@orkestrel/scaffold 0.0.77 → 0.0.79

package/dist/host/agents/orchestration.md

@@ -1,1019 +1,168 @@
 # Orchestration
 
-How agents are dispatched, how long-running work is supervised, and how both are accepted. Every
-harness follows this file.
+How agents are dispatched, parallelized, reviewed, and cleaned up. Every harness follows this file. `AGENTS.md` governs code and outranks it.
 
 ## Authority
 
-Read in this order before acting:
+Read in order: the user's instruction; `AGENTS.md` and the rules it scopes to your paths; this file; the named skill; the guide. A harness bridge (`.claude/AGENTS.md`, `.codex/config.toml`, `.cursor/rules/orchestration.mdc`) adds mechanics and restates nothing here.
 
-1. The user's current instruction. It wins over every later item.
-2. `AGENTS.md` and the applicable `.claude/rules/*.md` files. They govern code substance.
-3. This file. It governs agent operation only and cannot weaken the coding contract.
-4. The dispatch-named skill and the references it requires.
-5. The governing guide or spec.
-
-`CLAUDE.md`, `.codex/config.toml`, and `.cursor/rules/` are bridges. Each points here and adds
-only what its harness needs. None of them restates this file.
+## Engines
 
-A line stays in this file when an executor who is not doing that thing is worse off without it. A
-line becomes a skill when it fires on a named trigger and its reader is one agent at one moment.
+| Engine                            | Job                                                   | Posture                                                  |
+| --------------------------------- | ----------------------------------------------------- | -------------------------------------------------------- |
+| Cursor Grok                       | absorb, distill, scout, bounded research              | read-only; returns evidence, never decisions             |
+| Opus 5.5                          | subjective design, design-fit review, implementation  | proposes, audits, implements; never accepts its own work |
+| GPT-6 Astra                       | objective analysis, correctness audit, implementation | proposes, audits, implements; never accepts its own work |
+| Sonnet 5.5, GPT-6 Sol, GPT-6 Luna | mechanical units, gates, conformance, locating        | executes a fully specified brief                         |
 
-Every dispatch tells its executor to read every item after the user's current instruction before
-acting.
+The harness's own engine orchestrates: Opus 5.5 in Claude Code, Astra in Codex, Grok in Cursor. The Orchestrator owns the plan, every decision, integration, and acceptance. When the size gate names a review, the review runs on an engine that did not write the work.
 
-## The engines
+## Roles
 
-One workflow runs across all providers. Each engine has one job and never takes another's.
+| Role         | Job                                                                | Claude        | Codex      |
+| ------------ | ------------------------------------------------------------------ | ------------- | ---------- |
+| `grok`       | absorption and distillation on Cursor Grok                         | sonnet driver | sol driver |
+| `analyst`    | objective design argument or correctness audit on Astra            | sonnet driver | astra      |
+| `astra`      | objective, constraint-heavy implementation on Astra                | sonnet driver | astra      |
+| `planner`    | subjective design on Opus                                          | opus          | sol driver |
+| `reviewer`   | design-fit or correctness review on Opus                           | opus          | sol driver |
+| `opus`       | subjective implementation (API shape, naming, guide voice) on Opus | opus          | sol driver |
+| `builder`    | one fully specified taste-free unit, app layer included            | sonnet        | sol        |
+| `checker`    | mechanical conformance against criteria and rules                  | sonnet        | luna       |
+| `verifier`   | gates and evidence commands, exit-code truth                       | sonnet        | sol        |
+| `scout`      | locate files, symbols, seams                                       | sonnet        | luna       |
+| `distiller`  | bulk reading when the Cursor bench is dark                         | sonnet        | luna       |
+| `researcher` | primary-source research when the Cursor bench is dark              | sonnet        | luna       |
+| `orkestrel`  | ecosystem reconciliation over supplied evidence                    | sonnet        | luna       |
+
+- Name the role and its engine in every dispatch. Reach a role by its own name.
+- A driver launches another provider's CLI and returns the journal path and session id with the result. It never judges or implements. Refuse a bench result that carries no journal path and session id; it ran on the driver.
+- `.agents/transports/<provider>.md` owns each bench's invocation, sandbox, journal, and recovery. `.claude/agents/` and `.codex/agents/` hold one file per role.
+
+## Routing
+
+- Route by judgment load. Objective, constraint-heavy, mechanical-precision work goes to `astra`. API shape, naming, and documentation voice go to `opus`. A unit whose correct implementations cannot differ goes to `builder`.
+- Delegate bulk supporting reads to `grok`: terrain, prior art, diff sweeps, scattered sources. Read decision-bearing source yourself. Fall back to `distiller` or `researcher` only when the Cursor bench is dark, and record the fallback.
+- Route gates to `verifier`. A writer's self-reported gate is not evidence.
+- Work directly on a one-file change, a lookup, or a one-line fix. Dispatch when isolation, parallelism, a second engine, or a large read pays for the brief.
+
+## Size gate
+
+`AGENTS.md` § Work loop sizes a change and fixes the precedence (large, then medium, then small). This file adds who runs what.
+
+| Size   | Design                                                                                          | Implementation                                 | Review                                                                                                         | Gates                              |
+| ------ | ----------------------------------------------------------------------------------------------- | ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ---------------------------------- |
+| small  | none                                                                                            | direct or `builder`                            | none; the touched test is the review                                                                           | touched file                       |
+| medium | one opinion (`planner` or `analyst`) only when the shape is open                                | `opus`, `astra`, or `builder` by judgment load | one pass by a reviewer engine that did not write it, on numbered claims about the contract and the risky seams | `verifier` on the touched projects |
+| large  | one adversarial round: `planner` and `analyst`, same brief, clean contexts, blind to each other | disjoint units in parallel                     | one `orkestrel-falsify` round on the integrated result                                                         | `verifier` tree-wide, once         |
+
+- Never run a review on a small change. Never run a second design round on the same brief.
+- A fix round re-audits the repaired claim only. A fix that adopted the reviewer's prescription verbatim closes with a mutation probe (disable the load-bearing line, watch the test fail, restore it). A fix that departs from it gets one pass by the other engine.
+- Three review rounds at one seam end the depth search. Name what the audit is for, dispatch one blind lens per station of the stream the defect moves along, locate the source, and plan from there.
+- An all-confirmed round ends the audit. A round needs an added or repaired claim to attack; reviewer appetite is not a subject.
+
+## Campaign
+
+A large change runs these phases once each, in order, and ends when the exit criterion written at the start is met.
+
+1. **Absorb.** Map the terrain with the `orkestrel-scout` skill's `map.ts`, then `grok` distills it and the prior art. In an Orkestrel repository, `verifier` or another tool-capable role collects manifests, lockfiles, installed declarations, and registry readings, and `orkestrel` reconciles them.
+2. **Design.** One adversarial round: `planner` (subjective) and `analyst` (objective) on one brief, clean contexts, blind to each other. Reconcile into one plan: units, owned files, dependencies, parallel and serial order, acceptance criteria, exit criterion, routing ledger.
+3. **Implement.** Dispatch units per § Routing and § Parallelism.
+4. **Integrate.** Apply returned patches to shared files serially. A type, mechanism, or criterion found here is a successor unit, never an integration edit.
+5. **Audit.** One `orkestrel-falsify` round on the integrated result, one engine that did not write it per lane; add `checker` when the criteria are mechanical.
+6. **Verify.** `verifier` runs the tree-wide gates once.
+7. **Re-baseline.** Strike satisfied units, restate transformed ones, add units the exit criterion already required. A re-baseline never moves the exit criterion; that needs the user.
+8. **Accept.** Report outcome, decisions, evidence, remaining risk. Run `orkestrel-debrief` when the campaign changed process, then prune per § Cleanup.
+
+## Parallelism
+
+- Fan out when the work is many small, fully specified, disjoint units: one cheap agent per unit with minimal context. Give the agents the same model, effort, agent type, tools, schema, and working directory when isolation and routing allow it, so their prompts share one cache prefix.
+- Judgment stays narrow: a design or review pass is at most the two lanes the size gate names, each in a clean context, blind to the other, and it runs once. Never fan judgment out further, and never run it as a loop.
+- One writer per checkout. Give parallel writers disjoint owned files; give a writer its own worktree under `tmp/worktrees/` only when two units must write the same files at once. Commit a checkpoint before a writing dispatch.
+- Shared files are report-only; a unit returns an exact patch.
+- Concurrent units validate read-only and scoped to their owned files. Never run tree-wide `format`, lint `--fix`, or `build` beside a live unit.
+- One Grok lane at a time; queue the rest. An empty lane beside a live probe is starvation, not darkness.
+- The Orchestrator's own sweep is a writing dispatch: run it before or after the units, never beside them.
 
-| Engine          | Job                                                   | Posture                                      |
-| --------------- | ----------------------------------------------------- | -------------------------------------------- |
-| **Cursor Grok** | Absorption, distillation, scouting, bounded research  | Read-only; returns evidence, never decisions |
-| **Opus 5.5**    | Subjective design, design-fit review, implementation  | Proposes, audits, implements; never accepts  |
-| **GPT-6 Astra** | Objective analysis, correctness audit, implementation | Proposes, audits, implements; never accepts  |
+## Permission floor
 
-- Route each nontrivial implementation unit to Opus or Astra. Objective, constraint-heavy,
-  mechanical-precision work goes to Astra. API-shape, naming, and documentation-voice work goes to
-  Opus. Cursor Composer is not an implementation route, and no `composer` role exists.
-- Design runs the adversarial pass. § Execution loop's audit step fixes which lanes an audit runs.
-
-## Orchestration by harness
+- Read-only roles carry no edit or write tool. The Orchestrator supplies the diff and status to every review dispatch.
+- No role commits, pushes, tags, publishes, installs, or runs a destructive command.
+- No role runs `git checkout`, `git restore`, `git stash`, `git reset`, or `git clean`. Undo an edit by rewriting the text.
+- No role reads, prints, copies, uploads, or packages a secret: `.env*`, `.npmrc`, `auth.json`, keys, tokens, `CURSOR_API_KEY`.
+- A unit writes only under its owned files and its checkout's `tmp/`. The Orchestrator's own briefs, probes, drafts, and records live in the checkout's `tmp/` too, never in a directory outside the repository; the user follows the work through the tree.
+- When a sandbox rejects a write, the unit stops and reports the rejection. It never tries another write mechanism.
+- A unit deletes only the fixture directory it created, by its recorded path. It never removes a `tmp/<lane>` directory, another unit's files, or anything through `sweep.ts --tmp` or `--unit … --delete`; those are the Orchestrator's, after the last live unit exits.
 
