forgedock 1.8.4 → 1.9.1

package/scripts/verify-phase-trail.sh

@@ -9,7 +9,7 @@
 # verdict alone after phases were silently skipped.
 #
 # Usage:
-#   verify-phase-trail.sh <issue> -R <owner/repo> [--docs-only] [--code-diff] [--head-tree <sha>]
+#   verify-phase-trail.sh <issue> -R <owner/repo> [--docs-only] [--code-diff] [--head-tree <sha>] [--head-sha <sha>]
 #
 #   --docs-only   The diff is documentation-only; the FORGE:QUALITY_GATE marker
 #                 is not required.
@@ -22,6 +22,9 @@
 #                 An empty or non-hex value is a usage error (exit 2, fails closed).
 #                 Scope: this binds the PASS to the built tree; it is not tamper-proof, because the
 #                 pipeline agent posts under the same trusted identity and could compute the tree itself.
+#   --head-sha    Commit id (40 or 64 hex) of the head being gated. Enables the human break-glass
+#                 override (below); without it an override comment is never evaluated. An empty or
+#                 non-hex value is a usage error (exit 2, fails closed).
 #
 # Requirements by COMPLEXITY_BAND (read from the FORGE:FAST_PATH comment).
 # The authoritative table is the `case "$EFFECTIVE"` block below; this summary must be
@@ -38,9 +41,14 @@
 #   PHASE_TRAIL: PASS|FAIL|ERROR
 #   BAND: <band>
 #   MISSING: <marker> -> <phase to re-run>      (one line per missing artifact)
+#   PHASE_TRAIL: OVERRIDDEN                     (exit 0 via an accepted break-glass override)
+#   WAIVED: <marker list>                       (the MISSING set the override waived)
+#   OVERRIDE: approver=<login> head=<sha> missing=<list> reason=<sanitised>
+#                                               (the ONLY source callers use to record the override)
 #
-# Exit codes: 0 pass, 1 one or more artifacts missing, 2 could not
+# Exit codes: 0 pass (or accepted override), 1 one or more artifacts missing, 2 could not
 # read the issue (fails closed — an unreadable trail is never treated as a pass).
+# Exit 2 is NEVER overridable: override evaluation only runs on the exit-1 (MISSING) path.
 # Callers route on the exit code: 1 -> re-run the MISSING phases; 2 (or 127 when the
 # verifier itself cannot be resolved) -> infrastructure BLOCKED, never "missing phases".
 #
@@ -62,11 +70,36 @@
 # Identities outside that set -- e.g. a human with author_association CONTRIBUTOR/NONE/FIRST_TIME_CONTRIBUTOR
 # (an external contributor running the pipeline under their own login) -- are NOT trusted, so their
 # markers are ignored and the gate reports them MISSING. To accept such an identity add its login to
-# FORGE_TRAIL_TRUSTED_LOGINS, or widen FORGE_TRAIL_TRUSTED_ASSOCIATIONS (e.g. add CONTRIBUTOR). On FAIL the
+# FORGE_TRAIL_TRUSTED_LOGINS (do NOT widen FORGE_TRAIL_TRUSTED_ASSOCIATIONS to CONTRIBUTOR: that lets any
+# contributor forge FORGE:* trail markers). On FAIL the
 # script prints a NOTE when untrusted-author FORGE markers were seen, so this is diagnosable (#3123).
 # Limits: "Bot" trusts any GitHub App/bot that can comment on the repo (set
 # FORGE_TRAIL_TRUSTED_ASSOCIATIONS and FORGE_TRAIL_TRUSTED_LOGINS to tighten);
 # COLLABORATOR includes read-level collaborators; login matching is case-sensitive.
+# The override prefilter uses FORGE_TRAIL_OVERRIDE_ASSOCIATIONS (default: the trail list). Widen THAT variable,
+# not the trail list, for concealed-membership approvers; it never affects which FORGE markers count toward the
+# gate. Blast radius of widening FORGE_TRAIL_TRUSTED_ASSOCIATIONS: every listed association can forge trail markers.
+#
+# Break-glass override (#3152): a misfiring gate can be cleared by a HUMAN, never by the pipeline.
+# A comment whose body starts with `<!-- FORGE:PHASE_TRAIL_OVERRIDE -->` and carries the lines
+#   **Head**: <full head sha>
+#   **Missing**: <marker names, comma separated>
+#   **Reason**: <one line>
+# is honoured only when ALL of these hold (any error, null field or API failure rejects it and the
+# gate stays at exit 1; never a pass):
+#   - user.type == "User" (allowlist: Bots and null users are rejected) with a plain login;
+#   - updated_at == created_at (an edited comment is rejected: tamper evidence);
+#   - the author has repo permission admin or write (collaborators/<login>/permission), not mere
+#     org membership or read access;
+#   - the author is NOT a pipeline identity: FORGE_TRAIL_PIPELINE_LOGINS (comma-separated, case-insensitive)
+#     plus the author of every trusted FORGE marker comment (BUILDER, INVESTIGATOR, CONTRACT, ...), so a
+#     pipeline running under a human token cannot approve its own gate. A solo operator therefore needs a
+#     second human with write access to post the override;
+#   - **Head** equals --head-sha and **Missing** equals the current MISSING marker-name set exactly
+#     (a new commit or a different failure invalidates it);
+#   - created_at is later than the latest trusted FORGE:BUILDER:COMPLETE update time.
+# The reason is sanitised (control chars stripped, comment markers neutralised, whitespace collapsed,
+# capped at 200 chars); an empty reason rejects the override.
 # END-HELP (`-h` prints the header up to this line; keep it last)
 
 set -uo pipefail
@@ -77,6 +110,8 @@ DOCS_ONLY=0
 CODE_DIFF=0
 HEAD_TREE=""
 HEAD_TREE_SET=0
+HEAD_SHA=""
+HEAD_SHA_SET=0
 
 while [ $# -gt 0 ]; do
   case "$1" in
@@ -88,6 +123,9 @@ while [ $# -gt 0 ]; do
     --head-tree)
       if [ $# -lt 2 ]; then echo "PHASE_TRAIL: ERROR"; echo "usage error: $1 needs a value" >&2; exit 2; fi
       HEAD_TREE="$2"; HEAD_TREE_SET=1; shift 2 ;;
+    --head-sha)
+      if [ $# -lt 2 ]; then echo "PHASE_TRAIL: ERROR"; echo "usage error: $1 needs a value" >&2; exit 2; fi
+      HEAD_SHA="$2"; HEAD_SHA_SET=1; shift 2 ;;
     -h|--help) awk 'NR >= 5 { if (/^# END-HELP/) exit; print }' "$0"; exit 0 ;;
     *)
       if [ -z "$ISSUE" ] && [[ "$1" =~ ^[0-9]+$ ]]; then ISSUE="$1"; shift
@@ -98,7 +136,7 @@ done
 
 if [ -z "$ISSUE" ] || [ -z "$REPO" ]; then
   echo "PHASE_TRAIL: ERROR"
-  echo "usage: verify-phase-trail.sh <issue> -R <owner/repo> [--docs-only] [--code-diff] [--head-tree <sha>]" >&2
+  echo "usage: verify-phase-trail.sh <issue> -R <owner/repo> [--docs-only] [--code-diff] [--head-tree <sha>] [--head-sha <sha>]" >&2
   exit 2
 fi
 if [ "$HEAD_TREE_SET" = "1" ]; then
@@ -111,6 +149,16 @@ if [ "$HEAD_TREE_SET" = "1" ]; then
   fi
 fi
 
+if [ "$HEAD_SHA_SET" = "1" ]; then
+  # Fail closed: a caller that could not resolve the head passes an empty value and must not silently skip the binding.
+  HEAD_SHA=$(printf '%s' "$HEAD_SHA" | tr 'A-F' 'a-f')
+  if ! [[ "$HEAD_SHA" =~ ^([0-9a-f]{40}|[0-9a-f]{64})$ ]]; then
+    echo "PHASE_TRAIL: ERROR"
+    echo "usage error: --head-sha needs a 40 or 64 hex commit id" >&2
+    exit 2
+  fi
+fi
+
 RAW=$(gh api "repos/${REPO}/issues/${ISSUE}/comments" --paginate 2>/dev/null) || {
   echo "PHASE_TRAIL: ERROR"
   echo "could not read comments for ${REPO}#${ISSUE}" >&2
@@ -130,6 +178,10 @@ RAW=$(printf '%s' "$RAW" | jq -s 'if all(.[]; type == "array" and all(.[]; type
 # One line per comment, newlines folded to \x1f so a marker and its sentinel can
 # be matched within the SAME comment.
 TRUSTED_ASSOC="${FORGE_TRAIL_TRUSTED_ASSOCIATIONS-OWNER,MEMBER,COLLABORATOR}"
+# Separate trust decision (forge#3350): the break-glass override prefilter has its own list so it can be widened
+# (e.g. CONTRIBUTOR for concealed-membership approvers) without loosening the trail-marker gate. Defaults to the
+# trail list; ${VAR-default} (no colon) so an explicitly empty value yields no override candidates (fail closed).
+OVERRIDE_ASSOC="${FORGE_TRAIL_OVERRIDE_ASSOCIATIONS-$TRUSTED_ASSOC}"
 TRUSTED_LOGINS="${FORGE_TRAIL_TRUSTED_LOGINS-}"
 COMMENTS=$(printf '%s' "$RAW" | jq -r --arg assoc "$TRUSTED_ASSOC" --arg logins "$TRUSTED_LOGINS" '
   ($assoc | split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(length > 0))) as $A
@@ -263,6 +315,133 @@ if [ "${#MISSING[@]}" -eq 0 ]; then
   exit 0
 fi
 
+# --- Break-glass override (#3152) ---------------------------------------------------------------
+# Reached ONLY with a non-empty MISSING set (exit-1 path); every `exit 2` above precedes it.
+# Prints the OVERRIDE/WAIVED lines and returns 0 only when a comment passes every rule; any failure
+# (jq error, permission API error, empty field) returns 1 and the caller falls through to FAIL.
+# Name set normaliser shared by BOTH sides of the comparison: drops ` -> action` and `(qualifier)`,
+# trims, de-duplicates, sorts, joins with commas. bash 3.2/BSD portable.
+norm_set() {
+  sed -e 's/ -> .*$//' -e 's/([^)]*)//g' -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' \
+    | grep -v '^$' | LC_ALL=C sort -u | paste -sd, -
+}
+
+evaluate_override() {
+  [ "$HEAD_SHA_SET" = "1" ] || return 1
+  local cur_set cands pipeline_logins login created head missing reason perm n=0 total=0 seen_logins="" llogin
+  cur_set=$(printf '%s\n' "${MISSING[@]}" | norm_set) || return 1
+  [ -n "$cur_set" ] || return 1
+  # BUILDER exists but its completion time is unknown -> cannot prove the override is newer: reject.
+  if has '<!-- FORGE:BUILDER -->' && [ -z "$BUILD_AT" ]; then return 1; fi
+  # Pipeline identity set (configured + derived): authors of trusted FORGE marker comments other than overrides.
+  # The token this verifier runs under is the pipeline's identity too (forge#3269): a pipeline using a human
+  # token with no markers yet must not approve its own override. Lookup failure adds nothing (derived set still applies).
+  local self_login extra_logins marker_floor
+  self_login=$(gh api user --jq '.login' 2>/dev/null || true)
+  case "$self_login" in *[!A-Za-z0-9_-]*) self_login="" ;; esac
+  extra_logins="${FORGE_TRAIL_PIPELINE_LOGINS-}${self_login:+,$self_login}"
+  pipeline_logins=$(printf '%s' "$RAW" | jq -r --arg assoc "$TRUSTED_ASSOC" --arg logins "$TRUSTED_LOGINS" --arg extra "$extra_logins" '
+    ($assoc | split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(length > 0))) as $A
+    | ($logins | split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(length > 0))) as $L
+    | ($extra | split(",") | map(gsub("^\\s+|\\s+$"; "") | ascii_downcase) | map(select(length > 0))) as $E
+    | ( [ .[]
+          | select(
+              ((.author_association // "") as $x | $A | index($x) != null)
+              or ((.user.type // "") == "Bot")
+              or ((.user.login // "") as $x | $L | index($x) != null))
+          | select((.body // "") | startswith("<!-- FORGE:") and (startswith("<!-- FORGE:PHASE_TRAIL_OVERRIDE -->") | not))
+          | (.user.login // empty) | ascii_downcase ] + $E ) | unique | .[]' 2>/dev/null) || return 1
+  # Time floor (forge#3271): the latest trusted BUILDER:COMPLETE. With none, fall back to the newest trusted
+  # non-override FORGE marker so an override still has to post-date the pipeline's own activity.
+  marker_floor="$BUILD_AT"
+  if [ -z "$marker_floor" ]; then
+    marker_floor=$(printf '%s' "$RAW" | jq -r --arg assoc "$TRUSTED_ASSOC" --arg logins "$TRUSTED_LOGINS" '
+      ($assoc | split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(length > 0))) as $A
+      | ($logins | split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(length > 0))) as $L
+      | [ .[]
+          | select(((.author_association // "") as $x | $A | index($x) != null)
+                   or ((.user.type // "") == "Bot")
+                   or ((.user.login // "") as $x | $L | index($x) != null))
+          | select((.body // "") | startswith("<!-- FORGE:") and (startswith("<!-- FORGE:PHASE_TRAIL_OVERRIDE -->") | not))
+          | .created_at // empty ] | sort | .[-1] // empty' 2>/dev/null) || return 1
+  fi
+  # Candidates, newest first, as TSV: login created_at head missing reason (reason last, others never empty).
