@orkestrel/scaffold 0.0.77 → 0.0.79

package/dist/host/claude/rules/workspace.md

@@ -58,6 +58,7 @@ Define aliases in `tsconfig.json` first. `vite.config.ts` derives from `compiler
 - `tsconfig.json`: shared compiler options, all-tree types, and path aliases.
 - `vite.config.ts`: shared builds, test projects, environment loading/mapping, and aliases.
 - `*/types.ts`: public API contracts.
+- `configs/agents/tsconfig.skills.json`: the scoped typecheck of the skill scripts; its presence selects the `skills` blueprint fact.
 - `configs/src/` and `configs/app/`: thin per-target wrappers, including optional
   `configs/src/*bin*` files. Shared logic remains in root configs.
 - `configs/helpers.ts`, `configs/browsers.ts`, and `configs/policy.ts`: the only permitted leaves
@@ -128,18 +129,19 @@ environment axis is one project per src/app axis × environment:
 The workspace-proof axis is cross-cutting. Each proof covers the whole workspace rather than
 one environment, so each is its own project:
 
-| Project             | Files                                                          | Proves                                                                                                                                                                                       | Gate                                  |
-| ------------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------- |
-| `policy`            | `tests/policy.test.ts`                                         | The path- and text-shaped policy laws: mirrors, suppressions, the rule map, filenames, manifest scripts, skills, and bridges                                                                 | `test`                                |
-| `config`            | `tests/config.test.ts`                                         | Root configuration resolves its aliases, projects, and outputs                                                                                                                               | `test`                                |
-| `setup`             | `tests/setup*.test.ts`, excluding `tests/setupBrowser.test.ts` | Prove root setup behavior in Node with `setup.ts`.                                                                                                                                           | `test`                                |
-| `setup:browser`     | `tests/setupBrowser.test.ts`                                   | Prove browser setup behavior in Playwright Chromium with `setup.ts` and `setupBrowser.ts`.                                                                                                   | `test`                                |
-| `journey:<variant>` | `tests/app/browser/integration.test.ts`                        | Drive the browser application at the declared variant viewport in Playwright Chromium with `setup.ts` and `setupBrowser.ts`.                                                                 | `test` through `test:journey`         |
-| `guides`            | `tests/guides.test.ts`                                         | Every documented API exists, every public API is documented, every compared summary, example, and pitch equals its source, and every executable fence returns what the guide says it returns | `test`                                |
-| `conformance`       | `tests/conformance.test.ts`                                    | Where this package drifts from the official tooling it tracks                                                                                                                                | `test`                                |
-| `distribution`      | `tests/distribution.test.ts`                                   | The packed package installs and resolves through its public exports                                                                                                                          | `prepublishOnly`; absent when private |
-| `integration`       | `tests/integration.test.ts`                                    | The package's features work together end to end across environments                                                                                                                          | `test`                                |
-| `service`           | `tests/service/**/*.test.ts`                                   | The live external services this package drives, driven for real                                                                                                                              | `prepublishOnly`; `test` when private |
+| Project             | Files                                                          | Proves                                                                                                                                                                                                                      | Gate                                  |
+| ------------------- | -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------- |
+| `policy`            | `tests/policy.test.ts`                                         | The path- and text-shaped policy laws: mirrors, suppressions, the rule map, filenames, manifest scripts, skills, and bridges                                                                                                | `test`                                |
+| `config`            | `tests/config.test.ts`                                         | Root configuration resolves its aliases, projects, and outputs                                                                                                                                                              | `test`                                |
+| `setup`             | `tests/setup*.test.ts`, excluding `tests/setupBrowser.test.ts` | Prove root setup behavior in Node with `setup.ts`.                                                                                                                                                                          | `test`                                |
+| `setup:browser`     | `tests/setupBrowser.test.ts`                                   | Prove browser setup behavior in Playwright Chromium with `setup.ts` and `setupBrowser.ts`.                                                                                                                                  | `test`                                |
+| `journey:<variant>` | `tests/app/browser/integration.test.ts`                        | Drive the browser application at the declared variant viewport in Playwright Chromium with `setup.ts` and `setupBrowser.ts`.                                                                                                | `test` through `test:journey`         |
+| `guides`            | `tests/guides.test.ts`                                         | Every documented API exists, every public API is documented, every compared summary, example, and pitch equals its source, and every executable fence returns what the guide says it returns                                | `test`                                |
+| `conformance`       | `tests/conformance.test.ts`                                    | Where this package drifts from the official tooling it tracks                                                                                                                                                               | `test`                                |
+| `skills`            | `tests/agents/**/*.test.ts`                                    | Each skill script under `.agents/skills/*/scripts/` does what its `SKILL.md` states, driven as a child process against a scratch fixture from its mirrored proof; `configs/agents/tsconfig.skills.json` selects the project | `test`                                |
+| `distribution`      | `tests/distribution.test.ts`                                   | The packed package installs and resolves through its public exports                                                                                                                                                         | `prepublishOnly`; absent when private |
+| `integration`       | `tests/integration.test.ts`                                    | The package's features work together end to end across environments                                                                                                                                                         | `test`                                |
+| `service`           | `tests/service/**/*.test.ts`                                   | The live external services this package drives, driven for real                                                                                                                                                             | `prepublishOnly`; `test` when private |
 
