forgedock 1.16.2 → 1.17.0

package/scripts/fixtures/cost-report/unfinished-reopened.jsonl

@@ -0,0 +1,5 @@
+{"seq":1,"event":"RUN_START","issue":6,"run":"r_6_staging","lane":"staging","version":"2.0.0","repo":"o/a"}
+{"seq":2,"event":"PHASE_COMMIT","phase":"build","outputs":{},"usage":{"input_tokens":10,"output_tokens":5,"cache_creation_input_tokens":1,"cache_read_input_tokens":9999000}}
+{"seq":3,"event":"RUN_TERMINAL","reason":"needs-human"}
+{"seq":4,"event":"RUN_REOPEN","issue":6}
+{"seq":5,"event":"PHASE_COMMIT","phase":"build","outputs":{},"usage":{"input_tokens":10,"output_tokens":5,"cache_creation_input_tokens":1,"cache_read_input_tokens":9999000}}

package/scripts/forge-root.test.sh

@@ -279,15 +279,18 @@ HR_CLASSIFY="$ROOT/commands/review-pr.md"
 HR_AMP="$ROOT/commands/orchestrate/phase-4-execution.md"
 HR_EX3="$ROOT/commands/orchestrate/phase-3-dependency.md"
 stub_block "$HR_CLASSIFY" CLASSIFY_SCRIPT > "$T/hr_classify.sh"
+stub_block "$HR_CLASSIFY" CAP_SCRIPT > "$T/hr_cap.sh"
 extract_helper_block "$HR_AMP" AMP_SCRIPT > "$T/hr_amp.sh"
 extract_helper_fn "$HR_AMP" > "$T/hr_ex4.sh"
 extract_helper_fn "$HR_EX3" > "$T/hr_ex3.sh"
 expect "CLASSIFY_SCRIPT resolver stub found" 1 "$(grep -c '^CLASSIFY_SCRIPT=\$(forge_resolve classify-finding.sh)$' "$T/hr_classify.sh")"
+expect "CAP_SCRIPT resolver stub found" 1 "$(grep -c '^CAP_SCRIPT=\$(forge_resolve cap-findings.sh)$' "$T/hr_cap.sh")"
+expect "CAP_SCRIPT resolver stub found in review-pr-staging.md" 1 "$(sed 's/^[[:space:]]*//' "$ROOT/commands/review-pr-staging.md" | grep -c '^CAP_SCRIPT=\$(forge_resolve cap-findings.sh)$')"
 expect "AMP_SCRIPT resolver block found" 1 "$(grep -c '^AMP_SCRIPT=""' "$T/hr_amp.sh")"
 expect "extract-affected-files resolver found in phase-4" 1 "$(grep -c 'resolve_extract_affected_files() {' "$T/hr_ex4.sh")"
 expect "extract-affected-files resolver found in phase-3" 1 "$(grep -c 'resolve_extract_affected_files() {' "$T/hr_ex3.sh")"
 cmp -s "$T/hr_ex3.sh" "$T/hr_ex4.sh" && ok || bad 'resolve_extract_affected_files copies differ between phase-3 and phase-4'
-for hr in classify amp ex3 ex4; do
+for hr in classify cap amp ex3 ex4; do
   grep -qF 'plugins/cache/forgedock/forgedock' "$T/hr_$hr.sh" && ok || bad "$hr helper resolver lacks the plugin-cache scan"
   grep -qF 'CLAUDE_CONFIG_DIR' "$T/hr_$hr.sh" && ok || bad "$hr helper resolver lacks CLAUDE_CONFIG_DIR"
   grep -qE '\$PWD|\$REPO_PATH|\$\{PWD|\$\{REPO_PATH' "$T/hr_$hr.sh" && bad "$hr helper resolver lists the working directory or repo path" || ok
@@ -298,7 +301,7 @@ if grep -rnE 'PWD/scripts/|^\$PWD$|REPO_PATH/scripts/extract' "$ROOT/commands" >
 # Behavior (#3483): a planted scripts/<helper>.sh in the cwd must never be selected; a cache-only install must resolve.
 mkdir -p "$T/hrwork/scripts" "$T/hrhome/.claude/plugins/cache/forgedock/forgedock/1.12.0/scripts/lib"
 cp "$ROOT/scripts/lib/forge-resolve.sh" "$T/hrhome/.claude/plugins/cache/forgedock/forgedock/1.12.0/scripts/lib/forge-resolve.sh"
-for h in classify-finding amplification-breaker extract-affected-files; do
+for h in classify-finding cap-findings amplification-breaker extract-affected-files; do
   : > "$T/hrwork/scripts/$h.sh"; : > "$T/hrhome/.claude/plugins/cache/forgedock/forgedock/1.12.0/scripts/$h.sh"
 done
 CACHE_SCRIPTS="$T/hrhome/.claude/plugins/cache/forgedock/forgedock/1.12.0/scripts"
@@ -307,6 +310,8 @@ hr_run() { # home blockfile expr
 }
 expect "CLASSIFY_SCRIPT: cache-only install resolves (cwd copy ignored)" "$CACHE_SCRIPTS/classify-finding.sh" "$(hr_run "$T/hrhome" "$T/hr_classify.sh" 'printf %s "$CLASSIFY_SCRIPT"')"
 expect "CLASSIFY_SCRIPT: no install resolves empty (cwd copy ignored)" "" "$(hr_run "$T/nohome" "$T/hr_classify.sh" 'printf %s "$CLASSIFY_SCRIPT"')"
+expect "CAP_SCRIPT: cache-only install resolves (cwd copy ignored)" "$CACHE_SCRIPTS/cap-findings.sh" "$(hr_run "$T/hrhome" "$T/hr_cap.sh" 'printf %s "$CAP_SCRIPT"')"
+expect "CAP_SCRIPT: no install resolves empty (cwd copy ignored)" "" "$(hr_run "$T/nohome" "$T/hr_cap.sh" 'printf %s "$CAP_SCRIPT"')"
 expect "AMP_SCRIPT: cache-only install resolves (cwd copy ignored)" "$CACHE_SCRIPTS/amplification-breaker.sh" "$(hr_run "$T/hrhome" "$T/hr_amp.sh" 'printf %s "$AMP_SCRIPT"')"
 expect "AMP_SCRIPT: no install resolves empty (cwd copy ignored)" "" "$(hr_run "$T/nohome" "$T/hr_amp.sh" 'printf %s "$AMP_SCRIPT"')"
 expect "extract-affected-files: cache-only install resolves (cwd and REPO_PATH copies ignored)" "$CACHE_SCRIPTS/extract-affected-files.sh" "$(hr_run "$T/hrhome" "$T/hr_ex4.sh" 'resolve_extract_affected_files')"
@@ -411,7 +416,7 @@ sed 's/^[[:space:]]*//' "$STG_SPEC" | grep '^type forge_resolve >/dev/null' | so
 [ "$(wc -l < "$T/loc_uniq" | tr -d ' ')" = 1 ] && ok || bad "forge_resolve locator line must be byte-identical across every stub in review-pr-staging.md"
 [ "$(awk '{print $1}' "$T/loc_uniq")" -ge 30 ] && ok || bad "expected a locator on every bootstrap (21) and resolver (11) stub"
 grep -qE 'PWD|\$\(pwd\)|REPO_PATH' "$T/locator.sh" && bad "stub locator must not consult the cwd or repo under review" || ok
-[ "$(grep -c '# FENCE_BOOTSTRAP$' "$STG_SPEC")" = 21 ] && ok || bad "expected 21 fence bootstrap stubs"
+[ "$(grep -c '# FENCE_BOOTSTRAP$' "$STG_SPEC")" = 22 ] && ok || bad "expected 22 fence bootstrap stubs"
 [ "$(grep '# FENCE_BOOTSTRAP$' "$STG_SPEC" | sort -u | wc -l | tr -d ' ')" = 1 ] && ok || bad "fence bootstrap stubs must be byte-identical"
 grep '# FENCE_BOOTSTRAP$' "$STG_SPEC" | sed 1q | grep -qF 'exit 1' && ok || bad "fence bootstrap stub must fail closed (exit 1) when the helper is unresolved"
 # the spec carries none of the old inlined blocks

