forge-orkes 0.64.2 → 0.64.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forge-orkes",
-  "version": "0.64.2",
+  "version": "0.64.5",
   "description": "Set up the Forge meta-prompting framework for Claude Code in your project",
   "bin": {
     "create-forge": "./bin/create-forge.js"

package/template/.claude/hooks/README.md

@@ -10,7 +10,7 @@ skipped. All require `jq` and **fail closed** (deny) if it is missing — except
 
 | Hook | Event · matcher | Blocks |
 |---|---|---|
-| `block-dangerous-commands.sh` | PreToolUse · Bash | force push, push to a protected branch, `rm -rf` on `/`/`~`/`$VAR`/system dirs/substituted targets, `DROP`/`TRUNCATE`/`DELETE`-without-WHERE, destructive migrations (`migrate:fresh`, `db:wipe`, `rails db:reset`, `prisma migrate reset`, …), `chmod 777`, `curl\|sh`, `dd`/`mkfs` on devices, `git reset --hard`, `git clean -f`, accidental `npm/cargo/gem/twine/uv/poetry/composer publish` |
+| `block-dangerous-commands.sh` | PreToolUse · Bash | force push, push to a protected branch, `rm -rf` on `/`/`~`/`$VAR`/system dirs/substituted targets, `DROP`/`TRUNCATE`/`DELETE`-without-WHERE, destructive migrations (`migrate:fresh`, `db:wipe`, `rails db:reset`, `prisma migrate reset`, …), `chmod 777`, `curl\|sh`, `dd`/`mkfs` on devices, `git reset --hard`, `git clean -f`, accidental `npm/cargo/gem/twine/uv/poetry/composer publish`, whole-filesystem walks (`find`/`bfs`/`fd`/`rg`/`grep -r` rooted at `/`, `~`, `$HOME`, or a bare `/Users/<user>` — the refusal names the canonical runner-artifact paths) |
 | `scan-secrets.sh` | PreToolUse · Edit\|Write | content containing AWS/GitHub/Anthropic/Slack/Stripe/Google keys, private-key blocks, credentialed connection strings, Laravel `APP_KEY`, generic hardcoded credentials — decision `ask` so genuine fixtures can be overridden |
 | `protect-files.sh` | PreToolUse · Edit\|Write | edits to `.env`, keys/certs, lockfiles, generated/minified files, `.git/`, `secrets/`; `ask` on `settings.json`. Allowlists `.env.example`/`.sample`/`.dist`/`.template` |
 | `warn-large-files.sh` | PreToolUse · Edit\|Write | writes into `node_modules`/`vendor`/build output/tool caches and binary/archive/media files |

package/template/.claude/hooks/block-dangerous-commands.sh

@@ -85,6 +85,35 @@ if printf '%s' "$CMD_NOQUOTE" | grep -qE 'rm[[:space:]]+(-[a-zA-Z]*[[:space:]]+)
   emit_deny "Blocked: recursive force-delete with a shell-substituted target (\$(...) or \`...\`). Pass a literal path."
 fi
 
+# ── Whole-filesystem walks ──────────────────────────────────────────────
+# A walk binary (find/bfs/fd/rg, or grep with -r/-R) rooted at `/` or the bare
+# home directory scans the whole disk: 75+ minutes and one macOS TCC prompt per
+# protected folder — and spawned sessions run permission-free (0.64.4), so no
+# prompt catches it. (Incident 2026-07-22: `bfs -S dfs / -name result.json
+# -path *runner-work*` hunted a runner artifact whose location is knowable —
+# see the canonical paths in the refusal below.)
+# NARROW by design: only a standalone root token — `/`, `~`, `$HOME`,
+# `/Users/<user>` EXACTLY (not subpaths) — in the same `;|&`-split command
+# segment as the walk binary refuses. `find .`, `rg pat src/`, `grep -r x .`,
+# and `find /Users/x/Dev/repo` all pass. bash 3.2 / BWK awk (macOS) safe:
+# segments via RS, POSIX ERE only, root pattern kept in a string.
+CMD_WALK=${CMD_NOQUOTE//\$\{HOME\}/\$HOME}   # normalize ${HOME} → $HOME for the token match
+if printf '%s\n' "$CMD_WALK" | awk '
+  BEGIN {
+    RS = "[;&|]+"
+    root = "(^|[[:space:]])(/|~|~/|\\$HOME|\\$HOME/|/Users/[A-Za-z0-9._-]+/?)([[:space:]]|$)"
+  }
+  {
+    seg = $0
+    if (seg ~ /(^|[[:space:](`\/])(find|bfs|fd|rg)([[:space:]]|$)/ && seg ~ root) { print "BAD"; exit }
+    if (seg ~ /(^|[[:space:](`\/])grep([[:space:]]|$)/ \
+        && (seg ~ /(^|[[:space:]])-[a-zA-Z]*[rR]/ || seg ~ /--(dereference-)?recursive/) \
+        && seg ~ root) { print "BAD"; exit }
+  }
+' | grep -q BAD; then
+  emit_deny "Blocked: filesystem walk rooted at / or the home directory. Runner artifacts live at knowable paths — work dir <slice-worktree>/.forge/runner-work/, per-phase result <slice-worktree>/.forge/runner-work/phase-*/result.json, notify log <slice-worktree>/.forge/runner-work/notify.log, dispatch output <slice-worktree>/.forge/runner-work/dispatch.out. Root the search at the slice worktree or repo instead."
+fi
+
 # ── Dangerous database operations ───────────────────────────────────────
 if contains_icmd 'DROP[[:space:]]+(TABLE|DATABASE|SCHEMA)[[:space:]]+'; then
   emit_deny "Blocked: DROP TABLE/DATABASE/SCHEMA detected. Run manually if intended."

package/template/.claude/hooks/forge-slice-runner.sh

@@ -111,6 +111,28 @@ PHASES="$(awk '
 report_field() {  # report_field <file> <key> — a TOP-LEVEL `key:` (col 0)
   grep -E "^$2:" "$1" 2>/dev/null | head -1 | sed -E "s/^$2:[[:space:]]*//; s/[[:space:]]*(#.*)?$//; s/^\"//; s/\"$//"
 }
+report_field_flat() {  # report_field_flat <file> <key> — report_field + YAML block scalars
+  # A long interrupt question is naturally written as a block scalar (`key: |` /
+  # `key: >`), and report_field's single-line read returns the literal indicator —
+  # so the §8 ping carried "|" as the whole question (seen live: m-40 phase
+  # 73-approval-prompt-digest, 2026-07-22). When the value is a block-scalar
+  # indicator, collect the block's more-indented lines and FLATTEN to one line
+  # (newlines → spaces) so the ping payload stays a single TSV field. Blank lines
+  # inside the block are kept-as-separators; the first non-blank column-0 line
+  # (the next top-level key) ends the block. Plain scalars pass through unchanged.
+  _ff="$(report_field "$1" "$2")"
+  case "$_ff" in
+    '|'*|'>'*)
+      awk -v k="$2" '
+        hit && /^[^[:space:]]/ { exit }
+        hit { sub(/^[[:space:]]+/, ""); sub(/[[:space:]]+$/, "");
+              if (length($0)) printf "%s%s", (n++ ? " " : ""), $0; next }
+        !hit && index($0, k ":") == 1 { hit = 1 }
+      ' "$1"
+      ;;
+    *) printf '%s' "$_ff" ;;
+  esac
+}
 report_nested() {  # report_nested <file> <key> — an INDENTED `key:` (checks.*/usage.*)
   # The report nests checks.failed and usage.model under their parent block;
   # report_field's `^key:` anchor can't see them. Each nested key we read
@@ -431,6 +453,9 @@ for phase in $PHASES; do
     printf '  %s\n' "$REPORT_TEMPLATE"
     printf 'and the JSON schema here:\n'
     printf '  %s\n' "$SCHEMA"
+    printf 'All runner artifacts for this slice live under %s\n' "$WORK_DIR"
+    printf '(this phase writes into %s) — the paths are known; never search the\n' "$wdir"
+    printf 'filesystem for result.json, notify.log, or any runner file.\n'
     printf 'Set verdict to one of proceed|park|halt|done. If you hit a Rule-4 stop,\n'
     printf 'an ambiguity, an irreversible step, a design fork, or a budget breach,\n'
     printf 'set verdict=park and fill interrupt + interrupt_payload — do not guess.\n'
@@ -501,7 +526,7 @@ for phase in $PHASES; do
         continue
       fi
       # Retry exhausted → HALT the slice early, failure evidence attached.
-      _ev="$(report_field "$report" evidence)"
+      _ev="$(report_field_flat "$report" evidence)"
       slice_notify halt slice \
         "slice HALTED at phase $phase ($idx/$total) after 1 retry — verdict=$verdict checks.failed=$cfailed; evidence: $report${_ev:+ ; $_ev}"
       printf '[runner] phase %s: HALTED after retry — failure evidence at %s\n' "$phase" "$report" >&2
@@ -582,7 +607,7 @@ for phase in $PHASES; do
       # The park happens BEFORE the next phase launches, so an irreversible action
       # (declared in the report, deferred by the phase) is caught pre-execution.
       interrupt="$(report_field "$report" interrupt)"
-      ipayload="$(report_field "$report" interrupt_payload)"
+      ipayload="$(report_field_flat "$report" interrupt_payload)"
 
       # A design fork must arrive as something to LOOK AT — the payload is a
       # sketch/mockup PATH that exists, never prose describing a visual (§8).

package/template/.claude/hooks/tests/cases/block-dangerous-commands.cases.json

@@ -372,5 +372,159 @@
     },
     "expect_exit": 0,
     "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "denies whole-disk bfs walk (literal 2026-07-22 incident command)",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "bfs -S dfs / -name result.json -path *runner-work*"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "walk refusal names the canonical runner-artifact globs",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "bfs -S dfs / -name result.json -path *runner-work*"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": ".forge/runner-work/phase-*/result.json"
+  },
+  {
+    "name": "denies find rooted at /",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "find / -name result.json"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies rg --files rooted at /",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "rg --files /"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies recursive grep rooted at bare home (~)",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "grep -r secret ~"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies find rooted at bare $HOME",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "find $HOME -name notify.log"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies fd rooted at bare /Users/<user>",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "fd result.json /Users/somebody"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies path-invoked find rooted at /",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "/usr/bin/find / -name x"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "allows find rooted at cwd (narrow-match neg-control)",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "find . -name result.json"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "allows rg rooted at a project subdir (narrow-match neg-control)",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "rg pattern src/"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "allows recursive grep rooted at cwd (narrow-match neg-control)",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "grep -r x ."
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "allows find rooted at a home SUBPATH (narrow-match neg-control)",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "find /Users/somebody/Dev/forge -name result.json"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "allows non-recursive grep on an absolute file (narrow-match neg-control)",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "grep -q result /etc/hosts"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "allows find rooted at a $HOME SUBPATH (narrow-match neg-control)",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "find \"$HOME/Dev/proj\" -name x"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
   }
 ]

package/template/.claude/hooks/tests/forge-release-fold.test.sh

@@ -24,7 +24,7 @@
 #   ./.claude/hooks/tests/forge-release-fold.test.sh ordering    # ordering controls
 # Filter tags (one arg, selects matching case blocks):
 #   unmerged merged grandfather human-verified signoff-tag stored-field
-#   exit-2 stable-sha ordering promotion forgery
+#   exit-2 stable-sha ordering promotion forgery labeled
 # `promotion` + `forgery` (plan 51-01): validation_event=promotion_approval —
 # a CI-signed tag on a deploy sha CONTAINING the unit's landed sha validates;
 # tag deletion reverts; unsigned/wrong-key lookalikes and non-containing tags
@@ -763,9 +763,37 @@ lifecycle:
   check_absent "signers-tamper: never validated from a working-tree signers edit" "$OUT" "release_state=validated"
 fi
 
+# --- case: labeled unit ids (m-AUTO01 class) -----------------------------------
+# Numeric (m-8) and labeled (m-AUTO01) id schemes are both valid; the labeled
+# convention keeps the m- prefix in the FILENAME (milestone-m-LABEL.yml) and the
+# fold prefers whichever spelling is tracked. Unsafe characters stay refused.
+if running labeled; then
+  printf '\n--- case: labeled unit ids — milestone-m-LABEL.yml resolves; unsafe ids still refused ---\n'
+  d="$(new_repo labeled)"
+  write_milestone "$d" m-AUTO01 'milestone:
+  id: m-AUTO01
+  name: "fixture: labeled pre-gate closed milestone"
+
+current:
+  tier: standard
+  status: complete
+  completed_at: "2026-07-01"
+  last_updated: "2026-07-01"
+
+lifecycle:
+  worktree_mode: retired'
+  run_fold "$d" m-AUTO01
+  check "labeled id: exit 0" "$RC" "0"
+  check "labeled id: resolves the milestone-m-LABEL.yml spelling" "$OUT" "release_state=validated reason=legacy-complete"
+
+  run_fold "$d" "m-AUTO;01"
+  check "unsafe labeled id: exit 2" "$RC" "2"
+  check_absent "unsafe labeled id: no verdict on stdout" "$OUT" "release_state="
+fi
+
 # --- summary -------------------------------------------------------------------
 if [ -n "$FILTER" ] && [ "$SELECTED" -eq 0 ]; then
-  printf 'ERROR: filter "%s" matched no cases (tags: unmerged merged grandfather human-verified signoff-tag stored-field exit-2 stable-sha ordering promotion forgery)\n' "$FILTER" >&2
+  printf 'ERROR: filter "%s" matched no cases (tags: unmerged merged grandfather human-verified signoff-tag stored-field exit-2 stable-sha ordering promotion forgery labeled)\n' "$FILTER" >&2
   exit 2
 fi
 

package/template/.claude/skills/jarvis/SKILL.md

@@ -56,6 +56,7 @@ The helper (see its header for the full contract) owns the caller-side environme
 - **`FORGE_SLICE_NOTIFY` points at a log-only channel** (`forge-jarvis-notify-logonly.sh`) so the default channel's per-ping headless `claude -p` micro-call stays quiet — the B4 relay is the single delivery path; a live default channel would risk a double-buzz (B1 probe x). This is the swappable channel seam used exactly as designed: the runner is untouched, the caller owns the env.
 - **The model map is forwarded verbatim.** The helper carries no model-selection logic (see Boundaries — routing is step 5).
 - **The work order is materialized at dispatch** (FR-197): the runner's contract is `<worktree>/slice.yml` + `phases/<name>/plan.md`; when `slice.yml` is absent the helper builds both from the milestone's locked `.forge/phases/milestone-{id}/` plans (an existing `slice.yml` is honored untouched). When it cannot, it **refuses synchronously, before the detach** — relay that refusal to the operator immediately. And shortly after any real dispatch, read `<worktree>/.forge/runner-work/dispatch.out` once: a runner refusal lands there and must be relayed — **a silent phone is never success** (walk run 4's failure mode: the runner declined instantly and nothing ever buzzed).
+- **Runner artifacts live at knowable paths — never walk the filesystem for them** (a walk rooted at `/` or the bare home is refused by the Bash guard): work dir `<worktree>/.forge/runner-work/`, per-phase `phase-<N>/result.json` (with `phase-report.yml` and `answer.md`), ping log `notify.log`, dispatch/refusal output `dispatch.out` — state these paths to any session you spawn about a slice.
 
 After dispatch, the slice runs headless in its worktree, writing every ping to its notify log. That log is the event bus the callback relay watches (B4).
 

package/template/.claude/skills/planning/SKILL.md

@@ -440,10 +440,30 @@ Issues -> fix, re-verify. Max 3 cycles.
 
