@agentsfleet/orly 0.10.4 → 0.10.6

package/dispatch/lifecycle.md

@@ -12,55 +12,108 @@ are entering, not the whole file.
 
 ## What runs at each stage
 
-The mechanical half of the lifecycle, in one table. Everything in the "runs"
-column is a command, not a claim — `orly gate` reads the repository's declared
-`.oracle/orly.json` commands and never invents one.
+This is the authoritative sequence. Commands come from the repository's
+`.oracle/orly.json`; the engine contains no product-specific build recipes.
 
-| Stage | Runs | Fired by |
+| Stage | Runs | Owner |
 |---|---|---|
-| CHORE(open) | the declared `verify.unit` once, to record `Test Baseline:` | the agent |
-| PLAN | nothing — no file mutations | — |
-| EXECUTE | the dispatch façade for each edited file type; DOC READ recorded via `audits/doc-read.sh log` | the agent, and the runtime's read hook where it has one |
-| CONFORM | the declared `conform` command | `orly gate work` — the generated pre-commit hook |
-| VERIFY (Section) | `conform` plus the declared lane covering the surface touched | the agent |
-| VERIFY (milestone) | the fast `verify.*` set: lint, unit, version | `orly gate verify` — the generated pre-push hook |
-| REVIEW | gstack `/review` over the diff | the agent |
-| DOCUMENT | nothing mechanical | — |
-| COMMIT | `conform` again, on the staged tree | the pre-commit hook |
-| CHORE(close) | every spec criterion, branch shape, clean tree, pushed branch, docs surface, and the slow `verify.*` suites | `orly gate pr`, by hand, before `gh pr create` |
-| LAND | nothing gated | — |
-
-Three properties hold this together. A gate only asks what it can answer
-honestly at that moment: `work` judges no git state, because a commit hook's
-tree is dirty by construction and a new spec is committed on the default branch.
-Each tier runs once per cadence — `conform` at commit, the fast set at push, the
-slow set at the close. And `orly gate pr` can skip the fast set because
-`git.pushed` proves HEAD is the commit pre-push already graded.
+| CHORE(open) | Record the comparison commit and pending baseline; create the tree, carry owned changes, commit metadata | Agent; commit hook still runs |
+| PLAN | Resolve references, scope, decisions, and proof mapping; no application build | Agent |
+| EXECUTE | Read triggered rules; implement one Section and its tests | Agent |
+| First Section verification | Hydrate only the touched surfaces; format, lint, and execute Section proofs | Agent |
+| Later Section verification | Reuse the tree; repeat affected formatting, lint, and proof commands | Agent |
+| COMMIT | Declared `conform` over staged changes | `orly gate work` in pre-commit |
+| Push | Documentation check and declared non-test verification commands | `orly gate verify` in generated pre-push |
+| Before PR | Measure the comparison revision's unit and integration lanes; review results and fix final-branch failures | Agent |
+| CHORE(close) | Branch and spec criteria, exact upstream revision, every declared `verify.*` command | `orly gate pr` |
+| LAND | Pull and clean up the merged stream | Agent after merge |
+
+`verify.unit`, `verify.integration`, and `verify.memory` belong to the PR
+boundary. Other `verify.*` commands also run at push and are checked again at
+that independent boundary. Full suites run once per PR-gate invocation;
+failures or later changes require a new invocation. No verification cache is
+kept, and a custom hook cannot silently remove final verification.
+`conform` remains the commit hook's responsibility because it may read the
+index. A bare `orly gate` runs all groups and stops at the first red group.
+
+Formatting and lint do not prove behavior. A Section is complete only when its
+Dimensions have passing proofs. Use existing repository test lanes; if a lane
+runs a whole workspace, describe it honestly and add a supported filter to that
+recipe when narrower Section checks are needed. Boundary commands remain
+unfiltered. Rust projects run `cargo fmt` in their Rust workspace, followed by
+the declared lint wrapper covering Clippy and the shipping build configuration.
+Other languages use their own declared formatter and lint commands.
 
