@walwal-harness/cli 7.1.54 → 7.1.56

package/CHANGELOG.md

@@ -4,7 +4,7 @@ docmeta:
   title: walwal-harness CHANGELOG
   type: output
   createdAt: 2026-05-07T00:00:00Z
-  updatedAt: 2026-06-24T00:00:00Z
+  updatedAt: 2026-09-01T00:00:00Z
   source:
     producer: agent
     skillId: harness-release
@@ -31,6 +31,23 @@ docmeta:
 
 ## Unreleased
 
+## 7.1.56 — Close the lessons-gate bypass at the terminal transition (2026-09-01)
+- **Fix: the Hard Rule 20 gate could be bypassed by firing the completion transition.** Found by an A/B sandbox test of 7.1.54 vs 7.1.55 running identical fixtures. 7.1.55 put the gate in `harness-stop.sh` only, but `harness-company-complete.sh` sets `conductor.state=completed`, and `harness-stop.sh` short-circuits on that state at the top of the file — so a mission could complete having never recorded what it read, simply by running the transition. That is precisely the failure the gate was written to prevent. `harness-company-complete.sh` now runs `harness-lessons-gate.sh` itself and refuses the transition (non-zero exit, runtime left in `running`, refusal logged to `progress.log`) when the active mission's role documents lack `## Lessons Preflight` / `## Lessons Tally`.
+- Deadlock-safe by construction, verified against every legitimate stop path: the gate is scoped to the latest **active** mission, so the Stop-hook auto-complete backstop — which fires only when no mission is active — always passes; and `harness-company-block.sh` (external-authority BLOCKED) is deliberately **not** gated, since a mission blocked on a missing credential must still be able to stop.
+- Two escape hatches: `HARNESS_SKIP_LESSONS_GATE=1` for a single call, and `behavior.lessons_gate:false` for a project that has not adopted the sections.
+
+## 7.1.55 — Read before plan: lessons-before-planning ordering + Stop-hook gate (2026-09-01)
+- **Hard Rule 20 — Lessons precede planning.** `AGENTS.md` now carries an *ordering* rule, not another content artifact: before any source edit, any measurement, and before any brief is issued, every CXX and every hired worker reads `.harness/conventions/{shared,role}.md` + `.harness/gotchas/{shared,role}.md`, follows only the topic links those files name, and writes `## Lessons Preflight` (which items apply and why). Every `ceo.md`, `{cxx}.md`, and worker report closes with a one-line `## Lessons Tally` immediately above `## Implementation Notes`; **`0 fired` is valid and must be stated, not omitted** — a tally that only ever reports hits trains agents to manufacture them. The rule also states the propagation clause: a requirement placed on a CXX that its workers must also satisfy is inserted **verbatim** into the worker brief, because *a rule stated one layer above the layer that executes it does not apply*. Origin: a 24h autonomous run in which the company kept re-learning lessons it had already written down — index compliance was already perfect (40 gotchas, 0 orphans, all linked), and the knowledge still arrived after the mistake. **Deliberately not shipped: the distilled 28-item preflight file** that run also produced — a derived corpus must be re-synced whenever any source file changes, went factually stale within an hour, and would be a second thing nobody reads before planning.
+- **Hard Rule 21 — every worker spawn declares its model.** Never inherit the CLI default. The model is recorded in the brief, the Worker Evidence Manifest, and `progress.json company_state.workers[]`. A worker terminated by a usage limit is indistinguishable, from the outside, from a worker that finished, so **a silent or truncated worker is a rate limit until proven otherwise**. `scripts/harness-worker-dispatch.sh` now resolves an explicit model (`company_mode.worker_model` → `flow.team.{gen,eval}_model` → `opus`), passes `--model` on every `claude -p` spawn form, and records it in the queue, the dispatch record, and `progress.log`.
+- **Hard Rule 22 / `conventions/shared.md` — section-scoped readers do not filter by content.** Any reader scanning a role document or worker report matches `^>?\s*#{1,6}` and returns every hit — blockquoted or plain, at any depth, no content filter. Measured against real CXX documents, a verdict-token filter caught 3/11 blockquoted headings and a retraction-marker filter 4/11; their union still missed 4, including the *second line of a verdict* whose first line was caught. A filter that catches half a verdict is worse than one that catches none, because it reports success — and a reader anchored on `^#` returns a claim while never reaching its in-place retraction. `scripts/harness-worker-evidence-validate.sh` heading matching is fixed accordingly.
+- **Report skeletons are seeded at file creation, not assembled at the end.** Every CXX skill gained a `Worker Spawn Contract`: create the worker report **before** the worker starts with all required sections present (`## Status`, `## Task`, `## Evidence`, `## Result`, `## Lessons Tally`, and the stubbed terminal `## Implementation Notes`), and brief the worker to fill it in incrementally. `init` now installs the skeleton to `.harness/shared/templates/worker-report.md`. Evidence: same failure, opposite outcome — unseeded workers killed mid-round left stubs and halted the company twice; a seeded worker killed by the same rate limit left an intact report and cost nothing.
+- **CQO/OPS: an instrument declares what it cannot see.** New `Instrument Validity` sections require a positive control that fires **in the same run** and varies the exact variable under suspicion before any negative evidence is admissible (otherwise the verdict is BLOCKED, not PASS), and require dependency-supplied filtering to be **read from source and quoted** (package, version, file, line range) rather than inferred from observed output. Origin: every traffic audit in the source repo inherited an invisible `skip: res.statusCode < 400` from `live-server@1.2.2` at `logLevel === 2` — a rule with 0 references anywhere in the project's own code, so every "no stubbed 2xx was served" claim rested on a structurally null instrument.
+- **The Stop hook enforces it.** New `scripts/harness-lessons-gate.sh`, wired into `scripts/harness-stop.sh` alongside the existing worker-evidence guard: a turn cannot end while the latest active mission's role documents lack `## Lessons Preflight` or `## Lessons Tally`. Rules that live only in prose are followed when convenient; the Stop hook was the single most reliable actor in the source run, so the check goes where the enforcement already works. Scoped to `latest-active` so legacy/archive documents cannot block forever, and opt-out via `.harness/config.json` `behavior.lessons_gate:false`. `migrate` injects `behavior.lessons_gate` + `company_mode.worker_model` into existing configs.
+- New gotcha entries carrying the run's lessons: written-indexed-and-still-too-late, silent-worker-is-a-rate-limit, heading-readers-that-filter-by-content, rules-stated-one-layer-above (shared); negative-evidence-without-a-positive-control, null-instrument-supplied-by-a-dependency, audit-questions-that-offer-alternatives (cqo); stub-report-from-a-worker-killed-mid-round (cto); clean-log-from-an-unproven-instrument (ops).
+- **Fixed: every boolean config opt-out was inert.** `jq`'s `//` treats `false` as empty, so `.behavior.auto_chain_on_stop // true` returned `true` even when the project had explicitly set it to `false`. Setting `auto_chain_on_stop:false` (Stop-hook auto-chaining), `company_mode.write_on_signal:false` (legacy always-write hourly review), or `behavior.auto_route_ceo:false` (CEO routing guidance) silently did nothing. All four sites now test for `null` explicitly. Found while verifying the new `lessons_gate` opt-out, which had inherited the same shape.
+- Also shipping in this release (already on the working tree): unattended wake/dispatch agents pass `--dangerously-skip-permissions` (`--dangerously-bypass-approvals-and-sandbox` for Codex) so an hourly tick never blocks on a permission prompt nobody is there to answer, and `init` pre-accepts the workspace-trust gate plus `enableAllProjectMcpServers` in `~/.claude.json` (atomic write, one-time backup, non-fatal on failure) — the two gates a project-level `settings.json` and `--dangerously-skip-permissions` cannot clear on their own.
+- `/goal`, `/submission`, `/hot-fix` repeat the ordering rule at the Owner entrypoint. `/hot-fix` scales the read to the fix: a four-line patch pays the index files plus only the matching topic links, never the whole corpus — the ordering constraint holds at every size, the depth does not.
+
 ## 7.1.53 — Write-on-signal documents + `archive/` namespace reclaim (2026-06-24)
 - **`archive/` is now reserved for completed missions, never migrate/init backups.** Every backup snapshot moved out of `.harness/archive/` into a new `.harness/backups/` root: `bin/init.js` (migration snapshot dir, legacy-role migration, pre-harness doc extraction backup, AGENTS/CLAUDE doc backup), `init.sh refresh-ref`, `scripts/init-agents-md.sh`, and `scripts/init-ref-docs.sh`. The Owner expected `archive/` to hold a completed `goal + submission + hot-fix` per goal folder; the harness using it as a migrate backup dump conflicted with that meaning. Files are moved (not deleted), so recovery data is preserved. (Agreement: "archive/ 네임스페이스 탈환".)
 - `.harness/backups/` is added to the managed `.gitignore` block (`assets/templates/gitignore-append.txt`), and **`migrate` now refreshes the host `.gitignore` and best-effort untracks newly-ignored runtime paths** (previously only `init` did this), so migrating projects also stop committing backup/runtime noise.

