@azure-id/orc 0.55.0

package/templates/skills/orc-claude/examples/claude-run-mock.md

@@ -0,0 +1,65 @@
+# Worked example — orc-claude runs (mock; orient only, never execute from this)
+
+## Run 1 — UPDATE (existing hand-written CLAUDE.md, 610 lines)
+
+U: /orc-claude
+C: CLAUDE.md exists, no orc-claude:meta header → UPDATE mode. Spawns
+   orc-claude-writer-opus-4-8-high (the skill never writes the file itself).
+W: Scans: pnpm monorepo (3 workspaces), turbo, eslint+prettier, vitest,
+   Postgres migrations under `packages/db/migrations`.
+W: Copies CLAUDE.md → CLAUDE.md.bak. Injects meta header (v0.0.1, 12-07-2026,
+   line-budget: 400) + P0 placeholder at top, appends fenced sections:
+   commands, layout (ownership map), conventions, boundaries, workflow,
+   decisions, patterns, gotchas placeholder, testing, environment, glossary
+   placeholder. Skips `adr` (nothing scannable). Existing 610 lines: untouched.
+
+```
+ORC-CLAUDE — update → CLAUDE.md v0.0.1 (12-07-2026)
+Sections written: p0*, commands, layout, conventions, boundaries, workflow,
+decisions, patterns, gotchas*, testing, environment, glossary*   (*=fill yourself)
+Skipped (empty scan): adr, pointers
+Preserved untouched: user content (610 lines), no wiki block found
+Conflicts flagged (NOT auto-edited):
+  - existing line 42 says "run yarn test" — repo uses pnpm (pnpm test)
+Backup: CLAUDE.md.bak written (add it to .gitignore)
+NOTE: file is 802 lines total (budget covers generated content only) — trim
+unused user content yourself for better instruction-following.
+```
+
+## Run 2 — REFRESH, one stale section
+
+U: /orc-claude   (weeks later; `test` script renamed to `test:unit` + `test:e2e`)
+C: Header found → REFRESH → spawns the writer.
+W: Recomputes fingerprints: only `commands` differs (e3f1a2 → 8c04b1). Writes
+   .bak, replaces the commands fence interior, bumps 0.0.1 → 0.0.2,
+   updated: 03-08-2026. User's edits outside fences + the wiki block:
+   byte-identical. Returns actual_model=claude-opus-4-8, actual_effort=high.
+
+## Run 3 — REFRESH, noop
+
+U: /orc-claude
+W: All fingerprints match →
+   `CLAUDE.md up to date (v0.0.2, 03-08-2026)` — no write, no bump, no bak.
+
+## Run 4 — behavior trace (permanent, always on)
+
+Same dispatch as any run, plus the minimal one-dispatch trace. The skill writes
+the run pointer (`run-claude-<slug>-<DDMMYY>-<HHMMSS>.txt` into `log_dir`)
+FIRST, records these events as they happen, and — as a single-dispatch lane —
+dispatches the trace writer ONCE at run end to append them (`SPAWN`/`RETURN`
+come from the `orc-trace.js` hook as they occur):
+
+```
+[120726 09:14:02.110] writer   DISPATCH orc-claude-writer :: refresh expect=opus-4-8/high
+[120726 09:14:02.230] hook     SPAWN orc-claude-writer-opus-4-8-high
+[120726 09:15:47.900] hook     RETURN
+[120726 09:15:48.010] writer   VERIFY writer actual=claude-opus-4-8/high ✅ MATCH
+[120726 09:15:48.120] writer   FINISH :: refresh CLAUDE.md v0.0.3
+```
+
+Then the writer packet returns and the run pointer is deleted (in that order).
+A noop refresh traces the same shape, ending
+`FINISH :: noop`. No phase/score/gate/finding/verdict markers — orc-claude
+runs none of those phases (they live inside the writer). The `orc-trace.js` hook
+bootstraps the pointer on the writer dispatch, so the SPAWN/RETURN skeleton is
+captured even if the skill's run-start step is skipped.

