forgedock 1.15.0 → 1.16.0

package/bin/engine/phases.mjs

@@ -218,6 +218,15 @@ function hasPhaseComplete(comments) {
   return hasMarker(comments, "FORGE:PHASE:COMPLETE", "FORGE:PHASE:COMPLETE");
 }
 
+/**
+ * close.md's own idempotency key: a trusted FORGE:TRAJECTORY comment. Shared by close.reconcile
+ * and close.detectOutcome so the two cannot drift. Throws on fetch error; callers fail closed.
+ */
+async function hasTrajectory(issue, io) {
+  const { comments } = await issueMarkers(issue, io);
+  return comments.some((b) => startsWithHeader(b, "FORGE:TRAJECTORY"));
+}
+
 /**
  * Trusted comment bodies, chronological — the same single fetch + trust predicate
  * as issueMarkers() (one path, forge#3542). Fail closed: a fetch error yields `[]` here (issueMarkers itself propagates it).
@@ -960,8 +969,7 @@ export const PHASES = [
         // proof close.md ran (board, summary, trajectory). Its own idempotency key is the
         // FORGE:TRAJECTORY comment; only that makes this satisfied.
         try {
-          const { comments } = await issueMarkers(state.issue, io);
-          return { satisfied: comments.some((b) => startsWithHeader(b, "FORGE:TRAJECTORY")), terminalReason: "investigation" };
+          return { satisfied: await hasTrajectory(state.issue, io), terminalReason: "investigation" };
         } catch { return { satisfied: false }; }
       }
       if (snap.state === "CLOSED") return { satisfied: true };
@@ -992,8 +1000,17 @@ export const PHASES = [
       if (snap.labels.includes(PHASE_MARKERS.close.completionLabel))
         return { status: "committed", terminalReason: "merged", outputs: {} };
       // forge#3534: an investigation exit closes the issue itself; keep that reason honest.
-      if (snap.state === "CLOSED")
-        return { status: "committed", terminalReason: state.terminalReason === "investigation" ? "investigation" : "invalid", outputs: {} };
+      if (snap.state === "CLOSED") {
+        if (state.terminalReason !== "investigation")
+          return { status: "committed", terminalReason: "invalid", outputs: {} };
+        // The issue is always already CLOSED for an investigation run, so require the same
+        // positive evidence as reconcile (a trusted FORGE:TRAJECTORY); fail closed on error.
+        let ran = false;
+        try { ran = await hasTrajectory(state.issue, io); } catch { ran = false; }
+        return ran
+          ? { status: "committed", terminalReason: "investigation", outputs: {} }
+          : { status: "failed", detail: "investigation close: no FORGE:TRAJECTORY" };
+      }
       // forge#3545: PHASE_COMPLETE is a valid close exit (multi-phase issue: PR merged,
       // issue deliberately left OPEN). Only the current cycle's marker counts.
       if (snap.state === "OPEN") {

package/bin/engine/runlog.mjs

@@ -61,6 +61,8 @@ export function deriveState(events) {
               remediationKind: null };
   // forge#3528: handoff reason of the LAST PHASE_COMMIT only (replaced, not sticky).
   let lastCommitReason = null;
+  // forge#3754: phase of the LAST PHASE_COMMIT, so a reopen can tell a remediate-terminal run.
+  let lastCommitPhase = null;
   for (const e of events) {
     switch (e.event) {
       case "RUN_START":
@@ -75,6 +77,7 @@ export function deriveState(events) {
         // remediate instead of defaulting to a "merged" close.
         if (e.terminalReason) s.terminalReason = e.terminalReason;
         lastCommitReason = e.terminalReason ?? null;
+        lastCommitPhase = e.phase ?? null;
         // forge#3530: the review's remediation kind must survive resume. A later review
         // commit replaces it; a committed remediate consumes it, so it is never reused.
         if (e.phase === "review") s.remediationKind = e.outputs?.remediation ?? null;
@@ -91,6 +94,12 @@ export function deriveState(events) {
       // retry re-enters remediate/decompose instead of close/build.
       case "RUN_REOPEN":
         s.terminal = false; s.terminalReason = lastCommitReason; s.v = e.seq;
+        // forge#3754: a remediate that ended needs-human is re-run after a human clears the
+        // label. Un-commit it (new array, no in-place mutation) so the forge#3506 resume guard
+        // does not re-terminate and remediate's entryCondition re-selects it.
+        if (lastCommitPhase === "remediate" && lastCommitReason === "needs-human") {
+          s.committed = s.committed.filter((p) => p !== "remediate");
+        }
         break;
       // forge#3562: an explicit `run-issue --retry` on a `phase-complete` run
       // (multi-phase issue: this phase merged, more remain) starts a NEW cycle.
@@ -102,7 +111,7 @@ export function deriveState(events) {
       case "RUN_NEXT_CYCLE":
         s.terminal = false; s.terminalReason = null; s.committed = [];
         s.branch = null; s.pr = null; s.remediationKind = null;
-        lastCommitReason = null; s.v = e.seq;
+        lastCommitReason = null; lastCommitPhase = null; s.v = e.seq;
         break;
       // forge#2524: a session-limit pause is purely informational — it does
       // NOT touch committed/terminal/terminalReason. The phase that hit the

package/bin/engine.mjs

@@ -514,6 +514,8 @@ export async function runIssue(opts) {
     // must honour that reason instead of picking the next phase (close would throw in buildArgs
     // and end as engine-error; build would run on a decomposed parent). Review's `needs-human`
     // is a handoff to remediate, so only these committed phases trigger the guard.
+    // forge#3754: a reopened (--retry) remediate-terminal run has `remediate` un-committed by the
+    // run-log reducer, so this guard does not fire and remediate re-runs.
     if (state.terminalReason && TERMINAL_REASONS.includes(state.terminalReason) &&
         ((state.committed.includes("remediate") && !["merged", "decomposed", "invalid"].includes(state.terminalReason)) ||
          (state.committed.includes("decompose") && state.terminalReason === "decomposed") ||

package/commands/forge-stats.md

@@ -52,6 +52,16 @@ Commands are classified by role. Each role has a max line count — beyond this,
 
 ---
 
+## CI Spec-Size Budget
+
+`scripts/check-spec-size.sh` (job `spec-size-budget` in `check-commands.yml`, PRs only) enforces a budget that is independent of the line-count `.baselines`; the baseline is refreshed on release via `/forge-stats baseline`. It compares bytes against the PR base:
+
+- `review-pr.md`, `review-pr-staging.md`, `work-on/remediate.md`, `work-on/review.md`, `work-on.md` may not grow by more than 2% or 4 KB. Shrinking always passes.
+- No `commands/**` file may gain a copy of a canonical block (FORGE_ROOT bootstrap, TRUSTED_SCRIPT/HELPER_SCRIPT resolver, FENCE_BOOTSTRAP anchor); the per-file marker count may not rise. Tighten to an outright ban once the shared helper (#3493) lands.
+- Exemption: the `spec-size-exempt` PR label, or a `<!-- spec-size-exempt: <reason> -->` line in the PR body (non-empty reason). The job summary lists the per-file delta and any waiver.
+
+---
+
 ## Mode: `diff` (default)
 
 Compare current line counts against the last git commit. Shows what grew and what shrank.

