@orkestrel/scaffold 0.0.37 → 0.0.39

package/dist/host/CLAUDE.md

@@ -11,6 +11,8 @@ follows it. This file adds only what Claude Code does differently, and cannot we
 - Use the Agent tool for a single dispatch, including when later control flow depends on its result.
 - Use a Workflow for a deterministic fan-out, staged pipeline, or loop. Serialize writing nodes.
 - Recover an interrupted Workflow with `resumeFromRunId`.
+- Foreground Bash is hard-capped at 10 minutes regardless of its timeout parameter. Launch anything
+  that can exceed it as a harness-tracked background command.
 - Never dispatch an adversarial lane with a context-inheriting subagent type such as `fork`. A lane
   must start clean, or it inherits the Orchestrator's framing and stops being independent.
 

package/dist/host/agents/orchestration.md

@@ -54,15 +54,16 @@ reasoning effort.
 
 ## The adversarial pass
 
-Two lanes run on every design round and every audit round.
+Two lanes run on every design round; an audit round runs the lanes the execution loop's step 5
+names, on the same clean-context terms.
 
 | Lane           | Argues                                                                      |
 | -------------- | --------------------------------------------------------------------------- |
 | **Subjective** | Shape, taste, naming, ergonomics, design fit, what the API should feel like |
 | **Objective**  | Correctness, constraints, and what the code and contracts actually permit   |
 
-**Both lanes always run.** Never collapse them into one. Never let an engine's absence stand in for
-a lane.
+**A required lane always runs.** Never collapse two required lanes into one. Never let an engine's
+absence stand in for a required lane.
 
 ### Clean contexts
 
@@ -162,6 +163,9 @@ when the role file already pins it.
   job to a bench means shipping that catalog across, which costs more than the bench saves.
 - `codex` is the shared Sol transport contract, not a route. `analyst` and `sol` are the named
   bridges; both bind that contract by reference and pin only their route and sandbox.
+- Mirroring is by work class, not filename. A transport contract is provider-specific:
+  `.claude/agents/codex.md` carries the Sol transport on the Claude side, `.codex/agents/claude.toml`
+  the Opus transport on the Codex side, and each side's bridges bind their own by reference.
 - Opus and Sol roles use high effort. Native cheap-tier roles use low or medium. Bridge drivers use
   the cheapest tier that can run a CLI.
 - Never route orchestration or acceptance across a bridge.
@@ -284,18 +288,23 @@ lane instead of re-dispatching against a session-start answer that no longer hol
    fully specified taste-free unit to `builder`. Never route implementation to an engine the unit's
    judgment load exceeds.
 4. **Integrate.** Evaluate each distillate against its acceptance criteria, apply shared-file
-   patches serially, and route cross-cutting findings.
-5. **Audit adversarially.** Run the two-lane adversarial pass on every nontrivial implementation:
-   `reviewer` for the subjective lane and `analyst` for the objective lane, plus `checker` for
-   mechanical conformance.
+   patches serially, and route cross-cutting findings. Integration applies exact returned patches
+   and mechanical conflict resolution only. A new type, mechanism, behavior, or acceptance
+   criterion discovered at integration is a successor brief routed to a writer, never an
+   integration edit.
+5. **Audit adversarially.** Audit every nontrivial implementation with at least one lane whose
+   engine did not write it. Run the second lane when the first returns FAIL, when the subject is a
+   rendered or externally driven surface, or when the unit's claims span both correctness and
+   shape. Dispatch `checker` when the acceptance criteria are mechanical — counts, paths, parity
+   rows, scope honesty. Record in the round's verdict file when a lane or the checker did not run.
    - State the audit's subject as numbered falsifiable claims and require per-claim verdicts with
-     evidence, per the Falsification law in `.claude/rules/quality.md` and the value set the
-     dispatch-named skill fixes.
+     evidence, per the Falsification law in `.claude/rules/quality.md` and the `orkestrel-falsify`
+     value set, unless the dispatch names a different skill that fixes another.
    - In a fix round, give the unit to an auditor engine that did not write it.
    - Run the `orkestrel-falsify` skill for multi-round audits. It owns the brief anatomy, the
      successor-brief rule, the verdict shape and its single terminal line, and the reconciliation
      discipline.
-   - Reconcile their evidence. Drop, on the record, any finding neither engine can substantiate.
+   - Reconcile the lanes that ran. Drop, on the record, any finding no lane can substantiate.
 6. **Verify.** Have one independent `verifier` run the authoritative gates.
 7. **Re-baseline.** Reconcile the remaining plan against what the phase revealed, before dispatching
    the next one.
@@ -369,11 +378,18 @@ The harness bridge names the concrete mechanism for each of these.
 - Send a decision taken mid-campaign to every unit already in flight whose brief it invalidates. An
   executor cannot see a change made after it was dispatched, so it writes the state its brief
   described and the defect surfaces as its own.
-- Treat the `tmp/` brief and report pair as ephemeral launch copies. **Bench laws** rule 4 owns
-  what is kept and what is swept; follow it there rather than deciding here.
+- Retention is uniform for every unit, whatever engine ran it, including an Orchestrator-owned
+  integration, fix, probe, or capture unit: copy the brief, the returned report or distillate, the
+  audit verdict, the exact executed script or instrument, and the acceptance evidence into
+  `.orkestrel/<package>/` as the unit is dispatched and as it returns, then sweep only the `tmp/`
+  launch copies. A capture claim's instrument is acceptance evidence; the frames may be swept once
+  the record transcribes them, because the committed instrument re-produces the film. **Bench
+  laws** rule 4 owns journals and points here for everything durable.
 - Promote anything that must outlive the campaign into a durable artifact before the sweep — a
   commit message, a guide, a rule, a retrospective. What is only in a swept file did not survive,
   and a debrief that must quote the record verbatim has nothing to quote.
+- Land a process rule stated as binding mid-campaign in the owning rule or contract file in the
+  same commit that states it. A campaign artifact is evidence, never a rule's home.
 
