@orkestrel/scaffold 0.0.3 → 0.0.5

package/dist/host/codex/config.toml

@@ -37,12 +37,14 @@ Work directly for trivial tasks. For non-trivial work: send the reading to grok;
 planner (Opus 5, subjective) and analyst (Sol, objective) on the
 SAME design brief in parallel without showing either the other's answer, then
 reconcile them into one plan; plan bounded units with disjoint ownership; route each
-nontrivial unit to implementer (Sol), reserving builder/application for fully
+nontrivial unit to implementer (Sol) or the opus implementation bridge (Opus 5) —
+whichever engine fits the unit — reserving builder/application for fully
 specified taste-free mechanics; integrate
 shared files serially; obtain an independent reviewer (Opus 5) design audit and an
 independent analyst (Sol) correctness audit plus a checker conformance pass; then
-run one verifier. Parallelize only independent units. Writing agents use worktrees or
-disjoint owned files and never run tree-wide mutating commands concurrently.
+run one verifier. Parallelize only independent units. Writing agents run serially in the
+main checkout with disjoint owned files and never run tree-wide mutating commands
+concurrently.
 
 Every dispatch includes objective, context, AGENTS.md, applicable rules, governing
 skill name/path and required references (or explicit none), guide/spec, owned and

package/dist/host/cursor/mcp.json

@@ -0,0 +1,12 @@
+{
+	"mcpServers": {
+		"codex": {
+			"command": "codex",
+			"args": ["mcp-server"]
+		},
+		"claude": {
+			"command": "claude",
+			"args": ["mcp", "serve"]
+		}
+	}
+}

package/dist/host/dotfiles/mcp.json

@@ -0,0 +1,8 @@
+{
+	"mcpServers": {
+		"codex": {
+			"command": "codex",
+			"args": ["mcp-server"]
+		}
+	}
+}

package/dist/host/guides/src/scaffold.md

@@ -133,6 +133,7 @@ From [`types.ts`](../../src/core/types.ts).
 | `BuildFormat`          | type      |
 | `SrcDefinition`        | interface |
 | `AppDefinition`        | interface |
+| `ViteMachinery`        | interface |
 | `Origin`               | type      |
 | `Group`                | type      |
 | `Category`             | type      |
@@ -183,6 +184,12 @@ is `'INVALID' | 'BLOCKED' | 'DESTROYED' | 'TARGET' | 'WRITE' | 'FETCH'`.
 environment contributes, its test-project label, and — on the `src` axis — its `exports` subpath
 and build formats, or — on the `app` axis — its optional runtime entry.
 
