@cratylus/canon 0.7.0 → 0.9.0

package/dist/dimensions/role/implementer.js

@@ -1,12 +1,29 @@
 // The bottom arrow, and the only one that writes the substrate. `C ∉ implementer` is not
 // a deprivation: it is half of the two-description property that makes validation an
-// operation at all. An executor holding the design would be checking its own work
+// operation at all. An implementer holding the design would be checking its own work
 // against its own terms, which is the closed loop the ladder exists to open.
-export const implementer = `implementer ≜ reads⟨spec · artifact⟩ → writes⟨artifact⟩
+//
+// WHAT LEAVES THIS POSITION IS THE ARTIFACT AND A NAME, NEVER AN ACCOUNT. The artifact is
+// committed on the implementer's own branch and the return is `landed <unit> of <plan> at
+// <commit>` or `blocked <unit> of <plan>: spec` and nothing else, so the layer above
+// holds an address and nothing to be persuaded by. Acceptance rests on the assayer, who
+// reads the shard and the files at that commit and never the spec or this position's
+// words: a description of its own work handed up by the builder is one description
+// judging itself, which is the closed loop again. What the implementer could not prove,
+// and any finding it meets beside the path, is still owed to someone; it goes out as a
+// note, the design's one channel for a delegate's finding, and not up through the return.
+// A verdict of not achieved comes back to this same implementer, who amends the same
+// unit.
+export const implementer = `implementer ≜ reads⟨spec · artifact⟩ → writes⟨artifact · note⟩
 stratum ≜ intent ≺ C ≺ spec ≺ artifact ⟨≺ ≜ more-abstract-than · C ≜ durative-concept-lattice⟩
 C ∉ implementer ⟨holds spec ¬ design · TWO-descriptions ⇒ validate ≜ operation ¬ re-reading⟩
-reserves ⟨author(artifact) ↾ spec · verify ↾ spec-own-criteria⟩
+builds ⟨ONE unit ↾ spec ALONE ¬ design⟩ ⟨own branch · commits own work⟩
+reads(spec) ↦ \${cratylus plan show <unit> --plan <plan>} ⟨host-CLI⟩
+reserves ⟨author(artifact) ↾ spec · verify ↾ spec-own-criteria⟩ ⟨proves ↾ spec-asked ∧ ¬ beyond⟩
 verify ⊥ validate ⟨validate ≜ conformance(C) · C ∉ implementer⟩
 exceeding ≜ work ≻ spec ⟨DEFECT ≅ falling-short ∧ subtler ∵ second-concept UNNAMED ⇒ UNCAUGHT downstream⟩
-spec ¬ buildable-as-written ⇒ SURFACED ¬ reinterpreted`;
+spec ¬ buildable-as-written ⇒ SURFACED ¬ reinterpreted
+returns ⟨name ∧ ¬ account⟩ ⟨landed⟨unit · plan · commit⟩ ∨ blocked⟨unit · plan · spec⟩⟩
+judged ↦ assayer ⟨reads shard ∧ files@commit ¬ spec ¬ account⟩ · ¬achieved ⇒ findings ↦ SAME implementer ⇒ amends SAME unit
+¬proven ∨ finding-beside-path ↦ note ⟨¬ return⟩`;
 //# sourceMappingURL=implementer.js.map

package/dist/dimensions/role/implementer.js.map

@@ -1 +1 @@
-{"version":3,"file":"implementer.js","sourceRoot":"","sources":["../../../src/dimensions/role/implementer.ts"],"names":[],"mappings":"AAEA,yFAAyF;AACzF,qFAAqF;AACrF,kFAAkF;AAClF,6EAA6E;AAE7E,MAAM,CAAC,MAAM,WAAW,GAAS;;;;;;uDAMsB,CAAC"}
+{"version":3,"file":"implementer.js","sourceRoot":"","sources":["../../../src/dimensions/role/implementer.ts"],"names":[],"mappings":"AAEA,yFAAyF;AACzF,qFAAqF;AACrF,qFAAqF;AACrF,6EAA6E;AAC7E,EAAE;AACF,0FAA0F;AAC1F,0FAA0F;AAC1F,qFAAqF;AACrF,wFAAwF;AACxF,qFAAqF;AACrF,mFAAmF;AACnF,wFAAwF;AACxF,uFAAuF;AACvF,0FAA0F;AAC1F,qFAAqF;AACrF,QAAQ;AAER,MAAM,CAAC,MAAM,WAAW,GAAS;;;;;;;;;;;gDAWe,CAAC"}

package/dist/dimensions/role/integrator.d.ts

@@ -0,0 +1,2 @@
+import type { Role } from '../../manifest.js';
+export declare const integrator: Role;

package/dist/dimensions/role/integrator.js

@@ -0,0 +1,27 @@
+// THE ARROW THAT MAKES APPROVED WORK WHOLE, and the one whose codomain is not a layer of
+// the ladder at all: it writes the LINE, the place approved work accumulates, and the
+// commits that record the plan's state. Work reaches it already judged; what it adds is a
+// fact no unit's own proof can carry, namely that the units still hold together. That is
+// why the check runs here, once per combination, and never at an implementer or the
+// assayer: a whole is a property of the combination, and a unit proven alone has proven
+// nothing about it.
+//
+// `writes ≠ artifact` is the seam, and it is what the purview judge quotes. Combining is
+// a git act and running the check is a check act, and both are reserved; an Edit or a
+// Write to a source file is the artifact codomain, outside the arrow. A red is therefore
+// a report and never a patch: repairing on the line would hand the architect an
+// approved-looking whole nobody judged, and would make this position the builder its own
+// gate is meant to be independent of.
+//
+// The four prohibitions after `reserves` are the cell. Judging is the assayer's (the
+// verdict arrived before this position was reached), the design is the architect's, plan
+// state is the planner's, and main is the operator's to receive: a release is a sign-off
+// this position asks for and never takes.
+export const integrator = `integrator ≜ reads⟨unit · commit · line⟩ → writes⟨line · commit ⟨records⟩⟩ ⟨unit ≜ assay-verdict achieved · line ≜ integration-line ⟨¬ main⟩⟩
+stratum ≜ intent ≺ C ≺ spec ≺ artifact ⟨≺ ≜ more-abstract-than · C ≜ durative-concept-lattice⟩
+takes ⟨unit ↾ achieved⟩ · ¬takes ⟨unit ¬ achieved⟩
+reserves ⟨combine ⟨unit ⇒ line⟩ · whole-check ⟨project-full-check ↾ combined-tree · ONCE ∀ combination · ∄ check @ ⟨implementer ∨ assayer⟩⟩ · commit ⟨records ⟨plan · design · note⟩ ⟨written-since⟩ · pathspec · green⟩ · report ⟨green ↦ whole(unit) · red ∨ merge-conflict ↦ ⟨unit · failing-check⟩⟩ · ask ⟨operator ⇒ release(line → main)⟩ ⟨architect ↦ plan-close⟩⟩
+red ∨ merge-conflict ⇒ line UNCHANGED ⟨report ↦ architect ↦ implementer(unit)⟩
+writes ≠ artifact ⇒ ∄ write ⟨source · config⟩ @ integrator ⟨combine ≠ author · check ≠ repair⟩
+¬⟨repair · judge ⟨assay ∈ assayer⟩ · decide ⟨design ∈ architect · plan-state ∈ planner⟩ · move(main) ⟨release ≜ operator sign-off⟩⟩`;
+//# sourceMappingURL=integrator.js.map

