forgedock 1.30.0 → 1.31.0

package/bin/lean/precheck.test.mjs

@@ -5,7 +5,9 @@ import assert from "node:assert/strict";
 import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpDir } from "../tests/_tmp.mjs";
-import { runChecks, formatPrecheckSummary } from "./precheck.mjs";
+import { formatFirstPassSummary } from "./fixround.mjs";
+import { runChecks, formatPrecheckSummary, planPrecheck, selfCheck, selfCheckState, formatCheckTable, worktreeFingerprint, quietFailure } from "./precheck.mjs";
+import { execFileSync } from "node:child_process";
 import { readPrecheckBudget } from "../engine-cli.mjs";
 import { orchestrate } from "./orchestrate.mjs";
 
@@ -66,6 +68,43 @@ describe("runChecks (#4331)", () => {
   });
 });
 
+describe("runChecks (#4344)", () => {
+  /** A fake heavy semaphore: counts live slots, their peak and releases; `wait` ms of the shared clock per acquire. */
+  const sem = (h, wait = 0) => { const s = { live: 0, peak: 0, acquired: 0, released: 0 };
+    s.acquire = async () => { s.acquired++; s.peak = Math.max(s.peak, ++s.live); h.t += wait; return { release: () => { s.live--; s.released++; } }; }; return s; };
+
+  it("#4344 divides the worker budget across concurrent commands and takes one heavy slot per running command", async () => {
+    for (const [n, cmds, share, peak] of [[8, ["a", "b", "c", "d", "e", "f", "g", "h"], 1, 8], [8, ["a", "b"], 4, 2], [6, ["a", "b", "c", "d"], 1, 4], [5, ["a", "b"], 2, 2], [4, ["a"], 4, 1]]) {
+      const h = harness(), s = sem(h), seen = [];
+      await runChecks({ commands: cmds, parallelism: n, budgetMs: 600000, perCommandMs: 300000, now: h.now, acquire: s.acquire, run: (a) => { seen.push(a.workers); return h.run(a); } });
+      assert.ok(seen.every((w) => w === share), `N=${n} k=${cmds.length}: ${seen}`);
+      assert.ok(share * h.peak <= n, `round total ${share * h.peak} workers > N=${n}`);
+      assert.deepEqual([s.peak, s.acquired, s.released, s.live], [peak, cmds.length, cmds.length, 0], `N=${n} slots`);
+    }
+  });
+
+  it("#4344 FORGE_HOST_PARALLELISM=1: one command at a time, one worker, one slot", async () => {
+    const h = harness(), s = sem(h), seen = [];
+    await runChecks({ commands: ["a", "b", "c"], parallelism: 1, budgetMs: 600000, perCommandMs: 300000, now: h.now, acquire: s.acquire, run: (a) => { seen.push(a.workers); return h.run(a); } });
+    assert.deepEqual([h.peak, s.peak, seen], [1, 1, [1, 1, 1]]);
+  });
+
+  it("#4344 the slot wait counts against the budget: a command whose wait exhausts it is deferred, its slot released", async () => {
+    const h = harness(), s = sem(h, 1000);
+    const r = await runChecks({ commands: ["a", "b"], parallelism: 1, budgetMs: 2500, perCommandMs: 300000, now: h.now, acquire: s.acquire, run: h.run });
+    assert.deepEqual(h.calls, [["a", 1500]]);
+    assert.deepEqual([r.results.map((x) => x.command), r.deferred], [["a"], ["b"]]);
+    assert.deepEqual([s.acquired, s.released], [2, 2]);
+  });
+
+  it("#4344 a throwing acquire runs the command ungated; a throwing release is ignored", async () => {
+    const h = harness();
+    const r1 = await runChecks({ commands: ["a"], parallelism: 2, budgetMs: 600000, perCommandMs: 300000, now: h.now, acquire: async () => { throw new Error("registry"); }, run: h.run });
+    const r2 = await runChecks({ commands: ["b"], parallelism: 2, budgetMs: 600000, perCommandMs: 300000, now: h.now, acquire: async () => ({ release: () => { throw new Error("x"); } }), run: h.run });
+    assert.deepEqual([...r1.results, ...r2.results].map((x) => [x.command, x.rc]), [["a", 0], ["b", 0]]);
+  });
+});
+
 describe("formatPrecheckSummary (#4331)", () => {
   it("sums precheck_ms over the lanes that ran checks and counts deferrals; null when none did", () => {
     assert.equal(formatPrecheckSummary([{ precheck_ms: 90000 }, { precheck_ms: 30000, precheck_deferred: 2 }, { issue: 3 }]), "precheck: 2.0m total over 2 lanes, 2 deferred to CI");
@@ -79,6 +118,12 @@ describe("formatPrecheckSummary (#4331)", () => {
     assert.deepEqual(rows.map((r) => [r.issue, r.precheck_ms, r.precheck_deferred]), [[1, 90000, 1], [2, 30000, undefined], [3, undefined, undefined]]);
     assert.equal(formatPrecheckSummary(rows), "precheck: 2.0m total over 2 lanes, 1 deferred to CI");
   });
+  it("#4362: orchestrate rows carry the lane's firstPass as first_pass for the batch first-pass line", async () => {
+    const rows = await orchestrate({ issues: [1, 2, 3], parallel: 1, readBody: async () => "",
+      runOne: async (n) => ({ terminalReason: "merged", ...({ 1: { firstPass: true }, 2: { firstPass: false } })[n] }) });
+    assert.deepEqual(rows.map((r) => [r.issue, r.first_pass]), [[1, true], [2, false], [3, undefined]]);
+    assert.equal(formatFirstPassSummary(rows), "first-pass: 50% (1/2 lanes that reached the build)");
+  });
 });
 
 describe("readPrecheckBudget: forge.yaml lean.precheck.max_minutes (#4331)", () => {
