@warpgogol/forge 5.3.3 → 6.0.0

package/skills/fo/fo-idea-plan/SKILL.md

@@ -20,9 +20,25 @@ triggerPhrases: ["plan the implementation for this RFC", "create implementation
 </non-goals>
 </MODULE_CONTRACT>
 <CHANGE_SUMMARY>
+  <item>RFC-1250: collect-mode contract — open questions and grilling emit to
+  the decision ledger; draft plan carries PENDING DECISION markers;
+  draft-to-accepted transition deferred to the resolution phase (window =
+  acceptance act).</item>
   <item>RFC-1097: sweep — SKILL.md headers + classification fixes
 
 Sweep batch 1: add Compass v2 headers to 45 SKILL.md files (purpose derived from frontmatter description). Fix non-skill-markdown exclusion to check filename not workspace-relative path (packages/AGENTS.md escaped it). Add .coverage to ignoredDirs.</item>
+  <item>RFC-1250: review wave — QUEUE-07 gates un-parked opens only, ledger binding checks, fail-closed loader
+
+REVIEW-RFC-1250-01 findings: QUEUE-07 no longer fires on parked entries
+(the park is the containment — a parked queue stays resumable and the
+decision window arbitrates it); loader fails open only on ENOENT —
+other read errors are QUEUE-01; ledger gains queue/id-stem binding
+(QUEUE-02), Q-N uniqueness (QUEUE-05), and QUEUE-08 hygiene warnings
+(missing answers, foreign doc ids); next excludes QUEUE-07-blocked
+items; top-level decision totals added. Orchestrator pre-flight treats
+QUEUE-07 as the window agenda — structural errors still stop the batch;
+maturation skips parked/deferred items; uncovered imperative ask sites
+gain collect riders (ADR code-trace, NC markers, audit-verdict guard).</item>
 </CHANGE_SUMMARY>
 -->
 
@@ -71,7 +87,11 @@ If all checks pass, proceed to step 0.3.
 
 #### 0.3. Transition draft → accepted
 
-If the RFC is `draft` or `reviewing` and has `enhancedAt` — the user's instruction to plan IS the architecture acceptance. Transition the RFC to `accepted`:
+If the RFC is `draft` or `reviewing` and has `enhancedAt` — the user's instruction to plan IS the architecture acceptance. Transition the RFC to `accepted`.
+
+**Collect mode exception:** inside an orchestrator-driven queue run the `draft → accepted` transition moves to the resolution phase — the answered decision window IS the acceptance act. In collect mode this skill persists the plan as a draft carrying `PENDING DECISION` markers and does NOT transition the RFC; the orchestrator's resolution phase finalizes (integrate answers, lift markers, transition + commit) after the window.
+
+Standalone/interview-mode flow:
 
 1. Set `status: accepted`.
 2. Set `reviewers` — if the operator specified a reviewer at invocation, use that. Otherwise, read the default reviewer(s) from the `reviewers` field comment in `docs/rfcs/rfc-0000-template.md`. Set all listed default reviewers.
@@ -93,7 +113,7 @@ Then proceed to step 1.
 **Inherited acceptance.** If the RFC has a `specRef` frontmatter field pointing to a spec with `status: accepted`, the acceptance inheritance path applies:
 
 1. Check the audit report for this RFC — if the audit verdict is `approved`, the RFC MAY transition `draft → accepted` without a separate human acceptance ceremony. Record `reviewers` from the spec's `reviewers` field and note `via spec acceptance <spec-id>` in the commit message.
-2. If the audit verdict is `needs-revision` or `rejected`, inheritance is void — a human decision is required. Do not transition; ask the operator.
+2. If the audit verdict is `needs-revision` or `rejected`, inheritance is void — a human decision is required. Do not transition; ask the operator. **Collect mode:** instead of asking, append an `open` ledger entry (`stage: plan`) recording the audit verdict and the inheritance question, leave a `> PENDING DECISION: Q-N` marker in the draft plan, and do not transition — the window arbitrates whether the RFC proceeds or returns to enhance.
 3. If the `specRef` points to a spec with `status: vendored` (not yet accepted), the RFC cannot progress past `draft` — V-SPEC-03 blocks it.
 
 ### 1. Read the RFC
@@ -125,13 +145,15 @@ Verify the RFC's claims about affected artifacts. Check:
 
 After exploring, identify decisions the RFC leaves open — ambiguities, trade-offs, unspecified boundaries, conflicting constraints. These are **decisions**, not facts: if a fact can be found by exploring the codebase, look it up instead of asking.
 
-Walk the user through each question **one at a time**. For each:
+**Collect mode:** under an orchestrated run, never call `ask_user_question` — climb the self-resolution ladder (`_shared/fo-pipeline-conventions.md` §Self-resolution ladder); genuine trade-offs append to the queue's decision ledger as `open` entries (`stage: plan`) with recommended options, and `> PENDING DECISION: Q-N` markers land in the draft plan at the steps that depend on the answer.
+
+Interview mode: walk the user through each question **one at a time**. For each:
 
 1. **Short context** — what the question is, why the plan needs it resolved, what changes depending on the answer.
 2. **Options** — list 2-4 concrete options, **recommended option first**. Mark it with "(recommended)". Each option is a short label plus one line explaining the trade-off.
 3. **Wait** — present the question and stop. Do not batch multiple questions; asking several at once is bewildering.
 