 - Define the Node `setup` project only when a root file matches `tests/setup*.test.ts`,
   exact-case, other than `tests/setupBrowser.test.ts`. Include those matching files and exclude
@@ -147,6 +149,8 @@ one environment, so each is its own project:
   exists, and collect that path alone. For each registered project, emit its `test:setup` or
   `test:setup:browser` script and run it from `test`; otherwise emit neither its project nor its
   script.
+- When `tests/setupGlobal.ts` exists, give `src:browser`, `setup:browser`, and `integration` that
+  module as their `globalSetup` option, and give no other project a global setup.
 - When a browser application selects the journey axis, register `journey:<variant>` projects
   through the birth-owned `configs/app/vite.journey.config.ts` wrapper. Keep the adopter's variant
   list there and compose each project through the root `appJourney` factory. Exclude
@@ -164,13 +168,13 @@ parallelism in `service`. In a `private: true` workspace, never declare `prepubl
 `distribution`, reach `service` from `test`, and retain the service project's isolated
 configuration.
 
-One project sits on neither axis. `probe` includes `tmp/probe/**/*.test.ts` so an agent can run a
+One project sits on neither axis. `probe` includes `tmp/probes/**/*.test.ts` so an agent can run a
 throwaway instrument against real sources, aliases and setup. Declare no proof there. Keep the
 project composed in the root configuration rather than declared as a path string. The `probe` MCP
-server arms through it — its arming specifications live under the `tmp/probe/` directory and infer
+server arms through it — its arming specifications live under the `tmp/probes/` directory and infer
 this project — so a workspace that removes the project, or declares it as a path string, fails the
 server's arming, and an unarmed server refuses every `prove` call. The `test:bench` script runs the
-same project in benchmark mode, which collects every test file under the `tmp/probe/` directory and
+same project in benchmark mode, which collects every test file under the `tmp/probes/` directory and
 the `tests/` tree while refusing every ordinary test case. Every test script names its project and
 the `test:bench` script joins no chain, so no gate runs either mode; the project's directory is
 ignored by git; and `.claude/rules/tests.md` governs what may live there.
@@ -204,6 +208,8 @@ then runs the configured scoped checks that prove environment isolation.
 - `check:src` mirrors configured `src:*` test projects; optional `src:bin` is its
   own scope.
 - `check:app` mirrors configured `app:*` projects.
+- `check:skills` typechecks `.agents/skills/*/scripts/*.ts` through `configs/agents/tsconfig.skills.json` wherever that wrapper is present: the root project's wildcard never enters a dot-prefixed directory, so the scripts need their own scope.
+- The `build:skills` script emits a `.js` twin of every `.agents/skills/*/scripts/*.ts` script into the `dist/agents/skills/` tree through the same wrapper, rewrites each relative import to `.js`, and copies `.agents/templates/brief.md` into the `dist/agents/templates/` directory; the `build` chain runs it after `build:host`, and `dist/agents` ships in the package.
 - During development, run the narrowest granular scope that covers the change.
 - Lint is a separate complementary gate; neither lint nor root checking replaces
   environment-isolation checks.

