@orkestrel/scaffold 0.0.76 → 0.0.78

package/dist/host/agents/skills/orkestrel-falsify/references/reconcile.md

@@ -1,156 +1,57 @@
 # Reconciling a round and ruling on it
 
-The auditors return. Neither accepts; the orchestrator does. This is where a round becomes a
-decision, and it is not delegable.
+The Orchestrator reconciles and accepts; no lane does. Run a finding rather than argue it.
 
-## Reproduce before you act
+## Reproduce before acting
 
-The rule beneath this whole section: **run it rather than argue it.** Every judgement that follows
-is cheap once the probe exists and unreliable until it does.
+- Treat a lane's finding as a hypothesis until you have run it against the built output. Reproduce every `BROKEN` and every outside finding by hand before it enters a fix brief.
+- Construct the hostile input outside the `try` and guard only the call under test, so a harness fault (a missing import, a wrong arity, a `require` in ESM) crashes loudly instead of reading as the finding.
+- Record which outcome the reproduction produced: confirmed and wider than reported; confirmed and bounded smaller; or evaporated because the input could not exercise what it claimed.
+- Separate a dead finding from a dead vector: a vector the compiler rejects refutes the vector alone. Re-derive one the types admit and record which vector was tested.
+- Apply the same discipline to your own probes; a probe whose input cannot reach the code under test reads exactly like a real pass.
 
-An auditor's finding is a **hypothesis** until the orchestrator has run it. Reproduce every sharp
-claim by hand, against the built output, before it enters a fix brief.
+## Resolve a disagreement
 
-**Build the hostile input outside the `try`.** A probe that wraps construction and invocation in one
-catch cannot distinguish _the subject threw_ from _my harness threw_ — a missing import, a wrong
-arity, a `require` in an ESM context all surface as the finding you were hoping to see. Construct
-first, let harness failures crash loudly, and only guard the call under test.
+When lanes return opposite verdicts on one claim, reproduce first; never average them and never prefer the engine you trust more. Then name the question each lane answered.
 
-Reproduction produces these outcomes, and all of them matter:
+- Both right about different objects: the claim was a universal carrying more than one subject. Split it, keep `BROKEN` on any broken subclaim (`SPLIT-CLAIM` is a note, never a verdict value), and carry the split into the successor brief.
+- Both right about different halves of one claim number: split and renumber.
+- One right on the mechanism, the other on the criterion: take both constraints; the reconciled ruling satisfies both.
+- An argument that an input class is unreachable: run it and show the reachable consequence.
 
-- the finding **confirms** and is often **wider** than reported — the reproduction reaches doors the
-  auditor did not try;
-- the finding **confirms but is bounded smaller** — real, and not where the auditor thought;
-- the finding **evaporates**, because the auditor's input could not exercise what it claimed to test.
-
-Separate a dead finding from a dead vector before evaporating anything. A reported vector the
-compiler rejects refutes the vector alone; re-derive one the types admit, and record which vector
-was actually tested.
-
-The same reproduction discipline applies to your own probes. A probe whose input cannot reach the
-code under test reports a pass that means nothing, and it will read exactly like a real pass.
-
-## A disagreement is rarely a tie
-
-When auditors return opposite verdicts on one claim, do not average them and do not prefer the
-engine you trust more. **Reproduce first** — running the disagreement settles most of them outright,
-and it is the only method that can also find what neither auditor saw. Then find the question each
-one answered. The common shapes:
-
-- **Both right about different objects.** One tested a case the other did not construct. This is a
-  `SPLIT-CLAIM`: the claim was a universal that carried more than one subject. It is **not** a
-  further verdict value — one falsifying input makes a universal claim `BROKEN`, and succeeding on a
-  different object does not undo that. Split it, keep the original `BROKEN` if any subclaim is
-  broken, and carry the split into the successor brief.
-- **Both right about different halves of one claim number.** Same resolution: the claim number was
-  carrying more than one claim. Split and renumber.
-- **One right on the mechanism, the other on the criterion.** Take both. The reconciled ruling is
-  frequently neither proposal, and better than either, because each supplied a constraint the other
-  violated.
-- **The consequence disproves the premise.** An argument that an input class is unreachable is
-  answered by running it and showing what the reachable consequence is.
-
-Record which engine was right and on what. A round whose disagreements are smoothed over teaches
-nothing to the next one.
+Record which engine was right and on what.
 