package/HR-Resource/cdo/SKILL.md

@@ -13,6 +13,17 @@ Own design strategy for the mission.
 
 Before design work, read `.harness/conventions/shared.md`, `.harness/conventions/cdo.md`, `.harness/gotchas/shared.md`, and `.harness/gotchas/cdo.md`. Then follow only the related links in `cdo.md` files that match the mission topic. Worker briefs must pass the relevant links instead of asking workers to scan all rule files.
 
+### Lessons Before Plan
+
+That read happens **before** the first source edit, the first measurement, and the first worker brief — not alongside them, and not after. The corpus is rarely the problem; the ordering is. Then, in `cdo.md`, write:
+
+- `## Lessons Preflight` — which convention/gotcha items apply to this mission and why, named by id or heading. Written before any worker is dispatched. If the corpus genuinely has nothing for this topic, say so explicitly.
+- `## Lessons Tally` — one line, written last, naming which of those items actually fired. **`0 fired` is a valid tally and must be stated, not omitted** — a tally that only ever reports hits trains agents to manufacture them. Place it immediately before `## Implementation Notes`.
+
+**Propagate verbatim.** Any requirement this skill places on CDO that its workers must also satisfy — the linked corpus items, the browser-automation clause, the seeded report skeleton, the `## Lessons Tally` line, the `## Implementation Notes` block — is copied **word for word** into every worker brief. *A rule stated one layer above the layer that executes it does not apply,* and a worker cannot infer a rule it was never given.
+
+Do not distill the corpus into a private checklist file and read that instead. A derived corpus must be re-synced whenever any source file changes, goes stale quietly, and becomes one more thing nobody reads before planning.
+
 ## Workflow
 
 1. Read CEO and COO mission context.
@@ -29,7 +40,7 @@ Before design work, read `.harness/conventions/shared.md`, `.harness/conventions
 
 When CEO routes this mission to you, set yourself as the live agent on entry so the dashboard shows the handoff: `bash scripts/harness-progress-set.sh . '.current_agent="cdo" | .agent_status="running"'`.
 
-Before launching any fresh worker session, update `.harness/progress.json` with `scripts/harness-progress-set.sh` so dashboards can show the worker as active. Record the worker name, owning CXX, report path, and `status:"running"` under `company_state.workers`, increment `company_state.active_workers`, and set `conductor.current_action` to `spawn:{worker-name}`. After the worker report is accepted, update that worker to `status:"complete"` and decrement `active_workers`. Do not leave `active_workers:0` while a worker session is running. Require every worker report to open with a `## Status` line whose body is `IN_PROGRESS` while the worker runs and `COMPLETE` once the report is final, so the dashboard shows true worker liveness instead of guessing from file timestamps.
+Before launching any fresh worker session, update `.harness/progress.json` with `scripts/harness-progress-set.sh` so dashboards can show the worker as active. Record the worker name, owning CXX, report path, **the model the worker was spawned with**, and `status:"running"` under `company_state.workers`, increment `company_state.active_workers`, and set `conductor.current_action` to `spawn:{worker-name}`. After the worker report is accepted, update that worker to `status:"complete"` and decrement `active_workers`. Do not leave `active_workers:0` while a worker session is running. Require every worker report to open with a `## Status` line whose body is `IN_PROGRESS` while the worker runs and `COMPLETE` once the report is final, so the dashboard shows true worker liveness instead of guessing from file timestamps.
 
 On exit, after writing `cdo.md` and handing back to CEO, run `bash scripts/harness-progress-set.sh . '.agent_status="completed"'` so the loop advances and the dashboard reflects the finished step. Do not clear `conductor.state`; only the CEO's Company Loop Termination step ends the loop.
 
