forge-orkes 0.71.0 → 0.73.1

package/template/.forge/checks/forge-check-lint.sh

@@ -14,7 +14,7 @@
 #     lint=clean
 #     lint=fail                                     + finding=<rule>:<file>[:<line>]
 #     lint=justified justify="<trailer line>"       + finding=<rule>:<file>[:<line>] justified
-#     rule ∈ cannot-fail|silent-fail|existence-only|deleted-assertion|feature-removal|skip-marker
+#     rule ∈ cannot-fail|silent-fail|existence-only|deleted-assertion|feature-removal|skip-marker|driven-by-missing
 #   exit: 0 = clean or justified; 1 = fail; 2 = bad invocation. Logs → stderr.
 #
 # Targets (nothing else is scanned):
@@ -48,11 +48,30 @@
 #                       shrink is ambiguous and keeps the stricter deleted-assertion.
 #   skip-marker       — an ADDED .only( / .skip( / it.skip / describe.only / xit( /
 #                       xdescribe( / @pytest.mark.skip / t.Skip() line.
+#   driven-by-missing — CONFIG-GATED, default OFF (hold-waiver patch, operator-
+#                       ruled 2026-07-22). When the BASE-side .forge/project.yml
+#                       carries:
+#                         attribution:
+#                           driven_by: true
+#                       every non-merge commit of merge-base..head must carry a
+#                         Driven-by: <email>
+#                       trailer (optional trailing session ref allowed) — the
+#                       durable per-commit record of the driving human, whatever
+#                       identity authors. Finding format: the file slot carries
+#                       the offending commit's short SHA
+#                       (finding=driven-by-missing:<short-sha>). Config absent or
+#                       false → rule fully off, zero behavior change. Read from
+#                       the BASE side, so a PR cannot disable the rule for
+#                       itself (and a project.yml edit raises a protected-path
+#                       hold in the sibling check anyway). Merge commits are
+#                       exempt (host- or tool-authored join points, not driven
+#                       work). SEVERABLE: this rule dies alone if it grows
+#                       friction; it shares only the justification channel.
 #
 # Justification channel (pure git, host-agnostic): a commit-message trailer
 #   Lint-Justify: <one line>
 # in ANY commit of merge-base..head lifts (b)/(c)/deleted-assertion/feature-removal/
-# skip-marker → exit 0 `lint=justified`. It never lifts (a).
+# skip-marker/driven-by-missing → exit 0 `lint=justified`. It never lifts (a).
 #
 # Host-agnostic + offline (NFR-032): POSIX sh over git plumbing only.
 set -u
@@ -85,6 +104,8 @@ JUSTIFY="$(git log --format=%B "$MB..$HEAD_REF" 2>/dev/null \
   | sed -n 's/^Lint-Justify:[[:space:]]*//p' | head -1 | tr '"' "'")"
 
 # Base-side gating_tests globs (same additive config the hold check reads).
+# Twin parser: keep in sync with forge-hold-check.sh:conf_list() —
+# duplicated deliberately (R075, self-contained-hooks convention).
 GATING="$(git show "$MB:.forge/hold-config.yml" 2>/dev/null \
   | awk '
       /^[A-Za-z_]+:/ { insec = (index($0, "gating_tests:") == 1) ? 1 : 0; next }
@@ -295,6 +316,13 @@ add_finding() { # rule, file, line("" ok)
 CHANGED="$(git diff --name-only "$MB" "$HEAD_REF" 2>/dev/null)" \
   || { printf 'forge-check-lint: git diff failed for %s\n' "$RANGE" >&2; exit 2; }
 
+# Scratch file for classify_units | while-read (escapes the pipe subshell so
+# add_finding's FINDINGS/HAS_A accumulation survives past the loop). No
+# predictable path (R077): allocated on first use, trap-cleaned.
+FCL_SCRATCH=""
+cleanup_fcl_scratch() { [ -n "$FCL_SCRATCH" ] && rm -f "$FCL_SCRATCH"; }
+trap cleanup_fcl_scratch EXIT INT TERM
+
 while IFS= read -r path; do
   [ -n "$path" ] || continue
   base_name="$(basename "$path")"
@@ -304,6 +332,7 @@ while IFS= read -r path; do
     .github/workflows/*.yml|.github/workflows/*.yaml|.gitlab-ci.yml)
       ADDED="$(added_lines "$path")"
       [ -n "$ADDED" ] || continue
+      [ -n "$FCL_SCRATCH" ] || FCL_SCRATCH="$(mktemp)" || { printf 'forge-check-lint: mktemp failed\n' >&2; exit 2; }
       classify_units "$path" | while IFS=' ' read -r cls ustart uend; do
         [ "$cls" != "clean" ] || continue
         hit=""
@@ -314,11 +343,10 @@ while IFS= read -r path; do
 $ADDED
 EOF2
         [ -n "$hit" ] && printf '%s %s %s\n' "$cls" "$path" "$ustart"
-      done > "${TMPDIR:-/tmp}/fcl_units.$$" || true
+      done > "$FCL_SCRATCH" || true
       while IFS=' ' read -r cls p ln; do
         [ -n "$cls" ] && add_finding "$cls" "$p" "$ln"
-      done < "${TMPDIR:-/tmp}/fcl_units.$$"
-      rm -f "${TMPDIR:-/tmp}/fcl_units.$$"
+      done < "$FCL_SCRATCH"
       continue
       ;;
   esac
@@ -358,6 +386,21 @@ done <<EOF
 $CHANGED
 EOF
 
