forgedock 1.12.0 → 1.13.0

package/scripts/forge-root.test.sh

@@ -229,20 +229,110 @@ if command -v node >/dev/null 2>&1; then
   done
 fi
 
-# Guard (#3400): gate-helper (trusted-comments.sh) resolution loops must never list "$PWD" — the repo
-# under review is author-controlled. Exact copy counts + normalized identity prevent drift.
-TC_LOOPS="commands/review-pr.md:7 commands/work-on/review.md:1"
-: > "$T/tc_all"
-for e in $TC_LOOPS; do
-  f="${e%%:*}"; want="${e##*:}"
-  n=$(grep -c 'trusted-comments.sh" \]' "$ROOT/$f"); expect "trusted-comments.sh loop count in $f" "$want" "$n"
-  grep -n 'for _c in' "$ROOT/$f" | while IFS=: read -r ln _; do
-    sed -n "$((ln+1))p" "$ROOT/$f" | grep -q 'trusted-comments.sh' && sed -n "${ln}p" "$ROOT/$f" | sed 's/^[ ]*//' >> "$T/tc_all"
-  done
+# Guard (#3400, #3454): every gate-helper (trusted-comments.sh) resolver block under commands/ must be
+# byte-identical, must scan the plugin cache (the plugin-root placeholder is not always substituted in
+# forked runs, so without the scan a cache-only install never resolves the script), and must never list the
+# working directory (the repo under review is author-controlled). Blocks are discovered, not hard-coded, so a
+# new copy cannot drift unnoticed. A block runs from its '# TRUSTED_SCRIPT resolver' header to 'done <<< "$_tc"'.
+: > "$T/tc_all"; TC_BLOCKS=0; TC_STRAY=0
+while IFS= read -r f; do
+  awk -v out="$T/tc_all" '
+    /^[ ]*# TRUSTED_SCRIPT resolver/ {inb=1; line=""}
+    inb { sub(/^[ ]+/, ""); line = line $0 "\\n" }
+    inb && /^done <<< "\$_tc"$/ { print line >> out; inb=0; n++ }
+    END { print n+0 }' "$f" > "$T/tc_n"
+  TC_BLOCKS=$((TC_BLOCKS + $(cat "$T/tc_n")))
+  # every trusted-comments.sh resolution case-arm must belong to a block (no stray short copies)
+  arms=$(grep -c 'trusted-comments.sh" \]' "$f" || true)
+  [ "$arms" = "$(cat "$T/tc_n")" ] || { TC_STRAY=$((TC_STRAY + 1)); echo "  stray resolver in $f: $arms arms vs $(cat "$T/tc_n") blocks"; }
+done < <(grep -rl 'trusted-comments.sh" \]' "$ROOT/commands")
+expect "trusted-comments.sh resolver blocks discovered (review-pr 8 + review + remediate + phase-4 + review-pr-staging)" 12 "$TC_BLOCKS"
+expect "trusted-comments.sh resolvers without a canonical block" 0 "$TC_STRAY"
+expect "trusted-comments.sh resolvers byte-identical" 1 "$(sort -u "$T/tc_all" | wc -l | tr -d ' ')"
+grep -qF 'plugins/cache/forgedock/forgedock' "$T/tc_all" && ok || bad 'trusted-comments.sh resolver lacks the plugin-cache scan'
+grep -qF 'CLAUDE_CONFIG_DIR' "$T/tc_all" && ok || bad 'trusted-comments.sh resolver lacks CLAUDE_CONFIG_DIR'
+grep -qF '"$PWD"' "$T/tc_all" && bad 'trusted-comments.sh resolver lists "$PWD"' || ok
+
+# Behavior (#3454): a cache-only install with an unsubstituted plugin-root placeholder must resolve the script.
+# Run the real block from review.md against a fake HOME that has only plugins/cache/forgedock/forgedock/<semver>.
+awk '/^[ ]*# TRUSTED_SCRIPT resolver/ {inb=1} inb {sub(/^[ ]+/, ""); print} inb && /^done <<< "\$_tc"$/ {exit}' "$ROOT/commands/work-on/review.md" > "$T/tc_block.sh"
+mkdir -p "$T/tchome/.claude/plugins/cache/forgedock/forgedock/1.9.0/scripts" "$T/tchome/.claude/plugins/cache/forgedock/forgedock/1.12.0/scripts" "$T/tcwork"
+: > "$T/tchome/.claude/plugins/cache/forgedock/forgedock/1.9.0/scripts/trusted-comments.sh"
+: > "$T/tchome/.claude/plugins/cache/forgedock/forgedock/1.12.0/scripts/trusted-comments.sh"
+mkdir -p "$T/tcwork/scripts"; : > "$T/tcwork/scripts/trusted-comments.sh"   # author-controlled cwd copy must NOT win
+out=$(cd "$T/tcwork" && env -i PATH="$PATH" HOME="$T/tchome" bash -c 'source "$1"; printf %s "$TRUSTED_SCRIPT"' _ "$T/tc_block.sh" 2>&1)
+expect "cache-only install resolves newest cached trusted-comments.sh" "$T/tchome/.claude/plugins/cache/forgedock/forgedock/1.12.0/scripts/trusted-comments.sh" "$out"
+out=$(cd "$T/tcwork" && env -i PATH="$PATH" HOME="$T/nohome" bash -c 'source "$1"; printf %s "$TRUSTED_SCRIPT"' _ "$T/tc_block.sh" 2>&1)
+expect "no install resolves empty (cwd copy never used)" "" "$out"
+
+# Guard (#3483): the other executable-helper resolvers (classify-finding.sh, amplification-breaker.sh,
+# extract-affected-files.sh) must use the same trusted-install tiers: no "$PWD", no "$REPO_PATH", plugin-cache
+# scan present. Blocks are extracted from the real specs (header '# HELPER_SCRIPT resolver' to 'done <<< "$_tc"',
+# or the resolve_extract_affected_files function) so a drifting copy cannot pass on a hand-written stand-in.
+extract_helper_block() { # file var -> block on stdout
+  awk -v var="$2" '/^[ ]*# HELPER_SCRIPT resolver \(/ && index($0, "(" var ";") {inb=1} inb {sub(/^[ ]+/, ""); print} inb && /^done <<< "\$_tc"$/ {exit}' "$1"
+}
+extract_helper_fn() { # file -> function on stdout
+  awk '/^resolve_extract_affected_files\(\) \{/ {inb=1} inb {print} inb && /^\}$/ {exit}' "$1"
+}
+HR_CLASSIFY="$ROOT/commands/review-pr.md"
+HR_AMP="$ROOT/commands/orchestrate/phase-4-execution.md"
+HR_EX3="$ROOT/commands/orchestrate/phase-3-dependency.md"
+extract_helper_block "$HR_CLASSIFY" CLASSIFY_SCRIPT > "$T/hr_classify.sh"
+extract_helper_block "$HR_AMP" AMP_SCRIPT > "$T/hr_amp.sh"
+extract_helper_fn "$HR_AMP" > "$T/hr_ex4.sh"
+extract_helper_fn "$HR_EX3" > "$T/hr_ex3.sh"
+expect "CLASSIFY_SCRIPT resolver block found" 1 "$(grep -c '^CLASSIFY_SCRIPT=""' "$T/hr_classify.sh")"
