). When absent or empty, the workflow-trigger suggestion is omitted.
 
 You are the pipeline's emergency rollback system. When a shipped feature or fix causes production issues, this command creates a revert PR and fast-tracks it through the pipeline.
 
@@ -112,12 +113,29 @@ If conflicts cannot be auto-resolved, report to user and STOP.
 
 ### Step 2C: Verify the revert compiles
 
+Read `forge.yaml → verification.commands` for project-specific tool commands:
+
 ```bash
-# Python files
-poetry -C services/api run python -m py_compile {reverted_python_files} 2>&1
+# Python compile check (always runs — no config needed)
+for f in {reverted_python_files}; do
+    python3 -m py_compile "$f" 2>&1
+done
+
+# Python format check (config-driven)
+PYTHON_FORMAT=$(awk '/^  commands:/{f=1;next} f && /^[^ \t]/{exit} f' forge.yaml 2>/dev/null | awk '/^    python:/{f=1;next} f && /^    [^ \t]/{exit} f' | grep 'format:' | head -1 | sed "s/.*format: *['\"]//;s/['\"].*//")
+if [ -n "$PYTHON_FORMAT" ]; then
+    eval "$PYTHON_FORMAT" 2>&1 | head -20
+else
+    echo "SKIPPED — python.format not configured in verification.commands"
+fi
 
-# TypeScript files (if any)
-cd web && npx tsc --noEmit 2>&1 | head -20
+# TypeScript typecheck (config-driven)
+TS_TYPECHECK=$(awk '/^  commands:/{f=1;next} f && /^[^ \t]/{exit} f' forge.yaml 2>/dev/null | awk '/^    typescript:/{f=1;next} f && /^    [^ \t]/{exit} f' | grep 'typecheck:' | head -1 | sed "s/.*typecheck: *['\"]//;s/['\"].*//")
+if [ -n "$TS_TYPECHECK" ]; then
+    eval "$TS_TYPECHECK" 2>&1 | head -20
+else
+    echo "SKIPPED — typescript.typecheck not configured in verification.commands"
+fi
 ```
 
 ---
@@ -160,10 +178,11 @@ PR_EOF
 ```bash
 gh pr merge {REVERT_PR} --merge
 ```
-- Then trigger hotfix deploy:
+- Then trigger hotfix deploy (requires `deploy.workflow` set in `forge.yaml`):
 ```bash
 echo "Revert merged to main. CI/CD will deploy automatically."
-echo "For faster deploy, trigger hotfix: gh workflow run hotfix-deploy.yml --ref main -f services={affected} -f reason=\"Rollback PR #{PR_NUMBER}\""
+echo "For faster deploy, trigger deploy workflow: gh workflow run {deploy.workflow} --ref main -f {deploy.workflow_inputs.services}={affected} -f {deploy.workflow_inputs.reason}=\"Rollback PR #{PR_NUMBER}\""
+# If deploy.workflow is not configured in forge.yaml, CI/CD will deploy automatically on the next push to main.
 ```
 
 **If not urgent**:

package/commands/work-on/build/validate.md

@@ -88,31 +88,50 @@ Needs human review before proceeding to commit.
 
 ## Phase V2: Format and Verify
 
-Run after quality gate passes. Format checks are per-language:
+Run after quality gate passes. All tool commands are read from `forge.yaml → verification.commands`; each step logs `SKIPPED — not configured` when the corresponding key is absent rather than silently passing:
 
 **Python**:
 ```bash
 cd {WORKTREE_PATH}
-black {PYTHON_FILES}
-isort {PYTHON_FILES}
+
+PYTHON_FORMAT=$(awk '/^  commands:/{f=1;next} f && /^[^ \t]/{exit} f' forge.yaml 2>/dev/null | awk '/^    python:/{f=1;next} f && /^    [^ \t]/{exit} f' | grep 'format:' | head -1 | sed "s/.*format: *['\"]//;s/['\"].*//")
+if [ -n "$PYTHON_FORMAT" ]; then
+    eval "$PYTHON_FORMAT" 2>&1
+else
+    echo "SKIPPED — python.format not configured in verification.commands"
+fi
+
+# Compile check always runs for Python files (no config needed — catches syntax errors)
 python -m py_compile {PYTHON_FILES}
 ```
 Failures in `py_compile` are BLOCKING — fix before continuing.
 
