forgedock 1.18.0 → 1.20.0

package/scripts/review-prepare.test.sh

@@ -125,8 +125,24 @@ eq "auth score" '.scores.AUTH > 0' true; eq "billing score" '.scores.BILLING > 0
 eq "security baseline" .scores.SECURITY 1
 eq "risk FINANCIAL" '.risk_signals | index("FINANCIAL") != null' true
 eq "slice auth file exists" '.slices.auth.diff_file | length > 0' true
-if grep -q "auth.py" "$WORK/out/slice-auth.diff" 2>/dev/null; then ok; else bad "auth slice should hold the auth.py diff"; fi
-if grep -q "billing.py" "$WORK/out/slice-auth.diff" 2>/dev/null; then bad "auth slice leaked the billing diff"; else ok; fi
+AUTH_SLICE=$(jqv '.slices.auth.diff_file')
+eq "auth slice name is keyed by head SHA" '.slices.auth.diff_file | endswith("/slice-'"$(printf '%s' "$SHA_B" | cut -c1-7)"'-auth.diff")' true
+if grep -q "auth.py" "$AUTH_SLICE" 2>/dev/null; then ok; else bad "auth slice should hold the auth.py diff"; fi
+if grep -q "billing.py" "$AUTH_SLICE" 2>/dev/null; then bad "auth slice leaked the billing diff"; else ok; fi
+if [ -z "$(ls -A "$WORK"/out/.slice-* 2>/dev/null)" ]; then ok; else bad "temp slice files left behind"; fi
+# SHA isolation: a re-run at a different head SHA must not overwrite the earlier head's slice
+FIRST_SUM=$(cksum < "$AUTH_SLICE")
+setup feat/x staging "services/api/auth.py
+services/api/billing.py" "$DIFF_AUTH_BILL
++changed-for-head-A" "$SHA_A"
+prep "$ROOT"
+AUTH_SLICE_A=$(jqv '.slices.auth.diff_file')
+if [ -n "$AUTH_SLICE_A" ] && [ "$AUTH_SLICE_A" != "$AUTH_SLICE" ] && [ -f "$AUTH_SLICE" ] && [ -f "$AUTH_SLICE_A" ]; then ok; else bad "different head SHA must produce a distinct slice file ($AUTH_SLICE_A vs $AUTH_SLICE)"; fi
+if [ "$(cksum < "$AUTH_SLICE")" = "$FIRST_SUM" ]; then ok; else bad "earlier head's slice was overwritten by a re-review at another SHA"; fi
+if [ -z "$(ls -A "$WORK"/out/.slice-* 2>/dev/null)" ]; then ok; else bad "temp slice files left behind after re-run"; fi
+setup feat/x staging "services/api/auth.py
+services/api/billing.py" "$DIFF_AUTH_BILL"
+prep "$ROOT"
 eq "auth slice paths" '.slices.auth.paths | join(" ")' "services/api/auth.py"
 eq "security slice is the full diff" '.slices.security.paths | length' 2
 

package/scripts/review-roster.sh

@@ -17,7 +17,8 @@
 #
 # Tiers, evaluated in this order:
 #   full      THOROUGH or milestone->staging: Security plus every domain with a score > 0.
-#   fix-pr    the PR closes a `review-finding` issue: Security, plus the source finding's domain when it was HIGH+.
+#   fix-pr    the PR closes a `review-finding` issue AND has <= 150 changed lines with a known size: Security, plus the
+#             source finding's domain when it was HIGH+. Larger or unknown-size fix PRs fall to the size ladder below.
 #   small     <= 60 changed lines, or one file of <= 150 lines: Security only.
 #   medium    61-150 lines: Security plus the score-escalation table (no top-2 baseline).
 #   standard  > 150 lines, or an unknown size (fail toward more agents): top-2 domains by score plus the table.
@@ -27,7 +28,7 @@
 # exact value EXTENDED is STANDARD. An extended roster prints an extra DEPTH=extended line.
 # Path triggers escalate in EVERY tier except full (which already runs the union): CONTRACT HIGH_RISK, cross-critical
 # pairs, churn hot-spot, danger zone, bin/engine* (Concurrency + spec-cli), bin/ (spec-cli), auth/session/trust-filter
-# files (Auth), CI/docker/deploy/infra files (Infra), migration/.sql files (Database), SDK/OpenAPI files (API).
+# files (Auth: auth*, not author*; oauth, jwt, login, password, permission, rbac, acl, token(s), api_key(s), credential, deps.py), CI/docker/deploy/infra files (Infra), migration/.sql files (Database), SDK/OpenAPI files (API).
 # Auth and Infra are path-gated: a diff-text score alone never selects them. Security is a hard floor in every tier.
 # spec-cli is added only with --spec-cli true (the persona file exists in the repo under review); in the standard tier it
 # also covers commands/**. Bash 3.2 portable (no mapfile, associative arrays, grep -P).
@@ -114,7 +115,10 @@ fi
 HIGH_RISK=false
 case " $CFLAGS " in *" HIGH_RISK "*) HIGH_RISK=true ;; esac
 
