@orkestrel/scaffold 0.0.21 → 0.0.23

package/dist/host/agents/skills/orkestrel-build-application/references/application.md

@@ -0,0 +1,129 @@
+# Application architecture reference
+
+## Environment selection
+
+Support application-only, source-only, and mixed workspaces.
+The CLI uses `--src core,browser,server` for published src environments and
+`--app core,browser,server` for private app environments. At least one selector
+is required in non-interactive creation; `--surfaces` is not part of the
+vocabulary.
+
+| Selection   | Contract                                               |
+| ----------- | ------------------------------------------------------ |
+| app/core    | Host-independent contracts and composition             |
+| app/browser | Vue browser runtime and real-browser tests             |
+| app/server  | Node runtime, executable CJS build, and loopback tests |
+
+Core-only, browser-only, and server-only are valid. A browser+server pair must
+include app/core so shared transport contracts have one host-independent owner.
+
+## Dependency direction
+
+- app/core imports no DOM, Node, app/browser, or app/server implementation.
+- app/browser may import app/core and published browser/core packages.
+- app/server may import app/core and published server/core packages.
+- Published src environments never import private app modules. Src core is
+  host-independent; src browser/server may import src core and remain
+  mutually disjoint.
+- Apply the same direction to cross-package `@orkestrel/<package>/browser` and
+  `/server` exports; a package's bare export is its core API.
+- Browser code reaches server behavior through app/core contracts and a
+  transport boundary, never by importing app/server.
+- Every environment barrel contains `export *` declarations only. A star-export
+  collision is a design failure to be renamed at its owner, never hidden behind
+  a selective barrel row.
+- Types, constants, helpers, validators, parsers, and factories live in their
+  centralized kind files; an implementation file holds one class plus imports.
+  `ApplicationServerRunner` lives alone in `ApplicationServerRunner.ts` and
+  `startApplicationServer` in `factories.ts`; `main.ts` owns no reusable
+  declarations.
+- Enforcement is layered, and each layer owns exactly what it can express:
+  - `.oxlintrc.json` `no-restricted-imports` owns **literal-string** declared
+    package, alias, and conventional relative imports, in both directions.
+    `.oxfmtrc.json` owns formatting. Neither replaces the other, and neither
+    replaces typechecking.
+  - `tests/setupPolicy.ts` owns what Oxlint cannot represent: computed and
+    template-literal import specifiers, declaration placement, and the
+    export-star barrel law. It is a deliberately narrow TypeScript-compiler pass
+    over the repository's own coding laws — not a general-purpose analyzer, and
+    not a second linter.
+  - Scoped TypeScript projects remove Node/DOM globals from the wrong
+    environment.
+  - Vite's real browser/server builds resolve Vue, assets, CSS, workers, and
+    runtime module graphs, and its generated environment-boundary plugin checks
+    dependency direction and physical workspace containment on the actual graph.
+    Vite's parsed HTML asset callbacks reject forced inlining before any direct
+    asset read; non-inlined output assets are audited by physical source path.
+  - Generated-consumer lint, typecheck, build, and integration tests prove the
+    combined configuration.
+- Do not add a second general-purpose parser, source-language analyzer, or
+  boundary script that duplicates a layer above. Use the toolchain's own
+  facilities instead: Vite's Oxc/Rolldown AST for TypeScript and JavaScript
+  asset references, the official Vue SFC compiler for `.vue` blocks, Vite's
+  HTML parser callbacks, its bundled Lightning CSS dependency analyzer, and the
+  TypeScript compiler API for the narrow coding-law pass.
+- Include `.ts`, `.tsx`, `.mts`, and `.cts` in every scoped TypeScript check.
+  Vue SFCs belong only to app/browser. CSS is the generated browser style
+  format; SCSS requires an explicitly authorized Sass compiler dependency.
+
+## Entries and configuration
+
+- Every selected app environment has an `index.ts` barrel.
+- app/browser executes from `main.ts` through `index.html`.
+- app/server centralizes process signals in an explicitly stoppable runner,
+  returns that runner from convenience startup so cleanup is never hidden, and
+  executes it from a declaration-free `main.ts`; its bundle is
+  `dist/app/server/main.cjs`, with only `node:*` external.
+- app/core is check/test-only.
+- Root `tsconfig.json` owns `@app/*` aliases.
+- Root `vite.config.ts` owns shared config and Vitest projects.
+- `configs/app` contains thin target wrappers and scoped tsconfigs.
+- app/browser uses `vue-tsc`; other app environments use `tsc`.
+
+## Manifest policy
+
+- App-only: unscoped name, `private: true`, no package `main`, `module`,
+  `types`, `exports`, or public `publishConfig`.
+- Mixed: normal published source entries; package files include `dist/src` and
+  exclude `dist/app`.
+- Add Vue only to development tooling when app/browser is selected; mixed
+  publication must not expose an app-only Vue runtime dependency.
+- Add no product-specific dependencies or optional showcase tooling by default.
+
+## Boundaries and tests
+
+- Default server host is loopback.
+- Parse the options container and host/port leaves before mutation; reject
+  wrong-shaped containers, empty hosts, and non-integer, negative, or
+  out-of-range ports with a coded error and guard.
+- Lifecycle transitions serialize in call order, ephemeral restarts re-request
+  port zero, server stop closes hostile active connections deterministically,
+  and runner stop idempotently releases its SIGINT/SIGTERM listeners. Runner
+  generations isolate asynchronous failures so an older transition cannot
+  release a newer run's listeners.
+- Real child-process tests prove executable readiness, collision exit, signal
+  termination, and port release. On Windows, `ChildProcess.kill('SIGTERM')`
+  reports OS termination by signal; POSIX delivery exercises the runner's
+  graceful signal listener and exits zero.
+- Browser tests use Playwright-backed Vitest Browser Mode and real DOM. A
+  browser-capability check probes the installed executable directly with
+  `existsSync(chromium.executablePath())`; there is no channel or environment
+  guessing.
+- Server tests bind port zero on loopback and use real fetch requests.
+- Capability-dependent tests probe the actual capability and scope any skip.
+- The generated browser application disables the public directory so an
+  unmanaged file copy cannot bypass the module graph or its boundary checks.
+- Generated CI runs the gates on the declared minimum Node release and on the
+  current major.
+- Guide parity walks existing `src` and/or `app` roots and maps every selected
+  `@src/*` / `@app/*` alias.
+
+## Cleanup before gates
+
+- Source: no stray or misplaced declarations, non-exported centralized
+  declarations, nested function declarations, duplicate implementations,
+  superfluous wrappers, compatibility aliases, or stale imports and barrel rows.
+- Tests: no unused or duplicated helpers, empty setup files, placeholder suites,
+  current-scope `.todo` / `.skip`, or assertions that cannot fail.
+- Text: UTF-8 only; scan generated or migrated edits for replacement characters,
+  mojibake, and stray control characters.

