@azure-id/orc 1.9.1 → 2.0.2

package/templates/skills/orc-diy/README.md

@@ -1,143 +1,174 @@
-# ORC-DIY — Build your own ORC flow
-
-> This guide is intentionally separate from the main project README. The root
-> README covers installing and using the shipped lanes; **everything about
-> composing your own lane lives here.**
-
-ORC-DIY lets you assemble a custom orchestrator pipeline from ORC's real
-parts — keep the phases you want, drop the ones you don't, pick the session
-tier, and decide how autonomous the run is. The shape is chosen entirely in
-your **terminal** (deterministic, zero model tokens); Claude only ever runs
-the flow you compiled.
-
-```
-orc diy init          →  orc diy set … (repeat)  →  orc diy compile  →  /orc-diy <request>
-   (config created)       (shape your flow)          (build the flow)     (run it)
-```
-
-## 1. Bootstrap
-
-**Easiest path — the interactive composer.** Run bare `orc diy` in a real
-terminal: it creates the flow if none exists (pick full-lane defaults or a
-preset from a numbered list), then lets you shape every key with numbered
-pick-lists, shows the live gate status and validation issues as you go, and
-offers to compile on exit. Everything below is the same thing, non-interactive:
-
-```bash
-orc diy                         # interactive composer (create + shape + compile)
-orc diy init                    # scriptable: create the default config (full-lane shape)
-orc diy init --preset lean      # or start from a preset: lean | paranoid | solo-fast
-```
-
-This writes three project-scoped files (there is no global variant — `orc
-diy` rejects `--global`; one flow per project):
-
-| File | What it is | Who writes it |
-|---|---|---|
-| `.claude/orc-diy.config.yaml` | your flow choices | the CLI only |
-| `.claude/orc/diy/flow.md` | human-readable flow spec (regenerated on every change) | the CLI only |
-| `.claude/orc/diy/flow.lock.json` | hashes + compile stamp — the gate's state | the CLI only |
-
-## 2. Shape the flow
-
-```bash
-orc diy show                    # current flow + gate status (READY / STALE / UNCONFIGURED)
-orc diy set review blocking-only
-orc diy set verify smoke
-orc diy set scoring off
-orc diy set fixed_executor orc-executor-sonnet-5-high
-orc diy set session_tier opus-4-7-med
-orc diy set autonomy semi
-orc diy validate                # re-check cross-key rules any time
-```
-
-**`opus5_only` does not reach this lane.** That config forces every other
-lane's roles to Opus 5, but a DIY flow's executors come from `flow.lock.json`,
-which only `orc diy compile` writes. To run this lane on Opus 5, set
-`fixed_executor`/`session_tier` here and re-compile.
-
-The full key table lives in `references/flow-schema.md`. Highlights:
-
-- **Phases** — `analyze`, `review`, `security`, `verify`, `testgen`,
-  `summary`, `wiki_gate`: each phase has off/on/strictness values. Order is
-  fixed; you choose presence and strictness.
-- **Scoring** — `scoring on` keeps the per-task rubric; `scoring off` skips
-  it and sends every task to your `fixed_executor`.
-- **Session tier** — `session_tier` is the model+effort the compiled flow
-  requires. DIY is SEPARATE from the baseline /orc rule — pick any tier from the
-  full grid: `sonnet-4-6-{med,high}`, `opus-4-7-{med,high}`,
-  `opus-4-8-{med,high,xhigh,max}`, `opus-5-{med,high,xhigh,max}`,
-  `fable-5-{med,high,xhigh,max}` (default
-  `opus-5-high` — D29 moved it there at v1.0.0 so the wizard's own default
-  does not clip the two Opus 5 bands the score table ships). The effort guard enforces the effort half deterministically
-  (the compiled effort OR higher on the ladder); the statusline warns on the
-  model half. Executor choices above the tier are rejected at validate time; the
-  score table is clipped to the tier at compile time.
-- **Autonomy** — `interactive` (all asks), `semi` (routine asks
-  auto-accepted), `hands-off` (only hard stops + ship). Locked safety rules
-  are never overridden — see `references/locked-blocks.md` for what you can
-  NEVER configure away.
-- **Ship** — `ship_mode`: `ask`, `commit`, `pr`, or `report-only`.
-
-## 3. Compile
-
-```bash
-orc diy compile                 # deterministic stitch — no model, no tokens
-```
-
-The compiler validates, cherry-picks the needed references from your
-installed orc skill, stitches `.claude/orc/diy/FLOW-COMPILED.md`, and stamps
-`flow.lock.json`. Details: `references/compile.md`.
-
-**Every change requires a recompile.** The gate flips to STALE whenever:
-- you change any key (`orc diy set` …),
-- you update orc (`orc update` / `orc upgrade`),
-- the compiled file is edited or deleted.
-
-`/orc-diy` will not run a stale flow — it names the reason, tells you to run
-`orc diy compile`, and offers the regular `/orc` lane for the request at
-hand. `/orc-diy compile` in a session just runs the same CLI compiler.
-
-## 4. Run
-
-```
-/orc-diy implement the CSV export endpoint
-```
-
-The stub skill checks the gate, then follows your compiled flow: same run