-if [ "$FIX_PR" = "true" ]; then
+# The fix-pr tier is author-controlled (Closes #N), so it is capped by size: a larger or unknown-size fix PR follows the size ladder.
+FIX_PR_MAX_LINES=150
+FIX_PR_CAPPED=false
+if [ "$FIX_PR" = "true" ] && [ "$LINES_KNOWN" = "true" ] && [ "$LINES" -le "$FIX_PR_MAX_LINES" ]; then
     TIER=fix-pr; REASON="fix PR for a review-finding issue"
 elif [ "$LINES_KNOWN" = "true" ] && { [ "$LINES" -le 60 ] || { [ "$NFILES" -eq 1 ] && [ "$LINES" -le 150 ]; }; }; then
     TIER=small; REASON="lines=$LINES files=$NFILES"
@@ -124,6 +128,9 @@ else
     TIER=standard
     if [ "$LINES_KNOWN" = "true" ]; then REASON="lines=$LINES"; else REASON="size unknown"; fi
 fi
+if [ "$FIX_PR" = "true" ] && [ "$TIER" != "fix-pr" ]; then
+    FIX_PR_CAPPED=true; REASON="$REASON; fix-pr tier capped by size (max $FIX_PR_MAX_LINES lines, known size)"
+fi
 # CONTRACT HIGH_RISK is never narrowed: a small, medium or fix-PR roster is lifted to the standard roster.
 BASE_TIER="$TIER"
 if [ "$HIGH_RISK" = "true" ] && [ "$TIER" != "standard" ]; then TIER=standard; REASON="$REASON; CONTRACT HIGH_RISK lifts $BASE_TIER to standard"; fi
@@ -147,6 +154,12 @@ case "$TIER" in
         esac ;;
     standard) for d in $(top_domains "$TOP_N"); do add_agent "$d"; done ;;
 esac
+# A size-capped fix PR keeps the source finding's domain (size only ever ADDS depth).
+if [ "$FIX_PR_CAPPED" = "true" ] && [ -n "$SRC_DOM" ]; then
+    case "$(printf '%s' "$SRC_SEV" | tr '[:lower:]' '[:upper:]')" in
+        HIGH|CRITICAL|BLOCKER) add_agent "$SRC_DOM"; REASON="$REASON; source finding ${SRC_SEV} adds its domain" ;;
+    esac
+fi
 
 # Score escalation table (medium and standard only; diff-text signals, so never in the small or fix-pr tiers)
 if [ "$TIER" = "medium" ] || [ "$TIER" = "standard" ]; then
@@ -170,8 +183,8 @@ if [ "$CHURN" = "true" ] || [ "$DANGER" = "true" ]; then
     for d in $(top_domains 1); do add_agent "$d"; trig churn-or-danger-zone; done
 fi
 hit() { printf '%s\n' "$FILES" | grep -qiE "$1"; }
-hit '(^|[/_.-])(auth|authn|authz|session|sessions|jwt|oauth|login|logout|password|trust[-_]?filter|trusted[-_a-z]*)([/_.-]|$)' && { add_agent Auth; trig auth-path; }
-hit '^\.github/|(^|/)Dockerfile|docker-compose|(^|/)(deploy|infra|traefik|nginx|k8s|helm|terraform)/|\.tf$' && { add_agent Infra; trig infra-path; }
+hit '(^|[/_.-])(auth([^o]|o[^r]|$)|authori[sz]|oauth|session|jwt|login|logout|passw(or)?d|permission|rbac|acl([/_.-]|$)|tokens?([/_.-]|$)|api[-_]?keys?|credential|trust[-_]?filter|trusted[-_a-z]*)|(^|/)deps\.py$' && { add_agent Auth; trig auth-path; }
+hit '^\.github/|(^|/)Dockerfile|docker-compose|(^|/)(docker-)?compose[^/]*\.ya?ml$|(^|/)deploy[^/]*\.sh$|(^|/)docker-entrypoint[^/]*$|(^|/)(deploy|infra|traefik|nginx|k8s|helm|terraform)/|\.tf$' && { add_agent Infra; trig infra-path; }
 hit 'migration|\.sql$' && { add_agent Database; trig migration-path; }
 hit '^sdk/|openapi.*\.json$|openapi-versions/' && { add_agent API; trig sdk-path; }
 hit '^bin/engine' && { add_agent Concurrency; trig bin-engine; }

package/scripts/review-roster.test.sh

@@ -58,9 +58,26 @@ expect_has "consumer repo bin/engine" concurrency; expect_not "consumer repo bin
 
 # Case 3: a fix PR gives Security only
 run "commands/orchestrate/phase-4-execution.md
-commands/work-on.md" --scores "$SC_NOISY" --changed-lines 200 --changed-files 2 --fix-pr true --source-severity MEDIUM
+commands/work-on.md" --scores "$SC_NOISY" --changed-lines 120 --changed-files 2 --fix-pr true --source-severity MEDIUM
 expect_sel "fix PR" "security"; expect_tier "fix PR" fix-pr
 
