@orkestrel/scaffold 0.0.51 → 0.0.52

package/dist/host/agents/skills/orkestrel-debrief/references/instruction-audit.md

@@ -6,25 +6,51 @@ evidence-first treatment as any surface.
 
 ## Blind passes, one brief
 
-Run a subjective lane and an objective lane on the SAME brief, in parallel, neither
-seeing the other's answer before both return:
-
-- **Subjective** (design-fit engine): coherence of the role model, charter voice, whether
-  each role's job is one job, whether the skill family reads as one system.
-- The subjective lenses, so the lane can state its coverage: role-job singularity;
-  charter voice against dispatched usage; lane-swap residue; bridge minimalism;
-  vocabulary drift across mirrored files; skill-family seams.
-- **Objective** (correctness engine): evidence-only sweeps of the actual files and the
-  campaign record — the lanes below.
+Run the subjective lane and the objective lane on the SAME brief, in parallel, neither
+seeing the other's answer before both return. `reviewer` holds the subjective lane and
+`analyst` holds the objective lane.
 
 Each lane returns numbered findings, most severe first, and exactly one terminal line:
-`INSTRAUDIT <LANE>: <n> findings`.
+`INSTRAUDIT <LANE>: <n> findings`. Each charter defaults to the `orkestrel-falsify`
+verdict shape and takes a different shape the dispatch names, so name `orkestrel-debrief`
+in the dispatch and this shape binds.
+
+Point each lane's brief at its own section rather than copying that section's lens list
+into the brief. A copied list drops a lens silently, and the lane that lost it reports
+full coverage.
 
 Reconcile into rulings; every divergence gets a ruled row with the reason. Convergent
 findings adopt without contest; a finding neither lane can substantiate dies on the
 record.
 
-## The objective lanes
+## The subjective lens list
+
+Held by `reviewer`. It judges coherence of the role model, charter voice, whether each
+role's job is one job, and whether the skill family reads as one system. This section is
+the lens list's only normative home, and the lane states its coverage against it.
+
+- **Role-job singularity.** Is each charter's work cohesive? A charter describing bundled
+  jobs is either a role to split or a bundle no dispatch sends whole.
+- **Charter voice against dispatched usage.** Read each charter the way an executor reads
+  it mid-task, then compare against how the campaign actually dispatched that role.
+  Wording that produced a deviation report is a defect in the charter.
+- **Lane-swap residue.** A role holds the other lane when a bench is dark. Check that each
+  charter's wording survives the swap: a charter that assumes its default perspective
+  everywhere outside the swap clause cannot be dispatched into the other lane, and a round
+  run under a swap that reads like the default lane's output is the residue.
+- **Bridge minimalism.** A provider bridge loads one canonical workflow and adds nothing.
+  Any instruction beyond the load is a competing instruction.
+- **Vocabulary drift across mirrored files.** The same concept takes the same term across
+  the Claude and Codex mirrors and each operating contract's role table.
+- **Skill-family seams.** Do the skills read as one system: the naming axis, the
+  load-authority order, the reference depth, and the boundary each draws with the
+  contract.
+
+## The objective lens list
+
+Held by `analyst`. It runs evidence-only sweeps of the actual files and the campaign
+record. This section is the lens list's only normative home, and the lane states its coverage
+against it.
 
 - **Duplication diff.** Whole-line and obligation-level comparison across charters, rules,
   and skills. A charter that restates a rule drifts from it; a rule restated elsewhere has

package/dist/host/agents/skills/orkestrel-debrief/references/retention.md

@@ -0,0 +1,107 @@
+# Retire a campaign folder
+
+Delete a campaign's working artifacts through this procedure. It fixes what the deletion
+covers, the checks that close it, the go-ahead that authorizes it, and the commit message that
+keeps it recoverable.
+
+A debrief arrives at its Dispose step, after every finding has a
+carrier. A campaign that accepts with no debrief arrives at acceptance, per
+`.agents/orchestration.md` § Where campaign artifacts live. The procedure is the same through
+either door.
+
+Call the `.orkestrel/` folder the campaign folder, never a ledger. The word `ledger` names the
+routing ledger and the carry ledger only.
+
+## The gate order
+
+Order is the whole of this rule: the checks close the prune, and the owner's go-ahead authorizes
+it. Run the steps in this sequence.
+
+1. Run the carry, promotion, measurement, and orientation checks that follow. Every one closes, or
+   the prune stops there and the open item gets a carrier first.
+2. Present the disposition to the owner: what the checks found, where each promotion landed, and
+   what the deletion removes.
+3. Delete only on the owner's explicit go-ahead. Never silently, and never as residue left for the
+   next session to read as current.
+4. Commit the deletion with the promotion record as its message.
+
+Closed checks authorize nothing on their own, and a go-ahead taken over an open check deletes an
+item nothing carries. Pruning is deletion, so it needs the same evidence as any other destructive
+step.
+
+## What the prune covers
+
+Rule on every location in this table before deleting anything.
+
+| Location                | What it holds                                                                                                                                              | What the prune does                                                                                                |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
+| `.orkestrel/<package>/` | The campaign folder for a campaign about one package: each unit's brief and report, the audit verdicts, the executed instruments, the acceptance evidence. | Deleted in the prune commit.                                                                                       |
+| `.orkestrel/campaign/`  | The shared campaign folder for a campaign spanning several packages: the wave's plan, its routing ledger, its verdicts.                                    | Deleted in the prune commit.                                                                                       |
+| `tmp/units/`            | A native unit's `<unit>-brief.md` and `<unit>-report.md` pair.                                                                                             | Swept. The durable copy already sits in the campaign folder, so a pair missing there blocks the sweep.             |
+| `tmp/<bench>/`          | A bench unit's brief, report, event stream, final answer, and any login log.                                                                               | Swept after the final gate evidence is recorded. Never committed.                                                  |
+| `tmp/probe/`            | The runtime probes the campaign wrote.                                                                                                                     | Swept. A probe that settled a claim becomes a test before the prune, per `.claude/rules/quality.md` § Instruments. |
+| `ROADMAP.md`            | The repository's sequenced plan of record, where it keeps one.                                                                                             | Kept. Strike the chunks the campaign closed and add the forward work it revealed.                                  |
+| `PROPOSAL.md`           | A proposal for work nobody has ruled on yet.                                                                                                               | Deleted after the work lands or the proposal is refused. The ruling goes in the prune commit message.              |
+
+A plan-of-record file is not campaign residue. `ROADMAP.md` outlives every prune and takes the
+campaign's forward work; `PROPOSAL.md` is spent the moment its proposal is ruled on, and a spent
+proposal left in the tree reads as live work.
+
+## Sweep `tmp/` as a tree
+
+Sweep the whole `tmp/` tree, not the set of folders this campaign created. A journal, a log, or a
+brief left by an earlier session sits in the same directory, carries no date a reader checks, and
+is read by the next campaign as its own.
+
+- Name each file you find before deleting it. A file you cannot attribute to a closed campaign is
+  an open item for the carry check rather than residue.
+- Never sweep while a unit is live. `tmp/units/` and `tmp/<bench>/` hold the briefs and journals
+  live lanes are reading, and the Orchestrator's own instruments belong in its scratchpad for this
+  reason, per `.agents/orchestration.md` § Writing concurrency.
+- Delete a probe from the source tree before its unit returns, per `.claude/rules/tests.md`. A
+  leaked type probe is a placement-sweep failure rather than a retention question.
+
+## The carry check
+
+List every item the campaign folder leaves open: a defect, a measurement to re-take, a deferred
+decision, a withdrawn claim, an unmet acceptance condition. Each ends the check with a carrier — a
+commit that closed it, a live brief that owns it, or an explicit drop on the record. An item with
+no carrier blocks the prune.
+
+Read the register files for this — the plan, the readiness grade, the carry ledger, the triage —
+rather than every brief and report in the folder.
+
+## The promotion check
+
+Rule on each remaining file by what it asserts.
+
+- Product truth goes to the guide, where the parity gate reaches it.
+- A process law goes to the rule or contract file that owns it, in the commit that states it.
+- A decision goes to the commit message that made it, which is where it already sits.
+- Everything else is process diary and prunes.
+
+A section recording live state — adopter republish status, installed version tables, what a sibling
+repository was doing that week — prunes with no promotion. It was stale when it was written, and
+promoting it publishes the staleness.
+
+## The measurement check
+
+A number the guide carries out of the campaign folder carries the date it was taken. A measurement
+whose date the folder does not record is re-taken or dropped, never copied.
+
+## The orientation check
+
+A cross-session orientation document — a handoff, a package-root narrative file, a session log — is
+not a further category. It duplicates the guide for product truth and the contract for process
+truth, it is gated by nothing, and it drifts. Dissolve it into the artifacts that own it and delete
+it.
+
+## The prune commit
+
+Write the prune commit's message as the promotion record: what moved, and where each part landed.
+That message is what makes the deletion recoverable in practice rather than only in principle. Git
+history is the archive; the working tree is the workspace.
+
+Name in one message the guide passages the campaign produced, the rule and contract files that took
+its process laws, the measurements re-taken with their dates, and the campaign folder path the
+commit removes.

package/dist/host/agents/skills/{orkestrel-human-journey → orkestrel-prove-journey}/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: orkestrel-human-journey
+name: orkestrel-prove-journey
 description: Prove a browser application the way a person uses it — real keystrokes, clicks, and Tab/Enter against only what is visible and reachable — and generate the capture portfolio from those same journeys. Use when accepting a UI build, proving an application end to end, deciding whether a surface is reachable by keyboard alone, proving what a screen refuses as well as what it does, auditing whether the interface speaks the user's vocabulary rather than the engine's, producing the screenshots a design review judges, or whenever the only evidence a screen works is a test that drove it through JavaScript instead of through the interface.
 ---
 

package/dist/host/agents/skills/{orkestrel-human-journey → orkestrel-prove-journey}/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: 'Prove Human Journeys'
   short_description: 'Prove an application through the interface a person uses'
-  default_prompt: 'Use $orkestrel-human-journey to prove this application through the interface a person uses, and generate the capture portfolio from those journeys.'
+  default_prompt: 'Use $orkestrel-prove-journey to prove this application through the interface a person uses, and generate the capture portfolio from those journeys.'

package/dist/host/agents/skills/orkestrel-publish/SKILL.md

@@ -0,0 +1,77 @@
+---
+name: orkestrel-publish
+description: Run an Orkestrel release from layer order to registry confirmation. Use when the user asks to publish a package, to run a fleet-wide release wave, or to recover a release that stalled at the npm approval, and follow it for the per-repository visit, the bump ruling, the layer preparation, the login approval, and the five-minute upload window.
+---
+
+# Publish an Orkestrel release
+
+## Load authority
+
+Read the current files in this order:
+
+1. `AGENTS.md` and every applicable `.claude/rules/*.md` file.
+2. `.agents/orchestration.md` § Publishing the fleet and § Long-running commands. Each named
+   section binds every step here.
+3. The reference the moment needs: [wave.md](references/wave.md) before visiting a repository,
+   ruling on a bump, or preparing a layer; [window.md](references/window.md) before running
+   `npm login` or any upload.
+4. The live evidence: the registry's packument for every package in the round, each target's
+   manifest, and the catalog table the contract names as the layer order.
+
+The user's current instruction wins. The contract's § Publishing the fleet owns the credential
+and authorization law; nothing here weakens it.
+
+## The boundary with the contract
+
+`.agents/orchestration.md` § Publishing the fleet binds every release, and this skill does not
+repeat it. Read that section for the credential and approval law, the long-running-command
+binding, the serialization of uploads, the tarball swap that serves a consumer whose dependency
+has not published, what a bump obliges downstream, and where the layer order comes from.
+
+This skill carries what an operator needs while a release is running: the per-repository visit,
+the bump ruling, the preparation order, the login and approval mechanics, and the window.
+
+Where the skill and the contract disagree, the contract wins. Report the drift instead of
+following the skill.
+
+## Run the release
+
+1. **Name the round.** List the packages the release covers, and group them into layers by the
+   contract's layer order.
+2. **Take the registry evidence.** Read what the registry serves for every package in the round.
+   Derive each pin from that reading, never from a local manifest.
+3. **Visit each repository.** Run the visit in [wave.md](references/wave.md) in its stated order,
+   in parallel slices of disjoint repositories, each slice serial inside itself.
+4. **Rule on each package's bump.** Apply the triggers in [wave.md](references/wave.md). A package
+   whose published surface did not move takes its re-pin, its gates, and a commit to `main`, and
+   does not publish.
+5. **Prepare the whole layer before authenticating.** Bump, re-pin, install, sweep the self-pins,
+   run each package's own `prepublishOnly` to green, commit, and push. Every one of those steps
+   happens outside the window.
+6. **Reach the approval.** Follow [window.md](references/window.md), and launch the login chain
+   only after the user signals they are at the keyboard.
+7. **Spend the window.** Follow [window.md](references/window.md). Open the layer with one
+   package, confirm its upload from the registry, then chase the remaining uploads back-to-back.
+8. **Close the layer from the registry, then prepare the next.** A dependent's new pin cannot
+   install until the version it names exists, so preparation and publication interleave and cannot
+   be batched ahead.
+
+Run that sequence for every layer, from the registry reading to the registry close. Refresh the
+registry evidence between layers rather than carrying the previous round's reading forward.
+
+## Accept the release
+
+Completion requires:
+
+- every package the round named has ended published at a registry-confirmed version, published on
+  a later round with the reason recorded, or ruled as no bump with the evidence that ruled it;
+- every obligation § What a bump obliges places on a published package's dependents has closed as
+  that section requires;
+- every tarball swap is restored per § Fixing a dependency before it publishes, and no target
+  repository is left holding an uncommitted bump or an unpushed commit;
+- every gate that proved a package ran outside the window and against the artifact that shipped.
+
+Report the layers in publish order, each package with its registry-confirmed version, the bump
+rulings and their evidence, the approvals the user granted, and anything still unpublished. End
+with exactly one terminal line — `RELEASE: LANDED` when every package in the round has closed, or
+`RELEASE: OPEN` with the packages that have not.

package/dist/host/agents/skills/orkestrel-publish/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: 'Publish Orkestrel Release'
+  short_description: 'Run a release in layer order through the npm approval window'
+  default_prompt: 'Use $orkestrel-publish to run the release - layer order, per-repository visit, bump ruling, layer preparation, login approval, upload window, and registry confirmation.'

package/dist/host/agents/skills/orkestrel-publish/references/wave.md

@@ -0,0 +1,97 @@
+# The release wave
+
+Close a fleet-wide goal of every package on registry-served versions as a release wave in layer
+order: visit every
+repository once per round with one procedure, publish each layer in one window, and only then
+prepare the next.
+
+## Visit a repository
+
+Run the visit in this order. A step that reads generated or installed state is invalid before the
+step that writes it.
+
+1. Re-pin the target's `@orkestrel/scaffold` devDependency and install, so the overwrite runs the
+   current vendored host.
+2. Run `scaffold overwrite`.
+3. Force-verify every `@orkestrel` range against a registry sweep taken after the previous layer
+   published.
+4. Run the full install.
+5. Run the mutating `format` script to converge generated writes.
+6. Run the quality gates.
+7. Compare the rebuilt `dist/` against the published tarball for material content.
+
+Restore any unpublished tarball the target is holding before the quality gates run, per
+`.agents/orchestration.md` § Fixing a dependency before it publishes. A distribution proof run
+against a local tarball proves the local tarball.
+
+Run visits in parallel slices of disjoint repositories, each slice strictly serial inside itself,
+reporting per target. Refuse a failed target, name it, repair it, and re-run it alone.
+
+## Rule on the bump
+
+Bump on either trigger: the rebuilt dist differs materially from the published tarball, or the
+final runtime dependency set differs from the published packument.
+
+- Test the final dependency set against the packument, never "did my step move a pin". The
+  `declare` step inside `scaffold overwrite` re-pins before any later check, so the step-local
+  reading reports nothing moved while the manifest surface did.
+- Treat a re-pinned runtime range as published surface. Without the bump a consumer installs
+  duplicate copies of the moved dependency.
+- Compare material content only, as `.agents/orchestration.md` § What a bump obliges defines it,
+  and take the blast radius of a bump from that section rather than deciding it here.
+- Ship a dist built before the version bump wherever the bump edits no emitted byte. Check that
+  per package rather than assuming it: a package that imports its own `package.json` version into
+  published code emits that version, so its pre-bump dist is stale the moment the version moves.
+  Rebuild after the bump there and pack from the rebuilt tree. The `npm publish --ignore-scripts`
+  command skips `prepack`, so that rebuild is the operator's step rather than the publish's.
+
+## Prepare a layer
+
+An unpublished package's first version is `0.0.1`. Do not bump it before that first publish. The
+registry has nothing to serve, so there is no version to move away from, and bumping produces a
+package whose history starts at a number nothing explains.
+
+Prepare a published package's layer in this order:
+
+1. **Bump from what the registry serves, not from the local manifest.** A repository's `version`
+   field can sit a release behind what was published from another checkout, and bumping that
+   produces a version the registry already holds, which fails on upload after the whole gate chain
+   has run. Read the registry first.
+2. **Re-pin every `@orkestrel` range to what the registry serves, and install.**
+3. **Sweep the self-pins**, per the following section.
+4. **Run each package's own `prepublishOnly` script to green.**
+5. **Commit and push before the window opens.**
+
+Prepare the next layer only after this one is on the registry. A dependent's new pin cannot
+install until the version it names exists, so preparation and publication interleave and cannot be
+batched ahead.
+
+The window is for uploads. Every gate, build, install, and commit happens outside it, which is
+what makes `--ignore-scripts` the right flag at publish time: the artifact was already proved, and
+the flag is what stops the gate chain running a second time inside the five minutes.
+
+## Sweep the self-pins
+
+A package's own version appears in its source and its tests as a literal, and a bump falsifies
+every one of them. Run this sweep after the re-pin install, not after the manifest edit.
+
+- `grep` the prior version literal across `tests/` and `src/` in the publishing package, and rule
+  on every hit. A canned packument in a fixture and a looked-up version in a CLI suite carry the
+  version with no tripwire comment beside them, so they surface as a red gate after the bump
+  rather than as a planned edit before it.
+- Move a documented tripwire — a golden digest over generated output — in the same change as the
+  version bump. That is what the tripwire is for.
+- Re-take a generated artifact's digest after the install, because the generated bytes can derive
+  from the installed tree rather than from the manifest. An install that picks up a newly
+  published dependency moves such a digest with no manifest edit at all, and reverting the
+  manifest pin does not restore it.
+- Prove the cause of a moved digest before recording it. Patch the generated bytes back to the
+  prior content and reproduce the prior digest: a digest that stays moved after the pin is
+  reverted has a cause the pin does not explain, and a new digest recorded without that control is
+  a value nobody can check.
+
+## Refresh the registry between layers
+
+Refresh the registry evidence between layers and derive each round's pins from it. A pin can only
+name a version the registry already serves, so a dependency shipping in the same window keeps the
+resolvable previous pin and takes its development-only re-pin after the window closes.

package/dist/host/agents/skills/orkestrel-publish/references/window.md

@@ -0,0 +1,95 @@
+# The approval and the upload window
+
+The npm approval is the user's click, and the window it opens is five minutes long. Reach that
+click with a live chain, and spend the window without losing it.
+
+## Arm the terminal
+
+- Run the login and every publish under `script -qfc '<command>' <log>`. npm offers the approval
+  only when it sees a TTY; without one it fails `EOTP` with no way to answer.
+- Pass `--browser=false` to `npm login` and to every `npm publish`. Without it npm prints
+  `Press ENTER to open in the browser...` and blocks. Never answer that prompt with a newline: the
+  web flow consumes the newline on a later read, drops to a legacy `Username:` prompt, and exits
+  **zero** without authenticating. With the flag npm prints the URL and polls, and stdin stays
+  untouched.
+- Hold stdin open and write nothing to it. Use a fifo held open by a long `sleep`. EOF drops npm
+  to the same legacy prompt a stray newline does.
+- Run `npm login` before any publish. The `npm publish` command does not open the browser flow:
+  unauthenticated it returns `E404` on `PUT`, which reads as a missing package rather than as a
+  missing credential.
+- Confirm authentication with `npm whoami`, never with an exit code. The legacy fallthrough exits
+  zero.
+- Re-probe `whoami` immediately before opening the window. A stored credential expires
+  mid-session, so a session-start answer does not hold.
+- Read a login log that shows the spinner and then a legacy `Username:` prompt as an expired
+  attempt rather than as a prompt to answer. Kill it by process id and mint a fresh flow.
+- On a Windows host, Git Bash ships no `script` binary, so the upload step is operator-driven:
+  prepare the layer, prove the gates, surface the exact `npm publish` command, and the operator
+  runs it in a real terminal. Everything before and after the upload — bumps, re-pins, gates,
+  registry reads — stays with the Orchestrator. The fifo stdin law still binds on that host.
+
+## Reach the approval
+
+- Launch the login chain only when the user has signalled they are at the keyboard and will click
+  within ten minutes. An approval URL expires unclicked in about ten to fifteen minutes, and an
+  overnight gap expires the session credential with it.
+- Expect an approval for each stage. The `npmjs.com/login/cli/<id>` URL authenticates the session;
+  the `npmjs.com/auth/cli/<id>` URL authorizes the publish and opens the five-minute window. Tell
+  the user both are coming, or the second link reads as the first having failed.
+- Say that approving the publish one opens a five-minute window covering the rest of the layer.
+- Surface each approval URL the moment it appears in the log, and take the **last** one in log
+  order. npm mints a new URL whenever an attempt starts again, and the log accumulates every one,
+  so a URL chosen by sorting rather than by position is already dead when the user opens it.
+- Read the URL out of the journal in the foreground and surface it before arming any watcher. A
+  watcher-based relay can fail silently, and its silence is indistinguishable from a chain that
+  has not reached the URL yet.
+- Relay the URL as plain text. A decorated link did not render for the operator, who then had
+  nothing to click while the window ran down.
+- Re-read the log before treating an approval as failed. The chain is usually still alive on a
+  later URL, so surface that one rather than starting the chain again.
+- Read a `404` on an approval URL as a publish that already succeeded and consumed it. Read the
+  registry before calling it a failure.
+
+## Spend the window
+
+- The window opens when the user approves, not when the first publish starts.
+- Open each layer with one package: publish it alone, surface its approval URL the moment the
+  journal shows it, and confirm the upload from the registry before starting the rest.
+- Then chase the remaining uploads back-to-back in one process with no gap. An upload started
+  within seconds of an approval frequently rides that approval, and each one that does not mints
+  its own URL.
+- Relay every new URL to the user the moment it appears, through a journal watcher, and never
+  pause the chain to wait for a click: a poll outlives the relay.
+- Tell the user to click only the URL last in log order. A click on a superseded URL poisons the live attempt
+  — the current poll fails `403 Forbidden - GET /-/v1/done` mid-flight. After any such 403,
+  confirm no publish process is live, then mint one fresh attempt.
+- **Never retry a publish that is still waiting for its authorization.** Each `npm publish`
+  attempt mints a new `authId` and invalidates the previous one, so a retry loop makes the URL a
+  moving target the user cannot approve in time. The abandoned poll then reports
+  `403 Forbidden - GET /-/v1/done?authId=…`, which reads as a permissions problem and is the
+  abandoned attempt colliding with the live one. Publish the first package of a layer with exactly
+  one attempt.
+- Retry only an upload that failed **inside** an already-open window. `EOTP` there is intermittent
+  contention rather than the window closing: retry about three times, and retry a failed set after
+  the layer ends. Packages have landed on the third attempt and on a later pass with no new
+  approval. These are different failures wearing similar codes; a retry fixes in-window contention
+  and causes the moving approval target.
+- Expect a large layer to outlast one window. Size batches to what uploads in five minutes and
+  name each planned approval point to the user, rather than discovering them mid-run.
+- The contract's serialization law binds every upload in the window, and
+  `.agents/orchestration.md` § Long-running commands binds the chain that runs them.
+
+## Read the verdict from the registry
+
+- Read the result from the registry, not from an exit code. A piped `npm publish` reports the exit
+  status of the pipeline, and a CDN read straight after a publish can still serve the previous
+  version.
+- Treat a `404` after a first publish as pending rather than failed. A first publish creates the
+  packument and can serve `404` for minutes after success, so for a package with no prior version
+  re-read on an interval before reporting either way. A bump serving the old version is CDN lag,
+  same rule.
+- Rule on a pack-time manifest-rewriting warning by fetching the registry's copy of the manifest,
+  never by the warning's own text.
+- Re-read the registry before telling the user a package failed. A chain still running, a retry
+  that landed, and CDN lag all produce a failure reading that the registry contradicts, and a
+  false failure report costs a needless approval and a needless republish.

package/dist/host/agents/templates/brief.md

@@ -0,0 +1,157 @@
+# Dispatch brief template
+
+Copy this file for each dispatch and fill every row. Then run
+`.agents/orchestration.md` § "Check the brief before you send it" against what you filled, and save
+the filled copy and the returned report under the names § "Every dispatch is a file before it is a
+launch" fixes.
+
+Replace every placeholder written in upper snake case with a concrete value. Retitle the filled
+copy `# Unit UNIT_ID — SHORT_SUBJECT`. Delete each italic reminder as you fill the row it sits
+under, and leave no row blank: fill a row you cannot close with a named unknown label, and
+describe that label under § Unknowns with how the unit reports back on it.
+
+## Role and engine
+
+ROLE_NAME on ENGINE_NAME, reached as TRANSPORT.
+
+_Name the executor that opens this brief — a native subagent, a bench engine inside its own CLI, or a
+bridge driver — and write every later section for that reader._
+
+## Objective
+
+ONE_OUTCOME.
+
+_State one outcome. Give a small unrelated obligation its own unit._
+
+## Context
+
+**Evidence.** PASTED_COMMANDS_AND_OUTPUT
+
+_Paste the command and its output behind every factual claim: paths, counts, registrations, file
+existence. Name the scope each search covered, and check each fact against the code rather than
+against another artifact that states it._
+
+**Law.** `AGENTS.md`, RULE_FILES, SKILL_NAME and the references it requires, GUIDE_OR_SPEC.
+
+_Name each applicable rule file, the dispatch-named skill and its required references, and the
+governing guide or spec. Write `none` in a slot that is genuinely empty rather than dropping the
+slot._
+
+**Host.** SHELL, WORKING_PATH, NETWORK_AND_SANDBOX_LIMITS.
+
+_Name the shell, the working path, and the sandbox, network, and approval limits the unit's commands
+run under._
+
+**Measurements.** MEASURED_FACTS_AND_THE_CONDITIONS_THEY_WERE_TAKEN_UNDER.
+
+_Take each measurement under the conditions the unit runs in, or have the unit take it before doing
+anything else._
+
+**Control identifiers.** CONTROL_LABELS.
+
+_Keep this brief's control labels inside this brief, and state that a test is named for what it
+proves rather than for the control that specified it._
+
+**Standing conditions.** DIRTY_FILES, KNOWN_FAILING_COMMANDS, BLOCKED_TOOLS.
+
+_Name each condition the unit meets and must not diagnose as its own: a file expected to be dirty, a
+command known to fail, a gate red at the baseline, a shim the shell blocks, and who repairs each
+one._
+
+## Unknowns
+
+UNKNOWN_FACT and HOW_THE_UNIT_REPORTS_IT.
+
+_Name what you do not know that the unit needs, as an unknown, with the report-back it takes. Write
+`none` where the brief is fully specified, rather than shipping a guess the unit has to invent an
+answer around._
+
+## Scope
+
+**Owned.** OWNED_FILES
+
+_Grant a behaviour with the tests that pin it, a constant with every fixture and expectation derived
+from it, a template with the materialized copy the package generates from it, and a mechanism with
+the prose describing it: the comment beside the code it edits and the guide passage stating the
+behaviour it moves._
+
+**Shared (report-only).** SHARED_FILES
+
+_Name each file another live unit owns. The unit returns an exact patch for serial integration and
+edits nothing in this row._
+
+**Off-limits.** OFF_LIMITS_FILES
+
+_Name each file the unit must not touch, and read every acceptance criterion against this row line by
+line. Grant the file a criterion needs, or strike that criterion. A file the change breaks that
+appears in no row of this section is unscoped._
+
+**What asserts the state this change ends.** FILES_THE_RESULT_MAKES_FALSE
+
+_List every file the result makes false rather than every file that declares the thing changing: the
+test asserting the reversed behaviour, the fixture carrying the raised value, the golden digest over
+generated output, the consumer script naming the removed union member. Derive the list by running the
+suite; where you cannot run it, name the search's bound so the unit re-derives the list. End each
+entry in Owned, in Shared, or with a named carrier dispatched before this change ships._
+
+**Tools and limits.** ALLOWED_TOOLS, PERMISSION_LIMITS
+
+_Check the § Output mechanism and every acceptance criterion's verification method against this
+allowlist. A read-only lane writes no report file and runs no probe, so hand it the rendered evidence
+instead._
+
+## Execution
+
+**A native subagent, or a bench engine reading this brief inside its own CLI:** perform the
+assignment directly and spawn nothing.
+
+**A bridge driver:** carry this brief across unaltered, launch ENGINE_NAME through its CLI, and
+return the journal path and the session id with the result.
+
+_Keep the line written for the reader this brief reaches. Delete the line written for the other
+reader. A bench result that carries no journal path and no session id ran on the driver's own engine:
+refuse it._
+
+## Output
+
+RETURN_SHAPE, delivered through OUTPUT_MECHANISM.
+
+_State the exact distilled return shape and the mechanism that delivers it. No process diary._
+
+## Deviation contract
+
+Stop and report — expected, found, exact evidence, done or not done, and at most one short
+hypothesis — on CONFLICT_WITH_THE_OBJECTIVE. Decide, record, and carry on from
+ANCILLARY_CONFLICT_THE_UNIT_SETTLES.
+
+_Scope the contract. A conflict with the objective stops the unit; where a paragraph sits and which
+heading a section takes are the unit's to settle._
+
+## Acceptance criteria
+
+1. REGENERATION_OR_CHEAPEST_GATE_CRITERION
+2. SCOPED_GATE_CRITERION
+3. ARTIFACT_CRITERION
+
+_Order the criteria cheap-first, so an unreachable criterion cannot hide a typecheck or a lint
+criterion behind it. Where the change edits a file the repository vendors or digests, put the
+regeneration step ahead of every gate that reads the generated artifact. Ask what the change does
+to every fact you measured, and fix each criterion to the state the unit finishes in. Close each
+criterion with owned files alone, and name the property the unit must change; record a consequence
+you expect to follow as an observation, never as a criterion. A scoped run over the unit's own
+owned files stays a legitimate criterion._
+
+**Observations, not criteria.** TIMING_SENSITIVE_OR_WHOLE_SUITE_GATES
+
+_Name each timing-sensitive or whole-suite gate as an observation the unit reports with its own
+reading. Take the authoritative run yourself after the unit exits._
+
+## Review evidence
+
+EVIDENCE_FOR_EVERY_ROW_THIS_SUBJECT_OCCUPIES.
+
+_Supply what `orkestrel-falsify` § "Evidence, by subject type" requires of each row the subject
+occupies: for a code change the actual diff and the actual status output, for a rendered or
+externally driven surface the capture portfolio as primary and source as corroboration, and for a
+policy, design, or process proposal the proposal, the canon it must satisfy, and the record of what
+motivated it. A subject occupying more than one row takes the evidence of every row._