-folders, checkpoints, subagents, and evidence rules as the full lane — minus
-the phases you removed, plus the strictness you chose.
-
-## Presets
-
-| Preset | Shape |
-|---|---|
-| `lean` | analyze off, review blocking-only, verify smoke, summary short |
-| `paranoid` | analyze full, security always, testgen on, verify full |
-| `solo-fast` | scoring off → one Sonnet 5 high executor, review off, verify smoke, autonomy semi |
-
-Presets are just config bundles — inspect with `orc diy show`, tweak with
-`set`, and compile like any other flow.
-
-## Command reference
-
-```
-orc diy                                    INTERACTIVE composer (create/shape/compile in one menu)
-orc diy init [--preset <name>] [--force]   create (or overwrite) the config
-orc diy show                               flow table + gate status
-orc diy status [--json]                    gate status only (used by the skill/hooks)
-orc diy set <key> <value>                  change one key (invalidates the compile)
-orc diy validate                           run cross-key validation
-orc diy compile                            build FLOW-COMPILED.md + stamp the lock
-orc diy reset                              delete config, flow, lock, and compiled file
-```
-
-## Boundaries (read before getting creative)
-
-- The CLI is the only writer. Never hand-edit the config, the lock, or the
-  compiled flow — and never ask Claude to; the skill refuses by contract.
-- `references/locked-blocks.md` is compiled into every flow verbatim: the
-  orchestrator never implements, checkpoint discipline, wave conflict rules,
-  the severity ladder, and red-build ship blocking are not yours to remove.
-- orc-diy needs the orc skill installed next to it (it cherry-picks by
-  reference); `orc init` installs both.
+# ORC-DIY — Build your own ORC flow
+
+> This guide is intentionally separate from the main project README. The root
+> README covers installing and using the shipped lanes; **everything about
+> composing your own lane lives here.**
+
+ORC-DIY lets you assemble a custom orchestrator pipeline from ORC's real
+parts — keep the phases you want, drop the ones you don't, pick the session
+tier, and decide how autonomous the run is. The shape is chosen entirely in
+your **terminal** (deterministic, zero model tokens); Claude only ever runs
+the flow you compiled.
+
+```
+orc diy init          →  orc diy set … (repeat)  →  orc diy compile  →  /orc-diy <request>
+   (config created)       (shape your flow)          (build the flow)     (run it)
+```
+
+## 1. Bootstrap
+
+**Easiest path — the interactive composer.** Run bare `orc diy` in a real
+terminal: it creates the flow if none exists (pick full-lane defaults or a
+preset from a numbered list), then lets you shape every key with numbered
+pick-lists, shows the live gate status and validation issues as you go, and
+offers to compile on exit. Everything below is the same thing, non-interactive:
+
+```bash
+orc diy                         # interactive composer (create + shape + compile)
+orc diy init                    # scriptable: create the default config (full-lane shape)
+orc diy init --preset lean      # or start from a preset: lean | paranoid | solo-fast
+```
+
+This writes three project-scoped files (there is no global variant — `orc
+diy` rejects `--global`; one flow per project):
+
+| File | What it is | Who writes it |
+|---|---|---|
+| `.claude/orc-diy.config.yaml` | your flow choices | the CLI only |
+| `.claude/orc/diy/flow.md` | human-readable flow spec (regenerated on every change) | the CLI only |
+| `.claude/orc/diy/flow.lock.json` | hashes + compile stamp — the gate's state | the CLI only |
+
+## 2. Shape the flow
+
+```bash
+orc diy show                    # current flow + gate status (READY / STALE / UNCONFIGURED)
+orc diy set review blocking-only
+orc diy set verify smoke
+orc diy set scoring off
+orc diy set fixed_executor orc-executor-sonnet-5-high
+orc diy set session_tier opus-4-7-med
+orc diy set autonomy semi
+orc diy validate                # re-check cross-key rules any time
+```
+
+**`opus5_only` does not reach this lane.** That config forces every other
+lane's roles to Opus 5.5, but a DIY flow's executors come from `flow.lock.json`,
+which only `orc diy compile` writes. To run this lane on Opus 5.5, set
+`fixed_executor`/`session_tier` here and re-compile.
+
+The full key table lives in `references/flow-schema.md`. Highlights:
+
+- **Phases** — `analyze`, `review`, `security`, `verify`, `testgen`,
+  `summary`, `wiki_gate`: each phase has off/on/strictness values. Order is
+  fixed; you choose presence and strictness.
+- **Scoring** — `scoring on` keeps the per-task rubric; `scoring off` skips
+  it and sends every task to your `fixed_executor`.
+- **Session tier** — `session_tier` is the model+effort the compiled flow
+  requires. DIY is SEPARATE from the baseline /orc rule — pick any tier from the
+  full grid: `sonnet-4-6-{med,high}`, `opus-4-7-{med,high}`,
+  `opus-4-8-{med,high,xhigh,max}`, `opus-5-{med,high,xhigh,max}`,
