@entelligentsia/forgecli 1.0.2 → 1.0.10

package/dist/forge-payload/.schemas/migrations.json

@@ -1,4 +1,76 @@
 {
+  "1.0.9": {
+    "version": "1.0.10",
+    "date": "2026-05-31",
+    "notes": "v1.0.10 — set-summary self-resolve hardening. When the JSON file is omitted, set-summary/set-bug-summary resolve the CANONICAL sidecar name (e.g. VALIDATION-SUMMARY.json) from the phase→kind map. If that file is missing but a near-name summary sidecar exists in the same dir (e.g. an agent wrote VALIDATE-SUMMARY.json via the Write tool instead of forge_artifact's canonical name), the error now surfaces the near-name file and points at the canonical write path (forge_artifact artifact:\"<kind>\"), instead of a silent 'file not found' dead-end. Surfaced by cartographer CART-S01-T01 validate, where the QA subagent wrote a non-canonical sidecar and the verdict never reached the store (orchestrator then correctly escalated via read-verdict). No behavior change when the canonical file is present.",
+    "target": "tools:store-cli",
+    "regenerate": ["tools"],
+    "breaking": false,
+    "manual": ["Run /forge:update to copy the updated tools into your project."]
+  },
+  "1.0.8": {
+    "version": "1.0.9",
+    "date": "2026-05-31",
+    "notes": "v1.0.9 — store-cli suggestion drift-map: add create→write. Agents reach for REST-style `create <entity>`, but store-cli has no `create` verb (records are written with `write`), and create→write is beyond Levenshtein ≤2 so only the curated drift-map can surface it. `store-cli create sprint` now emits `Unknown command: create (Did you mean \"write\"?)`. Pure error-message UX improvement; no behavior change for valid commands. Observed on cartographer sprint-init dogfooding.",
+    "target": "tools:store-cli",
+    "regenerate": ["tools"],
+    "breaking": false,
+    "manual": ["Run /forge:update to copy the updated tools into your project."]
+  },
+  "1.0.7": {
+    "version": "1.0.8",
+    "date": "2026-05-31",
+    "notes": "v1.0.8 — artifact-resolution Phase 4 (issue #111). ArtifactStore gains a backend registry: artifactStore.register(backend, impl) and per-call routing by the handle's `backend` (default 'fs'). Adding a storage backend is now implementing the six-method interface and registering it — no prompt or call-site changes (the acceptance criterion). Ships MemArtifactImpl, a complete synchronous in-memory reference backend, as the canonical template for real S3/CMS/DB providers. Per the ADR sync constraint, a networked impl is sync-bound for in-process callers and reachable async-internally only through the forge-cli subprocess surface — so no live remote backend is bundled. tools-only; no schema, workflow, or store-layout changes.",
+    "target": "tools:artifact-store",
+    "regenerate": ["tools"],
+    "breaking": false,
+    "manual": ["Run /forge:update to copy the updated tools into your project."]
+  },
+  "1.0.6": {
+    "version": "1.0.7",
+    "date": "2026-05-31",
+    "notes": "v1.0.7 — artifact-resolution Phase 3 (issue #111). Introduces the ArtifactStore/FsArtifactImpl provider seam (tools/artifact-store.cjs), mirroring the store.cjs Store/FSImpl pattern: a backend-agnostic, synchronous facade (read/write/exists/url/list/delete) delegating to a swappable impl, default-wired to the filesystem. artifact.cjs is now a thin CLI over the facade and gains exists/url/delete subcommands; entity-dir resolution moved into artifact-store.cjs (re-exported for back-compat). Records gain an optional backend-agnostic locator {backend,ref} (schemas/_defs/locator.schema.json, $ref'd from task/bug/sprint); record.path stays REQUIRED as the read-time alias (the resolver derives {backend:'fs',ref:path} when locator is absent), so legacy records work unchanged and no store rewrite is forced. Concepts docs (task.md/bug.md) updated. Materialization of locator into stored records is deferred — the alias covers it. No FSM/lifecycle or store-layout changes.",
+    "target": "tools:artifact,tools:artifact-store,schemas:task,schemas:bug,schemas:sprint",
+    "regenerate": ["tools", "schemas"],
+    "breaking": false,
+    "manual": ["Run /forge:update to copy the updated tools and schemas into your project."]
+  },
+  "1.0.5": {
+    "version": "1.0.6",
+    "date": "2026-05-31",
