forgedock 1.14.0 → 1.16.0

package/scripts/check-spec-size.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# check-spec-size.sh — PR spec-size budget (forge#3762).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Usage: check-spec-size.sh [base_ref]     (default: $BASE_REF, else origin/staging)
+# Env:   PR_LABELS  comma-separated PR label names (untrusted; grep-matched only)
+#        PR_BODY    PR body text (untrusted; grep-matched only)
+#        GITHUB_STEP_SUMMARY  summary file (stdout when unset)
+# Exit:  0 pass/exempt, 1 budget violation, 2 usage/base-ref error (fail closed)
+#
+# Rules (against the PR base, compared in bytes):
+#   1. Budgeted specs may not grow by more than 2% or more than 4096 bytes.
+#   2. No commands/**/*.md file may gain a canonical block copy (per-file marker
+#      count may not rise). Count-based until the shared helper lands (#3493).
+#   Shrinking or equal size always passes.
+# Exemption: `spec-size-exempt` label, or a `<!-- spec-size-exempt: <reason> -->`
+# line with a non-empty reason in the PR body. Failures are reported, exit 0.
+# Bash 3.2 portable: no assoc arrays, mapfile, grep -P.
+set -uo pipefail
+
+BASE="${1:-${BASE_REF:-origin/staging}}"
+PCT_NUM=2            # 2%
+ABS_MAX=4096         # bytes
+BUDGETED="commands/review-pr.md commands/review-pr-staging.md commands/work-on/remediate.md commands/work-on/review.md commands/work-on.md"
+
+SUMMARY="${GITHUB_STEP_SUMMARY:-/dev/stdout}"
+out() { printf '%s\n' "$*" >> "$SUMMARY"; }
+
+if ! git rev-parse --verify -q "$BASE^{commit}" >/dev/null; then
+  echo "ERROR: base ref '$BASE' cannot be resolved (shallow checkout? need fetch-depth: 0)" >&2
+  exit 2
+fi
+
+# --- exemption -------------------------------------------------------------
+EXEMPT_REASON=""
+if printf '%s' "${PR_LABELS:-}" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -qxF 'spec-size-exempt'; then
+  EXEMPT_REASON="label spec-size-exempt"
+else
+  R=$(printf '%s\n' "${PR_BODY:-}" | tr -d '\r' \
+    | sed -n 's/^[[:space:]]*<!--[[:space:]]*spec-size-exempt:[[:space:]]*\(.*\)-->[[:space:]]*$/\1/p' \
+    | head -n 1 | sed 's/[[:space:]]*$//')
+  [ -n "$R" ] && EXEMPT_REASON="PR body marker: $R"
+fi
+
+FAILURES=0
+base_size() { git cat-file -s "$BASE:$1" 2>/dev/null || echo 0; }
+MARKERS='FORGE_ROOT bootstrap \(canonical|TRUSTED_SCRIPT=""|HELPER_SCRIPT=""|mkdir -p "\$_SD".*# FENCE_BOOTSTRAP'
+
+out "## Spec-size budget (base: \`$BASE\`)"
+out ""
+out "| File | Base | Head | Delta | Delta % | Status |"
+out "|------|-----:|-----:|------:|--------:|--------|"
+for f in $BUDGETED; do
+  [ -f "$f" ] || [ "$(base_size "$f")" != 0 ] || continue
+  b=$(base_size "$f")
+  h=0; [ -f "$f" ] && h=$(wc -c < "$f" | tr -d ' ')
+  g=$((h - b))
+  status="ok"
+  if [ "$g" -gt 0 ] && { [ $((g * 100)) -gt $((b * PCT_NUM)) ] || [ "$g" -gt "$ABS_MAX" ]; }; then
+    status="OVER BUDGET"; FAILURES=$((FAILURES + 1))
+  fi
+  if [ "$b" -gt 0 ]; then
+    p=$(awk -v g="$g" -v b="$b" 'BEGIN{printf "%+.2f%%", g*100/b}')
+  else p="n/a"; fi
+  out "| \`$f\` | $b | $h | $g | $p | $status |"
+done
+
+DUP_ROWS=""
+# Every commands/**/*.md present at head (new files have base count 0).
+for f in $(git ls-files 'commands/*.md' 'commands/**/*.md' | sort -u); do
+  [ -f "$f" ] || continue
+  hc=$(grep -cE "$MARKERS" "$f" 2>/dev/null || true); hc=${hc:-0}
+  bc=$(git show "$BASE:$f" 2>/dev/null | grep -cE "$MARKERS" 2>/dev/null || true); bc=${bc:-0}
+  if [ "$hc" -gt "$bc" ]; then
+    DUP_ROWS="$DUP_ROWS| \`$f\` | $bc | $hc | NEW CANONICAL BLOCK COPY |
+"
+    FAILURES=$((FAILURES + 1))
+  fi
+done
+if [ -n "$DUP_ROWS" ]; then
+  out ""
+  out "### Canonical block copies added (source the shared helper instead)"
+  out ""
+  out "| File | Base markers | Head markers | Status |"
+  out "|------|-----:|-----:|--------|"
+  printf '%s' "$DUP_ROWS" >> "$SUMMARY"
+fi
+
+out ""
+if [ "$FAILURES" -eq 0 ]; then
+  out "Result: PASS"
+  exit 0
+fi
+if [ -n "$EXEMPT_REASON" ]; then
+  out "Result: EXEMPT ($FAILURES violation(s) waived: $EXEMPT_REASON)"
+  echo "spec-size: $FAILURES violation(s) waived: $EXEMPT_REASON"
+  exit 0
+fi
+out "Result: FAIL ($FAILURES violation(s)). Shrink the spec, or add the spec-size-exempt label / a \`<!-- spec-size-exempt: <reason> -->\` line to the PR body."
+echo "spec-size: FAIL ($FAILURES violation(s)); see job summary" >&2
+exit 1

