catherd-cli 0.1.0

package/src/mcp/setup-tools.ts

@@ -0,0 +1,175 @@
+import { existsSync, readdirSync } from "node:fs";
+import { basename } from "node:path";
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import diff from "microdiff";
+import { z } from "zod";
+import { formatHarness, harnessCosts } from "../core/harness.ts";
+import { ID } from "../core/lanes.ts";
+import { listRuns } from "../core/runstore.ts";
+import { runsSummary } from "../core/status.ts";
+import { claudeAgentsDir, saveProfileAndAgents } from "../profile/agents.ts";
+import {
+  activeProfileName,
+  defaultProfile,
+  listProfiles,
+  loadProfile,
+  patchProfile,
+  type ProfilePatch,
+  validateProfile,
+} from "../profile/profile.ts";
+import { capableFor, loadCatalog } from "../routing/catalog.ts";
+import { type Backend, type Profile, ROLES, splitRung } from "../types.ts";
+import { json } from "./out.ts";
+
+const isolation = z.object({ isolated: z.boolean() });
+
+const PATCH = z.object({
+  objective: z.enum(["cost", "speed"]).optional(),
+  roles: z
+    .partialRecord(
+      z.enum(ROLES),
+      z.object({
+        enabled: z.boolean().optional(),
+        models: z.record(z.string(), z.array(z.string())).optional(),
+        defaultRung: z.string().optional(),
+      }),
+    )
+    .optional(),
+  harness: z.object({ codex: isolation.optional(), opencode: isolation.optional() }).optional(),
+  lock: z.object({ heavy: z.union([z.number().int().positive(), z.literal("cpus/2")]) }).optional(),
+  notify: z.array(z.enum(["milestone", "finish", "blocked"])).optional(),
+});
+
+/** Whether each backend's CLI is on PATH. Claude is always available: it needs no CLI, only agent files. */
+function installedBackends(): Record<Backend, boolean> {
+  const probe = (bin: string) =>
+    Bun.which(bin) !== null &&
+    Bun.spawnSync([bin, "--version"], { stdout: "ignore", stderr: "ignore" }).success;
+  return { codex: probe("codex"), opencode: probe("opencode"), claude: true };
+}
+
+const profileOrNew = (name: string): Profile =>
+  listProfiles().includes(name) ? loadProfile(name) : { ...defaultProfile(), name };
+
+export function registerSetupTools(server: McpServer): void {
+  server.registerTool(
+    "catalog_query",
+    {
+      description:
+        "Models catherd can place, with their capabilities, the roles they are capable for, their scored rungs, any 'treat like', and whether their backend is installed. Scored models first.",
+      inputSchema: {
+        role: z.enum(ROLES).optional(),
+        backend: z.enum(["codex", "opencode", "claude"]).optional(),
+        text: z.string().optional(),
+        scored_only: z.boolean().default(false),
+        limit: z.number().int().min(1).max(500).default(50),
+      },
+    },
+    async (a) => {
+      const c = loadCatalog();
+      const installed = installedBackends();
+      const needle = a.text?.toLowerCase();
+      const models = c.models
+        .filter(
+          (m) =>
+            (!a.role || capableFor(a.role, m)) &&
+            (!a.backend || m.backend === a.backend) &&
+            (!needle || m.id.toLowerCase().includes(needle)),
+        )
+        .map((m) => ({
+          id: m.id,
+          backend: m.backend,
+          installed: installed[m.backend],
+          efforts: m.efforts,
+          capabilities: m.capabilities,
+          roles: ROLES.filter((r) => capableFor(r, m)),
+          scored: c.entries.filter((e) => splitRung(e.rung).model === m.id),
+          treatLike: Object.fromEntries(
+            Object.entries(c.treatLike).filter(([k]) => splitRung(k).model === m.id),
+          ),
+        }))
+        .filter((m) => !a.scored_only || m.scored.length > 0 || Object.keys(m.treatLike).length > 0)
+        .sort((x, y) => y.scored.length - x.scored.length || x.id.localeCompare(y.id));
+      return json({ total: models.length, models: models.slice(0, a.limit) });
+    },
+  );
+
+  server.registerTool(
+    "profile_get",
+    {
+      description:
+        "A profile (the active one without a name), the active profile's name, and every profile name.",
+      inputSchema: { name: z.string().regex(ID).optional() },
+    },
+    async (a) => {
+      const active = activeProfileName();
+      return json({ active, profiles: listProfiles(), profile: loadProfile(a.name ?? active) });
