@shiwenbin1617/pstack 0.14.4

package/scripts/host-adapters.mjs

@@ -0,0 +1,128 @@
+import { mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+const CODEX_TRANSCRIPT = "`~/.codex/sessions/<yyyy>/<mm>/<dd>/rollout-*.jsonl`, filtered by the session metadata `cwd` for the active workspace";
+const CLAUDE_TRANSCRIPT = "`~/.claude/projects/<slug>/<uuid>.jsonl`, where `<slug>` is the absolute workspace path with every `/` changed to `-`";
+
+const CLAUDE_TRANSCRIPT_PARAGRAPH = /On Claude Code that is `~\/\.claude\/projects\/<slug>\/<uuid>\.jsonl`, where `<slug>` is[^.]*\.[\s\S]*?On Codex it is `~\/\.codex\/sessions\/<yyyy>\/<mm>\/<dd>\/rollout-\*\.jsonl`, which is not partitioned by workspace, so filter by the session's own cwd\./g;
+
+function stripUnsupportedFrontmatter(text) {
+  const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text);
+  if (!match) return text;
+
+  const kept = match[1]
+    .split(/\r?\n/)
+    .filter((line) => /^(name|description|metadata):/.test(line) || /^\s+/.test(line));
+  return `---\n${kept.join("\n")}\n---\n\n${text.slice(match[0].length)}`;
+}
+
+function replaceSkillInvocations(text, skillNames) {
+  const names = [...skillNames].sort((a, b) => b.length - a.length).join("|");
+  const invocation = new RegExp("/(?:" + names + ")(?=[\\s`,.)'\"]|$)", "g");
+  return text.replace(invocation, (value) => `$${value.slice(1)}`);
+}
+
+function adaptCodexVocabulary(text) {
+  return text
+    .replace(CLAUDE_TRANSCRIPT_PARAGRAPH, `On Codex, transcripts live at ${CODEX_TRANSCRIPT}`)
+    .replace(/Transcripts live at `~\/\.claude\/projects\/<slug>\/<uuid>\.jsonl`[^\n]*/g, `Transcripts live at ${CODEX_TRANSCRIPT}. Scope every search to the active workspace.`)
+    .replace(/ls -t ~\/\.claude\/projects\/"\$\(pwd \| tr \/ -\)"\/\*\.jsonl 2>\/dev\/null \| head -10/g, "find ~/.codex/sessions -name 'rollout-*.jsonl' -type f -print")
+    .replace(/On Claude Code that is `subagent_type: Explore`\.?/g, "On Codex, use a custom agent with `sandbox_mode = \"read-only\"`.")
+    .replace(/using the Task tool/g, "using Codex subagent tools")
+    .replace(/Task tool's error message/g, "subagent tool's validation error")
+    .replace(/through the Task tool/g, "through Codex subagent tools")
+    .replace(/`run_in_background: true`/g, "concurrently")
+    .replace(/the `AskQuestion` tool \(structured multi-choice\)/g, "Codex's structured-question tool")
+    .replace(/About to `AskQuestion`/g, "About to ask the user with the structured-question tool")
+    .replace(/`AskQuestion`/g, "the structured-question tool")
+    .replace(/AskQuestion/g, "structured-question")
+    .replace(/\.claude\/skills\/<handle>\/\*\/` and `~\/\.claude\/skills\/<handle>\/\*\/` on Claude Code, `\.agents\/skills\/<handle>\/\*\/` and `~\/\.agents\/skills\/<handle>\/\*\/` on Codex/g, ".agents/skills/<handle>/*/` and `~/.agents/skills/<handle>/*/`")
+    .replace(/\.claude\/skills\/verify-<app>\/` \(`\.agents\/skills\/verify-<app>\/` on Codex\)/g, ".agents/skills/verify-<app>/`")
+    .replace(/`\.claude\/skills\/` \(`\.agents\/skills\/` on Codex\)/g, "`.agents/skills/`")
+    .replace(/usually `\.claude\/skills\/verify-\*\/`, or `\.agents\/skills\/verify-\*\/` on Codex/g, "usually `.agents/skills/verify-*/`")
+    .replace(/project `\.claude\/skills\/` or `\.agents\/skills\/`, user-level `~\/\.claude\/skills\/` or `~\/\.agents\/skills\/`, or plugin-installed paths under `~\/\.claude\/plugins\/`/g, "project `.agents/skills/` or user-level `~/.agents/skills/`")
+    .replace(/~\/\.claude\/skills\//g, "~/.agents/skills/")
+    .replace(/\.claude\/skills\//g, ".agents/skills/")
+    .replace(/\.claude\/worktrees\//g, ".codex/worktrees/")
+    .replace(/under `~\/\.claude\/projects\/<slug>\/`/g, `under ${CODEX_TRANSCRIPT}`)
+    .replace(/`environment: "cloud"`/g, "a cloud session only when Codex explicitly exposes one; otherwise use a local subagent")
+    .replace(/a real terminal `\/loop`/g, "Codex's available recurring-monitoring mechanism")
