@orkestrel/scaffold 0.0.108 → 0.0.109

package/dist/host/agents/skills/orkestrel-debrief/references/instruction-audit.md

@@ -88,7 +88,7 @@ Findings land as one of:
   reference; the root stays the single owner.
 - **Charter refinements.** Wording that caused a deviation is a defect; fix the charter,
   not the executor.
-- **Skill refinements / creation.** A workflow the campaign repeated twice is a skill; a
+- **Skill refinements / creation.** A workflow a second campaign needs is a skill; a
   skill step the campaign always skipped or always overrode is wrong.
 - **Orchestration-contract refinements.** Laws the orchestrator learned (cap sizing,
   probe-first, journal-first, verdict shapes, launch ownership) land in the operating
@@ -97,8 +97,8 @@ Findings land as one of:
 ## The questions every round asks
 
 - **Which findings came from falsification rather than diff reading**, and is the brief
-  shape that produced them doctrine yet? Route to the Falsification law in
-  `.claude/rules/quality.md`.
+  shape that produced them doctrine yet? Route to `.claude/rules/quality.md` § Instruments or
+  the `orkestrel-falsify` skill.
 - **Which shipped gaps were accepted as untestable**, and was each one genuinely
   irreducible or a missing seam? Route to the missing-seam law in
   `.claude/rules/tests.md`.
@@ -108,6 +108,5 @@ Findings land as one of:
 
 ## Mirror discipline
 
-Every roster or contract change lands on all harness surfaces in the same round: the
-Claude charters, the Codex mirrors, and both operating-contract role tables. An
-unmirrored refinement is a new drift seeded on purpose.
+Land every roster or contract change on all harness surfaces in the same round;
+`.agents/orchestration.md` § Roles names them.

package/dist/host/agents/skills/orkestrel-debrief/references/retention.md

@@ -10,7 +10,7 @@ carrier. A campaign that accepts with no debrief arrives at acceptance, per
 either door.
 
 Call the `.orkestrel/` folder the campaign folder, never a ledger. The word `ledger` names the
-campaign's ledger file and the carry ledger only.
+campaign's `ledger.md` only.
 
 ## The gate order
 
@@ -41,11 +41,9 @@ Rule on every location in this table before deleting anything.
 | `tmp/<bench>/`          | A bench unit's brief, report, event stream, final answer, and any login log.                                                                 | Swept after the final gate evidence is recorded. Never committed.                                                                |
 | `tmp/probes/`           | The runtime probes the campaign wrote.                                                                                                       | Swept. A probe that settled a claim becomes a test before the prune, per `.claude/rules/quality.md` § Instruments.               |
 | `ROADMAP.md`            | The repository's sequenced plan of record, where it keeps one.                                                                               | Kept. Strike the chunks the campaign closed and add the forward work it revealed.                                                |
-| `PROPOSAL.md`           | A proposal for work nobody has ruled on yet.                                                                                                 | Deleted after the work lands or the proposal is refused. The ruling goes in the prune commit message.                            |
 
 A plan-of-record file is not campaign residue. `ROADMAP.md` outlives every prune and takes the
-campaign's forward work; `PROPOSAL.md` is spent the moment its proposal is ruled on, and a spent
-proposal left in the tree reads as live work.
+campaign's forward work.
 
 ## Sweep `tmp/` as a tree
 
@@ -68,8 +66,8 @@ decision, a withdrawn claim, an unmet acceptance condition. Each ends the check
 commit that closed it, a live brief that owns it, or an explicit drop on the record. An item with
 no carrier blocks the prune.
 
-Read the register files for this — the plan, the readiness grade, the carry ledger, the triage —
-rather than every brief and report in the folder.
+Read `plan.md` § State, `ledger.md`, `gaps.md`, and `ideas.md` for this, rather than every brief and
+report in the folder.
 
 ## The promotion check
 

package/dist/host/agents/skills/orkestrel-dispatch/SKILL.md

@@ -1,25 +1,26 @@
 ---
 name: orkestrel-dispatch
 description: >-
-  Dispatch one unit of work to a native subagent or an external bench and bring its result back: write the brief, probe the bench, launch under a cap, watch liveness, read the report, check its citations, accept, and delete the launch copies. Use when `.agents/orchestration.md` routes work to a role, when a bench lane (Grok, Astra, or Opus through the Claude CLI) is needed, or when a command will outlive the turn that starts it.
+  Dispatch one unit of work to a native subagent or an external bench and bring its result back: write the brief, probe the bench, launch under a cap, watch liveness, read the report, check its citations, accept, and delete the launch copies. Use when `.agents/orchestration.md` routes work to a role, when a bench lane is needed, or when a command will outlive the turn that starts it.
 ---
 
 # Dispatch
 
-`.agents/orchestration.md` decides who runs what and binds the permission floor; this skill runs the dispatch. Read `references/launch.md` before any command that outlives the turn, and `references/bench.md` before any bench lane. Run every step a script performs as that script, from the checkout root, with `node`.
+`.agents/orchestration.md` decides who runs what and binds the permission floor; this skill runs the dispatch. Read `references/launch.md` before any command that outlives the turn. Run every step a script performs as that script, from the checkout root, with `node`.
 