package/scripts/check-spec-size.test.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# check-spec-size.test.sh — cases for scripts/check-spec-size.sh (forge#3762).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+set -uo pipefail
+S="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/check-spec-size.sh"
+PASS=0; FAILN=0
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+ok() { PASS=$((PASS+1)); }
+bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
+
+git init -q --bare "$TMP/origin.git"
+git clone -q "$TMP/origin.git" "$TMP/w" 2>/dev/null
+cd "$TMP/w" || exit 1
+git config user.email t@example.com; git config user.name t
+mkdir -p commands/work-on
+gen() { awk -v n="$1" 'BEGIN{for(i=0;i<n;i++) print "line of spec text number " i}'; }
+gen 4000 > commands/review-pr.md          # ~110 KB: 2% ~ 2.2 KB < 4 KB cap
+gen 20000 > commands/work-on.md           # ~560 KB: 2% ~ 11 KB, so the 4 KB cap binds
+gen 100 > commands/other.md
+gen 100 > commands/work-on/remediate.md
+git add -A; git commit -qm base; git branch -M staging; git push -q origin staging 2>/dev/null
+git checkout -q -b feat
+
+reset() { git reset -q --hard origin/staging; git clean -qfd; }
+run() { # name want_rc [env...]
+  local name="$1" want="$2"; shift 2
+  local sum="$TMP/summary"; : > "$sum"
+  env GITHUB_STEP_SUMMARY="$sum" PR_LABELS="" PR_BODY="" "$@" bash "$S" origin/staging >"$TMP/out" 2>"$TMP/err"
+  local rc=$?
+  if [ "$rc" = "$want" ]; then ok; else bad "$name (rc=$rc want $want)"; cat "$TMP/err"; fi
+}
+has() { grep -qF "$2" "$TMP/summary" && ok || bad "$1 (summary lacks: $2)"; }
+
+reset; run "no change passes" 0
+has "summary shows delta table" "| File | Base | Head | Delta |"
+
+reset; gen 100 >> commands/review-pr.md   # +~2.8 KB on ~110 KB = ~2.5% (>2%, <4 KB)
+run "over 2% fails" 1; has "over-budget flagged" "OVER BUDGET"
+
+reset; gen 200 >> commands/work-on.md     # +~5.6 KB (<2% of 560 KB, >4 KB)
+run "over 4 KB fails" 1
+
+reset; gen 5 >> commands/review-pr.md     # small growth under both limits
+run "small growth passes" 0
+
+reset; gen 5000 >> commands/other.md      # not a budgeted spec
+run "non-budgeted growth passes" 0
+
+reset; gen 100 > commands/review-pr.md    # shrink
+run "shrink passes" 0
+
+reset; printf 'TRUSTED_SCRIPT=""\n' >> commands/other.md
+run "new TRUSTED_SCRIPT copy fails" 1; has "dup flagged" "NEW CANONICAL BLOCK COPY"
+
+reset; printf '_SD=x; mkdir -p "$_SD"   # FENCE_BOOTSTRAP\n' >> commands/other.md
+run "new FENCE_BOOTSTRAP anchor fails" 1
+
+reset; printf 'echo hi   # FENCE_BOOTSTRAP\n' >> commands/other.md
+run "non-anchor FENCE_BOOTSTRAP tag passes" 0
+
+reset; printf '# FORGE_ROOT bootstrap (canonical)\n' > commands/new-spec.md; git add -A
+run "new spec file with block fails" 1
+
+# Existing block, count unchanged or reduced, passes
+reset; printf 'HELPER_SCRIPT=""\n' >> commands/other.md; git commit -qam x; git push -q origin HEAD:staging 2>/dev/null
+git fetch -q origin staging
+run "unchanged count passes" 0
+: > commands/other.md; git add -A
+run "reduced count passes" 0
+
+# Exemption
+reset; gen 100 >> commands/review-pr.md
+run "exempt by label" 0 PR_LABELS="bug,spec-size-exempt"; has "label reported" "EXEMPT"
+run "exempt by body marker" 0 PR_BODY=$'text\n<!-- spec-size-exempt: security fix -->\nmore'; has "reason reported" "security fix"
+run "empty-reason marker not exempt" 1 PR_BODY='<!-- spec-size-exempt:  -->'
+run "label substring not exempt" 1 PR_LABELS="spec-size-exempt-not"
+
+# Fail closed on unresolvable base
+: > "$TMP/summary"
+GITHUB_STEP_SUMMARY="$TMP/summary" bash "$S" origin/does-not-exist >/dev/null 2>&1; rc=$?
+[ "$rc" = 2 ] && ok || bad "unresolved base fails closed (rc=$rc)"
+
+echo "check-spec-size.test: pass=$PASS fail=$FAILN"
+[ "$FAILN" -eq 0 ]

