@sabaiway/agent-workflow-kit 10.2.0 → 10.4.0

package/tools/node-evidence.mjs

@@ -0,0 +1,77 @@
+// node-evidence.mjs — does Node PROVABLY run in this project tree? Contract: docs/ai/specs/kit/node-evidence.md.
+// Pure over an injectable lstat; no writes, no side effects on import. Dependency-free, Node >= 22.
+
+import { lstatSync } from 'node:fs';
+import { join } from 'node:path';
+
+export const NODE_EVIDENCE = Object.freeze({
+  PACKAGE_JSON: 'package-json',
+  DEPLOYED_SCRIPTS: 'deployed-node-scripts',
+  NONE: 'none',
+  UNREADABLE: 'unreadable',
+});
+
+export const PACKAGE_JSON_REL = 'package.json';
+export const SCRIPTS_DIR = 'scripts';
+
+// The runnable scripts the bootstrap copies from references/scripts/ — pinned against the bundle by the suite.
+export const NODE_EVIDENCE_SCRIPTS = Object.freeze([
+  'archive-caps.mjs',
+  'archive-changelog.mjs',
+  'archive-decisions.mjs',
+  'archive-issues.mjs',
+  'check-docs-size.mjs',
+  'install-git-hooks.mjs',
+  'markdown-blocks.mjs',
+  'migrate-gates.mjs',
+  'spec-schema.mjs',
+]);
+
+export const NODE_EVIDENCE_PROBES = Object.freeze([PACKAGE_JSON_REL, ...NODE_EVIDENCE_SCRIPTS.map((name) => `${SCRIPTS_DIR}/${name}`)]);
+
+const ENOENT = 'ENOENT';
+const kindOf = (st) => (st.isSymbolicLink() ? 'a symlink' : st.isDirectory() ? 'a directory' : st.isFile() ? 'a regular file' : 'not a regular file');
+
+const answer = (state, evidence, wrongKind, extra = {}) =>
+  Object.freeze({ state, evidence, probed: NODE_EVIDENCE_PROBES, wrongKind: Object.freeze(wrongKind), ...extra });
+
+// probeNodeEvidence(cwd, lstat) -> { state, evidence, probed, wrongKind, error? }: the first regular file
+// among the probes answers; a probe failing with anything but ENOENT answers unreadable at once; a path of
+// the wrong node kind is not evidence — it is recorded in `wrongKind` and the walk continues. lstat does
+// not follow the LEAF but walks THROUGH a symlinked scripts/, whose files are not this tree's — so the
+// directory is proven plain before any script inside it counts.
+export const probeNodeEvidence = (cwd, lstat = lstatSync) => {
+  const wrongKind = [];
+  const probeKind = (rel, wanted) => {
+    let st;
+    try {
+      st = lstat(join(cwd, rel));
+    } catch (err) {
+      if (err && err.code === ENOENT) return 'absent';
+      throw Object.assign(err, { probedRel: rel });
+    }
+    if (wanted === 'dir' ? st.isDirectory() && !st.isSymbolicLink() : st.isFile()) return wanted;
+    wrongKind.push(`${rel} is ${kindOf(st)}`);
+    return 'wrong-kind';
+  };
+  try {
+    if (probeKind(PACKAGE_JSON_REL, 'file') === 'file') return answer(NODE_EVIDENCE.PACKAGE_JSON, PACKAGE_JSON_REL, wrongKind);
+    if (probeKind(SCRIPTS_DIR, 'dir') === 'dir') {
+      for (const rel of NODE_EVIDENCE_PROBES.slice(1)) {
+        if (probeKind(rel, 'file') === 'file') return answer(NODE_EVIDENCE.DEPLOYED_SCRIPTS, rel, wrongKind);
+      }
+    }
+  } catch (err) {
+    return answer(NODE_EVIDENCE.UNREADABLE, null, wrongKind, { error: `${err.code || err.message || 'lstat failed'} on ${err.probedRel}` });
+  }
+  return answer(NODE_EVIDENCE.NONE, null, wrongKind);
+};
+
+export const hasNodeEvidence = (probe) => probe.state === NODE_EVIDENCE.PACKAGE_JSON || probe.state === NODE_EVIDENCE.DEPLOYED_SCRIPTS;
+
+// The sentence a skip line carries: every probe checked, and what of the wrong kind sat at any of them.
+export const describeNodeProbes = (probe = null) => {
+  const probes = `${PACKAGE_JSON_REL} and the kit-seeded ${SCRIPTS_DIR}/ files (${NODE_EVIDENCE_SCRIPTS.join(', ')})`;
+  const wrong = probe?.wrongKind?.length ? ` — not evidence: ${probe.wrongKind.join('; ')}` : '';
+  return `${probes}${wrong}`;
+};

package/tools/orchestration-config.mjs

@@ -68,7 +68,7 @@ export const assertSlotRecipe = (activity, slot, recipe, exitCode = 2) => {
   if (!(SLOT_RECIPES[slotType] ?? []).includes(recipe)) {
     throw fail(
       exitCode,
-      `invalid recipe "${recipe}" for ${slotType} slot of "${activity}" (${slotType} accepts: ${SLOT_RECIPES[slotType].join(', ')})`,
+      `invalid value "${recipe}" for ${slotType} slot of "${activity}" (${slotType} accepts: ${SLOT_RECIPES[slotType].join(', ')})`,
     );
   }
   return slotType;
@@ -98,14 +98,14 @@ const parseQualified = (lhs, flag) => {
 export const parseOp = (kind, token) => {
   if (kind === 'set') {
     const eq = token.indexOf('=');
-    if (eq <= 0) throw fail(2, `--set must be <activity>.<slot>=<recipe> (got "${token}")`);
+    if (eq <= 0) throw fail(2, `--set must be <activity>.<slot>=<value> (got "${token}")`);
     const recipe = token.slice(eq + 1);
-    if (!recipe) throw fail(2, `--set must be <activity>.<slot>=<recipe> (got "${token}")`);
+    if (!recipe) throw fail(2, `--set must be <activity>.<slot>=<value> (got "${token}")`);
     const { activity, slot } = parseQualified(token.slice(0, eq), '--set');
     assertSlotRecipe(activity, slot, recipe);
     return { kind: 'set', activity, slot, recipe };
   }
-  if (token.includes('=')) throw fail(2, `--unset takes <activity>.<slot> without a recipe (got "${token}")`);
+  if (token.includes('=')) throw fail(2, `--unset takes <activity>.<slot> without a value (got "${token}")`);
   const { activity, slot } = parseQualified(token, '--unset');
   assertSlot(activity, slot);
   return { kind: 'unset', activity, slot };
@@ -245,7 +245,7 @@ export const validateConfig = (config) => {
       if (typeof recipe !== 'string' || !(SLOT_RECIPES[slotType] ?? []).includes(recipe)) {
         throw fail(
           1,
-          `${CONFIG_REL}: invalid recipe "${recipe}" for ${slotType} slot of "${key}" (${slotType} accepts: ${SLOT_RECIPES[slotType].join(', ')})`,
+          `${CONFIG_REL}: invalid value "${recipe}" for ${slotType} slot of "${key}" (${slotType} accepts: ${SLOT_RECIPES[slotType].join(', ')})`,
         );
       }
     }
@@ -361,19 +361,40 @@ export const CANON_README =
   "Per-project orchestration config: the recipe used at each step (slot) of each named activity. " +
   "Easiest: tell the agent in plain language and run the `set-recipe` writer — it interprets your intent, " +
   "previews the change, and writes valid JSON for you. You can still hand-edit this file directly whenever you " +
-  "prefer; that option never goes away. Each activity is configured independently (e.g. plan-authoring, " +
-  "plan-execution), and so is each slot within it. A slot's value is a recipe: a 'review' slot accepts " +
+  "prefer; that option never goes away. Three activities are configured independently, and so is each slot " +
+  "within them: 'plan-authoring' (slots author, review), 'plan-execution' (slots execute, review) and " +
+  "'routine' (slots carrier, parallel). A slot's value is a recipe: a 'review' slot accepts " +
   "solo | reviewed | council (you self-review / one backend reviews / both review and you synthesize); an " +
-  "'execute' slot accepts solo | delegated (you implement / a backend runs a bounded sub-task). The default " +
-  "below is 'solo' everywhere — no execution backend required. Raise a slot to reviewed or council for a second " +
-  "opinion, or to delegated to hand off execution; those need an execution backend set up first. Remove a slot's " +
-  "line (or run `set-recipe --unset <activity>.<slot>`) to fall back to the computed default (reviewed when a " +
-  "review backend is ready, otherwise solo). Run the read-only procedures advisor to see an activity's steps " +
-  "plus the recipe resolved for your environment. Strict JSON — no comments.";
+  "'execute' slot accepts solo | delegated | subagent (you implement / a backend runs a bounded sub-task / a " +
+  "full-tool frontier subagent carries a bounded slice you verify); the carrier slots 'plan-authoring.author' " +
+  "and 'routine.carrier' accept solo | subagent. 'routine.parallel' is a flag rather than a recipe: it accepts " +
+  "on | off and decides whether file-disjoint subagent slices dispatch concurrently. The default below is " +
+  "'solo' for every recipe and carrier slot, and 'on' for the parallel switch — no execution backend required. " +
+  "Raise a slot to reviewed or council for a second " +
+  "opinion, or to delegated to hand off execution; those need an execution backend set up first. 'subagent' " +
+  "needs the executor vehicle placed in this project — the composition root's `agents` writer places it; without " +
+  "it the slot resolves to solo with the reason stated. Remove a slot's line, or a whole activity block (or " +
+  "run `set-recipe --unset <activity>.<slot>`), to fall back to the computed default: reviewed when a review " +
+  "backend is ready and otherwise solo for a review slot, solo for author, execute and carrier, on for " +
+  "parallel. Run the read-only procedures advisor to see an activity's steps plus the recipe resolved for " +
+  "your environment. Strict JSON — no comments.";
 
