forgedock 1.16.2 → 1.17.0

package/scripts/review-prepare.test.sh

@@ -0,0 +1,270 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Tests for scripts/review-prepare.sh (review-pr Phases 1-3B + delta/slices) and its shared libs. A stubbed `gh` and throwaway git repos
+# stand in for GitHub and the PR checkout. Run: FORGEDOCK_HOME=$PWD bash scripts/review-prepare.test.sh (bash 3.2 compatible)
+
+set -u
+DIR=$(cd "$(dirname "$0")" && pwd)
+ROOT=$(cd "$DIR/.." && pwd)
+pass=0; fail=0
+ok() { pass=$((pass+1)); }
+bad() { fail=$((fail+1)); echo "FAIL: $1"; }
+WORK=$(mktemp -d "${TMPDIR:-/tmp}/review-prepare-test.XXXXXX")
+trap 'rm -rf "$WORK"' EXIT
+command -v jq >/dev/null 2>&1 || { echo "SKIP: jq not installed"; exit 0; }
+command -v yq >/dev/null 2>&1 || { echo "SKIP: yq not installed"; exit 0; }
+
+export HOME="$WORK/home"; mkdir -p "$HOME"
+unset FORGE_ROOT FORGE_HOME CLAUDE_PLUGIN_ROOT FORGE_CONFIG FORGE_SCRATCHPAD
+export REVIEW_PREPARE_SLEEP=0 GIT_AUTHOR_NAME=t GIT_AUTHOR_EMAIL=t@t GIT_COMMITTER_NAME=t GIT_COMMITTER_EMAIL=t@t
+
+# ---- stubbed gh: every answer comes from files under $FIX ----
+FIX="$WORK/fix"; mkdir -p "$FIX" "$WORK/bin"
+cat > "$WORK/bin/gh" <<'STUB'
+#!/usr/bin/env bash
+a="$*"
+case "$a" in
+  "pr view"*"mergeable,mergeStateStatus"*)
+    f="$FIX/merge.seq"; l=$(head -n 1 "$f"); [ "$(wc -l < "$f")" -gt 1 ] && sed -i.bak 1d "$f"; echo "$l" ;;
+  "pr view"*"--json body"*) cat "$FIX/body.txt" ;;
+  "pr view"*) cat "$FIX/prinfo.json" ;;
+  "pr diff"*"--name-only"*) [ -f "$FIX/difffail" ] && exit 1; cat "$FIX/files" ;;
+  "pr diff"*) cat "$FIX/diff" ;;
+  "pr list"*) cat "$FIX/prior" 2>/dev/null || echo 1 ;;
+  "api --paginate"*) [ -f "$FIX/comments.fail" ] && exit 1; cat "$FIX/comments.json" 2>/dev/null || echo '[]' ;;
+  "issue view"*"labels"*) cat "$FIX/labels" 2>/dev/null || echo false ;;
+  "issue view"*"body"*) cat "$FIX/issuebody" 2>/dev/null ;;
+  *) exit 1 ;;
+esac
+STUB
+chmod +x "$WORK/bin/gh"; export FIX PATH="$WORK/bin:$PATH"
+
+# ---- fake trusted install roots (the real one, or a trimmed copy with a stub delta resolver) ----
+mkroot() {   # mkroot <dir> [no-roster] [delta-stub-file] [templates]
+    local r="$1"; mkdir -p "$r/scripts/lib"
+    cp "$ROOT/scripts/lib/forge-resolve.sh" "$ROOT/scripts/lib/review-delta-mode.sh" "$ROOT/scripts/lib/pr-issue-number.sh" "$ROOT/scripts/lib/review-template-resolve.sh" "$r/scripts/lib/"
+    cp "$ROOT/scripts/trusted-comments.sh" "$r/scripts/"
+    [ "${2:-}" = "no-roster" ] || cp "$ROOT/scripts/review-roster.sh" "$r/scripts/"
+    [ -n "${3:-}" ] && cp "$3" "$r/scripts/review-delta.sh"
+    if [ -n "${4:-}" ]; then mkdir -p "$r/commands/review-pr-agents"; echo "# protocols" > "$r/commands/review-pr-agents/protocols.md"; fi
+}
+
+# ---- throwaway PR checkout: main (A) + one more commit (B = PR head) ----
+REPO_DIR="$WORK/repo"; mkdir -p "$REPO_DIR/services/api"
+git -C "$REPO_DIR" init -q -b main
+echo a > "$REPO_DIR/a.txt"; git -C "$REPO_DIR" add -A; git -C "$REPO_DIR" commit -qm A
+SHA_A=$(git -C "$REPO_DIR" rev-parse HEAD)
+git -C "$REPO_DIR" checkout -q -b pr-branch; echo b > "$REPO_DIR/services/api/auth.py"
+git -C "$REPO_DIR" add -A; git -C "$REPO_DIR" commit -qm B
+SHA_B=$(git -C "$REPO_DIR" rev-parse HEAD)
+git -C "$REPO_DIR" checkout -q main
+git -C "$REPO_DIR" remote add origin "$REPO_DIR"
+
+CFG="$WORK/forge.yaml"
+printf 'project:\n  name: Demo\nverification:\n  commands:\n    typescript:\n      build: "npm run build"\n    python:\n      format: "ruff format --check"\n' > "$CFG"
+
+# setup <head> <base> <files> <diff> [sha]
+setup() {
+    rm -f "${FIX:?}"/*; printf 'MERGEABLE|CLEAN\n' > "$FIX/merge.seq"; : > "$FIX/body.txt"
+    printf '{"number":7,"title":"t","author":{"login":"dev"},"baseRefName":"%s","headRefName":"%s","headRefOid":"%s","additions":5,"deletions":2,"changedFiles":1}\n' "$2" "$1" "${5:-$SHA_B}" > "$FIX/prinfo.json"
+    printf '%s\n' "$3" > "$FIX/files"; printf '%s\n' "$4" > "$FIX/diff"
+}
+CTX=""; RC=0
+# prep <install root> [extra args...]
+prep() {
+    local r="$1"; shift
+    CTX=$(cd "$REPO_DIR" && FORGEDOCK_HOME="$r" FORGE_CONFIG="${CFG_OVERRIDE:-$CFG}" bash "$ROOT/scripts/review-prepare.sh" --pr 7 --repo o/r --out-dir "$WORK/out" "$@" 2>"$WORK/stderr"); RC=$?