 ## Evidence custody
 
-Blind reports are immutable, and their independence is a property of the record, not of anyone's
-memory. A reader six months out must be able to tell an unbiased blind verdict from one produced
-after an auditor saw its counterpart's evidence — otherwise the whole value of running blind is
-unverifiable after the fact.
-
-These rules are enforceable:
-
-1. **A returned verdict is never edited** — not by the auditor, not by the orchestrator.
-2. **Anything an auditor says after seeing another's report is a separate file beside that verdict**,
-   under `.orkestrel/<package>/`, named for the unit and the exposure, recording what was shown and
-   to whom. It is a durable record, not a journal, so it survives the campaign sweep.
-
-That exchange is a **fallback, not a phase.** Reproduction comes first and settles most
-disagreements. Reach for an exchange only when a specific factual question survives reproduction,
-scope it to that question, initiate it yourself, and run it once — a second exchange is negotiation.
-
-**Ask the auditor to attack the other's evidence on that question. Never ask it to resolve the
-disagreement, reconsider its position, or say whether the other changed its mind.** Constraining
-when, who, scope and frequency does nothing about convergence if the instruction itself invites it,
-and "does their evidence change your claim?" is the convergence prompt in its purest form.
+- Never edit a returned verdict, whoever wrote it.
+- Write anything a lane says after seeing another lane's report as a separate file beside the verdict under `.orkestrel/<package>/`, named for the unit and the exposure, recording what was shown and to whom. That file is a durable record, never a journal: it survives the campaign sweep, and its contents are promoted into the acceptance record before the folder retires.
+- Reach for such an exchange only when a specific factual question survives reproduction; scope it to that question, initiate it yourself, and run it once. Ask the lane to attack the other's evidence on that question; never ask it to resolve the disagreement, reconsider its position, or say whether the other changed its mind.
 
 ## Bound the finding
 
-State what is **not** broken, and why the adjacent behaviour that looks identical is correct. A
-finding without a boundary is an alarm, and alarms get discounted wholesale — including the true
-ones next to them.
-
-These boundaries earn their keep:
-
-- **Credit what the round got right.** If the hostile inputs adjacent to the hole are correctly
-  contained, say so and list them. It sharpens the finding to a point instead of an area.
-- **Show where the same-looking answer is correct.** When several exports answer a hostile input the
-  same way and only one is wrong, name what makes the difference — usually that the correct ones
-  agree with a documented view, and the wrong one reads on an axis it then ignores.
+- State what is not broken and why the adjacent behavior that looks identical is correct.
+- List the hostile inputs adjacent to the hole that are correctly contained.
+- Where several exports answer a hostile input the same way and one is wrong, name what makes the difference.
 