package/scripts/lib/fence-bootstrap.sh

@@ -10,7 +10,8 @@ CONFIG_FILE="${FORGE_CONFIG:-forge.yaml}"
 [ -n "${GH_REPO:-}" ] || GH_REPO=$(yq '.project.owner + "/" + .project.repo' "$CONFIG_FILE" 2>/dev/null)
 [ -n "${DEFAULT_BRANCH:-}" ] || DEFAULT_BRANCH=$(yq '.branches.default' "$CONFIG_FILE" 2>/dev/null)
 [ -n "${STAGING_BRANCH:-}" ] || STAGING_BRANCH=$(yq '.branches.staging' "$CONFIG_FILE" 2>/dev/null)
-# numeric-validated: a tampered file never reaches gh
-[ -n "${PR_NUMBER:-}" ] || { [ -r "$_SD/staging_pr_number" ] && PR_NUMBER=$(sed -n '1{/^[0-9][0-9]*$/p;q}' "$_SD/staging_pr_number"); }
+# run-keyed pointer (concurrent runs share $_SD); numeric-validated: a tampered file never reaches gh
+FORGE_RUN_KEY="${FORGE_RUN_KEY:-${FORGE_RUN_ID:-${CLAUDE_CODE_SESSION_ID:-${CLAUDE_SESSION_ID:-${CODEX_THREAD_ID:-${OPENCODE_SESSION_ID:-$PPID}}}}}}"; FORGE_RUN_KEY=$(printf '%s' "$FORGE_RUN_KEY" | tr -c 'A-Za-z0-9_-' '_')
+[ -n "${PR_NUMBER:-}" ] || { [ -r "$_SD/staging_pr_number.${FORGE_RUN_KEY}" ] && PR_NUMBER=$(sed -n '1{/^[0-9][0-9]*$/p;q}' "$_SD/staging_pr_number.${FORGE_RUN_KEY}"); }
 [ -n "${ALL_PR_NUMBERS:-}" ] || { [ -n "${PR_NUMBER:-}" ] && [ -r "$_SD/${PR_NUMBER}_bundle-prs.txt" ] && ALL_PR_NUMBERS=$(grep -E '^[0-9]+$' "$_SD/${PR_NUMBER}_bundle-prs.txt"); }
-[ -n "${PR_NUMBER:-}" ] || echo "WARNING: PR_NUMBER is empty after reload (no staging_pr_number in $_SD): this fence cannot key its scratch files or post to a PR."
+[ -n "${PR_NUMBER:-}" ] || echo "WARNING: PR_NUMBER is empty after reload (no staging_pr_number.${FORGE_RUN_KEY} in $_SD): this fence cannot key its scratch files or post to a PR."

package/scripts/lib/pr-issue-number.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# pr-issue-number.sh: sourced helper — the ONE numeric-validated "Closes #N" extractor for a PR body.
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Source it, never exec it (resolve with `forge_resolve lib/pr-issue-number.sh`).
+#   pr_issue_number            reads the PR body on stdin
+#   pr_issue_number_of <body>  same, body as an argument
+# Prints the number of the FIRST `Closes|Fixes|Resolves #N` reference (any keyword form, any case), or NOTHING when the body
+# has none. The output is always ^[0-9]+$ or empty, so it is safe to place in an API path. A hand-rolled jq `gsub` returns the
+# whole input when the pattern does not match, which is why every extraction goes through this helper instead.
+pr_issue_number() {
+    local n
+    n=$(grep -oiE '(close[sd]?|fix(e[sd])?|resolve[sd]?):?[[:space:]]+#[0-9]+' 2>/dev/null | head -n 1 | grep -oE '[0-9]+$' | head -n 1)
+    case "$n" in ''|*[!0-9]*) return 0 ;; esac
+    printf '%s\n' "$n"
+}
+pr_issue_number_of() { printf '%s\n' "${1:-}" | pr_issue_number; }

package/scripts/lib/review-template-resolve.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# review-template-resolve.sh: sourced helper — the ONE resolution chain for the review-pr-agents persona templates.
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Source it, never exec it. `review_template_resolve [repo_path]` sets:
+#   TEMPLATE_SOURCE    plugin_root | forge_home | repo_path | monolithic_catalog | none
+#   TEMPLATE_BASE      directory holding protocols.md and the persona files (empty for monolithic_catalog / none)
+#   MONOLITHIC_CATALOG path of the last-resort catalog (monolithic_catalog only)
+# Chain: the running plugin root (CLAUDE_PLUGIN_ROOT, absolute only), then FORGE_HOME, then the trusted install root from
+# forge_root when the resolver is loaded, then the repo path argument, then the monolithic catalog (it must contain `### Agent:`
+# headers: a post-split repo ships a router stub at that path that points back to the missing directory). `none` is a fatal setup
+# error: the caller must stop and never review inline. The repo path is data, only ever read for template files.
+review_template_resolve() {
+    local _plugin _root _repo="${1:-}"
+    TEMPLATE_BASE=""; TEMPLATE_SOURCE="none"; MONOLITHIC_CATALOG=""
+    _plugin="${CLAUDE_PLUGIN_ROOT:-}"; case "$_plugin" in /*) ;; *) _plugin="" ;; esac
+    if [ -n "$_plugin" ] && [ -f "$_plugin/commands/review-pr-agents/protocols.md" ]; then
+        TEMPLATE_BASE="$_plugin/commands/review-pr-agents"; TEMPLATE_SOURCE="plugin_root"; return 0
+    fi
+    case "${FORGE_HOME:-}" in
+        /*) if [ -f "$FORGE_HOME/commands/review-pr-agents/protocols.md" ]; then
+                TEMPLATE_BASE="$FORGE_HOME/commands/review-pr-agents"; TEMPLATE_SOURCE="forge_home"; return 0
+            fi ;;
+    esac
+    if type forge_root >/dev/null 2>&1; then
+        _root=$(forge_root)
+        if [ -n "$_root" ] && [ -f "$_root/commands/review-pr-agents/protocols.md" ]; then
+            TEMPLATE_BASE="$_root/commands/review-pr-agents"; TEMPLATE_SOURCE="forge_home"; return 0
+        fi
+    fi
+    if [ -n "$_repo" ]; then
+        if [ -f "$_repo/commands/review-pr-agents/protocols.md" ]; then
+            TEMPLATE_BASE="$_repo/commands/review-pr-agents"; TEMPLATE_SOURCE="repo_path"; return 0
+        fi
+        if [ -f "$_repo/commands/review-pr-agents.md" ] && grep -q "^### Agent:" "$_repo/commands/review-pr-agents.md" 2>/dev/null; then
+            MONOLITHIC_CATALOG="$_repo/commands/review-pr-agents.md"; TEMPLATE_SOURCE="monolithic_catalog"; return 0
+        fi
+    fi
+    return 0
+}

package/scripts/lib/telemetry.sh

@@ -0,0 +1,168 @@
+#!/usr/bin/env bash
+# telemetry.sh — fail-safe structured telemetry emitter (sourced helper, or exec'd as a CLI).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+#   . scripts/lib/telemetry.sh;  forge_emit <event> key=value...      # sourced
+#   bash scripts/lib/telemetry.sh <event> key=value...                 # exec'd (spec call sites)
+#
+# One compact JSON line per call: v, ts, forge_version, repo, issue, pr, run, phase, event + payload. GitHub is the
+# canonical store: the line is appended to the trusted `<!-- FORGE:TELEMETRY v1 -->` comment on the issue (or PR for
+# review-side events), edited in place (JSONL inside a fenced block), rolling over to `... v1 part=N` near 60000 chars.
+# A failed write is appended to a local buffer and flushed by the next emit for the same target; the buffer is only
+# a cache, everything flushed is recoverable from GitHub alone. The emitter NEVER fails or changes the caller:
+# always returns 0, all output is discarded, `FORGE_TELEMETRY=off` disables it. It records ids, counts and codes only,
+# never comment bodies, file contents or secrets (values are charset-restricted and truncated).
+#
+# Context env: FORGE_REPO (default: parsed from `git remote get-url origin`), FORGE_ISSUE, FORGE_PR, FORGE_RUN,
+# FORGE_PHASE; null when unset. With no repo or no numeric target the record is dropped (nothing to write to).
+# Test hooks: FORGE_TELEMETRY_GH (gh replacement), FORGE_TELEMETRY_BUFFER_DIR, FORGE_TELEMETRY_MAX_CHARS.
+# Comment trust is decided by scripts/trusted-comments.sh (the one trust predicate), resolved next to this file.
+# bash 3.2 portable.
+
+_FORGE_TEL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" 2>/dev/null && pwd)"
+
+_forge_tel_clean() { # sanitize a payload value: restricted charset, max 200 chars
+  printf '%s' "$1" | tr '\n\r\t' '   ' | tr -c 'A-Za-z0-9 _.:/#@+=,-' '_' | cut -c1-200
+}
+
+_forge_tel_record() { # event k=v... -> one JSON line on stdout
+  local ev="$1"; shift
+  local ver="" repo="${FORGE_REPO:-}" args=() kv k v
+  if [ -z "$repo" ]; then
+    repo=$(git remote get-url origin 2>/dev/null | sed -E 's#^.*[:/]([^/:]+/[^/]+)$#\1#; s#\.git$##')
+  fi
+  ver=$(jq -r '.version // empty' "$_FORGE_TEL_DIR/../../package.json" 2>/dev/null)
+  for kv in "$@"; do
+    k="${kv%%=*}"; v="${kv#*=}"
+    case "$kv" in *=*) ;; *) continue ;; esac
+    case "$k" in ''|*[!A-Za-z0-9_]*) continue ;; esac
+    case "$k" in v|ts|forge_version|repo|issue|pr|run|phase|event|eid) continue ;; esac
+    args+=("$k" "$(_forge_tel_clean "$v")")
+  done
+  jq -nc --arg ev "$ev" --arg ver "$ver" --arg repo "$repo" --arg issue "${FORGE_ISSUE:-}" --arg pr "${FORGE_PR:-}" \
+    --arg run "${FORGE_RUN:-}" --arg phase "${FORGE_PHASE:-}" --arg eid "$(date +%s)-$$-${RANDOM}${RANDOM}${RANDOM}" --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" '
+    def num: if test("^[0-9]+$") then tonumber else null end;
+    def str: if . == "" then null else . end;
+    ($ARGS.positional | [range(0; length; 2) as $i | {key: .[$i], value: .[$i+1]}]
+      | map(.value |= (if test("^-?[0-9]+$") then tonumber elif . == "true" then true elif . == "false" then false else . end))
+      | from_entries) as $p
+    | {v: 1, ts: $ts, forge_version: ($ver | str), repo: ($repo | str), issue: ($issue | num), pr: ($pr | num),
+       run: ($run | str), phase: ($phase | str), event: $ev, eid: $eid} + $p' --args "${args[@]}"
+}
+
+# Prints "<number> <repo>" of the comment target (issue or PR) for this event, or nothing when none is usable.
+_forge_tel_target() {
+  local ev="$1" repo="$2" n
+  case "$ev" in
+    review_panel|finding_disposition|ci_gate) n="${FORGE_PR:-}"; case "$n" in ''|*[!0-9]*) n="${FORGE_ISSUE:-}" ;; esac ;;
+    *) n="${FORGE_ISSUE:-}"; case "$n" in ''|*[!0-9]*) n="${FORGE_PR:-}" ;; esac ;;
+  esac
+  case "$n" in ''|*[!0-9]*) return 0 ;; esac
+  case "$repo" in */*) ;; *) return 0 ;; esac
+  printf '%s %s\n' "$n" "$repo"
+}
+
+# Appends the JSONL lines on stdin to the trusted telemetry comment of <repo>#<n>; returns non-zero on any failure.
+_forge_tel_upsert() {
+  local repo="$1" n="$2" gh="${FORGE_TELEMETRY_GH:-gh}" max="${FORGE_TELEMETRY_MAX_CHARS:-60000}"
+  local nl fence new comments cand id body part best_id="" best_part=0 best_body="" all_bodies="" lines hdr out tc
+  new=$(cat); [ -n "$new" ] || return 0
+  tc="$_FORGE_TEL_DIR/../trusted-comments.sh"; [ -f "$tc" ] || return 1
+  command -v jq >/dev/null 2>&1 || return 1
+  local to=""; command -v timeout >/dev/null 2>&1 && to="timeout 30"
+  comments=$($to "$gh" api --paginate "repos/$repo/issues/$n/comments" 2>/dev/null) || return 1
+  [ -n "$comments" ] || comments='[]'
+  # Candidates carry the marker; each is then checked individually against the trust predicate.
+  while IFS= read -r cand; do
+    [ -n "$cand" ] || continue
+    id=$(printf '%s' "$cand" | jq -r '.id')
+    [ "$(printf '[%s]' "$cand" | bash "$tc" count '^<!-- FORGE:TELEMETRY v1( part=[0-9]+)? -->' 2>/dev/null)" = "1" ] || continue
+    body=$(printf '%s' "$cand" | jq -r '.body')
+    all_bodies="${all_bodies}${body}"$'\n'
+    part=$(printf '%s' "$body" | sed -n '1s/^<!-- FORGE:TELEMETRY v1 part=\([0-9]*\) -->.*/\1/p'); part="${part:-1}"
+    if [ "$part" -ge "$best_part" ]; then best_part="$part"; best_id="$id"; best_body="$body"; fi
+  done < <(printf '%s' "$comments" | jq -c -s '.[][] | select((.body // "") | test("^<!-- FORGE:TELEMETRY v1( part=[0-9]+)? -->")) | {id, body, user, author_association}' 2>/dev/null)
+  # Drop lines any part already holds (a PATCH whose reply was lost, or a re-flushed buffer). Every record carries a
+  # unique eid, so two distinct same-second events are never byte-identical and are never dropped by this check.
+  lines=""
+  while IFS= read -r l; do
+    [ -n "$l" ] || continue
+    case "$all_bodies" in *"$l"*) continue ;; esac
+    lines="${lines}${l}"$'\n'
+  done <<< "$new"
+  [ -n "$lines" ] || return 0
+  # bash 3.2: $'..' inside a double-quoted ${..%..} is NOT expanded (and backticks there start a command
+  # substitution), so the newline and fence live in variables and the pattern quotes them.
+  nl=$'\n'; fence='```'
+  lines="${lines%"$nl"}"
+  if [ -n "$best_id" ]; then
+    local cur="${best_body%"$nl$fence"*}"            # body up to the closing fence
+    out="${cur}"$'\n'"${lines}"$'\n```'
+    if [ "${#out}" -le "$max" ]; then
+      $to "$gh" api -X PATCH "repos/$repo/issues/comments/$best_id" -f body="$out" >/dev/null 2>&1; return $?
+    fi
+    hdr="<!-- FORGE:TELEMETRY v1 part=$((best_part + 1)) -->"
+  else
+    hdr="<!-- FORGE:TELEMETRY v1 -->"
+  fi
+  out="${hdr}"$'\n```jsonl\n'"${lines}"$'\n```'
+  $to "$gh" api -X POST "repos/$repo/issues/$n/comments" -f body="$out" >/dev/null 2>&1
+}
+
+_forge_tel_impl() {
+  local ev="${1:-}"; shift
+  [ "${FORGE_TELEMETRY:-on}" = "off" ] && return 0
+  case "$ev" in ''|*[!A-Za-z0-9_.-]*) return 0 ;; esac
+  command -v jq >/dev/null 2>&1 || return 0
+  local rec repo tgt n buf bdir pending
+  rec=$(_forge_tel_record "$ev" "$@") && [ -n "$rec" ] || return 0
+  repo=$(printf '%s' "$rec" | jq -r '.repo // ""')
+  tgt=$(_forge_tel_target "$ev" "$repo"); [ -n "$tgt" ] || return 0
+  n="${tgt%% *}"
+  bdir="${FORGE_TELEMETRY_BUFFER_DIR:-$HOME/.forge/telemetry-buffer}"
+  buf="$bdir/$(printf '%s' "$repo" | tr '/' '_')__${n}.jsonl"
+  # Serialize emitters on this host per target: the GitHub read-modify-write has no version check, so two overlapping
+  # emitters would each PATCH a stale snapshot (lost record) or both POST a first/rollover part (duplicate comments).
+  # Bounded wait (every loop pass counts, 50 x 0.1s); a lock over 5 min old (longer than any bounded hold: two 30s gh
+  # calls plus trust checks) is stale and reclaimed by an atomic rename so only one waiter wins; the holder writes an
+  # owner token and releases only its own lock. A non-writable buffer dir skips locking. On timeout the record is
+  # buffered, never dropped.
+  local lock="$bdir/.lock-$(printf '%s' "$repo" | tr '/' '_')__${n}" tries=0 got="" token="$$.${RANDOM}${RANDOM}"
+  if ! { mkdir -p "$bdir" 2>/dev/null && [ -w "$bdir" ]; }; then tries=50; got=nolock; fi
+  while [ "$tries" -lt 50 ]; do
+    if mkdir "$lock" 2>/dev/null; then printf '%s' "$token" > "$lock/owner" 2>/dev/null; got=1; break; fi
+    if [ -n "$(find "$lock" -maxdepth 0 -mmin +5 2>/dev/null)" ]; then
+      mv "$lock" "$lock.stale.$token" 2>/dev/null && rm -rf "$lock.stale.$token" 2>/dev/null
+    else
+      sleep 0.1 2>/dev/null || sleep 1
+    fi
+    tries=$((tries + 1))
+  done
+  if [ -z "$got" ]; then printf '%s\n' "$rec" >> "$buf" 2>/dev/null; return 0; fi
+  _forge_tel_unlock() { [ "$got" = 1 ] && [ "$(cat "$lock/owner" 2>/dev/null)" = "$token" ] && rm -rf "$lock" 2>/dev/null; got=""; }
+  trap '_forge_tel_unlock' EXIT; trap '_forge_tel_unlock; exit 1' HUP INT TERM
+  # Claim the buffer by renaming it first: a record appended by another emitter after this point lands in a fresh
+  # buffer file and survives. Holding the lock, any other "$buf.flush.*" is an orphan of a killed emitter: fold it in.
+  local claimed="$buf.flush.$token" f
+  pending="$rec"
+  if [ -s "$buf" ]; then mv "$buf" "$claimed" 2>/dev/null; fi
+  for f in "$buf".flush.*; do
+    [ -f "$f" ] && [ "$f" != "$claimed" ] && cat "$f" >> "$claimed" 2>/dev/null && rm -f "$f" 2>/dev/null
+  done
+  if [ -s "$claimed" ]; then pending="$(cat "$claimed")"$'\n'"$rec"; fi
+  if printf '%s\n' "$pending" | _forge_tel_upsert "$repo" "$n"; then
+    rm -f "$claimed" 2>/dev/null
+  else
+    if [ -f "$claimed" ]; then cat "$claimed" >> "$buf" 2>/dev/null; rm -f "$claimed" 2>/dev/null; fi
+    printf '%s\n' "$rec" >> "$buf" 2>/dev/null
+  fi
+  _forge_tel_unlock
+  return 0
+}
+
+# Subshell + discarded output: no option, variable, trap or stream of the caller can be changed or polluted.
+forge_emit() { ( set +eu +o pipefail 2>/dev/null; _forge_tel_impl "$@" ) >/dev/null 2>&1 </dev/null || true; return 0; }
+
+# Exec'd as a CLI (spec call sites); sourcing only defines functions.
+if [ -n "${BASH_SOURCE[0]:-}" ] && [ "${BASH_SOURCE[0]}" = "$0" ]; then forge_emit "$@"; exit 0; fi

package/scripts/remediate-liveness.sh

@@ -12,7 +12,9 @@
 #       lease.by that is not the dispatching holder and not a provably dead same-host engine pid. An until past
 #       the TTL cap is not a lease an engine could have written (the issue body is author-editable), so it is dead.
 #   (b) review: the newest trusted FORGE:REVIEW_ROUTE comment is younger than REVIEW_PENDING_MAX_S and no trusted
-#       FORGE:REVIEW-AGENT:* comment carries a Reviewed-SHA that prefix-matches the routed sha (either direction).
+#       FORGE:REVIEW-AGENT:* or FORGE:REVIEW-CARRIED comment carries a Reviewed-SHA that prefix-matches the routed sha (either direction),
+#       and no trusted FORGE:{CI|INPR|BASESYNC}_REMEDIATION: pr=<pr> bound marker on the issue is at or after that route
+#       (a review that handed off to remediation, even before dispatching a panel, is never in flight).
 #   A deferral is bounded: after MAX_DEFERRALS trusted FORGE:REMEDIATION_DEFERRED records for this PR the answer is
 #   EXHAUSTED (a human is needed), so a flapping lease or a dead review can never park a PR forever.
 #
@@ -23,6 +25,10 @@
 #   LIVENESS: ERROR <why>              exit 2   unreadable state; fail closed (never "no lease", never delete)
 # Trust predicate for comments: Bot, or OWNER/MEMBER/COLLABORATOR (same default as scripts/trusted-comments.sh).
 set -uo pipefail
+# Telemetry (forge#3834): best-effort decision record; never changes stdout, stderr or the exit code.
+_TEL="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/telemetry.sh"; [ -f "$_TEL" ] && . "$_TEL" 2>/dev/null
+type forge_emit >/dev/null 2>&1 || forge_emit() { :; }
+[ -z "${DRY_RUN:-}" ] || FORGE_TELEMETRY=off
 
 PR="${1:-}"; ISSUE="${2:-}"; REPO="${3:-}"; HOLDER="${4:-}"
 MAX_LEASE_TTL_MS=1800000      # 3x the engine's 10 min lease TTL
@@ -39,7 +45,28 @@ NOW_S=$(( NOW_MS / 1000 ))
 
 TRUST='((.user.type // "") == "Bot" or ((.author_association // "") | IN("OWNER","MEMBER","COLLABORATOR")))'
 
-ISSUE_JSON=$(gh issue view "$ISSUE" -R "$REPO" --json body 2>/dev/null) || err "issue unreadable"
+# Body + provenance (issue-body FORGE:STATE trust gate): the LAST EDITOR (editor // author) must be a Bot,
+# or the creator with OWNER/MEMBER/COLLABORATOR, or a distinct editor with write/maintain/admin permission.
+# Unreadable provenance fails closed. An untrusted body is treated as having no FORGE:STATE (no lease).
+OWNER_PART="${REPO%%/*}"; NAME_PART="${REPO#*/}"
+PROV_Q='query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){issue(number:$number){body authorAssociation author{login __typename} editor{login __typename}}}}'
+PROV=$(gh api graphql -f query="$PROV_Q" -F owner="$OWNER_PART" -F name="$NAME_PART" -F number="$ISSUE" 2>/dev/null) || err "issue unreadable"
+ISSUE_JSON=$(printf '%s' "$PROV" | jq -c '.data.repository.issue | {body: (.body // "")}' 2>/dev/null) || err "issue unreadable"
+ACTOR_ROW=$(printf '%s' "$PROV" | jq -r '.data.repository.issue | (.editor // .author) as $a | [($a.__typename // ""), ($a.login // ""), (if .editor != null and .editor.login != .author.login then "EDITOR" else (.authorAssociation // "NONE") end)] | @tsv' 2>/dev/null) || err "issue unreadable"
+A_TYPE=$(printf '%s' "$ACTOR_ROW" | cut -f1); A_LOGIN=$(printf '%s' "$ACTOR_ROW" | cut -f2); A_ASSOC=$(printf '%s' "$ACTOR_ROW" | cut -f3)
+BODY_TRUSTED=false
+if [ "$A_TYPE" = "Bot" ]; then BODY_TRUSTED=true
+else
+  case "$A_ASSOC" in
+    OWNER|MEMBER|COLLABORATOR) BODY_TRUSTED=true ;;
+    EDITOR)
+      if printf '%s' "$A_LOGIN" | grep -qE '^[A-Za-z0-9-]{1,39}$'; then
+        PERM=$(gh api "repos/$REPO/collaborators/$A_LOGIN/permission" --jq .permission 2>/dev/null || true)
+        case "$PERM" in admin|maintain|write) BODY_TRUSTED=true ;; esac
+      fi ;;
+  esac
+fi
+[ "$BODY_TRUSTED" = "true" ] || ISSUE_JSON='{"body":""}'
 ISSUE_COMMENTS=$(gh api --paginate "repos/$REPO/issues/$ISSUE/comments" 2>/dev/null) || err "issue comments unreadable"
 PR_COMMENTS=$(gh api --paginate "repos/$REPO/issues/$PR/comments" 2>/dev/null) || err "PR comments unreadable"
 [ -n "$PR_COMMENTS" ] || err "PR comments unreadable"
@@ -63,22 +90,30 @@ if [ -n "$STATE_JSON" ]; then
   fi
 fi
 
-# (b) a routed review that is still inside its window and has produced no verdict for the routed sha.
+# (b) a routed review that is still inside its window and has produced no verdict (FORGE:REVIEW-AGENT or, for BASE_SYNC_ONLY, FORGE:REVIEW-CARRIED) for the routed sha.
 ROUTE=$(printf '%s' "$PR_COMMENTS" | jq -rs "[.[][] | select($TRUST) | select((.body // \"\") | test(\"^<!-- FORGE:REVIEW_ROUTE mode=[^ ]+ spec=review-pr.md sha=[0-9a-f]{7,40} -->\")) | select((.body | test(\"mode=spec-evolution-blocked\")) | not)] | last | if . == null then \"\" else ((.body | capture(\"sha=(?<s>[0-9a-f]{7,40})\").s) + \" \" + ((.created_at // \"\") | fromdateiso8601? // 0 | tostring)) end" 2>/dev/null) \
   || err "review comments unparseable"
 ROUTE_SHA="${ROUTE%% *}"; ROUTE_AT="${ROUTE##* }"; REVIEW_PENDING=false
 if [ -n "$ROUTE_SHA" ]; then
   case "$ROUTE_AT" in ''|*[!0-9]*) ROUTE_AT=0 ;; esac
-  VERDICTS=$(printf '%s' "$PR_COMMENTS" | jq -rs --arg r "$ROUTE_SHA" "[.[][] | select($TRUST) | select((.body // \"\") | test(\"^<!-- FORGE:REVIEW-AGENT:[a-z-]+ -->\")) | ((.body | capture(\"(^|\\\\n)Reviewed-SHA: (?<s>[0-9a-f]{7,40})\")? // {s: \"\"}).s) as \$s | select(\$s != \"\" and ((\$r | startswith(\$s)) or (\$s | startswith(\$r))))] | length" 2>/dev/null) || err "reviewer comments unreadable"
-  [ "${VERDICTS:-0}" -eq 0 ] && [ "$ROUTE_AT" -gt 0 ] && [ $(( NOW_S - ROUTE_AT )) -lt "$REVIEW_PENDING_MAX_S" ] && REVIEW_PENDING=true
+  VERDICTS=$(printf '%s' "$PR_COMMENTS" | jq -rs --arg r "$ROUTE_SHA" "[.[][] | select($TRUST) | select((.body // \"\") | test(\"^<!-- FORGE:REVIEW-(AGENT:[a-z-]+|CARRIED) -->\")) | ((.body | capture(\"(^|\\\\n)Reviewed-SHA: (?<s>[0-9a-f]{7,40})\")? // {s: \"\"}).s) as \$s | select(\$s != \"\" and ((\$r | startswith(\$s)) or (\$s | startswith(\$r))))] | length" 2>/dev/null) || err "reviewer comments unreadable"
+  # Handoff: the dispatcher posts FORGE:CI_REMEDIATION / FORGE:INPR_REMEDIATION / FORGE:BASESYNC_REMEDIATION: pr=N on the issue right before dispatching remediation, so a
+  # trusted marker at or after the route means the review handed off (possibly before any panel) and nothing is in flight. A route newer than the marker is a re-review.
+  HANDOFF_Q='[.[][] | select('"$TRUST"') | select((.body // "") | test("(^|\\n)[ \\t]*<!-- FORGE:(CI|INPR|BASESYNC)_REMEDIATION: " + $m + " -->[ \\t\\r]*(\\n|$)")) | ((.created_at // "") | fromdateiso8601? // 0)] | max // 0'
+  HANDOFF_AT=$(printf '%s' "$ISSUE_COMMENTS" | jq -rs --arg m "pr=$PR" "$HANDOFF_Q" 2>/dev/null) || err "handoff markers unreadable"
+  case "$HANDOFF_AT" in ''|*[!0-9]*) HANDOFF_AT=0 ;; esac
+  [ "${VERDICTS:-0}" -eq 0 ] && [ "$ROUTE_AT" -gt 0 ] && [ $(( NOW_S - ROUTE_AT )) -lt "$REVIEW_PENDING_MAX_S" ] \
+    && { [ "$HANDOFF_AT" -eq 0 ] || [ "$HANDOFF_AT" -lt "$ROUTE_AT" ]; } && REVIEW_PENDING=true
 fi
 
 if [ "$LEASE_LIVE" != "true" ] && [ "$REVIEW_PENDING" != "true" ]; then
+  FORGE_REPO="${FORGE_REPO:-$REPO}" FORGE_ISSUE="${FORGE_ISSUE:-$ISSUE}" FORGE_PR="${FORGE_PR:-$PR}" forge_emit liveness decision=PROCEED why=dead
   echo "LIVENESS: DEAD"; exit 0
 fi
 
 PRIOR=$(printf '%s' "$ISSUE_COMMENTS" | jq -rs --arg pr "pr=$PR" "[.[][] | select($TRUST) | select((.body // \"\") | startswith(\"<!-- FORGE:REMEDIATION_DEFERRED -->\")) | select((.body | split(\"\\n\") | index(\$pr)) != null)] | length" 2>/dev/null) || err "deferral records unreadable"
-if [ "${PRIOR:-0}" -ge "$MAX_DEFERRALS" ]; then echo "LIVENESS: EXHAUSTED ${PRIOR}"; exit 11; fi
+if [ "${PRIOR:-0}" -ge "$MAX_DEFERRALS" ]; then FORGE_REPO="${FORGE_REPO:-$REPO}" FORGE_ISSUE="${FORGE_ISSUE:-$ISSUE}" FORGE_PR="${FORGE_PR:-$PR}" forge_emit liveness decision=EXHAUSTED why=deferrals-${PRIOR}
+  echo "LIVENESS: EXHAUSTED ${PRIOR}"; exit 11; fi
 
 if [ "$LEASE_LIVE" = "true" ]; then KIND=lease; DETAIL="lease held by ${LEASE_BY} until ${LEASE_UNTIL}"
 else KIND=review; DETAIL="re-review of ${ROUTE_SHA} has no reviewer verdicts yet"; fi
@@ -93,4 +128,5 @@ lease_by=${LEASE_BY:-none}
 lease_until=${LEASE_UNTIL}"
 if [ -n "${DRY_RUN:-}" ]; then printf 'DRY_RUN: would post:\n%s\n' "$BODY"
 else gh issue comment "$ISSUE" -R "$REPO" --body "$BODY" >/dev/null 2>&1 || err "could not post deferral record"; fi
+FORGE_REPO="${FORGE_REPO:-$REPO}" FORGE_ISSUE="${FORGE_ISSUE:-$ISSUE}" FORGE_PR="${FORGE_PR:-$PR}" forge_emit liveness decision=DEFER why="$KIND"
 echo "LIVENESS: DEFER ${KIND} ${DETAIL}"; exit 10

package/scripts/review-acceptance-gate.sh

@@ -4,13 +4,17 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 #
 # Usage: review-acceptance-gate.sh <issue> <gh_repo> "<gh_flag>" <worktree_path>     (DRY_RUN=1 skips gh writes)
-# Evaluates the ACCEPTANCE_CHECK lines the build gate (B6.5) deferred: `phase=review` checks, plus untagged legacy
-# command/behavior checks on a `gh pr` target. Uses its own FORGE:ACCEPTANCE_GATE_REVIEW marker, never the build
+# Evaluates the ACCEPTANCE_CHECK lines the build gate (B6.5) deferred: `phase=review` checks, plus command/behavior
+# checks on a `gh pr` target (B6.5's legacy deferral ignores any phase= tag, so a tagged phase=build one is selected too). Uses its own FORGE:ACCEPTANCE_GATE_REVIEW marker, never the build
 # gate's FORGE:ACCEPTANCE_GATE header or :PASSED/:FAILED/:BLOCKED sentinels (the engine reads those).
 # Malformed checks (forge#3694 parity with B6.5: 4+ backslash run, `bash -n` parse failure, grep usage error) are skipped and listed,
 # never a FAIL and never needs-human. With zero verified checks and some malformed, a non-blocking notice is posted (no PASSED marker).
 # Exit: 0 passed / no-op / notice / already passed for this head, 1 a deferred check failed (issue gets needs-human).
 set -uo pipefail
+# Telemetry (forge#3834): best-effort decision record; never changes stdout, stderr or the exit code.
+_TEL="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/telemetry.sh"; [ -f "$_TEL" ] && . "$_TEL" 2>/dev/null
+type forge_emit >/dev/null 2>&1 || forge_emit() { :; }
+[ -z "${DRY_RUN:-}" ] || FORGE_TELEMETRY=off
 
 NUMBER="${1:?issue number}"; GH_REPO="${2:?repo}"; GH_FLAG="${3:-}"; WT="${4:-.}"
 cd "$WT" || exit 2
@@ -42,6 +46,7 @@ if printf '%s' "$LAST" | grep -qF "<!-- FORGE:ACCEPTANCE_GATE_REVIEW:PASSED:${HE
 fi
 
 CHECKS=$(printf '%s\n' "$TRUSTED_INV" | jq -r '.' 2>/dev/null | grep "^ACCEPTANCE_CHECK:")
+GREP_CLS=$(forge_resolve classify-grep-exit.sh) # unresolved = grep exit>=2 stays a real FAIL (fail closed, forge#3802)
 GATE_PASS=true; FAILED=""; VERIFIED_COUNT=0; MALFORMED_CHECKS=""; RESULTS=""
 while IFS= read -r check_line; do
   [ -z "$check_line" ] && continue
@@ -57,12 +62,12 @@ while IFS= read -r check_line; do
   [ "$PHASE" = "review" ] || PHASE=build
   case "$TYPE" in command|behavior) ;; *) [ "$PHASE" = "review" ] || continue ;; esac
   if [ "$PHASE" != "review" ]; then
-    printf '%s\n' "$check_line" | grep -qE ' phase=(build|review)( |$)' && continue
     case "$TARGET" in *'gh pr'*) ;; *) continue ;; esac
   fi
   # malformed-check (forge#3694): static screen only parses (bash -n), never executes.
   MALFORMED=""
   { [ "$TYPE" = "command" ] || [ "$TYPE" = "behavior" ]; } && { case "$TARGET" in *'\\\\'*) MALFORMED="run of 4+ backslashes (over-escaped target)";; esac; [ -n "$MALFORMED" ] || bash -n -c "$TARGET" 2>/dev/null || MALFORMED="shell syntax error (unbalanced quotes)"; }
+  { [ "$TYPE" = "command" ] || [ "$TYPE" = "behavior" ]; } && [ -z "$MALFORMED" ] && case "$(printf '%s' "$TARGET" | tr '[:upper:]' '[:lower:]' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')" in none) MALFORMED='target "none" is not a command (a manual criterion must be type=skipped)';; esac
   if [ -n "$MALFORMED" ]; then MALFORMED_CHECKS="${MALFORMED_CHECKS}\n- **$ID** ($DESC): $MALFORMED"; continue; fi
   RESULT="PASS"; DETAIL=""
   case "$TYPE" in
@@ -72,12 +77,14 @@ while IFS= read -r check_line; do
     command|behavior)
       if [ "$MATCHER" = "exit_0" ]; then
         ERR=$(eval "$TARGET" 2>&1 >/dev/null); RC=$?
-        # grep exit >= 2 is a usage error, not a verdict; a missing/unreadable operand also exits 2 but stays a real FAIL.
-        [ "$RC" -ge 2 ] && case "$TARGET" in grep\ *|egrep\ *|fgrep\ *) printf '%s' "$ERR" | grep -qE 'No such file or directory|Permission denied|Is a directory' || MALFORMED="grep usage error (exit $RC)";; esac
+        # grep exit >= 2 is a usage error, not a verdict; only a positively identified usage error (classify-grep-exit.sh) is malformed; a missing operand stays a real FAIL even with stderr suppressed.
+        [ "$RC" -ge 2 ] && MALFORMED=$(bash "$GREP_CLS" "$RC" "$ERR" "$TARGET" 2>/dev/null)
+        [ "$RC" -eq 127 ] && [ -z "$MALFORMED" ] && printf '%s' "$ERR" | grep -qF 'command not found' && MALFORMED="command not found (rc 127): the target is not an executable command"
         [ "$RC" -eq 0 ] || [ -n "$MALFORMED" ] || { RESULT="FAIL"; DETAIL="command exited non-zero: $TARGET"; }
       else
-        OUTPUT=$(eval "$TARGET" 2>&1); RC=$?; ERR="$OUTPUT"
-        [ "$RC" -ge 2 ] && case "$TARGET" in grep\ *|egrep\ *|fgrep\ *) printf '%s' "$ERR" | grep -qE 'No such file or directory|Permission denied|Is a directory' || MALFORMED="grep usage error (exit $RC)";; esac
+        ERRF=$(mktemp); OUTPUT=$(eval "$TARGET" 2>"$ERRF"); RC=$?; ERR=$(cat "$ERRF"); rm -f "$ERRF"; [ -z "$ERR" ] || OUTPUT="${OUTPUT}${OUTPUT:+$'\n'}${ERR}" # classify on stderr only, match on both
+        [ "$RC" -ge 2 ] && MALFORMED=$(bash "$GREP_CLS" "$RC" "$ERR" "$TARGET" 2>/dev/null)
+        [ "$RC" -eq 127 ] && [ -z "$MALFORMED" ] && printf '%s' "$ERR" | grep -qF 'command not found' && MALFORMED="command not found (rc 127): the target is not an executable command"
         if [ -n "$MALFORMED" ]; then :
         else
           printf '%s\n' "$OUTPUT" | grep -qE "$MATCHER" || printf '%s\n' "$OUTPUT" | grep -qF -- "$MATCHER" \
@@ -95,6 +102,8 @@ done <<< "$CHECKS"
 MALFORMED_SECTION=""
 [ -n "$MALFORMED_CHECKS" ] && MALFORMED_SECTION=$(printf '\n**malformed-check (not counted as failures; regenerate the acceptance spec by re-running investigate)**:%b\n' "$MALFORMED_CHECKS")
 
+_nf=$(printf '%b' "$FAILED" | grep -c '^- ' || true); _nm=$(printf '%b' "$MALFORMED_CHECKS" | grep -c '^- ' || true)
+FORGE_REPO="${FORGE_REPO:-$GH_REPO}" FORGE_ISSUE="${FORGE_ISSUE:-$NUMBER}" forge_emit acceptance_gate phase=review verified="$VERIFIED_COUNT" failed="${_nf:-0}" malformed="${_nm:-0}" deferred=$((VERIFIED_COUNT + ${_nm:-0}))
 if [ "$VERIFIED_COUNT" -eq 0 ] && [ -z "$MALFORMED_CHECKS" ]; then
   echo "No deferred acceptance checks; R2.5 is a no-op."
 elif [ "$VERIFIED_COUNT" -eq 0 ]; then

package/scripts/review-acceptance-gate.test.sh

@@ -75,6 +75,9 @@ inv "$(chk ac-1 false)"; rc=$(run); eq "real fail: rc 1" "$rc" 1
 grep -q 'needs-human' "$TMP/out" && ok "real fail: needs-human added" || bad "real fail: no needs-human"
 inv "$(chk ac-1 'grep -q nomatch f.txt')"; rc=$(run); eq "grep exit 1 is a real fail" "$rc" 1
 inv "$(chk ac-1 'grep -q x nofile.txt')"; rc=$(run); eq "grep missing operand file stays a real fail" "$rc" 1
+inv "$(chk ac-1 'grep -q x nofile.txt 2>/dev/null')"; rc=$(run); eq "stderr-suppressed missing operand is a real fail (forge#3802)" "$rc" 1
+grep -q ':PASSED:' "$TMP/out" && bad "stderr-suppressed missing operand wrote PASSED" || ok "stderr-suppressed missing operand: no PASSED marker"
+inv "$(chk ac-1 'grep -sq x nofile.txt')"; rc=$(run); eq "grep -s missing operand is a real fail (forge#3802)" "$rc" 1
 
 for t in "echo 'unbalanced" 'echo a\\\\\\\\b' "grep -E '[' f.txt"; do
   inv "$(chk ac-7 "$t")"; rc=$(run); eq "malformed skipped, rc 0: $t" "$rc" 0
@@ -87,4 +90,14 @@ inv "$(chk ac-1 true)" "$(chk ac-7 "echo 'unbalanced")"; rc=$(run); eq "mixed pa
 grep -q ':PASSED:' "$TMP/out" && grep -qi 'malformed' "$TMP/out" && ok "mixed: PASSED with malformed listed" || bad "mixed: wrong output"
 inv "$(chk ac-1 false)" "$(chk ac-7 "echo 'unbalanced")"; rc=$(run); eq "mixed fail+malformed: fails closed" "$rc" 1
 
+# Selection parity with B6.5 (forge#3809): non-review checks are selected by the `gh pr` target only, never by a phase= text match.
+bt() { printf 'ACCEPTANCE_CHECK: id=%s type=command target="%s" matcher="exit_0" phase=%s description=%s' "$1" "$2" "$3" "$4"; }
+inv "$(bt ac-1 'gh pr view 1 && false' build d)"; rc=$(run); eq "phase=build gh pr check is evaluated (fails)" "$rc" 1
+inv "$(bt ac-1 'gh pr view 1 && true' build d)"; rc=$(run)
+grep -q ':PASSED:' "$TMP/out" && ok "phase=build gh pr check counted and passes" || bad "phase=build gh pr check not counted"
+inv "$(bt ac-1 'false' build d)"; rc=$(run); eq "phase=build non-gh-pr check is not selected" "$rc" 0
+inv "$(bt ac-1 'gh pr view 1 && false' build 'x phase=review y')"; rc=$(run); eq "phase=review in description does not change selection" "$rc" 1
+inv "$(bt ac-1 'false' build 'x phase=review y')"; rc=$(run); eq "phase=review in description does not select a non-gh-pr check" "$rc" 0
+inv 'ACCEPTANCE_CHECK: id=ac-1 type=command target="gh pr view 1 && false" matcher="exit_0" description=untagged'; rc=$(run); eq "untagged gh pr check is evaluated" "$rc" 1
+
 echo "$PASS passed, $FAILN failed"; [ "$FAILN" -eq 0 ]

package/scripts/review-pr-domain-map.test.sh

@@ -27,7 +27,12 @@ awk -v dir="$WORK" '
   /^# END review-pr-agent-domain/ {on=0; close(out)}
 ' "$SPEC"
 copies=$(ls "$WORK"/helper.* 2>/dev/null | wc -l | tr -d ' ')
-if [ "$copies" -ge 4 ]; then ok; else bad "expected >=4 inline agent_domain copies (roster, canonicalize, dispatch, phase 4), found $copies"; fi
+if [ "$copies" -ge 3 ]; then ok; else bad "expected >=3 inline agent_domain copies (canonicalize, dispatch, phase 4), found $copies"; fi
+# The roster script carries its own copy of the helper; it must match the inline copies (forge#3599).
+ROSTER="$ROOT/scripts/review-roster.sh"
+want_fn=$(grep '^agent_domain()' "$WORK/helper.1")
+got_fn=$(grep '^agent_domain()' "$ROSTER")
+if [ -n "$want_fn" ] && [ "$want_fn" = "$got_fn" ]; then ok; else bad "scripts/review-roster.sh agent_domain differs from the inline copies"; fi
 for f in "$WORK"/helper.*; do
   [ -f "$f" ] || continue
   if cmp -s "$f" "$WORK/helper.1"; then ok; else bad "$(basename "$f") differs from helper.1"; fi
@@ -54,8 +59,8 @@ for l in API Api; do check "$l" api; done
 check "CustomDomain" customdomain
 