+}
+jqv() { printf '%s' "$CTX" | jq -r "$1" 2>/dev/null; }
+eq() { local got; got=$(jqv "$2"); if [ "$got" = "$3" ]; then ok; else bad "$1: $2 = '$got', want '$3'"; fi; }
+rc_is() { if [ "$RC" = "$2" ]; then ok; else bad "$1: exit $RC, want $2 ($(head -c 300 "$WORK/stderr"))"; fi; }
+
+DIFF_PLAIN='diff --git a/README.md b/README.md
++hello'
+DIFF_AUTH_BILL='diff --git a/services/api/auth.py b/services/api/auth.py
++def f(): jwt = get_current_user(); stripe.charge()
+diff --git a/services/api/billing.py b/services/api/billing.py
++credit = 1'
+
+# --- 1. happy path, schema, small tier ---
+setup feat/x staging "README.md" "$DIFF_PLAIN"
+prep "$ROOT"
+rc_is "happy path" 0
+eq "schema" .schema_version 1; eq "status" .status OK; eq "pr number" .pr.number 7; eq "review sha" .pr.review_sha "$SHA_B"
+eq "sha7" .pr.review_sha_short "$(printf '%s' "$SHA_B" | cut -c1-7)"
+eq "small tier" .roster.tier small; eq "small roster" '.roster.agents | join(" ")' security
+eq "lines" '.pr.additions + .pr.deletions' 7
+eq "first-time false" .pr.first_time_contributor false
+eq "template source resolved" '.templates.source != "none"' true
+eq "delta FULL" .delta.mode FULL
+
+# --- 2. merge health ---
+setup feat/x staging "README.md" "$DIFF_PLAIN"; printf 'UNKNOWN|UNKNOWN\nUNKNOWN|UNKNOWN\nMERGEABLE|CLEAN\n' > "$FIX/merge.seq"
+prep "$ROOT"; eq "retry count" .merge_health.retries 2; eq "retry result" .merge_health.mergeable MERGEABLE; eq "retry state" .merge_health.state CLEAN
+setup feat/x staging "README.md" "$DIFF_PLAIN"; printf 'CONFLICTING|DIRTY\n' > "$FIX/merge.seq"
+prep "$ROOT"; eq "conflicting" .merge_health.mergeable CONFLICTING; eq "conflicting state" .merge_health.state DIRTY; eq "no retry on CONFLICTING" .merge_health.retries 0
+setup feat/x staging "README.md" "$DIFF_PLAIN"; printf 'UNKNOWN|UNKNOWN\n' > "$FIX/merge.seq"
+prep "$ROOT"; eq "unknown stays unknown after 3 retries" .merge_health.retries 3; eq "still UNKNOWN" .merge_health.mergeable UNKNOWN
+setup feat/x staging "README.md" "$DIFF_PLAIN"; printf 'garbage|$(rm -rf)\n' > "$FIX/merge.seq"
+prep "$ROOT"; eq "garbage state normalized" .merge_health.state UNKNOWN
+setup feat/x staging "README.md" "$DIFF_PLAIN"; echo 0 > "$FIX/prior"
+prep "$ROOT"; eq "first-time contributor" .pr.first_time_contributor true
+
+# --- 3. classification + scores ---
+setup feat/x staging "services/api/auth.py
+services/api/billing.py" "$DIFF_AUTH_BILL"
+prep "$ROOT"
+eq "services has API" '.classification.services | index("API") != null' true
+eq "domains has AUTH" '.classification.domains | index("AUTH") != null' true
+eq "domains has BILLING" '.classification.domains | index("BILLING") != null' true
+eq "auth score" '.scores.AUTH > 0' true; eq "billing score" '.scores.BILLING > 0' true
+eq "security baseline" .scores.SECURITY 1
+eq "risk FINANCIAL" '.risk_signals | index("FINANCIAL") != null' true
+eq "slice auth file exists" '.slices.auth.diff_file | length > 0' true
+if grep -q "auth.py" "$WORK/out/slice-auth.diff" 2>/dev/null; then ok; else bad "auth slice should hold the auth.py diff"; fi
+if grep -q "billing.py" "$WORK/out/slice-auth.diff" 2>/dev/null; then bad "auth slice leaked the billing diff"; else ok; fi
+eq "auth slice paths" '.slices.auth.paths | join(" ")' "services/api/auth.py"
+eq "security slice is the full diff" '.slices.security.paths | length' 2
+
+# --- 4. roster: thorough, scraping config ordering, unresolved roster script ---
+setup feat/x staging "services/api/auth.py
+services/api/billing.py" "$DIFF_AUTH_BILL"
+prep "$ROOT" --thorough true
+eq "thorough tier" .roster.tier full
+eq "thorough roster has auth+billing+concurrency" '.roster.agents | (index("auth") != null) and (index("billing") != null) and (index("concurrency") != null)' true
+SCRAPE_DIFF='diff --git a/x/scraper.py b/x/scraper.py
++stealth scrape'
+setup feat/x staging "x/scraper.py" "$SCRAPE_DIFF"
+prep "$ROOT" --thorough true; eq "scraping off without config" '.roster.agents | index("scraper") != null' false
+printf 'review:\n  domains:\n    scraping: "tiers"\n' > "$WORK/scrape.yaml"
+CFG_OVERRIDE="$WORK/scrape.yaml" prep "$ROOT" --thorough true
+eq "scraping scored on first pass once configured" '.roster.agents | index("scraper") != null' true
+eq "scraping configured flag" .config.scraping_configured true
+eq "absent yq key is empty, not null" '.config.domains.auth' ""
+mkroot "$WORK/root-noroster" no-roster
+setup feat/x staging "README.md" "$DIFF_PLAIN"
+prep "$WORK/root-noroster"
+eq "unresolved roster script falls back to full" .roster.tier full
+eq "unresolved roster still has security" '.roster.agents | index("security") != null' true
+
+# --- 5. delta mode ---
+cat > "$WORK/delta-stub.sh" <<STUB
+#!/usr/bin/env bash
+case "\${DELTA_KIND:-DELTA}" in
+  DELTA) printf 'DELTA %s..%s\nFULL_ROUNDS=%s\n' "$SHA_A" "$SHA_B" "\${DELTA_ROUNDS:-1}" ;;
+  BASE_SYNC_ONLY) printf 'BASE_SYNC_ONLY %s\nFULL_ROUNDS=1\n' "$SHA_A" ;;
+  JUNK) echo nonsense ;;
+esac
+STUB
+mkroot "$WORK/root-delta" "" "$WORK/delta-stub.sh" templates
+FIXFILES="services/api/auth.py
+services/api/billing.py"
