@orkestrel/scaffold 0.0.64 → 0.0.66

package/dist/host/claude/settings.json

@@ -977,7 +977,7 @@
 					},
 					{
 						"type": "command",
-						"command": "\"$CLAUDE_PROJECT_DIR\"/scripts/ollama.sh",
+						"command": "if [ \"${CLAUDE_CODE_REMOTE:-}\" = \"true\" ]; then \"$CLAUDE_PROJECT_DIR\"/scripts/ollama.sh; fi",
 						"timeout": 600
 					},
 					{

package/dist/host/claude/skills/enterprise-bootstrap/SKILL.md

@@ -1,25 +1,26 @@
 ---
 name: enterprise-bootstrap
 description: >-
-  Design and build distinctive, production-grade user interfaces with Bootstrap
-  5.3 and intentional frontend craft, in any host project and on any stack. Use
-  for Bootstrap user-interface work — creating, restyling, or
+  Design and build distinctive, production-grade UI with Bootstrap 5.3 on any
+  stack. Use for any Bootstrap interface work — creating, restyling, or
   extending pages, screens, components, layouts, app shells, dashboards, admin
   panels, SaaS tools, data tables, filter bars, forms, wizards, navigation,
   modals, empty/loading/error states, dark mode, marketing surfaces — whenever
   the task touches HTML/CSS/visual design, mentions Bootstrap or its components,
-  or must look professional and avoid templated defaults. Covers aesthetics,
-  typography, color modes, design tokens, accessibility (WCAG 2.2 AA),
-  responsive layout, and enterprise app patterns. The `orkestrel-polish-surface`
-  skill owns a requested verdict, round, or campaign over a surface that already
-  renders, including a review that changes nothing. In that campaign's fix
-  units, use this skill for Bootstrap craft.
+  asks for visual hierarchy, polish, a design system, or spacing/type/color
+  scales, or must look professional rather than like stock Bootstrap. Covers
+  aesthetics, typography, color modes, design tokens, elevation, finishing
+  details, accessibility (WCAG 2.2 AA), responsive layout, and enterprise app
+  patterns. The `orkestrel-polish-surface` skill owns a requested verdict,
+  round, or campaign over a surface that already renders, including a review
+  that changes nothing; in that campaign's fix units, use this skill for
+  Bootstrap craft.
 ---
 
 # Load the canonical workflow
 
 Read `.agents/skills/enterprise-bootstrap/SKILL.md` completely, then read every
-reference layer it names for the work in hand. Follow that canonical package before acting.
+reference layer it names for the work in hand. Follow that canonical skill before acting.
 
 This bridge contains no independent process. `AGENTS.md`, applicable rules, the
 canonical skill, and the governing guide/spec remain authoritative in that order.

package/dist/host/guides/scaffold.md

@@ -33,7 +33,7 @@ print. Limits states what that leaves unproven and what covers it instead.
 npm install --save-dev @orkestrel/scaffold
 ```
 
-The executable needs Node 22.12 or later. Run it through `npx` without installing:
+The executable needs Node 22.18.0 or later. Run it through `npx` without installing:
 
