voidmachine 6.0.0 → 7.0.0

package/core-assets/skills/void-commit-discipline/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: void-commit-discipline
-description: Conventional Commits + mandatory "why" in body + scope + breaking-change marking. ASCII-only (no em dash, no emoji). Co-author trailer for AI pair. The git log is documentation. Use at every commit.
+description: Conventional Commits + mandatory "why" in body + scope + breaking-change marking. Co-author trailer for AI pair. The git log is documentation. Use at every commit.
 ---
 
 # commit-discipline — voidcorp craftsman edition
@@ -27,7 +27,7 @@ The git log is the project's living narrative. "fix stuff" / "wip" / "asdf" dest
 |---|---|
 | `feat` | New observable behavior (new feature, new endpoint, new component visible to users / consumers) |
 | `fix` | Bug fix. Composes with `void-debug` (the why = the root cause) |
-| `void-refactor` | Structural change without behavior change. Composes with `void-refactor` (named Fowler move) |
+| `refactor` | Structural change without behavior change. Composes with `void-refactor` (named Fowler move) |
 | `test` | Add / modify tests without changing production code. Includes `test: reproduce <bug>` from `void-debug` |
 | `docs` | Documentation only |
 | `chore` | Repo maintenance (config, scripts, tooling) without user-visible effect |
@@ -48,11 +48,11 @@ No invented types (`improve:`, `tweak:`, `cleanup:`). Reach for one of the above
 
 ### Body rules
 
-- Always present for `feat`, `fix`, `void-refactor`, `perf` commits. Optional for trivial `chore` / `style`.
+- Always present for `feat`, `fix`, `refactor`, `perf` commits. Optional for trivial `chore` / `style`.
 - Wrapped at ≤ 72 columns
 - Explains the WHY: rationale, constraint, spec link, root cause
 - Multi-line bullets fine
-- ASCII only — no em dash, no emoji (the harness invariant)
+- Follow the philosophy's prose rule: avoid decorative filler; meaningful punctuation and glyphs are allowed.
 
 ### Footers
 
@@ -145,10 +145,6 @@ The author cannot tell, the reviewer cannot tell, future maintainers cannot tell
 
 The companion hook `tidying-commit-prefix` (already shipped) flags `refactor:` with behavior-change keywords in body.
 
-### Em dash, emoji, non-ASCII
-
-The harness invariant: English ASCII commit messages. Hyphens (`-`) for ranges, hyphens for parenthetical, not em dash. The companion hook `no-emdash-no-emoji-in-commit-msg` blocks.
-
 ### Missing "why" for substantive commits
 
 `feat:` / `fix:` / `refactor:` / `perf:` without a body explaining why = rejected. The commit message is documentation.
@@ -174,7 +170,6 @@ prove that chronology. Retain the actual test commands/results and explain the r
 - `commitlint-precommit` (commit-msg, in `pack-monorepo`) — already in void-starter. Enforces conventional commits.
 - `tidying-commit-prefix` (commit-msg, already shipped in core/hooks) — warns on mixed-intent `refactor:` commits.
 - `refactor-named-grep` (commit-msg, already shipped) — warns on `refactor:` without a Fowler name.
-- `no-emdash-no-emoji-in-commit-msg` (commit-msg, in `pack-monorepo`) — blocks em dash and emoji.
 
 ---
 
@@ -192,7 +187,6 @@ prove that chronology. Retain the actual test commands/results and explain the r
 
 - MUST NOT decide whether the change itself is correct (that is the upstream skills' job).
 - MUST NOT permit vacuous subjects.
-- MUST NOT permit em dash / emoji / non-ASCII.
 - MUST NOT permit `feat:` / `fix:` / `refactor:` without a body why.
 - MUST NOT substitute phase commit messages for observed RED/GREEN evidence.
 - MUST NOT silently allow invented commit types.
@@ -202,7 +196,7 @@ prove that chronology. Retain the actual test commands/results and explain the r
 ## Final rule
 
 ```
-Every commit → conventional format + imperative subject ≤ 72 + body explains WHY + ASCII + AI co-author trailer.
+Every commit → conventional format + imperative subject ≤ 72 + body explains WHY + AI co-author trailer.
 Substantive (feat/fix/refactor/perf) → body mandatory.
 Otherwise → it is not voidcorp commit-discipline.
 ```

package/core-assets/skills/void-frontend-design/SKILL.md

@@ -19,7 +19,7 @@ Every UI is designed mobile-first AND must reach first-class quality on both vie
 