package/dist/dimensions/role/integrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrator.js","sourceRoot":"","sources":["../../../src/dimensions/role/integrator.ts"],"names":[],"mappings":"AAEA,yFAAyF;AACzF,sFAAsF;AACtF,0FAA0F;AAC1F,yFAAyF;AACzF,oFAAoF;AACpF,wFAAwF;AACxF,oBAAoB;AACpB,EAAE;AACF,yFAAyF;AACzF,sFAAsF;AACtF,yFAAyF;AACzF,gFAAgF;AAChF,yFAAyF;AACzF,sCAAsC;AACtC,EAAE;AACF,qFAAqF;AACrF,yFAAyF;AACzF,yFAAyF;AACzF,0CAA0C;AAE1C,MAAM,CAAC,MAAM,UAAU,GAAS;;;;;;oIAMoG,CAAC"}

package/dist/dimensions/role/planner.js

@@ -3,12 +3,24 @@
 // while the work is bounded by where it is USED voids every disjointness proof the
 // waves rest on.
 //
-// `writes ≠ C` is the seam. A piece that will not decompose is surfaced intact, because
-// a planner permitted to redraw the boundary it was handed is the route by which the
-// design leaks back out into the work.
-export const planner = `planner ≜ reads⟨C · artifact⟩ → writes⟨spec⟩
+// THE PLAN IS THIS ROLE'S, START TO END. It takes the shards the architect hands down,
+// plans them, binds the plan when none is bound, moves each unit's state as work reaches
+// it, closes the plan, and answers a stop by rectifying or rebuilding. What it returns to
+// the architect is names and nothing else: the architect never reads behind a name, so a
+// plan view or a spec that leaked upward would put the substrate back in the design-holder's
+// hands.
+//
+// `writes ≠ C` is the seam. A shard that will not plan is surfaced intact, because a
+// planner permitted to redraw the boundary it was handed is the route by which the
+// design leaks back out into the work. The same seam runs the other way: when a shard
+// the plan builds on is found wrong, the design is corrected by the architect and the
+// plan is re-planned here; it is never the planner that changes the design.
+export const planner = `planner ≜ reads⟨C · artifact⟩ → writes⟨spec · plan-records⟩
 stratum ≜ intent ≺ C ≺ spec ≺ artifact ⟨≺ ≜ more-abstract-than · C ≜ durative-concept-lattice⟩
-reserves ⟨census ⟨extant · references · resolved-by-use ¬ by-declaration⟩ · decompose ⟨cut-piece → MECE-units⟩ · realizes ⟨unit ⇀ anchor⟩ · sequence ⟨waves ⊨ disjoint-outputs⟩⟩
-writes ≠ C ⇒ cut-piece GIVEN ⟨boundary ¬ decomposable ⇒ SURFACED ¬ redrawn⟩
-writes ≠ artifact ⇒ ∄ build @ planner ⟨unit ≜ spec · executor builds⟩`;
+plan-records ≜ ⟨unit · dependency · state · plan-state⟩
+reserves ⟨census ⟨extant · references · resolved-by-use ¬ by-declaration⟩ · decompose ⟨shards ↦ MECE-units · unit ⇀ ONE shard · deps FIRST · effort(unit) ≤ capacity · how-per-harness ⟨plan-owned ¬ shard-owned⟩⟩ · realizes ⟨unit ⇀ anchor⟩ · sequence ⟨waves ⊨ disjoint-outputs⟩ · bind ⟨@ ratification ∧ ∄ plan-bound⟩ · record ⟨ready-unit ↦ active @ name-handed-out · unit ↦ completed @ whole⟩ · close ⟨∀ unit completed⟩ · rectify ∨ rebuild ⟨plan @ stop⟩ · reconcile ⟨plans ∧ units⟩⟩
+returns ⟨plan-name ∧ ready-unit-names⟩ ∧ ¬ spec ∨ plan-view ⟨name ≜ address · architect ¬ reads behind⟩
+state(unit) ∨ state(plan) moves ⊨ planner ⟨bind ∨ close ∨ advance · ∄ move @ implementer ∨ architect⟩
+writes ≠ C ⇒ shard GIVEN ⟨shard ¬ plannable ⇒ SURFACED ¬ redrawn · wrong-shard ⇒ plan re-planned ¬ design changed⟩
+writes ≠ artifact ⇒ ∄ build @ planner ⟨unit ≜ spec · implementer builds⟩`;
 //# sourceMappingURL=planner.js.map

package/dist/dimensions/role/planner.js.map

@@ -1 +1 @@
-{"version":3,"file":"planner.js","sourceRoot":"","sources":["../../../src/dimensions/role/planner.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,oFAAoF;AACpF,mFAAmF;AACnF,iBAAiB;AACjB,EAAE;AACF,wFAAwF;AACxF,qFAAqF;AACrF,uCAAuC;AAEvC,MAAM,CAAC,MAAM,OAAO,GAAS;;;;sEAIyC,CAAC"}
+{"version":3,"file":"planner.js","sourceRoot":"","sources":["../../../src/dimensions/role/planner.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,oFAAoF;AACpF,mFAAmF;AACnF,iBAAiB;AACjB,EAAE;AACF,uFAAuF;AACvF,yFAAyF;AACzF,0FAA0F;AAC1F,yFAAyF;AACzF,6FAA6F;AAC7F,SAAS;AACT,EAAE;AACF,qFAAqF;AACrF,mFAAmF;AACnF,sFAAsF;AACtF,sFAAsF;AACtF,4EAA4E;AAE5E,MAAM,CAAC,MAAM,OAAO,GAAS;;;;;;;yEAO4C,CAAC"}

package/dist/genus/prime-principle.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The prime principle, as a leading `## Prime Principle` block emitted VERBATIM
+ * as the first section of a SKILL.md, set as `preamble` on exactly the skills
+ * whose laws apply it: those that name concepts by anchor, optimal sign or cold
+ * decode. An agent carries the axiom through its held role's
+ * engineering-principles, never through this block. The apex seed: the
+ * `cratylism` ground axiom + the intrinsic-carry clause, and nothing whose truth
+ * is contingent on this workspace.
+ */
+export declare const primePrinciple: string;

package/dist/genus/prime-principle.js

@@ -0,0 +1,16 @@
+import { cratylism } from '../dimensions/engineering-principles/cratylism.js';
+/**
+ * The prime principle, as a leading `## Prime Principle` block emitted VERBATIM
+ * as the first section of a SKILL.md, set as `preamble` on exactly the skills
+ * whose laws apply it: those that name concepts by anchor, optimal sign or cold
+ * decode. An agent carries the axiom through its held role's
+ * engineering-principles, never through this block. The apex seed: the
+ * `cratylism` ground axiom + the intrinsic-carry clause, and nothing whose truth
+ * is contingent on this workspace.
+ */
+export const primePrinciple = `## Prime Principle
+
+${cratylism}
+
+intrinsic ⟨¬ ambient⟩`;
+//# sourceMappingURL=prime-principle.js.map

package/dist/genus/prime-principle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prime-principle.js","sourceRoot":"","sources":["../../src/genus/prime-principle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mDAAmD,CAAC;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;;EAE5B,SAAS;;sBAEW,CAAC"}

package/dist/hooks/deploy-drift-notice.js

@@ -97,8 +97,8 @@
 // is held by a test rather than remembered.
 //
 // A FULL BYTE COMPARISON of every rendered artifact is therefore what runs — no
-// digest, and above all NO SAMPLE. A sampled check that misses the founding doctrine
-// reports "in sync", which is the exact failure this cell exists to end. The
+// digest, and above all NO SAMPLE. A sample that skips the ten skills carrying the
+// prime principle reports "in sync", which is the exact failure this cell exists to end. The
 // `deploy-drift-notice` suite re-measures the clean path and fails on a regression, so
 // the number above is a held bound rather than a remembered one.
 //
@@ -117,7 +117,7 @@
 //      matches is now THIS harness's, because the projector substitutes this
 //      harness's hooks-file name (`harness-hooks-file`) and its own name
 //      (`harness-name`, passed to the comparator so it audits the right home). A
-//      codex session reports on the codex deployment. The pair lives on
+//      omp session reports on the omp deployment. The pair lives on
 //      `HarnessAdapter` and reaches here through projection, which is the only stage
 //      that knows which adapter it is rendering for — the alternative was a
 //      shell-side copy of the harness registry, a second home for adapter knowledge.
@@ -196,7 +196,7 @@ export const deployDriftNotice = {
 #   - ADVISORY ONLY. Prints to stdout and exits 0. It never emits
 #     {"decision":"block"} — a stale deployment must not block a session.
 #   - NEVER SAMPLES. The comparison is the tool's own: whole tree, byte for byte.
-#     A sampled check that misses the founding doctrine reports "in sync".
+#     A sample that skips the ten skills carrying the prime principle reports "in sync".
 #   - NOT A COUNT. It relays the tool's report, which carries the superseded lines
 #     still running and the rendered lines missing.
 #
@@ -229,9 +229,9 @@ DEPLOY_TOOL={{fact:deploy-bin}}
 
 # WHICH HARNESS THIS PROJECTION IS FOR. A hook worker is handed no identity by the
 # session it runs in, so a worker that must LOOK at a deployed tree had to guess —
-# and guessed claude, which made a codex session report on a sibling deployment.
+# and guessed claude, which made an omp session report on a sibling deployment.
 # These two are the adapter's own \`name\` and \`hooksFile\`, substituted at
-# projection: the codex render of this cell carries codex's.
+# projection: the omp render of this cell carries omp's.
 HARNESS={{fact:harness-name}}
 HARNESS_HOOKS_FILE={{fact:harness-hooks-file}}
 
@@ -283,8 +283,8 @@ done
 # A render tree is recognized by BEING one: \`agents/\` + \`skills/\` + THIS harness's
 # own hooks file. That file is what distinguishes this harness's tree from another
 # harness's tree sitting beside it, and it is named by projection rather than by
-# this script — so a codex render of this worker skips the claude tree and a claude
-# render skips the codex one. The \`--out\` dir is an operator's choice, so the tree
+# this script — so an omp render of this worker skips the claude tree and a claude
+# render skips the omp one. The \`--out\` dir is an operator's choice, so the tree
 # is discovered, never named.
 #
 # THE GLOB USED TO BE \`.render*\`, WHICH MADE THE PARAGRAPH ABOVE FALSE. The shape
@@ -376,7 +376,7 @@ if [ -z "$cli" ]; then
 fi
 
 # \`--harness\` is what makes the audited HOME this session's. Without it the tool
-# resolves its default root, so a codex tree would be compared against the claude
+# resolves its default root, so an omp tree would be compared against the claude
 # deployment — a report that is about neither.
 # The tool reports and repairs nothing, so it is safe to point at a host mid-work.
 set +e