 # Test 4: add_agent dedups across spellings; canonicalization block yields one entry per persona
-ADD=$(awk '/^add_agent\(\) \{/{on=1} on{print} on && /^\}/{exit}' "$SPEC")
-if [ -n "$ADD" ]; then ok; else bad "add_agent not found in spec"; fi
+ADD=$(awk '/^add_agent\(\) \{/{on=1} on{print} on && /^\}/{exit}' "$ROSTER")
+if [ -n "$ADD" ]; then ok; else bad "add_agent not found in scripts/review-roster.sh"; fi
 eval "$ADD"
 SELECTED_AGENTS="Security INFRA SCRAPING"
 add_agent "Infrastructure"; add_agent "Scraping"; add_agent "Auth"; add_agent "AUTH"; add_agent "security"

package/scripts/review-pr-gate2.test.sh

@@ -93,5 +93,20 @@ for p in infra security scraper; do
   if [ "$reads" -ge 1 ] && [ "$reads" = "$decls" ]; then ok; else bad "$p.md: $reads fences read SLICE_FILE, $decls re-declare it"; fi
 done
 
+# Staging slice path: every placeholder must be bound, and an unresolved SHA must yield a slash-free component.
+STAGING_SPEC="$ROOT/commands/review-pr-staging.md"
+if grep -qE '^REVIEW_SHA_SHORT=.*tr -cd .*unresolved' "$STAGING_SPEC"; then ok; else bad "staging spec does not define a hex-sanitized REVIEW_SHA_SHORT with an unresolved fallback"; fi
+if grep -qF 'Phase -1 `REVIEW_SHA_SHORT`' "$STAGING_SPEC"; then ok; else bad "staging dispatch text does not bind [REVIEW_SHA_SHORT] to Phase -1 REVIEW_SHA_SHORT"; fi
+SHORT_LINE=$(grep -E '^REVIEW_SHA_SHORT=' "$STAGING_SPEC" | head -n 1)
+for full in "" "n/x" "0123456789abcdef0123456789abcdef01234567"; do
+  got=$(REVIEW_SHA_FULL="$full"; eval "$SHORT_LINE"; printf '%s' "$REVIEW_SHA_SHORT")
+  case "$full" in
+    0123*) want="0123456" ;;
+    *) want="unresolved" ;;
+  esac
+  if [ "$got" = "$want" ]; then ok; else bad "REVIEW_SHA_SHORT for '$full' = '$got' (want '$want')"; fi
+  case "$got" in */*) bad "REVIEW_SHA_SHORT contains a slash for '$full'" ;; *) ok ;; esac
+done
+
 echo "review-pr-gate2.test.sh: passed=$PASS failed=$FAILN"
 [ "$FAILN" -eq 0 ]

package/scripts/review-pr-staging-finding-filter.test.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# review-pr-staging-finding-filter.test.sh — fixtures for the anchored open-finding filter (forge#3800).
+# The spec's `# FINDING_PR_FILTER` line is extracted and run against issue shapes: the gate must keep a
+# hit only when its title suffix or `**Source**:` line names exactly PR #N; hidden markers never count.
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+PASS=0; FAILN=0
+ok() { PASS=$((PASS+1)); }
+bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
+command -v jq >/dev/null 2>&1 || { echo "review-pr-staging-finding-filter.test.sh: jq missing, skipped"; exit 0; }
+
+extract() { grep -E '# FINDING_PR_FILTER$' "$1" | sed 's/[[:space:]]*# FINDING_PR_FILTER$//; s/^[[:space:]]*//'; }
+SPEC="$ROOT/commands/review-pr-staging.md"
+DEF="$(extract "$SPEC" | sort -u)"
+[ "$(printf '%s\n' "$DEF" | grep -c .)" -eq 1 ] && ok || bad "review-pr-staging.md must carry one identical FINDING_PR_FILTER definition"
+[ "$(extract "$ROOT/commands/deploy-info.md" | sort -u)" = "$DEF" ] && ok || bad "deploy-info.md filter differs from review-pr-staging.md"
+[ "$(grep -c -F 'FINDING_PR_FILTER' "$SPEC")" -ge 3 ] && ok || bad "filter must be referenced by all three queries"
+grep -q -F 'OVERRIDE: shipping with open findings' "$SPEC" && ok || bad "OVERRIDE text missing"
+eval "$DEF"
+
+run() { printf '%s' "$1" | jq -r --arg n "$2" "$FINDING_PR_FILTER"; }
+J() { jq -n --arg t "$1" --arg b "$2" --argjson n "${3:-1}" '[{number:$n,title:$t,body:$b}]'; }
+
+# #3605 shape: number only inside a hidden issue-create-token
+OUT=$(run "$(J 'Some finding (review finding — PR #3593)' $'**Source**: PR #3593 — x\n\n<!-- issue-create-token:forge-create-20261010T165826Z-1996537-3776 -->' 3605)" 3776)
+[ -z "$OUT" ] && ok || bad "issue-create-token ending in 3776 must not match"
+# bare mention in prose
+OUT=$(run "$(J 'Unrelated' 'see PR #3776 for context')" 3776); [ -z "$OUT" ] && ok || bad "prose mention must not match"
+# longer number
+OUT=$(run "$(J 'F (review finding — PR #37761)' $'**Source**: PR #37761 — x')" 3776); [ -z "$OUT" ] && ok || bad "PR #37761 must not match PR #3776"
+OUT=$(run "$(J 'F (review finding — PR #3776)' 'b')" 37761); [ -z "$OUT" ] && ok || bad "PR #3776 must not match PR #37761"
+# real findings still kept
+OUT=$(run "$(J 'Bad thing (review finding — PR #3776)' 'no source line' 42)" 3776)
+[ "$OUT" = "  - #42: Bad thing (review finding — PR #3776)" ] && ok || bad "title-suffix finding must be kept in the '  - #N: title' format (got: $OUT)"
+OUT=$(run "$(J 'Bad thing' $'intro\n**Source**: PR #3776 — Some title\nmore' 43)" 3776)
+[ "$OUT" = "  - #43: Bad thing" ] && ok || bad "Source-line finding must be kept"
+OUT=$(run "$(J 'Bad thing' '**Source**: PR #3776' 44)" 3776); [ -n "$OUT" ] && ok || bad "Source line at end of body must be kept"
+OUT=$(run "$(J 'Bad thing' null 45)" 3776); [ -z "$OUT" ] && ok || bad "body text 'null' must not match"
+OUT=$(run '[{"number":1,"title":"x (review finding — PR #3776)","body":null}]' 3776); [ -n "$OUT" ] && ok || bad "null body must not break title match"
+
+echo "review-pr-staging-finding-filter.test.sh: $PASS passed, $FAILN failed"
+[ "$FAILN" -eq 0 ]