forgedock 1.19.0 → 1.20.0

package/scripts/review-finalize.test.sh

@@ -39,13 +39,15 @@ case "$a" in
   "api --paginate repos/o/r/pulls/"*"/files"*) cat "$FIX/pr-files.txt" 2>/dev/null || exit 1 ;;
   "api repos/o/r/pulls/"*"--jq .changed_files") cat "$FIX/changed-n" 2>/dev/null || exit 1 ;;
   "api repos/o/r/pulls/"*"--jq .head.sha") cat "$FIX/head" ;;
+  "api repos/o/r/pulls/"*"--jq .base.sha") cat "$FIX/base-sha" 2>/dev/null || exit 1 ;;
   "api repos/o/r/branches/"*"/protection"*) cat "$FIX/protection" 2>/dev/null || exit 1 ;;
   "api repos/o/r/issues/"*"/comments --paginate --jq"*) cat "$FIX/route-bodies" 2>/dev/null; exit 0 ;;
   "api repos/o/r/issues/"*"/comments --jq"*) cat "$FIX/investigator" 2>/dev/null; exit 0 ;;
   "api repos/o/r/commits/"*) cat "$FIX/commit-sha" 2>/dev/null || exit 1 ;;
   "api repos/o/r/compare/"*) cat "$FIX/compare-files" 2>/dev/null || exit 1 ;;
   "pr comment"*) { printf '%s\n' '=====COMMENT====='; for x in "$@"; do last="$x"; done; printf '%s\n' "$last"; } >> "$FIX/posted.log"; exit 0 ;;
-  "issue comment"*) printf 'ISSUE_COMMENT %s\n' "$3" >> "$FIX/issue-comments.log"; { for x in "$@"; do last="$x"; done; printf '%s\n' "$last"; } >> "$FIX/issue-bodies.log"; exit 0 ;;
+  "issue view"*"--json state"*) [ -f "$FIX/issue-closed" ] && echo CLOSED || echo OPEN; exit 0 ;;
+  "issue comment"*) [ -f "$FIX/issue-comment-fail" ] && exit 1; printf 'ISSUE_COMMENT %s\n' "$3" >> "$FIX/issue-comments.log"; { for x in "$@"; do last="$x"; done; printf '%s\n' "$last"; } >> "$FIX/issue-bodies.log"; exit 0 ;;
   "label create"*) exit 0 ;;
   "pr view"*"headRefOid"*) cat "$FIX/head" ;;
   "pr view"*"baseRefName"*) echo main ;;
@@ -317,6 +319,55 @@ for pair in G-1:introduced G-2:pre-existing G-3:pre-existing G-4:unknown G-7:pre
 done
 want "gate2 table: a file absent from the PR and from the head is stale (gate 1), not pre-existing" '[.findings[].id] | contains(["G-14"]) | not' findings.json "true"
 
+# symbol fallback (#4061): a stale or call-site cited line still scopes introduced when a named identifier is in the added lines
+reset
+printf '%s\n' '[{"filename":"s.sh","status":"modified","patch":"@@ -9,2 +9,3 @@\n ctx baseOnlyName\n+stepKey=1 stepKeyed=2 a*b $(x) self return result computeLaneBudget\n ctx"}]' > "$FIX/pr-files.json"
+# The base version of s.sh (a dangling commit, HEAD untouched): base-present words never count as new symbols.
+_bb=$(printf 'ctx baseOnlyName\nctx\nself return result\n' | git -C "$REPO_DIR" hash-object -w --stdin)
+_bt=$(printf '100644 blob %s\ts.sh\n' "$_bb" | git -C "$REPO_DIR" mktree)
+git -C "$REPO_DIR" commit-tree "$_bt" -m base-s > "$FIX/base-sha"
+SY_PROSE=""; SY_MARKS=""; SY_N=0
+sy() {   # sy <id> <title> <extra prose line>
+    SY_PROSE="${SY_PROSE}### $1 finding
+**Failure scenario**: s
+$3
+"
+    SY_N=$((SY_N + 1))
+    SY_MARKS="${SY_MARKS}<!-- FINDING:$1|LIKELY|MEDIUM|s.sh:$((300 + SY_N * 20))|$2 -->
+"
+}
+sy Y-1 "alpha stale" 'The dedup key `stepKey` is wrong'
+sy Y-2 "bravo base" 'Calls `baseOnlyName` badly'
+sy Y-3 "charlie generic" 'Uses `this` and `file` and `abc` here'
+sy Y-4 "delta substring" 'Wrong `stepKe` or `step` usage'
+sy Y-5 "echo plain" 'No backticks and no cause line at all'
+sy Y-6 "foxtrot meta" 'Odd `a*b` and `$(x)` and `[` tokens'
+sy Y-7 "golf rootcause" 'Root cause: stepKey is built too late'
+sy Y-8 "hotel self" 'The `self` handle leaks'
+sy Y-9 "india return" 'Missing `return` on the error path'
+sy Y-10 "juliet result" 'The `result` is discarded'
+sy Y-11 "kilo newfn" 'The new `computeLaneBudget` overflows'
+cm MEMBER User "$(agent_body security "$SHA" "$SY_PROSE" "$SY_MARKS")"; flush
+run "$GOOD" extract; rc_is "symbol fallback" "$RC" 0
+# stale cited line (outside every added hunk) naming an added identifier: Y-1, Y-7 introduced
+# generic words (this, file) and identifiers under 4 characters (abc): Y-3 never triggers the fallback
+for pair in Y-1:introduced Y-2:pre-existing Y-3:pre-existing Y-4:pre-existing Y-5:pre-existing Y-6:pre-existing Y-7:introduced Y-8:pre-existing Y-9:pre-existing Y-10:pre-existing Y-11:introduced; do
+    want "symbol fallback: ${pair%%:*}" ".findings[] | select(.id == \"${pair%%:*}\") | .scope" findings.json "${pair#*:}"
+done
+want "symbol fallback: stale cited line naming an added identifier is introduced" '[.findings[] | select(.id == "Y-1" or .id == "Y-7") | .scope] | join(",")' findings.json "introduced,introduced"
+want "symbol fallback: generic words and short identifiers never trigger the fallback" '.findings[] | select(.id == "Y-3") | .scope' findings.json "pre-existing"
+want "symbol fallback: introduced routes file" '.findings[] | select(.id == "Y-1") | .route' findings.json "file"
+want "symbol fallback: base-only stays pre-existing route" '.findings[] | select(.id == "Y-2") | .route' findings.json "pre-existing"
+want "symbol fallback: self/return/result present in base stay pre-existing (DSEC-1/DBH-1)" '[.findings[] | select(.id == "Y-8" or .id == "Y-9" or .id == "Y-10") | .scope] | join(",")' findings.json "pre-existing,pre-existing,pre-existing"
+want "symbol fallback: a brand-new function name is introduced" '.findings[] | select(.id == "Y-11") | .scope' findings.json "introduced"
+# unreadable added text (extraction failure) keeps the line-window result
+reset; echo '[]' > "$FIX/pr-files.json"
+cm MEMBER User "$(agent_body security "$SHA" '### Y-1 f
+**Failure scenario**: s
+`stepKey`
+' '<!-- FINDING:Y-1|LIKELY|MEDIUM|s.sh:300|alpha stale -->')"; flush
+run "$GOOD" extract; want "symbol fallback: no diff keeps" '.findings[0].scope' findings.json "unknown"
+
 # DELTA: the earlier reviewed head's findings are read as well
 reset; mkctx 1 DELTA "$OLD_SHA"
 cm MEMBER User "$(agent_body security "$SHA" '### D-1 new
@@ -462,16 +513,49 @@ run "$GOOD" classify --auto-merge true; has "untrusted marker" "INPR_FIX=1"
 reset; mkctx 1 FULL "" 12; echo false > "$FIX/labels"; printf 'a.py\n' > "$FIX/files"
 CONTRACT_BODY=$(printf '<!-- FORGE:CONTRACT -->\n### Out of Scope\n\n- `docs/` — deferred → #30: tracked there\n')
 cm MEMBER User "$CONTRACT_BODY"; flush "$FIX/comments-12.json"; echo '[]' > "$FIX/comments.json"
-echo '{"state":"open","body":"x <!-- FORGE:DEFERRED_FROM: #12 --> docs/","author_association":"MEMBER","user":{"type":"User"}}' > "$FIX/issue-30.json"
+echo '{"state":"open","body":"x <!-- FORGE:DEFERRED_FROM: #12 -->\n- [ ] `docs/` — why","author_association":"MEMBER","user":{"type":"User"}}' > "$FIX/issue-30.json"
 mkfind K-1 LIKELY MEDIUM docs/guide.md 3 "Docs example is misleading"; putfind 1
 run "$GOOD" classify; has "contract" "CONTRACT_DEMOTED=1"
 want "contract-deferred" '.findings[0].disposition' classified.json "NOTE contract-deferred #30"
 [ "$(cat "$FIX/issue-comments.log" 2>/dev/null)" = "ISSUE_COMMENT 30" ] && ok || bad "deferred issue comment not posted"
 posted_has "contract list line" "tracked on #30"
+# substring-only / longer-path / legacy / empty bodies must not verify (e1, e3, e4); [x] and regex-metachar paths do (e2, e3)
+for B in 'x <!-- FORGE:DEFERRED_FROM: #12 --> docs/' 'x <!-- FORGE:DEFERRED_FROM: #12 -->\n- [ ] `docs/guide.md.bak` — why' 'x <!-- FORGE:DEFERRED_FROM: #12 -->\n- [ ] `docs/x`' 'x <!-- FORGE:DEFERRED_FROM: #12 -->\n- [ ] `docs/`x' ''; do
+    reset; mkctx 1 FULL "" 12; echo false > "$FIX/labels"; printf 'a.py\n' > "$FIX/files"
+    cm MEMBER User "$CONTRACT_BODY"; flush "$FIX/comments-12.json"; echo '[]' > "$FIX/comments.json"
+    echo "{\"state\":\"open\",\"body\":\"$B\",\"author_association\":\"MEMBER\",\"user\":{\"type\":\"User\"}}" > "$FIX/issue-30.json"
+    mkfind K-1 LIKELY MEDIUM docs/guide.md 3 "Docs example is misleading"; putfind 1
+    run "$GOOD" classify; has "unverified-body '$B'" "CONTRACT_DEMOTED=0"
+done
+reset; mkctx 1 FULL "" 12; echo false > "$FIX/labels"; printf 'a.py\n' > "$FIX/files"
+cm MEMBER User "$CONTRACT_BODY"; flush "$FIX/comments-12.json"; echo '[]' > "$FIX/comments.json"
+echo '{"state":"open","body":"x <!-- FORGE:DEFERRED_FROM: #12 -->\n- [x] `docs/`","author_association":"MEMBER","user":{"type":"User"}}' > "$FIX/issue-30.json"
+mkfind K-1 LIKELY MEDIUM docs/guide.md 3 "Docs example is misleading"; putfind 1
+run "$GOOD" classify; has "checked-item-verifies" "CONTRACT_DEMOTED=1"
+# a failing comment on the deferred issue, or a no-longer-open one, files the finding instead of demoting it
+for _mode in issue-comment-fail issue-closed; do
+reset; mkctx 1 FULL "" 12; echo false > "$FIX/labels"; printf 'a.py\n' > "$FIX/files"
+cm MEMBER User "$CONTRACT_BODY"; flush "$FIX/comments-12.json"; echo '[]' > "$FIX/comments.json"
+echo '{"state":"open","body":"x <!-- FORGE:DEFERRED_FROM: #12 -->\n- [ ] `docs/` — why","author_association":"MEMBER","user":{"type":"User"}}' > "$FIX/issue-30.json"
+mkfind K-1 LIKELY MEDIUM docs/guide.md 3 "Docs example is misleading"; putfind 1
+: > "$FIX/$_mode"
+run "$GOOD" classify; has "$_mode not counted" "CONTRACT_DEMOTED=0"
+want "$_mode falls back to the no-contract disposition" '.findings[0].disposition' classified.json "ISSUE MEDIUM-LIKELY"
+rm -f "$FIX/$_mode"
+done
+# a failing comment on a LOW/POSSIBLE finding falls back to its no-contract disposition (a NOTE), not a blanket ISSUE (DB-1)
+reset; mkctx 1 FULL "" 12; echo false > "$FIX/labels"; printf 'a.py\n' > "$FIX/files"
+cm MEMBER User "$CONTRACT_BODY"; flush "$FIX/comments-12.json"; echo '[]' > "$FIX/comments.json"
+echo '{"state":"open","body":"x <!-- FORGE:DEFERRED_FROM: #12 -->\n- [ ] `docs/` — why","author_association":"MEMBER","user":{"type":"User"}}' > "$FIX/issue-30.json"
+mkfind K-1 POSSIBLE LOW docs/guide.md 3 "Docs example is misleading"; putfind 1
+: > "$FIX/issue-comment-fail"
+run "$GOOD" classify; has "low-fallback not counted" "CONTRACT_DEMOTED=0"
+want "low finding falls back to its NOTE" '.findings[0].class' classified.json "NOTE"
+rm -f "$FIX/issue-comment-fail"
 # an untrusted contract demotes nothing
 reset; mkctx 1 FULL "" 12; echo false > "$FIX/labels"; printf 'a.py\n' > "$FIX/files"
 cm NONE User "$CONTRACT_BODY"; flush "$FIX/comments-12.json"; echo '[]' > "$FIX/comments.json"
-echo '{"state":"open","body":"x <!-- FORGE:DEFERRED_FROM: #12 --> docs/","author_association":"MEMBER","user":{"type":"User"}}' > "$FIX/issue-30.json"
+echo '{"state":"open","body":"x <!-- FORGE:DEFERRED_FROM: #12 -->\n- [ ] `docs/` — why","author_association":"MEMBER","user":{"type":"User"}}' > "$FIX/issue-30.json"
 mkfind K-1 LIKELY MEDIUM docs/guide.md 3 "Docs example is misleading"; putfind 1
 run "$GOOD" classify; has "untrusted contract" "CONTRACT_DEMOTED=0"
 
