@orkestrel/scaffold 0.0.55 → 0.0.57

package/dist/host/agents/orchestration.md

@@ -161,9 +161,12 @@ when the role file already pins it.
 - `implementer` names the harness's native implementation lane, so the token means Opus in Claude
   Code and Sol in Codex. An engine-named bridge — `sol`, `opus` — names the other engine. Read a
   role name against the harness you are running in, and state the engine anyway.
-- Give every role a file on both sides. The role file is where engine, effort, tools, permissions,
-  and charter are pinned, and the tool allowlist is what makes the read-only floor real. A role
-  with no file has nowhere to pin either.
+- Give every role a file in the scaffold checkout, under `.claude/agents/` and under
+  `.codex/agents/`. The role file is where engine, effort, tools, permissions, and charter are
+  pinned, and the tool allowlist is what makes the read-only floor real. A role with no file has
+  nowhere to pin either. The requirement is the canon repository's alone: a fleet target holds the
+  catalog agent and no other role, and a session that dispatches roles starts on scaffold and
+  attaches the target.
 - Reach every role by its own name. Do not rely on a remembered route.
 - `researcher`, `scout`, and `checker` are native lanes for jobs that belong to Grok first.
   Dispatch `grok` with their brief before using them, and use the native role only once the ladder

package/dist/host/agents/skills/orkestrel-publish/SKILL.md

@@ -50,8 +50,10 @@ following the skill.
    happens outside the window.
 6. **Reach the approval.** Follow [window.md](references/window.md), and launch the login chain
    only after the user signals they are at the keyboard.
-7. **Spend the window.** Follow [window.md](references/window.md). Open the layer with one
-   package, confirm its upload from the registry, then chase the remaining uploads back-to-back.
+7. **Authorize and upload.** Follow [window.md](references/window.md). Take the account's one-time
+   code where it has one, because that path opens no window. Where the account answers with no
+   code, the browser authorization opens the five-minute window: open the layer with one package,
+   confirm its upload from the registry, then chase the remaining uploads back-to-back.
 8. **Close the layer from the registry, then prepare the next.** A dependent's new pin cannot
    install until the version it names exists, so preparation and publication interleave and cannot
    be batched ahead.

package/dist/host/agents/skills/orkestrel-publish/references/wave.md

@@ -12,7 +12,24 @@ step that writes it.
 
 1. Re-pin the target's `@orkestrel/scaffold` devDependency and install, so the overwrite runs the
    current vendored host.
-2. Run `scaffold overwrite`.
+2. Run `scaffold overwrite`. One run repairs the `AGENTS.md` and `CLAUDE.md` pointers and deletes
+   every tracked copy the target still holds at an instruction-canon path. Prove the sweep with a
+   second `scaffold audit` that exits `0`.
+   - Where the target's `.claude/agents/orkestrel.md` carries a body outside the marker-bounded
+     table that differs from the floor copy the installed scaffold stages, delete the file and
+     commit the deletion before the run. `repair` restores the floor body and `catalog` refills the
+     table, so one visit leaves the current file and the committed deletion keeps the
+     uncommitted-work refusal from firing. Presence ownership never replaces present bytes and the
+     table rewrite touches only the marker-bounded region, which is why the deletion is the
+     migration.
+   - The deletion draws on what git tracks, so an untracked copy survives it, and the verb refuses
+     the whole run as uncommitted work while an unignored one stands. Commit that copy or delete it
+     by hand before re-running. `--dirty` clears the refusal and leaves the copy standing, and a
+     kept `.claude/rules` copy then reddens the target's own policy sweep: the pointer `AGENTS.md`
+     carries no rule map, so the copy has no row there and the sweep reports it. Delete the copy
+     rather than waiving past it.
+   - A copy the target git-ignores stays a `foreign` finding, so that target never reaches exit `0`
+     again. Keep a local MCP server registration outside the repository rather than at `.mcp.json`.
 3. Force-verify every `@orkestrel` range against a registry sweep taken after the previous layer
    published.
 4. Run the full install.
@@ -22,7 +39,16 @@ step that writes it.
 
 Restore any unpublished tarball the target is holding before the quality gates run, per
 `.agents/orchestration.md` § Fixing a dependency before it publishes. A distribution proof run
-against a local tarball proves the local tarball.
+against a local tarball proves the local tarball. Stage an unpublished tarball with
+`npm install --no-save`, because a `file:` pin refuses the blueprint and the manifest keeps a
+registry range.
+
+Where a visit runs before scaffold itself publishes, run `scaffold overwrite --offline` and prove
+the sweep with `scaffold audit --offline`. The online verbs read vendored bytes from the published
+package, so an unpublished scaffold's visit otherwise writes the registry's older floor, and an
+online audit reports the floor-restored files as stale until the release. The `--offline` overwrite
+skips the catalog step and exits `1` with a note naming that refusal, so run the full
+`scaffold overwrite` after the release.
 
 Run visits in parallel slices of disjoint repositories, each slice strictly serial inside itself,
 reporting per target. Refuse a failed target, name it, repair it, and re-run it alone.

package/dist/host/agents/skills/orkestrel-publish/references/window.md

@@ -1,7 +1,11 @@
 # The approval and the upload window
 
-The npm approval is the user's click, and the window it opens is five minutes long. Reach that
-click with a live chain, and spend the window without losing it.
+A release needs the user at the keyboard to authenticate the session, and again to authorize each
+upload. An approval URL dies unclicked in under a minute, so mint one only in a
+moment the user can click, and relay it byte for byte. Where the account answers with a one-time
+code, take that code for the upload — it needs no browser authorization and opens no window to
+lose. Where the account has no code, the browser authorization opens a five-minute window, and the
+rest of the layer either fits inside it or takes another approval.
 
 ## Arm the terminal
 
@@ -19,8 +23,8 @@ click with a live chain, and spend the window without losing it.
   missing credential.
 - Confirm authentication with `npm whoami`, never with an exit code. The legacy fallthrough exits
   zero.
-- Re-probe `whoami` immediately before opening the window. A stored credential expires
-  mid-session, so a session-start answer does not hold.
+- Re-probe `whoami` immediately before the first upload. A stored credential expires mid-session
+  and an overnight gap expires it, so a session-start answer does not hold.
 - Read a login log that shows the spinner and then a legacy `Username:` prompt as an expired
   attempt rather than as a prompt to answer. Kill it by process id and mint a fresh flow.
 - On a Windows host, Git Bash ships no `script` binary, so the upload step is operator-driven:
@@ -30,13 +34,30 @@ click with a live chain, and spend the window without losing it.
 
 ## Reach the approval
 
-- Launch the login chain only when the user has signalled they are at the keyboard and will click
-  within ten minutes. An approval URL expires unclicked in about ten to fifteen minutes, and an
-  overnight gap expires the session credential with it.
-- Expect an approval for each stage. The `npmjs.com/login/cli/<id>` URL authenticates the session;
-  the `npmjs.com/auth/cli/<id>` URL authorizes the publish and opens the five-minute window. Tell
-  the user both are coming, or the second link reads as the first having failed.
-- Say that approving the publish one opens a five-minute window covering the rest of the layer.
+- Mint an approval only when the user is at the keyboard in that moment and can click immediately.
+  A URL minted while the user is still on their way is dead before they arrive.
+- Put the URL on the first line of the message, with nothing before it. A reader who must read
+  anything before clicking arrives after the session is gone.
+- Relay the URL exactly as the journal holds it. The `npm login --browser=false` command prints
+  `https://www.npmjs.com/login?next=/login/cli/<id>`, and the `npm publish --browser=false` command
+  prints `https://www.npmjs.com/auth/cli/<id>`.
+- Never shorten, redirect-strip, or otherwise improve a minted URL. The bare
+  `https://www.npmjs.com/login/cli/<id>` target the login URL names is not a page: opened in a
+  browser it answers `{"message":"Unauthorized"}`. The user then reads a broken chain where the
+  chain is healthy, and the operator diagnoses the wrong failure.
+- Expect an unclicked session to die about 45 seconds after it is minted. Measured on 2026-08-27
+  against `registry.npmjs.org` with `npm` 10.9.7 and `node` 22.22.2: npm polls `GET /-/v1/done`
+  every few seconds and takes `202` while the session waits, and the registry answers `403` at
+  about 45 seconds. Whether the registry fixes that abandon by elapsed time or by poll count is
+  unmeasured, so plan against the duration.
+- Recognise the abandon on each side. The `npm login` command reads the `403` as web login being
+  unsupported and drops to its legacy `Username:` prompt. The `npm publish` command exits `E403`
+  naming `GET /-/v1/done?authId=`.
+- Never keep a link alive by re-minting on a loop. Each mint invalidates the URL before it, so a
+  supervisor that re-mints on expiry makes the link a moving target and every relayed URL is dead
+  on arrival. Mint once per human moment, and mint again only when the user asks.
+- Name the login approval and the upload authorization to the user before either arrives, or the
+  authorization link reads as the login having failed.
 - Surface each approval URL the moment it appears in the log, and take the **last** one in log
   order. npm mints a new URL whenever an attempt starts again, and the log accumulates every one,
   so a URL chosen by sorting rather than by position is already dead when the user opens it.
@@ -45,13 +66,33 @@ click with a live chain, and spend the window without losing it.
   has not reached the URL yet.
 - Relay the URL as plain text. A decorated link did not render for the operator, who then had
   nothing to click while the window ran down.
-- Re-read the log before treating an approval as failed. The chain is usually still alive on a
+- Re-read the log before treating an approval as failed. The chain is sometimes still alive on a
   later URL, so surface that one rather than starting the chain again.
 - Read a `404` on an approval URL as a publish that already succeeded and consumed it. Read the
   registry before calling it a failure.
 
+## Authorize the upload
+
+- Take the account's one-time code where the account has one. The
+  `npm publish --ignore-scripts --otp=<code>` command uploads with no browser authorization and no
+  poll, so it carries neither a window nor a race. In the `@orkestrel/scaffold` 0.0.56 run on
+  2026-08-27 the browser authorization failed on the 45-second abandon and the one-time code
+  uploaded the package with no retry.
+- Ask for the code at the moment of the upload, and run the upload inside that code's own life. A
+  code read minutes earlier is already spent.
+- Ask for the code and nothing else. Never ask for a password, an access token, or an auth file.
+  `.agents/orchestration.md` § Publishing the fleet owns that law.
+- Arm a one-time-code upload the way § Arm the terminal arms every other publish.
+- Fall back to the browser authorization where the account answers with no code. That path mints
+  the `auth/cli/<id>` URL, needs the click inside the session's life, and opens the five-minute
+  window.
+- Tell the user that approving an `auth/cli/<id>` URL opens a five-minute window covering the rest
+  of the layer.
+
 ## Spend the window
 
+- Everything under this heading is the browser-authorization path. A one-time-code upload opens no
+  window, so none of it binds that path.
 - The window opens when the user approves, not when the first publish starts.
 - Open each layer with one package: publish it alone, surface its approval URL the moment the
   journal shows it, and confirm the upload from the registry before starting the rest.
@@ -60,18 +101,16 @@ click with a live chain, and spend the window without losing it.
   its own URL.
 - Relay every new URL to the user the moment it appears, through a journal watcher, and never
   pause the chain to wait for a click: a poll outlives the relay.
-- Tell the user to click only the URL last in log order. A click on a superseded URL poisons the live attempt
-  — the current poll fails `403 Forbidden - GET /-/v1/done` mid-flight. After any such 403,
-  confirm no publish process is live, then mint one fresh attempt.
+- Tell the user to click only the URL last in log order. A click on a superseded URL poisons the
+  live attempt, and the current poll then fails `403 Forbidden - GET /-/v1/done` mid-flight.
+  § Read a `403` on the poll owns the recovery.
 - **Never retry a publish that is still waiting for its authorization.** Each `npm publish`
   attempt mints a new `authId` and invalidates the previous one, so a retry loop makes the URL a
-  moving target the user cannot approve in time. The abandoned poll then reports
-  `403 Forbidden - GET /-/v1/done?authId=…`, which reads as a permissions problem and is the
-  abandoned attempt colliding with the live one. Publish the first package of a layer with exactly
+  moving target the user cannot approve in time. Publish a layer's opening package with exactly
   one attempt.
 - Retry only an upload that failed **inside** an already-open window. `EOTP` there is intermittent
   contention rather than the window closing: retry about three times, and retry a failed set after
-  the layer ends. Packages have landed on the third attempt and on a later pass with no new
+  the layer ends. Packages have landed on a third attempt and on a later pass with no new
   approval. These are different failures wearing similar codes; a retry fixes in-window contention
   and causes the moving approval target.
 - Expect a large layer to outlast one window. Size batches to what uploads in five minutes and
@@ -79,6 +118,21 @@ click with a live chain, and spend the window without losing it.
 - The contract's serialization law binds every upload in the window, and
   `.agents/orchestration.md` § Long-running commands binds the chain that runs them.
 
+## Read a `403` on the poll
+
+`403 Forbidden - GET /-/v1/done` carries more than one cause, and each takes a different reading of
+the same status. Rule from the evidence, never from which cause reads likelier.
+
+- Nobody clicked inside the session's life. The poll ran out its 45 seconds against a URL no one
+  opened, and the registry closed the session.
+- The user clicked a superseded URL and poisoned the live attempt. The poll fails mid-flight while
+  the user is looking at a page that reports success.
+- Tell those causes apart from the log and the user, never from the status alone. A single minted
+  URL that nobody opened in time is the abandon. A log carrying a URL the running attempt
+  superseded, with the user reporting a click, is the poisoned attempt.
+- Recover the same way whichever it was: read the registry for the version, confirm no publish
+  process is live, then mint exactly one fresh attempt with the user at the keyboard.
+
 ## Read the verdict from the registry
 
 - Read the result from the registry, not from an exit code. A piped `npm publish` reports the exit

package/dist/host/claude/agents/orkestrel.md

@@ -9,8 +9,12 @@ permissionMode: dontAsk
 
 You are the read-only Orkestrel ecosystem reconciler. Spawn nothing and edit nothing.
 
-Read `.agents/orchestration.md` first. It owns the role set, the routing, and the
-dispatch contract. Then read `AGENTS.md`, applicable rules, the dispatch-named skill and
+Read the orchestration contract first. It owns the role set, the routing, and the
+dispatch contract. Resolve it against scaffold. In the scaffold checkout it sits at
+`.agents/orchestration.md`. A repository that installs scaffold reads it at
+`node_modules/@orkestrel/scaffold/dist/host/agents/orchestration.md`, or in a scaffold
+checkout beside that repository, as that repository's own `AGENTS.md` pointer names. Then
+read `AGENTS.md` itself, the applicable rules it names, the dispatch-named skill and its
 references, and the governing guides.
 
 Your job is reconciliation over supplied evidence, never collection. You have no shell

package/dist/host/claude/rules/quality.md

@@ -60,6 +60,7 @@ A review that reads a diff finds what the diff shows. A review that tries to bre
 
 - An instrument is not evidence until it has failed. Pair every probe, comparison, or matrix with a negative control that must report failure, run under the same conditions. An identity check whose control reports "same" has measured nothing.
 - When a question about a TypeScript edit can supply a workspace project, a case of workspace files with a test, and a negative control naming its files, its test, the stage it must fail at, and why, call the `prove` tool the `probe` MCP server registers before relying on the answer. When the question supplies no project, no case, or no control, follow `.claude/rules/tests.md` § Probes and report the fallback instrument's own control and coverage.
+- When no `probe` server is registered in the session, register one outside the repository, in the harness's own local or user MCP scope — in Claude Code, `claude mcp add` outside project scope — naming the installed `node_modules/@orkestrel/probe/dist/bin/main.js` entry, and start it in the repository whose projects the question names, because the server fixes its workspace from its own working directory. The registration cannot live in the tree: a scaffold target holds no `.mcp.json` file, that path is instruction canon, and a copy at it reports as foreign drift on every `scaffold audit` run. Where the harness registers no server at all, treat the question as supplying no project and take the preceding rule's fallback.
 - Quote the closing line of the `prove` answer verbatim in every report, brief, and audit verdict that rests on the claim: the `receipt probe:<digest>:…` line when the case ran clean and the control broke exactly where the claim declared it would, and the `no receipt` line otherwise. A `no receipt` line leaves the claim unproved — report it with the stage that refused.
 - Read a receipt as evidence about its claim, never as a gate result. The gate chain still runs, and `verifier` still owns its result.
 - Draw the negative control from outside the population the instrument covers. Name the instrument's membership rule first, then pick a control that rule excludes. A control sampled from constructs the instrument already handles proves only that it discriminates among those constructs, and says nothing about the class it silently cannot reach.