 ## CHORE (open) — runbook
 
 1. Spec `docs/v*/pending/` → `active/`; `Status: IN_PROGRESS`; `Branch:` set.
-2. **Test Baseline** — run the repository's declared `verify.unit` (and
-   `verify.integration` where declared) from `.oracle/orly.json`; copy the
-   reported counts into the spec header as `**Test Baseline:** unit=<N>
-   integration=<M>` (VERIFY's Test Delta row compares against it; a product
-   pack may name a dedicated counter — see the product block below).
-3. Create the worktree; verify CWD is inside it (`pwd` + `git worktree list`).
+2. **Test Baseline** — record `**Baseline revision:** <full commit>` and
+   `**Test Baseline:** pending — measured before the Pull Request`. Run no
+   application suite at opening. Before the PR, obtain both declared baseline
+   lanes (`verify.unit` and `verify.integration`) for that exact revision from
+   matching successful run evidence or an isolated checkout of that revision.
+   Never assume the default checkout stayed at the comparison commit. Keep
+   baseline and final integration environments separate; neither may reset a
+   shared deployment. Record passed, failed, and skipped counts per lane in a
+   report, with commands, revision, and environment; put totals in the header
+   and the report path or run URL in `**Baseline evidence:**`.
+   A missing or failed baseline run is recorded honestly; fix failures in the
+   implementation branch and keep the historical result unchanged. Baseline
+   failures never permit final failures. Compare like-for-like lanes and report
+   added, removed, or changed test selections rather than inventing a delta.
+   `n/a — <reason>` is valid only when there is no code or no baseline lane.
+   The gate validates counts, revision ancestry, and the evidence reference;
+   the agent reviews the report's contents. Performance baselines required by
+   a spec remain due before the changes they measure.
+3. Create the worktree and carry the base checkout's uncommitted work into it;
+   verify CWD is inside it (`pwd` + `git worktree list`).
 4. Commit the four steps on the feature branch. No code until the commit lands.
 
+**The base checkout's uncommitted work moves with the stream.** A worktree cut
+from a dirty base strands that work on the default branch, where it is neither
+committed, nor reviewed, nor in the tree the stream is about to gate — and the
+next `git status` there reads as drift nobody owns. So step 3 moves it, before
+any spec edit:
+
+```bash
+git -C <base> status --porcelain -uall            # nothing? the step is a no-op
+git -C <base> stash push --include-untracked -m "chore(open): <branch>"
+git -C <worktree> stash pop
+```
+
+`git stash` is per-repository, not per-worktree, so the entry the base pushes is
+the entry the worktree pops. **Move, never copy** — work left in both places is
+committed twice and conflicts on the merge. Name what came across in the
+CHORE(open) report; a carry-over nobody announced is indistinguishable from
+scope that wandered in. A pop that conflicts KEEPS the stash: stop there and
+resolve before step 4, because a half-applied carry-over is worse than a dirty
+base. Work that does not belong to this stream is the one exception — leave it,
+and say so.
+
 <!-- oracle-packs:start product.agentsfleet -->
 ## Worktree recipe (agentsfleet)
 
