@orkestrel/scaffold 0.0.107 → 0.0.108

package/dist/host/claude/rules/campaign.md

@@ -0,0 +1,55 @@
+---
+paths:
+  - '.orkestrel/**/*'
+---
+
+# Campaign folder rules
+
+`.orkestrel/` is the tracked record of a live campaign: everything a session on another machine, under another harness, needs to resume the work. `.agents/orchestration.md` owns how agents run. This file owns what the folder holds, how to write it, and how a session starts from it.
+
+## Layout
+
+| Path                    | Holds                                                                                                                                    |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| `.orkestrel/<package>/` | one package's live campaign                                                                                                              |
+| `.orkestrel/plan.md`    | the fleet campaign's plan: goal, exit criterion, packages, layer order, and the units each package owes                                  |
+| `.orkestrel/ledger.md`  | the fleet campaign's ledger                                                                                                              |
+| `.orkestrel/release.md` | the live release wave: its layers, each package's bump ruling with its evidence, the round each package landed in, and standing readings |
+
+A package directory holds:
+
+| File                    | Holds                                                                                                                                                                       | When                                                      |
+| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
+| `plan.md`               | a concise goal and exit criterion that serve as a goal prompt, each repository the campaign changes by name and URL, § State, open decisions, deferred triggers, § Sequence | always                                                    |
+| `ledger.md`             | one row per dispatched unit and per user ruling on routing or scope: date, unit, role, carrier                                                                              | always                                                    |
+| `README.md`             | the file map, the read order, and the id law                                                                                                                                | when the folder holds more than `plan.md` and `ledger.md` |
+| `tenets.md`             | the campaign's standing directives                                                                                                                                          | when the campaign has any                                 |
+| `ideas.md`, `gaps.md`   | ideas set aside and library gaps, each numbered for life with its reason and its reopen trigger                                                                             | when the campaign records any                             |
+| `designs/`, `research/` | one design or research record per subject                                                                                                                                   | when a chunk needs one                                    |
+| a verdict file          | the verdict of an open seam                                                                                                                                                 | until the seam closes                                     |
+
+- Write a file about one package under that package's directory, and a file about two or more packages at the top level.
+- Name a ledger row's lane by its role in `.agents/orchestration.md` § Roles. Write no row for the Orchestrator's own commit.
+
+## Content
+
+- Track every file under `.orkestrel/`. Cite a tracked file, a commit, or a published URL. Cite no git-ignored path, no agent memory, and no path outside the repository; name a sibling repository by its package name and a path inside it.
+- Name no harness, model, provider, harness tool, operating system, shell, or machine as the host or engine of the work. Name a lane by its role. A product statement about a host family follows `.claude/rules/portability.md` § Claims.
+- Write every line as a directive, a fact, or a table cell, per `.claude/rules/writing.md` § Instruction files: absolute dates, one home per fact, a tree location by symbol and file. A decision or a measurement lives in the commit that made it; cite the commit.
+- Keep live state out: engine availability, session ownership, process ids, installed versions, and another repository's state live in the roster, `package.json`, and that repository.
+- Keep unit briefs, reports, journals, and drafts under the checkout's `tmp/` (`.agents/orchestration.md` § tmp layout); that file's § Cleanup owns what a unit's files carry before they go.
+- Record a prepared, unapplied change as text in `plan.md` or as a commit, never as a pointer to scratch.
+
+## Start a session
+
+1. Read the package folder's `README.md` when present, then `plan.md` § State, then the first open chunk of § Sequence.
+2. Run `git status --porcelain -b`, `git log @{upstream}..`, and `node .agents/skills/orkestrel-dispatch/scripts/sweep.ts --report`. Reconcile each difference with § State before you act.
+3. Act only on what the folder, the tree, and git hold. Agent memory from another machine or harness is absent.
+
+## Hand off and close
+
+- Keep `plan.md` § State current at every commit, and make its last line the next action.
+- Before a session ends or its context compacts, write each ruling, decision, and next action into the folder; `.agents/orchestration.md` § Memory owns what memory can hold.
+- When a chunk closes, remove it from § Sequence. Its closing commit carries its evidence, and § State names the commit.
+- Delete a verdict file when its seam closes.
+- At acceptance, move each file that outlives the campaign to its root home, retarget its citations in the same change, and delete the package directory per `.agents/skills/orkestrel-debrief/references/retention.md`. Delete a top-level file when the wave or fleet campaign it records closes.