+    "notes": "v1.0.6 — artifact-resolution Phase 2 (issue #111). (1) The orchestrator's Verdict Detection no longer reads a markdown review artifact via the removed parse-verdict.cjs — meta-orchestrate.md was the last reference to that deleted tool, which would have crashed the verdict step. It now reads the verdict from the store record via read-verdict.cjs (--phase <role> --task|--bug <id>), branching on the stdout token; no artifact path is constructed. (2) Removed the stale verdict-source table that hard-coded {sprintDir}/{taskDir} markdown paths. (3) meta-commit reads ARCHITECT_APPROVAL by kind via forge_artifact instead of a built path; meta-collate anchors WRITEBACK-SUMMARY on the sprint record's path. (4) Documented canonical artifact addressing + the placeholder-token glossary in the store-cli-verbs fragment (rename-unsafe: tools parse the literal tokens). No schema or store-layout changes.",
+    "target": "workflows:orchestrate_task,workflows:commit,workflows:collate",
+    "regenerate": ["workflows:orchestrate_task", "workflows:commit", "workflows:collate"],
+    "breaking": false,
+    "manual": ["Run /forge:update to copy the updated workflows into your project."]
+  },
+  "1.0.4": {
+    "version": "1.0.5",
+    "date": "2026-05-31",
+    "notes": "v1.0.5 — artifact-resolution Phase 1 (issue #111). set-summary / set-bug-summary now self-resolve the phase-summary sidecar from the store record's path: the JSON file argument is optional and the call collapses to `set-summary <id> <phase>`. This fixes the 2-arg arity failure (plan-phase set-summary previously exited 1 with Usage) and removes the hand-built `engineering/sprints/{sprint}/{task}/…-SUMMARY.json` paths from the implement/validate/approve/bug-triage workflows, which broke on non-default on-disk layouts. New canonical kind registry tools/lib/artifact-kinds.cjs (ARTIFACT_CATALOG + bug-mode overrides + phase→kind map) is now the single source consumed by artifact.cjs and store-cli.cjs. No schema or store-layout changes; the explicit jsonFile form remains accepted for back-compat.",
+    "target": "tools:store-cli,tools:artifact,tools:artifact-kinds,workflows:implement_plan,workflows:validate_task,workflows:approve_task,workflows:triage",
+    "regenerate": ["tools", "workflows:implement_plan", "workflows:validate_task", "workflows:approve_task", "workflows:triage"],
+    "breaking": false,
+    "manual": ["Run /forge:update to copy the updated tools and workflows into your project."]
+  },
+  "1.0.3": {
+    "version": "1.0.4",
+    "date": "2026-05-30",
+    "notes": "v1.0.4 — two store/path tool fixes. (1) preflight-gate.cjs now derives {sprint}/{task} from the store record's task.path instead of reconstructing sprints/{sprintId}/{taskId}/, fixing false 'artifact missing' halts on projects whose on-disk layout differs from the default (legacy sprint_NN_*/tasks/ trees and tasks/-nested dirs). (2) The store-query NLP path no longer degrades an explicit-ID query into a full-store scan: the parser keeps primary=tasks when a follow-word ('with sprint'/'with feature') accompanies an anchored task ID, and the engine re-routes a stripped anchored ID to its entity and applies a default result cap (new 'truncated' flag) so unbounded listings never dump the whole store. No schema, workflow, or store-layout changes.",
+    "target": "tools:preflight-gate,tools:store-query",
+    "regenerate": ["tools"],
+    "breaking": false,
+    "manual": ["Run /forge:update to copy the updated tools into your project."]
+  },
+  "1.0.2": {
+    "version": "1.0.3",
+    "date": "2026-05-28",
+    "notes": "v1.0.3 — FORGE-BUG-040 (GH-110) fix. /forge:fix-bug now runs each phase as a phase-scoped subagent: triage uses the new triage.md workflow, plan-fix uses plan_task.md (bug-mode), implement uses implement_plan.md (bug-mode). Previously all three pointed at fix_bug.md (orchestrator-only body), causing the triage subagent to execute the entire lifecycle in one phase. Bug schema, transitions, and store layout are unchanged.",
+    "target": "workflows:triage,workflows:fix_bug",
+    "regenerate": ["workflows:triage", "workflows:fix_bug"],
+    "breaking": false,
+    "manual": []
+  },
   "1.0.1": {
     "version": "1.0.2",
     "date": "2026-05-27",