-Use the `ask_user_question` tool when available, with the recommended option as the first entry. Otherwise, present the question inline and wait for the answer.
+Use the `ask_user_question` tool when available (interview mode only), with the recommended option as the first entry. Otherwise, present the question inline and wait for the answer.
 
 Typical questions that arise:
 
@@ -146,7 +168,7 @@ If exploration surfaces no open questions, skip this step and proceed directly t
 
 ### 4. Draft the plan
 
-Copy `docs/plans/plan-0000-template.md` and fill it, incorporating the user's answers from step 3. Each step must have a **completion criterion** — a checkable condition that tells the agent the step is done.
+Copy `docs/plans/plan-0000-template.md` and fill it, incorporating the user's answers from step 3. Each step must have a **completion criterion** — a checkable condition that tells the agent the step is done. Keep the template's `## Falsified routes` ledger section — implementing skills append to it when an approach is abandoned after a real attempt (see `_shared/fo-pipeline-conventions.md` §Falsified-routes ledger).
 
 Step ordering follows the contract-first pattern:
 
@@ -168,7 +190,7 @@ Mark **human review points** on steps that:
 
 ### 5. Grill the plan
 
-Invoke the `/grilling` skill to stress-test the draft plan before persisting. This is **mandatory**, not optional — every plan goes through grilling.
+Invoke the `/grilling` skill to stress-test the draft plan before persisting. This is **mandatory**, not optional — every plan goes through grilling. **Collect mode:** grilling runs in `emit` mode — questions land in the ledger (`stage: plan`) with recommended answers; no interview.
 
 The grilling checks:
 

package/skills/fo/fo-review/SKILL.md

@@ -9,7 +9,7 @@ languagePolicy: ref(PREFERENCES.md)
 bindings:
   requires: [commands.validateRfc]
   optional: [paths.invariantsFile, paths.compassDocs]
-triggerPhrases: ["review this code diff", "check code against Forge standards", "fitness check on code changes"]
+triggerPhrases: ["проверим всё ли сделали правильно", "проверь изменения", "review this session", "review this code diff", "check code against Forge standards"]
 ---
 
 <!--
@@ -20,9 +20,24 @@ triggerPhrases: ["review this code diff", "check code against Forge standards",
 </non-goals>
 </MODULE_CONTRACT>
 <CHANGE_SUMMARY>
+  <item>RFC-1250: soft-block arbitration appends to the queue decision ledger
+  (open / stage: review) under orchestrated runs.</item>
   <item>RFC-1097: sweep — SKILL.md headers + classification fixes
 
 Sweep batch 1: add Compass v2 headers to 45 SKILL.md files (purpose derived from frontmatter description). Fix non-skill-markdown exclusion to check filename not workspace-relative path (packages/AGENTS.md escaped it). Add .coverage to ignoredDirs.</item>
+  <item>RFC-1247: triggerPhrases vocabulary sync — mined operator phrasing applied to this skill's trigger set.</item>
+  <item>RFC-1250: review wave — QUEUE-07 gates un-parked opens only, ledger binding checks, fail-closed loader
+
+REVIEW-RFC-1250-01 findings: QUEUE-07 no longer fires on parked entries
+(the park is the containment — a parked queue stays resumable and the
+decision window arbitrates it); loader fails open only on ENOENT —
+other read errors are QUEUE-01; ledger gains queue/id-stem binding
+(QUEUE-02), Q-N uniqueness (QUEUE-05), and QUEUE-08 hygiene warnings
+(missing answers, foreign doc ids); next excludes QUEUE-07-blocked
+items; top-level decision totals added. Orchestrator pre-flight treats
+QUEUE-07 as the window agenda — structural errors still stop the batch;
+maturation skips parked/deferred items; uncovered imperative ask sites
+gain collect riders (ADR code-trace, NC markers, audit-verdict guard).</item>
 </CHANGE_SUMMARY>
 -->
 
@@ -41,6 +56,25 @@ This skill reviews **code** — `.ts`, `.js`, `.tsx`, `.astro`, `.css`, `.json`,
 - For **RFCs, ADRs, architecture docs, or plans**, use `/fo-idea-audit` instead.
 - For **iterative fix-then-build-then-commit**, use `/fo-fix`.
 
