forgedock 1.20.0 → 1.22.0

package/bin/lean/render.mjs

@@ -0,0 +1,66 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/** Fixed comment templates for the core work-on. Pure functions, no model calls. Missing fields read "not reported". */
+
+export const NR = "not reported";
+
+/** Single-line, table-safe text: collapse newlines, escape pipes. */
+export const cell = (v) => {
+  const s = v == null ? "" : typeof v === "string" ? v : JSON.stringify(v);
+  const t = s.replace(/\r?\n+/g, " ").replace(/\|/g, "\\|").trim();
+  return t || NR;
+};
+/** Inline text: newlines collapsed (keeps list items and one-liners intact). */
+const line = (v) => cell(v).replace(/\\\|/g, "|");
+const arr = (v) => (Array.isArray(v) ? v : v == null || v === "" ? [] : [v]);
+const bullets = (v) => {
+  const items = arr(v).map((x) => line(typeof x === "object" && x ? Object.values(x).join(" - ") : x)).filter((x) => x !== NR);
+  return items.length ? items.map((x) => `- ${x}`).join("\n") : NR;
+};
+
+const norm = (r) => r ?? {};
+const objs = (v, keys) => arr(v).map((x) => (x && typeof x === "object" ? x : { [keys[0]]: x }));
+
+export function changesTable(r, gitFiles = []) {
+  let rows = objs(norm(r).changes, ["file"]);
+  if (!rows.length) rows = gitFiles.map((file) => ({ file }));
+  if (!rows.length) return NR;
+  return ["| file | change | why |", "| --- | --- | --- |", ...rows.map((x) => `| ${cell(x.file)} | ${cell(x.change)} | ${cell(x.why)} |`)].join("\n");
+}
+
+export function verification(r) {
+  const rows = objs(norm(r).tests, ["command"]);
+  if (!rows.length) return NR;
+  return rows.map((t) => `- \`${line(t.command).replace(/`/g, "'")}\`: ${line(t.result)}; fails without fix: ${t.fails_without_fix === true ? "yes" : t.fails_without_fix === false ? "no" : "unknown"}`).join("\n");
+}
+
+export function renderValidate(r, verdict) {
+  const x = norm(r);
+  return `## Validation: ${verdict}\n**Verdict:** ${verdict}\n\n**Evidence**\n${bullets(x.evidence)}\n\n**Root cause:** ${line(x.root_cause)}\n\n**Summary:** ${line(String(x.summary ?? "").split("\n")[0].slice(0, 300))}`;
+}
+
+export function renderPlan(r, gitFiles = []) {
+  const x = norm(r);
+  const files = objs(x.changes, ["file"]).map((c) => c.file).filter(Boolean);
+  const testPlan = objs(x.tests, ["command"]).map((t) => t.command).filter(Boolean);
+  return `## Plan\n**Approach:** ${line(x.approach)}\n\n**Files**\n${bullets(files.length ? files : gitFiles)}\n\n**Sibling sites checked**\n${bullets(Array.isArray(x.sibling_sites_checked) ? x.sibling_sites_checked.map((s) => (s && typeof s === "object" ? Object.values(s).join(": ") : s)) : x.sibling_sites_checked)}\n\n**Test plan**\n${bullets(testPlan)}`;
+}
+
+export function renderReview(rv) {
+  const yn = (b) => (b ? "yes" : "no");
+  return `## Review: ${rv.verdict}\n**Fixes the issue:** ${yn(rv.fixes_issue)}${rv.fixes_issue ? "" : ` - ${line(rv.reason)}`}\n**Regression:** ${yn(rv.regression)}${rv.regression ? ` - ${line(rv.reason)}` : ""}\n**Reason:** ${line(rv.reason)}\n**Checked:** ${line(rv.checked)}`;
+}
+
+export function renderSummary(r, gitFiles = []) {
+  return `**Root cause:** ${line(norm(r).root_cause)}\n\n**Changes**\n${changesTable(r, gitFiles)}\n\n**Verification**\n${verification(r)}`;
+}
+
+export function renderRegister({ result, gitFiles = [], review, links = {}, prUrl, usage, policy }) {
+  const x = norm(result);
+  const link = (k, v) => (v ? `- ${k}: ${v}\n` : "");
+  return `## Work-on: fixed\n**Summary:** ${line(x.summary)}\n\n${renderSummary(result, gitFiles)}\n\n**Risks:** ${line(Array.isArray(x.risks) ? x.risks.join("; ") : x.risks)}\n**Follow-ups:** ${line(Array.isArray(x.follow_ups) ? x.follow_ups.join("; ") : x.follow_ups)}\n\n**Review:** ${review.verdict} (fixes issue: ${review.fixes_issue ? "yes" : "no"}, regression: ${review.regression ? "yes" : "no"}) ${line(review.reason)}\n\n**Links**\n${link("Validation", links.validate)}${link("Plan", links.plan)}${link("Review", links.review)}- PR: ${prUrl}\n\n**Merge policy:** ${line(policy)}\n\n_${usage}_`;
+}
+
+export function renderPrBody({ issue, result, gitFiles = [] }) {
+  return `Closes #${issue}\n\n${renderSummary(result, gitFiles)}`;
+}

package/bin/runner.mjs

@@ -671,6 +671,23 @@ export function isClaudeCliAvailable(
 // gated on the cached `claude --version` probe, never on help-text scraping.
