@amsterdamdatalabs/enact-extensions 0.1.12 → 0.1.25

package/scripts/lib/run-install.mjs

@@ -2,6 +2,7 @@ import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { existsSync, readFileSync } from "node:fs";
 import {
+  activateClaudePlugin,
   installPluginBundle,
   installClaudePluginBundle,
   installCursorPluginBundle,
@@ -13,7 +14,7 @@ import {
 import { appendEntry } from "./ledger.mjs";
 import { bundleHash } from "./bundle-hash.mjs";
 import { provisionMcp, summarizeProvision } from "./provision-mcp.mjs";
-import { registerPluginHooks, removePluginHooks } from "./hooks.mjs";
+import { registerPluginHooks, removeHook, removePluginHooks } from "./hooks.mjs";
 import { assertSupportedHookEvents } from "../../dist/index.js";
 
 // scope: "global" (default) -> the agent's default home (~/.codex, ~/.enact/agent, ~/.claude, ~/.cursor, ~/.agents)
@@ -198,6 +199,33 @@ function readJsonIfExists(path) {
   }
 }
 
+function readCanonicalManifest(pluginRoot) {
+  return readJsonIfExists(join(pluginRoot, ".agents", "plugin.json"));
+}
+
+function supportedHostSurfaces(pluginRoot) {
+  const manifest = readCanonicalManifest(pluginRoot);
+  const rawTargets = manifest?.targets;
+  if (!Array.isArray(rawTargets)) return [...ALL_PLATFORMS];
+  return rawTargets.filter((target) => ALL_PLATFORMS.includes(target));
+}
+
+function assertRequestedPlatformsSupported(pluginRoot, requestedPlatforms) {
+  const supported = supportedHostSurfaces(pluginRoot);
+  const unsupported = requestedPlatforms.filter(
+    (platform) => ALL_PLATFORMS.includes(platform) && !supported.includes(platform),
+  );
+  if (unsupported.length === 0) return;
+
+  const manifest = readCanonicalManifest(pluginRoot);
+  const pluginName = typeof manifest?.name === "string" ? manifest.name : pluginRoot.split("/").pop();
+  const supportedLabel = supported.length > 0 ? supported.join(", ") : "(none)";
+  throw new Error(
+    `Plugin ${pluginName} does not target host surface(s): ${unsupported.join(", ")}. ` +
+      `Supported host surfaces: ${supportedLabel}`,
+  );
+}
+
 function readPluginHookConfig(pluginRoot) {
   const manifest = readJsonIfExists(join(pluginRoot, ".agents", "plugin.json"));
   const hooksPath = typeof manifest?.hooks === "string" ? manifest.hooks : null;
@@ -206,9 +234,16 @@ function readPluginHookConfig(pluginRoot) {
   return readJsonIfExists(join(pluginRoot, normalized));
 }
 
+function hookConfigHasEntries(hookConfig) {
+  const hooks = hookConfig?.hooks;
+  if (!hooks || typeof hooks !== "object" || Array.isArray(hooks)) return false;
+  return Object.values(hooks).some((entries) => Array.isArray(entries) && entries.length > 0);
+}
+
 function registerInstalledPluginHooks(pluginRoot, platform, result, homes, options) {
   // codex reads hooks from the installed plugin bundle (no config.toml
-  // registration); cursor likewise. claude/enact register into their config.
+  // registration); cursor likewise. claude/enact stay in the reconcile path
+  // only so removePluginHooks can clean legacy scattered runtime hooks.
   if (!["claude", "cursor", "enact"].includes(platform)) return;
   const hookConfig = readPluginHookConfig(pluginRoot);
   const name = result?.name ?? result?.results?.[0]?.name;
@@ -235,6 +270,20 @@ function registerInstalledPluginHooks(pluginRoot, platform, result, homes, optio
   }
 }
 