package/scripts/classify-finding.sh

@@ -51,7 +51,9 @@
 #                 earlier head of this PR or by a bundle's member PRs, one per line, columns
 #                 file<TAB>line-start<TAB>line-end<TAB>title<TAB>prior-disposition<TAB>issue#.
 #                 prior-disposition is `filed` (its issue is still open), `filed-closed` (issue closed:
-#                 the row is IGNORED so a regressed defect is classified normally) or `note`.
+#                 the row is IGNORED so a regressed defect is classified normally), `note` (a recorded NOTE) or
+#                 `unknown` (a reviewer-body row whose issue linkage failed: it is IGNORED for a MEDIUM
+#                 CONFIRMED/LIKELY finding so it can never suppress one, and behaves like `note` otherwise).
 #                 Line columns may be empty (NOTE-sourced rows carry no range). A finding re-flags a row
 #                 when it is the same file AND ((line IoU >= 0.6 and >= 1 shared title token), or >= 3 shared title tokens). Output is
 #                 `NOTE reflag-filed #N` (row has an issue number) or `NOTE reflag-note`; this gate never
@@ -180,7 +182,7 @@ if [ -n "$PRIOR_FINDINGS" ] && [ -n "$FINDING_FILE" ]; then
   case "$_rls" in ''|*[!0-9]*) _rls=""; _rle="" ;; esac
   case "$_rle" in ''|*[!0-9]*) _rle="$_rls" ;; esac
   _dmap="$DIFF_MAP"; { [ -n "$_dmap" ] && [ -r "$_dmap" ]; } || _dmap=""
-  _reflag=$(awk -F '\t' -v file="$_rpath" -v ls="$_rls" -v le="$_rle" -v title="$TITLE" -v dmap="$_dmap" '
+  _reflag=$(awk -F '\t' -v file="$_rpath" -v ls="$_rls" -v le="$_rle" -v title="$TITLE" -v dmap="$_dmap" -v sev="$SEV" -v conf="$CONF" '
     function toks(str, arr,    n, i, parts, t, c) {
       c = 0; str = tolower(str); gsub(/[^a-z0-9]+/, " ", str)
       n = split(str, parts, " ")
@@ -202,18 +204,23 @@ if [ -n "$PRIOR_FINDINGS" ] && [ -n "$FINDING_FILE" ]; then
         }
         close(dmap)
       }
+      # Generic words count toward the token set but never as topical similarity (#3719).
+      ns = split("the and with for from before after write read when that this into not are but can has have via use using does should may all any only also than then over under without within while where which what its it was were been being each both one two", sw, " ")
+      for (i = 1; i <= ns; i++) stop[sw[i]] = 1
       ntitle = toks(title, ft)
     }
     {
       pf = $1; sub(/^\.\//, "", pf)
       if (pf != file) next
       if ($5 == "filed-closed") next
+      if ($5 == "unknown" && sev == "MEDIUM" && (conf == "CONFIRMED" || conf == "LIKELY")) next
       hit = 0
-      delete pt; toks($4, pt); shared = 0
-      for (t in pt) if (t in ft) shared++
+      delete pt; toks($4, pt); shared = 0; cshared = 0
+      for (t in pt) if (t in ft) { shared++; if (!(t in stop)) cshared++ }
       # Line overlap alone is not a match (an unrelated finding can land on the same line): it also
-      # needs at least one shared title token. Title-only matching still needs >= 3.
-      if (shared >= 1 && ls != "" && $2 ~ /^[0-9]+$/) {
+      # needs at least one shared non-stopword title token. Title-only matching needs >= 3 shared
+      # tokens, of which >= 2 are non-stopword (generic words never count as topical similarity).
+      if (cshared >= 1 && ls != "" && $2 ~ /^[0-9]+$/) {
         ps = $2 + 0; pe = ($3 ~ /^[0-9]+$/) ? $3 + 0 : ps
         if (pe < ps) pe = ps
         d = shift(pf, ps, pe); ps += d; pe += d
@@ -222,7 +229,7 @@ if [ -n "$PRIOR_FINDINGS" ] && [ -n "$FINDING_FILE" ]; then
         uni = (pe - ps + 1) + (le - ls + 1) - inter
         if (uni > 0 && inter / uni >= 0.6) hit = 1
       }
-      if (!hit && ntitle >= 3 && shared >= 3) hit = 1
+      if (!hit && ntitle >= 3 && shared >= 3 && cshared >= 2) hit = 1
       if (!hit) next
       if ($5 == "filed" && $6 ~ /^#?[0-9]+$/) { n = $6; sub(/^#/, "", n); print "NOTE reflag-filed #" n; found = 1; exit }
       if (!note) note = "NOTE reflag-note"