package/commands/review-pr-staging.md

@@ -1190,7 +1190,11 @@ if [ -n "$REVIEW_SHA_FULL" ] && [ -n "$TRUSTED_SCRIPT" ]; then
     | jq -r 'scan("^<!-- FORGE:REVIEW-AGENT:([a-z0-9-]+) -->") | .[0]' 2>/dev/null | sort -u | grep -c . || echo 0)
 fi
 case "$ACTUAL_AGENT_COUNT" in ''|*[!0-9]*) ACTUAL_AGENT_COUNT=0 ;; esac   # fail closed: unreadable or untrusted counts as not posted
-if [ "$DISPATCH_FAILED" = "true" ] || [ "$ACTUAL_AGENT_COUNT" -lt "$SELECTED_AGENT_COUNT" ]; then
+# Fresh shell: SELECTED_AGENT_COUNT is not carried over. Reload it from the PR-keyed launched-agent file, then fail closed when it is empty, non-integer or zero (a staging review always selects at least one reviewer).
+[ -n "${SELECTED_AGENT_COUNT:-}" ] || { [ -n "${PR_NUMBER:-}" ] && [ -r "$_SD/${PR_NUMBER}_launched_review_agents" ] && SELECTED_AGENT_COUNT=$(grep -E '^[a-z0-9-]+$' "$_SD/${PR_NUMBER}_launched_review_agents" | sort -u | grep -c .); }
+SELECTED_COUNT_INVALID=false
+case "${SELECTED_AGENT_COUNT:-}" in ''|*[!0-9]*|0) SELECTED_COUNT_INVALID=true; SELECTED_AGENT_COUNT=0 ;; esac
+if [ "${DISPATCH_FAILED:-}" = "true" ] || [ "$SELECTED_COUNT_INVALID" = "true" ] || [ "$ACTUAL_AGENT_COUNT" -lt "$SELECTED_AGENT_COUNT" ]; then
   gh label create "review-degraded" --color "E4E669" --description "PR review panel was incomplete; re-review required before deployment. Managed by ForgeDock." --force -R "$GH_REPO" 2>/dev/null || true
   gh pr edit "$PR_NUMBER" -R "$GH_REPO" --add-label "review-degraded" --add-label "needs-human" 2>/dev/null || true # allowlist:check-command-side-effects
   gh pr comment "$PR_NUMBER" -R "$GH_REPO" --body "<!-- FORGE:GATE_FAILURE:TYPE=review-panel-integrity -->
@@ -1222,6 +1226,12 @@ CONFIG_FILE="${FORGE_CONFIG:-forge.yaml}"   # FENCE_BOOTSTRAP
 [ -n "${PR_NUMBER:-}" ] || echo "WARNING: PR_NUMBER is empty after reload (no staging_pr_number in $_SD): this fence cannot key its scratch files or post to a PR."   # FENCE_BOOTSTRAP
 # Reload the launched-agent list persisted at dispatch (validated: lowercase marker domains only).
 [ -n "${LAUNCHED_REVIEW_AGENTS:-}" ] || { [ -r "$_SD/${PR_NUMBER}_launched_review_agents" ] && LAUNCHED_REVIEW_AGENTS=$(grep -E '^[a-z0-9-]+$' "$_SD/${PR_NUMBER}_launched_review_agents" | sort -u | tr '\n' ' '); }
+# Fail closed: a staging review always launches at least the Phase 2 material-change agent, so an empty list means lost state or skipped bookkeeping, never "nothing to verify".
+if [ -z "${PR_NUMBER:-}" ] || [ -z "${LAUNCHED_REVIEW_AGENTS:-}" ]; then
+  echo "REVIEW DELIVERY FAILURE: launched-agent list is empty or unreadable (PR_NUMBER='${PR_NUMBER:-}')"
+  echo "Recover the launched reviewer domains from the PR's FORGE:REVIEW-AGENT comments, re-append them to the launched-agent file, and rerun."
+  exit 1
+fi
 MISSING_AGENT_COMMENTS=""
 # Each Bash call is a fresh shell: re-resolve the full head SHA if it is not set, and refuse when it is not a commit id
 # (an empty SHA would make the Reviewed-SHA match accept any head).
@@ -1256,7 +1266,7 @@ if [ -n "$MISSING_AGENT_COMMENTS" ]; then
 fi
 ```
 
-Missing comments are an explicit failure, never evidence of no findings. Do not triage or synthesize a deploy verdict while any launched agent is unaccounted for.