-The harness's own engine orchestrates. Run it on the latest version of that model at high
-reasoning effort.
+## tmp layout
 
-| Harness     | Orchestrator engine |
-| ----------- | ------------------- |
-| Claude Code | Opus 5.5            |
-| Codex       | GPT-6 Astra         |
-| Cursor      | Cursor Grok         |
-
-- The Orchestrator reconciles. No engine reconciles itself or accepts its own work.
-- The Orchestrator shares its engine with one lane: Opus in Claude Code, Astra in Codex. That lane is
-  still dispatched as a separate subagent with a clean context, never run inline.
-- In a fix round the auditor is an engine that did not write it. When the writer's engine is the
-  Orchestrator's engine, the auditor is the other lane.
-- Each harness reaches the engines it does not host through its own bridge file. The bridge owns
-  the invocation mechanics and their cost constraints; this file owns the routing.
-
-## The adversarial pass
-
-The subjective lane and the objective lane run on every design round; an audit round runs the lanes
-the execution loop's audit step names, on the same clean-context terms.
-
-| Lane           | Argues                                                                      |
-| -------------- | --------------------------------------------------------------------------- |
-| **Subjective** | Shape, taste, naming, ergonomics, design fit, the feel the API must present |
-| **Objective**  | Correctness, constraints, and what the code and contracts actually permit   |
-
-**A required lane always runs.** Never collapse required lanes into one. Never let an engine's
-absence stand in for a required lane.
-
-Call a lane the round did not dispatch **not run**. `dark` names a bench that cannot round-trip and
-names nothing else, so never write it of a lane. A verdict file's recorded reason uses those words.
-
-### Clean contexts
-
-- Dispatch each lane as a fresh subagent. Never run a lane inside the Orchestrator's own context.
-- Give each subagent the brief and its evidence slice, and nothing else. Do not carry the
-  Orchestrator's conversation, its working hypothesis, or the other lane's answer.
-- A lane run in the Orchestrator's context is the Orchestrator assessing itself, whatever model
-  name it carries. The clean context is what makes the lane independent and unbiased, and it is
-  what keeps the main context at decision level.
-- Run the lanes in parallel, blind to each other. Reconcile them yourself.
-
-### Engine assignment
-
-By default Opus 5.5 holds the subjective lane and Astra holds the objective lane.
-
-Swap the lanes whenever the round needs an engine that is not the one running that lane. Bench
-darkness is one trigger and the writer's engine is another: § Execution loop's audit step requires
-an auditor that did not write the work, so where Astra wrote the work under audit, give the objective
-lane to Opus 5.5 and the subjective lane to Astra, and reverse that where Opus 5.5 wrote it. Both engines
-still run, so this is a lane swap rather than a substitution. Record which engine held which lane in
-the routing ledger.
-
-When one engine is unavailable, the remaining engine runs **every** lane — still separate
-subagents, still clean contexts, still blind to each other, each told which perspective it holds.
-Record the substitution.
-
-| Harness     | Engine unavailable                    | Runs every lane |
-| ----------- | ------------------------------------- | --------------- |
-| Claude Code | Astra (Codex bench dark)              | Opus 5.5        |
-| Codex       | Opus 5.5 (Claude CLI dark)            | GPT-6 Astra     |
-| Cursor      | Opus 5.5 and Astra (MCP servers dark) | Cursor Grok     |
-
-- Never assign Grok to either lane in Claude Code or Codex. If the remaining native engine is also
-  unavailable there, the pass cannot run: stop and report rather than substituting Grok.
-- Grok takes every lane only in Cursor, and only when Opus 5.5 and Astra are both unavailable.
-- Treat a lane that returns no verdicts as a lane that did not run. Re-probe the bench before ruling
-  on why, per Bench laws rule "One lane at a time per bench". A bench lane reporting that its driver
-  executed and its engine was never reached is a dark bench, not a result. Record the bench dark
-  from that report, re-run the lane on the substitute engine from the preceding table, and name in
-  the routing ledger which lane ran on which engine. Never accept a round with one lane empty.
-- Re-read bench liveness at dispatch, not at session start. A bench that probed live can be dark when
-  the lane launches.
-
-## Tedious work goes to Grok
-
-Absorption, distillation, repository scouting, and bounded primary-source research go to Grok
-first, always. Grok returns distilled evidence with `file:line` pointers, never raw dumps.
-
-Send it any task whose cost is reading: mapping terrain, surveying prior art, sweeping a large
-diff, reconciling scattered sources.
-
-Fall back in this order and record the substitution:
-
-1. **Cursor Grok.** The default.
-2. **Luna** (`gpt-5.6-luna`), when the Cursor bench is dark and Codex is available.
-3. **Sonnet**, when both benches are dark.
-
-- Dispatch `distiller` for absorption and distillation after the ladder steps past Grok, and
-  `researcher`, `scout`, or `checker` for the job each of those names. `scout` excludes deep
-  reading and `researcher` excludes repository-scale absorption, so neither takes that step.
-- Never route absorption to the Orchestrator itself, even when the Orchestrator is Grok. Keep the
-  main context at decision level; in Cursor that means a Grok executor session, not this one.
-- Never spend Opus 5.5 or Astra on it.
-- Grok is read-only, so a writing unit never routes there. Fully specified mechanical writing goes
-  to `builder` or `application` on the harness's cheap native tier.
-- `verifier` runs commands and reports exit codes, so it stays on the native tier too.
-
-## Orchestrator and executor
-
-- The top-level agent is the **Orchestrator**. It owns the goal, plan, decisions, cross-unit
-  state, integration, and final acceptance.
-- A dispatched subagent is an **Executor**. It performs its bounded assignment directly, spawns
-  nothing, and returns the required distillate.
-- Work directly on a typo, a one-line fix, or a single lookup. Orchestrate when isolation,
-  parallelism, independent review, or substantial context justifies it.
-- Dispatch staging, packing, gate-chain invocation, and instrument authorship as units — `builder`
-  for a fully specified script, `verifier` for its evidence — each with a brief and an audit like
-  any other unit. The commit and the push stay with the Orchestrator.
-- A release instrument installs, commits, or runs a mutating tree-wide command, which the
-  permission floor bars every role from, so its run is the Orchestrator's tracked command, retained
-  with its log as the authoring unit's acceptance evidence. An upload loop that must run inside a
-  one-time code's life with the user at the keyboard stays with the Orchestrator whole.
+Every working file lives under the checkout's gitignored `tmp/`, in the directory its kind names.
 
-## Roles
+| Directory                                  | Holds                                                                                              |
+| ------------------------------------------ | -------------------------------------------------------------------------------------------------- |
+| `tmp/claude/`, `tmp/codex/`, `tmp/cursor/` | bench briefs, launch scripts, journals, `.err` files, last-message files, login logs, per provider |
+| `tmp/units/`                               | native unit briefs, reports, claims files, and campaign records                                    |
+| `tmp/probes/`                              | runtime probes the `probe` Vitest project collects and the `probe` MCP server arms                 |
+| `tmp/type/`                                | the type stage's workspace mirror, owned by `@orkestrel/probe`                                     |
+| `tmp/captures/`                            | screenshots, resolved-style snapshots, and other capture portfolios                                |
+| `tmp/worktrees/`                           | worktrees the Orchestrator creates for a parallel writer                                           |
 