package/scripts/classify-finding.test.sh

@@ -166,6 +166,7 @@ DMAP=$(mktemp "${TMPDIR:-/tmp}/classify-finding-dmap.XXXXXX")
   printf 'src/api.py\t10\t20\tmissing retry on timeout handler\tfiled\t123\n'
   printf 'src/closed.py\t5\t15\tstale cache entry never evicted\tfiled-closed\t77\n'
   printf 'src/notes.py\t\t\tduplicated predicate counted twice\tnote\t\n'
+  printf 'src/unlinked.py\t30\t40\tunvalidated redirect target in login handler\tunknown\t\n'
 } > "$PRIOR"
 PF=(--prior-findings "$PRIOR")
 M=(--severity MEDIUM --confidence CONFIRMED)
@@ -182,9 +183,17 @@ expect_out "NOTE reflag-note" "NOTE row with empty line columns matches by title
 expect ISSUE "same line, different topic MEDIUM CONFIRMED is not swallowed (SEC-1)" -- "${M[@]}" --agent security "${PF[@]}" --file src/sync.sh --line-start 42 --line-end 50 --title "SQL injection via unsanitized token"
 expect ISSUE "same line with no title at all is not swallowed" -- "${M[@]}" "${PF[@]}" --file src/sync.sh --line-start 42 --line-end 50
 expect_out "NOTE reflag-note" "same line, same topic (one shared token) still NOTE" -- "${M[@]}" "${PF[@]}" --file src/sync.sh --line-start 42 --line-end 50 --title "Lock handling is racy"
+expect ISSUE "same line, only a stopword-class word shared is not swallowed (#3719)" -- "${M[@]}" "${PF[@]}" --file src/sync.sh --line-start 42 --line-end 50 --title "Path traversal in the write target"
+expect ISSUE "far line, only generic words shared is not swallowed (#3719)" -- "${M[@]}" "${PF[@]}" --file src/sync.sh --line-start 300 --title "Command injection before write with the lock"
 expect ISSUE "non-overlapping same-file finding is classified normally" -- "${M[@]}" "${PF[@]}" --file src/sync.sh --line-start 200 --line-end 210 --title "missing bounds check"
 expect ISSUE "two shared tokens are not enough"       -- "${M[@]}" "${PF[@]}" --file src/sync.sh --line-start 200 --title "lock released late"
 expect ISSUE "same title on a different file is classified normally" -- "${M[@]}" "${PF[@]}" --file src/other.sh --line-start 45 --title "lock released before write completes"
+expect ISSUE "unknown row does not demote MEDIUM CONFIRMED (unlinked prior)" -- "${M[@]}" "${PF[@]}" --file src/unlinked.py --line-start 300 --title "Unvalidated redirect target in the login handler"
+expect ISSUE "unknown row does not demote MEDIUM CONFIRMED by line IoU" -- "${M[@]}" "${PF[@]}" --file src/unlinked.py --line-start 32 --line-end 40 --title "redirect target unchecked"
+expect ISSUE "unknown row does not demote MEDIUM LIKELY" -- --severity MEDIUM --confidence LIKELY "${PF[@]}" --file src/unlinked.py --line-start 300 --title "Unvalidated redirect target in the login handler"
+expect_out "NOTE reflag-note" "unknown row still demotes LOW" -- --severity LOW --confidence CONFIRMED "${PF[@]}" --file src/unlinked.py --line-start 300 --title "Unvalidated redirect target in the login handler"
+expect_out "NOTE reflag-note" "unknown row still demotes MEDIUM POSSIBLE" -- --severity MEDIUM --confidence POSSIBLE "${PF[@]}" --file src/unlinked.py --line-start 300 --title "Unvalidated redirect target in the login handler"
+expect ISSUE "HIGH unaffected by unknown row" -- --severity HIGH --confidence CONFIRMED "${PF[@]}" --file src/unlinked.py --line-start 300 --title "Unvalidated redirect target in the login handler"
 expect_out "NOTE reflag-filed #123" "re-flag of an already-filed issue links it" -- "${M[@]}" "${PF[@]}" --file src/api.py --line-start 12 --line-end 18 --title "retry x"
 expect_out "NOTE reflag-filed #123" "filed re-flag by title tokens" -- "${M[@]}" "${PF[@]}" --file src/api.py --line-start 99 --title "Missing retry on timeout"
 expect ISSUE "filed-closed row is ignored (regression not swallowed)" -- "${M[@]}" "${PF[@]}" --file src/closed.py --line-start 5 --line-end 15 --title "stale cache entry never evicted"

package/scripts/forge-root.test.sh

@@ -13,7 +13,7 @@ ok()  { PASS=$((PASS+1)); }
 bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
 expect() { [ "$2" = "$3" ] && ok || bad "$1 (got '$3' want '$2')"; }
 
-SITES="commands/work-on.md commands/work-on/build/validate.md commands/quality-gate.md commands/work-on/review.md commands/work-on/investigate.md commands/work-on/decompose.md commands/work-on/build.md commands/work-on/close.md commands/review-pr.md commands/orchestrate/phase-1-resolve.md commands/orchestrate/phase-4-execution.md"
+SITES="commands/work-on.md commands/work-on/build/validate.md commands/quality-gate.md commands/work-on/review.md commands/work-on/investigate.md commands/work-on/decompose.md commands/work-on/build.md commands/work-on/close.md commands/review-pr.md commands/work-on/remediate.md commands/orchestrate/phase-1-resolve.md commands/orchestrate/phase-4-execution.md"
 
 # extract the bootstrap block (comment line .. closing top-level fi), indentation stripped
 # Block ends at the first line (after the marker) that starts with `fi` at the marker's own indentation.
@@ -111,6 +111,23 @@ else
   echo "SKIP: symlink cases (this platform cannot create symlinks)"; SKIPPED=$((SKIPPED+1))
 fi
 
