Forgehand 0.2.4

Forgehand 0.2.4

Forgehand 0.2.4 lets a complete cold sweep fit inside an Actions job's API budget. In 0.2.3 a real repository's full lifecycle journey needed far more requests than the job token allows in an hour, so the sweep couldn't be enabled at all.

The cold sweep reads each settled object far fewer times. 0.2.3 re-read comment, commit and closing-relationship evidence through separate REST requests for every Issue and pull request, including ones already settled. 0.2.4 reads that evidence through fully paginated GraphQL connections, and skips an object only when complete evidence proves it has already converged. Inside the read-only plan, repeated GETs are coalesced; that cache is discarded before apply, and every real effect still re-reads policy, suppression, object state and permissions on the existing paths. Missing, changed, truncated or cyclic evidence fails the run instead of turning into a guessed no-op.

On a 491-object fixture shaped like a real adopter, the complete plan → apply journey, including completion recovery and the optional check writer, now takes 729 REST requests and 438 conservative GraphQL points, against GitHub's separate 1,000-per-hour job budgets. 0.2.3 needed 16,898 REST requests for the same fixture. Decisions, resulting object state and check effects are identical to 0.2.3.

Label controls respect their Issue/PR scope everywhere. The fast path and the planner now share one label-selection helper. Manual Triage, No Auto-reply and cleanup labels apply only to the object kinds the policy defines them for. A closed pull request still clears a PR-only Stale label, even when it carries an Issue-only control name.

Existing adopters should update their reviewed runtime pin to this release's exact commit, both the reusable-workflow reference and its runtime checkout reference. Policy, message templates, warnings, timings and stable-source behavior are unchanged. This release proves budget fit on that fixture shape. It doesn't establish Actions read permissions or throughput for materially larger histories, and it doesn't update caller pins, enable a consumer, change credentials or replay missed effects. The maintenance guide explains the source-upgrade path.

Contributors

This patch carries runtime and review work from Wolf's Agents.

Eira: request-efficient sweep evidence, shared label selection, the exact-baseline fixture comparison. Tala: the measurement that exposed the 0.2.3 request amplification. Katja: the technical read that found the shortcut's label-scope mismatch. Nyxara: product selection and acceptance. Juno: integration and release.

Full changes: v0.2.3...v0.2.4

Forgehand 0.2.3

Forgehand 0.2.3

Forgehand 0.2.3 lets a complete repository sweep actually finish. Two runtime defects in 0.2.2 stopped it, and both surfaced on the first real adopter sweep.

A deliberate hold no longer stops unrelated work. When the planner deliberately holds one object, for example a suppressed warning, a missing resolution reference or a later manual reopen, 0.2.2 counted that hold as a run error. The read-only plan then failed, and the standard caller skipped its whole apply step, so every other eligible Issue and pull request went unhandled. 0.2.3 keeps the hold and its reason on that one object and performs no effect on it, while independent eligible objects proceed. Genuine read, planning and write failures still fail the run. A completed run does not claim a held object's lifecycle is resolved.

Sweeps now cross GitHub's real page boundaries. GitHub returns next-page links in the numeric form /repositories/<id>/…. The 0.2.2 pagination guard trusted only /repos/<owner>/<repo>/…, so a sweep of any repository with more than 100 Issues or pull requests stopped at the first page with Untrusted pagination URL. 0.2.3 binds the repository's numeric id from the selected owner and name, and accepts id-form links only for that id, through the trusted API origin and the same request-path boundary. Another repository's id and any other origin are still refused before a second request.

The Action entry also passes the workflow ref into the manual-sweep guard instead of relying on ambient process state. A workflow_dispatch sweep with an empty number on the default branch is now covered end to end. A manual run on any other ref is still refused before a writer token is minted or any lifecycle write happens.

Existing adopters should update their reviewed runtime pin to this release's exact commit, both the reusable-workflow reference and its runtime checkout reference. Policy, message templates, warnings, timings and stable-source behavior are unchanged. This release does not update caller pins, enable a consumer, change credentials or replay effects an older runtime missed. The maintenance guide explains the source-upgrade path.

Contributors

This patch carries runtime repair and review work from Wolf's Agents.

Mira — hold classification, repository-bound id-form pagination, manual-entry proof; Tala — the real-repository sweep that found the pagination defect; Katja — the technical read that located the hold veto and the manual-entry proof gap; Nyxara — product selection and acceptance; Juno — integration and release.

Full changes: v0.2.2...v0.2.3

Forgehand 0.2.2

Forgehand 0.2.2

Forgehand 0.2.2 restores native lifecycle controls for repositories using labelPolicy: null. The released loader silently skipped those mappings: an inactive Issue carrying Keep Open, Manual Triage or No Auto-reply could still receive a stale warning, even though the local preview appeared to respect the control. The runtime now keeps the native mappings applicable, and preview uses the same loaded configuration. A repository with an explicit canonical label policy still retains its exact Issue/PR scopes.

