forgedock 1.46.0 → 1.48.0

package/scripts/prior-attempts.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * scripts/prior-attempts.mjs — prior attempts on an issue's subject (#5085). Deterministic, no LLM.
+ *
+ * Extracts the subject terms (error/outcome codes, symbols, title words) from a title and body, searches closed issues
+ * and merged PRs by those terms (GitHub search) plus the whole git history (`git log --grep`), whatever files they
+ * touched, and prints a `## Prior Attempts` table. Same search as the context pack's subject rows (bin/lean/context.mjs).
+ * Used by /issue (filing time) and as the live fallback when the Forge Ledger recall index is absent.
+ *
+ * Usage: node scripts/prior-attempts.mjs --repo OWNER/NAME --title T [--body-file F] [--issue N] [--base REF] [--json]
+ * Exit: 0 table printed (also when nothing is found), 1 a search failed (stderr says which), 2 usage error.
+ */
+import { execFile } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { subjectHistory } from "../bin/lean/context.mjs";
+
+const USAGE = "usage: prior-attempts.mjs --repo OWNER/NAME --title T [--body-file F] [--issue N] [--base REF] [--json]";
+
+const KEYS = { "--repo": "repo", "--title": "title", "--body-file": "bodyFile", "--issue": "issue", "--base": "base" };
+
+export function parseArgs(argv) {
+  const o = { json: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--json") o.json = true;
+    else if (a === "-h" || a === "--help") o.help = true;
+    else if (Object.hasOwn(KEYS, a)) {
+      if (i + 1 >= argv.length) throw new Error(`${a} needs a value`);
+      o[KEYS[a]] = argv[++i];
+    } else throw new Error(`unknown argument ${a}`);
+  }
+  return o;
+}
+
+// Backslashes first, then pipes: a title ending in "\" must not turn the cell's "\|" back into a column break (CodeQL js/incomplete-sanitization).
+const cell = (s) => String(s ?? "").replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
+const shipped = (r) => (r.status === "merged" ? "yes" : r.status === "not_planned" || r.status === "closed unmerged" ? "no" : "closed");
+
+/** The `## Prior Attempts` markdown for a subjectHistory result; columns 2 and 4 are left for the drafter. */
+export function renderPriorAttempts({ terms = [], rows = [] } = {}) {
+  const out = ["## Prior Attempts", ""];
+  if (!rows.length) out.push(`None found (terms: ${terms.length ? terms.join(", ") : "none"}).`);
+  else {
+    out.push("| Issue/PR | What it changed | Shipped? | Why it didn't hold |", "|---|---|---|---|");
+    for (const r of rows) out.push(`| #${r.number} ${cell(r.title)} (${r.kind}, ${r.status}) | ? | ${shipped(r)} | ? |`);
+    out.push("", `Search terms: ${terms.join(", ")}`);
+  }
+  return out.join("\n");
+}
+
+const run = (cmd) => (args, opts = {}) => new Promise((resolve, reject) =>
+  execFile(cmd, args, { maxBuffer: 16 * 1024 * 1024, ...opts }, (e, stdout, stderr) => (e ? reject(new Error(String(stderr || e.message).trim())) : resolve(stdout))));
+
+/** CLI body; `io` {gh, git, read, out, err} is injectable for tests. Returns the exit code. */
+export async function main(argv, io = {}) {
+  const out = io.out ?? ((s) => process.stdout.write(`${s}\n`)), err = io.err ?? ((s) => process.stderr.write(`${s}\n`));
+  let o;
+  try { o = parseArgs(argv); } catch (e) { err(`${e.message}\n${USAGE}`); return 2; }
+  if (o.help) { out(USAGE); return 0; }
+  if (!o.repo || !/^[\w.-]+\/[\w.-]+$/.test(o.repo) || !o.title) { err(USAGE); return 2; }
+  let body = "";
+  if (o.bodyFile) { try { body = (io.read ?? ((p) => readFileSync(p, "utf8")))(o.bodyFile); } catch (e) { err(`cannot read --body-file: ${e.message}`); return 2; } }
+  const r = await subjectHistory({ io: { gh: io.gh ?? run("gh"), git: io.git ?? run("git") }, repo: o.repo, issue: o.issue ? Number(o.issue) : null, title: o.title, body, base: o.base ?? "HEAD" });
+  out(o.json ? JSON.stringify(r) : renderPriorAttempts(r));
+  for (const e of r.errors) err(`WARNING: ${e}`);
+  return r.errors.length ? 1 : 0;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) process.exitCode = await main(process.argv.slice(2));