@@ -809,9 +893,25 @@ rc_is "guard: non-boolean" "$RC" 3; has "guard: non-boolean" "merge guard state
 # --- verdict / calibration / trust / base-conflict routing ---
 gate_reset; mg "$GATE" --verdict "CHANGES REQUESTED" --base-conflict true
 rc_is "route: only base conflict" "$RC" 3; has "route: only base conflict" "blocker: base-conflict"; has "route: only base conflict" "MERGE_OUTCOME=base-conflict"
-logged "route: base-sync comment" issue-bodies.log "the pipeline is performing the base sync automatically"; not_logged "route: base conflict is not needs-human" edits.log "needs-human"; not_merged "route: base conflict"
+logged "route: base-sync comment" issue-bodies.log "the work-on pipeline performs the base sync"; logged "route: standalone remediate action" issue-bodies.log "--remediate"; not_logged "route: base conflict is not needs-human" edits.log "needs-human"; not_merged "route: base conflict"
 gate_reset; mg "$GATE" --verdict "CHANGES REQUESTED" --base-conflict true --other-blocking true
 rc_is "route: base conflict plus blocker" "$RC" 3; has "route: base conflict plus blocker" "MERGE_OUTCOME=needs-human"; logged "route: needs-human" edits.log "needs-human"
+# other-blocking-derived: a persisted true (written by verdict) is ORed in; a passed false never lowers it
+ob() { mkdir -p "$WORK/out"; printf '%s\n' "$1" > "$WORK/out/other-blocking.txt"; }
+gate_reset; ob true; mg "$GATE" --verdict "CHANGES REQUESTED" --base-conflict true --other-blocking false
+rc_is "other-blocking-derived: persisted true beats passed false" "$RC" 3; has "other-blocking-derived: persisted true beats passed false" "MERGE_OUTCOME=needs-human"
+not_has() { case "$OUT" in *"$2"*) bad "$1: output has '$2'" ;; *) ok ;; esac; }
+not_has "other-blocking-derived: not base-conflict" "MERGE_OUTCOME=base-conflict"; logged "other-blocking-derived: needs-human" edits.log "needs-human"
+gate_reset; ob false; mg "$GATE" --verdict "CHANGES REQUESTED" --base-conflict true
+rc_is "other-blocking-derived: persisted false keeps base-conflict route" "$RC" 3; has "other-blocking-derived: persisted false" "MERGE_OUTCOME=base-conflict"
+gate_reset; mg "$GATE" --verdict "CHANGES REQUESTED" --base-conflict true
+has "other-blocking-derived: missing file uses passed flag" "MERGE_OUTCOME=base-conflict"
+for junk in "" "maybe" "TRUE" "yes"; do
+    gate_reset; ob "$junk"; mg "$GATE" --verdict "CHANGES REQUESTED" --base-conflict true
+    has "other-blocking-derived: garbage file '$junk' ignored" "MERGE_OUTCOME=base-conflict"
+done
+gate_reset; ob true; mg "$GATE" --other-blocking ""
+rc_is "other-blocking-derived: unbound passed flag still fails closed" "$RC" 3; has "other-blocking-derived: unbound still fails closed" "merge guard state unbound"
 gate_reset; mg "$GATE" --verdict "CHANGES REQUESTED" --base-conflict true --trust-needs-human true --table-cell-key "feature x HIGH"
 rc_is "route: base conflict plus trust" "$RC" 3; logged "route: trust reason" issue-bodies.log "provenance trust: NOVEL_NEEDS_HUMAN tier for cell \`feature x HIGH\`"; logged "route: trust needs-human" edits.log "needs-human"
 gate_reset; mg "$GATE" --verdict "CHANGES REQUESTED" --base-conflict true --calibration-needs-human true --calibration-note "overconfident cell"
@@ -834,7 +934,7 @@ rc_is "route: CHANGES REQUESTED" "$RC" 3; logged "route: verdict reason" issue-b
 
