@orkestrel/scaffold 0.0.27 → 0.0.28

package/dist/host/claude/rules/workspace.md

@@ -110,12 +110,21 @@ environment:
 The second axis is cross-cutting workspace proofs. Each one covers the whole workspace rather than
 one environment, so each is its own project:
 
-| Project       | Files                       | Proves                                                         | In `test` |
-| ------------- | --------------------------- | -------------------------------------------------------------- | --------- |
-| `policy`      | `tests/policy.test.ts`      | Every source file obeys the syntactic coding and placement law | Yes       |
-| `config`      | `tests/config.test.ts`      | Root configuration resolves its aliases, projects, and outputs | Yes       |
-| `guides`      | `tests/guides.test.ts`      | Every documented API exists and every public API is documented | Yes       |
-| `integration` | `tests/integration.test.ts` | The built package works when installed and driven from outside | No        |
+| Project       | Files                        | Proves                                                          | In `test` |
+| ------------- | ---------------------------- | --------------------------------------------------------------- | --------- |
+| `policy`      | `tests/policy.test.ts`       | Every source file obeys the syntactic coding and placement law  | Yes       |
+| `config`      | `tests/config.test.ts`       | Root configuration resolves its aliases, projects, and outputs  | Yes       |
+| `guides`      | `tests/guides.test.ts`       | Every documented API exists and every public API is documented  | Yes       |
+| `conformance` | `tests/conformance.test.ts`  | Where this package drifts from the official tooling it tracks   | Yes       |
+| `integration` | `tests/integration.test.ts`  | The built package works when installed and driven from outside  | No        |
+| `service`     | `tests/service/**/*.test.ts` | The live external services this package drives, driven for real | No        |
+
+`conformance` and `service` are two subjects, not two names for one. `conformance` measures this
+package against an official artifact it stays compatible with and drives nothing external: the
+tooling it measures against is installed, and any server it drives is one the proof starts itself.
+That is what makes it hermetic and keeps it in `test`. `service` drives the real thing, so it takes
+`tests/setupService.ts` for readiness, longer timeouts, and no file parallelism, and it leaves
+`test` for `prepublishOnly`.
 
 One project sits on neither axis. `probe` includes `tmp/probe/**/*.test.ts` so an agent can run a
 throwaway instrument against real sources, aliases and setup. Declare no proof there. Every test
@@ -123,8 +132,9 @@ script names its project, so no gate runs it; its directory is ignored by git; a
 `.claude/rules/tests.md` governs what may live there.
 
 - Define a cross-cutting project only for a proof the package actually has.
-- A live-service project is the fifth kind. It is named for the service it drives, and
-  `.claude/rules/tests.md` governs it.
+- A live-service project is the fifth kind. It is the `service` project above, `scripts/service.sh`
+  provisions what it drives, and `.claude/rules/tests.md` governs it. Name it `service` whatever it
+  drives.
 - A project leaves the default run for one of two reasons: it drives a live external service, or it
   is hermetic but slow — it spawns processes, packs, installs, or drives a real build.
 - Every isolated project has its own script, is excluded from `test`, and runs in `prepublishOnly`.
@@ -137,7 +147,7 @@ Setup assets:
 
 Scope with `test:src`, `test:src:core`, `test:app`, `test:app:server`, and equivalent scripts. Each
 cross-cutting project has its own script too: `test:policy`, `test:config`, `test:guides`,
-`test:integration`.
+`test:conformance`, `test:integration`, `test:service`.
 
 ## Typechecking and environment isolation
 
@@ -211,3 +221,4 @@ Run `show` only **after** formatting. The committed `demo/showcase.html` is gene
 - Store text as UTF-8.
 - Before accepting broad generated or migrated edits, scan changed text for replacement characters, mojibake, unintended control characters, and accidental trailing debris.
 - Preserve intentional Unicode punctuation and symbols; do not “clean” valid text merely because it is non-ASCII.
+- Never renormalize Unicode while rewriting a file. Retyping a line can silently fold a decomposed sequence into its precomposed form — `e` + U+0301 becoming U+00E9 — and the two render identically, so the diff reads as a no-op and review sees nothing. Where the exact code points are the subject, as in an encoding or transport proof, that fold deletes the case the test exists for while leaving it green and named. Move such a line rather than retyping it, and compare bytes with `od -c` or a code-point dump rather than by eye.

