Roadmap item 6: Prove the alternative forge and harness against the adapter evals

README.md

@@ -574,6 +574,19 @@ envelopes, bindings, or snapshots refused with the normalizer's own error id. Th
 normalizer is the only judge; the framework records the generic state, reason, and
 stale-binding set it reports.
 
+The same family also replays the GitLab forge normalizer and the Codex CLI
+producer normalizer, the alternative forge and harness from roadmap item 6,
+through the same contract and safety evals as the GitHub defaults. The GitLab
+cases cover ready, conflict, security-policy-blocked, merged, closed, locked, and
+still-running merge requests; stale bindings named exactly; provider text that
+can never decide a state; and GitHub-shaped or legacy merge-status inputs
+refused. The Codex producer cases cover changed and no-change snapshots;
+provider failure, timeout, and degraded runs kept inconclusive; stale inputs and
+incomplete metadata; a moved attempt; another harness's provider; an unknown
+state; a moved untrusted snapshot; and a caller manifest ceiling, each refused.
+This is the roadmap item 6 proof that the alternative forge and harness meet the
+same contract and evals as the defaults.
+
 The approval-invalidation and no-push-after-approval family is seeded from
 `evals/v1/seed-set-approvals.json`. Each case carries a whole decision tuple
 (policy set, core request, resolved profile, result, duty evaluation, decision

RESTORE.md

@@ -698,7 +698,6 @@ Restore the seventeen paths in the manifest's inactive eval and trace framework
 block from the same commit, plus the inactive state scanner, reconciliation
 planner, sandbox-policy and risk-gates evaluator, and default normalizer payloads
 it replays.
-
 With the same pinned, architecture-bound jq 1.6 runtime used by the portable
 core, run:
 

evals/v1/evals-driver.sh

@@ -67,10 +67,10 @@ sandbox_evaluator="$runtime/control/v1/evaluate-sandbox.sh"
 sandbox_sha256=8c4b50e6ce324bbf8c3b14972356b153a40ab26c0dbcf54687e37d1133e8a3bb
 risk_gates_evaluator="$runtime/control/v1/evaluate-risk-gates.sh"
 risk_gates_sha256=0df2094a1a86901d5db8bd463cdeb295f455585b345096719bdc6dcd0b8852e8
-normalizer_shas='{"codex-native-reviewer":"7baac5c59bc7934abc9512f3f949d1397d89b85f32b389f5c1f8a835e8c24603","github-actions-ci":"690d9a8c35dc49f61a533d1ce1a9041e34895e5d337eb454bafa3a2e4d878df7","github-forge":"b810117fb47c9f90efb0d0ea62efb3d46ff4c8c8e7a278c49a3abe1be57526be"}'
+normalizer_shas='{"codex-cli-producer":"dc2fff5f40517b3dc7a633f90483c661b9a4b2e7e4f1f40d9aa7c8edcf268f25","codex-native-reviewer":"7baac5c59bc7934abc9512f3f949d1397d89b85f32b389f5c1f8a835e8c24603","github-actions-ci":"690d9a8c35dc49f61a533d1ce1a9041e34895e5d337eb454bafa3a2e4d878df7","github-forge":"b810117fb47c9f90efb0d0ea62efb3d46ff4c8c8e7a278c49a3abe1be57526be","gitlab-forge":"ff2ec298eef102f94f28995f5306adeba8e078d19e4c22860c3b167cd9b7c37a"}'
 jq_bin="$runtime/bin/jq"
 work="$runtime_parent/work"
-program_sha256=723e6d001227565fb0649391233e0208fd172e507ead670f19888da9739fd26a
+program_sha256=911179d4806dde803fa8ea05e09bc0865fc1baae49956917d71a96bb92fe7c57
 driver_sha256=$(sha256_path "$self") || emit_error E_RUNTIME
 
