forgedock 1.0.6 → 1.0.8

package/commands/rollback.md

@@ -9,6 +9,7 @@ argument-hint: [PR number to revert, or "last" for most recent deploy]
 
 **Config variables used by this command** (set in `forge.yaml`):
 - `{REPO_PATH}` ← `paths.root` — project repository root
+- `{DEPLOY_WORKFLOW}` ← `deploy.workflow` (optional) — GitHub Actions workflow filename for fast-track deploys (e.g., `hotfix-deploy.yml`). When absent or empty, the workflow-trigger suggestion is omitted.
 
 You are the pipeline's emergency rollback system. When a shipped feature or fix causes production issues, this command creates a revert PR and fast-tracks it through the pipeline.
 
@@ -112,12 +113,29 @@ If conflicts cannot be auto-resolved, report to user and STOP.
 
 ### Step 2C: Verify the revert compiles
 
+Read `forge.yaml → verification.commands` for project-specific tool commands:
+
 ```bash
-# Python files
-poetry -C services/api run python -m py_compile {reverted_python_files} 2>&1
+# Python compile check (always runs — no config needed)
+for f in {reverted_python_files}; do
+    python3 -m py_compile "$f" 2>&1
+done
+
+# Python format check (config-driven)
+PYTHON_FORMAT=$(yq '.verification.commands.python.format // ""' forge.yaml 2>/dev/null || echo '')
+if [ -n "$PYTHON_FORMAT" ]; then
+    eval "$PYTHON_FORMAT" 2>&1 | head -20
+else
+    echo "SKIPPED — python.format not configured in verification.commands"
+fi
 
-# TypeScript files (if any)
-cd web && npx tsc --noEmit 2>&1 | head -20
+# TypeScript typecheck (config-driven)
+TS_TYPECHECK=$(yq '.verification.commands.typescript.typecheck // ""' forge.yaml 2>/dev/null || echo '')
+if [ -n "$TS_TYPECHECK" ]; then
+    eval "$TS_TYPECHECK" 2>&1 | head -20
+else
+    echo "SKIPPED — typescript.typecheck not configured in verification.commands"
+fi
 ```
 
 ---
@@ -160,10 +178,11 @@ PR_EOF
 ```bash
 gh pr merge {REVERT_PR} --merge
 ```
-- Then trigger hotfix deploy:
+- Then trigger hotfix deploy (requires `deploy.workflow` set in `forge.yaml`):
 ```bash
 echo "Revert merged to main. CI/CD will deploy automatically."
-echo "For faster deploy, trigger hotfix: gh workflow run hotfix-deploy.yml --ref main -f services={affected} -f reason=\"Rollback PR #{PR_NUMBER}\""
+echo "For faster deploy, trigger deploy workflow: gh workflow run {deploy.workflow} --ref main -f {deploy.workflow_inputs.services}={affected} -f {deploy.workflow_inputs.reason}=\"Rollback PR #{PR_NUMBER}\""
+# If deploy.workflow is not configured in forge.yaml, CI/CD will deploy automatically on the next push to main.
 ```
 
 **If not urgent**:

package/commands/work-on/build/validate.md

@@ -88,31 +88,50 @@ Needs human review before proceeding to commit.
 
 ## Phase V2: Format and Verify
 
-Run after quality gate passes. Format checks are per-language:
+Run after quality gate passes. All tool commands are read from `forge.yaml → verification.commands`; each step logs `SKIPPED — not configured` when the corresponding key is absent rather than silently passing:
 
 **Python**:
 ```bash
 cd {WORKTREE_PATH}
-black {PYTHON_FILES}
-isort {PYTHON_FILES}
+
+PYTHON_FORMAT=$(yq '.verification.commands.python.format // ""' forge.yaml 2>/dev/null || echo '')
+if [ -n "$PYTHON_FORMAT" ]; then
+    eval "$PYTHON_FORMAT" 2>&1
+else
+    echo "SKIPPED — python.format not configured in verification.commands"
+fi
+
+# Compile check always runs for Python files (no config needed — catches syntax errors)
 python -m py_compile {PYTHON_FILES}
 ```
 Failures in `py_compile` are BLOCKING — fix before continuing.
 
