@orkestrel/scaffold 0.0.33 → 0.0.35

package/dist/host/claude/settings.json

@@ -2,8 +2,100 @@
 	"$schema": "https://json.schemastore.org/claude-code-settings.json",
 	"enableAllProjectMcpServers": true,
 	"permissions": {
-		"defaultMode": "auto",
-		"allow": ["Bash(codex --version)", "Bash(codex login *)"],
+		"defaultMode": "bypassPermissions",
+		"allow": [
+			"Bash(codex --version)",
+			"Bash(codex login *)",
+			"Bash(codex login status)",
+			"Bash(codex exec *)",
+			"Bash(agent.cmd --version)",
+			"Bash(git status *)",
+			"Bash(git log *)",
+			"Bash(git show *)",
+			"Bash(git diff *)",
+			"Bash(mkdir *)",
+			"Bash(mkdir -p tmp/*)",
+			"Read(//tmp/**)",
+			"Bash(npm view *)",
+			"Bash(npm ci)",
+			"Bash(node_modules/.bin/scaffold audit *)",
+			"Bash(npx scaffold audit *)",
+			"Bash(npx vitest run *)",
+			"Bash(npx tsc --noEmit *)",
+			"Bash(npm test)",
+			"Bash(npm test *)",
+			"Bash(npm run clean)",
+			"Bash(npm run check)",
+			"Bash(npm run check *)",
+			"Bash(npm run check:src)",
+			"Bash(npm run check:src *)",
+			"Bash(npm run check:src:core)",
+			"Bash(npm run check:src:core *)",
+			"Bash(npm run check:app)",
+			"Bash(npm run check:app *)",
+			"Bash(npm run check:app:core)",
+			"Bash(npm run check:app:core *)",
+			"Bash(npm run check:app:browser)",
+			"Bash(npm run check:app:browser *)",
+			"Bash(npm run lint)",
+			"Bash(npm run lint *)",
+			"Bash(npm run lint:check)",
+			"Bash(npm run lint:check *)",
+			"Bash(npm run format)",
+			"Bash(npm run format *)",
+			"Bash(npm run format:check)",
+			"Bash(npm run format:check *)",
+			"Bash(npm run test)",
+			"Bash(npm run test *)",
+			"Bash(npm run test:src)",
+			"Bash(npm run test:src *)",
+			"Bash(npm run test:src:core)",
+			"Bash(npm run test:src:core *)",
+			"Bash(npm run test:app)",
+			"Bash(npm run test:app *)",
+			"Bash(npm run test:app:core)",
+			"Bash(npm run test:app:core *)",
+			"Bash(npm run test:app:browser)",
+			"Bash(npm run test:app:browser *)",
+			"Bash(npm run test:policy)",
+			"Bash(npm run test:policy *)",
+			"Bash(npm run test:config)",
+			"Bash(npm run test:config *)",
+			"Bash(npm run test:guides)",
+			"Bash(npm run test:guides *)",
+			"Bash(npm run test:conformance)",
+			"Bash(npm run test:conformance *)",
+			"Bash(npm run test:integration)",
+			"Bash(npm run test:integration *)",
+			"Bash(npm run test:distribution)",
+			"Bash(npm run test:distribution *)",
+			"Bash(npm run test:probe)",
+			"Bash(npm run test:probe *)",
+			"Bash(npm run build)",
+			"Bash(npm run build *)",
+			"Bash(npm run build:src)",
+			"Bash(npm run build:src *)",
+			"Bash(npm run build:src:core)",
+			"Bash(npm run build:src:core *)",
+			"Bash(npm run build:app)",
+			"Bash(npm run build:app *)",
+			"Bash(npm run build:app:browser)",
+			"Bash(npm run build:app:browser *)",
+			"mcp__codex__codex",
+			"mcp__codex__codex-reply",
+			"mcp__webstorm__read_file",
+			"mcp__webstorm__search_regex",
+			"mcp__webstorm__search_text",
+			"mcp__webstorm__search_file",
+			"mcp__webstorm__search_symbol",
+			"mcp__webstorm__get_file_problems",
+			"mcp__webstorm__get_symbol_info",
+			"mcp__webstorm__get_project_modules",
+			"mcp__webstorm__get_all_open_file_paths",
+			"mcp__webstorm__lint_files",
+			"mcp__webstorm__git_status",
+			"mcp__webstorm__list_directory_tree"
+		],
 		"deny": [
 			"Read(.env*)",
 			"Read(**/.env*)",
@@ -21,8 +113,6 @@
 			"Read(**/credentials)",
 			"Read(credentials.json)",
 			"Read(**/credentials.json)",
-			"Read(settings.local.json)",
-			"Read(**/settings.local.json)",
 			"Read(application_default_credentials.json)",
 			"Read(**/application_default_credentials.json)",
 			"Read(*.pem)",
@@ -74,7 +164,6 @@
 			"Read(//**/.git-credentials)",
 			"Read(//**/credentials)",
 			"Read(//**/credentials.json)",
-			"Read(//**/settings.local.json)",
 			"Read(//**/application_default_credentials.json)",
 			"Read(//**/*.pem)",
 			"Read(//**/*.key)",