+    .replace(/the `\/loop` skill \(your harness's, not a pstack skill\)/g, "Codex's available recurring-monitoring or wait mechanism")
+    .replace(/under `\/loop` in dynamic mode/g, "with Codex's recurring-monitoring mechanism")
+    .replace(/`\/loop` per component/g, "repeat per component with the available monitoring mechanism")
+    .replace(/with the `\/loop` skill/g, "with Codex's available monitoring mechanism")
+    .replace(/\/loop/g, "a monitored loop")
+    .replace(/cloud-sleeper wake chain/g, "Codex long-running goal mechanism")
+    .replace(/monitored-shell 30-minute sleep and emits an output-notification sentinel/g, "recurring monitor with a 30-minute heartbeat")
+    .replace(/\/~\/\.claude\/CLAUDE\.md/g, "~/.codex/AGENTS.md")
+    .replace(/Claude Code/g, "Codex")
+    .replace(/pstack model config(?!uration)/g, "Codex pstack model config at `~/.codex/pstack-models.md`")
+    .replace(/\*\*Just do it\.\*\* Use any MCP tool\. Reversible work and external actions \(team chat, ticket updates, kicking off evals\) proceed without asking\./g, "**Respect the active authorization boundary.** Proceed with reversible local work. External writes, commits, pushes, PR changes, messages, and production actions require explicit scope and the host's approval rules.")
+    .replace(/- Broken skill mid-task → fix it in its own PR\. Don't block\. Don't silently work around it\./g, "- Broken skill mid-task → report and fix it locally when in scope. Open a separate PR only when the user authorized PR creation.")
+    .replace(/, and open a separate PR to update the configured value or default table/g, ", and report that the configured value needs updating")
+    .replace(/Commit it when stakes need an auditable record; keep it local otherwise\./g, "Keep it local unless the user explicitly authorized a commit.")
+    .replace(/Frontmatter `disable-model-invocation: true` by default\. Mode skills are heavy and opinionated; they should only apply when the user explicitly invokes them \(by name or slash command\), not auto-trigger on description matching\. Opt out only if the user explicitly wants their mode to apply on every turn\./g, "Add `agents/openai.yaml` with `policy.allow_implicit_invocation: false` by default. Mode skills are heavy and opinionated; they should apply only when the user explicitly invokes `$<name>`. Enable implicit invocation only when the user explicitly requests it.");
+}
+
+function adaptClaudeVocabulary(text) {
+  return text
+    .replace(CLAUDE_TRANSCRIPT_PARAGRAPH, `On Claude Code, transcripts live at ${CLAUDE_TRANSCRIPT}.`)
+    .replace(/\(`\.agents\/skills\/verify-<app>\/` on Codex\)/g, "")
+    .replace(/ \(`\.agents\/skills\/` on Codex\)/g, "")
+    .replace(/, or `\.agents\/skills\/verify-\*\/` on Codex/g, "")
+    .replace(/`\.claude\/skills\/` and `~\/\.claude\/skills\/` on Claude Code, `\.agents\/skills\/` and `~\/\.agents\/skills\/` on Codex/g, "`.claude/skills/` and `~/.claude/skills/`")
+    .replace(/project `\.claude\/skills\/` or `\.agents\/skills\/`, user-level `~\/\.claude\/skills\/` or `~\/\.agents\/skills\/`, or plugin-installed paths under `~\/\.claude\/plugins\/`/g, "project `.claude/skills/`, user-level `~/.claude/skills/`, or plugin-installed paths under `~/.claude/plugins/`")
+    .replace(/\. Every line is one chat message\. Scope to this workspace; never sweep the whole store, that reads private chats from unrelated projects/g, ". Scope to this workspace; never sweep unrelated projects")
+    .replace(/ \(`\.agents\/skills\/verify-<app>\/` on Codex\)/g, "")
+    .replace(/ \(`\.agents\/skills\/` on Codex\)/g, "");
+}
+
+function adaptRuntimeForHost(text, host) {
+  if (host === "claude") {
+    return text
+      .replace(/# Search only host-native transcript stores\. The worktree path match below keeps\n# Codex's global date-partitioned store scoped to this repository\./, "# Search only the Claude Code transcript store for this repository.")
