@orkestrel/scaffold 0.0.97 → 0.0.99

package/dist/host/agents/orchestration.md

@@ -8,56 +8,62 @@ Read in order: the user's instruction; `AGENTS.md` and the rules it scopes to yo
 
 ## Engines
 
-| Engine                            | Job                                                   | Posture                                                  |
-| --------------------------------- | ----------------------------------------------------- | -------------------------------------------------------- |
-| Cursor Grok                       | absorb, distill, scout, bounded research              | read-only; returns evidence, never decisions             |
-| Opus 5.5                          | subjective design, design-fit review, implementation  | proposes, audits, implements; never accepts its own work |
-| GPT-6 Astra                       | objective analysis, correctness audit, implementation | proposes, audits, implements; never accepts its own work |
-| Sonnet 5.5, GPT-6 Sol, GPT-6 Luna | mechanical units, gates, conformance, locating        | executes a fully specified brief                         |
+Name the harness family and its access route: Claude through Claude Code or the Claude CLI; Codex through Codex native agents or the Codex CLI; Cursor through the Cursor CLI, with Grok 4.7 Extra High for the Grok bench. Classify GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna as Codex-family engines, including when another harness hosts the Orchestrator.
 
-The harness's own engine orchestrates: Opus 5.5 in Claude Code, Astra in Codex, Grok in Cursor. The Orchestrator owns the plan, every decision, integration, and acceptance. When the size gate names a review, the review runs on an engine that did not write the work.
+| Engine                  | Job                                                                             | Posture                                                                 |
+| ----------------------- | ------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
+| Claude Fable 5.1        | orchestration in Claude Code: the plan, every decision, integration, acceptance | never dispatched: never a subagent, a bench, a fork, or a Workflow node |
+| Cursor Grok             | context absorption, distillation, broad mapping, exploration                    | read-only; returns evidence, never decisions                            |
+| Claude Opus 5.5         | subjective design, design-fit review, implementation                            | proposes, audits, implements; never accepts its own work                |
+| GPT-6 Astra             | objective analysis, correctness audit, implementation                           | proposes, audits, implements; never accepts its own work                |
+| Claude Sonnet 5.5       | bounded implementation of a closed shape, ecosystem reconciliation              | executes a fully specified brief                                        |
+| Claude Haiku 5.5        | bench drivers, small precise tasks, exact lookups, conformance, gates           | executes a fully specified brief; edits no source                       |
+| GPT-6.1 Sol, GPT-6 Luna | mechanical units, drivers, small precise tasks, gates, exact lookups            | executes a fully specified brief                                        |
+
+The harness's own engine orchestrates: Claude Fable 5.1 or Claude Opus 5.5 in Claude Code, GPT-6 Astra in Codex, Cursor Grok in Cursor. The Orchestrator owns the plan, every decision, integration, and acceptance. When the harness is Codex or the Orchestrator uses a Codex-family engine, use the Codex column: map Opus to GPT-6 Astra, Sonnet to GPT-6.1 Sol, and Haiku to GPT-6 Luna; execute mapped Astra roles natively without an Opus bench probe. Under this mapping, assign review to another agent in a clean context and forbid self-review, including when writer and reviewer both use Astra. For other harnesses, review runs on an engine that did not write the work.
 
 ## Roles
 
-| Role         | Job                                                                | Claude        | Codex      |
-| ------------ | ------------------------------------------------------------------ | ------------- | ---------- |
-| `grok`       | absorption and distillation on Cursor Grok                         | sonnet driver | sol driver |
-| `analyst`    | objective design argument or correctness audit on Astra            | sonnet driver | astra      |
-| `astra`      | objective, constraint-heavy implementation on Astra                | sonnet driver | astra      |
-| `planner`    | subjective design on Opus                                          | opus          | sol driver |
-| `reviewer`   | design-fit or correctness review on Opus                           | opus          | sol driver |
-| `opus`       | subjective implementation (API shape, naming, guide voice) on Opus | opus          | sol driver |
-| `builder`    | one fully specified taste-free unit, app layer included            | sonnet        | sol        |
-| `checker`    | mechanical conformance against criteria and rules                  | sonnet        | luna       |
-| `verifier`   | gates and evidence commands, exit-code truth                       | sonnet        | sol        |
-| `scout`      | locate files, symbols, seams                                       | sonnet        | luna       |
-| `distiller`  | bulk reading when the Cursor bench is dark                         | sonnet        | luna       |
-| `researcher` | primary-source research when the Cursor bench is dark              | sonnet        | luna       |
-| `orkestrel`  | ecosystem reconciliation over supplied evidence                    | sonnet        | luna       |
+| Role         | Job                                                        | Claude       | Codex       |
+| ------------ | ---------------------------------------------------------- | ------------ | ----------- |
+| `grok`       | absorption, distillation, broad mapping, exploration       | haiku driver | luna driver |
+| `analyst`    | objective design argument or correctness audit on Astra    | haiku driver | astra       |
+| `astra`      | objective, constraint-heavy implementation on Astra        | haiku driver | astra       |
+| `planner`    | subjective design                                          | opus         | astra       |
+| `reviewer`   | design-fit or correctness review                           | opus         | astra       |
+| `opus`       | subjective implementation (API shape, naming, guide voice) | opus         | astra       |
+| `builder`    | one bounded unit with a closed shape, app layer included   | sonnet       | sol         |
+| `checker`    | mechanical conformance against criteria and rules          | haiku        | luna        |
+| `verifier`   | gates and evidence commands, exit-code truth               | haiku        | luna        |
+| `scout`      | exact bounded lookup of files, symbols, seams              | haiku        | luna        |
+| `distiller`  | bulk reading when the Cursor bench is dark                 | haiku        | luna        |
+| `researcher` | primary-source research when the Cursor bench is dark      | haiku        | luna        |
+| `orkestrel`  | ecosystem reconciliation over supplied evidence            | sonnet       | sol         |
 
 - Name the role and its engine in every dispatch. Reach a role by its own name.
-- A driver launches another provider's CLI and returns the journal path and session id with the result. It never judges or implements. Refuse a bench result that carries no journal path and session id; it ran on the driver.
-- `.agents/transports/<provider>.md` owns each bench's invocation, sandbox, journal, and recovery. `.claude/agents/` and `.codex/agents/` hold one file per role.
+- A driver launches another harness's CLI and returns the journal path and session id with the result. It never judges or implements. Refuse a bench result that carries no journal path and session id; it ran on the driver.
+- `.agents/transports/<harness>.md` owns each bench's invocation, sandbox, journal, and recovery. `.claude/agents/` and `.codex/agents/` hold one file per role.
 