 ## Step 9: Present
 
-1. Requirements (P1/P2/P3, clarifications)
-2. Phase/plan structure + waves
-3. Effort estimates
-4. "Does this plan match expectations? Changes?"
+Lead the approval prompt with a scannable digest, then isolate the approval question at the very end. Full plan prose (per-phase detail, task breakdown, rationale) stays in the plan file on disk — the digest summarizes, it never reproduces the plan file into the prompt. Emit, in this order:
+
+1. **Header + phase lines**, framed by a horizontal rule (`─`) above and below: one line per phase — id, name, deps, and `◆` if it carries `integration_checkpoint: true` (else `·` or blank).
+2. **Counts row**, middot-separated (`·`): task count, estimated hours, the FR/NFR ids covered, the reserved version (if any).
+3. **`Ratifying:` bullets** — the 3-5 judgment calls this plan makes that the operator is being asked to ratify (slice boundaries, tier choices, deferrals, discretion picks) — not a restatement of requirements.
+4. **The approval question**, isolated on its own line, prefixed `→`.
+
+Shape (fill placeholders per plan; this is the shape, not literal text):
+
+```
+Plan digest — m-{id} {name}
+─────────────────────────────
+P{n} {phase-name}   deps:{…}   {◆ checkpoint | ·}
+…one line per phase…
+─────────────────────────────
+{T} tasks · {H}h · {FR-…, NFR-…} · v{X.Y.Z}
+
+Ratifying:
+  • {judgment call 1}
+  • {judgment call 2}
+  • … (3–5)
+
+→ Approve this plan? (yes / changes)
+```
 
 Done when approved.
 

package/template/.forge/checks/forge-jarvis.sh

@@ -35,8 +35,9 @@
 #
 # PERMISSIONS — NO FLAGS NEEDED FOR THE PRE-CREATED SESSION (B1 probe vii): typed Bash,
 # Monitor-arm, and PushNotification all run prompt-free in the pre-created session as-is;
-# `--permission-mode` governs only SPAWNED sessions. Nothing to provision here. (Probe vii
-# still owes an explicit check for any OTHER tool a later phase uses unattended.)
+# `--permission-mode` governs only SPAWNED sessions. (Probe vii still owes an explicit
+# check for any OTHER tool a later phase uses unattended.) Post-UAT (2026-07-22): spawned
+# sessions were locked to "auto" — jarvis.spawn_permission_mode below is the opt-in seam.
 #
 # CONFIG — optional `jarvis:` block in .forge/project.yml (board-block precedent):
 #   jarvis:
@@ -44,6 +45,12 @@
 #     name_suffix: ""        # appended: jarvis-<repo>-<suffix>; env FORGE_JARVIS_NAME_SUFFIX
 #                            #   overrides per machine (the multi-machine seam)
 #     capacity: 4            # RC server session capacity
+#     spawn_permission_mode: ""  # --permission-mode for SPAWNED sessions (phone-spawned);
+#                            #   one of acceptEdits|auto|bypassPermissions|default|dontAsk|plan;
+#                            #   env FORGE_JARVIS_SPAWN_PERMISSION_MODE overrides (the
+#                            #   name_suffix pattern). Unset/empty = NO flag (today's command).
+#                            #   TRUST: bypassPermissions means phone-spawned sessions act
+#                            #   without prompts — attended-lane only.
 #   NO block → sensible defaults (the launcher is operator-invoked, not ambient — unlike
 #   the board, absence does not mean inert).
 #
@@ -130,10 +137,23 @@ case "$CAP" in
   *[!0-9]*|'') printf 'forge-jarvis: capacity must be a positive integer, got: %s\n' "$CAP" >&2; exit 2 ;;
 esac
 
+# --- spawn permission mode (post-UAT 2026-07-22: phone-spawned sessions offered ----
+# only "auto"; --permission-mode is a remote-control LAUNCH flag governing spawned
+# sessions). Env beats config (the name_suffix pattern). Unset/empty = no flag —
+# today's command byte-for-byte. Unknown value = loud refusal, never a silent drop.
+SPAWN_PM="${FORGE_JARVIS_SPAWN_PERMISSION_MODE:-$(jarvis_cfg spawn_permission_mode)}"
+case "$SPAWN_PM" in
+  ''|acceptEdits|auto|bypassPermissions|default|dontAsk|plan) ;;
+  *)
+    printf 'forge-jarvis: spawn_permission_mode must be one of acceptEdits|auto|bypassPermissions|default|dontAsk|plan, got: %s\n' "$SPAWN_PM" >&2
+    exit 2 ;;
+esac
+
 # --- resolve -----------------------------------------------------------------
 # The ONE command shape, built once — --dry-run prints exactly the argv launch
 # execs (modulo the caffeinate degradation below), so the two can never drift.
 set -- claude remote-control --name "$NAME" --spawn worktree --capacity "$CAP"
+[ -n "$SPAWN_PM" ] && set -- "$@" --permission-mode "$SPAWN_PM"
 
