forgedock 1.30.0 → 1.32.0

package/bin/lean/prefilter.test.mjs

@@ -2,10 +2,14 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
-import { prefilterIssue, flakyReason, makePrefilter, ownLogins, resolveOwnLogins, formatPrefilterSummary, claimsFix, ciFailureRun, namedPaths, DEFAULT_PREFILTER_MODEL } from "./prefilter.mjs";
+import { prefilterIssue, flakyReason, makePrefilter, postDeployGate, postDeployOnly, deferredFrom, formatParkedLine, lazyDefaultBranch, ownLogins, resolveOwnLogins, formatPrefilterSummary, claimsFix, ciFailureRun, namedPaths, isTrustedIssueComment, DEFAULT_PREFILTER_MODEL, parseMinAge, itemWindowsMs, landedAt } from "./prefilter.mjs";
+import { writeFileSync } from "node:fs";
+import { tmpDir } from "../tests/_tmp.mjs";
+import { execFileSync } from "node:child_process";
+import { join } from "node:path";
 import { parsePrefilterVerdict, prefilterPrompt } from "./prompts.mjs";
-import { orchestrate, formatTable } from "./orchestrate.mjs";
-import { triageFromCli } from "../engine-cli.mjs";
+import { orchestrate, formatTable, formatOutcomeLists } from "./orchestrate.mjs";
+import { triageFromCli, readPostDeployMinAge } from "../engine-cli.mjs";
 
 const fence = (o) => "```json\n" + JSON.stringify(o) + "\n```";
 
@@ -13,7 +17,7 @@ const fence = (o) => "```json\n" + JSON.stringify(o) + "\n```";
 function world(o = {}) {
   const w = { comments: [], closed: [], labels: [], runner: [], lanes: [], gitCalls: [],
     issues: o.issues ?? {}, prs: o.prs ?? [], commits: o.commits ?? "", paths: new Set(o.paths ?? []), runs: o.runs ?? {}, workflowRuns: o.workflowRuns ?? {}, shaRuns: o.shaRuns ?? {},
-    verdict: o.verdict ?? null };
+    verdict: o.verdict ?? null, mergedPrs: o.mergedPrs ?? [], ancestry: o.ancestry ?? {}, edits: [] };
   w.io = {
     gh: async (a) => {
       const k = a.slice(0, 2).join(" ");
@@ -30,6 +34,8 @@ function world(o = {}) {
       }
       if (k === "issue comment") { w.comments.push([Number(a[2]), a[a.indexOf("--body") + 1]]); return ""; }
       if (k === "issue close") { w.closed.push([Number(a[2]), a[a.indexOf("--reason") + 1]]); return ""; }
+      if (k === "pr list") return JSON.stringify(w.mergedPrs);
+      if (k === "issue edit") { w.edits.push([Number(a[2]), a[5], a[6]]); return ""; }
       throw new Error(`unexpected gh ${a.join(" ")}`);
     },
     git: async (a) => {
@@ -37,6 +43,7 @@ function world(o = {}) {
       if (a[0] === "log") return w.commits;
       if (a[0] === "cat-file") { if (w.paths.has(a[2].replace(/^origin\/staging:/, ""))) return ""; throw new Error("missing"); }
       if (a[0] === "fetch") return "";
+      if (a[0] === "merge-base") { const c = w.ancestry[a[2]] ?? 128; if (c === 0) return ""; throw Object.assign(new Error(`exit ${c}`), { code: c }); }
       if (a[0] === "ls-remote") return a.at(-1) === "refs/heads/staging" ? "abc\trefs/heads/staging\n" : "";
       throw new Error(`unexpected git ${a.join(" ")}`);
     },
@@ -71,6 +78,20 @@ describe("pre-filter (#4123)", () => {
     assert.match(w.comments[0][1], /FORGE:PREFILTER/); assert.match(w.comments[0][1], /src\/foo\.js:3 null guard/); assert.match(w.comments[0][1], /PR #90/);
   });
 
+  it("#4399 an issue reopened by a failed acceptance probe is never re-closed as already-fixed; a pass is no skip", async () => {
+    const probe = (result, author = { login: "rapiercraft-forgedock" }, assoc = "CONTRIBUTOR") => ({ author, authorAssociation: assoc,
+      body: `<!-- FORGE:PROBE -->\n## Acceptance probe: ${result}\n${JSON.stringify({ fix: "abc1234", default_sha: "d", result, exit: result === "pass" ? 0 : 1, ms: 5 })}` });
+    assert.deepEqual(flakyReason({ comments: [probe("fail")] }), { reason: "probe-failed", why: "acceptance probe failed after promotion" });
+    assert.equal(flakyReason({ comments: [probe("fail"), probe("pass")] }), null);
+    assert.equal(flakyReason({ comments: [probe("fail", { login: "someone" }, "NONE")] }), null);
+    const w = world({ issues: { 12: { title: "foo breaks", body: "foo crashes on null", comments: [probe("fail")] } },
+      prs: [{ number: 90, title: "fix: guard foo", body: "Fixes #12", url: "https://github.com/o/r/pull/90" }],
+      verdict: { verdict: "ALREADY-FIXED", summary: "guard added", evidence: ["src/foo.js:3"] } });
+    const r = await pf(w, 12);
+    assert.equal(r.closed, false); assert.match(r.detail, /acceptance probe failed after promotion/);
+    assert.equal(w.runner.length, 0); assert.deepEqual(w.closed, []); assert.deepEqual(w.comments, []);
+  });
+
   it("a candidate the validator CONFIRMS (or answers without evidence) is not closed", async () => {
