forgedock 1.17.0 → 1.18.0

package/scripts/diff-size.test.sh

@@ -137,10 +137,67 @@ check "test name patterns" "$OUT" test_lines 30
 reset; gen 20 > keep.py; gen 900 > package-lock.json; git add -A
 OUT="$(run --threshold 1000)"; check "excluded not in new_lines" "$OUT" new_lines 20
 
-# existing key order is unchanged: cohesion keys sit between over= and top=
+# existing key order is unchanged: cohesion keys sit between over= and top=; review keys follow cohesive=
 reset; gen 3 > s.txt; git add -A
 KEYS="$(run | sed -n 's/^\([a-z_]*\)=.*/\1/p' | tr '\n' ' ')"
-[ "$KEYS" = "diff_lines excluded_lines threshold over new_lines test_lines cohesive_lines cohesive top " ] && ok || bad "key order ($KEYS)"
+[ "$KEYS" = "diff_lines excluded_lines threshold over new_lines test_lines cohesive_lines cohesive ws_lines review_weight modules top " ] && ok || bad "key order ($KEYS)"
+
+# review_weight (forge#3862): a pure re-indent counts about 0, whatever its raw size
+reset; mkdir -p svc; awk 'BEGIN{for(i=0;i<120;i++) print "if x:\n    y" i}' > svc/h.py; git add -A; git commit -qm h; git push -q origin feat:staging 2>/dev/null
+awk 'BEGIN{for(i=0;i<120;i++) print "if x:\n        y" i}' > svc/h.py; git add -A
+OUT="$(run)"; check "re-indent raw diff_lines" "$OUT" diff_lines 240; check "re-indent ws_lines" "$OUT" ws_lines 0
+check "re-indent review_weight" "$OUT" review_weight 0; check "re-indent modules" "$OUT" modules 0
+git reset -q --hard origin/staging
+
+# tests are weighted (default 50%, configurable); ws_lines is unweighted
+reset; mkdir -p src tests; gen 100 > src/m.py; gen 200 > tests/test_m.py; git add -A
+OUT="$(run)"; check "weight ws_lines" "$OUT" ws_lines 300; check "weight default 50" "$OUT" review_weight 200
+OUT="$(run --test-weight 25)"; check "weight 25" "$OUT" review_weight 150
+OUT="$(run --test-weight 0)"; check "weight 0" "$OUT" review_weight 100
+OUT="$(run --test-weight 100)"; check "weight 100" "$OUT" review_weight 300
+reset; mkdir -p src; gen 3 > src/o.py; mkdir -p tests; gen 1 > tests/test_o.py; git add -A
+OUT="$(run)"; check "weight rounds up" "$OUT" review_weight 4
+
+# generated and vendored code is excluded from review_weight and modules
+reset; gen 10 > keep.py; mkdir -p vendor generated; gen 900 > vendor/v.js; gen 900 > generated/g.js; gen 900 > package-lock.json; git add -A
+OUT="$(run)"; check "excluded ws_lines" "$OUT" ws_lines 10; check "excluded review_weight" "$OUT" review_weight 10; check "excluded modules" "$OUT" modules 1
+
+# module count: distinct directories at --module-depth
+reset; mkdir -p a/b/c a/b/d a/e f; gen 5 > a/b/c/1.py; gen 5 > a/b/d/2.py; gen 5 > a/e/3.py; gen 5 > f/4.py; gen 5 > root.py; git add -A
+OUT="$(run)"; check "modules depth 2" "$OUT" modules 4
+OUT="$(run --module-depth 1)"; check "modules depth 1" "$OUT" modules 3