+      .replace(/^\[ -d "\$HOME\/\.codex\/sessions" \].*\n/m, "");
+  }
+  return text
+    .replace(/# Search only host-native transcript stores\. The worktree path match below keeps\n# Codex's global date-partitioned store scoped to this repository\./, "# Search Codex's global transcript store and scope matches to this repository.")
+    .replace(/^slug=.*\n/m, "")
+    .replace(/^\[ -d "\$HOME\/\.claude\/projects\/\$slug" \].*\n/m, "");
+}
+
+export function adaptMarkdownForHost(text, { host, skillNames }) {
+  if (host === "claude") return adaptClaudeVocabulary(text);
+  let adapted = stripUnsupportedFrontmatter(text);
+  adapted = replaceSkillInvocations(adapted, skillNames);
+  adapted = adaptCodexVocabulary(adapted);
+  return adapted;
+}
+
+export function writeCodexInvocationPolicy(skillDir, allowImplicitInvocation) {
+  const agentsDir = join(skillDir, "agents");
+  mkdirSync(agentsDir, { recursive: true });
+  writeFileSync(
+    join(agentsDir, "openai.yaml"),
+    `policy:\n  allow_implicit_invocation: ${allowImplicitInvocation ? "true" : "false"}\n`,
+  );
+}
+
+export function adaptCopiedSkillTree(skillDir, { host, skillNames, allowImplicitInvocation, nativeCodex = false }) {
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir)) {
+      const path = join(dir, entry);
+      if (statSync(path).isDirectory()) {
+        walk(path);
+        continue;
+      }
+      if (!path.endsWith(".md") && !path.endsWith("worktree-audit.sh")) continue;
+      const source = readFileSync(path, "utf8");
+      if (path.endsWith(".md")) {
+        writeFileSync(path, adaptMarkdownForHost(source, { host, skillNames }));
+      } else if (path.endsWith("worktree-audit.sh")) {
+        writeFileSync(path, adaptRuntimeForHost(source, host));
+      }
+    }
+  };
+  if (!nativeCodex) walk(skillDir);
+  if (host === "codex") writeCodexInvocationPolicy(skillDir, allowImplicitInvocation);
+}

package/scripts/lib.mjs

@@ -0,0 +1,181 @@
+import { readdirSync, readFileSync, statSync, lstatSync, mkdirSync, rmSync, cpSync, existsSync, realpathSync } from "node:fs";
+import { join, dirname, relative } from "node:path";
+import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { adaptCopiedSkillTree } from "./host-adapters.mjs";
+
+export const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+export const SKILLS_DIR = join(REPO_ROOT, "skills");
+export const AGENTS_DIR = join(REPO_ROOT, "agents");
+export const CODEX_ADAPTER_DIR = join(REPO_ROOT, "adapters", "codex");
+export const CLAUDE_ADAPTER_DIR = join(REPO_ROOT, "adapters", "claude-code");
+
+export const HOSTS = {
+  claude: {
+    label: "Claude Code",
+    skillsDir: (scope) => (scope === "project" ? join(process.cwd(), ".claude", "skills") : join(homedir(), ".claude", "skills")),
+    agentsDir: (scope) => (scope === "project" ? join(process.cwd(), ".claude", "agents") : join(homedir(), ".claude", "agents")),
+    memoryFile: (scope) => (scope === "project" ? join(process.cwd(), "CLAUDE.md") : join(homedir(), ".claude", "CLAUDE.md")),
+    invoke: (name) => `/${name}`,
+  },
+  codex: {
+    label: "Codex",
+    skillsDir: (scope) => (scope === "project" ? join(process.cwd(), ".agents", "skills") : join(homedir(), ".agents", "skills")),
+    agentsDir: (scope) => (scope === "project" ? join(process.cwd(), ".codex", "agents") : join(homedir(), ".codex", "agents")),
+    memoryFile: (scope) => (scope === "project" ? join(process.cwd(), "AGENTS.md") : join(homedir(), ".codex", "AGENTS.md")),
+    invoke: (name) => `$${name}`,
+  },
+};
+
+/** Parse the `name` and `description` out of a SKILL.md's YAML frontmatter. */
+export function parseFrontmatter(text) {
+  const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text);
+  if (!m) return {};
+  const out = {};
+  // Only the two scalar fields pstack relies on; values may be quoted.
