@orkestrel/scaffold 0.0.107 → 0.0.109

package/dist/host/agents/skills/orkestrel-build/SKILL.md

@@ -14,18 +14,16 @@ than this summary of it.
 
 ## Select the environments
 
-`--src` selects published src environments and `--app` selects private app environments.
-The selections are independent, at least one is required, and each offers `core`, `browser`,
-and `server`.
+`scaffold new` takes the independent selections `--src` and `--app`; `guides/scaffold.md` § Command line
+and § Select at creation own the options and the combinations they refuse. The table names what each
+app environment owns.
 
-| Selection   | What it owns                                                             |
-| ----------- | ------------------------------------------------------------------------ |
-| app/core    | Host-independent contracts and composition; check and test only          |
-| app/browser | Vue runtime behind an `index.html` entry, `vue-tsc`, real Chromium tests |
-| app/server  | Node runtime, `dist/app/server/main.cjs` with only `node:*` external     |
-
-Core-only, browser-only, and server-only applications are valid. A browser+server pair
-includes app/core so the shared transport contracts have one host-independent owner.
+| Selection   | What it owns                                                                               |
+| ----------- | ------------------------------------------------------------------------------------------ |
+| app/core    | Host-independent contracts and composition; check and test only                            |
+| app/browser | Framework-independent DOM runtime behind an `index.html` entry, `tsc`, real Chromium tests |
+| app/vue     | Vue runtime with `App.vue` behind an `index.html` entry, `vue-tsc`, real Chromium tests    |
+| app/server  | Node runtime, `dist/app/server/main.cjs` with only `node:*` external                       |
 
 ## Execute the workflow
 
@@ -39,50 +37,26 @@ includes app/core so the shared transport contracts have one host-independent ow
    thin target wrappers and scoped tsconfigs.
 4. **Implement completely** — entries, barrels, centralized declarations, one-class
    implementation files, environment parsing, lifecycle, builds, and scripts — under the
-   placement and manifest laws. Parse the options container and its host and port leaves
-   before mutation, rejecting wrong-shaped containers, empty hosts, and non-integer,
-   negative, or out-of-range ports with a coded error and its guard.
-5. **Own the shutdown contract.**
+   placement and manifest laws in `.claude/rules/application.md`.
+5. **Own the shutdown contract** of the runner `.claude/rules/application.md` requires:
    - Serialize lifecycle transitions in call order.
    - Re-request port zero on an ephemeral restart.
    - Close lingering active connections deterministically on stop.
    - Release the runner's signal listeners idempotently on stop.
-   - Isolate asynchronous failures by runner generation, so an older transition cannot
-     release a newer run's listeners.
-   - Return the runner from convenience startup rather than hiding that cleanup.
-6. **Keep boundary enforcement inside the configured toolchain.** Each layer owns what it
-   can express:
-   - Oxlint `no-restricted-imports` — literal-string declared package, alias, and
-     conventional relative import direction.
-   - Oxfmt — formatting.
-   - `tests/setupPolicy.ts` — the narrow TypeScript compiler-API pass over computed and
-     template-literal specifiers, declaration placement, and the barrel law.
-   - Scoped TypeScript projects — host-global isolation.
-   - Vite's real builds and environment-boundary plugin — Vue, CSS, assets, workers,
-     runtime resolution, and physical workspace containment. Its parsed HTML asset
-     callbacks reject forced inlining before any direct asset read, and non-inlined
-     output assets are audited by physical source path.
-
-   Then hold these limits:
-   - Add no standalone boundary script, and no second parser or source-language analyzer
-     duplicating those layers. Reach for the toolchain's own facilities instead: Vite's
-     Oxc/Rolldown AST for TypeScript and JavaScript asset references, the official Vue SFC
-     compiler for `.vue` blocks, Vite's HTML parser callbacks, its bundled Lightning CSS
-     dependency analyzer, and the TypeScript compiler API for the narrow coding-law pass.
+6. **Keep boundary enforcement inside the configured toolchain**, per
+   `.claude/rules/workspace.md` § Typechecking and environment isolation and § Tooling.
+   - Add no standalone boundary script and no second parser or source-language analyzer.
    - Disable the browser application's public directory, so an unmanaged file copy cannot
      ship outside the module graph.
    - Keep browser-only runtime tooling development-only.
    - Require explicit authorization before adding a Sass compiler.
-
 7. **Prove it on real hosts.**
    - Run app/browser tests on Playwright-backed Vitest Browser Mode against real DOM.
      Probe the installed executable directly with `existsSync(chromium.executablePath())`
      rather than guessing a channel or reading an environment flag.
    - Bind port zero on loopback in app/server tests and use real fetch.
    - Prove executable readiness, collision exit, signal termination, and port release with
-     real child-process tests. Windows reports `ChildProcess.kill('SIGTERM')` as OS
-     termination by signal, while POSIX delivery exercises the graceful listener and exits
-     zero.
+     real child-process tests.
    - Probe the actual capability in a capability-dependent test, and scope any skip
      narrowly.
 8. **Document and prove parity** for every app export and behavioral method: guide,
@@ -92,10 +66,6 @@ includes app/core so the shared transport contracts have one host-independent ow
    `.agents/orchestration.md` § Size gate names for the change and the repository gates in
    their required order.
 
