Forgehand 0.2.3

Forgehand 0.2.3

Forgehand 0.2.3 lets a complete repository sweep actually finish. Two runtime defects in 0.2.2 stopped it, and both surfaced on the first real adopter sweep.

A deliberate hold no longer stops unrelated work. When the planner deliberately holds one object, for example a suppressed warning, a missing resolution reference or a later manual reopen, 0.2.2 counted that hold as a run error. The read-only plan then failed, and the standard caller skipped its whole apply step, so every other eligible Issue and pull request went unhandled. 0.2.3 keeps the hold and its reason on that one object and performs no effect on it, while independent eligible objects proceed. Genuine read, planning and write failures still fail the run. A completed run does not claim a held object's lifecycle is resolved.

Sweeps now cross GitHub's real page boundaries. GitHub returns next-page links in the numeric form /repositories/<id>/…. The 0.2.2 pagination guard trusted only /repos/<owner>/<repo>/…, so a sweep of any repository with more than 100 Issues or pull requests stopped at the first page with Untrusted pagination URL. 0.2.3 binds the repository's numeric id from the selected owner and name, and accepts id-form links only for that id, through the trusted API origin and the same request-path boundary. Another repository's id and any other origin are still refused before a second request.

The Action entry also passes the workflow ref into the manual-sweep guard instead of relying on ambient process state. A workflow_dispatch sweep with an empty number on the default branch is now covered end to end. A manual run on any other ref is still refused before a writer token is minted or any lifecycle write happens.

Existing adopters should update their reviewed runtime pin to this release's exact commit, both the reusable-workflow reference and its runtime checkout reference. Policy, message templates, warnings, timings and stable-source behavior are unchanged. This release does not update caller pins, enable a consumer, change credentials or replay effects an older runtime missed. The maintenance guide explains the source-upgrade path.

Contributors

This patch carries runtime repair and review work from Wolf's Agents.

Mira — hold classification, repository-bound id-form pagination, manual-entry proof; Tala — the real-repository sweep that found the pagination defect; Katja — the technical read that located the hold veto and the manual-entry proof gap; Nyxara — product selection and acceptance; Juno — integration and release.

Full changes: v0.2.2...v0.2.3