+  for (const key of ["name", "description"]) {
+    const km = new RegExp(`^${key}:[ \\t]*(.*)$`, "m").exec(m[1]);
+    if (!km) continue;
+    let v = km[1].trim();
+    if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
+      v = v.slice(1, -1).replace(/\\"/g, '"');
+    }
+    out[key] = v;
+  }
+  return out;
+}
+
+/** Every SKILL.md under skills/, including nested category dirs. */
+export function findSkills(root = SKILLS_DIR) {
+  const found = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir)) {
+      const p = join(dir, entry);
+      if (!statSync(p).isDirectory()) continue;
+      const skillFile = join(p, "SKILL.md");
+      if (existsSync(skillFile)) {
+        const text = readFileSync(skillFile, "utf8");
+        const fm = parseFrontmatter(text);
+        found.push({
+          name: fm.name || entry,
+          dirName: entry,
+          description: fm.description || "",
+          path: p,
+          relPath: relative(root, p),
+        });
+      } else {
+        walk(p);
+      }
+    }
+  };
+  walk(root);
+  return found.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/**
+ * Install one skill for a host.
+ * Nested category directories flatten to a single level, which is why build.mjs
+ * rejects duplicate directory names.
+ */
+export function installSkill(skill, { host, scope, dryRun = false }) {
+  const hostDir = HOSTS[host].skillsDir(scope);
+  const dest = join(hostDir, skill.dirName);
+  if (dryRun) return dest;
+
+  mkdirSync(hostDir, { recursive: true });
+  rmSync(dest, { recursive: true, force: true });
+  const adapterDir = host === "codex" ? CODEX_ADAPTER_DIR : CLAUDE_ADAPTER_DIR;
+  const override = join(adapterDir, "overrides", skill.dirName);
+  const source = existsSync(override) ? override : skill.path;
+  cpSync(source, dest, { recursive: true });
+  adaptCopiedSkillTree(dest, {
+    host,
+    skillNames: findSkills().map((item) => item.name),
+    allowImplicitInvocation: !readFileSync(join(skill.path, "SKILL.md"), "utf8").includes("disable-model-invocation: true"),
+    nativeCodex: source === override,
+  });
+  return dest;
+}
+
+export function installAgents({ host, scope, dryRun = false }) {
+  const dir = HOSTS[host].agentsDir(scope);
+  const sourceDir = host === "codex" ? join(CODEX_ADAPTER_DIR, "agents") : AGENTS_DIR;
+  const extension = host === "codex" ? ".toml" : ".md";
+  if (!dir || !existsSync(sourceDir)) return null;
+  if (dryRun) return dir;
+  mkdirSync(dir, { recursive: true });
+  for (const f of readdirSync(sourceDir).filter((f) => f.endsWith(extension))) {
+    cpSync(join(sourceDir, f), join(dir, f));
+  }
+  return dir;
+}
+
+export function expandSkillDependencies(selected, catalog = findSkills()) {
+  const selectedNames = new Set(selected.map((skill) => skill.name));
+  const queued = [...selected];
+
+  const readMarkdown = (dir) => {
+    let body = "";
+    for (const entry of readdirSync(dir)) {
+      const path = join(dir, entry);
+      if (statSync(path).isDirectory()) body += readMarkdown(path);
+      else if (path.endsWith(".md")) body += `\n${readFileSync(path, "utf8")}`;
+    }
+    return body;
+  };
+
+  while (queued.length) {
+    const current = queued.shift();
+    const body = readMarkdown(current.path);
+    for (const candidate of catalog) {
+      if (selectedNames.has(candidate.name)) continue;
+      const escaped = candidate.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      if (!new RegExp(`(^|[^a-z0-9-])${escaped}([^a-z0-9-]|$)`, "i").test(body)) continue;
+      selectedNames.add(candidate.name);
+      queued.push(candidate);
+    }
+  }
+
+  return catalog.filter((skill) => selectedNames.has(skill.name));
+}
+
+/** Installed pstack skills in one host dir, each tagged with whether it is a symlink. */
+export function listInstalled({ host, scope }) {
+  const dir = HOSTS[host].skillsDir(scope);
+  if (!existsSync(dir)) return [];
+  const ours = new Set(findSkills().map((s) => s.dirName));
+  return readdirSync(dir)
+    .filter((d) => ours.has(d) && existsSync(join(dir, d, "SKILL.md")))
+    .map((d) => {
+      const p = join(dir, d);
+      let linkedTo = null;
+      try { if (lstatSync(p).isSymbolicLink()) linkedTo = realpathSync(p); } catch {}
+      return { name: d, path: p, linkedTo };
+    })
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/**
+ * Remove a skill from one host. lstat, not exists, so a symlink left dangling by an
+ * earlier removal still gets cleared.