+setup feat/x staging "$FIXFILES" "$DIFF_AUTH_BILL"
+DELTA_KIND=DELTA DELTA_ROUNDS=1 prep "$WORK/root-delta"
+eq "DELTA mode" .delta.mode DELTA; eq "DELTA from" .delta.from "$SHA_A"; eq "DELTA files" '.delta.files | join(" ")' "services/api/auth.py"
+eq "early rounds keep the 3B roster" '.roster.agents | index("security") != null' true
+eq "DELTA slice paths narrow to the delta" '.slices.security.paths | join(" ")' "services/api/auth.py"
+eq "full_files stays whole" '.full_files | length' 2
+DELTA_KIND=DELTA DELTA_ROUNDS=2 prep "$WORK/root-delta"
+eq "round 3 roster is security + touched domains" '.roster.agents | join(" ")' "security auth api"
+DELTA_KIND=BASE_SYNC_ONLY prep "$WORK/root-delta"
+eq "BASE_SYNC_ONLY mode" .delta.mode BASE_SYNC_ONLY; eq "carried from" .delta.carried_from "$SHA_A"
+eq "BASE_SYNC_ONLY roster empty" '.roster.agents | length' 0; eq "BASE_SYNC_ONLY no slices" '.slices | length' 0
+DELTA_KIND=JUNK prep "$WORK/root-delta"; eq "junk resolver output is FULL" .delta.mode FULL
+mkroot "$WORK/root-nodelta" "" "" templates
+prep "$WORK/root-nodelta"; eq "unresolved delta script is FULL" .delta.mode FULL
+DELTA_KIND=DELTA prep "$WORK/root-delta" --thorough true; eq "thorough never goes DELTA" .delta.mode FULL
+setup feat/x staging "$FIXFILES" "$DIFF_AUTH_BILL" "notasha"
+DELTA_KIND=DELTA prep "$WORK/root-delta"; eq "unvalidated sha is FULL" .delta.mode FULL
+
+# --- 6. full-build lane: empty trusted config is BLOCKED, never a silent skip ---
+TS_DIFF='diff --git a/web/src/app/page.tsx b/web/src/app/page.tsx
++x'
+printf 'project:\n  name: Demo\nverification:\n  commands:\n    typescript:\n      typecheck: "tsc"\n' > "$WORK/nobuild.yaml"
+setup milestone/m1 staging "web/src/app/page.tsx" "$TS_DIFF"
+CFG_OVERRIDE="$WORK/nobuild.yaml" prep "$ROOT"
+rc_is "empty ts build on a milestone lane" 3; eq "BLOCKED status" .status BLOCKED
+eq "blocker names typescript.build" '.blockers | join(" ") | test("typescript.build")' true
+eq "config status blocked" .phase2.build_config.status blocked; eq "lane flag" .lane.requires_full_build true
+prep "$ROOT"; rc_is "configured ts build passes" 0; eq "status OK" .status OK
+PY_DIFF='diff --git a/app/x.py b/app/x.py
++x'
+printf 'project:\n  name: Demo\n' > "$WORK/empty.yaml"
+setup milestone/m1 staging "app/x.py" "$PY_DIFF"
+CFG_OVERRIDE="$WORK/empty.yaml" prep "$ROOT"; rc_is "empty python.format on full-build lane" 3
+eq "blocker names python.format" '.blockers | join(" ") | test("python.format")' true
+setup milestone/m1 staging "README.md" "$DIFF_PLAIN"
+CFG_OVERRIDE="$WORK/empty.yaml" prep "$ROOT"; rc_is "docs-only milestone needs no build config" 0
+CFG_OVERRIDE="$WORK/missing.yaml" prep "$ROOT"; rc_is "no forge.yaml at all on a full-build lane" 3
+setup feat/x staging "web/src/app/page.tsx" "$TS_DIFF"
+CFG_OVERRIDE="$WORK/nobuild.yaml" prep "$ROOT"; rc_is "empty ts build on a normal lane is fine" 0
+setup staging main "web/src/app/page.tsx" "$TS_DIFF"
+CFG_OVERRIDE="$WORK/nobuild.yaml" prep "$ROOT"; rc_is "staging to main requires the build" 3
+
+# --- 7. templates: none is a fatal setup error ---
+mkroot "$WORK/root-notpl"
+mkdir -p "$WORK/emptyrepo"; printf 'paths:\n  root: %s\n' "$WORK/emptyrepo" > "$WORK/emptyroot.yaml"
+setup feat/x staging "README.md" "$DIFF_PLAIN"
+CFG_OVERRIDE="$WORK/emptyroot.yaml" prep "$WORK/root-notpl"
+rc_is "no template source" 3; eq "templates none" .templates.source none
+
+# --- 8. issue number extraction and trusted contract ---
+. "$ROOT/scripts/lib/pr-issue-number.sh"
+chk() { local got; got=$(pr_issue_number_of "$2"); if [ "$got" = "$3" ]; then ok; else bad "$1: got '$got', want '$3'"; fi; }
+chk "Closes" "Closes #12" 12
+chk "closes lowercase" "intro
+closes #7 and more" 7
+chk "Fixes" "Fixes #345" 345
+chk "Resolved" "Resolved #9" 9
+chk "no reference yields empty, not the body" "Just a description with no issue reference" ""
+chk "bare #N is not a closing keyword" "see #44" ""
+chk "non numeric" "Closes #abc" ""
+chk "first wins" "Closes #1, Fixes #2" 1
+setup feat/x staging "README.md" "$DIFF_PLAIN"; printf 'Just text, no issue\n' > "$FIX/body.txt"
+prep "$ROOT"; eq "no linked issue" .contract.issue null; eq "no flags" .contract.flags ""
+setup feat/x staging "README.md" "$DIFF_PLAIN"; printf 'Fixes #55\n' > "$FIX/body.txt"
+printf '[{"body":"<!-- FORGE:CONTRACT -->\\n**Risk**: HIGH\\nbilling change","author_association":"OWNER","user":{"login":"o","type":"User"}}]' > "$FIX/comments.json"
+prep "$ROOT"; eq "trusted contract issue" .contract.issue 55
+eq "trusted contract HIGH_RISK" '.contract.flags | test("HIGH_RISK")' true; eq "trusted contract billing flag" '.contract.flags | test("CONTRACT_BILLING")' true
+eq "HIGH_RISK lifts the roster above small" '.roster.tier != "small"' true
+printf '[{"body":"<!-- FORGE:CONTRACT -->\\n**Risk**: HIGH","author_association":"NONE","user":{"login":"evil","type":"User"}}]' > "$FIX/comments.json"
+prep "$ROOT"; eq "planted contract from an untrusted author is ignored" .contract.flags ""; eq "roster stays small" .roster.tier small
+touch "$FIX/comments.fail"