package/dist/host/agents/skills/orkestrel-debrief/SKILL.md

@@ -18,9 +18,9 @@ Read the current files in this order:
    pass of an agent-facing surface.
 4. `guides/README.md`, the governing guides for what the campaign built, and `ROADMAP.md`.
 
-The user's current instruction wins. The debrief judges the artifact AND the process that
-produced it; neither is exempt, and successes are captured as deliberately as mistakes —
-a practice that worked is codified so it repeats, not merely survived.
+The user's current instruction wins. The debrief judges the artifact and the process that
+produced it; neither is exempt. Capture successes as deliberately as mistakes, and codify
+a practice that worked so it repeats.
 
 ## The debrief laws
 

package/dist/host/agents/skills/orkestrel-debrief/references/field-testing.md

@@ -10,8 +10,8 @@ Test from the top down, and do not stop at the tier that passes:
 1. **Frontier** (the harness's default model) — proves the surface works at all.
 2. **Mid tier** (e.g. a codex mechanical model) — proves the surface survives a harness's
    schema abbreviation and a model that reads less carefully.
-3. **Small harness-native** (e.g. Haiku, a codex high-volume model, a cursor composer) —
-   the acceptance tier: these must walk the surface unaided, or the surface is not done.
+3. **Small harness-native** (e.g. Haiku, a codex high-volume model) — the acceptance
+   tier: these must walk the surface unaided, or the surface is not done.
 4. **Local floor** (a quantized 2B-class model through a real tool-calling client) — not
    an acceptance gate; a stochastic probe that exposes teaching gaps nothing else hits.
    Its residual failures must be provably consumer-floor (malformed emission, attention

