@williambeto/ai-workflow 2.7.1 → 2.8.1

package/chunk-YOBY5C72.js

@@ -0,0 +1,76 @@
+// src/linting/skill-frontmatter-linter.ts
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+function parseFrontmatter(content) {
+  const match = content.match(/^---\n([\s\S]*?)\n---\n/);
+  if (!match) return {};
+  const lines = match[1].split("\n");
+  const data = {};
+  for (const line of lines) {
+    const colonIdx = line.indexOf(":");
+    if (colonIdx !== -1) {
+      const key = line.substring(0, colonIdx).trim();
+      const value = line.substring(colonIdx + 1).trim();
+      data[key] = value.replace(/^["'](.*)["']$/, "$1");
+    }
+  }
+  return data;
+}
+function lintSkillFile(filePath) {
+  const errors = [];
+  if (!fs.existsSync(filePath)) return errors;
+  const content = fs.readFileSync(filePath, "utf8");
+  const frontmatter = parseFrontmatter(content);
+  if (!frontmatter.name) {
+    errors.push({ filePath, message: "Missing or empty 'name' field in frontmatter" });
+  }
+  if (!frontmatter.description) {
+    errors.push({ filePath, message: "Missing or empty 'description' field in frontmatter" });
+  }
+  return errors;
+}
+function findSkillDirs(baseDir) {
+  if (!fs.existsSync(baseDir)) return [];
+  const entries = fs.readdirSync(baseDir, { withFileTypes: true });
+  return entries.filter((e) => e.isDirectory()).map((e) => path.join(baseDir, e.name));
+}
+function getDiscoverableSkillPaths(cwd) {
+  const pathsToSearch = [
+    path.join(cwd, ".agents/skills"),
+    path.join(cwd, ".ai-workflow/opencode/skills"),
+    // Installed by kit
+    path.join(cwd, "dist-assets/skills"),
+    // DevKit source
+    path.join(os.homedir(), ".gemini/config/skills"),
+    path.join(os.homedir(), ".gemini/antigravity-cli/builtin/skills")
+  ];
+  const skillFiles = [];
+  for (const basePath of pathsToSearch) {
+    const dirs = findSkillDirs(basePath);
+    for (const dir of dirs) {
+      const skillFile = path.join(dir, "SKILL.md");
+      if (fs.existsSync(skillFile)) {
+        skillFiles.push(skillFile);
+      }
+    }
+  }
+  return skillFiles;
+}
+function runLinter(cwd) {
+  const files = getDiscoverableSkillPaths(cwd);
+  const allErrors = [];
+  for (const file of files) {
+    const fileErrors = lintSkillFile(file);
+    allErrors.push(...fileErrors);
+  }
+  return { errors: allErrors, filesScanned: files.length };
+}
+
+export {
+  parseFrontmatter,
+  lintSkillFile,
+  getDiscoverableSkillPaths,
+  runLinter
+};
+//# sourceMappingURL=chunk-YOBY5C72.js.map

package/core/index.d.ts

@@ -1,11 +1,16 @@
+type DeliveryMode = "workspace" | "answer-only";
+
+type MutationOwner = "Astra" | "Phoenix" | "ControlPlane" | null;
 interface RequestUnderstanding {
     rawRequest: string;
     taskGoal: string;
     requestedActor?: string;
     invalidActor?: string;
     requestedCapability?: string;
+    capabilityRoles: string[];
     operationType: string;
     mutationIntent: "readonly" | "write" | "publish";
+    deliveryMode: DeliveryMode;
     riskLevel: "low" | "medium" | "high";
     requiredEvidence: string[];
     safetyConstraints: string[];
@@ -16,8 +21,11 @@ interface RequestUnderstanding {
 interface RoutingDecision {
     requestedActor?: string;
     selectedActor?: string;
+    mutationOwner: MutationOwner;
+    capabilityRoles: string[];
     operationType: string;
     mutationIntent: "readonly" | "write" | "publish";
+    deliveryMode: DeliveryMode;
     permissionDecision: "allowed" | "rerouted" | "blocked";
     reason: string;
     workflowPath: string[];
@@ -133,6 +141,8 @@ declare class EvidenceLedger {
     cwd: string;
     workflowId: string;
     events: LedgerEvent[];
+    private loadedPath;
+    private loadedContentHash;
     constructor({ cwd, workflowId }?: {
         cwd?: string;
         workflowId?: string;
@@ -154,6 +164,7 @@ declare class EvidenceLedger {
      * Saves the ledger events to a JSON file.
      */
     save(filePath: string): Promise<void>;
+    load(filePath: string): Promise<boolean>;
     verifyRoleConfinement(): Promise<RoleConfinementResult>;
 }
 
@@ -161,6 +172,7 @@ interface InspectResult {
     available: boolean;
     supports: {
         run: boolean;
+        server: boolean;
         formatJson: boolean;
         agent: boolean;
         model: boolean;
@@ -171,17 +183,29 @@ interface ExecuteOptions {
     model?: string | null;
     readOnly?: boolean;
     fastTrack?: boolean;
+    requireActorConfirmation?: boolean;
+    orchestratedChild?: boolean;
+}
+interface ObservedCommand {
+    command: string;
+    tool: string;
+    status: "PASS" | "FAIL" | "UNKNOWN";
+    exitCode: number | null;
+    source: "sdk" | "json-event" | "text-output";
 }
 interface ExecuteResult {
     success: boolean;
     status?: string;
     commandsRun: string[];
+    commandEvents?: ObservedCommand[];
     eventCount: number;
     error?: string;
     runtimeAgentRequested?: string | null;
     runtimeAgentApplied?: string | null;
     runtimeAgentSupported?: boolean;
     runtimeAgentSelectionMode?: string;
+    runtimeActorConfirmation?: "confirmed" | "unavailable";
+    output?: string;
 }
 /**
  * OpenCodeAdapter - Real runtime integration with the OpenCode CLI.
@@ -198,7 +222,7 @@ declare class OpenCodeAdapter {
     /**
      * Runs opencode with a prompt and options.
      */
-    execute(message: string, { agent, model, readOnly, fastTrack }?: ExecuteOptions): Promise<ExecuteResult>;
+    execute(message: string, { agent, model, readOnly, fastTrack, requireActorConfirmation, orchestratedChild }?: ExecuteOptions): Promise<ExecuteResult>;
 }
 
 interface DelegationControllerOptions {
@@ -206,6 +230,22 @@ interface DelegationControllerOptions {
     ledger?: EvidenceLedger;
     adapter?: OpenCodeAdapter;
 }
+interface PhaseArtifactResult {
+    artifactPath?: string;
+    artifactHash?: string;
+    [key: string]: unknown;
+}
+interface DelegationPhaseOptions {
+    phase: "specification" | "planning" | "implementation";
+    actor: "Nexus" | "Orion" | "Astra";
+    prompt: string;
+    readOnly: boolean;
+    requireExplicitActor?: boolean;
+    onOutput?: (output: string) => Promise<PhaseArtifactResult | void>;
+}
+interface DelegationPhaseResult extends ExecuteResult {
+    artifact?: PhaseArtifactResult;
+}
 /**
  * DelegationController - Manages and logs coordination between Atlas, Astra, Sage, and Phoenix.
  */
@@ -219,6 +259,11 @@ declare class DelegationController {
      * Logs routing decision by Atlas.
      */
     route(naturalRequest: string, classification: RequestClassifierResult): Promise<void>;
+    /**
+     * Executes one high-risk phase and fails closed unless the runtime confirms
+     * the requested actor through machine-readable output.
+     */
+    executePhase({ phase, actor, prompt, readOnly, requireExplicitActor, onOutput }: DelegationPhaseOptions): Promise<DelegationPhaseResult>;
     /**
      * Logs and executes the implementation process by Astra.
      */
@@ -323,6 +368,8 @@ declare class WorkspaceSnapshot {
     });
     isIgnored(relativePath: string): boolean;
     capture(): Promise<WorkspaceSnapshotData>;
+    listGitVisibleFiles(): string[] | null;
+    scanFiles(relativePaths: string[], filesMap: Record<string, SnapshotFile>): Promise<void>;
     scanDir(dir: string, filesMap: Record<string, SnapshotFile>): Promise<void>;
     calculateHash(snapshot: WorkspaceSnapshotData): string;
 }
@@ -426,11 +473,14 @@ interface SpecValidationResult {
     reason?: string;
     tier?: string;
 }
+type RequiredSpecStatus = "DRAFT" | "APPROVED";
 /**
  * SpecValidator - Enforces "No Spec, No Code" rule.
  * Validates existence, structure, and approval status of specifications.
  */
 declare class SpecValidator {
+    validateContent(content: string, requiredStatus?: RequiredSpecStatus): SpecValidationResult;
+    validateDraftContent(content: string): SpecValidationResult;
     /**
      * Validates a specification file.
      */

package/core/index.js

@@ -1,5 +1,4 @@
 import {
-  BranchGate,
   DelegationController,
   EvidenceLedger,
   ExecutionPlanner,
@@ -10,10 +9,13 @@ import {
   RequestClassifier,
   SpecValidator,
   WorkflowStateMachine
-} from "../chunk-W4RTQWVQ.js";
+} from "../chunk-4FI5ODAM.js";
 import {
   MergeGate
-} from "../chunk-XW747GIG.js";
+} from "../chunk-H7GIKXFO.js";
+import {
+  BranchGate
+} from "../chunk-AINIR25D.js";
 import "../chunk-5WRI5ZAA.js";
 export {
   BranchGate,

package/dist-assets/agents/atlas.md

@@ -23,7 +23,7 @@ Atlas must:
 * Enforce protected-branch safety before writes.
 * Route to specialists only when useful.
 * Require observed validation and prevent false success.
-* Return a concise delivery handoff.
+* Continue from routing through delivery, validation, and a concise handoff.
 
 ## Trusted context
 * Repository files
@@ -40,7 +40,11 @@ Atlas must:
 ## Constraints
 * **High-Risk Sequence Enforcement**: For high-risk tasks (specPolicy: required), Atlas must strictly enforce that the workflow runs sequentially through `discover`, `spec-create`, `spec-review`, and `plan` phases before any implementation or coding starts. Jumping directly to implementation is forbidden.
 * **Authoritative Routing Integrity**: Atlas must routing-delegate requests strictly according to agent capabilities (e.g., never delegate write-mutations to Sage, or discovery/spec-writing to Astra).
-* **Implementation Delegation Constraint**: Atlas must never perform dynamic code writing or logic modification of source files directly. Any code changes (excluding pure documentation, README updates, or spelling typos) must be delegated to Astra.
+* **Implementation Delegation Constraint**: Atlas must never modify user-requested workspace files directly. Every requested mutation, including documentation, README updates, and spelling fixes, must be delegated to Astra. Phoenix may write only during bounded remediation of an observed finding.
+* **Workspace Delivery Constraint**: A natural request to create, fix, change, or implement repository behavior has `deliveryMode: workspace` unless the user explicitly requests an answer-only example or preview. Printed code is never workspace delivery.
+* **Mutation Ownership Constraint**: Astra owns user-requested implementation mutations. Phoenix owns only bounded remediation of observed findings. Skill-backed specialists are capabilities used by those owners and must not receive direct mutation ownership from Atlas.
+* **Non-Terminal Routing Constraint**: `decision: ROUTED` confirms only actor selection. Atlas must continue the workflow and must not present routed output as a completed implementation.
+* **Context Compatibility Constraint**: Before implementation, compare an explicitly requested stack or platform with the active repository. Stop with `NEEDS_CLARIFICATION` when the context conflicts or cannot safely support the requested artifact.
 * **Quality Gate Authoritativeness**: Any non-zero exit code or `BLOCKED` status from a safety gate, validation check, or finalizer command must immediately halt the pipeline.
 * Never write on `main`, `master`, or another protected branch.
 * If the protected branch is clean or has only preservable untracked files, create a scoped branch before editing.
@@ -73,13 +77,16 @@ Atlas must:
 
 ## Operating procedure
 1. classify requests and select the lowest safe proportional policies.
-2. Delegate to specialist actors:
+2. For workspace delivery, run `git branch --show-current` and `git status --short`, then satisfy the branch gate before any edit.
+3. Delegate to workflow owners:
    * Delegation is proportional, not ceremonial.
-   * Use Astra for substantial implementation work.
+   * Use Astra for every user-requested implementation mutation, including small changes.
+   * Astra may use skill-backed specialists as bounded capabilities.
+   * Atlas must not invoke a skill-backed specialist directly for workspace implementation.
    * Use Sage for independent validation when high risk justifies it.
    * Use Phoenix only for concrete findings that need remediation.
    * Do not claim that an agent acted unless that handoff actually occurred.
-3. For low or medium risk tasks:
+4. For low or medium risk tasks:
    * Inspect status.
    * Recover branch if needed.
    * Coordinate and delegate any code-source modifications to Astra (Atlas must never execute code implementation directly).
@@ -92,7 +99,13 @@ Atlas must:
      * exit code `0` with `COMPLETED` or `COMPLETED_WITH_NOTES`: Atlas may report that exact public state;
      * non-zero exit code or `BLOCKED`: remediate within the configured bound or report `BLOCKED`;
      * Atlas must never infer, upgrade, or replace the finalizer result from screenshots, manual checks, build output, or its own judgement.
-4. For high-risk tasks requiring evidence (evidencePolicy: required), use the full workflow/orchestrator so persisted evidence and independent validation remain available.
+5. Resolve the delivery outcome after observed validation:
+   * `CHANGED` requires an actual scoped diff and passing proportional validation.
+   * `ALREADY_SATISFIED` requires explicit verification and must not manufacture a diff.
+   * `READ_ONLY_RESULT` and `PREVIEW_ONLY` must not claim workspace implementation.
+   * `NEEDS_CLARIFICATION` and `NOT_DELIVERED` are blocking outcomes.
+   * Record `testAction: reuse | extend | add | none` with a concrete reason; do not add prompt-specific tests solely to make a request pass.
+6. For high-risk tasks requiring evidence (evidencePolicy: required), use the full workflow/orchestrator so persisted evidence and independent validation remain available.
 
 ## Expected output schema
 Must include:
@@ -107,6 +120,12 @@ workflowPath
 reason
 requiredEvidence
 decision: ROUTED | BLOCKED | NEEDS_CLARIFICATION
+deliveryMode: workspace | answer-only
+mutationOwner: Astra | Phoenix | ControlPlane | null
+capabilityRoles
+deliveryOutcome: CHANGED | ALREADY_SATISFIED | READ_ONLY_RESULT | PREVIEW_ONLY | NEEDS_CLARIFICATION | NOT_DELIVERED
+testAction: reuse | extend | add | none
+testReason
 ```
 
 ## Evidence required

package/dist-assets/commands/atlas.md

@@ -27,6 +27,9 @@ Route user requests safely, proportionately, and securely according to the permi
 - Always route to the correct specialized agent or fail closed.
 - Do not execute code modifications directly.
 - Do not claim routing execution without ledger evidence.
+- Treat `ROUTED` as non-terminal; continue through implementation and validation.
+- Route workspace implementation to Astra, never directly to a skill-backed specialist.
+- Printed code is not a substitute for a requested repository change.
 
 ## Allowed tools
 - classify request
@@ -43,7 +46,8 @@ Route user requests safely, proportionately, and securely according to the permi
 2. Classify intent (write/readonly/publish) and risk level.
 3. Resolve target agent according to the permission matrix.
 4. Log the routing event to the ledger.
-5. Delegate execution to the resolved agent.
+5. Delegate workspace implementation to Astra; pass specialist capabilities as context only.
+6. Continue through proportional validation and resolve the delivery outcome.
 
 ## Safety gates
 - Enforce branch gate constraints.
@@ -58,7 +62,8 @@ Output must include:
 - Classification metrics
 - Target agent resolved
 - Safety constraints
-- Decision: ALLOWED | BLOCKED
+- Decision: ROUTED | BLOCKED | NEEDS_CLARIFICATION
+- Delivery outcome and test action
 
 ## Evidence required
 - routing ledger event log

package/dist-assets/docs/QUICKSTART.md

@@ -1,6 +1,10 @@
 # AI Workflow Kit quickstart
 
-To initialize your project, run `npx ai-workflow init --profile=standard` (default) or `npx ai-workflow init --profile=full` (adds examples). Then, give Atlas a natural software request. Atlas chooses the lowest safe proportional policies and the closest workflow profile.
+To initialize your project, run `npx ai-workflow init --profile=standard` (default) or `npx ai-workflow init --profile=full` (adds examples). For enforced workspace delivery, run `npx aw execute "your natural software request"` or use the OpenCode `/run` command. Atlas chooses the lowest safe proportional policies and the closest workflow profile.
+
+Selecting Atlas directly uses the same ownership contract: Atlas routes product
+mutations to Astra and may use specialists only as capabilities. The CLI path is
+the authoritative control plane for programmatic gates and persisted evidence.
 
 ## Proportional Policies
 
@@ -20,6 +24,11 @@ Write-capable work never runs on `main` or `master`. Existing relevant tests/bui
 - `COMPLETED_WITH_NOTES`
 - `BLOCKED`
 
+The structured delivery outcome distinguishes `CHANGED`,
+`ALREADY_SATISFIED`, `READ_ONLY_RESULT`, `PREVIEW_ONLY`,
+`NEEDS_CLARIFICATION`, and `NOT_DELIVERED`. A routing decision alone is never a
+completed implementation.
+
 Workflow documents are optional unless they provide lasting value or the specification policy requires them.
 
 ## Visual & Accessibility Evidence Requirements

package/dist-assets/docs/cli-reference.md

@@ -75,19 +75,21 @@ Runs formal orchestration for an approved specification with branch safety, obse
 
 **Synopsis:**
 ```bash
-ai-workflow run --spec-path=<path>
+ai-workflow run --spec-path=<path> [--approval-path=<path>]
 ```
 
 **Description:**
-Reads an approved specification file and orchestrates the full implementation workflow. Enforces branch gate safety, runs validation commands, applies bounded remediation (up to configured attempt limits), and generates a handoff summary.
+Reads an approved specification file and orchestrates the full implementation workflow. Enforces branch gate safety, runs validation commands, applies bounded remediation (up to configured attempt limits), and generates a handoff summary. DEEP specifications also require a hash-bound approval receipt created after human review.
 
 | Flag | Description |
 | --- | --- |
 | `--spec-path=<path>` | Path to the approved specification file (required) |
+| `--approval-path=<path>` | Path to the approval receipt required for DEEP specifications |
 
 **Example:**
 ```bash
 ai-workflow run --spec-path=.ai-workflow/specs/feature-auth.md
+ai-workflow run --spec-path=docs/workflows/auth/spec.md --approval-path=.ai-workflow/approvals/auth.json
 ```
 
 ---
@@ -196,6 +198,49 @@ ai-workflow clean --purge-agents  # Remove everything including .agents/
 
 ---
 
+## `ai-workflow skill create`
+
+Creates a workspace-local skill scaffold.
+
+**Synopsis:**
+```bash
+ai-workflow skill create <name> [--description=<description>] [--dry-run] [--force]
+```
+
+**Description:**
+Creates `.agents/skills/<name>/SKILL.md` with the required `name` and `description` YAML frontmatter. Skill names must use lowercase kebab-case. The command validates the destination before applying the branch gate and rejects paths or symbolic links detected outside the workspace.
+
+| Flag | Description |
+| --- | --- |
+| `--description=<description>` | Search-friendly description written to the YAML frontmatter |
+| `--dry-run` | Show the target and planned action without creating a branch or writing files |
+| `--force` | Back up and overwrite an existing `SKILL.md`; preserves auxiliary files |
+
+**Example:**
+```bash
+ai-workflow skill create database-migrations \
+  --description="Guidelines for safe database migrations"
+```
+
+The generated folder can also contain optional `scripts/`, `examples/`, and `references/` directories. Workspace-local skills are discovered automatically and take precedence over installed or global skills.
+
+The containment checks protect against unsafe paths present when the command runs. As with other local filesystem tools, they do not defend against another process concurrently replacing validated directories while the write is in progress.
+
+---
+
+## `ai-workflow lint skills`
+
+Checks the required YAML frontmatter of every discoverable `SKILL.md`.
+
+**Synopsis:**
+```bash
+ai-workflow lint skills
+```
+
+The command scans workspace-local, installed, development, and supported global skill locations. It exits with a non-zero status when a skill is missing a non-empty `name` or `description` field.
+
+---
+
 ## Public Statuses
 
 All workflow commands that produce delivery summaries use these statuses:

package/dist-assets/docs/compatibility/provider-usage.md

@@ -9,13 +9,21 @@ npx @williambeto/ai-workflow doctor
 
 Use `opencode.jsonc` and the generated OpenCode assets as the primary workflow interface.
 
+For CLI-enforced branch, delivery, validation, and evidence gates, use:
+
+```bash
+npx @williambeto/ai-workflow execute "<natural-language request>"
+```
+
+Direct Atlas sessions depend on the selected provider model following the installed agent contract. GPT-5.6 Sol is the validated direct-session model for this release. GPT-5.3 Codex Spark in medium mode is experimental because observed sessions delegated correctly but did not consistently produce a runnable, validated workspace delivery. The finalizer still blocks false success, but it cannot make an incompatible model complete the implementation.
+
 ## Codex
 
 ```bash
 npx @williambeto/ai-workflow init --yes --codex
 ```
 
-Review generated `.github/agents/`, `.agents/skills/`, and `.codex/prompts/`. Preserve the repository's existing `AGENTS.md`; do not assume Codex reproduces OpenCode delegation semantics.
+Review generated `AGENTS.md`, `CODEX.md`, `.codex/skills/`, `.codex/prompts/`, and `.codex/docs/policies/`. The root `AGENTS.md` provides the primary project-level instruction contract. The `ai-workflow doctor` command will automatically validate these assets.
 
 ## Claude Code
 
@@ -33,6 +41,13 @@ npx @williambeto/ai-workflow init --yes --antigravity
 
 Review `ANTIGRAVITY.md` and `.agents/`. Antigravity is supported and acts as the primary reference ecosystem for configuring and executing specialized agents and skills.
 
+### Activating the Personas in the Antigravity IDE
+
+To ensure the assistant assumes a specific persona (like **Atlas** for workflow routing) instead of acting as a generic assistant:
+
+* **IDE Agent Selector**: Click the Agent selector dropdown in the Antigravity IDE sidebar and select `Atlas` (configured via `.agents/agents/atlas/agent.json`).
+* **Slash Command Prefix**: Alternatively, start your chat prompt with the `/atlas` prefix to automatically load the orchestrator context.
+
 ## Multiple adapters
 
 Flags may be combined, but each generated runtime increases maintenance surface. Generate only the integrations the consumer project actually uses.

package/dist-assets/docs/compatibility/runtime-matrix.md

@@ -9,8 +9,8 @@
 
 | Runtime | Level | Generated integration | Current evidence | Known limitations |
 | --- | --- | --- | --- | --- |
-| OpenCode | Primary | `opencode.jsonc`, OpenCode agents, commands, and skills | init, doctor, package smoke, generated-file checks | Model may bypass canonical commands in direct conversation |
-| Codex | Supported with limitations | `.github/agents/`, `.agents/skills/`, `.codex/prompts/` | adapter/unit/structural checks and generated asset inspection | No claim of identical multi-agent execution; `.codex/` output is optional and only generated with `--codex` |
+| OpenCode | Primary | `opencode.jsonc`, OpenCode agents, commands, and skills | init, doctor, package smoke, generated-file checks, real GPT-5.6 Sol delivery | Direct-agent behavior depends on a validated model; use `ai-workflow execute` for CLI-enforced gates |
+| Codex | Supported | `AGENTS.md`, `CODEX.md`, `.codex/skills/`, `.codex/prompts/` | full `ai-workflow doctor` runtime validation, e2e smoke checks | `.codex/` output requires `--codex` flag |
 | Claude Code | Supported with limitations | `CLAUDE.md`, `.claude/rules/` | adapter/unit/structural checks and generated asset inspection | Rule loading and tool permissions depend on Claude Code configuration |
 | Antigravity | Supported | `ANTIGRAVITY.md`, `.agents/agents/`, `.agents/skills/`, `.agents/commands/` | unit tests, validation suite, and WSL/Desktop consumer validation | Agents are only listed under `/agents` when actively running (instantiated via `invoke_subagent`) |
 
@@ -18,6 +18,17 @@
 
 Compatibility levels must be based on evidence available in the release. Adapter code or generated files alone are not proof of full behavioral parity.
 
+## OpenCode model qualification
+
+OpenCode runtime compatibility does not imply that every provider model follows agent instructions with the same reliability.
+
+| Model and mode | Direct Atlas status | Observed behavior |
+| --- | --- | --- |
+| GPT-5.6 Sol | Supported | Completed branch gate, one Astra delegation, workspace implementation, proportional validation, browser inspection, and finalization |
+| GPT-5.3 Codex Spark, medium | Experimental | Delegated to Astra, but produced an incomplete scaffold, failed required validation, and repeated source code in the handoff; the finalizer correctly blocked false success |
+
+The canonical enforcement path is `ai-workflow execute`. Direct Atlas sessions are supported only for model configurations that pass the release smoke suite. Experimental models may inspect or generate partial work, but their direct-session behavior is not a supported delivery guarantee.
+
 ## Promotion requirements
 
 A runtime may be promoted only after a clean consumer test records:

package/dist-assets/docs/policies/06-FINAL_EVIDENCE_CONTRACT.md

@@ -18,7 +18,12 @@ A report written by an agent is not proof that a command ran. Command results mu
 
 ## Required evidence policy work
 
-Persisted evidence is appropriate when traceability has lasting value. The runtime may write a structured evidence file containing branch state, changed files, command exit codes, checks, limitations, and final status.
+Persisted evidence is appropriate when traceability has lasting value. The runtime may write a structured evidence file containing branch state, all currently changed files, the files changed by the current delivery, mutation owner, capability roles, delivery mode, delivery outcome, test action and reason, command exit codes, checks, limitations, and final status.
+
+`changedFiles` preserves the complete dirty-workspace view used by safety checks.
+`deliveryChangedFiles` is the delta observed from the current execution baseline
+and is the only file set used to attribute the delivery outcome and test action.
+Pre-existing dirty work must never be claimed as the current delivery.
 
 The model must not manually author successful command results.
 
@@ -29,3 +34,8 @@ The model must not manually author successful command results.
 - `BLOCKED`
 
 A failed required command, protected-branch violation, missing meaningful validation, or unresolved material finding cannot be promoted to success.
+
+`COMPLETED` does not imply a diff by itself. `CHANGED` requires an observed
+workspace change and proportional validation. `ALREADY_SATISFIED` requires
+explicit verification without an artificial change. Read-only and preview
+outcomes must not claim implementation.

package/dist-assets/docs/policies/SKILLS_COMMON_GOVERNANCE.md

@@ -4,6 +4,22 @@ This document defines the shared execution contracts, quality gates, and finaliz
 
 ---
 
+## Ownership boundary
+
+Skills and skill-backed specialist roles are capabilities, not autonomous
+mutation owners. Atlas routes workspace implementation to Astra. Phoenix owns
+only bounded remediation of observed findings. A specialist may provide analysis,
+candidate content, or validation guidance to the active owner, but it must not:
+
+- accept direct workspace-delivery ownership from Atlas;
+- edit repository files unless Astra or Phoenix explicitly delegated that
+  bounded capability inside an authorized branch;
+- replace a requested repository change with printed code;
+- claim terminal workflow completion.
+
+If the delegation does not identify the active mutation owner and delivery mode,
+return the missing context instead of assuming ownership.
+
 ## Behavioral contract core
 
 All executing agents and specialist roles must respect these rules:

package/dist-assets/schemas/README.md

@@ -39,6 +39,10 @@ For normal Markdown documents, use the schemas as a checklist. A document does n
 | `pr-breakdown.schema.json` | Pull request breakdown shape |
 | `handoff.schema.json` | Agent handoff shape |
 | `validation-report.schema.json` | Validation report shape |
+| `evidence.schema.json` | Observed delivery, validation, outcome, and test-action evidence |
+
+In evidence artifacts, `changedFiles` is the full dirty-workspace view and
+`deliveryChangedFiles` is the delta attributable to the current execution.
 
 ## Validation
 

package/dist-assets/schemas/approval-receipt.schema.json

@@ -0,0 +1,35 @@
+{
+  "$id": "https://github.com/williambeto/ai-workflow/schemas/approval-receipt.schema.json",
+  "title": "Human Approval Receipt",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "workflowId",
+    "approvedSpecHash",
+    "approvedBy",
+    "approvedAt",
+    "authorizationSource"
+  ],
+  "properties": {
+    "workflowId": {
+      "type": "string",
+      "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$"
+    },
+    "approvedSpecHash": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "approvedBy": {
+      "type": "string",
+      "minLength": 1
+    },
+    "approvedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "authorizationSource": {
+      "type": "string",
+      "minLength": 1
+    }
+  }
+}