 export const KNOWN_PRIOR_README = [
   // v1 (pre-set-recipe) — the "Hand-edit this file — it is never written for you" note. APPEND-ONLY.
   "Per-project orchestration config: the recipe used at each step (slot) of each named activity. Hand-edit this file — it is never written for you. Each activity is configured independently (e.g. plan-authoring, plan-execution), and so is each slot within it. A slot's value is a recipe: a 'review' slot accepts solo | reviewed | council (you self-review / one backend reviews / both review and you synthesize); an 'execute' slot accepts solo | delegated (you implement / a backend runs a bounded sub-task). The default below is 'solo' everywhere — no execution backend required. Raise a slot to reviewed or council for a second opinion, or to delegated to hand off execution; those need an execution backend set up first. Remove a slot's line to fall back to the computed default (reviewed when a review backend is ready, otherwise solo). Run the read-only procedures advisor to see an activity's steps plus the recipe resolved for your environment, and pass a per-run override to change one slot just once. Strict JSON — no comments.",
+  // v2 (two activities, an `execute` slot without a carrier) — the note that shipped before AD-124.
+  "Per-project orchestration config: the recipe used at each step (slot) of each named activity. Easiest: tell " +
+  "the agent in plain language and run the `set-recipe` writer — it interprets your intent, previews the change, " +
+  "and writes valid JSON for you. You can still hand-edit this file directly whenever you prefer; that option " +
+  "never goes away. Each activity is configured independently (e.g. plan-authoring, plan-execution), and so is " +
+  "each slot within it. A slot's value is a recipe: a 'review' slot accepts solo | reviewed | council (you " +
+  "self-review / one backend reviews / both review and you synthesize); an 'execute' slot accepts solo | " +
+  "delegated (you implement / a backend runs a bounded sub-task). The default below is 'solo' everywhere — no " +
+  "execution backend required. Raise a slot to reviewed or council for a second opinion, or to delegated to hand " +
+  "off execution; those need an execution backend set up first. Remove a slot's line (or run `set-recipe --unset " +
+  "<activity>.<slot>`) to fall back to the computed default (reviewed when a review backend is ready, otherwise " +
+  "solo). Run the read-only procedures advisor to see an activity's steps plus the recipe resolved for your " +
+  "environment. Strict JSON — no comments.",
 ];
 
 // refreshReadme(config) → { config, changed }: refresh ONLY the `_README` value when it normalize-

package/tools/procedures.mjs

@@ -3,10 +3,10 @@
 //
 // It composes the AD-018 orchestration recipes into NAMED activities: it reads the canonical procedure
 // steps LIVE from the installed agent-workflow-engine (references/procedures.md — AD-016 live read, no
-// bundled mirror), reads the per-project, hand-edited config (docs/ai/orchestration.json), runs the
-// read-only backend detector, and prints the activity's steps VERBATIM + the resolved effective recipe
-// per slot (default = Reviewed-when-a-backend-is-ready, Council on request, slot-aware incl. Delegated),
-// plus the project's DECLARED source-size practice when it declares one (D-17 U1).
+// bundled mirror), reads the per-project, hand-edited config (docs/ai/orchestration.json), composes the
+// readiness every caller composes (detected backends + the executor vehicle), and prints the activity's
+// steps VERBATIM + the resolved effective recipe per slot, plus the project's DECLARED source-size
+// practice when it declares one (D-17 U1).
 //
 // Invariants (mirror recipes.mjs): pure-where-possible, READ-ONLY (never writes, never commits, never
 // runs a subscription CLI). The deterministic resolution lives in the kit (resolveActivityRecipe), not
@@ -26,7 +26,9 @@ import { detectBackends, wrapperCmdFor, wrapperContractFor } from './detect-back
 // core only — never the writer — so this read-only advisor never imports the atomic-write core.
 import { loadRegistry, allowedLabel } from './bridge-settings-read.mjs';
 import { isDirectRun } from './direct-run.mjs';
-import { ACTIVITIES, resolveActivityRecipe, planRecipe } from './recipes.mjs';
+import { ACTIVITIES, SLOT_RECIPES, isSwitchSlot, resolveActivityRecipe, planRecipe, composeReadiness } from './recipes.mjs';
+// The dispatch-form wording, from the pure (fs-free) leaf that owns it: composed here, never re-worded.
+import { dispatchForm, parallelLine } from './carriers.mjs';
 import { resolveEngineDir, readEngineFragment, PROCEDURES_FRAGMENT_REL } from './engine-source.mjs';
 // The plan-in-flight detector (AD-038) — imported from the plan-files.mjs LEAF (read-only fs by
 // construction); the WRITER-capable grounding.mjs is only NAMED in rendered text, never imported.
@@ -34,19 +36,15 @@ import { plansInFlight, PLANS_REL } from './plan-files.mjs';
 // The family's ONE shell quoter for a RENDERED command operand (bare when the value is already safe,
 // single-quoted otherwise) — the same leaf eight other command renderers here read through.
 import { shellQuoteArg } from './repo-lex.mjs';
-// The config schema/read core lives in orchestration-config.mjs (the single config contract). procedures
-// is READ-ONLY: it imports the reader + the SHARED slot/recipe validity, never the fs-writer
-// (orchestration-write.mjs) DIRECTLY — the import-split test pins the direct-import rule.
-// CONFIG_REL is RE-EXPORTED so existing importers (procedures.test.mjs, historically) keep their
-// import site working.
+// The config schema/read core (orchestration-config.mjs, the single config contract): the reader +
+// the SHARED slot/recipe validity, never the fs-writer (orchestration-write.mjs) DIRECTLY — the
+// import-split test pins the direct-import rule.
 import { CONFIG_REL, fail, loadConfig, assertSlotRecipe } from './orchestration-config.mjs';
 import { AUTONOMY_REL, loadAutonomy, resolveAutonomy, isSparseSeedConfig } from './autonomy-config.mjs';
-// The flow armed-halves probe (P8): read-only store presence/adoption facts for the session-start
-// surface, imported from the read module that OWNS no write API — this advisor never imports the
-// mixed flow-store module (append API) DIRECTLY, like it never imports orchestration-write (the
-// import-split test pins both direct rules). The TRANSITIVE claim is now structural, not
-// narrated: this advisor's import closure reaches NO write-API module and the tools graph is
-// acyclic — pinned by test/read-graph-purity.test.mjs (FLOW-READ-GRAPH-PURITY).
+// The flow armed-halves probe (P8): read-only store presence/adoption facts, from the read module
+// that OWNS no write API — never the mixed flow-store module (append API) DIRECTLY, like never
+// orchestration-write (the import-split test pins both direct rules; the TRANSITIVE claim is
+// structural — test/read-graph-purity.test.mjs pins it).
 import { resolveFlowStorePath, readFlowStore } from './flow-store-read.mjs';
 import { CHAIN_KIND } from './flow-record.mjs';
 // The declared source-size practice (D-17 U1), read through the practice's PURE READ core — never
@@ -57,18 +55,17 @@ export { CONFIG_REL };
 
 // ── argument + override parsing (usage errors → exit 2) ─────────────────────────────
 
-// Parse the activity's --override <slot>=<recipe> tokens into a { slot: recipe } map, validating each
+// Parse the activity's --override <slot>=<value> tokens into a { slot: recipe } map, validating each
 // against the SHARED slot/recipe validity table (assertSlotRecipe — the SAME accept/reject the set-recipe
-// op parser uses, drift-guarded). Every malformed token is a USAGE error (exit 2): a bare `<recipe>` (no
-// slot), an unknown slot for the activity, an invalid recipe-for-slot, or a duplicate slot. (An override
-// naming a recipe whose backend merely is not `ready` is NOT a usage error — it degrades loudly at
-// resolution time, exit 0.) The `--override` grammar stays activity-SCOPED (the activity comes from the
-// CLI arg), unlike the fully-qualified `--set <activity>.<slot>=<recipe>` the writer takes.
+// op parser uses, drift-guarded). Every malformed token is a USAGE error (exit 2): a bare `<recipe>`, an
+// unknown slot for the activity, an invalid recipe-for-slot, or a duplicate slot. (An override naming a
+// recipe whose backend merely is not `ready` is NOT a usage error — it degrades loudly at resolution
+// time, exit 0.) The grammar stays activity-SCOPED, unlike the writer's `--set <activity>.<slot>=<x>`.
 const parseOverrides = (tokens, activity) => {
   const overrides = {};
   for (const tok of tokens) {
     const eq = tok.indexOf('=');
-    if (eq <= 0) throw fail(2, `--override must be <slot>=<recipe> (got "${tok}")`);
+    if (eq <= 0) throw fail(2, `--override must be <slot>=<value> (got "${tok}")`);
     const slot = tok.slice(0, eq);
     const recipe = tok.slice(eq + 1);
     assertSlotRecipe(activity, slot, recipe); // shared validity (unknown slot / invalid recipe → exit 2)
@@ -91,7 +88,7 @@ const parseArgs = (argv) => {
       json = true;
     } else if (a === '--override') {
       const tok = argv[i + 1];
-      if (tok === undefined || tok.startsWith('--')) throw fail(2, '--override requires <slot>=<recipe>');
+      if (tok === undefined || tok.startsWith('--')) throw fail(2, '--override requires <slot>=<value>');
       overrideTokens.push(tok);
       i += 1;
     } else if (a.startsWith('--override=')) {
@@ -162,28 +159,36 @@ const resolveAllSlots = ({ activity, config, detection, overrides }) => {
     }
   })();
   const knobsFor = (cmd) => [...registry.values()].filter((k) => (k.appliesTo ?? []).includes(cmd));
-  return Object.keys(ACTIVITIES[activity].slots).map((slot) => {
+  return Object.entries(ACTIVITIES[activity].slots).map(([slot, slotType]) => {
     const resolved = resolveActivityRecipe({ config: config ?? {}, readiness: detection, activity, slot, override: overrides[slot] });
+    if (isSwitchSlot(slotType)) return { slot, slotType, ...resolved, backends: [], contracts: [], vehicles: [] };
     // The concrete wrapper set this slot's EFFECTIVE recipe dispatches (empty for solo). Reuse
     // planRecipe's drift-guarded dispatch for WHICH backends, then resolve each (backend, role) to its
-    // manifest wrapper cmd via the bridge registry — no wrapper name is hand-composed here.
+    // manifest wrapper cmd via the bridge registry — no wrapper name is hand-composed here. A vehicle
+    // step is NOT a bridge: it carries its own state and is never looked up in a manifest.
     const { dispatch } = planRecipe(resolved.recipe, detection);
-    const backends = dispatch.map((d) => wrapperCmdFor(d.backend, d.role)).filter(Boolean);
+    const vehicles = dispatch.filter((d) => d.vehicle != null).map((d) => ({ backend: d.backend, state: d.vehicle }));
+    const bridged = dispatch.filter((d) => d.vehicle == null);
+    const backends = bridged.map((d) => wrapperCmdFor(d.backend, d.role)).filter(Boolean);
     // The full DRIVING CONTRACT per dispatched (backend, role) — resolved HERE, on the raw dispatch
     // pairs, BEFORE they are flattened to wrapper names (the name array cannot reconstruct the role).
     // Every slot with a non-empty dispatch gets contracts — including execute=delegated; the contract
     // is NEVER gated by REVIEW_RECIPES (that set gates only the review-loop economics block).
-    const contracts = dispatch
+    const contracts = bridged
       .map((d) => ({ backend: d.backend, role: d.role, cmd: wrapperCmdFor(d.backend, d.role), contract: wrapperContractFor(d.backend, d.role) }))
       .filter((c) => c.cmd && c.contract)
       // `retired` rides along: without it this surface advertised a RETIRED key as an ordinary
       // settable knob, while the writer refuses to set it — a driving contract that contradicts the
       // tool it points at.
       .map((c) => ({ ...c, settings: knobsFor(c.cmd).map((k) => ({ key: k.key, allowed: allowedLabel(k), retired: k.retired ?? null })) }));
-    return { slot, ...resolved, backends, contracts };
+    return { slot, slotType, ...resolved, backends, contracts, vehicles };
   });
 };
 
