forgedock 1.29.1 → 1.31.0

package/scripts/ci-local/scoping.mjs

@@ -589,6 +589,8 @@ function scopeTsc(rest, cmd, cwdRel, sctx, join) {
   return scoped(join([rest[0], '-b', ...owners.map((d) => fromCwd(cwdRel, d)), ...flags.filter((f) => f !== '--noEmit')]), owners.length, null, 'tsc-project', { projects: owners });
 }
 
+const isLintTask = (t) => t === 'lint' || t.startsWith('lint:') || t.endsWith(':lint');
+
 function scopeMono(tool, rest, cmd, sctx, join) {
   if (sctx.widen) return full(cmd, sctx.widen, { selector: `${tool}-affected` });
   const base = sctx.from || sctx.baseRef;
@@ -597,7 +599,14 @@ function scopeMono(tool, rest, cmd, sctx, join) {
     if (rest[1] === 'run-many' && !out.some((t) => t === '-t' || t.startsWith('--target'))) return full(cmd, '', { selector: 'unscoped:nx-no-target' });
     return scoped(join([...out, `--base=${base}`]), null, null, 'nx-affected');
   }
-  if (tool === 'turbo' && rest[1] === 'run') { if (rest.some((t) => t.startsWith('--filter'))) return full(cmd, '', { selector: 'unscoped:explicit-filter' }); return scoped(join([...rest, `--filter=...[${base}]`]), null, null, 'turbo-affected'); }
+  if (tool === 'turbo' && rest[1] === 'run') {
+    if (rest.some((t) => t.startsWith('--filter'))) return full(cmd, '', { selector: 'unscoped:explicit-filter' });
+    // #4381: lint is per-file, so a lint-only run covers the changed packages, not their dependents (`...[base]`).
+    const end = rest.findIndex((t, i) => i > 1 && t.startsWith('-'));
+    const tasks = rest.slice(2, end < 0 ? rest.length : end);
+    if (tasks.length && tasks.every(isLintTask)) return scoped(join([...rest, `--filter=[${base}]`]), null, null, 'turbo-changed');
+    return scoped(join([...rest, `--filter=...[${base}]`]), null, null, 'turbo-affected');
+  }
   return null;
 }
 

package/scripts/ci-local.test.sh

@@ -23,6 +23,8 @@ export FORGE_TELEMETRY=off
 export FORGE_CI_LOCAL_HOME="$T/home"
 export FORGE_CI_LOCAL_SLOTS=4
 unset FORGE_CI_LOCAL_SERVICES FORGE_CI_LOCAL_NO_YQ FORGE_CI_LOCAL_BUDGET_SECONDS FORGE_CI_LOCAL_JOB_TIMEOUT FORGE_CI_LOCAL_NO_CACHE
+# A lane's FORGE_HOST_PARALLELISM cap (#4182) would serialise the parallelism fixtures below; capParallel has its own test.
+unset FORGE_HOST_PARALLELISM
 HOST=$(uname -s)
 
 pass=0; fail=0

package/scripts/fixtures/apishape/other/go-change/base/x.go

@@ -0,0 +1,3 @@
+package x
+
+func Add(a, b int) int { return a + b }

package/scripts/fixtures/apishape/other/go-change/head/x.go

@@ -0,0 +1,3 @@
+package x
+
+func Add(a, b, c int) int { return a + b + c }

package/scripts/fixtures/apishape/python/generator-function/base/seq.py

@@ -0,0 +1,3 @@
+def pairs(items):
+    for i in range(0, len(items), 2):
+        yield items[i:i + 2]

package/scripts/fixtures/apishape/python/generator-function/head/seq.py

@@ -0,0 +1,2 @@
+def pairs(items):
+    return [items[i:i + 2] for i in range(0, len(items), 2)]

package/scripts/fixtures/apishape/python/ichunked/base/more.py

@@ -0,0 +1,17 @@
+from itertools import islice
+
+__all__ = ["ichunked"]
+
+
+def _take(iterator, n):
+    return list(islice(iterator, n))
+
+
+def ichunked(iterable, n):
+    """Yield successive chunks of length n from iterable."""
+    iterator = iter(iterable)
+    while True:
+        chunk = _take(iterator, n)
+        if not chunk:
+            return
+        yield iter(chunk)

package/scripts/fixtures/apishape/python/ichunked/head/more.py

@@ -0,0 +1,20 @@
+from itertools import islice
+
+__all__ = ["ichunked"]
+
+
+def _take(iterator, n):
+    return list(islice(iterator, n))
+
+
+def _chunks(iterator, n):
+    while True:
+        chunk = _take(iterator, n)
+        if not chunk:
+            return
+        yield iter(chunk)
+
+
+def ichunked(iterable, n):
+    """Return an iterator over successive chunks of length n from iterable."""
+    return _chunks(iter(iterable), n)

package/scripts/fixtures/apishape/python/private-edit/base/calc.py

@@ -0,0 +1,6 @@
+def _scale(value):
+    return value * 2
+
+
+def total(values):
+    return sum(_scale(v) for v in values)