package/scripts/prior-attempts.test.mjs

@@ -0,0 +1,52 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { main, parseArgs, renderPriorAttempts } from "./prior-attempts.mjs";
+
+const cap = () => { const o = { out: [], err: [] }; return { o, io: { out: (s) => o.out.push(s), err: (s) => o.err.push(s) } }; };
+const item = (n, title, extra = {}) => JSON.stringify({ number: n, title, state_reason: "completed", pr: false, merged: false, ...extra });
+
+describe("#5085: prior-attempts.mjs", () => {
+  it("prints a ## Prior Attempts table from closed issues and merged PRs found by subject terms, not files", async () => {
+    const { o, io } = cap();
+    const queries = [];
+    const gh = async (a) => { const q = a.find((x) => String(x).startsWith("q=")); queries.push(q);
+      return q.includes('"tls.bypass_misclassified"') ? [item(34683, "TLS bypass counted as block"), item(35204, "Retry TLS | bypass", { pr: true, merged: true }), item(34935, "won't fix", { state_reason: "not_planned" })].join("\n") : ""; };
+    const git = async () => `\x1e${"a".repeat(40)}\x1fMerge pull request #34735 from o/x\x1fClassify tls.bypass_misclassified as success\n`;
+    const code = await main(["--repo", "o/r", "--title", "fix: TLS bypass misclassified", "--body-file", "b.md", "--issue", "38355"], { ...io, gh, git, read: () => "Ends as `tls.bypass_misclassified` in src/a.ts" });
+    assert.equal(code, 0, o.err.join("\n"));
+    const t = o.out.join("\n");
+    assert.match(t, /^## Prior Attempts\n\n\| Issue\/PR \| What it changed \| Shipped\? \| Why it didn't hold \|/);
+    assert.ok(t.includes("| #35204 Retry TLS \\| bypass (PR, merged) | ? | yes | ? |"), t);
+    assert.ok(t.includes("| #34935 won't fix (issue, not_planned) | ? | no | ? |"), t);
+    assert.ok(t.includes("| #34683 TLS bypass counted as block (issue, completed) | ? | closed | ? |"), t);
+    assert.ok(t.includes("| #34735 Classify tls.bypass_misclassified as success (PR, merged) | ? | yes | ? |"), t);
+    assert.ok(t.includes("Search terms: tls.bypass_misclassified, bypass, misclassified"), t);
+    assert.ok(queries.every((q) => q.startsWith("q=repo:o/r is:closed ")) && !queries.some((q) => q.includes("src/a.ts")));
+  });
+
+  it("nothing found prints the heading and the terms; a failed search exits 1 with a warning", async () => {
+    assert.equal(renderPriorAttempts({ terms: ["x.y"], rows: [] }), "## Prior Attempts\n\nNone found (terms: x.y).");
+    const { o, io } = cap();
+    assert.equal(await main(["--repo", "o/r", "--title", "Thin content billing"], { ...io, gh: async () => { throw new Error("HTTP 403"); }, git: async () => "" }), 1);
+    assert.ok(o.out[0].startsWith("## Prior Attempts") && o.err.some((e) => e.startsWith("WARNING: attempts: subject search")));
+  });
+
+  it("a title with a backslash or pipe stays inside its table cell (CodeQL js/incomplete-sanitization, release review #5103)", () => {
+    const t = renderPriorAttempts({ terms: ["x"], rows: [{ number: 7, title: "path a\\|b ends in \\", kind: "issue", status: "merged" }] });
+    const row = t.split("\n").find((l) => l.startsWith("| #7"));
+    assert.ok(row.includes("a\\\\\\|b ends in \\\\ "), row);
+    assert.equal(row.split(/(?<!\\)\|/).length, 6, row);
+  });
+
+  it("usage errors exit 2; --json prints the raw rows", async () => {
+    const { io } = cap();
+    assert.equal(await main(["--title", "x"], io), 2);
+    assert.equal(await main(["--repo", "o/r", "--bogus"], io), 2);
+    assert.throws(() => parseArgs(["--repo"]), /needs a value/);
+    const c = cap();
+    assert.equal(await main(["--repo", "o/r", "--title", "Thin content billing", "--json"], { ...c.io, gh: async () => item(9, "thin"), git: async () => "" }), 0);
+    assert.deepEqual(JSON.parse(c.o.out[0]).rows.map((r) => r.number), [9]);
+  });
+});

