@orkestrel/scaffold 0.0.77 → 0.0.78

package/dist/host/agents/templates/brief.md

@@ -1,176 +1,55 @@
-# Dispatch brief template
+# Unit UNIT_ID — SHORT_SUBJECT
 
-Copy this file for each dispatch and fill every row. Then run
-`.agents/orchestration.md` § "Check the brief before you send it" against what you filled, and save
-the filled copy and the returned report under the names § "Every dispatch is a file before it is a
-launch" fixes.
-
-Replace every placeholder written in upper snake case with a concrete value. Retitle the filled
-copy `# Unit UNIT_ID — SHORT_SUBJECT`. Delete each italic reminder as you fill the row it sits
-under, and leave no row blank: fill a row you cannot close with a named unknown label, and
-describe that label under § Unknowns with how the unit reports back on it.
-
-An audit lane is the exception that drops rows: fill the rows
-`.agents/skills/orkestrel-falsify/references/brief.md` § "The audit lane's brief" names
-and delete the rest of this template. Every other dispatch keeps every section and row heading
-verbatim.
+Fill every section. Write `none` in an empty one. Replace each `UPPER_SNAKE_CASE` placeholder.
 
 ## Role and engine
 
-ROLE_NAME on ENGINE_NAME, reached as TRANSPORT.
-
-_Name the executor that opens this brief — a native subagent, a bench engine inside its own CLI, or a
-bridge driver — and write every later section for that reader._
+ROLE on ENGINE, reached as TRANSPORT. Executor: NATIVE_SUBAGENT | BENCH_ENGINE | BRIDGE_DRIVER.
 
 ## Objective
 
 ONE_OUTCOME.
 
-_State one outcome. Give a small unrelated obligation its own unit._
-
 ## Context
 
-**Evidence.** PASTED_COMMANDS_AND_OUTPUT
-
-_Paste the command and its output behind every factual claim: paths, counts, registrations, file
-existence. Name the scope each search covered, and check each fact against the code rather than
-against another artifact that states it._
-
-**Law.** `AGENTS.md`, RULE_FILES, SKILL_NAME and the references it requires, GUIDE_OR_SPEC.
-
-_Name each applicable rule file, the dispatch-named skill and its required references, and the
-governing guide or spec. Write `none` in a slot that is genuinely empty rather than dropping the
-slot._
-
-**Installed primitives.** ORKESTREL_PACKAGES_WITH_SURFACE_POINTERS.
-
-_Name every installed `@orkestrel/*` package whose exports the unit's owned files may overlap —
-`@orkestrel/test` and `@orkestrel/contract` for any unit that owns a `tests/**` or `src/**` file —
-with the pointer the unit reads first: the package's guide `## Surface` section in the scaffold
-checkout, or its declaration under `node_modules`. State that a helper, guard, wait, recorder, or
-deferred whose job an installed export does is a defect, and give the audit's checker the
-export-name probe over the diff._
-
-**Host.** SHELL, WORKING_PATH, NETWORK_AND_SANDBOX_LIMITS.
-
-_Name the shell, the working path, and the sandbox, network, and approval limits the unit's commands
-run under._
-
-**Measurements.** MEASURED_FACTS_AND_THE_CONDITIONS_THEY_WERE_TAKEN_UNDER.
-
-_Take each measurement under the conditions the unit runs in, or have the unit take it before doing
-anything else._
-
-**Control identifiers.** CONTROL_LABELS.
-
-_Keep this brief's control labels inside this brief, and state that a test is named for what it
-proves rather than for the control that specified it._
-
-**Standing conditions.** DIRTY_FILES, KNOWN_FAILING_COMMANDS, BLOCKED_TOOLS.
-
-_Name each condition the unit meets and must not diagnose as its own: a file expected to be dirty, a
-command known to fail, a gate red at the baseline, a shim the shell blocks, and who repairs each
-one._
+- **Evidence.** COMMANDS_AND_OUTPUT behind every fact.
+- **Law.** `AGENTS.md`; RULE_FILES; SKILL and the references it names; GUIDE_OR_SPEC.
+- **Installed primitives.** ORKESTREL_PACKAGES with the surface each unit reads first. A local helper whose job an installed export does is a defect.
+- **Host.** SHELL, WORKING_PATH, SANDBOX_NETWORK_APPROVAL_LIMITS.
+- **Standing conditions.** DIRTY_FILES, KNOWN_FAILING_COMMANDS, BLOCKED_TOOLS, and who repairs each.
 
 ## Unknowns
 
-UNKNOWN_FACT and HOW_THE_UNIT_REPORTS_IT.
-
-_Name what you do not know that the unit needs, as an unknown, with the report-back it takes. Write
-`none` where the brief is fully specified, rather than shipping a guess the unit has to invent an
-answer around._
+UNKNOWN and how the unit reports it.
 
