forgedock 1.17.0 → 1.19.0

package/scripts/classify-finding.sh

@@ -10,12 +10,18 @@
 # Usage:
 #   classify-finding.sh --severity <S> [--confidence <C>] [--agent <A>]
 #                       [--lineage none|review-finding] [--text <T> | --text-file <F>]
-#                       [--inpr-diff <F> --file <P>] [--contract-scope <F> --contract-open <F> [--pr-files <F>] [--merge-issue <N>]]
+#                       [--inpr-diff <F> --file <P> [--scope introduced|pre-existing|unknown]] [--contract-scope <F> --contract-open <F> [--pr-files <F>] [--merge-issue <N>]]
 #                       [--fix-efficacy fails|regresses] [--fixes-issue <N>]
 #                       [--prior-findings <F> [--title <T>] [--line-start <N> [--line-end <M>]] [--diff-map <F>]]
+#                       [--unstructured]
 #
 #   --severity    CRITICAL | HIGH | MEDIUM | LOW (case-insensitive). Missing or
 #                 unparseable → ISSUE (fail toward filing, never drop).
+#   --unstructured The finding has no `FINDING:` marker (it was not read from a structured
+#                 findings block). With an empty or unparseable severity it is `NOTE unstructured`,
+#                 never ISSUE: a marker-less finding cannot block a PR. HIGH/CRITICAL/MEDIUM/LOW
+#                 still classify normally. A real marker with a bad severity (no flag) stays
+#                 `ISSUE unparseable-severity`.
 #   --confidence  CONFIRMED | LIKELY | POSSIBLE (case-insensitive). Missing is
 #                 treated as not-POSSIBLE.
 #   --agent       The `**Agent**:` value of the finding (e.g. "Security", "Auth").
@@ -37,6 +43,11 @@
 #                 are given, a MEDIUM CONFIRMED finding whose path is in the PR diff is
 #                 classified INPR_FIX — fix it on the PR before merge instead of filing it.
 #                 Callers pass these only for the first fix round of an auto-merge review.
+#   --scope <S>   introduced | pre-existing | unknown: whether the finding's line sits in code the PR
+#                 added or changed (computed from the diff by review-finalize.sh). With `introduced`,
+#                 a MEDIUM LIKELY finding in the PR diff is also INPR_FIX (a defect in new code is fixed
+#                 in the PR, not filed). Absent, `pre-existing` or `unknown` keeps the CONFIRMED-only
+#                 behaviour. Any other value exits 2. Always recorded as `scope=` on the telemetry event.
 #
 #   --contract-scope <F> --contract-open <F> --file <P>  Contract-declared scope gate: F is the TSV
 #                 from `check-contract-scope.sh list` (disposition<TAB>path<TAB>issue). A finding
@@ -115,9 +126,11 @@ TITLE=""
 LINE_START=""
 LINE_END=""
 DIFF_MAP=""
+UNSTRUCTURED=0
+SCOPE=""
 
 usage() {
-  echo "ERROR: Usage: classify-finding.sh --severity <S> [--confidence <C>] [--agent <A>] [--lineage none|review-finding] [--text <T> | --text-file <F>] [--inpr-diff <F> --file <P>] [--contract-scope <F> --contract-open <F> [--pr-files <F>] [--merge-issue <N>]] [--fix-efficacy fails|regresses] [--fixes-issue <N>] [--prior-findings <F> [--title <T>] [--line-start <N> [--line-end <M>]] [--diff-map <F>]]" >&2
+  echo "ERROR: Usage: classify-finding.sh --severity <S> [--confidence <C>] [--agent <A>] [--lineage none|review-finding] [--text <T> | --text-file <F>] [--inpr-diff <F> --file <P> [--scope introduced|pre-existing|unknown]] [--contract-scope <F> --contract-open <F> [--pr-files <F>] [--merge-issue <N>]] [--fix-efficacy fails|regresses] [--fixes-issue <N>] [--prior-findings <F> [--title <T>] [--line-start <N> [--line-end <M>]] [--diff-map <F>]] [--unstructured]" >&2
   exit 2
 }
 
@@ -130,6 +143,7 @@ while [ "$#" -gt 0 ]; do
     --text)       [ "$#" -ge 2 ] || usage; TEXT="$2"; shift 2 ;;
     --inpr-diff)  [ "$#" -ge 2 ] || usage; INPR_DIFF="$2"; shift 2 ;;
     --file)       [ "$#" -ge 2 ] || usage; FINDING_FILE="$2"; shift 2 ;;
+    --scope)      [ "$#" -ge 2 ] || usage; SCOPE=$(printf '%s' "$2" | tr '[:upper:]' '[:lower:]'); shift 2 ;;
     --contract-scope) [ "$#" -ge 2 ] || usage; CONTRACT_SCOPE="$2"; shift 2 ;;
     --contract-open)  [ "$#" -ge 2 ] || usage; CONTRACT_OPEN="$2"; shift 2 ;;
     --pr-files)       [ "$#" -ge 2 ] || usage; PR_FILES="$2"; shift 2 ;;
@@ -141,6 +155,7 @@ while [ "$#" -gt 0 ]; do
     --line-start)     [ "$#" -ge 2 ] || usage; LINE_START="$2"; shift 2 ;;
     --line-end)       [ "$#" -ge 2 ] || usage; LINE_END="$2"; shift 2 ;;
     --diff-map)       [ "$#" -ge 2 ] || usage; DIFF_MAP="$2"; shift 2 ;;
+    --unstructured)   UNSTRUCTURED=1; shift ;;
     --text-file)
       [ "$#" -ge 2 ] || usage
       [ -r "$2" ] || { echo "ERROR: --text-file not readable: $2" >&2; exit 2; }
@@ -159,6 +174,11 @@ case "$FIX_EFF" in
   *) echo "ERROR: --fix-efficacy must be 'fails' or 'regresses' (got '$FIX_EFF')" >&2; exit 2 ;;
 esac
 
+case "$SCOPE" in
+  ''|introduced|pre-existing|unknown) ;;
+  *) echo "ERROR: --scope must be 'introduced', 'pre-existing' or 'unknown'" >&2; exit 2 ;;
+esac
+
 if [ -n "$INPR_DIFF" ] && [ ! -r "$INPR_DIFF" ]; then
   echo "ERROR: --inpr-diff not readable: $INPR_DIFF" >&2; exit 2
 fi
@@ -186,14 +206,18 @@ CONF=$(upper "$CONFIDENCE")
 _TEL="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/telemetry.sh"; [ -f "$_TEL" ] && . "$_TEL" 2>/dev/null
 type forge_emit >/dev/null 2>&1 || forge_emit() { :; }
 disp() { # "<DISPOSITION> <reason>"
-  forge_emit finding_disposition severity="$SEV" confidence="${CONF:-UNKNOWN}" agent="${AGENT:-none}" disposition="${1%% *}" reason="${1#* }"
+  forge_emit finding_disposition severity="$SEV" confidence="${CONF:-UNKNOWN}" agent="${AGENT:-none}" scope="${SCOPE:-unknown}" disposition="${1%% *}" reason="${1#* }"
   echo "$1"
 }
 
 # In-PR fix gate predicate (#3387, widened to HIGH/CRITICAL in #3592): CONFIRMED, linked to a
 # --inpr-diff file list, and the finding's file is one of those files. Fails toward ISSUE.
+# MEDIUM LIKELY also matches, only when --scope introduced (a defect in code this PR added).
 inpr_match() {
-  [ -n "$INPR_DIFF" ] && [ -n "$FINDING_FILE" ] && [ "$CONF" = "CONFIRMED" ] || return 1
+  [ -n "$INPR_DIFF" ] && [ -n "$FINDING_FILE" ] || return 1
+  if [ "$CONF" != "CONFIRMED" ]; then
+    [ "$SEV" = "MEDIUM" ] && [ "$CONF" = "LIKELY" ] && [ "$SCOPE" = "introduced" ] || return 1
+  fi
   _path="${FINDING_FILE#./}"; _path="${_path%%:*}"
   grep -Fxq -- "$_path" "$INPR_DIFF"
 }
@@ -207,7 +231,9 @@ case "$SEV" in
     fi
     disp "ISSUE severity-$SEV"; exit 0 ;;
   MEDIUM|LOW) ;;
-  *) disp "ISSUE unparseable-severity"; exit 0 ;;
+  *)
+    if [ "$UNSTRUCTURED" = "1" ]; then disp "NOTE unstructured"; exit 0; fi
+    disp "ISSUE unparseable-severity"; exit 0 ;;
 esac
 
 # Cross-head / cross-PR re-flag gate (#3641). Runs after the severity parse so HIGH/CRITICAL and
@@ -282,7 +308,7 @@ fi
 # (lineage included), so checking here changes only where it is handled, never whether.
 # HIGH/CRITICAL were handled in the severity case above.
 if [ "$SEV" = "MEDIUM" ] && inpr_match; then
-  disp "INPR_FIX medium-confirmed-in-diff"
+  if [ "$CONF" = "CONFIRMED" ]; then disp "INPR_FIX medium-confirmed-in-diff"; else disp "INPR_FIX medium-likely-introduced-in-diff"; fi
   exit 0
 fi
 

package/scripts/classify-finding.test.sh

@@ -6,6 +6,8 @@
 # Run: bash scripts/classify-finding.test.sh   (bash 3.2 compatible)
 
 set -u
+# Every mktemp below lands in one private dir that the EXIT trap removes (forge#4016).
+_SUITE_TMP=$(mktemp -d); export TMPDIR="$_SUITE_TMP"; trap 'rm -rf "$_SUITE_TMP"' EXIT
 DIR=$(cd "$(dirname "$0")" && pwd)
 S="$DIR/classify-finding.sh"
 pass=0; fail=0
@@ -29,6 +31,16 @@ expect ISSUE "missing severity files"         -- --severity "" --confidence LIKE
 expect ISSUE "unknown severity files"         -- --severity INFO
 expect ISSUE "lowercase high files"           -- --severity high
 
+# --- --unstructured: a marker-less finding can never be ISSUE on a bad severity ---
+expect NOTE  "unstructured empty severity is NOTE"       -- --unstructured --severity "" --confidence LIKELY
+expect NOTE  "unstructured missing severity is NOTE"     -- --unstructured
+expect NOTE  "unstructured garbage severity is NOTE"     -- --unstructured --severity INFO
+expect ISSUE "unstructured HIGH still files"             -- --unstructured --severity HIGH --confidence POSSIBLE
+expect ISSUE "unstructured CRITICAL still files"         -- --unstructured --severity CRITICAL
+expect ISSUE "unstructured MEDIUM CONFIRMED still files" -- --unstructured --severity MEDIUM --confidence CONFIRMED --text "loop exits early"
+expect ISSUE "marker finding, empty severity stays ISSUE" -- --severity "" --confidence LIKELY
+expect ISSUE "marker finding, bad severity stays ISSUE"  -- --severity INFO
+
 # --- Rule 4: non-lineage ---
 expect ISSUE "MEDIUM CONFIRMED files"         -- --severity MEDIUM --confidence CONFIRMED --text "loop exits early"
 expect ISSUE "MEDIUM LIKELY files"            -- --severity MEDIUM --confidence LIKELY --text "loop exits early"
@@ -112,6 +124,17 @@ expect INPR_FIX "./ prefix matches"                   -- --severity MEDIUM --con
 expect INPR_FIX "lineage PR still fixes in-PR"        -- --severity MEDIUM --confidence CONFIRMED --lineage review-finding --inpr-diff "$DIFF" --file src/api/jobs.py
 expect ISSUE "MEDIUM CONFIRMED outside diff files"    -- --severity MEDIUM --confidence CONFIRMED --inpr-diff "$DIFF" --file src/api/other.py
 expect ISSUE "MEDIUM LIKELY in diff is not gated"     -- --severity MEDIUM --confidence LIKELY --inpr-diff "$DIFF" --file src/api/jobs.py
+# --- scope-aware gate (#3975): MEDIUM LIKELY in diff is INPR_FIX only when introduced ---
+expect INPR_FIX "MEDIUM LIKELY introduced in diff"     -- --severity MEDIUM --confidence LIKELY --scope introduced --inpr-diff "$DIFF" --file src/api/jobs.py
+expect INPR_FIX "MEDIUM CONFIRMED introduced in diff"  -- --severity MEDIUM --confidence CONFIRMED --scope introduced --inpr-diff "$DIFF" --file src/api/jobs.py
+expect ISSUE "MEDIUM LIKELY pre-existing stays ISSUE"  -- --severity MEDIUM --confidence LIKELY --scope pre-existing --inpr-diff "$DIFF" --file src/api/jobs.py
+expect ISSUE "MEDIUM LIKELY unknown stays ISSUE"       -- --severity MEDIUM --confidence LIKELY --scope unknown --inpr-diff "$DIFF" --file src/api/jobs.py
+expect ISSUE "MEDIUM LIKELY introduced outside diff"   -- --severity MEDIUM --confidence LIKELY --scope introduced --inpr-diff "$DIFF" --file src/api/other.py
+expect NOTE  "MEDIUM POSSIBLE introduced stays NOTE"  -- --severity MEDIUM --confidence POSSIBLE --scope introduced --inpr-diff "$DIFF" --file src/api/jobs.py
+expect NOTE  "LOW LIKELY introduced is not INPR_FIX"   -- --severity LOW --confidence LIKELY --scope introduced --inpr-diff "$DIFF" --file src/api/jobs.py
+expect ISSUE "HIGH LIKELY introduced stays ISSUE"      -- --severity HIGH --confidence LIKELY --scope introduced --inpr-diff "$DIFF" --file src/api/jobs.py
+expect INPR_FIX "HIGH CONFIRMED pre-existing scope unchanged" -- --severity HIGH --confidence CONFIRMED --scope pre-existing --inpr-diff "$DIFF" --file src/api/jobs.py
+expect_exit 2 "bad --scope value"                      -- --severity MEDIUM --scope bogus
 expect INPR_FIX "HIGH CONFIRMED in diff (#3592)"       -- --severity HIGH --confidence CONFIRMED --inpr-diff "$DIFF" --file src/api/jobs.py
 expect INPR_FIX "CRITICAL CONFIRMED in diff (#3592)"   -- --severity CRITICAL --confidence CONFIRMED --inpr-diff "$DIFF" --file "src/api/jobs.py:9"
 expect INPR_FIX "HIGH in diff with safety keyword"     -- --severity HIGH --confidence CONFIRMED --title "billing refund leg unreachable" --inpr-diff "$DIFF" --file src/api/jobs.py

package/scripts/classify-test-run.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# classify-test-run.sh — classify a finished test-command run as RAN, RAN_NOTHING or FAILED.
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Usage: classify-test-run.sh <exit_code> <output_file>
+# Prints exactly one word on stdout:
+#   FAILED       non-zero exit that is not a "ran nothing" signal (a real failure)
+#   RAN_NOTHING  the runner exited without exercising anything: pytest exit 5, "no tests ran/collected" output,
+#                every collected test skipped, or a connection/service-unavailable error that caused the skips
+#   RAN          anything else (including exit 0 with no recognizable runner output; the caller only classifies test commands)
+# Conservative by design: RAN_NOTHING needs positive evidence, and any "N passed" count means something ran.
+# The script only reads the exit code and the output file; it never executes their contents.
+# Exit: 0 classified | 2 usage error (bad exit code or unreadable file; stdout empty so callers fail closed)
+# Bash 3.2 portable (no mapfile, associative arrays, grep -P).
+set -uo pipefail
+
+CODE="${1-}"; FILE="${2-}"
+case "$CODE" in ''|*[!0-9]*) echo "usage: classify-test-run.sh <exit_code> <output_file>" >&2; exit 2 ;; esac
+[ -n "$FILE" ] && [ -r "$FILE" ] && [ -f "$FILE" ] || { echo "classify-test-run.sh: output file unreadable: ${FILE}" >&2; exit 2; }
+
+has() { grep -qiE -e "$1" "$FILE"; }
+
+# pytest exit 5 is "no tests were collected"; it is never a verified run.
+if [ "$CODE" -eq 5 ]; then echo RAN_NOTHING; exit 0; fi
+
+# Any other non-zero exit is a real failure; the existing blocking rules apply.
+if [ "$CODE" -ne 0 ]; then echo FAILED; exit 0; fi
+
+# Positive evidence that something executed and passed: a "N passed" / "# pass N" / "ok N" count with N >= 1.
+PASSED=false
+if grep -qE '(^|[^0-9A-Za-z])[1-9][0-9]* passed' "$FILE" || grep -qE '^# pass [1-9][0-9]*' "$FILE" \
+   || grep -qE '^Ran [1-9][0-9]* tests?' "$FILE" \
+   || grep -qE '^ok [0-9]+' "$FILE"; then
+  PASSED=true
+fi
+# forge#4037: pass summaries of other common runners count as positive evidence BEFORE any error-keyword heuristic, so a
+# passing run whose output merely mentions ECONNREFUSED / "skip" is not RAN_NOTHING. node --test spec ("ℹ pass N", "✔ name (Nms)"),
+# jest/vitest ("Tests: N passed" is covered above), go test ("ok  pkg 0.3s", "--- PASS"), cargo ("test result: ok. N passed").
+if [ "$PASSED" = "false" ] && { grep -qE '^[[:space:]]*ℹ pass [1-9][0-9]*' "$FILE" \
+   || grep -qE '^[[:space:]]*✔ .*\([0-9.]+ ?m?s\)[[:space:]]*$' "$FILE" \
+   || grep -qE '^ok[[:space:]]+[^[:space:]]+[[:space:]]+[0-9.]+s' "$FILE" \
+   || grep -qE '^[[:space:]]*--- PASS: ' "$FILE" \
+   || grep -qE '^test result: ok\. [1-9][0-9]* passed' "$FILE"; }; then
+  PASSED=true
+fi
+
+# Explicit "nothing ran" output.
+if has 'no tests ran' || has 'no tests collected' || has 'collected 0 items' || has '^Ran 0 tests' \
+   || has '^# tests 0$' || has 'no test files found' || has 'No tests found'; then
+  [ "$PASSED" = "true" ] || { echo RAN_NOTHING; exit 0; }
+fi
+
+# Every collected test skipped: a pytest-style summary with a skipped count and no passed count.
+if [ "$PASSED" = "false" ] && grep -qE '(^|[^0-9A-Za-z])[1-9][0-9]* skipped' "$FILE" \
+   && ! grep -qE '(^|[^0-9A-Za-z])[1-9][0-9]* (failed|error)' "$FILE"; then
+  echo RAN_NOTHING; exit 0
+fi
+# node:test / TAP all-skipped: "# skipped N" with "# pass 0".
+if has '^# skipped [1-9]' && has '^# pass 0$'; then echo RAN_NOTHING; exit 0; fi
+
+# Unreachable DB or service that turned tests into skips (or an exit-0 runner that swallowed the error).
+if [ "$PASSED" = "false" ] \
+   && has 'connection refused|ECONNREFUSED|could not connect to server|service unavailable|database (is )?(unavailable|not available)|connection to .* failed' \
+   && has 'skip'; then
+  echo RAN_NOTHING; exit 0
+fi
+
+echo RAN

package/scripts/classify-test-run.test.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# classify-test-run.test.sh — tests for scripts/classify-test-run.sh
+# One case per class plus a positive control (normal pass) and a real failure. No network.
+# Usage: bash scripts/classify-test-run.test.sh
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CLS="$SCRIPT_DIR/classify-test-run.sh"
+TMP=$(mktemp -d); trap 'rm -rf "$TMP"' EXIT
+PASS=0; FAILN=0
+check() { # name expected exit_code output
+  local name="$1" want="$2" code="$3" out="$4" got
+  printf '%s\n' "$out" > "$TMP/out.txt"
+  got=$(bash "$CLS" "$code" "$TMP/out.txt" 2>/dev/null)
+  if [ "$got" = "$want" ]; then PASS=$((PASS+1)); echo "ok   - $name"; else FAILN=$((FAILN+1)); echo "FAIL - $name: want $want got '$got'"; fi
+}
+
+check "positive control: normal pass is RAN" RAN 0 "collected 12 items
+============ 12 passed in 0.31s ============"
+check "pytest passed with some skipped is RAN" RAN 0 "=== 10 passed, 2 skipped in 1.2s ==="
+check "pytest exit 5 is RAN_NOTHING" RAN_NOTHING 5 "collected 0 items
+no tests ran in 0.01s"
+check "exit 0 with 'no tests ran' is RAN_NOTHING" RAN_NOTHING 0 "============ no tests ran in 0.02s ============"
+check "collected 0 items is RAN_NOTHING" RAN_NOTHING 0 "collected 0 items"
+check "all tests skipped is RAN_NOTHING" RAN_NOTHING 0 "collected 8 items
+=========== 8 skipped in 0.12s ==========="
+check "connection refused causing skips is RAN_NOTHING" RAN_NOTHING 0 "SKIPPED [3] tests/test_db.py: could not connect to server: Connection refused
+=========== 3 skipped in 0.5s ==========="
+check "connection refused without a skip summary but with skip text is RAN_NOTHING" RAN_NOTHING 0 "ECONNREFUSED 127.0.0.1:5432 - skipping DB tests"
+check "real failure is FAILED" FAILED 1 "=========== 1 failed, 4 passed in 0.9s ==========="
+check "failure that mentions connection refused is still FAILED" FAILED 1 "ConnectionRefusedError: connection refused
+1 failed in 0.2s"
+check "exit 0 with no runner output is RAN" RAN 0 "done"
+check "node:test TAP all skipped is RAN_NOTHING" RAN_NOTHING 0 "# tests 3
+# pass 0
+# skipped 3"
+check "node:test TAP pass is RAN" RAN 0 "# tests 3
+# pass 3
+# skipped 0"
+
+# forge#4037: pass summaries of common runners are positive evidence ahead of any error-keyword heuristic.
+check "node --test spec reporter pass mentioning ECONNREFUSED and skip is RAN" RAN 0 "▶ db client
+  ✔ retries after ECONNREFUSED and skip logging (2.1ms)
+  ✔ connects (1.0ms)
+✔ db client (4.2ms)
+ℹ tests 2
+ℹ suites 1
+ℹ pass 2
+ℹ fail 0
+ℹ skipped 0"
+check "node --test spec reporter lines alone are RAN" RAN 0 "✔ works with ECONNREFUSED text, skip (0.4ms)"
+check "node --test spec all skipped is still RAN_NOTHING" RAN_NOTHING 0 "ℹ tests 3
+ℹ pass 0
+ℹ skipped 3
+# skipped 3
+# pass 0"
+check "go test pass mentioning connection refused is RAN" RAN 0 "--- PASS: TestRetry (0.00s)
+connection refused handled, skip
+ok  	example.com/pkg	0.012s"
+check "cargo test pass mentioning ECONNREFUSED is RAN" RAN 0 "test net::retries ... ok
+ECONNREFUSED skip
+test result: ok. 4 passed; 0 failed; 0 ignored"
+check "jest summary mentioning ECONNREFUSED is RAN" RAN 0 "ECONNREFUSED skip
+Tests:       3 passed, 3 total"
+check "vitest summary mentioning ECONNREFUSED is RAN" RAN 0 "ECONNREFUSED skip
+ Tests  5 passed (5)"
+check "pytest passed mentioning connection refused is RAN" RAN 0 "connection refused skip
+==== 6 passed in 0.4s ===="
+
+# forge#4037: validate.md runs test commands under a timeout; rc 124 is DEGRADED (recorded), never FAILED. Uses the real functions.
+VAL="$SCRIPT_DIR/../commands/work-on/build/validate.md"
+for fn in degrade_check run_verification_command run_classified_test; do sed -n "/^${fn}() {/,/^}/p" "$VAL"; done > "$TMP/fns.sh"
+if [ -s "$TMP/fns.sh" ] && command -v timeout >/dev/null 2>&1; then
+  vres=$(cd "$TMP" && DEGRADED_CHECKS="" TEST_FAILED=0 CLASSIFY_SCRIPT="$CLS" FORGEDOCK_VERIFICATION_TIMEOUT_SECONDS=1 bash -c ". '$TMP/fns.sh'; run_classified_test slow.test 'sleep 5' >/dev/null; echo \"FAILED=\$TEST_FAILED DEG=\$DEGRADED_CHECKS\"")
+  case "$vres" in
+    "FAILED=0 DEG=slow.test"*"timed out"*) PASS=$((PASS+1)); echo "ok   - test timeout (rc 124) is DEGRADED, not FAILED" ;;
+    *) FAILN=$((FAILN+1)); echo "FAIL - test timeout classification: $vres" ;;
+  esac
+  vres=$(cd "$TMP" && DEGRADED_CHECKS="" TEST_FAILED=0 CLASSIFY_SCRIPT="$CLS" bash -c ". '$TMP/fns.sh'; run_classified_test bad.test 'exit 3' >/dev/null; echo \"FAILED=\$TEST_FAILED\"")
+  [ "$vres" = "FAILED=1" ] && { PASS=$((PASS+1)); echo "ok   - a real non-zero exit is still FAILED"; } || { FAILN=$((FAILN+1)); echo "FAIL - real failure: $vres"; }
+fi
+
+: > "$TMP/empty.txt"
+[ "$(bash "$CLS" 0 "$TMP/empty.txt" 2>/dev/null)" = "RAN" ] && { PASS=$((PASS+1)); echo "ok   - empty output exit 0 is RAN"; } || { FAILN=$((FAILN+1)); echo "FAIL - empty output exit 0"; }
+bash "$CLS" abc "$TMP/empty.txt" >/dev/null 2>&1; [ $? -eq 2 ] && { PASS=$((PASS+1)); echo "ok   - bad exit code is a usage error"; } || { FAILN=$((FAILN+1)); echo "FAIL - bad exit code"; }
+bash "$CLS" 0 "$TMP/nope.txt" >/dev/null 2>&1; [ $? -eq 2 ] && { PASS=$((PASS+1)); echo "ok   - missing file is a usage error"; } || { FAILN=$((FAILN+1)); echo "FAIL - missing file"; }
+
+echo "$PASS passed, $FAILN failed"
+[ "$FAILN" -eq 0 ]

package/scripts/close-parent-c3.test.sh

@@ -6,6 +6,8 @@
 # Usage: bash scripts/close-parent-c3.test.sh
 
 set -euo pipefail
+# Every mktemp below lands in one private dir that the EXIT trap removes (forge#4016).
+_SUITE_TMP=$(mktemp -d); export TMPDIR="$_SUITE_TMP"; trap 'rm -rf "$_SUITE_TMP"' EXIT
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 CLOSE="$ROOT/commands/work-on/close.md"
@@ -51,4 +53,73 @@ printf '%s\n' "$OUT" | grep -q 'gh issue close 5 .*All sub-issues complete' || f
 printf '%s\n' "$OUT" | grep -q 'set_workflow_state 5 merged' || fail "open parent: merged not set"
 printf '%s\n' "$OUT" | grep -q 'gh issue comment' && fail "open parent: no separate comment expected"
 
+# ---- Verified-retry checkbox write + state-derived OPEN_SUBS (concurrent sibling close race) ----
+WRITE_BLOCK=$(awk '/^PARENT_UPDATED=false$/{p=1} p{print} p&&/^\[ "\$PARENT_UPDATED" = true \]/{exit}' "$CLOSE")
+DERIVE_BLOCK=$(awk '/^PARENT_FRESH=/{p=1} p{print} p&&/^OPEN_SUBS=\$\{OPEN_SUBS:-0\}$/{exit}' "$CLOSE")
+[ -n "$WRITE_BLOCK" ] || fail "close.md C3 verified-retry write block not found"
+[ -n "$DERIVE_BLOCK" ] || fail "close.md C3 state-derivation block not found"
+
+# run_derive <parent body> <states "N=STATE ..."> [lost_edits]
+# gh stub: parent body lives in a file; the first <lost_edits> edits are clobbered by a stale sibling write.
+run_derive() {
+  local body="$1" states="$2" lost="${3:-0}" dir rendered
+  dir=$(mktemp -d)
+  printf '%s\n' "$body" >"$dir/body"; printf '%s\n' "$body" >"$dir/stale"
+  echo 0 >"$dir/edits"
+  gh() {
+    case "$1 $2" in
+      "issue view")
+        if [ "$6" = "--json" ] && [ "$7" = "body" ]; then cat "$dir/body"; return 0; fi
+        if [ "$6" = "--json" ] && [ "$7" = "state" ]; then
+          local kv; for kv in $states; do [ "${kv%%=*}" = "$3" ] && { echo "${kv#*=}"; return 0; }; done
+          return 1
+        fi ;;
+      "issue edit")
+        local n; n=$(( $(cat "$dir/edits") + 1 )); echo "$n" >"$dir/edits"
+        if [ "$n" -le "$lost" ]; then cp "$dir/stale" "$dir/body"; else printf '%s\n' "$7" >"$dir/body"; fi ;;
+    esac
+  }
+  sleep() { :; }
+  rendered=$(printf '%s\n%s\n' "$WRITE_BLOCK" "$DERIVE_BLOCK" | sed -e 's/{GH_FLAG}/-R o\/r/g' -e 's/{GH_REPO}/o\/r/g' -e 's/{NUMBER}/7/g')
+  PARENT_REF=5
+  eval "$rendered" >/dev/null 2>&1 || true
+  printf 'OPEN_SUBS=%s UPDATED=%s EDITS=%s CHECKED7=%s\n' "$OPEN_SUBS" "$PARENT_UPDATED" "$(cat "$dir/edits")" \
+    "$(grep -cE '^- \[x\] #7( |$)' "$dir/body" || true)"
+  rm -rf "$dir"; unset -f gh sleep
+}
+
+TWO=$'- [ ] #7 first\n- [ ] #8 second'
+
+# Lost checkbox is re-applied by the retry loop (first write clobbered by a sibling).
+OUT=$(run_derive "$TWO" "7=CLOSED 8=CLOSED" 1)
+printf '%s\n' "$OUT" | grep -q 'CHECKED7=1' || fail "retry: checkbox not restored after a lost write ($OUT)"
+printf '%s\n' "$OUT" | grep -q 'UPDATED=true' || fail "retry: PARENT_UPDATED not set ($OUT)"
+printf '%s\n' "$OUT" | grep -q 'EDITS=2' || fail "retry: expected exactly 2 writes ($OUT)"
+
+# Race: every write is lost, boxes stay unchecked, but all subs are CLOSED => 0 open (parent completes).
+OUT=$(run_derive "$TWO" "7=CLOSED 8=CLOSED" 9)
+printf '%s\n' "$OUT" | grep -q 'OPEN_SUBS=0' || fail "race: stale checklist with all subs CLOSED must derive 0 open ($OUT)"
+printf '%s\n' "$OUT" | grep -q 'EDITS=3' || fail "race: retries must be bounded at 3 writes ($OUT)"
+
+# A still-OPEN sibling keeps the parent open.
+OUT=$(run_derive "$TWO" "7=CLOSED 8=OPEN")
+printf '%s\n' "$OUT" | grep -q 'OPEN_SUBS=1' || fail "one open sibling must derive 1 open ($OUT)"
+
+# State lookup failure falls back to the checklist count (fail closed, never 0 from a failed lookup).
+OUT=$(run_derive "$TWO" "7=CLOSED")
+printf '%s\n' "$OUT" | grep -q 'OPEN_SUBS=1' || fail "lookup failure must fall back to checklist count ($OUT)"
+
+# Already-checked box: no write needed.
+OUT=$(run_derive $'- [x] #7 first\n- [ ] #8 second' "7=CLOSED 8=CLOSED")
+printf '%s\n' "$OUT" | grep -q 'EDITS=0' || fail "already checked: must not rewrite the parent ($OUT)"
+
+# #7 must not match #70.
+OUT=$(run_derive $'- [ ] #70 other\n- [ ] #7 first' "7=CLOSED 70=OPEN")
+printf '%s\n' "$OUT" | grep -q 'OPEN_SUBS=1' || fail "#70 must stay open and not be confused with #7 ($OUT)"
+printf '%s\n' "$OUT" | grep -q 'CHECKED7=1' || fail "#7 checkbox must be checked without touching #70 ($OUT)"
+
+# A non-leading #N mention on an unchecked line is an open item, not a sub-issue ref (no fail-open close).
+OUT=$(run_derive $'- [ ] #7 first\n- [ ] #8 second\n- [ ] Write docs (see #9)' "7=CLOSED 8=CLOSED")
+printf '%s\n' "$OUT" | grep -q 'OPEN_SUBS=1' || fail "non-leading ref line must count as open ($OUT)"
+
 printf 'PASS: close-parent-c3\n'