Read Forge through the credential helper and public authority endpoint, treat API failures as failures, and evaluate every workflow attached to the newest candidate SHA. A green source gate can no longer hide a red package rail. Include RedFlag in the deliberate repository inventory.
A rotted action pin skipped the publish job rather than failing it, so
edge stopped publishing and the phone sat on an old build for a working
day with nothing saying why. The runner journal logs task pickup and
never outcome, which is what was being read.
ci-status.sh asks Gitea instead, drilling run -> job -> log tail on a
failure. claude-hook-push-ci.sh runs it after every git push so the
answer arrives without anyone choosing to look. TASK-42 has the
three-layer plan; this is layer 1.