+  `fable-5-{med,high,xhigh,max}` (default
+  `opus-5-high` — D29 moved it there at v1.0.0 so the wizard's own default
+  does not clip the two Opus 5.5 bands the score table ships). The effort guard enforces the effort half deterministically
+  (the compiled effort OR higher on the ladder); the statusline warns on the
+  model half. Executor choices above the tier are rejected at validate time; the
+  score table is clipped to the tier at compile time.
+- **Autonomy** — `interactive` (all asks), `semi` (routine asks
+  auto-accepted), `hands-off` (only hard stops + ship). Locked safety rules
+  are never overridden — see `references/locked-blocks.md` for what you can
+  NEVER configure away.
+- **Ship** — `ship_mode`: `ask`, `commit`, `pr`, or `report-only`.
+
+## 3. Compile
+
+```bash
+orc diy compile                 # deterministic stitch — no model, no tokens
+```
+
+The compiler validates, cherry-picks the needed references from your
+installed orc skill, stitches `.claude/orc/diy/FLOW-COMPILED.md`, and stamps
+`flow.lock.json`. Details: `references/compile.md`.
+
+**Every change requires a recompile.** The gate flips to STALE whenever:
+- you change any key (`orc diy set` …),
+- you update orc (`orc update` / `orc upgrade`),
+- the compiled file is edited or deleted.
+
+`/orc-diy` will not run a stale flow — it names the reason, tells you to run
+`orc diy compile`, and offers the regular `/orc` lane for the request at
+hand. `/orc-diy compile` in a session just runs the same CLI compiler.
+
+### Where the compiled flow comes from (maintainer view)
+
+You never read these; `orc diy compile` does, once, and stitches the result
+into `FLOW-COMPILED.md`. The table is here so a maintainer can see the
+provenance of a compiled phase without reading the compiler — `orc lane phases
+orc-diy --json` is the authoritative version and marks every row below
+`when: compile-time`.
+
+Eleven phases come from the shared library, as that file's `composed` LAYER —
+NOT its `full` layer, which is `/orc`'s procedure for the same phase:
+`../_shared/phases/trace.md` · `../_shared/phases/planning.md` ·
+`../_shared/phases/scoring.md` · `../_shared/phases/execution.md` ·
+`../_shared/phases/review.md` · `../_shared/phases/security.md` ·
+`../_shared/phases/verify.md` · `../_shared/phases/testgen.md` ·
+`../_shared/phases/mock-example.md` · `../_shared/phases/ship.md` ·
+`../_shared/phases/summary.md`.
+
+Five have no counterpart anywhere else in the payload and stay this lane's own:
+`references/blocks/header.md` (the tier self-gate), `wiki.md`, `analyze.md`,
+`pattern.md` and `extra.md`. They are composition prose about a decision only a
+composed flow makes, so there is nothing to share them WITH.
+
+Four more are pointed at from inside those stitched layers rather than stitched
+themselves: `../_shared/phases/intake.md`,
+`../_shared/phases/wave-grouping.md`,
+`../_shared/phases/security-checklist.md` and
+`../_shared/phases/stop-resume.md`.
+
+The stitch ORDER is the compiler's `order` array and is documented in
+`references/compile.md`; a golden test holds the three lists together.
+
+## 4. Run
+
+```
+/orc-diy implement the CSV export endpoint
+```
+
+The stub skill checks the gate, then follows your compiled flow: same run
+folders, checkpoints, subagents, and evidence rules as the full lane — minus
+the phases you removed, plus the strictness you chose.
+
+## Presets
+
+| Preset | Shape |
+|---|---|
+| `lean` | analyze off, review blocking-only, verify smoke, summary short |
+| `paranoid` | analyze full, security always, testgen on, verify full |
+| `solo-fast` | scoring off → one Sonnet 5 high executor, review off, verify smoke, autonomy semi |
+
+Presets are just config bundles — inspect with `orc diy show`, tweak with
+`set`, and compile like any other flow.
+
+## Command reference
+
+```
+orc diy                                    INTERACTIVE composer (create/shape/compile in one menu)
+orc diy init [--preset <name>] [--force]   create (or overwrite) the config
+orc diy show                               flow table + gate status
+orc diy status [--json]                    gate status only (used by the skill/hooks)
+orc diy set <key> <value>                  change one key (invalidates the compile)
+orc diy validate                           run cross-key validation
+orc diy compile                            build FLOW-COMPILED.md + stamp the lock
+orc diy reset                              delete config, flow, lock, and compiled file
+```
+
+## Boundaries (read before getting creative)
+
+- The CLI is the only writer. Never hand-edit the config, the lock, or the
+  compiled flow — and never ask Claude to; the skill refuses by contract.
+- `references/locked-blocks.md` is compiled into every flow verbatim: the
+  orchestrator never implements, checkpoint discipline, wave conflict rules,
+  the severity ladder, and red-build ship blocking are not yours to remove.
+- orc-diy needs the orc skill installed next to it (it cherry-picks by
+  reference); `orc init` installs both.