package/dist/host/claude/rules/writing.md

@@ -1,89 +1,66 @@
-# Developer-facing writing rules
-
-These rules govern prose a developer reads, including chat replies, reports, guides, README files,
-and commit messages.
-`AGENTS.md` § Writing governs prose everywhere, and this file does not restate it; this file adds
-only what a developer audience decides. An instruction file follows `AGENTS.md` § Instruction files
-first, and these rules wherever a rule here names no different form for it.
-
-## Voice and actor
-
-- Write `must` for a requirement, `can` for an option or an ability, and `might` for a possibility.
-  A recommendation takes the imperative, the same form `AGENTS.md` § Writing fixes for instructions.
-  Never write `should`, and never soften a recommendation into `We recommend`.
-- Address the developer as `you`. Name the software component that acts, and make it the subject of
-  the sentence. Reserve `user` for someone using software the developer builds. Never write `we`,
-  `our`, or `let's` about agent work.
-- Give software no human faculties. A component reports, returns, detects, or refuses; it never
-  knows, thinks, wants, or sees.
-- Use the passive voice only where naming the actor adds blame and nothing else, such as a defect
-  count. Name the actor wherever the reader needs it.
-- Use negative contractions (`don't`, `isn't`, `can't`) in a reply or a guide. Do not use them in an
-  instruction file.
-
-## Sentence and paragraph order
-
-- Put the condition, the goal, or the location before the instruction, so a reader the instruction
-  does not apply to stops at the first clause. Put the result or the reason after it. This governs a
-  sentence, not a document: a report still opens with its finding.
-- Put the key point in the first sentence of every paragraph and every list item, not only in the
-  opening of the reply or the section.
-- Keep the helper words `that`, `then`, `of`, `a`, and `the`. Do not drop one for brevity.
-- Name the noun after `this`, `these`, or `it` wherever the reader could attach the pronoun to
-  another referent.
-- State what the reader can do. Do not write a double negative.
+# Writing rules
+
+`AGENTS.md` § Writing governs every reply. This file adds what developer prose, comments, and instruction files decide. Write prose after the code works, and keep it short.
+
+## Voice
+
+- Write `must` for a requirement, `can` for an option, `might` for a possibility, and the imperative for a recommendation. Never `should`, never `We recommend`.
+- Address the developer as `you`. Make the software component the subject; it reports, returns, detects, or refuses, and never knows, thinks, wants, or sees. Never `we`, `our`, or `let's` about agent work.
+- Use the passive voice only where naming the actor adds nothing.
+- Use negative contractions in a reply or a guide, never in an instruction file.
+
+## Order
+
+- Put the condition, goal, or location before the instruction. A report still opens with its finding.
+- Put the key point in the first sentence of every paragraph and list item.
+- Keep `that`, `then`, `of`, `a`, and `the`. Name the noun after `this`, `these`, or `it` when the referent is unclear.
+- State what the reader can do; no double negatives.
 
 ## Claims and time
 
-- Claim only what the reader can check. Never write `ensure`, `guarantee`, a superlative, or an
-  effort adjective as a claim about behavior, and cite the run behind every number. `ensure`
-  addressed to an executor as a directive is outside this ban.
-- Write the present tense for what exists. Do not write `currently`, `now`, `new`, `latest`, or
-  `soon`; where time matters, give the version or the date.
-- Recommend one path, the shortest one you proved. Rule on every option you list, and drop an option
-  equivalent to the one you recommend.
-
-## Code tokens, references, and links
-
-- Put a code token in backticks and follow it with a noun: the `parse` method, the `vite.config.ts`
-  file, the `--check` flag. Never inflect, pluralize, or possessivize a code token, and never use one
-  as an English verb.
-- Point to other material with `preceding`, `following`, `earlier`, or `later`, never with `above` or
-  `below`. Use `earlier` and `later` for a version range too.
-- Write link text as the destination's title or a descriptive phrase, introduced by `see`. Never
-  write `here`, `this document`, or a bare URL in prose.
-- Paraphrase third-party content and link its source; never paste it into prose you author. A
-  vendored mirror is fetched bytes rather than authored prose, and `.claude/rules/documentation.md`
-  governs it.
+- Claim only what the reader can check. Never `ensure`, `guarantee`, a superlative, or an effort adjective as a claim about behavior; cite the run behind every number.
+- Present tense for what exists. Never `currently`, `now`, `new`, `latest`, or `soon`; give a version or a date.
+- Recommend one path. Rule on every option you list.
+
+## Tokens, references, links
+
+- Put a code token in backticks and follow it with a noun. Never inflect or pluralize a code token or use it as a verb.
+- Point with `preceding`, `following`, `earlier`, or `later`, never `above` or `below`.
+- Link text is the destination's title or a descriptive phrase, introduced by `see`. No `here`, no bare URL in prose.
+- Paraphrase third-party content and link it. A vendored mirror is fetched bytes and is exempt.
 