+# --- Driven-by trailer rule (config-gated, default OFF; see header) -----------
+# Gate read from the BASE-side project.yml — a PR cannot disable the rule for
+# itself. Absent file / absent block / not-true value → rule fully off.
+DRIVEN_BY_ON="$(git show "$MB:.forge/project.yml" 2>/dev/null | awk '
+  /^[A-Za-z_]+:/ { insec = (index($0, "attribution:") == 1) ? 1 : 0; next }
+  insec && /^[[:space:]]+driven_by:[[:space:]]*true([[:space:]#]|$)/ { print "on"; exit }')"
+if [ "$DRIVEN_BY_ON" = "on" ]; then
+  for db_c in $(git rev-list --no-merges "$MB..$HEAD_REF" 2>/dev/null); do
+    if ! git log -1 --format=%B "$db_c" 2>/dev/null \
+      | grep -qE '^Driven-by:[[:space:]]*[^[:space:]@]+@[^[:space:]@]+'; then
+      add_finding driven-by-missing "$(git rev-parse --short "$db_c")" ""
+    fi
+  done
+fi
+
 FINDINGS="$(printf '%s' "$FINDINGS" | sort -u)"
 
 if [ -z "$FINDINGS" ]; then

package/template/.forge/checks/forge-hold-check.sh

@@ -14,6 +14,7 @@
 #     hold=blocked                                  facts, no recorded operator act
 #     fact=<class>:<path>                             one line per fact
 #     hold=waived waived_by=<login>                 facts + operator approval
+#     hold=waived waiver_run=<url>                  facts + approved waiver run (below)
 #     fact=<class>:<path> waived                      one line per waived fact
 #     class ∈ irreversible|structural|protected
 #   exit: 0 = clear or waived; 1 = blocked; 2 = bad invocation. All logs → stderr.
@@ -47,11 +48,49 @@
 # base-side config operators: list. Absent config / empty operators → no waiver
 # possible (raise-only safe default until the repo configures operators).
 #
+# Run-waiver (hold-waiver patch, operator-ruled 2026-07-22): OPTIONAL second
+# waiver channel — the Environment-gated waiver run. Base-side hold-config.yml
+# may carry:
+#   waiver:
+#     workflow: waive-hold.yml   # dispatchable workflow under .github/workflows/
+#     ref: main                  # MUST equal the repo's default branch
+# When configured AND the hold has fired AND no operator PR approval waives it,
+# the check queries the host ONCE (gh, the Actions runs API) for a run of that
+# workflow matching ALL of:
+#   - workflow path == .github/workflows/<workflow>  (querying by workflow file,
+#     re-asserted per run — a same-named run of another workflow never counts)
+#   - run ref (head_branch) == the repo's DEFAULT branch, which must also equal
+#     the configured ref (a dispatch runs the REF's copy of the file — a
+#     PR-branch copy with the gate stripped can never be the run that counts)
+#   - conclusion == success (an Environment-gated run cannot succeed unapproved
+#     — the approval IS why it ran)
+#   - display_title carries the PR HEAD SHA (the workflow's run-name templates
+#     the sha input in; a new push changes the head SHA, so a stale waiver run
+#     stops matching — superseded-SHA fail-closed leg)
+# Match → the check passes, annotated: hold=waived waiver_run=<run html_url>.
+# FAIL-CLOSED ON EVERY LEG: waiver unconfigured / unsafe config value / gh
+# missing / API unreachable / default branch unknown / config ref != default
+# branch / no matching run (wrong path, wrong ref, non-success, stale SHA) →
+# the hold stands (hold=blocked, exit 1). The waiver applies to THIS check
+# ONLY — never to the check-quality lint, never to CI test checks.
+#
+# Host access + CI permissions: the query runs through `gh` (env override
+# FORGE_HOLD_GH — fixtures stub it and stay offline). In CI the job needs the
+# default GITHUB_TOKEN exposed as GH_TOKEN with `actions: read` (the runs API)
+# in addition to `contents: read`; see docs/merge-floor-checks.md §5 wiring.
+# gh is used for transport + a PROJECTION-only --jq (no filtering in jq — every
+# matching leg is asserted in this script, so the offline fixtures exercise it).
+#
 # Host-agnostic + offline (NFR-032): pure POSIX sh over git plumbing. No GitHub/
-# GitLab API, no network, no node/python/jq. Heuristic manifest parsing is
-# documented inline; what it can't catch, UAT stands behind.
+# GitLab API, no network, no node/python/jq — with ONE opt-in exception: the
+# run-waiver query above, which only fires when `waiver:` is configured AND a
+# hold has already fired. With `waiver:` absent the check touches no network and
+# behaves byte-identically to the pre-waiver check. Heuristic manifest parsing
+# is documented inline; what it can't catch, UAT stands behind.
 set -u
 
+GH="${FORGE_HOLD_GH:-gh}"   # host CLI; fixtures point this at an offline stub
+
 usage() { printf 'usage: forge-hold-check.sh <base>...<head> [--approvals <file>]\n' >&2; }
 