-**TypeScript (tsc)**:
+**TypeScript**:
 ```bash
 cd {WORKTREE_PATH}
-prettier --write {TS_FILES}
-tsc --noEmit
-```
-`tsc --noEmit` failures are BLOCKING — fix type errors before continuing.
 
-**TypeScript (satellite repos — MCP, n8n)**:
-```bash
-cd {WORKTREE_PATH}
-npm run build
-prettier --write {TS_FILES}
+TS_FORMAT=$(awk '/^  commands:/{f=1;next} f && /^[^ \t]/{exit} f' forge.yaml 2>/dev/null | awk '/^    typescript:/{f=1;next} f && /^    [^ \t]/{exit} f' | grep 'format:' | head -1 | sed "s/.*format: *['\"]//;s/['\"].*//")
+TS_TYPECHECK=$(awk '/^  commands:/{f=1;next} f && /^[^ \t]/{exit} f' forge.yaml 2>/dev/null | awk '/^    typescript:/{f=1;next} f && /^    [^ \t]/{exit} f' | grep 'typecheck:' | head -1 | sed "s/.*typecheck: *['\"]//;s/['\"].*//")
+TS_BUILD=$(awk '/^  commands:/{f=1;next} f && /^[^ \t]/{exit} f' forge.yaml 2>/dev/null | awk '/^    typescript:/{f=1;next} f && /^    [^ \t]/{exit} f' | grep 'build:' | head -1 | sed "s/.*build: *['\"]//;s/['\"].*//")
+
+if [ -n "$TS_FORMAT" ]; then
+    eval "$TS_FORMAT" 2>&1
+else
+    echo "SKIPPED — typescript.format not configured in verification.commands"
+fi
+
+if [ -n "$TS_TYPECHECK" ]; then
+    eval "$TS_TYPECHECK" 2>&1
+    TS_EXIT=$?
+elif [ -n "$TS_BUILD" ]; then
+    eval "$TS_BUILD" 2>&1 | tail -30
+    TS_EXIT=$?
+else
+    echo "SKIPPED — typescript.typecheck and typescript.build not configured in verification.commands"
+    TS_EXIT=0
+fi
 ```
+Typecheck or build failures are BLOCKING — fix type errors before continuing.
 
 **Shell scripts**: Verify service interactions — read target middleware files, document what was verified in V4 summary.
 

package/commands/work-on/decompose.md

@@ -40,6 +40,8 @@ gh api repos/{GH_REPO}/issues/{NUMBER}/comments \
 - If FORGE:INVESTIGATOR comment is absent → EXIT with `DECOMPOSE_RESULT: status: BLOCKED`, blocker: "No investigation report found — run investigate first"
 - If investigation report has no Decomposition Assessment section, OR the assessment does not list any sub-issues → EXIT with `DECOMPOSE_RESULT: status: BLOCKED`, blocker: "Investigation report has no decomposition plan — re-run investigate with explicit decomposition scope"
 
+> **Shared Scoping Convention**: This investigation gate (blocks without a `FORGE:INVESTIGATOR` comment) is the **reference pattern** for investigation-gated issue creation across the pipeline. `milestone.md` Step 4 and `orchestrate.md` MUST apply the same principle: read code and identify all affected call sites BEFORE writing any issue body. Sub-issue bodies created in Phase D3 MUST use the Pipeline Issue Template defined in `issue.md` Phase 3D — that template is the single canonical standard for all automated issue creation. <!-- Added: forge#293 -->
+
 Extract from investigation report:
 - Decomposition Assessment section: list of proposed sub-issues with titles and dependencies
 - Milestone (from issue metadata)

package/commands/work-on-monolithic.md

@@ -89,16 +89,20 @@ Mission: Validate whether the issue is real. Assume description is wrong until p
 