 ## Structure
 
-- Keep a required fact in the main flow. A note or a notice carries only what the reader can skip,
-  never a prerequisite, a step, or a warning the task depends on.
-- In a reply or a guide, introduce every list, table, and code fence with a complete sentence naming
-  what follows; a rule file's list sits bare under its heading. Number a list only where order or
-  rank matters. Use a table only for rows with comparable fields.
-- Write a heading in sentence case, verb first for a task and a noun phrase for a concept. Identity
-  numbering — a claim, an audit verdict, a plan unit — is data rather than a heading style, and
-  stays.
-
-## Examples, numbers, and abbreviations
-
-- Build an example from fictional data with descriptive names and no personally identifiable
-  information. Write a placeholder in `UPPER_SNAKE_CASE` and explain it on first use. Never write
-  `foo`, `bar`, or `baz`.
-- Expand an abbreviation the reader may not know on first use, with the short form in parentheses.
-  Skip the expansion for one this audience reads daily, such as `API`, `CLI`, `JSON`, `URL`, or a
-  file format.
-- Write a numeral for a technical quantity, a version, or a measurement. Write a date as
-  `YYYY-MM-DD` in evidence, commit messages, and reports. See `AGENTS.md` § Writing for what
-  separates a value from a count.
-- Use the serial comma. Mark omitted code with a comment in the sample's language, never with `...`.
+- Keep a required fact in the main flow; a note carries only what the reader can skip.
+- In a reply or a guide, introduce every list, table, and fence with a sentence. A rule file's list sits bare under its heading. Number a list only where order matters.
+- Headings in sentence case: verb first for a task, noun phrase for a concept.
+
+## Examples, numbers, abbreviations
+
+- Build examples from fictional descriptive data; placeholders in `UPPER_SNAKE_CASE`, explained on first use. Never `foo`, `bar`, or `baz`.
+- Expand an abbreviation the reader may not know on first use; skip `API`, `CLI`, `JSON`, `URL`, and file formats.
+- Numerals for technical quantities, versions, and measurements. Dates as `YYYY-MM-DD`. Serial comma. Mark omitted code with a comment in the sample's language.
+
+## Code comments
+
+- A comment states why, never what the code shows. Delete a comment that restates the line. Do not narrate history, alternatives tried, or a probe's result.
+- Write TSDoc only where `.claude/rules/typescript.md` requires it, in its prescribed shape, and no longer than the contract needs.
+
+## Instruction files
+
+`AGENTS.md`, `.claude/rules/*`, `.agents/*`, `.claude/agents/*`, `.codex/agents/*`, `.cursor/rules/*`, and every skill are executed by an agent mid-task.
+
+- Write every line as a directive: what to do, what to check, or what to refuse. Delete a line that does none of those.
+- Name the trigger and the action: "When X, do Y".
+- State the finding as the rule. Never record how it was found, which session found it, or what was tried first; that belongs in the commit message.
+- Cut every clause that persuades, reassures, or explains to a person.
+- Give a rule one home. Point at it from elsewhere; never restate it.
+- Keep an example only when it disambiguates the rule.
+- Keep `AGENTS.md` under 200 lines and the always-loaded set small; move a procedure into a skill and scope a rule with `paths`.
 
 ## Substitutions
 
-Replace each term in this table with its replacement. A literal code identifier is data, and so is
-a sample string inside a code fence or a test fixture: quote each as itself, exempt from every row.
+Replace each term with its replacement. A code identifier and a string inside a fence or a fixture are data and exempt.
 
 | Term                               | Replacement                                  |
 | ---------------------------------- | -------------------------------------------- |
@@ -108,35 +85,7 @@ a sample string inside a code fence or a test fixture: quote each as itself, exe
 | `blacklist`, `whitelist`           | `denylist`, `allowlist`                      |
 | `master`, `slave`                  | `primary`, `replica`                         |
 
-- Register each lexical prohibition in the substitution table. Where its application depends on the
-  sense rather than the match, register it in the judged set and rule each hit.
-- `policy/no-banned-term` reads every comment and the prose sweep in `tests/setupPolicy.ts` reads
-  every authored Markdown file, and each matches the rows this table bans unconditionally. The rule
-  and the sweep leave `now`, `new`, `latest`, `once`, `since`, `above`, `below`, and `master`
-  unmatched because those rows carry a permitted sense, so rule a hit in one of those rows yourself.
-- Sweep case-insensitively and across inflections when checking prose against the preceding table. A
-  pattern for `easy` reaches neither `Easy` nor `easier`, and a temporal `once` most often appears
-  as a sentence-initial `Once`.
-- Rule every hit by the sense its row bans, not by the match. `once` counts as often as it means
-  `after`, and `new` names a value as often as it dates one. Record a hit in a permitted sense as
-  permitted rather than dropping it.
-- Name the pattern and the paths behind every sweep result, including a clean one. A result naming
-  neither reports on the population its pattern admitted rather than on the population it was drawn
-  from.
+- `policy/no-banned-term` reads comments and the prose sweep in `tests/setupPolicy.ts` reads authored Markdown; each matches the rows banned unconditionally. Rule a hit in `now`, `new`, `latest`, `once`, `since`, `above`, `below`, or `master` yourself by the banned sense.
+- Sweep case-insensitively and across inflections. Name the pattern and the paths behind every sweep result.
 - Write singular `they` for a person of unstated gender.
-- This table carries no row for `execute`, `abort`, `kill`, `terminate`, or `run`:
-  `.claude/rules/names.md` § Fixed lifecycle vocabulary owns those words, and no row here overrides
-  it.
-
-## Not adopted
-
-- Do not add conversational personality, warmth, or memorability to a reply; the prose stays plain.
-- Do not import a license to break these rules where a departure reads better; an exception exists
-  only where a rule states it.
-- `We recommend` as a recommendation form — refused in § Voice and actor.
-- Do not apply a source guide's sample indentation or line-length chrome; the repository formatter
-  and `.claude/rules/typescript.md` decide code presentation.
-- Do not write an unspaced em dash; this project spaces it.
-- Do not cap a sentence at a word count; `AGENTS.md` § Writing owns sentence length.
-- Do not treat an external word list as vocabulary law; the preceding substitution table is the
-  adopted set.
+- `.claude/rules/names.md` § Fixed lifecycle vocabulary owns `execute`, `abort`, `kill`, `terminate`, and `run`.

package/dist/host/claude/settings.json

@@ -10,7 +10,6 @@
 			"Bash(codex login status)",
 			"Bash(codex exec *)",
 			"Bash(agent.cmd --version)",
-			"Bash(codex mcp-server)",
 			"Bash(agent --version)",
 			"Bash(agent -p *)",
 			"Bash(claude --version)",
@@ -239,8 +238,6 @@
 			"Bash(cmd /c fc *)",
 			"Bash(cmd /c tree)",
 			"Bash(cmd /c tree *)",
-			"mcp__codex__codex",
-			"mcp__codex__codex-reply",
 			"mcp__webstorm__read_file",
 			"mcp__webstorm__search_regex",
 			"mcp__webstorm__search_text",
@@ -989,6 +986,11 @@
 						"type": "command",
 						"command": "\"$CLAUDE_PROJECT_DIR\"/scripts/codex.sh",
 						"timeout": 120
+					},
+					{
+						"type": "command",
+						"command": "cd \"$CLAUDE_PROJECT_DIR\" && [ -f .agents/skills/orkestrel-dispatch/scripts/sweep.ts ] && node .agents/skills/orkestrel-dispatch/scripts/sweep.ts --report || true",
+						"timeout": 30
 					}
 				]
 			}

package/dist/host/claude/skills/enterprise-bootstrap/SKILL.md

@@ -11,7 +11,7 @@ description: >-
   scales, or must look professional rather than like stock Bootstrap. Covers
   aesthetics, typography, color modes, design tokens, elevation, finishing
   details, accessibility (WCAG 2.2 AA), responsive layout, and enterprise app
-  patterns. The `orkestrel-polish-surface` skill owns a requested verdict,
+  patterns. The `orkestrel-polish` skill owns a requested verdict,
   round, or campaign over a surface that already renders, including a review
   that changes nothing; in that campaign's fix units, use this skill for
   Bootstrap craft.

package/dist/host/claude/skills/{orkestrel-align-packages → orkestrel-align}/SKILL.md

@@ -1,10 +1,10 @@
 ---
-name: orkestrel-align-packages
+name: orkestrel-align
 description: Audit and improve how two or more Orkestrel packages, or their core, server, browser, and app environments, fit together. Use for coordinated package-stack refactors, cross-package extraction, developer-ergonomics reviews, end-to-end or live integration testing, dependency and guide alignment, and fleet/package-manager campaigns. Preserve host-independent core boundaries, update dependents topologically, and use the package-hardening workflow for each implementation unit.
 ---
 
 # Load the canonical workflow
 
-Read `.agents/skills/orkestrel-align-packages/SKILL.md` completely, then read every reference it requires. Follow that canonical workflow before acting.
+Read `.agents/skills/orkestrel-align/SKILL.md` completely, then read every reference it requires. Follow that canonical workflow before acting.
 
 This bridge contains no independent process. `AGENTS.md`, applicable rules, the canonical skill, and the governing guide/spec remain authoritative in that order.

package/dist/host/claude/skills/{orkestrel-build-application → orkestrel-build}/SKILL.md

@@ -1,11 +1,11 @@
 ---
-name: orkestrel-build-application
+name: orkestrel-build
 description: Wire, extend, or harden Orkestrel `app/core`, `app/browser`, and `app/server` environments — the environment's contracts, boundaries, entries, and host proofs, never the product designed inside one. Use for app-only or mixed src/app workspaces, app environment isolation, Vue browser entries, Node server entries, app aliases, configs, scripts, and tests, cross-environment contracts, and application guide parity. Do not use it to redesign an application's routes, screens, or domain behavior; take that to a design round and return here to wire what it decides.
 ---
 
 # Load the canonical workflow
 
-Read `.agents/skills/orkestrel-build-application/SKILL.md` completely, then read
+Read `.agents/skills/orkestrel-build/SKILL.md` completely, then read
 every reference it requires. Follow that canonical workflow before acting.
 