@@ -59,11 +70,23 @@ Owner is the final acceptance reviewer, not a design QA substitute. CDO must use
 
 Required output sections:
 
-1. Worker Task Briefs — task, capability needed, selected worker or hiring request, acceptance criteria.
-2. Worker Evidence Manifest — worker name, report path, status.
-3. CDO Decision — only decisions accepted from worker evidence.
-4. Preview Artifact — path `.harness/documents/{mission_name}/cdo/preview.html`, visual summary, and dashboard viewing note.
-5. Next Handoff — CTO-ready design constraints, inputs, blockers.
-6. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
+1. Lessons Preflight — convention/gotcha items that apply to this mission, why each applies, and the topic links passed into worker briefs. Written before the first worker is dispatched.
+2. Worker Task Briefs — task, capability needed, selected worker or hiring request, declared model, acceptance criteria.
+3. Worker Evidence Manifest — worker name, declared model, report path, status.
+4. CDO Decision — only decisions accepted from worker evidence.
+5. Preview Artifact — path `.harness/documents/{mission_name}/cdo/preview.html`, visual summary, and dashboard viewing note.
+6. Next Handoff — CTO-ready design constraints, inputs, blockers.
+7. Lessons Tally — one line naming which preflight items actually fired. `0 fired` is valid and must be stated.
+8. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
 
 Every CDO worker brief must require the worker to append the same English `## Implementation Notes` block to the bottom of `.harness/documents/{mission_name}/cdo/workers/{worker-name}.md`, covering risks, self-corrections, chosen direction, and unresolved questions. Use `None` for empty subsections.
+
+## Worker Spawn Contract
+
+Two things are decided **before** the round starts, not after a worker dies.
+
+**1. Declare the model.** Every worker spawn names its model explicitly — never inherit the CLI or session default. Record that model in the brief, in the Worker Evidence Manifest, and in `company_state.workers[]`. A worker terminated by a usage limit is indistinguishable, from the outside, from a worker that finished, so **a silent or truncated worker is a rate limit until proven otherwise**: check the limit and its reset time before re-briefing, re-hiring, or rewriting the task. Spreading a round across model families is only a decision you can make if the model was declared.
+
+**2. Seed the report.** Create `.harness/documents/{goal-or-child-mission}/cdo/workers/{worker-name}.md` **before the worker starts**, already carrying every required section — `## Status` (`IN_PROGRESS`), `## Task`, `## Evidence`, `## Result`, `## Lessons Tally`, and the terminal `## Implementation Notes` block with all four subsections stubbed. Copy `.harness/shared/templates/worker-report.md` when it is installed; otherwise write the skeleton by hand. Brief the worker to fill it in **incrementally as the work happens**, never to assemble the report at the end.
+
+A worker that dies mid-round — rate limit, crash, cancelled session — must leave a **valid partial report, never a stub**. Same failure, opposite outcome, one variable: unseeded workers killed mid-round left stubs and halted the company; a seeded worker killed by the same limit left its report intact and cost nothing. The variable was a decision taken before the round.

package/HR-Resource/ceo/SKILL.md

@@ -72,6 +72,16 @@ Before routing or accepting CXX work, enforce lazy loading:
 - Topic files such as `.harness/gotchas/i18n-locale-hotfix.md` remain separate. CXX index files carry links to them; they are not merged into one large file.
 - Workers receive the relevant CXX link set in their brief instead of scanning every convention/gotcha file.
 
+### Lessons Before Plan
+
+The read is an **ordering constraint**, not a reading list. It happens before the first source edit, the first measurement, and the first brief — not alongside them, and not after. A lesson that is written, indexed, and reachable still arrives too late if it is read after the mistake.
+
+- `ceo.md` opens with `## Lessons Preflight`: which convention/gotcha items apply to this mission and why. Write it before routing to the first CXX.
+- `ceo.md` closes with a one-line `## Lessons Tally` immediately before `## Implementation Notes`: which of those items actually fired. **`0 fired` is a valid tally and must be stated, not omitted.**
+- CEO requires the same two sections from every `{cxx}.md` and every worker report, and **rejects** any report that omits them.
+- **Propagate verbatim.** Any requirement CEO places on a CXX that its workers must also satisfy is copied word for word into the worker brief by that CXX. *A rule stated one layer above the layer that executes it does not apply.* CEO checks the worker briefs recorded in `{cxx}.md` for this, not just the CXX document.
+- **Do not commission a distilled preflight checklist.** A derived corpus must be re-synced whenever any source file changes, goes stale silently, and becomes a second thing nobody reads before planning. Fix the ordering, not the corpus.
+
 ## Mission Protocol
 
 1. Read the Owner request and decide whether brainstorming is needed or execution can start.
@@ -103,6 +113,9 @@ Before routing or accepting CXX work, enforce lazy loading:
 - CEO must not accept CQO PASS for a runnable product unless OPS has supplied clean verification-watch evidence or an explicit not-applicable reason. Open OPS incidents, missing runtime mapping, missing required logs, service down, or health mismatch block Owner acceptance.
 - After launch, CEO treats OPS production incidents as company events. CEO convenes CTO/CQO/OPS when user-impacting production signals appear; CTO owns recovery, CQO owns regression confirmation, and OPS owns evidence and close criteria.
 - Every CEO and CXX mission document must include an English `## Implementation Notes` section with the required subsections below. CEO must reject CXX reports that omit it.
+- Every CEO and CXX mission document and every worker report must carry `## Lessons Preflight` and a one-line `## Lessons Tally` (tally immediately before `## Implementation Notes`). `0 fired` is a valid tally; an omitted tally is not. CEO must reject reports that omit either section.
+- Every worker spawn declares its model explicitly — never the inherited CLI default. CEO requires the model in each CXX's Worker Task Briefs and Worker Evidence Manifest. **A silent or truncated worker is a rate limit until proven otherwise**: before treating a stalled round as a CXX failure, CEO asks for the usage-limit status and reset time, because a rate-limited worker looks exactly like a finished one from the outside.
+- Every worker report file is created **before the worker starts**, already carrying its required sections (seeded from `.harness/shared/templates/worker-report.md`). A worker killed mid-round must leave a valid partial report, never a stub. CEO treats a stub report as a seeding failure by the owning CXX, not as a worker failure.
 - Owner is the final acceptance reviewer, not a tester, QA substitute, debugger, or deployment verifier. CEO must not send "done, please check" reports while core functionality, regression, account setup, browser flows, logs, or runtime health remain unverified by workers.
 - Before requesting Owner acceptance, CEO must collect and summarize CXX-backed completion evidence: CTO implementation evidence, CQO evaluator/tester evidence, and OPS verification-watch/runtime evidence when runnable environments are involved. The final Owner report may request acceptance review or business/product judgment, but must not ask the Owner to discover whether the software works.
 
@@ -126,6 +139,13 @@ Every `ceo.md` and CXX document (`coo.md`, `cdo.md`, `cto.md`, `cqo.md`, `ops.md
 - ...
 ```
 
+Immediately above it, every document carries the one-line tally:
+
+```
+## Lessons Tally
+- Fired: <items from Lessons Preflight that actually changed a decision, or `0 fired`>
+```
+
 Use `None` when a subsection has no entries. These notes are mandatory even for small or emergency work. They must summarize how the role interpreted the Owner request, where the role intentionally diverged from the request, what alternatives were considered, and any true external-authority blocker. Do not list routine CEO-approved operations as "needs Owner confirmation."
 
 When briefing a CXX, CEO must explicitly require the CXX to append this section to its own `{cxx}.md` and to require every worker it manages to append the same section to the bottom of that worker's report.

package/HR-Resource/coo/SKILL.md

@@ -13,6 +13,17 @@ Own mission planning, research, references, hypotheses, and goal fit.
 
 Before planning, read `.harness/conventions/shared.md`, `.harness/conventions/coo.md`, `.harness/gotchas/shared.md`, and `.harness/gotchas/coo.md`. Then follow only the related links in `coo.md` files that match the mission topic. Worker briefs must pass the relevant links instead of asking workers to scan all rule files.
 
+### Lessons Before Plan
+
+That read happens **before** the first source edit, the first measurement, and the first worker brief — not alongside them, and not after. The corpus is rarely the problem; the ordering is. Then, in `coo.md`, write:
+
+- `## Lessons Preflight` — which convention/gotcha items apply to this mission and why, named by id or heading. Written before any worker is dispatched. If the corpus genuinely has nothing for this topic, say so explicitly.
+- `## Lessons Tally` — one line, written last, naming which of those items actually fired. **`0 fired` is a valid tally and must be stated, not omitted** — a tally that only ever reports hits trains agents to manufacture them. Place it immediately before `## Implementation Notes`.
+
+**Propagate verbatim.** Any requirement this skill places on COO that its workers must also satisfy — the linked corpus items, the browser-automation clause, the seeded report skeleton, the `## Lessons Tally` line, the `## Implementation Notes` block — is copied **word for word** into every worker brief. *A rule stated one layer above the layer that executes it does not apply,* and a worker cannot infer a rule it was never given.
+
+Do not distill the corpus into a private checklist file and read that instead. A derived corpus must be re-synced whenever any source file changes, goes stale quietly, and becomes one more thing nobody reads before planning.
+
 ## MCP Capability Scan
 
 During planning, COO must determine whether the active runtime exposes MCP servers, MCP tools, connector tools, or tool-discovery tools that can materially improve the mission. This is a planning input, not an implementation shortcut.
@@ -39,7 +50,7 @@ During planning, COO must determine whether the active runtime exposes MCP serve
 
 When CEO routes this mission to you, set yourself as the live agent on entry so the dashboard shows the handoff: `bash scripts/harness-progress-set.sh . '.current_agent="coo" | .agent_status="running"'`.
 
-Before launching any fresh worker session, update `.harness/progress.json` with `scripts/harness-progress-set.sh` so dashboards can show the worker as active. Record the worker name, owning CXX, report path, and `status:"running"` under `company_state.workers`, increment `company_state.active_workers`, and set `conductor.current_action` to `spawn:{worker-name}`. After the worker report is accepted, update that worker to `status:"complete"` and decrement `active_workers`. Do not leave `active_workers:0` while a worker session is running. Require every worker report to open with a `## Status` line whose body is `IN_PROGRESS` while the worker runs and `COMPLETE` once the report is final, so the dashboard shows true worker liveness instead of guessing from file timestamps.
+Before launching any fresh worker session, update `.harness/progress.json` with `scripts/harness-progress-set.sh` so dashboards can show the worker as active. Record the worker name, owning CXX, report path, **the model the worker was spawned with**, and `status:"running"` under `company_state.workers`, increment `company_state.active_workers`, and set `conductor.current_action` to `spawn:{worker-name}`. After the worker report is accepted, update that worker to `status:"complete"` and decrement `active_workers`. Do not leave `active_workers:0` while a worker session is running. Require every worker report to open with a `## Status` line whose body is `IN_PROGRESS` while the worker runs and `COMPLETE` once the report is final, so the dashboard shows true worker liveness instead of guessing from file timestamps.
 
 On exit, after writing `coo.md` and handing back to CEO, run `bash scripts/harness-progress-set.sh . '.agent_status="completed"'` so the loop advances and the dashboard reflects the finished step. Do not clear `conductor.state`; only the CEO's Company Loop Termination step ends the loop.
 
@@ -72,11 +83,23 @@ Return planning decisions, evidence, rejected options, mission fit, worker names
 
 Required output sections:
 
-1. Worker Task Briefs — task, capability needed, selected worker or hiring request, acceptance criteria.
-2. Worker Evidence Manifest — worker name, report path, status.
-3. MCP Capability Inventory — available/applicable MCPs, required setup, read/write risk, recommended use, or explicit `None`.
-4. COO Decision — only decisions accepted from worker evidence.
-5. Next Handoff — next CXX, inputs, blockers.
-6. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
+1. Lessons Preflight — convention/gotcha items that apply to this mission, why each applies, and the topic links passed into worker briefs. Written before the first worker is dispatched.
+2. Worker Task Briefs — task, capability needed, selected worker or hiring request, declared model, acceptance criteria.
+3. Worker Evidence Manifest — worker name, declared model, report path, status.
+4. MCP Capability Inventory — available/applicable MCPs, required setup, read/write risk, recommended use, or explicit `None`.
+5. COO Decision — only decisions accepted from worker evidence.
+6. Next Handoff — next CXX, inputs, blockers.
+7. Lessons Tally — one line naming which preflight items actually fired. `0 fired` is valid and must be stated.
+8. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
 
 Every COO worker brief must require the worker to append the same English `## Implementation Notes` block to the bottom of `.harness/documents/{mission_name}/coo/workers/{worker-name}.md`, covering risks, self-corrections, chosen direction, and unresolved questions. Use `None` for empty subsections.
+
+## Worker Spawn Contract
+
+Two things are decided **before** the round starts, not after a worker dies.
+
+**1. Declare the model.** Every worker spawn names its model explicitly — never inherit the CLI or session default. Record that model in the brief, in the Worker Evidence Manifest, and in `company_state.workers[]`. A worker terminated by a usage limit is indistinguishable, from the outside, from a worker that finished, so **a silent or truncated worker is a rate limit until proven otherwise**: check the limit and its reset time before re-briefing, re-hiring, or rewriting the task. Spreading a round across model families is only a decision you can make if the model was declared.
+
+**2. Seed the report.** Create `.harness/documents/{goal-or-child-mission}/coo/workers/{worker-name}.md` **before the worker starts**, already carrying every required section — `## Status` (`IN_PROGRESS`), `## Task`, `## Evidence`, `## Result`, `## Lessons Tally`, and the terminal `## Implementation Notes` block with all four subsections stubbed. Copy `.harness/shared/templates/worker-report.md` when it is installed; otherwise write the skeleton by hand. Brief the worker to fill it in **incrementally as the work happens**, never to assemble the report at the end.
+
+A worker that dies mid-round — rate limit, crash, cancelled session — must leave a **valid partial report, never a stub**. Same failure, opposite outcome, one variable: unseeded workers killed mid-round left stubs and halted the company; a seeded worker killed by the same limit left its report intact and cost nothing. The variable was a decision taken before the round.

package/HR-Resource/cqo/SKILL.md

@@ -13,6 +13,17 @@ Own quality, recurrence prevention, and archive eligibility.
 
 Before quality work, read `.harness/conventions/shared.md`, `.harness/conventions/cqo.md`, `.harness/gotchas/shared.md`, and `.harness/gotchas/cqo.md`. Then follow only the related links in `cqo.md` files that match the mission topic, such as i18n, regression, accessibility, API, runtime, or incident links. Worker briefs must pass the relevant links instead of asking workers to scan all rule files.
 
+### Lessons Before Plan
+
+That read happens **before** the first source edit, the first measurement, and the first worker brief — not alongside them, and not after. The corpus is rarely the problem; the ordering is. Then, in `cqo.md`, write:
+
+- `## Lessons Preflight` — which convention/gotcha items apply to this mission and why, named by id or heading. Written before any worker is dispatched. If the corpus genuinely has nothing for this topic, say so explicitly.
+- `## Lessons Tally` — one line, written last, naming which of those items actually fired. **`0 fired` is a valid tally and must be stated, not omitted** — a tally that only ever reports hits trains agents to manufacture them. Place it immediately before `## Implementation Notes`.
+
+**Propagate verbatim.** Any requirement this skill places on CQO that its workers must also satisfy — the linked corpus items, the browser-automation clause, the seeded report skeleton, the `## Lessons Tally` line, the `## Implementation Notes` block — is copied **word for word** into every worker brief. *A rule stated one layer above the layer that executes it does not apply,* and a worker cannot infer a rule it was never given.
+
+Do not distill the corpus into a private checklist file and read that instead. A derived corpus must be re-synced whenever any source file changes, goes stale quietly, and becomes one more thing nobody reads before planning.
+
 ## Workflow
 
 1. Read CEO and CTO mission context.
@@ -28,7 +39,7 @@ Before quality work, read `.harness/conventions/shared.md`, `.harness/convention
 
 When CEO routes this mission to you, set yourself as the live agent on entry so the dashboard shows the handoff: `bash scripts/harness-progress-set.sh . '.current_agent="cqo" | .agent_status="running"'`.
 
-Before launching any fresh worker session, update `.harness/progress.json` with `scripts/harness-progress-set.sh` so dashboards can show the worker as active. Record the worker name, owning CXX, report path, and `status:"running"` under `company_state.workers`, increment `company_state.active_workers`, and set `conductor.current_action` to `spawn:{worker-name}`. After the worker report is accepted, update that worker to `status:"complete"` and decrement `active_workers`. Do not leave `active_workers:0` while a worker session is running. Require every worker report to open with a `## Status` line whose body is `IN_PROGRESS` while the worker runs and `COMPLETE` once the report is final, so the dashboard shows true worker liveness instead of guessing from file timestamps.
+Before launching any fresh worker session, update `.harness/progress.json` with `scripts/harness-progress-set.sh` so dashboards can show the worker as active. Record the worker name, owning CXX, report path, **the model the worker was spawned with**, and `status:"running"` under `company_state.workers`, increment `company_state.active_workers`, and set `conductor.current_action` to `spawn:{worker-name}`. After the worker report is accepted, update that worker to `status:"complete"` and decrement `active_workers`. Do not leave `active_workers:0` while a worker session is running. Require every worker report to open with a `## Status` line whose body is `IN_PROGRESS` while the worker runs and `COMPLETE` once the report is final, so the dashboard shows true worker liveness instead of guessing from file timestamps.
 
 On exit, after writing `cqo.md` and handing back to CEO, run `bash scripts/harness-progress-set.sh . '.agent_status="completed"'` so the loop advances and the dashboard reflects the finished step. Do not clear `conductor.state`; only the CEO's Company Loop Termination step ends the loop.
 
@@ -53,6 +64,16 @@ If changed-scope tests or changed-scope coverage fail, CQO returns FAIL or BLOCK
 
 CQO must report any out-of-scope full-suite failure or coverage deficit to CEO and CTO with command output, affected paths, and the classification above. CQO must not expand the mission into broad unrelated test-writing work unless CEO explicitly routes that as a new task.
 
+## Instrument Validity
+
+Evidence about what did **not** happen is worth exactly as much as the instrument that looked for it.
+
+- **Negative evidence is inadmissible without a positive control that fires in the same run**, and the control must vary the exact variable under suspicion. "No error was logged", "no stubbed 2xx was served", "no leak was detected" are claims about the instrument until a control proves the instrument can see the thing at all. Require the control in the evaluator brief, not after the fact.
+- Report the control next to the result: what was injected, that it was observed, and the negative result from the same run. A verdict resting on unproven negative evidence is **BLOCKED**, not PASS.
+- **Where an instrument is supplied by a dependency rather than written in-repo, its filtering behaviour is read from source and quoted** — package, version, file, line range — not inferred from observed output. A filter that lives upstream is invisible to every in-repo search, so its absence from the project's own code is not evidence of its absence.
+- When an instrument turns out to have been structurally null, the claims it produced are identifiable **by their shape** — every claim of that form, not just the one that happened to be noticed. Re-open them as a class and say so in Recurrence Notes.
+- An audit question that offers alternatives asserts that the alternatives are exhaustive. "Is it A or B?" cannot return "neither, it is upstream". When an audit stalls, re-ask the question without the menu.
+
 ## Hard Rules
 
 CQO must not directly execute QA, visual review, security review, performance testing, or regression checks. CQO may only define gates, select evaluators, review evidence, decide archive eligibility, and document worker names and report paths.
@@ -76,12 +97,15 @@ If OPS reports an incident during verification:
 
 Required output sections in `cqo.md`:
 
-1. Worker Task Briefs — gate, capability needed, selected evaluator or hiring request, acceptance criteria.
-2. Worker Evidence Manifest — worker name, report path, command or artifact evidence, status.
-3. OPS Watch Evidence — ops report path, monitored runtime mapping, incidents/warnings, and whether runtime evidence permits PASS.
-4. CQO Verdict — PASS, FAIL, or BLOCKED based only on worker evidence plus required OPS watch evidence. Must reference Worker Evidence Manifest entries.
-5. Recurrence Notes — accepted gotchas, conventions, memories, or none.
-6. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
+1. Lessons Preflight — convention/gotcha items that apply to this mission, why each applies, and the topic links passed into evaluator briefs. Written before the first evaluator is dispatched.
+2. Worker Task Briefs — gate, capability needed, selected evaluator or hiring request, declared model, acceptance criteria.
+3. Worker Evidence Manifest — worker name, declared model, report path, command or artifact evidence, status.
+4. Instrument Validity — for every negative claim: the instrument, its log level and filter (quoted from source when the instrument comes from a dependency), and the positive control that fired in the same run. Negative evidence with no control is BLOCKED, not PASS.
+5. OPS Watch Evidence — ops report path, monitored runtime mapping, incidents/warnings, and whether runtime evidence permits PASS.
+6. CQO Verdict — PASS, FAIL, or BLOCKED based only on worker evidence plus required OPS watch evidence. Must reference Worker Evidence Manifest entries.
+7. Recurrence Notes — accepted gotchas, conventions, memories, or none.
+8. Lessons Tally — one line naming which preflight items actually fired. `0 fired` is valid and must be stated.
+9. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
 
 ## Worker Report Note Requirement
 
@@ -104,3 +128,13 @@ Every CQO evaluator/tester brief must require the worker to append this English
 ```
 