package/templates/skills/orc-diy/SKILL.md

@@ -1,14 +1,12 @@
 ---
 name: orc-diy
 description: >
-  User-composable ORC lane. Use for "/orc-diy" or "run my custom orc flow".
-  The pipeline shape (analyze/review/verify/security/testgen on-off, scoring
-  or a fixed executor, autonomy, ship mode, session tier) is configured
-  ENTIRELY through the `orc diy` CLI and compiled into a flow file —
-  never configured in-session. HARD-GATED: no config or a stale compile →
-  this skill never runs the custom flow; it explains the CLI steps and offers
-  plain /orc instead. "/orc-diy compile" re-runs the deterministic CLI
-  compiler. See references/flow-schema.md and references/compile.md.
+  User-composable ORC lane. Use for "/orc-diy" or "run my custom orc flow". The
+  pipeline shape is configured ENTIRELY through the `orc diy` CLI and compiled
+  into a flow file — never configured in-session. HARD-GATED: no config or a
+  stale compile → this skill never runs the custom flow; it explains the CLI
+  steps and offers plain /orc instead. "/orc-diy compile" re-runs the
+  deterministic CLI compiler.
 ---
 
 # ORC-DIY (stub — gate + dispatcher)
@@ -59,65 +57,23 @@ as it says. Do not consult this stub again for the rest of the run, and do
 not load orc's SKILL.md as a spine (the compiled flow already references the
 exact orc subskills and schemas it needs).
 
