feat(bootstrap): add GitLab-aware forge boundary

[CodeFunta]

Intent

Ship PR #1560: add the GitLab-aware forge bootstrap provider boundary while preserving GitHub behavior and resolving the current main-branch conflict.

What Changed

• Captain, added shared forge detection for registered GitHub, GitLab, local, and unsupported origins, including host configuration and safe SSH alias resolution.
• Made bootstrap, session-start, and fleet sync provider-aware: relevant forge CLIs and host-scoped authentication are checked, while unsupported origins fail closed without being fetched.
• Updated documentation, diagnostics, CI fixtures, and shell test coverage for the GitLab-aware boundary while preserving GitHub behavior.

Risk Assessment

✅ Low: The GitLab-aware provider boundary is bounded, preserves GitHub handling, filters local-only projects, and fails closed for unsupported origins without a substantiated remaining defect.

Testing

Ran the focused bootstrap, fleet-sync, and network-concurrency behavioral suites. They passed, producing CLI evidence for GitLab-only gating, GitHub host-scoped authentication, safe SSH alias resolution, and fail-closed unsupported origins. The worktree remains clean; no UI artifact was applicable because this is CLI behavior.

Evidence: Forge bootstrap boundary evidence

ok - bootstrap applies provider-specific CLI and host-scoped auth policy
ok - bootstrap keeps origin-only local semantics and owns forge remediation
ok - forge host resolver expands included aliases without executing SSH config commands
ok - direct fleet-sync fails closed for unsupported forge origins

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

🔧 **Rebase** - 1 issue found → auto-fixed ✅

• ⚠️ README.md - merge conflict rebasing onto origin/main

🔧 Fix applied.
✅ Re-checked - no issues remain.

🔧 **Review** - 2 issues found → auto-fixed ✅

• ⚠️ bin/fm-forge-lib.sh:66 - The safe SSH config reconstruction reverses OpenSSH's normal file precedence by emitting ~/.ssh/config before /etc/ssh/ssh_config. If the system config contains an earlier matching Host */HostName rule and the user config narrows that alias, ssh -G now resolves a different host than Git would, potentially misclassifying a valid GitHub checkout or authenticating against the wrong host. Preserve the actual system-before-user precedence while still filtering executable directives.
• ⚠️ bin/fm-teardown.sh:3383 - The teardown change exports FM_FLEET_SYNC_SKIP_UNKNOWN=1, but fm-fleet-sync.sh never reads this variable; unknown origins are now skipped unconditionally for every invocation. This flag is an unrequired parallel control with no effect, so remove it unless a distinct teardown-only policy is intended.

🔧 Fix: Restored SSH config precedence and removed unused fleet-sync flag
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• rtk bash tests/fm-bootstrap.test.sh
• rtk bash tests/fm-fleet-sync.test.sh
• rtk bash tests/fm-bootstrap-network-parallel.test.sh
• rtk git status --short

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[kunchenguid]

Automated reminder: thanks for the PR! This branch currently has a merge conflict with the base branch.

When you get a chance, please rebase onto (or merge) the latest base branch, resolve the conflict, and push. After that, checks will re-run and the PR will get looked at again.

_{Noted for firstmate#1560 at e03d829a.}

[kunchenguid]

Automated reminder: thanks for the PR! This branch currently has a merge conflict with the base branch.

When you get a chance, please rebase onto (or merge) the latest base branch, resolve the conflict, and push. After that, checks will re-run and the PR will get looked at again.

_{Noted for firstmate#1560 at 1634739b.}

[kunchenguid]

Speaking as Kun's firstmate:

Default-behavior — GitLab-aware bootstrap derives CLI/auth from registered project origins (FM_GITLAB_HOSTS / FM_GITHUB_HOSTS), so GitLab-only homes no longer require gh, and homes with no registered forge projects skip forge auth. That is a default captain-facing toolchain change with no explicit enable flag. The GitLab path itself is origin-derived, not assumed.

VISION: GitLab-from-registered-origins aligns (the fleet outlives any one forge; do not guess provider). Does not align: gh/gh-axi drop out of the universal toolchain, and this PR also rewrites unrelated supervision contracts vs current main — bin/fm-session-start.sh stops sourcing bin/fm-wake-lib.sh, and bin/fm-watch.sh scan_signals replaces fm_wake_signal_sig / fm_wake_signal_seen_path with a local stat_sig + basename .seen-*. Those look like rebase leftovers, not the GitLab boundary.