 verify_runtime() {
@@ -112,6 +112,10 @@ verify_runtime() {
     "$runtime/control/v1/duty-separation.jq" &&
   verify_hash 146e73dc880d363e889f32140ac375997fb709e3101de32b8d9603f1f38ca0fa \
     "$runtime/control/v1/evaluate-duty.sh" &&
+  verify_hash dc2fff5f40517b3dc7a633f90483c661b9a4b2e7e4f1f40d9aa7c8edcf268f25 \
+    "$runtime/adapters/codex-cli-producer/v1/normalize.jq" &&
+  verify_hash ff2ec298eef102f94f28995f5306adeba8e078d19e4c22860c3b167cd9b7c37a \
+    "$runtime/adapters/gitlab-forge/v1/normalize.jq" &&
   verify_hash 7baac5c59bc7934abc9512f3f949d1397d89b85f32b389f5c1f8a835e8c24603 \
     "$runtime/adapters/codex-native-reviewer/v1/normalize.jq" &&
   verify_hash 690d9a8c35dc49f61a533d1ce1a9041e34895e5d337eb454bafa3a2e4d878df7 \
@@ -383,7 +387,7 @@ replay_normalizer_cases() {
     case_id=$("$jq_bin" -r ".body.cases[$i].case_id" "$input") || emit_error E_RUNTIME
     normalizer=$("$jq_bin" -r ".body.cases[$i].normalizer" "$input") || emit_error E_RUNTIME
     case "$normalizer" in
-      codex-native-reviewer|github-actions-ci|github-forge) ;;
+      codex-cli-producer|codex-native-reviewer|github-actions-ci|github-forge|gitlab-forge) ;;
       *) emit_error E_SHAPE ;;
     esac
     input_doc="$work/normalizer-input-$i.json"
@@ -393,13 +397,14 @@ replay_normalizer_cases() {
       "$("$jq_bin" -r ".body.cases[$i].input.sha256" "$input")" ] || emit_error E_RELATION
     norm_out="$work/normalizer-$i.out"
     norm_err="$work/normalizer-$i.err"
-    "$jq_bin" -S -c -f "$runtime/adapters/$normalizer/v1/normalize.jq" "$input_doc" \
+    "$jq_bin" -L "$modules" -S -c -f "$runtime/adapters/$normalizer/v1/normalize.jq" "$input_doc" \
       </dev/null >"$norm_out" 2>"$norm_err"
     norm_status=$?
     if [ "$norm_status" -eq 0 ]; then
       [ ! -s "$norm_err" ] || emit_error E_RUNTIME
-      normalization=$("$jq_bin" -S -c '{reason_id,stale_bindings,state}' "$norm_out") ||
-        emit_error E_RUNTIME
+      # A producer normalizer has no bindings to go stale; its set is empty.
+      normalization=$("$jq_bin" -S -c '{reason_id,stale_bindings:(.stale_bindings // []),state}' \
+        "$norm_out") || emit_error E_RUNTIME
       observation=$("$jq_bin" -S -c -n --arg case_id "$case_id" \
         --argjson normalization "$normalization" \
         '{case_id:$case_id,disposition:"normalized",
@@ -415,6 +420,8 @@ replay_normalizer_cases() {
         github-actions-ci.invalid-snapshot|github-actions-ci.invalid-trust-context) ;;
         github-actions-ci.provider-contradiction|github-forge.invalid-envelope) ;;
         github-forge.invalid-snapshot|github-forge.invalid-trust-context) ;;
+        gitlab-forge.invalid-envelope|gitlab-forge.invalid-snapshot) ;;
+        gitlab-forge.invalid-trust-context|E_SHAPE|E_STALE|E_TRUST) ;;
         *) emit_error E_RUNTIME ;;
       esac
       observation=$("$jq_bin" -S -c -n --arg case_id "$case_id" --arg token "$token" \

evals/v1/evals-launcher.sh

@@ -136,16 +136,18 @@ runtime="$scratch/runtime"
   "$runtime/orchestrator/v1" "$runtime/control" "$runtime/control/v1" "$runtime/adapters" \
   "$runtime/adapters/codex-native-reviewer" "$runtime/adapters/codex-native-reviewer/v1" \
   "$runtime/adapters/github-actions-ci" "$runtime/adapters/github-actions-ci/v1" \
-  "$runtime/adapters/github-forge" "$runtime/adapters/github-forge/v1" "$scratch/work" ||
+  "$runtime/adapters/github-forge" "$runtime/adapters/github-forge/v1" \
+  "$runtime/adapters/gitlab-forge" "$runtime/adapters/gitlab-forge/v1" \
+  "$runtime/adapters/codex-cli-producer" "$runtime/adapters/codex-cli-producer/v1" "$scratch/work" ||
   emit_error E_RUNTIME
 generation=g-c83c940afd16550a4f8a4dbee2b9a6f37e429063d277962ba81c141ba5303b43
 generation_runtime="$runtime/core/v2/generations/$generation"
 /bin/mkdir -m 0700 "$generation_runtime" "$generation_runtime/modules" ||
   emit_error E_RUNTIME
 
-program_sha=723e6d001227565fb0649391233e0208fd172e507ead670f19888da9739fd26a
+program_sha=911179d4806dde803fa8ea05e09bc0865fc1baae49956917d71a96bb92fe7c57
 catalog_sha=ddd8937325342d202ec57c3060be71881e603c00f423e5a3587339c57aa22b65
-driver_sha=25ce8772c87aa8c46f25d9094fbe42f36d5818b2af12dc3f0342e110ae33fd41
+driver_sha=6d0ad6a05010fdf1a1cc2696db32f6d8fa3da3fa2ffb9c004077f7b222167bb6
 snapshot_file "$source_dir/run-evals.sh" "$runtime/bootstrap.sh" 1048576 0400 ||
   emit_error E_RUNTIME
 bootstrap_sha=$(sha256_path "$runtime/bootstrap.sh") || emit_error E_RUNTIME
@@ -216,6 +218,8 @@ for member in \
 done
 # The inactive provider-snapshot normalizers, replayed for the adapter family.
 for member in \
+  'codex-cli-producer dc2fff5f40517b3dc7a633f90483c661b9a4b2e7e4f1f40d9aa7c8edcf268f25' \
+  'gitlab-forge ff2ec298eef102f94f28995f5306adeba8e078d19e4c22860c3b167cd9b7c37a' \
   'codex-native-reviewer 7baac5c59bc7934abc9512f3f949d1397d89b85f32b389f5c1f8a835e8c24603' \
   'github-actions-ci 690d9a8c35dc49f61a533d1ce1a9041e34895e5d337eb454bafa3a2e4d878df7' \
   'github-forge b810117fb47c9f90efb0d0ea62efb3d46ff4c8c8e7a278c49a3abe1be57526be'; do
@@ -296,9 +300,11 @@ seed_sha=$(sha256_path "$input_document") || emit_error E_RUNTIME
         {path:"orchestrator/v1/state-scanner.jq",sha256:"722afbf8a20ecf6f1d61b045186dc97b22fea1457f167ec87ac5b31b317e34ae"}
       ],
       adapter_closure:[
+        {path:"adapters/codex-cli-producer/v1/normalize.jq",sha256:"dc2fff5f40517b3dc7a633f90483c661b9a4b2e7e4f1f40d9aa7c8edcf268f25"},
         {path:"adapters/codex-native-reviewer/v1/normalize.jq",sha256:"7baac5c59bc7934abc9512f3f949d1397d89b85f32b389f5c1f8a835e8c24603"},
         {path:"adapters/github-actions-ci/v1/normalize.jq",sha256:"690d9a8c35dc49f61a533d1ce1a9041e34895e5d337eb454bafa3a2e4d878df7"},
-        {path:"adapters/github-forge/v1/normalize.jq",sha256:"b810117fb47c9f90efb0d0ea62efb3d46ff4c8c8e7a278c49a3abe1be57526be"}
+        {path:"adapters/github-forge/v1/normalize.jq",sha256:"b810117fb47c9f90efb0d0ea62efb3d46ff4c8c8e7a278c49a3abe1be57526be"},
+        {path:"adapters/gitlab-forge/v1/normalize.jq",sha256:"ff2ec298eef102f94f28995f5306adeba8e078d19e4c22860c3b167cd9b7c37a"}
       ],
       control_closure:[
         {path:"control/v1/duty-separation-decision.json",sha256:"4c2297341d1d389f21ace62b58b83e27a6ed248f9bf13a10fa385c4f8474af99"},
@@ -367,7 +373,7 @@ program_check() {
     --arg scanner_sha256 556a365b92a76c7a46c56b25c61a291f5ab3dcad8168fb77f15c15b3f3477ca5 \
     --arg planner_sha256 03904cef1e06acf207ee7a6cf8666f7dd7a6360acd95bb1e8ce34bd6409ddbe4 \
     --arg sandbox_sha256 8c4b50e6ce324bbf8c3b14972356b153a40ab26c0dbcf54687e37d1133e8a3bb \
-    --argjson normalizer_shas '{"codex-native-reviewer":"7baac5c59bc7934abc9512f3f949d1397d89b85f32b389f5c1f8a835e8c24603","github-actions-ci":"690d9a8c35dc49f61a533d1ce1a9041e34895e5d337eb454bafa3a2e4d878df7","github-forge":"b810117fb47c9f90efb0d0ea62efb3d46ff4c8c8e7a278c49a3abe1be57526be"}' \
+    --argjson normalizer_shas '{"codex-cli-producer":"dc2fff5f40517b3dc7a633f90483c661b9a4b2e7e4f1f40d9aa7c8edcf268f25","codex-native-reviewer":"7baac5c59bc7934abc9512f3f949d1397d89b85f32b389f5c1f8a835e8c24603","github-actions-ci":"690d9a8c35dc49f61a533d1ce1a9041e34895e5d337eb454bafa3a2e4d878df7","github-forge":"b810117fb47c9f90efb0d0ea62efb3d46ff4c8c8e7a278c49a3abe1be57526be","gitlab-forge":"ff2ec298eef102f94f28995f5306adeba8e078d19e4c22860c3b167cd9b7c37a"}' \
     --arg risk_gates_sha256 0df2094a1a86901d5db8bd463cdeb295f455585b345096719bdc6dcd0b8852e8 \
     --arg observed_at "$check_observed_at" \
     --slurpfile catalog_docs "$runtime/catalog.json" \
@@ -409,6 +415,10 @@ fi
 /usr/bin/cmp -s "$output" "$scratch/output.canonical" || emit_error E_CANONICAL
 [ "$(sha256_path "$runtime/bootstrap.sh")" = "$bootstrap_sha" ] &&
 [ "$(sha256_path "$runtime/launcher.sh")" = "$launcher_sha" ] &&
+[ "$(sha256_path "$runtime/adapters/codex-cli-producer/v1/normalize.jq")" = \
+    dc2fff5f40517b3dc7a633f90483c661b9a4b2e7e4f1f40d9aa7c8edcf268f25 ] &&
+[ "$(sha256_path "$runtime/adapters/gitlab-forge/v1/normalize.jq")" = \
+    ff2ec298eef102f94f28995f5306adeba8e078d19e4c22860c3b167cd9b7c37a ] &&
 [ "$(sha256_path "$runtime/adapters/codex-native-reviewer/v1/normalize.jq")" = \
     7baac5c59bc7934abc9512f3f949d1397d89b85f32b389f5c1f8a835e8c24603 ] &&
 [ "$(sha256_path "$runtime/adapters/github-actions-ci/v1/normalize.jq")" = \

evals/v1/evals.jq

@@ -90,15 +90,20 @@ def expected_control_closure:
      sha256:"cf173ad0eaa08244bf636e3937845e894b21f14291fc5e66753e8673bdd2bd2a"}
   ];
 
-# The inactive provider-snapshot normalizers replayed for the adapter family.
+# The inactive default and alternative normalizers replayed for the adapter
+# family: three GitHub-side defaults, the GitLab forge, and the Codex CLI producer.
 def expected_adapter_closure:
   [
+    {path:"adapters/codex-cli-producer/v1/normalize.jq",
+     sha256:"dc2fff5f40517b3dc7a633f90483c661b9a4b2e7e4f1f40d9aa7c8edcf268f25"},
     {path:"adapters/codex-native-reviewer/v1/normalize.jq",
      sha256:"7baac5c59bc7934abc9512f3f949d1397d89b85f32b389f5c1f8a835e8c24603"},
     {path:"adapters/github-actions-ci/v1/normalize.jq",
      sha256:"690d9a8c35dc49f61a533d1ce1a9041e34895e5d337eb454bafa3a2e4d878df7"},
     {path:"adapters/github-forge/v1/normalize.jq",
-     sha256:"b810117fb47c9f90efb0d0ea62efb3d46ff4c8c8e7a278c49a3abe1be57526be"}
+     sha256:"b810117fb47c9f90efb0d0ea62efb3d46ff4c8c8e7a278c49a3abe1be57526be"},
+    {path:"adapters/gitlab-forge/v1/normalize.jq",
+     sha256:"ff2ec298eef102f94f28995f5306adeba8e078d19e4c22860c3b167cd9b7c37a"}
   ];
 
 def ref_shape($content_id; $media_type):
@@ -140,17 +145,21 @@ def active_seed_sources:
   ["adapters.provider-normalizers.v1","control.risk-gates.v1","control.sandbox-policy.v1",
    "core.stage-run.v2","orchestrator.reconciliation-plan.v1","orchestrator.state-scanner.v1"];
 def risk_gates_error_tokens: ["E_DUTY","E_LIMIT","E_RELATION","E_RUNTIME","E_USAGE"];
-def normalizer_ids: ["codex-native-reviewer","github-actions-ci","github-forge"];
+def normalizer_ids:
+  ["codex-cli-producer","codex-native-reviewer","github-actions-ci","github-forge","gitlab-forge"];
 def normalizer_error_ids:
-  ["codex-reviewer.invalid-envelope","codex-reviewer.invalid-snapshot",
+  ["E_SHAPE","E_STALE","E_TRUST",
+   "codex-reviewer.invalid-envelope","codex-reviewer.invalid-snapshot",
    "codex-reviewer.invalid-trust-context","github-actions-ci.invalid-envelope",
    "github-actions-ci.invalid-snapshot","github-actions-ci.invalid-trust-context",
    "github-actions-ci.provider-contradiction","github-forge.invalid-envelope",
-   "github-forge.invalid-snapshot","github-forge.invalid-trust-context"];
+   "github-forge.invalid-snapshot","github-forge.invalid-trust-context",
+   "gitlab-forge.invalid-envelope","gitlab-forge.invalid-snapshot",
+   "gitlab-forge.invalid-trust-context"];
 def normalizer_states:
-  ["action-required","cancelled","clean","closed-unmerged","dismissed","failed","findings",
-   "in-progress","inconclusive","merged","open-blocked","open-ready","passed","queued","stale",
-   "timed-out","timeout"];
+  ["action-required","cancelled","changed","clean","closed-unmerged","dismissed","failed",
+   "findings","in-progress","inconclusive","merged","no-change","open-blocked","open-ready",
+   "passed","queued","stale","timed-out","timeout"];
 def sandbox_error_tokens:
   ["E_CANONICAL","E_LIMIT","E_PARSE","E_POLICY_SET","E_RELATION","E_RUNTIME","E_USAGE"];
 def sandbox_verdicts: ["inconclusive","satisfied","violated"];
@@ -651,7 +660,7 @@ def tool_ref($source; $case):
 def tool_ref_ok($source):
   if $source == "adapters.provider-normalizers.v1" then
     schema::content_ref_ok and .media_type == "text/x-jq" and
-    (.content_id | test("\\Aadapter-normalizer\\.(codex-native-reviewer|github-actions-ci|github-forge)\\.v1\\z")) and
+    (.content_id | test("\\Aadapter-normalizer\\.(codex-cli-producer|codex-native-reviewer|github-actions-ci|github-forge|gitlab-forge)\\.v1\\z")) and
     .sha256 == $normalizer_shas[.content_id | ltrimstr("adapter-normalizer.") | rtrimstr(".v1")]
   else ref_shape(tool_content_id($source);tool_media_type($source)) end;