+# Case 3b (forge#3848): the fix-pr tier is capped at 150 known lines; larger or unknown-size fix PRs follow the size ladder
+SC_MULTI="AUTH=0 BILLING=5 CONCURRENCY=0 DATABASE=4 INFRA=0 FRONTEND=3 API=0"
+run "svc/x.py" --scores "$SC_MULTI" --changed-lines 900 --changed-files 30 --fix-pr true --source-severity MEDIUM
+expect_tier "fix PR 900 lines" standard; expect_has "fix PR 900 lines" billing; expect_has "fix PR 900 lines" database
+run "svc/x.py" --scores "$SC_QUIET" --changed-lines 150 --changed-files 2 --fix-pr true
+expect_tier "fix-PR-at-cap" fix-pr
+run "svc/x.py" --scores "$SC_QUIET" --changed-lines 151 --changed-files 2 --fix-pr true
+expect_tier "fix PR over cap" standard
+run "svc/x.py" --scores "$SC_MULTI" --fix-pr true
+expect_tier "fix-PR-unknown-size" standard
+run "svc/x.py" --scores "$SC_MULTI" --changed-lines abc --fix-pr true
+expect_tier "fix PR non-numeric size" standard
+run "svc/x.py" --scores "$SC_QUIET" --changed-lines 400 --changed-files 5 --fix-pr true --source-severity HIGH --source-domain Concurrency
+expect_has "capped-fix-PR,-HIGH-source" concurrency; expect_tier "capped-fix-PR,-HIGH-source" standard
+run "svc/x.py" --scores "$SC_QUIET" --changed-lines 400 --changed-files 5 --fix-pr true --contract-flags "HIGH_RISK" --review-depth EXTENDED
+expect_tier "capped-fix-PR-with-HIGH_RISK-and-EXTENDED" standard
+
 # Case 4: a fix PR whose source finding was HIGH adds the domain agent
 run "commands/work-on.md" --scores "AUTH=0 BILLING=0 CONCURRENCY=2 DATABASE=0 INFRA=0 FRONTEND=0 API=0" --changed-lines 40 --fix-pr true --source-severity HIGH --source-domain Concurrency
 expect_sel "fix PR, HIGH source finding" "security concurrency"
@@ -89,12 +106,51 @@ run "svc/app/routers/session.py" --scores "$SC_QUIET" --changed-lines 20 --chang
 expect_has "auth path" auth
 run "scripts/trusted-comments.sh" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_has "trust-filter path" auth
+run "svc/authorization.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path authorization.py" auth
+run "svc/authMiddleware.ts" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth-path-authMiddleware.ts" auth
+run "svc/oauth2.ts" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path oauth2.ts" auth
+run "svc/permissions.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path permissions.py" auth
+run "svc/rbac.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path rbac.py" auth
+run "svc/deps.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path deps.py" auth
+run "svc/tokens.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path tokens.py" auth
+run "svc/api_keys.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path api_keys.py" auth
+run "svc/auth_utils.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth-path-auth_utils.py" auth
+run "AUTHORS.md" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_not "no-auth-path-AUTHORS.md" auth
+run "docs/author.md" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_not "no auth path docs/author.md" auth
+run "svc/tokenizer.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_not "no-auth-path-svc/tokenizer.py" auth
+run "commands/review-pr.md" --scores "AUTH=3 INFRA=0 DATABASE=0 BILLING=0 CONCURRENCY=0" --changed-lines 20 --changed-files 1
+expect_not "auth-from-prose-score-alone" auth
 run "commands/review-pr.md" --scores "AUTH=3 INFRA=3 DATABASE=0 BILLING=0 CONCURRENCY=0" --changed-lines 120
 expect_not "auth from prose score alone" auth; expect_not "infra from prose score alone" infra
 run ".github/workflows/ci.yml" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_has "infra path" infra
 run "docker-compose.prod.yml" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_has "docker path" infra
+# Infra path gate covers deploy scripts, container entrypoints and Compose v2 names (basename-anchored)
+for f in scripts/deploy.sh scripts/deploy-prod.sh docker-entrypoint.sh svc/docker-entrypoint.sh compose.yaml compose.yml; do
+  run "$f" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+  expect_has "infra path: $f" infra
+done
+for f in scripts/resolve-deploy-gate.sh commands/deploy-pr.md; do
+  run "$f" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+  expect_not "no-infra-path-$f" infra
+done
+run "$(printf 'README.md\nscripts/deploy.sh')" --scores "$SC_QUIET" --changed-lines 20 --changed-files 2
+expect_has "infra-path-multi-file-list" infra
+run "Scripts/Deploy.SH" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "infra-path-case-insensitive" infra
 run "db/migrations/0042_add.sql" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_has "migration path" database
 run "sdk/node/src/index.ts" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1

package/scripts/run-shell-tests.sh

@@ -22,6 +22,11 @@ cd "$REPO_ROOT" || exit 1
 # Gate scripts emit best-effort telemetry (forge#3834); suites run with it off so stubbed gh calls never buffer into ~/.forge.
 # scripts/telemetry.test.sh sets its own environment.
 export FORGE_TELEMETRY=off
+# Per-run TMPDIR (forge#4016): every suite and child process inherits it and the whole dir is removed at exit,
+# so a temp path a suite forgets to clean never outlives the run (tmpfs quotas fail with EDQUOT otherwise).
+RUN_TMP=$(mktemp -d) || { echo "run-shell-tests: cannot create per-run TMPDIR" >&2; exit 1; }
+trap 'rm -rf "$RUN_TMP"' EXIT
+export TMPDIR="$RUN_TMP"
 
 TIMEOUT_SECS="${SHELL_TEST_TIMEOUT:-300}"
 # WIRE:PROVEN — manual: SHELL_TEST_TIMEOUT=abc and SHELL_TEST_TIMEOUT=0 both print the error and exit 2