 The worker notes must cover risks, self-corrections, and chosen direction. Use `None` when a subsection has no entries. CQO must not accept evaluator output that omits this block.
+
+## Worker Spawn Contract
+
+Two things are decided **before** the round starts, not after a worker dies.
+
+**1. Declare the model.** Every worker spawn names its model explicitly — never inherit the CLI or session default. Record that model in the brief, in the Worker Evidence Manifest, and in `company_state.workers[]`. A worker terminated by a usage limit is indistinguishable, from the outside, from a worker that finished, so **a silent or truncated worker is a rate limit until proven otherwise**: check the limit and its reset time before re-briefing, re-hiring, or rewriting the task. Spreading a round across model families is only a decision you can make if the model was declared.
+
+**2. Seed the report.** Create `.harness/documents/{goal-or-child-mission}/cqo/workers/{worker-name}.md` **before the worker starts**, already carrying every required section — `## Status` (`IN_PROGRESS`), `## Task`, `## Evidence`, `## Result`, `## Lessons Tally`, and the terminal `## Implementation Notes` block with all four subsections stubbed. Copy `.harness/shared/templates/worker-report.md` when it is installed; otherwise write the skeleton by hand. Brief the worker to fill it in **incrementally as the work happens**, never to assemble the report at the end.
+
+A worker that dies mid-round — rate limit, crash, cancelled session — must leave a **valid partial report, never a stub**. Same failure, opposite outcome, one variable: unseeded workers killed mid-round left stubs and halted the company; a seeded worker killed by the same limit left its report intact and cost nothing. The variable was a decision taken before the round.

