I have a character who is always in disguise and I was wondering how that affected things. Does he have to reroll his check every day? Does someone he’s known for years have a bonus to seeing through the disguise he’s worn ever since they met?
Reroll only when conditions change.
In situations like this I've been served well by following The Angry GM's rule #3: "One Roll is Usually Enough (Unless Something Changes)".
In a mechanical sense, this isn't different than keeping watch at night (Spot and Listen checks) or sneaking through a noble's manor (Hide and Move Silently checks), both situations that I run into on a regular basis that are streamlined by just rolling once. Your player's character is practiced in the disguise and the charade of their false identity. When interacting with the same people in similar situations, the previous roll should stand.
When conditions change, such as picking up a heavy valuable object in the sneaking example above, rerolling the checks makes sense. For your scenario, I could see several changes that I feel like would prompt a reroll: if the PC has been surprised with unexpected personal information; or critical pieces of the disguise have been damaged and hastily replaced; or they are stressed by spotting an old contact that could out them.
For your lifelong friend NPC who has presumably already failed their Sense Motive check, the same deal applies. Something new would have to make them suspicious to give them a chance to figure it out.
How the Disguise skill works
The creature takes 1d3×10 min. to make a Disguise skill check to create the fictional identity. The Player's Handbook says that the DM on the creature's behalf secretly makes, for example, Decipher Script and Disable Device skill checks (71 and 72, respectively), but it doesn't mention the DM making on the creature's behalf secret Disguise skill checks (72–3) even though Rules Compendium does (67). Ask the DM.
However, since a Disguise skill check to create a disguise can't be failed and, instead, just be applied poorly (yielding a low result), if not under stress or threatened, the creature can opt simply to take 10 on the Disguise skill check. Alternatively, the creature could take 20d3×10 min. to take 20 on this Disguise skill check. (This DM would rule that if the creature want to benefit from a disguise kit (PH 128, 130) (50 gp; 8 lbs.) then taking 20 will expend 20 disguise kit uses, or two complete kits.) Once the disguise is applied and the Disguise skill check result established, the creature can test its efficacy:
- If the disguised creature remains relatively inconspicuous around folks who aren't suspicious of the creature, those folks don't make Spot skill checks to penetrate the creature's disguise. (The Player's Handbook says, "If you don't draw any attention to yourself, others do not get to make Spot checks" (72)).
- If the disguised creature remains relatively inconspicuous around suspicious folks—adventurers, guards on duty, PCs, etc.—then each of those folks usually takes 10 to make a Spot skill check (DC = the disguised creature's Disguise skill check result). Success means that the individual penetrates the disguised creature's disguise.
- If the disguised creature interacts obviously with folks, upon meeting the disguised creature each of those folks makes a Spot skill check (DC = the disguised creature's Disguise skill check result). Further, each hour that interaction continues between those folks and the disguised creature, each of those folks makes a Spot skill check (DC as above). Success means that the individual penetrates the creature's disguise.
- If the disguised creature interacts casually with a great many folks over the long term, the DM may make for all these folks—at the DM's whim either once per hour or once per day—one blanket Spot skill check (DC = the disguised creature's Disguise skill check result). The DM determines this Spot skill check modifier by taking the average Spot skill check modifiers of the folks with whom the disguised creature has interacted. Success here is undefined by the rules, yet this reader has always assumed it to mean at least one appropriate individual penetrated the disguised creature's disguise. (From a rules-as-written perspective, this also means that the disguised creature should try to bring down the average by ending each hour or day with a stroll past, like, the school for the blind.)
Note that the rules are unclear on what it means exactly when a creature penetrates a disguise. That is, the DM may rule—arbitrarily or consistently—that an onlooker that penetrates a disguise either knows only that the creature is in disguise or knows the creature's actual appearance. (This DM uses and recommends the former.)
"How long does a disguise last?"
The rules don't put a duration on a disguise. This means that a disguise lasts forever… or until the DM says it doesn't. For example, this DM has ruled that a disguise must be reapplied because so much time has passed since its initial application that the disguise's elements start to fail and can't just be touched up anymore (e.g. the creature's fake mustache is more spirit gum than horsehair). This DM makes such a ruling case-by-case, factoring in, for instance, the environment and the disguised creature's normal activities (e.g. a typical disguise will last longer in a neutral environment like the Underdark than it will in a desert or a jungle, a disguise that puts the creature in the role of a desk-driving scribe will likely see less abuse than a disguise that puts a short female human in the role of a tall male dwarf city patrolman assigned to the anti-lycanthrope unit).
Further, this DM has ruled that a catastrophic occurrence can wreck a disguise (e.g. the disguised creature dives head first into a lake, the disguised creature rolls a 1 on a saving throw against a fireball, the disguised creature is strip-searched). However, he has—depending on circumstances—provided the creature with a window in which to get to safety before the disguise fails completely and onlookers automatically penetrate the disguise (e.g. taking a cue from the Disguise skill, 1d3×10 min., rolled secretly by the DM).
That said, because taking 10 is an option and because a destroyed disguise is often extraordinarily significant, this player recommends that a creature play it safe and reapply a disguise daily and whenever one of those catastrophes befall the creature, whether or not the DM says specifically that the disguise will fail soon or is ruined outright. Nonetheless, if the creature doesn't bathe or perform acts of close-quarters violence or intimacy, a creature can probably get away with the same Disguise skill check result holding up for weeks or even indefinitely, although the creature'd eventually be awfully ripe and plenty filthy.
"Does a longtime associate gain a bonus on the Spot skill check to penetrate the disguise of a creature that's always been in disguise whenever the two've met?"
I can't find in the rules a reason why an associate that's only known a creature by its false identity would receive a bonus to the Spot skill check to penetrate the creature's disguise. Presumably, each time the two have met the associate's already making the appropriate Spot skill checks to penetrate the creature's disguise; to get a bonus would require the DM ruling that, for some reason, the associate gets a bonus.
I think that what might lead to this line of thinking is that the Disguise skill does say
If you are impersonating a particular individual, those who know what that person looks like get a bonus on their Spot checks according to [how familiar they are with the individual]. Furthermore, they are automatically considered to be suspicious of you, so opposed checks are always called for. (73)
Keep in mind, though, that here the scenario is not the creature disguising itself as an existing individual but, instead, as a new and wholly fictitious entity. While a longtime associate may, after years of interaction, finally penetrate the creature's disguise, if the associate hadn't been aware of the disguise prior, the associate may think that this creature's impersonating his longtime friend! And this impostor is trading on his friend's good name! And he should maybe secretly alert the city guard while he and the creature have tea!?
Really, this is a complicated enough scenario with disastrous enough consequences that game balance alone would see this DM rule that the associate doesn't get a bonus to penetrate the creature's disguise, even if the two've been buddies for decades.