 ```sh
 npx @orkestrel/scaffold --help
@@ -149,13 +149,14 @@ Exported from `@orkestrel/scaffold`, and reachable from
 | `MAX_TOTAL_ARTIFACT_BYTES`        | const | Caps the bytes retained across one whole plan or audit.                                                |
 | `MAX_TOTAL_REGISTRY_BYTES`        | const | Caps the decoded bytes accepted across one registry-reading call.                                      |
 | `MINIMUM_NODE_VERSION`            | const | Names the oldest Node version the generated toolchain supports.                                        |
+| `MINIMUM_NPM_VERSION`             | const | Names the oldest npm version the generated toolchain supports.                                         |
 | `NAME_PATTERN`                    | const | Matches the bare workspace name syntax: lowercase alphanumeric with hyphens, letter first.             |
 | `ORCHESTRATION_PATH_NAMES`        | const | Lists the exact root paths that wire an agent bench or own an orchestration directory, frozen.         |
 | `ORCHESTRATION_PATH_PREFIXES`     | const | Lists the path prefixes whose contents instruct or wire an agent, frozen.                              |
 | `ORKESTREL_RANGE_PATTERN`         | const | Matches the exact caret-pinned pre-1.0 range accepted for an `@orkestrel/*` runtime dependency.        |
 | `PRINT_WIDTH`                     | const | Caps the columns one emitted line may occupy, matching `printWidth` in `.oxfmtrc.json`.                |
 | `RELEASE_PROOF_COMMAND`           | const | Names the `prepublishOnly` row that runs the packed-package proof against a real registry.             |
-| `SERVICE_SCRIPT_PATH`             | const | Names the provisioner skeleton a workspace with declared service vendors is given once.                |
+| `SERVICE_SCRIPT_PATH`             | const | Names the inventory skeleton a workspace with declared service vendors is given once.                  |
 | `SERVICE_SETUP_PATH`              | const | Names the live-service readiness module whose presence makes a workspace `service`.                    |
 | `SERVICE_TEST_INCLUDE`            | const | Names the include the live-service project covers, which is a directory rather than one proof.         |
 | `SHOWCASE_CONFIG_PATH`            | const | Names the Vite wrapper whose presence makes a workspace `showcase`.                                    |
@@ -164,6 +165,7 @@ Exported from `@orkestrel/scaffold`, and reachable from
 | `SRC_MATRIX`                      | const | Holds the build and export settings each published `src` environment contributes, frozen.              |
 | `TAB_WIDTH`                       | const | Sets the columns one tab occupies when the formatter measures a line, matching `tabWidth`.             |
 | `VERSION_PATTERN`                 | const | Matches the exact `major.minor.patch` version syntax a blueprint declares.                             |
+| `WORKSPACE_DEV_ENGINES`           | const | Holds the `devEngines` record every generated manifest carries.                                        |
 | `WORKSPACE_OWNED_PATHS`           | const | Lists the vendored paths whose present bytes belong to each workspace, frozen.                         |
 
 #### Guards
@@ -565,9 +567,10 @@ other structural facts do not need creation flags. Add a root `tests/setup*.test
 `setup`, `tests/guides.test.ts` for `guides`, `tests/integration.test.ts` for `integration`,
 `tests/conformance.test.ts` for `conformance`, `tests/setupService.ts` for `service`,
 `tests/setupGlobal.ts` for `global`, and `configs/app/vite.showcase.config.ts` for `showcase`;
-reading verbs detect each exact-case file and register its fixed machinery. Add `scripts/service.sh`
-for `vendors`. Reading verbs preserve and protect that birth-owned script, but do not infer its
-vendor list from edited text.
+reading verbs detect each exact-case file and register its fixed machinery. An explicitly supplied
+plan with `vendors` owns and protects the birth-owned `scripts/service.sh` inventory skeleton.
+Reading verbs do not infer its vendor list from edited text and cannot preserve an arbitrary present
+script on that basis.
 
 `distribution` is not on that list. Publishing at least one `src` environment is its whole
 condition, and scaffold writes `tests/distribution.test.ts` itself rather than waiting for you to.
@@ -586,10 +589,10 @@ and `configs/app/vite.showcase.config.ts` selects `showcase`. A containing direc
 the fact by itself. `tests/distribution.test.ts` selects nothing: the published `src` axis the
 target ships already decides the `distribution` project, and the file is planned from that.
 
-`vendors` is not reconstructed. Its only artifact, `scripts/service.sh`, is birth-owned, so edited
-script text is not a trustworthy declaration of a vendor list. A present script remains in the
-target and remains protected from deletion through the owned scripts inventory, but a reading verb
-does not infer vendors from it.
+`vendors` is not reconstructed. Its artifact, `scripts/service.sh`, is a birth-owned inventory
+skeleton rather than a working installer, so edited script text is not a trustworthy declaration of
+a vendor list. A target-reading verb derives no vendor list from a present script. Only an
+explicitly supplied plan with `vendors` owns that birth artifact.
 
 That is why the live-service project follows `service` rather than `vendors`. A reading verb has to
 plan the project before it can say anything about a target that runs one, and a vendor list it
@@ -774,7 +777,7 @@ const blueprint = createBlueprint('router', {
 })
 
 blueprint.version // '0.0.1'
-blueprint.engines // '>=22.12.0'
+blueprint.engines // '>=22.18.0'
 ```
 
 `src` selects published library environments and `app` selects private application environments.
@@ -846,12 +849,13 @@ is the one proof scaffold generates from the workspace's own shape.
 
 `service` says the workspace runs a live-service Vitest project over `tests/service`, and it alone
 registers that project, its `test:service` script, and the `tests/setupService.ts` readiness module
-the project names. A publishing workspace invokes it from `prepublishOnly`; a `private: true`
-workspace invokes it from `test`, which is the only gate it has. Its longer timeouts and disabled
-file parallelism are the same in both. `vendors` names each external service the workspace drives
-and emits `scripts/service.sh`, the provisioner that starts them. Neither is derivable from the
-other: a workspace may declare vendors before it writes a suite, and a suite may drive a service the
-skeleton does not start.
+the project names. The caller prepares the external service before it invokes the project, and the
+setup module verifies readiness. A publishing workspace invokes the project from `prepublishOnly`;
+a `private: true` workspace invokes it from `test`, which is the only gate it has. Its longer
+timeouts and disabled file parallelism are the same in each workspace form. `vendors` names each external service the
+workspace drives and emits `scripts/service.sh`, an inventory skeleton that starts nothing. The
+vendor inventory and live-service setup are independent: a workspace may declare vendors before it
+writes a suite, and a suite may drive a service the skeleton does not start.
 
 `integration` projects a cross-environment composition proof for any workspace, independently of
 whether it has a published `src`. Its generated seed imports every selected `src` and `app`
@@ -901,7 +905,7 @@ one that answers it. So `new` refuses on any question, blocking or not, before i
 `audit` and `repair` carry the same questions through, because a target that already has that shape
 still has to be described and restored.
 
-A library caller creating a fresh workspace applies `new`'s rule itself:
+A library caller creating a fresh workspace itself applies the rule the `new` command follows:
 
 ```ts
 import { Compiler, createBlueprint } from '@orkestrel/scaffold'
@@ -1059,8 +1063,9 @@ after a write it prints `next: npm run format`.
 
 Scaffold owns the `scripts` directory. An audit for the orchestration group reports every unplanned
 member as foreign. `overwrite` deletes an unplanned tracked member only when the tree is clean, its
-observed bytes still match, and the path is not protected. A planned birth-owned
-`scripts/service.sh` survives that deletion pass.
+observed bytes still match, and the path is not protected. An unplanned tracked
+`scripts/service.sh` is retired on that basis. An explicitly planned birth-owned script survives
+that deletion pass.
 
 `tests/distribution.test.ts` is the one proof scaffold generates, and the one test artifact it
 claims by presence. Generation is the line, not writing: scaffold writes the vendored
@@ -1252,11 +1257,30 @@ licence, the harness permission file, the scaffold-owned `scripts` directory, th
 shared policy register, the shared policy proof, the shared policy plugin, the shared configuration
 leaf and its proof, the byte-identical root dotfiles, and the guide mirrors a generated workspace
 starts from. It is a candidate list rather than a plan, because a workspace never mirrors its own
-guide. The session-start hooks inside `scripts` split by job:
-the bench probe reports whether a bench CLI resolves, and the dependency hook installs the
-lockfile's closure in a remote session. What wires a bench stays in the canon, and a session reads
+guide. The session-start hooks inside `scripts` split by job. The bench probe reports whether a
+bench CLI resolves, and the dependency hook installs the lockfile's closure in a remote session.
+The Ollama hook invokes `scripts/ollama.sh` only when `CLAUDE_CODE_REMOTE=true`; direct invocation
+remains available for live-service setup. What wires a bench stays in the canon, and a session reads
 it at its primary root.
 
