forgedock 1.8.4 → 1.9.0

package/scripts/classify-finding.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# classify-finding.sh — Deterministic review-pr §6B.5 note disposition.
+#                        Decides whether one deduped review finding is filed
+#                        as a standalone `review-finding` issue (ISSUE) or
+#                        handled as a non-blocking note (NOTE).
+#
+# Usage:
+#   classify-finding.sh --severity <S> [--confidence <C>] [--agent <A>]
+#                       [--lineage none|review-finding] [--text <T> | --text-file <F>]
+#
+#   --severity    CRITICAL | HIGH | MEDIUM | LOW (case-insensitive). Missing or
+#                 unparseable → ISSUE (fail toward filing, never drop).
+#   --confidence  CONFIRMED | LIKELY | POSSIBLE (case-insensitive). Missing is
+#                 treated as not-POSSIBLE.
+#   --agent       The `**Agent**:` value of the finding (e.g. "Security", "Auth").
+#   --lineage     `review-finding` when the PR's linked issue (MERGE_ISSUE) carries
+#                 the `review-finding` label — i.e. this PR is itself a fix for a
+#                 review finding. Default `none`.
+#   --text/--text-file  Finding title + body + affected file paths, used for the
+#                 content-based safety exemption.
+#
+# Output (stdout, one line): `ISSUE <reason>` or `NOTE <reason>`.
+# Exit codes: 0 classified, 2 usage error.
+#
+# Rules (forge#3060, tightened after the 2026-10-08 cascade audit):
+#   1. HIGH/CRITICAL, or unparseable severity → ISSUE.
+#   2. Safety exemption is CONTENT-based: the text matches the security/billing
+#      keyword set, or the finding came from a dedicated, signal-selected domain
+#      agent (Auth, Billing, Concurrency, Database). Origin from the always-on
+#      "General Security & Quality" agent alone NO LONGER exempts a finding —
+#      that agent runs on every PR, so origin-based exemption filed nearly every
+#      LOW note it raised (50 of 60 would-be notes in the audited batch).
+#   3. Review-finding lineage (a fix for a finding): only MEDIUM findings that are
+#      CONFIRMED, or LIKELY and safety-exempt, become issues. LOW is always a
+#      NOTE — a fix for a finding must not mint a new generation of findings.
+#   4. Otherwise: LOW, or POSSIBLE below HIGH, is a NOTE unless safety-exempt.
+#
+# NOTEs are never discarded silently: review-pr §6B.5 fixes them in-PR, lists
+# them in the PR body, or records a drop reason in the review summary.
+#
+# Portable: bash 3.2 (macOS /bin/bash), BSD and GNU grep/tr. No network.
+
+set -u
+
+SEVERITY=""
+CONFIDENCE=""
+AGENT=""
+LINEAGE="none"
+TEXT=""
+
+usage() {
+  echo "ERROR: Usage: classify-finding.sh --severity <S> [--confidence <C>] [--agent <A>] [--lineage none|review-finding] [--text <T> | --text-file <F>]" >&2
+  exit 2
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --severity)   [ "$#" -ge 2 ] || usage; SEVERITY="$2"; shift 2 ;;
+    --confidence) [ "$#" -ge 2 ] || usage; CONFIDENCE="$2"; shift 2 ;;
+    --agent)      [ "$#" -ge 2 ] || usage; AGENT="$2"; shift 2 ;;
+    --lineage)    [ "$#" -ge 2 ] || usage; LINEAGE="$2"; shift 2 ;;
+    --text)       [ "$#" -ge 2 ] || usage; TEXT="$2"; shift 2 ;;
+    --text-file)
+      [ "$#" -ge 2 ] || usage
+      [ -r "$2" ] || { echo "ERROR: --text-file not readable: $2" >&2; exit 2; }
+      TEXT=$(cat "$2"); shift 2 ;;
+    *) usage ;;
+  esac
+done
+
+case "$LINEAGE" in
+  none|review-finding) ;;
+  *) echo "ERROR: --lineage must be 'none' or 'review-finding' (got '$LINEAGE')" >&2; exit 2 ;;
+esac
+
+upper() { printf '%s' "$1" | tr '[:lower:]' '[:upper:]' | tr -d '[:space:]'; }
+SEV=$(upper "$SEVERITY")
+CONF=$(upper "$CONFIDENCE")
+
+case "$SEV" in
+  CRITICAL|HIGH) echo "ISSUE severity-$SEV"; exit 0 ;;
+  MEDIUM|LOW) ;;
+  *) echo "ISSUE unparseable-severity"; exit 0 ;;
+esac
+
+# Safety exemption. Keywords match whole words, where `_`, `-`, `/` and other
+# punctuation separate words (so `auth_service` matches, `author` does not).
+SAFETY=""
+KW='security|auth|authz|authn|billing|payment|stripe|charge|invoice|injection|xss|csrf|ssrf|idor|secret|secrets|credential|credentials|permission|permissions|sql|token|password|redact'
+if printf '%s' "$TEXT" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9\n' ' ' | grep -Eqw "($KW)"; then
+  SAFETY="keyword"
+fi
+AGENT_LC=$(printf '%s' "$AGENT" | tr '[:upper:]' '[:lower:]')
+case "$AGENT_LC" in
+  auth*|billing*|concurrency*|database*) SAFETY="${SAFETY:-domain-agent}" ;;
+esac
+
+if [ "$LINEAGE" = "review-finding" ]; then
+  if [ "$SEV" = "MEDIUM" ] && { [ "$CONF" = "CONFIRMED" ] || { [ -n "$SAFETY" ] && [ "$CONF" = "LIKELY" ]; }; }; then
+    echo "ISSUE lineage-medium-${CONF:-UNKNOWN}"
+  else
+    echo "NOTE lineage-${SEV}-${CONF:-UNKNOWN}"
+  fi
+  exit 0
+fi
+
+if [ "$SEV" = "LOW" ] || [ "$CONF" = "POSSIBLE" ]; then
+  if [ -n "$SAFETY" ]; then
+    echo "ISSUE safety-exemption-$SAFETY"
+  else
+    echo "NOTE ${SEV}-${CONF:-UNKNOWN}"
+  fi
+  exit 0
+fi
+
+echo "ISSUE ${SEV}-${CONF:-UNKNOWN}"
+exit 0

package/scripts/classify-finding.test.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Fixtures for scripts/classify-finding.sh (review-pr §6B.5 note disposition).