 RANGE=""
@@ -93,6 +132,8 @@ fi
 # --- base-side config (additive; the PR cannot rewrite the rules it is judged by)
 CONF="$(git show "$MB:.forge/hold-config.yml" 2>/dev/null || true)"
 
+# Twin parser: keep in sync with forge-check-lint.sh:GATING awk block —
+# duplicated deliberately (R075, self-contained-hooks convention).
 conf_list() { # key → one value per line from the base-side config
   [ -n "$CONF" ] || return 0
   printf '%s\n' "$CONF" | awk -v k="$1" '
@@ -106,10 +147,25 @@ conf_list() { # key → one value per line from the base-side config
     }'
 }
 
+conf_waiver() { # key → scalar under the base-side waiver: block (empty if absent)
+  [ -n "$CONF" ] || return 0
+  printf '%s\n' "$CONF" | awk -v k="$1" '
+    /^[A-Za-z_]+:/ { insec = (index($0, "waiver:") == 1) ? 1 : 0; next }
+    insec && index($0, k ":") > 0 && $0 ~ ("^[[:space:]]+" k ":") {
+      v = $0
+      sub(/^[[:space:]]*[A-Za-z_]+:[[:space:]]*/, "", v)
+      gsub(/["\047]/, "", v)
+      sub(/[[:space:]]*(#.*)?$/, "", v)
+      print v; exit
+    }'
+}
+
 CONF_IRREVERSIBLE="$(conf_list irreversible_paths)"
 CONF_DEPLOY="$(conf_list deploy_paths)"
 CONF_GATING="$(conf_list gating_tests)"
 CONF_OPERATORS="$(conf_list operators)"
+WAIVER_WF="$(conf_waiver workflow)"
+WAIVER_REF="$(conf_waiver ref)"
 
 glob_match() { # path, glob-list (newline) → 0 if any glob matches
   [ -n "$2" ] || return 1
@@ -252,6 +308,71 @@ if [ -n "$WAIVED_BY" ]; then
   exit 0
 fi
 
+# --- run-waiver (optional; FAIL-CLOSED on every leg — see header) -------------
+# Reached only when facts exist and no operator PR approval waived them. With
+# waiver: unconfigured this block is a no-op (no gh call, no network): the
+# blocked verdict below is byte-identical to the pre-waiver check.
+WAIVER_RUN_URL=""
+if [ -n "$WAIVER_WF" ] && [ -n "$WAIVER_REF" ]; then
+  # Config values reach gh argv — hard-validate the charset first (fail-closed:
+  # a malformed binding can never widen the query or smuggle flags).
+  W_OK=1
+  case "$WAIVER_WF" in *[!A-Za-z0-9._/-]*)
+    printf 'forge-hold-check: waiver.workflow carries unsafe characters — waiver ignored, hold stands\n' >&2; W_OK=0 ;;
+  esac
+  case "$WAIVER_REF" in *[!A-Za-z0-9._/-]*)
+    printf 'forge-hold-check: waiver.ref carries unsafe characters — waiver ignored, hold stands\n' >&2; W_OK=0 ;;
+  esac
+  if [ "$W_OK" = 1 ]; then
+    HEAD_SHA="$(git rev-parse "$HEAD_REF^{commit}" 2>/dev/null)"
+    DEFAULT_BRANCH="$("$GH" api 'repos/{owner}/{repo}' --jq .default_branch 2>/dev/null)" || DEFAULT_BRANCH=""
+    if [ -z "$DEFAULT_BRANCH" ]; then
+      printf 'forge-hold-check: waiver: default branch unknown (gh missing or API unreachable) — hold stands\n' >&2
+    elif [ "$WAIVER_REF" != "$DEFAULT_BRANCH" ]; then
+      printf 'forge-hold-check: waiver.ref (%s) != repo default branch (%s) — hold stands\n' "$WAIVER_REF" "$DEFAULT_BRANCH" >&2
+    else
+      case "$WAIVER_WF" in
+        */*) WF_PATH="$WAIVER_WF" ;;
+        *)   WF_PATH=".github/workflows/$WAIVER_WF" ;;
+      esac
+      # PROJECTION-only jq (no filtering there — every leg is asserted below so
+      # the offline fixture stub exercises each one). Fields tab-separated,
+      # display_title LAST (the one field that may contain spaces).
+      RUNS="$("$GH" api \
+        "repos/{owner}/{repo}/actions/workflows/$WAIVER_WF/runs?branch=$DEFAULT_BRANCH&status=success&per_page=100" \
+        --jq '.workflow_runs[] | [.conclusion, .head_branch, .path, .html_url, .display_title] | @tsv' \
+        2>/dev/null)" || RUNS=""
+      if [ -z "$RUNS" ]; then
+        printf 'forge-hold-check: waiver: no runs of %s on %s (or API unreachable) — hold stands\n' "$WF_PATH" "$DEFAULT_BRANCH" >&2
+      else
+        W_TAB="$(printf '\t')"
+        while IFS="$W_TAB" read -r r_concl r_branch r_path r_url r_title; do
+          [ -n "$r_concl" ] || continue
+          [ "$r_concl" = "success" ] || continue           # leg: approved (Environment-gated success)
+          [ "$r_branch" = "$DEFAULT_BRANCH" ] || continue  # leg: run ref == default branch
+          [ "$r_path" = "$WF_PATH" ] || continue           # leg: workflow path
+          case "$r_title" in                               # leg: run title carries the PR head SHA
+            *"$HEAD_SHA"*) WAIVER_RUN_URL="$r_url"; break ;;
+          esac
+        done <<WEOF
+$RUNS
+WEOF
+        [ -n "$WAIVER_RUN_URL" ] \
+          || printf 'forge-hold-check: waiver: no approved success run of %s on %s carries head SHA %s — hold stands\n' "$WF_PATH" "$DEFAULT_BRANCH" "$HEAD_SHA" >&2
+      fi
+    fi
+  fi
+fi
+
+if [ -n "$WAIVER_RUN_URL" ]; then
+  printf 'forge-hold-check: hold waived by approved run %s\n' "$WAIVER_RUN_URL" >&2
+  printf 'hold=waived waiver_run=%s\n' "$WAIVER_RUN_URL"
+  printf '%s\n' "$FACTS" | while IFS= read -r f; do
+    [ -n "$f" ] && printf 'fact=%s waived\n' "$f"
+  done
+  exit 0
+fi
+
 printf 'hold=blocked\n'
 printf '%s\n' "$FACTS" | while IFS= read -r f; do
   [ -n "$f" ] && printf 'fact=%s\n' "$f"