-Do not add showcase, authentication, persistence, proxy, styling-system, or product
-policy unless the request requires it. Do not leave placeholders, compatibility shims,
-empty setup files, or deferred app behavior.
-
 ## Accept the result
 
 Completion requires:
@@ -109,6 +79,4 @@ Completion requires:
 - guide parity green over every app export and behavioral method;
 - the repository gates green in their required order from an independent `verifier`.
 
-A selected environment still unwired, a real-host proof not taken, or an open parity row
-means the run is not finished. Report what each environment owns, the exact proof and gate
-evidence, and any residual risk. Do not call an in-scope omission future work.
+Report what each environment owns, the exact proof and gate evidence, and any residual risk.

package/dist/host/agents/skills/orkestrel-build/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: 'Build Orkestrel Application'
-  short_description: 'Design and harden Orkestrel app environments'
+  short_description: 'Wire and harden Orkestrel app environments'
   default_prompt: 'Use $orkestrel-build to build or harden this workspace application layer.'

package/dist/host/agents/skills/orkestrel-debrief/SKILL.md

@@ -13,8 +13,8 @@ auditing the agent, rule, skill, and process layer; [field-testing.md](reference
 before running or judging a live field pass of an agent-facing surface;
 [retention.md](references/retention.md) before retiring the campaign folder.
 
-The debrief judges the artifact and the process that produced it; neither is exempt. Record a
-practice that worked as a refinement, so it repeats.
+The debrief judges the artifact and the process that produced it. Record a practice that worked
+as a refinement.
 
 ## The debrief laws
 
@@ -43,23 +43,25 @@ practice that worked as a refinement, so it repeats.
 
 ## Run the round
 
-1. **Scope and gather.** Name the campaign(s) under debrief. Assemble the record: unit
-   ledger, deviations and recoveries, audit verdicts and their reconciliations, gate
-   history, and any live transcripts. State what evidence exists and what must be
+1. **Scope and gather.** Name the campaign(s) under debrief. Assemble the record from the
+   campaign folder (`.claude/rules/campaign.md` § Layout): `plan.md`, `ledger.md`, `gaps.md`,
+   `ideas.md`, and the verdict files, plus deviations and recoveries, gate history, and any
+   live transcripts. State what evidence exists and what must be
    produced fresh.
 2. **Field evidence.** Drive what was built with real consumers where a consumable
    surface exists. Record every pass verbatim.
 3. **Artifact audits.** Layer and boundary truth: does app code belong a layer down in
    src, does src carry application policy, does either duplicate a declared ecosystem
    primitive? Package promotion: what grew into a reusable mechanism that belongs in an
-   existing package or justifies a new one — mapped dependency-first so promotion order
-   is executable. Sweep test infrastructure both ways: name every local test helper or
-   fixture whose semantics an installed shared-package export already covers (compare
-   against the declarations each repository compiles with, and adopt rather than keep),
-   and name every instrument two or more packages built independently (count a value set
-   fed through one proof loop as one implementation, whether the set sits beside the
-   loop or its assertions are spelled out one by one). Every row ends implement, repair,
-   retain, or intentionally exclude, with evidence.
+   existing package or justifies a new one, judged by the extraction signals in
+   `.agents/orchestration.md` § Depth, breadth, and machinery and mapped dependency-first
+   so promotion order is executable. Sweep test infrastructure both ways: name every
+   local test helper or fixture whose semantics an installed shared-package export already
+   covers (compare against the declarations each repository compiles with, and adopt
+   rather than keep), and name every instrument two or more packages built independently
+   (count a value set fed through one proof loop as one implementation, whether the set
+   sits beside the loop or its assertions are spelled out one by one). Every row ends
+   implement, repair, retain, or intentionally exclude, with evidence.
 4. **Process retrospective.** Walk the campaign record for both failure and success:
    dispatches that deviated and why; recoveries that worked (codify the mechanism that
    saved them); estimates versus observed durations; audit rounds that caught real
@@ -77,8 +79,9 @@ practice that worked as a refinement, so it repeats.
    orchestration contract) with the owner's direction where the root contract is
    touched; re-prove per the re-proving law in § "The debrief laws".
 8. **Propagate.** Portable changes are made in the scaffold repository's host inventory,
-   staged, gated, and pushed — editing one project's checkout propagates nothing. Verify
-   the generated-workspace proofs stay green so new projects inherit the refined canon.
+   staged, gated, and committed; editing one project's checkout propagates nothing. Push on
+   the user's go-ahead (`.agents/orchestration.md` § Acceptance). Verify the
+   generated-workspace proofs stay green so new projects inherit the refined canon.
 9. **Dispose.** Present the disposition map — finding table with carriers, the canon
    delta, what remains open — and retire the campaign folder through
    [retention.md](references/retention.md), which owns the checks, the go-ahead, the
@@ -89,5 +92,5 @@ practice that worked as a refinement, so it repeats.
 Each round ends with one fixed report: the finding table (id, evidence pointer, bucket,
 carrier), the canon delta (files created or changed, per layer: agents, rules, skills,
 process, guide, roadmap), the re-proof evidence, and exactly one terminal line —
-`DEBRIEF: FOLDED` when every finding has a carrier and the propagation is pushed, or
+`DEBRIEF: FOLDED` when every finding has a carrier and the propagation is committed in scaffold, or
 `DEBRIEF: OPEN` with the blocking items.

