forgedock 1.11.0 → 1.12.1

package/scripts/check-branch-ancestry.test.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Fixtures for scripts/check-branch-ancestry.sh. Run: bash scripts/check-branch-ancestry.test.sh (bash 3.2 compatible)
+
+set -u
+DIR=$(cd "$(dirname "$0")" && pwd)
+S="$DIR/check-branch-ancestry.sh"
+T=$(mktemp -d "${TMPDIR:-/tmp}/check-branch-ancestry-test.XXXXXX")
+trap 'rm -rf "$T"' EXIT
+pass=0; fail=0
+OUT=""
+
+g() { git -C "$T/r" -c user.name=t -c user.email=t@example.com -c commit.gpgsign=false "$@" >/dev/null 2>&1; }
+commit() { echo "$1" > "$T/r/$1.txt"; g add -A; g commit -m "$1"; }
+# run <branch> <base>: sets OUT and RC
+run() { OUT=$(cd "$T/r" && bash "$S" "$@" 2>&1); RC=$?; }
+expect() { # expect <want_rc> <desc> [want_substring]
+  if [ "$RC" = "$1" ] && { [ -z "${3:-}" ] || case "$OUT" in *"$3"*) true ;; *) false ;; esac; }; then
+    pass=$((pass+1))
+  else
+    fail=$((fail+1)); echo "FAIL: $2 (rc=$RC, want $1)"; printf '%s\n' "$OUT" | sed 's/^/    /'
+  fi
+}
+
+mkdir "$T/r"; git -C "$T/r" init -q -b staging >/dev/null 2>&1 || { git -C "$T/r" init -q; g checkout -b staging; }
+commit base
+# milestone diverges from staging after staging2
+commit staging2
+g checkout -b milestone/m1; commit ms1
+g checkout staging
+# feature branch off the original base commit
+g checkout -b feat HEAD~1; commit feat1
+
+# 1. no merges
+run feat staging; expect 0 "no merges passes"
+
+# 2. base-sync merge passes (staging advances, then is merged into feat)
+g merge --no-ff -m "Merge staging into feat" staging
+run feat staging; expect 0 "base-sync merge passes"
+run HEAD staging; expect 0 "HEAD form passes"
+
+# 3. staging advances further and is synced again: still passes
+g checkout -q staging; commit staging3; g checkout -q feat
+g merge --no-ff -m "Merge staging again" staging
+run feat staging; expect 0 "repeated base-sync merges pass"
+
+# 4. foreign merge fails, foreign parent printed
+MS=$(git -C "$T/r" rev-parse milestone/m1)
+g merge --no-ff -m "Merge milestone into feat" milestone/m1
+run feat staging; expect 1 "foreign merge fails" "$MS"
+case "$OUT" in *"Merge milestone into feat"*) pass=$((pass+1)) ;; *) fail=$((fail+1)); echo "FAIL: subject not printed"; echo "$OUT" ;; esac
+
+# 5. octopus with one foreign parent fails
+g checkout -q -b feat2 staging; commit f2
+g checkout -q staging; g checkout -q -b side; commit side1
+g checkout -q feat2
+g merge --no-ff -m "octopus" side milestone/m1
+run feat2 staging; expect 1 "octopus with foreign parent fails" "$MS"
+
+# 5b. branch cut from a milestone line, then syncing the base: foreign first-parent history fails
+MS1=$(git -C "$T/r" rev-parse milestone/m1)
+g checkout -q -b feat3 milestone/m1; commit f3
+g merge --no-ff -m "Merge staging into feat3" staging
+run feat3 staging; expect 1 "milestone-cut branch with base sync fails" "$MS1"
+
+# 5c. milestone-cut branch with no merge at all also fails
+g checkout -q -b feat4 milestone/m1; commit f4
+run feat4 staging; expect 1 "milestone-cut branch without merges fails" "$MS1"
+
+# 6. bad refs fail closed (exit 2)
+run nosuchbranch staging; expect 2 "bad branch ref exits 2"
+run feat nosuchbase; expect 2 "bad base ref exits 2"
+run feat; expect 2 "missing arg exits 2"
+
+echo "check-branch-ancestry tests: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]

package/scripts/check-spec-markers.sh

@@ -84,6 +84,8 @@ MARKER_REGISTRY="
   AUTOPILOT_IMPACT
   BATCHABLE
   BATCH_ID
+  BASESYNC_FAILED
+  BASESYNC_REMEDIATION
   BATCH_MEMBERS
   BENCH_SCORECARD
   BLOCKED_ON_HUMAN_MERGE

package/scripts/forge-root.test.sh

@@ -13,7 +13,7 @@ ok()  { PASS=$((PASS+1)); }
 bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
 expect() { [ "$2" = "$3" ] && ok || bad "$1 (got '$3' want '$2')"; }
 