@@ -91,3 +136,70 @@ describe("readPrecheckBudget: forge.yaml lean.precheck.max_minutes (#4331)", ()
     assert.equal(readPrecheckBudget(tmpDir("precheck-")), undefined);
   });
 });
+
+describe("forgedock check core (#4364)", () => {
+  const MAP = { version: 1, entries: [{ globs: ["src/**"], command: "npm test", cwd: "." }, { globs: ["docs/**"], command: "make docs", cwd: "." }] };
+
+  it("planPrecheck: the engine's selection and budget rule (max_minutes wins, else precheck_total_seconds, else 600 s)", () => {
+    const p = planPrecheck({ testMap: MAP, files: ["src/a.js"], learned: [" make lint ", "", "make docs"], verify: { precheckTotalSeconds: 120, precheckTimeoutSeconds: 30 } });
+    assert.deepEqual(p.commands, ["make lint", "npm test"]); assert.deepEqual(p.dropped, ["make docs"]);
+    assert.equal(p.selected, 1); assert.equal(p.budgetMs, 120000); assert.equal(p.perCommandMs, 30000);
+    assert.equal(planPrecheck({ learned: ["x"], maxMinutes: 2, verify: { precheckTotalSeconds: 999 } }).budgetMs, 120000);
+    assert.equal(planPrecheck({ learned: ["x"], maxMinutes: 3, verify: {} }).budgetMs, 180000);
+    assert.deepEqual(planPrecheck({ learned: ["x"], verify: {} }), { commands: ["x"], added: 0, dropped: [], source: "learned", selected: 0, budgetMs: 600000, perCommandMs: 300000 });
+  });
+
+  it("selfCheck runs validates then pre-PR commands; ok only when every run exits 0; ci mode leaves validates to CI", async () => {
+    const h = harness({ rc: { "make lint": 2 } });
+    const contract = { validate: [{ id: "V1", command: "node --test a" }, { id: "V2", command: " " }] };
+    const plan = { mode: "local", commands: ["npm test", "make lint"], budgetMs: 600000, perCommandMs: 300000 };
+    const r = await selfCheck({ contract, plan, now: h.now, run: h.run });
+    assert.deepEqual(h.calls.map((c) => c[0]), ["node --test a", "npm test", "make lint"]);
+    assert.deepEqual(r.validate.map((x) => [x.id, x.rc]), [["V1", 0]]); assert.deepEqual(r.commands.map((x) => x.rc), [0, 2]); assert.equal(r.ok, false);
+    const h2 = harness();
+    const r2 = await selfCheck({ contract, plan: { ...plan, mode: "ci" }, now: h2.now, run: h2.run });
+    assert.deepEqual(h2.calls.map((c) => c[0]), ["npm test", "make lint"]); assert.deepEqual(r2.validate, [{ id: "V1", command: "node --test a", status: "ci" }]); assert.equal(r2.ok, true);
+    const h3 = harness({ cost: { "npm test": 5000 } });
+    const r3 = await selfCheck({ contract: {}, plan: { commands: ["npm test", "make lint"], budgetMs: 4000, perCommandMs: 300000 }, now: h3.now, run: h3.run });
+    assert.deepEqual(r3.deferred, ["npm test", "make lint"]); assert.equal(r3.ok, true, "deferred to CI is not a failure, as in the engine");
+  });
+
+  it("selfCheckState and formatCheckTable", () => {
+    assert.equal(selfCheckState(null, "f"), "skipped"); assert.equal(selfCheckState({ fingerprint: "g", ok: true }, "f"), "stale");
+    assert.equal(selfCheckState({ fingerprint: "f", ok: false }, "f"), "red"); assert.equal(selfCheckState({ fingerprint: "f", ok: true }, "f"), "green");
+    const t = formatCheckTable({ ok: false, validate: [{ id: "V1", command: "v", rc: 0, ms: 1200 }], commands: [{ command: "make lint", rc: 2, ms: 10, output: `${"x".repeat(5000)}TAIL` }], deferred: ["slow"] }, 1000);
+    assert.match(t, /^PASS +1\.2s {2}V1 v$/m); assert.match(t, /^FAIL exit 2 .* make lint$/m); assert.match(t, /^DEFERRED .* slow$/m);
+    assert.match(t, /--- make lint \(exit 2\)\n…x+TAIL/); assert.ok(t.length < 1400, "failure output capped"); assert.match(t, /check: FAIL \(1 failing\)$/);
+  });
+
+  it("#4390 quietFailure: last 40 lines, failing ids across ecosystems, log pointer; short output unchanged", () => {
+    const out = ["FAILED tests/test_x.py::test_a - assert 1 == 2", "not ok 3 - parses dates", " FAIL  src/a.test.ts > adds", "--- FAIL: TestSum (0.00s)", "test parser::empty ... FAILED", "  ✕ renders header (5 ms)",
+      ...Array.from({ length: 100 }, (_, i) => `line ${i}`)].join("\n");
+    const q = quietFailure(out, { logPath: ".forge-lean/logs/check-V1.log" });
+    assert.match(q, /^…line 60\n/); assert.match(q, /line 99\nfailing tests:\n/);
+    for (const id of ["FAILED tests/test_x.py::test_a", "not ok 3 - parses dates", "FAIL  src/a.test.ts > adds", "--- FAIL: TestSum", "test parser::empty ... FAILED", "✕ renders header"]) assert.ok(q.includes(`  ${id}`), id);
+    assert.match(q, /\nfull log: \.forge-lean\/logs\/check-V1\.log$/);
+    assert.equal(quietFailure("ok\nall good\n"), "ok\nall good");
+    assert.equal(quietFailure(""), "(no output)");
+    assert.equal(quietFailure("x".repeat(50), { maxChars: 10 }), `…${"x".repeat(10)}`);
+  });
+
+  it("worktreeFingerprint: the same content committed or not is the same tree; an edit or new file changes it; .forge-lean is ignored", async () => {
+    const dir = tmpDir("selfcheck-fp-");
