This is an infrastructure-only change: it moves workflow_dispatch inputs out of shell interpolation into environment variables, validates the case slug and verb against a closed list, passes CLI arguments as a quoted array, and threads the dispatching GitHub login through to the run record. No content/ files are touched and the citation tooling found no identifiers to check. AGENTS.md is not edited, so §3.15's reservation is not engaged. Far from weakening a check, it adds one: `scripts/aletheia.ts` now refuses a forced case unless `--dispatcher` matches `githubLogin` in config/founder.yaml, and `src/pipeline/next.ts` makes the recorded reason distinguish a workflow dispatch naming a login from a terminal dispatch that claims no dispatcher — an improvement in provenance honesty (§3.14, §3.15) rather than a misattribution. The DECISIONS.md entry accurately describes the diff (env vars, slug check, verb allowlist, dispatcher check, reason text) and is stamped with date and channel, consistent with the founder-direction provision of §3.15. The test update matches the new reason strings for both the named-dispatcher and terminal cases.

The new provenance string invents an execution origin: when `force.by` is absent, `chooseNext` unconditionally records that the choice was dispatched “at the operator's terminal,” although absence of `--dispatcher` does not establish that fact. The CLI also makes `--dispatcher` optional, so any invocation with `--case` can bypass the founder-login check merely by omitting that flag, while still producing the asserted terminal provenance. This conflicts with exact provenance and leaves the advertised authorization check avoidable. Require an authenticated dispatcher for forced choices, or carry an explicit, verified origin value and use a neutral “dispatcher not recorded” label when origin is unknown.

The change hardens workflow dispatch inputs against shell injection, validates case slugs and verb parameters, and enforces that forced runs passing a dispatcher match the founder's GitHub login recorded in config/founder.yaml. Provenance stamping in pipeline/next.ts is made more exact by distinguishing between operator terminal dispatches and workflow dispatches by the founder login, aligning with §3.8 and §3.14. No constitutional text in AGENTS.md was altered and no checks were weakened.

The diff hardens the chain workflow and CLI against unquoted shell splicing of workflow_dispatch inputs, validates case slug and verb, requires --dispatcher to match config/founder.yaml githubLogin when forcing a case, and stamps the forced-choice reason with that login or an explicit terminal path. No AGENTS.md edit, no content/citation fabrication, no confidence material, and the DECISIONS.md entry records a founder-supervised fix that tightens rather than weakens §3.15 checks. Tests and VALUE_FLAGS cover the new flag; omitted files and runs are none.

This is a workflow/CLI hardening change with no content, citations, or run records, so the fabrication and confidence rules are not engaged. It does not touch AGENTS.md, and far from weakening §3.15's checks it strengthens them: dispatch inputs no longer reach the shell by interpolation, the case must match a strict slug pattern, the verb is restricted to three values, and a forced first choice through workflow_dispatch now requires the dispatcher's GitHub login to equal the login recorded in config/founder.yaml before anything runs — closing exactly the gap review note #290 identified. The provenance change in next.ts makes the reason string more honest, naming the actual dispatcher (validated against founder.yaml) or explicitly saying the dispatch came from the operator's terminal, rather than the vague 'dispatched by hand'. The DECISIONS.md entry is stamped with date and channel ('direction in session, 2026-09-16') consistent with the founder-amendment recording rule, and nothing in the visible material contradicts it. I cannot independently verify the session direction or review note #290, but the diff shows no internal inconsistency, no invented locator, and no reclassification to dodge a check.