+// The routine switch reads against the EFFECTIVE carrier: the resolved recipe of the activity's
+// carrier-typed slot (registry-driven — no slot name is spelled here), solo when it has none.
+const effectiveCarrier = (slots) => slots.find((s) => s.slotType === 'carrier')?.recipe ?? 'solo';
+
 // An unsatisfiable EXPLICIT override is the only "warning" (loud, flagged for the agent to relay). A
 // graceful config/default degradation is reported as a per-slot reason, not a warning.
 const collectWarnings = (slots) =>
@@ -410,12 +415,11 @@ const flowHalvesAdvice = (flow, probe) => {
 // plan is being written. Composed from the project's live declaration, never from constants here.
 // Each config state speaks as itself: ABSENT renders NOTHING (a project that declares no practice must
 // not be handed invented limits); AUTHORED and INCOMPLETE render the declared caps plus the honest
-// "nothing is recorded yet" line — both are pre-mint states, and treating INCOMPLETE as MINTED would
-// report a half record as the whole tree's debt; MINTED renders the recorded counts too.
+// "nothing is recorded yet" line (treating INCOMPLETE as MINTED would report a half record as the
+// whole tree's debt); MINTED renders the recorded counts too.
 // A config that cannot be read renders ONE loud line carrying the reader's own message and the render
-// still completes: the exit code for a broken source-size config belongs to the practice's own
-// checker (exit 2 there, and its declared gate reds the matrix on it), while THIS tool's exit
-// contract is about its own config and the engine.
+// still completes: the exit code for a broken source-size config belongs to the practice's own checker,
+// while THIS tool's exit contract is about its own config and the engine.
 
 export const DECLARED_PRACTICE_HEADER = `Declared source-size practice (${SOURCE_SIZE_CONFIG_REL}) — known BEFORE the code is written:`;
 