+  # The author_association prefilter uses its own list ($OVERRIDE_ASSOC, default = trail list) and is only an
+  # optimization (forge#3279): the permission API stays authoritative. A real write/admin approver with concealed
+  # org membership can show CONTRIBUTOR/NONE and is filtered out here; widen FORGE_TRAIL_OVERRIDE_ASSOCIATIONS to
+  # accept them (never the trail list). An empty list yields no candidates (fail closed). Filtered candidates are counted in a NOTE.
+  # One jq pass (forge#3351): the eligibility predicate is defined once (`eligible`); the first output line is the
+  # count of eligible comments dropped by the association prefilter, the rest are the candidate TSV rows.
+  local assoc_dropped out
+  out=$(printf '%s' "$RAW" | jq -r --arg assoc "$OVERRIDE_ASSOC" --arg bt "$marker_floor" '
+    ($assoc | split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(length > 0))) as $A
+    | def clean: explode | map(select(. >= 32 and . != 127 and (. < 128 or . > 159) and (. < 8203 or . > 8207) and (. < 8232 or . > 8238) and (. < 8288 or . > 8297) and . != 65279)) | implode;
+    def eligible:
+      select((.body // "") | startswith("<!-- FORGE:PHASE_TRAIL_OVERRIDE -->"))
+      | select((.user.type // "") == "User")
+      | select(((.user.login // "") | test("^[A-Za-z0-9_-]+$")))
+      | select((.created_at // "") != "" and (.updated_at // "") != "" and .created_at == .updated_at)
+      | select($bt == "" or .created_at > $bt);
+    def assoc_ok: (.author_association // "") as $x | $A | index($x) != null;
+    ( [ .[] | eligible | select(assoc_ok | not) ] | length ) as $dropped
+    | ( [ .[]
+        | eligible
+        | select(assoc_ok)
+        | (.body | split("\n") | map(sub("\r$"; ""))) as $ln
+        | { login: .user.login, at: .created_at,
+            head: ([$ln[] | capture("^\\*\\*Head\\*\\*: *(?<v>[0-9A-Fa-f]{40,64}) *$")? | .v] | .[0] // "-"),
+            missing: ([$ln[] | capture("^\\*\\*Missing\\*\\*: *(?<v>.+)$")? | .v] | .[0] // "-"),
+            reason: ([$ln[] | capture("^\\*\\*Reason\\*\\*: *(?<v>.*)$")? | .v] | .[0] // "")
+              | clean | gsub("<!--"; "<!-/-") | gsub("-->"; "-/->") | gsub("`"; "'"'"'") | gsub("@"; "(at)")
+              | gsub("\\s+"; " ") | sub("^ "; "") | sub(" $"; "") | .[0:200] } ]
+      | sort_by(.at) | reverse ) as $rows
+    | "#DROPPED\t\($dropped)",
+      ($rows[] | [.login, .at, .head, .missing, (if .reason == "" then "-" else .reason end)] | @tsv)' 2>/dev/null) || return 1
+  assoc_dropped=$(printf '%s\n' "$out" | head -n 1 | cut -f2)
+  case "$assoc_dropped" in ''|*[!0-9]*) assoc_dropped=0 ;; esac
+  if [ "$assoc_dropped" -gt 0 ]; then echo "NOTE: ${assoc_dropped} override candidate(s) ignored: author_association not in override-approver set" >&2; fi
+  cands=$(printf '%s\n' "$out" | tail -n +2)
+  [ -n "$cands" ] || return 1
+  while IFS=$'\t' read -r login created head missing reason; do
+    [ -n "$login" ] || continue
+    [ "$reason" != "-" ] && [ -n "$reason" ] || continue
+    reason=$(printf '%s' "$reason" | tr -d '[:cntrl:]')   # belt and braces: cntrl (incl. ESC) stripped again
+    [ -n "$reason" ] || continue
+    [ "$(printf '%s' "$head" | tr 'A-F' 'a-f')" = "$HEAD_SHA" ] || continue
+    [ "$(printf '%s' "$missing" | tr ',' '\n' | norm_set)" = "$cur_set" ] || continue
+    if printf '%s\n' "$pipeline_logins" | grep -Fx -- "$(printf '%s' "$login" | tr 'A-Z' 'a-z')" >/dev/null; then continue; fi
+    # forge#3279/#3306: dedupe distinct logins (bash 3.2-portable newline list, no associative arrays); a login seen
+    # before was already rejected (an accepted one returns), so repeat comments cost no slot and no API call.
+    # Cap accounting: a DEFINITIVE negative (read/triage/none) is free so read-level members cannot crowd out an older
+    # real approver; only UNREADABLE lookups spend the 5-slot error cap, and 25 distinct lookups is a hard ceiling.
+    llogin=$(printf '%s' "$login" | tr 'A-Z' 'a-z')
+    if printf '%s\n' "$seen_logins" | grep -Fx -- "$llogin" >/dev/null; then continue; fi
+    total=$((total+1)); [ "$total" -le 25 ] || { echo "NOTE: break-glass override: more than 25 distinct candidate logins; extra ones ignored" >&2; break; }   # bound API calls
+    seen_logins="${seen_logins}${llogin}"$'\n'
+    # Login already matched ^[A-Za-z0-9_-]+$ in jq, so it is safe to interpolate into the API path.
+    perm=$(gh api "repos/${REPO}/collaborators/${login}/permission" 2>/dev/null | jq -r '.permission // empty' 2>/dev/null) || perm=""
+    case "$perm" in
+      admin|write) ;;
+      "")
+        echo "NOTE: break-glass override by ${login} rejected: permission='unreadable' (needs admin/write; the lookup needs a token with push access)" >&2
+        n=$((n+1)); [ "$n" -le 5 ] || { echo "NOTE: break-glass override: more than 5 unreadable permission lookups; extra candidates ignored" >&2; break; }
+        continue ;;
+      *) echo "NOTE: break-glass override by ${login} rejected: permission='${perm}' (needs admin/write)" >&2; continue ;;
+    esac
+    echo "PHASE_TRAIL: OVERRIDDEN"
+    echo "BAND: ${BAND:-UNKNOWN}"
+    echo "WAIVED: ${cur_set}"
+    echo "OVERRIDE: approver=${login} head=${HEAD_SHA} missing=${cur_set} reason=${reason}"
+    return 0
+  done <<< "$cands"
+  return 1
+}
+
+if evaluate_override; then
+  [ -n "${BAND_NOTE:-}" ] && echo "NOTE: $BAND_NOTE"
+  exit 0
+fi
+
 echo "PHASE_TRAIL: FAIL"
 echo "BAND: ${BAND:-UNKNOWN}"
 for m in "${MISSING[@]}"; do echo "MISSING: $m"; done

package/scripts/verify-phase-trail.test.sh

@@ -16,7 +16,21 @@ trap 'rm -rf "$TMP_BIN" "$TMP_FX"' EXIT
 cat > "$TMP_BIN/gh" <<'MOCK'
 #!/usr/bin/env bash
 if [ "${MOCK_GH_FAIL:-}" = "1" ]; then echo "mock gh: outage" >&2; exit 1; fi
-cat "$MOCK_GH_JSON"
+# Route by endpoint (#3152): unknown endpoints fail, so a test can never pass by accident on the wrong fixture.