 ### Where campaign artifacts live
 
@@ -447,7 +463,8 @@ wrong is right to stop.
   fix the criterion to the property you want rather than to the number you saw.
 - Read the acceptance criteria against the off-limits list, line by line. Every criterion closes
   using owned files alone. A criterion that needs an off-limits file gets that file granted or gets
-  struck.
+  struck. A file the change will break that appears in neither list is an unscoped file; grant it or
+  strike the criterion.
 - Give a small unrelated obligation its own unit. Ride it along in a large one and its scope error
   blocks the primary work, which is a whole unit lost to a detail.
 - Ask what the change will do to the facts you just measured. A criterion fixed to a measured set is
@@ -471,9 +488,10 @@ wrong is right to stop.
   already settled. Where a read-only lane needs executed evidence, produce it separately and hand it
   over: the Orchestrator supplies the evidence and the lane rules on it.
 - Scope a fleet-wide refactor by the files that **consume** a symbol, not by the files that declare
-  it. A criterion to delete or rename anything closes only when every importer is owned, so a brief
-  scoped to the declaration alone sends the unit into a typecheck break in a file it cannot edit.
-  Count the importers before writing the owned list.
+  it. A criterion that removes a symbol, or that makes an existing state or fixture shape
+  unreachable, closes only when every consumer that exercises it is owned, so a brief scoped to the
+  declaration alone sends the unit into a typecheck break in a file it cannot edit. Count the
+  importers before writing the owned list.
 
 ### Carry every finding
 
@@ -513,8 +531,9 @@ command that outlives the turn that started it. Every law here binds all of them
   launch whose tail is the evidence.
 - Keep network-dependent work out of sandboxed bench execs. Bench sandboxes deny network, so
   lockfile generation, real installs, and live fetches belong to the Orchestrator's own tracked
-  commands or a network-capable native agent. A bench exec hanging on `npm` until its cap fires is
-  the signature of this misroute, not of a slow bench.
+  commands or to the native `implementer` or `builder` as an ordinary dispatched writing unit. A
+  bench exec hanging on `npm` until its cap fires is the signature of this misroute, not of a slow
+  bench.
 - A Workflow journals identically and dies identically, so give it the same watch — with one
   correction. A workflow journal writes only at agent start and result, so its mtime goes quiet for
   minutes during healthy work, and the liveness signal is the newest subagent transcript instead. A
@@ -546,6 +565,10 @@ nothing.
 - Kill by process id, never by pattern. `pkill -f` matches the relaunch that is already starting, so
   the pattern that cleans up the old run kills the new one and the cleanup reads as a launch
   failure.
+- A killed `codex exec` is dead only when its process tree is dead: walk the children with
+  `ps --ppid` and confirm the `codex-code-mode-host` child is gone. Before dispatching a substitute
+  writer, check the owned files' modification times against the baseline — a live orphan is still
+  writing the tree the substitute is about to own.
 - Read a failure against what was running when it happened, not against what you believe was
   running. The check costs one command and is the only thing that separates a real failure from
   self-inflicted contention.
@@ -584,12 +607,9 @@ transport.
    running" always has a first-class answer instead of a recollection of a command.
 4. **Ephemeral streams, durable records.** A journal proves a bench is alive and recovers an
    interrupted session. Keep journals under `tmp/`, never commit them, and sweep them at acceptance
-   after the final gate evidence is recorded. The **brief**, the returned **distillate**, the
-   **audit verdict**, and the **acceptance evidence** are not streams. Copy each into
-   `.orkestrel/<package>/` and commit it as its unit is dispatched and as it returns, then sweep
-   only the `tmp/` copy. None of it is reproducible from the diff, and a debrief has no primary
-   source without it. This rule owns retention for the whole contract; **Dispatch anatomy**
-   points here rather than answering it.
+   after the final gate evidence is recorded. Durable retention — brief, distillate, verdict,
+   instrument, acceptance evidence — is owned by **Dispatch anatomy**; this rule owns only the
+   journal stream.
 
 ### Recovering a dark bench
 
@@ -623,9 +643,14 @@ either publishes packages nobody needed to publish or leaves a consumer pinned t
   downstream of it re-pins, re-runs its gates, bumps, and republishes, in layer order.
 - A **development** `devDependencies` bump reaches nobody. Re-pin it, prove the gates still green,
   and commit to `main`. Do not bump the version and do not publish.
-- A development bump that forces a change to `src` or `app` is no longer a development bump. The
-  published types or runtime moved, so that package bumps and publishes on its own account, and
-  its own dependents follow the runtime rule above.
+- A development bump that moves the published artifact is no longer a development bump. Prove the
+  direction with the build, not the diff of sources: rebuild after the re-pin and compare `dist/`
+  against the published tarball. Compare material content only — exclude sourcemaps and ignore
+  whitespace-only differences; a superfluous diff (formatting, blank lines, map noise) moves
+  nothing and obliges nothing. A material diff — tokens, declarations, logic — means the published
+  surface moved — a forced `src` or `app` edit and a toolchain-changed emit both surface here — so
+  that package bumps and publishes on its own account, and its own dependents follow the runtime
+  rule above.
 