package/dist/host/agents/skills/orkestrel-falsify/SKILL.md

@@ -0,0 +1,167 @@
+---
+name: orkestrel-falsify
+description: Run an adversarial audit round against work that already looks finished — write the subject as numbered falsifiable claims, dispatch independent auditors instructed to break them rather than confirm them, reconcile their evidence, and rule. Use before accepting a fix round, before a version bump or publication, when green gates are the only evidence a change works, when a defect has recurred across rounds, or whenever a review would otherwise read a diff and agree with it.
+---
+
+# Falsify
+
+Green gates prove a suite ran. They prove nothing about the claim the work makes. This skill is for
+the moment when everything passes and the work is still not known to be right.
+
+## Load authority
+
+1. `AGENTS.md`.
+2. `.claude/rules/quality.md`, especially **Falsification** — the laws governing auditor behaviour.
+   This skill prescribes the round; that section prescribes the conduct inside it. Do not restate it.
+3. The governing guide/spec for the subject.
+4. `references/brief.md` before writing a brief; `references/reconcile.md` before ruling.
+
+## When a round is warranted
+
+Run one when the work is finished and the evidence is weak in a specific way:
+
+- gates are green and nothing has attacked the claim;
+- a fix round is about to be accepted, especially one whose author reported success;
+- a version is about to be bumped, packed, or published;
+- the same defect class has now appeared in more than one round;
+- a self-declared "sound, unchanged, no fix needed" verdict is load-bearing.
+
+Do not run one for a typo, a mechanical rename, or work whose failure would be immediately visible.
+
+A round also needs something new to attack. When the previous round's claims all held, nothing has
+been added or repaired since, and the only motive is that an auditor could still imagine an attack,
+there is no subject — closing is the correct action and the next subject is the deliverable.
+
+## Write the brief
+
+The brief is the instrument. A weak brief produces a confirming review no matter which auditor reads
+it. Follow `references/brief.md`. What this skill adds beyond the conduct law:
+
+- Every re-run is a **successor**, not a restatement. It carries what the previous round closed so
+  nothing is re-reported, and it adds claims that attack **the previous round's own rulings**.
+- The brief names what the round **decides**. An auditor that does not know the stakes calibrates to
+  politeness.
+- Unknowns are named as unknowns, with how the auditor reports back on them.
+
+The claim form itself is the Falsification law's — read it there. The **verdict shape** below is this
+skill's, because `.agents/orchestration.md` assigns it here; everything else about auditor conduct is the law's.
+
+## Evidence, by subject type
+
+The brief supplies the evidence its subject actually has. Requiring a diff for a subject that has no
+diff is a rule the brief cannot satisfy.
+
+| subject                                 | required evidence                                                                     |
+| --------------------------------------- | ------------------------------------------------------------------------------------- |
+| a code change                           | the actual diff and the actual status output; omitting either is a dispatch deviation |
+| a rendered or externally driven surface | the capture portfolio as primary, source as corroboration                             |
+| a policy, design, or process proposal   | the proposal, the canon it must satisfy, and the record of what motivated it          |
+
+**A subject can occupy more than one row; supply every row it occupies.** A ruling whose fixes
+already landed as edits is both the third row and the first, and withholding the diff on the grounds
+that the subject is "a proposal" leaves the auditor unable to check whether a fix changed anything
+nobody claimed.
+
+## Run the round
+
+- **Verify every authority the brief references exists in the tree the auditor is rooted in.** A
+  brief that points at a rule file, section, or guide the executor cannot find delivers nothing while
+  looking like authority — and it fails silently, because an auditor does not report a heading it
+  never saw. Check before dispatch; propagate the missing file rather than restating its contents in
+  the brief. This is the reason restatement felt necessary, and it is the wrong cure.
+- Run the **two-lane adversarial pass** on one identical brief: a subjective lane and an objective
+  lane, each a fresh subagent with a clean context, blind to each other. Reconcile them yourself.
+  `.agents/orchestration.md` owns lane definitions, engine assignment, and what happens when an
+  engine is dark; do not restate them here.
+- A round run with one lane is a deviation. Record it rather than glossing it. If an engine is
+  unavailable, the remaining engine runs both lanes — it never drops one.
+- **Give every auditor the means to run its attacks.** A lens that can only read returns derivations,
+  and a derivation reads exactly like a verdict — it will confirm a claim that one probe would break.
+- **Tell each auditor exactly where a probe may live, and verify that place works before you say it.**
+  A test runner resolves only what its own configuration includes: a probe written outside the project
+  root is typically not discovered at all, and the run reports no test files rather than a result. The
+  reliable form is a file inside the canonical mirrored suite, run by explicit path, deleted before the
+  auditor returns — promoted into a permanent test when it proves something worth keeping. Give each
+  concurrent auditor a distinct filename that already satisfies the repository's test naming
+  convention; never invent a prefix to dodge collisions, and never let two auditors claim one path. A