package/scripts/selfreview-plan.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# selfreview-plan.sh — build-time self-review plan: run or skip, and which roster (forge#3971).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Pure decision script: flags in, key=value lines out. No network, no git, no eval; every flag value is data.
+# It calls scripts/review-roster.sh (resolved through forge_resolve, never from the repo under build) on the staged
+# diff's file list so the self-review roster equals the roster /review-pr would pick for the same diff.
+#
+# Usage: selfreview-plan.sh --files-file PATH|- [--changed-lines N] [--changed-files N] [--contract-flags "HIGH_RISK ..."]
+#          [--spec-cli true|false] [--review-depth STANDARD|EXTENDED] [--scores "AUTH=n ..."]
+#          [--agent-available true|false] [--tree HASH] [--done-trees "HASH HASH ..."]
+# Env:   FORGE_SELFREVIEW=off|0|false|disabled   operator off switch
+# Output (stdout, always all four lines):
+#          SELFREVIEW=run|skip   SKIP_REASON=<reason or empty>   TIER=<roster tier or empty>   SELECTED_AGENTS=<domains>
+# Skip reasons (first match wins): disabled, empty-diff, docs-only, no-agent-tool, already-done, roster-unavailable,
+#          small-security-only (small tier, Security-only roster, no path or contract trigger fired).
+# Exit: 0 for every parseable call, including every degrade-to-skip path (self-review never blocks build); 2 on an unknown flag.
+# Bash 3.2 portable (no mapfile, associative arrays, grep -P).
+set -u
+
+FILES_FILE=""; LINES=""; NFILES=""; CFLAGS=""; SPEC_CLI=false; DEPTH=STANDARD; SCORES=""
+AGENT_AVAILABLE=true; TREE=""; DONE_TREES=""
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --files-file) FILES_FILE="${2:-}"; shift 2 ;;
+        --changed-lines) LINES="${2:-}"; shift 2 ;;
+        --changed-files) NFILES="${2:-}"; shift 2 ;;
+        --contract-flags) CFLAGS="${2:-}"; shift 2 ;;
+        --spec-cli) SPEC_CLI="${2:-false}"; shift 2 ;;
+        --review-depth) DEPTH="${2:-STANDARD}"; shift 2 ;;
+        --scores) SCORES="${2:-}"; shift 2 ;;
+        --agent-available) AGENT_AVAILABLE="${2:-true}"; shift 2 ;;
+        --tree) TREE="${2:-}"; shift 2 ;;
+        --done-trees) DONE_TREES="${2:-}"; shift 2 ;;
+        *) echo "selfreview-plan: unknown argument: $1" >&2; exit 2 ;;
+    esac
+done
+
+emit() { # <run|skip> <skip reason> <tier> <agents>
+    printf 'SELFREVIEW=%s\nSKIP_REASON=%s\nTIER=%s\nSELECTED_AGENTS=%s\n' "$1" "$2" "$3" "$4"
+    exit 0
+}
+
+case "$(printf '%s' "${FORGE_SELFREVIEW:-}" | tr '[:upper:]' '[:lower:]')" in
+    off|0|false|disabled|no) emit skip disabled "" "" ;;
+esac
+
+FILES=""
+if [ "$FILES_FILE" = "-" ]; then FILES=$(cat)
+elif [ -n "$FILES_FILE" ] && [ -f "$FILES_FILE" ]; then FILES=$(cat "$FILES_FILE"); fi
+FILES=$(printf '%s\n' "$FILES" | grep -v '^[[:space:]]*$' || true)
+
+[ -n "$FILES" ] || emit skip empty-diff "" ""
+
+# Docs-only: every file is documentation. commands/**, .agents/** and skills/** are executable spec, never docs.
+CODE_FILES=$(printf '%s\n' "$FILES" | grep -vE '^(docs/|README|CHANGELOG|LICENSE|NOTICE)|\.(md|txt|rst)$' || true)
+SPEC_FILES=$(printf '%s\n' "$FILES" | grep -E '^(commands|\.agents|skills)/.*\.md$' || true)
+[ -n "$CODE_FILES" ] || [ -n "$SPEC_FILES" ] || emit skip docs-only "" ""
+
+[ "$AGENT_AVAILABLE" = "true" ] || emit skip no-agent-tool "" ""
+
+if [ -n "$TREE" ]; then
+    for _t in $DONE_TREES; do
+        [ "$_t" = "$TREE" ] && emit skip already-done "" ""
+    done
+fi
+
+type forge_resolve >/dev/null 2>&1 || { setopt nonomatch 2>/dev/null || true; _SELF_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd -P)"; for _r in "$(cygpath -u "${FORGEDOCK_HOME:-}" 2>/dev/null || printf %s "${FORGEDOCK_HOME:-}")" "${CLAUDE_PLUGIN_ROOT:-}" "${FORGE_ROOT:-}" "${FORGE_HOME:-}" "$(readlink -f "$HOME/.claude/commands/work-on.md" 2>/dev/null | sed 's|/commands/work-on\.md$||')" "$(head -n 1 "${CODEX_HOME:-$HOME/.codex}/forge-home" 2>/dev/null)" "$HOME/.claude/plugins/marketplaces/forgedock" "${CLAUDE_CONFIG_DIR:-$HOME/.claude}"/plugins/cache/forgedock/forgedock/* "$HOME/.claude"/plugins/cache/forgedock/forgedock/* "$_SELF_ROOT"; do case "$_r" in /*) [ -f "$_r/scripts/lib/forge-resolve.sh" ] && { . "$_r/scripts/lib/forge-resolve.sh"; break; };; esac; done; type forge_resolve >/dev/null 2>&1 || forge_resolve() { :; }; }  # allowlist:portability — canonical resolver block; readlink -f is guarded (2>/dev/null) and optional
+ROSTER_SCRIPT=$(forge_resolve review-roster.sh)
+[ -n "$ROSTER_SCRIPT" ] && [ -f "$ROSTER_SCRIPT" ] || emit skip roster-unavailable "" ""
+
+set -- --files-file - --contract-flags "$CFLAGS" --spec-cli "$SPEC_CLI" --review-depth "$DEPTH"
+[ -n "$LINES" ] && set -- "$@" --changed-lines "$LINES"
+[ -n "$NFILES" ] && set -- "$@" --changed-files "$NFILES"
+[ -n "$SCORES" ] && set -- "$@" --scores "$SCORES"
+OUT=$(printf '%s\n' "$FILES" | bash "$ROSTER_SCRIPT" "$@" 2>/dev/null) || emit skip roster-unavailable "" ""
+
+SEL=$(printf '%s\n' "$OUT" | sed -n 's/^SELECTED_AGENTS=//p' | head -n 1)
+TIER=$(printf '%s\n' "$OUT" | sed -n 's/^TIER=//p' | head -n 1)
+[ -n "$SEL" ] && [ -n "$TIER" ] || emit skip roster-unavailable "" ""
+
+# Cost guard: the small tier runs only when a path or contract trigger widened the roster past Security.
+if [ "$TIER" = "small" ] && [ "$SEL" = "security" ]; then emit skip small-security-only "$TIER" "$SEL"; fi
+emit run "" "$TIER" "$SEL"

