`git merge` of upstream `8c3a4d1` onto `dad99dd`, common ancestor `84bb1a4`.
18 hunks in 10 files; `lib/forge.sh`, `lib/forge-github.sh` and
`lib/forge-forgejo.sh` conflict in none and come out byte-identical.
The resolutions the issue decided: VERSION and both CEREMONY_SELF_REF
carriers take upstream's numbers; `.github/labels.conf` and `drills/0.4.1.md`
keep this forge's; CHANGELOG keeps both sides and names the upstream commit
this tree carries.
The part the hunks did not contain. Upstream's 0.5.0/0.6.0 work added whole
functions to files this tree already owned, so `git merge` took its side
without raising a conflict — and with them, EIGHT runtime `gh` call sites
that #188 had removed. Seven are ported onto the shim: two reads and four
comment writes in issueflow-reconcile, and labels-reconcile's HEAD_COMMIT_AT
read. The eighth is `gh workflow run` in labels.yml, which a workflow cannot
declare a client for and whose Forgejo equivalent this instance answers with
500 rather than a 4xx — named with its reason rather than ported on a guess.
test/no-runtime-gh.test.sh makes the rule mechanical, because reviewing the
diff could not: four reviewers reading it each found a different subset, and
the contract suite stubs `gh`, so a reintroduced call site passes it.
Three seams the resolution decides are silent when resolved wrongly, and each
now has a case that fails on the wrong one: the merged record's `merged_at`
third column (without it every sort key ties and the highest PR number comes
back), the open gather's one-BODY-row-per-line feed (a whole decoded body as
one record loses every declaration including the first), and the whole-board
read whose COLLISION_FLAGS/WINDOW_FLAGS consumers auto-merged.
The open gather carries CLOSING rows as well as BODY rows. `Refs` alone would
drop every `Closes #N` link on the open side and reclaim a claim the PR was
holding — the existing base64 round-trip case is red without it.
actions/refs-not-closing declares CEREMONY_FORGE_CLIENT=gh: its only gather
is GraphQL, which Forgejo does not serve at all. #199 ports it.
test/run.sh: 28 test files, 0 failed. shellcheck and actionlint clean.
Refs #198
Thirty-five fragments assembled into '## 0.6.0 — 2026-08-05'; VERSION to
bare 0.6.0; the three CEREMONY_SELF_REF carriers stamped "0.6.0" in this
one commit; the three docs/CONSUMERS.md availability markers cleared to
name 0.6.0 — refs-not-closing (#218), the RELEASES.md mirror entry (#248)
and the vendored-manifest completeness guarantee (#251).
drills/0.6.0.md opens with the measurement that decides its shape: the
doors-unchanged conditions do NOT all hold at this candidate, because
lib/changelog.sh moved on the release path since the last rehearsed tag
0.4.0. A full disposable-repo rehearsal is owed and is in progress; the
record is committed early and filled from the runs as they happen.
Refs #249.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The section is re-assembled: main's merge base now carries two fragments
(188.md and 191.md), so 0.4.1 publishes with the door port it actually
ships, and neither fragment survives its own release.
drills/0.4.1.md takes main's two-run record, with run 1's disclosures
restored — the scratch repo it used, its candidate ref, and the ~8 minutes
it spent public to read job logs. A later success does not retire a
disclosed deviation.
Codex (!194#1588) is right on the text: #191's criterion is a drill that
runs all six probes with 1 and 5 passing, not two probes passing and four
recorded. Probe 2 (mislabeled ordinary PR) and probe 4 (a re-run of the
completed ceremony) were run on the same consumer, un-archived for them and
archived again after.
Probe 4 diverges in mechanism because Forgejo 8.0.3 has no run-rerun API:
the ceremony was re-run by reproducing its input rather than replaying the
run. The record says so, and says which assert refused.