package/templates/skills/orc-claude/references/refresh.md

@@ -0,0 +1,76 @@
+# Reference — Refresh Protocol (section-scoped, fingerprint-driven)
+
+REFRESH runs when `CLAUDE.md` carries an `orc-claude:meta` header. It touches
+ONLY stale fenced sections — small drift means a small diff (one section body,
+the version, the date, one fingerprint).
+
+## Fingerprints
+
+Each scanned section's fingerprint is a 6-hex digest of the CANONICAL INPUT
+STRING that produced it — the inputs, not the prose — so cosmetic rewording of
+generated text never marks a section stale.
+
+Canonical input string per section (pipe-joined, sorted where a list):
+
+| Section | Canonical input |
+|---------|-----------------|
+| `whatis` | manifest name+description fields + top-level dir names |
+| `commands` | sorted `name=command` pairs of every verified script/target |
+| `layout` | sorted top-level dir names (+ workspace package names) |
+| `conventions` | sorted basenames+size of lint/format/type config files |
+| `boundaries` (scanned half) | sorted `.gitignore` non-comment lines + generated/vendored dir names |
+| `workflow` | CI workflow file basenames + detected branch/commit convention |
+| `decisions` | dependency-manifest name (tiebreakers only change if stack changes) |
+| `patterns` | sorted config basenames + primary language name |
+| `testing` | test-runner name + test dir names |
+| `adr` | manifest name+version field |
+| `environment` | sorted env-var names found |
+| `pointers` | sorted `docs/claude-*.md` basenames |
+
+Compute with a real command — never mentally:
+
+```bash
+node -e "console.log(require('crypto').createHash('md5').update(process.argv[1]).digest('hex').slice(0,6))" "<canonical input string>"
+```
+
+`@user` sections have no fingerprint and are NEVER regenerated. For
+`@user+scan` (boundaries), fingerprint and refresh only the scanned half; the
+user half is untouchable.
+
+## The refresh algorithm
+
+1. Parse the `orc-claude:meta` header (version, updated, line-budget,
+   sections map). Malformed header → treat the file as foreign → UPDATE mode.
+2. Run the Phase-1 scan; recompute every scanned section's fingerprint.
+3. Diff against the header's `name@fingerprint` entries →
+   - **stale**: fingerprint changed → regenerate that fence's interior.
+   - **new**: a section that now scans non-empty but isn't in the file →
+     append it (fenced) and add it to the header map.
+   - **gone**: a scanned section whose inputs vanished entirely (e.g. tests
+     removed) → leave the fence but note it in the report; never silently
+     delete (the user may want the history). Flag, don't cut.
+   - **@user**: skip always.
+4. **No stale/new sections** → print
+   `CLAUDE.md up to date (v<X.Y.Z>, <DD-MM-YYYY>)` and STOP. No write, no
+   bump, no bak.
+5. Otherwise: write `CLAUDE.md.bak` (overwrite the old bak), apply the
+   section replacements inside their fences only, bump `version` by exactly
+   0.0.1, set `updated:` to today (DD-MM-YYYY), rewrite the header's
+   fingerprint map, and re-emit the one-line visible trademark under the
+   header with the new version/date.
+6. Contradiction check: if the scan contradicts a user-authored line (e.g.
+   file says `yarn`, repo uses `pnpm`), list it under "Conflicts flagged" in
+   the report. NEVER edit the user's line.
+7. Budget: regenerated sections respect the persisted `line-budget` for
+   generated content, same overflow rule as CREATE (cut Zone B → `docs/` +
+   pointer). Existing user content never counts and is never trimmed.
+
+## Invariants (hold in every refresh)
+
+- Exactly +0.0.1 per content-changing run; no bump on noop.
+- DD-MM-YYYY everywhere a date is written.
+- Nothing outside `orc-claude:section` fences and the `orc-claude:meta`
+  header is ever modified.
+- The `ORC-WIKI:START`…`ORC-WIKI:END` block (owned by orc-wiki) is
+  byte-preserved even when it sits between generated sections.
+- Zero questions to the user, in every branch.

package/templates/skills/orc-claude/references/template.md

@@ -0,0 +1,109 @@
+# Reference — Generated CLAUDE.md Template
+
+The exact shape orc-claude writes. Two zones: **Zone A (rules)** first — the
+hot zone Claude must obey, kept short so nothing dilutes — then **Zone B
+(reference)** — lookup material (tables, maps, checklists). Behavioral rules
+never go in Zone B.
+
+Sections whose scan came back empty are OMITTED entirely (no stubs). `@user`
+sections are ALWAYS emitted as placeholders — they are the user's to fill and
+are never regenerated by refresh.
+
+## The meta header (top of file, before everything)
+
+```markdown
+<!-- orc-claude:meta
+generated-by: orc-claude
+version: 0.0.1
+updated: 12-07-2026
+line-budget: 400
+sections: p0@user | commands@e3f1a2 | layout@9b21cc | conventions@41ad07 | boundaries@user+scan | workflow@c0ffee | decisions@d00d01 | patterns@5eed42 | gotchas@user | testing@77c2e1 | adr@1decaf | environment@ab12cd | glossary@user | pointers@f00baa
+-->
+> Generated by **orc-claude** v0.0.1 — 12-07-2026. Run `/orc-claude` to
+> refresh stale sections only. Fill the placeholder sections yourself.
+```
+
+- `version` starts at `0.0.1`, bumps by exactly 0.0.1 per content-changing run.
+- `updated` is DD-MM-YYYY.
+- `sections:` lists only sections actually present, as `name@fingerprint`;
+  `@user` marks never-regenerated sections; `@user+scan` marks a section with
+  a scanned half (refreshable) and a user half (untouchable). Fingerprint
+  recipe: `references/refresh.md`.
+
+## The fence grammar
+
+Every generated section body sits inside:
+
+```markdown
+<!-- orc-claude:section commands -->
+...content...
+<!-- /orc-claude:section -->
+```
+
+Refresh replaces ONLY the interior of a stale section's fences. Anything the
+user writes OUTSIDE fences survives every run, verbatim. User edits INSIDE a
+scanned fence are lost on that section's next refresh — the report warns about
+this once.
+
+## Zone A — rules (target ≤ ~120 generated lines)
+
+| # | Section | Fence name | Source | ~Lines | Content |
+|---|---------|-----------|--------|-------|---------|
+| 1 | `# P0 — non-negotiable rules` | `p0` | `@user` | 15 | Placeholder below. |
+| 2 | `## What this is` | `whatis` | scan | 5 | 2–4 sentences: what the project does, who consumes it, the one architectural fact not obvious from the tree. |
+| 3 | `## Commands` | `commands` | scan | 25 | Verified-real only: install, dev/run, build, test (+ single-test form), lint, typecheck, migrate. Per-workspace table if monorepo. |
+| 4 | `## Boundaries` | `boundaries` | `@user+scan` | 15 | Scanned half: do-not-touch dirs (generated/vendored/legacy), lockfile + secrets rules, migration safety. User half: placeholder for zones only a human knows. |
+| 5 | `## Workflow` | `workflow` | scan | 15 | Branch/commit conventions (from git history + CI), the pre-done verification loop, PR checklist if CI defines one. |
+| 6 | `## Decision rules` | `decisions` | scan | 8 | 3–4 tiebreakers for ambiguity, e.g. "match existing patterns over introducing new ones; ask before adding dependencies". |
+
+### The P0 placeholder (emitted verbatim in CREATE/UPDATE)
