Audit remediation: docs/config truth, CI gates, silent-failure wiring, trust-layer completion

[QuintinBotes]

Summary

47 commits closing every fixable gap from the 2026-07-20 whole-project audit. Executed subagent-driven: each task implemented by a fresh agent, adversarially reviewed against its brief, with mandatory fix loops; a final whole-branch review verified the cross-task seams and returned ready to merge.

Phase 1 — Docs & config truth

• .env.example/docs now document the real FORGE_MODEL_* BYOK contract; worker logs a loud warning before falling back to the offline scripted client
• Doc-drift sweep: FORGE_SECRET_KEY in quickstart, shipped-feature claims (marketplace publish, leaderboard, OIDC), 20-package maps, compose tables
• CHANGELOG + RELEASE_READINESS regenerated at HEAD; docs/trust-layer.md written from code for all four trust-layer features; nginx reverse-proxy config + guide; FORGE_SPEC realigned with shipped reality

Phase 2 — CI gates what exists

• Web vitest suite (now 820 tests) + tsc --noEmit run on every PR
• mypy covers all 23 workspace modules (4 were silently skipped; 23 errors fixed properly)
• pytest basename-collision guard (the known exit-2 gotcha); schema-drift gate via alembic compare_metadata (surfaced and resolved 8 pre-existing drift items); dead-config hygiene + release.yml draft input wired tag-push-safe

Phase 3 — Silent-failure wiring

• Slack /forge status returns live run status; legacy in-memory /approval router retired
• Spec review Reject/Request-changes persist end-to-end (engine transitions → API → web)
• Supervised multi-agent mode actually dispatches forge_coordinator (was silently single-agent)
• PM webhooks (Jira/Linear + 7 more) now sync to the board: adapter re-fetch → workspace-scoped upsert, three idempotency layers, real Celery retries for transient faults

Phase 4 — Trust-layer completion

• Attested Changesets: read-only REST + approvals UI panel (verification via the same seam as forge-verify)
• Red-Team Gate: POST trigger endpoint + V1 worker parity via a shared verdict helper; spine persistence asymmetry documented honestly
• Self-Eval Gate: settings panel + GET /ao/self-eval/status + POST /ao/self-eval/runs (worker-driven per feat(self-eval): enforce the gate on config changes + worker-driven run (Phase A wiring) #66)

Discovered along the way (fixed on this branch)

• Helm chart shipped the dead MODEL_PROVIDER_KEY var → k8s deploys silently ran the scripted model; now wired to the real contract with an install-time blank-key warning
• Realtime websockets fell through Caddy's catch-all to the web app → explicit /ws routes both proxies; mcp-gateway wasn't on the edge network at all
• Web client baked ws://localhost:8000/http://localhost:8000 into deployed bundles → same-origin runtime fallbacks for both WS and HTTP
• Compose never passed the model/provider env vars (or MULTI_AGENT_ENABLED) into containers → passthrough added in both compose files + Helm knob

Verification

ruff clean · mypy 648 files clean · 4831 tests collect cleanly · web 820/820 + production build · deploy/tests 106 passed · helm lint/template/unittest 41/41 · per-task targeted suites green throughout (evidence in each task's review). Postgres-gated lanes run in CI.

Known follow-ups (triaged non-blocking by the final review)

forge_db SpecStatus enum sync, suite-version lexicographic ordering, F36 viewer positive-read test, URL-helper consolidation, eslint argsIgnorePattern, FORGE_SPEC deployment-snippet sweep, PT-14 punch-list entry for the Slack UUID-boundary residual, Slack approval interactivity → F36 migration.

🤖 Generated with Claude Code