 ## Scope
 
-**Owned.** OWNED_FILES
-
-_Grant a behaviour with the tests that pin it, a constant with every fixture and expectation derived
-from it, a template with the materialized copy the package generates from it, and a mechanism with
-the prose describing it: the comment beside the code it edits and the guide passage stating the
-behaviour it moves. A unit that moves a published symbol owns the package `README.md`._
-
-**Shared (report-only).** SHARED_FILES
-
-_Name each file another live unit owns. The unit returns an exact patch for serial integration and
-edits nothing in this row._
-
-**Off-limits.** OFF_LIMITS_FILES
-
-_Name each file the unit must not touch, and read every acceptance criterion against this row line by
-line. Grant the file a criterion needs, or strike that criterion. A file the change breaks that
-appears in no row of this section is unscoped. Never list `tmp/probe/` off-limits: it is the unit's
-probe home, and `.claude/rules/tests.md` puts every runtime probe there._
-
-**What asserts the state this change ends.** FILES_THE_RESULT_MAKES_FALSE
-
-_List every file the result makes false rather than every file that declares the thing changing: the
-test asserting the reversed behaviour, the fixture carrying the raised value, the golden digest over
-generated output, the consumer script naming the removed union member. Derive the list by running the
-suite; where you cannot run it, name the search's bound so the unit re-derives the list. A rename's
-search bound is a word-boundary sweep over the old name followed by a case-insensitive sweep over
-its `-s`, `-ed`, and `-ing` inflections. End each entry in Owned, in Shared, or with a named carrier
-dispatched before this change ships._
-
-**Tools and limits.** ALLOWED_TOOLS, PERMISSION_LIMITS
-
-_Check the § Output mechanism and every acceptance criterion's verification method against this
-allowlist. A read-only lane writes no report file and runs no probe, so hand it the rendered evidence
-instead. A rename moves the file with the shell's `mv`, never `git mv`; `git add -N` is permitted
-only to render diff evidence._
+- **Owned.** FILES, including the tests that pin the behavior, the fixtures derived from a constant, and the materialized copy of a template.
+- **Shared (report-only).** FILES; return an exact patch.
+- **Off-limits.** FILES. Never list `tmp/probes/` here.
+- **Made false by this change.** FILES, derived by running the suite or by a named search bound.
+- **Tools and limits.** ALLOWED_TOOLS; scoped validation only; no tree-wide mutating command.
 
 ## Execution
 
-**A native subagent, or a bench engine reading this brief inside its own CLI:** perform the
-assignment directly and spawn nothing.
-
-**A bridge driver:** carry this brief across unaltered, launch ENGINE_NAME through its CLI, and
-return the journal path and the session id with the result.
-
-_Keep the line written for the reader this brief reaches. Delete the line written for the other
-reader. A bench result that carries no journal path and no session id ran on the driver's own engine:
-refuse it._
+Perform the assignment yourself and spawn nothing. (Bridge driver: carry this brief unaltered, launch ENGINE through its CLI, and return the journal path and session id with the result.)
 
 ## Output
 
-RETURN_SHAPE, delivered through OUTPUT_MECHANISM.
-
-_State the exact distilled return shape and the mechanism that delivers it. No process diary._
+RETURN_SHAPE through OUTPUT_MECHANISM. No process diary.
 
 ## Deviation contract
 
-Stop and report — expected, found, exact evidence, done or not done, and at most one short
-hypothesis — on CONFLICT_WITH_THE_OBJECTIVE. Decide, record, and carry on from
-ANCILLARY_CONFLICT_THE_UNIT_SETTLES.
-
-_Scope the contract. A conflict with the objective stops the unit; where a paragraph sits and which
-heading a section takes are the unit's to settle._
+Stop and report (expected, found, evidence, done or not done, one hypothesis) on OBJECTIVE_CONFLICT. Settle ANCILLARY_CHOICES yourself and record them.
 
 ## Acceptance criteria
 
-1. REGENERATION_OR_CHEAPEST_GATE_CRITERION
-2. SCOPED_GATE_CRITERION
+1. CHEAPEST_GATE (regeneration, typecheck, or lint over owned files)
+2. SCOPED_TEST
 3. ARTIFACT_CRITERION
 
-_Order the criteria cheap-first, so an unreachable criterion cannot hide a typecheck or a lint
-criterion behind it. Where the change edits a file the repository vendors or digests, put the
-regeneration step ahead of every gate that reads the generated artifact. Ask what the change does
-to every fact you measured, and fix each criterion to the state the unit finishes in. Close each
-criterion with owned files alone, and name the property the unit must change; record a consequence
-you expect to follow as an observation, never as a criterion. A criterion that closes on an
-instrument's reading names that instrument's negative control and the class the control proves the
-instrument can see. A scoped run over the unit's own owned files stays a legitimate criterion._
-
-**Observations, not criteria.** TIMING_SENSITIVE_OR_WHOLE_SUITE_GATES
-
-_Name each timing-sensitive or whole-suite gate as an observation the unit reports with its own
-reading. Take the authoritative run yourself after the unit exits._
+**Observations, not criteria.** TIMING_SENSITIVE_OR_TREE_WIDE_GATES the unit reports and the Orchestrator re-runs.
 
