@codedology/code-forge 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -6,6 +6,28 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.6.1] — 2026-10-07
+
+### Added
+
+- Skill rule R17 "Never relax a rule alone": the orchestrator and any delegate never change, relax or remove a limit,
+  threshold, budget, forbidden entry, gate or review requirement without the owner; when a limit blocks work they stop,
+  show the data, propose options and wait. The skill also asks to supervise cost continuously (budget.usd, spend after
+  every block close).
+
+### Fixed
+
+- A verb run from a subfolder uses the project root (the git root, or the nearest regular `.code-forge.yml` below it;
+  outside git never above HOME) for its config and ledger slug: `jev`, `plan`, `author`, `facts`, `spawn`, `s2` and
+  `run start`. A `.git` at HOME (a dotfiles repo) does not make HOME a project.
+- `plan check` reads the list form of the "cannot back" section that the template shows, still reads the old table
+  form, and splits clauses on `;` and on ` · (n)`.
+- `facts`: a flag claim is proved only by `grep -rn -- <flag> <source folder>` (hits in source files under that
+  folder; docs, plans, tests, fixtures and the brief never count). The delegate never runs `--help`, `-h`, `--version`,
+  a pipe, a list or `rg`; grep options come from a fixed allow-list. No Claude allow rules are added.
+- A command claim written without its CLI (`run reload`) gets the project's own bin only when the brief names that bin
+  and the first word is not a well-known CLI.
+
 ## [0.6.0] — 2026-10-06
 
 ### Added

package/README.md

@@ -8,17 +8,39 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 > `examples/` have all landed (`docs/reference/blocks.json` lists every build block). What changed
 > in each version is in [CHANGELOG.md](CHANGELOG.md).
 
-## What's new (next release)
+## What's new in 0.6
+
+Next release (0.6.1):
+
+- **Never relax a rule alone.** A new skill rule (R17): the orchestrator and the delegate never
+  change, relax or remove a limit, threshold, budget, gate or review requirement. When a limit
+  blocks work they stop, show the data, propose options and wait for you.
+- **Fixes from using code-forge on itself.** A verb run from a subfolder now uses the project's
+  ledger and config. `plan check` reads the list form the template shows. `facts` checks a flag
+  with `grep -rn -- <flag> <source folder>` instead of `--help`, so the check runs in the
+  delegate's sandbox.
+
+In 0.6.0:
 
 - **Autopilot.** Step away for up to 24 hours. `code-forge autopilot start` grants a delegate (a
-  fresh L2 or L3 session) a few of your decisions: waive a warning or a nit, one extra fix round,
-  the coder level. A fixed deny list keeps the rest yours: critical waivers, plan and design
-  approval, limits, budget raises, merges, destructive actions. Each category can pause at a
-  budget stop, and every answer is a signed ledger row.
+  fresh closed-book L2 or L3 session, never Codex) a few of your decisions: waive a warning or a
+  nit, one extra fix round past the review cap, the coder level. The orchestrator asks the
+  delegate first (`autopilot ask`) and acts only on an answer it acted on. A fixed deny list in
+  the code keeps the rest yours: critical and proof waivers, skipping reviews, plan and design
+  approval, any limit or rule change, budget raises, merges, destructive actions. Every answer is
+  a signed ledger row; each waiver opens a GitHub issue. See [docs/autopilot.md](docs/autopilot.md).
+- **Budget per category.** `--budget review=<usd>,coding=<usd>` pauses a category at `--stop-at`
+  (default 0.9) of its cap until you return. `autopilot approve` (only you, at a terminal) changes
+  one setting until a time and puts it back by itself. While a grant is active, `run reload`
+  refuses any limit key.
 - **A live log for your return.** In Claude Code the orchestrator keeps one Claude Docs page per
-  run with two tabs: Binnacle (the summary) and Full log (every event, newest first).
-  `autopilot status` and `autopilot stop` print its link; without the connector they print the two
-  Markdown files. See [docs/autopilot.md](docs/autopilot.md).
+  run with two tabs: Binnacle (status at a glance, decisions, blocks, open questions, actions only
+  you can take, incidents, timeline) and Full log (every event, newest first). `autopilot status`
+  and `autopilot stop` print its link; without the connector they print two Markdown files in the
+  run dir (`autopilot binnacle`, `autopilot log`).
+- **From 0.5.x, not listed before:** two files of one block can no longer both take the block's one
+  L3 patch rung (0.5.0), and a maintainer can install a tagged release before it is on npm
+  ([getting-started](docs/getting-started.md#keeping-it-up-to-date), 0.5.1).
 
