@geraldmaron/construct 1.0.24 → 1.1.1

package/rules/common/neurodivergent-output.md

@@ -28,7 +28,7 @@ Use headings in order (H2, then H3) and do not skip or nest deeper. One `h1`-equ
 
 ## 3. Scannable chunks
 
-Short paragraphs. Bulleted or numbered lists in place of long sentences that pack several facts together. White space between sections. Prefer three short lines over one dense one.
+Short paragraphs with white space between sections; prefer three short lines over one dense one. Use a bulleted or numbered list for genuinely parallel items — a set of options, steps, or independent facts — where scanning is the point. Keep reasoning, cause-and-effect, and narrative in prose: a wall of bullets fragments the logic that connects the points and is harder to follow, not easier. Bullets for what scans, sentences for what reasons.
 
 ## 4. Plain, literal language
 

package/rules/web/coding-style.md

@@ -1,5 +1,13 @@
 ---
 description: Construct web coding style rule. Use when writing or reviewing web code that involves coding style.
+paths:
+  - "**/*.tsx"
+  - "**/*.jsx"
+  - "**/*.css"
+  - "**/*.scss"
+  - "**/*.html"
+  - "**/*.vue"
+  - "**/*.svelte"
 ---
 > This file extends [common/coding-style.md](../common/coding-style.md) with web-specific frontend content.
 

package/rules/web/design-quality.md

@@ -1,5 +1,13 @@
 ---
 description: Construct web design quality rule. Use when writing or reviewing web code that involves design quality.
+paths:
+  - "**/*.tsx"
+  - "**/*.jsx"
+  - "**/*.css"
+  - "**/*.scss"
+  - "**/*.html"
+  - "**/*.vue"
+  - "**/*.svelte"
 ---
 > This file extends [common/patterns.md](../common/patterns.md) with web-specific design-quality guidance.
 

package/rules/web/hooks.md

@@ -1,5 +1,13 @@
 ---
 description: Prefer project-local tooling.
+paths:
+  - "**/*.tsx"
+  - "**/*.jsx"
+  - "**/*.css"
+  - "**/*.scss"
+  - "**/*.html"
+  - "**/*.vue"
+  - "**/*.svelte"
 ---
 # Web Hooks
 

package/rules/web/patterns.md

@@ -1,5 +1,13 @@
 ---
 description: Construct web patterns rule. Use when writing or reviewing web code that involves patterns.
+paths:
+  - "**/*.tsx"
+  - "**/*.jsx"
+  - "**/*.css"
+  - "**/*.scss"
+  - "**/*.html"
+  - "**/*.vue"
+  - "**/*.svelte"
 ---
 > This file extends [common/patterns.md](../common/patterns.md) with web-specific patterns.
 

package/rules/web/performance.md

@@ -1,5 +1,13 @@
 ---
 description: Construct web performance rule. Use when writing or reviewing web code that involves performance.
+paths:
+  - "**/*.tsx"
+  - "**/*.jsx"
+  - "**/*.css"
+  - "**/*.scss"
+  - "**/*.html"
+  - "**/*.vue"
+  - "**/*.svelte"
 ---
 > This file extends [common/performance.md](../common/performance.md) with web-specific performance content.
 

package/rules/web/security.md

@@ -1,5 +1,13 @@
 ---
 description: Construct web security rule. Use when writing or reviewing web code that involves security.
+paths:
+  - "**/*.tsx"
+  - "**/*.jsx"
+  - "**/*.css"
+  - "**/*.scss"
+  - "**/*.html"
+  - "**/*.vue"
+  - "**/*.svelte"
 ---
 > This file extends [common/security.md](../common/security.md) with web-specific security content.
 

package/rules/web/testing.md

@@ -1,5 +1,13 @@
 ---
 description: Construct web testing rule. Use when writing or reviewing web code that involves testing.
+paths:
+  - "**/*.tsx"
+  - "**/*.jsx"
+  - "**/*.css"
+  - "**/*.scss"
+  - "**/*.html"
+  - "**/*.vue"
+  - "**/*.svelte"
 ---
 > This file extends [common/testing.md](../common/testing.md) with web-specific testing content.
 

