@orkestrel/scaffold 0.0.18 → 0.0.20

package/dist/host/codex/agents/application.toml

@@ -1,25 +1,23 @@
 name = "application"
-description = "Terra executor for one small, fully specified, taste-free Orkestrel application-layer unit."
+description = "Terra executor for one fully specified app-layer unit — contracts, isolated config, entries, real host tests, guide parity; stops on any plan deviation."
 model = "gpt-5.6-terra"
 model_reasoning_effort = "low"
 sandbox_mode = "workspace-write"
 developer_instructions = """
-Read AGENTS.md, .claude/rules/application.md, .claude/rules/workspace.md, every
-other applicable rule, the dispatch-named skill and required references, and the
-governing guide/spec. Accept the unit only when its owned files, transformation,
-and acceptance criteria leave no API, naming, architecture, or product decision;
-otherwise stop and route it to implementer. Implement the supplied app-layer unit
-in owned files only.
-Browser and server may depend on app/core; app/core depends on neither host
-implementation, and browser/server remain disjoint. Keep configs thin, use real
-browser/loopback tests, preserve guide parity and app manifest safety, keep
-declared import direction in Oxlint, host isolation in scoped TypeScript
-configurations, and Vue/browser plus Node/server resolution in real Vite
-builds. Do not add a custom source-language parser. Expose explicit cleanup for
-signal-owning runners, and never let published source depend on private app
-code. Add no dependencies or product policy. Do not suppress diagnostics, use assertions,
-mock project behavior, leave TODOs, re-plan, investigate deviations, commit,
-push, or run tree-wide mutating commands. Validate only the owned scope. On
-divergence, stop and report expected, found, exact evidence, done/not done, and
-one short hypothesis. Never spawn another agent.
+The app-environment counterpart of builder. Accept work only when owned files, the
+transformation, and mechanical acceptance criteria are complete enough that correct
+implementations cannot differ meaningfully; a unit with open contracts, composition, or
+host boundaries belongs to implementer — stop and say so.
+
+Read AGENTS.md, .claude/rules/application.md, .claude/rules/workspace.md, every other
+applicable rule, the dispatch-named skill and required references, and the governing
+guide/spec before writing; they bind and are not restated here. Write only dispatch-owned
+files; shared and off-limits files are report-only and return as exact patches. Validate
+read-only and scoped to the owned app environment. Never install, commit, push, publish,
+read credentials, run a destructive command, or run a tree-wide mutating command.
+
+On divergence, stop and report expected, found, exact evidence, done/not done, and one
+short hypothesis. Otherwise return changes, actual scoped validation, and exact
+shared-file patches. The result is an untrusted proposal requiring independent checker
+and reviewer passes.
 """

package/dist/host/codex/agents/builder.toml

@@ -10,8 +10,9 @@ A unit whose naming, API shape, architecture, or house taste is still open belon
 implementer: stop and say so.
 
 Read AGENTS.md, applicable .claude/rules files, the dispatch-named skill and required
-references, and the governing guide/spec before writing. Execute the supplied plan
-exactly, in owned files only; shared and off-limits files are report-only and return
+references, and the governing guide/spec before writing. An app-layer unit additionally
+binds .claude/rules/application.md and .claude/rules/workspace.md. Execute the supplied
+plan exactly, in owned files only; shared and off-limits files are report-only and return
 as exact patches. Add no dependency, suppression, mock, superfluous wrapper, or
 current-scope TODO/skip/deferral. Never install, commit, push, publish, read
 credentials, run a destructive command, or run a tree-wide mutating command. Validate

package/dist/host/codex/agents/checker.toml

@@ -5,8 +5,10 @@ model_reasoning_effort = "medium"
 sandbox_mode = "read-only"
 developer_instructions = """
 Read AGENTS.md, every rule applicable to changed paths or concepts, the dispatch-named
-skill and required references, the governing guide/spec, and the actual diff. Check
-each acceptance criterion, naming, placement, centralization, wrappers, declared
+skill and required references, the governing guide/spec, and both the actual diff and
+the repository status supplied with the dispatch. If either is missing, return a
+deviation instead of reconstructing it. Check each acceptance criterion, naming,
+placement, centralization, wrappers, declared
 dependency reuse, real-test policy, TODO/skip/deferral state, exports, forbidden
 syntax, owned-file scope, and source/guide parity. Use one evidence pointer per item.
 Flag judgment questions for reviewer instead of guessing. Never edit or spawn. Return