+ */
+export function removeSkill(dirName, { host, scope, dryRun = false }) {
+  const dest = join(HOSTS[host].skillsDir(scope), dirName);
+  try { lstatSync(dest); } catch { return null; }
+  if (!dryRun) rmSync(dest, { recursive: true, force: true });
+  return dest;
+}
+
+/** The curated entry set. Installation expands its transitive skill references. */
+export const CORE_SKILLS = [
+  "poteto-mode",
+  "setup-pstack",
+  "how",
+  "why",
+  "architect",
+  "interrogate",
+  "unslop",
+  "no-comments",
+  "technical-writing",
+  "tdd",
+];

package/scripts/test.mjs

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import {
+  existsSync,
+  lstatSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  CORE_SKILLS,
+  REPO_ROOT,
+  expandSkillDependencies,
+  findSkills,
+  installAgents,
+  installSkill,
+} from "./lib.mjs";
+
+const scriptsDir = dirname(fileURLToPath(import.meta.url));
+const check = spawnSync(process.execPath, [join(scriptsDir, "build.mjs")], {
+  encoding: "utf8",
+});
+assert.equal(check.status, 0, check.stderr || check.stdout);
+
+const shellCheck = spawnSync("bash", ["-n", join(REPO_ROOT, "skills", "poteto-mode", "scripts", "worktree-audit.sh")], {
+  encoding: "utf8",
+});
+assert.equal(shellCheck.status, 0, shellCheck.stderr || shellCheck.stdout);
+
+const planCheck = spawnSync(process.execPath, ["--check", join(REPO_ROOT, "skills", "poteto-mode", "scripts", "check-plan.mjs")], {
+  encoding: "utf8",
+});
+assert.equal(planCheck.status, 0, planCheck.stderr || planCheck.stdout);
+
+const testRoot = mkdtempSync(join(tmpdir(), "pstack-host-isolation-"));
+const originalCwd = process.cwd();
+
+function markdownUnder(root) {
+  const files = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir)) {
+      const path = join(dir, entry);
+      if (statSync(path).isDirectory()) walk(path);
+      else if (path.endsWith(".md")) files.push(path);
+    }
+  };
+  walk(root);
+  return files;
+}
+
+try {
+  process.chdir(testRoot);
+  const catalog = findSkills();
+  const requested = catalog.filter((skill) => CORE_SKILLS.includes(skill.name));
+  const selected = expandSkillDependencies(requested, catalog);
+  assert(selected.length > requested.length, "core entries must expand their skill dependencies");
+
+  for (const host of ["claude", "codex"]) {
+    for (const skill of selected) installSkill(skill, { host, scope: "project" });
+    installAgents({ host, scope: "project" });
+  }
+
+  const claudeRoot = join(testRoot, ".claude", "skills");
+  const codexRoot = join(testRoot, ".agents", "skills");
+  const claudeMode = join(claudeRoot, "poteto-mode", "SKILL.md");
+  const codexMode = join(codexRoot, "poteto-mode", "SKILL.md");
+
+  assert(!lstatSync(join(claudeRoot, "poteto-mode")).isSymbolicLink());
+  assert(!lstatSync(join(codexRoot, "poteto-mode")).isSymbolicLink());
+  assert.notEqual(statSync(claudeMode).ino, statSync(codexMode).ino);
+  assert(existsSync(join(testRoot, ".claude", "agents", "comment-sicko.md")));
+  assert(existsSync(join(testRoot, ".codex", "agents", "comment-sicko.toml")));
+  assert(existsSync(join(codexRoot, "poteto-mode", "agents", "openai.yaml")));
+
+  const claudeAudit = readFileSync(join(claudeRoot, "poteto-mode", "scripts", "worktree-audit.sh"), "utf8");
+  const codexAudit = readFileSync(join(codexRoot, "poteto-mode", "scripts", "worktree-audit.sh"), "utf8");
+  assert.doesNotMatch(claudeAudit, /\.codex\/sessions/);
+  assert.doesNotMatch(codexAudit, /\.claude\/projects/);
+
+  for (const path of markdownUnder(claudeRoot)) {
+    const body = readFileSync(path, "utf8");
+    assert(!/\.codex\/|\.agents\/skills|\$[a-z][a-z0-9-]+/.test(body), `Codex leak in ${path}`);
+  }
+  for (const path of markdownUnder(codexRoot)) {
+    const body = readFileSync(path, "utf8");
+    assert(!/\.claude\/|Claude Code|Task tool|subagent_type:|run_in_background|AskQuestion/.test(body), `Claude leak in ${path}`);
+  }
+
+  const claudeSetup = readFileSync(join(claudeRoot, "setup-pstack", "SKILL.md"), "utf8");
+  const codexSetup = readFileSync(join(codexRoot, "setup-pstack", "SKILL.md"), "utf8");
+  assert.match(claudeSetup, /~\/\.claude\/pstack-models\.md/);