     const mk = (verdict) => world({ issues: { 12: { body: "x" } }, prs: [{ number: 90, title: "fix (#12)", body: "" }], verdict });
     for (const v of [{ verdict: "CONFIRMED", evidence: ["src/foo.js:3 still derefs"] }, { verdict: "ALREADY-FIXED", evidence: [] }, null]) {
@@ -338,3 +359,238 @@ describe("#4318: the engine's own identity under an installation token or a diff
     assert.equal(lookups, 4, "user + app, twice: one retry, then cached");
   });
 });
+
+describe("post-deploy precondition gate (#4389)", () => {
+  const MERGE = "a".repeat(40);
+  const item = (id, disp) => `- [ ] \`${id}: After the next scheduled run, a health row exists\` — ${disp}: only checkable in prod after promotion`;
+  const followup = (parent, items) => `## Problem\n\nDeferred from #${parent}: the items below were declared out of scope.\n\n## Acceptance Criteria\n\n${items.join("\n")}\n\n<!-- FORGE:DEFERRED_FROM: #${parent} -->\n`;
+  const parentPr = [{ number: 90, title: "fix(x): health row (#40)", body: "", mergeCommit: { oid: MERGE } }];
+  const gated = (w, n, extra = {}) => pf(w, n, { defaultBranch: "main", ...extra });
+
+  it("parses the marker and requires every checklist item to be post-deploy", () => {
+    const body = followup(40, [item("R2", "post-deploy")]);
+    assert.equal(deferredFrom(body), 40);
+    assert.equal(deferredFrom("no marker"), null);
+    assert.ok(postDeployOnly(body));
+    assert.ok(!postDeployOnly(followup(40, [item("R2", "post-deploy"), item("R3", "defer")])));
+    assert.ok(!postDeployOnly("no checklist"));
+  });
+
+  it("not an ancestor of the default branch: parked awaiting-promotion, labelled and explained once, no validation run, $0", async () => {
+    const w = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]) } }, mergedPrs: parentPr, ancestry: { [MERGE]: 1 } });
+    const r = await gated(w, 41);
+    assert.equal(r.parked, true); assert.equal(r.kind, "awaiting-promotion"); assert.equal(r.closed, false); assert.equal(r.cost_usd, 0);
+    assert.match(r.detail, /of #40 is not on main/);
+    assert.deepEqual(w.edits, [[41, "--add-label", "awaiting-promotion"]]);
+    assert.equal(w.comments.length, 1); assert.match(w.comments[0][1], /FORGE:PRECONDITION/);
+    assert.equal(w.runner.length, 0); assert.deepEqual(w.closed, []);
+    // already labelled: no second comment
+    const w2 = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]), labels: [{ name: "awaiting-promotion" }] } }, mergedPrs: parentPr, ancestry: { [MERGE]: 1 } });
+    assert.equal((await gated(w2, 41)).parked, true);
+    assert.equal(w2.comments.length, 0);
+  });
+
+  it("an escalated (needs-human) promotion follow-up is parked too; a dry run changes nothing on GitHub", async () => {
+    const w = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]), labels: [{ name: "needs-human" }] } }, mergedPrs: parentPr, ancestry: { [MERGE]: 1 } });
+    const r = await gated(w, 41, { dryRun: true });
+    assert.equal(r.parked, true);
+    assert.deepEqual(w.edits, []); assert.deepEqual(w.comments, []);
+  });
+
+  it("an ancestor (after promotion): not parked, the label is removed, and the issue goes on as before", async () => {
+    const w = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]), labels: [{ name: "awaiting-promotion" }] } }, mergedPrs: parentPr, ancestry: { [MERGE]: 0 } });
+    const r = await gated(w, 41);
+    assert.ok(!r.parked); assert.equal(r.detail, "no already-fixed signal");
+    assert.deepEqual(w.edits, [[41, "--remove-label", "awaiting-promotion"]]);
+    const rows = await orchestrate({ issues: [41], readBody: async () => "", prefilter: makePrefilter({ repo: "o/r", cwd: "/repo", io: w.io, defaultBranch: "main" }),
+      runOne: async () => ({ terminalReason: "merged", pr: 7, cost_usd: 1 }) });
+    assert.deepEqual(rows.map((x) => x.outcome), ["merged"]);
+  });
+
+  it("an unresolvable parent (no merged PR, no trajectory) or an unknown SHA falls through to the lane", async () => {
+    const w = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]) }, 40: { comments: [] } } });
+    const r = await gated(w, 41);
+    assert.ok(!r.parked); assert.deepEqual(w.edits, []);
+    const g = await postDeployGate({ iss: { number: 41, body: followup(40, [item("R2", "post-deploy")]) }, repo: "o/r", lane: "staging", defaultBranch: "main", cwd: "/repo",
+      io: world({ mergedPrs: parentPr, ancestry: { [MERGE]: 128 } }).io });
+    assert.equal(g.state, "unresolved");
+    assert.equal((await postDeployGate({ iss: { number: 41, body: followup(40, [item("R2", "post-deploy")]) }, repo: "o/r", defaultBranch: async () => null, io: world().io })).state, "unresolved");
+  });
+
