feat(skills,core): worktree guard + per-fork question filter + trade-off mandate

[firatcand]

Summary

Three coupled fixes to enforce forge protocols across parallel Claude Code sessions. Second-opinion reviewed via /codex (verdict: agree-with-modification on all three, applied).

1. Worktree branch bleed (P0 — operational)

/pickup-task correctly creates a git worktree, but downstream skills had no cwd contract. Parallel sessions all sitting in the main checkout clobbered each other's HEAD.

• workspace.create() writes .forge/worktree-task.json as the binding marker on every creation (regardless of copyMeta). cleanup() whitelists it and physically removes baseline files before git worktree remove so it stays clean.
• skills/pickup-task inline bash writes the same marker.
• Each task-scoped mutating skill (plan-task, implement, qa, fix, review, ship) gained a Preflight: worktree guard block that exits 1 on the default branch when no marker is present, warns on a feature branch without a marker, and passes silently when the marker is found. Skills that intentionally run from main (sync-status, decompose, push-to-tracker, setup-repo, init) are not guarded.
• skills/_shared/worktree-guard.md documents the contract.

2. Per-fork architectural questions

/plan-task and /implement were thin and silently auto-decided architectural forks, bundling them into "Questions decided" tables the user rubber-stamped at plan approval.

• ETHOS.md Confusion Protocol now defines a four-dimension severity filter (decision_type, blast_radius, reversibility, plan_branch) and calls out decision-bundling as an anti-pattern.
• /plan-task adds an explicit fork-detection step, asks per fork in batches of ≤4, and records "Questions asked & answers applied" in the plan (not silent decisions).
• /implement applies the same filter to mid-implementation forks and records each surfaced decision in the commit message body.

3. Trade-off mandate in AskUserQuestion

Existing format presented options as pro-only lists, training users to rubber-stamp the agent's recommendation.

• ETHOS.md Confusion Protocol now requires every option carry both a benefit AND a concrete trade-off (vendor lock-in, migration cost, irreversibility, blast radius).
• Escape hatch for genuinely equivalent options: "No meaningful trade-off — this is a naming preference" — so agents don't invent contrast.
• skills/_shared/question-format.md is the canonical reference, with good/bad examples and the five-part structure (re-ground / simplify / recommend / options / trade-offs).

Test plan

• npm test — 876/887 pass, 0 fail (11 pre-existing skips)
• npm run typecheck — clean
• npm run build — clean ESM + CJS
• npm run test:pack — 0 forbidden paths in 65-file tarball
• node dist/bin/forge.cjs --version — 0.2.2
• Manual: run /pickup-task then /implement from main checkout — confirm guard refuses
• Manual: run /pickup-task then cd into worktree, run /implement — confirm guard passes
• Manual: trigger a planning task with an architectural fork — confirm AskUserQuestion fires per-fork, not bundled

Files changed

• src/core/workspace.ts — marker write + cleanup whitelist + physical baseline removal
• test/unit/workspace.test.ts — marker assertions on both copyMeta variants
• ETHOS.md — Confusion Protocol expansion (severity filter, trade-off mandate, anti-pattern)
• skills/_shared/worktree-guard.md (new) — contract doc
• skills/_shared/question-format.md (new) — canonical AskUserQuestion reference
• skills/pickup-task/SKILL.md — write marker in inline bash
• skills/plan-task/SKILL.md — preflight + fork-detection step + severity filter
• skills/implement/SKILL.md — preflight + mid-fork enforcement
• skills/{ship,qa,fix,review}/SKILL.md — preflight only

Codex review (2nd opinion)

Codex agreed with all three diagnoses (9/8/7 confidence) with these modifications, all applied:

• Use per-task marker, not single shared state file (parallel sessions would overwrite)
• Add severity filter rather than ask-every-fork (avoids question fatigue)
• Escape hatch for fake trade-offs

Full transcript: /tmp/codex-three-fixes-review.txt (local).