 ## Routing
 
-- Route by judgment load. Objective, constraint-heavy, mechanical-precision work goes to `astra`. API shape, naming, and documentation voice go to `opus`. A unit whose correct implementations cannot differ goes to `builder`.
-- Delegate bulk supporting reads to `grok`: terrain, prior art, diff sweeps, scattered sources. Read decision-bearing source yourself. Fall back to `distiller` or `researcher` only when the Cursor bench is dark, and record the fallback.
+- Route by judgment load. Objective, constraint-heavy, mechanical-precision work goes to `astra`. API shape, naming, and documentation voice go to `opus`. A bounded unit whose brief or types fix its names, API, and architecture goes to `builder`, whatever its private lines; a unit that spans packages or leaves one of those open goes to `astra` or `opus`.
+- Route all context absorption, distillation, broad mapping, and exploratory or fishing reads to `grok` on Cursor Grok 4.7 Extra High: terrain, prior art, diff sweeps, scattered sources. Keep decision-bearing reading with the decision owner. Fall back to `distiller` or `researcher` only when the Cursor bench is dark, and record the fallback; ease or cost never authorizes a fallback.
+- Keep small tedious precise tasks native: Claude Haiku in Claude, Codex Luna in Codex. Use `scout` for an exact bounded lookup; keep bench drivers, `checker`, and `verifier` on their mapped native engines. A bounded file scope does not turn context absorption or exploratory reading into a native lookup.
 - Route gates to `verifier`. A writer's self-reported gate is not evidence.
-- Work directly on a one-file change, a lookup, or a one-line fix. Dispatch when isolation, parallelism, a second engine, or a large read pays for the brief.
+- Work directly on a one-file change or a one-line fix, subject to the preceding routing rules. Route standalone lookups through `scout`. Dispatch when isolation, parallelism, a second engine, or a large read pays for the brief.
 
 ## Size gate
 
 `AGENTS.md` § Work loop sizes a change and fixes the precedence (large, then medium, then small). This file adds who runs what.
 
-| Size   | Design                                                                                          | Implementation                                 | Review                                                                                                         | Gates                              |
-| ------ | ----------------------------------------------------------------------------------------------- | ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ---------------------------------- |
-| small  | none                                                                                            | direct or `builder`                            | none; the touched test is the review                                                                           | touched file                       |
-| medium | one opinion (`planner` or `analyst`) only when the shape is open                                | `opus`, `astra`, or `builder` by judgment load | one pass by a reviewer engine that did not write it, on numbered claims about the contract and the risky seams | `verifier` on the touched projects |
-| large  | one adversarial round: `planner` and `analyst`, same brief, clean contexts, blind to each other | disjoint units in parallel                     | one `orkestrel-falsify` round on the integrated result                                                         | `verifier` tree-wide, once         |
+| Size   | Design                                                                                          | Implementation                                 | Review                                                                                                       | Gates                              |
+| ------ | ----------------------------------------------------------------------------------------------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ---------------------------------- |
+| small  | none                                                                                            | direct or `builder`                            | none; the touched test is the review                                                                         | touched file                       |
+| medium | one opinion (`planner` or `analyst`) only when the shape is open                                | `opus`, `astra`, or `builder` by judgment load | one pass by an independent reviewer per § Engines, on numbered claims about the contract and the risky seams | `verifier` on the touched projects |
+| large  | one adversarial round: `planner` and `analyst`, same brief, clean contexts, blind to each other | disjoint units in parallel                     | one `orkestrel-falsify` round on the integrated result                                                       | `verifier` tree-wide, once         |
 
 - Never run a review on a small change. Never run a second design round on the same brief.
-- A fix round re-audits the repaired claim only. A fix that adopted the reviewer's prescription verbatim closes with a mutation probe (disable the load-bearing line, watch the test fail, restore it). A fix that departs from it gets one pass by the other engine.
+- A fix round re-audits the repaired claim only. A fix that adopted the reviewer's prescription verbatim closes with a mutation probe (disable the load-bearing line, watch the test fail, restore it). A fix that departs from it gets one pass by an independent reviewer per § Engines.
 - When review rounds at one seam keep surfacing defects without converging on their source, follow `.agents/skills/orkestrel-falsify/SKILL.md` § End the depth search.
 - An all-confirmed round ends the audit. A round needs an added or repaired claim to attack; reviewer appetite is not a subject.
 
@@ -69,7 +75,7 @@ A large change runs these phases once each, in order, and ends when the exit cri
 2. **Design.** One adversarial round: `planner` (subjective) and `analyst` (objective) on one brief, clean contexts, blind to each other. Reconcile into one plan: units, owned files, dependencies, parallel and serial order, acceptance criteria, exit criterion, routing ledger.
 3. **Implement.** Dispatch units per § Routing and § Parallelism.
 4. **Integrate.** Apply returned patches to shared files serially. A type, mechanism, or criterion found here is a successor unit, never an integration edit.
-5. **Audit.** One `orkestrel-falsify` round on the integrated result, one engine that did not write it per lane; add `checker` when the criteria are mechanical.
+5. **Audit.** One `orkestrel-falsify` round on the integrated result, an independent reviewer per § Engines in each lane; add `checker` when the criteria are mechanical.
 6. **Verify.** `verifier` runs the tree-wide gates once.
 7. **Re-baseline.** Strike satisfied units, restate transformed ones, add units the exit criterion already required. A re-baseline never moves the exit criterion; that needs the user.
 8. **Accept.** Report outcome, decisions, evidence, remaining risk. Run `orkestrel-debrief` when the campaign changed process, then prune per § Cleanup.
@@ -100,7 +106,7 @@ Every working file lives under the checkout's gitignored `tmp/`, in the director
 