 **Domain file hints** (start search here):
 
-| Domain | Key files |
-|--------|-----------|
-| BILLING | `routers/billing.py`, `core/pricing.py`, `services/credit_service.py` |
-| SCRAPING | `unified_consumer.py`, `queues.py`, `domain_playbooks.json` |
+Configure domain-to-file mappings for your project in `forge.yaml → review.key_paths`. The table below shows the standard layout — override any entry that doesn't match your codebase:
+
+| Domain | Default key files (override via forge.yaml) |
+|--------|---------------------------------------------|
+| BILLING | `routers/billing.py`, `core/pricing.py`, `services/payment_service.py` |
+| WORKER | `worker/main.py`, `worker/queues.py`, `worker/tasks.py` |
 | AUTH | `core/auth.py`, `routers/auth.py`, `dependencies.py` |
 | DATABASE | `infra/migrations/`, `models/`, `db/` |
 | FRONTEND | `web/src/app/`, `web/src/components/`, `web/src/lib/` |
-| CORTEX | `cortex_client.py`, `routers/cortex.py` |
+| AI | `services/ai_client.py`, `routers/ai.py` |
 | INFRA | `.github/workflows/`, `docker-compose.yml`, `infra/traefik/` |
 
+If `forge.yaml → review.key_paths` is present, use those mappings instead of the defaults above.
+
 **Steps**: Check right branch → read domain files → verify claims → git blame → determine root cause → identify affected files → validate proposed fixes against full system stack.
 
 **Fix-Approach Validation**: If issue proposes a fix, don't adopt it as spec. Trace through target system's middleware, auth, routing.

package/commands/work-on.md

@@ -747,25 +747,50 @@ if iteration == max_iterations AND not PASS:
 
 ### 3H: Format and verify
 
+All tool commands are read from `forge.yaml → verification.commands`. When a key is absent, the step logs `SKIPPED — not configured in verification.commands` and continues rather than silently passing.
+
 **Python**:
 ```bash
 cd {WORKTREE_PATH}
-black {PYTHON_FILES} && isort {PYTHON_FILES} && python -m py_compile {PYTHON_FILES}
+
+PYTHON_FORMAT=$(awk '/^  commands:/{f=1;next} f && /^[^ \t]/{exit} f' forge.yaml 2>/dev/null | awk '/^    python:/{f=1;next} f && /^    [^ \t]/{exit} f' | grep 'format:' | head -1 | sed "s/.*format: *['\"]//;s/['\"].*//")
+if [ -n "$PYTHON_FORMAT" ]; then
+    eval "$PYTHON_FORMAT" 2>&1
+else
+    echo "SKIPPED — python.format not configured in verification.commands"
+fi
+
+# Compile check always runs (no config needed — catches syntax errors)
+python -m py_compile {PYTHON_FILES}
 ```
 `py_compile` failures are BLOCKING.
 
-**TypeScript (primary repo — has tsconfig.json)**:
+**TypeScript**:
 ```bash
 cd {WORKTREE_PATH}
-prettier --write {TS_FILES} && tsc --noEmit
-```
-`tsc --noEmit` failures are BLOCKING.
 
-**TypeScript (satellite repos)**:
-```bash
-cd {WORKTREE_PATH}
-npm run build && prettier --write {TS_FILES}
+TS_FORMAT=$(awk '/^  commands:/{f=1;next} f && /^[^ \t]/{exit} f' forge.yaml 2>/dev/null | awk '/^    typescript:/{f=1;next} f && /^    [^ \t]/{exit} f' | grep 'format:' | head -1 | sed "s/.*format: *['\"]//;s/['\"].*//")
+TS_TYPECHECK=$(awk '/^  commands:/{f=1;next} f && /^[^ \t]/{exit} f' forge.yaml 2>/dev/null | awk '/^    typescript:/{f=1;next} f && /^    [^ \t]/{exit} f' | grep 'typecheck:' | head -1 | sed "s/.*typecheck: *['\"]//;s/['\"].*//")
+TS_BUILD=$(awk '/^  commands:/{f=1;next} f && /^[^ \t]/{exit} f' forge.yaml 2>/dev/null | awk '/^    typescript:/{f=1;next} f && /^    [^ \t]/{exit} f' | grep 'build:' | head -1 | sed "s/.*build: *['\"]//;s/['\"].*//")
+
+if [ -n "$TS_FORMAT" ]; then
+    eval "$TS_FORMAT" 2>&1
+else
+    echo "SKIPPED — typescript.format not configured in verification.commands"
+fi
+
+if [ -n "$TS_TYPECHECK" ]; then
+    eval "$TS_TYPECHECK" 2>&1
+    TS_EXIT=$?
+elif [ -n "$TS_BUILD" ]; then
+    eval "$TS_BUILD" 2>&1 | tail -30
+    TS_EXIT=$?
+else
+    echo "SKIPPED — typescript.typecheck and typescript.build not configured in verification.commands"
+    TS_EXIT=0
+fi
 ```
+Typecheck or build failures are BLOCKING.
 