+# forge#3758 (hgate is a fixture of its own: the loop runs once per shell and h14 is reused below with other versions): deploy-gate script resolves on a plugin-only install (cache only, no symlink, no FORGE_* env).
+# The gate-script line is taken verbatim from the spec so the test exercises exactly what ships.
+mkscripts "$T/hgate/.claude/plugins/cache/forgedock/forgedock/1.0.0"; : > "$T/hgate/.claude/plugins/cache/forgedock/forgedock/1.0.0/scripts/resolve-deploy-gate.sh"
+grep -hE '^[[:space:]]*GATE_SCRIPT=""; \[ -n "\$FORGE_ROOT" \]' "$ROOT/commands/work-on/remediate.md" "$ROOT/commands/review-pr.md" | sed 's/^[[:space:]]*//' | sort -u > "$T/gs"
+expect "gate-script resolver line is identical across sites" 1 "$(wc -l < "$T/gs" | tr -d ' ')"
+gate_run() { ( cd "$T/consumer" && env -i PATH="$PATH" HOME="$1" "$SH" -c "$(cat "$T/canon"); $(cat "$T/gs"); printf %s \"\$GATE_SCRIPT\"" ); }
+expect "plugin-only install resolves resolve-deploy-gate.sh" "$T/hgate/.claude/plugins/cache/forgedock/forgedock/1.0.0/scripts/resolve-deploy-gate.sh" "$(gate_run "$T/hgate")"
+expect "unresolved gate script stays empty (strict)" "" "$(gate_run "$T/empty")"
+# cwd/consumer repo is never a candidate even when it carries the gate script
+: > "$T/consumer/scripts/resolve-deploy-gate.sh"
+expect "consumer repo gate script never used" "" "$(gate_run "$T/empty")"
+rm -f "$T/consumer/scripts/resolve-deploy-gate.sh"
+# no spec iterates CLAUDE_PLUGIN_ROOT as an env var for the gate script
+for f in commands/work-on/remediate.md commands/review-pr.md; do
+  grep -qF '"${CLAUDE_PLUGIN_ROOT:-}" "${FORGE_ROOT:-}"' "$ROOT/$f" && bad "env-style CLAUDE_PLUGIN_ROOT gate loop in $f" || ok
+done
+
 # newest cached version wins (1.10.0 must beat 1.9.0)
 for v in 1.9.0 1.10.0 1.2.0; do mkscripts "$T/h3/.claude/plugins/cache/forgedock/forgedock/$v"; done
 expect "newest cached version wins" "$T/h3/.claude/plugins/cache/forgedock/forgedock/1.10.0" "$(run "$T/h3")"
@@ -325,6 +342,8 @@ hr_check_block() { # label file var script
 hr_check_block review-pr "$HR_CLASSIFY" DERIVE_MILESTONE_SCRIPT derive-finding-milestone.sh
 hr_check_block review-pr "$HR_CLASSIFY" PRIORITY_SCRIPT severity-to-priority.sh
 hr_check_block review-pr "$HR_CLASSIFY" CODE_INDEX_SCRIPT code-index.sh
+hr_check_block review-pr "$HR_CLASSIFY" DEDUP_SCRIPT issue-dedup.sh
+hr_check_block issue "$ROOT/commands/issue.md" DEDUP_SCRIPT issue-dedup.sh
 hr_check_block review-pr-staging "$HR_STG" DERIVE_MILESTONE_SCRIPT derive-finding-milestone.sh
 hr_check_block review-pr-staging "$HR_STG" PRIORITY_SCRIPT severity-to-priority.sh
 extract_helper_block "$HR_CLASSIFY" DERIVE_MILESTONE_SCRIPT > "$T/hr_dm.sh"
@@ -334,6 +353,9 @@ extract_helper_block "$HR_STG" PRIORITY_SCRIPT > "$T/hr_pr_stg.sh"
 # only the variable-name-specific text may differ, and review-pr/review-pr-staging must agree
 cmp -s "$T/hr_dm.sh" "$T/hr_dm_stg.sh" && ok || bad 'DERIVE_MILESTONE_SCRIPT resolver differs between review-pr and review-pr-staging'
 cmp -s "$T/hr_pr.sh" "$T/hr_pr_stg.sh" && ok || bad 'PRIORITY_SCRIPT resolver differs between review-pr and review-pr-staging'
+extract_helper_block "$HR_CLASSIFY" DEDUP_SCRIPT > "$T/hr_dd.sh"
+extract_helper_block "$ROOT/commands/issue.md" DEDUP_SCRIPT > "$T/hr_dd_issue.sh"
+cmp -s "$T/hr_dd.sh" "$T/hr_dd_issue.sh" && ok || bad 'DEDUP_SCRIPT resolver differs between review-pr and issue'
 # no bare cwd-relative helper call in either review spec
 if grep -nE 'bash scripts/(derive-finding-milestone|severity-to-priority)\.sh' "$HR_CLASSIFY" "$HR_STG" >/dev/null 2>&1; then bad 'review spec still calls a helper by a bare scripts/ path'; else ok; fi
 
@@ -342,10 +364,25 @@ if grep -nE 'bash scripts/(derive-finding-milestone|severity-to-priority)\.sh' "
 #   design-bench.md, design-render-critique-loop.md, pipeline-health/phase-2-metrics.md, phase-3-dependency.md:
 #     node scripts/*.mjs run inside the ForgeDock repo itself or printed as user hints (not run under a PR checkout cwd).
 #   work-on/investigate.md, work-on/build/architect.md: {REPO_PATH}/scripts/code-index.sh, deferred to #3670.
+#   orchestrate/phase-3-dependency.md: scripts/worktree-lifecycle.sh lines sit in a roadmap/proposal fence, not executed.
 #   deploy-info.md: read-only grep of decrypt-secrets.sh, never executed.
-SCRIPTS_ALLOW='commands/(design-bench|design-render-critique-loop|deploy-info|pipeline-health/phase-2-metrics|pipeline-health/phase-3-dependency|work-on/investigate|work-on/build/architect)\.md'
-guard_hits=$(grep -rnE '(^|[^A-Za-z0-9_-])(bash|sh|source) +(\./)?scripts/[A-Za-z0-9_.-]+|REPO_PATH\}?/scripts/' "$ROOT/commands" 2>/dev/null \
-  | sed "s#^$ROOT/##" | grep -vE "^($SCRIPTS_ALLOW):" | grep -vE '^[^:]+:[0-9]+:[[:space:]]*#' || true)  # comment lines are prose
+SCRIPTS_ALLOW='commands/(design-bench|design-render-critique-loop|deploy-info|pipeline-health/phase-2-metrics|pipeline-health/phase-3-dependency|orchestrate/phase-3-dependency|work-on/investigate|work-on/build/architect)\.md'
+# Executed forms: a bash/sh/source word, a command substitution `$(scripts/x.sh`, or a line-start/after-;&&| direct `scripts/x.sh` / `./scripts/x.sh`.
+GUARD_RE='(^|[^A-Za-z0-9_-])(bash|sh|source) +(\./)?scripts/[A-Za-z0-9_.-]+|REPO_PATH\}?/scripts/|\$\( *(\./)?scripts/[A-Za-z0-9_.-]+\.sh|(^|:[0-9]+:|[;&(] *)[[:space:]]*(\./)?scripts/[A-Za-z0-9_.-]+\.sh'
+guard_scan() { # dir -> offending file:line:text rows (comment lines are prose)
+  grep -rnE "$GUARD_RE" "$1" 2>/dev/null | grep -vE '^[^:]+:[0-9]+:[[:space:]]*#' || true
+}
+guard_hits=$(guard_scan "$ROOT/commands" | sed "s#^$ROOT/##" | grep -vE "^($SCRIPTS_ALLOW):" || true)
+# Negative fixtures (#3679): a bare direct call must be flagged; backticked prose and comments must not.
+mkdir -p "$T/guardfx/bad1" "$T/guardfx/bad2" "$T/guardfx/bad3" "$T/guardfx/good"
+printf 'X=$(scripts/foo.sh a b)\n' > "$T/guardfx/bad1/x.md"
+printf 'scripts/foo.sh arg\n' > "$T/guardfx/bad2/x.md"
+printf 'ok && ./scripts/foo.sh\n' > "$T/guardfx/bad3/x.md"
+printf 'See `scripts/foo.sh` for details, forwarded to scripts/foo.sh --exclude.\n# $(scripts/foo.sh) in a comment\n' > "$T/guardfx/good/x.md"
+for f in bad1 bad2 bad3; do
+  [ -n "$(guard_scan "$T/guardfx/$f")" ] && ok || bad "widened guard missed direct execution fixture $f"
+done
+[ -z "$(guard_scan "$T/guardfx/good")" ] && ok || bad 'widened guard flags prose/comment fixture'
 if [ -n "$guard_hits" ]; then bad "commands/ has a cwd-relative or REPO_PATH helper call outside the allowlist: $(printf '%s' "$guard_hits" | head -5 | tr '\n' '|')"; else ok; fi
 