+prep "$ROOT"; eq "a failed contract read widens, never narrows" '.contract.flags | test("HIGH_RISK")' true
+rm -f "$FIX/comments.fail"
+mkroot "$WORK/root-notrust"; rm "$WORK/root-notrust/scripts/trusted-comments.sh"
+prep "$WORK/root-notrust"; eq "unresolved trust script widens, never narrows" '.contract.flags | test("HIGH_RISK")' true
+
+# --- 9. restore_ref: git checkout -f of the recorded ref on every exit path ---
+setup feat/x staging "services/api/auth.py" "$DIFF_AUTH_BILL"
+echo dirty > "$REPO_DIR/a.txt"
+prep "$ROOT" --checkout-pr
+rc_is "checkout-pr run" 0
+if [ "$(git -C "$REPO_DIR" symbolic-ref --short HEAD 2>/dev/null)" = "main" ]; then ok; else bad "restore_ref left HEAD detached, want main"; fi
+git -C "$REPO_DIR" checkout -f -q main
+setup feat/x staging "README.md" "$DIFF_PLAIN" "0000000000000000000000000000000000000000"
+prep "$ROOT" --checkout-pr
+rc_is "unknown sha cannot be checked out" 3
+if [ "$(git -C "$REPO_DIR" symbolic-ref --short HEAD 2>/dev/null)" = "main" ]; then ok; else bad "failed checkout moved HEAD"; fi
+if grep -q 'checkout -f "\$ORIG_REF"' "$ROOT/scripts/review-prepare.sh"; then ok; else bad "restore_ref must use git checkout -f"; fi
+
+# --- 10. fail closed on gh and bad arguments ---
+setup feat/x staging "README.md" "$DIFF_PLAIN"; : > "$FIX/difffail"
+prep "$ROOT"; rc_is "gh pr diff failure" 3; eq "blocked on gh failure" .status BLOCKED
+setup feat/x staging "README.md" "$DIFF_PLAIN"
+for bad_args in "--pr abc --repo o/r" "--pr 7 --repo noslash" "--pr 7 --repo o/r;x/y" "--pr 7 --repo o/r --bogus" "--repo o/r --pr"; do
+    # shellcheck disable=SC2086
+    (cd "$REPO_DIR" && FORGEDOCK_HOME="$ROOT" bash "$ROOT/scripts/review-prepare.sh" $bad_args >/dev/null 2>&1); rcx=$?
+    if [ "$rcx" = 2 ]; then ok; else bad "args '$bad_args' exit $rcx, want 2"; fi
+done
+# every helper resolves through the trusted resolver, never the cwd
+if grep -q 'forge_resolve' "$ROOT/scripts/review-prepare.sh" && grep -q 'schema_version' "$ROOT/scripts/review-prepare.sh"; then ok; else bad "script must use forge_resolve and document schema_version"; fi
+mkdir -p "$WORK/hostile/scripts"; printf '#!/usr/bin/env bash\necho SELECTED_AGENTS=evil\n' > "$WORK/hostile/scripts/review-roster.sh"
+setup feat/x staging "README.md" "$DIFF_PLAIN"
+CTX=$(cd "$WORK/hostile" && FORGEDOCK_HOME="$ROOT" FORGE_CONFIG="$CFG" bash "$ROOT/scripts/review-prepare.sh" --pr 7 --repo o/r --out-dir "$WORK/out" 2>/dev/null)
+eq "a hostile cwd roster script is never used" '.roster.agents | index("evil") != null' false
+
+echo "review-prepare tests: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]

package/scripts/review-roster.sh

@@ -0,0 +1,172 @@
+#!/usr/bin/env bash
+# review-roster.sh — risk-tiered reviewer roster for /review-pr Phase 3B and /review-pr-staging (forge#3599).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Pure function: flags in, key=value lines out. No network, no git, no eval; every flag value is data.
+# Resolve it through forge_resolve (trusted FORGE_ROOT / plugin cache), never from the repo under review.
+#
+# Usage: review-roster.sh [--scores "AUTH=n BILLING=n CONCURRENCY=n DATABASE=n INFRA=n SECURITY=n SCRAPING=n FRONTEND=n API=n"]
+#          [--changed-lines N] [--changed-files N] [--files-file PATH|-] [--fix-pr true|false]
+#          [--source-severity SEV] [--source-domain DOMAIN] [--contract-flags "HIGH_RISK CONTRACT_AUTH ..."]
+#          [--churn true|false] [--danger-zone true|false] [--thorough true|false] [--milestone true|false]
+#          [--scraping-configured true|false] [--database-container true|false] [--spec-cli true|false]
+# Output (stdout): SELECTED_AGENTS=<canonical marker domains, space separated>  TIER=<tier>  REASON=<text>
+# Exit: 0 always for a parseable call; 2 on an unknown flag (callers fall back to the full union, never a narrower roster).
+#
+# Tiers, evaluated in this order:
+#   full      THOROUGH or milestone->staging: Security plus every domain with a score > 0.
+#   fix-pr    the PR closes a `review-finding` issue: Security, plus the source finding's domain when it was HIGH+.
+#   small     <= 60 changed lines, or one file of <= 150 lines: Security only.
+#   medium    61-150 lines: Security plus the score-escalation table (no top-2 baseline).
+#   standard  > 150 lines, or an unknown size (fail toward more agents): top-2 domains by score plus the table.
+# Path triggers escalate in EVERY tier except full (which already runs the union): CONTRACT HIGH_RISK, cross-critical
+# pairs, churn hot-spot, danger zone, bin/engine* (Concurrency + spec-cli), bin/ (spec-cli), auth/session/trust-filter
+# files (Auth), CI/docker/deploy/infra files (Infra), migration/.sql files (Database), SDK/OpenAPI files (API).
+# Auth and Infra are path-gated: a diff-text score alone never selects them. Security is a hard floor in every tier.
+# spec-cli is added only with --spec-cli true (the persona file exists in the repo under review); in the standard tier it
+# also covers commands/**. Bash 3.2 portable (no mapfile, associative arrays, grep -P).