 ## What's new in 0.5
 
@@ -143,7 +165,7 @@ usage line.
 | `validate` | `code-forge validate [--file <path>]` |
 | `resolve` | `code-forge resolve <L0\|L1\|L2\|L3>` |
 | `run` | `code-forge run start [--cwd <dir>] [--run <id>] [--engine <e>] [--worker-pid <pid>]` · `run start --reattach --run <id> [--worker-pid <pid>]` · `run status --run <id>` (with spent and budget USD) · `run reload --run <id>` (re-read `.code-forge.yml` mid-run) · `run end --run <id>` |
-| `block` | `code-forge block open <id> --run <r> --level L<n> --owned <paths…> --acceptance <file> [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <n>] [--kind code\|docs\|contract]` · `block attempt\|rebase <id> --run <r>` · `block close <id> --run <r> [--transcript <file>] [--report <file>] [--no-require-reviews]` · `block claim <id> <path> --run <r>` · `block stop <id> --run <r> --reason <text>` · `block waive <id> <finding-id> --run <r> --file <path> --reason <text>` (human-only) |
+| `block` | `code-forge block open <id> --run <r> [--level L<n>] --owned <paths…> --acceptance <file> [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <n>] [--kind code\|docs\|contract]` · `block attempt\|rebase <id> --run <r>` · `block close <id> --run <r> [--transcript <file>] [--report <file>] [--no-require-reviews]` · `block claim <id> <path> --run <r>` · `block stop <id> --run <r> --reason <text>` · `block waive <id> <finding-id> --run <r> --file <path> --reason <text>` (human-only) |
 | `worker` | `code-forge worker --run <id> [--cwd <dir>] [--poll-ms <n>] [--once]` — started detached by `run start`, never by a coder |
 | `review` | `code-forge review [--base <ref>] [--files <path…>] [--acceptance <file> \| --intent "<text>"] [--run <id>] [--max <seconds>] [--json] [--keep-run]` — review only: no coder, no proof, never closes a block |
 | `review-file` | `code-forge review-file <path> --block <id> [--run <id>]` (enqueue) · `review-file --wait <ticket> [--max <seconds>s]` (poll, default 90s; still running at `--max` prints `status: pending, reason: wait_timeout`) |
@@ -164,7 +186,7 @@ usage line.
 | `upgrade` | `code-forge upgrade [--source <path>]` |
 | `logs` | `code-forge logs [--last N] [--json]` · `logs summary [--days N] [--json]` · `logs clear [--yes]` · `logs path` — the local error log (`~/.code-forge/logs/errors.jsonl`): errors, warnings, and `[fixed in X.Y.Z]` marks |
 | `logs report` | `code-forge logs report [--last N] [--kind K] [--verb V] [--note "text"] [--include-warnings] [--with-doctor] [--no-ai] [--allow-old] [--force] [--dry-run] [--yes]` — share selected errors as a public GitHub issue; you see the full text first and say yes once. An error a newer version fixes is not filed unless `--force` |
-| `autopilot` | `code-forge autopilot start --run <id> --until <ISO-8601 with offset> --delegate <L2\|L3> --allow <scope,…> [--deny <scope,…>] [--budget <category>=<usd>,…] [--stop-at <0..1>] [--yes]` · `autopilot status\|stop --run <id>` (print the live log's link, or the two Markdown files) · `autopilot ask --run <id> --scope <scope> --question <text> [--options a,b,…] [--block <id>] [--file <path>] [--finding <id>] [--json]` · `autopilot waive\|round\|level … --decision <id>` · `autopilot approve --run <id> --key <dot.path> --value <json> --until <time>` (owner only, at a terminal) · `autopilot binnacle --run <id> [--json\|--markdown] [--link <https url>]` · `autopilot log --run <id> [--json\|--markdown]` — the owner's time-boxed grant to a delegate; see [docs/autopilot.md](docs/autopilot.md) |
+| `autopilot` | `code-forge autopilot start --run <id> --until <ISO-8601 with offset> --delegate <L2\|L3> --allow <scope,…> [--deny <scope,…>] [--budget <category>=<usd>,…] [--stop-at <0..1>] [--yes]` · `autopilot status --run <id> [--json]` · `autopilot stop --run <id>` (both print the live log's link, or the two Markdown files) · `autopilot ask --run <id> --scope <scope> --question <text> [--options a,b,…] [--context-file <path>] [--block <id>] [--file <path>] [--finding <id>] [--json]` · `autopilot waive\|round\|level … --decision <id>` · `autopilot approve --run <id> --key <dot.path> --value <json> --until <time>` (owner only, at a terminal) · `autopilot binnacle --run <id> [--json\|--markdown] [--link <https url>]` · `autopilot log --run <id> [--json\|--markdown]` — the owner's time-boxed grant to a delegate; see [docs/autopilot.md](docs/autopilot.md) |
 | `help` / `version` | `code-forge --help` (or no verb) · `code-forge --version` |
 
 `run`, `block`, `worker`, `spawn`, `s2`, `author`, `facts` and `review-file` are what the Agent
@@ -203,7 +225,8 @@ CLI verbs like any other and every one of them is exercised by this package's ow
 
 `schema/code-forge.schema.json` is the source of truth for `.code-forge.yml`.
 [docs/reference/config.md](docs/reference/config.md) lists every key with its type and default.
-Keys added in 0.4 and 0.5 (the last two rows are new in 0.5):
+Keys added in 0.4, 0.5 and 0.6 (`review.parallel_tickets` and `review.provider_concurrency` are
+new in 0.5, `autopilot.min_confidence` in 0.6):
 
 | Key | Default | What it does |
 |---|---|---|
@@ -217,6 +240,7 @@ Keys added in 0.4 and 0.5 (the last two rows are new in 0.5):
 | `review.session_timeout_s` | `300` | a review session that runs longer is killed and retried once |
 | `review.parallel_tickets` | `3` | review tickets the worker runs at once (1 to 16); `1` reviews one file at a time |
 | `review.provider_concurrency` | anthropic `4`, openai `2`, xai `2` | review sessions at once per provider |
+| `autopilot.min_confidence` | `0.7` | the lowest delegate confidence that is acted on; below it the question goes to you |
 
 `code-forge block open … --kind code|docs|contract` sets a block's kind when its file endings do
 not say it. The reference page is generated:

package/docs/README.md

@@ -9,9 +9,9 @@ disagree, the verb is right: each verb prints its own usage line when its argume
 | # | Page | Read it when you want to… |
 |---|---|---|
 | 1 | [overview.md](overview.md) | know what code-forge is, the problem it solves, who it is for, and what it is not |
-| 2 | [concepts.md](concepts.md) | look up a word: block, level, lane, tier, S1/S2, waiver, ledger, budget, block kind, closed book, known fix… |
-| 3 | [how-it-works.md](how-it-works.md) | follow the full workflow from a brief to a closed block, and see who does what and where state lives |
-| 4 | [getting-started.md](getting-started.md) | install it, answer `init`, run `doctor`, try the first commands, and read or report errors (`code-forge logs`) |
+| 2 | [concepts.md](concepts.md) | look up a word: block, level, lane, tier, S1/S2, waiver, ledger, budget, block kind, closed book, plan approval, owner rule, autopilot grant, known fix… |
+| 3 | [how-it-works.md](how-it-works.md) | follow the full workflow from a brief to a closed block (plan approval, parallel review, the escalation ladder, the rules the orchestrator keeps), and see who does what and where state lives |
+| 4 | [getting-started.md](getting-started.md) | install it, answer `init`, install the recommended tools (`code-forge tools`), run `doctor`, set a budget, upgrade, and read or report errors (`code-forge logs`) |
 | 5 | [tutorial-first-test.md](tutorial-first-test.md) | run one real end-to-end test: build the code-forge marketing site in a new repo |
 | 5a | [review-only.md](review-only.md) | only review code you already wrote: a branch, uncommitted work or some files, with CI exit codes |
 | 5b | [autopilot.md](autopilot.md) | step away while a run goes on: grant a delegate a few decisions for a set time, and review the live log (Binnacle and Full log) when you return |
@@ -19,7 +19,7 @@ disagree, the verb is right: each verb prints its own usage line when its argume
 | 7 | [marketing.md](marketing.md) | read the product story: the problem, the promise, the honest limits |
 
 New to the tool? Read 1 → 3 → 4, then do 5. Keep 2 open as a glossary. Only want reviews? Read 4,
-then 5a.
+then 5a. Going away while a run goes on? Read 5b.
 
 ## Reference pages (already in the repo)
 

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 52,
+  "block_count": 54,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -701,6 +701,37 @@
         "B49a"
       ],
       "note": "root-added 2026-10-06; plan plans/autopilot (issue #5); also amends src/cli/autopilot.mjs, skill/SKILL.md, skill/references/{decisions,review,harden,plan,code}.md, skill/references/adapters/claude-code.md, README.md, docs/README.md, docs/concepts.md, docs/getting-started.md"
+    },
+    "B50": {
+      "title": "Dogfood tool fixes: the project root (git root, or the nearest regular .code-forge.yml below it; outside git never above HOME) sets the config and ledger slug for every verb run from a subfolder; plan check reads the list form and the old table form of the cannot-back section and splits clauses on ';' and ' · (n)'; the facts delegate proves a flag only with grep -rn -- <flag> <source folder> (exact option allow-list, no --help, no pipes, no rg, hits only in source files under the path); a command claim without its CLI gets the project bin only when the brief names it",
+      "wave": 11,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/config/load.mjs",
+        "src/session/plan-check.mjs",
+        "src/session/facts.mjs",
+        "test/session/plan-check.test.mjs",
+        "test/session/facts.test.mjs"
+      ],
+      "depends_on": [
+        "B49b"
+      ],
+      "note": "root-added 2026-10-06; dogfood findings from plans/parallel-review §6.1 and plans/autopilot; no Claude allow rules (rejected: an allow-list of commands is unsafe); also amends src/cli/{author,facts,jev,plan,run,s2,spawn}.mjs, src/autopilot/limits.mjs, skill/references/plan.md, skill/templates/plan.md, docs/how-it-works.md, docs/tutorial-first-test.md"
+    },
+    "B51": {
+      "title": "Skill rule R17 'Never relax a rule alone' and cost supervision; owner rules and docs gaps filled",
+      "wave": 11,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "skill/references/rules-core.md",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B49b"
+      ],
+      "note": "root-added 2026-10-06; also amends skill/SKILL.md, skill/references/{autopilot,decisions,ledger}.md, README.md, docs/*"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",

package/skill/SKILL.md

@@ -62,6 +62,7 @@ State lives in the plan file's header — `facts → planned → hardened → co
 - **R14** No design before facts
 - **R15** Re-checks shrink: fix hunks only, four rounds, then a patch, then a human
 - **R16** Proof is exact assertions on the main behaviour
+- **R17** Never relax a rule alone
 
 ## §5 Where to read more
 

package/skill/references/autopilot.md

@@ -45,4 +45,4 @@ These never go to the delegate, whatever the grant says (the CLI's fixed deny li
 - a critical waiver, a proof waiver, or closing a block without its reviews;
 - merges and destructive actions.
 
-When one of these comes up during the window: stop that line of work, add it to Actions only you can take, and wait.
+When one of these comes up during the window: stop that line of work, add it to Actions only you can take, and wait. The delegate never relaxes a rule or a limit to keep work moving (`rules-core.md` R17).

package/skill/references/decisions.md

@@ -50,6 +50,6 @@ A fresh L3 session receives the failure evidence — the last attempt's diff, th
 
 ## §7 What reaches the human
 
-`next = stop`, `review.over_budget`, an orphan file, `worker_down`, `review_cap`, `redecompose`, `ask_human`, a security question, consensus unavailable, and one budget raise per run. Everything else is decided by S1, S2 or the rules above and recorded.
+`next = stop`, `review.over_budget`, an orphan file, `worker_down`, `review_cap`, `redecompose`, `ask_human`, a security question, consensus unavailable, and one budget raise per run. Everything else is decided by S1, S2 or the rules above and recorded. A change to a rule, limit or check is never decided here: it always reaches the owner (`rules-core.md` R17).
 
 **Autopilot:** while a grant is active, a warning or nit waiver, one extra round at `review_cap` and a coder level go first to the delegate (`forge autopilot ask`, then `forge autopilot waive|round|level --decision <id>` only when it acted, `autopilot.md` §2). Never delegated: `next = stop`, `ask_human`, a security question, a critical finding, a budget raise, `redecompose` — they wait for the owner (`autopilot.md` §5).

package/skill/references/ledger.md

@@ -18,6 +18,8 @@ Terminal output in this version. Sections: cost per block — completed and stil
 
 Every `session` row carries `usd` (tokens × the static price table) or `usd: null, usd_unknown: true` when the provider/level has no price — never a guess; a `session.background` coder's price is always unknown. Spend code-forge never saw (a cloud or hand-run coder) goes in with `forge ledger add coder --run <r> --block <b> --usd <n> [--note "..."]`, a signed `session` row with `manual: true`. With `budget.usd` set, every session spawn first sums the run's spend: at 80 % one `budget.warning` row and one stderr line per run; at 100 % the session is refused (`budget.usd 20.00 reached (spent 20.13); raise budget.usd or end the run`), a `budget.refused` row is written, nothing is spawned, and a review reports `review.unavailable {reason: budget}`. A budget whose spend cannot be read refuses too (fail closed).
 
+Watch the cost the whole run, not only at the end: ask the owner for a `budget.usd` before the first block when the project has none, read `spent_usd` / `budget_usd` in `forge run status` after every block close, and record cloud or hand-run coder spend with `forge ledger add coder` as soon as it is known. A budget stop is the owner's call (`rules-core.md` R6, R17).
+
 Sessions that run at the same time (B41): each session first takes its provider slot, then — under one in-process lock per run — reads the spend, checks it and reserves its estimated cost (the packet's bytes / 4 in, plus a fixed tokens_out per role and level, priced with the same table; a session waiting for a slot reserves nothing). A session is refused when spent + reserved by running sessions + its own estimate passes the budget: `budget.usd 20.00 would be exceeded: spent 3.10, reserved by running sessions 15.80, this session about 1.92; it starts when running sessions finish or when budget.usd is raised`, or, when its estimate alone is above the budget, `this session's estimated cost (about 64.00) is above budget.usd 20.00; raise budget.usd`; the `budget.refused` row then carries `reserved_usd` and `estimate_usd`. The reservation is released when the session's row is written, or when the spawn fails or throws. The 80 % warning is checked under the same lock, so it is written once per run.
 
