@codedology/code-forge 0.5.1 → 0.6.1

package/CHANGELOG.md

@@ -6,6 +6,65 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.6.1] — 2026-10-07
+
+### Added
+
+- Skill rule R17 "Never relax a rule alone": the orchestrator and any delegate never change, relax or remove a limit,
+  threshold, budget, forbidden entry, gate or review requirement without the owner; when a limit blocks work they stop,
+  show the data, propose options and wait. The skill also asks to supervise cost continuously (budget.usd, spend after
+  every block close).
+
+### Fixed
+
+- A verb run from a subfolder uses the project root (the git root, or the nearest regular `.code-forge.yml` below it;
+  outside git never above HOME) for its config and ledger slug: `jev`, `plan`, `author`, `facts`, `spawn`, `s2` and
+  `run start`. A `.git` at HOME (a dotfiles repo) does not make HOME a project.
+- `plan check` reads the list form of the "cannot back" section that the template shows, still reads the old table
+  form, and splits clauses on `;` and on ` · (n)`.
+- `facts`: a flag claim is proved only by `grep -rn -- <flag> <source folder>` (hits in source files under that
+  folder; docs, plans, tests, fixtures and the brief never count). The delegate never runs `--help`, `-h`, `--version`,
+  a pipe, a list or `rg`; grep options come from a fixed allow-list. No Claude allow rules are added.
+- A command claim written without its CLI (`run reload`) gets the project's own bin only when the brief names that bin
+  and the first word is not a well-known CLI.
+
+## [0.6.0] — 2026-10-06
+
+### Added
+
+- `code-forge autopilot start|status|stop` (issue #5): a time-boxed grant (at most 24 h) of owner decisions — allow
+  `waive:warning`, `waive:nit`, `round:extra`, `model:choose` — with a fixed deny list in code (critical or proof
+  waivers, skipping reviews, any limit or rule change incl. parent keys, plan/design approval, merges, destructive
+  actions, budget raises). Signed grant, stop and expire rows; expiry is checked at every command. Coders may not run
+  it.
+- `code-forge autopilot ask`: a closed-book delegate (never Codex) answers one owner question inside the grant; every
+  answer is one signed `autopilot.decision` row. It acts only when the question offers at least 2 options, the answer is
+  one of them, it is within scope, does not ask to escalate, and its confidence is at least `autopilot.min_confidence`
+  (default 0.7); otherwise the question goes to the owner (exit 3). `autopilot.*` counts as a limit key.
+- `code-forge autopilot waive|round|level`: actions that need the delegate's acted decision (`--decision <id>`, same
+  grant, scope and block/file/finding, at most 30 minutes old, with the matching word: `waive`, `allow` or the level).
+  Waivers cover warnings and nits only (severity read from the signed review rows) and are written `by: autopilot`; each
+  opens one tracked GitHub issue in the project's repo. The block gate accepts an autopilot waiver only under a grant
+  and decision that covered it. One extra fix round per file per grant; the coder level comes from the Jev lane, capped
+  at the plan level + 1 and L2.
+- Autopilot budget stop per category: with `--budget review=<usd>,coding=<usd>`, new sessions in a category are refused
+  once its spend since the grant started plus running reservations reaches `--stop-at` x cap ("autopilot paused: ...
+  waiting for the owner"), with one signed `autopilot.pause` row; `autopilot status` shows spend per category.
+  `code-forge autopilot approve --key --value --until` (owner only, in a terminal, no `--yes`) changes one setting until
+  a time and restores it automatically, crash-safe, with signed rows; a value changed by hand meanwhile is left alone.
+  While a grant is active, `run reload` refuses any limit key.
+- `code-forge autopilot binnacle` and `autopilot log`: the logbook of an autopilot run, in the shape of an overnight-run
+  page (status at a glance, decisions with why and what would reverse them, blocks, open questions, actions only you can
+  take, incidents, timeline newest first) plus a full log of every autopilot event. As JSON or as
+  `autopilot-binnacle.md` / `autopilot-log.md` in the run dir, rewritten after each delegate decision and scrubbed.
+  `--link <https url>` stores the live page's link.
+- Autopilot log page for your return: the skill (`skill/references/autopilot.md`) creates one Claude Docs doc per run
+  with a Binnacle tab (the title and byline, then 7 sections) and a Full log tab, stores its link first, updates only
+  the changed sections after each decision, block close or incident, and at stop adds the final rows and asks you to
+  review the open questions and your actions. `autopilot status` and `stop` print the link (or the Markdown file paths
+  without the Docs connector). Every owner stop in the skill says what autopilot may do there or that it is never
+  delegated. New `docs/autopilot.md`.
+
 ## [0.5.1] — 2026-10-04
 
 ### Changed

package/README.md

@@ -8,6 +8,40 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 > `examples/` have all landed (`docs/reference/blocks.json` lists every build block). What changed
 > in each version is in [CHANGELOG.md](CHANGELOG.md).
 
+## What's new in 0.6
+
+Next release (0.6.1):
+
+- **Never relax a rule alone.** A new skill rule (R17): the orchestrator and the delegate never
+  change, relax or remove a limit, threshold, budget, gate or review requirement. When a limit
+  blocks work they stop, show the data, propose options and wait for you.
+- **Fixes from using code-forge on itself.** A verb run from a subfolder now uses the project's
+  ledger and config. `plan check` reads the list form the template shows. `facts` checks a flag
+  with `grep -rn -- <flag> <source folder>` instead of `--help`, so the check runs in the
+  delegate's sandbox.
+
+In 0.6.0:
+
+- **Autopilot.** Step away for up to 24 hours. `code-forge autopilot start` grants a delegate (a
+  fresh closed-book L2 or L3 session, never Codex) a few of your decisions: waive a warning or a
+  nit, one extra fix round past the review cap, the coder level. The orchestrator asks the
+  delegate first (`autopilot ask`) and acts only on an answer it acted on. A fixed deny list in
+  the code keeps the rest yours: critical and proof waivers, skipping reviews, plan and design
+  approval, any limit or rule change, budget raises, merges, destructive actions. Every answer is
+  a signed ledger row; each waiver opens a GitHub issue. See [docs/autopilot.md](docs/autopilot.md).
+- **Budget per category.** `--budget review=<usd>,coding=<usd>` pauses a category at `--stop-at`
+  (default 0.9) of its cap until you return. `autopilot approve` (only you, at a terminal) changes
+  one setting until a time and puts it back by itself. While a grant is active, `run reload`
+  refuses any limit key.
+- **A live log for your return.** In Claude Code the orchestrator keeps one Claude Docs page per
+  run with two tabs: Binnacle (status at a glance, decisions, blocks, open questions, actions only
+  you can take, incidents, timeline) and Full log (every event, newest first). `autopilot status`
+  and `autopilot stop` print its link; without the connector they print two Markdown files in the
+  run dir (`autopilot binnacle`, `autopilot log`).
+- **From 0.5.x, not listed before:** two files of one block can no longer both take the block's one
+  L3 patch rung (0.5.0), and a maintainer can install a tagged release before it is on npm
+  ([getting-started](docs/getting-started.md#keeping-it-up-to-date), 0.5.1).
+
 ## What's new in 0.5
 