-**TypeScript (tsc)**:
+**TypeScript**:
 ```bash
 cd {WORKTREE_PATH}
-prettier --write {TS_FILES}
-tsc --noEmit
-```
-`tsc --noEmit` failures are BLOCKING — fix type errors before continuing.
 
-**TypeScript (satellite repos — MCP, n8n)**:
-```bash
-cd {WORKTREE_PATH}
-npm run build
-prettier --write {TS_FILES}
+TS_FORMAT=$(yq '.verification.commands.typescript.format // ""' forge.yaml 2>/dev/null || echo '')
+TS_TYPECHECK=$(yq '.verification.commands.typescript.typecheck // ""' forge.yaml 2>/dev/null || echo '')
+TS_BUILD=$(yq '.verification.commands.typescript.build // ""' forge.yaml 2>/dev/null || echo '')
+
+if [ -n "$TS_FORMAT" ]; then
+    eval "$TS_FORMAT" 2>&1
+else
+    echo "SKIPPED — typescript.format not configured in verification.commands"
+fi
+
+if [ -n "$TS_TYPECHECK" ]; then
+    eval "$TS_TYPECHECK" 2>&1
+    TS_EXIT=$?
+elif [ -n "$TS_BUILD" ]; then
+    eval "$TS_BUILD" 2>&1 | tail -30
+    TS_EXIT=$?
+else
+    echo "SKIPPED — typescript.typecheck and typescript.build not configured in verification.commands"
+    TS_EXIT=0
+fi
 ```
+Typecheck or build failures are BLOCKING — fix type errors before continuing.
 
 **Shell scripts**: Verify service interactions — read target middleware files, document what was verified in V4 summary.
 

package/commands/work-on/decompose.md

@@ -40,6 +40,8 @@ gh api repos/{GH_REPO}/issues/{NUMBER}/comments \
 - If FORGE:INVESTIGATOR comment is absent → EXIT with `DECOMPOSE_RESULT: status: BLOCKED`, blocker: "No investigation report found — run investigate first"
 - If investigation report has no Decomposition Assessment section, OR the assessment does not list any sub-issues → EXIT with `DECOMPOSE_RESULT: status: BLOCKED`, blocker: "Investigation report has no decomposition plan — re-run investigate with explicit decomposition scope"
 
+> **Shared Scoping Convention**: This investigation gate (blocks without a `FORGE:INVESTIGATOR` comment) is the **reference pattern** for investigation-gated issue creation across the pipeline. `milestone.md` Step 4 and `orchestrate.md` MUST apply the same principle: read code and identify all affected call sites BEFORE writing any issue body. Sub-issue bodies created in Phase D3 MUST use the Pipeline Issue Template defined in `issue.md` Phase 3D — that template is the single canonical standard for all automated issue creation. <!-- Added: forge#293 -->
+
 Extract from investigation report:
 - Decomposition Assessment section: list of proposed sub-issues with titles and dependencies
 - Milestone (from issue metadata)

package/commands/work-on-monolithic.md

@@ -89,16 +89,20 @@ Mission: Validate whether the issue is real. Assume description is wrong until p
 
 **Domain file hints** (start search here):
 
-| Domain | Key files |
-|--------|-----------|
-| BILLING | `routers/billing.py`, `core/pricing.py`, `services/credit_service.py` |
-| SCRAPING | `unified_consumer.py`, `queues.py`, `domain_playbooks.json` |
+Configure domain-to-file mappings for your project in `forge.yaml → review.key_paths`. The table below shows the standard layout — override any entry that doesn't match your codebase:
+
+| Domain | Default key files (override via forge.yaml) |
+|--------|---------------------------------------------|
+| BILLING | `routers/billing.py`, `core/pricing.py`, `services/payment_service.py` |
+| WORKER | `worker/main.py`, `worker/queues.py`, `worker/tasks.py` |
 | AUTH | `core/auth.py`, `routers/auth.py`, `dependencies.py` |
 | DATABASE | `infra/migrations/`, `models/`, `db/` |
 | FRONTEND | `web/src/app/`, `web/src/components/`, `web/src/lib/` |
-| CORTEX | `cortex_client.py`, `routers/cortex.py` |
+| AI | `services/ai_client.py`, `routers/ai.py` |
 | INFRA | `.github/workflows/`, `docker-compose.yml`, `infra/traefik/` |
 
+If `forge.yaml → review.key_paths` is present, use those mappings instead of the defaults above.
+
 **Steps**: Check right branch → read domain files → verify claims → git blame → determine root cause → identify affected files → validate proposed fixes against full system stack.
 