+for a in "$@"; do
+  case "$a" in
+    repos/*/issues/*/comments) cat "$MOCK_GH_JSON"; exit 0 ;;
+    user) [ -n "${MOCK_SELF_LOGIN:-}" ] && { echo "$MOCK_SELF_LOGIN"; exit 0; }; exit 1 ;;
+    repos/*/collaborators/*/permission)
+      [ "${MOCK_PERM_FAIL:-}" = "1" ] && { echo "mock gh: permission api error" >&2; exit 1; }
+      u="${a#repos/*/collaborators/}"; u="${u%/permission}"
+      [ -n "${MOCK_PERM_LOG:-}" ] && echo "$u" >> "$MOCK_PERM_LOG"
+      f="${MOCK_PERM_DIR:-/nonexistent}/$u"
+      [ -f "$f" ] && { cat "$f"; exit 0; }
+      echo "mock gh: 404" >&2; exit 1 ;;
+  esac
+done
+echo "mock gh: unexpected endpoint: $*" >&2; exit 1
 MOCK
 chmod +x "$TMP_BIN/gh"
 export PATH="$TMP_BIN:$PATH"
@@ -273,6 +287,9 @@ OUT=$(MOCK_GH_JSON="$UT" bash "$VERIFY" 3061 -R o/r 2>/dev/null); RC=$?
 [ $RC -eq 1 ] && echo "$OUT" | grep -q 'MISSING: INVESTIGATOR' && echo "$OUT" | grep -q 'NOTE: .*untrusted authors were ignored' && ok "CONTRIBUTOR markers ignored with NOTE" || bad "contributor note (rc=$RC out=$OUT)"
 OUT=$(FORGE_TRAIL_TRUSTED_LOGINS=ext MOCK_GH_JSON="$UT" bash "$VERIFY" 3061 -R o/r 2>/dev/null); RC=$?
 [ $RC -eq 0 ] && ok "FORGE_TRAIL_TRUSTED_LOGINS accepts a CONTRIBUTOR login" || bad "trusted login override (rc=$RC out=$OUT)"
+# forge#3350: widening only the override list must not make CONTRIBUTOR trail markers count
+OUT=$(FORGE_TRAIL_OVERRIDE_ASSOCIATIONS="OWNER,MEMBER,COLLABORATOR,CONTRIBUTOR" MOCK_GH_JSON="$UT" bash "$VERIFY" 3061 -R o/r 2>/dev/null); RC=$?
+[ $RC -eq 1 ] && echo "$OUT" | grep -q 'MISSING: INVESTIGATOR' && ok "override list widened only: CONTRIBUTOR trail markers still ignored (#3350)" || bad "override-only widen trail (rc=$RC out=$OUT)"
 expect_pass "marker-only CONTEXT satisfies STANDARD" "$(mk minctx INV FP_STANDARD CONTRACT CONTEXT ARCH QG_PASS)"
 
 # -h is bounded by the END-HELP sentinel, not a hardcoded line range (#3147)
@@ -294,5 +311,198 @@ OUT=$("${TMO[@]}" bash "$VERIFY" 5 -R 2>/dev/null); RC=$?
 OUT=$(bash "$VERIFY" 2>/dev/null); RC=$?
 [ $RC -eq 2 ] && ok "no args is a usage error" || bad "usage error (rc=$RC)"
 
+# --- Break-glass override (#3152) ---
+HS=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa; HS2=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
+PERM="$TMP_FX/perm"; mkdir -p "$PERM"
+echo '{"permission":"write"}' > "$PERM/alice"; echo '{"permission":"admin"}' > "$PERM/carol"
+echo '{"permission":"read"}' > "$PERM/reader"; echo '{"permission":"write"}' > "$PERM/pipeuser"
+echo '{"permission":"write"}' > "$PERM/builduser"
+export MOCK_PERM_DIR="$PERM"
+BT=2026-10-08T01:00:00Z; AFTER=2026-10-08T02:00:00Z; BEFORE=2026-10-08T00:30:00Z
+# Base trail: everything but CONTEXT/ARCHITECT/QUALITY_GATE on a STANDARD band, built (BUILDER:COMPLETE) at $BT by `builduser`.