 ## Scripts
 
-| Script               | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `scripts/bench.ts`   | `--cursor [--resolve]`, `--codex [--sandbox MODE]`, or `--claude`, each with `[--model ID] [--cap SECONDS]`: resolves the bench entry, reads its version and login, runs one bounded round trip into `tmp/<bench>/bench.jsonl`, and prints JSON with `live`; `--resolve` prints the Cursor entry alone. Exit 3 when the bench is dark.                                                                                                                                                                                                  |
-| `scripts/brief.ts`   | `--unit UNIT --lane units\|cursor\|codex\|claude [--subject TEXT]` writes the brief from `.agents/templates/brief.md` and never overwrites a launched one; `--check PATH` lists every slash-bearing path the brief names that does not resolve from the root. Exit 3 when one is missing.                                                                                                                                                                                                                                               |
-| `scripts/launch.ts`  | `--journal PATH --errors PATH --cap SECONDS [--status] -- COMMAND [ARGS...]` runs the command with no shell and closed stdin, kills it at the cap (its process tree on Windows), records `git status --porcelain` before and after with `--status`, prints a spawn line carrying the `pid` when the command starts, writes that pid to `<journal>.pid`, and ends the errors file with `exit=`. Exit 124 when capped; 127 when the command cannot start (the errors file names why); 64 on usage, including a cap above 2147483 seconds. |
-| `scripts/login.ts`   | `--codex [--cap SECONDS]` reads `codex login status`, runs `codex login --device-auth` journaled to `tmp/codex/login.log` when it is not logged in, prints the URL and the one-time code as they appear, and polls the status until it answers or the cap ends; `--claude` reads `claude auth status`. Exit 0 logged in, 3 not.                                                                                                                                                                                                         |
-| `scripts/result.ts`  | `--cursor\|--claude\|--codex JOURNAL [--out PATH]` prints the session id, the answer length, the run's `exit`, `capped`, and `durationMs` from the errors file, and the journal's `bytes`, `ageMs`, and `lastEvent`. Exit 3 when the journal carries no session or answer.                                                                                                                                                                                                                                                              |
-| `scripts/cite.ts`    | `PATH [--root DIR] [--json]` lists every `file:line` citation in a report whose file does not exist or whose line is past the end. Exit 3 when one does not resolve.                                                                                                                                                                                                                                                                                                                                                                    |
-| `scripts/helpers.ts` | Import with `.ts`: `readOption`, `readOptions`, `readList`, `listFiles`, `readJsonObject`, `readString`, `readNumber`, `normalizeSlashes`, `resolveNpm`, `runNpm`, `SPEC_FIELDS`, `LOCAL_SPEC_PATTERN`, `ARCHIVE_SPEC_PATTERN`, `SHORTHAND_SPEC_PATTERN`, `matchesLocalSpec`, `collectSpecs`, `scanLocalSpecs`, `removeTree`, `isRecord`. Runs nothing.                                                                                                                                                                                 |
-| `scripts/sweep.ts`   | `--report` lists leftovers under `tmp/` and `.orkestrel/` by age, deletes nothing, and flags a `.orkestrel/**/*.md` line that cites a backticked path git ignores or names a machine path; `--tmp [--older-than MINUTES]` deletes stale launch files and refuses while a journal is changing; `--unit UNIT [--delete]` lists or deletes one accepted unit's brief, report, claims, journal, errors, status, pid, and last-message files; `--tmp` and `--unit --delete` keep every file git tracks and print `kept tracked <path>`.      |
+| Script              | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `scripts/bench.ts`  | `--cursor [--resolve]`, `--codex [--sandbox MODE]`, or `--claude`, each with `[--model ID] [--cap SECONDS]`: resolves the bench entry, reads its version and login, runs one bounded round trip into `tmp/<bench>/bench.jsonl`, and prints JSON with `live`; `--resolve` prints the Cursor entry alone. A malformed cap, a `--sandbox` outside `read-only`, `workspace-write`, and `danger-full-access`, or `--resolve` without `--cursor` is a usage fault, never a dark bench. Exit 3 when the bench is dark, 64 on usage.            |
+| `scripts/brief.ts`  | `--unit UNIT --lane units\|cursor\|codex\|claude [--subject TEXT]` writes the brief from `.agents/templates/brief.md` and never overwrites a launched one; `--check PATH` lists every slash-bearing path the brief names that does not resolve from the root. Exit 3 when one is missing.                                                                                                                                                                                                                                               |
+| `scripts/launch.ts` | `--journal PATH --errors PATH --cap SECONDS [--status] -- COMMAND [ARGS...]` runs the command with no shell and closed stdin, kills it at the cap (its process tree on Windows), records `git status --porcelain` before and after with `--status`, prints a spawn line carrying the `pid` when the command starts, writes that pid to `<journal>.pid`, and ends the errors file with `exit=`. Exit 124 when capped; 127 when the command cannot start (the errors file names why); 64 on usage, including a cap above 2147483 seconds. |
+| `scripts/login.ts`  | `--codex [--cap SECONDS]` reads `codex login status`, runs `codex login --device-auth` journaled to `tmp/codex/login.log` when it is not logged in, prints the URL and the one-time code as they appear, and polls the status until it answers or the cap ends, ending any status read that outlasts the cap, and refuses a cap above 2147483 seconds; `--claude` reads `claude auth status`. Exit 0 logged in, 3 not.                                                                                                                  |
+| `scripts/result.ts` | `--cursor\|--claude\|--codex JOURNAL [--out PATH]` prints the session id, the answer length, the run's `exit`, `capped`, and `durationMs` from the errors file, and the journal's `bytes`, `ageMs`, and `lastEvent`. Exit 3 when the journal carries no session or answer.                                                                                                                                                                                                                                                              |
+| `scripts/cite.ts`   | `PATH [--root DIR] [--json]` lists every `file:line` citation in a report whose file does not exist or whose line is past the end. Exit 3 when one does not resolve.                                                                                                                                                                                                                                                                                                                                                                    |
+| `scripts/sweep.ts`  | `--report` lists leftovers under `tmp/` and `.orkestrel/` by age, deletes nothing, and flags a `.orkestrel/**/*.md` line that cites a backticked path git ignores or names a machine path; `--tmp [--older-than MINUTES]` deletes stale launch files and refuses while a journal is changing; `--unit UNIT [--delete]` lists or deletes one accepted unit's brief, report, claims, journal, errors, status, pid, and last-message files; `--tmp` and `--unit --delete` keep every file git tracks and print `kept tracked <path>`.      |
+| `scripts/chain.ts`  | `--plan FILE.json --journal DIR` runs the steps of a JSON plan (`name`, `command`, `args`, optional `cwd` and `env`) in order with no shell, writes each step's output to `<journal>/<name>.txt`, prints one `name exit= durationMs=` line per step, and stops at the first step that does not exit 0. Exit is that step's code; 2 when a step cannot start; 64 on usage.                                                                                                                                                               |
+| `scripts/patch.ts`  | `EDITS.md (--plan \| --apply) [--skip N ...]` applies an edit file of `### <path>` blocks, each with a `reason:` line and fenced `old:` and `new:` texts: every `old` text must occur exactly once in its file after the earlier edits to that file (however the blocks spell its path), and nothing is written unless every selected edit resolves. `--plan` prints each edit's resolution; `--skip N` leaves out edit N and repeats. Exit 1 when an edit does not resolve, 64 on usage.                                               |
 
