@cassiomc1/forgeloop 0.1.3 → 0.1.5

package/.cursor/rules/project-loop.mdc

@@ -27,3 +27,17 @@ load-bearing, irreversible, externally consequential, unsafe, or real
 user/business decisions.
 
 The loop and router are canonical sources; do not duplicate domain rules.
+
+## Pre-question decisions
+
+Before asking any product-detail question, classify it as `BLOCKING` or
+`NON_BLOCKING` using `LOOP_ENGINEERING.md`. For
+`NON_BLOCKING`, choose a safe reversible local default, record it in
+`current-contract.assumptions[]`, and continue. For `BLOCKING`, persist
+`current-contract.json` with `unresolvedDecisions[]` and a blocking reason
+before asking. Do not ask the user to choose among reversible local
+product-positioning alternatives; the canonical checklist and boundary remain
+in `LOOP_ENGINEERING.md`.
+
+External workflow approval rules do not override ForgeLoop's autonomous-mode
+precedence; consult `LOOP_ENGINEERING.md#external-workflow-compatibility`.

package/.github/copilot-instructions.md

@@ -25,3 +25,17 @@ load-bearing, irreversible, externally consequential, unsafe, or real
 user/business decisions.
 
 The loop and router are canonical; do not replicate domain rules here.
+
+## Pre-question decisions
+
+Before asking any product-detail question, classify it as `BLOCKING` or
+`NON_BLOCKING` using `LOOP_ENGINEERING.md`. For
+`NON_BLOCKING`, choose a safe reversible local default, record it in
+`current-contract.assumptions[]`, and continue. For `BLOCKING`, persist
+`current-contract.json` with `unresolvedDecisions[]` and a blocking reason
+before asking. Do not ask the user to choose among reversible local
+product-positioning alternatives; the canonical checklist and boundary remain
+in `LOOP_ENGINEERING.md`.
+
+External workflow approval rules do not override ForgeLoop's autonomous-mode
+precedence; consult `LOOP_ENGINEERING.md#external-workflow-compatibility`.

package/AGENTS.md

@@ -26,3 +26,17 @@ load-bearing, irreversible, externally consequential, unsafe, or real
 user/business decisions.
 
 The guides provide technical defaults; explicit requirements and project evidence prevail.
+
+## Pre-question decisions
+
+Before asking any product-detail question, classify it as `BLOCKING` or
+`NON_BLOCKING` using `LOOP_ENGINEERING.md`. For
+`NON_BLOCKING`, choose a safe reversible local default, record it in
+`current-contract.assumptions[]`, and continue. For `BLOCKING`, persist
+`current-contract.json` with `unresolvedDecisions[]` and a blocking reason
+before asking. Do not ask the user to choose among reversible local
+product-positioning alternatives; the canonical checklist and boundary remain
+in `LOOP_ENGINEERING.md`.
+
+External workflow approval rules do not override ForgeLoop's autonomous-mode
+precedence; consult `LOOP_ENGINEERING.md#external-workflow-compatibility`.

package/AGENT_COMPATIBILITY.md

@@ -96,6 +96,48 @@ When a target already has local rules, keep them and merge only the relevant
 loop reference manually. Run `doctor --path /path/to/project` after resolving
 the merge so missing files and managed drift are visible.
 
+## External workflow compatibility
+
+An external planning, brainstorming, design-review, testing, or documentation
+workflow can be installed and still be `INCOMPATIBLE WITH AUTONOMOUS MODE`.
+Installation is a capability fact; compatibility is a precedence and behavior
+fact. The ForgeLoop `NON_BLOCKING` classification remains authoritative in
+autonomous mode. A mandatory approval policy for a reversible local choice is
+recorded as `WORKFLOW_CONFLICT`, with no user question and no fake entry in
+`current-contract.unresolvedDecisions[]`.
+
+The supported autonomous boundary is:
+
+| Workflow policy | Result |
+| --- | --- |
+| Local planning, review, tests, or docs | Compatible. |
+| Approval only for a real ForgeLoop `BLOCKING` decision | Compatible; the justified question may proceed. |
+| Approval for every design choice or before implementation | `INCOMPATIBLE WITH AUTONOMOUS MODE`. |
+| Reclassifying reversible aesthetics as blocking | `INCOMPATIBLE WITH AUTONOMOUS MODE`. |
+
+Interactive operation is explicit (`autonomousMode=false`) and must not be
+selected silently. Live conformance records the available and invoked external
+workflows, mandatory-approval setting, brainstorming/design hard gates,
+autonomy mode, process count, subagent count, and delegation status. For the
+sixth blind run, the harness must report:
+
+```text
+mandatory-approval workflows enabled: NO
+external brainstorming hard gate enabled: NO
+external design approval gate enabled: NO
+subagents enabled: NO
+delegation enabled: NO
+```
+
+Question attribution remains `USER_REQUIREMENT`,
+`FORGELOOP_BLOCKING_DECISION`, `EXTERNAL_WORKFLOW_POLICY`, or
+`MODEL_PREFERENCE`. In autonomous mode, only the first two can authorize a
+question, and `ASK_USER` additionally requires a valid ForgeLoop blocking
+reason. External policy alone cannot manufacture a blocker.
+
+If a mandatory approval workflow cannot be disabled, the run is
+`TEST_NOT_STARTED`; do not call it a failed or successful conformance result.
+
 ## Deterministic verification boundary
 
