Hard cut over Architecture renderer to Scryer view model

.github/workflows/e2e.yml

@@ -130,6 +130,9 @@ jobs:
         with:
           run_install: false
 
+      - name: Verify Node.js version
+        run: pnpm run preflight:node
+
       # Why: this job runs the same pnpm install path as pr.yml's verify
       # job, so it needs the same pinned node-gyp override to avoid pnpm's
       # broken bundled gyp_main.py on Linux. Gate on runner.os matches
@@ -145,6 +148,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Rebuild native modules for Node
+        run: pnpm run rebuild:native:node
+
       - name: Download E2E build output
         uses: actions/download-artifact@v8
         with:

.github/workflows/pr.yml

@@ -1,6 +1,7 @@
 name: PR Checks
 
 on:
+  workflow_dispatch:
   pull_request:
     types:
       - opened
@@ -29,6 +30,9 @@ jobs:
         with:
           run_install: false
 
+      - name: Verify Node.js version
+        run: pnpm run preflight:node
+
       # Why: pnpm's bundled node-gyp ships gyp_main.py without execute
       # permission, which breaks native module builds (e.g. node-pty's
       # postinstall) with "/bin/sh: gyp_main.py: Permission denied".
@@ -83,8 +87,8 @@ jobs:
       # Why: postinstall rebuilds better-sqlite3 for Electron's ABI via
       # @electron/rebuild, but vitest runs under system Node.js. Rebuild
       # it for Node so orchestration tests can load the native module.
-      - name: Rebuild better-sqlite3 for Node
-        run: pnpm rebuild better-sqlite3
+      - name: Rebuild native modules for Node
+        run: pnpm run rebuild:native:node
 
       # Why: install intentionally blocks Electron's package postinstall, but
       # some unit tests import `electron` under Node and require path.txt.

.gitignore

@@ -82,6 +82,14 @@ docs/**
 !docs/reference/**
 # Keep generated React perf scan ledgers local; durable docs still use docs/reference.
 docs/reference/react-performance-audit.md
+!docs/orca-scryer-decision-map.md
+!docs/adr/
+!docs/adr/**
+!docs/scryer-cli-tool-parity.md
+!docs/prd/
+!docs/prd/orca-scryer-engine-catalog-foundation.md
+!docs/prd/orca-scryer-operation-migration-work-set.md
+!docs/prd/orca-scryer-operation-migration-issue-slices.md
 !docs/STYLEGUIDE.md
 !docs/mobile-terminal-shortcut-bar.md
 
@@ -115,3 +123,4 @@ src/renderer/src/i18n/locales/.zh-catalog-cache.json
 src/renderer/src/i18n/locales/.ko-catalog-cache.json
 src/renderer/src/i18n/locales/.ja-catalog-cache.json
 src/renderer/src/i18n/locales/.es-catalog-cache.json
+.gitnexus

.npmrc

@@ -4,3 +4,4 @@ minimum-release-age-exclude[]=electron@42.3.3
 minimum-release-age-exclude[]=mermaid@11.15.0
 minimum-release-age-exclude[]=@mermaid-js/parser@1.1.1
 minimum-release-age-exclude[]=serve-sim@0.1.40
+engine-strict=true

config/electron-builder.config.cjs

@@ -100,6 +100,7 @@ module.exports = {
     'out/main/gemini/**',
     'out/main/grok/**',
     'out/main/hermes/**',
+    'out/main/scryer/engine/**',
     'out/main/win32-utils.js',
     'out/main/daemon-entry.js',
     'out/main/computer-sidecar.js',
@@ -287,7 +288,15 @@ module.exports = {
     // Why: xvfb lets the bundled `orca serve` CLI run browser panes on a headless
     // Linux host — Chromium needs a display server even for offscreen rendering,
     // and serve starts Xvfb itself when present (see ensure-virtual-display.ts).
-    depends: ['python3', 'python3-gi', 'gir1.2-atspi-2.0', 'at-spi2-core', 'xdotool', 'xclip', 'xvfb'],
+    depends: [
+      'python3',
+      'python3-gi',
+      'gir1.2-atspi-2.0',
+      'at-spi2-core',
+      'xdotool',
+      'xclip',
+      'xvfb'
+    ],
     // Why: symlink the bundled CLI onto PATH at install time so `orca-ide serve`
     // works on a headless host. The in-app CLI registration (CliInstaller) is
     // GUI-triggered and can never run on a server, so without this the CLI is