+  it("the trusted trajectory 'merged at <sha>' is the fallback when no merged PR names the parent", async () => {
+    const w = world({ issues: { 40: { comments: [{ author: { login: "rapiercraft-forgedock" }, authorAssociation: "CONTRIBUTOR", body: "<!-- FORGE:TRAJECTORY -->\n| Merge | merged at abcdef123456 |" },
+      { author: { login: "mallory" }, authorAssociation: "NONE", body: "<!-- FORGE:TRAJECTORY --> merged at 0123456789ab" }] } }, ancestry: { abcdef123456: 1 } });
+    const g = await postDeployGate({ iss: { number: 41, body: followup(40, [item("R2", "post-deploy")]) }, repo: "o/r", lane: "staging", defaultBranch: "main", cwd: "/repo", io: w.io });
+    assert.equal(g.state, "awaiting-promotion"); assert.deepEqual(g.shas, ["abcdef123456"]);
+  });
+
+  it("mixed post-deploy + code items, and issues without DEFERRED_FROM, are unaffected (no gate calls)", async () => {
+    for (const body of [followup(40, [item("R2", "post-deploy"), item("R3", "defer")]), item("R2", "post-deploy")]) {
+      const w = world({ issues: { 41: { body } }, mergedPrs: parentPr, ancestry: { [MERGE]: 1 } });
+      const r = await gated(w, 41);
+      assert.ok(!r.parked); assert.ok(!w.gitCalls.some((a) => a[0] === "merge-base"));
+    }
+    const w = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]), labels: [{ name: "needs-human" }] } } });
+    assert.equal((await pf(w, 41)).detail, "labelled, left to the lane"); // no default branch: gate off, today's behaviour
+  });
+
+  it("post_deploy.precondition_cmd: exit 0 ready, exit 1 parked awaiting-precondition, other exits fail open", async () => {
+    const body = followup(40, [item("R2", "post-deploy")]);
+    for (const [code, state] of [[0, "ready"], [1, "awaiting-precondition"], [2, "unresolved"], [-1, "unresolved"]]) {
+      const w = world({ mergedPrs: parentPr, ancestry: { [MERGE]: 0 } });
+      const calls = [];
+      w.io.execCode = async (cmd, args, opts) => { calls.push([cmd, args, opts.env.FORGE_ISSUE]); return code; };
+      const g = await postDeployGate({ iss: { number: 41, body }, repo: "o/r", lane: "staging", defaultBranch: "main", cwd: "/repo", io: w.io, preconditionCmd: "check-rollout" });
+      assert.equal(g.state, state);
+      assert.deepEqual(calls, [["sh", ["-c", "check-rollout", "precondition", "41"], "41"]]);
+    }
+  });
+
+  it("forgedock triage prints a parked issue, one awaiting-promotion line, and leaves it out of the lanes", async () => {
+    const w = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]) }, 13: { body: "y" } }, mergedPrs: parentPr, ancestry: { [MERGE]: 1 } });
+    const logs = []; const l = console.log; console.log = (x) => logs.push(String(x));
+    let res;
+    try { res = await triageFromCli(["41", "13", "--repo", "o/r", "--lane", "staging", "--dry-run"], { leanIo: w.io }); } finally { console.log = l; }
+    assert.deepEqual(res.lanes, [13]);
+    assert.ok(logs.some((x) => /^#41 → parked \(awaiting-promotion: /.test(x)));
+    assert.ok(logs.includes("awaiting promotion: #41 (fixes on staging, not on main)"));
+    assert.deepEqual(w.edits, []);
+  });
+
+  it("lazyDefaultBranch resolves GitHub's default and fetches it once, only when asked", async () => {
+    const w = world();
+    const d = lazyDefaultBranch({ io: w.io, repo: "o/r", cwd: "/repo" });
+    assert.equal(w.gitCalls.length, 0);
+    assert.equal(await d(), "main"); assert.equal(await d(), "main");
+    assert.deepEqual(w.gitCalls, [["fetch", "origin", "main"]]);
+  });
+
+  it("orchestrate: parked issues start no lane and the report has one awaiting-promotion line, no escalations", async () => {
+    const issues = {}; for (const n of [41, 42, 43]) issues[n] = { body: followup(40, [item("R2", "post-deploy")]) };
+    const w = world({ issues, mergedPrs: parentPr, ancestry: { [MERGE]: 1 } });
+    const lanes = [];
+    const rows = await orchestrate({ issues: [41, 42, 43], readBody: async () => "", prefilter: makePrefilter({ repo: "o/r", cwd: "/repo", io: w.io, defaultBranch: "main" }),
+      resolveLane: async () => ({ ok: true, lane: "staging" }),
+      runOne: async (n) => { lanes.push(n); return { terminalReason: "merged", pr: 1, cost_usd: 1 }; } });
+    assert.deepEqual(lanes, []);
+    assert.deepEqual(rows.map((r) => [r.outcome, r.cost_usd]), [["awaiting-promotion", 0], ["awaiting-promotion", 0], ["awaiting-promotion", 0]]);
+    const lists = formatOutcomeLists(rows);
+    assert.deepEqual(lists, ["awaiting promotion: #41 #42 #43 (fixes on staging, not on main)"]);
+    assert.match(formatTable(rows), /#41\s+awaiting-promotion \(pre-filter\)/);
+    assert.equal(formatParkedLine([{ issue: 1, outcome: "merged" }]), "");
+  });
+});
+
+describe("post_deploy.min_age soak window (#4425)", () => {
+  const MERGE = "a".repeat(40), PROMO = "b".repeat(40), MAIN = "c".repeat(40);
+  const H = 3600, LANDED = 1_800_000_000; // unix seconds of the promotion merge
+  const item = (id, why) => `- [ ] \`${id}: a health row exists\` — post-deploy: ${why}`;
+  const followup = (items) => `## Acceptance Criteria\n\n${items.join("\n")}\n\n<!-- FORGE:DEFERRED_FROM: #40 -->\n`;
+  const parentPr = [{ number: 90, title: "fix(x): health row (#40)", body: "", mergeCommit: { oid: MERGE } }];
+  // the parent fix reached main through promotion merge PROMO (first parent MAIN) at LANDED
+  const soakWorld = (o = {}) => {
+    const w = world({ mergedPrs: parentPr, ancestry: { [MERGE]: 0 }, ...o });
+    const git = w.io.git;
+    w.io.git = async (a, opts) => {
+      if (a[0] === "log" && a[1] === "--first-parent") { w.gitCalls.push(a); return o.walk ?? `${"d".repeat(40)} ${PROMO} ${LANDED + 9 * H}\n${PROMO} ${MAIN} ${MERGE} ${LANDED}\n${MAIN} ${"e".repeat(40)} ${LANDED - H}\n`; }
+      if (a[0] === "rev-list") { w.gitCalls.push(a); return o.below ?? `${"d".repeat(40)}\n${PROMO}\n`; }
+      if (a[0] === "log" && a[1] === "-1") { w.gitCalls.push(a); return String(LANDED - 5 * H); }
+      return git(a, opts);
+    };
+    return w;
+  };
+  const gate = (w, body, extra = {}) => postDeployGate({ iss: { number: 41, body }, repo: "o/r", lane: "staging", defaultBranch: "main", cwd: "/repo", io: w.io, ...extra });
+
+  it("parses min_age and the windows each post-deploy item's why states (largest wins, none -> null)", () => {
+    assert.equal(parseMinAge("24h"), 24 * H * 1000); assert.equal(parseMinAge("7d"), 7 * 24 * H * 1000); assert.equal(parseMinAge("2w"), 14 * 24 * H * 1000);
+    assert.equal(parseMinAge("30m"), 30 * 60e3); assert.equal(parseMinAge("0"), 0); assert.equal(parseMinAge(90), 90 * 60e3);
+    assert.equal(parseMinAge("soon"), null); assert.equal(parseMinAge(null), null);
+    assert.deepEqual(itemWindowsMs(followup([item("R1", "after 24h of traffic, then 7 days of retention"), item("R2", "only in prod")])), [7 * 24 * H * 1000, null]);
+  });
+
+  it("landedAt: the promotion merge time, or the SHA's own time when it is on the mainline", async () => {
+    const w = soakWorld();
+    assert.equal(await landedAt({ sha: MERGE, def: "main", io: w.io, cwd: "/repo" }), LANDED);
+    assert.deepEqual(w.gitCalls.slice(0, 2), [["rev-list", "--ancestry-path", `${MERGE}..origin/main`], ["log", "--first-parent", "--format=%H %P %ct", `${MERGE}..origin/main`]]);
+    const own = soakWorld({ walk: `${PROMO} ${MERGE} ${LANDED}\n`, below: `${PROMO}\n` });
+    assert.equal(await landedAt({ sha: MERGE, def: "main", io: own.io, cwd: "/repo" }), LANDED - 5 * H);
+    const tip = soakWorld({ walk: "", below: "" });
+    assert.equal(await landedAt({ sha: MERGE, def: "main", io: tip.io, cwd: "/repo" }), LANDED - 5 * H);
+  });
+
+  it("landedAt on a real repo: the promotion merge that brought a staging fix in through its second parent", async () => {
+    const d = tmpDir("landed-");
+    const run = (args, t) => execFileSync("git", args, { cwd: d, encoding: "utf8", env: { ...process.env, GIT_AUTHOR_DATE: `@${t} +0000`, GIT_COMMITTER_DATE: `@${t} +0000`,
+      GIT_AUTHOR_NAME: "t", GIT_AUTHOR_EMAIL: "t@t", GIT_COMMITTER_NAME: "t", GIT_COMMITTER_EMAIL: "t@t", GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_NOSYSTEM: "1" } }).trim();
+    run(["init", "-q", "-b", "main"], 1);
+    run(["commit", "-q", "--allow-empty", "-m", "base"], LANDED - 10 * H);
+    run(["checkout", "-q", "-b", "staging"], 1);
+    run(["commit", "-q", "--allow-empty", "-m", "fix"], LANDED - 8 * H);
+    const fix = run(["rev-parse", "HEAD"], 1);
+    run(["checkout", "-q", "main"], 1);
+    run(["commit", "-q", "--allow-empty", "-m", "hotfix on main"], LANDED - 2 * H);
+    run(["merge", "-q", "--no-ff", "-m", "promote", "staging"], LANDED);
+    run(["commit", "-q", "--allow-empty", "-m", "later"], LANDED + 5 * H);
+    run(["update-ref", "refs/remotes/origin/main", "HEAD"], 1);
+    const io = { git: async (a, o) => run(a, 1) + "\n" };
+    assert.equal(await landedAt({ sha: fix, def: "main", io, cwd: d }), LANDED);
+    assert.equal(await landedAt({ sha: fix.slice(0, 12), def: "main", io, cwd: d }), LANDED);
+    assert.equal(await landedAt({ sha: run(["rev-parse", "HEAD~1^1"], 1), def: "main", io, cwd: d }), LANDED - 2 * H); // on the mainline itself
+    assert.equal(await landedAt({ sha: "f".repeat(40), def: "main", io, cwd: d }), null);
+  });
+
+  it("parks awaiting-min-age until max(item window ?? min_age) after landing, then is ready", async () => {
+    const body = followup([item("R1", "wait 7d of production data"), item("R2", "only in prod")]);
+    const g = await gate(soakWorld(), body, { minAge: parseMinAge("24h"), now: (LANDED + 48 * H) * 1000 });
+    assert.equal(g.state, "awaiting-min-age");
+    assert.equal(g.eligibleAt, new Date((LANDED + 7 * 24 * H) * 1000).toISOString());
+    assert.match(g.detail, /^fix of #40 on main since .*; min age 7d until /);
+    // no stated window: the min_age floor applies
+    const short = followup([item("R2", "only in prod")]);
+    assert.equal((await gate(soakWorld(), short, { minAge: parseMinAge("24h"), now: (LANDED + 23 * H) * 1000 })).state, "awaiting-min-age");
+    assert.equal((await gate(soakWorld(), short, { minAge: parseMinAge("24h"), now: (LANDED + 25 * H) * 1000 })).state, "ready");
+    assert.equal((await gate(soakWorld(), body, { minAge: 0, now: (LANDED + 8 * 24 * H) * 1000 })).state, "ready");
+  });
+
+  it("unset min_age changes nothing (no landing-time git calls); an unknown landing time fails open", async () => {
+    const w = soakWorld();
+    assert.equal((await gate(w, followup([item("R1", "wait 7d")]))).state, "ready");
+    assert.ok(!w.gitCalls.some((a) => a[0] === "log" || a[0] === "rev-list"));
+    const broken = soakWorld();
+    const git = broken.io.git;
+    broken.io.git = async (a, o) => { if (a[0] === "rev-list") throw Object.assign(new Error("bad"), { code: 128 }); return git(a, o); };
+    const g = await gate(broken, followup([item("R1", "wait 7d")]), { minAge: 0 });
+    assert.equal(g.state, "unresolved"); assert.match(g.detail, /landing time of aaaaaaaaaaaa on main unknown/);
+  });
+
+  it("prefilterIssue parks it with the awaiting-promotion label, one comment, and an 'awaiting min age:' report line", async () => {
+    const w = soakWorld({ issues: { 41: { body: followup([item("R1", "wait 7d")]) } } });
+    w.io.now = () => (LANDED + H) * 1000;
+    const r = await pf(w, 41, { defaultBranch: "main", minAge: parseMinAge("24h") });
+    assert.equal(r.parked, true); assert.equal(r.kind, "awaiting-min-age"); assert.equal(r.cost_usd, 0);
+    assert.deepEqual(w.edits, [[41, "--add-label", "awaiting-promotion"]]);
+    assert.equal(w.comments.length, 1); assert.match(w.comments[0][1], /Parked: awaiting its post-deploy soak window/);
+    assert.equal(formatParkedLine([{ issue: 41, prefilter: r }, { issue: 42, prefilter: { parked: true, kind: "awaiting-promotion", lane: "staging", default: "main" } }]),
+      "awaiting promotion: #42 (fixes on staging, not on main)\nawaiting min age: #41 (fix on main, soak window not elapsed)");
+  });
+
+  it("readPostDeployMinAge reads forge.yaml post_deploy.min_age; absent or invalid -> null", async () => {
+    const d = tmpDir("minage-");
+    assert.equal(await readPostDeployMinAge(d), null);
+    writeFileSync(join(d, "forge.yaml"), "post_deploy:\n  min_age: \"24h\"\n");
+    assert.equal(await readPostDeployMinAge(d), 24 * H * 1000);
+    writeFileSync(join(d, "forge.yaml"), "post_deploy:\n  min_age: later\n");
+    assert.equal(await readPostDeployMinAge(d), null);
+  });
+});
+
+describe("#4467: isTrustedIssueComment", () => {
+  it("trusts the App in gh issue view and REST shapes and trusted associations; not other contributors", () => {
+    assert.equal(isTrustedIssueComment({ author: { login: "rapiercraft-forgedock" }, authorAssociation: "CONTRIBUTOR" }), true);
+    assert.equal(isTrustedIssueComment({ user: { login: "rapiercraft-forgedock[bot]", type: "Bot" }, author_association: "NONE" }), true);
+    assert.equal(isTrustedIssueComment({ author: { login: "app/rapiercraft-forgedock" }, authorAssociation: "NONE" }), true);
+    assert.equal(isTrustedIssueComment({ author: { login: "owner" }, authorAssociation: "OWNER" }), true);
+    assert.equal(isTrustedIssueComment({ author: { login: "someone" }, authorAssociation: "CONTRIBUTOR" }), false);
+    assert.equal(isTrustedIssueComment(null), false);
+  });
+});

package/bin/lean/preflight.mjs

@@ -5,11 +5,15 @@
  * (each segment's bare executable, Python modules a bare python imports via -c/-m, Node packages `node -e` code imports)
  * and a read-only bash probe for each. The engine runs the probes (lean.mjs) before the implement session, so a validate
  * command the host cannot run is corrected in the plan instead of found after the build (#4323 env.tool_missing).
+ * #4393: text alone misses wrapped interpreters (`uv run python -m x`) and transitive imports, so `runPreflight` also runs
+ * each command once on the base worktree and classifies its output (`runProbeMiss`); `unsetEnvVars` flags `$NAME`s the lane
+ * env leaves empty (#4325).