 ### 3I: Frontend proxy wiring check (MANDATORY)
 
@@ -791,27 +816,44 @@ Advisory only — does not block build. Check for lambda/callable in connect_arg
 
 Skip if no new env vars introduced.
 
+**Config variables used by this phase** (set in `forge.yaml`):
+- `{deploy.secrets_backend}` — secrets delivery method (`sops`, `aws-sm`, `vault`, `ci-env`, `none`). When absent or not `sops`, SOPS-specific checks below are skipped with an explicit log message.
+- `{verification.services[name].container}` — container name for post-deploy verification. Resolved by matching the service name; falls back to `{service}` (bare name) when not configured.
+
 For each new env var, verify present in ALL required locations:
 
 | Location | Required for |
 |----------|-------------|
 | `.env.example` | All new vars |
-| `infra/secrets/prod.enc.yaml` (SOPS) | Production secrets |
-| `infra/decrypt-secrets.sh` ENV_MAPPING | All vars in deploy chain |
-| `app/env_validation.py` | API service vars |
-| `docker-compose.prod.yml` | Vars needing explicit injection |
+| Secrets backend (see `deploy.secrets_backend`) | Secret vars — skip if backend is `none` or unset |
+| `app/env_validation.py` | API service vars (if project has one) |
+| `docker-compose.prod.yml` | Vars needing explicit injection (if project uses Docker Compose) |
 
-Deploy chain: SOPS → `decrypt-secrets.sh` (ENV_MAPPING) → `.env.secrets` → `merge-env-secrets.sh` → `.env.production` → docker-compose `env_file`.
+**Secrets backend check** *(trigger: `deploy.secrets_backend == "sops"`)*:
 
-**Operator-set var classification** *(trigger: new env var is NOT present in `infra/secrets/prod.enc.yaml`)*: <!-- Added: forge#380 -->
+If the project uses SOPS, verify the new var is present in all SOPS chain locations:
+- `infra/secrets/prod.enc.yaml` — SOPS-encrypted secret store
+- `infra/decrypt-secrets.sh` ENV_MAPPING — maps SOPS key to env var name
+- Deploy chain: SOPS → `decrypt-secrets.sh` (ENV_MAPPING) → `.env.secrets` → `merge-env-secrets.sh` → `.env.production` → docker-compose `env_file`
 
-Some env vars are operator-set (non-secret, not sourced from SOPS) — they must be manually added to `.env.production` on the production server. The SOPS deploy chain does not carry them. When a new env var has no entry in `prod.enc.yaml`, classify it as operator-set and add a **HARD BLOCKER** item to the Testing Checklist:
+If `deploy.secrets_backend` is absent or not `sops`, skip these checks and log:
+> `SKIP: SOPS chain check — deploy.secrets_backend is not "sops". Configure deploy.secrets_backend in forge.yaml to enable.`
+
+**Operator-set var classification** *(trigger: new env var is NOT in the configured secrets backend)*: <!-- Added: forge#380 -->
+
+Some env vars are operator-set (non-secret, not sourced from the secrets backend) — they must be manually added to the runtime environment on the production server. When a new env var has no entry in the secrets backend, classify it as operator-set and add a **HARD BLOCKER** item to the Testing Checklist.
+
+Resolve the container name for the verification command:
+1. Look up the service in `forge.yaml → verification.services[]` by name — use the `container` field if present.
+2. If no matching entry, fall back to the bare service name: `{service}` (no suffix).
 
 ```
-- [ ] HARD BLOCKER: Add {VAR_NAME} to .env.production on the production server.
-      This var is operator-set (not in SOPS) — it does NOT flow through the automated
-      deploy chain. It must be added manually before or after deploy.
-      Verify with: docker exec {service}-blue env | grep {VAR_NAME}
+- [ ] HARD BLOCKER: Add {VAR_NAME} to the runtime environment on the production server.
+      This var is operator-set — it does NOT flow through the automated secrets chain.
+      It must be added manually before or after deploy.
+      Verify with: docker exec {CONTAINER_NAME} env | grep {VAR_NAME}
+      (CONTAINER_NAME resolved from verification.services[{service}].container in forge.yaml,
+       or bare service name if not configured)
 ```
 