 const CLI_MIN_VERSION_MODEL_FLAG = [1, 0, 0];
 const CLI_MIN_VERSION_MAX_TURNS_FLAG = [1, 0, 0];
+// forge#4065: minimal phase sessions. Conservative floor: the oldest version
+// known to accept `--strict-mcp-config`, `--mcp-config` and
+// `--disable-slash-commands` together. Unparseable/older => flags omitted.
+const CLI_MIN_VERSION_MINIMAL_SESSION = [2, 1, 296];
+
+// Phase commands whose spec never invokes `Skill(...)`; only these run with
+// `--disable-slash-commands` (spec-coverage test enforces the invariant).
+export const SKILL_FREE_PHASE_COMMANDS = Object.freeze(["work-on/investigate", "work-on/close"]);
+
+// Engine phase commands (mirrors PHASES in bin/engine/phases.mjs; a test enforces it). Only these
+// get the minimal-session group: other `forgedock run` commands (qa-sweep, analytics, geo-audit,
+// autopilot) may need the operator's MCP servers and skills.
+export const ENGINE_PHASE_COMMANDS = Object.freeze([
+  "work-on/investigate", "work-on/decompose", "work-on/build", "work-on/review", "work-on/remediate", "work-on/close",
+]);
+
+const MINIMAL_SESSION_MCP_CONFIG = '{"mcpServers":{}}';
 
 /**
  * Extract a `major.minor.patch` version from probe output (the text after the
@@ -702,7 +719,7 @@ function versionAtLeast(version, min) {
  *
  * @param {string} [cwd]
  * @param {object} [opts] - Forwarded to `isClaudeCliAvailable()` (test seams).
- * @returns {{model: boolean, maxTurns: boolean}}
+ * @returns {{model: boolean, maxTurns: boolean, strictMcp: boolean, disableSlash: boolean}}
  */
 export function getClaudeCliCapabilities(cwd = process.cwd(), opts = {}) {
   isClaudeCliAvailable(cwd, opts);
@@ -710,9 +727,53 @@ export function getClaudeCliCapabilities(cwd = process.cwd(), opts = {}) {
   return {
     model: versionAtLeast(version, CLI_MIN_VERSION_MODEL_FLAG),
     maxTurns: versionAtLeast(version, CLI_MIN_VERSION_MAX_TURNS_FLAG),
+    strictMcp: versionAtLeast(version, CLI_MIN_VERSION_MINIMAL_SESSION),
+    disableSlash: versionAtLeast(version, CLI_MIN_VERSION_MINIMAL_SESSION),
   };
 }
 
+/**
+ * Build the minimal-session argv group (forge#4065): no operator MCP servers
+ * and, for Skill-free phases only, no slash-command/skill listing. Operator
+ * settings are deliberately NOT skipped (the CLI setting-sources flag is not passed) so
+ * ForgeDock's user-scope PreToolUse/SubagentStop hooks keep running.
+ * Non-engine commands, `FORGEDOCK_FULL_SESSION=1` (exactly) or an unsupported CLI yield `[]`.
+ *
+ * @param {string} commandName
+ * @param {{strictMcp: boolean, disableSlash: boolean}} caps
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string[]}
+ */
+export function buildMinimalSessionFlags(commandName, caps, env = process.env) {
+  if (env?.FORGEDOCK_FULL_SESSION === "1" || !caps) return [];
+  const name = String(commandName ?? "").trim().replace(/^\/+/, "").replace(/\.md$/i, "");
+  if (!ENGINE_PHASE_COMMANDS.includes(name)) return [];
+  const flags = [];
+  if (caps.strictMcp) flags.push("--strict-mcp-config", "--mcp-config", MINIMAL_SESSION_MCP_CONFIG);
+  if (caps.disableSlash && SKILL_FREE_PHASE_COMMANDS.includes(name)) flags.push("--disable-slash-commands");
+  return flags;
+}
+
+/**
+ * Lean-path (#4081) minimal session flags: reuses the #4065 capability probe. Every phase is Skill-free, so slash
+ * commands are off too; user-scope settings and hooks still load. Unsupported CLI or FORGEDOCK_FULL_SESSION=1 yields [].