+    const env = { ...process.env, GIT_AUTHOR_NAME: "t", GIT_AUTHOR_EMAIL: "t@example.invalid", GIT_COMMITTER_NAME: "t", GIT_COMMITTER_EMAIL: "t@example.invalid", GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_NOSYSTEM: "1" };
+    const g = (a) => execFileSync("git", a, { cwd: dir, encoding: "utf8", env });
+    g(["init", "-q", "-b", "main"]); writeFileSync(join(dir, "a.js"), "1\n"); writeFileSync(join(dir, "gone.js"), "x\n"); g(["add", "-A"]); g(["commit", "-q", "-m", "base"]);
+    g(["branch", "base"]);
+    const fp = () => worktreeFingerprint({ git: async (a) => g(a), base: "base" });
+    const clean = await fp();
+    writeFileSync(join(dir, "a.js"), "2\n"); writeFileSync(join(dir, "new.js"), "n\n"); g(["rm", "-q", "gone.js"]);
+    const dirty = await fp(); assert.notEqual(dirty, clean);
+    execFileSync("mkdir", ["-p", join(dir, ".forge-lean")]); writeFileSync(join(dir, ".forge-lean", "result.json"), "{}");
+    g(["add", "-A"]); g(["reset", "-q", "--", ".forge-lean"]);
+    writeFileSync(join(dir, ".git", "info", "exclude"), ".forge-lean/\n");
+    g(["commit", "-q", "-m", "work"]);
+    assert.equal(await fp(), dirty, "committing the checked tree does not make the check stale");
+    writeFileSync(join(dir, "a.js"), "3\n");
+    assert.notEqual(await fp(), dirty);
+  });
+});

package/bin/lean/prefilter.mjs

@@ -10,12 +10,17 @@
  *   3. every repo path the issue names is gone from origin/<lane> -> candidate
  * A candidate gets ONE read-only, single-turn validation on a small model in the main checkout (no worktree). Only an
  * ALREADY-FIXED/INVALID verdict with evidence closes the issue; everything else, and every error, goes to the normal lane.
- * All effects are injected (gh, git, runner, transitionLabel, projector?) so it is unit-testable.
+ * Post-deploy gate (#4389), with `defaultBranch`: a `FORGE:DEFERRED_FROM: #P` follow-up whose checklist items are all
+ * post-deploy is parked (`parked: true`, label `awaiting-promotion`, no lane) while a merge SHA of #P is not an ancestor
+ * of origin/<default>, or while forge.yaml `post_deploy.precondition_cmd` exits 1. Anything unresolvable fails open.
+ * All effects are injected (gh, git, runner, transitionLabel, projector?, execCode?) so it is unit-testable.
  */
+import { execFile } from "node:child_process";
 import { capComment, sanitizeMd, noComments } from "./render.mjs";
 import { PREFILTER_SYSTEM, prefilterPrompt, parsePrefilterVerdict } from "./prompts.mjs";
 import { isTrustedComment } from "../engine/phases.mjs";
 import { APP_SLUG } from "../init-repo.mjs";
+import { probeResultOf } from "./probe.mjs";
 
 export const DEFAULT_PREFILTER_MODEL = "claude-haiku-5-5";
 export const PREFILTER_MARKER = "FORGE:PREFILTER";
@@ -78,11 +83,15 @@ export function flakyReason(iss, own = [bareLogin(APP_SLUG)]) {
   if (FLAKY_RE.test(`${iss.title ?? ""}\n${noComments(String(iss.body ?? ""), " ")}`)) return { reason: "flaky", why: "issue says the failure is intermittent" };
   if ((iss.labels ?? []).some((l) => String(l?.name ?? l).toLowerCase() === "flaky")) return { reason: "flaky", why: "flaky label" };
   const mine = new Set((own ?? []).map(bareLogin));
+  // #4399: the latest pipeline FORGE:PROBE result is a fail: the fix did not hold in production, so no already-fixed close
+  const probe = (iss.comments ?? []).filter((c) => probeResultOf(c?.body) && (trusted(c) || mine.has(bareLogin(loginOf(c))))).at(-1);
+  if (probe && probeResultOf(probe.body).result === "fail") return { reason: "probe-failed", why: "acceptance probe failed after promotion" };
   if ((iss.comments ?? []).some((c) => isMarked(c) && (trusted(c) || mine.has(bareLogin(loginOf(c)))))) return { reason: "reopened", why: "reopened after a pre-filter close" };
   return null;
 }
 /** The own logins, looked up only when an otherwise-untrusted marker comment needs them (no call for most issues). */
-const ownFor = async (iss, resolve) => ((iss.comments ?? []).some((c) => isMarked(c) && !trusted(c)) ? resolve() : undefined);
+const ownFor = async (iss, resolve) => ((iss.comments ?? []).some((c) => (isMarked(c) || probeResultOf(c?.body)) && !trusted(c)) ? resolve() : undefined);
+const selfResolver = (selfLogins, gh) => (typeof selfLogins === "function" ? selfLogins : selfLogins ? async () => selfLogins : () => ownLogins(gh));
 
 const PATH_RE = /(?:^|[\s`'"(\[])((?:\.{0,2}\/)?(?:[\w@.-]+\/)+[\w@.-]+\.[A-Za-z0-9]{1,8})(?::\d+(?:-\d+)?)?(?=$|[\s`'"),.:;\]])/gm;
 /** Repo-relative file paths the issue names (`dir/file.ext`, optionally `:line`); URLs and HTML comments are ignored. */
@@ -115,7 +124,7 @@ export async function collectSignals({ iss, repo, lane, io, cwd, selfLogins = nu
         const sha = latest.head_sha ?? "";
         // #4305: a workflow that failed and passed at the same SHA is flaky; the lookup is any branch (PR run vs push)
         // and only made when the issue itself gave no reason. An unreadable lookup throws: no CI signal.
