feat: add GitLab-aware forge bootstrap boundary

[CodeFunta]

Intent

Ship PR #1560: add the GitLab-aware forge bootstrap provider boundary while preserving GitHub behavior and resolving the current main-branch conflict.

What Changed

• Added forge-provider detection and provider-specific bootstrap requirements for GitHub and GitLab projects, including host-scoped authentication and configurable forge hosts.
• Preserved GitHub behavior while making unsupported origins fail closed and skip fleet synchronization; updated deferred session diagnostics to be forge-neutral.
• Updated configuration, operator documentation, bootstrap diagnostics, and regression coverage for GitLab, enterprise hosts, local projects, and unsupported remotes.

Risk Assessment

✅ Low: The provider classification, host-scoped authentication, mixed-provider handling, and fail-closed fleet-sync boundary are consistent with the stated intent; no additional source-verifiable defects were substantiated.

Testing

The targeted bootstrap, startup-network, session-start, and fleet-sync tests passed after correcting an outdated assertion; manual CLI checks demonstrated unknown origins fail closed, supported GitHub remediation continues, and direct fleet-sync performs no fetch for unsupported origins. Evidence was recorded in the dedicated evidence directory.

Evidence: Provider boundary CLI transcript

Source: Provider boundary CLI transcript

Provider boundary end-to-end checks (2026-08-25)

Unknown origin in deferred network phase:
FORGE_UNSUPPORTED: unknown (host: code.example)

Mixed GitHub + unknown origins in deferred network phase:
FORGE_UNSUPPORTED: unknown (host: code.example)
NEEDS_GH_AUTH: github.com

Direct fleet-sync against unknown origin:
output=
fetch_attempted=no

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

🔧 **Rebase** - 3 issues found → auto-fixed ✅

• ⚠️ AGENTS.md - merge conflict rebasing onto refs/remotes/no-mistakes-push/feat/gitlab-bootstrap-provider-boundary
• ⚠️ bin/fm-bootstrap.sh - merge conflict rebasing onto refs/remotes/no-mistakes-push/feat/gitlab-bootstrap-provider-boundary
• ⚠️ bin/fm-startup-network.sh - merge conflict rebasing onto refs/remotes/no-mistakes-push/feat/gitlab-bootstrap-provider-boundary

🔧 Fix applied.
✅ Re-checked - no issues remain.

🔧 **Review** - 2 issues found → auto-fixed (3) ✅

• 🚨 bin/fm-bootstrap.sh:1324 - In a mixed home containing a supported GitHub project and an unknown-origin project, forge_report_unsupported returns failure at line 1324, so the GitHub authentication loop is skipped; line 1358 likewise skips the entire fleet-sync sweep. This omits valid GitHub remediation and prevents supported projects from refreshing, contradicting the requirement to preserve GitHub behavior. Report unsupported projects independently and filter them at the per-project fleet-sync boundary.
• ⚠️ .agents/skills/bootstrap-diagnostics/SKILL.md:31 - This guidance incorrectly says FORGE_UNSUPPORTED can result from an unreachable network. The diagnostic is emitted from local origin classification; network/auth failures produce NEEDS_GH_AUTH or NEEDS_GLAB_AUTH. Move reachability guidance to those authentication diagnostics so operators do not troubleshoot an unsupported host as an outage.

🔧 Fix: Fixed mixed-provider bootstrap gating and fail-closed unknown-origin fleet refresh
1 warning still open:

• ⚠️ bin/fm-forge-lib.sh:179 - The deferred FM_BOOTSTRAP_NETWORK=only path silently omits authentication diagnostics when the provider CLI is absent: fm_forge_check_auth returns immediately on command -v gh/glab failure without printing NEEDS_GH_AUTH or NEEDS_GLAB_AUTH. This regresses standalone/rerun network behavior and lets the phase appear clean despite an unverifiable forge prerequisite; emit the corresponding diagnostic before returning.

🔧 Fix: Emit forge auth diagnostics when provider CLIs are missing
1 error still open:

• 🚨 bin/fm-fleet-sync.sh:339 - The provider boundary is only enforced when bootstrap invokes fleet sync with FM_FLEET_SYNC_SKIP_UNKNOWN=1. A direct bin/fm-fleet-sync.sh invocation against a registered checkout whose origin is https://code.example/team/project.git reaches git fetch origin at line 344 because the guard at lines 339-342 is disabled by default. This leaves the same unsupported-origin network mutation reachable outside the deferred bootstrap wrapper; enforce the unknown-provider skip at the shared fleet-sync boundary.

🔧 Fix: Enforced fail-closed filtering for standalone fleet sync
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• ./bin/fm-test-run.sh tests/fm-bootstrap.test.sh
• ./bin/fm-test-run.sh tests/fm-startup-network.test.sh tests/fm-session-start.test.sh tests/fm-fleet-sync.test.sh
• Manual deferred-network unknown-origin and mixed-provider CLI checks
• Manual direct fleet-sync unknown-origin check confirming no fetch attempt

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[kunchenguid]

Automated reminder: thanks for the PR! This branch currently has a merge conflict with the base branch.

When you get a chance, please rebase onto (or merge) the latest base branch, resolve the conflict, and push. After that, checks will re-run and the PR will get looked at again.

_{Noted for firstmate#1560 at e03d829a.}

[kunchenguid]

Automated reminder: thanks for the PR! This branch currently has a merge conflict with the base branch.

When you get a chance, please rebase onto (or merge) the latest base branch, resolve the conflict, and push. After that, checks will re-run and the PR will get looked at again.

_{Noted for firstmate#1560 at 1634739b.}

[kunchenguid]

Speaking as Kun's firstmate:

Default-behavior — GitLab-aware bootstrap derives CLI/auth from registered project origins (FM_GITLAB_HOSTS / FM_GITHUB_HOSTS), so GitLab-only homes no longer require gh, and homes with no registered forge projects skip forge auth. That is a default captain-facing toolchain change with no explicit enable flag. The GitLab path itself is origin-derived, not assumed.

VISION: GitLab-from-registered-origins aligns (the fleet outlives any one forge; do not guess provider). Does not align: gh/gh-axi drop out of the universal toolchain, and this PR also rewrites unrelated supervision contracts vs current main — bin/fm-session-start.sh stops sourcing bin/fm-wake-lib.sh, and bin/fm-watch.sh scan_signals replaces fm_wake_signal_sig / fm_wake_signal_seen_path with a local stat_sig + basename .seen-*. Those look like rebase leftovers, not the GitLab boundary.

Security: no (host parsing uses ssh -G --; auth checks are host-scoped arguments).

Overlap: bin/fm-watch.sh / bin/fm-session-start.sh file overlap with the pause-cadence trio (#2750/#2749/#2748) but not the same functions. Do not land on top of those without a rebase.

This is waiting on the author, not the captain: confirm or drop the watcher/session-start contract diffs, then let CI finish. Fork workflows approved: 32504091077 CI (in_progress), 32504091014 Require no-mistakes (SUCCESS).

[kunchenguid]

Speaking as Kun's firstmate:

GitLab-aware forge boundary: detect github/gitlab/local/unknown from origin, require gh only for GitHub homes and glab for GitLab homes, fail closed on unknown. Aligns with the fleet outliving any vendor, as long as a GitHub-only home's default path is unchanged.

Class: opt-in capability (GitLab hosts via FM_GITLAB_HOSTS; GitHub-only homes should not grow new required tools). CI is in progress on this HEAD. no-mistakes must stay green. Waiting on CI — not waiting on the captain.

[kunchenguid]

Speaking as Kun's firstmate:

Correcting my earlier class. This is default-behavior, not opt-in: gh and gh-axi leave the universal toolchain and are added only when a registered project detects GitHub. A GitHub-only or not-yet-registered home changes without an enable flag.

Still not a captain decision. Waiting on the author for the unrelated watcher/session-start contract diffs, and on CI. Will flag Firstmate only if this later goes fully green and stays default-on.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains in the previously reported provider-classification, mixed-home reconciliation, or unsupported-origin mutation paths.

_{Reviews (10): Last reviewed commit: "no-mistakes: apply CI fixes" | Re-trigger Greptile}

[kunchenguid]

Speaking as Kun's firstmate:

Re-review of NEW HEAD 3805dd87663e75fab9468df0410ed2c7a100cdbb (prior stamp 2026-08-21T18:23Z).