+  leaked probe is discovered by the suite and fails a run nobody else caused.
+- **Run auditors concurrently only when their writes cannot collide.** Read-only lenses still write
+  probes; give each a distinct path and forbid whole-project runs, or serialize the round. **This binds
+  the orchestrator too:** a tree-wide gate run while a round is live sees the auditors' in-flight probes
+  and reports a failure nobody caused. Wait for the round, or scope the command to paths no auditor
+  owns. Never delete another executor's working file to make your own command pass.
+- Supply the evidence the subject type requires, per the table above.
+- Auditors are read-only and spawn nothing.
+- Blind reports are **immutable**. Nothing an auditor returns is edited, merged, or revised — by
+  anyone, including the auditor — once it has been returned.
+
+## Verdict shape
+
+Every auditor in every round returns exactly this, and nothing else. One shape makes rounds
+comparable; a round that invents its own cannot be read against the last one.
+
+1. **Numbered verdicts**, one per claim, in the brief's order. Exactly one of four values:
+
+   | value           | meaning                                                                                | evidence                                                                                                                                                      |
+   | --------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+   | `CONFIRMED`     | attacked and it held                                                                   | as the Falsification law requires                                                                                                                             |
+   | `BROKEN`        | falsified                                                                              | as the Falsification law requires — note it says _input, **state, or interleaving**_, so a concurrency claim is falsified by an interleaving, not by an input |
+   | `UNRESOLVED`    | cannot be decided from the evidence available                                          | what would settle it                                                                                                                                          |
+   | `NOT-EVIDENCED` | a claim about a rendered or externally driven surface the supplied capture cannot show | which capture is missing                                                                                                                                      |
+
+   The first two rows defer; only the last two are this skill's, because the law does not name them.
+   `BROKEN` and `UNRESOLVED` are **separate**: a claim nobody could decide has not been falsified,
+   and it cannot supply the fields falsification requires. `NOT-EVIDENCED` is the token the
+   `analyst` and `reviewer` charters already require; it is kept, not re-invented.
+
+2. **Findings fitting no claim**, if any, each substantiated to the same standard as `BROKEN`.
+
+3. **One terminal line**, and only one:
+
+   ```text
+   VERDICT: PASS — <m> of <m> confirmed, no findings outside the claims
+   VERDICT: FAIL — <n> broken, <u> unresolved, <e> not-evidenced, <x> findings outside the claims
+   ```
+
+   **`PASS` requires all four to be true**: every claim `CONFIRMED`, nothing `UNRESOLVED`, nothing
+   `NOT-EVIDENCED`, and no substantiated finding outside the claims. A single substantiated finding
+   forces `FAIL` no matter how the numbered claims landed — otherwise a round can report a real
+   defect and still emit the word that authorises the release.
+
+No process diary. No summary of what was read.
+
+## When a round comes back all-confirmed
+
+The Falsification law governs this: the brief goes on trial, not the subject. Apply it, and if the
+claims turn out to have been descriptive, the successor brief is where the sharper ones go.
+
+## Reconcile and rule
+
+Follow `references/reconcile.md`. The obligations that are not delegable:
+
+- **Reproduce every sharp finding yourself** before acting on it. An auditor's finding is a
+  hypothesis until the orchestrator has run it.
+- **A disagreement between auditors is rarely a tie to average.** It is usually two correct answers
+  to two different questions. Find the question each one answered.
+- **Bound every finding**: state what is _not_ broken, and why the adjacent behaviour that looks the
+  same is correct. An audit that reports everything is as useless as one that reports nothing.
+- **Bound the fix before briefing it.** Establish what over-correcting would break, and include that
+  in the fix brief as a constraint.
+- Drop, on the record, any finding neither auditor can substantiate.
+
+## Accept, or run it again
+
+The threshold is **a `PASS` terminal line on a brief whose claims cover what the subject owns** —
+every numbered claim `CONFIRMED` on evidence, nothing `UNRESOLVED`, nothing `NOT-EVIDENCED`, no
+substantiated finding beside them. Never green gates, which prove only that a suite ran.
+
+A round that finds something is a success, not a delay. The alternative is a consumer finding it
+after publication, when the version number is already spent. But an unsubstantiated attack is not a
+finding, and the supply of imaginable ones never runs out: a round is not re-run because an auditor
+can still think of one. A substantiated finding against something no claim names is real and forces
+`FAIL`; an unsubstantiated one is a claim for the successor brief. The escalation law in
+`.claude/rules/quality.md` governs a subject that keeps producing findings at the same seam — after
+enough of them the ruling owed is on the design, not on the next defect.
+
+When a fix round follows, its auditor must be an engine that did not write it, and the next round's
+brief is the successor of this one.