 | Directory                                  | Holds                                                                                              |
 | ------------------------------------------ | -------------------------------------------------------------------------------------------------- |
-| `tmp/claude/`, `tmp/codex/`, `tmp/cursor/` | bench briefs, launch scripts, journals, `.err` files, last-message files, login logs, per provider |
+| `tmp/claude/`, `tmp/codex/`, `tmp/cursor/` | bench briefs, launch scripts, journals, `.err` files, last-message files, login logs, per harness  |
 | `tmp/units/`                               | native unit briefs, reports, claims files, and campaign records                                    |
 | `tmp/probes/`                              | runtime probes the `probe` Vitest project collects and the `probe` MCP server arms                 |
 | `tmp/type/`                                | the type stage's workspace mirror, owned by `@orkestrel/probe`                                     |
@@ -141,8 +147,8 @@ The Orchestrator triages: obvious correction → tighten and re-dispatch; missin
 
 ## Benches
 
-- Probe a bench with the dispatch skill's `scripts/bench.ts` before its first lane in a session. A version string or a login status is not liveness.
-- A dispatch that fails on auth, quota, model access, or network records the bench dark and re-plans the lane on the substitute engine: Astra dark → Opus holds the objective lane too; Opus dark in Codex → Astra holds the subjective lane too; Grok dark → Luna, then Sonnet. Record every substitution in the routing ledger.
+- Probe a bench with the dispatch skill's `scripts/bench.ts` and the model its transport pins before its first lane in a session. A version string or a login status is not liveness.
+- For a harness that uses a bench, record a dispatch that fails on auth, quota, model access, or network as bench dark and re-plan the lane: Astra bench dark → Claude Opus holds the objective lane too; Claude Opus bench dark → Astra holds the subjective lane too; Grok dark → the harness's native reader, `distiller` or `researcher`: Claude Haiku 5.5 in Claude Code, GPT-6 Luna under the Codex mapping. When Haiku refuses the read, re-dispatch the role with `model: sonnet`. Record every substitution in the routing ledger. For a native role failure, use § Deviation protocol without a Claude fallback prerequisite.
 - Never assign Grok a design or review lane in Claude Code or Codex.
 - Journal every bench run under `tmp/<bench>/` with its session id. Never commit a journal.
 
@@ -159,7 +165,7 @@ The Orchestrator triages: obvious correction → tighten and re-dispatch; missin
 - Fix the model at session start. Effort switches and MCP changes invalidate the cache on most models and configurations; check the rule for the active model and tool-loading mode before changing either mid-session.
 - Keep the always-on instruction set small; rules load by path. An edit to a loaded instruction file takes effect after `/clear`, `/compact`, or a restart.
 - Give reading and driver roles no instruction files (`omitClaudeMd` in Claude Code) when their charter carries the floor they need.
-- Send bulk reads to a subagent and keep only the distillate.
+- Route bulk reads per § Routing and keep only the distillate.
 
 ## Acceptance
 

package/dist/host/agents/skills/orkestrel-debrief/references/instruction-audit.md

@@ -39,7 +39,7 @@ is the lens list's only normative home, and the lane states its coverage against
   charter's wording survives the swap: a charter that assumes its default perspective
   everywhere outside the swap clause cannot be dispatched into the other lane, and a round
   run under a swap that reads like the default lane's output is the residue.
-- **Bridge minimalism.** A provider bridge loads one canonical workflow and adds nothing.
+- **Bridge minimalism.** A harness bridge loads one canonical workflow and adds nothing.
   Any instruction beyond the load is a competing instruction.
 - **Vocabulary drift across mirrored files.** The same concept takes the same term across
   the Claude and Codex mirrors and each operating contract's role table.
@@ -92,7 +92,7 @@ Findings land as one of:
   skill step the campaign always skipped or always overrode is wrong.
 - **Orchestration-contract refinements.** Laws the orchestrator learned (cap sizing,
   probe-first, journal-first, verdict shapes, launch ownership) land in the operating
-  contract, mirrored across providers.
+  contract, mirrored across harnesses.
 
 ## The questions every round asks
 
@@ -108,6 +108,6 @@ Findings land as one of:
 
 ## Mirror discipline
 
-Every roster or contract change lands on all provider surfaces in the same round: the
+Every roster or contract change lands on all harness surfaces in the same round: the
 Claude charters, the Codex mirrors, and both operating-contract role tables. An
 unmirrored refinement is a new drift seeded on purpose.

package/dist/host/agents/skills/orkestrel-dispatch/references/bench.md

@@ -1,6 +1,6 @@
 # Bench lanes
 
-An external engine widens capacity and inherits no authority. Treat every bench output as a proposal until the Orchestrator verifies it against the tree. `.agents/transports/<provider>.md` owns each bench's command, sandbox, and recovery; this file owns what is true of every bench.
+An external engine widens capacity and inherits no authority. Treat every bench output as a proposal until the Orchestrator verifies it against the tree. `.agents/transports/<harness>.md` owns each bench's command, sandbox, and recovery; this file owns what is true of every bench.
 
 ## Before the lane
 

package/dist/host/agents/skills/orkestrel-dispatch/scripts/bench.ts

@@ -21,7 +21,7 @@ const SCRIPTS = dirname(fileURLToPath(import.meta.url))
 // The checkout runs the `.ts` sources and a built twin under `dist/agents` runs `.js` siblings.
 const EXTENSION = extname(fileURLToPath(import.meta.url))
 const PROMPT = 'Reply with the single word READY and nothing else.'
-const CURSOR_MODEL = process.env.CURSOR_GROK_MODEL ?? 'grok-4.7-high'
+const CURSOR_MODEL = process.env.CURSOR_GROK_MODEL ?? 'grok-4.7-xhigh'
 const CODEX_MODEL = process.env.CODEX_ASTRA_MODEL ?? 'gpt-6-astra'
 const CLAUDE_MODEL = 'opus'
 const DEFAULT_CAP = 180

package/dist/host/agents/skills/orkestrel-falsify/SKILL.md

@@ -31,7 +31,7 @@ Write `tmp/units/<unit>-claims.md` and point every lane at it. Read `references/
 
