…er; honest CLI states (RA-01, RA-08, RA-09)

- RA-01: verifyDeep ok is now a conjunction — core tests status must be
  PASS AND the lens consensus must not block. A core that never ran a
  verifier (NOT_CONFIGURED/INCOMPLETE) can no longer surface as deep
  ok:true/PASS/exit 0. A four-state `status` field is added (additively)
  to the verifyDeep result, provenance.deep, and the verify metrics
  record (`outcome` vocabulary unchanged).
- RA-08: runTests executes the DETECTED test command via structured
  descriptors from detectStack's new `testRunners` field ({bin, args,
  label}, deduped/sorted; `testCommands` strings unchanged for
  back-compat). Executor whitelist {npm, pnpm, yarn, bun, pytest};
  a pnpm/yarn/bun repo spawns its own package manager, never a
  hardcoded `npm test`. Non-whitelisted detections (go/cargo/mvn/
  gradle/dotnet/bundle/phpunit) and missing binaries (ENOENT) report
  INCOMPLETE with the real label; npx-based runners stay label-only
  and are never executed. FAIL/timeout results carry the real runner
  label.
- RA-09: plain `verify` CLI prints four distinct tests states (pass/
  FAIL with runner, INCOMPLETE with detail, NOT CONFIGURED) and the
  verdict distinguishes BLOCKED (a runner actually failed) from
  NOT VERIFIED (nothing completed). `verify --deep` prints the core
  tests state after the lens table and a four-outcome verdict line.
  Exit code remains 1 for every non-PASS state.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01KfCEnSJzSG914yyVesjjD6

…valid records (RA-02)

Imported or hand-forged ledger evidence could previously move claim
confidence: importState() appended records via the low-level appendRecord
(bypassing validOutcome/validateRef), and readLog() trusted every line's
`h` without recomputing it, so a forged line with a bogus hash, a known
oracle, and result:"confirm" counted fully in val().

Close every hole at three layers:

- readLog() (the single reader every log goes through) now recomputes each
  line's content hash and drops mismatches; evidence lines must also pass
  validOutcome. Forged lines are invisible to loadState/readEvidence/val/
  blame/dedupe; verify() still names them.
- validOutcome() additionally requires the ref to be a non-empty string
  passing the pure half of validateRef (typed-but-empty refs like `git:`
  rejected; untyped/legacy refs kept — read-path parity with append).
- appendRecord() rechecks the seal, and importState() routes evidence
  through the full appendEvidence gate (validOutcome + git ref resolution
  against the destination repo). Rejected records are quarantined as
  sealed, hash-deduped audit lines under quarantine/<claimId>.log
  (idempotent across re-merges) and counted in the new additive
  `quarantined` field; `forge ledger merge` prints the count. mergeDirs
  reads its source raw on purpose so bad records get quarantined with a
  named reason instead of silently dropped.

Tests: the forged-evidence test now asserts val() is exactly unchanged
(the old <0.75 bound masked real inflation), plus new read-path filtering
and merge-quarantine/idempotence coverage.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01KfCEnSJzSG914yyVesjjD6

…lth; enforced completion obligations (RA-07, RA-10, RA-19, RA-20)

RA-07 (HIGH): substrateCheck's ambient path kept a stale atlas and derived
impacts, impactedFiles, and predictedTests from it, and enforceDecision could
hard-block on that stale blast radius under FORGE_ENFORCE=1. The stale+ambient
branch now drops the atlas entirely (atlas=null, atlasFresh=false) so every
derivative is empty; predictedTests is additionally gated on atlasFresh, the
blast-radius block requires atlasFresh !== false, and both renderers suppress
the likely-affected-tests section when impact is unavailable. Downstream null
atlas consumers (reusePeek/assembleContext) already fail toward miss/null.

RA-19: doctor reported a missing atlas as ok, which subsystemHealth mapped to
ACTIVE. New "na" result kind (not built/applicable): missing atlas -> health
UNAVAILABLE, stale -> DEGRADED (warn, unchanged), fresh -> ACTIVE; the CLI
prints na neutrally and it never counts toward failed totals.

RA-20: doctor --fix recorded ok:true unless a repair THREW, but mergeSettings
reports failure as a returned {action:"error", reason}. The fix loop now
inspects the returned object and records ok:false with the reason.

RA-10 (HIGH): the completion gate passed any code change as long as a doc or
state artifact moved — `forge handoff` alone satisfied it. gateDecision is now
a real decision table: a code change owes TEST EVIDENCE (a test-class file
moved with it, or a fresh passing `forge verify` provenance stamp written this
session) AND the docs/state continuity leg; test-only sessions pass; config-only
keeps the lighter bar where a handoff alone still satisfies. stopGate reads
.forge/provenance.json parse-guarded (any error -> no evidence), repairReason
leads with the missing leg per row, and all protections are preserved:
FORGE_STOPGATE=0, block-once marker (second stop always proceeds),
stop-hook-active, fail-open on internal errors.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01KfCEnSJzSG914yyVesjjD6

…aders; visible redactor degradation (RA-05, RA-06)

RA-05: protect-paths.sh only treated git show/log as content readers, so
git diff, cat-file, archive, grep, and stash-show invocations naming a
protected secret path slipped past the Bash secret-read block — and the
settings template pre-allowed two of them. The reader regex now covers
show, log, diff, stash, cat-file, archive, and grep (space or end-of-string
after the subcommand, POSIX-ERE). Plain diff stays allowed in the template
(the guard hook fires on every Bash call and now classifies it), but the
stash rule moves allow -> ask: stash-show with -p dumps stashed secret
content with no path token in the command string, so the permission layer
is the only defense, and stash mutates state.