-SITES="commands/work-on.md commands/work-on/review.md commands/work-on/investigate.md commands/work-on/decompose.md commands/work-on/build.md commands/work-on/close.md commands/review-pr.md commands/orchestrate/phase-1-resolve.md commands/orchestrate/phase-4-execution.md"
+SITES="commands/work-on.md commands/work-on/build/validate.md commands/quality-gate.md commands/work-on/review.md commands/work-on/investigate.md commands/work-on/decompose.md commands/work-on/build.md commands/work-on/close.md commands/review-pr.md commands/orchestrate/phase-1-resolve.md commands/orchestrate/phase-4-execution.md"
 
 # extract the bootstrap block (comment line .. closing top-level fi), indentation stripped
 # Block ends at the first line (after the marker) that starts with `fi` at the marker's own indentation.
@@ -229,20 +229,41 @@ if command -v node >/dev/null 2>&1; then
   done
 fi
 
-# Guard (#3400): gate-helper (trusted-comments.sh) resolution loops must never list "$PWD" — the repo
-# under review is author-controlled. Exact copy counts + normalized identity prevent drift.
-TC_LOOPS="commands/review-pr.md:7 commands/work-on/review.md:1"
-: > "$T/tc_all"
-for e in $TC_LOOPS; do
-  f="${e%%:*}"; want="${e##*:}"
-  n=$(grep -c 'trusted-comments.sh" \]' "$ROOT/$f"); expect "trusted-comments.sh loop count in $f" "$want" "$n"
-  grep -n 'for _c in' "$ROOT/$f" | while IFS=: read -r ln _; do
-    sed -n "$((ln+1))p" "$ROOT/$f" | grep -q 'trusted-comments.sh' && sed -n "${ln}p" "$ROOT/$f" | sed 's/^[ ]*//' >> "$T/tc_all"
-  done
-done
-expect "trusted-comments.sh loops total" 8 "$(wc -l < "$T/tc_all" | tr -d ' ')"
-expect "trusted-comments.sh loops byte-identical" 1 "$(sort -u "$T/tc_all" | wc -l | tr -d ' ')"
-grep -qF '"$PWD"' "$T/tc_all" && bad 'trusted-comments.sh loop lists "$PWD"' || ok
+# Guard (#3400, #3454): every gate-helper (trusted-comments.sh) resolver block under commands/ must be
+# byte-identical, must scan the plugin cache (the plugin-root placeholder is not always substituted in
+# forked runs, so without the scan a cache-only install never resolves the script), and must never list the
+# working directory (the repo under review is author-controlled). Blocks are discovered, not hard-coded, so a
+# new copy cannot drift unnoticed. A block runs from its '# TRUSTED_SCRIPT resolver' header to 'done <<< "$_tc"'.
+: > "$T/tc_all"; TC_BLOCKS=0; TC_STRAY=0
+while IFS= read -r f; do
+  awk -v out="$T/tc_all" '
+    /^[ ]*# TRUSTED_SCRIPT resolver/ {inb=1; line=""}
+    inb { sub(/^[ ]+/, ""); line = line $0 "\\n" }