+ */
+export function buildLeanSessionFlags(caps, env = process.env) {
+  // Same group as the Skill-free engine phases (no MCP, no slash commands). Operator settings stay loaded so the
+  // user-scope safety hooks keep running, exactly like #4077.
+  return buildMinimalSessionFlags("work-on/investigate", caps, env);
+}
+
+/**
+ * Read-only reviewer tools (#4081): only Read, Grep and Glob. Uses `--tools` where the capability probe says the
+ * CLI is recent enough, else denies the mutating tools with `--disallowedTools`.
+ */
+export function buildReadOnlyToolFlags(caps) {
+  return caps?.strictMcp
+    ? ["--tools", "Read,Grep,Glob"]
+    : ["--disallowedTools", "Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"];
+}
+
 /**
  * Return the exact absolute `claude` executable path that
  * `isClaudeCliAvailable()` validated for `cwd` (issue #2741), ensuring the
@@ -1443,6 +1504,9 @@ export function runCliBackend({
   model = null,
   maxTurns = null,
   leaseHolder = null,
+  sessionFlags = [],
+  // #4081: extra argv (e.g. ["--resume", id]) appended verbatim, never dropped by FORGEDOCK_FULL_SESSION.
+  extraArgs = [],
 }) {
   // forge#3589: opt-in flags, validated again here as defence in depth. Callers
   // (runCommand) are responsible for the version gate. Unset -> argv unchanged.
@@ -1451,6 +1515,12 @@ export function runCliBackend({
   const optionalFlags = [
     ...(modelFlag ? ["--model", modelFlag] : []),
     ...(maxTurnsFlag ? ["--max-turns", String(maxTurnsFlag)] : []),
+    // forge#4065: minimal-session group, built by buildMinimalSessionFlags().
+    // Re-checked here so FORGEDOCK_FULL_SESSION=1 always wins.
+    ...(process.env.FORGEDOCK_FULL_SESSION === "1" || !Array.isArray(sessionFlags)
+      ? []
+      : sessionFlags.map(String)),
+    ...(Array.isArray(extraArgs) ? extraArgs.map(String) : []),
   ];
   const rawTimeout = parseInt(process.env.FORGEDOCK_CLI_TIMEOUT_MS, 10);
   const configuredTimeout = resolveConfiguredCliTimeout(cwd);
@@ -1738,6 +1808,7 @@ export function runCliBackend({
     // bin/batch-runner.mjs's `tokenCost()` (`input + output`).
     const stdoutTrimmed = stdout.trim();
     let parsedResult = null;
+    let sessionId = null;
     let usage = null;
     let turns = null;
     // forge#3696: envelope cost/duration per attempt (null when absent or non-finite).
@@ -1750,6 +1821,7 @@ export function runCliBackend({
         if (Number.isFinite(parsed.total_cost_usd)) costUsd = parsed.total_cost_usd;
         if (Number.isFinite(parsed.duration_ms)) durationMs = parsed.duration_ms;
         parsedResult = typeof parsed.result === "string" ? parsed.result : null;
+        if (typeof parsed.session_id === "string" && parsed.session_id) sessionId = parsed.session_id;
         if (parsed.usage && typeof parsed.usage === "object") {
           usage = {
             input_tokens: toFiniteUsageNumber(parsed.usage.input_tokens),
@@ -1835,6 +1907,7 @@ export function runCliBackend({
       turns,
       costUsd,
       durationMs,
+      sessionId,
       backend: "cli",
       // forge#3521: the phase's final reply (the CLI envelope's `.result`), so
       // callers can read its structured `*_RESULT` block. Additive; "" when absent.
@@ -2715,10 +2788,13 @@ export async function runCommand(opts = {}) {
       : null;
     let cliModel = commandSettings.model ?? runLevelModel;
     let cliMaxTurns = commandSettings.maxTurns;
-    if (resolvedBin && (cliModel || cliMaxTurns)) {
+    // forge#4065: minimal phase session flags, computed per call (never cached).