package/scripts/fixtures/apishape/python/private-edit/head/calc.py

@@ -0,0 +1,9 @@
+def _scale(value, factor=2):
+    return value * factor
+
+
+def total(values):
+    result = 0
+    for v in values:
+        result += _scale(v)
+    return result

package/scripts/fixtures/apishape/python/removed/base/ops.py

@@ -0,0 +1,6 @@
+def add(a, b):
+    return a + b
+
+
+def sub(a, b):
+    return a - b

package/scripts/fixtures/apishape/python/removed/head/ops.py

@@ -0,0 +1,2 @@
+def add(a, b):
+    return a + b

package/scripts/fixtures/apishape/python/renamed/base/text.py

@@ -0,0 +1,2 @@
+def slugify(value):
+    return value.lower().replace(" ", "-")

package/scripts/fixtures/apishape/python/renamed/head/text.py

@@ -0,0 +1,2 @@
+def to_slug(value):
+    return value.lower().replace(" ", "-")

package/scripts/fixtures/apishape/python/signature/base/shapes.py

@@ -0,0 +1,2 @@
+def area(width, height):
+    return width * height

package/scripts/fixtures/apishape/python/signature/head/shapes.py

@@ -0,0 +1,2 @@
+def area(width, height, *, scale=1):
+    return width * height * scale

package/scripts/fixtures/apishape/python/sync-async/base/client.py

@@ -0,0 +1,7 @@
+def fetch(url):
+    return url
+
+
+class Client:
+    def get(self, path):
+        return path

package/scripts/fixtures/apishape/python/sync-async/head/client.py

@@ -0,0 +1,7 @@
+async def fetch(url):
+    return url
+
+
+class Client:
+    async def get(self, path):
+        return path

package/scripts/fixtures/apishape/ts/generator-function/base/seq.js

@@ -0,0 +1,3 @@
+export function* pairs(items) {
+  for (let i = 0; i < items.length; i += 2) yield items.slice(i, i + 2);
+}

package/scripts/fixtures/apishape/ts/generator-function/head/seq.js

@@ -0,0 +1,5 @@
+export function pairs(items) {
+  const out = [];
+  for (let i = 0; i < items.length; i += 2) out.push(items.slice(i, i + 2));
+  return out;
+}

package/scripts/fixtures/apishape/ts/private-edit/base/calc.ts

@@ -0,0 +1,7 @@
+function scale(value: number): number {
+  return value * 2;
+}
+
+export function total(values: number[]): number {
+  return values.reduce((sum, v) => sum + scale(v), 0);
+}

package/scripts/fixtures/apishape/ts/private-edit/head/calc.ts

@@ -0,0 +1,9 @@
+function scale(value: number, factor = 2): number {
+  return value * factor;
+}
+
+export function total(values: number[]): number {
+  let sum = 0;
+  for (const v of values) sum += scale(v);
+  return sum;
+}

package/scripts/fixtures/apishape/ts/removed/base/ops.ts

@@ -0,0 +1,7 @@
+export function add(a: number, b: number): number {
+  return a + b;
+}
+
+export function sub(a: number, b: number): number {
+  return a - b;
+}

package/scripts/fixtures/apishape/ts/removed/head/ops.ts

@@ -0,0 +1,3 @@
+export function add(a: number, b: number): number {
+  return a + b;
+}

package/scripts/fixtures/apishape/ts/renamed/base/text.ts

@@ -0,0 +1,3 @@
+export function slugify(value: string): string {
+  return value.toLowerCase().replace(/ /g, "-");
+}

package/scripts/fixtures/apishape/ts/renamed/head/text.ts

@@ -0,0 +1,3 @@
+export function toSlug(value: string): string {
+  return value.toLowerCase().replace(/ /g, "-");
+}

package/scripts/fixtures/apishape/ts/signature/base/shapes.ts

@@ -0,0 +1,3 @@
+export function area(width: number, height: number): number {
+  return width * height;
+}

package/scripts/fixtures/apishape/ts/signature/head/shapes.ts

@@ -0,0 +1,3 @@
+export function area(width: number, height: number, scale = 1): number {
+  return width * height * scale;
+}

package/scripts/fixtures/apishape/ts/sync-async/base/client.mjs

@@ -0,0 +1,5 @@
+export function fetchUrl(url) {
+  return url;
+}
+
+export const load = (path) => path;

package/scripts/fixtures/apishape/ts/sync-async/head/client.mjs

@@ -0,0 +1,5 @@
+export async function fetchUrl(url) {
+  return url;
+}
+
+export const load = async (path) => path;