-## Where the compiled flow comes from
-
-You never read these; `orc diy compile` does, once, and stitches the result
-into `FLOW-COMPILED.md`. The table is here so a maintainer can see the
-provenance of a compiled phase without reading the compiler — `orc lane phases
-orc-diy --json` is the authoritative version and marks every row below
-`when: compile-time`.
-
-Eleven phases come from the shared library, as that file's `composed` LAYER —
-NOT its `full` layer, which is `/orc`'s procedure for the same phase:
-`../_shared/phases/trace.md` · `../_shared/phases/planning.md` ·
-`../_shared/phases/scoring.md` · `../_shared/phases/execution.md` ·
-`../_shared/phases/review.md` · `../_shared/phases/security.md` ·
-`../_shared/phases/verify.md` · `../_shared/phases/testgen.md` ·
-`../_shared/phases/mock-example.md` · `../_shared/phases/ship.md` ·
-`../_shared/phases/summary.md`.
-
-Five have no counterpart anywhere else in the payload and stay this lane's own:
-`references/blocks/header.md` (the tier self-gate), `wiki.md`, `analyze.md`,
-`pattern.md` and `extra.md`. They are composition prose about a decision only a
-composed flow makes, so there is nothing to share them WITH.
-
-Four more are pointed at from inside those stitched layers rather than stitched
-themselves: `../_shared/phases/intake.md`,
-`../_shared/phases/wave-grouping.md`,
-`../_shared/phases/security-checklist.md` and
-`../_shared/phases/stop-resume.md`.
-
-The stitch ORDER is the compiler's `order` array and is documented in
-`references/compile.md`; a golden test holds the three lists together.
-
-
-## Config
-
-**ONE resolver, and it is not you:** `orc lane config orc-diy --json`. Obey
-`effective`, print every line in `announce[]` VERBATIM at preflight, and honour
-`stops[]` before wave 1. Never re-derive a value, a precedence or an inertness
-from `.claude/orc.config.yaml` — a key this lane does not read is not in the
-answer, and a key another key shadows comes back already marked. Exit ≠ 0 → say
-the CLI is unavailable and fall back to `../_shared/config-precedence.md`'s
-documented defaults, out loud. Priorities and families:
-`../_shared/config-precedence.md`.
+## Lane contract (`../_shared/lane-contract.md` — read it ONLY when a call exits ≠ 0)
+
+- **Calls:** `orc lane calls orc-diy --json` names every call and its exit codes.
+  **An exit code is an ANSWER where it says so, not a failure.** Make no other call.
+- **Config:** `orc lane config orc-diy --json`. Obey `effective`, print every line
+  in `announce[]` VERBATIM at preflight, and honour `stops[]` before wave 1.
+  Never merge `.claude/orc.config.yaml` yourself (`../_shared/config-precedence.md`).
+- **Habits:** `habits{}` in the config answer → read `../_shared/habits.md`. No
+  `habits{}` → ignore every `(H …)` mark.
+- **Rules:** `orc rules slice --lane orc-diy --json` is the ONLY assembler
+  (`../_shared/phases/rules.md`). Its `line` prints VERBATIM at preflight.
 
 The flow SHAPE is not in that answer: it is compile-owned and lives in
 `flow.lock.json`. The resolver answers for everything else this lane still
 reads, and `extra` is the same split — the flow decides WHETHER, the resolver
 still decides WHERE.
 
-## Calls
-
-**ONE catalogue, and it is not you:** `orc lane calls orc-diy --json` names every
-CLI call this lane makes, each with its exit-code contract, its cost, when to run
-it, and what an EMPTY answer means. Never invent a spelling, never re-word an
-exit code, and never re-derive a state word — the CLI's state words are the only
-state words, and **an exit code is an ANSWER wherever that contract says so, not
-a failure**. A call the answer does not name is a call this lane does not make.
-Exit ≠ 0 from the catalogue itself → say the CLI is unavailable and name the
-command you are about to run, out loud, before running it.
-
 ## Hard rules
 