 ## Review evidence
 
-EVIDENCE_FOR_EVERY_ROW_THIS_SUBJECT_OCCUPIES.
-
-_Supply what `orkestrel-falsify` § "Evidence, by subject type" requires of each row the subject
-occupies: for a code change the actual diff and the actual status output, for a rendered or
-externally driven surface the capture portfolio as primary and source as corroboration, and for a
-policy, design, or process proposal the proposal, the canon it must satisfy, and the record of what
-motivated it. A subject occupying more than one row takes the evidence of every row._
+The actual diff and `git status --porcelain` for a code change; the capture portfolio for a rendered surface; the proposal, the canon it must satisfy, and its motivation for a process proposal.

package/dist/host/agents/transports/claude-cli.md

@@ -0,0 +1,21 @@
+# Claude transport contract
+
+Every Codex-side driver that carries a brief to the Claude Opus 5.5 bench follows this file. Routes: `planner`, `reviewer`, `opus`. A driver writes the brief, resolves the command, and returns the brief path, the command, and the journal path. The Orchestrator launches the run as a tracked background command under a cap it sizes from prior runs. Read `.agents/orchestration.md` first; it owns the role set and the routing.
+
+## Command
+
+```text
+node .agents/skills/orkestrel-dispatch/scripts/launch.ts --journal tmp/claude/<unit>.jsonl --errors tmp/claude/<unit>.err --cap <seconds> --status -- claude -p "Read tmp/claude/<unit>-brief.md and execute it exactly. Your final message is the report it specifies." --model opus --output-format stream-json --verbose --permission-mode <mode>
+```
+
+- Pass the permission mode the route pins. Never substitute a fixed Claude model id; `opus` and `sonnet` are the aliases.
+- Write the brief to `tmp/claude/<unit>-brief.md` with `scripts/brief.ts --lane claude`; the prompt is a pointer to it. Briefs never travel as shell arguments.
+- Read the answer and the session id with `node .agents/skills/orkestrel-dispatch/scripts/result.ts --claude tmp/claude/<unit>.jsonl`. A unit with no journal ran on its driver's engine, however normal its answer reads.
+- A driver pinned `workspace-write` writes the brief itself. A driver pinned `read-only` writes nothing: it returns the brief text, its intended path, the resolved command, and the journal paths, and the Orchestrator writes and launches.
+- A driver never launches long work, recommends a cap, detaches, polls, restarts, or kills a run.
+
+## Availability
+
+- Probe with `node .agents/skills/orkestrel-dispatch/scripts/bench.ts --claude` before the first use in a session. `live: false` records the bench dark: return it at once with the fallback named, so the Astra main session records Opus unavailable for the round. Where the binary is absent, name the install command for the `claude` CLI so the Orchestrator can put it to the user in the same turn.
+- Never install, authenticate, or substitute an API key, access token, or copied auth file.
+- Never route orchestration or acceptance across this bridge. Never read credentials, edit, or spawn another agent.

package/dist/host/agents/transports/codex.md

@@ -1,175 +1,54 @@
 # Codex transport contract
 
-The transport contract every Claude-side driver follows when it carries a brief to the
-GPT-6 Astra bench: work class to transport, the exact exec form, journalling, session ids,
-and recovery. Reach a route by its own name — `analyst` for audit, `sol` for
-implementation. This file is a contract, not a role: it is never dispatched, and the
-drivers that bind it pin their own tools, model, effort, and permission mode.
+Every driver that carries a brief to the GPT-6 Astra bench follows this file. Routes: `analyst` (audit, objective design argument) and `astra` (implementation). A driver writes the brief, resolves the command, and returns the brief path, the command, and the journal path. The Orchestrator launches the run as a tracked background command under a cap it sizes from prior runs.
 
-You dispatch the external Codex Astra bench.
+## Models and effort
 
-Read `.agents/orchestration.md` first. It owns the role set, the routing, and the dispatch
-contract.
+```text
+CODEX_ASTRA_MODEL=gpt-6-astra          effort high; xhigh only for a stated hard-reasoning need
+CODEX_MECHANICAL_MODEL=gpt-6-sol       fully specified, taste-free units and drivers
+CODEX_READING_MODEL=gpt-6-luna         absorption and research when the Cursor bench is dark; record the substitution
+```
 
-The dispatch names exactly one route and includes the objective, evidence slice, rules,
-skill, guide or spec, scope, output contract, and acceptance criteria. Spawn no Claude
-agent, never implement directly, and never treat Astra's response as authoritative.
+## Command
 