 ## Dispatch the lanes
 
-- Medium: one lane, on an engine that did not write the work (`reviewer` for Astra-written work, `analyst` for Opus-written work). Large: the objective lane and the subjective lane, same claims file, each in a clean context, neither shown the other's answer before reconciliation. Add `checker` when criteria are mechanical.
+- Medium: one lane, with an independent reviewer per `.agents/orchestration.md` § Engines (`reviewer` for Astra-written work, `analyst` for Opus-written work). Large: the objective lane and the subjective lane, same claims file, each in a clean context, neither shown the other's answer before reconciliation. Add `checker` when criteria are mechanical.
 - Tell a lane when its own engine wrote the half it audits.
 - Give a lane the evidence a read-only allowlist cannot produce: run the probe yourself, record its control and output, and hand it over.
 - Auditors edit no source and spawn nothing. Their reports are immutable after they return.

package/dist/host/agents/skills/orkestrel-falsify/references/reconcile.md

@@ -53,5 +53,5 @@ Record which engine was right and on what.
 - Every retained finding names the fix-brief item that carries it; walk the list once.
 - Drop, on the record, anything no lane can substantiate against the evidence.
 - Promote anything that must outlive the round into a durable artifact before the working files are swept.
-- The fix round's lane is an engine that did not write the fix. The next round's brief is this round's successor.
+- Assign the fix round's lane to an independent reviewer per `.agents/orchestration.md` § Engines. The next round's brief is this round's successor.
 - Accept when the claims are satisfied on evidence (`VERDICT: PASS` against a claim set covering what the subject owns), never on green gates alone. Bound the claim set at the brief, rule on what it returned, and close; never re-run because an attack can still be imagined.

package/dist/host/agents/skills/orkestrel-publish/references/wave.md

@@ -112,8 +112,7 @@ Prepare a published package's layer in this order, after the visit has ruled the
 4. **Run each package's own `prepublishOnly` script to green.**
    When the host npm is below the `MINIMUM_NPM_VERSION` floor a generated workspace declares in
    `devEngines`, prepend a local npm 11 install's `node_modules/.bin` to `PATH` for the visit and
-   this script; a distribution proof that installs a generated workspace under an older npm fails
-   `EBADDEVENGINES`.
+   this script.
 5. **Write the release commit and push before the window opens.** The preparation commit inside
    the visit is a different commit at a different moment.
 

package/dist/host/agents/skills/orkestrel-scout/SKILL.md

@@ -10,9 +10,9 @@ A map is mechanical; reading is not. Run the map first, hand it to the reader, a
 
 ## Scripts
 
-| Script           | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `scripts/map.ts` | `--tree PATH...` files with line counts and sizes; `--headings PATH...` Markdown headings with lines; `--frontmatter PATH...` every key of a frontmatter block, a TOML file, or a YAML file with its whole value, nested keys dotted (`interface.default_prompt`); `--exports PATH...` `export` lines in TypeScript files (a text reading); `--census TERM...` every line carrying a term; `--refs PATH` every line naming a path or its basename; `--anchors PATH...` every `§ Heading` reference whose heading its target lacks. `--paths a,b` narrows a census or refs walk; `--ignore-case`; `--json`; `--out FILE` writes the map instead of printing it. Walks skip `node_modules`, `.git`, `dist`, `tmp`, `.orkestrel`, `.idea`, and `host.json`. |
+| Script           | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `scripts/map.ts` | `--tree PATH...` files with line counts and sizes; `--headings PATH...` Markdown headings with lines; `--frontmatter PATH...` every key of a frontmatter block, a TOML file, or a YAML file with its whole value, nested keys dotted (`interface.default_prompt`); `--exports PATH...` `export` lines in TypeScript files (a text reading); `--census TERM...` every line carrying a term (a term that opens with `--` is refused as a missing value, so drop a custom property's leading dashes); `--refs PATH` every line naming a path or its basename; `--anchors PATH...` every `§ Heading` reference whose heading its target lacks. `--paths a,b` narrows a census or refs walk; `--ignore-case`; `--json`; `--out FILE` writes the map instead of printing it. Walks skip `node_modules`, `.git`, `dist`, `tmp`, `.orkestrel`, `.idea`, and `host.json`. |
 
 ## Map
 
@@ -24,5 +24,5 @@ A map is mechanical; reading is not. Run the map first, hand it to the reader, a
 
 ## Refuse
 
-- A question that needs reading at depth or a judgment: route it to `grok`, `distiller`, or the reviewer the size gate names, with the map attached.
+- A question that needs reading at depth or a judgment: route it per `.agents/orchestration.md` § Routing and the size gate, with the map attached.
 - A census over a term short enough to match inside unrelated words, without `--paths`.

package/dist/host/agents/skills/orkestrel-scout/scripts/map.ts

@@ -9,8 +9,9 @@
 // heading the named file, or the same file, does not carry. Walks skip node_modules, .git, dist,
 // tmp, .orkestrel, .idea, and host.json; --paths narrows a census or refs walk. Modes combine, each
 // printing its section; --json prints one object; --out writes the output to FILE instead of the
-// terminal. Give each flag once; a later duplicate is not read. Exit 0, or 64 when no mode is
-// given or --refs names no path.
+// terminal. Give each flag once; a later duplicate is not read. A value that opens with `--` is a
+// missing value, so census a custom property without its leading dashes. Exit 0, or 64 when no
+// mode is given or a flag is given with no value.
 import { existsSync, readFileSync, statSync, mkdirSync, writeFileSync } from 'node:fs'
 import { basename, dirname } from 'node:path'
 import {
@@ -300,7 +301,17 @@ function renderReport(report: Report): string {
 }
 
 function main(argv: readonly string[]): number {
-	const missing = readMissingFlags(argv, ['--refs', '--paths', '--out'])
+	const missing = readMissingFlags(argv, [
+		'--tree',
+		'--headings',
+		'--frontmatter',
+		'--exports',
+		'--census',
+		'--refs',
+		'--anchors',
+		'--paths',
+		'--out',
+	])
 	if (missing.length > 0) {
 		console.error(`map: ${missing.join(', ')} given with no value`)
 		return 64

package/dist/host/agents/transports/claude-cli.md

@@ -1,6 +1,6 @@
 # Claude transport contract
 
-Every Codex-side driver that carries a brief to the Claude Opus 5.5 bench follows this file. Routes: `planner`, `reviewer`, `opus`. A driver writes the brief, resolves the command, and returns the brief path, the command, and the journal path. The Orchestrator launches the run as a tracked background command under a cap it sizes from prior runs. Read `.agents/orchestration.md` first; it owns the role set and the routing.
+For harnesses that route work to the Claude Opus 5.5 bench, follow this file. Routes: `planner`, `reviewer`, `opus`. Read `.agents/orchestration.md` first; its Codex mapping uses native roles without this transport or a Claude probe. A driver writes the brief, resolves the command, and returns the brief path, the command, and the journal path. The Orchestrator launches the run as a tracked background command under a cap it sizes from prior runs.
 