+# Run: bash scripts/classify-finding.test.sh   (bash 3.2 compatible)
+
+set -u
+DIR=$(cd "$(dirname "$0")" && pwd)
+S="$DIR/classify-finding.sh"
+pass=0; fail=0
+
+expect() { # expect <ISSUE|NOTE> <description> -- args...
+  want="$1"; desc="$2"; shift 3
+  got=$(bash "$S" "$@" 2>/dev/null | cut -d' ' -f1)
+  if [ "$got" = "$want" ]; then pass=$((pass+1)); else fail=$((fail+1)); echo "FAIL: $desc (want $want, got '${got}')"; fi
+}
+expect_exit() { # expect_exit <code> <description> -- args...
+  want="$1"; desc="$2"; shift 3
+  bash "$S" "$@" >/dev/null 2>&1; got=$?
+  if [ "$got" = "$want" ]; then pass=$((pass+1)); else fail=$((fail+1)); echo "FAIL: $desc (want exit $want, got $got)"; fi
+}
+
+# --- Rule 1: high severity and unparseable severity always file ---
+expect ISSUE "CRITICAL files"                 -- --severity CRITICAL --confidence POSSIBLE
+expect ISSUE "HIGH POSSIBLE files"            -- --severity HIGH --confidence POSSIBLE
+expect ISSUE "HIGH on lineage files"          -- --severity HIGH --confidence LIKELY --lineage review-finding
+expect ISSUE "missing severity files"         -- --severity "" --confidence LIKELY
+expect ISSUE "unknown severity files"         -- --severity INFO
+expect ISSUE "lowercase high files"           -- --severity high
+
+# --- Rule 4: non-lineage ---
+expect ISSUE "MEDIUM CONFIRMED files"         -- --severity MEDIUM --confidence CONFIRMED --text "loop exits early"
+expect ISSUE "MEDIUM LIKELY files"            -- --severity MEDIUM --confidence LIKELY --text "loop exits early"
+expect NOTE  "MEDIUM POSSIBLE no-safety note" -- --severity MEDIUM --confidence POSSIBLE --text "loop exits early"
+expect NOTE  "LOW CONFIRMED no-safety note"   -- --severity LOW --confidence CONFIRMED --text "stale comment wording"
+expect NOTE  "LOW from Security agent, no keyword, is a NOTE (audit fix)" -- --severity LOW --confidence CONFIRMED --agent "Security" --text "comment wording drifted"
+expect NOTE  "LOW from General Security & Quality, no keyword" -- --severity LOW --confidence LIKELY --agent "General Security & Quality" --text "duplicated predicate in NOTE count"
+
+# --- Safety exemption (content-based) ---
+expect ISSUE "LOW with injection keyword"     -- --severity LOW --confidence POSSIBLE --text "shell injection via unquoted var"
+expect ISSUE "LOW with auth_service path"     -- --severity LOW --confidence LIKELY --text "src/auth_service.py:12 missing check"
+expect ISSUE "LOW with Secrets (case)"        -- --severity LOW --confidence LIKELY --text "Secrets leak to log"
+expect ISSUE "LOW with permission-check"      -- --severity LOW --confidence LIKELY --text "permission-check skipped"
+expect NOTE  "'author' is not 'auth'"         -- --severity LOW --confidence LIKELY --text "author field unused"
+expect NOTE  "'tokenizer' is not 'token'"     -- --severity LOW --confidence LIKELY --text "tokenizer splits oddly"
+expect ISSUE "LOW from Auth domain agent"     -- --severity LOW --confidence LIKELY --agent "Auth" --text "nit"
+expect ISSUE "LOW from Billing domain agent"  -- --severity LOW --confidence POSSIBLE --agent "billing" --text "nit"
+expect ISSUE "LOW from Database agent"        -- --severity LOW --confidence POSSIBLE --agent "Database" --text "nit"
+expect ISSUE "LOW from Concurrency agent"     -- --severity LOW --confidence POSSIBLE --agent "Concurrency" --text "nit"
+
+# --- Rule 3: review-finding lineage (fix for a finding) ---
+expect NOTE  "lineage LOW CONFIRMED note"     -- --severity LOW --confidence CONFIRMED --lineage review-finding --text "nit"
+expect NOTE  "lineage LOW security keyword still note" -- --severity LOW --confidence CONFIRMED --lineage review-finding --text "injection nit"
+expect ISSUE "lineage MEDIUM CONFIRMED files" -- --severity MEDIUM --confidence CONFIRMED --lineage review-finding --text "logic bug"
+expect NOTE  "lineage MEDIUM LIKELY no-safety note" -- --severity MEDIUM --confidence LIKELY --lineage review-finding --text "logic bug"
+expect ISSUE "lineage MEDIUM LIKELY with keyword files" -- --severity MEDIUM --confidence LIKELY --lineage review-finding --text "token leaks"
+expect NOTE  "lineage MEDIUM POSSIBLE with keyword note" -- --severity MEDIUM --confidence POSSIBLE --lineage review-finding --text "token leaks"
+
+# --- text-file input ---
+TMPF=$(mktemp "${TMPDIR:-/tmp}/classify-finding-test.XXXXXX")
+printf 'Title: unchecked xss sink\n' > "$TMPF"
+expect ISSUE "text-file keyword"              -- --severity LOW --confidence LIKELY --text-file "$TMPF"
+rm -f "$TMPF"
+
+# --- usage errors ---
+expect_exit 2 "unknown flag"                  -- --bogus x
+expect_exit 2 "bad lineage"                   -- --severity LOW --lineage P3
+expect_exit 2 "missing flag value"            -- --severity
+expect_exit 2 "unreadable text-file"          -- --severity LOW --text-file /nonexistent/x
+expect_exit 0 "valid call exits 0"            -- --severity LOW
+
+echo "classify-finding.test.sh: passed=$pass failed=$fail"
+[ "$fail" -eq 0 ]

package/scripts/close-dossier-no-main-commit.test.sh

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+# close-dossier-no-main-commit.test.sh — close.md Phase C1.7 must never write or commit in the main checkout.
+#
+# Static asserts on the spec plus execution of the real extracted C1.7 block
+# against a temp repo with a bare origin and a stubbed gh.
