@azure-id/orc 1.9.1 → 2.0.2

package/templates/skills/orc-analyze/schemas/report-audit.md

@@ -1,83 +1,84 @@
-# Template — Analyst Report (AUDIT mode)
-
-Human-readable source of truth. You review and confirm this; the machine spec
-is derived from it. Written to analyst_report/{analysis-name}/report.md.
-
-```markdown
-# Analysis Report — {analysis-name}
-mode: audit
-depth: standard | deep
-source_doc: <path or "pasted">
-scope: <X — the requested scope only>
-analyzed_at: DDMMYY HH:MM:SS
-model: opus-5-high        # the RESOLVED model of the agent that produced this
-                          #   (mini writes sonnet-5-high) — never copied from here
-grounding: repo-read | repo-read+scouts   # scouts only in deep mode
-
-## In-scope rows (X only)
-
-Each row = one audit line that belongs to scope X, reconciled against code. Every
-"Code reality" cell carries quote-anchored file:line evidence
-(`file:line — "verbatim snippet"`, never paraphrased; a ref with no quote
-auto-downgrades to UNVERIFIED), OR the row is tagged ASSUMPTION/UNVERIFIED (and
-appears below as an open question). A row whose code reality is a claim of
-ABSENCE ("no retry exists") instead carries `searched:` — the concrete
-globs/greps run. In deep mode EVERY row is verified, not just the load-bearing
-ones.
-
-| # | Claim (result + notes) | Code reality | Evidence (file:line + quote / searched:) | Files/modules | Status | Resolution |
-|---|------------------------|--------------|------------------------------------------|---------------|--------|------------|
-| 1 | PASS — "UUID validated" | present | auth/uuid.x:8 — "validateUuid(id)" | auth/uuid.x | verified | — |
-| 2 | PASS — notes: "consider adding retry" | no retry | searched: `retry`, `backoff` in svc/ — no hits | svc/x | diverged | user: retry OUT of scope |
-| 3 | FAIL — "missing UUID check" | field renamed to ref_id | models/user.x:20 — "ref_id:" | models/x | diverged | user: update premise; check ref_id |
-
-Status: verified | diverged | resolved
-- verified: claim matches code (with evidence), nothing to challenge.
-- diverged: claim vs code mismatch → was challenged.
-- resolved: a diverged row the user decided on (Resolution column holds the call).
-
-## Assumptions & Open Questions
-- UNVERIFIED (resolved): row 7 cited a "legacy flag" not found in code — user
-  confirmed it was removed; row dropped.
-
-## Additional context (do not build)
-Anchored, non-actionable context pulled from an ADJACENT scope because an in-scope
-row depends on it. Read for understanding; never a task. Each item names the
-in-scope row it serves + why. Omit this whole section if none survived.
-| Anchor (in-scope #) | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
-|---------------------|-----------|------------|-----------------------|----------------------|
-| Row 3 (ref_id check) | models (Y) | consumes-output | ref_id is set by the user loader before validation | models/user.x:20 |
-
-## Alternatives & risks   (DEEP mode only — omit in standard)
-- Row 3 fix: add ref_id check in the model (recommended) vs at the API edge —
-  edge version duplicates validation across 3 handlers.
-
-## Challenges raised & answers
-- Row 2: notes suggested retry — user confirmed OUT of scope X.
-- Row 3: audit says missing UUID check, code renamed field to ref_id — user
-  confirmed implement the check against ref_id.
-
-## Row numbering — `R#` is the SPEC's namespace, never the report's
-Refer to report rows as **"row N"** only. Labelling a report row `R1` collides
-with the spec's own `R#` ids, and the derivation lint compares the two id sets:
-report-`R1` (a build item) vs spec-`R1` (audit row 1) either false-passes or
-false-bounces. A row that legitimately duplicates another's `files[]` (e.g. a
-doc's closing `Recommendation:` line) carries `yields_build_work: false` in the
-spec rather than a prose qualifier.
-
-## Excluded scopes (recognized, not detailed)
-- Recognized Y, Z in the source doc; excluded from this report per scope = X.
-
-## Handoff readiness (checklist — all five or handoff_ready is false)
-The first three are checkable IN this report. The last two can only become true
-AFTER this report is confirmed and frozen, so on a correct run they stay
-unticked here and are satisfied in the spec — a reader of report.md alone must
-not read that as a failed checklist.
-- [ ] all BLOCKING challenges resolved (every diverged row decided)
-- [ ] zero open UNVERIFIED on any in-scope row
-- [ ] every row has status + evidence-or-resolution
-- [ ] spec derived AFTER the user confirmed this report  (satisfied
-      post-confirmation — see the spec)
-- [ ] scope_closed: true written into the spec  (satisfied post-confirmation —
-      see the spec)