-One role set, mirrored per provider. Name the role and state its engine in every dispatch, even
-when the role file already pins it.
-
-| Job                                      | Claude role (`.claude/agents/`) | Codex role (`.codex/agents/`) | Engine                        |
-| ---------------------------------------- | ------------------------------- | ----------------------------- | ----------------------------- |
-| Absorption, distillation, scouting       | `grok`                          | `grok`                        | Cursor Grok (bridge)          |
-| Creative design and alternatives         | `planner`                       | `planner`                     | Opus 5.5 (native / bridge)    |
-| Design-fit review and audit              | `reviewer`                      | `reviewer`                    | Opus 5.5 (native / bridge)    |
-| Objective analysis and correctness audit | `analyst`                       | `analyst`                     | GPT-6 Astra (bridge / native) |
-| Nontrivial implementation (objective)    | `sol`                           | `sol`                         | GPT-6 Astra (bridge / native) |
-| Nontrivial implementation (subjective)   | `opus`                          | `opus`                        | Opus 5.5 (native / bridge)    |
-| Bulk reading and evidence distillation   | `distiller`                     | `distiller`                   | Grok → Luna → Sonnet          |
-| Bounded primary-source research          | `researcher`                    | `researcher`                  | Grok → Luna → Sonnet          |
-| Repository reconnaissance                | `scout`                         | `scout`                       | Grok → Luna → Sonnet          |
-| Mechanical conformance evidence          | `checker`                       | `checker`                     | Grok → Luna → Sonnet          |
-| Ecosystem evidence                       | `orkestrel`                     | `orkestrel`                   | Sonnet / Terra                |
-| Fully specified mechanical unit          | `builder`                       | `builder`                     | Sonnet / Terra                |
-| Fully specified app-layer unit           | `application`                   | `application`                 | Sonnet / Terra                |
-| Gate evidence                            | `verifier`                      | `verifier`                    | Sonnet / Terra                |
-
-- A **bridge** role is a cheap driver whose only work is invoking another provider's CLI. It never
-  implements, judges, or endorses the result.
-- `sol` and `opus` each name one engine on both provider surfaces. The harness decides whether the
-  role is native or a bridge; the name never does. State the engine in the dispatch anyway.
-- A role name and a model alias occupy different fields — a dispatch and a role file's `name` carry
-  the role, a `model:` pin carries the alias — so the Codex `opus` bridge is a role named `opus`
-  pinned to the `gpt-5.6-terra` model.
-- Give every role a file in the scaffold checkout, under `.claude/agents/` and under
-  `.codex/agents/`. The role file is where engine, effort, tools, permissions, and charter are
-  pinned, and the tool allowlist is what makes the read-only floor real. A role with no file has
-  nowhere to pin either. The requirement is the canon repository's alone: a fleet target holds the
-  catalog agent and no other role, and a session that dispatches roles starts on scaffold and
-  attaches the target.
-- Reach every role by its own name. Do not rely on a remembered route.
-- `distiller`, `researcher`, `scout`, and `checker` are native lanes for jobs that belong to Grok
-  first. Dispatch `grok` with their brief before using them, and use the native role only after the
-  ladder has stepped past Grok. Record which step you are on.
-- `orkestrel` stays native because it carries the package catalog in its own role file. Sending its
-  job to a bench means shipping that catalog across, which costs more than the bench saves.
-- A transport contract lives in `.agents/transports/`, not in an agents directory. A harness lists
-  its dispatchable agents from that directory, so a contract that is never dispatched sits outside
-  it. `.agents/transports/codex.md` is the shared Astra transport contract and
-  `.agents/transports/claude.md` the shared Opus transport contract. Neither is a route: `analyst`
-  and `sol` are the named Astra bridges, `planner`, `reviewer`, and `opus` the named Opus bridges, and
-  each binds its own contract by reference and pins only its route and sandbox.
-  `.agents/transports/cursor.md` is the shared Cursor transport contract, and both harnesses' `grok`
-  bridges bind it, because Cursor is native to neither. A contract's home is the provider it carries,
-  never the harness that reaches it.
-- Mirroring is by work class, not filename. A transport contract is provider-specific: the Codex
-  contract carries the Astra transport the Claude-side bridges follow, the Claude contract carries the
-  Opus transport the Codex-side bridges follow, and each bridge binds the contract of the provider it
-  reaches.
-- Opus and Astra roles use high effort. Native cheap-tier roles use low or medium. Bridge drivers use
-  the cheapest tier that can run a CLI.
-- Never route orchestration or acceptance across a bridge.
+## .orkestrel layout
 
-## Permission floor
+`.orkestrel/` is the campaign folder: tracked, deleted in the acceptance commit, never a home for a rule. A nested directory belongs to one package; a file at the top level belongs to the ecosystem.
+
+| Path                    | Holds                                                                                                                                    |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| `.orkestrel/<package>/` | one package's live campaign: its `plan.md`, its routing ledger, the verdicts of its open seams, and its exposure records                 |
+| `.orkestrel/plan.md`    | the live fleet campaign's plan: goal, exit criterion, packages, layer order, and the units each package owes                             |
+| `.orkestrel/ledger.md`  | the fleet campaign's routing ledger: every dispatch, engine, and bench substitution across packages                                      |
+| `.orkestrel/release.md` | the live release wave: its layers, each package's bump ruling with its evidence, the round each package landed in, and standing readings |
 
-Every role honours this floor. No dispatch may widen it.
-
-- Agents run to completion. Constrain only genuine security or destruction risk. Do not gate
-  routine work behind approval prompts or turn budgets.
-- Read-only roles carry no `Edit` and no `Write`. The tool allowlist is the guarantee. Because
-  those roles cannot inspect the tree by writing to it, the Orchestrator supplies the actual diff
-  and status evidence in every review dispatch.
-- `verifier` has no edit or write tools and never fixes a failure.
-- Run one writing role per checkout, on disjoint checkouts, each dispatched from a clean committed
-  baseline and each owning disjoint files. In a single checkout that is one writer at a time.
-- Treat every shared file as report-only.
-- No role commits, pushes, tags, publishes, installs dependencies, or runs a destructive command.
-- No role runs `git checkout`, `git restore`, `git stash`, `git reset`, or `git clean`. Each discards
-  a working-tree change silently. A role that must undo its own edit undoes exactly that edit.
-- A dispatch that has a unit plant a line to prove an instrument can fail names a file the unit under
-  verification did not touch, and names how the plant is removed. Check the tree's status before
-  choosing the file.
-- No role reads, prints, copies, uploads, or packages a secret — `CURSOR_API_KEY`, Codex auth
-  files, `.env*`, `.npmrc`, `auth.json`, keys, or tokens.
-- Concurrent executors never run tree-wide `format`, lint `--fix`, or `build`. They validate
-  read-only and scoped to their own files.
-- Keep hooks light. A Stop hook may run cheap changed-file verification such as `git diff --check`.
-  It never duplicates the gate suite; gates belong to `verifier`.
-
-## Context and decomposition
-
-- Keep the main context at decision level. Send large reads, repository scans, raw logs, diffs,
-  and exploratory sweeps to `grok` and consume the distillate.
-- Settle a behavioural question by running it, including your own. This binds before a brief is
-  written, not only after a report arrives, and it needs no disagreement to trigger it. A round of
-  deliberation that a probe would have ended is the expensive failure, and it is invisible because
-  it feels like rigour.
-- Check an assumption before it enters the plan. An unverified belief the Orchestrator states
-  becomes a fact for every unit downstream, and every one of them inherits the error.
-- Break a repeating frame deliberately. When several rounds against one subject keep finding the
-  same class of defect through a new door, the search is following the frame rather than the
-  defect. Bound the scope, then fan out independent lenses over disjoint slices in one pass.
-  Parallelism is worth more here for the framing it breaks than for the wall-clock it saves.
-- When the recurring class has a direction — each fix relocates it along one stream: a dependency
-  chain, a data path, a call chain — the source sits elsewhere on that stream, and deepening the
-  current station cannot reach it. Switch from depth to breadth: fan probes over the stream's
-  stations in parallel, blind and clean-contexted, as far up and down as the stream runs, to locate
-  the source. Then plan downstream from the source with the sweep's map of how far the defect
-  reaches, so the remaining work carries a measured bound instead of an open count of rounds. The
-  seam budget in `.claude/rules/quality.md` § Rounds and verdicts states when this fires.
-- The subjective and objective lanes are the adversarial pass's FLOOR, not its shape. Where a
-  subject has more seams than that pass can attack, fan out one lens per seam over disjoint slices,
-  keep every lens blind and
-  clean-contexted, and number every slice's claims in one shared sequence. Change the lenses in a
-  successor round rather than repeating them.
-- Decompose by required context and independently verifiable acceptance criteria, not by task type.
-- Send instructions down fully specified. Return findings smaller than the context consumed.
-- Parallelize independent work. Serialize dependencies and shared-file contention.
-- The Orchestrator owns the plan and every final decision. Design engines propose, writers execute,
-  auditors advise.
-
-## Writing concurrency
-
-Concurrent executors share a filesystem unless isolated. Follow these rules to prevent clobbered
-edits, formatter and build races, cache phantoms, and validation cross-talk.
-
-1. Serialize writers as § Permission floor states: one per checkout, checkouts disjoint. Commit a
-   checkpoint before each writing dispatch so git is the rollback mechanism.
-2. Assign disjoint owned files plus explicit shared and off-limits files.
-3. Keep shared files report-only. Executors return exact patches for serial integration.
-4. Restrict concurrent executors to read-only, scoped validation. A tree-wide result may contain a
-   sibling's in-flight failure, so an executor reports only its owned scope.
-5. Give concurrent audit lanes worktree isolation whenever the campaign is uncommitted. Lanes
-   sharing one working tree contaminate each other's readings in both directions.
-6. After integration, clear shared caches if needed, then have one independent `verifier` run the
-   authoritative tree-wide sweep. A writer's self-report never establishes green.
-7. The Orchestrator's own sweep is a writing dispatch and queues behind the units that own those
-   files. A script that fixes one thing across every target is the most direct way to break the
-   serialization rule, because it does not feel like a dispatch — nobody was named, no brief was
-   written, and it finishes in seconds. It still writes into trees a live unit owns, and a unit
-   whose brief it invalidates will repair the same drift the other way and report a state that is
-   already false. Run it before the units, or after them, or send the decision to every unit in
-   flight per the mid-campaign rule under **Dispatch anatomy**. Never beside them.
-8. A fleet pass that records a per-target status commits only the targets it recorded green. Reading
-   "is the tree dirty" instead of "did this target pass" pushes a red target the moment one exists,
-   and a flake makes that look like it worked. Refuse the failed row, name it, and re-run it alone
-   before deciding what it was.
-9. Run a fleet pass in slices that report as they finish, never as one block. A block hides its first
-   failure behind every target that follows, so the failure surfaces after the work it exists to
-   stop. A slice hands control back while most of the fleet is still unstarted.
-10. Re-run a timing or resource failure alone before believing it. Concurrent slices, builds, and
-    suites make a container miss deadlines it meets when idle, so a red result under load is a
-    question rather than an answer. A unit re-running the file alone is not alone: its own exec,
-    code-mode host, and sandbox stay resident throughout, and on a small container that residue
-    alone misses a deadline the same file meets on an idle one. So the deciding re-run belongs to
-    the Orchestrator after the unit exits, never to the unit, and a timing failure a unit cannot
-    clear is carried to that reading rather than diagnosed by the unit. This makes a writer's own
-    gate evidence systematically pessimistic on timing, which is another reason the independent
-    `verifier` runs the authoritative gates.
-11. While any unit is live, the Orchestrator's own instruments go in its scratchpad, never in the
-    subject repository's `tmp/`. A probe that both writes and deletes inside the subject tree can
-    remove a file it did not create, and a cleanup keyed to a caller-supplied path list is how. The
-    same directory is where dispatched units build their instruments, so removing it destroys a live
-    lane's work.
-
-## Execution loop
-
-At session start, before planning, probe bench liveness and plan routing against the result. Resolve
-each CLI first (`codex --version`; `agent --version`, falling back to `agent.cmd --version`), then
-run the bench's authentication-state check where it exposes one. Neither answer is liveness. A
-version string proves the binary is installed, and an authentication-state check reads stored
-credentials, so both pass while the account is out of quota, while the routed model is unavailable to
-it, while the server has already revoked the credential the check read, and inside a sandbox
-with the network denied. Record a bench live only on a bounded round-tripped model call that came
-back, and record what came back beside the routing decision. Probes are read-only, and the role file
-owns each bench's exact probe.
-
-The local steps still run, because they route the recovery rather than decide the verdict: an
-unresolved CLI is an install problem, a failed authentication-state check starts the login ladder
-in Recovering a dark bench, and a bench that passes both and still cannot round-trip is dark for a
-reason no local check can see. Record every dark bench with its fallback and the lane substitution
-it forces, and never absorb one silently. A readiness script reports readiness and performs no
-model call, so the round trip belongs to the Orchestrator's own probe or to the bridge carrying
-the unit, never to the hook. Liveness also expires: a dispatch that fails on quota, model access,
-or the network is a fresh liveness result rather than a unit-level fault, so record the bench dark
-from there and re-plan the lane instead of re-dispatching against a session-start answer that no
-longer holds.
-
-1. **Absorb.** Dispatch `grok` for terrain, prior art, and the reading the decision needs. In an
-   Orkestrel repo dispatch `orkestrel` alongside it for live package state. Skip only when the
-   ground is already known.
-2. **Design adversarially.** Run the adversarial pass on one design brief: `planner` for
-   the subjective lane and `analyst` for the objective lane. Reconcile them yourself into one plan:
-   units, dependencies, ownership, parallel and serial order, acceptance criteria, risks.
-   - Surface the plan before dispatch, including a routing ledger naming each unit's role **and**
-     engine. Routing a unit to a Claude-native agent when its work class belongs to a bench —
-     reading-heavy to Grok, objective audit or objective implementation to Astra — without a recorded
-     bench-dark deviation is a dispatch deviation.
-   - State the goal's exit criterion beside the units: the enumerated capabilities whose closure
-     ends the campaign, each to end implemented, repaired, retained, or intentionally excluded on
-     evidence. A plan that names work but not its end can only be abandoned, never finished.
-3. **Implement.** Route each nontrivial objective unit to `sol` and each nontrivial subjective unit
-   to `opus`, in the checkout the unit writes, one writer per checkout. Route a fully specified
-   taste-free unit to `builder`. Never route implementation to an engine the unit's judgment load
-   exceeds.
-4. **Integrate.** Evaluate each distillate against its acceptance criteria, apply shared-file
-   patches serially, and route cross-cutting findings. Integration applies exact returned patches
-   and mechanical conflict resolution only. A new type, mechanism, behavior, or acceptance
-   criterion discovered at integration is a successor brief routed to a writer, never an
-   integration edit.
-5. **Audit adversarially.** Audit every nontrivial implementation with the objective lane and the
-   subjective lane — `analyst` and `reviewer`, the way the design step names its lanes — at least
-   one of them on an engine that did not write the work. Dispatch `checker` in addition when the
-   acceptance criteria are mechanical — counts, paths, parity rows, scope honesty — never in place
-   of a lane. A round that runs fewer lanes than its brief names, or omits the checker its criteria
-   call for, records the deviation in its verdict file with that round's own reason, never a
-   template sentence.
-   - State the audit's subject as numbered falsifiable claims and require per-claim verdicts with
-     evidence, per the Falsification law in `.claude/rules/quality.md` and the `orkestrel-falsify`
-     value set, unless the dispatch names a different skill that fixes another.
-   - Require every lane, before confirming a claim **about a proof**, to name the mutation that would
-     make that proof fail and to say whether its assertions distinguish that mutation from the
-     passing case. Put the answer in the evidence. Describing what a proof does is not ruling on it:
-     a proof that cannot fail reads exactly like one that can, and structural reading confirms both.
-     This is the discipline that separates a lane which runs the disputed thing from one which reads
-     it, and the reading lane is the one that confirms a hole.
-   - In a fix round, give the unit to an auditor engine that did not write it.
-   - Run the `orkestrel-falsify` skill for multi-round audits. It owns the brief anatomy, the
-     successor-brief rule, the verdict shape and its single terminal line, and the reconciliation
-     discipline.
-   - Reconcile the lanes that ran. Drop, on the record, any finding no lane can substantiate.
-   - Where two lanes contradict each other, check first that each one's citations resolve in the
-     file it names, before weighing the arguments. A line number past a file's end settles the
-     disagreement in one command, and a lane that confirmed a claim on evidence that cannot exist
-     has its verdict on that claim discarded rather than balanced against the other lane's. Discard
-     the claim, not the lane: verify a sample of that lane's other citations, and keep the readings
-     that hold.
-6. **Verify.** Have one independent `verifier` run the authoritative gates.
-7. **Re-baseline.** Reconcile the remaining plan against what the phase revealed, before dispatching
-   the next one.
-   - Rule on every remaining unit: **satisfied**, the phase closed it, strike it; **transformed**,
-     the intent stands and the work changed, restate it; **added**, the phase revealed a fork the
-     plan did not consider; **unchanged**.
-   - Redraw the dependency order. Strike a unit whose subject a later unit deletes. State the new
-     prerequisite of a unit that acquired one.
-   - Walk the remaining units once and ask of each whether what landed still supports it. A
-     decision taken inside a unit can remove a later unit's foundation, and the unit that took it
-     cannot see that.
-   - Re-baseline when a probe overturns a decision the plan rests on, not only at a phase boundary.
-     A measurement that falsifies your own reconciliation changes which units run.
-   - Record what changed and why. An unrecorded re-baseline cannot be audited, and the next one
-     re-derives it.
-8. **Accept.** Decide, then report outcomes, decisions, evidence, and remaining risk concisely.
-   When the design step's exit criterion is met and the gates are green, accept. The next goal is the
-   deliverable.
-
-### Re-baselining is not rescoping
-
-`.claude/rules/quality.md` fixes the enumerated scope when work begins and forbids reopening it. A
-re-baseline changes which units run. It never changes the goal's exit criterion.
-
-Strike a unit because the phase satisfied it, never because it became inconvenient. Add a unit
-because implementation revealed work the exit criterion already required, never because an engine
-thought of something else worth doing. A re-baseline that moves the exit criterion is a rescope, and
-that needs the user.
+- Write a file about one package under that package's directory and never at the top level; write a file about two or more packages at the top level and never under a package.
+- Delete a package directory in that campaign's acceptance commit and a top-level file when the wave or fleet campaign it records closes. `sweep.ts --report` lists both.
+
+## Dispatch
+
+`orkestrel-dispatch` owns the brief template, launch mechanics for native and bench units, long-running commands, liveness, and recovery. Load it before a bench lane, a campaign unit, or any command that outlives the turn. The floor that follows binds every dispatch.
+
+- A small native unit's brief is the dispatch message: scope, law references, expected result. Write a brief file with the dispatch skill's `scripts/brief.ts` at `tmp/units/<unit>-brief.md` (native) or `tmp/<bench>/<unit>-brief.md` (bench) when the unit is a bench lane, belongs to a campaign, or may need re-running. A re-run gets `<unit>-brief-<n>.md`; never edit a launched brief.
+- State in every brief: role and engine, one objective, the evidence slice, owned and off-limits files, the acceptance criteria cheap-first, the return shape, the deviation contract, and that the executor performs the work itself and spawns nothing.
+- Capture a campaign unit's report to `tmp/units/<unit>-report.md`, or read the bench's last-message file.
+- Launch every multi-minute command as a harness-tracked background command through `node .agents/skills/orkestrel-dispatch/scripts/launch.ts` under a cap sized from prior runs, and read a bench answer with that skill's `scripts/result.ts`. Every launcher, probe, and instrument is a TypeScript file run by `node`, never a shell or Python script. Read liveness from the artifact the work produces. Kill only a recorded process id, never a pattern, and confirm the process and its descendants are gone before another writer takes its files.
+- Probe a bench with the dispatch skill's `scripts/bench.ts` before its first lane, and re-read liveness at every dispatch after a failure.
+- Send a mid-campaign decision to every live unit whose brief it invalidates.
 