-        const own = await ownFor(iss, typeof selfLogins === "function" ? selfLogins : selfLogins ? async () => selfLogins : () => ownLogins(io.gh));
+        const own = await ownFor(iss, selfResolver(selfLogins, io.gh));
         let skip = flakyReason(iss, own);
         const same = { reason: "same-sha", why: `failed and passed at ${sha.slice(0, 12)}` };
         if (!skip && sha && failed.head_sha === sha) skip = same;
@@ -139,21 +148,166 @@ export async function collectSignals({ iss, repo, lane, io, cwd, selfLogins = nu
   return sig;
 }
 
+// #4389: post-deploy precondition gate. A follow-up filed by scripts/file-deferred-followups.sh whose items are all
+// post-deploy checks cannot be done before its parent's fix is on the default branch: a git fact, so no lane learns it.
+export const PRECONDITION_MARKER = "FORGE:PRECONDITION";
+export const AWAITING_PROMOTION_LABEL = "awaiting-promotion";
+const DEFERRED_FROM_RE = /<!--\s*FORGE:DEFERRED_FROM:\s*#(\d+)\s*-->/;
+/** The parent #P of a deferred follow-up (`<!-- FORGE:DEFERRED_FROM: #P -->`), or null. */
+export function deferredFrom(body) {
+  const m = DEFERRED_FROM_RE.exec(String(body ?? ""));
+  return m ? Number(m[1]) : null;
+}
+const CHECK_RE = /^\s*[-*]\s+\[[ xX]\]\s+(.*)$/;
+/** True when the body has checklist items and every one is a ``- [ ] `R#: …` — post-deploy: why`` line (conformance followupItems). */
+export function postDeployOnly(body) {
+  const items = noComments(String(body ?? ""), " ").split("\n").map((l) => CHECK_RE.exec(l)?.[1]).filter((x) => x != null);
+  return items.length > 0 && items.every((t) => /^`[^`]*`\s+(?:\*\*known-flaw\*\*\s+)?[—-]+\s*post-deploy:/.test(t));
+}
+const SHA_RE = /^[0-9a-f]{7,40}$/i;
+/**
+ * #4467: an issue comment the engine may trust, in REST shape (`user.type`) or `gh issue view` shape (`author.login`,
+ * `authorAssociation`): what isTrustedComment trusts, or the ForgeDock App, which `gh issue view` reports as a bare
+ * `rapiercraft-forgedock` CONTRIBUTOR with no type and no `[bot]` suffix (#4315).
+ */
+export const isTrustedIssueComment = (c) => Boolean(c) && (trusted(c) || bareLogin(loginOf(c)) === bareLogin(APP_SLUG));
+/** Merge commits of the merged PRs that claim to fix #parent; else the `merged at <sha>` of its trusted FORGE:TRAJECTORY. */
+export async function parentMergeShas({ parent, repo, io }) {
+  const shas = new Set();
+  try {
+    const prs = JSON.parse(String(await io.gh(["pr", "list", "-R", repo, "--state", "merged", "--search", `#${parent}`, "--json", "number,title,body,mergeCommit", "--limit", "20"])) || "[]");
+    for (const p of prs) if ((claimsFix(p.title, parent) || claimsFix(p.body, parent)) && SHA_RE.test(p.mergeCommit?.oid ?? "")) shas.add(p.mergeCommit.oid);
+  } catch { /* unreadable: try the trajectory */ }
+  if (!shas.size) {
+    try {
+      const v = JSON.parse(String(await io.gh(["issue", "view", String(parent), "-R", repo, "--json", "comments"])));
+      for (const c of v.comments ?? []) {
+        const b = String(c?.body ?? "");
+        const m = b.includes("FORGE:TRAJECTORY") && isTrustedIssueComment(c) ? /merged at `?([0-9a-f]{7,40})\b/i.exec(b) : null;
+        if (m) shas.add(m[1]);
+      }
+    } catch { /* unreadable: no SHA */ }
+  }
+  return [...shas];
+}
+/** Default `io.execCode`: the exit code of an argv-only child (-1 when it could not run or timed out). */
+function execCode(cmd, args, opts) {
+  return new Promise((res) => {
+    try { execFile(cmd, args, opts, (err) => res(err ? (typeof err.code === "number" ? err.code : -1) : 0)); } catch { res(-1); }
+  });
+}
+/**
+ * #4389: never throws, no model call. `defaultBranch` is a name or an (async) function resolving it (and fetching it).
+ * @returns {Promise<{state:"not-applicable"|"unresolved"|"awaiting-promotion"|"awaiting-precondition"|"ready", parent:?number, shas:string[], default?:string, detail:string}>}
+ * Fail-open: no merge SHA, a git answer other than yes/no, an unknown default branch or a hook error give "unresolved".
+ */
+export async function postDeployGate({ iss, repo, lane, defaultBranch, cwd, io, preconditionCmd = null }) {
+  const parent = deferredFrom(iss?.body);
+  const res = (state, detail, extra = {}) => ({ state, parent, shas: [], detail, ...extra });
+  if (!parent || !postDeployOnly(iss.body)) return res("not-applicable", "");
+  try {
+    const def = typeof defaultBranch === "function" ? await defaultBranch() : defaultBranch;
+    if (!def) return res("unresolved", "default branch unknown");
+    const shas = await parentMergeShas({ parent, repo, io });
+    if (!shas.length) return res("unresolved", `no merge SHA found for #${parent}`);
+    const off = [];
+    for (const sha of shas) {
+      let on;
+      try { await io.git(["merge-base", "--is-ancestor", sha, `origin/${def}`], { cwd }); on = true; } catch (e) { on = e?.code === 1 ? false : null; }
+      if (on === null) return res("unresolved", `${sha.slice(0, 12)} unknown to git`, { shas, default: def });
+      if (!on) off.push(sha);
+    }
+    if (off.length) return res("awaiting-promotion", `fix ${off.map((s) => s.slice(0, 12)).join(", ")} of #${parent} is not on ${def}${lane ? ` (lane ${lane})` : ""}`, { shas, default: def });
+    if (preconditionCmd) {
+      const code = await (io.execCode ?? execCode)("sh", ["-c", preconditionCmd, "precondition", String(iss.number)],
+        { cwd, timeout: 60000, env: { ...process.env, FORGE_ISSUE: String(iss.number) } });
+      if (code === 1) return res("awaiting-precondition", `fix of #${parent} is on ${def}; post_deploy.precondition_cmd says not ready`, { shas, default: def });
+      if (code !== 0) return res("unresolved", `post_deploy.precondition_cmd exited ${code}`, { shas, default: def });
+    }
+    return res("ready", `fix of #${parent} is on ${def}`, { shas, default: def });
+  } catch (e) {
+    return res("unresolved", `gate error (${String(e?.message ?? e).slice(0, 120)})`);
+  }
+}
+/**
+ * #4389: the default branch for the gate, resolved and fetched once, only when a gated issue asks: forge.yaml
+ * `branches.default`, else GitHub's default branch. Null when neither answers (the gate then fails open).