-```
+# Template — Analyst Report (AUDIT mode)
+
+Human-readable source of truth. You review and confirm this; the machine spec
+is derived from it. Written to `<analyzer_dir>/{analysis-name}/report.md`;
+COPIED to `<report_out_dir>/{analysis-name}/` only on the stop-here branch.
+
+```markdown
+# Analysis Report — {analysis-name}
+mode: audit
+depth: standard | deep
+source_doc: <path or "pasted">
+scope: <X — the requested scope only>
+analyzed_at: DDMMYY HH:MM:SS
+model: opus-5-5-high      # the RESOLVED model of the agent that produced this
+                          #   (mini writes sonnet-5-high) — never copied from here
+grounding: repo-read | repo-read+scouts   # scouts only in deep mode
+
+## In-scope rows (X only)
+
+Each row = one audit line that belongs to scope X, reconciled against code. Every
+"Code reality" cell carries quote-anchored file:line evidence
+(`file:line — "verbatim snippet"`, never paraphrased; a ref with no quote
+auto-downgrades to UNVERIFIED), OR the row is tagged ASSUMPTION/UNVERIFIED (and
+appears below as an open question). A row whose code reality is a claim of
+ABSENCE ("no retry exists") instead carries `searched:` — the concrete
+globs/greps run. In deep mode EVERY row is verified, not just the load-bearing
+ones.
+
+| # | Claim (result + notes) | Code reality | Evidence (file:line + quote / searched:) | Files/modules | Status | Resolution |
+|---|------------------------|--------------|------------------------------------------|---------------|--------|------------|
+| 1 | PASS — "UUID validated" | present | auth/uuid.x:8 — "validateUuid(id)" | auth/uuid.x | verified | — |
+| 2 | PASS — notes: "consider adding retry" | no retry | searched: `retry`, `backoff` in svc/ — no hits | svc/x | diverged | user: retry OUT of scope |
+| 3 | FAIL — "missing UUID check" | field renamed to ref_id | models/user.x:20 — "ref_id:" | models/x | diverged | user: update premise; check ref_id |
+
+Status: verified | diverged | resolved
+- verified: claim matches code (with evidence), nothing to challenge.
+- diverged: claim vs code mismatch → was challenged.
+- resolved: a diverged row the user decided on (Resolution column holds the call).
+
+## Assumptions & Open Questions
+- UNVERIFIED (resolved): row 7 cited a "legacy flag" not found in code — user
+  confirmed it was removed; row dropped.
+
+## Additional context (do not build)
+Anchored, non-actionable context pulled from an ADJACENT scope because an in-scope
+row depends on it. Read for understanding; never a task. Each item names the
+in-scope row it serves + why. Omit this whole section if none survived.
+| Anchor (in-scope #) | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
+|---------------------|-----------|------------|-----------------------|----------------------|
+| Row 3 (ref_id check) | models (Y) | consumes-output | ref_id is set by the user loader before validation | models/user.x:20 |
+
+## Alternatives & risks   (DEEP mode only — omit in standard)
+- Row 3 fix: add ref_id check in the model (recommended) vs at the API edge —
+  edge version duplicates validation across 3 handlers.
+
+## Challenges raised & answers
+- Row 2: notes suggested retry — user confirmed OUT of scope X.
+- Row 3: audit says missing UUID check, code renamed field to ref_id — user
+  confirmed implement the check against ref_id.
+
+## Row numbering — `R#` is the SPEC's namespace, never the report's
+Refer to report rows as **"row N"** only. Labelling a report row `R1` collides
+with the spec's own `R#` ids, and the derivation lint compares the two id sets:
+report-`R1` (a build item) vs spec-`R1` (audit row 1) either false-passes or
+false-bounces. A row that legitimately duplicates another's `files[]` (e.g. a
+doc's closing `Recommendation:` line) carries `yields_build_work: false` in the
+spec rather than a prose qualifier.
+
+## Excluded scopes (recognized, not detailed)
+- Recognized Y, Z in the source doc; excluded from this report per scope = X.
+
+## Handoff readiness (checklist — all five or handoff_ready is false)
+The first three are checkable IN this report. The last two can only become true
+AFTER this report is confirmed and frozen, so on a correct run they stay
+unticked here and are satisfied in the spec — a reader of report.md alone must
+not read that as a failed checklist.
+- [ ] all BLOCKING challenges resolved (every diverged row decided)
+- [ ] zero open UNVERIFIED on any in-scope row
+- [ ] every row has status + evidence-or-resolution
+- [ ] spec derived AFTER the user confirmed this report  (satisfied
+      post-confirmation — see the spec)
+- [ ] scope_closed: true written into the spec  (satisfied post-confirmation —
+      see the spec)
+```

package/templates/skills/orc-analyze/schemas/report-prose.md

@@ -1,63 +1,64 @@
-# Template — Analyst Report (PROSE mode)
-
-Human-readable source of truth. Written to analyst_report/{analysis-name}/report.md.
-
-```markdown
-# Analysis Report — {analysis-name}
-mode: prose
-depth: standard | deep
-source_doc: <path or "pasted">
-scope: <X — the requested scope only>
-analyzed_at: DDMMYY HH:MM:SS
-model: opus-5-high        # the RESOLVED model of the agent that produced this
-                          #   (mini writes sonnet-5-high) — never copied from here
-grounding: repo-read | repo-read+scouts   # scouts only in deep mode
-
-## In-scope requirements (X only)
-
-Every "Code reality" cell carries quote-anchored file:line evidence
-(`file:line — "verbatim snippet"`, never paraphrased; a ref with no quote
-auto-downgrades to UNVERIFIED), OR the row is tagged ASSUMPTION/UNVERIFIED (and
-appears below as an open question). Absence claims (status missing) instead
-carry `searched:` — the concrete globs/greps run.
-
-| # | Requirement (from doc) | Code reality | Evidence (file:line + quote / searched:) | Files/modules | Status | Resolution |
-|---|------------------------|--------------|------------------------------------------|---------------|--------|------------|
-| 1 | "notifications must paginate" | list is unbounded | searched: `paginate`, `cursor`, `limit` in api/notifications — no hits | api/notifications/x | missing | implement pagination |
-| 2 | "respect existing auth" | auth middleware present | auth/mw.x:10 — "app.use(requireAuth)" | auth/mw.x | exists | reuse, no change |
-
-Status: exists | missing | conflict | resolved
-
-## Assumptions & Open Questions
-Anything not grounded to code, plus every ambiguity — each was raised as a
-recommended-option challenge and resolved (or is still open).
-- ASSUMPTION (resolved): "paginate" = cursor-based (recommended) — user confirmed.
-- UNVERIFIED (open): whether a rate-limit already exists — evidence not found.
-
-## Additional context (do not build)
-Anchored, non-actionable context pulled from an ADJACENT scope because an in-scope
-requirement depends on it. Read for understanding; never a task. Each item names
-the in-scope requirement it serves + why. Omit this whole section if none survived.
-| Anchor (in-scope #) | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
-|---------------------|-----------|------------|-----------------------|----------------------|
-| Req 1 (pagination) | listing (Y) | guards-invariant | shared list serializer caps a page at 100 | api/serializers/list.x:31 |
-
-## Alternatives & risks   (DEEP mode only — omit in standard)
-- Approach A (recommended): reuse existing cursor helper — low blast radius, 3 files.
-- Approach B: new offset paginator — simpler read, breaks existing cursor clients.
-- Risk: pagination touches the shared list serializer (dependents: 4 call sites).
-
-## Challenges raised & answers
-- Req 3 appeared to require an admin panel (belongs to scope Z) — user confirmed
-  OUT of scope X.
-
-## Excluded scopes (recognized, not detailed)
-- Recognized Y, Z; excluded per scope = X.
-
-## Handoff readiness (checklist — all five or handoff_ready is false)
-- [ ] all BLOCKING challenges resolved
-- [ ] zero open UNVERIFIED on any in-scope requirement
-- [ ] every requirement has status + evidence-or-resolution
-- [ ] spec derived AFTER the user confirmed this report
-- [ ] scope_closed: true written into the spec
-```