package/dist/forge-payload/.schemas/sprint.schema.json

@@ -20,6 +20,7 @@
     "createdAt":      { "type": "string", "format": "date-time" },
     "completedAt":    { "type": "string", "format": "date-time" },
     "path":           { "type": "string" },
+    "locator":        { "$ref": "_defs/locator.schema.json" },
     "humanEstimates": { "type": "object" },
     "features":       { "type": "array", "items": { "type": "string" } }
   },

package/dist/forge-payload/.schemas/task.schema.json

@@ -19,6 +19,7 @@
       ]
     },
     "path":                 { "type": "string" },
+    "locator":              { "$ref": "_defs/locator.schema.json" },
     "estimate":             { "type": "string", "enum": ["S", "M", "L", "XL"] },
     "dependencies":         { "type": "array", "items": { "type": "string" } },
     "knowledgeUpdates":     { "type": "array" },

package/dist/forge-payload/integrity.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.0.2",
-  "generated": "2026-05-27",
+  "version": "1.0.10",
+  "generated": "2026-05-31",
   "note": "Tamper-evident only. Authoritative source: /forge:update from remote.",
   "files": {
     "commands/add-pipeline.md": "529a2fc01be49815efa2cf1147528827ff1bfc12ce2ac8663b5a3a9781f8682e",
@@ -29,7 +29,7 @@
     "schemas/transitions/bug.json": "27b17da42d1cebffbd4f61ab3dcd432a0017aa71997d548ed80d22c2fc3fad6a",
     "schemas/transitions/sprint.json": "2e0a629396e687b0ca88e1814ac3e35d84533a5d55b25237ab67feddce3c9deb",
     "schemas/transitions/task.json": "4c71849747baa0d585756e57c56325ff6219c078178374e60815dff91e25e3e7",
-    "schemas/enum-catalog.json": "af954fc219984ba9944de123867590c90c09c532b8d3d40859648a75e9010e5c",
+    "schemas/enum-catalog.json": "fe6c4b9d0b326a22ccbe2d2e6b8ea81c4f81ea827b9b46507a214cbeffcd45d3",
     "tools/verify-integrity.cjs": "3ec3c970dd3d7c3001f8f373bcc40556803eadd2fc2afafb14f1c232cba4cc3f"
   }
 }

package/dist/forge-payload/meta/fragments/tool-discipline.md

@@ -1,9 +1,28 @@
 ## Forge Tool Discipline
 
 All forge_* tools wrap local .cjs scripts via direct exec — deterministic, no LLM,
-no agent loop. Prefer them over shelling out.
+no agent loop. Use them for all Forge-managed data — never bypass with god tools.
 
-- Store CRUD: call `forge_store` (named tool). Canonical write is 2-positional:
+### Data boundaries — off-limits to `read`, `cat`, `bash`, `grep`
+
+These paths contain Forge-managed data. Never access them with generic tools.
+
+| Path | Owned by | Use instead |
+|------|----------|-------------|
+| `.forge/store/**` | Store | `forge_store`, `forge_store_query` |
+| `{paths.engineering}/**/` task/bug/sprint dirs | Artifacts | `forge_artifact read` (covers all 15 artifact types) |
+| `{paths.engineering}/**/INDEX.md` | KB | `forge_store_query` or `forge_collate` |
+| `{paths.engineering}/MASTER_INDEX.md` | KB | `forge_store_query` or `forge_collate` |
+
+`{paths.engineering}` is the project's KB folder name from `.forge/config.json`
+(default: `engineering`). Never hardcode it.
+
+Source files (`.py`, `.ts`, `.js`, etc.), persona `.md`, workflow `.md`, and
+project config outside `.forge/store/` are fine to `read`/`grep` directly.
+
+### Tool routing
+
+- **Store CRUD:** call `forge_store` (named tool). Canonical write is 2-positional:
   `{command:"write", args:["<entity>","<json>"]}`. The id lives INSIDE the json
   (e.g. `{"sprintId":"X-S01","title":"...","status":"planning","taskIds":[],"createdAt":"..."}`).
   DO NOT pass id as a separate arg — `["sprint","X-S01","<json>"]` (3-arg) FAILS.

package/dist/forge-payload/meta/workflows/_fragments/store-cli-verbs.md

@@ -32,14 +32,29 @@ Notes for subagents:
   The three-arg form `update-status task {taskId} {value}` is WRONG and will
   error. Always include `status` between the id and the value.
 - **`emit`** appends an event. There is no `append-event` / `add-event`.
-- **`set-summary`** / **`set-bug-summary`** write summary sidecars referenced
-  from the entity record. Do not inline summaries into the entity via `write`.
+- **`set-summary <id> <phase>`** / **`set-bug-summary <id> <phase>`** link a
+  phase summary onto the entity record. The JSON-file argument is **optional**:
+  when omitted, the sidecar is auto-resolved from the record's `path` plus the
+  canonical phase→filename map (so `set-summary {taskId} validation` just works).
+  Never pass a hand-built `engineering/sprints/.../…-SUMMARY.json` path. Do not
+  inline summaries into the entity via `write`.
 - **Artifact I/O:** Use `forge_artifact` for ALL phase artifact reads and writes
   (PLAN.md, PROGRESS.md, *-SUMMARY.json, CODE_REVIEW.md, etc.). Never construct
   artifact file paths manually — the tool resolves paths from entity IDs and
   validates JSON summary schemas on write. After writing a summary JSON via
-  `forge_artifact`, link it to the store record via `forge_store set-summary`.
+  `forge_artifact`, link it to the store record via `forge_store set-summary {id} {phase}` (no path).
   Example: `forge_artifact({ command:"write", entity:"task", entityId:"{taskId}", artifact:"progress", content:"..." })`
+- **Artifact addressing (canonical) — never reconstruct a path.** Address an
+  artifact by `(entity, entityId, kind)` via `forge_artifact`, or read the
+  entity's `path` field from the store record. The on-disk directory is owned by
+  the record's `path`, NOT by any id template. Token glossary:
+  - `{sprintId}` / `{taskId}` / `{bugId}` — the **store record filenames**
+    (`.forge/store/<kind>s/<id>.json`); deterministic and safe to use as IDs.
+  - `{sprint}` / `{task}` / `{bug}` — runtime path-template substitutions used by
+    the **preflight gate**, derived from the record's `path` (not the bare ID).
+  - The engineering artifact directory always comes from `record.path`.
+  These spellings are parsed literally by tools (`preflight-gate.cjs`,
+  `collate.cjs`) — do not invent new spellings or rename them in prose.
 - If you need a verb not on this list, run
   `node "$FORGE_ROOT/tools/store-cli.cjs" --help` before improvising.
 - If you supply an unknown verb, entity type, enum value, or field name,