+ */
+export function lazyDefaultBranch({ io, repo, cwd, configured = null }) {
+  let p = null;
+  return () => (p ??= (async () => {
+    let name = configured;
+    if (!name) { try { name = String(await io.gh(["repo", "view", repo, "--json", "defaultBranchRef", "-q", ".defaultBranchRef.name"])).trim() || null; } catch { name = null; } }
+    if (name) { try { await io.git(["fetch", "origin", name], { cwd }); } catch { /* offline: use the local ref */ } }
+    return name;
+  })());
+}
+/** #4389: label and explain a parked issue once (the comment only when the label was not there yet); best effort. */
+async function markParked({ issue, repo, io, had, gate }) {
+  const edit = () => io.gh(["issue", "edit", String(issue), "-R", repo, "--add-label", AWAITING_PROMOTION_LABEL]);
+  try { await edit(); } catch {
+    try {
+      await io.gh(["label", "create", AWAITING_PROMOTION_LABEL, "-R", repo, "--force", "--color", "C5DEF5", "--description", "Post-deploy follow-up parked until its parent fix reaches the default branch. Managed by ForgeDock."]);
+      await edit();
+    } catch { /* the comment and the report still show it */ }
+  }
+  if (had) return;
+  const what = gate.state === "awaiting-promotion" ? "awaiting promotion" : "awaiting its post-deploy precondition";
+  const body = `<!-- ${PRECONDITION_MARKER} -->\n## Parked: ${what}\n${sanitizeMd(gate.detail)}.\n\nEvery item here is a post-deploy check, so no lane was started. The next orchestrate or triage run checks again and launches this issue once the precondition holds.`;
+  try { await io.gh(["issue", "comment", String(issue), "-R", repo, "--body", capComment(body)]); } catch { /* the label still shows it */ }
+}
+
+/** #4389 batch-report lines: one `awaiting promotion:` line (and one `awaiting precondition:` line) for the parked rows, or "". */
+export function formatParkedLine(rows) {
+  const parked = (rows ?? []).filter((r) => r?.prefilter?.parked);
+  const uniq = (xs) => [...new Set(xs.filter(Boolean))];
+  const out = [];
+  const promo = parked.filter((r) => r.prefilter.kind === "awaiting-promotion");
+  if (promo.length) {
+    const lanes = uniq(promo.map((r) => r.prefilter.lane)), defs = uniq(promo.map((r) => r.prefilter.default));
+    out.push(`awaiting promotion: ${promo.map((r) => `#${r.issue}`).join(" ")} (fixes on ${lanes.join(", ") || "the lane"}, not on ${defs.join(", ") || "the default branch"})`);
+  }
+  const pre = parked.filter((r) => r.prefilter.kind === "awaiting-precondition");
+  if (pre.length) out.push(`awaiting precondition: ${pre.map((r) => `#${r.issue}`).join(" ")} (post_deploy.precondition_cmd not ready)`);
+  return out.join("\n");
+}
+
 /**
  * Pre-filter one issue. Never throws.
  * @returns {Promise<{issue:number, closed:boolean, kind:?string, candidate:boolean, verdict:?string, cost_usd:number, detail:string}>}
  */
-export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAULT_PREFILTER_MODEL, dryRun = false, agentId = null, maxMinutes = 5, selfLogins = null }) {
+export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAULT_PREFILTER_MODEL, dryRun = false, agentId = null, maxMinutes = 5, selfLogins = null, defaultBranch = null, preconditionCmd = null }) {
   const out = { issue, closed: false, kind: null, candidate: false, verdict: null, cost_usd: 0, detail: "" };
   try {
     const iss = JSON.parse(String(await io.gh(["issue", "view", String(issue), "-R", repo, "--json", "number,title,body,state,labels,comments"])));
     if (String(iss.state).toUpperCase() !== "OPEN") return { ...out, detail: "not open" };
-    if ((iss.labels ?? []).some((l) => ["needs-human", "workflow:merged"].includes(l?.name ?? l))) return { ...out, detail: "labelled, left to the lane" };
+    const names = (iss.labels ?? []).map((l) => l?.name ?? l);
+    const labelled = names.some((l) => ["needs-human", "workflow:merged"].includes(l));
+    // #4389: a post-deploy follow-up is gated even when an earlier lane escalated it (needs-human); nothing else changes.