 Known limits, accepted: unknown-price sessions and `session.background` coders add **0** to the spent total — record their real cost with `forge ledger add coder --usd <n>`; a background coder's reservation is released at its start row, since its cost is never seen; a session refused because of running sessions' reservations is refused, not queued — run it again once they finish; `forge run status` shows `unknown_usd_sessions` and prints `N sessions have no known price; the budget does not count them` when N > 0. The lock and the reservations live in one process only: two separate code-forge processes starting a session of one run at the same moment can still each pass the check or each write a `budget.warning` row.

package/skill/references/plan.md

@@ -4,8 +4,8 @@
 
 Run `forge facts --brief <brief> [--sources <path>...] --out <plans_dir>/<slug>.facts.md` before anything else. What it does:
 
-1. Deterministic: the CLI extracts every *claim token* from the brief and the sources it names — CLI flags, `<cli> <verb>` commands, paths, versions, endpoints, package names, environment variable names — and writes a claim list.
-2. One L0 session whose cwd is a **read-only snapshot of the repository at HEAD plus the `--sources` files**, built under the run's temp root and removed at session end — so `./path` claims are checkable, while **uncommitted files are not visible unless named as sources** (the snapshot is HEAD, not the working tree) — and whose packet is the claim list and the rule "run the cheapest read-only check, quote the command and the output line, tag VERIFIED / NOT-FOUND / UNVERIFIABLE, never infer". Two lines of defence, exactly as built. **First, at spawn:** the session gets the shell tool only, with the forbidden list plus every write verb rendered as deny rules and the provider's restricted mode (file tools confined to the working directory). There is no pre-execution gate on individual commands beyond those deny rules: the delegate runs what it runs. **Second, after the fact:** the CLI checks every `command` the delegate reports against an allow-list, fail closed, and refuses the whole sheet on the first violation. Allowed forms: `ls cat head tail wc grep rg stat file uname sw_vers jq which` with in-cwd arguments (`grep` never recursive), `find` with only these predicates — `-name -iname -path -ipath -type -maxdepth -mindepth -print -print0 -newer -size -empty -mtime -mmin -not ! -a -o -and -or` — every other predicate refused, `git log|show|status|rev-parse|ls-files|cat-file|--version`, `npm view|ls|--version`, `node --version`, `test -e|-f|-d|-n <one operand>`, `curl` as a HEAD request of exactly one http(s) URL with `-s -S -I -L -f --max-time <N>` only, and `<cli> --help|-h|--version` for a bare CLI name that is not a build runner; an env claim is only `printenv NAME >/dev/null` with its excerpt blanked. Refused anywhere: backticks, `$`, redirection, unquoted globs, `~`, `..`, absolute paths outside `/usr`, `/opt/homebrew`, `/bin`, and secret-looking paths. **`npm view` and `curl -I` reach the network** — they are what makes a package version or an endpoint checkable; nothing else the delegate may run does.
+1. Deterministic: the CLI extracts every *claim token* from the brief and the sources it names — CLI flags, `<cli> <verb>` commands, paths, versions, endpoints, package names, environment variable names — and writes a claim list. A `<cli> <verb>` written without its CLI (`run reload`) whose first word is not one of the project's CLIs, not a well-known CLI (`git gh npm npx node pnpm yarn bun deno ls cat grep which find test make docker curl claude codex python python3 pip go cargo op`), and that the brief never uses as a CLI of its own (`` `gh` `` or `` `gh --repo x` `` in a code span) — decided from the brief and `package.json` alone, never PATH — becomes `<project CLI> <verb>` (`code-forge run reload`) when the brief itself (not a source) names one of the project's CLIs (its `package.json` `bin` names) as a whole word — `.code-forge.yml` or `code-forge.config` do not count; `plan check` then counts a clause citing `run reload` as backed by that VERIFIED fact, and only when the extra word is one of the project's own CLIs.
+2. One L0 session whose cwd is a **read-only snapshot of the repository at HEAD plus the `--sources` files**, built under the run's temp root and removed at session end — so `./path` claims are checkable, while **uncommitted files are not visible unless named as sources** (the snapshot is HEAD, not the working tree) — and whose packet is the claim list and the rule "run the cheapest read-only check, quote the command and the output line, tag VERIFIED / NOT-FOUND / UNVERIFIABLE, never infer". Two lines of defence, exactly as built. **First, at spawn:** the session gets the shell tool only, with the forbidden list plus every write verb rendered as deny rules and the provider's restricted mode (file tools confined to the working directory). Nothing is pre-approved: the delegate only runs what the provider already treats as read-only. A flag claim is therefore checked in the project's **source text**, never by running a program: `grep -rn -- <flag> <path>` over a top-level source folder of the snapshot such as `src` (never `.` or the root); it is VERIFIED only when the claim is that flag and the excerpt has a `file:line:text` hit from a source file — not `.md`/`.markdown`/`.txt`, not under `docs/ plans/ test/ tests/ fixtures/ node_modules/`, not the brief, and under the grep's path — holding the flag as a whole token (`--force-push` does not prove `--force`); a NOT-FOUND counts only over one whole top-level source folder that exists as a directory in the snapshot (not hidden, not `dist build coverage out` or the folders above). The grep's path must be an existing source directory of the snapshot (a nested one such as `src/cli` is fine for VERIFIED; a single file never is), and no other command — a plain grep included — ever proves or disproves a flag. Every check is ONE command: no pipe and no list (`| ; && || &`). There is no pre-execution gate on individual commands beyond the deny rules: the delegate runs what it runs. **Second, after the fact:** the CLI checks every `command` the delegate reports against an allow-list, fail closed, and refuses the whole sheet on the first violation. Allowed forms (never `rg`, which searches recursively by default): `ls cat head tail wc grep stat file uname sw_vers jq which` with in-cwd arguments (`grep` options only `-n -c -i -w -F` before `--`, recursive only as the whole command `grep -rn -- <--long-flag> <path>` with one relative subfolder or file, never `.` or a secret path), `find` with only these predicates — `-name -iname -path -ipath -type -maxdepth -mindepth -print -print0 -newer -size -empty -mtime -mmin -not ! -a -o -and -or` — every other predicate refused, `git log|show|status|rev-parse|ls-files|cat-file`, `npm view|ls`, `test -e|-f|-d|-n <one operand>`, and `curl` as a HEAD request of exactly one http(s) URL with `-s -S -I -L -f --max-time <N>` only. No program ever runs with `--help`, `-h` or `--version` (BSD `rm foo --help` deletes `foo`): a version claim is checked with `npm view`, `which` or `ls`; an env claim is only `printenv NAME >/dev/null` with its excerpt blanked. Refused anywhere: backticks, `$`, redirection, unquoted globs, `~`, `..`, absolute paths outside `/usr`, `/opt/homebrew`, `/bin`, and secret-looking paths. **`npm view` and `curl -I` reach the network** — they are what makes a package version or an endpoint checkable; nothing else the delegate may run does.
    **Path claims:** `./path` claims resolve against the HEAD snapshot, so a committed file is VERIFIED or NOT-FOUND by a plain `ls`/`test -e`; a file that exists only uncommitted in the working tree reads NOT-FOUND unless you passed it with `--sources`. `~/…` claims stay UNVERIFIABLE (`~` is refused), and absolute paths are allowed only under `/usr`, `/opt/homebrew` and `/bin`; a home-directory path that matters to a block is checked by you with one read-only command and recorded in the unbackable list with that command as the tolerance.
 3. Deterministic again: the answer is validated against the facts schema, rendered with `templates/facts-sheet.md`, and refused when a VERIFIED tag has no output excerpt. Every claim, command and excerpt passes through the redactor. The header records the brief's sha and mtime.
 
@@ -23,7 +23,7 @@ Run `forge facts --brief <brief> [--sources <path>...] --out <plans_dir>/<slug>.
 | `owned_files` | exact paths or disjoint globs; a glob never contains `[ ] ( ) ! + @` (an exact path may); pairwise disjoint across blocks that can run together |
 | `depends_on` | acyclic; a block imports only modules of blocks it depends on — a batch-mate's module is a `next = stop` |
 | `level` | the S1 `lane` answer recorded for the block — `forge jev ask lane --block <id> --plan <plan> --state <file>`, or `--rules` (the deterministic fallback) when Jev is unavailable; never a block category (`L0` trivial · `L1` a plain feature following a pattern · `L2` money, dates, tenancy, migrations, concurrency · `split` too large or two concerns); **L3 is not a lane** |
-| `acceptance` | clauses that each name ≥ 1 test id; a clause citing a flag, path, version or API cites a VERIFIED fact id or sits in the unbackable list with a tolerance naming this block |
+| `acceptance` | clauses that each name ≥ 1 test id, numbered `(1) … · (2) …` or separated by `;` (`plan check` splits the cell on both and checks each clause on its own); a clause citing a flag, path, version or API cites a VERIFIED fact id or sits in the unbackable list with a tolerance naming this block |
 | `cases`, `lines` | forecasts: `cases = 2 × counted clauses`, `lines = 26 × cases` with a floor of 1 200 for a greenfield block and 500 for an amendment; above `budget.block_cases` or `budget.block_lines` the block is split in the plan, never "split-ready" |
 | `test_command` | a quoted glob or an explicit file list, never a bare directory |
 | `commit_message` | house style |
@@ -36,7 +36,7 @@ Every clause of the parent's acceptance maps to exactly one block; an unmapped c
 
 ## §4 The deterministic exit — `forge plan check <plan> [--facts <sheet>]`
 
-Prints every failing row by name and exits 1 on any of: an acceptance clause with a claim token that resolves to no VERIFIED fact and no tolerance row (`unbackable clause without tolerance: <block> <clause>`); a missing caller map or a block absent from it; a block without `cases` and `lines`; a forecast above `budget.block_cases` / `budget.block_lines` without a named split; overlapping `owned_files` in one wave; a cyclic `depends_on` or an import of a batch-mate; a glob with `[ ] ( ) ! + @`; more than `caps.coders` concurrent blocks in a slot; `questions[]` still open; the facts sheet's sha absent from the draft; a block whose level has no recorded lane, or differs from it (`block <id>: level L2 differs from the recorded lane L1 (jev)`). A required section under a near-miss heading at its template position (§0.x, §3) passes with a `WARN` naming the exact heading. stdout ends with the lane recorded per block (`lanes: B1 L1 (jev) · B2 L0 (rules)`). Green ⇒ set `status: hardened` after the harden job (`harden.md`), never before.
+Prints every failing row by name and exits 1 on any of: an acceptance clause with a claim token that resolves to no VERIFIED fact and no tolerance line (`unbackable clause without tolerance: <block> <clause>`) — a tolerance line is a list item of §0.x naming the block, the token and the word `tolerance`, as `templates/plan.md` shows (`- B3 \`--flag\` (F4, UNVERIFIABLE) — tolerance: …`); a row of the older table form with a filled tolerance column still counts (`—`, `-`, `…`, `n/a` and the like are empty); a missing caller map or a block absent from it; a block without `cases` and `lines`; a forecast above `budget.block_cases` / `budget.block_lines` without a named split; overlapping `owned_files` in one wave; a cyclic `depends_on` or an import of a batch-mate; a glob with `[ ] ( ) ! + @`; more than `caps.coders` concurrent blocks in a slot; `questions[]` still open; the facts sheet's sha absent from the draft; a block whose level has no recorded lane, or differs from it (`block <id>: level L2 differs from the recorded lane L1 (jev)`). A required section under a near-miss heading at its template position (§0.x, §3) passes with a `WARN` naming the exact heading. stdout ends with the lane recorded per block (`lanes: B1 L1 (jev) · B2 L0 (rules)`). `plan check` and `jev ask` may run from any folder of the project: both read the project root's config and ledger (the nearest `.code-forge.yml` file up to the git top level, else the git top level; outside git, never above the home directory, and only the folder itself when it is not under home), never a subfolder's name. `author`, `facts`, `spawn`, `s2` and `run start` read the same root. Green ⇒ set `status: hardened` after the harden job (`harden.md`), never before.
 