+OUT="$(run --module-depth 3)"; check "modules depth 3" "$OUT" modules 5
+
+# scope diff: in-plan, out-of-plan, prefix entries, formatting noise, no baseline, overrun
+reset; mkdir -p src tests docs; gen 10 > src/a.py; gen 10 > src/b.py; gen 10 > tests/test_a.py; gen 10 > docs/x.md; git add -A
+printf '%s\n' '# plan' '- `src/a.py`' '* ./src/b.py' '' 'tests/' > "$TMP/plan"
+OUT="$(run --plan-files "$TMP/plan")"
+check "scope out_of_plan" "$OUT" scope out_of_plan; check "scope count" "$OUT" out_of_plan_count 1
+check "scope plan_files" "$OUT" plan_files 3; check "scope path" "$OUT" out_of_plan docs/x.md
+printf '%s\n' src/a.py src/b.py tests/test_a.py docs/x.md > "$TMP/plan"
+OUT="$(run --plan-files "$TMP/plan")"; check "scope ok" "$OUT" scope ok; check "scope ok count" "$OUT" out_of_plan_count 0
+printf '%s\n' 'src/a.py' > "$TMP/plan"
+OUT="$(run --plan-files "$TMP/plan")"; check "scope 3 out" "$OUT" out_of_plan_count 3
+: > "$TMP/plan"; OUT="$(run --plan-files "$TMP/plan")"; check "empty plan is no_baseline" "$OUT" scope no_baseline; check "no_baseline count" "$OUT" out_of_plan_count 0
+OUT="$(run)"; [ -z "$(val "$OUT" scope)" ] && ok || bad "scope keys absent without plan args"
+# excluded files are never out-of-plan; a path is data (glob chars, spaces) not a pattern
+reset; mkdir -p vendor; gen 5 > vendor/z.js; gen 5 > 'we ird[1].txt'; git add -A
+printf '%s\n' 'src/a.py' > "$TMP/plan"
+OUT="$(run --plan-files "$TMP/plan")"; check "excluded not out-of-plan" "$OUT" out_of_plan_count 1; check "path with space and glob quoted" "$OUT" out_of_plan 'we ird[1].txt'
+printf '%s\n' '*.txt' > "$TMP/plan"; OUT="$(run --plan-files "$TMP/plan")"; check "plan entry is not a glob" "$OUT" out_of_plan_count 1
+# overrun against the plan estimate (ws-insensitive actual)
+reset; gen 500 > big.py; git add -A
+OUT="$(run --estimate 200)"; check "overrun 2.5x" "$OUT" overrun true; check "overrun estimate" "$OUT" estimate 200; check "overrun no plan file is no_baseline" "$OUT" scope no_baseline
+OUT="$(run --estimate 250)"; check "at 2x not overrun" "$OUT" overrun false
+OUT="$(run --estimate 200 --overrun-pct 300)"; check "custom overrun pct" "$OUT" overrun false
+OUT="$(run --estimate 0)"; check "estimate 0 is no estimate" "$OUT" overrun false
+# unreadable plan fails closed; bad numeric args are usage errors
+OUT="$(bash "$S" --repo-path "$TMP/w" --base staging --plan-files "$TMP/none" 2>/dev/null)"; rc=$?
+{ [ "$rc" = 2 ] && [ -z "$OUT" ]; } && ok || bad "unreadable plan (rc=$rc)"
+for bad_arg in "--test-weight x" "--module-depth 0" "--overrun-pct -1" "--estimate x"; do
+  OUT="$(bash "$S" --repo-path "$TMP/w" --base staging $bad_arg 2>/dev/null)"; rc=$?
+  { [ "$rc" = 2 ] && [ -z "$OUT" ]; } && ok || bad "bad arg $bad_arg (rc=$rc)"
+done
 
