feat: add provider-aware forge bootstrap boundary

[CodeFunta]

Intent

Add a provider-aware bootstrap boundary for registered GitHub and GitLab projects. Preserve the existing GitHub-only behavior, allow GitLab-only and local homes to avoid unnecessary GitHub requirements, fail closed for unknown origins, and report host-specific authentication remediation. Keep the PR focused on forge bootstrap behavior and do not change watcher, session-start, procevent, or unrelated supervision contracts.

What Changed

• Added shared forge detection for registered project origins, recognizing GitHub and GitLab hosts while classifying local and unknown origins without defaulting.
• Updated bootstrap dependency, authentication, and deferred network checks to require only relevant forge tooling, provide host-specific remediation, and fail closed for unknown origins.
• Documented provider-aware configuration and expanded bootstrap, session-start, and startup-network regression coverage.

Risk Assessment

⚠️ Medium: The change introduces a broad shell-based provider boundary and modifies deferred bootstrap control flow, but the reviewed implementation is internally consistent and no concrete source-level defect was substantiated.

Testing

Exercised the end-user bootstrap CLI behavior for GitHub, GitLab, local, and unsupported project origins, including host-specific authentication remediation and fail-closed network phases; all targeted tests passed and the reviewer-visible CLI transcript was captured.

Evidence: Provider-aware bootstrap targeted test transcript

Source: Provider-aware bootstrap targeted test transcript

$ bash tests/.targeted-bootstrap.test.sh
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
ok - bootstrap applies provider-specific CLI and host-scoped auth policy
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
ok - bootstrap keeps origin-only local semantics and owns forge remediation
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
ok - bootstrap: FM_BOOTSTRAP_NETWORK partitions one run into local and network halves
exit=0

$ bash tests/fm-startup-network.test.sh
ok - fm-startup-network: wait fails when no deferred stage publishes before its deadline
ok - fm-startup-network: start returns immediately and never holds the caller's stdout open
ok - fm-startup-network: exactly one of the digest and the wake reports each result
ok - fm-startup-network: a claimant crash after publication still surfaces the result
ok - fm-startup-network: a report-publication failure is failed, diagnosed, and still wakes
ok - fm-startup-network: manual callers cannot forge mutation authority
ok - fm-startup-network: deferred auth labels are provider neutral
ok - fm-startup-network: an aggregate bound turns a wedged sweep into an actionable line
ok - fm-startup-network: an abandoned run reports as needing a rerun, never as in progress forever
ok - fm-startup-network: a second start never launches a competing worker
ok - fm-startup-network: start atomically reserves the generation harvest observes
ok - fm-startup-network: a new lock owner gets a distinct worker generation
ok - fm-startup-network: fleet-lock takeover cannot overlap a mutating sweep
ok - fm-startup-network: timing records share one origin so their offsets form a timeline
ok - fm-startup-network: timings are durable and printed only on demand
ok - fm-startup-network: a timed-out run still publishes the partial timings it recorded
ok - fm-startup-network: the timing artifact cannot carry a command line or forge records
# fm-startup-network.test.sh: all assertions passed
exit=0

$ bash tests/fm-project-origin.test.sh
ok - ordinary clone URLs are accepted and clone with the command the remote host runs
ok - executable transports, option-shaped values, and unusable spellings are refused
ALL TESTS PASSED
exit=0

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

⚠️ **Rebase** - 3 warnings

• ⚠️ bin/fm-bootstrap.sh - merge conflict rebasing onto refs/remotes/no-mistakes-push/feat/gitlab-bootstrap-provider-boundary
• ⚠️ bin/fm-forge-lib.sh - merge conflict rebasing onto refs/remotes/no-mistakes-push/feat/gitlab-bootstrap-provider-boundary
• ⚠️ tests/fm-bootstrap.test.sh - merge conflict rebasing onto refs/remotes/no-mistakes-push/feat/gitlab-bootstrap-provider-boundary

🔧 **Review** - 2 issues found → auto-fixed ✅

• 🚨 bin/fm-bootstrap.sh:1237 - The deferred FM_BOOTSTRAP_NETWORK=only path skips unknown providers in the authentication loop and never emits FORGE_UNSUPPORTED. A standalone or rerun-only invocation can therefore proceed through mutating network sweeps for a registered project whose origin is unknown, violating the required fail-closed behavior. The network phase should independently surface the unsupported-origin diagnostic, or establish an equivalent shared guard before any forge-dependent sweep runs.
• ⚠️ docs/configuration.md:297 - The documented universal toolchain still says every home requires gh, GitHub auth, and compatible gh-axi, contradicting the new provider-aware behavior and the added GitLab/local requirements below. This will direct GitLab-only and local users to install unnecessary GitHub tooling.

🔧 Fix: Fail closed on unsupported forge network phases
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• bash tests/.targeted-bootstrap.test.sh covering provider-specific CLI/auth policy, GitHub/GitLab/local/unknown origin behavior, and network-phase partitioning
• bash tests/fm-startup-network.test.sh covering deferred network bootstrap behavior and provider-neutral auth reporting
• bash tests/fm-project-origin.test.sh covering origin URL validation and executable transport rejection
• Captured the targeted test transcript at /Users/andreylitvinov/.no-mistakes/evidence/01M0KJCN6QHS8K8RX38Q5HZS64/bootstrap-provider-test-transcript.txt

✅ **Document** - passed

✅ No issues found.

🔧 **Lint** - 1 issue found → auto-fixed ✅

• ⚠️ linter found issues (exit code 1)

🔧 Fix: Remove unused forge network flag
✅ Re-checked - no issues remain.

✅ **Push** - passed

✅ No issues found.

[kunchenguid]

Automated reminder: thanks for the PR! This branch currently has a merge conflict with the base branch.

When you get a chance, please rebase onto (or merge) the latest base branch, resolve the conflict, and push. After that, checks will re-run and the PR will get looked at again.

_{Noted for firstmate#1560 at e03d829a.}

[kunchenguid]

Automated reminder: thanks for the PR! This branch currently has a merge conflict with the base branch.

When you get a chance, please rebase onto (or merge) the latest base branch, resolve the conflict, and push. After that, checks will re-run and the PR will get looked at again.

_{Noted for firstmate#1560 at 1634739b.}

[kunchenguid]

Speaking as Kun's firstmate:

Default-behavior — GitLab-aware bootstrap derives CLI/auth from registered project origins (FM_GITLAB_HOSTS / FM_GITHUB_HOSTS), so GitLab-only homes no longer require gh, and homes with no registered forge projects skip forge auth. That is a default captain-facing toolchain change with no explicit enable flag. The GitLab path itself is origin-derived, not assumed.

VISION: GitLab-from-registered-origins aligns (the fleet outlives any one forge; do not guess provider). Does not align: gh/gh-axi drop out of the universal toolchain, and this PR also rewrites unrelated supervision contracts vs current main — bin/fm-session-start.sh stops sourcing bin/fm-wake-lib.sh, and bin/fm-watch.sh scan_signals replaces fm_wake_signal_sig / fm_wake_signal_seen_path with a local stat_sig + basename .seen-*. Those look like rebase leftovers, not the GitLab boundary.

Security: no (host parsing uses ssh -G --; auth checks are host-scoped arguments).

Overlap: bin/fm-watch.sh / bin/fm-session-start.sh file overlap with the pause-cadence trio (#2750/#2749/#2748) but not the same functions. Do not land on top of those without a rebase.

This is waiting on the author, not the captain: confirm or drop the watcher/session-start contract diffs, then let CI finish. Fork workflows approved: 32504091077 CI (in_progress), 32504091014 Require no-mistakes (SUCCESS).

[kunchenguid]

Speaking as Kun's firstmate:

GitLab-aware forge boundary: detect github/gitlab/local/unknown from origin, require gh only for GitHub homes and glab for GitLab homes, fail closed on unknown. Aligns with the fleet outliving any vendor, as long as a GitHub-only home's default path is unchanged.

Class: opt-in capability (GitLab hosts via FM_GITLAB_HOSTS; GitHub-only homes should not grow new required tools). CI is in progress on this HEAD. no-mistakes must stay green. Waiting on CI — not waiting on the captain.

[kunchenguid]

Speaking as Kun's firstmate:

Correcting my earlier class. This is default-behavior, not opt-in: gh and gh-axi leave the universal toolchain and are added only when a registered project detects GitHub. A GitHub-only or not-yet-registered home changes without an enable flag.

Still not a captain decision. Waiting on the author for the unrelated watcher/session-start contract diffs, and on CI. Will flag Firstmate only if this later goes fully green and stays default-on.

[greptile-apps]

Confidence Score: 4/5

The PR is not yet safe to merge because an unsupported project origin still prevents supported project clones from being refreshed.

A single unknown provider makes the fleet-wide bootstrap gate skip fleet_sync, even though the underlying sync command reconciles projects independently, leaving unrelated supported clones stale.

Files Needing Attention: bin/fm-bootstrap.sh

_{Reviews (5): Last reviewed commit: "no-mistakes: apply CI fixes" | Re-trigger Greptile}

[kunchenguid]

Speaking as Kun's firstmate:

Re-review of NEW HEAD 3805dd87663e75fab9468df0410ed2c7a100cdbb (prior stamp 2026-08-21T18:23Z).

VISION: mixed. Provider-aware bootstrap is a legitimate fleet-outlives-vendor move, and fail-closed unknown origins are the right refusal shape. But this remains default-behavior: gh / gh-axi leave the universal toolchain and are added only when a registered project detects GitHub, so a GitHub-only or not-yet-registered home changes without an enable flag. Class stays default-behavior.

The earlier wait on unrelated watcher / session-start contract diffs is cleared on this HEAD (session-start is label/fixture only; no watcher files). What is not cleared:

1. P1: forge_report_unsupported returning false gates all secondmate liveness/convergence/handoff and fleet_sync. One unknown-origin project then disables independent deferred reconciliation for supported projects and secondmates. Fail-closed for that project's forge work is right; suppressing unrelated sweeps is not.
2. P1: git:// remotes are parsed as host git and classified unknown, so a supported GitHub/GitLab git:// origin loses tooling/auth checks and can trip (1).

Security: none.

Overlap: no collision with the teardown/treehouse hold pair or the spawn-freshen hold. Other forge/bootstrap PRs were not in this batch.

CI: first-time fork workflows approved after diff review. Greptile is red on the two P1s above. no-mistakes is pending and blocking. Ahead 16, behind 0, mergeable.

Still not a captain decision. Waiting on the author for those two P1s, and on CI — not waiting on the captain. Will flag Firstmate only if this later goes fully green and stays default-on.

Merge-eligible: NO. Captain-flag NOW: NO.

[kunchenguid]

Speaking as Kun's firstmate:

Newer HEAD 3805dd87663e. Still default-behavior: COMMON_TOOLS on this HEAD is still node git no-mistakes ... without gh/gh-axi; those are added only when a registered project detects GitHub. Unrelated fm-watch.sh rewrites look gone; the toolchain default change remains.

VISION: GitLab-from-origin aligns. Dropping gh from the universal toolchain does not (assumes consent that a GitHub-only or not-yet-registered home no longer needs gh).

CI in progress. Not a captain decision yet. Waiting on CI — not waiting on the captain. Will flag only if this later goes fully green and stays default-on.

[kunchenguid]

Speaking as Kun's firstmate:

Newer HEAD d8b67f302eba. Still default-behavior: COMMON_TOOLS is still node git no-mistakes ... without gh/gh-axi. Those are added only when a registered project detects GitHub.

VISION: provider boundary aligns; dropping gh from the universal toolchain does not.

Not merge-eligible. Not a captain decision yet. Waiting on CI / author — not waiting on the captain. Will flag only if this later goes fully green and stays default-on.

[kunchenguid]

Speaking as Kun's firstmate:

Re-review of NEW HEAD d8b67f302eba (prior class=default-behavior). Still default-behavior: COMMON_TOOLS on this HEAD is still node git no-mistakes ... without gh/gh-axi; those are added only when a registered project detects GitHub. A GitHub-only or not-yet-registered home changes without an enable flag. Unrelated watcher rewrites stay gone.

VISION (per rule):

• One captain, one interface — mixed. GitLab/unknown origins now get honest forge diagnostics; dropping gh auth login from the README install path is a default presentation change.
• Authority is explicit — does not align. gh/gh-axi leave the universal toolchain without an explicit grant (assumes consent that those homes no longer need gh).
• Scripts own the mechanics — aligns. Provider detection is scripted; unknown origins fail closed rather than guessed.
• A restart is a non-event — aligns. Classification is from registered checkouts, not chat memory.
• Delegation with a spine — mixed. Fail-closed for that project's forge work is right; see P1.
• The fleet outlives any vendor — aligns. GitLab-from-origin is the legitimate vendor-survival move. git:// remotes now parse as a real host (prior P1 looks fixed).
• Scope — aligns. Bootstrap boundary, not merge policy.

What is not cleared:

1. P1: forge_report_unsupported still gates all of fleet_sync. One unknown-origin project skips clone refresh for supported projects too. Secondmate liveness/convergence/handoff are no longer suppressed on this HEAD (that half of the earlier P1 is fixed). Fail-closed for that project's forge work is right; suppressing unrelated clone refresh is not.
2. Body attestation head_sha is still 3805dd87663e, not this HEAD d8b67f302eba.

Security: no (ssh -G --; host-scoped auth).

Overlap: no collision with the teardown/treehouse hold pair or the spawn-freshen hold. docs/configuration.md and bin/fm-bootstrap.sh also move in several other open PRs; bin/fm-forge-lib.sh is unique.

CI: first-time fork workflows re-approved on this HEAD after diff review (CI 32561670331, Require no-mistakes 32561670322). Greptile is still red on the fleet_sync P1. Portable CI / no-mistakes have not finished.

Ahead 20, behind 3, mergeable, mergeStateStatus UNSTABLE.

Still not a captain decision. Waiting on the author for the remaining fleet_sync P1 and matching attestation, and on CI — not waiting on the captain. Will flag only if this later goes fully green and stays default-on.

Merge-eligible: NO. Captain-flag NOW: NO.