 - **Layout starts at 360–390px** (iPhone 12 mini → 15 Pro range), progressively enhanced wider.
 - **Never the reverse.** No "desktop-first then squeeze for mobile."
-- **Both viewports screenshot-reviewed before merge** — `viewport-screenshot-gate` hook (shared with `void-accessibility`).
+- **Both viewports screenshot-reviewed before merge** — inspect actual captures; the optional `viewport-screenshot-gate` script only checks PR text.
 - **No mobile-only / desktop-only features** without an explicit decision recorded through the `void-decide` skill.
 - **Performance budget enforced for both**: LCP < 2.5s on slow 4G mobile AND on desktop fiber (measure with the project's perf tooling — Lighthouse CI, WebPageTest, bundlesize).
 
@@ -234,7 +234,7 @@ import { Button } from '@repo/ui';
 
 ## Companion hooks
 
-- `viewport-screenshot-gate` (pre-PR on UI changes, shared with `void-accessibility`) — fails PRs lacking both mobile and desktop screenshots.
+- `viewport-screenshot-gate` (pre-PR on UI changes, shared with `void-accessibility`) — optional PR-text heuristic, not a wired native/CI gate or image validation. Review actual captures.
 - `anti-ai-slop-grep` (pre-commit) — warns on banned copy patterns. Initial list of ~10; grows from `void-learn` harness-gap feedback.
 
 See `../../hooks/`.