 This bridge contains no independent process. `AGENTS.md`, applicable rules, the

package/dist/host/claude/skills/orkestrel-dispatch/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: orkestrel-dispatch
+description: >-
+  Dispatch one unit of work to a native subagent or an external bench and bring its result back: write the brief, probe the bench, launch under a cap, watch liveness, read the report, check its citations, accept, and delete the launch copies. Use when `.agents/orchestration.md` routes work to a role, when a bench lane (Grok, Astra, or Opus through the Claude CLI) is needed, or when a command will outlive the turn that starts it.
+---
+
+# Load the canonical workflow
+
+Read `.agents/skills/orkestrel-dispatch/SKILL.md` completely, then read every reference it requires. Follow that canonical workflow before acting.
+
+This bridge contains no independent process. `AGENTS.md`, applicable rules, the canonical skill, and the governing guide/spec remain authoritative in that order.

package/dist/host/claude/skills/orkestrel-falsify/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: orkestrel-falsify
-description: Run an adversarial audit round against work that already looks finished — write the subject as numbered falsifiable claims, dispatch independent auditors instructed to break them rather than confirm them, reconcile their evidence, and rule. Use before accepting a fix round, before a version bump or publication, when green gates are the only evidence a change works, when a defect has recurred across rounds, or whenever a review would otherwise read a diff and agree with it.
+description: >-
+  Run one adversarial audit round against finished work: write the subject as numbered falsifiable claims, dispatch independent auditors instructed to break them, reconcile their evidence, and rule. Use when the size gate in `.agents/orchestration.md` names a review, before a fix round is accepted, before a version bump or publication, or when a defect has recurred across rounds. Do not use it for a small change, a mechanical rename, or a round with no added or repaired claim to attack.
 ---
 
 # Load the canonical workflow

package/dist/host/claude/skills/{orkestrel-harden-package → orkestrel-harden}/SKILL.md

@@ -1,10 +1,10 @@
 ---
-name: orkestrel-harden-package
+name: orkestrel-harden
 description: Research, audit, refactor, implement, centralize, test, document, and locally verify an individual Orkestrel TypeScript package to enterprise-grade production readiness under the repository's current AGENTS.md. Use when asked to fill missing or deferred capabilities, compare upstream or legacy implementations, salvage prior art, centralize source or test declarations, eliminate nested functions or superfluous wrappers, maximize declared @orkestrel dependencies—especially @orkestrel/contract—or add rigorous real-implementation and live-service tests. Select only the phases required by a narrow request; run the full workflow for production readiness or comprehensive hardening.
 ---
 
 # Load the canonical workflow
 
-Read `.agents/skills/orkestrel-harden-package/SKILL.md` completely, then read every reference it requires for the selected work lane. Follow that canonical workflow before acting.
+Read `.agents/skills/orkestrel-harden/SKILL.md` completely, then read every reference it requires for the selected work lane. Follow that canonical workflow before acting.
 
 This bridge contains no independent process. `AGENTS.md`, applicable rules, the canonical skill, and the governing guide/spec remain authoritative in that order.

package/dist/host/claude/skills/{orkestrel-prove-journey → orkestrel-journey}/SKILL.md

@@ -1,10 +1,10 @@
 ---
-name: orkestrel-prove-journey
+name: orkestrel-journey
 description: Prove a browser application the way a person uses it — real keystrokes, clicks, and Tab/Enter against only what is visible and reachable — through the journey layer @orkestrel/test/browser publishes, and generate the capture portfolio, the resolved-style matrix, and the statechart outcome from those same journeys. Use when accepting a UI build, proving an application end to end, deciding whether a surface is reachable by keyboard alone, proving what a screen refuses as well as what it does, proving the styles a browser actually resolved under each theme and viewport, driving a transition table through the interface and watching it run, auditing whether the interface speaks the user's vocabulary rather than the engine's, producing the screenshots a design review judges, routing a rendered question to an artifact a model can read, or whenever the only evidence a screen works is a test that drove it through JavaScript instead of through the interface.
 ---
 
 # Load the canonical workflow
 
-Read `.agents/skills/orkestrel-prove-journey/SKILL.md` completely, then read every reference it requires. Follow that canonical workflow before acting.
+Read `.agents/skills/orkestrel-journey/SKILL.md` completely, then read every reference it requires. Follow that canonical workflow before acting.
 
