@agentsfleet/orly 0.7.1 → 0.9.0

package/AGENTS.md

@@ -61,7 +61,7 @@ Auto-memory is **disabled** (`autoMemoryEnabled: false` + `CLAUDE_CODE_DISABLE_A
 - **Skip hooks/signing.** Never `--no-verify`/`--no-gpg-sign`/`-c commit.gpgsign=false`. Hook fails → fix cause.
 - **Plaintext secrets in entity tables.** Store vault `key_name` ref, resolve via `crypto_store.load()`.
 - **Static strings in SQL schema.** No `DEFAULT 'value'`/`CHECK (col IN ('a','b'))`. Enforce in app via named constants.
-- **Resolving/printing credentials.** `op read 'op://...'` at runtime — never paste/log.
+- **Resolving/printing credentials.** `op read 'op://...'` at runtime — never paste/log. Vault names come from the environment, never from a rules file.
 - **Force-push default branch** (`main`/`master`).
 - **Install-process launches in core paths.** Native SDKs. Exception: personal dev tools (`op`/`gh`/`glab`/`oracle`).
 
@@ -83,14 +83,14 @@ Auto-memory is **disabled** (`autoMemoryEnabled: false` + `CLAUDE_CODE_DISABLE_A
 - **Symlinked edits land in the repository that owns the file.** A file whose `readlink` resolves outside this checkout — into a dotfiles or config repository — is an edit to *that* repository, not this one. Detect via `readlink` BEFORE editing. After: `cd` to the resolved repository, `git add <files> && git commit && git push` on its default branch. Never leave uncommitted.
 - **Docs-repo edits on own branch.** `~/Projects/docs/` is shared across milestones: check `git status` first; from `main` (checkout or worktree off `main`) commit on `chore/m{N}-{slug}-changelog`; recovery = stash, re-apply on a fresh branch.
 - Other dotfiles (`.zshrc`/`.gitconfig`/etc.): timestamped backup; minimal edits.
+- **Check a sibling repository for an existing pattern in the same language before inventing one.** A shape shipping next door is prior art; a new one needs a reason.
+- **Read the reference implementation before designing.** Where the language's dispatch page names a canonical external source, that read is mandatory in review and its guideline identifiers are cited — applied or diverged from. "Broken for us" means the delta was missed: diff our call site against theirs before blaming the principle.
 - Before commit/push: `gitleaks` must pass.
 - No new `make` targets without a distinct caller (CI job, spec-mandated gate, or a workflow existing targets can't express) — check `make/*.mk` first; extend over near-duplicate wrappers.
 - `*.zig` → read `dispatch/write_zig.md`; ZIG GATE fires.
 - Auth-flow (token-minting handlers, credential-typed spec dimensions, the repository's auth directories) → read the repository's `docs/AUTH.md` first, where it exists.
 - `conn.query()` requires `.drain()` in same fn before `deinit()`. Verify `make lint-governance`. Use `conn.exec()` for no-rows.
-- **Vault (1Password `op`).** Resolve secrets via the `op` CLI, never hand-paste/log. Vault names come from the environment, never from a rules file.
-- Check a sibling repository under `$HOME/Projects/` for an existing pattern in the same language before inventing one.
-- **Reference canon (read before designing):** TypeScript → `oss/supabase/apps/studio` + `oss/supabase/packages/{ui,ui-patterns}` + `oss/cli`; Zig → `oss/ghostty/src/`; Rust → `oss/bun/src/` + `oss/exonum` + `oss/core_api-develop` + Microsoft's Rust guidelines (`oss/rust-guidelines/all.txt`, fetch if absent; mandatory in review). Missing checkout → ask, then clone into `~/Projects/oss/`. "Broken for us" → call-site diff first.
+- **Indy's reference checkouts** (the machine-local half of the rule above): TypeScript → `oss/supabase/apps/studio` + `oss/supabase/packages/{ui,ui-patterns}` + `oss/cli`; Zig → `oss/ghostty/src/`; Rust → `oss/bun/src/` + `oss/exonum` + `oss/core_api-develop`. Missing checkout → ask, then clone into `~/Projects/oss/`.
 
 **Forge detection:** `github.com` → `gh`; `gitlab.com` → `glab`. Check `git remote -v`.
 
@@ -180,7 +180,9 @@ Non-trivial (full lifecycle) if it: touches >1 file · new abstraction · data m
 
 **With spec:** `CHORE(open) → PLAN → EXECUTE → CONFORM → VERIFY → REVIEW → DOCUMENT → COMMIT → CHORE(close)`. **Without spec** (bug fix/config/refactor): `PLAN → EXECUTE → CONFORM → VERIFY → REVIEW → DOCUMENT → COMMIT`. CHORE bookends iff work creates/continues a spec under `docs/v*/{active,pending}/`. Stage runbooks (checklists, recipes, formats): `dispatch/lifecycle.md`.
 
-**Anchor invariant — `orly gate` proves the boundary.** No PR opens unless every `orly gate pr` criterion is green or carries an `Orly-Override` trailer the user recorded with a reason. `orly gate` runs `work → verify → pr`, stops at the first red group, and only reads; green unlocks CHORE(close) but never performs it. No spec → spec criteria skip, quality gates still run. Slow suites (`verify.integration`, `verify.memory`) run only when the branch carries code. A user-surface change without a docs change is red until docs land or an override says why not.
+**Anchor invariant — `orly gate` proves the boundary.** No PR opens unless every `orly gate pr` criterion is green or carries an `Orly-Override` trailer the user recorded with a reason.
+
+**One gate per cadence, each tier run once.** `work` = the declared `conform` command, no git state (a commit hook's tree is dirty by construction). `verify` = spec dimensions, docs language, the fast `verify.*` set. `pr` = branch shape, clean tree, pushed branch, every spec criterion, the slow suites. `orly gate pr` is the command CHORE(close) runs; `git.pushed` proves HEAD is exactly what the pre-push `orly gate verify` already graded. A bare `orly gate` chains all three, for a branch whose earlier gates never ran. Stage map: `dispatch/lifecycle.md`. Both stop at the first red group and only read; green unlocks CHORE(close) but never performs it. No spec → spec criteria skip, quality gates still run. Slow suites (`verify.integration`, `verify.memory`) run only when the branch carries code. A user-surface change without a docs change is red until docs land or an override says why not.
 