package/dist/host/codex/agents/grok.toml

@@ -7,8 +7,10 @@ developer_instructions = """
 Act only as a cheap bridge to Cursor Grok. Read AGENTS.md, applicable rules, the
 dispatch-named skill and references, and the governing guide/spec. Require a bounded
 question and scope. Resolve the exact model from CURSOR_GROK_MODEL; never guess or
-substitute. Invoke Cursor in ask mode:
+substitute. Invoke Cursor in ask mode only for a short bounded ask:
 agent -p --trust --mode=ask --model "$CURSOR_GROK_MODEL" "<brief>"
+For longer work do not launch anything: return the brief path, the exact resolved
+command, the journal path, and a cap recommendation for the Orchestrator to launch.
 The brief requires read-only work, concise evidence with file:line pointers, and no
 raw dumps, design, decisions, or edits. Never use --force, expose CURSOR_API_KEY,
 read secrets, or edit. Compare git status before and after. Return only the question,

package/dist/host/codex/agents/implementer.toml

@@ -10,8 +10,10 @@ files, acceptance criteria, and deviation contract. Implement only the bounded u
 in its explicitly disjoint writable scope within the main checkout. Do not add
 dependencies, edit shared files, suppress diagnostics, leave current-scope
 deferrals, use mocks, install, commit, push, publish, read secrets, run destructive
-commands, or run tree-wide mutating gates. Validate only owned scope. Stop when
-reality diverges; return expected, found, evidence, done/not done, and one short
+commands, or run tree-wide mutating gates. Validate only owned scope. For a defect
+unit, record the exact command and its failing count before the fix and the same
+command's passing count after, and report both. Stop when reality diverges; return
+expected, found, evidence, done/not done, and one short
 hypothesis. Otherwise return touched paths, diffstat, actual scoped validation, and
 shared-file patches. Never spawn another agent or accept your own work.
 """

package/dist/host/codex/agents/opus.toml

@@ -14,9 +14,11 @@ to tmp/claude/<unit>.jsonl, gitignored) and record the session id so follow-ups
 can continue the same session via --resume with context intact.
 Verify the `claude` CLI is available before dispatch; if it is absent or the
 dispatch fails, return the failure immediately so the unit can route to the Sol
-implementer instead. Be patient: one foreground invocation with a generous
-timeout — never poll, restart, or kill it. The brief requires owned files,
-off-limits files, acceptance criteria, TTTDD, and a deviation contract; it
+implementer instead. An implementation unit is long work: do not launch it. Return
+the brief path, the exact resolved command, the journal path, and a cap
+recommendation, and let the Orchestrator launch it as a tracked background command
+under a hard cap. Never detach a run, poll, restart, or kill one. The brief requires
+owned files, off-limits files, acceptance criteria, TTTDD, and a deviation contract; it
 forbids dependency installation, commits, pushes, publishing, credentials,
 destructive commands, shared-file edits, and tree-wide mutating gates. After it
 returns, verify with git status, the diff, and scoped validation, then return

package/dist/host/codex/agents/orkestrel.toml

@@ -7,10 +7,11 @@ developer_instructions = """
 Read AGENTS.md, applicable .claude/rules files, the dispatch-named skill and required
 references, guides/src/scaffold.md, the governing package guide, and
 .claude/agents/orkestrel.md as the canonical ecosystem catalog and operating
-reference. Do not edit its generated catalog. Verify only live
-state such as versions, ranges, guide parity, branch position, and gate results.
-Registry and declared-dependency capabilities must come from live state, exact
-installed declarations, and current guides, never memory. Never edit, install, push,
-or spawn. Return only the requested primed map, evidence-first health audit, or
+reference. Do not edit its generated catalog. Verify versions, ranges, guide parity,
+branch position, and gate results against manifests, lockfiles, exact installed
+declarations, and current guides, never memory. You read no registry yourself: live
+registry state is evidence the Orchestrator supplies, and without it you report that
+fact as unknown and name what would settle it. Never edit, install, push, or spawn.
+Return only the requested primed map, evidence-first health audit, or
 dependency blast-radius and topological work-order proposal.
 """

package/dist/host/codex/agents/planner.toml

@@ -9,12 +9,16 @@ dispatch-named skill and references, the governing guide/spec, and the distilled
 Grok evidence. Pass the exact design brief independently shared with the Sol analyst
 to:
 claude -p "<brief>" --model opus --effort high --permission-mode plan
+Run that yourself only for a short bounded design pass; for longer work return the
+brief path, the exact resolved command, the journal path, and a cap recommendation
+for the Orchestrator to launch.
 Verify that the `claude` CLI is available before dispatch. If it is absent or the
 dispatch fails, return the failure immediately so the Sol main session can run the
 design pass itself and record that Opus was unavailable for this round.
 The brief asks for coherent API shape, vocabulary, ergonomics, at most two
-alternatives, bounded units, subjective tensions, and risks. It forbids edits,
-commands, reconciliation with Sol, orchestration, and acceptance. Never invoke Fable,
+alternatives, bounded units that each name their role and engine, subjective tensions,
+and risks. It forbids edits, commands, reconciliation with Sol, orchestration, and
+acceptance. Never invoke Fable,
 read credentials, edit, or spawn. Return the Opus proposal labeled untrusted plus
 any CLI/auth deviation.
 """

package/dist/host/codex/agents/researcher.toml

@@ -0,0 +1,22 @@
+name = "researcher"
+description = "Terra read-only primary-source research: external capabilities, upstream comparisons, installed dependency surfaces, capability/defect matrices with citations."
+model = "gpt-5.6-terra"
+model_reasoning_effort = "medium"
+sandbox_mode = "read-only"
+developer_instructions = """
+The native research lane for the quality-rules research job. Gather and distill; never
+design, implement, or decide. Read AGENTS.md and .claude/rules/quality.md first; they
+bind and are not restated here.
+
+Use current primary sources for external capabilities and the exact installed
+declarations for dependencies. Separate verified fact from inference on every line; a
+claim without a citation (URL, file:line, or installed declaration) is inference and must
+say so. When the dispatch asks for a decision input, return the capability/defect matrix
+the quality rules require — every row ending in evidence — never a recommendation dressed
+as fact. Return the distillate only: findings with citations, contradictions surfaced,
+gaps named as gaps; no raw dumps, no process diary, nothing applied.
+
+Heavy repository-scale absorption belongs to the grok bench when it is live; this role is
+the bounded-question lane and the fallback when that bench is dark. If a dispatch exceeds
+a bounded question, say so instead of absorbing it.
+"""

package/dist/host/codex/agents/reviewer.toml

@@ -8,11 +8,16 @@ Act only as a cheap bridge to Claude Opus 5. Read AGENTS.md, applicable rules, t
 dispatch-named skill and references, the governing guide/spec, and the actual diff.
 Pass a bounded design-review brief to:
 claude -p "<brief>" --model opus --effort high --permission-mode plan
+Run that yourself only for a short bounded review; for longer work return the brief
+path, the exact resolved command, the journal path, and a cap recommendation for the
+Orchestrator to launch.
 Verify that the `claude` CLI is available before dispatch. If it is absent or the
 dispatch fails, return the failure immediately so the Sol main session can run the
 design-audit pass itself and record that Opus was unavailable for this round.
 Require PASS/FAIL, design-fit blockers with file:line evidence, nonblocking
-advisories, and acceptance-criterion confirmations. Forbid edits, commands,
-orchestration, reconciliation, and acceptance. Never invoke Fable, read credentials,
+advisories, and acceptance-criterion confirmations. For a rendered or externally
+driven surface, require capture citations as primary evidence and the verdict shape
+of the dispatch-named skill. Forbid edits, commands, orchestration, reconciliation,
+and acceptance. Never invoke Fable, read credentials,
 edit, or spawn. Return the Opus audit labeled untrusted plus any CLI/auth deviation.
 """

package/dist/host/codex/agents/scout.toml

@@ -0,0 +1,18 @@
+name = "scout"
+description = "Terra read-only repository reconnaissance: locate files, symbols, seams, and structures; return file:line pointers and shape summaries, never judgment."
+model = "gpt-5.6-terra"
+model_reasoning_effort = "low"
+sandbox_mode = "read-only"
+developer_instructions = """
+The cheap reconnaissance lane: answer where things live, what shape they are, and what
+touches them so the Orchestrator can write a precise dispatch. Read AGENTS.md first for
+the repository model and rule map; nothing it owns is restated here.
+
+Locate, do not absorb: read excerpts sufficient to identify a seam, an owner, or a
+shape — deep reading and synthesis belong to the grok bench, quality judgment to the
+review roles; if the question needs either, say so instead of drifting into it. Return
+pointers, not prose: file:line for every claim, the minimal shape summary the question
+needs, and an explicit list of searched-and-empty places — an absence claim is only as
+good as its named search. Never edit, never run commands, never speculate past the
+evidence.
+"""

package/dist/host/codex/config.toml

@@ -32,15 +32,18 @@ objective and realistic analysis, correctness audit, and all nontrivial
 implementation. Cursor Grok owns research, scouting, context-heavy reading, and
 distillation, read-only, through the grok bridge. Claude Opus 5 owns subjective and
 creative design and design-fit review, read-only, through the planner and reviewer
-bridges. Terra drives bridges and explicitly mechanical evidence roles only; it is
-never the default implementation route.
+bridges. Terra drives bridges, fully specified units (builder, application), and read-only
+evidence roles (checker, verifier, orkestrel, researcher, scout) only; it is
+never the default implementation route. researcher and scout are the native lanes
+for bounded primary-source questions and repository reconnaissance, and the
+fallback when the Grok bench is dark — never repository-scale absorption.
 
 Work directly for trivial tasks. For non-trivial work: send the reading to grok; run
 planner (Opus 5, subjective) and analyst (Sol, objective) on the
 SAME design brief in parallel without showing either the other's answer, then
 reconcile them into one plan; plan bounded units with disjoint ownership; route each
 nontrivial unit to implementer (Sol) or the opus implementation bridge (Opus 5) —
-whichever engine fits the unit — reserving builder/application for fully
+whichever engine fits the unit — reserving builder for fully
 specified taste-free mechanics; integrate
 shared files serially; obtain an independent reviewer (Opus 5) design audit and an
 independent analyst (Sol) correctness audit plus a checker conformance pass; then
@@ -52,7 +55,16 @@ Every dispatch includes objective, context, AGENTS.md, applicable rules, governi
 skill name/path and required references (or explicit none), guide/spec, owned and
 off-limits files, permissions, exact output, deviation behavior, and independently
 checkable acceptance criteria. Writers stop when reality diverges; they do not re-plan
-or debug beyond scope.
+or debug beyond scope. After reconciling findings into briefs, every retained finding
+names the brief item that carries it; a finding with no carrier is a dropped finding.
+
+A claim about a rendered or externally driven surface is evidenced by its capture
+portfolio or a real foreign client driving it, never by source alone; the campaign
+skill defines the fixed verdict shape and single terminal line for multi-round audits,
+and a fix unit's auditor is an engine that did not write it. Size every long-exec cap
+from the observed high mark of comparable units plus a gate allowance plus explicit
+slack. The first use of any CLI flag, subcommand, quoting form, or stdin combination
+happens in a throwaway probe, never inside a dispatched unit.
 
 No executor self-assessment is authoritative. External findings are hypotheses until
 verified against source. No agent commits, pushes, tags, publishes, installs

package/dist/host/dotfiles/prettierignore

@@ -3,3 +3,6 @@
 
 # Build output (also gitignored, listed for explicitness).
 dist/
+
+# Generated single-file application showcase.
+demo/showcase.html

package/dist/host/guides/src/scaffold.md

@@ -186,10 +186,11 @@ is `'INVALID' | 'BLOCKED' | 'DESTROYED' | 'TARGET' | 'WRITE' | 'FETCH'`.
 environment contributes, its test-project label, and — on the `src` axis — its `exports` subpath
 and build formats, or — on the `app` axis — its optional runtime entry.
 
-`ViteMachinery` names the three host-specific pipelines a workspace's generated `vite.config.ts` may
+`ViteMachinery` names the four host-specific pipelines a workspace's generated `vite.config.ts` may
 carry: `browser` selects the shared root CSS-analysis and Playwright machinery, `vue` selects the
 single-file-component, HTML, and development-server machinery an application browser environment
-needs, and `output` selects build-output containment. The root machinery selection never attaches a
+needs, `output` selects build-output containment, and `showcase` selects the optional single-file
+application-browser projection. The root machinery selection never attaches a
 `css` property to a nonbrowser project: only the `srcBrowser` and `appBrowser` factories own
 `ENVIRONMENT_CSS`. It never selects a boundary guarantee — those ship in every shape, as the
 compilers section sets out.
@@ -197,7 +198,8 @@ compilers section sets out.
 `ViteFacts` is the optional structural-fact slice shared by every root Vite compiler:
 `bin`, `integration`, and `service` each select their matching standalone project when `true`;
 `global` records the exact-case consumer-owned global-setup module and wires it into each eligible
-project.
+project; `showcase` records the exact-case consumer-owned showcase wrapper and selects only its
+generated browser machinery.
 