 # --- pre-merge mergeability guard ---
 gate_reset; echo "CONFLICTING|DIRTY" > "$FIX/premerge"; mg "$GATE"
-rc_is "premerge: conflicting" "$RC" 3; has "premerge: conflicting" "blocker: base-conflict"; not_logged "premerge: conflict is not needs-human" edits.log "needs-human"; not_merged "premerge: conflicting"
+rc_is "premerge: conflicting" "$RC" 3; has "premerge: conflicting" "blocker: base-conflict"; not_logged "premerge: conflict is not needs-human" edits.log "needs-human"; logged "premerge: standalone base-sync wording" issue-bodies.log "/work-on 42 --remediate"; not_merged "premerge: conflicting"
 gate_reset; echo "MERGEABLE|BEHIND" > "$FIX/premerge"; echo true > "$FIX/protection"; mg "$GATE"
 rc_is "premerge: behind under strict protection" "$RC" 3; has "premerge: behind under strict protection" "blocker: base-conflict"
 gate_reset; echo "MERGEABLE|BEHIND" > "$FIX/premerge"; echo false > "$FIX/protection"; mg "$GATE"
@@ -896,6 +996,22 @@ reset; MH=MERGEABLE; MHS=CLEAN; vd --result clean --intensity-tier FAST --table-
 logged "verdict: trust annotation" reviews.log '**Intensity tier**: FAST | **Cell**: `bug HIGH` | **Shadow mode**: false'
 reset; MH=CONFLICTING; MHS=DIRTY; vd --result blocking --blocking-count 1
 has "verdict: blocking" "VERDICT=CHANGES REQUESTED"; logged "verdict: blocking body" reviews.log "CHANGES REQUESTED: commit"; logged "verdict: base conflict line" reviews.log "🔴 Base Conflict:"
+# other-blocking-derived: verdict resolves and persists OTHER_BLOCKING
+OBF="$WORK/out/other-blocking.txt"
+reset; MH=MERGEABLE; MHS=CLEAN; vd --result blocking --blocking-count 1 --other-blocking false
+has "other-blocking-derived: unexplained blocking forces true" "OTHER_BLOCKING=true"; [ "$(cat "$OBF" 2>/dev/null)" = "true" ] && ok || bad "other-blocking-derived: file lacks true"
+reset; MH=MERGEABLE; MHS=CLEAN; vd --result blocking --blocking-count 1
+has "other-blocking-derived: no flag still derives true" "OTHER_BLOCKING=true"
+reset; MH=CONFLICTING; MHS=DIRTY; vd --result blocking --blocking-count 1 --other-blocking false
+has "other-blocking-derived: base conflict explains the block" "OTHER_BLOCKING=false"; [ "$(cat "$OBF" 2>/dev/null)" = "false" ] && ok || bad "other-blocking-derived: file lacks false"
+reset; MH=CONFLICTING; MHS=DIRTY; vd --result blocking --blocking-count 1 --other-blocking true
+has "other-blocking-derived: reviewer true is kept" "OTHER_BLOCKING=true"
+reset; MH=MERGEABLE; MHS=CLEAN; mkdir -p "$WORK/out"; echo true > "$OBF"; vd --result clean --other-blocking true
+has "other-blocking-derived: clean result resets to false" "OTHER_BLOCKING=false"; [ "$(cat "$OBF" 2>/dev/null)" = "false" ] && ok || bad "other-blocking-derived: stale true survived a clean re-review"
+reset; MH=MERGEABLE; MHS=CLEAN; mkdir -p "$WORK/out"; echo true > "$OBF"; vd --result stale
+[ -e "$OBF" ] && bad "other-blocking-derived: stale result must remove the file" || ok
+reset; MH=MERGEABLE; MHS=CLEAN; vd --result blocking --other-blocking maybe --blocking-count 1
+has "other-blocking-derived: garbage flag, unexplained block" "OTHER_BLOCKING=true"
 reset; MH=CONFLICTING; MHS=DIRTY; vd --result clean
 has "verdict: clean coerced over a base conflict" "VERDICT_COERCED=true"; has "verdict: coerced verdict" "VERDICT=CHANGES REQUESTED"; logged "verdict: coerced body" reviews.log "CHANGES REQUESTED: commit"
 reset; MH=MERGEABLE; MHS=CLEAN; vd --result clean --has-purpose-regression true --purpose-findings "F-1"
@@ -1007,6 +1123,21 @@ reset; rm -f "$FIX/comments.json"; ig; has "integrity: unreadable comments count
 reset; mkctx 1 BASE_SYNC_ONLY "$OLD_SHA" 42; cm MEMBER User "$(agent_body security "$SHA" 'a' '')"; flush; ig
 has "integrity: unverified carry is not reported as carried" "CARRIED_FROM: "; case "$OUT" in *"carried from"*) bad "integrity: carried requires a verified record" ;; *) ok ;; esac
 
+# forge#3971: a build-time FORGE:SELFREVIEW-AGENT comment (even a trusted one pinned to the current head) is never a panel member
+sr_body() { printf '<!-- FORGE:SELFREVIEW-AGENT:%s -->\n%s\n<!-- REVIEW-FINDINGS-START -->\n%s\n<!-- REVIEW-FINDINGS-END -->\nReviewed-SHA: %s\nTree: abc123\n' "$1" "$3" "$4" "$2"; }
+reset
+cm MEMBER User "$(sr_body security "$SHA" 'self' '<!-- FINDING:SEC-9|CONFIRMED|HIGH|a.py:9|Self-review finding -->')"; cm MEMBER Bot "<!-- FORGE:SELFREVIEW -->
+Tree: abc123"; flush
+ig; has "integrity: self-review comments never count as panel agents" "ACTUAL_AGENT_COUNT=0"
+case "$OUT" in *security*) bad "integrity: SELFREVIEW-AGENT domain leaked into the panel" ;; *) ok ;; esac
+reset
+cm MEMBER User "$(sr_body security "$SHA" 'self' '<!-- FINDING:SEC-9|CONFIRMED|HIGH|a.py:9|Self-review finding -->')"; flush
+run "$GOOD" extract
+has "extract: a self-review comment alone is no review (fail closed)" "no trusted reviewer comments"
+reset
+cm MEMBER User "$(sr_body security "$SHA" 'self' '')"; cm MEMBER User "$(agent_body api "$SHA" 'real' '')"; flush
+ig; has "integrity: only the REVIEW-AGENT counts beside a self-review" "ACTUAL_AGENT_COUNT=1"; has "integrity: only the real domain" "ACTUAL_AGENT_DOMAINS=api"
+
 # --- Phase 7-9 subcommands run without a review-prepare context (flags only) ---
 nctx() { local sub="$1"; shift; OUT=$(cd "$REPO_DIR" && FORGEDOCK_HOME="$GATE" bash "$ROOT/scripts/review-finalize.sh" "$sub" --pr 7 --repo o/r "$@" 2>"$WORK/stderr"); RC=$?; }
 gate_reset; nctx merge-gate --issue 42 --base main --verdict APPROVED --has-purpose-regression false --calibration-needs-human false --trust-needs-human false --base-conflict false --other-blocking false

package/scripts/review-roster.sh

@@ -17,7 +17,8 @@
 #
 # Tiers, evaluated in this order:
 #   full      THOROUGH or milestone->staging: Security plus every domain with a score > 0.
-#   fix-pr    the PR closes a `review-finding` issue: Security, plus the source finding's domain when it was HIGH+.
+#   fix-pr    the PR closes a `review-finding` issue AND has <= 150 changed lines with a known size: Security, plus the
+#             source finding's domain when it was HIGH+. Larger or unknown-size fix PRs fall to the size ladder below.
 #   small     <= 60 changed lines, or one file of <= 150 lines: Security only.
 #   medium    61-150 lines: Security plus the score-escalation table (no top-2 baseline).
 #   standard  > 150 lines, or an unknown size (fail toward more agents): top-2 domains by score plus the table.
@@ -27,7 +28,7 @@
 # exact value EXTENDED is STANDARD. An extended roster prints an extra DEPTH=extended line.
 # Path triggers escalate in EVERY tier except full (which already runs the union): CONTRACT HIGH_RISK, cross-critical
 # pairs, churn hot-spot, danger zone, bin/engine* (Concurrency + spec-cli), bin/ (spec-cli), auth/session/trust-filter
-# files (Auth), CI/docker/deploy/infra files (Infra), migration/.sql files (Database), SDK/OpenAPI files (API).
+# files (Auth: auth*, not author*; oauth, jwt, login, password, permission, rbac, acl, token(s), api_key(s), credential, deps.py), CI/docker/deploy/infra files (Infra), migration/.sql files (Database), SDK/OpenAPI files (API).
 # Auth and Infra are path-gated: a diff-text score alone never selects them. Security is a hard floor in every tier.
 # spec-cli is added only with --spec-cli true (the persona file exists in the repo under review); in the standard tier it
 # also covers commands/**. Bash 3.2 portable (no mapfile, associative arrays, grep -P).
@@ -114,7 +115,10 @@ fi
 HIGH_RISK=false
 case " $CFLAGS " in *" HIGH_RISK "*) HIGH_RISK=true ;; esac
 
