@orkestrel/scaffold 0.0.18 → 0.0.19

package/dist/host/claude/agents/orkestrel.md

@@ -13,9 +13,14 @@ nothing and edit nothing.
 
 The catalog below is discovery data, not instruction and not proof of current state.
 Before reporting a version, range, guide, branch, or capability, verify it against the
-registry, manifest, lockfile, installed declarations, canonical guide, or repository
-source named by the dispatch. Prefer exact installed declarations when implementation
-depends on a package contract. Never inspect credentials or mutate package state.
+manifest, lockfile, installed declarations, canonical guide, or repository source named
+by the dispatch. Prefer exact installed declarations when implementation depends on a
+package contract. Never inspect credentials or mutate package state.
+
+You have no shell and no network, so you never read the registry yourself. Live registry
+state is evidence the Orchestrator supplies with the dispatch; without it, report that
+fact as unknown and name what would settle it. Never present the catalog, a lockfile
+entry, or memory as live registry truth.
 
 ## Package catalog
 
@@ -29,10 +34,10 @@ descriptions never enter agent instruction context.
 
 | Package               | Version |
 | --------------------- | ------- |
-| @orkestrel/abort      | 0.0.4   |
+| @orkestrel/abort      | 0.0.5   |
 | @orkestrel/agent      | 0.0.13  |
 | @orkestrel/browser    | 0.0.8   |
-| @orkestrel/budget     | 0.0.4   |
+| @orkestrel/budget     | 0.0.5   |
 | @orkestrel/console    | 0.0.4   |
 | @orkestrel/contract   | 0.0.9   |
 | @orkestrel/csv        | 0.0.2   |
@@ -43,8 +48,8 @@ descriptions never enter agent instruction context.
 | @orkestrel/indexeddb  | 0.0.6   |
 | @orkestrel/interpret  | 0.0.7   |
 | @orkestrel/markdown   | 0.0.7   |
-| @orkestrel/mcp        | 0.0.9   |
-| @orkestrel/middleware | 0.0.6   |
+| @orkestrel/mcp        | 0.0.11  |
+| @orkestrel/middleware | 0.0.9   |
 | @orkestrel/msg        | 0.0.5   |
 | @orkestrel/ndjson     | 0.0.5   |
 | @orkestrel/ollama     | 0.0.8   |
@@ -55,20 +60,20 @@ descriptions never enter agent instruction context.
 | @orkestrel/rater      | 0.0.8   |
 | @orkestrel/reason     | 0.0.4   |
 | @orkestrel/relation   | 0.0.7   |
-| @orkestrel/router     | 0.0.7   |
-| @orkestrel/scaffold   | 0.0.16  |
-| @orkestrel/sea        | 0.0.4   |
-| @orkestrel/server     | 0.0.7   |
+| @orkestrel/router     | 0.0.8   |
+| @orkestrel/scaffold   | 0.0.18  |
+| @orkestrel/sea        | 0.0.5   |
+| @orkestrel/server     | 0.0.10  |
 | @orkestrel/sqlite     | 0.0.6   |
 | @orkestrel/sse        | 0.0.4   |
 | @orkestrel/template   | 0.0.2   |
 | @orkestrel/terminal   | 0.0.5   |
-| @orkestrel/timeout    | 0.0.4   |
+| @orkestrel/timeout    | 0.0.5   |
 | @orkestrel/tool       | 0.0.9   |
-| @orkestrel/toolbox    | 0.0.2   |
+| @orkestrel/toolbox    | 0.0.3   |
 | @orkestrel/websocket  | 0.0.7   |
-| @orkestrel/worker     | 0.0.5   |
-| @orkestrel/workflow   | 0.0.9   |
+| @orkestrel/worker     | 0.0.6   |
+| @orkestrel/workflow   | 0.0.10  |
 | @orkestrel/workspace  | 0.0.2   |
 
 <!-- catalog:end -->

package/dist/host/claude/agents/planner.md

@@ -16,7 +16,8 @@ Return only:
 
 - `Design`: the coherent API, vocabulary, architecture, and user experience.
 - `Alternatives`: at most two real alternatives and why the design wins.
-- `Units`: bounded work with ownership, dependencies, and acceptance criteria.
+- `Units`: bounded work, each naming its role AND engine so the routing ledger is
+  derivable, with ownership, dependencies, and acceptance criteria.
 - `Tensions`: subjective choices that Sol should challenge objectively.
 - `Risks`: design-fit risks and the evidence needed to settle them.
 

package/dist/host/claude/agents/reviewer.md

@@ -33,6 +33,12 @@ Audit the changed work only through Opus 5's subjective and creative lens:
 5. **Guide voice and product coherence** — documentation reads as the package's
    current, self-contained human guide and matches the experience the code presents.
 