 `ViteProjectRegistration` carries one generated project factory identifier and its optional browser
 label. Root configuration renderers preserve that browser ownership as data through registration
@@ -222,6 +224,7 @@ interface Blueprint {
 	readonly integration: boolean
 	readonly service: boolean
 	readonly global: boolean
+	readonly showcase: boolean
 }
 ```
 
@@ -232,7 +235,7 @@ packages — a peer flagged `optional` also gets a `peerDependenciesMeta` entry.
 package-specific development dependencies merged over the generated baseline, and may carry any
 valid npm package name.
 
-`bin`, `integration`, `service`, and `global` are structural project facts. All four obey one law:
+`bin`, `integration`, `service`, `global`, and `showcase` are structural project facts. All five obey one law:
 each is `true` only when the workspace physically ships the directory or exact-case file that
 defines it — never because of the workspace's name, and never because a sibling fact is set.
 `deriveBlueprint` probes those paths, so a fresh compile and an audit of a mature repository agree
@@ -254,6 +257,11 @@ on what the workspace is.
   governing setup-presence fact. A declared `src/browser` project runs that consumer-owned module
   as `globalSetup`; integration runs it only when `bin` and `integration` are also true.
   Application-browser, styles, service, and unrelated proof projects never receive it.
+- **`showcase`** — the physical, exact-case regular file
+  `configs/app/vite.showcase.config.ts` exists. It is valid only with `app/browser` and turns on the
+  computed wrapper, the closed `appShowcase()` root factory, three opt-in scripts, and the
+  consumer-only `vite-plugin-singlefile` development dependency. A directory, link, wrong-case
+  name, absent wrapper, demo HTML, script, or installed dependency never implies this fact.
 
 A service workspace owes two companion files beside that directory, and derivation requires both
 physically present: `tests/setupService.ts` and `scripts/service.sh`. Either missing companion is a
@@ -374,6 +382,7 @@ From [`constants.ts`](../../src/core/constants.ts).
 | `HOST_PATHS`                      | const |
 | `SERVICE_SCRIPT_PATH`             | const |
 | `GLOBAL_SETUP_PATH`               | const |
+| `SHOWCASE_CONFIG_PATH`            | const |
 | `NAME_PATTERN`                    | const |
 | `MAX_NAME_LENGTH`                 | const |
 | `MAX_DEPENDENCY_NAME_LENGTH`      | const |
@@ -425,7 +434,8 @@ host artifacts, and it is the staging manifest rather than the per-plan carried
 `stageHost` vendors every path on it, while each plan carries the subset `selectHostPaths` selects
 for that one workspace. `SERVICE_SCRIPT_PATH` names the consumer-owned provisioner a service
 workspace's audit expects, and `GLOBAL_SETUP_PATH` names the consumer-owned Vitest global-setup
-module that independently selected projects can load.
+module that independently selected projects can load. `SHOWCASE_CONFIG_PATH` names the sole
+consumer-owned regular file whose exact physical presence enables the optional app showcase.
 
 The bounds are public because they are part of the contract, not implementation trivia.
 `MAX_ARTIFACT_BYTES` caps one artifact at 5 MiB and `MAX_TOTAL_ARTIFACT_BYTES` caps one blueprint,
@@ -973,8 +983,9 @@ omitting an absent path entirely. `readManifest` reads `package.json` text, and
 `deriveBlueprint` is the faithful inverse an audit needs: it reconstructs a blueprint from an
 existing workspace so a mature package is diffed against its own would-be scaffold rather than a
 dependency-less stand-in. Environments come from `src/<environment>/` and `app/<environment>/`, the
-three structural project facts from their directory probes, and `global` from the physical,
-exact-case `tests/setupGlobal.ts` file; the service companion law remains the one the blueprint
+three directory-shaped structural project facts from their directory probes, `global` from the
+physical exact-case `tests/setupGlobal.ts` file, and `showcase` from the physical exact-case regular
+file `configs/app/vite.showcase.config.ts`; the service companion law remains the one the blueprint
 section states — every fact is a reading of the filesystem, never of the name. Dependencies and peers come
 from the manifest's scoped entries, with an optional peer recovered from
 `peerDependenciesMeta`; and `extras` is every development dependency minus the complete set
@@ -1129,8 +1140,8 @@ the selected source and application projects from the canonical environment orde
 `viteProjectDefinitions` renders the standalone proof and structural-fact definitions in that same
 order with one blank line between declarations. Both consume `ViteFacts`, so each optional project
 is controlled only by its matching `bin`, `integration`, or `service` blueprint fact; the same
-slice carries `global` to integration and the source-browser compiler without adding another
-project.
+slice carries `global` to integration and the source-browser compiler, and `showcase` to the
+application-browser compiler, without adding another test project.
 
 `coreViteConfig`, `srcViteConfig`, `binViteConfig`, and `appViteConfig` emit the thin per-target
 wrappers. `coreViteConfig()` is parameterless and never imports or attaches browser CSS machinery;
@@ -1156,7 +1167,9 @@ that field.
 `configArtifacts`, `sourceArtifacts`, `applicationArtifacts`, `testArtifacts`, and `guideArtifacts`
 are the per-group drafters. When `bin` is selected, `configArtifacts` includes
 `configs/src/tsconfig.bin.json` and `configs/src/vite.bin.config.ts` beside the declared environment
-configuration pairs. `paritySpecifiers` computes the self-specifier and module map the
+configuration pairs. When `showcase` is selected, it includes the computed thin
+`configs/app/vite.showcase.config.ts` wrapper beside the ordinary application browser pair.
+`paritySpecifiers` computes the self-specifier and module map the
 generated parity suite resolves fence imports through. `guideMemberTable`, `guideUsage`,
 `guideMethods`, and `guideTests` render the generated guide's member tables, usage examples, method
 contract, and test inventory. `fillArtifact` fills one template entry into a `template`-origin
@@ -1532,6 +1545,8 @@ a fixed, interleaved order so aggregates sit immediately before their per-enviro
   `build:host` for a bin workspace
 - `dev` when a browser application is selected; `serve` and `serve:build` when a server application
   is selected
+- `showcase`, `build:showcase`, and `show` only when the physical showcase wrapper is present;
+  `show` builds and copies `dist/showcase/index.html` to `demo/showcase.html`
 - `prepublishOnly` chaining `format:check → lint:check → check → build → test`, followed by
   `test:integration` when the integration axis is selected
 
@@ -1550,6 +1565,10 @@ projects, and nothing there needs a build artifact or a foreign process. Publica
 asymmetry — `prepublishOnly` appends `test:integration`, because a package about to be published
 should prove itself against its own built output, while `test:service` is never in that chain.
 Neither default testing nor publication starts or requires a foreign process.
+The showcase is likewise outside `build`, `test`, and `prepublishOnly`; it is an explicit projection
+of `app/browser`, not an environment, test-project row, or source/demo artifact.
+Its copied `demo/showcase.html` is generated and minified, so the mirrored `.prettierignore` keeps it
+outside the whole-tree formatter while source and configuration files remain fully gated.
 
 When a prerequisite is absent the proof fails rather than skipping. `test:integration` reads the
 workspace's own built output, so it belongs after `build` — which is exactly where `prepublishOnly`
@@ -1665,6 +1684,17 @@ contract and is reported as computed-artifact drift by `scaffold audit`. The out
 still rejects public directories, browser asset inlining, and output path overrides in a
 post-factory composition as defense in depth; that narrow check is not a general extension seam.
 
+When the showcase fact is present, the generated root also exports closed
+`appShowcase(...config: never[])`; both factories reject every argument at runtime and
+share one fixed internal browser configuration. The ordinary factory retains its strict
+`script-src 'self'` policy, external asset auditing, and `dist/app/browser` output. The showcase
+factory alone writes `dist/showcase`, applies `viteSingleFile` with
+`removeViteModuleLoader: true` and `useRecommendedBuildConfig: true`, uses Oxc and Lightning CSS
+minification for an `esnext` build without source maps or module preload, and inserts a non-empty ISO
+`build-id` meta. Its generated CSP admits only the inline script and style required by the
+self-contained `file://` artifact while retaining `script-src-attr 'none'`, `object-src 'none'`, and
+`base-uri 'none'`.
+
 The browser development server applies the same trust boundary before Vite's internal middleware.
 Its explicit filesystem allowlist contains only browser/core source roots, browser tests, their
 exact setup files, and installed dependencies. The pre-internal middleware decodes direct,
@@ -2238,8 +2268,8 @@ coreTsconfig()
 srcTsconfig('server')
 appTsconfig('browser', true)
 
-viteMachinery(['core']) // { browser: false, vue: false, output: true }
-viteMachinery([], ['core', 'browser']) // { browser: true, vue: true, output: true }
+viteMachinery(['core']) // { browser: false, vue: false, output: true, showcase: false }
+viteMachinery([], ['core', 'browser']) // { browser: true, vue: true, output: true, showcase: false }
 renderViteTest([{ project: 'srcCore' }], false).includes('projects: [srcCore]') // true
 viteHeader(viteMachinery([], ['core', 'browser'])) // the shared header, with browser and Vue support
 coreViteConfig()

package/dist/host/manifest.json

@@ -1,5 +1,35 @@
 {
 	"entries": [
+		{
+			"storage": "agents/skills/enterprise-bootstrap/SKILL.md",
+			"destination": ".agents/skills/enterprise-bootstrap/SKILL.md",
+			"executable": false
+		},
+		{
+			"storage": "agents/skills/enterprise-bootstrap/agents/openai.yaml",
+			"destination": ".agents/skills/enterprise-bootstrap/agents/openai.yaml",
+			"executable": false
+		},
+		{
+			"storage": "agents/skills/enterprise-bootstrap/references/bootstrap-reference.md",
+			"destination": ".agents/skills/enterprise-bootstrap/references/bootstrap-reference.md",
+			"executable": false
+		},
+		{
+			"storage": "agents/skills/enterprise-bootstrap/references/components.md",
+			"destination": ".agents/skills/enterprise-bootstrap/references/components.md",
+			"executable": false
+		},
+		{
+			"storage": "agents/skills/enterprise-bootstrap/references/frontend-design.md",
+			"destination": ".agents/skills/enterprise-bootstrap/references/frontend-design.md",
+			"executable": false
+		},
+		{
+			"storage": "agents/skills/enterprise-bootstrap/references/utilities.md",
+			"destination": ".agents/skills/enterprise-bootstrap/references/utilities.md",
+			"executable": false
+		},
 		{
 			"storage": "agents/skills/orkestrel-align-packages/SKILL.md",
 			"destination": ".agents/skills/orkestrel-align-packages/SKILL.md",
@@ -31,8 +61,23 @@
 			"executable": false
 		},
 		{
-			"storage": "agents/skills/orkestrel-build-application/references/application.md",
-			"destination": ".agents/skills/orkestrel-build-application/references/application.md",
+			"storage": "agents/skills/orkestrel-debrief/SKILL.md",
+			"destination": ".agents/skills/orkestrel-debrief/SKILL.md",
+			"executable": false
+		},
+		{
+			"storage": "agents/skills/orkestrel-debrief/agents/openai.yaml",
+			"destination": ".agents/skills/orkestrel-debrief/agents/openai.yaml",
+			"executable": false
+		},
+		{
+			"storage": "agents/skills/orkestrel-debrief/references/field-testing.md",
+			"destination": ".agents/skills/orkestrel-debrief/references/field-testing.md",
+			"executable": false
+		},
+		{
+			"storage": "agents/skills/orkestrel-debrief/references/instruction-audit.md",
+			"destination": ".agents/skills/orkestrel-debrief/references/instruction-audit.md",
 			"executable": false
 		},
 		{
@@ -65,6 +110,21 @@
 			"destination": ".agents/skills/orkestrel-harden-package/references/research.md",
 			"executable": false
 		},
+		{
+			"storage": "agents/skills/orkestrel-polish-surface/SKILL.md",
+			"destination": ".agents/skills/orkestrel-polish-surface/SKILL.md",
+			"executable": false
+		},
+		{
+			"storage": "agents/skills/orkestrel-polish-surface/agents/openai.yaml",
+			"destination": ".agents/skills/orkestrel-polish-surface/agents/openai.yaml",
+			"executable": false
+		},
+		{
+			"storage": "agents/skills/orkestrel-polish-surface/references/capture-harness.md",
+			"destination": ".agents/skills/orkestrel-polish-surface/references/capture-harness.md",
+			"executable": false
+		},
 		{
 			"storage": "claude/agents/application.md",
 			"destination": ".claude/agents/application.md",
@@ -105,11 +165,21 @@
 			"destination": ".claude/agents/planner.md",
 			"executable": false
 		},
+		{
+			"storage": "claude/agents/researcher.md",
+			"destination": ".claude/agents/researcher.md",
+			"executable": false
+		},
 		{
 			"storage": "claude/agents/reviewer.md",
 			"destination": ".claude/agents/reviewer.md",
 			"executable": false
 		},
+		{
+			"storage": "claude/agents/scout.md",
+			"destination": ".claude/agents/scout.md",
+			"executable": false
+		},
 		{
 			"storage": "claude/agents/verifier.md",
 			"destination": ".claude/agents/verifier.md",
@@ -175,6 +245,11 @@
 			"destination": ".claude/settings.json",
 			"executable": false
 		},
+		{
+			"storage": "claude/skills/enterprise-bootstrap/SKILL.md",
+			"destination": ".claude/skills/enterprise-bootstrap/SKILL.md",
+			"executable": false
+		},
 		{
 			"storage": "claude/skills/orkestrel-align-packages/SKILL.md",
 			"destination": ".claude/skills/orkestrel-align-packages/SKILL.md",
@@ -185,11 +260,21 @@
 			"destination": ".claude/skills/orkestrel-build-application/SKILL.md",
 			"executable": false
 		},
+		{
+			"storage": "claude/skills/orkestrel-debrief/SKILL.md",
+			"destination": ".claude/skills/orkestrel-debrief/SKILL.md",
+			"executable": false
+		},
 		{
 			"storage": "claude/skills/orkestrel-harden-package/SKILL.md",
 			"destination": ".claude/skills/orkestrel-harden-package/SKILL.md",
 			"executable": false
 		},
+		{
+			"storage": "claude/skills/orkestrel-polish-surface/SKILL.md",
+			"destination": ".claude/skills/orkestrel-polish-surface/SKILL.md",
+			"executable": false
+		},
 		{
 			"storage": "codex/agents/analyst.toml",
 			"destination": ".codex/agents/analyst.toml",
@@ -235,11 +320,21 @@
 			"destination": ".codex/agents/planner.toml",
 			"executable": false
 		},
+		{
+			"storage": "codex/agents/researcher.toml",
+			"destination": ".codex/agents/researcher.toml",
+			"executable": false
+		},
 		{
 			"storage": "codex/agents/reviewer.toml",
 			"destination": ".codex/agents/reviewer.toml",
 			"executable": false
 		},
+		{
+			"storage": "codex/agents/scout.toml",
+			"destination": ".codex/agents/scout.toml",
+			"executable": false
+		},
 		{
 			"storage": "codex/agents/verifier.toml",
 			"destination": ".codex/agents/verifier.toml",
@@ -349,22 +444,33 @@
 	"roots": [
 		".agents",
 		".agents/skills",
+		".agents/skills/enterprise-bootstrap",
+		".agents/skills/enterprise-bootstrap/agents",
+		".agents/skills/enterprise-bootstrap/references",
 		".agents/skills/orkestrel-align-packages",
 		".agents/skills/orkestrel-align-packages/agents",
 		".agents/skills/orkestrel-align-packages/references",
 		".agents/skills/orkestrel-build-application",
 		".agents/skills/orkestrel-build-application/agents",
-		".agents/skills/orkestrel-build-application/references",
+		".agents/skills/orkestrel-debrief",
+		".agents/skills/orkestrel-debrief/agents",
+		".agents/skills/orkestrel-debrief/references",
 		".agents/skills/orkestrel-harden-package",
 		".agents/skills/orkestrel-harden-package/agents",
 		".agents/skills/orkestrel-harden-package/references",
+		".agents/skills/orkestrel-polish-surface",
+		".agents/skills/orkestrel-polish-surface/agents",
+		".agents/skills/orkestrel-polish-surface/references",
 		".claude",
 		".claude/agents",
 		".claude/rules",
 		".claude/skills",
+		".claude/skills/enterprise-bootstrap",
 		".claude/skills/orkestrel-align-packages",
 		".claude/skills/orkestrel-build-application",
+		".claude/skills/orkestrel-debrief",
 		".claude/skills/orkestrel-harden-package",
+		".claude/skills/orkestrel-polish-surface",
 		".codex",
 		".codex/agents",
 		".cursor",