Of

/of — alias for orderfield

Two names. One kernel. /of is /orderfield. Product surface (sibling README) leads with typical problems → what Orderfield does. Mid-flight plan-change H2 sits before Install.

Load the sibling skill and follow it. When that skill names references/skill-appendix.md, read the appendix before pack, spawn, contrast, or close. Stop if the sibling is missing. Do not invent a second contract.

Human install or verify: the sibling path is bash docs/demo/mortal-install.sh --global (or --root PATH), then of doctor must print ok. Closed-field historical packs (older order_rev than the retained ORDER) are informational — not FAIL. Open-field stale/aged packs still FAIL. Pack lines name field id + wave. Do not rewrite a closed audit trail to green doctor. Pin recipe stays README / PUBLISH. Not pip. Not a daemon.

Doctor / status / resume / pulse ask the user at most once a day when a newer release exists. On yes: ORDERFIELD_VERSION=<ver> bash install.sh --global --from-release (release tar.gz + SHA256SUMS). Do not upgrade mid-ORDER without consent. Not a silent auto-update.

In-flight is not done: while any residual is MISSING, of status / of resume print running + the live PULSE + a speak line (quote a PULSE line above to the user; do not claim done while running). A leftover residual from a prior collect refuse does not hide a started-only re-spawn — stay running + speak until that spawn settles. PACKED / spawned 0 / next SPAWN mean the packet exists but no spawn record — not ALIVE; of spawn or of handoff. Spawn stream-json / JSON streams (claude/cursor/codex) and grok streaming-json feed the same scratch PULSE. Grok residual extract reuses that stdout path; spawn metadata is finalized on exit, timeout, and missing binary. Before ending a turn or saying the mission is done, run one of them and quote the live PULSE — the human never runs of pulse by hand. Follow the sibling.

Close is proof: the sibling names docs/close-is-proof.md. Residual empty is not the close.

After a successful of phase, of next-wave is the next step. The just-integrated wave stays eligible; do not integrate --recompute that completed wave. An empty current wave (no packets) has nothing to integrate: after done_when is closed, of phase <next> succeeds without --force. Packets that exist still require integrate. When of resume prints INTEGRATE --RECOMPUTE, the wave report digest drifted: run of integrate --wave N --recompute. Do not next-wave. Spawn session_id / denied_actions after integrate are not drift (IntegrationDigest). Follow the sibling.

Claim shipped is mechanical: run of contrast and of close --checklist in the same turn. Quote the printed speak line (do not claim shipped unless contrast RESOLVED and residual empty) plus contrast RESOLVED and residual empty. If either proof row fails or that speak line is not quoted, do not claim shipped. Pair with quote-PULSE while flying. Production checklist language is those verbs (checklist → of contrast / of close / residual). Not a second checklist. After a wave, must ask consent for a fresh-context review packet (adversary / verifier) before close; never silent. Self-praise is not review. Not a new close gate. Follow the sibling.

Published claims stay ≤98% honest. After skill/docs edits: python3 docs/audit/check-claims.py (also inside validate-skill.sh). Follow the sibling.

Chat-dump residuals still cannot collect. Structured evidence over 4000 chars (counts, paths, shas) can. A size refuse names scratch/<child>/notes.md + re-spawn the same packet. Follow the sibling.

of learn length is advisory like pack --slice: over 400 chars still stores and prints a note. Over 4 lines still refuse dumps. Put the long record in work/scratch/leader/<file>.md and keep a short pointer learning. Follow the sibling.

Gaps as prose: of contrast --diff narrates SPEC vs coverage from the same ContrastReport + spec-diff facts. RESOLVED is not CLOSED. No theater. Follow the sibling.

Webhook HMAC signature + replay is pair-shaped: accept a valid delivery AND reject replay / bad signature at the public surface, then of spec --verified-contract ID --both-sides. WebhookPair is the oracle. Not a webhook server. Follow the sibling.

Timeout, idempotency, health, and version IDs are public-surface VERIFIED_CONTRACT (not closable on VERIFIED_INTERNAL). Idempotency stays PAIR (--both-sides). Timeout/health/version: exercise the bound / /health / /version or a release header at the surface. ContractSurface names the shapes. Not a health monitor. Not a timeout supervisor. Not a version server. Follow the sibling.

status=done close evidence must name artifact_sha: (sha256 of result_ref bytes) and rollback: a command — not captions. CloseEvidence. Collect refuses a missing or mismatched hash and a slogan rollback. Slice done is still not SPEC closed. Follow the sibling.

Production mode: the sibling appendix Production mode names Gate A before --role implementer. Use the full verb table. Prod§15: name a repo-relative runbook path in done_when before close; close refuse without it. Never invent a process supervisor, bot org, RUNTIME_OWNERSHIP, --tokens, or of merge. Follow the sibling.

Orca interactive workers: after residual + of collect (and on abandon), must worker-stop then worker-release for dispatches you started. Never leave retained unless the user asked. If of worktree add was used, of worktree remove when the slice closes. worker-stop does not delete worktrees. Follow the sibling. Not a process supervisor.

Recorded worktree + native Codex spawn: of spawn --adapter codex uses -C <worktree>, --add-dir <field-home> for residual/PULSE, and --add-dir <git-common-dir> for linked-worktree metadata. Missing, malformed, or non-Git records refuse before launch with remove/re-add guidance. No record leaves Codex argv unchanged. Follow the sibling.

Generic OF_AGENT is a shell-quoted argv (shlex.split). Quote paths with spaces (--add-dir "/path/with spaces/.git"). Dry-run prints shlex.join of the real list so a space path stays one token. Follow the sibling.

Per-task model hints: when packing a multi-role wave, consult docs/model-catalog.md first, then must propose cheap vs frontier in chat. Do not assume smarter = costlier. On yes → of patch --model-hints field|wave and/or of pack --model-tier cheap|frontier / --model NAME. Spawn passes --model for claude/codex/cursor/grok/agy when the packet names one (claude also maps cheap→haiku / frontier→opus). Grok/agy: named model only; no invented aliases; flags before -p. Orca/qwen/opencode/generic stay no-op. Follow the sibling. Not a router. Never budget.tokens.

Wave harness plan: before pack (init → first pack, or re-planning), consult the catalog, then must ask same-harness roles on one harness vs multi-harness mix. Playbook: sibling appendix Multi-harness mix. On same → of patch --harness <adapter> (or stay on session). On mix → of doctor + of detect (present / missing / PATH≠auth Partial). Then of pack / of spawn only from present. After residuals: of collect → of contrast → of close. Never claim login from PATH. Never silent mix. Follow the sibling. Not a router.

Conservative agy spawn: if the harness JSON named refused tools, read residual.denied_actions (or the spawn denied_actions= line). Those tools were refused — not approval. Missing/empty is omit; do not invent []. Do not set OF_TRUST=yolo to hide them. Follow the sibling.

Missing collect residual: MISSING means pending/unavailable. The diagnostic shows known adapter / trust / outcome and actual denied_actions. “permissions may be involved for conservative <adapter> headless mode” is a possibility, not proof; conservative children may still write scratch and residual files. Follow the sibling.

agy residual schema: of spawn --adapter agy passes --json-schema to residual.codex.schema.json (same Codex file; type unions unique, usage is [object,null]). Claude omit: --json-schema is inline-only and would drop stream-json PULSE. Do not fake a path. Qwen omit: structured_output tool, not residual delivery. Follow the sibling.

OF_TRUST=plan maps cursor --mode plan, agy --mode plan, grok --sandbox read-only. auto-edit/auto stay conservative where the harness has no accept-edits flag. Claude auto stays acceptEdits (classifier auto is account/model gated). Follow the sibling table.

Adapter resume/continue: of spawn emits --resume ID only when residual.session_id is already set (claude/cursor). Cold residual is a fresh spawn. Do not invent. Never --continue. Not ORDER.origin.session_id. Follow the sibling.

Leader HITL --body-file is .orderfield/work/scratch/leader/ISSUE.md (or the child's existing ISSUE.md / issues/<slug>.md). Refuse names .orderfield/work/scratch/<child_id>/. Follow the sibling.

If status/resume prints efficiency propose …, ask the human; on yes run the printed of patch --model-hints / --model-tier. Never silent switch. Never invent token spend. Follow the sibling docs/efficiency-signal.md.

Long-task efficiency mix: mid-mission (residuals landed / next-wave replan) quote honest signals only — of status efficiency, of detect, of doctor balance. No published balance/session signal → say unknown; never invent. budget.tokens stays reserved. Propose cheap/frontier rebalance AND/OR harness mix when those signals exist. Must ask; on yes use the sibling verbs. Never silent. Follow the sibling.

After package installation, the full skill is normally at ../orderfield/SKILL.md relative to this file. In a source checkout, it is at ../SKILL.md. The leader appendix is ../orderfield/references/skill-appendix.md (checkout: ../references/skill-appendix.md). If the sibling skill is missing, stop and report that the Orderfield skill package is incomplete.