-## Models and effort
+Use the journaled CLI for every unit. `codex mcp-server` was removed in Codex 0.154.0: never register it in an MCP configuration and never call an `mcp__codex__*` tool.
 
 ```text
-CODEX_ANALYST_MODEL=gpt-6-astra
-CODEX_ANALYST_EFFORT=high
-CODEX_IMPLEMENTER_MODEL=gpt-6-astra
-CODEX_IMPLEMENTER_EFFORT=high
+node .agents/skills/orkestrel-dispatch/scripts/launch.ts --journal tmp/codex/<unit>.jsonl --errors tmp/codex/<unit>.err --cap <seconds> --status -- codex exec --json -C <checkout> --sandbox <sandbox> --model gpt-6-astra -c model_reasoning_effort="high" --output-last-message tmp/codex/<unit>-last.md "Read tmp/codex/<unit>-brief.md from disk and execute it exactly. Your final message is the report it specifies."
 ```
 
-Raise the analyst to `xhigh` only for a stated hard reasoning need. Use `gpt-5.6-terra`
-only for explicitly mechanical, taste-free roles. Use `gpt-5.6-luna` for absorption,
-distillation, scouting, and bounded research when the Cursor bench is dark — it sits
-between Cursor Grok and Sonnet on the tedious-work ladder, and the substitution is
-recorded. Never switch models silently.
-
-## Transport — pick by work class
-
-- **Short interactive exchange** (one bounded question or a follow-up on an existing
-  thread, finishing in about two minutes): use the MCP tools. `mcp__codex__codex` starts
-  the session; `mcp__codex__codex-reply` continues it. Persist the thread id to
-  `tmp/codex/<unit>.session` the moment a response carries it. An interrupted MCP call
-  whose id was never written to disk is unrecoverable, and that exchange is then failed.
-- **Long-running work** (audits, implementation units, anything multi-minute): the
-  journaled CLI is mandatory, the MCP tools are forbidden, and you do not launch it. A
-  long MCP call is one interruption away from losing the session invisibly, and a
-  backgrounded exec you start and walk away from has no owner, no completion signal, and
-  no death notice. Prepare it and hand it back.
-
-## Prepare the journaled CLI launch
-
-Your jobs are drafting the brief and running short MCP exchanges. For long work you
-prepare the launch and return it; the Orchestrator runs it as a harness-tracked
-background command under a hard cap.
-
-Create `tmp/codex/`, then write the full brief to `tmp/codex/<unit>-brief.md`. Briefs
-never travel as shell arguments. Return the exact resolved command with a pointer prompt:
-
-`timeout <cap> codex exec --json -C <working-directory> --sandbox <route-sandbox> --model gpt-6-astra -c "model_reasoning_effort=\"high\"" --output-last-message tmp/codex/<unit>-last.md "Read and execute the brief at tmp/codex/<unit>-brief.md exactly. Your final message must be the report it specifies." < /dev/null > tmp/codex/<unit>.jsonl`
-
-- Return the brief path, that resolved command, and the journal path. Leave
-  `<cap>` unresolved — the Orchestrator owns it, per **Long-running commands → Launching**
-  in `.agents/orchestration.md`. You hold no record of prior runs.
-- Never launch, background, poll, sleep-loop, restart, or kill an exec.
-- Keep `< /dev/null`. A background-launched exec that inherits an open stdin pipe wedges
-  before its first event, and only the cap ever surfaces it.
-- Add `--skip-git-repo-check` when the working directory is outside a trusted git
-  repository, and `--output-schema <file>` when the Orchestrator supplies one.
-- The journal at `tmp/codex/<unit>.jsonl` is the live progress record and its mtime is
-  the liveness signal the Orchestrator watches. Never re-print the stream into your report.
-- The Orchestrator reads Astra's answer from the `--output-last-message` file rather than
-  stdout, and records the session id (`thread_id` in the journal's opening events)
-  beside the result; a follow-up on a finished exec is a fresh dispatch.
-
-## The exec sandbox denies network
-
-`codex exec` runs with `--unshare-net`. Any unit needing the registry or another remote
-endpoint — lockfile generation, real installs, live fetches — belongs to the
-Orchestrator's own tracked commands or a network-capable native agent. Never put it in a
-brief. A Astra exec hanging on `npm` until its cap fires is this misroute, not a slow bench.
-
-The namespace has its own loopback, so a host daemon on `127.0.0.1` is unreachable and a bind can
-fail `EPERM`. It has no IPv6, so `::1` fails `EAFNOSUPPORT`. Any proof that must reach a daemon,
-bind a port, or drive a built server belongs outside the exec.
-
-## The exec sandbox mounts `.git` read-only
-
-A `workspace-write` exec can write the working tree and cannot write `.git`. Every command
-that takes the index lock fails, `git checkout -- <file>` included.
-
-Never write a git command into a brief as a mechanism. A unit that must restore a file it
-mutated restores it by rewriting the original text, and proves it with
-`git diff --exit-code -- <file>`, which reads the index without locking it. Reading commands
-— `status`, `diff`, `log` — are unaffected and stay available.
-
-## Recovery ladder
-
-On any interruption or missing result, in order:
-
-1. Interrupted MCP call with a persisted thread id → `mcp__codex__codex-reply` asking Astra
-   to re-emit the complete final report. The reasoning may have finished server-side.
-2. No persisted id, or the reply fails → prepare a fresh journaled CLI launch with the
-   same brief file and return it.
-3. Interrupted CLI exec → the journal survives. Report the thread id and the last journal
-   events as a deviation, and let the Orchestrator choose resume or fresh.
-
-`codex exec resume <session-id>` inherits the session's sandbox, model, effort, and
