Approach

The minimal-kernel phase: push capability out of Rust and into scripts so the CLI stops growing.

• commands::ontology — typed loader for ~/.config/forge/config.yaml with FORGE_* env precedence and project.yaml fallback (deprecation warning). forge config --json prints the resolved ontology with per-key source tracking.
• forge exec <skill> — runs a skill's bundled script by extension (.py→uv run PEP 723, .sh→bash, .ts→deno, .js→node), injecting FORGE_*/INPUT_* env, piping the --json object on stdin, and wrapping results as {ok, exit_code, stdout, structured} with optional outputSchema validation. --dry-run shows resolved argv + env.
• git-style dispatch — an unknown forge <verb> execs an external forge-<verb> from the module commands/ dir, config extension dirs, then PATH. Built-ins match first (can't be shadowed). New verbs are scripts, not Rust.

ADRs: CLI-0013 (unified config), CLI-0014 (exec contract), CLI-0015 (git-style dispatch).

Adversarial review (self, cross-harness pass)

Reviewed the two arbitrary-code-execution surfaces. Findings fixed in this PR:

• Path traversal in forge exec --script / skill script: (skill_dir.join escaping via ../absolute) — now canonicalized and asserted within the skill dir.
• Verb/skill name traversal — verb and skill names with path separators are rejected.
• INPUT_* injection is safe by construction (INPUT_ prefix + non-alphanumeric sanitization; can't override PATH/LD_PRELOAD).

Known/accepted (documented): repo-local commands/forge-* execute without a trust gate when you cd into a repo, like a Makefile; matches the extend-freely design and built-ins can't be shadowed. Candidate for a future forge trust gate.

Test plan

• cargo fmt --check; clippy -D warnings; cargo test (incl. traversal-guard tests)
• functional smokes: forge config --json; forge hello external dispatch; unknown-verb clean error; forge exec .sh round-trip with INPUT_* + structured output; --dry-run
• CI matrix

🤖 Generated with Claude Code