 - **Parallel review.** The worker reviews `review.parallel_tickets` files at once (default 3), with
@@ -131,7 +165,7 @@ usage line.
 | `validate` | `code-forge validate [--file <path>]` |
 | `resolve` | `code-forge resolve <L0\|L1\|L2\|L3>` |
 | `run` | `code-forge run start [--cwd <dir>] [--run <id>] [--engine <e>] [--worker-pid <pid>]` · `run start --reattach --run <id> [--worker-pid <pid>]` · `run status --run <id>` (with spent and budget USD) · `run reload --run <id>` (re-read `.code-forge.yml` mid-run) · `run end --run <id>` |
-| `block` | `code-forge block open <id> --run <r> --level L<n> --owned <paths…> --acceptance <file> [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <n>] [--kind code\|docs\|contract]` · `block attempt\|rebase <id> --run <r>` · `block close <id> --run <r> [--transcript <file>] [--report <file>] [--no-require-reviews]` · `block claim <id> <path> --run <r>` · `block stop <id> --run <r> --reason <text>` · `block waive <id> <finding-id> --run <r> --file <path> --reason <text>` (human-only) |
+| `block` | `code-forge block open <id> --run <r> [--level L<n>] --owned <paths…> --acceptance <file> [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <n>] [--kind code\|docs\|contract]` · `block attempt\|rebase <id> --run <r>` · `block close <id> --run <r> [--transcript <file>] [--report <file>] [--no-require-reviews]` · `block claim <id> <path> --run <r>` · `block stop <id> --run <r> --reason <text>` · `block waive <id> <finding-id> --run <r> --file <path> --reason <text>` (human-only) |
 | `worker` | `code-forge worker --run <id> [--cwd <dir>] [--poll-ms <n>] [--once]` — started detached by `run start`, never by a coder |
 | `review` | `code-forge review [--base <ref>] [--files <path…>] [--acceptance <file> \| --intent "<text>"] [--run <id>] [--max <seconds>] [--json] [--keep-run]` — review only: no coder, no proof, never closes a block |
 | `review-file` | `code-forge review-file <path> --block <id> [--run <id>]` (enqueue) · `review-file --wait <ticket> [--max <seconds>s]` (poll, default 90s; still running at `--max` prints `status: pending, reason: wait_timeout`) |
@@ -152,6 +186,7 @@ usage line.
 | `upgrade` | `code-forge upgrade [--source <path>]` |
 | `logs` | `code-forge logs [--last N] [--json]` · `logs summary [--days N] [--json]` · `logs clear [--yes]` · `logs path` — the local error log (`~/.code-forge/logs/errors.jsonl`): errors, warnings, and `[fixed in X.Y.Z]` marks |
 | `logs report` | `code-forge logs report [--last N] [--kind K] [--verb V] [--note "text"] [--include-warnings] [--with-doctor] [--no-ai] [--allow-old] [--force] [--dry-run] [--yes]` — share selected errors as a public GitHub issue; you see the full text first and say yes once. An error a newer version fixes is not filed unless `--force` |
+| `autopilot` | `code-forge autopilot start --run <id> --until <ISO-8601 with offset> --delegate <L2\|L3> --allow <scope,…> [--deny <scope,…>] [--budget <category>=<usd>,…] [--stop-at <0..1>] [--yes]` · `autopilot status --run <id> [--json]` · `autopilot stop --run <id>` (both print the live log's link, or the two Markdown files) · `autopilot ask --run <id> --scope <scope> --question <text> [--options a,b,…] [--context-file <path>] [--block <id>] [--file <path>] [--finding <id>] [--json]` · `autopilot waive\|round\|level … --decision <id>` · `autopilot approve --run <id> --key <dot.path> --value <json> --until <time>` (owner only, at a terminal) · `autopilot binnacle --run <id> [--json\|--markdown] [--link <https url>]` · `autopilot log --run <id> [--json\|--markdown]` — the owner's time-boxed grant to a delegate; see [docs/autopilot.md](docs/autopilot.md) |
 | `help` / `version` | `code-forge --help` (or no verb) · `code-forge --version` |
 
 `run`, `block`, `worker`, `spawn`, `s2`, `author`, `facts` and `review-file` are what the Agent
@@ -190,7 +225,8 @@ CLI verbs like any other and every one of them is exercised by this package's ow
 
 `schema/code-forge.schema.json` is the source of truth for `.code-forge.yml`.
 [docs/reference/config.md](docs/reference/config.md) lists every key with its type and default.
-Keys added in 0.4 and 0.5 (the last two rows are new in 0.5):
+Keys added in 0.4, 0.5 and 0.6 (`review.parallel_tickets` and `review.provider_concurrency` are
+new in 0.5, `autopilot.min_confidence` in 0.6):
 
 | Key | Default | What it does |
 |---|---|---|
@@ -204,6 +240,7 @@ Keys added in 0.4 and 0.5 (the last two rows are new in 0.5):
 | `review.session_timeout_s` | `300` | a review session that runs longer is killed and retried once |
 | `review.parallel_tickets` | `3` | review tickets the worker runs at once (1 to 16); `1` reviews one file at a time |
 | `review.provider_concurrency` | anthropic `4`, openai `2`, xai `2` | review sessions at once per provider |
+| `autopilot.min_confidence` | `0.7` | the lowest delegate confidence that is acted on; below it the question goes to you |
 
 `code-forge block open … --kind code|docs|contract` sets a block's kind when its file endings do
 not say it. The reference page is generated:

package/docs/README.md

@@ -9,16 +9,17 @@ disagree, the verb is right: each verb prints its own usage line when its argume
 | # | Page | Read it when you want to… |
 |---|---|---|
 | 1 | [overview.md](overview.md) | know what code-forge is, the problem it solves, who it is for, and what it is not |
-| 2 | [concepts.md](concepts.md) | look up a word: block, level, lane, tier, S1/S2, waiver, ledger, budget, block kind, closed book, known fix… |
-| 3 | [how-it-works.md](how-it-works.md) | follow the full workflow from a brief to a closed block, and see who does what and where state lives |
-| 4 | [getting-started.md](getting-started.md) | install it, answer `init`, run `doctor`, try the first commands, and read or report errors (`code-forge logs`) |
+| 2 | [concepts.md](concepts.md) | look up a word: block, level, lane, tier, S1/S2, waiver, ledger, budget, block kind, closed book, plan approval, owner rule, autopilot grant, known fix… |
+| 3 | [how-it-works.md](how-it-works.md) | follow the full workflow from a brief to a closed block (plan approval, parallel review, the escalation ladder, the rules the orchestrator keeps), and see who does what and where state lives |
+| 4 | [getting-started.md](getting-started.md) | install it, answer `init`, install the recommended tools (`code-forge tools`), run `doctor`, set a budget, upgrade, and read or report errors (`code-forge logs`) |
 | 5 | [tutorial-first-test.md](tutorial-first-test.md) | run one real end-to-end test: build the code-forge marketing site in a new repo |
 | 5a | [review-only.md](review-only.md) | only review code you already wrote: a branch, uncommitted work or some files, with CI exit codes |
+| 5b | [autopilot.md](autopilot.md) | step away while a run goes on: grant a delegate a few decisions for a set time, and review the live log (Binnacle and Full log) when you return |
 | 6 | [examples/marketing-site/brief.md](examples/marketing-site/brief.md) | copy the brief the tutorial uses |
 | 7 | [marketing.md](marketing.md) | read the product story: the problem, the promise, the honest limits |
 
 New to the tool? Read 1 → 3 → 4, then do 5. Keep 2 open as a glossary. Only want reviews? Read 4,
-then 5a.
+then 5a. Going away while a run goes on? Read 5b.
 