-working directory, and rejects `--sandbox`, `--model`, `-c`, and `-C`. Only output flags
-and the prompt are valid on a resume. A read-only session can therefore never be resumed
-into a writer, so implementation always gets a fresh `workspace-write` session.
-
-## Analyst route
-
-Sandbox `read-only`, current checkout. Use for the objective design argument, diagnosis,
-correctness and security audit, and constraint review. Capture repository status before
-and after. Require evidence for every claim and return unsupported claims as dropped.
-
-An audit brief states its subject as a numbered list of falsifiable claims rather than a
-diff to read, and requires Astra to attempt refutation. The Falsification section of
-`.claude/rules/quality.md` owns the method and the evidence each verdict carries. The verdict shape
-defaults to `orkestrel-falsify`; a dispatch may name a different skill that fixes another. That
-skill owns the value set and the terminal line. Point the brief at both; restate neither.
-
-## Astra route
-
-Sandbox `workspace-write`, the checkout the route writes in, its sole serial writer from a clean committed
-baseline, with owned files, off-limits files, and a deviation contract. The brief forbids
-dependency installation, commits, pushes, publishing, credentials, destructive commands,
-shared-file edits, and tree-wide mutating gates.
-
-The Orchestrator verifies the finished exec with direct evidence — git status, the diff,
-scoped validation — and carries touched files, diffstat, and deviation state into
-integration and review.
-
-On a Windows host a shell write that decodes and re-encodes text can replace a code point the active
-code page cannot represent, so when a bench unit must edit a line carrying a code point above
-`0x7F`, the brief tells it to make that edit through the exec's own patch tool, never through
-`Get-Content`, `Set-Content`, `Out-File`, or a `>` redirection, and to report every such line it
-touched. The Orchestrator's review sweep compares the set of code points above `0x7F` on each
-touched line before and after the edit, and flags a line that lost any of them.
-
-## Routing exclusion — defensive negative-test units
-
-The provider applies a content-safety filter that terminates a turn mid-run when the work
-requires authoring or reproducing a violation construct, even when the purpose is to prove
-a guard rejects it: sandbox escapes, resolution-bypassing imports, boundary evasion,
-injection payloads, credential-handling probes. The filter reads the construct, not the
-intent, so a legitimate negative test trips it exactly like an attack would. Observed twice
-on one unit, at the same point in the work, with nothing written to disk either time.
-
-Route such a unit to `opus` from the start and record the Codex
-bench dark for that unit with this reason. Do not soften or obscure a brief to slip past
-the filter; a bench that declines work is a routing fact, not an obstacle. The exclusion is
-per unit — everything else still routes to Astra, and an audit that merely reads existing
-negative tests is unaffected.
+- Launch through the dispatch skill's `launch.ts` as the preceding block shows; it closes stdin, records `git status --porcelain` before and after, and kills the process tree at the cap. Write the brief with `scripts/brief.ts --lane codex`. Never write a `.sh` launcher.
+- Codex appends piped stdin to the prompt; the launcher closes stdin so an inherited pipe adds nothing.
+- Add `--skip-git-repo-check` outside a trusted repository and `--output-schema <file>` when the Orchestrator supplies one.
+- The first journal event, `thread.started`, carries the session id. Read the answer with `node .agents/skills/orkestrel-dispatch/scripts/result.ts --codex tmp/codex/<unit>.jsonl`, which reads the last-message file, never stdout.
+- Follow up with `codex exec resume <session-id> "<prompt>"`. Resume accepts `--model`, `-c`, and output flags, and inherits the session's directory; pass the sandbox and permissions you intend explicitly rather than inferring them from the session's former role.
+
+## Sandbox by host
+
+| Host                                             | `analyst`            | `astra`              |
+| ------------------------------------------------ | -------------------- | -------------------- |
+| POSIX, Claude Code Cloud                         | `read-only`          | `workspace-write`    |
+| Windows (measured 2026-09-28 on the user's host) | `danger-full-access` | `danger-full-access` |
+
+- On the measured Windows host `read-only` and `workspace-write` reject every shell command with `blocked by policy`. Recheck when the host or the Codex version changes. Under `danger-full-access` the brief states read-only where the route is read-only, and the launch script records `git status --porcelain` before and after; any difference is a deviation. This mode detects tracked changes only; it does not enforce read-only access.
+- Recorded POSIX sandbox behavior, to recheck when conditions change: network denied, `.git` mounted read-only, loopback bind fails `EPERM`, a grandchild process is denied. Route installs, live fetches, servers, process-tree proofs, and lockfile generation to the Orchestrator or a native writer.
+- A nested `git` inside the sandbox has reported `not a git repository` while the unit's own `git status` worked; name this in the brief so the unit does not diagnose the checkout.
+- When a sandbox rejects a write, the unit stops and reports it. It never tries another write mechanism.
+- A Windows shell write can re-encode text. Edit a line carrying a code point above `0x7F` with the exec's patch tool, never with `Set-Content`, `Out-File`, or `>`.
 