 ## Deviation protocol
 
-Stop when a conflict prevents the primary objective or requires an unowned change. Resolve an
-ancillary choice within the owned scope, record the choice, and continue.
-
-Every charter references this section rather than restating it. A charter keeps only a stop
-condition its own route owns, such as a misrouted unit it must refuse.
-
-When a writer stops:
-
-1. The writer reports: expected, found, exact evidence, done or not done, and at most one
-   short hypothesis. It does not investigate, improvise, or alter the plan.
-2. The Orchestrator triages:
-   - obvious correction → tighten and re-dispatch;
-   - missing mechanical evidence → dispatch `verifier`;
-   - unknown terrain → dispatch `grok` with the report and the plan slice;
-   - unknown design or root cause → dispatch `planner` and `analyst` on the question.
-3. The Orchestrator decides, updates the plan, and re-dispatches.
-
-Workflow failures use the same ladder. Do not absorb their raw logs into the main context.
-
-## Dispatch anatomy
-
-### Native first
-
-Launch a model through the running harness's own mechanism whenever that harness hosts it: Claude
-subagents and workflows in Claude Code, Codex-native agents in a Codex session, Cursor-native
-sessions in Cursor. MCP and CLI transports exist only to reach a model the harness does not host.
-Never route a native model through its own CLI or an MCP loopback.
-
-- Use a single-agent dispatch when later control flow depends on the previous result.
-- Use a workflow for a known deterministic fan-out, staged pipeline, or loop. Serialize writing
-  nodes; never run concurrent writers in the tree.
-- Name a role and its engine in every node.
-
-The harness bridge names the concrete mechanism for each of these.
-
-### Every dispatch is a file before it is a launch
-
-- Write the brief to a file under `tmp/`, named for its unit, before launching the unit, whatever
-  engine executes it. A brief composed only inside a launch argument cannot be corrected, resumed,
-  or re-run after that call ends. A native unit's pair is `tmp/units/<unit>-brief.md` and
-  `tmp/units/<unit>-report.md`. A bench unit's pair sits under the bench directory its role file
-  names, beside the journal.
-- Write the unit's returned report in the SAME action that commits its code, never afterwards. A
-  commit message states what changed; the report states what the unit measured, what it decided, what
-  it could not close, and which of its own claims it flagged. An auditor's subject is the report,
-  so a report living only in the Orchestrator's context stops the next lane on arrival.
-- Capture the unit's returned report to a file beside its brief under the same unit name, so a
-  unit's instruction and its outcome are one pair on disk.
-- Name, inside a report that rests on a bench lane, that lane's journal path and session id, so
-  the provenance survives the journal's sweep.
-- Re-run a unit with a successor brief, never with an edit to the brief it already ran. Name the
-  successor `<unit>-brief-<n>.md`, state in it what changed and why, and leave the original in place
-  unedited. A fix round's brief names the findings it carries and where each came from.
-- Name a corrected unit's effective brief and report and the pair they supersede before that unit
-  integrates. A unit whose correction landed as a serial patch or a direct reconciliation, with no
-  successor pair on disk, cannot be re-run from what the campaign kept.
-- When you copy a previous round's or unit's launch artifact to derive this one's, rewrite every
-  field that names the subject, not only the ones the edit was about. That covers each brief's lane
-  focus, its evidence and report paths, its subject files, and the path it gives for the law; the
-  claims file's subject line; each driver and watch script's header, journal, and output paths; and
-  the workflow's `meta.description` and every node's label. Read the derived copy start to finish
-  against the round it launches before launching it. A field carried over from the source names a
-  different subject and still reads as deliberate, so the lane works around it or rules on the wrong
-  file, and the retained record attributes that to the round.
-- Write an audit round's numbered claims to `tmp/audit/<unit>-audit-claims.md` and point every lane
-  of the round at that one file, so "both lanes ran the same brief" stays checkable after the round.
-  Retain it as `.orkestrel/<package>/<unit>-audit-claims.md`, beside the round's verdict.
-  `.agents/skills/orkestrel-falsify/references/brief.md` owns what the claims say.
-- Write the round's verdict to `.orkestrel/<package>/<unit>-audit-verdict.md`. That file is where
-  the audit step records a lane or a checker that did not run.
-- Read the copy the executor will open, not the one you wrote. A brief written in the orchestrator's
-  repository and staged into the subject's checkout so a `-C` invocation can reach it is a second
-  file, and staging can rewrite a path or drop a clause. The executor rules on what it opens, so a
-  staged copy whose facts are false stops a unit that was correctly briefed. Verify the staged path
-  and its load-bearing facts before launching, and stage into a scratch directory the subject tree
-  ignores rather than into the checkout root.
-- Before dispatching a successor or accepting a round, open every file the effective brief names
-  and confirm it resolves from the executor's root. Refuse the transition when one does not.
-- Check the launch argument's own file list the same way. A driver prompt names records beside the
-  brief it points at, and those names are part of the effective instruction even though they sit
-  outside the brief file. Staging the brief and its terrain is not enough: list every path the prompt
-  mentions and confirm each one resolves, because the unit stops on the one that does not and the
-  stop is charged to the round rather than to the launch.
-- Send a decision taken mid-campaign to every unit already in flight whose brief it invalidates. An
-  executor cannot see a change made after it was dispatched, so it writes the state its brief
-  described and the defect surfaces as its own.
-- Retention is uniform for every unit, whatever engine ran it, including an Orchestrator-owned
-  integration, fix, probe, or capture unit: copy the brief, the returned report or distillate, the
-  audit verdict, the exact executed script or instrument, and the acceptance evidence into
-  `.orkestrel/<package>/` as the unit is dispatched and as it returns, then sweep only the `tmp/`
-  launch copies. Rewrite every `tmp/` path inside a copied artifact to the retained path it now
-  names, in the same action that copies it. A retained file naming a launch copy resolves to
-  nothing after the sweep, and the successor, the claim list, and the staged authority always do.
-  Retention covers every lane of an audit round, including the lane whose brief produced a
-  deviation: a round with a retained report and no retained brief cannot be re-run. A capture
-  claim's instrument is acceptance evidence; the frames may be swept once the record transcribes
-  them, because the committed instrument re-produces the film. The **Bench laws** rule "Ephemeral
-  streams, durable records" owns journals and points here for everything durable.
-- Name a retained log with the `<unit>.log.txt` pattern, never with a bare `.log` suffix, which the
-  root `.gitignore` file ignores.
-- Promote anything that must outlive the campaign into a durable artifact before the sweep — a
-  commit message, a guide, a rule, a retrospective. What is only in a swept file did not survive,
-  and a debrief that must quote the record verbatim has nothing to quote.
-- Land a process rule stated as binding mid-campaign in the owning rule or contract file in the
-  same commit that states it. A campaign artifact is evidence, never a rule's home.
-
-### Where campaign artifacts live
-
-- Put every campaign artifact in the **orchestrator's** repository under `.orkestrel/<package>/`,
-  named for the package the campaign is about.
-- Give a campaign spanning several packages one shared `.orkestrel/campaign/` folder instead, so the
-  wave's plan, routing ledger, and verdicts sit together rather than split across the packages they
-  rule on.
-- Never put them in the package they are about. A published package's tree is its product.
-- Where the orchestrator's repository is itself a subject package, keep `.orkestrel/` as the
-  artifact home and stage every landing chain by path, never with `git add -A`. Run that
-  checkout's own CLI through the built `node dist/bin/main.js` entry, never through the `npx`
-  launcher, and record its audit reading beside the landing instead of gating the landing on it.
-  Commit the records before the landing's commit step, never during it.
-- Claim nothing outside `.orkestrel/` unless Orkestrel scaffold mandates it. Everything Orkestrel
-  owns in a consumer's tree lives beneath that folder, so a convention can be settled there without
-  colliding with a convention that is not Orkestrel's.
-- Keep the campaign narrative and every ruling in the durable artifact that owns it — the guide for
-  product truth, a rule or role file for process truth, the commit message for the decision itself.
-  Use `ROADMAP.md` only where the repository already keeps one.
-- Prefer a mechanism that recomputes a fact over a document that records it. A document recording
-  live state is stale from the moment it is written, and the next campaign reads it as current.
-  Where the fact can be derived, derive it: the fleet's publish order lives in the catalog table
-  `scaffold catalog` regenerates, not in a written order anyone has to remember to update.
-- Prune the campaign folder in a commit at acceptance. Git history is the archive; the working tree
-  is the workspace. `.agents/skills/orkestrel-debrief/references/retention.md` owns the procedure —
-  the checks that close the prune, the artifact locations it sweeps, and the promotion record
-  the commit message carries. Run it before deleting anything.
-
-### Required sections
-
-- **Role and engine.** The named role and its explicit engine.
-- **Objective.** One concrete outcome.
-- **Context.** The evidence slice, paths, decisions, `AGENTS.md`, applicable rules, the skill name
-  and its required references (or an explicit none), and the guide or spec. Include the host
-  environment facts the unit will hit — the shell, path, and network constraints its commands run
-  under — because an executor that rediscovers them pays for the discovery in round trips. State
-  every standing condition the same way: a file expected to be dirty, a command known to fail, a
-  shim the shell blocks. A condition the brief leaves unnamed comes back as a deviation report
-  about something you already knew.
-- **Unknowns.** What the Orchestrator does not yet know that the unit needs, named as unknown, with
-  how the unit reports back on it. A brief that cannot be fully specified says so instead of
-  shipping a guess the executor would have to invent an answer around.
-- **Scope.** Owned files, shared and off-limits files, allowed tools, permission limits.
-- **Execution.** State that the executor performs the assignment directly and spawns nothing. Put
-  it in every brief; an executor deep in a task does not re-read this contract. Write the sentence
-  for the reader the transport actually delivers it to, because "directly" names a different action
-  on each side of a bridge. To a native subagent or a bench engine reading the brief inside its own
-  CLI, it means do the work yourself. To a bridge driver, whose entire assignment is the launch, it
-  means carry the brief across unaltered and return the journal — the engine behind the CLI is not a
-  subagent the driver is spawning, and a driver told to work directly answers from its own engine
-  instead. That answer reads normal and its only tell is the missing journal, so pair this sentence
-  with **Bench laws** rule "Journal first" and refuse a bench result whose journal path and session
-  id are absent.
-- **Output.** The exact distilled return shape. No process diary.
-- **Deviation contract.** Point the writer at § Deviation protocol and scope it: name the ancillary