+An empty or unreadable launched-agent list is also a delivery failure (the fence exits 1), never evidence that nothing needed verifying; recover the list from the PR comments and rerun. Missing comments are an explicit failure, never evidence of no findings. Do not triage or synthesize a deploy verdict while any launched agent is unaccounted for.
 
 ### 7A: Extract Findings
 Only findings inside trusted, current-head reviewer comments count: the head SHA is public, so an untrusted commenter must never be able to inject `FINDING` markers that get filed as issues. Read every page of comments, fail closed when the trust script or comments are unreadable (never fall through to "no findings").

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgedock",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "description": "Autonomous development pipeline for coding agents. GitHub as institutional memory, with native Claude Code and OpenCode entrypoints.",
   "bin": {
     "forgedock": "bin/forgedock.mjs"

package/scripts/check-spec-size.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# check-spec-size.sh — PR spec-size budget (forge#3762).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Usage: check-spec-size.sh [base_ref]     (default: $BASE_REF, else origin/staging)
+# Env:   PR_LABELS  comma-separated PR label names (untrusted; grep-matched only)
+#        PR_BODY    PR body text (untrusted; grep-matched only)
+#        GITHUB_STEP_SUMMARY  summary file (stdout when unset)
+# Exit:  0 pass/exempt, 1 budget violation, 2 usage/base-ref error (fail closed)
+#
+# Rules (against the PR base, compared in bytes):
+#   1. Budgeted specs may not grow by more than 2% or more than 4096 bytes.
+#   2. No commands/**/*.md file may gain a canonical block copy (per-file marker
+#      count may not rise). Count-based until the shared helper lands (#3493).
+#   Shrinking or equal size always passes.
+# Exemption: `spec-size-exempt` label, or a `<!-- spec-size-exempt: <reason> -->`
+# line with a non-empty reason in the PR body. Failures are reported, exit 0.
+# Bash 3.2 portable: no assoc arrays, mapfile, grep -P.
+set -uo pipefail
+
+BASE="${1:-${BASE_REF:-origin/staging}}"
+PCT_NUM=2            # 2%
+ABS_MAX=4096         # bytes
+BUDGETED="commands/review-pr.md commands/review-pr-staging.md commands/work-on/remediate.md commands/work-on/review.md commands/work-on.md"
+
+SUMMARY="${GITHUB_STEP_SUMMARY:-/dev/stdout}"
+out() { printf '%s\n' "$*" >> "$SUMMARY"; }
+
+if ! git rev-parse --verify -q "$BASE^{commit}" >/dev/null; then
+  echo "ERROR: base ref '$BASE' cannot be resolved (shallow checkout? need fetch-depth: 0)" >&2
+  exit 2
+fi
+
+# --- exemption -------------------------------------------------------------
+EXEMPT_REASON=""
+if printf '%s' "${PR_LABELS:-}" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -qxF 'spec-size-exempt'; then
+  EXEMPT_REASON="label spec-size-exempt"
+else
+  R=$(printf '%s\n' "${PR_BODY:-}" | tr -d '\r' \
+    | sed -n 's/^[[:space:]]*<!--[[:space:]]*spec-size-exempt:[[:space:]]*\(.*\)-->[[:space:]]*$/\1/p' \
+    | head -n 1 | sed 's/[[:space:]]*$//')
+  [ -n "$R" ] && EXEMPT_REASON="PR body marker: $R"
+fi
+
+FAILURES=0
+base_size() { git cat-file -s "$BASE:$1" 2>/dev/null || echo 0; }
+MARKERS='FORGE_ROOT bootstrap \(canonical|TRUSTED_SCRIPT=""|HELPER_SCRIPT=""|mkdir -p "\$_SD".*# FENCE_BOOTSTRAP'