 ## Reference pages (already in the repo)
 

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 46,
+  "block_count": 54,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -606,6 +606,132 @@
         "B43"
       ],
       "note": "root-added 2026-10-03; plan plans/parallel-review (approved in plan mode)"
+    },
+    "B45": {
+      "title": "Autopilot grants: autopilot start/status/stop, scopes with a fixed deny list (incl. parents of limit keys), lazy expiry with signed grant/stop/expire rows; coders may not run autopilot",
+      "wave": 11,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/autopilot/scopes.mjs",
+        "src/autopilot/grant.mjs",
+        "src/cli/autopilot.mjs",
+        "test/cli/autopilot.test.mjs",
+        "test/autopilot/grant.test.mjs"
+      ],
+      "depends_on": [
+        "B44"
+      ],
+      "note": "root-added 2026-10-06; plan plans/autopilot (issue #5), approved in plan mode"
+    },
+    "B46": {
+      "title": "Autopilot delegate: closed-book delegate role (never Codex, opt-in or not), askDelegate (grant first, one session, one signed autopilot.decision row; acts only with options, in scope, no escalation, confidence >= autopilot.min_confidence), autopilot ask, doctor delegate pings; autopilot.* is a limit key",
+      "wave": 11,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/autopilot/delegate.mjs",
+        "src/doctor/probes.mjs",
+        "test/autopilot/delegate.test.mjs"
+      ],
+      "depends_on": [
+        "B45"
+      ],
+      "note": "root-added 2026-10-06; plan plans/autopilot (issue #5)"
+    },
+    "B47": {
+      "title": "Autopilot delegated actions, each on the delegate's acted decision with the matching word (waive / allow / the level): autopilot waive (warning or nit read from signed review rows, never critical or proof; tracked gh issue in the project repo, exact-marker dedupe; no gh => waiver stands + autopilot.issue_failed), gate accepts by:autopilot waivers only under a covering grant and decision, autopilot round (one extra fix round per file per grant), autopilot level (lane capped at plan + 1, max L2; block open uses it); re-checked under the run lock before writing",
+      "wave": 11,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/autopilot/actions.mjs",
+        "src/review/gate-check.mjs",
+        "src/util/gh.mjs",
+        "test/autopilot/actions.test.mjs"
+      ],
+      "depends_on": [
+        "B46"
+      ],
+      "note": "root-added 2026-10-06; plan plans/autopilot (issue #5); also amends src/autopilot/delegate.mjs, src/cli/autopilot.mjs, src/cli/block.mjs, src/cli/logs.mjs, src/review/fixloop.mjs, src/worker/engine.mjs"
+    },
+    "B48": {
+      "title": "Autopilot budget stop per category (review/coding caps at --stop-at, refused at the spawn budget gate under the B41 lock, one signed autopilot.pause row per category per grant, grantFor paused, status spend) and expiring owner approvals (autopilot approve: terminal only, no --yes, fixed keys and __proto__/constructor/prototype refused, applied through the run reload path, signed approve/restore/restore_skipped rows, crash-safe lazy restore at autopilot, block and worker drain); run reload refuses limit keys while a grant is active",
+      "wave": 11,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/autopilot/limits.mjs",
+        "src/session/spawn.mjs",
+        "src/worker/loop.mjs",
+        "src/cli/block.mjs",
+        "src/cli/run.mjs",
+        "test/autopilot/expiry.test.mjs"
+      ],
+      "depends_on": [
+        "B47"
+      ],
+      "note": "root-added 2026-10-06; plan plans/autopilot (issue #5); also amends src/autopilot/grant.mjs, src/autopilot/scopes.mjs, src/cli/autopilot.mjs, src/state/run.mjs (reloadRun guard), src/config/load.mjs (slugFor moved from cli/run.mjs), src/cli/{author,facts,jev,plan,s2,spawn}.mjs (slugFor import), test/cli/autopilot.test.mjs"
+    },
+    "B49a": {
+      "title": "Autopilot binnacle and full log: autopilot binnacle builds the owner's 8-section logbook (status at a glance, decisions with why and reversal, blocks, open questions, actions only the owner can take, incidents, timeline) and autopilot log lists every autopilot row, as JSON or Markdown files in the run dir (rewritten after each decision, scrubbed with the workspace as <project>); --link stores the live page link with a signed row",
+      "wave": 11,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/autopilot/binnacle.mjs",
+        "test/autopilot/binnacle.test.mjs"
+      ],
+      "depends_on": [
+        "B48"
+      ],
+      "note": "root-added 2026-10-06; plan plans/autopilot (issue #5); also amends src/autopilot/delegate.mjs (refresh hook), src/cli/autopilot.mjs"
+    },
+    "B49b": {
+      "title": "Autopilot live log artifact and skill text: skill/references/autopilot.md (one Claude Docs doc per run with a Binnacle tab - title and byline, then 7 sections - and a Full log tab; link stored first; only changed sections updated; stop adds the final rows and asks the owner to review), Autopilot notes at every owner stop, the never-delegated list, autopilot status/stop print the link or the Markdown paths, docs/autopilot.md, README, concepts",
+      "wave": 11,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "skill/references/autopilot.md",
+        "docs/autopilot.md",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B49a"
+      ],
+      "note": "root-added 2026-10-06; plan plans/autopilot (issue #5); also amends src/cli/autopilot.mjs, skill/SKILL.md, skill/references/{decisions,review,harden,plan,code}.md, skill/references/adapters/claude-code.md, README.md, docs/README.md, docs/concepts.md, docs/getting-started.md"
+    },
+    "B50": {
+      "title": "Dogfood tool fixes: the project root (git root, or the nearest regular .code-forge.yml below it; outside git never above HOME) sets the config and ledger slug for every verb run from a subfolder; plan check reads the list form and the old table form of the cannot-back section and splits clauses on ';' and ' · (n)'; the facts delegate proves a flag only with grep -rn -- <flag> <source folder> (exact option allow-list, no --help, no pipes, no rg, hits only in source files under the path); a command claim without its CLI gets the project bin only when the brief names it",
+      "wave": 11,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/config/load.mjs",
+        "src/session/plan-check.mjs",
+        "src/session/facts.mjs",
+        "test/session/plan-check.test.mjs",
+        "test/session/facts.test.mjs"
+      ],
+      "depends_on": [
+        "B49b"
+      ],
+      "note": "root-added 2026-10-06; dogfood findings from plans/parallel-review §6.1 and plans/autopilot; no Claude allow rules (rejected: an allow-list of commands is unsafe); also amends src/cli/{author,facts,jev,plan,run,s2,spawn}.mjs, src/autopilot/limits.mjs, skill/references/plan.md, skill/templates/plan.md, docs/how-it-works.md, docs/tutorial-first-test.md"
+    },
+    "B51": {
+      "title": "Skill rule R17 'Never relax a rule alone' and cost supervision; owner rules and docs gaps filled",
+      "wave": 11,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "skill/references/rules-core.md",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B49b"
+      ],
+      "note": "root-added 2026-10-06; also amends skill/SKILL.md, skill/references/{autopilot,decisions,ledger}.md, README.md, docs/*"
     }
   }
 }