+ov_base() {
+  jq -nc --arg bt "$BT" '[
+    {body:"<!-- FORGE:INVESTIGATOR -->\n<!-- INVESTIGATION:COMPLETE -->",user:{login:"builduser",type:"User"},author_association:"OWNER"},
+    {body:"<!-- FORGE:FAST_PATH -->\n**COMPLEXITY_BAND**: STANDARD",user:{login:"builduser",type:"User"},author_association:"OWNER"},
+    {body:"<!-- FORGE:CONTRACT -->\nc",user:{login:"builduser",type:"User"},author_association:"OWNER"},
+    {body:"<!-- FORGE:BUILDER -->\nx\n<!-- FORGE:BUILDER:COMPLETE -->",created_at:$bt,updated_at:$bt,user:{login:"builduser",type:"User"},author_association:"OWNER"}]'
+}
+CUR_MISSING='ARCHITECT,CONTEXT,QUALITY_GATE'
+# ovc <login> <type> <created> <updated> <head> <missing> <reason> -> one override comment (JSON)
+ovc() {
+  jq -nc --arg l "$1" --arg t "$2" --arg c "$3" --arg u "$4" --arg h "$5" --arg m "$6" --arg r "$7" \
+    '{body:("<!-- FORGE:PHASE_TRAIL_OVERRIDE -->\n**Head**: "+$h+"\n**Missing**: "+$m+"\n**Reason**: "+$r),created_at:$c,updated_at:$u,author_association:"OWNER",user:{login:$l,type:$t}}'
+}
+ovf() { # ovf <name> <override comment json...> -> fixture = base trail + comments
+  local out="$TMP_FX/$1.json"; shift
+  { ov_base | jq -c '.[]'; for c in "$@"; do echo "$c"; done; } | jq -sc '.' > "$out"; echo "$out"
+}
+GOODC() { ovc alice User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "gate misfire, verified by hand"; }
+orun() { OUT=$(MOCK_GH_JSON="$1" bash "$VERIFY" 3061 -R o/r --head-sha "$HS" "${@:2}" 2>/dev/null); RC=$?; }
+expect_override() { orun "$2" "${@:3}"; [ $RC -eq 0 ] && echo "$OUT" | grep -q 'PHASE_TRAIL: OVERRIDDEN' && echo "$OUT" | grep -q '^OVERRIDE: approver=' && ok "$1" || bad "$1 (rc=$RC out=$OUT)"; }
+expect_blocked() { orun "$2" "${@:3}"; [ $RC -eq 1 ] && echo "$OUT" | grep -q 'PHASE_TRAIL: FAIL' && ! echo "$OUT" | grep -q 'OVERRIDDEN' && ok "$1" || bad "$1 (rc=$RC out=$OUT)"; }
+
+expect_blocked "no override comment stays blocked" "$(ovf o0)"
+expect_override "valid human override is accepted" "$(ovf o1 "$(GOODC)")"
+orun "$(ovf o1b "$(GOODC)")"
+echo "$OUT" | grep -q "^OVERRIDE: approver=alice head=$HS missing=$CUR_MISSING reason=gate misfire, verified by hand$" && ok "OVERRIDE line carries approver, head, missing set and reason" || bad "OVERRIDE line ($OUT)"
+echo "$OUT" | grep -q '^MISSING:' && bad "accepted override must not emit MISSING lines" || ok "accepted override emits no MISSING lines"
+expect_override "admin permission is accepted" "$(ovf o2 "$(ovc carol User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "ok")")"
+expect_override "uppercase head and shuffled/spaced missing list still bind to the same set" \
+  "$(ovf o3 "$(ovc alice User "$AFTER" "$AFTER" "$(echo $HS | tr a-f A-F)" "QUALITY_GATE , ARCHITECT,CONTEXT -> x" "ok")")"
+expect_override "a later valid override wins over an earlier rejected one" \
+  "$(ovf o4 "$(ovc reader User "$BEFORE" "$BEFORE" "$HS" "$CUR_MISSING" "old")" "$(GOODC)")"
+
+# One test per rejection rule
+expect_blocked "rejects: Bot author" "$(ovf r1 "$(ovc alice Bot "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "r")")"
+expect_blocked "rejects: null user" "$(ovf r2 "$(GOODC | jq -c '.user=null')")"
+expect_blocked "rejects: missing user.type" "$(ovf r3 "$(GOODC | jq -c 'del(.user.type)')")"
+expect_blocked "rejects: edited comment (updated_at != created_at)" "$(ovf r4 "$(ovc alice User "$AFTER" "2026-10-08T03:00:00Z" "$HS" "$CUR_MISSING" "r")")"
+expect_blocked "rejects: missing timestamps" "$(ovf r5 "$(GOODC | jq -c 'del(.updated_at)')")"
+expect_blocked "rejects: read-only collaborator" "$(ovf r6 "$(ovc reader User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "r")")"
+expect_blocked "rejects: author with no permission record" "$(ovf r7 "$(ovc stranger User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "r")")"
+orun "$(ovf r8 "$(GOODC)")"; OUT=$(MOCK_PERM_FAIL=1 MOCK_GH_JSON="$TMP_FX/r8.json" bash "$VERIFY" 3061 -R o/r --head-sha "$HS" 2>/dev/null); RC=$?
+[ $RC -eq 1 ] && ! echo "$OUT" | grep -q OVERRIDDEN && ok "rejects: permission API error fails closed (exit 1)" || bad "permission api error (rc=$RC out=$OUT)"
+expect_blocked "rejects: wrong head sha" "$(ovf r9 "$(ovc alice User "$AFTER" "$AFTER" "$HS2" "$CUR_MISSING" "r")")"
+expect_blocked "rejects: truncated head sha" "$(ovf r10 "$(ovc alice User "$AFTER" "$AFTER" "${HS:0:12}" "$CUR_MISSING" "r")")"
+expect_blocked "rejects: override for a different MISSING set" "$(ovf r11 "$(ovc alice User "$AFTER" "$AFTER" "$HS" "ARCHITECT,CONTEXT" "r")")"
+expect_blocked "rejects: override for a superset of MISSING" "$(ovf r12 "$(ovc alice User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING,CONTRACT" "r")")"
+expect_blocked "rejects: posted before BUILDER:COMPLETE" "$(ovf r13 "$(ovc alice User "$BEFORE" "$BEFORE" "$HS" "$CUR_MISSING" "r")")"
+expect_blocked "rejects: posted exactly at BUILDER:COMPLETE time" "$(ovf r14 "$(ovc alice User "$BT" "$BT" "$HS" "$CUR_MISSING" "r")")"
+expect_blocked "rejects: empty reason" "$(ovf r15 "$(ovc alice User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "   ")")"
+expect_blocked "rejects: reason that is only control characters" "$(ovf r16 "$(ovc alice User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" $'\x1b\x07')")"
+expect_blocked "rejects: login with path characters (no API path injection)" "$(ovf r17 "$(ovc 'alice/../x' User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "r")")"
+# Pipeline identity: configured login, and derived (author of the pipeline's own FORGE markers)
+FORGE_TRAIL_PIPELINE_LOGINS="Alice" expect_blocked "rejects: configured pipeline login (case-insensitive)" "$(ovf p1 "$(GOODC)")"
+FORGE_TRAIL_PIPELINE_LOGINS="x, alice ,y" expect_blocked "rejects: configured pipeline login in a list" "$(ovf p2 "$(GOODC)")"
+expect_blocked "rejects: derived pipeline identity (author of FORGE:BUILDER/INVESTIGATOR/CONTRACT)" "$(ovf p3 "$(ovc builduser User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "self approve")")"
+expect_blocked "rejects: derived pipeline identity matches case-insensitively" "$(ovf p4 "$(ovc BuildUser User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "self approve")")"
+# A pipeline App identity that posts markers is also excluded even if typed User in the override
+PIPE_C=$(jq -nc '{body:"<!-- FORGE:QUALITY_GATE -->\n**Result**: FAIL",user:{login:"pipeuser",type:"User"},author_association:"OWNER"}')
+expect_blocked "rejects: author of any trusted FORGE marker (QUALITY_GATE) is pipeline" "$(ovf p5 "$PIPE_C" "$(ovc pipeuser User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "r")")"
+# Override cannot be evaluated without --head-sha
+OUT=$(MOCK_GH_JSON="$(ovf n1 "$(GOODC)")" bash "$VERIFY" 3061 -R o/r 2>/dev/null); RC=$?
