Add V3 ToolMesh all-wave control plane

Author: AtomEons

orangebox-v3/V3_FLAGS.env

@@ -32,3 +32,18 @@ ORANGEBOX_K3_REQUIRE_COLD_TRUTH_GATE=1
 ORANGEBOX_K3_REQUIRE_MEMORY_DOCTOR=1
 ORANGEBOX_K3_ALPHA_MATCHER=1
 ORANGEBOX_K3_RETURN_PATHS_ONLY=1
+ORANGEBOX_FREE_ALPHA_TOOLMESH=1
+ORANGEBOX_TOOLMESH_REGISTRY=1
+ORANGEBOX_IMAGE_LAB=0
+ORANGEBOX_VIDEO_LAB=0
+ORANGEBOX_AUDIO_LAB=0
+ORANGEBOX_DESIGN_LAB=0
+ORANGEBOX_CODING_LAB=0
+ORANGEBOX_AUTOMATION_LAB=0
+ORANGEBOX_ANALYTICS_LAB=0
+ORANGEBOX_PUBLIC_AGENT_LAB=0
+ORANGEBOX_OBSERVABILITY_LAB=0
+ORANGEBOX_SECURITY_LAB=0
+ORANGEBOX_RELEASEOPS_LAB=0
+ORANGEBOX_ALPHA_WATCHLIST=1
+ORANGEBOX_CLOUD_TOOL_WARRANTS=1

orangebox-v3/baseline.ts

@@ -46,7 +46,7 @@ export async function runV3Baseline() {
   }
   const pkg = readJson<any>(path.join(repoRoot, "package.json"), {});
   const scripts = Object.keys(pkg.scripts || {}).filter((name) =>
-    /v3|ghost|knowledge|k3|elysia|chatbus|vision|chronos|voice|mcp|speculative|goose|openjarvis|gpu|littleorange|atomsmasher|memory|model|trilane|strongarm|gremlin|health|project|harness/.test(name)
+    /v3|ghost|knowledge|k3|elysia|chatbus|vision|chronos|voice|mcp|speculative|goose|openjarvis|gpu|littleorange|atomsmasher|memory|model|trilane|strongarm|gremlin|health|project|harness|toolmesh|image-lab|video-lab|audio-lab|design-lab|coding-lab|automation-lab|analytics-lab|public-agent|observability|security|releaseops|alpha-watchlist/.test(name)
   );
   const latest = {
     memory_truth: latestJson(path.join(dataRoot, "memory-truth", "latest-memory-source-truth-doctor.json")),
@@ -55,6 +55,7 @@ export async function runV3Baseline() {
     atomsmasher: latestJson(path.join(dataRoot, "atomsmasher", "latest-atomsmasher-doctor.json")),
     feature_matrix: latestJson(path.join(dataRoot, "feature-proof", "latest-feature-acceptance-matrix.json")),
     model_inventory: latestJson(path.join(dataRoot, "reports", "models", "latest-model-inventory.json")),
+    toolmesh: latestJson(path.join(dataRoot, "v3", "toolmesh", "latest-toolmesh-doctor.json")),
   };
   const report = {
     ok: true,

orangebox-v3/docs/V3_MASTER_LEDGER.md

@@ -33,6 +33,31 @@ Build Cortex IDE as the local-first, visual, voice-directed, ghost-worktree, mod
 14. VRAM Multiplexing Escalation
 15. Theater Polish
 
+## ToolMesh Extension
+
+ToolMesh is now part of the V3 scope as an additive free-alpha control plane. It does not install or execute candidate tools by default.
+
+Y0. Registry Only
+Y1. Image Lab
+Y2. Design Lab
+Y3. Audio Lab
+Y4. Video Lab
+Y5. Coding Lab
+Y6. Automation Lab
+Y7. Analytics / MarketOps
+Y8. PublicAgent
+Y9. Observability / Security / ReleaseOps
+Alpha. Watchlist
+
+## ToolMesh Law
+
+- Tool cards are capability records, not execution permission.
+- Local-first is default.
+- Cloud requires warrant.
+- Repo-touching tools require ghost worktree, STRONGARM, receipt, tests, and rollback proof.
+- Public-facing tools require publish warrant and injection checks.
+- Candidate tools must beat baseline before promotion.
+
 ## Current Status
 
-Initialized with feature flags and proof-first implementation lanes. V2 remains the working baseline while V3 features prove parity behind flags.
+Initialized with feature flags and proof-first implementation lanes. V2 remains the working baseline while V3 features prove parity behind flags. ToolMesh Y0 is active as a registry and doctor layer; Y1-Y9 labs remain scoped behind promotion gates.