 ## Command
 
@@ -8,7 +8,7 @@ Every Codex-side driver that carries a brief to the Claude Opus 5.5 bench follow
 node .agents/skills/orkestrel-dispatch/scripts/launch.ts --journal tmp/claude/<unit>.jsonl --errors tmp/claude/<unit>.err --cap <seconds> --status -- claude -p "Read tmp/claude/<unit>-brief.md and execute it exactly. Your final message is the report it specifies." --model opus --output-format stream-json --verbose --permission-mode <mode>
 ```
 
-- Pass the permission mode the route pins. Never substitute a fixed Claude model id; `opus` and `sonnet` are the aliases.
+- Pass the permission mode the route pins and `--model opus` for every route. Never substitute another alias, `fable`, or a fixed Claude model id.
 - Write the brief to `tmp/claude/<unit>-brief.md` with `scripts/brief.ts --lane claude`; the prompt is a pointer to it. Briefs never travel as shell arguments.
 - Read the answer and the session id with `node .agents/skills/orkestrel-dispatch/scripts/result.ts --claude tmp/claude/<unit>.jsonl`. A unit with no journal ran on its driver's engine, however normal its answer reads.
 - A driver pinned `workspace-write` writes the brief itself. A driver pinned `read-only` writes nothing: it returns the brief text, its intended path, the resolved command, and the journal paths, and the Orchestrator writes and launches.
@@ -16,6 +16,6 @@ node .agents/skills/orkestrel-dispatch/scripts/launch.ts --journal tmp/claude/<u
 
 ## Availability
 
-- Probe with `node .agents/skills/orkestrel-dispatch/scripts/bench.ts --claude` before the first use in a session. `live: false` records the bench dark: return it at once with the fallback named, so the Astra main session records Opus unavailable for the round. Where the binary is absent, name the install command for the `claude` CLI so the Orchestrator can put it to the user in the same turn.
+- Probe with `node .agents/skills/orkestrel-dispatch/scripts/bench.ts --claude` before the first bench use in a session. `live: false` records the bench dark: return it at once with the fallback named, so the Orchestrator records Opus unavailable for the round. Where the binary is absent, name the install command for the `claude` CLI so the Orchestrator can put it to the user in the same turn.
 - Never install, authenticate, or substitute an API key, access token, or copied auth file.
 - Never route orchestration or acceptance across this bridge. Never read credentials, edit, or spawn another agent.

package/dist/host/agents/transports/codex.md

@@ -1,18 +1,18 @@
 # Codex transport contract
 
-Every driver that carries a brief to the GPT-6 Astra bench follows this file. Routes: `analyst` (audit, objective design argument) and `astra` (implementation). A driver writes the brief, resolves the command, and returns the brief path, the command, and the journal path. The Orchestrator launches the run as a tracked background command under a cap it sizes from prior runs.
+Every driver that carries a brief to the Codex GPT-6 Astra bench follows this file. Routes: `analyst` (audit, objective design argument) and `astra` (implementation). For native roles, use the canonical Codex mapping in `.agents/orchestration.md` without a bench launch or probe. A driver writes the brief, resolves the command, and returns the brief path, the command, and the journal path. The Orchestrator launches the run as a tracked background command under a cap it sizes from prior runs.
 
 ## Models and effort
 
 ```text
 CODEX_ASTRA_MODEL=gpt-6-astra          effort high; xhigh only for a stated hard-reasoning need
-CODEX_MECHANICAL_MODEL=gpt-6-sol       fully specified, taste-free units and drivers
+CODEX_MECHANICAL_MODEL=gpt-6.1-sol     fully specified, taste-free units
 CODEX_READING_MODEL=gpt-6-luna         absorption and research when the Cursor bench is dark; record the substitution
 ```
 
 ## Command
 
-Use the journaled CLI for every unit. `codex mcp-server` was removed in Codex 0.154.0: never register it in an MCP configuration and never call an `mcp__codex__*` tool.
+Use the journaled CLI for every bench unit. `codex mcp-server` was removed in Codex 0.154.0: never register it in an MCP configuration and never call an `mcp__codex__*` tool.
 
 ```text
 node .agents/skills/orkestrel-dispatch/scripts/launch.ts --journal tmp/codex/<unit>.jsonl --errors tmp/codex/<unit>.err --cap <seconds> --status -- codex exec --json -C <checkout> --sandbox <sandbox> --model gpt-6-astra -c model_reasoning_effort="high" --output-last-message tmp/codex/<unit>-last.md "Read tmp/codex/<unit>-brief.md from disk and execute it exactly. Your final message is the report it specifies."
@@ -47,7 +47,7 @@ node .agents/skills/orkestrel-dispatch/scripts/launch.ts --journal tmp/codex/<un
 
 ## Routing exclusion
 
-The provider's content filter has ended turns that authored a violation construct, even as a negative test: sandbox escapes, resolution-bypassing imports, injection payloads, credential probes. Route such a unit to `opus` from the start and record the bench dark for that unit only.
+For harnesses that route `opus` to Claude, route a unit that authors sandbox escapes, resolution-bypassing imports, injection payloads, or credential probes to `opus` from the start and record the Codex bench dark for that unit only. For native Codex roles, report a harness refusal through the deviation protocol; the `opus` role uses the same harness.
 