+set -u
+
+S_AUTH=0; S_BILLING=0; S_CONCURRENCY=0; S_DATABASE=0; S_INFRA=0; S_SCRAPING=0; S_FRONTEND=0; S_API=0
+LINES=""; NFILES=""; FILES_FILE=""; FIX_PR=false; SRC_SEV=""; SRC_DOM=""; CFLAGS=""
+CHURN=false; DANGER=false; THOROUGH=false; MILESTONE=false; SCRAPING_ON=false; DB_CONTAINER=false; SPEC_CLI=false
+
+num() { case "${1:-}" in ''|*[!0-9]*) printf '0' ;; *) printf '%s' "$1" ;; esac; }
+agent_domain() { local l; l=$(printf '%s' "${1}" | tr '[:upper:]' '[:lower:]'); case "$l" in infrastructure) l=infra ;; scraping) l=scraper ;; web) l=frontend ;; esac; printf '%s' "$l"; }
+add_agent() {
+    local AGENT CUR HAVE=""
+    AGENT=$(agent_domain "${1}")
+    for CUR in $SELECTED_AGENTS; do
+        [ "$(agent_domain "$CUR")" = "$AGENT" ] && HAVE=1
+    done
+    [ -n "$HAVE" ] || SELECTED_AGENTS="$SELECTED_AGENTS $AGENT"
+}
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --scores)
+            for kv in ${2:-}; do
+                v=$(num "${kv#*=}")
+                case "${kv%%=*}" in
+                    AUTH) S_AUTH=$v ;; BILLING) S_BILLING=$v ;; CONCURRENCY) S_CONCURRENCY=$v ;; DATABASE) S_DATABASE=$v ;;
+                    INFRA) S_INFRA=$v ;; SCRAPING) S_SCRAPING=$v ;; FRONTEND) S_FRONTEND=$v ;; API) S_API=$v ;;
+                esac
+            done; shift 2 ;;
+        --changed-lines) LINES="${2:-}"; shift 2 ;;
+        --changed-files) NFILES="${2:-}"; shift 2 ;;
+        --files-file) FILES_FILE="${2:-}"; shift 2 ;;
+        --fix-pr) FIX_PR="${2:-false}"; shift 2 ;;
+        --source-severity) SRC_SEV="${2:-}"; shift 2 ;;
+        --source-domain) SRC_DOM="${2:-}"; shift 2 ;;
+        --contract-flags) CFLAGS="${2:-}"; shift 2 ;;
+        --churn) CHURN="${2:-false}"; shift 2 ;;
+        --danger-zone) DANGER="${2:-false}"; shift 2 ;;
+        --thorough) THOROUGH="${2:-false}"; shift 2 ;;
+        --milestone) MILESTONE="${2:-false}"; shift 2 ;;
+        --scraping-configured) SCRAPING_ON="${2:-false}"; shift 2 ;;
+        --database-container) DB_CONTAINER="${2:-false}"; shift 2 ;;
+        --spec-cli) SPEC_CLI="${2:-false}"; shift 2 ;;
+        *) echo "review-roster: unknown argument: $1" >&2; exit 2 ;;
+    esac
+done
+
+FILES=""
+if [ "$FILES_FILE" = "-" ]; then FILES=$(cat)
+elif [ -n "$FILES_FILE" ] && [ -f "$FILES_FILE" ]; then FILES=$(cat "$FILES_FILE"); fi
+[ -n "$NFILES" ] || NFILES=$(printf '%s\n' "$FILES" | grep -c . || true)
+case "$LINES" in ''|*[!0-9]*) LINES_KNOWN=false; LINES=0 ;; *) LINES_KNOWN=true ;; esac
+case "$NFILES" in ''|*[!0-9]*) NFILES=0 ;; esac
+
+SELECTED_AGENTS="security"
+TIER=""; REASON=""
+
+# Domains that may be picked by score alone. Auth and Infra are path-gated, Scraping is opt-in.
+top_domains() { # $1 = how many
+    local d out="" list=""
+    list="$S_BILLING:BILLING $S_CONCURRENCY:CONCURRENCY $S_DATABASE:DATABASE $S_FRONTEND:FRONTEND $S_API:API"
+    [ "$SCRAPING_ON" = "true" ] && list="$list $S_SCRAPING:SCRAPING"
+    for d in $(printf '%s\n' "$list" | tr ' ' '\n' | sort -t: -k1,1 -rn | head -n "$1"); do
+        [ "${d%%:*}" -gt 0 ] && out="$out ${d#*:}"
+    done
+    printf '%s' "$out"
+}
+
+if [ "$THOROUGH" = "true" ] || [ "$MILESTONE" = "true" ]; then
+    TIER=full; REASON="thorough or milestone-to-staging: full union"
+    [ "$S_AUTH" -gt 0 ] && add_agent Auth
+    [ "$S_BILLING" -gt 0 ] && { add_agent Billing; add_agent Concurrency; }
+    [ "$S_DATABASE" -gt 0 ] && add_agent Database
+    [ "$S_INFRA" -gt 0 ] && add_agent Infra
+    [ "$S_SCRAPING" -gt 0 ] && [ "$SCRAPING_ON" = "true" ] && add_agent Scraping
+    [ "$S_FRONTEND" -gt 0 ] && add_agent Frontend
+    [ "$S_API" -gt 0 ] && add_agent API
+    printf 'SELECTED_AGENTS=%s\nTIER=%s\nREASON=%s\n' "${SELECTED_AGENTS# }" "$TIER" "$REASON"
+    exit 0
+fi
+
+HIGH_RISK=false
+case " $CFLAGS " in *" HIGH_RISK "*) HIGH_RISK=true ;; esac
+
+if [ "$FIX_PR" = "true" ]; then
+    TIER=fix-pr; REASON="fix PR for a review-finding issue"
+elif [ "$LINES_KNOWN" = "true" ] && { [ "$LINES" -le 60 ] || { [ "$NFILES" -eq 1 ] && [ "$LINES" -le 150 ]; }; }; then
+    TIER=small; REASON="lines=$LINES files=$NFILES"
+elif [ "$LINES_KNOWN" = "true" ] && [ "$LINES" -le 150 ]; then
+    TIER=medium; REASON="lines=$LINES"
+else
+    TIER=standard
+    if [ "$LINES_KNOWN" = "true" ]; then REASON="lines=$LINES"; else REASON="size unknown"; fi
+fi
+# CONTRACT HIGH_RISK is never narrowed: a small, medium or fix-PR roster is lifted to the standard roster.