package/docs/reference/config.md

@@ -171,4 +171,6 @@ Every other key defaults as shown, or is entirely absent from a minimal file. `a
 | `keys.<key>` | string |  | — | user-defined key |
 | `tmp` | object |  | — |  |
 | `tmp.root` | string \| null |  | `null` |  |
+| `autopilot` | object |  | — |  |
+| `autopilot.min_confidence` | number |  | `0.7` | min 0; max 1; B46: the lowest confidence at which the autopilot delegate's answer is acted on; below it the question goes to the owner. |
 | `telemetry` | const `"off"` |  | `"off"` |  |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.5.1",
+  "version": "0.6.1",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",

package/schema/code-forge.schema.json

@@ -306,6 +306,13 @@
         }
       }
     },
+    "autopilot": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "min_confidence": { "type": "number", "minimum": 0, "maximum": 1, "default": 0.7, "description": "B46: the lowest confidence at which the autopilot delegate's answer is acted on; below it the question goes to the owner." }
+      }
+    },
     "telemetry": { "type": "string", "const": "off", "default": "off" }
   },
   "$defs": {

package/skill/SKILL.md

@@ -62,6 +62,7 @@ State lives in the plan file's header — `facts → planned → hardened → co
 - **R14** No design before facts
 - **R15** Re-checks shrink: fix hunks only, four rounds, then a patch, then a human
 - **R16** Proof is exact assertions on the main behaviour
+- **R17** Never relax a rule alone
 
 ## §5 Where to read more
 
@@ -77,4 +78,5 @@ State lives in the plan file's header — `facts → planned → hardened → co
 | takeover, base moves | `references/continuity.md` |
 | no Solo, no subagent tool, a level unavailable | `references/degraded.md` |
 | keys, the forbidden list, signed rows and their limit | `references/security.md` |
+| the owner is away: an autopilot grant, the delegate, the live log doc | `references/autopilot.md` |
 | spawning coders per engine | `references/adapters/solo.md`, `references/adapters/claude-code.md`, `references/adapters/subprocess.md` |

package/skill/references/adapters/claude-code.md

@@ -21,3 +21,17 @@ The plan goes to the owner through plan mode (`plan.md` §4.1): `EnterPlanMode`
 ## §3 What is lost and what is not
 
 Lost: live observation of the coder (only the progress log and the final report), a resumable transcript (a lost subagent is re-dispatched with the fix history in a new brief — `continuity.md` §2). Not lost: session isolation, signed rows, the gate, the ladder, the facts rule, the convergence rule (`degraded.md` §2).
+
+## §4 Autopilot — the live log doc (Claude Docs connector)
+
+At `forge autopilot start` (`autopilot.md` §1) the run gets ONE doc through the Claude Docs connector. Follow the connector's own guide (`guide` → `topic.index`, `topic.tabs`). The steps:
+
+0. **One doc per run:** `forge autopilot status --run <r>` first. A link there ⇒ the doc exists (a lost session left it): continue in it from step 5, never birth a second one.
+1. **Birth, one `batch`:** a new doc named `<project> autopilot run — <date>`. The main tab **Binnacle** follows `forge autopilot binnacle --run <r> --json`: the title and byline, then 7 sections: Status at a glance, Decisions, Blocks, Open questions, Actions only you can take, Incidents, Timeline — one `pending` block per section. A second tab **Full log** is born in the same batch with one `pending` block for its table. The last member places both: Binnacle `order "a0"`, Full log `order "a1"`.
+2. **Store the link at once,** from the birth ack: `forge autopilot binnacle --run <r> --link <url>`.
+3. **Open it** with the Artifact tool's `open` action and that link (no `open` action: give the link in your next message, once).
+4. **Fill one section per `update`**, in reading order: replace each Binnacle pending block with `## <heading>` and its table or list from the JSON; then the Full log tab's pending block with one pipe table from `forge autopilot log --run <r> --json`, newest first.
+5. **During the window:** after each decision, block close or incident, one `update` per changed section — insert the new Decisions row, insert the new Timeline row at the top, replace only the Status cells that changed — and insert the new rows at the top of the Full log table. Never resend the whole doc. A refused edit (`guard_mismatch`, `find_none`) means the owner edited it: re-read that section, keep their edit, apply only the new row(s); never `force`.
+6. **At stop:** after `forge autopilot stop --run <r>`, insert the stop event as the newest Timeline row and the newest Full log row, then replace the Status at a glance section with the final values. The doc stays as the run's record. Tell the owner in chat: the link, and "review Open questions and Actions only you can take before work resumes".
+
+No Claude Docs connector: skip the doc. The Markdown files in the run dir are the record, and `status` and `stop` print their paths (`autopilot.md` §4).