 **Fix-Approach Validation**: If issue proposes a fix, don't adopt it as spec. Trace through target system's middleware, auth, routing.
@@ -210,7 +214,24 @@ Fix HIGH/MEDIUM findings. Max 2 iterations. Skip for 1-file config/docs edits.
 All client-side fetch/useSWR/apiFetch must use `/api/...` proxy routes, NEVER `/api/v1/...` directly.
 
 ### 3I: Deployment completeness check (MANDATORY)
-New env vars must be in: `.env.example` + SOPS `prod.enc.yaml` + `decrypt-secrets.sh` ENV_MAPPING + `env_validation.py` (if API).
+Skip if no new env vars introduced.
+
+For each new env var, verify present in ALL required locations:
+
+| Location | Required for |
+|----------|-------------|
+| `.env.example` | All new vars |
+| Secrets backend (see `deploy.secrets_backend`) | Secret vars — skip if backend is `none` or unset |
+| `app/env_validation.py` | API service vars (if project has one) |
+
+**Secrets backend check** *(trigger: `deploy.secrets_backend == "sops"`)*:
+
+If the project uses SOPS, verify the new var is present in all SOPS chain locations:
+- `infra/secrets/prod.enc.yaml` — SOPS-encrypted secret store
+- `infra/decrypt-secrets.sh` ENV_MAPPING — maps SOPS key to env var name
+
+If `deploy.secrets_backend` is absent or not `sops`, skip these checks and log:
+> `SKIP: SOPS chain check — deploy.secrets_backend is not "sops". Configure deploy.secrets_backend in forge.yaml to enable.`
 
 ### 3J: Commit
 Conventional prefix (fix/feat/refactor/docs). Reference #{NUMBER} in the commit message.

package/commands/work-on.md

@@ -747,25 +747,50 @@ if iteration == max_iterations AND not PASS:
 
 ### 3H: Format and verify
 
+All tool commands are read from `forge.yaml → verification.commands`. When a key is absent, the step logs `SKIPPED — not configured in verification.commands` and continues rather than silently passing.
+
 **Python**:
 ```bash
 cd {WORKTREE_PATH}
-black {PYTHON_FILES} && isort {PYTHON_FILES} && python -m py_compile {PYTHON_FILES}
+
+PYTHON_FORMAT=$(yq '.verification.commands.python.format // ""' forge.yaml 2>/dev/null || echo '')
+if [ -n "$PYTHON_FORMAT" ]; then
+    eval "$PYTHON_FORMAT" 2>&1
+else
+    echo "SKIPPED — python.format not configured in verification.commands"
+fi
+
+# Compile check always runs (no config needed — catches syntax errors)
+python -m py_compile {PYTHON_FILES}
 ```
 `py_compile` failures are BLOCKING.
 
-**TypeScript (primary repo — has tsconfig.json)**:
+**TypeScript**:
 ```bash
 cd {WORKTREE_PATH}
-prettier --write {TS_FILES} && tsc --noEmit
-```
-`tsc --noEmit` failures are BLOCKING.
 
-**TypeScript (satellite repos)**:
-```bash
-cd {WORKTREE_PATH}
-npm run build && prettier --write {TS_FILES}
+TS_FORMAT=$(yq '.verification.commands.typescript.format // ""' forge.yaml 2>/dev/null || echo '')
+TS_TYPECHECK=$(yq '.verification.commands.typescript.typecheck // ""' forge.yaml 2>/dev/null || echo '')
+TS_BUILD=$(yq '.verification.commands.typescript.build // ""' forge.yaml 2>/dev/null || echo '')
+
+if [ -n "$TS_FORMAT" ]; then
+    eval "$TS_FORMAT" 2>&1
+else
+    echo "SKIPPED — typescript.format not configured in verification.commands"
+fi
+
+if [ -n "$TS_TYPECHECK" ]; then
+    eval "$TS_TYPECHECK" 2>&1
+    TS_EXIT=$?
+elif [ -n "$TS_BUILD" ]; then
+    eval "$TS_BUILD" 2>&1 | tail -30
+    TS_EXIT=$?
+else
+    echo "SKIPPED — typescript.typecheck and typescript.build not configured in verification.commands"
+    TS_EXIT=0
+fi
 ```
+Typecheck or build failures are BLOCKING.
 
