@orkestrel/scaffold 0.0.33 → 0.0.36

package/dist/host/claude/settings.json

@@ -2,8 +2,100 @@
 	"$schema": "https://json.schemastore.org/claude-code-settings.json",
 	"enableAllProjectMcpServers": true,
 	"permissions": {
-		"defaultMode": "auto",
-		"allow": ["Bash(codex --version)", "Bash(codex login *)"],
+		"defaultMode": "bypassPermissions",
+		"allow": [
+			"Bash(codex --version)",
+			"Bash(codex login *)",
+			"Bash(codex login status)",
+			"Bash(codex exec *)",
+			"Bash(agent.cmd --version)",
+			"Bash(git status *)",
+			"Bash(git log *)",
+			"Bash(git show *)",
+			"Bash(git diff *)",
+			"Bash(mkdir *)",
+			"Bash(mkdir -p tmp/*)",
+			"Read(//tmp/**)",
+			"Bash(npm view *)",
+			"Bash(npm ci)",
+			"Bash(node_modules/.bin/scaffold audit *)",
+			"Bash(npx scaffold audit *)",
+			"Bash(npx vitest run *)",
+			"Bash(npx tsc --noEmit *)",
+			"Bash(npm test)",
+			"Bash(npm test *)",
+			"Bash(npm run clean)",
+			"Bash(npm run check)",
+			"Bash(npm run check *)",
+			"Bash(npm run check:src)",
+			"Bash(npm run check:src *)",
+			"Bash(npm run check:src:core)",
+			"Bash(npm run check:src:core *)",
+			"Bash(npm run check:app)",
+			"Bash(npm run check:app *)",
+			"Bash(npm run check:app:core)",
+			"Bash(npm run check:app:core *)",
+			"Bash(npm run check:app:browser)",
+			"Bash(npm run check:app:browser *)",
+			"Bash(npm run lint)",
+			"Bash(npm run lint *)",
+			"Bash(npm run lint:check)",
+			"Bash(npm run lint:check *)",
+			"Bash(npm run format)",
+			"Bash(npm run format *)",
+			"Bash(npm run format:check)",
+			"Bash(npm run format:check *)",
+			"Bash(npm run test)",
+			"Bash(npm run test *)",
+			"Bash(npm run test:src)",
+			"Bash(npm run test:src *)",
+			"Bash(npm run test:src:core)",
+			"Bash(npm run test:src:core *)",
+			"Bash(npm run test:app)",
+			"Bash(npm run test:app *)",
+			"Bash(npm run test:app:core)",
+			"Bash(npm run test:app:core *)",
+			"Bash(npm run test:app:browser)",
+			"Bash(npm run test:app:browser *)",
+			"Bash(npm run test:policy)",
+			"Bash(npm run test:policy *)",
+			"Bash(npm run test:config)",
+			"Bash(npm run test:config *)",
+			"Bash(npm run test:guides)",
+			"Bash(npm run test:guides *)",
+			"Bash(npm run test:conformance)",
+			"Bash(npm run test:conformance *)",
+			"Bash(npm run test:integration)",
+			"Bash(npm run test:integration *)",
+			"Bash(npm run test:distribution)",
+			"Bash(npm run test:distribution *)",
+			"Bash(npm run test:probe)",
+			"Bash(npm run test:probe *)",
+			"Bash(npm run build)",
+			"Bash(npm run build *)",
+			"Bash(npm run build:src)",
+			"Bash(npm run build:src *)",
+			"Bash(npm run build:src:core)",
+			"Bash(npm run build:src:core *)",
+			"Bash(npm run build:app)",
+			"Bash(npm run build:app *)",
+			"Bash(npm run build:app:browser)",
+			"Bash(npm run build:app:browser *)",
+			"mcp__codex__codex",
+			"mcp__codex__codex-reply",
+			"mcp__webstorm__read_file",
+			"mcp__webstorm__search_regex",
+			"mcp__webstorm__search_text",
+			"mcp__webstorm__search_file",
+			"mcp__webstorm__search_symbol",
+			"mcp__webstorm__get_file_problems",
+			"mcp__webstorm__get_symbol_info",
+			"mcp__webstorm__get_project_modules",
+			"mcp__webstorm__get_all_open_file_paths",
+			"mcp__webstorm__lint_files",
+			"mcp__webstorm__git_status",
+			"mcp__webstorm__list_directory_tree"
+		],
 		"deny": [
 			"Read(.env*)",
 			"Read(**/.env*)",
@@ -21,8 +113,6 @@
 			"Read(**/credentials)",
 			"Read(credentials.json)",
 			"Read(**/credentials.json)",
-			"Read(settings.local.json)",
-			"Read(**/settings.local.json)",
 			"Read(application_default_credentials.json)",
 			"Read(**/application_default_credentials.json)",
 			"Read(*.pem)",
@@ -74,7 +164,6 @@
 			"Read(//**/.git-credentials)",
 			"Read(//**/credentials)",
 			"Read(//**/credentials.json)",
-			"Read(//**/settings.local.json)",
 			"Read(//**/application_default_credentials.json)",
 			"Read(//**/*.pem)",
 			"Read(//**/*.key)",