package/scripts/forge-root.test.sh

@@ -416,9 +416,9 @@ FR="$ROOT/scripts/lib/forge-resolve.sh"; FB="$ROOT/scripts/lib/fence-bootstrap.s
 [ -f "$FR" ] && [ -f "$FB" ] && ok || bad "scripts/lib/forge-resolve.sh and scripts/lib/fence-bootstrap.sh must exist"
 sed 's/^[[:space:]]*//' "$STG_SPEC" | grep '^type forge_resolve >/dev/null' | sort | uniq -c > "$T/loc_uniq"
 [ "$(wc -l < "$T/loc_uniq" | tr -d ' ')" = 1 ] && ok || bad "forge_resolve locator line must be byte-identical across every stub in review-pr-staging.md"
-[ "$(awk '{print $1}' "$T/loc_uniq")" -ge 25 ] && ok || bad "expected a locator on every bootstrap (21) and resolver (5) stub"
+[ "$(awk '{print $1}' "$T/loc_uniq")" -ge 12 ] && ok || bad "expected a locator on every bootstrap (10) and resolver (2) stub (the pre/post-dispatch fences moved to forgedock review-staging, #4359)"
 grep -qE 'PWD|\$\(pwd\)|REPO_PATH' "$T/locator.sh" && bad "stub locator must not consult the cwd or repo under review" || ok
-[ "$(grep -c '# FENCE_BOOTSTRAP$' "$STG_SPEC")" = 21 ] && ok || bad "expected 21 fence bootstrap stubs"
+[ "$(grep -c '# FENCE_BOOTSTRAP$' "$STG_SPEC")" = 10 ] && ok || bad "expected 10 fence bootstrap stubs"
 [ "$(grep '# FENCE_BOOTSTRAP$' "$STG_SPEC" | sort -u | wc -l | tr -d ' ')" = 1 ] && ok || bad "fence bootstrap stubs must be byte-identical"
 grep '# FENCE_BOOTSTRAP$' "$STG_SPEC" | sed 1q | grep -qF 'exit 1' && ok || bad "fence bootstrap stub must fail closed (exit 1) when the helper is unresolved"
 # the spec carries none of the old inlined blocks

package/scripts/publish-staging-sync.test.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# publish-staging-sync.test.sh — guards the publish.yml "Sync version to staging" step (forge#3695)
-# and the deploy-pr Phase 2A.5 version-sync pre-flight. Static assertions, no network.
+# publish-staging-sync.test.sh — guards the publish.yml "Sync version to staging" step (forge#3695, forge#4357)
+# and the deploy-pr Phase 2A.5 version-sync pre-flight. Static assertions plus a local-only run of the step (bare origin, stub gh); no network.
 # Usage: bash scripts/publish-staging-sync.test.sh
 # SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
 # SPDX-License-Identifier: AGPL-3.0-or-later
@@ -29,14 +29,72 @@ else bad "sync step sits between Push version bump and Create GitHub Release"; f
 
 stepHas() { if printf '%s\n' "$STEP" | grep -qF -e "$2"; then ok "$1"; else bad "$1 (missing '$2')"; fi; }
 stepHas "step fetches origin/staging" "origin/staging"
-stepHas "step pushes HEAD to staging" "git push origin HEAD:staging"
 stepHas "step is non-fatal" "continue-on-error: true"
 stepHas "step is guarded by SKIP_PUBLISH" "env.SKIP_PUBLISH != 'true'"
-stepHas "commit carries [skip ci]" "[skip ci]"
+# forge#4357: staging is protected (GH006), so the sync goes through a PR, never a direct push.
+stepHas "step pushes to a chore/sync-version-X.Y.Z branch" 'SYNC_BRANCH="chore/sync-version-${VERSION}"'
+stepHas "step force-pushes the sync branch" 'git push -f origin "HEAD:refs/heads/$SYNC_BRANCH"'
+stepHas "step looks up an existing sync PR" 'gh pr list --head "$SYNC_BRANCH" --base staging'
+stepHas "step opens a PR to staging" 'gh pr create --base staging --head "$SYNC_BRANCH"'
+stepHas "step authenticates gh" 'GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}'
+stepHas "step skips when staging is at or above the version" "nothing to sync"
+if printf '%s\n' "$STEP" | grep -E 'git push' | grep -qE 'HEAD:staging|refs/heads/staging|origin staging'; then
+  bad "step must not push directly to staging"; else ok "step does not push directly to staging"; fi
+if printf '%s\n' "$STEP" | grep -E 'git commit' | grep -qF '[skip ci]'; then
+  bad "sync commit (PR head) must not carry [skip ci]"; else ok "sync commit does not carry [skip ci]"; fi
+PERMS=$(awk '/^    permissions:/{f=1;next} f&&/^    [a-z]/{exit} f{print}' "$PUB")
+if printf '%s\n' "$PERMS" | grep -qE '^ +pull-requests: write'; then ok "publish job grants pull-requests: write"; else bad "publish job grants pull-requests: write"; fi
 stepHas "only version files are staged" "git add package.json .claude-plugin/plugin.json"
 stepHas "failure emits a warning" "::warning::"
 if printf '%s\n' "$STEP" | grep -qE 'git (merge|pull)'; then bad "step must not merge main (version-only commit)"; else ok "step does not merge main"; fi
 