+[ $RC -eq 1 ] && ! echo "$OUT" | grep -q OVERRIDDEN && ok "rejects: no --head-sha means the override is never evaluated" || bad "no head-sha (rc=$RC out=$OUT)"
+for bs in "" "xyz" "${HS}0"; do
+  OUT=$(MOCK_GH_JSON="$(ovf n2 "$(GOODC)")" bash "$VERIFY" 3061 -R o/r --head-sha "$bs" 2>/dev/null); RC=$?
+  [ $RC -eq 2 ] && echo "$OUT" | grep -q 'PHASE_TRAIL: ERROR' && ok "invalid --head-sha '$bs' fails closed (exit 2)" || bad "head-sha '$bs' (rc=$RC out=$OUT)"
+done
+OUT=$(MOCK_GH_JSON="$TMP_FX/n2.json" bash "$VERIFY" 3061 -R o/r --head-sha 2>/dev/null); RC=$?
+[ $RC -eq 2 ] && ok "--head-sha without a value exits 2" || bad "head-sha no value (rc=$RC)"
+# Exit 2 is never overridable
+OUT=$(MOCK_GH_FAIL=1 MOCK_GH_JSON="$TMP_FX/o1.json" bash "$VERIFY" 3061 -R o/r --head-sha "$HS" 2>/dev/null); RC=$?
+[ $RC -eq 2 ] && ! echo "$OUT" | grep -q OVERRIDDEN && ok "exit 2 (unreadable trail) is not overridable" || bad "exit 2 override (rc=$RC out=$OUT)"
+{ cat "$TMP_FX/o1.json"; echo '{"message":"Server Error"}'; } > "$TMP_FX/o2bad.json"
+OUT=$(MOCK_GH_JSON="$TMP_FX/o2bad.json" bash "$VERIFY" 3061 -R o/r --head-sha "$HS" 2>/dev/null); RC=$?
+[ $RC -eq 2 ] && ! echo "$OUT" | grep -q OVERRIDDEN && ok "exit 2 (malformed page) is not overridable" || bad "exit 2 malformed override (rc=$RC out=$OUT)"
+OUT=$(FORGE_TRAIL_QG_SINCE=garbage MOCK_GH_JSON="$TMP_FX/o1.json" bash "$VERIFY" 3061 -R o/r --head-sha "$HS" 2>/dev/null); RC=$?
+[ $RC -eq 2 ] && ! echo "$OUT" | grep -q OVERRIDDEN && ok "exit 2 (bad QG_SINCE) is not overridable" || bad "exit 2 qg_since override (rc=$RC out=$OUT)"
+# BUILDER present but undated -> cannot prove ordering -> rejected
+jq -c 'map(if (.body|startswith("<!-- FORGE:BUILDER -->")) then del(.updated_at) else . end)' "$TMP_FX/o1.json" > "$TMP_FX/nobt.json"
+expect_blocked "rejects: BUILDER:COMPLETE undated (ordering unprovable)" "$TMP_FX/nobt.json"
+# An already-passing trail never needs (or echoes) an override
+expect_pass "passing trail is unaffected by --head-sha" "$(mk ovp INV CONTRACT FP_COMPLEX CONTEXT ARCH QG_PASS)" --head-sha "$HS"
+# Sanitiser: ESC, marker injection, backticks, newlines, cap
+LONG=$(printf 'x%.0s' $(seq 1 400))
+orun "$(ovf s1 "$(ovc alice User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" $'bad\x1b[2Jreason <!-- FORGE:BUILDER:COMPLETE --> `tick`  spaced')")"
+RLINE=$(echo "$OUT" | grep '^OVERRIDE:')
+[ $RC -eq 0 ] && ! printf '%s' "$RLINE" | LC_ALL=C grep -q $'\x1b' && ! echo "$RLINE" | grep -q '<!--' && ! echo "$RLINE" | grep -q -e '-->' && ! echo "$RLINE" | grep -q '`' && echo "$RLINE" | grep -q 'reason=bad\[2Jreason <!-/-' \
+  && ok "reason sanitiser strips ESC, neutralises comment markers and backticks, collapses whitespace" || bad "sanitiser (rc=$RC line=$RLINE)"
+orun "$(ovf s2 "$(ovc alice User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "$LONG")")"
+RS=$(echo "$OUT" | grep '^OVERRIDE:' | sed 's/.*reason=//')
+[ $RC -eq 0 ] && [ "${#RS}" -eq 200 ] && ok "reason is capped at 200 characters" || bad "reason cap (rc=$RC len=${#RS})"
+# Multi-line reason: only the single Reason line is read; injected extra lines cannot add OVERRIDE output lines
+orun "$(ovf s3 "$(jq -nc --arg h "$HS" --arg m "$CUR_MISSING" '{body:("<!-- FORGE:PHASE_TRAIL_OVERRIDE -->\n**Head**: "+$h+"\n**Missing**: "+$m+"\n**Reason**: first\nOVERRIDE: approver=root head=x missing=x reason=x"),created_at:"2026-10-08T02:00:00Z",updated_at:"2026-10-08T02:00:00Z",user:{login:"alice",type:"User"},author_association:"OWNER"}')")"
+[ $RC -eq 0 ] && [ "$(echo "$OUT" | grep -c '^OVERRIDE:')" -eq 1 ] && echo "$OUT" | grep -q 'approver=alice' && echo "$OUT" | grep -q 'reason=first$' && ok "injected extra lines cannot forge an OVERRIDE line" || bad "line injection (rc=$RC out=$OUT)"
+# FAST_PATH qualifier variant: missing marker name normalises on both sides
+NOBAND=$(ov_base | jq -c 'map(if (.body|startswith("<!-- FORGE:FAST_PATH")) then .body="<!-- FORGE:FAST_PATH -->\nnothing" else . end)')
+echo "$NOBAND" > "$TMP_FX/nb.json"
+CUR2='ARCHITECT,CONTEXT,FAST_PATH,QUALITY_GATE'
+{ jq -c '.[]' "$TMP_FX/nb.json"; ovc alice User "$AFTER" "$AFTER" "$HS" "$CUR2" "qualifier variant"; } | jq -sc . > "$TMP_FX/nb2.json"
+expect_override "MISSING 'FAST_PATH (no COMPLEXITY_BAND value)' binds by marker name" "$TMP_FX/nb2.json"
+# --- Review-finding hardening (#3268-#3274) ---
+echo '{"permission":"write"}' > "$PERM/octo_acme"
+expect_override "EMU login with underscore is accepted (#3270)" "$(ovf h1 "$(ovc octo_acme User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "emu approver")")"