-if [ "$FIX_PR" = "true" ]; then
+# The fix-pr tier is author-controlled (Closes #N), so it is capped by size: a larger or unknown-size fix PR follows the size ladder.
+FIX_PR_MAX_LINES=150
+FIX_PR_CAPPED=false
+if [ "$FIX_PR" = "true" ] && [ "$LINES_KNOWN" = "true" ] && [ "$LINES" -le "$FIX_PR_MAX_LINES" ]; then
     TIER=fix-pr; REASON="fix PR for a review-finding issue"
 elif [ "$LINES_KNOWN" = "true" ] && { [ "$LINES" -le 60 ] || { [ "$NFILES" -eq 1 ] && [ "$LINES" -le 150 ]; }; }; then
     TIER=small; REASON="lines=$LINES files=$NFILES"
@@ -124,6 +128,9 @@ else
     TIER=standard
     if [ "$LINES_KNOWN" = "true" ]; then REASON="lines=$LINES"; else REASON="size unknown"; fi
 fi
+if [ "$FIX_PR" = "true" ] && [ "$TIER" != "fix-pr" ]; then
+    FIX_PR_CAPPED=true; REASON="$REASON; fix-pr tier capped by size (max $FIX_PR_MAX_LINES lines, known size)"
+fi
 # CONTRACT HIGH_RISK is never narrowed: a small, medium or fix-PR roster is lifted to the standard roster.
 BASE_TIER="$TIER"
 if [ "$HIGH_RISK" = "true" ] && [ "$TIER" != "standard" ]; then TIER=standard; REASON="$REASON; CONTRACT HIGH_RISK lifts $BASE_TIER to standard"; fi
@@ -147,6 +154,12 @@ case "$TIER" in
         esac ;;
     standard) for d in $(top_domains "$TOP_N"); do add_agent "$d"; done ;;
 esac
+# A size-capped fix PR keeps the source finding's domain (size only ever ADDS depth).
+if [ "$FIX_PR_CAPPED" = "true" ] && [ -n "$SRC_DOM" ]; then
+    case "$(printf '%s' "$SRC_SEV" | tr '[:lower:]' '[:upper:]')" in
+        HIGH|CRITICAL|BLOCKER) add_agent "$SRC_DOM"; REASON="$REASON; source finding ${SRC_SEV} adds its domain" ;;
+    esac
+fi
 
 # Score escalation table (medium and standard only; diff-text signals, so never in the small or fix-pr tiers)
 if [ "$TIER" = "medium" ] || [ "$TIER" = "standard" ]; then
@@ -170,8 +183,8 @@ if [ "$CHURN" = "true" ] || [ "$DANGER" = "true" ]; then
     for d in $(top_domains 1); do add_agent "$d"; trig churn-or-danger-zone; done
 fi
 hit() { printf '%s\n' "$FILES" | grep -qiE "$1"; }
-hit '(^|[/_.-])(auth|authn|authz|session|sessions|jwt|oauth|login|logout|password|trust[-_]?filter|trusted[-_a-z]*)([/_.-]|$)' && { add_agent Auth; trig auth-path; }
-hit '^\.github/|(^|/)Dockerfile|docker-compose|(^|/)(deploy|infra|traefik|nginx|k8s|helm|terraform)/|\.tf$' && { add_agent Infra; trig infra-path; }
+hit '(^|[/_.-])(auth([^o]|o[^r]|$)|authori[sz]|oauth|session|jwt|login|logout|passw(or)?d|permission|rbac|acl([/_.-]|$)|tokens?([/_.-]|$)|api[-_]?keys?|credential|trust[-_]?filter|trusted[-_a-z]*)|(^|/)deps\.py$' && { add_agent Auth; trig auth-path; }
+hit '^\.github/|(^|/)Dockerfile|docker-compose|(^|/)(docker-)?compose[^/]*\.ya?ml$|(^|/)deploy[^/]*\.sh$|(^|/)docker-entrypoint[^/]*$|(^|/)(deploy|infra|traefik|nginx|k8s|helm|terraform)/|\.tf$' && { add_agent Infra; trig infra-path; }
 hit 'migration|\.sql$' && { add_agent Database; trig migration-path; }
 hit '^sdk/|openapi.*\.json$|openapi-versions/' && { add_agent API; trig sdk-path; }
 hit '^bin/engine' && { add_agent Concurrency; trig bin-engine; }

package/scripts/review-roster.test.sh

@@ -58,9 +58,26 @@ expect_has "consumer repo bin/engine" concurrency; expect_not "consumer repo bin
 
 # Case 3: a fix PR gives Security only
 run "commands/orchestrate/phase-4-execution.md
-commands/work-on.md" --scores "$SC_NOISY" --changed-lines 200 --changed-files 2 --fix-pr true --source-severity MEDIUM
+commands/work-on.md" --scores "$SC_NOISY" --changed-lines 120 --changed-files 2 --fix-pr true --source-severity MEDIUM
 expect_sel "fix PR" "security"; expect_tier "fix PR" fix-pr
 