+#
+# Usage: bash scripts/close-dossier-no-main-commit.test.sh
+# Exit code: 0 if all assertions pass, 1 if any fail.
+#
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CLOSE_MD="$SCRIPT_DIR/../commands/work-on/close.md"
+
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+PASS=0; FAIL=0
+ok()   { PASS=$((PASS+1)); echo "PASS: $1"; }
+bad()  { FAIL=$((FAIL+1)); echo "FAIL: $1"; }
+
+# --- Static asserts on the spec ---
+if grep -nE 'git -C "\$\{REPO_PATH\}" (commit|add)' "$CLOSE_MD" >/dev/null; then
+  bad "close.md still runs git add/commit against REPO_PATH"
+else ok "close.md has no git add/commit against REPO_PATH"; fi
+
+C17=$(sed -n '/^## Phase C1.7/,/^## Phase C1.5/p' "$CLOSE_MD")
+if printf '%s\n' "$C17" | grep -nE '^\s*cd "\$\{REPO_PATH\}"' >/dev/null; then
+  bad "C1.7 changes directory into REPO_PATH"
+else ok "C1.7 does not cd into REPO_PATH"; fi
+printf '%s\n' "$C17" | grep -q 'Phase C1.7: skipped' && ok "C1.7 logs skip reasons" || bad "C1.7 missing 'Phase C1.7: skipped'"
+printf '%s\n' "$C17" | grep -q 'worktree add --detach' && ok "C1.7 uses a temporary detached worktree" || bad "C1.7 missing temp worktree"
+printf '%s\n' "$C17" | grep -q 'gh pr create' && ok "C1.7 opens a PR" || bad "C1.7 missing gh pr create"
+[ "$(printf '%s\n' "$C17" | grep -c '^```bash')" -eq 1 ] && ok "C1.7 is a single bash block (no cross-block shell state)" || bad "C1.7 must be exactly one bash block"
+printf '%s\n' "$C17" | grep -qE "^\s*trap .*EXIT" && ok "C1.7 registers an EXIT trap" || bad "C1.7 missing EXIT trap"
+printf '%s\n' "$C17" | grep -q 'worktree remove --force' && ok "C1.7 cleanup removes the worktree" || bad "C1.7 cleanup missing worktree remove"
+ADD_LN=$(printf '%s\n' "$C17" | grep -n 'worktree add --detach' | head -1 | cut -d: -f1)
+TRAP_LN=$(printf '%s\n' "$C17" | grep -nE "^\s*trap .*EXIT" | head -1 | cut -d: -f1)
+[ -n "$ADD_LN" ] && [ -n "$TRAP_LN" ] && [ "$TRAP_LN" -gt "$ADD_LN" ] && ok "EXIT trap registered after worktree add" || bad "EXIT trap must follow worktree add"
+printf '%s\n' "$C17" | grep -q 'force-with-lease' && ok "C1.7 pushes with --force-with-lease" || bad "C1.7 missing force-with-lease"
+printf '%s\n' "$C17" | grep -qE 'push .*--force( |$)' && bad "C1.7 uses bare --force" || ok "C1.7 has no bare --force"
+printf '%s\n' "$C17" | grep -q 'gh pr list' && ok "C1.7 checks for an existing open PR" || bad "C1.7 missing gh pr list"
+grep -q 'FORGE:DOSSIER_UPDATED' "$CLOSE_MD" && ok "FORGE:DOSSIER_UPDATED marker kept" || bad "FORGE:DOSSIER_UPDATED marker missing"
+
+# --- Dynamic: execute the REAL C1.7 block extracted from close.md (gh stubbed) ---
+BLOCK=$(printf '%s\n' "$C17" | awk '/^```bash/{f=1;next} /^```/{f=0} f')
+if [ -z "$BLOCK" ]; then
+  bad "could not extract the C1.7 bash block"
+elif ! command -v perl >/dev/null 2>&1 || ! yq --version 2>&1 | grep -q 'mikefarah'; then
+  bad "dynamic section needs perl and mikefarah yq v4 (not silently skipped)"
+else
+printf '%s\n' "$BLOCK" | grep -q '^_dossier_run()' && printf '%s\n' "$BLOCK" | grep -q '^_dossier_cleanup()' \
+  && ok "extracted block defines _dossier_run and _dossier_cleanup" || bad "extracted block missing _dossier_run/_dossier_cleanup"
+
+# Substitute only the exact {NAME} placeholders; leave ${NAME} shell expansions intact.
+printf '%s\n' "$BLOCK" | perl -pe 's/(?<!\$)\{GH_REPO\}/o\/r/g; s/(?<!\$)\{NUMBER\}/1/g; s/(?<!\$)\{PR_NUMBER\}/2/g; s/(?<!\$)\{GH_FLAG\}/-R o\/r/g' > "$TMP/block.sh"
+bash -n "$TMP/block.sh" && ok "substituted C1.7 block parses (bash -n)" || bad "substituted C1.7 block has a syntax error"
+
+export GIT_AUTHOR_NAME=t GIT_AUTHOR_EMAIL=t@example.com GIT_COMMITTER_NAME=t GIT_COMMITTER_EMAIL=t@example.com
+git init -q --bare "$TMP/origin.git"
+git init -q -b staging "$TMP/main"
+mkdir -p "$TMP/main/devdocs/modules"
+echo seed > "$TMP/main/devdocs/modules/m.md"
+printf 'modules:\n  - name: m\n    glob: "*.sh"\n    path: modules/m.md\n' > "$TMP/main/devdocs/index.yaml"
+git -C "$TMP/main" add -A && git -C "$TMP/main" commit -q -m seed
+git -C "$TMP/main" remote add origin "$TMP/origin.git"
+git -C "$TMP/main" push -q origin staging 2>/dev/null
+
+# gh stub: never touches the network; every call is logged.