package/template/.forge/checks/forge-jarvis-awareness.sh

@@ -23,20 +23,28 @@
 # NO OWNED STATE: nothing here is persisted; the next ask recomputes from disk + git. The only
 # durable Jarvis state anywhere is B4's relay markers (a different helper).
 #
+# BARE BRANCH LOOSENING (issue #25): the disk glob also matches a bare `m-<id>-slug` or
+# `m<digits>-slug` branch (no `forge/` prefix) — a worktree created by hand or by another tool,
+# not just the Worktree Convention's `forge/{anchor}`. Its milestone id is derived from the
+# LONGEST-matching `.forge/state/milestone-*.yml` filename in that worktree, else the id's first
+# hyphen-segment. A bare NUMBER alone (no `m` token) never matches — see derive_milestone_id.
+#
 #   forge-jarvis-awareness.sh [--dry-run] [--worktree-root <dir>]
 #     --dry-run          resolve + print structure without shelling to the fold/board (fast
 #                        plumbing check); tests and quick sanity checks use it.
 #     --worktree-root    override the worktree scan root (tests); default: real `git worktree list`.
 #
 # Host-truth commands are env-overridable so tests inject stubs and degradation is explicit:
-#   FORGE_JARVIS_FOLD   default .claude/hooks/forge-release-fold.sh
-#   FORGE_JARVIS_BOARD  default .forge/checks/forge-board-render.sh
+#   FORGE_JARVIS_FOLD       default .claude/hooks/forge-release-fold.sh
+#   FORGE_JARVIS_BOARD      default .forge/checks/forge-board-render.sh
+#   FORGE_JARVIS_REPO_ROOT  default the repo root derived from this script's own path (test seam:
+#                        points the git-worktree glob at a throwaway fixture repo)
 # BEST-EFFORT: a missing fold/board degrades to a stated 'unknown' / '(unavailable)', never a hard
 # fail — the awareness answer always renders.
 set -u
 
 SELF_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "$SELF_DIR/../.." && pwd)"                 # .forge/checks → repo root
+REPO_ROOT="${FORGE_JARVIS_REPO_ROOT:-$(cd "$SELF_DIR/../.." && pwd)}"   # .forge/checks → repo root
 FOLD="${FORGE_JARVIS_FOLD:-$REPO_ROOT/.claude/hooks/forge-release-fold.sh}"
 BOARD="${FORGE_JARVIS_BOARD:-$REPO_ROOT/.forge/checks/forge-board-render.sh}"
 TAB="$(printf '\t')"
@@ -61,9 +69,50 @@ fold_state() {  # fold_state <milestone-id>
   [ -n "$_rs" ] && printf '%s' "$_rs" || printf 'unknown'
 }
 
-# ── 1. live/parked slices — a DISK GLOB of worktrees on forge/m-* branches. Same on-disk registry
-#       the relay's --list-logs arms tail -F on; recomputed here, never stored. Emits TSV:
-#       <milestone-id>\t<branch>\t<path>. --worktree-root globs a given dir instead (tests). ──────
+# ── milestone id derivation for a matched branch (issue #25, bare-branch loosening). A
+#    forge/m-* branch keeps its original textual derivation unchanged (strip forge/, strip the
+#    8-hex session suffix). A bare branch (m-<id>-slug | m<digits>-slug) derives the id from the
+#    LONGEST-matching .forge/state/milestone-*.yml file name in that worktree, else falls back to
+#    the id's first hyphen-segment. Same rule text as forge-jarvis-dispatch.sh's branch-derived
+#    milestone-dir pick (there against .forge/phases/milestone-*/ dirs instead of state files). ──
+derive_milestone_id() {  # derive_milestone_id <branch> <worktree-path>
+  _b="$1"; _p="$2"
+  case "$_b" in
+    forge/*)
+      _m="${_b#forge/}"                                          # m-37[-<session>]
+      case "$_m" in
+        *-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f])
+          _m="${_m%-*}" ;;                                        # → m-37
+      esac
+      printf '%s' "$_m"
+      return 0 ;;
+  esac
+  _base="$_b"
+  case "$_base" in
+    *-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f])
+      _base="${_base%-*}" ;;                                      # strip an 8-hex session suffix
+  esac
+  _best=""
+  for _f in "$_p"/.forge/state/milestone-*.yml; do
+    [ -f "$_f" ] || continue
+    _id="$(basename "$_f" .yml)"; _id="${_id#milestone-}"
+    case "$_base" in
+      "m-$_id"|"m-$_id"-*|"m$_id"|"m$_id"-*)
+        [ "${#_id}" -gt "${#_best}" ] && _best="$_id" ;;
+    esac
+  done
+  if [ -n "$_best" ]; then
+    printf 'm-%s' "$_best"
+  else
+    _seg="${_base#m}"; _seg="${_seg#-}"; _seg="${_seg%%-*}"       # first hyphen-segment fallback
+    printf 'm-%s' "$_seg"
+  fi
+}
+
+# ── 1. live/parked slices — a DISK GLOB of worktrees on forge/m-* branches OR a bare m-<id>
+#       branch (issue #25). Same on-disk registry the relay's --list-logs arms tail -F on;
+#       recomputed here, never stored. Emits TSV: <milestone-id>\t<branch>\t<path>.
+#       --worktree-root globs a given dir instead (tests). ─────────────────────────────────────
 list_slices() {
   if [ -n "$WT_ROOT" ]; then
     for _wt in "$WT_ROOT"/*/; do
@@ -75,12 +124,14 @@ list_slices() {
     git -C "$REPO_ROOT" worktree list --porcelain 2>/dev/null | awk -v tab="$TAB" '
       /^worktree / { p = substr($0, 10) }   # full remainder — paths may contain spaces
       /^branch /   {
-        if ($2 ~ /refs\/heads\/forge\/m-/) {
-          b = $2; sub(/refs\/heads\//, "", b)          # forge/m-37[-<session>]
-          m = b; sub(/^forge\//, "", m); sub(/-[0-9a-f]{8}$/, "", m)   # → m-37
-          print m tab b tab p
+        b = $2; sub(/refs\/heads\//, "", b)
+        if (b ~ /^forge\/m-/ || b ~ /^m-[0-9A-Za-z]/ || b ~ /^m[0-9]/) {
+          print b tab p
         }
-      }'
+      }' | while IFS="$TAB" read -r _b _p; do
+        _m="$(derive_milestone_id "$_b" "$_p")"
+        printf '%s%s%s%s%s\n' "$_m" "$TAB" "$_b" "$TAB" "$_p"
+      done
   fi
 }
 

package/template/.forge/checks/forge-jarvis-dispatch.sh

@@ -25,9 +25,13 @@
 # this dispatch ever starts choosing models, STOP — routing is step 5.
 #
 # All non-flag args are forwarded to the runner unchanged (--slice <worktree>, and optionally
-# --work-dir / --config / --schema / --report-template — whatever the runner accepts). The args
-# this helper consumes for itself are --dry-run, --materialize-only, and --plan (the runner has
-# no --plan; forwarding it would be a routing-adjacent contract change — FR-198 boundary class).
+# --config / --schema / --report-template — whatever the runner accepts). The args this helper
+# consumes for itself are --dry-run, --materialize-only, and --plan (the runner has no --plan;
+# forwarding it would be a routing-adjacent contract change — FR-198 boundary class).
+# EXCEPTION (R092): --work-dir is REFUSED, not forwarded — dispatch pins notify.log,
+# dispatch.out, and the runner-work rotation to <worktree>/.forge/runner-work, so a forwarded
+# --work-dir would split-brain the work dir (runner writes one place; dispatch, relay, and
+# rotation look at another). Callers managing their own work dir invoke the runner directly.
 #
 #   --dry-run   print the exact `nohup env ... runner ...` command + env on stdout and exit 0;
 #               never dispatches. Use it to show the operator what "go" will run.
@@ -55,9 +59,9 @@
 # LINE NUMBER (sibling dir); a partial reset would misalign relay offsets. Archive, never
 # delete: git commits are the durable evidence, runner-work is runtime. The resume paths are
 # untouched by construction — crash re-dispatch and park→answer→resume arrive with slice.yml
-# present and take the honored-as-is early return, so rotation never fires there. An explicitly
-# forwarded --work-dir is the caller's own state management and is NOT rotated; dispatching a
-# new order while the prior runner still lives in the worktree is operator error, unchanged.
+# present and take the honored-as-is early return, so rotation never fires there. A --work-dir
+# arg is refused at the door (R092, see above) so rotation always matches the paths dispatch
+# owns; dispatching a new order while the prior runner still lives is operator error, unchanged.
 #
 # WORK-ORDER MATERIALIZATION (FR-197; walk run 4, 2026-07-22). The runner's contract
 # (consumed, never edited) is <worktree>/slice.yml listing phase names, each resolving to
@@ -70,6 +74,15 @@
 # REFUSES LOUDLY AND SYNCHRONOUSLY when it cannot — the failure surface is this exit code, not
 # a silent phone. An existing slice.yml is honored untouched (a hand-authored work order wins).
 #   --materialize-only   materialize (or refuse) and exit — no dispatch. Test hook + operator tool.
+#
+# STALENESS GUARD (live 2026-07-23). A materialized order SNAPSHOTS its source plans, so each
+# bundled plan-NN.md is fingerprinted into slice.yml (`# source: <phase>/<file> cksum=N`, after
+# the phases block). A plain re-dispatch (slice.yml present, no --plan) re-checksums them: any
+# divergence — an amended source plan — REFUSES loudly instead of silently building the old
+# spec (observed live: a full rebuild ran to the pre-amendment plan). Refuse, never auto-
+# rebuild: the honored-as-is branch also serves crash re-dispatch and park→answer→resume,
+# whose runner-work must survive rotation. Hand-authored orders are never checked; pre-guard
+# materialized orders (no fingerprints) skip the check — lazy migration.
 set -u
 