package/core-assets/skills/void-hexagonal-architecture/SKILL.md

@@ -31,9 +31,9 @@ The domain decides; the world translates. Ports are interfaces the domain owns.
                      infrastructure (Drizzle, fetch, Resend SDK, ...)
 ```
 
-Read it: the domain depends on its own port interfaces. Adapters depend on the port interfaces and on infrastructure. **Infrastructure NEVER depends on the domain.** Reversing this direction is a Red Flag.
+Read it: the domain depends on its own port interfaces. Adapters depend on the port interfaces and on infrastructure. The domain never imports concrete infrastructure. Adapters may depend on domain-owned ports.
 
-The companion hook `boundary-direction-check` enforces this on every commit.
+Review enforces this architectural direction. The `boundary-direction-check` hook checks declared package dependencies; it does not infer domain/adapters layers from paths.
 
 ---
 
@@ -124,7 +124,7 @@ export function createDrizzleOrdersAdapter(db: Database): OrdersPort {
 
 - Business decisions ("if order total > $1000, set priority")
 - Cross-port coordination ("save to DB AND emit event in one method")
-- Validation beyond type translation (Zod for trust-boundary input lives in use-cases or boundary, not in adapters)
+- Business invariants belong in the domain. Validate untrusted external data at adapter ingress (for example with Zod), before passing typed input to a use-case.
 
 ### The "fat port" smell
 
@@ -231,13 +231,13 @@ Replayable event log is an audit / temporal tool, not a default persistence stra
 
 ### Domain → infrastructure imports
 
-The companion hook blocks. There is no legitimate exception.
+Review rejects this dependency direction; a package-manifest check alone cannot prove internal layer isolation.
 
 ---
 
 ## Companion hooks
 
-- **`boundary-direction-check`** (pre-commit) — greps cross-layer imports forbidden by the architecture (domain → infrastructure / adapters). See `../../hooks/`.
+- **`boundary-direction-check`** (PreToolUse) checks scoped package imports against the nearest package manifest. It does not validate internal layer imports. See `void-dependency-direction` for the pack convention.
 
 ---
 

package/core-assets/skills/void-implement/SKILL.md

@@ -28,6 +28,9 @@ executes it: never delegate this complete workflow again. Tiny direct work and
 capability fallbacks follow that policy without skipping triggered quality gates.
 Preserve one `leadWriterId` through corrections; the coordinator retains user intent
 and decisions. Pass any orchestrator-owned panel contract unchanged.
+For the writer and delegated reviewers, compose `void-orchestrate` to publish
+observed worker lifecycle events in the canonical mission. Display metadata never
+replaces the implementation or independent review receipts below.
 
 ## Optional usage linkage
 
@@ -78,7 +81,7 @@ materializes its runtime-neutral specialist envelopes from the current plan.
    unaffected conclusions and proofs; invalidate only affected evidence. A new targeted blocker
    must demonstrate a regression from the correction or a defect within the original scope.
    Carry unresolved blockers until an explicit, evidenced resolution; silence is not resolution.
-7. Maximum two correction batches after the initial general review. A batch is submitted
+7. Maximum two correction batches after the initial general review. Under `void-autopilot`, its tighter two-total-review-round budget applies (initial plus one corrected head); see `docs/BOUNDED-REVIEWS.md`. A batch is submitted
    corrections awaiting targeted verification. Agent restart, incomplete review, transport repair
    and mission resumption neither consume a batch nor reset the budget. At the limit, stop
    automatic corrective dispatch, retain history and expose a cause, owner and next action.
@@ -92,8 +95,9 @@ materializes its runtime-neutral specialist envelopes from the current plan.
    prior reviews, resolutions, budgets and effects. Existing attestation-only stops need explicit
    validation of the original review's subject, available provenance and result before recovery;
    never promote a degraded historical result automatically or recreate the mission to bypass it.
-9. Collect the final result before closing an orchestrator-owned agent panel. Keep worktrees,
-   branches and useful proofs on their distinct lifecycle. Panel closure never deletes them.
+9. Collect the final result, then publish the worker terminal state and finished event
+   through `void-orchestrate`. Keep worktrees, branches and useful proofs on their distinct
+   lifecycle. External presentation tools own their surfaces; the harness does not close them.
 
 The CLI and existing Mission Engine implement this bounded cycle. A runtime certification is
 not an additional delivery gate. Concrete independence, permission, isolation, evidence and

package/core-assets/skills/void-observability/SKILL.md

@@ -45,7 +45,7 @@ logger.error({ err, orderId }, 'payment_failed');
 | `error` | Operation failed; user impact |
 | `warn` | Unexpected but handled |
 | `info` | Significant business event |
-| `void-debug` | Developer-time signal |
+| `debug` | Developer-time signal |
 | `trace` | Very granular (rarely committed) |
 
 ---
@@ -110,7 +110,7 @@ The adapter (per `void-hexagonal-architecture`) is where the catch lives. The er
 try { await doSomething(); } catch (e) { /* swallow */ }
 ```
 
-Either log it, or rethrow, or both. `catch (e) {}` is rejected.
+Logging alone does not recover a failed operation. Propagate a typed failure or rethrow; explicit recovery must preserve the caller's contract. Log at the boundary that owns the diagnosis, without duplicating the same failure at every layer.
 
 ---
 
@@ -121,7 +121,7 @@ Majors' rule. Log:
 - User ID (anonymized — `userId: hash(realId)` for Sentry; raw in internal logs only if compliance allows)
 - Org / tenant ID
 - Feature flags active
-- Session ID
+- Non-secret correlation ID (generated for tracing, never an authentication credential)
 - Browser / device / region
 - Business-meaningful tags (plan tier, signup source, conversion path)
 
@@ -184,7 +184,7 @@ Defense in depth. The discipline says "don't log it." The config says "even if y
 ## What NOT to log
 