 **`env_file` re-read warning** *(trigger: any new env var added to `.env.production` path)*:
@@ -822,11 +864,13 @@ Add this warning to the Testing Checklist whenever a new env var is introduced (
 
 **Post-deploy in-container verification** *(trigger: any new env var)*:
 
-Add the following to the Testing Checklist so the deployer can confirm delivery after deploy:
+Add the following to the Testing Checklist so the deployer can confirm delivery after deploy.
+
+Resolve `{CONTAINER_NAME}` from `forge.yaml → verification.services[{service}].container`; use `{service}` (bare) if the field is absent.
 
 ```bash
 # Verify env var reached the running container (run post-deploy)
-docker exec {service}-blue env | grep {VAR_NAME}
+docker exec {CONTAINER_NAME} env | grep {VAR_NAME}
 # Expected: {VAR_NAME}={value}
 # If blank: container was not recreated — run: docker compose up --no-deps --force-recreate {service}
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgedock",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "GitHub as a knowledge graph for AI agents. Autonomous dev pipeline for Claude Code.",
   "bin": {
     "forgedock": "bin/forgedock.mjs"

package/scripts/verify-route-registration.sh

@@ -5,6 +5,18 @@
 #   changed_files_file: path to a file listing changed files (one per line)
 #   repo_root: path to the repository root
 #
+# Layout path overrides (env vars — override defaults for non-AlterLab layouts):
+#   FORGE_PAGES_ROOT          Root of Next.js App Router pages dir (default: web/src/app)
+#   FORGE_API_ROUTERS_DIR     Dir containing FastAPI router .py files (default: services/api/app/routers)
+#   FORGE_API_MAIN            Path to API app entrypoint, relative to repo root (default: services/api/app/main.py)
+#   FORGE_API_MIDDLEWARE_DIR  Dir containing API middleware .py files (default: services/api/app/middleware)
+#   FORGE_API_SERVICES_DIR    Root of the backend API service dir (default: services/api)
+#   FORGE_WORKER_DIR          Root of the background worker service dir (default: services/worker)
+#   FORGE_COMPONENTS_DIR      Root of shared frontend component library (default: web/src/components)
+#
+# Set these from forge.yaml review.layout fields before invoking, e.g.:
+#   export FORGE_PAGES_ROOT=$(yq '.review.layout.pages // "web/src/app"' forge.yaml)
+#
 # Output: Structured findings (one per line, prefixed with severity)
 #   BLOCKING: <message>  — must fix before merge
 #   WARNING:  <message>  — likely issue, verify manually
@@ -23,12 +35,21 @@ else
     FILES=$(cat "$CHANGED_FILES")
 fi
 
+# Layout path configuration — read from env vars, fall back to AlterLab defaults
+FORGE_PAGES_ROOT="${FORGE_PAGES_ROOT:-web/src/app}"
+FORGE_API_ROUTERS_DIR="${FORGE_API_ROUTERS_DIR:-services/api/app/routers}"
+FORGE_API_MAIN="${FORGE_API_MAIN:-services/api/app/main.py}"
+FORGE_API_MIDDLEWARE_DIR="${FORGE_API_MIDDLEWARE_DIR:-services/api/app/middleware}"
+FORGE_API_SERVICES_DIR="${FORGE_API_SERVICES_DIR:-services/api}"