 **LAND (after merge, or when the user confirms it merged):** pull the default branch, prune the merged worktree + branch, `make down` where defined.
 
@@ -203,13 +205,13 @@ Edit only approved scope; no opportunistic refactors. Stay in active worktree. C
 
 ### CONFORM
 
-Runs after EXECUTE, before VERIFY. Invokes the `conform` commands the repository declares in `.oracle/orly.json` and aggregates every gate verdict. Any 🔴 returns to EXECUTE; the lifecycle does not advance.
+Runs after EXECUTE, before VERIFY. Invokes the `conform` commands the repository declares in `.oracle/orly.json` and aggregates every gate verdict. Any 🔴 returns to EXECUTE; the lifecycle does not advance. This is the `work` gate's tier and the pre-commit hook runs it at every commit: declare a `conform` costing seconds, not minutes.
 In `agentsfleet` this stage is `make harness-verify`; its output block and end-of-turn audit detail live in `docs/HARNESS_VERIFY_OUTPUT.md`. Required rows: FILE SHAPE, PUB GATE, LENGTH GATE, MILESTONE-ID GATE, ZIG GATE, UI GATE, DESIGN TOKEN GATE, UFS GATE, SCHEMA GUARD, GREPTILE GATE, Architecture consult, Coverage, and `/orly-write-unit-test`.
 
 ### VERIFY
 
-Run the repository's declared `verify.*` commands from `.oracle/orly.json`. A package-scoped command never replaces a listed one.
-The `agentsfleet` output block and exact tiers live in `docs/VERIFY_TIERS.md`. **FIRST: `/orly-write-unit-test`** audits diff coverage. **LAST: the Test Delta row** compares against the CHORE(open) baseline; zero or negative unit growth on a code-adding diff needs justification or a return to EXECUTE. Paste memory-leak evidence into PR Session Notes or cite its Continuous Integration (CI) URL. After refactors, list newly dead code before removing it.
+**Two cadences, one boundary.** Inside a Section, run CONFORM plus the declared lane covering the surface the Section touched — enough to prove a Section, reported as a Section claim. The repository's full declared `verify.*` set runs ONCE, at the milestone boundary, before the PR. A package-scoped command never replaces a listed one at either cadence, and a Section lane never satisfies a "tests pass" claim about the repository.
+The `agentsfleet` output block and both cadences live in `docs/VERIFY_TIERS.md`. **FIRST: `/orly-write-unit-test`** audits diff coverage. **LAST: the Test Delta row** compares against the CHORE(open) baseline; zero or negative unit growth on a code-adding diff needs justification or a return to EXECUTE. Paste memory-leak evidence into PR Session Notes or cite its Continuous Integration (CI) URL. After refactors, list newly dead code before removing it.
 
 ### REVIEW
 
@@ -235,7 +237,7 @@ Required when spec involved — after last COMMIT, before PR. Also runs when par
 
 | # | When | Skill |
 |---|---|---|
-| 1 | VERIFY | `/orly-write-unit-test`, then `/orly-write-integration-test` — both before the PR, never skipped, never deferred |
+| 1 | VERIFY | `/orly-write-unit-test` once per Section over that Section's diff, and again at the boundary — never skipped, never deferred. Then `/orly-write-integration-test` at the boundary **when the diff crosses a module boundary with real input/output**; otherwise record `N/A — <reason>` in Session Notes. |
 | 2 | REVIEW | gstack `/review` — every runtime, same route; address findings or record a user-acked deferral; reviewer unavailable → Session Notes: *"skipped — <reason> <ts>; rerun before merge"* |
 | 3 | After every push | `orly-babysit-prs` — CI check runs + greptile inline threads + PR-level summary; stops on two consecutive empty polls with CI green; never `gh pr checks --watch` for greptile |
 
@@ -294,7 +296,10 @@ Optimise for one thing: he never has to ask twice.
   justification clauses, importance puffery, em-dash rhythm crutches, and
   fake-profound kickers. End on the clearest concrete sentence. The banned-word
   list lives in `docs/DOCUMENTATION_RULES.md` §DOC-05, §DOC-07, §DOC-14b, and
-  `orly gate verify` enforces it.
+  `orly gate verify` REPORTS it — `docs.language` prints its findings and stays
+  green, because the corpus predates the rule and a red on day one gets switched
+  off by the end of the week. Nobody fails a build over this, so the prose is
+  mine to get right.
 
 ## Reading Indy
 
@@ -370,5 +375,5 @@ Optimise for one thing: he never has to ask twice.
 
 | Responsibility | Commands |
 |---|---|
-| `conform` | `make audit` |
+| `conform` | `make conform` |
 | `verify.unit` | `bun test src` |

package/README.md

@@ -81,6 +81,9 @@ your-repo/
 ├── AGENTS.md ─────────────── yours. untouched, except one delimited pointer block
 ├── AGENTS.orly.md ────────── the generated rules: safety, dispatch router, lifecycle
 │
+├── CLAUDE.md ─────────────── one import line; the only file Claude Code loads itself
+├── opencode.json ─────────── names both rule files; opencode loads nothing by default
+│
 ├── dispatch/*.md ─────────── one rule page per kind of work
 ├── audits/*.sh ───────────── the deterministic gates
 ├── docs/*.md ─────────────── the standards those rules cite
@@ -191,8 +194,12 @@ Each edit activates the rule page for that file kind. A gate proves whether the
 |---|---|---|
 | `AGENTS.md` | **you** | untouched, except one delimited pointer block |
 | `AGENTS.orly.md` | orly | rewritten |
+| `CLAUDE.md` | **you** | written only when missing; never edited after |
+| `opencode.json` | **you** | gains the two rule files in `instructions`; nothing else touched |
+
+`AGENTS.md` stays yours — orly writes its rules beside it and points at them from one delimited block.
 