 ## Bound the fix before briefing it
 
-Establish what over-correcting would break, and put it in the fix brief as a constraint. Both ends
-are usually wrong:
-
-- **too little** — a patch to the one function, leaving the package holding conflicting standards
-  for the same thing, which is the inconsistency that produced the finding;
-- **too much** — adopting the strictest sibling's rule verbatim, breaking a legitimate caller
-  pattern, and tripping "no refusal was widened into a regression" in the next round.
-
-Find the rule that fits both. It is usually about **agreement** rather than about categories — what
-a reader reads, its answer must carry — and it dissolves the special cases rather than enumerating
-them.
-
-Measure a proposed fix before adopting it; it is itself a claim. Run it against the set it must
-not break, including every case an earlier round pinned. Where it fails that set, document the
-limit on the helper that owns it and pin the limit with a test that names it as one. A heuristic
-that trades one wrong answer for another fails quietly; a stated boundary does not.
-
-Where the choice is genuinely open, it is a design judgement with a subjective and an objective
-half, and it goes to a blind design pass before code. Ruling it unilaterally is how a fix round
-becomes the next audit's finding.
-
-## Certifying an instrument
-
-The control-population law in `.claude/rules/quality.md` binds here without restatement. What it
-leaves this round is the procedure.
-
-When a round certifies an instrument — a pin, an identity check, a generated sweep — the controls
-are usually drawn from whatever the instrument obviously covers, because that is where the examples
-take the least construction. That sampling proves discrimination _within_ the population and is
-routinely reported as proof the instrument works.
-
-So before running controls, write down the instrument's **membership rule** in one sentence, then
-ask what the rule excludes. Draw at least one control from there. These shapes have already cost a
-round each:
-
-- an AST comparison whose controls were all drawn from the literal classes present in the bodies it
-  guarded, blind to the classes absent from them;
-- a call-closure pin whose controls were all body-reachable functions, green for a function reached
-  only through a parameter default.
-
-Then write the sentences that matter: what the controls established, and what they did not. What
-they did not establish is the one that gets skipped, and skipping it is how an instrument's
-credibility outruns its evidence.
+- Put in the fix brief what over-correcting would break. Refuse both a patch to one function that leaves the package holding two standards for the same thing, and the strictest sibling's rule adopted verbatim, which breaks a legitimate caller.
+- Find the rule that fits both ends: a rule about agreement (what a reader reads, its answer must carry) that dissolves the special cases rather than enumerating them.
+- Measure a proposed fix as a claim: run it against the set it must not break, including every case an earlier round pinned. Where it fails that set, document the limit on the helper that owns it and pin the limit with a test that names it.
+- Where the choice is open, it has a subjective and an objective half: send it to a blind design pass before code.
 
-## Ruling
+## Certify an instrument
 
-- Every retained finding names the fix-brief item that carries it. A finding with no carrier is a
-  dropped finding; walk the list once and check.
-- Drop, **on the record**, anything neither auditor can substantiate against the evidence.
-- Promote anything that must outlive the round into a durable artifact before the working files are
-  swept. What lives only in a scratch file did not survive.
-- The fix round's auditor is an engine that did not write it.
-- The next round's brief is this round's successor.
+`.claude/rules/quality.md` § Instruments binds the control-population law. The procedure:
 
-## The threshold
+1. Write the instrument's membership rule in one sentence.
+2. Name what the rule excludes and draw at least one control from there. Controls drawn only from what the instrument obviously covers prove discrimination inside the population and nothing outside it: an AST comparison blind to literal classes absent from its bodies, a call-closure pin green for a function reached only through a parameter default.
+3. Write what the controls established and what they did not.
 
-Accept when the brief's claims are **satisfied on evidence** — the `PASS` terminal line the skill
-defines, against a claim set that covers what the subject owns. Not green gates.
+## Rule
 
-A round that finds something is the process working. A round that finds nothing because nobody tried
-is the failure; a round re-run because an attack can still be imagined never ends. Bound the claim
-set at the brief, rule on what it returned, and close.
+- Every retained finding names the fix-brief item that carries it; walk the list once.
+- Drop, on the record, anything no lane can substantiate against the evidence.
+- Promote anything that must outlive the round into a durable artifact before the working files are swept.
+- The fix round's lane is an engine that did not write the fix. The next round's brief is this round's successor.
+- Accept when the claims are satisfied on evidence (`VERDICT: PASS` against a claim set covering what the subject owns), never on green gates alone. Bound the claim set at the brief, rule on what it returned, and close; never re-run because an attack can still be imagined.

package/dist/host/agents/skills/{orkestrel-harden-package → orkestrel-harden}/SKILL.md

@@ -1,23 +1,19 @@
 ---
-name: orkestrel-harden-package
+name: orkestrel-harden
 description: Research, audit, refactor, implement, centralize, test, document, and locally verify an individual Orkestrel TypeScript package to enterprise-grade production readiness under the repository's current AGENTS.md. Use when asked to fill missing or deferred capabilities, compare upstream or legacy implementations, salvage prior art, centralize source or test declarations, eliminate nested functions or superfluous wrappers, maximize declared @orkestrel dependencies—especially @orkestrel/contract—or add rigorous real-implementation and live-service tests. Select only the phases required by a narrow request; run the full workflow for production readiness or comprehensive hardening.
 ---
 
 # Harden an Orkestrel package
 
-## Load authority
+## Read
 
-Read the current files in this order:
+`AGENTS.md` § Authority and loading names the files every unit reads. This skill adds the references the selected lane names, the contracts, barrels, manifest, and configuration that lane needs, and every decision-bearing implementation file the user names, read first-hand by the decision owner. Delegate bulk reconnaissance and supporting research, never the design decision. Preserve dirty and user-owned work.
 