 ### 3I: Frontend proxy wiring check (MANDATORY)
 
@@ -791,27 +816,44 @@ Advisory only — does not block build. Check for lambda/callable in connect_arg
 
 Skip if no new env vars introduced.
 
+**Config variables used by this phase** (set in `forge.yaml`):
+- `{deploy.secrets_backend}` — secrets delivery method (`sops`, `aws-sm`, `vault`, `ci-env`, `none`). When absent or not `sops`, SOPS-specific checks below are skipped with an explicit log message.
+- `{verification.services[name].container}` — container name for post-deploy verification. Resolved by matching the service name; falls back to `{service}` (bare name) when not configured.
+
 For each new env var, verify present in ALL required locations:
 
 | Location | Required for |
 |----------|-------------|
 | `.env.example` | All new vars |
-| `infra/secrets/prod.enc.yaml` (SOPS) | Production secrets |
-| `infra/decrypt-secrets.sh` ENV_MAPPING | All vars in deploy chain |
-| `app/env_validation.py` | API service vars |
-| `docker-compose.prod.yml` | Vars needing explicit injection |
+| Secrets backend (see `deploy.secrets_backend`) | Secret vars — skip if backend is `none` or unset |
+| `app/env_validation.py` | API service vars (if project has one) |
+| `docker-compose.prod.yml` | Vars needing explicit injection (if project uses Docker Compose) |
 
-Deploy chain: SOPS → `decrypt-secrets.sh` (ENV_MAPPING) → `.env.secrets` → `merge-env-secrets.sh` → `.env.production` → docker-compose `env_file`.
+**Secrets backend check** *(trigger: `deploy.secrets_backend == "sops"`)*:
 
-**Operator-set var classification** *(trigger: new env var is NOT present in `infra/secrets/prod.enc.yaml`)*: <!-- Added: forge#380 -->
+If the project uses SOPS, verify the new var is present in all SOPS chain locations:
+- `infra/secrets/prod.enc.yaml` — SOPS-encrypted secret store
+- `infra/decrypt-secrets.sh` ENV_MAPPING — maps SOPS key to env var name
+- Deploy chain: SOPS → `decrypt-secrets.sh` (ENV_MAPPING) → `.env.secrets` → `merge-env-secrets.sh` → `.env.production` → docker-compose `env_file`
 
-Some env vars are operator-set (non-secret, not sourced from SOPS) — they must be manually added to `.env.production` on the production server. The SOPS deploy chain does not carry them. When a new env var has no entry in `prod.enc.yaml`, classify it as operator-set and add a **HARD BLOCKER** item to the Testing Checklist:
+If `deploy.secrets_backend` is absent or not `sops`, skip these checks and log:
+> `SKIP: SOPS chain check — deploy.secrets_backend is not "sops". Configure deploy.secrets_backend in forge.yaml to enable.`
+
+**Operator-set var classification** *(trigger: new env var is NOT in the configured secrets backend)*: <!-- Added: forge#380 -->
+
+Some env vars are operator-set (non-secret, not sourced from the secrets backend) — they must be manually added to the runtime environment on the production server. When a new env var has no entry in the secrets backend, classify it as operator-set and add a **HARD BLOCKER** item to the Testing Checklist.
+
+Resolve the container name for the verification command:
+1. Look up the service in `forge.yaml → verification.services[]` by name — use the `container` field if present.
+2. If no matching entry, fall back to the bare service name: `{service}` (no suffix).
 
 ```
-- [ ] HARD BLOCKER: Add {VAR_NAME} to .env.production on the production server.
-      This var is operator-set (not in SOPS) — it does NOT flow through the automated
-      deploy chain. It must be added manually before or after deploy.
-      Verify with: docker exec {service}-blue env | grep {VAR_NAME}
+- [ ] HARD BLOCKER: Add {VAR_NAME} to the runtime environment on the production server.
+      This var is operator-set — it does NOT flow through the automated secrets chain.
+      It must be added manually before or after deploy.
+      Verify with: docker exec {CONTAINER_NAME} env | grep {VAR_NAME}
+      (CONTAINER_NAME resolved from verification.services[{service}].container in forge.yaml,
+       or bare service name if not configured)
 ```
 
