fix(unic-archon-dlc): explicit staging, and composed repository pinning in the Archon Boxes

apps/claude-code/unic-archon-dlc/.archon/commands/unic-dlc-build.md

@@ -17,8 +17,10 @@ each slice carrying its `acceptance_criteria` + `test_command`). There is **no g
 ## What this workflow does
 
 1. **bootstrap** — parse the slug from `$ARGUMENTS`, read `.archon/unic-dlc.config.yaml`
-   (`artifacts_dir`, `gates.build`, `build.*`), and confirm `issues.json` exists. Missing
-   preconditions cancel cleanly with a "run /tickets first" message.
+   (`artifacts_dir`, `gates.build`, `build.*`), confirm `issues.json` exists, and **derive the target
+   repository** from the worktree's `origin` remote (`project.repo_ref` is an optional override, absent
+   by default). Missing preconditions cancel cleanly with a "run /tickets first" message; an ambiguous
+   repository cancels with its own message.
 
 2. **slopcheck** — verify every package introduced since the last commit against the npm registry.
    Packages that can't be confirmed are flagged `[ASSUMED]` and halt the build until a human resolves
@@ -45,7 +47,11 @@ each slice carrying its `acceptance_criteria` + `test_command`). There is **no g
 6. **report** — writes `<artifacts_dir>/<slug>/report.md` (what was built, matrix, test outcomes,
    decisions/ADRs, tech debt).
 
-7. **open-pr → build-pr-gate** — opens a PR to `develop`, then gates it. The gate is **HITL by default**
+7. **open-pr → build-pr-gate** — stages an explicit list of **named paths** (source, tests, `PRD.md`,
+   `issues.json`, `report.md`, `build-state.json`, and any drafted ADR), confirms with
+   `git status --porcelain` that nothing else is staged, opens a PR against the derived repository with
+   base `develop`, then gates it. `build-state.json` is committed here and **only** here — never during
+   a loop iteration — so the loop's anti-cheat record survives `/cleanup`. The gate is **HITL by default**
    and honours `gates.build`: skipped when `afk` (the PR is still opened). On **reject**, a
    verify-and-fix pass runs from the reviewer's feedback and the gate re-pauses — it does **not** rebuild
    from scratch.
@@ -55,6 +61,7 @@ each slice carrying its `acceptance_criteria` + `test_command`). There is **no g
 - `/unic-archon-dlc:tickets <slug>` has run and its tickets PR is approved.
 - `<artifacts_dir>/<slug>/issues.json` exists.
 - `.archon/unic-dlc.config.yaml` is present (from `/unic-archon-dlc:setup`).
+- The checkout has an `origin` remote, or `project.repo_ref` is set.
 - Archon ≥ 0.5.0.
 
 ## Runs

apps/claude-code/unic-archon-dlc/.archon/commands/unic-dlc-explore.md

@@ -31,8 +31,10 @@ a prior baton.
 ## What this workflow does
 
 1. **bootstrap** — parse the slug from `$ARGUMENTS`, read `.archon/unic-dlc.config.yaml`
-   (`artifacts_dir`, `gates.explore`, `tracker.type`, `project.branching`). A missing slug or config
-   cancels cleanly.
+   (`artifacts_dir`, `gates.explore`, `tracker.type`, `project.branching`), and **derive the target
+   repository** from the worktree's `origin` remote (`project.repo_ref` is an optional override,
+   absent by default). A missing slug or config cancels cleanly; so does a fork checkout whose parent
+   differs from `origin` with no override set, because the target would then be ambiguous.
 
 2. **4 research nodes** (parallel, fresh, read-only) — stack · features · architecture · pitfalls. Each
    emits a concise findings body.
@@ -58,7 +60,9 @@ a prior baton.
    spike code on branch `spike/<slug>`; REJECT → no branch (the code stays in the isolated worktree for
    `/cleanup`).
 
-7. **preserve-spike** — reached only on approve: creates `spike/<slug>` and commits the worktree.
+7. **preserve-spike** — reached only on approve: creates `spike/<slug>` and commits **named paths
+   only** (findings.md plus the paths the spike node recorded), then confirms with
+   `git status --porcelain` that nothing else was staged.
 
