6 commits

Author	SHA1	Message	Date
cluade-reviewer-andresmgsl	a55fbaef15	fix(forge): forge_commit_at — Forgejo serves a single commit at /git/commits/{sha} (#209) ... Found by the first post-merge sweep after the 0.6.0 merge — #198's own acceptance probe — not by review. Three PRs in one run: labels: #208: could not read the head commit's date: forge_api: HTTP 404 from 'GET repos/heavy-duty/ceremony/commits/f3a1336…' — blocker:unrequested not judged this pass Measured against this instance: forgejo repos/{o}/{r}/commits/{sha} -> 404 forgejo repos/{o}/{r}/git/commits/{sha} -> 200, date under `.created` github repos/{o}/{r}/commits/{sha} -> 200, date nested A fourth asymmetry, alongside the three lib/forge-forgejo.sh's header already records. #198 ported this call site onto the shim with GitHub's path unchanged — correct against GitHub, and the block it lives in (#236 D2) arrived WITH the merge, so nothing here had ever executed it. So it becomes a verb rather than a path at the call site: the caller wants one timestamp and should not have to know either shape. Cost while it stood was bounded and loud rather than silent — guarded_read refused and the sweep said so — but blocker:unrequested could never be judged on this forge. The tests pin each backend's PATH and FIELD, because a stubbed forge_api cannot catch a wrong path; that is exactly how this shipped and why it took a live sweep to find. Swapping the paths reds the forgejo pair; swapping the fields reds the github one. test/run.sh 28/28 under jq 1.7 and jq 1.6; forge-backends 124/124; shellcheck 0.10.0 and actionlint clean. Refs #209	2026-08-05 15:01:32 +00:00
cluade-reviewer-andresmgsl	957f72739d	fix(forge): the release doors speak the shim, and an unread fact refuses (#191) ... The 0.4.1 drill measured both doors dead on Forgejo. lib/facts.sh gathered `released` with `gh release view` and `labeled` with `gh api .../pulls`, and release.yml tagged and published with `gh` — none of which exist on the runner image. The merge door therefore read labeled=no for a correctly labeled, correctly merged ceremony PR and refused it as "a bare push"; the tag door cleared every gate and died at `gh release create`. Both are ported onto lib/forge.sh. Two asymmetries were measured against the live instance and its swagger rather than assumed: * GitHub serves an ARRAY of PRs at /commits/{sha}/pulls; Forgejo serves a single OBJECT at /commits/{sha}/pull and 404s on the plural. Both verbs emit the array shape, so facts.sh carries one jq expression. * GitHub creates a tag by POSTing to /git/refs; Forgejo serves that path GET-only and creates tags at /tags. A 1:1 port of the gh call would have 404'd forever. The behaviour change is the second half of the bug. Any failure used to become a definite `no`, which is safe for row 4 and catastrophic for row 5: it is how a missing binary became "this was not a release ceremony". Now a completed read that finds nothing is still `no` and still fail-closed, and a read that did not complete refuses and emits no fact at all. Four new cases in test/facts.test.sh cover exactly that, and a mutation back to the old fail-closed-on-error behaviour kills all four and nothing else. 1014 assertions, 22 suites, shellcheck and actionlint clean. Refs #191 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-04 11:31:06 +00:00
grok-reviewer-andresmgsl	5c8e4f5b84	feat(forge): timeline normalizer, portable PR activity, shellcheck install (#188) ... Panel-unanimous batch that was staged unpushed on 57abe15 (#4853): - forge_timeline: project Forgejo label events into the GitHub shape so the ruling ladder fires on this forge (measured mapping #4849) - forge_pr_activity: stop calling /pulls/{n}/comments (404 here); use reviews with comments_count > 0 for inline comments (#4844) - ci.yml: install shellcheck before lint, mirroring actionlint — the act-22.04 runner image does not ship it Status captured before jq so an unreadable timeline cannot report empty.	2026-08-03 15:13:30 +00:00
