@orkestrel/scaffold 0.0.17 → 0.0.19

package/dist/host/agents/skills/orkestrel-debrief/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: 'Debrief Closed Campaign'
+  short_description: 'Fold a closed campaign into portable truth on field evidence'
+  default_prompt: 'Use $orkestrel-debrief to debrief the closed campaign: field passes, findings ledger, fix loops, canon refinement, propagation, disposal.'

package/dist/host/agents/skills/orkestrel-debrief/references/field-testing.md

@@ -0,0 +1,75 @@
+# Field testing an agent-facing surface
+
+The method for producing the live evidence a debrief judges by. Proven across the
+supervisor MCP campaign's five-model roster; portable to any surface a model consumes.
+
+## The tier ladder
+
+Test from the top down, and do not stop at the tier that passes:
+
+1. **Frontier** (the harness's default model) — proves the surface works at all.
+2. **Mid tier** (e.g. a codex mechanical model) — proves the surface survives a harness's
+   schema abbreviation and a model that reads less carefully.
+3. **Small harness-native** (e.g. Haiku, a codex high-volume model, a cursor composer) —
+   the acceptance tier: these must walk the surface unaided, or the surface is not done.
+4. **Local floor** (a quantized 2B-class model through a real tool-calling client) — not
+   an acceptance gate; a stochastic probe that exposes teaching gaps nothing else hits.
+   Its residual failures must be provably consumer-floor (malformed emission, attention
+   loss), never surface darkness — every refusal it received must have named the fix.
+
+## The pass discipline
+
+- **Goal-only prompts.** State the outcome, never the shape: no field names, no schema
+  hints, no tool names beyond the surface's own. The teaching surface must carry
+  everything else. Identical wording across models; only identifiers vary.
+- **Fresh state per round.** New workflow/resource ids each round; a fresh server on the
+  exact build under test. Never let a model inherit a sibling's residue.
+- **No coaching, no retries by hand.** The transcript ends when the model finishes or its
+  cap fires. A human nudge invalidates the pass.
+- **Caps and journals.** Every pass runs as a tracked background command under a hard
+  time cap with its transcript journaled; the journal is the evidence of record.
+
+## Capture the reasoning, not just the calls
+
+Where the runtime exposes thinking (local runtimes expose it directly; harness stream
+formats carry interstitial text), record it. The call log shows WHAT failed; the trace
+shows WHY — and the why is what the fix targets.
+
+## The confusion-signature catalog
+
+Read every trace against these; each maps to a class of surface fix:
+
+| Signature               | What it looks like                                                     | The fix class                                                                                              |
+| ----------------------- | ---------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
+| Rationalized silence    | The model meets an anomaly, invents a plausible cause, reports success | A silent path must refuse loudly; false affordances removed                                                |
+| Guess loop              | Repeated invented shapes with no reading between attempts              | The critical shape belongs in the description text, stated early                                           |
+| Abbreviation blindness  | The model names what it cannot see ("the abbreviated schema")          | Teaching moved to the surface every harness shows intact                                                   |
+| One-correction-per-step | A refusal names two defects; the model fixes one and keeps the other   | Refusals name ALL missing and unexpected items every time                                                  |
+| Opaque-wall regression  | A correct structure abandoned after an unnamed refusal                 | Every refusal names the subject, path, expectation, and candidates                                         |
+| Repetition fixpoint     | The identical failing call repeated verbatim                           | The refusal must change the caller's information state; if it already does, the residual is consumer-floor |
+
+## The teaching-surface doctrine
+
+What the field passes repeatedly prove:
+
+- **Descriptions are the surviving surface.** Harnesses abbreviate nested schemas;
+  the tool description reaches every model intact. The critical path — a worked example,
+  the key nesting, the reply shape — lives there, importance-first, so a model that
+  stops reading early still gets it.
+- **Every refusal orients, names, or corrects.** Subject, exact key path, expected
+  shape, valid candidates, missing versus unexpected — a refusal that names nothing ends
+  runs; a refusal that names everything converges even a 2B model.
+- **Strictness with teaching beats tolerance.** Never coerce, never silently drop;
+  refuse with the correction in the message. Encode untrusted identifiers (JSON-encoded,
+  length-capped) so hostile input cannot forge or balloon a diagnostic.
+- **Acknowledge or state, never both.** Mutations return acknowledgements; reads return
+  state; the split is stated in both tools' descriptions so neither is polled for the
+  other's job.
+
+## The scoreboard
+
+Report each round as a table: model, harness, calls, failed calls, outcome, and the
+delta from the prior round. A tier passes when its models complete the goal with zero
+failed calls and no out-of-band reading (no source excavation, no filesystem search —
+watch for it in the transcript; it means the surface leaked its teaching job to the
+repository).

