@sabaiway/agent-workflow-engine 1.9.0 → 1.11.0

package/CHANGELOG.md

@@ -4,6 +4,44 @@ All notable changes to the methodology engine. Versions are this **package's** n
 they are distinct from the **deployment-lineage** stamp written into a project's `docs/ai/`
 (which tracks the shared `agent-workflow` lineage, head `1.3.0`).
 
+## 1.11.0 — Plans carry only checked syntax (the §9 checked-vs-unchecked boundary)
+
+A **feature** release (canon text + its tests; installer unchanged). The §9 "No code-mechanics in
+the plan" rule now names a hard discriminator for what syntax plan prose may carry:
+
+- **`references/planning.md` §9 (B5)** — **checked syntax**: a Step's exact paths + commands stay
+  REQUIRED (§7/§8) and count as checked because the plan's own Verification runs them against an
+  explicit expected outcome or gate — merely running without asserting checks nothing; the only
+  other syntax a plan may carry is a literal fixture/schema fragment a named test copies or
+  validates. **Un-run, logic-bearing syntax** — control-flow, a regex, a glob, a grammar, an
+  algorithm body, a mini-DSL, anything that transforms data or evaluates a condition — never lives
+  in plan prose, however plausible or shell-verified it looks ("I ran it in my shell" is not a
+  checker): a fold or draft that wants one writes the red→green test-as-spec at Execute instead.
+- **`references/procedures.md` plan-authoring step 5** — the terse mirror of the same boundary at
+  the point of use (the kit advisor prints this section verbatim).
+- **Lockstep tests** — `planning-canon.test.mjs` (§9 it-block) and `procedures-canon.test.mjs`
+  (Set-1) pin the two new tokens `checked syntax` + `logic-bearing`; non-vacuity proven by an
+  injected red→green in both guards.
+
+## 1.10.0 — Cost-lane vocabulary in the orchestration canon (§5)
+
+A **feature** release (canon text + its tests; installer unchanged). Work now has named **cost
+lanes**, and the canon states who runs what:
+
+- **`orchestration.md` §5 defines the lanes** — **L0** deterministic script · **L1** cheap
+  subagent (small model, low effort, read-only tools) · **L2** subscription bridge · **L3**
+  frontier — plus the two routing rules: route every step to the **cheapest adequate executor**,
+  and **a step with no named guardrail does not move down** a lane. The **red lines never move
+  down**: council review models · real code · ADR/plan/handover/changelog-entry wording ·
+  persuasive copy · go/no-go · the maintainer approval asks. Asymmetric pairing (cheap drafts,
+  a deterministic tool or the frontier verifies) and the incident-repair default (salvage
+  recorded state first, never frontier re-derivation) are canon now.
+- **Lockstep tests** — `test/orchestration-canon.test.mjs` pins the four lane tokens, both
+  routing rules, the red-line list, and that §5 stays generic (the L0 examples name the family's
+  own surfaces — the gate runner over `docs/ai/gates.json`, the rotation checks — never a
+  project's publish mechanics); `test/procedures-canon.test.mjs` pins the same canon tokens the
+  composition root's advisor paraphrases, so the two cannot silently drift apart.
+
 ## 1.9.0 — Honest installer messaging: the verb states what was observed, the note states facts
 
 A **feature** release (installer output contract only; the canon text is unchanged). `bin/install.mjs`

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-engine
 description: Canonical home of the agent-workflow planning methodology — the Plan→Phase→Step→Substep vocabulary, plan lifecycle, queue.md series index, mandatory Cleanup phase, the bounded methodology slot fragment, the orchestration-recipe vocabulary (Solo / Reviewed / Council / Delegated), and the activity-procedures canon (plan-authoring / plan-execution, with typed recipe slots). A published, installable npm package (available:true) that *provides* the methodology text; it mutates nothing. The composition root (agent-workflow-kit) reads this canon LIVE from the installed engine and injects the bounded slots from it — one source of truth, no bundled mirror; `npx @sabaiway/agent-workflow-kit@latest init` installs the engine.
 disable-model-invocation: true
 metadata:
-  version: '1.9.0'
+  version: '1.11.0'
 ---
 
 # agent-workflow-engine

package/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "agent-workflow-engine",
   "kind": "methodology-engine",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "available": true,
   "provides": ["plan"],
   "roles": {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sabaiway/agent-workflow-engine",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "description": "Canonical home of the agent-workflow planning methodology — the Plan→Phase→Step vocabulary, plan lifecycle, queue.md series index, and mandatory Cleanup phase, consumed by the kit (composition root). The methodology engine of the agent-workflow family.",
   "keywords": [
     "ai-agents",

package/references/orchestration.md

@@ -101,6 +101,41 @@ already accepted: run both, every round, until a round comes back clean — or u
 marks the crossover (§4), resolved at altitude rather than by exhausting the strictest backend. Spending
 quota to line-by-line re-review mechanics past that crossover is the over-run the divergence stop prevents.
 