 SELF_DIR="$(cd "$(dirname "$0")" && pwd)"
@@ -98,6 +111,12 @@ while [ "$argc" -gt 0 ]; do
       [ -n "$_spec" ] || { printf 'forge-jarvis-dispatch: --plan requires a <phase>[/plan-NN] spec\n' >&2; exit 2; }
       PLAN_SPECS="${PLAN_SPECS}${_spec}
 " ;;
+    --work-dir|--work-dir=*)                         # REFUSED (R092) — see header: a forwarded
+      # work dir splits the brain (runner writes there; notify.log/dispatch.out/rotation
+      # stay pinned to <worktree>/.forge/runner-work). Refuse loudly BEFORE the detach —
+      # the failure surface is this exit code, not a silent phone.
+      printf 'forge-jarvis-dispatch: REFUSED — --work-dir cannot be forwarded through dispatch (notify.log, dispatch.out and runner-work rotation are pinned to <worktree>/.forge/runner-work; a custom work dir would split-brain them). Invoke forge-slice-runner.sh directly to manage your own work dir.\n' >&2
+      exit 2 ;;
     --slice)
       WORKTREE="${1:-}"; shift; argc=$((argc - 1))
       set -- "$@" --slice "$WORKTREE" ;;             # forward it too (runner needs it)
@@ -161,14 +180,43 @@ rotate_runner_work() {
 # caller sees it synchronously and must relay it to the operator.
 materialize_work_order() {
   if [ -f "$WORKTREE/slice.yml" ]; then
+    _hdr="$(head -n 1 "$WORKTREE/slice.yml" 2>/dev/null)"
     if [ -z "$PLAN_SPECS" ]; then
+      # STALENESS GUARD (live 2026-07-23): a helper-materialized work order SNAPSHOTS
+      # the source plans at dispatch time; amend .forge/phases/.../plan-NN.md afterward
+      # and a plain re-dispatch would build the OLD spec silently (observed live: a full
+      # rebuild ran to the pre-amendment plan; the miss surfaced only because the
+      # operator poked). Materialization records one `# source: <phase>/<file> cksum=N`
+      # line per bundled plan; here each is re-checksummed and ANY divergence refuses
+      # LOUDLY. Refuse, never auto-rebuild: this branch also serves crash re-dispatch
+      # and park→answer→resume, and an auto-rotation would wipe the parked report the
+      # resume derives from. Hand-authored orders are never checked (they win, always);
+      # older materialized orders without fingerprints skip the check (lazy migration).
+      case "$_hdr" in
+        "# Materialized by forge-jarvis-dispatch from "*)
+          _srcrel="${_hdr#\# Materialized by forge-jarvis-dispatch from }"
+          _srcrel="${_srcrel% (delete to re-materialize)}"
+          _stale=""
+          while IFS= read -r _sl; do
+            case "$_sl" in "# source: "*) ;; *) continue ;; esac
+            _ref="${_sl#\# source: }"                    # <phase>/<file> cksum=<n>
+            _rf="${_ref% cksum=*}"; _rk="${_ref##* cksum=}"
+            _cur=""
+            [ -f "$WORKTREE/$_srcrel/$_rf" ] && _cur="$(cksum < "$WORKTREE/$_srcrel/$_rf" 2>/dev/null | cut -d' ' -f1)"
+            [ "$_cur" = "$_rk" ] || _stale="$_stale $_rf"
+          done < "$WORKTREE/slice.yml"
+          if [ -n "$_stale" ]; then
+            printf 'forge-jarvis-dispatch: REFUSED — materialized slice.yml is STALE:%s changed since materialization (source plan amended or removed). Re-dispatch with --plan to rebuild the work order (the prior one is archived), or delete slice.yml to re-materialize whole. RELAY this refusal to the operator.\n' "$_stale" >&2
+            return 2
+          fi ;;
+      esac
       printf 'forge-jarvis-dispatch: slice.yml present — using it as-is\n' >&2
       return 0
     fi
     # --plan asks for a NEW work order. Only a slice.yml this helper itself wrote may be
     # replaced (and it is archived, not lost — rotate_runner_work); a hand-authored work
     # order wins, always.
-    case "$(head -n 1 "$WORKTREE/slice.yml" 2>/dev/null)" in
+    case "$_hdr" in
       "# Materialized by forge-jarvis-dispatch"*)
         REPLACE_MATERIALIZED=1 ;;
       *)
@@ -185,6 +233,14 @@ materialize_work_order() {
   # unconditionally missed milestone-m-EVT01 and fell through to a 38-dir refusal. Try the
   # anchor verbatim before the m--stripped form, then both again minus one trailing
   # -{session} token; first existing dir wins (exact/longer forms first).
+  #
+  # BARE BRANCH LOOSENING (issue #25): a worktree may also sit on a bare `m-<id>-slug` or
+  # `m<digits>-slug` branch (no `forge/` prefix) — same match family as the awareness/relay
+  # glob. Unlike the forge/ convention (id + at most one session token), a bare branch's slug
+  # can carry several descriptive words (m-176-marcy-mcp), so the id is found by repeatedly
+  # truncating the LAST hyphen-segment and testing for an existing milestone dir at each
+  # length — the longest-matching truncation wins (mirrors awareness's state-file prefix
+  # match, here against .forge/phases/milestone-*/ dirs instead).
   _mdir=""
   _branch="$(git -C "$WORKTREE" branch --show-current 2>/dev/null)"
   case "$_branch" in
@@ -198,6 +254,22 @@ materialize_work_order() {
           break
         fi
       done ;;
+    m-*|m[0-9]*)
+      _cand="$_branch"
+      while [ -n "$_cand" ]; do
+        for _try in "$_cand" "${_cand#m-}" "${_cand#m}"; do
+          [ -n "$_try" ] || continue
+          if [ -d "$WORKTREE/.forge/phases/milestone-$_try" ]; then
+            _mdir="$WORKTREE/.forge/phases/milestone-$_try"
+            break
+          fi
+        done
+        [ -n "$_mdir" ] && break
+        case "$_cand" in
+          *-*) _cand="${_cand%-*}" ;;                 # drop the last hyphen-segment, retry shorter
+          *) break ;;
+        esac
+      done ;;
   esac
   # Fallback (non-git fixture dirs / unconventional branches): a SINGLE milestone dir is
   # unambiguous; several without a branch-derived pick is a refusal, never a guess.
@@ -212,7 +284,7 @@ materialize_work_order() {
       return 2
     fi
     if [ "$_mdirs" -gt 1 ]; then
-      printf 'forge-jarvis-dispatch: REFUSED — %s milestone plan dirs in %s and no forge/m-* branch to pick by; ambiguous work order. Write slice.yml explicitly. RELAY this refusal to the operator.\n' "$_mdirs" "$WORKTREE" >&2
+      printf 'forge-jarvis-dispatch: REFUSED — %s milestone plan dirs in %s and no forge/m-* or bare m-<id> branch to pick by; ambiguous work order. Write slice.yml explicitly. RELAY this refusal to the operator.\n' "$_mdirs" "$WORKTREE" >&2
       return 2
     fi
   fi
@@ -273,6 +345,8 @@ PLAN_VALIDATE_EOF
   fi
   printf '# Materialized by forge-jarvis-dispatch from %s (delete to re-materialize)\nphases:\n' "${_mdir#"$WORKTREE"/}" > "$_tmp"
   _count=0
+  _srcs=""             # per-plan source fingerprints — the staleness guard's record
+
   # Quoted glob iteration, numeric phase order — never word-split ls output
   # (phase/plan names are repo content; unquoted expansion would let a crafted
   # name pull arbitrary *.md into the runner's prompt).
@@ -319,6 +393,8 @@ PLAN_SELECT_EOF
         esac
       fi
       cat "$_f" >> "$_pl"
+      _srcs="$_srcs# source: $_p/$(basename "$_f") cksum=$(cksum < "$_f" 2>/dev/null | cut -d' ' -f1)
+"
     done
     printf '  - %s\n' "$_p" >> "$_tmp"
     _count=$((_count + 1))
@@ -330,6 +406,10 @@ MATERIALIZE_EOF
     printf 'forge-jarvis-dispatch: REFUSED — %s has no phase plans (plan-*.md); nothing to dispatch. RELAY this refusal to the operator.\n' "$_mdir" >&2
     return 2
   fi
+  # Source fingerprints land AFTER the phases block (the runner's phases parser stops
+  # at the first non-list line — interleaving them would truncate the phase list).
+  # The staleness guard above re-checks them on the next plain re-dispatch.
+  printf '%s' "$_srcs" >> "$_tmp"
   # Commit point: the new work order definitely lands. Rotate stale runner state first
   # (FR-235) — this is the ONLY call site; every refusal above exits before it.
   rotate_runner_work || { rm -f "$_tmp"; return 2; }