+## Review modes: `inline` vs `independent`
+
+`fo-review` accepts an `independent` flag. **Default: `true` when invoked from a pipeline orchestrator (`fo-idea-i-just-want-to-see-the-result`, `fo-idea-implement`), `false` for ad-hoc in-session review.**
+
+In `independent` mode the reviewing pass executes in a **clean agent context** — a subagent dispatch where the platform provides one — carrying only artifacts:
+
+- the diff range or file list to review;
+- the rubric paths (this skill file, `_shared/fo-pipeline-conventions.md`);
+- the anchor paths (AGENTS.md files, DNA invariants file, relevant specs);
+- raw evidence (command output, failing logs, mechanical floor results).
+
+**Never pass the executor's session narrative, self-assessment, or settled conclusions** — passing them defeats the isolation the mode exists for (veil-of-ignorance contract, shared with the falsified-routes blind-spot pass). The dispatched reviewer's prompt contains artifact paths and the rubric, not the executor's story.
+
+Where the platform exposes no subagent primitive (or policy forbids dispatch), run an `isolated-inline` pass instead: re-derive conclusions only from the artifacts, deliberately ignoring the session's accumulated narrative, and record the fallback. **Never claim `subagent` isolation that did not happen** — the persisted report's `reviewer.isolation` field records the mode actually used (`subagent` | `isolated-inline` | `inline`), so independence is auditable rather than asserted.
+
+An executor that narrows the reviewer's inputs — passing a self-authored summary instead of artifact paths — commits a scope-narrowing violation, itself reportable as a `soft-block` on the review process.
+
+**Report persistence is the dispatcher's duty in `independent` mode.** A clean-context reviewer may be read-only and never writes files — it returns findings and verdict. The skill run that dispatched it performs steps 6–7 itself: it assembles the report, builds the YAML frontmatter (`reviewer.isolation` records the mode actually used), and writes the file to `docs/reviews/code/`. A persisted review report without the frontmatter block is a contract violation regardless of which side produced the prose.
+
 ## Process
 
 ### 1. Identify the diff
@@ -99,7 +133,7 @@ Read the context the diff claims to fit into:
 
 Do not read every file in the repo — only the standards relevant to the diff.
 
-### 4. Run the seven review axes
+### 4. Run the eight review axes
 
 For each axis, check every item. An item either **passes**, **fails** (specific finding with evidence), or is **not applicable** (state why). Skip N/A items silently — do not pad the report.
 
@@ -177,6 +211,15 @@ If the invariants file is absent or the optional binding is unresolvable, state
 - **Migration path**: existing apps' path to compliance is documented.
 - **Security / privacy**: if the diff touches user data, PII, or external services, it addresses GDPR/privacy and secret management. No cookies (`document.cookie`, `Set-Cookie`). Client-side persistence is `localStorage` only; server-side is `unstorage`.
 
+#### Axis H — Fracture inference
+
+Will this output collapse at the next step? Judge the diff not only for what it is, but for whether the _process that produced it_ is honest:
+
+- **Goal-closure authenticity** — claims of completion vs. verifiable evidence. A marked-done criterion whose checkable trace is absent or hand-waved is a fracture signal.
+- **Ordering-constraint compliance** — skipped preconditions: plan steps executed out of order, dependencies implemented after their dependents, gates bypassed to reach a green run.
+- **Unclosed-marking truthfulness** — deferred or open items actually declared as such; nothing silently dropped from the plan, todo list, or spec.
+- **State-transmission completeness** — would a fresh agent recover this work without the conversation? Checkpoints, persisted reports, and committed artifacts carry the state — not session memory.
+
 ### 5. Check spec compliance
 
 If an original request, spec, PRD, issue, or brief is available (from commit messages, linked issues, or session context), build a gap table:
@@ -199,7 +242,7 @@ Present the findings in this structure in `aiLanguage`. **Translate all labels,
 ```
 ## <Code Review in aiLanguage>: <diff range or file list>
 
-### Verdict: <Approved | Needs revision | Rejected>
+### Verdict: <Approved | Needs revision | Rejected> (blockLevel: <pass | warning | soft-block | hard-block>)
 
 <2-3 sentence justification grounded in the most serious findings.>
 
@@ -228,6 +271,9 @@ Present the findings in this structure in `aiLanguage`. **Translate all labels,
 ### Axis G — Blind spots
 <Findings or "No issues.">
 
+### Axis H — Fracture inference
+<Findings or "No issues.">
+
 ### Spec compliance
 
 <Gap table or "No spec available — skipped.">
@@ -239,11 +285,22 @@ Present the findings in this structure in `aiLanguage`. **Translate all labels,
 3. <Hard question.>
 ```
 
-**Verdict criteria:**
+**Verdict criteria (blocking model):**
+
+Every verdict carries a `blockLevel` — the blocking semantics downstream pipeline skills act on. `verdict` is retained and **derived** from it for backward compatibility (`fo-fix` consumes `verdict` unchanged):
+
+| `blockLevel` | `verdict` | Semantics |
+| --- | --- | --- |
+| `pass` | `approved` | Zero findings across all axes — no fracture signals |
+| `warning` | `needs-revision` | Findings recorded as tracked observations; they must be answered, and unresolved warnings at T3 escalate to `soft-block` |
+| `soft-block` | `needs-revision` + `escalation: operator` | Directional deviation or process violation — suspends the item for operator arbitration (queue mode: item parked, arbitration question appended to the decision ledger as `open`/`stage: review`/`parked: true`, batch continues) |
+| `hard-block` | `rejected` | Fundamental flaw — fix, then **full** re-review (not a delta on the flagged point) before the item may proceed to stamping |
+
+- **Approved (`pass`)** — zero findings across all eight axes. Any finding, no matter how minor or cosmetic, disqualifies Approved and forces Needs revision. The rationale: downstream agents treat Approved as a stop signal and stop reading the findings — so even a trivial finding left under Approved gets silently ignored. If there is anything to fix, the verdict must say so.
+- **Needs revision (`warning` | `soft-block`)** — one or more findings on any axis, regardless of severity. A one-line cosmetic rename is enough (`warning`). Escalate to `soft-block` when the deviation is directional or the review process itself was compromised (e.g. narrowed inputs). The agent must not downgrade to Approved based on severity — a finding is a finding.
+- **Rejected (`hard-block`)** — fundamental flaw: the diff contradicts a DNA invariant, introduces a backward compatibility layer, or bypasses the storage policy.
 