-Every agent runtime auto-loads `AGENTS.md`, so it stays yours. orly writes its rules beside it and adds a pointer so they get read.
+The last two files exist because installing a rules file is not the same as delivering it, and no runtime loads `AGENTS.orly.md` on its own. Codex and Amp auto-load `AGENTS.md`, which carries the pointer block onward. Claude Code loads `CLAUDE.md` and nothing else. opencode loads only what its `instructions` name. So orly writes the one import line each of those needs, and leaves any file you already wrote alone — a `CLAUDE.md` of your own, symlink included, is your answer to the question and orly does not touch it.
 
 > [!WARNING]
 > orly refuses to replace a hook or rule page it did not write. `--force` and `--no-hooks` are the ways through. A refused run changes nothing.

package/SOUL.md

@@ -44,7 +44,10 @@ Optimise for one thing: he never has to ask twice.
   justification clauses, importance puffery, em-dash rhythm crutches, and
   fake-profound kickers. End on the clearest concrete sentence. The banned-word
   list lives in `docs/DOCUMENTATION_RULES.md` §DOC-05, §DOC-07, §DOC-14b, and
-  `orly gate verify` enforces it.
+  `orly gate verify` REPORTS it — `docs.language` prints its findings and stays
+  green, because the corpus predates the rule and a red on day one gets switched
+  off by the end of the week. Nobody fails a build over this, so the prose is
+  mine to get right.
 
 ## Reading Indy
 

package/audits/agents-md.md

@@ -95,6 +95,7 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 | 4.23 (Documentation) | Before published Markdown JSX (MDX), reusable snippets, customer readme, or public OpenAPI prose, must the agent read `dispatch/write_documentation.md` and `docs/DOCUMENTATION_RULES.md` before any narrower guide? | YES |
 | 4.24 (Documentation) | Are page, snippet, generated API, and changelog scopes distinct, with repository-owned pre-commit checks enforcing the mechanical rules? | YES |
 | 4.25 (Rust) | Do `*.rs` edits route to `dispatch/write_rust.md` — ownership, error variants, feature combinations, deterministic contention tests — with Microsoft's Pragmatic Rust Guidelines (`~/Projects/oss/rust-guidelines/all.txt`, fetched when absent) read sectioned and its `M-…` IDs cited in every Rust review? | YES | <!-- oracle-packs:language.rust -->
+| 4.25b (Rust errors) | Is RULE ERR-RS deterministic where a machine can decide it — `dispatch/write_rust.sh` running `audits/rust-error.sh` over staged `*.rs` to block a `map_err` that stringifies its own cause and an error type with no `pub type Result<…>` in its crate — while `source()` shape and whether a context addition is warranted stay the agent's call? | YES | <!-- oracle-packs:language.rust -->
 | 4.25a (Go) | Do `*.go` edits route to `dispatch/write_go.md`, with wrapped errors, goroutine exit paths, context-first signatures, defer-at-acquire, and `-race` verification? | YES | <!-- oracle-packs:language.go -->
 | 4.26 (Python) | Do `*.py` edits route to `dispatch/write_python.md`, with parse-boundary validation and context-managed resources? | YES |
 | 4.27 (Shell) | Do `*.sh` edits route to `dispatch/write_shell.md`, with quoted expansions, array arguments, cleanup, and compatibility requirements? | YES |
@@ -334,6 +335,8 @@ siblings.
 | 26.5 | Does the `agentsfleet` profile map CONFORM to `make harness-verify` while VERIFY remains behavior proof? | YES |
 | 26.6 | Does `README.md` document initialization, explicit synchronization, status, and doctor commands for new repositories? | YES |
 | 26.7 | Does `orly gate pr` discover a spec closed to `done/` on the branch (its `Branch:` header names the branch) and run the spec criteria — including `spec.moved`, `spec.baseline`, `spec.ordering`, and `spec.deferrals` — instead of skip-passing as spec-less? | YES |
+| 26.8 | Does the install write one loader per runtime that has a deterministic way into context — a bare, unbackticked `@AGENTS.orly.md` import line inside the pointer block, a `CLAUDE.md` carrying `@AGENTS.md` where the repository has none, and both rule files in `opencode.json`'s `instructions` — so delivery never depends on an agent noticing a markdown link? | YES |
+| 26.9 | Are those loaders the repository's files rather than orly's — absent from `managed`, `CLAUDE.md` written only when missing (a symlink at the host counted as delivery, any other symlink left alone), `opencode.json` edited only by appending a missing `instructions` entry, and an unparseable one left byte for byte? | YES |
 
 ### Scenario 27 — Rule-path residence & reachability
 

package/audits/rust-error.sh

@@ -0,0 +1,228 @@
+#!/usr/bin/env bash
+# rust-error.sh — the mechanical half of RULE ERR-RS (Rust error discipline).
+#
+# Dispatch façade: dispatch/write_rust.md (Error discipline). Pairs with
+# dispatch/write_rust.sh, which is what runs it.
+#
+# The rule has four clauses. Two of them a machine can decide from the text
+# alone, and only those two live here:
+#
+#   1. LOSSY MAP_ERR — `map_err` whose closure converts its own cause through
+#      `to_string()` or `format!`. The rule allows `map_err` to ADD context the
+#      call site alone knows; it forbids stringifying the cause on the way into
+#      an error type, because `to_string()` destroys the `source()` chain. The
+#      closure's BINDING is what makes this decidable: `.map_err(|e| Mine::Db(
+#      e.to_string()))` stringifies the cause, while `.map_err(|e| Mine::Read {
+#      source: e, path: path.to_string() })` stringifies a path and is correct.
+#      Only a `to_string()` or `format!` applied to the closure's own parameter
+#      is a finding.
+#
+#   2. MISSING RESULT ALIAS — a crate declaring `pub enum Error` or
+#      `pub struct Error` with no `pub type Result<` anywhere beside it. The
+#      rule is "one error type per crate, and a `Result` alias beside it": a
+#      reader must never have to check WHICH error a signature returns.
+#
+# The other two clauses stay JUDGMENT and are not attempted here. Whether a
+# `source()` implementation returns its own kind needs the Display body read
+# beside it, and whether a context addition is warranted is a call-site
+# question. A gate that guesses at those gets switched off within a week, and a
+# switched-off gate protects nothing — partial mechanisation stated honestly is
+# the whole design (the same call audits/doc-read.sh makes about its record).
+#
+# Carve-outs match audits/logging.sh exactly, so one Rust scope answers to both
+# leaves: build scripts, `tests/`, `benches/`, `examples/`, and `#[cfg(test)]`
+# modules are fixture code, where a stringified error in a test assertion is
+# not a production error path.
+#
+# Modes:
+#   --staged   diff-scope: only *.rs in `git diff --cached`
+#   --all      (default) every tracked/unignored *.rs
+#
+# Exits 0 clean, 1 on findings.
+
+set -euo pipefail
+
+MODE_STAGED="--staged"
+MODE_ALL="--all"
+RULE="ERR-RS"
+FACADE="dispatch/write_rust.md"
+# The closure body window. A `map_err` closure that has not closed its
+# parentheses within this many lines is a block long enough that its conversion
+# is no longer a one-liner, and the rule's subject is the one-liner.
+MAX_CLOSURE_LINES=12
+CARGO_MANIFEST="Cargo.toml"
+RESULT_ALIAS_PATTERN='^[[:space:]]*pub[[:space:]]+type[[:space:]]+Result[[:space:]]*<'
+ERROR_TYPE_PATTERN='^[[:space:]]*pub[[:space:]]+(enum|struct)[[:space:]]+Error[[:space:]]*[<{(;]'
+
+MODE="$MODE_ALL"
+for arg in "$@"; do
+  case "$arg" in
+    --staged|staged) MODE="$MODE_STAGED" ;;
+    --all|all)       MODE="$MODE_ALL" ;;
+    -h|--help)
+      printf 'usage: %s [--staged|--all]\n' "$0"
+      exit 0
+      ;;
+    *) printf 'unknown arg: %s\n' "$arg" >&2; exit 64 ;;
+  esac
+done
+
+ROOT="$(git rev-parse --show-toplevel)"
+cd "$ROOT"
+
+FAIL=0
+fail() { printf 'FAIL: %s\n' "$*" >&2; FAIL=1; }
+ok()   { printf 'OK:   %s\n' "$*"; }
+
+# Non-runtime Rust paths, identical to audits/logging.sh's carve-out list.
+is_non_runtime_rust_path() {
+  case "$1" in
+    build.rs|*/build.rs|tests/*|*/tests/*|benches/*|*/benches/*|examples/*|*/examples/*) return 0 ;;
+  esac
+  return 1
+}
+
+gather_paths() {
+  case "$MODE" in
+    "$MODE_STAGED")
+      git diff --cached --name-only --diff-filter=ACMRT -- '*.rs' || true
+      ;;
+    "$MODE_ALL")
+      git ls-files --cached --others --exclude-standard -- '*.rs' || true
+      ;;
+  esac
+}
+
+FILES=()
+while IFS= read -r path; do
+  [[ -n "$path" && -f "$path" ]] || continue
+  is_non_runtime_rust_path "$path" && continue
+  FILES+=("$path")
+done < <(gather_paths)
+
+if [[ ${#FILES[@]} -eq 0 ]]; then
+  ok "$RULE: no runtime Rust files in scope ($MODE)"
+  exit 0
+fi
+
+# ---------------------------------------------------------------------------
+# 1. Scan every in-scope file once, emitting both signals.
+# ---------------------------------------------------------------------------
+# One pass, one carve-out. Both halves need the same `#[cfg(test)]` skip, and
+# implementing it twice is how the two halves would come to disagree about what
+# a test module is — so the scanner emits `LOSSY:` and `ERRTYPE:` records from a
+# single walk and the shell decides what to do with each.
+#