+
+out "## Spec-size budget (base: \`$BASE\`)"
+out ""
+out "| File | Base | Head | Delta | Delta % | Status |"
+out "|------|-----:|-----:|------:|--------:|--------|"
+for f in $BUDGETED; do
+  [ -f "$f" ] || [ "$(base_size "$f")" != 0 ] || continue
+  b=$(base_size "$f")
+  h=0; [ -f "$f" ] && h=$(wc -c < "$f" | tr -d ' ')
+  g=$((h - b))
+  status="ok"
+  if [ "$g" -gt 0 ] && { [ $((g * 100)) -gt $((b * PCT_NUM)) ] || [ "$g" -gt "$ABS_MAX" ]; }; then
+    status="OVER BUDGET"; FAILURES=$((FAILURES + 1))
+  fi
+  if [ "$b" -gt 0 ]; then
+    p=$(awk -v g="$g" -v b="$b" 'BEGIN{printf "%+.2f%%", g*100/b}')
+  else p="n/a"; fi
+  out "| \`$f\` | $b | $h | $g | $p | $status |"
+done
+
+DUP_ROWS=""
+# Every commands/**/*.md present at head (new files have base count 0).
+for f in $(git ls-files 'commands/*.md' 'commands/**/*.md' | sort -u); do
+  [ -f "$f" ] || continue
+  hc=$(grep -cE "$MARKERS" "$f" 2>/dev/null || true); hc=${hc:-0}
+  bc=$(git show "$BASE:$f" 2>/dev/null | grep -cE "$MARKERS" 2>/dev/null || true); bc=${bc:-0}
+  if [ "$hc" -gt "$bc" ]; then
+    DUP_ROWS="$DUP_ROWS| \`$f\` | $bc | $hc | NEW CANONICAL BLOCK COPY |
+"
+    FAILURES=$((FAILURES + 1))
+  fi
+done
+if [ -n "$DUP_ROWS" ]; then
+  out ""
+  out "### Canonical block copies added (source the shared helper instead)"
+  out ""
+  out "| File | Base markers | Head markers | Status |"
+  out "|------|-----:|-----:|--------|"
+  printf '%s' "$DUP_ROWS" >> "$SUMMARY"
+fi
+
+out ""
+if [ "$FAILURES" -eq 0 ]; then
+  out "Result: PASS"
+  exit 0
+fi
+if [ -n "$EXEMPT_REASON" ]; then
+  out "Result: EXEMPT ($FAILURES violation(s) waived: $EXEMPT_REASON)"
+  echo "spec-size: $FAILURES violation(s) waived: $EXEMPT_REASON"
+  exit 0
+fi
+out "Result: FAIL ($FAILURES violation(s)). Shrink the spec, or add the spec-size-exempt label / a \`<!-- spec-size-exempt: <reason> -->\` line to the PR body."
+echo "spec-size: FAIL ($FAILURES violation(s)); see job summary" >&2
+exit 1

package/scripts/check-spec-size.test.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# check-spec-size.test.sh — cases for scripts/check-spec-size.sh (forge#3762).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+set -uo pipefail
+S="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/check-spec-size.sh"
+PASS=0; FAILN=0
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+ok() { PASS=$((PASS+1)); }
+bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
+
+git init -q --bare "$TMP/origin.git"
+git clone -q "$TMP/origin.git" "$TMP/w" 2>/dev/null
+cd "$TMP/w" || exit 1
+git config user.email t@example.com; git config user.name t
+mkdir -p commands/work-on
+gen() { awk -v n="$1" 'BEGIN{for(i=0;i<n;i++) print "line of spec text number " i}'; }
+gen 4000 > commands/review-pr.md          # ~110 KB: 2% ~ 2.2 KB < 4 KB cap
+gen 20000 > commands/work-on.md           # ~560 KB: 2% ~ 11 KB, so the 4 KB cap binds
+gen 100 > commands/other.md
+gen 100 > commands/work-on/remediate.md
+git add -A; git commit -qm base; git branch -M staging; git push -q origin staging 2>/dev/null
+git checkout -q -b feat
+
+reset() { git reset -q --hard origin/staging; git clean -qfd; }
+run() { # name want_rc [env...]
+  local name="$1" want="$2"; shift 2
+  local sum="$TMP/summary"; : > "$sum"