 if [ "$DRY_RUN" = "1" ]; then
   printf 'caffeinate -s %s\n' "$*"

package/template/.forge/checks/tests/forge-jarvis.test.sh

@@ -9,8 +9,11 @@
 #   + optional suffix from jarvis.name_suffix, overridden per machine by
 #   FORGE_JARVIS_NAME_SUFFIX (probe ii: the sticky name is the only discoverability
 #   anchor). Capacity: --capacity flag > jarvis.capacity > 4. NO token export ever
-#   (probe iv — asserted here as an env-name absence in the output). Refusals:
-#   jarvis.enabled: false, or not a git repo → non-zero exit, NO command on stdout.
+#   (probe iv — asserted here as an env-name absence in the output). Spawn permission
+#   mode (post-UAT 2026-07-22): jarvis.spawn_permission_mode appends --permission-mode,
+#   env FORGE_JARVIS_SPAWN_PERMISSION_MODE beats config, unset = no flag. Refusals:
+#   jarvis.enabled: false, unknown spawn_permission_mode, or not a git repo →
+#   non-zero exit, NO command on stdout.
 #
 # Builds throwaway git repos in a mktemp dir, offline by construction; only ever
 # invokes --dry-run, so `claude`/`caffeinate` need not exist (dry-run is pure
@@ -30,6 +33,7 @@ trap 'rm -rf "$ROOT"' EXIT INT TERM
 GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null
 export GIT_CONFIG_GLOBAL GIT_CONFIG_SYSTEM
 unset FORGE_JARVIS_NAME_SUFFIX 2>/dev/null || true
+unset FORGE_JARVIS_SPAWN_PERMISSION_MODE 2>/dev/null || true
 
 PASSED=0; FAILED=0
 ok()   { PASSED=$((PASSED+1)); printf '  ok   %s\n' "$1"; }
@@ -95,7 +99,62 @@ case "$out" in
   *) ok "no token export in the resolved command (probe iv)" ;;
 esac
 