package/dist/hooks/deploy-drift-notice.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-drift-notice.js","sourceRoot":"","sources":["../../src/hooks/deploy-drift-notice.ts"],"names":[],"mappings":"AAEA,kFAAkF;AAClF,kEAAkE;AAClE,EAAE;AACF,oFAAoF;AACpF,qFAAqF;AACrF,gFAAgF;AAChF,sFAAsF;AACtF,0EAA0E;AAC1E,mFAAmF;AACnF,gFAAgF;AAChF,qFAAqF;AACrF,EAAE;AACF,sFAAsF;AACtF,sFAAsF;AACtF,qFAAqF;AACrF,iFAAiF;AACjF,8BAA8B;AAC9B,EAAE;AACF,qFAAqF;AACrF,sFAAsF;AACtF,oFAAoF;AACpF,uFAAuF;AACvF,kFAAkF;AAClF,2BAA2B;AAC3B,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,oFAAoF;AACpF,kFAAkF;AAClF,kFAAkF;AAClF,oFAAoF;AACpF,oFAAoF;AACpF,mFAAmF;AACnF,+BAA+B;AAC/B,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,oFAAoF;AACpF,oFAAoF;AACpF,uFAAuF;AACvF,sFAAsF;AACtF,kFAAkF;AAClF,mFAAmF;AACnF,uFAAuF;AACvF,EAAE;AACF,uFAAuF;AACvF,qFAAqF;AACrF,uFAAuF;AACvF,wFAAwF;AACxF,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AACzF,0FAA0F;AAC1F,wFAAwF;AACxF,0BAA0B;AAC1B,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,yFAAyF;AACzF,oFAAoF;AACpF,uEAAuE;AACvE,EAAE;AACF,mFAAmF;AACnF,8CAA8C;AAC9C,gFAAgF;AAChF,2EAA2E;AAC3E,EAAE;AACF,qFAAqF;AACrF,oFAAoF;AACpF,qFAAqF;AACrF,8BAA8B;AAC9B,gDAAgD;AAChD,gDAAgD;AAChD,oFAAoF;AACpF,6EAA6E;AAC7E,qFAAqF;AACrF,kFAAkF;AAClF,sFAAsF;AACtF,oFAAoF;AACpF,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,wFAAwF;AACxF,gDAAgD;AAChD,gDAAgD;AAChD,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,wFAAwF;AACxF,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,4CAA4C;AAC5C,EAAE;AACF,gFAAgF;AAChF,qFAAqF;AACrF,6EAA6E;AAC7E,uFAAuF;AACvF,iEAAiE;AACjE,EAAE;AACF,qFAAqF;AACrF,iFAAiF;AACjF,mFAAmF;AACnF,iFAAiF;AACjF,EAAE;AACF,sFAAsF;AACtF,+EAA+E;AAC/E,kFAAkF;AAClF,iFAAiF;AACjF,gDAAgD;AAChD,qFAAqF;AACrF,oFAAoF;AACpF,6EAA6E;AAC7E,yEAAyE;AACzE,iFAAiF;AACjF,wEAAwE;AACxE,qFAAqF;AACrF,4EAA4E;AAC5E,qFAAqF;AACrF,gFAAgF;AAChF,gFAAgF;AAChF,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,EAAE;AACF,oFAAoF;AACpF,iFAAiF;AACjF,sFAAsF;AACtF,2DAA2D;AAC3D,EAAE;AACF,+EAA+E;AAC/E,uFAAuF;AACvF,qFAAqF;AACrF,4EAA4E;AAC5E,oFAAoF;AACpF,oFAAoF;AACpF,6BAA6B;AAE7B,MAAM,CAAC,MAAM,iBAAiB,GAAa;IACzC,EAAE,EAAE,qBAAqB;IACzB,OAAO,EACL,i8BAAi8B;IACn8B,SAAS,EAAE,SAAS;IACpB,MAAM,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,KAAK,EAAE,wBAAwB;IAC/B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,MAAM,EAAE;QACN;YACE,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,oVAAoV;SAC3V;QACD;YACE,EAAE,EAAE,YAAY;YAChB,4EAA4E;YAC5E,sEAAsE;YACtE,IAAI,EAAE,qNAAqN;SAC5N;QACD;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,sQAAsQ;SAC7Q;KACF;IACD,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,wBAAwB;YAClC,UAAU,EAAE,yDAAyD;YACrE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiQd;SACI;KACF;CACF,CAAC"}
+{"version":3,"file":"deploy-drift-notice.js","sourceRoot":"","sources":["../../src/hooks/deploy-drift-notice.ts"],"names":[],"mappings":"AAEA,kFAAkF;AAClF,kEAAkE;AAClE,EAAE;AACF,oFAAoF;AACpF,qFAAqF;AACrF,gFAAgF;AAChF,sFAAsF;AACtF,0EAA0E;AAC1E,mFAAmF;AACnF,gFAAgF;AAChF,qFAAqF;AACrF,EAAE;AACF,sFAAsF;AACtF,sFAAsF;AACtF,qFAAqF;AACrF,iFAAiF;AACjF,8BAA8B;AAC9B,EAAE;AACF,qFAAqF;AACrF,sFAAsF;AACtF,oFAAoF;AACpF,uFAAuF;AACvF,kFAAkF;AAClF,2BAA2B;AAC3B,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,oFAAoF;AACpF,kFAAkF;AAClF,kFAAkF;AAClF,oFAAoF;AACpF,oFAAoF;AACpF,mFAAmF;AACnF,+BAA+B;AAC/B,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,oFAAoF;AACpF,oFAAoF;AACpF,uFAAuF;AACvF,sFAAsF;AACtF,kFAAkF;AAClF,mFAAmF;AACnF,uFAAuF;AACvF,EAAE;AACF,uFAAuF;AACvF,qFAAqF;AACrF,uFAAuF;AACvF,wFAAwF;AACxF,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AACzF,0FAA0F;AAC1F,wFAAwF;AACxF,0BAA0B;AAC1B,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,yFAAyF;AACzF,oFAAoF;AACpF,uEAAuE;AACvE,EAAE;AACF,mFAAmF;AACnF,8CAA8C;AAC9C,gFAAgF;AAChF,2EAA2E;AAC3E,EAAE;AACF,qFAAqF;AACrF,oFAAoF;AACpF,qFAAqF;AACrF,8BAA8B;AAC9B,gDAAgD;AAChD,gDAAgD;AAChD,oFAAoF;AACpF,6EAA6E;AAC7E,qFAAqF;AACrF,kFAAkF;AAClF,sFAAsF;AACtF,oFAAoF;AACpF,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,wFAAwF;AACxF,gDAAgD;AAChD,gDAAgD;AAChD,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,wFAAwF;AACxF,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,4CAA4C;AAC5C,EAAE;AACF,gFAAgF;AAChF,mFAAmF;AACnF,6FAA6F;AAC7F,uFAAuF;AACvF,iEAAiE;AACjE,EAAE;AACF,qFAAqF;AACrF,iFAAiF;AACjF,mFAAmF;AACnF,iFAAiF;AACjF,EAAE;AACF,sFAAsF;AACtF,+EAA+E;AAC/E,kFAAkF;AAClF,iFAAiF;AACjF,gDAAgD;AAChD,qFAAqF;AACrF,oFAAoF;AACpF,6EAA6E;AAC7E,yEAAyE;AACzE,iFAAiF;AACjF,oEAAoE;AACpE,qFAAqF;AACrF,4EAA4E;AAC5E,qFAAqF;AACrF,gFAAgF;AAChF,gFAAgF;AAChF,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,EAAE;AACF,oFAAoF;AACpF,iFAAiF;AACjF,sFAAsF;AACtF,2DAA2D;AAC3D,EAAE;AACF,+EAA+E;AAC/E,uFAAuF;AACvF,qFAAqF;AACrF,4EAA4E;AAC5E,oFAAoF;AACpF,oFAAoF;AACpF,6BAA6B;AAE7B,MAAM,CAAC,MAAM,iBAAiB,GAAa;IACzC,EAAE,EAAE,qBAAqB;IACzB,OAAO,EACL,i8BAAi8B;IACn8B,SAAS,EAAE,SAAS;IACpB,MAAM,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,KAAK,EAAE,wBAAwB;IAC/B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,MAAM,EAAE;QACN;YACE,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,oVAAoV;SAC3V;QACD;YACE,EAAE,EAAE,YAAY;YAChB,4EAA4E;YAC5E,sEAAsE;YACtE,IAAI,EAAE,qNAAqN;SAC5N;QACD;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,sQAAsQ;SAC7Q;KACF;IACD,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,wBAAwB;YAClC,UAAU,EAAE,yDAAyD;YACrE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiQd;SACI;KACF;CACF,CAAC"}

