harness-everything 0.30.10 → 0.31.0

package/fable-mode/scripts/workflow-plan-consumer.js

@@ -63,7 +63,7 @@ function normalizeWritePath(value) {
   if (typeof value !== 'string' || !value.trim()) throw new Error('writeSet entries must be non-empty strings');
   let normalized = value.trim().replace(/\\/g, '/').replace(/^\.\//, '');
   normalized = normalized.replace(/\/+$/g, '');
-  if (!normalized || normalized.startsWith('/') || /^[A-Za-z]:\//.test(normalized)) {
+  if (!normalized || normalized.startsWith('/') || /^[A-Za-z]:/.test(normalized)) {
     throw new Error(`writeSet paths must be repository-relative: ${value}`);
   }
   const parts = normalized.split('/');
@@ -76,6 +76,95 @@ function normalizeWritePath(value) {
   return normalized;
 }
 
+// The resolver ships with the hook runtime. A Skills-only install has no hook
+// runtime, so declared paths stay `unverified` instead of claiming availability.
+function bindingResolver() {
+  for (const relative of ['../../hooks/scripts/lib/binding-resolver.js', '../../../hooks/scripts/lib/binding-resolver.js']) {
+    const file = path.resolve(__dirname, relative);
+    if (fs.existsSync(file)) return require(file);
+  }
+  return null;
+}
+
+function resolveStageBindingAvailability(bindings, workspaceRoot) {
+  const resolver = bindingResolver();
+  for (const binding of bindings) {
+    const resolution = resolver
+      ? resolver.resolveBinding(binding, workspaceRoot)
+      : { availability: binding.path ? 'unverified' : 'unknown', file: null };
+    binding.availability = resolution.availability;
+    binding.resolvedPath = resolution.file;
+  }
+}
+
+function normalizeBindings(values, label, required) {
+  if (values === undefined) return [];
+  if (!Array.isArray(values)) throw new Error(`${label} must be an array`);
+  const seen = new Set();
+  return values.map(raw => {
+    const value = typeof raw === 'string' ? { id: raw } : raw;
+    if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`${label} entries must be ids or objects`);
+    const id = sanitizeId(value.id, `${label}.id`);
+    if (seen.has(id)) throw new Error(`${label} contains duplicate binding: ${id}`);
+    seen.add(id);
+    const bindingPath = value.path === undefined || value.path === null || value.path === ''
+      ? null
+      : normalizeWritePath(value.path);
+    return {
+      id,
+      required,
+      path: bindingPath,
+      status: 'pending',
+      availability: bindingPath ? 'unverified' : 'unknown',
+      resolvedPath: null,
+      evidence: null,
+      reasonCode: null,
+      updatedAt: null,
+    };
+  });
+}
+
+function activeStageBindings(runRoot, escapes = []) {
+  const run = readJson(path.join(runRoot, 'run.json'));
+  if (!run || !Array.isArray(run.stageIds)) return [];
+  const contractsDir = path.join(runRoot, 'contracts');
+  const stages = new Map();
+  for (const stageId of run.stageIds) {
+    const stage = readJson(path.join(contractsDir, `${stageId}.json`));
+    if (stage && stage.runId === run.runId && stage.stageId === stageId) stages.set(stageId, stage);
+  }
+  const escapedIds = new Set((escapes || []).filter(item => item?.runId === run.runId && item?.evidence && item?.uncoveredScope &&
+    ['workflow-uncovered-scope', 'host-capability-unavailable'].includes(item.reasonCode))
+    .map(item => item.stageId));
+  const stagePassed = stage => stage?.status === 'pass' &&
+    (stage.requiredBindings || []).every(binding => binding.status === 'loaded') &&
+    (stage.optionalBindings || []).every(binding => ['loaded', 'not-needed'].includes(binding.status));
+  const bindingsResolved = stage =>
+    (stage.requiredBindings || []).every(binding => binding.status === 'loaded') &&
+    (stage.optionalBindings || []).every(binding => ['loaded', 'not-needed'].includes(binding.status));
+  return run.stageIds
+    .map(stageId => stages.get(stageId))
+    .filter(stage => stage && !escapedIds.has(stage.stageId) &&
+      (['planned', 'running', 'fail', 'binding-unresolved'].includes(stage.status) ||
+        (stage.status === 'pass' && !bindingsResolved(stage))) &&
+      (stage.dependsOn || []).every(id => stagePassed(stages.get(id)) || escapedIds.has(id)))
+    .map(stage => ({
+      stageId: stage.stageId,
+      goal: stage.goal,
+      status: stage.status === 'pass' && !bindingsResolved(stage) ? 'binding-unresolved' : stage.status,
+      requiredBindings: (stage.requiredBindings || []).map(binding => ({
+        id: binding.id, status: binding.status, availability: binding.availability, path: binding.path, resolvedPath: binding.resolvedPath || null,
+      })),
+      optionalBindings: (stage.optionalBindings || []).map(binding => ({
+        id: binding.id, status: binding.status, availability: binding.availability, path: binding.path, resolvedPath: binding.resolvedPath || null,
+      })),
+    }));
+}
+
+function readJson(filePath) {
+  try { return JSON.parse(fs.readFileSync(filePath, 'utf8')); } catch (_) { return null; }
+}
+
 function normalizeStage(raw) {
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('stage must be an object');
   const stageId = sanitizeId(raw.stageId, 'stageId');
@@ -87,6 +176,12 @@ function normalizeStage(raw) {
 