 **`env_file` re-read warning** *(trigger: any new env var added to `.env.production` path)*:
@@ -822,11 +864,13 @@ Add this warning to the Testing Checklist whenever a new env var is introduced (
 
 **Post-deploy in-container verification** *(trigger: any new env var)*:
 
-Add the following to the Testing Checklist so the deployer can confirm delivery after deploy:
+Add the following to the Testing Checklist so the deployer can confirm delivery after deploy.
+
+Resolve `{CONTAINER_NAME}` from `forge.yaml → verification.services[{service}].container`; use `{service}` (bare) if the field is absent.
 
 ```bash
 # Verify env var reached the running container (run post-deploy)
-docker exec {service}-blue env | grep {VAR_NAME}
+docker exec {CONTAINER_NAME} env | grep {VAR_NAME}
 # Expected: {VAR_NAME}={value}
 # If blank: container was not recreated — run: docker compose up --no-deps --force-recreate {service}
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgedock",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "GitHub as a knowledge graph for AI agents. Autonomous dev pipeline for Claude Code.",
   "bin": {
     "forgedock": "bin/forgedock.mjs"

package/scripts/verify-route-registration.sh

@@ -5,6 +5,18 @@
 #   changed_files_file: path to a file listing changed files (one per line)
 #   repo_root: path to the repository root
 #
+# Layout path overrides (env vars — override defaults for non-AlterLab layouts):
+#   FORGE_PAGES_ROOT          Root of Next.js App Router pages dir (default: web/src/app)
+#   FORGE_API_ROUTERS_DIR     Dir containing FastAPI router .py files (default: services/api/app/routers)
+#   FORGE_API_MAIN            Path to API app entrypoint, relative to repo root (default: services/api/app/main.py)
+#   FORGE_API_MIDDLEWARE_DIR  Dir containing API middleware .py files (default: services/api/app/middleware)
+#   FORGE_API_SERVICES_DIR    Root of the backend API service dir (default: services/api)
+#   FORGE_WORKER_DIR          Root of the background worker service dir (default: services/worker)
+#   FORGE_COMPONENTS_DIR      Root of shared frontend component library (default: web/src/components)
+#
+# Set these from forge.yaml review.layout fields before invoking, e.g.:
+#   export FORGE_PAGES_ROOT=$(yq '.review.layout.pages // "web/src/app"' forge.yaml)
+#
 # Output: Structured findings (one per line, prefixed with severity)
 #   BLOCKING: <message>  — must fix before merge
 #   WARNING:  <message>  — likely issue, verify manually
@@ -23,17 +35,39 @@ else
     FILES=$(cat "$CHANGED_FILES")
 fi
 
+# Layout path configuration — read from env vars, fall back to AlterLab defaults
+FORGE_PAGES_ROOT="${FORGE_PAGES_ROOT:-web/src/app}"
+FORGE_API_ROUTERS_DIR="${FORGE_API_ROUTERS_DIR:-services/api/app/routers}"
+FORGE_API_MAIN="${FORGE_API_MAIN:-services/api/app/main.py}"
+FORGE_API_MIDDLEWARE_DIR="${FORGE_API_MIDDLEWARE_DIR:-services/api/app/middleware}"
+FORGE_API_SERVICES_DIR="${FORGE_API_SERVICES_DIR:-services/api}"
+FORGE_WORKER_DIR="${FORGE_WORKER_DIR:-services/worker}"
+FORGE_COMPONENTS_DIR="${FORGE_COMPONENTS_DIR:-web/src/components}"