 ## Write the brief
 
@@ -36,28 +37,38 @@ description: >-
 
 - Select continuation or a fresh session per `.agents/orchestration.md` § Sessions and consultation. Use the message or resume mechanism the harness's live tool descriptions name, and record the session and task identities it returns.
 - Start a native unit by the Start row of the session's harness page under `.agents/skills/orkestrel-parallel/references/`; that row also names when a hosting harness's child-task channel replaces the native one.
-- Bench: run `bench.ts --<bench>` once per session before the first lane, then launch the transport contract's command through `launch.ts` in the background with `--status`.
-- Size the cap from the `durationMs` that `result.ts` reported for comparable runs, plus gate time, plus slack. Never let the unit name it.
-- Confirm the launch within a minute with `result.ts`: `bytes` past the header and a small `ageMs`. An instantly dead journal is a failed launch; read its errors file.
+- Size the cap per `references/launch.md` § Cap. Never let the unit name it.
+- Confirm the launch with `result.ts` before the next dispatch: `bytes` past the header and a small `ageMs`. An instantly dead journal is a failed launch; read its errors file.
+
+### Bench lanes
+
+An external engine widens capacity and inherits no authority; treat its output as a proposal until the Orchestrator verifies it against the tree. `.agents/transports/<harness>.md` owns each bench's command, sandbox, and recovery.
+
+- Probe once per session before the first lane with `bench.ts --<bench>`, and again at any dispatch after a failure. `live: false` records the bench dark. Then launch the transport's command through `launch.ts` in the background with `--status`.
+- A driver writes the brief with `brief.ts --lane <bench>`, resolves the command, runs the lane itself only where its transport allows, and otherwise returns the brief path, the command, and the journal path for the Orchestrator to launch. A driver pinned read-only writes nothing: it returns the brief text, its intended path, the resolved command, and the journal paths, and the Orchestrator writes the brief. Briefs never travel as shell arguments.
+- Name in the brief the host restrictions the transport records that the unit will meet. The Orchestrator takes a proof that needs a restricted capability on the host, and the unit records it as an observation naming the exact command.
+- A bench unit writes only its owned files and its checkout's `tmp/`. Name its report path there, or take the report from the last-message file.
+- Record the lane in the roster (`.agents/orchestration.md` § Sessions and consultation) with subject, journal path, and session id. The Orchestrator owns the cap and the watch; nothing polls the bench from inside the driver.
+- Read the answer with `result.ts`, never from stdout, and refuse a result with no journal path and session id.
 
 ## Watch
 
 - Read liveness from the artifact the work produces: owned-file mtimes, `result.ts` on the journal, the counts a suite reports. A wrapper's silence proves nothing.
-- Prove a run dead before relaunching, by the process id in the spawn line `launch.ts` prints at start and in the `<journal>.pid` file it writes, per `references/launch.md` § Kill and relaunch. Never `pgrep -f` or `pkill -f` a pattern from a shell whose own command line contains it.
+- Prove a run dead before relaunching, per `references/launch.md` § Kill and relaunch.
 - A stalled or cap-killed run: resume with the session id from `result.ts`, or relaunch with a successor brief. Triage per `.agents/orchestration.md` § Deviation protocol.
 
 ## Accept
 
-1. Capture a native report to `tmp/units/<unit>-report.md`, or read a bench answer with `result.ts --<bench> <journal> --out <path>`. Refuse a bench report with no journal path and session id.
+1. Capture a native report to `tmp/units/<unit>-report.md`, or read a bench answer with `result.ts --<bench> <journal> --out <path>`.
 2. Run `cite.ts <report>` and discard every claim whose citation does not resolve before reading the rest.
 3. Verify with direct evidence: `git status --porcelain`, the diff, and the scoped validation the brief named. A writer's self-report is not evidence.
-4. Run the review the size gate names, then integrate: apply shared-file patches serially; route an added type, mechanism, or criterion to a successor unit.
+4. Run the review the size gate names, then integrate: apply shared-file patches serially, each an edit file in the shape `patch.ts` reads, with `patch.ts EDITS.md --plan`, then `--apply`; route an added type, mechanism, or criterion to a successor unit.
 5. Write the acceptance commit message with what changed and what the unit measured; record `durationMs` when it informs a cap or a performance claim.
-6. Run `sweep.ts --unit <unit> --delete` to remove the unit's brief, report, claims, journal, errors, status, pid, and last-message files. Delete any probe the unit left in the tree. In a campaign, update `.orkestrel/<package>/plan.md` and the ledger, and delete a closed seam's verdict. Run `sweep.ts --report` at acceptance and `sweep.ts --tmp [--older-than MINUTES]` after the last live unit exits.
+6. Run `sweep.ts --unit <unit> --delete` to remove the unit's brief, report, claims, journal, errors, status, pid, and last-message files. Delete any probe the unit left in the tree. In a campaign, update `.orkestrel/<package>/plan.md` and the ledger, and delete a closed seam's verdict. `.agents/orchestration.md` § Cleanup owns the `--report` and `--tmp` runs.
 
 ## Refuse
 
 - A brief that contradicts a measurement the campaign already recorded: reconcile first.
 - A unit that asks for an unowned edit: stop it and re-scope.
-- A concurrent writer outside an acknowledged `orkestrel-parallel` ownership protocol: queue it.
+- A concurrent writer outside an `orkestrel-parallel` ownership assignment: queue it.
 - A tree-wide source-mutating command from a unit: strike it from the brief. For verifier command outputs, apply `.agents/orchestration.md` § Permission floor.

package/dist/host/agents/skills/orkestrel-dispatch/references/launch.md

@@ -6,11 +6,10 @@ Apply these rules to every command that outlives the turn that starts it: a benc
 
 - Launch as a harness-tracked background command through `scripts/launch.ts` under a hard cap, per § Launch ownership.
 - Spawn a package manager through its JavaScript entry; `.agents/platforms/<platform>.md` names the entry and the shell quirks of each host.
-- Write a multi-step chain as a TypeScript file run by `node`, with an opening comment naming its log, its cap, and what changed from the file it supersedes. Never edit a script while it runs: copy, edit the copy, launch the copy.
+- Write a multi-step chain as a TypeScript file run by `node`, with an opening comment naming its log and its cap. Never edit a script while it runs: copy, edit the copy, launch the copy.
 - Run the first use of any flag, subcommand, or quoting form in a throwaway probe, never inside a unit.
 - Keep network-dependent work (installs, lockfile generation, live fetches) out of sandboxed bench execs.
 - Confirm the journal advanced past its header before recording the launch as started; `scripts/result.ts` reports `bytes` and `ageMs`.
-- Never push a git commit through a hosting REST API when a file's content must ride in the request; the per-call cap truncates it.
 
 ## Launch ownership
 
@@ -20,7 +19,7 @@ Apply these rules to every command that outlives the turn that starts it: a benc
 
 ## Watch
 
-- Watch each long exec through one harness-native watcher (Claude Code's Monitor), filtered to milestones and terminal states and exiting on the terminal event; on a harness with none, wait for its completion notice. Never stream the raw journal.
+- Watch each long exec through one harness-native watcher, the one its page under `.agents/skills/orkestrel-parallel/references/` names, filtered to milestones and terminal states and exiting on the terminal event; on a harness with none, wait for its completion notice. Never stream the raw journal.
 - Read a harness fan-out run's liveness and recover it per its page under `.agents/skills/orkestrel-parallel/references/`.
 - Judge a unit by the tree it changes: owned-file mtimes, suite counts, its report file. Check before killing anything; a unit killed on a false signal loses unwritten work.
 
@@ -29,7 +28,7 @@ Apply these rules to every command that outlives the turn that starts it: a benc
 - Take the child's `pid` from the spawn line `scripts/launch.ts` prints when the command starts, or from `<journal>.pid`. Never take it from a pattern match over command lines, and never run `pgrep -f` or `pkill -f`.
 - Read liveness, list descendants, and kill with the commands of `.agents/platforms/<platform>.md`: list every descendant of the recorded pid, print the list, then kill each listed id and the recorded pid.
 - Refuse a list holding PID 1, the harness shell, or an id outside the descent of the recorded pid. At the cap, `launch.ts` kills what the platform page states; kill the remaining listed descendants by hand.
-- Confirm the recorded process and every listed descendant are gone before another writer takes the files. A killed `codex exec` is dead only when its `codex-code-mode-host` child is gone too. Check owned-file mtimes before dispatching the substitute.
+- Confirm the recorded process and every listed descendant are gone before another writer takes the files. Check owned-file mtimes before dispatching the substitute.
 - Re-run a timing failure alone, after the unit exits, before believing it; a unit's own re-run is never alone.
 
 ## Cap