package/scripts/sync-specialists.mjs

@@ -44,7 +44,11 @@ import {
   writeCodexConfig,
 } from "../lib/codex-config.mjs";
 import { findOpenCodeConfigPath, readOpenCodeConfig, writeOpenCodeConfig } from "../lib/opencode-config.mjs";
-import { resolvePromptContract } from "../lib/prompt-composer.js";
+import { HEAVY_EXTERNAL_MCP_IDS, LOCAL_SURFACE_MODES, decideTrim, isLocalModel } from "../lib/mcp/tool-budget.mjs";
+import { emitCursorRules } from "../lib/rules-delivery.mjs";
+import { resolvePromptContract, readPromptBody } from "../lib/prompt-composer.js";
+import { renderPersonaForTier } from "../lib/persona-sections.mjs";
+import { getModelVerdict } from "../lib/ollama/capability-store.mjs";
 import {
   buildClaudeMcpEntry,
   buildOpenCodeMcpEntry,
@@ -54,7 +58,7 @@ import { loadConstructEnv } from "../lib/env-config.mjs";
 import { inlineRoleAntiPatterns, PROMPT_WORD_CAP } from "../lib/role-preload.mjs";
 import { loadManifest } from "../lib/roles/manifest.mjs";
 import { resolveActiveProfile } from "../lib/profiles/loader.mjs";
-import { resolveTiersForPrimary } from "../lib/model-router.mjs";
+import { resolveTiersForPrimary, resolveCapabilityTier, selectLocalEditorModel } from "../lib/model-router.mjs";
 import { stampFrontmatter } from "../lib/doc-stamp.mjs";
 import { buildSkillFrontmatter, stripLeadingFrontmatter } from "../lib/sync/skill-frontmatter.mjs";
 
@@ -157,6 +161,19 @@ const COMPRESS_PERSONAS = process.argv.includes("--compress-personas");
 const PROJECT_FLAG = process.argv.includes("--project");
 const GLOBAL_FLAG = process.argv.includes("--global");
 
+// --local-surface=on|off|auto controls whether the heavy external MCP servers are
+// disabled to fit a small local-model window. `auto` (default) trims only when the
+// config's own default model is local — so a cloud session keeps context7/github
+// even on a machine that also has Ollama. `on` forces the trim (the lever for users
+// who pick a local model at runtime, leaving the config default unset); `off` keeps
+// every server. CONSTRUCT_LOCAL_SURFACE is the env equivalent.
+
+const LOCAL_SURFACE = (() => {
+  const arg = process.argv.find((a) => a.startsWith("--local-surface="));
+  const raw = (arg ? arg.slice("--local-surface=".length) : process.env.CONSTRUCT_LOCAL_SURFACE || "auto").trim().toLowerCase();
+  return LOCAL_SURFACE_MODES.includes(raw) ? raw : "auto";
+})();
+
 // --quiet suppresses only the closing one-line summary, not the work or any
 // warning. `construct install` runs the global tier twice (plain `sync` then
 // `sync --global`); in a non-project cwd both land in the same global branch and
@@ -173,8 +190,13 @@ const summary = (msg) => { if (!QUIET) console.log(msg); };
 // Absent → null → write every host, preserving `construct sync` back-compat.
 
 import { detectHostCapabilities } from "../lib/host-capabilities.mjs";
-
-const HOST_KEYS = ["claude", "codex", "copilot", "opencode", "vscode", "cursor"];
+import {
+  HOST_KEYS,
+  displayNameToKey,
+  hasNativeSubagents as hostHasNativeSubagents,
+  globalHookAllowlist,
+  globalMcpAllowlist,
+} from "../lib/platforms/capabilities.mjs";
 
 function parseHostSelection() {
   const arg = process.argv.find((a) => a.startsWith("--hosts="));
@@ -182,14 +204,7 @@ function parseHostSelection() {
   if (!raw) {
     // Default to detected hosts if none are explicitly requested.
     const detected = new Set();
-    const nameToKey = {
-      "Claude Code": "claude",
-      "OpenCode": "opencode",
-      "Codex": "codex",
-      "VS Code": "vscode",
-      "Cursor": "cursor",
-      "Copilot": "copilot",
-    };
+    const nameToKey = displayNameToKey();
     try {
       for (const cap of detectHostCapabilities()) {
         if (cap.availability === "installed" && nameToKey[cap.host]) {
@@ -427,7 +442,7 @@ const hardDefaults = {
 // primary's provider. Explicit CX_MODEL_* env wins if set.
 const primaryFromOpenCode = (() => {
   try {
-    const cfg = readOpenCodeConfig(findOpenCodeConfigPath()) ?? {};
+    const cfg = readOpenCodeConfig().config ?? {};
     return cfg.model || cfg.defaultModel || null;
   } catch { return null; }
 })();
@@ -589,7 +604,83 @@ export function renderRoleFrameworkSection(entry) {
   return `\n\n${lines.join("\n")}`;
 }
 
