forgedock 1.43.1 → 1.44.0

package/bin/engine/outcome-codes.mjs

@@ -199,13 +199,13 @@ export const ENV_VALIDATE_TIMEOUT = "env.validate_timeout";
  * Batch recovery classes of a lane result (forge#4267). The batch runner recovers `recoverable` rows once
  * (`orchestration.recovery.max_attempts`) and re-queues them; only `human` rows are escalations.
  */
-export const RECOVERABLE_CODES = Object.freeze([OUTCOME_CODES.CI_RED, OUTCOME_CODES.BASE_CONFLICT, OUTCOME_CODES.BUILDER_BLOCK_UNTYPED, OUTCOME_CODES.CONTRACT_INVALID, OUTCOME_CODES.CONTRACT_INVALID_COMMAND, OUTCOME_CODES.ENV_TOOL_MISSING, OUTCOME_CODES.ENV_REPRO_UNRUNNABLE, ENV_VALIDATE_TIMEOUT, OUTCOME_CODES.ENV_CAPABILITY_REMOTE, OUTCOME_CODES.BUDGET_EXCEEDED]);
+export const RECOVERABLE_CODES = Object.freeze([OUTCOME_CODES.CI_RED, OUTCOME_CODES.BASE_CONFLICT, OUTCOME_CODES.BUILDER_BLOCK_UNTYPED, OUTCOME_CODES.CONTRACT_INVALID, OUTCOME_CODES.CONTRACT_INVALID_COMMAND, OUTCOME_CODES.ENV_TOOL_MISSING, OUTCOME_CODES.ENV_REPRO_UNRUNNABLE, ENV_VALIDATE_TIMEOUT, OUTCOME_CODES.ENV_CAPABILITY_REMOTE, OUTCOME_CODES.BUDGET_EXCEEDED, OUTCOME_CODES.CONFORMANCE_UNIMPLEMENTED, OUTCOME_CODES.CONFORMANCE_OMISSION, OUTCOME_CODES.CONFORMANCE_UNJUSTIFIED_DEFERRAL]);
 /** `builder.blocked` is only reached by a typed human block: credentials, spend, promotion, customer, product-decision. */
 export const HUMAN_CODES = Object.freeze([OUTCOME_CODES.BUILDER_BLOCKED]);
 
 /**
  * `recoverable` | `human` | `terminal` for a lane result row ({outcome|terminalReason, code, issueEdited?, conflicting?}).
- * Recoverable: needs-human `ci.red`, `base.conflict`, `builder.block_untyped`, `env.tool_missing`, `env.repro_unrunnable`, `env.validate_timeout`, `env.capability_remote`, `budget.exceeded`, `contract.invalid` after a mid-run issue
+ * Recoverable: needs-human `ci.red`, `base.conflict`, `builder.block_untyped`, `env.tool_missing`, `env.repro_unrunnable`, `env.validate_timeout`, `env.capability_remote`, `budget.exceeded`, `conformance.unimplemented` / `conformance.omission` / `conformance.unjustified_deferral` (#5035; regression, guard_broken, scope_creep and e2e_unverified stay terminal), `contract.invalid` after a mid-run issue
  * edit (`issueEdited`) or when every problem was an unmatched quote (`quoteMismatch`), `ci-pending` on a conflicting PR (`conflicting`), and the non-human `budget-exceeded` turn-overrun end (forge#4505). Human: `builder.blocked`. Anything else
  * (another code, or not a needs-human/ci-pending row) is terminal. Pure, never throws.
  */

package/bin/engine/telemetry-seam.mjs

@@ -8,7 +8,7 @@
  *   RUN_TERMINAL        -> `run_terminal`  (reason, code, wall_ms; lean adds milestone, conformance_mode, shadow_would, the pr and
  *                          builder_tier/class/model/escalated 0|1, forge#4394)
  *   SANDBOX_USAGE       -> `sandbox_usage` (provider, sandbox_id, minutes, cost_usd, batch; one per settled remote lane, forge#4255)
- *   DECISION_ENGINE     -> `decision_engine` (decided, escalated, vetoed, reversed, mode, needs_human_before/after; forge#4766)
+ *   DECISION_ENGINE     -> `decision_engine` (decided, escalated, vetoed, reversed, mode, needs_human_before/after; forge#4766; emitted once the engine is wired)
  *   PRODWATCH_METRICS   -> `prodwatch_metrics` (source, sample, invalid, fp_rate, fix_ineffective_rate, recurrence_rate, signal_to_issue/merge/verified_ms; forge#4837)
  *   STRUCTURE_DELTA     -> `structure_delta` (edges_added/removed, import_files_added/removed, boundary_changed/loosened 0|1; forge#4159)
  *                          lean's merge-time record (forge#4165) adds milestone, the pr and string lists: deps_added and

package/bin/engine-cli.mjs

@@ -21,7 +21,7 @@ import { parseForgeYaml } from "./forge-utils.mjs";
 import { makeEmitTelemetry } from "./engine/telemetry-seam.mjs";
 import { makeEventEmitter, probeSweepEvents, experimentEvent } from "./engine/events.mjs";
 import { readExperiment } from "./experiment.mjs";
-import { readBranches, resolveLane, isDefaultLane } from "./lean/lane.mjs";
+import { readBranches, resolveLane, isDefaultLane, makeLaneCache } from "./lean/lane.mjs";
 import { parseVerify } from "./lean/verify.mjs";
 import { normalizeKindModes } from "./lean/conformance.mjs";
 import { viewIssue } from "./lean/gh-assoc.mjs";
@@ -1327,6 +1327,26 @@ async function addToBatch({ id, tokens, root, io, viaDaemon = null, print = (l)
 /** #4592: a resume's release line, only when it freed something. */
 const onlyReleased = (l, out = (t) => console.log(t)) => { if (!l.endsWith("(none)")) out(l); };
 
+/**
+ * #5031: the `baseWait` seam of `orchestrate` for issues admitted while a dependency's merge commit was not yet on their base:
+ * a detail string until every awaited commit is an ancestor of origin/<base> (fetched at most every 30s per base), else null.
+ */
+function baseWaitOf(waits, { io, leanIo, cwd, now = () => Date.now() }) {
+  const fetched = new Map();
+  return async (n) => {
+    const l = waits.get(n);
+    if (!l) return null;
+    const missing = [];
+    for (const w of l) {
+      if (now() - (fetched.get(w.base) ?? -Infinity) > 30000) { fetched.set(w.base, now()); try { await leanIo.git(["fetch", "origin", w.base], { cwd }); } catch { /* offline: the local ref */ } }
+      let on = false;
+      for (const ref of [`origin/${w.base}`, w.base]) if (!on) on = await io.git?.(["-C", cwd, "merge-base", "--is-ancestor", w.sha, ref]).then(() => true, () => false);
+      if (!on) missing.push(w);
+    }
+    return missing.length ? `waiting for ${missing.map((w) => `#${w.dep} (${w.sha.slice(0, 10)})`).join(", ")} on ${missing[0].base}` : null;
+  };
+}
+
 /**
  * `--hold <id> N...` / `--release <id> N...` (#4592): the batch's `hold` file, through the daemon (`viaDaemon(op, issues)`, null
  * when none runs) or directly. A held issue is not admitted (a running lane is not stopped); `--release` (or a `--resume` that
@@ -1569,12 +1589,15 @@ export async function runBatch({ argv, cwd: callerCwd = process.cwd(), env: call
     await holdBatch({ op: "release", id: resumeId, tokens: resumeExtra, root, print: (l) => onlyReleased(l, (t) => sink.line(t)) }); // #4592
   }
   let batch, plan = null;
+  const baseWaits = new Map(); // #5031: issue -> [{dep, sha, base}] merge commits not yet on its base at start
   if (resumeId) {
     batch = batchMod.openBatch(root, resumeId);
     batch.scrubPlan(); // #4787: a pre-fix plan.json keeps no secret; the lanes re-read it from the environment
     plan = batch.readPlan();
     if (!plan) throw new Error(`no batch ${resumeId} in ${root}`);
     argv = plan.argv;
+    // #5031: a resume (operator or schedd restart) keeps the base waits recorded at start; a landed commit releases on the first check
+    for (const [n, l] of Object.entries(plan.baseWaits ?? {})) if (Array.isArray(l) && l.length) baseWaits.set(Number(n), l.filter((w) => w && typeof w.sha === "string" && typeof w.base === "string"));
   }
   const issues = issuesOf(argv);
   if (!issues.length) throw new Error(ORCH_USAGE);
@@ -1602,16 +1625,26 @@ export async function runBatch({ argv, cwd: callerCwd = process.cwd(), env: call
       const { unmetDependencies } = await import("../scripts/plan-validate-live.mjs");
       const gateBranches = readBranches(cwd);
       const gateIo = deps.leanIo ?? (await import("./lean/effects.mjs")).makeLeanIo({ repo });
-      const unmet = await unmetDependencies({ issues, repo, gh: io.gh, baseOf: async (n) => {
+      const isAncestor = async (sha, b) => {
+        for (const ref of [`origin/${b}`, b]) if (await io.git?.(["-C", cwd, "merge-base", "--is-ancestor", sha, ref]).then(() => true, () => false)) return true;
+        return false;
+      };
+      let unmet = await unmetDependencies({ issues, repo, gh: io.gh, isAncestor, baseOf: async (n) => {
         const r = await resolveLane({ issue: n, repo, io: gateIo, cwd, branches: gateBranches, requested: lane, override: laneOverride });
         return r.ok ? r.lane : null;
       } });
+      // #5031: a dependency merged but not yet on the base is admitted and held until its commit lands; any other unmet edge still refuses
+      for (const u of unmet.filter((x) => x.kind === "commit")) {
+        const list = baseWaits.get(u.issue) ?? []; list.push({ dep: u.dep, sha: u.sha, base: u.base }); baseWaits.set(u.issue, list);
+      }
+      for (const [n, l] of baseWaits) sink.line(`held: #${n} waits for ${l.map((w) => `#${w.dep} (${w.sha.slice(0, 10)}) on ${w.base}`).join(", ")}; admitted once the commit lands`);
+      unmet = unmet.filter((x) => x.kind !== "commit");
       if (unmet.length) throw new Error(`parallel milestone start refused: ${unmet.map((u) => `#${u.issue} depends on #${u.dep} (${u.why}; base ${u.base})`).join("; ")}. Merge the dependencies first, or pass --force "<reason>".`);
     }
     const base = deps.batchId ?? batchMod.newBatchId();
     batch = batchMod.openBatch(root, base);
     for (let i = 2; batch.exists(); i++) batch = batchMod.openBatch(root, `${base}.${i}`); // never resume by accident
-    plan = { v: 1, id: batch.id, argv: [...argv], repo, cwd, created: new Date().toISOString(), ...(force ? { forced: force } : {}), ...(daemon ? { daemon: true, env: kept } : {}) };
+    plan = { v: 1, id: batch.id, argv: [...argv], repo, cwd, created: new Date().toISOString(), ...(force ? { forced: force } : {}), ...(baseWaits.size ? { baseWaits: Object.fromEntries(baseWaits) } : {}), ...(daemon ? { daemon: true, env: kept } : {}) };
     batch.writePlan(plan);
     batch.setParallel(parallel);
   } else {
@@ -1644,8 +1677,10 @@ export async function runBatch({ argv, cwd: callerCwd = process.cwd(), env: call
   const prefilter = argv.includes("--no-prefilter") ? null
     : makePrefilter({ repo, cwd, io: leanIo, ...prefilterModel(argv), defaultBranch: lazyDefaultBranch({ io: leanIo, repo, cwd, configured: branches.default }), preconditionCmd: readPreconditionCmd(cwd), minAge: await readPostDeployMinAge(cwd) });
   const fetched = new Set();
+  const laneCache = makeLaneCache(), milestoneOf = new Map(); // #4963: shared default-branch / ls-remote reads; the milestone readBody already fetched