package/skill/references/autopilot.md

@@ -0,0 +1,48 @@
+# Autopilot — the owner steps away; a delegate decides inside a grant; one live doc records it all
+
+Autopilot lets the owner leave for a set time. A delegate (a fresh L2 or L3 session) answers some owner questions inside a time-boxed grant. Everything it does is a signed ledger row, and one live doc shows it. You start nothing on your own: autopilot exists only when the owner asks for it.
+
+## §1 Start — only after the owner asks
+
+1. The owner asks for autopilot and names the window, the delegate level and the scopes. Run `forge autopilot start --run <r> --until <ISO-8601 with offset> --delegate <L2|L3> --allow <scope,…> [--deny <scope,…>] [--budget <category>=<usd>,…] [--stop-at <0..1>]`. The owner confirms it at the prompt. Never pass `--yes` unless the owner said so in chat.
+2. **One doc per run.** First run `forge autopilot status --run <r>`: a link there means the doc exists (a lost session left it) — continue in it, never create a second doc for the same run. No link: create ONE Claude Docs doc titled `<project> autopilot run — <date>` with two tabs, born in one call (the exact steps: `adapters/claude-code.md` §4).
+   - **Binnacle** (the main tab): its outline is `forge autopilot binnacle --run <r> --json` — the title and byline, then 7 sections: Status at a glance, Decisions, Blocks, Open questions, Actions only you can take, Incidents, Timeline. One pending block per section.
+   - **Full log**: one table from `forge autopilot log --run <r> --json` — Time, Event, Block, File, Detail, Link — newest first. One pending block for it.
+3. **Store the link first**, right after the birth (its ack gives the link): `forge autopilot binnacle --run <r> --link <url>`. From now on `forge autopilot status` and `forge autopilot stop` print it.
+4. Open the doc for the owner, then fill one section per call, in reading order: the 7 Binnacle sections, then the Full log table. Never write the whole doc in one call.
+
+## §2 During the window
+
+- **Every owner-level question goes to the delegate first**: `forge autopilot ask --run <r> --scope <scope> --question <text> --options <words> [--block <id>] [--file <path>] [--finding <id>]`. Use the fixed option words, or the action will refuse the answer: a waiver `waive,fix` · an extra round `allow,deny` · a coder level the candidate levels, e.g. `L1,L2`.
+- **Act only when it acted** (exit 0): run the action with `--decision <id>` from the answer — `forge autopilot waive|round|level … --decision <id>`. Exit 3 means the question goes to the owner: leave it open, it shows under Open questions. Exit 1 means the grant refused it: also the owner's.
+- **A paused category** (`autopilot paused: … waiting for the owner`): wait. Never raise the cap, never route around it.
+- **Keep the doc current — only what changed.** After every decision, block close or incident: re-read `forge autopilot binnacle --run <r> --json` and `forge autopilot log --run <r> --json`, then
+  - append the new row to the Binnacle's Decisions table;
+  - put the new row at the top of the Timeline (newest first);
+  - update the Status at a glance cells that changed (and Blocks, Open questions, Actions or Incidents when they changed);
+  - add the new rows to the Full log tab's table, at the top (it is newest first too).
+  Never rewrite the whole doc and never replace a section that did not change.
+- **A refused edit** (`guard_mismatch`, `find_none`) means the owner edited that section: re-read it, keep the owner's edit, and apply only the new row(s). Never force. Answer an owner's comment in its own thread.
+- **A lost session:** the next one reads the link from `forge autopilot status --run <r>` and continues in the same doc.
+
+## §3 Stop — at the owner's return or `until`
+
+1. `forge autopilot stop --run <r>` when the owner is back (at `until` the grant expires by itself; `forge autopilot status --run <r>` then says so).
+2. Add the stop (or expiry) event as the newest Timeline row and the newest Full log row, then write the final Status at a glance (the window's end, the result, the spend). Leave the doc as the record of the run; do not delete or move it.
+3. Tell the owner in chat: the link, and "review Open questions and Actions only you can take before work resumes".
+
+## §4 Without the Docs connector
+
+Another harness, or the connector is missing: the two Markdown files in the run dir are the record. At start, run `forge autopilot binnacle --run <r> --markdown` once: it creates `autopilot-binnacle.md` and `autopilot-log.md`; print both paths for the owner. After that the CLI rewrites both files by itself, after every delegate decision and at every `forge autopilot status` and `forge autopilot stop`, and those two commands print both paths. At stop, tell the owner the two paths and the same review line as §3.
+
+## §5 Never delegated — always the owner
+
+These never go to the delegate, whatever the grant says (the CLI's fixed deny list refuses them too):
+
+- plan approval (`plan.md` §4.1) and design approval;
+- a budget raise (`code.md` §6, `review.md` §7);
+- a threshold edit or any other limit or rule change — only the owner's own `forge autopilot approve` at a terminal;
+- a critical waiver, a proof waiver, or closing a block without its reviews;
+- merges and destructive actions.
+
+When one of these comes up during the window: stop that line of work, add it to Actions only you can take, and wait. The delegate never relaxes a rule or a limit to keep work moving (`rules-core.md` R17).

package/skill/references/code.md

@@ -45,7 +45,7 @@ The coder's report is a claim sheet. The gate reproduces each number in the meas
 
 ## §6 Budget — the stop is the feature (R6)
 
-`budget.block_lines` and `budget.block_cases` bind the plan; the gate's 1.25 × stop binds the block. A coder that overruns and stops before expanding did the right thing: never compress or defer coverage to fit. One raise per run, by the human, logged; a second overrun in the same run re-decomposes at the architect level. A post-acceptance ruling that adds required lines re-baselines the cap at ruling time, priced from the assertions it orders; a STOP defined mid-turn binds from the coder's next reported boundary. A coder never trims to fit; landing exactly on a cap is a tell that is checked. Review tokens count toward `budget.block_tokens_soft` / `budget.block_tokens_hard` (`review.md` §7).
+`budget.block_lines` and `budget.block_cases` bind the plan; the gate's 1.25 × stop binds the block. A coder that overruns and stops before expanding did the right thing: never compress or defer coverage to fit. One raise per run, by the human, logged; a second overrun in the same run re-decomposes at the architect level. **Autopilot:** a budget raise is never delegated, and neither is `--no-require-reviews` or a merge (`autopilot.md` §5). A post-acceptance ruling that adds required lines re-baselines the cap at ruling time, priced from the assertions it orders; a STOP defined mid-turn binds from the coder's next reported boundary. A coder never trims to fit; landing exactly on a cap is a tell that is checked. Review tokens count toward `budget.block_tokens_soft` / `budget.block_tokens_hard` (`review.md` §7).
 
 ## §7 The PR contract — a draft PR only after independent review
 

package/skill/references/decisions.md

@@ -50,4 +50,6 @@ A fresh L3 session receives the failure evidence — the last attempt's diff, th
 
 ## §7 What reaches the human
 
-`next = stop`, `review.over_budget`, an orphan file, `worker_down`, `review_cap`, `redecompose`, `ask_human`, a security question, consensus unavailable, and one budget raise per run. Everything else is decided by S1, S2 or the rules above and recorded.
+`next = stop`, `review.over_budget`, an orphan file, `worker_down`, `review_cap`, `redecompose`, `ask_human`, a security question, consensus unavailable, and one budget raise per run. Everything else is decided by S1, S2 or the rules above and recorded. A change to a rule, limit or check is never decided here: it always reaches the owner (`rules-core.md` R17).
+
+**Autopilot:** while a grant is active, a warning or nit waiver, one extra round at `review_cap` and a coder level go first to the delegate (`forge autopilot ask`, then `forge autopilot waive|round|level --decision <id>` only when it acted, `autopilot.md` §2). Never delegated: `next = stop`, `ask_human`, a security question, a critical finding, a budget raise, `redecompose` — they wait for the owner (`autopilot.md` §5).

package/skill/references/harden.md

@@ -4,7 +4,7 @@
 
 `forge author --job harden --brief <brief> --facts <sheet> --draft <plan> [--answers <file>] --out <plan>` runs a fresh L3 closed-book session over the brief, the facts sheet, the current draft and the answers so far. It returns `{draft, questions: [{id, question, options[], why, blocking}], cost}`.
 
-Loop: write the draft to the plan file → print `questions[]` to the human in chat (and to the Solo scratchpad when present) → collect answers into `<answers file>` → re-run with `--draft` and `--answers`. Stop when **no blocking question is left**: `questions[]` is empty, or every remaining item is non-blocking and the human chose to skip it — a skipped question is written into the plan's Q&A as `skipped` with the human's word, never silently dropped. Each round prints its cost. **The human answers; the orchestrator never answers for them.** Under Solo the human may run harden as an interactive L3 session (`harness.solo.interactive_harden`).
+Loop: write the draft to the plan file → print `questions[]` to the human in chat (and to the Solo scratchpad when present) → collect answers into `<answers file>` → re-run with `--draft` and `--answers`. Stop when **no blocking question is left**: `questions[]` is empty, or every remaining item is non-blocking and the human chose to skip it — a skipped question is written into the plan's Q&A as `skipped` with the human's word, never silently dropped. Each round prints its cost. **The human answers; the orchestrator never answers for them.** **Autopilot:** never delegated — harden questions wait for the owner, grant or not (`autopilot.md` §5). Under Solo the human may run harden as an interactive L3 session (`harness.solo.interactive_harden`).
 