package/dist/host/agents/skills/orkestrel-debrief/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: 'Debrief Closed Campaign'
   short_description: 'Fold a closed campaign into portable truth on field evidence'
-  default_prompt: 'Use $orkestrel-debrief to debrief the closed campaign: field passes, findings ledger, fix loops, canon refinement, propagation, disposal.'
+  default_prompt: 'Use $orkestrel-debrief to debrief the closed campaign: field passes, finding table, fix loops, canon refinement, propagation, disposal.'

package/dist/host/agents/skills/orkestrel-debrief/references/field-testing.md

@@ -5,17 +5,18 @@ model consumes.
 
 ## The tier ladder
 
-Test from the top down, and do not stop at the tier that passes:
-
-1. **Frontier** (the harness's default model) — proves the surface works at all.
-2. **Mid tier** (for example, a codex mechanical model) — proves the surface survives a
-   harness's schema abbreviation and a model that reads less carefully.
-3. **Small harness-native** (for example, Haiku or a codex high-volume model) — the
-   acceptance tier: these must walk the surface unaided, or the surface is not done.
-4. **Local floor** (a quantized 2B-class model through a real tool-calling client) — not
-   an acceptance gate; a stochastic probe that exposes teaching gaps nothing else hits.
-   Its residual failures must be provably consumer-floor (malformed emission, attention
-   loss), never surface darkness — every refusal it received must have named the fix.
+Test from the top down, and do not stop at the tier that passes. Map each tier to an engine
+per `.agents/orchestration.md` § Roles and name the map in the dispatch.
+
+1. **Frontier** (the harness's default engine) — proves the surface works at all.
+2. **Mid tier** — proves the surface survives a harness's schema abbreviation and an engine
+   that reads less carefully.
+3. **Small native** (the mechanical roles' engine) — the acceptance tier: it must walk the
+   surface unaided, or the surface is not done.
+4. **Local floor** (a small quantized model through a real tool-calling client) — not an
+   acceptance gate; a stochastic probe that exposes teaching gaps nothing else hits. Its
+   residual failures must be provably consumer-floor (malformed emission, attention loss),
+   never surface darkness — every refusal it received must have named the fix.
 
 ## The pass discipline
 
@@ -48,23 +49,9 @@ Read every trace against these; each maps to a class of surface fix:
 | Opaque-wall regression  | A correct structure abandoned after an unnamed refusal                 | Every refusal names the subject, path, expectation, and candidates                                         |
 | Repetition fixpoint     | The identical failing call repeated verbatim                           | The refusal must change the caller's information state; if it already does, the residual is consumer-floor |
 
-## The teaching-surface doctrine
-
-What the field passes repeatedly prove:
-
-- **Descriptions are the surviving surface.** Harnesses abbreviate nested schemas;
-  the tool description reaches every model intact. The critical path — a worked example,
-  the key nesting, the reply shape — lives there, importance-first, so a model that
-  stops reading early still gets it.
-- **Every refusal orients, names, or corrects.** Subject, exact key path, expected
-  shape, valid candidates, missing versus unexpected — a refusal that names nothing ends
-  runs; a refusal that names everything converges even a 2B model.
-- **Strictness with teaching beats tolerance.** Never coerce, never silently drop;
-  refuse with the correction in the message. Encode untrusted identifiers (JSON-encoded,
-  length-capped) so malformed input cannot fake or balloon a diagnostic.
-- **Acknowledge or state, never both.** Mutations return acknowledgements; reads return
-  state; the split is stated in both tools' descriptions so neither is polled for the
-  other's job.
+## Judge the fix
+
+Rule each fix against `.claude/rules/documentation.md` § Agent-facing surfaces.
 
 ## The scoreboard
 

package/dist/host/agents/skills/orkestrel-debrief/references/instruction-audit.md

@@ -88,7 +88,7 @@ Findings land as one of:
   reference; the root stays the single owner.
 - **Charter refinements.** Wording that caused a deviation is a defect; fix the charter,
   not the executor.
-- **Skill refinements / creation.** A workflow the campaign repeated twice is a skill; a
+- **Skill refinements / creation.** A workflow a second campaign needs is a skill; a
   skill step the campaign always skipped or always overrode is wrong.
 - **Orchestration-contract refinements.** Laws the orchestrator learned (cap sizing,
   probe-first, journal-first, verdict shapes, launch ownership) land in the operating
@@ -97,8 +97,8 @@ Findings land as one of:
 ## The questions every round asks
 
 - **Which findings came from falsification rather than diff reading**, and is the brief
-  shape that produced them doctrine yet? Route to the Falsification law in
-  `.claude/rules/quality.md`.
+  shape that produced them doctrine yet? Route to `.claude/rules/quality.md` § Instruments or
+  the `orkestrel-falsify` skill.
 - **Which shipped gaps were accepted as untestable**, and was each one genuinely
   irreducible or a missing seam? Route to the missing-seam law in
   `.claude/rules/tests.md`.
@@ -108,6 +108,5 @@ Findings land as one of:
 
 ## Mirror discipline
 
-Every roster or contract change lands on all harness surfaces in the same round: the
-Claude charters, the Codex mirrors, and both operating-contract role tables. An
-unmirrored refinement is a new drift seeded on purpose.
+Land every roster or contract change on all harness surfaces in the same round;
+`.agents/orchestration.md` § Roles names them.

package/dist/host/agents/skills/orkestrel-debrief/references/retention.md

@@ -10,7 +10,7 @@ carrier. A campaign that accepts with no debrief arrives at acceptance, per
 either door.
 