+  assert.match(codexSetup, /~\/\.codex\/pstack-models\.md/);
+  assert.doesNotMatch(claudeSetup, /~\/\.codex/);
+  assert.doesNotMatch(codexSetup, /~\/\.claude/);
+} finally {
+  process.chdir(originalCwd);
+  rmSync(testRoot, { recursive: true, force: true });
+}
+
+console.log("host isolation and installation checks passed");

package/skills/architect/SKILL.md

@@ -0,0 +1,83 @@
+---
+name: architect
+description: "Sketch types, signatures, and module structure before code, then stay in the loop while implementation fills in. Use for /architect, 'architect this', 'design this', or non-trivial work where jumping to code would lock in the wrong shape."
+disable-model-invocation: true
+---
+
+# Architect
+
+Design before implementing. Sketch types, function signatures, class shapes, and module boundaries with `not implemented` bodies and pseudocode. Synthesize across multiple model perspectives, then fill in code against the chosen sketch. If implementation proves the sketch wrong, throw it out and redesign.
+
+## Start
+
+Open a todolist with one entry per phase before starting. Autonomous mode without checkpoints needs the list to show phase position and keep phases from silently disappearing.
+
+1. Ground
+2. Sketch
+3. Agree
+4. Implement
+5. Scrap
+
+## Phase A: Ground the problem
+
+Build a real mental model of every system the new code touches. Run the **how** skill over the relevant subsystems. Critique mode if existing structure is the constraint or the design must push back on it.
+
+Naming a file isn't grounding. Produce the traced model `how` prescribes. If the design redefines ownership or layering, also run the **why** skill on the existing shape so the rationale becomes a constraint, not a guess.
+
+Skip Phase A only when the work is genuinely greenfield with no surrounding system to integrate.
+
+## Phase B: Sketch
+
+Run the **arena** skill with the design-sketch task and the Phase A grounding artifacts. Pass `references/runner-prompt.md` as each runner's prompt. Each candidate produces a design package shaped per `references/rationale-template.md`: the caller's usage written first, then the type sketch, function signatures, module map, and prose rationale derived from it.
+
+Use your configured architect runners (defaults to one on each of your judgment, precise-execution, and fast code models).
+
+Design it twice. Require at least two structurally distinct candidates before synthesis, even when the first looks sufficient. This is the **exhaust-the-design-space** principle skill made concrete. Whole-shape alternatives, not point fixes inside one shape.
+
+Screen every candidate against [`references/design-red-flags.md`](references/design-red-flags.md) before synthesis. Reject or revise shallow modules, information leakage, temporal decomposition, and pass-through methods.
+
+Compare viable candidates on interface depth. Prefer the design that hides more complexity behind a smaller, simpler public surface. A rich interface can keep call chains short by concentrating capability instead of scattering it across layers.
+
+Arena returns one synthesized design package. The synthesis decision populates the rationale's "Synthesis decision" section.
+
+## Phase C: Agree (opt-in)
+
+Default: proceed directly to implementation with the synthesized design. No human checkpoint.
+
+Opt in to a checkpoint when the invoker explicitly asks: "/architect with checkpoint," "stop and show me before implementing," or similar. Then surface the synthesized design and pause for sign-off.
+
+The synthesis can ship as its own commit either way. That's the "scaffold first" mode of the **foundational-thinking** principle skill; subsequent commits read as filling in bodies against a stable contract. Planned and scoped breakage during fill-in is fine, per the **outcome-oriented-execution** principle skill. For adversarial pressure on the design before implementing, run the **interrogate** skill on the synthesized sketch.
+
+If the human pushes back on the shape (in a checkpoint or after the fact), treat that as Phase A evidence. Re-ground and re-run Phase B before writing more code.