+    const gated = !!defaultBranch && !names.includes("workflow:merged") && deferredFrom(iss.body) != null && postDeployOnly(iss.body);
+    if (labelled && !gated) return { ...out, detail: "labelled, left to the lane" };
     if (io.projector) {
       let st = null;
       try { st = await io.projector.readState(issue); } catch { /* unreadable: proceed */ }
       if (st?.lease && st.lease.until > Date.now() && st.lease.by !== agentId) return { ...out, detail: `leased by ${st.lease.by}` };
     }
+    if (gated) {
+      const gate = await postDeployGate({ iss, repo, lane, defaultBranch, cwd, io, preconditionCmd });
+      const had = names.includes(AWAITING_PROMOTION_LABEL);
+      if (gate.state === "awaiting-promotion" || gate.state === "awaiting-precondition") {
+        if (!dryRun) await markParked({ issue, repo, io, had, gate });
+        return { ...out, parked: true, kind: gate.state, parent: gate.parent, lane, default: gate.default, detail: gate.detail };
+      }
+      if (gate.state === "ready" && had && !dryRun) {
+        try { await io.gh(["issue", "edit", String(issue), "-R", repo, "--remove-label", AWAITING_PROMOTION_LABEL]); } catch { /* best effort */ }
+      }
+      if (labelled) return { ...out, detail: `labelled, left to the lane (post-deploy gate: ${gate.state}${gate.detail ? `, ${gate.detail}` : ""})` };
+    }
+    // #4399: an issue reopened by a failed acceptance probe goes to a lane, never back to an already-fixed close
+    if ((iss.comments ?? []).some((c) => probeResultOf(c?.body)?.result === "fail")
+      && flakyReason({ comments: iss.comments }, await ownFor(iss, selfResolver(selfLogins, io.gh)))?.reason === "probe-failed") {
+      return { ...out, detail: "acceptance probe failed after promotion (FORGE:PROBE): no already-fixed close; lane" };
+    }
     const sig = await collectSignals({ iss, repo, lane, io, cwd, selfLogins });
     const close = async (kind, body, detail) => {
       let note = "";

package/bin/lean/prefilter.test.mjs

@@ -2,9 +2,9 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
-import { prefilterIssue, flakyReason, makePrefilter, ownLogins, resolveOwnLogins, formatPrefilterSummary, claimsFix, ciFailureRun, namedPaths, DEFAULT_PREFILTER_MODEL } from "./prefilter.mjs";
+import { prefilterIssue, flakyReason, makePrefilter, postDeployGate, postDeployOnly, deferredFrom, formatParkedLine, lazyDefaultBranch, ownLogins, resolveOwnLogins, formatPrefilterSummary, claimsFix, ciFailureRun, namedPaths, isTrustedIssueComment, DEFAULT_PREFILTER_MODEL } from "./prefilter.mjs";
 import { parsePrefilterVerdict, prefilterPrompt } from "./prompts.mjs";
-import { orchestrate, formatTable } from "./orchestrate.mjs";
+import { orchestrate, formatTable, formatOutcomeLists } from "./orchestrate.mjs";
 import { triageFromCli } from "../engine-cli.mjs";
 
 const fence = (o) => "```json\n" + JSON.stringify(o) + "\n```";
@@ -13,7 +13,7 @@ const fence = (o) => "```json\n" + JSON.stringify(o) + "\n```";
 function world(o = {}) {
   const w = { comments: [], closed: [], labels: [], runner: [], lanes: [], gitCalls: [],
     issues: o.issues ?? {}, prs: o.prs ?? [], commits: o.commits ?? "", paths: new Set(o.paths ?? []), runs: o.runs ?? {}, workflowRuns: o.workflowRuns ?? {}, shaRuns: o.shaRuns ?? {},
-    verdict: o.verdict ?? null };
+    verdict: o.verdict ?? null, mergedPrs: o.mergedPrs ?? [], ancestry: o.ancestry ?? {}, edits: [] };
   w.io = {
     gh: async (a) => {
       const k = a.slice(0, 2).join(" ");
@@ -30,6 +30,8 @@ function world(o = {}) {
       }
       if (k === "issue comment") { w.comments.push([Number(a[2]), a[a.indexOf("--body") + 1]]); return ""; }
       if (k === "issue close") { w.closed.push([Number(a[2]), a[a.indexOf("--reason") + 1]]); return ""; }
+      if (k === "pr list") return JSON.stringify(w.mergedPrs);
+      if (k === "issue edit") { w.edits.push([Number(a[2]), a[5], a[6]]); return ""; }
       throw new Error(`unexpected gh ${a.join(" ")}`);
     },
     git: async (a) => {
@@ -37,6 +39,7 @@ function world(o = {}) {
       if (a[0] === "log") return w.commits;
       if (a[0] === "cat-file") { if (w.paths.has(a[2].replace(/^origin\/staging:/, ""))) return ""; throw new Error("missing"); }
       if (a[0] === "fetch") return "";
+      if (a[0] === "merge-base") { const c = w.ancestry[a[2]] ?? 128; if (c === 0) return ""; throw Object.assign(new Error(`exit ${c}`), { code: c }); }
       if (a[0] === "ls-remote") return a.at(-1) === "refs/heads/staging" ? "abc\trefs/heads/staging\n" : "";
       throw new Error(`unexpected git ${a.join(" ")}`);
     },
@@ -71,6 +74,20 @@ describe("pre-filter (#4123)", () => {
     assert.match(w.comments[0][1], /FORGE:PREFILTER/); assert.match(w.comments[0][1], /src\/foo\.js:3 null guard/); assert.match(w.comments[0][1], /PR #90/);
   });
 
+  it("#4399 an issue reopened by a failed acceptance probe is never re-closed as already-fixed; a pass is no skip", async () => {
+    const probe = (result, author = { login: "rapiercraft-forgedock" }, assoc = "CONTRIBUTOR") => ({ author, authorAssociation: assoc,
+      body: `<!-- FORGE:PROBE -->\n## Acceptance probe: ${result}\n${JSON.stringify({ fix: "abc1234", default_sha: "d", result, exit: result === "pass" ? 0 : 1, ms: 5 })}` });
+    assert.deepEqual(flakyReason({ comments: [probe("fail")] }), { reason: "probe-failed", why: "acceptance probe failed after promotion" });
+    assert.equal(flakyReason({ comments: [probe("fail"), probe("pass")] }), null);
