[antoinetoussaint-byte]

codefly add solution had never been run end to end. This is every CLI fix that running it required, in one PR.

The bar, and it is met. Scaffold with the CLI, then run the result against the local dev authority — no manual steps between:

$ codefly add solution notes --package-id obin/notes
  resolved solution-go → 0.0.2
  wrote contracts/api and the package's api-contracts entry
$ codefly doctor solution --dir modules/notes
  OK  notes — conforms to the solution shape

$ codefly run service backend          # wiki playground = local dev authority
  delivered module=notes workloads=1 disposition=accepted
  permissions: role installation/installer × notes@1 ×
               GET /v1/notes/overview: covered statically
  notes/backend: Running in 5.6s

GET /health                 200
GET /v1/notes/overview      401 {"error":"no Work Context: this page is reached
                                 through the authority's edge, which signs the person in"}

That permissions: line is the whole chain closing: this command writes the installer role and the <name>.page ceiling → the solution agent's route requires <name>.page:read → the contract is published → the authority derives the method policy and binds the role to the route. The 401 is the correct answer to a bare curl — the route is served and protected, and a viewer's Work Context exists only through the edge.

Eight defects, every one found by running

#	What	How it showed
1	Every invocation failed. Step 3 read the module off a workspace handle loaded before add module wrote it	cannot find module <name> in <ws>, present: [], after creating the module and both services
2	The rollback had the same bug	left the half-built module its own doc comment promised it never would
3	--agent python was advertised and cannot work	the generic agent "defines no project template"
4	The authority refuses a scaffolded solution	declares 0 role(s) and none is "installer", at runtime-run, after the whole composition booted
5	doctor solution called a working shell empty	looked beside the manifest; the nextjs agent's default puts the app under code/. The layouts differ by spec.source-dir
6	The default agent scaffolded a service, not a solution	no declared operation, no published policy, no page remote; delivery refused the result
7	npm ci can never work on a fresh scaffold	refuses without a lockfile; and nativeBuildEnvironment stripped NODE_AUTH_TOKEN, which the agent's own .npmrc reads — 401 Unauthorized whatever the operator exported
8	The package carried no contract	generate contracts refused (add "contracts" under artifact-roots), so the authority got ceilings and no method policy: every call to every route refused, with one log warning as the only sign

The agent, not the CLI

An earlier revision scaffolded an example backend and page as string literals in cmd/add. Reverted. A solution's code is the solution-go agent's — codefly-dev/service-solution-go, now at v0.0.2, whose base/ is a real backend on solution-runtime-go with operations.go, required per-route policy, a rendered interface document and templates/page/. The CLI's job is the shape, the documents, and refusing the wrong agent:

$ codefly add solution demo --package-id obin/demo --agent go
--agent go is the SERVICE agent: it scaffolds a service, not a solution — no
declared operation, no published policy, no page remote, and delivery refuses
the result. Pass --agent solution-go

A refusal, not a substitution: which agent to run is the author's statement. It happens before the first write.

doctor solution gains two rules, and they re-sort the fleet

Both are the silent-at-build-time, refused-at-runtime class the checker exists for. Of the nine solutions in core-solutions, the same two pass both — wiki and proposals, the only two that are actually run:

	before	after
	9/9 OK	wiki, proposals OK; 7 FAIL

installer_role_missing and backend_contract_missing. The other seven are tracked by the already-open conformance issues (core-solutions #467–#473) and are not in this PR.

Reuse

add module / add service's own paths; cmd/generate's contract generation behind one new exported entry point; core's modulecontract.InstallerRole, Contract, Role, CeilingScope; composition.PackageManifest; resources.LoadFromDir; yamledit; shared.WriteFileAtomic. The rollback is cmd/add/module.go's, applied where it was needed.

Not verified

• No page rendered in a browser. The remote builds and delivery is accepted; nothing here renders it.
• /assets/mf-manifest.json is 404 on the backend even though the bundle builds and staged. I do not know whether the host serves it instead or this is a ninth defect, and I did not guess.
• No authenticated call. The 401 proves the route is protected; getting a 200 needs a signed-in viewer through the edge, which I did not stage.
• The python-fastapi path scaffolds and conforms but was never booted.

Docs updated: docs/commands.md, docs/cli-reference.md.

🤖 Generated with Claude Code