package/HR-Resource/cto/SKILL.md

@@ -13,6 +13,17 @@ Own engineering execution for the mission.
 
 Before engineering work, read `.harness/conventions/shared.md`, `.harness/conventions/cto.md`, `.harness/gotchas/shared.md`, and `.harness/gotchas/cto.md`. Then follow only the related links in `cto.md` files that match the mission topic, such as i18n, auth, API, runtime, or platform links. Worker briefs must pass the relevant links instead of asking workers to scan all rule files.
 
+### Lessons Before Plan
+
+That read happens **before** the first source edit, the first measurement, and the first worker brief — not alongside them, and not after. The corpus is rarely the problem; the ordering is. Then, in `cto.md`, write:
+
+- `## Lessons Preflight` — which convention/gotcha items apply to this mission and why, named by id or heading. Written before any worker is dispatched. If the corpus genuinely has nothing for this topic, say so explicitly.
+- `## Lessons Tally` — one line, written last, naming which of those items actually fired. **`0 fired` is a valid tally and must be stated, not omitted** — a tally that only ever reports hits trains agents to manufacture them. Place it immediately before `## Implementation Notes`.
+
+**Propagate verbatim.** Any requirement this skill places on CTO that its workers must also satisfy — the linked corpus items, the browser-automation clause, the seeded report skeleton, the `## Lessons Tally` line, the `## Implementation Notes` block — is copied **word for word** into every worker brief. *A rule stated one layer above the layer that executes it does not apply,* and a worker cannot infer a rule it was never given.
+
+Do not distill the corpus into a private checklist file and read that instead. A derived corpus must be re-synced whenever any source file changes, goes stale quietly, and becomes one more thing nobody reads before planning.
+
 ## Workflow
 
 1. Read CEO, COO, and CDO mission documents.
@@ -30,7 +41,7 @@ Before engineering work, read `.harness/conventions/shared.md`, `.harness/conven
 
 When CEO routes this mission to you, set yourself as the live agent on entry so the dashboard shows the handoff: `bash scripts/harness-progress-set.sh . '.current_agent="cto" | .agent_status="running"'`.
 
-Before launching any fresh worker session, update `.harness/progress.json` with `scripts/harness-progress-set.sh` so dashboards can show the worker as active. Record the worker name, owning CXX, report path, and `status:"running"` under `company_state.workers`, increment `company_state.active_workers`, and set `conductor.current_action` to `spawn:{worker-name}`. After the worker report is accepted, update that worker to `status:"complete"` and decrement `active_workers`. Do not leave `active_workers:0` while a worker session is running. Require every worker report to open with a `## Status` line whose body is `IN_PROGRESS` while the worker runs and `COMPLETE` once the report is final, so the dashboard shows true worker liveness instead of guessing from file timestamps.
+Before launching any fresh worker session, update `.harness/progress.json` with `scripts/harness-progress-set.sh` so dashboards can show the worker as active. Record the worker name, owning CXX, report path, **the model the worker was spawned with**, and `status:"running"` under `company_state.workers`, increment `company_state.active_workers`, and set `conductor.current_action` to `spawn:{worker-name}`. After the worker report is accepted, update that worker to `status:"complete"` and decrement `active_workers`. Do not leave `active_workers:0` while a worker session is running. Require every worker report to open with a `## Status` line whose body is `IN_PROGRESS` while the worker runs and `COMPLETE` once the report is final, so the dashboard shows true worker liveness instead of guessing from file timestamps.
 
 On exit, after writing `cto.md` and handing back to CEO, run `bash scripts/harness-progress-set.sh . '.agent_status="completed"'` so the loop advances and the dashboard reflects the finished step. Do not clear `conductor.state`; only the CEO's Company Loop Termination step ends the loop.
 