package/dist/host/agents/skills/orkestrel-falsify/references/brief.md

@@ -0,0 +1,98 @@
+# Writing the claims brief
+
+The brief decides the round. Every weak audit this process has produced was a weak brief read
+faithfully; every finding worth having came from a claim written sharply enough to be attacked.
+
+## Anatomy
+
+**Subject.** The whole chain, not the last commit. A fix round's defect usually lives in what an
+earlier round assumed, so an audit scoped to the newest diff cannot see it. State the tip, the
+branch, and the chain of rounds with one line each on what each claimed to close.
+
+**What the round decides.** Say it plainly — "this decides whether the package is bumped and
+consumed downstream", "this decides whether the fix is accepted". An auditor that does not know the
+stakes calibrates to politeness, and politeness confirms.
+
+**Already established — do not re-run.** List what the orchestrator has already verified, so effort
+goes somewhere new and settled findings are not re-reported as fresh. State that these were verified
+by the orchestrator directly rather than taken from a writer's report; an auditor that suspects the
+established list is hearsay will re-derive all of it.
+
+**Review evidence.** The actual diff and the actual status output, by path. Omitting either is a
+dispatch deviation. For any claim about a rendered or externally driven surface, the capture is the
+evidence and source is corroboration.
+
+**Numbered falsifiable claims.** Each is a property some concrete input, state, or interleaving
+could show false. Assign the primary lane where auditors differ in strength, but do not let an
+auditor skip a claim because it assumes the other covers it better. The claim set is the round's
+scope: write it to cover what the subject owns, then hold it closed. An attack the round invents
+against something no claim names enters the verdict only when it is substantiated to the `BROKEN`
+standard; otherwise it is a claim for the successor brief, not a finding.
+
+**Unknowns, named as unknowns.** What the orchestrator does not know that the round needs, and how
+the auditor reports back on it. A brief that cannot be fully specified says so; the alternative is
+an executor inventing an answer and building on it silently.
+
+**The threshold.** State that a finding is worth more than a clean pass, and why: the alternative is
+a consumer finding it after publication, when the version is already spent.
+
+## The successor rule
+
+A re-run **amends**; it never restates. Rewriting a brief from scratch loses the shape of what has
+already been attacked, and the round re-derives it at full cost.
+
+A successor brief:
+
+- **carries the chain forward** with the new round added to the table;
+- **moves the closed findings into "already established"** so they are not re-reported;
+- **states what changed in the brief itself**, so a reader can see which claims are new;
+- **adds claims that attack the previous round's own rulings.**
+
+That last one is the highest-yield idea in this process. A fix round makes _decisions_ — it rules
+that some input should be refused rather than carried, that some widening is deliberate, that some
+site is sound and needs no change. Those rulings are the freshest and least-examined surface in the
+package, and they were made by the engine least able to see their consequences. Write a claim for
+each one.
+
+## Claims that repeatedly find things
+
+- **"The containment has no remaining door."** Require the auditor to enumerate the surface itself
+  rather than trust any registry, table, or sweep the writer produced.
+- **"No refusal was widened into a regression."** Every hardening round risks over-correcting. Ask
+  which legitimate caller pattern broke, and require it to be named.
+- **"The instruments bind."** Attack the instrument's _rule_, not its output: name a change it would
+  not catch. An instrument nobody has tried to evade is not evidence.
+- **"No instrument is vacuous."** Ask for a control that cannot produce its failing verdict. If a
+  previous round shipped one, say so and name it — a round told a tautology already shipped here
+  looks harder than one told to check generally.
+- **"The guide is true."** Not plausible — true. Ask specifically whether a false universal has been
+  replaced by an **unfalsifiable** one, which is worse, because it reads as rigour.
+- **"The package is coherent as a whole. Would you ship this?"** The only claim that catches
+  accumulated damage no single diff shows.
+- **"The self-declared sound-and-unchanged verdicts are sound."** A writer's table saying a site
+  needed no change is a claim like any other, made by the party least able to test it. Require the
+  auditor to pick the ones it considers most likely wrong and actually attack them, and say how many.
+
+## Instructions that change auditor behaviour
+
+- _"CONFIRMED requires naming the attack you tried that failed."_ — the single most effective
+  sentence, because it converts a confirmation from an opinion into a report of work done.
+- _"A claim you cannot decide is UNRESOLVED, not CONFIRMED — say what would settle it."_
+- _"Assume this chain has one more."_ — with the count of prior rounds and how many were provoked by
+  a defect the previous round believed closed.
+- _"Do not hedge toward an imagined consensus."_ — when two auditors run blind, each will otherwise
+  soften toward what it guesses the other said.
+
+Do **not** write _"an audit returning only confirmations has not tried."_ It reads as pressure to
+produce a finding, and an auditor that manufactures one to satisfy the brief has corrupted the round
+in the more expensive direction — a false finding costs a fix unit, an argument, and the credibility
+of the true findings beside it. The adequacy of an all-confirmed round is tested afterwards, against
+the brief, by the orchestrator.
+
+## What not to put in a brief
+
+- Laws already binding from `AGENTS.md` and the rule files. Reference them; restating invites drift
+  between the copy and the original.
+- Any hint of what the other auditor is finding, or has found.
+- Your own hypothesis about where the defect is, beyond what the claims state. An auditor handed a
+  suspect investigates the suspect and stops.