package/scripts/review-finalize.sh

@@ -266,7 +266,7 @@ do_extract() {
     # carried head's, and only a VERIFIED carry record (trusted, same head, resolver agrees) selects that SHA. DELTA: reviewers
     # saw only the delta, so the earlier fully reviewed head's findings are read too (they must still reach the Phase 8 gates);
     # the 6B.4 head-SHA and provenance gates then drop any whose cited line is gone from the current head.
-    PRIMARY_SHA="$REVIEW_SHA"; EARLIER_SHA=""
+    PRIMARY_SHA="$REVIEW_SHA"; EARLIER_SHA=""; PRIMARY_FINDINGS=""
     if [ "$REVIEW_MODE" = "BASE_SYNC_ONLY" ]; then
         CARRIED_FROM=$(carry_verified_from); [ -n "$CARRIED_FROM" ] && PRIMARY_SHA="$CARRIED_FROM"
     fi
@@ -280,6 +280,8 @@ do_extract() {
     if [ -n "$EARLIER_SHA" ]; then
         EARLIER_BODIES=$(bodies_at "$EARLIER_SHA") && [ -n "$EARLIER_BODIES" ] \
             || { echo "REVIEW_RESULT: status: BLOCKED, blocker: earlier reviewed head ${EARLIER_SHA} findings unreadable (fail closed)"; exit 3; }
+        # forge#5081: the findings the delta-head reviewers themselves raised; an earlier-pass finding absent from them is "earlier only".
+        PRIMARY_FINDINGS=$(printf '%s\n' "$SOURCE_BODIES" | jq -r 'scan("<!-- FINDING:(.+?) -->") | .[0]' 2>/dev/null)
         SOURCE_BODIES=$(printf '%s\n%s' "$SOURCE_BODIES" "$EARLIER_BODIES")
         CARRIER_BODIES=$(printf '%s\n%s' "$CARRIER_BODIES" "$(agent_bodies_at "$EARLIER_SHA")")
     fi
@@ -385,10 +387,18 @@ do_extract() {
             | tr '[:upper:]' '[:lower:]' | sed -E 's/.*(fails|regresses).*/\1/')
         TEXT_FILE="$WORKDIR/text.$N_EXTRACTED"
         { printf '%s\n%s\n' "$F_TITLE" "$F_FILE"; cat "$SECTION_FILE" 2>/dev/null; } > "$TEXT_FILE"
+        # DELTA: earlier_only = raised only at the earlier head (not by the delta reviewers, not re-raised on the same file within 5 lines).
+        EARLIER_ONLY=false
+        if [ -n "$EARLIER_SHA" ] && ! printf '%s\n' "$PRIMARY_FINDINGS" | grep -qxF -- "${F_ID}|${F_CONF}|${F_SEV}|${F_LOC}|${F_TITLE}" \
+            && ! printf '%s\n' "$PRIMARY_FINDINGS" | awk -F'|' -v f="$F_FILE" -v l="${L1:-0}" '{ loc = $4; i = match(loc, /:[0-9]+(-[0-9]+)?$/)
+                if (i) { file = substr(loc, 1, i - 1); split(substr(loc, i + 1), b, "-"); st = b[1] + 0 } else { file = loc; st = 0 }
+                if (file == f && (l + 0 == 0 || st == 0 || (st >= l - 5 && st <= l + 5))) found = 1 } END { exit !found }'; then
+            EARLIER_ONLY=true
+        fi
         jq -n -c --arg id "$F_ID" --arg c "$F_CONF" --arg s "$F_SEV" --arg loc "$F_LOC" --arg file "$F_FILE" --arg l1 "$L1" --arg l2 "$L2" \
-            --arg title "$F_TITLE" --arg agent "$AGENT" --arg scen "$SCENARIO" --arg fe "$FIX_EFF" --rawfile text "$TEXT_FILE" \
+            --arg title "$F_TITLE" --arg agent "$AGENT" --arg scen "$SCENARIO" --arg fe "$FIX_EFF" --rawfile text "$TEXT_FILE" --argjson eo "$EARLIER_ONLY" \
             '{id: $id, confidence: $c, severity: $s, loc: $loc, file: $file, line_start: ($l1 | tonumber? // null), line_end: ($l2 | tonumber? // null),
-              title: $title, agent: $agent, scenario: $scen, fix_efficacy: $fe, text: $text}' >> "$RAW"
+              title: $title, agent: $agent, scenario: $scen, fix_efficacy: $fe, text: $text} + (if $eo then {earlier_only: true} else {} end)' >> "$RAW"
     done <<EOF
 $FINDINGS
 EOF
@@ -934,6 +944,21 @@ do_file_prepare() {
     }
 
     OUT_ITEMS="$WORKDIR/items.jsonl"; : > "$OUT_ITEMS"
+    # forge#5081: DELTA: the old-side line ranges (file, start, count) the delta rewrote or deleted; an earlier-only finding inside one was fixed there.
+    DELTA_OLD_RANGES="$WORKDIR/delta-old-ranges"; : > "$DELTA_OLD_RANGES"
+    if [ "$REVIEW_MODE" = "DELTA" ] && is_sha "$DELTA_FROM" && is_sha "$REVIEW_SHA"; then
+        _dtop=$(git rev-parse --show-toplevel 2>/dev/null) || _dtop=""
+        if [ -n "$_dtop" ]; then
+            { git -C "$_dtop" diff -U0 --no-color --no-renames "$DELTA_FROM" "$REVIEW_SHA" 2>/dev/null || true; } | while IFS= read -r _l; do
+                case "$_l" in
+                    "--- a/"*) _f="${_l#--- a/}" ;;
+                    "@@ "*) _h="${_l#@@ -}"; _o="${_h%% *}"
+                        case "$_o" in *,*) _oc="${_o#*,}" ;; *) _oc=1 ;; esac
+                        printf '%s\t%s\t%s\n' "$_f" "${_o%%,*}" "$_oc" ;;
+                esac
+            done > "$DELTA_OLD_RANGES" || : > "$DELTA_OLD_RANGES"
+        fi
+    fi
     TOTAL=$(jq '.findings | length' "$IN_FILE"); I=0; N_FILE=0
     while [ "$I" -lt "$TOTAL" ]; do
         F_ROUTE=$(fj .route); F_CLASS=$(fj .class)
@@ -954,7 +979,13 @@ do_file_prepare() {
         else
             DEDUP_RESULT=""; DEDUP_EXIT=0
         fi
-        if [ "$DEDUP_EXIT" -eq 1 ]; then
+        F_EARLIER_ONLY=$(fj .earlier_only)
+        if [ "$F_EARLIER_ONLY" = "true" ] && [ "$F_LINE" -gt 0 ] && [ -s "$DELTA_OLD_RANGES" ] \
+            && awk -F'\t' -v f="$F_FILE" -v l="$F_LINE" '$1 == f && $3 + 0 > 0 && l >= $2 + 0 && l <= $2 + $3 - 1 { found = 1 } END { exit !found }' "$DELTA_OLD_RANGES"; then
+            # The delta rewrote the cited lines and its reviewers did not re-raise the finding: fixed in the delta, never re-filed.
+            ACTION="skip-fixed-in-delta"; NOTE="fixed in delta ${DELTA_FROM:0:7}..${REVIEW_SHA:0:7}"
+            echo "FIXED-IN-DELTA: ${F_FILE}:${F_LINE} was changed by the delta and not re-raised"
+        elif [ "$DEDUP_EXIT" -eq 1 ]; then
             ACTION="skip-dedup"; NOTE="$DEDUP_RESULT"; DEDUP_OF=$(printf '%s' "$DEDUP_RESULT" | sed -n 's/[^0-9]*\([0-9][0-9]*\).*/\1/p' | head -1)
             echo "DEDUP: Skipping — $DEDUP_RESULT"
         elif [ "$DEDUP_EXIT" -eq 2 ]; then

package/scripts/review-finalize.test.sh

@@ -772,6 +772,16 @@ mkfind K-4 CONFIRMED HIGH c.py 5 "Renamed defect"; putfind 1
 jq '.findings |= map(. + {class: "ISSUE", disposition: "ISSUE x"})' "$WORK/out/findings.json" > "$WORK/out/classified.json"
 run "$GOOD" file-prepare
 want "delta mode: Source line marks own closed issue" '.items[0] | [.action, (.dedup_of | tostring)] | join(",")' worklist.json "skip-resolved,63"
+# forge#5081: a finding raised only at the earlier head whose cited lines the delta rewrote is fixed in the delta, never re-filed
+echo "changed" > "$REPO_DIR/c.py"; git -C "$REPO_DIR" commit -qam delta; SHA2=$(git -C "$REPO_DIR" rev-parse HEAD); git -C "$REPO_DIR" reset -q --hard "$SHA"
+fp_setup; SHA_OVERRIDE="$SHA2" mkctx 1 DELTA "$SHA" 12
+echo '[]' > "$FIX/issues-open.json"; echo '[]' > "$FIX/issues-closed.json"
+mkfind K-5 CONFIRMED HIGH c.py 5 "Earlier-only defect"; mkfind K-6 CONFIRMED HIGH c.py 5 "Re-raised defect"; putfind 2
+jq '.findings |= map(. + {class: "ISSUE", disposition: "ISSUE x"} + (if .id == "K-5" then {earlier_only: true} else {} end))' "$WORK/out/findings.json" > "$WORK/out/classified.json"
+run "$GOOD" file-prepare
+want "delta mode: earlier-only finding on rewritten lines is fixed in delta" '.items[] | select(.id == "K-5") | .action' worklist.json "skip-fixed-in-delta"
+want "delta mode: a finding the delta reviewers re-raised is still filed" '.items[] | select(.id == "K-6") | .action' worklist.json "file"
+SHA_OVERRIDE=""
 # the dedup helper receives the title without the shared suffix
 DEDUP_LOG="$WORK/dedup-args"; : > "$DEDUP_LOG"
 printf '#!/usr/bin/env bash\nprintf "%%s\\n" "$1" >> "%s"\nexit 0\n' "$DEDUP_LOG" > "$GOOD/scripts/issue-dedup.sh"

package/scripts/review-prepare.sh

@@ -498,15 +498,15 @@ if [ -n "$DELTA_FROM_OPT" ]; then
             [ -n "$_dl" ] || _dl="[]"
         fi
         if [ -n "$TRUSTED_SCRIPT" ] && [ -n "$COMMENTS_JSON" ]; then
-            _db=$(printf '%s' "$COMMENTS_JSON" | bash "$TRUSTED_SCRIPT" bodies '^<!-- FORGE:REVIEW-AGENT:[a-z0-9-]+ -->|^<!-- REVIEW-FINDINGS-SYNTHESIZED-START -->|# PR Review Summary|^<!-- FORGE:GATE_(PASS|FAILURE) -->|<!-- FORGE:GATE_FAILURE:TYPE=review-panel-integrity|<!-- FORGE:REVIEW_DEGRADED|<!-- FORGE:REVIEW_BLOCKED' 2>/dev/null) \
+            _db=$(printf '%s' "$COMMENTS_JSON" | bash "$TRUSTED_SCRIPT" bodies '^(?:[^\n]*\r?\n){0,4}<!-- FORGE:REVIEW-AGENT:[a-z0-9-]+ -->|^<!-- REVIEW-FINDINGS-SYNTHESIZED-START -->|# PR Review Summary|^<!-- FORGE:GATE_(PASS|FAILURE) -->|<!-- FORGE:GATE_FAILURE:TYPE=review-panel-integrity|<!-- FORGE:REVIEW_DEGRADED|<!-- FORGE:REVIEW_BLOCKED' 2>/dev/null) \
                 && _dv=$(printf '%s\n' "$_db" | jq -s -r --arg f "$DELTA_FROM_OPT" --argjson L "$_dl" '
                     def shas($t; $re): [ $t | scan($re) | .[0] ];
                     def one($a): if ($a | length) == 1 then $a[0] else null end;
                     def rsha: "(?:^|\\n)Reviewed-SHA: ([0-9a-f]{40}|[0-9a-f]{64})\\r?(?:\\n|$)";
                     to_entries as $E
-                    | [ $E[] | select((.value | test("\\A<!-- FORGE:REVIEW-AGENT:[a-z0-9-]+ -->")) and (.value | test("<!-- REVIEW-FINDINGS-START -->")))
+                    | [ $E[] | select((.value | test("\\A(?:[^\\n]*\\r?\\n){0,4}<!-- FORGE:REVIEW-AGENT:[a-z0-9-]+ -->")) and (.value | test("<!-- REVIEW-FINDINGS-START -->")))
                         | select(one(shas(.value; rsha)) == $f)
-                        | {i: .key, d: (.value | capture("\\A<!-- FORGE:REVIEW-AGENT:(?<d>[a-z0-9-]+) -->").d)} ] as $AG
+                        | {i: .key, d: (.value | capture("\\A(?:[^\\n]*\\r?\\n){0,4}<!-- FORGE:REVIEW-AGENT:(?<d>[a-z0-9-]+) -->").d)} ] as $AG
                     | if ($AG | length) == 0 then "no-agent" else
                         ($AG | map(.i) | min) as $first | ($AG | map(.d) | unique | length) as $nd
                         | ([ $E[] | .value as $t | select(
@@ -526,7 +526,19 @@ if [ -n "$DELTA_FROM_OPT" ]; then
         case "$_dv" in
             ok) REVIEW_MODE="DELTA"; DELTA_FROM="$DELTA_FROM_OPT" ;;
             no-agent) block "--delta-from ${DELTA_FROM_OPT}: no trusted FORGE:REVIEW-AGENT comment with a findings block for that head, no earlier pass to credit: run a full review" ;;
-            no-proof) block "--delta-from ${DELTA_FROM_OPT}: no trusted proof that the earlier panel completed (staging summary, synthesized block or PR Review Summary for that head, nor every launched domain delivered at it): run a full review" ;;
+            no-proof)
+                # forge#5081: name what lacked a valid delivery (launched domains with none, comments whose marker or findings block is malformed)
+                _hint=$(printf '%s' "$COMMENTS_JSON" | bash "$TRUSTED_SCRIPT" bodies '<!-- FORGE:REVIEW-AGENT:[a-z0-9-]+ -->' 2>/dev/null \
+                    | jq -s -r --arg f "$DELTA_FROM_OPT" --argjson L "$_dl" '
+                        def vstart: test("\\A(?:[^\\n]*\\r?\\n){0,4}<!-- FORGE:REVIEW-AGENT:[a-z0-9-]+ -->");
+                        [ .[] | {d: capture("<!-- FORGE:REVIEW-AGENT:(?<d>[a-z0-9-]+) -->").d, start: vstart, blk: test("<!-- REVIEW-FINDINGS-START -->"), at: test("Reviewed-SHA: " + $f)}
+                            | .ok = (.start and .blk and .at) ] as $A
+                        | ([ $A[] | select(.ok) | .d ] | unique) as $ok
+                        | [ $L[] | select(. as $d | $ok | index($d) | not) ] as $miss
+                        | [ $A[] | select(.at and (.ok | not)) | "\(.d) (" + (if .start | not then "REVIEW-AGENT marker not within the first 5 lines" elif .blk | not then "no findings block" else "no usable Reviewed-SHA" end) + ")" ] as $mal
+                        | (if ($miss | length) > 0 then "; launched domains without a valid delivery at that head: " + ($miss | join(", ")) else "" end)
+                          + (if ($mal | length) > 0 then "; malformed reviewer comment(s): " + ($mal | join(", ")) else "" end)' 2>/dev/null) || _hint=""
+                block "--delta-from ${DELTA_FROM_OPT}: no trusted proof that the earlier panel completed (staging summary, synthesized block or PR Review Summary for that head, nor every launched domain delivered at it)${_hint}: run a full review" ;;
             degraded) block "--delta-from ${DELTA_FROM_OPT}: the earlier pass is degraded (review-panel-integrity / REVIEW_DEGRADED / REVIEW_BLOCKED after its agents): run a full review" ;;
             *) block "--delta-from ${DELTA_FROM_OPT}: could not read the trusted review comments, no earlier pass to credit: run a full review" ;;
         esac

package/scripts/review-prepare.test.sh

@@ -250,6 +250,14 @@ prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_A"; rc_is "untrusted ear
 eq "untrusted earlier pass blocker" '.blockers | join(" ") | test("no earlier pass to credit")' true
 earlier_pass "$SHA_B"
 prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_A"; rc_is "no earlier pass at the from sha" 3
+# forge#5081: a reviewer body that opens with a heading before the marker still counts as delivered
+{ cmt "$(printf '## Security review\n\n%s' "$(agent_body "$SHA_A")")"; cmt "$(staging_summary "$SHA_A")"; } | comments_of
+prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_A"; rc_is "marker not on line 1 is accepted" 0; eq "marker-not-on-line-1 mode" .delta.mode DELTA
+# ...and a malformed comment (marker buried past the first lines) is named in the blocker
+late_body() { printf 'a\nb\nc\nd\ne\nf\n<!-- FORGE:REVIEW-AGENT:frontend -->\nReviewed-SHA: %s\n<!-- REVIEW-FINDINGS-START -->\n<!-- REVIEW-FINDINGS-END -->' "$1"; }
+{ cmt "$(agent_body "$SHA_A")"; cmt "$(late_body "$SHA_A")"; } | comments_of
+prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_A"; rc_is "no proof with a malformed reviewer comment" 3
+eq "blocker names the malformed comment" '.blockers | join(" ") | test("frontend \\(REVIEW-AGENT marker not within the first 5 lines\\)")' true
 earlier_pass "$SHA_D"
 prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_D"; rc_is "non-ancestor from sha" 3
 eq "non-ancestor blocker" '.blockers | join(" ") | test("not an ancestor")' true

package/scripts/review-roster.sh

@@ -28,7 +28,7 @@
 # exact value EXTENDED is STANDARD. An extended roster prints an extra DEPTH=extended line.
 # Path triggers escalate in EVERY tier except full (which already runs the union): CONTRACT HIGH_RISK, cross-critical
 # pairs, churn hot-spot, danger zone, bin/engine* (Concurrency + spec-cli), bin/ (spec-cli), auth/session/trust-filter
-# files (Auth: auth*, not author*; oauth, jwt, login, password, permission, rbac, acl, token(s), api_key(s), credential, deps.py), CI/docker/deploy/infra files (Infra), migration/.sql files (Database), SDK/OpenAPI files (API).
+# files (Auth: auth*, not author*; oauth, jwt, login, password, permission, rbac, acl, token(s), api_key(s), credential, deps.py), CI/docker/deploy/infra files (Infra), migration/.sql files (Database), SDK/OpenAPI files (API). web/app dirs, .tsx/.jsx, next.config.*, middleware.ts (Frontend; forge#5077).
 # Auth and Infra are path-gated: a diff-text score alone never selects them. Security is a hard floor in every tier.
 # spec-cli is added only with --spec-cli true (the persona file exists in the repo under review); in the standard tier it
 # also covers commands/**. Bash 3.2 portable (no mapfile, associative arrays, grep -P).
@@ -198,8 +198,10 @@ if printf '%s\n' "$AUTH_FILES" | grep -qiE '(^|[/_.-])(auth([^o]|o[^r]|$)|author
     add_agent Auth; trig auth-path
 fi
 hit '^\.github/|(^|/)Dockerfile|docker-compose|(^|/)(docker-)?compose[^/]*\.ya?ml$|(^|/)deploy[^/]*\.sh$|(^|/)docker-entrypoint[^/]*$|(^|/)(deploy|infra|traefik|nginx|k8s|helm|terraform)/|\.tf$' && { add_agent Infra; trig infra-path; }
+hit '(^|/)app/(.*/)?route\.[cm]?[jt]sx?$|(^|/)pages/api/' && { add_agent Infra; trig route-handler; } # forge#5087: a new HTTP route needs its ingress confirmed
 hit 'migration|\.sql$' && { add_agent Database; trig migration-path; }
 hit '^sdk/|openapi.*\.json$|openapi-versions/' && { add_agent API; trig sdk-path; }
+hit '(^|/)(web|app)/|\.(tsx|jsx)$|(^|/)next\.config\.[a-z]+$|(^|/)middleware\.(ts|js)$' && { add_agent Frontend; trig frontend-path; }
 hit '^bin/engine' && { add_agent Concurrency; trig bin-engine; }
 if [ "$SPEC_CLI" = "true" ]; then
     hit '^bin/' && { add_agent spec-cli; trig bin; }

package/scripts/review-roster.test.sh

@@ -164,6 +164,15 @@ run "$(printf 'README.md\nscripts/deploy.sh')" --scores "$SC_QUIET" --changed-li
 expect_has "infra-path-multi-file-list" infra
 run "Scripts/Deploy.SH" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_has "infra-path-case-insensitive" infra
+# forge#5087: a route-handler diff pulls the Infra reviewer even when no infra file changed
+for f in "web/src/app/(site)/api/v1/agent/signup/pending/route.ts" "web/src/pages/api/health.ts" "app/route.js"; do
+  run "$f" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+  expect_has "route-handler-$f" infra
+done
+for f in web/src/app/page.tsx web/src/app/dashboard/layout.tsx web/src/lib/route.ts; do
+  run "$f" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
+  expect_not "no-route-handler-$f" infra
+done
 run "db/migrations/0042_add.sql" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
 expect_has "migration path" database
 run "sdk/node/src/index.ts" --scores "$SC_QUIET" --changed-lines 20 --changed-files 1
@@ -182,8 +191,8 @@ expect_has "billing score in medium tier" billing; expect_has "billing score in
 run "web/src/app/a.tsx
 web/src/b.tsx" --scores "FRONTEND=3 API=2 BILLING=1 DATABASE=1" --changed-lines 300
 expect_tier "standard" standard; expect_has "standard" frontend; expect_has "standard" api; expect_not "standard top-2 only" billing
-run "web/src/app/a.tsx
-web/src/b.tsx" --scores "FRONTEND=3 API=2" --changed-lines 100
+run "svc/a.py
+svc/b.py" --scores "FRONTEND=3 API=2" --changed-lines 100
 expect_sel "medium has no baseline" "security"
 run "svc/x.py" --scores "FRONTEND=3" --changed-lines ""
 expect_tier "unknown size" standard; expect_has "unknown size" frontend
@@ -250,5 +259,24 @@ expect_tier "EXTENDED lifts fix-pr to standard" standard
 run "svc/a.py" --scores "$SC_TOP" --changed-lines 400 --thorough true --review-depth EXTENDED
 expect_tier "full stays full" full
 
+# forge#5077: Frontend path trigger escalates in every tier except full; a bundle selects every path-triggered domain
+for n in 30 100 300; do
+  run "web/src/app/(site)/not-found.tsx" --scores "$SC_QUIET" --changed-lines "$n" --changed-files 1
+  expect_has "frontend path trigger at $n lines" frontend
+done
+for f in next.config.mjs middleware.ts app/page.jsx; do
+  run "$f" --scores "$SC_QUIET" --changed-lines 30 --changed-files 1; expect_has "frontend path $f" frontend
+done
+run "web/src/app/(site)/not-found.tsx
+svc/auth/login.py
+.github/workflows/ci.yml
+db/migrations/001.sql
+sdk/client.py" --scores "FRONTEND=0 API=0 BILLING=2 DATABASE=2" --changed-lines 700000 --changed-files 5
+expect_tier "staging bundle" standard
+for d in frontend auth infra database api; do expect_has "bundle union" "$d"; done
+run "docs/web-notes.md
+svc/a.py" --scores "$SC_QUIET" --changed-lines 30 --changed-files 2
+expect_not "no frontend path" frontend
+
 echo "review-roster: $pass passed, $fail failed"
 [ "$fail" -eq 0 ]

package/scripts/review-staging-pre.sh

@@ -72,7 +72,7 @@ gh_retry() {
 # One review-finding search fetch; fails (so gh_retry retries) on a gh error or non-array output.
 fetch_findings() {
   local raw
-  raw=$(gh issue list -R "$GH_REPO" --label "review-finding" --state open --search "PR #${1}" --limit 20 --json number,title,body 2>/dev/null) || return 1
+  raw=$(gh issue list -R "$GH_REPO" --label "review-finding" --state open --search "PR #${1}" --limit 20 --json number,title,body,labels 2>/dev/null) || return 1
   printf '%s' "$raw" | jq -e 'type == "array"' >/dev/null 2>&1 || return 1
   printf '%s' "$raw"
 }
@@ -156,7 +156,9 @@ for pr_num in $ALL_PR_NUMBERS; do
   # Search for open review-finding issues that reference this PR. The search is only a coarse
   # candidate fetch (full-text, tokenized: it also hits hidden markers and longer numbers), so
   # narrow it with the anchored FINDING_PR_FILTER: title suffix `PR #N)` or a `**Source**: PR #N` line.
-  FINDING_PR_FILTER='[.[] | select((.title | endswith("PR #" + $n + ")")) or ((.body // "") | test("(^|\\n)\\*\\*Source\\*\\*: PR #" + $n + "([^0-9]|$)")))] | .[] | "  - #\(.number): \(.title)"'  # FINDING_PR_FILTER
+  # Only a blocking finding gates: labelled `blocking`, priority:P0/P1, or carrying no priority:* label (unknown severity fails closed).
+  # A priority:P2/P3 follow-up (NOTE-class, POSSIBLE, over review.max_filed_findings) never blocks the bundle.
+  FINDING_PR_FILTER='[.[] | select(([.labels[]?.name] | (index("blocking") != null) or (index("priority:P0") != null) or (index("priority:P1") != null) or (map(select(startswith("priority:"))) | length == 0))) | select((.title | endswith("PR #" + $n + ")")) or ((.body // "") | test("(^|\\n)\\*\\*Source\\*\\*: PR #" + $n + "([^0-9]|$)")))] | .[] | "  - #\(.number): \(.title)"'  # FINDING_PR_FILTER
   OPEN_FINDINGS=""
   if _RAW=$(gh_retry --search fetch_findings "$pr_num"); then
     OPEN_FINDINGS=$(printf '%s' "$_RAW" | jq -r --arg n "${pr_num}" "$FINDING_PR_FILTER" 2>/dev/null) || READ_FAILURES="$READ_FAILURES #${pr_num}(findings)"  # uses FINDING_PR_FILTER
@@ -177,7 +179,7 @@ if [ -n "$READ_FAILURES" ]; then
   echo "Re-run the gate once GitHub reads succeed."
   echo "RESULT: BLOCK DEPLOY"
   if [ -n "$PR_NUMBER" ]; then
-    gh pr comment "$PR_NUMBER" -R $GH_REPO --body "<!-- FORGE:GATE_FAILURE -->
+    gh_retry gh pr comment "$PR_NUMBER" -R $GH_REPO --body "<!-- FORGE:GATE_FAILURE -->
 ## Deploy Gate: BLOCKED
 
 **Gate**: open-review-finding (read failure)
@@ -195,7 +197,7 @@ if [ -n "$DEGRADED_REVIEWS" ]; then
   echo "⛔ DEPLOY BLOCKED — An included PR has an incomplete isolated review panel."
   echo "$DEGRADED_REVIEWS"
   if [ -n "$PR_NUMBER" ]; then
-    gh pr comment "$PR_NUMBER" -R $GH_REPO --body "<!-- FORGE:GATE_FAILURE -->
+    gh_retry gh pr comment "$PR_NUMBER" -R $GH_REPO --body "<!-- FORGE:GATE_FAILURE -->
 ## Deploy Gate: BLOCKED
 
 **Gate**: review-panel-integrity
@@ -245,7 +247,7 @@ if [ -n "$BLOCKING_FINDINGS" ]; then
     FINDING_COUNT=$(echo "$BLOCKING_FINDINGS" | grep -c '^\s*- #' || echo "unknown")
     GATE_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
     if [ -n "$PR_NUMBER" ]; then
-      gh pr comment "$PR_NUMBER" -R $GH_REPO --body "<!-- FORGE:GATE_FAILURE -->
+      gh_retry gh pr comment "$PR_NUMBER" -R $GH_REPO --body "<!-- FORGE:GATE_FAILURE -->
 ## Deploy Gate: BLOCKED
 