 This bridge contains no independent process. `AGENTS.md`, applicable rules, the canonical skill, and the governing guide/spec remain authoritative in that order.

package/dist/host/claude/skills/orkestrel-polish/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: orkestrel-polish
+description: Drive a rendered or externally driven surface to shipped quality through one capture-evidence verdict round and its fix units. Use when asked to polish an interface, bring a rendered surface to enterprise grade, judge what actually renders rather than what the source claims, or reconcile design, state-truth, and inventory findings into fix units on captured proof. Run a verdict alone for a narrow request; run the round with its fix units for a polish or production-readiness request.
+---
+
+# Load the canonical workflow
+
+Read `.agents/skills/orkestrel-polish/SKILL.md` completely, then read every
+reference it requires. Follow that canonical workflow before acting.
+
+This bridge contains no independent process. `AGENTS.md`, applicable rules, the
+canonical skill, and the governing guide/spec remain authoritative in that order.

package/dist/host/claude/skills/orkestrel-scout/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: orkestrel-scout
+description: >-
+  Map terrain mechanically before anyone reads it: file trees with line counts, Markdown headings, export lines, a term census, the files that name a path, and unresolved `§` cross-references, written once and handed to the lane that reads. Use before writing a brief, before a Grok absorption lane, before a rename or a sweep, when a dispatch names the `scout` role, or whenever a question is "where is", "how big is", "what names this", or "which files carry this term".
+---
+
+# Load the canonical workflow
+
+Read `.agents/skills/orkestrel-scout/SKILL.md` completely and run the script it names. Follow that canonical workflow before acting.
+
+This bridge contains no independent process. `AGENTS.md`, applicable rules, the canonical skill, and the governing guide/spec remain authoritative in that order.

package/dist/host/codex/agents/analyst.toml

@@ -1,40 +1,23 @@
 name = "analyst"
-description = "Read-only GPT-6 Astra objective analysis, correctness audit, and constraint review."
+description = "Read-only GPT-6 Astra objective design argument, diagnosis, and correctness audit against numbered claims."
 model = "gpt-6-astra"
 model_reasoning_effort = "high"
 sandbox_mode = "read-only"
 developer_instructions = """
-Read .agents/orchestration.md first. It owns the role set, the routing, and the
-dispatch contract.
+Read the brief, AGENTS.md, the .claude/rules files whose paths match the subject, the named skill,
+and the guide. Read the actual diff and status the dispatch supplies; return a deviation if they
+are missing.
 
-Read AGENTS.md, applicable rules, the dispatch-named skill and references, the
-governing guide/spec, and the exact scope. For design, take the same brief as Opus
-independently and argue what contracts, evidence, and constraints permit.
+Hold the lane the dispatch names and say which: objective (correctness under adverse orderings,
+what the contracts and installed declarations permit, dependency and range truth, test
+sufficiency, the letter of the rules) or subjective (shape, naming, ergonomics, design fit).
 
-You hold the objective lane by default. The dispatch may assign you the subjective lane
-instead — shape, taste, naming, ergonomics, and design fit — whenever the round needs an
-engine that is not the one running that lane, including when the Claude CLI is dark and
-when Opus 5.5 wrote the work under audit. Hold whichever perspective the dispatch names, in
-full, and say which one you held. Do not drift back to the objective case because it is
-your usual one.
+Attack each numbered claim with a concrete input, state, or interleaving. Before confirming a
+claim about a proof, name the mutation that would make the proof fail and whether the assertions
+distinguish it. Rule a claim whose only evidence is the writer's report UNRESOLVED. Mark a
+rendered-surface claim the capture cannot show NOT-EVIDENCED.
 
-For audit,
-read the actual diff and examine correctness, security, concurrency, failure modes,
-dependency reuse, boundary behavior, tests, cleanup, and guide parity. Require
-file:line evidence and drop unsupported claims. When the brief states its subject as
-numbered falsifiable claims, attempt refutation rather than confirmation and return
-each claim per the Falsification section of .claude/rules/quality.md. The verdict
-shape defaults to orkestrel-falsify; a dispatch may name a different skill that fixes
-another. That skill owns the value set and the terminal line — it may carry values
-beyond CONFIRMED and BROKEN, and a claim you cannot decide belongs in the one it
-provides rather than being forced into BROKEN. For a rendered or externally driven
-surface, the supplied capture portfolio is primary evidence and source is
-corroboration; mark a claim the portfolio cannot show NOT-EVIDENCED rather than
-inferring it from source. Never edit, implement, reconcile, accept, or spawn. Return
-only the objective argument or PASS/FAIL audit, blockers, advisories, and criterion
-confirmations.
-
-Your sandbox is read-only: you never edit a file and never write your report to a file.
-Your final message IS the verdict. A dispatch that names a report path for you is a
-dispatch defect — return the verdict as your final message and name the defect in it.
+Return the orkestrel-falsify verdict shape: numbered verdicts with evidence, findings outside the
+claims, attacked-and-held, one terminal line. Never edit, implement, reconcile, accept, or spawn.
+Your final message is the verdict.
 """