-`git checkout main && git branch feat/mNN-name && git worktree add ../agentsfleet-mNN-name feat/mNN-name && cd ../agentsfleet-mNN-name && bun install && (cd cli && bun install && bun run build)`.
-The root `bun install` hydrates the workspace (`ui/packages/*`); `cli/` is its
-own Bun project needing install + build. `git worktree add` fires
-`.githooks/post-checkout` → symlinks `~/.config/agentsfleet/{ui,runner}.env.local`
-into the tree; on 🟠 run `provision-env-1password`, re-link. Post-merge:
-`git worktree remove ../agentsfleet-mNN-name`.
-
-**Test Baseline counter.** A repository whose declared `verify.unit` does not
-print a total names its own counter here. Without one, record the count the
-declared command reports.
+```bash
+cd ~/Projects/agentsfleet && git checkout main
+git status --porcelain -uall     # dirty? carry it over — the two stash lines below
+git stash push --include-untracked -m "chore(open): feat/mNN-name"
+git branch feat/mNN-name
+git worktree add ../agentsfleet-mNN-name feat/mNN-name
+cd ../agentsfleet-mNN-name && git stash pop
+```
+
+Omit stash operations when the base is clean. Identify the saved stash entry
+explicitly when other streams exist, restore its staged state, and remove only
+that entry after successful restoration. Leave changes owned by another stream
+in place and report them. No application installation or build runs here.
+`git worktree add` may run the repository's cheap environment-link hook.
+
+At first Section verification, install dependencies for the surfaces being
+verified: root `bun install` for the JavaScript workspace; `cli/` has its own
+install and build. Rust checks run from `rustd/` using `make lint-rustd` after
+`cargo fmt`. The first compilation resolves Rust dependencies; later Sections
+reuse the build artifacts. Missing environment links follow the repository's
+provisioning instructions before a check that needs them.
 
 **agentsfleet CHORE(close) paths:** the `<Update>` lands in
 `~/Projects/docs/changelog.mdx` (template + version-bump matrix:
@@ -99,8 +152,9 @@ into a separate tree.
   guesses `surfaces`.
   First session in a repository whose config is still that seed:
   1. Read the build files properly. Fill every `verify.*` the repository really
-     has — the tiering is fixed (`conform` + `verify.unit` are the fast tier,
-     every other `verify.*` is slow and skips on prose-only branches).
+     has — the gate ownership is fixed: `conform` at commit, non-test checks at
+     push, all `verify.*` at the PR boundary; only integration and memory
+     skip on branches with no code.
   2. Set `surfaces.user` and `surfaces.docs` to real path prefixes, or the docs
      gate can never fire and a user-visible change ships undocumented.
   3. Add any opt-in pack the repository's own sources cannot imply
@@ -108,8 +162,10 @@ into a separate tree.
      `orly update` so they materialise.
   4. Commit it. Every teammate and every later session reads this file, and
      `orly` never rewrites it — so an edit here is permanent.
-  A seeded-but-uncompleted config is why `orly gate` reports a repository with
-  no declared commands: the fix is this list, not another `orly init`.
+  Setup requires `conform` and at least one named `verify.*` command.
+  A documentation repository can declare `verify.docs` for its site and link
+  checks without application unit or integration suites. `init` reports
+  missing commands; `doctor` and the gates reject incomplete setup.
 - **Priming:** (1) Human runs `playbooks/founding/01_bootstrap/001_playbook.md`.
   (2) Agent runs `./playbooks/founding/02_preflight/00_gate.sh` (green before
   next). (3) Agent runs `playbooks/founding/03_priming_infra/001_playbook.md`.

package/dispatch/verify.md

@@ -25,58 +25,40 @@ Only when a target is genuinely unrunnable (e.g. Docker missing for integration
 tests). Surface the limitation in the done message — never dress a skip as "tests
 pass".
 
-## Why `make` is canonical
+## Repository commands are canonical
 
-Package-scoped runners (`bun run test`, `vitest <file>`, `cargo test -p <crate>`)
-are **not** verification — they skip every other package's lint and tests and the
-cross-language gates. The declared `make` targets are the canonical gates.
+The commands in `.oracle/orly.json` define full verification. Use repository
+Make targets where declared; a repository may also declare its native tools
+directly. A narrower package run never substitutes for a declared full check.
+Documentation repositories may use `verify.docs` for site and link checks;
+application test suites are required only when the repository declares them.
 
