feat(framework): forge wrapper gaps, merge policy and PR workflow skills (#1841) #1842

Merged
jason.woltje merged 26 commits from feat/forge-wrapper-gaps into next 2026-11-05 20:13:57 +00:00
26 Commits
Author SHA1 Message Date
jason.woltje faf3f90e3a style(framework): format forge wrapper README table
ci/woodpecker/pr/ci Pipeline was successful
2026-11-05 13:44:57 -06:00
Codex 01662b281f fix(framework): read pinned policy from repo root and compare pages unordered
ci/woodpecker/pr/ci Pipeline failed
2026-11-05 13:16:32 -06:00
jason.woltje ed5332b73b fix(framework): fail closed on missing base and overlapping pages
ci/woodpecker/pr/ci Pipeline failed
2026-11-05 12:22:33 -06:00
jason.woltje abab3a67e2 fix(framework): enforce pinned forge merge policy
ci/woodpecker/pr/ci Pipeline failed
2026-11-05 11:47:16 -06:00
code-infra-01andGPT-6.1-Sol de99f7263f fix(framework): validate milestone title before provider reads (#1841)
ci/woodpecker/pr/ci Pipeline was successful
Refuse missing or empty creation titles before provider detection while preserving title-free listing. Prove zero-provider usage failures and unchanged synthetic list and creation payload behavior.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 19:41:12 -06:00
code-infra-01andGPT-6.1-Sol ade6f3d26f test(framework): isolate issue usage fixture origins (#1841)
Use owned empty Git fixtures so parse-acceptance arms cannot inherit the enclosing checkout remote. Retain no-provider assertions and deliberate GitHub normalization coverage.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 19:41:04 -06:00
code-infra-01andGPT-6.1-Sol d3a2b8c870 fix(framework): validate raw provider header bytes (#1841)
Capture transport bytes without universal newline conversion and validate CRLF framing and field bytes before parsing. Prove malformed redirects refuse before any follow-up while valid OWS and response blocks remain supported.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 19:40:54 -06:00
code-infra-01andGPT-6.1-Sol 1a569f734c test(framework): isolate local PR diff provider fixture (#1841)
ci/woodpecker/pr/ci Pipeline failed
Inject a synthetic Gitea detector only for owned local fixture origins. Keep actual fetch/ref/diff and fail-closed reviewer assertions intact.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 19:00:27 -06:00
code-infra-01andGPT-6.1-Sol b03f3a70bd fix(framework): reject redirect URI glob expansion (#1841)
ci/woodpecker/pr/ci Pipeline was canceled
Validate raw and resolved URI components before transport and disable curl globbing. Preserve encoded literal targets and prove overlapping defenses with real loopback TLS controls.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 18:54:25 -06:00
code-infra-01andGPT-6.1-Sol 85ea376dc0 fix(framework): constrain authenticated read redirects (#1841)
ci/woodpecker/pr/ci Pipeline failed
Follow bounded same-origin HTTPS GET redirects without replaying mutations. Prove real wrapper entry paths and declare TLS fixture prerequisites in all consuming pipeline steps.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 18:26:34 -06:00
code-infra-01andGPT-6.1-Sol 79682f703f test(framework): make fake provider launchers portable to BusyBox (#1841)
ci/woodpecker/pr/ci Pipeline failed
Replace only the two env -S fixture prefixes with a POSIX shell trampoline. Keep Python isolation, quoted argv, fixture bodies and assertions unchanged.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 17:33:28 -06:00
code-infra-01andGPT-6.1-Sol 1effc9c143 docs(framework): index shipped forge wrappers and fixture helper (#1841)
ci/woodpecker/pr/ci Pipeline failed
Add the nine missing git-tool index rows to the existing tables. Identify the schema fixture as an offline test helper and retain all existing tool entries.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 17:02:18 -06:00
code-infra-01andGPT-6.1-Sol 00d62c62ca ci(framework): enumerate forge wrapper regression suites (#1841)
ci/woodpecker/pr/ci Pipeline failed
Add eleven shell suites and seven Python suites to the existing framework test command. Keep all prior invocations and exclusions unchanged.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 16:35:17 -06:00
code-infra-01andGPT-6.1-Sol 5cde8cd15b docs(framework): record round-two credential contract and evidence (#1841)
ci/woodpecker/pr/ci Pipeline failed
Resolve R2-C3 by documenting anonymous authentication consistently. Record complete URL, transport-error and wrapper trace controls, correct the earlier S6 coverage claim, and preserve the independent baseline failure.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 16:06:10 -06:00