 Every package is `0.0.x`, where a caret pins one exact release. A dependent therefore sees a new
 version only after it re-pins and republishes, so the fleet publishes in topological layer order
@@ -682,6 +707,9 @@ flag is what stops the gate chain running a second time inside the five minutes.
 
 ### Reaching the approval
 
+- Launch the login chain only when the user has signalled they are at the keyboard and will click
+  within ten minutes. An approval URL expires unclicked in about ten to fifteen minutes, and an
+  overnight gap expires the session credential with it.
 - Run `npm login` before any publish. `npm publish` does not open the browser flow: unauthenticated
   it returns `E404` on `PUT`, which reads as a missing package rather than a missing credential.
 - Pass `--browser=false` to `npm login` and to every `npm publish`. Without it npm prints
@@ -691,8 +719,14 @@ flag is what stops the gate chain running a second time inside the five minutes.
   untouched.
 - Hold stdin open and write nothing to it. Use a fifo held open by a long `sleep`. EOF drops npm to
   the same legacy prompt a stray newline does.
+- A login log showing the spinner and then a legacy `Username:` prompt is an expired attempt, not a
+  prompt to answer: kill it by process id and mint a fresh flow.
 - Run the login and every publish under `script -qfc '<command>' <log>`. npm offers the approval only
   when it sees a TTY; without one it fails `EOTP` with no way to answer.
+- Git Bash on Windows ships no `script` binary, so the upload step there is operator-driven: prepare
+  the layer, prove the gates, surface the exact `npm publish` command, and the operator runs it in a
+  real terminal. Everything before and after the upload — bumps, re-pins, gates, registry reads —
+  stays with the Orchestrator. The fifo stdin law still binds on that host.
 - Expect two approvals. `npmjs.com/login/cli/<id>` authenticates the session; `npmjs.com/auth/cli/<id>`
   authorizes the publish and opens the five-minute window. Tell the user both are coming, or the
   second link reads as the first having failed.
@@ -729,6 +763,11 @@ flag is what stops the gate chain running a second time inside the five minutes.
 - Read the result from the registry, not from an exit code: a piped `npm publish` reports the exit
   status of the pipeline, and a CDN read straight after a publish can still serve the previous
   version.
+- A first publish creates the packument and can serve 404 for minutes after success. For a package
+  with no prior version treat 404 as pending, not failed, and re-read on an interval before
+  reporting either way. A bump serving the old version is CDN lag, same rule.
+- Rule on a pack-time manifest-rewriting warning by fetching the registry's copy of the manifest,
+  never by the warning's own text.
 - Re-read the registry before telling the user a package failed. A chain still running, a retry that
   landed, and CDN lag all produce a failure reading that the registry contradicts, and a false
   failure report costs a needless approval and a needless republish.
@@ -749,6 +788,8 @@ flag is what stops the gate chain running a second time inside the five minutes.
   implicit engines, fixed Claude model IDs, or verbose completed-work residue.
 - Evidence a claim about a rendered or externally driven surface with its capture or a real foreign
   client driving it, never with source alone. Where no such surface exists this law is inert.
+- When the Orchestrator writes any part of a unit, that part is briefed, owned, and audited like any
+  other part, and its auditor is an engine the Orchestrator does not share.
 - Final acceptance belongs only to the Orchestrator, after independent audit and gate evidence.
 - Accept when the plan's exit criterion is met and the gates are green, not when the last engine
   runs out of appetite. Reopening an accepted criterion is the user's instruction, not an auditor's

package/dist/host/agents/skills/orkestrel-debrief/SKILL.md

@@ -58,8 +58,13 @@ a practice that worked so it repeats.
    src, does src carry application policy, does either duplicate a declared ecosystem
    primitive? Package promotion: what grew into a reusable mechanism that belongs in an
    existing package or justifies a new one — mapped dependency-first so promotion order
-   is executable. Every row ends implement, repair, retain, or intentionally exclude,
-   with evidence.
+   is executable. Sweep test infrastructure both ways: name every local test helper or
+   fixture whose semantics an installed shared-package export already covers (compare
+   against the declarations each repository compiles with, and adopt rather than keep),
+   and name every instrument two or more packages built independently (count a value set
+   fed through one proof loop as one implementation, whether the set sits beside the
+   loop or its assertions are spelled out one by one). Every row ends implement, repair,
+   retain, or intentionally exclude, with evidence.
 4. **Process retrospective.** Walk the campaign record for both failure and success:
    dispatches that deviated and why; recoveries that worked (codify the mechanism that
    saved them); estimates versus observed durations; audit rounds that caught real

package/dist/host/agents/skills/orkestrel-debrief/references/field-testing.md

@@ -73,3 +73,6 @@ delta from the prior round. A tier passes when its models complete the goal with
 failed calls and no out-of-band reading (no source excavation, no filesystem search —
 watch for it in the transcript; it means the surface leaked its teaching job to the
 repository).
+
+A re-film that drives the surface with live models is a field pass: it carries the
+scoreboard and each lane's journal path like any other round.

package/dist/host/agents/skills/orkestrel-debrief/references/instruction-audit.md

@@ -11,9 +11,15 @@ seeing the other's answer before both return:
 
 - **Subjective** (design-fit engine): coherence of the role model, charter voice, whether
   each role's job is one job, whether the skill family reads as one system.
+- The subjective lenses, so the lane can state its coverage: role-job singularity;
+  charter voice against dispatched usage; lane-swap residue; bridge minimalism;
+  vocabulary drift across mirrored files; skill-family seams.
 - **Objective** (correctness engine): evidence-only sweeps of the actual files and the
   campaign record — the lanes below.
 