package/template/.forge/checks/forge-jarvis-relay.sh

@@ -31,16 +31,22 @@
 #                                              the payload rather than fold/gh/board (acceptance #3).
 #
 # HOST-TRUTH COMMANDS (env-overridable so tests inject stubs, and so degradation is explicit):
-#   FORGE_JARVIS_FOLD   default .claude/hooks/forge-release-fold.sh  (release_state recompute)
+#   FORGE_JARVIS_FOLD       default .claude/hooks/forge-release-fold.sh  (release_state recompute)
+#   FORGE_JARVIS_REPO_ROOT  default the repo root derived from this script's own path (test seam:
+#                        points --list-logs's git-worktree glob at a throwaway fixture repo)
 #   (gh-based facts live in forge-jarvis-prwatch.sh, which documents its own FORGE_JARVIS_GH;
 #    the board recompute lives in awareness/promote — this helper consults the fold only.)
 #
+# BARE BRANCH LOOSENING (issue #25): --list-logs also matches a bare `m-<id>-slug` or
+# `m<digits>-slug` worktree branch (no `forge/` prefix), same match rule as the awareness glob —
+# it only needs the notify-log PATH, not the milestone id, so no id derivation lives here.
+#
 # BEST-EFFORT: a fold/gh/board that is absent or errors degrades to release_state=unknown and
 # says so — never a silent success, never a hard fail of the relay path.
 set -u
 