 ## Two cadences, one boundary
 
-"Always" is not a cadence. A Section closing and a milestone closing are
-different claims, and running the whole declared set at both spends the
-wall-clock of the comprehensive tier to answer a question the scoped lane
-already answered.
-
-The gates match those cadences: `orly gate work` runs the declared `conform`
-alone (every commit, seconds), `orly gate verify` runs the fast `verify.*` set
-(every push), and `orly gate pr` runs the whole-branch criteria and the slow
-suites (the close). Each tier runs once per cadence.
-
-**Section lane (per Section, and per done-claim inside one).** `make
-harness-verify` — the declared `conform`, seconds — plus the lane that covers
-the surface the Section touched (`make test-unit-rustd`, `make test-unit-app`,
-…). This proves a Section. It is not a repository claim and never satisfies a
-VERIFY row on its own.
-
-**Milestone boundary (once, at CHORE(close), before the PR).** Every command
-`.oracle/orly.json` declares, in one pass: `conform`, `verify.lint`,
-`verify.unit`, `verify.version`, and the slow tier (`verify.integration`,
-`verify.memory`). This is the repository claim, and it is what the done-message
-below reports.
-
-Run `orly gate pr` at the close. It does not re-run the fast tier, and it does
-not need to: its own `git.pushed` criterion proves HEAD is exactly the commit
-the pre-push `orly gate verify` already graded. A bare `orly gate` chains all
-three gates — use it on a branch whose earlier gates never ran.
-
-| Target | When |
-|---|---|
-| `make harness-verify` | Section lane and boundary. The declared `conform` — the deterministic gate audit. |
-| `make lint-all` | Boundary. The declared `verify.lint`. |
-| `make test-unit-all` | Boundary. The declared `verify.unit` — the cargo workspace plus every package coverage gate. |
-| `make check-version` | Boundary. The declared `verify.version`. |
-| `make test-integration-rustd` | Boundary. The declared `verify.integration` — live Postgres and Redis; `orly gate pr` skips it on a branch carrying no code. |
-| `make wire-fixtures` | The `/v1/runners` wire types changed. Regenerate, then review the diff — a changed fixture IS the wire change. |
-| `make bench` (local) | Diff touches request-path code, allocator wiring, or startup/shutdown sequencing. |
-| `API_BENCH_URL=https://api-dev.agentsfleet.net/healthz make bench` | After branch deploys to dev. |
-| `/orly-write-integration-test` (skill) | With `/orly-write-unit-test` at VERIFY when the diff crosses module boundaries with real I/O; otherwise record `N/A — <reason>`. |
-| Acceptance e2e (live tier) | Diff touches a surface the live/acceptance tier covers — relevant suites green, or their opt-in skip matrix recorded. |
-
-The declared set in `.oracle/orly.json` is the source of truth for what exists,
-and a lane listed there is a lane that runs at the boundary — including the slow
-tier. A package-scoped runner (`cargo test -p afd_wire`, `bun run test` inside a
-package) proves that package and never the repository, at either cadence.
+The command ownership and chronological sequence live in
+`dispatch/lifecycle.md` §What runs at each stage. Read that table before
+verification; this page defines what counts as evidence.
+
+- **Section proof:** format, lint, and run the tests covering the changed
+  Dimensions. Hydrate the required application dependencies at the first
+  Section verification, then reuse that worktree. Passing lint alone never
+  marks a behavior DONE.
+- **Baseline:** before the Pull Request, measure the recorded comparison
+  revision's declared unit and integration lanes. Keep commands, counts, and
+  output in an evidence report. Compare equivalent selections; explain removed
+  tests. A historical failure never exempts the final branch.
+- **Final verification:** `orly gate pr` runs every declared `verify.*` command
+  itself. It does not infer success from a pushed branch or an installed hook.
+  Capture full command output and the decisive counts, not only exit codes.
+  Custom hooks may run additional checks but cannot replace the final gate.
+- **Repeat only for cause:** a failure or a subsequent change invalidating the
+  result requires a rerun. Run the final gate once per candidate; do not also
+  launch its full suites manually as an unrecorded duplicate.
+
+Use repository-owned Make targets where declared. A narrower package run is
+Section evidence only, never a substitute for the full declared boundary.
+When a diff crosses a module boundary with real input/output, apply
+`orly-write-integration-test`; otherwise record why it does not apply.
 
 ## Wire-fixture evidence rule
 

package/dispatch/write_spec.md

@@ -1,91 +1,65 @@
-# write_spec.md — spec-authoring dispatch (LATENT façade)
+# Spec authoring
 
-This is the prose the AGENT reads **before writing or editing a spec** under
-`docs/v*/{pending,active,done}/`. It pairs with the deterministic half
-`audits/spec-template.sh`, which runs in `make lint`. (This is the former Spec Template gate absorbed into
-the dispatch model — `docs/TEMPLATE.md` remains the canonical section source.)
+Read this before editing a spec under `docs/v*/{pending,active,done}/`, or
+`docs/TEMPLATE.md`. The template defines the document shape. The authoring skill
+fills it; the audit checks structural consistency. None proves design quality.
 
-**Signal legend:**
+## What must be ready, and when
 
-- 🟢 / 🔴 — `audits/spec-template.sh` mechanically passes/fails the prohibited-pattern and
-  required-section checks.
-- 🤔 DECIDE — whether a required section is *meaningfully filled* (not just
-  present) is the agent's judgment at author time.
+| Stage | Required content |
+|---|---|
+| Authoring | Goal, scope, existing references, decisions and prerequisites, Dimensions with test mappings, failures, interfaces, and acceptance checks |
+| CHORE(open) | Active status, branch, full comparison revision, baseline measurement pending |
+| PLAN | Implementer's comprehension handshake; resolved scope and decisions needed by the next Section |
+| Before Pull Request | Declared unit/integration baseline counts, comparison revision, and evidence reference |
+| Completion | Passing behavior proofs, final repository checks, and any required human evidence |
+
+The sequence and hydration timing live in `dispatch/lifecycle.md`. A preparation
+Section may establish inputs for later Sections when the spec states its output
+and who may decide it. A required human sign-off remains a human dependency.
+
+## Mechanical checks
+
+`audits/spec-template.sh` is the entry point; its Bun helper
+`audits/spec-template.ts` reads headings, lists, and tables from the runtime's
+parsed Markdown tree. Code examples and quoted headings cannot supply sections.
+
+- Prohibited authoring estimates, ownership labels, and completion percentages.
+- Required sections with content, known placeholder residue, and the spec length cap.
+- Existing repository files or URLs in the read-first list. Planned CREATE files
+  belong in Files Changed, not in the existing-reference list.
+- Each Dimension names a proof and has a matching tiered Test Specification row
+  with an assertion. Duplicate identifiers and orphan test rows fail.
+- The rubric's Verify cells contain the exact declared `conform` and `verify.*`
+  commands, with Expected values. Include conditional suites; the final gate
+  decides their applicability from the actual branch diff. Additional
+  spec-specific commands and explicitly named manual checks remain valid.
+
+`--staged` reads spec contents, configuration, and local references from the Git
+index. `--file <path>` checks the working copy. Missing runtime or configuration
+fails these readiness checks. Bulk `--all` and `--include-done` scans retain
+prohibited-pattern checks only; they do not retrofit historical documents.
+
+## Author review
+
+Check that required content is meaningful, prerequisites are attainable, failures
+are tested, and the acceptance checks prove the goal. A structural pass does not
+mean the feature is implemented. Use `manual` for a human proof; record its
+procedure, required person, and durable evidence without inventing sign-off.
+
+Use `{{fill:description}}` for authoring slots. Delete them and all `tpl:`
+guidance before staging. Runtime parameters such as `/items/{id}` are allowed
+when the spec defines them. Lifecycle-owned values use explicit pending text,
+not unfilled authoring slots. Existing specs follow current rules; examples do
+not override them.
 
