chore(#904): deduplicate harness config across forge sections

AGENTS.md

@@ -159,8 +159,9 @@ values that are genuinely computed per-repo or per-run, such as
 branch lists, tokens, or PR/issue numbers — those must stay as
 `${VAR}` passthrough, as already used by `CODE_ALLOWED_TARGET_BRANCHES`
 in `harness/code.yaml`'s `env.runner` block and by `REVIEW_TOKEN`,
-`REPO_FULL_NAME`, `PR_NUMBER`, and `PR_URL` in the
-`forge.<platform>.env.runner` blocks. When reviewing PRs, do not flag a
+`PR_NUMBER`, and `PR_URL` in the `forge.<platform>.env.runner` blocks
+(some passthroughs like `REPO_FULL_NAME` live at top-level `env.runner`
+when identical across forges). When reviewing PRs, do not flag a
 static literal default in these blocks as hardcoded, but do flag a
 regression that replaces one of these computed passthrough values
 with a literal.

docs/code.md

@@ -172,7 +172,7 @@ The precedence is as follows:
 
 The code agent supports both GitHub and GitLab. The harness
 `forge.<platform>` sections configure platform-specific policies,
-skills, env vars, and scripts. Key differences from single-forge
+skills, and env vars. Key differences from single-forge
 setup:
 
 - **`FULLSEND_FORGE`** is required. Set automatically by the harness

docs/triage.md

@@ -233,9 +233,9 @@ If you use `base:` composition to override `harness/triage.yaml`:
   harness defines policy, skills, and the forge-specific env file
   (`env/github/triage.env` / `env/gitlab/triage.env` /
   `env/jira/triage.env`) under `forge.<platform>` rather than at the top
-  level. `pre_script` and `post_script` are set at both levels (identical
-  values — the forge-level entries are redundant but kept explicit for
-  clarity). Top-level keys are still supported by `ResolveForge` — a
+  level. `pre_script` and `post_script` are set at the top level only;
+  forge sections inherit them via `ResolveForge`.
+  Top-level keys are still supported by `ResolveForge` — a
   downstream harness using `base:` composition can set top-level `policy:`,
   `skills:`, or `host_files:` and they will work: policy (scalar) is
   overridden by the forge-level value, skills (list) are concatenated with

harness/code.yaml

@@ -55,16 +55,23 @@ validation_loop:
   schema: schemas/code-result.schema.json
   max_iterations: 2
 
-# Environment variables available to pre/post scripts on the runner.
-# These are expanded from the runner environment and NEVER enter the sandbox.
+# Environment variables for runner pre/post scripts and sandbox sessions.
 env:
   runner:
     CODE_ALLOWED_TARGET_BRANCHES: "${CODE_ALLOWED_TARGET_BRANCHES}"
+    PUSH_TOKEN: "${PUSH_TOKEN}"
+    PUSH_TOKEN_SOURCE: "${PUSH_TOKEN_SOURCE}"
+    REPO_FULL_NAME: "${REPO_FULL_NAME}"
+    ISSUE_NUMBER: "${ISSUE_NUMBER}"
   sandbox:
     MAX_RETRIES: "1"
     TIMEOUT_SECONDS: "2100"
     GOPATH: "/sandbox/go"
     GOMODCACHE: "/sandbox/go/pkg/mod"
+    GIT_AUTHOR_NAME: "fullsend-code"
+    GIT_AUTHOR_EMAIL: "${GIT_BOT_EMAIL}"
+    GIT_COMMITTER_NAME: "fullsend-code"
+    GIT_COMMITTER_EMAIL: "${GIT_BOT_EMAIL}"
 
 timeout_minutes: 35
 
@@ -75,8 +82,6 @@ forge:
     openshell:
       profiles:
         - profiles/fullsend-github-code.yaml
-    pre_script: scripts/pre-code.sh
-    post_script: scripts/post-code.sh
     skills:
       - skills/github-forge
     host_files:
@@ -85,10 +90,6 @@ forge:
         expand: true
     env:
       runner:
-        PUSH_TOKEN: "${PUSH_TOKEN}"
-        PUSH_TOKEN_SOURCE: "${PUSH_TOKEN_SOURCE}"
-        REPO_FULL_NAME: "${REPO_FULL_NAME}"
-        ISSUE_NUMBER: "${ISSUE_NUMBER}"
         ISSUE_URL: "${GITHUB_ISSUE_URL}"
         GH_TOKEN: "${GH_TOKEN}"
         FULLSEND_FORGE: github
@@ -97,14 +98,8 @@ forge:
         ISSUE_URL: "${GITHUB_ISSUE_URL}"
         GH_TOKEN: "${GH_TOKEN}"
         FULLSEND_FORGE: github
-        GIT_AUTHOR_NAME: "fullsend-code"
-        GIT_AUTHOR_EMAIL: "${GIT_BOT_EMAIL}"
-        GIT_COMMITTER_NAME: "fullsend-code"
-        GIT_COMMITTER_EMAIL: "${GIT_BOT_EMAIL}"
   gitlab:
     policy: policies/gitlab/code.yaml
-    pre_script: scripts/pre-code.sh
-    post_script: scripts/post-code.sh
     skills:
       - skills/gitlab-forge
     host_files:
@@ -113,10 +108,6 @@ forge:
         expand: true
     env:
       runner:
-        PUSH_TOKEN: "${PUSH_TOKEN}"
-        PUSH_TOKEN_SOURCE: "${PUSH_TOKEN_SOURCE}"
-        REPO_FULL_NAME: "${REPO_FULL_NAME}"
-        ISSUE_NUMBER: "${ISSUE_NUMBER}"
         ISSUE_URL: "${GITLAB_ISSUE_URL}"
         GITLAB_TOKEN: "${GITLAB_TOKEN}"
         FULLSEND_FORGE: gitlab
@@ -125,7 +116,3 @@ forge:
         ISSUE_URL: "${GITLAB_ISSUE_URL}"
         GITLAB_TOKEN: "${GITLAB_TOKEN}"
         FULLSEND_FORGE: gitlab
-        GIT_AUTHOR_NAME: "fullsend-code"
-        GIT_AUTHOR_EMAIL: "${GIT_BOT_EMAIL}"
-        GIT_COMMITTER_NAME: "fullsend-code"
-        GIT_COMMITTER_EMAIL: "${GIT_BOT_EMAIL}"

harness/review.yaml

@@ -32,6 +32,9 @@ host_files:
     dest: /sandbox/workspace/prior-review.txt
     optional: true
 