+FORGE_WORKER_DIR="${FORGE_WORKER_DIR:-services/worker}"
+FORGE_COMPONENTS_DIR="${FORGE_COMPONENTS_DIR:-web/src/components}"
+
 BLOCKING=0
 WARNINGS=0
 
 # --- Next.js Route Handler registration check ---
 while read -r f; do
-    URL_PATH=$(echo "$f" | sed 's|^web/src/app||; s|/route\.ts$||; s|\[.*\]|*|g')
+    URL_PATH=$(echo "$f" | sed "s|^${FORGE_PAGES_ROOT}||; s|/route\\.ts\$||; s|\\[.*\\]|*|g")
     ROUTE_SEGMENT=$(echo "$URL_PATH" | sed 's|/api/v1/||; s|/.*||')
 
     # Check if next.config.js has a rewrite that might shadow this route
@@ -48,50 +69,50 @@ while read -r f; do
             WARNINGS=$((WARNINGS + 1))
         fi
     fi
-done < <(echo "$FILES" | grep -E "^web/src/app/api/.*route\.ts$") || true
+done < <(echo "$FILES" | grep -E "^${FORGE_PAGES_ROOT}/api/.*route\\.ts$") || true
 
 # --- Python API Router registration check ---
 while read -r f; do
     ROUTER_NAME=$(basename "$f" .py)
-    MAIN_PY="$REPO_ROOT/services/api/app/main.py"
+    MAIN_PY="$REPO_ROOT/${FORGE_API_MAIN}"
 
     if [ -f "$MAIN_PY" ]; then
         if grep -q "$ROUTER_NAME" "$MAIN_PY" 2>/dev/null; then
-            echo "OK: API Router '$ROUTER_NAME' ($f) — registered in main.py"
+            echo "OK: API Router '$ROUTER_NAME' ($f) — registered in $(basename "$MAIN_PY")"
         else
-            echo "BLOCKING: API Router '$ROUTER_NAME' ($f) — NOT found in main.py. Router will not be reachable."
+            echo "BLOCKING: API Router '$ROUTER_NAME' ($f) — NOT found in $(basename "$MAIN_PY"). Router will not be reachable."
             BLOCKING=$((BLOCKING + 1))
         fi
     else
-        echo "WARNING: Cannot verify router registration — main.py not found at $MAIN_PY"
+        echo "WARNING: Cannot verify router registration — API main not found at $MAIN_PY"
         WARNINGS=$((WARNINGS + 1))
     fi
-done < <(echo "$FILES" | grep -E "^services/api/app/routers/.*\.py$") || true
+done < <(echo "$FILES" | grep -E "^${FORGE_API_ROUTERS_DIR}/.*\\.py$") || true
 
 # --- Python Middleware registration check ---
 while read -r f; do
     MIDDLEWARE_NAME=$(basename "$f" .py)
-    MAIN_PY="$REPO_ROOT/services/api/app/main.py"
+    MAIN_PY="$REPO_ROOT/${FORGE_API_MAIN}"
 
     if [ -f "$MAIN_PY" ]; then
         if grep -q "$MIDDLEWARE_NAME" "$MAIN_PY" 2>/dev/null; then
-            echo "OK: Middleware '$MIDDLEWARE_NAME' ($f) — registered in main.py"
+            echo "OK: Middleware '$MIDDLEWARE_NAME' ($f) — registered in $(basename "$MAIN_PY")"
         else
-            echo "WARNING: Middleware '$MIDDLEWARE_NAME' ($f) — not found in main.py. May not be active."
+            echo "WARNING: Middleware '$MIDDLEWARE_NAME' ($f) — not found in $(basename "$MAIN_PY"). May not be active."
             WARNINGS=$((WARNINGS + 1))
         fi
     fi
-done < <(echo "$FILES" | grep -E "^services/api/app/middleware/.*\.py$") || true
+done < <(echo "$FILES" | grep -E "^${FORGE_API_MIDDLEWARE_DIR}/.*\\.py$") || true
 