+    inb && /^done <<< "\$_tc"$/ { print line >> out; inb=0; n++ }
+    END { print n+0 }' "$f" > "$T/tc_n"
+  TC_BLOCKS=$((TC_BLOCKS + $(cat "$T/tc_n")))
+  # every trusted-comments.sh resolution case-arm must belong to a block (no stray short copies)
+  arms=$(grep -c 'trusted-comments.sh" \]' "$f" || true)
+  [ "$arms" = "$(cat "$T/tc_n")" ] || { TC_STRAY=$((TC_STRAY + 1)); echo "  stray resolver in $f: $arms arms vs $(cat "$T/tc_n") blocks"; }
+done < <(grep -rl 'trusted-comments.sh" \]' "$ROOT/commands")
+expect "trusted-comments.sh resolver blocks discovered (review-pr 7 + review + remediate + phase-4)" 10 "$TC_BLOCKS"
+expect "trusted-comments.sh resolvers without a canonical block" 0 "$TC_STRAY"
+expect "trusted-comments.sh resolvers byte-identical" 1 "$(sort -u "$T/tc_all" | wc -l | tr -d ' ')"
+grep -qF 'plugins/cache/forgedock/forgedock' "$T/tc_all" && ok || bad 'trusted-comments.sh resolver lacks the plugin-cache scan'
+grep -qF 'CLAUDE_CONFIG_DIR' "$T/tc_all" && ok || bad 'trusted-comments.sh resolver lacks CLAUDE_CONFIG_DIR'
+grep -qF '"$PWD"' "$T/tc_all" && bad 'trusted-comments.sh resolver lists "$PWD"' || ok
+
+# Behavior (#3454): a cache-only install with an unsubstituted plugin-root placeholder must resolve the script.
+# Run the real block from review.md against a fake HOME that has only plugins/cache/forgedock/forgedock/<semver>.
+awk '/^[ ]*# TRUSTED_SCRIPT resolver/ {inb=1} inb {sub(/^[ ]+/, ""); print} inb && /^done <<< "\$_tc"$/ {exit}' "$ROOT/commands/work-on/review.md" > "$T/tc_block.sh"
+mkdir -p "$T/tchome/.claude/plugins/cache/forgedock/forgedock/1.9.0/scripts" "$T/tchome/.claude/plugins/cache/forgedock/forgedock/1.12.0/scripts" "$T/tcwork"
+: > "$T/tchome/.claude/plugins/cache/forgedock/forgedock/1.9.0/scripts/trusted-comments.sh"
+: > "$T/tchome/.claude/plugins/cache/forgedock/forgedock/1.12.0/scripts/trusted-comments.sh"
+mkdir -p "$T/tcwork/scripts"; : > "$T/tcwork/scripts/trusted-comments.sh"   # author-controlled cwd copy must NOT win
+out=$(cd "$T/tcwork" && env -i PATH="$PATH" HOME="$T/tchome" bash -c 'source "$1"; printf %s "$TRUSTED_SCRIPT"' _ "$T/tc_block.sh" 2>&1)
+expect "cache-only install resolves newest cached trusted-comments.sh" "$T/tchome/.claude/plugins/cache/forgedock/forgedock/1.12.0/scripts/trusted-comments.sh" "$out"
+out=$(cd "$T/tcwork" && env -i PATH="$PATH" HOME="$T/nohome" bash -c 'source "$1"; printf %s "$TRUSTED_SCRIPT"' _ "$T/tc_block.sh" 2>&1)
+expect "no install resolves empty (cwd copy never used)" "" "$out"
 
 echo "forge-root tests: pass=$PASS fail=$FAILN skipped=$SKIPPED"
 [ "$FAILN" -eq 0 ]

package/scripts/review-pr-domain-map.test.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Guards the review-pr roster-label to marker-domain mapping: every roster spelling collapses to one marker
+# domain, the helper is identical wherever it is inlined, the roster dedups across spellings, and every
+# persona file is covered by the table and the catalog. Run: bash scripts/review-pr-domain-map.test.sh
+# (bash 3.2 compatible)
+
+set -u
+DIR=$(cd "$(dirname "$0")" && pwd)
+ROOT=$(cd "$DIR/.." && pwd)
+SPEC="$ROOT/commands/review-pr.md"
+CATALOG="$ROOT/commands/review-pr-agents.md"
+PERSONAS="$ROOT/commands/review-pr-agents"
+pass=0; fail=0
+ok() { pass=$((pass+1)); }
+bad() { fail=$((fail+1)); echo "FAIL: $1"; }
+
+WORK=$(mktemp -d "${TMPDIR:-/tmp}/review-pr-domain-map.XXXXXX")
+trap 'rm -rf "$WORK"' EXIT
+
+# Test 1: helper copies. Every inline definition must be byte-identical (each Bash call is a fresh shell).
+awk -v dir="$WORK" '
+  /^# BEGIN review-pr-agent-domain/ {n++; out=dir "/helper." n; on=1}
+  on {print > out}
+  /^# END review-pr-agent-domain/ {on=0; close(out)}
+' "$SPEC"
+copies=$(ls "$WORK"/helper.* 2>/dev/null | wc -l | tr -d ' ')
+if [ "$copies" -ge 4 ]; then ok; else bad "expected >=4 inline agent_domain copies (roster, canonicalize, dispatch, phase 4), found $copies"; fi
+for f in "$WORK"/helper.*; do
+  [ -f "$f" ] || continue
+  if cmp -s "$f" "$WORK/helper.1"; then ok; else bad "$(basename "$f") differs from helper.1"; fi
+done
+
+# Test 2: no site derives the marker by lowercasing the roster label directly
+if grep -nE "AGENT_DOMAIN=.*tr '\[:upper:\]' '\[:lower:\]'" "$SPEC" >/dev/null; then bad "direct lowercase marker derivation remains"; else ok; fi
+sites=$(grep -c 'AGENT_DOMAIN=$(agent_domain "$AGENT")' "$SPEC")
+if [ "$sites" -ge 2 ]; then ok; else bad "expected >=2 agent_domain derivation sites, found $sites"; fi
+
+# Test 3: spelling collapse
+# shellcheck disable=SC1090
+. "$WORK/helper.1"
+check() { got=$(agent_domain "$1"); if [ "$got" = "$2" ]; then ok; else bad "agent_domain '$1' = '$got', want '$2'"; fi; }
+for l in INFRA Infrastructure infra infrastructure; do check "$l" infra; done
+for l in SCRAPING Scraping scraper Scraper scraping; do check "$l" scraper; done
+for l in FRONTEND Frontend frontend Web; do check "$l" frontend; done
+for l in Security SECURITY; do check "$l" security; done
+for l in AUTH Auth; do check "$l" auth; done
+for l in BILLING Billing; do check "$l" billing; done
+for l in CONCURRENCY Concurrency; do check "$l" concurrency; done
+for l in DATABASE Database; do check "$l" database; done
+for l in API Api; do check "$l" api; done
+check "CustomDomain" customdomain
+
+# Test 4: add_agent dedups across spellings; canonicalization block yields one entry per persona
+ADD=$(awk '/^add_agent\(\) \{/{on=1} on{print} on && /^\}/{exit}' "$SPEC")
+if [ -n "$ADD" ]; then ok; else bad "add_agent not found in spec"; fi
+eval "$ADD"
+SELECTED_AGENTS="Security INFRA SCRAPING"
+add_agent "Infrastructure"; add_agent "Scraping"; add_agent "Auth"; add_agent "AUTH"; add_agent "security"
+want=$(printf '%s' "Security INFRA SCRAPING auth")
+if [ "$SELECTED_AGENTS" = "$want" ]; then ok; else bad "add_agent roster '$SELECTED_AGENTS', want '$want'"; fi
+
+CANON=$(awk '/^# END review-pr-agent-domain/{seen++} seen && /^CANON_ROSTER=/{on=1} on{print} on && /^SELECTED_AGENTS=/{exit}' "$SPEC" | head -20)
+SELECTED_AGENTS="Security AUTH INFRA Infrastructure SCRAPING Scraping Frontend API api"
+eval "$CANON"
+want="security auth infra scraper frontend api"
+if [ "$SELECTED_AGENTS" = "$want" ]; then ok; else bad "canonical roster '$SELECTED_AGENTS', want '$want'"; fi
+cnt=$(printf '%s' "$SELECTED_AGENTS" | tr ' ' '\n' | grep -c '.')
+if [ "$cnt" -eq 6 ]; then ok; else bad "roster count $cnt, want 6"; fi
+
+# Test 5: every persona file (minus protocols and spec-cli) has a table row in the spec and a catalog row
+for pf in "$PERSONAS"/*.md; do
+  name=$(basename "$pf" .md)
+  case "$name" in protocols|spec-cli) continue ;; esac
+  if grep -qE "^\| .*\| \`$name\` \| \`$name\.md\` \|" "$SPEC"; then ok; else bad "spec table has no row for persona $name"; fi
+  if grep -qE "^\| .*\| \`$name\` \| \`review-pr-agents/$name\.md\` \|" "$CATALOG"; then ok; else bad "catalog has no marker-domain row for persona $name"; fi
+  got=$(agent_domain "$name")
+  if [ "$got" = "$name" ]; then ok; else bad "persona $name maps to $got"; fi
+done
+
+# Test 6: the protocol defines the marker domain through the mapping
+if grep -qF 'marker domain' "$PERSONAS/protocols.md"; then ok; else bad "protocols.md does not define the marker domain"; fi
+
+echo "review-pr-domain-map: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]

package/scripts/spec-no-worktree-script.test.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# spec-no-worktree-script.test.sh — guard/gate scripts named in specs must resolve from ForgeDock's
+# install root only. A candidate under {WORKTREE_PATH}/scripts, {REPO_PATH}/scripts or a cwd-relative
+# scripts/ is author-controlled (the PR branch under audit) and would let a branch supply the script
+# that gates it. Read-only data uses (grep of a file's contents, JSON manifest reads) are not matched.
+# Usage: bash scripts/spec-no-worktree-script.test.sh
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; ROOT="$HERE/.."
+PASS=0; FAILN=0
+ok()  { PASS=$((PASS+1)); }
+bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
+
+# Execution-resolution patterns: a fallback assignment or candidate list pointing at a repo-controlled scripts dir.
+PATTERNS=(
+  '\|\| [A-Za-z_]+="\{(WORKTREE_PATH|REPO_PATH)\}/scripts/[A-Za-z0-9_.-]+\.sh"'
+  'for _d in [^;]*\{(WORKTREE_PATH|REPO_PATH)\}/scripts'
+  '\$\{FORGEDOCK_SCRIPTS:-scripts\}'
+  '\|\| [A-Za-z_]+="scripts/[A-Za-z0-9_.-]+\.sh"'
+)
+FILES=$(cd "$ROOT" && find commands -name '*.md' | sort)
+for p in "${PATTERNS[@]}"; do
+  hits=$(cd "$ROOT" && grep -nE "$p" $FILES 2>/dev/null || true)
+  [ -z "$hits" ] && ok || bad "repo-controlled script resolution matches /$p/: $hits"
+done
+
+# Representative swept instances must each carry the install-root-only resolution.
+chk() { grep -qF "$2" "$ROOT/$1" && ok || bad "$1 lacks: $2"; }
+chk commands/work-on/build/validate.md 'ANCESTRY_SCRIPT="${FORGE_ROOT:+$FORGE_ROOT/scripts/check-branch-ancestry.sh}"'
+chk commands/quality-gate.md 'VALIDATOR="${FORGE_ROOT:+$FORGE_ROOT/scripts/validate-spec-graph.sh}"'
+chk commands/quality-gate.md 'CONFLICT_CHECKER="${FORGE_ROOT:+$FORGE_ROOT/scripts/check-native-conflicts.sh}"'
+chk commands/quality-gate.md 'SPEC_BASH_CHECKER="${FORGE_ROOT:+$FORGE_ROOT/scripts/check-spec-bash.sh}"'
+chk commands/quality-gate.md 'CLASSIFIER="${FORGE_ROOT:+$FORGE_ROOT/scripts/flaky-quarantine.sh}"'
+chk commands/review-pr.md 'CLASSIFIER="${FORGE_ROOT:+$FORGE_ROOT/scripts/flaky-quarantine.sh}"'
+# validate.md must not name the worktree scripts dir at all (ac-1)
+grep -qF '{WORKTREE_PATH}/scripts' "$ROOT/commands/work-on/build/validate.md" && bad "validate.md references {WORKTREE_PATH}/scripts" || ok
+
+# Behavioral: the validate.md ancestry resolver with FORGE_ROOT unset/empty must resolve to nothing (never /scripts or ./scripts).
+for fr in "" "/nonexistent-root"; do
+  out=$(FORGE_ROOT="$fr" bash -c 'ANCESTRY_SCRIPT="${FORGE_ROOT:+$FORGE_ROOT/scripts/check-branch-ancestry.sh}"; [ -f "$ANCESTRY_SCRIPT" ] || ANCESTRY_SCRIPT=""; printf %s "$ANCESTRY_SCRIPT"')
+  [ -z "$out" ] && ok || bad "resolver yielded '$out' for FORGE_ROOT='$fr'"
+done
+
+echo "spec-no-worktree-script tests: pass=$PASS fail=$FAILN"
+[ "$FAILN" -eq 0 ]

package/scripts/transition-label.sh

@@ -8,7 +8,8 @@
 #   GH_FLAG       Repository flag passed to gh (e.g. -R RapierCraftStudios/forgedock)
 #                 May be multiple tokens — pass before TARGET_STATE
 #   TARGET_STATE  One of: investigating, ready-to-build, building, in-review,
-#                         merged, invalid, decomposed, awaiting-merge
+#                         merged, invalid, decomposed, awaiting-merge,
+#                         remediating  (label workflow:remediating: autonomous remediation pending, not a human gate)
 #
 #   --validate    Sub-command mode: translate an investigation verdict into a
 #                 finding-lifecycle label (needs-validation → validated/false-positive).
@@ -184,6 +185,7 @@ VALID_STATES=(
   "invalid"
   "decomposed"
   "awaiting-merge"
+  "remediating"
 )
 
 # ---------------------------------------------------------------------------