oris-skills 2.2.1 → 2.2.3

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## Unreleased
+
+- **Settings are per-project and tiny**: moved out of the user-global `~/.oris/settings.json` into `.oris-flow/settings.json`, holding only `orisFlow.responseStyle` (`standard`/`caveman`) and `orisFlow.artifactLanguage` (document language, default `en`). The installer no longer creates a settings file.
+- **Test profiles removed**: the whole profile/secret subsystem is gone — `defaultProfiles`, `profiles`, the adapter `profile` block and its env mappings, and the loop's profile-gating. Every project drives its own e2e/CI tooling; Oris stores no credentials.
+- **No UI-language setting**: chat, menus, and question labels follow the language the user writes (deduced from context); only generated documents use `artifactLanguage`.
+- **No refresh-policy setting**: map freshness is answered by the `headSha` anchor (`flow scan --check`); the advisory `refreshPolicy` field was dropped from the manifest and schema.
+- **Questions & subagents fire reliably**: conventions now bind a platform question call (Claude `AskUserQuestion`) as a tool call rather than optional chat text, and treat entering an Oris route as the explicit request to spawn scan subagents — so gates open their UI and setup fans out by default.
+
 ## 2.2.1 - 2026-07-07
 
 - **Loop roles are invisible to users**: the installer no longer writes `oris-loop-{executor,verifier,doctor,debriefer}` into `~/.cursor/agents/`, `~/.claude/agents/`, or `~/.codex/agents/` — they showed up as manually invocable subagents, but the loop orchestrator never spawns them by name (it passes each loop's `prompts/<role>.md` to a generic subagent). `agents/` stays in the repo as the canonical role definitions for development. Uninstall (and therefore reinstall/upgrade) now also removes adapters left behind by earlier versions.

package/README.md

@@ -91,9 +91,10 @@ Stop anything, anytime: `npx oris-skills loop chat --action stop`.
 
 ## Tuning
 
-Settings live in `~/.oris/settings.json` (`/oris-flow` → Setup → language & profiles):
-chat and document language (`en`/`it`), test profiles, and `responseStyle: "caveman"` —
-chat shrinks to maximum token density while documents and safety gates stay complete.
+Settings live in `.oris-flow/settings.json` (`/oris-flow` → Setup): document language
+(`artifactLanguage`, default `en`) and `responseStyle` (`standard`/`caveman`, where
+caveman shrinks chat to maximum token density while documents and safety gates stay
+complete). Chat language is deduced from your messages, not configured.
 
 ## Repository layout
 

package/docs/adr/README.md

@@ -0,0 +1,5 @@
+# Architecture Decision Records
+
+Decisions agents must not re-litigate. Format: `NNNN-short-title.md`.
+
+Each ADR: context, decision, consequences. See `docs/architecture.md` for current principles.

package/docs/distribution.md

@@ -14,13 +14,12 @@ The installer detects Cursor / Claude Code / Codex from `~/.cursor`, `~/.claude`
 
 ```text
 ~/.oris/oris-skills/        bundle: scripts, skills, references, agents, docs
-~/.oris/settings.json       user settings (created only if missing)
 ~/.cursor/skills/<name>/    Cursor skills (marker-managed)
 ~/.claude/skills/<name>/    Claude Code skills (marker-managed)
 ~/.codex/prompts/<name>.md  Codex prompts pointing to the bundled SKILL.md
 ```
 
-Project assets live only in each repository's `.oris-flow/` (adapter, loops, runtime) plus thin hook wrappers in `.cursor/hooks/` and `.claude/hooks/` written by `npx oris-skills loop bootstrap`.
+Project assets live only in each repository's `.oris-flow/` (adapter, settings, loops, runtime) plus thin hook wrappers in `.cursor/hooks/` and `.claude/hooks/` written by `npx oris-skills loop bootstrap`.
 