#191's last acceptance criterion was a live drill against the MERGED tree,
not the candidate. Run against `fda5657`:
probe 1 merge door one release 0.4.1, changelog body, main re-armed
to 0.4.2-dev, both assets uploaded
probe 3 no label refused, nothing created
probe 5 tag door 0.5.0 published, main VERSION untouched
probe 6 bad tag refused, nothing created
The fixture carried an artifact hook this time, dropping `drill asset.tgz`
and `a&b.tgz`. Both survived under those exact names — the encoding fix
proven end to end, in the place it would have failed: after the tag exists,
mid-publish.
The record keeps run 1 (the failure at 9a229ee) beside run 2, because the
failure is why #191 exists and a record that quietly replaced it would be
the kind of tidy history this repo refuses.
Refs #191
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The drill ran and FAILED, and the record says so. Merge door: lib/facts.sh
reads the release label with `gh api`, the runner image has no gh, the fact
comes back "no", and decide fail-closes on a wrong fact — reproduced twice.
Tag door: clears every gate the merge door fails, then dies at
`gh release create`.
Release count in the scratch repo at the end: 0. Every refusal created
nothing, which is the property the drill exists to check.
drill-recorded wants a record, not a passing result — this is the honest
one, and it says 0.4.1 cannot publish from this instance until facts.sh and
the publish call sites are ported off gh.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The #226 delta sits behind reconcile_ruling's needs-ruling gate and this
board has no such item — the post-merge sweeps ran the file, never the
delta. The record now says what was observed and why the live claim is
unreachable (round 1, claude).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Five fragments assembled into '## 0.5.0 — 2026-08-03' (#205#216#221#224#226); VERSION to bare 0.5.0; the three CEREMONY_SELF_REF carriers
stamped "0.5.0" in this one commit; the panel-rows unreleased marker in
docs/CONSUMERS.md cleared to name 0.5.0; drills/0.5.0.md records the
doors-unchanged ruling with the measurements as they are at 0ac3a6f.
Refs #233.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Consume the two displacement-fix fragments into the 0.4.1 section, stamp
VERSION and every CEREMONY_SELF_REF carrier, and record the doors-unchanged
drill ruling with the candidate-head evidence table.
Refs #212
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Both 0.2.0 drills ended at the same wall independently: bot tokens
deliberately lack delete_repo, so 'it gets deleted at the end' named a
step no builder in this fleet can perform. One drill held its release
draft in state:building retrying a 403 that cannot succeed; the other
shipped a record asserting a delete that had not happened. Step 1 now
names archive (archived:true, inside the repo scope) as the builder's
end state and the delete as the operator's, states that cleanup gates
nothing, and says why the archived leftover is safe to leave. The
record now states the disposal its author actually observed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bootstrap arms with a preamble plus changelog.d/, the guard list gains
changelog-assembled, the conversion checklist gains the fragment
conversion, the changelog rule is fragment-first with the legacy floor
kept for unconverted pins, and the assembly command block gives a reader
everything needed to produce a section (#112 D12, #117).
drills/0.1.0.md — six probes plus (g), run on the disposable scratch repo
against the candidate SHA, every refusal checked for droppings; the pin
deviation (fork ref, CEREMONY_SELF_REF -> candidate SHA in both carriers)
recorded under its own heading per triage's ruling on #11. drills/README.md
gains the first-release caveat that ruling asked for: the first drill can
never take the pure pinned consumer path, and must not fix that by putting
a tag-shaped branch in the canonical ref namespace.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
VERSION at 0.1.0-dev, the armed CHANGELOG.md, drills/README.md (what a
drill means here), the self-callers (self-release.yml, self-labels.yml —
local uses:, the one form consumers must never copy), .github/labeler.yml
for the scope job, and the three self-guards in CI. labels.yml gains the
self-consumption bypass (release.yml's twin) so the label bootstrap can run
before any release tag exists; action-exercise's armed/drill-recorded
scratch steps move to self-guards per their own eviction note.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