+# Template — Analyst Report (PROSE mode)
+
+Human-readable source of truth. Written to `<analyzer_dir>/{analysis-name}/report.md`;
+COPIED to `<report_out_dir>/{analysis-name}/` only on the stop-here branch.
+
+```markdown
+# Analysis Report — {analysis-name}
+mode: prose
+depth: standard | deep
+source_doc: <path or "pasted">
+scope: <X — the requested scope only>
+analyzed_at: DDMMYY HH:MM:SS
+model: opus-5-5-high      # the RESOLVED model of the agent that produced this
+                          #   (mini writes sonnet-5-high) — never copied from here
+grounding: repo-read | repo-read+scouts   # scouts only in deep mode
+
+## In-scope requirements (X only)
+
+Every "Code reality" cell carries quote-anchored file:line evidence
+(`file:line — "verbatim snippet"`, never paraphrased; a ref with no quote
+auto-downgrades to UNVERIFIED), OR the row is tagged ASSUMPTION/UNVERIFIED (and
+appears below as an open question). Absence claims (status missing) instead
+carry `searched:` — the concrete globs/greps run.
+
+| # | Requirement (from doc) | Code reality | Evidence (file:line + quote / searched:) | Files/modules | Status | Resolution |
+|---|------------------------|--------------|------------------------------------------|---------------|--------|------------|
+| 1 | "notifications must paginate" | list is unbounded | searched: `paginate`, `cursor`, `limit` in api/notifications — no hits | api/notifications/x | missing | implement pagination |
+| 2 | "respect existing auth" | auth middleware present | auth/mw.x:10 — "app.use(requireAuth)" | auth/mw.x | exists | reuse, no change |
+
+Status: exists | missing | conflict | resolved
+
+## Assumptions & Open Questions
+Anything not grounded to code, plus every ambiguity — each was raised as a
+recommended-option challenge and resolved (or is still open).
+- ASSUMPTION (resolved): "paginate" = cursor-based (recommended) — user confirmed.
+- UNVERIFIED (open): whether a rate-limit already exists — evidence not found.
+
+## Additional context (do not build)
+Anchored, non-actionable context pulled from an ADJACENT scope because an in-scope
+requirement depends on it. Read for understanding; never a task. Each item names
+the in-scope requirement it serves + why. Omit this whole section if none survived.
+| Anchor (in-scope #) | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
+|---------------------|-----------|------------|-----------------------|----------------------|
+| Req 1 (pagination) | listing (Y) | guards-invariant | shared list serializer caps a page at 100 | api/serializers/list.x:31 |
+
+## Alternatives & risks   (DEEP mode only — omit in standard)
+- Approach A (recommended): reuse existing cursor helper — low blast radius, 3 files.
+- Approach B: new offset paginator — simpler read, breaks existing cursor clients.
+- Risk: pagination touches the shared list serializer (dependents: 4 call sites).
+
+## Challenges raised & answers
+- Req 3 appeared to require an admin panel (belongs to scope Z) — user confirmed
+  OUT of scope X.
+
+## Excluded scopes (recognized, not detailed)
+- Recognized Y, Z; excluded per scope = X.
+
+## Handoff readiness (checklist — all five or handoff_ready is false)
+- [ ] all BLOCKING challenges resolved
+- [ ] zero open UNVERIFIED on any in-scope requirement
+- [ ] every requirement has status + evidence-or-resolution
+- [ ] spec derived AFTER the user confirmed this report
+- [ ] scope_closed: true written into the spec
+```

package/templates/skills/orc-analyze/schemas/report-requirement.md

@@ -1,78 +1,78 @@
-# Template — Analyst Report (REQUIREMENT mode — no document)
-
-Used when there is NO source document: the user's plain-language request IS the
-requirement, reconciled against the existing code. Human-readable source of
-truth. Written to `<analyzer_dir>/{analysis-name}/report.md` (config
-`analyzer_dir` — the internal artifact dir); it is COPIED to
-`<report_out_dir>/{analysis-name}/report.md` only on the report-only /
-stop-here branch. The old "written to analyst_report/…" wording described the
-copy target as if it were the write target.
-
-```markdown
-# Analysis Report — {analysis-name}
-mode: requirement
-depth: standard | deep
-source: "pasted request"        # the user's own words, verbatim
-scope: <X — the requested scope only>
-analyzed_at: DDMMYY HH:MM:SS
-model: opus-5-high        # the RESOLVED model of the agent that produced this
-                          #   (mini writes sonnet-5-high) — never copied from here
-grounding: repo-read | repo-read+scouts   # scouts only in deep mode
-
-## Restated requirement (analyst's words)
-One or two sentences restating the request — restating is what surfaces
-misreadings. If the restatement rests on any assumption, tag it and ask.
-
-## In-scope requirement parts (X only)
-
-Each part of the request, reconciled against code. Every "Code reality" cell
-carries quote-anchored file:line evidence (`file:line — "verbatim snippet"`,
-never paraphrased; a ref with no quote auto-downgrades to UNVERIFIED), OR the
-part is tagged ASSUMPTION/UNVERIFIED (and appears below as an open question).
-Absence claims (status missing/buildable) instead carry `searched:` — the
-concrete globs/greps run. In deep mode EVERY part is verified.
-
-| # | Requirement part (from request) | Code reality | Evidence (file:line + quote / searched:) | Files/modules | Status | Resolution |
-|---|---------------------------------|--------------|------------------------------------------|---------------|--------|------------|
-| 1 | "add CSV export to reports" | reports render HTML only | searched: `export*`, `csv`, `download` — no hits | web/reports/x | missing | new export path |
-| 2 | "reuse current auth" | auth guard on report routes | web/reports/routes.x:12 — "requireAuth(" | web/reports/x | exists | reuse, no change |
-
-Status: buildable | exists | conflict | resolved
-- buildable: not present, but consistent with the code — safe to build.
-- exists: already implemented — flag so the planner doesn't duplicate.
-- conflict: request contradicts existing behavior → challenged.
-- resolved: a challenged part the user decided on.
-
-## Assumptions & Open Questions
-Every ambiguity in the request + anything not grounded to code. Each raised as a
-recommended-option challenge and resolved (or still open).
-- ASSUMPTION (resolved): "export" = download file (recommended) vs email — user
-  confirmed download.
-- UNVERIFIED (open): whether a reports permission gate exists — evidence not found.
-
-## Additional context (do not build)
-Anchored, non-actionable context pulled from an ADJACENT scope because an in-scope
-request part depends on it. Read for understanding; never a task. Each item names
-the in-scope part it serves + why. Omit this whole section if none survived.
-| Anchor (in-scope #) | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
-|---------------------|-----------|------------|-----------------------|----------------------|
-| Part 1 (CSV export) | reporting (Y) | consumes-output | report query already paginates; export must page too | web/reports/query.x:44 |
-
-## Alternatives & risks   (DEEP mode only — omit in standard)
-- Approach A (recommended): stream CSV from the existing query — low blast radius.
-- Approach B: precompute + cache — faster reads, adds a cache dependency.
-- Risk: export reuses the report query (dependents: 2 schedulers).
-
-## Challenges raised & answers
-- Part 3 ("admin-only export") looked like scope Z (admin) — user confirmed OUT.
-
-## Excluded scopes (recognized, not detailed)
-- Recognized Y, Z implied by the request; excluded per scope = X.
-
-## Handoff readiness (checklist — all five or handoff_ready is false)
-- [ ] all BLOCKING challenges resolved
-- [ ] zero open UNVERIFIED on any in-scope part
-- [ ] every part has status + evidence-or-resolution
-- [ ] spec derived AFTER the user confirmed this report