RA-06: secret-redact.mjs swallowed every failure with exit 0 — a broken
redactor let the original unredacted output pass through with no warning.
Failures now print a visible "secret redaction DEGRADED" line on stderr;
FORGE_GUARD_STRICT=1 turns the degradation into a block (exit 2, mirrored
in the shell launcher's node-missing path). Default stays advisory.
Documented in docs/GUIDE.md env table.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01KfCEnSJzSG914yyVesjjD6

… profile; reversible settings uninstall (RA-04, RA-11..13, RA-17, RA-18)

RA-04: a failed/refused settings merge now exits 1 with the reason on
stderr — in `forge init --settings-only` (previously a silent exit 0) and
in full `forge init` (previously a console.log with exit 0). install.sh
captures the merge exit status (output captured before the sed pipe, so
sed can no longer mask it), warns on stderr that hooks/guards are NOT
wired, and prints "Install INCOMPLETE" + exits 1 instead of "Done.".

RA-12: resolveManagedPaths now emits single-quoted absolute hook and
statusline paths (`bash '<base>/guards/x.sh' args`, `'\''` escaping) so
an install prefix containing spaces still runs. guardKey dedup is
quote-normalized (and still normalizes legacy `~/.forge/` prefixes), so
old unquoted installed entries match the new quoted template — no
duplicate hooks on re-merge; a matching old unquoted spelling of the
same resolved command is healed in place to the quoted form.

RA-13: `init()` calls the new `validateProfile()` at the top and aborts
with `{profile:{error}, aborted:true}` BEFORE any side effect — an
invalid --profile no longer writes .forge/, AGENTS.md, .gitattributes,
or settings before failing.

RA-17: new `removeForgeSettings()` (`forge init --remove-settings`)
reverses the merge using the settings template as the authoritative
shape: template-keyed hooks, verbatim template permission strings (same
list only), the template statusline and $schema (quote-normalized), and
the _forge marker — user-owned entries survive byte-for-byte, empty
containers are pruned, timestamped backup + atomic write, corrupt file
refused, missing file noop. install.sh --uninstall runs it fail-soft
(manual instruction when node is missing) before removing symlinks.

RA-18: install.sh's header/--help no longer claims it "never edits
settings.json" — it now states the marker-guarded global merge, the new
--no-settings skip flag, and both reversal paths.

RA-11: merge-by-default is kept but announced: `forge init` prints a
"GLOBAL — affects all repos" consent line (with --no-settings /
--remove-settings pointers) on merged AND unchanged runs; install.sh
prints an equivalent line before invoking; README quick-start documents
both flags. FORGE_SETTINGS_PATH (internal, test-only) lets tests target
a throwaway settings file through the CLI.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01KfCEnSJzSG914yyVesjjD6

Consolidated [Unreleased] entries for the verification, ledger, guards,
substrate/doctor/gate, and init/installer workstreams.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01KfCEnSJzSG914yyVesjjD6

…plicit adoption; auto-sync full-body compare (RA-03, RA-16, RA-21)

RA-03: `sync` and `integrations add` previously emitted DIFFERENT server sets
(full registry vs the one added server), so sync → add context7 → sync
oscillated — each command clobbered the other's Continue file and never
refreshed stale Codex entries. Installed integrations are now RECORDED in
.forge/forge.config.json (mcp.integrations, via WS7's writeForgeConfig, which
round-trips unknown keys), and both commands emit the same full managed set:
source/mcp.json registry ∪ recorded integrations. A corrupt config emits
registry-only with a warning — never treated as "nothing installed".

- Continue: one forge-marked YAML file per managed server
  (.continue/mcpServers/forge-<name>.yaml) instead of a rebuilt-from-scratch
  combined file. The legacy forge-mcp.yaml is migrated away only when it is
  provably forge's (forge:sync marker, or the old emitter's exact
  `name: Forge MCP` + `schema: v1` fingerprint); anything else stays.
- Codex TOML: each managed server lives in a `# forge:managed:<name>
  begin/end` block that is byte-compared and refreshed on drift. Unmarked
  `[mcp_servers.<name>]` blocks are claimed only when owned (adopted /
  registry) or byte-identical to the old forge emission; otherwise they are
  preserved and reported with an adoption hint.

RA-21: JSON emitters now take an ownership set (registry names implicit ∪
mcp.adopted). Absent entries are written; owned entries refresh on drift; a
same-name entry the user configured is NEVER overwritten — it is reported
with `adopt with: forge integrations add <name> --adopt`. A fresh add that
forge itself creates is auto-adopted (forge owns what it wrote, so catalog
updates keep refreshing it); claiming a pre-existing divergent entry requires
the explicit --adopt.

New `forge integrations remove <name>` reverses an add: clears the record,
deletes the per-server Continue file, the forge-marked Codex block, and JSON
entries that are adopted or byte-identical to forge's spec (a user's own
divergent entry stays). Second remove is a no-op. On a corrupt config both
add and remove refuse instead of writing unrecorded state.

RA-16: autoSyncIfDrifted trusted the embedded forge:sync marker hash, so a
hand-edited AGENTS.md body with an intact marker never resynced. It now
byte-compares the file against the exact content sync would write, built via
the new shared managedContent() helper that writeManaged also writes through,
so the two paths cannot diverge again.

Tests: oscillation matrix across all eight targets, Codex marked-refresh /
user-owned preservation / legacy-block migration, JSON adoption flow,
Continue migration, remove + idempotence, corrupt-config fallback, and the
RA-16 marker-intact drift repair.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01KfCEnSJzSG914yyVesjjD6

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01KfCEnSJzSG914yyVesjjD6