 ## Availability
 
-- Verify `codex --version` before first use. On Windows `codex` resolves in Bash through
-  the extensionless npm shim; if it does not, invoke `codex.cmd`.
-- Binary absent: report it so the Orchestrator can record the bench dark and, in the same turn,
-  name to the user the install command for `@openai/codex` and the bench it unblocks. The
-  Orchestrator re-probes when the user answers. Never install it yourself.
-- Binary present but authentication unavailable: report it so the Orchestrator can start
-  device-auth recovery in the same turn. It backgrounds `codex login --device-auth` with
-  output captured to `tmp/codex/login.log`, surfaces the verification URL and one-time code
-  from that file, and re-probes `codex login status` on completion.
-- Recovery impossible — device login unavailable, declined, or expired: the Codex bench is
-  dark. Name the fallback explicitly: `planner` and `reviewer` (Opus 5.5) for judgment, and
-  `builder` for fully specified mechanics.
-- Never authenticate, log out, inspect auth files, or substitute an API key, access token,
-  or copied `auth.json`.
+- Probe with `node .agents/skills/orkestrel-dispatch/scripts/bench.ts --codex` before the first use in a session: it reads `codex --version` and `codex login status`, then runs one bounded exec and reports `live`. Neither the version nor the login status alone is liveness.
+- Binary absent: report it; the Orchestrator names `npm install -g @openai/codex` to the user and re-probes when the user answers.
+- Not logged in: the Orchestrator runs `node .agents/skills/orkestrel-dispatch/scripts/login.ts --codex` in the background, which journals `codex login --device-auth` to `tmp/codex/login.log`, prints the URL and the one-time code for the user, and polls the status until it answers; then it re-probes with `bench.ts --codex`.
+- Recovery impossible: record the bench dark. `planner` and `reviewer` hold the objective lane too; `builder` takes fully specified mechanics.
+- Never authenticate on the user's behalf, read an auth file, or substitute a key or token.
 
-## Journals
+## Routing exclusion
 
-Leave `tmp/codex/` to the Orchestrator. `.agents/orchestration.md` § Bench laws owns the
-retention rule for every journal, brief, session file, and last-message file.
+The provider's content filter has ended turns that authored a violation construct, even as a negative test: sandbox escapes, resolution-bypassing imports, injection payloads, credential probes. Route such a unit to `opus` from the start and record the bench dark for that unit only.
+
+## Journals
 
-Never route orchestration or acceptance across this bridge.
+Journals live under `tmp/codex/` and are never committed. `.agents/orchestration.md` § Cleanup owns their deletion.

package/dist/host/agents/transports/cursor.md

@@ -1,85 +1,36 @@
 # Cursor transport contract
 
-The transport contract every driver follows when it carries a brief to the Cursor Grok
-bench: the model pin, the CLI resolution ladder, the launch form, journalling, session ids,
-and recovery. Reach the route by its own name — `grok`. This file is a contract, not a
-role: it is never dispatched, and the drivers that bind it pin their own tools, model,
-effort, and permission or sandbox mode.
-
-Read `.agents/orchestration.md` first. It owns the role set, the routing, and the dispatch
-contract. Cursor is native to neither Claude Code nor Codex, so both harnesses' `grok`
-bridges bind this file.
+Every driver that carries a brief to the Cursor Grok bench follows this file. Route: `grok`. A driver writes the brief, resolves the command, and returns the brief path, the command, and the journal path. The Orchestrator launches the run as a tracked background command under a cap it sizes from prior runs. Read `.agents/orchestration.md` first; it owns the role set and the routing.
 