 1. The compiled flow is a build artifact — NEVER edit
@@ -126,16 +82,9 @@ command you are about to run, out loud, before running it.
    `orc diy set` + `orc diy compile`, both run by the user.
 2. Fail closed: any gate ambiguity = STALE, with the reason shown.
 3. The fallback ask is ONE question with two outcomes (`/orc` or stop) —
-   never a menu, never a silent fallback.
-
-## Rules — the anti-slop card (`../_shared/phases/rules.md`)
-
-`orc rules slice --lane orc-diy --json` is the ONLY assembler; never build
-the card here. It rides under the house rules and above the task —
-**house rules > your project's rules > ORC's own packs** — and its `line` prints
-VERBATIM at preflight. Returns gain `rules_applied[]`, `rules_conflicts[]` (a gap,
-never a silent choice) and `rules_overridden[]`.
-## Waiting mid-run (`/orc-wait`)
-
-Canonical: `../_shared/wait.md`. **`a lane that waits without a hand-back` has broken this contract.**
-Checkpoint **full** · safe point **compiled phase edge**. `soft` FORCES that checkpoint and does NOT stop if the write fails; `hard` skips it and can lose an in-flight return. Never begin a wait between a dispatch and its validated return, or before the smoke gate has reported.
+   never a menu, never a silent fallback.
+
+## Waiting mid-run (`/orc-wait`)
+
+Canonical: `../_shared/wait.md`. **`a lane that waits without a hand-back` has broken this contract.**
+Checkpoint **full** · safe point **compiled phase edge**.

package/templates/skills/orc-diy/references/blocks/pattern.md

@@ -1,18 +1,18 @@
-## Phase: Code-pattern findings
-
-<!-- diy:when pattern=off -->
-Code-pattern codification is OFF: executors run language-agnostic (security/
-correctness invariants still enforced; conventions imitate neighbor files).
-Never prompt about patterns. A cached pattern under `.claude/orc/patterns/`
-is still injected if present — cache hits are always silent.
-<!-- /diy:when -->
-<!-- diy:when pattern=ask -->
-On an FE/BE pattern-cache miss at dispatch time, ask the user once: learn the
-house style via the `.claude/skills/orc-pattern/SKILL.md` flow, or proceed
-language-agnostic. Cache hits are used silently.
-<!-- /diy:when -->
-<!-- diy:when pattern=on -->
-On an FE/BE pattern-cache miss at dispatch time, auto-codify without asking:
-run the `.claude/skills/orc-pattern/SKILL.md` flow, then inject the cached
-pattern literally into executor slices. Cache hits are used silently.
-<!-- /diy:when -->
+## Phase: Code-pattern findings
+
+<!-- diy:when pattern=off -->
+Code-pattern codification is OFF: executors run language-agnostic (security/
+correctness invariants still enforced; conventions imitate neighbor files).
+Never prompt about patterns. A cached pattern under `.claude/orc/patterns/`
+is still injected if present — cache hits are always silent.
+<!-- /diy:when -->
+<!-- diy:when pattern=ask -->
+On an FE/BE pattern-cache miss at dispatch time, ask the user once (H `orc.phase-3.pattern`): learn the
+house style via the `.claude/skills/orc-pattern/SKILL.md` flow, or proceed
+language-agnostic. Cache hits are used silently.
+<!-- /diy:when -->
+<!-- diy:when pattern=on -->
+On an FE/BE pattern-cache miss at dispatch time, auto-codify without asking:
+run the `.claude/skills/orc-pattern/SKILL.md` flow, then inject the cached
+pattern literally into executor slices. Cache hits are used silently.
+<!-- /diy:when -->

package/templates/skills/orc-diy/references/flow-schema.md

@@ -60,7 +60,7 @@ Warnings (written, reported):
 - `autonomy: hands-off` with `ship_mode: commit` or `pr` (fully unattended
   git actions).
 - `session_tier` below `opus-5-med` with `review`/`verify` on: the pinned
-  Opus 5 reviewer/verifier agents will silently run at the session's model —
+  Opus 5.5 reviewer/verifier agents will silently run at the session's model —
   the flow still works, honesty-checked by the tier-honesty locked rule.
 
 ## `flow.lock.json` (machine state — written by the CLI only)