  */
 import { builtinModules } from "node:module";
+import { missingTool } from "./conformance.mjs";
 
 export const PREFLIGHT_CAP = 20;
-const KIND_NAME = { command: "command", "python-module": "Python module", "node-module": "Node package" };
+const KIND_NAME = { command: "command", "python-module": "Python module", "node-module": "Node package", path: "path", "env-var": "env var" };
 const PY_RE = /^python(\d+(\.\d+)?)?$/;
 const PY_ARG_FLAGS = new Set(["-W", "-X", "-Q"]);
 const sq = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
@@ -127,7 +131,108 @@ export function preflightProbes(contract, { repoHas = () => false, cap = PREFLIG
   return { probes: all.slice(0, cap), dropped: Math.max(0, all.length - cap) };
 }
 
-/** One contract problem per missed probe: names the validate ids and the tool, and how to fix the plan (never a global install). */
+const FIX_HOW = "run the check through the repo's own toolchain (its virtualenv, lockfile-pinned runner or package scripts) or use a check that does not need it, never a global install";
+/** One contract problem per miss: names the validate ids and the tool (or path, or env var), and how to fix the plan (never a global install). */
 export function preflightProblems(misses) {
-  return (misses ?? []).map((m) => `${m.ids.join(", ")}: needs ${KIND_NAME[m.kind] ?? m.kind} '${m.tool}'${m.interp ? ` (for ${m.interp})` : ""}, which this host lacks, so the validate command cannot run here; run the check through the repo's own toolchain (its virtualenv, lockfile-pinned runner or package scripts) or use a check that does not need it, never a global install`);
+  return (misses ?? []).map((m) => {
+    const ids = m.ids.join(", ");
+    if (m.kind === "env-var") return `${ids}: uses $${m.tool}, which is unset or empty in the lane environment, so the validate command cannot run as written; set it inside the command or ${FIX_HOW}`;
+    if (m.source === "run") return `${ids}: running it on the base worktree stopped before any test ran: needs ${KIND_NAME[m.kind] ?? m.kind} '${m.tool}'${m.line ? ` (\`${m.line}\`)` : ""}, so the validate command cannot run here; ${m.kind === "path" ? "point it at a path the repo or a deliverable has, or " : ""}${FIX_HOW}`;
+    return `${ids}: needs ${KIND_NAME[m.kind] ?? m.kind} '${m.tool}'${m.interp ? ` (for ${m.interp})` : ""}, which this host lacks, so the validate command cannot run here; ${FIX_HOW}`;
+  });
+}
+
+/** #4393: per-command timeout and total budget of the freeze-time runs; a command cut by either is no evidence. */
+export const RUN_PROBE_MS = 30000, RUN_BUDGET_MS = 120000;
+const TIMEOUT_RC = 124;
+// bash sets these itself; they are never "missing from the lane env"
+const SHELL_VARS = new Set(["RANDOM", "SECONDS", "LINENO", "PWD", "OLDPWD", "HOME", "UID", "EUID", "PPID", "BASHPID", "IFS", "HOSTNAME", "SHELL", "USER", "PATH", "BASH", "BASH_SOURCE", "BASH_VERSION", "BASH_REMATCH", "PIPESTATUS", "FUNCNAME", "EPOCHSECONDS", "EPOCHREALTIME", "SHLVL", "OPTARG", "OPTIND", "REPLY", "HOSTTYPE", "OSTYPE", "MACHTYPE", "GROUPS"]);
+
+/**
+ * `$NAME` / `${NAME}` references (outside single quotes, not escaped) that are unset or empty in `env` and that the command
+ * does not assign itself (`NAME=`, `export NAME=`, `for NAME in`). `${NAME:-x}`-style defaults, `${#NAME}` and specials are not flagged.
+ */
+export function unsetEnvVars(command, env = {}) {
+  const s = String(command ?? ""), refs = [];
+  let q = null;
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i];
+    if (q === "'") { if (ch === "'") q = null; continue; }
+    if (ch === "\\") { i++; continue; }
+    if (ch === '"') { q = q ? null : '"'; continue; }
+    if (ch === "'" && !q) { q = "'"; continue; }
+    if (ch !== "$") continue;
+    const m = /^\{([A-Za-z_]\w*)(\}|:?[-=+?])|^([A-Za-z_]\w*)/.exec(s.slice(i + 1));
+    if (m && (m[3] || m[2] === "}")) refs.push(m[1] ?? m[3]);
+  }
+  const assigned = (n) => new RegExp(`(^|[\\s;&|(])((export|local|readonly|declare)\\s+)?${n}=|\\bfor\\s+${n}\\s+in\\b`).test(s);
+  return [...new Set(refs)].filter((n) => !SHELL_VARS.has(n) && (env[n] === undefined || env[n] === null || env[n] === "") && !assigned(n));
+}
+
+// [rc, pattern]: bash could not exec a path (127), python could not open its script, pytest / node --test could not find a file
+const PATH_MISSING_RES = [[127, /(?:^|\s)([^\s:'"`]+): No such file or directory/m], [null, /can't open file '([^']+)'/], [null, /file or directory not found: (\S+)/], [null, /Could not find '([^']+)'/]];
+const TESTISH_RE = /(^|\/)(tests?|__tests__|spec)\/|\.(test|spec)\.[^/]+$|(^|\/)test_[^/]*\.py$|_test\.(py|go)$/;
+
+/**
+ * #4393: why one freeze-time run of a validate command shows it cannot run on this host, or null when it ran (passed, or
+ * failed on test content: RED on base is expected), timed out (no evidence) or gave no recognisable reason.