+# The lossy scanner accumulates a map_err closure from its opening parenthesis
+# until the parentheses balance, so a conversion split over several lines reads
+# the same as a one-liner.
+signals="$(awk -v maxlines="$MAX_CLOSURE_LINES" -v errtype="$ERROR_TYPE_PATTERN" '
+  FNR == 1 { intest = 0; testdepth = 0; pending = 0; collecting = 0 }
+
+  # A #[cfg(test)] module is fixture code. The attribute precedes the item, so
+  # arm on the attribute and start counting braces at the item that follows.
+  !collecting && /#\[cfg\(test\)\]/ { pending = 1; next }
+  pending {
+    if (index($0, "{") > 0) { pending = 0; intest = 1; testdepth = 0 }
+    else next
+  }
+  intest {
+    n = gsub(/\{/, "{"); m = gsub(/\}/, "}")
+    testdepth += n - m
+    if (testdepth <= 0) intest = 0
+    next
+  }
+
+  {
+    line = $0
+    # Strip a trailing line comment so a commented example is not a finding.
+    sub(/\/\/.*$/, "", line)
+
+    # A public error type outside any test module. Emitted per file; the shell
+    # resolves it to a crate and asks that crate for its alias once.
+    if (!collecting && line ~ errtype) printf "ERRTYPE:%s\n", FILENAME
+
+    if (!collecting) {
+      where = match(line, /map_err[[:space:]]*\([[:space:]]*\|[[:space:]]*[A-Za-z_][A-Za-z0-9_]*[[:space:]]*\|/)
+      if (where == 0) next
+      rest = substr(line, where)
+      # The closure binding: the identifier between the pipes.
+      bind = rest
+      sub(/^map_err[[:space:]]*\([[:space:]]*\|[[:space:]]*/, "", bind)
+      sub(/[[:space:]]*\|.*$/, "", bind)
+      if (bind == "_") next
+      collecting = 1; buffer = rest; startline = FNR; spanned = 1
+      depth = gsub(/\(/, "(", rest) - gsub(/\)/, ")", rest)
+    } else {
+      buffer = buffer " " line
+      spanned++
+      depth += gsub(/\(/, "(", line) - gsub(/\)/, ")", line)
+    }
+
+    if (depth > 0 && spanned < maxlines) next
+
+    # `bind.to_string()` — the cause converted to text on the way in.
+    stringified = 0
+    if (buffer ~ ("(^|[^A-Za-z0-9_])" bind "[[:space:]]*\\.[[:space:]]*to_string[[:space:]]*\\(")) stringified = 1
+    # `format!(... bind ...)` — the same loss wearing a formatter.
+    if (buffer ~ /format!/ && buffer ~ ("(^|[^A-Za-z0-9_])" bind "([^A-Za-z0-9_]|$)")) {
+      after = buffer; sub(/^.*format!/, "", after)
+      if (after ~ ("(^|[^A-Za-z0-9_])" bind "([^A-Za-z0-9_]|$)")) stringified = 1
+    }
+    if (stringified) printf "LOSSY:%s:%d\n", FILENAME, startline
+    collecting = 0
+  }
+' "${FILES[@]}" || true)"
+
+lossy_count=0
+error_type_files=()
+while IFS= read -r signal; do
+  case "$signal" in
+    LOSSY:*)
+      lossy_count=$((lossy_count + 1))
+      fail "${signal#LOSSY:}  $RULE: map_err stringifies its own cause — to_string()/format! on the closure binding destroys the source() chain. Carry the cause with #[from] or a source field; map_err only ADDS context."
+      ;;
+    ERRTYPE:*)
+      error_type_files+=("${signal#ERRTYPE:}")
+      ;;
+  esac
+done <<< "$signals"
+
+# ---------------------------------------------------------------------------
+# 2. An error type with no Result alias beside it.
+# ---------------------------------------------------------------------------
+# Crate-scoped: the alias may live in any file of the crate that declares the
+# error, so the question is asked of the crate, once, not of the file.
+crate_root_of() {
+  local dir; dir="$(dirname "$1")"
+  while [[ "$dir" != "." && "$dir" != "/" ]]; do
+    [[ -f "$dir/$CARGO_MANIFEST" ]] && { printf '%s' "$dir"; return 0; }
+    dir="$(dirname "$dir")"
+  done
+  [[ -f "$CARGO_MANIFEST" ]] && { printf '.'; return 0; }
+  return 1
+}
+
+alias_count=0
+checked_crates=""
+for path in ${error_type_files[@]+"${error_type_files[@]}"}; do
+  crate=""
+  crate_root_of "$path" > /dev/null 2>&1 && crate="$(crate_root_of "$path")"
+  # A .rs file outside any Cargo crate has no crate to carry the alias; the
+  # lossy-map_err half still judged it.
+  [[ -n "$crate" ]] || continue
+  case " $checked_crates " in *" $crate "*) continue ;; esac
+  checked_crates="$checked_crates $crate"
+  if ! git ls-files --cached --others --exclude-standard -- "$crate/*.rs" \
+       | xargs grep -lE "$RESULT_ALIAS_PATTERN" 2>/dev/null | grep -q .; then
+    alias_count=$((alias_count + 1))
+    fail "$path  $RULE: crate '$crate' declares a public Error type with no \`pub type Result<T, E = Error>\` beside it — a reader must not have to check WHICH error a signature returns."
+  fi
+done
+
+ok "$RULE: scanned ${#FILES[@]} runtime Rust file(s); lossy-map_err=$lossy_count missing-result-alias=$alias_count"
+if [[ $FAIL -ne 0 ]]; then
+  printf '\n🔴 %s: blocking violations. See %s (Error discipline).\n' "$RULE" "$FACADE" >&2
+  exit 1
+fi
+exit 0

package/core/operating-model.md

@@ -61,7 +61,7 @@ Auto-memory is **disabled** (`autoMemoryEnabled: false` + `CLAUDE_CODE_DISABLE_A
 - **Skip hooks/signing.** Never `--no-verify`/`--no-gpg-sign`/`-c commit.gpgsign=false`. Hook fails → fix cause.
 - **Plaintext secrets in entity tables.** Store vault `key_name` ref, resolve via `crypto_store.load()`.
 - **Static strings in SQL schema.** No `DEFAULT 'value'`/`CHECK (col IN ('a','b'))`. Enforce in app via named constants.
-- **Resolving/printing credentials.** `op read 'op://...'` at runtime — never paste/log.
+- **Resolving/printing credentials.** `op read 'op://...'` at runtime — never paste/log. Vault names come from the environment, never from a rules file.
 - **Force-push default branch** (`main`/`master`).
 - **Install-process launches in core paths.** Native SDKs. Exception: personal dev tools (`op`/`gh`/`glab`/`oracle`).
 
@@ -80,18 +80,18 @@ Auto-memory is **disabled** (`autoMemoryEnabled: false` + `CLAUDE_CODE_DISABLE_A
 ### Operational defaults
 
 - Workspace `~/Projects`. `gh`/`glab` not browsers. `trash` not `rm`. Conventional Commits. Process decisions → repo docs, not chat. "Make a note" → update `AGENTS.md`/repo docs.
-- **Symlinked edits land in the repository that owns the file.** A file whose `readlink` resolves outside this checkout — into a dotfiles or config repository — is an edit to *that* repository, not this one. Detect via `readlink` BEFORE editing. After: `cd` to the resolved repository, `git add <files> && git commit && git push` on its default branch. Never leave uncommitted. <!-- oracle-packs:persona.indy -->
+- **Symlinked edits land in the repository that owns the file.** A file whose `readlink` resolves outside this checkout — into a dotfiles or config repository — is an edit to *that* repository, not this one. Detect via `readlink` BEFORE editing. After: `cd` to the resolved repository, `git add <files> && git commit && git push` on its default branch. Never leave uncommitted.
 - **Docs-repo edits on own branch.** `~/Projects/docs/` is shared across milestones: check `git status` first; from `main` (checkout or worktree off `main`) commit on `chore/m{N}-{slug}-changelog`; recovery = stash, re-apply on a fresh branch.
-- Other dotfiles (`.zshrc`/`.gitconfig`/etc.): timestamped backup; minimal edits. <!-- oracle-packs:persona.indy -->
+- Other dotfiles (`.zshrc`/`.gitconfig`/etc.): timestamped backup; minimal edits.
+- **Check a sibling repository for an existing pattern in the same language before inventing one.** A shape shipping next door is prior art; a new one needs a reason.
+- **Read the reference implementation before designing.** Where the language's dispatch page names a canonical external source, that read is mandatory in review and its guideline identifiers are cited — applied or diverged from. "Broken for us" means the delta was missed: diff our call site against theirs before blaming the principle.
 - Before commit/push: `gitleaks` must pass.
 - No new `make` targets without a distinct caller (CI job, spec-mandated gate, or a workflow existing targets can't express) — check `make/*.mk` first; extend over near-duplicate wrappers.
 - `*.zig` → read `dispatch/write_zig.md`; ZIG GATE fires. <!-- oracle-packs:language.zig -->
 - Auth-flow (token-minting handlers, credential-typed spec dimensions, the repository's auth directories) → read the repository's `docs/AUTH.md` first, where it exists. <!-- oracle-packs:domain.auth -->
 - `conn.query()` requires `.drain()` in same fn before `deinit()`. Verify `make lint-governance`. Use `conn.exec()` for no-rows. <!-- oracle-packs:product.agentsfleet -->
 <!-- oracle-packs:start persona.indy -->
-- **Vault (1Password `op`).** Resolve secrets via the `op` CLI, never hand-paste/log. Vault names come from the environment, never from a rules file.
-- Check a sibling repository under `$HOME/Projects/` for an existing pattern in the same language before inventing one.
-- **Reference canon (read before designing):** TypeScript → `oss/supabase/apps/studio` + `oss/supabase/packages/{ui,ui-patterns}` + `oss/cli`; Zig → `oss/ghostty/src/`; Rust → `oss/bun/src/` + `oss/exonum` + `oss/core_api-develop` + Microsoft's Rust guidelines (`oss/rust-guidelines/all.txt`, fetch if absent; mandatory in review). Missing checkout → ask, then clone into `~/Projects/oss/`. "Broken for us" → call-site diff first.
+- **Indy's reference checkouts** (the machine-local half of the rule above): TypeScript → `oss/supabase/apps/studio` + `oss/supabase/packages/{ui,ui-patterns}` + `oss/cli`; Zig → `oss/ghostty/src/`; Rust → `oss/bun/src/` + `oss/exonum` + `oss/core_api-develop`. Missing checkout → ask, then clone into `~/Projects/oss/`.
 <!-- oracle-packs:end -->
 
 **Forge detection:** `github.com` → `gh`; `gitlab.com` → `glab`. Check `git remote -v`.
@@ -186,7 +186,9 @@ Non-trivial (full lifecycle) if it: touches >1 file · new abstraction · data m
 
 **With spec:** `CHORE(open) → PLAN → EXECUTE → CONFORM → VERIFY → REVIEW → DOCUMENT → COMMIT → CHORE(close)`. **Without spec** (bug fix/config/refactor): `PLAN → EXECUTE → CONFORM → VERIFY → REVIEW → DOCUMENT → COMMIT`. CHORE bookends iff work creates/continues a spec under `docs/v*/{active,pending}/`. Stage runbooks (checklists, recipes, formats): `dispatch/lifecycle.md`.
 
-**Anchor invariant — `orly gate` proves the boundary.** No PR opens unless every `orly gate pr` criterion is green or carries an `Orly-Override` trailer the user recorded with a reason. `orly gate` runs `work → verify → pr`, stops at the first red group, and only reads; green unlocks CHORE(close) but never performs it. No spec → spec criteria skip, quality gates still run. Slow suites (`verify.integration`, `verify.memory`) run only when the branch carries code. A user-surface change without a docs change is red until docs land or an override says why not.
+**Anchor invariant — `orly gate` proves the boundary.** No PR opens unless every `orly gate pr` criterion is green or carries an `Orly-Override` trailer the user recorded with a reason.
+
+**One gate per cadence, each tier run once.** `work` = the declared `conform` command, no git state (a commit hook's tree is dirty by construction). `verify` = spec dimensions, docs language, the fast `verify.*` set. `pr` = branch shape, clean tree, pushed branch, every spec criterion, the slow suites. `orly gate pr` is the command CHORE(close) runs; `git.pushed` proves HEAD is exactly what the pre-push `orly gate verify` already graded. A bare `orly gate` chains all three, for a branch whose earlier gates never ran. Stage map: `dispatch/lifecycle.md`. Both stop at the first red group and only read; green unlocks CHORE(close) but never performs it. No spec → spec criteria skip, quality gates still run. Slow suites (`verify.integration`, `verify.memory`) run only when the branch carries code. A user-surface change without a docs change is red until docs land or an override says why not.
 
 **LAND (after merge, or when the user confirms it merged):** pull the default branch, prune the merged worktree + branch, `make down` where defined.
 
@@ -213,16 +215,16 @@ Edit only approved scope; no opportunistic refactors. Stay in active worktree. C
 
 ### CONFORM
 
-Runs after EXECUTE, before VERIFY. Invokes the `conform` commands the repository declares in `.oracle/orly.json` and aggregates every gate verdict. Any 🔴 returns to EXECUTE; the lifecycle does not advance.
+Runs after EXECUTE, before VERIFY. Invokes the `conform` commands the repository declares in `.oracle/orly.json` and aggregates every gate verdict. Any 🔴 returns to EXECUTE; the lifecycle does not advance. This is the `work` gate's tier and the pre-commit hook runs it at every commit: declare a `conform` costing seconds, not minutes.
 <!-- oracle-packs:start product.agentsfleet -->
 In `agentsfleet` this stage is `make harness-verify`; its output block and end-of-turn audit detail live in `docs/HARNESS_VERIFY_OUTPUT.md`. Required rows: FILE SHAPE, PUB GATE, LENGTH GATE, MILESTONE-ID GATE, ZIG GATE, UI GATE, DESIGN TOKEN GATE, UFS GATE, SCHEMA GUARD, GREPTILE GATE, Architecture consult, Coverage, and `/orly-write-unit-test`.
 <!-- oracle-packs:end -->
 
 ### VERIFY
 
-Run the repository's declared `verify.*` commands from `.oracle/orly.json`. A package-scoped command never replaces a listed one.
+**Two cadences, one boundary.** Inside a Section, run CONFORM plus the declared lane covering the surface the Section touched — enough to prove a Section, reported as a Section claim. The repository's full declared `verify.*` set runs ONCE, at the milestone boundary, before the PR. A package-scoped command never replaces a listed one at either cadence, and a Section lane never satisfies a "tests pass" claim about the repository.
 <!-- oracle-packs:start product.agentsfleet -->
-The `agentsfleet` output block and exact tiers live in `docs/VERIFY_TIERS.md`. **FIRST: `/orly-write-unit-test`** audits diff coverage. **LAST: the Test Delta row** compares against the CHORE(open) baseline; zero or negative unit growth on a code-adding diff needs justification or a return to EXECUTE. Paste memory-leak evidence into PR Session Notes or cite its Continuous Integration (CI) URL. After refactors, list newly dead code before removing it.
+The `agentsfleet` output block and both cadences live in `docs/VERIFY_TIERS.md`. **FIRST: `/orly-write-unit-test`** audits diff coverage. **LAST: the Test Delta row** compares against the CHORE(open) baseline; zero or negative unit growth on a code-adding diff needs justification or a return to EXECUTE. Paste memory-leak evidence into PR Session Notes or cite its Continuous Integration (CI) URL. After refactors, list newly dead code before removing it.
 <!-- oracle-packs:end -->
 
 ### REVIEW
@@ -250,7 +252,7 @@ Required when spec involved — after last COMMIT, before PR. Also runs when par
 
 | # | When | Skill |
 |---|---|---|
-| 1 | VERIFY | `/orly-write-unit-test`, then `/orly-write-integration-test` — both before the PR, never skipped, never deferred |
+| 1 | VERIFY | `/orly-write-unit-test` once per Section over that Section's diff, and again at the boundary — never skipped, never deferred. Then `/orly-write-integration-test` at the boundary **when the diff crosses a module boundary with real input/output**; otherwise record `N/A — <reason>` in Session Notes. |
 | 2 | REVIEW | gstack `/review` — every runtime, same route; address findings or record a user-acked deferral; reviewer unavailable → Session Notes: *"skipped — <reason> <ts>; rerun before merge"* |
 | 3 | After every push | `orly-babysit-prs` — CI check runs + greptile inline threads + PR-level summary; stops on two consecutive empty polls with CI green; never `gh pr checks --watch` for greptile |
 

package/dispatch/lib.sh

@@ -80,6 +80,7 @@ declare -A DISPATCH_GLOSS=(
   [LOG]="LOGging discipline (scoped event, error_code, severity, redaction)"
   [MSID]="Milestone-ID ban in source (M{N}_{NNN} / §x.y / T{N} / dim)"
   [ERR]="ERror Registry (UZ-XXX-NNN declared + referenced)"
+  [ERR-RS]="Rust ERror discipline (one type per crate, Result alias, no stringified cause)"
   [GRP]="GREptile rule audit (diff vs greptile-learnings/RULES.md codes)"
   [LDC]="Legacy-Design Consult (A remove / B patch / C keep)"
 )
@@ -92,13 +93,35 @@ dispatch_init() {
   DISPATCH_EXTS=("$@")
 }
 
+# Paths this repository's engine wrote, one per line, from the install record.
+#
+# A managed file is orly's, not the repository's: the next `orly update`
+# overwrites it, so a finding against one is a chore nobody can complete. Left
+# unfiltered, staging a fresh install put orly's own leaf helpers in front of
+# orly's own length gate — audits/logging.sh is 444 lines against a 350 cap —
+# and the first commit of an adoption failed on the adoption itself.
+dispatch_managed_paths() {
+  local config="$TARGET_ROOT/.oracle/orly.json"
+  [ -f "$config" ] || return 0
+  sed -n '/"managed"[[:space:]]*:[[:space:]]*\[/,/\]/p' "$config" \
+    | grep -oE '"[^"]+"' \
+    | sed -e 's/^"//' -e 's/"$//' \
+    | grep -vx 'managed' || true
+}
+
 # Resolve targets: explicit file args, or --staged self-discovery via git.
+# Explicit arguments are never filtered — naming a file is asking about it.
 dispatch_resolve_files() {
   DISPATCH_FILES=()
   if [ "${1:-}" = "--staged" ]; then
-    local pathspecs=() e
+    local pathspecs=() e managed
     for e in "${DISPATCH_EXTS[@]}"; do pathspecs+=("$e"); done
-    while IFS= read -r f; do [ -n "$f" ] && DISPATCH_FILES+=("$f"); done \
+    managed="$(dispatch_managed_paths)"
+    while IFS= read -r f; do
+      [ -n "$f" ] || continue
+      [ -n "$managed" ] && grep -qxF "$f" <<<"$managed" && continue
+      DISPATCH_FILES+=("$f")
+    done \
       < <(git -C "$TARGET_ROOT" diff --cached --name-only --diff-filter=ACMRT -- "${pathspecs[@]}" \
           | grep -vE '(^|/)(vendor|third_party|node_modules|\.zig-cache|dist|build|\.next)/' || true)
   elif [ "$#" -ge 1 ]; then
@@ -124,9 +147,11 @@ dispatch_resolve_files() {
 # dispatch must never claim a file its gates cannot parse.
 dispatch_add_shebang_files() {
   [ "${1:-}" = "--staged" ] || return 0
-  local f base path firstline
+  local f base path firstline managed
+  managed="$(dispatch_managed_paths)"
   while IFS= read -r f; do
     [ -n "$f" ] || continue
+    [ -n "$managed" ] && grep -qxF "$f" <<<"$managed" && continue
     base="${f##*/}"
     case "$base" in *.*) continue ;; esac
     path="$TARGET_ROOT/$f"; [ -f "$path" ] || path="$f"; [ -f "$path" ] || continue

package/dispatch/lifecycle.md

@@ -10,6 +10,33 @@ that moment. 🤔 judgment-only — no `.sh` pair; CONFORM's deterministic gates
 Section-scan first (`grep -n "^## " dispatch/lifecycle.md`); read the stage you
 are entering, not the whole file.
 
+## What runs at each stage
+
+The mechanical half of the lifecycle, in one table. Everything in the "runs"
+column is a command, not a claim — `orly gate` reads the repository's declared
+`.oracle/orly.json` commands and never invents one.
+
+| Stage | Runs | Fired by |
+|---|---|---|
+| CHORE(open) | the declared `verify.unit` once, to record `Test Baseline:` | the agent |
+| PLAN | nothing — no file mutations | — |
+| EXECUTE | the dispatch façade for each edited file type; DOC READ recorded via `audits/doc-read.sh log` | the agent, and the runtime's read hook where it has one |
+| CONFORM | the declared `conform` command | `orly gate work` — the generated pre-commit hook |
+| VERIFY (Section) | `conform` plus the declared lane covering the surface touched | the agent |
+| VERIFY (milestone) | the fast `verify.*` set: lint, unit, version | `orly gate verify` — the generated pre-push hook |
+| REVIEW | gstack `/review` over the diff | the agent |
+| DOCUMENT | nothing mechanical | — |
+| COMMIT | `conform` again, on the staged tree | the pre-commit hook |
+| CHORE(close) | every spec criterion, branch shape, clean tree, pushed branch, docs surface, and the slow `verify.*` suites | `orly gate pr`, by hand, before `gh pr create` |
+| LAND | nothing gated | — |
+
+Three properties hold this together. A gate only asks what it can answer
+honestly at that moment: `work` judges no git state, because a commit hook's
+tree is dirty by construction and a new spec is committed on the default branch.
+Each tier runs once per cadence — `conform` at commit, the fast set at push, the
+slow set at the close. And `orly gate pr` can skip the fast set because
+`git.pushed` proves HEAD is the commit pre-push already graded.
+
 ## CHORE (open) — runbook
 
 1. Spec `docs/v*/pending/` → `active/`; `Status: IN_PROGRESS`; `Branch:` set.

package/dispatch/verify.md

@@ -31,24 +31,52 @@ Package-scoped runners (`bun run test`, `vitest <file>`, `cargo test -p <crate>`
 are **not** verification — they skip every other package's lint and tests and the
 cross-language gates. The declared `make` targets are the canonical gates.
 
-## Required runs
+## Two cadences, one boundary
+
+"Always" is not a cadence. A Section closing and a milestone closing are
+different claims, and running the whole declared set at both spends the
+wall-clock of the comprehensive tier to answer a question the scoped lane
+already answered.
+
+The gates match those cadences: `orly gate work` runs the declared `conform`
+alone (every commit, seconds), `orly gate verify` runs the fast `verify.*` set
+(every push), and `orly gate pr` runs the whole-branch criteria and the slow
+suites (the close). Each tier runs once per cadence.
+
+**Section lane (per Section, and per done-claim inside one).** `make
+harness-verify` — the declared `conform`, seconds — plus the lane that covers
+the surface the Section touched (`make test-unit-rustd`, `make test-unit-app`,
+…). This proves a Section. It is not a repository claim and never satisfies a
+VERIFY row on its own.
+
+**Milestone boundary (once, at CHORE(close), before the PR).** Every command
+`.oracle/orly.json` declares, in one pass: `conform`, `verify.lint`,
+`verify.unit`, `verify.version`, and the slow tier (`verify.integration`,
+`verify.memory`). This is the repository claim, and it is what the done-message
+below reports.
+
+Run `orly gate pr` at the close. It does not re-run the fast tier, and it does
+not need to: its own `git.pushed` criterion proves HEAD is exactly the commit
+the pre-push `orly gate verify` already graded. A bare `orly gate` chains all
+three gates — use it on a branch whose earlier gates never ran.
 
 | Target | When |
 |---|---|
-| `make lint-all` | Always. The declared `verify.lint`. |
-| `make test-unit-all` | Always. The declared `verify.unit` — the cargo workspace plus every package coverage gate. |
-| `make harness-verify` | Always. The declared `conform` — the deterministic gate audit. |
-| `make check-version` | Always. The declared `verify.version`. |
+| `make harness-verify` | Section lane and boundary. The declared `conform` — the deterministic gate audit. |
+| `make lint-all` | Boundary. The declared `verify.lint`. |
+| `make test-unit-all` | Boundary. The declared `verify.unit` — the cargo workspace plus every package coverage gate. |
+| `make check-version` | Boundary. The declared `verify.version`. |
+| `make test-integration-rustd` | Boundary. The declared `verify.integration` — live Postgres and Redis; `orly gate pr` skips it on a branch carrying no code. |
 | `make wire-fixtures` | The `/v1/runners` wire types changed. Regenerate, then review the diff — a changed fixture IS the wire change. |
 | `make bench` (local) | Diff touches request-path code, allocator wiring, or startup/shutdown sequencing. |
 | `API_BENCH_URL=https://api-dev.agentsfleet.net/healthz make bench` | After branch deploys to dev. |
 | `/orly-write-integration-test` (skill) | With `/orly-write-unit-test` at VERIFY when the diff crosses module boundaries with real I/O; otherwise record `N/A — <reason>`. |
 | Acceptance e2e (live tier) | Diff touches a surface the live/acceptance tier covers — relevant suites green, or their opt-in skip matrix recorded. |
 
-There is no slow tier. The Zig integration and memory-leak lanes retired with the
-rest of the Zig gating, so nothing a developer runs needs live Postgres or Redis.
-A package-scoped runner (`cargo test -p afd_wire`, `bun run test` inside a
-package) proves that package and never the repository.
+The declared set in `.oracle/orly.json` is the source of truth for what exists,
+and a lane listed there is a lane that runs at the boundary — including the slow
+tier. A package-scoped runner (`cargo test -p afd_wire`, `bun run test` inside a
+package) proves that package and never the repository, at either cadence.
 
 ## Wire-fixture evidence rule
 
@@ -70,10 +98,16 @@ generated output; a type change with no fixture diff means the emitter never ran
 
 ## Required output (done-message)
 
-**Success:**
+**Success (boundary):**
 
 ```
-✅ Verified: 🧪 lint-all ✓ · 🧪 test-unit-all ✓ <N>p/<M>s · 🔆 harness-verify ✓ · 🔆 check-version ✓
+✅ Verified: 🧪 lint-all ✓ · 🧪 test-unit-all ✓ <N>p/<M>s · 🧩 test-integration-rustd ✓ · 🔆 harness-verify ✓ · 🔆 check-version ✓
+```
+
+**Success (Section lane)** — names the lane it ran, never the repository:
+
+```
+✅ Section verified: 🔆 harness-verify ✓ · 🧪 test-unit-<surface> ✓ <N>p/<M>s
 ```
 
 **Failure (any required target failed):**