package/dist/host/claude/skills/orkestrel-human-journey/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: orkestrel-human-journey
+description: Prove a browser application the way a person uses it — real keystrokes, clicks, and Tab/Enter against only what is visible and reachable — and generate the capture portfolio from those same journeys. Use when accepting a UI build, proving an application end to end, deciding whether a surface is reachable by keyboard alone, proving what a screen refuses as well as what it does, auditing whether the interface speaks the user's vocabulary rather than the engine's, producing the screenshots a design review judges, or whenever the only evidence a screen works is a test that drove it through JavaScript instead of through the interface.
+---
+
+# Load the canonical workflow
+
+Read `.agents/skills/orkestrel-human-journey/SKILL.md` completely, then read every reference it requires. Follow that canonical workflow before acting.
+
+This bridge contains no independent process. `AGENTS.md`, applicable rules, the canonical skill, and the governing guide/spec remain authoritative in that order.

package/dist/host/claude/skills/orkestrel-polish-surface/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: orkestrel-polish-surface
-description: Drive a rendered or externally driven surface to shipped quality through capture-evidence verdict rounds. Use for interface polish, rendered-state audits, reconciling design/state-truth/inventory findings into fix units, and converging review rounds on captured proof.
+description: Drive a rendered or externally driven surface to shipped quality through capture-evidence verdict rounds. Use when asked to polish an interface, bring a rendered surface to enterprise grade, judge what actually renders rather than what the source claims, reconcile design, state-truth, and inventory findings into fix units, or converge repeated review rounds on captured proof. Run one round for a narrow request; run the full campaign for a polish or production-readiness request.
 ---
 
 # Load the canonical workflow

package/dist/host/codex/agents/grok.toml

@@ -11,7 +11,7 @@ cursor-grok-4.5-high; re-read `agent models` if it fails and never guess or
 substitute. Invoke Cursor in ask mode only for a short bounded ask:
 agent -p --trust --mode=ask --model "$CURSOR_GROK_MODEL" "<brief>"
 For longer work do not launch anything: return the brief path, the exact resolved
-command, the journal path, and a cap recommendation for the Orchestrator to launch.
+command, and the journal path for the Orchestrator to launch under a cap it owns.
 The brief requires read-only work, concise evidence with file:line pointers, and no
 raw dumps, design, decisions, or edits. Never use --force, expose CURSOR_API_KEY,
 read secrets, or edit. Compare git status before and after. Return only the question,

package/dist/host/codex/agents/opus.toml

@@ -15,9 +15,9 @@ can continue the same session via --resume with context intact.
 Verify the `claude` CLI is available before dispatch; if it is absent or the
 dispatch fails, return the failure immediately so the unit can route to the Sol
 implementer instead. An implementation unit is long work: do not launch it. Return
-the brief path, the exact resolved command, the journal path, and a cap
-recommendation, and let the Orchestrator launch it as a tracked background command
-under a hard cap. Never detach a run, poll, restart, or kill one. The brief requires
+the brief path, the exact resolved command, and the journal path, and let the
+Orchestrator launch it as a tracked background command under a cap it owns. Never
+recommend a cap; you hold no record of prior runs. Never detach a run, poll, restart, or kill one. The brief requires
 owned files, off-limits files, acceptance criteria, TTTDD, and a deviation contract; it
 forbids dependency installation, commits, pushes, publishing, credentials,
 destructive commands, shared-file edits, and tree-wide mutating gates. After it