 ## Uninstall / reinstall
 

package/docs/user-guide.md

@@ -42,4 +42,4 @@ npx oris-skills reinstall
 ```
 
 Uninstall removes only Oris-owned paths (including legacy locations); preview with `--dry-run`.
-Settings (language, test profiles, `responseStyle: caveman` for ultra-short chat): `~/.oris/settings.json`, edited via `/oris-flow` → Setup.
+Settings (`artifactLanguage` for document language, `responseStyle: caveman` for ultra-short chat): `.oris-flow/settings.json`, edited via `/oris-flow` → Setup. Chat language is deduced from context, not configured.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oris-skills",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "description": "Oris Skills: one entry point (/oris-flow), guided discovery-to-implementation flow, and self-tuning verified loops for Cursor, Claude Code, and Codex.",
   "license": "MIT",
   "author": "Davide Baldassarre",

package/references/conventions.md

@@ -26,9 +26,18 @@ The `oris-skills` CLI is NOT installed globally. ALWAYS invoke it as `npx oris-s
 
 ## Questions
 
-- ASK with the platform question UI (Cursor `AskQuestion`, Claude `AskUserQuestion`); ELSE ask plainly in chat.
+- ASK through the platform's question tool — Claude `AskUserQuestion`, Cursor `AskQuestion`
+  (Plan Mode). A question turn = ONE call to it. Chat text is a fallback, NOT a choice: use
+  it ONLY when no such tool is available (e.g. Cursor Agent Mode) or the question cannot fit
+  the tool's schema (open-ended, or more options than it allows) — then present the options
+  as a lettered list.
+- Oris gates and interview questions ALWAYS qualify for the tool: the answer decides the
+  next step. NEVER skip the tool because an answer "looks like a sensible default".
+- FIT the schema: question tools cap the options (typically 4, meta-options included).
+  MORE options → split into a two-level question (category first) or use the deliberate
+  text fallback above.
 - ONE question per turn. Recommended answer FIRST.
-- ALWAYS include, localized to `uiLanguage`:
+- ALWAYS include, in the user's language:
   - `Explain the options` / `Spiega le opzioni` — explain, then re-ask the same question.
   - During interviews: `Enough questions — proceed` / `Basta domande — procedi` (early exit → go to the generation gate; NOT approval to write).
 - NEVER ask what the workspace, docs, code, or setup map already answer. Explore first.
@@ -41,12 +50,18 @@ The `oris-skills` CLI is NOT installed globally. ALWAYS invoke it as `npx oris-s
 
 ## Language
 
-- READ `references/settings.md` (user settings: `~/.oris/settings.json`).
-- Chat + questions: `uiLanguage`. Generated documents: `artifactLanguage`. Default both: `en`.
+- CHAT, menus, and question labels: the language the user writes — DEDUCED from context,
+  no setting. NEVER ask which language to use when the conversation already shows it.
+- GENERATED documents: `orisFlow.artifactLanguage` from `.oris-flow/settings.json`
+  (default `en`).
+- Skill instructions and code stay English.
+- COMMIT messages and PULL REQUEST titles/descriptions: ALWAYS English, whatever the chat
+  language or `artifactLanguage`. Work-item references follow the DevOps provider's
+  `workItemSyntax` (`references/devops.md`).
 
 ## Response style
 
-READ `orisFlow.responseStyle` (`standard` | `caveman`, default `standard`).
+READ `orisFlow.responseStyle` from `.oris-flow/settings.json` (`standard` | `caveman`, default `standard`).
 
 `caveman` = the user pays per token; chat goes maximum density. The contract, in its own voice:
 
@@ -75,5 +90,11 @@ labels, receipts, error reports, and anything another session must read cold.
 
 ## Subagents
 
-- USE parallel subagents for independent scans when the platform has them (Cursor subagents, Claude Task tool).
+- USE parallel subagents for independent scans when the platform's agent tool is in the
+  tool list (Claude `Agent` tool — formerly Task; Cursor subagents).
+- The user invoking an Oris route IS the explicit request to spawn: when a route step
+  names subagent scans, platform guidance like "only spawn when the user asks" is
+  satisfied — do not skip on that ground.
+- WHEN the platform has no agent tool (or spawning is blocked) → run the same scans
+  inline, sequentially, same coverage. Coverage never shrinks; only parallelism does.
 - KEEP subagent output compact: summaries and pointers, not raw logs.

package/references/devops.md

@@ -0,0 +1,58 @@
+# Oris DevOps
+
+How Oris connects to a DevOps platform for commits, pull requests, and work items.
+Swappable by design: today Azure DevOps, tomorrow Jira or GitHub — same flows, a different
+provider block. Non-secret only; Oris stores NO credentials
+(`references/conventions.md` `## Gates`).
+
+## Config surface
+
+Resolved in order, each layer overriding the previous:
+
+1. Built-in Oris default (`azure-devops`, org `orislineweb`, MCP `oris-devops`).
+2. Organization: `~/.oris/devops.json` — shared defaults for everyone in the org.
+3. Repository: `.oris-flow/devops.json` — this repo's override.
+
+Shape (`references/devops.schema.json`):
+
+```json
+{
+  "version": 1,
+  "devops": {
+    "provider": "azure-devops",
+    "organization": "orislineweb",
+    "workItemSyntax": "#{id}",
+    "commitLanguage": "en",
+    "prLanguage": "en",
+    "mcp": {
+      "name": "oris-devops",
+      "package": "@azure-devops/mcp@2.7.0",
+      "domains": ["core", "work", "work-items", "repositories"]
+    }
+  }
+}
+```
+
+- `provider` — the DevOps platform. Swap this (and the `mcp` block) to move off Azure.
+- `organization` — org/account slug; substituted into the MCP command.
+- `workItemSyntax` — how a work item id is written in commits/PRs. `#{id}` → `#1234`.
+- `commitLanguage` / `prLanguage` — always `en`; commits and PRs are English by contract.
+- `mcp` — the MCP server Oris seeds (`oris-devops`) so agents can read work items and
+  repositories. Auth is the platform's own (PAT / sign-in), never Oris's.
+
+## Rules
+
+1. READ the resolved config before composing a commit or PR.
+2. NEVER store credentials in `.oris-flow/**`, `~/.oris/**`, or any Oris file.
+3. Missing provider auth → degrade: compose the message, tell the user, do not block.
+4. CONFIRM before writing any devops config file.
+
+## Never
+
+- Put secrets or tokens in a devops config file.