+`ViteMachinery` names the three host-specific pipelines a workspace's generated `vite.config.ts` may
+carry: `browser` for the CSS pipeline and the Playwright-backed browser test project, `vue` for the
+single-file-component, HTML, and development-server machinery an application browser environment
+needs, and `output` for build-output containment. It never selects a boundary guarantee — those ship
+in every shape, as the compilers section sets out.
+
 `Blueprint` is the closed input spec:
 
 ```ts
@@ -946,6 +953,7 @@ From [`compilers.ts`](../../src/core/compilers.ts).
 | `devDependenciesFor`    | function |
 | `packageManifest`       | function |
 | `rootTsconfig`          | function |
+| `viteMachinery`         | function |
 | `viteHeader`            | function |
 | `policyViteProject`     | function |
 | `singleSrcViteConfig`   | function |
@@ -987,10 +995,33 @@ optional metadata, and engines.
 `rootTsconfig` emits the root compiler options and one path alias per declared environment;
 `coreTsconfig`, `srcTsconfig`, and `appTsconfig` emit the scoped configurations that remove the
 wrong host's globals from each environment. `viteHeader` renders the shared header — the alias block
-derived from the tsconfig paths, plus the environment-boundary plugin. `coreViteConfig`,
-`srcViteConfig`, and `appViteConfig` emit the thin per-target wrappers; `rootViteConfig`,
-`singleSrcViteConfig`, and `applicationViteConfig` emit the root configuration for a
-library-only, single non-core `src` environment, and application-bearing workspace respectively;
+derived from the tsconfig paths, plus the environment-boundary plugin — and `viteMachinery` is the
+one place the header's axes are derived, read by `rootViteConfig`, `singleSrcViteConfig`,
+`applicationViteConfig`, and `configArtifacts` alike so no caller can invent a fourth answer.
+
+**The boundary guarantees do not vary by blueprint.** Every generated `vite.config.ts` — a
+`core`-only library, an application of `app/core` alone, or the full six-environment workspace —
+emits `environmentBoundary`, its `resolveId` / `load` / `buildEnd` walks, the module-graph AST audit
+(`environmentAssetSources`, `parseSync`, `Visitor`), and stylesheet rejection (`isStylesheetPath`
+plus its `environmentPathError` / `environmentSourceError` clauses). Those enforce owner-independent
+laws: core stays host-independent whatever else the workspace declares, a server module never
+imports a stylesheet, and a `@vite-ignore` dynamic import — which `resolveId` never sees and the
+module graph never records — has no other enforcement point. Only host-specific pipelines vary,
+along the three `ViteMachinery` axes:
+
+| Machinery                                                         | Emitted when                         |
+| ----------------------------------------------------------------- | ------------------------------------ |
+| CSS pipeline (`ENVIRONMENT_CSS`, `preprocessCSS`, `isCSSRequest`) | a `src` or `app` browser environment |
+| Playwright provider and `hasChromium`                             | a `src` or `app` browser environment |
+| Vue plugin, HTML boundary, browser development server             | an `app` browser environment         |
+| Output containment (`outputBoundary`, `enforceOutputPath`)        | anything the workspace builds        |
+
+An application of `app/core` alone is the sole shape that builds nothing, so it is the sole shape
+without output containment — and it still carries every boundary guarantee above.
+
+`coreViteConfig`, `srcViteConfig`, and `appViteConfig` emit the thin per-target wrappers;
+`rootViteConfig`, `singleSrcViteConfig`, and `applicationViteConfig` emit the root configuration for
+a library-only, single non-core `src` environment, and application-bearing workspace respectively;
 `policyViteProject` emits the dedicated Node-only repository-policy test project.
 
 `configArtifacts`, `sourceArtifacts`, `applicationArtifacts`, `testArtifacts`, and `guideArtifacts`
@@ -1924,6 +1955,7 @@ import {
 	srcTsconfig,
 	srcViteConfig,
 	viteHeader,
+	viteMachinery,
 } from '@orkestrel/scaffold'
 
 rootTsconfig(['core'], ['core', 'server'])
@@ -1931,7 +1963,9 @@ coreTsconfig()
 srcTsconfig('server')
 appTsconfig('browser', true)
 
-viteHeader(true, true) // the shared header, with browser and Vue support
+viteMachinery(['core']) // { browser: false, vue: false, output: true }
+viteMachinery([], ['core', 'browser']) // { browser: true, vue: true, output: true }
+viteHeader(viteMachinery([], ['core', 'browser'])) // the shared header, with browser and Vue support
 coreViteConfig()
 srcViteConfig('browser')
 appViteConfig('server')

package/dist/host/manifest.json

@@ -90,6 +90,11 @@
 			"destination": ".claude/agents/grok.md",
 			"executable": false
 		},
+		{
+			"storage": "claude/agents/implementer.md",
+			"destination": ".claude/agents/implementer.md",
+			"executable": false
+		},
 		{
 			"storage": "claude/agents/orkestrel.md",
 			"destination": ".claude/agents/orkestrel.md",
@@ -215,6 +220,11 @@
 			"destination": ".codex/agents/implementer.toml",
 			"executable": false
 		},
+		{
+			"storage": "codex/agents/opus.toml",
+			"destination": ".codex/agents/opus.toml",
+			"executable": false
+		},
 		{
 			"storage": "codex/agents/orkestrel.toml",
 			"destination": ".codex/agents/orkestrel.toml",
@@ -240,6 +250,11 @@
 			"destination": ".codex/config.toml",
 			"executable": false
 		},
+		{
+			"storage": "cursor/mcp.json",
+			"destination": ".cursor/mcp.json",
+			"executable": false
+		},
 		{
 			"storage": "dotfiles/editorconfig",
 			"destination": ".editorconfig",
@@ -255,6 +270,11 @@
 			"destination": ".gitignore",
 			"executable": false
 		},
+		{
+			"storage": "dotfiles/mcp.json",
+			"destination": ".mcp.json",
+			"executable": false
+		},
 		{
 			"storage": "dotfiles/oxfmtrc.json",
 			"destination": ".oxfmtrc.json",
@@ -347,6 +367,7 @@
 		".claude/skills/orkestrel-harden-package",
 		".codex",
 		".codex/agents",
+		".cursor",
 		"guides",
 		"guides/src",
 		"scripts",

package/dist/host/tests/setupPolicy.ts

@@ -13,6 +13,7 @@ export const CENTRAL_SOURCE_FILES: readonly string[] = Object.freeze([
 	'factories.ts',
 	'helpers.ts',
 	'handlers.ts',
+	'inferers.ts',
 	'middlewares.ts',
 	'parsers.ts',
 	'relations.ts',
@@ -33,6 +34,7 @@ export const FUNCTION_SOURCE_FILES: readonly string[] = Object.freeze([
 	'factories.ts',
 	'handlers.ts',
 	'helpers.ts',
+	'inferers.ts',
 	'middlewares.ts',
 	'parsers.ts',
 	'relations.ts',
@@ -100,6 +102,23 @@ export function isDirectCallback(node: ts.ArrowFunction | ts.FunctionExpression)
 	)
 }
 
+/**
+ * Whether an arrow/function expression is returned directly as a factory or combinator result.
+ *
+ * @param node - The function expression to inspect
+ * @returns `true` when the node is a direct return value, including one parenthesized layer
+ */
+export function isDirectReturn(node: ts.ArrowFunction | ts.FunctionExpression): boolean {
+	const parent = node.parent
+	if (ts.isReturnStatement(parent)) return true
+	if (ts.isArrowFunction(parent) && parent.body === node) return true
+	if (!ts.isParenthesizedExpression(parent)) return false
+	const container = parent.parent
+	return (
+		ts.isReturnStatement(container) || (ts.isArrowFunction(container) && container.body === parent)
+	)
+}
+
 /** Whether a function expression is assigned by one module-scope variable declaration. */
 export function isModuleFunction(node: ts.ArrowFunction | ts.FunctionExpression): boolean {
 	const declaration = node.parent
@@ -113,6 +132,18 @@ export function isModuleFunction(node: ts.ArrowFunction | ts.FunctionExpression)
 	)
 }
 
+/**
+ * Format a syntax node's source position as a one-based line and character.
+ *
+ * @param node - The syntax node whose starting position to format
+ * @returns The node's one-based `line:character` position
+ */
+export function formatPolicyPosition(node: ts.Node): string {
+	const source = node.getSourceFile()
+	const position = source.getLineAndCharacterOfPosition(node.getStart())
+	return `${String(position.line + 1)}:${String(position.character + 1)}`
+}
+
 /** Whether a property signature belongs to a centralized interface or type alias contract. */
 export function isContractProperty(node: ts.PropertySignature): boolean {
 	let parent: ts.Node = node.parent
@@ -162,10 +193,10 @@ export function inspectCodingNode(path: string, node: ts.Node, violations: strin
 		ts.isTypeAssertionExpression(node) ||
 		ts.isNonNullExpression(node)
 	) {
-		violations.push(`${path}:${node.getStart()} forbids type/non-null assertions`)
+		violations.push(`${path}:${formatPolicyPosition(node)} forbids type/non-null assertions`)
 	}
 	if (node.kind === ts.SyntaxKind.AnyKeyword) {
-		violations.push(`${path}:${node.getStart()} forbids any`)
+		violations.push(`${path}:${formatPolicyPosition(node)} forbids any`)
 	}
 	if (
 		(ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) &&
@@ -173,14 +204,14 @@ export function inspectCodingNode(path: string, node: ts.Node, violations: strin
 		ts.isStringLiteral(node.moduleSpecifier) &&
 		isUnsupportedModuleSpecifier(node.moduleSpecifier.text)
 	) {
-		violations.push(`${path}:${node.getStart()} forbids non-Node URL module specifiers`)
+		violations.push(`${path}:${formatPolicyPosition(node)} forbids non-Node URL module specifiers`)
 	}
 	if (
 		ts.isPropertySignature(node) &&
 		isContractProperty(node) &&
 		!hasModifier(node, ts.SyntaxKind.ReadonlyKeyword)
 	) {
-		violations.push(`${path}:${node.getStart()} requires readonly contract properties`)
+		violations.push(`${path}:${formatPolicyPosition(node)} requires readonly contract properties`)
 	}
 	if (
 		ts.isCallExpression(node) &&
@@ -188,7 +219,7 @@ export function inspectCodingNode(path: string, node: ts.Node, violations: strin
 		(node.arguments.length !== 1 || !node.arguments.every(ts.isStringLiteral))
 	) {
 		violations.push(
-			`${path}:${node.getStart()} requires dynamic imports to use string literals so import policy remains enforceable`,
+			`${path}:${formatPolicyPosition(node)} requires dynamic imports to use string literals so import policy remains enforceable`,
 		)
 	}
 	if (
@@ -198,17 +229,18 @@ export function inspectCodingNode(path: string, node: ts.Node, violations: strin
 		node.arguments.every(ts.isStringLiteral) &&
 		isUnsupportedModuleSpecifier(node.arguments[0]?.text ?? '')
 	) {
-		violations.push(`${path}:${node.getStart()} forbids non-Node URL module specifiers`)
+		violations.push(`${path}:${formatPolicyPosition(node)} forbids non-Node URL module specifiers`)
 	}
 	if (ts.isFunctionDeclaration(node) && !ts.isSourceFile(node.parent)) {
-		violations.push(`${path}:${node.getStart()} forbids nested function declarations`)
+		violations.push(`${path}:${formatPolicyPosition(node)} forbids nested function declarations`)
 	}
 	if (
 		(ts.isArrowFunction(node) || ts.isFunctionExpression(node)) &&
 		!isDirectCallback(node) &&
+		!isDirectReturn(node) &&
 		!isModuleFunction(node)
 	) {
-		violations.push(`${path}:${node.getStart()} forbids hidden function assignments`)
+		violations.push(`${path}:${formatPolicyPosition(node)} forbids hidden function assignments`)
 	}
 	ts.forEachChild(node, (child) => inspectCodingNode(path, child, violations))
 }
@@ -290,14 +322,18 @@ export function inspectCodingLaw(path: string, content: string): readonly string
 					!ts.isIdentifier(declaration.name) ||
 					!/^[A-Z][A-Z0-9_]*$/u.test(declaration.name.text)
 				) {
-					violations.push(`${path}:${declaration.getStart()} requires UPPER_SNAKE_CASE constants`)
+					violations.push(
+						`${path}:${formatPolicyPosition(declaration)} requires UPPER_SNAKE_CASE constants`,
+					)
 				}
 				if (
 					declaration.initializer !== undefined &&
 					(ts.isArrayLiteralExpression(declaration.initializer) ||
 						ts.isObjectLiteralExpression(declaration.initializer))
 				) {
-					violations.push(`${path}:${declaration.getStart()} freezes collection constants`)
+					violations.push(
+						`${path}:${formatPolicyPosition(declaration)} freezes collection constants`,
+					)
 				}
 			}
 		}
@@ -321,7 +357,7 @@ export function inspectCodingLaw(path: string, content: string): readonly string
 		}
 		for (const member of classes[0]?.members ?? []) {
 			if (hasModifier(member, ts.SyntaxKind.PrivateKeyword)) {
-				violations.push(`${path}:${member.getStart()} uses runtime # privacy`)
+				violations.push(`${path}:${formatPolicyPosition(member)} uses runtime # privacy`)
 			}
 		}
 	}