+# Behavioural: run the step's script against a local bare origin with a stub gh.
+RUN=$(printf '%s\n' "$STEP" | awk '/^        run: \|/{f=1;next} f{sub(/^          /,"");print}')
+SB=$(mktemp -d "${TMPDIR:-/tmp}/pubsync.XXXXXX")
+trap 'rm -rf "$SB"' EXIT
+(
+  set -e
+  export GIT_AUTHOR_NAME=t GIT_AUTHOR_EMAIL=t@t GIT_COMMITTER_NAME=t GIT_COMMITTER_EMAIL=t@t
+  git init -q --bare "$SB/origin.git"
+  git init -q -b staging "$SB/seed"; cd "$SB/seed"
+  mkdir .claude-plugin
+  echo '{"name":"x","version":"1.9.0"}' > package.json
+  echo '{"name":"x","version":"1.9.0"}' > .claude-plugin/plugin.json
+  echo keep > other.txt
+  git add -A; git commit -qm seed; git push -q "$SB/origin.git" staging
+  git clone -q -b staging "$SB/origin.git" "$SB/work"
+  mkdir "$SB/bin"
+  printf '#!/bin/sh\necho "$*" >> "%s/gh.log"\ncase "$2" in create) echo https://example.test/pr/1;; list) [ -z "$GH_STUB_LIST" ] || echo "$GH_STUB_LIST";; esac\n' "$SB" > "$SB/bin/gh"
+  chmod +x "$SB/bin/gh"
+) >/dev/null 2>&1 || bad "behavioural sandbox setup"
+# The workflow's bump step sets git user.name/email; give the step that identity here
+# (CI runners have no global git config).
+runStep() { (cd "$SB/work" && PATH="$SB/bin:$PATH" RUNNER_TEMP="$SB/rt" VERSION="$1" \
+  GIT_AUTHOR_NAME=t GIT_AUTHOR_EMAIL=t@t GIT_COMMITTER_NAME=t GIT_COMMITTER_EMAIL=t@t bash -c "$RUN") >"$SB/out" 2>&1; }
+mkdir -p "$SB/rt"
+STAGING_BEFORE=$(git -C "$SB/origin.git" rev-parse staging 2>/dev/null)
+if runStep 1.10.0; then ok "step exits 0"; else bad "step exits 0"; fi
+[ "$(git -C "$SB/origin.git" rev-parse staging 2>/dev/null)" = "$STAGING_BEFORE" ] && ok "staging is not pushed to" || bad "staging is not pushed to"
+SYNCV=$(git -C "$SB/origin.git" show chore/sync-version-1.10.0:package.json 2>/dev/null | node -e "process.stdout.write(JSON.parse(require('fs').readFileSync(0,'utf8')).version)" 2>/dev/null)
+[ "$SYNCV" = "1.10.0" ] && ok "sync branch carries the new version" || bad "sync branch carries the new version (got '$SYNCV')"
+CHANGED=$(git -C "$SB/origin.git" diff --name-only staging chore/sync-version-1.10.0 2>/dev/null | sort | tr '\n' ' ')
+[ "$CHANGED" = ".claude-plugin/plugin.json package.json " ] && ok "sync commit is version-only" || bad "sync commit is version-only (got '$CHANGED')"
+grep -q -- 'pr create --base staging --head chore/sync-version-1.10.0' "$SB/gh.log" 2>/dev/null && ok "gh pr create targets staging" || bad "gh pr create targets staging"
+: > "$SB/gh.log"
+if GH_STUB_LIST=https://example.test/pr/7 runStep 1.10.0 && grep -q 'Updated existing staging sync PR https://example.test/pr/7' "$SB/out" \
+   && ! grep -q 'pr create' "$SB/gh.log"; then
+  ok "an open sync PR is updated, not duplicated"; else bad "an open sync PR is updated, not duplicated"; fi
+: > "$SB/gh.log"
+if runStep 1.9.0 && grep -q 'nothing to sync' "$SB/out" && [ ! -s "$SB/gh.log" ]; then
+  ok "skipped when staging is already at the version"; else bad "skipped when staging is already at the version"; fi
+# A failed commit (no identity) must not push an unchanged branch or open a PR.
+: > "$SB/gh.log"
+git -C "$SB/origin.git" branch -D chore/sync-version-1.11.0 >/dev/null 2>&1 || true
+(cd "$SB/work" && PATH="$SB/bin:$PATH" RUNNER_TEMP="$SB/rt" VERSION=1.11.0 GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 \
+  GIT_AUTHOR_NAME='' GIT_COMMITTER_NAME='' EMAIL='' bash -c "$RUN") >"$SB/out" 2>&1
+if ! git -C "$SB/origin.git" rev-parse -q --verify chore/sync-version-1.11.0 >/dev/null && [ ! -s "$SB/gh.log" ]; then
+  ok "failed commit pushes nothing and opens no PR"; else bad "failed commit pushes nothing and opens no PR"; fi
+
 has "deploy-pr has the 2A.5 pre-flight" "### 2A.5: Version Sync Pre-flight" "$DEP"
 has "deploy-pr pre-flight compares package.json" "package.json" "$DEP"
 