@@ -486,12 +490,21 @@ const formatHuman = ({ activity, section, slots, warnings, plans, autonomy, flow
   const lines = [
     section,
     '',
-    `resolved recipes for "${activity}" (read-only — the orchestrator runs the recipe via the bridge skills and owns any commit; a backend never commits):`,
+    `resolved recipes for "${activity}" (read-only — the orchestrator runs the recipe via the bridge skills or the executor vehicle and owns any commit; every other carrier never commits):`,
   ];
+  const carrier = effectiveCarrier(slots);
   for (const s of slots) {
     const arrow = s.degradedFrom ? ` (requested ${s.degradedFrom} → degraded)` : '';
-    lines.push(`  ${s.slot}: ${s.recipe} — ${SOURCE_LABEL[s.source]}${arrow}${backendSetLabel(s.backends)}`);
+    // A switch slot states what the flag DOES under the effective carrier; both keep the source suffix.
+    lines.push(isSwitchSlot(s.slotType)
+      ? `  ${parallelLine({ value: s.recipe, carrier })} — ${SOURCE_LABEL[s.source]}`
+      : `  ${s.slot}: ${s.recipe} — ${SOURCE_LABEL[s.source]}${arrow}${backendSetLabel(s.backends)}`);
     if (s.reason) lines.push(`      ↳ ${s.reason}`);
+    // The form replaces the one-line vehicle mention: a carrier never told how to carry is a name,
+    // not an instruction. Indented like the driving contracts beside it.
+    for (const v of s.vehicles ?? []) {
+      for (const line of dispatchForm({ activity, slot: s.slot, state: v.state })) lines.push(`      ${line}`);
+    }
     for (const c of s.contracts ?? []) lines.push(...contractLines(c));
   }
   if ((flowHalves ?? []).length) lines.push('', ...flowHalves);
@@ -544,16 +557,17 @@ const buildJson = ({ activity, section, slots, configSource, warnings, plans, au
 const HELP = `procedures — read-only activity-procedures advisor for the agent-workflow family.
 
 Usage:
-  node procedures.mjs <activity> [--override <slot>=<recipe>]... [--json]
+  node procedures.mjs <activity> [--override <slot>=<value>]... [--json]
 
 Activities: ${Object.keys(ACTIVITIES).join(', ')}
-Slots:      plan-authoring → review;  plan-execution → execute, review
-Recipes:    review accepts solo|reviewed|council;  execute accepts solo|delegated
+Slots:      ${Object.entries(ACTIVITIES).map(([a, d]) => `${a} → ${Object.keys(d.slots).join(', ')}`).join(';  ')}
+Accepted values: ${Object.entries(SLOT_RECIPES).map(([type, values]) => `${type} accepts ${values.join('|')}`).join(';  ')}
 
 Reads the activity's procedure steps LIVE from the installed agent-workflow-engine
 (references/procedures.md), resolves the effective recipe per slot from
-${CONFIG_REL} + the read-only backend detector, and prints both. A per-run
---override <slot>=<recipe> (repeatable) overrides the configured/default recipe for that slot.
+${CONFIG_REL} + the read-only backend detector plus the executor-vehicle survey, and prints
+both. A per-run
+--override <slot>=<value> (repeatable) overrides the configured/default recipe for that slot.
 Read-only: never writes, never commits, never runs a subscription CLI.
 
 Also prints the project's DECLARED source-size practice (${SOURCE_SIZE_CONFIG_REL}) when it declares
@@ -582,18 +596,17 @@ export const main = (argv, ctx = {}) => {
     const { activity, overrides, json } = parseArgs(argv);
     const { config, source: configSource } = loadConfig(cwd, readFile, lstat);
     const section = extractSection(readProceduresCanon(env, home), activity);
-    // Backend detection is a SECONDARY input — it only refines the recipe. A corrupt / unreadable backend
-    // must NOT fail activity resolution as a config/engine error (exit 1, outside the contract): treat all
-    // backends as not-ready (resolution floors at Solo) and surface the failure as a loud warning, exit 0.
+    // Readiness is a SECONDARY input — it only refines the recipe. A corrupt bridge must NOT fail
+    // activity resolution as a config/engine error: the detector-failure hook floors the bridge half
+    // at not-ready and warns (exit 0), while the surveyed executor vehicle survives untouched.
     const detectWarnings = [];
-    let detection = [];
-    try {
-      detection = detect();
-    } catch (err) {
-      detectWarnings.push(
-        `backend detection failed (${(err && err.message) || err}) — treating all backends as not ready; recipes needing a backend degrade to solo.`,
-      );
-    }
+    const detection = composeReadiness(cwd, {
+      detect,
+      surveyVehicle: ctx.surveyVehicle,
+      onDetectError: (err) => detectWarnings.push(
+        `backend detection failed (${(err && err.message) || err}) — treating every bridge as not ready; recipes needing a bridge degrade to solo (the executor vehicle is unaffected).`,
+      ),
+    });
     const slots = resolveAllSlots({ activity, config, detection, overrides });
     const warnings = [...detectWarnings, ...collectWarnings(slots)];
     const plans = plansInFlight(cwd);