package/scripts/selfreview-plan.test.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Tests for scripts/selfreview-plan.sh (build-time self-review plan, forge#3971). Run: bash scripts/selfreview-plan.test.sh
+# (bash 3.2 compatible)
+set -u
+DIR=$(cd "$(dirname "$0")" && pwd)
+ROOT=$(cd "$DIR/.." && pwd)
+SCRIPT="$DIR/selfreview-plan.sh"
+pass=0; fail=0
+ok() { pass=$((pass+1)); }
+bad() { fail=$((fail+1)); echo "FAIL: $1"; }
+WORK=$(mktemp -d "${TMPDIR:-/tmp}/selfreview-plan.XXXXXX")
+trap 'rm -rf "$WORK"' EXIT
+export FORGEDOCK_HOME="$ROOT"   # the resolver must not pick up an ambient install
+unset FORGE_SELFREVIEW
+
+PLAN=""; RC=0
+# run <files, newline separated> <flags...>
+run() {
+  printf '%s\n' "$1" > "$WORK/files"; shift
+  PLAN=$(bash "$SCRIPT" --files-file "$WORK/files" "$@" 2>/dev/null); RC=$?
+}
+field() { printf '%s\n' "$PLAN" | sed -n "s/^$1=//p"; }
+expect() { # name key want
+  local got; got=$(field "$2")
+  if [ "$got" = "$3" ]; then ok; else bad "$1: $2='$got', want '$3'"; fi
+}
+has_agent() { case " $(field SELECTED_AGENTS) " in *" $1 "*) return 0 ;; *) return 1 ;; esac; }
+
+# e1: docs-only and empty diffs skip with a recorded reason
+run "docs/GUIDE.md
+README.md" --changed-lines 40
+expect "docs-only skips" SELFREVIEW skip; expect "docs-only reason" SKIP_REASON docs-only
+run "" --changed-lines 0
+expect "empty diff skips" SELFREVIEW skip; expect "empty reason" SKIP_REASON empty-diff
+run "commands/work-on/build.md" --changed-lines 40 --changed-files 1
+expect "spec markdown is not docs" SELFREVIEW skip
+if [ "$(field SKIP_REASON)" = "docs-only" ]; then bad "commands/*.md treated as docs"; else ok; fi
+
+# e2: small tier, Security-only roster, no trigger: skipped; the same size with an auth path runs
+run "scripts/foo.sh" --changed-lines 30 --changed-files 1
+expect "small security-only skips" SELFREVIEW skip; expect "small reason" SKIP_REASON small-security-only; expect "small tier" TIER small
+run "src/auth/session.py
+src/util.py" --changed-lines 30 --changed-files 2
+expect "small + auth path runs" SELFREVIEW run; expect "small + auth tier" TIER small
+has_agent auth && ok || bad "auth path did not add auth"
+has_agent security && ok || bad "security floor missing"
+run "scripts/foo.sh
+scripts/bar.sh" --changed-lines 30 --changed-files 2 --contract-flags "HIGH_RISK"
+expect "small + HIGH_RISK runs" SELFREVIEW run; expect "HIGH_RISK lifts tier" TIER standard
+
+# standard tier runs
+run "scripts/foo.sh
+scripts/bar.sh" --changed-lines 400 --changed-files 2
+expect "standard runs" SELFREVIEW run; expect "standard tier" TIER standard; expect "standard no reason" SKIP_REASON ""
+has_agent security && ok || bad "standard roster lacks security"
+
+# EXTENDED depth lifts a small roster
+run "scripts/foo.sh" --changed-lines 20 --changed-files 1 --review-depth EXTENDED
+expect "extended depth runs" SELFREVIEW run; expect "extended tier" TIER standard
+
+# e3: off switch, no Agent tool, unresolvable roster degrade to skip and exit 0
+FORGE_SELFREVIEW=off run "scripts/a.sh
+scripts/b.sh" --changed-lines 400
+[ "$RC" = 0 ] && ok || bad "off exit code $RC"
+expect "off skips" SELFREVIEW skip; expect "off reason" SKIP_REASON disabled
+run "scripts/a.sh
+scripts/b.sh" --changed-lines 400 --agent-available false
+[ "$RC" = 0 ] && ok || bad "no-agent exit code $RC"
+expect "no agent skips" SELFREVIEW skip; expect "no agent reason" SKIP_REASON no-agent-tool
+FORGEDOCK_HOME=/nonexistent-forge-home run "scripts/a.sh
+scripts/b.sh" --changed-lines 400
+[ "$RC" = 0 ] && ok || bad "unresolvable exit code $RC"
+expect "unresolvable roster skips" SELFREVIEW skip; expect "unresolvable reason" SKIP_REASON roster-unavailable
+
+# e4: a tree that already has a completed self-review is not dispatched again
+run "scripts/a.sh
+scripts/b.sh" --changed-lines 400 --tree aaa --done-trees "bbb aaa"
+expect "same tree skips" SELFREVIEW skip; expect "same tree reason" SKIP_REASON already-done
+run "scripts/a.sh
+scripts/b.sh" --changed-lines 400 --tree ccc --done-trees "bbb aaa"
+expect "new tree runs" SELFREVIEW run
+
+# usage: unknown flag exits 2
+bash "$SCRIPT" --nope >/dev/null 2>&1; [ "$?" = 2 ] && ok || bad "unknown flag should exit 2"
+
+echo "selfreview-plan: ${pass} passed, ${fail} failed"
+[ "$fail" -eq 0 ]