+- Hardcode a platform in the flows — read `provider` and act generically.
+
+## Done when
+
+- [ ] Effective config resolved from default → org → repo before acting.
+- [ ] No credentials written anywhere under Oris.

package/references/devops.schema.json

@@ -0,0 +1,54 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Oris DevOps Provider",
+  "$id": "https://oris.dev/schemas/oris-flow-devops-v1.json",
+  "type": "object",
+  "required": ["version", "devops"],
+  "additionalProperties": false,
+  "properties": {
+    "version": {
+      "type": "integer",
+      "const": 1
+    },
+    "devops": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "provider": {
+          "type": "string",
+          "description": "DevOps platform id (e.g. azure-devops, github, jira). Swap this and the mcp block to change platform."
+        },
+        "organization": {
+          "type": "string",
+          "description": "Org/account slug substituted into the MCP command. Non-secret."
+        },
+        "workItemSyntax": {
+          "type": "string",
+          "description": "How a work item id is written in commits/PRs. Template with {id}, e.g. #{id} -> #1234."
+        },
+        "commitLanguage": {
+          "type": "string",
+          "minLength": 2,
+          "description": "Language for commit messages. Always en by contract."
+        },
+        "prLanguage": {
+          "type": "string",
+          "minLength": 2,
+          "description": "Language for pull request titles/descriptions. Always en by contract."
+        },
+        "mcp": {
+          "type": "object",
+          "additionalProperties": false,
+          "description": "MCP server Oris seeds so agents can read work items and repositories. No credentials.",
+          "properties": {
+            "name": { "type": "string" },
+            "package": { "type": "string" },
+            "domains": { "type": "array", "items": { "type": "string" } },
+            "command": { "type": "string" },
+            "args": { "type": "array", "items": { "type": "string" } }
+          }
+        }
+      }
+    }
+  }
+}

package/references/doc-policy.md

@@ -32,7 +32,7 @@ NEVER split one feature's docs across unrelated directories.
 
 ## Rules
 
-1. Language: documents in `artifactLanguage`; skill instructions stay English.
+1. Language: documents in `artifactLanguage` (default `en`); chat/UI language is deduced from context. Skill instructions and code stay English.
 2. Steps are independent: any document may be created without the previous one. State the missing source once, use the strongest confirmed source, record the gap in the document ("not available" localized). Never block on a missing predecessor.
 3. INSPECT the task folder + setup map before asking the user or writing.
 4. Every document ends with a change-history table: date | source | change | reason. Later changes rewrite the affected sections AND add a history row — no inline "changed!" notes.

package/references/loop-adapter.schema.json

@@ -4,7 +4,7 @@
   "title": "Oris Loop Repository Adapter",
   "type": "object",
   "additionalProperties": false,
-  "required": ["$schema", "schemaVersion", "repository", "paths", "commands", "profile", "preflight"],
+  "required": ["$schema", "schemaVersion", "repository", "paths", "commands", "preflight"],
   "properties": {
     "$schema": {
       "const": "https://oris.dev/schemas/oris-loop-adapter-v1.json"
@@ -54,22 +54,6 @@
       "propertyNames": { "pattern": "^[a-z][a-z0-9-]*$" },
       "additionalProperties": { "type": "string", "minLength": 1 }
     },
-    "profile": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["required", "defaultRole", "mappings"],
-      "properties": {
-        "required": { "type": "boolean" },
-        "defaultRole": {
-          "type": "string",
-          "pattern": "^[a-z][a-zA-Z0-9]*$"
-        },
-        "mappings": {
-          "type": "array",
-          "items": { "$ref": "#/$defs/mapping" }
-        }
-      }
-    },
     "preflight": {
       "type": "object",
       "additionalProperties": false,
@@ -104,23 +88,6 @@
           "minimum": 0
         }
       }
-    },
-    "mapping": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["env", "from", "required", "secret"],
-      "properties": {
-        "env": {
-          "type": "string",
-          "pattern": "^[A-Z_][A-Z0-9_]*$"
-        },
-        "from": {
-          "type": "string",
-          "pattern": "^[A-Za-z][A-Za-z0-9]*(\\.[A-Za-z][A-Za-z0-9]*)*$"
-        },
-        "required": { "type": "boolean" },
-        "secret": { "type": "boolean" }
-      }
     }
   }
 }

package/references/repo-map.md

@@ -6,10 +6,10 @@ Setup map = the default project context for every Oris skill and loop. It exists
 
 | File | Scope | Purpose |
 |------|-------|---------|
-| `.oris-flow/manifest.json` | repo | compact index: section paths, freshness, confidence, refresh policy |
+| `.oris-flow/manifest.json` | repo | compact index: section paths, freshness, confidence |
 | `.oris-flow/maps/**` | repo | short markdown maps: docs, stack, commands, code areas, tests |
 | `.oris-flow/adapter.json` | repo | loop adapter: paths, commands, model aliases |
-| `~/.oris/settings.json` | user | language + test profiles |
+| `.oris-flow/settings.json` | repo | preferences: `responseStyle` + `artifactLanguage` (non-secret) |
 | `{tasksRoot}/{task}/…` | task | business artifacts only — `setup.tasksRoot` in the manifest, default `.oris-flow/tasks` (see `references/doc-policy.md`) |
 
 Manifest and maps are never task authority and NEVER hold secrets.
@@ -24,7 +24,6 @@ Manifest and maps are never task authority and NEVER hold secrets.
   "generatedAt": "",
   "updatedAt": "",
   "setup": { "versionControl": { "orisFlowMap": "commit" } },
-  "refreshPolicy": {},
   "sections": {}
 }
 ```
@@ -46,7 +45,6 @@ Each section: purpose, authoritative paths, confirmed decisions, key commands/co
 2. VERIFY stale or high-risk facts against the repository before consequential actions.
 3. Loops: the orchestrator passes relevant setup-map facts into role prompts at craft time; users never repeat project facts per loop.
 4. SUGGEST `/oris-flow` → Setup refresh only when a stale gap materially affects the task.
-5. Refresh policy is advisory — never a scheduler.
 
 ## Command surface
 

package/references/repo-map.schema.json

@@ -49,9 +49,6 @@
     "setup": {
       "$ref": "#/$defs/setup"
     },
-    "refreshPolicy": {
-      "$ref": "#/$defs/refreshPolicy"
-    },
     "sections": {
       "$ref": "#/$defs/sections"
     },
@@ -106,29 +103,6 @@
         "pattern": "^[a-z][a-zA-Z0-9-]*$"
       }
     },
-    "refreshPolicy": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["mode"],
-      "properties": {
-        "mode": {
-          "type": "string",
-          "enum": ["manual", "monthly", "after-major-refactor", "after-test-layout-change"]
-        },
-        "suggestAfterDays": {
-          "type": "integer",
-          "minimum": 1
-        },
-        "triggers": {
-          "type": "array",
-          "items": {
-            "type": "string",
-            "enum": ["after-major-refactor", "after-test-layout-change"]
-          },
-          "uniqueItems": true
-        }
-      }
-    },
     "setup": {
       "type": "object",
       "additionalProperties": false,

package/references/settings.md

@@ -1,36 +1,24 @@
 # Oris Settings
 
-User-local settings, never bundle content. Path: `~/.oris/settings.json` (all platforms).
-The installer creates it when missing; it NEVER overwrites an existing file.
+Per-project preferences. Path: `.oris-flow/settings.json`. Small and non-secret —
+chat verbosity and document language, nothing else. Missing file → defaults below.
+Created/edited via `/oris-flow` → Setup, or by hand.
 