 ## §2 What the L3 session interrogates (so you can judge its questions)
 

package/skill/references/ledger.md

@@ -18,6 +18,8 @@ Terminal output in this version. Sections: cost per block — completed and stil
 
 Every `session` row carries `usd` (tokens × the static price table) or `usd: null, usd_unknown: true` when the provider/level has no price — never a guess; a `session.background` coder's price is always unknown. Spend code-forge never saw (a cloud or hand-run coder) goes in with `forge ledger add coder --run <r> --block <b> --usd <n> [--note "..."]`, a signed `session` row with `manual: true`. With `budget.usd` set, every session spawn first sums the run's spend: at 80 % one `budget.warning` row and one stderr line per run; at 100 % the session is refused (`budget.usd 20.00 reached (spent 20.13); raise budget.usd or end the run`), a `budget.refused` row is written, nothing is spawned, and a review reports `review.unavailable {reason: budget}`. A budget whose spend cannot be read refuses too (fail closed).
 
+Watch the cost the whole run, not only at the end: ask the owner for a `budget.usd` before the first block when the project has none, read `spent_usd` / `budget_usd` in `forge run status` after every block close, and record cloud or hand-run coder spend with `forge ledger add coder` as soon as it is known. A budget stop is the owner's call (`rules-core.md` R6, R17).
+
 Sessions that run at the same time (B41): each session first takes its provider slot, then — under one in-process lock per run — reads the spend, checks it and reserves its estimated cost (the packet's bytes / 4 in, plus a fixed tokens_out per role and level, priced with the same table; a session waiting for a slot reserves nothing). A session is refused when spent + reserved by running sessions + its own estimate passes the budget: `budget.usd 20.00 would be exceeded: spent 3.10, reserved by running sessions 15.80, this session about 1.92; it starts when running sessions finish or when budget.usd is raised`, or, when its estimate alone is above the budget, `this session's estimated cost (about 64.00) is above budget.usd 20.00; raise budget.usd`; the `budget.refused` row then carries `reserved_usd` and `estimate_usd`. The reservation is released when the session's row is written, or when the spawn fails or throws. The 80 % warning is checked under the same lock, so it is written once per run.
 
 Known limits, accepted: unknown-price sessions and `session.background` coders add **0** to the spent total — record their real cost with `forge ledger add coder --usd <n>`; a background coder's reservation is released at its start row, since its cost is never seen; a session refused because of running sessions' reservations is refused, not queued — run it again once they finish; `forge run status` shows `unknown_usd_sessions` and prints `N sessions have no known price; the budget does not count them` when N > 0. The lock and the reservations live in one process only: two separate code-forge processes starting a session of one run at the same moment can still each pass the check or each write a `budget.warning` row.

package/skill/references/plan.md

@@ -4,8 +4,8 @@
 
 Run `forge facts --brief <brief> [--sources <path>...] --out <plans_dir>/<slug>.facts.md` before anything else. What it does:
 
-1. Deterministic: the CLI extracts every *claim token* from the brief and the sources it names — CLI flags, `<cli> <verb>` commands, paths, versions, endpoints, package names, environment variable names — and writes a claim list.
-2. One L0 session whose cwd is a **read-only snapshot of the repository at HEAD plus the `--sources` files**, built under the run's temp root and removed at session end — so `./path` claims are checkable, while **uncommitted files are not visible unless named as sources** (the snapshot is HEAD, not the working tree) — and whose packet is the claim list and the rule "run the cheapest read-only check, quote the command and the output line, tag VERIFIED / NOT-FOUND / UNVERIFIABLE, never infer". Two lines of defence, exactly as built. **First, at spawn:** the session gets the shell tool only, with the forbidden list plus every write verb rendered as deny rules and the provider's restricted mode (file tools confined to the working directory). There is no pre-execution gate on individual commands beyond those deny rules: the delegate runs what it runs. **Second, after the fact:** the CLI checks every `command` the delegate reports against an allow-list, fail closed, and refuses the whole sheet on the first violation. Allowed forms: `ls cat head tail wc grep rg stat file uname sw_vers jq which` with in-cwd arguments (`grep` never recursive), `find` with only these predicates — `-name -iname -path -ipath -type -maxdepth -mindepth -print -print0 -newer -size -empty -mtime -mmin -not ! -a -o -and -or` — every other predicate refused, `git log|show|status|rev-parse|ls-files|cat-file|--version`, `npm view|ls|--version`, `node --version`, `test -e|-f|-d|-n <one operand>`, `curl` as a HEAD request of exactly one http(s) URL with `-s -S -I -L -f --max-time <N>` only, and `<cli> --help|-h|--version` for a bare CLI name that is not a build runner; an env claim is only `printenv NAME >/dev/null` with its excerpt blanked. Refused anywhere: backticks, `$`, redirection, unquoted globs, `~`, `..`, absolute paths outside `/usr`, `/opt/homebrew`, `/bin`, and secret-looking paths. **`npm view` and `curl -I` reach the network** — they are what makes a package version or an endpoint checkable; nothing else the delegate may run does.
+1. Deterministic: the CLI extracts every *claim token* from the brief and the sources it names — CLI flags, `<cli> <verb>` commands, paths, versions, endpoints, package names, environment variable names — and writes a claim list. A `<cli> <verb>` written without its CLI (`run reload`) whose first word is not one of the project's CLIs, not a well-known CLI (`git gh npm npx node pnpm yarn bun deno ls cat grep which find test make docker curl claude codex python python3 pip go cargo op`), and that the brief never uses as a CLI of its own (`` `gh` `` or `` `gh --repo x` `` in a code span) — decided from the brief and `package.json` alone, never PATH — becomes `<project CLI> <verb>` (`code-forge run reload`) when the brief itself (not a source) names one of the project's CLIs (its `package.json` `bin` names) as a whole word — `.code-forge.yml` or `code-forge.config` do not count; `plan check` then counts a clause citing `run reload` as backed by that VERIFIED fact, and only when the extra word is one of the project's own CLIs.
+2. One L0 session whose cwd is a **read-only snapshot of the repository at HEAD plus the `--sources` files**, built under the run's temp root and removed at session end — so `./path` claims are checkable, while **uncommitted files are not visible unless named as sources** (the snapshot is HEAD, not the working tree) — and whose packet is the claim list and the rule "run the cheapest read-only check, quote the command and the output line, tag VERIFIED / NOT-FOUND / UNVERIFIABLE, never infer". Two lines of defence, exactly as built. **First, at spawn:** the session gets the shell tool only, with the forbidden list plus every write verb rendered as deny rules and the provider's restricted mode (file tools confined to the working directory). Nothing is pre-approved: the delegate only runs what the provider already treats as read-only. A flag claim is therefore checked in the project's **source text**, never by running a program: `grep -rn -- <flag> <path>` over a top-level source folder of the snapshot such as `src` (never `.` or the root); it is VERIFIED only when the claim is that flag and the excerpt has a `file:line:text` hit from a source file — not `.md`/`.markdown`/`.txt`, not under `docs/ plans/ test/ tests/ fixtures/ node_modules/`, not the brief, and under the grep's path — holding the flag as a whole token (`--force-push` does not prove `--force`); a NOT-FOUND counts only over one whole top-level source folder that exists as a directory in the snapshot (not hidden, not `dist build coverage out` or the folders above). The grep's path must be an existing source directory of the snapshot (a nested one such as `src/cli` is fine for VERIFIED; a single file never is), and no other command — a plain grep included — ever proves or disproves a flag. Every check is ONE command: no pipe and no list (`| ; && || &`). There is no pre-execution gate on individual commands beyond the deny rules: the delegate runs what it runs. **Second, after the fact:** the CLI checks every `command` the delegate reports against an allow-list, fail closed, and refuses the whole sheet on the first violation. Allowed forms (never `rg`, which searches recursively by default): `ls cat head tail wc grep stat file uname sw_vers jq which` with in-cwd arguments (`grep` options only `-n -c -i -w -F` before `--`, recursive only as the whole command `grep -rn -- <--long-flag> <path>` with one relative subfolder or file, never `.` or a secret path), `find` with only these predicates — `-name -iname -path -ipath -type -maxdepth -mindepth -print -print0 -newer -size -empty -mtime -mmin -not ! -a -o -and -or` — every other predicate refused, `git log|show|status|rev-parse|ls-files|cat-file`, `npm view|ls`, `test -e|-f|-d|-n <one operand>`, and `curl` as a HEAD request of exactly one http(s) URL with `-s -S -I -L -f --max-time <N>` only. No program ever runs with `--help`, `-h` or `--version` (BSD `rm foo --help` deletes `foo`): a version claim is checked with `npm view`, `which` or `ls`; an env claim is only `printenv NAME >/dev/null` with its excerpt blanked. Refused anywhere: backticks, `$`, redirection, unquoted globs, `~`, `..`, absolute paths outside `/usr`, `/opt/homebrew`, `/bin`, and secret-looking paths. **`npm view` and `curl -I` reach the network** — they are what makes a package version or an endpoint checkable; nothing else the delegate may run does.
    **Path claims:** `./path` claims resolve against the HEAD snapshot, so a committed file is VERIFIED or NOT-FOUND by a plain `ls`/`test -e`; a file that exists only uncommitted in the working tree reads NOT-FOUND unless you passed it with `--sources`. `~/…` claims stay UNVERIFIABLE (`~` is refused), and absolute paths are allowed only under `/usr`, `/opt/homebrew` and `/bin`; a home-directory path that matters to a block is checked by you with one read-only command and recorded in the unbackable list with that command as the tolerance.
 3. Deterministic again: the answer is validated against the facts schema, rendered with `templates/facts-sheet.md`, and refused when a VERIFIED tag has no output excerpt. Every claim, command and excerpt passes through the redactor. The header records the brief's sha and mtime.
 