+    },
+  );
+
+  server.registerTool(
+    "profile_validate",
+    {
+      description:
+        "Check a profile (the active one without a name): every enabled role has a capable model, the worker's ladder is non-empty for every kind, and no unscored model is enabled without its 'treat like'.",
+      inputSchema: { name: z.string().regex(ID).optional() },
+    },
+    async (a) => {
+      const errors = validateProfile(loadProfile(a.name ?? activeProfileName()), loadCatalog());
+      return json({ valid: errors.length === 0, errors });
+    },
+  );
+
+  server.registerTool(
+    "profile_set",
+    {
+      description:
+        "Apply a patch to a profile (the active one without a name). It validates first and writes nothing when invalid; otherwise it saves the profile and regenerates the Claude agent files. Returns the diff and the agents that need a new Claude Code session.",
+      inputSchema: { name: z.string().regex(ID).optional(), patch: PATCH },
+    },
+    async (a) => {
+      const c = loadCatalog();
+      const before = profileOrNew(a.name ?? activeProfileName());
+      const { harness, ...rest } = a.patch;
+      const patched = patchProfile(before, rest as ProfilePatch);
+      const after: Profile = harness ? { ...patched, harness: { ...patched.harness, ...harness } } : patched;
+      const errors = validateProfile(after, c);
+      if (errors.length) return json({ saved: false, errors });
+      const dir = claudeAgentsDir();
+      const had = new Set(existsSync(dir) ? readdirSync(dir) : []);
+      const agents = saveProfileAndAgents(after, c);
+      return json({
+        saved: true,
+        diff: diff(before as unknown as Record<string, unknown>, after as unknown as Record<string, unknown>),
+        agents,
+        new_session_needed_for: agents.linked
+          .filter((l) => !had.has(basename(l)))
+          .map((l) => basename(l, ".md")),
+      });
+    },
+  );
+
+  server.registerTool(
+    "runs_summary",
+    {
+      description:
+        "Per role and rung over past runs: runs, ok, refusals, climbs from that rung, seconds and tokens; plus what the user's harness customizations cost per run.",
+      inputSchema: {
+        run: z.string().optional(),
+        repo: z.string().optional(),
+        role: z.enum(ROLES).optional(),
+        since_days: z.number().positive().optional(),
+      },
+    },
+    async (a) => {
+      const harness = harnessCosts(listRuns().map((r) => r.dir)).map((h) => ({
+        ...h,
+        line: formatHarness(h),
+      }));
+      return json({
+        rungs: runsSummary({ run: a.run, repo: a.repo, role: a.role, sinceDays: a.since_days }),
+        harness,
+      });
+    },
+  );
+}

package/src/paths.ts

@@ -0,0 +1,20 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+function root(kind: "config" | "data"): string {
+  const home = process.env.CATHERD_HOME;
+  if (home) return join(home, kind);
+  if (kind === "config") return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "catherd");
+  return join(process.env.XDG_DATA_HOME || join(homedir(), ".local", "share"), "catherd");
+}
+
+export const configDir = (): string => root("config");
+export const dataDir = (): string => root("data");
+
+export function repoSlug(repoRoot: string): string {
+  return repoRoot.replace(/^\/+/, "").replaceAll("/", "-");
+}
+
+export function runsRoot(repoRoot: string): string {
+  return join(dataDir(), repoSlug(repoRoot));
+}

package/src/profile/agents.ts

@@ -0,0 +1,118 @@
+import { lstatSync, mkdirSync, readdirSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, join, sep } from "node:path";
+import { configDir } from "../paths.ts";
+import { modelOf } from "../routing/catalog.ts";
+import { type Catalog, type Profile, ROLES, type Role, type RungId, rungOf, splitRung } from "../types.ts";
+import { activeProfileName, saveProfile } from "./profile.ts";
+import { ROLE_PROMPTS } from "./role-prompts.ts";
+
+const slug = (s: string) =>
+  s
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-|-$/g, "");
+
+export function agentName(role: Role, rung: RungId): string {
+  const { model, effort } = splitRung(rung);
+  return `catherd-${role}-${slug(model)}-${effort}`;
+}
+
+export function claudeAgentsDir(): string {
+  return process.env.CATHERD_CLAUDE_AGENTS_DIR ?? join(homedir(), ".claude", "agents");
+}
+
+function render(role: Role, rung: RungId): string {
+  const { model, effort } = splitRung(rung);
+  const p = ROLE_PROMPTS[role];
+  return [
+    "---",
+    `name: ${agentName(role, rung)}`,
+    `description: Internal ${role} role of the catherd orchestrator, on ${model} at ${effort} effort. Dispatched only by the catherd skill while a run is in flight. Never for a plain request, even one that names this role.`,
+    `model: ${model}`,
+    `effort: ${effort}`,
+    `disallowedTools: ${p.disallowedTools.join(", ")}`,
+    "---",
+    "",
+    p.body,
+    "",
+  ].join("\n");
+}
+
+const lstatOrNull = (p: string) => {
+  try {
+    return lstatSync(p);
+  } catch {
+    return null;
+  }
+};
+
+export function writeClaudeAgents(
+  p: Profile,
+  c: Catalog,
+): { written: string[]; linked: string[]; pruned: string[] } {
+  const root = join(configDir(), "agents");
+  const dir = join(root, p.name);
+  const files = new Map<string, string>();
+  for (const role of ROLES) {
+    const rc = p.roles[role];
+    if (!rc?.enabled) continue;
+    for (const [model, efforts] of Object.entries(rc.models)) {
+      if (modelOf(c, model)?.backend !== "claude") continue;
+      for (const effort of efforts) {
+        const rung = rungOf(model, effort);
+        files.set(join(dir, `${agentName(role, rung)}.md`), render(role, rung));
+      }
+    }
+  }
+
+  const active = p.name === activeProfileName();
+  const target = claudeAgentsDir();
+  const ours = `${root}${sep}`;
+  const isOurs = (link: string) => {
+    const st = lstatOrNull(link);
+    return !st || (st.isSymbolicLink() && readlinkSync(link).startsWith(ours));
+  };
+  if (active) {
+    for (const f of files.keys()) {
+      const link = join(target, basename(f));
+      if (!isOurs(link))
+        throw new Error(`catherd: ${link} exists and is not catherd's; move it away and save again`);
+    }
+  }
+
+  mkdirSync(dir, { recursive: true });
+  for (const [f, text] of files) writeFileSync(f, text);
+  for (const f of readdirSync(dir)) if (!files.has(join(dir, f))) rmSync(join(dir, f));
+  const written = [...files.keys()];
+  if (!active) return { written, linked: [], pruned: [] };
+
+  mkdirSync(target, { recursive: true });
+  const linked: string[] = [];
+  for (const f of written) {
+    const link = join(target, basename(f));
+    rmSync(link, { force: true });
+    symlinkSync(f, link);
+    linked.push(link);
+  }
+  const pruned: string[] = [];
+  for (const name of readdirSync(target)) {
+    const link = join(target, name);
+    if (!lstatOrNull(link)?.isSymbolicLink()) continue;
+    const to = readlinkSync(link);
+    if (to.startsWith(ours) && !files.has(to)) {
+      rmSync(link);
+      pruned.push(link);
+    }
+  }
+  return { written, linked, pruned };
+}
+
+export function saveProfileAndAgents(
+  p: Profile,
+  c: Catalog,
+): { written: string[]; linked: string[]; pruned: string[] } {
+  const r = writeClaudeAgents(p, c);
+  saveProfile(p);
+  return r;
+}

package/src/profile/profile.ts

@@ -0,0 +1,228 @@
+import { existsSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { z } from "zod";
+import { readJsonFile } from "../files.ts";
+import { configDir } from "../paths.ts";
+import { capableFor, isScored, modelOf } from "../routing/catalog.ts";
+import { candidates, clearsBar } from "../routing/select.ts";
+import {
+  type Catalog,
+  DIFFICULTIES,
+  type HarnessConfig,
+  KINDS,
+  type NotifyMoment,
+  type Profile,
+  ROLE_NEEDS,
+  ROLES,
+  type Role,
+  type RoleConfig,
+  type RungId,
+  rungOf,
+  splitRung,
+} from "../types.ts";
+
+const NAME = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+
+const Harness = z.object({ isolated: z.boolean() }).default(() => ({ isolated: false }));
+
+const ProfileSchema = z.object({
+  name: z.string().regex(NAME),
+  objective: z.enum(["cost", "speed"]),
+  roles: z.record(
+    z.enum(ROLES),
+    z.object({
+      enabled: z.boolean(),
+      models: z.record(z.string().min(1), z.array(z.string().min(1))),
+      defaultRung: z.string().optional(),
+    }),
+  ),
+  // Profiles written before the harness toggle existed load as native, which is the default.
+  harness: z
+    .object({ codex: Harness, opencode: Harness })
+    .default(() => ({ codex: { isolated: false }, opencode: { isolated: false } })),
+  lock: z.object({ heavy: z.union([z.number().int().min(1), z.literal("cpus/2")]) }),
+  notify: z.array(z.enum(["milestone", "finish", "blocked"])),
+  // spec §11b: quota failover and the run budget. Both optional, so old profile files still load.
+  failover: z.record(z.string(), z.string()).optional(),
+  budget: z
+    .object({ minutes: z.number().optional(), tokens: z.number().optional(), usd: z.number().optional() })
+    .optional(),
+});
+const ConfigSchema = z.looseObject({ activeProfile: z.string().optional() });
+const ProjectsSchema = z.record(z.string(), z.string());
+
+export type ProfilePatch = {
+  objective?: Profile["objective"];
+  /** A role's `models` map is replaced whole, so a patch can drop an entry. */
+  roles?: Partial<Record<Role, Partial<RoleConfig>>>;
+  harness?: Partial<Record<"codex" | "opencode", Partial<HarnessConfig>>>;
+  lock?: Profile["lock"];
+  notify?: NotifyMoment[];
+};
+
+const profilesDir = () => join(configDir(), "profiles");
+const configFile = () => join(configDir(), "config.json");
+const projectsFile = () => join(configDir(), "projects.json");
+
+function checkName(name: string): string {
+  if (!NAME.test(name))
+    throw new Error(`catherd: bad profile name "${name}": use letters, digits, "-" and "_"`);
+  return name;
+}
+
+function readOr<T>(schema: z.ZodType<T>, file: string, fallback: T): T {
+  return existsSync(file) ? readJsonFile(schema, file) : fallback;
+}
+
+function writeJson(file: string, value: unknown): void {
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+export function defaultProfile(): Profile {
+  return {
+    name: "default",
+    objective: "cost",
+    roles: {
+      architect: { enabled: true, models: { "claude-opus-5-5": ["high"] } },
+      verifier: { enabled: true, models: { "claude-opus-5-5": ["low"] } },
+      worker: {
+        enabled: true,
+        defaultRung: "gpt-6-sol#medium",
+        models: { "gpt-6-luna": ["high"], "gpt-6-sol": ["medium", "high", "xhigh"] },
+      },
+      reviewer: { enabled: true, models: { "gpt-6-sol": ["high"] } },
+      "ui-reviewer": { enabled: true, models: { "gpt-6-sol": ["medium"] } },
+      artist: { enabled: true, models: { "gpt-6-sol": ["medium"] } },
+      writer: { enabled: true, models: { "gpt-6-luna": ["high"] } },
+      researcher: { enabled: true, models: { "gpt-6-luna": ["high"] } },
+    },
+    harness: { codex: { isolated: false }, opencode: { isolated: false } },
+    lock: { heavy: "cpus/2" },
+    notify: ["milestone", "finish", "blocked"],
+  };
+}
+
+export function loadProfile(name?: string): Profile {
+  const n = checkName(name ?? activeProfileName());
+  const file = join(profilesDir(), `${n}.json`);
+  if (existsSync(file)) return { ...readJsonFile(ProfileSchema, file), name: n };
+  if (n === "default") return defaultProfile();
+  throw new Error(`catherd: no profile named "${n}" (looked for ${file})`);
+}
+
+export function saveProfile(p: Profile): void {
+  const file = join(profilesDir(), `${checkName(p.name)}.json`);
+  const r = ProfileSchema.safeParse(p);
+  if (!r.success) throw new Error(`catherd: profile "${p.name}" is invalid:\n${z.prettifyError(r.error)}`);
+  writeJson(file, r.data);
+}
+
+export function listProfiles(): string[] {
+  const onDisk = existsSync(profilesDir())
+    ? readdirSync(profilesDir())
