Skip to content

forge 0.13.8

Choose a tag to compare

View all tags
@forcetrainer forcetrainer released this 06 Oct 15:18
· 83 commits to main since this release
forge--v0.13.8
4cf51b3

A stable patch release. This page covers what changed since 0.13.7 (PR #133). Reviewers now verify by running code in a scratch copy, and the runner proves they left your repository alone.

Reviewers execute, and the runner checks they didn't write

Reviewers used to run under a read-only sandbox, which stopped them from executing anything to confirm a finding. The sandbox is gone on both harnesses; in its place the runner fingerprints the repository around every review. Issue #127.

  • Reviewer dispatches run without the read-only sandbox and verify by executing in a scratch copy. The agent contracts carry the scratch-copy, no-stash and break-the-code rules, with evidence required.
  • The runner fingerprints the repository before every reviewer dispatch and on every exit: working tree, index, HEAD and branch. A change is a reviewer-wrote halt that freezes the pre-review capture, restores refs, and cannot be recovered within the run. scripts/forge_fingerprint.py (snapshot, verify, freeze) gives the Claude loop the same guarantee.
  • Task discovery packets carry the acceptance command results with a do-not-re-run assertion, so a reviewer doesn't repeat them.
  • The pre-repair snapshot captures untracked files, so repair deltas compare tree against tree.

Final review can halt as unverified

  • Seed findings and unverifiable coverage entries accumulate as a terminal unverified set. A final-review pass with an open entry halts before doc-sync. Answer it with --resolve <id>=accept:<evidence>|defer|repair.
  • Run-level approved ids outlive the halt record and reach final-review convergence.
  • repair_task is required on a runner-derived pre-existing contract-breaking finding, on both harnesses.

Known limits

On the Claude path the fingerprint file is reviewer-writable, and .git/hooks and .git/config are outside the fingerprint (#131).

Codex

No hooks/hooks.json change since 0.13.7, so Codex doesn't ask you to re-trust forge's hooks.

Install

claude plugin marketplace update forge
claude plugin update forge@forge        # or: claude plugin install forge@forge

Restart the session to apply. On Codex: codex plugin marketplace add forcetrainer/forge --ref forge--v0.13.8, then codex plugin add forge@forge.

Assets 2
Loading