package/dist/host/agents/skills/orkestrel-falsify/references/reconcile.md

@@ -0,0 +1,148 @@
+# Reconciling a round and ruling on it
+
+Two auditors return. Neither accepts; the orchestrator does. This is where a round becomes a
+decision, and it is not delegable.
+
+## Reproduce before you act
+
+The rule beneath this whole section: **run it rather than argue it.** Every judgement below is
+cheap once the probe exists and unreliable until it does.
+
+An auditor's finding is a **hypothesis** until the orchestrator has run it. Reproduce every sharp
+claim by hand, against the built output, before it enters a fix brief.
+
+**Build the hostile input outside the `try`.** A probe that wraps construction and invocation in one
+catch cannot distinguish _the subject threw_ from _my harness threw_ — a missing import, a wrong
+arity, a `require` in an ESM context all surface as the finding you were hoping to see. Construct
+first, let harness failures crash loudly, and only guard the call under test. Every campaign that has
+run this process has produced at least one finding that was the instrument failing.
+
+Reproduction produces three outcomes, and all three matter:
+
+- the finding **confirms** and is often **wider** than reported — the reproduction reaches doors the
+  auditor did not try;
+- the finding **confirms but is bounded smaller** — real, and not where the auditor thought;
+- the finding **evaporates**, because the auditor's input could not exercise what it claimed to test.
+
+The same reproduction discipline applies to your own probes. A probe whose input cannot reach the
+code under test reports a pass that means nothing, and it will read exactly like a real pass.
+
+## A disagreement is rarely a tie
+
+When two auditors return opposite verdicts on one claim, do not average them and do not prefer the
+engine you trust more. **Reproduce first** — running the disagreement settles most of them outright,
+and it is the only method that can also find what neither auditor saw. Then find the question each
+one answered. The common shapes:
+
+- **Both right about different objects.** One tested a case the other did not construct. This is a
+  `SPLIT-CLAIM`: the claim was a universal that carried more than one subject. It is **not** a third
+  verdict value — one falsifying input makes a universal claim `BROKEN`, and succeeding on a
+  different object does not undo that. Split it, keep the original `BROKEN` if any subclaim is
+  broken, and carry the split into the successor brief.
+- **Both right about different halves of one claim number.** Same resolution: the claim number was
+  carrying two claims. Split and renumber.
+- **One right on the mechanism, the other on the criterion.** Take both. The reconciled ruling is
+  frequently neither proposal, and better than either, because each supplied a constraint the other
+  violated.
+- **The consequence disproves the premise.** An argument that an input class is unreachable is
+  answered by running it and showing what the reachable consequence is.
+
+Record which engine was right and on what. A round whose disagreements are smoothed over teaches
+nothing to the next one.
+
+## Evidence custody
+
+Blind reports are immutable, and their independence is a property of the record, not of anyone's
+memory. A reader six months out must be able to tell an unbiased blind verdict from one produced
+after an auditor saw its counterpart's evidence — otherwise the whole value of running blind is
+unverifiable after the fact.
+
+Two rules, both enforceable:
+
+1. **A returned verdict is never edited** — not by the auditor, not by the orchestrator.
+2. **Anything an auditor says after seeing another's report is a separate file beside that verdict**,
+   under `.orkestrel/<package>/`, named for the unit and the exposure, recording what was shown and
+   to whom. It is a durable record, not a journal, so it survives the campaign sweep.
+
+That exchange is a **fallback, not a phase.** Reproduction comes first and settles most
+disagreements. Reach for an exchange only when a specific factual question survives reproduction,
+scope it to that question, initiate it yourself, and run it once — a second exchange is negotiation.
+
+**Ask the auditor to attack the other's evidence on that question. Never ask it to resolve the