Existing adopters using labelPolicy: null should update their reviewed runtime pin to this release's exact commit, including both the reusable-workflow reference and its runtime checkout reference. Keep the repository's existing policy and message templates; no canonical label catalogue needs to be added as a workaround. This release does not update caller pins, enable a consumer, change credentials or restore effects already delivered by an older runtime. The maintenance guide explains the source-upgrade path.

Forgehand's repository-owned DiffDevil Action also verifies the Automaton identity before passing the writer token to DiffDevil. The self-adoption documentation now records the Action as the sole enabled size writer, qualified on an ordinary pull request; managed App execution remains suspended until it can load the repository-owned XL reply template. Dependabot-authored pull requests are not yet sized by this route. These are Forgehand's own adoption facts, not activation of the Action in other repositories.

Contributors

This patch carries implementation and adoption work from Wolf's Agents.

Eira — native-control loader repair and preview/runtime regression coverage; Mira — Automaton identity verification and release preparation; Nyxara — self-adoption documentation; Juno — the immutable v0.2.1 self-adoption pin.

Full changes: v0.2.1...v0.2.2

Forgehand 0.2.1

Forgehand 0.2.1

Forgehand 0.2.1 makes the repository-owned automation packet safer to activate. Its Automaton installation token now requests only Issue and pull-request writes, with Checks write added only when a policy check needs it. Trusted policy reads continue through the workflow's read token. App installations without Contents access can therefore supply the writer token.

The supplied DiffDevil policy now compares the review metric with the XL threshold of 1,000 changed lines. An unknown metric still holds the XL reply instead of guessing. The policy also maps DiffDevil's size labels onto the six size labels the label policy provisions, so a writer assigns those labels instead of creating a parallel set. This corrects the policy included in the installation example and Forgehand's own self-adoption source.

Lifecycle automation and DiffDevil sizing are separate capabilities, and the lifecycle packet can be enabled on its own. This is the release Forgehand's own repository runs its lifecycle from; the self-adoption issue records when that activation happens and what it proved. This release includes Forgehand's repository-owned DiffDevil Action route and corrected size-label policy. The Action remains disabled until managed Forgehand execution is suspended and the route is enabled and qualified on one real pull request, so this release does not yet size Forgehand's pull requests. Managed DiffDevil App sizing remains the final destination and will replace the Action as the only writer. It cannot do so yet: the App cannot read the repository-owned XL reply template and returns E_TEMPLATE_SOURCE.

Existing adopters who copied the earlier DiffDevil policy should review their repository-owned .diffdevil.yml against the corrected example, including its size-label mapping, before enabling a size writer or the XL reply. This release does not change an existing repository's policy, App installation, credentials, caller pin, or enablement.

Contributors

Mira (Wolf's Agents) — self-adoption source and the token and DiffDevil policy repairs.

Full changes: v0.2.0...v0.2.1

Forgehand 0.2.0

Forgehand 0.2.0

Forgehand 0.2.0 makes the adoption-ready lifecycle packet available as shared runtime source: a repository can now generate its selected product or Company profile with the policy, labels, messages, caller, and local declaration kept in that repository.

Highlights

• The product packet includes the complete Issue and pull-request lifecycle and message set, with the selected 90-day inactivity window and a real 7-day warning. Necessary responses end quietly rather than adding a redundant acknowledgement.
• The Company profile deliberately omits general product Issue/PR inactivity and its product-only inventory, so a Company room does not inherit a lifecycle it did not select.
• Generated product packets include the repository-owned DiffDevil policy and XL reply template. The managed DiffDevil App remains the sole writer for size labels, checks, and XL replies; Forgehand no longer carries a local size-parser or CLI adapter.
• Runtime coordinates remain exact: an activatable caller is generated only from an authoritative public release record containing the repository, full runtime SHA, and GitHub Release URL.

Before a repository uses it

This release does not install an App, enable a consumer, configure credentials or variables, or start lifecycle effects. Keep managed-App execution disabled until the policy and templates are durable on the repository default branch; then use the next ordinary real pull request as the first managed size/check trial. The repository-owned XL reply appears only if that pull request actually enters XL.

Proof

The release candidate passed Forgehand's npm test, npm run check, and npm run build verification on Node 22 and 24.

Contributors

Mira (Wolf's Agents) — adoption-ready lifecycle, profile, installer, and message-packet work.

Full changes: v0.1.0...v0.2.0

Forgehand 0.1.0

Forgehand's first public runtime release.

It provides policy-driven GitHub Issue and pull-request lifecycle automation with repository-owned configuration and voice. The release includes read-only planning, explicitly scoped Automaton writes, inactivity and necessary-response episodes, deliberate reopening, and stable-source completion.

PR size labelling remains disabled until the separate DiffDevil dependency is publicly published and qualified. This release does not publish an npm package, enable a consumer workflow, or provision an App key.