+expect "AMP_SCRIPT resolver block found" 1 "$(grep -c '^AMP_SCRIPT=""' "$T/hr_amp.sh")"
+expect "extract-affected-files resolver found in phase-4" 1 "$(grep -c 'resolve_extract_affected_files() {' "$T/hr_ex4.sh")"
+expect "extract-affected-files resolver found in phase-3" 1 "$(grep -c 'resolve_extract_affected_files() {' "$T/hr_ex3.sh")"
+cmp -s "$T/hr_ex3.sh" "$T/hr_ex4.sh" && ok || bad 'resolve_extract_affected_files copies differ between phase-3 and phase-4'
+for hr in classify amp ex3 ex4; do
+  grep -qF 'plugins/cache/forgedock/forgedock' "$T/hr_$hr.sh" && ok || bad "$hr helper resolver lacks the plugin-cache scan"
+  grep -qF 'CLAUDE_CONFIG_DIR' "$T/hr_$hr.sh" && ok || bad "$hr helper resolver lacks CLAUDE_CONFIG_DIR"
+  grep -qE '\$PWD|\$REPO_PATH|\$\{PWD|\$\{REPO_PATH' "$T/hr_$hr.sh" && bad "$hr helper resolver lists the working directory or repo path" || ok
 done
-expect "trusted-comments.sh loops total" 8 "$(wc -l < "$T/tc_all" | tr -d ' ')"
-expect "trusted-comments.sh loops byte-identical" 1 "$(sort -u "$T/tc_all" | wc -l | tr -d ' ')"
-grep -qF '"$PWD"' "$T/tc_all" && bad 'trusted-comments.sh loop lists "$PWD"' || ok
+# no leftover cwd-derived helper tier anywhere under commands/
+if grep -rnE 'PWD/scripts/|^\$PWD$|REPO_PATH/scripts/extract' "$ROOT/commands" >/dev/null 2>&1; then bad 'commands/ still lists a working-directory helper tier'; else ok; fi
+
+# Behavior (#3483): a planted scripts/<helper>.sh in the cwd must never be selected; a cache-only install must resolve.
+mkdir -p "$T/hrwork/scripts" "$T/hrhome/.claude/plugins/cache/forgedock/forgedock/1.12.0/scripts"
+for h in classify-finding amplification-breaker extract-affected-files; do
+  : > "$T/hrwork/scripts/$h.sh"; : > "$T/hrhome/.claude/plugins/cache/forgedock/forgedock/1.12.0/scripts/$h.sh"
+done
+CACHE_SCRIPTS="$T/hrhome/.claude/plugins/cache/forgedock/forgedock/1.12.0/scripts"
+hr_run() { # home blockfile expr
+  (cd "$T/hrwork" && env -i PATH="$PATH" HOME="$1" REPO_PATH="$T/hrwork" bash -c 'source "$1"; '"$3" _ "$2" 2>/dev/null)
+}
+expect "CLASSIFY_SCRIPT: cache-only install resolves (cwd copy ignored)" "$CACHE_SCRIPTS/classify-finding.sh" "$(hr_run "$T/hrhome" "$T/hr_classify.sh" 'printf %s "$CLASSIFY_SCRIPT"')"
+expect "CLASSIFY_SCRIPT: no install resolves empty (cwd copy ignored)" "" "$(hr_run "$T/nohome" "$T/hr_classify.sh" 'printf %s "$CLASSIFY_SCRIPT"')"
+expect "AMP_SCRIPT: cache-only install resolves (cwd copy ignored)" "$CACHE_SCRIPTS/amplification-breaker.sh" "$(hr_run "$T/hrhome" "$T/hr_amp.sh" 'printf %s "$AMP_SCRIPT"')"
+expect "AMP_SCRIPT: no install resolves empty (cwd copy ignored)" "" "$(hr_run "$T/nohome" "$T/hr_amp.sh" 'printf %s "$AMP_SCRIPT"')"
+expect "extract-affected-files: cache-only install resolves (cwd and REPO_PATH copies ignored)" "$CACHE_SCRIPTS/extract-affected-files.sh" "$(hr_run "$T/hrhome" "$T/hr_ex4.sh" 'resolve_extract_affected_files')"
+expect "extract-affected-files: no install resolves nothing (cwd and REPO_PATH copies ignored)" "" "$(hr_run "$T/nohome" "$T/hr_ex4.sh" 'resolve_extract_affected_files')"
+
+# Guard (#3636): review-delta.sh takes its trust script ONLY from an explicit absolute --trusted-script. Any
+# commands/ block that resolves review-delta.sh (added by the specs that consume it) must use the trusted-install
+# tiers: plugin-cache scan and CLAUDE_CONFIG_DIR present, no "$PWD"/"$REPO_PATH" tier. Passes with 0 blocks today.
+RD_BLOCKS=0
+while IFS= read -r f; do
+  awk '/^[ ]*# HELPER_SCRIPT resolver \(/ && index($0, "(REVIEW_DELTA_SCRIPT;") {inb=1} inb {sub(/^[ ]+/, ""); print} inb && /^done <<< "\$_tc"$/ {exit}' "$f" > "$T/rd_block.sh"
+  [ -s "$T/rd_block.sh" ] || { bad "review-delta.sh referenced in $f without a canonical REVIEW_DELTA_SCRIPT resolver block"; continue; }
+  RD_BLOCKS=$((RD_BLOCKS + 1))
+  grep -qF 'plugins/cache/forgedock/forgedock' "$T/rd_block.sh" && ok || bad "review-delta resolver in $f lacks the plugin-cache scan"
+  grep -qF 'CLAUDE_CONFIG_DIR' "$T/rd_block.sh" && ok || bad "review-delta resolver in $f lacks CLAUDE_CONFIG_DIR"
+  grep -qE '\$PWD|\$REPO_PATH|\$\{PWD|\$\{REPO_PATH' "$T/rd_block.sh" && bad "review-delta resolver in $f lists the working directory or repo path" || ok
+done < <(grep -rl 'review-delta\.sh' "$ROOT/commands" 2>/dev/null)
+
+# Behavior (#3636): a planted scripts/trusted-comments.sh in the cwd must never be used. Without --trusted-script the
+# resolver fails closed (FULL); a stub that would trust everything cannot change that.
+mkdir -p "$T/rdwork/scripts"
+printf '#!/usr/bin/env bash\ncat >/dev/null\nprintf "%%s\\n" "\\"<!-- REVIEW-FINDINGS-SYNTHESIZED-START -->\\""\n' > "$T/rdwork/scripts/trusted-comments.sh"
+echo '[]' > "$T/rdwork/comments.json"
+out=$(cd "$T/rdwork" && bash "$ROOT/scripts/review-delta.sh" --pr 1 --head 0123456789abcdef0123456789abcdef01234567 --base main --comments-file comments.json --labels "" 2>&1 | sed -n 1p)
+expect "review-delta.sh without --trusted-script prints FULL (cwd trust script ignored)" "FULL" "$out"
+out=$(cd "$T/rdwork" && bash "$ROOT/scripts/review-delta.sh" --pr 1 --head 0123456789abcdef0123456789abcdef01234567 --base main --trusted-script scripts/trusted-comments.sh --comments-file comments.json --labels "" 2>&1 | sed -n 1p)
+expect "review-delta.sh with a relative cwd --trusted-script prints FULL" "FULL" "$out"
 