 ## Model
 
 ```text
-CURSOR_GROK_MODEL=cursor-grok-4.7-high
+CURSOR_GROK_MODEL=grok-4.7-high
 ```
 
-That id was read from `agent models` on 2026-08-13. Resolve the model from the variable at
-dispatch. Re-read `agent models` and update this line when the id changes. Never guess or
-substitute a model id.
-
-## Invocation
-
-Resolve the CLI in this order, verifying with `--version` before first use:
-
-1. bare `agent`, on a POSIX host;
-2. on Windows, the versioned entry under `"$LOCALAPPDATA/cursor-agent/versions/"` — take the
-   newest directory and invoke its own `node.exe` against its `index.js` directly.
-
-Launch an unattended run through the versioned entry, never through `agent`, `agent.cmd`, or
-`agent.ps1` on Windows. Those shims delegate to `cursor-agent.ps1`, which sets the console window
-title and can abort with Win32 `0xE9` when no console is attached. The failure is intermittent, so a
-shim that answered once does not clear it, and when it does fire it leaves only a PowerShell
-`SetConsoleWindowTitle` trace — which reads as a bench that returned nothing rather than as a launch
-that never happened. The versioned entry has no console dependency and no such failure mode.
-
-Read an empty shim run as a launch failure until its `.err` journal is checked for that
-trace.
+Read from `agent models` on 2026-08-13. Re-read `agent models` and update this line when the id changes. Never guess or substitute a model id.
 
-## Journal the launch
+## Command
 
-Create `tmp/cursor/` first. Write any brief longer than a couple of sentences to
-`tmp/cursor/<unit>-brief.md` and make the prompt a pointer to it; briefs never travel as
-fragile shell arguments. Every run journals its event stream, so the user can tail progress
-live and an interrupted run leaves its partial distillate on disk:
+- Resolve the entry with `node .agents/skills/orkestrel-dispatch/scripts/bench.ts --cursor --resolve`: bare `agent` on a POSIX host; on Windows, the newest versioned install's own `node.exe` and `index.js` under `%LOCALAPPDATA%\cursor-agent\versions\`. Never launch through `agent`, `agent.cmd`, or `agent.ps1` on Windows: the shims can abort with Win32 `0xE9` when no console is attached and leave only a `SetConsoleWindowTitle` trace in the `.err` file. Read an empty shim run as a launch failure.
+- Launch:
 
-`<resolved-entry> -p --trust --mode=ask --model "$CURSOR_GROK_MODEL" --output-format stream-json "<pointer>" > tmp/cursor/<unit>.jsonl 2> tmp/cursor/<unit>.err`
-
-Write that chain to `tmp/cursor/run.sh` and run the file, so the resolution, the model, and the
-journalling are one artifact the next run reuses.
-
-A driver pinned `workspace-write` writes the brief and the run script itself. A driver pinned
-`read-only` writes nothing at all — not the brief, not the script, not the journal: return the
-brief text, its intended path, the resolved command, and the journal and `.err` paths, and the
-Orchestrator writes them and launches the run. Check your own pinned sandbox before drafting, and
-take the branch that matches it.
-
-The journal's first event is the `init` event, and its `session_id` is the run's recovery
-handle. The journal's `result` event carries the final answer. Return the journal path and
-that session id with the result, so the Orchestrator can confirm the bench ran. Read the
-`.err` file before calling a run empty; a launch that never reached the model leaves its
-trace only there. Resume an interrupted run through the CLI's `--resume` option, probed
-before its first use.
+```text
+node .agents/skills/orkestrel-dispatch/scripts/launch.ts --journal tmp/cursor/<unit>.jsonl --errors tmp/cursor/<unit>.err --cap <seconds> --status -- <node> <index> -p --trust --mode=ask --model grok-4.7-high --output-format stream-json "Read tmp/cursor/<unit>-brief.md and execute it exactly. Your final message is the document it specifies."
+```
 
-Run that yourself only for a short bounded ask finishing in about two minutes. For anything
-longer your job ends at drafting: return the brief path, the exact resolved command, and the
-journal path, and let the Orchestrator launch it as a harness-tracked background command under
-a cap it owns. Never recommend a cap — you hold no record of prior runs. Never detach a run and
-end your turn; an unowned run has no completion signal and no death notice.
+- Write the brief to `tmp/cursor/<unit>-brief.md` with `scripts/brief.ts --lane cursor`; the prompt is a pointer to it.
+- Read the answer and the session id with `node .agents/skills/orkestrel-dispatch/scripts/result.ts --cursor tmp/cursor/<unit>.jsonl`. The `init` event carries the session id; resume through the CLI's `--resume` option, probed before its first use.
+- A driver runs a lane finishing in about two minutes itself and returns the result. For anything longer its job ends at drafting: return the brief path, the resolved command, and the journal path. A driver never recommends a cap and never detaches a run.
+- A driver pinned read-only writes nothing: it returns the brief text, its intended path, the resolved command, and the journal paths, and the Orchestrator writes and launches.
 
