forgedock 1.1.7 → 1.1.9

package/commands/ci-audit.md

@@ -30,7 +30,7 @@ This command is designed to be run:
 
 This is NOT a PR review — it does not approve or block. It creates issues for each CI gap found.
 
-**Agent model policy**: `model: "sonnet"` (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
+**Agent model policy**: `model: "{DEFAULT_MODEL}"` — resolved from forge.yaml `agents.default_model`, else "sonnet" (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
 **NEVER use plan mode (EnterPlanMode).**
 
 ---

package/commands/cleanup.md

@@ -50,7 +50,7 @@ All `{GH_REPO}`, `{GH_FLAG}`, `{REPO_PATH}`, `{STAGING_BRANCH}`, `{PROJECT_BOARD
 | `branches` | Prune worktrees and remote branches for merged PRs |
 | `milestones` | Report milestones with 0 open issues (advisory — never closes) |
 | `board` | Sync closed issues to Project board with correct terminal state |
-| `batch-p3` | Sweep: fold stale unbatched P3 review findings into domain-grouped batch issues |
+| `batch-p3` | Sweep: fold stale unbatched P3 review findings into surface-area-grouped batch issues (same file, then leaf directory) |
 | `all` | All of the above, in order |
 
 ---
@@ -68,6 +68,9 @@ gh issue list {GH_FLAG} --state closed --label "workflow:in-review" --limit 100
 echo "=== Stale workflow:building ==="
 gh issue list {GH_FLAG} --state closed --label "workflow:building" --limit 100 --json number,title --jq '.[] | "#\(.number) — \(.title)"'
 
+echo "=== Stale workflow:awaiting-merge ==="
+gh issue list {GH_FLAG} --state closed --label "workflow:awaiting-merge" --limit 100 --json number,title --jq '.[] | "#\(.number) — \(.title)"'
+
 echo "=== Stale workflow:investigating ==="
 gh issue list {GH_FLAG} --state closed --label "workflow:investigating" --limit 100 --json number,title --jq '.[] | "#\(.number) — \(.title)"'
 
@@ -79,11 +82,11 @@ gh issue list {GH_FLAG} --state closed --label "needs-validation" --limit 100 --
 
 For each closed issue with a stale intermediate label:
 
-**Stale `workflow:in-review`, `workflow:building`** — these were merged but label wasn't updated:
+**Stale `workflow:in-review`, `workflow:building`, `workflow:awaiting-merge`** — these were merged but label wasn't updated:
 ```bash
 for NUM in {stale_issue_numbers}; do
   gh issue edit $NUM {GH_FLAG} --add-label "workflow:merged"
-  gh issue edit $NUM {GH_FLAG} --remove-label "workflow:in-review,workflow:building,needs-validation" 2>/dev/null || true
+  gh issue edit $NUM {GH_FLAG} --remove-label "workflow:in-review,workflow:building,workflow:awaiting-merge,needs-validation" 2>/dev/null || true
 done
 ```
 
@@ -91,11 +94,58 @@ done
 - If it has `workflow:invalid` already → just remove `workflow:investigating`
 - If closed normally → add `workflow:merged`, remove `workflow:investigating`
 