code-infra-01andGPT-6.1-Sol fc7b9d61b3 fix(framework): keep shell credentials inside private workflows (#1841)
Disable tracing before caller-side token capture and retain privacy through the entire workflow. Use anonymous curl config descriptors, keep request stdin available, and cover all token-consuming wrappers with trace and argv controls. Preserve signal handling and stateful readback fixtures.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 16:03:00 -06:00
code-infra-01andGPT-6.1-Sol bec37b6fdf fix(framework): bind provider URLs and reject curl errors (#1841)
Validate complete public and enterprise API URLs in transport fixtures. Treat nonzero curl exits as transport failures for every provider, preserving unknown mutation outcomes.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 16:01:05 -06:00
code-infra-01andGPT-6.1-Sol a193cf2845 docs(framework): record forge review fixes and verification (#1841)
Map review findings to fix commits and regressions; preserve offline sweep, targeted correction, mutant controls and baseline failures separately. Record deferred inherited literals and unverified live transport behavior.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 15:31:26 -06:00
code-infra-01andGPT-6.1-Sol 8325df7063 test(framework): isolate issue-close actor credentials (#1841)
Replace the inherited shared-token fixture dependency with a synthetic actor and host-bound token in a private fixture home. Keep the comment-before-close negative and positive controls intact.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 15:30:47 -06:00
code-infra-01andGPT-6.1-Sol 02c7f2b183 test(framework): finish explicit credential fixture migration (#1841)
Keep metadata fixture arms offline, bind explicit/default-port fixture credentials and avoid new shell diagnostics in isolated credential arms.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 15:25:38 -06:00
code-infra-01andGPT-6.1-Sol e62adbcc27 test(framework): use independent offline workflow controls (#1841)
Exercise separate T3-wake and notifier wrapper paths against expected verdicts; reject wrong-ready and missing-full-stop mutants. Keep schema fixtures offline, operator patterns external and generated guard fixtures in scratch.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 15:22:25 -06:00
code-infra-01andGPT-6.1-Sol d939601116 fix(framework): bind forge policy and credentials to trusted identities (#1841)
Resolve merge authority from the pinned target commit; reject full PR identity races and malformed conversation state. Require explicit host-bound actors, verify mutation identity and deliver auth through anonymous descriptors. Migrate legacy fixture credentials to explicit actors.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 15:21:39 -06:00
code-infra-01andGPT-6.1-Sol 55d6cc18e3 feat(framework): package provider-neutral PR workflow skills and parity evidence (#1841)
Promote the four attributed workflows and their git/watch skill dependencies. Document capabilities, merge declarations, unsupported profiles, optional notification prerequisites and measured verification limits. Exclude generated Python bytecode from published git tools.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 14:41:45 -06:00
code-infra-01andGPT-6.1-Sol 5d187488d4 fix(framework): verify enterprise review URLs and ambiguous outcomes (#1841)
Preserve provider-qualified conversation ownership on enterprise API prefixes and keep post-write malformed readback outcomes unknown. Make the absence assertion independent of scratch directory names.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 14:36:25 -06:00
code-infra-01andGPT-6.1-Sol 630cc86355 fix(framework): harden forge adapters and preserve SSH compatibility (#1841)
Keep credentials out of client argv, validate snapshot schema and ownership evidence, reject opaque GraphQL writes and isolate suite scratch roots. Retain existing SCP and SSH transport parsing.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 14:31:15 -06:00
code-infra-01andGPT-6.1-Sol f59a4c3483 feat(framework): enforce declared merge methods and verified integration controls (#1841)
Add schema-v3 merge policy with squash-only defaults, protected scheduling, explicit capability failures, normalized CI checks and guarded review mutations. Qualify legacy fake providers with public metadata fixtures.

Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 14:17:10 -06:00
code-infra-01andGPT-6.1-Sol bbfdacaa38 feat(framework): draft normalized forge status and review adapters (#1841)
Co-Authored-By: GPT-6.1-Sol (Codex) <[email protected]>
2026-11-04 13:54:56 -06:00