 Call the `.orkestrel/` folder the campaign folder, never a ledger. The word `ledger` names the
-routing ledger and the carry ledger only.
+campaign's `ledger.md` only.
 
 ## The gate order
 
@@ -33,19 +33,17 @@ step.
 
 Rule on every location in this table before deleting anything.
 
-| Location                | What it holds                                                                                                                                       | What the prune does                                                                                                                 |
-| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
-| `.orkestrel/<package>/` | One package's live campaign per `.agents/orchestration.md` § .orkestrel layout: its plan, routing ledger, open-seam verdicts, and exposure records. | Deleted in the prune commit.                                                                                                        |
-| `.orkestrel/*.md`       | The ecosystem's records per the same section: the fleet campaign's `plan.md` and `ledger.md`, and the release wave's `release.md`.                  | Deleted in the prune commit of the wave or fleet campaign each records.                                                             |
-| `tmp/units/`            | A native unit's `<unit>-brief.md` and `<unit>-report.md` pair.                                                                                      | Swept after the unit's measurements and unresolved findings are carried into the acceptance record, the campaign ledger, or a test. |
-| `tmp/<bench>/`          | A bench unit's brief, report, event stream, final answer, and any login log.                                                                        | Swept after the final gate evidence is recorded. Never committed.                                                                   |
-| `tmp/probes/`           | The runtime probes the campaign wrote.                                                                                                              | Swept. A probe that settled a claim becomes a test before the prune, per `.claude/rules/quality.md` § Instruments.                  |
-| `ROADMAP.md`            | The repository's sequenced plan of record, where it keeps one.                                                                                      | Kept. Strike the chunks the campaign closed and add the forward work it revealed.                                                   |
-| `PROPOSAL.md`           | A proposal for work nobody has ruled on yet.                                                                                                        | Deleted after the work lands or the proposal is refused. The ruling goes in the prune commit message.                               |
+| Location                | What it holds                                                                                                                                | What the prune does                                                                                                              |
+| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
+| `.orkestrel/<package>/` | One package's live campaign per `.claude/rules/campaign.md` § Layout: its plan, ledger, open-seam verdicts, and the records that rule names. | Deleted in the prune commit, after each file that outlives the campaign moves to its root home.                                  |
+| `.orkestrel/*.md`       | The ecosystem's records per the same section: the fleet campaign's `plan.md` and `ledger.md`, and the release wave's `release.md`.           | Deleted in the prune commit of the wave or fleet campaign each records.                                                          |
+| `tmp/units/`            | A native unit's `<unit>-brief.md` and `<unit>-report.md` pair.                                                                               | Swept after the unit's measurements and unresolved findings are carried into the acceptance record, a tracked design, or a test. |
+| `tmp/<bench>/`          | A bench unit's brief, report, event stream, final answer, and any login log.                                                                 | Swept after the final gate evidence is recorded. Never committed.                                                                |
+| `tmp/probes/`           | The runtime probes the campaign wrote.                                                                                                       | Swept. A probe that settled a claim becomes a test before the prune, per `.claude/rules/quality.md` § Instruments.               |
+| `ROADMAP.md`            | The repository's sequenced plan of record, where it keeps one.                                                                               | Kept. Strike the chunks the campaign closed and add the forward work it revealed.                                                |
 
 A plan-of-record file is not campaign residue. `ROADMAP.md` outlives every prune and takes the
-campaign's forward work; `PROPOSAL.md` is spent the moment its proposal is ruled on, and a spent
-proposal left in the tree reads as live work.
+campaign's forward work.
 
 ## Sweep `tmp/` as a tree
 
@@ -68,8 +66,8 @@ decision, a withdrawn claim, an unmet acceptance condition. Each ends the check
 commit that closed it, a live brief that owns it, or an explicit drop on the record. An item with
 no carrier blocks the prune.
 
-Read the register files for this — the plan, the readiness grade, the carry ledger, the triage —
-rather than every brief and report in the folder.
+Read `plan.md` § State, `ledger.md`, `gaps.md`, and `ideas.md` for this, rather than every brief and
+report in the folder.
 
 ## The promotion check
 

package/dist/host/agents/skills/orkestrel-dispatch/SKILL.md

@@ -1,25 +1,26 @@
 ---
 name: orkestrel-dispatch
 description: >-
-  Dispatch one unit of work to a native subagent or an external bench and bring its result back: write the brief, probe the bench, launch under a cap, watch liveness, read the report, check its citations, accept, and delete the launch copies. Use when `.agents/orchestration.md` routes work to a role, when a bench lane (Grok, Astra, or Opus through the Claude CLI) is needed, or when a command will outlive the turn that starts it.
+  Dispatch one unit of work to a native subagent or an external bench and bring its result back: write the brief, probe the bench, launch under a cap, watch liveness, read the report, check its citations, accept, and delete the launch copies. Use when `.agents/orchestration.md` routes work to a role, when a bench lane is needed, or when a command will outlive the turn that starts it.
 ---
 
 # Dispatch
 
-`.agents/orchestration.md` decides who runs what and binds the permission floor; this skill runs the dispatch. Read `references/launch.md` before any command that outlives the turn, and `references/bench.md` before any bench lane. Run every step a script performs as that script, from the checkout root, with `node`.
+`.agents/orchestration.md` decides who runs what and binds the permission floor; this skill runs the dispatch. Read `references/launch.md` before any command that outlives the turn. Run every step a script performs as that script, from the checkout root, with `node`.
 
 ## Scripts
 
-| Script               | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `scripts/bench.ts`   | `--cursor [--resolve]`, `--codex [--sandbox MODE]`, or `--claude`, each with `[--model ID] [--cap SECONDS]`: resolves the bench entry, reads its version and login, runs one bounded round trip into `tmp/<bench>/bench.jsonl`, and prints JSON with `live`; `--resolve` prints the Cursor entry alone. Exit 3 when the bench is dark.                                                                                                                                                                                                  |
-| `scripts/brief.ts`   | `--unit UNIT --lane units\|cursor\|codex\|claude [--subject TEXT]` writes the brief from `.agents/templates/brief.md` and never overwrites a launched one; `--check PATH` lists every slash-bearing path the brief names that does not resolve from the root. Exit 3 when one is missing.                                                                                                                                                                                                                                               |
-| `scripts/launch.ts`  | `--journal PATH --errors PATH --cap SECONDS [--status] -- COMMAND [ARGS...]` runs the command with no shell and closed stdin, kills it at the cap (its process tree on Windows), records `git status --porcelain` before and after with `--status`, prints a spawn line carrying the `pid` when the command starts, writes that pid to `<journal>.pid`, and ends the errors file with `exit=`. Exit 124 when capped; 127 when the command cannot start (the errors file names why); 64 on usage, including a cap above 2147483 seconds. |
-| `scripts/login.ts`   | `--codex [--cap SECONDS]` reads `codex login status`, runs `codex login --device-auth` journaled to `tmp/codex/login.log` when it is not logged in, prints the URL and the one-time code as they appear, and polls the status until it answers or the cap ends; `--claude` reads `claude auth status`. Exit 0 logged in, 3 not.                                                                                                                                                                                                         |
-| `scripts/result.ts`  | `--cursor\|--claude\|--codex JOURNAL [--out PATH]` prints the session id, the answer length, the run's `exit`, `capped`, and `durationMs` from the errors file, and the journal's `bytes`, `ageMs`, and `lastEvent`. Exit 3 when the journal carries no session or answer.                                                                                                                                                                                                                                                              |
-| `scripts/cite.ts`    | `PATH [--root DIR] [--json]` lists every `file:line` citation in a report whose file does not exist or whose line is past the end. Exit 3 when one does not resolve.                                                                                                                                                                                                                                                                                                                                                                    |
-| `scripts/helpers.ts` | Import with `.ts`: `readOption`, `readOptions`, `readList`, `listFiles`, `readJsonObject`, `readString`, `readNumber`, `normalizeSlashes`, `resolveNpm`, `runNpm`, `SPEC_FIELDS`, `LOCAL_SPEC_PATTERN`, `ARCHIVE_SPEC_PATTERN`, `SHORTHAND_SPEC_PATTERN`, `matchesLocalSpec`, `collectSpecs`, `scanLocalSpecs`, `removeTree`, `isRecord`. Runs nothing.                                                                                                                                                                                 |
-| `scripts/sweep.ts`   | `--report` lists leftovers under `tmp/` and `.orkestrel/` by age and deletes nothing; `--tmp [--older-than MINUTES]` deletes stale launch files and refuses while a journal is changing; `--unit UNIT [--delete]` lists or deletes one accepted unit's brief, report, claims, journal, errors, status, pid, and last-message files.                                                                                                                                                                                                     |
+| Script              | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `scripts/bench.ts`  | `--cursor [--resolve]`, `--codex [--sandbox MODE]`, or `--claude`, each with `[--model ID] [--cap SECONDS]`: resolves the bench entry, reads its version and login, runs one bounded round trip into `tmp/<bench>/bench.jsonl`, and prints JSON with `live`; `--resolve` prints the Cursor entry alone. A malformed cap, a `--sandbox` outside `read-only`, `workspace-write`, and `danger-full-access`, or `--resolve` without `--cursor` is a usage fault, never a dark bench. Exit 3 when the bench is dark, 64 on usage.            |
+| `scripts/brief.ts`  | `--unit UNIT --lane units\|cursor\|codex\|claude [--subject TEXT]` writes the brief from `.agents/templates/brief.md` and never overwrites a launched one; `--check PATH` lists every slash-bearing path the brief names that does not resolve from the root. Exit 3 when one is missing.                                                                                                                                                                                                                                               |
+| `scripts/launch.ts` | `--journal PATH --errors PATH --cap SECONDS [--status] -- COMMAND [ARGS...]` runs the command with no shell and closed stdin, kills it at the cap (its process tree on Windows), records `git status --porcelain` before and after with `--status`, prints a spawn line carrying the `pid` when the command starts, writes that pid to `<journal>.pid`, and ends the errors file with `exit=`. Exit 124 when capped; 127 when the command cannot start (the errors file names why); 64 on usage, including a cap above 2147483 seconds. |
+| `scripts/login.ts`  | `--codex [--cap SECONDS]` reads `codex login status`, runs `codex login --device-auth` journaled to `tmp/codex/login.log` when it is not logged in, prints the URL and the one-time code as they appear, and polls the status until it answers or the cap ends, ending any status read that outlasts the cap, and refuses a cap above 2147483 seconds; `--claude` reads `claude auth status`. Exit 0 logged in, 3 not.                                                                                                                  |
+| `scripts/result.ts` | `--cursor\|--claude\|--codex JOURNAL [--out PATH]` prints the session id, the answer length, the run's `exit`, `capped`, and `durationMs` from the errors file, and the journal's `bytes`, `ageMs`, and `lastEvent`. Exit 3 when the journal carries no session or answer.                                                                                                                                                                                                                                                              |
+| `scripts/cite.ts`   | `PATH [--root DIR] [--json]` lists every `file:line` citation in a report whose file does not exist or whose line is past the end. Exit 3 when one does not resolve.                                                                                                                                                                                                                                                                                                                                                                    |
+| `scripts/sweep.ts`  | `--report` lists leftovers under `tmp/` and `.orkestrel/` by age, deletes nothing, and flags a `.orkestrel/**/*.md` line that cites a backticked path git ignores or names a machine path; `--tmp [--older-than MINUTES]` deletes stale launch files and refuses while a journal is changing; `--unit UNIT [--delete]` lists or deletes one accepted unit's brief, report, claims, journal, errors, status, pid, and last-message files; `--tmp` and `--unit --delete` keep every file git tracks and print `kept tracked <path>`.      |
+| `scripts/chain.ts`  | `--plan FILE.json --journal DIR` runs the steps of a JSON plan (`name`, `command`, `args`, optional `cwd` and `env`) in order with no shell, writes each step's output to `<journal>/<name>.txt`, prints one `name exit= durationMs=` line per step, and stops at the first step that does not exit 0. Exit is that step's code; 2 when a step cannot start; 64 on usage.                                                                                                                                                               |
+| `scripts/patch.ts`  | `EDITS.md (--plan \| --apply) [--skip N ...]` applies an edit file of `### <path>` blocks, each with a `reason:` line and fenced `old:` and `new:` texts: every `old` text must occur exactly once in its file after the earlier edits to that file (however the blocks spell its path), and nothing is written unless every selected edit resolves. `--plan` prints each edit's resolution; `--skip N` leaves out edit N and repeats. Exit 1 when an edit does not resolve, 64 on usage.                                               |
 
 ## Write the brief
 
@@ -28,35 +29,46 @@ description: >-
 3. Scope by what the change makes false: run the `orkestrel-scout` skill's `map.ts --refs` and `--census` for an existing member of any enumerated population the unit extends, and own every file that comes back, with the tests that pin the behavior, the fixtures derived from a constant, and the materialized copy of a template.
 4. Order acceptance criteria cheap-first (regenerate, typecheck, lint, scoped test). Name a timing-sensitive or tree-wide gate as an observation, not a criterion.
 5. State that the executor performs the work itself and spawns nothing. A bridge driver carries the brief unaltered and returns the journal path and session id.
-6. Name the host conditions the unit will hit: shell, sandbox, network, files expected dirty, commands known to fail.
-7. Run `brief.ts --check <brief>` and fix every missing path before the launch.
+6. Name the host conditions the unit will hit: shell, sandbox, network, files expected dirty, commands known to fail. Give absolute paths for work outside the session's root; a lane's shell can restart in another directory between calls.
+7. Fill each placeholder at its value sites only; a global replace also rewrites a stop clause that names the placeholder.
+8. Run `brief.ts --check <brief>` and fix every missing path before the launch.
 
 ## Launch
 
-- Select continuation or a fresh session per `.agents/orchestration.md` § Sessions and consultation. Use the message or resume mechanism the harness's live tool descriptions name, and record the session and task identities it returns. Read the harness reference named by `.agents/skills/orkestrel-parallel/SKILL.md` § Assign lanes for T3 and native channel mechanics.
-- For a fresh native Claude Code unit, use the Agent tool with the role as `subagent_type`; for native Codex, use the custom agent by name. Use T3 `delegate_task` when the selected provider, model, options, or workspace require it.
-- Bench: run `bench.ts --<bench>` once per session before the first lane, then launch the transport contract's command through `launch.ts` in the background with `--status`.
-- Size the cap from the `durationMs` that `result.ts` reported for comparable runs, plus gate time, plus slack. Never let the unit name it.
-- Confirm the launch within a minute with `result.ts`: `bytes` past the header and a small `ageMs`. An instantly dead journal is a failed launch; read its errors file.
+- Select continuation or a fresh session per `.agents/orchestration.md` § Sessions and consultation. Use the message or resume mechanism the harness's live tool descriptions name, and record the session and task identities it returns.
+- Start a native unit by the Start row of the session's harness page under `.agents/skills/orkestrel-parallel/references/`; that row also names when a hosting harness's child-task channel replaces the native one.
+- Size the cap per `references/launch.md` § Cap. Never let the unit name it.
+- Confirm the launch with `result.ts` before the next dispatch: `bytes` past the header and a small `ageMs`. An instantly dead journal is a failed launch; read its errors file.
+
+### Bench lanes
+
+An external engine widens capacity and inherits no authority; treat its output as a proposal until the Orchestrator verifies it against the tree. `.agents/transports/<harness>.md` owns each bench's command, sandbox, and recovery.
+
+- Probe once per session before the first lane with `bench.ts --<bench>`, and again at any dispatch after a failure. `live: false` records the bench dark. Then launch the transport's command through `launch.ts` in the background with `--status`.
+- A driver writes the brief with `brief.ts --lane <bench>`, resolves the command, runs the lane itself only where its transport allows, and otherwise returns the brief path, the command, and the journal path for the Orchestrator to launch. A driver pinned read-only writes nothing: it returns the brief text, its intended path, the resolved command, and the journal paths, and the Orchestrator writes the brief. Briefs never travel as shell arguments.
+- Name in the brief the host restrictions the transport records that the unit will meet. The Orchestrator takes a proof that needs a restricted capability on the host, and the unit records it as an observation naming the exact command.
+- A bench unit writes only its owned files and its checkout's `tmp/`. Name its report path there, or take the report from the last-message file.
+- Record the lane in the roster (`.agents/orchestration.md` § Sessions and consultation) with subject, journal path, and session id. The Orchestrator owns the cap and the watch; nothing polls the bench from inside the driver.
+- Read the answer with `result.ts`, never from stdout, and refuse a result with no journal path and session id.
 
 ## Watch
 
 - Read liveness from the artifact the work produces: owned-file mtimes, `result.ts` on the journal, the counts a suite reports. A wrapper's silence proves nothing.
-- Prove a run dead before relaunching, by the process id in the spawn line `launch.ts` prints at start and in the `<journal>.pid` file it writes, per `references/launch.md` § Kill and relaunch. Never `pgrep -f` or `pkill -f` a pattern from a shell whose own command line contains it.
+- Prove a run dead before relaunching, per `references/launch.md` § Kill and relaunch.
 - A stalled or cap-killed run: resume with the session id from `result.ts`, or relaunch with a successor brief. Triage per `.agents/orchestration.md` § Deviation protocol.
 
 ## Accept
 
-1. Capture a native report to `tmp/units/<unit>-report.md`, or read a bench answer with `result.ts --<bench> <journal> --out <path>`. Refuse a bench report with no journal path and session id.
+1. Capture a native report to `tmp/units/<unit>-report.md`, or read a bench answer with `result.ts --<bench> <journal> --out <path>`.
 2. Run `cite.ts <report>` and discard every claim whose citation does not resolve before reading the rest.
 3. Verify with direct evidence: `git status --porcelain`, the diff, and the scoped validation the brief named. A writer's self-report is not evidence.
-4. Run the review the size gate names, then integrate: apply shared-file patches serially; route an added type, mechanism, or criterion to a successor unit.
+4. Run the review the size gate names, then integrate: apply shared-file patches serially, each an edit file in the shape `patch.ts` reads, with `patch.ts EDITS.md --plan`, then `--apply`; route an added type, mechanism, or criterion to a successor unit.
 5. Write the acceptance commit message with what changed and what the unit measured; record `durationMs` when it informs a cap or a performance claim.
-6. Run `sweep.ts --unit <unit> --delete` to remove the unit's brief, report, claims, journal, errors, status, pid, and last-message files. Delete any probe the unit left in the tree. In a campaign, update `.orkestrel/<package>/plan.md` and the ledger, and delete a closed seam's verdict. Run `sweep.ts --report` at acceptance and `sweep.ts --tmp [--older-than MINUTES]` after the last live unit exits.
+6. Run `sweep.ts --unit <unit> --delete` to remove the unit's brief, report, claims, journal, errors, status, pid, and last-message files. Delete any probe the unit left in the tree. In a campaign, update `.orkestrel/<package>/plan.md` and the ledger, and delete a closed seam's verdict. `.agents/orchestration.md` § Cleanup owns the `--report` and `--tmp` runs.
 
 ## Refuse
 
 - A brief that contradicts a measurement the campaign already recorded: reconcile first.
 - A unit that asks for an unowned edit: stop it and re-scope.
-- A concurrent writer outside an acknowledged `orkestrel-parallel` ownership protocol: queue it.
+- A concurrent writer outside an `orkestrel-parallel` ownership assignment: queue it.
 - A tree-wide source-mutating command from a unit: strike it from the brief. For verifier command outputs, apply `.agents/orchestration.md` § Permission floor.

package/dist/host/agents/skills/orkestrel-dispatch/references/launch.md

@@ -4,28 +4,31 @@ Apply these rules to every command that outlives the turn that starts it: a benc
 
 ## Launch
 
-- Launch as a harness-tracked background command through `scripts/launch.ts` under a hard cap. Never detach a run from inside a dispatched agent; an unowned run has no completion signal and no death notice.
-- On Windows, launch npm through its JavaScript entry, `node <directory of node>/node_modules/npm/bin/npm-cli.js ARGS`: `launch.ts` spawns with no shell, a `.cmd` shim cannot start that way, and the launcher reports exit `127`.
-- Write a multi-step chain as a TypeScript file run by `node`, with an opening comment naming its log, its cap, and what changed from the file it supersedes. Never edit a script while it runs: copy, edit the copy, launch the copy.
-- On Windows, keep every program-carrying command in a file: a heredoc, `node -e`, an `&&` chain, or a `${...}` argument trips the approval classifier.
+- Launch as a harness-tracked background command through `scripts/launch.ts` under a hard cap, per § Launch ownership.
+- Spawn a package manager through its JavaScript entry; `.agents/platforms/<platform>.md` names the entry and the shell quirks of each host.
+- Write a multi-step chain as a TypeScript file run by `node`, with an opening comment naming its log and its cap. Never edit a script while it runs: copy, edit the copy, launch the copy.
 - Run the first use of any flag, subcommand, or quoting form in a throwaway probe, never inside a unit.
 - Keep network-dependent work (installs, lockfile generation, live fetches) out of sandboxed bench execs.
 - Confirm the journal advanced past its header before recording the launch as started; `scripts/result.ts` reports `bytes` and `ageMs`.
-- Never push a git commit through a hosting REST API when a file's content must ride in the request; the per-call cap truncates it.
+
+## Launch ownership
+
+- Give every run one owner whose lifetime exceeds the run: the owner holds the journal, the pid file, and the cap. A dispatched agent never detaches a run; its turn can end before the run does.
+- When the expected duration exceeds the harness's background cap or idle-session window, which its page under `.agents/skills/orkestrel-parallel/references/` states, the Orchestrator starts the run outside the session's process tree by the detach procedure of `.agents/platforms/<platform>.md`. Record the journal and pid-file paths in the unit's records before the launch, and read liveness from the journal. No other session kills that pid.
+- On a host whose platform page records no proven detach procedure, keep the session in its turn for the run's whole duration.
 
 ## Watch
 
-- Arm one Monitor per long exec, filtered to milestones and terminal states, exiting on the terminal event. Never stream the raw journal.
-- A Workflow journal writes only at agent start and result; read liveness from the newest subagent transcript. Recover with `resumeFromRunId`.
+- Watch each long exec through one harness-native watcher, the one its page under `.agents/skills/orkestrel-parallel/references/` names, filtered to milestones and terminal states and exiting on the terminal event; on a harness with none, wait for its completion notice. Never stream the raw journal.
+- Read a harness fan-out run's liveness and recover it per its page under `.agents/skills/orkestrel-parallel/references/`.
 - Judge a unit by the tree it changes: owned-file mtimes, suite counts, its report file. Check before killing anything; a unit killed on a false signal loses unwritten work.
 
 ## Kill and relaunch
 
 - Take the child's `pid` from the spawn line `scripts/launch.ts` prints when the command starts, or from `<journal>.pid`. Never take it from a pattern match over command lines, and never run `pgrep -f` or `pkill -f`.
-- On a POSIX host, read liveness with `kill -0 <pid>` (exit 0 means alive), list descendants by running `ps -A -o pid= -o ppid=` and taking the rows whose ppid is the recorded pid, then each listed id in turn, print the list, then kill each listed id and the recorded pid with `kill -KILL <id>`.
-- On Windows under Git Bash, write every Windows slash option as `//`. Read liveness from the output of `tasklist //FI "PID eq <pid>" //NH`, never from its exit code: a row naming `<pid>` means alive, and the `INFO:` line means gone. Alternatively, read the `WINPID` column of `ps -W`. Never read liveness with `kill -0` or `ps -eo`. List descendants with `powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter 'ParentProcessId=<pid>' | Select-Object -ExpandProperty ProcessId"` applied to each listed id in turn, print the list, then kill the recorded tree with `taskkill //pid <pid> //T //F`.
-- Refuse a list holding PID 1, the harness shell, or an id outside the descent of the recorded pid. At the cap, `launch.ts` kills the tree on Windows and the command alone on any other host; on a POSIX host, kill the listed descendants of a capped run by hand.
-- Confirm the recorded process and every listed descendant are gone before another writer takes the files. A killed `codex exec` is dead only when its `codex-code-mode-host` child is gone too. Check owned-file mtimes before dispatching the substitute.
+- Read liveness, list descendants, and kill with the commands of `.agents/platforms/<platform>.md`: list every descendant of the recorded pid, print the list, then kill each listed id and the recorded pid.
+- Refuse a list holding PID 1, the harness shell, or an id outside the descent of the recorded pid. At the cap, `launch.ts` kills what the platform page states; kill the remaining listed descendants by hand.
+- Confirm the recorded process and every listed descendant are gone before another writer takes the files. Check owned-file mtimes before dispatching the substitute.
 - Re-run a timing failure alone, after the unit exits, before believing it; a unit's own re-run is never alone.
 
 ## Cap