+mkdir -p "$TMP/bin" "$TMP/tmpd" "$TMP/cwd"
+cat > "$TMP/bin/gh" <<'GHEOF'
+#!/usr/bin/env bash
+echo "gh $*" >> "$GH_LOG"
+case "$1 $2" in
+  "api repos/o/r/issues/1/comments")
+    printf '<!-- FORGE:BUILDER -->\n### Changes\n- `scripts/foo.sh` changed\n### Next\n' ;;
+  "pr view") echo "Test PR title" ;;
+  "pr list")
+    echo "pr-list worktrees: $(git -C "$REPO_PATH" worktree list | wc -l)" >> "$GH_LOG"
+    [ "${GH_KILL_ON_PR_LIST:-}" = 1 ] && kill -TERM "$(cat "$PIDF")" && sleep 1
+    echo "${GH_PR_LIST_URL:-}" ;;
+  "pr create") [ "${GH_FAIL_PR_CREATE:-}" = 1 ] && exit 1; echo "https://example.invalid/o/r/pull/9" ;;
+esac
+exit 0
+GHEOF
+chmod +x "$TMP/bin/gh"
+export GH_LOG="$TMP/gh.log" PIDF="$TMP/pid" REPO_PATH="$TMP/main" PR_BASE=staging NUMBER=1
+[ "$(PATH="$TMP/bin:$PATH" command -v gh)" = "$TMP/bin/gh" ] && ok "gh resolves to the stub" || bad "gh stub not first on PATH"
+
+HEAD_BEFORE=$(git -C "$TMP/main" rev-parse HEAD)
+BRANCH_BEFORE=$(git -C "$TMP/main" branch --show-current)
+
+# run_block: executes the real block in a fresh bash, cwd without forge.yaml.
+run_block() { : > "$GH_LOG"; ( cd "$TMP/cwd" && env PATH="$TMP/bin:$PATH" TMPDIR="$TMP/tmpd" "$@" bash -c 'echo $$ > "$PIDF"; source "$1"' _ "$TMP/block.sh" ) > "$TMP/out.log" 2>&1; }
+main_untouched() {
+  [ "$(git -C "$TMP/main" rev-parse HEAD)" = "$HEAD_BEFORE" ] && [ "$(git -C "$TMP/main" branch --show-current)" = "$BRANCH_BEFORE" ] \
+    && [ -z "$(git -C "$TMP/main" status --porcelain)" ]
+}
+no_leak() {
+  [ -z "$(ls -A "$TMP/tmpd" 2>/dev/null)" ] && [ "$(git -C "$TMP/main" worktree list | wc -l)" -eq 1 ]
+}
+
+# Scenario A: happy path
+run_block; RC=$?
+[ "$RC" -eq 0 ] && ok "A: real block exits 0" || bad "A: real block exit $RC"
+main_untouched && ok "A: main checkout untouched (HEAD, branch, clean tree)" || bad "A: main checkout modified"
+git -C "$TMP/origin.git" rev-parse -q --verify refs/heads/docs/dossier-1 >/dev/null && ok "A: dossier branch pushed to origin" || bad "A: dossier branch not pushed"
+git -C "$TMP/origin.git" show refs/heads/docs/dossier-1:devdocs/modules/m.md 2>/dev/null | grep -q '^## Entry' && ok "A: dossier entry appended on pushed branch" || bad "A: no entry on pushed branch"
+grep -q '^gh pr create' "$GH_LOG" && ok "A: gh pr create called" || bad "A: gh pr create not called"
+grep -q 'FORGE:DOSSIER_UPDATED' "$GH_LOG" && ok "A: FORGE:DOSSIER_UPDATED comment posted" || bad "A: no FORGE:DOSSIER_UPDATED comment"
+no_leak && ok "A: temporary worktree removed" || bad "A: temporary worktree leaked"
+
+# Scenario B: retry over the existing remote branch (real fetch + --force-with-lease)
+OLD=$(git -C "$TMP/origin.git" rev-parse refs/heads/docs/dossier-1)
+sleep 1  # commit SHAs embed second-resolution timestamps; ensure the retry differs
+run_block; RC=$?
+NEW=$(git -C "$TMP/origin.git" rev-parse refs/heads/docs/dossier-1)
+[ "$RC" -eq 0 ] && [ "$OLD" != "$NEW" ] && ok "B: retry push over existing remote branch succeeds" || bad "B: retry push failed (rc=$RC)"
+main_untouched && no_leak && ok "B: main untouched and worktree removed" || bad "B: main modified or worktree leaked"
+
+# Scenario C: fault injection - SIGTERM after worktree add, before the explicit cleanup.
+# Only the block's real EXIT trap can remove the worktree.
+run_block GH_KILL_ON_PR_LIST=1 2>/dev/null
+grep -q '^pr-list worktrees: 2' "$GH_LOG" && ok "C: worktree existed when the fault fired" || bad "C: fault did not fire after worktree add (vacuous)"
+grep -q '^gh pr create' "$GH_LOG" && bad "C: block continued past the injected fault" || ok "C: block aborted before pr create"
+no_leak && ok "C: real EXIT trap cleaned the worktree" || bad "C: worktree leaked after abort (EXIT trap regression)"
+main_untouched && ok "C: main checkout untouched" || bad "C: main checkout modified"
+
+# Scenario D: gh pr create fails - block still exits 0, logs a skip, cleans up
+run_block GH_FAIL_PR_CREATE=1; RC=$?
+[ "$RC" -eq 0 ] && grep -q 'skipped - gh pr create failed' "$TMP/out.log" && ok "D: pr create failure logged as skip, exit 0" || bad "D: pr create failure not handled"
+grep -q 'issue comment' "$GH_LOG" && bad "D: annotation posted despite no PR" || ok "D: no annotation without a PR"
+no_leak && ok "D: worktree removed" || bad "D: worktree leaked"
+fi
+
+echo "Passed: $PASS  Failed: $FAIL"
+[ "$FAIL" -eq 0 ]

package/scripts/forge-root.test.sh

@@ -8,7 +8,7 @@
 set -uo pipefail
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; ROOT="$HERE/.."
 T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
-PASS=0; FAILN=0
+PASS=0; FAILN=0; SKIPPED=0
 ok()  { PASS=$((PASS+1)); }
 bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
 expect() { [ "$2" = "$3" ] && ok || bad "$1 (got '$3' want '$2')"; }
@@ -40,6 +40,8 @@ grep -v '^[[:space:]]*#' "$T/canon" > "$T/canon.code"   # code only: the comment
 grep -qE 'mapfile|readarray|declare -A|sort[^|]* -[a-zA-Z]*V' "$T/canon.code" && bad "canonical bootstrap uses a bash-4+/non-portable construct" || ok
 grep -q 'sort -k1,1nr -k2,2nr -k3,3nr' "$T/canon.code" && ok || bad "canonical bootstrap lacks numeric component version sort"
 grep -qF 'marketplaces/*; do' "$T/canon" && bad "canonical bootstrap globs all marketplaces" || ok
+grep -qF -- "-iname '*forgedock*'" "$T/canon.code" && bad "canonical bootstrap wildcard-matches marketplaces" || ok
+grep -qF '[A-Za-z]:' "$T/canon.code" && ok || bad "canonical bootstrap lacks drive-letter path handling"
 # review.md must hard-exit on an unreadable trail
 grep -qE 'TRAIL_RC.* -ge 2 .*exit 1' "$ROOT/commands/work-on/review.md" && ok || bad "work-on/review.md lacks hard exit guard for TRAIL_RC>=2"
 # behavioral: execute the guard line itself. rc>=2 => BLOCKED on STDOUT + exit 1; rc 0/1 => falls through.
@@ -88,9 +90,9 @@ mkscripts() {
   : > "$1/bin/engine/resolve.mjs"; : > "$1/bin/engine/orchestrate-canary.mjs"; : > "$1/bin/engine/admission.mjs"
 }
 # plugin install: no env vars at all
-mkscripts "$T/h1/.claude/plugins/cache/mk/forgedock/1.0.0"
-expect "plugin cache resolves with no env" "$T/h1/.claude/plugins/cache/mk/forgedock/1.0.0" "$(run "$T/h1")"
-expect "CLAUDE_PLUGIN_ROOT resolves" "$T/h1/.claude/plugins/cache/mk/forgedock/1.0.0" "$(run "$T/empty" CLAUDE_PLUGIN_ROOT="$T/h1/.claude/plugins/cache/mk/forgedock/1.0.0")"
+mkscripts "$T/h1/.claude/plugins/cache/forgedock/forgedock/1.0.0"
+expect "plugin cache resolves with no env" "$T/h1/.claude/plugins/cache/forgedock/forgedock/1.0.0" "$(run "$T/h1")"
+expect "CLAUDE_PLUGIN_ROOT resolves" "$T/h1/.claude/plugins/cache/forgedock/forgedock/1.0.0" "$(run "$T/empty" CLAUDE_PLUGIN_ROOT="$T/h1/.claude/plugins/cache/forgedock/forgedock/1.0.0")"
 # nothing installed: empty (never the consumer repo, never a relative path)
 expect "unresolvable stays empty" "" "$(run "$T/empty")"
 expect "relative FORGE_HOME ignored" "" "$(run "$T/empty" FORGE_HOME=.)"
@@ -98,31 +100,38 @@ expect "relative FORGE_HOME ignored" "" "$(run "$T/empty" FORGE_HOME=.)"
 expect "FORGEDOCK_HOME authoritative" "$T/nowhere" "$(run "$T/h1" FORGEDOCK_HOME="$T/nowhere")"
 # symlink install (install.sh): ~/.claude/commands/work-on.md -> <clone>/commands/work-on.md
 mkdir -p "$T/clone/commands" "$T/h2/.claude/commands"; mkscripts "$T/clone"; : > "$T/clone/commands/work-on.md"
-ln -sf "$T/clone/commands/work-on.md" "$T/h2/.claude/commands/work-on.md"
-expect "install.sh symlink resolves" "$(cd "$T/clone" && pwd -P)" "$(cd "$(run "$T/h2")" && pwd -P)"
-expect "FORGE_HOME without scripts falls through" "$(cd "$T/clone" && pwd -P)" "$(cd "$(run "$T/h2" FORGE_HOME="$T/h2/.claude")" && pwd -P)"
+# Git Bash (MSYS) makes a COPY for `ln -s` unless native symlinks are requested, which leaves readlink
+# nothing to resolve; request them, and run the two symlink cases only when a real symlink exists (a runner
+# without symlink privilege cannot exercise install.sh's layout, which is itself a symlink install).
+MSYS=winsymlinks:nativestrict ln -sf "$T/clone/commands/work-on.md" "$T/h2/.claude/commands/work-on.md" 2>/dev/null
+if [ -L "$T/h2/.claude/commands/work-on.md" ]; then
+  expect "install.sh symlink resolves" "$(cd "$T/clone" && pwd -P)" "$(cd "$(run "$T/h2")" && pwd -P)"
+  expect "FORGE_HOME without scripts falls through" "$(cd "$T/clone" && pwd -P)" "$(cd "$(run "$T/h2" FORGE_HOME="$T/h2/.claude")" && pwd -P)"
+else
+  echo "SKIP: symlink cases (this platform cannot create symlinks)"; SKIPPED=$((SKIPPED+1))
+fi
 
 # newest cached version wins (1.10.0 must beat 1.9.0)
-for v in 1.9.0 1.10.0 1.2.0; do mkscripts "$T/h3/.claude/plugins/cache/mk/forgedock/$v"; done
-expect "newest cached version wins" "$T/h3/.claude/plugins/cache/mk/forgedock/1.10.0" "$(run "$T/h3")"
+for v in 1.9.0 1.10.0 1.2.0; do mkscripts "$T/h3/.claude/plugins/cache/forgedock/forgedock/$v"; done
+expect "newest cached version wins" "$T/h3/.claude/plugins/cache/forgedock/forgedock/1.10.0" "$(run "$T/h3")"
 # HOME containing a space still resolves
-mkscripts "$T/sp ace/.claude/plugins/cache/mk/forgedock/2.0.0"
-expect "space in HOME resolves" "$T/sp ace/.claude/plugins/cache/mk/forgedock/2.0.0" "$(run "$T/sp ace")"
+mkscripts "$T/sp ace/.claude/plugins/cache/forgedock/forgedock/2.0.0"
+expect "space in HOME resolves" "$T/sp ace/.claude/plugins/cache/forgedock/forgedock/2.0.0" "$(run "$T/sp ace")"
 # relative FORGEDOCK_HOME / CLAUDE_PLUGIN_ROOT rejected (fail closed => empty)
 expect "relative FORGEDOCK_HOME rejected" "" "$(run "$T/h1" FORGEDOCK_HOME=scripts/..)"
 expect "relative CLAUDE_PLUGIN_ROOT ignored" "" "$(run "$T/empty" CLAUDE_PLUGIN_ROOT=../consumer)"
 # a candidate with only one of the two needed scripts is rejected
-mkdir -p "$T/h4/.claude/plugins/cache/mk/forgedock/1.0.0/scripts"; : > "$T/h4/.claude/plugins/cache/mk/forgedock/1.0.0/scripts/verify-phase-trail.sh"
+mkdir -p "$T/h4/.claude/plugins/cache/forgedock/forgedock/1.0.0/scripts"; : > "$T/h4/.claude/plugins/cache/forgedock/forgedock/1.0.0/scripts/verify-phase-trail.sh"
 expect "partial install (missing lint script) rejected" "" "$(run "$T/h4")"
 # stale install: has the two original gate scripts but lacks is-docs-only.sh / engine modules => rejected
 for missing in scripts/is-docs-only.sh bin/engine/resolve.mjs bin/engine/orchestrate-canary.mjs bin/engine/admission.mjs; do
-  rm -rf "$T/h12"; mkscripts "$T/h12/.claude/plugins/cache/mk/forgedock/1.0.0"; rm -f "$T/h12/.claude/plugins/cache/mk/forgedock/1.0.0/$missing"
+  rm -rf "$T/h12"; mkscripts "$T/h12/.claude/plugins/cache/forgedock/forgedock/1.0.0"; rm -f "$T/h12/.claude/plugins/cache/forgedock/forgedock/1.0.0/$missing"
   expect "stale install missing $missing rejected" "" "$(run "$T/h12")"
 done
 # a stale newest version is skipped in favor of a complete older one
-rm -rf "$T/h13"; mkscripts "$T/h13/.claude/plugins/cache/mk/forgedock/1.0.0"; mkscripts "$T/h13/.claude/plugins/cache/mk/forgedock/2.0.0"
-rm -f "$T/h13/.claude/plugins/cache/mk/forgedock/2.0.0/scripts/is-docs-only.sh"
-expect "stale newest skipped for complete older" "$T/h13/.claude/plugins/cache/mk/forgedock/1.0.0" "$(run "$T/h13")"
+rm -rf "$T/h13"; mkscripts "$T/h13/.claude/plugins/cache/forgedock/forgedock/1.0.0"; mkscripts "$T/h13/.claude/plugins/cache/forgedock/forgedock/2.0.0"
+rm -f "$T/h13/.claude/plugins/cache/forgedock/forgedock/2.0.0/scripts/is-docs-only.sh"
+expect "stale newest skipped for complete older" "$T/h13/.claude/plugins/cache/forgedock/forgedock/1.0.0" "$(run "$T/h13")"
 # non-ForgeDock marketplace dirs are ignored; ForgeDock-named ones resolve
 mkscripts "$T/h5/.claude/plugins/marketplaces/other-tool"
 expect "non-ForgeDock marketplace ignored" "" "$(run "$T/h5")"
@@ -131,21 +140,67 @@ expect "forgedock marketplace resolves" "$T/h6/.claude/plugins/marketplaces/forg
 
 # release outranks its own pre-release; a newer pre-release core still beats an older release
 rm -rf "$T/h7"   # fixture is mutated below; reset per shell
-mkscripts "$T/h7/.claude/plugins/cache/mk/forgedock/1.9.0-rc1"; mkscripts "$T/h7/.claude/plugins/cache/mk/forgedock/1.9.0"
-expect "release beats its pre-release" "$T/h7/.claude/plugins/cache/mk/forgedock/1.9.0" "$(run "$T/h7")"
-mkscripts "$T/h7/.claude/plugins/cache/mk/forgedock/2.0.0-rc1"
-expect "newer-core pre-release beats older release" "$T/h7/.claude/plugins/cache/mk/forgedock/2.0.0-rc1" "$(run "$T/h7")"
-# version component decides, not the marketplace name (zz sorts after aa lexically but holds the older version)
-mkscripts "$T/h8/.claude/plugins/cache/zz-market/forgedock/1.0.0"; mkscripts "$T/h8/.claude/plugins/cache/aa-market/forgedock/1.1.0"
-expect "version beats marketplace name" "$T/h8/.claude/plugins/cache/aa-market/forgedock/1.1.0" "$(run "$T/h8")"
+mkscripts "$T/h7/.claude/plugins/cache/forgedock/forgedock/1.9.0-rc1"; mkscripts "$T/h7/.claude/plugins/cache/forgedock/forgedock/1.9.0"
+expect "release beats its pre-release" "$T/h7/.claude/plugins/cache/forgedock/forgedock/1.9.0" "$(run "$T/h7")"
+mkscripts "$T/h7/.claude/plugins/cache/forgedock/forgedock/2.0.0-rc1"
+expect "newer-core pre-release beats older release" "$T/h7/.claude/plugins/cache/forgedock/forgedock/2.0.0-rc1" "$(run "$T/h7")"
+# marketplace pinning: a higher-versioned forgedock plugin from a non-official marketplace is never used
+mkscripts "$T/h8/.claude/plugins/cache/evil-market/forgedock/99.0.0"; mkscripts "$T/h8/.claude/plugins/cache/forgedock/forgedock/1.1.0"
+expect "hostile marketplace at 99.0.0 ignored" "$T/h8/.claude/plugins/cache/forgedock/forgedock/1.1.0" "$(run "$T/h8")"
+rm -rf "$T/h8b"; mkscripts "$T/h8b/.claude/plugins/cache/evil-market/forgedock/99.0.0"
+expect "only a hostile marketplace => empty" "" "$(run "$T/h8b")"
+expect "FORGEDOCK_MARKETPLACE pins another marketplace" "$T/h8b/.claude/plugins/cache/evil-market/forgedock/99.0.0" "$(run "$T/h8b" FORGEDOCK_MARKETPLACE=evil-market)"
+expect "invalid FORGEDOCK_MARKETPLACE falls back to forgedock" "" "$(run "$T/h8b" FORGEDOCK_MARKETPLACE=..)"
+rm -rf "$T/h8c"; mkscripts "$T/h8c/.claude/plugins/marketplaces/evil-forgedock-tools"
+expect "wildcard-named marketplace dir ignored" "" "$(run "$T/h8c")"
+# non-semver cache dir names (commit SHAs, 1e5x) are skipped, never ranked by numeric coercion
+rm -rf "$T/h14"; P14="$T/h14/.claude/plugins/cache/forgedock/forgedock"
+mkscripts "$P14/1.10.0"; mkscripts "$P14/1e5abcdef"; mkscripts "$P14/abc1234def"; mkscripts "$P14/6f3a9c0"
+expect "SHA-named cache dirs ignored" "$P14/1.10.0" "$(run "$T/h14")"
+rm -rf "$T/h14b"; mkscripts "$T/h14b/.claude/plugins/cache/forgedock/forgedock/abc1234def"
+expect "only SHA-named dir => empty" "" "$(run "$T/h14b")"
+mkscripts "$P14/1.10.0-rc1"; expect "pre-release dir name still accepted (release wins)" "$P14/1.10.0" "$(run "$T/h14")"
+# Windows drive-letter FORGEDOCK_HOME is normalized (/c/...), relative stays rejected
+rm -rf "$T/win"; mkscripts "$T/win/c/forge"
+expect "C:/ FORGEDOCK_HOME authoritative (no cygpath, bogus path)" "/c/nowhere/forge" "$(run "$T/h1" FORGEDOCK_HOME='C:/nowhere/forge')"
+expect "C:\\ FORGEDOCK_HOME normalized" "/d/x/y" "$(run "$T/h1" FORGEDOCK_HOME='D:\x\y')"
+# Codex: forge-home pointer file written by install-codex.sh
+mkscripts "$T/hx/clone"; mkdir -p "$T/hx/.codex"; printf '%s\n' "$T/hx/clone" > "$T/hx/.codex/forge-home"
+expect "codex forge-home pointer resolves" "$T/hx/clone" "$(run "$T/hx")"
+expect "CODEX_HOME override resolves" "$T/hx/clone" "$(run "$T/empty" CODEX_HOME="$T/hx/.codex")"
+# A relative CODEX_HOME must not resolve the pointer against the consumer cwd
+mkdir -p "$T/consumer/.codex"; printf '%s\n' "$T/hx/clone" > "$T/consumer/.codex/forge-home"
+expect "relative CODEX_HOME ignored (cwd-local pointer not read)" "" "$(run "$T/empty" CODEX_HOME=.codex)"
+rm -rf "$T/consumer/.codex"
+printf 'relative/path\n' > "$T/hx/.codex/forge-home"
+expect "relative forge-home pointer rejected" "" "$(run "$T/hx")"
+# install-codex.sh: FORGE_HOME is shell-escaped in env files, and absent env files are not created (forge#3241)
+IC="$T/ic/we ird\$x's"; mkdir -p "$IC/commands" "$T/ic-home"
+cp "$ROOT/install-codex.sh" "$IC/install-codex.sh"
+: > "$T/ic-home/.zshenv"
+( cd "$IC" && env -i PATH="$PATH" HOME="$T/ic-home" CODEX_HOME="$T/ic-home/.codex" bash ./install-codex.sh >/dev/null 2>&1 )
+[ ! -e "$T/ic-home/.profile" ] && ok || bad "install-codex.sh created a missing ~/.profile"
+# The installer records its own resolved dir (macOS /var -> /private/var, Git Bash /tmp -> /c/Users/...), so compare against that, not $IC.
+IC_REAL=$( cd "$IC" && env -i PATH="$PATH" bash -c 'cd "$(dirname ./install-codex.sh)" && pwd' )
+got=$(env -i PATH="$PATH" HOME="$T/ic-home" bash -c '. "$HOME/.zshenv"; printf %s "$FORGE_HOME"' 2>&1)
+expect "env-file FORGE_HOME round-trips space, \$ and single quote" "$IC_REAL" "$got"
+got=$(env -i PATH="$PATH" HOME="$T/ic-home" sh -c '. "$HOME/.zshenv"; printf %s "$FORGE_HOME"' 2>&1)
+expect "env-file FORGE_HOME round-trips under POSIX sh" "$IC_REAL" "$got"
+grep -qF "\$'" "$T/ic-home/.zshenv" && bad "env file contains bash-only \$'...' quoting" || ok
+expect "pointer file still written" "$IC_REAL" "$(cat "$T/ic-home/.codex/forge-home" 2>/dev/null)"
+# errexit/pipefail safety: absent readlink target, absent cache dir, no ~/.claude at all
+for opts in "-e" "-eo pipefail" "-euo pipefail"; do
+  expect "survives set $opts with nothing installed" "ok:" "$( cd "$T/consumer" && env -i PATH="$PATH" HOME="$T/empty" "$SH" -c "set $opts; $(cat "$T/canon"); printf 'ok:%s' \"\$FORGE_ROOT\"" 2>&1 )"
+  expect "resolves under set $opts" "ok:$T/h3/.claude/plugins/cache/forgedock/forgedock/1.10.0" "$( cd "$T/consumer" && env -i PATH="$PATH" HOME="$T/h3" "$SH" -c "set $opts; $(cat "$T/canon"); printf 'ok:%s' \"\$FORGE_ROOT\"" 2>&1 )"
+done
 # a non-forgedock plugin in the cache is ignored even with a higher version
-mkscripts "$T/h9/.claude/plugins/cache/mk/otherplugin/9.9.9"; mkscripts "$T/h9/.claude/plugins/cache/mk/forgedock/1.0.0"
-expect "non-forgedock cache plugin ignored" "$T/h9/.claude/plugins/cache/mk/forgedock/1.0.0" "$(run "$T/h9")"
+mkscripts "$T/h9/.claude/plugins/cache/forgedock/otherplugin/9.9.9"; mkscripts "$T/h9/.claude/plugins/cache/forgedock/forgedock/1.0.0"
+expect "non-forgedock cache plugin ignored" "$T/h9/.claude/plugins/cache/forgedock/forgedock/1.0.0" "$(run "$T/h9")"
 # unmatched globs: empty cache dir, absent marketplaces dir, absent ~/.claude entirely (must not abort under zsh)
 mkdir -p "$T/h10/.claude/plugins/cache"
 expect "empty cache, no match, no abort" "" "$(run "$T/h10")"
 expect "no ~/.claude at all, no abort" "" "$(run "$T/empty")"
-expect "unmatched glob does not break later candidates" "$T/h1/.claude/plugins/cache/mk/forgedock/1.0.0" "$(run "$T/h10" CLAUDE_PLUGIN_ROOT="$T/h1/.claude/plugins/cache/mk/forgedock/1.0.0")"
+expect "unmatched glob does not break later candidates" "$T/h1/.claude/plugins/cache/forgedock/forgedock/1.0.0" "$(run "$T/h10" CLAUDE_PLUGIN_ROOT="$T/h1/.claude/plugins/cache/forgedock/forgedock/1.0.0")"
 # plugin root (textually substituted) outranks an exported FORGE_HOME that also has the scripts:
 # the running plugin's own files win over a stale clone named by a global env var (forge#3147 field test)
 mkscripts "$T/h11/stale-clone"; mkscripts "$T/h11/running-plugin"
@@ -166,11 +221,13 @@ for f in $SITES commands/work-on/close.md; do
 done
 if command -v node >/dev/null 2>&1; then
   for d in "we#ird" "sp ace" "q?x"; do
+    # '?' is not a legal Windows filename character: MSYS remaps it, so node sees a different path.
+    case "$d:$(uname -s)" in *'?'*:MINGW*|*'?'*:MSYS*|*'?'*:CYGWIN*) echo "SKIP: path '$d' (illegal on Windows)"; SKIPPED=$((SKIPPED+1)); continue ;; esac
     mkdir -p "$T/url/$d/bin/engine"; echo 'export const v = 42;' > "$T/url/$d/bin/engine/resolve.mjs"
     out=$(node -e 'import(require("node:url").pathToFileURL(process.argv[1]).href).then(m => process.stdout.write(String(m.v)))' "$T/url/$d/bin/engine/resolve.mjs" 2>&1)
     expect "pathToFileURL import survives path '$d'" 42 "$out"
   done
 fi
 
-echo "forge-root tests: pass=$PASS fail=$FAILN"
+echo "forge-root tests: pass=$PASS fail=$FAILN skipped=$SKIPPED"
 [ "$FAILN" -eq 0 ]

package/scripts/lint-build-validate-files.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Lint: every work-on:build:validate Skill( invocation in build.md must carry --files,
+# and the B6.5 repair section must contain an explicit one (forge#3254).
+# Usage: bash scripts/lint-build-validate-files.sh [path/to/build.md]
+set -uo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+SPEC="${1:-$HERE/../commands/work-on/build.md}"
+[ -f "$SPEC" ] || { echo "lint-build-validate-files: spec not found: $SPEC" >&2; exit 2; }
+rc=0
+calls=$(grep -n 'Skill(skill=.*work-on:build:validate' "$SPEC" || true)
+if [ -z "$calls" ]; then
+  echo "FAIL: no work-on:build:validate Skill( invocation found in $SPEC" >&2
+  exit 1
+fi
+bad=$(printf '%s\n' "$calls" | grep -vF -- '--files' || true)
+if [ -n "$bad" ]; then
+  printf '%s\n' "$bad" | while IFS= read -r l; do
+    echo "FAIL: $SPEC:${l%%:*}: validate invocation lacks --files" >&2
+  done
+  rc=1
+fi
+if ! awk '/Phase B6\.5/{f=1} f' "$SPEC" | grep 'Skill(skill=.*work-on:build:validate' | grep -qF -- '--files'; then
+  echo "FAIL: $SPEC: B6.5 repair section has no explicit validate invocation carrying --files" >&2
+  rc=1
+fi
+[ "$rc" -eq 0 ] && echo "OK: all validate invocations carry --files"
+exit "$rc"

package/scripts/lint-build-validate-files.test.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Fixtures for lint-build-validate-files.sh (forge#3254). Run: bash scripts/lint-build-validate-files.test.sh
+set -uo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+LINT="$HERE/lint-build-validate-files.sh"
+T="$(mktemp -d)"; trap 'rm -rf "$T"' EXIT
+PASS=0; FAILN=0
+check() { # name want_rc file
+  bash "$LINT" "$3" >"$T/out" 2>&1; rc=$?
+  if [ "$rc" -eq "$2" ]; then PASS=$((PASS+1)); else FAILN=$((FAILN+1)); echo "FAIL: $1 (rc=$rc want $2)"; cat "$T/out"; fi
+}
+V='Skill(skill="{FORGE_SKILL_PREFIX}work-on:build:validate", args="{NUMBER} --worktree {W}'
+printf '## Phase B6\n%s --files \\"{CHANGED_FILES}\\"")\n## Phase B6.5\n%s --files \\"{CHANGED_FILES}\\"")\n' "$V" "$V" > "$T/ok.md"
+check "all carry --files" 0 "$T/ok.md"
+printf '## Phase B6\n%s --files \\"x\\"")\n## Phase B6.5\n%s")\n' "$V" "$V" > "$T/bad1.md"
+check "one invocation lacks --files" 1 "$T/bad1.md"
+printf '## Phase B6\n%s --files \\"x\\"")\n## Phase B6.5\nfollowed by work-on:build:validate with the same args\n' "$V" > "$T/bad2.md"
+check "B6.5 has no explicit invocation" 1 "$T/bad2.md"
+printf 'nothing here\n' > "$T/bad3.md"
+check "no invocations at all" 1 "$T/bad3.md"
+check "real build.md" 0 "$HERE/../commands/work-on/build.md"
+echo "passed=$PASS failed=$FAILN"
+[ "$FAILN" -eq 0 ]

package/scripts/lint-dispatch-prompt.test.sh

@@ -229,7 +229,8 @@ check "mid-line CR not stripped" 1 "$T/p25"
 # 10. Spec snippet enforcement (forge#3070): extract the lint gate from the spec and run it in a loop.
 # Gate = from the bootstrap marker to the end of its fenced code block (not a hard-coded count of
 # top-level fi lines, which breaks whenever the bootstrap gains or loses a conditional).
-awk '/^# FORGE_ROOT bootstrap/{f=1} f&&/^```/{exit} f{print}' "$SPEC" > "$T/gate"
+# Several spec blocks carry the bootstrap marker (e.g. the recovery-claim gate, forge#3172); pick the one holding the lint gate.
+awk '/^# FORGE_ROOT bootstrap/{f=1;buf=""} f&&/^```/{if(buf ~ /LINT_REFUSED_ISSUES/){printf "%s",buf;exit} f=0} f{buf=buf $0 "\n"}' "$SPEC" > "$T/gate"
 [ -s "$T/gate" ] || { FAILN=$((FAILN+1)); echo "FAIL: could not extract spec lint gate"; }
 gate_refused() { # prompt-file home -> prints refusal entries or LAUNCHED
   ( LINT_REFUSED_ISSUES=(); RENDERED_PROMPT="$(cat "$1")"; FORGEDOCK_HOME="$2"; unset FORGE_HOME; reset_vals