package/scripts/review-finalize.sh

@@ -364,12 +364,18 @@ do_extract() {
                 }
             }' "$BODY_FILE" > "$SECTION_FILE" 2>/dev/null || : > "$SECTION_FILE"
         # Failure scenario: present / absent when the section was found, unknown when the carrying comment or section is unreadable.
+        # Read from the prose (#4356): a `**Failure scenario**` anywhere on a line, or a line that starts (after list/quote/bold markup, any
+        # case) with a `failure scenario`, `scenario`, `repro`, `reproduction` or `steps to reproduce` label followed by `:` or a closing `**`.
+        # The content sits on that line or the next non-blank one; a mid-sentence use of the word is not a label.
         SCENARIO="unknown"
         if [ -s "$SECTION_FILE" ]; then
             SCENARIO=$(awk '
-                tolower($0) ~ /\*\*failure scenario\*\*/ { s = $0; sub(/^.*\*\*[Ff]ailure [Ss]cenario\*\*[*:[:space:]]*/, "", s); gsub(/[[:space:]]/, "", s)
-                    if (s != "") { print "present"; found = 1; exit } else { want = 1; next } }
-                want { t = $0; gsub(/[[:space:]]/, "", t); if (t != "") { print "present"; found = 1; exit } }
+                want { t = $0; gsub(/[[:space:]]/, "", t); if (t != "") { print "present"; found = 1; exit } next }
+                { l = tolower($0); s = "" }
+                l ~ /\*\*failure scenario\*\*/ { s = l; sub(/^.*\*\*failure scenario\*\*/, "", s) }
+                s == "" { m = l; sub(/^[[:space:]]*([-*+>_][[:space:]]*)*/, "", m)
+                    if (match(m, /^(failure scenario|steps to reproduce|reproduction|repro|scenario)((\*\*|__)?[[:space:]]*:|\*\*|__)/)) s = substr(m, RLENGTH + 1); else next }
+                { gsub(/[*_:[:space:]]/, "", s); if (s != "") { print "present"; found = 1; exit } else want = 1 }
                 END { if (!found) print "absent" }' "$SECTION_FILE")
         fi
         FIX_EFF=$(grep -iE '^[[:space:]]*(\*\*Fix efficacy\*\*:?|FIX_EFFICACY:)[[:space:]]*\**[[:space:]]*(fails|regresses)' "$SECTION_FILE" 2>/dev/null | head -n 1 \
@@ -531,10 +537,15 @@ SYMEOF
                 case "$SEV" in MEDIUM|LOW|INFO) ROUTE="pre-existing" ;; esac
             fi
         fi
-        # Gate 3 (concrete failure): MEDIUM or lower without a **Failure scenario** is speculative hardening, demoted to a NOTE.
-        # CRITICAL/HIGH are exempt; an unreadable carrying comment keeps the finding.
+        # Gate 3 (concrete failure): MEDIUM or lower without a failure scenario in its prose is speculative hardening, demoted to a NOTE.
+        # CRITICAL/HIGH (any confidence) and CONFIRMED MEDIUM are exempt (#4356): a confirmed finding is filed through the classifier with its
+        # agent and prose as evidence. An unreadable carrying comment keeps the finding.
         if [ "$ROUTE" = "file" ] && [ "$SCEN" = "absent" ]; then
-            case "$SEV" in MEDIUM|LOW|INFO) ROUTE="demoted-no-scenario" ;; esac
+            CONF=$(upper "$(printf '%s' "$F" | jq -r '.confidence // ""')")
+            case "$SEV" in
+                MEDIUM) [ "$CONF" = "CONFIRMED" ] || ROUTE="demoted-no-scenario" ;;
+                LOW|INFO) ROUTE="demoted-no-scenario" ;;
+            esac
         fi
         case "$ROUTE" in pre-existing) N_PREEXISTING=$((N_PREEXISTING + 1)) ;; demoted-no-scenario) N_NO_SCENARIO=$((N_NO_SCENARIO + 1)) ;; esac
         N_KEPT=$((N_KEPT + 1))