+        .filter((f) => f.endsWith(".json"))
+        .map((f) => f.slice(0, -".json".length))
+        .filter((n) => NAME.test(n))
+    : [];
+  return [...new Set(["default", ...onDisk])].sort();
+}
+
+export function activeProfileName(repo?: string): string {
+  const bound = repo === undefined ? undefined : readOr(ProjectsSchema, projectsFile(), {})[resolve(repo)];
+  return bound ?? readOr(ConfigSchema, configFile(), {}).activeProfile ?? "default";
+}
+
+export function setActiveProfile(name: string, repo?: string): void {
+  if (!listProfiles().includes(name)) throw new Error(`catherd: no profile named "${name}"`);
+  if (repo === undefined)
+    writeJson(configFile(), { ...readOr(ConfigSchema, configFile(), {}), activeProfile: name });
+  else writeJson(projectsFile(), { ...readOr(ProjectsSchema, projectsFile(), {}), [resolve(repo)]: name });
+}
+
+export function patchProfile(p: Profile, patch: ProfilePatch): Profile {
+  const roles = { ...p.roles };
+  for (const role of ROLES) {
+    const rc = patch.roles?.[role];
+    if (rc) roles[role] = { ...roles[role], ...rc };
+  }
+  return {
+    ...p,
+    objective: patch.objective ?? p.objective,
+    roles,
+    harness: {
+      codex: { ...p.harness.codex, ...patch.harness?.codex },
+      opencode: { ...p.harness.opencode, ...patch.harness?.opencode },
+    },
+    lock: patch.lock ?? p.lock,
+    notify: patch.notify ?? p.notify,
+  };
+}
+
+const backendOf = (c: Catalog, rung: RungId): string | undefined =>
+  modelOf(c, splitRung(rung).model)?.backend;
+
+export function validateProfile(p: Profile, c: Catalog): string[] {
+  const errors: string[] = [];
+  if (!p.roles.worker.enabled) errors.push("worker: cannot be disabled");
+  for (const role of ROLES) {
+    const rc = p.roles[role];
+    if (!rc.enabled) continue;
+    const usable: RungId[] = [];
+    for (const [id, efforts] of Object.entries(rc.models)) {
+      const m = modelOf(c, id);
+      if (!m) {
+        errors.push(`${role}: ${id} is not in the catalog`);
+        continue;
+      }
+      if (!capableFor(role, m)) {
+        errors.push(
+          `${role}: ${id} cannot fill this role (it needs ${Object.keys(ROLE_NEEDS[role]).join(" + ")})`,
+        );
+        continue;
+      }
+      for (const effort of efforts) {
+        const rung = rungOf(id, effort);
+        if (!m.efforts.includes(effort)) {
+          errors.push(`${role}: ${id} has no effort "${effort}" (it has ${m.efforts.join(", ")})`);
+        } else if (!isScored(c, rung)) {
+          errors.push(
+            `${role}: ${rung} is unscored; declare it "treat like" a scored entry in catalog.override.json`,
+          );
+        } else {
+          usable.push(rung);
+        }
+      }
+    }
+    if (usable.length === 0) errors.push(`${role}: no usable model is enabled`);
+    else if (rc.defaultRung && !usable.includes(rc.defaultRung)) {
+      errors.push(`${role}: defaultRung ${rc.defaultRung} is not one of its enabled entries`);
+    }
+  }
+  const worker = candidates(p, c, "worker");
+  if (worker.length > 1) {
+    for (const kind of KINDS) {
+      for (const d of DIFFICULTIES) {
+        if (!worker.some((r) => clearsBar(c, r, kind, d))) {
+          errors.push(`worker: no enabled entry clears the ${kind}/${d} bar`);
+        }
+      }
+    }
+  }
+  // spec §11b: a failover stand-in must be usable on its own, and on a different backend, so
+  // a quota outage on one backend cannot fail over onto the very backend that is out of quota.
+  for (const [from, to] of Object.entries(p.failover ?? {})) {
+    if (!isScored(c, to)) {
+      errors.push(`failover: ${to} (stand-in for ${from}) is unscored`);
+      continue;
+    }
+    const fromBackend = backendOf(c, from);
+    const toBackend = backendOf(c, to);
+    if (fromBackend && toBackend && fromBackend === toBackend) {
+      errors.push(
+        `failover: ${to} is on the same backend (${toBackend}) as ${from}; a stand-in must be on another backend`,
+      );
+    }
+  }
+  return errors;
+}

package/src/profile/role-prompts.ts

@@ -0,0 +1,129 @@
+import type { Role } from "../types.ts";
+
+const READ_ONLY = ["Write", "Edit", "NotebookEdit", "Agent"];
+const WRITES = ["Agent"];
+
+const RUN_FILES =
+  "The run folder is outside the project. Read and write it only through the catherd MCP tools read_run_file and write_run_file (in the tool list as mcp__plugin_catherd_catherd__read_run_file and mcp__plugin_catherd_catherd__write_run_file), with the run id the orchestrator gave you. Paths are relative to the run folder.";
+
+const REPLY =
+  "Do not commit. Reply in at most 15 lines: results, file:line, and evidence as a log path, not the log. The last line of your reply is: STATUS: complete|partial|blocked|refused — <one line why>";
+
+const architect = [
+  "You are the architect of a catherd run. The orchestrator gave you the goal, the acceptance lines, the run id, and usually a dossier: a researcher's map of the code this work touches. Workers are other models that run in the project directory with no memory of this conversation. They will write every line of code from your plan.",
+  "",
+  `Start from the dossier. Open a project file yourself only to settle a decision the dossier leaves open, and read each file once. Bash is for inspection only. Change nothing in the project. ${RUN_FILES}`,
+  "",
+  "Write plan.md with exactly these parts, in this order:",
+  "",
+  "1. Decisions D1…Dn: each one is a choice, the alternative you rejected, and one line on why. Cover only choices where two reasonable engineers would differ.",
+  "2. Milestones M1…Mn: each one is a shippable step with its own acceptance lines and its full check (the command that proves the whole milestone). Order them so each builds on the last.",
+  "3. Lanes inside each milestone, M1.L1…: each lane gives",
+  "   - the files it owns (two lanes of one milestone never share a file);",
+  "   - what changes, stated as behavior plus the exact signatures and data shapes it introduces;",
+  "   - its fast check: the targeted command a worker reruns while it works, seconds to a minute or two.",
+  "",
+  "   Every lane of a milestone runs at the same time, so split for width: more small lanes beat one long one.",
+  "4. Speed: if the full check takes more than about five minutes, name why and make speeding it up (parallel tests, one shared fixture, fewer real-time waits) a lane of the first milestone.",
+  "5. Edge cases the tests must pin, one line each.",
+  "6. Out of scope: what no worker may touch.",
+  "",
+  "Then write one file per lane, lanes/Mx.Ly.md. It is everything that worker needs and nothing else: the lane's section, the decisions and edge cases it relies on (copied, not referenced), and the out-of-scope lines. A worker reads its lane file, never plan.md. Its first three lines are exactly:",
+  "",
+  "    # Mx.Ly — <one line>",
+  "    Owns: <repo-relative paths, comma-separated>",
+  "    Fast check: <command>",
+  "",
+  "catherd reads the Owns: line to keep two running lanes off the same file, and to tell a refusal (owned files unchanged) from work.",
+  "",
+  "Signatures, data shapes and test case names are yours. Function bodies are the worker's. A plan that contains the implementation turns the worker into a typist and spends the most expensive model on typing.",
+  "",
+  "Prefer the smallest design that meets the acceptance lines: no abstraction with one implementation, no config for a value that never changes, no comments restating code.",
+  "",
+  "Your reply to the orchestrator is short: the milestones, each with its lanes as Mx.Ly — one line — owned files, and the full-check command per milestone. The detail lives in the files.",
+  "",
+  "When the orchestrator sends you a design finding later, answer with a delta: rewrite the affected lane files and the matching plan.md sections, and reply with what changed.",
+].join("\n");
+
+const verifier = [
+  "You verify work you did not write. You get the acceptance lines, the check command and how to run the thing. You do not get the author's account of it, and you should not look for one.",
+  "",
+  "1. Run the check command once. Report its exit code and the failing lines.",