 ### §4.1 Owner approval in plan mode
 

package/skill/references/rules-core.md

@@ -1,4 +1,4 @@
-# Core rules — sixteen, each with its why
+# Core rules — seventeen, each with its why
 
 The headings below are the list in `SKILL.md` §4. A rule names levels and roles, never a model. Config keys are the ones `forge validate` accepts.
 
@@ -50,6 +50,9 @@ Round n ≥ 2 reviews the fix hunks and the open findings; the open set shrinks
 ### R16 — Proof is exact assertions on the main behaviour
 One exact test per clause plus a negative or boundary where the clause has a failure mode; red→green for every new test; there is no mutation tier (`proof.md` §1). Why: exhaustive suites hid the defects the isolated review found.
 
+### R17 — Never relax a rule alone
+The orchestrator and any delegate never change, relax or remove a rule, limit, permission or check without the owner: config limits, thresholds, budgets, the forbidden list, gates, review requirements, or a local patch that loosens a check. When a limit blocks work: stop, show the data, propose options, wait. Only the owner raises a limit (the budget once per run, R6); during autopilot only the owner's own `forge autopilot approve` (`autopilot.md` §5). Why: a limit relaxed to finish the work protects nothing, and the owner learns of it too late.
+
 ## What survives from the previous pipeline (14 rows)
 
 | survivor | lands in | kind |

package/skill/scripts/forge

@@ -10,7 +10,7 @@
 #      copied install with no package next to it); `test/skill/shim.test.mjs` asserts the pin
 #      equals package.json's version.
 # The shim holds no logic of its own: every verb, flag and message is the CLI's.
-PINNED_VERSION="0.6.0"
+PINNED_VERSION="0.6.1"
 set -eu
 
 self="$0"

package/skill/templates/plan.md

@@ -14,10 +14,9 @@
 
 ### §0.x Acceptance clauses the facts sheet cannot back
 
-`none` — or one row per clause:
+`none` — or one list item per unbacked claim, naming the block, the claim token, its fact id and tag, and the word `tolerance` (`forge plan check` reads these lines):
 
-| block | clause | claim | tag | tolerance (how the block's acceptance survives it) |
-|---|---|---|---|---|
+- B3 `--flag` (F4, UNVERIFIABLE) — tolerance: <how the block's acceptance survives it>
 
 ## §1 Architecture decision
 
@@ -29,6 +28,8 @@ Chosen approach and why · rejected alternatives (one line each) · the project
 |---|---|---|---|---|---|---|---|---|---|
 | B1 | … | L1 | — | `src/x.mjs`, `test/x.test.mjs` | 12 | 1 200 | (1) … (`test/x.test.mjs`, F3) · (2) … | `node --test 'test/x/**/*.test.mjs'` | … |
 
+Acceptance clauses are numbered `(1) … · (2) …` (or separated by `;`); `forge plan check` splits the cell on both and checks each clause on its own.
+
 `level` is the lane recorded for the block by `forge jev ask lane --block <id>` (or `--rules`), never a category; `forge plan check` refuses any other.
 
 Split rule: `cases = 2 × clauses`, `lines = 26 × cases` (floor 1 200 greenfield, 500 amendment); above `budget.block_cases` or `budget.block_lines` the block is split here. A glob in `owned_files` never contains `[ ] ( ) ! + @`.

package/src/autopilot/limits.mjs

@@ -360,6 +360,7 @@ export function limitGuard(allow, now) {
 export async function reloadWorkspace({ runId, allow = null, writeRow, now = new Date() }) {
   const { project, workspace, status } = await readRun(runId);
   if (status !== 'active') throw new StateError('run-ended', `run ${runId} has ended`);
+  // the run record's workspace IS the project root (`run start` records `projectRootFor`, B50)
   const loaded = await loadProjectConfig(workspace);
   if (!loaded.ok || !loaded.config) {
     if (loaded.error === 'not-found') return { ok: false, error: 'not-found' };

package/src/cli/author.mjs

@@ -11,7 +11,7 @@
 
 import { mkdirSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
-import { loadProjectConfig, slugFor } from '../config/load.mjs';
+import { loadProjectConfig, projectRootFor, slugFor } from '../config/load.mjs';
 import { AuthorError, runAuthor } from '../session/author.mjs';
 import { runRootFor, SessionError } from '../session/spawn.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
@@ -39,7 +39,10 @@ export async function runAuthorVerb(args, deps = {}) {
     /** @param {string | string[] | true | undefined} v */
     const abs = (v) => (typeof v === 'string' ? path.resolve(cwd, v) : undefined);
     const briefPath = /** @type {string} */ (abs(flags.brief));
-    const loaded = await loadProjectConfig(cwd);
+    // B50: the project root's config and ledger slug, also from a subfolder; flag paths stay
+    // cwd-relative, and the default output goes to <root>/<plans_dir>
+    const root = projectRootFor(cwd);
+    const loaded = await loadProjectConfig(root);
     if (!loaded.ok) {
       writeSafe(stderr, `author: ${loaded.message}\n`);
       return 2;
@@ -57,7 +60,7 @@ export async function runAuthorVerb(args, deps = {}) {
         answersPath: abs(flags.answers),
         run,
         runRoot: run ? runRootFor(run, cfg?.tmp?.root) : undefined,
-        slug: slugFor(cfg, cwd),
+        slug: slugFor(cfg, root),
         timeoutMs: timeout === undefined ? undefined : timeout * 1000,
       },
       { ...deps, stderr },
@@ -66,7 +69,7 @@ export async function runAuthorVerb(args, deps = {}) {
       writeSafe(stderr, `author: ${result.status}${result.reason ? ` (${result.reason})` : ''}\n`);
       return exitCodeFor(result);
     }
-    const out = abs(flags.out) ?? path.join(path.resolve(cwd, cfg.project?.plans_dir ?? 'plans'), `${path.basename(briefPath, path.extname(briefPath))}.${flags.job}.md`);
+    const out = abs(flags.out) ?? path.join(path.resolve(root, cfg.project?.plans_dir ?? 'plans'), `${path.basename(briefPath, path.extname(briefPath))}.${flags.job}.md`);
     mkdirSync(path.dirname(out), { recursive: true });
     writeFileSync(out, /** @type {string} */ (result.draft));
     writeSafe(stdout, `${JSON.stringify({ draft: out, questions: result.questions, cost: result.cost })}\n`);