+
+```markdown
+<!-- orc-claude:section p0 -->
+# P0 — non-negotiable rules
+**IMPORTANT: these override everything below. YOU (the human) must fill this
+section in yourself — orc-claude never writes rules on your behalf and never
+asks. Each rule: one line + a short *why*. Delete this notice when done.**
+- <your hard rule> — <why it exists>
+- <your hard rule> — <why it exists>
+<!-- /orc-claude:section -->
+```
+
+## Zone B — reference (the rest of the budget)
+
+| # | Section | Fence name | Source | ~Lines | Content |
+|---|---------|-----------|--------|-------|---------|
+| 7 | `## Layout` | `layout` | scan | 20 | Annotated top-level dirs (non-obvious ones only, never file-by-file). Monorepo → package ownership map + cross-package edit rules. |
+| 8 | `## Conventions` | `conventions` | scan | 30 | Deviations from defaults only: module system, "formatter owns style — don't hand-format", naming, error-handling shape, FE state/styling or BE API shape. |
+| 9 | `## Patterns & anti-patterns` | `patterns` | scan | 35 | Do/don't table WITH reasons, sampled from real code. Seeded by scan; user grows it. |
+| 10 | `## Gotchas` | `gotchas` | `@user` | 30 | Placeholder + note: "if you typed the same correction last session, it belongs here." Append-only; refresh never rewrites it. |
+| 11 | `## Testing` | `testing` | scan | 25 | Unit vs integration split, mocks-or-not, fixture locations, evidence rule: "never claim done without test/build output". |
+| 12 | `## Architecture decisions` | `adr` | scan | 25 | Mini-ADR list, one line each: decision + why + date. Scan seeds obvious ones; user/refresh appends. |
+| 13 | `## Environment` | `environment` | scan | 15 | Required env-var NAMES only (never values), local-setup quirks, external service boundaries. |
+| 14 | `## Domain glossary` | `glossary` | `@user` | 15 | Placeholder: business term ↔ code name mappings only a human knows. |
+| 15 | `## Pointers` | `pointers` | scan | 10 | `@docs/...` imports for anything that overflowed the budget. |
+
+`@user` placeholders (gotchas, glossary, boundaries' user half) each carry a
+one-line bold note that the user must fill them themself, mirroring the P0
+notice.
+
+## Budget rules
+
+- Default budget: **400 generated lines** (header + all fences). Persist the
+  effective budget in `line-budget:`; a user-passed `budget=N` argument
+  overrides and is persisted.
+- The budget NEVER applies to pre-existing user content. In UPDATE mode the
+  total file may exceed the budget — allowed; the report tells the user to
+  trim unused content themself.
+- Over budget at generation time → cut Zone B first (largest section first),
+  moving the overflow into `docs/claude-<section>.md` + an `@docs/...` line in
+  Pointers. Zone A is never cut.
+
+## Placement rules (UPDATE mode)
+
+- Meta header: very top of the file.
+- Generated sections: appended after existing content as one contiguous block,
+  EXCEPT the P0 placeholder, which goes directly under the meta header so the
+  hot zone stays on top.
+- Existing user headings are never moved to "make room".
+- The orc-wiki managed block stays exactly where it is, byte-identical.

package/templates/skills/orc-diy/README.md

@@ -0,0 +1,142 @@
+# ORC-DIY — Build your own ORC flow
+
+> This guide is intentionally separate from the main project README. The root
+> README covers installing and using the shipped lanes; **everything about
+> composing your own lane lives here.**
+
+ORC-DIY lets you assemble a custom orchestrator pipeline from ORC's real
+parts — keep the phases you want, drop the ones you don't, pick the session
+tier, and decide how autonomous the run is. The shape is chosen entirely in
+your **terminal** (deterministic, zero model tokens); Claude only ever runs
+the flow you compiled.
+
+```
+orc diy init          →  orc diy set … (repeat)  →  orc diy compile  →  /orc-diy <request>
+   (config created)       (shape your flow)          (build the flow)     (run it)
+```
+
+## 1. Bootstrap
+
+**Easiest path — the interactive composer.** Run bare `orc diy` in a real
+terminal: it creates the flow if none exists (pick full-lane defaults or a
+preset from a numbered list), then lets you shape every key with numbered
+pick-lists, shows the live gate status and validation issues as you go, and
+offers to compile on exit. Everything below is the same thing, non-interactive:
+
+```bash
+orc diy                         # interactive composer (create + shape + compile)
+orc diy init                    # scriptable: create the default config (full-lane shape)
+orc diy init --preset lean      # or start from a preset: lean | paranoid | solo-fast
+```
+
+This writes three project-scoped files (there is no global variant — `orc
+diy` rejects `--global`; one flow per project):
+
+| File | What it is | Who writes it |
+|---|---|---|
+| `.claude/orc-diy.config.yaml` | your flow choices | the CLI only |
+| `.claude/orc/diy/flow.md` | human-readable flow spec (regenerated on every change) | the CLI only |
+| `.claude/orc/diy/flow.lock.json` | hashes + compile stamp — the gate's state | the CLI only |
+
+## 2. Shape the flow
+
+```bash
+orc diy show                    # current flow + gate status (READY / STALE / UNCONFIGURED)
+orc diy set review blocking-only
+orc diy set verify smoke
+orc diy set scoring off
+orc diy set fixed_executor orc-executor-sonnet-5-high
+orc diy set session_tier opus-4-7-med
+orc diy set autonomy semi
+orc diy validate                # re-check cross-key rules any time
+```
+
+**`opus5_only` does not reach this lane.** That config forces every other
+lane's roles to Opus 5, but a DIY flow's executors come from `flow.lock.json`,
+which only `orc diy compile` writes. To run this lane on Opus 5, set
+`fixed_executor`/`session_tier` here and re-compile.
+
+The full key table lives in `references/flow-schema.md`. Highlights:
+
+- **Phases** — `analyze`, `review`, `security`, `verify`, `testgen`,
+  `summary`, `wiki_gate`: each phase has off/on/strictness values. Order is
+  fixed; you choose presence and strictness.
+- **Scoring** — `scoring on` keeps the per-task rubric; `scoring off` skips
+  it and sends every task to your `fixed_executor`.
+- **Session tier** — `session_tier` is the model+effort the compiled flow
+  requires. DIY is SEPARATE from the baseline /orc rule — pick any tier from the
+  full grid: `sonnet-4-6-{med,high}`, `opus-4-7-{med,high}`,
+  `opus-4-8-{med,high,xhigh,max}`, `opus-5-{med,high,xhigh,max}`,
+  `fable-5-{med,high,xhigh,max}` (default
+  `opus-4-8-high`). The effort guard enforces the effort half deterministically
+  (the compiled effort OR higher on the ladder); the statusline warns on the
+  model half. Executor choices above the tier are rejected at validate time; the
+  score table is clipped to the tier at compile time.
+- **Autonomy** — `interactive` (all asks), `semi` (routine asks
+  auto-accepted), `hands-off` (only hard stops + ship). Locked safety rules
+  are never overridden — see `references/locked-blocks.md` for what you can
+  NEVER configure away.
+- **Ship** — `ship_mode`: `ask`, `commit`, `pr`, or `report-only`.
+
+## 3. Compile
+
+```bash
+orc diy compile                 # deterministic stitch — no model, no tokens
+```
+
+The compiler validates, cherry-picks the needed references from your
+installed orc skill, stitches `.claude/orc/diy/FLOW-COMPILED.md`, and stamps
+`flow.lock.json`. Details: `references/compile.md`.
+
+**Every change requires a recompile.** The gate flips to STALE whenever:
+- you change any key (`orc diy set` …),
+- you update orc (`orc update` / `orc upgrade`),
+- the compiled file is edited or deleted.
+
+`/orc-diy` will not run a stale flow — it names the reason, tells you to run
+`orc diy compile`, and offers the regular `/orc` lane for the request at
+hand. `/orc-diy compile` in a session just runs the same CLI compiler.
+
+## 4. Run
+
+```
+/orc-diy implement the CSV export endpoint
+```
+
+The stub skill checks the gate, then follows your compiled flow: same run
+folders, checkpoints, subagents, and evidence rules as the full lane — minus
+the phases you removed, plus the strictness you chose.
+
+## Presets
+
+| Preset | Shape |
+|---|---|
+| `lean` | analyze off, review blocking-only, verify smoke, summary short |
+| `paranoid` | analyze full, security always, testgen on, verify full |
+| `solo-fast` | scoring off → one Sonnet 5 high executor, review off, verify smoke, autonomy semi |
+
+Presets are just config bundles — inspect with `orc diy show`, tweak with
+`set`, and compile like any other flow.
+
+## Command reference
+
+```
+orc diy                                    INTERACTIVE composer (create/shape/compile in one menu)
+orc diy init [--preset <name>] [--force]   create (or overwrite) the config
+orc diy show                               flow table + gate status
+orc diy status [--json]                    gate status only (used by the skill/hooks)
+orc diy set <key> <value>                  change one key (invalidates the compile)
+orc diy validate                           run cross-key validation
+orc diy compile                            build FLOW-COMPILED.md + stamp the lock
+orc diy reset                              delete config, flow, lock, and compiled file
+```
+
+## Boundaries (read before getting creative)
+
+- The CLI is the only writer. Never hand-edit the config, the lock, or the
+  compiled flow — and never ask Claude to; the skill refuses by contract.
+- `references/locked-blocks.md` is compiled into every flow verbatim: the
+  orchestrator never implements, checkpoint discipline, wave conflict rules,
+  the severity ladder, and red-build ship blocking are not yours to remove.
+- orc-diy needs the orc skill installed next to it (it cherry-picks by
+  reference); `orc init` installs both.