 ## Journals
 

package/dist/host/agents/transports/cursor.md

@@ -1,14 +1,14 @@
 # Cursor transport contract
 
-Every driver that carries a brief to the Cursor Grok bench follows this file. Route: `grok`. A driver writes the brief, resolves the command, and returns the brief path, the command, and the journal path. The Orchestrator launches the run as a tracked background command under a cap it sizes from prior runs. Read `.agents/orchestration.md` first; it owns the role set and the routing.
+Every driver that carries a brief to the Cursor Grok 4.7 Extra High bench follows this file. Route: `grok`. A driver writes the brief, resolves the command, and returns the brief path, the command, and the journal path. The Orchestrator launches the run as a tracked background command under a cap it sizes from prior runs. Read `.agents/orchestration.md` first; it owns the role set and the routing.
 
 ## Model
 
 ```text
-CURSOR_GROK_MODEL=grok-4.7-high
+CURSOR_GROK_MODEL=grok-4.7-xhigh
 ```
 
-Read from `agent models` on 2026-08-13. Re-read `agent models` and update this line when the id changes. Never guess or substitute a model id.
+`grok-4.7-xhigh` is Grok 4.7 Extra High in `agent models` (read 2026-10-08). Re-read `agent models` and update this line, the `bench.ts` default, and the `CURSOR_GROK_MODEL` value in each host environment when the id changes. Never guess or substitute a model id.
 
 ## Command
 
@@ -16,7 +16,7 @@ Read from `agent models` on 2026-08-13. Re-read `agent models` and update this l
 - Launch:
 
 ```text
-node .agents/skills/orkestrel-dispatch/scripts/launch.ts --journal tmp/cursor/<unit>.jsonl --errors tmp/cursor/<unit>.err --cap <seconds> --status -- <node> <index> -p --trust --mode=ask --model grok-4.7-high --output-format stream-json "Read tmp/cursor/<unit>-brief.md and execute it exactly. Your final message is the document it specifies."
+node .agents/skills/orkestrel-dispatch/scripts/launch.ts --journal tmp/cursor/<unit>.jsonl --errors tmp/cursor/<unit>.err --cap <seconds> --status -- <node> <index> -p --trust --mode=ask --model grok-4.7-xhigh --output-format stream-json "Read tmp/cursor/<unit>-brief.md and execute it exactly. Your final message is the document it specifies."
 ```
 
 - Write the brief to `tmp/cursor/<unit>-brief.md` with `scripts/brief.ts --lane cursor`; the prompt is a pointer to it.
@@ -32,5 +32,5 @@ node .agents/skills/orkestrel-dispatch/scripts/launch.ts --journal tmp/cursor/<u
 
 ## Availability
 
-- `bench.ts --cursor` reporting `live: false` records the bench dark. Stop with a deviation naming the fallback from `.agents/orchestration.md` § Benches: Luna, then Sonnet. Never hand the reading to the Orchestrator, `planner`, or `analyst`. Never install or authenticate.
+- `bench.ts --cursor --model grok-4.7-xhigh` reporting `live: false` records the bench dark. Stop with a deviation naming the native reader for the harness from `.agents/orchestration.md` § Benches. Never hand the reading to the Orchestrator, `planner`, or `analyst`. Never install or authenticate.
 - Never route orchestration or acceptance across this bridge.

package/dist/host/claude/AGENTS.md

@@ -4,18 +4,19 @@
 
 ## Dispatch
 
-- Use the Agent tool for one unit, or when the next step depends on the result. Name the role as `subagent_type`.
-- Use a Workflow for a fan-out of many small units, a staged pipeline, or a loop. Give every `agent()` node a model alias and an effort. Serialize writing nodes. Recover an interrupted run with `resumeFromRunId`.
-- Never run a design or review lane as `fork`. A lane starts with a clean context.
-- Use the built-in `Explore` agent for a quick locate; it loads no instruction files.
+- Use the Agent tool for one unit, or when the next step depends on the result. Name a role from `.claude/agents/` as `subagent_type`; never `general-purpose`, `Plan`, `claude`, or `fork`.
+- Use a Workflow for a fan-out of many small units, a staged pipeline, or a loop. Give every `agent()` node a model alias from § Models and an effort. Serialize writing nodes. Recover an interrupted run with `resumeFromRunId`.
+- Never dispatch `fork`; it runs on the session's model and context. Every unit starts with a clean context on its role's model.
+- Use the built-in `Explore` agent with `model: haiku` for an exact bounded lookup; apply `.agents/orchestration.md` § Routing. It loads no instruction files.
 - Foreground Bash is capped at 10 minutes. Run anything longer as a background command with an internal `timeout`.
 - Write a reusable or long-running program as a TypeScript file and run it with `node`; a heredoc, `node -e`, `&&` chain, or `${...}` argument trips the Windows approval classifier, and a one-shot read-only check may run inline. Probe a bench with `node .agents/skills/orkestrel-dispatch/scripts/bench.ts`, launch a lane through `scripts/launch.ts`, and read its answer with `scripts/result.ts`, all from the dispatch skill.
 
