forgedock 1.10.3 → 1.11.0

package/scripts/check-spec-bash.sh

@@ -12,7 +12,19 @@
 #
 # Usage:
 #   check-spec-bash.sh [--base <git-ref>] [--shellcheck] <file.md>...
+#   check-spec-bash.sh --positional [<file.md>...]
+#   check-spec-bash.sh            (no args: same as --positional over all Skill-loaded commands/**/*.md,
+#                                  excluding orchestrate/**, pipeline-health/**, review-pr-agents/**)
 #
+#   --positional  Different check, opt-in: fail on any `$0`..`$9` inside a fenced code block.
+#                 Claude Code rewrites those tokens with the invocation's arguments whenever a
+#                 spec is loaded via Skill/slash command WITH args (awk `{print $2}` silently
+#                 becomes `{print --issue}`). Use `${1}` in shell and `$(1)` in awk instead;
+#                 `${N}`, `$(N)`, `$NF`, `$@`, `$#` and `$10`+ are not substituted. Suppress a
+#                 deliberate hit by putting `allowlist:positional-arg` on the same line.
+#                 Scope the file list to Skill-loaded specs (Read-loaded orchestrate/**,
+#                 pipeline-health/** and the review-pr-agents catalog are not substituted).
+#                 Output: `FAIL <file>:<line> positional arg ...` then `SPEC-POSITIONAL: ...`.
 #   --base <ref>   Only check blocks that contain a line changed relative to <ref>
 #                  (`git diff -U0 <ref> -- <file>`), so pre-existing blocks never fail
 #                  a new change. Without --base every block is checked.
@@ -33,20 +45,51 @@
 
 set -u
 
-BASE=""; SHELLCHECK=0; FILES=""
-usage() { echo "ERROR: Usage: check-spec-bash.sh [--base <git-ref>] [--shellcheck] <file.md>..." >&2; exit 2; }
+BASE=""; SHELLCHECK=0; POSITIONAL=0; FILES=""
+usage() { echo "ERROR: Usage: check-spec-bash.sh [--base <git-ref>] [--shellcheck] <file.md>... | --positional [<file.md>...]" >&2; exit 2; }
 
 while [ "$#" -gt 0 ]; do
   case "$1" in
     --base) [ "$#" -ge 2 ] || usage; BASE="$2"; shift 2 ;;
     --shellcheck) SHELLCHECK=1; shift ;;
+    --positional) POSITIONAL=1; shift ;;
     --*) usage ;;
     *) FILES="$FILES
 $1"; shift ;;
   esac
 done
+
+# No file arguments: default to the --positional check over every Skill-loaded spec under commands/
+# (orchestrate/**, pipeline-health/** and the review-pr-agents catalog are Read-loaded, not substituted).
+# Resolved relative to this script, so it works from any cwd and from linked worktrees.
+if [ -z "$FILES" ] && { [ "$#" -eq 0 ] && [ "$POSITIONAL" = 0 ] && [ -z "$BASE" ] && [ "$SHELLCHECK" = 0 ] || [ "$POSITIONAL" = 1 ]; }; then
+  POSITIONAL=1
+  cd "$(dirname "$0")/.." || exit 2
+  FILES=$(find commands -name '*.md' -not -path 'commands/orchestrate/*' \
+    -not -path 'commands/pipeline-health/*' -not -path 'commands/review-pr-agents/*' | LC_ALL=C sort)
+fi
 [ -n "$FILES" ] || usage
 