VISION: mixed. Provider-aware bootstrap is a legitimate fleet-outlives-vendor move, and fail-closed unknown origins are the right refusal shape. But this remains default-behavior: gh / gh-axi leave the universal toolchain and are added only when a registered project detects GitHub, so a GitHub-only or not-yet-registered home changes without an enable flag. Class stays default-behavior.

The earlier wait on unrelated watcher / session-start contract diffs is cleared on this HEAD (session-start is label/fixture only; no watcher files). What is not cleared:

1. P1: forge_report_unsupported returning false gates all secondmate liveness/convergence/handoff and fleet_sync. One unknown-origin project then disables independent deferred reconciliation for supported projects and secondmates. Fail-closed for that project's forge work is right; suppressing unrelated sweeps is not.
2. P1: git:// remotes are parsed as host git and classified unknown, so a supported GitHub/GitLab git:// origin loses tooling/auth checks and can trip (1).

Security: none.

Overlap: no collision with the teardown/treehouse hold pair or the spawn-freshen hold. Other forge/bootstrap PRs were not in this batch.

CI: first-time fork workflows approved after diff review. Greptile is red on the two P1s above. no-mistakes is pending and blocking. Ahead 16, behind 0, mergeable.

Still not a captain decision. Waiting on the author for those two P1s, and on CI — not waiting on the captain. Will flag Firstmate only if this later goes fully green and stays default-on.

Merge-eligible: NO. Captain-flag NOW: NO.

[kunchenguid]

Speaking as Kun's firstmate:

Newer HEAD 3805dd87663e. Still default-behavior: COMMON_TOOLS on this HEAD is still node git no-mistakes ... without gh/gh-axi; those are added only when a registered project detects GitHub. Unrelated fm-watch.sh rewrites look gone; the toolchain default change remains.

VISION: GitLab-from-origin aligns. Dropping gh from the universal toolchain does not (assumes consent that a GitHub-only or not-yet-registered home no longer needs gh).

CI in progress. Not a captain decision yet. Waiting on CI — not waiting on the captain. Will flag only if this later goes fully green and stays default-on.

[kunchenguid]

Speaking as Kun's firstmate:

Re-review of NEW HEAD 571ebde25b31c50a2224f36f6d21e68b816f4f7e (prior stamp 2026-08-22T10:24:02Z). Newer activity is author pushes, not a new human comment.

Still default-behavior: COMMON_TOOLS is still node git no-mistakes ... without gh/gh-axi; those are added only when a registered project detects GitHub. A GitHub-only or not-yet-registered home changes without an enable flag. README also drops gh auth login from the install path.

VISION (per rule):

• One captain, one interface — mixed. GitLab/unknown origins now get honest forge diagnostics; dropping gh auth login from the README install path is a default presentation change.
• Authority is explicit — does not align. gh/gh-axi leave the universal toolchain without an explicit grant (assumes consent that those homes no longer need gh).
• Scripts own the mechanics — aligns. Provider detection is scripted; unknown origins fail closed rather than guessed.
• A restart is a non-event — aligns. Classification is from registered checkouts, not chat memory.
• Delegation with a spine — aligns on this HEAD. Mixed-home GitHub auth still runs; unknown origins no longer suppress secondmate sweeps; fleet-sync skips unknown origins per project instead of gating the whole refresh.
• The fleet outlives any vendor — aligns. GitLab-from-origin is the legitimate vendor-survival move. git:// remotes parse as a real host on this HEAD.
• Scope — aligns. Bootstrap boundary, not merge policy.

What is not cleared:

1. Body attestation head_sha is 723bd2f1ef37860a7c026bb780ef11c6da407243, not this HEAD 571ebde25b31c50a2224f36f6d21e68b816f4f7e. No matching no-mistakes-pipeline-attestation:v1 comment either. That is blocking.
2. Portable CI is in progress after fork-workflow re-approval on this HEAD. Greptile is green.

Security: no (ssh -G --; host-scoped auth).

Overlap: no collision with the teardown/treehouse hold pair or the spawn-freshen hold. bin/fm-forge-lib.sh is unique to this PR.

This is waiting on the author, not the captain: push a matching no-mistakes attestation for this HEAD, and let CI finish. I will flag the default-behavior toolchain change only if this later goes fully green and stays default-on.

Merge-eligible: NO. Captain-flag NOW: NO.