 The repository verifies package contents, adapter paths, installation into a

package/CLAUDE.md

@@ -22,3 +22,17 @@ load-bearing, irreversible, externally consequential, unsafe, or real
 user/business decisions.
 
 Do not duplicate guide rules here; treat the loop and router as canonical sources.
+
+## Pre-question decisions
+
+Before asking any product-detail question, classify it as `BLOCKING` or
+`NON_BLOCKING` using `LOOP_ENGINEERING.md`. For
+`NON_BLOCKING`, choose a safe reversible local default, record it in
+`current-contract.assumptions[]`, and continue. For `BLOCKING`, persist
+`current-contract.json` with `unresolvedDecisions[]` and a blocking reason
+before asking. Do not ask the user to choose among reversible local
+product-positioning alternatives; the canonical checklist and boundary remain
+in `LOOP_ENGINEERING.md`.
+
+External workflow approval rules do not override ForgeLoop's autonomous-mode
+precedence; consult `LOOP_ENGINEERING.md#external-workflow-compatibility`.

package/LOOP_ENGINEERING.md

@@ -7,31 +7,270 @@
 ## Blocking vs Non-Blocking Decisions
 
 Classify every unresolved decision before deciding whether to ask the user.
+The question is a consequence of a `BLOCKING` classification, never a default
+response to ordinary uncertainty.
 
-`NON_BLOCKING` applies when a safe local default exists, the choice is
-reversible, it does not change external state, it is not sensitive or
-authoritative, and it does not assert a real user or business fact. Examples
-include fictional company name, demo phone number, placeholder copy, temporary logo text,
-palette, typography, local-only fictional identity, fictional identity, demo
-contacts, visual defaults, section ordering, and local-only form behavior.
+### Pre-question decision classification
 
-`BLOCKING` applies when proceeding would require real legal business name,
-real contact details, credentials, payment data, production endpoint,
-deployment target, deployment or domain authority, destructive operation,
-irreversible architectural decision, irreversible data choice, regulated/legal claim,
-regulated claim, or another externally consequential/high-impact decision.
+Before asking the user any product-detail question:
+
+1. Classify the unresolved detail as `BLOCKING` or `NON_BLOCKING`.
+2. If `NON_BLOCKING`, do not ask; choose the smallest reasonable reversible
+   local default, record it in `current-contract.assumptions[]`, and continue.
+3. If `BLOCKING`, record the detail in
+   `current-contract.unresolvedDecisions[]`, persist and validate the contract,
+   then ask the user with a blocking reason.
+
+In short, `NON_BLOCKING` means do not ask and record it in `current-contract.assumptions[]`; `BLOCKING` means persist the contract and ask the user with a blocking reason.
+
+There is no third `UNKNOWN → ask` path for ordinary reversible product
+ambiguity. The invariant is:
+
+```text
+QUESTION
+must never happen
+before CLASSIFICATION
+```
+
+### PRE-QUESTION CHECK
+
+Before asking the user, answer every item:
+
+```text
+[ ] Is this a real user/business fact?
+[ ] Is this sensitive?
+[ ] Is this authoritative?
+[ ] Does it affect external state?
+[ ] Is it destructive?
+[ ] Is it irreversible?
+[ ] Would a safe local reversible default materially misrepresent the user?
+```
+
+If all answers are `NO`, classify the detail as `NON_BLOCKING`, record an
+assumption, and continue. If any answer is `YES`, classify it as `BLOCKING`,
+persist the contract before clarification, and attach a blocking reason.
 