package/dist/host/guides/scaffold.md

@@ -92,6 +92,7 @@ Exported from `@orkestrel/scaffold`, and reachable from
 | `BIN_ENTRY_PATH`                  | const | The executable entry whose presence makes a workspace `bin`.                                     |
 | `CATALOG_AGENT_PATH`              | const | The agent file whose marker-bounded package table the catalog verb alone owns.                   |
 | `CONFIG_TEMPLATES`                | const | Formatter-stable template text for every configuration artifact.                                 |
+| `CONFORMANCE_TEST_PATH`           | const | The official-tooling drift proof whose presence makes a workspace `conformance`.                 |
 | `CONTROL_CHARACTER_PATTERN`       | const | Unicode controls, formatting controls, and line and paragraph separators rejected in text.       |
 | `DEFAULT_ENGINES`                 | const | The `engines.node` range a workspace starts with.                                                |
 | `DEFAULT_VERSION`                 | const | The version a workspace starts at.                                                               |
@@ -124,6 +125,8 @@ Exported from `@orkestrel/scaffold`, and reachable from
 | `ORCHESTRATION_PATH_PREFIXES`     | const | The path prefixes whose contents instruct or wire an agent, frozen.                              |
 | `ORKESTREL_RANGE_PATTERN`         | const | The exact caret-pinned pre-1.0 range accepted for an `@orkestrel/*` runtime dependency.          |
 | `SERVICE_SCRIPT_PATH`             | const | The provisioner skeleton a workspace with declared service vendors is given once.                |
+| `SERVICE_SETUP_PATH`              | const | The live-service readiness module whose presence makes a workspace `service`.                    |
+| `SERVICE_TEST_INCLUDE`            | const | The include the live-service project covers, which is a directory rather than one proof.         |
 | `SHOWCASE_CONFIG_PATH`            | const | The Vite wrapper whose presence makes a workspace `showcase`.                                    |
 | `SHOWCASE_DEV_DEPENDENCIES`       | const | The development dependency used only by the optional single-file showcase build.                 |
 | `SOURCE_BROWSER_DEV_DEPENDENCIES` | const | The development dependencies a published browser `src` environment adds.                         |
@@ -456,25 +459,33 @@ workspace would otherwise declare a dependency that does not resolve.
 
 `new --bin` creates the executable entry, its test, and its scoped Vite and TypeScript wrappers.
 The other structural facts do not need creation flags. Add `tests/integration.test.ts` for
-`integration`, `tests/setupGlobal.ts` for `global`, and
-`configs/app/vite.showcase.config.ts` for `showcase`; reading verbs detect each exact-case file and
-register its fixed machinery. Add `scripts/service.sh` for `services`. Reading verbs preserve and
-protect that birth-owned script, but do not infer its service list from edited text.
+`integration`, `tests/conformance.test.ts` for `conformance`, `tests/setupService.ts` for `service`,
+`tests/setupGlobal.ts` for `global`, and `configs/app/vite.showcase.config.ts` for `showcase`;
+reading verbs detect each exact-case file and register its fixed machinery. Add `scripts/service.sh`
+for `vendors`. Reading verbs preserve and protect that birth-owned script, but do not infer its
+vendor list from edited text.
 
 ### Reading a target
 
 `audit`, `repair`, `catalog`, and `overwrite` derive the blueprint from the target itself. The name
 and the declared `@orkestrel/*` packages come from `package.json`. The two environment axes come
 from the directories the target actually ships, because a directory is the fact and a declaration
-beside it could disagree. Four more facts come from exact-case files: `src/bin/main.ts` selects
-`bin`, `tests/integration.test.ts` selects `integration`, `tests/setupGlobal.ts` selects `global`,
+beside it could disagree. Six more facts come from exact-case files: `src/bin/main.ts` selects
+`bin`, `tests/integration.test.ts` selects `integration`, `tests/conformance.test.ts` selects
+`conformance`, `tests/setupService.ts` selects `service`, `tests/setupGlobal.ts` selects `global`,
 and `configs/app/vite.showcase.config.ts` selects `showcase`. A containing directory does not select
 the fact by itself.
 
-`services` is not reconstructed. Its only artifact, `scripts/service.sh`, is birth-owned, so edited
-script text is not a trustworthy declaration of a service list. A present script remains in the
+`vendors` is not reconstructed. Its only artifact, `scripts/service.sh`, is birth-owned, so edited
+script text is not a trustworthy declaration of a vendor list. A present script remains in the
 target and remains protected from deletion through the owned scripts inventory, but a reading verb
-does not infer services from it.
+does not infer vendors from it.
+
+That is why the live-service project follows `service` rather than `vendors`. A reading verb has to
+plan the project before it can say anything about a target that runs one, and a vendor list it
+cannot recover would leave every such workspace unplannable. `tests/setupService.ts` is recoverable,
+is the module the root configuration names by path, and is what a live proof needs anyway, so it
+carries the fact and the vendor list keeps its own separate job.
 
 The root Vite configuration always defines the fixed `guides` project and selects it at
 configuration load only when `tests/guides.test.ts` is a physical file with that exact path case. A
@@ -560,9 +571,16 @@ because the shape is chosen once and read afterwards: `new` refuses the advisory
 `repair` need the plan to describe and restore a target that already has that shape. A library
 caller creating a workspace holds the same refusal, and the Compile section below states it.
 
-`bin`, `integration`, `services`, `global`, and `showcase` are structural facts. Each is set only
-when the workspace physically ships the directory or exact-case file that defines it, never because
-of the workspace's name and never because a sibling fact is set.
+`bin`, `integration`, `conformance`, `service`, `vendors`, `global`, and `showcase` are structural
+facts. Each is set only when the workspace physically ships the directory or exact-case file that
+defines it, never because of the workspace's name and never because a sibling fact is set.
+
+`service` says the workspace runs a live-service Vitest project over `tests/service`, and it alone
+registers that project, its `test:service` script, and the `tests/setupService.ts` readiness module
+the project names. `vendors` names each external service the workspace drives and emits
+`scripts/service.sh`, the provisioner that starts them. Neither is derivable from the other: a
+workspace may declare vendors before it writes a suite, and a suite may drive a service the skeleton
+does not start.
 
 An axis-dependent structural fact projects only when its required axis exists. `integration`
 projects a published `src`, and `showcase` projects the browser `app` environment. When that axis is
@@ -674,7 +692,8 @@ barrels, the tests, `README.md`, and `guides/README.md` are written once and are
 a later verb.
 
 Content ownership does not preserve an arbitrary custom Vitest project. Fixed optional proofs are
-selected by their defining paths, as `guides` is. A workspace that needs other local configuration
+selected by their defining paths, as `guides`, `conformance`, and `service` are. A workspace that
+needs other local configuration
 must keep those edits outside a content-owned file; `repair` restores that file to the canonical
 project set.
 
@@ -960,7 +979,7 @@ are thrown, so an observer sees a refusal even where the caller catches it.
 
 ## Limits
 
-Six things a reader will look for and not find.
+Seven things a reader will look for and not find.
 
 **A code fence in this guide is unverified.** [`tests/guides.test.ts`](../tests/guides.test.ts)
 proves that every fence imports only real exports of the two barrels, and that every backticked name
@@ -1012,6 +1031,30 @@ nothing. This is deliberate: a generated sample entity is repeatedly mistaken fo
 implementation. What a consumer does first is write the module's `types.ts`, then the
 implementation that conforms to it, then export both from the barrel — the order `AGENTS.md` fixes.
 
+**A conformance or live-service proof is registered, but neither is written for you.** Scaffold
+registers the `conformance` and `service` projects, their scripts, and the gate each belongs to. It
+emits no proof into either, because both name something only the package knows: the official
+artifact a conformance check measures against, and the service a live proof drives. A generated
+placeholder would read as a proof while measuring nothing, so the file a consumer writes is the file
+that selects the project.
+
+The consequence is one empty-project case in each direction. A blueprint carrying `conformance` with
+no `tests/conformance.test.ts` registers a project whose include resolves to nothing, and Vitest
+exits non-zero on it. A blueprint carrying `service` gets `tests/setupService.ts` — the root
+configuration names that module by path, so an absent one fails the project's load rather than its
+run — and still no suite beneath `tests/service`, so `test:service` reports no test files until the
+consumer writes the first one. Both cases are visible the first time the script runs, which is why
+neither is silent.
+
+Neither project folds into `integration`, which means something narrower: the built package works
+when installed and driven from outside. Two fleet packages hold the distinction. `@orkestrel/ollama`
+drives a real Ollama daemon through a `service` project, so a real service answers it and it runs
+from `prepublishOnly`. `@orkestrel/mcp` measures its server against the specification's own runner,
+`@modelcontextprotocol/conformance`, through a `conformance` project. It pins that runner as a
+development dependency and resolves it out of `node_modules`, and the server the runner drives is
+one the fixture starts itself on a loopback port, so the run drives nothing external and stays in
+`test`.
+
 ## Tests
 
 - [`tests/src/core/Compiler.test.ts`](../tests/src/core/Compiler.test.ts) — the three stages, the

package/dist/host/tests/config.test.ts

@@ -102,13 +102,22 @@ describe('root configuration', () => {
 				setup: ['./tests/setup.ts', './tests/setupServer.ts'],
 			})
 		}
-		for (const label of ['policy', 'config', 'guides', 'integration']) {
+		for (const label of ['policy', 'config', 'guides', 'conformance', 'integration']) {
 			if (!existsSync(resolve(root, `tests/${label}.test.ts`))) continue
 			expected.set(label, {
 				include: `tests/${label}.test.ts`,
 				setup: ['./tests/setup.ts'],
 			})
 		}
+		// The live-service project covers a directory rather than one proof, so its
+		// readiness module is the fact that selects it. A suite beneath
+		// `tests/service` with no setup module is a project nothing configures.
+		if (existsSync(resolve(root, 'tests/setupService.ts'))) {
+			expected.set('service', {
+				include: 'tests/service/**/*.test.ts',
+				setup: ['./tests/setup.ts', './tests/setupService.ts'],
+			})
+		}
 		expected.set('probe', { include: 'tmp/probe/**/*.test.ts', setup: ['./tests/setup.ts'] })
 		// A row that is a configuration rather than a factory. A workspace with a
 		// browser application emits one, because that factory refuses overrides and
@@ -353,8 +362,35 @@ describe('root configuration', () => {
 		const test = Object.getOwnPropertyDescriptor(scripts, 'test')?.value
 		const config = Object.getOwnPropertyDescriptor(scripts, 'test:config')?.value
 		const integration = Object.getOwnPropertyDescriptor(scripts, 'test:integration')?.value
+		const conformance = Object.getOwnPropertyDescriptor(scripts, 'test:conformance')?.value
+		const service = Object.getOwnPropertyDescriptor(scripts, 'test:service')?.value
 		const publish = Object.getOwnPropertyDescriptor(scripts, 'prepublishOnly')?.value
 		const hasIntegration = existsSync(resolve(root, 'tests/integration.test.ts'))
+		// The optional proofs are read off the registered project set rather than off
+		// their files, because the defect this measures is a registered project no
+		// gate runs. A project selected by a path that is not yet there is still
+		// registered, and it is exactly the one whose script goes missing.
+		const rows = configuration.test?.projects
+		if (!Array.isArray(rows)) throw new Error('The root configuration carries no projects')
+		const registered = new Set<string>()
+		for (const row of rows) {
+			if (typeof row === 'function') {
+				registered.add(row.name)
+				continue
+			}
+			if (typeof row !== 'object' || row === null) continue
+			const block: unknown = Object.getOwnPropertyDescriptor(row, 'test')?.value
+			if (typeof block !== 'object' || block === null) continue
+			const named: unknown = Object.getOwnPropertyDescriptor(block, 'name')?.value
+			if (typeof named !== 'object' || named === null) continue
+			const label: unknown = Object.getOwnPropertyDescriptor(named, 'label')?.value
+			if (typeof label === 'string') registered.add(label)
+		}
+		// The population must be able to answer both ways before either answer counts.
+		expect(registered.has('config')).toBe(true)
+		expect(registered.has('control')).toBe(false)
+		const hasConformance = registered.has('conformance')
+		const hasService = registered.has('service')
 		expect(config).toBe(
 			'vitest run --config vite.config.ts --no-cache --reporter=dot --project config',
 		)
@@ -368,6 +404,25 @@ describe('root configuration', () => {
 		expect(typeof publish === 'string' && publish.includes('npm run test:integration')).toBe(
 			hasIntegration,
 		)
+		// A registered project no gate runs is a proof that never executes, and it
+		// never fails, so the suite reports green while carrying it. Conformance is
+		// hermetic and belongs to `test`; the live-service project drives a real
+		// service and belongs to `prepublishOnly` alone.
+		expect(conformance).toBe(
+			hasConformance
+				? 'vitest run --config vite.config.ts --no-cache --reporter=dot --project conformance'
+				: undefined,
+		)
+		expect(typeof test === 'string' && test.includes('npm run test:conformance')).toBe(
+			hasConformance,
+		)
+		expect(service).toBe(
+			hasService
+				? 'vitest run --config vite.config.ts --no-cache --reporter=dot --project service'
+				: undefined,
+		)
+		expect(typeof test === 'string' && test.includes('test:service')).toBe(false)
+		expect(typeof publish === 'string' && publish.includes('npm run test:service')).toBe(hasService)
 	})
 })
 

package/dist/src/core/index.cjs

@@ -201,6 +201,12 @@ var GLOBAL_SETUP_PATH = "tests/setupGlobal.ts";
 var GUIDES_TEST_PATH = "tests/guides.test.ts";
 /** The installed-package proof whose presence makes a workspace `integration`. */
 var INTEGRATION_TEST_PATH = "tests/integration.test.ts";
+/** The official-tooling drift proof whose presence makes a workspace `conformance`. */
+var CONFORMANCE_TEST_PATH = "tests/conformance.test.ts";
+/** The live-service readiness module whose presence makes a workspace `service`. */
+var SERVICE_SETUP_PATH = "tests/setupService.ts";
+/** The include the live-service project covers, which is a directory rather than one proof. */
+var SERVICE_TEST_INCLUDE = "tests/service/**/*.test.ts";
 /** The Vite wrapper whose presence makes a workspace `showcase`. */
 var SHOWCASE_CONFIG_PATH = "configs/app/vite.showcase.config.ts";
 /** The bare workspace name syntax: lowercase alphanumeric with hyphens, letter first. */
@@ -284,7 +290,7 @@ var DEFAULT_ENGINES = `>=${MINIMUM_NODE_VERSION}`;
 var BASE_DEV_DEPENDENCIES = Object.freeze({
 	"@microsoft/api-extractor": "^7.58.12",
 	"@orkestrel/guide": "^0.0.10",
-	"@orkestrel/scaffold": "^0.0.27",
+	"@orkestrel/scaffold": "^0.0.28",
 	"@types/node": "^26.2.0",
 	oxfmt: "^0.62.0",
 	oxlint: "^1.77.0",
@@ -676,6 +682,44 @@ export function appBrowser(...options: never[]): UserConfig {
 		},
 		options ?? {},
 	)
+`,
+		conformance: `// Where this package drifts from the official tooling it stays compatible with.
+// The subject is this package, so the proof is hermetic and stays in \`npm test\`.
+export const conformance = (options?: UserConfig): UserConfig =>
+	mergeConfig(
+		{
+			resolve,
+			test: {
+				name: { label: 'conformance', color: 'magenta' },
+				include: ['${CONFORMANCE_TEST_PATH}'],
+				setupFiles: ['./tests/setup.ts'],
+				environment: 'node',
+				browser: { enabled: false },
+			},
+		},
+		options ?? {},
+	)
+`,
+		service: `// The live external services this package drives. It starts nothing itself:
+// \`scripts/service.sh\` provisions, \`tests/setupService.ts\` proves readiness, and
+// the project stays out of \`npm test\` because a real service answers it.
+export const service = (options?: UserConfig): UserConfig =>
+	mergeConfig(
+		{
+			resolve,
+			test: {
+				name: { label: 'service', color: 'red' },
+				include: ['${SERVICE_TEST_INCLUDE}'],
+				setupFiles: ['./tests/setup.ts', './tests/setupService.ts'],
+				environment: 'node',
+				browser: { enabled: false },
+				testTimeout: 120_000,
+				hookTimeout: 120_000,
+				fileParallelism: false,
+			},
+		},
+		options ?? {},
+	)
 `,
 		probe: `// A workbench, not a proof. No gate selects this project.
 export const probe = (options?: UserConfig): UserConfig =>
@@ -1150,7 +1194,7 @@ npm test
 set -eu
 
 printf '%s\\n' \\
-{{services}}
+{{vendors}}
 ` })
 });
 //#endregion
@@ -1437,7 +1481,9 @@ var isBlueprint = (0, _orkestrel_contract.recordOf)({
 	overrides: (0, _orkestrel_contract.andOf)(isCollection, (0, _orkestrel_contract.arrayOf)(isOverride)),
 	bin: _orkestrel_contract.isBoolean,
 	integration: _orkestrel_contract.isBoolean,
-	services: (0, _orkestrel_contract.andOf)(isCollection, (0, _orkestrel_contract.arrayOf)(_orkestrel_contract.isString)),
+	conformance: _orkestrel_contract.isBoolean,
+	service: _orkestrel_contract.isBoolean,
+	vendors: (0, _orkestrel_contract.andOf)(isCollection, (0, _orkestrel_contract.arrayOf)(_orkestrel_contract.isString)),
 	global: _orkestrel_contract.isBoolean,
 	showcase: _orkestrel_contract.isBoolean
 }, ["description"]);
@@ -2673,8 +2719,14 @@ function blueprintToDevDependencies(blueprint) {
 * to the axes the blueprint declares: a check and a test script per declared
 * environment, an aggregate over each axis, the policy and configuration
 * proofs every workspace can pass before it has a public API, and one build per
-* target that actually builds. The isolated installed-package integration
-* proof stays out of `test` and runs from `prepublishOnly` instead.
+* target that actually builds.
+*
+* A proof leaves `test` when a real service or a real install answers it. The
+* installed-package integration proof and the live-service proof therefore run
+* from `prepublishOnly` instead. The conformance proof stays in `test`, because
+* it measures this package against official tooling and drives nothing external:
+* a conformance run may start a server, but it starts its own and reaches it
+* over loopback, so the run stays hermetic.
 *
 * The configuration paths interpolated here are the same ones `SRC_MATRIX` and
 * `APP_MATRIX` list as each environment's configuration files, so a rename in
@@ -2721,7 +2773,8 @@ function blueprintToScripts(blueprint) {
 		...compiles ? ["npm run test:src"] : [],
 		...blueprint.app.length > 0 ? ["npm run test:app"] : [],
 		"npm run test:policy",
-		"npm run test:config"
+		"npm run test:config",
+		...blueprint.conformance ? ["npm run test:conformance"] : []
 	].join(" && ");
 	if (compiles) {
 		scripts["test:src"] = [
@@ -2738,8 +2791,10 @@ function blueprintToScripts(blueprint) {
 	}
 	scripts["test:policy"] = `${vitest} --project policy`;
 	scripts["test:config"] = `${vitest} --project config`;
+	if (blueprint.conformance) scripts["test:conformance"] = `${vitest} --project conformance`;
 	scripts["test:probe"] = "vitest run --config vite.config.ts --no-cache --reporter=verbose --project probe";
 	if (integrates) scripts["test:integration"] = `${vitest} --project integration`;
+	if (blueprint.service) scripts["test:service"] = `${vitest} --project service`;
 	scripts.build = [
 		"npm run clean",
 		...compiles ? ["npm run build:src"] : [],
@@ -2769,7 +2824,11 @@ function blueprintToScripts(blueprint) {
 		scripts.serve = "node dist/app/server/main.cjs";
 		scripts["serve:build"] = "npm run build:app:server && npm run serve";
 	}
-	scripts.prepublishOnly = ["npm run format:check && npm run lint:check && npm run check && npm run build && npm test", ...integrates ? ["npm run test:integration"] : []].join(" && ");
+	scripts.prepublishOnly = [
+		"npm run format:check && npm run lint:check && npm run check && npm run build && npm test",
+		...integrates ? ["npm run test:integration"] : [],
+		...blueprint.service ? ["npm run test:service"] : []
+	].join(" && ");
 	return scripts;
 }
 /**
@@ -3051,6 +3110,14 @@ export function appShowcase(...options: never[]): UserConfig {
 	projects.push("config");
 	factories.push(CONFIG_TEMPLATES.factories.guides);
 	projects.push(`...(isExactCaseFile(resolveWorkspacePath('${GUIDES_TEST_PATH}')) ? [guides] : [])`);
+	if (blueprint.conformance) {
+		factories.push(CONFIG_TEMPLATES.factories.conformance);
+		projects.push("conformance");
+	}
+	if (blueprint.service) {
+		factories.push(CONFIG_TEMPLATES.factories.service);
+		projects.push("service");
+	}
 	if (blueprint.src.length > 0 && blueprint.integration) {
 		factories.push((0, _orkestrel_template.fillTemplate)(CONFIG_TEMPLATES.factories.integration, { global: blueprint.global ? "				globalSetup: ['./tests/setupGlobal.ts'],\n" : "" }));
 		projects.push("integration");
@@ -3271,6 +3338,12 @@ function blueprintToSourceArtifacts(blueprint) {
 * workspace and therefore follows the `src` axis as well as its structural
 * flag.
 *
+* The conformance proof is not emitted either, for the reason the guide proof
+* is not: it names an official artifact only the package knows, so a generated
+* placeholder would read as a proof while measuring nothing. `service` emits its
+* readiness setup alone, because the root configuration names that module by
+* path.
+*
 * @example
 * ```ts
 * import { blueprintToTestArtifacts, createBlueprint } from '@orkestrel/scaffold'
@@ -3304,6 +3377,13 @@ function blueprintToTestArtifacts(blueprint) {
 		environment: "server",
 		content: ARTIFACT_TEMPLATES.tests.setup
 	});
+	if (blueprint.service) artifacts.push({
+		path: SERVICE_SETUP_PATH,
+		group: "tests",
+		ownership: "birth",
+		origin: "template",
+		content: ARTIFACT_TEMPLATES.tests.setup
+	});
 	if (blueprint.global) artifacts.push({
 		path: GLOBAL_SETUP_PATH,
 		group: "tests",
@@ -3417,22 +3497,22 @@ function blueprintToDocumentArtifacts(blueprint) {
 * Compile the blueprint-dependent orchestration artifacts.
 *
 * @param blueprint - The workspace specification.
-* @returns A service inventory script when services are declared, otherwise none.
+* @returns A vendor inventory script when vendors are declared, otherwise none.
 *
 * @remarks
-* A service name does not describe startup, readiness, or cleanup. The script
+* A vendor name does not describe startup, readiness, or cleanup. The script
 * therefore records only the declared inventory and does not invent a service
 * runner or test project.
 */
 function blueprintToOrchestrationArtifacts(blueprint) {
-	if (blueprint.services.length === 0) return [];
-	const services = blueprint.services.map((service, index) => `\t'${service}'${index === blueprint.services.length - 1 ? "" : " \\"}`).join("\n");
+	if (blueprint.vendors.length === 0) return [];
+	const vendors = blueprint.vendors.map((vendor, index) => `\t'${vendor}'${index === blueprint.vendors.length - 1 ? "" : " \\"}`).join("\n");
 	return [{
 		path: SERVICE_SCRIPT_PATH,
 		group: "orchestration",
 		ownership: "birth",
 		origin: "template",
-		content: (0, _orkestrel_template.fillTemplate)(ARTIFACT_TEMPLATES.orchestration.service, { services })
+		content: (0, _orkestrel_template.fillTemplate)(ARTIFACT_TEMPLATES.orchestration.service, { vendors })
 	}];
 }
 /**
@@ -3788,19 +3868,19 @@ function blueprintToQuestions(blueprint) {
 		message: "integration projects a published src, and this workspace declares none, so it emits nothing.",
 		blocking: false
 	});
-	const services = /* @__PURE__ */ new Set();
-	for (const service of blueprint.services) {
-		if (!NAME_PATTERN.test(service)) questions.push({
-			field: "services",
-			message: `${service} is not a lowercase alphanumeric service name starting with a letter.`,
+	const vendors = /* @__PURE__ */ new Set();
+	for (const vendor of blueprint.vendors) {
+		if (!NAME_PATTERN.test(vendor)) questions.push({
+			field: "vendors",
+			message: `${vendor} is not a lowercase alphanumeric vendor name starting with a letter.`,
 			blocking: true
 		});
-		else if (services.has(service)) questions.push({
-			field: "services",
-			message: `${service} is declared more than once on services.`,
+		else if (vendors.has(vendor)) questions.push({
+			field: "vendors",
+			message: `${vendor} is declared more than once on vendors.`,
 			blocking: true
 		});
-		services.add(service);
+		vendors.add(vendor);
 	}
 	if (blueprint.showcase && !blueprint.app.includes("browser")) questions.push({
 		field: "showcase",
@@ -4268,8 +4348,8 @@ var Compiler = class {
 * blueprint.
 *
 * @remarks
-* A blueprint is a closed record of sixteen fields, and most of them have one
-* sensible starting value: an empty list, a cleared flag, `DEFAULT_VERSION`, and
+* A blueprint is a closed record, and most of its fields have one sensible
+* starting value: an empty list, a cleared flag, `DEFAULT_VERSION`, and
 * `DEFAULT_ENGINES`. Filling them here is what lets a caller state only what its
 * workspace actually declares.
 *
@@ -4310,7 +4390,9 @@ function createBlueprint(name, input) {
 		overrides: input?.overrides ?? [],
 		bin: input?.bin ?? false,
 		integration: input?.integration ?? false,
-		services: input?.services ?? [],
+		conformance: input?.conformance ?? false,
+		service: input?.service ?? false,
+		vendors: input?.vendors ?? [],
 		global: input?.global ?? false,
 		showcase: input?.showcase ?? false
 	}));
@@ -4347,6 +4429,7 @@ exports.BIN_CONFIGS = BIN_CONFIGS;
 exports.BIN_ENTRY_PATH = BIN_ENTRY_PATH;
 exports.CATALOG_AGENT_PATH = CATALOG_AGENT_PATH;
 exports.CONFIG_TEMPLATES = CONFIG_TEMPLATES;
+exports.CONFORMANCE_TEST_PATH = CONFORMANCE_TEST_PATH;
 exports.CONTROL_CHARACTER_PATTERN = CONTROL_CHARACTER_PATTERN;
 exports.Compiler = Compiler;
 exports.DEFAULT_ENGINES = DEFAULT_ENGINES;
@@ -4380,6 +4463,8 @@ exports.ORCHESTRATION_PATH_NAMES = ORCHESTRATION_PATH_NAMES;
 exports.ORCHESTRATION_PATH_PREFIXES = ORCHESTRATION_PATH_PREFIXES;
 exports.ORKESTREL_RANGE_PATTERN = ORKESTREL_RANGE_PATTERN;
 exports.SERVICE_SCRIPT_PATH = SERVICE_SCRIPT_PATH;
+exports.SERVICE_SETUP_PATH = SERVICE_SETUP_PATH;
+exports.SERVICE_TEST_INCLUDE = SERVICE_TEST_INCLUDE;
 exports.SHOWCASE_CONFIG_PATH = SHOWCASE_CONFIG_PATH;
 exports.SHOWCASE_DEV_DEPENDENCIES = SHOWCASE_DEV_DEPENDENCIES;
 exports.SOURCE_BROWSER_DEV_DEPENDENCIES = SOURCE_BROWSER_DEV_DEPENDENCIES;