+  env GITHUB_STEP_SUMMARY="$sum" PR_LABELS="" PR_BODY="" "$@" bash "$S" origin/staging >"$TMP/out" 2>"$TMP/err"
+  local rc=$?
+  if [ "$rc" = "$want" ]; then ok; else bad "$name (rc=$rc want $want)"; cat "$TMP/err"; fi
+}
+has() { grep -qF "$2" "$TMP/summary" && ok || bad "$1 (summary lacks: $2)"; }
+
+reset; run "no change passes" 0
+has "summary shows delta table" "| File | Base | Head | Delta |"
+
+reset; gen 100 >> commands/review-pr.md   # +~2.8 KB on ~110 KB = ~2.5% (>2%, <4 KB)
+run "over 2% fails" 1; has "over-budget flagged" "OVER BUDGET"
+
+reset; gen 200 >> commands/work-on.md     # +~5.6 KB (<2% of 560 KB, >4 KB)
+run "over 4 KB fails" 1
+
+reset; gen 5 >> commands/review-pr.md     # small growth under both limits
+run "small growth passes" 0
+
+reset; gen 5000 >> commands/other.md      # not a budgeted spec
+run "non-budgeted growth passes" 0
+
+reset; gen 100 > commands/review-pr.md    # shrink
+run "shrink passes" 0
+
+reset; printf 'TRUSTED_SCRIPT=""\n' >> commands/other.md
+run "new TRUSTED_SCRIPT copy fails" 1; has "dup flagged" "NEW CANONICAL BLOCK COPY"
+
+reset; printf '_SD=x; mkdir -p "$_SD"   # FENCE_BOOTSTRAP\n' >> commands/other.md
+run "new FENCE_BOOTSTRAP anchor fails" 1
+
+reset; printf 'echo hi   # FENCE_BOOTSTRAP\n' >> commands/other.md
+run "non-anchor FENCE_BOOTSTRAP tag passes" 0
+
+reset; printf '# FORGE_ROOT bootstrap (canonical)\n' > commands/new-spec.md; git add -A
+run "new spec file with block fails" 1
+
+# Existing block, count unchanged or reduced, passes
+reset; printf 'HELPER_SCRIPT=""\n' >> commands/other.md; git commit -qam x; git push -q origin HEAD:staging 2>/dev/null
+git fetch -q origin staging
+run "unchanged count passes" 0
+: > commands/other.md; git add -A
+run "reduced count passes" 0
+
+# Exemption
+reset; gen 100 >> commands/review-pr.md
+run "exempt by label" 0 PR_LABELS="bug,spec-size-exempt"; has "label reported" "EXEMPT"
+run "exempt by body marker" 0 PR_BODY=$'text\n<!-- spec-size-exempt: security fix -->\nmore'; has "reason reported" "security fix"
+run "empty-reason marker not exempt" 1 PR_BODY='<!-- spec-size-exempt:  -->'
+run "label substring not exempt" 1 PR_LABELS="spec-size-exempt-not"
+
+# Fail closed on unresolvable base
+: > "$TMP/summary"
+GITHUB_STEP_SUMMARY="$TMP/summary" bash "$S" origin/does-not-exist >/dev/null 2>&1; rc=$?
+[ "$rc" = 2 ] && ok || bad "unresolved base fails closed (rc=$rc)"
+
+echo "check-spec-size.test: pass=$PASS fail=$FAILN"
+[ "$FAILN" -eq 0 ]

package/scripts/review-pr-staging-scope.test.sh

@@ -113,6 +113,34 @@ grep -q 'test_gate_verdict' "$SPEC" && grep -q 'launched_review_agents' "$SPEC"
 if grep -qE '\$_SD/(test_gate_verdict|test_gate_reason|launched_review_agents)|\.forge-scratch\}/launched_review_agents' "$SPEC"; then bad "gate/launched-agent scratch files must be keyed by \${PR_NUMBER}_"; else ok; fi
 grep -qF ': > "$_SD/${PR_NUMBER}_launched_review_agents"' "$SPEC" && grep -qF 'rm -f "$_SD/${PR_NUMBER}_test_gate_verdict" "$_SD/${PR_NUMBER}_test_gate_reason"' "$SPEC" && ok || bad "Phase 2 must truncate and Phase 6.5 must rm -f the PR-keyed scratch files in executable commands"
 if awk '/^### 7E:/,/^### 7F:/' "$SPEC" | grep -qF '{GH_REPO}'; then bad "7E must not use the {GH_REPO} template token"; else ok; fi