+BASE_TIER="$TIER"
+if [ "$HIGH_RISK" = "true" ] && [ "$TIER" != "standard" ]; then TIER=standard; REASON="$REASON; CONTRACT HIGH_RISK lifts $BASE_TIER to standard"; fi
+
+TRIG=""
+trig() { case " $TRIG " in *" $1 "*) ;; *) TRIG="$TRIG $1" ;; esac; }
+
+# Tier baseline
+case "$TIER" in
+    fix-pr)
+        case "$(printf '%s' "$SRC_SEV" | tr '[:lower:]' '[:upper:]')" in
+            HIGH|CRITICAL|BLOCKER)
+                if [ -n "$SRC_DOM" ]; then add_agent "$SRC_DOM"; else for d in $(top_domains 1); do add_agent "$d"; done; fi
+                REASON="$REASON; source finding ${SRC_SEV} adds its domain" ;;
+        esac ;;
+    standard) for d in $(top_domains 2); do add_agent "$d"; done ;;
+esac
+
+# Score escalation table (medium and standard only; diff-text signals, so never in the small or fix-pr tiers)
+if [ "$TIER" = "medium" ] || [ "$TIER" = "standard" ]; then
+    [ "$S_BILLING" -ge 3 ] && { add_agent Billing; add_agent Concurrency; trig billing-score; }
+    [ "$S_DATABASE" -ge 3 ] && { add_agent Database; trig database-score; }
+    [ "$S_SCRAPING" -ge 3 ] && [ "$SCRAPING_ON" = "true" ] && { add_agent Scraping; trig scraping; }
+    [ "$S_INFRA" -ge 3 ] && [ "$DB_CONTAINER" = "true" ] && { add_agent Infra; trig db-container; }
+fi
+
+# Path and contract triggers (every tier)
+if [ "$HIGH_RISK" = "true" ]; then
+    trig contract-high-risk
+    case " $CFLAGS " in *" CONTRACT_AUTH "*) add_agent Auth ;; esac
+    case " $CFLAGS " in *" CONTRACT_BILLING "*) add_agent Billing; add_agent Concurrency ;; esac
+    case " $CFLAGS " in *" CONTRACT_DATABASE "*) add_agent Database ;; esac
+fi
+{ [ "$S_AUTH" -ge 2 ] && [ "$S_BILLING" -ge 2 ]; } && { add_agent Auth; add_agent Billing; add_agent Concurrency; trig cross-critical; }
+{ [ "$S_AUTH" -ge 2 ] && [ "$S_DATABASE" -ge 3 ]; } && { add_agent Auth; add_agent Database; trig cross-critical; }
+{ [ "$S_BILLING" -ge 2 ] && [ "$S_CONCURRENCY" -ge 2 ]; } && { add_agent Billing; add_agent Concurrency; add_agent Database; trig cross-critical; }
+if [ "$CHURN" = "true" ] || [ "$DANGER" = "true" ]; then
+    for d in $(top_domains 1); do add_agent "$d"; trig churn-or-danger-zone; done
+fi
+hit() { printf '%s\n' "$FILES" | grep -qiE "$1"; }
+hit '(^|[/_.-])(auth|authn|authz|session|sessions|jwt|oauth|login|logout|password|trust[-_]?filter|trusted[-_a-z]*)([/_.-]|$)' && { add_agent Auth; trig auth-path; }
+hit '^\.github/|(^|/)Dockerfile|docker-compose|(^|/)(deploy|infra|traefik|nginx|k8s|helm|terraform)/|\.tf$' && { add_agent Infra; trig infra-path; }
+hit 'migration|\.sql$' && { add_agent Database; trig migration-path; }
+hit '^sdk/|openapi.*\.json$|openapi-versions/' && { add_agent API; trig sdk-path; }
+hit '^bin/engine' && { add_agent Concurrency; trig bin-engine; }
+if [ "$SPEC_CLI" = "true" ]; then
+    hit '^bin/' && { add_agent spec-cli; trig bin; }
+    [ "$TIER" = "standard" ] && hit '^commands/' && { add_agent spec-cli; trig commands; }
+fi
+
+[ -n "$TRIG" ] && REASON="$REASON; triggers:$TRIG"
+printf 'SELECTED_AGENTS=%s\nTIER=%s\nREASON=%s\n' "${SELECTED_AGENTS# }" "$TIER" "$REASON"

package/scripts/review-roster.test.sh

@@ -0,0 +1,163 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Tests for scripts/review-roster.sh (risk-tiered reviewer roster, forge#3599): the tier cases, the path triggers that
+# escalate in every tier, and the regression table of the 13 review-driven holds. Run: bash scripts/review-roster.test.sh
+# (bash 3.2 compatible)
+#
+# Hold table fixture: the changed-line count, file count and file list of each PR, the PR's linked-issue lineage, and
+# the reviewers whose posted findings were CRITICAL or BLOCKER on it (from the FORGE:REVIEW-AGENT comments). The
+# regression gate: at least one catching reviewer stays selected on every hold, and the sole catcher always does.
