[Spec 1134] afx whoami + ship /arch-init command (multi-architect identity)

.claude/skills/afx/SKILL.md

@@ -121,6 +121,19 @@ afx status                      # Show all builders and workspace status
 
 No flags needed. Shows Tower status, workspace, and all active builders.
 
+## afx whoami
+
+```bash
+afx whoami                      # Report this terminal's identity (workspace, type, name)
+afx whoami --json               # Same, as a single JSON object
+```
+
+Resolves identity from Tower/global.db's perspective: builder-worktree cwd
+match first, then the Tower-injected `CODEV_ARCHITECT_NAME` env var. Exits 1
+with an explanation when identity cannot be determined — it never guesses and
+never defaults to `main` (issue #1094). Builders also get an `architect:`
+field naming their spawning architect when recorded. Works without Tower.
+
 ## afx tower
 
 ```bash

.claude/skills/arch-init/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: arch-init
+description: Adopt an architect identity and recover its state from codev/state/<name>.md. Use when an architect terminal needs to (re)establish which architect it is — after a restart, context loss, or session handoff — or when the user says "/arch-init", "you are the X architect", or "recover your architect state". Identity resolves via `afx whoami` (an explicit name argument overrides); if neither resolves, ask the human — never guess.
+argument-hint: "[name]   (e.g. main; omit to auto-detect via afx whoami)"
+---
+
+# /arch-init — become architect `<name>` and recover state
+
+You are an **architect agent** in a codev workspace. This command tells you
+which architect you are and where your durable state lives, so you can resume
+mid-stream.
+
+`$ARGUMENTS` is the architect name (e.g. `main`, or a sibling architect's
+name in a multi-architect workspace).
+
+## What to do
+
+1. **Resolve your name.**
+   - If `$ARGUMENTS` is non-empty, that is your name — the human named you
+     explicitly, which removes all identity-resolution risk. **Validate it
+     first**: an architect name must match `[a-z][a-z0-9-]*` and be at most
+     64 characters (lowercase letters, digits, hyphens; starts with a
+     letter). Reject anything else — slashes, `..`, uppercase, spaces — and
+     tell the human the rule. Never build a file path from an unvalidated
+     name (path-traversal guard).
+   - If `$ARGUMENTS` is empty, run `afx whoami` and read its output:
+     - `type: architect` → adopt the reported `name`.
+     - `type: builder` → STOP. This terminal is a builder, not an architect;
+       report the mismatch to the human and do not adopt an architect
+       identity.
+     - Non-zero exit (identity unknown) → STOP and ask the human which
+       architect you are. Do NOT guess, and do NOT default to `main` —
+       adopting the wrong identity and writing to another architect's state
+       file is the exact failure this command exists to prevent.
+
+2. **Read your state file: `codev/state/<name>.md`** (relative to the
+   workspace root).
+   - If it does not exist: list the architect state files in `codev/state/`
+     — **excluding `*_thread.md` files**, which are builder thread logs that
+     share the directory — tell the human the file is missing, and ask
+     whether to start a fresh state file for `<name>`. Do not fabricate
+     state.
+   - The state file is authoritative free text. It typically opens with a
+     role banner and may carry resume instructions; follow whatever it says.
+
+3. **Confirm identity + orient, then follow the state file.** In one tight
+   block, report: who you now are (name + one-line role from the banner, if
+   present), the file you read, and the current-state / open-loops summary
+   from the most recent dated section (or the file's leading content if it
+   has no dated sections). Then carry out whatever the state file says to do
+   on resume. Do not invent a new agenda — resume the one the state file
+   describes.
+
+## Guardrails (architect-wide; the state file may add more)
+
+- **Never auto-approve porch gates.** A gate notification is for the human,
+  not you.
+- **Touch only your own builders / spawns / filings.** Sibling architects own
+  theirs.
+- **Never `cd` into a builder worktree**; use `git -C` + absolute paths.
+- **Stay on the default branch at the workspace root**; verify with
+  `git branch` if unsure.

codev-skeleton/.claude/skills/afx/SKILL.md

@@ -99,6 +99,19 @@ afx status                      # Show all builders and workspace status
 
 No flags needed. Shows Tower status, workspace, and all active builders.
 
+## afx whoami
+
+```bash
+afx whoami                      # Report this terminal's identity (workspace, type, name)
+afx whoami --json               # Same, as a single JSON object
+```
+
+Resolves identity from Tower/global.db's perspective: builder-worktree cwd
+match first, then the Tower-injected `CODEV_ARCHITECT_NAME` env var. Exits 1
+with an explanation when identity cannot be determined — it never guesses and
+never defaults to `main` (issue #1094). Builders also get an `architect:`
+field naming their spawning architect when recorded. Works without Tower.
+
 ## afx tower
 