+    assert.equal(flakyReason({ comments: [probe("fail", { login: "someone" }, "NONE")] }), null);
+    const w = world({ issues: { 12: { title: "foo breaks", body: "foo crashes on null", comments: [probe("fail")] } },
+      prs: [{ number: 90, title: "fix: guard foo", body: "Fixes #12", url: "https://github.com/o/r/pull/90" }],
+      verdict: { verdict: "ALREADY-FIXED", summary: "guard added", evidence: ["src/foo.js:3"] } });
+    const r = await pf(w, 12);
+    assert.equal(r.closed, false); assert.match(r.detail, /acceptance probe failed after promotion/);
+    assert.equal(w.runner.length, 0); assert.deepEqual(w.closed, []); assert.deepEqual(w.comments, []);
+  });
+
   it("a candidate the validator CONFIRMS (or answers without evidence) is not closed", async () => {
     const mk = (verdict) => world({ issues: { 12: { body: "x" } }, prs: [{ number: 90, title: "fix (#12)", body: "" }], verdict });
     for (const v of [{ verdict: "CONFIRMED", evidence: ["src/foo.js:3 still derefs"] }, { verdict: "ALREADY-FIXED", evidence: [] }, null]) {
@@ -338,3 +355,135 @@ describe("#4318: the engine's own identity under an installation token or a diff
     assert.equal(lookups, 4, "user + app, twice: one retry, then cached");
   });
 });
+
+describe("post-deploy precondition gate (#4389)", () => {
+  const MERGE = "a".repeat(40);
+  const item = (id, disp) => `- [ ] \`${id}: After the next scheduled run, a health row exists\` — ${disp}: only checkable in prod after promotion`;
+  const followup = (parent, items) => `## Problem\n\nDeferred from #${parent}: the items below were declared out of scope.\n\n## Acceptance Criteria\n\n${items.join("\n")}\n\n<!-- FORGE:DEFERRED_FROM: #${parent} -->\n`;
+  const parentPr = [{ number: 90, title: "fix(x): health row (#40)", body: "", mergeCommit: { oid: MERGE } }];
+  const gated = (w, n, extra = {}) => pf(w, n, { defaultBranch: "main", ...extra });
+
+  it("parses the marker and requires every checklist item to be post-deploy", () => {
+    const body = followup(40, [item("R2", "post-deploy")]);
+    assert.equal(deferredFrom(body), 40);
+    assert.equal(deferredFrom("no marker"), null);
+    assert.ok(postDeployOnly(body));
+    assert.ok(!postDeployOnly(followup(40, [item("R2", "post-deploy"), item("R3", "defer")])));
+    assert.ok(!postDeployOnly("no checklist"));
+  });
+
+  it("not an ancestor of the default branch: parked awaiting-promotion, labelled and explained once, no validation run, $0", async () => {
+    const w = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]) } }, mergedPrs: parentPr, ancestry: { [MERGE]: 1 } });
+    const r = await gated(w, 41);
+    assert.equal(r.parked, true); assert.equal(r.kind, "awaiting-promotion"); assert.equal(r.closed, false); assert.equal(r.cost_usd, 0);
+    assert.match(r.detail, /of #40 is not on main/);
+    assert.deepEqual(w.edits, [[41, "--add-label", "awaiting-promotion"]]);
+    assert.equal(w.comments.length, 1); assert.match(w.comments[0][1], /FORGE:PRECONDITION/);
+    assert.equal(w.runner.length, 0); assert.deepEqual(w.closed, []);
+    // already labelled: no second comment
+    const w2 = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]), labels: [{ name: "awaiting-promotion" }] } }, mergedPrs: parentPr, ancestry: { [MERGE]: 1 } });
+    assert.equal((await gated(w2, 41)).parked, true);
+    assert.equal(w2.comments.length, 0);
+  });
+
+  it("an escalated (needs-human) promotion follow-up is parked too; a dry run changes nothing on GitHub", async () => {
+    const w = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]), labels: [{ name: "needs-human" }] } }, mergedPrs: parentPr, ancestry: { [MERGE]: 1 } });
+    const r = await gated(w, 41, { dryRun: true });
+    assert.equal(r.parked, true);
+    assert.deepEqual(w.edits, []); assert.deepEqual(w.comments, []);
+  });
+
+  it("an ancestor (after promotion): not parked, the label is removed, and the issue goes on as before", async () => {
+    const w = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]), labels: [{ name: "awaiting-promotion" }] } }, mergedPrs: parentPr, ancestry: { [MERGE]: 0 } });
+    const r = await gated(w, 41);
+    assert.ok(!r.parked); assert.equal(r.detail, "no already-fixed signal");
+    assert.deepEqual(w.edits, [[41, "--remove-label", "awaiting-promotion"]]);
+    const rows = await orchestrate({ issues: [41], readBody: async () => "", prefilter: makePrefilter({ repo: "o/r", cwd: "/repo", io: w.io, defaultBranch: "main" }),
+      runOne: async () => ({ terminalReason: "merged", pr: 7, cost_usd: 1 }) });
+    assert.deepEqual(rows.map((x) => x.outcome), ["merged"]);
+  });
+
+  it("an unresolvable parent (no merged PR, no trajectory) or an unknown SHA falls through to the lane", async () => {
+    const w = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]) }, 40: { comments: [] } } });
+    const r = await gated(w, 41);
+    assert.ok(!r.parked); assert.deepEqual(w.edits, []);
+    const g = await postDeployGate({ iss: { number: 41, body: followup(40, [item("R2", "post-deploy")]) }, repo: "o/r", lane: "staging", defaultBranch: "main", cwd: "/repo",
+      io: world({ mergedPrs: parentPr, ancestry: { [MERGE]: 128 } }).io });
+    assert.equal(g.state, "unresolved");
+    assert.equal((await postDeployGate({ iss: { number: 41, body: followup(40, [item("R2", "post-deploy")]) }, repo: "o/r", defaultBranch: async () => null, io: world().io })).state, "unresolved");
+  });
+