 # --- Shared module import check ---
 while read -r f; do
     MODULE_NAME=$(basename "$f" .py)
 
-    IMPORTERS=$(grep -rl "$MODULE_NAME" "$REPO_ROOT/services/api/" "$REPO_ROOT/services/worker/" 2>/dev/null | head -5)
+    IMPORTERS=$(grep -rl "$MODULE_NAME" "$REPO_ROOT/${FORGE_API_SERVICES_DIR}/" "$REPO_ROOT/${FORGE_WORKER_DIR}/" 2>/dev/null | head -5)
     if [ -n "$IMPORTERS" ]; then
         echo "OK: Shared module '$MODULE_NAME' ($f) — imported by services"
     else
-        echo "WARNING: Shared module '$MODULE_NAME' ($f) — no imports found in services/api/ or services/worker/"
+        echo "WARNING: Shared module '$MODULE_NAME' ($f) — no imports found in ${FORGE_API_SERVICES_DIR}/ or ${FORGE_WORKER_DIR}/"
         WARNINGS=$((WARNINGS + 1))
     fi
 done < <(echo "$FILES" | grep -E "^shared/.*\.py$") || true
@@ -100,14 +121,14 @@ done < <(echo "$FILES" | grep -E "^shared/.*\.py$") || true
 while read -r f; do
     COMPONENT_NAME=$(basename "$f" .tsx)
 
-    IMPORTERS=$(grep -rl "$COMPONENT_NAME" "$REPO_ROOT/web/src/app/" "$REPO_ROOT/web/src/components/" 2>/dev/null | grep -v "$f" | head -3)
+    IMPORTERS=$(grep -rl "$COMPONENT_NAME" "$REPO_ROOT/${FORGE_PAGES_ROOT}/" "$REPO_ROOT/${FORGE_COMPONENTS_DIR}/" 2>/dev/null | grep -v "$f" | head -3)
     if [ -n "$IMPORTERS" ]; then
         echo "OK: Component '$COMPONENT_NAME' ($f) — imported by other files"
     else
         echo "WARNING: Component '$COMPONENT_NAME' ($f) — no imports found. May be unused or new."
         WARNINGS=$((WARNINGS + 1))
     fi
-done < <(echo "$FILES" | grep -E "^web/src/components/.*\.tsx$") || true
+done < <(echo "$FILES" | grep -E "^${FORGE_COMPONENTS_DIR}/.*\\.tsx$") || true
 
 # --- Exit code ---
 if [ "$BLOCKING" -gt 0 ]; then

package/scripts/verify-sops-chain.sh

@@ -24,6 +24,24 @@ DIFF_INPUT="${1:--}"
 CHANGED_FILES_INPUT="${2:--}"
 REPO_ROOT="${3:-.}"
 
+# --- Secrets backend guard ---
+# This script only applies when the project uses SOPS as its secrets backend.
+# Read the configured backend from the FORGE_SECRETS_BACKEND env var (set by the
+# calling pipeline) or fall back to parsing forge.yaml in the repo root.
+#
+# If the backend is not "sops" (or is unset), exit 0 with a skip message.
+# This is a clean no-op — not a false-pass — so callers can distinguish
+# "SOPS configured and passed" from "SOPS not in use on this project".
+_SECRETS_BACKEND="${FORGE_SECRETS_BACKEND:-}"
+if [ -z "$_SECRETS_BACKEND" ] && [ -f "$REPO_ROOT/forge.yaml" ]; then
+    _SECRETS_BACKEND=$(grep -E '^\s*secrets_backend:' "$REPO_ROOT/forge.yaml" \
+        | head -1 | sed 's/.*secrets_backend:[[:space:]]*//' | tr -d '"' | tr -d "'" | xargs)
+fi
+if [ "$_SECRETS_BACKEND" != "sops" ]; then
+    echo "SKIP: verify-sops-chain — secrets_backend is '${_SECRETS_BACKEND:-none}' (not sops). Configure deploy.secrets_backend: sops in forge.yaml to enable SOPS chain verification."
+    exit 0
+fi
+
 if [ "$DIFF_INPUT" = "-" ]; then
     DIFF_CONTENT=$(cat)
 else