+`scripts/ollama.sh` defaults to `http://127.0.0.1:11434` and `qwen3.5:2b-q4_K_M`. It requires Node
+for native URL and JSON handling and curl for the HTTP protocol. The script accepts an HTTP or HTTPS
+origin without credentials, path, query, or fragment. It reuses any reachable daemon without
+requiring a local Ollama executable. It inspects the selected model through `/api/show`, pulls only
+after a `404` absence response, and warms the model through a completed non-streaming `/api/chat`
+request with a 30-minute keep-alive. Version readiness, pull completion, and warm completion each
+require a `2xx` HTTP status; redirects and error statuses fail even when their bodies report
+completion.
+
+When an HTTP loopback endpoint is unreachable, the script may start an installed Ollama executable
+in an owned POSIX process group. A failure sends that owned group `TERM`, then sends `KILL` if it
+does not stop within 5 seconds; a reused daemon remains untouched. Direct reuse works from Git Bash on Windows, but local startup there fails because Bash
+cannot safely terminate the Windows process tree. Automatic installation is limited to Linux cloud
+or CI automation. The official installer download follows only HTTPS redirects, must be nonempty,
+and runs within the remaining setup deadline. The installer may require root or `sudo`, and its own
+platform prerequisites remain authoritative. The full setup deadline is 590 seconds, including a
+60-second local startup allowance, within the hook's 600-second timeout.
+
 `CANON_PATHS` is the instruction canon, staged for reading instead: the `AGENTS.md` coding contract,
 the `CLAUDE.md` harness bridge, the `.agents/orchestration.md` agent-operation contract, the rules
 under `.claude/rules/` and `.cursor/rules/`, the skills under `.agents/skills/` and `.claude/skills/`,
@@ -1424,6 +1448,23 @@ except the manifest.
 - One host artifact per vendored path the workspace selects. A vendored directory is one planned
   path that expands into the files the data root stores beneath it.
 
+Every generated manifest declares the toolchain it is gated on. The `engines.node` field carries
+the blueprint's `engines` value, which defaults to the `>=22.18.0` range. The
+`devEngines.packageManager` record names npm at the `>=11.6.0` range with its `onFail` key set to
+the `error` value, and no blueprint field varies that record. An npm at 10.9.0 or later reads that
+record. Such an npm earlier than 11.6.0 refuses the `npm install` command in a generated workspace
+with the `EBADDEVENGINES` code, before resolving the dependency graph.
+npm 10.9.7 refuses an `npm run` command in such a workspace with the same code. The releases
+measured earlier than 10.9.0, npm 10.5.0 and npm 10.8.3, ignore the record and fail inside
+dependency resolution instead. Every Node release at 22.18.0 or later bundles an npm at 10.9.0 or
+later. A generated workspace on Node 22.18.0 or later therefore meets an npm that ignores the record
+only under an npm other than the bundled one. Run a generated workspace on npm 11.6.0 or later:
+every release from 10.9.0 up to 11.6.0 refuses it, and 11.6.0 installs it. Read the ambient
+version with the `npm --version` command. Raise it with the `npm install --global npm@11.6.0`
+command before the first install; that command installs an npm that reports
+11.6.0. The npm readings come from a Linux host on Node 22.22.2, on 2026-09-13, and the bundled
+versions come from the Node release index read that day.
+
 A workspace publishing a `src` environment rolls each published face's declarations up from that
 face's own Vite config. The seeded config calls `declarationRollup` from the vendored
 `configs/helpers.ts`, which runs the workspace's own compiler as a command —

package/dist/host/manifest.json

@@ -28,7 +28,7 @@
 			"storage": "agents/skills/enterprise-bootstrap/SKILL.md",
 			"destination": ".agents/skills/enterprise-bootstrap/SKILL.md",
 			"executable": false,
-			"digest": "6ed9e288539cbe7a7fbd25b13cf759ecedd72101189e0317fbabf82d1aa1aef4"
+			"digest": "fd2f390a4b3cc40bd2ca62a726e33a96132269fc3c4d466f948c36b7d0173cbe"
 		},
 		{
 			"storage": "agents/skills/enterprise-bootstrap/agents/openai.yaml",
@@ -40,37 +40,49 @@
 			"storage": "agents/skills/enterprise-bootstrap/references/bootstrap-reference.md",
 			"destination": ".agents/skills/enterprise-bootstrap/references/bootstrap-reference.md",
 			"executable": false,
-			"digest": "98379b5905cba4cc3725df7ddd8fd9ec19dce75ff89e68499b20ac27c53478c7"
+			"digest": "0406dbdf44881b9e33e27c9ead6d9ae67ab6a226e5ff7ec6e71cf07b53e5083c"
+		},
+		{
+			"storage": "agents/skills/enterprise-bootstrap/references/color-modes.md",
+			"destination": ".agents/skills/enterprise-bootstrap/references/color-modes.md",
+			"executable": false,
+			"digest": "4a7d30374e60add9207a87197c65c576dd0e0ee52ab97064597b6b31af2bc34e"
 		},
 		{
 			"storage": "agents/skills/enterprise-bootstrap/references/components.md",
 			"destination": ".agents/skills/enterprise-bootstrap/references/components.md",
 			"executable": false,
-			"digest": "252de08e786aa41834f13df4d115e33b3c56d897ccea00b95ed4912da62fbd89"
+			"digest": "2fde6b3dc9e168461192b01183f194aca61974b27721ca406ba684da295833e4"
 		},
 		{
 			"storage": "agents/skills/enterprise-bootstrap/references/frontend-design.md",
 			"destination": ".agents/skills/enterprise-bootstrap/references/frontend-design.md",
 			"executable": false,
-			"digest": "8ce1985267316610f4b68582cc993fa2d3f3a504e3e7f2c35e9d9d0e982891a1"
+			"digest": "758a87d744e632d0789f6b7175f5eb7496961640dc80886eaa70e28e7e4f2bca"
 		},
 		{
 			"storage": "agents/skills/enterprise-bootstrap/references/inputs.md",
 			"destination": ".agents/skills/enterprise-bootstrap/references/inputs.md",
 			"executable": false,
-			"digest": "17fb8a977d34a0ef25f5155ac6459e805cc4f691d819995eb85838dca6c8fa46"
+			"digest": "ec68bd122f83b186aaeebcfeea80ee745c143aeefde2f4d7e1b72d710b48dd61"
 		},
 		{
 			"storage": "agents/skills/enterprise-bootstrap/references/inspection.md",
 			"destination": ".agents/skills/enterprise-bootstrap/references/inspection.md",
 			"executable": false,
-			"digest": "48b202e331c17a26f8262b30095898e6d147906847a74d3779907c0aad4de43b"
+			"digest": "c2c7ed7027c8208b0ffa255abc8ca245c2ae534b5b4f311a9fe03e1e842c6f32"
+		},
+		{
+			"storage": "agents/skills/enterprise-bootstrap/references/responsive-layout.md",
+			"destination": ".agents/skills/enterprise-bootstrap/references/responsive-layout.md",
+			"executable": false,