-- [ ] scope_closed: true written into the spec
-```
+# Template — Analyst Report (REQUIREMENT mode — no document)
+
+Used when there is NO source document: the user's plain-language request IS the
+requirement, reconciled against the existing code. Human-readable source of
+truth. Written to `<analyzer_dir>/{analysis-name}/report.md` (config
+`analyzer_dir` — the internal artifact dir); it is COPIED to
+`<report_out_dir>/{analysis-name}/report.md` only on the report-only /
+stop-here branch. The old "written to analyst_report/…" wording described the
+copy target as if it were the write target.
+
+```markdown
+# Analysis Report — {analysis-name}
+mode: requirement
+depth: standard | deep
+source: "pasted request"        # the user's own words, verbatim
+scope: <X — the requested scope only>
+analyzed_at: DDMMYY HH:MM:SS
+model: opus-5-5-high      # the RESOLVED model of the agent that produced this
+                          #   (mini writes sonnet-5-high) — never copied from here
+grounding: repo-read | repo-read+scouts   # scouts only in deep mode
+
+## Restated requirement (analyst's words)
+One or two sentences restating the request — restating is what surfaces
+misreadings. If the restatement rests on any assumption, tag it and ask.
+
+## In-scope requirement parts (X only)
+
+Each part of the request, reconciled against code. Every "Code reality" cell
+carries quote-anchored file:line evidence (`file:line — "verbatim snippet"`,
+never paraphrased; a ref with no quote auto-downgrades to UNVERIFIED), OR the
+part is tagged ASSUMPTION/UNVERIFIED (and appears below as an open question).
+Absence claims (status missing/buildable) instead carry `searched:` — the
+concrete globs/greps run. In deep mode EVERY part is verified.
+
+| # | Requirement part (from request) | Code reality | Evidence (file:line + quote / searched:) | Files/modules | Status | Resolution |
+|---|---------------------------------|--------------|------------------------------------------|---------------|--------|------------|
+| 1 | "add CSV export to reports" | reports render HTML only | searched: `export*`, `csv`, `download` — no hits | web/reports/x | missing | new export path |
+| 2 | "reuse current auth" | auth guard on report routes | web/reports/routes.x:12 — "requireAuth(" | web/reports/x | exists | reuse, no change |
+
+Status: buildable | exists | conflict | resolved
+- buildable: not present, but consistent with the code — safe to build.
+- exists: already implemented — flag so the planner doesn't duplicate.
+- conflict: request contradicts existing behavior → challenged.
+- resolved: a challenged part the user decided on.
+
+## Assumptions & Open Questions
+Every ambiguity in the request + anything not grounded to code. Each raised as a
+recommended-option challenge and resolved (or still open).
+- ASSUMPTION (resolved): "export" = download file (recommended) vs email — user
+  confirmed download.
+- UNVERIFIED (open): whether a reports permission gate exists — evidence not found.
+
+## Additional context (do not build)
+Anchored, non-actionable context pulled from an ADJACENT scope because an in-scope
+request part depends on it. Read for understanding; never a task. Each item names
+the in-scope part it serves + why. Omit this whole section if none survived.
+| Anchor (in-scope #) | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
+|---------------------|-----------|------------|-----------------------|----------------------|
+| Part 1 (CSV export) | reporting (Y) | consumes-output | report query already paginates; export must page too | web/reports/query.x:44 |
+
+## Alternatives & risks   (DEEP mode only — omit in standard)
+- Approach A (recommended): stream CSV from the existing query — low blast radius.
+- Approach B: precompute + cache — faster reads, adds a cache dependency.
+- Risk: export reuses the report query (dependents: 2 schedulers).
+
+## Challenges raised & answers
+- Part 3 ("admin-only export") looked like scope Z (admin) — user confirmed OUT.
+
+## Excluded scopes (recognized, not detailed)
+- Recognized Y, Z implied by the request; excluded per scope = X.
+
+## Handoff readiness (checklist — all five or handoff_ready is false)
+- [ ] all BLOCKING challenges resolved
+- [ ] zero open UNVERIFIED on any in-scope part
+- [ ] every part has status + evidence-or-resolution
+- [ ] spec derived AFTER the user confirmed this report
+- [ ] scope_closed: true written into the spec
+```