package/dist/forge-payload/meta/workflows/meta-approve.md

@@ -103,15 +103,14 @@ The Architect gives final sign-off on a completed task after Supervisor approval
        "artifact_ref":"ARCHITECT_APPROVAL.md"
      }
      ```
-   - Call (task mode) — optional for tasks, since `task.status` is the canonical signal:
+   - Call (task mode) — optional for tasks, since `task.status` is the canonical signal.
+     The sidecar path is auto-resolved from the record's `path` — never pass it:
      ```
-     node "$FORGE_ROOT/tools/store-cli.cjs" set-summary {taskId} approve \
-       engineering/sprints/{sprint}/{task}/APPROVE-SUMMARY.json
+     node "$FORGE_ROOT/tools/store-cli.cjs" set-summary {taskId} approve
      ```
      Or (bug mode) — REQUIRED for bugs, this is the canonical verdict signal:
      ```
-     node "$FORGE_ROOT/tools/store-cli.cjs" set-bug-summary {bugId} approve \
-       engineering/bugs/{bugDir}/APPROVE-SUMMARY.json
+     node "$FORGE_ROOT/tools/store-cli.cjs" set-bug-summary {bugId} approve
      ```
    - In bug mode, if the set-bug-summary call exits non-zero, fix the sidecar JSON and retry. Do not return without a valid summary — the downstream commit gate has no other way to read the approval verdict.
 ```

package/dist/forge-payload/meta/workflows/meta-bug-triage.md

@@ -0,0 +1,210 @@
+---
+requirements:
+  reasoning: High
+  context: Medium
+  speed: Medium
+audience: subagent
+phase: triage
+context:
+  architecture: false
+  prior_summaries: delta
+  persona: summary
+  master_index: false
+  diff_mode: false
+deps:
+  personas: [bug-fixer]
+  skills: [bug-fixer, generic]
+  templates: []
+  sub_workflows: []
+  kb_docs: [architecture/stack.md]
+  config_fields: [commands.test, paths.engineering]
+---
+
+# 🍂 Meta-Workflow: Bug Triage
+
+## Purpose
+
+The Bug Fixer reproduces a reported bug, confirms root cause, decides the
+fix route (Path A short-circuit vs Path B full loop), and writes the
+triage artifact + summary. This is the **first phase** of `/forge:fix-bug`
+and the only phase that records the route decision read by the orchestrator
+(`meta-fix-bug.md`) to select `phases_A` vs `phases_B`.
+
+<!-- See _fragments/iron-laws.md for Iron Laws section structure guidance -->
+## Iron Laws
+
+- Reproduce the bug before deciding anything. A bug without a confirmed
+  reproduction has no business going to plan-fix or implement.
+- Read `.forge/personas/bug-fixer.md` first; print the persona identity
+  line (emoji, name, tagline) to stdout before any other tool use.
+- All store I/O via `forge_store` (or `node "$FORGE_ROOT/tools/store-cli.cjs"`).
+  Never edit `.forge/store/*.json` directly.
+- **Triage NEVER writes `bug.status`.** The orchestrator (`meta-fix-bug.md`)
+  owns the `reported → triaged` and `triaged → in-progress` transitions.
+  Writing `bug.status` from this workflow violates `meta-fix-bug.md
+  § Iron Laws #2` (parallel to `meta-review-plan.md`'s "Supervisor NEVER
+  writes entity status" rule).
+- Triage is a **single phase**. Do NOT call `forge_preflight` with any
+  other `--phase` value. Do NOT call `forge_store update-status`,
+  `set-bug-summary` for any non-triage phase, or `forge_store emit`.
+  These are orchestrator-owned or other-phase-owned actions. The
+  phase-ownership guard in forge-cli will reject violations at the tool
+  layer, but the Iron Law names the rule.
+
+## Store-Write Verification
+
+<!-- See _fragments/store-write-verification.md for the canonical block content -->
+
+## Algorithm
+
+```
+
+0. Pre-flight Gate Check:
+   - Resolve FORGE_ROOT (`node -e "console.log(require('./.forge/config.json').paths.forgeRoot)"`).
+   - Run: `node "$FORGE_ROOT/tools/preflight-gate.cjs" --phase triage --bug {bugId}`
+   - Exit 1 (gate failed) → print stderr and HALT. Do not proceed.
+   - Exit 2 (misconfiguration) → print stderr and HALT.
+   - Exit 0 → continue.
+
+1. Load Context:
+   - Read `.forge/personas/bug-fixer.md` first; print the persona identity
+     line to stdout before any other tool use.
+   - Read the bug record:
+     `forge_store({ command:"read", entity:"bug", id:"{bugId}" })`
+   - Read business domain docs relevant to the reported symptom.
+   - store-cli verbs: `read` | `list` | `write` | `emit` |
+     `update-status` | `set-summary` | `set-bug-summary` | `describe` |
+     `nlp` | `query` | `delete` — there is no `get`/`set`/`find`. See
+     `_fragments/store-cli-verbs.md` for full notes.
+
+2. Reproduce:
+   - Construct a minimal reproduction: a failing test, a short script,
+     or a documented manual sequence that triggers the reported symptom.
+   - If reproduction cannot be achieved with the information in the bug
+     record, write what was tried in TRIAGE.md, set the route to "B"
+     (any uncertainty defaults to Path B), and continue to root-cause
+     research with the reporter's narrative as the working hypothesis.
+
+3. Root-Cause Research:
+   - Read the code paths implicated by the reproduction.
+   - Confirm (or revise) the reporter's stated root cause via direct
+     inspection of source files and tests.
+   - Note collateral damage: which other call sites, schemas, or
+     workflows share the defective shape.
+
+4. Path A / Path B Eligibility:
+   - Apply the criteria in § "Path A / Path B Eligibility" below.
+   - Record the route decision and the explicit enumeration of each
+     criterion in the findings section of the triage summary.
+
+5. Write Triage Artifacts:
+   - Write the triage artifact (markdown narrative):
+     `forge_artifact({ command:"write", entity:"bug", entityId:"{bugId}",
+                       artifact:"triage", content:"<markdown>" })`
+   - Write the triage-summary sidecar (JSON shape below):
+     `forge_artifact({ command:"write", entity:"bug", entityId:"{bugId}",
+                       artifact:"triage-summary", content:"<JSON>" })`
+
+6. Finalize:
+   - **No status write.** The orchestrator (`meta-fix-bug.md`) writes the
+     `reported → triaged` and `triaged → in-progress` transitions on
+     return. Writing `bug.status` from this workflow is forbidden by
+     Iron Laws above and is rejected by the phase-ownership guard.
+   - **Do NOT emit a phase event yourself.** The orchestrator owns event
+     emission — it composes the canonical event from runtime telemetry
+     (model, provider, tokens, wall times) plus the SUMMARY you write
+     in the next step.
+
+7. Emit Summary Sidecar:
+   - The JSON written in step 5 MUST have this shape (the `route` field
+     is required; allowed values: `"A"` or `"B"`):
+
+     ```json
+     {
+       "objective":   "Triage FORGE-BUG-NNN — reproduce, locate, decide route.",
+       "key_changes": ["<up to 12 bullets, 200 chars each — findings or actions>"],
+       "findings": [
+         "Root cause: <one line>",
+         "Reproduction: <one line>",
+         "Route decision: A | B",
+         "Rationale: <one line>"
+       ],
+       "verdict":     "n/a",
+       "written_at":  "<current ISO 8601 timestamp>",
+       "artifact_ref":"TRIAGE.md",
+       "route":       "A"
+     }
+     ```
+
+   - Call:
+     ```
+     forge_store({ command:"set-bug-summary", entity:"bug",
+                   id:"{bugId}", phase:"triage" })
+     // sidecar path auto-resolved from the bug record's `path` — never pass it
+     ```
+   - If the set-bug-summary call exits non-zero, fix the sidecar JSON
+     and retry (up to 3 attempts per the Store-Write Verification rule).
+     Do not proceed without a valid summary.
+
+> **Field-naming caution — runtime-tested.** The route field is named
+> `route`, never `path`. The bug schema's top-level `path` field is the
+> bug's **artifact directory** (e.g. `engineering/bugs/EMG-BUG-001-...`).
+> Conflating the two caused EMBERGLOW-BUG-001 (v0.44.0 first run) to land
+> its `TRIAGE.md` under `.forge/store/bugs/` instead of `engineering/bugs/`.
+> Triage MUST NOT touch `bug.path` — that field is set at bug creation
+> and never modified by triage.
+```
+
+## Path A / Path B Eligibility
+
+Path A is **eligible only when ALL** of the following hold. The triage
+summary `findings` array MUST enumerate each criterion explicitly with a
+pass/fail mark, so reviewers can audit the decision:
+
+- `bug.severity ∈ {minor}`
+- Fix is contained in a single file