package/templates/skills/orc-diy/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: orc-diy
+description: >
+  User-composable ORC lane. Use for "/orc-diy" or "run my custom orc flow".
+  The pipeline shape (analyze/review/verify/security/testgen on-off, scoring
+  or a fixed executor, autonomy, ship mode, session tier) is configured
+  ENTIRELY through the `orc diy` CLI and compiled into a flow file —
+  never configured in-session. HARD-GATED: no config or a stale compile →
+  this skill never runs the custom flow; it explains the CLI steps and offers
+  plain /orc instead. "/orc-diy compile" re-runs the deterministic CLI
+  compiler. See references/flow-schema.md and references/compile.md.
+---
+
+# ORC-DIY (stub — gate + dispatcher)
+
+You are the entry gate for the user's compiled custom flow. You NEVER invent,
+modify, or interpret flow configuration in-session — the `orc diy` CLI is the
+only writer, the compiler is the only builder, and this stub only gates and
+dispatches. All state lives in the project's `.claude/` (project-scoped; no
+global variant).
+
+## Step 0 — route `compile`
+
+If the invocation argument is `compile` (from `/orc-diy compile`): run
+`orc diy compile` via Bash and relay its output. If the `orc` CLI is not on
+PATH, tell the user to run `orc diy compile` in their own terminal — do NOT
+reimplement the compiler in-session. Then end the turn. (`status` routes the
+same way to `orc diy status`.)
+
+## Step 1 — the hard gate (every other invocation)
+
+Run `orc diy status` via Bash and branch on the reported state. If the CLI is
+unavailable, apply the same checks manually from
+`.claude/orc-diy.config.yaml` + `.claude/orc/diy/flow.lock.json` per
+`references/flow-schema.md` — and treat ANYTHING you cannot verify as STALE
+(fail closed).
+
+- **UNCONFIGURED** — no config exists. Tell the user, in this order: what
+  orc-diy is (one sentence), the exact bootstrap
+  (`orc diy init` → optionally `orc diy set <key> <value>` →
+  `orc diy compile` — see the skill's README for the full guide), then ask
+  ONE question: *"Run this request through the regular full `/orc` lane
+  instead?"* Yes → invoke the `orc` skill with the user's original request
+  carried over verbatim. No → end the turn. Never proceed on an
+  unconfigured flow, and never write the config yourself.
+- **STALE** — configured but not runnable. Report the specific reason the
+  status gave (config changed since compile / orc was updated / compiled
+  flow modified or missing) and the fix (`orc diy compile`), then the same
+  single `/orc` fallback question as above. Never run a stale flow.
+- **READY** — proceed to Step 2.
+
+## Step 2 — dispatch the compiled flow
+
+Read `.claude/orc/diy/FLOW-COMPILED.md` and follow it as your orchestrator
+spine for this run — it is self-contained: tier self-check, locked rules,
+phase sequence, and the references it cherry-picks from the installed orc
+skill. Honor its generated header: if its own self-gate fails, stop exactly
+as it says. Do not consult this stub again for the rest of the run, and do
+not load orc's SKILL.md as a spine (the compiled flow already references the
+exact orc subskills and schemas it needs).
+
+## Hard rules
+
+1. The compiled flow is a build artifact — NEVER edit
+   `FLOW-COMPILED.md`, `flow.lock.json`, or `orc-diy.config.yaml` yourself,
+   and never "patch" the flow conversationally. Config changes go through
+   `orc diy set` + `orc diy compile`, both run by the user.
+2. Fail closed: any gate ambiguity = STALE, with the reason shown.
+3. The fallback ask is ONE question with two outcomes (`/orc` or stop) —
+   never a menu, never a silent fallback.

package/templates/skills/orc-diy/references/blocks/analyze.md

@@ -0,0 +1,24 @@
+## Phase: Analyze (doc intake)
+
+<!-- diy:when analyze=off -->
+Document analysis is DISABLED in this flow. If the user supplies a
+requirements document, tell them this flow skips analysis and will plan
+directly from their stated intent; offer `/orc-analyze` as a standalone step
+if they want the doc grounded first.
+<!-- /diy:when -->
+<!-- diy:when analyze=mini -->
+When the request includes a document (PDF path or pasted), dispatch the
+trimmed analyst: follow `.claude/skills/orc-analyze-mini/SKILL.md` and hand
+its requirement spec to planning. No doc → go straight to planning.
+<!-- /diy:when -->
+<!-- diy:when analyze=full -->
+When the request includes a document (PDF path or pasted), dispatch the full
+System Analyst: follow `.claude/skills/orc-analyze/SKILL.md` (the orchestrator
+dispatches; it never analyzes itself) and hand the requirement spec to
+planning. No doc → go straight to planning.
+<!-- /diy:when -->
+<!-- diy:when analyze=auto -->
+Route doc intake exactly as the full lane does: a document present triggers
+the System Analyst per the intake rules in
+`.claude/skills/orc/references/intake.md`; otherwise proceed to planning.
+<!-- /diy:when -->