 # fail closed: bad repo path, bad base, bad threshold, unknown arg, missing base
 OUT="$(bash "$S" --repo-path "$TMP/nope" --base staging 2>/dev/null)"; rc=$?

package/scripts/forge-root.test.sh

@@ -95,8 +95,8 @@ fi
 # forge#3758 (hgate is a fixture of its own: the loop runs once per shell and h14 is reused below with other versions): deploy-gate script resolves on a plugin-only install (cache only, no symlink, no FORGE_* env).
 # The gate-script line is taken verbatim from the spec so the test exercises exactly what ships.
 mkscripts "$T/hgate/.claude/plugins/cache/forgedock/forgedock/1.0.0"; : > "$T/hgate/.claude/plugins/cache/forgedock/forgedock/1.0.0/scripts/resolve-deploy-gate.sh"
-# review-pr.md resolves the gate script through the forge_resolve stub (#3780): the locator and the call line are taken verbatim from the spec.
-sed 's/^[[:space:]]*//' "$ROOT/commands/review-pr.md" | grep '^GATE_SCRIPT=\$(forge_resolve resolve-deploy-gate.sh)$' | sort -u > "$T/gs"
+# review-finalize.sh (the review-pr.md Phase 8 gate) resolves the gate script through forge_resolve (#3780): the locator and the call line are taken verbatim from the script.
+sed 's/^[[:space:]]*//' "$ROOT/scripts/review-finalize.sh" | grep '^GATE_SCRIPT=\$(forge_resolve resolve-deploy-gate.sh)$' | sort -u > "$T/gs"
 expect "gate-script resolver line is identical across sites" 1 "$(wc -l < "$T/gs" | tr -d ' ')"
 { sed 's/^[[:space:]]*//' "$ROOT/commands/review-pr.md" | grep -m1 '^type forge_resolve >/dev/null'; cat "$T/gs"; } > "$T/gs_full"
 gate_run() { ( cd "$T/consumer" && env -i PATH="$PATH" HOME="$1" "$SH" -c "$(cat "$T/gs_full"); printf %s \"\$GATE_SCRIPT\"" ); }
@@ -271,11 +271,13 @@ extract_helper_block() { # file var -> block on stdout
 extract_helper_fn() { # file -> function on stdout
   awk '/^resolve_extract_affected_files\(\) \{/ {inb=1} inb {print} inb && /^\}$/ {exit}' "$1"
 }
-# review-pr.md resolves its helpers through the forge_resolve stub (#3780): the pinned locator plus the call line, taken from the spec.
+# review-pr.md resolves its helpers through the forge_resolve stub (#3780); since #3841 the classify, cap, milestone, priority and dedup helpers are resolved inside
+# scripts/review-finalize.sh and the code-index helper inside scripts/review-prepare.sh: the pinned locator plus the call line, taken from those scripts.
 stub_block() { # file var -> locator + the first `var=$(forge_resolve ...)` line, indentation stripped
   sed 's/^[[:space:]]*//' "$1" | grep -m1 '^type forge_resolve >/dev/null'; sed 's/^[[:space:]]*//' "$1" | grep -m1 "^$2=\$(forge_resolve "
 }
-HR_CLASSIFY="$ROOT/commands/review-pr.md"
+HR_CLASSIFY="$ROOT/scripts/review-finalize.sh"
+HR_PREPARE="$ROOT/scripts/review-prepare.sh"
 HR_AMP="$ROOT/commands/orchestrate/phase-4-execution.md"
 HR_EX3="$ROOT/commands/orchestrate/phase-3-dependency.md"
 stub_block "$HR_CLASSIFY" CLASSIFY_SCRIPT > "$T/hr_classify.sh"
@@ -285,7 +287,7 @@ extract_helper_fn "$HR_AMP" > "$T/hr_ex4.sh"
 extract_helper_fn "$HR_EX3" > "$T/hr_ex3.sh"
 expect "CLASSIFY_SCRIPT resolver stub found" 1 "$(grep -c '^CLASSIFY_SCRIPT=\$(forge_resolve classify-finding.sh)$' "$T/hr_classify.sh")"
 expect "CAP_SCRIPT resolver stub found" 1 "$(grep -c '^CAP_SCRIPT=\$(forge_resolve cap-findings.sh)$' "$T/hr_cap.sh")"
-expect "CAP_SCRIPT resolver stub found in review-pr-staging.md" 1 "$(sed 's/^[[:space:]]*//' "$ROOT/commands/review-pr-staging.md" | grep -c '^CAP_SCRIPT=\$(forge_resolve cap-findings.sh)$')"
+expect "review-pr-staging.md no longer carries a CAP_SCRIPT resolver stub (review-finalize.sh owns the cap helper, #3841)" 0 "$(sed 's/^[[:space:]]*//' "$ROOT/commands/review-pr-staging.md" | grep -c '^CAP_SCRIPT=\$(forge_resolve cap-findings.sh)$')"
 expect "AMP_SCRIPT resolver block found" 1 "$(grep -c '^AMP_SCRIPT=""' "$T/hr_amp.sh")"
 expect "extract-affected-files resolver found in phase-4" 1 "$(grep -c 'resolve_extract_affected_files() {' "$T/hr_ex4.sh")"
 expect "extract-affected-files resolver found in phase-3" 1 "$(grep -c 'resolve_extract_affected_files() {' "$T/hr_ex3.sh")"
@@ -337,7 +339,7 @@ hr_check_stub() { # label file var script: the spec calls the script through the
 }
 hr_check_stub review-pr "$HR_CLASSIFY" DERIVE_MILESTONE_SCRIPT derive-finding-milestone.sh
 hr_check_stub review-pr "$HR_CLASSIFY" PRIORITY_SCRIPT severity-to-priority.sh
-hr_check_stub review-pr "$HR_CLASSIFY" CODE_INDEX_SCRIPT code-index.sh
+hr_check_stub review-prepare "$HR_PREPARE" CODE_INDEX_SCRIPT code-index.sh
 hr_check_stub review-pr "$HR_CLASSIFY" DEDUP_SCRIPT issue-dedup.sh
 hr_check_block issue "$ROOT/commands/issue.md" DEDUP_SCRIPT issue-dedup.sh
 stub_block "$HR_CLASSIFY" DERIVE_MILESTONE_SCRIPT > "$T/hr_dm.sh"
@@ -414,9 +416,9 @@ FR="$ROOT/scripts/lib/forge-resolve.sh"; FB="$ROOT/scripts/lib/fence-bootstrap.s
 [ -f "$FR" ] && [ -f "$FB" ] && ok || bad "scripts/lib/forge-resolve.sh and scripts/lib/fence-bootstrap.sh must exist"
 sed 's/^[[:space:]]*//' "$STG_SPEC" | grep '^type forge_resolve >/dev/null' | sort | uniq -c > "$T/loc_uniq"
 [ "$(wc -l < "$T/loc_uniq" | tr -d ' ')" = 1 ] && ok || bad "forge_resolve locator line must be byte-identical across every stub in review-pr-staging.md"
-[ "$(awk '{print $1}' "$T/loc_uniq")" -ge 30 ] && ok || bad "expected a locator on every bootstrap (21) and resolver (11) stub"
+[ "$(awk '{print $1}' "$T/loc_uniq")" -ge 25 ] && ok || bad "expected a locator on every bootstrap (21) and resolver (5) stub"
 grep -qE 'PWD|\$\(pwd\)|REPO_PATH' "$T/locator.sh" && bad "stub locator must not consult the cwd or repo under review" || ok
-[ "$(grep -c '# FENCE_BOOTSTRAP$' "$STG_SPEC")" = 22 ] && ok || bad "expected 22 fence bootstrap stubs"
+[ "$(grep -c '# FENCE_BOOTSTRAP$' "$STG_SPEC")" = 21 ] && ok || bad "expected 21 fence bootstrap stubs"
 [ "$(grep '# FENCE_BOOTSTRAP$' "$STG_SPEC" | sort -u | wc -l | tr -d ' ')" = 1 ] && ok || bad "fence bootstrap stubs must be byte-identical"
 grep '# FENCE_BOOTSTRAP$' "$STG_SPEC" | sed 1q | grep -qF 'exit 1' && ok || bad "fence bootstrap stub must fail closed (exit 1) when the helper is unresolved"
 # the spec carries none of the old inlined blocks
@@ -424,11 +426,11 @@ grep -qE '^[[:space:]]*(TRUSTED_SCRIPT|[A-Z_]+_SCRIPT)=""$|_tc="\$\(printf' "$ST
 # no $PWD / $(pwd) tier in the helper (comments aside)
 grep -nE '\$PWD|\$\(pwd\)|\$\{PWD' "$FR" | grep -vE '^[0-9]+:[[:space:]]*#' | grep -q . && bad "forge-resolve.sh must have no PWD tier" || ok
 
-# Guard (#3779): remediate.md carries the same byte-identical locator stub (7 fences: 5 gate sites, trusted-comments, CI gate) and none of the old inlined resolvers.
+# Guard (#3779): remediate.md carries the same byte-identical locator stub (9 fences: M4 ancestry, merged-first transition-label (the merge-branch one reuses the CI-gate fence locator), 5 gate sites, trusted-comments, CI gate) and none of the old inlined resolvers.
 REM_SPEC="$ROOT/commands/work-on/remediate.md"
 sed 's/^[[:space:]]*//' "$REM_SPEC" | grep '^type forge_resolve >/dev/null' | sort | uniq -c > "$T/rem_uniq"
 [ "$(wc -l < "$T/rem_uniq" | tr -d ' ')" = 1 ] && ok || bad "remediate.md locator lines must be byte-identical"
-expect "remediate.md locator count (one per fence that resolves a script)" 7 "$(awk '{print $1}' "$T/rem_uniq")"
+expect "remediate.md locator count (one per fence that resolves a script)" 9 "$(awk '{print $1}' "$T/rem_uniq")"
 [ "$(sed 's/^[[:space:]]*//' "$REM_SPEC" | grep '^type forge_resolve >/dev/null' | sed 1q)" = "$(cat "$T/locator.sh")" ] && ok || bad "remediate.md locator differs from the pinned review-pr-staging.md locator"
 expect "remediate.md inlined FORGE_ROOT bootstrap copies" 0 "$(grep -c '# FORGE_ROOT bootstrap' "$REM_SPEC" || true)"
 grep -qE '^[[:space:]]*(TRUSTED_SCRIPT|[A-Z_]+_SCRIPT)=""|_tc="\$\(printf|^[[:space:]]*GATE_SCRIPT=""' "$REM_SPEC" && bad "remediate.md still carries an inlined resolver block" || ok
@@ -441,7 +443,7 @@ expect "remediate.md: forge_resolve calls without a preceding locator in the sam
 RP_SPEC="$ROOT/commands/review-pr.md"
 sed 's/^[[:space:]]*//' "$RP_SPEC" | grep '^type forge_resolve >/dev/null' | sort | uniq -c > "$T/rp_uniq"
 [ "$(wc -l < "$T/rp_uniq" | tr -d ' ')" = 1 ] && ok || bad "review-pr.md locator lines must be byte-identical"
-[ "$(awk '{print $1}' "$T/rp_uniq")" -ge 15 ] && ok || bad "expected a locator in every review-pr.md fence that resolves a script (>=15)"
+[ "$(awk '{print $1}' "$T/rp_uniq")" -ge 10 ] && ok || bad "expected a locator in every review-pr.md fence that resolves a script (>=10; the classify/file/prepare helpers resolve inside the review scripts since #3841)"
 [ "$(sed 's/^[[:space:]]*//' "$RP_SPEC" | grep '^type forge_resolve >/dev/null' | sed 1q)" = "$(cat "$T/locator.sh")" ] && ok || bad "review-pr.md locator differs from the pinned review-pr-staging.md locator"
 expect "review-pr.md inlined FORGE_ROOT bootstrap copies" 0 "$(grep -c 'FORGE_ROOT bootstrap' "$RP_SPEC" || true)"
 # (SCOPE_SCRIPT="" is a sibling path derived from the resolved trusted script's own directory, not a resolver accumulator)

package/scripts/publish-staging-sync.test.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# publish-staging-sync.test.sh — guards the publish.yml "Sync version to staging" step (forge#3695)
+# and the deploy-pr Phase 2A.5 version-sync pre-flight. Static assertions, no network.
+# Usage: bash scripts/publish-staging-sync.test.sh
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+PUB="$ROOT/.github/workflows/publish.yml"
+DEP="$ROOT/commands/deploy-pr.md"
+
+PASS=0; FAILN=0
+ok()  { PASS=$((PASS+1)); echo "ok   - $1"; }
+bad() { FAILN=$((FAILN+1)); echo "FAIL - $1"; }
+has() { if grep -qF -e "$2" "$3"; then ok "$1"; else bad "$1 (missing '$2')"; fi; }
+
+# Extract the sync step block (from its name line to the next step's name line).
+STEP=$(awk '/- name: Sync version to staging/{f=1;print;next} f&&/^      - name: /{exit} f{print}' "$PUB")
+[ -n "$STEP" ] && ok "publish.yml has the Sync version to staging step" || bad "publish.yml has the Sync version to staging step"
+
+L_PUSH=$(grep -n -- '- name: Push version bump' "$PUB" | head -1 | cut -d: -f1)
+L_SYNC=$(grep -n -- '- name: Sync version to staging' "$PUB" | head -1 | cut -d: -f1)
+L_REL=$(grep -n -- '- name: Create GitHub Release' "$PUB" | head -1 | cut -d: -f1)
+if [ -n "$L_PUSH" ] && [ -n "$L_SYNC" ] && [ -n "$L_REL" ] && [ "$L_PUSH" -lt "$L_SYNC" ] && [ "$L_SYNC" -lt "$L_REL" ]; then
+  ok "sync step sits between Push version bump and Create GitHub Release"
+else bad "sync step sits between Push version bump and Create GitHub Release"; fi
+
+stepHas() { if printf '%s\n' "$STEP" | grep -qF -e "$2"; then ok "$1"; else bad "$1 (missing '$2')"; fi; }
+stepHas "step fetches origin/staging" "origin/staging"
+stepHas "step pushes HEAD to staging" "git push origin HEAD:staging"
+stepHas "step is non-fatal" "continue-on-error: true"
+stepHas "step is guarded by SKIP_PUBLISH" "env.SKIP_PUBLISH != 'true'"
+stepHas "commit carries [skip ci]" "[skip ci]"
+stepHas "only version files are staged" "git add package.json .claude-plugin/plugin.json"
+stepHas "failure emits a warning" "::warning::"
+if printf '%s\n' "$STEP" | grep -qE 'git (merge|pull)'; then bad "step must not merge main (version-only commit)"; else ok "step does not merge main"; fi
+
+has "deploy-pr has the 2A.5 pre-flight" "### 2A.5: Version Sync Pre-flight" "$DEP"
+has "deploy-pr pre-flight compares package.json" "package.json" "$DEP"
+
+if git -C "$ROOT" rev-parse --verify -q origin/main >/dev/null 2>&1; then
+  if git -C "$ROOT" diff --quiet origin/main -- .github/workflows/version-guard.yml; then ok "version-guard.yml unchanged"; else bad "version-guard.yml unchanged"; fi
+fi
+
+echo "passed=$PASS failed=$FAILN"
+[ "$FAILN" -eq 0 ]