package/dist/host/codex/agents/planner.toml

@@ -10,7 +10,7 @@ Grok evidence. Pass the exact design brief independently shared with the Sol ana
 to:
 claude -p "<brief>" --model opus --effort high --permission-mode plan
 Run that yourself only for a short bounded design pass; for longer work return the
-brief path, the exact resolved command, the journal path, and a cap recommendation
+brief path, the exact resolved command, and the journal path
 for the Orchestrator to launch.
 Verify that the `claude` CLI is available before dispatch. If it is absent or the
 dispatch fails, return the failure immediately so the Sol main session can run the

package/dist/host/codex/agents/reviewer.toml

@@ -9,7 +9,7 @@ dispatch-named skill and references, the governing guide/spec, and the actual di
 Pass a bounded design-review brief to:
 claude -p "<brief>" --model opus --effort high --permission-mode plan
 Run that yourself only for a short bounded review; for longer work return the brief
-path, the exact resolved command, the journal path, and a cap recommendation for the
+path, the exact resolved command, and the journal path for the
 Orchestrator to launch.
 Verify that the `claude` CLI is available before dispatch. If it is absent or the
 dispatch fails, return the failure immediately so the Sol main session can run the

package/dist/host/dotfiles/gitignore

@@ -13,6 +13,9 @@ dist
 dist-ssr
 *.local
 
+# Per-operator Claude permissions; the vendored settings.json is fleet-uniform
+.claude/settings.local.json
+
 # Editor directories and files
 .vscode/*
 !.vscode/extensions.json

package/dist/host/manifest.json

@@ -110,6 +110,11 @@
 			"destination": ".agents/skills/orkestrel-falsify/SKILL.md",
 			"executable": false
 		},
+		{
+			"storage": "agents/skills/orkestrel-falsify/agents/openai.yaml",
+			"destination": ".agents/skills/orkestrel-falsify/agents/openai.yaml",
+			"executable": false
+		},
 		{
 			"storage": "agents/skills/orkestrel-falsify/references/brief.md",
 			"destination": ".agents/skills/orkestrel-falsify/references/brief.md",
@@ -150,6 +155,26 @@
 			"destination": ".agents/skills/orkestrel-harden-package/references/research.md",
 			"executable": false
 		},
+		{
+			"storage": "agents/skills/orkestrel-human-journey/SKILL.md",
+			"destination": ".agents/skills/orkestrel-human-journey/SKILL.md",
+			"executable": false
+		},
+		{
+			"storage": "agents/skills/orkestrel-human-journey/agents/openai.yaml",
+			"destination": ".agents/skills/orkestrel-human-journey/agents/openai.yaml",
+			"executable": false
+		},
+		{
+			"storage": "agents/skills/orkestrel-human-journey/references/captures.md",
+			"destination": ".agents/skills/orkestrel-human-journey/references/captures.md",
+			"executable": false
+		},
+		{
+			"storage": "agents/skills/orkestrel-human-journey/references/layer.md",
+			"destination": ".agents/skills/orkestrel-human-journey/references/layer.md",
+			"executable": false
+		},
 		{
 			"storage": "agents/skills/orkestrel-polish-surface/SKILL.md",
 			"destination": ".agents/skills/orkestrel-polish-surface/SKILL.md",
@@ -225,6 +250,11 @@
 			"destination": ".claude/agents/scout.md",
 			"executable": false
 		},
+		{
+			"storage": "claude/agents/sol.md",
+			"destination": ".claude/agents/sol.md",
+			"executable": false
+		},
 		{
 			"storage": "claude/agents/verifier.md",
 			"destination": ".claude/agents/verifier.md",
@@ -320,6 +350,11 @@
 			"destination": ".claude/skills/orkestrel-harden-package/SKILL.md",
 			"executable": false
 		},
+		{
+			"storage": "claude/skills/orkestrel-human-journey/SKILL.md",
+			"destination": ".claude/skills/orkestrel-human-journey/SKILL.md",
+			"executable": false
+		},
 		{
 			"storage": "claude/skills/orkestrel-polish-surface/SKILL.md",
 			"destination": ".claude/skills/orkestrel-polish-surface/SKILL.md",
@@ -511,10 +546,14 @@
 		".agents/skills/orkestrel-debrief/agents",
 		".agents/skills/orkestrel-debrief/references",
 		".agents/skills/orkestrel-falsify",
+		".agents/skills/orkestrel-falsify/agents",
 		".agents/skills/orkestrel-falsify/references",
 		".agents/skills/orkestrel-harden-package",
 		".agents/skills/orkestrel-harden-package/agents",
 		".agents/skills/orkestrel-harden-package/references",
+		".agents/skills/orkestrel-human-journey",
+		".agents/skills/orkestrel-human-journey/agents",
+		".agents/skills/orkestrel-human-journey/references",
 		".agents/skills/orkestrel-polish-surface",
 		".agents/skills/orkestrel-polish-surface/agents",
 		".agents/skills/orkestrel-polish-surface/references",
@@ -527,9 +566,10 @@
 		".claude/skills/orkestrel-debrief",
 		".claude/skills/orkestrel-falsify",
 		".claude/skills/orkestrel-harden-package",
+		".claude/skills/orkestrel-human-journey",
 		".claude/skills/orkestrel-polish-surface",
 		".codex/agents",
 		".cursor/rules"
 	],
-	"digest": "ae9a32c599f4ca43278496001c659731504b3e669252ca231aaaf1c61d84810c"
+	"digest": "d2b056bb83ece5f6e49cb3acd27fd917241a51a3e287791eaf8d807cd56fb4c7"
 }

package/dist/host/tests/policy.test.ts

@@ -6,7 +6,12 @@ import {
 	inspectPolicyMirrorPaths,
 	inspectPolicySources,
 	inspectPolicyWorkspace,
+	inspectSkillFamily,
 	POLICY_CONTROLS,
+	readSkillFamily,
+	SKILL_POLICY_APOSTROPHE,
+	SKILL_POLICY_CONTROLS,
+	SKILL_POLICY_EXCLUSION,
 	stemToPolicyCandidates,
 	testToPolicyStem,
 } from './setupPolicy.js'
@@ -291,6 +296,34 @@ describe('instrument negative controls', () => {
 	}
 })
 
+describe('skill family policy', () => {
+	it('discovers a non-empty family containing orkestrel-falsify', () => {
+		const family = readSkillFamily(process.cwd())
+		expect(family.length).toBeGreaterThan(0)
+		expect(family).toContain('orkestrel-falsify')
+	})
+
+	it('requires every discovered skill file, metadata token, and reference', () => {
+		expect(inspectSkillFamily(process.cwd())).toEqual([])
+	})
+
+	for (const control of SKILL_POLICY_CONTROLS) {
+		it(`${control.label} [membership: ${control.membership}]`, () => {
+			const violations = inspectPolicyControl(control)
+			expect(violations).toHaveLength(1)
+			expect(violations[0]?.rule).toBe(control.rule)
+		})
+	}
+
+	it(`${SKILL_POLICY_APOSTROPHE.label} [membership: ${SKILL_POLICY_APOSTROPHE.membership}]`, () => {
+		expect(inspectPolicyControl(SKILL_POLICY_APOSTROPHE)).toEqual([])
+	})
+
+	it(`${SKILL_POLICY_EXCLUSION.label} [membership: ${SKILL_POLICY_EXCLUSION.membership}]`, () => {
+		expect(inspectPolicyControl(SKILL_POLICY_EXCLUSION)).toEqual([])
+	})
+})
+
 describe('repository policy', () => {
 	it('enforces placement and mirrors over the real workspace', () => {
 		expect(inspectPolicyWorkspace(process.cwd())).toEqual([])