+if [ "$POSITIONAL" = 1 ]; then
+  pfail=0; pfiles=0
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    case "$f" in *.md) ;; *) continue ;; esac
+    [ -f "$f" ] || { echo "SKIP $f missing"; continue; }
+    pfiles=$((pfiles + 1))
+    hits=$(awk -v f="$f" '
+      /^[ \t]*```/ { inb = !inb; next }
+      inb && /\$[0-9]([^0-9]|$)/ && !/allowlist:positional-arg/ { print "FAIL " f ":" NR " positional arg ($0-$9) in fenced block: " $0 }
+    ' "$f")
+    if [ -n "$hits" ]; then printf '%s\n' "$hits"; pfail=$((pfail + $(printf '%s\n' "$hits" | wc -l))); fi
+  done <<EOP
+$FILES
+EOP
+  echo "SPEC-POSITIONAL: files=$pfiles violations=$pfail"
+  [ "$pfail" -eq 0 ]
+  exit $?
+fi
+
 TMPD=$(mktemp -d "${TMPDIR:-/tmp}/check-spec-bash.XXXXXX") || exit 2
 trap 'rm -rf "$TMPD"' EXIT
 

package/scripts/check-spec-bash.test.sh

@@ -70,7 +70,9 @@ check 0 "SKIP allow.md:2 allowlisted"   "allowlisted fragment skipped"         -
 check 0 "checked=0 failed=0"            "non-bash fence ignored"               -- notbash.md
 check 1 "FAIL prose-mention.md:2"      "prose mention of the marker does not allowlist" -- prose-mention.md
 check 1 "checked=2 failed=1 skipped=1"  "multi-file summary"                   -- good.md bad.md pseudo.md
-check 2 ""                              "no files is a usage error"            --
+check 0 "SPEC-POSITIONAL: files="       "no args defaults to --positional over commands/" --
+check 0 "SPEC-POSITIONAL: files="       "--positional with no files uses the default set" -- --positional
+check 2 ""                              "--shellcheck alone is a usage error"  -- --shellcheck
 check 2 ""                              "unknown flag"                         -- --bogus good.md
 
 # --base: only blocks touching changed lines are checked, so pre-existing breakage never fails a change.
@@ -86,5 +88,26 @@ ${FENCE}
 EOF
 check 1 "FAIL good.md:"                 "--base: newly added broken block fails" -- --base HEAD good.md
 
+# --positional: $0-$9 inside fences are flagged; ${N}, $(N), $NF, prose and allowlisted lines are not.
+cat > "$T/pos-bad.md" <<EOF
+${FENCE}bash
+X=\$(echo a b | awk '{print \$2}')
+local a="\$1"
+${FENCE}
+EOF
+cat > "$T/pos-good.md" <<EOF
+Prose mentions \$1 and \$2 freely.
+${FENCE}bash
+X=\$(echo a b | awk '{print \$(2) \$NF}')
+local a="\${1}" b="\$@" n="\$#"
+echo \$10
+y=\$1 # allowlist:positional-arg
+${FENCE}
+EOF
+check 1 "FAIL pos-bad.md:2"             "--positional flags awk \$2"            -- --positional pos-bad.md
+check 1 "FAIL pos-bad.md:3"             "--positional flags shell \$1"          -- --positional pos-bad.md
+check 1 "violations=2"                  "--positional counts violations"       -- --positional pos-bad.md
+check 0 "violations=0"                  "--positional passes safe forms, prose, allowlist" -- --positional pos-good.md
+
 echo "check-spec-bash.test.sh: passed=$pass failed=$fail"
 [ "$fail" -eq 0 ]

package/scripts/check-spec-markers.sh

@@ -105,6 +105,7 @@ MARKER_REGISTRY="
   DECOMPOSED
   DECOMPOSE_BLOCKED
   DESIGN
+  DIFF_SIZE
   DISPATCH
   DISPATCHER
   DOSSIER_UPDATED
@@ -157,6 +158,7 @@ MARKER_REGISTRY="
   RECOVERY_CLAIM_RELEASED
   REMEDIATION
   REREVIEW_DISPATCHED
+  REREVIEW_RELEASED
   REREVIEW_SKIPPED
   REVIEW
   REVIEWER
@@ -165,6 +167,7 @@ MARKER_REGISTRY="
   SECURITY_AUDIT
   SIGNAL_RESOLVED
   SIGNAL_UNRESOLVED
+  SIZE_OVERRIDE
   SPAWN_POLICY
   SPEC_DOCTOR_COMPLETE
   SPEC_LOADED
@@ -361,6 +364,56 @@ if [ -f "$P4_SPEC" ]; then
   fi
 fi
 
+# ---------------------------------------------------------------------------
+# Router claim pre-check must classify the existing/winning claim's lease (forge#3431)
+# ---------------------------------------------------------------------------
+
+WORKON_SPEC="$COMMANDS_DIR/work-on.md"
+if [ -f "$WORKON_SPEC" ]; then
+  # Scope: the "Claim pre-check" paragraph only, from its "**Claim pre-check" line up to the line before
+  # "**Terminal fallback". Full-line HTML comments are skipped, then each numbered step (N. ...) is collapsed
+  # to one whitespace-normalised line tagged "STEP<N>:" so tokens in other steps, the Terminal fallback
+  # paragraph, or comments cannot satisfy another step's assertion.
+  PRECHECK_STEPS=$(awk '
+    /^\*\*Terminal fallback/ { inpre = 0 }
+    /^\*\*Claim pre-check/ { inpre = 1; next }
+    inpre {
+      line = $0
+      if (line ~ /^[[:space:]]*<!--.*-->[[:space:]]*$/) next
+      gsub(/<!--[^>]*-->/, "", line)
+      if (match(line, /^[0-9]+\. /)) {
+        n = substr(line, 1, RLENGTH - 2)
+        cur = n
+        steps[cur] = "STEP" n ": " substr(line, RLENGTH + 1)
+        next
+      }
+      if (line ~ /^Only after the read-back/) { cur = ""; next }
+      if (cur != "") steps[cur] = steps[cur] " " line
+    }
+    END { for (k in steps) print steps[k] }
+  ' "$WORKON_SPEC" | tr -s '[:space:]' ' ' | sed 's/ STEP/\nSTEP/g' || true)
+  # WIRE:PROVEN: manual mutation in a temp copy of commands/work-on.md: removing `STALE` from step 4 only fired step 4, removing it from step 2 only fired step 2, tokens only in an HTML comment or only in the Terminal fallback paragraph still fired, a router-local REREVIEW_LEASE_SECS= or rereview_lease_state fired, clean tree passes
+  for STEP_N in 2 4; do
+    STEP_TXT=$(printf '%s\n' "$PRECHECK_STEPS" | grep "^STEP${STEP_N}:" || true)
+    if [ -z "$STEP_TXT" ] \
+       || [[ "$STEP_TXT" != *STALE* ]] \
+       || [[ "$STEP_TXT" != *phase-4-execution.md* ]] \
+       || [[ "$STEP_TXT" != *fallback* ]]; then
+      echo "HIGH | $WORKON_SPEC | claim pre-check step $STEP_N does not route STALE to the terminal fallback via the shared phase-4-execution.md Step 1 classification" >&2
+      VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+  done
+  # The router must reference the orchestrator's single lease definition, never redefine it.
+  if grep -qE '^[[:space:]]*REREVIEW_LEASE_SECS=' "$WORKON_SPEC"; then
+    echo "HIGH | $WORKON_SPEC | router redefines REREVIEW_LEASE_SECS (single definition lives in phase-4-execution.md Step 1)" >&2
+    VIOLATIONS=$((VIOLATIONS + 1))
+  fi
+  if grep -rq 'rereview_lease_state' "$COMMANDS_DIR" 2>/dev/null; then
+    echo "HIGH | $COMMANDS_DIR | competing lease helper rereview_lease_state reintroduced (router must reuse the shared Step 1 classification)" >&2
+    VIOLATIONS=$((VIOLATIONS + 1))
+  fi
+fi
+
 # ---------------------------------------------------------------------------
 # Summary
 # ---------------------------------------------------------------------------

package/scripts/diff-size.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# diff-size.sh — the ONE measurement of a build's diff size for the build phase size gate (forge#3450).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Usage: diff-size.sh --repo-path P --base B [--threshold N] [--exclude-glob G]...
+#   Measures lines changed (added + deleted) by the index plus any earlier commits against the MERGE BASE of
+#   HEAD and origin/B (git diff --cached --numstat --no-renames $(git merge-base HEAD origin/B)), so commits that
+#   landed on the base after the branch point are never counted as this build's changes. Exit 2 when the merge
+#   base cannot be computed. It must run AFTER implement staged its changes
+#   and BEFORE validate commits. Unstaged or untracked files are not measured. Binary files count 0.
+#   Files matching the built-in default globs or any --exclude-glob are excluded (additive).
+#   Glob rules: a configured (--exclude-glob) glob ending in "/" matches that directory at any depth; any other
+#   glob is a bash case pattern matched against the basename and the full path. The built-in directory defaults
+#   build/ dist/ generated/ fixtures/ vendor/ are anchored to the repo root (so first-party dirs such as
+#   commands/work-on/build/ are counted); __generated__/ and __snapshots__/ match at any depth.
+#   Globs are data, never evaluated.
+# Default globs (mirrored in docs/CONFIG.md under build.diff_size.exclude_globs):
+#   lockfiles (package-lock.json yarn.lock pnpm-lock.yaml Cargo.lock poetry.lock uv.lock go.sum Gemfile.lock
+#   composer.lock), *.min.*, *.snap, root-anchored dist/ build/ generated/ fixtures/ vendor/, any-depth
+#   __generated__/ __snapshots__/
+# Output (stdout, key=value lines): diff_lines=N excluded_lines=M threshold=T over=true|false, then up to 10
+#   "top=<lines> <path>" lines, largest first. threshold 0 disables the gate (over=false always).
+# Exit: 0 measured (even when over); 2 usage or git failure with EMPTY stdout (fail closed: unknown is not zero).
+
+set -euo pipefail
+
+REPO_PATH=""; BASE=""; THRESHOLD="1000"; EXTRA=()
+die() { echo "diff-size.sh: $*" >&2; exit 2; }
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --repo-path) [ $# -ge 2 ] || die "missing value for $1"; REPO_PATH="$2"; shift 2 ;;
+    --base) [ $# -ge 2 ] || die "missing value for $1"; BASE="$2"; shift 2 ;;
+    --threshold) [ $# -ge 2 ] || die "missing value for $1"; THRESHOLD="$2"; shift 2 ;;
+    --exclude-glob) [ $# -ge 2 ] || die "missing value for $1"; [ -z "$2" ] || EXTRA+=("$2"); shift 2 ;;
+    *) die "unknown argument: $1" ;;
+  esac
+done
+[ -n "$REPO_PATH" ] && [ -d "$REPO_PATH" ] || die "--repo-path must be an existing directory"
+[ -n "$BASE" ] || die "--base is required"
+case "$THRESHOLD" in ""|*[!0-9]*) die "--threshold must be a non-negative integer" ;; esac
+
+DEFAULTS=(package-lock.json yarn.lock pnpm-lock.yaml Cargo.lock poetry.lock uv.lock go.sum Gemfile.lock composer.lock
+  '*.min.*' '*.snap' __generated__/ __snapshots__/)
+ROOT_DIRS=(dist/ build/ generated/ fixtures/ vendor/)
+GLOBS=("${DEFAULTS[@]}" ${EXTRA[@]+"${EXTRA[@]}"})
+
+excluded() { # path -> 0 when excluded
+  local p="$1" b="${1##*/}" g
+  for g in "${ROOT_DIRS[@]}"; do case "$p" in "$g"*) return 0 ;; esac; done
+  for g in "${GLOBS[@]}"; do
+    case "$g" in
+      */) case "/$p" in *"/$g"*) return 0 ;; esac ;;
+      *) case "$b" in $g) return 0 ;; esac; case "$p" in $g) return 0 ;; esac ;;
+    esac
+  done
+  return 1
+}
+
+MB="$(git -C "$REPO_PATH" merge-base HEAD "origin/$BASE" 2>/dev/null)" && [ -n "$MB" ] \
+  || die "cannot compute merge base of HEAD and origin/$BASE"
+RAW="$(git -C "$REPO_PATH" diff --cached --numstat --no-renames -z "$MB" -- | tr '\0' '\001')" \
+  || die "git diff against merge base $MB failed"
+
+TOTAL=0; EXCL=0; LIST=""
+# -z numstat records are "added<TAB>deleted<TAB>path" separated by NUL (translated to \001 above).
+while IFS= read -r -d $'\001' rec; do
+  [ -n "$rec" ] || continue
+  a="${rec%%$'\t'*}"; rest="${rec#*$'\t'}"; d="${rest%%$'\t'*}"; path="${rest#*$'\t'}"
+  case "$a" in ''|*[!0-9]*) a=0 ;; esac
+  case "$d" in ''|*[!0-9]*) d=0 ;; esac
+  n=$((a + d))
+  if excluded "$path"; then EXCL=$((EXCL + n)); else TOTAL=$((TOTAL + n)); LIST="${LIST}${n} ${path}"$'\n'; fi
+done <<< "$RAW"
+
+OVER=false
+if [ "$THRESHOLD" -gt 0 ] && [ "$TOTAL" -gt "$THRESHOLD" ]; then OVER=true; fi
+echo "diff_lines=$TOTAL"
+echo "excluded_lines=$EXCL"
+echo "threshold=$THRESHOLD"
+echo "over=$OVER"
+if [ -n "$LIST" ]; then
+  printf '%s' "$LIST" | sort -t' ' -k1,1nr | head -n 10 | sed 's/^/top=/' || true
+fi

package/scripts/diff-size.test.sh

@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+# diff-size.test.sh — cases for scripts/diff-size.sh (forge#3450).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+set -uo pipefail
+S="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/diff-size.sh"
+PASS=0; FAILN=0
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+ok() { PASS=$((PASS+1)); }
+bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
+
+# Fixture: a bare "origin" plus a clone on a feature branch.
+git init -q --bare "$TMP/origin.git"
+git clone -q "$TMP/origin.git" "$TMP/w" 2>/dev/null
+cd "$TMP/w" || exit 1
+git config user.email t@example.com; git config user.name t
+echo base > README.md
+git add README.md; git commit -qm base; git branch -M staging; git push -q origin staging 2>/dev/null
+git checkout -q -b feat
+
+gen() { awk -v n="$1" 'BEGIN{for(i=0;i<n;i++) print "line " i}'; }
+reset() { git reset -q --hard origin/staging; git clean -qfd; }
+run() { bash "$S" --repo-path "$TMP/w" --base staging "$@"; }
+val() { printf '%s\n' "$1" | sed -n "s/^$2=//p" | head -n1; }
+check() { # name out key want
+  local got; got="$(val "$2" "$3")"
+  if [ "$got" = "$4" ]; then ok; else bad "$1 ($3=$got want $4)"; fi
+}
+
+# empty diff
+OUT="$(run)"; check "empty diff lines" "$OUT" diff_lines 0; check "empty diff over" "$OUT" over false
+
+# under threshold
+reset; gen 10 > a.txt; git add a.txt
+OUT="$(run --threshold 100)"; check "under lines" "$OUT" diff_lines 10; check "under over" "$OUT" over false
+
+# over threshold, exit 0 even when over
+reset; gen 150 > a.txt; git add a.txt
+OUT="$(run --threshold 100)"; rc=$?
+[ "$rc" = 0 ] && ok || bad "over exits 0 (rc=$rc)"
+check "over lines" "$OUT" diff_lines 150; check "over flag" "$OUT" over true
+
+# exactly at threshold is not over
+OUT="$(run --threshold 150)"; check "at threshold" "$OUT" over false
+
+# threshold 0 disables
+OUT="$(run --threshold 0)"; check "threshold 0 disables" "$OUT" over false
+
+# default exclusions: lockfile, min, snap, root dist/, any-depth __snapshots__/
+reset; gen 5 > a.txt
+gen 500 > package-lock.json; gen 500 > app.min.js; gen 500 > x.snap
+mkdir -p dist pkg/__snapshots__/deep; gen 500 > dist/out.js; gen 500 > pkg/__snapshots__/deep/f.json
+git add -A
+OUT="$(run --threshold 100)"
+check "defaults diff_lines" "$OUT" diff_lines 5; check "defaults excluded" "$OUT" excluded_lines 2500; check "defaults over" "$OUT" over false
+
+# SEC-2: built-in directory defaults are root-anchored; first-party nested dirs are counted
+reset; mkdir -p commands/work-on/build pkg/vendor pkg/fixtures; gen 300 > commands/work-on/build/a.md
+gen 200 > pkg/vendor/v.js; gen 100 > pkg/fixtures/f.json; mkdir -p build; gen 50 > build/root.js; git add -A
+OUT="$(run --threshold 100)"
+check "nested defaults counted" "$OUT" diff_lines 600; check "root build excluded" "$OUT" excluded_lines 50; check "nested defaults over" "$OUT" over true
+
+
+# a directory glob is not a substring match (distribution/ is not dist/)
+reset; mkdir -p distribution; gen 30 > distribution/a.txt; git add -A
+OUT="$(run --threshold 100)"; check "dist is not substring" "$OUT" diff_lines 30
+
+# extra glob is additive
+reset; gen 40 > keep.txt; mkdir -p docs/gen; gen 400 > docs/gen/big.md; git add -A
+OUT="$(run --threshold 100 --exclude-glob 'docs/gen/*')"
+check "extra glob lines" "$OUT" diff_lines 40; check "extra glob excluded" "$OUT" excluded_lines 400
+OUT="$(run --threshold 100 --exclude-glob 'docs/gen/*' --exclude-glob '*.txt')"
+check "two extra globs" "$OUT" diff_lines 0
+
+# glob is data, not evaluated
+reset; gen 10 > a.txt; git add -A
+OUT="$(run --exclude-glob '$(touch '"$TMP"'/pwned)' 2>/dev/null)"
+[ ! -e "$TMP/pwned" ] && ok || bad "glob evaluated as code"
+
+# binary file counts 0
+reset; head -c 2000 /dev/urandom > b.bin; gen 7 > a.txt; git add -A
+OUT="$(run)"; check "binary counts 0" "$OUT" diff_lines 7
+
+# deletions and renames count both sides (--no-renames)
+reset; gen 20 > r.txt; git add -A; git commit -qm r; git push -q origin feat:staging 2>/dev/null
+git mv r.txt r2.txt; OUT="$(run)"; check "rename counts add+delete" "$OUT" diff_lines 40
+git reset -q --hard origin/staging
+
+# committed + staged are both measured
+reset; gen 10 > c1.txt; git add -A; git commit -qm c1; gen 5 > c2.txt; git add -A
+OUT="$(run)"; check "committed + staged" "$OUT" diff_lines 15
+
+# top files, largest first
+reset; gen 3 > s.txt; gen 9 > l.txt; git add -A
+OUT="$(run)"; FIRST="$(printf '%s\n' "$OUT" | sed -n 's/^top=//p' | head -n1)"
+[ "$FIRST" = "9 l.txt" ] && ok || bad "top ordering (got '$FIRST')"
+
+# fail closed: bad repo path, bad base, bad threshold, unknown arg, missing base
+OUT="$(bash "$S" --repo-path "$TMP/nope" --base staging 2>/dev/null)"; rc=$?
+{ [ "$rc" = 2 ] && [ -z "$OUT" ]; } && ok || bad "bad repo path (rc=$rc out='$OUT')"
+OUT="$(run2() { bash "$S" --repo-path "$TMP/w" --base nonexistent 2>/dev/null; }; run2)"; rc=$?
+{ [ "$rc" = 2 ] && [ -z "$OUT" ]; } && ok || bad "bad base (rc=$rc out='$OUT')"
+OUT="$(bash "$S" --repo-path "$TMP/w" --base staging --threshold abc 2>/dev/null)"; rc=$?
+{ [ "$rc" = 2 ] && [ -z "$OUT" ]; } && ok || bad "bad threshold (rc=$rc)"
+OUT="$(bash "$S" --repo-path "$TMP/w" --bogus 2>/dev/null)"; rc=$?
+{ [ "$rc" = 2 ] && [ -z "$OUT" ]; } && ok || bad "unknown arg (rc=$rc)"
+OUT="$(bash "$S" --repo-path "$TMP/w" 2>/dev/null)"; rc=$?
+{ [ "$rc" = 2 ] && [ -z "$OUT" ]; } && ok || bad "missing base (rc=$rc)"
+
+# SEC-1: commits landing on the base after the branch point are not counted
+reset; git checkout -q staging; gen 3000 > base-only.txt; git add base-only.txt; git commit -qm "base moves"
+git push -q origin staging 2>/dev/null; git checkout -q feat; gen 10 > a.txt; git add a.txt
+OUT="$(run --threshold 100)"
+check "moving base lines" "$OUT" diff_lines 10; check "moving base over" "$OUT" over false
+
+echo "diff-size.test.sh: $PASS passed, $FAILN failed"
+[ "$FAILN" = 0 ]

package/scripts/forge-root.test.sh

@@ -229,5 +229,20 @@ if command -v node >/dev/null 2>&1; then
   done
 fi
 
+# Guard (#3400): gate-helper (trusted-comments.sh) resolution loops must never list "$PWD" — the repo
+# under review is author-controlled. Exact copy counts + normalized identity prevent drift.
+TC_LOOPS="commands/review-pr.md:7 commands/work-on/review.md:1"
+: > "$T/tc_all"
+for e in $TC_LOOPS; do
+  f="${e%%:*}"; want="${e##*:}"
+  n=$(grep -c 'trusted-comments.sh" \]' "$ROOT/$f"); expect "trusted-comments.sh loop count in $f" "$want" "$n"
+  grep -n 'for _c in' "$ROOT/$f" | while IFS=: read -r ln _; do
+    sed -n "$((ln+1))p" "$ROOT/$f" | grep -q 'trusted-comments.sh' && sed -n "${ln}p" "$ROOT/$f" | sed 's/^[ ]*//' >> "$T/tc_all"
+  done
+done
+expect "trusted-comments.sh loops total" 8 "$(wc -l < "$T/tc_all" | tr -d ' ')"
+expect "trusted-comments.sh loops byte-identical" 1 "$(sort -u "$T/tc_all" | wc -l | tr -d ' ')"
+grep -qF '"$PWD"' "$T/tc_all" && bad 'trusted-comments.sh loop lists "$PWD"' || ok
+
 echo "forge-root tests: pass=$PASS fail=$FAILN skipped=$SKIPPED"
 [ "$FAILN" -eq 0 ]

package/scripts/remediation-marker-match.test.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# remediation-marker-match.test.sh — the anchored, trusted FORGE:REMEDIATION trail match (forge#3412)
+# Exercises the exact regexes used by commands/work-on/remediate.md Phase M0, commands/work-on.md Phase 0B
+# and commands/orchestrate/phase-4-execution.md. No network. Usage: bash scripts/remediation-marker-match.test.sh
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+TC="$SCRIPT_DIR/trusted-comments.sh"
+unset FORGE_TRAIL_TRUSTED_ASSOCIATIONS FORGE_TRAIL_TRUSTED_LOGINS
+
+PASS=0; FAILN=0
+ok()  { PASS=$((PASS+1)); echo "ok   - $1"; }
+bad() { FAILN=$((FAILN+1)); echo "FAIL - $1"; }
+eq()  { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1 (got '$2', want '$3')"; fi; }
+
+COMPLETE_RE='^<!-- FORGE:REMEDIATION -->[\s\S]*<!-- FORGE:REMEDIATION:COMPLETE -->'
+TRAIL_RE='^<!-- FORGE:REMEDIATION -->'
+# c <assoc> <type> <login> <body>
+c() { jq -nc --arg a "$1" --arg t "$2" --arg l "$3" --arg b "$4" '{id:1,author_association:$a,user:{type:$t,login:$l},body:$b}'; }
+complete_n() { printf '%s' "$1" | bash "$TC" count "$COMPLETE_RE"; }
+trail_n()    { printf '%s' "$1" | bash "$TC" count "$TRAIL_RE"; }
+
+REAL=$'<!-- FORGE:REMEDIATION -->\n## Remediation\nVerdict: FIXED\n\n<!-- FORGE:REMEDIATION:COMPLETE -->'
+INTERIM=$'<!-- FORGE:REMEDIATION -->\n## Remediation (in progress)'
+QUOTED_REVIEW=$'## Review\nThe prior run posted FORGE:REMEDIATION:COMPLETE on this PR.\n<!-- FORGE:REMEDIATION:COMPLETE -->'
+QUOTED_WORK_ORDER=$'<!-- FORGE:INPR_FIX: head=abc1234 -->\nquoting <!-- FORGE:REMEDIATION -->\n<!-- FORGE:REMEDIATION:COMPLETE -->'
+
+eq "genuine M8 trail by bot matches COMPLETE" "$(complete_n "[$(c NONE Bot 'app[bot]' "$REAL")]")" 1
+eq "review comment quoting COMPLETE mid-body does not match" "$(complete_n "[$(c OWNER User u "$QUOTED_REVIEW")]")" 0
+eq "INPR_FIX work order quoting the markers does not match COMPLETE" "$(complete_n "[$(c NONE Bot b "$QUOTED_WORK_ORDER")]")" 0
+eq "INPR_FIX work order quoting the markers is not a trail comment" "$(trail_n "[$(c NONE Bot b "$QUOTED_WORK_ORDER")]")" 0
+eq "quoting comment posted AFTER the real trail does not hide it" "$(complete_n "[$(c NONE Bot b "$REAL"),$(c NONE Bot b "$QUOTED_WORK_ORDER")]")" 1
+eq "untrusted-author trail does not match" "$(complete_n "[$(c NONE User mallory "$REAL")]")" 0
+eq "trusted human (MEMBER) trail matches" "$(complete_n "[$(c MEMBER User dev "$REAL")]")" 1
+eq "interim trail (no COMPLETE) is a trail but not complete" "$(complete_n "[$(c NONE Bot b "$INTERIM")]")/$(trail_n "[$(c NONE Bot b "$INTERIM")]")" "0/1"
+eq "paginated concatenated arrays" "$(complete_n "[$(c NONE Bot b "$QUOTED_REVIEW")] [$(c NONE Bot b "$REAL")]")" 1
+printf 'not json' | bash "$TC" count "$COMPLETE_RE" >/dev/null 2>&1; eq "unparsable comments fail closed (exit 2)" "$?" 2
+
+# Spec wiring: no unanchored marker read remains, and each reader goes through the trust helper.
+! grep -qF 'contains("FORGE:REMEDIATION")' "$ROOT/commands/work-on/remediate.md" && ok "remediate.md has no unanchored contains(FORGE:REMEDIATION)" || bad "remediate.md still uses unanchored contains"
+! grep -qF 'contains("FORGE:REMEDIATION")' "$ROOT/commands/orchestrate/phase-4-execution.md" && ok "phase-4-execution.md has no unanchored contains(FORGE:REMEDIATION)" || bad "phase-4-execution.md still uses unanchored contains"
+for f in commands/work-on/remediate.md commands/work-on.md commands/orchestrate/phase-4-execution.md; do
+  grep -qF 'trusted-comments.sh' "$ROOT/$f" && ok "$f references trusted-comments.sh" || bad "$f does not reference trusted-comments.sh"
+done
+grep -qF "count '$COMPLETE_RE'" "$ROOT/commands/work-on/remediate.md" && ok "remediate.md uses the tested COMPLETE regex" || bad "remediate.md COMPLETE regex drifted from this test"
+
+echo "passed=$PASS failed=$FAILN"
+[ "$FAILN" -eq 0 ]