package/templates/skills/orc-analyze-mini/SKILL.md

@@ -1,19 +1,12 @@
 ---
 name: orc-analyze-mini
 description: >
-  Fast-lane System Analyst for ORC-MINI (Sonnet 5, high effort). Turns a
-  requirement — a document (PDF by path or pasted) OR a plain-language request —
-  into a scope-bounded, code-grounded requirement report + derived spec: bounds
-  the deliverable to exactly the asked scope (other scopes never become tasks),
-  maps each requirement to real files with quote-anchored file:line evidence —
-  or marks it an ASSUMPTION and turns it into a question — and challenges the
-  user with recommended options. Use for "/orc-analyze-mini", "quickly analyze
-  this doc", "fast doc analysis", "quick requirement check", "fast requirement
-  analysis", or when orc-mini meets a document or an ambiguous requirement.
-  Distinct from /orc-analyze: ALWAYS single-pass — NO deep mode, NO scouts —
-  trading depth for speed and tokens; switch to /orc-analyze (deep) when you
-  need a wider code sweep, verify-every-claim, or alternatives with trade-offs.
-  The orchestrator dispatches this to a subagent — it never analyzes itself.
+  Fast-lane System Analyst for ORC-MINI (Sonnet 5, high effort). Use for
+  "/orc-analyze-mini", "quickly analyze this doc", "fast doc analysis", "quick
+  requirement check", "fast requirement analysis", or when orc-mini meets a
+  document or an ambiguous requirement. Writes a scope-bounded requirement
+  report with file:line evidence. ALWAYS single-pass — NO deep mode, NO scouts;
+  use /orc-analyze for depth.
 ---
 
 # ORC-ANALYZE-MINI
@@ -39,48 +32,37 @@ for the formats; this skill does not duplicate them.
   silently dropped.
 - **No deep mode, no scouts.** Always single-pass.
 - **Concrete escalation thresholds** (recommend the full `/orc-analyze`, Opus
-  4.8 high, and let the user choose — the boundary is not self-assessed vibes):
+  5.5 high, and let the user choose — the boundary is not self-assessed vibes):
   source doc > ~10 pages, OR > 12 in-scope requirements, OR > 3 conflict rows,
   OR audit mode with > 5 stale-premise rows.
 - **Model:** Sonnet 5, high effort.
 
 ## What's identical
 
+The full analyst's **hard rules 2, 3, 3a, 4a, 5 and 6** apply unchanged
+(`../orc-analyze/SKILL.md` §Hard rules): quote-anchored evidence-or-mark with
+`searched:` on absence claims, the read ladder (`../_shared/read-ladder.md`),
+recommended-option challenges, two perimeters with the **Additional context (do
+not build)** section, and a spec derived from the confirmed report (with the Evidence column and the
+Assumptions & Open Questions section). Anchored context is self-read (no
+scouts). Also the same:
+
 - **Doc-optional intake:** auto-detect + confirm mode — prose / audit
-  (documents) or **requirement** (NO doc; the user's request is the source of
-  truth, reconciled against code).
-- **Evidence-or-mark, quote-anchored:** every code claim / interpretation is
-  grounded with `file:line — "verbatim snippet"` (a ref with no quote
-  auto-downgrades to `UNVERIFIED`), OR tagged `ASSUMPTION`/`UNVERIFIED` and
-  turned into a question — never a silent guess. **Absence claims**
-  (missing/buildable) carry `searched:` — the concrete globs/greps run.
-- **The read ladder:** locate → outline → range → full, escalating only as far as
-  the question needs (`../_shared/read-ladder.md`). Trimmed depth is not a lower
-  evidence floor — it is fewer wasted full reads reaching the same anchors.
-- **Recommended-option challenges:** each challenge is a 2–3 option set with one
-  flagged recommended option + reason (blocking one at a time, advisory batched).
-- Two perimeters: the deliverable stays scope X (Y/Z never become tasks), but
-  anchored, non-actionable adjacent context is gathered when an in-scope item
-  depends on it — touchpoint-bounded, self-read (no scouts), each item anchored to
-  the requirement it serves + labeled "do not build". Same **Additional context
-  (do not build)** section in report + spec. Unanchored context is dropped.
-- Two artifacts, spec derived from the confirmed report, same folder
-  `orc/analyzer/{analysis-name}/` (internal; copied out only on report-only),
-  including the Evidence column and Assumptions & Open Questions section. The
-  spec is stamped with `git_head` + `dirty` for plan-time staleness detection.
+  (documents) or **requirement** (NO doc; the request is the source of truth).
+- Same folder `orc/analyzer/{analysis-name}/` (internal; copied out only on
+  report-only). The spec is stamped with `git_head` + `dirty` for plan-time
+  staleness detection.
 - Same branch: report-only, or take into build (hand both files to orc-mini,
-  which continues with the mini planner) — orc-mini runs the same evidence
-  spot-check + derivation lint gates as the full lane before building.
+  which continues with the mini planner and runs the same evidence spot-check +
+  derivation lint gates).
 
