forge 0.13.9

A stable patch release. This page covers what changed since 0.13.8 (PR #135). It fixes approvals leaking between reviews that reuse the same finding id.

Finding identity is scoped to its review

Reviewers number findings from f1 in every review, and approvals were keyed on that bare id. Approving task 2's f1 also exempted task 5's f1. Issue #128.

• Finding identity is runner-owned and review-scoped: t<N>:<id> or final:<id>, stamped once and read everywhere. Approvals, seeds, unverified entries, halt-record findings, receipts and --status key on it.
• A scoped carried_from is kept only when it names a prior finding the review's packet carried. Anything else is a validation defect on the retry path, which closes an identity-borrowing hole.
• Every prior finding in a packet is presented under its identity as id, so a seed-carried finding keeps its approval across verification laps.
• Malformed verdict ids and carried_from values are validation defects, not raw TypeErrors. The final-review loop filters approved identities from its halted list, as the task loop does.

Command changes

• forge_dispose.py requires --scope and takes --prior-identities.
• --resolve takes an identity or an unambiguous bare id; an ambiguous bare id raises and lists the candidates.
• A halt record without identities raises on resume.

Codex

No hooks/hooks.json change since 0.13.8, so Codex doesn't ask you to re-trust forge's hooks.

Install

claude plugin marketplace update forge
claude plugin update forge@forge        # or: claude plugin install forge@forge

Restart the session to apply. On Codex: codex plugin marketplace add forcetrainer/forge --ref forge--v0.13.9, then codex plugin add forge@forge.