 - Full request bodies (PII / secrets / massive payloads). Log specific fields with explicit allowlist.
-- Passwords, tokens, API keys, session IDs, JWTs (composes with `void-security-guidance`)
+- Passwords, tokens, API keys, authentication session IDs/cookies, JWTs (composes with `void-security-guidance`)
 - Email addresses unredacted in production logs (consider hashing or partial redaction depending on compliance)
 - Full database rows (PII risk)
 - LLM full prompts / responses (PII + cost) — log token counts and structural metadata, not content

package/core-assets/skills/void-orchestrate/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: void-orchestrate
-description: Delegate independent research and substantial implementation through native agents; choose context, isolation and bounded concurrency, collect results and preserve review evidence. Use the supported session host.
+description: Delegate independent research and substantial implementation through native agents; choose context, isolation and bounded concurrency, collect results and preserve review evidence. Publish observed worker lifecycle events.
 ---
 
 # Orchestrate
@@ -17,16 +17,10 @@ context, permissions, completion and resume capabilities. Use the best supported
 capabilities for the task in the current session; an installed executable or an
 environment hint alone does not validate a host, identity or permission.
 
-Herdr is optional for consumers, not discretionary inside a validated Herdr session.
-When fresh discovery validates the coordinator in Herdr, use its adapter below for
-durable terminal workers and mission visibility. Short agents remain native; never
-duplicate an agent to give it a pane. Outside Herdr, use the current supported host
-(such as tmux) when its required capabilities and ownership can be verified. This
-policy adds no tmux transport and never relaunches through the legacy kernel.
-Without supported presentation, retain native delegation and report the limitation;
-do not claim durability from a pane or unsupported API. Failed or ambiguous host
-discovery blocks the affected host action: diagnose it, never silently switch hosts
-or act on an unrelated project. Native work independent of that action may continue.
+Use native execution independently of presentation. The harness publishes worker
+observations; external plugins own windows, tabs and panes. Never discover or call
+a multiplexer to delegate, and never duplicate an agent to make it visible.
+An absent display cannot change execution permissions or invalidate real evidence.
 
 - Work directly for a tiny targeted change, a single tool call, mechanical processing,
   or tightly coupled work where delegation adds no useful separation.
@@ -70,22 +64,6 @@ conflict, rather than silently upgrading or claiming the quality requirement is
   and report the effective model only when the runtime supplies it; otherwise it is unknown.
   Use existing evidence/reporting, not a new registry. Report cost/time only when observed.
 
-## First ticket and optional worker tabs
-
-SessionStart discovers Herdr even before central mission files exist. Its advice
-requires a fresh caller pane at the canonical checkout and process ownership;
-environment variables alone never authorize a host action. Revalidate before launch.
-On a new implementation ticket, reuse the assigned writer if one exists. Otherwise,
-in a validated Herdr session, register the mission and planned worker first, then
-create one background tab in the resolved coordinator workspace with the assigned
-worktree as cwd. Read the installed `herdr tab` schema, preserve focus with
-`--no-focus`, and use the returned root pane for the single agent start below.
-Reattach a matching existing worker instead of opening another tab. The coordinator
-stays in its existing pane. Hooks only discover and advise; they never create tabs,
-launch agents or write central files. Without Herdr, use native delegation normally.
-An invalid host or explicit mission selection refuses only that host action;
-independent native work may continue with the limitation stated.
-
 ## Brief and bound the delegation
 
 Use a fresh context by default. Choose a supported fork only when the task needs
@@ -98,7 +76,7 @@ Formal specialist envelopes and evidence follow the independent contract below.
 
 Count writer, research and review children together against observed available runtime slots
 and the coordinator's bounded dispatch; queue work when full. Preserve tighter caller
-limits, including Autopilot's ticket cap and the central schema's four-worker limit.
+limits, including Autopilot's ticket cap.
 This is no machine-wide quota. Do not create recursive child coordinators or redispatch
 the same complete workflow. Required formal specialists remain dispatched by their
 designated owner within the shared available capacity. Do not duplicate a child's work
@@ -150,206 +128,56 @@ Preserve the complete result; incomplete results go back to the same agent.
 With `panel.provider: orchestrator`, only ORCH launches and collects this panel.
 Missing required native capability is reported with cause and next action.
 
-## Herdr adapter: recovery
-
-The following Herdr sections apply when the session-host policy selects this adapter.
-Native delegation without it does not require these central files or pane discovery.
-
-Read project instructions, the approved task and the current Git status. Preserve
-other writers' changes. Resolve the canonical Git common directory, SHA-256 its
-absolute real path as UTF-8, and inspect
-`~/.local/state/orchestra/<project>/<mission>/`. Never use an inherited workspace
-variable or a stale pane ID as authority. Read mission.md, the applicable
-workers/<label>/brief.md and report.md. Re-read `herdr pane list` before every
-identity decision. Match **label + worktree**, using the canonical worktree path.
-Refuse multiple matches, incomplete discovery, symlinks, traversal and invalid data.
-After reattachment/restart, ORCH atomically updates pane_id and coordinator.workspace
-from that validated fresh inventory. Hooks and workers never write these hints.
-A missing unrelated historical worktree does not invalidate a current identity.
-
-The coordinator is the existing ORCH session, never a second agent opened for display.
-Resolve its own label + worktree before selecting its workspace. Keep each writer
-in its assigned worktree. Do not affect any other project, workspace or pane.
-An uncertain launch or prompt acknowledgement requires reconciliation of that same
-worker before retrying. A timeout proves neither launch failure nor prompt loss.
-
-## Herdr adapter: explicit coordinator context
-
-If unique discovery refuses multiple compatible missions, ORCH reads the target
-mission and reports, then atomically replaces its local, unversioned
-`<canonical worktree>/.void/machine/orchestra-selection.json`. Schema 1 is strict
-JSON, at most 4096 UTF-8 bytes: `{ "schema": 1, "project": "<project-sha256>",
-"mission": "<existing-id>", "coordinator": { "label": "ORCH", "worktree":
-"/absolute/canonical/worktree" } }`. ORCH alone writes it; hooks never repair it.
-No unknown or duplicate keys, YAML, traversal, symlinks or partial writes.
-
-This selects context only, never execution state or permissions. Full bounded
-central discovery still runs; malformed unrelated missions or limits refuse.
-A stale/invalid binding never falls back. Verify selected coordinator label and
-canonical worktree against the current worktree and a fresh `herdr pane list`;
-missing or duplicate live matches refuse. Never prefer timestamps, running status
-or pane tokens to decide intent. Without a binding, preserve unique discovery.
-Clear/compact/resume re-read selection and central state without launching workers.
-Separate worker worktrees retain their own mission, attempt and report discovery.
-A selected terminal mission retains the guarded cleanup below: never clear tokens
-belonging to another mission. No binding belongs in the programme descriptor.
-
-## Herdr adapter: central files and ownership
-
-Use schema: 1 YAML frontmatter, strict string keys and one document, followed by
-Markdown. Reject duplicate keys, tags, anchors, aliases and unknown fields. Bound
-mission/report to 64 KiB, brief to 256 KiB, discovery to 64 entries and 1 MiB of
-mission bytes; exceeding a bound is incomplete, never a unique match.
-See the shipped technical contract `docs/ORCHESTRA.md` in the harness source for
-schemas; the operational fields are listed here so an installed skill is sufficient.
-
-- mission.md: schema, mission, project, status, updated_at
-  (ISO with `Z` or `+HH:MM`/`-HH:MM`; prefer UTC `Z`), repository
-  (canonical Git common path), coordinator {label, worktree, workspace?}, workers.
-- Worker entries: label, agent (codex or claude), worktree, branch, ticket, status,
-  attempt; optional pane_id and session are hints only. At most four workers.
-- Coordinator status and worker status: planned, running, blocked, done, failed.
-- report.md: schema, mission, attempt, worker, branch, status (running, blocked,
-  done, failed), commits (full SHAs), tests (passed, failed, not_run), updated_at.
-  Body: actual commands/results, proof locations, risks, questions and remaining work.
-- brief.md: absolute paths, exact base, footprint, acceptance criteria, ownership,
-  permissions, forbidden effects and current attempt. No secrets. Explicitly warn
-  that other writers exist and their changes must be preserved.
-
-ORCH alone writes mission and briefs; each worker alone writes its report. Use an
-atomic replacement: write an exclusive temporary sibling, then rename. Hooks never
-write these files. A new work turn gets a new attempt; resume keeps its attempt.
-A valid report for the current mission/attempt overrides workers[].status at every
-event. An absent report falls back to the manifest. Malformed, foreign, partial or
-unrecognized stale reports refuse usage; never turn a parse failure into absence.
-The files carry coordination state, not independent review proof.
-
-## Herdr adapter: copyable starting files
-
-Replace the example project hash with SHA-256 of the canonical common Git path.
-Replace every path, branch, ticket and timestamp from actual observations. These
-three files are authored by their owner, never by the hook.
-
-mission.md:
-
-```yaml
----
-schema: 1
-mission: dev-42
-project: "<project-sha256>"
-status: planned
-updated_at: "2026-10-08T10:00:00.000Z"
-repository: /absolute/repository/.git
-coordinator:
-  label: ORCH
-  worktree: /absolute/repository
-  workspace: wA
-workers:
-  - label: WORK-1
-    agent: codex
-    worktree: /absolute/worktrees/dev-42
-    branch: work/dev-42
-    ticket: DEV-42
-    status: planned
-    attempt: implementation-1
----
-# Mission
-Scope, acceptance criteria, canonical mission journal and proof locations.
-```
-
-workers/WORK-1/brief.md:
-
-```yaml
----
-schema: 1
-mission: dev-42
-attempt: implementation-1
-worker: WORK-1
----
-# Work
-Worktree: /absolute/worktrees/dev-42. Branch: work/dev-42.
-Base: <verified full commit SHA>. Ticket: DEV-42.
-Footprint: <exact owned files/directories>; preserve every other writer's edits.
-Acceptance: <complete observable criteria and verification commands>.
-Limits: <role permissions, forbidden effects, human gates>.
-Report: /absolute/mission/workers/WORK-1/report.md, owned only by this worker.
-Resume: <actual runtime session and the recipe from the table below>.
-```
-
-workers/WORK-1/report.md:
-
-```yaml
----
-schema: 1
-mission: dev-42
-attempt: implementation-1
-worker: WORK-1
-branch: work/dev-42
-status: running
-commits: []
-tests: not_run
-updated_at: "2026-10-08T10:00:00.000Z"
----
-# Checkpoint
-Completed: <actual changes>. Verification: <commands, results and proof paths>.
-Remaining: <work and exact next action>. Risks/questions: <observed limitations>.
-```
-
-## Herdr adapter: durable workers
-
-Read installed `herdr --help`, `herdr agent --help` and the live schema before
-issuing commands. Use structured argv, exact acknowledged identities and bounded
-waits/output. The launch recipes for the selected worktree are:
+## Publish worker observations
 
-| Kind | Launch argv | Resume argv | Short contexts | ctx capability |
-| --- | --- | --- | --- | --- |
-| codex | `--no-daemon --add-dir <absolute-mission>` | `resume <actual-session> --no-daemon --add-dir <absolute-mission>` | Native fresh context | Unmeasurable without a supported usage source |
-| claude | `--add-dir <absolute-mission>` | `--resume <actual-session> --add-dir <absolute-mission>` | Native Agent, no interception | Fresh transcript usage plus required context.windowTokens |
+For each mission worker or reviewer, keep one `run_<opaque-id>` for its assignment.
+Reuse the unit's open canonical mission; if it has none, create it with
+`void-machine mission start --title <unit> --json` and retain its returned ID.
+Do not recreate a mission to evade a refusal. This publication never substitutes
+for the mission's implementation, verification or independent review receipts.
 
-Use the selected kind's executable and preserve these options on every launch/resume:
+After an actual successful native dispatch acknowledgement, publish:
 
 ```sh
-herdr agent start <unique-mission-worker-name> --kind <kind> --pane <resolved-pane> -- <argv-from-table>
+void-machine agents record --mission <mis_id> --event-file <observation.json>
 ```
 
-The arguments after `--` belong to the selected runtime. The name is unique within
-the mission; it is not an invented native session ID. Resolve the pane first and
-keep the session ID actually returned by the runtime.
-
-Apply the role's existing permission/read-only policy; `--add-dir` only grants the
-specified directory, never disables a sandbox or an approval. Unsupported kind or
-option: diagnose and stop that launch. Do not update or restart Herdr to make it fit.
-Register planned worker before creating its owned surface. Keep the returned pane
-ID as a hint, launch once, submit the brief once, then reconcile by label + worktree.
-Use `herdr agent wait` in bounded slices and read the report after every turn.
-Idle/done is a turn ending, never proof the task passed. Request a missing report
-from the same session. Follow up in that session; never create a duplicate worker.
-After /clear read the same mission; after a killed process resume its actual session
-in the same worktree. Missing session: retain the mission and expose the loss.
-
-`resume_argv` is absent from Herdr 0.9.0 and 0.9.1, present from 0.9.2. Publish it
-only after the installed schema proves support. Otherwise retain the complete resume
-recipe in the brief. Never claim restart restoration was tested without doing it.
-
-## Herdr adapter: projection and closure
-
-The hook publishes source void-machine on SessionStart startup/resume/clear/compact
-and Stop after re-reading central state and fresh Herdr identities. Pane tokens:
-mission, worker, ticket, wstatus; coordinator-only workspace: mission, wstatus, workers.
-These are file status, never agent state. ctx requires the selected kind's measured capability from the table; unavailable measurement stays unavailable. Clear
-removes ctx before fresh measurement. State TTL is 86400000 ms, ctx TTL 7200000 ms.
-Sequences are exact nanosecond decimal BigInts captured before discovery. Old or
-equal seq is ignored by Herdr. Tokens are global keys, not source namespaces: another
-source may overwrite them; null clears globally. Never reconfigure cockpit to win.
-
-Terminal mission cleanup explicitly clears keys on all still-resolved owned panes,
-only where the currently projected mission still matches. Only the resolved
-coordinator clears workspace keys, again after verifying the displayed mission.
-A late closure of A must not clear B. A worker SessionEnd never cleans the workspace.
-When no mission is active, recover the verified displayed terminal mission; do not
-choose arbitrary history. Discovery/transport errors never trigger a purge.
-After collection and acceptance ORCH may close its owned surfaces; retain worktrees,
-branches and evidence according to their own lifecycle. Do not close the coordinator.
+The file contains `observationId`, `kind` and `payload`. Use a stable observation ID
+and exactly the same content on a retry. The payload always carries `schemaVersion: 1`
+and `runId`. Publish these three kinds at their real boundaries:
+
+- `worker.dispatched`: add `missionId`, `ticket` (or `unknown`), `role` (`work` or
+  `review`), `runtime` (`claude` or `codex`), the verified absolute `worktree`,
+  `branch` (`detached` requires `headSha`), and `attachCommand` (verified argv or
+  `unknown`). Never invent an attachment recipe or use presentation hints as identity.
+- `worker.state`: add `state` (`running`, `blocked`, `done`, `failed`) and the UTC
+  `observedAt`; optional `reason` explains a wait. Publish the initial running state
+  and subsequent observed changes. A turn ending while awaiting the coordinator
+  is blocked, not done. No observation means unknown, never inferred failure.
+- `worker.finished`: add `outcome` (`succeeded`, `failed`, `stopped`) after final
+  collection or confirmed terminal failure/stop, preceded by done for succeeded,
+  failed otherwise. Finish before closing the mission. It does not mean merged.
+
+Keep the same assignment through corrections and resume. Repeated running states
+across distinct turns need distinct observation IDs. A finished assignment is closed;
+new work afterwards gets a new run ID. Keep real native identities in the existing
+brief/evidence; the observation ID is not a fabricated native receipt.
+
+A publication error is visible and retried with the same identity/content after its
+cause is resolved; it never authorizes another launch. No brief, transcript, secret
+or result content belongs in these metadata. Native calls outside this procedure are
+not automatically captured, including unsupported Codex observation paths.
+
+`void-machine agents status --json` reads all project mission journals and reports
+active assignments, their last observed state and coverage issues. It does not poll
+runtimes or control presentation. Partial coverage is explicit and exits nonzero;
+never treat an unreadable history as no workers. External tools consume this public
+contract; the harness does not open or close their surfaces.
+
+Existing legacy runs retain their session and journal. Their mutating CLI commands
+publish the same events; `void-machine agents publish <runId>` retries publication
+from saved transitions without re-executing or stopping the runtime. This does not
+make the legacy launcher mandatory for new work.
 
 ## Independent review
 

package/core-assets/skills/void-testing/SKILL.md

@@ -128,7 +128,7 @@ Describe the behavior. Imperative. Specific.
 - `it should retry` (the "should" is fluff)
 </Bad>
 
-The companion hook `test-name-lint` warns on weak patterns (`test`, `works`, `should` as the entire name).
+The `test-name-lint` write hook blocks detected generic names: exactly `test`, or names starting with `should `, `work` or `works`. The owning rule defines the lexical scope.
 
 ---
 
@@ -231,7 +231,7 @@ Each snapshot has a reason. No `.toMatchSnapshot()` outside the whitelist withou
 
 Banned in committed code. They mean "I will not run this." If you mean "this case is intentionally not yet tested," write a `it.todo('description')` — the test runner reports todos.
 
-The companion hook `no-only-no-skip` blocks commits with `.only` / `fdescribe` / `xit` in the staged diff (allowed in `**/__skip-on-purpose__/**` whitelist with justifying comment).
+The `no-only-no-skip` write hook rejects focused and skipped calls in proposed test files, including `fit`, `fdescribe`, `xit`, `xdescribe` and suite `.skip`. There is no path whitelist; use an explicit `todo` for pending coverage.
 
 ### Implementation spies as primary assertion
 
@@ -259,8 +259,8 @@ Use pglite or dev branch. Mocking Drizzle breaks at every schema change while pr
 
 ## Companion hooks
 
-- **`no-only-no-skip`** — block on `.only` / `fdescribe` / `xit` / `.skip` in staged diff (whitelist: `**/__skip-on-purpose__/**`)
-- **`test-name-lint`** — warn on weak test names matching `/^\s*(test|works|should)\s*$/i`
+- **`no-only-no-skip`** — blocks focused/skipped calls on supported test writes; no path exemption
+- **`test-name-lint`** — blocks the generic test-name patterns described above
 - **`no-business-mock`** — warn on `vi.mock\('@/(services|domain)/...'\)` patterns
 - **`no-snapshot-default`** — warn on new `.toMatchSnapshot()` outside `**/__visual__/**` whitelist
 

package/core-assets/skills/void-verify/SKILL.md

@@ -77,7 +77,7 @@ Remove unrelated scope unless the requested behavior requires it.
 Give the result, relevant commands/results, independent review outcome and material limits.
 Do not print a twelve-item checklist with irrelevant N/A rows. Keep applicability reasoning in
 the existing task/review evidence; summarize it when it explains a real omission or decision.
-For a plan, update its existing resume point; the tracker owns mutable programme progress.
+For a standalone sequential plan, update its existing resume point. For a programme, the declared tracker alone owns mutable progress; do not add a current/next unit to the plan.
 The PR evidence and final report reuse the same observed results rather than duplicate work.
 
 Once at ticket end, the coordinator closes each explicitly bound source with