   const dependsOn = [...new Set(raw.dependsOn.map(value => sanitizeId(value, `${stageId}.dependsOn`)))];
   const writeSet = [...new Set(raw.writeSet.map(normalizeWritePath))].sort();
+  const requiredBindings = normalizeBindings(raw.requiredBindings, `${stageId}.requiredBindings`, true);
+  const optionalBindings = normalizeBindings(raw.optionalBindings, `${stageId}.optionalBindings`, false);
+  const bindingIds = new Set(requiredBindings.map(binding => binding.id));
+  for (const binding of optionalBindings) {
+    if (bindingIds.has(binding.id)) throw new Error(`${stageId}: binding cannot be both required and optional: ${binding.id}`);
+  }
 
   return {
     stageId,
@@ -98,6 +193,8 @@ function normalizeStage(raw) {
     outputPath: raw.outputPath === undefined ? null : raw.outputPath,
     dependsOn,
     writeSet,
+    requiredBindings,
+    optionalBindings,
     checkCommand: typeof raw.checkCommand === 'string' && raw.checkCommand.trim() ? raw.checkCommand.trim() : null,
     passCondition: typeof raw.passCondition === 'string' && raw.passCondition.trim() ? raw.passCondition.trim() : null,
     failureReturn: typeof raw.failureReturn === 'string' && raw.failureReturn.trim()
@@ -236,6 +333,7 @@ function prepareRun({ routerContract, stages, workspaceRoot, runId, sessionId =
   fs.mkdirSync(evidenceDir, { recursive: true });
 
   for (const stage of normalizedStages) {
+    resolveStageBindingAvailability([...stage.requiredBindings, ...stage.optionalBindings], root);
     atomicWriteJson(path.join(contractsDir, `${stage.stageId}.json`), {
       schemaVersion: STAGE_CONTRACT_VERSION,
       planId,
@@ -319,7 +417,7 @@ if (require.main === module) {
       runId: args.runId,
       sessionId: args.sessionId || null,
     });
-    process.stdout.write(`${JSON.stringify(manifest)}\n`);
+    process.stdout.write(`${JSON.stringify({ ...manifest, activeStages: activeStageBindings(manifest.runRoot) })}\n`);
   } catch (err) {
     console.error(`[FABLE PLAN CONSUMER] ${err.message}`);
     process.exit(2);
@@ -328,6 +426,7 @@ if (require.main === module) {
 
 module.exports = {
   STAGE_CONTRACT_VERSION,
+  activeStageBindings,
   derivePlanId,
   getWorkspaceKey,
   getWorkspaceStateRoot,

package/harness-everything/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: harness-everything
-description: "Route software/project work through Harness: classify tier/topology, resolve suggested skills, apply semantic obligations, and keep tactics flexible. Use for software triage/routing/re-routing; not general Q&A or non-software writing."
+description: "Route software/project work through Harness: classify tier/topology, compose active-step knowledge bindings, apply semantic obligations, and keep tactics flexible. Use for software triage/routing/re-routing; not general Q&A or non-software writing."
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.6
+  version: 0.31.0
 ---
 
 # Harness Everything
@@ -20,16 +20,17 @@ metadata:
 1. **Route (MUST)** — scope/tier plus selected/deferred topology.
 2. **Verify (MUST)** — objective evidence via `verify-gate.js --json`.
 3. **Zoom out (MUST)** — after 3 same-signature failures, use `zoom-out`.
-4. **Resolve suggestions (MUST)** — evaluate each suggested `SKILL.md`; run applicable core contracts or retain a flow-grounded reason.
+4. **Bind knowledge by step (MUST)** — ordered steps declare required/optional skills/references; only the active step's bindings load and resolve.
 5. **Surface status (MUST)** — non-trivial work renders `### 🚦 Harness Status` with bold `Current`, `Read / Evidence`, `Next`; `Risk / Blocked` optional.
 6. **Keep agency** — required obligations are MUST; tactics MAY adapt. Numeric planning MAY guide, never hard-stop; only Rule-of-3 reflection and explicit user/host permission boundaries may block.
 7. **Windows PowerShell (MUST)** — `Get-Content -Encoding UTF8 -Raw`; npm `.cmd` shims (`npx.cmd`); never weaken `ExecutionPolicy`.
 
 ## Workflow
 1. Reuse kernel output or run `node "<this-skill-dir>/scripts/kernel-router.js" "<prompt summary>"`.
-2. Keep the routing checkpoint internal.
-3. Resolve suggestions as `use`, `not-applicable`, or `unresolved`.
-4. Complete selected-topology invariants/stages/checks.
-5. Tier-3/Fable broad mutation MUST use a linked worktree or explicit degraded fallback.
+2. Keep the routing checkpoint internal; knowledge signals feed planning, not document selection.
+3. Decompose ordered requirement steps, with their bindings, before execution.
+4. Required active-step bindings and applicable core contracts MUST resolve before the step passes; unknown/unavailable stays visible.
+5. Complete selected-topology invariants/stages/checks; Fable exposes only dependency-ready stage bindings.
+6. Tier-3/Fable broad mutation MUST use a linked worktree or explicit degraded fallback.
 
 Deep dive: <this-skill-dir>/references/triage-and-tiers.md

package/harness-everything/references/router-workflow-plan.md

@@ -104,22 +104,27 @@ Irreversible or external side-effect intent (for example destructive database ch
 
 This does not choose a topology and does not itself enforce the gate. Phase 5 owns PreToolUse enforcement. The router only declares the invariant so any eventual executor must preserve it.
 
-## Invariants vs advisory skills
+## Invariants vs knowledge signals
 
-`requiredInvariants` and `suggestedSkills` are separate plan fields. The kernel prints both separately and consumes them from the structured plan instead of reconstructing suggestions from tier.
+`requiredInvariants` and `knowledgeSignals` have separate roles. Invariants state semantic MUSTs; normalized knowledge signals help decompose requirements but never select document paths. `suggestedSkills` remains an empty compatibility field and is not populated from topology or keywords.
 
 Examples:
 
 - `loop-awareness` and `objective-verification` are mandatory for `iterative-single`, on top of the base `scope-lock`, `verify-before-claim`, and `replan-after-repeated-failure`;
-- `tdd` and `verification-loop` remain advisory skill suggestions;
+- TDD and verification-loop bindings are declared on behavior-change and verification steps, respectively;
 - `stage-contracts` and `cold-verification` are mandatory for Fable topologies;
-- `multi-agent-workspace` is suggested only when the selected topology actually requires durable workspace behavior.
+- domain skills and references are bound only to steps that need them;
+- `fable-multi-agent-workspace` selects durable workspace behavior without globally loading a skill path.
 
 There is no universal `TODO → TDD → verification` pipeline.
 
-## Guide deduplication
+## Binding and disclosure rule
 
-Knowledge-guide recommendations are deduplicated by the referenced guide path, not by full line text. If two routing groups describe `security-review/SKILL.md` differently, the path is still emitted once.
+Each ordered requirement or Fable stage may declare `requiredBindings` and `optionalBindings` by stable id and concrete repository-relative path. Only the active requirement or dependency-ready stage exposes its paths. Required bindings must resolve before that step/stage passes; unknown required bindings remain visible and unresolved. Future-step paths and keyword-matched documents are never preloaded.
+
+For single-agent steps, `workflow-disposition.js start`, `binding`, and `step` return command templates for resolving the current binding and passing the active step. Retained workflow reminders print the same commands. Record the binding evidence before the step disposition; the next step and its paths are disclosed only after the current step passes.
+
+In typed-step mode, the aggregate `execute` and `verify` obligations resolve from their corresponding passed steps. A verification-only plan records an explicit no-execution disposition for `execute`; it still requires the verification binding, step evidence, and objective check.
 
 ## Determinism rule
 

package/harness-everything/references/triage-and-tiers.md

@@ -14,10 +14,9 @@ flowchart TD
     K --> W{Workflow selected?}
     W -- No / deferred --> D[Preserve invariants<br/>choose smallest justified workflow]
     W -- Yes --> A[ACTIVE workflow contract]
-    A --> G{Suggested skills?}
-    G -- Yes --> R[Read each suggested SKILL.md<br/>resolve applicability]
-    G -- No --> E[Execute selected workflow]
-    R --> E
+    A --> P[Decompose requirements<br/>into ordered steps]
+    P --> B[Bind skills/references<br/>to each step]
+    B --> E[Execute active step only]
     E --> V{Required checks / stages resolved?}
     V -- Yes --> O([Claim completion])
     V -- No --> P[Diagnose / re-plan]
@@ -42,7 +41,7 @@ The kernel protects lifecycle obligations without micromanaging model reasoning.
 1. **Route before execution** — establish task scope/tier and the smallest justified topology.
 2. **Verify before claim** — completion requires objective evidence appropriate to the change.
 3. **Re-plan on repetition** — after three same-signature failures, stop micro-retrying and use a fresh diagnosis / `zoom-out`.
-4. **Evaluate before omission** — when the router suggests a skill, read its complete `SKILL.md` entry/basic flow before deciding applicability.
+4. **Bind knowledge by step** — compose ordered requirement steps and declare required/optional skills or references before execution.
 5. **Resolve selected workflow** — selected-topology required obligations are semantic MUSTs; implementation tactics MAY adapt where the contract allows.
 6. **Surface status** — non-trivial software/project work MUST use the single Harness Status format at required phase boundaries.
 
@@ -52,10 +51,10 @@ The model remains free to choose tools, implementation technique, decomposition
 
 - One universal `TODO → TDD → verification-loop` sequence for every Tier 2/3 task.
 - Multi-agent execution merely because a task is Tier 3.
-- Every router-suggested skill when its evaluated flow is objectively not applicable.
+- Every keyword-matched skill/reference regardless of whether an active requirement needs it.
 - Every optional deep-dive/reference linked from a skill.
 
-A suggested skill may resolve as `use`, `not-applicable`, or `unresolved/unavailable`. Resolution is a **MUST**. `not-applicable` needs a flow-grounded reason; a metadata-only or confidence-only judgement is insufficient. If disposition is `use`, the skill's core contract is a **MUST**. The selected **topology** is also a semantic execution contract; neither concept implies a persistent runtime lock.
+Keyword/domain matches are normalized planning signals, not document selectors. Each ordered step declares its required and optional skill/reference bindings; only the active step or dependency-ready Fable stage exposes those paths. Read a required skill's complete entry and follow its applicable core contract before the step passes. Required bindings without a known path remain visible and unresolved. Optional bindings resolve as loaded or not-needed. Hooks may remind, but missing bindings do not hard-block ordinary tools or Stop.
 
 ## 2. Routing Mechanism
 
@@ -67,28 +66,27 @@ node "<this-skill-dir>/scripts/kernel-router.js" "<brief prompt summary>"
 npx github:dyphn1/Harness-everything next "<brief prompt summary>"
 ```
 
-`kernel-router.js` delegates classification/guide discovery to `tier-router.js` and emits:
+`kernel-router.js` delegates classification/knowledge-signal detection to `tier-router.js` and emits:
 
 - classified tier + rationale,
 - structured workflow plan,
 - compact **Harness Routing Checkpoint**,
 - required invariants,
-- suggested skills whose applicability must be evaluated,
+- normalized knowledge signals that help compose requirement steps, not paths to read,
+- ordered requirement steps and their active required/optional bindings after planning,
 - **Workflow Contract** for the selected topology.
 
 If `UserPromptSubmit` already ran the kernel this turn, reuse that output. Do not infer a silent Tier 1/direct path from missing or degraded routing.
 
-### Suggestion applicability contract
+### Active binding contract
 
-For every router-suggested skill:
+- Before a selected Tier 2/3 workflow starts, decompose the request into ordered requirement steps and confirm the smallest sufficient topology.
+- Put a required skill/reference only on steps whose acceptance criteria need it; put optional knowledge on its actual consumer step.
+- Load/resolve only bindings for the active step. Do not print or preload future-step bindings.
+- A required binding MUST resolve as loaded before the step passes; optional bindings resolve as loaded or not-needed. Unknown/unavailable required bindings stay visible and unresolved.
+- Fable uses its existing dependency/write-set graph as the step graph. Only dependency-ready stage bindings are disclosed; unresolved bindings keep a successful check at `binding-unresolved` until they are resolved and that exact check is rerun.
 
-1. **MUST** read the complete `SKILL.md` entry.
-2. **MUST** evaluate `USE FOR`, `DO NOT USE FOR`, workflow/basic flow, and hard rules.
-3. Read extra material only when the entry explicitly requires it to decide applicability.
-4. **MUST** resolve the suggestion as `use`, `not-applicable`, or `unresolved/unavailable`.
-5. `use` means the skill's core contract **MUST** be followed; `not-applicable` **MUST** keep a flow-grounded reason.
-
-A name, description, router summary, tier label, or generic "routine/common task" judgement is not enough to mark a suggestion not applicable. Using one suggestion does not resolve the others automatically.
+The binding disposition is an execution contract, not proof that a real host loaded a file. Preserve a host/session trace before making live-host claims. Missing evidence stays a reminder and does not create a persistent Harness lock.
 
 ### Workflow escape contract
 
@@ -111,7 +109,7 @@ Default topology is normally `direct-single`. Keep the lifecycle minimal, but st
 
 Typical shape: specific feature/bug fix, multi-file coordination, behavioral change, focused benchmark/review.
 
-The router normally selects `iterative-single`: bounded reason/act work plus objective verification. It may surface `tdd`, `verification-loop`, `security-review`, `using-git-worktrees`, or other focused skills. Those suggestions are applicability decisions, not a universal sequence.
+The router normally selects `iterative-single`: bounded reason/act work plus objective verification. Compose ordered steps and bind TDD to behavior-change, verification-loop to verification, and domain references only to steps whose acceptance needs them. Keyword matches alone never select or load documents.
 
 When an evaluated skill is applicable, follow its workflow rather than reading it and then discarding it because the implementation seems obvious.
 
@@ -181,16 +179,16 @@ For software/project work, consume this internal runtime state when producing th
 - Strategy: <selected/deferred strategy>
 - Workflow state: <pending | running | satisfied | deferred | blocked>
 - Required invariants: <router invariants>
-- Suggested skills: <deduplicated suggestions or none>
-- Suggestion applicability: <use | not-applicable + reason | unresolved/unavailable>
+- Knowledge signals: <normalized planning inputs; not document paths>
+- Active step: <ordered requirement id/type, with only its declared bindings>
 - Escape: <none | reason + uncovered scope + evidence>
 ```
 
-The checkpoint is runtime/source state, not a competing user-facing template. Render user progress through the single Harness Status contract above. The key distinction is: **skill suggestions MUST resolve applicability; applicable skill core contracts and selected-topology obligations are MUSTs, while tactics MAY adapt.**
+The checkpoint is runtime/source state, not a competing user-facing template. Render user progress through the single Harness Status contract above. The key distinction is: **active required bindings and selected-topology obligations are MUSTs; unrelated future knowledge stays undisclosed, while tactics MAY adapt.**
 
 ## 8. Self-Healing and Dynamic Skills
 
-Self-heal, generated-skill discovery, knowledge-guide matching, and fact-audit behavior remain part of the runtime. Dynamic skill suggestions still require applicability evaluation.
+Self-heal and fact-audit behavior remain part of the runtime. Prompt keyword matches emit normalized knowledge signals plus candidate step-binding ids; they do not print skill/reference paths. Self-evolved skills registered in a manifest's `generated` entries are matched on metadata (triggers) only: matching ids surface as `SELF-EVOLVED SKILL SIGNALS`, and a step that declares such an id resolves its `SKILL.md` from the manifest only once that step is active.
 
 If bootstrap reports missing integration touchpoints:
 

package/harness-everything/schemas/router-workflow-plan.schema.json

@@ -12,6 +12,7 @@
     "patterns",
     "requiredInvariants",
     "suggestedSkills",
+    "knowledgeSignals",
     "actionGate",
     "limits",
     "parallelism",
@@ -34,6 +35,7 @@
     "patterns": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
     "requiredInvariants": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
     "suggestedSkills": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+    "knowledgeSignals": { "type": "array", "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,63}$" }, "uniqueItems": true },
     "actionGate": {
       "type": "object",
       "required": ["required", "reasonCodes", "approver", "disposition"],

package/harness-everything/scripts/kernel-router-core.js

@@ -27,7 +27,6 @@ const INVARIANT_TEXT = {
   'verify-before-claim': 'MUST verify before claim with objective evidence appropriate to the change.',
   'visible-status-updates': 'MUST render the single Markdown Harness Status with a visible heading, bullet-aligned bold labels, Current, Read / Evidence, and Next; add Risk / Blocked only when materially applicable.',
   'replan-after-repeated-failure': 'MUST stop micro-retrying after 3 same-signature failures and zoom out/re-diagnose.',
-  'evaluate-suggestions-before-skip': 'MUST read/evaluate each suggested skill\'s complete SKILL.md entry/basic flow before omission; an applicable skill core contract MUST be followed.',
   'loop-awareness': 'MUST reconsider assumptions/re-plan when evidence shows iterative stagnation; numeric iteration values MAY guide but never hard-stop.',
   'objective-verification': 'MUST use an objective check for iterative work; self-critique alone is not verification.',
   'stage-contracts': 'When Fable is selected, stages MUST have explicit stage contracts and pass conditions.',
@@ -43,16 +42,6 @@ const INVARIANT_TEXT = {
   'isolated-worktree-before-mutation': 'Tier-3/Fable broad mutation MUST resolve isolation: verified linked worktree or explicit degraded fallback.',
 };
 
-const SKILL_TEXT = {
-  'tdd': 'tdd: useful for behavioral changes where executable tests can drive the implementation.',
-  'verification-loop': 'verification-loop: useful for systematic build/lint/test/diff evidence before delivery.',
-  'using-git-worktrees': 'using-git-worktrees: resolves required Tier-3/Fable isolation disposition before broad mutation.',
-  'fable-mode': 'fable-mode / fable-discipline: useful for macro planning or deliberate multi-agent decomposition.',
-  'fable-discipline': null,
-  'multi-agent-workspace': 'multi-agent-workspace: useful when durable bounded delegation, handoffs, or workspace memory are required.',
-  'self-evolve': 'self-evolve: classify an evidence-backed lesson and use the authorized memory persistence path.',
-};
-
 function sanitizeClassifierOutput(stdout) {
   const lines = String(stdout || '').split(/\r?\n/);
   const filtered = [];
@@ -121,25 +110,12 @@ function printWorkflowPlan(plan) {
     fallback: plan.fallback,
     reasonCodes: plan.reasonCodes,
     requiredInvariants: plan.requiredInvariants,
-    suggestedSkills: plan.suggestedSkills,
+    knowledgeSignals: plan.knowledgeSignals,
     mutationIsolation: plan.mutationIsolation,
   };
   console.log(`\n=> ROUTER WORKFLOW PLAN (JSON): ${JSON.stringify(visible)}`);
 }
 
-function uniqueSuggestedSkills(plan) {
-  if (!Array.isArray(plan.suggestedSkills)) return [];
-  return [...new Set(plan.suggestedSkills.filter(skill => typeof skill === 'string' && skill.trim()))];
-}
-
-function enforceSuggestionEvaluation(plan) {
-  if (uniqueSuggestedSkills(plan).length === 0) return;
-  if (!Array.isArray(plan.requiredInvariants)) plan.requiredInvariants = [];
-  if (!plan.requiredInvariants.includes('evaluate-suggestions-before-skip')) {
-    plan.requiredInvariants.push('evaluate-suggestions-before-skip');
-  }
-}
-
 function displayTier(tier) {
   if (tier === 'tier1') return 'Tier 1';
   if (tier === 'tier2') return 'Tier 2';
@@ -149,19 +125,14 @@ function displayTier(tier) {
 
 function printRoutingCheckpoint(plan) {
   const invariants = Array.isArray(plan.requiredInvariants) ? plan.requiredInvariants : [];
-  const suggestions = uniqueSuggestedSkills(plan);
+  const signals = Array.isArray(plan.knowledgeSignals) ? plan.knowledgeSignals : [];
 
