forgedock 1.36.0 → 1.37.0

package/bin/lean/schedd.mjs

@@ -35,6 +35,7 @@
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, writeSync } from "node:fs";
 import { createConnection, createServer } from "node:net";
 import { spawn } from "node:child_process";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { schedDir, pidAlive } from "./sched.mjs";
 import { batchRoot, listBatches, openBatch } from "./batch.mjs";
@@ -48,17 +49,57 @@ export function scheddPaths(dir = schedDir()) {
   return { dir, sock: join(dir, "schedd.sock"), lock: join(dir, "schedd.lock"), log: join(dir, "schedd.log") };
 }
 
-// Env keys a batch keeps for its lanes (account and backend selectors, tool paths); persisted in plan.json.
-const ENV_KEEP = /^(PATH|HOME|USER|SHELL|LANG|LC_ALL|TMPDIR|FORGEDOCK_.*|CLAUDE_.*|ANTHROPIC_.*|GH_.*|GITHUB_.*)$/;
+// Env keys a batch keeps for its lanes (account selectors, tool paths); persisted in plan.json (#4691). Session-scoped
+// `CLAUDE_CODE_*` / `CLAUDE_PID` and `ANTHROPIC_*` are not kept, except the non-secret provider/endpoint/model selectors
+// (`CLAUDE_CODE_USE_*`, `ANTHROPIC_BASE_URL`, `ANTHROPIC_MODEL`, ...; #4734); more names come from `orchestration.env_passthrough`.
+const ENV_KEEP = /^(PATH|HOME|USER|SHELL|LANG|LC_.*|TMPDIR|CLAUDE_CONFIG_DIR|CLAUDE_CODE_USE_.*|ANTHROPIC_(BASE_URL|MODEL|SMALL_FAST_MODEL|DEFAULT_.*_MODEL)|FORGEDOCK_.*|GH_.*|GITHUB_.*)$/;
+// What the 1.36.0 pin carried (plus FORGEDOCK_*): a key of these families not pinned now is named at submit (#4734).
+const LEGACY_PIN = /^(CLAUDE_.*|ANTHROPIC_.*|GH_.*|GITHUB_.*|FORGEDOCK_.*)$/;
+const SESSION_SCOPED = /^(CLAUDE_PID|CLAUDE_CODE_(SESSION|MESSAGING|ENTRYPOINT|EXECPATH|SSE).*)$/;
+// A secret never rides the allowlist: it resolves at lane start (env, keychain) unless the operator names it as a passthrough.
+export const SECRET_ENV = /(TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_?KEY|PRIVATE_?KEY)/i;
+const SESSION_DIR = /(^|\/)(arg0|claude[^/]*)(\/|$)/;
 
-/** The allowlisted part of `env`. */
-export function batchEnv(env = process.env) {
-  return Object.fromEntries(Object.entries(env).filter(([k, v]) => ENV_KEEP.test(k) && typeof v === "string"));
+/** A forge.yaml glob (`*` within a segment, `**` across segments, `?`) as an anchored RegExp. */
+export function globToRegExp(glob) {
+  const re = String(glob).replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\u0000").replace(/\*/g, "[^/]*").replace(/\u0000/g, ".*").replace(/\?/g, "[^/]");
+  return new RegExp(`^${re}$`);
 }
 
-/** `base` without its allowlisted keys, plus `kept`: an account selector the client did not set never leaks in from the daemon. */
+/** `path` without non-existent dirs, per-session temp dirs (an `arg0`/`claude*` dir under a temp root) and `exclude` glob matches. */
+export function sanitizePath(path, { exclude = [], exists = existsSync, tmpRoots = ["/tmp", "/var/tmp", tmpdir(), process.env.TMPDIR] } = {}) {
+  const globs = exclude.map(globToRegExp);
+  const roots = tmpRoots.filter(Boolean).map((r) => r.replace(/\/+$/, ""));
+  const keep = (d) => d && exists(d) && !globs.some((g) => g.test(d.replace(/\/+$/, "")))
+    && !(roots.some((r) => d === r || d.startsWith(`${r}/`)) && SESSION_DIR.test(d));
+  const seen = new Set();
+  return String(path).split(":").filter((d) => keep(d) && !seen.has(d) && seen.add(d)).join(":");
+}
+
+/**
+ * The allowlisted part of `env`, with PATH sanitised. `passthrough` names extra keys to keep (`orchestration.env_passthrough`,
+ * the configured `execution.token_env`); `pathExclude` is `orchestration.path_exclude`. Secret-looking names are dropped unless named.
+ */
+export function batchEnv(env = process.env, { passthrough = [], pathExclude = [], exists = existsSync, tmpRoots } = {}) {
+  const extra = new Set(passthrough);
+  const out = Object.fromEntries(Object.entries(env).filter(([k, v]) => typeof v === "string" && (extra.has(k) || (ENV_KEEP.test(k) && !SECRET_ENV.test(k)))));
+  if (typeof out.PATH === "string") out.PATH = sanitizePath(out.PATH, { exclude: pathExclude, exists, ...(tmpRoots ? { tmpRoots } : {}) });
+  return out;
+}
+
+/** Sorted names (never values) of `env` keys the pre-allowlist pin carried that `kept` does not: the lane gets the daemon's value or resolves it at lane start (#4734). */
+export function droppedEnv(env = process.env, kept = {}) {
+  return Object.keys(env).filter((k) => typeof env[k] === "string" && LEGACY_PIN.test(k) && !SESSION_SCOPED.test(k) && !(k in kept)).sort();
+}
+
+/** `env` with secret-looking values redacted (`--show-env`). */
+export function redactEnv(env) {
+  return Object.fromEntries(Object.entries(env ?? {}).map(([k, v]) => [k, SECRET_ENV.test(k) ? "<redacted>" : v]));
+}
+
+/** `base` without its allowlisted non-secret keys (secret-named ones, e.g. GH_TOKEN, stay from the daemon: never pinned), plus `kept`: an account selector the client did not set never leaks in from the daemon. */
 export function mergeEnv(base, kept) {
-  const out = Object.fromEntries(Object.entries(base).filter(([k]) => !ENV_KEEP.test(k)));
+  const out = Object.fromEntries(Object.entries(base).filter(([k]) => k in kept || !ENV_KEEP.test(k) || SECRET_ENV.test(k)));
   return { ...out, ...kept };
 }
 
@@ -141,8 +182,11 @@ export async function startDaemon({ dir = schedDir(), runBatch, idleMs = Number(
     if (req.op === "add") {
       const b = openBatch(root, req.id);
       if (!b.exists()) throw new Error(`no batch ${req.id} in ${root}`);
-      const { added, skipped } = b.addIssues(req.issues ?? []);
-      return send({ type: "ok", added, skipped, hosted: hosted.has(req.id) }, true);
+      const { added, skipped, requeued = [] } = b.addIssues(req.issues ?? []);
+      // #4687: a re-queued skipped issue reopens a finished, unhosted batch like --requeue does
+      const reopen = requeued.length > 0 && !hosted.has(req.id) && !starting.has(req.id);
+      if (reopen) await host({ argv: ["--resume", req.id], cwd: process.cwd(), env: {} });
+      return send({ type: "ok", added, skipped, requeued, hosted: hosted.has(req.id), reopened: reopen }, true);
     }
     if (req.op === "requeue") {
       // #4550: the runner applies the entries on its next pass; a finished, unhosted batch is reopened (hosted as a resume).

package/bin/lean/schedd.test.mjs

@@ -3,12 +3,12 @@
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 import { spawn } from "node:child_process";
-import { closeSync, existsSync, openSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { tmpDir } from "../tests/_tmp.mjs";
 import { openBatch, isLaneAlive, listBatches } from "./batch.mjs";
-import { startDaemon, scheddPaths, connectDaemon, request, mergeEnv, batchEnv, exitOnSignals } from "./schedd.mjs";
+import { startDaemon, scheddPaths, connectDaemon, request, mergeEnv, batchEnv, droppedEnv, sanitizePath, redactEnv, exitOnSignals } from "./schedd.mjs";
 import { schedDir } from "./sched.mjs";
 import { formatTable, orchestrate } from "./orchestrate.mjs";
 import { orchestrateFromCli } from "../engine-cli.mjs";
@@ -507,10 +507,82 @@ await orchestrateFromCli(["1", "2", "--parallel", "2", "--repo", "o/r", "--no-pr
   });
 