config/scripts/electron-builder-config.test.mjs

@@ -106,6 +106,12 @@ describe('electron-builder config', () => {
     expect(electronBuilderConfig.npmRebuild).toBe(true)
   })
 
+  it('unpacks CLI runtime imports from out/main', () => {
+    expect(electronBuilderConfig.asarUnpack).toEqual(
+      expect.arrayContaining(['out/main/agent-hooks/**', 'out/main/scryer/engine/**'])
+    )
+  })
+
   it('verifies packaged main runtime deps from Windows-style asar entries', async () => {
     const resourcesDir = await mkdtemp(join(tmpdir(), 'orca-runtime-deps-'))
     try {

config/scripts/electron-vite-config.test.mjs

@@ -0,0 +1,13 @@
+import { readFile } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+describe('electron-vite config', () => {
+  it('keeps CLI out/main runtime imports available after main rebuilds', async () => {
+    const source = await readFile(resolve('electron.vite.config.ts'), 'utf8')
+
+    expect(source).toContain("'agent-hooks/managed-agent-hook-controls'")
+    expect(source).toContain("'scryer/engine/index'")
+    expect(source).toContain("'src/main/scryer/engine/index.ts'")
+  })
+})

config/scripts/package-electron-runtime-contract.test.mjs

@@ -241,6 +241,19 @@ describe('Electron runtime package contract', () => {
     expect(installStep.run).toBe('node config/scripts/install-electron-package-binary.mjs')
   })
 
+  it('keeps PR checks wired to the Node native module rebuild script', () => {
+    const prWorkflow = readFileSync(join(projectDir, '.github/workflows/pr.yml'), 'utf8')
+    const parsedWorkflow = parse(prWorkflow)
+    const rebuildStep = parsedWorkflow.jobs.verify.steps.find(
+      (step) => step.name === 'Rebuild native modules for Node'
+    )
+
+    expect(rebuildStep.run).toBe('pnpm run rebuild:native:node')
+    expect(packageJson.scripts['rebuild:native:node']).toBe(
+      'node config/scripts/rebuild-node-native-deps.mjs'
+    )
+  })
+
   it('smokes the packaged CLI from outside the checkout in PR checks', () => {
     const prWorkflow = readFileSync(join(projectDir, '.github/workflows/pr.yml'), 'utf8')
     const parsedWorkflow = parse(prWorkflow)

config/scripts/rebuild-node-native-deps.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+import { execFileSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+
+const modules = ['better-sqlite3', 'node-pty', '@parcel/watcher']
+
+const getPnpmCommand = () => {
+  const corepackRoot = process.env.COREPACK_ROOT
+  const corepackEntry = corepackRoot ? join(corepackRoot, 'dist/corepack.js') : undefined
+
+  if (corepackEntry && existsSync(corepackEntry)) {
+    return {
+      command: process.execPath,
+      args: [corepackEntry, 'pnpm']
+    }
+  }
+
+  if (process.env.npm_execpath?.includes('pnpm') && existsSync(process.env.npm_execpath)) {
+    return {
+      command: process.execPath,
+      args: [process.env.npm_execpath]
+    }
+  }
+
+  return {
+    command: 'pnpm',
+    args: []
+  }
+}
+
+try {
+  const pnpm = getPnpmCommand()
+  execFileSync(pnpm.command, [...pnpm.args, 'rebuild', ...modules], {
+    stdio: 'inherit'
+  })
+} catch (error) {
+  console.error('[rebuild] Failed to rebuild native modules for Node.js:', error.message)
+  process.exit(1)
+}

config/scripts/verify-node-version.mjs

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const packageJson = JSON.parse(readFileSync(resolve(process.cwd(), 'package.json'), 'utf8'))
+const requiredMajor = Number(String(packageJson.engines?.node ?? '').match(/\d+/)?.[0])
+const actualMajor = Number(process.versions.node.split('.')[0])
+
+if (!requiredMajor || actualMajor === requiredMajor) {
+  process.exit(0)
+}
+
+console.error(
+  `[preflight] Orca requires Node ${requiredMajor}.x, but current Node is ${process.versions.node}.`
+)
+console.error('[preflight] Switch to Node 24 before installing dependencies or running full tests.')
+process.exit(1)

config/tsconfig.cli.json

@@ -28,9 +28,11 @@
     "../src/main/kimi/hook-service.ts",
     "../src/main/kimi/kimi-hook-config-toml.ts",
     "../src/main/openclaude/hook-service.ts",
+    "../src/main/scryer/engine/**/*.ts",
     "../src/main/runtime/runtime-metadata.ts",
     "../src/main/win32-utils.ts"
   ],
+  "exclude": ["../src/main/scryer/engine/**/*.test.ts"],
   "compilerOptions": {
     "composite": true,
     "module": "CommonJS",

docs/adr/0001-scryer-engine-parity-with-orca-native-shell.md

@@ -0,0 +1,3 @@
+# Scryer engine parity with an Orca-native shell
+
+Orca will migrate Scryer by preserving upstream Scryer model and agent-facing behavior while replacing the app shell, process ownership, packaging, and user-facing integration with Orca-native surfaces. This keeps the integration product-native without turning it into a partial Scryer clone.

docs/adr/0002-scryer-agent-runs-use-orca-execution-adapters.md

@@ -0,0 +1,5 @@
+# Scryer agent runs use Orca execution adapters
+
+Scryer agent-run semantics are preserved, but Orca owns Codex/Claude process launch, account state, terminal/runtime state, and UI integration. `ScryerEditSessionController` keeps Scryer model-edit lease and completion-gate workflow over Orca runtime capabilities without duplicating generic agent runtime mechanics.
+
+The edit-session lease token is internal trusted context, not renderer-facing state. Renderer/preload interfaces receive only token-free session status and completion-gate DTOs; `ScryerEditSessionController` resolves any matching token inside the main process before calling the Native Scryer Engine.

docs/adr/0003-background-scryer-runs-with-visible-agent-handoff.md

@@ -0,0 +1,3 @@
+# Background Scryer runs with visible agent handoff
+
+Default Scryer automation should run as structured background Orca agent work, because build/fill/drift flows need deterministic progress, cancellation, logs, and tests. Visible terminal handoff remains an explicit mode for inspection, recovery, or manual continuation.

docs/adr/0004-replace-scryer-mcp-with-orca-cli-tool-surface.md

@@ -0,0 +1,3 @@
+# Replace Scryer MCP with an Orca CLI tool surface
+
+Orca will not retain Scryer MCP as a product path. Upstream MCP tool behavior is migrated into Orca-native `orca scryer <noun> <verb>` commands backed by the Native Scryer Engine, so Codex, Claude Code, scripts, UI, and humans share one Orca command surface.

docs/adr/0005-use-decision-map-as-planning-authority.md

@@ -0,0 +1,3 @@
+# Use a decision map as planning authority
+
+Multi-session Scryer migration planning will use one compact decision map as the authoritative planning artifact. ADRs and detailed design files are linked assets; they do not replace the map or copy its frontier.

docs/adr/0006-link-detailed-design-assets-from-the-decision-map.md

@@ -0,0 +1,3 @@
+# Link detailed design assets from the decision map
+
+Detailed matrices, migration checklists, UML comparisons, and research notes stay in separate Markdown assets and are linked from the decision map. This keeps the map small enough to load into every planning session while preserving the detail needed for implementation.

docs/adr/0007-implement-scryer-engine-natively-in-typescript.md

@@ -0,0 +1,3 @@
+# Implement the Scryer engine natively in TypeScript
+
+The product runtime will implement Scryer model-engine semantics in Orca's TypeScript/Node codebase instead of calling a packaged Rust sidecar. Upstream Rust remains the semantic reference, but native implementation keeps packaging, UI refresh, IPC, agent runtime, and tests inside Orca.

docs/adr/0008-native-scryer-engine-owns-state-semantics.md

@@ -0,0 +1,3 @@
+# Native Scryer engine owns state semantics
+
+The Native Scryer Engine is the only module that owns Scryer state semantics such as planned/committed layers, locking, history, anchors, drift, and health. CLI, IPC, UI, sync, and import paths call the engine instead of implementing their own model rules.

docs/adr/0009-use-scryer-0-3-model-as-canonical-engine-model.md

@@ -0,0 +1,3 @@
+# Use Scryer 0.3 ScryModel as the canonical engine model
+
+The Native Scryer Engine uses upstream Scryer 0.3 `ScryModel` as its canonical model. Orca `C4ModelData`, flow data, layout data, and pre-0.3 shapes are import or view concerns, not engine truth.

docs/adr/0010-follow-upstream-scryer-0-3-model-handling.md

@@ -0,0 +1,3 @@
+# Follow upstream Scryer 0.3 model handling
+
+Normal runtime opens only `version: "0.3"` Scryer models and refuses pre-0.3 files with a clear incompatibility result. Preservation of older Orca/Scryer data belongs in an explicit import path, not automatic runtime migration.

docs/adr/0011-keep-orca-view-and-runtime-state-outside-scrymodel.md

@@ -0,0 +1,5 @@
+# Keep Orca view and runtime state outside ScryModel
+
+`ScryModel` stores architecture truth only. Orca selection, expanded paths, active tabs, layout/render cache, retained flow-editor data, agent progress, and model edit leases live in Orca-owned state so UI mechanics do not pollute the agent-facing model.
+
+Only sanitized model-edit lease status is renderer-facing. The raw lease token stays in trusted main-process/edit-session context and must not be persisted into `ScryModel`, renderer store state, DOM state, logs, or prompts.

docs/adr/0012-use-upstream-planned-committed-semantics-with-orca-gates.md

@@ -0,0 +1,5 @@
+# Use upstream planned/committed semantics with Orca gates
+
+Orca preserves upstream planned/committed semantics: draft edits write planned state, while folds, extraction, corrections, and drift verdicts explicitly affect committed state. Orca adds Model Edit Lease and Completion Gate enforcement so agent completion and UI write-back cannot silently corrupt the model.
+
+Model Edit Lease tokens are write-concurrency credentials held in trusted main-process context. They may be attached to `ScryerOperationContext` by the edit-session controller, but renderer-facing DTOs, logs, prompts, and generic operation inputs must expose only sanitized lease status, never the raw token.

docs/adr/0013-use-native-scryer-engine-as-the-only-model-semantics-interface.md

@@ -0,0 +1,3 @@
+# Use Native Scryer Engine as the only model semantics interface
+
+Architecture UI, Electron IPC, Orca CLI, agent runtime, drift/sync, and tests must call the Native Scryer Engine or typed wrappers. This keeps parsing, validation, planned/committed policy, locks, leases, history, anchors, build edges, drift semantics, and atomic IO behind one interface.

docs/adr/0014-keep-glossary-separate-from-design-specs.md

@@ -0,0 +1,3 @@
+# Keep glossary separate from design specs
+
+`CONTEXT.md` is a glossary only. Design decisions belong in ADRs, frontier planning belongs in the decision map, and implementation matrices or migration checklists belong in linked design assets.

docs/adr/0015-use-orca-native-scryer-operation-catalog.md

@@ -0,0 +1,3 @@
+# Use Orca-native Scryer Operation Catalog
+
+The Native Scryer Engine uses an Orca-owned Operation Catalog as its semantic center. Operation ids are Orca-native, while operation behavior remains anchored to upstream Scryer parity.

docs/adr/0016-use-orca-native-scryer-operation-and-command-names.md

@@ -0,0 +1,3 @@
+# Use Orca-native Scryer operation and command names
+
+Internal operation ids use dotted Orca-native names such as `scryer.model.read`; CLI commands use noun/verb names such as `orca scryer model read`. Upstream tool names remain parity anchors rather than the product command surface.

docs/adr/0017-use-typed-operation-contracts-as-scryer-engine-interface.md

@@ -0,0 +1,3 @@
+# Use typed operation contracts as the Scryer engine interface
+
+Every Native Scryer Engine operation is defined by one typed contract. The contract declares caller-facing input/output behavior and state effects; detailed matrices live in the linked parity asset rather than in this ADR.

docs/adr/0018-land-first-operation-contracts-as-minimal-semantic-loop.md

@@ -0,0 +1,3 @@
+# Land first operation contracts as a minimal semantic loop
+
+The first implementation slice is a minimal semantic loop: model read, model validate, node update, link add, link delete, plan pending, and plan fold. This proves read/write layers, validation, pending diff, fold, lock/lease, result envelope, and transport forwarding before broad tool coverage.

docs/adr/0019-drive-first-operation-contracts-from-contract-matrix.md

@@ -0,0 +1,3 @@
+# Drive first operation contracts from a contract matrix
+
+The first seven operation contracts are defined by one contract matrix before implementation. That matrix is the source for contract tests, CLI mapping, IPC mapping, UI actions, and operation implementation order.

docs/adr/0020-use-upstream-scryer-field-semantics-in-engine-contracts.md

@@ -0,0 +1,3 @@
+# Use upstream Scryer field semantics in engine contracts
+
+Engine contracts preserve upstream Scryer semantic field names for model and operation behavior. Orca-native adaptation happens in operation ids, CLI commands, aliases, context, and result envelopes, not by renaming Scryer model fields.

docs/adr/0021-use-shared-operation-result-envelope.md

@@ -0,0 +1,3 @@
+# Use a shared operation result and error envelope
+
+Every Native Scryer Engine operation returns the same success-or-failure envelope. Operation-specific contracts define payload and error details, while CLI, IPC, UI, agents, scripts, and tests all consume the shared shape.

docs/adr/0022-use-explicit-orca-operation-context-for-scryer-authority.md

@@ -0,0 +1,3 @@
+# Use explicit Orca operation context for Scryer authority
+
+Every Native Scryer Engine operation receives explicit Orca operation context for caller identity, request tracking, project resolution defaults, edit authority, and run correlation. This replaces hidden caller assumptions with deterministic authority checks while preserving upstream Scryer state semantics.

docs/adr/0023-use-unified-operation-execution-pipeline.md

@@ -0,0 +1,3 @@
+# Use a unified operation execution pipeline for Scryer
+
+Every Native Scryer Engine operation runs through one contract-driven execution pipeline. The pipeline owns cross-cutting behavior such as contract lookup, context/input validation, project resolution, authority, lock/lease checks, declared state reads/writes, side effects, and result envelopes; operation files own only Scryer domain semantics.

docs/adr/0024-reimplement-scryer-semantics-in-orca-owned-code.md

@@ -0,0 +1,3 @@
+# Reimplement Scryer semantics in Orca-owned code
+
+Orca will migrate Scryer functional semantics and reimplement the code in Orca-owned TypeScript/Node modules rather than directly copying upstream implementation source into the product runtime. Upstream Scryer remains the reference for behavior, schemas, state transitions, and parity tests; Orca owns the implementation.