+# Case 3b (forge#3848): the fix-pr tier is capped at 150 known lines; larger or unknown-size fix PRs follow the size ladder
+SC_MULTI="AUTH=0 BILLING=5 CONCURRENCY=0 DATABASE=4 INFRA=0 FRONTEND=3 API=0"
+run "svc/x.py" --scores "$SC_MULTI" --changed-lines 900 --changed-files 30 --fix-pr true --source-severity MEDIUM
+expect_tier "fix PR 900 lines" standard; expect_has "fix PR 900 lines" billing; expect_has "fix PR 900 lines" database
+run "svc/x.py" --scores "$SC_QUIET" --changed-lines 150 --changed-files 2 --fix-pr true
+expect_tier "fix-PR-at-cap" fix-pr
+run "svc/x.py" --scores "$SC_QUIET" --changed-lines 151 --changed-files 2 --fix-pr true
+expect_tier "fix PR over cap" standard
+run "svc/x.py" --scores "$SC_MULTI" --fix-pr true
+expect_tier "fix-PR-unknown-size" standard
+run "svc/x.py" --scores "$SC_MULTI" --changed-lines abc --fix-pr true
+expect_tier "fix PR non-numeric size" standard
+run "svc/x.py" --scores "$SC_QUIET" --changed-lines 400 --changed-files 5 --fix-pr true --source-severity HIGH --source-domain Concurrency
+expect_has "capped-fix-PR,-HIGH-source" concurrency; expect_tier "capped-fix-PR,-HIGH-source" standard
+run "svc/x.py" --scores "$SC_QUIET" --changed-lines 400 --changed-files 5 --fix-pr true --contract-flags "HIGH_RISK" --review-depth EXTENDED
+expect_tier "capped-fix-PR-with-HIGH_RISK-and-EXTENDED" standard
+
 # Case 4: a fix PR whose source finding was HIGH adds the domain agent
 run "commands/work-on.md" --scores "AUTH=0 BILLING=0 CONCURRENCY=2 DATABASE=0 INFRA=0 FRONTEND=0 API=0" --changed-lines 40 --fix-pr true --source-severity HIGH --source-domain Concurrency
 expect_sel "fix PR, HIGH source finding" "security concurrency"
@@ -89,12 +106,51 @@ run "svc/app/routers/session.py" --scores "$SC_QUIET" --changed-lines 20 --chang
 expect_has "auth path" auth
 run "scripts/trusted-comments.sh" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_has "trust-filter path" auth
+run "svc/authorization.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path authorization.py" auth
+run "svc/authMiddleware.ts" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth-path-authMiddleware.ts" auth
+run "svc/oauth2.ts" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path oauth2.ts" auth
+run "svc/permissions.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path permissions.py" auth
+run "svc/rbac.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path rbac.py" auth
+run "svc/deps.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path deps.py" auth
+run "svc/tokens.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path tokens.py" auth
+run "svc/api_keys.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth path api_keys.py" auth
+run "svc/auth_utils.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "auth-path-auth_utils.py" auth
+run "AUTHORS.md" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_not "no-auth-path-AUTHORS.md" auth
+run "docs/author.md" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_not "no auth path docs/author.md" auth
+run "svc/tokenizer.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_not "no-auth-path-svc/tokenizer.py" auth
+run "commands/review-pr.md" --scores "AUTH=3 INFRA=0 DATABASE=0 BILLING=0 CONCURRENCY=0" --changed-lines 20 --changed-files 1
+expect_not "auth-from-prose-score-alone" auth
 run "commands/review-pr.md" --scores "AUTH=3 INFRA=3 DATABASE=0 BILLING=0 CONCURRENCY=0" --changed-lines 120
 expect_not "auth from prose score alone" auth; expect_not "infra from prose score alone" infra
 run ".github/workflows/ci.yml" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_has "infra path" infra
 run "docker-compose.prod.yml" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_has "docker path" infra
+# Infra path gate covers deploy scripts, container entrypoints and Compose v2 names (basename-anchored)
+for f in scripts/deploy.sh scripts/deploy-prod.sh docker-entrypoint.sh svc/docker-entrypoint.sh compose.yaml compose.yml; do
+  run "$f" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+  expect_has "infra path: $f" infra
+done
+for f in scripts/resolve-deploy-gate.sh commands/deploy-pr.md; do
+  run "$f" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+  expect_not "no-infra-path-$f" infra
+done
+run "$(printf 'README.md\nscripts/deploy.sh')" --scores "$SC_QUIET" --changed-lines 20 --changed-files 2
+expect_has "infra-path-multi-file-list" infra
+run "Scripts/Deploy.SH" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+expect_has "infra-path-case-insensitive" infra
 run "db/migrations/0042_add.sql" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_has "migration path" database
 run "sdk/node/src/index.ts" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1

package/scripts/selfreview-plan.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# selfreview-plan.sh — build-time self-review plan: run or skip, and which roster (forge#3971).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Pure decision script: flags in, key=value lines out. No network, no git, no eval; every flag value is data.
+# It calls scripts/review-roster.sh (resolved through forge_resolve, never from the repo under build) on the staged
+# diff's file list so the self-review roster equals the roster /review-pr would pick for the same diff.
+#
+# Usage: selfreview-plan.sh --files-file PATH|- [--changed-lines N] [--changed-files N] [--contract-flags "HIGH_RISK ..."]
+#          [--spec-cli true|false] [--review-depth STANDARD|EXTENDED] [--scores "AUTH=n ..."]
+#          [--agent-available true|false] [--tree HASH] [--done-trees "HASH HASH ..."]
+# Env:   FORGE_SELFREVIEW=off|0|false|disabled   operator off switch
+# Output (stdout, always all four lines):
+#          SELFREVIEW=run|skip   SKIP_REASON=<reason or empty>   TIER=<roster tier or empty>   SELECTED_AGENTS=<domains>
+# Skip reasons (first match wins): disabled, empty-diff, docs-only, no-agent-tool, already-done, roster-unavailable,
+#          small-security-only (small tier, Security-only roster, no path or contract trigger fired).
+# Exit: 0 for every parseable call, including every degrade-to-skip path (self-review never blocks build); 2 on an unknown flag.
+# Bash 3.2 portable (no mapfile, associative arrays, grep -P).
+set -u
+
+FILES_FILE=""; LINES=""; NFILES=""; CFLAGS=""; SPEC_CLI=false; DEPTH=STANDARD; SCORES=""
+AGENT_AVAILABLE=true; TREE=""; DONE_TREES=""
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --files-file) FILES_FILE="${2:-}"; shift 2 ;;
+        --changed-lines) LINES="${2:-}"; shift 2 ;;
+        --changed-files) NFILES="${2:-}"; shift 2 ;;
+        --contract-flags) CFLAGS="${2:-}"; shift 2 ;;
+        --spec-cli) SPEC_CLI="${2:-false}"; shift 2 ;;
+        --review-depth) DEPTH="${2:-STANDARD}"; shift 2 ;;
+        --scores) SCORES="${2:-}"; shift 2 ;;
+        --agent-available) AGENT_AVAILABLE="${2:-true}"; shift 2 ;;
+        --tree) TREE="${2:-}"; shift 2 ;;
+        --done-trees) DONE_TREES="${2:-}"; shift 2 ;;
+        *) echo "selfreview-plan: unknown argument: $1" >&2; exit 2 ;;
+    esac
+done
+
+emit() { # <run|skip> <skip reason> <tier> <agents>
+    printf 'SELFREVIEW=%s\nSKIP_REASON=%s\nTIER=%s\nSELECTED_AGENTS=%s\n' "$1" "$2" "$3" "$4"
+    exit 0
+}
+
+case "$(printf '%s' "${FORGE_SELFREVIEW:-}" | tr '[:upper:]' '[:lower:]')" in
+    off|0|false|disabled|no) emit skip disabled "" "" ;;
+esac
+
+FILES=""
+if [ "$FILES_FILE" = "-" ]; then FILES=$(cat)
+elif [ -n "$FILES_FILE" ] && [ -f "$FILES_FILE" ]; then FILES=$(cat "$FILES_FILE"); fi
+FILES=$(printf '%s\n' "$FILES" | grep -v '^[[:space:]]*$' || true)
+
+[ -n "$FILES" ] || emit skip empty-diff "" ""
+
+# Docs-only: every file is documentation. commands/**, .agents/** and skills/** are executable spec, never docs.
+CODE_FILES=$(printf '%s\n' "$FILES" | grep -vE '^(docs/|README|CHANGELOG|LICENSE|NOTICE)|\.(md|txt|rst)$' || true)
+SPEC_FILES=$(printf '%s\n' "$FILES" | grep -E '^(commands|\.agents|skills)/.*\.md$' || true)
+[ -n "$CODE_FILES" ] || [ -n "$SPEC_FILES" ] || emit skip docs-only "" ""
+
+[ "$AGENT_AVAILABLE" = "true" ] || emit skip no-agent-tool "" ""
+
+if [ -n "$TREE" ]; then
+    for _t in $DONE_TREES; do
+        [ "$_t" = "$TREE" ] && emit skip already-done "" ""
+    done
+fi
+
+type forge_resolve >/dev/null 2>&1 || { setopt nonomatch 2>/dev/null || true; _SELF_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd -P)"; for _r in "$(cygpath -u "${FORGEDOCK_HOME:-}" 2>/dev/null || printf %s "${FORGEDOCK_HOME:-}")" "${CLAUDE_PLUGIN_ROOT:-}" "${FORGE_ROOT:-}" "${FORGE_HOME:-}" "$(readlink -f "$HOME/.claude/commands/work-on.md" 2>/dev/null | sed 's|/commands/work-on\.md$||')" "$(head -n 1 "${CODEX_HOME:-$HOME/.codex}/forge-home" 2>/dev/null)" "$HOME/.claude/plugins/marketplaces/forgedock" "${CLAUDE_CONFIG_DIR:-$HOME/.claude}"/plugins/cache/forgedock/forgedock/* "$HOME/.claude"/plugins/cache/forgedock/forgedock/* "$_SELF_ROOT"; do case "$_r" in /*) [ -f "$_r/scripts/lib/forge-resolve.sh" ] && { . "$_r/scripts/lib/forge-resolve.sh"; break; };; esac; done; type forge_resolve >/dev/null 2>&1 || forge_resolve() { :; }; }  # allowlist:portability — canonical resolver block; readlink -f is guarded (2>/dev/null) and optional
+ROSTER_SCRIPT=$(forge_resolve review-roster.sh)
+[ -n "$ROSTER_SCRIPT" ] && [ -f "$ROSTER_SCRIPT" ] || emit skip roster-unavailable "" ""
+
+set -- --files-file - --contract-flags "$CFLAGS" --spec-cli "$SPEC_CLI" --review-depth "$DEPTH"
+[ -n "$LINES" ] && set -- "$@" --changed-lines "$LINES"
+[ -n "$NFILES" ] && set -- "$@" --changed-files "$NFILES"
+[ -n "$SCORES" ] && set -- "$@" --scores "$SCORES"
+OUT=$(printf '%s\n' "$FILES" | bash "$ROSTER_SCRIPT" "$@" 2>/dev/null) || emit skip roster-unavailable "" ""
+
+SEL=$(printf '%s\n' "$OUT" | sed -n 's/^SELECTED_AGENTS=//p' | head -n 1)
+TIER=$(printf '%s\n' "$OUT" | sed -n 's/^TIER=//p' | head -n 1)
+[ -n "$SEL" ] && [ -n "$TIER" ] || emit skip roster-unavailable "" ""
+
+# Cost guard: the small tier runs only when a path or contract trigger widened the roster past Security.
+if [ "$TIER" = "small" ] && [ "$SEL" = "security" ]; then emit skip small-security-only "$TIER" "$SEL"; fi
+emit run "" "$TIER" "$SEL"