+### Cost lanes — route every step to the cheapest adequate executor
+
+Model quota is one axis of a wider guard: work has **lanes**, and every step routes to the
+**cheapest adequate executor**:
+
+- **L0 — deterministic script.** Anything rule-driven and verifiable by exit code: the batched
+  project gate matrix (the family's generic gate runner over a project-declared
+  `docs/ai/gates.json`), the docs cap/index checks, the rotation `--check` scripts
+  (changelog / issues / decisions). If a step CAN be a script, it IS a script — a model
+  re-reading what an exit code already proves is the canonical waste.
+- **L1 — cheap subagent** (a small model at low effort, bounded read-only tools): mechanical
+  extraction at scale — inventories, fact sweeps, changelog fact-skeletons, digesting long
+  failing output. Extraction and drafting ONLY; the orchestrator verifies the output against
+  sources and owns every conclusion.
+- **L2 — subscription bridge** (`codex` / `agy`): review and bounded delegated execution,
+  governed by the recipes above; real review work stays on frontier bridge models
+  (quality-first — economy on this lane comes from precomputed context, never a weaker model).
+- **L3 — frontier main lane**: judgment — plans, folds, syntheses, ADR / handover /
+  changelog-entry wording, user-facing copy, go/no-go, real code.
+
+Two rules bound the routing. **A step with no named guardrail does not move down a lane** — a
+deterministic checker, a pinned test, or a verifying orchestrator must catch a cheaper executor's
+error, otherwise the step stays where it is. And the **red lines never move down**: council
+reviews on frontier bridge models · real code implementation · ADR / plan / handover /
+changelog-entry wording · persuasive user-facing copy · go/no-go judgment · the maintainer's
+approval asks (commit / push / publish — cost tiering never touches approval gates).
+
+**Asymmetric pairing** is the default composition: the cheap lane drafts, a deterministic tool or
+the frontier verifies and signs — never the reverse.
+
+**Incident repair (your own error) defaults down-lane:** salvage recorded state first (journals,
+transcripts, git), replay it deterministically (L0), hand the leftovers to L1 in one batch —
+frontier re-derivation of recoverable state is the expensive failure mode, and the maintainer
+never pays frontier tokens for the agent's own mistake.
+
 A **standing health advisory** applies to `agy`: the Antigravity service can **stall on substantive
 prompts** (a long hang that returns nothing — an external service issue, not a setup problem;
 tracked as **Issue-001** in the kit's known issues). It is **invisible to file-presence detection**,

package/references/planning.md

@@ -115,7 +115,7 @@ These disciplines keep a plan converging instead of churning, and keep a fold or
 
 **Right altitude.** A plan pins *intent + architecture + invariants + acceptance criteria* — the named tests that must stay green and the new tests that must pass. It does NOT spell out fine code-mechanics in prose: those are resolved in code at Execute (against the real files + the per-Step review + the gates), where prose cannot diverge from reality. Most "blockers" that resurface across review rounds are code-level details that never belonged in a prose plan.
 
-**No code-mechanics in the plan.** A Step still carries its exact paths + commands (§7, §8); the ceiling is on *fold-bred* detail — a review fold must not push fine code-mechanics (`cd`, an env default, a flag) into prose, where they diverge from reality. A fold that needs a mechanic is the trigger to write the test (test-as-spec) instead.
+**No code-mechanics in the plan.** A Step still carries its exact paths + commands (§7, §8) — checked syntax: the plan's own Verification runs them against an explicit expected outcome or gate, and merely running without asserting checks nothing; the only other syntax a plan may carry is a literal fixture/schema fragment a named test copies or validates. Un-run, logic-bearing syntax — control-flow, a regex, a glob, a grammar, an algorithm body, a mini-DSL, anything that transforms data or evaluates a condition — never lives in plan prose, however plausible or shell-verified it looks ("I ran it in my shell" is not a checker): a fold or draft that wants one is the trigger to write the red→green test-as-spec at Execute instead.
 
 **Fold by code, not prose.** Before folding any code-touching finding into the plan, READ the cited `file:line`; the fold cites it. A fold grounded in prose alone drifts from the code and seeds the next bug.
 

package/references/procedures.md

@@ -57,8 +57,10 @@ Produce a self-contained, cold-readable plan, reviewed to the configured depth b
    **0 blockers + 0 majors** from every backend the recipe names (the convergence bar,
    [`planning.md`](planning.md) §9); folding ≠ convergence — re-review after folding. Fold a
    code-touching finding **test-as-spec** (a named acceptance test, not a prose paragraph); a fold must
-   add **no code-mechanics** to the plan — a Step still carries its own exact paths + commands, but a
-   fold needing a mechanic is the trigger to name the test instead. Council runs every named backend
+   add **no code-mechanics** to the plan — a Step still carries its own exact paths + commands
+   (checked syntax: its Verification asserts an expected outcome), but un-run, logic-bearing syntax
+   (control-flow, a regex, a glob, a mini-DSL) never enters plan prose — a fold needing one is the
+   trigger to name the test instead. Council runs every named backend
    **every round** (recipe fidelity,
    [`orchestration.md`](orchestration.md) §4) — never quietly drop a ready backend. Cap architecture
    plan-review at **≤2 rounds**, stopping at the **crossover** where **backend divergence** (one backend