@@ -23,7 +23,7 @@ Run `forge facts --brief <brief> [--sources <path>...] --out <plans_dir>/<slug>.
 | `owned_files` | exact paths or disjoint globs; a glob never contains `[ ] ( ) ! + @` (an exact path may); pairwise disjoint across blocks that can run together |
 | `depends_on` | acyclic; a block imports only modules of blocks it depends on — a batch-mate's module is a `next = stop` |
 | `level` | the S1 `lane` answer recorded for the block — `forge jev ask lane --block <id> --plan <plan> --state <file>`, or `--rules` (the deterministic fallback) when Jev is unavailable; never a block category (`L0` trivial · `L1` a plain feature following a pattern · `L2` money, dates, tenancy, migrations, concurrency · `split` too large or two concerns); **L3 is not a lane** |
-| `acceptance` | clauses that each name ≥ 1 test id; a clause citing a flag, path, version or API cites a VERIFIED fact id or sits in the unbackable list with a tolerance naming this block |
+| `acceptance` | clauses that each name ≥ 1 test id, numbered `(1) … · (2) …` or separated by `;` (`plan check` splits the cell on both and checks each clause on its own); a clause citing a flag, path, version or API cites a VERIFIED fact id or sits in the unbackable list with a tolerance naming this block |
 | `cases`, `lines` | forecasts: `cases = 2 × counted clauses`, `lines = 26 × cases` with a floor of 1 200 for a greenfield block and 500 for an amendment; above `budget.block_cases` or `budget.block_lines` the block is split in the plan, never "split-ready" |
 | `test_command` | a quoted glob or an explicit file list, never a bare directory |
 | `commit_message` | house style |
@@ -36,7 +36,7 @@ Every clause of the parent's acceptance maps to exactly one block; an unmapped c
 
 ## §4 The deterministic exit — `forge plan check <plan> [--facts <sheet>]`
 
-Prints every failing row by name and exits 1 on any of: an acceptance clause with a claim token that resolves to no VERIFIED fact and no tolerance row (`unbackable clause without tolerance: <block> <clause>`); a missing caller map or a block absent from it; a block without `cases` and `lines`; a forecast above `budget.block_cases` / `budget.block_lines` without a named split; overlapping `owned_files` in one wave; a cyclic `depends_on` or an import of a batch-mate; a glob with `[ ] ( ) ! + @`; more than `caps.coders` concurrent blocks in a slot; `questions[]` still open; the facts sheet's sha absent from the draft; a block whose level has no recorded lane, or differs from it (`block <id>: level L2 differs from the recorded lane L1 (jev)`). A required section under a near-miss heading at its template position (§0.x, §3) passes with a `WARN` naming the exact heading. stdout ends with the lane recorded per block (`lanes: B1 L1 (jev) · B2 L0 (rules)`). Green ⇒ set `status: hardened` after the harden job (`harden.md`), never before.
+Prints every failing row by name and exits 1 on any of: an acceptance clause with a claim token that resolves to no VERIFIED fact and no tolerance line (`unbackable clause without tolerance: <block> <clause>`) — a tolerance line is a list item of §0.x naming the block, the token and the word `tolerance`, as `templates/plan.md` shows (`- B3 \`--flag\` (F4, UNVERIFIABLE) — tolerance: …`); a row of the older table form with a filled tolerance column still counts (`—`, `-`, `…`, `n/a` and the like are empty); a missing caller map or a block absent from it; a block without `cases` and `lines`; a forecast above `budget.block_cases` / `budget.block_lines` without a named split; overlapping `owned_files` in one wave; a cyclic `depends_on` or an import of a batch-mate; a glob with `[ ] ( ) ! + @`; more than `caps.coders` concurrent blocks in a slot; `questions[]` still open; the facts sheet's sha absent from the draft; a block whose level has no recorded lane, or differs from it (`block <id>: level L2 differs from the recorded lane L1 (jev)`). A required section under a near-miss heading at its template position (§0.x, §3) passes with a `WARN` naming the exact heading. stdout ends with the lane recorded per block (`lanes: B1 L1 (jev) · B2 L0 (rules)`). `plan check` and `jev ask` may run from any folder of the project: both read the project root's config and ledger (the nearest `.code-forge.yml` file up to the git top level, else the git top level; outside git, never above the home directory, and only the folder itself when it is not under home), never a subfolder's name. `author`, `facts`, `spawn`, `s2` and `run start` read the same root. Green ⇒ set `status: hardened` after the harden job (`harden.md`), never before.
 
 ### §4.1 Owner approval in plan mode
 
@@ -47,6 +47,8 @@ A plan that passed `forge plan check` still needs the owner's yes before any blo
 
 Never treat a chat summary of the plan as the approval step, and never start `forge block open` before it.
 