 echo "forge-root tests: pass=$PASS fail=$FAILN skipped=$SKIPPED"
 [ "$FAILN" -eq 0 ]

package/scripts/forge-run.sh

@@ -285,7 +285,7 @@ fi
 
 # Read current workflow labels
 WORKFLOW_LABEL=""
-for label in "workflow:in-review" "workflow:building" "workflow:ready-to-build" "workflow:investigating"; do
+for label in "workflow:in-review" "workflow:remediating" "workflow:building" "workflow:ready-to-build" "workflow:investigating"; do
   if printf '%s' "$LABELS_JSON" | jq -e --arg l "$label" 'contains([$l])' > /dev/null 2>&1; then
     WORKFLOW_LABEL="$label"
     break
@@ -299,7 +299,7 @@ ACTION=""
 if [ "$REVIEW_STARTED" = "true" ]; then
   PHASE="in-review"
   ACTION="Review in progress — /review-pr handles merge. Check PR state."
-elif [ "$BUILDER_COMPLETE" = "true" ] && [ "$WORKFLOW_LABEL" != "workflow:in-review" ]; then
+elif [ "$BUILDER_COMPLETE" = "true" ] && [ "$WORKFLOW_LABEL" != "workflow:in-review" ] && [ "$WORKFLOW_LABEL" != "workflow:remediating" ]; then
   PHASE="awaiting-pr"
   ACTION="Builder complete. Create PR targeting the classified lane branch."
 elif [ "$BUILDER_PRESENT" = "true" ] && [ "$BUILDER_COMPLETE" = "false" ]; then

package/scripts/recovery-claim-live.test.sh

@@ -32,10 +32,13 @@ old_iso()  { date -u -d '2 hours ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u
 fx() { echo "$2" > "$TMP_FX/$1.json"; echo "$TMP_FX/$1.json"; }
 claim()   { jq -cn --arg id "$1" --arg t "$2" '{body:("<!-- FORGE:RECOVERY_CLAIM -->\n**Sweep: "+$id+"**\nHolder: /recover-orphans"), updated_at:$t}'; }
 release() { jq -cn --arg id "$1" --arg t "$2" '{body:("<!-- FORGE:RECOVERY_CLAIM_RELEASED -->\n**Sweep: "+$id+"**\nReleased"), updated_at:$t}'; }
+# comment <marker> <second-line> <updated_at>: built by jq, never hand-escaped. macOS /bin/bash 3.2 mis-parses
+# escaped double quotes inside "$(fx name "...")", which turned literal JSON fixtures into invalid JSON there.
+comment() { jq -cn --arg m "$1" --arg l "$2" --arg t "$3" '{body:("<!-- "+$m+" -->\n"+$l), updated_at:$t}'; }
 
 run() { local f="$1"; shift; OUT=$(MOCK_GH_JSON="$f" bash "$CHECK" 7 -R o/r "$@" 2>/dev/null); RC=$?; }
 expect() { # name rc needle
-  [ "$RC" -eq "$2" ] && echo "$OUT" | grep -q "$3" && ok "$1" || bad "$1 (rc=$RC out=$OUT)"
+  [ "$RC" -eq "$2" ] && grep -q "$3" <<< "$OUT" && ok "$1" || bad "$1 (rc=$RC out=$OUT)"
 }
 