 ## Shape (v1)
 
 ```json
 {
   "version": 1,
-  "orisFlow": { "uiLanguage": "en", "artifactLanguage": "en", "responseStyle": "standard" },
-  "defaultProfiles": { "testing": "default" },
-  "profiles": {
-    "default": {
-      "environment": "local",
-      "values": { "baseUrl": "" },
-      "secrets": { "username": "", "password": "" },
-      "flags": { "allowDataMutation": false }
-    }
-  }
+  "orisFlow": { "responseStyle": "standard", "artifactLanguage": "en" }
 }
 ```
 
-- `uiLanguage` → chat, menus, question labels, recaps (`en` | `it`, default `en`).
-- `artifactLanguage` → generated documents (`en` | `it`, default `en`).
 - `responseStyle` → chat verbosity (`standard` | `caveman`, default `standard`). Caveman = maximum token density in chat; contract in `references/conventions.md` `## Response style`. Documents and gates are never compressed.
-- `profiles` → repository-neutral test logins/config. The repo adapter maps profile fields to roles.
-- `flags.allowDataMutation` → data mutation allowed ONLY with `environment: local` + loopback URLs + this flag true.
+- `artifactLanguage` → language for generated documents (ISO code, default `en`). Chat/UI language is NOT configured here — it is deduced from the conversation.
 
 ## Rules
 
-1. READ settings before the first workflow question; missing/invalid → defaults above.
+1. READ settings before the first workflow decision; missing/invalid → defaults above.
 2. Current user instructions override settings for the turn.
-3. Passwords: only in this file. NEVER committed, printed, put in docs, loop state, receipts, or CLI args. Mask as `***` everywhere.
-4. CONFIRM before writing settings. Update via `/oris-flow` → Setup → language & profiles.
-5. In an approved loop scope, use only the profile/commands/tools the loop declares; otherwise `blocked`.
+3. Oris stores no credentials. Test/CI secrets belong to each project's own tooling — never Oris files, docs, loop state, receipts, or logs.
+4. CONFIRM before writing settings. Update via `/oris-flow` → Setup.

package/references/settings.schema.json

@@ -1,80 +1,30 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "title": "Oris Flow Settings",
-  "type": "object",
-  "$id": "https://oris.dev/schemas/oris-flow-settings-v1.json",
-  "required": ["version", "orisFlow", "defaultProfiles", "profiles"],
-  "additionalProperties": false,
-  "properties": {
-    "version": {
-      "type": "integer",
-      "const": 1
-    },
-    "orisFlow": {
-      "type": "object",
-      "required": ["uiLanguage", "artifactLanguage"],
-      "additionalProperties": false,
-      "properties": {
-        "uiLanguage": {
-          "type": "string",
-          "enum": ["en", "it"]
-        },
-        "artifactLanguage": {
-          "type": "string",
-          "enum": ["it", "en"]
-        },
-        "responseStyle": {
-          "type": "string",
-          "enum": ["standard", "caveman"],
-          "description": "Chat verbosity: standard prose or caveman (maximum token density; documents and gates never compressed)."
-        }
-      }
-    },
-    "defaultProfiles": {
-      "type": "object",
-      "minProperties": 1,
-      "additionalProperties": {
-        "type": "string",
-        "minLength": 1
-      }
-    },
-    "profiles": {
-      "type": "object",
-      "minProperties": 1,
-      "additionalProperties": {
-        "$ref": "#/$defs/profile"
-      }
-    }
-  },
-  "$defs": {
-    "profile": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["environment", "values", "secrets", "flags"],
-      "properties": {
-        "environment": {
-          "type": "string",
-          "minLength": 1
-        },
-        "values": {
-          "type": "object",
-          "additionalProperties": {
-            "type": ["string", "number", "boolean"]
-          }
-        },
-        "secrets": {
-          "type": "object",
-          "additionalProperties": {
-            "type": "string"
-          }
-        },
-        "flags": {
-          "type": "object",
-          "additionalProperties": {
-            "type": "boolean"
-          }
-        }
-      }
-    }
-  }
-}
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Oris Flow Settings",
+  "$id": "https://oris.dev/schemas/oris-flow-settings-v1.json",
+  "type": "object",
+  "required": ["version", "orisFlow"],
+  "additionalProperties": false,
+  "properties": {
+    "version": {
+      "type": "integer",
+      "const": 1
+    },
+    "orisFlow": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "responseStyle": {
+          "type": "string",
+          "enum": ["standard", "caveman"],
+          "description": "Chat verbosity: standard prose or caveman (maximum token density; documents and gates never compressed). Default standard."
+        },
+        "artifactLanguage": {
+          "type": "string",
+          "minLength": 2,
+          "description": "Language for generated documents (ISO code, e.g. en, it). Default en. Chat language is deduced from the conversation, not configured here."
+        }
+      }
+    }
+  }
+}

package/scripts/flow/oris-flow-devops.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+/**
+ * Built-in Oris default DevOps provider. Non-secret only — org and repo layers override it.
+ * The provider is swappable: move off Azure DevOps by overriding `provider` and `mcp`.
+ */
+export const DEFAULT_DEVOPS = {
+  version: 1,
+  devops: {
+    provider: "azure-devops",
+    organization: "orislineweb",
+    workItemSyntax: "#{id}",
+    commitLanguage: "en",
+    prLanguage: "en",
+    mcp: {
+      name: "oris-devops",
+      package: "@azure-devops/mcp@2.7.0",
+      domains: ["core", "work", "work-items", "repositories"],
+    },
+  },
+};
+
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/** Deep-merge source over target; arrays and scalars replace, plain objects merge. */
+function deepMerge(target, source) {
+  if (!isPlainObject(source)) return source;
+  const out = isPlainObject(target) ? { ...target } : {};
+  for (const [key, value] of Object.entries(source)) {
+    out[key] = isPlainObject(value) ? deepMerge(out[key], value) : value;
+  }
+  return out;
+}
+
+function readJson(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve the effective DevOps config: built-in default → org (`~/.oris/devops.json`) →
+ * repository (`.oris-flow/devops.json`). Missing or invalid layers are skipped, never fatal.
+ */
+export function resolveDevops(repositoryRoot, options = {}) {
+  const home = options.home ?? os.homedir();
+  const orgFile = readJson(path.join(home, ".oris", "devops.json"));
+  const repoFile = repositoryRoot ? readJson(path.join(repositoryRoot, ".oris-flow", "devops.json")) : null;
+  let resolved = DEFAULT_DEVOPS;
+  for (const layer of [orgFile, repoFile]) {
+    if (isPlainObject(layer)) resolved = deepMerge(resolved, layer);
+  }
+  return resolved;
+}
+
+/**
+ * Build the MCP server entry for an agent config from a resolved `devops` block. Azure
+ * DevOps command shape by default; any provider can supply explicit `mcp.args` instead.
+ */
+export function buildMcpServer(devops) {
+  const mcp = devops.mcp ?? {};
+  if (Array.isArray(mcp.args)) return { command: mcp.command ?? "npx", args: [...mcp.args] };
+  const domains = Array.isArray(mcp.domains) ? mcp.domains : [];
+  return { command: "npx", args: ["-y", mcp.package, devops.organization, "-d", ...domains] };
+}
+
+export function mcpServerName(devops) {
+  return devops.mcp?.name ?? "oris-devops";
+}

package/scripts/flow/oris-flow-layout.mjs

@@ -8,9 +8,9 @@ export const ORIS_FLOW_TASKS_ROOT = ".oris-flow/tasks";
 export const ORIS_FLOW_ADAPTER = ".oris-flow/adapter.json";
 export const ORIS_FLOW_LOOPS_ROOT = ".oris-flow/loops";
 export const ORIS_FLOW_RUNTIME = ".oris-flow/runtime";
+export const ORIS_FLOW_SETTINGS = ".oris-flow/settings.json";
 export const ORIS_HOME = path.join(os.homedir(), ".oris");
 export const ORIS_BUNDLE_ROOT = path.join(ORIS_HOME, "oris-skills");
-export const ORIS_SKILLS_SETTINGS = path.join(ORIS_HOME, "settings.json");
 export const ORIS_LOOP_SCHEMA = "https://oris.dev/schemas/oris-loop-adapter-v1.json";
 export const ORIS_LOOP_SCHEMA_VERSION = 1;
 export const ORIS_LOOP_DOCUMENT_VERSION = 2;