@@ -74,12 +85,14 @@ Every worker dispatched by CTO must be listed in the Worker Evidence Manifest se
 
 Required output sections in `cto.md`:
 
-1. Worker Task Briefs — task, capability needed, selected worker or hiring request, acceptance criteria.
-2. Port And Runtime Contract — `.env` and `.harness/config.json` values that workers must update or use.
-3. Worker Evidence Manifest — worker name, report path, changed files or artifact paths, status.
-4. CTO Decision — only decisions accepted from worker evidence.
-5. CQO Handoff — validation scope, commands, risk areas, blockers.
-6. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
+1. Lessons Preflight — convention/gotcha items that apply to this mission, why each applies, and the topic links passed into worker briefs. Written before the first worker is dispatched.
+2. Worker Task Briefs — task, capability needed, selected worker or hiring request, declared model, acceptance criteria.
+3. Port And Runtime Contract — `.env` and `.harness/config.json` values that workers must update or use.
+4. Worker Evidence Manifest — worker name, declared model, report path, changed files or artifact paths, status.
+5. CTO Decision — only decisions accepted from worker evidence.
+6. CQO Handoff — validation scope, commands, risk areas, blockers.
+7. Lessons Tally — one line naming which preflight items actually fired. `0 fired` is valid and must be stated.
+8. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
 