+  it("the trusted trajectory 'merged at <sha>' is the fallback when no merged PR names the parent", async () => {
+    const w = world({ issues: { 40: { comments: [{ author: { login: "rapiercraft-forgedock" }, authorAssociation: "CONTRIBUTOR", body: "<!-- FORGE:TRAJECTORY -->\n| Merge | merged at abcdef123456 |" },
+      { author: { login: "mallory" }, authorAssociation: "NONE", body: "<!-- FORGE:TRAJECTORY --> merged at 0123456789ab" }] } }, ancestry: { abcdef123456: 1 } });
+    const g = await postDeployGate({ iss: { number: 41, body: followup(40, [item("R2", "post-deploy")]) }, repo: "o/r", lane: "staging", defaultBranch: "main", cwd: "/repo", io: w.io });
+    assert.equal(g.state, "awaiting-promotion"); assert.deepEqual(g.shas, ["abcdef123456"]);
+  });
+
+  it("mixed post-deploy + code items, and issues without DEFERRED_FROM, are unaffected (no gate calls)", async () => {
+    for (const body of [followup(40, [item("R2", "post-deploy"), item("R3", "defer")]), item("R2", "post-deploy")]) {
+      const w = world({ issues: { 41: { body } }, mergedPrs: parentPr, ancestry: { [MERGE]: 1 } });
+      const r = await gated(w, 41);
+      assert.ok(!r.parked); assert.ok(!w.gitCalls.some((a) => a[0] === "merge-base"));
+    }
+    const w = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]), labels: [{ name: "needs-human" }] } } });
+    assert.equal((await pf(w, 41)).detail, "labelled, left to the lane"); // no default branch: gate off, today's behaviour
+  });
+
+  it("post_deploy.precondition_cmd: exit 0 ready, exit 1 parked awaiting-precondition, other exits fail open", async () => {
+    const body = followup(40, [item("R2", "post-deploy")]);
+    for (const [code, state] of [[0, "ready"], [1, "awaiting-precondition"], [2, "unresolved"], [-1, "unresolved"]]) {
+      const w = world({ mergedPrs: parentPr, ancestry: { [MERGE]: 0 } });
+      const calls = [];
+      w.io.execCode = async (cmd, args, opts) => { calls.push([cmd, args, opts.env.FORGE_ISSUE]); return code; };
+      const g = await postDeployGate({ iss: { number: 41, body }, repo: "o/r", lane: "staging", defaultBranch: "main", cwd: "/repo", io: w.io, preconditionCmd: "check-rollout" });
+      assert.equal(g.state, state);
+      assert.deepEqual(calls, [["sh", ["-c", "check-rollout", "precondition", "41"], "41"]]);
+    }
+  });
+
+  it("forgedock triage prints a parked issue, one awaiting-promotion line, and leaves it out of the lanes", async () => {
+    const w = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]) }, 13: { body: "y" } }, mergedPrs: parentPr, ancestry: { [MERGE]: 1 } });
+    const logs = []; const l = console.log; console.log = (x) => logs.push(String(x));
+    let res;
+    try { res = await triageFromCli(["41", "13", "--repo", "o/r", "--lane", "staging", "--dry-run"], { leanIo: w.io }); } finally { console.log = l; }
+    assert.deepEqual(res.lanes, [13]);
+    assert.ok(logs.some((x) => /^#41 → parked \(awaiting-promotion: /.test(x)));
+    assert.ok(logs.includes("awaiting promotion: #41 (fixes on staging, not on main)"));
+    assert.deepEqual(w.edits, []);
+  });
+
+  it("lazyDefaultBranch resolves GitHub's default and fetches it once, only when asked", async () => {
+    const w = world();
+    const d = lazyDefaultBranch({ io: w.io, repo: "o/r", cwd: "/repo" });
+    assert.equal(w.gitCalls.length, 0);
+    assert.equal(await d(), "main"); assert.equal(await d(), "main");
+    assert.deepEqual(w.gitCalls, [["fetch", "origin", "main"]]);
+  });
+
+  it("orchestrate: parked issues start no lane and the report has one awaiting-promotion line, no escalations", async () => {
+    const issues = {}; for (const n of [41, 42, 43]) issues[n] = { body: followup(40, [item("R2", "post-deploy")]) };
+    const w = world({ issues, mergedPrs: parentPr, ancestry: { [MERGE]: 1 } });
+    const lanes = [];
+    const rows = await orchestrate({ issues: [41, 42, 43], readBody: async () => "", prefilter: makePrefilter({ repo: "o/r", cwd: "/repo", io: w.io, defaultBranch: "main" }),
+      resolveLane: async () => ({ ok: true, lane: "staging" }),
+      runOne: async (n) => { lanes.push(n); return { terminalReason: "merged", pr: 1, cost_usd: 1 }; } });
+    assert.deepEqual(lanes, []);
+    assert.deepEqual(rows.map((r) => [r.outcome, r.cost_usd]), [["awaiting-promotion", 0], ["awaiting-promotion", 0], ["awaiting-promotion", 0]]);
+    const lists = formatOutcomeLists(rows);
+    assert.deepEqual(lists, ["awaiting promotion: #41 #42 #43 (fixes on staging, not on main)"]);
+    assert.match(formatTable(rows), /#41\s+awaiting-promotion \(pre-filter\)/);
+    assert.equal(formatParkedLine([{ issue: 1, outcome: "merged" }]), "");
+  });
+});
+
+describe("#4467: isTrustedIssueComment", () => {
+  it("trusts the App in gh issue view and REST shapes and trusted associations; not other contributors", () => {
+    assert.equal(isTrustedIssueComment({ author: { login: "rapiercraft-forgedock" }, authorAssociation: "CONTRIBUTOR" }), true);
+    assert.equal(isTrustedIssueComment({ user: { login: "rapiercraft-forgedock[bot]", type: "Bot" }, author_association: "NONE" }), true);
+    assert.equal(isTrustedIssueComment({ author: { login: "app/rapiercraft-forgedock" }, authorAssociation: "NONE" }), true);
+    assert.equal(isTrustedIssueComment({ author: { login: "owner" }, authorAssociation: "OWNER" }), true);
+    assert.equal(isTrustedIssueComment({ author: { login: "someone" }, authorAssociation: "CONTRIBUTOR" }), false);
+    assert.equal(isTrustedIssueComment(null), false);
+  });
+});