+ * A path counts as missing unless `knownPath(path)` (repo-tracked, a deliverable, the repro test) or it looks like a test the
+ * builder adds; a module goes through conformance.mjs `missingTool` with `repoHas`, as the post-build gate does.
+ * Returns {tool, kind: command|python-module|node-module|path, line} with the output line that showed it.
+ */
+export function runProbeMiss(r, { repoHas = () => false, command = "", knownPath = () => false } = {}) {
+  const rc = r?.rc, out = String(r?.output ?? "");
+  if (!Number.isInteger(rc) || rc === 0 || rc === TIMEOUT_RC) return null;
+  const lineOf = (needle) => (out.split("\n").find((l) => l.includes(needle)) ?? "").trim().slice(0, 160);
+  for (const [onlyRc, re] of PATH_MISSING_RES) {
+    const p = onlyRc === null || onlyRc === rc ? re.exec(out)?.[1] : null;
+    if (!p) continue;
+    if (TESTISH_RE.test(p) || knownPath(p)) return null;
+    return { tool: p, kind: "path", line: lineOf(p) };
+  }
+  const miss = missingTool(r, { repoHas, command });
+  return miss ? { ...miss, line: lineOf(miss.tool) } : null;
+}
+
+/**
+ * #4393: what a freeze-time run may legitimately not find yet: `repoHas` (a name the repo tracks or a deliverable's change
+ * text names) and `knownPath` (a tracked file, a deliverable or the repro test, matched as a suffix of an absolute path).
+ */
+export function knownToContract(contract, files = []) {
+  const changes = (Array.isArray(contract?.deliverables) ? contract.deliverables : []).map((d) => String(d?.change ?? "")).join("\n");
+  const paths = [...files, ...(contract?.deliverables ?? []).map((d) => d?.path), contract?.repro_test?.path].filter((x) => typeof x === "string" && x).map((x) => x.replace(/^\.\//, "").replace(/\/+$/, ""));
+  const segs = new Set(paths.flatMap((x) => x.split("/")));
+  const repoHas = (name) => segs.has(name) || segs.has(`${name}.py`) || new RegExp(`(^|[^\\w@/.-])${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\w/-])`).test(changes);
+  const knownPath = (p) => { const rel = String(p).replace(/^\.\//, ""); return paths.some((k) => rel === k || rel.endsWith(`/${k}`) || rel.startsWith(`${k}/`) || rel.includes(`/${k}/`)); };
+  return { repoHas, knownPath };
+}
+
+const porcelain = (out) => new Map(String(out ?? "").split("\n").filter((l) => l.length > 3).map((l) => [l.slice(3), l.slice(0, 2)]));
+
+/**
+ * #4393: run each `contract.validate[]` command (ids in `skipIds` excepted) once through `run({command, timeoutMs, env})`,
+ * 30 s each inside a 120 s budget, and classify each with `runProbeMiss`. `git(args)` runs in the worktree: whatever the runs
+ * newly created or modified (`git status --porcelain`) is reverted; a path dirty before the runs is never touched.
+ * Returns {misses: [{ids, tool, kind, line, source: "run"}], skipped: ids not run (budget), reverted: paths}.
+ */
+export async function runPreflight({ contract, run, git, env = {}, repoHas = () => false, knownPath = () => false, skipIds = [], now = () => Date.now(), perCommandMs = RUN_PROBE_MS, budgetMs = RUN_BUDGET_MS }) {
+  const misses = [], skipped = [], reverted = [];
+  const todo = (Array.isArray(contract?.validate) ? contract.validate : []).filter((v) => v?.id && typeof v.command === "string" && !skipIds.includes(v.id));
+  if (!todo.length) return { misses, skipped, reverted };
+  const status = async () => porcelain(await git(["status", "--porcelain", "--untracked-files=all"]).catch(() => ""));
+  const before = await status(), deadline = now() + budgetMs;
+  for (const v of todo) {
+    const left = deadline - now();
+    if (left <= 0) { skipped.push(v.id); continue; }
+    let r;
+    try { r = await run({ command: v.command, timeoutMs: Math.min(perCommandMs, left), env }); } catch (e) { r = { rc: 127, output: String(e?.message ?? e) }; }
+    const miss = runProbeMiss(r, { repoHas, command: v.command, knownPath });
+    if (miss) misses.push({ ids: [v.id], ...miss, source: "run" });
+  }
+  const after = await status();
+  for (const [path, xy] of after) {
+    if (before.has(path) || path.includes(" -> ")) continue;
+    try { await git(xy === "??" ? ["clean", "-fdq", "--", path] : ["checkout", "--", path]); reverted.push(path); } catch { /* left as is; the scope gate still sees it */ }
+  }
+  return { misses, skipped, reverted };
 }

package/bin/lean/preflight.test.mjs

@@ -4,7 +4,7 @@ import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { shellSegments, pythonImports, nodeImports, preflightProbes, preflightProblems } from "./preflight.mjs";
+import { shellSegments, pythonImports, nodeImports, preflightProbes, preflightProblems, runProbeMiss, unsetEnvVars, runPreflight, knownToContract } from "./preflight.mjs";
 import { runCheckCommand } from "./effects.mjs";
 import { repoTracks } from "./conformance.mjs";
 import { tmpDir } from "../tests/_tmp.mjs";
@@ -59,3 +59,50 @@ describe("#4328 validate preflight: what a command needs", () => {