 SELF_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "$SELF_DIR/../.." && pwd)"                 # .forge/checks → repo root
+REPO_ROOT="${FORGE_JARVIS_REPO_ROOT:-$(cd "$SELF_DIR/../.." && pwd)}"   # .forge/checks → repo root
 FOLD="${FORGE_JARVIS_FOLD:-$REPO_ROOT/.claude/hooks/forge-release-fold.sh}"
 
 # ── host truth: the slice's release_state, recomputed from the fold (never the payload) ───────
@@ -148,12 +154,15 @@ mode_list_logs() {
     done
   else
     # live path: `git worktree list` is the on-disk registry of worktrees; glob it to the
-    # forge/m-* slice branches and emit each slice's notify-log path. Pinned with -C so the
-    # watch list never depends on the caller's cwd (the cwd-reset footgun: a snapped cwd
-    # would silently arm ZERO watches).
+    # forge/m-* slice branches (OR a bare m-<id>-slug / m<digits>-slug branch, issue #25) and
+    # emit each slice's notify-log path. Pinned with -C so the watch list never depends on the
+    # caller's cwd (the cwd-reset footgun: a snapped cwd would silently arm ZERO watches).
     git -C "$REPO_ROOT" worktree list --porcelain 2>/dev/null | awk '
       /^worktree /  { p=substr($0, 10) }   # full remainder — paths may contain spaces
-      /^branch /    { if ($2 ~ /refs\/heads\/forge\/m-/) print p "/.forge/runner-work/notify.log" }
+      /^branch /    {
+        b=$2; sub(/refs\/heads\//, "", b)
+        if (b ~ /^forge\/m-/ || b ~ /^m-[0-9A-Za-z]/ || b ~ /^m[0-9]/) print p "/.forge/runner-work/notify.log"
+      }
     '
   fi
   exit 0

package/template/.forge/checks/forge-jarvis.sh

@@ -54,6 +54,15 @@
 #   NO block → sensible defaults (the launcher is operator-invoked, not ambient — unlike
 #   the board, absence does not mean inert).
 #
+# ONE DOOR PER NAME (firstmate-review adoption, 2026-07-22): docs/jarvis.md has said
+# "two live presences must never share one name" since m-37 — discipline, no mechanism.
+# On REAL launch (never --dry-run, which stays pure resolution) this script scans live
+# processes for a `claude remote-control` already holding the resolved sticky name on
+# THIS machine and refuses loudly with the live pid. Exact --name token match, so a
+# live jarvis-<repo>-personal never blocks jarvis-<repo>. The ps read is env-overridable
+# (FORGE_JARVIS_PS — the FORGE_JARVIS_FOLD stub pattern) so tests inject fixtures; an
+# unreadable ps warns and proceeds — advisory hygiene, not a security gate.
+#
 # USAGE:
 #   .forge/checks/forge-jarvis.sh [--dry-run] [--name <full-name>] [--capacity <N>]
 #     --dry-run    print the fully resolved command on stdout and exit 0 — never executes.
@@ -165,6 +174,25 @@ fi
 # .claude/skills/jarvis/SKILL.md ("Session binding" / arm-the-watches). The launcher
 # stays presence-only and deliberately keeps no relay glue.
 
+# --- double-start guard: one door per name per machine ------------------------
+# The sticky name is the phone's ONLY discoverability anchor (probe ii); a second
+# same-name server on this machine would co-mingle two presences behind one list
+# entry. Checked before the toolchain check so the refusal is the first word.
+PS_OUT="$(${FORGE_JARVIS_PS:-ps -Ao pid=,args=} 2>/dev/null)" || {
+  printf 'forge-jarvis: duplicate-door check unavailable (ps read failed) — proceeding.\n' >&2
+  PS_OUT=""
+}
+LIVE_PID="$(printf '%s\n' "$PS_OUT" | awk -v name="$NAME" '
+  /remote-control/ {
+    for (i = 2; i <= NF; i++)
+      if (($i == "--name" && $(i+1) == name) || $i == ("--name=" name)) { print $1; exit }
+  }')"
+if [ -n "$LIVE_PID" ]; then
+  printf 'forge-jarvis: %s is already live on this machine (pid %s) — one door per name.\n' "$NAME" "$LIVE_PID" >&2
+  printf 'forge-jarvis: attach to the running door instead, or stop it first: kill %s\n' "$LIVE_PID" >&2
+  exit 2
+fi
+
 # --- launch ------------------------------------------------------------------
 command -v claude >/dev/null 2>&1 || {
   printf 'forge-jarvis: `claude` not found on PATH.\n' >&2