package/dist/host/claude/rules/documentation.md

@@ -86,6 +86,8 @@ Never use in-repository `@src/*` aliases in public guide examples; reserve them
 - Name a skill directory `orkestrel-<word>`: the prefix and one word naming the process or the subject, such as `orkestrel-harden` or `orkestrel-journey`. Never a second word.
 - For a portable skill that teaches an external framework, takes the host project's own `AGENTS.md` file as its code law, and binds none of this repository's rule files, drop the `orkestrel-` prefix and name the skill for the framework a reader searches for. Add no other exception. The `enterprise-bootstrap` skill meets that test and keeps its name: it carries Bootstrap 5.3 craft, assumes no stack, and names the `.agents/orchestration.md` and `.claude/rules/quality.md` files only where they are present. Do not rename it into the namespace.
 - Keep `SKILL.md` concise and route conditional detail to one-level `references/`.
+- In a `SKILL.md`, name another skill's reference by that skill and the reference's title, never as a `references/<name>.md` path; the policy sweep attributes that token to the citing skill.
+- When you add a canonical skill, register it in `TARGET_SKILL_NAMES` in `src/core/constants.ts`, in the skill lists of `tests/distribution.test.ts`, `tests/src/core/Compiler.test.ts`, and `tests/src/core/compilers.test.ts`, and in the pointer-file count of `tests/src/bin/CLI.test.ts`, then regenerate `host.json` with a build.
 - Name every Markdown file in a skill's `references/` from its `SKILL.md`, and delete a reference nothing names.
 - Frontmatter contains only `name` and a trigger-focused `description`.
 - Set `name` to the skill's own directory name.

package/dist/host/claude/rules/portability.md

@@ -9,7 +9,6 @@ paths:
   - 'guides/**/*'
   - 'package.json'
   - '.gitattributes'
-  - '.github/workflows/*'
 ---
 
 # Host portability rules
@@ -99,7 +98,7 @@ and the form of a conditional skip.
 
 ## Claims
 
-- Never describe the suite, the host, or CI as POSIX. Name the host and the date behind a reading.
+- Never describe the suite or the host as POSIX. Name the host and the date behind a reading.
 - Run the gate chain on each host a change claims, and record a reading that could not run as a
   limit naming the host it needs.
 - Keep a POSIX-shaped `file:///` literal in a guide only as an opaque fictional identifier. Build

package/dist/host/claude/rules/typescript.md

@@ -233,7 +233,7 @@ type Result<T, E = Error> = Success<T> | Failure<E>
 ## Comments and API documentation
 
 - Comments explain why, never restate what self-explanatory code does. The Writing rules in `AGENTS.md` and `.claude/rules/writing.md` govern their prose.
-- Every public export has complete TSDoc: description, `@param`, `@returns`, and `@example` where applicable.
+- Every public export has TSDoc, because the package guide is built from it: a one-sentence summary; `@param`, `@returns`, or a thrown-error line only where the signature leaves the meaning open; and an `@example` of typical use, as short as it can be while still showing the call and its result.
 - The first sentence states what the symbol does in the third person with an `-s` verb — `Creates`,
   `Returns`, `Checks whether` — and never repeats the symbol's name.
 - `policy/no-malformed-summary` reads that first sentence over every doc block a top-level export

package/dist/host/claude/rules/writing.md

@@ -1,6 +1,9 @@
 # Writing rules
 
-`AGENTS.md` § Writing governs every reply. This file adds what developer prose, comments, and instruction files decide. Write prose after the code works, and keep it short.
+`AGENTS.md` § Writing governs every reply. This file adds what developer prose, comments, and instruction files decide.
+
+- Write comments, TSDoc, and guide prose once, after types, tests, and implementation are final, and keep them minimal. Prose written earlier is wrong by the time the implementation settles.
+- Never revise, review, or gate prose while the implementation can still change.
 
 ## Voice
 
@@ -43,7 +46,7 @@
 
 ## Code comments
 
-- A comment states why, never what the code shows. Delete a comment that restates the line. Do not narrate history, alternatives tried, or a probe's result.
+- Write a comment only where the code cannot show why, in one line. Delete a comment that restates the line. Do not narrate history, alternatives tried, or a probe's result.
 - Write TSDoc only where `.claude/rules/typescript.md` requires it, in its prescribed shape, and no longer than the contract needs.
 
 ## Instruction files

package/dist/host/claude/skills/orkestrel-parallel/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: orkestrel-parallel
 description: >-
-  Coordinate independently owned writer lanes in one checkout through messages, with one runner for checks and an Orchestrator for decisions. Use when implementation units can progress in parallel with disjoint files or explicit regions of shared files. Serialize overlapping edits and hold every input needed for a reliable measurement. Require shared files and a channel that can wake an idle lane.
+  Run parallel work: lanes inside one session (subagents, child tasks, background commands) and peer sessions that share a checkout, a machine, or an execution lane. Use when units can progress in parallel, when another session works on the same machine or checkout, or before the first lane on a harness. Bound the host, keep lanes visible, coordinate writers through messages with one runner for checks, and hand a shared execution lane over in one message. Each harness page records its mechanics and quirks; a harness with no page carries no writer or runner lane until its bring-up questions are answered on one.
 ---
 
 # Load the canonical workflow

package/dist/host/codex/config.toml

@@ -15,9 +15,9 @@ files you touch; Codex does not load them for you. Follow a skill under .agents/
 trigger fires.
 
 Use the role mapping and continuation rules in .agents/orchestration.md. Before using native or
-T3 collaboration, read .agents/skills/orkestrel-parallel/references/harnesses.md for the channel
-mechanics and retained identifiers, and read the installed tool descriptions before relying on a
-capability that reference names.
+T3 collaboration, read .agents/skills/orkestrel-parallel/references/codex.md and t3.md for the
+channel mechanics, retained identifiers, and quirks, and read the installed tool descriptions
+before relying on a capability those pages name. .agents/platforms/ owns the host shell.
 
 Hooks: .codex/hooks.json runs the orkestrel-dispatch sweep script (node
 .agents/skills/orkestrel-dispatch/scripts/sweep.ts --report) on SessionStart and git diff --check

package/dist/host/configs/policy.ts

@@ -28,7 +28,7 @@ export interface PolicyExpression extends PolicyNode {
 	readonly declaration?: PolicyExpression
 	readonly declarations?: readonly PolicyExpression[]
 	readonly init?: PolicyExpression | null
-	readonly source?: PolicyExpression
+	readonly source?: PolicyExpression | null
 	readonly specifiers?: readonly PolicyExpression[]
 	readonly imported?: PolicyExpression
 	readonly exported?: PolicyExpression
@@ -116,6 +116,9 @@ export interface PolicyVisitor {
 	readonly FunctionExpression?: (node: PolicyNode) => void
 	readonly ArrowFunctionExpression?: (node: PolicyNode) => void
 	readonly ImportDeclaration?: (node: PolicyNode) => void
+	readonly ImportExpression?: (node: PolicyNode) => void
+	readonly ExportNamedDeclaration?: (node: PolicyNode) => void
+	readonly ExportAllDeclaration?: (node: PolicyNode) => void
 	readonly MemberExpression?: (node: PolicyNode) => void
 	readonly MethodDefinition?: (node: PolicyNode) => void
 	readonly PropertyDefinition?: (node: PolicyNode) => void
@@ -205,9 +208,25 @@ export const DATA_EXEMPT_FILES: readonly string[] = Object.freeze(['helpers.ts']
 /** Lists the fleet-registered folders whose direct modules each contain one named function. */
 export const FUNCTION_DOMAIN_FOLDERS: readonly string[] = Object.freeze([
 	'app/browser/composables',
+	'app/vue/composables',
 	'src/server/execution',
 ])
 
+/** Lists the published destinations a Vue relative import may reach before independent restrictions. */
+export const VUE_SOURCE_ROOTS: readonly string[] = Object.freeze([
+	'src/core',
+	'src/browser',
+	'src/vue',
+])
+
+/** Lists the additional private destinations an application Vue relative import may reach. */
+export const VUE_APPLICATION_ROOTS: readonly string[] = Object.freeze([
+	...VUE_SOURCE_ROOTS,
+	'app/core',
+	'app/browser',
+	'app/vue',
+])
+
 /** Lists the registered function-domain names no source file may take as its stem. */
 export const FUNCTION_DOMAIN_NAMES: readonly string[] = Object.freeze(
 	FUNCTION_DOMAIN_FOLDERS.map((folder) => folder.slice(folder.lastIndexOf('/') + 1)),
@@ -439,6 +458,69 @@ export function pathToPolicyRelative(filename: string, cwd: string): string {
 	return normalizedFile.startsWith(prefix) ? normalizedFile.slice(prefix.length) : normalizedFile
 }
 
+/**
+ * Computes a lexical workspace-relative destination from an absolute Vue importer and its cwd.
+ * Refuses unclassifiable locations, noncanonical relative segments, and traversal above the
+ * workspace. Query and fragment text is excluded from the path without decoding it; callers retain
+ * the original specifier for independent restrictions. No filesystem or module resolution occurs.
+ */
+export function computePolicyTarget(
+	filename: string,
+	cwd: string,
+	specifier: string,
+): string | undefined {
+	const relative = pathToPolicyRelative(filename, cwd)
+	const location = relative.split('/')
+	if (
+		!/^(?:\/|[A-Za-z]:\/)/u.test(cwd.replaceAll('\\', '/')) ||
+		/(?:^|\/)\.{1,2}(?:\/|$)/u.test(cwd.replaceAll('\\', '/')) ||
+		relative === filename.replaceAll('\\', '/') ||
+		location.length < 3 ||
+		(location[0] !== 'src' && location[0] !== 'app') ||
+		location[1] !== 'vue' ||
+		location.some((part) => part === '' || part === '.' || part === '..')
+	) {
+		return undefined
+	}
+	const path = specifier.split(/[?#]/u)[0] ?? ''
+	if (!/^\.{1,2}(?:\/|$)/u.test(path) || path.includes('\\') || path.includes('//')) {
+		return undefined
+	}
+	const parts = path.replace(/\/$/u, '').split('/')
+	const first = parts.findIndex((part) => part !== '.' && part !== '..')
+	const boundary = first === -1 ? parts.length : first
+	const leading = parts.slice(0, boundary)
+	const parents = leading.filter((part) => part === '..').length
+	const remaining = parts.slice(boundary)
+	const directory = pathToPolicyFolder(relative).split('/')
+	if (
+		(parents === 0 && leading.length !== 1) ||
+		(parents !== 0 && parents !== leading.length) ||
+		parents > directory.length ||
+		remaining.some((part) => part === '' || part === '.' || part === '..')
+	) {
+		return undefined
+	}
+	return [...directory.slice(0, directory.length - parents), ...remaining].join('/')
+}
+
+/** Reports a literal relative import or re-export whose actual destination leaves its Vue boundary. */
+export function reportVueImport(context: PolicyContext, node: PolicyExpression): void {
+	const source = node.source
+	if (source?.type !== 'Literal' || typeof source.value !== 'string') return
+	if (!/^\.{1,2}(?:[/?#]|$)/u.test(source.value)) return
+	const target = computePolicyTarget(context.filename, context.cwd, source.value)
+	const roots = pathToPolicyRelative(context.filename, context.cwd).startsWith('app/vue/')
+		? VUE_APPLICATION_ROOTS
+		: VUE_SOURCE_ROOTS
+	if (
+		target !== undefined &&
+		roots.some((root) => target === root || target.startsWith(root + '/'))
+	)
+		return
+	context.report({ node, messageId: 'vue' })
+}
+
 /** Returns the extensionless stem of one policy file name. */
 export function fileToPolicyStem(file: string): string {
 	const boundary = file.lastIndexOf('.')
@@ -1399,6 +1481,28 @@ export const DOMAIN_RULE: PolicyRuleInterface = {
 	},
 }
 
+/** Bans literal relative imports and re-exports outside the importing Vue face's permitted roots. */
+export const VUE_IMPORT_RULE: PolicyRuleInterface = {
+	meta: {
+		type: 'problem',
+		docs: {
+			description:
+				'Disallow Vue relative imports outside the faces their importing file may reach.',
+		},
+		messages: {
+			vue: 'Keep this Vue relative import within the permitted source and application faces.',
+		},
+	},
+	create(context) {
+		return {
+			ImportDeclaration: (node) => reportVueImport(context, node),
+			ImportExpression: (node) => reportVueImport(context, node),
+			ExportNamedDeclaration: (node) => reportVueImport(context, node),
+			ExportAllDeclaration: (node) => reportVueImport(context, node),
+		}
+	},
+}
+
 /** Bans host-specific line-ending handling. */
 export const ENDING_RULE: PolicyRuleInterface = {
 	meta: {
@@ -1478,6 +1582,7 @@ export default {
 		'no-misnamed-factory': FACTORY_RULE,
 		'no-misnamed-plugin': PLUGIN_RULE,
 		'no-malformed-domain': DOMAIN_RULE,
+		'no-cross-vue-face': VUE_IMPORT_RULE,
 		'no-host-line-endings': ENDING_RULE,
 		'no-malformed-summary': VOICE_RULE,
 		'no-banned-term': TERM_RULE,

package/dist/host/cursor/rules/orchestration.mdc

@@ -11,6 +11,7 @@ alwaysApply: true
 
 - Invoked through the `grok` bridge (`agent -p --mode=ask`): act as a read-only executor. Return distilled evidence with `file:line` pointers. Never edit, decide, or accept.
 - Driven by the user: act as the Orchestrator per `.agents/orchestration.md`, on Grok.
+- `.agents/skills/orkestrel-parallel/references/cursor.md` owns Cursor's lane mechanics and quirks; `.agents/platforms/` owns the host shell.
 
 ## Reaching the other engines
 

package/dist/host/dotfiles/oxlintrc.json

@@ -401,12 +401,13 @@
 		{
 			"files": ["src/vue/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx,vue}"],
 			"rules": {
+				"policy/no-cross-vue-face": "error",
 				"no-restricted-imports": [
 					"error",
 					{
 						"patterns": [
 							{
-								"regex": "^(?:@src/(?:|[^/?#cbv][^/?#]*|c|c[^/?#o][^/?#]*|co|co[^/?#r][^/?#]*|cor|cor[^/?#e][^/?#]*|core[^/?#][^/?#]*|b|b[^/?#r][^/?#]*|br|br[^/?#o][^/?#]*|bro|bro[^/?#w][^/?#]*|brow|brow[^/?#s][^/?#]*|brows|brows[^/?#e][^/?#]*|browse|browse[^/?#r][^/?#]*|browser[^/?#][^/?#]*|v|v[^/?#u][^/?#]*|vu|vu[^/?#e][^/?#]*|vue[^/?#][^/?#]*)(?:[/?#]|$)|(?:\\.\\./)+(?:src/)?(?:[^/.scbv][^/.]*|s|s[^/.r][^/.]*|sr|sr[^/.c][^/.]*|src[^/.][^/.]*|c|c[^/.o][^/.]*|co|co[^/.r][^/.]*|cor|cor[^/.e][^/.]*|core[^/.][^/.]*|b|b[^/.r][^/.]*|br|br[^/.o][^/.]*|bro|bro[^/.w][^/.]*|brow|brow[^/.s][^/.]*|brows|brows[^/.e][^/.]*|browse|browse[^/.r][^/.]*|browser[^/.][^/.]*|v|v[^/.u][^/.]*|vu|vu[^/.e][^/.]*|vue[^/.][^/.]*)(?:/|$))",
+								"regex": "^(?:@src/(?:|[^/?#cbv][^/?#]*|c|c[^/?#o][^/?#]*|co|co[^/?#r][^/?#]*|cor|cor[^/?#e][^/?#]*|core[^/?#][^/?#]*|b|b[^/?#r][^/?#]*|br|br[^/?#o][^/?#]*|bro|bro[^/?#w][^/?#]*|brow|brow[^/?#s][^/?#]*|brows|brows[^/?#e][^/?#]*|browse|browse[^/?#r][^/?#]*|browser[^/?#][^/?#]*|v|v[^/?#u][^/?#]*|vu|vu[^/?#e][^/?#]*|vue[^/?#][^/?#]*)(?:[/?#]|$))",
 								"message": "Vue faces must not depend on sibling sheet faces"
 							},
 							{
@@ -605,12 +606,13 @@
 		{
 			"files": ["app/vue/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx,vue}"],
 			"rules": {
+				"policy/no-cross-vue-face": "error",
 				"no-restricted-imports": [
 					"error",
 					{
 						"patterns": [
 							{
-								"regex": "^(?:@(?:src|app)/(?:|[^/?#cbv][^/?#]*|c|c[^/?#o][^/?#]*|co|co[^/?#r][^/?#]*|cor|cor[^/?#e][^/?#]*|core[^/?#][^/?#]*|b|b[^/?#r][^/?#]*|br|br[^/?#o][^/?#]*|bro|bro[^/?#w][^/?#]*|brow|brow[^/?#s][^/?#]*|brows|brows[^/?#e][^/?#]*|browse|browse[^/?#r][^/?#]*|browser[^/?#][^/?#]*|v|v[^/?#u][^/?#]*|vu|vu[^/?#e][^/?#]*|vue[^/?#][^/?#]*)(?:[/?#]|$)|(?:\\.\\./)+(?:src/|app/)?(?:[^/.sacbv][^/.]*|s|s[^/.r][^/.]*|sr|sr[^/.c][^/.]*|src[^/.][^/.]*|a|a[^/.p][^/.]*|ap|ap[^/.p][^/.]*|app[^/.][^/.]*|c|c[^/.o][^/.]*|co|co[^/.r][^/.]*|cor|cor[^/.e][^/.]*|core[^/.][^/.]*|b|b[^/.r][^/.]*|br|br[^/.o][^/.]*|bro|bro[^/.w][^/.]*|brow|brow[^/.s][^/.]*|brows|brows[^/.e][^/.]*|browse|browse[^/.r][^/.]*|browser[^/.][^/.]*|v|v[^/.u][^/.]*|vu|vu[^/.e][^/.]*|vue[^/.][^/.]*)(?:/|$))",
+								"regex": "^(?:@(?:src|app)/(?:|[^/?#cbv][^/?#]*|c|c[^/?#o][^/?#]*|co|co[^/?#r][^/?#]*|cor|cor[^/?#e][^/?#]*|core[^/?#][^/?#]*|b|b[^/?#r][^/?#]*|br|br[^/?#o][^/?#]*|bro|bro[^/?#w][^/?#]*|brow|brow[^/?#s][^/?#]*|brows|brows[^/?#e][^/?#]*|browse|browse[^/?#r][^/?#]*|browser[^/?#][^/?#]*|v|v[^/?#u][^/?#]*|vu|vu[^/?#e][^/?#]*|vue[^/?#][^/?#]*)(?:[/?#]|$))",
 								"message": "Vue faces must not depend on sibling sheet faces"
 							},
 							{

package/dist/host/guides/scaffold.md

@@ -1416,6 +1416,15 @@ executable, installs it, runs its checks, builds, projects, journey modes, showc
 export consumption, and proves that `repair` restores a deleted wrapper byte for byte and that
 `audit` reports a stale one.
 
+The default `appServer` build emits the single `dist/app/server/main.cjs` that a single-executable
+embed takes; its dynamic import evaluates only when it runs. The factory defaults `codeSplitting`
+to `false` on outputs that omit it. An override keeps its output members and explicit splitting
+values, so an overridden build can emit several files. The vendored `tests/config.test.ts` builds a
+scratch entry through the real wrapper in each target that holds `app/server`, requires one chunk,
+and splits it under a control. Scaffold's `tests/src/core/templates.test.ts` runs the emitted file in a staged
+server root, builds explicit output lists through the factory parameter, and runs the vendored case
+in staged server targets under a mutation of the factory and of the control.
+
 ### The migration guard
 
 Vue code belongs to the `vue` extension's faces. `repair` and `overwrite` refuse a target whose
@@ -1623,6 +1632,52 @@ fetched bytes rather than prose this workspace wrote, and it reports a top-level
 neither this package's own, nor `guides/README.md`, nor a catalog row, so an exclusion always
 carries its evidence.
 