   it("lane env: allowlisted keys come from the client only, the rest from the daemon", () => {
-    const kept = batchEnv({ PATH: "/c", CLAUDE_CONFIG_DIR: "/acct-b", SECRET_X: "no", FORGEDOCK_SCHED_DIR: "/s" });
-    assert.deepEqual(kept, { PATH: "/c", CLAUDE_CONFIG_DIR: "/acct-b", FORGEDOCK_SCHED_DIR: "/s" });
+    const kept = batchEnv({ PATH: "/", CLAUDE_CONFIG_DIR: "/acct-b", SECRET_X: "no", FORGEDOCK_SCHED_DIR: "/s", LC_CTYPE: "C" });
+    assert.deepEqual(kept, { PATH: "/", CLAUDE_CONFIG_DIR: "/acct-b", FORGEDOCK_SCHED_DIR: "/s", LC_CTYPE: "C" });
     const env = mergeEnv({ PATH: "/d", ANTHROPIC_API_KEY: "daemon-key", NODE_OPTIONS: "x" }, kept);
-    assert.deepEqual(env, { NODE_OPTIONS: "x", PATH: "/c", CLAUDE_CONFIG_DIR: "/acct-b", FORGEDOCK_SCHED_DIR: "/s" });
+    assert.equal(mergeEnv({ GH_TOKEN: "d" }, kept).GH_TOKEN, "d", "a secret-named daemon key (never pinned) stays for the lane");
+    assert.deepEqual(env, { NODE_OPTIONS: "x", ANTHROPIC_API_KEY: "daemon-key", PATH: "/", CLAUDE_CONFIG_DIR: "/acct-b", FORGEDOCK_SCHED_DIR: "/s", LC_CTYPE: "C" });
+  });
+
+  it("#4734: the pin keeps non-secret provider selectors, drops secrets and session ids, and droppedEnv names what was left out", () => {
+    const client = { PATH: "/", GH_TOKEN: "fresh", CLAUDE_CODE_USE_BEDROCK: "1", ANTHROPIC_BASE_URL: "http://proxy", ANTHROPIC_MODEL: "m", ANTHROPIC_API_KEY: "k",
+      FORGEDOCK_POOL_TOKEN: "p", CLAUDE_CONFIG_DIR: "/acct", CLAUDE_CODE_SESSION_ID: "s", CLAUDE_PID: "1" };
+    const kept = batchEnv(client);
+    assert.deepEqual(Object.keys(kept).sort(), ["ANTHROPIC_BASE_URL", "ANTHROPIC_MODEL", "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CONFIG_DIR", "PATH"]);
+    assert.deepEqual(droppedEnv(client, kept), ["ANTHROPIC_API_KEY", "FORGEDOCK_POOL_TOKEN", "GH_TOKEN"]);
+    assert.deepEqual(droppedEnv(client, batchEnv(client, { passthrough: ["GH_TOKEN"] })), ["ANTHROPIC_API_KEY", "FORGEDOCK_POOL_TOKEN"]);
+    assert.deepEqual(droppedEnv({ PATH: "/", CLAUDE_CODE_SESSION_ID: "s" }, {}), [], "nothing to name: no warning");
+    assert.equal(mergeEnv({ ANTHROPIC_BASE_URL: "daemon", GH_TOKEN: "d" }, kept).ANTHROPIC_BASE_URL, "http://proxy");
+  });
+
+  it("#4691: the pinned env drops session tokens and ids, session temp PATH dirs and path_exclude dirs", () => {
+    const work = tmpDir("schedd-env-");
+    const keep = join(work, "bin"), session = join(work, "claude-1", "arg0"), wrapper = join(work, "wrap", "shims");
+    for (const d of [keep, session, wrapper]) mkdirSync(d, { recursive: true });
+    const session_env = { PATH: [keep, session, wrapper, join(work, "gone")].join(":"), HOME: "/h", CLAUDE_CODE_MESSAGING_TOKEN: "tok", CLAUDE_CODE_SESSION_ID: "s", CLAUDE_PID: "1",
+      CLAUDE_CODE_SESSION_ATTENDED: "1", ANTHROPIC_API_KEY: "k", FORGEDOCK_SANDBOX_TOKEN: "t", MY_FLAG: "1", MY_SECRET_PASS: "p", GH_HOST: "h" };
+    const pin = batchEnv(session_env, { passthrough: ["MY_FLAG", "MY_SECRET_PASS"], pathExclude: [`${work}/wrap/*`], tmpRoots: [work] });
+    assert.equal(pin.PATH, keep, "only the live, non-session, non-excluded dir stays");
+    assert.deepEqual(Object.keys(pin).sort(), ["GH_HOST", "HOME", "MY_FLAG", "MY_SECRET_PASS", "PATH"]);
+    assert.equal(sanitizePath(`${session}:${keep}`, { tmpRoots: [work] }), keep);
+    assert.equal(sanitizePath(`${session}:${keep}`, { tmpRoots: ["/nowhere"] }), `${session}:${keep}`, "an arg0 dir outside a temp root is not session-scoped");
+    assert.deepEqual(redactEnv({ A: "1", GH_TOKEN: "x" }), { A: "1", GH_TOKEN: "<redacted>" });
+  });
+
+  it("#4691: plan.json holds none of the session token, temp PATH dir or excluded wrapper dir; --show/--set/--unset-env edit it", async () => {
+    const h = host();
+    const work = tmpDir("schedd-pin-");
+    const keep = join(work, "bin"), session = join(work, "claude-9", "arg0"), wrapper = join(work, "wrap", "shims");
+    for (const d of [keep, session, wrapper]) mkdirSync(d, { recursive: true });
+    writeFileSync(join(work, "forge.yaml"), `orchestration:\n  path_exclude: ${work}/wrap/*\n`);
+    const saved = { cwd: process.cwd(), path: process.env.PATH, tmp: process.env.TMPDIR };
+    let a;
+    try {
+      await h.daemon();
+      process.chdir(work);
+      process.env.PATH = [keep, session, wrapper].join(":");
+      process.env.TMPDIR = work;
+      process.env.CLAUDE_CODE_MESSAGING_TOKEN = "msg-token";
+      process.env.CLAUDE_CODE_SESSION_ID = "sess";
+      await withRoot(h, async () => {
+        a = capture(() => orchestrateFromCli(["1", "--repo", "o/r", "--no-prefilter"], { ...h.client, reconnectMs: 0 })).catch((e) => e);
+        await until(() => h.stubPids().length === 1 && h.lanePids().length === 1);
+      });
+      const [id] = listBatches(h.root);
+      const raw = readFileSync(join(h.root, id, "plan.json"), "utf8");
+      const env = JSON.parse(raw).env;
+      assert.equal(env.PATH, keep);
+      for (const bad of ["msg-token", "sess", "CLAUDE_CODE_", session, wrapper]) assert.equal(raw.includes(bad), false, `${bad} not pinned`);
+      await withRoot(h, async () => {
+        await capture(() => orchestrateFromCli(["--set-env", id, "MY_VAR=1"], h.client));
+        await capture(() => orchestrateFromCli(["--set-env", id, "GH_TOKEN=abc"], h.client));
+        assert.equal(openBatch(h.root, id).readPlan().env.MY_VAR, "1");
+        const { lines } = await capture(() => orchestrateFromCli(["--show-env", id], h.client));
+        assert.match(lines.join("\n"), /^GH_TOKEN=<redacted>$/m);
+        assert.match(lines.join("\n"), /^MY_VAR=1$/m);
+        assert.equal(lines.join("\n").includes("abc"), false);
+        await capture(() => orchestrateFromCli(["--unset-env", id, "MY_VAR"], h.client));
+        assert.equal("MY_VAR" in openBatch(h.root, id).readPlan().env, false);
+        await assert.rejects(() => orchestrateFromCli(["--set-env", id, "NOEQUALS"], h.client), /KEY=VAL/);
+      });
+      writeFileSync(h.release, "");
+    } finally {
+      process.chdir(saved.cwd); process.env.PATH = saved.path;
+      if (saved.tmp === undefined) delete process.env.TMPDIR; else process.env.TMPDIR = saved.tmp;
+      delete process.env.CLAUDE_CODE_MESSAGING_TOKEN; delete process.env.CLAUDE_CODE_SESSION_ID;
+      await h.cleanup();
+    }
+    await a;
   });
 });
 

package/bin/lean/sequence.mjs

@@ -457,3 +457,27 @@ export async function generatorProblems({ git, base, ref = "HEAD" }) {
   }
   return problems;
 }
+
+/**
+ * #4661: journal `when` ordering. Newest-only migrators (drizzle `migrate()`) skip an entry stamped older than one already
+ * applied, so every entry the lane adds to a drizzle-style journal (`<dir>/meta/_journal.json`) must have `when` above the
+ * base journal's max, and `when` must increase within the lane journal. No journal or base journal: []. @returns {Promise<string[]>}
+ */
+export async function journalOrderProblems({ git, base, ref = "HEAD" }) {
+  const g = out(git), problems = [];
+  const changed = lines(await g(["-c", "core.quotepath=off", "diff", "--name-only", `${base}...${ref}`])).filter((f) => /(?:^|\/)meta\/_journal\.json$/.test(f) && !SKIP_RE.test(f));
+  const entriesAt = async (r, jp) => { try { const e = JSON.parse(await g(["show", `${r}:${jp}`])).entries; return Array.isArray(e) ? e : null; } catch { return null; } };
+  for (const jp of changed) {
+    const now = await entriesAt(ref, jp);
+    if (!now) continue;
+    const was = (await entriesAt(base, jp)) ?? [], wasTags = new Set(was.map((e) => e?.tag));
+    const max = Math.max(-Infinity, ...was.map((e) => Number(e?.when)).filter(Number.isFinite));
+    for (let i = 0; i < now.length; i++) {
+      const e = now[i] ?? {}, w = Number(e.when);
+      if (wasTags.has(e.tag)) continue;
+      if (Number.isFinite(max) && !(w > max)) problems.push(`${jp}: ${e.tag} when ${e.when} is not above the base max when ${max} (stale stamp: a newest-only migrator skips it on a persistent database)`);
+      else if (i > 0 && Number.isFinite(Number(now[i - 1]?.when)) && !(w > Number(now[i - 1].when))) problems.push(`${jp}: ${e.tag} when ${e.when} is not after ${now[i - 1].tag} (${now[i - 1].when})`);
+    }
+  }
+  return problems;
+}

package/bin/lean/sequence.test.mjs

@@ -8,7 +8,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { tmpDir } from "../tests/_tmp.mjs";
-import { sequenceCollisions, journalProblems, snapshotLane, verifyRenumber, numberOnlyChange, headerOnlyChange, renumberLane, resolveSequenceConflicts, generatorProblems } from "./sequence.mjs";
+import { sequenceCollisions, journalProblems, snapshotLane, verifyRenumber, numberOnlyChange, headerOnlyChange, renumberLane, resolveSequenceConflicts, generatorProblems, journalOrderProblems } from "./sequence.mjs";
 import { makeSequenceLeaseIo } from "./seqlease.mjs";
 import { sequencePrompt, sequenceSyncNote, migrationGeneratorPrompt, builderImplementPrompt } from "./prompts.mjs";
 
@@ -492,3 +492,33 @@ describe("hand-named migrations (#4591)", () => {
     assert.match(builderImplementPrompt("local"), /Never name or number migration files by hand/);
   });
 });
+
+describe("journal when ordering across parallel milestone branches (#4661)", () => {
+  const J = (...es) => `${JSON.stringify({ version: "7", entries: es.map(([tag, when], idx) => ({ idx, tag, when })) }, null, 2)}\n`;
+  function repo(laneEntries) {
+    const d = tmpDir("when-");
+    sh(d, "init", "-q", "-b", "main");
+    put(d, { "db/meta/_journal.json": J(["0_a", 5000], ["1_b", 9000]) });
+    commit(d, "init");
+    sh(d, "checkout", "-qb", "lane");
+    if (laneEntries) { put(d, { "db/meta/_journal.json": J(["0_a", 5000], ["1_b", 9000], ...laneEntries) }); commit(d, "lane"); }
+    return d;
+  }
+  it("flags an added entry stamped at or below the base max when", async () => {
+    const p = await journalOrderProblems({ git: gitIn(repo([["2_c", 7000]])), base: "main" });
+    assert.equal(p.length, 1);
+    assert.match(p[0], /db\/meta\/_journal\.json: 2_c when 7000 is not above the base max when 9000/);
+  });
+  it("passes entries above the base max, an unchanged journal, and no journal", async () => {
+    assert.deepEqual(await journalOrderProblems({ git: gitIn(repo([["2_c", 9001]])), base: "main" }), []);
+    assert.deepEqual(await journalOrderProblems({ git: gitIn(repo(null)), base: "main" }), []);
+    const d = tmpDir("when-none-");
+    sh(d, "init", "-q", "-b", "main"); put(d, { "x.txt": "x" }); commit(d, "i"); sh(d, "checkout", "-qb", "lane");
+    assert.deepEqual(await journalOrderProblems({ git: gitIn(d), base: "main" }), []);
+  });
+  it("flags non-increasing when inside the lane's added entries; the prompt asks for a re-stamp", async () => {
+    const p = await journalOrderProblems({ git: gitIn(repo([["2_c", 9100], ["3_d", 9050]])), base: "main" });
+    assert.match(p[0], /3_d when 9050 is not after 2_c/);
+    assert.match(migrationGeneratorPrompt(p), /re-stamp/);
+  });
+});

package/bin/lean/signoff.mjs

@@ -0,0 +1,66 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * DCO sign-off for a lane's own unpushed commits (#4651). A resumed lane keeps the commits of an earlier run; one from a
+ * pool agent that predates the identity fix is authored `*@localhost` with no `Signed-off-by`, and DCO fails on the release
+ * PR. Before a push, the commits the push would add (reachable from HEAD, not from origin/<branch> nor origin/<lane>) are
+ * checked, and the offenders are rewritten with the lane identity and --signoff. Commits already on either remote ref are
+ * never in the range, so they are never rewritten. Deterministic, 0 LLM calls.
+ */
+const SEP = "\x1f", END = "\x1e";
+const PLACEHOLDER_RE = /@localhost$/i;
+
+/** True when the commit must be rewritten: placeholder author or committer, or no sign-off naming its author. */
+export function needsSignoff({ authorEmail, committerEmail, signedOff }) {
+  if (PLACEHOLDER_RE.test(authorEmail ?? "") || PLACEHOLDER_RE.test(committerEmail ?? "")) return true;
+  const a = String(authorEmail ?? "").toLowerCase();
+  return !signedOff.some((s) => s.toLowerCase().includes(`<${a}>`));
+}
+
+/** Parse `git log` output of FORMAT into the commits that need a rewrite, oldest first (the log is newest first). */
+export function offendersOf(out) {
+  return String(out ?? "").split(END).map((r) => r.replace(/^\n/, "")).filter(Boolean).map((r) => {
+    const [sha, authorEmail, committerEmail, trailers = "", parents = ""] = r.split(SEP);
+    return { sha, authorEmail, committerEmail, signedOff: trailers.split("\n").map((l) => l.trim()).filter(Boolean), merge: parents.trim().split(/\s+/).filter(Boolean).length > 1 };
+  }).filter((c) => !c.merge && needsSignoff(c)).reverse();
+}
+
+const FORMAT = `%H${SEP}%ae${SEP}%ce${SEP}%(trailers:key=Signed-off-by,valueonly,separator=%x0a)${SEP}%P${END}`;
+
+// filter-branch rewrites only the commits in the range (the excluded remote refs stay as they are), and only the listed ones change.
+const IS_BAD = 'case " $FD_BAD " in *" $GIT_COMMIT "*)';
+const ENV_FILTER = `${IS_BAD} export GIT_AUTHOR_NAME="$FD_NAME" GIT_AUTHOR_EMAIL="$FD_EMAIL" GIT_COMMITTER_NAME="$FD_NAME" GIT_COMMITTER_EMAIL="$FD_EMAIL";; esac`;
+const MSG_FILTER = `${IS_BAD} git interpret-trailers --trailer "Signed-off-by: $FD_NAME <$FD_EMAIL>";; *) cat;; esac`;
+
+/**
+ * @param {object} o
+ * @param {(args: string[], opts?: {env?: object}) => Promise<string>} o.git runs git in the lane worktree
+ * @param {string} o.lane the lane (base) branch
+ * @param {string} o.branch the lane's own branch
+ * @param {object} [o.env] where GIT_AUTHOR_NAME/EMAIL are read from (default process.env)
+ * @returns {Promise<{rewritten: number}>}
+ * @throws Error with `.laneCode` unset: callers type it. `.noIdentity` when a rewrite is needed but no usable identity exists.
+ */
+export async function ensureSignedOff({ git, lane, branch, env = process.env }) {
+  const ok = async (args) => { try { return String(await git(args)).trim(); } catch { return ""; } };
+  try { await git(["fetch", "origin", branch]); } catch { /* not pushed yet, or offline: the tracking refs we have decide */ }
+  const exclude = [];
+  for (const ref of [`origin/${branch}`, `origin/${lane}`]) if (await ok(["rev-parse", "--verify", "-q", `refs/remotes/${ref}`])) exclude.push(`^${ref}`);
+  const log = await ok(["log", `--format=${FORMAT}`, "HEAD", ...exclude]);
+  const bad = offendersOf(log);
+  if (!bad.length) return { rewritten: 0 };
+  // the lane identity: GIT_AUTHOR_* (what the sandbox sets and what a commit would use), else the worktree config
+  let name = env.GIT_AUTHOR_NAME || await ok(["config", "user.name"]), email = env.GIT_AUTHOR_EMAIL || await ok(["config", "user.email"]);
+  if (!name || !email) { // the runner's own git env (what a commit here would use), e.g. GIT_AUTHOR_* set only on the git runner
+    const m = /^(.*?)\s*<([^>]*)>/.exec(await ok(["var", "GIT_AUTHOR_IDENT"]));
+    if (m) { name ||= m[1]; email ||= m[2]; }
+  }
+  if (!name || !email || PLACEHOLDER_RE.test(email)) {
+    throw Object.assign(new Error(`${bad.length} unpushed commit(s) fail DCO (placeholder author or no sign-off: ${bad.slice(0, 5).map((c) => c.sha.slice(0, 8)).join(", ")}) and the worktree has no usable git identity to rewrite them`), { noIdentity: true });
+  }
+  const fenv = { FD_BAD: bad.map((c) => c.sha).join(" "), FD_NAME: name, FD_EMAIL: email, FILTER_BRANCH_SQUELCH_WARNING: "1" };
+  try { await git(["filter-branch", "-f", "--env-filter", ENV_FILTER, "--msg-filter", MSG_FILTER, "--", "HEAD", ...exclude], { env: fenv }); }
+  catch (e) { throw Object.assign(new Error(`could not rewrite ${bad.length} unpushed commit(s) for DCO: ${String(e?.stderr ?? e?.message ?? e).slice(0, 300)}`), { noIdentity: false }); }
+  await ok(["for-each-ref", "--format=delete %(refname)", "refs/original/"]).then(async (l) => { for (const r of l.split("\n").map((x) => x.replace(/^delete /, "")).filter(Boolean)) await ok(["update-ref", "-d", r]); });
+  return { rewritten: bad.length };
+}

