@orkestrel/scaffold 0.0.19 → 0.0.21

package/dist/host/codex/agents/application.toml

@@ -0,0 +1,23 @@
+name = "application"
+description = "Terra executor for one fully specified app-layer unit — contracts, isolated config, entries, real host tests, guide parity; stops on any plan deviation."
+model = "gpt-5.6-terra"
+model_reasoning_effort = "low"
+sandbox_mode = "workspace-write"
+developer_instructions = """
+The app-environment counterpart of builder. Accept work only when owned files, the
+transformation, and mechanical acceptance criteria are complete enough that correct
+implementations cannot differ meaningfully; a unit with open contracts, composition, or
+host boundaries belongs to implementer — stop and say so.
+
+Read AGENTS.md, .claude/rules/application.md, .claude/rules/workspace.md, every other
+applicable rule, the dispatch-named skill and required references, and the governing
+guide/spec before writing; they bind and are not restated here. Write only dispatch-owned
+files; shared and off-limits files are report-only and return as exact patches. Validate
+read-only and scoped to the owned app environment. Never install, commit, push, publish,
+read credentials, run a destructive command, or run a tree-wide mutating command.
+
+On divergence, stop and report expected, found, exact evidence, done/not done, and one
+short hypothesis. Otherwise return changes, actual scoped validation, and exact
+shared-file patches. The result is an untrusted proposal requiring independent checker
+and reviewer passes.
+"""

package/dist/host/codex/agents/researcher.toml

@@ -0,0 +1,22 @@
+name = "researcher"
+description = "Terra read-only primary-source research: external capabilities, upstream comparisons, installed dependency surfaces, capability/defect matrices with citations."
+model = "gpt-5.6-terra"
+model_reasoning_effort = "medium"
+sandbox_mode = "read-only"
+developer_instructions = """
+The native research lane for the quality-rules research job. Gather and distill; never
+design, implement, or decide. Read AGENTS.md and .claude/rules/quality.md first; they
+bind and are not restated here.
+
+Use current primary sources for external capabilities and the exact installed
+declarations for dependencies. Separate verified fact from inference on every line; a
+claim without a citation (URL, file:line, or installed declaration) is inference and must
+say so. When the dispatch asks for a decision input, return the capability/defect matrix
+the quality rules require — every row ending in evidence — never a recommendation dressed
+as fact. Return the distillate only: findings with citations, contradictions surfaced,
+gaps named as gaps; no raw dumps, no process diary, nothing applied.
+
+Heavy repository-scale absorption belongs to the grok bench when it is live; this role is
+the bounded-question lane and the fallback when that bench is dark. If a dispatch exceeds
+a bounded question, say so instead of absorbing it.
+"""

package/dist/host/codex/agents/reviewer.toml

@@ -15,7 +15,9 @@ Verify that the `claude` CLI is available before dispatch. If it is absent or th
 dispatch fails, return the failure immediately so the Sol main session can run the
 design-audit pass itself and record that Opus was unavailable for this round.
 Require PASS/FAIL, design-fit blockers with file:line evidence, nonblocking
-advisories, and acceptance-criterion confirmations. For a rendered or externally
+advisories, and acceptance-criterion confirmations. Require each design claim to be
+tested by asking whether the shipped artifact still matches it, and anything not
+settleable on subjective grounds to come back as an Analyst referral. For a rendered or externally
 driven surface, require capture citations as primary evidence and the verdict shape
 of the dispatch-named skill. Forbid edits, commands, orchestration, reconciliation,
 and acceptance. Never invoke Fable, read credentials,

package/dist/host/codex/agents/scout.toml

@@ -0,0 +1,18 @@
+name = "scout"
+description = "Terra read-only repository reconnaissance: locate files, symbols, seams, and structures; return file:line pointers and shape summaries, never judgment."
+model = "gpt-5.6-terra"
+model_reasoning_effort = "low"
+sandbox_mode = "read-only"
+developer_instructions = """
+The cheap reconnaissance lane: answer where things live, what shape they are, and what
+touches them so the Orchestrator can write a precise dispatch. Read AGENTS.md first for
+the repository model and rule map; nothing it owns is restated here.
+
+Locate, do not absorb: read excerpts sufficient to identify a seam, an owner, or a
+shape — deep reading and synthesis belong to the grok bench, quality judgment to the
+review roles; if the question needs either, say so instead of drifting into it. Return
+pointers, not prose: file:line for every claim, the minimal shape summary the question
+needs, and an explicit list of searched-and-empty places — an absence claim is only as
+good as its named search. Never edit, never run commands, never speculate past the
+evidence.
+"""

package/dist/host/codex/config.toml

@@ -32,8 +32,11 @@ objective and realistic analysis, correctness audit, and all nontrivial
 implementation. Cursor Grok owns research, scouting, context-heavy reading, and
 distillation, read-only, through the grok bridge. Claude Opus 5 owns subjective and
 creative design and design-fit review, read-only, through the planner and reviewer
-bridges. Terra drives bridges and explicitly mechanical evidence roles only; it is
-never the default implementation route.
+bridges. Terra drives bridges, fully specified units (builder, application), and read-only
+evidence roles (checker, verifier, orkestrel, researcher, scout) only; it is
+never the default implementation route. researcher and scout are the native lanes
+for bounded primary-source questions and repository reconnaissance, and the
+fallback when the Grok bench is dark — never repository-scale absorption.
 
 Work directly for trivial tasks. For non-trivial work: send the reading to grok; run
 planner (Opus 5, subjective) and analyst (Sol, objective) on the
@@ -50,10 +53,16 @@ concurrently.
 
 Every dispatch includes objective, context, AGENTS.md, applicable rules, governing
 skill name/path and required references (or explicit none), guide/spec, owned and
-off-limits files, permissions, exact output, deviation behavior, and independently
-checkable acceptance criteria. Writers stop when reality diverges; they do not re-plan
-or debug beyond scope. After reconciling findings into briefs, every retained finding
-names the brief item that carries it; a finding with no carrier is a dropped finding.
+off-limits files, permissions, exact output, deviation behavior, declared unknowns
+with how the unit reports them, the requirement that the executor spawns nothing,
+and independently checkable acceptance criteria. Every brief is a file under tmp/
+written before its unit launches, with the unit's report captured beside it; a
+re-run amends the brief in a successor file rather than restating it; both are
+swept at campaign acceptance, so anything that must outlive the campaign is
+promoted into a durable artifact first. Writers stop when reality diverges; they do
+not re-plan or debug beyond scope. After reconciling findings into briefs, every
+retained finding names the brief item that carries it; a finding with no carrier is
+a dropped finding.
 
 A claim about a rendered or externally driven surface is evidenced by its capture
 portfolio or a real foreign client driving it, never by source alone; the campaign

package/dist/host/guides/src/scaffold.md

@@ -67,11 +67,41 @@ than aspirational:
 - `app/browser` reaches server behavior only through shared `app/core` contracts and transports,
   never through a server implementation import.
 
-A generated `app/server` owns strict `APP_HOST`, `APP_PORT`, and `APP_START_TIMEOUT` parsing, a
-repeat-safe HTTP lifecycle, bounded connection behavior, and process signal cleanup. Its exported
+A generated `app/server` owns strict grouped `server.host`, `server.port`, and `server.timeout`
+options plus the `APP_HOST`, `APP_PORT`, and `APP_START_TIMEOUT` environment boundaries. It
+composes the installed router, server, and boundary/security/deadline middleware substrates around
+a fresh `GET /health` dispatcher from `createApplicationDispatcher`, supports repeated start/stop
+cycles and terminal destroy of both the server and its owned dispatcher, and writes exactly one
+`[READY] <name> <url>` diagnostic after process-owned readiness. The process runner owns an emitter
+whose `ApplicationServerRunnerEventMap` publishes `ready(url)` and `fail(error)`; initial
+`ApplicationServerRunnerOptions.on` hooks run before the runner's own announcement and reporting
+listeners; a synchronous fail hook sees an otherwise-unset `process.exitCode` as `undefined` before
+the default reporter sets it to `1`. Concurrent stops join one substrate shutdown. In-process tests park on those events,
+while child-process tests still observe the readiness line across the process boundary. Its exported
 `reportApplicationServerError` handler writes only a stable configuration, lifecycle, or unknown
-failure code; process-owned diagnostics never serialize a rejected value, nested cause, stack, or
-other error context.
+failure code; process-owned failures never serialize a rejected value, nested cause, stack,
+secret, or other error context. `ApplicationState` extends middleware's `IdentifierState` and adds
+only the connection fact. `ApplicationServer.url` is `undefined` until a real port is bound and
+again after stop or destroy; the redundant `listening` projection is not part of the generated
+interface. The runner narrows the post-start URL before writing `[READY]`, so it never announces a
+stale or unbound address, and it stops the server as part of failing that narrowing rather than
+leaving a bound listener without a shutdown owner. It also serializes every start and stop on one
+lifecycle queue, so a stop waits for the startup it aborted to settle before closing the server,
+and a restart issued during that shutdown is honoured after it rather than lost.
+
+The health contract belongs to whichever layer both hosts can reach. While the server alone reads
+it, `ApplicationRecord`, `APP_HEALTH_METHOD`, and `APP_HEALTH_PATH` stay declared in `app/server`.
+The moment a blueprint declares `app/browser` beside `app/server` — a combination that already
+requires `app/core` — those three declarations move to `app/core` and gain `APP_HEALTH_TIMEOUT`,
+the `isApplicationRecord` guard, and `readApplicationHealth`. That one asynchronous read is the
+whole browser/server boundary: it fetches the running server's health route, reads the body as
+`unknown`, narrows it with the shared guard, and returns the shared `Application` identity or
+`undefined` for an unreachable, slow, or off-contract answer. Nothing is duplicated by the move —
+`app/server` imports the relocated contract from `@app/core`, and `app/browser` still never imports
+a server module. The generated browser entry then mounts `mountBrowserApplication`, which performs
+that single read before mounting and falls back to the locally configured identity when the
+boundary yields `undefined`. A rejected mount reports the context-free
+`[ERROR] Browser application failed`, the browser twin of that server-side discipline.
 
 Every environment barrel is an export-star barrel: `index.ts` contains only `export * from './x.js'`
 rows and nothing else. Named, default, namespace, and type-only barrel rows are absent by design,
@@ -416,7 +446,9 @@ From [`constants.ts`](../../src/core/constants.ts).
 | `SCAFFOLD_RANGE`                  | const |
 | `BASE_DEV_DEPENDENCIES`           | const |
 | `SOURCE_BROWSER_DEV_DEPENDENCIES` | const |
+| `APP_DEV_DEPENDENCIES`            | const |
 | `APP_BROWSER_DEV_DEPENDENCIES`    | const |
+| `APP_SERVER_DEV_DEPENDENCIES`     | const |
 | `CHECKOUT_ACTION_SHA`             | const |
 | `SETUP_NODE_ACTION_SHA`           | const |
 | `COMPILER_ID`                     | const |
@@ -464,8 +496,11 @@ form. `HEX_PATTERN` requires whole lowercase byte pairs, and `SYNC_BASELINE_PATT
 `MINIMUM_NODE_VERSION` is `22.12.0`, `DEFAULT_ENGINES` derives from it, and `DEFAULT_VERSION` is
 `0.0.1`. `BASE_DEV_DEPENDENCIES` is the host-neutral tooling baseline every generated workspace
 gets; `SOURCE_BROWSER_DEV_DEPENDENCIES` adds the real browser providers a published browser environment
-needs, and `APP_BROWSER_DEV_DEPENDENCIES` extends that with the Vue toolchain a private browser
-application needs. Vite is minor-pinned at `~8.2.0`: the generated boundary consumes the reviewed
+needs; `APP_DEV_DEPENDENCIES` is the baseline every private application environment gets;
+`APP_BROWSER_DEV_DEPENDENCIES` adds the Vue toolchain and `@orkestrel/html` start-tag parser a
+private browser application needs;
+and `APP_SERVER_DEV_DEPENDENCIES` adds the emitter, middleware, router, and server packages a private
+server application needs. Vite is minor-pinned at `~8.2.0`: the generated boundary consumes the reviewed
 8.2 `CSSOptions`, `preprocessCSS`, and `isCSSRequest` surface, while the selected
 `css.transformer` / `lightningcss` path is experimental and must not float into an unreviewed minor.
 `SCAFFOLD_RANGE` is the range generated workspaces pin this package at.
@@ -788,6 +823,8 @@ From [`helpers.ts`](../../src/core/helpers.ts).
 | `pascalCase`                | function |
 | `escapeHtmlText`            | function |
 | `serializeTypeScriptString` | function |
+| `hasApplicationBoundary`    | function |
+| `hasApplicationShowcase`    | function |
 | `blueprintToMembers`        | function |
 | `catalogNames`              | function |
 | `alignTable`                | function |
@@ -824,6 +861,7 @@ From [`helpers.ts`](../../src/core/helpers.ts).
 | `renderArray`               | function |
 | `renderObject`              | function |
 | `renderValue`               | function |
+| `renderStringArray`         | function |
 | `formatJson`                | function |
 | `pinPlan`                   | function |
 
@@ -836,7 +874,9 @@ guard. `blueprint` fills the defaults: `version` and `engines` from their consta
 derives the entity name from a lowercase-hyphen package name, and `blueprintToMembers` derives the
 declared public `Member[]` — a full entity, options type, interface, and factory per published
 environment, plus the exact declaration inventory each selected application environment
-contributes.
+contributes. `hasApplicationBoundary` recognizes exactly app/core + app/browser + app/server,
+while `hasApplicationShowcase` requires showcase intent beside app/browser; plan assembly, tests,
+guides, and member inventory share those predicates.
 
 `escapeHtmlText` and `serializeTypeScriptString` are the two escaping leaves used when a
 caller-supplied name reaches generated HTML or generated TypeScript source; the latter preserves
@@ -888,7 +928,12 @@ id is already registered: an identical plan is idempotent, while a distinct payl
 `formatJson` and its leaves — `renderValue`,
 `renderArray`, `renderObject`, `computeColumnWidth`, and `fitsPrintWidth` — emit JSON that matches the fleet
 formatter byte for byte, collapsing a short array onto one line and breaking a long one, so
-computed configuration JSON is format-stable by construction.
+computed configuration JSON is format-stable by construction. `renderStringArray` applies the same
+inline-or-broken width rule to single-quoted TypeScript string-array literals — with a trailing
+comma on every broken line, matching `oxfmt`'s `trailingComma: "all"` for non-JSON files — so
+generated TypeScript configuration is format-stable too. It serializes every string element through
+`serializeTypeScriptString`, so quotes, backslashes, controls, and line separators remain inert in
+both layouts.
 
 ### Helpers — server
 
@@ -1049,6 +1094,7 @@ From [`compilers.ts`](../../src/core/compilers.ts).
 | `renderViteTest`           | function |
 | `viteHeader`               | function |
 | `policyViteProject`        | function |
+| `configViteProject`        | function |
 | `guidesViteProject`        | function |
 | `binViteProject`           | function |
 | `integrationViteProject`   | function |
@@ -1136,7 +1182,7 @@ formatter's 100-column fixed point: a complete registration-array line, includin
 its trailing comma, stays collapsed when it fits and expands one entry per line otherwise.
 `viteProjectRegistrations` is the one registration derivation every root shape consumes: it derives
 the selected source and application projects from the canonical environment order, then appends
-`policy`, `guides`, and the optional `srcBin`, `integration`, and `service` projects.
+`policy`, `config`, `guides`, and the optional `srcBin`, `integration`, and `service` projects.
 `viteProjectDefinitions` renders the standalone proof and structural-fact definitions in that same
 order with one blank line between declarations. Both consume `ViteFacts`, so each optional project
 is controlled only by its matching `bin`, `integration`, or `service` blueprint fact; the same
@@ -1149,8 +1195,9 @@ the root `srcCore` factory and its wrapper stay host-independent even when the w
 browser target. `binTsconfig` emits the executable declaration scope; `rootViteConfig`,
 `singleSrcViteConfig`, and `applicationViteConfig` emit the root configuration for a library-only,
 single non-core `src` environment, and application-bearing workspace respectively; and
-`policyViteProject`, `guidesViteProject`, `integrationViteProject`, and `serviceViteProject` emit
-the standalone Node proof projects, with `binViteProject` the single executable-project emitter. A
+`policyViteProject`, `configViteProject`, `guidesViteProject`, `integrationViteProject`, and
+`serviceViteProject` emit the standalone Node proof projects, with `binViteProject` the single
+executable-project emitter. A
 proof project is structurally derived from the directory holding its tests and never wraps a source
 or application environment project. The guides project therefore uses only `tests/setup.ts`, never
 `setupServer.ts`, `setupBrowser.ts`, or `setupService.ts`; and its `tests/src/**/*.test.ts` and
@@ -1540,13 +1587,13 @@ a fixed, interleaved order so aggregates sit immediately before their per-enviro
 - `format`, `format:check`, `lint:check`
 - `test`, then `test:src` and its per-environment scopes, the optional `test:integration`,
   `test:equivalence`, and `test:service` proofs, `test:app` and its per-environment scopes, then
-  `test:policy` and `test:guides`
+  `test:policy`, `test:config`, and `test:guides`
 - `build`, then `build:src` and its per-environment targets, `build:app` and its runtime targets, and
   `build:host` for a bin workspace
 - `dev` when a browser application is selected; `serve` and `serve:build` when a server application
   is selected
 - `showcase`, `build:showcase`, and `show` only when the physical showcase wrapper is present;
-  `show` builds and copies `dist/showcase/index.html` to `demo/showcase.html`
+  `show` formats, then builds, then copies `dist/showcase/index.html` to `demo/showcase.html`
 - `prepublishOnly` chaining `format:check → lint:check → check → build → test`, followed by
   `test:integration` when the integration axis is selected
 
@@ -1560,8 +1607,9 @@ only where `bin` and `integration` are both set:
 | `test:equivalence` | no         | no               | no                         |
 | `test:service`     | no         | never            | after `scripts/service.sh` |
 
-No proof joins the default chain: `npm test` runs the source, application, policy, and guide
-projects, and nothing there needs a build artifact or a foreign process. Publication is the one
+No opt-in proof joins the default chain: `npm test` runs the source, application, policy,
+configuration, and guide projects, and nothing there needs a build artifact or a foreign process.
+Publication is the one
 asymmetry — `prepublishOnly` appends `test:integration`, because a package about to be published
 should prove itself against its own built output, while `test:service` is never in that chain.
 Neither default testing nor publication starts or requires a foreign process.
@@ -1633,10 +1681,16 @@ comments, text, raw blocks, attributes, adjacent tokens, casing, and user-author
 byte-stable. The trusted preparation hook owns the final pre-parse phase; inline proxy code is
 restored before module analysis, and the first normal post-parse hook restores the original HTML
 spelling. The browser entry begins with a generated, byte-stable security prologue: the doctype,
-document and head opening, and a `Content-Security-Policy` meta element are one required prefix.
-Preparation rejects a missing, moved, or changed prologue before Vite parses the document, and the
-final trusted post-hook verifies that Vite retained the policy. CRLF and LF files are both accepted;
-the prologue's markup and ordering are otherwise exact. Vite's `%ENV%` HTML substitution is rejected
+head opening, and `Content-Security-Policy` meta markup, ordering, and indentation are exact. The
+opening `html` start tag is parsed by `@orkestrel/html`'s fail-closed `parseStartTag` boundary,
+so ASCII case and well-formed attributes such as `lang`, `data-bs-theme`, and `data-bs-core`
+may vary without weakening the position of the following head and policy. A malformed, incomplete,
+duplicate-attribute, wrong-name, or syntactically slashed root still fails closed. Preparation owns
+that positional check while the document is still generated bytes; the final trusted post-hook
+checks only that the exact
+policy survived because Vite may legitimately inject into the head. CRLF and LF files are both
+accepted. Vite's
+`%ENV%` HTML substitution is rejected
 before parsing because Vite performs that expansion after every plugin pre-hook, where it could
 otherwise create a late control attribute. The guard walks the exact left-to-right `%(\S+?)%`
 tokens Vite recognizes instead of performing a substring search, and each preparation plugin owns
@@ -1685,15 +1739,31 @@ still rejects public directories, browser asset inlining, and output path overri
 post-factory composition as defense in depth; that narrow check is not a general extension seam.
 
 When the showcase fact is present, the generated root also exports closed
-`appShowcase(...config: never[])`; both factories reject every argument at runtime and
-share one fixed internal browser configuration. The ordinary factory retains its strict
+`appShowcase(...config: never[])`; both factories reject every argument at runtime. The
+ordinary factory retains its strict
 `script-src 'self'` policy, external asset auditing, and `dist/app/browser` output. The showcase
-factory alone writes `dist/showcase`, applies `viteSingleFile` with
+factory is a standalone configuration with `base: './'`, unlimited asset inlining, and
+`dist/showcase` output. It applies `viteSingleFile` with
 `removeViteModuleLoader: true` and `useRecommendedBuildConfig: true`, uses Oxc and Lightning CSS
-minification for an `esnext` build without source maps or module preload, and inserts a non-empty ISO
-`build-id` meta. Its generated CSP admits only the inline script and style required by the
-self-contained `file://` artifact while retaining `script-src-attr 'none'`, `object-src 'none'`, and
-`base-uri 'none'`.
+minification for an `esnext` build without source maps or module preload, and inserts a SHA-256
+`build-id` derived from the secured, fully inlined document. An unchanged document therefore keeps
+the same id, while any changed byte changes it. The showcase development CSP keeps scripts
+same-origin and permits Vue's injected inline styles. Its built CSP swaps that script permission to
+inline and admits only inline styles plus data images and fonts, while both policies retain
+`default-src 'none'`, `script-src-attr 'none'`, `object-src 'none'`, and `base-uri 'none'`.
+
+The showcase fact also emits its own entry pair, `app/browser/showcase.html` and
+`app/browser/showcase.ts`, beside the application's `index.html` and `main.ts`. Both HTML entries
+open with a generated security prologue: the application carries the ordinary strict policy and the
+showcase carries its development policy. The boundary plugins select and validate the matching
+prologue; the showcase build alone swaps in the self-contained policy before hashing and renames its
+single HTML output to `index.html`, which is what `show` copies to `demo/showcase.html`. The showcase entry
+mounts `mountShowcaseApplication`, and `app/browser/seeders.ts` exports exactly one seeder,
+`seedApplication`, returning a frozen identity of the same shape the shipped root view receives.
+The two mount factories differ in the seed expression alone. Both explicitly pass
+`{ name: seed.name }` to the same `createBrowserApplication` root: the showcase seed comes from
+`seedApplication()`, while the shipped application seed comes from `readApplicationHealth` with
+the configured identity as its fallback.
 
 The browser development server applies the same trust boundary before Vite's internal middleware.
 Its explicit filesystem allowlist contains only browser/core source roots, browser tests, their
@@ -1756,12 +1826,26 @@ it is not a general-purpose source analyzer. Generated workspaces receive the sa
 module as a host-origin file and run it as a dedicated Node-only `policy` test project over
 `tests/policy.test.ts`.
 
+**The configuration suite.** Policy reads source, the `config` project exercises the root
+configuration, and integration builds for real. Every generated workspace therefore receives a
+universal Node-only
+`config` project over `tests/config/**/*.test.ts`. Its base cases execute the root module's physical
+workspace containment and environment-direction helpers; conditional cases exercise output
+containment when the workspace builds, managed/system browser discovery when a browser environment
+exists, and the HTML/CSP boundary only for an application browser. Those cases import the generated
+root `vite.config.ts` itself, so a failure is repaired in the generator rather than patched into a
+consumer. The generated-consumer integration matrix remains the fidelity boundary for real builds;
+the configuration suite supplies deterministic edge coverage without duplicating build orchestration.
+When scaffold changes a generated configuration invariant, an existing consumer's `vite.config.ts`
+is intentionally reported stale until that consumer accepts the regenerated configuration and its
+matching config test.
+
 **Real browser capability.** Browser test projects are gated on one centralized discovery chain:
 Playwright's pinned Chromium executable first, then a managed Chromium alias or cached revision,
 then stable system Chrome, then stable system Edge. Managed candidates must be executable regular
 files. System channels are selected only when their executable exists at Playwright's standard
 Linux, macOS, or Windows installation location; custom installations are not guessed. The generated
-policy test consumes the same discovery helpers and accepts either an executable managed path or the
+configuration test consumes the same discovery helpers and accepts either an executable managed path or the
 stable `chrome` / `msedge` channel, so it does not maintain a second heuristic.
 
 A browser suite runs when any one of those real browser capabilities is available and is skipped
@@ -1900,7 +1984,10 @@ renderer behind the table and blockquote work; the template engine behind every
 artifact; and, consumed only at the executable boundary, the terminal prompt toolkit and the console
 reporter. The core face uses the first four and stays pure; the server face adds only `node:*`
 builtins. Development dependencies are the shared tooling baseline plus the guide-parity toolkit
-that drives [`parity.test.ts`](../../tests/guides/src/parity.test.ts). The engines floor is Node
+that drives [`parity.test.ts`](../../tests/guides/src/parity.test.ts) and `@orkestrel/html`,
+which this package's real emitted-configuration tests execute. Generated manifests keep that HTML
+dependency scoped to `app/browser`; source-only, `app/core`, and `app/server` workspaces do not
+receive it. The engines floor is Node
 `>=22.12.0`, and the build emits ES and CJS for both library faces plus an ES executable.
 
 ## Patterns
@@ -2245,6 +2332,7 @@ import {
 	appViteConfig,
 	applicationViteConfig,
 	binViteProject,
+	configViteProject,
 	coreTsconfig,
 	coreViteConfig,
 	guidesViteProject,
@@ -2276,13 +2364,14 @@ coreViteConfig()
 srcViteConfig('browser')
 appViteConfig('server')
 policyViteProject()
+configViteProject()
 guidesViteProject()
 binViteProject()
 integrationViteProject({ bin: true, integration: true, global: true })
 serviceViteProject()
 viteProjectDefinitions({ integration: true }).includes('export const integration =') // true
 viteProjectRegistrations(['core'], [], { integration: true }).map(({ project }) => project)
-// ['srcCore', 'policy', 'guides', 'integration']
+// ['srcCore', 'policy', 'config', 'guides', 'integration']
 
 rootViteConfig(['core', 'server'], { bin: true })
 singleSrcViteConfig('server').includes('srcServer') // true
@@ -2576,6 +2665,8 @@ isMissingPathError(caught) // true only for an ENOENT error
   ids, the batch-overload semantics, and all-or-nothing list removal.
 - [`tests/src/core/policy.test.ts`](../../tests/src/core/policy.test.ts) — the repository coding-law
   policy module against this workspace and against deliberately hostile fixtures.
+- [`tests/config/vite.test.ts`](../../tests/config/vite.test.ts) — the executable root Vite
+  invariants for workspace, environment, and output containment.
 - [`tests/src/server/helpers.test.ts`](../../tests/src/server/helpers.test.ts) — containment,
   digests, host staging, hydration, derivation, prune scanning, and the local catalog.
 - [`tests/src/server/validators.test.ts`](../../tests/src/server/validators.test.ts) — the portable

package/dist/host/manifest.json

@@ -75,6 +75,11 @@
 			"destination": ".agents/skills/orkestrel-debrief/references/field-testing.md",
 			"executable": false
 		},
+		{
+			"storage": "agents/skills/orkestrel-debrief/references/instruction-audit.md",
+			"destination": ".agents/skills/orkestrel-debrief/references/instruction-audit.md",
+			"executable": false
+		},
 		{
 			"storage": "agents/skills/orkestrel-harden-package/SKILL.md",
 			"destination": ".agents/skills/orkestrel-harden-package/SKILL.md",
@@ -120,6 +125,11 @@
 			"destination": ".agents/skills/orkestrel-polish-surface/references/capture-harness.md",
 			"executable": false
 		},
+		{
+			"storage": "claude/agents/application.md",
+			"destination": ".claude/agents/application.md",
+			"executable": false
+		},
 		{
 			"storage": "claude/agents/builder.md",
 			"destination": ".claude/agents/builder.md",
@@ -155,11 +165,21 @@
 			"destination": ".claude/agents/planner.md",
 			"executable": false
 		},
+		{
+			"storage": "claude/agents/researcher.md",
+			"destination": ".claude/agents/researcher.md",
+			"executable": false
+		},
 		{
 			"storage": "claude/agents/reviewer.md",
 			"destination": ".claude/agents/reviewer.md",
 			"executable": false
 		},
+		{
+			"storage": "claude/agents/scout.md",
+			"destination": ".claude/agents/scout.md",
+			"executable": false
+		},
 		{
 			"storage": "claude/agents/verifier.md",
 			"destination": ".claude/agents/verifier.md",
@@ -260,6 +280,11 @@
 			"destination": ".codex/agents/analyst.toml",
 			"executable": false
 		},
+		{
+			"storage": "codex/agents/application.toml",
+			"destination": ".codex/agents/application.toml",
+			"executable": false
+		},
 		{
 			"storage": "codex/agents/builder.toml",
 			"destination": ".codex/agents/builder.toml",
@@ -295,11 +320,21 @@
 			"destination": ".codex/agents/planner.toml",
 			"executable": false
 		},
+		{
+			"storage": "codex/agents/researcher.toml",
+			"destination": ".codex/agents/researcher.toml",
+			"executable": false
+		},
 		{
 			"storage": "codex/agents/reviewer.toml",
 			"destination": ".codex/agents/reviewer.toml",
 			"executable": false
 		},
+		{
+			"storage": "codex/agents/scout.toml",
+			"destination": ".codex/agents/scout.toml",
+			"executable": false
+		},
 		{
 			"storage": "codex/agents/verifier.toml",
 			"destination": ".codex/agents/verifier.toml",

package/dist/host/tests/setupPolicy.ts

@@ -18,6 +18,7 @@ export const CENTRAL_SOURCE_FILES: readonly string[] = Object.freeze([
 	'middlewares.ts',
 	'parsers.ts',
 	'relations.ts',
+	'routes.ts',
 	'schemas.ts',
 	'seeders.ts',
 	'shapers.ts',
@@ -39,6 +40,7 @@ export const FUNCTION_SOURCE_FILES: readonly string[] = Object.freeze([
 	'middlewares.ts',
 	'parsers.ts',
 	'relations.ts',
+	'routes.ts',
 	'schemas.ts',
 	'seeders.ts',
 	'shapers.ts',
@@ -51,6 +53,7 @@ export const DATA_SOURCE_FILES: readonly string[] = Object.freeze([
 	'constants.ts',
 	'contracts.ts',
 	'relations.ts',
+	'routes.ts',
 	'schemas.ts',
 	'shapers.ts',
 	'templates.ts',
@@ -90,6 +93,22 @@ export const WORKER_SCOPE_VALUE_GLOBALS: readonly string[] = Object.freeze([
 	'removeEventListener',
 ])
 
+/** Source extensions inspected by the repository coding-law sweep. */
+export const CODING_SOURCE_EXTENSIONS: readonly string[] = Object.freeze([
+	'cjs',
+	'cts',
+	'js',
+	'jsx',
+	'mjs',
+	'mts',
+	'ts',
+	'tsx',
+	'vue',
+])
+
+/** Production-source glob derived from the complete inspected extension vocabulary. */
+export const CODING_SOURCE_GLOB = `{app,src}/**/*.{${CODING_SOURCE_EXTENSIONS.join(',')}}`
+
 /** Virtual source text used while binding one policy-inspected module. */
 export const POLICY_SOURCE_TEXTS: Map<string, string> = new Map()
 
@@ -109,6 +128,17 @@ export function normalizePolicyPath(path: string): string {
 	return path.replaceAll('\\', '/').replace(/\/+/gu, '/')
 }
 
+/** Whether a path belongs to the production-source coding-law corpus. */
+export function isCodingSourcePath(path: string): boolean {
+	const normalized = normalizePolicyPath(path)
+	const extension = normalized.split('.').pop()
+	return (
+		(normalized.startsWith('app/') || normalized.startsWith('src/')) &&
+		extension !== undefined &&
+		CODING_SOURCE_EXTENSIONS.includes(extension)
+	)
+}
+
 /** Whether a declaration carries an explicit export modifier. */
 export function hasExportModifier(node: ts.Node): boolean {
 	return (
@@ -416,6 +446,22 @@ export function inspectVueCodingLaw(
 	return violations
 }
 
+/** Inspect one production source through the shared coding-law route. */
+export function inspectCodingSource(
+	path: string,
+	content: string,
+	vueScripts?: VueScriptExtractorInterface,
+): readonly string[] {
+	const normalizedPath = normalizePolicyPath(path)
+	if (!normalizedPath.endsWith('.vue')) return inspectCodingLaw(normalizedPath, content)
+	const violations: string[] = []
+	if (!normalizedPath.startsWith('app/browser/')) {
+		violations.push(`${normalizedPath} Vue components belong in app/browser`)
+	}
+	violations.push(...inspectVueCodingLaw(normalizedPath, vueScripts?.(normalizedPath, content)))
+	return violations
+}
+
 /** Add syntax-wide coding-law violations while traversing one source tree. */
 export function inspectCodingNode(
 	path: string,
@@ -627,25 +673,17 @@ export function inspectCodingLaw(path: string, content: string): readonly string
 	return violations
 }
 
-/** Inspect every production TypeScript module under one workspace. */
+/** Inspect every production source under one workspace. */
 export function inspectCodingWorkspace(
 	root: string,
 	vueScripts?: VueScriptExtractorInterface,
 ): readonly string[] {
 	const violations: string[] = []
-	for (const path of globSync('{app,src}/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx,vue}', {
+	for (const path of globSync(CODING_SOURCE_GLOB, {
 		cwd: root,
 	})) {
 		const content = readFileSync(join(root, path), 'utf8')
-		const normalizedPath = normalizePolicyPath(path)
-		if (path.endsWith('.vue') && !normalizedPath.startsWith('app/browser/')) {
-			violations.push(`${normalizedPath} Vue components belong in app/browser`)
-		}
-		violations.push(
-			...(path.endsWith('.vue')
-				? inspectVueCodingLaw(normalizedPath, vueScripts?.(normalizedPath, content))
-				: inspectCodingLaw(normalizedPath, content)),
-		)
+		violations.push(...inspectCodingSource(path, content, vueScripts))
 	}
 	return violations
 }