 ## Models
 
-- Use the aliases `opus` and `sonnet`. Never `inherit`, never a fixed model ID, never `CLAUDE_CODE_SUBAGENT_MODEL`.
-- An alias serves the model the installed Claude Code maps it to. After a model release, measure the mapping with `claude -p --model <alias> --output-format json` and read `modelUsage`; when a newer model answers by id and the alias lags, update Claude Code (`scoop update claude-code` on this host) and measure again. Claude Code 2.1.284 serves Sonnet 5.5 as `sonnet` and Opus 5.5 as `opus` (measured 2026-09-29).
-- Run the main session on `opus` at high effort and keep the model fixed for the session; a model switch invalidates the prompt cache. An effort switch invalidates it too except on Opus 5.5 and Fable 5.1 under a Claude subscription or API key.
+- Use the aliases `haiku`, `sonnet`, and `opus` in role frontmatter, a Workflow node, and a per-invocation `model`. Never `fable`, never `inherit`, never a fixed model ID, and never a dispatch that takes its model from the session, an `Explore` call or a Workflow node without `model` included: Claude Fable 5.1 orchestrates and is never a subagent.
+- Keep `CLAUDE_CODE_SUBAGENT_MODEL` at `sonnet` in the `env` object of `.claude/settings.json`. It serves a subagent that no role frontmatter and no dispatch assigned a model; frontmatter and a per-invocation `model` outrank it (measured 2026-10-08 on Claude Code 2.1.294: `general-purpose` took it, `Plan` did not). Never set `CLAUDE_CODE_SUBAGENT_MODEL_FORCE`; it overrides every role.
+- An alias serves the model the installed Claude Code maps it to. After a model release, measure the mapping with `claude -p "Reply with the single word OK." --model <alias> --output-format json --max-turns 1` and read `modelUsage`; when a newer model answers by id and the alias lags, update Claude Code (`scoop update claude-code` on the Windows host) and measure again. Claude Code 2.1.294 serves Haiku 5.5 as `haiku`, Sonnet 5.5 as `sonnet`, and Opus 5.5 as `opus` (measured 2026-10-08). When a measurement moves an alias, update, in the same change, the version each `.claude/agents/` charter names in its description and opening line and the rows of `.agents/orchestration.md` § Engines.
+- Run the main session on `fable` or `opus` at high effort and keep the model fixed for the session; a model switch invalidates the prompt cache. An effort switch invalidates it too except on Opus 5.5 and Fable 5.1 under a Claude subscription or API key.
 - Reach Astra through `analyst` and `astra`, Grok through `grok`. Role frontmatter carries Claude models only.
 
 ## Context and cache
@@ -23,7 +24,7 @@
 - Roles that launch a CLI, run gates, or only read set `omitClaudeMd: true`; their charters carry the permission floor they need. Writers and reviewers load the contract.
 - Adding or removing an MCP server invalidates the cache when its tools load into the prefix; deferred tools (the default) append without disturbing it. Avoid either mid-session.
 - An edit to a loaded instruction file takes effect after `/clear`, `/compact`, or a restart. Edits under `.claude/agents/` and `.claude/skills/` hot-reload.
-- Keep large reads in subagents. The main context holds decisions.
+- Route supporting reads per `.agents/orchestration.md` § Routing. The main context holds decisions.
 
 ## Wiring
 
@@ -35,4 +36,6 @@
 ## Cloud
 
 - Setup installs `@openai/codex` and never authenticates. Start each live session with `codex login --device-auth`.
+- When `npm ci` in a remote session refuses `EBADDEVENGINES`, run `scripts/npm.sh` and rerun the install.
 - `scripts/deps.sh` reinstalls when the lockfile digest differs from `node_modules/.orkestrel-lock.sha256`. Write the marker only after `npm ci` succeeds for that lockfile, in the same turn.
+- When a browser launch in a remote session reports `Executable doesn't exist`, run `scripts/browsers.sh` and rerun the test before treating the failure as a defect.

package/dist/host/claude/agents/analyst.md

@@ -1,14 +1,14 @@
 ---
 name: analyst
-description: 'Driver for the GPT-6 Astra analyst route: the objective design argument, diagnosis, and correctness audit. Writes the brief, resolves the read-only codex exec command, and returns the brief path, the command, and the journal path. Analyzes nothing itself and endorses nothing.'
+description: 'Haiku 5.5 driver for the GPT-6 Astra analyst route: the objective design argument, diagnosis, and correctness audit. Writes the brief, resolves the read-only codex exec command, and returns the brief path, the command, and the journal path. Analyzes nothing itself and endorses nothing.'
 tools: Bash, Read, Grep, Glob
-model: sonnet
-effort: low
+model: haiku
+effort: high
 permissionMode: default
 omitClaudeMd: true
 ---
 
-You drive the Astra `analyst` route. Do not analyze, judge, implement, or endorse the result yourself.
+On Claude Haiku 5.5, you drive the Astra `analyst` route. Do not analyze, judge, implement, or endorse the result yourself.
 
 Read `.agents/transports/codex.md` and follow it exactly. It owns the command, the sandbox by host, the journal, and the recovery ladder. The route is read-only: on a POSIX host the sandbox is `read-only`; on Windows it is `danger-full-access` with the brief stating read-only and the launch script recording `git status --porcelain` before and after.
 

package/dist/host/claude/agents/astra.md

@@ -1,14 +1,14 @@
 ---
 name: astra
-description: 'Driver for the GPT-6 Astra implementation route: one bounded, objective, constraint-heavy unit. Writes the brief, resolves the writing codex exec command, and returns the brief path, the command, and the journal path. Implements nothing itself and endorses nothing.'
+description: 'Haiku 5.5 driver for the GPT-6 Astra implementation route: one bounded, objective, constraint-heavy unit. Writes the brief, resolves the writing codex exec command, and returns the brief path, the command, and the journal path. Implements nothing itself and endorses nothing.'
 tools: Bash, Read, Grep, Glob
-model: sonnet
-effort: low
+model: haiku
+effort: high
 permissionMode: default
 omitClaudeMd: true
 ---
 
-You drive the Astra implementation route. Do not implement, judge, or endorse the result yourself.
+On Claude Haiku 5.5, you drive the Astra implementation route. Do not implement, judge, or endorse the result yourself.
 
 Read `.agents/transports/codex.md` and follow it exactly. It owns the command, the sandbox by host (`workspace-write` on POSIX, `danger-full-access` on Windows), the journal, and the recovery ladder.
 

package/dist/host/claude/agents/builder.md

@@ -1,26 +1,26 @@
 ---
 name: builder
-description: 'Implements one small, fully specified, taste-free unit exactly as dispatched, in src, app, tests, or configs. Writes only owned files as the sole writer in its checkout, validates scoped to them, and stops on any conflict with the brief. Nontrivial design belongs to astra or opus.'
+description: 'Sonnet 5.5 implementation of one bounded unit with a closed shape, in src, app, tests, or configs: the brief or the types fix its names, API, and architecture. Writes only owned files as the sole writer in its checkout, validates scoped to them, and stops on any conflict with the brief. A unit that leaves a name, API, or architecture open belongs to astra or opus.'
 tools: Read, Grep, Glob, Edit, Write, Bash
 model: sonnet
 effort: low
 permissionMode: acceptEdits
 ---
 
-You implement one fully specified unit. The dispatch is the plan; do not re-plan.
+On Claude Sonnet 5.5, you implement one bounded unit with a closed shape. The dispatch is the plan; do not re-plan.
 