package/bin/lean/signoff.test.mjs

@@ -0,0 +1,102 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// #4651: sign-off rewrite of a lane's own unpushed commits, on a real temp git repo (bare origin + clone).
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpDir } from "../tests/_tmp.mjs";
+import { ensureSignedOff, needsSignoff, offendersOf } from "./signoff.mjs";
+
+const CLEAN = Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^GIT_(AUTHOR|COMMITTER)_/.test(k)));
+const sh = (cwd, ...a) => execFileSync("git", a, { cwd, encoding: "utf8", env: { ...CLEAN, GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null" } }).trim();
+const PLACEHOLDER = ["-c", "user.name=forgedock", "-c", "user.email=forgedock@localhost"];
+
+function fixture() {
+  const root = tmpDir("signoff-"), origin = join(root, "origin.git"), wt = join(root, "wt");
+  sh(root, "init", "--bare", "-b", "staging", origin);
+  sh(root, "clone", origin, wt);
+  sh(wt, "config", "user.name", "Lane Bot"); sh(wt, "config", "user.email", "lane@example.com");
+  const commit = (file, msg, ...flags) => { writeFileSync(join(wt, file), `${file}\n`); sh(wt, "add", file); sh(wt, ...(flags.includes("placeholder") ? PLACEHOLDER : []), "commit", "-q", "-m", msg, ...flags.filter((f) => f !== "placeholder")); return sh(wt, "rev-parse", "HEAD"); };
+  commit("base.txt", "base");
+  sh(wt, "push", "-q", "origin", "HEAD:staging");
+  sh(wt, "checkout", "-q", "-b", "feat/x");
+  const git = async (a, o = {}) => execFileSync("git", a, { cwd: wt, encoding: "utf8", env: { ...CLEAN, GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null", ...(o.env ?? {}) } }).trim();
+  return { wt, commit, git, sh: (...a) => sh(wt, ...a) };
+}
+
+describe("needsSignoff / offendersOf", () => {
+  it("flags placeholder authors and missing or mismatched sign-offs", () => {
+    assert.equal(needsSignoff({ authorEmail: "a@x.io", committerEmail: "a@x.io", signedOff: ["A <a@x.io>"] }), false);
+    assert.equal(needsSignoff({ authorEmail: "a@x.io", committerEmail: "a@x.io", signedOff: [] }), true);
+    assert.equal(needsSignoff({ authorEmail: "a@x.io", committerEmail: "a@x.io", signedOff: ["B <b@x.io>"] }), true);
+    assert.equal(needsSignoff({ authorEmail: "forgedock@localhost", committerEmail: "forgedock@localhost", signedOff: ["F <forgedock@localhost>"] }), true);
+    assert.deepEqual(offendersOf(""), []);
+  });
+});
+
+describe("ensureSignedOff", () => {
+  it("rewrites unpushed placeholder-author commits and leaves pushed commits alone", async () => {
+    const f = fixture();
+    const pushed = f.commit("a.txt", "pushed unsigned", "placeholder");
+    f.sh("push", "-q", "origin", "feat/x");
+    const bad = f.commit("b.txt", "unpushed placeholder", "placeholder");
+    const unsigned = f.commit("c.txt", "unpushed unsigned");
+    const good = f.commit("d.txt", "unpushed signed", "--signoff");
+    const r = await ensureSignedOff({ git: f.git, lane: "staging", branch: "feat/x", env: {} });
+    assert.equal(r.rewritten, 2);
+    const rows = f.sh("log", "--format=%H|%ae|%(trailers:key=Signed-off-by,valueonly,separator=;)", "origin/feat/x..HEAD").split("\n").map((l) => l.split("|"));
+    assert.equal(rows.length, 3);
+    for (const [, email, so] of rows) { assert.equal(email, "lane@example.com"); assert.match(so, /Lane Bot <lane@example\.com>/); }
+    const shas = rows.map((x) => x[0]);
+    assert.ok(!shas.includes(bad) && !shas.includes(unsigned), "originals are gone from the pushed range");
+    assert.equal(f.sh("rev-parse", "origin/feat/x"), pushed);
+    assert.equal(f.sh("merge-base", "--is-ancestor", pushed, "HEAD") ?? "", "");
+    assert.equal(f.sh("log", "-1", "--format=%ae", pushed), "forgedock@localhost"); // the pushed commit itself is untouched
+    assert.equal(f.sh("rev-parse", "HEAD~3"), pushed);
+    assert.equal(f.sh("show", "-s", "--format=%an", "HEAD"), "Lane Bot"); // the already-signed one is authored by the lane here, so it is unchanged
+    assert.ok(good);
+  });
+  it("never rewrites commits already on origin/<lane>, nor a clean range", async () => {
+    const f = fixture();
+    f.sh("checkout", "-q", "staging");
+    const onLane = f.commit("l.txt", "lane commit unsigned", "placeholder");
+    f.sh("push", "-q", "origin", "staging");
+    f.sh("checkout", "-q", "feat/x"); f.sh("merge", "-q", "--no-edit", "staging");
+    f.commit("m.txt", "mine", "--signoff");
+    const before = f.sh("rev-parse", "HEAD");
+    const r = await ensureSignedOff({ git: f.git, lane: "staging", branch: "feat/x", env: {} });
+    assert.equal(r.rewritten, 0);
+    assert.equal(f.sh("rev-parse", "HEAD"), before);
+    assert.equal(f.sh("merge-base", "--is-ancestor", onLane, "HEAD") ?? "", "");
+  });
+  it("rewrites with a merge commit in the range and keeps lane commits intact", async () => {
+    const f = fixture();
+    f.sh("checkout", "-q", "staging");
+    const onLane = f.commit("l.txt", "lane commit", "placeholder");
+    f.sh("push", "-q", "origin", "staging");
+    f.sh("checkout", "-q", "feat/x");
+    f.commit("b.txt", "unpushed placeholder", "placeholder");
+    f.sh("merge", "-q", "--no-edit", "staging");
+    const r = await ensureSignedOff({ git: f.git, lane: "staging", branch: "feat/x", env: {} });
+    assert.equal(r.rewritten, 1);
+    assert.equal(f.sh("merge-base", "--is-ancestor", onLane, "HEAD") ?? "", "");
+    assert.equal(f.sh("log", "--format=%ae", "origin/staging..HEAD", "--no-merges"), "lane@example.com");
+    assert.equal(f.sh("log", "-1", "--format=%ae", onLane), "forgedock@localhost");
+  });
+  it("uses GIT_AUTHOR_* from the env over the worktree config (sandbox lanes)", async () => {
+    const f = fixture();
+    f.commit("b.txt", "unpushed placeholder", "placeholder");
+    await ensureSignedOff({ git: f.git, lane: "staging", branch: "feat/x", env: { GIT_AUTHOR_NAME: "Host Dev", GIT_AUTHOR_EMAIL: "host@example.com" } });
+    assert.equal(f.sh("log", "-1", "--format=%ae|%an"), "host@example.com|Host Dev");
+    assert.match(f.sh("log", "-1", "--format=%(trailers:key=Signed-off-by,valueonly)"), /Host Dev <host@example\.com>/);
+  });
+  it("throws noIdentity (and rewrites nothing) when the worktree has no usable identity", async () => {
+    const f = fixture();
+    const bad = f.commit("b.txt", "unpushed placeholder", "placeholder");
+    f.sh("config", "user.email", "forgedock@localhost");
+    await assert.rejects(ensureSignedOff({ git: f.git, lane: "staging", branch: "feat/x", env: {} }), (e) => e.noIdentity === true);
+    assert.equal(f.sh("rev-parse", "HEAD"), bad);
+  });
+});