+Each lane returns numbered findings, most severe first, and exactly one terminal line:
+`INSTRAUDIT <LANE>: <n> findings`.
+
 Reconcile into rulings; every divergence gets a ruled row with the reason. Convergent
 findings adopt without contest; a finding neither lane can substantiate dies on the
 record.

package/dist/host/claude/agents/analyst.md

@@ -36,7 +36,8 @@ Everything `.agents/orchestration.md`'s dispatch contract requires, plus:
   never saw. Propagate the missing file; do not restate its contents in the brief.
 - For an audit: the subject as numbered falsifiable claims, and the skill that fixes the verdict
   shape. The Falsification section of `.claude/rules/quality.md` owns the method and the evidence
-  each verdict carries; the dispatch-named skill owns the value set and the terminal line. Point at
+  each verdict carries. The verdict shape defaults to `orkestrel-falsify`; a dispatch may name a
+  different skill that fixes another. That skill owns the value set and the terminal line. Point at
   both; restate neither.
 
 ## Launching
@@ -52,8 +53,10 @@ work-class rule. Persist the thread id the moment a response carries it.
 
 ## Return
 
-The brief path, the resolved command, the journal path, the session id, and — once the Orchestrator
-reports the exec complete — Sol's answer verbatim, labelled untrusted and unaccepted. Never a cap.
+The brief path, the resolved command, and the journal path — and nothing else. Never a cap. The
+Orchestrator launches the exec and reads Sol's answer from the `--output-last-message` file itself;
+you never wait for it, relay it, or endorse it. A follow-up on a finished exec is a fresh dispatch,
+not a continuation.
 
 Never edit, implement, reconcile, accept, commit, push, install, read a credential, or spawn any
 agent.

package/dist/host/claude/agents/checker.md

@@ -1,6 +1,6 @@
 ---
 name: checker
-description: 'Mechanical conformance review — acceptance criteria, AGENTS.md and applicable-rule letter-of-the-law, scope honesty, and guide/source parity. Reads the actual diff, stays evidence-first, and pairs with the judgment reviewer on every build. Never edits.'
+description: "Mechanical conformance review — acceptance criteria, AGENTS.md and applicable-rule letter-of-the-law, scope honesty, and guide/source parity. Reads the actual diff, stays evidence-first, and is dispatched when a unit's acceptance criteria are mechanically checkable. Never edits."
 tools: Read, Grep, Glob
 model: sonnet
 effort: low

package/dist/host/claude/agents/codex.md

@@ -62,9 +62,9 @@ never travel as shell arguments. Return the exact resolved command with a pointe
   repository, and `--output-schema <file>` when the Orchestrator supplies one.
 - The journal at `tmp/codex/<unit>.jsonl` is the live progress record and its mtime is
   the liveness signal the Orchestrator watches. Never re-print the stream into your report.
-- When the Orchestrator hands back a finished exec, read Sol's answer from the
-  `--output-last-message` file rather than stdout, and record the session id (`thread_id`
-  in the journal's opening events) in every report.
+- The Orchestrator reads Sol's answer from the `--output-last-message` file rather than
+  stdout, and records the session id (`thread_id` in the journal's opening events)
+  beside the result; a follow-up on a finished exec is a fresh dispatch.
 
 ## The exec sandbox denies network
 
@@ -73,6 +73,10 @@ endpoint — lockfile generation, real installs, live fetches — belongs to the
 Orchestrator's own tracked commands or a network-capable native agent. Never put it in a
 brief. A Sol exec hanging on `npm` until its cap fires is this misroute, not a slow bench.
 
+The namespace has its own loopback, so a host daemon on `127.0.0.1` is unreachable and a bind can
+fail `EPERM`. It has no IPv6, so `::1` fails `EAFNOSUPPORT`. Any proof that must reach a daemon,
+bind a port, or drive a built server belongs outside the exec.
+
 ## The exec sandbox mounts `.git` read-only
 
 A `workspace-write` exec can write the working tree and cannot write `.git`. Every command
@@ -107,9 +111,9 @@ and after. Require evidence for every claim and return unsupported claims as dro
 
 An audit brief states its subject as a numbered list of falsifiable claims rather than a
 diff to read, and requires Sol to attempt refutation. The Falsification section of
-`.claude/rules/quality.md` owns the method and the evidence each verdict carries. When the
-dispatch names a skill that fixes the verdict shape, that skill owns the value set and the
-terminal line. Point the brief at both; restate neither.
+`.claude/rules/quality.md` owns the method and the evidence each verdict carries. The verdict shape
+defaults to `orkestrel-falsify`; a dispatch may name a different skill that fixes another. That
+skill owns the value set and the terminal line. Point the brief at both; restate neither.
 
 ## Implementer route
 
@@ -118,9 +122,9 @@ baseline, with owned files, off-limits files, and a deviation contract. The brie
 dependency installation, commits, pushes, publishing, credentials, destructive commands,
 shared-file edits, and tree-wide mutating gates.
 
-When the Orchestrator hands the finished exec back, verify the result with direct evidence
-(git status, diff, scoped validation) and report once, completely: touched files,
-diffstat, scoped validation, and deviation state, for independent integration and review.
+The Orchestrator verifies the finished exec with direct evidence — git status, the diff,
+scoped validation — and carries touched files, diffstat, and deviation state into
+integration and review.
 
 ## Routing exclusion — defensive negative-test units
 

package/dist/host/claude/agents/grok.md

@@ -40,8 +40,9 @@ that never happened. The versioned entry has no console dependency and no such f
 
 Read an empty shim run as a launch failure until its log is checked for that trace.
 
-If nothing responds the bench is dark. Stop with a deviation naming the fallback: hand the
-reading to the Orchestrator, `planner`, or `analyst` directly. Never install or authenticate.
+If nothing responds the bench is dark. Stop with a deviation naming the fallback from the root
+tedious-work ladder — Luna, then Sonnet. Never hand the reading to the Orchestrator, `planner`, or
+`analyst`. Never install or authenticate.
 
 Create `tmp/cursor/` first. Write any brief longer than a couple of sentences to
 `tmp/cursor/<unit>-brief.md` and make the prompt a pointer to it; briefs never travel as

package/dist/host/claude/agents/orkestrel.md

@@ -36,46 +36,51 @@ so network-controlled descriptions never enter agent instruction context.
 
 | Package                 | Version  | Layer | Runtime dependencies                                                                                                                                                                                                                                                                                                 |
 | ----------------------- | -------- | ----- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `@orkestrel/abort`      | `0.0.6`  | L1    | `@orkestrel/contract` `^0.0.11`                                                                                                                                                                                                                                                                                      |
+| `@orkestrel/abort`      | `0.0.7`  | L1    | `@orkestrel/contract` `^0.0.12`                                                                                                                                                                                                                                                                                      |
 | `@orkestrel/agent`      | `0.0.15` | L5    | `@orkestrel/abort` `^0.0.6`, `@orkestrel/budget` `^0.0.6`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/database` `^0.0.8`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/queue` `^0.0.8`, `@orkestrel/timeout` `^0.0.6`, `@orkestrel/tool` `^0.0.10`, `@orkestrel/workflow` `^0.0.11`, `@orkestrel/workspace` `^0.0.4` |
+| `@orkestrel/brief`      | `0.0.2`  | L4    | `@orkestrel/contract` `^0.0.12`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/interpret` `^0.0.9`, `@orkestrel/reason` `^0.0.6`                                                                                                                                                                                        |
 | `@orkestrel/browser`    | `0.0.9`  | L3    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/html` `^0.0.3`, `@orkestrel/websocket` `^0.0.8`                                                                                                                                                                                          |
-| `@orkestrel/budget`     | `0.0.6`  | L1    | `@orkestrel/contract` `^0.0.11`                                                                                                                                                                                                                                                                                      |
-| `@orkestrel/console`    | `0.0.5`  | L2    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`                                                                                                                                                                                                                                                       |
-| `@orkestrel/contract`   | `0.0.11` | L0    |                                                                                                                                                                                                                                                                                                                      |
-| `@orkestrel/csv`        | `0.0.3`  | L1    | `@orkestrel/contract` `^0.0.11`                                                                                                                                                                                                                                                                                      |
-| `@orkestrel/database`   | `0.0.8`  | L2    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/indexeddb` `^0.0.7`, `@orkestrel/sqlite` `^0.0.7`                                                                                                                                                                                        |
-| `@orkestrel/emitter`    | `0.0.6`  | L1    | `@orkestrel/contract` `^0.0.11`                                                                                                                                                                                                                                                                                      |
-| `@orkestrel/guide`      | `0.0.10` | L3    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/markdown` `^0.0.8`                                                                                                                                                                                                                                                      |
-| `@orkestrel/html`       | `0.0.3`  | L1    | `@orkestrel/contract` `^0.0.11`                                                                                                                                                                                                                                                                                      |
-| `@orkestrel/indexeddb`  | `0.0.7`  | L1    | `@orkestrel/contract` `^0.0.11`                                                                                                                                                                                                                                                                                      |
-| `@orkestrel/interpret`  | `0.0.8`  | L3    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/reason` `^0.0.5`, `@orkestrel/template` `^0.0.3`                                                                                                                                                                                         |
-| `@orkestrel/markdown`   | `0.0.8`  | L2    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/html` `^0.0.3`                                                                                                                                                                                                                                                          |
-| `@orkestrel/mcp`        | `0.0.14` | L3    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/sse` `^0.0.5`, `@orkestrel/tool` `^0.0.10`, `@orkestrel/websocket` `^0.0.8`                                                                                                                                                              |
-| `@orkestrel/middleware` | `0.0.10` | L2    | `@orkestrel/abort` `^0.0.6`, `@orkestrel/budget` `^0.0.6`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/timeout` `^0.0.6`                                                                                                                                                                                            |
-| `@orkestrel/msg`        | `0.0.6`  | L0    |                                                                                                                                                                                                                                                                                                                      |
-| `@orkestrel/ndjson`     | `0.0.6`  | L1    | `@orkestrel/contract` `^0.0.11`                                                                                                                                                                                                                                                                                      |
+| `@orkestrel/budget`     | `0.0.7`  | L1    | `@orkestrel/contract` `^0.0.12`                                                                                                                                                                                                                                                                                      |
+| `@orkestrel/console`    | `0.0.8`  | L2    | `@orkestrel/contract` `^0.0.12`, `@orkestrel/emitter` `^0.0.7`                                                                                                                                                                                                                                                       |
+| `@orkestrel/contract`   | `0.0.12` | L0    |                                                                                                                                                                                                                                                                                                                      |
+| `@orkestrel/csv`        | `0.0.4`  | L1    | `@orkestrel/contract` `^0.0.12`                                                                                                                                                                                                                                                                                      |