-function buildPrompt(entry, allEntries, platform) {
+// The native-subagent orchestration micro-prompt. A worked tool-call example lifts
+// small local models' tool-use reliability sharply (bead construct-c16l). Shared by the
+// full path and the capability-tiered local path so both stay in sync.
+
+const ORCHESTRATION_MICRO_PROMPT =
+  `You are the primary orchestrator. To discover available specialist agents, you MUST call the \`orchestration_policy\` MCP tool. Do not guess agent names.\n\n` +
+  `Example — the user says "add rate limiting to the API". Your first action is a tool call, not prose:\n` +
+  `  call orchestration_policy { "task": "add rate limiting to the API" }\n` +
+  `Then dispatch the specialists it returns. Always call the tool before answering.`;
+
+// Directive for the local editor agent (construct-local). It executes bounded work on
+// the cheap local model and hands planning/reasoning back to the construct architect —
+// the aider architect/editor split. Kept short: a small model must actually obey it.
+
+const LOCAL_EDITOR_DIRECTIVE =
+  `You are a focused execution agent running on a local model, dispatched by construct to do one bounded job. Do well-scoped edits for the current task and verify them; make the smallest correct change, never a broad rewrite.\n` +
+  `You do NOT plan, classify, orchestrate, or spawn other agents. For anything needing multi-file design, architecture or security judgment, dependency or contract changes, or research, STOP and return control to construct — report what needs deeper work and why, rather than attempting it yourself.`;
+
+// Warn-and-emit capability advisory. Sizing already consumes the probe verdict
+// (COLLAPSED → floor tier via resolveCapabilityTier); this only nudges the user toward a
+// measured verdict and never suppresses emission. Notice-only, so it auto-suppresses in
+// CI / test / non-TTY per the repo's wrong-context rule — no skip env var.
+
+const localAdvisorySeen = new Set();
+function adviseLocalModelCapability(model) {
+  if (!model || !isLocalModel(model)) return;
+  if (process.env.CI === "true" || process.env.NODE_ENV === "test" || !process.stderr.isTTY) return;
+  if (localAdvisorySeen.has(model)) return;
+  localAdvisorySeen.add(model);
+  const verdict = getModelVerdict(model)?.verdict ?? null;
+  if (verdict === "COLLAPSED") {
+    console.warn(`[sync] ${model} probed COLLAPSED — emitting at the floor tier with escalation to construct. Re-probe after a Modelfile change: construct doctor --probe-local`);
+  } else if (!verdict) {
+    console.warn(`[sync] ${model} is local with no coherence verdict — tier inferred from parameter count. For a measured tier: construct doctor --probe-local`);
+  }
+}
+
+function enforcePromptWordCap(prompt, entry) {
+  const wordCount = prompt.split(/\s+/).filter(Boolean).length;
+  const effectiveCap = Number(entry.wordCapOverride) > 0 ? entry.wordCapOverride : PROMPT_WORD_CAP;
+  if (wordCount > effectiveCap) {
+    const msg = `[sync] ${entry.name}: prompt is ${wordCount} words (cap ${effectiveCap})`;
+    if (process.env.CONSTRUCT_SYNC_FORCE === '1' || process.argv.includes('--force')) {
+      console.warn(`${msg} — proceeding due to --force / CONSTRUCT_SYNC_FORCE=1.`);
+    } else {
+      console.error(`${msg}`);
+      console.error(
+        `[sync] Hard cap exceeded. Options:\n` +
+        `   - trim the prompt body or move detail to a skill (preferred)\n` +
+        `   - set "wordCapOverride": <N> on this entry in specialists/registry.json with a written reason\n` +
+        `   - re-run with --force or CONSTRUCT_SYNC_FORCE=1 as a temporary escape hatch\n` +
+        `Prompt budget is a hard contract because every over-cap agent degrades every session that dispatches it.`,
+      );
+      process.exit(1);
+    }
+  }
+  return prompt;
+}
+
+function buildPrompt(entry, allEntries, platform, { capabilityTier = 'full' } = {}) {
+  const capabilities = { hasNativeSubagents: HOST_KEYS.includes(platform) ? hostHasNativeSubagents(platform) : false };
+
+  // Capability-tiered local path. A small local model follows a long multi-instruction
+  // persona poorly (instruction-following degrades before the window fills), so emit
+  // only the persona sections at/below its tier plus the orchestration micro-prompt, and
+  // skip the role footer, role-framework, operating-guidance, and model-family blocks —
+  // those add instruction load the model cannot track. Cloud models resolve to 'full'
+  // and take the unchanged path below, so cloud configs are never slimmed.
+
+  if (capabilityTier && capabilityTier !== 'full' && entry.promptFile) {
+    let slim = renderPersonaForTier(readPromptBody(entry.promptFile, root), capabilityTier);
+    if (entry.injectAgentRoster && capabilities.hasNativeSubagents) {
+      slim = `${ORCHESTRATION_MICRO_PROMPT}\n\n${slim}`;
+    }
+    return enforcePromptWordCap(slim, entry);
+  }
+
   let prompt = resolvePromptContract(entry, {
     rootDir: root,
     registry,
@@ -598,9 +689,19 @@ function buildPrompt(entry, allEntries, platform) {
 