     }
   });
 });
+
+describe("#4393 validate preflight: running the command on base", () => {
+  const known = knownToContract({ deliverables: [{ id: "D1", path: "tools/new_check.py", change: "add module newlib" }], repro_test: { path: "test/r.test.mjs" } }, ["shared/detection/__init__.py", "scripts/run.sh"]);
+  it("unrunnable: a missing module, command or path; a repo-tracked or deliverable-named module is not the host", () => {
+    assert.deepEqual(runProbeMiss({ rc: 1, output: "Traceback (most recent call last):\nModuleNotFoundError: No module named 'httpx'\n" }, known),
+      { tool: "httpx", kind: "python-module", line: "ModuleNotFoundError: No module named 'httpx'" });
+    assert.equal(runProbeMiss({ rc: 1, output: "ModuleNotFoundError: No module named 'shared'" }, known), null);
+    assert.equal(runProbeMiss({ rc: 1, output: "ModuleNotFoundError: No module named 'newlib'" }, known), null);
+    assert.equal(runProbeMiss({ rc: 127, output: "bash: line 1: jq: command not found" }, known).tool, "jq");
+    assert.deepEqual(runProbeMiss({ rc: 127, output: "bash: line 1: ./scripts/gone.sh: No such file or directory" }, known), { tool: "./scripts/gone.sh", kind: "path", line: "bash: line 1: ./scripts/gone.sh: No such file or directory" });
+    assert.equal(runProbeMiss({ rc: 2, output: "python3: can't open file '/wt/x/tools/old.py': [Errno 2] No such file or directory" }, known).kind, "path");
+  });
+  it("runs: passes, RED test failures, timeouts and paths the change adds are no miss", () => {
+    for (const r of [{ rc: 0, output: "" }, { rc: 1, output: "AssertionError: expected 1 to equal 2" }, { rc: 124, output: "ModuleNotFoundError: No module named 'httpx'\n(timed out after 30s)" },
+      { rc: 2, output: "python3: can't open file '/wt/x/tools/new_check.py': [Errno 2] No such file or directory" }, { rc: 4, output: "ERROR: file or directory not found: tests/test_new.py" },
+      { rc: 1, output: "Could not find '/wt/x/test/r.test.mjs'" }, { rc: 1, output: "cat: data.json: No such file or directory" }]) assert.equal(runProbeMiss(r, known), null, r.output);
+  });
+  it("unset env vars: empty or unset, outside single quotes, not assigned or defaulted by the command", () => {
+    assert.deepEqual(unsetEnvVars(`cat "$TMPDIR/x" && echo \${OUT} '$SINGLE' \\$ESC \${D:-1} $? $HOME`, { TMPDIR: "", HOME: "/h" }), ["TMPDIR", "OUT"]);
+    assert.deepEqual(unsetEnvVars(`X=1; echo $X; export Y=2 && echo "$Y"; for F in a b; do echo $F; done; echo $SET`, { SET: "s" }), []);
+  });
+  it("runPreflight runs every command with the env and a capped timeout, skips ids, honours the budget and reverts only what the runs changed", async () => {
+    const ran = [], gits = [];
+    let clock = 0, st = " M kept.js\n";
+    const run = async (a) => { ran.push([a.command, a.timeoutMs, a.env.K]); clock += 70000; st += "?? new.log\n M src/a.js\n"; return { rc: 1, output: a.command === "c1" ? "ModuleNotFoundError: No module named 'httpx'" : "" }; };
+    const git = async (args) => { gits.push(args.join(" ")); return args[0] === "status" ? st : ""; };
+    const contract = { validate: ["c1", "c2", "c3", "c4"].map((command, i) => ({ id: `V${i + 1}`, command })) };
+    const r = await runPreflight({ contract, run, git, env: { K: "v" }, skipIds: ["V2"], now: () => clock });
+    assert.deepEqual(ran, [["c1", 30000, "v"], ["c3", 30000, "v"]]);
+    assert.deepEqual(r.misses.map((m) => [m.ids, m.tool, m.kind, m.source]), [[["V1"], "httpx", "python-module", "run"]]);
+    assert.deepEqual(r.skipped, ["V4"]);
+    assert.deepEqual(r.reverted, ["new.log", "src/a.js"]);
+    assert.deepEqual(gits.filter((g) => !g.startsWith("status")), ["clean -fdq -- new.log", "checkout -- src/a.js"], "kept.js was dirty before: untouched");
+  });
+  it("problem lines name the id, the tool and the observed line, or the env var", () => {
+    const [run, env] = preflightProblems([{ ids: ["V4"], tool: "httpx", kind: "python-module", source: "run", line: "ModuleNotFoundError: No module named 'httpx'" }, { ids: ["V2"], tool: "TMPDIR", kind: "env-var", source: "env" }]);
+    assert.match(run, /^V4: running it on the base worktree stopped before any test ran: needs Python module 'httpx' \(`ModuleNotFoundError[^`]*`\)[\s\S]*repo's own toolchain .*never a global install/);
+    assert.match(env, /^V2: uses \$TMPDIR, which is unset or empty in the lane environment/);
+  });
+  it("a real run: a missing module is a miss, a failing test is not", async () => {
+    const dir = tmpDir("preflight-run-");
+    const git = async () => "";
+    const contract = C(`node -e "require('absent-pkg-4393')"`, `node -e "process.exit(1)"`);
+    const r = await runPreflight({ contract, run: (a) => runCheckCommand({ ...a, cwd: dir }), git });
+    assert.deepEqual(r.misses.map((m) => [m.ids[0], m.tool]), [["V1", "absent-pkg-4393"]]);
+  });
+});