+			"digest": "44e709e8df187495e6343048891ca9ff1ff9d3f30d86e00ad8cbd97c8e29bf20"
 		},
 		{
 			"storage": "agents/skills/enterprise-bootstrap/references/utilities.md",
 			"destination": ".agents/skills/enterprise-bootstrap/references/utilities.md",
 			"executable": false,
-			"digest": "0601721056882a7d45bfaa9ca0a03aa39e1259876f16546d4bf19b4b9496e023"
+			"digest": "8cec05a193672bc543439a3aa46cf7b4ffc5573527b3fe047ad575fbe73f4a2c"
 		},
 		{
 			"storage": "agents/skills/orkestrel-align-packages/SKILL.md",
@@ -340,7 +352,7 @@
 			"storage": "claude/agents/orkestrel.md",
 			"destination": ".claude/agents/orkestrel.md",
 			"executable": false,
-			"digest": "b6c285b9923947460066ebc08f5778891ae2eac14800f40cdbcc53a63875554a"
+			"digest": "a1938acb42922f35b63413ecc04a7721f7c22466b9e201e830f3ec80532333fc"
 		},
 		{
 			"storage": "claude/agents/planner.md",
@@ -448,7 +460,7 @@
 			"storage": "claude/rules/workspace.md",
 			"destination": ".claude/rules/workspace.md",
 			"executable": false,
-			"digest": "5e69fa5bb2b439c640d1d73204418309d310a9de5a28212b8756de09f4af5d2d"
+			"digest": "5fbf4f0e9803ef1e4cbaa12a2cfb896cec1188f9c2fc3e020b93923319c91b2f"
 		},
 		{
 			"storage": "claude/rules/writing.md",
@@ -460,13 +472,13 @@
 			"storage": "claude/settings.json",
 			"destination": ".claude/settings.json",
 			"executable": false,
-			"digest": "c5c379bf5001754d11b94e692f7624e0a59c7e4b2b2072569b115c3723c24ee7"
+			"digest": "52c5aafe0f3a891a909a5ce26ad761abb38f2ab931f084f5ca147abb7680c419"
 		},
 		{
 			"storage": "claude/skills/enterprise-bootstrap/SKILL.md",
 			"destination": ".claude/skills/enterprise-bootstrap/SKILL.md",
 			"executable": false,
-			"digest": "1e2c83abb2a7c6a2e41dc210202d25124f6a30cfdc1bbd44d6b9c59dded6d93f"
+			"digest": "c8ae2dbc8337238899334cd205afe3617ef64298ac39c043b8cd3fe0885103f2"
 		},
 		{
 			"storage": "claude/skills/orkestrel-align-packages/SKILL.md",
@@ -682,7 +694,7 @@
 			"storage": "guides/scaffold.md",
 			"destination": "guides/scaffold.md",
 			"executable": false,
-			"digest": "660f6f9443c16252ad92afb0c78802908c5d2ded69a461a8e83bb12c71ea43db"
+			"digest": "3f26b6d6649a7fb5882c02d674c5c10386706e87a5305b863a0d2028a2bf5043"
 		},
 		{
 			"storage": "scripts/codex.sh",
@@ -706,7 +718,7 @@
 			"storage": "scripts/ollama.sh",
 			"destination": "scripts/ollama.sh",
 			"executable": true,
-			"digest": "666979b75f02c7f550c3acc74a02b67594407b887e6a8b90f0ba38a0d79bec07"
+			"digest": "be5cb42991792190d7f61c7b8eef568eaf207db67cce5d2ccc223af814f2d6fa"
 		},
 		{
 			"storage": "tests/config.test.ts",
@@ -773,5 +785,5 @@
 		".cursor/rules",
 		"scripts"
 	],
-	"digest": "0327bc72ce35efe56b959fea41d06a8334b9c9fd318b6ea005efd46b8ef0fd46"
+	"digest": "50fad5d60acc60ca69beacdee573bd99cccb9ab1fc31462ece80bea1c1c53ff4"
 }