   prompt = inlineRoleAntiPatterns(prompt, root, entry.name, console.warn, { preload: entry.preloadRoleGuidance === true });
 
-  if (entry.injectAgentRoster && allEntries) {
+  // Platform-Native Orchestration Alignment (ADR-0002). Hosts with native subagent
+  // routing (OpenCode, VS Code, Cursor) do not get the static specialist roster
+  // injected — on a small-context local model the roster alone is ~3-4k tokens and,
+  // combined with MCP tool schemas, overruns the model's real context window and
+  // collapses output. Those hosts get a tool-bound micro-prompt instead and resolve
+  // the chain at runtime via the orchestration_policy MCP tool. Hosts without native
+  // routing (Claude Code, Codex) still need the roster to simulate handoffs in text.
+
+  if (entry.injectAgentRoster && allEntries && !capabilities.hasNativeSubagents) {
     const roster = buildAgentRoster(allEntries);
     prompt = `Available specialist agents:\n${roster}\n\n${prompt}`;
+  } else if (entry.injectAgentRoster && capabilities.hasNativeSubagents) {
+    prompt = `${ORCHESTRATION_MICRO_PROMPT}\n\n${prompt}`;
   }
 
   prompt += buildRoleFooter(entry);
@@ -616,26 +717,7 @@ function buildPrompt(entry, allEntries, platform) {
 
   prompt += buildModelGuidanceBlock(entry);
 
-  const wordCount = prompt.split(/\s+/).filter(Boolean).length;
-  const effectiveCap = Number(entry.wordCapOverride) > 0 ? entry.wordCapOverride : PROMPT_WORD_CAP;
-  if (wordCount > effectiveCap) {
-    const msg = `[sync] ${entry.name}: prompt is ${wordCount} words (cap ${effectiveCap})`;
-    if (process.env.CONSTRUCT_SYNC_FORCE === '1' || process.argv.includes('--force')) {
-      console.warn(`${msg} — proceeding due to --force / CONSTRUCT_SYNC_FORCE=1.`);
-    } else {
-      console.error(`${msg}`);
-      console.error(
-        `[sync] Hard cap exceeded. Options:\n` +
-        `   - trim the prompt body or move detail to a skill (preferred)\n` +
-        `   - set "wordCapOverride": <N> on this entry in specialists/registry.json with a written reason\n` +
-        `   - re-run with --force or CONSTRUCT_SYNC_FORCE=1 as a temporary escape hatch\n` +
-        `Prompt budget is a hard contract because every over-cap agent degrades every session that dispatches it.`,
-      );
-      process.exit(1);
-    }
-  }
-
-  return prompt;
+  return enforcePromptWordCap(prompt, entry);
 }
 
 function escapeRegExp(value) { return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); }
@@ -800,18 +882,26 @@ function makeHooksPortable(hooksJson) {
   return JSON.stringify(walk(hooksJson));
 }
 