 ```bash

codev-skeleton/.claude/skills/arch-init/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: arch-init
+description: Adopt an architect identity and recover its state from codev/state/<name>.md. Use when an architect terminal needs to (re)establish which architect it is — after a restart, context loss, or session handoff — or when the user says "/arch-init", "you are the X architect", or "recover your architect state". Identity resolves via `afx whoami` (an explicit name argument overrides); if neither resolves, ask the human — never guess.
+argument-hint: "[name]   (e.g. main; omit to auto-detect via afx whoami)"
+---
+
+# /arch-init — become architect `<name>` and recover state
+
+You are an **architect agent** in a codev workspace. This command tells you
+which architect you are and where your durable state lives, so you can resume
+mid-stream.
+
+`$ARGUMENTS` is the architect name (e.g. `main`, or a sibling architect's
+name in a multi-architect workspace).
+
+## What to do
+
+1. **Resolve your name.**
+   - If `$ARGUMENTS` is non-empty, that is your name — the human named you
+     explicitly, which removes all identity-resolution risk. **Validate it
+     first**: an architect name must match `[a-z][a-z0-9-]*` and be at most
+     64 characters (lowercase letters, digits, hyphens; starts with a
+     letter). Reject anything else — slashes, `..`, uppercase, spaces — and
+     tell the human the rule. Never build a file path from an unvalidated
+     name (path-traversal guard).
+   - If `$ARGUMENTS` is empty, run `afx whoami` and read its output:
+     - `type: architect` → adopt the reported `name`.
+     - `type: builder` → STOP. This terminal is a builder, not an architect;
+       report the mismatch to the human and do not adopt an architect
+       identity.
+     - Non-zero exit (identity unknown) → STOP and ask the human which
+       architect you are. Do NOT guess, and do NOT default to `main` —
+       adopting the wrong identity and writing to another architect's state
+       file is the exact failure this command exists to prevent.
+
+2. **Read your state file: `codev/state/<name>.md`** (relative to the
+   workspace root).
+   - If it does not exist: list the architect state files in `codev/state/`
+     — **excluding `*_thread.md` files**, which are builder thread logs that
+     share the directory — tell the human the file is missing, and ask
+     whether to start a fresh state file for `<name>`. Do not fabricate
+     state.
+   - The state file is authoritative free text. It typically opens with a
+     role banner and may carry resume instructions; follow whatever it says.
+
+3. **Confirm identity + orient, then follow the state file.** In one tight
+   block, report: who you now are (name + one-line role from the banner, if
+   present), the file you read, and the current-state / open-loops summary
+   from the most recent dated section (or the file's leading content if it
+   has no dated sections). Then carry out whatever the state file says to do
+   on resume. Do not invent a new agenda — resume the one the state file
+   describes.
+
+## Guardrails (architect-wide; the state file may add more)
+
+- **Never auto-approve porch gates.** A gate notification is for the human,
+  not you.
+- **Touch only your own builders / spawns / filings.** Sibling architects own
+  theirs.
+- **Never `cd` into a builder worktree**; use `git -C` + absolute paths.
+- **Stay on the default branch at the workspace root**; verify with
+  `git branch` if unsure.

codev-skeleton/resources/commands/agent-farm.md

@@ -237,6 +237,65 @@ Status values:
 
 ---
 
+### afx whoami
+
+Report this terminal's agent identity — workspace, type, and name — from
+Tower/global.db's perspective.
+
+```bash
+afx whoami
+afx whoami --json
+```
+
+**Description:**
+
+Resolves who the current terminal's agent is. Identity precedence:
+
+1. **Builder worktree** — when CWD is inside `.builders/<id>/`, the canonical
+   builder id is verified against `global.db` (the same resolution `afx send`
+   uses). An unverifiable worktree identity is an error, never a fallthrough
+   to the next signal.
+2. **`CODEV_ARCHITECT_NAME`** — the env var Tower injects into architect
+   terminals.
+3. **Unknown** — exits non-zero with an explanation. There is no implicit
+   fallback to `main` (issue #1094: unverified identities misroute messages).
+
+Works without Tower running (reads `global.db` read-only).
+
+**Example output (architect terminal):**
+
+```
+workspace: codev
+type: architect
+name: main
+```
+
+**Example output (builder worktree):**
+
+```
+workspace: codev
+type: builder
+name: builder-spir-984
+architect: main
+```
+
+The `architect:` line is the builder's spawning architect; it is omitted when
+not recorded (legacy rows).
+
+**JSON output:**
+
+```bash
+afx whoami --json
+# {"workspace":"codev","type":"builder","name":"builder-spir-984","architect":"main"}
+```
+
+On failure, `--json` prints `{"error":"..."}` to stdout (the human-readable
+explanation still goes to stderr) and exits 1.
+
+**Exit codes:** `0` identity resolved; `1` identity unknown or unverifiable.
+
+---
+
 ### afx cleanup
 
 Clean up a builder worktree and branch.