+disagreement, reconsider its position, or say whether the other changed its mind.** Constraining
+when, who, scope and frequency does nothing about convergence if the instruction itself invites it,
+and "does their evidence change your claim?" is the convergence prompt in its purest form.
+
+## Bound the finding
+
+State what is **not** broken, and why the adjacent behaviour that looks identical is correct. A
+finding without a boundary is an alarm, and alarms get discounted wholesale — including the true
+ones next to them.
+
+Two boundaries earn their keep:
+
+- **Credit what the round got right.** If the hostile inputs adjacent to the hole are correctly
+  contained, say so and list them. It sharpens the finding to a point instead of an area.
+- **Show where the same-looking answer is correct.** When several exports answer a hostile input the
+  same way and only one is wrong, name what makes the difference — usually that the correct ones
+  agree with a documented view, and the wrong one reads on an axis it then ignores.
+
+## Bound the fix before briefing it
+
+Establish what over-correcting would break, and put it in the fix brief as a constraint. Both ends
+are usually wrong:
+
+- **too little** — a patch to the one function, leaving the package holding two standards for the
+  same thing, which is the inconsistency that produced the finding;
+- **too much** — adopting the strictest sibling's rule verbatim, breaking a legitimate caller
+  pattern, and tripping "no refusal was widened into a regression" in the next round.
+
+Find the rule that fits both. It is usually about **agreement** rather than about categories — what
+a reader reads, its answer must carry — and it dissolves the special cases rather than enumerating
+them.
+
+Where the choice is genuinely open, it is a design judgement with a subjective and an objective
+half, and it goes to a blind design pass before code. Ruling it unilaterally is how a fix round
+becomes the next audit's finding.
+
+## Certifying an instrument
+
+The control-population law in `.claude/rules/quality.md` binds here without restatement. What it
+leaves this round is the procedure.
+
+When a round certifies an instrument — a pin, an identity check, a generated sweep — the controls
+are usually drawn from whatever the instrument obviously covers, because that is where the examples
+are easiest to construct. That sampling proves discrimination _within_ the population and is
+routinely reported as proof the instrument works.
+
+So before running controls, write down the instrument's **membership rule** in one sentence, then
+ask what the rule excludes. Draw at least one control from there. Two shapes have already cost a
+round each:
+
+- an AST comparison whose controls were all drawn from the literal classes present in the bodies it
+  guarded, blind to the classes absent from them;
+- a call-closure pin whose controls were all body-reachable functions, green for a function reached
+  only through a parameter default.
+
+Then write the two sentences that matter: what the controls established, and what they did not. The
+second sentence is the one that gets skipped, and skipping it is how an instrument's credibility
+outruns its evidence.
+
+## Ruling
+
+- Every retained finding names the fix-brief item that carries it. A finding with no carrier is a
+  dropped finding; walk the list once and check.
+- Drop, **on the record**, anything neither auditor can substantiate against the evidence.
+- Promote anything that must outlive the round into a durable artifact before the working files are
+  swept. What lives only in a scratch file did not survive.
+- The fix round's auditor is an engine that did not write it.
+- The next round's brief is this round's successor.
+
+## The threshold
+
+Accept when the brief's claims are **satisfied on evidence** — the `PASS` terminal line the skill
+defines, against a claim set that covers what the subject owns. Not green gates.
+
+A round that finds something is the process working. A round that finds nothing because nobody tried
+is the failure; a round re-run because an attack can still be imagined never ends. Bound the claim
+set at the brief, rule on what it returned, and close.

package/dist/host/agents/skills/orkestrel-harden-package/SKILL.md

@@ -41,7 +41,7 @@ Load [hardening.md](references/hardening.md) for the hardening lane and for any
 
