create-harness-vibe-coding 0.8.19 → 0.9.3

package/src/wf-ui-server/__tests__/workflow-agent-context.test.mjs

@@ -0,0 +1,323 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { makeHarnessTempRoot } from '../../../tests/support/temp-root.js';
+import {
+  buildAgentContext,
+  buildAgentSnapshot,
+  buildConnections,
+  buildConnectedAgentRefs,
+  buildConnectedCapabilityRefs,
+  buildConnectedEventRefs,
+  buildConnectedGoalRefs,
+  buildConnectedResourceRefs,
+  effectiveSkillGroupsFor,
+  findAgentGraphNode,
+  outputRoutingFor,
+  skillTriggersFor,
+} from '../workflow-agent-context.mjs';
+import { buildWorkflowSnapshot, loadWorkflowGraphMap, writeWorkflowGraphMap } from '../a2a-store.mjs';
+import { SessionRegistry } from '../session-registry.mjs';
+import * as runtime from '../workflow-node-runtime.mjs';
+
+// W40-C1-CONTEXT-UNIFY golden test: the API path (/api/workflow/context/:id via
+// buildAgentContext) and the snapshot path (/api/a2a/snapshot per-node context
+// via buildWorkflowSnapshot -> buildSessionGraph) MUST produce the same Agent
+// context shape and values. The snapshot path may only add the session-
+// enumeration extras (agentKind, parentAgentId, connectedPeerIds,
+// outboundPeerIds, inboundPeerIds).
+const SNAPSHOT_ONLY_KEYS = ['agentKind', 'connectedPeerIds', 'inboundPeerIds', 'outboundPeerIds', 'parentAgentId'];
+
+const DRIFT_FIELDS = [
+  'defaultSkills',
+  'defaultCapabilityRefs',
+  'ontology',
+  'affordances',
+  'availableActions',
+  'magneticTopology',
+  'outputRouting',
+  'directMagneticNeighbors',
+  'magneticReachableNodes',
+  'magneticGroupId',
+  'identity',
+  'workspace',
+  'connectedPeers',
+  'connectedAgentRefs',
+  'skillTriggers',
+  'availableOnDemandCapabilityRefs',
+  'graphVersion',
+];
+
+function makeProject() {
+  const projectRoot = makeHarnessTempRoot('wf-agent-context-');
+  const taskRoot = path.join(projectRoot, 'Harness', 'tasks', 'task-context-unify');
+  fs.mkdirSync(taskRoot, { recursive: true });
+  fs.writeFileSync(path.join(projectRoot, 'Harness', 'PROGRESS.md'), '## Active Task\n\n- task-context-unify\n');
+  fs.writeFileSync(path.join(taskRoot, 'STATE.json'), JSON.stringify({
+    schemaVersion: 1,
+    taskId: 'task-context-unify',
+    status: 'active',
+    mode: 'wf',
+    phase: 'implementation',
+    gate: 'AC-GATE',
+    links: { dependsOn: [], blocks: [] },
+    acceptance: [{ id: 'AC-CONTEXT', text: 'unified context', status: 'pending' }],
+  }, null, 2));
+  fs.writeFileSync(path.join(taskRoot, 'PLAN.md'), '# Plan\n');
+  fs.writeFileSync(path.join(taskRoot, 'PROGRESS.md'), '# Progress\n');
+  return projectRoot;
+}
+
+async function seedGraphFixture(root) {
+  // One agent, one timer (event + control edges), one markdown resource,
+  // one goal, one capability (skill-group), one capsule dock (magnetic group).
+  const agentNodeId = 'session-context-unify';
+  const registry = new SessionRegistry();
+  const session = registry.create({
+    runtime: 'codex',
+    agentKind: 'main',
+    role: 'Main Agent',
+    graphNodeId: agentNodeId,
+  });
+  const sessionId = session.sessionId;
+  registry.update(sessionId, { status: 'running' });
+  const subagent = registry.create({
+    runtime: 'claude',
+    agentKind: 'subagent',
+    role: 'Subagent',
+    parentAgentId: sessionId,
+    graphNodeId: 'session-context-sub',
+  });
+  const subSessionId = subagent.sessionId;
+  registry.update(subSessionId, { status: 'running' });
+
+  const markdown = await runtime.createNode(root, { type: 'markdown', title: 'Agent Notes', markdown: '# Notes' });
+  const timer = await runtime.createNode(root, {
+    type: 'timer',
+    title: 'Heartbeat Timer',
+    schedule: { mode: 'loop', intervalSeconds: 30 },
+  });
+  const pack = await runtime.createNode(root, {
+    type: 'skill-group',
+    title: 'Agent Skill Pack',
+    sourceGroup: { id: 'source:workflow', label: 'Workflow', kind: 'source' },
+    skills: [
+      { id: 'skill:wf-ui', name: 'wf-ui', title: 'WF-UI Adapter', source: 'project' },
+      { id: 'skill:browser-lab', name: 'browser-lab', title: 'Browser Lab', source: 'project' },
+    ],
+  });
+  const goalNodeId = 'goal-task-context-unify';
+
+  writeWorkflowGraphMap(root, {
+    schemaVersion: 1,
+    version: 7,
+    nodes: [{
+      nodeId: agentNodeId,
+      sessionId,
+      kind: 'terminal-session',
+      agentKind: 'main',
+      runtime: 'codex',
+      status: 'running',
+      role: 'Main Agent',
+      label: 'Main Agent',
+      cwd: root,
+      taskId: null,
+    }],
+    edges: [
+      { id: 'edge-agent-timer', from: agentNodeId, to: timer.node.nodeId, relation: 'event', direction: 'source-to-target', sourceHandle: 'context', targetHandle: 'event' },
+      { id: 'edge-agent-timer-control', from: agentNodeId, to: timer.node.nodeId, relation: 'control', direction: 'source-to-target', sourceHandle: 'context', targetHandle: 'config' },
+      { id: 'edge-agent-markdown', from: agentNodeId, to: markdown.node.nodeId, relation: 'default-output', direction: 'bidirectional', sourceHandle: 'output', targetHandle: 'markdown' },
+      { id: 'edge-agent-goal', from: agentNodeId, to: goalNodeId, relation: 'goal', direction: 'bidirectional', sourceHandle: 'context', targetHandle: 'goal' },
+      { id: 'edge-agent-pack', from: agentNodeId, to: pack.node.nodeId, relation: 'capability', direction: 'bidirectional', sourceHandle: 'right', targetHandle: 'capability:left' },
+    ],
+    capsuleDockLinks: [{
+      id: 'dock-context',
+      nodeIds: [agentNodeId, markdown.node.nodeId],
+      anchorId: agentNodeId,
+      draggedId: markdown.node.nodeId,
+      connections: [
+        { id: 'dock-context-1', from: agentNodeId, to: markdown.node.nodeId, relation: 'wf-bridge', direction: 'bidirectional' },
+      ],
+    }],
+    positions: {
+      [agentNodeId]: { x: 100, y: 100 },
+    },
+  });
+  return { registry, sessionId, subSessionId, agentNodeId, markdown: markdown.node.nodeId, timer: timer.node.nodeId, pack: pack.node.nodeId, goalNodeId };
+}
+
+function assertRefsCarryW38e(refs, label) {
+  assert.ok(Array.isArray(refs), `${label} must be an array`);
+  for (const ref of refs) {
+    assert.equal(typeof ref.nodeId, 'string', `${label} ref nodeId`);
+    assert.equal(typeof ref.title, 'string', `${label} ref title (${ref.nodeId})`);
+    assert.equal(typeof ref.shortId, 'string', `${label} ref shortId (${ref.nodeId})`);
+    assert.ok(ref.shortId.length > 0, `${label} ref shortId non-empty (${ref.nodeId})`);
+    assert.equal(typeof ref.displayName, 'string', `${label} ref displayName (${ref.nodeId})`);
+    assert.ok(ref.displayName.length > 0, `${label} ref displayName non-empty (${ref.nodeId})`);
+  }
+}
+
+test('API path and snapshot path produce identical Agent context fields and values', async () => {
+  const root = makeProject();
+  try {
+    const fixture = await seedGraphFixture(root);
+    const graph = loadWorkflowGraphMap(root);
+    const graphNode = findAgentGraphNode(graph, fixture.agentNodeId);
+    assert.ok(graphNode, 'agent node must be present in the workflow graph');
+
+    const api = buildAgentContext(root, graphNode, graph);
+    assert.equal(api.ok, true);
+    assert.equal(api.node.kind, 'agent');
+    const apiContext = api.context;
+
+    const workflow = buildWorkflowSnapshot(root, fixture.registry);
+    const snapContext = workflow.graphContextBySessionId[fixture.sessionId];
+    assert.ok(snapContext, 'snapshot must expose per-session graph context');
+
+    // 1. Field parity: every API field exists in the snapshot path...
+    const apiKeys = Object.keys(apiContext);
+    const snapKeys = Object.keys(snapContext);
+    for (const key of apiKeys) {
+      assert.ok(Object.hasOwn(snapContext, key), `snapshot context is missing API field: ${key}`);
+    }
+    // ...and the snapshot path only adds its session-enumeration extras.
+    const extras = snapKeys.filter(key => !apiKeys.includes(key)).sort();
+    assert.deepEqual(extras, SNAPSHOT_ONLY_KEYS, `snapshot extras leaked: ${extras.join(',')}`);
+
+    // 2. Value parity: every shared field has identical values.
+    for (const key of apiKeys) {
+      assert.deepEqual(apiContext[key], snapContext[key], `value drift on context field: ${key}`);
+    }
+
+    // 3. The W39 drift fields are present in BOTH paths.
+    for (const key of DRIFT_FIELDS) {
+      assert.ok(Object.hasOwn(apiContext, key), `API context missing drift field: ${key}`);
+      assert.ok(Object.hasOwn(snapContext, key), `snapshot context missing drift field: ${key}`);
+    }
+
+    // 4. The snapshot extras keep their contract values (session enumeration;
+    // edges to non-session nodes contribute null session ids, as before W40-C1).
+    assert.equal(snapContext.agentKind, 'main');
+    assert.equal(snapContext.parentAgentId, null);
+    assert.ok(snapContext.connectedPeerIds.includes(fixture.subSessionId), 'connectedPeerIds must include the subagent session');
+    assert.ok(snapContext.outboundPeerIds.includes(fixture.subSessionId), 'outboundPeerIds must include the subagent session');
+    assert.ok(!snapContext.inboundPeerIds.includes(fixture.subSessionId), 'main agent has no inbound session edges');
+    const subContext = workflow.graphContextBySessionId[fixture.subSessionId];
+    assert.ok(subContext, 'snapshot must expose subagent context');
+    assert.equal(subContext.parentAgentId, fixture.sessionId, 'subagent parentAgentId must resolve to the main session');
+    assert.ok(subContext.connectedPeerIds.includes(fixture.sessionId), 'subagent connectedPeerIds must include the main session');
+
+    // 5. Specific drift-field content (both paths).
+    for (const context of [apiContext, snapContext]) {
+      assert.ok(context.defaultSkills.includes('workflow-ontology'), 'defaultSkills must include workflow-ontology');
+      assert.equal(context.ontology.ontologyId, 'harness.workflow.ontology');
+      assert.ok(Array.isArray(context.affordances), 'affordances must be an array');
+      assert.ok(context.affordances.length > 0, 'affordances must be non-empty');
+      assert.ok(context.availableActions.includes('agent.sendInput'), 'availableActions must include agent.sendInput');
+      assert.ok(context.availableActions.includes('agent.createNode'), 'availableActions must include agent graph capabilities');
+      assert.ok(context.skillTriggers['workflow-node-actions'].includes('draw flowchart'), 'skillTriggers must carry canonical triggers');
+      assert.equal(context.skillPolicy, 'auto', 'skillPolicy must come from normalized node config');
+      assert.deepEqual(context.outputRouting.markdownDefault, {
+        enabled: false,
+        explicitTargetNodeId: '',
+        resolvedTargetNodeId: '',
+        resolution: 'disabled',
+      });
+      assert.ok(context.magneticTopology.groupCount >= 1, 'magnetic topology must have a group');
+      assert.equal(context.magneticTopology.dockLinkCount, 1);
+      assert.equal(typeof context.magneticGroupId, 'string');
+      assert.ok(context.magneticGroupId.length > 0, 'agent must belong to a magnetic group');
+      assert.ok(context.directMagneticNeighbors.includes(fixture.markdown), 'markdown must be a direct magnetic neighbor');
+      assert.ok(context.magneticReachableNodes.includes(fixture.markdown), 'markdown must be magnetically reachable');
+      assert.equal(context.identity.isMainAgent, true);
+      assert.equal(context.workspace.kind, 'agent-node-home');
+      assert.equal(context.graphVersion, 7);
+    }
+
+    // 6. Connected refs carry shortId + displayName + title (W38e) in both paths.
+    for (const context of [apiContext, snapContext]) {
+      assertRefsCarryW38e(context.connectedResourceRefs, 'connectedResourceRefs');
+      assertRefsCarryW38e(context.connectedEventRefs, 'connectedEventRefs');
+      assertRefsCarryW38e(context.connectedCapabilityRefs, 'connectedCapabilityRefs');
+      assertRefsCarryW38e(context.connectedGoalRefs, 'connectedGoalRefs');
+      assertRefsCarryW38e(context.connectedCapabilityNodeRefs, 'connectedCapabilityNodeRefs');
+    }
+
+    // 7. Timer control affordance resolves through the control edge (both paths).
+    for (const context of [apiContext, snapContext]) {
+      const timerRef = context.connectedEventRefs.find(ref => ref.type === 'timer');
+      assert.ok(timerRef, 'timer event ref must be connected');
+      assert.equal(timerRef.canControl, true, 'control edge must grant timer control');
+      assert.ok(timerRef.allowedActions.includes('timer.configure'), 'timer control actions must be allowed');
+      assert.equal(timerRef.connection.relation, 'event');
+    }
+
+    // 8. Goal and capability refs resolve (both paths).
+    for (const context of [apiContext, snapContext]) {
+      assert.ok(context.connectedGoalRefs.some(ref => ref.nodeId === fixture.goalNodeId && ref.type === 'goal'), 'goal ref must resolve');
+      assert.ok(context.connectedCapabilityNodeRefs.some(ref => ref.nodeId === fixture.pack && ref.capabilityKind === 'skill-group'), 'skill-group ref must resolve');
+    }
+
+    // 9. effectiveSkillGroups carry skillRefs with enabled (W38-BE-FOLLOWUP, both paths).
+    for (const context of [apiContext, snapContext]) {
+      assert.equal(context.effectiveSkillGroups.length, 1);
+      const group = context.effectiveSkillGroups[0];
+      assert.equal(group.nodeId, fixture.pack);
+      assert.equal(group.label, 'Workflow');
+      assert.deepEqual(group.skillNames, ['wf-ui', 'browser-lab']);
+      for (const skillRef of group.skillRefs) {
+        assert.equal(skillRef.enabled, true, `skill ${skillRef.name} must default to enabled:true`);
+        assert.deepEqual(Object.keys(skillRef).sort(), ['enabled', 'id', 'name', 'source', 'state', 'title']);
+      }
+      assert.ok(context.effectiveSkills.includes('wf-ui'), 'connected skill names must feed effectiveSkills');
+      assert.ok(context.effectiveSkills.includes('browser-lab'), 'connected skill names must feed effectiveSkills');
+    }
+
+    // 10. connectedPeers enumerates every non-agent peer in both paths
+    // (timer appears once per event/control edge; the capsule dock duplicates
+    // the markdown edge — dedupe by node id for the peer-set assertion).
+    for (const context of [apiContext, snapContext]) {
+      const peerIds = [...new Set(context.connectedPeers.map(peer => peer.nodeId))].sort();
+      assert.deepEqual(peerIds, [fixture.goalNodeId, fixture.markdown, fixture.pack, fixture.timer].sort());
+      const goalPeer = context.connectedPeers.find(peer => peer.nodeId === fixture.goalNodeId);
+      assert.equal(goalPeer.type, 'goal');
+      assert.equal(typeof goalPeer.shortId, 'string');
+      assert.equal(typeof goalPeer.displayName, 'string');
+    }
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('sub-builders are independently importable and produce the canonical shapes', async () => {
+  const root = makeProject();
+  try {
+    const fixture = await seedGraphFixture(root);
+    const graph = loadWorkflowGraphMap(root);
+    const graphNode = findAgentGraphNode(graph, fixture.agentNodeId);
+    const nodeId = fixture.agentNodeId;
+
+    const resourceRefs = buildConnectedResourceRefs(root, nodeId, graph);
+    assert.ok(resourceRefs.some(ref => ref.nodeId === fixture.markdown));
+    const eventRefs = buildConnectedEventRefs(root, nodeId, graph);
+    assert.ok(eventRefs.some(ref => ref.nodeId === fixture.timer));
+    const capabilityRefs = buildConnectedCapabilityRefs(root, nodeId, graph);
+    assert.ok(capabilityRefs.some(ref => ref.nodeId === fixture.pack));
+    const goalRefs = buildConnectedGoalRefs(root, nodeId, graph);
+    assert.ok(goalRefs.some(ref => ref.nodeId === fixture.goalNodeId));
+    const agentRefs = buildConnectedAgentRefs(root, nodeId, graph, { isMainAgent: true });
+    assert.deepEqual(agentRefs, []);
+    const connections = buildConnections(nodeId, graph);
+    assert.equal(connections.length, 6); // 5 edges + 1 capsule-dock connection
+    assert.ok(effectiveSkillGroupsFor(capabilityRefs).length >= 1);
+    assert.ok(Object.keys(skillTriggersFor(['workflow-ontology'])).includes('workflow-ontology'));
+    assert.deepEqual(outputRoutingFor({ values: {} }, resourceRefs).markdownDefault.resolution, 'disabled');
+    const snapshot = buildAgentSnapshot(root, graphNode, graph);
+    assert.equal(snapshot.kind, 'agent');
+    assert.equal(snapshot.sessionId, fixture.sessionId);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

package/src/wf-ui-server/__tests__/workflow-agent-cooperation-permissions.test.mjs

@@ -0,0 +1,318 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import http from 'node:http';
+import { makeHarnessTempRoot } from '../../../tests/support/temp-root.js';
+import { loadWorkflowGraphMap, writeWorkflowGraphMap, loadA2aSkills } from '../a2a-store.mjs';
+import { workflowOntology } from '../workflow-ontology.mjs';
+import { createNode } from '../workflow-node-runtime.mjs';
+import { startServer, stopServer } from '../server.mjs';
+import { SessionRegistry } from '../session-registry.mjs';
+
+// ── Helpers ──
+function seedRoot() {
+  const root = makeHarnessTempRoot('wf-agent-coop-permissions-');
+  fs.mkdirSync(path.join(root, 'Harness', 'tasks'), { recursive: true });
+  fs.mkdirSync(path.join(root, 'Harness', 'a2a'), { recursive: true });
+  return root;
+}
+
+function seedActiveTask(root, taskId = 'task-coop-permissions') {
+  fs.mkdirSync(path.join(root, 'Harness', 'tasks', taskId), { recursive: true });
+  fs.writeFileSync(path.join(root, 'Harness', 'PROGRESS.md'), `# PROGRESS.md\n\n## Active Task\n\n- ${taskId}\n`, 'utf8');
+  fs.writeFileSync(path.join(root, 'Harness', 'tasks', taskId, 'STATE.json'), JSON.stringify({
+    schemaVersion: 1,
+    taskId,
+    status: 'active',
+    nextAction: 'Close cooperation permission gates',
+    acceptance: [],
+    planItems: [],
+    phase: 'implement',
+  }));
+  return `goal-${taskId}`;
+}
+
+async function seedGoalItems(base, goalNodeId, agentNodeId, count) {
+  const added = await jsonRequest(base, `/api/workflow/nodes/${goalNodeId}/actions/goal.add`, {
+    method: 'POST',
+    body: { actorNodeId: agentNodeId, planItems: Array.from({ length: count }, (_, index) => ({ text: `Open item ${index + 1}` })) },
+  });
+  assert.equal(added.status, 200, JSON.stringify(added.body));
+  return added;
+}
+
+function seedAgentGraphNode(root, nodeId, sessionId = `${nodeId}-pty`) {
+  writeWorkflowGraphMap(root, {
+    ...loadWorkflowGraphMap(root),
+    version: loadWorkflowGraphMap(root).version + 1,
+    nodes: [
+      ...(loadWorkflowGraphMap(root).nodes || []),
+      { nodeId, sessionId, kind: 'terminal-session', runtime: 'claude', agentKind: 'subagent', role: 'Agent', label: 'Agent', status: 'stopped' },
+    ],
+  });
+  return nodeId;
+}
+
+function connectGoal(root, goalNodeId, agentNodeId) {
+  writeWorkflowGraphMap(root, {
+    ...loadWorkflowGraphMap(root),
+    version: loadWorkflowGraphMap(root).version + 1,
+    edges: [
+      ...(loadWorkflowGraphMap(root).edges || []),
+      { id: `edge-${goalNodeId}-${agentNodeId}`, from: goalNodeId, to: agentNodeId, relation: 'goal', direction: 'bidirectional' },
+    ],
+  });
+}
+
+function dockLink(a, b) {
+  const pair = [a, b].sort();
+  return {
+    id: `dock:${pair[0]}::${pair[1]}`,
+    nodeIds: pair,
+    anchorId: pair[0],
+    draggedId: pair[1],
+    side: 'top',
+    edges: [],
+    connections: [
+      {
+        source: a,
+        target: b,
+        relation: 'wf-bridge',
+        direction: 'source-to-target',
+        sourceHandle: 'dock',
+        targetHandle: 'dock',
+      },
+    ],
+  };
+}
+
+function jsonRequest(baseUrl, route, { method = 'GET', body } = {}) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(route, baseUrl);
+    const payload = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(url, {
+      method,
+      headers: payload ? { 'content-type': 'application/json' } : {},
+    });
+    req.on('response', (res) => {
+      let data = '';
+      res.on('data', chunk => { data += chunk; });
+      res.on('end', () => {
+        try { resolve({ status: res.statusCode, body: JSON.parse(data) }); }
+        catch { resolve({ status: res.statusCode, body: data }); }
+      });
+    });
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+async function startTestServer(root) {
+  const registry = new SessionRegistry();
+  const started = await startServer({ projectRoot: root, host: '127.0.0.1', port: 0, sessionRegistry: registry });
+  return { base: `http://127.0.0.1:${started.port}`, stop: () => stopServer(started.server) };
+}
+
+// ── Agent-visible allowed action set (spec §7/§8: agents tick goals and use the
+//    markdown blackboard with locks; timer.dispatchWakeup stays denied) ──
+test('AC-013/AC-016/AC-017 (a): agent allowed set includes goal item + markdown lock actions; dispatchWakeup denied', () => {
+  const root = seedRoot();
+  try {
+    // Backend skill manuals carry the agent-visible allowed lists (a2a-store defaults)
+    const skills = loadA2aSkills(root);
+    const goalSkill = skills.find(s => s.skillId === 'workflow-goal-node');
+    assert.ok(goalSkill, 'workflow-goal-node skill must be present');
+    for (const action of ['goal.add', 'goal.delete', 'goal.replace', 'goal.check', 'goal.uncheck', 'goal.complete', 'goal.reopen']) {
+      assert.ok(goalSkill.policy.allowed.includes(action), `goal skill allowed set must include ${action}`);
+    }
+    const markdownSkill = skills.find(s => s.skillId === 'workflow-markdown-node');
+    assert.ok(markdownSkill, 'workflow-markdown-node skill must be present');
+    for (const action of ['markdown.find', 'markdown.acquireLock', 'markdown.releaseLock']) {
+      assert.ok(markdownSkill.policy.allowed.includes(action), `markdown skill allowed set must include ${action}`);
+    }
+    const resourceSkill = skills.find(s => s.skillId === 'workflow-resource-node');
+    assert.ok(resourceSkill, 'workflow-resource-node skill must be present');
+    for (const action of ['markdown.find', 'markdown.acquireLock', 'markdown.releaseLock']) {
+      assert.ok(resourceSkill.policy.allowed.includes(action), `resource skill allowed set must include ${action}`);
+    }
+
+    // timer.dispatchWakeup stays denied to agents everywhere in the skill layer
+    for (const skill of skills) {
+      for (const list of [skill.policy?.allowed, skill.policy?.subagent, skill.policy?.mainAgent]) {
+        if (Array.isArray(list)) {
+          assert.ok(!list.includes('timer.dispatchWakeup'), `timer.dispatchWakeup must not appear in ${skill.skillId} allowed lists`);
+        }
+      }
+    }
+
+    // Ontology affordances: goal/markdown schema expose the new actions to agents
+    const ontology = workflowOntology();
+    const goalSchema = ontology.nodeTypes.goal;
+    for (const action of ['goal.add', 'goal.delete', 'goal.replace', 'goal.check', 'goal.uncheck', 'goal.complete', 'goal.reopen']) {
+      assert.ok(goalSchema.writableActions.includes(action), `goal ontology writableActions must include ${action}`);
+    }
+    const markdownSchema = ontology.nodeTypes.markdown;
+    assert.ok(markdownSchema.readableActions.includes('markdown.find'), 'markdown ontology must expose markdown.find as a read action');
+    assert.ok(markdownSchema.writableActions.includes('markdown.acquireLock'), 'markdown ontology writableActions must include markdown.acquireLock');
+    assert.ok(markdownSchema.writableActions.includes('markdown.releaseLock'), 'markdown ontology writableActions must include markdown.releaseLock');
+
+    // timer.dispatchWakeup remains a runtime action, denied to agents
+    assert.ok(ontology.nodeTypes.timer.runtimeActions.includes('timer.dispatchWakeup'), 'timer.dispatchWakeup must stay a runtime action');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+// ── Live HTTP dispatch: an agent CAN invoke goal.check and markdown.acquireLock ──
+test('AC-013/AC-017 (a): agent invokes goal.check and markdown.acquireLock through the node-action route', async () => {
+  const root = seedRoot();
+  const goalNodeId = seedActiveTask(root);
+  const agentNodeId = seedAgentGraphNode(root, 'agent-coop-1');
+  connectGoal(root, goalNodeId, agentNodeId);
+  const markdown = await createNode(root, { type: 'markdown', title: 'Team Blackboard' });
+  const markdownNodeId = markdown.node.nodeId;
+  const server = await startTestServer(root);
+  try {
+    await seedGoalItems(server.base, goalNodeId, agentNodeId, 1);
+    const goalCheck = await jsonRequest(server.base, `/api/workflow/nodes/${goalNodeId}/actions/goal.check`, {
+      method: 'POST',
+      body: { planItemIds: ['P-001'], actorNodeId: agentNodeId },
+    });
+    assert.equal(goalCheck.status, 200, JSON.stringify(goalCheck.body));
+    assert.equal(goalCheck.body.ok, true);
+    assert.equal(goalCheck.body.action, 'goal.check');
+    assert.equal(goalCheck.body.result.state.planItems[0].status, 'done', 'goal.check must tick the item');
+
+    const acquire = await jsonRequest(server.base, `/api/workflow/nodes/${markdownNodeId}/actions/markdown.acquireLock`, {
+      method: 'POST',
+      body: { lockOwner: agentNodeId, ttlSeconds: 30 },
+    });
+    assert.equal(acquire.status, 200, JSON.stringify(acquire.body));
+    assert.ok(acquire.body.result.lockId, 'acquireLock must return a lockId');
+    assert.equal(acquire.body.result.owner, agentNodeId);
+  } finally {
+    await server.stop();
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+// ── HTTP error body detail fields (spec §7 goal_items_pending) ──
+test('AC-014 (c): HTTP goal.complete rejection carries remaining ids in the body', async () => {
+  const root = seedRoot();
+  const goalNodeId = seedActiveTask(root);
+  const agentNodeId = seedAgentGraphNode(root, 'agent-coop-2');
+  connectGoal(root, goalNodeId, agentNodeId);
+  const server = await startTestServer(root);
+  try {
+    await seedGoalItems(server.base, goalNodeId, agentNodeId, 2);
+    const complete = await jsonRequest(server.base, `/api/workflow/nodes/${goalNodeId}/actions/goal.complete`, {
+      method: 'POST',
+      body: { evidenceRefs: [], actorNodeId: agentNodeId },
+    });
+    assert.equal(complete.status, 409, JSON.stringify(complete.body));
+    assert.equal(complete.body.error.code, 'goal_items_pending');
+    assert.equal(complete.body.error.message, 'Complete all plan items before completing the Goal.');
+    assert.deepEqual(complete.body.remaining, ['P-001', 'P-002'], 'HTTP body must carry the typed remaining field');
+  } finally {
+    await server.stop();
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+// ── HTTP error body detail fields (spec §8.3 markdown_conflict) ──
+test('AC-018 (d): HTTP markdown_conflict carries currentRevision + expectedRevision', async () => {
+  const root = seedRoot();
+  const markdown = await createNode(root, { type: 'markdown', title: 'Blackboard' });
+  const markdownNodeId = markdown.node.nodeId;
+  const server = await startTestServer(root);
+  try {
+    const v1 = await jsonRequest(server.base, `/api/workflow/nodes/${markdownNodeId}/actions/markdown.append`, {
+      method: 'POST',
+      body: { markdown: '# v1' },
+    });
+    assert.equal(v1.status, 200, JSON.stringify(v1.body));
+    const v2 = await jsonRequest(server.base, `/api/workflow/nodes/${markdownNodeId}/actions/markdown.append`, {
+      method: 'POST',
+      body: { markdown: '# v2' },
+    });
+    assert.equal(v2.status, 200, JSON.stringify(v2.body));
+    const currentRevision = v2.body.result.revision;
+
+    const stale = await jsonRequest(server.base, `/api/workflow/nodes/${markdownNodeId}/actions/markdown.append`, {
+      method: 'POST',
+      body: { markdown: '# stale', expectedRevision: 1 },
+    });
+    assert.equal(stale.status, 409, JSON.stringify(stale.body));
+    assert.equal(stale.body.error.code, 'markdown_conflict');
+    assert.equal(stale.body.currentRevision, currentRevision, 'HTTP body must carry currentRevision');
+    assert.equal(stale.body.expectedRevision, 1, 'HTTP body must carry expectedRevision');
+
+    // Lock conflict (spec §8.2/8.3, F18/D15): write by a non-holder is refused
+    // with markdown_locked — mandatory exclusion while the lock is held, even
+    // without expectedRevision — carrying the holder and lease expiry so the
+    // UI can surface them.
+    const lock = await jsonRequest(server.base, `/api/workflow/nodes/${markdownNodeId}/actions/markdown.acquireLock`, {
+      method: 'POST',
+      body: { lockOwner: 'agent-a', ttlSeconds: 30 },
+    });
+    assert.equal(lock.status, 200, JSON.stringify(lock.body));
+    const locked = await jsonRequest(server.base, `/api/workflow/nodes/${markdownNodeId}/actions/markdown.append`, {
+      method: 'POST',
+      body: { markdown: '# blocked', lockOwner: 'agent-b' },
+    });
+    assert.equal(locked.status, 409, JSON.stringify(locked.body));
+    assert.equal(locked.body.error.code, 'markdown_locked');
+    assert.equal(locked.body.holder, 'agent-a', 'HTTP body must carry the lock holder');
+    assert.ok(locked.body.expiresAt > Date.now(), 'HTTP body must carry the lock expiresAt');
+  } finally {
+    await server.stop();
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+// ── HTTP error body detail fields (spec §6.2 goal_already_bound, AC-015/T12) ──
+test('AC-015 (e): HTTP goal_already_bound carries existingGoalNodeId + timerNodeId (409)', async () => {
+  const root = seedRoot();
+  const goalNodeId = seedActiveTask(root);
+  const timer = await createNode(root, { type: 'timer', title: 'Coop Timer' });
+  const timerNodeId = timer.node.nodeId;
+  const agentNodeId = seedAgentGraphNode(root, 'agent-coop-3');
+  writeWorkflowGraphMap(root, {
+    ...loadWorkflowGraphMap(root),
+    version: loadWorkflowGraphMap(root).version + 1,
+    capsuleDockLinks: [
+      dockLink(goalNodeId, timerNodeId),
+      dockLink(timerNodeId, agentNodeId),
+    ],
+  });
+  const server = await startTestServer(root);
+  try {
+    const first = await jsonRequest(server.base, '/api/workflow/nodes', { method: 'POST', body: { type: 'goal' } });
+    assert.equal(first.status, 201, JSON.stringify(first.body));
+
+    // Inject a second goal into the same magnetic group
+    writeWorkflowGraphMap(root, {
+      ...loadWorkflowGraphMap(root),
+      version: loadWorkflowGraphMap(root).version + 1,
+      nodes: [
+        ...(loadWorkflowGraphMap(root).nodes || []),
+        { nodeId: 'goal-second', label: 'Second Goal' },
+      ],
+      capsuleDockLinks: [
+        ...(loadWorkflowGraphMap(root).capsuleDockLinks || []),
+        dockLink(agentNodeId, 'goal-second'),
+      ],
+    });
+
+    const second = await jsonRequest(server.base, '/api/workflow/nodes', { method: 'POST', body: { type: 'goal' } });
+    assert.equal(second.status, 409, JSON.stringify(second.body));
+    assert.equal(second.body.error, 'goal_already_bound');
+    assert.equal(second.body.existingGoalNodeId, 'goal-second');
+    assert.equal(second.body.timerNodeId, timerNodeId);
+  } finally {
+    await server.stop();
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});