 N=$(now_iso); O=$(old_iso)
@@ -44,16 +47,16 @@ run "$(fx live "[$(claim sweep-A "$N")]")";                      expect "fresh c
 run "$(fx exp "[$(claim sweep-A "$O")]")";                       expect "expired claim is FREE" 0 "CLAIM: FREE"
 run "$(fx rel "[$(claim sweep-A "$N"), $(release sweep-A "$N")]")"; expect "released claim is FREE" 0 "CLAIM: FREE"
 run "$(fx relother "[$(claim sweep-A "$N"), $(release sweep-B "$N")]")"; expect "release of another sweep does not free the claim" 1 "CLAIM: LIVE sweep-A"
-run "$(fx unkrel "[{\"body\":\"<!-- FORGE:RECOVERY_CLAIM -->\\nno sweep line\",\"updated_at\":\"$N\"}, {\"body\":\"<!-- FORGE:RECOVERY_CLAIM_RELEASED -->\\nno sweep line\",\"updated_at\":\"$N\"}]")"; expect "release with no sweep id does not free an id-less claim" 1 "CLAIM: LIVE unknown"
+run "$(fx unkrel "[$(comment FORGE:RECOVERY_CLAIM "no sweep line" "$N"), $(comment FORGE:RECOVERY_CLAIM_RELEASED "no sweep line" "$N")]")"; expect "release with no sweep id does not free an id-less claim" 1 "CLAIM: LIVE unknown"
 run "$(fx own "[$(claim sweep-A "$N")]")" --exempt-sweep sweep-A; expect "own sweep id is exempt" 0 "CLAIM: FREE"
 run "$(fx other "[$(claim sweep-A "$N")]")" --exempt-sweep sweep-B; expect "other sweep id is not exempt" 1 "CLAIM: LIVE sweep-A"
 run "$(fx two "[$(claim sweep-A "$N"), $(claim sweep-B "$N")]")" --exempt-sweep sweep-A; expect "exempting A still sees live B" 1 "CLAIM: LIVE sweep-B"
-run "$(fx unk "[{\"body\":\"<!-- FORGE:RECOVERY_CLAIM -->\\nno sweep line\",\"updated_at\":\"$N\"}]")" --exempt-sweep sweep-A; expect "claim with no sweep id is never exempt" 1 "CLAIM: LIVE"
-run "$(fx unk2 "[{\"body\":\"<!-- FORGE:RECOVERY_CLAIM -->\\nno sweep line\",\"updated_at\":\"$N\"}]")" --exempt-sweep unknown; expect "--exempt-sweep unknown is rejected" 2 "CLAIM: ERROR"
+run "$(fx unk "[$(comment FORGE:RECOVERY_CLAIM "no sweep line" "$N")]")" --exempt-sweep sweep-A; expect "claim with no sweep id is never exempt" 1 "CLAIM: LIVE"
+run "$(fx unk2 "[$(comment FORGE:RECOVERY_CLAIM "no sweep line" "$N")]")" --exempt-sweep unknown; expect "--exempt-sweep unknown is rejected" 2 "CLAIM: ERROR"
 run "$(fx none '[]')";                                            expect "no comments is FREE" 0 "CLAIM: FREE"
-run "$(fx hb "[{\"body\":\"<!-- FORGE:HEARTBEAT -->\\nPhase 3\",\"updated_at\":\"$N\"}]")"; expect "heartbeat alone is not a recovery claim" 0 "CLAIM: FREE"
-run "$(fx bad "[{\"body\":\"<!-- FORGE:RECOVERY_CLAIM -->\\nno sweep line\",\"updated_at\":\"$N\"}]")"; expect "malformed claim fails closed (LIVE)" 1 "CLAIM: LIVE"
-run "$(fx nodate "[{\"body\":\"<!-- FORGE:RECOVERY_CLAIM -->\\n**Sweep: sweep-A**\",\"updated_at\":\"garbage\"}]")"; expect "unparsable updated_at fails closed (LIVE)" 1 "CLAIM: LIVE"
+run "$(fx hb "[$(comment FORGE:HEARTBEAT "Phase 3" "$N")]")"; expect "heartbeat alone is not a recovery claim" 0 "CLAIM: FREE"
+run "$(fx bad "[$(comment FORGE:RECOVERY_CLAIM "no sweep line" "$N")]")"; expect "malformed claim fails closed (LIVE)" 1 "CLAIM: LIVE"
+run "$(fx nodate "[$(comment FORGE:RECOVERY_CLAIM "**Sweep: sweep-A**" garbage)]")"; expect "unparsable updated_at fails closed (LIVE)" 1 "CLAIM: LIVE"
 
 OUT=$(MOCK_GH_FAIL=1 MOCK_GH_JSON=/dev/null bash "$CHECK" 7 -R o/r 2>/dev/null); RC=$?
 expect "gh outage is ERROR (exit 2)" 2 "CLAIM: ERROR"