package/scripts/review-finalize.test.sh

@@ -286,6 +286,45 @@ want "scope: HIGH near an added line" '.findings[] | select(.id == "N-2") | .sco
 want "scope: MEDIUM near an added line" '.findings[] | select(.id == "N-3") | .scope' findings.json "introduced"
 want "scope: every finding carries a valid scope" '[.findings[].scope | select(. == "introduced" or . == "pre-existing" or . == "unknown")] | length' findings.json "$(jq '.findings | length' "$WORK/out/findings.json")"
 want "scope: introduced count" '.counts.findings_introduced' findings.json "$(jq '[.findings[] | select(.scope == "introduced")] | length' "$WORK/out/findings.json")"
+# Gate 3 reads the scenario from the prose and never demotes a CONFIRMED MEDIUM+ for a missing field (#4356); the damper stays for the rest
+reset
+for f in a b c d e f g h; do printf '{"filename":"%s.py","status":"modified","patch":"@@ -9,0 +10,1 @@\\n+new line"}\n' "$f"; done | jq -s . > "$FIX/pr-files.json"
+cm MEMBER User "$(agent_body security "$SHA" '### C-1 confirmed
+Real bug described in prose only.
+### C-2 confirmed lower case
+Real bug described in prose only.
+### C-3 confirmed low
+Prose only.
+### C-4 plain label
+Failure scenario: a missing key crashes the loader
+### C-5 repro label
+- **Repro**: call load() twice
+### C-6 no scenario
+Some prose without the field.
+### C-7 mid-sentence word
+no scenario written here
+### C-8 label on next line
+**Steps to reproduce**:
+
+1. run it
+' '<!-- FINDING:C-1|CONFIRMED|MEDIUM|a.py:10|Confirmed medium without a scenario field -->
+<!-- FINDING:C-2|confirmed|medium|b.py:10|Lower case confirmed medium without a scenario field -->
+<!-- FINDING:C-3|CONFIRMED|LOW|c.py:10|Confirmed low without a scenario field -->
+<!-- FINDING:C-4|LIKELY|MEDIUM|d.py:10|Plain failure scenario label in prose -->
+<!-- FINDING:C-5|POSSIBLE|MEDIUM|e.py:10|Bold repro label in a list item -->
+<!-- FINDING:C-6|POSSIBLE|MEDIUM|f.py:10|Possible medium with no scenario anywhere -->
+<!-- FINDING:C-7|LIKELY|MEDIUM|g.py:10|Scenario word mid sentence only -->
+<!-- FINDING:C-8|LIKELY|MEDIUM|h.py:10|Scenario content on the next line -->')"
+flush; run "$GOOD" extract; rc_is "gate3 prose" "$RC" 0
+want "gate3: CONFIRMED MEDIUM without a scenario is filed" '.findings[] | select(.id == "C-1") | [.scenario, .route] | join(",")' findings.json "absent,file"
+want "gate3: lower-case confirmed medium is filed" '.findings[] | select(.id == "C-2") | .route' findings.json "file"
+want "gate3: CONFIRMED LOW without a scenario is still demoted" '.findings[] | select(.id == "C-3") | .route' findings.json "demoted-no-scenario"
+want "gate3: plain Failure scenario label counts" '.findings[] | select(.id == "C-4") | [.scenario, .route] | join(",")' findings.json "present,file"
+want "gate3: bold Repro label counts" '.findings[] | select(.id == "C-5") | [.scenario, .route] | join(",")' findings.json "present,file"
+want "gate3: POSSIBLE MEDIUM with no scenario is demoted" '.findings[] | select(.id == "C-6") | .route' findings.json "demoted-no-scenario"
+want "gate3: a mid-sentence scenario word is not a label" '.findings[] | select(.id == "C-7") | [.scenario, .route] | join(",")' findings.json "absent,demoted-no-scenario"
+want "gate3: label content on the next line counts" '.findings[] | select(.id == "C-8") | .scenario' findings.json "present"
+want "gate3: demoted count" '.counts.notes_demoted_no_scenario' findings.json "3"
 # an unreadable files API classifies nothing as pre-existing
 reset; echo '[]' > "$FIX/pr-files.json"
 cm MEMBER User "$(agent_body security "$SHA" '### P-1 pre
@@ -625,6 +664,14 @@ want "lineage damps LIKELY medium" '.findings[] | select(.id == "L-1") | .class'
 want "no-scenario note" '.findings[] | select(.id == "L-2") | .disposition' classified.json "NOTE no-scenario"
 posted_has "no-scenario counter" "notes_demoted_no_scenario=1"
 posted_has "no-scenario listed" "- L-2 a.py:9 [LIKELY] Demoted for lack of a scenario: no-scenario"
+# a CONFIRMED MEDIUM that Gate 3 kept (scenario absent, route file) is classified, never a no-scenario NOTE (#4356); marker fields unchanged
+reset
+mkfind K-1 CONFIRMED MEDIUM a.py 5 "Confirmed medium kept without a scenario field"
+FJ=$(printf '%s' "$FJ" | jq -c '.scenario = "absent"'); putfind 1
+run "$GOOD" classify; rc_is "confirmed medium classify" "$RC" 0
+want "confirmed medium without scenario is an issue" '.findings[] | select(.id == "K-1") | .class' classified.json "ISSUE"
+has "confirmed medium without scenario is filed" "FINDINGS_FILED=1"
+posted_has "confirmed medium: marker field set unchanged" "<!-- FORGE:NOTE_DISPOSITION: notes_fixed=0 notes_listed=0 notes_dropped=0 findings_filed=1 inpr_fix=0 contract_demoted=0 findings_dropped_stale=0 findings_preexisting=0 introduced=0 notes_demoted_no_scenario=0 lineage=none classifier=script notes_reflag=0 notes_capped=0 reviewed_sha=${SHA} -->"
 # the PR-body issue in the context alone never sets lineage: only the invoker's --issue does (#3952 SEC-1/QA-2)
 reset; echo review-finding > "$FIX/labels"; mkctx 1 FULL "" 12
 mkfind L-1 LIKELY MEDIUM a.py 2 "Lineage damped medium finding"

package/scripts/review-pr-arguments.test.sh

@@ -151,6 +151,17 @@ touch $SENTINEL"; do
   else bad "staging injection not rejected: '$got'"; fi
 done
 
+# Test 6b (forge#4360): `--delta <full sha>` is forwarded to the CLI; anything but a full lowercase hex SHA is dropped
+DELTA_LINE=$(grep -m1 '^STAGING_DELTA=' "$STAGING")
+if [ -n "$DELTA_LINE" ] && grep -qF '${STAGING_DELTA:+--delta "$STAGING_DELTA"}' "$STAGING"; then ok; else bad "staging --delta parse/forward not found"; fi
+run_delta() { STAGING_ARGS_RAW="$1" "${BASH:-bash}" -c "$DELTA_LINE"$'\n''printf "%s" "$STAGING_DELTA"'; }
+D40=0123456789abcdef0123456789abcdef01234567
+got=$(run_delta "3401 --delta $D40"); if [ "$got" = "$D40" ]; then ok; else bad "staging --delta not parsed: '$got'"; fi
+got=$(run_delta "3401 --delta $D40 --thorough"); if [ "$got" = "$D40" ]; then ok; else bad "staging --delta before a flag: '$got'"; fi
+for v in "abc123" "${D40}0" "XYZ" ""; do
+  got=$(run_delta "3401 --delta $v"); if [ -z "$got" ]; then ok; else bad "staging --delta '$v' not dropped: '$got'"; fi
+done
+
 # Test 7: Phase -1 stops on an empty PR_NUMBER before any `gh pr view` (gh falls back to the current-branch PR)
 GUARD=$(awk '/^  if \[ -z "\$PR_NUMBER" \]; then$/{p=1} p{print} p && /^  fi$/{exit}' "$SPEC")
 if [ -n "$GUARD" ]; then ok; else bad "Phase -1 empty-PR_NUMBER guard not found"; fi
@@ -167,7 +178,8 @@ done
 got=$(run_route "3401 --auto-merge --issue 3398"); if [ "$got" = REACHED ]; then ok; else bad "route stopped a valid PR number: '$got'"; fi
 
 # Test 8: the whole staging fence stops (non-zero, no REVIEW_ROUTE post) on a rejected string
-STAGING_FENCE=$(awk '/^```bash/{buf=""; in_f=1; next} /^```$/{if (in_f && buf ~ /STAGING_ARGS_RAW/) {printf "%s", buf; exit}; in_f=0; next} in_f{buf=buf $0 "\n"}' "$STAGING")
+# Cut before the CLI resolution (#4359): the fence ends by running `forgedock review-staging`, which this test never runs.
+STAGING_FENCE=$(awk '/^```bash/{buf=""; in_f=1; next} /^```$/{if (in_f && buf ~ /STAGING_ARGS_RAW/) {printf "%s", buf; exit}; in_f=0; next} in_f && /^FD_ROOT=/{if (buf ~ /STAGING_ARGS_RAW/) {printf "%s", buf; exit}} in_f{buf=buf $0 "\n"}' "$STAGING")
 if [ -n "$STAGING_FENCE" ]; then ok; else bad "staging fence not found"; fi
 run_stg_fence() { gen_script "$STAGING_FENCE" "$1" "$WORK/stgf.sh" 'echo REACHED'; : > "$ERR"; (cd "$WORK" && "${BASH:-bash}" "$WORK/stgf.sh" 2>"$ERR"); }
 got=$(run_stg_fence "\$(touch $SENTINEL)"); rc=$?

package/scripts/review-pr-delta-wiring.test.sh

@@ -235,8 +235,8 @@ case "$(p4 FULL 'security auth')" in "PANEL_STATUS: SHORTFALL"*) ok ;; *) bad "u
 # a verdict without a findings block is undelivered (#3976): not complete, never counted
 { cm "$(printf '<!-- FORGE:REVIEW-AGENT:security -->\nReviewed-SHA: %s\n\nVerdict: APPROVE, no findings.' "$HEAD")" User MEMBER; cm "$(body_agent auth "$HEAD")" User MEMBER; } | jq -s '.' > "$FAKE_COMMENTS"
 case "$(p4 FULL 'security auth')" in "PANEL_STATUS: SHORTFALL (ACTUAL_AGENT_COUNT=1)"*) ok ;; *) bad "a block-less reviewer comment must not satisfy Phase 4: $(p4 FULL 'security auth')" ;; esac
-# the 3C pending-agent count and the staging 6.75 delivery count carry the same block lookahead as Phase 4
-STAGING="$ROOT/commands/review-pr-staging.md"
+# the 3C pending-agent count and the staging 6.75 delivery count (scripts/review-staging-post.sh) carry the same block lookahead as Phase 4
+STAGING="$ROOT/scripts/review-staging-post.sh"   # owner of the staging 6.75 delivery count (forge#4359)
 for spec in "$SPEC" "$STAGING"; do
   n=$(grep -F 'count "^(?=[\\s\\S]*<!-- REVIEW-FINDINGS-START -->[\\s\\S]*<!-- REVIEW-FINDINGS-END -->)<!-- FORGE:REVIEW-AGENT:${AGENT_DOMAIN} -->' "$spec" | wc -l)
   want=2; [ "$spec" = "$STAGING" ] && want=1

package/scripts/review-pr-gate2.test.sh

@@ -37,20 +37,12 @@ for p in infra security scraper; do
   if [ "$reads" -ge 1 ] && [ "$reads" = "$decls" ]; then ok; else bad "$p.md: $reads fences read SLICE_FILE, $decls re-declare it"; fi
 done
 