package/dist/host/codex/agents/astra.toml

@@ -0,0 +1,25 @@
+name = "astra"
+description = "GPT-6 Astra implementation of one bounded, objective, constraint-heavy unit as the sole writer in its checkout."
+model = "gpt-6-astra"
+model_reasoning_effort = "high"
+sandbox_mode = "workspace-write"
+developer_instructions = """
+Implement one dispatched unit and spawn nothing.
+
+Read the brief, AGENTS.md, the .claude/rules files whose paths match the owned files, the named
+skill, and the guide. Follow AGENTS.md § Work loop: types first, prove the claim with the prove
+tool, implement, test, consolidate, document. For a defect, record the failing command and count
+before the fix and the same command green after.
+
+Write only the owned files; return an exact patch for a shared file. Validate read-only and scoped:
+the touched project's check: script, the touched test file, then the touched project. Never run
+format, lint --fix, build, or the whole suite. Delete every probe before returning; promote a
+probe that settled a claim into a test.
+
+Never add a dependency, suppress a diagnostic, mock project-owned behavior, leave a TODO in scope,
+commit, push, install, read a secret, or run a destructive command. Stop only per
+.agents/orchestration.md § Deviation protocol.
+
+Return touched files with one line each, diffstat, scoped validation results, the prove closing
+line per claim, failing-first test names, shared-file patches, deviation state. No process diary.
+"""

package/dist/host/codex/agents/builder.toml

@@ -1,28 +1,21 @@
 name = "builder"
-description = "Terra executor for one small, fully specified, taste-free unit; follows the orchestration contract deviation protocol."
-model = "gpt-5.6-terra"
+description = "Sol executor for one small, fully specified, taste-free unit in src, app, tests, or configs; writes only owned files as the sole writer in its checkout and validates scoped to them."
+model = "gpt-6-sol"
 model_reasoning_effort = "low"
 sandbox_mode = "workspace-write"
 developer_instructions = """
-Read .agents/orchestration.md first. It owns the role set, the routing, and the
-dispatch contract.
+Implement one fully specified unit. The dispatch is the plan; do not re-plan.
 
-Accept work only when owned files, the transformation, and mechanical acceptance
-criteria are complete enough that correct implementations cannot differ meaningfully.
-A unit whose naming, API shape, architecture, or house taste is still open belongs to
-sol or opus: stop and say so.
+Read the brief, the .claude/rules files whose paths match your owned files, and the guide it names.
+Write only the owned files; return an exact patch for a shared file. Follow AGENTS.md § Work loop
+for a small change: edit, prove or test the claim, run the touched test file, then the touched
+project if the brief names it. Validate read-only and scoped: a non-fix lint on your paths, the
+scoped check: script, the touched tests; never run format, lint --fix, build, or the whole suite. Delete any probe you wrote before returning.
 
-Read AGENTS.md, applicable .claude/rules files, the dispatch-named skill and required
-references, and the governing guide/spec before writing; they bind as written there and
-are not restated here. An app-layer unit belongs to application: stop and say so.
-Execute the supplied plan exactly, in owned files only; shared and off-limits files are
-report-only and return as exact patches. The AGENTS.md non-negotiables own what you may
-not add: read the prohibitions there and apply them exactly. Never install, commit,
-push, publish, read credentials, run a destructive command, or run a tree-wide mutating
-command. Validate only the owned scope.
+A unit whose naming, API shape, or architecture is still open belongs to astra or opus: stop and
+say so. Never install, commit, push, read a secret, or run a destructive command. Stop and report
+per .agents/orchestration.md § Deviation protocol on any conflict with the brief.
 
-Follow .agents/orchestration.md § Deviation protocol. Otherwise return changes, actual
-scoped validation, and exact shared-file patches. Never re-plan, investigate beyond
-scope, or spawn another agent.
-The result is an untrusted proposal requiring independent checker and reviewer passes.
+Return changed files with one line each, the scoped commands run and their results, shared-file
+patches, and any deviation report. No process diary. Never spawn another agent.
 """