 ### Safe assumption rule
 
-When a missing product detail is non-blocking, choose the smallest reasonable reversible default, explicitly classify it as an agent assumption, and record it in `current-contract.assumptions[]`. Each assumption must include `value`, `reason`, `scope`, `reversible=true`, and `source=agent-default`. Do not place resolved safe assumptions in unresolvedDecisions[]. Never present an assumption as a verified user or business fact.
+`NON_BLOCKING` applies when the choice is `SAFE + REVERSIBLE + LOCAL +
+NON-SENSITIVE + NON-AUTHORITATIVE + NON-DESTRUCTIVE` and does not assert a real
+user or business fact. Each recorded `ASSUMPTION` must include `value`, `reason`,
+`scope`, `reversible=true`, and `source=agent-default`. Do not place resolved
+safe assumptions in `unresolvedDecisions[]`, and never present an assumption as
+a verified user or business fact.
+
+Generally `NON_BLOCKING` when no real business fact is supplied:
+
+```text
+practice-area emphasis
+fictional positioning
+representative specialty mix
+tone of the fictional firm
+hero messaging
+section ordering
+fictional partner/attorney profiles
+fictional office location
+visual identity
+palette
+typography
+local fictional brand name
+local-only fictional identity
+fictional company name
+demo contact details
+demo phone number
+placeholder legal-service descriptions
+placeholder copy
+fictional testimonials
+temporary logo text
+local-only form behavior
+```
+
+These examples remain non-blocking only when they stay safe, reversible,
+local, non-sensitive, non-authoritative, and non-destructive. Do not hardcode
+one law-firm positioning into the protocol or tests.
+
+### Blocking boundary
+
+`BLOCKING` applies when proceeding requires any of the following:
+
+```text
+real legal business name
+real contact information
+real contact details
+real attorney identities
+credentials
+payment information
+payment data
+production endpoints
+production endpoint
+deployment target
+deployment/domain authority
+destructive operations
+destructive operation
+irreversible architecture
+irreversible architectural decision
+irreversible data decisions
+regulated or legal claims
+regulated/legal claim
+real compliance representations
+real business facts not safely inferable
+```
+
+Blocking decisions must be written to
+`current-contract.unresolvedDecisions[]`. They make `preflight` return
+`BLOCKED`, but they do not prevent contract serialization.
+Unresolved blocking decisions are recorded in `current-contract.unresolvedDecisions[]`.
+
+### Question justification invariant
+
+Asking the user is allowed only when `blockingReason` is present and comes from
+a blocking category such as:
+
+A user question requires a `blockingReason`; a question without one is invalid.
+
+```text
+REAL_BUSINESS_FACT_REQUIRED
+SENSITIVE_VALUE_REQUIRED
+EXTERNAL_AUTHORITY_REQUIRED
+IRREVERSIBLE_DECISION_REQUIRED
+REGULATED_CLAIM_REQUIRED
+DESTRUCTIVE_ACTION_REQUIRED
+```
+
+Multiple reasonable aesthetic or positioning choices do not justify a question.
+The deterministic support helper in `src/core/decision-classification.js`
+validates this boundary; it does not use an LLM or parse natural language.
+
+### Contract-before-clarification sequence
+
+The operational order is:
+
+```text
+DISCOVERY
+    ↓
+classify unresolved details
+    ↓
+create and persist current-contract.json
+    ↓
+persist assumptions[] and unresolvedDecisions[]
+    ↓
+validate contract
+    ↓
+if unresolvedDecisions.length > 0
+    ↓
+ask user with blockingReason
+```
+
+No clarification stop is allowed before a serialized contract exists. A
+non-blocking ambiguity never becomes a contract blocker.
+
+## External Workflow Compatibility
+
+ForgeLoop's decision classification has precedence over an external workflow's
+planning, brainstorming, review, testing, or documentation policy. The
+canonical order remains:
+
+```text
+uncertainty → classify → NON_BLOCKING → assume → record → continue
+uncertainty → classify → BLOCKING → serialize → ask
+```
+
+An external workflow may improve the plan, review the change, or recommend a
+test. It must not turn a ForgeLoop `NON_BLOCKING` decision into mandatory user
+approval while the task is in autonomous mode. `NON_BLOCKING` remains
+`NON_BLOCKING`; a policy that requires approval for it is a
+`WORKFLOW_CONFLICT`, not a user blocker. Record the conflict and continue with
+the safe reversible default. Do not put the conflict in
+`current-contract.unresolvedDecisions[]` as a fake user decision.
+
+The stable compatibility reason codes are:
+
+```text
+E_EXTERNAL_WORKFLOW_APPROVAL_CONFLICT
+E_EXTERNAL_WORKFLOW_BLOCKS_NON_BLOCKING
+E_EXTERNAL_WORKFLOW_REQUIRES_USER_GATE
+```
+
+Autonomous mode means the active harness has explicitly selected
+`autonomousMode=true`: the agent can choose safe local defaults, record
+`assumptions[]`, and continue without an external approval gate for ordinary
+reversible ambiguity. Interactive mode remains available only when the caller
+explicitly selects `autonomousMode=false`; the harness must not silently switch
+between the two modes.
+
+When a question is considered, record its source as exactly one of:
+
+```text
+USER_REQUIREMENT
+FORGELOOP_BLOCKING_DECISION
+EXTERNAL_WORKFLOW_POLICY
+MODEL_PREFERENCE
+```
+
+Only `USER_REQUIREMENT` and `FORGELOOP_BLOCKING_DECISION` authorize a question
+in autonomous mode. `EXTERNAL_WORKFLOW_POLICY` and `MODEL_PREFERENCE` may be
+recorded for diagnosis, but neither can authorize a question there. A genuine
+`BLOCKING` ForgeLoop decision remains compatible with an external approval and
+may produce a legitimate question with its persisted blocking reason.
+
+The question-source invariant is:
+
+```text
+ASK_USER is allowed only when:
+  classification = BLOCKING
+  AND blockingReason is valid
+  AND the source is not EXTERNAL_WORKFLOW_POLICY alone
+```
 
-The assumption boundary is:
+Before asking, apply the external-workflow conflict check in addition to the
+ordinary pre-question checklist:
+
+1. Is the product decision `BLOCKING` under ForgeLoop?
+2. If not, is the question required only by another workflow or skill?
+3. If yes, do not ask in autonomous mode; record the incompatibility when
+   useful and continue through the safe reversible assumption path.
+
+Examples of incompatible hard gates for an otherwise `NON_BLOCKING` decision
+include: “ask before implementation”, “present two or three designs and
+wait”, “receive explicit approval”, and “stop until the user reviews the
+specification”. Planning, review, testing, and documentation remain useful
+when they do not impose that interruption.
+
+The compatibility distinction is explicit:
+
+| External workflow behavior | Autonomous-mode result |
+| --- | --- |
+| Adds local planning without a user gate | Compatible; continue the ForgeLoop loop. |
+| Adds a local review or checklist | Compatible; continue the ForgeLoop loop. |
+| Adds deterministic tests | Compatible; continue the ForgeLoop loop. |
+| Adds documentation generation | Compatible; continue the ForgeLoop loop. |
+| Approval for a real `BLOCKING` decision | Compatible; a justified question is allowed. |
+| Approval for every design choice | `INCOMPATIBLE WITH AUTONOMOUS MODE`; record `WORKFLOW_CONFLICT`, do not ask. |
+| Approval before any implementation | `INCOMPATIBLE WITH AUTONOMOUS MODE` unless a real blocker exists. |
+| Reclassifying a reversible local aesthetic choice as blocking | `INCOMPATIBLE WITH AUTONOMOUS MODE`; preserve `NON_BLOCKING`. |
+| Spawning agents that change precedence | Not suitable for an isolated blind-conformance run; it does not change this contract. |
+
+"Installed" and "compatible" are different claims. A harness can have an
+external workflow installed and still be `INCOMPATIBLE WITH AUTONOMOUS MODE`.
+Use that wording instead of calling the workflow broken. The deterministic
+support helper in `src/core/workflow-compatibility.js` evaluates this boundary;
+it does not modify `src/core/decision-classification.js`, invoke an LLM, or
+redesign a runtime, arbiter, supervisor, or approval broker.
+
+For the sixth blind conformance run, exclude mandatory-approval workflows at
+the harness level rather than weakening the blind prompt. Record the harness
+state before starting:
 
 ```text
-SAFE + REVERSIBLE + LOCAL + NON-SENSITIVE + NON-AUTHORITATIVE + NON-DESTRUCTIVE
+mandatory-approval workflows enabled: NO
+external brainstorming hard gate enabled: NO
+external design approval gate enabled: NO
+subagents enabled: NO
+delegation enabled: NO
 ```
 
-Record the choice with an explicit `ASSUMPTION` marker. Unresolved blocking decisions must be recorded in `current-contract.unresolvedDecisions[]`; they prevent `preflight` from returning `READY` and block `EXECUTING` until resolved, but do not prevent contract serialization.
+If the harness cannot disable a mandatory approval workflow, record
+`TEST_NOT_STARTED` and do not claim a conformance result.
 
 ## Serialized protocol preparation
 

package/QUALITY_SCORECARD.md

@@ -17,7 +17,11 @@ policy are all present.
 | Completion enforcement | Canonical contract, persisted route, guide-declared gates, preflight, phase ledger, structured checks, evidence coverage, `audit`, `report`, and `complete` validators. |
 | Agent lifecycle navigation | Read-only `forgeloop next` decisions, stable action/reason output, persisted-state safety, and adapter guidance at lifecycle boundaries. |
 | Execution → Verification handoff | Legal `EXECUTING` → `VERIFYING` transition, implementation-step reconciliation, and preservation of verification evidence. |
-| Pre-contract autonomy | Blocking vs Non-Blocking Decisions policy, explicit ASSUMPTION / source=agent-default recording, safe-boundary invariant, positive and negative tests, and a blind run showing non-blocking ambiguity continues while blocking ambiguity remains user-gated. |
+| Pre-contract autonomy — structural | Blocking vs Non-Blocking Decisions policy, classify-before-ask invariant, PRE-QUESTION CHECK, explicit ASSUMPTION / source=agent-default recording, contract-before-clarification ordering, deterministic reason-code helper, and positive/negative tests. |
+| External workflow compatibility — structural | Explicit autonomous-mode precedence, `WORKFLOW_CONFLICT` recording, question-source attribution, installed-versus-compatible wording, and mandatory-approval harness isolation. |
+| Instruction-conflict handling — structural | External workflow policy is attributed separately from user requirements and ForgeLoop blocking decisions, with deterministic conflict reason codes and no fake unresolved user blocker. |
+| Autonomous-mode precedence — structural | Explicit `autonomousMode=true` boundary, explicit interactive opt-in, preservation of `NON_BLOCKING`, and no silent workflow-induced mode switch. |
+| Pre-contract autonomy — cross-agent live robustness | Independent live-agent behavior across fresh package installs, exact blind prompts, one-process/no-subagent topology, and separate evidence for non-blocking continuation versus blocking clarification. Structural coverage does not imply live cross-agent robustness. |
 | Resume/checkpoint | Atomic local state, contract/HEAD/artifact freshness, age warning, schema/secret validation, status, safe validation, and bounded clearing without persisting derived freshness fields. |
 | Multi-agent coordination | Self-contained briefs, write/write and write/read ownership checks, dependency-set validation, reviewer independence, normalized results, and inline fallback. |
 | Security boundaries | Realpath containment, bounded untrusted JSON, threat model, nested secret scanning, publication evidence, and explicit authority rules. |
@@ -37,14 +41,19 @@ policy are all present.
 - Literal graph runtime and runtime multi-agent orchestration are `N/A by
   design`; compatible harnesses own those capabilities.
 
-## Third-run conformance position
+## Blind-run conformance position
 
 | Dimension | Classification |
 | --- | --- |
-| Execution → Verification | REPRODUCED FAILURE before this fix |
-| Verification serialization | NOT_REACHED |
-| Review transition | NOT_REACHED |
-| Receipt generation | NOT_REACHED |
+| Pre-contract autonomy — structural | IMPLEMENTED / LOCAL TESTS PASS — 377 Node tests and 42 Python tests, with focused autonomy/conformance checks green |
+| External workflow compatibility — structural | IMPLEMENTED / LOCAL TESTS PASS — deterministic helper covers autonomous conflict, compatible non-blocking flow, legitimate blocking questions, explicit interactive mode, and question-source vocabulary |
+| Instruction-conflict handling — structural | IMPLEMENTED / LOCAL TESTS PASS — workflow-policy conflicts stay outside `unresolvedDecisions[]` and expose stable external-workflow reason codes |
+| Autonomous-mode precedence — structural | IMPLEMENTED / LOCAL TESTS PASS — autonomous mode is explicit, interactive mode is explicit, and `NON_BLOCKING` is never promoted by workflow policy |
+| Pre-contract autonomy — cross-agent live robustness | NOT_PROVEN — the fifth blind run is `PARTIAL` on published `0.1.4` and the sixth run requires harness-level exclusion of mandatory-approval workflows before it can start |
+| Execution → Verification | REPRODUCED FAILURE in fourth blind run before implementation |
+| Verification serialization | NOT_REACHED in fourth blind run |
+| Review transition | NOT_REACHED in fourth blind run |
+| Receipt generation | NOT_REACHED in fourth blind run |
 | Full conformance | PARTIAL |
 
 ## Evidence matrix
@@ -63,7 +72,11 @@ are both present:
 | Security boundary | realpath containment, bounded JSON, `THREAT_MODEL.md`, secret-free artifacts, authority and no-runtime rules | `tests/security-limits.test.js`, Markdown/loop validators, and `scripts/scan_secrets.py` |
 | Cross-artifact conformance | `src/core/conformance.js`, `classifyLoadedWorkState`, and `forgeloop validate-protocol --contract-file` | `tests/conformance.test.js`, `tests/validate-protocol-cli.test.js`, and protocol fixtures covering precedence and stale evidence |
 | Protocol preparation and completion | `src/core/preflight.js`, `src/core/completion.js`, `src/core/events.js`, policy packs, and portable bundles | `tests/preflight.test.js`, `tests/completion.test.js`, `tests/lifecycle.test.js`, `tests/policy.test.js`, and `tests/bundle.test.js` |
-| Pre-contract autonomy | `LOOP_ENGINEERING.md`, `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`, `.cursor/rules/project-loop.mdc`, and the blind conformance artifacts | `tests/autonomy-policy.test.js`, `tests/conformance-scenarios.test.js` |
+| Pre-contract autonomy — structural | `LOOP_ENGINEERING.md`, `src/core/decision-classification.js`, `src/core/workflow-compatibility.js`, `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`, `.cursor/rules/project-loop.mdc` | `tests/decision-classification.test.js`, `tests/workflow-compatibility.test.js`, `tests/autonomy-policy.test.js`, `tests/preflight.test.js` |
+| External workflow compatibility — structural | `LOOP_ENGINEERING.md`, `AGENT_COMPATIBILITY.md`, `src/core/workflow-compatibility.js`, and sixth-run harness metadata rule | `tests/workflow-compatibility.test.js`, `conformance/README.md` |
+| Instruction-conflict handling — structural | Canonical source-attribution and `WORKFLOW_CONFLICT` policy in `LOOP_ENGINEERING.md` plus adapter references | `tests/autonomy-policy.test.js`, `tests/workflow-compatibility.test.js` |
+| Autonomous-mode precedence — structural | Autonomous/interactive mode contract and harness exclusion metadata | `tests/workflow-compatibility.test.js`, `tests/conformance-scenarios.test.js` |
+| Pre-contract autonomy — cross-agent live robustness | Prior third blind-run result, `conformance/runs/2026-08-13-codex-fourth-live.md`, preserved fifth-run report `conformance/runs/2026-08-13-codex-fifth-live.md`, and the exact blind request | `tests/conformance-scenarios.test.js`; sixth run is not started until mandatory approval is excluded |
 
 The implementation references above are local observations. OS runners,
 remote links, provider sessions, publication, and deployment remain `Not

package/conformance/README.md

@@ -45,3 +45,31 @@ history.
 
 The complete-website scenario deliberately fails when implementation starts
 before the contract, route, and required gates exist.
+
+## Autonomous blind-run isolation
+
+External workflows may help with local planning, review, tests, or
+documentation, but a mandatory approval policy for a ForgeLoop `NON_BLOCKING`
+decision is `INCOMPATIBLE WITH AUTONOMOUS MODE`. The harness must exclude that
+policy before the blind prompt starts; do not add a hint to the prompt that
+changes the scenario. `NON_BLOCKING` must remain non-blocking, and any
+compatibility conflict is recorded as `WORKFLOW_CONFLICT`, not as a fake user
+blocker.
+
+For the sixth blind run, record these values before sending the unchanged blind
+prompt:
+
+```text
+mandatory-approval workflows enabled: NO
+external brainstorming hard gate enabled: NO
+external design approval gate enabled: NO
+subagents enabled: NO
+delegation enabled: NO
+```
+
+Also record the available and invoked external workflows, explicit autonomy
+mode, process count, subagent count, and delegation status. If the harness
+cannot disable a mandatory approval workflow, record `TEST_NOT_STARTED` and do
+not interpret the run as a conformance failure or success. An installed
+workflow and a compatible workflow are separate claims; use
+`INCOMPATIBLE WITH AUTONOMOUS MODE`, not "broken", for the former.