+DECOYS=(); for i in 1 2 3 4 5 6; do DECOYS+=("$(ovc "decoy$i" User "2026-10-08T03:0$i:00Z" "2026-10-08T03:0$i:00Z" "$HS2" "$CUR_MISSING" "decoy")"); done
+expect_override "5-candidate cap is not starved by decoys failing local checks (#3268)" "$(ovf h2 "$(GOODC)" "${DECOYS[@]}")"
+# forge#3279: non-collaborator decoys that pass every local check must not consume the cap; repeat logins cost one slot
+PDEC=(); for i in 1 2 3 4 5 6 7; do PDEC+=("$(ovc "pdecoy$i" User "2026-10-08T04:0$i:00Z" "2026-10-08T04:0$i:00Z" "$HS" "$CUR_MISSING" "decoy" | jq -c '.author_association="NONE"')"); done
+expect_override "non-collaborator decoy flood (newer, all-local-checks-passing) does not starve a real override (#3279)" "$(ovf h5 "$(GOODC)" "${PDEC[@]}")"
+echo '{"permission":"read"}' > "$PERM/rdr1"
+RDEC=(); for i in 1 2 3 4 5 6; do RDEC+=("$(ovc rdr1 User "2026-10-08T05:0$i:00Z" "2026-10-08T05:0$i:00Z" "$HS" "$CUR_MISSING" "same login repeated")"); done
+expect_override "one login repeated many times costs a single cap slot (#3279)" "$(ovf h6 "$(GOODC)" "${RDEC[@]}")"
+# forge#3306: read-level members (pass the association prefilter) must not consume the cap ahead of an older write approver
+RLV=(); for i in 1 2 3 4 5 6 7; do echo '{"permission":"read"}' > "$PERM/rlv$i"; RLV+=("$(ovc "rlv$i" User "2026-10-08T06:0$i:00Z" "2026-10-08T06:0$i:00Z" "$HS" "$CUR_MISSING" "decoy")"); done
+expect_override "7 distinct read-level members newer than a write approver do not starve it (#3306)" "$(ovf h7 "$(GOODC)" "${RLV[@]}")"
+orun "$(ovf h8 "${RLV[@]}")"
+[ $RC -eq 1 ] && ! echo "$OUT" | grep -q OVERRIDDEN && ok "read-level members only: override rejected (#3306)" || bad "read-level only (rc=$RC out=$OUT)"
+ULV=(); for i in 1 2 3 4 5 6 7; do ULV+=("$(ovc "ulv$i" User "2026-10-08T07:0$i:00Z" "2026-10-08T07:0$i:00Z" "$HS" "$CUR_MISSING" "unreadable")"); done
+expect_blocked "unreadable lookups stay bounded by the error cap and fail closed (#3306)" "$(ovf h9 "$(GOODC)" "${ULV[@]}")"
+# forge#3307: association prefilter reuses the configured list; each association value is pinned
+echo '{"permission":"write"}' > "$PERM/memb"; echo '{"permission":"write"}' > "$PERM/collab"; echo '{"permission":"write"}' > "$PERM/concealed"
+assoc() { jq -c --arg a "$1" '.author_association=$a'; }
+expect_override "MEMBER write approver is accepted (#3307)" "$(ovf a1 "$(ovc memb User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "r" | assoc MEMBER)")"
+expect_override "COLLABORATOR write approver is accepted (#3307)" "$(ovf a2 "$(ovc collab User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "r" | assoc COLLABORATOR)")"
+CDEC=(); for i in 1 2 3 4 5 6 7; do CDEC+=("$(ovc "cdecoy$i" User "2026-10-08T08:0$i:00Z" "2026-10-08T08:0$i:00Z" "$HS" "$CUR_MISSING" "decoy" | assoc CONTRIBUTOR)"); done
+expect_override "CONTRIBUTOR decoy flood does not starve a real override (#3307)" "$(ovf a3 "$(GOODC)" "${CDEC[@]}")"
+CONC=$(ovc concealed User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "concealed membership" | assoc CONTRIBUTOR)
+expect_blocked "CONTRIBUTOR write approver is rejected under the default list (#3307)" "$(ovf a4 "$CONC")"
+FORGE_TRAIL_OVERRIDE_ASSOCIATIONS="OWNER,MEMBER,COLLABORATOR,CONTRIBUTOR" expect_override "widened override list accepts a CONTRIBUTOR write approver (#3307, #3350)" "$(ovf a4 "$CONC")"
+FORGE_TRAIL_TRUSTED_ASSOCIATIONS="OWNER,MEMBER,COLLABORATOR,CONTRIBUTOR" expect_override "trail list widened still widens override by default inheritance (#3350)" "$(ovf a4i "$CONC")"
+FORGE_TRAIL_OVERRIDE_ASSOCIATIONS="" expect_blocked "empty override list yields no candidates with default trail list (#3350)" "$(ovf a4e "$(GOODC)")"
+FORGE_TRAIL_TRUSTED_ASSOCIATIONS="OWNER" expect_blocked "narrowed list rejects a MEMBER approver (#3307)" "$(ovf a5 "$(ovc memb User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "r" | assoc MEMBER)")"
+FORGE_TRAIL_TRUSTED_ASSOCIATIONS="" expect_blocked "empty list yields no override candidates (fail closed) (#3307)" "$(ovf a6 "$(GOODC)")"
+# Case-variant duplicate logins cost one lookup / one slot
+echo '{"permission":"read"}' > "$PERM/cvx"
+CVV=(); i=0; for l in Cvx cvx CVX cvX Cvx CVx; do i=$((i+1)); CVV+=("$(ovc "$l" User "2026-10-08T09:0$i:00Z" "2026-10-08T09:0$i:00Z" "$HS" "$CUR_MISSING" "dup")"); done
+PL="$TMP_FX/permlog-cv"; : > "$PL"
+OUT=$(MOCK_PERM_LOG="$PL" MOCK_GH_JSON="$(ovf a7 "$(GOODC)" "${CVV[@]}")" bash "$VERIFY" 3061 -R o/r --head-sha "$HS" 2>/dev/null); RC=$?