   const laneOf = async (n) => {
-    const r = await resolveLane({ issue: n, repo, io: leanIo, cwd, branches, requested: lane, override: laneOverride });
+    const known = milestoneOf.get(n); milestoneOf.delete(n); // used once: a later retry re-reads the live milestone
+    const r = await resolveLane({ issue: n, repo, io: leanIo, cwd, branches, requested: lane, override: laneOverride, cache: laneCache, milestone: known });
     if (r.ok && prefilter && !fetched.has(r.lane)) { fetched.add(r.lane); try { await leanIo.git(["fetch", "origin", r.lane], { cwd }); } catch { /* offline: use the local ref */ } }
     return r;
   };
@@ -1886,7 +1921,7 @@ export async function runBatch({ argv, cwd: callerCwd = process.cwd(), env: call
       trusted: (n) => trustedOf.get(n) === true,
       autoChildren,
       ...(autoMod.addsEpicChildren(autoChildren.mode) ? { getChildren: async () => ({ list: await autoMod.readChildList({ gh: (a) => leanIo.gh(a), repo, fields: childFields ??= await autoMod.hostListFields((a) => leanIo.gh(a)) }), elsewhere: autoMod.liveElsewhere({ batchMod, root, self: batch.id, repo }) }) } : {}),
-      issues, parallel, prefilter, resolveLane: laneOf, store: batch.store, getParallel: batch.readParallel, getAdded: batch.readAdded, getRequeued: batch.readRequeued, getCancelled: batch.readCancel, getHeld: batch.readHeld, getGates: batch.readGates, ...lanes,
+      issues, parallel, prefilter, resolveLane: laneOf, store: batch.store, getParallel: batch.readParallel, getAdded: batch.readAdded, getRequeued: batch.readRequeued, getCancelled: batch.readCancel, getHeld: batch.readHeld, getGates: batch.readGates, baseWait: baseWaits.size ? baseWaitOf(baseWaits, { io, leanIo, cwd }) : null, ...lanes,
       breaker: orch.breaker, maxDeferrals: orch.maxDeferrals, ...(deps.pollMs ? { pollMs: deps.pollMs } : {}), ...budget, limits, identity, batchId: batch.id, drift, lifecycle, integration,
       ...(registry ? { sched: { registry, batch: batch.id, repo, cap: liveLaneCap(orch.globalParallel ?? null, { cfg: readAdmission(cwd) }), exclusive: true }, priorityOf: async (n) => schedMod.priorityFromLabels(await labelNames(n)) } : {}),
       ...(remote ? { remote } : {}),
@@ -1928,8 +1963,8 @@ export async function runBatch({ argv, cwd: callerCwd = process.cwd(), env: call
         sink.line(`cross-lane: #${e.issue} (${e.lane}) depends on #${e.dependency} (${e.dependencyLane}); its fix will not be on ${e.lane}: re-milestone #${e.dependency} or wait for a milestone sync`);
       },
       readBody: maint || registry || hybrid
-        ? async (n) => { const v = await viewIssue(leanIo.gh, repo, n, "body,labels,comments,author"); trustedOf.set(n, bodyTrusted(v)); labelsOf.set(n, (v.labels ?? []).map((x) => x.name)); needsOf.set(n, detectNeeds(placementText(v), execForNeeds)); if (execForNeeds?.relay) prefetchOf.set(n, relayPrefetchCommands(v, execForNeeds.relay)); return v.body; }
-        : async (n) => { const v = await viewIssue(leanIo.gh, repo, n, "body,comments,author"); trustedOf.set(n, bodyTrusted(v)); needsOf.set(n, detectNeeds(placementText(v), execForNeeds)); if (execForNeeds?.relay) prefetchOf.set(n, relayPrefetchCommands(v, execForNeeds.relay)); return v.body; }, // #4785: decisions and the frozen contract's validate commands too
+        ? async (n) => { const v = await viewIssue(leanIo.gh, repo, n, "body,labels,comments,author,milestone"); if ("milestone" in v) milestoneOf.set(n, v.milestone?.title ?? null); trustedOf.set(n, bodyTrusted(v)); labelsOf.set(n, (v.labels ?? []).map((x) => x.name)); needsOf.set(n, detectNeeds(placementText(v), execForNeeds)); if (execForNeeds?.relay) prefetchOf.set(n, relayPrefetchCommands(v, execForNeeds.relay)); return v.body; }
+        : async (n) => { const v = await viewIssue(leanIo.gh, repo, n, "body,comments,author,milestone"); if ("milestone" in v) milestoneOf.set(n, v.milestone?.title ?? null); trustedOf.set(n, bodyTrusted(v)); needsOf.set(n, detectNeeds(placementText(v), execForNeeds)); if (execForNeeds?.relay) prefetchOf.set(n, relayPrefetchCommands(v, execForNeeds.relay)); return v.body; }, // #4785: decisions and the frozen contract's validate commands too
       onUpdate: (r) => sink.row(r),
     });
   } finally { for (const [sig, f] of Object.entries(handlers)) off(sig, f); }
@@ -2301,11 +2336,12 @@ export async function schedFromCli(argv, deps = {}) {
     const st = reg.list();
     const who = (e) => `#${e.issue} ${e.repo ?? "-"} batch ${e.batch ?? "-"} P${e.priority}`;
     console.log(deps.tick ?? health.tickText(health.stallCheck({ dir: schedMod.schedDir() })));
-    console.log(`host cap: ${st.cap ?? "none set here (each batch's orchestration.global_parallel applies)"}; running ${st.slots.length}, queued ${st.queue.length}`);
+    console.log(`host cap: ${st.cap ?? "none set here (each batch's orchestration.global_parallel applies)"}; running ${st.slots.length}, queued ${st.queue.length}, remote ${(st.remote ?? []).length}`);
     const ws = Object.entries(st.weights ?? {});
     console.log(`repo weights: ${ws.length ? ws.map(([r, n]) => `${r}=${n}`).join(", ") : "equal (none set)"}`);
     for (const e of st.slots) console.log(`  running ${who(e)}  dispatcher ${e.pid}${e.lanePid ? ` lane ${e.lanePid}` : ""}`);
     for (const e of st.queue) console.log(`  queued  ${who(e)}  dispatcher ${e.pid}`);
+    for (const l of schedMod.remoteLines(st)) console.log(l); // #4964
     return st;
   }
   if (sub === "cap") {

package/bin/forgedock.mjs

@@ -221,6 +221,19 @@ function detectInstallPaths() {
 
 const SCRIPTS_DIR = join(FORGE_HOME, "scripts");
 
+/**
+ * True when a link at ~/.claude/<kind>/<rel> points at a ForgeDock-owned
+ * source: the package file, or its copy in the persisted ~/.forge home
+ * (persistHome(), #1943, makes npm installs link there). Path-only, so links
+ * left dangling after ~/.forge is deleted still count as ours (#4962).
+ */
+function isOwnedLinkTarget(dest, src, kind, rel) {
+  return (
+    dest === src ||
+    resolve(dest) === resolve(join(HOME, ".forge", kind, rel))
+  );
+}
+
 // PIPELINE_SCRIPTS (the allowlist of universal pipeline-agent scripts linked
 // to ~/.claude/scripts/) is defined in journey.mjs — forge()'s
 // linkPipelineScripts() step is what writes them there (forge#1885,
@@ -1183,7 +1196,7 @@ async function uninstall() {
       const stats = await lstat(target);
       if (stats.isSymbolicLink()) {
         const current = await readlink(target);
-        if (current === file) {
+        if (isOwnedLinkTarget(current, file, "commands", rel)) {
           await unlink(target);
           console.log(`  ${RED}Removed${RESET}: ${rel}`);
           removed++;
@@ -1259,7 +1272,7 @@ async function uninstall() {
       const stats = await lstat(target);
       if (stats.isSymbolicLink()) {
         const current = await readlink(target);
-        if (current === file) {
+        if (isOwnedLinkTarget(current, file, "scripts", rel)) {
           await unlink(target);
           console.log(`  ${RED}Removed${RESET}: scripts/${rel}`);
           scriptsRemoved++;
@@ -2507,10 +2520,16 @@ async function doctor(fix = false) {
             const lstats = await lstat(tgt);
             if (lstats.isSymbolicLink()) {
               const dest = await readlink(tgt);
-              if (dest !== src) {
+              if (dest !== src && !isOwnedLinkTarget(dest, src, "commands", rel)) {
                 broken++;
                 brokenLinks.push(rel);
                 symlinkOk = false;
+              } else if (dest !== src && readFileSync(tgt, "utf-8") !== readFileSync(src, "utf-8")) {
+                // Linked into the persisted ~/.forge home: valid only while
+                // that copy matches the package source (#4962).
+                broken++;
+                brokenLinks.push(`${rel} (stale ~/.forge copy)`);
+                symlinkOk = false;
               } else {
                 try {
                   // readlink() only validates the stored target. Opening the
@@ -3111,34 +3130,41 @@ async function doctor(fix = false) {
   // server presence is orthogonal to the core ForgeDock install — but missing
   // it causes /qa-sweep to silently fail mid-sweep.
   {
+    // Claude Code registers servers in ~/.claude.json (user + per-project) and
+    // project .mcp.json; the legacy mcp_servers.json is still honoured (#4962).
     const mcpServersPath = join(GLOBAL_CLAUDE_DIR, "mcp_servers.json");
     let playwrightFound = false;
     let fileReadable = false;
     let hasMcpServers = false;
-
-    try {
-      const mcpRaw = readFileSync(mcpServersPath, "utf-8");
-      const mcpConfig = JSON.parse(mcpRaw);
-      // Read + parse succeeded — the file exists and contains valid JSON.
+    const readJson = (p) => {
+      try {
+        return JSON.parse(readFileSync(p, "utf-8"));
+      } catch {
+        return null;
+      }
+    };
+    const userCfg = readJson(join(HOME, ".claude.json"));
+    const sources = [
+      readJson(mcpServersPath),
+      userCfg,
+      userCfg?.projects?.[process.cwd()],
+      readJson(join(process.cwd(), ".mcp.json")),
+    ];
+    for (const cfg of sources) {
+      if (!cfg || typeof cfg !== "object") continue;
       fileReadable = true;
-      const servers = mcpConfig?.mcpServers;
-      if (servers && typeof servers === "object") {
-        hasMcpServers = true;
-        // Search for a registered server whose name or command references playwright
-        for (const [name, entry] of Object.entries(servers)) {
-          const nameLower = name.toLowerCase();
-          const cmdStr = [
-            entry?.command ?? "",
-            ...(Array.isArray(entry?.args) ? entry.args : []),
-          ].join(" ").toLowerCase();
-          if (nameLower.includes("playwright") || cmdStr.includes("playwright")) {
-            playwrightFound = true;
-            break;
-          }
+      const servers = cfg.mcpServers;
+      if (!servers || typeof servers !== "object") continue;
+      hasMcpServers = true;
+      for (const [name, entry] of Object.entries(servers)) {
+        const cmdStr = [
+          entry?.command ?? "",
+          ...(Array.isArray(entry?.args) ? entry.args : []),
+        ].join(" ").toLowerCase();
+        if (name.toLowerCase().includes("playwright") || cmdStr.includes("playwright")) {
+          playwrightFound = true;
         }
       }
-    } catch {
-      // File absent or unreadable — treat as no MCP servers configured
     }
 
     if (!fileReadable) {

package/bin/gc.mjs

@@ -600,7 +600,9 @@ export function hygieneCheck(plan, { applied = null, ttlMs = plan?.ttlMs ?? hygi
     if (owned.length) parts.push(`${owned.length} ${t}${owned.length === 1 ? "" : "s"} ${fmtSize(owned.reduce((s, i) => s + (i.sizeBytes ?? 0), 0))}`);
   }
   const reclaimable = items.filter((i) => i.owned && i.action === "reclaim").length;
-  const stale = items.filter((i) => !i.owned && i.ageMs != null && i.ageMs >= (ttlMs?.[i.type] ?? LEDGER_TTL_MS)).length;
+  // Unrelated docker projects (compose etc.) are not ours to nag about (#4962): only ForgeDock-named docker resources count.
+  const forgeNamed = (i) => (i.type !== "container" && i.type !== "volume") || /^(forgedock|forge-|fdrsbx)/i.test(String(i.id));
+  const stale = items.filter((i) => !i.owned && forgeNamed(i) && i.ageMs != null && i.ageMs >= (ttlMs?.[i.type] ?? LEDGER_TTL_MS)).length;
   const bits = [`owned: ${parts.length ? parts.join(", ") : "none"}`];
   if (applied) bits.push(`reclaimed ${applied.reclaimed.length} of ${reclaimable}${applied.failed.length ? ` (${applied.failed.length} failed)` : ""}${applied.deferred?.length ? ` (${applied.deferred.length} deferred)` : ""}`);
   else bits.push(`${reclaimable} reclaimable`);

package/bin/hooks/pre-tool-use.mjs

@@ -602,7 +602,7 @@ async function main() {
   if (!(await isForgeDockManagedCwd())) { process.exit(0); return; }
 
   // --- Rule 1: PR branch target validation ---
-  const prViolation = checkPrTarget(command);
+  const prViolation = await checkPrTarget(command);
   if (prViolation) {
     process.stderr.write(prViolation);
     process.exit(2);
@@ -749,6 +749,51 @@ async function isForgeDockManagedCwd() {
 // Rule 1: PR branch target validation
 // ---------------------------------------------------------------------------
 
+/**
+ * Resolve the `owner/repo` a `gh pr create` command targets: `-R`/`--repo`,
+ * else the cwd's `origin` remote. Lower-cased; null when unresolvable.
+ *
+ * @param {string} command
+ * @returns {string|null}
+ */
+function resolvePrTargetRepo(command) {
+  const slug = (v) => {
+    const m = String(v || "").trim().match(/([^/:\s]+)\/([^/\s]+?)(?:\.git)?\/?$/);
+    return m ? `${m[1]}/${m[2]}`.toLowerCase() : null;
+  };
+  const flagged = extractFlag(command, "--repo") || extractFlag(command, "-R");
+  if (flagged) return slug(flagged);
+  try {
+    const { execFileSync: exec } = _require("child_process");
+    return slug(exec("git", ["remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 5000,
+    }));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * `owner/repo` of the forge.yaml in cwd (project.owner / project.repo),
+ * lower-cased; null when absent or unreadable.
+ *
+ * @returns {Promise<string|null>}
+ */
+async function configuredRepoSlug() {
+  try {
+    const raw = _require("fs").readFileSync(join(process.cwd(), "forge.yaml"), "utf-8");
+    const { parseForgeYaml } = await import(
+      pathToFileURL(join(FORGE_HOME, "bin", "forge-utils.mjs")).href
+    );
+    const { owner, repo } = parseForgeYaml(raw)?.project ?? {};
+    return owner && repo ? `${owner}/${repo}`.toLowerCase() : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Check whether a gh pr create command targets a forbidden base branch.
  *
@@ -757,9 +802,9 @@ async function isForgeDockManagedCwd() {
  * main are still hard-blocked.
  *
  * @param {string} command
- * @returns {string|null} Error message to show, or null if allowed.
+ * @returns {Promise<string|null>} Error message to show, or null if allowed.
  */
-function checkPrTarget(command) {
+async function checkPrTarget(command) {
   // Only check gh pr create commands.
   if (!/gh\s+pr\s+create/.test(command)) return null;
 
@@ -767,6 +812,12 @@ function checkPrTarget(command) {
   if (!base) return null; // no --base flag — gh will use the default
 
   if (FORBIDDEN_PR_BASES.includes(base.toLowerCase())) {
+    // The staging/milestone rule only governs the configured forge repo; a PR
+    // to a positively-identified other repo may legitimately target main.
+    const target = resolvePrTargetRepo(command);
+    const configured = await configuredRepoSlug();
+    if (target && configured && target !== configured) return null;
+
     // Allow staging → main (the deploy path, not a pipeline violation).
     const head = extractFlag(command, "--head") || extractFlag(command, "-H") || currentGitBranch();
     if (head && /^staging$/.test(head)) {

package/bin/lean/autochildren.mjs

@@ -4,6 +4,8 @@
 // Pure and deterministic: the child scan reads one open-issue list per pass; no LLM call.
 import { parentOf } from "./context.mjs";
 import { parseHelpFields } from "./selftest-static.mjs";
+import { listAssociations } from "./gh-assoc.mjs";
+import { isTrustedActor } from "../engine/phases.mjs";
 
 export const AUTO_MODES = ["off", "decomposed", "epic", "all"];
 export const DEFAULT_AUTO_MODE = "decomposed";
@@ -41,9 +43,11 @@ const labelsOf = (it) => nodesOf(it?.labels).map((l) => String(l?.name ?? l));
  * @param {Iterable<number>} roots the batch issues plus the `--epic N` epics
  * @param {Iterable<number>} skip issues the batch already holds
  * @returns {number[]} open children of a root, ascending: `**Parent**: #P` line, `parent` field, or the root's `subIssues`;
- *   an issue labelled `needs-human` is left out.
+ *   an issue labelled `needs-human` is left out. #4982: so is a child whose author is not trusted (the `Blocked by` edge
+ *   rule, `isTrustedActor`; a missing association fails closed), reported through `onSkip({number, reason})`.
+ * @param {(s:{number:number, reason:string})=>void} [onSkip]
  */
-export function selectChildren({ list, roots, skip = [] }) {
+export function selectChildren({ list, roots, skip = [], onSkip }) {
   const rootSet = new Set(roots), skipSet = new Set(skip), open = new Set(), out = new Set();
   for (const it of list ?? []) if (Number.isSafeInteger(it?.number)) open.add(it.number);
   for (const it of list ?? []) {
@@ -54,10 +58,12 @@ export function selectChildren({ list, roots, skip = [] }) {
     if (p != null && rootSet.has(p)) out.add(n);
   }
   const byNum = new Map((list ?? []).map((it) => [it.number, it]));
-  return [...out].filter((n) => !skipSet.has(n) && !labelsOf(byNum.get(n)).includes("needs-human")).sort((a, b) => a - b);
+  const trusted = (it) => isTrustedActor({ association: it?.authorAssociation, type: it?.author?.is_bot ? "Bot" : "User", login: it?.author?.login });
+  return [...out].filter((n) => !skipSet.has(n) && !labelsOf(byNum.get(n)).includes("needs-human")).sort((a, b) => a - b)
+    .filter((n) => trusted(byNum.get(n)) || (onSkip?.({ number: n, reason: "untrusted author" }), false));
 }
 
-const REQUIRED_FIELDS = ["number", "body", "labels"], OPTIONAL_FIELDS = ["parent", "subIssues"];
+const REQUIRED_FIELDS = ["number", "body", "labels", "author"], OPTIONAL_FIELDS = ["parent", "subIssues"];
 
 /** The `--json` list this host's `gh issue list` accepts (read from its `--help`, K4): the required fields plus whichever sub-issue fields it advertises. */
 export async function hostListFields(gh) {
@@ -74,7 +80,9 @@ export async function readChildList({ gh, repo, limit = 1000, fields = null }) {
   const f = fields ?? (await hostListFields(gh));
   const raw = await gh(["issue", "list", "-R", repo, "--state", "open", "--limit", String(limit), "--json", f.join(",")]);
   const v = JSON.parse(raw);
-  return Array.isArray(v) ? v : [];
+  if (!Array.isArray(v)) return [];
+  const assoc = await listAssociations(gh, repo); // #4982: not a `gh issue list` field (#4859); unreadable = every author untrusted
+  return v.map((it) => ({ ...it, authorAssociation: assoc.get(it?.number) }));
 }
 
 /**

package/bin/lean/autochildren.test.mjs

@@ -26,12 +26,12 @@ describe("#4965 modes", () => {
 describe("#4965 selectChildren", () => {
   const list = [
     { number: 1, body: "epic", labels: [], subIssues: { nodes: [{ number: 5 }, { number: 9 }] } },
-    { number: 2, body: "x\n\n**Parent**: #1", labels: [] },
-    { number: 3, body: "", labels: [], parent: { number: 1 } },
-    { number: 4, body: "**Parent**: #1", labels: [{ name: "needs-human" }] },
-    { number: 5, body: "", labels: [] },
-    { number: 6, body: "**Parent**: #77", labels: [] },
-    { number: 7, body: "**Parent**: #1", labels: [] },
+    { number: 2, body: "x\n\n**Parent**: #1", labels: [], authorAssociation: "MEMBER" },
+    { number: 3, body: "", labels: [], parent: { number: 1 }, authorAssociation: "MEMBER" },
+    { number: 4, body: "**Parent**: #1", labels: [{ name: "needs-human" }], authorAssociation: "MEMBER" },
+    { number: 5, body: "", labels: [], authorAssociation: "MEMBER" },
+    { number: 6, body: "**Parent**: #77", labels: [], authorAssociation: "MEMBER" },
+    { number: 7, body: "**Parent**: #1", labels: [], authorAssociation: "MEMBER" },
   ];
   it("finds children by Parent line, parent field and sub-issues; skips needs-human, closed sub-issues and unrelated", () => {
     assert.deepEqual(selectChildren({ list, roots: [1], skip: [1] }), [2, 3, 5, 7]);
@@ -42,8 +42,25 @@ describe("#4965 selectChildren", () => {
   it("an --epic root outside the batch yields its children", () => {
     assert.deepEqual(selectChildren({ list, roots: [77] }), [6]);
   });
+  it("#4982 selectChildren drops children of an untrusted author and reports each", () => {
+    const l = [
+      { number: 1, body: "", labels: [], authorAssociation: "OWNER", subIssues: { nodes: [{ number: 5 }] } },
+      { number: 2, body: "**Parent**: #1", labels: [], authorAssociation: "NONE", author: { login: "eve" } },
+      { number: 3, body: "**Parent**: #1", labels: [], authorAssociation: "MEMBER" },
+      { number: 4, body: "**Parent**: #1", labels: [], author: { login: "app", is_bot: true } },
+      { number: 5, body: "", labels: [] },
+      { number: 6, body: "", labels: [], parent: { number: 1 } },
+    ];
+    const skipped = [];
+    assert.deepEqual(selectChildren({ list: l, roots: [1], skip: [1], onSkip: (s) => skipped.push(s) }), [3, 4]);
+    assert.deepEqual(skipped, [2, 5, 6].map((number) => ({ number, reason: "untrusted author" })));
+  });
+  it("#4982 readChildList merges the REST author association per issue", async () => {
+    const gh = async (a) => a[0] === "api" ? "1\tMEMBER\n" : a.includes("--help") ? "JSON FIELDS\n  number, body, labels, author\n\nEXAMPLES\n" : "[{\"number\":1},{\"number\":2}]";
+    assert.deepEqual(await readChildList({ gh, repo: "o/r" }), [{ number: 1, authorAssociation: "MEMBER" }, { number: 2, authorAssociation: undefined }]);
+  });
   it("children filed later appear on a later list", () => {
-    assert.deepEqual(selectChildren({ list: [...list, { number: 8, body: "**Parent**: #1", labels: [] }], roots: [1], skip: [1, 2, 3, 5, 7] }), [8]);
+    assert.deepEqual(selectChildren({ list: [...list, { number: 8, body: "**Parent**: #1", labels: [], authorAssociation: "MEMBER" }], roots: [1], skip: [1, 2, 3, 5, 7] }), [8]);
   });
 });
 
@@ -59,17 +76,17 @@ describe("#4965 readers", () => {
   };
   it("readChildList asks the host gh for its fields, then makes one list call", async () => {
     const calls = [];
-    const r = await readChildList({ gh: fakeGh(["number", "body", "labels", "parent", "subIssues", "title"], calls), repo: "o/r" });
-    assert.equal(calls.filter((a) => !a.includes("--help")).length, 1);
-    assert.equal(calls.at(-1)[calls.at(-1).indexOf("--json") + 1], "number,body,labels,parent,subIssues");
-    assert.deepEqual(r, [{ number: 1 }]);
+    const r = await readChildList({ gh: fakeGh(["number", "body", "labels", "author", "parent", "subIssues", "title"], calls), repo: "o/r" });
+    assert.equal(calls.filter((a) => a.includes("--json")).length, 1);
+    assert.equal(calls.findLast((a) => a.includes("--json"))[calls.findLast((a) => a.includes("--json")).indexOf("--json") + 1], "number,body,labels,author,parent,subIssues");
+    assert.deepEqual(r, [{ number: 1, authorAssociation: undefined }]);
   });
   it("a host gh without parent/subIssues still lists, with the fields it has (children found by Parent line)", async () => {
     const calls = [];
-    const gh = fakeGh(["number", "body", "labels", "title"], calls);
-    assert.deepEqual(await hostListFields(gh), ["number", "body", "labels"]);
-    assert.deepEqual(await readChildList({ gh, repo: "o/r" }), [{ number: 1 }]);
-    assert.equal(calls.at(-1)[calls.at(-1).indexOf("--json") + 1], "number,body,labels");
+    const gh = fakeGh(["number", "body", "labels", "author", "title"], calls);
+    assert.deepEqual(await hostListFields(gh), ["number", "body", "labels", "author"]);
+    assert.deepEqual(await readChildList({ gh, repo: "o/r" }), [{ number: 1, authorAssociation: undefined }]);
+    assert.equal(calls.findLast((a) => a.includes("--json"))[calls.findLast((a) => a.includes("--json")).indexOf("--json") + 1], "number,body,labels,author");
   });
   it("liveElsewhere holds the unsettled issues of other live batches of the repo only", () => {
     const mk = (o) => ({ readReport: () => o.report ?? null, readPlan: () => ({ repo: o.repo ?? "o/r" }), store: { load: () => ({ order: o.order, results: o.results ?? {} }) } });
@@ -109,11 +126,12 @@ appendFileSync(${JSON.stringify(launches)}, a[1] + "\\n"); writeFileSync(rf, JSO
     b.setParallel(2);
     const lists = [];
     const gh = async (a) => {
-      if (a[0] === "issue" && a[1] === "list" && a.includes("--help")) return "JSON FIELDS\n  number, body, labels, parent, subIssues\n\nEXAMPLES\n";
-      if (a[0] === "issue" && a[1] === "list" && a.includes("--state") && a.includes("number,body,labels,parent,subIssues")) { lists.push(a); return JSON.stringify([{ number: 9, body: "", labels: [] }, { number: 51, body: "**Parent**: #9", labels: [] }]); }
+      if (a[0] === "issue" && a[1] === "list" && a.includes("--help")) return "JSON FIELDS\n  number, body, labels, author, parent, subIssues\n\nEXAMPLES\n";
+      if (a[0] === "issue" && a[1] === "list" && a.includes("--state") && a.includes("number,body,labels,author,parent,subIssues")) { lists.push(a); return JSON.stringify([{ number: 9, body: "", labels: [], authorAssociation: "MEMBER" }, { number: 51, body: "**Parent**: #9", labels: [], authorAssociation: "MEMBER" }]); }
+      if (a[0] === "api" && /issues\?state=open/.test(a[1])) return "9\tMEMBER\n51\tMEMBER\n";
       if (a.includes("milestone")) return JSON.stringify({ milestone: null });
       if (a[0] === "repo") return "main\n";
-      return JSON.stringify({ body: "", state: "OPEN", labels: [] });
+      return JSON.stringify({ body: "", state: "OPEN", labels: [], authorAssociation: "MEMBER" });
     };
     const deps = { batchRoot: root, allowTmpfs: true, laneScript: stub, pollMs: 20, orchestration: { breaker: null, maxDeferrals: 3 }, io: { gh: async () => "o/r\n" },
       leanIo: { gh, git: async (a) => (a[0] === "ls-remote" ? "abc\trefs/heads/staging\n" : "") } };

package/bin/lean/batch.test.mjs

@@ -6,6 +6,7 @@ import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpDir } from "../tests/_tmp.mjs";
+import { resolveLane, makeLaneCache } from "./lane.mjs";
 import { orchestrate, deferPolicy, DEFER_BACKOFF_S, formatOutcomeLists } from "./orchestrate.mjs";
 import { openBatch, fsTypeOf, assertDiskPath, isLaneAlive, writeAtomic, launchLane, detachedLanes } from "./batch.mjs";
 import { orchestrateFromCli, runFromCli, readOrchestration, makeRelabelNeedsHuman, makeDispatchCheck } from "../engine-cli.mjs";
@@ -1194,4 +1195,49 @@ describe("batch plan secrets (#4787)", () => {
     assert.equal(statSync(join(b.dir, "plan.json")).mode & 0o777, 0o600);
     assert.deepEqual(b.scrubPlan(), []);
   });
+
+  it("setup reads run with bounded concurrency, keep order and deps, and write an early setup state (#4963)", async () => {
+    const saves = []; let live = 0, peak = 0;
+    const bodies = { 1: "Blocked by #2", 2: "", 3: "Depends on #1", 4: "", 5: "" };
+    const store = { load: () => null, save: (s) => saves.push(JSON.parse(JSON.stringify(s))) };
+    await orchestrate({ issues: [1, 2, 3, 4, 5], parallel: 1, store, setupConcurrency: 2, trusted: () => true,
+      readBody: async (n) => { live++; peak = Math.max(peak, live); await new Promise((r) => setTimeout(r, 15 - n * 2)); live--; return bodies[n]; },
+      runOne: async () => ({ terminalReason: "merged" }), now: () => Date.now(), sleep: async () => {}, pollMs: 1 });
+    assert.equal(peak, 2);
+    const setupSaves = saves.filter((s) => s.phase === "setup");
+    assert.deepEqual(setupSaves[0].setup, { read: 0, total: 5 });
+    assert.equal(setupSaves.at(-1).setup.read, 5);
+    assert.deepEqual(setupSaves[0].order, [1, 2, 3, 4, 5]);
+    const last = saves.at(-1);
+    assert.equal(last.phase, undefined);
+    assert.deepEqual(last.deps, { 1: [2], 2: [], 3: [1], 4: [], 5: [] });
+  });
+
+  it("a setup save never records an issue as read before its lane is resolved (#4963 resume safety)", async () => {
+    const saves = [];
+    const store = { load: () => null, save: (s) => saves.push(JSON.parse(JSON.stringify(s))) };
+    await orchestrate({ issues: [1, 2, 3, 4], parallel: 1, store, setupConcurrency: 4, trusted: () => true,
+      readBody: async () => "",
+      resolveLane: async (n) => { await new Promise((r) => setTimeout(r, 5 + n * 10)); return { ok: true, lane: "staging" }; },
+      runOne: async () => ({ terminalReason: "merged" }), now: () => Date.now(), sleep: async () => {}, pollMs: 1 });
+    for (const s of saves.filter((x) => x.phase === "setup")) for (const n of Object.keys(s.deps ?? {})) assert.ok(s.lanes?.[n], `setup save lists #${n} in deps without its lane`);
+  });
+
+  it("5 issues with slow gh/git calls reach their first admitted lane in a fraction of the serial setup time (#4963)", async () => {
+    const LAT = 30; // ms per gh/git call, standing in for a loaded host
+    const wait = () => new Promise((r) => setTimeout(r, LAT));
+    const firstLane = async (setupConcurrency, cache) => {
+      const io = { gh: async (a) => { await wait(); return a[0] === "repo" ? "main\n" : JSON.stringify({ milestone: null }); }, git: async () => { await wait(); return "abc\trefs/heads/staging\n"; } };
+      const t0 = Date.now(); let first = null;
+      await orchestrate({ issues: [1, 2, 3, 4, 5], parallel: 5, setupConcurrency, trusted: () => true, now: () => Date.now(), sleep: async () => {}, pollMs: 1,
+        readBody: async () => { await wait(); return ""; },
+        resolveLane: (n) => resolveLane({ issue: n, repo: "o/r", io, cwd: "/r", ...(cache ? { cache: makeLaneCache(), milestone: null } : {}) }),
+        runOne: async () => { first ??= Date.now() - t0; return { terminalReason: "merged" }; } });
+      return first;
+    };
+    const serial = await firstLane(1, false), fast = await firstLane(6, true);
+    // Serial: 5 issues x 4 calls x LAT = 600 ms; bounded + shared lookups: about 3 rounds = 90 ms. The 2-minute target is a 5x cut or better here.
+    assert.ok(fast < serial / 3, `fast ${fast} ms vs serial ${serial} ms`);
+    assert.ok(fast < 10 * LAT, `first lane after ${fast} ms`);
+  });
 });