+function activateInstalledClaudePlugin(pluginRoot, result, homes, options) {
+  const hookConfig = readPluginHookConfig(pluginRoot);
+  if (!hookConfigHasEntries(hookConfig)) return;
+  const pluginId = `${result.name}@${result.marketplaceName ?? (options.marketplaceName ?? "enact-os-plugins")}`;
+  const activation = activateClaudePlugin(
+    homes.claudeHome,
+    pluginId,
+    result.marketplaceDir,
+    homes.scope,
+    options.claudeExec,
+  );
+  console.log(`claude plugin ${activation.action} -> ${pluginId}`);
+}
+
 function removeLegacyCodexPluginHooks(name, result, homes, options) {
   if (!name) return;
 
@@ -261,6 +310,21 @@ function removeLegacyCodexPluginHooks(name, result, homes, options) {
   }
 }
 
+function removeLegacyStandaloneDriftHook(platform, name, homes, options) {
+  if (name !== "enact-core") return;
+  const hookResult = removeHook(platform, {
+    claudeHome: homes.claudeHome,
+    codexHome: homes.codexHome,
+    cursorHome: homes.cursorHome,
+    enactHome: homes.enactHome,
+    local: homes.scope === "local",
+    cwd: options.cwd ?? process.cwd(),
+  });
+  if (hookResult.result === "removed") {
+    console.log(`removed legacy drift hook for ${name} on ${platform} -> ${hookResult.location}`);
+  }
+}
+
 // Append one install entry per installed target in a single-platform result.
 // Tolerant of every result shape (single platform, shared, codex multi-home).
 // `hash` is the pre-computed bundle hash (or null) for this install invocation.
@@ -318,6 +382,10 @@ function runSinglePlatform(pluginRoot, platform, homes, options, hash) {
     target.log(result);
     recordInstall(platform, result, homes, options, hash);
     registerInstalledPluginHooks(pluginRoot, platform, result, homes, options);
+    removeLegacyStandaloneDriftHook(platform, result?.name, homes, options);
+    if (platform === "claude") {
+      activateInstalledClaudePlugin(pluginRoot, result, homes, options);
+    }
     return result;
   }
 
@@ -337,6 +405,7 @@ function runSinglePlatform(pluginRoot, platform, homes, options, hash) {
   }
   recordInstall("codex", result, homes, options, hash);
   removeLegacyCodexPluginHooks(result.results[0]?.name, result, homes, options);
+  removeLegacyStandaloneDriftHook("codex", result.results[0]?.name, homes, options);
   return result;
 }
 
@@ -375,6 +444,7 @@ export function runInstall(pluginRoot, options = {}) {
   assertSupportedHookEvents(pluginRoot);
 
   const platforms = parsePlatforms(options.platform);
+  assertRequestedPlatformsSupported(pluginRoot, platforms);
   const homes = resolveHomes(options);
   console.log(`install scope: ${homes.scope}${homes.scope === "local" ? ` (${process.cwd()})` : ""}`);
 

package/scripts/lib/run-prune.mjs

@@ -3,7 +3,7 @@ import { homedir } from "node:os";
 import { cwd as processCwd } from "node:process";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { listInstalled } from "./ledger.mjs";
+import { appendEntry, listInstalled } from "./ledger.mjs";
 import { parsePlatforms, runUninstall } from "./run-uninstall.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -21,6 +21,10 @@ function sourceBundleExists(name, sourceRoots) {
   return sourceRoots.some((root) => existsSync(join(root, name, ".agents", "plugin.json")));
 }
 
+function installedSurfaceExists(entry) {
+  return Boolean(entry.path) && existsSync(entry.path);
+}
+
 function homeOptionForPlatform(platform) {
   switch (platform) {
     case "codex": return "codexHome";
@@ -32,6 +36,22 @@ function homeOptionForPlatform(platform) {
   }
 }
 
+function recordPruneTombstone(entry, ledgerHome, marketplaceName) {
+  appendEntry(
+    {
+      action: "uninstall",
+      name: entry.name,
+      version: entry.version ?? "0.0.0",
+      platform: entry.platform,
+      scope: entry.scope,
+      home: entry.home,
+      path: entry.path,
+      marketplaceName: entry.marketplaceName ?? marketplaceName,
+    },
+    { home: ledgerHome },
+  );
+}
+
 export function runPrune(options = {}) {
   const cwd = options.cwd ?? processCwd();
   const ledgerHome = options.ledgerHome ?? options.home ?? homedir();
@@ -43,7 +63,7 @@ export function runPrune(options = {}) {
   const candidates = installed
     .filter((entry) => platforms.has(entry.platform))
     .filter((entry) => entry.marketplaceName === marketplaceName)
-    .filter((entry) => !sourceBundleExists(entry.name, sourceRoots));
+    .filter((entry) => !sourceBundleExists(entry.name, sourceRoots) || !installedSurfaceExists(entry));
 
   const pruned = [];
   const failed = [];
@@ -63,6 +83,7 @@ export function runPrune(options = {}) {
         ledgerHome,
         version: entry.version,
       });
+      recordPruneTombstone(entry, ledgerHome, marketplaceName);
       pruned.push(entry);
     } catch (err) {
       failed.push({ entry, error: err instanceof Error ? err : new Error(String(err)) });

package/scripts/lib/run-sync.mjs

@@ -26,7 +26,10 @@ export function runSync(pluginRoot, { name } = {}) {
 
   const results = syncPlatformManifests(pluginRoot, enact);
   for (const r of results) {
-    console.log(`${r.written ? "wrote" : "skip"} ${r.manifestPath}`);
+    const generatedProjectionNote = /(^|\/)\.(claude|codex|cursor)-plugin\//.test(r.manifestPath)
+      ? " (generated preview only; normal install uses enact-extensions install)"
+      : "";
+    console.log(`${r.written ? "wrote" : "skip"} ${r.manifestPath}${generatedProjectionNote}`);
   }
   return results;
 }

package/scripts/postinstall.mjs

@@ -6,7 +6,7 @@
  *   - If NOT a TTY → print one-line notice and exit 0. NEVER hang.
  *   - If CI env var is set → print one-line notice and exit 0.
  *   - If ENACT_EXTENSIONS_NO_POSTINSTALL is set → print one-line notice and exit 0.
- *   - If interactive TTY (and not CI) → run `hooks setup` interactive picker.
+ *   - If interactive TTY (and not CI) → install `enact-core` across host surfaces.
  *   - Entire script is wrapped in try/catch → ALWAYS process.exit(0).
  *     A postinstall that throws would break `npm ci` in CI.
  *
@@ -14,7 +14,7 @@
  *   - Docker CI environments (CI=1, no TTY)
  *   - npm ci / npm install in CI pipelines
  *   - Automated install tooling (pipes, scripts)
- *   - Developer machines with interactive TTY (triggers the interactive picker)
+ *   - Developer machines with interactive TTY (triggers enact-core install)
  */
 
 try {
@@ -24,7 +24,7 @@ try {
   const isNoPostinstall = !!(env.ENACT_EXTENSIONS_NO_POSTINSTALL);
   const isTTY = !!(stdin.isTTY);
 
-  const NOTICE = `Run \`enact-extensions hooks setup\` to enable session-start drift checks.\n`;
+  const NOTICE = `Run \`enact-extensions install enact-core --platform all\` to enable session-start drift checks.\n`;
 
   if (!isTTY || isCI || isNoPostinstall) {
     // Non-interactive or CI: print notice and exit immediately.
@@ -32,7 +32,7 @@ try {
     process.exit(0);
   }
 
-  // Interactive TTY (non-CI): run the hooks setup interactive picker via CLI.
+  // Interactive TTY (non-CI): install enact-core, which now owns SessionStart.
   // We spawn a child process rather than importing directly to keep postinstall
   // isolated from any import-time side-effects in the CLI modules.
   const { spawnSync } = await import("node:child_process");
@@ -44,7 +44,7 @@ try {
 
   // Spawn with stdio inherited so the interactive readline prompt is visible.
   // We spawn and ignore the exit code — postinstall must always exit 0.
-  spawnSync(process.execPath, [CLI, "hooks", "setup"], {
+  spawnSync(process.execPath, [CLI, "install", "enact-core", "--platform", "all"], {
     stdio: "inherit",
     env: { ...process.env },
   });
@@ -54,7 +54,7 @@ try {
   // Printing to stderr is best-effort (safe to fail).
   try {
     process.stderr.write(
-      "[enact-extensions postinstall] Non-fatal error during hook setup. Run `enact-extensions hooks setup` manually.\n",
+      "[enact-extensions postinstall] Non-fatal error during enact-core install. Run `enact-extensions install enact-core --platform all` manually.\n",
     );
   } catch {
     // Even stderr.write failed — just exit 0.

package/scripts/setup-enact-context.sh

@@ -1,23 +1,28 @@
 #!/usr/bin/env bash
-# Wire enact-context setup into the enact-extensions workspace.
-# Validates the plugin-dev bundle then runs consolidated agent setup.
+# Install enact-context through the enact-extensions plugin system.
+#
+# This intentionally does NOT run `enact-context setup` or `doctor --fix`.
+# Those commands write direct host artifacts such as ~/.codex/AGENTS.md,
+# ~/.codex/hooks.json, and ~/.codex/skills/enact-context, bypassing plugin
+# enable/disable and uninstall semantics.
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-REPO_ROOT="$(cd "$ROOT/.." && pwd)"
-
-if ! command -v enact-context >/dev/null 2>&1; then
-  if [[ -x "$REPO_ROOT/enact-context/rust/target/release/enact-context" ]]; then
-    export PATH="$REPO_ROOT/enact-context/rust/target/release:$PATH"
-  else
-    echo "enact-context binary not found on PATH" >&2
-    exit 1
-  fi
-fi
 
 cd "$ROOT"
-npm run validate
+npm run build
+node scripts/enact-extensions.mjs validate extensions/enact-context
 
 echo ""
-echo "Running enact-context setup (claude, codex, opencode, enact, zed)..."
-enact-context setup "$@"
+echo "Installing enact-context via enact-extensions plugin registration..."
+if [[ " $* " == *" --platform "* ]]; then
+  node scripts/enact-extensions.mjs install enact-context "$@"
+else
+  node scripts/enact-extensions.mjs install enact-context --platform "${ENACT_CONTEXT_PLATFORM:-codex}" "$@"
+fi
+
+if ! command -v enact-context >/dev/null 2>&1; then
+  echo ""
+  echo "Note: enact-context runtime binary is not on PATH."
+  echo "Install the runtime separately; do not use 'enact-context setup' for Codex registration."
+fi

package/scripts/version-bump.sh

@@ -52,6 +52,7 @@ CURRENT_BRANCH=""
 INTEGRATION_BRANCH="integration"
 DRY_RUN=false
 DO_PUSH=false
+INTEGRATION_MODE=false
 
 # ─────────────────────────────────────────────────────────────────────────────
 usage() {
@@ -121,6 +122,7 @@ parse_args() {
       -f|--file)   VERSION_FILE="${2:?'--file requires a path'}"; file_given=true; shift 2 ;;
       -b|--branch) INTEGRATION_BRANCH="${2:?'--branch requires a name'}"; shift 2 ;;
       --push)      DO_PUSH=true; shift ;;
+      --integration) INTEGRATION_MODE=true; shift ;;
       -n|--dry-run) DRY_RUN=true; shift ;;
       -h|--help)   usage ;;
       *) die "Unknown option: '$1'. Run with --help." ;;
@@ -354,6 +356,19 @@ validate_branch() {
     info "Detached HEAD — branch from env: ${branch}"
   fi
 
+  # Integration mode: the bump runs on the integration build AFTER a PR merges
+  # and pushes the bump commit directly back to integration (the build service
+  # has "bypass policies when pushing"). The ***NO_CI*** commit message stops it
+  # from re-triggering. This avoids the pre-merge feature-branch bump that
+  # re-validated the PR (double pipeline run).
+  if $INTEGRATION_MODE; then
+    [[ "$branch" == "$INTEGRATION_BRANCH" ]] || \
+      die "Integration mode expects branch '${INTEGRATION_BRANCH}', currently on '${branch}'."
+    ok "On integration branch '${branch}' (integration mode — bump pushes directly)."
+    CURRENT_BRANCH="$branch"
+    return
+  fi
+
   [[ "$branch" =~ ^(feat|fix)/ ]] || \
     die "Expected a feat/* or fix/* branch, currently on '${branch}'. Version bump runs on feature branches before PR merge."
 
@@ -432,7 +447,13 @@ main() {
   parse_args "$@"
   resolve_manifest
   validate_branch
-  validate_version_unchanged   # exits 0 silently if version was manually bumped
+  if $INTEGRATION_MODE; then
+    # On integration we bump once per merge; the manual-bump guard (compare vs
+    # origin/integration) does not apply on integration itself.
+    CURRENT_VERSION="$(get_version)" || die "Cannot read current version from manifest."
+  else
+    validate_version_unchanged   # exits 0 silently if version was manually bumped
+  fi
 
   local new_version
   new_version="$(bump_patch "$CURRENT_VERSION")"

package/spec/codex.json

@@ -69,6 +69,11 @@
       "description": "Relative path to the skills directory.",
       "default": "./skills/"
     },
+    "agents": {
+      "type": "string",
+      "description": "Relative path to the canonical TOML agents directory.",
+      "default": "./agents/"
+    },
     "mcpServers": {
       "type": "string",
       "description": "Relative path to the .mcp.json MCP server configuration file.",

package/spec/enact.json

@@ -52,13 +52,13 @@
     },
     "targets": {
       "type": "array",
-      "description": "Agent platforms this plugin is built for. Drives platform-specific manifest generation.",
+      "description": "Supported install surfaces for this plugin. The canonical .agents/plugin.json is the Enact surface; claude/codex/cursor are derived projections.",
       "items": {
         "type": "string",
-        "enum": ["claude", "codex", "cursor"]
+        "enum": ["claude", "codex", "cursor", "enact"]
       },
       "uniqueItems": true,
-      "minItems": 1
+      "minItems": 0
     },
     "skills": {
       "type": "string",

package/spec/enact.md

@@ -10,14 +10,13 @@ Extend what Enact can do, for example:
 - Install the enact-context plugin to give agents deep code intelligence and semantic search.
 - Install the enact-wiki plugin to persist knowledge across sessions and projects.
 - Install the enact-loop plugin to run durable contract-verified work with independent judgment grading.
-- Install the enact-operator plugin for the full operator surface (team orchestration, HUD, doctor, and oversight tools).
 
 A plugin can contain:
 