+
+set -u
+DIR=$(cd "$(dirname "$0")" && pwd)
+SCRIPT="$DIR/review-roster.sh"
+pass=0; fail=0
+ok() { pass=$((pass+1)); }
+bad() { fail=$((fail+1)); echo "FAIL: $1"; }
+WORK=$(mktemp -d "${TMPDIR:-/tmp}/review-roster.XXXXXX")
+trap 'rm -rf "$WORK"' EXIT
+
+SEL=""; TIER=""; REASON=""
+# run <files, newline separated> <review-roster flags...>
+run() {
+  printf '%s\n' "$1" > "$WORK/files"; shift
+  out=$(bash "$SCRIPT" --files-file "$WORK/files" "$@") || { bad "script exited non-zero for: $*"; return 1; }
+  SEL=$(printf '%s\n' "$out" | sed -n 's/^SELECTED_AGENTS=//p')
+  TIER=$(printf '%s\n' "$out" | sed -n 's/^TIER=//p')
+  REASON=$(printf '%s\n' "$out" | sed -n 's/^REASON=//p')
+}
+has() { case " $SEL " in *" $1 "*) return 0 ;; *) return 1 ;; esac; }
+expect_sel() { if [ "$SEL" = "$2" ]; then ok; else bad "$1: roster '$SEL', want '$2' (tier $TIER; $REASON)"; fi; }
+expect_has() { if has "$2"; then ok; else bad "$1: '$2' missing from '$SEL' (tier $TIER; $REASON)"; fi; }
+expect_not() { if has "$2"; then bad "$1: '$2' should not be in '$SEL' (tier $TIER)"; else ok; fi; }
+expect_tier() { if [ "$TIER" = "$2" ]; then ok; else bad "$1: tier '$TIER', want '$2'"; fi; }
+
+SC_QUIET="AUTH=0 BILLING=0 CONCURRENCY=0 DATABASE=0 INFRA=0 SECURITY=1 SCRAPING=0 FRONTEND=0 API=0"
+SC_NOISY="AUTH=3 BILLING=1 CONCURRENCY=0 DATABASE=1 INFRA=3 SECURITY=4 SCRAPING=0 FRONTEND=2 API=2"
+SC_BUSY="AUTH=3 BILLING=3 CONCURRENCY=3 DATABASE=3 INFRA=3 SECURITY=1 SCRAPING=0 FRONTEND=2 API=2"
+
+# Case 1: a small diff gives Security only, even when diff-text scores are loud
+run "commands/foo.md" --scores "$SC_NOISY" --changed-lines 40 --changed-files 1
+expect_sel "small diff" "security"; expect_tier "small diff" small
+run "scripts/a.sh
+scripts/b.sh" --scores "$SC_NOISY" --changed-lines 60 --changed-files 2
+expect_sel "60-line boundary" "security"
+# a single file is small up to 150 lines, not beyond
+run "scripts/a.sh" --scores "$SC_QUIET" --changed-lines 120 --changed-files 1
+expect_tier "single file" small
+run "scripts/a.sh" --scores "$SC_QUIET" --changed-lines 400 --changed-files 1
+expect_tier "single large file" standard
+
+# Case 2: a small diff touching bin/engine/** adds concurrency and spec-cli
+run "bin/engine/phases.mjs" --scores "$SC_QUIET" --changed-lines 30 --changed-files 1 --spec-cli true
+expect_has "small bin/engine" concurrency; expect_has "small bin/engine" spec-cli; expect_has "small bin/engine" security; expect_tier "small bin/engine" small
+run "bin/engine/phases.mjs" --scores "$SC_QUIET" --changed-lines 30 --changed-files 1 --spec-cli false
+expect_has "consumer repo bin/engine" concurrency; expect_not "consumer repo bin/engine" spec-cli
+
+# Case 3: a fix PR gives Security only
+run "commands/orchestrate/phase-4-execution.md
+commands/work-on.md" --scores "$SC_NOISY" --changed-lines 200 --changed-files 2 --fix-pr true --source-severity MEDIUM
+expect_sel "fix PR" "security"; expect_tier "fix PR" fix-pr
+
+# Case 4: a fix PR whose source finding was HIGH adds the domain agent
+run "commands/work-on.md" --scores "AUTH=0 BILLING=0 CONCURRENCY=2 DATABASE=0 INFRA=0 FRONTEND=0 API=0" --changed-lines 40 --fix-pr true --source-severity HIGH --source-domain Concurrency
+expect_sel "fix PR, HIGH source finding" "security concurrency"
+run "commands/work-on.md" --scores "AUTH=0 BILLING=0 CONCURRENCY=2 DATABASE=0 INFRA=0 FRONTEND=0 API=0" --changed-lines 40 --fix-pr true --source-severity critical
+expect_sel "fix PR, CRITICAL source, top domain" "security concurrency"
+
+# Case 5: CONTRACT HIGH_RISK escalates in every tier
+for tier_args in "--changed-lines 30 --changed-files 1" "--changed-lines 100" "--changed-lines 400" "--changed-lines 30 --fix-pr true"; do
+  # shellcheck disable=SC2086
+  run "svc/x.py" --scores "$SC_QUIET" $tier_args --contract-flags "HIGH_RISK CONTRACT_AUTH CONTRACT_BILLING"
+  expect_has "HIGH_RISK ($tier_args)" auth; expect_has "HIGH_RISK ($tier_args)" billing; expect_has "HIGH_RISK ($tier_args)" concurrency
+done
+run "svc/x.py" --scores "$SC_QUIET" --changed-lines 30 --contract-flags "CONTRACT_AUTH"
+expect_not "CONTRACT_AUTH without HIGH_RISK" auth
+
+# Case 6: --thorough and milestone give the full union
+run "svc/x.py" --scores "$SC_BUSY" --changed-lines 10 --thorough true
+expect_tier "thorough" full
+for d in security auth billing concurrency database infra frontend api; do expect_has "thorough" "$d"; done
+expect_not "thorough, scraping not configured" scraper
+run "svc/x.py" --scores "$SC_BUSY SCRAPING=3" --changed-lines 10 --milestone true --scraping-configured true
+expect_tier "milestone" full; expect_has "milestone" scraper
+
+# Path gates: auth and infra only by path; the other path triggers fire in the small tier
+run "svc/app/routers/session.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path" auth
+run "scripts/trusted-comments.sh" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "trust-filter path" auth
+run "commands/review-pr.md" --scores "AUTH=3 INFRA=3 DATABASE=0 BILLING=0 CONCURRENCY=0" --changed-lines 120
+expect_not "auth from prose score alone" auth; expect_not "infra from prose score alone" infra
+run ".github/workflows/ci.yml" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "infra path" infra
+run "docker-compose.prod.yml" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "docker path" infra
+run "db/migrations/0042_add.sql" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "migration path" database
+run "sdk/node/src/index.ts" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "sdk path" api
+run "svc/x.py" --scores "AUTH=2 BILLING=2" --changed-lines 20 --changed-files 1
+expect_has "cross-critical" auth; expect_has "cross-critical" billing
+run "svc/x.py" --scores "BILLING=3 CONCURRENCY=3" --changed-lines 20 --changed-files 1 --churn true
+expect_has "churn hot-spot top domain" billing
+run "svc/x.py" --scores "BILLING=3" --changed-lines 20 --changed-files 2
+expect_not "billing score in small tier" billing
+run "svc/x.py
+svc/y.py" --scores "BILLING=3" --changed-lines 100
+expect_has "billing score in medium tier" billing; expect_has "billing score in medium tier" concurrency
+
+# Tier shape: standard keeps the top-2 baseline, medium does not
+run "web/src/app/a.tsx
+web/src/b.tsx" --scores "FRONTEND=3 API=2 BILLING=1 DATABASE=1" --changed-lines 300
+expect_tier "standard" standard; expect_has "standard" frontend; expect_has "standard" api; expect_not "standard top-2 only" billing
+run "web/src/app/a.tsx
+web/src/b.tsx" --scores "FRONTEND=3 API=2" --changed-lines 100
+expect_sel "medium has no baseline" "security"
+run "svc/x.py" --scores "FRONTEND=3" --changed-lines ""
+expect_tier "unknown size" standard; expect_has "unknown size" frontend
+run "commands/x.md
+commands/y.md" --scores "$SC_QUIET" --changed-lines 300 --spec-cli true
+expect_has "standard commands/** adds spec-cli" spec-cli
+run "commands/x.md
+commands/y.md" --scores "$SC_QUIET" --changed-lines 100 --spec-cli true
+expect_not "medium commands/** has no spec-cli" spec-cli
+
+# Roster output is canonical and duplicate free
+run "bin/engine/a.mjs
+.github/workflows/a.yml" --scores "$SC_BUSY" --changed-lines 300 --spec-cli true
+n=$(printf '%s' "$SEL" | tr ' ' '\n' | grep -c .); u=$(printf '%s' "$SEL" | tr ' ' '\n' | sort -u | grep -c .)