+pre_script: scripts/pre-review.sh
+post_script: scripts/post-review.sh
+
 validation_loop:
   script: scripts/validate-output-schema.sh
   schema: schemas/review-result.schema.json
@@ -47,9 +50,13 @@ env:
   runner:
     REVIEW_FINDING_SEVERITY_THRESHOLD: "low"
     REVIEW_PROTECTED_PATHS: ".claude/,.cursor/,.gitattributes,.github/,.pre-commit-config.yaml,AGENTS.md,agents/,api-servers/,CLAUDE.md,CODEOWNERS,Containerfile,Dockerfile,harness/,images/,plugins/,policies/,profiles/,providers/,scripts/,skills/"
+    REPO_FULL_NAME: "${REPO_FULL_NAME}"
   sandbox:
     REVIEW_FINDING_SEVERITY_THRESHOLD: "low"
     REVIEW_PROTECTED_PATHS: ".claude/,.cursor/,.gitattributes,.github/,.pre-commit-config.yaml,AGENTS.md,agents/,api-servers/,CLAUDE.md,CODEOWNERS,Containerfile,Dockerfile,harness/,images/,plugins/,policies/,profiles/,providers/,scripts/,skills/"
+    REPO_FULL_NAME: "${REPO_FULL_NAME}"
+    PRIOR_REVIEW_SHA: "${PRIOR_REVIEW_SHA}"
+    PRIOR_REVIEW_PROVENANCE: "${PRIOR_REVIEW_PROVENANCE}"
 
 timeout_minutes: 20
 
@@ -61,8 +68,6 @@ forge:
       profiles:
         - profiles/fullsend-github-ro.yaml
     policy: policies/github/review.yaml
-    pre_script: scripts/pre-review.sh
-    post_script: scripts/post-review.sh
     skills:
       - skills/github-forge
       - skills/issue-labels/github
@@ -74,23 +79,17 @@ forge:
     env:
       runner:
         REVIEW_TOKEN: "${REVIEW_TOKEN}"
-        REPO_FULL_NAME: "${REPO_FULL_NAME}"
         PR_NUMBER: "${PR_NUMBER}"
         PR_URL: "${GITHUB_PR_URL}"
         GH_TOKEN: "${GH_TOKEN}"
         FULLSEND_FORGE: github
       sandbox:
-        REPO_FULL_NAME: "${REPO_FULL_NAME}"
         PR_NUMBER: "${PR_NUMBER}"
         PR_URL: "${GITHUB_PR_URL}"
         GH_TOKEN: "${GH_TOKEN}"
         FULLSEND_FORGE: github
-        PRIOR_REVIEW_SHA: "${PRIOR_REVIEW_SHA}"
-        PRIOR_REVIEW_PROVENANCE: "${PRIOR_REVIEW_PROVENANCE}"
   gitlab:
     policy: policies/gitlab/review.yaml
-    pre_script: scripts/pre-review.sh
-    post_script: scripts/post-review.sh
     skills:
       - skills/gitlab-forge
       - skills/issue-labels/gitlab
@@ -102,16 +101,12 @@ forge:
     env:
       runner:
         REVIEW_TOKEN: "${GITLAB_TOKEN}"
-        REPO_FULL_NAME: "${REPO_FULL_NAME}"
         PR_NUMBER: "${MR_NUMBER}"
         PR_URL: "${GITLAB_MR_URL}"
         GITLAB_TOKEN: "${GITLAB_TOKEN}"
         FULLSEND_FORGE: gitlab
       sandbox:
-        REPO_FULL_NAME: "${REPO_FULL_NAME}"
         PR_NUMBER: "${MR_NUMBER}"
         PR_URL: "${GITLAB_MR_URL}"
         GITLAB_TOKEN: "${GITLAB_TOKEN}"
         FULLSEND_FORGE: gitlab
-        PRIOR_REVIEW_SHA: "${PRIOR_REVIEW_SHA}"
-        PRIOR_REVIEW_PROVENANCE: "${PRIOR_REVIEW_PROVENANCE}"

harness/triage.yaml

@@ -45,8 +45,6 @@ forge:
     openshell:
       profiles:
         - profiles/fullsend-github-ro.yaml
-    pre_script: scripts/pre-triage.sh
-    post_script: scripts/post-triage.sh
     skills:
       - skills/github-forge
       - skills/issue-labels/github
@@ -65,8 +63,6 @@ forge:
         FULLSEND_FORGE: github
   gitlab:
     policy: policies/gitlab/triage.yaml
-    pre_script: scripts/pre-triage.sh
-    post_script: scripts/post-triage.sh
     skills:
       - skills/gitlab-forge
       - skills/issue-labels/gitlab
@@ -85,8 +81,6 @@ forge:
         FULLSEND_FORGE: gitlab
   jira:
     policy: policies/jira/triage.yaml
-    pre_script: scripts/pre-triage.sh
-    post_script: scripts/post-triage.sh
     skills:
       - skills/jira-forge
       - skills/issue-labels/jira