-- **Approved** — zero findings across all seven axes. Any finding, no matter how minor or cosmetic, disqualifies Approved and forces Needs revision. The rationale: downstream agents treat Approved as a stop signal and stop reading the findings — so even a trivial finding left under Approved gets silently ignored. If there is anything to fix, the verdict must say so.
-- **Needs revision** — one or more findings on any axis, regardless of severity. A one-line cosmetic rename is enough. The agent must not downgrade to Approved based on severity — a finding is a finding.
-- **Rejected** — fundamental flaw: the diff contradicts a DNA invariant, introduces a backward compatibility layer, or bypasses the storage policy.
+The `blockLevel` → pipeline semantics (full re-review on `hard-block`, queue parking on `soft-block`, warning escalation at T3) are declared in `_shared/fo-pipeline-conventions.md` §Review blocking semantics.
 
 ### 7. Persist the review
 
@@ -265,8 +322,12 @@ reviewId: REVIEW-CODE-<YYYY-MM-DD>-<NN>
 date: YYYY-MM-DD
 reviewer:
   skill: fo-review
+  isolation: <subagent | isolated-inline | inline>   # the isolation mode actually used
   model: <AI model identifier>
-verdict: <approved | needs-revision | rejected>
+blockLevel: <pass | warning | soft-block | hard-block>  # blocking semantics
+verdict: <approved | needs-revision | rejected>          # derived from blockLevel
+escalation: <none | operator>                            # set when blockLevel = soft-block
+observations: []                                          # tracked warnings carried to T3
 diffRange: <fixed-point>...HEAD
 filesReviewed:
   - <file path>

package/skills/fo/fo-session-retro/SKILL.md

@@ -9,7 +9,7 @@ languagePolicy: ref(PREFERENCES.md)
 bindings:
   requires: []
   optional: [paths.invariantsFile]
-triggerPhrases: ["session retrospective", "triage session discoveries", "Завершаем эту сессию", "End session", "/session-end"]
+triggerPhrases: ["завершаем", "протокол завершения", "Завершаем эту сессию", "session retrospective", "End session"]
 ---
 
 <!--
@@ -23,6 +23,7 @@ triggerPhrases: ["session retrospective", "triage session discoveries", "Зав
   <item>RFC-1097: sweep — SKILL.md headers + classification fixes
 
 Sweep batch 1: add Compass v2 headers to 45 SKILL.md files (purpose derived from frontmatter description). Fix non-skill-markdown exclusion to check filename not workspace-relative path (packages/AGENTS.md escaped it). Add .coverage to ignoredDirs.</item>
+  <item>RFC-1247: triggerPhrases vocabulary sync — mined operator phrasing applied to this skill's trigger set.</item>
 </CHANGE_SUMMARY>
 -->
 
@@ -85,7 +86,7 @@ The agent reconstructs the current session's conversation from its context windo
 3. Reconstruct the conversation from context — include every user message and assistant response you can recall from the current session, in chronological order. This is a best-effort reconstruction: the agent's context window is the source, not an external export tool.
 4. **Redact sensitive information** — remove API keys, passwords, PII, and secret values before writing. Replace with `<redacted>`.
 5. **Truncate very long tool outputs** — if a tool call produced thousands of lines of output, summarize it as `<tool output truncated, N lines>` in the content field. Keep the tool call name and key results.
-6. Write the file using `write_to_file` to `docs/sessions/.raw/<timestamp>-session.atif`.
+6. Write the file **atomically**: `write_to_file` to `docs/sessions/.raw/<timestamp>-session.atif.tmp`, then `mv` it to the same path without `.tmp` (rename is atomic). A parallel agent's `session.save` claims any `.atif` the moment it appears — this ordering guarantees it never sees a half-written transcript.
 
 ### 0c. Run session.save
 
@@ -450,7 +451,7 @@ If any operator insights were routed to `.agents/operator-profile.md`, offer the
 
 Present a concise summary in `aiLanguage`. **ALL labels, headings, column names, and prose MUST be translated to `aiLanguage`** — the template below is structural only. Only identifiers (file paths, skill names, RFC/ADR ids, commit hashes) stay untranslated. This is non-negotiable: an English summary when `aiLanguage` is `ru` is a violation of this skill's language contract.
 
-**Engineering Checkpoint (RFC-0884):** The closing block follows the Engineering Checkpoint protocol defined in `_shared/fo-session-summary.md`. The agent MUST:
+**Engineering Checkpoint:** The closing block follows the Engineering Checkpoint protocol defined in `_shared/fo-session-summary.md`. The agent MUST:
 
 1. **Select mode** — analyze the session's changes. If the session changed architecture, runtime flow, state machines, persistence models, or public contracts, use **full mode** (6 sections). Otherwise, use **lightweight mode** (3 sections).
 2. **Diagram selection** (full mode only) — apply the diagram selection rules table from `_shared/fo-session-summary.md` to determine if a Mermaid diagram is warranted. If no structural change warrants a diagram, explicitly state "No diagram: this session did not change system structure..."

package/skills/fo/fo-session-save/SKILL.md

@@ -60,7 +60,7 @@ Enhance saved session transcripts with semantic annotations, summaries, and qual
 
 6. **Update the session file:**
    - Update frontmatter: `summary`, `decisions`, refined `types`, corrected metadata.
-   - **Checkpoint fields (RFC-0884):** When the session produced substantial engineering work, populate the optional checkpoint frontmatter fields:
+   - **Checkpoint fields:** When the session produced substantial engineering work, populate the optional checkpoint frontmatter fields:
      - `checkpoint` — object with `before`, `change`, `after` (each 1-2 sentences describing state N, what was done, state N+1)
      - `systemDelta` — object with arrays: `changedContracts`, `changedSchemas`, `changedStateMachines`, `changedInvariants`, `changedPersistence`
      - `diagrams` — array of objects: `type` (flowchart/sequenceDiagram/stateDiagram-v2/erDiagram/none), `scope` (current-system/session-delta), `caption`, `mermaid` (Mermaid syntax or empty string)

package/skills/fo/fo-step-commit/SKILL.md

@@ -10,6 +10,7 @@ concerns: code-mutation
 dependsOn: ['my-preferences']
 languagePolicy: ref(PREFERENCES.md)
 triggerPhrases:
+  - "закоммитим"
   - "commit after request"
   - "auto-commit changes"
   - "step commit"
@@ -26,6 +27,7 @@ triggerPhrases:
   <item>RFC-1097: sweep — SKILL.md headers + classification fixes
 
 Sweep batch 1: add Compass v2 headers to 45 SKILL.md files (purpose derived from frontmatter description). Fix non-skill-markdown exclusion to check filename not workspace-relative path (packages/AGENTS.md escaped it). Add .coverage to ignoredDirs.</item>
+  <item>RFC-1247: triggerPhrases vocabulary sync — mined operator phrasing applied to this skill's trigger set.</item>
 </CHANGE_SUMMARY>
 -->
 

package/skills/shared/grilling/SKILL.md

@@ -22,11 +22,23 @@ knowledge:
   <item>RFC-1097: sweep — SKILL.md headers + classification fixes
 
 Sweep batch 1: add Compass v2 headers to 45 SKILL.md files (purpose derived from frontmatter description). Fix non-skill-markdown exclusion to check filename not workspace-relative path (packages/AGENTS.md escaped it). Add .coverage to ignoredDirs.</item>
+  <item>RFC-1250: two modes — interview (standalone, interactive) and emit
+  (orchestrated runs: questions land in the queue decision ledger with
+  recommended answers, no interview).</item>
 </CHANGE_SUMMARY>
 -->
 
 Before starting, read `PREFERENCES.md` at the repository root. If the file is missing or `aiLanguage` is unset, ask the operator once and create the file using the `my-preferences` skill semantics.
 
+## Modes
+
+Grilling runs in one of two modes — the caller selects:
+
+- **`interview`** (default — standalone, operator-invoked runs): the interactive behavior below, one question at a time.
+- **`emit`** (inside an orchestrator-driven queue run — `fo-idea-i-just-want-to-see-the-result` queue mode): never ask the operator. Generate the same questions you would have asked, climb the self-resolution ladder (`_shared/fo-pipeline-conventions.md` §Self-resolution ladder), and append each surviving question to the queue's decision ledger `docs/queues/<id>.decisions.yaml` as an `open` entry (`id: Q-N`, `doc`, `stage`, `question`, `resolutionPath`, `options` with `recommended: true` on your recommended answer, `status: open`). Branching questions are written conditionally ("if Q-3 resolves to X, then…"). The pipeline's decision window consumes the emitted entries.
+
+Mode trigger: `emit` activates only when the invoking skill passes a queue manifest / ledger path; otherwise `interview`.
+
 Read `learned-principles.md` (L2) at the start of each session to improve recommended answers. Apply only entries with `status: active`; skip entries with `status: stale`, `superseded`, or `archived`. Principles with `confirmations >= 3` may be applied autonomously — but re-evaluate if context changes.
 
 Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.

package/skills/shared/writing-great-skills/GLOSSARY.md

@@ -58,6 +58,8 @@ A **user-invoked** skill whose job is to point at your other user-invoked skills
 
 _Avoid_: dispatcher, menu, registry, index, router procedure
 
+_Applied instance_: `fo-idea-i-just-want-to-see-the-result` is the forge pipeline's router skill — the operator's single front door. Its Preconditions carry an intent-routing table that maps non-pipeline intents (review, fix, session-end, commit, mission work, exploration) to their standing skills before document-id detection; pipeline intents flow through unchanged, and the escape hatches stay directly invocable.
+
 ### Granularity
 
 How finely you divide skills. Finer division spends one of the two loads: more **model-invoked** skills spend **context load** (more descriptions crowding the window and competing for attention); more **user-invoked** skills spend **cognitive load** (more for the human to remember and reach for). Two cuts guide the division. By **invocation**, split off a model-invoked skill where you have a distinct **leading word** to trigger it — a trigger word you actually use in your prompts. By **sequence**, split a run of **steps** where a step's **post-completion steps** need hiding, since isolating it in its own context clears what follows. Beware the reverse: merging sequences exposes each step's post-completion steps to what follows, inviting premature completion.

package/skills/shared/writing-great-skills/SKILL.md

@@ -19,6 +19,7 @@ languagePolicy: ref(PREFERENCES.md)
   <item>RFC-1097: sweep — SKILL.md headers + classification fixes
 
 Sweep batch 1: add Compass v2 headers to 45 SKILL.md files (purpose derived from frontmatter description). Fix non-skill-markdown exclusion to check filename not workspace-relative path (packages/AGENTS.md escaped it). Add .coverage to ignoredDirs.</item>
+  <item>RFC-1247: close RFC-1247 review r2 — CHANGE_SUMMARY items on six touched skills, fo-handoff in AGENTS enumeration, glossary applied-instance pointer, recorded per-skill phrase split</item>
 </CHANGE_SUMMARY>
 -->
 
@@ -37,7 +38,7 @@ Two choices, trading different costs:
 
 Pick model-invocation only when the agent must reach the skill on its own, or another skill must. If it only ever fires by hand, make it user-invoked and pay no context load.
 
-When user-invoked skills multiply past what you can remember, that piled-up cognitive load is cured by a **router skill**: one user-invoked skill that names the others and when to reach for each.
+When user-invoked skills multiply past what you can remember, that piled-up cognitive load is cured by a **router skill**: one user-invoked skill that names the others and when to reach for each. (Applied instance: `fo-idea-i-just-want-to-see-the-result` — see GLOSSARY.md.)
 
 ## Writing the description
 

package/src/cli-flags.ts

@@ -12,6 +12,10 @@ with `TypeError: targetId.toLowerCase is not a function`.</purpose>
 </MODULE_CONTRACT>
 <CHANGE_SUMMARY>
   <item>Standalone port of kernel argv resolution for the forge CLI (RFC-0260 lineage): strict KERNEL-FLAG-01/02/03 + KERNEL-ARG-01 diagnostics for schema-carrying commands, legacy heuristic parse (with KERNEL-ARG-01) for schema-less commands; repeated single-value string flags diagnose instead of silently promoting to an array that crashes handlers; indexOf-based inline-value split preserves values containing "=" that split("=", 2) silently truncated.</item>
+  <item>Session-retro 2026-10-08: string[] flags greedily consume consecutive
+bare tokens until the next --flag (`--files a b` → ["a","b"]), matching the
+kernel argv parser; bare positionals without a preceding string[] flag still
+emit KERNEL-ARG-01.</item>
 </CHANGE_SUMMARY>
 */
 
@@ -227,11 +231,25 @@ function resolveStrict(
       continue;
     }
 
-    const next = rawArgv[index + 1];
-    if (typeof next === "string" && !next.startsWith("--")) {
-      addFlagValue(flags, flagName, next);
-      index += 1;
-      continue;
+    // string[] flags consume every following bare token — mirrors the kernel's
+    // resolveCommandFlags: positional args are never valid (KERNEL-ARG-01),
+    // so `--files a b` unambiguously means the value list [a, b].
+    if (spec.kind === "string[]") {
+      let consumed = 0;
+      while (index + 1 < rawArgv.length && !rawArgv[index + 1]!.startsWith("--")) {
+        addFlagValue(flags, flagName, rawArgv[index + 1]!);
+        index += 1;
+        consumed += 1;
+      }
+      if (consumed > 0) continue;
+      // fall through to the missing-value diagnostic
+    } else {
+      const next = rawArgv[index + 1];
+      if (typeof next === "string" && !next.startsWith("--")) {
+        addFlagValue(flags, flagName, next);
+        index += 1;
+        continue;
+      }
     }
 
     diagnostics.push({

package/src/config/forge-config.ts

@@ -6,7 +6,6 @@
 </non-goals>
 </MODULE_CONTRACT>
 <CHANGE_SUMMARY>
-  <item>RFC-0661: added optional knowledge.budgets binding for hot/warm layer character budget overrides.</item>
   <item>RFC-0662: added optional knowledge.retentionDays and knowledge.staleDays bindings for compaction overrides.</item>
   <item>RFC-0704: added optional independentVersionPackages field to forgeConfigSchema for packages with autonomous npm versions.</item>
   <item>RFC-1097: step 6 — compass.migrate codemod run
@@ -15,14 +14,15 @@ Mechanical v1 to v2 header migration across the workspace: 942 files rewritten
   <item>RFC-1097: sweep — packages/forge + services clean
 
 Sweep batch 2: real KEY_DECISIONS on 10 files, expanded purposes (CONTRACT-02/PURPOSE-02), headers on mission/index + gen-upstreams, sanitizeItemText in summary.record (literal Compass tags corrupted history), excludedPaths for wrangler types, test-fixtures testPattern. forge+services now 0 diagnostics under --mode error.</item>
-  <history>RFC-0391, RFC-0393, RFC-0537, RFC-0538, RFC-0539, RFC-0540, RFC-0543, RFC-0546, RFC-0639, RFC-0640, RFC-0643</history>
+  <item>RFC-1224: preserve operator forge.yaml content on upgrade, promote adrImplementStamp binding</item>
+  <history>RFC-0391, RFC-0393, RFC-0537, RFC-0538, RFC-0539, RFC-0540, RFC-0543, RFC-0546, RFC-0639, RFC-0640, RFC-0643, RFC-0661, RFC-1224</history>
 </CHANGE_SUMMARY>
 */
 
 import * as fs from "../utils/sync-fs.ts";
 import path from "node:path";
 import { z } from "zod";
-import { parse as parseYaml } from "yaml";
+import { parse as parseYaml, parseDocument } from "yaml";
 import {
   TERMINOLOGY_DEFAULTS,
   compassPolicyOverridesSchema,
@@ -36,22 +36,27 @@ import { listStackProfiles, type StackProfile } from "../profiles/stack-profile.
 
 export const forgeBindingsSchema = z.object({
   schema: z.literal("forge/bindings@1"),
-  commands: z.object({
-    validateRfc: z.string().nullable().default(null),
-    validateAdr: z.string().nullable().default(null),
-    implementStamp: z.string().nullable().default(null),
-    typecheck: z.string().nullable().default(null),
-    test: z.string().nullable().default(null),
-    scopedBuild: z.string().nullable().default(null),
-    specValidate: z.string().nullable().default(null),
-    sessionSave: z.string().nullable().default(null),
-    // Semantic keys (RFC-0639) — domain-neutral, optional
-    validate: z.string().nullable().default(null),
-    produce: z.string().nullable().default(null),
-    verify: z.string().nullable().default(null),
-    preview: z.string().nullable().default(null),
-    lint: z.string().nullable().default(null),
-  }),
+  commands: z
+    .object({
+      validateRfc: z.string().nullable().default(null),
+      validateAdr: z.string().nullable().default(null),
+      implementStamp: z.string().nullable().default(null),
+      adrImplementStamp: z.string().nullable().default(null),
+      typecheck: z.string().nullable().default(null),
+      test: z.string().nullable().default(null),
+      scopedBuild: z.string().nullable().default(null),
+      specValidate: z.string().nullable().default(null),
+      sessionSave: z.string().nullable().default(null),
+      // Semantic keys (RFC-0639) — domain-neutral, optional
+      validate: z.string().nullable().default(null),
+      produce: z.string().nullable().default(null),
+      verify: z.string().nullable().default(null),
+      preview: z.string().nullable().default(null),
+      lint: z.string().nullable().default(null),
+      // RFC-1224: consumer-defined command keys (e.g. createRfc) stay in the
+      // parsed config so resolveBinding can resolve them.
+    })
+    .passthrough(),
   paths: z.object({
     invariantsFile: z.string().nullable().default(null),
     compassDocs: z.array(z.string()).default([]),
@@ -98,6 +103,7 @@ export interface ForgeBindings {
     validateRfc: string | null;
     validateAdr: string | null;
     implementStamp: string | null;
+    adrImplementStamp: string | null;
     typecheck: string | null;
     test: string | null;
     scopedBuild: string | null;
@@ -177,44 +183,50 @@ export interface ForgeMigrationAdapter {
 // Schema (forge/config@1)
 // ---------------------------------------------------------------------------
 