+
+## Phase D: Implement against the sketch
+
+Replace `not implemented` bodies with code, pseudocode with logic. The synthesized sketch is the contract.
+
+Deviations from the sketch are signal worth surfacing, not friction to absorb silently. If a function needs a parameter the sketch didn't anticipate, ask whether the sketch was wrong, the requirement was missed, or the implementation is overreaching. Surface it; don't bolt it on.
+
+## Phase E: Scrap when the architecture is wrong
+
+If implementation keeps producing friction the sketch can't absorb, throw the sketch out. Don't bolt fixes onto a wrong design, per the **redesign-from-first-principles** and **fix-root-causes** principle skills.
+
+The signal is a *pattern*, not single instances. Tells:
+
+- The same shape of workaround appearing repeatedly across unrelated code.
+- Multiple unrelated edge cases that all need special-case branches.
+- Types that need escape hatches (`any`, casts, optional fields always set in practice) to compile.
+- The "we need a lock" reflex when the sketch said the state wasn't shared.
+- Callers having to know the abstraction's internal rules to use it.
+- Two or more independent Phase D deviations of the same shape across the implementation. Surfacing deviations is Phase D's job; a repeated pattern of them is Phase E's trigger.
+
+Use judgment. A few edge cases don't condemn an architecture. Some problems are legitimately complex; complexity in the data is not complexity in the design. The rewrite signal is repeated friction of the same shape, not single hard cases.
+
+When you scrap:
+
+1. Re-run the **how** skill over what's been built. The implementation lessons enter the new design as inputs, not vibes.
+2. Redesign as if the new constraints had been day-one assumptions, per redesign-from-first-principles.
+3. Subtract before adding, per the **subtract-before-you-add** principle skill. The new sketch should be smaller than the old one before it grows.
+4. Return to Phase B and re-run arena.
+
+## Outputs
+
+The caller's usage is written first and the type sketch derived from it. One file with new types and signatures for small changes; module map plus type definitions for larger work. The rationale ships alongside, shaped per `references/rationale-template.md`, including the usage sketch and the synthesis decision.

package/skills/architect/references/design-red-flags.md

@@ -0,0 +1,33 @@
+# Design red flags
+
+Screen every candidate before synthesis. A red flag is a reason to revise or reject the shape.
+
+## Shallow module
+
+A shallow module exposes a large interface while hiding little complexity. Judge depth by the capability and policy hidden behind the public surface relative to the size of that surface. Prefer a simple interface backed by substantial behavior.
+
+Do not confuse a deep module with a deep call chain. A deep call chain scatters understanding across layers. A deep module concentrates capability behind one interface.
+
+Look for these signs:
+
+- Callers coordinate several methods to complete one operation.
+- Public options expose internal stages or implementation choices.
+- Learning the interface does not save the caller from learning the implementation.
+
+## Information leakage
+
+Information leakage makes multiple modules depend on the same internal decision. A representation, policy, or protocol detail appears in more than one place, so changing it requires coordinated edits.
+
+Public re-exports of transport or wire types are leakage. Parse external data into domain types behind the interface. Keep storage schemas, framework objects, and protocol details private.
+
+## Temporal decomposition
+
+Temporal decomposition organizes modules by execution order instead of the knowledge they own. Separate load, validate, transform, and save stages often repeat one representation and its invariants across several boundaries.
+
+Group code around domain knowledge and ownership. Methods that run at different times can still belong to one module when they protect the same decisions.
+
+## Pass-through method
+
+A pass-through method forwards the same arguments to another method with the same shape. It adds a layer without hiding complexity.
+
+Remove it or move responsibility to the module that can complete the operation. Keep a forwarding boundary only when it adds policy, adaptation, or a distinct abstraction.

package/skills/architect/references/rationale-template.md

@@ -0,0 +1,35 @@
+# Rationale template
+
+The prose that ships alongside the type sketch. One page. Sentence-case headings, no boilerplate. Replace the italic notes with actual content.