package/scripts/spawn-depth-check.sh

@@ -1,13 +1,14 @@
 #!/usr/bin/env bash
-# spawn-depth-check.sh — will a /work-on dispatching phase (review, remediate) have the Agent tool?
+# spawn-depth-check.sh — will a /work-on dispatching phase (build self-review, review, remediate) have the Agent tool?
 # SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
 # SPDX-License-Identifier: AGPL-3.0-or-later
 #
 # Claude Code grants the Agent tool to sub-agents down to CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH layers
 # below the main conversation (default 3 since 2.1.219; 5 for 2.1.172-2.1.216; 1 for 2.1.217-2.1.218).
-# A sub-agent at layer L can spawn only when L < depth. The router invokes review/remediate at
+# A sub-agent at layer L can spawn only when L < depth. The router invokes build/review/remediate at
 # router layer + 1, so they can spawn reviewers only when router layer + 2 <= depth (forge#3398,
-# docs/WORK-ON-RUNTIME.md).
+# docs/WORK-ON-RUNTIME.md). build (B5.6 self-review, forge#3971) uses the same arithmetic but degrades to a recorded
+# skip on FAIL instead of stopping the run.
 #
 # Usage: spawn-depth-check.sh [--router-layer N]      (N = 0 solo, 1 under /orchestrate; default 0)
 # Env:   CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH  explicit limit (wins over the version default)
@@ -69,5 +70,5 @@ if [ "$DEPTH" -ge "$REQUIRED" ]; then
   echo "SPAWN_DEPTH: OK depth=${DEPTH} required=${REQUIRED} (${SOURCE})"
   exit 0
 fi
-echo "SPAWN_DEPTH: FAIL depth=${DEPTH} required=${REQUIRED} (${SOURCE}) — review/remediate would run without the Agent tool and could not spawn /review-pr reviewers. Set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH>=${REQUIRED}."
+echo "SPAWN_DEPTH: FAIL depth=${DEPTH} required=${REQUIRED} (${SOURCE}) — build/review/remediate would run without the Agent tool and could not spawn self-review or /review-pr reviewers. Set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH>=${REQUIRED}."
 exit 1

package/scripts/spawn-depth-check.test.sh

@@ -43,5 +43,8 @@ t "env depth 09 decimal"           0 "SPAWN_DEPTH: OK"      CLAUDE_CODE_MAX_SUBA
 # Usage errors.
 t "bad router layer"              2 "spawn-depth-check:"   -- --router-layer x
 t "unknown flag"                  2 "usage:"               -- --nope
+# forge#3971: build is a dispatching phase too, and the FAIL text names it (exit codes unchanged)
+out=$(env -u CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH -u FORGE_RUNTIME FORGE_CLAUDE_VERSION=2.1.217 bash "$S" 2>&1)
+case "$out" in *build/review/remediate*) PASS=$((PASS+1)) ;; *) FAILN=$((FAILN+1)); echo "FAIL: FAIL text does not name build ($out)" ;; esac
 echo "spawn-depth-check: ${PASS} passed, ${FAILN} failed"
 [ "$FAILN" -eq 0 ]

package/scripts/telemetry.test.sh

@@ -55,10 +55,20 @@ for fx in "acceptance_gate phase=review verified=3 failed=0 malformed=1 deferred
   check "fixture $ev event" "$(grep '^{' "$TD/posted" | jq -r '.event')" "$ev"
   check "fixture $ev key $key" "$(grep '^{' "$TD/posted" | jq -r --arg k "$key" 'has($k)')" "true"
 done
+reset; FORGE_PR=9 forge_emit finding_disposition severity=MEDIUM scope=introduced disposition=INPR_FIX
+check "finding_disposition carries scope" "$(grep '^{' "$TD/posted" | jq -r '.scope')" "introduced"
 # review-side events go to the PR, others to the issue
 reset; FORGE_PR=9 forge_emit review_panel mode=FULL; grep -q 'issues/9/comments' "$TD/calls" && ok || bad "review_panel targets PR"
 reset; FORGE_PR=9 forge_emit diff_size lines=1; grep -q 'issues/5/comments' "$TD/calls" && ok || bad "diff_size targets issue"
 
+# build_selfreview (forge#3971) is a build-side event: posted to the issue even when a PR number is set; ids and counts only
+reset; FORGE_PR=9 forge_emit build_selfreview tier=standard agents=3 findings=4 fixed=2 declined=1 skipped=
+grep -q 'issues/5/comments' "$TD/calls" && ok || bad "build_selfreview targets issue"
+REC=$(grep '^{' "$TD/posted")
+check "build_selfreview event" "$(printf '%s' "$REC" | jq -r '.event')" "build_selfreview"
+check "build_selfreview counts typed" "$(printf '%s' "$REC" | jq -r '.agents + .findings + .fixed + .declined')" "10"
+check "build_selfreview skip reason" "$(reset; forge_emit build_selfreview skipped=small-security-only tier=small; grep '^{' "$TD/posted" | jq -r '.skipped')" "small-security-only"
+
 # 2. Sanitising: reserved keys, bad keys, backticks and newlines never reach the record.
 reset
 forge_emit x repo=evil 'a b=1' ok='a`b

package/scripts/transition-label.sh

@@ -278,6 +278,32 @@ fi
 # ---------------------------------------------------------------------------
 # Add target label
 # ---------------------------------------------------------------------------
+# forge#3567: `gh issue edit --add-label` fails when the label is absent from the repo (a
+# consumer repo not re-synced via `forgedock labels setup`), aborting the transition under
+# `set -e`. Best-effort ensure first: `--force` is a create-or-update, a failure (permissions,
+# rate limit, concurrent create) is ignored so the add below surfaces its own error. Only
+# ForgeDock-managed names are created (fixed table mirroring bin/labels.json, kept in sync by
+# bin/tests/label-bootstrap.test.mjs); a custom FORGE_LABEL_MAP name is never created.
+ensure_label() {
+  local name="$1" LBL_COLOR="" LBL_DESC=""
+  case "$name" in
+    "workflow:investigating") LBL_COLOR="1D76DB"; LBL_DESC="Pipeline: investigation phase in progress. Managed by ForgeDock." ;;
+    "workflow:ready-to-build") LBL_COLOR="0075CA"; LBL_DESC="Pipeline: investigation complete, ready for build. Managed by ForgeDock." ;;
+    "workflow:building") LBL_COLOR="0052CC"; LBL_DESC="Pipeline: implementation in progress. Managed by ForgeDock." ;;
+    "workflow:in-review") LBL_COLOR="5319E7"; LBL_DESC="Pipeline: PR created, under review. Managed by ForgeDock." ;;
+    "workflow:remediating") LBL_COLOR="C5DEF5"; LBL_DESC="Pipeline: autonomous remediation pending (no human action needed). Managed by ForgeDock." ;;
+    "workflow:awaiting-merge") LBL_COLOR="FF8C00"; LBL_DESC="Pipeline: remediated + re-reviewed, awaiting a human merge decision. Managed by ForgeDock." ;;
+    "workflow:merged") LBL_COLOR="0E8A16"; LBL_DESC="Pipeline: PR merged, issue closed. Managed by ForgeDock." ;;
+    "workflow:decomposed") LBL_COLOR="BFD4F2"; LBL_DESC="Pipeline: decomposed into sub-issues. Managed by ForgeDock." ;;
+    "workflow:invalid") LBL_COLOR="CCCCCC"; LBL_DESC="Pipeline: issue closed as invalid after investigation. Managed by ForgeDock." ;;
+    "needs-human") LBL_COLOR="E4E669"; LBL_DESC="Pipeline stalled — requires human intervention. Managed by ForgeDock." ;;
+    "workflow:engine-error") LBL_COLOR="B60205"; LBL_DESC="Pipeline stalled — engine/tool failure (not a genuine human-judgment block). Managed by ForgeDock." ;;
+    *) return 0 ;;
+  esac
+  gh label create "$name" --color "$LBL_COLOR" --description "$LBL_DESC" --force "${GH_ARGS[@]}" >/dev/null 2>&1 || true
+}
+ensure_label "$EFFECTIVE_LABEL"
+
 echo "Adding $EFFECTIVE_LABEL to issue #$ISSUE_NUMBER..."
 gh issue edit "$ISSUE_NUMBER" "${GH_ARGS[@]}" --add-label "$EFFECTIVE_LABEL"
 