 - **Skills:** reusable instructions for specific kinds of work. Agents load
   them on demand so they follow the right steps and use the right references
   or helper scripts for a task.
-- **Slash commands:** named commands invoked directly by the user (e.g. `/enact-operator:setup`)
+- **Slash commands:** named commands invoked directly by the user (e.g. `/plugin-name:command-name`)
   to trigger specific workflows without relying on automatic skill selection.
 - **MCP servers:** services that give agents access to additional tools or
   shared information, often from systems outside the local project.
@@ -90,8 +89,6 @@ If you want to keep a plugin installed but turn it off, set its entry in
 enabled = false
 ```
 
-> **Note:** enact-operator is also available in the registry for teams that need the full operator surface (HUD, doctor, team orchestration, oversight). enact-loop is the recommended default for contract-verified loop work.
-
 ## Build your own plugin
 
 Plugins live in a directory containing an `.agents/` folder with a `plugin.json`

package/spec/index.json

@@ -46,7 +46,7 @@
           "targets": {
             "type": "array",
             "items": { "type": "string" },
-            "description": "Agent platforms this plugin targets (e.g. claude, codex, cursor)."
+            "description": "Supported host surfaces for this plugin (e.g. claude, codex, cursor, enact)."
           },
           "path": {
             "type": "string",

package/extensions/enact-factory/hooks/hooks.json

@@ -1,14 +0,0 @@
-{
-  "hooks": {
-    "UserPromptSubmit": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "enact-factory hook user-prompt-submit"
-          }
-        ]
-      }
-    ]
-  }
-}

package/extensions/enact-operator/.agents/plugin.json

@@ -1,56 +0,0 @@
-{
-  "name": "enact-operator",
-  "version": "0.1.0",
-  "description": "First-party Enact Operator plugin surfaces for skills, commands, agents, MCP, and runtime hook registrations.",
-  "author": {
-    "name": "amsterdamdatalabs"
-  },
-  "homepage": "https://amsterdamdatalabs.com",
-  "repository": "https://dev.azure.com/amsterdamdatalabs/Enact/_git/enact-operator",
-  "license": "UNLICENSED",
-  "keywords": [
-    "enact",
-    "operator",
-    "orchestration",
-    "workflow"
-  ],
-  "targets": [
-    "claude",
-    "codex",
-    "cursor"
-  ],
-  "skills": "./skills/",
-  "agents": "./agents/",
-  "mcpServers": "./.mcp.json",
-  "apps": "./.app.json",
-  "interface": {
-    "displayName": "Enact Operator",
-    "shortDescription": "Installable surfaces for Enact Operator workflows.",
-    "longDescription": "Bundles the operator-owned Enact catalog. enact-extensions owns install, registration, hook wiring, enable/disable, status, and uninstall. Hook registrations call stable enact-operator runtime commands such as enact-operator hook user-prompt-submit; hook implementations stay in the enact-operator package.",
-    "developerName": "enact-operator",
-    "category": "Developer Tools",
-    "composerIcon": "./assets/icon.png",
-    "logo": "./assets/logo.png",
-    "capabilities": [
-      "skills",
-      "slash commands",
-      "operator workflows",
-      "team orchestration",
-      "operator setup",
-      "doctor and readiness audits",
-      "plan and execution workflows",
-      "review and QA workflows",
-      "federated context and memory workflows"
-    ]
-  },
-  "operator": {
-    "firstParty": true,
-    "bundledMcpProviders": [
-      "enact-factory",
-      "enact-context",
-      "enact-wiki"
-    ],
-    "operatorScope": "project"
-  },
-  "hooks": "./hooks/hooks.json"
-}

package/extensions/enact-operator/.app.json

@@ -1,3 +0,0 @@
-{
-  "apps": {}
-}

package/extensions/enact-operator/.mcp.json

@@ -1,10 +0,0 @@
-{
-  "mcpServers": {
-    "enact-operator": {
-      "command": "enact-operator",
-      "args": [
-        "mcp"
-      ]
-    }
-  }
-}

package/extensions/enact-operator/_taxonomy.md

@@ -1,86 +0,0 @@
-# Enact Operator Extension Taxonomy
-
-`extensions/` has three extension tiers. Each entry belongs to exactly one tier.
-
-## Pure skills
-
-Pure skills live at `extensions/skills/<name>/SKILL.md`.
-
-- No MCP tool surface
-- No persisted lane state
-- Prompt/context guidance only
-
-Current pure skills:
-
-- `ai-slop-cleaner`
-- `analyze`
-- `ask`
-- `autoresearch-goal`
-- `cancel`
-- `configure-notifications`