+- Estimated diff ≤ ~20 lines (judgement call; one screen)
+- No schema, API, migration, security, or build-system change
+- A regression test is obvious from the reproduction script (single short
+  test case, no new fixtures, no test-harness change)
+
+If any criterion fails, the triage subagent MUST select Path B.
+
+**Path B is the default.** Any uncertainty resolves to Path B. It runs the
+same plan/review/implement/review/approve/commit shape as
+`meta-orchestrate.md`. Picking Path A under uncertainty is the documented
+failure mode (over-eager short-circuit).
+
+## Triage Artifact Contents (TRIAGE.md)
+
+The narrative artifact MUST contain:
+
+1. **Reported symptom** — one paragraph summarising the bug report.
+2. **Reproduction** — exact steps, commands, or test case that triggers
+   the symptom; copy of the failing output.
+3. **Root cause** — one or two paragraphs naming the defective code path,
+   schema, or workflow. Cite file paths and line numbers.
+4. **Path A / Path B enumeration** — for each criterion above, mark
+   pass/fail with one-line evidence.
+5. **Route decision and rationale** — the chosen route and the
+   single-sentence justification.
+6. **Collateral findings** — any related shapes, call sites, or
+   workflows that share the defective pattern (filed as follow-ups in
+   the commit phase, not fixed here).
+
+<!-- See _fragments/generation-instructions.md for Generation Instructions template -->
+## Generation Instructions
+
+- The generated `triage.md` MUST include all four markers required by
+  `forge-cli/src/extensions/forgecli/lib/manifest-checker.ts §
+  checkMaterialization`: (1) `## Store-Write Verification` heading;
+  (2) `## Iron Laws` heading; (3) literal `forge_store` token in body;
+  (4) `.forge/personas/bug-fixer.md` referenced in body.
+- Token Reporting: `_fragments/finalize.md` — wire via `file_ref:`.
+- Event Emission: orchestrator-owned; this workflow MUST NOT call
+  `forge_store emit` for phase events.
+
+## Friction Emit
+
+Emit `type:friction` `{workflow:triage, persona:bug-fixer, issue}` per
+`_fragments/friction-emit.md`.

package/dist/forge-payload/meta/workflows/meta-collate.md

@@ -72,7 +72,7 @@ Never set `FORGE_SKIP_WRITE_VALIDATION=1` — operator-only emergency switch.
 
 4. Finalize:
    - **Do NOT emit a phase event yourself.** The orchestrator (or kickoff handler) owns event emission — it composes the canonical event from runtime telemetry (model, provider, tokens, wall times) plus the SUMMARY you write in the next step. Subagents that call `store-cli emit` for phase events hallucinate runtime facts (see Plan 11 / Slice 2). Write the SUMMARY and return.
-   - Write `WRITEBACK-SUMMARY.json` to the sprint directory (`engineering/sprints/{sprintId}/`) with the following shape:
+   - Write `WRITEBACK-SUMMARY.json` to the sprint's artifact directory — use the sprint record's `path` field (read it from the store), not a reconstructed `engineering/sprints/{sprintId}/` template — with the following shape:
      ```json
      {
        "objective":   "<one sentence — what views were regenerated>",

package/dist/forge-payload/meta/workflows/meta-commit.md

@@ -62,9 +62,8 @@ Seal a completed and approved task by committing its artifacts to the VCS and up
 
 1. Load Context:
    - Read the record manifest (task or bug, per entity_kind).
-   - Read ARCHITECT_APPROVAL.md from the record's artifact directory:
-     - Task mode: `engineering/sprints/{sprint}/{task}/ARCHITECT_APPROVAL.md`
-     - Bug mode:  `engineering/bugs/{bugDir}/ARCHITECT_APPROVAL.md`
+   - Read ARCHITECT_APPROVAL.md by kind — never construct the path:
+     `forge_artifact({ command:"read", entity:"{entity_kind}", entityId:"{record_id}", artifact:"architect-approval" })`
 
 2. Staging:
    - Stage all record-related artifacts and the code changes:

package/dist/forge-payload/meta/workflows/meta-fix-bug.md

@@ -31,7 +31,7 @@ Phases`):
 
 | Phase | Role | Persona | Workflow | Path A | Path B |
 |---|---|---|---|---|---|
-| triage | `triage` | bug-fixer | (inline algorithm) | yes | yes |
+| triage | `triage` | bug-fixer | `triage.md` | yes | yes |
 | plan-fix | `plan` | engineer | `plan_task.md` (bug-mode) | no | yes |
 | review-plan | `review-plan` | supervisor | `review_plan.md` | no | yes |
 | implement | `implement` | engineer | `implement_plan.md` (bug-mode) | yes | yes |
@@ -101,24 +101,11 @@ The `route` field is required. Allowed values: `"A"` or `"B"`.
 > Triage subagents MUST NOT touch `bug.path` — that field is set at bug
 > creation and never modified by triage.
 
-### Path A — short-circuit (eligibility)
+### Path A / Path B eligibility
 
-Path A is **eligible only when ALL** of the following hold. Triage subagent
-must enumerate each in its findings:
-
-- `bug.severity ∈ {minor}`
-- Fix is contained in a single file
-- Estimated diff ≤ ~20 lines (judgement call; one screen)
-- No schema, API, migration, security, or build-system change
-- A regression test is obvious from the reproduction script (single short
-  test case, no new fixtures, no test-harness change)
-
-If any criterion fails, the triage subagent MUST select Path B.
-
-### Path B — full loop (default)
-
-Path B runs the same plan/review/implement/review/approve/commit shape as
-`meta-orchestrate.md`. It is the default. Any uncertainty defaults Path B.
+See `triage.md § Path A / Path B Eligibility` for the criteria the triage
+subagent applies. The criteria are single-sourced in the triage workflow;
+this orchestrator only reads the resulting `summaries.triage.route` value.
 
 ### Pipeline selection by path
 
@@ -164,16 +151,11 @@ Differences are confined to the **triage** step and the **path branch**.
      b. If .forge/store/bugs/{BUG_ID}.json does NOT exist, write a fresh record
         via store-cli with status="reported".
      c. Read the now-guaranteed record.
-   - Spawn the triage subagent (persona: bug-fixer). It MUST:
-     • Reproduce the bug (failing test or reproduction script).
-     • Confirm the root cause via codebase research.
-     • Decide Path A vs Path B by the criteria above.
-     • Write triage artifact:
-       forge_artifact({ command:"write", entity:"bug", entityId:"{bugId}", artifact:"triage", content:"<markdown>" })
-     • Write triage-summary artifact (JSON shape documented in § Triage Judgement):
-       forge_artifact({ command:"write", entity:"bug", entityId:"{bugId}", artifact:"triage-summary", content:"<JSON>" })
-     • Call set-bug-summary {bugId} triage via forge_store:
-       forge_store({ command:"set-bug-summary", bugId:"{bugId}", phase:"triage", file:"TRIAGE-SUMMARY.json" })
+   - Spawn the triage subagent (workflow: `triage.md`, persona: bug-fixer).
+     It MUST write `TRIAGE.md` + `TRIAGE-SUMMARY.json` with a `route` field
+     (`"A"` or `"B"`) and call `set-bug-summary {bugId} triage` per
+     `triage.md`. The triage workflow is `audience: subagent`, `phase: triage`;
+     the orchestrator MUST NOT pass any other workflow body to this subagent.
    - On return, orchestrator transitions status:
        store-cli update-status bug {bugId} status triaged
        store-cli update-status bug {bugId} status in-progress

package/dist/forge-payload/meta/workflows/meta-implement.md

@@ -96,9 +96,10 @@ The Engineer implements the approved plan: write code, run tests, verify, and do
      JSON shape: `{"objective":"<one sentence>", "key_changes":["<up to 12 bullets>"], "verdict":"n/a", "written_at":"<ISO 8601>", "artifact_ref":"PROGRESS.md"}`
      The tool validates required fields automatically — fix and retry if it rejects.
    - Then link sidecar to store (task mode):
-     `forge_store({ command:"set-summary", args:["{taskId}", "implementation", "engineering/sprints/{sprint}/{task}/IMPLEMENTATION-SUMMARY.json"] })`
+     `forge_store({ command:"set-summary", args:["{taskId}", "implementation"] })`
      Or (bug mode):
-     `forge_store({ command:"set-bug-summary", args:["{bugId}", "implementation", "engineering/bugs/{bugDir}/IMPLEMENTATION-SUMMARY.json"] })`
+     `forge_store({ command:"set-bug-summary", args:["{bugId}", "implementation"] })`
+     The sidecar path is auto-resolved from the record's `path` — never pass it.
 ```
 
 <!-- See _fragments/iron-laws.md for Iron Laws section structure guidance -->