-1. `AGENTS.md`.
-2. Every applicable `.claude/rules/*.md`.
-3. Select the work lane § "Select the work lane" names, and read every reference that lane requires.
-4. `guides/README.md`, the governing package/domain guide, and `ROADMAP.md` when present.
-5. The authoritative `*/types.ts`, public barrels, `package.json`, build/test configuration, and decision-bearing implementation files.
+## Scripts
 
-Treat the current user instruction as authoritative. Treat repository rules as the coding contract and this skill as the workflow. Preserve dirty and user-owned work.
-
-The decision owner must read the governing types and every implementation file the user names directly. Delegate bulk reconnaissance or supporting research, not the final design decision.
+| Script                 | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `scripts/discovery.ts` | `[--config vite.config.ts] [--projects a,b] [--json]`, run from the checkout root: follows every root script chain to the Vitest projects and test files it gates, runs `vitest list --json` once, and reports per project the files, tests, and gate, plus every `.skip(`, `.todo(`, `.skipIf(`, `.runIf(`, `retry:`, and `timeout:` marker. Exit 3 when a collected project has no gate, a named project collects nothing, or a test file under `tests/` is collected by no project. |
 
 ## Select the work lane
 
@@ -44,14 +40,14 @@ Load [hardening.md](references/hardening.md) for the hardening lane and for any
 3. **Establish the intended contract.** Build a capability/defect matrix. Separate verified fact from inference. Mark each row implement, repair, retain, or exclude with a reason. The matrix is fixed at this step and is the campaign's definition of done: every later step serves a row, and work that serves no row belongs to the next campaign. The row set is fixed; the planned work that closes it is not. Re-baseline that work at each phase boundary per `.agents/orchestration.md`, which owns the step and its boundary with rescoping.
 4. **Design types first.** Update guide/spec intent and `*/types.ts` before implementation, under the root design laws. A contract that needs a compatibility shim is the wrong contract.
 5. **Implement completely.** Finish every in-scope branch and reuse the exact installed Orkestrel primitives whose semantics match. The root completion law decides what may not be left behind.
-6. **Prove each defect before repairing it.** A repair begins with a test that fails for that defect: record the exact command and its failing count before the fix and the same command's passing count after. A repair with no red-then-green record is unproven.
+6. **Prove each defect before repairing it** per the defect rule in `AGENTS.md` § Work loop. A repair with no red-then-green record is unproven.
 7. **Consolidate.** Run the complete centralization and wrapper sweep. Update all call sites to the real symbol rather than leaving aliases or 1:1 delegates.
 8. **Challenge seams.** Add deterministic tests for invariants, boundaries, failures, lifecycle, cleanup, cancellation, concurrency, hostile input, and resource pressure as applicable, under the test rules' real-implementation law.
 9. **Use live services deliberately.** Put real external services/models in their dedicated project, require readiness, and make each request minimally sufficient, stable across the service's nondeterminism, and behaviorally meaningful. When the claim is that a foreign client can use this package, drive one representative real client end to end.
 10. **Document the final behavior.** Update the governing guide, examples, method tables, limitations, and parity coverage. Document architectural limits honestly.
-11. **Audit completion.** Inspect test discovery, `.todo`/`.skip`/conditional skip use, source/test helper duplication, exports, environment isolation, unexpected text corruption, and the entire diff.
+11. **Audit completion.** Run `node .agents/skills/orkestrel-harden/scripts/discovery.ts` and rule on every flag and marker it reports, then inspect source/test helper duplication, exports, environment isolation, unexpected text corruption, and the entire diff.
 12. **Verify.** Run the repository-prescribed gates in order and inspect the generated outputs relevant to the request.
-13. **Review independently, and never by the author.** When orchestration is available, run the adversarial pass — subjective design fit and objective correctness — plus a mechanical checker, per `.agents/orchestration.md`. Add a dedicated adversarial round for security, concurrency, destructive paths, or external input. A unit's auditor is an engine that did not write it; same-engine re-review returns the author's own blind spot. Resolve every required finding, then rerun affected verification.
+13. **Review by the size gate, never by the author.** Run the review `.agents/orchestration.md` § Size gate names for the change, resolve every required finding, then rerun the affected scoped verification.
 
 ## Accept the result
 

package/dist/host/agents/skills/{orkestrel-harden-package → orkestrel-harden}/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: 'Harden Orkestrel Package'
   short_description: 'Research, centralize, test, and harden one package'
-  default_prompt: 'Use $orkestrel-harden-package to bring this package to enterprise-grade production readiness.'
+  default_prompt: 'Use $orkestrel-harden to bring this package to enterprise-grade production readiness.'

package/dist/host/agents/skills/{orkestrel-harden-package → orkestrel-harden}/references/hardening.md

@@ -82,11 +82,10 @@ For every fetch, write, delete, extraction, path, protocol, or authentication bo
 
 ## Audit the tests themselves
 
-Verify:
+Run `node .agents/skills/orkestrel-harden/scripts/discovery.ts` for the discovery census: which project collects each file, which gate reaches each project, and where a file carries `.skip`, `.todo`, a conditional skip, a retry, or a timeout. Then verify:
 
-- every test file is discovered by the intended project;
-- targeted commands run the expected count and environment;
-- `.todo`, `.skip`, conditional skips, retries, and generous timeouts are justified;
+- every flag the census reports is closed or ruled with a reason;
+- every marker it reports is justified;
 - no current-scope requirement is represented only by a todo;
 - assertions can fail for the defect they claim to catch;
 - tests observe public outcomes rather than private implementation;

package/dist/host/agents/skills/orkestrel-harden/scripts/discovery.ts

@@ -0,0 +1,228 @@
+// Census of test discovery: which projects the gates reach, what each collects, and where a suite
+// skips. Run from the checkout root:
+//   node .agents/skills/orkestrel-harden/scripts/discovery.ts [--config vite.config.ts] [--projects a,b] [--json]
+// The script follows every root script chain in package.json (a script no other script invokes) to
+// the `--project` names its Vitest scripts gate and the test files its `node` scripts run, runs
+// `vitest list --json` once through the local vitest entry to read what each project collects, and
+// reads every collected file for `.skip(`, `.todo(`, `.skipIf(`, `.runIf(`, `retry:`, and
+// `timeout:`. It flags a collected project no root chain reaches, a named project that collects
+// nothing, and a test file under tests/ that no project collects and no root script runs directly.
+// A project with no test file and no gate is outside the census. Exit 0 with no flag, 3 with one, 2 when Vitest cannot list, 64 on
+// usage.
+import { spawnSync } from 'node:child_process'
+import { existsSync, readFileSync } from 'node:fs'
+import { relative, resolve } from 'node:path'
+import {
+	listFiles,
+	readMissingFlags,
+	readOption,
+} from '../../orkestrel-dispatch/scripts/helpers.ts'
+
+const VITEST = 'node_modules/vitest/vitest.mjs'
+const MARKERS: readonly string[] = ['.skip(', '.todo(', '.skipIf(', '.runIf(', 'retry:', 'timeout:']
+
+interface Collected {
+	readonly file: string
+	readonly projectName: string
+}
+
+interface Gates {
+	readonly projects: ReadonlyMap<string, string>
+	readonly files: ReadonlyMap<string, string>
+}
+
+interface Project {
+	readonly name: string
+	readonly gate: string | undefined
+	readonly files: number
+	readonly tests: number
+}
+
+interface Census {
+	readonly file: string
+	readonly projects: readonly string[]
+	readonly markers: Readonly<Record<string, number>>
+}
+
+function readScripts(): Readonly<Record<string, string>> {
+	const parsed: unknown = JSON.parse(readFileSync('package.json', 'utf8'))
+	if (typeof parsed !== 'object' || parsed === null) return {}
+	const scripts = Object.fromEntries(Object.entries(parsed)).scripts
+	if (typeof scripts !== 'object' || scripts === null) return {}
+	const record: Record<string, string> = {}
+	for (const [key, value] of Object.entries(scripts))
+		if (typeof value === 'string') record[key] = value
+	return record
+}
+
+function listInvocations(text: string): readonly string[] {
+	return [...text.matchAll(/npm run ([A-Za-z0-9:_-]+)/gu)].flatMap((match) =>
+		match[1] === undefined ? [] : [match[1]],
+	)
+}
+
+function readGates(scripts: Readonly<Record<string, string>>): Gates {
+	const invoked = new Set(Object.values(scripts).flatMap(listInvocations))
+	const projects = new Map<string, string>()
+	const files = new Map<string, string>()
+	for (const root of Object.keys(scripts).filter((name) => !invoked.has(name))) {
+		const visited = new Set<string>()
+		const pending = [root]
+		while (pending.length > 0) {
+			const name = pending.pop()
+			if (name === undefined || visited.has(name)) continue
+			visited.add(name)
+			const text = scripts[name]
+			if (text === undefined) continue
+			pending.push(...listInvocations(text))
+			const gate = root === name ? name : `${root} > ${name}`
+			if (/\bvitest\b/u.test(text)) {
+				for (const match of text.matchAll(/--project[= ]([A-Za-z0-9:_-]+)/gu)) {
+					if (match[1] !== undefined && !projects.has(match[1])) projects.set(match[1], gate)
+				}
+			}
+			for (const match of text.matchAll(
+				/(?:^|\s)((?:tests|src|app)\/[A-Za-z0-9_./-]+\.test\.[cm]?ts)\b/gu,
+			)) {
+				if (match[1] !== undefined && !files.has(match[1])) files.set(match[1], gate)
+			}
+		}
+	}
+	return { projects, files }
+}
+
+function listCollected(config: string): readonly Collected[] | undefined {
+	const result = spawnSync(process.execPath, [VITEST, 'list', '--config', config, '--json'], {
+		encoding: 'utf8',
+		maxBuffer: 64 * 1024 * 1024,
+		windowsHide: true,
+	})
+	if (result.status !== 0) return undefined
+	const start = result.stdout.indexOf('[')
+	if (start === -1) return undefined
+	const parsed: unknown = JSON.parse(result.stdout.slice(start))
+	if (!Array.isArray(parsed)) return undefined
+	const collected: Collected[] = []
+	for (const entry of parsed) {
+		if (typeof entry !== 'object' || entry === null) continue
+		const record = Object.fromEntries(Object.entries(entry))
+		if (typeof record.file === 'string' && typeof record.projectName === 'string') {
+			collected.push({
+				file: relative(process.cwd(), record.file).split('\\').join('/'),
+				projectName: record.projectName,
+			})
+		}
+	}
+	return collected
+}
+
+function listTestFiles(directory: string): readonly string[] {
+	if (!existsSync(directory)) return []
+	return listFiles(directory)
+		.map((file) => file.path)
+		.filter((path) => /\.test\.[cm]?ts$/u.test(path))
+}
+
+function countMarkers(file: string): Readonly<Record<string, number>> {
+	const text = readFileSync(file, 'utf8')
+	const counts: Record<string, number> = {}
+	for (const marker of MARKERS) {
+		const count = text.split(marker).length - 1
+		if (count > 0) counts[marker] = count
+	}
+	return counts
+}
+
+function main(argv: readonly string[]): number {
+	const missing = readMissingFlags(argv, ['--config', '--projects'])
+	if (missing.length > 0) {
+		console.error(`discovery: ${missing.join(', ')} given with no value`)
+		return 64
+	}
+	const config = readOption(argv, '--config') ?? 'vite.config.ts'
+	if (!existsSync(config) || !existsSync('package.json')) {
+		console.error('usage: discovery.ts [--config vite.config.ts] [--projects a,b] [--json]')
+		return 64
+	}
+	if (!existsSync(VITEST)) {
+		console.error(`discovery: ${VITEST} is missing; run npm ci first`)
+		return 2
+	}
+	const gates = readGates(readScripts())
+	const collected = listCollected(config)
+	if (collected === undefined) {
+		console.error('discovery: vitest list failed; run it bare to read the diagnostic')
+		return 2
+	}
+	const named = (readOption(argv, '--projects') ?? '').split(',').filter((name) => name !== '')
+	const names = new Set<string>([
+		...gates.projects.keys(),
+		...collected.map((entry) => entry.projectName),
+		...named,
+	])
+	const projects: Project[] = [...names].sort().map((name) => {
+		const mine = collected.filter((entry) => entry.projectName === name)
+		const fileGate = mine
+			.map((entry) => gates.files.get(entry.file))
+			.find((gate) => gate !== undefined)
+		return {
+			name,
+			gate: gates.projects.get(name) ?? fileGate,
+			files: new Set(mine.map((entry) => entry.file)).size,
+			tests: mine.length,
+		}
+	})
+	const collectedFiles = new Set(collected.map((entry) => entry.file))
+	const undiscovered = listTestFiles('tests')
+		.filter((file) => !collectedFiles.has(file) && !gates.files.has(file))
+		.sort()
+	const ungated = projects
+		.filter((project) => project.gate === undefined && project.tests > 0)
+		.map((project) => project.name)
+	// A project no chain reaches is a workbench (the `probe` project collects `tmp/probes/**`), so an
+	// empty one is reported, never flagged.
+	const empty = projects
+		.filter((project) => project.tests === 0 && project.gate?.includes(' > ') === true)
+		.map((project) => project.name)
+	const workbenches = projects
+		.filter((project) => project.tests === 0 && project.gate?.includes(' > ') !== true)
+		.map((project) => project.name)
+	const census: Census[] = [...collectedFiles].sort().map((file) => ({
+		file,
+		projects: [
+			...new Set(
+				collected.filter((entry) => entry.file === file).map((entry) => entry.projectName),
+			),
+		],
+		markers: countMarkers(resolve(file)),
+	}))
+	const flagged = undiscovered.length + ungated.length + empty.length > 0
+	if (argv.includes('--json')) {
+		console.log(
+			JSON.stringify({ config, projects, ungated, empty, workbenches, undiscovered, census }),
+		)
+	} else {
+		for (const project of projects) {
+			console.log(
+				`discovery: ${project.name.padEnd(14)} ${String(project.files).padStart(3)} file(s) ${String(project.tests).padStart(5)} test(s) gate=${project.gate ?? 'none'}`,
+			)
+		}
+		for (const name of ungated)
+			console.log(`discovery: ${name} collects tests but no root script chain reaches it`)
+		for (const name of empty) console.log(`discovery: ${name} collects nothing`)
+		for (const name of workbenches)
+			console.log(`discovery: ${name} is a workbench no chain runs; it collects nothing`)
+		for (const file of undiscovered) console.log(`discovery: ${file} is collected by no project`)
+		for (const entry of census) {
+			const marks = Object.entries(entry.markers)
+			if (marks.length > 0) {
+				console.log(
+					`discovery: ${entry.file} ${marks.map(([marker, count]) => `${marker}×${count}`).join(' ')}`,
+				)
+			}
+		}
+	}
+	return flagged ? 3 : 0
+}
+
+process.exitCode = main(process.argv.slice(2))

package/dist/host/agents/skills/{orkestrel-prove-journey → orkestrel-journey}/SKILL.md

@@ -1,28 +1,20 @@
 ---
-name: orkestrel-prove-journey
+name: orkestrel-journey
 description: Prove a browser application the way a person uses it — real keystrokes, clicks, and Tab/Enter against only what is visible and reachable — through the journey layer @orkestrel/test/browser publishes, and generate the capture portfolio, the resolved-style matrix, and the statechart outcome from those same journeys. Use when accepting a UI build, proving an application end to end, deciding whether a surface is reachable by keyboard alone, proving what a screen refuses as well as what it does, proving the styles a browser actually resolved under each theme and viewport, driving a transition table through the interface and watching it run, auditing whether the interface speaks the user's vocabulary rather than the engine's, producing the screenshots a design review judges, routing a rendered question to an artifact a model can read, or whenever the only evidence a screen works is a test that drove it through JavaScript instead of through the interface.
 ---
 
 # Prove an application through human journeys
 
-## Load authority
-
-Read the current files in this order:
-
-1. `AGENTS.md`.
-2. `.claude/rules/tests.md` for test law, real implementations, and shared test infrastructure;
-   `.claude/rules/browser.md` for browser and Vue usage; `.claude/rules/application.md` for app
-   composition and entries; `.claude/rules/styles.md` for style centralization;
-   `.claude/rules/quality.md` for the instrument and negative-control law;
-   `.claude/rules/documentation.md` for parity. Those rules are the contract; this skill is the
-   workflow.
-3. [layer.md](references/layer.md) before importing, extending, or debugging the journey layer.
-4. [captures.md](references/captures.md) before registering a state or placing a capture.
-5. [styles.md](references/styles.md) before asserting anything the browser resolved.
-6. [statechart.md](references/statechart.md) before declaring a transition or mounting the harness.
-7. [decide.md](references/decide.md) before routing a question to an instrument.
-8. `guides/README.md`, the governing guide for the surface, and `ROADMAP.md` when present.
-9. The `*/types.ts` of every environment the journeys drive, plus the application's root component,
+## Read
+
+`AGENTS.md` § Authority and loading names the files every unit reads. This skill adds:
+
+1. [layer.md](references/layer.md) before importing, extending, or debugging the journey layer.
+2. [captures.md](references/captures.md) before registering a state or placing a capture.
+3. [styles.md](references/styles.md) before asserting anything the browser resolved.
+4. [statechart.md](references/statechart.md) before declaring a transition or mounting the harness.
+5. [decide.md](references/decide.md) before routing a question to an instrument.
+6. The `*/types.ts` of every environment the journeys drive, plus the application's root component,
    route entry, and store contract.
 
 Treat a retained readiness verdict as evidence to re-verify against the current tip, never as a plan
@@ -137,8 +129,8 @@ whose text names `vitest`, so a script naming another runner's configuration rai
 - Put the provided-context declaration in the browser test setup module, and consume the injected
   data in `tests/app/browser/integration.test.ts` through the following portfolio configuration.
   Mount the shipped application entry with its real provisions before the acceptance journey runs.
-- From `tests/app/browser/integration.test.ts`, pass `../../../tmp/capture/states` as the capture
-  directory to write into the workspace's `tmp/capture/states` directory. The browser provider
+- From `tests/app/browser/integration.test.ts`, pass `../../../tmp/captures/states` as the capture
+  directory to write into the workspace's `tmp/captures/states` directory. The browser provider
   resolves a custom screenshot path relative to the test file's directory.
 
 ```ts
@@ -165,7 +157,7 @@ const PORTFOLIO = createPortfolio({
 	states: ['home'],
 	variants: VARIANTS,
 	variant: VARIANT,
-	directory: '../../../tmp/capture/states',
+	directory: '../../../tmp/captures/states',
 	enabled: CAPTURE,
 })
 ```
@@ -330,7 +322,7 @@ exists only during an activation is captured.
 Where a capture and a green suite disagree, take the capture as the evidence and the fixture as the
 defect.
 
-Route review of the portfolio to the `orkestrel-polish-surface` campaign. Do not judge it here.
+Route review of the portfolio to the `orkestrel-polish` campaign. Do not judge it here.
 
 ## Route the question
 

package/dist/host/agents/skills/orkestrel-journey/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: 'Prove Human Journeys'
+  short_description: 'Prove an application through the interface a person uses'
+  default_prompt: 'Use $orkestrel-journey to prove this application through the interface a person uses, and generate the capture portfolio, the resolved-style matrix, and the statechart outcome from those journeys.'

package/dist/host/agents/skills/{orkestrel-prove-journey → orkestrel-journey}/references/captures.md

@@ -119,5 +119,5 @@ after the click returns.
   state the interface never rests in.
 - Regenerate the whole matrix from the journeys after any surface change. Never judge a round
   against a portfolio that is part old and part new.
-- Route review of the portfolio to the `orkestrel-polish-surface` campaign, which owns preflight,
+- Route review of the portfolio to the `orkestrel-polish` campaign, which owns preflight,
   verdicts, and reconciliation. This reference owns only how the journeys generate it.