 1. **Bound the campaign.** Record requested outcomes, in-scope environments/domains, explicit exclusions, supported hosts, dirty files, and evidence needed for acceptance.
 2. **Map before editing.** Trace public types, implementations, callers, tests, guides, exports, runtime boundaries, installed Orkestrel dependencies, and applicable legacy/upstream references.
-3. **Establish the intended contract.** Build a capability/defect matrix. Separate verified fact from inference. Mark each row implement, repair, retain, or exclude with a reason.
+3. **Establish the intended contract.** Build a capability/defect matrix. Separate verified fact from inference. Mark each row implement, repair, retain, or exclude with a reason. The matrix is fixed at this step and is the campaign's definition of done: every later step serves a row, and work that serves no row belongs to the next campaign.
 4. **Design types first.** Update guide/spec intent and `*/types.ts` before implementation, under the root design laws. A contract that needs a compatibility shim is the wrong contract.
 5. **Implement completely.** Finish every in-scope branch and reuse the exact installed Orkestrel primitives whose semantics match. The root completion law decides what may not be left behind.
 6. **Prove each defect before repairing it.** A repair begins with a test that fails for that defect: record the exact command and its failing count before the fix and the same command's passing count after. A repair with no red-then-green record is unproven.
@@ -51,7 +51,7 @@ Load [hardening.md](references/hardening.md) for the hardening lane and for any
 10. **Document the final behavior.** Update the governing guide, examples, method tables, limitations, and parity coverage. Document architectural limits honestly.
 11. **Audit completion.** Inspect test discovery, `.todo`/`.skip`/conditional skip use, source/test helper duplication, exports, environment isolation, unexpected text corruption, and the entire diff.
 12. **Verify.** Run the repository-prescribed gates in order and inspect the generated outputs relevant to the request.
-13. **Review independently, and never by the author.** When orchestration is available, require a design-fit reviewer, an objective correctness/constraints analyst, and a mechanical checker; add an adversarial pass for security, concurrency, destructive paths, or external input. A unit's auditor is the engine that did not write it — same-engine re-review returns the author's own blind spot. Resolve every required finding, then rerun affected verification.
+13. **Review independently, and never by the author.** When orchestration is available, run the two-lane adversarial pass — subjective design fit and objective correctness — plus a mechanical checker, per `.agents/orchestration.md`. Add a dedicated adversarial round for security, concurrency, destructive paths, or external input. A unit's auditor is an engine that did not write it; same-engine re-review returns the author's own blind spot. Resolve every required finding, then rerun affected verification.
 
 ## Accept the result
 
@@ -63,4 +63,6 @@ Do not accept “mostly complete,” “tests pass” without adequacy review, o
 - no unresolved centralization, wrapper, dependency-reuse, test-discovery, lifecycle, security, or text-integrity finding;
 - exact command evidence for every final gate.
 
+Completion is those conditions met, not the absence of anything further to find. When every row is closed and the gates are green, stopping is the correct action and the next campaign is the deliverable; a further pass over the same surface is a new instruction from the user, not a finding.
+
 Report what changed, what evidence proves it, exact test/gate results, and any genuine residual risk. Do not call an in-scope omission “future work.”

package/dist/host/agents/skills/orkestrel-harden-package/references/centralization.md

@@ -10,11 +10,11 @@ inventory, how to classify, and what must be proven before acceptance.
 Inspect every touched implementation and centralized file, then sweep the full affected
 environments.
 
-| Where               | Inventory                                                                                                                                                                                                          |
-| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Implementation file | Interfaces and type aliases, module constants and data, free functions/guards/parsers/factories/schemas, function declarations or assignments inside bodies, extra classes, imports and exports stranded by a move |
-| Centralized file    | Every module declaration: does it match that file's kind, is it exported, is it reachable from the sole public barrel when public, does it carry direct behavioral coverage when it carries logic                  |
-| Environment root    | Every declaration promoted there: at least two consuming modules, or it belongs to the owning module's centralized file                                                                                            |
+| Where               | Inventory                                                                                                                                                                                                                                                     |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Implementation file | Interfaces and type aliases, module constants and data, free functions/guards/parsers/factories/schemas, function declarations or assignments inside bodies, extra classes, imports and exports stranded by a move                                            |
+| Centralized file    | Every module declaration: does it match that file's kind, is it exported, is every intentional top-level export reachable from the correct environment barrel regardless of current consumers, does it carry direct behavioral coverage when it carries logic |
+| Environment root    | Every declaration promoted there: at least two consuming modules, or it belongs to the owning module's centralized file                                                                                                                                       |
 
 The rare runtime-self-contained entrypoint exception must be literally required for
 execution and must explain why sibling imports cannot work.

package/dist/host/agents/skills/orkestrel-harden-package/references/research.md

@@ -48,6 +48,8 @@ Classify each row:
 
 “Deferred” is not a final classification for in-scope work.
 
+A defect found after its row closed is not in-scope work of this matrix. Record it against the capability it belongs to and carry it into the next matrix — unless it falsifies its row's claim through a path this package itself ships, which makes it this matrix's repair.
+
 ## Convert evidence into design
 
 Before implementation: