@orkestrel/scaffold 0.0.30 → 0.0.31

package/dist/host/agents/orchestration.md

@@ -230,6 +230,16 @@ clobbered edits, formatter and build races, cache phantoms, and validation cross
    invalidates will repair the same drift the other way and report a state that is already false.
    Run it before the units, or after them, or send the decision to every unit in flight per the
    mid-campaign rule under **Dispatch anatomy**. Never beside them.
+8. A fleet pass that records a per-target status commits only the targets it recorded green. Reading
+   "is the tree dirty" instead of "did this target pass" pushes a red target the moment one exists,
+   and a flake makes that look like it worked. Refuse the failed row, name it, and re-run it alone
+   before deciding what it was.
+9. Run a fleet pass in slices that report as they finish, never as one block. A block hides its first
+   failure behind every target that follows, so the failure surfaces after the work it should have
+   stopped. A slice hands control back while most of the fleet is still unstarted.
+10. Re-run a timing or resource failure alone before believing it. Concurrent slices, builds, and
+    suites make a container miss deadlines it meets when idle, so a red result under load is a
+    question rather than an answer.
 
 ## Execution loop
 
@@ -641,17 +651,30 @@ flag is what stops the gate chain running a second time inside the five minutes.
   zero.
 - Re-probe `whoami` immediately before opening the window. A stored credential expires mid-session,
   so a session-start answer does not hold.
-- Surface each approval URL the moment it appears in the log. Say that approving the publish one
-  opens a five-minute window covering the rest of the layer.
+- Surface each approval URL the moment it appears in the log, and take the **last** one in log order.
+  npm mints a new URL whenever an attempt restarts, and the log accumulates every one, so a URL
+  chosen by sorting rather than by position is already dead when the user opens it.
+- Re-read the log before treating an approval as failed. The chain is usually still alive on a newer
+  URL, so surface that one rather than relaunching.
+- A `404` on an approval URL usually means the publish already succeeded and consumed it. Read the
+  registry before calling it a failure.
+- Say that approving the publish one opens a five-minute window covering the rest of the layer.
 
 ### Spending the window
 
 - The window opens when the user approves, not when the first publish starts. Chain every remaining
   publish inside the same process as the gate package, so no human turn sits inside it.
 - Publish serially. Concurrent publishes collide on the auth handshake and fail each other.
-- `EOTP` inside the window is intermittent contention rather than the window closing. Retry each
-  package about three times before recording it failed, and retry a failed set once the layer ends;
-  packages have landed on the third attempt and on a later pass with no new approval.
+- **Never retry a publish that is still waiting for its authorization.** Each `npm publish` attempt
+  mints a new `authId` and invalidates the previous one, so a retry loop makes the URL a moving
+  target the user cannot approve in time. The abandoned poll then reports
+  `403 Forbidden - GET /-/v1/done?authId=…`, which reads as a permissions problem and is two attempts
+  colliding. Publish the first package of a layer with exactly one attempt.
+- Retry only an upload that failed **inside** an already-open window. `EOTP` there is intermittent
+  contention rather than the window closing: retry about three times, and retry a failed set once the
+  layer ends. Packages have landed on the third attempt and on a later pass with no new approval.
+  These are two different failures wearing similar codes; a retry fixes the second and causes the
+  first.
 - Expect a large layer to outlast one window. Size batches to what uploads in five minutes and tell
   the user how many approvals to expect, rather than discovering it mid-run.
 - Read the result from the registry, not from an exit code: a piped `npm publish` reports the exit

package/dist/host/agents/skills/orkestrel-falsify/SKILL.md

@@ -92,6 +92,10 @@ nobody claimed.
   the orchestrator too:** a tree-wide gate run while a round is live sees the auditors' in-flight probes
   and reports a failure nobody caused. Wait for the round, or scope the command to paths no auditor
   owns. Never delete another executor's working file to make your own command pass.
+- **Tell a lane when its own engine wrote the half it is auditing, and tell it to attack that half
+  harder.** A fix round reviewed by the engine that wrote it is the case the round exists to avoid,
+  and where the pass cannot avoid it, naming it is what recovers the round. A clean pass on its own
+  engine's work is the least valuable result a lane can return.
 - Supply the evidence the subject type requires, per the table above.
 - Auditors are read-only and spawn nothing.
 - Blind reports are **immutable**. Nothing an auditor returns is edited, merged, or revised — by
@@ -143,6 +147,14 @@ Follow `references/reconcile.md`. The obligations that are not delegable:
 
 - **Reproduce every sharp finding yourself** before acting on it. An auditor's finding is a
   hypothesis until the orchestrator has run it.
+- **Build before you pack.** `npm pack` runs no build, so it ships whatever `dist/` is on disk. An
+  auditor who packs an artifact to inspect it is reading the last build, not the current source, and
+  will report deleted exports as still shipping. Run the package's build first, and say in the brief
+  that the tarball was built from the commit under audit.
+- **Check the subject before acting on a finding, not only the reasoning.** A brief that names attack
+  vectors teaches the lane those vectors matter, and a lane can hand back the brief's own questions as
+  the subject's claims — demanding coverage for a property the subject never documented. Grep the
+  subject for the claim the finding rests on. Where it is not there, the finding is against the brief.
 - **A disagreement between auditors is rarely a tie to average.** It is usually two correct answers
   to two different questions. Find the question each one answered.
 - **Bound every finding**: state what is _not_ broken, and why the adjacent behaviour that looks the

package/dist/host/claude/agents/codex.md

@@ -73,6 +73,16 @@ endpoint — lockfile generation, real installs, live fetches — belongs to the
 Orchestrator's own tracked commands or a network-capable native agent. Never put it in a
 brief. A Sol exec hanging on `npm` until its cap fires is this misroute, not a slow bench.
 
+## The exec sandbox mounts `.git` read-only
+
+A `workspace-write` exec can write the working tree and cannot write `.git`. Every command
+that takes the index lock fails, `git checkout -- <file>` included.
+
+Never write a git command into a brief as a mechanism. A unit that must restore a file it
+mutated restores it by rewriting the original text, and proves it with
+`git diff --exit-code -- <file>`, which reads the index without locking it. Reading commands
+— `status`, `diff`, `log` — are unaffected and stay available.
+
 ## Recovery ladder
 
 On any interruption or missing result, in order:

package/dist/host/claude/agents/grok.md

@@ -16,10 +16,10 @@ Require a bounded question and an exact scope.
 ## Model
 
 ```text
-CURSOR_GROK_MODEL=cursor-grok-4.5-high
+CURSOR_GROK_MODEL=cursor-grok-4.6-high
 ```
 
-That id was read from `agent models` on 2026-08-09. Resolve the model from the variable at
+That id was read from `agent models` on 2026-08-13. Resolve the model from the variable at
 dispatch. Re-read `agent models` and update this line when the id changes. Never guess or
 substitute a model id.
 

package/dist/host/claude/rules/architecture.md

@@ -115,6 +115,10 @@ kind. It reads declaration syntax and file name, never meaning.
 - The cleanup sweep and independent review prove kind purity across those files. A helper misfiled
   as a parser, a coercer misfiled as a guard, a compiler misfiled as a factory, and a shaper
   misfiled as a cloner are review findings, not red tests.
+- It does not decide barrel membership. It parses each file alone and resolves no module, so it
+  cannot tell whether a declaration is reachable from its barrel. That question belongs to each
+  package's `tests/guides.test.ts`, which imports the barrel and gets real resolution. Do not add
+  module resolution here to duplicate it.
 - The kind table is mandatory whether or not a test can see the violation.
 
 ## Wrapper test
@@ -231,6 +235,15 @@ Both obey:
 - If a declaration should not be public, make it a true local or runtime-private detail, or remove
   the capability for a substantive reason. Never leave an intentional reusable export stranded
   outside the barrel.
+- One-class-per-file evicts some classes from their only caller, and `export` on such a file is
+  structural rather than a statement of intent. Barrel that class when a consumer can construct it
+  from values they already hold. Intern it — out of the barrel, and named in the package's parity
+  `INTERNAL` list — when its constructor requires a value only its owner produces, or when the
+  public value is a projection of the instance rather than the instance. A class named in a public
+  signature is always barrelled.
+- Delete a barrel row whose class no consumer can construct, and delete its `@example` with it. A
+  row obliges a documented, runnable example, so a class kept public without one is drift that
+  parity cannot see.
 - When a symbol moves, update every import; never leave a compatibility re-export.
 
 ```ts

package/dist/host/claude/rules/tests.md

@@ -25,6 +25,7 @@ paths:
 - Never assert an implementation against itself. Compare the answer to a declaration, a fixture, or a second mechanism that could disagree with it. Re-deriving the answer the same way the source derives it produces a test that passes for every value the source ever returns, and it reads exactly like a real one.
 - Probe a host-varying property at runtime, on the host the test is running on, and assert against what the probe returned. Filesystem case folding, path separators, permission bits, and rename semantics differ per host, so a fixture built on one host describes that host and silently measures something else on the next.
 - Assert a runtime-chosen result as the property it must have, not as the number one run produced. Compression, timing, and buffer sizing are the runtime's choice, so pin the relationship the test depends on — that the encoded form is larger, that the second call is faster — and let the assertion fail when the input drifts out of the range where that relationship holds.
+- Measure an elapsed interval with `performance.now()`, never `Date.now()`. `Date.now()` returns whole milliseconds, so an interval built from two of its readings truncates at both ends and can under-report by a millisecond — enough to fail a boundary assertion against a timer that behaved correctly. `performance.now()` is monotonic and sub-millisecond, and it does not move when the wall clock does.
 - Give a conditional skip the mechanism that makes it inapplicable, cited, not the platform name alone. A test skipped on a platform is a test nobody re-examines; a test skipped because a named API rejects a named case is one anybody can re-check.
 - A regression test records the exact command and its failing count before the fix, and the same command's passing count after.
 - Use `it.todo()` only for explicitly out-of-scope roadmap work, never to complete the current request. Every `.skip` or conditional skip has a narrow verifiable applicability reason.

package/dist/src/core/index.cjs

@@ -290,7 +290,7 @@ var DEFAULT_ENGINES = `>=${MINIMUM_NODE_VERSION}`;
 var BASE_DEV_DEPENDENCIES = Object.freeze({
 	"@microsoft/api-extractor": "^7.58.12",
 	"@orkestrel/guide": "^0.0.10",
-	"@orkestrel/scaffold": "^0.0.30",
+	"@orkestrel/scaffold": "^0.0.31",
 	"@types/node": "^26.2.0",
 	oxfmt: "^0.62.0",
 	oxlint: "^1.77.0",