@azure-id/orc 1.4.1 → 1.5.0

package/templates/commands/orc-test.md

@@ -0,0 +1,66 @@
+---
+description: Run the tests against the real running system — happy path to security — and report only what was observed
+---
+
+Use the **orc-test** skill. Standalone — no plan, no build, no code written into
+your project.
+
+Every other ORC lane reasons about your system. This one **runs it**:
+
+> **A test that ran is a FACT; a test that was written is an OPINION.**
+
+ORC already has a lane that WRITES tests and never runs them (Phase 6.5,
+`test-generator/`). This is the mirror image, and the two never mix: `/orc-test`
+writes nothing into your test tree and runs everything.
+
+**It never edits the system it is testing.** If the server will not come up, it
+prints exactly what it ran and the tail of the output, and hands back. You fix
+it, and re-run for free — the same shape as `/orc-challenge`, and for the same
+reason: a session that just fixed the code cannot be trusted to measure it.
+
+**It never reports a result it did not observe.** Three verdicts and no fourth:
+`pass` (observed, matched), `fail` (observed, did not match), and `unknown` —
+not observed. `unknown` keeps its slot in the report and never becomes a pass.
+A flake is recorded, never retried away: there is no retry count, because if the
+same case answers differently twice, *that instability is the finding*.
+
+One pass:
+
+1. **Target** — `orc test init <slug>` asks what it must not guess: back end or
+   front end, local or remote, the base URL. On a remote target it also requires
+   `--authorized "<who authorized this, and where it is recorded>"`, stored
+   verbatim and reprinted at the head of every report. ORC cannot verify
+   authorization and does not pretend to — it makes the assertion impossible to
+   skip. Frozen, and never asked again.
+2. **Surface** — free, deterministic: an OpenAPI or GraphQL spec on disk, the
+   same spec at the target, route extraction by framework fingerprint, FE router
+   config. Anything ambiguous comes back as `unresolved[]` and is never guessed.
+   The **code-vs-live diff** is a first-class output: routes that answer live and
+   exist in no source file are zombie APIs.
+3. **Flow** — it digs the repo for how a request reaches your endpoint: the
+   route registration, the middleware in order, the handler, what it writes, what
+   must be true first, which fields name an object, and the login flow itself.
+4. **Environment** (local only) — it brings the system up and waits for health.
+   Five states, one next action each.
+5. **Cases** — the CLI derives the bulk for free: equivalence partitions,
+   boundary values, method and content-type negatives, stateful create → read →
+   update → delete sequences. An agent fills only what a schema cannot know.
+6. **Run** — paced, capped, and fenced to the frozen origin. A 429 is a RESULT,
+   not an error: it means rate limiting works. Every case leaves its exact
+   request, its exact response and a reproducible `curl`, with every credential
+   redacted **before the bytes reach disk**.
+7. **Report** — `orc/orc-test/<slug>/REPORT.md`, written for someone who does
+   not read code.
+
+The security tier is a **closed set** mapped to the OWASP API Security Top 10
+(2023), and it demonstrates a CONDITION rather than an extraction — confirming
+an exploit is your decision on your authority. With one identity, BOLA and BFLA
+report `UNCHECKABLE`, which keeps its slot and never becomes a pass.
+
+**The run folder is never staged.** Evidence contains real response bodies from
+a real system. The lane offers you the one `.gitignore` line; it does not edit
+`.gitignore` itself.
+
+Read the state back any time without this lane: `orc test status <slug>`.
+
+The slug to open or reopen (or nothing, and it will ask): $ARGUMENTS

package/templates/hooks/README.md

@@ -205,12 +205,19 @@ them where you want them. One rule decides where a component may go:
 > A line may hold a component only if every line above it holds at least one.
 
 So line 1 must hold something before line 2 can, and line 2 before line 3. Each
-line holds at most five components. The panel will not let you make an illegal
+line holds at most six components. The panel will not let you make an illegal
 move, and it tells you why.
 
 Every component can be changed: its words, its colour, its shape, how wide it
 is, and when it is allowed to disappear.
 
+**The shape decides what the other settings can do.** Only these shapes print a
+short name in front of the value: `plain`, `label-value`, `bracket`, `angle`,
+`badge`, `pill` and `stack`. A bar, an icon and a bare value have no room for
+one, so the panel switches the Name box off for them and says so. The same is
+true of the number settings: a bar has a width and a colour ramp, and no number
+format at all.
+
 **Three things a terminal cannot do**, said plainly so you do not look for them:
 
 | You may want | What you get |

package/templates/hooks/orc-statusline.js

@@ -1147,16 +1147,27 @@ function custom(d, ctx) {
       if (!engine.BINDINGS[b]) return slFallback(orcDir, "statusline-layout-skew");
     }
 
-    // Rung 5. The cheap shape guard: at most three lines, at most five
+    // Rung 5. The cheap shape guard: at most three lines, at most `max_per_line`
     // components on any of them, and the dense-prefix rule —
     // A line may hold a component only if every line above it holds at least one.
+    //
+    // THE CAP AND THE COUNTING RULE ARE BOTH THE COMPILER'S (v1.4.2). This held
+    // its own `5` and counted EVERY item op, so it disagreed with the validator
+    // twice: it bounced a legal six-part line, and it bounced a legal five plus
+    // a spacer. Both fell silently back to the shipped lines with the reason
+    // only in a ledger file, which reads exactly like "my sixth part reset the
+    // bar to the default". The cap rides on the lock (already gated on
+    // `orc_version` at rung 3, so a stale copy cannot outlive its build) and
+    // the compiler marks a structural op `s` — this cannot know that on its
+    // own, because a compiled op carries an INSTANCE id and never a type.
     if (!Array.isArray(prog.lines) || prog.lines.length > 3)
       return slFallback(orcDir, "statusline-layout-invalid");
+    const cap = Number(lock.max_per_line) > 0 ? Number(lock.max_per_line) : 6;
     let seenEmpty = false;
     for (const l of prog.lines) {
-      const n = (l.ops || []).filter((o) => o.op === "item").length;
-      if (n > 5) return slFallback(orcDir, "statusline-layout-invalid");
-      if (n === 0) seenEmpty = true;
+      const ops = (l.ops || []).filter((o) => o.op === "item");
+      if (ops.filter((o) => !o.s).length > cap) return slFallback(orcDir, "statusline-layout-invalid");
+      if (ops.length === 0) seenEmpty = true;
       else if (seenEmpty) return slFallback(orcDir, "statusline-layout-invalid");
     }
 

package/templates/hooks/orc-subagent-line.js

@@ -182,10 +182,13 @@ function render(d, tasks) {
 
     // Rung 5. A subagent row is ONE line by construction — Claude Code renders
     // one row per task — so the board's three-line shape does not apply and the
-    // cheap guard is simply "one line, at most five things on it".
+    // cheap guard is simply "one line, at most `max_per_line` things on it".
     if (!Array.isArray(prog.lines) || !prog.lines.length) return null;
     const line = prog.lines[0];
-    if ((line.ops || []).filter((o) => o.op === "item").length > 5) return null;
+    // The same cap, from the same place, counted the same way (v1.4.2). A
+    // hardcoded number here is a second idea of how much one line may say.
+    const cap = Number(lock && lock.max_per_line) > 0 ? Number(lock.max_per_line) : 6;
+    if ((line.ops || []).filter((o) => o.op === "item" && !o.s).length > cap) return null;
 
     // Rung 6. One row per task, each rendered with THAT TASK bound.
     const now = Date.now();