-export const forgeConfigSchema = z.object({
-  schema: z.literal("forge/config@1"),
-  project: z.object({
-    name: z.string().min(1),
-    stack: z.array(z.string()).default([]),
-    packageManager: z.enum(["pnpm", "npm", "yarn", "bun", "none"]).default("pnpm"),
-    // RFC-0640: optional domain field — absent means software-domain fallback
-    domain: z.string().optional(),
-  }),
-  paths: z.object({
-    rfcsDir: z.string().default("docs/rfcs"),
-    adrsDir: z.string().default("docs/adrs"),
-    plansDir: z.string().default("docs/plans"),
-    auditsDir: z.string().default("docs/audits"),
-    specsDir: z.string().default("docs/specs"),
-    skillsDir: z.string().default(".agents/skills"),
-    sessionsDir: z.string().default("docs/sessions"),
-  }),
-  /** Bindings contract (RFC-0393). Optional — absent means no bindings. */
-  bindings: forgeBindingsSchema.optional(),
-  /** Skill packs (RFC-0539). Optional — absent means no project-local packs. */
-  skillPacks: z.array(forgeSkillPackSchema).optional(),
-  /** Migration adapters (RFC-0546). Optional — absent means built-in adapters only. */
-  migrationAdapters: z.array(forgeMigrationAdapterSchema).optional(),
-  /** Forge sync metadata (RFC-0543). Optional — absent means never synced. */
-  forge: z
-    .object({
-      syncedVersion: z.string().nullable().default(null),
-    })
-    .optional(),
-  /** RFC-0643: profile id — when present, loadForgeConfig loads the corresponding profiles/<id>.yaml */
-  // RFC-1118: accept the corrupted object form (whole StackProfile written by a
-  // previous buggy serialize) so loadForgeConfig can recover the declared id —
-  // a hard schema throw here would deadlock `forge upgrade`, the healing path.
-  profile: z.union([z.string(), z.object({ id: z.string().min(1) }).passthrough()]).optional(),
-  /** RFC-0704: packages with autonomous npm versions — ecosystem.commit skips platform bump when all staged files belong to these packages */
-  independentVersionPackages: z.array(z.string()).optional(),
-});
+export const forgeConfigSchema = z
+  .object({
+    schema: z.literal("forge/config@1"),
+    project: z.object({
+      name: z.string().min(1),
+      stack: z.array(z.string()).default([]),
+      packageManager: z.enum(["pnpm", "npm", "yarn", "bun", "none"]).default("pnpm"),
+      // RFC-0640: optional domain field — absent means software-domain fallback
+      domain: z.string().optional(),
+      /** RFC-1240: local consumer identity — absent means no consumer-aware spec filtering. */
+      consumer: z.string().optional(),
+    }),
+    paths: z.object({
+      rfcsDir: z.string().default("docs/rfcs"),
+      adrsDir: z.string().default("docs/adrs"),
+      plansDir: z.string().default("docs/plans"),
+      auditsDir: z.string().default("docs/audits"),
+      specsDir: z.string().default("docs/specs"),
+      skillsDir: z.string().default(".agents/skills"),
+      sessionsDir: z.string().default("docs/sessions"),
+    }),
+    /** Bindings contract (RFC-0393). Optional — absent means no bindings. */
+    bindings: forgeBindingsSchema.optional(),
+    /** Skill packs (RFC-0539). Optional — absent means no project-local packs. */
+    skillPacks: z.array(forgeSkillPackSchema).optional(),
+    /** Migration adapters (RFC-0546). Optional — absent means built-in adapters only. */
+    migrationAdapters: z.array(forgeMigrationAdapterSchema).optional(),
+    /** Forge sync metadata (RFC-0543). Optional — absent means never synced. */
+    forge: z
+      .object({
+        syncedVersion: z.string().nullable().default(null),
+      })
+      .optional(),
+    /** RFC-0643: profile id — when present, loadForgeConfig loads the corresponding profiles/<id>.yaml */
+    // RFC-1118: accept the corrupted object form (whole StackProfile written by a
+    // previous buggy serialize) so loadForgeConfig can recover the declared id —
+    // a hard schema throw here would deadlock `forge upgrade`, the healing path.
+    profile: z.union([z.string(), z.object({ id: z.string().min(1) }).passthrough()]).optional(),
+    /** RFC-0704: packages with autonomous npm versions — ecosystem.commit skips platform bump when all staged files belong to these packages */
+    independentVersionPackages: z.array(z.string()).optional(),
+    // RFC-1224: consumer-owned top-level sections (e.g. `plugins:`) stay in the
+    // parsed config so full-serialization writes do not silently drop them.
+  })
+  .passthrough();
 
 export interface ForgeConfig {
   schema: "forge/config@1";
@@ -224,6 +236,8 @@ export interface ForgeConfig {
     packageManager: "pnpm" | "npm" | "yarn" | "bun" | "none";
     /** RFC-0640: optional domain field — absent means software-domain fallback */
     domain?: string;
+    /** RFC-1240: local consumer identity — absent means no consumer-aware spec filtering */
+    consumer?: string;
   };
   paths: {
     rfcsDir: string;
@@ -268,6 +282,10 @@ export const FORGE_CLI_BINDING_DEFAULTS: ForgeCliBindingDefault[] = [
     key: "commands.implementStamp",
     template: "forge rfc.implement.stamp --id {id} --implementation-commit {commit}",
   },
+  {
+    key: "commands.adrImplementStamp",
+    template: "forge adr.implement.stamp --id {id} --implementation-commit {commit}",
+  },
   { key: "commands.specValidate", template: "forge spec.validate --spec={id} --json" },
   { key: "commands.sessionSave", template: "forge session.save --json" },
 ];
@@ -302,6 +320,7 @@ export function applyCliBindingDefaults(pm: string): ForgeBindings["commands"] {
     validateRfc: null,
     validateAdr: null,
     implementStamp: null,
+    adrImplementStamp: null,
     typecheck: null,
     test: null,
     scopedBuild: null,
@@ -471,6 +490,36 @@ export function serializeForgeConfig(config: ForgeConfig): Record<string, unknow
   return out;
 }
 
+// ---------------------------------------------------------------------------
+// YAML document patching — RFC-1224
+// ---------------------------------------------------------------------------
+
+/**
+ * A single targeted write into forge.yaml: a dotted key path expressed as
+ * segments plus the value to set. `applyForgeYamlPatches` creates missing
+ * intermediate maps and preserves comments/formatting elsewhere in the file.
+ */
+export interface ForgeYamlPatch {
+  path: string[];
+  value: unknown;
+}
+
+/**
+ * Apply targeted patches to a forge.yaml document without rewriting it.
+ * Returns the patched YAML text, or null when the document cannot be parsed —
+ * callers should fall back to full serialization in that case.
+ */
+export function applyForgeYamlPatches(rawYaml: string, patches: ForgeYamlPatch[]): string | null {
+  const doc = parseDocument(rawYaml);
+  if (doc.errors.length > 0) {
+    return null;
+  }
+  for (const patch of patches) {
+    doc.setIn(patch.path, patch.value);
+  }
+  return doc.toString();
+}
+
 // ---------------------------------------------------------------------------
 // Forge root resolver — the single place that decides monorepo vs npm-installed
 // ---------------------------------------------------------------------------