package/dist/host/agents/skills/orkestrel-harden-package/SKILL.md

@@ -42,21 +42,23 @@ Load [hardening.md](references/hardening.md) for the hardening lane and for any
 1. **Bound the campaign.** Record requested outcomes, in-scope environments/domains, explicit exclusions, supported hosts, dirty files, and evidence needed for acceptance.
 2. **Map before editing.** Trace public types, implementations, callers, tests, guides, exports, runtime boundaries, installed Orkestrel dependencies, and applicable legacy/upstream references.
 3. **Establish the intended contract.** Build a capability/defect matrix. Separate verified fact from inference. Mark each row implement, repair, retain, or exclude with a reason.
-4. **Design types first.** Update guide/spec intent and `*/types.ts` before implementation. Preserve dependency direction, single-word entity APIs, and mechanism-over-policy boundaries. Do not retain compatibility shims.
-5. **Implement completely.** Finish every in-scope branch. Reuse exact installed Orkestrel primitives when their semantics match. Never hide incomplete behavior behind a TODO, skip, empty branch, or success-shaped placeholder.
-6. **Consolidate.** Run the complete centralization and wrapper sweep. Update all call sites to the real symbol rather than leaving aliases or 1:1 delegates.
-7. **Challenge seams.** Add deterministic tests for invariants, boundaries, failures, lifecycle, cleanup, cancellation, concurrency, hostile input, and resource pressure as applicable. Use real implementations and protocol-faithful fixtures. Never use mocks or fakes.
-8. **Use live services deliberately.** Put real external services/models in their dedicated project, require readiness, and make each request minimally sufficient, robust, and behaviorally meaningful.
-9. **Document the final behavior.** Update the governing guide, examples, method tables, limitations, and parity coverage. Document architectural limits honestly.
-10. **Audit completion.** Inspect test discovery, `.todo`/`.skip`/conditional skip use, source/test helper duplication, exports, environment isolation, unexpected text corruption, and the entire diff.
-11. **Verify.** Run the repository-prescribed gates in order and inspect the generated outputs relevant to the request.
-12. **Review independently.** When orchestration is available, require a design-fit reviewer, an objective correctness/constraints analyst, and a mechanical checker; add an adversarial pass for security, concurrency, destructive paths, or external input. Resolve every required finding, then rerun affected verification.
+4. **Design types first.** Update guide/spec intent and `*/types.ts` before implementation, under the root design laws. A contract that needs a compatibility shim is the wrong contract.
+5. **Implement completely.** Finish every in-scope branch and reuse the exact installed Orkestrel primitives whose semantics match. The root completion law decides what may not be left behind.
+6. **Prove each defect before repairing it.** A repair begins with a test that fails for that defect: record the exact command and its failing count before the fix and the same command's passing count after. A repair with no red-then-green record is unproven.
+7. **Consolidate.** Run the complete centralization and wrapper sweep. Update all call sites to the real symbol rather than leaving aliases or 1:1 delegates.
+8. **Challenge seams.** Add deterministic tests for invariants, boundaries, failures, lifecycle, cleanup, cancellation, concurrency, hostile input, and resource pressure as applicable, under the test rules' real-implementation law.
+9. **Use live services deliberately.** Put real external services/models in their dedicated project, require readiness, and make each request minimally sufficient, robust, and behaviorally meaningful. When the claim is that a foreign client can use this package, drive one representative real client end to end.
+10. **Document the final behavior.** Update the governing guide, examples, method tables, limitations, and parity coverage. Document architectural limits honestly.
+11. **Audit completion.** Inspect test discovery, `.todo`/`.skip`/conditional skip use, source/test helper duplication, exports, environment isolation, unexpected text corruption, and the entire diff.
+12. **Verify.** Run the repository-prescribed gates in order and inspect the generated outputs relevant to the request.
+13. **Review independently, and never by the author.** When orchestration is available, require a design-fit reviewer, an objective correctness/constraints analyst, and a mechanical checker; add an adversarial pass for security, concurrency, destructive paths, or external input. A unit's auditor is the engine that did not write it — same-engine re-review returns the author's own blind spot. Resolve every required finding, then rerun affected verification.
 
 ## Accept the result
 
 Do not accept “mostly complete,” “tests pass” without adequacy review, or a builder's self-report. Completion requires:
 
 - all requested capabilities implemented or explicitly proven out of scope;
+- red-then-green evidence for every repaired defect;
 - public contract, implementation, tests, guides, and generated outputs aligned;
 - no unresolved centralization, wrapper, dependency-reuse, test-discovery, lifecycle, security, or text-integrity finding;
 - exact command evidence for every final gate.

package/dist/host/agents/skills/orkestrel-harden-package/references/centralization.md

@@ -1,85 +1,70 @@
 # Centralization and simplification
 
-## Inventory declarations
+Placement, kind purity, the wrapper test, the no-nested-function law, and barrel law live
+in `.claude/rules/architecture.md`; shared test infrastructure and helper placement live in
+`.claude/rules/tests.md`. This reference adds only the sweep those laws assume: what to
+inventory, how to classify, and what must be proven before acceptance.
 
-Inspect every touched implementation and centralized file, then sweep the full affected environments.
+## Inventory what you touched
 
-For implementation files, inventory:
+Inspect every touched implementation and centralized file, then sweep the full affected
+environments.
 
-- interfaces and type aliases;
-- module constants and data;
-- free functions, guards, parsers, factories, and schemas;
-- function declarations or assignments inside functions/methods;
-- multiple classes;
-- imports or exports left behind after moves.
+| Where               | Inventory                                                                                                                                                                                                          |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Implementation file | Interfaces and type aliases, module constants and data, free functions/guards/parsers/factories/schemas, function declarations or assignments inside bodies, extra classes, imports and exports stranded by a move |
+| Centralized file    | Every module declaration: does it match that file's kind, is it exported, is it reachable from the sole public barrel when public, does it carry direct behavioral coverage when it carries logic                  |
+| Environment root    | Every declaration promoted there: at least two consuming modules, or it belongs to the owning module's centralized file                                                                                            |
 
-Implementation files contain imports and one class. The rare runtime-self-contained entrypoint exception must be literally required for execution and must explain why sibling imports cannot work.
+The rare runtime-self-contained entrypoint exception must be literally required for
+execution and must explain why sibling imports cannot work.
 
-For centralized files, inventory every module declaration. Each declaration must:
+## Classify every function
 
-- match that file's kind;
-- be exported;
-- be reachable from the sole public barrel when public by repository law;
-- have direct behavioral coverage when it contains logic.
+| Signal                                     | Home                                                 |
+| ------------------------------------------ | ---------------------------------------------------- |
+| Reaches instance state or a sibling method | Class method                                         |
+| Pure self-contained computation            | Exported centralized helper, parser, compiler, guard |
+| Defining recursive or compositional spine  | Class method, after extracting its pure leaves       |
+| Trivial and genuinely one-use              | Inline it into the caller                            |
 
-Promote a declaration to an environment root only when multiple modules consume it. Otherwise keep it in the owning module's centralized file.
+Never move logic into a nested function to evade centralization. An anonymous callback
+passed directly to another operation stays a callback, not a hidden helper declaration.
 
-## Apply the leaf test
+## Hunt the wrapper
 
-Classify each function:
+Search callers and callees for one-line delegates, pass-through factories, getters that
+rename another public getter, duplicate guards or parsers a declared dependency already
+supplies, compatibility aliases and re-exports, and functions whose only purpose is
+avoiding a downstream rename. The architecture rules' wrapper test decides each one; a
+survivor owns a real boundary, invariant, composition, translation, lifecycle, or
+materially narrower contract. Otherwise use or rename the real symbol and update every
+consumer.
 
-1. Instance state or sibling-method access: class method.
-2. Pure, self-contained computation: exported centralized helper/parser/compiler/etc.
-3. Defining recursive/compositional engine spine: class method after extracting its pure leaves.
-4. Trivial, genuinely one-use expression: inline it.
-
-Never move logic into a nested function to evade centralization. Anonymous callbacks passed directly to another operation remain callbacks, not hidden helper declarations.
-
-## Remove superfluous wrappers
-
-Search callers and callees for:
-
-- one-line helper delegates;
-- pass-through factories;
-- getters that merely rename another public getter;
-- duplicate guards/parsers already supplied by a declared dependency;
-- compatibility aliases and re-exports;
-- functions whose only purpose is avoiding a downstream rename.
-
-A wrapper survives only if it owns a boundary, invariant, composition, translation, lifecycle, or materially narrower contract. Otherwise use or rename the real symbol and update every consumer.
-
-Do not hollow a class into public methods that each forward to one helper. Keep meaningful orchestration on the entity and export only pure leaves.
+Do not hollow a class into public methods that each forward to one helper.
 
 ## Consolidate tests
 
-Sweep test files for repeated or reusable:
-
-- input and result records;
-- builders and factories;
-- recorders and event capture;
-- wait/readiness helpers;
-- temporary workspace or fixture-server setup;
-- browser/DOM builders and event factories;
-- service request builders and response assertions.
-
-Move host-independent helpers to `tests/setup.ts`; Node helpers to `tests/setupServer.ts`; browser helpers to `tests/setupBrowser.ts`; styles helpers to `tests/setupStyles.ts`; and live-service helpers to that project's dedicated setup.
-
-Use customizable factories and inert stubs for data shapes. A scripted boundary stub may implement the real interface/protocol minimally to drive the system under test, but must not reproduce project-owned behavior or replace the integration being claimed. Otherwise use the real implementation, a temporary resource, a protocol-faithful fixture server, or the real external service.
-
-Prefer recorders over spies. Do not use mocks or fakes.
+Sweep test files for repeated or reusable input and result records, builders and
+factories, recorders and event capture, wait and readiness helpers, temporary workspace or
+fixture-server setup, browser and DOM builders, event factories, and service request
+builders or response assertions. Move each into the setup file its environment owns.
 
-Add focused tests for every exported function extracted from production code. Do not create isolated tests for declaration-only types, constants, barrels, or error definitions.
+Add focused tests for every exported function extracted from production code. Do not create
+isolated tests for declaration-only types, constants, barrels, or error definitions.
 
-## Run the cleanup sweep
+## Prove the sweep
 
 Before acceptance, prove:
 
 - no stray declarations remain in implementation files;
 - no non-exported or wrong-kind declaration remains in centralized files;
-- no prohibited nested function declaration/assignment remains;
+- no prohibited nested function declaration or assignment remains;
 - no duplicate or rename-only wrapper remains;
 - every move updated imports, barrels, guides, and tests;
 - test helpers are consolidated without over-generalizing one-off setup;
-- files are valid UTF-8 and contain no replacement characters, mojibake, unintended control characters, or accidental trailing debris.
+- files are valid UTF-8 with no replacement characters, mojibake, unintended control
+  characters, or accidental trailing debris.
 
-Review the complete diff after formatting. Formatting cannot substitute for the structural sweep.
+Review the complete diff after formatting. Formatting cannot substitute for the structural
+sweep.

package/dist/host/agents/skills/orkestrel-harden-package/references/hardening.md

@@ -21,12 +21,20 @@ For each applicable seam, state the invariant, failure mode, observable result,
 
 Test through public behavior with:
 
-- real package classes and composed managers;
-- temporary directories/files;
-- actual local sockets and protocol-faithful fixture servers;
-- actual Chromium-family browsers where the browser is the system under test;
-- actual installed dependencies;
-- actual external service/model projects when their behavior is the subject.
+| Seam                                    | The real thing it must be driven with                                    |
+| --------------------------------------- | ------------------------------------------------------------------------ |
+| Package behavior                        | Real package classes and composed managers                               |
+| Filesystem                              | Temporary directories and files                                          |
+| Network protocol                        | Actual local sockets and protocol-faithful fixture servers               |
+| Browser                                 | An actual Chromium-family browser when the browser is the system         |
+| Declared dependency                     | The actual installed dependency                                          |
+| External service or model               | The real service in its dedicated project when its behavior is the claim |
+| Third-party client or protocol consumer | One representative real foreign client, driven end to end                |
+
+A third-party seam is the one case where the package's own tests cannot close the claim:
+protocol tests prove the protocol, and only a real client of that class proves the
+integration. Drive it end to end, record the exact commands, and record what that client
+could NOT reach as an honest limit rather than an untested assumption.
 
 Never use mocks, behavioral fakes, module replacement, or framework spies. Use recorders for callbacks and customizable data factories/stubs for inert shapes.
 

package/dist/host/agents/skills/orkestrel-polish-surface/SKILL.md

@@ -0,0 +1,113 @@
+---
+name: orkestrel-polish-surface
+description: Drive a rendered or externally driven surface to shipped quality through capture-evidence verdict rounds. Use when asked to polish an interface, bring a rendered surface to enterprise grade, judge what actually renders rather than what the source claims, reconcile design, state-truth, and inventory findings into fix units, or converge repeated review rounds on captured proof. Run one round for a narrow request; run the full campaign for a polish or production-readiness request.
+---
+
+# Polish a rendered surface
+
+## Load authority
+
+Read the current files in this order:
+
+1. `AGENTS.md`.
+2. Every applicable `.claude/rules/*.md`. The style, browser, test, and documentation
+   laws bind every fix unit; this skill adds only the campaign.
+3. [capture-harness.md](references/capture-harness.md) before building, eyeballing, or
+   trusting a portfolio.
+4. `guides/README.md`, the governing guide for the surface, and `ROADMAP.md` when present.
+5. The authoritative `*/types.ts` for the surface, its components and partials, and the
+   shipped resolved cascade of every stylesheet the surface actually loads.
+
+Treat the current user instruction as authoritative. Treat repository rules as the coding
+contract and this skill as the workflow. Preserve dirty and user-owned work.
+
+## Judge the rendering, not the source
+
+A claim about a rendered surface is proven by capture, never by reading the code that was
+supposed to produce it. Source-reading review passes a component that renders nothing.
+
+- The portfolio IS the review input: captures at both viewports and both themes, an
+  accessibility snapshot, and an interaction log.
+- Source is corroboration for a mechanism, never the proof that the surface shows it.
+- A claim the portfolio cannot show is unproven, not passed. Say so.
+- The same law governs an externally driven surface: a compatibility claim is proven by
+  driving it with a representative real client, not by its own tests.
+
+## Select the scope
+
+Choose the smallest scope that satisfies the request:
+
+- **Verdict:** one portfolio, one lane, no fixes.
+- **Round:** portfolio → three independent verdicts → reconciliation → fix units →
+  recapture.
+- **Campaign:** rounds repeated until one terminal converged line, then independent gates.
+
+A narrow verdict request does not authorize fixes. A polish request authorizes fixing every
+confirmed finding in scope and rebuilding the harness gaps the verdicts expose.
+
+## Execute the campaign
+
+1. **Build the portfolio.** Produce the full evidence set with the harness reference, then
+   eyeball every artifact yourself before spending a verdict round on it. An unexamined
+   portfolio buys harness bugs at verdict prices.
+2. **Seed candidates.** Turn your own mid-integration observations into numbered
+   confirm-or-refute candidates inside the verdict brief. Observations that stay in your
+   head are neither evidence nor findings.
+3. **Take three independent verdicts** on the SAME portfolio, in the fixed shape below, no
+   lane seeing another's answer before all have returned. The three work classes are
+   subjective design fit; objective state truth; and mechanical inventory of copy, classes,
+   icons, and accessibility attributes.
+4. **Reconcile.** Confirmed findings get carriers; refuted findings die on the record with
+   the evidence that killed them; conflicts get a dated ruling. Then walk the reconciled
+   list once and name the fix-brief item carrying each finding — a finding with no carrier
+   is a dropped finding, and it will cost the next round.
+5. **Dispatch serialized fix units,** objective lane first because it changes the ground
+   truth the subjective lane reads. Each unit records the failing proof before the
+   repair — the exact command and its red count — and the same command's green count
+   after. Commit each accepted unit before dispatching the next.
+6. **Cross-audit.** A fix unit's auditor is the engine that did not write it. Same-engine
+   re-review returns the author's own blind spot.
+7. **Recapture,** repairing every harness gap the verdicts exposed, and re-verdict against
+   the new portfolio, not the old one.
+8. **Iterate to the terminal line.** Repeat rounds until every lane returns converged.
+9. **Verify independently.** An independent runner executes the repository-prescribed
+   gates; a fixer's own report never establishes green.
+
+## Fix the treatment, not the symptom
+
+- Resolve every visual treatment in the shipped cascade before writing it; a dependency's
+  own default rules decide what a bare element renders as.
+- Prove a defect with a test that fails for that defect before the repair exists.
+- Do not narrow a selector, add a local exception, or restyle one instance to make a
+  capture pass while the underlying rule stays wrong.
+- When a law of the repository genuinely conflicts with the surface's required anatomy,
+  stop and report both horns with evidence. An improvised local exception poisons an
+  enforced invariant.
+
+## Return the fixed verdict shape
+
+Free-form verdicts cost one reconciliation pass each. Every verdict returns:
+
+- one line per item, in the brief's numbering:
+  - `RENDERED-PROVEN(<capture>)` — the artifact shows it;
+  - `REGRESSED(<capture>, <what regressed>)` — the artifact shows it is now worse;
+  - `NOT-EVIDENCED(<what the portfolio lacks>)` — the portfolio cannot decide it;
+- referrals to another lane, each with the specific evidence and no verdict attached;
+- exactly one final line: `CONVERGED` or `ANOTHER ROUND(<item list>)`.
+
+Treat every `NOT-EVIDENCED` line as a harness question first and a product defect second.
+Triage it against the capture reference before it becomes a finding.
+
+## Accept the result
+
+Do not accept a source-only verdict, a self-audited fix unit, a round without a terminal
+line, or a green claim from the engine that wrote the code. Completion requires:
+
+- every confirmed finding fixed or explicitly ruled out of scope on the record;
+- a final portfolio whose captures show the accepted state;
+- red-then-green evidence for every defect unit;
+- every lane converged in one round against that final portfolio;
+- independent gate evidence.
+
+Report what changed, which capture proves each change, the exact test and gate results, and
+any residual risk the portfolio genuinely cannot settle.

package/dist/host/agents/skills/orkestrel-polish-surface/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: 'Polish Rendered Surface'
+  short_description: 'Drive a rendered surface to shipped quality on captured evidence'
+  default_prompt: 'Use $orkestrel-polish-surface to bring this rendered surface to shipped quality on captured evidence.'

package/dist/host/agents/skills/orkestrel-polish-surface/references/capture-harness.md

@@ -0,0 +1,82 @@
+# The capture harness
+
+The harness produces the only evidence the verdict lanes are allowed to judge. It is owned
+by the campaign owner, not by a review lane, and it is a throwaway instrument: written for
+this surface, kept honest, deleted or rebuilt when the surface changes.
+
+## One call, one lifecycle
+
+Background processes started inside one tool call die with that call's process group, and a
+verdict round spent on a half-dead harness is a wasted round.
+
+- Write the harness as one self-contained script that spawns its own children, waits for
+  readiness, does the capture, and kills them before returning.
+- Never leave a child running across calls or expect one to survive its parent.
+- Give every child a pinned working directory: a process that resolves assets, config, or
+  fixtures relative to the current directory dies silently when launched from elsewhere.
+- Pipe child standard error somewhere readable and print it on failure. A discarded stream
+  turns a one-line configuration refusal into a debugging round.
+- Wait on an observable readiness signal — a served response, a printed line, a health
+  probe — never on a fixed sleep.
+- Tear down on every exit path, including assertion and setup failure, so a failed capture
+  leaves no orphaned server, browser, or port.
+
+## Validate the seed before capturing
+
+Most "the surface is broken" verdicts trace back to a seed the surface legitimately
+refused.
+
+- Build seed payloads from the surface's own published contract, not from memory of it: a
+  near-miss field name produces an empty screen that looks exactly like a product defect.
+- Assert the seeded state is present before shooting: the row exists, the prompt is parked,
+  the list is non-empty.
+- Drive the surface through its real entry path so the captured state is one a user can
+  actually reach.
+- Reset to a known state between scenarios; a capture that inherits the previous scenario's
+  selection, focus, or scroll proves nothing about either.
+
+## Capture the full portfolio
+
+Every round produces all of it, for every scenario in scope:
+
+| Artifact               | Requirement                                                                            |
+| ---------------------- | -------------------------------------------------------------------------------------- |
+| Viewport captures      | The narrow and wide breakpoints the surface actually declares, not one convenient size |
+| Theme captures         | Every theme the surface ships, each at both viewports                                  |
+| Accessibility snapshot | The rendered accessible tree: roles, names, states, and focus order                    |
+| Interaction log        | Each scripted interaction, its trigger, and the observed result                        |
+| Console and error log  | Anything the page or process emitted during the run                                    |
+
+- Shoot the whole surface before selecting or focusing anything inside it; a capture taken
+  after a selection reports a duplicate or highlighted artifact that does not exist.
+- Start a keyboard walk from a neutral state, never from an already-focused control, or the
+  log will "prove" a broken order the user never sees.
+- Name artifacts so a verdict can cite one exactly: scenario, viewport, theme, step.
+- Keep the artifacts of each round beside its verdicts; a round judged against the previous
+  round's captures is not a round.
+
+## Preflight before spending a round
+
+The campaign owner opens every artifact before dispatching a verdict lane:
+
+- each capture shows the scenario it claims, in the theme and viewport it claims;
+- the seeded state is visible;
+- the accessibility snapshot is non-empty and matches the captured screen;
+- the interaction log records the interactions the brief asked for;
+- nothing in the console log indicates the harness, rather than the surface, failed.
+
+A portfolio that fails preflight is repaired before dispatch. A verdict round is the
+most expensive way to discover a harness bug.
+
+## Triage missing evidence to the harness first
+
+When a verdict returns a not-evidenced item, the harness is the first suspect and the
+surface is the second. In order:
+
+1. Confirm the artifact that should decide the item exists and is named as the brief said.
+2. Confirm the scenario reached the state the item is about.
+3. Confirm the seed and the entry path match the surface's real contract.
+4. Only then treat it as a product finding.
+
+Every harness gap a round exposes is repaired before the recapture, and the repair is
+recorded with the round so the next portfolio is strictly better than the last.

package/dist/host/claude/agents/builder.md

@@ -16,6 +16,8 @@ You are an Executor: do the work yourself, spawn nothing.
 
 - Before writing, read **AGENTS.md**, every applicable `.claude/rules/*.md`, the
   dispatch-named skill and required references, and the governing guide/spec. All bind you.
+  An app-layer unit additionally binds `.claude/rules/application.md` and
+  `.claude/rules/workspace.md`.
 - Write ONLY the owned files named in your dispatch. Shared or off-limits files are
   report-only: if one needs a change, RETURN the exact patch — never edit it.
 - NO tree-wide or mutating commands: never `format`, lint `--fix`, or `build`.

package/dist/host/claude/agents/codex.md

@@ -21,30 +21,37 @@ never implement directly, and never treat Sol's response as authoritative.
   `tmp/codex/<unit>.session` — an interrupted MCP call whose id was never written
   to disk is unrecoverable, and that whole exchange is then treated as failed.
 - **Long-running work** (audits, implementation units, anything multi-minute):
-  the journaled CLI is MANDATORY and the MCP tools are forbidden. A long MCP call
-  is one interruption away from losing the session invisibly; the journal is not.
+  the journaled CLI is MANDATORY, the MCP tools are forbidden, and YOU DO NOT
+  LAUNCH IT. A long MCP call is one interruption away from losing the session
+  invisibly; a backgrounded exec you start and walk away from has no owner, no
+  completion signal, and no death notice. Prepare it and hand it back.
 
-## Journaled CLI protocol
+## Prepare the journaled CLI launch
 
-Create `tmp/codex/` first. Write the full brief to `tmp/codex/<unit>-brief.md` —
-briefs never travel as shell arguments — and pass a pointer prompt instead:
-
-`codex exec --json --sandbox <route-sandbox> --model gpt-5.6-sol -c "model_reasoning_effort=\"high\"" --output-last-message tmp/codex/<unit>-last.md "Read and execute the brief at tmp/codex/<unit>-brief.md exactly. Your final message must be the report it specifies." > tmp/codex/<unit>.jsonl`
+Your two jobs are drafting the brief and short MCP exchanges. For long work you
+prepare the launch and return it; the Orchestrator runs it as a harness-tracked
+background command under a hard cap.
 
-- Run it foreground with a generous timeout when it will finish inside the shell's
-  foreground cap. When it may exceed that cap, launch it in the background and END
-  YOUR TURN — the harness re-invokes you when the exec exits. Ending the turn IS
-  the wait; a "final" message that only promises to wait is a deviation.
-- Never sleep-loop, never poll the journal, never spawn placeholder wait loops or
-  keep-alive commands, never restart or kill a running exec.
+Create `tmp/codex/` first. Write the full brief to `tmp/codex/<unit>-brief.md` —
+briefs never travel as shell arguments — then return the exact resolved command
+with a pointer prompt:
+
+`timeout <cap> codex exec --json -C <working-directory> --sandbox <route-sandbox> --model gpt-5.6-sol -c "model_reasoning_effort=\"high\"" --output-last-message tmp/codex/<unit>-last.md "Read and execute the brief at tmp/codex/<unit>-brief.md exactly. Your final message must be the report it specifies." < /dev/null > tmp/codex/<unit>.jsonl`
+
+- Return four things: the brief path, that resolved command, the journal path,
+  and a cap recommendation with its basis — the observed duration high-mark for
+  this work class, plus an independently budgeted gate allowance, plus explicit
+  slack. Never launch, background, poll, sleep-loop, restart, or kill an exec.
+- Keep `< /dev/null`: a background-launched exec that inherits an open stdin pipe
+  wedges before its first event and only the cap ever surfaces it. Add
+  `--skip-git-repo-check` when the working directory is outside a trusted git
+  repository, and `--output-schema <file>` when the Orchestrator supplies one.
 - The journal at `tmp/codex/<unit>.jsonl` is the live progress record (the user
   tails it) and its mtime is the liveness signal the Orchestrator watches. Never
   re-print the stream into your report.
-- Read Sol's answer from the `--output-last-message` file, not from stdout.
-- Record the session id (`thread_id` in the journal's opening events) in every
-  report.
-- When the Orchestrator supplies a JSON Schema for the return shape, pass it with
-  `--output-schema <file>`.
+- When the Orchestrator hands back a finished exec, read Sol's answer from the
+  `--output-last-message` file, not from stdout, and record the session id
+  (`thread_id` in the journal's opening events) in every report.
 
 ## Recovery ladder
 
@@ -53,8 +60,8 @@ On any interruption or missing result, in order:
 1. Interrupted MCP call WITH a persisted thread id → `mcp__codex__codex-reply`
    asking Sol to re-emit the complete final report (the reasoning may have
    finished server-side).
-2. No persisted id, or the reply fails → fresh journaled CLI session with the
-   same brief file.
+2. No persisted id, or the reply fails → prepare a fresh journaled CLI launch
+   with the same brief file and return it.
 3. Interrupted CLI exec → the journal survives; report the thread id and the last
    journal events as a deviation and let the Orchestrator choose resume or fresh.
 
@@ -74,12 +81,12 @@ unsupported claims as dropped.
 
 Sandbox `workspace-write`, main checkout, sole serial writer from a clean
 committed baseline with owned files, off-limits files, and a deviation contract.
-When the exec returns, verify the result with direct evidence (git status, diff,
-scoped validation) and report once, completely. The brief forbids dependency
-installation, commits, pushes, publishing, credentials, destructive commands,
-shared-file edits, and tree-wide mutating gates. Return the touched files,
-diffstat, scoped validation, and deviation state for independent integration and
-review.
+When the Orchestrator hands the finished exec back, verify the result with direct
+evidence (git status, diff, scoped validation) and report once, completely. The
+brief forbids dependency installation, commits, pushes, publishing, credentials,
+destructive commands, shared-file edits, and tree-wide mutating gates. Return the
+touched files, diffstat, scoped validation, and deviation state for independent
+integration and review.
 
 ## Routing exclusion — defensive negative-test units
 

package/dist/host/claude/agents/grok.md

@@ -30,6 +30,13 @@ on disk:
 
 `<agent-cli> -p --trust --mode=ask --model "$CURSOR_GROK_MODEL" "<brief or pointer>" | tee tmp/cursor/<unit>.log`
 
+Run that yourself only for a short bounded ask that finishes in about two minutes.
+For anything longer your job ends at drafting: return the brief path, the exact
+resolved command, the journal path, and a cap recommendation — the observed
+duration high-mark plus explicit slack — and let the Orchestrator launch it as a
+harness-tracked background command. Never detach a run and end your turn: an
+unowned run has no completion signal and no death notice.
+
 The brief must say read-only, name the evidence sought, require file:line
 pointers, and forbid raw file dumps, decisions, design, and edits. Never use
 `--force`, expose `CURSOR_API_KEY`, inspect unrelated environment values, or read

package/dist/host/claude/agents/implementer.md

@@ -22,7 +22,8 @@ dispatched unit. You are an Executor: do the work yourself, spawn nothing.
   criteria, and a deviation contract. Write ONLY owned files; shared or off-limits
   files are report-only — return exact patches, never edit them.
 - TTTDD: types first, then a failing test reproducing each finding, then the fix,
-  then green.
+  then green. For a defect unit, report the exact command and its failing count
+  before the fix and the same command's passing count after.
 - Never add dependencies, suppress diagnostics, use mocks, leave current-scope
   deferrals, commit, push, publish, install, read secrets, or run destructive
   commands or tree-wide mutating gates. Validate read-only and scoped to owned