 **Gate**: open-review-finding
@@ -274,7 +276,7 @@ else
   echo "✅ Open review-finding gate: PASSED — no open findings for PRs in this bundle."
   # Post FORGE:GATE_PASS for symmetric observability — bypass is indistinguishable from clean pass without this
   if [ -n "$PR_NUMBER" ]; then
-    gh pr comment "$PR_NUMBER" -R $GH_REPO --body "<!-- FORGE:GATE_PASS -->
+    gh_retry gh pr comment "$PR_NUMBER" -R $GH_REPO --body "<!-- FORGE:GATE_PASS -->
 ## Deploy Gate: PASSED
 
 **Gate**: open-review-finding check

package/scripts/review-staging-pre.test.sh

@@ -39,7 +39,7 @@ case "$a" in "pr view"*"--json labels"*) [ -f "$F/fail-labels" ] && exit 1 ;; "i
 flaky() { [ -f "$F/flaky-$1" ] || return 0; local c; c=$(cat "$F/count-$1" 2>/dev/null || echo 0); echo $((c+1)) > "$F/count-$1"; [ "$c" -lt "$(cat "$F/flaky-$1")" ] && exit 1; return 0; }
 case "$a" in "pr view"*"--json labels"*) flaky labels ;; "issue list"*) flaky issues ;; "api repos/o/r/issues/"*) case "$a" in *"/comments"*) ;; *) flaky kind ;; esac ;; esac
 case "$1 $2" in
-  "pr comment") while [ $# -gt 0 ]; do [ "$1" = --body ] && { printf '%s\n@@\n' "$2" >> "$F/posted"; }; shift; done; exit 0 ;;
+  "pr comment") flaky comment; while [ $# -gt 0 ]; do [ "$1" = --body ] && { printf '%s\n@@\n' "$2" >> "$F/posted"; }; shift; done; exit 0 ;;
   "pr diff") [ -f "$F/files-$3" ] && { cat "$F/files-$3"; exit 0; }; exit 1 ;;
   "pr view")
     case "$a" in *"--json labels"*) [ -f "$F/degraded-$3" ] && echo true || echo false; exit 0 ;; esac
@@ -99,6 +99,16 @@ case "$OUT" in *"RESULT: BLOCK DEPLOY"*) ok ;; *) bad "blocked gate must print R
 grep -q 'FORGE:GATE_FAILURE:TYPE=open-review-finding|FINDINGS=1' "$FIX/posted" && ok || bad "blocked gate must post the GATE_FAILURE marker with FINDINGS=1"
 newfix unanchored; jq -n '[{number:41,title:"bug (PR #55)",body:"x"}]' > "$FIX/findings-5.json"
 run gate --repo o/r --pr 9 --prs-file "$TMP/prs" >/dev/null 2>&1; [ $? -eq 0 ] && ok || bad "a finding for another PR (#55) must not block #5"
+# #5081: only blocking findings gate; a priority:P2/P3 follow-up does not, a priority:P1 or `blocking` one does
+newfix nonblocking; jq -n '[{number:41,title:"nit (PR #5)",body:"x",labels:[{name:"review-finding"},{name:"priority:P3"}]}]' > "$FIX/findings-5.json"
+run gate --repo o/r --pr 9 --prs-file "$TMP/prs" >/dev/null 2>&1; [ $? -eq 0 ] && ok || bad "a priority:P3 review-finding must not block"
+newfix blockp1; jq -n '[{number:41,title:"bug (PR #5)",body:"x",labels:[{name:"review-finding"},{name:"priority:P1"}]}]' > "$FIX/findings-5.json"
+run gate --repo o/r --pr 9 --prs-file "$TMP/prs" >/dev/null 2>&1; [ $? -eq 1 ] && ok || bad "a priority:P1 review-finding must block"
+newfix blocklabel; jq -n '[{number:41,title:"bug (PR #5)",body:"x",labels:[{name:"review-finding"},{name:"priority:P3"},{name:"blocking"}]}]' > "$FIX/findings-5.json"
+run gate --repo o/r --pr 9 --prs-file "$TMP/prs" >/dev/null 2>&1; [ $? -eq 1 ] && ok || bad "a finding labelled blocking must block"
+# #5081: a transient gh pr comment failure is retried, not dropped
+newfix commentflaky; echo 2 > "$FIX/flaky-comment"
+run gate --repo o/r --pr 9 --prs-file "$TMP/prs" >/dev/null 2>&1; grep -qx '<!-- FORGE:GATE_PASS:TYPE=open-review-finding -->' "$FIX/posted" && ok || bad "a transient gh pr comment failure must be retried until the GATE_PASS lands"
 newfix override; jq -n '[{number:41,title:"bug (PR #5)",body:"x"}]' > "$FIX/findings-5.json"
 jq -n '[{body:"OVERRIDE: shipping with open findings — known",author_association:"OWNER",user:{type:"User",login:"o"}}]' > "$FIX/comments-9.json"
 OUT=$(run gate --repo o/r --pr 9 --prs-file "$TMP/prs" 2>&1); RC=$?