+
 BLOCKING=0
 WARNINGS=0
 
 # --- Next.js Route Handler registration check ---
 while read -r f; do
-    URL_PATH=$(echo "$f" | sed 's|^web/src/app||; s|/route\.ts$||; s|\[.*\]|*|g')
+    # Use shell parameter expansion instead of sed to avoid interpreting FORGE_PAGES_ROOT
+    # as a sed pattern (values containing | or other metacharacters break the substitution).
+    stripped="${f#${FORGE_PAGES_ROOT}/}"
+    stripped="${stripped%/route.ts}"
+    # Replace dynamic segments [param] with * using a loop (no regex needed)
+    URL_PATH=""
+    IFS='/' read -ra SEGMENTS <<< "$stripped"
+    for seg in "${SEGMENTS[@]}"; do
+        case "$seg" in
+            \[*\]) URL_PATH="${URL_PATH}/*" ;;
+            *)     URL_PATH="${URL_PATH}/${seg}" ;;
+        esac
+    done
     ROUTE_SEGMENT=$(echo "$URL_PATH" | sed 's|/api/v1/||; s|/.*||')
 
     # Check if next.config.js has a rewrite that might shadow this route
     if [ -f "$REPO_ROOT/web/next.config.js" ]; then
-        if grep -q "$ROUTE_SEGMENT" "$REPO_ROOT/web/next.config.js" 2>/dev/null; then
+        # Use -F (fixed string) so ROUTE_SEGMENT is not interpreted as a regex pattern
+        if grep -qF "$ROUTE_SEGMENT" "$REPO_ROOT/web/next.config.js" 2>/dev/null; then
             echo "WARNING: Route handler $f ($URL_PATH) — next.config.js references '$ROUTE_SEGMENT', may shadow this route"
             WARNINGS=$((WARNINGS + 1))
         else
@@ -43,55 +77,65 @@ while read -r f; do
 
     # Check if nginx routes this path to Next.js or directly to backend
     if [ -f "$REPO_ROOT/infra/nginx/nginx.conf" ]; then
-        if grep -q "location.*$ROUTE_SEGMENT" "$REPO_ROOT/infra/nginx/nginx.conf" 2>/dev/null; then
+        # Check for location blocks mentioning ROUTE_SEGMENT — use two -F searches to avoid
+        # embedding the variable in a regex: first find lines with "location", then filter
+        # for the literal segment. This avoids ROUTE_SEGMENT being interpreted as a BRE.
+        if grep -F "location" "$REPO_ROOT/infra/nginx/nginx.conf" 2>/dev/null | grep -qF "$ROUTE_SEGMENT"; then
             echo "WARNING: Route handler $f ($URL_PATH) — nginx.conf has a location block for '$ROUTE_SEGMENT', may bypass Next.js"
             WARNINGS=$((WARNINGS + 1))
         fi
     fi
-done < <(echo "$FILES" | grep -E "^web/src/app/api/.*route\.ts$") || true
+done < <(echo "$FILES" | while IFS= read -r line; do
+    case "$line" in
+        "${FORGE_PAGES_ROOT}/api/"*"route.ts") echo "$line" ;;
+    esac
+done) || true
 
 # --- Python API Router registration check ---
 while read -r f; do
     ROUTER_NAME=$(basename "$f" .py)
-    MAIN_PY="$REPO_ROOT/services/api/app/main.py"
+    MAIN_PY="$REPO_ROOT/${FORGE_API_MAIN}"
 
     if [ -f "$MAIN_PY" ]; then
-        if grep -q "$ROUTER_NAME" "$MAIN_PY" 2>/dev/null; then
-            echo "OK: API Router '$ROUTER_NAME' ($f) — registered in main.py"
+        # Use -F (fixed string) so ROUTER_NAME is not interpreted as a regex pattern
+        if grep -qF "$ROUTER_NAME" "$MAIN_PY" 2>/dev/null; then
+            echo "OK: API Router '$ROUTER_NAME' ($f) — registered in $(basename "$MAIN_PY")"
         else
-            echo "BLOCKING: API Router '$ROUTER_NAME' ($f) — NOT found in main.py. Router will not be reachable."
+            echo "BLOCKING: API Router '$ROUTER_NAME' ($f) — NOT found in $(basename "$MAIN_PY"). Router will not be reachable."
             BLOCKING=$((BLOCKING + 1))
         fi
     else
-        echo "WARNING: Cannot verify router registration — main.py not found at $MAIN_PY"
+        echo "WARNING: Cannot verify router registration — API main not found at $MAIN_PY"
         WARNINGS=$((WARNINGS + 1))
     fi
-done < <(echo "$FILES" | grep -E "^services/api/app/routers/.*\.py$") || true
+done < <(echo "$FILES" | grep -E "^${FORGE_API_ROUTERS_DIR}/.*\\.py$") || true
 
 # --- Python Middleware registration check ---
 while read -r f; do
     MIDDLEWARE_NAME=$(basename "$f" .py)
-    MAIN_PY="$REPO_ROOT/services/api/app/main.py"
+    MAIN_PY="$REPO_ROOT/${FORGE_API_MAIN}"
 
     if [ -f "$MAIN_PY" ]; then
-        if grep -q "$MIDDLEWARE_NAME" "$MAIN_PY" 2>/dev/null; then
-            echo "OK: Middleware '$MIDDLEWARE_NAME' ($f) — registered in main.py"
+        # Use -F (fixed string) so MIDDLEWARE_NAME is not interpreted as a regex pattern
+        if grep -qF "$MIDDLEWARE_NAME" "$MAIN_PY" 2>/dev/null; then
+            echo "OK: Middleware '$MIDDLEWARE_NAME' ($f) — registered in $(basename "$MAIN_PY")"
         else
-            echo "WARNING: Middleware '$MIDDLEWARE_NAME' ($f) — not found in main.py. May not be active."
+            echo "WARNING: Middleware '$MIDDLEWARE_NAME' ($f) — not found in $(basename "$MAIN_PY"). May not be active."
             WARNINGS=$((WARNINGS + 1))
         fi
     fi
-done < <(echo "$FILES" | grep -E "^services/api/app/middleware/.*\.py$") || true
+done < <(echo "$FILES" | grep -E "^${FORGE_API_MIDDLEWARE_DIR}/.*\\.py$") || true
 
 # --- Shared module import check ---
 while read -r f; do
     MODULE_NAME=$(basename "$f" .py)
 
-    IMPORTERS=$(grep -rl "$MODULE_NAME" "$REPO_ROOT/services/api/" "$REPO_ROOT/services/worker/" 2>/dev/null | head -5)
+    # Use -F (fixed string) so MODULE_NAME is not interpreted as a regex pattern
+    IMPORTERS=$(grep -rlF "$MODULE_NAME" "$REPO_ROOT/${FORGE_API_SERVICES_DIR}/" "$REPO_ROOT/${FORGE_WORKER_DIR}/" 2>/dev/null | head -5)
     if [ -n "$IMPORTERS" ]; then
         echo "OK: Shared module '$MODULE_NAME' ($f) — imported by services"
     else
-        echo "WARNING: Shared module '$MODULE_NAME' ($f) — no imports found in services/api/ or services/worker/"
+        echo "WARNING: Shared module '$MODULE_NAME' ($f) — no imports found in ${FORGE_API_SERVICES_DIR}/ or ${FORGE_WORKER_DIR}/"
         WARNINGS=$((WARNINGS + 1))
     fi
 done < <(echo "$FILES" | grep -E "^shared/.*\.py$") || true
@@ -100,14 +144,16 @@ done < <(echo "$FILES" | grep -E "^shared/.*\.py$") || true
 while read -r f; do
     COMPONENT_NAME=$(basename "$f" .tsx)
 
-    IMPORTERS=$(grep -rl "$COMPONENT_NAME" "$REPO_ROOT/web/src/app/" "$REPO_ROOT/web/src/components/" 2>/dev/null | grep -v "$f" | head -3)
+    # Use -F (fixed string) for both the component name search and the self-exclusion
+    # to prevent file paths and component names from being interpreted as regex patterns
+    IMPORTERS=$(grep -rlF "$COMPONENT_NAME" "$REPO_ROOT/${FORGE_PAGES_ROOT}/" "$REPO_ROOT/${FORGE_COMPONENTS_DIR}/" 2>/dev/null | grep -vF "$f" | head -3)
     if [ -n "$IMPORTERS" ]; then
         echo "OK: Component '$COMPONENT_NAME' ($f) — imported by other files"
     else
         echo "WARNING: Component '$COMPONENT_NAME' ($f) — no imports found. May be unused or new."
         WARNINGS=$((WARNINGS + 1))
     fi
-done < <(echo "$FILES" | grep -E "^web/src/components/.*\.tsx$") || true
+done < <(echo "$FILES" | grep -E "^${FORGE_COMPONENTS_DIR}/.*\\.tsx$") || true
 
 # --- Exit code ---
 if [ "$BLOCKING" -gt 0 ]; then

package/scripts/verify-sops-chain.sh

@@ -24,6 +24,24 @@ DIFF_INPUT="${1:--}"
 CHANGED_FILES_INPUT="${2:--}"
 REPO_ROOT="${3:-.}"
 
+# --- Secrets backend guard ---
+# This script only applies when the project uses SOPS as its secrets backend.
+# Read the configured backend from the FORGE_SECRETS_BACKEND env var (set by the
+# calling pipeline) or fall back to parsing forge.yaml in the repo root.
+#
+# If the backend is not "sops" (or is unset), exit 0 with a skip message.
+# This is a clean no-op — not a false-pass — so callers can distinguish
+# "SOPS configured and passed" from "SOPS not in use on this project".
+_SECRETS_BACKEND="${FORGE_SECRETS_BACKEND:-}"
+if [ -z "$_SECRETS_BACKEND" ] && [ -f "$REPO_ROOT/forge.yaml" ]; then
+    _SECRETS_BACKEND=$(grep -E '^\s*secrets_backend:' "$REPO_ROOT/forge.yaml" \
+        | head -1 | sed 's/.*secrets_backend:[[:space:]]*//' | tr -d '"' | tr -d "'" | xargs)
+fi
+if [ "$_SECRETS_BACKEND" != "sops" ]; then
+    echo "SKIP: verify-sops-chain — secrets_backend is '${_SECRETS_BACKEND:-none}' (not sops). Configure deploy.secrets_backend: sops in forge.yaml to enable SOPS chain verification."
+    exit 0
+fi
+
 if [ "$DIFF_INPUT" = "-" ]; then
     DIFF_CONTENT=$(cat)
 else
@@ -62,7 +80,9 @@ if [ -n "$NEW_MAPPINGS" ]; then
 
     # For each new mapping, verify the SOPS path structure exists
     # (We can't decrypt SOPS to verify values, but we can check the mapping format is valid)
-    echo "$NEW_MAPPINGS" | while IFS= read -r mapping; do
+    # Use process substitution instead of a pipe so WARNINGS increments persist in the parent shell.
+    # (echo ... | while read creates a subshell — counter changes are lost on subshell exit.)
+    while IFS= read -r mapping; do
         VAR_NAME=$(echo "$mapping" | grep -oE '^"[A-Z_]+"' | tr -d '"')
         SOPS_SECTION=$(echo "$mapping" | grep -oE '\("([a-z_]+)"' | head -1 | tr -d '("')
         SOPS_KEY=$(echo "$mapping" | grep -oE ', "([a-z_]+)"\)' | tr -d ', ")')
@@ -73,7 +93,7 @@ if [ -n "$NEW_MAPPINGS" ]; then
             echo "WARNING: Malformed ENV_MAPPING entry: $mapping"
             WARNINGS=$((WARNINGS + 1))
         fi
-    done
+    done < <(echo "$NEW_MAPPINGS")
 else
     echo "OK: No new ENV_MAPPING entries in diff"
 fi