+# (8b) forge#3733: Phase 6.75 fails closed on an empty/absent launched-agent list or empty PR_NUMBER; Phase 6 fails closed on a bad SELECTED_AGENT_COUNT
+F675=$(awk '/^### Phase 6.75/,/^### 7A/' "$SPEC" | awk '/^```bash/{f=1;next} /^```/{if(f)exit} f')
+GUARD_LN=$(printf '%s\n' "$F675" | grep -n 'launched-agent list is empty or unreadable' | head -1 | cut -d: -f1)
+LOOP_LN=$(printf '%s\n' "$F675" | grep -n '^for AGENT_DOMAIN in' | head -1 | cut -d: -f1)
+[ -n "$GUARD_LN" ] && [ -n "$LOOP_LN" ] && [ "$GUARD_LN" -lt "$LOOP_LN" ] && ok || bad "6.75 empty-list guard must precede the for AGENT_DOMAIN loop"
+printf '%s\n' "$F675" | sed -n "1,$((LOOP_LN-1))p" | grep -v '^[[:space:]]*gh ' > "$TMP/f675.sh"
+mkdir -p "$TMP/sd9/empty" "$TMP/sd9/full" "$TMP/bin9"
+printf '#!/bin/sh\necho stub-value\n' > "$TMP/bin9/yq"; printf '#!/bin/sh\nexit 0\n' > "$TMP/bin9/gh"; chmod +x "$TMP/bin9/yq" "$TMP/bin9/gh"
+: > "$TMP/sd9/empty/42_launched_review_agents"
+printf 'security\n' > "$TMP/sd9/full/42_launched_review_agents"
+run675() { ( unset LAUNCHED_REVIEW_AGENTS REVIEW_SHA_FULL; export PATH="$TMP/bin9:$PATH" FORGE_SCRATCHPAD="$1" HOME="$TMP/nohome"; [ -n "$2" ] && export PR_NUMBER="$2"; bash "$TMP/f675.sh" 2>&1; echo "rc=$?" ); }
+for _case in "$TMP/sd9/empty|42" "$TMP/sd9/none|42" "$TMP/sd9/full|"; do
+  OUT9=$(run675 "${_case%%|*}" "${_case##*|}")
+  case "$OUT9" in *"REVIEW DELIVERY FAILURE: launched-agent list is empty or unreadable"*"rc=1"*) ok ;; *) bad "6.75 must exit 1 for case '$_case' (got '$OUT9')" ;; esac
+done
+OUT9=$(run675 "$TMP/sd9/full" 42)
+case "$OUT9" in *"launched-agent list is empty"*) bad "6.75 guard must not fire for a non-empty list (got '$OUT9')" ;; *) ok ;; esac
+# Phase 6 SELECTED_AGENT_COUNT validation: static order + behaviour of the reload/validate lines
+F6=$(awk '/Selected isolated reviewers/{exit} {print}' "$SPEC" | awk '/^```bash/{b=""; f=1; next} /^```/{f=0; next} f{b=b $0 "\n"; last=b} END{printf "%s", last}')
+printf '%s' "$F6" | grep -qF 'SELECTED_COUNT_INVALID' && ok || bad "Phase 6 fence must validate SELECTED_AGENT_COUNT (SELECTED_COUNT_INVALID)"
+printf '%s' "$F6" | grep -F 'SELECTED_AGENT_COUNT=' | grep -F 'launched_review_agents' > "$TMP/sel.sh"
+printf '%s\n' 'SELECTED_COUNT_INVALID=false' "$(printf '%s' "$F6" | grep -F 'case "${SELECTED_AGENT_COUNT:-}"')" > "$TMP/selcase.sh"
+for _c in "$TMP/sd9/empty|42" "$TMP/sd9/none|42" "$TMP/sd9/full|42"; do
+  OUT9=$( ( unset SELECTED_AGENT_COUNT; _SD="${_c%%|*}"; PR_NUMBER="${_c##*|}"; . "$TMP/sel.sh"; . "$TMP/selcase.sh"; echo "$SELECTED_COUNT_INVALID|$SELECTED_AGENT_COUNT" ) 2>&1 )
+  case "${_c%%|*}" in */full) [ "$OUT9" = "false|1" ] && ok || bad "Phase 6: one launched agent must give SELECTED_AGENT_COUNT=1 (got '$OUT9')" ;; *) [ "$OUT9" = "true|0" ] && ok || bad "Phase 6: empty/absent list must be invalid (got '$OUT9')" ;; esac
+done
+OUT9=$( ( SELECTED_AGENT_COUNT="abc"; . "$TMP/selcase.sh"; echo "$SELECTED_COUNT_INVALID" ) 2>&1 )
+[ "$OUT9" = "true" ] && ok || bad "Phase 6: non-integer SELECTED_AGENT_COUNT must be invalid (got '$OUT9')"
 mkdir -p "$TMP/sd8/full" "$TMP/sd8/empty" "$TMP/sd8/bad" "$TMP/bin"
 printf '#!/bin/sh\necho stub-value\n' > "$TMP/bin/yq"; chmod +x "$TMP/bin/yq"
 printf '42\n' > "$TMP/sd8/full/staging_pr_number"; printf '7\n8\n' > "$TMP/sd8/full/42_bundle-prs.txt"