`git merge` of upstream `8c3a4d1` onto `dad99dd`, common ancestor `84bb1a4`.
18 hunks in 10 files; `lib/forge.sh`, `lib/forge-github.sh` and
`lib/forge-forgejo.sh` conflict in none and come out byte-identical.
The resolutions the issue decided: VERSION and both CEREMONY_SELF_REF
carriers take upstream's numbers; `.github/labels.conf` and `drills/0.4.1.md`
keep this forge's; CHANGELOG keeps both sides and names the upstream commit
this tree carries.
The part the hunks did not contain. Upstream's 0.5.0/0.6.0 work added whole
functions to files this tree already owned, so `git merge` took its side
without raising a conflict — and with them, EIGHT runtime `gh` call sites
that #188 had removed. Seven are ported onto the shim: two reads and four
comment writes in issueflow-reconcile, and labels-reconcile's HEAD_COMMIT_AT
read. The eighth is `gh workflow run` in labels.yml, which a workflow cannot
declare a client for and whose Forgejo equivalent this instance answers with
500 rather than a 4xx — named with its reason rather than ported on a guess.
test/no-runtime-gh.test.sh makes the rule mechanical, because reviewing the
diff could not: four reviewers reading it each found a different subset, and
the contract suite stubs `gh`, so a reintroduced call site passes it.
Three seams the resolution decides are silent when resolved wrongly, and each
now has a case that fails on the wrong one: the merged record's `merged_at`
third column (without it every sort key ties and the highest PR number comes
back), the open gather's one-BODY-row-per-line feed (a whole decoded body as
one record loses every declaration including the first), and the whole-board
read whose COLLISION_FLAGS/WINDOW_FLAGS consumers auto-merged.
The open gather carries CLOSING rows as well as BODY rows. `Refs` alone would
drop every `Closes #N` link on the open side and reclaim a claim the PR was
holding — the existing base64 round-trip case is red without it.
actions/refs-not-closing declares CEREMONY_FORGE_CLIENT=gh: its only gather
is GraphQL, which Forgejo does not serve at all. #199 ports it.
test/run.sh: 28 test files, 0 failed. shellcheck and actionlint clean.
Refs #198
Thirty-five fragments assembled into '## 0.6.0 — 2026-08-05'; VERSION to
bare 0.6.0; the three CEREMONY_SELF_REF carriers stamped "0.6.0" in this
one commit; the three docs/CONSUMERS.md availability markers cleared to
name 0.6.0 — refs-not-closing (#218), the RELEASES.md mirror entry (#248)
and the vendored-manifest completeness guarantee (#251).
drills/0.6.0.md opens with the measurement that decides its shape: the
doors-unchanged conditions do NOT all hold at this candidate, because
lib/changelog.sh moved on the release path since the last rehearsed tag
0.4.0. A full disposable-repo rehearsal is owed and is in progress; the
record is committed early and filled from the runs as they happen.
Refs #249.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The section is re-assembled: main's merge base now carries two fragments
(188.md and 191.md), so 0.4.1 publishes with the door port it actually
ships, and neither fragment survives its own release.
drills/0.4.1.md takes main's two-run record, with run 1's disclosures
restored — the scratch repo it used, its candidate ref, and the ~8 minutes
it spent public to read job logs. A later success does not retire a
disclosed deviation.
The three stamps, in one commit as the ceremony requires: VERSION goes
bare, the self-ref pin follows it, and the changelog section is the
assembler's output rather than a hand edit.
0.4.1 is the forge release. Everything in the section comes from #188's
single fragment: ceremony stops being gh-only. `lib/forge.sh` selects a
backend from the runner's own environment, `lib/forge-github.sh` and
`lib/forge-forgejo.sh` implement one call surface twice, and the
reconcilers preflight before they sweep — so a GitHub-shaped client
pointed at a Forgejo instance is a named refusal instead of a sweep that
reads nothing and reports success.
Verified on this instance before stamping: the first post-merge `labels`
run on main (7fc9afe, task 467) came back SUCCESS — the reconciler's
first green run on Forgejo, and the evidence the section's claims are
not merely asserted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Five fragments assembled into '## 0.5.0 — 2026-08-03' (#205#216#221#224#226); VERSION to bare 0.5.0; the three CEREMONY_SELF_REF carriers
stamped "0.5.0" in this one commit; the panel-rows unreleased marker in
docs/CONSUMERS.md cleared to name 0.5.0; drills/0.5.0.md records the
doors-unchanged ruling with the measurements as they are at 0ac3a6f.
Refs #233.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Consume the two displacement-fix fragments into the 0.4.1 section, stamp
VERSION and every CEREMONY_SELF_REF carrier, and record the doors-unchanged
drill ruling with the candidate-head evidence table.
Refs #212
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
One definition in the fragment predicate; changelog-armed reds the PR
that writes the fragment and the assembler refuses at release, both by
inheritance. Doctrine names the number in BUILDER.md and CHANGELOG.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The flip's mechanical half (#117): the 26 entries under '## Unreleased'
move verbatim to changelog.d/<issue>.md, the heading is deleted, the
directory gains its marker README (#112 D1) and this PR's own fragment
(112.md), CHANGELOG.md's preamble describes fragments, and labeler.yml
maps changelog.d/** into scope:release-flow.
