forgedock 1.47.0 → 1.48.1

package/bin/lean/conformance.mjs

@@ -266,9 +266,18 @@ export function tmpdirInputs(command) {
 
 const tmpInputProblem = (id, p) => `${id}: reads ${p}, which the command does not create; the run TMPDIR is per run, so the engine's rerun and red-green check will not find it. Create the file inside the command (\`… > ${p} && …\`) or use a path the repo tracks`;
 
-const E2E_WORD_RE = /\b(?:e2e|end-to-end|integration|playwright|cypress|live[- ]stack)\b/i;
-const WEAKEN_RE = /\b(?:no|not|without|drop(?:ped|s|ping)?|skip(?:ped|s|ping)?|replac\w+|downgrad\w+|instead of|rather than|in lieu of|swap\w*)\b/i;
-const MOCKED_RE = /\b(?:mock\w*|stub\w*|fake\w*|unit|vitest|jest|component tests?|route tests?)\b/i;
+const E2E_TERM = String.raw`(?:e2e|end-to-end|integration|playwright|cypress|live[- ]stack)`;
+const E2E_WORD_RE = new RegExp(String.raw`\b${E2E_TERM}\b`, "i");
+const MOCKED_TERM = String.raw`(?:mock\w*|stub\w*|fake\w*|unit|vitest|jest|component tests?|route tests?)`;
+const MOCKED_RE = new RegExp(String.raw`\b${MOCKED_TERM}`, "i");
+// #5116: a negated mock ("do not mock", "no stubs") or a fake clock is not a substitute for the e2e check.
+const NEG_MOCK_RE = /\b(?:do(?:es)? not|don't|never|no|not|without)\s+(?:use\s+|any\s+)?(?:mock\w*|stub\w*|fake\w*)/gi;
+const FAKE_CLOCK_RE = /\bfake[- ](?:timers?|clocks?)\b/gi;
+// A weakener governs the e2e term only within a few words and the same clause (no . or ; between them).
+const GAP = String.raw`(?:[\s,]+\w+){0,3}?[\s,]+`;
+const DROP_BEFORE_RE = new RegExp(String.raw`\b(?:no|not|without|never|drop(?:ped|s|ping)?|skip(?:ped|s|ping)?|replac\w+|downgrad\w+|swap\w*)${GAP}${E2E_TERM}\b`, "i");
+const DROP_AFTER_RE = new RegExp(String.raw`\b${E2E_TERM}${GAP}(?:replaced|dropped|skipped|swapped|downgraded)\b`, "i");
+const INSTEAD_OF_RE = new RegExp(String.raw`\b${MOCKED_TERM}[^.;]{0,60}?\b(?:instead of|rather than|in lieu of)\b${GAP}${E2E_TERM}\b`, "i");
 const PROBE_RE = /forge-probe|acceptance[- ]probe/i;
 const NEG_PROBE_RE = /\b(?:no|not|without|never)\b[^.;]{0,30}(?:forge-probe|acceptance[- ]probe)/i;
 /**
@@ -282,7 +291,9 @@ export function weakenedE2eDecisions(c) {
   const elsewhere = (id) => JSON.stringify({ r: c?.requirements ?? [], d: c?.deliverables ?? [], k: decisions.filter((k) => k?.id !== id) });
   return decisions.filter((k) => {
     const choice = String(k?.choice ?? "");
-    if (!E2E_WORD_RE.test(choice) || !WEAKEN_RE.test(choice) || !MOCKED_RE.test(choice)) return false;
+    if (!E2E_WORD_RE.test(choice)) return false;
+    const mocked = choice.replace(NEG_MOCK_RE, " ").replace(FAKE_CLOCK_RE, " ");
+    if (!MOCKED_RE.test(mocked) || !(DROP_BEFORE_RE.test(mocked) || DROP_AFTER_RE.test(mocked) || INSTEAD_OF_RE.test(mocked))) return false;
     const own = `${choice} ${k?.justification ?? ""}`;
     return !((PROBE_RE.test(own) && !NEG_PROBE_RE.test(own)) || /forge-probe/i.test(elsewhere(k?.id)));
   }).map((k) => k.id).filter(Boolean);
@@ -1228,7 +1239,7 @@ export function bucketProblems(r) {
 const POST_PROMOTION_RE = /(?:after|post)[- ]?(?:promotion|release|deploy)|in production after|production[- ]verif|promot(?:e|ion)|rollout|purge|deploy[- ]time/i;
 export const READONLY_PROD_RE = /\bssh\s+[\w.-]*-monitor\b|\bobs-psql\b|\bprod(?:uction)?[ _-]monitor\b|\bread[- ]only\b[^.]{0,40}\bprod(?:uction)?\b|\bprod(?:uction)?\b[^.]{0,30}\b(?:query|queries|capture|telemetry|logs?)\b/i;
 /** An item that truly needs the outside world (or a write to production) stays external even when it also reads production. */
-export const EXTERNAL_NEED_RE = /credential|secret|api[- ]?key|token|password|passphrase|ssh[- ]?keys?\b|private[- ]key|\blogin\b|\bsudo\b|spend|budget|billing|purchase|payment|account|third[- ]party|vendor|customer|contract sign|legal|\b(?:delete|drop|truncate|wipe|destroy|modify|migrate|write)\b/i;
+export const EXTERNAL_NEED_RE = /credential|secret|api[- ]?key|token|password|passphrase|ssh[- ]?keys?\b|private[- ]key|\blogin\b|\bsudo\b|spend|budget|billing|purchase|payment|account|third[- ]party|vendor|customer|contract sign|legal|\b(?:delete|drop|truncate|wipe|destroy|modify|migrate|write|update|restart|rotate|remove|grant|alter)\b/i;
 /**
  * #5078: where an owner deferral goes. `owner:orchestrator`, `owner:promote:*` or post-promotion text -> post-deploy (the
  * rollup); read-only production data or capture (with no credential/spend/account/third-party/customer need) -> host; else external (credentials, spend, an account, a third party or a customer).

package/bin/lean/conformance.test.mjs

@@ -1325,6 +1325,16 @@ describe("#5087 a plan decision may not weaken an e2e/integration criterion to m
     assert.deepEqual(weakenedE2eDecisions({ ...C, deliverables: [...C.deliverables, { id: "D9", path: "x.md", change: "declare a forge-probe block" }], decisions: [K2] }), []);
     assert.deepEqual(weakenedE2eDecisions({ ...C, decisions: [{ ...K2, justification: "no acceptance probe" }] }), ["K2"]);
   });
+  it("#5116 negated or strengthening wording is not a weakening; real weakenings still are", () => {
+    for (const choice of ["Run the Playwright e2e suite against the live stack; do not mock the API", "Integration tests use fake timers, no sleeps", "E2E check hits the real server rather than a stubbed one"]) {
+      const c = { ...C, decisions: [{ id: "K1", choice, source: "doc" }] };
+      assert.deepEqual(weakenedE2eDecisions(c), [], choice);
+      assert.ok(!validateContract(c, ISSUE).problems.some((p) => p.startsWith("K1:")), choice);
+    }
+    for (const choice of ["No Playwright e2e; integration coverage via route and component tests", "Replace the e2e test with mocked unit tests", "Skip e2e, use vitest instead", "Use mocked unit tests instead of the e2e check"]) {
+      assert.deepEqual(weakenedE2eDecisions({ ...C, decisions: [{ id: "K1", choice, source: "doc" }] }), ["K1"], choice);
+    }
+  });
   it("leaves unrelated decisions and contracts without decisions alone", () => {
     assert.deepEqual(weakenedE2eDecisions(C), []);
     assert.deepEqual(weakenedE2eDecisions({ ...C, decisions: [{ id: "K1", choice: "Run the Playwright e2e suite against the live stack", source: "doc" }, { id: "K3", choice: "Use unit tests with mocks for the parser", source: "spec" }] }), []);
@@ -1383,4 +1393,12 @@ describe("release review #5103", () => {
     }
     assert.equal(route5103({ bucket: "owner:decide", why: "Should we delete production data older than 90 days?" }), "external");
   });
+  it("#5115: production-mutating verbs naming a prod monitor stay external, never host", () => {
+    for (const why of ["ssh ovh-monitor and restart the worker", "rotate the prod monitor webhook", "update the production telemetry config",
+      "remove the stale prod monitor alert", "grant read-only prod access to the analyst", "alter the production query timeout"]) {
+      assert.equal(RO5103.test(why), true, `read-only prod phrase: ${why}`);
+      assert.equal(host(why), false, why);
+      assert.equal(route5103({ bucket: "owner:x", why }), "external", why);
+    }
+  });
 });

package/bin/lean/issuewatch.mjs

@@ -25,7 +25,7 @@ import { noComments } from "./render.mjs";
 import { listAssociations } from "./gh-assoc.mjs";
 import { verifyMerge, verifyComment } from "./issuewatch-verify.mjs";
 
-const WATCH_KEYS = ["milestone", "labels", "exclude_labels", "search", "title_regex", "since", "version", "lane", "max_issues", "max_inflight", "until", "mode", "parallel", "include_followups", "postdeploy_rollup", "threshold", "immediate", "max_release_issues", "theme_map", "tracker", "sweep_needs_human", "max_launches"];
+const WATCH_KEYS = ["milestone", "labels", "exclude_labels", "search", "title_regex", "since", "version", "lane", "max_issues", "max_inflight", "until", "mode", "parallel", "include_followups", "postdeploy_rollup", "threshold", "immediate", "max_release_issues", "theme_map", "tracker", "sweep_needs_human", "max_launches", "trust_app", "trust_app_labels"];
 export const TRUSTED = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
 const NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const RETRIES = 3;
@@ -79,8 +79,11 @@ export function validateWatch(name, cfg = {}) {
   const w = { name, milestone: cfg.milestone || null, labels: list(cfg.labels), exclude_labels: list(cfg.exclude_labels), search: cfg.search || null, title_regex: cfg.title_regex || null,
     since: cfg.since || null, version: cfg.version ? String(cfg.version) : null, lane: cfg.lane || null, max_issues: int("max_issues", null), max_inflight: int("max_inflight", 4),
     until: cfg.until || null, mode: cfg.mode || "per-issue", parallel: int("parallel", 4), include_followups: cfg.include_followups || "none", postdeploy_rollup: cfg.postdeploy_rollup ? Number(String(cfg.postdeploy_rollup).replace("#", "")) : null,
-    max_launches: int("max_launches", null), sweep_needs_human: cfg.sweep_needs_human === true || String(cfg.sweep_needs_human).toLowerCase() === "true" };
+    max_launches: int("max_launches", null), sweep_needs_human: cfg.sweep_needs_human === true || String(cfg.sweep_needs_human).toLowerCase() === "true",
+    trust_app: cfg.trust_app === true || String(cfg.trust_app).toLowerCase() === "true", trust_app_labels: list(cfg.trust_app_labels) };
   if (cfg.sweep_needs_human !== undefined && !/^(true|false)$/i.test(String(cfg.sweep_needs_human))) throw new Error(`watch ${name}: sweep_needs_human must be true or false`);
+  if (cfg.trust_app !== undefined && !/^(true|false)$/i.test(String(cfg.trust_app))) throw new Error(`watch ${name}: trust_app must be true or false`);
+  if (w.trust_app_labels.length && !w.trust_app) throw new Error(`watch ${name}: trust_app_labels needs trust_app: true`);
   if (!["per-issue", "batch", "release"].includes(w.mode)) throw new Error(`watch ${name}: mode must be per-issue, batch or release`);
   if (w.mode === "release") validateRelease(name, cfg, w, int);
   else for (const k of ["threshold", "immediate", "max_release_issues", "theme_map", "tracker"]) if (cfg[k] !== undefined) throw new Error(`watch ${name}: ${k} needs mode: release`);
@@ -123,37 +126,64 @@ export function issueVersion(issue) {
   return null;
 }
 
-/** AND of every set selector. `search` is applied by gh, not here. */
-export function matchesSelectors(issue, sel) {
+/** The first selector `issue` fails, as a reason (`missing label x`, `excluded label x`, ...), or null when all match. `search` is applied by gh, not here. */
+export function selectorMiss(issue, sel) {
   const names = labelNames(issue);
-  if (sel.milestone === "none" ? issue.milestone : sel.milestone && milestoneSlug(issue.milestone?.title) !== milestoneSlug(sel.milestone)) return false;
-  if ((sel.labels ?? []).some((l) => !names.includes(l))) return false;
-  if ((sel.exclude_labels ?? []).some((l) => names.includes(l))) return false;
-  if (sel.title_regex && !new RegExp(sel.title_regex).test(issue.title ?? "")) return false;
-  if (sel.since && !(Date.parse(issue.createdAt) >= Date.parse(sel.since))) return false;
-  if (sel.version && issueVersion(issue) !== sel.version) return false;
-  return true;
+  if (sel.milestone === "none" ? issue.milestone : sel.milestone && milestoneSlug(issue.milestone?.title) !== milestoneSlug(sel.milestone)) return "milestone";
+  const missing = (sel.labels ?? []).find((l) => !names.includes(l));
+  if (missing !== undefined) return `missing label ${missing}`;
+  const excluded = (sel.exclude_labels ?? []).find((l) => names.includes(l));
+  if (excluded !== undefined) return `excluded label ${excluded}`;
+  if (sel.title_regex && !new RegExp(sel.title_regex).test(issue.title ?? "")) return "title_regex";
+  if (sel.since && !(Date.parse(issue.createdAt) >= Date.parse(sel.since))) return "since";
+  if (sel.version && issueVersion(issue) !== sel.version) return "version";
+  return null;
 }
 
+/** AND of every set selector. `search` is applied by gh, not here. */
+export const matchesSelectors = (issue, sel) => !selectorMiss(issue, sel);
+
 const CHECK_RE = /^\s*[-*]\s+\[ \]\s+(.*)$/;
 /** True when the body has an unchecked `— defer` checklist item. */
 export const hasUnresolvedDefer = (body) => noComments(body).split("\n").some((l) => { const t = CHECK_RE.exec(l)?.[1]; return t != null && /\s[—-]+\s*defer\b/.test(t); });
 
 // Bot authorship comes from the author only, never the body: a `FORGE:DEFERRED` marker in an outsider's issue is not
 // the App. `gh` reports the ForgeDock App as a bare login with no `[bot]` suffix (#4467), so it is matched by slug.
-export const isBot = (i) => { const l = String(i.author?.login ?? ""); return /\[bot\]$|^app\//i.test(l) || i.author?.is_bot === true || l.toLowerCase().replace(/^app\//, "").replace(/\[bot\]$/, "") === APP_SLUG; };
+const bareLogin = (i) => String(i.author?.login ?? "").trim().toLowerCase().replace(/^app\//, "").replace(/\[bot\]$/, "");
+export const isBot = (i) => { const l = String(i.author?.login ?? ""); return /\[bot\]$|^app\//i.test(l) || i.author?.is_bot === true || bareLogin(i) === APP_SLUG; };
+/** #5088: the issue's author is this repo's ForgeDock App (`app/<slug>`, `<slug>[bot]` or the bare slug); never another bot. */
+// Release review of #5123 (AUTH-1): the slug alone is a username anyone could register. Require a bot signal too: the
+// REST/gh forms `<slug>[bot]` / `app/<slug>`, or `is_bot: true` (gh --json author) for the bare GraphQL login.
+export const isOwnApp = (i) => {
+  if (bareLogin(i) !== APP_SLUG) return false;
+  const l = String(i.author?.login ?? "").trim();
+  return /\[bot\]$|^app\//i.test(l) || i.author?.is_bot === true;
+};
 const isFollowup = (i) => /^follow-up\b/i.test(i.title ?? "");
 
-/** `claim` (a lane/batch takes it), `fold` (post-deploy-only follow-up for the rollup), or null (not for this watch). */
-export function classifyIssue(issue, watch) {
+/** {kind, reason}: `kind` as classifyIssue returns it; `reason` says why (shown by the per-issue/batch `--dry-run`). */
+function classifyWhy(issue, watch) {
+  const login = issue.author?.login ?? "unknown";
   if (isBot(issue)) {
-    if (!isFollowup(issue) || watch.include_followups !== "defer-only") return null;
-    if (postDeployOnly(issue.body)) return watch.postdeploy_rollup ? "fold" : null;
-    return hasUnresolvedDefer(issue.body) ? "claim" : null;
+    if (isFollowup(issue)) { // trust_app never overrides the follow-up rules: a post-deploy-only follow-up folds, never claims (#5088 K3)
+      if (watch.include_followups !== "defer-only") return { kind: null, reason: `bot follow-up by ${login} (include_followups: none)` };
+      if (postDeployOnly(issue.body)) return watch.postdeploy_rollup ? { kind: "fold", reason: "post-deploy-only follow-up" } : { kind: null, reason: "post-deploy-only follow-up (no postdeploy_rollup)" };
+      return hasUnresolvedDefer(issue.body) ? { kind: "claim", reason: "defer follow-up" } : { kind: null, reason: "bot follow-up without an unchecked defer item" };
+    }
+    if (!watch.trust_app || !isOwnApp(issue)) return { kind: null, reason: `bot author ${login}` };
+    const want = watch.trust_app_labels ?? [];
+    if (want.length && !labelNames(issue).some((l) => want.includes(l))) return { kind: null, reason: `bot author ${login} (trust_app_labels not matched)` };
+    return { kind: "claim", reason: "ForgeDock App author (trust_app)" };
   }
-  return TRUSTED.has(issue.authorAssociation) ? "claim" : null;
+  return TRUSTED.has(issue.authorAssociation) ? { kind: "claim", reason: `trusted author (${issue.authorAssociation})` } : { kind: null, reason: `untrusted author ${login} (${issue.authorAssociation ?? "unknown"})` };
 }
 
+/**
+ * `claim` (a lane/batch takes it), `fold` (post-deploy-only follow-up for the rollup), or null (not for this watch).
+ * #5088: with `trust_app: true` an issue the repo's own ForgeDock App authored is claimed (narrowed by `trust_app_labels`).
+ */
+export const classifyIssue = (issue, watch) => classifyWhy(issue, watch).kind;
+
 /** `milestone/<slug>` (forge.yaml feature pattern) for a milestone issue, else staging; a pinned `lane:` wins but is never a default branch. Throws on a default-branch lane. */
 export function laneFor(issue, watch, { branches = {}, defaults = [] } = {}) {
   const staging = branches.staging || DEFAULT_STAGING_BRANCH;
@@ -281,21 +311,11 @@ export async function tick({ watch, repo, io, state, dir, branches = {}, default
   if (capped && state.phase === "running") state.phase = "draining";
   if (state.phase === "draining") { if (!state.inflight.length && !Object.keys(state.verifyFrom ?? {}).length) state.phase = "done"; return state; } // a merge mid-verification holds the drain
 
-  const room = Math.min(watch.max_inflight - state.inflight.length, watch.max_issues ? watch.max_issues - used.issues : Infinity, watch.max_launches ? watch.max_launches - used.launches : Infinity);
-  const args = ["issue", "list", "-R", repo, "--state", "open", "--limit", "200", "--json", "number,title,body,labels,milestone,author,createdAt"];
-  if (watch.search) args.push("--search", watch.search);
-  const candidates = [];
-  const assoc = await listAssociations(io.gh, repo); // #4859: not a `gh issue list` field
-  for (const raw of await ghJson(args)) {
-    const i = { ...raw, authorAssociation: assoc.get(raw.number) };
-    if (!matchesSelectors(i, watch)) continue;
-    const kind = classifyIssue(i, watch);
-    if (kind === "fold") { await fold({ issue: i, watch, repo, io, state }); continue; }
-    if (kind === "claim" && !state.claimed.includes(i.number)) candidates.push(i);
-  }
-  const ordered = watch.mode === "batch" ? dagOrder(candidates) : candidates;
+  const room = roomFor(watch, state);
+  const plan = await planClaims({ watch, repo, io, state, branches, defaults, room });
+  for (const i of plan.folds) await fold({ issue: i, watch, repo, io, state });
   const taken = [];
-  for (const i of ordered) {
+  for (const i of plan.candidates) {
     if (taken.length >= room) break;
     const lane = laneFor(i, watch, { branches, defaults });
     if (!claimIssue(repoDir(repo, io.env), i.number, watch.name)) continue;
@@ -308,6 +328,50 @@ export async function tick({ watch, repo, io, state, dir, branches = {}, default
   return state;
 }
 
+const roomFor = (watch, state) => { const used = claimsUsed(state); return Math.min(watch.max_inflight - state.inflight.length, watch.max_issues ? watch.max_issues - used.issues : Infinity, watch.max_launches ? watch.max_launches - used.launches : Infinity); };
+
+/**
+ * #5088: what one pass would take, without writing anything. `candidates` are the issues `tick` tries to claim (in order);
+ * `claim` [{number, lane, reason}] and `skip` [{number, reason}] are the read-only forecast (registry read, never written;
+ * `room` caps the claims), `fold` the post-deploy-only follow-up numbers (`folds` the issues).
+ */
+export async function planClaims({ watch, repo, io, state, branches = {}, defaults = [], room = Infinity }) {
+  const args = ["issue", "list", "-R", repo, "--state", "open", "--limit", "200", "--json", "number,title,body,labels,milestone,author,createdAt"];
+  if (watch.search) args.push("--search", watch.search);
+  const found = [], folds = [], skip = [], why = new Map();
+  const assoc = await listAssociations(io.gh, repo); // #4859: not a `gh issue list` field
+  for (const raw of JSON.parse(String(await io.gh(args)))) {
+    const i = { ...raw, authorAssociation: assoc.get(raw.number) };
+    const miss = selectorMiss(i, watch);
+    if (miss) { skip.push({ number: i.number, reason: miss }); continue; }
+    const c = classifyWhy(i, watch);
+    if (c.kind === "fold") { folds.push(i); continue; }
+    if (c.kind !== "claim") { skip.push({ number: i.number, reason: c.reason }); continue; }
+    if (state.claimed.includes(i.number)) { skip.push({ number: i.number, reason: "already claimed by this watch" }); continue; }
+    found.push(i); why.set(i.number, c.reason);
+  }
+  const candidates = watch.mode === "batch" ? dagOrder(found) : found;
+  const registry = readJson(join(repoDir(repo, io.env), "claims.json")) ?? {};
+  const claim = [];
+  for (const i of candidates) {
+    const owner = registry[i.number];
+    if (owner && owner !== watch.name) { skip.push({ number: i.number, reason: `already claimed by watch ${owner}` }); continue; }
+    let lane;
+    try { lane = laneFor(i, watch, { branches, defaults }); } catch (e) { skip.push({ number: i.number, reason: String(e?.message ?? e) }); continue; }
+    if (claim.length >= room) { skip.push({ number: i.number, reason: `over capacity (room ${Math.max(0, room)})` }); continue; }
+    claim.push({ number: i.number, lane, reason: why.get(i.number) });
+  }
+  return { candidates, claim, fold: folds.map((i) => i.number), folds, skip };
+}
+
+/** The per-issue/batch `--dry-run` lines of a planClaims result. */
+export function formatClaimPlan(plan) {
+  const out = plan.claim.length ? plan.claim.map((c) => `would claim #${c.number} -> ${c.lane}: ${c.reason}`) : ["would claim: none"];
+  for (const n of plan.fold) out.push(`would fold #${n}`);
+  for (const s of plan.skip) out.push(`skip #${s.number}: ${s.reason}`);
+  return out.join("\n");
+}
+
 /** True when the registry leaves issue `n` to watch `name`: unclaimed, or already this watch's own claim (crash-safe re-claim, #4825). */
 export const unclaimedOrOwn = (registry, n, name) => !registry?.[n] || registry[n] === name;
 
@@ -402,7 +466,7 @@ export async function runWatch({ watch, repo, io, dir, branches, defaults, once
 const judgePrompt = ({ decision, options, policy, policyPath, precedent }) => `You settle one decision for a repository from its own policy file (${policyPath ?? "none"}) and prior decisions. Reply with only a JSON object {"choice","clause","rejected","reversibility":"reversible|one-way","confidence":"high|medium|low","anchors":[]}. "clause" quotes the policy clause or precedent that supports the choice; leave it empty when none applies.\n\nPolicy:\n${policy}\n\nPrior decisions:\n${JSON.stringify((precedent ?? []).slice(0, 20))}\n\nDecision needed:\n${decision}\n${(options ?? []).length ? `Options: ${options.join(" | ")}\n` : ""}`;
 const CLI = join(dirname(fileURLToPath(import.meta.url)), "..", "forgedock.mjs");
 function realIo(repo, env = process.env) {
-  const gh = (args) => execFileSync("gh", args, { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+  const gh = ghRunner(execFileSync, (l) => console.error(l));
   const root = batchRoot(env);
   return { env, gh, now: () => Date.now(), sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
     classify: (issues, themes) => { // the one LLM judgment of release mode: issues no theme_map rule classifies
@@ -433,9 +497,37 @@ function realIo(repo, env = process.env) {
     } };
 }
 
+/** #5088: what a failed gh call does to the watch pass, from its argv (the callers that swallow it degrade; the rest fail). */
+export function ghFailureEffect(args) {
+  const a = (args ?? []).map(String), s = a.join(" ");
+  if (a[0] === "api" && /(^| )repos\/[^ ]+\/issues\?state=open/.test(s)) return "pass degraded: author associations unknown, every author untrusted (nothing claimed or settled this pass)";
+  if (a[0] === "api" && (a[1] === "user" || a[1] === "app")) return "no effect: the App slug stands in for the engine's own login";
+  if (/\/protection\/required_status_checks|\/rules\/branches\//.test(s)) return "verification degraded: required checks unknown, a merge is verified without them";
+  if (/\/check-runs|\/commits\/[^ /]+\/status/.test(s)) return "verification degraded: check states unread";
+  if (/\/compare\//.test(s)) return "verification pending: merge placement unknown";
+  return "the error is raised to its caller (that step fails)";
+}
+
+/**
+ * #5088: `gh(args)→stdout` over `exec` (execFileSync's signature) with gh's stderr captured instead of leaked. A failure
+ * throws an Error naming the call (`.status`, `.stderr` kept); an HTTP 401/403 first `warn`s one line with the call and
+ * its effect on the pass (ghFailureEffect).
+ */
+export function ghRunner(exec, warn = () => {}) {
+  return (args) => {
+    try { return exec("gh", args, { encoding: "utf8", maxBuffer: 64 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"] }); } catch (e) {
+      const call = args.slice(0, 3).join(" "), stderr = String(e?.stderr ?? "");
+      const first = stderr.split("\n").map((l) => l.trim()).find(Boolean) ?? String(e?.message ?? e).split("\n")[0];
+      const code = /HTTP (40[13])\b/.exec(stderr)?.[1];
+      if (code) warn(`issue-watch: gh ${call} -> HTTP ${code}: ${first}; effect: ${ghFailureEffect(args)}`);
+      throw Object.assign(new Error(`gh ${call} failed: ${first}`), { status: e?.status, stderr });
+    }
+  };
+}
+
 const flag = (argv, f) => { const i = argv.indexOf(f); return i >= 0 ? argv[i + 1] : null; };
 
-/** `forgedock issue-watch run [--name w] [--repo o/r] [--once] [--interval s] | status [--name w] [--repo o/r]`; `--dry-run` (mode release) prints the would-cut set and writes nothing. */
+/** `forgedock issue-watch run [--name w] [--repo o/r] [--once] [--interval s] | status [--name w] [--repo o/r]`; `--dry-run` writes nothing: mode release prints the would-cut set, per-issue/batch the would-claim/fold/skip plan (#5088) and the needs-human classification. */
 export async function issueWatchFromCli(argv, deps = {}) {
   const [op] = argv;
   const usage = "usage: forgedock issue-watch run [--name <w>] [--repo owner/repo] [--once] [--interval <s>] [--dry-run] | status [--name <w>] [--repo owner/repo]";
@@ -455,10 +547,15 @@ export async function issueWatchFromCli(argv, deps = {}) {
     return { ok: true };
   }
   const ctx = decisionContext({ loadPolicy, readFile, cwd }), shared = { matches: matchesSelectors, fold, labelNames, isBot, TRUSTED };
-  if (argv.includes("--dry-run") && watch.mode !== "release") { // #4793: classification of the needs-human escalations, nothing written
-    const { rows } = await decisionStep({ watch, repo, io, state: readJson(join(dir, "status.json")) ?? fresh(watch, repo), ctx, shared, dryRun: true });
+  if (argv.includes("--dry-run") && watch.mode !== "release") { // #5088 would-claim/skip with reasons, then #4793 the needs-human classification; nothing written
+    const real = deps.io ?? realIo(repo, env), branches = readBranches(cwd);
+    const defaults = await defaultBranches({ repo, io: { gh: async (a) => real.gh(a) }, branches });
+    const state = readJson(join(dir, "status.json")) ?? fresh(watch, repo);
+    const { claim, fold: folded, skip } = await planClaims({ watch, repo, io: real, state, branches, defaults, room: roomFor(watch, state) });
+    print(formatClaimPlan({ claim, fold: folded, skip }));
+    const { rows } = await decisionStep({ watch, repo, io: real, state, ctx, shared, dryRun: true });
     print(formatDecisionDryRun(rows));
-    return { ok: true, dryRun: { rows } };
+    return { ok: true, dryRun: { rows, claim, fold: folded, skip } };
   }
   if (argv.includes("--dry-run")) {
     const real = deps.io ?? realIo(repo, env), branches = readBranches(cwd);

package/bin/lean/issuewatch.test.mjs

@@ -5,7 +5,7 @@ import assert from "node:assert/strict";
 import { mkdirSync, writeFileSync, existsSync, readFileSync } from "node:fs";
 import { tmpDir } from "../tests/_tmp.mjs";
 import { join } from "node:path";
-import { unclaimedOrOwn, parseWatches, validateWatch, loadWatches, matchesSelectors, issueVersion, hasUnresolvedDefer, classifyIssue, laneFor, dagOrder, claimIssue, acquireLock, tick, runWatch, formatStatus, repoDir, watchDir, issueWatchFromCli } from "./issuewatch.mjs";
+import { unclaimedOrOwn, parseWatches, validateWatch, loadWatches, matchesSelectors, issueVersion, hasUnresolvedDefer, classifyIssue, laneFor, dagOrder, claimIssue, acquireLock, tick, runWatch, formatStatus, repoDir, watchDir, issueWatchFromCli, isOwnApp, selectorMiss, planClaims, ghFailureEffect, ghRunner } from "./issuewatch.mjs";
 import { openBatch } from "./batch.mjs";
 
 const tmp = () => tmpDir("iw-");
@@ -419,3 +419,125 @@ test("#4793 formatStatus lists decided / evidence-gathered / folded / external-k
     decisions: { rows: [{ action: "decided" }, { action: "evidence-needed" }, { action: "post-deploy-only" }, { action: "external", kept: true }, { action: "external", kept: true }] } };
   assert.match(formatStatus(s, w, 0), /needs-human decisions: decided 1  evidence-gathered 1  folded 1  external-kept 2/);
 });
+
+// ── #5088: opt-in trust for the repo's own ForgeDock App, claim dry-run, named 401/403 ──────────────────────────────
+const appIss = (n, login = "rapiercraft-forgedock[bot]", o = {}) => iss(n, { title: `fix: app ${n}`, authorAssociation: "NONE", author: { login }, ...o });
+
+test("#5088 trust_app / trust_app_labels are validated watch keys, default off", () => {
+  assert.equal(W().trust_app, false);
+  assert.deepEqual(W().trust_app_labels, []);
+  assert.equal(W({ trust_app: "true" }).trust_app, true);
+  assert.equal(W({ trust_app: "false" }).trust_app, false);
+  assert.deepEqual(W({ trust_app: true, trust_app_labels: ["operator"] }).trust_app_labels, ["operator"]);
+  assert.throws(() => W({ trust_app: "yes" }), /trust_app must be true or false/);
+  assert.throws(() => W({ trust_app_labels: ["operator"] }), /trust_app_labels needs trust_app: true/);
+  assert.deepEqual(parseWatches("issue_watch:\n  watches:\n    a:\n      trust_app: true\n      trust_app_labels: [operator, intake]\n").a, { trust_app: "true", trust_app_labels: ["operator", "intake"] });
+});
+
+test("#5088 trust_app claims the repo's own App issues only; other bots and NONE humans stay out", () => {
+  const on = W({ trust_app: true });
+  // Release review #5123 (AUTH-1): the bare slug counts only with a bot signal; a human who registers the slug is never the App.
+  assert.ok(isOwnApp(appIss(1, "rapiercraft-forgedock", { author: { login: "rapiercraft-forgedock", is_bot: true } })));
+  assert.ok(!isOwnApp(appIss(1, "rapiercraft-forgedock", { author: { login: "rapiercraft-forgedock", is_bot: false } })), "human with the slug as login");
+  assert.equal(classifyIssue(appIss(1, "rapiercraft-forgedock", { author: { login: "rapiercraft-forgedock", is_bot: false } }), on), null, "human slug never claimed");
+  for (const l of ["rapiercraft-forgedock[bot]", "app/rapiercraft-forgedock"]) {
+    assert.ok(isOwnApp(appIss(1, l)), l);
+    assert.equal(classifyIssue(appIss(1, l), on), "claim", l);
+  }
+  for (const l of ["forge[bot]", "dependabot[bot]", "rapiercraft-forgedock-evil"]) assert.equal(classifyIssue(appIss(2, l), on), null, l);
+  assert.ok(!isOwnApp(appIss(2, "rapiercraft-forgedock-evil")));
+  assert.equal(classifyIssue(iss(3, { authorAssociation: "NONE", author: { login: "mallory" } }), on), null);
+  assert.equal(classifyIssue(iss(4), on), "claim"); // trusted humans unchanged
+  const narrow = W({ trust_app: true, trust_app_labels: ["operator"] });
+  assert.equal(classifyIssue(appIss(5), narrow), null);
+  assert.equal(classifyIssue(appIss(5, undefined, { labels: lbl("operator") }), narrow), "claim");
+  // App follow-ups stay governed by include_followups (post-deploy-only folds, never claims)
+  const defer = "- [ ] `R1: x` — defer: separate work\n", pd = "- [ ] `R2: y` — post-deploy: check later\n";
+  const fu = (body) => appIss(6, undefined, { title: "follow-up: 1 deferred item(s)", body });
+  const onFu = W({ trust_app: true, include_followups: "defer-only", postdeploy_rollup: "50" });
+  assert.equal(classifyIssue(fu(defer), onFu), "claim");
+  assert.equal(classifyIssue(fu(pd), onFu), "fold");
+  assert.equal(classifyIssue(fu("no items"), onFu), null);
+  assert.equal(classifyIssue(fu(pd), W({ trust_app: true })), null);
+});
+
+test("#5088 regression: without trust_app an App-authored issue is not claimed", async () => {
+  for (const l of ["rapiercraft-forgedock[bot]", "app/rapiercraft-forgedock", "rapiercraft-forgedock"]) assert.equal(classifyIssue(appIss(1, l), W()), null, l);
+  const io = fakeIo(tmp(), [appIss(1), iss(2)]);
+  const s = await tick({ watch: W(), repo: "o/r", io, state: { phase: "running", claimed: [], inflight: [], merged: [], verified: [], failed: [], folded: [], retries: {}, lanes: {}, batch: null } });
+  assert.deepEqual(s.claimed, [2]);
+});
+
+test("#5088 tick with trust_app claims and launches the App issue, not a NONE human or another bot", async () => {
+  const io = fakeIo(tmp(), [appIss(1), appIss(2, "forge[bot]"), iss(3, { authorAssociation: "NONE", author: { login: "mallory" } }), iss(4)]);
+  const s = await tick({ watch: W({ trust_app: true }), repo: "o/r", io, state: { phase: "running", claimed: [], inflight: [], merged: [], verified: [], failed: [], folded: [], retries: {}, lanes: {}, batch: null } });
+  assert.deepEqual(s.claimed, [1, 4]);
+  assert.deepEqual(io.launched.map(([n]) => n), [1, 4]);
+});
+
+test("#5088 selectorMiss names the failing selector", () => {
+  assert.equal(selectorMiss(iss(1, { labels: lbl("epic") }), W({ exclude_labels: ["epic"] })), "excluded label epic");
+  assert.equal(selectorMiss(iss(1), W({ labels: ["ready"] })), "missing label ready");
+  assert.equal(selectorMiss(iss(1), W()), null);
+});
+
+for (const mode of ["per-issue", "batch"]) {
+  test(`#5088 --dry-run (${mode}) lists would-claim and skipped issues with reasons and writes nothing`, async () => {
+    const dir = tmp(), cwd = tmp();
+    writeFileSync(join(cwd, "forge.yaml"), `branches:\n  default: main\nissue_watch:\n  watches:\n    intake:\n      mode: ${mode}\n      trust_app: true\n      exclude_labels: [epic]\n`);
+    const io = fakeIo(dir, [appIss(1), iss(2, { labels: lbl("epic") }), iss(3, { authorAssociation: "NONE", author: { login: "mallory" } }), iss(4), appIss(5, "dependabot[bot]")]);
+    io.gh = ((orig) => async (a) => (a[0] === "repo" ? (a.includes("nameWithOwner") ? JSON.stringify({ nameWithOwner: "o/r" }) : "main") : orig(a)))(io.gh);
+    const rdir = repoDir("o/r", io.env);
+    mkdirSync(rdir, { recursive: true });
+    writeFileSync(join(rdir, "claims.json"), JSON.stringify({ 4: "other" }) + "\n");
+    const out = [];
+    const r = await issueWatchFromCli(["run", "--name", "intake", "--dry-run"], { cwd, env: io.env, io, print: (l) => out.push(l) });
+    const t = out.join("\n");
+    assert.match(t, /would claim #1 -> staging: ForgeDock App author \(trust_app\)/);
+    assert.match(t, /skip #2: excluded label epic/);
+    assert.match(t, /skip #3: untrusted author mallory \(NONE\)/);
+    assert.match(t, /skip #4: already claimed by watch other/);
+    assert.match(t, /skip #5: bot author dependabot\[bot\]/);
+    assert.deepEqual(r.dryRun.claim, [{ number: 1, lane: "staging", reason: "ForgeDock App author (trust_app)" }]);
+    assert.ok(Array.isArray(r.dryRun.rows));
+    assert.deepEqual(JSON.parse(readFileSync(join(rdir, "claims.json"), "utf8")), { 4: "other" });
+    assert.ok(!existsSync(join(watchDir("o/r", "intake", io.env), "status.json")));
+    assert.deepEqual(io.launched, []);
+    assert.deepEqual(io.batchOps, []);
+  });
+}
+
+test("#5088 planClaims: own registry claim stays claimable, room caps the rest as over capacity", async () => {
+  const io = fakeIo(tmp(), [iss(1), iss(2), iss(3)]);
+  const rdir = repoDir("o/r", io.env);
+  mkdirSync(rdir, { recursive: true });
+  writeFileSync(join(rdir, "claims.json"), JSON.stringify({ 1: "w" }) + "\n");
+  const p = await planClaims({ watch: W(), repo: "o/r", io, state: { claimed: [3], inflight: [] }, room: 1 });
+  assert.deepEqual(p.claim.map((c) => c.number), [1]);
+  assert.deepEqual(p.skip, [{ number: 3, reason: "already claimed by this watch" }, { number: 2, reason: "over capacity (room 1)" }]);
+});
+
+test("#5088 ghRunner names the failing call; 401/403 also warn with the effect on the pass", () => {
+  const assocArgs = ["api", "repos/o/r/issues?state=open&per_page=100", "--paginate", "--jq", ".[]"];
+  assert.match(ghFailureEffect(assocArgs), /every author untrusted/);
+  assert.match(ghFailureEffect(["api", "user", "--jq", ".login"]), /^no effect/);
+  assert.match(ghFailureEffect(["api", "app", "--jq", ".slug"]), /^no effect/);
+  assert.match(ghFailureEffect(["api", "repos/o/r/branches/staging/protection/required_status_checks"]), /required checks unknown/);
+  assert.match(ghFailureEffect(["issue", "list", "-R", "o/r"]), /raised to its caller/);
+  const warned = [];
+  const fail = (stderr) => () => { throw Object.assign(new Error("Command failed"), { status: 1, stderr }); };
+  const gh403 = ghRunner(fail("gh: Resource not accessible by integration (HTTP 403)\n"), (l) => warned.push(l));
+  assert.throws(() => gh403(assocArgs), (e) => /gh api repos\/o\/r\/issues\?state=open&per_page=100 --paginate failed: gh: Resource not accessible by integration \(HTTP 403\)/.test(e.message) && e.status === 1);
+  assert.equal(warned.length, 1);
+  assert.match(warned[0], /gh api repos\/o\/r\/issues\?state=open.* -> HTTP 403: .*effect: pass degraded: .*every author untrusted/);
+  const gh401 = ghRunner(fail("gh: A JSON web token could not be decoded (HTTP 401)"), (l) => warned.push(l));
+  assert.throws(() => gh401(["api", "app", "--jq", ".slug"]), /gh api app --jq failed/);
+  assert.match(warned[1], /gh api app --jq -> HTTP 401: .*effect: no effect/);
+  const gh500 = ghRunner(fail("gh: Server Error (HTTP 500)"), (l) => warned.push(l));
+  assert.throws(() => gh500(["issue", "list"]), /gh issue list failed: gh: Server Error/);
+  assert.equal(warned.length, 2);
+  let seen;
+  assert.equal(ghRunner((cmd, args, opts) => { seen = { cmd, args, opts }; return "out"; })(["repo", "view"]), "out");
+  assert.equal(seen.cmd, "gh");
+  assert.deepEqual(seen.opts.stdio, ["ignore", "pipe", "pipe"]);
+});

package/docs/CONFIG.md

@@ -717,6 +717,8 @@ issue_watch:
 | `mode` | string | No | `per-issue` (default), `batch` or `release` (pool, then cut themed releases). |
 | `parallel` | integer | No | K of the batch in `batch` mode. Default 4. |
 | `include_followups` | string | No | `none` (default) or `defer-only`. |
+| `trust_app` | boolean | No | Claim issues authored by this repo's ForgeDock App. Other bots and `NONE`-association authors stay untrusted. Default false. |
+| `trust_app_labels` | list | No | Needs `trust_app`: an App-authored issue must carry one of these labels. |
 | `postdeploy_rollup` | issue number | No | Release issue that collects post-deploy-only follow-ups as checklist lines. |
 | `sweep_needs_human` | boolean | No | Also settle `needs-human` escalations that predate the watch (the backlog). Default false; `forgedock issue-watch run --dry-run` classifies them first and writes nothing. |
 | `max_launches` | integer | No | Total lane launches (claims plus requeues by the decision engine); at N the watch drains. Default: none. Decision-stage issues also count against `max_issues`. |

package/docs/ISSUE-WATCH.md

@@ -34,7 +34,7 @@ Each watch has `~/.forge/watch/<owner>__<repo>/<name>/` (or `$FORGEDOCK_WATCH_DI
 
 ## Selectors
 
-All optional, AND-ed. Only issues from an owner, member or collaborator are claimed (bot-filed issues only through `include_followups`).
+All optional, AND-ed. Only issues from an owner, member or collaborator are claimed (bot-filed issues only through `include_followups` or `trust_app`).
 
 | Key | Meaning |
 |---|---|
@@ -65,6 +65,27 @@ The lane follows the repo rule: a milestone issue goes to `milestone/<slug>` (fo
 
 `include_followups: defer-only` claims bot-filed `follow-up:` issues that have an unchecked `— defer` item. Post-deploy-only follow-ups are not claimed: with `postdeploy_rollup: <issue>` each is appended once as a checklist line to that release issue. Other bot issues stay excluded.
 
+## Issues filed by the ForgeDock App
+
+When agents and `gh` run as the ForgeDock App, the issues they file are authored by `rapiercraft-forgedock[bot]` with association `NONE`, so a watch skips them. `trust_app: true` (default false) claims issues authored by this repo's own ForgeDock App. Other bots and outsiders (`NONE` humans) stay excluded. It is an explicit opt-in because the App also files issues from untrusted inputs (prod-watch, ingestion). `trust_app_labels: [operator]` (needs `trust_app`) narrows it further: the App issue must carry one of those labels. `follow-up:` issues from the App still follow `include_followups`.
+
+## Dry run
+
+In `per-issue` and `batch` mode, `forgedock issue-watch run --name <w> --dry-run` prints what one pass would claim and why, then the needs-human classification. It writes nothing: no claim, no status, no launch.
+
+```
+would claim #12 -> staging: ForgeDock App author (trust_app)
+would fold #14
+skip #13: excluded label epic
+skip #15: untrusted author mallory (NONE)
+skip #16: already claimed by watch other
+skip #17: over capacity (room 4)
+```
+
+## gh errors
+
+A failed `gh` call raises an error that names the call. An HTTP 401 or 403 also prints one line naming the call and its effect on the pass, for example `issue-watch: gh api repos/o/r/issues?state=open&per_page=100 --paginate -> HTTP 403: ...; effect: pass degraded: author associations unknown, every author untrusted (nothing claimed or settled this pass)`. Under an App token, `gh api user` (403) and `gh api app` (401) report `no effect`.
+
 ## Merge verification
 
 A closed issue is not taken on trust. When a claimed issue closes (in `per-issue` and `batch` modes), the watch checks:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgedock",
-  "version": "1.47.0",
+  "version": "1.48.1",
   "description": "Autonomous development pipeline for coding agents. GitHub as institutional memory, with native Claude Code and OpenCode entrypoints.",
   "bin": {
     "forgedock": "bin/forgedock.mjs"

package/scripts/file-deferred-followups.sh

@@ -69,7 +69,7 @@ CLASSES="engineering post-deploy external ops verify-now host"
 # bin/lean/conformance.mjs ownerRoute; word boundaries spelled (^|[^[:alnum:]_]) / ([^[:alnum:]_]|$), no \b, for BSD grep (bash 3.2 hosts).
 POSTPROM_ERE='(after|post)[- ]?(promotion|release|deploy)|in production after|production[- ]verif|promot(e|ion)|rollout|purge|deploy[- ]time'
 ROPROD_ERE='ssh[[:space:]]+[[:alnum:]_.-]*-monitor([^[:alnum:]_]|$)|(^|[^[:alnum:]_])obs-psql([^[:alnum:]_]|$)|(^|[^[:alnum:]_])prod(uction)?[ _-]monitor([^[:alnum:]_]|$)|(^|[^[:alnum:]_])read[- ]only[^[:alnum:]_.]([^.]{0,38}[^[:alnum:]_.])?prod(uction)?([^[:alnum:]_]|$)|(^|[^[:alnum:]_])prod(uction)?[^[:alnum:]_.]([^.]{0,28}[^[:alnum:]_.])?(query|queries|capture|telemetry|logs?)([^[:alnum:]_]|$)'
-EXTNEED_ERE='credential|secret|api[- ]?key|token|password|passphrase|ssh[- ]?keys?([^[:alnum:]_]|$)|private[- ]key|(^|[^[:alnum:]_])login([^[:alnum:]_]|$)|(^|[^[:alnum:]_])sudo([^[:alnum:]_]|$)|spend|budget|billing|purchase|payment|account|third[- ]party|vendor|customer|contract sign|legal|(^|[^[:alnum:]_])(delete|drop|truncate|wipe|destroy|modify|migrate|write)([^[:alnum:]_]|$)'
+EXTNEED_ERE='credential|secret|api[- ]?key|token|password|passphrase|ssh[- ]?keys?([^[:alnum:]_]|$)|private[- ]key|(^|[^[:alnum:]_])login([^[:alnum:]_]|$)|(^|[^[:alnum:]_])sudo([^[:alnum:]_]|$)|spend|budget|billing|purchase|payment|account|third[- ]party|vendor|customer|contract sign|legal|(^|[^[:alnum:]_])(delete|drop|truncate|wipe|destroy|modify|migrate|write|update|restart|rotate|remove|grant|alter)([^[:alnum:]_]|$)'
 owner_route() { # why -> post-deploy | host | external
   case "$1" in "owner: orchestrator"*|"owner: promote"*) echo "post-deploy"; return 0 ;; esac
   if printf '%s' "$1" | grep -qiE "$POSTPROM_ERE" && ! printf '%s' "$1" | grep -qiE "$EXTNEED_ERE"; then echo "post-deploy"

package/scripts/owner-route-parity.test.sh

@@ -26,6 +26,12 @@ external|needs the prod ssh key to read production logs
 external|product manager decides the pricing page
 external|production dataset retention policy
 external|provide the Stripe API key, needed before rollout
+external|ssh ovh-monitor and restart the worker
+external|rotate the prod monitor webhook
+external|update the production telemetry config
+external|remove the stale prod monitor alert
+external|grant read-only prod access to the analyst
+external|alter the production query timeout
 post-deploy|verify the dashboard after release
 CASES
 echo "passed=$PASS failed=$FAIL"

package/scripts/plan-validate-live.mjs

@@ -59,7 +59,8 @@ export async function readLive({ gh, repo }) {
 /**
  * Parallel-start gate: dependencies of `issues` (not themselves in the batch) that are not merged into `baseOf(issue)`.
  * A dep is merged when it is CLOSED by a PR that is merged with that base, or whose merge commit is an ancestor of
- * that base (`isAncestor(sha, base)`, e.g. it arrived through a milestone sync). Unreadable issues are skipped (fail open:
+ * that base (`isAncestor(sha, base)`, e.g. it arrived through a milestone sync). With no linked PR (GitHub links only
+ * default-branch merges, #5086) the merged `feat/issue-<dep>-lean` PR is looked up instead. Unreadable issues are skipped (fail open:
  * the engine's own openDependency still guards each lane); an unreadable dep counts as unmet.
  * `sha`/`kind` (#5031): `kind` is "commit" when the dependency merged but its commit is not on the base yet (`sha`), else "other".
  * @returns {Promise<Array<{ issue: number, dep: number, base: string, why: string, sha: string|null, kind: "commit"|"other" }>>}
@@ -83,12 +84,23 @@ export async function unmetDependencies({ issues, baseOf, gh, repo, isAncestor }
         else {
           let merged = false;
           let missing = null;
+          // One PR is "on the base" when it merged there or its merge commit is an ancestor of it.
+          const check = async (p) => {
+            if (!p?.mergedAt) return;
+            const oid = p.mergeCommit?.oid;
+            if (p.baseRefName === base || (oid && isAncestor && await isAncestor(oid, base))) merged = true;
+            else if (oid) missing ??= oid;
+          };
           for (const pr of d.closedByPullRequestsReferences ?? []) {
-            const p = parse(await gh(["pr", "view", String(pr.number), ...r, "--json", "baseRefName,mergedAt,mergeCommit"]));
-            if (!p?.mergedAt) continue;
-            const sha = p.mergeCommit?.oid;
-            if (p.baseRefName === base || (sha && isAncestor && await isAncestor(sha, base))) { merged = true; break; }
-            if (sha) missing ??= sha;
+            await check(parse(await gh(["pr", "view", String(pr.number), ...r, "--json", "baseRefName,mergedAt,mergeCommit"])));
+            if (merged) break;
+          }
+          // #5086: GitHub links closing PRs only for default-branch merges, so a milestone-lane dependency has no references.
+          // Fall back to the lane PR by head-branch convention; a failed or non-array lookup finds nothing (still refused).
+          if (!merged && !missing) {
+            let prs = [];
+            try { prs = parse(await gh(["pr", "list", ...r, "--head", `feat/issue-${dep}-lean`, "--state", "merged", "--json", "number,baseRefName,mergedAt,mergeCommit", "--limit", "5"])); } catch { prs = []; }
+            for (const p of Array.isArray(prs) ? prs : []) { await check(p); if (merged) break; }
           }
           if (!merged) sha = missing;
           if (!merged) why = missing ? `merge commit ${missing.slice(0, 10)} is not on ${base}` : `closed but not merged into ${base}`;