+The Vue override populations enable `policy/no-cross-vue-face` for `cjs`, `cts`, `js`, `jsx`,
+`mjs`, `mts`, `ts`, `tsx`, and Vue single-file components. The import-free `configs/policy.ts`
+leaf uses these local exports:
+
+| Export                                      | Behaviour                                                                                                                                                               |
+| ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `computePolicyTarget`                       | Computes a lexical destination from the native importer's absolute filename and cwd, consuming relative parents against its actual directory.                           |
+| `reportVueImport`                           | Checks a literal source against complete permitted face roots, refusing unclassifiable locations and traversal above the workspace.                                     |
+| `VUE_IMPORT_RULE`                           | Visits parser-admitted static imports, source-bearing named and star exports, their type-only forms, and string-literal dynamic imports through Oxlint's native parser. |
+| `VUE_SOURCE_ROOTS`, `VUE_APPLICATION_ROOTS` | Hold the frozen destination roots checked before the retained independent restrictions.                                                                                 |
+
+Native grammar applies before policy visitors. In the canonical fixtures on both Vue faces, `.cjs` static
+value imports, named and star exports at both importer depths, and the source-less export receive
+native parser errors. The coverage keeps all original input identities and extensions in a disjoint
+partition: those seven inputs per face have explicit parser-refusal expectations on both Vue faces;
+the remaining inputs retain strict rule and collection checks. The `.cjs` literal dynamic imports
+and nonliteral import controls stay in that parsed population. No `.cts` or other extension inherits
+a refusal from the `.cjs` observation; each must establish its own native parsing and collection.
+
+Otherwise-permitted relative imports within `src/vue` or `app/vue` work at arbitrary nesting
+depth. A nested `../print/index.js` can stay inside Vue while the same text at the face root
+reaches a forbidden sibling. Application Vue retains relative access to `app/core`, `app/browser`,
+`src/core`, `src/browser`, and `src/vue`; published Vue retains its independent alias requirements
+for core and browser. Query and fragment suffixes are excluded from destination calculation
+without decoding their text. Thus application Vue's `../browser?x` reaches an allowed face, while
+published Vue's matching relative import still requires the browser alias.
+
+The existing alias, Node, server, absolute-path, URL, backslash, dot-segment, traversal-spelling,
+and compiler-API restrictions keep their original specifier matching. Consequently a same-face
+directory named `server` can still be refused, as can a published Vue directory named `core` or
+`browser`. Computed imports remain admitted by this boundary rule. Template-literal targets,
+`TSImportType`, CommonJS resolution, symlinks, URI decoding, and custom resolver remapping are
+outside its destination claim. POSIX, drive-letter, and UNC helper cases assert lexical behaviour;
+they do not establish a binary run on another operating system.
+
+The exact direct folder `app/vue/composables` joins the function-domain register. Its camelCase
+modules require one named exported function matching the filename. Nested folders, published Vue
+composables, look-alike names, and the existing structural filename exclusions gain no registration.
+Every parser-admitted Vue case in `tests/config.test.ts` requires a debugger collection sentinel;
+a valid composable keeps that sentinel inside its exported function. Parser-refused inputs retain
+their original text, but require an exact native message, error severity, normalized filename, and
+source-token label instead of claiming debugger or policy visitation. Both contracts use the same
+native-linter acquisition helper in `tests/setupPolicy.ts`; the rule reader still refuses missing
+rule codes or filenames. Scratch controls suppress only the new report, restore only the removed
+relative regex alternatives, or remove only the Vue composable row.
+
 The skill sweep reads named value and type imports from `@orkestrel/*` in every Markdown fence
 in `SKILL.md` and its named references, including fences inside lists and blockquotes. It resolves
 each entry through that package's exports map — the workspace's own manifest for the package the
@@ -2004,7 +2059,7 @@ succeed without making requests; remote hooks run setup. Claude Code Cloud conti
 the `.claude/AGENTS.md` Claude Code bridge, the `.agents/orchestration.md` agent-operation contract,
 the rules under `.claude/rules/` and `.cursor/rules/`, the skills under `.agents/skills/` and
 `.claude/skills/`, the templates under `.agents/templates/`, the transport contracts under
-`.agents/transports/`, the agent roles under `.claude/agents/` and `.codex/agents/`, the
+`.agents/transports/`, the platform pages under `.agents/platforms/`, the agent roles under `.claude/agents/` and `.codex/agents/`, the
 `.codex/config.toml` bench configuration, and the `.mcp.json` and `.cursor/mcp.json` server
 registrations. A release stages every one of them, and a target receives a copy only where the plan
 claims the path. At the `AGENTS.md` destination it receives the pointer: different content at the