-# Staging slice path: every placeholder must be bound, and an unresolved SHA must yield a slash-free component.
-STAGING_SPEC="$ROOT/commands/review-pr-staging.md"
-if grep -qE '^REVIEW_SHA_SHORT=.*tr -cd .*unresolved' "$STAGING_SPEC"; then ok; else bad "staging spec does not define a hex-sanitized REVIEW_SHA_SHORT with an unresolved fallback"; fi
-if grep -qF 'Phase -1 `REVIEW_SHA_SHORT`' "$STAGING_SPEC"; then ok; else bad "staging dispatch text does not bind [REVIEW_SHA_SHORT] to Phase -1 REVIEW_SHA_SHORT"; fi
-SHORT_LINE=$(grep -E '^REVIEW_SHA_SHORT=' "$STAGING_SPEC" | head -n 1)
-for full in "" "n/x" "0123456789abcdef0123456789abcdef01234567"; do
-  got=$(REVIEW_SHA_FULL="$full"; eval "$SHORT_LINE"; printf '%s' "$REVIEW_SHA_SHORT")
-  case "$full" in
-    0123*) want="0123456" ;;
-    *) want="unresolved" ;;
-  esac
-  if [ "$got" = "$want" ]; then ok; else bad "REVIEW_SHA_SHORT for '$full' = '$got' (want '$want')"; fi
-  case "$got" in */*) bad "REVIEW_SHA_SHORT contains a slash for '$full'" ;; *) ok ;; esac
-done
+# Staging slice path (#4359): `forgedock review-staging` renders [REVIEW_SHA_SHORT] into the briefs. It derives it only from a validated
+# full head SHA and stops before any brief when none resolves, so the slice path can never carry a / or an unresolved sentinel.
+STAGING_CLI="$ROOT/bin/review-staging.mjs"
+if grep -qF 'const SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;' "$STAGING_CLI" && grep -qF 'if (!SHA_RE.test(head)) throw new Stop(1' "$STAGING_CLI"; then ok; else bad "staging CLI does not refuse an unvalidated head SHA"; fi
+if grep -qF 'const sha7 = head.slice(0, 7);' "$STAGING_CLI" && grep -qF 'REVIEW_SHA_SHORT: sha7' "$STAGING_CLI"; then ok; else bad "staging CLI does not bind [REVIEW_SHA_SHORT] to the validated head's first 7 hex"; fi
+if grep -q 'REVIEW_SHA_SHORT' "$ROOT/commands/review-pr-staging.md"; then bad "staging spec still binds [REVIEW_SHA_SHORT] by hand (the CLI renders the briefs)"; else ok; fi
 
 echo "review-pr-gate2.test.sh: passed=$PASS failed=$FAILN"
 [ "$FAILN" -eq 0 ]

package/scripts/review-pr-staging-finding-filter.test.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # review-pr-staging-finding-filter.test.sh — fixtures for the anchored open-finding filter (forge#3800).
-# The spec's `# FINDING_PR_FILTER` line is extracted and run against issue shapes: the gate must keep a
+# The staging gate's `# FINDING_PR_FILTER` line (scripts/review-staging-pre.sh since #4359) is extracted and run against issue shapes: the gate must keep a
 # hit only when its title suffix or `**Source**:` line names exactly PR #N; hidden markers never count.
 # SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
 # SPDX-License-Identifier: AGPL-3.0-or-later
@@ -12,10 +12,10 @@ bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
 command -v jq >/dev/null 2>&1 || { echo "review-pr-staging-finding-filter.test.sh: jq missing, skipped"; exit 0; }
 
 extract() { grep -E '# FINDING_PR_FILTER$' "$1" | sed 's/[[:space:]]*# FINDING_PR_FILTER$//; s/^[[:space:]]*//'; }
-SPEC="$ROOT/commands/review-pr-staging.md"
+SPEC="$ROOT/scripts/review-staging-pre.sh"   # owner of the staging 0A gate (forge#4359)
 DEF="$(extract "$SPEC" | sort -u)"
-[ "$(printf '%s\n' "$DEF" | grep -c .)" -eq 1 ] && ok || bad "review-pr-staging.md must carry one identical FINDING_PR_FILTER definition"
-[ "$(extract "$ROOT/commands/deploy-info.md" | sort -u)" = "$DEF" ] && ok || bad "deploy-info.md filter differs from review-pr-staging.md"
+[ "$(printf '%s\n' "$DEF" | grep -c .)" -eq 1 ] && ok || bad "review-staging-pre.sh must carry one identical FINDING_PR_FILTER definition"
+[ "$(extract "$ROOT/commands/deploy-info.md" | sort -u)" = "$DEF" ] && ok || bad "deploy-info.md filter differs from review-staging-pre.sh"
 [ "$(grep -c -F 'FINDING_PR_FILTER' "$SPEC")" -ge 3 ] && ok || bad "filter must be referenced by all three queries"
 grep -q -F 'OVERRIDE: shipping with open findings' "$SPEC" && ok || bad "OVERRIDE text missing"
 eval "$DEF"