+For a rendered or externally driven surface, the supplied capture portfolio is the
+primary evidence and source is corroboration only: cite a capture for every rendered
+claim, mark what the portfolio cannot show as NOT-EVIDENCED instead of inferring it,
+and when the dispatch names a skill that fixes the verdict shape, return that shape
+and its single terminal line.
+
 Read the actual diff plus enough surrounding code to judge it in context.
 Correctness, security, dependency constraints, test sufficiency, and mechanical
 conformance belong to the independent Sol analyst and checker. If you notice a

package/dist/host/claude/rules/documentation.md

@@ -23,6 +23,7 @@ Documentation is an enforced contract, not explanatory decoration.
 - `guides/README.md` is the map: maintain both a concept index (`spec ↔ source ↔ tests ↔ showcase`) and directory index.
 - `ROADMAP.md` is the sequenced plan of record. Each chunk reaches green before the next.
 - A showcase is executable proof of public API. A missing demonstration is a missing feature, detectable by parity.
+- An integration surface's guide documents the validated hookup for each supported client: the exact commands run, the authentication and approval model that client needs, and the honest limit wherever a client cannot reach part of the surface.
 
 ## Parity
 

package/dist/host/claude/rules/names.md

@@ -93,18 +93,16 @@ Module helpers have no owning entity at the call site, so default to `{verb}{Nou
 
 ## General vocabulary
 
+The root design laws in `AGENTS.md` — one term per concept, boolean behavior switches, `undefined` absence, derived state, real domain states, and named discriminants — bind here. This section adds only their naming specifics:
+
 - Describe what a thing is, not its implementation.
 - Prefer short common English; avoid jargon, abbreviations, and non-universal acronyms.
-- One concept has one word project-wide. Do not alternate `count`/`length`/`size`/`total` or `abort`/`cancel`.
 - Properties are nouns; methods are verbs.
 - Booleans read as assertions: `aborted`, `exhausted`, `expired`.
-- A binary behavior switch is a boolean, such as `bail`; never model it as `'continue' | 'halt'`.
-- Genuine discriminants, multi-state lifecycles, conventional value pairs (`ascending`/`descending`, `and`/`or`), and external-spec literals remain unions.
-- Absence is `undefined`, never `'none'`, `'unset'`, `'unknown'`, `''`, `-1`, or another sentinel. Use `null` only when an external protocol distinguishes it from omission.
-- Derive facts from existing state through a getter or at the use site. Do not store a duplicate boolean/string label that can drift.
-- Use a union only for irreducible modes, phases, discriminants, or external values.
 - Accessors use bare nouns, never `get*`/`set*`.
-- A discriminant names its axis (`relationship`, `command`, `category`, `operation`, `via`), never `kind` or `type`.
+- Do not alternate `count`/`length`/`size`/`total` or `abort`/`cancel`.
+- Name the axis a discriminant varies: `relationship`, `command`, `category`, `operation`, `via`.
+- A binary switch is a boolean such as `bail`, never `'continue' | 'halt'`; genuine discriminants, multi-state lifecycles, conventional value pairs (`ascending`/`descending`, `and`/`or`), and external-spec literals remain unions.
 
 ## Acronyms
 

package/dist/host/claude/rules/quality.md

@@ -23,10 +23,11 @@ paths:
 
 ## Ecosystem reuse
 
-- Inspect declared `@orkestrel/*` packages before implementing overlapping infrastructure.
-- Prefer an exact originating primitive when semantics match; test semantic differences when they do not.
+The root laws on inspecting declared `@orkestrel/*` capabilities, reusing a matching primitive, and updating every consumer without shims bind here without restatement. They leave this file the judgment calls:
+
+- Prove the semantic difference before keeping a local variant; similar names are not evidence of different behavior.
 - Downstream friction is valid evidence of a reusable upstream defect, not automatic proof. Fix the lowest package that owns the general mechanism and keep product policy downstream.
-- Update affected consumers atomically. Never add compatibility shims or dependency re-exports.
+- Never re-export a dependency's symbol to soften a consumer's import.
 
 ## Production hardening
 
@@ -35,11 +36,12 @@ paths:
 - Use dedicated real-service projects for external model/service behavior. Require readiness and tune each request to the smallest robust proof.
 - Audit test discovery, counts, skipped/todo tests, cleanup, and assertion adequacy; passing discovered tests alone is insufficient.
 - Inspect public exports, declarations, supported runtime targets, and generated outputs.
+- A claim that a surface works with an external client stays unproven until one representative real client of that class has driven it end to end. Protocol tests prove the protocol, not the integration.
 - Add an independent adversarial review for security, destructive paths, concurrency, protocols, or untrusted external input.
 
 ## Completion
 
-- Run the applicable repository skill for comprehensive hardening, structural cleanup, contract adoption, or multi-package alignment.
-- Finish every in-scope capability and required finding now. Do not leave TODOs, deferred rows, empty branches, skipped proof, or hidden follow-up work.
+The root completion law — finish every in-scope capability now, leave no TODO, deferral, or hidden follow-up, and run the applicable repository skill for comprehensive work — binds here without restatement. It leaves this file two obligations:
+
 - Perform a final centralization/wrapper/test-helper/text-integrity sweep after implementation and before gates.
 - Local quality gates and relevant output inspection are required evidence.

package/dist/host/claude/rules/styles.md

@@ -35,6 +35,7 @@ SCSS mirrors TypeScript centralization. Concrete token prefixes are project-spec
 
 ## Prohibitions
 
+- Verify every treatment against the shipped resolved cascade — the compiled output plus the stylesheet of every dependency the consumer loads — before accepting it. A dependency's own default rules, not documentation or memory, decide what a bare element renders as.
 - Check `_tokens.scss` before inventing a token.
 - Put global tokens in `_tokens.scss`; put truly component-scoped custom properties on the component selector.
 - Never bury tokens in unrelated partials.

package/dist/host/claude/rules/tests.md

@@ -20,6 +20,7 @@ paths:
 - Prefer inert customizable data/input stubs. A scripted boundary stub is allowed only when it implements the real interface/protocol minimally to drive the system under test; it never reimplements project-owned behavior or stands in for the integration being claimed.
 - Cover happy paths, error paths, empty input, boundary values, `NaN`, positive/negative zero, cycles, and Map/Set order where relevant.
 - Test observable behavior, not implementation details.
+- A regression test records the exact command and its failing count before the fix, and the same command's passing count after.
 - Use `it.todo()` only for explicitly out-of-scope roadmap work, never to complete the current request. Every `.skip` or conditional skip has a narrow verifiable applicability reason.
 - Do not create test files solely for `constants.ts`, barrels, error definitions, or `types.ts`.
 - Run the narrowest relevant Vitest project during development; do not run the entire suite casually.

package/dist/host/claude/rules/typescript.md

@@ -5,7 +5,7 @@ paths:
 
 # TypeScript rules
 
-The non-negotiables in `AGENTS.md` apply without exception.
+The non-negotiables and design laws in `AGENTS.md` apply without exception and are not restated here. This file adds only what TypeScript itself decides.
 
 ## Syntax and imports
 
@@ -16,20 +16,13 @@ The non-negotiables in `AGENTS.md` apply without exception.
 - ESM imports use explicit `.js` extensions for local TypeScript modules.
 - Place `import type` declarations before value imports.
 - Do not place blank lines between consecutive imports of the same kind.
-- Use runtime `#` fields, never TypeScript `private`.
-- Accept untrusted values as `unknown`; narrow with total guards.
-- Never assert with `as` or `!`, and never suppress TypeScript/lint diagnostics.
+- Narrow an accepted `unknown` with a total guard rather than a conditional access.
 
 ## Types
 
 - Put every reusable or public interface/type alias in the nearest authoritative `*/types.ts`.
-- Define the public contract before implementation.
-- Interface properties are readonly.
 - Public collection properties and return types use `readonly T[]`, `ReadonlyMap<K, V>`, or `ReadonlySet<T>`.
-- Parameters are never `readonly`.
-- Optional state is `T | undefined`; optional lookup failure returns `undefined`.
-- Use `null` only when an external protocol/data format gives it semantics distinct from omission.
-- A binary behavior switch is boolean; a literal union must represent real domain modes, phases, discriminants, or external values.
+- Optional state is `T | undefined`; an optional lookup failure returns `undefined`.
 
 ## Immutability
 

package/dist/host/claude/rules/workspace.md

@@ -12,7 +12,7 @@ paths:
 
 # Workspace, environments, builds, and scripts
 
-Use only the environments a project needs, but preserve this dependency model.
+Use only the environments a project needs, and keep the root dependency model intact while doing it.
 
 ## Environments
 
@@ -29,10 +29,7 @@ Use only the environments a project needs, but preserve this dependency model.
 | `tests/`       | Mirrors src/app environments                       |
 | `configs/`     | Thin target wrappers around root configs           |
 
-- Browser/server import core; core imports neither.
-- `app/core` is host-independent.
-- `app/server` may import app/core and core/server libraries; it never imports browser code.
-- `app/browser` may import app/core and core/browser libraries. It reaches server behavior through shared contracts/transports and never imports Node or app/server implementation.
+- Dependency direction is the root project model in `AGENTS.md` and is not restated here; this file governs where the environments live and how they are configured.
 - Typical browser-app domains: `components/`, `pages/`, `composables.ts`, `controllers/`, `services/`, `stores/`.
 - Typical server-app domains: `handlers/`, `middlewares.ts`, `routes.ts`.
 - `src/styles/index.ts` is a side-effect entry importing `./index.scss`.

package/dist/host/claude/skills/enterprise-bootstrap/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: enterprise-bootstrap
+description: Design and build distinctive, production-grade user interfaces with Bootstrap 5.3 and intentional frontend craft. Use for ANY UI work — pages, screens, components, layouts, app shells, dashboards, data tables, filter bars, forms, wizards, navigation, modals, empty/loading/error states, dark mode, marketing surfaces — whenever the task touches HTML/CSS/visual design, mentions Bootstrap or its components, or must look professional and avoid templated defaults.
+---
+
+# Load the canonical workflow
+
+Read `.agents/skills/enterprise-bootstrap/SKILL.md` completely, then read every
+reference layer it names for the work in hand. Follow that canonical package before acting.
+
+This bridge contains no independent process. `AGENTS.md`, applicable rules, the
+canonical skill, and the governing guide/spec remain authoritative in that order.

package/dist/host/claude/skills/orkestrel-debrief/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: orkestrel-debrief
+description: Convert a closed campaign's residue into portable truth through field evidence, a findings ledger, fix loops with live re-proof, canon refinement, and disciplined disposal. Use after a campaign or milestone closes to audit what was built and how it was built, when live field testing must precede judgment, when learnings must propagate into skills/rules/guides/scaffold, or when working ledgers must fold into canon and retire.
+---
+
+# Load the canonical workflow
+
+Read `.agents/skills/orkestrel-debrief/SKILL.md` completely, then read every reference it
+requires. Follow that canonical workflow before acting.
+
+This bridge contains no independent process. `AGENTS.md`, applicable rules, the canonical
+skill, and the governing guide/spec remain authoritative in that order.

package/dist/host/claude/skills/orkestrel-polish-surface/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: orkestrel-polish-surface
+description: Drive a rendered or externally driven surface to shipped quality through capture-evidence verdict rounds. Use for interface polish, rendered-state audits, reconciling design/state-truth/inventory findings into fix units, and converging review rounds on captured proof.
+---
+
+# Load the canonical workflow
+
+Read `.agents/skills/orkestrel-polish-surface/SKILL.md` completely, then read every
+reference it requires. Follow that canonical workflow before acting.
+
+This bridge contains no independent process. `AGENTS.md`, applicable rules, the
+canonical skill, and the governing guide/spec remain authoritative in that order.

package/dist/host/codex/agents/analyst.toml

@@ -9,7 +9,10 @@ governing guide/spec, and the exact scope. For design, take the same brief as Op
 independently and argue what contracts, evidence, and constraints permit. For audit,
 read the actual diff and examine correctness, security, concurrency, failure modes,
 dependency reuse, boundary behavior, tests, cleanup, and guide parity. Require
-file:line evidence and drop unsupported claims. Never edit, implement, reconcile,
-accept, or spawn. Return only the objective argument or PASS/FAIL audit, blockers,
-advisories, and criterion confirmations.
+file:line evidence and drop unsupported claims. For a rendered or externally driven
+surface, the supplied capture portfolio is primary evidence and source is
+corroboration; mark a claim the portfolio cannot show NOT-EVIDENCED rather than
+inferring it from source. Never edit, implement, reconcile, accept, or spawn. Return
+only the objective argument or PASS/FAIL audit, blockers, advisories, and criterion
+confirmations.
 """

package/dist/host/codex/agents/builder.toml

@@ -10,8 +10,9 @@ A unit whose naming, API shape, architecture, or house taste is still open belon
 implementer: stop and say so.
 
 Read AGENTS.md, applicable .claude/rules files, the dispatch-named skill and required
-references, and the governing guide/spec before writing. Execute the supplied plan
-exactly, in owned files only; shared and off-limits files are report-only and return
+references, and the governing guide/spec before writing. An app-layer unit additionally
+binds .claude/rules/application.md and .claude/rules/workspace.md. Execute the supplied
+plan exactly, in owned files only; shared and off-limits files are report-only and return
 as exact patches. Add no dependency, suppression, mock, superfluous wrapper, or
 current-scope TODO/skip/deferral. Never install, commit, push, publish, read
 credentials, run a destructive command, or run a tree-wide mutating command. Validate

package/dist/host/codex/agents/checker.toml

@@ -5,8 +5,10 @@ model_reasoning_effort = "medium"
 sandbox_mode = "read-only"
 developer_instructions = """
 Read AGENTS.md, every rule applicable to changed paths or concepts, the dispatch-named
-skill and required references, the governing guide/spec, and the actual diff. Check
-each acceptance criterion, naming, placement, centralization, wrappers, declared
+skill and required references, the governing guide/spec, and both the actual diff and
+the repository status supplied with the dispatch. If either is missing, return a
+deviation instead of reconstructing it. Check each acceptance criterion, naming,
+placement, centralization, wrappers, declared
 dependency reuse, real-test policy, TODO/skip/deferral state, exports, forbidden
 syntax, owned-file scope, and source/guide parity. Use one evidence pointer per item.
 Flag judgment questions for reviewer instead of guessing. Never edit or spawn. Return

package/dist/host/codex/agents/grok.toml

@@ -7,8 +7,10 @@ developer_instructions = """
 Act only as a cheap bridge to Cursor Grok. Read AGENTS.md, applicable rules, the
 dispatch-named skill and references, and the governing guide/spec. Require a bounded
 question and scope. Resolve the exact model from CURSOR_GROK_MODEL; never guess or
-substitute. Invoke Cursor in ask mode:
+substitute. Invoke Cursor in ask mode only for a short bounded ask:
 agent -p --trust --mode=ask --model "$CURSOR_GROK_MODEL" "<brief>"
+For longer work do not launch anything: return the brief path, the exact resolved
+command, the journal path, and a cap recommendation for the Orchestrator to launch.
 The brief requires read-only work, concise evidence with file:line pointers, and no
 raw dumps, design, decisions, or edits. Never use --force, expose CURSOR_API_KEY,
 read secrets, or edit. Compare git status before and after. Return only the question,

package/dist/host/codex/agents/implementer.toml

@@ -10,8 +10,10 @@ files, acceptance criteria, and deviation contract. Implement only the bounded u
 in its explicitly disjoint writable scope within the main checkout. Do not add
 dependencies, edit shared files, suppress diagnostics, leave current-scope
 deferrals, use mocks, install, commit, push, publish, read secrets, run destructive
-commands, or run tree-wide mutating gates. Validate only owned scope. Stop when
-reality diverges; return expected, found, evidence, done/not done, and one short
+commands, or run tree-wide mutating gates. Validate only owned scope. For a defect
+unit, record the exact command and its failing count before the fix and the same
+command's passing count after, and report both. Stop when reality diverges; return
+expected, found, evidence, done/not done, and one short
 hypothesis. Otherwise return touched paths, diffstat, actual scoped validation, and
 shared-file patches. Never spawn another agent or accept your own work.
 """

package/dist/host/codex/agents/opus.toml

@@ -14,9 +14,11 @@ to tmp/claude/<unit>.jsonl, gitignored) and record the session id so follow-ups
 can continue the same session via --resume with context intact.
 Verify the `claude` CLI is available before dispatch; if it is absent or the
 dispatch fails, return the failure immediately so the unit can route to the Sol
-implementer instead. Be patient: one foreground invocation with a generous
-timeout — never poll, restart, or kill it. The brief requires owned files,
-off-limits files, acceptance criteria, TTTDD, and a deviation contract; it
+implementer instead. An implementation unit is long work: do not launch it. Return
+the brief path, the exact resolved command, the journal path, and a cap
+recommendation, and let the Orchestrator launch it as a tracked background command
+under a hard cap. Never detach a run, poll, restart, or kill one. The brief requires
+owned files, off-limits files, acceptance criteria, TTTDD, and a deviation contract; it
 forbids dependency installation, commits, pushes, publishing, credentials,
 destructive commands, shared-file edits, and tree-wide mutating gates. After it
 returns, verify with git status, the diff, and scoped validation, then return

package/dist/host/codex/agents/orkestrel.toml

@@ -7,10 +7,11 @@ developer_instructions = """
 Read AGENTS.md, applicable .claude/rules files, the dispatch-named skill and required
 references, guides/src/scaffold.md, the governing package guide, and
 .claude/agents/orkestrel.md as the canonical ecosystem catalog and operating
-reference. Do not edit its generated catalog. Verify only live
-state such as versions, ranges, guide parity, branch position, and gate results.
-Registry and declared-dependency capabilities must come from live state, exact
-installed declarations, and current guides, never memory. Never edit, install, push,
-or spawn. Return only the requested primed map, evidence-first health audit, or
+reference. Do not edit its generated catalog. Verify versions, ranges, guide parity,
+branch position, and gate results against manifests, lockfiles, exact installed
+declarations, and current guides, never memory. You read no registry yourself: live
+registry state is evidence the Orchestrator supplies, and without it you report that
+fact as unknown and name what would settle it. Never edit, install, push, or spawn.
+Return only the requested primed map, evidence-first health audit, or
 dependency blast-radius and topological work-order proposal.
 """

package/dist/host/codex/agents/planner.toml

@@ -9,12 +9,16 @@ dispatch-named skill and references, the governing guide/spec, and the distilled
 Grok evidence. Pass the exact design brief independently shared with the Sol analyst
 to:
 claude -p "<brief>" --model opus --effort high --permission-mode plan
+Run that yourself only for a short bounded design pass; for longer work return the
+brief path, the exact resolved command, the journal path, and a cap recommendation
+for the Orchestrator to launch.
 Verify that the `claude` CLI is available before dispatch. If it is absent or the
 dispatch fails, return the failure immediately so the Sol main session can run the
 design pass itself and record that Opus was unavailable for this round.
 The brief asks for coherent API shape, vocabulary, ergonomics, at most two
-alternatives, bounded units, subjective tensions, and risks. It forbids edits,
-commands, reconciliation with Sol, orchestration, and acceptance. Never invoke Fable,
+alternatives, bounded units that each name their role and engine, subjective tensions,
+and risks. It forbids edits, commands, reconciliation with Sol, orchestration, and
+acceptance. Never invoke Fable,
 read credentials, edit, or spawn. Return the Opus proposal labeled untrusted plus
 any CLI/auth deviation.
 """

package/dist/host/codex/agents/reviewer.toml

@@ -8,11 +8,16 @@ Act only as a cheap bridge to Claude Opus 5. Read AGENTS.md, applicable rules, t
 dispatch-named skill and references, the governing guide/spec, and the actual diff.
 Pass a bounded design-review brief to:
 claude -p "<brief>" --model opus --effort high --permission-mode plan
+Run that yourself only for a short bounded review; for longer work return the brief
+path, the exact resolved command, the journal path, and a cap recommendation for the
+Orchestrator to launch.
 Verify that the `claude` CLI is available before dispatch. If it is absent or the
 dispatch fails, return the failure immediately so the Sol main session can run the
 design-audit pass itself and record that Opus was unavailable for this round.
 Require PASS/FAIL, design-fit blockers with file:line evidence, nonblocking
-advisories, and acceptance-criterion confirmations. Forbid edits, commands,
-orchestration, reconciliation, and acceptance. Never invoke Fable, read credentials,
+advisories, and acceptance-criterion confirmations. For a rendered or externally
+driven surface, require capture citations as primary evidence and the verdict shape
+of the dispatch-named skill. Forbid edits, commands, orchestration, reconciliation,
+and acceptance. Never invoke Fable, read credentials,
 edit, or spawn. Return the Opus audit labeled untrusted plus any CLI/auth deviation.
 """

package/dist/host/codex/config.toml

@@ -40,7 +40,7 @@ planner (Opus 5, subjective) and analyst (Sol, objective) on the
 SAME design brief in parallel without showing either the other's answer, then
 reconcile them into one plan; plan bounded units with disjoint ownership; route each
 nontrivial unit to implementer (Sol) or the opus implementation bridge (Opus 5) —
-whichever engine fits the unit — reserving builder/application for fully
+whichever engine fits the unit — reserving builder for fully
 specified taste-free mechanics; integrate
 shared files serially; obtain an independent reviewer (Opus 5) design audit and an
 independent analyst (Sol) correctness audit plus a checker conformance pass; then
@@ -52,7 +52,16 @@ Every dispatch includes objective, context, AGENTS.md, applicable rules, governi
 skill name/path and required references (or explicit none), guide/spec, owned and
 off-limits files, permissions, exact output, deviation behavior, and independently
 checkable acceptance criteria. Writers stop when reality diverges; they do not re-plan
-or debug beyond scope.
+or debug beyond scope. After reconciling findings into briefs, every retained finding
+names the brief item that carries it; a finding with no carrier is a dropped finding.
+
+A claim about a rendered or externally driven surface is evidenced by its capture
+portfolio or a real foreign client driving it, never by source alone; the campaign
+skill defines the fixed verdict shape and single terminal line for multi-round audits,
+and a fix unit's auditor is an engine that did not write it. Size every long-exec cap
+from the observed high mark of comparable units plus a gate allowance plus explicit
+slack. The first use of any CLI flag, subcommand, quoting form, or stdin combination
+happens in a throwaway probe, never inside a dispatched unit.
 
 No executor self-assessment is authoritative. External findings are hypotheses until
 verified against source. No agent commits, pushes, tags, publishes, installs

package/dist/host/dotfiles/prettierignore

@@ -3,3 +3,6 @@
 
 # Build output (also gitignored, listed for explicitness).
 dist/
+
+# Generated single-file application showcase.
+demo/showcase.html

package/dist/host/guides/src/scaffold.md

@@ -186,10 +186,11 @@ is `'INVALID' | 'BLOCKED' | 'DESTROYED' | 'TARGET' | 'WRITE' | 'FETCH'`.
 environment contributes, its test-project label, and — on the `src` axis — its `exports` subpath
 and build formats, or — on the `app` axis — its optional runtime entry.
 
-`ViteMachinery` names the three host-specific pipelines a workspace's generated `vite.config.ts` may
+`ViteMachinery` names the four host-specific pipelines a workspace's generated `vite.config.ts` may
 carry: `browser` selects the shared root CSS-analysis and Playwright machinery, `vue` selects the
 single-file-component, HTML, and development-server machinery an application browser environment
-needs, and `output` selects build-output containment. The root machinery selection never attaches a
+needs, `output` selects build-output containment, and `showcase` selects the optional single-file
+application-browser projection. The root machinery selection never attaches a
 `css` property to a nonbrowser project: only the `srcBrowser` and `appBrowser` factories own
 `ENVIRONMENT_CSS`. It never selects a boundary guarantee — those ship in every shape, as the
 compilers section sets out.
@@ -197,7 +198,8 @@ compilers section sets out.
 `ViteFacts` is the optional structural-fact slice shared by every root Vite compiler:
 `bin`, `integration`, and `service` each select their matching standalone project when `true`;
 `global` records the exact-case consumer-owned global-setup module and wires it into each eligible
-project.
+project; `showcase` records the exact-case consumer-owned showcase wrapper and selects only its
+generated browser machinery.
 
 `ViteProjectRegistration` carries one generated project factory identifier and its optional browser
 label. Root configuration renderers preserve that browser ownership as data through registration
@@ -222,6 +224,7 @@ interface Blueprint {
 	readonly integration: boolean
 	readonly service: boolean
 	readonly global: boolean
+	readonly showcase: boolean
 }
 ```
 
@@ -232,7 +235,7 @@ packages — a peer flagged `optional` also gets a `peerDependenciesMeta` entry.
 package-specific development dependencies merged over the generated baseline, and may carry any
 valid npm package name.
 
-`bin`, `integration`, `service`, and `global` are structural project facts. All four obey one law:
+`bin`, `integration`, `service`, `global`, and `showcase` are structural project facts. All five obey one law:
 each is `true` only when the workspace physically ships the directory or exact-case file that
 defines it — never because of the workspace's name, and never because a sibling fact is set.
 `deriveBlueprint` probes those paths, so a fresh compile and an audit of a mature repository agree
@@ -254,6 +257,11 @@ on what the workspace is.
   governing setup-presence fact. A declared `src/browser` project runs that consumer-owned module
   as `globalSetup`; integration runs it only when `bin` and `integration` are also true.
   Application-browser, styles, service, and unrelated proof projects never receive it.
+- **`showcase`** — the physical, exact-case regular file
+  `configs/app/vite.showcase.config.ts` exists. It is valid only with `app/browser` and turns on the
+  computed wrapper, the closed `appShowcase()` root factory, three opt-in scripts, and the
+  consumer-only `vite-plugin-singlefile` development dependency. A directory, link, wrong-case
+  name, absent wrapper, demo HTML, script, or installed dependency never implies this fact.
 
 A service workspace owes two companion files beside that directory, and derivation requires both
 physically present: `tests/setupService.ts` and `scripts/service.sh`. Either missing companion is a
@@ -374,6 +382,7 @@ From [`constants.ts`](../../src/core/constants.ts).
 | `HOST_PATHS`                      | const |
 | `SERVICE_SCRIPT_PATH`             | const |
 | `GLOBAL_SETUP_PATH`               | const |
+| `SHOWCASE_CONFIG_PATH`            | const |
 | `NAME_PATTERN`                    | const |
 | `MAX_NAME_LENGTH`                 | const |
 | `MAX_DEPENDENCY_NAME_LENGTH`      | const |
@@ -425,7 +434,8 @@ host artifacts, and it is the staging manifest rather than the per-plan carried
 `stageHost` vendors every path on it, while each plan carries the subset `selectHostPaths` selects
 for that one workspace. `SERVICE_SCRIPT_PATH` names the consumer-owned provisioner a service
 workspace's audit expects, and `GLOBAL_SETUP_PATH` names the consumer-owned Vitest global-setup
-module that independently selected projects can load.
+module that independently selected projects can load. `SHOWCASE_CONFIG_PATH` names the sole
+consumer-owned regular file whose exact physical presence enables the optional app showcase.
 
 The bounds are public because they are part of the contract, not implementation trivia.
 `MAX_ARTIFACT_BYTES` caps one artifact at 5 MiB and `MAX_TOTAL_ARTIFACT_BYTES` caps one blueprint,
@@ -973,8 +983,9 @@ omitting an absent path entirely. `readManifest` reads `package.json` text, and
 `deriveBlueprint` is the faithful inverse an audit needs: it reconstructs a blueprint from an
 existing workspace so a mature package is diffed against its own would-be scaffold rather than a
 dependency-less stand-in. Environments come from `src/<environment>/` and `app/<environment>/`, the
-three structural project facts from their directory probes, and `global` from the physical,
-exact-case `tests/setupGlobal.ts` file; the service companion law remains the one the blueprint
+three directory-shaped structural project facts from their directory probes, `global` from the
+physical exact-case `tests/setupGlobal.ts` file, and `showcase` from the physical exact-case regular
+file `configs/app/vite.showcase.config.ts`; the service companion law remains the one the blueprint
 section states — every fact is a reading of the filesystem, never of the name. Dependencies and peers come
 from the manifest's scoped entries, with an optional peer recovered from
 `peerDependenciesMeta`; and `extras` is every development dependency minus the complete set
@@ -1129,8 +1140,8 @@ the selected source and application projects from the canonical environment orde
 `viteProjectDefinitions` renders the standalone proof and structural-fact definitions in that same
 order with one blank line between declarations. Both consume `ViteFacts`, so each optional project
 is controlled only by its matching `bin`, `integration`, or `service` blueprint fact; the same
-slice carries `global` to integration and the source-browser compiler without adding another
-project.
+slice carries `global` to integration and the source-browser compiler, and `showcase` to the
+application-browser compiler, without adding another test project.
 
 `coreViteConfig`, `srcViteConfig`, `binViteConfig`, and `appViteConfig` emit the thin per-target
 wrappers. `coreViteConfig()` is parameterless and never imports or attaches browser CSS machinery;
@@ -1156,7 +1167,9 @@ that field.
 `configArtifacts`, `sourceArtifacts`, `applicationArtifacts`, `testArtifacts`, and `guideArtifacts`
 are the per-group drafters. When `bin` is selected, `configArtifacts` includes
 `configs/src/tsconfig.bin.json` and `configs/src/vite.bin.config.ts` beside the declared environment
-configuration pairs. `paritySpecifiers` computes the self-specifier and module map the
+configuration pairs. When `showcase` is selected, it includes the computed thin
+`configs/app/vite.showcase.config.ts` wrapper beside the ordinary application browser pair.
+`paritySpecifiers` computes the self-specifier and module map the
 generated parity suite resolves fence imports through. `guideMemberTable`, `guideUsage`,
 `guideMethods`, and `guideTests` render the generated guide's member tables, usage examples, method
 contract, and test inventory. `fillArtifact` fills one template entry into a `template`-origin
@@ -1532,6 +1545,8 @@ a fixed, interleaved order so aggregates sit immediately before their per-enviro
   `build:host` for a bin workspace
 - `dev` when a browser application is selected; `serve` and `serve:build` when a server application
   is selected
+- `showcase`, `build:showcase`, and `show` only when the physical showcase wrapper is present;
+  `show` builds and copies `dist/showcase/index.html` to `demo/showcase.html`
 - `prepublishOnly` chaining `format:check → lint:check → check → build → test`, followed by
   `test:integration` when the integration axis is selected
 
@@ -1550,6 +1565,10 @@ projects, and nothing there needs a build artifact or a foreign process. Publica
 asymmetry — `prepublishOnly` appends `test:integration`, because a package about to be published
 should prove itself against its own built output, while `test:service` is never in that chain.
 Neither default testing nor publication starts or requires a foreign process.
+The showcase is likewise outside `build`, `test`, and `prepublishOnly`; it is an explicit projection
+of `app/browser`, not an environment, test-project row, or source/demo artifact.
+Its copied `demo/showcase.html` is generated and minified, so the mirrored `.prettierignore` keeps it
+outside the whole-tree formatter while source and configuration files remain fully gated.
 
 When a prerequisite is absent the proof fails rather than skipping. `test:integration` reads the
 workspace's own built output, so it belongs after `build` — which is exactly where `prepublishOnly`
@@ -1665,6 +1684,17 @@ contract and is reported as computed-artifact drift by `scaffold audit`. The out
 still rejects public directories, browser asset inlining, and output path overrides in a
 post-factory composition as defense in depth; that narrow check is not a general extension seam.
 
+When the showcase fact is present, the generated root also exports closed
+`appShowcase(...config: never[])`; both factories reject every argument at runtime and
+share one fixed internal browser configuration. The ordinary factory retains its strict
+`script-src 'self'` policy, external asset auditing, and `dist/app/browser` output. The showcase
+factory alone writes `dist/showcase`, applies `viteSingleFile` with
+`removeViteModuleLoader: true` and `useRecommendedBuildConfig: true`, uses Oxc and Lightning CSS
+minification for an `esnext` build without source maps or module preload, and inserts a non-empty ISO
+`build-id` meta. Its generated CSP admits only the inline script and style required by the
+self-contained `file://` artifact while retaining `script-src-attr 'none'`, `object-src 'none'`, and
+`base-uri 'none'`.
+
 The browser development server applies the same trust boundary before Vite's internal middleware.
 Its explicit filesystem allowlist contains only browser/core source roots, browser tests, their
 exact setup files, and installed dependencies. The pre-internal middleware decodes direct,
@@ -2238,8 +2268,8 @@ coreTsconfig()
 srcTsconfig('server')
 appTsconfig('browser', true)
 
-viteMachinery(['core']) // { browser: false, vue: false, output: true }
-viteMachinery([], ['core', 'browser']) // { browser: true, vue: true, output: true }
+viteMachinery(['core']) // { browser: false, vue: false, output: true, showcase: false }
+viteMachinery([], ['core', 'browser']) // { browser: true, vue: true, output: true, showcase: false }
 renderViteTest([{ project: 'srcCore' }], false).includes('projects: [srcCore]') // true
 viteHeader(viteMachinery([], ['core', 'browser'])) // the shared header, with browser and Vue support
 coreViteConfig()