-**Stale `needs-validation`** — remove from all closed issues:
+**Stale `needs-validation`** — backfill from FORGE:INVESTIGATOR verdict where available; strip-only for issues with no verdict comment: <!-- Added: forge#1730 -->
+
+This is the H1 backfill sweep from the Design Decision (#1730). For each closed finding-issue with `needs-validation`:
+1. Fetch any `FORGE:INVESTIGATOR` comment on the issue
+2. Extract the `**Verdict**: ...` line
+3. `CONFIRMED` → apply `validated` + remove `needs-validation`
+4. `NOT-CONFIRMED` / `INVALID` / `PARTIAL` → apply `false-positive` + remove `needs-validation`
+5. No verdict comment (or unrecognized verdict) → strip `needs-validation` only (no label added — do not guess)
+
+**H4 is forbidden**: Do NOT use file-overlap heuristics (whether a fix-PR touched the cited file) to infer validated/false-positive. H4 has ~10% error rate and poisons the corpus. If there is no FORGE:INVESTIGATOR comment, the issue goes to strip-only.
+
 ```bash
+BACKFILL_VALIDATED=0
+BACKFILL_FALSE_POSITIVE=0
+BACKFILL_STRIP_ONLY=0
+
 for NUM in {needs_validation_numbers}; do
-  gh issue edit $NUM {GH_FLAG} --remove-label "needs-validation" 2>/dev/null || true
+  # Fetch FORGE:INVESTIGATOR comment if any
+  INVESTIGATOR_COMMENT=$(gh api repos/{GH_REPO}/issues/$NUM/comments \
+    --jq '[.[] | select(.body | contains("FORGE:INVESTIGATOR"))] | last | .body // ""' 2>/dev/null || echo "")
+
+  if [ -n "$INVESTIGATOR_COMMENT" ]; then
+    # Extract verdict — matches "**Verdict**: CONFIRMED" etc.
+    VERDICT=$(echo "$INVESTIGATOR_COMMENT" | grep -oE '\*\*Verdict\*\*: [A-Za-z0-9_][A-Za-z0-9_-]*' | sed 's/^\*\*Verdict\*\*: //' | head -1)
+
+    case "$VERDICT" in
+      CONFIRMED)
+        gh issue edit $NUM {GH_FLAG} --add-label "validated" --remove-label "needs-validation" 2>/dev/null || true
+        echo "#$NUM: needs-validation → validated (verdict: CONFIRMED)"
+        BACKFILL_VALIDATED=$((BACKFILL_VALIDATED + 1))
+        ;;
+      NOT-CONFIRMED|INVALID|PARTIAL)
+        gh issue edit $NUM {GH_FLAG} --add-label "false-positive" --remove-label "needs-validation" 2>/dev/null || true
+        echo "#$NUM: needs-validation → false-positive (verdict: $VERDICT)"
+        BACKFILL_FALSE_POSITIVE=$((BACKFILL_FALSE_POSITIVE + 1))
+        ;;
+      *)
+        # Unrecognized or empty verdict — strip-only (no guessing)
+        gh issue edit $NUM {GH_FLAG} --remove-label "needs-validation" 2>/dev/null || true
+        echo "#$NUM: needs-validation stripped (no recognized verdict in INVESTIGATOR comment)"
+        BACKFILL_STRIP_ONLY=$((BACKFILL_STRIP_ONLY + 1))
+        ;;
+    esac
+  else
+    # No INVESTIGATOR comment — strip-only
+    gh issue edit $NUM {GH_FLAG} --remove-label "needs-validation" 2>/dev/null || true
+    echo "#$NUM: needs-validation stripped (no FORGE:INVESTIGATOR comment found)"
+    BACKFILL_STRIP_ONLY=$((BACKFILL_STRIP_ONLY + 1))
+  fi
 done
+
+echo "Backfill complete: validated=$BACKFILL_VALIDATED false-positive=$BACKFILL_FALSE_POSITIVE strip-only=$BACKFILL_STRIP_ONLY"
 ```
 
 ### 1C: Report closed issues with NO workflow label
@@ -176,7 +226,7 @@ For each orphaned issue found:
 ```bash
 gh issue close $NUM {GH_FLAG} --comment "Closed by cleanup — PR #$MERGED_PR was already merged."
 gh issue edit $NUM {GH_FLAG} --add-label "workflow:merged"
-gh issue edit $NUM {GH_FLAG} --remove-label "workflow:in-review" 2>/dev/null || true
+gh issue edit $NUM {GH_FLAG} --remove-label "workflow:in-review,workflow:awaiting-merge" 2>/dev/null || true
 ```
 
 Also check open issues with `workflow:building` — same pattern (search for merged PRs referencing them).
@@ -323,101 +373,132 @@ Do NOT call `gh api ... -X PATCH -f state=closed` on any milestone. This phase i
 ## Phase 4B: P3 Batch Sweep (if `batch-p3` or `all`)
 
 <!-- Added: forge#1333 -->
+<!-- Extended: forge#1828 — brought into lockstep with the P3 batching rule extension in orchestrate/phase-1-resolve.md and orchestrate/phase-4-execution.md (forge#1818): default-batchable eligibility, surface-area grouping, two-tier threshold, extended safety exclusions -->
 