 # Behavior (#3596): planted cwd copies of the two review helpers must never be selected.

package/scripts/remediate-approved-head.test.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# remediate-approved-head.test.sh — the M7 CI-gated merge is bound to APPROVED_HEAD on every path (forge#3686)
+# Extracts the guard from commands/work-on/remediate.md and exercises it. No network. Usage: bash scripts/remediate-approved-head.test.sh
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+SPEC="$ROOT/commands/work-on/remediate.md"
+
+PASS=0; FAILN=0
+ok()  { PASS=$((PASS+1)); echo "ok   - $1"; }
+bad() { FAILN=$((FAILN+1)); echo "FAIL - $1"; }
+eq()  { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1 (got '$2', want '$3')"; fi; }
+
+grep -qE 'GATED_HEAD" != "\$\{?APPROVED_HEAD' "$SPEC" && ok "spec compares GATED_HEAD to APPROVED_HEAD" || bad "spec compares GATED_HEAD to APPROVED_HEAD"
+grep -qF 'if [ "${RESUME_AT_M7:-false}" = "true" ] && [ "$CI_GATE_RC" -eq 0 ]' "$SPEC" && bad "guard is no longer resume-only" || ok "guard is no longer resume-only"
+
+# Extract the guard fence body (from the scratch reload through the closing fi) and run it per case.
+GUARD=$(awk '/^_SD="\$\{FORGE_SCRATCHPAD/ && !g {g=1} g {print} g && /^fi$/ {exit}' "$SPEC")
+[ -n "$GUARD" ] && ok "guard block extracted" || bad "guard block extracted"
+
+# run_guard <persisted head or NONE> <GATED_HEAD> <CI_GATE_RC> <RESUME_AT_M7>
+run_guard() {
+  local d; d=$(mktemp -d)
+  [ "$1" = NONE ] || printf '%s\n' "$1" > "$d/remediate_approved_head_7"
+  FORGE_SCRATCHPAD="$d" GATED_HEAD="$2" CI_GATE_RC="$3" RESUME_AT_M7="$4" CI_GATE_OUT="" \
+    bash -c "${GUARD//\{PR_NUMBER\}/7}"$'\nprintf %s "$CI_GATE_RC"'
+  rm -rf "$d"
+}
+A=$(printf 'a%.0s' {1..40}); B=$(printf 'b%.0s' {1..40})
+for r in true false; do
+  eq "match merges (resume=$r)" "$(run_guard "$A" "$A" 0 $r)" 0
+  eq "mismatch refuses (resume=$r)" "$(run_guard "$A" "$B" 0 $r)" 4
+  eq "missing approved head refuses (resume=$r)" "$(run_guard NONE "$A" 0 $r)" 4
+  eq "malformed approved head refuses (resume=$r)" "$(run_guard "zz" "$A" 0 $r)" 4
+  eq "empty gated head refuses (resume=$r)" "$(run_guard "$A" "" 0 $r)" 4
+  eq "nonzero rc is unchanged (resume=$r)" "$(run_guard "$A" "$B" 3 $r)" 3
+done
+
+echo "passed=$PASS failed=$FAILN"
+[ "$FAILN" -eq 0 ]

package/scripts/remediation-marker-match.test.sh

@@ -28,6 +28,8 @@ INTERIM=$'<!-- FORGE:REMEDIATION -->\n## Remediation (in progress)'
 QUOTED_REVIEW=$'## Review\nThe prior run posted FORGE:REMEDIATION:COMPLETE on this PR.\n<!-- FORGE:REMEDIATION:COMPLETE -->'
 QUOTED_WORK_ORDER=$'<!-- FORGE:INPR_FIX: head=abc1234 -->\nquoting <!-- FORGE:REMEDIATION -->\n<!-- FORGE:REMEDIATION:COMPLETE -->'
 
+HELD=$'<!-- FORGE:REMEDIATION_HELD -->\n**Re-gate outcome**: HELD-AWAITING-MERGE'
+eq "held-resume record matches neither COMPLETE nor TRAIL (forge#3685)" "$(complete_n "[$(c NONE Bot b "$HELD")]")/$(trail_n "[$(c NONE Bot b "$HELD")]")" "0/0"
 eq "genuine M8 trail by bot matches COMPLETE" "$(complete_n "[$(c NONE Bot 'app[bot]' "$REAL")]")" 1
 eq "review comment quoting COMPLETE mid-body does not match" "$(complete_n "[$(c OWNER User u "$QUOTED_REVIEW")]")" 0
 eq "INPR_FIX work order quoting the markers does not match COMPLETE" "$(complete_n "[$(c NONE Bot b "$QUOTED_WORK_ORDER")]")" 0
@@ -47,5 +49,9 @@ for f in commands/work-on/remediate.md commands/work-on.md commands/orchestrate/
 done
 grep -qF "count '$COMPLETE_RE'" "$ROOT/commands/work-on/remediate.md" && ok "remediate.md uses the tested COMPLETE regex" || bad "remediate.md COMPLETE regex drifted from this test"
 
+grep -qF 'FORGE:REMEDIATION_HELD' "$ROOT/commands/work-on/remediate.md" && ok "remediate.md documents FORGE:REMEDIATION_HELD" || bad "remediate.md lacks FORGE:REMEDIATION_HELD"
+! grep -qE 'PR_OPEN_STATE = .?MERGED.? → EXIT .REMEDIATE_RESULT: status: ALREADY_DONE. \(nothing to remediate' "$ROOT/commands/work-on/remediate.md" && ok "M0 has no unconditional merged ALREADY_DONE exit" || bad "M0 still exits ALREADY_DONE unconditionally on MERGED"
+grep -qiE 'merged.*(skip|exclusive|do not fall through)' "$ROOT/commands/work-on/remediate.md" && ok "M7 merged-first branch is exclusive" || bad "M7 merged-first exclusivity missing"
+
 echo "passed=$PASS failed=$FAILN"
 [ "$FAILN" -eq 0 ]

package/scripts/resolve-deploy-gate.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# resolve-deploy-gate.sh — trusted deploy-gate resolver (forge#3753)
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Usage: resolve-deploy-gate.sh <base> <owner/repo>
+#
+# Prints exactly one line: `true` (deploy gate, strict human bar) or `false`
+# (fast lane). Always exits 0; every failure path prints `true` (fail closed).
+#
+# A base is the deploy gate when it is empty/`null`, the literal `main` (hard
+# floor), the repository's GitHub default branch (`default_branch`), or the
+# `branches.default` of the default branch's COMMITTED forge.yaml
+# (`origin/<default>:forge.yaml`, falling back to the contents API) or of an
+# explicit trusted config (FORGE_TRUSTED_CONFIG, orchestrator-supplied).
+#
+# It NEVER reads forge.yaml from $PWD: the PR worktree is author-controlled, so
+# a PR could otherwise redefine which branch counts as the deploy gate.
+# Config sources can only ADD gate branches; main and the GitHub default are
+# unconditional, so no source relaxes the bar below the literal-main floor.
+set -uo pipefail
+
+BASE="${1:-}"
+REPO="${2:-}"
+
+emit() { printf '%s\n' "$1"; exit 0; }
+
+{ [ -z "$BASE" ] || [ "$BASE" = "null" ] || [ "$BASE" = "main" ]; } && emit true
+[ -n "$REPO" ] || emit true
+
+GH_DEFAULT=$(gh api "repos/${REPO}" --jq .default_branch 2>/dev/null || echo "")
+{ [ -z "$GH_DEFAULT" ] || [ "$GH_DEFAULT" = "null" ]; } && emit true
+[ "$BASE" = "$GH_DEFAULT" ] && emit true
+
+_cfg_default() { yq '.branches.default // ""' 2>/dev/null || true; }
+
+CFG_DEFAULT=""
+# Committed default-branch config only (a ref, never the working tree).
+CFG_DEFAULT=$(git show "origin/${GH_DEFAULT}:forge.yaml" 2>/dev/null | _cfg_default)
+if [ -z "$CFG_DEFAULT" ]; then
+  CFG_DEFAULT=$(gh api "repos/${REPO}/contents/forge.yaml?ref=${GH_DEFAULT}" --jq .content 2>/dev/null \
+    | base64 -d 2>/dev/null | _cfg_default)
+fi
+[ -n "$CFG_DEFAULT" ] && [ "$CFG_DEFAULT" != "null" ] && [ "$BASE" = "$CFG_DEFAULT" ] && emit true
+
+if [ -n "${FORGE_TRUSTED_CONFIG:-}" ] && [ -f "$FORGE_TRUSTED_CONFIG" ]; then
+  TRUSTED=$(_cfg_default < "$FORGE_TRUSTED_CONFIG")
+  [ -n "$TRUSTED" ] && [ "$TRUSTED" != "null" ] && [ "$BASE" = "$TRUSTED" ] && emit true
+fi
+
+emit false

package/scripts/resolve-deploy-gate.test.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# resolve-deploy-gate.test.sh — cases for scripts/resolve-deploy-gate.sh (forge#3753).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+set -uo pipefail
+S="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/resolve-deploy-gate.sh"
+PASS=0; FAILN=0
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+ok() { PASS=$((PASS+1)); }
+bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
+
+command -v yq >/dev/null 2>&1 || { echo "SKIP: yq not installed"; exit 0; }
+
+# Stub gh: GH_DEFAULT_STUB drives `repos/<r> --jq .default_branch`; contents API unused (fails).
+mkdir -p "$TMP/bin"
+cat > "$TMP/bin/gh" <<'EOF'
+#!/usr/bin/env bash
+case "$*" in
+  *"--jq .default_branch"*) [ -n "${GH_FAIL:-}" ] && exit 1; printf '%s\n' "${GH_DEFAULT_STUB:-}" ;;
+  *) exit 1 ;;
+esac
+EOF
+chmod +x "$TMP/bin/gh"
+
+# Repo fixture: origin/<default> committed forge.yaml, plus a PR worktree dir with its own forge.yaml.
+ORIGIN="$TMP/origin.git"; REPO="$TMP/repo"
+git init -q --bare "$ORIGIN"
+git init -q "$REPO"; git -C "$REPO" config user.email t@t; git -C "$REPO" config user.name t
+printf 'branches:\n  default: develop\n' > "$REPO/forge.yaml"
+git -C "$REPO" add forge.yaml; git -C "$REPO" commit -qm init
+git -C "$REPO" branch -M trunk
+git -C "$REPO" remote add origin "$ORIGIN"; git -C "$REPO" push -q origin trunk 2>/dev/null
+git -C "$REPO" fetch -q origin
+# PR worktree content: attacker redefines the deploy gate.
+printf 'branches:\n  default: release\n' > "$REPO/forge.yaml"
+
+run() { # base default_stub [env...]
+  local base="$1" def="$2"; shift 2
+  (cd "$REPO" && env PATH="$TMP/bin:$PATH" GH_DEFAULT_STUB="$def" "$@" bash "$S" "$base" owner/repo)
+}
+expect() { [ "$1" = "$2" ] && ok || bad "$3: got '$1' want '$2'"; }
+
+expect "$(run main trunk)" true "main with worktree release"
+expect "$(run release trunk)" false "worktree-declared branch is not a gate"
+expect "$(run staging trunk)" false "staging is fast lane"
+expect "$(run trunk trunk)" true "github default"
+expect "$(run master master)" true "github default master"
+expect "$(run develop trunk)" true "committed origin config default"
+expect "$(run '' trunk)" true "empty base"
+expect "$(run null trunk)" true "null base"
+expect "$(run staging '')" true "empty gh default fails closed"
+expect "$(run staging trunk GH_FAIL=1)" true "gh failure fails closed"
+expect "$(run main '' GH_FAIL=1)" true "main on gh failure"
+printf 'branches:\n  default: prod\n' > "$TMP/trusted.yaml"
+expect "$(run prod trunk FORGE_TRUSTED_CONFIG="$TMP/trusted.yaml")" true "trusted config default"
+expect "$(run prod trunk)" false "prod without trusted config"
+
+echo "resolve-deploy-gate.test.sh: $PASS passed, $FAILN failed"
+[ "$FAILN" -eq 0 ]

package/scripts/review-pr-delta-wiring.test.sh

@@ -120,8 +120,16 @@ expect "round 2 narrows to security by default" "security" "$(roster 2 'security
 expect "round 2 adds a path-triggered domain" "security auth" "$(roster 2 'security auth billing' $'README.md\nsrc/auth/login.py')"
 expect "round 3 cap holds" "security" "$(roster 3 'security auth billing database' 'docs/notes.txt')"
 expect "claim/lease paths trigger concurrency" "security concurrency" "$(roster 2 'security' 'engine/claim-lease.txt')"
+export REPO_PATH="$ROOT"   # ForgeDock itself: the persona file exists
 expect "commands/** triggers spec-cli" "security spec-cli" "$(roster 2 'security' 'commands/foo.md')"
 expect "bin/** triggers spec-cli" "security spec-cli" "$(roster 2 'security' 'bin/foo.mjs')"
+# consumer repo layout: no persona file, so no spec-cli
+mkdir -p "$TMP/consumer/bin" "$TMP/consumer/commands"
+export REPO_PATH="$TMP/consumer"
+expect "consumer bin/ gets no spec-cli" "security" "$(roster 2 'security' 'bin/foo.mjs')"
+expect "consumer commands/ gets no spec-cli" "security" "$(roster 2 'security' 'commands/foo.md')"
+expect "consumer with another trigger keeps it, no spec-cli" "security auth" "$(roster 2 'security' $'bin/foo.mjs\nsrc/auth/login.py')"
+unset REPO_PATH
 expect "non-numeric rounds fail to the 3B roster" "security auth" "$(roster 'x' 'security auth' 'README.md')"
 
 # ---- 3. mode resolution through the real fence ----------------------------------------------------------------------

package/scripts/review-pr-domain-map.test.sh

@@ -83,5 +83,15 @@ done
 # Test 6: the protocol defines the marker domain through the mapping
 if grep -qF 'marker domain' "$PERSONAS/protocols.md"; then ok; else bad "protocols.md does not define the marker domain"; fi
 
+# Test 7: the roster regexes in delta_roster must equal the DOMAIN_FILES_* regexes, and every domain needs an empty-slice fallback
+for pair in AUTH:auth BILLING:billing CONCURRENCY:concurrency DATABASE:database INFRA:infra SCRAPING:scraper FRONTEND:frontend API:api; do
+  var=${pair%%:*}; dom=${pair#*:}
+  a=$(grep -E "^DOMAIN_FILES_$var=" "$SPEC" | head -n 1 | sed -n 's/.*grep -iE "\([^"]*\)".*/\1/p')
+  b=$(grep -F "&& out=\"\$out $dom\"" "$SPEC" | grep 'grep -qiE' | head -n 1 | sed -n 's/.*grep -qiE "\([^"]*\)".*/\1/p')
+  if [ -z "$a" ] || [ -z "$b" ]; then bad "could not extract $var pattern (DOMAIN_FILES='$a' delta_roster='$b')"
+  elif [ "$a" = "$b" ]; then ok; else bad "$var regex drifted: DOMAIN_FILES='$a' delta_roster='$b'"; fi
+  if grep -qF "[ -z \"\$DOMAIN_FILES_$var\" ] && DOMAIN_FILES_$var=\"\$FILES\"" "$SPEC"; then ok; else bad "no empty-slice fallback for DOMAIN_FILES_$var"; fi
+done
+
 echo "review-pr-domain-map: $pass passed, $fail failed"
 [ "$fail" -eq 0 ]