package/bin/lean/train.mjs

@@ -0,0 +1,177 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * Native unattended milestone train (#4658): `forgedock milestone train <slug...>`.
+ *
+ * One durable state file `<batchRoot>/trains/<id>/state.json` (tmp + fsync + rename, like a batch) holds the order, the
+ * active set, each milestone's status and lifecycle state (#4657) and the typed STOP, if any. Deterministic, 0 LLM calls.
+ * Each milestone runs as one orchestrate batch; its lanes resolve their base from the issue's milestone (lane.mjs), so
+ * the train never steers them through `branches.staging` and never writes forge.yaml. After a batch the lifecycle seam
+ * (`onBatchEnd`) records `shipped:staging` and closes at `milestones.close_on`. A slug is a milestone title.
+ * Caps have one source, forge.yaml `orchestration.global_parallel` (see `resolveCaps`); a conflicting override is ignored.
+ * Order is defined once, in the state; `insertMilestone` is the only way to add one and re-runs dependency validation.
+ */
+import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { writeAtomic } from "./batch.mjs";
+import { classifyEdges } from "../../scripts/plan-validate-live.mjs";
+
+export const STOP_REASONS = ["dependency-unmet", "needs-human", "breaker", "budget", "cancelled", "milestone-open", "error"];
+export const DEFAULT_LANE_PARALLEL = 3;
+const ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+export const trainRoot = (batchRoot) => join(batchRoot, "trains");
+export const newTrainId = (now = Date.now()) => `train-${new Date(now).toISOString().replace(/[-:T]/g, "").slice(0, 14)}-${process.pid}`;
+
+/** Handle on one train's state file. */
+export function openTrain(root, id) {
+  if (!ID_RE.test(String(id))) throw new Error(`invalid train id: ${id}`);
+  const file = join(trainRoot(root), id, "state.json");
+  return {
+    id, file,
+    exists: () => existsSync(file),
+    load() { try { return JSON.parse(readFileSync(file, "utf8")); } catch { return null; } },
+    save(state) { writeAtomic(file, `${JSON.stringify(state, null, 2)}\n`); },
+  };
+}
+
+/**
+ * The only cap source is `orchestration.global_parallel` (host-wide lane cap, shared with `forgedock sched cap`); unset
+ * it is DEFAULT_LANE_PARALLEL. A `requested` lane cap (`--parallel`) that differs is ignored with a warning.
+ * Active milestones split the cap, at least 1 lane each.
+ */
+export function resolveCaps({ requested = null, globalParallel = null, parallelMilestones = 1 }) {
+  const cap = globalParallel ?? DEFAULT_LANE_PARALLEL;
+  const warnings = [];
+  if (requested != null && requested !== cap) warnings.push(`train: --parallel ${requested} conflicts with the lane cap ${cap} (${globalParallel ? "orchestration.global_parallel" : "default"}); ignored`);
+  return { cap, parallelMilestones, perMilestone: Math.max(1, Math.floor(cap / parallelMilestones)), warnings };
+}
+
+/** Throws when `order` puts a milestone before one its issues depend on (`live`: {issues} as plan-validate-live reads them). */
+export function validateOrder(order, live) {
+  const { ok, edges } = classifyEdges({ order, issues: live.issues });
+  if (!ok) {
+    const bad = edges.filter((e) => e.state === "invalid").map((e) => `#${e.from} (${e.fromMilestone}) depends on #${e.to} (${e.toMilestone}), which is later in the train`);
+    throw new Error(`train order invalid: ${bad.join("; ")}`);
+  }
+  return edges;
+}
+
+export function createTrain({ slugs, parallelMilestones = 1, repo = null, live, now = () => new Date().toISOString() }) {
+  const order = [...new Set(slugs)];
+  if (!order.length) throw new Error("train needs at least one milestone slug");
+  if (!Number.isInteger(parallelMilestones) || parallelMilestones < 1) throw new Error("--parallel-milestones must be a positive integer");
+  if (live) validateOrder(order, live);
+  return { v: 1, repo, created: now(), parallelMilestones, order, active: [], stop: null,
+    milestones: Object.fromEntries(order.map((s) => [s, { status: "pending", lifecycle: null, batch: null }])) };
+}
+
+/** Insert `slug` at the end, or before/after another; re-validates dependencies and leaves the state unchanged on a refusal. */
+export function insertMilestone(state, slug, { before = null, after = null, live = null } = {}) {
+  if (state.milestones[slug]) throw new Error(`milestone ${slug} is already in the train`);
+  const anchor = before ?? after;
+  if (anchor && !state.milestones[anchor]) throw new Error(`milestone ${anchor} is not in the train`);
+  const order = [...state.order];
+  order.splice(anchor ? order.indexOf(anchor) + (after ? 1 : 0) : order.length, 0, slug);
+  if (live) validateOrder(order, live);
+  return { ...state, order, milestones: { ...state.milestones, [slug]: { status: "pending", lifecycle: null, batch: null } } };
+}
+
+/** A milestone is ready when every earlier-in-train milestone its issues depend on is done (shipped to staging or later). */
+export function readyMilestones(state, live) {
+  const edges = live ? classifyEdges({ order: state.order, issues: live.issues }).edges : [];
+  return state.order.filter((s) => state.milestones[s].status === "pending"
+    && edges.every((e) => e.fromMilestone !== s || state.milestones[e.toMilestone]?.status === "done"));
+}
+
+/** Typed STOP reason of a failed milestone run: its rows' outcomes, else `error`. */
+export function stopOf(result) {
+  const outcomes = (result?.rows ?? []).map((r) => String(r.outcome ?? ""));
+  const has = (re) => outcomes.find((o) => re.test(o));
+  if (has(/^dependency-/)) return "dependency-unmet";
+  if (has(/^needs-human/)) return "needs-human";
+  if (has(/breaker/)) return "breaker";
+  if (has(/budget/)) return "budget";
+  if (has(/cancel/)) return "cancelled";
+  return "error";
+}
+
+/**
+ * Run the train until done or a STOP. `runMilestone(slug, {parallel, resume})` -> {ok, batch?, rows?, stop?}; `onBatchEnd([slug])`
+ * is the #4657 lifecycle seam. Saves after every transition. A resume (state loaded from disk) clears the STOP and re-runs
+ * milestones left `running` through their batch (`resume`). Never writes forge.yaml.
+ * @returns {Promise<{ok: boolean, state: object}>}
+ */