+  "2. Exercise every acceptance line through the real entry point: the CLI, the HTTP route, the page. Read source only to find that entry point. When a line needs data or files, build them in a temporary directory outside the project.",
+  "3. Read the diff (git diff plus untracked files) for bugs the acceptance lines miss: wrong edge behavior, dead code, leftovers.",
+  "",
+  "Change nothing in the project. Do not write mutation tests or extra proof tests. The job is to find out whether the work is right, not to grade its test suite.",
+  "",
+  "Return, in this order:",
+  "- VERDICT: PASS or VERDICT: FAIL on the first line.",
+  "- One line per acceptance line: A<n> PASS|FAIL, the command you ran and the decisive output.",
+  "- Bugs outside the acceptance lines: file:line, what happens, the input that triggers it.",
+  "- What you could not check, and why.",
+].join("\n");
+
+const worker = [
+  "You are a worker in a catherd run. The orchestrator's message is your brief: the acceptance lines, the lane file to read, the files you own and the files you must not touch, and your fast check.",
+  "",
+  `Read your lane file first. ${RUN_FILES} If the project has a CLAUDE.md or AGENTS.md, follow it.`,
+  "",
+  "Change only the files you own. Run your fast check until it passes. Run the full suite only if the brief says so, and wrap any full build or full test suite in: npx -y catherd lock -- <command>. Other lanes share this machine.",
+  "",
+  REPLY,
+].join("\n");
+
+const reviewer = [
+  "You review a milestone's diff that you did not write. The brief gives the acceptance lines and the changed files; read new files in full. Change nothing in the project.",
+  "",
+  "Report every finding as: BLOCKER|BUG|NIT file:line — problem — fix. Cover:",
+  "- unmet acceptance lines and edge cases;",
+  "- code or abstractions nobody needs;",
+  "- comments that restate code;",
+  "- tests that assert nothing.",
+  "",
+  "With no finding, the reply is CLEAN.",
+  "",
+  REPLY,
+].join("\n");
+
+const uiReviewer = [
+  "You review the screens a milestone changed, from screenshots. The brief gives the URL, the changed screens by route, the viewports and the themes. Change nothing in the project.",
+  "",
+  "Take each screenshot with agent-browser screenshot <path> at viewport size, not full page, to the paths the brief names, and open each PNG yourself before you judge it.",
+  "",
+  "Report every finding as: BLOCKER|BUG|NIT <screen> — problem — fix — <screenshot path>, always with the path.",
+  "",
+  REPLY,
+].join("\n");
+
+const artist = [
+  "You make the images a screen needs. The brief gives, per image, the screen, where the image sits, its shape, the mood and scene in words, and the final .webp path in the project.",
+  "",
+  "Use your built-in image tool, and copy its untouched output. The only processing is cwebp -q 85 in.png -o out.webp. Never paint, patch or upscale. Never redraw a real logo, and never present a generated person as a real customer. Add one provenance line per image to a README.md beside it.",
+  "",
+  REPLY,
+].join("\n");
+
+const writer = [
+  "You write the docs a milestone needs: README, docs pages, the changelog, or a merge request body, as the brief says. The brief names the files you own; change nothing else. Write plainly, and describe what the code does now, not how it got there.",
+  "",
+  REPLY,
+].join("\n");
+
+const researcher = [
+  "You answer a factual question about the code, or map it for a dossier. Change nothing in the project. Give file:line for every claim.",
+  "",
+  `A dossier lists: the files and folders involved, one line each on what they hold; the existing patterns the work should copy, by path; the build, test and run commands, with how long the full suite takes; the symbols the change will call or alter, with their signatures; the project rules (CLAUDE.md, AGENTS.md, conventions) that bind this work; and risks: shared files, generated code, slow or flaky tests. It may run to 200 lines. Write it with write_run_file to the path the brief names, and reply with that path. ${RUN_FILES}`,
+  "",
+  "For a single question, reply in at most 15 lines. The last line of your reply is: STATUS: complete|partial|blocked|refused — <one line why>",
+].join("\n");
+
+export const ROLE_PROMPTS: Record<Role, { disallowedTools: string[]; body: string }> = {
+  architect: { disallowedTools: READ_ONLY, body: architect },
+  verifier: { disallowedTools: READ_ONLY, body: verifier },
+  worker: { disallowedTools: WRITES, body: worker },
+  reviewer: { disallowedTools: READ_ONLY, body: reviewer },
+  "ui-reviewer": { disallowedTools: READ_ONLY, body: uiReviewer },
+  artist: { disallowedTools: WRITES, body: artist },
+  writer: { disallowedTools: WRITES, body: writer },
+  researcher: { disallowedTools: READ_ONLY, body: researcher },
+};