package/scripts/resolve-deploy-gate.sh

@@ -11,7 +11,9 @@
 # A base is the deploy gate when it is empty/`null`, the literal `main` (hard
 # floor), the repository's GitHub default branch (`default_branch`), or the
 # `branches.default` of the default branch's COMMITTED forge.yaml
-# (`origin/<default>:forge.yaml`, falling back to the contents API) or of an
+# (`refs/remotes/origin/<default>:forge.yaml`, falling back to the contents API;
+# if neither source is readable the result is `true`, never `false`; a source that
+# cleanly reports forge.yaml absent is "no config" and falls through) or of an
 # explicit trusted config (FORGE_TRUSTED_CONFIG, orchestrator-supplied).
 #
 # It NEVER reads forge.yaml from $PWD: the PR worktree is author-controlled, so
@@ -34,13 +36,37 @@ GH_DEFAULT=$(gh api "repos/${REPO}" --jq .default_branch 2>/dev/null || echo "")
 
 _cfg_default() { yq '.branches.default // ""' 2>/dev/null || true; }
 
+# Parse stdin's branches.default. Returns non-zero when yq is missing or the
+# parse fails, so "config unreadable" is distinguishable from "no branches.default".
+_cfg_parse() { command -v yq >/dev/null 2>&1 && yq '.branches.default // ""' 2>/dev/null; }
+
 CFG_DEFAULT=""
-# Committed default-branch config only (a ref, never the working tree).
-CFG_DEFAULT=$(git show "origin/${GH_DEFAULT}:forge.yaml" 2>/dev/null | _cfg_default)
-if [ -z "$CFG_DEFAULT" ]; then
-  CFG_DEFAULT=$(gh api "repos/${REPO}/contents/forge.yaml?ref=${GH_DEFAULT}" --jq .content 2>/dev/null \
-    | base64 -d 2>/dev/null | _cfg_default)
+READ_OK=""
+# Committed default-branch config only (a ref, never the working tree). The
+# fully-qualified ref cannot be shadowed by a local tag/branch named origin/<default>.
+# A present ref with no forge.yaml at that path is a clean "no config" read (READ_OK,
+# empty default); an unfetched ref, missing yq or parse error stays unreadable.
+CFG_REF="refs/remotes/origin/${GH_DEFAULT}"
+if git rev-parse -q --verify "${CFG_REF}^{commit}" >/dev/null 2>&1; then
+  if git cat-file -e "${CFG_REF}:forge.yaml" 2>/dev/null; then
+    CFG_RAW=$(git show "${CFG_REF}:forge.yaml" 2>/dev/null) && [ -n "$CFG_RAW" ] \
+      && CFG_DEFAULT=$(printf '%s\n' "$CFG_RAW" | _cfg_parse) && READ_OK=1
+  else
+    READ_OK=1
+  fi
+fi
+if [ -z "$READ_OK" ]; then
+  CFG_DEFAULT=""
+  API_OUT=$(gh api "repos/${REPO}/contents/forge.yaml?ref=${GH_DEFAULT}" --jq .content 2>&1); API_RC=$?
+  if [ "$API_RC" -eq 0 ]; then
+    CFG_RAW=$(printf '%s' "$API_OUT" | base64 -d 2>/dev/null) && [ -n "$CFG_RAW" ] \
+      && CFG_DEFAULT=$(printf '%s\n' "$CFG_RAW" | _cfg_parse) && READ_OK=1
+  elif printf '%s' "$API_OUT" | grep -q 'HTTP 404'; then
+    READ_OK=1   # API says the file does not exist: clean "no config", not a read failure
+  fi
 fi
+# Config unreadable from every source (no yq, ref unfetched, API failing): fail closed.
+[ -n "$READ_OK" ] || emit true
 [ -n "$CFG_DEFAULT" ] && [ "$CFG_DEFAULT" != "null" ] && [ "$BASE" = "$CFG_DEFAULT" ] && emit true
 
 if [ -n "${FORGE_TRUSTED_CONFIG:-}" ] && [ -f "$FORGE_TRUSTED_CONFIG" ]; then

package/scripts/resolve-deploy-gate.test.sh

@@ -9,7 +9,7 @@ TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
 ok() { PASS=$((PASS+1)); }
 bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
 
-command -v yq >/dev/null 2>&1 || { echo "SKIP: yq not installed"; exit 0; }
+HAVE_YQ=1; command -v yq >/dev/null 2>&1 || HAVE_YQ=0
 
 # Stub gh: GH_DEFAULT_STUB drives `repos/<r> --jq .default_branch`; contents API unused (fails).
 mkdir -p "$TMP/bin"
@@ -17,6 +17,7 @@ cat > "$TMP/bin/gh" <<'EOF'
 #!/usr/bin/env bash
 case "$*" in
   *"--jq .default_branch"*) [ -n "${GH_FAIL:-}" ] && exit 1; printf '%s\n' "${GH_DEFAULT_STUB:-}" ;;
+  *"contents/forge.yaml"*) [ -n "${GH_CONTENTS_404:-}" ] && { echo "gh: Not Found (HTTP 404)" >&2; exit 1; }; exit 1 ;;
   *) exit 1 ;;
 esac
 EOF
@@ -40,6 +41,7 @@ run() { # base default_stub [env...]
 }
 expect() { [ "$1" = "$2" ] && ok || bad "$3: got '$1' want '$2'"; }
 