package/scripts/trusted-comments.test.sh

@@ -47,7 +47,7 @@ eq "bodies with no match prints nothing" "$(printf '[]' | bash "$TC" bodies x)"
 SHA=0123456789abcdef0123456789abcdef01234567
 OTHER=fedcba9876543210fedcba9876543210fedcba98
 AGENT_RE="^<!-- FORGE:REVIEW-AGENT:[a-z-]+ -->[\\s\\S]*(^|\\n)Reviewed-SHA: ${SHA}(\\r?\\n|\$)"
-LOOK_RE="^(?=[\\s\\S]*<!-- REVIEW-FINDINGS-START -->)<!-- FORGE:REVIEW-AGENT:[a-z-]+ -->[\\s\\S]*(^|\\n)Reviewed-SHA: ${SHA}(\\r?\\n|\$)"
+LOOK_RE="^(?=[\\s\\S]*<!-- REVIEW-FINDINGS-START -->[\\s\\S]*<!-- REVIEW-FINDINGS-END -->)<!-- FORGE:REVIEW-AGENT:[a-z-]+ -->[\\s\\S]*(^|\\n)Reviewed-SHA: ${SHA}(\\r?\\n|\$)"
 SYNTH_RE="^<!-- REVIEW-FINDINGS-SYNTHESIZED-START -->[\\s\\S]*(^|\\n)Reviewed-SHA: ${SHA}(\\r?\\n|\$)"
 NL=$'\n'
 AG_BODY="<!-- FORGE:REVIEW-AGENT:security -->${NL}Reviewed-SHA: ${SHA}${NL}<!-- REVIEW-FINDINGS-START -->${NL}<!-- FINDING:real-1 -->${NL}<!-- REVIEW-FINDINGS-END -->"
@@ -57,6 +57,7 @@ AGJ="[$(c NONE Bot b "$AG_BODY"),$(c NONE User h "$FAKE_AG")]"
 eq "agent regex counts only the trusted body" "$(printf '%s' "$AGJ" | bash "$TC" count "$AGENT_RE")" 1
 eq "forged FINDING id never extracted" "$(printf '%s' "$AGJ" | bash "$TC" bodies "$AGENT_RE" | jq -r 'scan("<!-- FINDING:(.+?) -->") | .[0]')" "real-1"
 eq "lookahead agent count (REVIEW-FINDINGS-START inside body)" "$(printf '%s' "$AGJ" | bash "$TC" count "$LOOK_RE")" 1
+eq "lookahead rejects START without END (truncated)" "$(printf '%s' "[$(c NONE Bot b "$FAKE_AG")]" | bash "$TC" count "$LOOK_RE")" 0
 eq "lookahead rejects body without REVIEW-FINDINGS-START" "$(printf '%s' "[$(c NONE Bot b "<!-- FORGE:REVIEW-AGENT:api -->${NL}Reviewed-SHA: ${SHA}")]" | bash "$TC" count "$LOOK_RE")" 0
 eq "agent regex rejects a different head SHA" "$(printf '%s' "[$(c NONE Bot b "<!-- FORGE:REVIEW-AGENT:api -->${NL}Reviewed-SHA: ${OTHER}")]" | bash "$TC" count "$AGENT_RE")" 0
 eq "agent regex rejects SHA line mid-line" "$(printf '%s' "[$(c NONE Bot b "<!-- FORGE:REVIEW-AGENT:api -->${NL}note Reviewed-SHA: ${SHA}")]" | bash "$TC" count "$AGENT_RE")" 0

package/scripts/verify-phase-trail.test.sh

@@ -52,11 +52,13 @@ mk() {
       CONTEXT) items+=('{"body":"<!-- FORGE:CONTEXT -->\n## Context"}') ;;
       ARCH) items+=('{"body":"<!-- FORGE:ARCHITECT -->\n## Plan"}') ;;
       QG_PASS) items+=('{"body":"<!-- FORGE:QUALITY_GATE -->\n**Result**: PASS\n"}') ;;
+      QG_DEGRADED) items+=('{"body":"<!-- FORGE:QUALITY_GATE -->\n## Quality Gate Result\n\n**Result**: PASS\n**Tree**: abc\n**Degraded**: python.test — test run exercised nothing; blast-radius — check did not complete\n"}') ;;
       QG_FAIL) items+=('{"body":"<!-- FORGE:QUALITY_GATE -->\n**Result**: FAIL\n"}') ;;
       FP_NOBAND) items+=('{"body":"<!-- FORGE:FAST_PATH -->\nnothing"}') ;;
       FP_*) items+=("{\"body\":\"<!-- FORGE:FAST_PATH -->\\n**COMPLEXITY_BAND**: ${k#FP_}\"}") ;;
       QUOTED) items+=('{"body":"see `<!-- FORGE:CONTRACT -->` `<!-- FORGE:CONTEXT -->` `<!-- FORGE:ARCHITECT -->` `<!-- FORGE:QUALITY_GATE -->` **Result**: PASS"}') ;;
       INV_INVALID) items+=('{"body":"<!-- FORGE:INVESTIGATOR -->\nInvalid\n<!-- INVESTIGATION:INVALID -->"}') ;;
+      SR) items+=('{"body":"<!-- FORGE:SELFREVIEW-AGENT:security -->\nTree: abc\n<!-- REVIEW-FINDINGS-START -->\n<!-- REVIEW-FINDINGS-END -->"}' '{"body":"<!-- FORGE:SELFREVIEW -->\n## Self-review\nTree: abc"}') ;;
       PROSE) items+=('{"body":"I ran the architect and context inline; FORGE:CONTEXT FORGE:ARCHITECT FORGE:QUALITY_GATE done"}') ;;
     esac
   done
@@ -81,6 +83,11 @@ expect_pass "lowercase band is accepted" "$(mk lower INV CONTRACT FP_trivial QG_
 expect_pass "Investigation band passes with only INVESTIGATOR+FAST_PATH" "$(mk invest INV FP_INVESTIGATION)"
 expect_pass "docs-only waives QUALITY_GATE" "$(mk docs INV CONTRACT FP_TRIVIAL)" --docs-only
 
+# forge#3971: build-time self-review comments are tolerated but never satisfy a required phase marker
+expect_pass "self-review comments do not disturb a full trail" "$(mk sr1 INV CONTRACT FP_COMPLEX CONTEXT ARCH QG_PASS SR)"
+expect_fail "self-review comments do not stand in for QUALITY_GATE" "$(mk sr2 INV CONTRACT FP_COMPLEX CONTEXT ARCH SR)" QUALITY_GATE
+expect_fail "self-review comments do not stand in for CONTEXT" "$(mk sr3 INV CONTRACT FP_STANDARD ARCH QG_PASS SR)" CONTEXT
+
 expect_fail "missing INVESTIGATOR" "$(mk a CONTRACT FP_COMPLEX CONTEXT ARCH QG_PASS)" INVESTIGATOR
 expect_fail "partial investigation (no COMPLETE) fails" "$(mk b INV_PARTIAL CONTRACT FP_COMPLEX CONTEXT ARCH QG_PASS)" INVESTIGATOR
 expect_fail "missing CONTRACT" "$(mk c INV FP_COMPLEX CONTEXT ARCH QG_PASS)" CONTRACT
@@ -90,6 +97,7 @@ expect_fail "missing FAST_PATH" "$(mk f INV CONTRACT CONTEXT ARCH QG_PASS)" FAST
 expect_fail "FAST_PATH without band value fails" "$(mk g INV CONTRACT FP_NOBAND CONTEXT ARCH QG_PASS)" FAST_PATH
 expect_fail "missing QUALITY_GATE" "$(mk h INV CONTRACT FP_COMPLEX CONTEXT ARCH)" QUALITY_GATE
 expect_fail "QUALITY_GATE FAIL result does not count" "$(mk i INV CONTRACT FP_COMPLEX CONTEXT ARCH QG_FAIL)" QUALITY_GATE
+expect_pass "QUALITY_GATE PASS with a **Degraded**: line still counts (forge#3628)" "$(mk i2 INV CONTRACT FP_COMPLEX CONTEXT ARCH QG_DEGRADED)"
 expect_fail "TRIVIAL still needs CONTRACT" "$(mk j INV FP_TRIVIAL QG_PASS)" CONTRACT
 expect_fail "prose mentions do not satisfy markers" "$(mk k INV CONTRACT FP_COMPLEX PROSE)" CONTEXT
 
@@ -263,6 +271,12 @@ expect_pass "head-tree matches the PASS marker's Tree" "$(ht h1 "$QG_T1")" --hea
 expect_fail "PASS recorded for an earlier tree does not satisfy the gate" "$(ht h2 "$QG_T2")" QUALITY_GATE --head-tree "$T1"
 expect_fail "PASS without a Tree line does not satisfy a bound gate" "$(ht h3 "$QG_NOTREE")" QUALITY_GATE --head-tree "$T1"
 expect_pass "a later PASS for the head tree wins over an earlier-tree PASS" "$(ht h4 "$QG_T2" "$QG_T1")" --head-tree "$T1"
+# Post-merge re-gate (#3983): T1 = pre-sync build tree, T2 = merged tree after the base sync
+expect_fail "stale pre-merge PASS does not satisfy the merged head" "$(ht m1 "$QG_T1")" QUALITY_GATE --head-tree "$T2"
+expect_pass "post-merge re-gate marker satisfies the merged head" "$(ht m2 "$QG_T1" "$QG_T2")" --head-tree "$T2"
+expect_pass "pre-merge PASS still satisfies the pre-merge tree" "$(ht m3 "$QG_T1" "$QG_T2")" --head-tree "$T1"
+QG_T2_FAIL=$'<!-- FORGE:QUALITY_GATE -->\n**Result**: FAIL\n**Tree**: '"$T2"
+expect_fail "a FAIL re-gate on the merged tree is not a PASS" "$(ht m4 "$QG_T2_FAIL")" QUALITY_GATE --head-tree "$T2"
 expect_pass "no --head-tree keeps the unbound behaviour" "$(ht h5 "$QG_NOTREE")"
 expect_pass "uppercase head-tree is normalised" "$(ht h6 "$QG_T1")" --head-tree "$(echo "$T1" | tr a-f A-F)"
 expect_pass "docs-only still waives the bound gate" "$(ht h7)" --docs-only --head-tree "$T1"