@agimon-ai/po-workflow 0.0.0-alpha.123 → 0.0.0-alpha.124

package/README.md

@@ -159,6 +159,26 @@ does not add to them. The path resolves relative to the declaring YAML and is in
 `imports` as a default, like `tools`. A missing or unreadable file fails the step session rather than
 running it without instructions. Shell steps and external Claude/Codex CLI runners ignore it.
 
+## Explicit role allocation
+
+For a workflow declaring `identity.roles`, first call `workflow.requirements({ workflowPath })`, then
+launch with an exact `assignments` map from every required role to a stable profile reference. Roles
+used together by one job, reachable child or repair triage must select the same reference. Saved teams,
+a launch profile, environment variables and workflow inputs never fill missing assignments.
+
+The slash equivalent is `/workflow-launch <workflow> assign.writer=<stable-ref>`. Public tools and
+code mode accept assignments only, never provider bindings or an allocation snapshot. The launch
+freezes the effective definition and provider evidence; retries, child execution, reload, resume and
+recovery revalidate that evidence without reallocating. Legacy role-bound runs without a snapshot
+must be launched fresh or repaired through the existing approved revision-checked repair path.
+
+Allocated agent steps require managed in-process execution and a compatible `po-profile` admission
+capability. Help and external agent execution are refused. Roleless phases in an allocated graph run
+with no profile. Standalone CLI/background hosts cannot infer or carry trusted role allocations and
+refuse inadmissible graphs before process registration or delegation. Roleless CLI workflows remain
+supported. Allocations never grant product authority; the provider derives scope from trusted host
+configuration.
+
 ## Launch and monitor
 
 Core tools are: