@orkestrel/scaffold 0.0.21 → 0.0.23

package/dist/src/core/index.cjs

@@ -103,20 +103,29 @@ var APP_MATRIX = Object.freeze({
 * The byte-copied host artifact paths, frozen.
 *
 * @remarks
-* The root docs (`AGENTS.md` / `CLAUDE.md`), `LICENSE`, `.agents`, `.claude`, `.codex`,
-* the four SessionStart hook scripts (`scripts/deps.sh` / `scripts/cursor.sh` /
-* `scripts/codex.sh` / `scripts/ollama.sh`), the repository coding-law policy module,
-* the line's seven byte-identical root dotfiles, and the two guides-grouped
-* mirror candidates: the line-wide dev-tooling guide
-* (`guides/src/guide.md`) and the scaffold bin's own self-guide
-* (`guides/src/scaffold.md`). `stageHost` vendors both; each plan carries the
-* subset selected by `selectHostPaths`, omitting the target blueprint's own
-* guide.
+* The root docs (`AGENTS.md` / `CLAUDE.md`), `LICENSE`, the canonical
+* orchestration contract (`.agents/orchestration.md`) every harness bridge
+* points at, `.agents`, `.claude`, `.codex`, `.cursor`, the four SessionStart
+* hook scripts (`scripts/deps.sh` / `scripts/cursor.sh` / `scripts/codex.sh` /
+* `scripts/ollama.sh`), the repository coding-law policy module, the line's
+* seven byte-identical root dotfiles, and the two guides-grouped mirror
+* candidates: the line-wide dev-tooling guide (`guides/src/guide.md`) and the
+* scaffold bin's own self-guide (`guides/src/scaffold.md`). `stageHost` vendors
+* both; each plan carries the subset selected by `selectHostPaths`, omitting the
+* target blueprint's own guide.
+*
+* Three harness bridges point at `.agents/orchestration.md` and carry only their
+* own harness's specifics: `CLAUDE.md`, `.codex/config.toml`, and
+* `.cursor/rules`. They are meaningless without the contract they reference, but
+* they do not share a `Group` — `hostGroup` keeps `CLAUDE.md` in `docs` with the
+* other root documents, so a plan selecting `orchestration` carries two of the
+* three and a plan selecting `docs` carries the third.
 */
 var HOST_PATHS = Object.freeze([
 	"AGENTS.md",
 	"CLAUDE.md",
 	"LICENSE",
+	".agents/orchestration.md",
 	".agents/skills",
 	".claude/agents",
 	".claude/rules",
@@ -125,6 +134,7 @@ var HOST_PATHS = Object.freeze([
 	".codex/agents",
 	".codex/config.toml",
 	".cursor/mcp.json",
+	".cursor/rules",
 	".mcp.json",
 	"scripts/deps.sh",
 	"scripts/cursor.sh",
@@ -141,12 +151,48 @@ var HOST_PATHS = Object.freeze([
 	"guides/src/guide.md",
 	"guides/src/scaffold.md"
 ]);
-/** The consumer-owned live-service provisioner expected only by service workspaces. */
+/**
+* The path prefixes whose contents instruct or wire an agent, frozen.
+*
+* @remarks
+* Group classification splits by what a path governs, not by where it sits:
+* anything under these prefixes is `orchestration`, and everything else that is
+* not source, tests, guides, docs, or a manifest is `configs`. Both classifiers
+* — `inferGroup` for a foreign target path and `hostGroup` for a `HOST_PATHS`
+* entry — read this one list, so a new harness directory is admitted once.
+*/
+var ORCHESTRATION_PATH_PREFIXES = Object.freeze([
+	".agents/",
+	".claude/",
+	".codex/",
+	".cursor/",
+	".github/",
+	"scripts/"
+]);
+/**
+* The exact root filenames that wire an agent bench rather than the toolchain, frozen.
+*
+* @remarks
+* `.mcp.json` registers MCP servers for the harness. It sits among the root
+* dotfiles but governs agents, so it groups with the harness bridges.
+*/
+var ORCHESTRATION_PATH_NAMES = Object.freeze([".mcp.json"]);
+/** The birth-only provisioner skeleton retained by workspaces with declared service vendors. */
 var SERVICE_SCRIPT_PATH = "scripts/service.sh";
 /** The consumer-owned Vitest global-setup module shared by its independently selected projects. */
 var GLOBAL_SETUP_PATH = "tests/setupGlobal.ts";
 /** The consumer-owned Vite wrapper whose physical presence enables the optional app showcase. */
 var SHOWCASE_CONFIG_PATH = "configs/app/vite.showcase.config.ts";
+/**
+* The catalog agent file whose bounded marker region the catalog operation alone owns.
+*
+* @remarks
+* Vendored like every other host artifact, but presence-owned after hydration:
+* `diffPlan` compares this one path by presence, so a consumer restores it while
+* absent and never replaces its bytes — not from an audit, not from a repair, and
+* not under `replace`.
+*/
+var CATALOG_AGENT_PATH = ".claude/agents/orkestrel.md";
 /** The package-name RegExp — lowercase alphanumeric-with-hyphens, letter-first. */
 var NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
 /** Maximum bare workspace name length beneath the generated `@orkestrel/` scope. */
@@ -229,7 +275,7 @@ var DEFAULT_VERSION = "0.0.1";
 /** The `engines.node` range the `blueprint` builder fills. */
 var DEFAULT_ENGINES = `>=${MINIMUM_NODE_VERSION}`;
 /** The devDependency range generated packages pin `@orkestrel/scaffold` at. */
-var SCAFFOLD_RANGE = "^0.0.21";
+var SCAFFOLD_RANGE = "^0.0.23";
 /** Tooling versions shared by scaffold and every generated workspace. */
 var BASE_DEV_DEPENDENCIES = Object.freeze({
 	"@microsoft/api-extractor": "^7.58.12",
@@ -438,8 +484,8 @@ function member(name, category, summary, environment = "core") {
 * @remarks
 * `version` / `engines` default `DEFAULT_VERSION` / `DEFAULT_ENGINES`,
 * `src` defaults `['core']`, and `app` / `keywords` / `dependencies` /
-* `peers` / `extras` / `overrides` default `[]`, and `bin` / `integration` /
-* `service` / `global` / `showcase` default `false`. `description` is OMITTED entirely
+* `peers` / `extras` / `overrides` / `services` default `[]`, and `bin` /
+* `integration` / `global` / `showcase` default `false`. `description` is OMITTED entirely
 * when absent, so the result round-trips the exact-record `Blueprint` guard.
 * @returns A complete `Blueprint`.
 *
@@ -464,7 +510,7 @@ function blueprint(name, options) {
 		overrides: options?.overrides ?? [],
 		bin: options?.bin ?? false,
 		integration: options?.integration ?? false,
-		service: options?.service ?? false,
+		services: [...options?.services ?? []].sort(),
 		global: options?.global ?? false,
 		showcase: options?.showcase ?? false
 	};
@@ -953,7 +999,7 @@ function syncToReview(report) {
 }
 /**
 * Project a fleet package catalog into a markdown table — the block
-* `.claude/agents/orkestrel.md`'s catalog markers wrap.
+* `CATALOG_AGENT_PATH`'s catalog markers wrap.
 *
 * @param entries - The catalog rows to render.
 * @remarks
@@ -985,10 +1031,12 @@ function catalogToBlock(entries) {
 *
 * @param path - The target-relative path to classify.
 * @remarks
-* Ordered prefix match — `src/`, `tests/`, `guides/`, `docs/`, `configs/`,
-* then `.agents/`, `.claude/`, `.codex/`, `.github/`, and `scripts/` as
-* `'orchestration'`, then the two manifest files by exact name. Anything else
-* (a root-level, prefix-less file) falls through to `'configs'`.
+* Ordered prefix match — `src/`, `tests/`, `guides/`, `docs/`, `configs/`, then
+* `matchesOrchestrationPath`, which owns the orchestration membership rule for
+* this function and for `hostGroup` alike, then the two manifest files by exact
+* name. Anything left falls through to `'configs'`. Read the rule at
+* `matchesOrchestrationPath` rather than here; one rule with two descriptions
+* drifts exactly as fast as one rule with two implementations.
 * @returns The inferred `Group` for `path`.
 *
 * @example
@@ -1006,23 +1054,43 @@ function inferGroup(path) {
 	if (path.startsWith("guides/")) return "guides";
 	if (path.startsWith("docs/")) return "docs";
 	if (path.startsWith("configs/")) return "configs";
-	if (path.startsWith(".agents/") || path.startsWith(".claude/") || path.startsWith(".codex/") || path.startsWith(".github/") || path.startsWith("scripts/")) return "orchestration";
+	if (matchesOrchestrationPath(path)) return "orchestration";
 	if (path === "package.json" || path === "package-lock.json") return "manifest";
 	return "configs";
 }
 /**
+* Test whether a path instructs or wires an agent rather than the toolchain.
+*
+* @param path - The portable path to classify.
+* @returns `true` when the path is agent orchestration.
+*
+* @example
+* ```ts
+* import { matchesOrchestrationPath } from '@orkestrel/scaffold'
+*
+* matchesOrchestrationPath('.cursor/rules/orchestration.mdc') // true
+* matchesOrchestrationPath('.mcp.json') // true
+* matchesOrchestrationPath('.oxlintrc.json') // false
+* ```
+*/
+function matchesOrchestrationPath(path) {
+	if (ORCHESTRATION_PATH_NAMES.includes(path)) return true;
+	return ORCHESTRATION_PATH_PREFIXES.some((prefix) => path.startsWith(prefix));
+}
+/**
 * Diff a plan's artifacts against a target's current content.
 *
 * @param plan - The plan whose artifacts are the source of truth.
 * @param current - The target's current content, keyed by artifact-relative path.
 * @remarks
-* Audit semantics are per-origin. A `host`-origin artifact is audited by
-* PRESENCE only — `missing` or `aligned`, never `stale` — UNLESS it has been
-* hydrated with its real host bytes (`hydratePlan`'s `content`), in which case
-* it is content-compared exactly like a `computed` artifact and CAN be
-* `stale`. `hydratePlan` expands directory-shaped host artifacts into
-* content-bearing file artifacts; only an unresolved degrade-path host
-* artifact stays presence-only. A `computed` artifact is content-aware canon —
+* Audit semantics are per-origin. A `host`-origin artifact with canonical
+* `hex` is content-compared exactly like a `computed` artifact and CAN be
+* `stale`. A host artifact without canonical bytes is presence-owned:
+* present is `aligned`, absent is `missing`. `CATALOG_AGENT_PATH` remains
+* presence-owned after hydration because the catalog operation alone owns its
+* bounded marker region. `hydratePlan` expands directory-shaped host artifacts
+* into byte-aware file artifacts; only an intentional dependency-guide pointer
+* may remain without `hex`. A `computed` artifact is content-aware canon —
 * `missing` / `aligned` / `stale` — and gates the audit like any drifted
 * finding. A `template`-origin artifact is BIRTH-ONLY and AUDIT-EXEMPT: it is
 * always reported `aligned`, regardless of whether the target has it at all
@@ -1062,7 +1130,7 @@ function diffPlan(plan, current) {
 		if (artifact.origin === "host") {
 			let drift;
 			if (seen === void 0) drift = "missing";
-			else if (artifact.hex === void 0) drift = "aligned";
+			else if (artifact.path === ".claude/agents/orkestrel.md" || artifact.hex === void 0) drift = "aligned";
 			else drift = seen === artifact.hex ? "aligned" : "stale";
 			findings.push({
 				path: artifact.path,
@@ -1419,6 +1487,35 @@ function validateBlueprint(spec) {
 		text: "Showcase requires the app browser environment",
 		blocking: true
 	});
+	const seenServices = /* @__PURE__ */ new Set();
+	const serviceProjects = /* @__PURE__ */ new Set();
+	let previousService;
+	for (const service of spec.services) {
+		if (!NAME_PATTERN.test(service) || service.length > 203) questions.push({
+			field: "services",
+			text: `Service name "${service}" must be a bounded lowercase directory name matching ${NAME_PATTERN.source}`,
+			blocking: true
+		});
+		if (seenServices.has(service)) questions.push({
+			field: "services",
+			text: `Service "${service}" is declared more than once`,
+			blocking: true
+		});
+		if (previousService !== void 0 && previousService > service) questions.push({
+			field: "services",
+			text: "Services must be sorted by directory name",
+			blocking: true
+		});
+		const project = pascalCase(service);
+		if (serviceProjects.has(project)) questions.push({
+			field: "services",
+			text: `Service "${service}" collides with another generated project name`,
+			blocking: true
+		});
+		seenServices.add(service);
+		serviceProjects.add(project);
+		previousService = service;
+	}
 	if (spec.src.length > 0) {
 		for (const environment of spec.src) if (!ENVIRONMENTS.includes(environment)) questions.push({
 			field: "src",
@@ -1909,7 +2006,10 @@ function blueprintShape() {
 		overrides: (0, _orkestrel_contract.arrayShape)(overrideShape(), { max: MAX_COLLECTION_ITEMS }),
 		bin: (0, _orkestrel_contract.booleanShape)(),
 		integration: (0, _orkestrel_contract.booleanShape)(),
-		service: (0, _orkestrel_contract.booleanShape)(),
+		services: (0, _orkestrel_contract.arrayShape)((0, _orkestrel_contract.stringShape)({
+			min: 1,
+			max: 203
+		}), { max: MAX_COLLECTION_ITEMS }),
 		global: (0, _orkestrel_contract.booleanShape)(),
 		showcase: (0, _orkestrel_contract.booleanShape)()
 	});
@@ -4502,6 +4602,87 @@ describe('root Vite configuration', () => {
 		expect(environmentSourceError('app/browser', '@app/core')).toBeUndefined()
 	}){{cases}}
 })
+`
+	}),
+	serviceConformance: Object.freeze({
+		id: "serviceConformance",
+		name: "serviceConformance",
+		summary: "The generated service-vendor structure and configuration conformance test.",
+		category: "tests",
+		placeholders: Object.freeze([Object.freeze({
+			name: "services",
+			description: "The sorted service vendor directory names."
+		})]),
+		content: `import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs'
+import { join } from 'node:path'
+import { isRecord, parseJSON } from '@orkestrel/contract'
+import { expect, it } from 'vitest'
+
+it('keeps every service vendor structurally complete and exactly configured', () => {
+	const declared = {{services}}
+	const root = join(process.cwd(), 'tests', 'service')
+	const directories = readdirSync(root, { withFileTypes: true })
+		.filter((entry) => entry.isDirectory())
+		.map((entry) => entry.name)
+		.sort()
+	const manifest = parseJSON(readFileSync(join(process.cwd(), 'package.json'), 'utf8'))
+	const scripts = isRecord(manifest) && isRecord(manifest.scripts) ? manifest.scripts : {}
+	const config = readFileSync(join(process.cwd(), 'vite.config.ts'), 'utf8')
+	const provisioner = join(process.cwd(), 'scripts', 'service.sh')
+
+	expect(directories).toEqual(declared)
+	if (!existsSync(provisioner) || !lstatSync(provisioner).isFile()) {
+		throw new Error(
+			'Service vendors require scripts/service.sh to provision every declared vendor idempotently or exit nonzero',
+		)
+	}
+	for (const service of declared) {
+		const setup = join(root, service, 'setup.ts')
+		if (!existsSync(setup) || !lstatSync(setup).isFile()) {
+			throw new Error(
+				\`Service vendor "\${service}" is missing tests/service/\${service}/setup.ts; add a readiness module that probes and warms the vendor and throws when unavailable\`,
+			)
+		}
+		const label = \`name: { label: 'service:\${service}', color: 'red' }\`
+		const include = \`include: ['tests/service/\${service}/**/*.test.ts']\`
+		const setupFiles = \`setupFiles: ['./tests/setup.ts', './tests/setupServer.ts', './tests/service/\${service}/setup.ts']\`
+		if (!config.includes(label) || !config.includes(include) || !config.includes(setupFiles)) {
+			throw new Error(\`Service vendor "\${service}" is missing its exact Vite project\`)
+		}
+		const command = \`vitest run --config vite.config.ts --no-cache --reporter=dot --project service:\${service}\`
+		if (scripts[\`test:service:\${service}\`] !== command) {
+			throw new Error(\`Service vendor "\${service}" is missing its exact npm script\`)
+		}
+	}
+	const aggregate =
+		'vitest run --config vite.config.ts --no-cache --reporter=dot ' +
+		declared.map((service) => \`--project service:\${service}\`).join(' ')
+	if (scripts['test:service'] !== aggregate) {
+		throw new Error('test:service must name every declared service exactly once')
+	}
+	if (typeof scripts.test !== 'string' || scripts.test.includes('test:service')) {
+		throw new Error('The default test script must omit live service proofs')
+	}
+	if (
+		typeof scripts.prepublishOnly !== 'string' ||
+		!scripts.prepublishOnly.endsWith(' && npm run test:service')
+	) {
+		throw new Error('prepublishOnly must end with the aggregate live service proof')
+	}
+})
+`
+	}),
+	serviceProvisioner: Object.freeze({
+		id: "serviceProvisioner",
+		name: "serviceProvisioner",
+		summary: "The birth-only workspace-owned service-vendor provisioner skeleton.",
+		category: "orchestration",
+		placeholders: Object.freeze([]),
+		content: `#!/bin/sh
+set -eu
+
+printf '%s\\n' 'Service provisioning is not configured. Implement scripts/service.sh to provision every declared vendor idempotently, then remove this failure.' >&2
+exit 1
 `
 	}),
 	policyTest: Object.freeze({
@@ -4511,15 +4692,34 @@ describe('root Vite configuration', () => {
 		category: "tests",
 		placeholders: Object.freeze([Object.freeze({
 			name: "vuePolicyImport",
-			description: "The optional official Vue SFC compiler import."
+			description: "The Vue SFC parser import, when the workspace declares app/browser."
 		}), Object.freeze({
 			name: "workspacePolicyAssertion",
-			description: "The formatter-stable workspace policy assertion."
+			description: "The workspace coding-law assertion, carrying a Vue script extractor when the workspace declares app/browser."
 		})]),
 		content: `import { globSync } from 'node:fs'
 import { describe, expect, it } from 'vitest'
 import { isBrowserVuePath } from './setup.js'
-import { inspectCodingWorkspace } from './setupPolicy.js'{{vuePolicyImport}}
+import {
+	derivePolicyTokens,
+	inspectCodingLaw,
+	inspectCodingWorkspace,
+	inspectPolicyPurity,
+	inspectPolicyWorkspace,
+	isFunctionDomainPath,
+	POLICY_SOURCE_ENVIRONMENTS,
+	readPackageName,
+} from './setupPolicy.js'{{vuePolicyImport}}
+
+${CONST_KEYWORD} POLICY_PLANTED_PATH = 'tests/setupPolicy.ts'
+${CONST_KEYWORD} POLICY_TOKENS = derivePolicyTokens(readPackageName(process.cwd()))
+${CONST_KEYWORD} FUNCTION_MODULE_PATH = 'app/browser/composables/useTheme.ts'
+${CONST_KEYWORD} FUNCTION_MODULE_VIOLATION =
+	FUNCTION_MODULE_PATH + ' declarations do not form one matching exported function implementation'
+${CONST_KEYWORD} FUNCTION_DOMAIN_FILE_PATH = 'app/server/composables.ts'
+${CONST_KEYWORD} FUNCTION_DOMAIN_FILE_VIOLATION =
+	FUNCTION_DOMAIN_FILE_PATH +
+	' names a function domain, which belongs in a folder rather than a file'
 
 describe('repository coding law', () => {
 	it('keeps Vue single-file components exclusively in browser environments', () => {
@@ -4531,6 +4731,149 @@ describe('repository coding law', () => {
 	it('enforces source placement, exports, readonly contracts, and syntax law', () => {
 		{{workspacePolicyAssertion}}
 	})
+
+	it('accepts one matching exported function in a registered domain', () => {
+		expect(
+			inspectCodingLaw(
+				FUNCTION_MODULE_PATH,
+				"import type { Ref } from 'vue'\\nexport function useTheme(): Ref<undefined> { throw new Error() }",
+			),
+		).toEqual([])
+	})
+
+	it('accepts one matching exported generator in a registered domain', () => {
+		expect(
+			inspectCodingLaw(FUNCTION_MODULE_PATH, 'export function* useTheme(): Generator<void> {}'),
+		).toEqual([])
+	})
+
+	it('accepts overload signatures beside one matching implementation', () => {
+		expect(
+			inspectCodingLaw(
+				FUNCTION_MODULE_PATH,
+				'export function useTheme(): void\\nexport function useTheme(mode: string): void\\nexport function useTheme(_mode?: string): void {}',
+			),
+		).toEqual([])
+	})
+
+	it('rejects a bodyless function-domain declaration', () => {
+		expect(
+			inspectCodingLaw(FUNCTION_MODULE_PATH, 'export declare function useTheme(): void'),
+		).toEqual([FUNCTION_MODULE_VIOLATION])
+	})
+
+	it('rejects a mismatched bodyless declaration beside one implementation', () => {
+		expect(
+			inspectCodingLaw(
+				FUNCTION_MODULE_PATH,
+				'declare function smuggled(secret: string): void\\nexport function useTheme(): void {}',
+			),
+		).toEqual([FUNCTION_MODULE_VIOLATION])
+	})
+
+	it('rejects two exported functions in a function module', () => {
+		expect(
+			inspectCodingLaw(
+				FUNCTION_MODULE_PATH,
+				'export function useTheme(): void {}\\nexport function useMode(): void {}',
+			),
+		).toEqual([FUNCTION_MODULE_VIOLATION])
+	})
+
+	it('rejects module data beside a function-domain export', () => {
+		expect(
+			inspectCodingLaw(
+				FUNCTION_MODULE_PATH,
+				"const THEME = 'dark'\\nexport function useTheme(): string { return THEME }",
+			),
+		).toEqual([FUNCTION_MODULE_VIOLATION])
+	})
+
+	it('rejects a function whose name differs from its filename', () => {
+		expect(inspectCodingLaw(FUNCTION_MODULE_PATH, 'export function useMode(): void {}')).toEqual([
+			FUNCTION_MODULE_VIOLATION,
+		])
+	})
+
+	it('rejects a non-exported function-domain declaration', () => {
+		expect(inspectCodingLaw(FUNCTION_MODULE_PATH, 'function useTheme(): void {}')).toEqual([
+			FUNCTION_MODULE_VIOLATION,
+		])
+	})
+
+	it('rejects a default function-domain export', () => {
+		expect(
+			inspectCodingLaw(FUNCTION_MODULE_PATH, 'export default function useTheme(): void {}'),
+		).toEqual([FUNCTION_MODULE_VIOLATION])
+	})
+
+	it('keeps index modules outside the function-domain shape', () => {
+		const path = 'app/browser/composables/index.ts'
+
+		expect(isFunctionDomainPath(path)).toBe(false)
+		expect(inspectCodingLaw(path, 'export function index(): void {}')).toContain(
+			path + ' places module functions in their centralized kind file',
+		)
+	})
+
+	it('keeps main modules outside the function-domain shape', () => {
+		const path = 'app/browser/composables/main.ts'
+
+		expect(isFunctionDomainPath(path)).toBe(false)
+		expect(inspectCodingLaw(path, 'export function main(): void {}')).toContain(
+			path + ' places module functions in their centralized kind file',
+		)
+	})
+
+	it('rejects a file named for a registered function domain', () => {
+		const content =
+			"import { parentPort } from 'node:worker_threads'\\nexport function start(): void { parentPort?.close() }"
+
+		expect(inspectCodingLaw(FUNCTION_DOMAIN_FILE_PATH, content)).toEqual([
+			FUNCTION_DOMAIN_FILE_VIOLATION,
+		])
+	})
+
+	it('keeps camelCase modules in unregistered domains under centralized placement', () => {
+		const path = 'app/browser/services/normalizePath.ts'
+
+		expect(isFunctionDomainPath(path)).toBe(false)
+		expect(inspectCodingLaw(path, 'export function normalizePath(): void {}')).toEqual([
+			path + ' places module functions in their centralized kind file',
+		])
+	})
+
+	it('preserves the self-contained Node runtime exemption', () => {
+		const path = 'app/server/worker.ts'
+		const content =
+			"import { parentPort } from 'node:worker_threads'\\nconst port = parentPort\\nexport function start(): void { port?.close() }"
+
+		expect(inspectCodingLaw(path, content)).toEqual([])
+	})
+})
+
+describe('fleet policy purity', () => {
+	it('keeps fleet policy files free of this package architecture', () => {
+		expect(inspectPolicyWorkspace(process.cwd())).toEqual([])
+	})
+
+	it('reports planted package architecture, so a clean sweep is evidence', () => {
+		const token = POLICY_TOKENS[0]
+		const environment = POLICY_SOURCE_ENVIRONMENTS[0]
+		if (token === undefined || environment === undefined) {
+			throw new Error('The package manifest derived no policy token to plant')
+		}
+		const planted = [
+			'export const ' + token + '_PATH = []',
+			"export const path = 'src/" + environment + "/index.ts'",
+			'',
+		].join('\\n')
+
+		expect(inspectPolicyPurity(POLICY_PLANTED_PATH, planted, POLICY_TOKENS)).toEqual([
+			POLICY_PLANTED_PATH + ':1:14 forbids the ' + token + ' package token',
+			POLICY_PLANTED_PATH + ':2:21 forbids a source-environment path literal',
+		])
+	})
 })
 `
 	}),
@@ -5677,14 +6020,30 @@ for (const entry of GUIDE_MANIFEST) {
 * @example
 * ```ts
 * hostGroup('AGENTS.md') // 'docs'
-* hostGroup('.agents') // 'orchestration'
-* hostGroup('.claude') // 'orchestration'
-* hostGroup('.codex') // 'orchestration'
+* hostGroup('.agents/orchestration.md') // 'orchestration'
+* hostGroup('.claude/rules') // 'orchestration'
+* hostGroup('.cursor/rules') // 'orchestration'
+* hostGroup('.mcp.json') // 'orchestration'
+* hostGroup('.oxlintrc.json') // 'configs'
 * ```
+*
+* @remarks
+* Takes a `HOST_PATHS` entry, so every example above is one. A bare directory
+* name is not: `ORCHESTRATION_PATH_PREFIXES` entries carry a trailing slash, so
+* `hostGroup('.cursor')` is `configs`, and no vendored entry has that form.
+*
+* Below the `docs` branch the split is by what a path governs rather than where
+* it sits, which is why both MCP registrations — `.mcp.json` and
+* `.cursor/mcp.json` — group with the harness bridges instead of with the root
+* dotfiles beside them. The `docs` branch is checked first and is deliberately
+* positional: `AGENTS.md`, `CLAUDE.md`, and `LICENSE` are the root documents, and
+* `CLAUDE.md` stays there as a root document even though it is also a harness
+* bridge. A plan selecting `orchestration` therefore carries two of the three
+* bridges; a plan selecting `docs` carries the third.
 */
 function hostGroup(path) {
 	if (path === "AGENTS.md" || path === "CLAUDE.md" || path === "LICENSE") return "docs";
-	if (path.startsWith(".agents/") || path.startsWith(".claude/") || path.startsWith(".codex/") || path.startsWith("scripts/") || path.startsWith(".github/")) return "orchestration";
+	if (matchesOrchestrationPath(path)) return "orchestration";
 	if (path.startsWith("tests/")) return "tests";
 	if (path === "guides/src/guide.md" || path === "guides/src/scaffold.md") return "guides";
 	return "configs";
@@ -5950,7 +6309,10 @@ function packageManifest(spec) {
 	if (spec.bin) scripts["test:src:bin"] = "vitest run --config vite.config.ts --no-cache --reporter=dot --project src:bin";
 	if (spec.integration) scripts["test:integration"] = "vitest run --config vite.config.ts --no-cache --reporter=dot --project integration";
 	if (spec.bin && spec.integration) scripts["test:equivalence"] = "node -e \"const c=require('node:child_process'),p=process.env.npm_execpath;if(p===undefined)process.exit(1);const r=c.spawnSync(process.execPath,[p,'run','test:integration'],{stdio:'inherit',env:{...process.env,SCAFFOLD_BOUNDARY_EQUIVALENCE:'1'}});process.exit(r.status??1)\"";
-	if (spec.service) scripts["test:service"] = "vitest run --config vite.config.ts --no-cache --reporter=dot --project service";
+	if (spec.services.length > 0) {
+		scripts["test:service"] = "vitest run --config vite.config.ts --no-cache --reporter=dot " + spec.services.map((service) => `--project service:${service}`).join(" ");
+		for (const service of spec.services) scripts[`test:service:${service}`] = `vitest run --config vite.config.ts --no-cache --reporter=dot --project service:${service}`;
+	}
 	if (spec.app.length > 0) {
 		scripts["test:app"] = "vitest run --config vite.config.ts --no-cache --reporter=dot " + spec.app.map((environment) => `--project ${APP_MATRIX[environment].project}`).join(" ");
 		for (const environment of spec.app) scripts[`test:app:${environment}`] = `vitest run --config vite.config.ts --no-cache --reporter=dot --project ${APP_MATRIX[environment].project}`;
@@ -5989,7 +6351,7 @@ function packageManifest(spec) {
 		scripts["build:src:bin"] = "vite build --config configs/src/vite.bin.config.ts";
 		scripts["build:host"] = "node -e \"import('./dist/src/server/index.js').then((m)=>{const n=m.stageHost(process.cwd(),'dist/host').length;console.log('build-host: staged '+n+' file(s) into dist/host')})\"";
 	}
-	scripts.prepublishOnly = "npm run format:check && npm run lint:check && npm run check && npm run build && npm test" + (spec.integration ? " && npm run test:integration" : "");
+	scripts.prepublishOnly = "npm run format:check && npm run lint:check && npm run check && npm run build && npm test" + (spec.integration ? " && npm run test:integration" : "") + (spec.services.length > 0 ? " && npm run test:service" : "");
 	const devDependencies = devDependenciesFor(spec);
 	const manifest = {
 		name: hasSource ? `@orkestrel/${spec.name}` : spec.name,
@@ -5997,13 +6359,15 @@ function packageManifest(spec) {
 		...hasSource ? {} : { private: true },
 		description: spec.description ?? (hasSource ? `The @orkestrel/${spec.name} package.` : `The ${spec.name} application.`),
 		keywords: [...spec.keywords].sort(),
-		homepage: `https://github.com/orkestrel/${spec.name}#readme`,
-		bugs: `https://github.com/orkestrel/${spec.name}/issues`,
+		...hasSource ? {
+			homepage: `https://github.com/orkestrel/${spec.name}#readme`,
+			bugs: `https://github.com/orkestrel/${spec.name}/issues`
+		} : {},
 		license: "MIT",
-		repository: {
+		...hasSource ? { repository: {
 			type: "git",
 			url: `git+https://github.com/orkestrel/${spec.name}.git`
-		},
+		} } : {},
 		...spec.bin ? { bin: { scaffold: "./dist/bin/scaffold.js" } } : {},
 		files: spec.bin ? [
 			"dist/src",
@@ -6153,7 +6517,7 @@ function viteProjectRegistrations(src, app = [], facts = {}) {
 	registrations.push({ project: "policy" }, { project: "config" }, { project: "guides" });
 	if (facts.bin === true) registrations.push({ project: "srcBin" });
 	if (facts.integration === true) registrations.push({ project: "integration" });
-	if (facts.service === true) registrations.push({ project: "service" });
+	for (const service of facts.services ?? []) registrations.push({ project: `service${pascalCase(service)}` });
 	return registrations;
 }
 /**
@@ -6175,7 +6539,7 @@ function viteProjectDefinitions(facts = {}) {
 	];
 	if (facts.bin === true) definitions.push(binViteProject());
 	if (facts.integration === true) definitions.push(integrationViteProject(facts));
-	if (facts.service === true) definitions.push(serviceViteProject());
+	for (const service of facts.services ?? []) definitions.push(serviceViteProject(service));
 	return definitions.join("\n");
 }
 /**
@@ -8162,24 +8526,27 @@ ${facts.bin === true && facts.integration === true && facts.global === true ? `
 `;
 }
 /**
-* Build the standalone Node-only live-service proof project.
+* Build one standalone Node-only live-service vendor proof project.
 *
-* @returns The emitted `service` project definition.
+* @param name - The bounded vendor directory name.
+* @returns The emitted `service:<name>` project definition.
 *
 * @example
 * ```ts
-* serviceViteProject().includes("label: 'service'") // true
+* serviceViteProject('claude').includes("label: 'service:claude'") // true
 * ```
 */
-function serviceViteProject() {
-	return `${EXPORT_KEYWORD} const service = (options?: UserConfig): UserConfig =>
+function serviceViteProject(name) {
+	if (!NAME_PATTERN.test(name) || name.length > 203) throw new Error("Service project name must be a bounded lowercase directory name");
+	return `${EXPORT_KEYWORD} const ${`service${pascalCase(name)}`} = (options?: UserConfig): UserConfig =>
 	mergeConfig(
 		{
 			resolve,
+			plugins: [environmentBoundary('app/server')],
 			test: {
-				name: { label: 'service', color: 'red' },
-				include: ['tests/service/**/*.test.ts'],
-				setupFiles: ['./tests/setup.ts', './tests/setupService.ts'],
+				name: { label: ${serializeTypeScriptString(`service:${name}`)}, color: 'red' },
+				include: [${serializeTypeScriptString(`tests/service/${name}/**/*.test.ts`)}],
+				setupFiles: ['./tests/setup.ts', './tests/setupServer.ts', ${serializeTypeScriptString(`./tests/service/${name}/setup.ts`)}],
 				environment: 'node',
 				browser: { enabled: false },
 				testTimeout: 120_000,
@@ -8329,7 +8696,7 @@ ${renderedTest}
 *
 * @param src - The declared `Environment[]`.
 * @param facts - Optional structural facts. `bin` appends the standalone executable
-*   build-and-test project; `integration` and `service` append their standalone
+*   build-and-test project; `integration` and `services` append their standalone
 *   proof projects; `global` wires the shared global-setup module.
 * @returns The root `vite.config.ts` file content, newline-terminated.
 *
@@ -8956,28 +9323,60 @@ function srcTsconfig(environment) {
 * `build.lib` / externals live in the root `srcBrowser` / `srcServer` export
 * instead (per the live exemplars).
 *
+* @remarks
+* `bundleTypes` rolls the face up through API Extractor, which leaves every
+* `src/core` re-export behind a relative `../core/index.ts` specifier — a path no
+* published tarball carries. A workspace that also declares `core` therefore emits
+* a `beforeWriteFile` rewrite turning that specifier into `@orkestrel/<name>`, the
+* package's own published root export. The rewrite is narrowed to the FINAL face
+* roll-up: applying it to the intermediate declarations makes API Extractor analyse
+* `src/core`'s own source and abort. A workspace with no `core` emits no rewrite,
+* because it has no cross-environment specifier to externalize.
+*
 * @param environment - The non-`core` environment to derive the `vite.config.ts` for.
+* @param spec - The blueprint slice naming the package and its declared source environments.
 * @returns The environment `vite.config.ts` file content, newline-terminated.
 *
 * @example
 * ```ts
-* srcViteConfig('browser').includes('srcBrowser') // true
+* srcViteConfig('browser', { name: 'router', src: ['core', 'browser'] }).includes('srcBrowser')
 * ```
 */
-function srcViteConfig(environment) {
+function srcViteConfig(environment, spec) {
 	const anchor = environment === "browser" ? "srcBrowser" : "srcServer";
+	const specifier = `'@orkestrel/${spec.name}'`;
+	const pattern = "/(?:\\.\\.\\/)+core\\/index\\.ts/g";
+	const inlineCall = `\t\t\t\t\t\t? content.replaceAll(${pattern}, ${specifier})`;
+	const call = fitsPrintWidth(inlineCall) ? [inlineCall] : [
+		"						? content.replaceAll(",
+		`\t\t\t\t\t\t\t\t${pattern},`,
+		`\t\t\t\t\t\t\t\t${specifier},`,
+		"							)"
+	];
+	const face = `/[\\\\/]dist[\\\\/]src[\\\\/]${environment}[\\\\/]index\\.d\\.ts$/`;
+	const external = spec.src.includes("core");
+	const rewrite = external ? `\n${[
+		"				beforeWriteFile: (path, content) => ({",
+		`\t\t\t\t\tcontent: ${face}.test(path)`,
+		...call,
+		"						: content,",
+		"				}),"
+	].join("\n")}` : "";
 	return `import { defineConfig } from 'vite'
 import dts from 'vite-plugin-dts'
 import { ${anchor}, resolveWorkspacePath } from '../../vite.config.ts'
 
-// Types are bundled inline by vite-plugin-dts (see configs/src/vite.core.config.ts
-// for the same pattern).
+${external ? `// vite-plugin-dts rolls this face into one declaration, and the roll-up reaches
+// src/core through a relative source path the tarball does not carry. The rewrite
+// below externalizes core through the package's own published root export, on the
+// final roll-up only.` : `// vite-plugin-dts rolls this face into one declaration. This workspace declares no
+// src/core, so the roll-up has no cross-environment specifier to externalize.`}
 export default defineConfig(
 	${anchor}({
 		plugins: [
 			dts({
 				tsconfigPath: resolveWorkspacePath('configs/src/tsconfig.${environment}.json'),
-				bundleTypes: true,
+				bundleTypes: true,${rewrite}
 			}),
 		],
 	}),
@@ -9109,7 +9508,7 @@ function ciWorkflow(spec) {
 	const tail = [];
 	if (spec.integration) tail.push(`      - name: Run live consumer integration
         run: npm run test:integration`);
-	if (spec.service) {
+	if (spec.services.length > 0) {
 		tail.push(`      - name: Provision live service
         run: bash ${SERVICE_SCRIPT_PATH}`);
 		tail.push(`      - name: Run live service tests
@@ -9193,7 +9592,7 @@ function configArtifacts(spec) {
 		const row = SRC_MATRIX[environment];
 		for (const path of row.configs) {
 			const isTsconfig = path.endsWith(".json");
-			const content = environment === "core" ? isTsconfig ? coreTsconfig() : coreViteConfig() : isTsconfig ? srcTsconfig(environment) : srcViteConfig(environment);
+			const content = environment === "core" ? isTsconfig ? coreTsconfig() : coreViteConfig() : isTsconfig ? srcTsconfig(environment) : srcViteConfig(environment, spec);
 			artifacts.push({
 				path,
 				group: "configs",
@@ -9592,7 +9991,8 @@ ${EXPORT_KEYWORD} ${FUNCTION_KEYWORD} waitForEvent<TMap extends EventMap, K exte
 			cases: configCases.join("")
 		})
 	];
-	if (spec.src.includes("server") || spec.app.includes("server")) artifacts.push(fillArtifact("tests/setupServer.ts", "tests", "setupServer", {}, "server"));
+	if (spec.src.includes("server") || spec.app.includes("server") || spec.services.length > 0) artifacts.push(fillArtifact("tests/setupServer.ts", "tests", "setupServer", {}, "server"));
+	if (spec.services.length > 0) artifacts.push(fillArtifact("tests/config/services.test.ts", "tests", "serviceConformance", { services: renderStringArray(spec.services, "		", "const declared = ", "") }, "server"));
 	if (spec.src.includes("browser") || spec.app.includes("browser")) artifacts.push(fillArtifact("tests/setupBrowser.ts", "tests", "setupBrowser", {}, "browser"));
 	const hasBoundary = hasApplicationBoundary(spec);
 	const hasShowcase = hasApplicationShowcase(spec);
@@ -10195,12 +10595,15 @@ npm install @orkestrel/${blueprint.name}
 \`\`\`` : "This is a private application workspace and is not published to npm.",
 		usage: guideUsage(blueprint, pascal)
 	}));
-	if (selected.includes("orchestration")) artifacts.push({
-		path: ".github/workflows/ci.yml",
-		group: "orchestration",
-		origin: "computed",
-		content: ciWorkflow(blueprint)
-	});
+	if (selected.includes("orchestration")) {
+		artifacts.push({
+			path: ".github/workflows/ci.yml",
+			group: "orchestration",
+			origin: "computed",
+			content: ciWorkflow(blueprint)
+		});
+		if (blueprint.services.length > 0) artifacts.push(fillArtifact(SERVICE_SCRIPT_PATH, "orchestration", "serviceProvisioner", {}));
+	}
 	for (const path of selectHostPaths(HOST_PATHS, blueprint.name)) {
 		const group = hostGroup(path);
 		if (!selected.includes(group)) continue;
@@ -10324,9 +10727,10 @@ var Compiler = class Compiler {
 			this.#emitter.emit("audit", result);
 			return result;
 		}
+		const diff = diffPlan(scaffolding.plan, current);
 		const result = {
-			...diffPlan(scaffolding.plan, current),
-			questions: scaffolding.questions
+			...diff,
+			questions: [...scaffolding.questions, ...diff.questions]
 		};
 		this.#emitter.emit("audit", result);
 		return result;
@@ -10728,6 +11132,7 @@ exports.APP_MATRIX = APP_MATRIX;
 exports.APP_SERVER_DEV_DEPENDENCIES = APP_SERVER_DEV_DEPENDENCIES;
 exports.BASE_DEV_DEPENDENCIES = BASE_DEV_DEPENDENCIES;
 exports.BIN_CONFIGS = BIN_CONFIGS;
+exports.CATALOG_AGENT_PATH = CATALOG_AGENT_PATH;
 exports.CATEGORIES = CATEGORIES;
 exports.CHECKOUT_ACTION_SHA = CHECKOUT_ACTION_SHA;
 exports.COMPILER_ID = COMPILER_ID;
@@ -10767,6 +11172,8 @@ exports.MAX_SERIALIZED_INPUT_BYTES = MAX_SERIALIZED_INPUT_BYTES;
 exports.MAX_TOTAL_ARTIFACT_BYTES = MAX_TOTAL_ARTIFACT_BYTES;
 exports.MINIMUM_NODE_VERSION = MINIMUM_NODE_VERSION;
 exports.NAME_PATTERN = NAME_PATTERN;
+exports.ORCHESTRATION_PATH_NAMES = ORCHESTRATION_PATH_NAMES;
+exports.ORCHESTRATION_PATH_PREFIXES = ORCHESTRATION_PATH_PREFIXES;
 exports.ORIGINS = ORIGINS;
 exports.ORKESTREL_RANGE_PATTERN = ORKESTREL_RANGE_PATTERN;
 exports.PlanManager = PlanManager;
@@ -10866,6 +11273,7 @@ exports.isSyncReport = isSyncReport;
 exports.isWorkspaceName = isWorkspaceName;
 exports.manifestToDependencies = manifestToDependencies;
 exports.manifestToName = manifestToName;
+exports.matchesOrchestrationPath = matchesOrchestrationPath;
 exports.member = member;
 exports.memberShape = memberShape;
 exports.override = override;