[madskronborg]

Move Collie's GitHub and GitLab reads and writes to cached in-process forges providers using the existing gh/glab login. This removes repeated CLI startup from CI, merge-request and release polling while preserving forge behavior, credential refresh and safe write handling. CLI commands remain for agent instructions, credentials and repository setup. The fake forge now serves HTTP to spawned hosts as well as in-process callers.

Verified on 336f9503 by GitHub CI: all four jobs passed. The full suite passed 4,364 tests with zero failures and 11 existing optional live-harness skips; build, smoke and the pinned herdr contract check also passed. Focused local checks through Collie passed 284 baseline cases and 244 forge/release/verification cases under CI's Bun 1.4.4 and four workers, plus typecheck, lint and formatting.

The earlier Collie check gate passed on 92e08921 before the CI repairs and master integration; that historical gate is not offered as proof of the new tree. Current-head CI verification is recorded as ci-integrated-github.

Required verification:

• check: /home/mk/.local/share/mise/installs/bun/latest/bin/bun run check (in /home/mk/.herdr/worktrees/.collie/madskronborg/forges-transport)

The changes after the last review have the test and gate evidence described above but were not re-reviewed:

• Serve both fake forge hosts throughout every baseline scenario and follow fixture replacements, preventing fake hostnames from reaching the real network.
• Supply fixture credentials, assert CI requests and retries over HTTP, and bound direct workflow sessions to 30 seconds.
• Publish the command fixture's PID atomically so cleanup assertions cannot mistake an empty PID file for process group zero.
• Gate shutdown races at child creation, independently of transient process metadata.
• Match the toolchain fixture's complete # v2 marker so temporary paths cannot suppress the intended upgrade; retain a deterministic path regression.
• Scope verification repositories to the tests that use them, with cleanup inside each test's promise instead of file-wide hooks.
• Resolve the conflict with master's Stage workflow using the shared HTTP transport, preserving selected-job attribution and paginating environments, deployments and job attempts.

One non-blocking finding remains: test/desktop-peers.test.ts:65 times out when run from sources because its upgrade fixture copies Bun rather than the complete source command. This reproduces on released base b4ef74af; the compiled test and complete final gate pass.