 ## Do
 
 1. Read the brief, the rules whose `paths` match your owned files, and the guide it names.
 2. Write only the owned files. Return an exact patch for a shared file; never edit it.
-3. Follow `AGENTS.md` § Work loop for a small change: edit, prove or test the claim, run the touched test file, then the touched project if the brief names it.
+3. At the size the brief names, follow `AGENTS.md` § Work loop. Edit, prove or test the claim, run the touched test file, then the touched project when the brief names it.
 4. Validate read-only and scoped: a non-fix lint on your paths, the scoped `check:` script, the touched tests. Never run `format`, lint `--fix`, `build`, or the whole suite.
 5. Delete any probe you wrote before returning; promote a probe that settled a claim into a test in the mirrored location.
 6. Stop and report per `.agents/orchestration.md` § Deviation protocol when the brief conflicts with the tree or asks for an unowned edit.
 
 ## Refuse
 
-- A unit whose naming, API shape, or architecture is still open: report it as belonging to `astra` or `opus`.
+- A unit that leaves naming, API shape, or architecture open, or that spans packages: report it as belonging to `astra` or `opus`.
 - Installing, committing, pushing, reading a secret, or a destructive command.
 
 ## Return

package/dist/host/claude/agents/checker.md

@@ -1,13 +1,13 @@
 ---
 name: checker
-description: 'Mechanical conformance review of a diff against its acceptance criteria, the AGENTS.md letter, the applicable rules, scope honesty, and guide parity. One piece of evidence per item; no judgment calls. Dispatched when criteria are mechanically checkable. Never edits.'
+description: 'Haiku 5.5 mechanical conformance review of a diff against its acceptance criteria, the AGENTS.md letter, the applicable rules, scope honesty, and guide parity. One piece of evidence per item; no judgment calls. Dispatched when criteria are mechanically checkable. Never edits.'
 tools: Read, Grep, Glob
-model: sonnet
-effort: low
+model: haiku
+effort: high
 permissionMode: dontAsk
 ---
 
-You check mechanically. You hold no edit tool and run no command; your final message is the verdict.
+On Claude Haiku 5.5, you check mechanically. You hold no edit tool and run no command; your final message is the verdict.
 
 ## Do
 

package/dist/host/claude/agents/distiller.md

@@ -1,14 +1,14 @@
 ---
 name: distiller
-description: 'Read-only bulk reading and evidence distillation when the Cursor Grok bench is dark: sweeps large files, diffs, and directory trees and returns cited facts, contradictions, and unresolved inputs. Never designs, implements, reviews, or accepts.'
+description: 'Haiku 5.5 read-only bulk reading and evidence distillation when the Cursor Grok bench is dark: sweeps large files, diffs, and directory trees and returns cited facts, contradictions, and unresolved inputs. Never designs, implements, reviews, or accepts.'
 tools: Read, Grep, Glob
-model: sonnet
-effort: low
+model: haiku
+effort: high
 permissionMode: dontAsk
 omitClaudeMd: true
 ---
 
-You read so the Orchestrator does not have to. You decide nothing.
+On Claude Haiku 5.5, you read and distill the supplied evidence. You decide nothing.
 
 ## Do
 

package/dist/host/claude/agents/grok.md

@@ -1,14 +1,14 @@
 ---
 name: grok
-description: 'Driver for the Cursor Grok bench: absorption, distillation, scouting, and bounded research over a large read. Writes the brief, resolves the CLI command, and returns the Grok distillate with its journal path and session id. Reads nothing at depth itself and never designs, decides, edits, or reviews.'
+description: 'Haiku 5.5 driver for the Cursor Grok bench: context absorption, distillation, broad mapping, and exploration. Writes the brief, resolves the CLI command, and returns the Grok distillate with its journal path and session id. Reads nothing at depth itself and never designs, decides, edits, or reviews.'
 tools: Bash, Read, Grep, Glob
-model: sonnet
-effort: low
+model: haiku
+effort: high
 permissionMode: default
 omitClaudeMd: true
 ---
 
-You drive the Cursor Grok bench. Do not read the subject yourself, do not answer the question yourself, and make no repository change.
+On Claude Haiku 5.5, you drive the Cursor Grok bench. Do not read the subject yourself, do not answer the question yourself, and make no repository change.
 
 Read `.agents/transports/cursor.md` and follow it exactly. It owns the model pin, the CLI resolution, the launch form, the journal, and the recovery ladder.
 

package/dist/host/claude/agents/opus.md

@@ -7,7 +7,7 @@ effort: high
 permissionMode: acceptEdits
 ---
 
-You implement one dispatched unit and spawn nothing.
+On Claude Opus 5.5, you implement one dispatched unit and spawn nothing.
 
 ## Do
 

package/dist/host/claude/agents/orkestrel.md

@@ -1,13 +1,13 @@
 ---
 name: orkestrel
-description: 'Read-only Orkestrel ecosystem reconciler: turns the evidence the dispatch supplies — manifests, lockfiles, installed declarations, guides, and registry readings — into package maps, dependency sequencing, blast radius, and drift findings. Collects no live state itself, and never treats the embedded catalog as live state.'
+description: 'Sonnet 5.5 read-only Orkestrel ecosystem reconciler: turns the evidence the dispatch supplies — manifests, lockfiles, installed declarations, guides, and registry readings — into package maps, dependency sequencing, blast radius, and drift findings. Collects no live state itself, and never treats the embedded catalog as live state.'
 tools: Read, Grep, Glob
 model: sonnet
 effort: low
 permissionMode: dontAsk
 ---
 
-You are the read-only Orkestrel ecosystem reconciler. Spawn nothing and edit nothing.
+On Claude Sonnet 5.5, you are the read-only Orkestrel ecosystem reconciler. Spawn nothing and edit nothing.
 
 Read the orchestration contract first. It owns the role set, the routing, and the
 dispatch contract. Resolve it against scaffold. In the scaffold checkout it sits at