-**Purpose**: Fold stale unbatched P3 review findings into domain-grouped batch issues. Reduces pipeline overhead from individual per-finding full-pipeline runs.
+**Purpose**: Fold stale unbatched P3 review findings into surface-area-grouped batch issues (same file first, leaf directory as broader fallback). Reduces pipeline overhead from individual per-finding full-pipeline runs. This sweep applies the same batching rule as `orchestrate/phase-1-resolve.md`'s "P3 Review-Finding Batching" section (the canonical definition) — this file is a periodic, cross-run pass over the same policy that Phase 1 (at `/orchestrate` start) and Phase 4C (mid-run cascade findings, `phase-4-execution.md`) already apply.
 
 **Skip if**: Input is not `batch-p3` and not `all`.
 
 ### Step 4B.1: Fetch open batchable P3 findings
 
+Eligibility is **default-batchable**: any open `review-finding` + `priority:P3` issue qualifies unless excluded below. The `<!-- FORGE:BATCHABLE -->` marker (still appended by `review-pr.md` at finding-creation time) is honored when present but is no longer required — matching `phase-1-resolve.md`'s eligibility rule. <!-- Changed: forge#1828 — marker was previously mandatory -->
+
 ```bash
-# Find all open P3 review findings that carry the FORGE:BATCHABLE annotation
-# and are not already members of a batch (no "batch" label)
+# Find all open, unbatched P3 review findings. Excludes findings already
+# claimed by a batch ("batch" label), and applies the same extended safety
+# exclusions (security, billing, anti-bot, auth) as the other two batching
+# sites, using the identical jq test() (Oniguruma) patterns so classification
+# cannot diverge between the three sweep locations. <!-- Changed: forge#1828 -->
 UNBATCHED_P3=$(gh issue list {GH_FLAG} \
   --state open \
   --label "review-finding,priority:P3" \
   --limit 500 \
   --json number,title,body,labels,createdAt \
-  --jq '.[] | select(.body | test("<!-- FORGE:BATCHABLE -->"))
-         | select(([.labels[].name] | any(. == "batch")) | not)
-         | select(([.labels[].name] | any(. == "security" or . == "billing")) | not)
-         | select((.title | test("security|billing|payment|stripe"; "i")) | not)')
+  --jq '.[] | select(([.labels[].name] | any(. == "batch")) | not)
+         | select((.title | test("security|billing|anti-bot|auth"; "i")) | not)
+         | select(.body | test("## Problem[\\s\\S]{0,500}(security|billing|anti-bot|auth)"; "i") | not)
+         | select(([.labels[].name] | any(. == "security" or . == "billing" or . == "anti-bot" or . == "auth")) | not)')
 
 echo "Unbatched batchable P3 findings: $(echo "$UNBATCHED_P3" | jq -s 'length')"
 ```
 
-### Step 4B.2: Group by domain
+### Step 4B.2: Group by surface area (same file, then leaf directory)
 
-For each finding, extract the domain from the first affected file path under `## Affected Files`:
+<!-- Changed: forge#1828 — was coarse domain grouping (`cut -d/ -f1,2,3`); now surface area, matching phase-1-resolve.md -->
 
-```bash
-# Domain = top-level directory of the first affected file
-# e.g., "services/api/auth/login.py" → "services/api/auth"
-#        "commands/review-pr.md"     → "commands"
-# Exclude findings where the domain contains "billing" or "security"
+For each finding, extract the exact affected-file path under `## Affected Files` (primary grouping key) and its leaf directory — `dirname` of that path — as a broader fallback key:
 
-# Group findings by domain, track oldest creation timestamp per group
-declare -A DOMAIN_ISSUES
-declare -A DOMAIN_OLDEST
+```bash
+# Surface area = the exact affected file path listed first under "## Affected
+# Files" (primary key). Leaf directory = dirname of that file (fallback key).
+# e.g., "commands/orchestrate/phase-1-resolve.md" → file "commands/orchestrate/phase-1-resolve.md", leaf-dir "commands/orchestrate"
+#        "commands/review-pr.md"                   → file "commands/review-pr.md", leaf-dir "commands"
+# (security/billing/anti-bot/auth paths are already excluded in Step 4B.1)
+
+# Group findings by file (primary) and by leaf directory (fallback), tracking
+# oldest creation timestamp per group
+declare -A FILE_ISSUES
+declare -A FILE_OLDEST
+declare -A DIR_ISSUES
+declare -A DIR_OLDEST
 
 echo "$UNBATCHED_P3" | jq -c '.[]' | while read -r issue; do
   NUM=$(echo "$issue" | jq -r '.number')
   CREATED=$(echo "$issue" | jq -r '.createdAt')
   BODY=$(echo "$issue" | jq -r '.body')
 