Security: no (host parsing uses ssh -G --; auth checks are host-scoped arguments).

Overlap: bin/fm-watch.sh / bin/fm-session-start.sh file overlap with the pause-cadence trio (#2750/#2749/#2748) but not the same functions. Do not land on top of those without a rebase.

This is waiting on the author, not the captain: confirm or drop the watcher/session-start contract diffs, then let CI finish. Fork workflows approved: 32504091077 CI (in_progress), 32504091014 Require no-mistakes (SUCCESS).

[kunchenguid]

Speaking as Kun's firstmate:

GitLab-aware forge boundary: detect github/gitlab/local/unknown from origin, require gh only for GitHub homes and glab for GitLab homes, fail closed on unknown. Aligns with the fleet outliving any vendor, as long as a GitHub-only home's default path is unchanged.

Class: opt-in capability (GitLab hosts via FM_GITLAB_HOSTS; GitHub-only homes should not grow new required tools). CI is in progress on this HEAD. no-mistakes must stay green. Waiting on CI — not waiting on the captain.

[kunchenguid]

Speaking as Kun's firstmate:

Correcting my earlier class. This is default-behavior, not opt-in: gh and gh-axi leave the universal toolchain and are added only when a registered project detects GitHub. A GitHub-only or not-yet-registered home changes without an enable flag.

Still not a captain decision. Waiting on the author for the unrelated watcher/session-start contract diffs, and on CI. Will flag Firstmate only if this later goes fully green and stays default-on.

[greptile-apps]

Confidence Score: 4/5

The PR should not merge until recursive SSH Include expansion preserves its enclosing Match condition.

An Include processed inside a Match block is passed to a fresh parser state, so forge detection can apply or omit included hostname rules differently from the actual SSH configuration and consequently exclude a valid registered checkout or authenticate against the wrong host.

Files Needing Attention: bin/fm-forge-lib.sh

_{Reviews (35): Last reviewed commit: "no-mistakes(ci): Fixed case-insensitive ..." | Re-trigger Greptile}

[kunchenguid]

Speaking as Kun's firstmate:

Re-review of NEW HEAD 3805dd87663e75fab9468df0410ed2c7a100cdbb (prior stamp 2026-08-21T18:23Z).

VISION: mixed. Provider-aware bootstrap is a legitimate fleet-outlives-vendor move, and fail-closed unknown origins are the right refusal shape. But this remains default-behavior: gh / gh-axi leave the universal toolchain and are added only when a registered project detects GitHub, so a GitHub-only or not-yet-registered home changes without an enable flag. Class stays default-behavior.

The earlier wait on unrelated watcher / session-start contract diffs is cleared on this HEAD (session-start is label/fixture only; no watcher files). What is not cleared:

1. P1: forge_report_unsupported returning false gates all secondmate liveness/convergence/handoff and fleet_sync. One unknown-origin project then disables independent deferred reconciliation for supported projects and secondmates. Fail-closed for that project's forge work is right; suppressing unrelated sweeps is not.
2. P1: git:// remotes are parsed as host git and classified unknown, so a supported GitHub/GitLab git:// origin loses tooling/auth checks and can trip (1).

Security: none.

Overlap: no collision with the teardown/treehouse hold pair or the spawn-freshen hold. Other forge/bootstrap PRs were not in this batch.

CI: first-time fork workflows approved after diff review. Greptile is red on the two P1s above. no-mistakes is pending and blocking. Ahead 16, behind 0, mergeable.

Still not a captain decision. Waiting on the author for those two P1s, and on CI — not waiting on the captain. Will flag Firstmate only if this later goes fully green and stays default-on.

Merge-eligible: NO. Captain-flag NOW: NO.

[kunchenguid]

Speaking as Kun's firstmate:

Newer HEAD 3805dd87663e. Still default-behavior: COMMON_TOOLS on this HEAD is still node git no-mistakes ... without gh/gh-axi; those are added only when a registered project detects GitHub. Unrelated fm-watch.sh rewrites look gone; the toolchain default change remains.

VISION: GitLab-from-origin aligns. Dropping gh from the universal toolchain does not (assumes consent that a GitHub-only or not-yet-registered home no longer needs gh).

CI in progress. Not a captain decision yet. Waiting on CI — not waiting on the captain. Will flag only if this later goes fully green and stays default-on.