-- `deep-interview`
-- `doctor`
-- `hud`
-- `hyperplan`
-- `plan`
-- `remove-deadcode`
-- `research`
-- `review`
-- `security-research`
-- `setup`
-- `skill`
-- `tdd`
-- `trace`
-- `wiki`
-- `work-with-workitem`
-
-## Agents
-
-Codex subagents live at `extensions/agents/*.toml`.
-
-- Stateless worker contracts
-- Dispatched through Codex subagents
-- Installed into the Codex agents directory by setup
-
-The old exact-name collisions `architect`, `executor`, and `reviewer` were removed from `extensions/skills/` once their Codex agent TOMLs existed. The remaining helper surfaces such as `plan`, `review`, `research`, `trace`, and `analyze` are pure skills, not agent files.
-
-## Operator lanes
-
-Operator lanes remain under `extensions/skills/<name>/SKILL.md`, but they are explicitly tagged with:
-
-- `lane: true`
-- `mcpToolPrefix: operator_<lane>_`
-
-Lanes add:
-
-- MCP tool surfaces
-- persisted operator state
-- runtime lifecycle semantics
-
-**Classification rule:** an entry is a **root lane** if and only if it has both (a) a durable operator state file under `.enact/operator/state/` AND (b) an `mcpToolPrefix` field in its `SKILL.md` frontmatter. Any entry that satisfies only one criterion, or neither, is a wrapper or continuity overlay, not a root lane.
-
-### Root lanes
-
-Root lanes are the four autonomous runtime execution lanes that the scheduler assigns tasks to. Each has a durable state file and its own `mcpToolPrefix`.
-
-- `ralph`
-- `ultrawork`
-- `team`
-- `autopilot`
-
-### Continuity overlays
-
-Continuity overlays have an MCP surface and durable state, but serve as multi-session goal artifacts that wrap one or more root lanes rather than acting as independent scheduler candidates.
-
-- `ultragoal`
-
-### Wrappers
-
-Wrappers delegate execution to a root lane (typically ralph) and carry no independent durable state file of their own.
-
-- `ralplan`
-- `ultraqa`
-
-## Disambiguation rule
-
-No entry may straddle tiers. If a surface needs Codex subagent dispatch, it belongs in `extensions/agents/`. If it needs Operator MCP tools and durable state, it is a lane. Everything else is a pure skill.

package/extensions/enact-operator/agents/README.md

@@ -1,5 +0,0 @@
-# Enact Operator Agents
-
-Codex-compatible agent TOMLs live in this directory.
-
-The taxonomy contract is documented in [`../_taxonomy.md`](../_taxonomy.md). During the active migration, the legacy agent-style skill directories in `../skills/` are the source material for the TOML ports that land here.

package/extensions/enact-operator/agents/architect.toml

@@ -1,25 +0,0 @@
-name = "architect"
-description = "Architectural review and GO/NO-GO verdict with evidence pointers"
-model = "gpt-5.3-codex"
-model_reasoning_effort = "high"
-sandbox_mode = "danger-full-access"
-developer_instructions = """
-You are the Enact Operator architect agent.
-
-Role:
-- Read-only architectural reviewer.
-- Diagnose root causes from code and docs already on disk.
-- Produce a GO or NO-GO verdict with concrete evidence pointers.
-
-Rules:
-- Never edit files.
-- Never speculate when you can read the source.
-- Cite exact file paths and line references for material claims.
-- Call out tradeoffs, not just the favored direction.
-
-Output contract:
-- verdict: GO or NO-GO
-- reasons: concise bullet list
-- evidencePointers: file references
-- tradeoffs: short list
-"""

package/extensions/enact-operator/agents/code-reviewer.toml

@@ -1,24 +0,0 @@
-name = "code-reviewer"
-description = "Binding code review pass enforcing unconditional approval or actionable findings"
-model = "gpt-5.3-codex"
-model_reasoning_effort = "high"
-sandbox_mode = "danger-full-access"
-developer_instructions = """
-You are the Enact Operator code-reviewer agent.
-
-Role:
-- Perform the binding review pass after an implementation batch.
-- Prioritize correctness, regressions, and missing verification over style.
-
-Rules:
-- Never edit files.
-- Review only from the actual diff and surrounding code.
-- Every finding must cite a file reference and explain impact.
-- If no actionable issues remain, emit the token UNCONDITIONAL_APPROVE.
-- Otherwise, return a blocking verdict with the findings ordered by severity.
-
-Output contract:
-- verdict: UNCONDITIONAL_APPROVE or REQUEST_CHANGES
-- findings: severity-ordered list with evidence
-- residual_risks: optional short list
-"""