-## Trigger — every Edit/Write to
+**Override:** `SPEC TEMPLATE GATE: SKIPPED per user override (reason: ...)`.
+User-invokable only; an external constraint must explain the exception.
 
-- Any spec under `docs/v*/{pending,active,done}/**/*.md`.
-- `docs/TEMPLATE.md` itself.
-- Any `*.md` whose body carries the spec frontmatter pattern (`^**Milestone:** M\d+`).
+## Required output
 
-**Override:** `SPEC TEMPLATE GATE: SKIPPED per user override (reason: ...)`.
-**User-invokable only.** Auto-mode does NOT cover it; reasons must cite a concrete
-external constraint (vendor doc requirement, regulatory format), never internal
-preference.
-
-## What this covers
-
-**Family 1 — prohibited patterns (negative space).** `docs/TEMPLATE.md`
-"Prohibited" forbids: time/effort estimates, effort columns, complexity ratings,
-percentage-complete fields, assigned owners, implementation dates. Specs created
-from the template don't carry the Prohibited section forward — only the body
-below the divider gets copied — so without enforcement these drift back in.
-
-**Family 2 — required-present + no-placeholder (positive space).** The
-agent-facing template mandates the determinism sections the executing agent reads
-to emit invariant output: PR Intent & comprehension handshake, Applicable Rules,
-Applicable Gates, Overview, Prior-Art / Reference Implementations, Files Changed,
-Decomposition & alternatives, Sections, Metrics & Observability, Interfaces,
-Failure Modes, Invariants, Test Specification, Acceptance Rubric (legacy heading `Acceptance Criteria` accepted), Product Clarity (authoring record), Discovery. A spec missing one — or
-leaving template residue (`path/to/file.ext`, `test_<short_name>`,
-`{one-line reason}`, any surviving `tpl:` guidance comment — the template's fill
-grammar deletes them all at authoring) — forces the agent to guess intent.
-
-**Family 2b — declared-command parity.** A staged `pending/` or `active/`
-spec's Acceptance Rubric must quote the repository's declared `conform` and
-`verify.unit` commands (`.oracle/orly.json`) **verbatim** — the same set
-`orly gate` runs, so the rubric and the mechanical PR gate grade one boundary.
-Missing → BLOCK. No config, no bun, or no declared commands → NOTE + skip.
-Done specs are historical records and are never retrofitted.
-
-**Scope (no legacy carve-out).** Family 2 fires in `--staged` only — the spec
-being authored now (the agent's own output): BLOCK. Bulk scans (`--all` /
-`--include-done`, which `make harness-verify` runs) execute Family 1 only, so they
-behave identically over the corpus and never break an existing spec.
-
-## Pre-edit check
-
-| Pattern | Rule |
-|---|---|
-| `## Estimated effort` (any heading variant) | Forbidden. Delete the section. |
-| `## Effort` / `## Complexity` / `## Sizing` | Forbidden. Use Priority. |
-| `\b\d+\s*[-–]\s*\d+\s*h\b` (hour ranges like "10-14h") | Forbidden. |
-| `\b\d+\s*hours?\b` / `\b\d+\s*days?\b` / `\b\d+\s*min(utes?)?\b` | Forbidden. |
-| `\b(low|medium|high|small|large)\s*[:|-]\s*(effort|complexity)\b` | Forbidden. |
-| `\d+%\s*complete` / `\b\d+/\d+\b\s*tasks` | Forbidden — binary PENDING/IN_PROGRESS/DONE. |
-| `**Owner:**` / `**Assigned to:**` | Forbidden — use git history. |
-| `**Due:**` / `**Deadline:**` (with date) | Forbidden — use Priority. |
-| Missing a required determinism section in a **staged** spec | BLOCK — add it. |
-| Rubric missing a declared `conform`/`verify.unit` command (**staged** pending/active) | BLOCK — copy it verbatim from `.oracle/orly.json`. |
-| Unfilled template residue in a **staged** spec | BLOCK — fill the section. |
-| Surviving `tpl:` guidance comment in a **staged** spec | BLOCK — delete it; the executor reads instance content only. |
-| Spec without the SPEC AUTHORING RULES banner | Informational — reminds future edits. |
-
-## Required output (default — one line)
-
-```
-SPEC TEMPLATE GATE: <file> | prohibited:<0|list> required-sections:<all-present|missing-list — staged only> placeholders:<0|list> banner:<yes|no>
-```
-
-Full multi-line block fires on violation (prohibited sections / time estimates /
-effort fields / %-complete / owner-date fields, each with line numbers, plus the
-`audits/spec-template.sh` staged-diff finding count).
-
-## Scope
-
-`audits/spec-template.sh` walks the **full pending+active spec set** via `git ls-files`;
-the index includes staged-but-uncommitted content, so a fix staged in pre-commit
-satisfies the check on the same hook run. `--staged` is the opt-in narrowing mode.
+Report structural findings with file paths. Report an implementation verdict
+only after the spec's behavior and repository checks have run.
 
 ## Authoring discipline (judgment layer)
 

package/docs/ORLY_ARCHITECTURE.md

@@ -71,9 +71,14 @@ determinism proof is unchanged by any of this.
 
 | Gate | Proves |
 |---|---|
-| `work` | branch is not the default; tree is clean; the repository declares its commands in `.oracle/orly.json` |
-| `verify` | Dimensions marked DONE (when a spec exists); `conform`; the fast `verify.*` commands |
-| `pr` | tree clean; branch pushed; spec gate + closed-spec follow-through (`spec.moved` / `spec.baseline` / `spec.ordering` / `spec.deferrals`); docs updated for user-surface changes; the slow suites |
+| `work` | repository configuration and the declared `conform` command over the staged change |
+| `verify` | documentation checks and non-test `verify.*` commands; unfinished Sections may be pushed |
+| `pr` | exact pushed revision, branch/spec criteria, docs surface, and every declared `verify.*` command |
+
+The authoritative sequence is `dispatch/lifecycle.md`. Full unit, integration,
+and memory suites run at the PR boundary. No stored verification cache or
+assumption about a custom pre-push hook can remove them. Baselines name an
+immutable comparison revision and are measured before the Pull Request.
 
 Every criterion is mechanical — it reads an exit code or a file. Claims that
 cannot be proven that way stay prose and are graded by the spec's rubric; they
@@ -121,6 +126,11 @@ surfaces:
 ```
 
 Orly owns policy and invokes these commands. The repository owns what they do.
+Setup requires `conform` and at least one named `verify.*` command.
+Documentation repositories can use `verify.docs` for site validation and link
+checks without declaring application test suites. `init` reports missing
+commands; `doctor` rejects incomplete setup without running those commands.
+The final tree check includes the spec, so its evidence must be committed.
 
 ## Usage telemetry
 

package/docs/RULE_ENFORCEMENT.md

@@ -12,9 +12,9 @@ regenerates this file and fails on any difference. To update it, run
 | `docs/DOCUMENTATION_RULES.md` | — | 0 | 0 | 0/22 | latent |
 | `docs/LIFECYCLE_PATTERNS.md` | — | 0 | 0 | 0/22 | mechanical |
 | `docs/CHANGELOG_VOICE.md` | — | 0 | 0 | 0/3 | latent |
-| `docs/VERIFY_TIERS.md` | — | 0 | 0 | 0/7 | uncited |
+| `docs/VERIFY_TIERS.md` | — | 0 | 0 | 0/6 | uncited |
 | `docs/greptile-learnings/RULES.md` | — | 0 | 0 | 0/114 | mechanical |
-| **corpus** | | | | **30/279** | |
+| **corpus** | | | | **30/278** | |
 
 ## How to read this