package/templates/skills/orc-diy/references/blocks/execution.md

@@ -0,0 +1,42 @@
+## Phase: Execution (waves)
+
+Run execution exactly as the full lane's execution subskill defines it —
+follow `.claude/skills/orc/subskills/orc-execution/SKILL.md` (slices
+constructed by you, standing rules injected, evidence-bearing returns
+validated against the contract) with these compiled overrides:
+
+- Max parallel tasks per wave: **{{max_wave_tasks}}** (hard cap; overflow →
+  next wave; wave grouping per
+  `.claude/skills/orc/references/wave-grouping.md`).
+- Stop-and-continue pause every **{{batch_pause_every}}** waves (checkpoint
+  confirmed BEFORE announcing any stop; resume per
+  `.claude/skills/orc/references/stop-and-resume.md`).
+- Executor selection comes from this flow's scoring section above — never
+  from the shipped presets.
+
+<!-- diy:when tdd=on -->
+TDD execution: `tdd_spec` is SCOPED by each entry's `disposition` — only
+`new-surface` and `behavior-change` get tests; `covered-by-existing` (cited
+existing test) and `no-behavior` (constants, translation strings, docs, config)
+get none, and a task with cited `risk[]` is never scoped out. A PAIRED TDD task
+(never a Wave 0) materializes the remaining skeletons into real
+FAILING tests (red proven before implementation; a `new-surface` pre-implementation
+pass is a spec bug → block that requirement). Each implementation slice carries its
+`tdd_spec`; executors implement to green (implement→test→repair, cap
+`tdd_loop_max`; `TDD-RED`/`TDD-GREEN` per iteration) and return `tdd_state`
+per `.claude/skills/_shared/return-validation.md` — including §6's worktree
+delta: `git status --short` before/after each dispatch, any changed path
+outside `declared_files` (a revert included) gates the wave close.
+<!-- /diy:when -->
+
+<!-- diy:when gotchas=on -->
+Repair memory: probe `orc gotcha status` once at preflight (exit 0 = entries,
+1 = none — never a `find`) and print one line either way. Inject the
+SCOPE-MATCHING entries into each slice beside `pattern` — glob vs that task's
+`declared_files`, cap 3, highest `hits` first; zero matches = NO block, never an
+empty one, and NEVER unfiltered. A return that CLOSED a repair loop carries
+`gotcha_recorded`; dedupe it on `symptom`+`scope` (a match bumps `hits` and
+`last_seen`) and append it to `.claude/orc/gotchas.md` YOURSELF — a subagent never
+writes that file, and a loop that hit its cap and stopped records nothing. Full
+contract: `.claude/skills/_shared/gotchas.md`.
+<!-- /diy:when -->

package/templates/skills/orc-diy/references/blocks/extra.md

@@ -0,0 +1,55 @@
+## Phase: Extra — may an executor run OFF Claude?
+
+<!-- diy:when extra=on -->
+This flow ALLOWS a foreign executor. Canonical contract:
+`.claude/skills/_shared/extra-dispatch.md` — load it before the first dispatch.
+
+Two things must both be true or nothing routes foreign: `config.extra_enabled`
+is on, and a route row covers the score. Neither is decided here — **the flow
+key decides WHETHER, the resolver decides WHERE**, per task, at run time:
+
+```
+orc extra resolve <score> --role executor --risk <n> --json     # 0 foreign · 1 Claude
+```
+
+Route rows — **and slot rows** — are deliberately NOT baked into this compiled
+flow the way the score table is. The score table is clipped to this flow's
+session tier, so it is a compile-time fact; a route row and a slot row are a
+ledger the user edits independently, and `orc diy status` cannot see either one
+change. Baked rows would go stale in silence.
+
+**A DIY flow is a SCORED lane, so it resolves BANDS, not positions.** The six
+POSITIONS (`orc extra role`) belong to `/orc-quick`, `/orc-fast`, `/orc-doc` and
+`/orc-wiki`; nothing here reads one, and `fixed_executor:
+extra:<profile>/<provider>/<model>` is unchanged and remains band-free by
+construction.
+
+- **`scoring: off`** — this flow pins ONE executor, so there is no score.
+  Resolve that agent's **BAND at both edges and require them to agree**; a row
+  that covers the band only partially keeps the run on Claude and says so.
+- Print the `extra:` preflight line whenever the gate is on, before the first
+  dispatch — including on a run where nothing routed foreign. P0:
+  `a lane that sends work off Claude without saying so`.
+- Dispatch through `orc extra dispatch --task <file> --json` with the IDENTICAL
+  slice; validate the return with `return-validation.md` **§2b, not §2**; a
+  failure runs `orc extra reconcile <task_id>` FIRST — a worktree that moved is
+  RESUMED, never re-done (`a lane that re-does work the worktree already
+  contains` has broken the contract) — then falls back to the Claude band it
+  would have had, announced.
+- **Recovery is NOT compiled in.** The route rows already stay out of the
+  compiled lock file because they would go stale in silence; the same is true of
+  the recovery procedure. `orc extra reconcile` reads the journal at the moment
+  it is needed, and `config.extra_resume` decides whether a resume slice is
+  composed at all.
+- A cited-risk task never leaves Claude while `extra_risk_tasks` is `off`.
+<!-- /diy:when -->
+<!-- diy:when extra=off -->
+Extra is OFF in this flow. Every executor dispatch stays on Claude.
+
+**This is a decision the compile made, and it OUTRANKS the global setting.** If
+`config.extra_enabled` is on, say so once before the first dispatch — Extra is
+INERT here, exactly as `opus5_only` is inert in `/orc-quick`, and a shadowed
+setting must never be silent. Turning it on globally must never quietly change a
+flow the user compiled; that is what this key is for. To route foreign here, run
+`orc diy set extra on` and recompile.
+<!-- /diy:when -->

package/templates/skills/orc-diy/references/blocks/header.md

@@ -0,0 +1,55 @@
+<!-- GENERATED SOURCE BLOCK — stitched by `orc diy compile`. Edit the block
+     template in skills/orc-diy/references/blocks/, never the compiled file. -->
+# ORC-DIY compiled flow — {{flow_name}}
+
+> GENERATED — do not edit. Recompile with `orc diy compile` after any config
+> change. config_hash: `{{config_hash}}` · orc payload: `{{orc_version}}` ·
+> compiled: {{compiled_at}}
+
+You are the **orchestrator** for this custom flow. You run as
+**{{tier_model}} at {{tier_effort}} effort** — the tier this flow was compiled
+for. If you can tell you are on a LOWER model than {{tier_model}}, STOP and
+tell the user to switch: subagents cannot exceed the main-session tier, so
+every pinned agent below would silently downgrade.
+
+**Self-gate (run FIRST):** run `orc diy status` via Bash. **Exit 0 = READY;
+any non-zero means STOP** — tell the user the reported reason (it names every
+live trigger) and to run `orc diy compile`, then end. Never orchestrate from a
+stale compile.
+
+**Tier reconciliation (both directions).** Compare the session you are actually
+running as against `{{tier_model}}`:
+- **BELOW it** → STOP as stated above; every pinned agent would silently
+  downgrade.
+- **ABOVE it** → do NOT stop, but say so once: the executor table was CLIPPED
+  to `{{tier_model}}` at compile time and is frozen in this artifact, while the
+  pinned role agents (reviewer/verifier) are named verbatim and run at their
+  FULL pin — so a better session buys you better roles and the same clipped
+  executors, with nothing else telling you. Line to print:
+  *"compiled for {{tier_model}}, running higher — executors are clipped below
+  what this session supports; `orc diy set session_tier <tier> && orc diy
+  compile` to use the full ladder."* The session model is not part of any hash,
+  so `orc diy status` still reports READY — this line is the only signal.
+
+This flow reuses the full orchestrator's machinery by reference — schemas and
+subskills live under `.claude/skills/orc/`, the run folder + checkpoint under
+`.claude/orc/run/` (outside the installer's blast radius).
+Create the run folder first (`.claude/orc/run/{run-slug}/`), checkpoint
+eagerly, and treat disk as truth exactly as the locked rules below demand.
+
+<!-- diy:when autonomy=interactive -->
+**Autonomy: interactive.** Keep every user ask the referenced orc phases
+define — confirmations, gates, and escalations all go to the user.
+<!-- /diy:when -->
+<!-- diy:when autonomy=semi -->
+**Autonomy: semi.** Auto-accept advisory/preference asks using the referenced
+phase's stated default; still ASK the user for every P1-gating decision,
+scope change, and the ship decision. Log each auto-accepted ask in the
+decision log with the default you took.
+<!-- /diy:when -->
+<!-- diy:when autonomy=hands-off -->
+**Autonomy: hands-off.** Auto-accept every ask using the referenced phase's
+stated default and log it; the ONLY user interactions left are hard P0 stops
+(second-failure surface) and the ship step's own behavior below. Never let
+hands-off override a locked rule.
+<!-- /diy:when -->