package/scripts/remediate-basesync.test.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# remediate-basesync.test.sh — spec guard for the Phase M3 base-sync block in commands/work-on/remediate.md (forge#3515)
+# Asserts rc capture, MERGE_HEAD classification/guard, distinct refused blocker, sync-before-edits ordering,
+# clean-tree precondition, and a scratch-repo check of the git behaviour the spec relies on. No network.
+# Usage: bash scripts/remediate-basesync.test.sh
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+SPEC="$ROOT/commands/work-on/remediate.md"
+
+PASS=0; FAILN=0
+ok()  { PASS=$((PASS+1)); echo "ok   - $1"; }
+bad() { FAILN=$((FAILN+1)); echo "FAIL - $1"; }
+eq()  { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1 (got '$2', want '$3')"; fi; }
+has() { if grep -qE -- "$2" "$SPEC"; then ok "$1"; else bad "$1"; fi; }
+
+has "merge rc captured into MERGE_RC" 'MERGE_RC=\$\?'
+has "MERGE_HEAD guard present" 'git rev-parse -q --verify MERGE_HEAD'
+has "distinct refused-merge blocker" 'base-sync: merge refused'
+has "ordering: sync before any other FIXABLE edit" 'before any (other )?(FIXABLE|fix) edit'
+has "clean-tree precondition" 'git diff --quiet'
+has "empty CONFLICT_FILES fallback" 'CONFLICT_FILES="\(no conflicted files'
+has "unresolvable blocker unchanged" 'base-sync: unresolvable conflicts'
+has "FORGE:BASESYNC_FAILED marker kept" 'FORGE:BASESYNC_FAILED'
+if grep -nE '^[[:space:]]*git merge --abort' "$SPEC" >/dev/null; then bad "no bare git merge --abort line"; else ok "no bare git merge --abort line"; fi
+if grep -nE 'git merge --abort' "$SPEC" | grep -vq 'MERGE_HEAD'; then bad "every git merge --abort is MERGE_HEAD-guarded"; else ok "every git merge --abort is MERGE_HEAD-guarded"; fi
+# Unannotated side-effect lines would trip the #3541 gate
+if grep -E 'git merge (origin|--abort)' "$SPEC" | grep -v 'allowlist:check-command-side-effects' | grep -vq '^[[:space:]]*$'; then
+  grep -E 'git merge (origin|--abort)' "$SPEC" | grep -v 'allowlist:check-command-side-effects' | grep -qE '^[[:space:]]*(MERGE_OUT=|git merge|if git rev-parse)' && bad "side-effect lines annotated" || ok "side-effect lines annotated"
+else ok "side-effect lines annotated"; fi
+
+has "M3 records merged base head" 'BASESYNC_BASE_SHA=\$\(git rev-parse origin/'
+has "re-sync rounds hard-capped" 'BASESYNC_MAX_ROUNDS'
+has "M6 distinguishes advanced base" 'Base advanced'
+has "M8 trail persists base sha" 'Base sync\*\*: ran \(base='
+has "rounds derived from pushed sync merges" 'BASESYNC_ROUNDS=\$\(git rev-list --first-parent --merges --count origin/\{PR_BASE\}\.\.origin/\{HEAD_BRANCH\}'
+has "unreadable round count treated as the cap" '\|\| BASESYNC_ROUNDS=\$BASESYNC_MAX_ROUNDS'
+if grep -qF 'BASESYNC_ROUNDS=$(( ${BASESYNC_ROUNDS:-0}' "$SPEC"; then bad "no shell-state round counter"; else ok "no shell-state round counter"; fi
+if grep -qF '[ -n "${BASESYNC_BASE_SHA:-}" ]' "$SPEC"; then bad "freshness pass not gated on a shell var"; else ok "freshness pass not gated on a shell var"; fi
+has "freshness push rc checked" 'if git push origin HEAD:\{HEAD_BRANCH\}; then'
+has "freshness merge re-gated before push" 'Run the Phase M4 pre-push ancestry guard'
+if grep -qF 'do NOT sync a second time' "$SPEC"; then bad "unconditional second-sync refusal removed"; else ok "unconditional second-sync refusal removed"; fi
+
+# Behavioural: dirty tree + base change -> refused (rc!=0, no MERGE_HEAD, empty U-list); real conflict -> MERGE_HEAD present.
+T="$(mktemp -d)"; trap 'rm -rf "$T"' EXIT
+(
+  cd "$T" && git init -q -b main . && git config user.email t@t && git config user.name t
+  echo a > f && git add f && git commit -qm base
+  git checkout -qb feat && git checkout -q main && echo b > f && git commit -qam basechange
+  git checkout -q feat && echo local > f
+  out=$(git merge main --no-edit 2>&1); echo "$? $(git rev-parse -q --verify MERGE_HEAD >/dev/null && echo head || echo nohead) [$(git diff --name-only --diff-filter=U)]" > "$T/refused.out"
+  git checkout -q -- f && echo c > f && git commit -qam featchange
+  git merge main --no-edit >/dev/null 2>&1; echo "$? $(git rev-parse -q --verify MERGE_HEAD >/dev/null && echo head || echo nohead)" > "$T/conflict.out"
+)
+eq "refused merge: rc=1, no MERGE_HEAD, empty conflict list" "$(cat "$T/refused.out")" "1 nohead []"
+eq "real conflict: rc=1 with MERGE_HEAD" "$(cat "$T/conflict.out")" "1 head"
+
+# Advanced base: merge main at T0, main advances, head differs and a second merge is clean; unchanged base keeps the same SHA.
+(
+  R="$T/adv"; mkdir "$R" && cd "$R" && git init -q -b main . && git config user.email t@t && git config user.name t
+  echo a > f && git add f && git commit -qm base
+  git checkout -qb feat && echo x > g && git add g && git commit -qm feat
+  git checkout -q main && echo b > f && git commit -qam m1 && git checkout -q feat
+  git update-ref refs/remotes/origin/main main
+  sha0=$(git rev-parse origin/main); git merge origin/main --no-edit >/dev/null 2>&1
+  same=$(git rev-parse origin/main)
+  git checkout -q main && echo c > h && git add h && git commit -qm sibling && git checkout -q feat
+  git update-ref refs/remotes/origin/main main
+  sha1=$(git rev-parse origin/main)
+  git merge origin/main --no-edit >/dev/null 2>&1; rc=$?
+  echo "$([ "$sha0" = "$same" ] && echo unchanged-same || echo unchanged-differs) $([ "$sha0" != "$sha1" ] && echo advanced || echo notadvanced) $rc" > "$T/adv.out"
+)
+eq "advanced base: SHA differs, unchanged base same, second merge clean" "$(cat "$T/adv.out")" "unchanged-same advanced 0"
+
+# Durable derivation (forge#3517): the M3/M6 lines, run in a fresh shell against a scratch repo, recover rounds and the
+# recorded base head from the pushed branch; an unpushed merge does not count.
+DERIVE="$(grep -m1 -E '^BASESYNC_ROUNDS=\$\(git rev-list' "$SPEC")"$'\n'"$(grep -m1 -E '^_lm=\$\(git rev-list' "$SPEC")"$'\n'"$(grep -m1 -E '^\[ -n "\$_lm" \]' "$SPEC")"
+DERIVE="${DERIVE//\{PR_BASE\}/main}"; DERIVE="${DERIVE//\{HEAD_BRANCH\}/feat}"
+(
+  R="$T/derive"; mkdir "$R" && cd "$R" && git init -q -b main . && git config user.email t@t && git config user.name t
+  derive() { BASESYNC_MAX_ROUNDS=2; eval "$DERIVE"; echo "$BASESYNC_ROUNDS ${_p2:-none}"; }
+  echo a > f && git add f && git commit -qm base
+  git checkout -qb feat && echo x > g && git add g && git commit -qm feat
+  git update-ref refs/remotes/origin/main main; git update-ref refs/remotes/origin/feat feat
+  r0=$(derive)
+  git checkout -q main && echo b > f && git commit -qam m1 && git checkout -q feat
+  git update-ref refs/remotes/origin/main main; b1=$(git rev-parse main)
+  git merge origin/main --no-edit >/dev/null 2>&1
+  r_unpushed=$(derive)
+  git update-ref refs/remotes/origin/feat feat
+  r1=$(derive)
+  echo "$r0|$r_unpushed|$r1|$b1" > "$T/derive.out"
+)
+IFS='|' read -r D0 DU D1 B1 < "$T/derive.out"
+eq "derive: no sync merge -> 0 rounds, no recorded head" "$D0" "0 none"
+eq "derive: unpushed merge does not count" "$DU" "0 none"
+eq "derive: pushed sync merge -> 1 round, recorded head = merged base" "$D1" "1 $B1"
+
+echo "passed=$PASS failed=$FAILN"
+[ "$FAILN" -eq 0 ]