package/scripts/selfreview-plan.test.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Tests for scripts/selfreview-plan.sh (build-time self-review plan, forge#3971). Run: bash scripts/selfreview-plan.test.sh
+# (bash 3.2 compatible)
+set -u
+DIR=$(cd "$(dirname "$0")" && pwd)
+ROOT=$(cd "$DIR/.." && pwd)
+SCRIPT="$DIR/selfreview-plan.sh"
+pass=0; fail=0
+ok() { pass=$((pass+1)); }
+bad() { fail=$((fail+1)); echo "FAIL: $1"; }
+WORK=$(mktemp -d "${TMPDIR:-/tmp}/selfreview-plan.XXXXXX")
+trap 'rm -rf "$WORK"' EXIT
+export FORGEDOCK_HOME="$ROOT"   # the resolver must not pick up an ambient install
+unset FORGE_SELFREVIEW
+
+PLAN=""; RC=0
+# run <files, newline separated> <flags...>
+run() {
+  printf '%s\n' "$1" > "$WORK/files"; shift
+  PLAN=$(bash "$SCRIPT" --files-file "$WORK/files" "$@" 2>/dev/null); RC=$?
+}
+field() { printf '%s\n' "$PLAN" | sed -n "s/^$1=//p"; }
+expect() { # name key want
+  local got; got=$(field "$2")
+  if [ "$got" = "$3" ]; then ok; else bad "$1: $2='$got', want '$3'"; fi
+}
+has_agent() { case " $(field SELECTED_AGENTS) " in *" $1 "*) return 0 ;; *) return 1 ;; esac; }
+
+# e1: docs-only and empty diffs skip with a recorded reason
+run "docs/GUIDE.md
+README.md" --changed-lines 40
+expect "docs-only skips" SELFREVIEW skip; expect "docs-only reason" SKIP_REASON docs-only
+run "" --changed-lines 0
+expect "empty diff skips" SELFREVIEW skip; expect "empty reason" SKIP_REASON empty-diff
+run "commands/work-on/build.md" --changed-lines 40 --changed-files 1
+expect "spec markdown is not docs" SELFREVIEW skip
+if [ "$(field SKIP_REASON)" = "docs-only" ]; then bad "commands/*.md treated as docs"; else ok; fi
+
+# e2: small tier, Security-only roster, no trigger: skipped; the same size with an auth path runs
+run "scripts/foo.sh" --changed-lines 30 --changed-files 1
+expect "small security-only skips" SELFREVIEW skip; expect "small reason" SKIP_REASON small-security-only; expect "small tier" TIER small
+run "src/auth/session.py
+src/util.py" --changed-lines 30 --changed-files 2
+expect "small + auth path runs" SELFREVIEW run; expect "small + auth tier" TIER small
+has_agent auth && ok || bad "auth path did not add auth"
+has_agent security && ok || bad "security floor missing"
+run "scripts/foo.sh
+scripts/bar.sh" --changed-lines 30 --changed-files 2 --contract-flags "HIGH_RISK"
+expect "small + HIGH_RISK runs" SELFREVIEW run; expect "HIGH_RISK lifts tier" TIER standard
+
+# standard tier runs
+run "scripts/foo.sh
+scripts/bar.sh" --changed-lines 400 --changed-files 2
+expect "standard runs" SELFREVIEW run; expect "standard tier" TIER standard; expect "standard no reason" SKIP_REASON ""
+has_agent security && ok || bad "standard roster lacks security"
+
+# EXTENDED depth lifts a small roster
+run "scripts/foo.sh" --changed-lines 20 --changed-files 1 --review-depth EXTENDED
+expect "extended depth runs" SELFREVIEW run; expect "extended tier" TIER standard
+
+# e3: off switch, no Agent tool, unresolvable roster degrade to skip and exit 0
+FORGE_SELFREVIEW=off run "scripts/a.sh
+scripts/b.sh" --changed-lines 400
+[ "$RC" = 0 ] && ok || bad "off exit code $RC"
+expect "off skips" SELFREVIEW skip; expect "off reason" SKIP_REASON disabled
+run "scripts/a.sh
+scripts/b.sh" --changed-lines 400 --agent-available false
+[ "$RC" = 0 ] && ok || bad "no-agent exit code $RC"
+expect "no agent skips" SELFREVIEW skip; expect "no agent reason" SKIP_REASON no-agent-tool
+FORGEDOCK_HOME=/nonexistent-forge-home run "scripts/a.sh
+scripts/b.sh" --changed-lines 400
+[ "$RC" = 0 ] && ok || bad "unresolvable exit code $RC"
+expect "unresolvable roster skips" SELFREVIEW skip; expect "unresolvable reason" SKIP_REASON roster-unavailable
+
+# e4: a tree that already has a completed self-review is not dispatched again
+run "scripts/a.sh
+scripts/b.sh" --changed-lines 400 --tree aaa --done-trees "bbb aaa"
+expect "same tree skips" SELFREVIEW skip; expect "same tree reason" SKIP_REASON already-done
+run "scripts/a.sh
+scripts/b.sh" --changed-lines 400 --tree ccc --done-trees "bbb aaa"
+expect "new tree runs" SELFREVIEW run
+
+# usage: unknown flag exits 2
+bash "$SCRIPT" --nope >/dev/null 2>&1; [ "$?" = 2 ] && ok || bad "unknown flag should exit 2"
+
+echo "selfreview-plan: ${pass} passed, ${fail} failed"
+[ "$fail" -eq 0 ]