cluade-reviewer-andresmgsl	baf4a20571	feat(forge): port every reconciler call site onto the shim ... Term 1 completed. All 52 runtime gh call sites in the three reconcilers and lib/ruling.sh now go through forge_* verbs; the three remaining matches in labels-reconcile are prose in comments. lib/facts.sh is deliberately untouched — it is the release door, and the ruling keeps release.yml out of this issue. The CEREMONY_FORGE_CLIENT:-gh wrappers die here, in the same commit as the sites they described, so the tree is never in a state where the declaration lies. main() now runs forge_preflight then forge_select "". Two sites needed judgment rather than substitution: - labels-scope's write is forge_labels_add, a genuine additive POST on both backends, NOT forge_issue_edit --add-label. ceremony#128 turns on that write not being a read-modify-PUT: the labeler action computed (labels-at-job-start union derived) and PUT the whole set, silently dropping a label applied while the job ran. Routing it through a generic edit verb would have quietly reopened that. - the human-review request is forge_request_reviewer. Contrary to my earlier reading, POST /pulls/{n}/requested_reviewers DOES exist on Forgejo — 422 naming the reviewer's access without it, 201 with it. The earlier 404 was a GET, which the endpoint does not serve, plus a username that did not exist. Test churn, all of it the term-5 boundary move: - the suites select the github backend, so their existing gh() stubs stay the boundary and keep intercepting; - stubs strip the paging the shim injects, so fixtures stay keyed on the logical endpoint (inlined in the PATH stub, which is a standalone executable and cannot see a shell function); - fixtures renamed off the per_page suffix for the same reason; - recorded-mutation assertions now match the verb, not the raw gh line; - gh() stubs carry SC2317: they are reached through the backend now, so shellcheck can no longer see the call path. Refs #188	2026-08-02 19:43:58 +00:00
cluade-reviewer-andresmgsl	714a2e0413	feat(forge): the reconciler verb surface on both backends ... github is the existing gh invocation extracted 1:1 (term 5). forgejo is /api/v1, and encodes three asymmetries measured against this instance on a scratch repo — never a live board: 1. Adding labels takes NAMES; removing one takes a numeric ID. POST /issues/1/labels {"labels":["probe:one"]} -> 200 DELETE /issues/1/labels/probe:one -> 422 DELETE /issues/1/labels/149 -> 204 So a removal resolves name -> id first. gh hides this; the shim cannot. 2. Assignees are SET, not added and removed: PATCH /issues/{n} takes the whole list and {"assignees":[]} clears it. --remove-assignee is therefore a read-modify-write, not a delete. 3. There is no statusCheckRollup. The portable equivalent is the combined commit status, GET /commits/{sha}/status, mapped into the node shape checks_state already parses so the decision code is untouched. gh pr list --limit 100 moves behind forge_pr_list: that page size lives in gh's own flag namespace, so no URL-parameter strip could have caught it (@grok-reviewer-andresmgsl's note 3). Every verb driven live against a real Forgejo instance: label list/create/ delete, add and remove labels by name, a removal of a label the repo does not have (no-op, as gh behaves), comment, assignee add and remove, pr_list. Call sites are still unported, so this is not yet reachable on either forge. Refs #188	2026-08-02 19:13:14 +00:00
cluade-reviewer-andresmgsl	ab23a3b1b6	feat(forge): two backends behind one call surface, and the shim owns paging ... Term 1's foundation. lib/forge.sh gains forge_select, which sources exactly one of lib/forge-github.sh or lib/forge-forgejo.sh; both define the same verbs, so no branching reaches the 61 call sites. The github backend is the current gh invocation extracted 1:1 — term 5 is kept by making that path boring. The page size moves OUT of the call sites and into the backend, because it is not portable and fails silently. Measured 2026-08-02: ?per_page=100 GitHub 100 items Forgejo 30 items (ignored) ?limit=100 GitHub 30 items Forgejo 50 items (capped) Both answer HTTP 200 with valid JSON. Every call site here is GitHub-shaped, so a verbatim port would have swept 30 of rig's 137 issues and printed "reconciled." — criterion 2 failing green, the same failure class as the blind sweep. Both page_url helpers strip a stray page-size parameter in either dialect, so a call site cannot reintroduce it by accident. Forgejo caps a page at 50 whatever is asked, so pagination is mandatory, not an optimisation. The gather is then PROVEN complete against x-total-count rather than assumed complete because a loop ended. @kimi-reviewer-andresmgsl's hardening (#4699): a missing x-total-count is itself a loud refusal. Header exposure is a server setting, and an assert that cannot run must not silently pass — that is the failure class re-entering through the guard built to stop it. Call sites are not ported yet; that is the next commit. Refs #188	2026-08-02 19:00:58 +00:00