package/scripts/review-delta.sh

@@ -0,0 +1,206 @@
+#!/usr/bin/env bash
+# review-delta.sh — fail-closed reviewed-SHA delta resolver for /review-pr.
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Classifies how the PR head moved since the last FULLY reviewed head, so callers can skip or shrink the
+# domain panel. Pure bash + git + jq, no LLM. Standalone so the engine and the specs can both call it.
+#
+# Usage:
+#   review-delta.sh --pr <n> --head <40|64-hex> --base <branch> --trusted-script <abs path>
+#                   [--comments-file <json>] [--repo <owner/repo>] [--labels <csv>] [--repo-path <dir>]
+#
+#   --trusted-script  REQUIRED absolute path to an existing trusted-comments.sh. The caller passes the path it
+#                     resolved from the trusted install; this script never derives it from the working
+#                     directory, the repo under review or its own location (a PR-controlled copy would let the
+#                     PR author decide which comments count).
+#   --comments-file   JSON of `gh api --paginate repos/<repo>/issues/<pr>/comments` (one array or several
+#                     concatenated arrays). When absent the comments are fetched (needs --repo).
+#   --labels          comma-separated PR labels. When absent they are fetched (needs --repo). A `review-degraded`
+#                     label always yields FULL. `--labels ""` means "no labels" and is allowed.
+#   --repo-path       git checkout to inspect (default: the current directory). Needs origin/<base> fetched.
+#
+# Output (always exit 0; two lines):
+#   line 1  FULL | BASE_SYNC_ONLY <reviewed> | DELTA <reviewed>..<head>
+#   line 2  FULL_ROUNDS=<n>   number of distinct trusted full-panel SHAs (0 when none or on error)
+#
+# Contract notes for callers (#3637/#3638):
+#   - Every error path prints FULL. FULL is always safe (a full review), never a skipped one.
+#   - head == reviewed prints `DELTA <sha>..<sha>` (empty delta). The caller's same-head re-entry handles that
+#     case before calling; this classifier does not special-case it.
+#   - Checkpoint = newest full 40/64-hex `Reviewed-SHA:` on a trusted, complete-shape FORGE:REVIEW-AGENT body that
+#     also has a post-panel-guard proof (a synthesized body naming the SHA, or a `# PR Review Summary` whose
+#     **Reviewed commit** is the SHA and whose **Agents** count equals the distinct domains that posted). The
+#     FORGE:REVIEW_ROUTE sha= value is 7 chars and is never a checkpoint. A trusted review-panel-integrity gate
+#     failure / REVIEW_DEGRADED / REVIEW_BLOCKED marker posted after a SHA's first agent body disqualifies it.
+#   - FULL also when forge.yaml, the review specs, this script or the trust script changed in reviewed..head.
+#   - BASE_SYNC_ONLY also needs the per-path diff shape (modes, status, binary blob ids) of both 3-dot diffs
+#     to match: the +/- line comparison cannot see binary content or mode changes.
+#
+# bash 3.2 portable. No `set -e`: every read is captured and status-tested, never behind a pipe.
+
+set -uo pipefail
+
+ROUNDS=0
+full() { echo "FULL"; echo "FULL_ROUNDS=${ROUNDS}"; exit 0; }
+
+PR=""; HEAD_SHA=""; BASE=""; TRUSTED=""; COMMENTS_FILE=""; REPO=""; LABELS=""; LABELS_SET=0; REPO_PATH="."
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --pr) [ $# -ge 2 ] || full; PR="$2"; shift 2 ;;
+    --head) [ $# -ge 2 ] || full; HEAD_SHA="$2"; shift 2 ;;
+    --base) [ $# -ge 2 ] || full; BASE="$2"; shift 2 ;;
+    --trusted-script) [ $# -ge 2 ] || full; TRUSTED="$2"; shift 2 ;;
+    --comments-file) [ $# -ge 2 ] || full; COMMENTS_FILE="$2"; shift 2 ;;
+    --repo) [ $# -ge 2 ] || full; REPO="$2"; shift 2 ;;
+    --labels) [ $# -ge 2 ] || full; LABELS="$2"; LABELS_SET=1; shift 2 ;;
+    --repo-path) [ $# -ge 2 ] || full; REPO_PATH="$2"; shift 2 ;;
+    *) full ;;