+if [ "$HAVE_YQ" = 1 ]; then
 expect "$(run main trunk)" true "main with worktree release"
 expect "$(run release trunk)" false "worktree-declared branch is not a gate"
 expect "$(run staging trunk)" false "staging is fast lane"
@@ -55,5 +57,44 @@ printf 'branches:\n  default: prod\n' > "$TMP/trusted.yaml"
 expect "$(run prod trunk FORGE_TRUSTED_CONFIG="$TMP/trusted.yaml")" true "trusted config default"
 expect "$(run prod trunk)" false "prod without trusted config"
 
+
+# Shadowing: a local tag named origin/trunk carrying a config without `develop`
+# must not displace the committed refs/remotes/origin/trunk config.
+printf 'branches:\n  default: other\n' > "$REPO/forge.yaml"
+git -C "$REPO" add forge.yaml; git -C "$REPO" commit -qm shadow
+git -C "$REPO" tag origin/trunk
+expect "$(run develop trunk)" true "shadow tag origin/trunk does not displace committed config"
+expect "$(run other trunk)" false "shadow tag config is not honoured"
+git -C "$REPO" tag -d origin/trunk >/dev/null
+fi
+
+# Config read fail: no origin ref and failing contents API -> true (fail closed).
+NOREF="$TMP/noref"; git init -q "$NOREF"
+run_in() { # dir base [env...]
+  local dir="$1" base="$2"; shift 2
+  (cd "$dir" && env PATH="$TMP/bin:$PATH" GH_DEFAULT_STUB=trunk "$@" bash "$S" "$base" owner/repo)
+}
+expect "$(run_in "$NOREF" staging)" true "config read fail (no origin ref, API failing) fails closed"
+
+# Missing forge.yaml is a clean "no config" read, not a read failure (falls through to false).
+NOCFG="$TMP/nocfg.git"; NOCFGW="$TMP/nocfgw"
+git init -q --bare "$NOCFG"; git init -q "$NOCFGW"
+git -C "$NOCFGW" config user.email t@t; git -C "$NOCFGW" config user.name t
+echo x > "$NOCFGW/README"; git -C "$NOCFGW" add README; git -C "$NOCFGW" commit -qm init
+git -C "$NOCFGW" branch -M trunk; git -C "$NOCFGW" remote add origin "$NOCFG"
+git -C "$NOCFGW" push -q origin trunk 2>/dev/null; git -C "$NOCFGW" fetch -q origin
+expect "$(run_in "$NOCFGW" staging)" false "forge.yaml absent on default branch ref is no-config (fast lane)"
+expect "$(run_in "$NOCFGW" main)" true "main stays strict with no config"
+expect "$(run_in "$NOCFGW" trunk)" true "github default stays strict with no config"
+# API 404 (ref not fetched, file absent) is also a clean no-config read; other API failures stay closed.
+expect "$(run_in "$NOREF" staging GH_CONTENTS_404=1)" false "contents API 404 is no-config"
+expect "$(run_in "$NOREF" staging)" true "non-404 contents API failure fails closed"
+
+# Config unreadable: yq unusable (a failing stub shadows any real yq; portable to Git Bash, unlike a stripped PATH) even though the ref is readable.
+NOYQ="$TMP/noyqbin"; mkdir -p "$NOYQ"
+printf '#!/usr/bin/env bash\nexit 127\n' > "$NOYQ/yq"; chmod +x "$NOYQ/yq"
+cp "$TMP/bin/gh" "$NOYQ/gh"
+expect "$(cd "$REPO" && env PATH="$NOYQ:$PATH" GH_DEFAULT_STUB=trunk bash "$S" staging owner/repo)" true "config unreadable (yq failing) fails closed"
+
 echo "resolve-deploy-gate.test.sh: $PASS passed, $FAILN failed"
 [ "$FAILN" -eq 0 ]