 ## Workflow structure
 
@@ -85,21 +89,23 @@ grilling. Keeping those three subsection headings exact is what makes the handof
 ## Prerequisites
 
 - `.archon/unic-dlc.config.yaml` is present (from `/unic-archon-dlc:setup`).
-- The configured tracker CLI/MCP is reachable for the spike ticket (`gh` / `az` / `jira`, or the
-  `azure-devops-cli` skill). Trackers without a create CLI print manual steps instead of failing.
+- The system-skill registered under `tracker.access` is reachable for the spike ticket. A tracker with
+  no issue-creation capability prints manual steps instead of failing.
+- The checkout has an `origin` remote, or `project.repo_ref` is set.
 - Archon ≥ 0.5.0.
 
 ## Configuration reference
 
 Read from `.archon/unic-dlc.config.yaml`:
 
-| Field                   | Type         | Default     | Description                                                     |
-| ----------------------- | ------------ | ----------- | --------------------------------------------------------------- |
-| `gates.explore`         | `hitl`/`afk` | `hitl`      | HITL pauses at the spike-branch gate; AFK skips it (no branch)  |
-| `artifacts_dir`         | string       | `workflows` | Session artefact home (`<artifacts_dir>/<slug>/findings.md`)    |
-| `tracker.*`             | object       | —           | Composed to file the spike ticket (MCP-first, CLI-fallback)     |
-| `classification.labels` | object       | —           | Single source of truth for the spike ticket's labels (ADR-0024) |
-| `project.branching`     | string       | `gitflow`   | Informs branch conventions                                      |
+| Field                   | Type         | Default     | Description                                                      |
+| ----------------------- | ------------ | ----------- | ---------------------------------------------------------------- |
+| `gates.explore`         | `hitl`/`afk` | `hitl`      | HITL pauses at the spike-branch gate; AFK skips it (no branch)   |
+| `artifacts_dir`         | string       | `workflows` | Session artefact home (`<artifacts_dir>/<slug>/findings.md`)     |
+| `tracker.*`             | object       | —           | Composed to file the spike ticket (MCP-first, CLI-fallback)      |
+| `classification.labels` | object       | —           | Single source of truth for the spike ticket's labels (ADR-0024)  |
+| `project.branching`     | string       | `gitflow`   | Informs branch conventions                                       |
+| `project.repo_ref`      | string       | _absent_    | Optional override; by default the repository comes from `origin` |
 
 ## Runs
 

apps/claude-code/unic-archon-dlc/.archon/commands/unic-dlc-pr-review.md

@@ -1,19 +1,20 @@
 ---
-description: Run the unic-archon-dlc PR review workflow — seven intent-grounded aspects fanned out, then a summary comment + inline comments posted/updated on the current PR, with iteration-aware re-review.
+description: Run the unic-archon-dlc PR review workflow — an intent-grounded two-axis review, then a summary comment + inline comments posted/updated on the current PR, with iteration-aware re-review.
 ---
 
 # /unic-dlc-pr-review
 
-Runs the `pr-review` box: composes a shared **Intent Brief** (from the linked work items, Confluence/MD
-docs, the PR description, and `PRD.md`), fans out **seven review aspects** as parallel fresh nodes
-(code-quality, test-coverage, silent-failure, type-design, comment-rot, code-simplification, and an
-intent/AC-coverage check), synthesises the findings, **reconciles them against the prior iteration**
+Runs the `pr-review` box: composes a shared **Intent Brief** (from the linked work items, the referenced
+docs pages, the PR description, and `PRD.md`), runs **one review node** that hosts the `code-review`
+Method's own **two-axis fan-out** — **Standards** (repo standards plus the twelve-item Fowler smell
+baseline) and **Spec** (the diff against the originating intent) — synthesises the findings,
+**reconciles them against the prior iteration**
 (new / still-present / fixed / regressed), and — after a config-gated human confirm — posts or updates a
 single structured **summary comment** plus **inline comments** on the current PR.
 
 Generic and **self-contained**: it harvests `unic-pr-review`'s review learnings (confidence rubric,
 structured summary, hidden-marker idempotency, conditional spawn table, two-surface posting) **without
-its ADO code and without any runtime dependency** ([ADR-0016](../../docs/adr/0016-dlc-thin-process-layer.md)/
+its host-specific code and without any runtime dependency** ([ADR-0016](../../docs/adr/0016-dlc-thin-process-layer.md)/
 [ADR-0017](../../docs/adr/0017-container-follows-structural-need.md)). Ported to the key-discriminated
 Archon node schema ([ADR-0011](../../docs/adr/0011-archon-schema-target.md)); design in
 [ADR-0026](../../docs/adr/0026-pr-review-generic-archon-harvest.md).
@@ -32,18 +33,24 @@ precondition** — intent is composed from whatever sources resolve.
 
 1. **bootstrap** — parse the slug from `$ARGUMENTS`, read `.archon/unic-dlc.config.yaml`
    (`artifacts_dir`, `gates.pr-review`, `pr-review.confidence_threshold`, `pr-review.inline_comments`,
-   `tracker.type`, `docs.*`, `project.branching`). Missing slug/config cancels cleanly.
+   `tracker.type`, `docs.*`, `project.branching`), and **derive the target repository** from the
+   worktree's `origin` remote (`project.repo_ref` is an optional override, absent by default). Missing
+   slug/config cancels cleanly; so does an ambiguous repository.
 
 2. **prep** — identify the open PR + its description; compute the diff and **categorise** the changed
-   files (for the spawn gates); compose **one Intent Brief** from the linked work items, Confluence/MD
-   docs, the PR body, and `PRD.md` (recording any **contradictions across sources**); and detect the
+   files (reported for context; the categories gate nothing); compose **one Intent Brief** from the linked work items, the referenced
+   docs pages, the PR body, and `PRD.md` (recording any **contradictions across sources**); and detect the
    **prior review iteration** by its hidden marker. Writes everything to `<artifacts_dir>/<slug>/pr-review/`.
 
-3. **7 aspect nodes** (parallel, fresh) — each reads the shared Intent Brief (**every aspect is
-   intent-grounded**) + the diff and emits findings scored on the **confidence rubric** (90–100 Critical
-   / 80–89 Important / 60–79 Minor / below the threshold dropped). **Spawn gates** run each aspect only
-   when meaningful: code-quality + intent-check always; tests/type-design/comment-rot/simplifier/
-   silent-failure gated on the changed-file categories.
+3. **review** (one node, fresh) — hosts the `code-review` Method's own two-axis fan-out. The Method
+   spawns its two sub-agents itself: **Standards** (repo standards + the twelve-item Fowler smell
+   baseline, pasted in full) and **Spec** (the diff against the originating intent). Both axes read the
+   shared Intent Brief, so **neither judges the diff without knowing what it was for**. Every finding is
+   scored on the **confidence rubric** (90–100 Critical / 80–89 Important / 60–79 Minor / below the
+   threshold dropped) and carries `aspect: "standards" | "spec"`. The two axes are aggregated, never
+   merged or reranked. This replaced seven hand-written aspect nodes and their spawn gates: re-implementing
+   the Method's own step 4 as Archon nodes is what [ADR-0030](../../docs/adr/0030-harness-hosts-methods.md)'s
+   structural bar forbids.
 
 4. **synthesize** — merge + dedupe this run's findings, bucket by severity, assemble the summary
    sections + Intent Check + "What's good".
@@ -58,8 +65,8 @@ precondition** — intent is composed from whatever sources resolve.
 7. **post** — post/update the **summary comment** (matched by the `<!-- unic-dlc-pr-review:iteration= -->`
    marker, never author identity) and, when `inline_comments` and the tracker supports inline threads,
    reconcile **inline comments** per finding (still-present → update, fixed → resolve, regressed →
-   reopen, new → create). Trackers without inline threads (jira / local-markdown) degrade to
-   summary-only.
+   reopen, new → create). A tracker whose registered skill cannot comment on a file and line degrades
+   to summary-only.
 
 ## Gates & AFK
 
@@ -72,7 +79,8 @@ checkpoint is `/qa`.
 
 - The current branch has an open PR (for the summary + inline comments).
 - `.archon/unic-dlc.config.yaml` is present (from `/unic-archon-dlc:setup`).
-- The configured tracker CLI/MCP is reachable (`gh` / `az` / `jira`, or the `azure-devops-cli` skill).
+- The system-skill registered under `tracker.access` is reachable.
+- The checkout has an `origin` remote, or `project.repo_ref` is set.
 - Archon ≥ 0.5.0.
 
 ## Configuration reference
@@ -86,8 +94,9 @@ Read from `.archon/unic-dlc.config.yaml`:
 | `pr-review.inline_comments`      | boolean      | `true`      | Post inline per-finding comments in addition to the summary (where supported)    |
 | `artifacts_dir`                  | string       | `workflows` | Session artefact home (`<artifacts_dir>/<slug>/pr-review/`)                      |
 | `tracker.*`                      | object       | —           | Composed to read the PR, work items, and post comments (MCP-first, CLI-fallback) |
-| `docs.*`                         | object       | —           | Composed to fetch Confluence/MD intent sources                                   |
+| `docs.*`                         | object       | —           | Composed to fetch the docs pages an intent source cites                          |
 | `project.branching`              | string       | `gitflow`   | `gitflow` → base `develop`; else `main` (for the merge-base diff)                |
+| `project.repo_ref`               | string       | _absent_    | Optional override; by default the repository comes from `origin`                 |
 
 ## Runs
 

apps/claude-code/unic-archon-dlc/.archon/commands/unic-dlc-qa.md

@@ -24,8 +24,10 @@ from), which `/build` implemented against.
 
 1. **bootstrap** — parse the slug from `$ARGUMENTS`, read `.archon/unic-dlc.config.yaml`
    (`artifacts_dir`, `gates.qa`, `qa.e2e_command ?? build.e2e_command`,
-   `qa.coverage_threshold ?? build.coverage_threshold`, `tracker.type`, `project.branching`), and
-   confirm `PRD.md` exists. Missing preconditions cancel cleanly with a "run /build first" message.
+   `qa.coverage_threshold ?? build.coverage_threshold`, `tracker.type`, `project.branching`), confirm
+   `PRD.md` exists, and **derive the target repository** from the worktree's `origin` remote
+   (`project.repo_ref` is an optional override, absent by default). Missing preconditions cancel
+   cleanly with a "run /build first" message; an ambiguous repository cancels with its own message.
 
 2. **e2e** — run the resolved e2e command; **skips with a warning** when none is configured. Reports a
    verdict (does not hard-fail).
@@ -43,7 +45,8 @@ from), which `/build` implemented against.
    second reject halts the run.
 
 6. **verify-pr-base** — confirm the open PR targets the expected base (`develop` on Gitflow, else
-   `main`), composing the tracker CLI/MCP. Reports `base_ok`.
+   `main`), composing the registered tracker system-skill and naming the derived repository
+   explicitly. Reports `base_ok`.
 
 7. **merge-gate → merge** — **HITL by default** (`gates.qa`); skipped in AFK. On approval (or in AFK)
    the PR is merged via the configured tracker and the feature branch is cleaned up on Gitflow. The
@@ -61,6 +64,7 @@ mismatched PR base blocks the merge even in AFK (fail-closed `when`).
 - `<artifacts_dir>/<slug>/PRD.md` exists.
 - `.archon/unic-dlc.config.yaml` is present (from `/unic-archon-dlc:setup`).
 - The current branch has an open PR targeting the base branch (for verify-pr-base + merge).
+- The checkout has an `origin` remote, or `project.repo_ref` is set.
 - Archon ≥ 0.5.0.
 
 ## Configuration reference
@@ -76,7 +80,8 @@ Read from `.archon/unic-dlc.config.yaml`:
 | `tracker.*`             | object       | —           | Composed for issue filing, PR-base check, and merge (MCP-first, CLI-fallback) |
 | `classification.labels` | object       | —           | Single source of truth for the labels QA findings carry                       |
 | `project.branching`     | string       | `gitflow`   | `gitflow` → base `develop` + branch cleanup; else base `main`                 |
-| `project.pr_strategy`   | string       | `squash`    | GitHub merge style: `squash` or `merge`                                       |
+| `project.pr_strategy`   | string       | `squash`    | Merge style: `squash`, `merge` or `rebase`                                    |
+| `project.repo_ref`      | string       | _absent_    | Optional override; by default the repository comes from `origin`              |
 
 ## Runs