package/src/cli/facts.mjs

@@ -11,7 +11,7 @@
 
 import { accessSync, constants, statSync } from 'node:fs';
 import path from 'node:path';
-import { loadProjectConfig, slugFor } from '../config/load.mjs';
+import { loadProjectConfig, projectRootFor, slugFor } from '../config/load.mjs';
 import { buildFacts, FactsError } from '../session/facts.mjs';
 import { runRootFor, SessionError } from '../session/spawn.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
@@ -63,14 +63,16 @@ export async function runFactsVerb(args, deps = {}) {
       writeSafe(stderr, USAGE);
       return 2;
     }
-    const loaded = await loadProjectConfig(cwd);
+    // B50: the project root's config, slug, plans dir and snapshot, also from a subfolder (flag paths stay cwd-relative)
+    const root = projectRootFor(cwd);
+    const loaded = await loadProjectConfig(root);
     if (!loaded.ok) {
       writeSafe(stderr, `facts: ${loaded.message}\n`);
       return 2;
     }
     const cfg = /** @type {Record<string, any>} */ (loaded.config);
     const briefPath = path.resolve(cwd, flags.brief);
-    const plansDir = path.resolve(cwd, cfg.project?.plans_dir ?? 'plans');
+    const plansDir = path.resolve(root, cfg.project?.plans_dir ?? 'plans');
     const outPath = typeof flags.out === 'string' ? path.resolve(cwd, flags.out) : path.join(plansDir, `${path.basename(briefPath, path.extname(briefPath))}.facts.md`);
     const sources = Array.isArray(flags.sources) ? flags.sources.map((s) => path.resolve(cwd, s)) : [];
     // --brief must be a regular file; a --sources path may be a file or a directory
@@ -88,11 +90,11 @@ export async function runFactsVerb(args, deps = {}) {
     const run = typeof flags.run === 'string' ? flags.run : undefined;
     // pre-run argument checks: a bad --run id or an unusable project state is usage (exit 2)
     const runRoot = run ? runRootFor(run, cfg?.tmp?.root) : undefined;
-    const slug = slugFor(cfg, cwd);
+    const slug = slugFor(cfg, root);
     let result;
     try {
       result = await buildFacts(
-        { cfg, briefPath, sources, outPath, run, runRoot, slug, projectDir: cwd, timeoutMs: timeout === undefined ? undefined : timeout * 1000 },
+        { cfg, briefPath, sources, outPath, run, runRoot, slug, projectDir: root, timeoutMs: timeout === undefined ? undefined : timeout * 1000 },
         { ...deps, stderr },
       );
     } catch (err) {

package/src/cli/jev.mjs

@@ -16,8 +16,11 @@
  * or mistyped one is a usage error naming it, with nothing recorded. `system1.disable` still
  * applies. No key is resolved, no request is sent, and the row says `source: 'rules'`.
  * The ledger slug is `--slug`, else `project.slug`, else the directory-name slug `run` and
- * `author` use (`slugFor`; B36 — it used to fall back to `code-forge`). An unknown flag is a usage
- * error.
+ * `author` use (`slugFor`; B36 — it used to fall back to `code-forge`). B50: the config and the
+ * directory name are the PROJECT ROOT's (`projectRootFor`): inside git, the nearest regular-file
+ * `.code-forge.yml` from the cwd up to the git top level, else the git top level; outside git, the
+ * nearest one up to the home directory when the cwd is under it, else the cwd alone. A run from a
+ * subfolder thus writes to the project's ledger. An unknown flag is a usage error.
  *
  * Resolves the Jev key through B2's chain (`resolveKey`, earlier batch — the seam rule allows a
  * Wave 1 module to import a block in an earlier batch statically), asks Jev, runs the answer
@@ -31,7 +34,7 @@
 
 import { randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
-import { loadConfigFile, DEFAULT_CONFIG_FILENAME, slugFor } from '../config/load.mjs';
+import { loadConfigFile, DEFAULT_CONFIG_FILENAME, projectRootFor, slugFor } from '../config/load.mjs';
 import path from 'node:path';
 import { buildQuestionPayload, isKnownQuestion, isQuestionDisabled } from '../decide/questions.mjs';
 import { askJev as realAskJev } from '../decide/jev-client.mjs';
@@ -179,7 +182,9 @@ export async function runJev(args, deps = {}) {
     return 1;
   }
 
-  const configPath = path.join(cwd, DEFAULT_CONFIG_FILENAME);
+  // B50: the project's config and ledger, also from a subfolder of the project
+  const root = projectRootFor(cwd);
+  const configPath = path.join(root, DEFAULT_CONFIG_FILENAME);
   const loaded = await loadConfig(configPath);
   let cfg = {};
   if (loaded.ok) {
@@ -190,7 +195,7 @@ export async function runJev(args, deps = {}) {
   }
 
   // the same ledger as the rest of the tool: --slug, else project.slug, else the directory name
-  const slug = slugFlag.value ?? slugFor(cfg, cwd);
+  const slug = slugFlag.value ?? slugFor(cfg, root);
 
   if (isQuestionDisabled(id, cfg)) {
     err(`jev ask: question "${id}" is disabled by system1.disable\n`);

package/src/cli/plan.mjs

@@ -5,16 +5,17 @@
  * WARN lines (a required section found by its position under a near-miss heading) go to stderr and
  * never fail the check. Either way stdout ends with the lane recorded per block (B36):
  * `lanes: B1 L1 (jev) · B2 none` — read from the project's ledger (`--slug`, else `project.slug`,
- * else the directory-name slug `run`, `author` and `jev ask` use).
- * Limits come from `.code-forge.yml` when there is one (`caps.coders`, `budget.block_cases`,
+ * else the directory-name slug `run`, `author` and `jev ask` use — the project root's, B50).
+ * Limits come from the project root's `.code-forge.yml` when there is one (`caps.coders`, `budget.block_cases`,
  * `budget.block_lines`), else the plan defaults.
  */
 