+export async function runTrain({ train, state, runMilestone, onBatchEnd = async () => [], readLive = async () => null, caps, now = () => new Date().toISOString(), log = () => {} }) {
+  state = { ...state, stop: null, active: [], milestones: { ...state.milestones } };
+  for (const [s, m] of Object.entries(state.milestones)) if (m.status === "running" || m.status === "stopped") state.milestones[s] = { ...m, status: "pending", resume: m.batch };
+  const save = () => train.save(state);
+  const set = (slug, patch) => { state.milestones[slug] = { ...state.milestones[slug], ...patch }; };
+  const running = new Map();
+  const finish = async (slug) => {
+    let r;
+    try { r = await runMilestone(slug, { parallel: caps.perMilestone, resume: state.milestones[slug].resume ?? null, onBatch: (b) => { set(slug, { batch: b }); save(); } }); } catch (e) { r = { ok: false, stop: "error", detail: e?.message ?? String(e) }; }
+    state.active = state.active.filter((s) => s !== slug);
+    if (!r?.ok) { set(slug, { status: "stopped", batch: r?.batch ?? state.milestones[slug].batch }); state.stop ??= { reason: STOP_REASONS.includes(r?.stop) ? r.stop : stopOf(r), milestone: slug, detail: r?.detail ?? "", at: now() }; return save(); }
+    let life = null;
+    try { life = (await onBatchEnd([slug]))?.find((x) => x.title === slug) ?? null; } catch (e) { log(`train: lifecycle for ${slug}: ${e?.message ?? e}`); }
+    if (life && !["shipped:staging", "deployed:default", "closed"].includes(life.state)) {
+      set(slug, { status: "stopped", lifecycle: life.state });
+      state.stop ??= { reason: "milestone-open", milestone: slug, detail: "open issues remain after the batch", at: now() };
+    } else set(slug, { status: "done", lifecycle: life?.state ?? "shipped:staging", batch: r.batch ?? state.milestones[slug].batch });
+    save();
+  };
+  save();
+  for (;;) {
+    while (!state.stop && running.size < state.parallelMilestones) {
+      const next = readyMilestones(state, await readLive()).find((s) => !running.has(s));
+      if (!next) break;
+      set(next, { status: "running" }); state.active.push(next); save();
+      log(`train: starting ${next}`);
+      running.set(next, finish(next).finally(() => running.delete(next)));
+    }
+    if (!running.size) break;
+    await Promise.race(running.values());
+  }
+  const pending = state.order.filter((s) => state.milestones[s].status === "pending");
+  if (!state.stop && pending.length) { state.stop = { reason: "dependency-unmet", milestone: pending[0], detail: `waiting on an earlier milestone: ${pending.join(", ")}`, at: now() }; save(); }
+  return { ok: !state.stop, state };
+}
+
+const valueOf = (argv, name) => { const i = argv.indexOf(name); return i >= 0 ? argv[i + 1] : null; };
+const intOf = (v, name) => { if (v == null) return null; const n = Number(v); if (!Number.isInteger(n) || n < 1) throw new Error(`${name} must be a positive integer`); return n; };
+
+/**
+ * `forgedock milestone train <slug...> [--parallel-milestones N] [--parallel K]` | `--resume <id>` | `--insert <id> <slug> [--before s|--after s]` | `--show <id>`.
+ * deps: {root, readLive, runMilestone, onBatchEnd, globalParallel, repo, print}. Resolves {ok, id, state}.
+ */
+export async function trainCli(argv, deps) {
+  const { root, readLive, print = (l) => console.log(l) } = deps;
+  const usage = "usage: forgedock milestone train <slug...> [--parallel-milestones N] [--parallel K] [--repo owner/repo] | --resume <id> | --insert <id> <slug> [--before <slug>|--after <slug>] | --show <id>";
+  const valued = new Set(["--parallel-milestones", "--parallel", "--repo", "--resume", "--before", "--after"]);
+  const operands = []; for (let i = 0; i < argv.length; i++) { if (argv[i] === "--insert" || argv[i] === "--show") continue; if (valued.has(argv[i])) i++; else if (!argv[i].startsWith("--")) operands.push(argv[i]); }
+  const open = (id) => { const t = openTrain(root, id); const state = t.load(); if (!state) throw new Error(`no train ${id} in ${trainRoot(root)}`); return { t, state }; };
+  if (argv.includes("--show")) { const id = valueOf(argv, "--show"); const { state } = open(id); print(`train ${id}: ${state.order.map((s) => `${s}=${state.milestones[s].status}${state.milestones[s].lifecycle ? `(${state.milestones[s].lifecycle})` : ""}`).join(", ")}${state.stop ? `; STOP ${state.stop.reason} at ${state.stop.milestone}` : ""}`); return { ok: !state.stop, id, state }; }
+  if (argv.includes("--insert")) {
+    const id = valueOf(argv, "--insert"); const { t, state } = open(id); const slug = operands[1]; // operands[0] is the train id
+    if (!slug) throw new Error(usage);
+    const next = insertMilestone(state, slug, { before: valueOf(argv, "--before"), after: valueOf(argv, "--after"), live: await readLive() });
+    t.save(next); print(`train ${id}: inserted ${slug}; order: ${next.order.join(", ")}`); return { ok: true, id, state: next };
+  }
+  let train, state, id;
+  const pm = intOf(valueOf(argv, "--parallel-milestones"), "--parallel-milestones");
+  if (argv.includes("--resume")) { id = valueOf(argv, "--resume"); ({ t: train, state } = open(id)); }
+  else {
+    if (!operands.length) throw new Error(usage);
+    id = deps.id ?? newTrainId(); train = openTrain(root, id);
+    if (train.exists()) throw new Error(`train ${id} already exists`);
+    state = createTrain({ slugs: operands, parallelMilestones: pm ?? 1, repo: deps.repo ?? null, live: await readLive() });
+  }
+  const caps = resolveCaps({ requested: intOf(valueOf(argv, "--parallel"), "--parallel"), globalParallel: deps.globalParallel ?? null, parallelMilestones: pm ?? state.parallelMilestones });
+  for (const w of caps.warnings) print(w);
+  if (pm && argv.includes("--resume")) state = { ...state, parallelMilestones: pm };
+  print(`train: ${id} (${train.file}); resume with: forgedock milestone train --resume ${id}`);
+  const r = await runTrain({ train, state, runMilestone: deps.runMilestone, onBatchEnd: deps.onBatchEnd, readLive, caps, log: print });
+  print(r.ok ? `train ${id}: done` : `train ${id}: STOP ${r.state.stop.reason} at ${r.state.stop.milestone}${r.state.stop.detail ? ` (${r.state.stop.detail})` : ""}; resume with: forgedock milestone train --resume ${id}`);
+  return { ok: r.ok, id, state: r.state };
+}