+  esac
+done
+
+valid_sha() { # 40 or 64 lowercase hex
+  case "$1" in *[!0-9a-f]*|"") return 1 ;; esac
+  [ "${#1}" -eq 40 ] || [ "${#1}" -eq 64 ]
+}
+
+case "$PR" in ''|*[!0-9]*) full ;; esac
+valid_sha "$HEAD_SHA" || full
+case "$BASE" in ''|-*|*[!A-Za-z0-9._/-]*|*..*) full ;; esac
+case "$TRUSTED" in /*) ;; *) full ;; esac
+[ -f "$TRUSTED" ] || full
+case "$REPO" in *[!A-Za-z0-9._/-]*) full ;; esac
+[ -d "$REPO_PATH" ] || full
+command -v jq >/dev/null 2>&1 || full
+
+G() { git -C "$REPO_PATH" -c core.quotepath=off "$@"; }
+
+# ---- inputs: comments + labels --------------------------------------------------------------------------------
+if [ -n "$COMMENTS_FILE" ]; then
+  [ -f "$COMMENTS_FILE" ] && [ -r "$COMMENTS_FILE" ] || full
+  COMMENTS_JSON=$(cat "$COMMENTS_FILE" 2>/dev/null) || full
+else
+  [ -n "$REPO" ] || full
+  COMMENTS_JSON=$(gh api --paginate "repos/${REPO}/issues/${PR}/comments" 2>/dev/null) || full
+fi
+[ -n "$COMMENTS_JSON" ] || full
+
+if [ "$LABELS_SET" -eq 0 ]; then
+  [ -n "$REPO" ] || full
+  LABELS=$(gh pr view "$PR" -R "$REPO" --json labels --jq '[.labels[].name] | join(",")' 2>/dev/null) || full
+fi
+case ",${LABELS}," in *,review-degraded,*) full ;; esac
+
+# ---- checkpoint: newest SHA with a trusted, complete, proven panel ---------------------------------------------
+RE='^(?=[\s\S]*<!-- REVIEW-FINDINGS-START -->)<!-- FORGE:REVIEW-AGENT:[a-z-]+ -->|^<!-- REVIEW-FINDINGS-SYNTHESIZED-START -->|# PR Review Summary|<!-- FORGE:GATE_FAILURE:TYPE=review-panel-integrity|<!-- FORGE:REVIEW_DEGRADED|<!-- FORGE:REVIEW_BLOCKED'
+BODIES=$(bash "$TRUSTED" bodies "$RE" 2>/dev/null <<< "$COMMENTS_JSON"); rc=$?
+[ "$rc" -eq 0 ] || full
+
+# Bodies arrive in comment order, one JSON string per line. Everything is decided in one jq pass over that order
+# (the degraded markers carry no SHA and no timestamp, so relative order is the only signal).
+JQ_PROG='
+  def shas($t; $re): [ $t | scan($re) | .[0] ];
+  def one($a): if ($a | length) == 1 then $a[0] else null end;
+  to_entries as $E
+  | ($E | map(select(.value | test("<!-- FORGE:GATE_FAILURE:TYPE=review-panel-integrity|<!-- FORGE:REVIEW_DEGRADED|<!-- FORGE:REVIEW_BLOCKED")) | .key)) as $DEG
+  | ([ $E[] | .key as $i | .value as $t
+       | select($t | test("^(?=[\\s\\S]*<!-- REVIEW-FINDINGS-START -->)<!-- FORGE:REVIEW-AGENT:[a-z-]+ -->"))
+       | one(shas($t; "(?:^|\\n)Reviewed-SHA: ([0-9a-f]{40}|[0-9a-f]{64})\\r?(?:\\n|$)")) as $s
+       | select($s != null)
+       | {i: $i, sha: $s, d: ($t | capture("^<!-- FORGE:REVIEW-AGENT:(?<d>[a-z-]+) -->").d)} ]) as $AG
+  | ([ $E[] | .key as $i | .value as $t
+       | select($t | startswith("<!-- REVIEW-FINDINGS-SYNTHESIZED-START -->"))
+       | one(shas($t; "(?:^|\\n)Reviewed-SHA: ([0-9a-f]{40}|[0-9a-f]{64})\\r?(?:\\n|$)")) as $s
+       | select($s != null)
+       | {i: $i, sha: $s} ]) as $SY
+  | ([ $E[] | .key as $i | .value as $t
+       | select($t | test("# PR Review Summary"))
+       | one(shas($t; "\\*\\*Reviewed commit\\*\\*: `?([0-9a-f]{40}|[0-9a-f]{64})`?(?:[ |\\r\\n]|$)")) as $s
+       | one(shas($t; "\\*\\*Agents\\*\\*: ([0-9]+)")) as $n
+       | select($s != null and $n != null)
+       | {i: $i, sha: $s, n: ($n | tonumber)} ]) as $SU
+  | ([ $AG | group_by(.sha)[]
+       | {sha: .[0].sha, first: (map(.i) | min), domains: (map(.d) | unique | length)}
+       | . as $g
+       | select(
+           (($SY | map(select(.sha == $g.sha)) | length) > 0
+            or ($SU | map(select(.sha == $g.sha and .n == $g.domains)) | length) > 0)
+           and (($DEG | map(select(. > $g.first)) | length) == 0))
+       | . + {last: ([ ($AG[] | select(.sha == $g.sha) | .i), ($SY[] | select(.sha == $g.sha) | .i),
+                       ($SU[] | select(.sha == $g.sha) | .i) ] | max)} ]) as $OK