Not settled by the run

Recorded implementation assumptions

• assumed in 01-forge-http-and-the-ci-job-reads.md: The CLI front door (src/collie.ts) is given forgeHttpLayer too, though no CLI command runs the moved operations yet, so a later command reaching them cannot start without it.
• assumed in 01-forge-http-and-the-ci-job-reads.md: ForgeHttp runs credential reads through its own Runner captured at layer build; the adapter's run argument is no longer used by the four moved operations.
• assumed in 01-forge-http-and-the-ci-job-reads.md: forges is imported lazily inside src/forge/http.ts so a start that asks no forge never loads it (docs/internals.md keeping a start fast); smoke greps the binary for it because of that.
• assumed in 01-forge-http-and-the-ci-job-reads.md: GitLab's runStatus reads expiry and token for a stored login under env -u GITLAB_TOKEN -u GITLAB_ACCESS_TOKEN -u OAUTH_TOKEN, cached under its own key, so an environment token is never sent to a host from agent-supplied text.
• assumed in 01-forge-http-and-the-ci-job-reads.md: An OAuth expiry glab stores that Collie cannot parse is treated as non-expiring, so the token is used and a 401 then drives the one re-read.
• assumed in 01-forge-http-and-the-ci-job-reads.md: A glab expiry whose zone is an abbreviation (e.g. CET) is read in this Machine's local zone, as Go writes it.
• assumed in 01-forge-http-and-the-ci-job-reads.md: The GitLab no-login runStatus criterion already held on the base (it ran glab auth status first), so its red was shown by mutating the guard rather than on the base.
• assumed in 01-forge-http-and-the-ci-job-reads.md: test/mr.test.ts's recorder test that runStatus never asks an unlogged host was replaced by the forge.test.ts case, which asserts the same on both faces.
• assumed in 01-forge-http-and-the-ci-job-reads.md: Failure reasons keep their shape (<Display> answered <status>: …, could not be reached) but their wording now comes from the HTTP answer rather than CLI stderr.
• assumed in 01-forge-http-and-the-ci-job-reads.md: COLLIE_FORGE_API is the name of the base URL a test points a host at to reach the fake's HTTP face; unset in production.
• assumed in 01-forge-http-and-the-ci-job-reads.md: The benchmark's first library read includes the cold credential read and connection, as a host's first poll would.
• assumed in 02-the-merge-request-panel-and-a-branchs-merge-requests-over-http.md: The planner's answer in attachments/message-42165507.md is authoritative with the ticket unchanged: GitHub REST auto_merge supplies forBranch's autoMerge, and no GraphQL call is added for that branch lookup.
• assumed in 02-the-merge-request-panel-and-a-branchs-merge-requests-over-http.md: The replacement implementer retained the previous implementer's completed commit 894200a and recorded benchmark, confirmed the recorded failing-first cases, ran the remaining checks and confirmed the remote push rather than recreating completed work.
• assumed in 02-the-merge-request-panel-and-a-branchs-merge-requests-over-http.md: The source-only peer-upgrade failure is reported as a pre-existing minor finding because it reproduces on the released base and its repair is outside ticket 02.
• assumed in 03-branch-protection-and-deploy-status-over-http.md: The ticket's explicit requirement to page GitLab protected_branches takes precedence over the old one-page unknown fallback; wildcard matching stays unchanged.
• assumed in 03-branch-protection-and-deploy-status-over-http.md: GitLab liveTier keeps its existing environment and 50-deployment reads, while GitHub's deployment list is paged as explicitly required by the ticket.
• assumed in 04-issues-posting-and-the-login-through-forges-own-operations.md: The planner amended ticket 04 to move only the six named operations and created ticket 05 for the remaining review/release operations, so readReview keeps its private CLI login read until that ticket rather than partly migrating its implementation here.
• assumed in 04-issues-posting-and-the-login-through-forges-own-operations.md: The planner’s single-authority answer in attachments/message-9feb6a4d.md preserves post.ok:true after a note lands and approval fails, with inspection guidance before approving again, because retrying the whole post would duplicate the note.
• assumed in 05-review-reads-replies-merge-and-release-pipelines-over-http.md: GitHub readReview reuses the existing paginated panel query extended with mergedBy, preserving all review fields and avoiding a second implementation of check-context pagination.
• assumed in 05-review-reads-replies-merge-and-release-pipelines-over-http.md: Per the planner's pane-only instruction in message-1e8c2ee6.md, the delivering fixture regression from ticket 02 is corrected in this slice after original-base proof and bisection, by serving the same model over HTTP rather than changing the timeout or adapter behavior.

• 01-forge-http-and-the-ci-job-reads.md: after merge: Guard: on a real Run on cego/collie with a check left to CI, the card shows the job's state as before.
• 02-the-merge-request-panel-and-a-branchs-merge-requests-over-http.md: after merge: Guard: on a real Run on cego/collie, the card's panel shows the pull request's checks, review decision and auto-merge as before.
• 02-the-merge-request-panel-and-a-branchs-merge-requests-over-http.md: after merge: Guard: on a branch whose pull request merges itself once green, a push step still parks with not pushed: auto-merge is on for <url>.
• 03-branch-protection-and-deploy-status-over-http.md: after merge: Guard: a merged cego/collie pull request shows its deploy line as before.
• 04-issues-posting-and-the-login-through-forges-own-operations.md: after merge: Guard: self-improve on cego/collie files an issue and comments on one, and the Run's record has their URLs.
• 04-issues-posting-and-the-login-through-forges-own-operations.md: after merge: Guard: posting a clean review on a cego/collie pull request leaves one comment and an approval.
• 05-review-reads-replies-merge-and-release-pipelines-over-http.md: after merge: Guard: a landing Run on cego/collie reads its review, replies to a comment and merges as before.

The recorded ticket-01 smoke assumption was superseded during review: the final smoke exercises the compiled CLI against the HTTP fake and checks its response and request. Ticket 05 completed the review/release operations deferred by ticket 04.