+if [ "$n" -eq "$u" ]; then ok; else bad "duplicate roster entries in '$SEL'"; fi
+case "$SEL" in *[A-Z]*) bad "non-canonical roster '$SEL'" ;; *) ok ;; esac
+
+# Unknown flag fails (callers fall back to the full union)
+if bash "$SCRIPT" --bogus 1 >/dev/null 2>&1; then bad "unknown flag accepted"; else ok; fi
+
+# Regression table: the 13 review-driven holds. Columns: PR | lines | files | fix-PR | catchers (CRITICAL/BLOCKER) | sole catcher | file list
+hold() {
+  pr="$1"; lines="$2"; nf="$3"; fixpr="$4"; catchers="$5"; sole="$6"; files="$7"
+  run "$(printf '%s' "$files" | tr ' ' '\n')" --scores "$SC_QUIET" --changed-lines "$lines" --changed-files "$nf" --fix-pr "$fixpr" --spec-cli true
+  found=""
+  for c in $catchers; do has "$c" && found=1; done
+  if [ -n "$found" ]; then ok; else bad "hold #$pr: none of [$catchers] selected: '$SEL' (tier $TIER)"; fi
+  if [ -n "$sole" ]; then if has "$sole"; then ok; else bad "hold #$pr: sole catcher '$sole' not selected: '$SEL'"; fi; fi
+  if has security; then ok; else bad "hold #$pr: security missing"; fi
+}
+hold 3426 126 3 true "security concurrency" "" "commands/orchestrate/phase-4-execution.md commands/work-on.md commands/work-on/remediate.md"
+hold 3438 227 8 false "spec-cli" "spec-cli" "commands/review-pr-agents/protocols.md commands/review-pr.md commands/work-on.md commands/work-on/remediate.md commands/work-on/review.md docs/WORK-ON-RUNTIME.md docs/spec/review-protocol.md scripts/forge-root.test.sh"
+hold 3461 454 12 false "security spec-cli" "" "commands/work-on.md commands/work-on/build.md commands/work-on/build/implement.md commands/work-on/close.md commands/work-on/decompose.md docs/CONFIG.md docs/spec/forge-protocol-v1.md forge.yaml.example packages/protocol/src/types.js scripts/check-spec-markers.sh scripts/diff-size.sh scripts/diff-size.test.sh"
+hold 3464 53 2 true "security concurrency" "" "commands/orchestrate/phase-4-execution.md commands/work-on.md"
+hold 3480 56 3 true "security" "" "commands/orchestrate/phase-4-execution.md commands/work-on.md scripts/check-spec-markers.sh"
+hold 3490 220 3 false "security" "" "commands/review-pr-staging.md commands/review-pr.md scripts/review-pr-arguments.test.sh"
+hold 3500 263 5 false "security" "" ".github/workflows/check-commands.yml commands/work-on/build/validate.md commands/work-on/review.md scripts/check-branch-ancestry.sh scripts/check-branch-ancestry.test.sh"
+hold 3502 813 11 false "concurrency" "concurrency" "bin/engine-cli.mjs bin/engine.mjs bin/engine/phases-args.test.mjs bin/engine/phases.mjs bin/engine/runlog.mjs bin/tests/engine-crash.test.mjs bin/tests/engine-phases.test.mjs bin/tests/engine-runlog.test.mjs bin/tests/engine.test.mjs docs/WORK-ON-RUNTIME.md packages/protocol/src/phases.js"
+hold 3509 274 6 false "security spec-cli" "" "bin/engine.mjs bin/engine/phases.mjs bin/tests/engine-crash.test.mjs bin/tests/engine-phases.test.mjs bin/tests/engine-runlog.test.mjs bin/tests/engine.test.mjs"
+hold 3513 205 7 false "security concurrency infra spec-cli" "" "commands/orchestrate/phase-4-execution.md commands/review-pr.md commands/work-on.md commands/work-on/remediate.md commands/work-on/review.md docs/WORK-ON-RUNTIME.md scripts/check-spec-markers.sh"
+hold 3520 4977 9 false "concurrency" "concurrency" "bin/engine-cli.mjs bin/engine.mjs bin/engine/runlog.mjs bin/forgedock.mjs bin/runner.mjs bin/tests/engine.test.mjs bin/tests/runner.test.mjs commands/orchestrate/phase-4-execution.md devdocs/modules/runner.md"
+hold 3524 156 5 false "spec-cli" "spec-cli" "bin/engine.mjs bin/engine/phases.mjs bin/runner.mjs bin/tests/engine-phases.test.mjs bin/tests/engine.test.mjs"
+hold 3555 137 8 false "security" "" "bin/engine/phases.mjs bin/tests/engine-phases.test.mjs commands/work-on/build.md commands/work-on/build/implement.md commands/work-on/decompose.md commands/work-on/investigate.md packages/protocol/CHANGELOG.md packages/protocol/src/phases.js"
+
+echo "review-roster: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]

package/scripts/run-shell-tests.sh

@@ -19,6 +19,9 @@ set -u
 SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 REPO_ROOT=$(cd "$SCRIPT_DIR/.." && pwd)
 cd "$REPO_ROOT" || exit 1
+# Gate scripts emit best-effort telemetry (forge#3834); suites run with it off so stubbed gh calls never buffer into ~/.forge.
+# scripts/telemetry.test.sh sets its own environment.
+export FORGE_TELEMETRY=off
 
 TIMEOUT_SECS="${SHELL_TEST_TIMEOUT:-300}"
 # WIRE:PROVEN — manual: SHELL_TEST_TIMEOUT=abc and SHELL_TEST_TIMEOUT=0 both print the error and exit 2