 import { readFileSync } from 'node:fs';
 import path from 'node:path';
-import { loadProjectConfig, slugFor } from '../config/load.mjs';
+import { loadProjectConfig, projectRootFor, slugFor } from '../config/load.mjs';
 import { ledgerPath } from '../ledger/paths.mjs';
 import { readAllRows } from '../ledger/write.mjs';
+import { FactsError, readProjectBins } from '../session/facts.mjs';
 import { checkPlan } from '../session/plan-check.mjs';
 import { parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
@@ -49,14 +50,16 @@ export async function runPlanVerb(args, deps = {}) {
     };
     const text = read(planPath, 'the plan file');
     const factsText = factsPath ? read(factsPath, '--facts') : undefined;
-    const loaded = await loadProjectConfig(cwd);
+    // B50: the project's config and ledger, also from a subfolder of the project
+    const root = projectRootFor(cwd);
+    const loaded = await loadProjectConfig(root);
     if (!loaded.ok && loaded.error !== 'not-found') {
       writeSafe(stderr, `plan: ${loaded.message}\n`);
       return 2;
     }
     const cfg = loaded.ok ? loaded.config : undefined;
     // the same ledger as the rest of the tool (and `jev ask`): --slug, else project.slug, else the directory name
-    const slug = typeof flags.slug === 'string' ? flags.slug : slugFor(cfg, cwd);
+    const slug = typeof flags.slug === 'string' ? flags.slug : slugFor(cfg, root);
     try {
       ledgerPath(slug);
     } catch {
@@ -64,7 +67,16 @@ export async function runPlanVerb(args, deps = {}) {
     }
     // a missing ledger is no rows (every block `none`); any other read error propagates as itself
     const decisions = await readAllRows(slug);
-    const result = checkPlan(text, { planPath, factsPath, factsText, cfg, decisions });
+    // package.json is read lazily: only a command claim that needs the bin prefix reads it, so a bad
+    // package.json fails only the plans that depend on it
+    let result;
+    try {
+      result = checkPlan(text, { planPath, factsPath, factsText, cfg, decisions, projectBins: () => readProjectBins(root) });
+    } catch (err) {
+      if (!(err instanceof FactsError)) throw err;
+      writeSafe(stderr, `plan: ${err.message}\n`);
+      return 2;
+    }
     for (const line of result.warnings) writeSafe(stderr, `${line}\n`);
     for (const line of result.errors) writeSafe(stderr, `${line}\n`);
     if (result.ok) writeSafe(stdout, `plan check: ok (${result.blocks} blocks)\n`);

package/src/cli/run.mjs

@@ -24,7 +24,7 @@
 
 import path from 'node:path';
 import { reloadFailureText, reloadWorkspace } from '../autopilot/limits.mjs';
-import { DEFAULT_CONFIG_FILENAME, loadProjectConfig, slugFor } from '../config/load.mjs';
+import { DEFAULT_CONFIG_FILENAME, loadProjectConfig, projectRootFor, slugFor } from '../config/load.mjs';
 import { budgetUsdOf, runSpend } from '../ledger/spend.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
@@ -118,7 +118,8 @@ export async function runRun(args, deps = {}) {
       return 0;
     }
     if (sub === 'start') {
-      const workspace = path.resolve(typeof flags.cwd === 'string' ? flags.cwd : process.cwd());
+      // B50: the run's workspace is the project root (its config and ledger slug), also from a subfolder
+      const workspace = projectRootFor(path.resolve(typeof flags.cwd === 'string' ? flags.cwd : process.cwd()));
       const loaded = await loadProjectConfig(workspace);
       if (!loaded.ok) {
         err(`run start: ${loaded.message}\n`);

package/src/cli/s2.mjs

@@ -8,7 +8,7 @@
 
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { loadProjectConfig, slugFor } from '../config/load.mjs';
+import { loadProjectConfig, projectRootFor, slugFor } from '../config/load.mjs';
 import { runS2 } from '../session/s2.mjs';
 import { runRootFor, SessionError } from '../session/spawn.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
@@ -51,7 +51,9 @@ export async function runS2Verb(args, deps = {}) {
       writeSafe(stderr, USAGE);
       return 2;
     }
-    const loaded = await loadProjectConfig(process.cwd());
+    // B50: the project root's config and ledger slug, also from a subfolder
+    const root = projectRootFor(process.cwd());
+    const loaded = await loadProjectConfig(root);
     if (!loaded.ok) {
       writeSafe(stderr, `s2: ${loaded.message}\n`);
       return 2;
@@ -66,7 +68,7 @@ export async function runS2Verb(args, deps = {}) {
         run: typeof flags.run === 'string' ? flags.run : undefined,
         block: typeof flags.block === 'string' ? flags.block : undefined,
         runRoot: typeof flags.run === 'string' ? runRootFor(flags.run, cfg?.tmp?.root) : undefined,
-        slug: slugFor(cfg, process.cwd()),
+        slug: slugFor(cfg, root),
         timeoutMs: timeout === undefined ? undefined : timeout * 1000,
       },
       { ...deps, stderr },

package/src/cli/spawn.mjs

@@ -10,7 +10,7 @@
 
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { loadProjectConfig, slugFor } from '../config/load.mjs';
+import { loadProjectConfig, projectRootFor, slugFor } from '../config/load.mjs';
 import { ROLES, runRootFor, SessionError, spawnSession } from '../session/spawn.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
@@ -60,7 +60,9 @@ export async function runSpawn(args, deps = {}) {
       writeSafe(stderr, USAGE);
       return 2;
     }
-    const loaded = await loadProjectConfig(process.cwd());
+    // B50: the project root's config and ledger slug, also from a subfolder
+    const root = projectRootFor(process.cwd());
+    const loaded = await loadProjectConfig(root);
     if (!loaded.ok) {
       writeSafe(stderr, `spawn: ${loaded.message}\n`);
       return 2;
@@ -81,7 +83,7 @@ export async function runSpawn(args, deps = {}) {
         runRoot: typeof flags.run === 'string' ? runRootFor(flags.run, cfg?.tmp?.root) : undefined,
         run: typeof flags.run === 'string' ? flags.run : undefined,
         block: typeof flags.block === 'string' ? flags.block : undefined,
-        slug: slugFor(cfg, process.cwd()),
+        slug: slugFor(cfg, root),
       },
       { ...deps, stderr },
     );