The mirror is byte-identical in every governed repo, so the four-row
enumeration was true at home and false in rig, box, cast and incubator —
14 of 16 vendored rows lied. The section keeps its doctrine and points at
the two places true wherever the reader stands; ceremony's own set is now
a pointer sentence in CONTRIBUTING, and a labels.test.sh row (red on main,
4 hits) keeps enumeration from returning.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
test/changelog.test.sh drives changelog_fragments (order, marker, absent
dir), changelog_fragment_problem (every rule, file named each time), and
changelog_assemble (both shapes, canonical order, mixed-shape refusals).
test/changelog-assemble.test.sh drives the CLI against constructed trees:
exact-byte writes, provably read-only --check, every refusal from the
spec, the publisher/assembler round trip, and idempotence.
Closes#114.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The unit block now feeds blind_sweep_warning a sampled reason and asserts
the new lead plus two must-fail guards: the disproven 'grant checks: read
and statuses: read' diagnosis stated as fact goes red, and so does any
drift in the counted line's whole-line shape (exactly the blind PRs match,
no more, no less — a reason line that matched would double-count, a folded
reason would undercount). read_failure_reason is covered pure: D4 wording
for empty stderr, multi-line collapse to one line, 400 chars truncated to
300 plus ellipsis within the 304-byte bound, 300 passing through whole.
blind_main_probe's gh pr view stub now fails with a denial on stderr, the
way real gh fails.
Part of #101.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The slot rule counted work in flight but had no shape for its most common
wait: the round passed, state:needs-human set, the human's merge pending.
Shape 4 names it, the handoff round summary is its declaration, and shape
2 now covers the round awaiting its first verdicts so the live and passed
rounds are sequential and non-overlapping (#109).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Registry-vs-LABELS.md identity, happy path, missing label, one-name 403,
DRY_RUN narration, and the executed-subprocess dispatch (#91's lesson: a
sourced probe cannot see set -e). Cron and pull_request_target delete
nothing. Verified red without the guard: the unguarded dispatch dies on
the FIRST absent label, one delete of six attempted.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
reconcile_opened_issue's two early exits were bare returns, which carry
the failed guard's status into the executed script's set -e — every
triage-authored mint killed the labels run before one issue was
reconciled (#91, 4/4 observed). The stand-downs now say return 0; a
genuine failure on the arrival path still aborts loudly.
The suite sources the script and takes the set -u-only branch, so it
was blind to this by construction. The new arrival section executes the
script as a subprocess behind a fixture-serving gh stub (the house
pattern from test/release-chain.test.sh) and covers all three arrival
outcomes plus the preserved loud-failure path; it fails against
bb37c15 with the production signature — exit 1, empty output.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The shared, role-independent wake — an open issue assigned to me
carrying attention — stated once above the per-role lists, first in
priority, one acked session per demand, with the rejected mention-poll
and the #16 incident recorded and the on-paper caveat kept (#86).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The one-issue-at-a-time bullet counted claims when it meant build work
in flight; the 2026-07-23 board (#15, #16 parked beside #73) proved the
count wrong. BUILDER.md now defines the three parked shapes, the
declared-never-inferred park comment, and unparking; TRIAGE.md names a
directed hold as a park (#77).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
FLEET.md's wake conditions gain #50 D16: notify.sh's second query (open
issues and PRs labelled needs-ruling), one tracked message per item edited
in place across the ladder's four rungs and removed on clearance, the
message's contents, triage's past-24h pickup, and the on-paper caveat.
Nothing box-side sets, clears or decides the flag.
Part of #50. Closes#74.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
lib/ruling.sh gains the mechanical half of #50 D12-D15: the comment body
rides the fetch as base64 (rows stay line-oriented), ruling_shape_decision
checks the four line-anchored bold-tolerant field labels,
ruling_deadline_decision derives the rung from the labeled epoch,
ruling_default_decision parses the Default: line for wording only, and
reconcile_ruling wires them with bare-stops-here exclusion — every write a
comment, one per marker per episode, both surfaces via the shared lib.
Part of #73.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
LABELS.md's needs-ruling paragraph gains the bare-flag check and the
markerless 7-day nudge; CONSUMERS.md names them in the labels job and
states the caller stub is unchanged since #18 (a pin bump is the whole
upgrade); one CHANGELOG line under Unreleased (#52).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The ceremony PR — two edits, per the amended #11: VERSION 0.1.0-dev -> 0.1.0,
and the changelog stamp with the re-arm in the same edit (## Unreleased ->
## 0.1.0 — 2026-07-22, an empty ## Unreleased put back on top — box#108).
No third stamp: both CEREMONY_SELF_REF carriers already read "0.1.0", and
self-ref-check's bare-tree rule wants exactly that. drills/0.1.0.md follows
once the rehearsal runs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
VERSION at 0.1.0-dev, the armed CHANGELOG.md, drills/README.md (what a
drill means here), the self-callers (self-release.yml, self-labels.yml —
local uses:, the one form consumers must never copy), .github/labeler.yml
for the scope job, and the three self-guards in CI. labels.yml gains the
self-consumption bypass (release.yml's twin) so the label bootstrap can run
before any release tag exists; action-exercise's armed/drill-recorded
scratch steps move to self-guards per their own eviction note.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