+**Autopilot:** plan approval is never delegated. Under a grant the plan waits for the owner (`autopilot.md` §5).
+
 ## §5 Cost
 
 One L0 session per plan for the facts (typically a claim list of 40–80 items) and one L3 session per author round; `forge report --slug <slug>` shows both as `facts $` and coder/review splits.

package/skill/references/review.md

@@ -30,7 +30,7 @@ Per file, per block:
 3. **Strictly shrinking**: the open `fix_now` set after round n is smaller than after round n−1, counting closures minus new in-hunk findings. Equal or larger ⇒ `review_stall` (rule 2b), a trigger at once.
 3a. **Heavy rounds climb at once** (`review_warnings`, `decisions.md` §5 rule 3a): below L2, a round — round 1 included — that leaves ≥ `escalation.warning_threshold` (2) warnings or any `critical` open, `escalation.after_rounds_with_warnings` (1) times at the current level, climbs one level for the next fix. One round with a stronger model is faster and cheaper than three with a cheap one. The per-file cap (step 5) stays the outer limit.
 4. **Ladder**: the running ceiling is `min(L2, escalation.stop_at)` — L3 is never a *running* level. A trigger — rule 1 (`retries`), rule 2 (`escalation.review_rounds_per_level` exhausted with an open `fix_now`), rule 2b (`review_stall`) or step 3a (`review_warnings`) — below the ceiling climbs one level, coded by a fresh session with the open findings and the fix history in its brief (an L1 block's rounds 3–4 run at L2). At the ceiling — an L2 block, or an L1 block that has climbed to L2 — it takes the **L3 rung**: a patch ≤ 80 lines, owned files only, reviewed as a `patch_check` round outside the cap. Under `escalation.l3_mode: code` (opt-in) the rung is instead one L3 coding turn. Either way the rung fires **once per block** and the same post-patch order follows it. After it, in order: `patch_check` clean ⇒ complete; open set not smaller than before the patch ⇒ `stopped: l3_patch_exhausted` (`review_stall`); round ≥ `review.max_rounds_per_file` ⇒ `stopped: review_cap`; otherwise the fixes continue at L2 with `rounds_at_level` reset and the patch in the brief. Any later trigger in that block stops with its named reason (`l3_patch_exhausted`, `review_cap`) and never patches again.
-5. **Cap — four rounds per file** (`review.max_rounds_per_file`, default 4, range 2–6). Round 4 still open ⇒ the L3 rung if the block has not used it (same post-patch order as step 4), else `stopped: review_cap`. A stop means the block cannot close, the ledger lists the open findings, and the human decides — fix by hand, `forge block waive <id> <finding-id> --run <r> --file <path> --reason <text>` (a signed `review.waived` row, `by: human`), or re-decompose. The coder never sees a `waive` verb; it is on the forbidden list.
+5. **Cap — four rounds per file** (`review.max_rounds_per_file`, default 4, range 2–6). Round 4 still open ⇒ the L3 rung if the block has not used it (same post-patch order as step 4), else `stopped: review_cap`. A stop means the block cannot close, the ledger lists the open findings, and the human decides — fix by hand, `forge block waive <id> <finding-id> --run <r> --file <path> --reason <text>` (a signed `review.waived` row, `by: human`), or re-decompose. The coder never sees a `waive` verb; it is on the forbidden list. **Autopilot:** under a grant, a warning or nit finding may be waived by the delegate (`forge autopilot waive … --decision <id>`, written `by: autopilot`) and a file at the cap may get one extra round (`forge autopilot round`); a critical or proof waiver is never delegated (`autopilot.md`).
 6. **Block-close sweep**: `forge block close` batches the `late_findings` per file to one L3 judge ruling (`fix_now | nit`); a `fix_now` opens a round on that file at the block's current level and counts toward its cap.
 7. Ledger: one `review.round` row per round with `open_before`, `closed`, `new_in_hunks`, `late`, `open_after`; `forge report` prints rounds per file and rounds that stalled.
 
@@ -42,7 +42,7 @@ Two L2 reviewers, one per effective provider (`resolve(L2)` and `review.second_l
 
 ## §7 The review budget per block
 
-`review.block_budget_tokens` (and optionally `review.block_budget_usd`) bounds every review, recheck, judge and S2 session made for the block. When the forecast exceeds it the worker degrades one step at a time, cheapest first: batch small files of one tier into one packet (`review.batch_small_files`) → one judge per block instead of per file → standard band `full` → `quick` → high tier `A + B + judge` → one `full` L2 + judge, the floor. Tools-only is never a review; a light `quick` stays `quick`. Still over ⇒ `review.over_budget`: raise the budget once per run (a config edit by the human, on record) or split the block — never silently, never below the floors. The ledger keeps `depth_unconstrained` and `depth_chosen` per file so `forge report` can show `missed_after_degrade`.
+`review.block_budget_tokens` (and optionally `review.block_budget_usd`) bounds every review, recheck, judge and S2 session made for the block. When the forecast exceeds it the worker degrades one step at a time, cheapest first: batch small files of one tier into one packet (`review.batch_small_files`) → one judge per block instead of per file → standard band `full` → `quick` → high tier `A + B + judge` → one `full` L2 + judge, the floor. Tools-only is never a review; a light `quick` stays `quick`. Still over ⇒ `review.over_budget`: raise the budget once per run (a config edit by the human, on record) or split the block — never silently, never below the floors. **Autopilot:** a budget raise is never delegated; a paused category waits for the owner (`autopilot.md` §5). The ledger keeps `depth_unconstrained` and `depth_chosen` per file so `forge report` can show `missed_after_degrade`.
 
 ## §7a Parallel tickets
 

package/skill/references/rules-core.md

@@ -1,4 +1,4 @@
-# Core rules — sixteen, each with its why
+# Core rules — seventeen, each with its why
 
 The headings below are the list in `SKILL.md` §4. A rule names levels and roles, never a model. Config keys are the ones `forge validate` accepts.
 
@@ -50,6 +50,9 @@ Round n ≥ 2 reviews the fix hunks and the open findings; the open set shrinks
 ### R16 — Proof is exact assertions on the main behaviour
 One exact test per clause plus a negative or boundary where the clause has a failure mode; red→green for every new test; there is no mutation tier (`proof.md` §1). Why: exhaustive suites hid the defects the isolated review found.
 
+### R17 — Never relax a rule alone
+The orchestrator and any delegate never change, relax or remove a rule, limit, permission or check without the owner: config limits, thresholds, budgets, the forbidden list, gates, review requirements, or a local patch that loosens a check. When a limit blocks work: stop, show the data, propose options, wait. Only the owner raises a limit (the budget once per run, R6); during autopilot only the owner's own `forge autopilot approve` (`autopilot.md` §5). Why: a limit relaxed to finish the work protects nothing, and the owner learns of it too late.
+
 ## What survives from the previous pipeline (14 rows)
 
 | survivor | lands in | kind |

package/skill/scripts/forge

@@ -10,7 +10,7 @@
 #      copied install with no package next to it); `test/skill/shim.test.mjs` asserts the pin
 #      equals package.json's version.
 # The shim holds no logic of its own: every verb, flag and message is the CLI's.
-PINNED_VERSION="0.5.1"
+PINNED_VERSION="0.6.1"
 set -eu
 
 self="$0"