+
+## Problem
+
+*One paragraph. What we're trying to do, and what about the existing system or constraints makes the shape non-obvious. If [Phase A](../SKILL.md#phase-a-ground-the-problem) surfaced constraints the design must honor (existing types to interop with, callers we can't break, invariants that crossed our boundary), name them here so the reader sees the same constraints you saw.*
+
+## Usage (caller's view)
+
+*Write this first, before the type sketch. Show the README or quickstart the consumer reads, plus two or three realistic call sites in their own code. What they import, what they call, what comes back. The type sketch in [Shape](#shape) is derived from this. The two must agree; when they diverge, reconcile the sketch to the usage, not the reverse. The caller's experience is the spec. The types serve it.*
+
+## Shape
+
+*The recommended architecture. Data structures first; then how data flows through the signatures. Name the load-bearing decisions. State which invariants are encoded in types, where validation lives, and what the system deliberately does not do. Judge interface depth explicitly. State what complexity the public surface hides, what remains exposed to callers, and why the interface is no larger than needed. Cite the principle behind each decision (e.g., `per boundary-discipline`); don't restate it.*
+
+## Synthesis decision
+
+*Filled in by [arena](../../arena/SKILL.md). Records which candidate became the base and why, what was adapted from each of the others, and what was rejected and why.*
+
+## Tradeoffs accepted
+
+*One bullet per tradeoff the chosen shape makes. Form: "we accept X in exchange for Y." Name anything a future reader might mistake for an oversight, including things that look like premature optimization or premature simplification.*
+
+## Alternatives considered
+
+*Required. Name at least one concrete alternative shape, with one line on why it lost. Judge each alternative on interface depth, not implementation simplicity alone. Name the complexity it exposes to callers and the complexity it hides. Two or three alternatives belong here when the design space had real contenders. One is fine when the constraints forced the answer, with the conclusion phrased as "this was the only viable shape because..." Avoid listing flavors of the same shape. This section covers design alternatives the chosen shape considered and rejected, not other runner candidates.*
+
+## Open questions and risks
+
+*Things you noticed during the sketch that the human needs to weigh in on, and risks worth flagging before implementation starts. Phrase as questions, not assertions, so the human's answer is the resolution rather than a comment.*
+
+## Next implementation step
+
+*The first thing to build against the sketch. One sentence. What you'd start writing immediately after synthesis (or after Phase D sign-off, if a checkpoint was opted into).*

package/skills/architect/references/runner-prompt.md

@@ -0,0 +1,20 @@
+# Architect runner prompt
+
+The orchestrator passes this file through to every parallel candidate runner during Phase B and fills in the variable inputs around it: the task, the Phase A grounding artifacts, the isolated working directory, and the path to write outputs. The working directory is a git worktree when available, otherwise a per-runner subdirectory under the sketch dir; what matters is independence between candidates.
+
+You are producing one candidate design in architect's parallel exploration. Read the **architect** skill in full first; that's the workflow you're inside. Output a candidate design package: type sketch, function signatures, module map, and prose rationale shaped per [`rationale-template.md`](rationale-template.md).
+
+Apply the following discipline. The orchestrator compares candidates on these axes to pick a base.
+
+- Caller's usage first. Write the README-style usage and two or three real call sites before the types, then derive the type sketch from them. The usage is the spec; the two must agree, so reconcile the sketch to the usage, not the reverse.
+- Data structures first. Get the core types right and the code becomes obvious. Trace each dominant access pattern through the proposed structure; if the answer is "we'll add a map / index / cache later," the structure is wrong.
+- Interface depth. Compare the capability hidden behind the public surface relative to the size of that surface. Prefer a simple interface that pulls complexity into the callee, even when the implementation becomes less simple. Do not put transport or wire types on the public surface; parse into domain types behind the interface.
+- Shared state: if two actors might both write, ask "what happens?" If the answer isn't "nothing," default to per-actor state with a merge at the read boundary, per the **separate-before-serializing-shared-state** principle skill.
+- Make boundaries visible. `not implemented` errors for bodies, `// TODO` pseudocode for tricky logic, doc comments stating intent and invariants. A reader should trace data from input to output by reading types and signatures alone.
+- Encode invariants in types: hard-to-misuse types > runtime checks > prose comments, per the **encode-lessons-in-structure** principle skill.
+- Validate at boundaries, trust types inside, per the **boundary-discipline** principle skill. Business logic as pure functions; the shell stays thin.
+- Single source of truth per invariant. Derive instead of sync.
+- Idempotent state transitions where applicable, per the **make-operations-idempotent** principle skill. Ask what happens if the operation runs twice or crashes halfway.
+- Short call chains. If tracing the flow needs more than three files, flatten the hierarchy, per the **laziness-protocol** and **minimize-reader-load** principle skills.
+
+You are one of several runners, each on a different model. Produce the best design your model can make; don't hedge against the others. Differences between candidates are the signal used to pick a base and graft. Converging on a safe-looking middle defeats the exploration.