-  choices this unit settles itself — where a paragraph sits, which heading a section takes. An
-  unscoped contract stops a unit over a detail it was equipped to settle.
-- **Acceptance criteria.** Independently checkable completion conditions.
-- **Review evidence.** What the subject type requires, per the table in `orkestrel-falsify`. For a
-  code change that is the actual diff and the actual status output; omitting either is a dispatch
-  deviation. For any claim about a rendered or externally driven surface, the capture portfolio is
-  the review input and source is corroboration. A subject may occupy more than one row — a ruling
-  whose fixes already landed as edits is both a proposal and a code change — and it gets the
-  evidence of every row it occupies.
-
-### Check the brief before you send it
-
-Fill `.agents/templates/brief.md`, keeping its section and row headings verbatim, so a row you
-cannot close is visible as a heading with a named unknown under it rather than as an absence nobody
-can see. Add a section the unit needs; never drop one. Then run this checklist against what you
-filled.
-
-- Name the executor that will open the brief, and write the transport for that reader. A bridge
-  driver and the bench engine inside that driver's CLI need opposite instructions.
-- Paste the command and its output behind every factual claim — paths, counts, registrations, file
-  existence. Name the scope any search covered, and check a fact against the code rather than
-  against another artifact that states it.
-- Search the campaign's own record for every fact a brief asserts, and reconcile any disagreement
-  before dispatch. A brief that contradicts a measurement the campaign already took is the most
-  expensive kind of wrong fact, because the scope read cannot save you: it checks the brief against
-  the tree with the brief's framing in hand, so it reproduces the error as often as it catches it.
-  The unit reading the record cold is the only reader positioned to refuse, and by then the round is
-  spent. Grep the plan and the retained reports for the subject, and not the tree alone.
-- Better, give each measurement one home and keep the brief out of it. Put the measurements in a
-  terrain record the brief names and stages beside itself, and write the brief as rulings and
-  obligations that point at it. A measurement restated in a brief is a second copy that can drift
-  from the first, and the drift is invisible because both artifacts look authoritative. Tell the unit
-  which artifact wins when they disagree, and to stop rather than resolve it.
-- Cite a site by its symbol in any artifact meant to outlive a landing, and name a line only as
-  approximate ("around line 40"). A record written before one unit lands and read after another does is the
-  normal case, not the exception: a line citation that was exact when measured goes stale the moment
-  something is inserted above it, and the reader cannot tell a stale number from a wrong one. Name
-  the function, the mixin, the case title, or the surrounding construct, and tell the reader to
-  locate it by that.
-- Take every measurement under the conditions the unit runs in, or have the unit take it before
-  doing anything else.
-- Ask what the change does to every fact you measured, and fix each criterion to the state the unit
-  finishes in.
-- Scope the change by the files its result makes **false**, not by the files that declare the thing
-  changing: the test asserting the reversed behaviour, the fixture carrying the raised value, the
-  golden digest over generated output, the consumer script naming the removed union member.
-- Derive that set by running the suite. Where you cannot run it, name the search's bound in the
-  brief so the unit re-derives the set.
-- Find the enumerating assertions by searching for the population's EXISTING members, never by
-  reasoning about which files look relevant. A literal set or list naming every member of a growing
-  population goes false the moment a unit adds one, and it can sit in a file whose name suggests it
-  holds only machinery. Grep the tree for a member the population already has; every file that comes
-  back is a file the unit must own. Reasoning finds the obvious site and misses the rest, and the
-  miss surfaces as the unit's stop.
-- Answer any question of the form "can this tree do X" the same way: search for X already being done,
-  never by inspecting the interface that would do it. Grep for the behaviour, the export, the staged
-  preference, the driven surface. A sibling already doing it is the answer, and its call site is the
-  pattern the unit copies. An interface's surface is evidence about that interface and never about the
-  tree, so a missing control there proves nothing — the mechanism is as often a function an installed
-  package exports as a method on the object in hand. Record the answer as unreachable only after a
-  search for the thing itself came back empty, and name the pattern that search used. A brief that
-  asserts a capability is absent tells the unit to stop looking, so this error costs the round even
-  when the tree is correct.
-- Diff the previous unit's actual status against this brief's owned set whenever a series of units
-  adds members to one population. A grant the previous sibling needed and this brief omits is the
-  likeliest gap, because each brief is written from the plan rather than from what the last unit
-  touched.
-- Grant a behaviour with the tests that pin it, a constant with every fixture and expectation
-  derived from it, and a template change with the materialized copy the package generates from it.
-- Grant the file a brief tells the unit to copy a pattern from, wherever a standing gate forbids
-  duplicating that pattern. Naming a pattern to follow and withholding the file it lives in
-  instructs the unit into a gate failure it cannot fix inside its scope: the honest fix touches both
-  copies, and extracting one side alone breaks the same rule from the other direction. The unit then
-  stops, correctly, and the round is spent on a contradiction the brief carried.
-- Read each criterion against the off-limits list, line by line. Grant the file a criterion needs or
-  strike that criterion. A file the change will break that appears in neither list is unscoped.
-- Where a scope line names the `tests/**` or `src/**` glob, name the paths the `scaffold repair`
-  command restores as off-limits in the same sentence. Bound a criterion wider than its Sites by
-  the brief's scope.
-- Scope a unit that changes a mechanism to own the prose describing it. Where a brief scopes that
-  prose out, name the carrier and dispatch it before the change ships.
-- Give a small unrelated obligation its own unit.
-- Name the property the unit must change, and stop. Record an expected consequence as an
-  observation, never as a second criterion.
-- Order the criteria cheap-first, so an unreachable one cannot hide a typecheck or a lint criterion
-  behind it. Where the change edits a file the repository vendors or digests, the regeneration step
-  precedes every gate that reads the generated artifact.
-- Never make a timing-sensitive or whole-suite gate result a criterion for a unit running inside its
-  own exec. Name it as an observation the unit reports with its own reading, and take the
-  authoritative run yourself after the unit exits. A scoped run over the unit's owned files stays a
-  legitimate criterion.
-- Check the brief's output mechanism and its verification method against the executor's tool
-  allowlist. A read-only lane writes no report file and runs no probe, so hand it the rendered
-  evidence instead.
-- Keep the brief's control identifiers inside the brief, and say in the brief that a test is named
-  for what it proves rather than for the control that specified it.
-
-### Carry every finding
-
-After reconciling findings into briefs, walk the retained finding list once. Every finding names
-the brief item that carries it. A finding with no carrier is a dropped finding.
-
-Name a carrier by the unit, never by a condition. "Whichever unit next touches this file" is a
-description that stops being true the moment the next unit is chosen, and nobody re-reads the verdict
-at that moment — so the finding reads as assigned and is not. Where the carrying unit is not yet
-known, say that plainly and re-check the assignment at the next dispatch.
-
-Every finding names exactly one carrier. A further brief claiming the same finding is not redundancy
-that costs a little duplicated work — it is a conflict the executor discovers mid-unit, between
-documents you told it to obey, with no way to tell which you meant. It will either implement the row
-twice or stop. Where a reconciliation table and a brief disagree about who owns a row, the brief the
-executor opens wins, and you fix the other one before the second unit launches.
-
-## Long-running commands
-
-A bench exec, a Workflow, an install, a build, and a publish chain are one class of thing: a
-command that outlives the turn that started it. Every law here binds all of them.
-
-### Launching
-
-- The Orchestrator launches every long command as a harness-tracked background command under a hard
-  time cap. Never detach one from inside a dispatched agent. The harness owns the lifecycle,
-  completion re-invokes the session, and the cap kills a wedged command loudly instead of trusting
-  the agent to report its own failure. A wedged bridge is silent, and silence must never read as
-  progress.
-- Never replicate git commits through a hosting provider's REST API when a file's content must ride
-  inside the tool-call JSON. The per-call read cap truncates it, and a lockfile is the file that
-  proves the point: it transits incomplete and the tree it lands in installs something else. Push
-  over git, or move the file another way.
-- Write a multi-step chain to a script file and run the file. A chain composed inside one shell
-  argument cannot be read back, corrected, or re-run, and the record of what actually ran is the
-  argument text in a transcript rather than a file on disk.
-- Never edit a script file while a shell is executing it. `bash` reads a script incrementally from a
-  byte offset rather than loading it, so an edit that shifts line numbers moves the text under that
-  offset and the shell resumes mid-construct. The run dies on a syntax error in a line the script
-  does not contain, which reads as a defect in the work rather than as the edit that caused it. Copy
-  the file, edit the copy, and launch the copy for the next run. A successor's header names its own
-  file, its own log, and what changed from the file it supersedes.
-- On a Windows host this binds every program-carrying command, not only long ones. Heredocs,
-  `node -e`, `node -p`, `&&` chaining, and any argument carrying `${...}` trip the Git Bash
-  approval classifier and turn an unattended run into a manual approval prompt. Write the program
-  to a file, invoke the file, and keep each shell call one plain command.
-- Detach anything that must survive its launching shell with `setsid`. A backgrounded flow the
-  harness reaps mid-step leaves the work half done and the exit status missing, and the reap looks
-  identical to the step failing.
-- Size the cap yourself, from the observed high mark of comparable commands, plus an
-  independently budgeted gate allowance, plus explicit slack. Never size it from the estimate
-  alone. Never delegate it: a bridge starts with a clean context, holds no record of prior runs,
-  and can only guess. A cap-killed exec is indistinguishable from a real failure.
-- Run the first use of any CLI flag, subcommand, quoting form, or stdin combination in a throwaway
-  probe. Never inside a dispatched unit or a publish chain.
-- A launch is not a launch until its record grows past its header. Confirm the log advanced beyond
-  the head before recording that the command started, and treat an instantly-dead log as a failed
-  launch whose tail is the evidence.
-- Keep network-dependent work out of sandboxed bench execs. Bench sandboxes deny network, so
-  lockfile generation, real installs, and live fetches belong to the Orchestrator's own tracked
-  commands or to whichever of `sol`, `opus`, and `builder` runs natively in the harness, as an
-  ordinary dispatched writing unit. A bench exec hanging on `npm` until its cap fires is the
-  signature of this misroute, not of a slow bench.
-- A Workflow journals identically and dies identically, so give it the same watch — with one
-  correction. A workflow journal writes only at agent start and result, so its mtime goes quiet for
-  minutes during healthy work, and the liveness signal is the newest subagent transcript instead. A
-  watch that reports only new events cannot report a death, because silence and progress look the
-  same; the filter must fire on absence. Recover with `resumeFromRunId`, which returns every
-  completed agent from cache and re-runs only what never finished.
-
-### Reading liveness
-
-Read liveness from the artifact the work produces, never from its wrapper. A subagent's transcript
-file can report zero bytes while the agent is working normally, so an empty or stale wrapper proves
-nothing.
-
-- Judge a unit by what it has changed in the tree: modification times on the files it owns, the
-  counts its suite reports, the report it was told to write.
-- Check that before killing anything. A healthy unit killed on a false signal loses everything it
-  had not yet written down, and the loss is charged to the orchestrator, not the unit.
-- If a unit must be stopped, say plainly that it was stopped and why, then assess the tree it left
-  rather than assuming its partial bytes are either good or worthless.
-- Follow the deviation ladder for a stalled journal or a cap-killed exec, using the session id from
-  the journal head as the recovery handle.
-
-### Confirm dead before relaunching
-
-- Prove the previous run is gone before starting another. List the processes and read the list. A
-  second run started beside a live first one produces failures that read as the subject's — a
-  publish chain relaunched over a live one reports `EOTP` and `E403` that are its own processes
-  colliding, and both readings point at the registry.
-- Never ask `pgrep -f` or `ps | grep` whether a command is running from a shell whose own command line
-  contains that command's text. The shell matches itself, so the answer is yes whatever the truth is.
-  This bites in separate places and each one fails differently:
-  - **A liveness watcher** loops forever, reporting "still running" and never delivering its completion
-    notification, because it always finds itself.
-  - **An elapsed-time reading** returns the watcher's age rather than the exec's, so the number falls
-    instead of rising and reads as a relaunch that never happened.
-  - **A pre-launch "is anything already running" check** reports a phantom concurrent writer, which is
-    the worst of them: the honest response to it is to kill something, and there is nothing there.
-    Read liveness from the recorded process id with `kill -0 <pid>`, or enumerate by executable name and
-    parent with `ps -eo pid,ppid,comm` and read the rows. Both are immune; a pattern over the full command
-    line is not.
-- Kill by process id, never by pattern. `pkill -f` matches the relaunch that is already starting, so
-  the pattern that cleans up the old run kills the new one and the cleanup reads as a launch
-  failure.
-- A killed `codex exec` is dead only when its process tree is dead: walk the children with
-  `ps --ppid` and confirm the `codex-code-mode-host` child is gone. Before dispatching a substitute
-  writer, check the owned files' modification times against the baseline — a live orphan is still
-  writing the tree the substitute is about to own.
-- Read a failure against what was running when it happened, not against what you believe was
-  running. The check costs one command and is the only thing that separates a real failure from
-  self-inflicted contention.
-
-## Bench laws
-
-External engines widen capacity. They never inherit authority. Treat every bench output as a
-proposal or hypothesis until it is verified against source and accepted by the Orchestrator.
-
-A bench is cross-provider reach only. Never send a model across a bridge when the running harness
-hosts it natively.
-
-A bench exec is a long-running command, so every law under **Long-running commands** binds it too.
-This section adds what is true of a bench and nothing else.
-
-Every bridge verifies before running that its CLI resolves and its bench is authenticated, and stops
-with a deviation report naming the fallback when either fails. The role file owns the exact
-invocation, flags, paths, probe, and recovery ladder; these laws bind every bench regardless of
-transport.
-
-1. **Transport by work class.** Use an MCP transport only for a short interactive exchange — one
-   bounded question or a follow-up on a live thread, finishing in roughly two minutes. Use the
-   journaled CLI for audits, implementation units, and anything else multi-minute. An interrupted
-   MCP call loses its session invisibly; a journal survives any client-side failure.
-2. **Journal first.** Every bench invocation leaves a tailable on-disk record beside its brief
-   under `tmp/<bench>/`: the event stream or output log, and the final answer. Arm exactly one
-   Monitor per long exec, filtered to milestones — commands run, files changed, agent messages,
-   terminal states — never the raw event stream. Exit the filter on the exec's terminal event so no
-   watcher outlives its subject. The journal's mtime is the liveness signal; the session id in its
-   head is the recovery handle. The journal is also the proof the bench ran: a bench unit returns
-   its journal path and session id with its result, and the Orchestrator confirms both before
-   using that result. A report does not carry the engine that produced it, so a bench unit with no
-   journal ran on its driver's engine, however normal its answer reads.
-3. **Tracked, never loose.** Register every bench unit in the session task registry at launch with
-   its subject, journal path, and session id, and complete it there at acceptance. "What is
-   running" always has a first-class answer instead of a recollection of a command.
-4. **One lane at a time per bench.** Launch one `grok` lane at a time and queue the rest. Lanes past
-   that starve the bench: it accepts each launch and the lanes come back empty, which reads as the
-   work failing. Re-probe before ruling on an empty lane. A probe that round-trips while the lanes
-   return empty names starvation, not darkness — cut the concurrency and re-run the lane, rather
-   than recording the bench dark and substituting an engine.
-5. **A bench sandbox spawns a child and denies that child's child.** Under `workspace-write` a bench
-   exec runs a test suite and spawns children normally, and every operation one level deeper fails:
-   a grandchild process is denied `EPERM`, and a nested `npm install` is denied the same way. So a
-   proof needing a process tree, a tree-kill, a detached group, or an installed package cannot be
-   produced inside a bench unit at all — however carefully that unit isolates. Name the limit in the
-   brief before dispatch, tell the unit to record such a proof as an observation naming the exact
-   settling command, and take that proof yourself on the host. Never let a unit substitute the
-   reachable half: linking a packed tarball is not installing it, and a gate written to catch an
-   install failure that only ever links cannot see the defect it exists for.
-   Not every symptom names the sandbox. A nested process and a nested install fail `EPERM`, which
-   reads as a denial; a nested `git` invocation instead reports **"not a git repository"** while the
-   unit's own `git status` succeeds a moment earlier. That one reads as a broken checkout, and a unit
-   acting on it will go looking for damage that is not there. Tell a unit which of its tools shell out
-   one level down — a scaffolding CLI that probes git, a formatter that spawns a worker — so it
-   recognises the shape instead of diagnosing the tree.
-   The child a bench does create has unreliable stdio, and that failure wears a worse disguise than a
-   denial. A Node process spawned by a bench unit's own Node process has been measured both buffering
-   its pipe until EOF and publishing nothing at all, so no workaround built on either reading is
-   dependable. Any subject whose behaviour lives in a child's pipes is therefore unmeasurable inside a
-   bench: a stage driving a language server, a protocol fixture, a built entry driven as a spawned
-   child. It fails as a **false green**. The stage never arms, the boot inspection times out, and that
-   timeout produces the same rejection a genuine stage timeout produces, so a test asserting on the
-   message passes inside the bench while the host's gate reports the honest red — and neither run
-   reports why they disagree. Route such a subject to the harness's native writing lane, or keep it on
-   the bench and supply every executed measurement yourself. Never dispatch it to a bench and expect
-   it to prove its own work. The shape to recognise is a child that exits 0 almost immediately, a
-   request to it that never resolves, and a stack landing in the spawning code's exit handler.
-   **When a bench sandbox denies a loopback listener, `listen` fails `EPERM` on every address.** A
-   subject needing a real local server is unmeasurable inside the bench. Name the limit in the brief
-   before dispatch. Have the unit report the reading as an observation naming the exact command.
-   Take the proof on the host.
-   **When a brief assigns a bench unit a path outside the obvious source tree, name the write limit
-   in the brief.** If the sandbox rejects the patch, the unit stops and reports the rejection. Never
-   find another write mechanism.
-   **A bench unit writes only under its own `--cd` root and the system temporary directory.** A
-   report path in the orchestrator's repository is outside both, so the write is rejected after the
-   work is already done and the unit improvises a fallback the Orchestrator has to go find. Name the
-   report path inside the unit's own tree, or tell the unit to return the report as its final
-   message and take it from the `--output-last-message` file. Retention still lands the report in
-   `.orkestrel/<package>/` — the Orchestrator copies it there, and the unit never writes it there.
-6. **Ephemeral streams, durable records.** A journal proves a bench is alive and recovers an
-   interrupted session. Keep journals under `tmp/`, never commit them, and sweep them at acceptance
-   after the final gate evidence is recorded. Durable retention — brief, distillate, verdict,
-   instrument, acceptance evidence — is owned by **Dispatch anatomy**; this rule owns only the
-   journal stream.
-
-### Recovering a dark bench
-
-- A probe that finds no bench binary records the bench dark and, in the same turn, names to the user
-  the install command and the bench it unblocks. Re-probe when the user answers.
-- A probe that finds a bench binary present but authentication unavailable starts recovery in the
-  same turn. Do not record the bench dark and wait.
-- Background the login command with its output captured under `tmp/<bench>/`, surface the
-  verification URL and one-time code to the user the moment they appear there, arm a watcher on
-  completion, and re-probe when it fires. The bench comes live mid-session with no restart.
-- A session that sits dark until the user asks for the login has failed the probe, not the bench.
-- Never substitute an API key, access token, copied auth file, or another login flow. If recovery
-  cannot complete, record the bench dark, name the fallback in the plan, and say so.
-- The role file owns each bench's exact login command and probe.
-
-## Publishing the fleet
-
-Publishing is the user's decision and the user's credential. The Orchestrator prepares, surfaces
-the approval, and runs the publishes the user asked for. It never substitutes an API key, an access
-token, a copied auth file, or another login flow, and it never asks the user to paste a token into
-the conversation.
-
-A publish chain is a long-running command, so every law under **Long-running commands** binds it:
-write the chain to a file, detach it with `setsid`, and confirm the previous one is dead before
-starting another. Publish serially, because concurrent publishes collide on the authentication
-handshake and fail each other.
-
-The release itself runs from the `orkestrel-publish` skill: the wave's per-repo visit and its bump
-triggers in `references/wave.md`, and the preparation order, the login approval, and the
-five-minute upload window in `references/window.md`. Load the skill when the user asks for a
-release, and follow it there rather than reconstructing the procedure here. What remains in this
-section binds an executor who is not publishing.
-
-A wave over unpublished tips derives its order per run from the graph and records only the round
-each package landed in, never the order itself.
-
-### Fixing a dependency before it publishes
-
-A defect a consumer meets sometimes lives in a package the consumer only has from the registry.
-Waiting for that package to publish before the consumer can prove its own fix serializes releases
-that could have been one. Do not wait, and do not work around it in the consumer.
-
-Build the dependency from source, pack it, and **install the tarball** into the consumer.
-
-- **Install it, never link it.** A link resolves through a directory and skips the packing, the
-  `files` list, and the exports map — which is most of what a distribution proof exists to check. A
-  gate written to catch an install failure that only ever linked cannot see the defect it exists for.
-- **Write the swap to a script and run the file**, so the build, the pack, and the install are one
-  artifact the next run reuses rather than a command nobody can read back.
-- **Record the range you replaced** in the same step that replaces it. A consumer sitting on an
-  unpublished tarball with no record of what it had is a consumer nobody can restore.
-- **Rebuild and repack whenever the source moves.** A stale tarball is the same defect as a stale
-  `dist/`, and it is worse for being invisible: the consumer's gates go green against a fix that no
-  longer exists in the dependency's tree.
-- **Run one unit per checkout, at that checkout's catalog layer.** Give a checkout with no rows an
-  adopt unit only when its typecheck against the staged closure reddens.
-- **Fetch and merge the dependency's default branch before packing it**, wherever another session
-  can move that branch. A pack from a stale tip ships the consumer a dependency the dependency's own
-  repository no longer has.
-- **Restore the registry copy before any gate that must prove the published artifact, and before
-  publishing anything.** A distribution proof run against a local tarball proves the local tarball.
-  The release still follows layer order: the dependency publishes first, then the consumer re-pins to
-  the version the registry now serves and re-runs its gates against that.
-- **Keep the tarballs out of the tree.** They belong under `tmp/`, they are swept at acceptance, and
-  they are never committed.
-
-The tarball is a head start, not a shortcut. It lets the consumer's work proceed and its proofs run
-against the real packed artifact while the dependency's own release is still being prepared.
-
-### What a bump obliges
-
-A runtime dependency and a development dependency have different blast radius, and confusing them
-either publishes packages nobody needed to publish or leaves a consumer pinned to an older release.
-
-- A **runtime** `dependencies` bump reaches every consumer of the published package. Every package
-  downstream of it re-pins, re-runs its gates, bumps, and republishes, in layer order.
-- A **development** `devDependencies` bump reaches nobody. Re-pin it, prove the gates still green,
-  and commit to `main`. Do not bump the version and do not publish.
-- A development bump that moves the published artifact is no longer a development bump. Prove the
-  direction with the build, not the diff of sources: rebuild after the re-pin and compare `dist/`
-  against the published tarball. Compare material content only — exclude sourcemaps and ignore
-  whitespace-only differences; a superfluous diff (formatting, blank lines, map noise) moves
-  nothing and obliges nothing. A material diff — tokens, declarations, logic — means the published
-  surface moved — a forced `src` or `app` edit and a toolchain-changed emit both surface here — so
-  that package bumps and publishes on its own account, and its own dependents follow the preceding
-  runtime rule.
-
-Every package is `0.0.x`, where a caret pins one exact release. A dependent therefore sees a new
-version only after it re-pins and republishes, so the fleet publishes in topological layer order
-derived from the runtime `dependencies` and `peerDependencies` edges, never from a development
-edge. Layers exist for a reason a flat pass cannot fix: ranges that disagree install duplicate
-copies of the same package, and the compiler reads them as distinct types.
-
-Read the order from the catalog table in `.claude/agents/orkestrel.md`, which `scaffold catalog`
-regenerates from the registry. Its `Layer` column is the publish round. Regenerate it before
-sequencing a cascade rather than trusting the copy in the tree, and never write a second order down
-somewhere else.
-
-The tooling packages sit outside that order because nothing depends on them at runtime. `scaffold`
-is a development dependency of every package, including packages it depends on itself, so a runtime
-layering would report a cycle that does not exist. Each package builds against the already-published
-`scaffold`, never against an unpublished one, and a `scaffold` release therefore publishes on its own
-and propagates as files rather than as a cascade. A package the fleet consumes as a development
-dependency takes the same shape when its consumers' gates read its unpublished tip;
-`.agents/skills/orkestrel-publish/references/wave.md` § Rule on the bump states that trigger.
-
-`scaffold` also carries a second published surface beside `dist/src`: `package.json` ships
-`dist/host`, the vendored file set every target receives through `repair`.
-
-- Bump and publish `scaffold` when any vendored byte changes, or when the set of vendored paths
-  changes. That surface moved on its own account, and `dist/src` need not move with it.
-- Re-pin `@orkestrel/scaffold` in each target after a vendored-only release, run `repair` there, and
-  prove that target's gates still green. `repair` restores `tests/setupPolicy.ts` and
-  `tests/policy.test.ts`, so a vendored-only release can turn a green target red. A target bumps
-  only when its own published surface moved.
-- Keep a target's own Claude permissions in `.claude/settings.local.json`, never in the vendored
-  `.claude/settings.json`. `repair` restores the vendored copy, so a `defaultMode` or an `allow`
-  entry added there is reverted without warning and the operator loses grants they set
-  deliberately. Change the vendored file only here, in the host inventory.
-- Never edit a vendored file inside a target. `repair` restores it, so the edit is reverted and
-  reports as drift in `scaffold audit`. In this repository those same files are the published
-  `dist/host` surface, so editing one forces a bump, a publish, and a re-propagation across every
-  target. Scope a fleet-wide refactor to the files each target owns, and record the vendored
-  exclusion in the brief rather than letting each unit rediscover it.
-
-## Acceptance laws
-
-- No writer's and no external engine's self-assessment is authoritative.
-- Never spend Opus 5.5 or Astra on absorption, distillation, scouting, or mechanical edits. Never route
-  judgment-bearing implementation away from Opus 5.5 or Astra.
-- Substitute an engine only when the same session records the bench dark — CLI missing, auth
-  expired, model unavailable. Name the fallback in the plan; never improvise it silently. The
-  tedious-work ladder is the only pre-approved substitution, and each step down it is still recorded.
-- Never run the lanes on different briefs, and never show either one the other's answer before
-  both have returned.
-- Never run a lane inline in the Orchestrator's context, and never drop a lane because its default
-  engine is unavailable. Substitute the engine, keep the lane.
-- Never accept unreviewed implementation, unverified hypotheses, shared-tree writing races,
-  implicit engines, fixed Claude model IDs, or verbose completed-work residue.
-- Evidence a claim about a rendered or externally driven surface with its capture or a real foreign
-  client driving it, never with source alone. Where no such surface exists this law is inert.
-- When the Orchestrator writes any part of a unit, that part is briefed, owned, and audited like any
-  other part, and its auditor is an engine the Orchestrator does not share.
-- Final acceptance belongs only to the Orchestrator, after independent audit and gate evidence.
-- Accept when the plan's exit criterion is met and the gates are green, not when the last engine
-  runs out of appetite. Reopening an accepted criterion is the user's instruction, not an auditor's
-  finding.
+A unit stops when a conflict blocks its objective or requires an unowned change. It reports expected, found, exact evidence, done or not done, and at most one hypothesis. It settles an ancillary choice inside its scope and records it.
+
+The Orchestrator triages: obvious correction → tighten and re-dispatch; missing evidence → `verifier`; unknown terrain → `grok`; unknown design or cause → one `planner` or `analyst` question. Then decide, update the plan, re-dispatch.
+
+## Benches
+
+- Probe a bench with the dispatch skill's `scripts/bench.ts` before its first lane in a session. A version string or a login status is not liveness.
+- A dispatch that fails on auth, quota, model access, or network records the bench dark and re-plans the lane on the substitute engine: Astra dark → Opus holds the objective lane too; Opus dark in Codex → Astra holds the subjective lane too; Grok dark → Luna, then Sonnet. Record every substitution in the routing ledger.
+- Never assign Grok a design or review lane in Claude Code or Codex.
+- Journal every bench run under `tmp/<bench>/` with its session id. Never commit a journal.
+
+## Cleanup
+
+- When a unit is accepted, carry its measurements, unresolved findings, and any instrument worth keeping into the commit message, the campaign ledger, or a test, then delete its `tmp/units/<unit>-*` files and its bench journals.
+- `.orkestrel/` holds only what § .orkestrel layout names. Delete a verdict when its seam closes and the package directory in the acceptance commit; git history is the archive.
+- Delete a probe from the source tree before the unit returns; promote a probe that settled a claim into a test.
+- Run `node .agents/skills/orkestrel-dispatch/scripts/sweep.ts --report` at acceptance; it lists leftovers under `tmp/` and `.orkestrel/` by age and deletes nothing. Run the same script with `--tmp` after the last live unit exits; it deletes files older than its threshold and refuses while a journal is changing.
+- A campaign artifact never lives in the package it is about.
+
+## Cache
+
+- Fix the model at session start. Effort switches and MCP changes invalidate the cache on most models and configurations; check the rule for the active model and tool-loading mode before changing either mid-session.
+- Keep the always-on instruction set small; rules load by path. An edit to a loaded instruction file takes effect after `/clear`, `/compact`, or a restart.
+- Give reading and driver roles no instruction files (`omitClaudeMd` in Claude Code) when their charter carries the floor they need.
+- Send bulk reads to a subagent and keep only the distillate.
+
+## Acceptance
+
+- No writer's and no bench's self-assessment is authoritative. The Orchestrator accepts after the review and the gates the size gate names.
+- Accept when the exit criterion is met and the gates are green. Reopening an accepted criterion is the user's instruction, not a reviewer's finding.
+- Substitute an engine only when the same session recorded the bench dark; name the fallback in the ledger.
+- Publishing is the user's decision and credential; `orkestrel-publish` owns the release procedure, the bump rules, and the dependency-tarball rules.