+  | (if ($OK | length) == 0 then "-" else ($OK | max_by(.last) | .sha) end), ($OK | length)'
+PARSED=$(jq -s -r "$JQ_PROG" 2>/dev/null <<< "$BODIES"); rc=$?
+[ "$rc" -eq 0 ] || full
+REVIEWED=$(printf '%s\n' "$PARSED" | sed -n '1p'); N=$(printf '%s\n' "$PARSED" | sed -n '2p')
+case "$N" in ''|*[!0-9]*) full ;; esac
+ROUNDS="$N"
+[ "$REVIEWED" = "-" ] && full
+valid_sha "$REVIEWED" || full
+
+# ---- classification --------------------------------------------------------------------------------------------
+G cat-file -e "${HEAD_SHA}^{commit}" 2>/dev/null || full
+G cat-file -e "${REVIEWED}^{commit}" 2>/dev/null || full
+G merge-base --is-ancestor "$REVIEWED" "$HEAD_SHA" 2>/dev/null; rc=$?
+[ "$rc" -eq 0 ] || full   # 1 = force-push / rebase, >1 = git error: both FULL
+
+NAMES=$(G diff --name-only --no-renames "$REVIEWED" "$HEAD_SHA" 2>/dev/null); rc=$?
+[ "$rc" -eq 0 ] || full
+while IFS= read -r f; do
+  case "$f" in
+    forge.yaml|commands/review-pr*.md|commands/review-pr-agents/*|scripts/review-delta.sh|scripts/trusted-comments.sh) full ;;
+  esac
+done <<< "$NAMES"
+
+DELTA_OUT="DELTA ${REVIEWED}..${HEAD_SHA}"
+
+G rev-parse --verify --quiet "origin/${BASE}^{commit}" >/dev/null 2>&1 || full
+CHAIN=$(G rev-list --first-parent "${REVIEWED}..${HEAD_SHA}" 2>/dev/null); rc=$?
+[ "$rc" -eq 0 ] || full
+if [ -z "$CHAIN" ]; then echo "$DELTA_OUT"; echo "FULL_ROUNDS=${ROUNDS}"; exit 0; fi
+
+# BASE_SYNC_ONLY needs every first-parent commit to be a clean merge of origin/<base>
+SYNC=1
+while IFS= read -r c; do
+  [ -n "$c" ] || continue
+  PARENTS=$(G rev-list --parents -n 1 "$c" 2>/dev/null); rc=$?
+  [ "$rc" -eq 0 ] || full
+  set -- $PARENTS
+  if [ $# -ne 3 ]; then SYNC=0; break; fi            # not a plain two-parent merge
+  G merge-base --is-ancestor "$3" "origin/${BASE}" 2>/dev/null; rc=$?
+  [ "$rc" -le 1 ] || full
+  if [ "$rc" -ne 0 ]; then SYNC=0; break; fi         # second parent is not base history
+  CC=$(G diff-tree --cc --no-commit-id -r "$c" 2>/dev/null); rc=$?
+  [ "$rc" -eq 0 ] || full
+  if [ -n "$CC" ]; then SYNC=0; break; fi            # conflict-resolution content in the merge
+done <<< "$CHAIN"
+
+# per-path shape of a diff: modes, status and path for every file, plus both blob ids for binary files
+# (whose content the +/- line comparison cannot see). Text blob ids are left out: they shift when base moves.
+diff_shape() {
+  local raw bin
+  raw=$(G diff --raw --no-abbrev --no-renames "$1" 2>/dev/null) || return 1
+  bin=$(G diff --numstat --no-renames "$1" 2>/dev/null) || return 1
+  { printf '%s\n' "$bin"; printf '%s\n' '--RAW--'; printf '%s\n' "$raw"; } | awk -F'\t' '
+    $0 == "--RAW--" { r = 1; next }
+    !r { if ($1 == "-" && $2 == "-") b[$3] = 1; next }
+    $0 == "" { next }
+    { split($1, m, " "); line = m[1] " " m[2] " " m[5] "\t" $2; if ($2 in b) line = line " " m[3] " " m[4]; print line }'
+}
+
+if [ "$SYNC" -eq 1 ]; then
+  # the PR's own change must be unchanged: compare the +/- lines of both 3-dot diffs (index/hunk numbers shift
+  # when base moves, content lines do not)
+  D_OLD=$(G diff --no-color --no-ext-diff --no-renames -U0 "origin/${BASE}...${REVIEWED}" 2>/dev/null); rc=$?
+  [ "$rc" -eq 0 ] || full
+  D_NEW=$(G diff --no-color --no-ext-diff --no-renames -U0 "origin/${BASE}...${HEAD_SHA}" 2>/dev/null); rc=$?
+  [ "$rc" -eq 0 ] || full
+  L_OLD=$(printf '%s\n' "$D_OLD" | sed -n '/^[-+]/p'); L_NEW=$(printf '%s\n' "$D_NEW" | sed -n '/^[-+]/p')
+  # +/- lines miss binary content and mode changes, so the per-path shape must match too
+  S_OLD=$(diff_shape "origin/${BASE}...${REVIEWED}") || full
+  S_NEW=$(diff_shape "origin/${BASE}...${HEAD_SHA}") || full
+  if [ "$L_OLD" = "$L_NEW" ] && [ "$S_OLD" = "$S_NEW" ]; then
+    echo "BASE_SYNC_ONLY ${REVIEWED}"; echo "FULL_ROUNDS=${ROUNDS}"; exit 0
+  fi
+fi
+
+echo "$DELTA_OUT"; echo "FULL_ROUNDS=${ROUNDS}"; exit 0