package/dist/hooks/purview-guardrail.js

@@ -23,13 +23,15 @@
 // every agent in the corpus composed the fragment it claimed to enforce.
 //
 // WHAT IT BLOCKS is what the arrow excludes, and nothing else:
-//   · a dispatch to a builder for a piece no planner decomposed, from a holder whose
-//     arrow does not write spec — the architect skipping the middle rung;
+//   · a dispatch carrying a spec the dispatcher wrote, from a holder whose arrow does
+//     not write spec — the architect skipping the planner, who alone turns a shard into
+//     units;
 //   · a write to the substrate by a holder whose arrow does not write artifact;
-//   · a dispatch whose prompt is the operator's literal words rather than a cut piece
+//   · a dispatch whose prompt is the operator's literal words rather than a routed name
 //     — the same dispatch-echo the stance guard catches at turn end, refused here
 //     because at this moment the contract that convicts it is the ROLE's.
-// WHAT IT PASSES: a dispatch to a planner, a dispatch to an assayer, READING anything,
+// WHAT IT PASSES: a dispatch to a planner, a dispatch routing a unit name to an
+// implementer, a dispatch to an assayer, a dispatch to the integrator, READING anything,
 // and writing whatever the arrow reserves. Reading is never a block — the architect's
 // contract makes an artifact read a descent, but a read is cheap to undo and a gate
 // that fires on one would wedge every legitimate orientation.
@@ -40,8 +42,10 @@
 // error than a missed one.
 export const purviewGuardrail = {
     id: 'purview-guardrail',
-    residue: 'structural-refusal ↾ mid-turn act ∉ role-arrow · deny-before-fire ⟨descent ⟨write(artifact) ∉ writes⟩ · skipped-rung ⟨dispatch(build) ∄ decomposition⟩ · dispatch-echo ⟨literal-words ≠ cut-piece⟩⟩ · pass ⟨read · act ∈ reserves · dispatch ↦ plan ∨ assay⟩ · law = the HOLDER-projected role-section ⟨quoted verbatim · ¬ authored-opinion⟩ · shared judge-backend ⟨sibling⟩ · fail-open ∧ evidence-checked ∧ re-entry-capped',
+    residue: 'structural-refusal ↾ mid-turn act ∉ role-arrow · deny-before-fire ⟨descent ⟨write(artifact) ∉ writes⟩ · skipped-rung ⟨dispatch(spec the dispatcher wrote) ∄ planner⟩ · dispatch-echo ⟨literal-words ≠ routed-name⟩⟩ · pass ⟨read · act ∈ reserves · dispatch ↦ plan ∨ implement(unit-name) ∨ assay ∨ integrate⟩ · law = the HOLDER-projected role-section ⟨quoted verbatim · ¬ authored-opinion⟩ · shared judge-backend ⟨sibling⟩ · fail-open ∧ evidence-checked ∧ re-entry-capped',
     substrate: 'harness',
+    // Bound by holding a role at all: the arrow it judges against is the role's own.
+    binds: { dimension: 'role' },
     order: 1,
     events: ['subagent.dispatch.pre', 'tool.use.pre'],
     entry: 'purview-guardrail.sh',
@@ -69,19 +73,82 @@ export const purviewGuardrail = {
 #   - CONTRACT-ENROLLED, one step further. A persona whose Target carries no \`## Role\`
 #     section has no arrow to be outside of, so it is allowed. A gate cannot convict
 #     against a law that was never declared.
-#   - FAILS OPEN. Any error (no jq, no Target, judge failure) -> exit 0.
+#   - FAILS OPEN, NEVER SILENTLY. Any error (no jq, no input, no Target, judge failure,
+#     unparseable verdict, unexpected error) -> exit 0, and the call goes through WITH A NOTICE
+#     the operator reads (\`say\`: Claude Code's JSON \`systemMessage\`, omp's relayed line) naming
+#     this guard and why it could not judge. Silence is reserved for "judged, pass", "not
+#     enrolled" and "no arrow declared".
 #   - EVIDENCE-CHECKED. A BLOCK must quote a span that is literally present in the
-#     payload; a citation that is not there is a fabricated block and is DISCARDED.
-#   - LOOP-SAFE. A re-entry cap: never deny an identical tool_input twice.
+#     payload; a citation that is not there is a fabricated block and is DISCARDED — and the
+#     discard is said, since no verdict then stands.
+#   - LOOP-SAFE. A re-entry cap: never deny an identical tool_input twice. The second,
+#     identical call goes through unjudged, and says so.
 #
 # INPUT  : Claude Code PreToolUse hook JSON on stdin.
 # OUTPUT : on a purview breach -> a deny decision on stdout + exit 0.
-#          otherwise -> no stdout + exit 0.
+#          judged, pass -> no stdout + exit 0.
+#          let through with no verdict -> the notice \`say\` prints + exit 0.
 #
-# POSIX sh. Depends on: jq. Missing jq -> fail open.
+# POSIX sh. Depends on: jq. Missing jq -> the guard says so and allows the call.
 