-# 7. NEG: enabled: false → clean refusal (non-zero, no command on stdout)
+# 7. spawn permission mode — config jarvis.spawn_permission_mode appends the flag
+#    (post-UAT 2026-07-22: spawned sessions were locked to "auto")
+cat > "$REPO/.forge/project.yml" <<'EOF'
+jarvis:
+  enabled: true
+  spawn_permission_mode: bypassPermissions
+EOF
+out="$(cd "$REPO" && sh "$JARVIS" --dry-run 2>/dev/null)"; rc=$?
+want="caffeinate -s claude remote-control --name jarvis-proj --spawn worktree --capacity 4 --permission-mode bypassPermissions"
+if [ "$rc" = 0 ] && [ "$out" = "$want" ]; then
+  ok "spawn_permission_mode from config → --permission-mode appended"
+else
+  bad "spawn_permission_mode from config" "rc=$rc out=$out"
+fi
+
+# 8. env FORGE_JARVIS_SPAWN_PERMISSION_MODE beats config (the name_suffix pattern)
+out="$(cd "$REPO" && FORGE_JARVIS_SPAWN_PERMISSION_MODE=plan sh "$JARVIS" --dry-run 2>/dev/null)"; rc=$?
+case "$out" in
+  *"--permission-mode plan") ok "env FORGE_JARVIS_SPAWN_PERMISSION_MODE overrides config mode" ;;
+  *) bad "env spawn-permission-mode override" "rc=$rc out=$out" ;;
+esac
+
+# 9. NEG: unset → flag ABSENT (today's command byte-for-byte — the conservative default)
+cat > "$REPO/.forge/project.yml" <<'EOF'
+jarvis:
+  enabled: true
+EOF
+out="$(cd "$REPO" && sh "$JARVIS" --dry-run 2>/dev/null)"; rc=$?
+case "$out" in
+  *"--permission-mode"*) bad "neg-control: unset spawn_permission_mode must add no flag" "out=$out" ;;
+  *)
+    if [ "$rc" = 0 ] && [ "$out" = "caffeinate -s claude remote-control --name jarvis-proj --spawn worktree --capacity 4" ]; then
+      ok "neg-control: unset spawn_permission_mode → no --permission-mode, command unchanged"
+    else
+      bad "neg-control unset spawn_permission_mode" "rc=$rc out=$out"
+    fi ;;
+esac
+
+# 10. NEG: unknown mode → loud refusal (never a silent drop), no command on stdout
+cat > "$REPO/.forge/project.yml" <<'EOF'
+jarvis:
+  enabled: true
+  spawn_permission_mode: yolo
+EOF
+out="$(cd "$REPO" && sh "$JARVIS" --dry-run 2>/dev/null)"; rc=$?
+err="$(cd "$REPO" && sh "$JARVIS" --dry-run 2>&1 >/dev/null)"
+if [ "$rc" != 0 ] && [ -z "$out" ]; then
+  case "$err" in
+    *spawn_permission_mode*yolo*) ok "neg-control: unknown spawn_permission_mode → refusal naming the bad value" ;;
+    *) bad "neg-control unknown mode: refusal message" "err=$err" ;;
+  esac
+else
+  bad "neg-control unknown spawn_permission_mode" "rc=$rc out=$out"
+fi
+
+# 11. NEG: enabled: false → clean refusal (non-zero, no command on stdout)
 cat > "$REPO/.forge/project.yml" <<'EOF'
 jarvis:
   enabled: false
@@ -107,7 +166,7 @@ else
   bad "neg-control enabled:false" "rc=$rc out=$out"
 fi
 
-# 8. NEG: not a git repo → clean refusal (RC --spawn worktree needs one)
+# 12. NEG: not a git repo → clean refusal (RC --spawn worktree needs one)
 NOREPO="$ROOT/norepo"
 mkdir -p "$NOREPO"
 out="$(cd "$NOREPO" && sh "$JARVIS" --dry-run 2>/dev/null)"; rc=$?

package/template/.forge/templates/project.yml

@@ -148,6 +148,12 @@ models:
 #                                    #   repos each machine overrides via env FORGE_JARVIS_NAME_SUFFIX so two
 #                                    #   live presences never share one name
 #   capacity: 4                      # RC server session capacity (--capacity), default 4
+#   spawn_permission_mode: ""        # --permission-mode for SPAWNED (phone-launched) sessions; one of
+#                                    #   acceptEdits|auto|bypassPermissions|default|dontAsk|plan; env
+#                                    #   FORGE_JARVIS_SPAWN_PERMISSION_MODE overrides per machine. Unset =
+#                                    #   no flag (platform default). TRUST WARNING: bypassPermissions means
+#                                    #   phone-spawned sessions act without prompts — opt in only where the
+#                                    #   phone lane carries the same trust as an attended terminal.
 
 risks:                              # What could go wrong?
   - risk: ""

package/template/.forge/templates/slice-runner/phase-report.yml

@@ -31,9 +31,13 @@ interrupt: none
 
 interrupt_payload: ""
 # interrupt_payload — REQUIRED (may be empty string when interrupt==none).
-# For ambiguity/irreversible/budget: the question text to put in the ping.
+# For ambiguity/irreversible/budget: the question text to put in the ping. A long
+# question may be a YAML block scalar (`interrupt_payload: |` + indented lines) —
+# the runner flattens it to ONE line (newlines → spaces) for the ping, so write
+# it to read well as a single line too.
 # For a `fork` (design decision): a PATH to a sketch/mockup the operator LOOKS AT —
 # never prose describing a visual (brief §8: a fork arrives as something to see).
+# A fork payload must stay a single-line path, never a block scalar.
 
 checks:
   passed: 0