 ## Worker Report Note Requirement
 
@@ -102,3 +115,13 @@ Every CTO worker brief must require the worker to append this English block to t
 ```
 
 The worker notes must cover risks, self-corrections, and chosen direction. Use `None` when a subsection has no entries. CTO must not accept worker output that omits this block.
+
+## Worker Spawn Contract
+
+Two things are decided **before** the round starts, not after a worker dies.
+
+**1. Declare the model.** Every worker spawn names its model explicitly — never inherit the CLI or session default. Record that model in the brief, in the Worker Evidence Manifest, and in `company_state.workers[]`. A worker terminated by a usage limit is indistinguishable, from the outside, from a worker that finished, so **a silent or truncated worker is a rate limit until proven otherwise**: check the limit and its reset time before re-briefing, re-hiring, or rewriting the task. Spreading a round across model families is only a decision you can make if the model was declared.
+
+**2. Seed the report.** Create `.harness/documents/{goal-or-child-mission}/cto/workers/{worker-name}.md` **before the worker starts**, already carrying every required section — `## Status` (`IN_PROGRESS`), `## Task`, `## Evidence`, `## Result`, `## Lessons Tally`, and the terminal `## Implementation Notes` block with all four subsections stubbed. Copy `.harness/shared/templates/worker-report.md` when it is installed; otherwise write the skeleton by hand. Brief the worker to fill it in **incrementally as the work happens**, never to assemble the report at the end.
+
+A worker that dies mid-round — rate limit, crash, cancelled session — must leave a **valid partial report, never a stub**. Same failure, opposite outcome, one variable: unseeded workers killed mid-round left stubs and halted the company; a seeded worker killed by the same limit left its report intact and cost nothing. The variable was a decision taken before the round.

package/HR-Resource/hiring/SKILL.md

@@ -16,6 +16,7 @@ Hire workers from `.harness/shared/HR-Resource/`.
 - mission name
 - blocking status
 - owning CXX (`cto`, `cqo`, `coo`, `cdo`, or `ops`)
+- declared model for the spawn — explicit, never the inherited CLI default
 
 ## Workflow
 
@@ -26,12 +27,24 @@ Hire workers from `.harness/shared/HR-Resource/`.
 5. Update `.harness/shared/hr-roster.json` without deleting existing hired entries. Record `owner` as the owning CXX, `skillPath` as `.harness/shared/HR-Resource/{name}/SKILL.md`, and `skillPaths.claude` / `skillPaths.codex` as tool-specific hierarchical installed paths.
 6. The owning CXX must write worker reports under `.harness/documents/{mission}/{owning-cxx}/workers/{name}.md`. Do not write flat `.harness/documents/{mission}/workers/{name}.md` except when migrating legacy missions.
 7. Ask the `harness-resource-manager` skill to update trigger wording.
-8. Return worker name, owner, source skill path, installed paths, mission report path, invocation wording, related convention/gotcha links supplied by the owning CXX, and the mandatory report appendix below.
+8. Return worker name, owner, declared model, source skill path, installed paths, mission report path, invocation wording, related convention/gotcha links supplied by the owning CXX, and the mandatory report appendix below.
 
 ## Worker Rule Links
 
 Every hired worker receives the owning CXX's relevant convention/gotcha links in the worker brief. Workers read those linked topic files only when they match the assigned task.
 
+Requirements the owning CXX must satisfy and that its worker must also satisfy are copied into the brief **verbatim** — the browser-automation clause, the report skeleton, the `## Lessons Tally` line, the `## Implementation Notes` block. A rule stated one layer above the layer that executes it does not apply. Reject a hire request whose brief omits them.
+
+## Declared Model
+
+A hire request with no model is incomplete. Record the declared model in `hr-roster.json` alongside `owner` and the skill paths, and return it to the owning CXX for the Worker Evidence Manifest.
+
+A worker terminated by a usage limit is indistinguishable, from the outside, from a worker that finished. When a CXX comes back asking to re-hire a worker whose round went silent, ask for the usage-limit status first: **a silent loop is a rate limit until proven otherwise**, and re-hiring on the same exhausted model family repeats the failure.
+
+## Seeded Report
+
+The owning CXX creates `.harness/documents/{mission}/{owning-cxx}/workers/{name}.md` **before the worker starts**, seeded from `.harness/shared/templates/worker-report.md` with every required section already present, and briefs the worker to fill it in incrementally. A worker killed mid-round must leave a valid partial report, never a stub. Do not report a hire as complete while the report file has not been seeded.
+
 ## Mandatory Worker Report Appendix
 
 Every hired worker must append this English section to the bottom of its existing report:

package/HR-Resource/ops/SKILL.md

@@ -22,6 +22,17 @@ OPS owns three environment classes:
 OPS is not the implementation owner. CTO/DevOps workers start or change systems; OPS observes whether the declared build/service environments are healthy and raises evidence-backed events.
 OPS must not directly perform DevOps implementation, service fixes, config rewrites, deployment changes, or recovery work. OPS may only monitor, classify, brief hired Ops/DevOps workers, review their reports, and escalate evidence-backed events.
 
+### Lessons Before Plan
+
+That read happens **before** the first source edit, the first measurement, and the first worker brief — not alongside them, and not after. The corpus is rarely the problem; the ordering is. Then, in `ops.md`, write:
+
+- `## Lessons Preflight` — which convention/gotcha items apply to this mission and why, named by id or heading. Written before any worker is dispatched. If the corpus genuinely has nothing for this topic, say so explicitly.
+- `## Lessons Tally` — one line, written last, naming which of those items actually fired. **`0 fired` is a valid tally and must be stated, not omitted** — a tally that only ever reports hits trains agents to manufacture them. Place it immediately before `## Implementation Notes`.
+
+**Propagate verbatim.** Any requirement this skill places on OPS that its workers must also satisfy — the linked corpus items, the browser-automation clause, the seeded report skeleton, the `## Lessons Tally` line, the `## Implementation Notes` block — is copied **word for word** into every worker brief. *A rule stated one layer above the layer that executes it does not apply,* and a worker cannot infer a rule it was never given.
+
+Do not distill the corpus into a private checklist file and read that instead. A derived corpus must be re-synced whenever any source file changes, goes stale quietly, and becomes one more thing nobody reads before planning.
+
 ## CEO-Approved Operations
 
 OPS must not ask the Owner to approve routine monitoring operations. OPS proposes a default to CEO, and CEO decides.
@@ -68,6 +79,14 @@ After service launch, OPS continues the same monitoring duty against `runtime.pr
 - Repeated incidents must trigger recovery coordination through CEO -> CTO/CQO/OPS. OPS supplies evidence and recovery criteria; CTO owns fixes; CQO owns regression confirmation.
 - OPS may classify resolved events as close candidates only after the monitored endpoint is healthy and logs no longer show the triggering error pattern.
 
+## Instrument Validity
+
+OPS supplies most of the harness's negative evidence — "no crash", "no error in the log", "health stayed green" — so OPS owns proving the instrument could have seen the failure.
+
+- Every claim of the form "nothing bad happened" ships with a **positive control that fired in the same run** and varied the exact variable under suspicion. Without one, report the observation as unverified, not clean.
+- **Read dependency-supplied filtering from source and quote it** — package, version, file, line range — instead of inferring it from what appeared in the log. Log middleware, dev servers, proxies, and test runners routinely drop successful or sub-threshold requests at a log level nobody chose deliberately, and that rule appears nowhere in the project's own code.
+- Record the instrument in Environment Evidence: what tool observed the runtime, at what log level, with what filter, and what the control was. An unrecorded instrument makes every negative result from that run unusable.
+
 ## Port Policy
 
 - CEO/CTO/OPS must choose an available `{xx}000` base port before CXX services are allocated, unless the Owner already specified one.
@@ -94,7 +113,7 @@ After service launch, OPS continues the same monitoring duty against `runtime.pr
 
 When CEO routes this mission to you, set yourself as the live agent on entry so the dashboard shows the handoff: `bash scripts/harness-progress-set.sh . '.current_agent="ops" | .agent_status="running"'`.
 
-Before launching any fresh worker session, update `.harness/progress.json` with `scripts/harness-progress-set.sh` so dashboards can show the worker as active. Record the worker name, owning CXX, report path, and `status:"running"` under `company_state.workers`, increment `company_state.active_workers`, and set `conductor.current_action` to `spawn:{worker-name}`. After the worker report is accepted, update that worker to `status:"complete"` and decrement `active_workers`. Do not leave `active_workers:0` while a worker session is running. Require every worker report to open with a `## Status` line whose body is `IN_PROGRESS` while the worker runs and `COMPLETE` once the report is final, so the dashboard shows true worker liveness instead of guessing from file timestamps.
+Before launching any fresh worker session, update `.harness/progress.json` with `scripts/harness-progress-set.sh` so dashboards can show the worker as active. Record the worker name, owning CXX, report path, **the model the worker was spawned with**, and `status:"running"` under `company_state.workers`, increment `company_state.active_workers`, and set `conductor.current_action` to `spawn:{worker-name}`. After the worker report is accepted, update that worker to `status:"complete"` and decrement `active_workers`. Do not leave `active_workers:0` while a worker session is running. Require every worker report to open with a `## Status` line whose body is `IN_PROGRESS` while the worker runs and `COMPLETE` once the report is final, so the dashboard shows true worker liveness instead of guessing from file timestamps.
 
 On exit, after writing `ops.md` and handing back to CEO, run `bash scripts/harness-progress-set.sh . '.agent_status="completed"'` so the loop advances and the dashboard reflects the finished step. Do not clear `conductor.state`; only the CEO's Company Loop Termination step ends the loop.
 
@@ -112,12 +131,24 @@ OPS must not accept worker plans or reports that omit this requirement when brow
 
 ## Required Output Sections
 
-1. Worker Task Briefs — monitoring/recovery task, capability needed, selected worker or hiring request, acceptance criteria.
-2. Environment Evidence — config path, command/service checked, observed status.
-3. Worker Evidence Manifest — worker name, report path, status for delegated monitoring or recovery tasks.
-4. OPS Event Decision — good-case silence, warning, incident, or emergency escalation.
-5. CQO Verification Watch — whether CQO testing was monitored, runtime mapping used, open incidents, and PASS/BLOCKED implication.
-6. Post-Launch Watch — production services monitored, open incidents, recovery status, or not applicable.
-7. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
+1. Lessons Preflight — convention/gotcha items that apply to this mission, why each applies, and the topic links passed into worker briefs. Written before the first worker is dispatched.
+2. Worker Task Briefs — monitoring/recovery task, capability needed, selected worker or hiring request, declared model, acceptance criteria.
+3. Environment Evidence — config path, command/service checked, observed status, **and the instrument**: what tool observed it, at what log level, with what filter, and the positive control that fired in the same run.
+4. Worker Evidence Manifest — worker name, declared model, report path, status for delegated monitoring or recovery tasks.
+5. OPS Event Decision — good-case silence, warning, incident, or emergency escalation.
+6. CQO Verification Watch — whether CQO testing was monitored, runtime mapping used, open incidents, and PASS/BLOCKED implication.
+7. Post-Launch Watch — production services monitored, open incidents, recovery status, or not applicable.
+8. Lessons Tally — one line naming which preflight items actually fired. `0 fired` is valid and must be stated.
+9. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
 
 Every OPS worker brief must require the worker to append the same English `## Implementation Notes` block to the bottom of `.harness/documents/{mission_name}/ops/workers/{worker-name}.md`, covering risks, self-corrections, chosen direction, and unresolved questions. Use `None` for empty subsections.
+
+## Worker Spawn Contract
+
+Two things are decided **before** the round starts, not after a worker dies.
+
+**1. Declare the model.** Every worker spawn names its model explicitly — never inherit the CLI or session default. Record that model in the brief, in the Worker Evidence Manifest, and in `company_state.workers[]`. A worker terminated by a usage limit is indistinguishable, from the outside, from a worker that finished, so **a silent or truncated worker is a rate limit until proven otherwise**: check the limit and its reset time before re-briefing, re-hiring, or rewriting the task. Spreading a round across model families is only a decision you can make if the model was declared.
+
+**2. Seed the report.** Create `.harness/documents/{goal-or-child-mission}/ops/workers/{worker-name}.md` **before the worker starts**, already carrying every required section — `## Status` (`IN_PROGRESS`), `## Task`, `## Evidence`, `## Result`, `## Lessons Tally`, and the terminal `## Implementation Notes` block with all four subsections stubbed. Copy `.harness/shared/templates/worker-report.md` when it is installed; otherwise write the skeleton by hand. Brief the worker to fill it in **incrementally as the work happens**, never to assemble the report at the end.
+
+A worker that dies mid-round — rate limit, crash, cancelled session — must leave a **valid partial report, never a stub**. Same failure, opposite outcome, one variable: unseeded workers killed mid-round left stubs and halted the company; a seeded worker killed by the same limit left its report intact and cost nothing. The variable was a decision taken before the round.