 set -eu
 
+# WHAT AN OPERATOR READS WHEN THE GUARD CANNOT JUDGE, defined before anything that needs a
+# command: the first thing that can be missing is \`jq\`, and a worker run with a PATH holding
+# little beyond \`sh\` and \`cat\` must still say it did not judge, so \`esc\`, \`say\` and \`open\`
+# are builtins only and nothing external runs above the jq check.
+#
+# Claude Code shows the operator a hook's JSON \`systemMessage\` and NOT its plain stdout on
+# exit 0. omp's extension bridge reads the worker's plain stdout, and would relay a JSON object
+# as raw JSON — hence one form per harness, chosen at projection by the harness's own name.
+esc() {
+	_in="$1"
+	_out=""
+	_nl="$(printf '\\nx')"
+	_nl="\${_nl%x}"
+	_tab="$(printf '\\t')"
+	_cr="$(printf '\\r')"
+	while [ -n "$_in" ]; do
+		_rest="\${_in#?}"
+		_c="\${_in%"$_rest"}"
+		case "$_c" in
+			'\\') _c='\\\\' ;;
+			'"') _c='\\"' ;;
+			"$_nl") _c='\\n' ;;
+			"$_tab") _c='\\t' ;;
+			"$_cr") _c='\\r' ;;
+		esac
+		_out="$_out$_c"
+		_in="$_rest"
+	done
+	printf '%s' "$_out"
+}
+say() {
+	case "{{fact:harness-name}}" in
+		claude) printf '{"systemMessage":"%s"}\\n' "$(esc "$1")" ;;
+		*) printf '%s\\n' "$1" ;;
+	esac
+}
+
+allow() { exit 0; }
+
+# A verdict and a failure are different facts and silence carries only one of them: \`allow\`
+# means "judged, pass" or "not this guard's call", \`open\` means "could not judge" — the call
+# still proceeds, and the operator is told.
+open() {
+	[ -z "\${LOG:-}" ] || printf '%s\\n' "open: $1 tool=\${tool_name:-?} agent=\${agent_type:-?}" >> "$LOG" 2>/dev/null || true
+	say "PURVIEW GUARDRAIL — DARK: $1. This call was NOT judged; the absence of a deny is an absence of a verdict, not a clean one."
+	exit 0
+}
+
+# A PreToolUse hook must never break a session. An unexpected error (a nonzero status reaching
+# the trap) is let through AND SAID; every deliberate \`exit 0\` arrives with status 0.
+trap 'rc=$?; [ "$rc" -eq 0 ] || open "an unexpected error stopped it (exit status $rc)"; exit 0' EXIT
+
+input="$(cat)"
+[ -n "$input" ] || open "the hook received no input"
+command -v jq >/dev/null 2>&1 || open "jq is not installed, so the hook payload cannot be read"
+
 # The sibling Stop hook's deployed dir owns the SHARED judge backend, resolved from
 # this script's own location exactly as the pre-hook resolves it — every hooks root
 # holds the hook dirs as siblings, so this derivation is true at every site this file
@@ -94,33 +161,32 @@ RUBRIC="\${PURVIEW_RUBRIC:-$NEUTRAL_ROOT/purview-guardrail/purview-judge-prompt.
 JUDGE_CMD="\${STANCE_JUDGE_CMD:-sh $JUDGE_DIR/stance-judge.sh}"
 LOG="\${PURVIEW_GUARD_LOG:-$SELF_DIR/misses.log}"
 
-trap 'exit 0' EXIT
-
-allow() { exit 0; }
-note() { printf '%s\\n' "$1" >> "$LOG" 2>/dev/null || true; }
-
-input="$(cat)"
-[ -n "$input" ] || allow
-command -v jq >/dev/null 2>&1 || allow
-
 cwd="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
 [ -n "$cwd" ] && cd "$cwd" 2>/dev/null || true
 
 # --- scope gate: the persona's OWN stance manifest -------------------------------------------
+# The scope is the one the harness hands over: \`stance_scope\` where a dispatcher sits in the
+# persona's own scope (omp), else the persona directory of the agent the payload NAMES
+# (\`agent_type\`, Claude Code — none on a bare session) under this harness's home, one hop above
+# the hooks root. Presence of the manifest is enrollment; no agent list lives here.
 stance_scope="$(printf '%s' "$input" | jq -r '.stance_scope // empty' 2>/dev/null || true)"
-[ -n "$stance_scope" ] || allow
-manifest="$stance_scope/stance/manifest.json"
+if [ -z "$stance_scope" ]; then
+	named="$(printf '%s' "$input" | jq -r '.agent_type // empty' 2>/dev/null || true)"
+	case "$named" in '' | */* | . | ..) allow ;; esac
+	stance_scope="$(dirname -- "$HOOKS_ROOT")/{{fact:harness-persona-root}}/$named"
+fi
+manifest="$stance_scope/{{fact:stance-manifest}}"
 [ -f "$manifest" ] || allow
 agent_type="$(jq -r '.agent // empty' "$manifest" 2>/dev/null || true)"
-[ -n "$agent_type" ] || allow
+[ -n "$agent_type" ] || open "the stance manifest at $manifest names no agent, so there is no declared contract to judge against"
 
 # --- the LAW: this persona's own projected role contract -------------------------------------
-# A persona scope is \`<root>/agent/personas/<name>\` and the Target it was projected
-# from is \`<root>/agent/agents/<name>.md\` — two levels out and back down, the same
-# shape of derivation the judge path above uses. Overridable for test rigs.
+# A persona scope is \`<root>/personas/<name>\` (claude) or \`<root>/agent/personas/<name>\` (omp), and
+# the Target it was projected from is \`agents/<name>.md\` beside \`personas/\` — two levels out and
+# back down, the same shape of derivation the judge path above uses. Overridable for test rigs.
 AGENT_ROOT="$(dirname -- "$(dirname -- "$stance_scope")")"
 AGENT_MD="\${PURVIEW_AGENT_MD:-$AGENT_ROOT/agents/$agent_type.md}"
-[ -f "$AGENT_MD" ] || allow
+[ -f "$AGENT_MD" ] || open "the agent's projected Target is not at $AGENT_MD, so its declared contract cannot be read"
 contract="$(awk '/^## Role$/{f=1;next} /^## /{f=0} f' "$AGENT_MD" 2>/dev/null || true)"
 # A contract that is a BARE TOKEN states no arrow, so there is nothing to be outside
 # of. Only a multi-line contract is scoreable, and saying so here is what keeps the
@@ -129,13 +195,13 @@ contract="$(awk '/^## Role$/{f=1;next} /^## /{f=0} f' "$AGENT_MD" 2>/dev/null ||
 
 # --- extract the judged payload, branched by act ---------------------------------------------
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null || true)"
-[ -n "$tool_name" ] || allow
+[ -n "$tool_name" ] || open "the payload names no tool, so there is no call to judge"
 
 case "$tool_name" in
 	Agent|SendMessage|Task)
 		body="$(printf '%s' "$input" | jq -r '.tool_input.prompt // .tool_input.message // .tool_input.description // ""' 2>/dev/null || true)"
 		target="$(printf '%s' "$input" | jq -r '.tool_input.subagent_type // .tool_input.agent // .tool_input.name // ""' 2>/dev/null || true)"
-		act="DISPATCH to \\\`\${target:-unnamed}\\\` (codomain: the spec this delegate will build from)"
+		act="DISPATCH to \\\`\${target:-unnamed}\\\` (codomain: route when it carries a unit name and address only, spec when it carries instructions the dispatcher wrote)"
 		;;
 	Write|Edit|MultiEdit|NotebookEdit)
 		body="$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.path // .tool_input.notebook_path // ""' 2>/dev/null || true)"
@@ -160,28 +226,32 @@ $body"
 session_id="$(printf '%s' "$input" | jq -r '.session_id // "nosession"' 2>/dev/null || echo nosession)"
 sig="$(printf '%s' "$input" | jq -c '.tool_input' 2>/dev/null | cksum | cut -d' ' -f1 2>/dev/null || echo 0)"
 seen="\${TMPDIR:-/tmp}/.purview-pre-$session_id-$sig"
-[ -f "$seen" ] && allow
+[ -f "$seen" ] && open "this exact call was already denied once, so the re-entry cap lets it through unjudged"
 
 # --- judge (SHARED backend, OWN rubric) -----------------------------------------------------
-if [ -n "\${PURVIEW_EMIT_PAYLOAD:-}" ]; then
+# THE SAME SEAM, UNDER THE SAME NAMES, as the two stance workers: a host that holds a model
+# runs this worker twice around a judgment it makes itself (\`STANCE_EMIT_PAYLOAD\` to receive
+# the payload and rubric, \`STANCE_VERDICT_FILE\` naming the answer). This one read
+# \`PURVIEW_\`-prefixed names of its own, so the omp bridge — which speaks the shared names —
+# got no payload back and purview judged nothing there, on every call, while reading as a
+# guard that had found nothing.
+if [ -n "\${STANCE_EMIT_PAYLOAD:-}" ]; then
 	jq -cn --arg r "$RUBRIC" --arg p "$payload" '{rubric:$r, payload:$p}'
 	exit 0
 fi
-if [ -n "\${PURVIEW_VERDICT_FILE:-}" ]; then
-	verdict="$(cat "\${PURVIEW_VERDICT_FILE}" 2>/dev/null || true)"
-	[ -n "$verdict" ] || {
-		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-empty tool=$tool_name agent=$agent_type"
-		allow
-	}
+if [ -n "\${STANCE_VERDICT_FILE:-}" ]; then
+	verdict="$(cat "\${STANCE_VERDICT_FILE}" 2>/dev/null || true)"
+	[ -n "$verdict" ] || open "the judge did not answer"
 else
-	verdict="$(printf '%s' "$payload" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || {
-		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-fail tool=$tool_name agent=$agent_type"
-		allow
-	}
+	verdict="$(printf '%s' "$payload" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || open "the judge did not answer"
 fi
 
-decision="$(printf '%s\\n' "$verdict" | sed -n 's/^VERDICT:[[:space:]]*//p' | head -1)"
-[ "$decision" = "BLOCK" ] || allow
+decision="$(printf '%s\\n' "$verdict" | sed -n 's/^VERDICT:[[:space:]]*//p' | head -1 | sed 's/[[:space:]]*$//')"
+case "$decision" in
+	PASS) allow ;;  # judged, pass: the one silent verdict
+	BLOCK) ;;
+	*) open "the judge's verdict was unparseable (no VERDICT: PASS or VERDICT: BLOCK line)" ;;
+esac
 
 reason="$(printf '%s\\n' "$verdict" | sed -n 's/^REASON:[[:space:]]*//p' | head -1)"
 [ -n "$reason" ] || reason="This act falls outside the arrow your role contract declares."
@@ -193,8 +263,9 @@ reason="$(printf '%s\\n' "$verdict" | sed -n 's/^REASON:[[:space:]]*//p' | head
 cited="$(printf '%s\\n' "$verdict" | sed -n 's/^SPAN:[[:space:]]*//p' | head -1)"
 if [ -n "$cited" ]; then
 	printf '%s' "$payload" | grep -qF -- "$cited" || {
-		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) evidence-fail tool=$tool_name agent=$agent_type span=$cited"
-		allow
+		[ -z "\${LOG:-}" ] || printf '%s\\n' "block-discarded: span=$cited tool=$tool_name agent=$agent_type" >> "$LOG" 2>/dev/null || true
+		say "PURVIEW GUARDRAIL — BLOCK DISCARDED: the judge blocked this call but cited a span that is not in it (fabricated): $cited. No verdict stands; this call was NOT judged clean."
+		exit 0
 	}
 fi
 
@@ -202,10 +273,11 @@ fi
 
 feedback="PURVIEW GUARDRAIL — denied this $tool_name call: it falls outside the arrow your own \\
 role contract declares. $reason  Delegation is a THEOREM of that arrow, not an option: an act whose \\
-domain or codomain lies outside it goes to the role that owns it — a decomposition to a planner, a \\
-build to an implementer, an artifact reading to an assayer. Hand it over and carry on with what the \\
-contract reserves. (Legitimate and NOT blocked here: reading anything, dispatching to a planner or an \\
-assayer, and performing any act the contract's own \\\`reserves\\\` clause names.)"
+domain or codomain lies outside it goes to the role that owns it — a decomposition of a shard to a \\
+planner, a build to an implementer, an artifact reading to an assayer, a merge or a whole check to \\
+the integrator. Hand it over by name and carry on with what the contract reserves. (Legitimate and \\
+NOT blocked here: reading anything, dispatching to a planner, routing a unit name to an implementer, \\
+an assayer or the integrator, and performing any act the contract's own \\\`reserves\\\` clause names.)"
 
 jq -cn --arg r "$feedback" '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:$r}}'
 exit 0
@@ -251,7 +323,9 @@ durative concept lattice — the design.
 