 ## Behavior trace (always on)
 
-`../_shared/phases/trace.md` (`core`, at run start; `orc lane phases` names
-the file and the layers). Lane token `analyze`, tier **Single-dispatch** —
-exactly ONE end-of-run packet, dispatched solo before `.current` is deleted.
-At run start write `log_dir/.current` = `run-analyze-<slug>-<DDMMYY>-<HHMMSS>.txt` AND
-`touch the trace file` of that name in the SAME step.
-Nothing else about the protocol is restated here; a phase that ends with
-`zero new trace lines is a protocol violation`.
+`../_shared/phases/trace.md` (`core`, at run start; `orc lane phases orc-analyze-mini --json` →
+`trace_grammar` gives the verbs). Lane token `analyze`, tier
+**Single-dispatch**. At run start write `log_dir/.current` =
+`run-analyze-<slug>-<DDMMYY>-<HHMMSS>.txt` AND `touch the trace file` of that name
+in the SAME step. A phase that ends with `zero new trace lines is a protocol violation`.
 
 ## Workflow checkpoint (gate before deriving the spec)
 
@@ -108,29 +90,12 @@ survived. Return exactly:
 
 Never build or spawn.
 
-## Config
-
-Resolve with `orc lane config orc-analyze-mini --json` and obey `effective`. Never merge
-`.claude/orc.config.yaml` yourself, and never re-derive a precedence. Exit ≠ 0 →
-say so and use `../_shared/config-precedence.md`'s documented defaults, out
-loud. Nothing this lane reads is contested, gated or a stop, so it owes no
-preflight line and has no gate to honour.
-
-## Calls
-
-**ONE catalogue, and it is not you:** `orc lane calls orc-analyze-mini --json` names every
-CLI call this lane makes, each with its exit-code contract, its cost, when to run
-it, and what an EMPTY answer means. Never invent a spelling, never re-word an
-exit code, and never re-derive a state word — the CLI's state words are the only
-state words, and **an exit code is an ANSWER wherever that contract says so, not
-a failure**. A call the answer does not name is a call this lane does not make.
-Exit ≠ 0 from the catalogue itself → say the CLI is unavailable and name the
-command you are about to run, out loud, before running it.
-
-## Rules — the anti-slop card (`../_shared/phases/rules.md`)
-
-`orc rules slice --lane orc-analyze-mini --json` is the ONLY assembler; never build
-the card here. It rides under the house rules and above the task —
-**house rules > your project's rules > ORC's own packs** — and its `line` prints
-VERBATIM at preflight. Returns gain `rules_applied[]`, `rules_conflicts[]` (a gap,
-never a silent choice) and `rules_overridden[]`.
+## Lane contract (`../_shared/lane-contract.md` — read it ONLY when a call exits ≠ 0)
+
+- **Calls:** `orc lane calls orc-analyze-mini --json` names every call and its exit codes.
+  **An exit code is an ANSWER where it says so, not a failure.** Make no other call.
+- **Config:** `orc lane config orc-analyze-mini --json`. Obey `effective`. Never merge
+  `.claude/orc.config.yaml` yourself (`../_shared/config-precedence.md`). Nothing
+  here is contested, gated or a stop: no preflight line, no gate to honour.
+- **Rules:** `orc rules slice --lane orc-analyze-mini --json` is the ONLY assembler
+  (`../_shared/phases/rules.md`). Its `line` prints VERBATIM at preflight.