package/scripts/spawn-depth-check.sh

@@ -1,13 +1,14 @@
 #!/usr/bin/env bash
-# spawn-depth-check.sh — will a /work-on dispatching phase (review, remediate) have the Agent tool?
+# spawn-depth-check.sh — will a /work-on dispatching phase (build self-review, review, remediate) have the Agent tool?
 # SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
 # SPDX-License-Identifier: AGPL-3.0-or-later
 #
 # Claude Code grants the Agent tool to sub-agents down to CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH layers
 # below the main conversation (default 3 since 2.1.219; 5 for 2.1.172-2.1.216; 1 for 2.1.217-2.1.218).
-# A sub-agent at layer L can spawn only when L < depth. The router invokes review/remediate at
+# A sub-agent at layer L can spawn only when L < depth. The router invokes build/review/remediate at
 # router layer + 1, so they can spawn reviewers only when router layer + 2 <= depth (forge#3398,
-# docs/WORK-ON-RUNTIME.md).
+# docs/WORK-ON-RUNTIME.md). build (B5.6 self-review, forge#3971) uses the same arithmetic but degrades to a recorded
+# skip on FAIL instead of stopping the run.
 #
 # Usage: spawn-depth-check.sh [--router-layer N]      (N = 0 solo, 1 under /orchestrate; default 0)
 # Env:   CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH  explicit limit (wins over the version default)
@@ -69,5 +70,5 @@ if [ "$DEPTH" -ge "$REQUIRED" ]; then
   echo "SPAWN_DEPTH: OK depth=${DEPTH} required=${REQUIRED} (${SOURCE})"
   exit 0
 fi
-echo "SPAWN_DEPTH: FAIL depth=${DEPTH} required=${REQUIRED} (${SOURCE}) — review/remediate would run without the Agent tool and could not spawn /review-pr reviewers. Set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH>=${REQUIRED}."
+echo "SPAWN_DEPTH: FAIL depth=${DEPTH} required=${REQUIRED} (${SOURCE}) — build/review/remediate would run without the Agent tool and could not spawn self-review or /review-pr reviewers. Set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH>=${REQUIRED}."
 exit 1

package/scripts/spawn-depth-check.test.sh

@@ -43,5 +43,8 @@ t "env depth 09 decimal"           0 "SPAWN_DEPTH: OK"      CLAUDE_CODE_MAX_SUBA
 # Usage errors.
 t "bad router layer"              2 "spawn-depth-check:"   -- --router-layer x
 t "unknown flag"                  2 "usage:"               -- --nope
+# forge#3971: build is a dispatching phase too, and the FAIL text names it (exit codes unchanged)
+out=$(env -u CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH -u FORGE_RUNTIME FORGE_CLAUDE_VERSION=2.1.217 bash "$S" 2>&1)
+case "$out" in *build/review/remediate*) PASS=$((PASS+1)) ;; *) FAILN=$((FAILN+1)); echo "FAIL: FAIL text does not name build ($out)" ;; esac
 echo "spawn-depth-check: ${PASS} passed, ${FAILN} failed"
 [ "$FAILN" -eq 0 ]

package/scripts/telemetry.test.sh

@@ -61,6 +61,14 @@ check "finding_disposition carries scope" "$(grep '^{' "$TD/posted" | jq -r '.sc
 reset; FORGE_PR=9 forge_emit review_panel mode=FULL; grep -q 'issues/9/comments' "$TD/calls" && ok || bad "review_panel targets PR"
 reset; FORGE_PR=9 forge_emit diff_size lines=1; grep -q 'issues/5/comments' "$TD/calls" && ok || bad "diff_size targets issue"
 
+# build_selfreview (forge#3971) is a build-side event: posted to the issue even when a PR number is set; ids and counts only
+reset; FORGE_PR=9 forge_emit build_selfreview tier=standard agents=3 findings=4 fixed=2 declined=1 skipped=
+grep -q 'issues/5/comments' "$TD/calls" && ok || bad "build_selfreview targets issue"
+REC=$(grep '^{' "$TD/posted")
+check "build_selfreview event" "$(printf '%s' "$REC" | jq -r '.event')" "build_selfreview"
+check "build_selfreview counts typed" "$(printf '%s' "$REC" | jq -r '.agents + .findings + .fixed + .declined')" "10"
+check "build_selfreview skip reason" "$(reset; forge_emit build_selfreview skipped=small-security-only tier=small; grep '^{' "$TD/posted" | jq -r '.skipped')" "small-security-only"
+
 # 2. Sanitising: reserved keys, bad keys, backticks and newlines never reach the record.
 reset
 forge_emit x repo=evil 'a b=1' ok='a`b