 ## Containment
 
 - Never use `--force`.
 - Never expose `CURSOR_API_KEY`, inspect unrelated environment values, or read credentials.
-- Leave `tmp/cursor/` to the Orchestrator. `.agents/orchestration.md` § Bench laws owns the
-  retention rule for every journal.
+- Leave `tmp/cursor/` to the Orchestrator; `.agents/orchestration.md` § Cleanup owns retention.
 
 ## Availability
 
-If nothing responds the bench is dark. Stop with a deviation naming the fallback from the root
-tedious-work ladder — Luna, then Sonnet. Never hand the reading to the Orchestrator, `planner`, or
-`analyst`. Never install or authenticate.
-
-Never route orchestration or acceptance across this bridge.
+- `bench.ts --cursor` reporting `live: false` records the bench dark. Stop with a deviation naming the fallback from `.agents/orchestration.md` § Benches: Luna, then Sonnet. Never hand the reading to the Orchestrator, `planner`, or `analyst`. Never install or authenticate.
+- Never route orchestration or acceptance across this bridge.

package/dist/host/claude/AGENTS.md

@@ -0,0 +1,38 @@
+# Claude Code bridge
+
+`AGENTS.md` governs code. `.agents/orchestration.md` governs agent operation. This file adds Claude Code mechanics and cannot weaken either. Claude Code loads it at session start beside the root `AGENTS.md`; another harness reads it only when started inside `.claude/`.
+
+## Dispatch
+
+- Use the Agent tool for one unit, or when the next step depends on the result. Name the role as `subagent_type`.
+- Use a Workflow for a fan-out of many small units, a staged pipeline, or a loop. Give every `agent()` node a model alias and an effort. Serialize writing nodes. Recover an interrupted run with `resumeFromRunId`.
+- Never run a design or review lane as `fork`. A lane starts with a clean context.
+- Use the built-in `Explore` agent for a quick locate; it loads no instruction files.
+- Foreground Bash is capped at 10 minutes. Run anything longer as a background command with an internal `timeout`.
+- Write a reusable or long-running program as a TypeScript file and run it with `node`; a heredoc, `node -e`, `&&` chain, or `${...}` argument trips the Windows approval classifier, and a one-shot read-only check may run inline. Probe a bench with `node .agents/skills/orkestrel-dispatch/scripts/bench.ts`, launch a lane through `scripts/launch.ts`, and read its answer with `scripts/result.ts`, all from the dispatch skill.
+
+## Models
+
+- Use the aliases `opus` and `sonnet`. Never `inherit`, never a fixed model ID, never `CLAUDE_CODE_SUBAGENT_MODEL`.
+- An alias serves the model the installed Claude Code maps it to. After a model release, measure the mapping with `claude -p --model <alias> --output-format json` and read `modelUsage`; when a newer model answers by id and the alias lags, update Claude Code (`scoop update claude-code` on this host) and measure again. Claude Code 2.1.284 serves Sonnet 5.5 as `sonnet` and Opus 5.5 as `opus` (measured 2026-09-29).
+- Run the main session on `opus` at high effort and keep the model fixed for the session; a model switch invalidates the prompt cache. An effort switch invalidates it too except on Opus 5.5 and Fable 5.1 under a Claude subscription or API key.
+- Reach Astra through `analyst` and `astra`, Grok through `grok`. Role frontmatter carries Claude models only.
+
+## Context and cache
+
+- Roles that launch a CLI, run gates, or only read set `omitClaudeMd: true`; their charters carry the permission floor they need. Writers and reviewers load the contract.
+- Adding or removing an MCP server invalidates the cache when its tools load into the prefix; deferred tools (the default) append without disturbing it. Avoid either mid-session.
+- An edit to a loaded instruction file takes effect after `/clear`, `/compact`, or a restart. Edits under `.claude/agents/` and `.claude/skills/` hot-reload.
+- Keep large reads in subagents. The main context holds decisions.
+
+## Wiring
+
+- `.mcp.json` registers `probe` from `node_modules/@orkestrel/probe/dist/bin/main.js`. Run `npm ci --ignore-scripts` before the first `prove` call in a fresh checkout.
+- `.claude/settings.json` hooks: `SessionStart` runs the Cloud setup hooks under `scripts/` and the dispatch skill's `sweep.ts --report`; `Stop` runs `git diff --check`. `scripts/` holds Cloud setup hooks and nothing else.
+- `claude mcp serve` exposes this harness to a Codex- or Cursor-primary session.
+- `.claude/skills/<name>/SKILL.md` loads `.agents/skills/<name>/SKILL.md` and adds nothing.
+
+## Cloud
+
+- Setup installs `@openai/codex` and never authenticates. Start each live session with `codex login --device-auth`.
+- `scripts/deps.sh` reinstalls when the lockfile digest differs from `node_modules/.orkestrel-lock.sha256`. Write the marker only after `npm ci` succeeds for that lockfile, in the same turn.