@orkestrel/scaffold 0.0.4 → 0.0.6

package/dist/host/CLAUDE.md

@@ -276,7 +276,13 @@ journal head as the recovery handle.
   `tmp/codex/<unit>-brief.md`, one `codex exec --json` streaming to `tmp/codex/<unit>.jsonl`
   with `--output-last-message`, foreground when it fits the shell cap, backgrounded with the
   turn ended when it may not — the harness re-invocation is the wait; placeholder loops and
-  wait-promise reports are deviations. Recovery ladder on interruption: persisted-id
+  wait-promise reports are deviations. Every exec names its working directory with `-C`, and an
+  exec rooted outside a trusted git repository dies at launch unless `--skip-git-repo-check` is
+  passed, so cross-repo and fleet-container work rooted outside a checkout always passes it. A
+  launch is not a launch until the journal grows past its header: the bridge confirms the event
+  stream advanced beyond the session-configured head
+  before it reports the exec started, and treats an instantly-dead journal as a failed launch
+  whose tail is the evidence. Recovery ladder on interruption: persisted-id
   `codex-reply` re-emission → fresh CLI session with the same brief file → for an interrupted
   CLI exec, the journal survives and the Orchestrator chooses resume or fresh.
 - **The inverse bridge exists too:** Claude Code exposes `claude mcp serve`, registered in
@@ -297,9 +303,17 @@ journal head as the recovery handle.
 - At the start of each live Cloud session the user runs `codex login --device-auth` and
   completes ChatGPT approval in the browser. `scripts/codex.sh` only reports readiness; it
   never installs, authenticates, logs out, reads the auth cache, or performs a model call.
-- If ChatGPT device login is unavailable or expires, the Codex bench is dark. Fall back to
-  `planner`/`reviewer` (Opus 5) and `builder`, and say so. Never substitute an API key, access
-  token, copied `auth.json`, or another login flow unless the user changes this policy.
+- A probe that finds the binary present but authentication unavailable starts recovery in the
+  same turn instead of recording the bench dark and waiting: the Orchestrator backgrounds
+  `codex login --device-auth` with its output captured to `tmp/codex/login.log`, surfaces the
+  verification URL and one-time code to the user the moment they appear there, arms a watcher
+  on completion, and re-probes `codex login status` when it fires. The bench comes live
+  mid-session with no restart; a session that sits dark until the user asks for the login has
+  failed the probe, not the bench.
+- If that recovery cannot complete — device login unavailable, declined, or expired — the
+  Codex bench is dark. Fall back to `planner`/`reviewer` (Opus 5) and `builder`, and say so.
+  Never substitute an API key, access token, copied `auth.json`, or another login flow unless
+  the user changes this policy.
 
 Codex environment defaults:
 

package/dist/host/claude/agents/codex.md

@@ -81,6 +81,22 @@ shared-file edits, and tree-wide mutating gates. Return the touched files,
 diffstat, scoped validation, and deviation state for independent integration and
 review.
 
+## Routing exclusion — defensive negative-test units
+
+The provider applies a content-safety filter that terminates a turn mid-run when
+the work requires authoring or reproducing a violation construct, even when the
+purpose is to prove a guard REJECTS it: sandbox escapes, resolution-bypassing
+imports, boundary evasion, injection payloads, credential-handling probes. The
+filter reads the construct, not the intent, so a legitimate negative test trips
+it exactly like an attack would. Observed twice on one unit, at the same point in
+the work, with nothing written to disk either time.
+
+Route such a unit to the native Opus `implementer` from the start, and record the
+Codex bench dark for that unit with this reason. Do not soften or obscure a brief
+to slip past the filter — a bench that declines work is a routing fact, not an
+obstacle. The exclusion is per unit: everything else still routes to Sol
+normally, and an audit that merely READS existing negative tests is unaffected.
+
 ## Journals and Windows
 
 - Journals, briefs, session files, and last-message files under `tmp/codex/` are

package/dist/host/claude/rules/workspace.md

@@ -123,14 +123,14 @@ then runs the configured scoped checks that prove environment isolation.
 - Lint is a separate complementary gate; neither lint nor root checking replaces
   environment-isolation checks.
 
-| Scope                        | `lib`                             | `types`           | Permitted host globals                              |
-| ---------------------------- | --------------------------------- | ----------------- | --------------------------------------------------- |
-| `src:core`, `app:core`       | `["ESNext"]`                      | `[]`              | None: no DOM, Node, host crypto, console, or timers |
-| `src:browser`, `app:browser` | `["ESNext","DOM","DOM.Iterable"]` | default           | DOM; no Node                                        |
-| `src:server`, `app:server`   | `["ESNext"]`                      | `["node"]`        | Node; no DOM                                        |
-| `src:styles`                 | `["ESNext"]`                      | `["vite/client"]` | Vite SCSS module declaration only                   |
-
-Strict core is load-bearing. A host-dependent helper belongs in its host environment; for example, a `generateId` using host `crypto` belongs in server, not core.
+| Scope                        | `lib`                             | `types`           | Permitted host globals                                                                                                                   |
+| ---------------------------- | --------------------------------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| `src:core`, `app:core`       | `["ESNext","WebWorker"]`          | `[]`              | WHATWG web interop: fetch family, streams, URL, Abort, encoders, crypto, timers, console, DOMException, structuredClone; no DOM, no Node |
+| `src:browser`, `app:browser` | `["ESNext","DOM","DOM.Iterable"]` | default           | DOM; no Node                                                                                                                             |
+| `src:server`, `app:server`   | `["ESNext"]`                      | `["node"]`        | Node; no DOM                                                                                                                             |
+| `src:styles`                 | `["ESNext"]`                      | `["vite/client"]` | Vite SCSS module declaration only                                                                                                        |
+
+Strict core is load-bearing. A host-dependent helper belongs in its host environment; for example, a `generateId` reading `node:crypto` belongs in server, not core. The worker-only globals — `name`, `onrtctransform`, `close`, `postMessage`, `dispatchEvent`, `location`, `onerror`, `onlanguagechange`, `onoffline`, `ononline`, `onrejectionhandled`, `onunhandledrejection`, `self`, `importScripts`, `fonts`, `caches`, `crossOriginIsolated`, `indexedDB`, `isSecureContext`, `origin`, `scheduler`, `createImageBitmap`, `reportError`, `cancelAnimationFrame`, `requestAnimationFrame`, `onmessage`, `onmessageerror`, `addEventListener`, and `removeEventListener` — are policy-fenced out of core sources, so the `WebWorker` declarations widen the interop surface without admitting a worker host.
 
 Build/check config alignment:
 

package/dist/host/guides/src/scaffold.md

@@ -29,7 +29,7 @@ that projection, expressed as data. Rendered defaults ship as versioned package
 here rather than a hand edit in every workspace.
 
 The module is mechanism, never product policy. The judgment calls — the name, the description, the
-keywords, which src and app environments, which dependencies, any template override —
+keywords, which src and app environments, which dependencies, any artifact override —
 belong to the caller. What this module supplies is the closed vocabularies, the variant matrix as
 data, exact-record validation, a fail-closed gate, a deterministic pin, and lossless projections.
 
@@ -133,6 +133,7 @@ From [`types.ts`](../../src/core/types.ts).
 | `BuildFormat`          | type      |
 | `SrcDefinition`        | interface |
 | `AppDefinition`        | interface |
+| `ViteMachinery`        | interface |
 | `Origin`               | type      |
 | `Group`                | type      |
 | `Category`             | type      |
@@ -183,6 +184,12 @@ is `'INVALID' | 'BLOCKED' | 'DESTROYED' | 'TARGET' | 'WRITE' | 'FETCH'`.
 environment contributes, its test-project label, and — on the `src` axis — its `exports` subpath
 and build formats, or — on the `app` axis — its optional runtime entry.
 
+`ViteMachinery` names the three host-specific pipelines a workspace's generated `vite.config.ts` may
+carry: `browser` for the CSS pipeline and the Playwright-backed browser test project, `vue` for the
+single-file-component, HTML, and development-server machinery an application browser environment
+needs, and `output` for build-output containment. It never selects a boundary guarantee — those ship
+in every shape, as the compilers section sets out.
+
 `Blueprint` is the closed input spec:
 
 ```ts
@@ -363,7 +370,9 @@ value lists behind their literal unions. `SRC_MATRIX` is the `src` environment m
 data — each environment's `configs/src` files, test-project label, `exports` subpath, and build
 formats. `APP_MATRIX` is its application sibling, adding the runtime entry where an environment produces
 one (`app/browser/index.html`, `app/server/main.ts`). `HOST_PATHS` is the ordered list of
-byte-copied host artifacts.
+byte-copied host artifacts, and it is the staging manifest rather than the per-plan carried set:
+`stageHost` vendors every path on it, while each plan carries the subset `selectHostPaths` selects
+for that one workspace.
 
 The bounds are public because they are part of the contract, not implementation trivia.
 `MAX_ARTIFACT_BYTES` caps one artifact at 5 MiB and `MAX_TOTAL_ARTIFACT_BYTES` caps one blueprint,
@@ -537,7 +546,8 @@ entity allocation.
 then checks every override against the exact artifact set the plan would write. An override whose
 `path` matches no planned artifact, targets a `host`-origin artifact, or targets the
 blueprint-owned `package.json` publication boundary is a blocking question rather than a silent
-no-op.
+no-op. An override that clears all three lands a `warnings` entry naming the path it replaces — the
+declaration is accepted, and it is never accepted silently.
 
 ### Validators — server
 
@@ -729,11 +739,13 @@ From [`helpers.ts`](../../src/core/helpers.ts).
 | `contentByteLength`         | function |
 | `contentToHex`              | function |
 | `snapshotOf`                | function |
+| `selectHostPaths`           | function |
 | `findPathConflict`          | function |
 | `findFileConflict`          | function |
 | `validateDependencyArray`   | function |
 | `validateBlueprint`         | function |
 | `manifestToDependencies`    | function |
+| `manifestToName`            | function |
 | `rangeToFreshness`          | function |
 | `computeHash`               | function |
 | `stableStringify`           | function |
@@ -779,14 +791,20 @@ report projections count with.
 `snapshotOf`, `contentToHex`, `contentToBytes`, `contentByteLength`, `contentCodePoint`, and
 `bytesToHex` are the host-independent byte leaves that make exact comparison possible without a
 host encoder or buffer; an unpaired surrogate encodes as `U+FFFD` rather than throwing.
-`findPathConflict` finds the first exact or case-insensitive collision in a path list, and
-`findFileConflict` additionally rejects a file that would sit inside another planned path.
+`selectHostPaths` is the one-owner filter plan assembly applies before it carries anything: it
+returns the host paths in input order minus `guides/src/<name>.md`, so a workspace never plans a
+vendored mirror of the guide it writes itself. `findPathConflict` finds the first exact or
+case-insensitive collision in a path list, and `findFileConflict` additionally rejects a file that
+would sit inside another planned path — the loud backstop behind that selection.
 
 `validateBlueprint` and `validateDependencyArray` are the semantic pass. The array validator is
 pure — it returns its questions and the set of names it saw, so the caller can apply the
 cross-array overlap rules on top. `manifestToDependencies` reads a manifest's `dependencies`,
 `devDependencies`, and `peerDependencies` in that order, keeps only own data sections and scoped
-names, deduplicates, and never throws. `rangeToFreshness` applies the exact-pin comparison; the `missing` and `failed`
+names, deduplicates, and never throws. `manifestToName` is its self-reading sibling over the same
+text: the manifest's own string `name`, or `undefined` when the text is oversized, malformed,
+rootless, or nameless — the projection that lets a target recognize itself in its own declared
+dependencies. `rangeToFreshness` applies the exact-pin comparison; the `missing` and `failed`
 verdicts come from the fetch layer, never from this pure comparison.
 
 `computeHash` is a deterministic FNV-1a digest and `stableStringify` a key-order-independent
@@ -897,7 +915,9 @@ dependency-less stand-in. Environments come from `src/<environment>/` and `app/<
 scoped entries, with an optional peer recovered from `peerDependenciesMeta`; and `extras` is every
 development dependency minus the generated baseline and minus anything already declared as a
 dependency or peer, so a hand-added development dependency round-trips and stays audit-clean.
-`overrides` is always empty, because derivation cannot know a caller's override intent.
+Derivation yields no `overrides`: they are caller-time inputs, not repository state. A computed
+artifact that must differ reveals a gap in the canon; the blueprint grows an axis for that
+distinction rather than the repository forking the file.
 
 `storagePath`, `stageHost`, `readHostManifest`, `locateHostSource`, `remapArtifactPath`, and
 `hydratePlan` are the vendored-host path. `storagePath` maps a repo-relative path to its un-dotted
@@ -919,7 +939,9 @@ anything.
 `consumeCatalogAllowance` decrements the single shared entry allowance and throws `TARGET` before an
 over-budget traversal continues. `discoverPackages` requires a real, unlinked root and lists its
 immediate child directories whose bounded manifest names a scoped package, skipping anything else
-silently. `catalogPackages` applies one allowance across every root and directory rather than
+silently. A control-bearing child directory fails closed before its manifest is read and the
+untrusted name is never reflected in the diagnostic. `catalogPackages` applies one allowance across
+every root and directory rather than
 resetting a per-root budget, then draws each description from the first paragraph of the first
 blockquote of that package's own bounded guide via `guideToDescription`; a missing guide, an
 unreadable or oversized one, or one with no blockquote yields an empty description rather than an
@@ -946,6 +968,7 @@ From [`compilers.ts`](../../src/core/compilers.ts).
 | `devDependenciesFor`    | function |
 | `packageManifest`       | function |
 | `rootTsconfig`          | function |
+| `viteMachinery`         | function |
 | `viteHeader`            | function |
 | `policyViteProject`     | function |
 | `singleSrcViteConfig`   | function |
@@ -986,11 +1009,40 @@ optional metadata, and engines.
 
 `rootTsconfig` emits the root compiler options and one path alias per declared environment;
 `coreTsconfig`, `srcTsconfig`, and `appTsconfig` emit the scoped configurations that remove the
-wrong host's globals from each environment. `viteHeader` renders the shared header — the alias block
-derived from the tsconfig paths, plus the environment-boundary plugin. `coreViteConfig`,
-`srcViteConfig`, and `appViteConfig` emit the thin per-target wrappers; `rootViteConfig`,
-`singleSrcViteConfig`, and `applicationViteConfig` emit the root configuration for a
-library-only, single non-core `src` environment, and application-bearing workspace respectively;
+wrong host's globals from each environment. A core scope is the interesting one: `lib` is
+`["ESNext", "WebWorker"]` and `types` stays `[]`, which declares the WHATWG surface that is
+identical across Node, browsers, and workers — `fetch` and its request/response/header types,
+streams, `URL`, `AbortController`, the text encoders, `crypto`, timers, `console`, `DOMException`,
+`structuredClone` — while leaving `document`, `window`, and every `node:*` type unresolvable. That
+is one declaration set for a host-independent module, not a host. `viteHeader` renders the shared
+header — the alias block
+derived from the tsconfig paths, plus the environment-boundary plugin — and `viteMachinery` is the
+one place the header's axes are derived, read by `rootViteConfig`, `singleSrcViteConfig`,
+`applicationViteConfig`, and `configArtifacts` alike so no caller can invent a fourth answer.
+
+**The boundary guarantees do not vary by blueprint.** Every generated `vite.config.ts` — a
+`core`-only library, an application of `app/core` alone, or the full six-environment workspace —
+emits `environmentBoundary`, its `resolveId` / `load` / `buildEnd` walks, the module-graph AST audit
+(`environmentAssetSources`, `parseSync`, `Visitor`), and stylesheet rejection (`isStylesheetPath`
+plus its `environmentPathError` / `environmentSourceError` clauses). Those enforce owner-independent
+laws: core stays host-independent whatever else the workspace declares, a server module never
+imports a stylesheet, and a `@vite-ignore` dynamic import — which `resolveId` never sees and the
+module graph never records — has no other enforcement point. Only host-specific pipelines vary,
+along the three `ViteMachinery` axes:
+
+| Machinery                                                         | Emitted when                         |
+| ----------------------------------------------------------------- | ------------------------------------ |
+| CSS pipeline (`ENVIRONMENT_CSS`, `preprocessCSS`, `isCSSRequest`) | a `src` or `app` browser environment |
+| Playwright provider and `hasChromium`                             | a `src` or `app` browser environment |
+| Vue plugin, HTML boundary, browser development server             | an `app` browser environment         |
+| Output containment (`outputBoundary`, `enforceOutputPath`)        | anything the workspace builds        |
+
+An application of `app/core` alone is the sole shape that builds nothing, so it is the sole shape
+without output containment — and it still carries every boundary guarantee above.
+
+`coreViteConfig`, `srcViteConfig`, and `appViteConfig` emit the thin per-target wrappers;
+`rootViteConfig`, `singleSrcViteConfig`, and `applicationViteConfig` emit the root configuration for
+a library-only, single non-core `src` environment, and application-bearing workspace respectively;
 `policyViteProject` emits the dedicated Node-only repository-policy test project.
 
 `configArtifacts`, `sourceArtifacts`, `applicationArtifacts`, `testArtifacts`, and `guideArtifacts`
@@ -1094,8 +1146,9 @@ The public methods of each behavioral interface, one table per type.
 `Scaffolding`; the optional group selection scopes the plan to those artifact groups.
 `audit(blueprint, current, groups?)` compiles and then diffs the resulting plan against the
 caller-supplied current content; a gated blueprint returns `complete: false` with the gate's
-blocking questions and zero findings. `destroy()` is idempotent teardown. The interface also
-exposes the readonly `emitter`.
+blocking questions and zero findings, and a complete one carries the gate's advisories on that same
+`questions` field. `destroy()` is idempotent teardown. The interface also exposes the readonly
+`emitter`.
 
 #### `PlanManagerInterface`
 
@@ -1159,12 +1212,14 @@ in-flight request. The interface also exposes the readonly `emitter`.
 `compile` runs three stages in fixed order and records each as a `CompileRecord` carrying its input,
 its output, whether it failed, and any error text.
 
-1. **draft** — `blueprintToPlan` selects the covered groups, drafts each group's artifacts, appends
-   the host set, applies overrides, and pins the draft. A throw here records a `draft` failure coded
+1. **draft** — `blueprintToPlan` selects the covered groups, drafts each group's artifacts, carries
+   the selected host set — every vendored host path except the workspace's own guide — applies
+   overrides, and pins the draft. A throw here records a `draft` failure coded
    `INVALID`, emits `error`, marks the remaining two stages skipped, and returns incomplete.
 2. **gate** — `validatePlan` runs the semantic pass over the blueprint and checks every override
-   against the drafted artifact set. Blocking questions fail the stage; a dependency outside the
-   vendored guide set contributes a non-blocking advisory question instead.
+   against the drafted artifact set. Blocking questions fail the stage; an accepted override and a
+   dependency outside the vendored guide set each contribute a non-blocking advisory question
+   instead.
 3. **pin** — a host-origin pointer artifact is appended for each non-vendored dependency, and
    `pinPlan` fills `trace` and `hash` from the plan's own content.
 
@@ -1196,7 +1251,8 @@ how it is audited, and whether it may ever be overwritten.
 - **`host`** — byte-copied from the vendored data root. These are the shared files a whole fleet
   keeps identical: the root instruction documents and licence, the agent, rule, and skill
   directories, the session scripts, the repository coding-law policy module, the byte-identical root
-  dotfiles, and the two guide mirrors every workspace carries. `HOST_PATHS` is the exact list.
+  dotfiles, and the two line guide mirrors a workspace carries for contracts other than its own.
+  `HOST_PATHS` is the exact vendored list; what a given plan carries is `selectHostPaths` of it.
 - **`template`** — filled from a frozen template definition by a pure fill engine. These are
   starter files: source stubs, test stubs, the starter guide, the README.
 - **`computed`** — derived by this package's own combination logic. These are the structural files:
@@ -1225,18 +1281,31 @@ anything, so a mature workspace's hand-written source, tests, guides, and manife
 overwritten with a stub. A consequence worth stating plainly: the generated
 `.github/workflows/ci.yml` is a **computed** artifact, so **user-owned CI is never repaired**. Once
 a workspace has its own workflow, that copy stands, and any change to it is an ordinary edit in that
-workspace.
+workspace. Audit still compares it because computed artifacts are content-aware canon. A legitimate
+difference that the blueprint cannot express is a canon gap: add the missing blueprint axis rather
+than forking the computed file in one repository.
 
 Overrides respect the same boundary from the other direction. `applyOverrides` never replaces a
 host-origin artifact and never replaces `package.json`; the gate turns either attempt — and an
 override matching no planned artifact at all — into a blocking question rather than a silent no-op.
-
-Guide mirrors are the one place ownership is conditional. A dependency this package vendors a
-byte-identical mirror for gets a real host-origin copy of `guides/src/<short>.md`. Any other
-dependency gets a host-origin _pointer_ artifact plus a non-blocking question, never a fabricated
-mirror; on materialization that pointer degrades to a short stub, and `scaffold pull` fetches the
-real thing. That degrade is scoped exactly to guide pointers: any other missing manifest entry
-means a corrupt or truncated vendored manifest, and fails closed.
+What survives those three refusals is applied and announced: the gate carries a non-blocking
+advisory naming each replaced path, and that advisory rides the `Scaffolding` and the `Audit` all
+the way through the library result.
+
+Guide mirrors are the one place ownership is conditional, and the law is one owner per guide path.
+**A workspace mirrors every line guide except its own.** When the name matches — the guide package
+on `guides/src/guide.md`, this package on `guides/src/scaffold.md` — the workspace itself is the
+owner, keeping that path as its **template**-origin starter guide, and `selectHostPaths` drops the
+vendored mirror so the path is contributed exactly once. For every other contract the mirror is the
+owner: a dependency this package vendors a byte-identical mirror for gets a real host-origin copy of
+`guides/src/<short>.md`, contributed once whether it arrives through the host set or through the
+dependency, so a package depending on `@orkestrel/guide` plans one `guides/src/guide.md` rather than
+two. Any other dependency gets a host-origin _pointer_ artifact plus a non-blocking question, never
+a fabricated mirror; on materialization that pointer degrades to a short stub, and `scaffold pull`
+fetches the real thing. That degrade is scoped exactly to guide pointers: any other missing manifest
+entry means a corrupt or truncated vendored manifest, and fails closed. Selection is the law and
+`findFileConflict` is its backstop: two artifacts at one path refuse the plan rather than racing to
+be the last writer.
 
 ## Audit, repair, and prune
 
@@ -1286,10 +1355,15 @@ because there is nothing to explain.
 `pull` is the target-aware composition. It reads the target's declared scoped dependencies from its
 manifest, rejects any explicit selection the target does not declare, builds the reference map from
 the target's own `guides/src/<short>.md` mirrors, fetches guides and versions under one shared
-allowance, and assembles a report whose `clean` flag requires both no drift and no failures. `write`
-then commits only the `behind` guides — never `current`, `missing`, or `failed`, none of which carry
-trustworthy content — under the same containment and precondition law `Materializer` enforces,
-including a baseline digest check against what is actually on disk.
+allowance, and assembles a report whose `clean` flag requires both no drift and no failures. A
+target that declares itself is the one asymmetry, and it follows the same single-owner law: the
+guide pass drops the self dependency, so `pull` never fetches or writes a workspace's own contract
+guide over the copy that workspace owns, while the version pass keeps it and still reports its
+freshness. A `--live` audit reads upstream through the same two passes and applies the same
+self-exclusion, so the freshness a workspace reports about itself never depends on which verb asked.
+`write` then commits only the `behind` guides — never `current`, `missing`, or `failed`,
+none of which carry trustworthy content — under the same containment and precondition law
+`Materializer` enforces, including a baseline digest check against what is actually on disk.
 
 `catalog` builds the fleet package catalog from three reads per entry. The registry's exact
 organization package list is authoritative and unconditionally required. Each package's own registry
@@ -1331,10 +1405,20 @@ a fixed, interleaved order so aggregates sit immediately before their per-enviro
   live generated-consumer integration gate for the scaffold engine itself
 
 **Environment isolation.** Scoped TypeScript projects remove the wrong host's globals from each
-environment: core scopes carry no DOM, no Node, and no host globals at all; browser scopes carry DOM
-and no Node; server scopes carry Node and no DOM. Lint restricts declared package, alias, and
-conventional relative imports in the same directions. Neither replaces the other, and neither
-replaces the build.
+environment: core scopes carry the WHATWG web-interop surface and no host at all — no DOM, no Node,
+no `vite/client`; browser scopes carry DOM and no Node; server scopes carry Node and no DOM. The
+worker-only globals the `WebWorker` declarations would otherwise admit — `name`, `onrtctransform`,
+`close`, `postMessage`, `dispatchEvent`, `location`, `onerror`, `onlanguagechange`, `onoffline`,
+`ononline`, `onrejectionhandled`, `onunhandledrejection`, `self`, `importScripts`, `fonts`, `caches`,
+`crossOriginIsolated`, `indexedDB`, `isSecureContext`, `origin`, `scheduler`, `createImageBitmap`,
+`reportError`, `cancelAnimationFrame`, `requestAnimationFrame`, `onmessage`, `onmessageerror`,
+`addEventListener`, and `removeEventListener` — are fenced out of `src/core` and `app/core` sources
+by the policy suite, so the declarations widen what a host-independent module may call without
+widening where it may run. On every TypeScript bump, derive this list from the module-scope
+global-object `declare var` and `declare function` declarations in the installed
+`lib.webworker.d.ts`, then subtract values supplied by `lib.esnext*` or current Node globals. Lint
+restricts declared package, alias, and conventional relative imports in the same directions.
+Neither replaces the other, and neither replaces the build.
 
 **The generated build boundary.** The emitted configuration carries an environment-boundary plugin
 that resolves the real module graph rather than re-implementing a parser. **TypeScript and
@@ -1454,7 +1538,8 @@ cannot express — that a centralized module exports every top-level declaration
 implementation files hold one class and no stray module-scope declaration, that no function is
 declared inside another function outside a directly-passed callback, that interface properties are
 readonly, that privacy is a runtime `#` field rather than a TypeScript modifier, that a barrel
-re-exports only through `export *`, and that a computed dynamic import cannot smuggle a
+re-exports only through `export *`, that a core source never names a worker-only global the
+`WebWorker` declarations expose, and that a computed dynamic import cannot smuggle a
 cross-environment dependency past the declared import rules. Vue components are inspected for the
 same evasions. It is a complement to lint and typecheck, never a second type system, and it is not a
 general-purpose source analyzer. Generated workspaces receive the same exported policy module as a
@@ -1464,7 +1549,11 @@ host-origin file and run it as a dedicated Node-only `policy` test project over
 **Real browser capability.** Browser test projects are gated on the real executable: the generated
 configuration and the generated policy test both probe `existsSync(chromium.executablePath())`. A
 browser suite runs when a real Chromium is installed and is skipped honestly when it is not, rather
-than being faked.
+than being faked. The gate is applied at registration, not only inside the project: without a
+Chromium the browser project is left out of the emitted `projects` list entirely, so the runner
+never has to reconcile a registered project whose include set resolves to nothing, and one printed
+warning names every omitted project label. A machine with a browser runs the browser suite; a
+machine without one runs the remaining projects and says so.
 
 **Continuous integration.** The generated workflow runs on push and pull request, on
 `ubuntu-latest`, with read-only contents permission, a 60-minute timeout, and a matrix that **tests
@@ -1872,6 +1961,7 @@ import {
 	hostGroup,
 	packageManifest,
 	paritySpecifiers,
+	selectHostPaths,
 	sourceArtifacts,
 	srcVariant,
 	testArtifacts,
@@ -1881,6 +1971,7 @@ const spec = blueprint('router', { src: ['core'], app: ['core', 'server'] })
 const members = blueprintToMembers(spec)
 
 hostGroup('AGENTS.md') // 'docs'
+selectHostPaths(['guides/src/router.md', 'LICENSE'], spec.name) // ['LICENSE'] — never its own guide
 srcVariant(['core', 'server']) // 'multi'
 entryFields(['browser']).main // './dist/src/browser/index.js'
 dualCondition('./dist/src/core/index')
@@ -1924,6 +2015,7 @@ import {
 	srcTsconfig,
 	srcViteConfig,
 	viteHeader,
+	viteMachinery,
 } from '@orkestrel/scaffold'
 
 rootTsconfig(['core'], ['core', 'server'])
@@ -1931,7 +2023,9 @@ coreTsconfig()
 srcTsconfig('server')
 appTsconfig('browser', true)
 
-viteHeader(true, true) // the shared header, with browser and Vue support
+viteMachinery(['core']) // { browser: false, vue: false, output: true }
+viteMachinery([], ['core', 'browser']) // { browser: true, vue: true, output: true }
+viteHeader(viteMachinery([], ['core', 'browser'])) // the shared header, with browser and Vue support
 coreViteConfig()
 srcViteConfig('browser')
 appViteConfig('server')
@@ -1945,7 +2039,12 @@ applicationViteConfig([], ['core', 'server']).includes('appServer') // true
 ### Reading declared dependencies and comparing freshness
 
 ```ts
-import { isBehind, manifestToDependencies, rangeToFreshness } from '@orkestrel/scaffold'
+import {
+	isBehind,
+	manifestToDependencies,
+	manifestToName,
+	rangeToFreshness,
+} from '@orkestrel/scaffold'
 import {
 	guideStub,
 	packageShortName,
@@ -1954,6 +2053,7 @@ import {
 } from '@orkestrel/scaffold/server'
 
 manifestToDependencies('{"dependencies":{"@orkestrel/contract":"^0.0.7"}}')
+manifestToName('{"name":"@orkestrel/router"}') // '@orkestrel/router' — the target's own name
 rangeToFreshness('^0.0.7', '0.0.7') // 'current'
 isBehind(rangeToFreshness('^0.0.7', '0.0.9')) // true
 
@@ -2186,7 +2286,8 @@ isMissingPathError(caught) // true only for an ENOENT error
 ## Tests
 
 - [`tests/src/core/helpers.test.ts`](../../tests/src/core/helpers.test.ts) — the pure leaves: table
-  alignment, byte encoding, snapshots, conflicts, projections, hashing, and format-stable JSON.
+  alignment, byte encoding, snapshots, host selection, conflicts, projections, hashing, and
+  format-stable JSON.
 - [`tests/src/core/builders.test.ts`](../../tests/src/core/builders.test.ts) — the blueprint,
   dependency, override, and member builders, including optional-field omission.
 - [`tests/src/core/validators.test.ts`](../../tests/src/core/validators.test.ts) — every guard and
@@ -2194,7 +2295,8 @@ isMissingPathError(caught) // true only for an ENOENT error
 - [`tests/src/core/shapers.test.ts`](../../tests/src/core/shapers.test.ts) — per-shape guard
   exactness, schema essentials, seeded generation, and parse round-trips.
 - [`tests/src/core/compilers.test.ts`](../../tests/src/core/compilers.test.ts) — every drafted
-  group, the manifest and exports combination rules, and the emitted configuration text.
+  group, the manifest and exports combination rules, the one-owner guide law for a workspace that
+  names a line guide, and the emitted configuration text.
 - [`tests/src/core/Compiler.test.ts`](../../tests/src/core/Compiler.test.ts) — the three-stage
   pipeline, the fail-closed gate, the emission sequences, and post-destroy behavior.
 - [`tests/src/core/PlanManager.test.ts`](../../tests/src/core/PlanManager.test.ts) — content-hash

package/dist/host/scripts/codex.sh

@@ -32,8 +32,10 @@ valid_effort() {
 
 if codex login status >/dev/null 2>&1; then
   auth="authentication ready"
+  recovery=""
 else
   auth="authentication unavailable"
+  recovery='codex login --device-auth'
 fi
 
 if valid_model "$analyst_model" &&
@@ -46,4 +48,7 @@ else
 fi
 
 echo "codex.sh: bench detected; ${auth}; ${routes}."
+if [ -n "$recovery" ]; then
+  echo "codex.sh: to recover, run \`${recovery}\`."
+fi
 exit 0