+| `@orkestrel/database`   | `0.0.10` | L2    | `@orkestrel/contract` `^0.0.12`, `@orkestrel/emitter` `^0.0.7`, `@orkestrel/indexeddb` `^0.0.8`, `@orkestrel/sqlite` `^0.0.8`                                                                                                                                                                                        |
+| `@orkestrel/emitter`    | `0.0.7`  | L1    | `@orkestrel/contract` `^0.0.12`                                                                                                                                                                                                                                                                                      |
+| `@orkestrel/form`       | `0.0.2`  | L2    | `@orkestrel/contract` `^0.0.12`, `@orkestrel/emitter` `^0.0.7`                                                                                                                                                                                                                                                       |
+| `@orkestrel/guide`      | `0.0.11` | L3    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/markdown` `^0.0.8`                                                                                                                                                                                                                                                      |
+| `@orkestrel/html`       | `0.0.4`  | L1    | `@orkestrel/contract` `^0.0.12`                                                                                                                                                                                                                                                                                      |
+| `@orkestrel/indexeddb`  | `0.0.8`  | L1    | `@orkestrel/contract` `^0.0.12`                                                                                                                                                                                                                                                                                      |
+| `@orkestrel/interpret`  | `0.0.9`  | L3    | `@orkestrel/contract` `^0.0.12`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/reason` `^0.0.6`, `@orkestrel/template` `^0.0.3`                                                                                                                                                                                         |
+| `@orkestrel/markdown`   | `0.0.9`  | L2    | `@orkestrel/contract` `^0.0.12`, `@orkestrel/html` `^0.0.4`                                                                                                                                                                                                                                                          |
+| `@orkestrel/mcp`        | `0.0.15` | L3    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/sse` `^0.0.5`, `@orkestrel/tool` `^0.0.10`, `@orkestrel/websocket` `^0.0.8`                                                                                                                                                              |
+| `@orkestrel/middleware` | `0.0.13` | L2    | `@orkestrel/abort` `^0.0.7`, `@orkestrel/budget` `^0.0.7`, `@orkestrel/contract` `^0.0.12`, `@orkestrel/timeout` `^0.0.7`                                                                                                                                                                                            |
+| `@orkestrel/msg`        | `0.0.7`  | L0    |                                                                                                                                                                                                                                                                                                                      |
+| `@orkestrel/ndjson`     | `0.0.7`  | L1    | `@orkestrel/contract` `^0.0.12`                                                                                                                                                                                                                                                                                      |
 | `@orkestrel/ollama`     | `0.0.9`  | L6    | `@orkestrel/agent` `^0.0.15`, `@orkestrel/budget` `^0.0.6`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/ndjson` `^0.0.6`, `@orkestrel/timeout` `^0.0.6`, `@orkestrel/tool` `^0.0.10`                                                                                                                                |
-| `@orkestrel/pool`       | `0.0.7`  | L2    | `@orkestrel/emitter` `^0.0.6`                                                                                                                                                                                                                                                                                        |
-| `@orkestrel/program`    | `0.0.7`  | L4    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/qualifier` `^0.0.8`, `@orkestrel/rater` `^0.0.9`, `@orkestrel/reason` `^0.0.5`                                                                                                                                                           |
-| `@orkestrel/qualifier`  | `0.0.8`  | L3    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/reason` `^0.0.5`                                                                                                                                                                                                                         |
+| `@orkestrel/pool`       | `0.0.8`  | L2    | `@orkestrel/emitter` `^0.0.7`                                                                                                                                                                                                                                                                                        |
+| `@orkestrel/program`    | `0.0.8`  | L4    | `@orkestrel/contract` `^0.0.12`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/qualifier` `^0.0.9`, `@orkestrel/rater` `^0.0.10`, `@orkestrel/reason` `^0.0.6`                                                                                                                                                          |
+| `@orkestrel/qualifier`  | `0.0.9`  | L3    | `@orkestrel/contract` `^0.0.12`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/reason` `^0.0.6`                                                                                                                                                                                                                         |
 | `@orkestrel/queue`      | `0.0.8`  | L3    | `@orkestrel/abort` `^0.0.6`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/database` `^0.0.8`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/timeout` `^0.0.6`                                                                                                                                                           |
-| `@orkestrel/rater`      | `0.0.9`  | L3    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/reason` `^0.0.5`                                                                                                                                                                                                                         |
-| `@orkestrel/reason`     | `0.0.5`  | L2    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`                                                                                                                                                                                                                                                       |
+| `@orkestrel/rater`      | `0.0.10` | L3    | `@orkestrel/contract` `^0.0.12`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/reason` `^0.0.6`                                                                                                                                                                                                                         |
+| `@orkestrel/reason`     | `0.0.7`  | L2    | `@orkestrel/contract` `^0.0.12`, `@orkestrel/emitter` `^0.0.7`                                                                                                                                                                                                                                                       |
 | `@orkestrel/relation`   | `0.0.8`  | L3    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/database` `^0.0.8`, `@orkestrel/emitter` `^0.0.6`                                                                                                                                                                                                                       |
-| `@orkestrel/router`     | `0.0.9`  | L2    | `@orkestrel/abort` `^0.0.6`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`                                                                                                                                                                                                                          |
-| `@orkestrel/scaffold`   | `0.0.27` | L3    | `@orkestrel/console` `^0.0.5`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/markdown` `^0.0.8`, `@orkestrel/template` `^0.0.3`                                                                                                                                                        |
-| `@orkestrel/sea`        | `0.0.6`  | L2    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`                                                                                                                                                                                                                                                       |
-| `@orkestrel/server`     | `0.0.11` | L3    | `@orkestrel/abort` `^0.0.6`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/router` `^0.0.9`, `@orkestrel/timeout` `^0.0.6`                                                                                                                                                             |
-| `@orkestrel/sqlite`     | `0.0.7`  | L1    | `@orkestrel/contract` `^0.0.11`                                                                                                                                                                                                                                                                                      |
+| `@orkestrel/router`     | `0.0.10` | L2    | `@orkestrel/abort` `^0.0.7`, `@orkestrel/contract` `^0.0.12`, `@orkestrel/emitter` `^0.0.7`                                                                                                                                                                                                                          |
+| `@orkestrel/scaffold`   | `0.0.38` | L3    | `@orkestrel/console` `^0.0.6`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/markdown` `^0.0.8`, `@orkestrel/template` `^0.0.3`                                                                                                                                                        |
+| `@orkestrel/sea`        | `0.0.7`  | L2    | `@orkestrel/contract` `^0.0.12`, `@orkestrel/emitter` `^0.0.7`                                                                                                                                                                                                                                                       |
+| `@orkestrel/server`     | `0.0.12` | L3    | `@orkestrel/abort` `^0.0.6`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/router` `^0.0.9`, `@orkestrel/timeout` `^0.0.6`                                                                                                                                                             |
+| `@orkestrel/sqlite`     | `0.0.8`  | L1    | `@orkestrel/contract` `^0.0.12`                                                                                                                                                                                                                                                                                      |
 | `@orkestrel/sse`        | `0.0.5`  | L0    |                                                                                                                                                                                                                                                                                                                      |
-| `@orkestrel/template`   | `0.0.3`  | L2    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/emitter` `^0.0.6`                                                                                                                                                                                                                                                       |
-| `@orkestrel/terminal`   | `0.0.6`  | L3    | `@orkestrel/console` `^0.0.5`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/database` `^0.0.8`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/sse` `^0.0.5`                                                                                                                                                             |
-| `@orkestrel/timeout`    | `0.0.6`  | L1    | `@orkestrel/contract` `^0.0.11`                                                                                                                                                                                                                                                                                      |
-| `@orkestrel/tool`       | `0.0.10` | L1    | `@orkestrel/contract` `^0.0.11`                                                                                                                                                                                                                                                                                      |
-| `@orkestrel/toolbox`    | `0.0.4`  | L6    | `@orkestrel/agent` `^0.0.15`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/database` `^0.0.8`, `@orkestrel/relation` `^0.0.8`, `@orkestrel/server` `^0.0.11`, `@orkestrel/terminal` `^0.0.6`, `@orkestrel/tool` `^0.0.10`, `@orkestrel/workflow` `^0.0.11`, `@orkestrel/workspace` `^0.0.4`                          |
-| `@orkestrel/websocket`  | `0.0.8`  | L2    | `@orkestrel/emitter` `^0.0.6`                                                                                                                                                                                                                                                                                        |
+| `@orkestrel/supervisor` | `0.0.1`  | L5    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/database` `^0.0.9`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/workflow` `^0.0.12`                                                                                                                                                                                      |
+| `@orkestrel/table`      | `0.0.2`  | L2    | `@orkestrel/contract` `^0.0.12`, `@orkestrel/emitter` `^0.0.7`                                                                                                                                                                                                                                                       |
+| `@orkestrel/template`   | `0.0.4`  | L2    | `@orkestrel/contract` `^0.0.12`, `@orkestrel/emitter` `^0.0.7`                                                                                                                                                                                                                                                       |
+| `@orkestrel/terminal`   | `0.0.9`  | L3    | `@orkestrel/console` `^0.0.7`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/database` `^0.0.9`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/form` `^0.0.1`, `@orkestrel/sse` `^0.0.5`                                                                                                                                 |
+| `@orkestrel/test`       | `0.0.6`  | L0    |                                                                                                                                                                                                                                                                                                                      |
+| `@orkestrel/timeout`    | `0.0.7`  | L1    | `@orkestrel/contract` `^0.0.12`                                                                                                                                                                                                                                                                                      |
+| `@orkestrel/tool`       | `0.0.11` | L1    | `@orkestrel/contract` `^0.0.12`                                                                                                                                                                                                                                                                                      |
+| `@orkestrel/toolbox`    | `0.0.6`  | L6    | `@orkestrel/agent` `^0.0.15`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/database` `^0.0.8`, `@orkestrel/relation` `^0.0.8`, `@orkestrel/server` `^0.0.12`, `@orkestrel/terminal` `^0.0.7`, `@orkestrel/tool` `^0.0.10`, `@orkestrel/workflow` `^0.0.11`, `@orkestrel/workspace` `^0.0.4`                          |
+| `@orkestrel/websocket`  | `0.0.9`  | L2    | `@orkestrel/emitter` `^0.0.7`                                                                                                                                                                                                                                                                                        |
 | `@orkestrel/worker`     | `0.0.7`  | L4    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/database` `^0.0.8`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/pool` `^0.0.7`, `@orkestrel/queue` `^0.0.8`                                                                                                                                                              |
-| `@orkestrel/workflow`   | `0.0.11` | L4    | `@orkestrel/abort` `^0.0.6`, `@orkestrel/budget` `^0.0.6`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/database` `^0.0.8`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/queue` `^0.0.8`, `@orkestrel/timeout` `^0.0.6`                                                                                                |
+| `@orkestrel/workflow`   | `0.0.12` | L4    | `@orkestrel/abort` `^0.0.6`, `@orkestrel/budget` `^0.0.6`, `@orkestrel/contract` `^0.0.11`, `@orkestrel/database` `^0.0.8`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/queue` `^0.0.8`, `@orkestrel/timeout` `^0.0.6`                                                                                                |
 | `@orkestrel/workspace`  | `0.0.4`  | L3    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/database` `^0.0.8`, `@orkestrel/emitter` `^0.0.6`                                                                                                                                                                                                                       |
 
 <!-- /orkestrel:catalog -->
@@ -96,9 +101,11 @@ pin names an older version runs that older version, whatever the registry holds.
 
 A **development** bump obliges nothing. A `devDependencies` range reaches no consumer of
 the published package, so re-pin it, prove the gates still green, and stop. Never report a
-development bump as a cascade. It becomes one only if it forces a change to `src` or
-`app`, because then the published types or runtime moved and the package bumps on that
-account rather than on the dependency's.
+development bump as a cascade. It becomes one only when the rebuilt `dist/` differs
+materially from the published artifact after the re-pin — sourcemaps excluded,
+whitespace-only differences ignored — meaning the published surface moved, through a
+forced `src`/`app` edit or a changed toolchain emit, and the package then bumps on that
+account rather than on the dependency's. A superfluous diff obliges nothing.
 
 The `Layer` column above is the publish round, derived from the runtime edges in the same
 row. `L0` depends on nothing else in the fleet and publishes first; each later layer

package/dist/host/claude/agents/planner.md

@@ -24,7 +24,8 @@ Return only:
 - `Alternatives`: at most two real alternatives and why the design wins.
 - `Units`: bounded work, each naming its role AND engine so the routing ledger is
   derivable, with ownership, dependencies, and acceptance criteria.
-- `Tensions`: subjective choices that Sol should challenge objectively.
+- `Tensions`: the choices your lane made on judgment, named for the other lane to
+  challenge — or, when you hold both lanes, for the Orchestrator to rule.
 - `Risks`: design-fit risks and the evidence needed to settle them.
 
 Your proposal is input to the Orchestrator, never the final decision.

package/dist/host/claude/agents/reviewer.md

@@ -1,6 +1,6 @@
 ---
 name: reviewer
-description: 'Subjective design-fit review of implemented work — API feel, vocabulary, architecture shape, guide voice, and conceptual coherence. Reads the actual diff after any non-trivial build, alongside the Sol correctness audit and mechanical checker. Never edits.'
+description: "Subjective design-fit review of implemented work — API feel, vocabulary, architecture shape, guide voice, and conceptual coherence. Reads the actual diff when the round's triggers name this lane. Never edits."
 tools: Read, Grep, Glob
 model: opus
 effort: high
@@ -41,20 +41,21 @@ Audit the changed work only through Opus 5's subjective and creative lens:
 
 Test a design claim by asking whether the shipped artifact still matches it — a
 guide, charter, or name that described the work two revisions ago is drift, and
-that question is what finds it. Anything you cannot settle on subjective grounds
-becomes an Analyst referral rather than a verdict of yours.
+that question is what finds it. Anything you cannot settle within your lane becomes
+a referral — to the other lane when it is running, to the Orchestrator when you hold
+both — never a verdict of yours.
 
 For a rendered or externally driven surface, the supplied capture portfolio is the
 primary evidence and source is corroboration only: cite a capture for every rendered
 claim, mark what the portfolio cannot show as NOT-EVIDENCED instead of inferring it,
-and when the dispatch names a skill that fixes the verdict shape, return that shape
-and its single terminal line.
+and return the `orkestrel-falsify` verdict shape and its single terminal line unless
+the dispatch names a different skill that fixes one.
 
 Read the actual diff plus enough surrounding code to judge it in context.
 Correctness, security, dependency constraints, test sufficiency, and mechanical
 conformance belong to the independent Sol analyst and checker. If you notice a
-possible objective defect, report it as a specifically evidenced **Analyst
-referral** rather than adjudicating it.
+possible objective defect, report it as a specifically evidenced **referral**
+rather than adjudicating it.
 
 ## External input
 
@@ -66,13 +67,13 @@ referral** rather than adjudicating it.
 
 ## Output contract — the Verdict
 
-- **Verdict** — PASS or FAIL for subjective design fit. Any required design change
-  means FAIL.
-- **Required changes** — each with file:line, what is wrong, why it matters, and
-  what right looks like — actionable enough to re-dispatch verbatim.
-- **Analyst referrals** — specifically evidenced objective questions for Sol, with
+- The `orkestrel-falsify` verdict shape: numbered per-claim verdicts, findings
+  outside the claims, and its single terminal line — unless the dispatch names a
+  different skill that fixes one.
+- Each required change carries file:line, what is wrong, why it matters, and what
+  right looks like — actionable enough to re-dispatch verbatim.
+- **Referrals** — specifically evidenced questions outside your lane, addressed to
+  the other lane when it is running and to the Orchestrator when you hold both, with
   no verdict from you.
-- **Advisories** — improvements that do not block.
-- **Confirmations** — each design criterion checked, one line each.
 
 You are read-only: you never edit. Return only the verdict, never your process.

package/dist/host/claude/agents/sol.md

@@ -50,7 +50,9 @@ Writing units are strictly serialized. Never run beside another writer in the sa
 
 ## Return
 
-The brief path, the resolved command, the journal path, the session id, and — once the Orchestrator
-reports the exec complete — Sol's answer verbatim, labelled untrusted and unaccepted. Never a cap.
+The brief path, the resolved command, and the journal path — and nothing else. Never a cap. The
+Orchestrator launches the exec and reads Sol's answer from the `--output-last-message` file itself;
+you never wait for it, relay it, or endorse it. A follow-up on a finished exec is a fresh dispatch,
+not a continuation.
 
 Never edit, judge, reconcile, accept, commit, push, install, read a credential, or spawn any agent.