   console.log('\n=> HARNESS ROUTING CHECKPOINT (INTERNAL SOURCE STATE — DO NOT RENDER SEPARATELY):');
   console.log(`   - Tier: ${displayTier(plan.tier)}`);
   console.log(`   - Strategy: ${plan.strategy || 'deferred'}`);
   console.log(`   - Required invariants: ${invariants.length ? invariants.join(', ') : 'none'}`);
-  console.log(`   - Suggested skills: ${suggestions.length ? suggestions.join(', ') : 'none'}`);
-  console.log('   - User-visible progress: use this checkpoint as source state for the single Harness Status contract below; do not invent a per-skill progress format.');
-  if (suggestions.length > 0) {
-    console.log('   - Suggestion evaluation: MANDATORY. Before skipping any listed skill, read its complete SKILL.md entry and evaluate USE FOR, DO NOT USE FOR, workflow/basic flow, and hard rules.');
-    console.log('   - Skip evidence: do not reject from only the skill name, description, router summary, or a generic "routine/common task" judgement. If the entry cannot be resolved/read, mark it unresolved/unavailable rather than skipped.');
-    console.log('   - Suggestion disposition: applicability is conditional, but resolution is mandatory. If a skill is applicable, follow its core contract; if not-applicable, keep one brief flow-grounded reason. The selected workflow is a semantic execution contract, not optional advice.');
-  }
+  console.log(`   - Knowledge signals: ${signals.length ? signals.join(', ') : 'none'} (planning input only; not document selectors)`);
+  console.log('   - User-visible progress: use this checkpoint as source state for the single Harness Status contract below.');
 }
 
 function printKernelContract(plan) {
@@ -170,6 +141,11 @@ function printKernelContract(plan) {
     console.log(`   - ${invariant}: ${INVARIANT_TEXT[invariant] || 'Required by the selected workflow plan.'}`);
   }
 
+  if (plan.strategy && ['tier2', 'tier3'].includes(plan.tier)) {
+    console.log('\n=> PLANNING STEP: decompose → compose');
+    console.log('   - Define ordered requirement steps and their bindings before starting execution.');
+  }
+
   console.log('\n=> USER-VISIBLE HARNESS STATUS CONTRACT (MUST):');
   console.log('   - For non-trivial software/project work, the agent MUST render this single Markdown status shape:');
   console.log('     ### 🚦 Harness Status');
@@ -184,26 +160,10 @@ function printKernelContract(plan) {
   console.log('   - Emit it before substantive execution, after a major phase, when direction materially changes, at meaningful long-running phase boundaries, and before final completion (the final response may merge it naturally).');
   console.log('   - This is a semantic communication MUST, not a hard execution lock, counter, or reset condition.');
 
-  console.log('\n=> WORKFLOW SKILLS (APPLICABILITY MUST BE RESOLVED):');
-  if (Array.isArray(plan.suggestedSkills) && plan.suggestedSkills.length > 0) {
-    const emitted = new Set();
-    for (const skill of plan.suggestedSkills) {
-      if (emitted.has(skill)) continue;
-      const text = Object.prototype.hasOwnProperty.call(SKILL_TEXT, skill) ? SKILL_TEXT[skill] : `${skill}: evaluate applicability inside the selected topology.`;
-      if (text) console.log(`   - ${text}`);
-      emitted.add(skill);
-      if (skill === 'fable-mode') emitted.add('fable-discipline');
-    }
-    if (plan.strategy && plan.strategy.startsWith('fable-')) {
-      console.log('   - Fable is not a universal pipeline, but a selected Fable topology must be entered and resolved before completion.');
-    }
-  } else if (plan.strategy === 'direct-single') {
-    console.log('   - No domain skill was suggested. The bounded direct path SHOULD remain minimal; a focused skill MAY be loaded when it adds value.');
-  } else if (plan.strategySelection === 'deferred') {
-    console.log('   - Strategy is deferred/unclassified. Do not infer triviality; choose the smallest justified approach from task evidence.');
-  } else {
-    console.log('   - No additional skill suggestion from the workflow plan.');
-  }
+  console.log('\n=> ACTIVE-STEP KNOWLEDGE BINDINGS (MUST):');
+  console.log('   - Compose ordered requirement steps before execution. Each step declares the required/optional skills or references for that step.');
+  console.log('   - MUST load/resolve only bindings declared for the active step; future-step bindings remain undisclosed until that step becomes active.');
+  console.log('   - A required binding MUST be loaded and its core contract followed before the active step passes. An unknown/unavailable binding stays visible and unresolved; it does not hard-block ordinary tools or Stop.');
 
   if (plan.ensemble) {
     console.log(`\n=> ENSEMBLE REVIEW: bounded to ${plan.ensemble.maxCandidates} candidates; synthesis=${plan.ensemble.synthesis}; verifier=${plan.ensemble.verifier}. Preserve minority positions and do not claim improvement without paired evidence.`);
@@ -224,6 +184,44 @@ function printKernelContract(plan) {
   console.log('\n=> ORCHESTRATION POLICY: Selected-topology required obligations and applicable skill core contracts are semantic MUSTs; implementation tactics MAY adapt. Lifecycle hooks observe/remind rather than hard-block, except user/host permission boundaries and the Rule-of-3 zoom-out.');
 }
 
+function printRetainedWorkflow(plan, workflow, activeStep = null, activeStages = []) {
+  const invariants = Array.isArray(workflow?.requiredInvariants) ? workflow.requiredInvariants : plan.requiredInvariants || [];
+  const state = workflow?.state || 'unknown';
+  console.log('\n=> RETAINED EXECUTION CONTRACT (COMPACT):');
+  console.log(`   - Workflow: ${workflow?.workflowId || 'unavailable'}; state=${state}; tier=${displayTier(workflow?.tier || plan.tier)}; strategy=${workflow?.strategy || plan.strategy || 'deferred'}.`);
+  console.log(`   - Invariants remain active: ${invariants.length ? invariants.join(', ') : 'none'}.`);
+  console.log(`   - Action gate: ${plan.actionGate?.required ? `MUST remain ${plan.actionGate.disposition} (${plan.actionGate.reasonCodes.join(', ')})` : 'not required'}.`);
+  console.log(`   - Isolation: ${plan.mutationIsolation?.required ? 'MUST be resolved before broad mutation; missing host evidence remains visible, not a tool lock' : 'no topology-level isolation requirement'}.`);
+  if (activeStages.length) {
+    console.log(`   - Active Fable stage${activeStages.length === 1 ? '' : 's'}: ${activeStages.map(stage => `${stage.stageId} [${stage.status}]`).join(', ')}.`);
+    for (const stage of activeStages) {
+      console.log(`     - ${stage.stageId}: ${stage.goal}`);
+      for (const kind of ['requiredBindings', 'optionalBindings']) {
+        const bindings = stage[kind] || [];
+        if (bindings.length) {
+          console.log(`       - ${kind === 'requiredBindings' ? 'Required' : 'Optional'}: ${bindings.map(binding => `${binding.id} [${binding.status}; ${binding.path || 'path unavailable'}]`).join(', ')}.`);
+        }
+      }
+    }
+    console.log('   - Future-stage bindings remain undisclosed until their dependencies pass.');
+  } else if (activeStep) {
+    console.log(`   - Active step: ${activeStep.id} (${activeStep.stepType}) — ${activeStep.summary}; status=${activeStep.status}.`);
+    for (const kind of ['requiredBindings', 'optionalBindings']) {
+      const bindings = activeStep[kind] || [];
+      if (bindings.length) {
+        console.log(`   - ${kind === 'requiredBindings' ? 'Required' : 'Optional'} active bindings: ${bindings.map(binding => `${binding.id} [${binding.status}; ${binding.path || 'path unavailable'}]`).join(', ')}.`);
+      }
+    }
+    console.log('   - Do not resolve, load, or disclose bindings for future steps yet.');
+  } else if (String(workflow?.strategy || plan.strategy || '').startsWith('fable-')) {
+    console.log('   - No dependency-ready Fable stage bindings are currently available.');
+  } else {
+    console.log('   - Active step: planning/execution obligations; step bindings are not composed or started yet.');
+  }
+  console.log('   - Harness Status stays MUST: one block with Current, Read / Evidence, and Next; add Risk / Blocked only when material. Turn label stays MUST.');
+  console.log('   - Permission boundary and Rule-of-3 remain active; this reminder is non-blocking.');
+}
+
 function route(prompt, stdinPayload) {
   const classifierPath = path.join(__dirname, 'tier-router.js');
   const contractPath = path.join(os.tmpdir(), `harness-router-${process.pid}-${crypto.randomUUID()}.json`);
@@ -244,7 +242,6 @@ function route(prompt, stdinPayload) {
 
   const contract = readStructuredContract(contractPath);
   applyEnsemblePolicy(contract, resolvePrompt(prompt, stdinPayload));
-  enforceSuggestionEvaluation(contract.workflowPlan);
   try {
     fs.rmSync(contractPath, { force: true });
   } catch (err) {
@@ -279,4 +276,4 @@ if (prompt) {
 }
 }
 
-module.exports = { route, printWorkflowPlan, printRoutingCheckpoint, printKernelContract };
+module.exports = { route, printWorkflowPlan, printRoutingCheckpoint, printKernelContract, printRetainedWorkflow };

package/harness-everything/scripts/kernel-router.js

@@ -105,6 +105,27 @@ function persistWorkflow(contract, payload, prompt) {
   return { ...context, hooksRoot, retained: false, memoryCapability };
 }
 
+function activeExecutionFor(persisted, plan) {
+  if (!persisted?.workflow || !persisted.hooksRoot) return null;
+  try {
+    if (String(persisted.workflow.strategy || '').startsWith('fable-')) {
+      const runtime = require(path.join(persisted.hooksRoot, 'lib/workflow-runtime'));
+      const match = runtime.matchingRun(persisted);
+      if (!match) return { activeStages: [] };
+      for (const relative of ['../../fable-mode/scripts/workflow-plan-consumer.js', '../../skills/fable-mode/scripts/workflow-plan-consumer.js']) {
+        const file = path.resolve(__dirname, relative);
+        if (fs.existsSync(file)) return { activeStages: require(file).activeStageBindings(match.runRoot, persisted.workflow.escapes) };
+      }
+      return { activeStages: [] };
+    }
+    const obligations = require(path.join(persisted.hooksRoot, 'lib/workflow-obligations'));
+    const loaded = obligations.loadObligationSet(persisted, plan);
+    return { activeStep: loaded.set ? obligations.activeStepSnapshot(loaded.set) : null };
+  } catch (_) {
+    return null;
+  }
+}
+
 // Printed last so it is the nearest instruction when the turn ends (docs/system-one-observations.md#label-line).
 function printLabelContract() {
   console.log('\n=> TURN LABEL LINE (MUST, EVERY TURN — short answers, lookups and trivial edits included):');
@@ -134,14 +155,35 @@ function run(raw) {
     if (persisted?.retained && persisted.workflow) plan = persisted.workflow.workflowPlan;
   } catch (error) { failure = error; }
   if (hostNotification && !persisted?.workflow) {
-    console.log('\n=> Host notification — no active execution contract; ignored for routing.');
+    console.log('\n=> Host notification: no active execution contract; ignored for routing.');
+    if (failure) console.error('[Workflow Reminder] routing state was not persisted: ' + failure.message);
+    printLabelContract();
+    return;
+  }
+  if (persisted?.retained && persisted.workflow) {
+    if (persisted.hostNotification) console.log('\n=> Host notification: routing unchanged; keeping the active execution contract.');
+    else console.log('\n=> Retaining unresolved workflow; showing its compact active contract.');
+    const activeExecution = activeExecutionFor(persisted, plan) || {};
+    const activeStep = activeExecution.activeStep || null;
+    const activeStages = activeExecution.activeStages || [];
+    core.printRetainedWorkflow(plan, persisted.workflow, activeStep, activeStages);
+    if (activeStep) {
+      const controller = path.join(persisted.hooksRoot, 'workflow-disposition.js');
+      console.log('   - Resolve only bindings for this active step, then pass this step with evidence.');
+      console.log('   - Controller: ' + controller + '; session: ' + persisted.sessionId + '; step: ' + activeStep.id + '.');
+      console.log('   - Resolve binding: node "' + controller + '" binding --session-id "' + persisted.sessionId + '" --step-id "' + activeStep.id + '" --binding-id "<active-binding-id>" --disposition <loaded|not-needed|unavailable> --evidence "<binding evidence>"');
+      console.log('   - Pass step: node "' + controller + '" step --session-id "' + persisted.sessionId + '" --step-id "' + activeStep.id + '" --disposition pass --evidence "<completion evidence>"');
+    } else if (activeStages.length) {
+      const controller = path.join(persisted.hooksRoot, 'workflow-disposition.js');
+      console.log('   - Resolve only declared bindings with stage-binding --stage-id <active-stage> --binding-id <binding> --disposition <loaded|not-needed|unavailable> --evidence <evidence>.');
+      console.log('   - Controller: ' + controller + '; session: ' + persisted.sessionId + '.');
+    }
+    printLabelContract();
     if (failure) console.error('[Workflow Reminder] routing state was not persisted: ' + failure.message);
     return;
   }
   if (result?.sanitized) console.log(result.sanitized);
   if (result?.stderr) process.stderr.write(result.stderr);
-  if (persisted?.hostNotification) console.log('\n=> Host notification — routing unchanged; keeping the active execution contract.');
-  else if (persisted?.retained) console.log('\n=> Retaining unresolved workflow from earlier prompts; the checkpoint below is the active execution contract.');
   core.printWorkflowPlan(plan);
   core.printRoutingCheckpoint(plan);
   core.printKernelContract(plan);
@@ -163,7 +205,8 @@ function run(raw) {
     if (plan.strategySelection === 'selected' && ['tier2', 'tier3'].includes(plan.tier)) {
       console.log('   - Planning contract: ' + path.join(persisted.sessionDir, 'workflow-obligations.json'));
       console.log('   - Requirements first: decompose intent into requirement fragments, then confirm the smallest sufficient workflow.');
-      console.log('   - Record plan: node "' + controller + '" plan --session-id "' + persisted.sessionId + '" --requirements-json "[{\\\"id\\\":\\\"req-1\\\",\\\"summary\\\":\\\"...\\\",\\\"acceptance\\\":\\\"...\\\"}]" --strategy "' + plan.strategy + '" --evidence "<why this workflow fits>"');
+      console.log('   - Record ordered step types (review, behavior-change, verification, commit) and their bindings before execution.');
+      console.log('   - Record plan: node "' + controller + '" plan --session-id "' + persisted.sessionId + '" --requirements-json "[{\\"id\\":\\"req-1\\",\\"stepType\\":\\"behavior-change\\",\\"summary\\":\\"...\\",\\"acceptance\\":\\"...\\"},{\\"id\\":\\"req-verify\\",\\"stepType\\":\\"verification\\",\\"summary\\":\\"...\\",\\"acceptance\\":\\"...\\"}]" --strategy "' + plan.strategy + '" --evidence "<why this workflow fits>"');
     }
     console.log('   - Enter selected workflow after planning: node "' + controller + '" start --session-id "' + persisted.sessionId + '"');
     console.log('   - Escape one declared stage: node "' + controller + '" escape --session-id "' + persisted.sessionId + '" --stage-id "<id>" --reason-code workflow-uncovered-scope --scope "<uncovered scope>" --evidence "<evidence>"');
@@ -175,7 +218,7 @@ function run(raw) {
   if (result && result.status !== 0) console.error('[Workflow Reminder] router returned status ' + result.status + '; contract observation is degraded, not blocking.');
 }
 
-if (typeof module !== 'undefined') module.exports = { isHostNotificationPrompt };
+if (typeof module !== 'undefined') module.exports = { isHostNotificationPrompt, activeExecutionFor };
 
 if (process.argv.length > 2 || process.stdin.isTTY) run('');
 else {  let input = '';