 An act has a **domain** (the layer it consumes) and a **codomain** (the layer it produces):
 
-- a DISPATCH produces a **spec** — the delegate's instructions are the layer being written;
+- a DISPATCH that carries a unit name and its address only produces a **route**; a DISPATCH that
+  carries instructions the dispatcher wrote produces a **spec** — those instructions are the layer
+  being written;
 - a WRITE to a source or config file produces an **artifact**;
 - reading anything at all produces **nothing**, and is never a breach.
 
@@ -263,20 +337,23 @@ whole test, and it is mechanical.
 - **A write whose codomain is \`artifact\` by a holder whose \`writes\` set excludes \`artifact\`.**
   The contract usually names this: \`descent\`. The path in the payload is the evidence.
 - **A dispatch whose codomain is \`spec\` by a holder whose \`writes\` set excludes \`spec\`.** This is
-  the skipped rung: a holder that writes only the design has handed a delegate a spec that no
-  spec-writing role produced. The prompt is the evidence.
-- **A dispatch whose prompt is the operator's literal words rather than a piece the agent cut.** The
-  contract that convicts this is the same clause: a dispatch is a spec, and transcription is not
-  authorship. Evidence is the prompt reading as relayed instructions rather than a bounded piece
-  with its own acceptance.
+  the skipped rung: a holder that writes only the design and its routes has handed a delegate
+  instructions it wrote itself, where only a planner turns a shard into units. The prompt is the
+  evidence.
+- **A dispatch whose prompt is the operator's literal words rather than a routed name.** The
+  contract that convicts this is the same clause: transcription is not authorship, and a dispatch
+  carries a name, not instructions. Evidence is the prompt reading as relayed instructions rather
+  than a unit name with its address.
 
 ## What to PASS — and these are the majority
 
 - **Any read.** Reading is outside the test by construction. Even where a contract calls
   artifact-reading a descent, that is a standing discipline, not a mid-turn refusal.
 - **A dispatch to a role the contract explicitly routes to.** Contracts name their delegations
-  (\`⟨C → spec⟩ ↦ plan\`, \`⟨artifact → C⟩ ↦ assay\`). Handing work to a named delegate is the arrow
-  WORKING.
+  (\`⟨C → spec⟩ ↦ planner\`, \`⟨spec → artifact⟩ ↦ implementer\`, \`⟨artifact → C⟩ ↦ assayer\`, the
+  integrator for gate, merge and record). A dispatch to a planner, a dispatch routing a unit name
+  to an implementer, a dispatch to an assayer and a dispatch to the integrator are the arrow
+  WORKING, whether the contract's \`writes\` names \`route\` or not.
 - **Any act the \`reserves\` clause names**, whatever it is.
 - **A write by a holder whose \`writes\` set includes \`artifact\`.** Most agents in most corpora
   build. Do not read a contract's other clauses as narrowing an arrow that plainly permits the act.

package/dist/hooks/purview-guardrail.js.map

@@ -1 +1 @@
-{"version":3,"file":"purview-guardrail.js","sourceRoot":"","sources":["../../src/hooks/purview-guardrail.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,oFAAoF;AACpF,mFAAmF;AACnF,kFAAkF;AAClF,qBAAqB;AACrB,EAAE;AACF,iFAAiF;AACjF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,+EAA+E;AAC/E,sFAAsF;AACtF,yEAAyE;AACzE,EAAE;AACF,+DAA+D;AAC/D,qFAAqF;AACrF,0EAA0E;AAC1E,gFAAgF;AAChF,sFAAsF;AACtF,kFAAkF;AAClF,0EAA0E;AAC1E,uFAAuF;AACvF,sFAAsF;AACtF,oFAAoF;AACpF,8DAA8D;AAC9D,EAAE;AACF,sFAAsF;AACtF,wFAAwF;AACxF,mFAAmF;AACnF,2BAA2B;AAE3B,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,mBAAmB;IACvB,OAAO,EACL,iaAAia;IACna,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,uBAAuB,EAAE,cAAc,CAAC;IACjD,KAAK,EAAE,sBAAsB;IAC7B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,sBAAsB;YAChC,UAAU,EAAE,uDAAuD;YACnE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6Jd;SACI;QACD;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,KAAK;YACjB,iFAAiF;YACjF,2EAA2E;YAC3E,6EAA6E;YAC7E,8EAA8E;YAC9E,6BAA6B;YAC7B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0Ed;SACI;KACF;CACF,CAAC"}
+{"version":3,"file":"purview-guardrail.js","sourceRoot":"","sources":["../../src/hooks/purview-guardrail.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,oFAAoF;AACpF,mFAAmF;AACnF,kFAAkF;AAClF,qBAAqB;AACrB,EAAE;AACF,iFAAiF;AACjF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,+EAA+E;AAC/E,sFAAsF;AACtF,yEAAyE;AACzE,EAAE;AACF,+DAA+D;AAC/D,sFAAsF;AACtF,wFAAwF;AACxF,aAAa;AACb,gFAAgF;AAChF,wFAAwF;AACxF,kFAAkF;AAClF,0EAA0E;AAC1E,gFAAgF;AAChF,yFAAyF;AACzF,sFAAsF;AACtF,oFAAoF;AACpF,8DAA8D;AAC9D,EAAE;AACF,sFAAsF;AACtF,wFAAwF;AACxF,mFAAmF;AACnF,2BAA2B;AAE3B,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,mBAAmB;IACvB,OAAO,EACL,odAAod;IACtd,SAAS,EAAE,SAAS;IACpB,iFAAiF;IACjF,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;IAC5B,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,uBAAuB,EAAE,cAAc,CAAC;IACjD,KAAK,EAAE,sBAAsB;IAC7B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,sBAAsB;YAChC,UAAU,EAAE,uDAAuD;YACnE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiOd;SACI;QACD;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,KAAK;YACjB,iFAAiF;YACjF,2EAA2E;YAC3E,6EAA6E;YAC7E,8EAA8E;YAC9E,6BAA6B;YAC7B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+Ed;SACI;KACF;CACF,CAAC"}