-  # Extract first affected file path from body
-  FIRST_FILE=$(echo "$BODY" | sed -n '/^## Affected Files/,/^## /p' | grep -oP '`[^`]+`' | head -1 | tr -d '`')
+  # Extract first affected file path from body. Uses POSIX ERE (`grep -oE`),
+  # NOT PCRE lookbehind (`grep -oP '(?<=...)'`) — the prior fallback line here
+  # used `-P`, which BSD grep on macOS does not support (forge#1767). This
+  # pattern matches the portable one already used in phase-4-execution.md's
+  # same-run surface-area batching. <!-- Changed: forge#1828 -->
+  FIRST_FILE=$(echo "$BODY" | sed -n '/^## Affected Files/,/^## /p' | grep -oE '`[^`]+`' | head -1 | tr -d '`')
   if [ -z "$FIRST_FILE" ]; then
-    FIRST_FILE=$(echo "$BODY" | grep -oP '(?<=\`)[^`]+\.(?:py|ts|tsx|js|go|rs|java|sh|md)(?=\`)' | head -1 || echo "unknown")
+    FIRST_FILE=$(echo "$BODY" | grep -oE '`[^`]+\.(py|tsx?|jsx?|sql|json|ya?ml|sh|md)`' | head -1 | tr -d '`')
   fi
-  DOMAIN=$(echo "$FIRST_FILE" | cut -d/ -f1,2,3 | sed 's|/[^/]*$||')
-  [ -z "$DOMAIN" ] && DOMAIN="general"
+  [ -z "$FIRST_FILE" ] && FIRST_FILE="unknown"
+  LEAF_DIR=$(dirname "$FIRST_FILE")
 
-  echo "${NUM}:${DOMAIN}:${CREATED}"
+  echo "${NUM}:${FIRST_FILE}:${LEAF_DIR}:${CREATED}"
 done
 ```
 
-### Step 4B.3: Apply batching threshold
+### Step 4B.3: Apply two-tier batching threshold
+
+<!-- Changed: forge#1828 — added lower same-file tier, matching phase-1-resolve.md's two-tier threshold -->
 
-For each domain group:
-- **Trigger**: 5+ unbatched batchable P3 findings in the domain, **OR** the oldest finding in the domain is > 72 hours old
-- **No trigger**: fewer than 5 findings AND none older than 72 hours → skip (no batch created)
+- **Same-file cluster** (primary, low threshold): **2+** unbatched batchable P3 findings share the exact same affected file → create a batch issue for that file cluster.
+- **Leaf-directory cluster** (broader fallback, existing threshold preserved): among findings NOT already claimed by a same-file cluster above, **5+** share the same leaf directory, **OR** the oldest finding in that leaf directory is > 72 hours old → create a batch issue for that leaf-directory cluster.
+- Form same-file clusters first; only findings left ungrouped after that pass are evaluated for leaf-directory clustering. A finding is claimed by at most one batch.
 
 ```bash
 NOW_EPOCH=$(date +%s)
 HOURS_72=$((72 * 3600))
+MAX_MEMBERS=8   # Changed: forge#1828 — was 10, matching phase-1-resolve.md's cap
+
+# Pass 1 — same-file clusters (2+ members). Claim member issue numbers into
+# CLAIMED_BY_FILE so Pass 2 (leaf-directory) skips them.
+CLAIMED_BY_FILE=""
+echo "$FILE_ISSUES" | while IFS=: read -r file issue_list; do
+  COUNT=$(echo "$issue_list" | tr ',' '\n' | grep -c .)
+  if [ "$COUNT" -ge 2 ]; then
+    echo "Batching $COUNT P3 findings — same-file cluster: ${file}"
+    # Create batch issue(s) in chunks of <= MAX_MEMBERS members (see Batch
+    # creation below). Record consumed issue numbers in CLAIMED_BY_FILE.
+  fi
+done
 
-# For each domain group that meets the threshold, create a batch issue
-# (max 10 members per batch — if more, create multiple batches of ≤ 10 each)
-
-# Exclude domains with "security" or "billing" in the domain path
-echo "$DOMAIN_ISSUES" | while IFS=: read -r domain issue_list; do
-  echo "$domain" | grep -qiE 'security|billing' && continue
+# Pass 2 — leaf-directory clusters (5+ members, or oldest > 72h), excluding
+# any issue already claimed by a same-file cluster in Pass 1
+echo "$DIR_ISSUES" | while IFS=: read -r dir issue_list; do
+  REMAINING=$(echo "$issue_list" | tr ',' '\n' | grep -vxF -f <(printf '%s\n' "$CLAIMED_BY_FILE" | tr ',' '\n') || true)
+  COUNT=$(echo "$REMAINING" | grep -c . || echo 0)
+  [ "$COUNT" -eq 0 ] && continue
 
-  COUNT=$(echo "$issue_list" | tr ',' '\n' | wc -l)
-  OLDEST_EPOCH=$(echo "$DOMAIN_OLDEST[$domain]" | date -d "$..." +%s 2>/dev/null || echo "$NOW_EPOCH")
+  OLDEST_EPOCH=$(echo "${DIR_OLDEST[$dir]}" | date -d "$..." +%s 2>/dev/null || echo "$NOW_EPOCH")
   AGE_SECS=$((NOW_EPOCH - OLDEST_EPOCH))
 
   if [ "$COUNT" -ge 5 ] || [ "$AGE_SECS" -ge "$HOURS_72" ]; then
-    echo "Batching $COUNT P3 findings in domain: ${domain}"
-    # Create batch issues (in chunks of ≤ 10)
-    # See orchestrate.md Phase 1 for the batch creation template
+    echo "Batching $COUNT P3 findings — leaf-directory cluster: ${dir}"
+    # Create batch issue(s) in chunks of <= MAX_MEMBERS members (see Batch
+    # creation below).
   fi
 done
 ```
 
-**Batch creation** uses the same template as `orchestrate.md Phase 1 → P3 Review-Finding Batching`. After creating the batch issue, add the `batch` label to each member issue to prevent re-batching on the next sweep.
+**Batch creation** uses the same template as `orchestrate.md Phase 1 → P3 Review-Finding Batching`, including its surface-area path sanitization (`tr -cd 'A-Za-z0-9._/-'` on the file/directory value before interpolating it into the batch issue's `--title`/`--body`). After creating the batch issue, add the `batch` label to each member issue to prevent re-batching on the next sweep.
 
 ### Step 4B.4: Report
 
 ```
 ## P3 Batch Sweep
 
-| Domain | Unbatched P3s | Threshold Met | Action |
-|--------|--------------|---------------|--------|
-| {domain} | {N} | ≥5 issues | Created batch #{NUM} ({M} members) |
-| {domain} | {N} | Oldest > 72h | Created batch #{NUM} ({M} members) |
-| {domain} | {N} | Below threshold | No action |
+| Surface Area | Unbatched P3s | Threshold Met | Action |
+|---------------|--------------|---------------|--------|
+| {file} | {N} | ≥2 same-file | Created batch #{NUM} ({M} members) |
+| {leaf-dir} | {N} | ≥5 issues | Created batch #{NUM} ({M} members) |
+| {leaf-dir} | {N} | Oldest > 72h | Created batch #{NUM} ({M} members) |
+| {leaf-dir} | {N} | Below threshold | No action |
 
 Total batch issues created: {N}
 Total P3 findings batched: {N}
@@ -465,7 +546,9 @@ fi
 | workflow:in-review → workflow:merged | {N} |
 | workflow:building → workflow:merged | {N} |
 | workflow:investigating → cleaned | {N} |
-| needs-validation removed | {N} |
+| needs-validation → validated (backfill H1) | {N} |
+| needs-validation → false-positive (backfill H1) | {N} |
+| needs-validation stripped (no verdict) | {N} |
 
 ### Stale-Open Intermediate Issues (Phase 1D)
 | Issue | Label | Last Update | Action |
@@ -501,8 +584,9 @@ fi
 {N} closed issues have no workflow label (closed outside pipeline — no action needed)
 
 ### P3 Batch Sweep Results
-| Domain | Unbatched P3s | Action |
-|--------|--------------|--------|
-| {domain} | {N} | Created batch #{NUM} with {M} members |
-| {domain} | {N} | Below threshold — no action (< 5 findings, none > 72h) |
+| Surface Area | Unbatched P3s | Action |
+|---------------|--------------|--------|
+| {file} | {N} | Created batch #{NUM} with {M} members (same-file, ≥2) |
+| {leaf-dir} | {N} | Created batch #{NUM} with {M} members (leaf-directory, ≥5 or >72h) |
+| {leaf-dir} | {N} | Below threshold — no action (< 5 findings, none > 72h, no same-file pair) |
 ```

package/commands/compat-audit.md

@@ -10,7 +10,7 @@ install: extras
 
 You are the ForgeDock compatibility auditor. Produce a point-in-time advisory report that shows whether the user's installed Claude Code version is current and which ForgeDock features may behave differently on their runtime. This command is **non-blocking** — it never aborts the session. All output is advisory.
 
-**Agent model policy**: `model: "sonnet"` (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
+**Agent model policy**: `model: "{DEFAULT_MODEL}"` — resolved from forge.yaml `agents.default_model`, else "sonnet" (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
 **NEVER use plan mode (EnterPlanMode).**
 
 ---

package/commands/deploy-info.md

@@ -16,7 +16,7 @@ install: extras
 
 You are the pipeline's deploy awareness layer. Before the user merges staging → main (triggering CI/CD deployment), this command shows exactly what's going out: which PRs, which issues, what changed, and what risks exist.
 
-**Agent model policy**: `model: "sonnet"` (standard tier). Fallback: `model: "opus"` if rate-limited. User can override with `--model <name>`. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
+**Agent model policy**: `model: "{DEFAULT_MODEL}"` — resolved from forge.yaml `agents.default_model`, else "sonnet" (standard tier). Fallback: `model: "opus"` if rate-limited. User can override with `--model <name>`. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
 
 **NEVER use plan mode (EnterPlanMode)** — it breaks execution context.
 

package/commands/deploy-pr.md

@@ -13,7 +13,7 @@ allowed-tools: Bash, Read, Grep, Glob, Skill
 **NEVER use plan mode (EnterPlanMode)** — it breaks execution context.
 **NEVER use the Agent tool** — deploy-pr dispatches sub-skills via `Skill(...)` only. The Agent tool bypasses the allowed-tools constraint and produces opaque output that cannot be structured into the deploy result.
 
-**Agent model policy**: `model: "sonnet"` (standard tier). Fallback: `model: "opus"` if rate-limited. User can override with `--model <name>`.
+**Agent model policy**: `model: "{DEFAULT_MODEL}"` — resolved from forge.yaml `agents.default_model`, else "sonnet" (standard tier). Fallback: `model: "opus"` if rate-limited. User can override with `--model <name>`.
 
 <!-- FORGE:SPEC_LOADED — deploy-pr.md loaded and active. Agent is bound by this spec. -->
 

package/commands/diagnose.md

@@ -10,7 +10,7 @@ install: extras
 
 **NEVER use plan mode (EnterPlanMode)** — it breaks execution context.
 
-**Agent model policy**: `model: "sonnet"` (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
+**Agent model policy**: `model: "{DEFAULT_MODEL}"` — resolved from forge.yaml `agents.default_model`, else "sonnet" (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
 
 You are the pipeline's diagnostic layer. Given a single GitHub issue number, you reconstruct the full FORGE annotation chain for that pipeline run, identify the exact failure point, and suggest specific remediation steps. This command is **read-only** — it never mutates GitHub state.
 

package/commands/explain.md

@@ -10,7 +10,7 @@ install: extras
 
 You translate the FORGE pipeline's machine-readable annotations on a GitHub issue or PR into a clear, plain-English narrative that anyone can understand — no pipeline knowledge required. This is a read-only command: it never writes to GitHub, never changes labels, and never modifies any state.
 
-**Agent model policy**: `model: "sonnet"` (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
+**Agent model policy**: `model: "{DEFAULT_MODEL}"` — resolved from forge.yaml `agents.default_model`, else "sonnet" (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
 **NEVER use plan mode (EnterPlanMode).**
 
 ---

package/commands/fix-ci.md

@@ -13,7 +13,7 @@ argument-hint: <PR number or URL> [--max-attempts N] [--repo owner/repo]
 
 **Output**: Structured result — `{ pr, status, attempts, fixes_applied }` — printed to stdout and available to the calling skill.
 
-**Agent model policy**: `model: "sonnet"` (standard tier). Fallback: `model: "opus"` if rate-limited. User can override with `--model <name>`. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
+**Agent model policy**: `model: "{DEFAULT_MODEL}"` — resolved from forge.yaml `agents.default_model`, else "sonnet" (standard tier). Fallback: `model: "opus"` if rate-limited. User can override with `--model <name>`. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
 **NEVER use plan mode (EnterPlanMode).**
 **NEVER force-push or amend commits** — always create new commits.
 

package/commands/forgedock-init.md

@@ -11,7 +11,7 @@ argument-hint: [--preserve | --interactive | --section <name>]
 
 You complete the `forge.yaml` configuration that `npx forgedock init` started. The CLI generates required sections (project, paths, branches) from auto-detection. Your job is to scan the codebase, query GitHub APIs, and produce a complete `forge.yaml` with every applicable optional section filled — using detected values directly, without asking for confirmation.
 
-**Agent model policy**: `model: "sonnet"` (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
+**Agent model policy**: `model: "{DEFAULT_MODEL}"` — resolved from forge.yaml `agents.default_model`, else "sonnet" (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
 **NEVER use plan mode (EnterPlanMode).**
 
 ---

package/commands/incident-response.md

@@ -16,7 +16,7 @@ install: extras
 
 You are the pipeline's incident response coordinator. When production goes down or a critical bug surfaces, this command orchestrates the response: validates the hotfix before deploy, reconstructs the incident timeline, and produces a post-incident analysis.
 
-**Agent model policy**: `model: "sonnet"` (standard tier). Fallback: `model: "opus"` if rate-limited. User can override with `--model <name>`. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
+**Agent model policy**: `model: "{DEFAULT_MODEL}"` — resolved from forge.yaml `agents.default_model`, else "sonnet" (standard tier). Fallback: `model: "opus"` if rate-limited. User can override with `--model <name>`. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
 
 **NEVER use plan mode (EnterPlanMode)** — it breaks execution context.
 
@@ -109,7 +109,7 @@ gh api repos/{owner}/{repo}/issues/{NUMBER}/comments \
 Spawn a validation agent to check the proposed fix:
 
 ```
-Agent(model="sonnet", prompt="
+Agent(model="{SUBAGENT_MODEL}", prompt="
 You are validating a hotfix for a P0 production incident.
 
 Issue: #{NUMBER} — {TITLE}
@@ -242,7 +242,7 @@ gh pr list --state merged --base main --json number,title,mergedAt \
 Spawn an investigation agent:
 
 ```
-Agent(model="sonnet", prompt="
+Agent(model="{SUBAGENT_MODEL}", prompt="
 You are conducting a post-incident root cause analysis.
 
 Incident: #{NUMBER} — {TITLE}

package/commands/issue.md

@@ -11,7 +11,7 @@ argument-hint: [description of the problem or feature]
 
 You create GitHub issues with the exact structure the `/work-on` pipeline expects. Every issue you create must give the investigation agent enough context to find the right files on the first pass — no vague descriptions, no missing domains, no ambiguous scope.
 
-**Agent model policy**: `model: "sonnet"` (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
+**Agent model policy**: `model: "{DEFAULT_MODEL}"` — resolved from forge.yaml `agents.default_model`, else "sonnet" (standard tier). Fallback: `model: "opus"` if rate-limited. Feature gate: pass `effort` in Task/Skill spawns only on Claude Code >= 2.1.154.
 **NEVER use plan mode (EnterPlanMode).**
 
 ---