-const GLOBAL_CLAUDE_HOOK_IDS = new Set([
-  'pre:bash:block-no-verify',
-  'pre:bash:guard-dangerous',
-  'pre:edit:config-protection',
-  'pre:edit-guard',
-  'post:edit:json-validate',
-  'post:edit:scan-secrets',
-]);
+const GLOBAL_CLAUDE_HOOK_IDS = globalHookAllowlist('claude');
 
-const GLOBAL_CLAUDE_MCP_IDS = new Set([
-  'context7',
-]);
+const GLOBAL_CLAUDE_MCP_IDS = globalMcpAllowlist('claude');
+
+// Project scope writes only core-category MCP servers (plus construct-mcp, the
+// orchestration server the specialist loop needs). optional/integration servers
+// (memory, github, sequential-thinking, playwright, …) are opt-in via
+// `construct mcp add` so a project does not silently inherit heavy servers it was
+// never asked for (ADR-0031 §Consequences follow-up). A server already present in
+// the project settings is preserved, so a manual opt-in sticks.
+
+const PROJECT_DEFAULT_MCP_IDS = (() => {
+  try {
+    const catalog = JSON.parse(fs.readFileSync(path.join(root, "lib", "mcp-catalog.json"), "utf8"));
+    const arr = catalog.mcps || catalog.servers || [];
+    return new Set([...arr.filter((m) => m.category === "core").map((m) => m.id), "construct-mcp"]);
+  } catch {
+    return new Set(["context7", "construct-mcp"]);
+  }
+})();
 
 function filterGlobalClaudeHooks(hooksJson) {
   const filtered = {};
@@ -871,6 +961,7 @@ function writeProjectClaudeSettings(targetDir) {
     existing.mcpServers ??= {};
     for (const [id, mcpDef] of Object.entries(template.mcpServers)) {
       if (existing.mcpServers[id]) continue;
+      if (!PROJECT_DEFAULT_MCP_IDS.has(id)) continue;
       existing.mcpServers[id] = mcpDef;
     }
   }
@@ -886,6 +977,7 @@ function writeProjectClaudeSettings(targetDir) {
   existing.mcpServers ??= {};
   for (const [id, mcpDef] of Object.entries(registryMcp)) {
     if (existing.mcpServers[id]) continue;
+    if (!PROJECT_DEFAULT_MCP_IDS.has(id)) continue;
     existing.mcpServers[id] = buildClaudeMcpEntry(id, mcpDef, process.env);
   }
 
@@ -1347,6 +1439,15 @@ function syncCursor(targetDir = null, wants = true) {
         fs.writeFileSync(rulesPath, body);
       }
     }
+
+    // Glob-scoped language rules land as managed per-rule .mdc files only when
+    // the project's own files match their globs — Cursor's native auto-attach
+    // convention. See docs/concepts/rules-delivery.md.
+    try {
+      emitCursorRules({ rulesDir: path.join(root, "rules"), targetDir, dryRun: DRY_RUN });
+    } catch (err) {
+      console.warn(`[sync] cursor rules delivery skipped: ${err.message}`);
+    }
   }
   return true;
 }
@@ -1362,22 +1463,39 @@ function opencodePermissions(entry) {
     ? Object.fromEntries(Object.entries(entry.permissions).map(([k, v]) => [k, v]))
     : { edit: entry.canEdit === false ? "deny" : "allow", bash: "allow" };
 
-  // The orchestrator is the primary write surface; translate its abstract
-  // bash:allow into OpenCode's scoped permission map so destructive commands are
-  // denied and remote/history rewrites prompt — the commit-approval contract
-  // enforced at the tool layer, not just in the prompt. Subagents keep the
-  // abstract grant. This scoped shape is an OpenCode translation detail and stays
-  // out of the cross-adapter registry.
-
-  if (entry.isOrchestrator && perms.bash === "allow") {
-    perms.bash = {
-      "*": "allow",
-      "rm -rf *": "deny",
-      "git push *": "ask",
-      "git push --force*": "ask",
-      "git reset --hard *": "ask",
-    };
+  // Agentic Scope Reduction (ADR-0002). Serializing 100+ MCP tool schemas into a
+  // small local model's prompt overruns its context window and dilutes attention,
+  // collapsing output. OpenCode's per-agent permission map prunes the surface: the
+  // orchestrator keeps only orchestration + core tools and hands execution to
+  // subagents; subagents keep execution tools but not orchestration.
+
+  if (entry.isOrchestrator) {
+    if (perms.bash === "allow") {
+      perms.bash = {
+        "*": "allow",
+        "rm -rf *": "deny",
+        "git push *": "ask",
+        "git push --force*": "ask",
+        "git reset --hard *": "ask",
+      };
+    }
+    // Heavy execution and external-knowledge tools are denied to the orchestrator so
+    // its serialized tool schema stays small; orchestration_policy drives the handoff.
+
+    perms["mcp__construct-mcp__extract_document_text"] = "deny";
+    perms["mcp__construct-mcp__ingest_document"] = "deny";
+    perms["mcp__construct-mcp__scan_file"] = "deny";
+    perms["mcp__github__*"] = "deny";
+    perms["mcp__context7__*"] = "deny";
+    perms["mcp__sequential-thinking__*"] = "deny";
+    perms["mcp__memory__*"] = "deny";
+  } else {
+    // Subagents shouldn't be orchestrating
+    perms["mcp__construct-mcp__orchestration_policy"] = "deny";
+    perms["mcp__construct-mcp__agent_contract"] = "deny";
+    perms["mcp__construct-mcp__broker_check"] = "deny";
   }
+
   return perms;
 }
 
@@ -1527,6 +1645,34 @@ function syncOpencode(entries, targetDir = null, wants = true) {
         config.mcp[openCodeId] = buildOpenCodeMcpEntry(id, mcpDef, process.env).entry;
       }
     }
+
+    // Heavy external MCP servers serialize ~12k tokens of schema into EVERY
+    // agent's request — including the built-in Build/Plan agents the per-agent
+    // permission prune cannot reach. OpenCode 1.15.4 has no per-session tool
+    // filter (chat.params carries no tool list), so disabling the whole server in
+    // opencode.json is the only lever. The decision is INTENT-driven: trim only
+    // when this config's own default model is local (or a local Ollama provider is
+    // registered in it), so a cloud session on a machine that merely also has
+    // Ollama keeps context7/github. decideTrim centralizes the policy; a manual
+    // enabled:true is preserved so a user can re-enable a server they need.
+
+    // A set default model is explicit intent and wins (local → trim, cloud → keep).
+    // Only when no default is chosen does a registered Ollama provider stand in as
+    // soft local intent — so a cloud-default config is never trimmed for merely
+    // listing local models alongside.
+    const configDefaultModel = config.model || config.defaultModel || "";
+    const registersOllamaProvider = Object.keys(config.provider?.ollama?.models || {}).length > 0;
+    const intentModel = configDefaultModel || (registersOllamaProvider ? "ollama" : "");
+    const trimHeavyServers = decideTrim({ surface: LOCAL_SURFACE, defaultModel: intentModel });
+    for (const id of HEAVY_EXTERNAL_MCP_IDS) {
+      const ocId = getOpenCodeMcpId(id);
+      if (!config.mcp[ocId]) continue;
+      if (trimHeavyServers) {
+        if (config.mcp[ocId].enabled !== true) config.mcp[ocId].enabled = false;
+      } else {
+        delete config.mcp[ocId].enabled;
+      }
+    }
   }
 
   // Sweep cx-* / orchestrator agents that fall outside the current write set.
@@ -1542,6 +1688,20 @@ function syncOpencode(entries, targetDir = null, wants = true) {
   }
 
   // Write agents — no model/modelFallback set; agents inherit the global model.
+  //
+  // Capability tier for the orchestrator prompt. Keyed ONLY to an EXPLICIT local default
+  // model — that is a clear intent signal we can size against at sync time. With no
+  // explicit default (the orchestrator runs whatever model the user picks at runtime) or
+  // a cloud default, resolveCapabilityTier returns 'full', so cloud configs and unknown
+  // selections are never slimmed. Per-model slimming of a known pinned model lands on the
+  // construct-local editor agent.
+
+  const orchestratorDefaultModel = config.model || config.defaultModel || "";
+  adviseLocalModelCapability(orchestratorDefaultModel);
+  const orchestratorTier = resolveCapabilityTier({
+    model: orchestratorDefaultModel,
+    verdict: orchestratorDefaultModel ? (getModelVerdict(orchestratorDefaultModel)?.verdict ?? null) : null,
+  });
 
   for (const entry of writeEntries) {
     const name = adapterName(entry);
@@ -1551,7 +1711,9 @@ function syncOpencode(entries, targetDir = null, wants = true) {
         ? `${entry.role} — ${entry.description}`
         : entry.description,
       mode: entry.isOrchestrator ? "all" : "subagent",
-      prompt: buildPrompt(entry, entries, "opencode"),
+      prompt: buildPrompt(entry, entries, "opencode", {
+        capabilityTier: entry.isOrchestrator ? orchestratorTier : "full",
+      }),
       permission: {
         ...perms,
         task: opencodeTaskPermissions(entry),
@@ -1559,12 +1721,64 @@ function syncOpencode(entries, targetDir = null, wants = true) {
     };
   }
 
+  // Hybrid split (aider architect/editor). When the fast tier is a LOCAL model, emit a
+  // narrow `construct-local` editor: it does bounded edits on a cheap local model and hands
+  // planning/reasoning back to `construct` (the architect, which stays on the user's chosen
+  // model — we never pin it). The editor's model is NOT the generic fast-tier default
+  // (which for an Ollama family resolves to a non-code generalist); it is the best-installed
+  // CODE model from this config's DECLARED local inventory (OpenCode only uses declared
+  // models), excluding probe-COLLAPSED ones, with the fast tier as a last resort. Its prompt
+  // is sized to the chosen model's capability tier. Deterministic name, so manage it
+  // explicitly: emit when fast is local, delete otherwise, so switching to cloud cleans up.
+
+  const orchestratorEntry = writeEntries.find((e) => e.isOrchestrator) || registry.orchestrator;
+  const orchestratorName = orchestratorEntry ? adapterName(orchestratorEntry) : "construct";
+  const localEditorName = `${orchestratorName}-local`;
+  if (orchestratorEntry?.promptFile && isLocalModel(resolvedModels.fast)) {
+    const declaredLocal = Object.entries(config.provider || {})
+      .flatMap(([pid, pv]) => Object.keys(pv?.models || {}).map((mk) => `${pid}/${mk}`))
+      .filter((id) => isLocalModel(id) && getModelVerdict(id)?.verdict !== "COLLAPSED");
+    const editorModel = selectLocalEditorModel(declaredLocal) || resolvedModels.fast;
+    adviseLocalModelCapability(editorModel);
+    const editorVerdict = getModelVerdict(editorModel)?.verdict ?? null;
+    const editorTier = resolveCapabilityTier({ model: editorModel, verdict: editorVerdict });
+    const editorBody = renderPersonaForTier(readPromptBody(orchestratorEntry.promptFile, root), editorTier);
+    config.agent[localEditorName] = {
+      description: "Local execution agent — bounded edits on the local model; escalates planning and reasoning to construct.",
+      mode: "subagent",
+      model: editorModel,
+      prompt: `${LOCAL_EDITOR_DIRECTIVE}\n\n${editorBody}`,
+      permission: {
+        edit: "allow",
+        bash: { "*": "allow", "rm -rf *": "deny", "git push *": "ask", "git push --force*": "ask", "git reset --hard *": "ask" },
+        "mcp__construct-mcp__orchestration_policy": "deny",
+        "mcp__construct-mcp__agent_contract": "deny",
+        "mcp__construct-mcp__broker_check": "deny",
+        "mcp__github__*": "deny",
+        "mcp__context7__*": "deny",
+        "mcp__sequential-thinking__*": "deny",
+        "mcp__memory__*": "deny",
+        // OpenCode 1.15.4 disables the `task` tool entirely for any restrictive task map
+        // (verified in a sterile run). For an editor that is exactly right: it spawns no
+        // subagents and escalates by RETURNING to the construct agent that dispatched it,
+        // not by dispatching. Deny-all states that intent directly.
+        task: { "*": "deny" },
+      },
+    };
+  } else {
+    delete config.agent[localEditorName];
+  }
+
+  // Pass current Construct model tiers to OpenCode config for native routing.
+  config.construct = config.construct || {};
+  config.construct.models = { ...resolvedModels };
+
   // Seed a cheap auxiliary model for titles and summaries when the user has not
   // chosen one — a cost lever only. The primary `model` stays the user's choice
   // and is never written. Global scope only; project configs inherit it.
 
   if (!targetDir && config.small_model === undefined) {
-    config.small_model = "anthropic/claude-haiku-4-5-20251001";
+    config.small_model = resolvedModels.fast || "anthropic/claude-haiku-4-5-20251001";
   }
 
   writeOpenCodeConfig(config, configPath);

package/skills/docs/init-project.md

@@ -32,7 +32,7 @@ docs/                   ← human-readable project documentation
 1. Treat `.cx/context.md`, `.cx/context.json`, `.cx/workflow.json`, `docs/README.md`, and `docs/architecture.md` as required project state.
 2. Read them at the start of every meaningful session.
 3. Update them whenever work changes active reality: decisions, workflow phase, architecture assumptions, or documentation contract.
-4. Run `construct serve` to see the project in the dashboard.
+4. Run `construct dashboard` to see the project in the dashboard.
 
 ## For cx-docs-keeper
 At session start, check the core docs set. If missing, suggest running `construct init-docs`.

package/specialists/prompts/cx-architect.md

@@ -1,3 +1,23 @@
+---
+name: cx-architect
+role: architect
+version: 1
+perspective:
+  bias: "Designs that emerged from code, missing ADRs, data models that encode assumptions that will change"
+  tension: "cx-engineer"
+  openingQuestion: "What are the invariants, and what breaks if they're violated?"
+  failureMode: "If the ADR has no 'options rejected' section, the decision defaulted — and defaulted decisions bite hardest."
+roleGuidance: roles/architect
+roleOverlays:
+  - architect.platform
+  - architect.integration
+  - architect.data
+  - architect.ai-systems
+  - architect.enterprise
+templates:
+  - adr
+---
+
 You have inherited enough unmaintainable systems to be permanently suspicious of clever solutions. The damage from a bad interface contract compounds silently for years. Your job is to make the right trade-offs explicit before implementation locks them in.
 
 **Anti-fabrication contract**: every load-bearing claim in an ADR, RFC, or design doc cites a source the reader can re-verify (`[source: path#anchor]`, `[source: bd-<id>]`, `[source: <commit-sha>]`). When a fact isn't in the source you have, write `unknown` or `[unverified]`. Don't invent rejected alternatives that were never considered. See `rules/common/no-fabrication.md`.

package/specialists/prompts/cx-test-automation.md

@@ -1,3 +1,15 @@
+---
+name: cx-test-automation
+role: test-automation
+version: 1
+perspective:
+  bias: "Intermittent tests dismissed as infrastructure, coverage numbers over behavioral coverage, arbitrary sleeps"
+  tension: "cx-qa"
+  openingQuestion: "Is this test deterministic, and does it actually fail when the behavior it's testing breaks?"
+  failureMode: "If the test suite has never caught a production bug, the tests are testing the wrong things."
+roleGuidance: roles/qa.test-automation
+---
+
 You have inherited enough flaky test suites to know that bad automation is worse than no automation: it creates false confidence while hiding real failures. The test that passes intermittently isn't catching bugs; it's teaching the team to ignore red builds.
 
 **Anti-fabrication contract**: every test reliability claim cites the run history (pass rate over N runs). Don't call a test flaky from one failure or stable without the data. Coverage and performance claims cite the report, not an estimate. See `rules/common/no-fabrication.md`.

package/templates/docs/construct_guide.md

@@ -109,7 +109,7 @@ All ports bind to `127.0.0.1` only; nothing is reachable from other machines on
 | `construct config [mode <m>]` | Show active deployment mode (solo / team / enterprise) or set a new one |
 | `construct doctor` | Health check across config, services, agents, hooks |
 | `construct sync` | Regenerate platform adapters (Claude Code, OpenCode, Codex, Cursor) |
-| `construct up` / `construct down` | Start / stop local services |
+| `construct dev` / `construct stop` | Start / stop local services |
 | `construct status` | Live runtime status (services, providers, daemons) |
 | `construct intake list / show / done / skip / reopen` | Drive the R&D intake queue produced from `.cx/inbox/` |
 | `construct graph from-intake <id>` | Generate a task graph from a triaged intake packet |
@@ -131,7 +131,7 @@ That refreshes the agents, hooks, and slash commands in `.claude/` and `.constru
 
 ```bash
 construct doctor              # most issues surface here with a fix hint
-construct down && construct up  # restart local services
+construct stop && construct dev  # restart local services
 ```
 
 Troubleshooting guide: <https://geraldmaron.github.io/construct/docs/operations/troubleshooting>