+[ $RC -eq 0 ] && echo "$OUT" | grep -q OVERRIDDEN && [ "$(grep -ic '^cvx$' "$PL")" -eq 1 ] && ok "case-variant duplicate logins cost a single lookup (#3307)" || bad "case-variant dup (rc=$RC lookups=$(grep -ic '^cvx$' "$PL"))"
+# Decoys (NONE/CONTRIBUTOR) never reach the permission API; the NOTE reports the filtered count without logins
+MIXD=("${PDEC[@]}" "${CDEC[@]}")
+PL="$TMP_FX/permlog-decoy"; : > "$PL"
+ERR=$(MOCK_PERM_LOG="$PL" MOCK_GH_JSON="$(ovf a8 "${MIXD[@]}")" bash "$VERIFY" 3061 -R o/r --head-sha "$HS" 2>&1 >/dev/null); 
+[ ! -s "$PL" ] && echo "$ERR" | grep -q 'NOTE: 14 override candidate(s) ignored: author_association not in override-approver set' && ! echo "$ERR" | grep -q 'pdecoy\|cdecoy' \
+  && ok "decoys trigger no permission lookups; NOTE carries the count and no logins (#3307)" || bad "decoy no-call (log=$(cat "$PL") err=$ERR)"
+# forge#3351: the NOTE count shares one predicate with the candidates: only otherwise-eligible, association-excluded
+# comments are counted (edited, bot, and pre-floor ones are not)
+EXC=$(ovc xedit User "2026-10-08T11:01:00Z" "2026-10-08T11:02:00Z" "$HS" "$CUR_MISSING" "edited" | assoc NONE)
+EXB=$(ovc xbot Bot "2026-10-08T11:03:00Z" "2026-10-08T11:03:00Z" "$HS" "$CUR_MISSING" "bot" | assoc NONE)
+EXP=$(ovc xold User "2000-01-01T00:00:00Z" "2000-01-01T00:00:00Z" "$HS" "$CUR_MISSING" "pre-floor" | assoc NONE)
+EX1=$(ovc xok1 User "2026-10-08T11:04:00Z" "2026-10-08T11:04:00Z" "$HS" "$CUR_MISSING" "dropped" | assoc NONE)
+EX2=$(ovc xok2 User "2026-10-08T11:05:00Z" "2026-10-08T11:05:00Z" "$HS" "$CUR_MISSING" "dropped" | assoc CONTRIBUTOR)
+ERR=$(MOCK_GH_JSON="$(ovf a10 "$(GOODC)" "$EXC" "$EXB" "$EXP" "$EX1" "$EX2")" bash "$VERIFY" 3061 -R o/r --head-sha "$HS" 2>&1 >/dev/null)
+echo "$ERR" | grep -q 'NOTE: 2 override candidate(s) ignored: author_association not in override-approver set' \
+  && ok "NOTE count equals only eligible association-excluded candidates (#3351)" || bad "NOTE count shared predicate (err=$ERR)"
+# 6th distinct unreadable login is cut off: the cap stops the scan before an older real approver
+UNR=(); for i in 1 2 3 4 5 6 7 8; do UNR+=("$(ovc "unr$i" User "2026-10-08T10:0$i:00Z" "2026-10-08T10:0$i:00Z" "$HS" "$CUR_MISSING" "unreadable")"); done
+PL="$TMP_FX/permlog-unr"; : > "$PL"
+OUT=$(MOCK_PERM_LOG="$PL" MOCK_GH_JSON="$(ovf a9 "$(GOODC)" "${UNR[@]}")" bash "$VERIFY" 3061 -R o/r --head-sha "$HS" 2>/dev/null); RC=$?
+[ $RC -eq 1 ] && ! echo "$OUT" | grep -q OVERRIDDEN && [ "$(wc -l < "$PL" | tr -d ' ')" -eq 6 ] && ! grep -qx alice "$PL" && ok "unreadable lookups stop at the 6th login; older approver never queried (#3307)" || bad "unreadable cutoff (rc=$RC lookups=$(wc -l < "$PL"))"
+MOCK_SELF_LOGIN=alice orun "$(ovf h3 "$(GOODC)")"
+[ $RC -eq 1 ] && ! echo "$OUT" | grep -q OVERRIDDEN && ok "verifier's own login cannot approve an override (#3269)" || bad "self-login exclusion (rc=$RC out=$OUT)"
+MOCK_SELF_LOGIN=someoneelse orun "$(ovf h3b "$(GOODC)")"
+[ $RC -eq 0 ] && echo "$OUT" | grep -q OVERRIDDEN && ok "an unrelated self-login does not block a valid override (#3269)" || bad "self-login unrelated (rc=$RC out=$OUT)"
+orun "$(ovf h4 "$(ovc alice User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" $'ping @octocat\u2028next\u2029line')")"
+RS=$(echo "$OUT" | grep '^OVERRIDE:' | sed 's/.*reason=//')
+[ $RC -eq 0 ] && ! printf '%s' "$RS" | grep -q '@' && ! printf '%s' "$RS" | grep -q $'\xe2\x80\xa8' && ok "reason sanitiser neutralises @mentions and U+2028/2029 (#3274)" || bad "sanitiser unicode (rc=$RC rs=$RS)"
+# No BUILDER at all: floor falls back to the newest trusted FORGE marker (#3271)
+ov_base | jq -c '[.[] | select((.body|startswith("<!-- FORGE:BUILDER -->"))|not)] | map(if (.body|startswith("<!-- FORGE:CONTRACT -->")) then .created_at="2026-10-08T01:30:00Z" else . end)' > "$TMP_FX/nobuilder.json"
+orun "$TMP_FX/nobuilder.json"; NB_OUT="$OUT"
+NB_MISS=$(echo "$NB_OUT" | sed -n 's/^MISSING: //p' | sed -e 's/ -> .*$//' | paste -sd, -)
+if [ -n "$NB_MISS" ]; then
+  { jq -c '.[]' "$TMP_FX/nobuilder.json"; ovc alice User "2026-10-08T01:10:00Z" "2026-10-08T01:10:00Z" "$HS" "$NB_MISS" "older than marker"; } | jq -sc . > "$TMP_FX/nbo1.json"
+  expect_blocked "override older than newest trusted marker is rejected when BUILDER is absent (#3271)" "$TMP_FX/nbo1.json"
+  { jq -c '.[]' "$TMP_FX/nobuilder.json"; ovc alice User "$AFTER" "$AFTER" "$HS" "$NB_MISS" "newer than marker"; } | jq -sc . > "$TMP_FX/nbo2.json"
+  expect_override "override newer than newest trusted marker is accepted when BUILDER is absent (#3271)" "$TMP_FX/nbo2.json"
+else bad "no-BUILDER fixture produced no MISSING set ($NB_OUT)"; fi
+# Rejected permission is explained on stderr (#3272)
+ERRTXT=$(MOCK_GH_JSON="$(ovf h5 "$(ovc reader User "$AFTER" "$AFTER" "$HS" "$CUR_MISSING" "no perm")")" bash "$VERIFY" 3061 -R o/r --head-sha "$HS" 2>&1 >/dev/null)
+echo "$ERRTXT" | grep -q "rejected: permission='read'" && ok "rejected permission prints a diagnostic to stderr (#3272)" || bad "permission diagnostic ($ERRTXT)"
+
+# -h documents the override
+HOUT2=$(bash "$VERIFY" -h)
+echo "$HOUT2" | grep -q 'FORGE_TRAIL_PIPELINE_LOGINS' && echo "$HOUT2" | grep -q -- '--head-sha' && ok "-h documents the override and --head-sha" || bad "-h override docs"
+
 echo "passed=$PASS failed=$FAILN"
 [ "$FAILN" -eq 0 ]