package/dist/host/codex/agents/grok.toml

@@ -11,7 +11,7 @@ cursor-grok-4.5-high; re-read `agent models` if it fails and never guess or
 substitute. Invoke Cursor in ask mode only for a short bounded ask:
 agent -p --trust --mode=ask --model "$CURSOR_GROK_MODEL" "<brief>"
 For longer work do not launch anything: return the brief path, the exact resolved
-command, the journal path, and a cap recommendation for the Orchestrator to launch.
+command, and the journal path for the Orchestrator to launch under a cap it owns.
 The brief requires read-only work, concise evidence with file:line pointers, and no
 raw dumps, design, decisions, or edits. Never use --force, expose CURSOR_API_KEY,
 read secrets, or edit. Compare git status before and after. Return only the question,

package/dist/host/codex/agents/opus.toml

@@ -15,9 +15,9 @@ can continue the same session via --resume with context intact.
 Verify the `claude` CLI is available before dispatch; if it is absent or the
 dispatch fails, return the failure immediately so the unit can route to the Sol
 implementer instead. An implementation unit is long work: do not launch it. Return
-the brief path, the exact resolved command, the journal path, and a cap
-recommendation, and let the Orchestrator launch it as a tracked background command
-under a hard cap. Never detach a run, poll, restart, or kill one. The brief requires
+the brief path, the exact resolved command, and the journal path, and let the
+Orchestrator launch it as a tracked background command under a cap it owns. Never
+recommend a cap; you hold no record of prior runs. Never detach a run, poll, restart, or kill one. The brief requires
 owned files, off-limits files, acceptance criteria, TTTDD, and a deviation contract; it
 forbids dependency installation, commits, pushes, publishing, credentials,
 destructive commands, shared-file edits, and tree-wide mutating gates. After it

package/dist/host/codex/agents/planner.toml

@@ -10,7 +10,7 @@ Grok evidence. Pass the exact design brief independently shared with the Sol ana
 to:
 claude -p "<brief>" --model opus --effort high --permission-mode plan
 Run that yourself only for a short bounded design pass; for longer work return the
-brief path, the exact resolved command, the journal path, and a cap recommendation
+brief path, the exact resolved command, and the journal path
 for the Orchestrator to launch.
 Verify that the `claude` CLI is available before dispatch. If it is absent or the
 dispatch fails, return the failure immediately so the Sol main session can run the

package/dist/host/codex/agents/reviewer.toml

@@ -9,7 +9,7 @@ dispatch-named skill and references, the governing guide/spec, and the actual di
 Pass a bounded design-review brief to:
 claude -p "<brief>" --model opus --effort high --permission-mode plan
 Run that yourself only for a short bounded review; for longer work return the brief
-path, the exact resolved command, the journal path, and a cap recommendation for the
+path, the exact resolved command, and the journal path for the
 Orchestrator to launch.
 Verify that the `claude` CLI is available before dispatch. If it is absent or the
 dispatch fails, return the failure immediately so the Sol main session can run the

package/dist/host/dotfiles/gitignore

@@ -13,6 +13,9 @@ dist
 dist-ssr
 *.local
 
+# Per-operator Claude permissions; the vendored settings.json is fleet-uniform
+.claude/settings.local.json
+
 # Editor directories and files
 .vscode/*
 !.vscode/extensions.json

package/dist/host/manifest.json

@@ -110,6 +110,11 @@
 			"destination": ".agents/skills/orkestrel-falsify/SKILL.md",
 			"executable": false
 		},
+		{
+			"storage": "agents/skills/orkestrel-falsify/agents/openai.yaml",
+			"destination": ".agents/skills/orkestrel-falsify/agents/openai.yaml",
+			"executable": false
+		},
 		{
 			"storage": "agents/skills/orkestrel-falsify/references/brief.md",
 			"destination": ".agents/skills/orkestrel-falsify/references/brief.md",
@@ -225,6 +230,11 @@
 			"destination": ".claude/agents/scout.md",
 			"executable": false
 		},
+		{
+			"storage": "claude/agents/sol.md",
+			"destination": ".claude/agents/sol.md",
+			"executable": false
+		},
 		{
 			"storage": "claude/agents/verifier.md",
 			"destination": ".claude/agents/verifier.md",
@@ -511,6 +521,7 @@
 		".agents/skills/orkestrel-debrief/agents",
 		".agents/skills/orkestrel-debrief/references",
 		".agents/skills/orkestrel-falsify",
+		".agents/skills/orkestrel-falsify/agents",
 		".agents/skills/orkestrel-falsify/references",
 		".agents/skills/orkestrel-harden-package",
 		".agents/skills/orkestrel-harden-package/agents",
@@ -531,5 +542,5 @@
 		".codex/agents",
 		".cursor/rules"
 	],
-	"digest": "ae9a32c599f4ca43278496001c659731504b3e669252ca231aaaf1c61d84810c"
+	"digest": "9711710a3e8efb48ff70295138f5e54fc77ce3d232c2e4a50414448abea2f38b"
 }

package/dist/src/core/index.cjs

@@ -305,7 +305,7 @@ var DEFAULT_ENGINES = `>=${MINIMUM_NODE_VERSION}`;
 /** The tooling versions scaffold and every generated workspace share. */
 var BASE_DEV_DEPENDENCIES = Object.freeze({
 	"@orkestrel/guide": "^0.0.11",
-	"@orkestrel/scaffold": "^0.0.33",
+	"@orkestrel/scaffold": "^0.0.35",
 	"@orkestrel/test": "^0.0.3",
 	"@types/node": "^26.2.0",
 	oxfmt: "^0.62.0",