+    let sessionFlags = [];
+    if (resolvedBin) {
       const caps = getClaudeCliCapabilities(cwd);
       if (cliModel && !caps.model) cliModel = null;
       if (cliMaxTurns && !caps.maxTurns) cliMaxTurns = null;
+      sessionFlags = buildMinimalSessionFlags(commandName, caps);
     }
     if (!resolvedBin && backend === "auto") {
       resolvedBackend = "api";
@@ -2741,6 +2817,7 @@ export async function runCommand(opts = {}) {
           model: cliModel,
           maxTurns: cliMaxTurns,
           leaseHolder,
+          sessionFlags,
         },
       });
     }

package/commands/work-on/build/validate.md

@@ -842,11 +842,18 @@ DEGRADED_CHECKS="${DEGRADED_CHECKS:-}"
 GATE_STATUS=$([ "$GATE_PASSED" != "true" ] && echo FAIL || { [ -n "$DEGRADED_CHECKS" ] && echo DEGRADED || echo PASS; })
 # Bind the PASS to what was actually gated: the staged tree is exactly the tree the V5 commit will have.
 # scripts/verify-phase-trail.sh --head-tree (work-on/review.md R1.5) rejects a PASS recorded for a different tree. <!-- Added: forge#3149 -->
-git -C {WORKTREE_PATH} add -u   # same staging as the commit below; valid only because V2-V4 are done
-GATE_TREE=$(git -C {WORKTREE_PATH} write-tree)
-# Marker-only re-gate (invoked by work-on/review.md after a base sync or a stale re-review): HEAD is already committed and
-# the index is clean, so the gated tree is HEAD's tree. Use it instead of write-tree, and post the marker only (no V5 Step 2 commit).
-[ "${REGATE_MERGED_HEAD:-}" = "1" ] && GATE_TREE=$(git -C {WORKTREE_PATH} rev-parse 'HEAD^{tree}')
+if [ "${REGATE_MERGED_HEAD:-}" = "1" ]; then
+  # Marker-only re-gate (invoked by work-on/review.md after a base sync or a stale re-review): HEAD is already committed, so the
+  # gated tree must be HEAD's tree. Never stage here: require a clean worktree so no uncommitted fix sits outside the marked tree.
+  if [ -n "$(git -C {WORKTREE_PATH} status --porcelain --untracked-files=no)" ]; then
+    echo "QUALITY_GATE: marker-only re-gate needs a clean worktree (uncommitted tracked changes) - commit the fix, re-run the scoped V1 gate on the committed head, then re-run this step; not posting a marker" >&2
+    exit 1
+  fi
+  GATE_TREE=$(git -C {WORKTREE_PATH} rev-parse 'HEAD^{tree}')
+else
+  git -C {WORKTREE_PATH} add -u   # same staging as the commit below; valid only because V2-V4 are done
+  GATE_TREE=$(git -C {WORKTREE_PATH} write-tree)
+fi
 [ -n "$GATE_TREE" ] || { echo "QUALITY_GATE: tree unresolved - not posting a marker" >&2; exit 1; }
 QG_BODY="<!-- FORGE:QUALITY_GATE -->
 ## Quality Gate Result
@@ -860,7 +867,7 @@ QG_BODY="<!-- FORGE:QUALITY_GATE -->
 gh issue comment {NUMBER} {GH_FLAG} --body "$QG_BODY" # allowlist:check-command-side-effects
 ```
 
-**Marker-only re-gate mode** <!-- Added: forge#3983 -->: when `work-on/review.md` re-gates a merged head (Pre-Handoff Base Sync or stale re-review), it runs the scoped V1 gate on the committed head first, then sets `REGATE_MERGED_HEAD=1` and runs only this Step 1 with the real `GATE_RESULT` (FAIL stays FAIL). Steps 2-4 are skipped: there is nothing staged and no commit to make.
+**Marker-only re-gate mode** <!-- Added: forge#3983 -->: when `work-on/review.md` re-gates a merged head (Pre-Handoff Base Sync or stale re-review), it runs the scoped V1 gate on the committed head first, then sets `REGATE_MERGED_HEAD=1` and runs only this Step 1 with the real `GATE_RESULT` (FAIL stays FAIL). Steps 2-4 are skipped: there is nothing staged and no commit to make. **Precondition**: a clean worktree (no uncommitted tracked changes, untracked files ignored); a dirty tracked file or staged change exits 1 with no marker, so a fix made after a FAIL must be committed and the scoped V1 gate re-run on the committed head before this step is re-run, keeping the gated tree equal to the marked `HEAD^{tree}`.
 
 ### V5 Step 2: Commit
 

package/commands/work-on/review.md

@@ -205,7 +205,7 @@ On conflict, resolve every file, keep both sides' intent, `git add`, `git commit
 **Re-gate the merged head** <!-- Added: forge#3983 -->: the `FORGE:QUALITY_GATE` PASS is bound to `HEAD^{tree}` (R1.5 `--head-tree`), so a merge that changes the tree invalidates it. After the merge and any conflict resolution, compare `PRE_SYNC_TREE` with the current `HEAD^{tree}` (fail closed if either cannot be resolved):
 
 - Unchanged: do nothing; never re-gate.
-- Changed: run the scoped quality gate on the merged head here (`work-on/build/validate` V1 loop over the PR's changed files), then post the marker via validate.md V5 Step 1 "Marker-only re-gate mode" (`**Tree**` = merged `HEAD^{tree}`, `**Commands run**` = what ran). Post the real result: on FAIL, fix and re-run within the validate bounds, else add `needs-human` and return `REVIEW_RESULT: status: BLOCKED`, blocker "post-sync quality gate failed"; never post PASS without a run.
+- Changed: run the scoped quality gate on the merged head here (`work-on/build/validate` V1 loop over the PR's changed files), then post the marker via validate.md V5 Step 1 "Marker-only re-gate mode" (`**Tree**` = merged `HEAD^{tree}`, `**Commands run**` = what ran). Post the real result: on FAIL, fix, commit the fix (marker-only mode requires a clean worktree so the re-gated tree is the committed `HEAD^{tree}`), and re-run within the validate bounds, else add `needs-human` and return `REVIEW_RESULT: status: BLOCKED`, blocker "post-sync quality gate failed"; never post PASS without a run.
 
 ## Phase R1: Pre-Push Ancestry Guard
 

package/docs/CONFIG.md

@@ -481,6 +481,8 @@ engine:
 | `<key>_model` | string | No | Model alias (`sonnet`, `opus`, `haiku`) or full model id passed as `--model`. Invalid values are ignored. |
 | `<key>_max_turns` | integer | No | Positive integer passed as `--max-turns`. Invalid values are ignored. |
 
+| `path` | string | No | `core` (default), `full`, `lean` or `auto`. `core` is the lean work-on (`bin/lean/`): one plain builder session, one read-only two-question reviewer, GitHub as the register (see RELEASE-NOTES v1.22). `lean` and `auto` are aliases of `core`; `full` runs the legacy multi-phase pipeline and is required for `--retry` and `--wait-lease`. The `--path` flag overrides. `lean_reviewer_model` sets the reviewer model (default `claude-sonnet-5-5`); the builder uses `--model` or the CLI default. `forgedock orchestrate <issues...> [--parallel K] [--lane L]` runs the core per issue (K default 3, lane default `staging`) and honours `**Depends on**` ordering among the given issues. |
+| `merge_wait` | string | No | Core work-on merge gate. `required` (default): wait only for the status checks the base branch requires under branch protection (`gh api repos/{o}/{r}/branches/{base}/protection/required_status_checks`, contexts and checks); with no protection or no required checks (404 or empty) merge right after review PASS. A failing required check is `needs-human`; a pending one is polled with backoff and never `needs-human`. `all`: wait for every check (`scripts/wait-ci-green.sh`). `none`: merge right after review. Always `--match-head-commit` at the reviewed head. The policy used is recorded in the `FORGE:WORK-ON` comment. |
 | `ci_pending_max_minutes` | integer | No | Minutes the engine waits for CI when the review phase ends BLOCKED with "checks still pending", or the remediate phase holds at its M7 re-gate on "CI pending" (the merge gate's wait window ended while CI was still running). Default: 90. Invalid values are ignored. This key is flat like the others but is not part of the `<key>_model` / `<key>_max_turns` pattern. |
 
 **CI still pending**: the engine polls `scripts/wait-ci-green.sh` (no model calls) one read per poll on a 60 s, 2 min, 4 min, 5 min (cap) backoff with +/-20% jitter, while the lease keeps renewing, then re-dispatches the phase that was waiting, review or remediate (idempotent at an unchanged head: review re-runs the merge gate and merges; remediate resumes at its M7 re-gate). Before each poll it reads `gh api rate_limit` (not itself rate-limited) and, below 10% of the REST budget, sleeps until the window resets instead of polling; a rate-limited or transient (5xx, network) poll is retried and never re-dispatches the phase. Red CI takes the normal ci-gate path. When the budget is exhausted the run ends `needs-human` with outcome code `review.ci_pending_timeout`; `--retry` resumes. Each wait emits a `ci_pending_wait` telemetry event (`docs/TELEMETRY.md`) with the minutes waited, polls made and rate-limit sleeps.
@@ -493,6 +495,8 @@ engine:
 
 **Per-run scratch dir** (`tmp_root`): every engine child runs with `TMPDIR` and `CLAUDE_CODE_TMPDIR` set to `<tmp_root>/<repo-key>/<issue>` so venvs and Claude session data stay off a size-limited `/tmp`. `engine.tmp_root` is an absolute or `~`-prefixed path; default `~/.forge/tmp`. The `<repo-key>` is the checkout's directory name plus 8 hex characters of a hash of its real path, so the same issue number in two repos never shares a dir; the dir is created `0700` and an existing symlink or dir owned by another user is not used (the child keeps the inherited tmp). Old `<tmp_root>/<issue>` dirs from earlier versions are not migrated. When `tmp_root` is unset and the operator already exported `TMPDIR` or `CLAUDE_CODE_TMPDIR`, that choice is respected and never cleaned. The dir is removed on a terminal outcome and kept on `engine-error` so `--retry` resumes. A disk-full/quota failure (EDQUOT, ENOSPC, errno -28/-122) ends a retryable `engine-error` (outcome code `infra.disk_quota`), never `needs-human`.
 
+**Minimal phase sessions** (forge#4065): on a supported CLI (`claude --version` >= 2.1.296, probed once and cached like the flags above) every engine phase (`work-on/*`) runs with `--strict-mcp-config --mcp-config '{"mcpServers":{}}'`, so operator MCP servers and connectors are not loaded. Phases whose spec never calls `Skill(...)` (`work-on/investigate`, `work-on/close`) also get `--disable-slash-commands`; skill-using phases keep skills. Operator settings are intentionally not skipped (no `--setting-sources`), because ForgeDock's user-scope PreToolUse/SubagentStop hooks must keep running. Set `FORGEDOCK_FULL_SESSION=1` to restore the previous full session (no flags). Other `forgedock run` commands (qa-sweep, analytics, geo-audit, autopilot) keep the full session because they may need MCP servers. An old or unparseable CLI version also omits the flags.
+
 **Commands that use this section**: CLI backend (`runCommand` in `bin/runner.mjs`)
 
 ---

package/docs/RELEASE-NOTES.md

@@ -2,6 +2,21 @@
 
 Operator-facing notes for behavior changes that need action or awareness. Newest first.
 
+## v1.22: core work-on and orchestrate (GitHub as register)
+
+A blind A/B showed plain Claude Code fixes issues at equal quality for about 1/10 the cost of the multi-phase pipeline, so ForgeDock is reduced to a lean core.
+
+- **`forgedock run-issue N --lane L` now runs the core work-on by default.** One plain builder session (default model, a short developer prompt) does the work and writes `.forge-lean/result.json` (`status` fixed|already-fixed|invalid|blocked, `summary`, `evidence`, `tests`). One read-only Sonnet reviewer (Read/Grep/Glob, diff and issue in the prompt) answers two questions: does the change fix the issue, and does it introduce a regression. It fails the change only when the issue is not fixed or a regression has a concrete `file:line` failure. A FAIL resumes the builder session (`--resume`) with the reason for one re-review; a second FAIL is `needs-human`. Then push, PR (`Closes #N`), ONE register comment on the issue (`<!-- FORGE:WORK-ON -->`: summary, files, tests, review verdict, PR link, cost, tokens, wall time), CI wait (`scripts/wait-ci-green.sh`, backoff, slow CI is never `needs-human`), merge with `--match-head-commit` at the reviewed head, `workflow:merged`, close. Invalid or already-fixed with file:line evidence closes as `workflow:invalid`; without evidence it is `needs-human`.
+- **Validation comment:** right after the builder ends, a `<!-- FORGE:VALIDATE -->` comment (verdict, file:line evidence, one-line summary; no extra model call) is posted before review and before `workflow:in-review`; for invalid or already-fixed it is the evidence comment. The register comment links it.
+- **Rich comments, no extra model calls:** the builder writes structured `result.json` fields (root cause, approach, sibling sites, changes, tests with fails-without-fix, risks, follow-ups) and the engine renders fixed templates: `FORGE:VALIDATE`, `FORGE:PLAN` (both before review), `FORGE:REVIEW`, then `FORGE:WORK-ON` (root cause, changes table, verification, risks, review, links, merge policy, cost). The PR body reuses the summary. Missing fields read "not reported".
+- **`engine.merge_wait`** (`required` default, `all`, `none`): by default the core waits only for the base branch's required checks (none required means merge right after review). See docs/CONFIG.md.
+- **Unchanged:** the workflow labels, the issue lease, the Depends-on open-dependency refusal, rerun/resume from an open PR or remote branch, `phase_attempt` (builder as `implement`, reviewer as `review`) and `run_terminal` telemetry, the run log, and `forgedock stats`.
+- **Removed from the default path:** investigation, architect and validate phases, severity taxonomies, the security second reviewer, risk tiers, ci-local and test-required gates, and round counters beyond the single review retry.
+- **`forgedock orchestrate <issues...> [--parallel K] [--lane L]`** runs the core work-on per issue with K concurrency (default 3, lane default `staging`), in-process. An issue waits for any `**Depends on**: #X` among the given issues to merge, and is skipped if that dependency ends anything but merged/invalid (for example `needs-human`). It prints a summary table (issue, outcome, PR, cost, minutes). No investigation, synthesis or agent spawning.
+- **`--path full`** keeps the legacy multi-phase pipeline, untouched (and is required for `--retry` and `--wait-lease`). `--path lean` and `--path auto` are aliases of the core. `engine.path` in forge.yaml sets the default (see docs/CONFIG.md).
+
+Action: none for the default flow. Pin `engine.path: full` in forge.yaml to keep the old pipeline as the default.
+
 ## v1.19.1: build-time self-review, ci-local under concurrency, review roster gates
 
 - **Build-time self-review (B5.6, #3971).** After implement, the risk-tier review roster's domain agents review the staged diff, and the builder fixes CONFIRMED/LIKELY findings at MEDIUM or above in one repair round before validate. Small or docs-only diffs skip. Each build that runs it spends extra reviewer tokens, which the official review should save back through fewer findings and remediation rounds. Off switch: `FORGE_SELFREVIEW=off`. Wait budget: `SELFREVIEW_WAIT_SECS` (default 600, max 1800). Telemetry: `build_selfreview`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgedock",
-  "version": "1.20.0",
+  "version": "1.22.0",
   "description": "Autonomous development pipeline for coding agents. GitHub as institutional memory, with native Claude Code and OpenCode entrypoints.",
   "bin": {
     "forgedock": "bin/forgedock.mjs"
@@ -48,7 +48,7 @@
     "README.md"
   ],
   "scripts": {
-    "test": "bash scripts/with-run-tmpdir.sh node --test \"bin/tests/**/*.test.mjs\" \"bin/engine/**/*.test.mjs\" \"bin/stats/**/*.test.mjs\" \"packages/protocol/test/**/*.test.mjs\"",
+    "test": "bash scripts/with-run-tmpdir.sh node --test \"bin/tests/**/*.test.mjs\" \"bin/engine/**/*.test.mjs\" \"bin/stats/**/*.test.mjs\" \"bin/lean/**/*.test.mjs\" \"packages/protocol/test/**/*.test.mjs\"",
     "test:sh": "bash scripts/run-shell-tests.sh",
     "docs:dev": "vitepress dev docs/site",
     "docs:build": "vitepress build docs/site",

package/scripts/ci-local.test.sh

@@ -510,8 +510,8 @@ if [ -z "$P" ]; then bad "plan on ForgeDock's own workflows produced no output";
   eq "ForgeDock: a spec change selects the ci unit-tests job" runnable "$(state "$P" gha:ci:unit-tests)"
   eq "ForgeDock: a spec change selects the ci shell-tests job" runnable "$(state "$P" gha:ci:shell-tests)"
   eq "ForgeDock: a spec change selects the shellcheck job" runnable "$(state "$P" gha:shell-compat:shellcheck)"
-  eq "ForgeDock: the Windows job is deferred" deferred "$(state "$P" gha:shell-compat:windows-fixture-smoke)"
-  eq "ForgeDock: the macOS portability job is deferred" deferred "$(state "$P" gha:shell-compat:macos-portability)"
+  eq "ForgeDock: the Windows job is not run on PRs" not-applicable "$(state "$P" gha:shell-compat:windows-fixture-smoke)"
+  eq "ForgeDock: the macOS portability job is not run on PRs" not-applicable "$(state "$P" gha:shell-compat:macos-portability)"
   eq "ForgeDock: portability checks run" runnable "$(state "$P" portability:builtin)"
   eq "ForgeDock: the unit-test step is narrowed by the reference graph" scoped "$(printf '%s' "$P" | jq -r '[.jobs[] | select(.id == "gha:ci:unit-tests") | .steps[] | select(.scope.selector == "refgraph-nodetest") | .scope.mode][0]')"
 fi

package/scripts/review-roster.sh

@@ -183,7 +183,20 @@ if [ "$CHURN" = "true" ] || [ "$DANGER" = "true" ]; then
     for d in $(top_domains 1); do add_agent "$d"; trig churn-or-danger-zone; done
 fi
 hit() { printf '%s\n' "$FILES" | grep -qiE "$1"; }
-hit '(^|[/_.-])(auth([^o]|o[^r]|$)|authori[sz]|oauth|session|jwt|login|logout|passw(or)?d|permission|rbac|acl([/_.-]|$)|tokens?([/_.-]|$)|api[-_]?keys?|credential|trust[-_]?filter|trusted[-_a-z]*)|(^|/)deps\.py$' && { add_agent Auth; trig auth-path; }
+# Auth path gate (forge#4071). Docs and prose are never auth by path (the content gate still applies). Strong names match
+# any path segment; weak names (session, login, permission, token) only as a whole word in a code file outside design-system
+# and asset dirs, so design-tokens/, SessionTimeline.tsx, LoginButton.tsx and cursor-token files do not spawn Auth. A CamelCase
+# weak name, leading or after a CamelCase prefix (LoginController.java, RefreshTokenService.java), still counts outside UI
+# component files and dirs.
+AUTH_FILES=$(printf '%s\n' "$FILES" | grep -viE '(^|/)docs?/|\.(md|mdx|markdown|rst|adoc|txt)$' || true)
+AUTH_CODE=$(printf '%s\n' "$AUTH_FILES" | grep -iE '\.(py|pyi|ts|tsx|js|jsx|mjs|cjs|go|rb|java|kt|kts|scala|rs|php|cs|ex|exs|swift|c|cc|cpp|h|hpp|sh|bash|lua|dart|groovy|pl|vue|svelte)$' \
+    | grep -viE '(^|/)(design[-_]?(system|tokens?)|assets?|static|images?|icons?|fonts?|styles?|themes?)/' || true)
+if printf '%s\n' "$AUTH_FILES" | grep -qiE '(^|[/_.-])(auth([^o]|o[^r]|$)|authori[sz]|oauth|jwt|passw(or)?d|rbac|acl([/_.-]|$)|api[-_]?keys?|credential|trust[-_]?filter|trusted[-_a-z]*)|(^|/)deps\.py$' \
+    || printf '%s\n' "$AUTH_CODE" | grep -qiE '(^|[/_])(sessions?|login|logout|permissions?|tokens?)([/_.-]|$)' \
+    || printf '%s\n' "$AUTH_CODE" | grep -viE '\.(tsx|jsx|vue|svelte)$|(^|/)(components?|pages|views|ui|widgets)/' \
+        | grep -qE '((^|[/_])([Ss]essions?|[Ll]ogin|[Ll]ogout|[Pp]ermissions?|[Tt]okens?)|[a-z0-9](Sessions?|Login|Logout|Permissions?|Tokens?))([A-Z]|[/_.-]|$)'; then
+    add_agent Auth; trig auth-path
+fi
 hit '^\.github/|(^|/)Dockerfile|docker-compose|(^|/)(docker-)?compose[^/]*\.ya?ml$|(^|/)deploy[^/]*\.sh$|(^|/)docker-entrypoint[^/]*$|(^|/)(deploy|infra|traefik|nginx|k8s|helm|terraform)/|\.tf$' && { add_agent Infra; trig infra-path; }
 hit 'migration|\.sql$' && { add_agent Database; trig migration-path; }
 hit '^sdk/|openapi.*\.json$|openapi-versions/' && { add_agent API; trig sdk-path; }

package/scripts/review-roster.test.sh

@@ -130,6 +130,19 @@ run "docs/author.md" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_not "no auth path docs/author.md" auth
 run "svc/tokenizer.py" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_not "no-auth-path-svc/tokenizer.py" auth
+# forge#4071: weak names (session, token, permission, login) select Auth only as whole words in code files; docs never
+for f in design-tokens/colors.json src/SessionTimeline.tsx docs/permissions.md src/components/LoginButton.tsx src/editor/cursor-token.ts docs/auth.md \
+    src/components/LoginForm.ts svc/tokenizer.py src/JsonTokenizer.java src/components/UserSessionBadge.ts; do
+  run "$f" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+  expect_not "no-auth-path-$f" auth
+done
+for f in src/auth/session.py api/tokens.py middleware/permissions.ts lib/jwt.go src/session/store.ts svc/login_handler.go \
+    src/main/java/com/x/LoginController.java src/main/java/com/x/SessionManager.java src/TokenService.kt src/PermissionChecker.cs middleware/PermissionGuard.ts \
+    src/main/java/com/x/RefreshTokenService.java src/AccessTokenValidator.kt src/main/java/com/x/UserSessionManager.java \
+    src/CsrfTokenFilter.java src/AdminPermissionChecker.cs src/OtpLoginHandler.ts src/main/java/com/x/RefreshToken.java; do
+  run "$f" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+  expect_has "auth-path-$f" auth
+done
 run "commands/review-pr.md" --scores "AUTH=3 INFRA=0 DATABASE=0 BILLING=0 CONCURRENCY=0" --changed-lines 20 --changed-files 1
 expect_not "auth-from-prose-score-alone" auth
 run "commands/review-pr.md" --scores "AUTH=3 INFRA=3 DATABASE=0 BILLING=0 CONCURRENCY=0" --changed-lines 120