harness-everything 0.30.10 → 0.31.1

package/plugins/harness-everything/hooks/scripts/workflow-disposition.js

@@ -6,11 +6,15 @@ const path = require('path');
 const { loadWorkflow, saveWorkflow, matchingRun, OPEN_STATES, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
 const { getWorkspaceRoot, readCurrentSession } = require('./lib/harness-state');
 const { atomicWriteJson, readJson } = require('./lib/fable-contracts');
+const { resolveBinding } = require('./lib/binding-resolver');
 const {
   planningUnresolved,
   recordPlanning,
   materializeExecutionObligations,
   updateObligation,
+  updateBinding,
+  updateStep,
+  activeStepSnapshot,
 } = require('./lib/workflow-obligations');
 
 const ALLOWED_ESCAPE_REASONS = new Set(['workflow-uncovered-scope', 'host-capability-unavailable']);
@@ -21,6 +25,7 @@ function parseArgs(argv) {
     ['--reason-code', 'reasonCode'], ['--scope', 'scope'], ['--evidence', 'evidence'],
     ['--session-id', 'sessionId'], ['--stage-id', 'stageId'],
     ['--obligation-id', 'obligationId'], ['--disposition', 'disposition'],
+    ['--step-id', 'stepId'], ['--binding-id', 'bindingId'],
     ['--requirements-json', 'requirementsJson'], ['--strategy', 'strategy'],
   ]);
   for (let i = 1; i < argv.length; i++) {
@@ -32,7 +37,7 @@ function parseArgs(argv) {
 }
 
 function usage() {
-  return `Usage: workflow-disposition.js <${[...WORKFLOW_CONTROLLER_COMMANDS].join('|')}> --session-id <id> [--requirements-json <json> --strategy <strategy> --obligation-id <id> --disposition <pass|escaped|blocked> --reason-code <reason> --scope <scope> --evidence <evidence>]`;
+  return `Usage: workflow-disposition.js <${[...WORKFLOW_CONTROLLER_COMMANDS].join('|')}> --session-id <id> [--requirements-json <json> --strategy <strategy> --obligation-id <id> --step-id <id> --binding-id <id> --disposition <pass|blocked|escaped|loaded|not-needed|unavailable> --reason-code <reason> --scope <scope> --evidence <evidence>]`;
 }
 
 const SELECTABLE_STRATEGIES = new Set(['direct-single', 'iterative-single', 'fable-staged', 'fable-parallel', 'fable-multi-agent-workspace']);
@@ -65,6 +70,7 @@ function recomposePlan(workflow, requestedStrategy) {
     taskShape,
     actionGateReasonCodes: workflow.workflowPlan.actionGate?.reasonCodes || [],
     reasonCodes: ['post-decomposition-workflow-selection'],
+    knowledgeSignals: workflow.workflowPlan.knowledgeSignals || [],
   });
 }
 
@@ -76,6 +82,61 @@ function consumer() {
   throw new Error('Fable consumer unavailable');
 }
 
+function stageBindingDisposition(context, args) {
+  if (!String(context.workflow.strategy || '').startsWith('fable-')) throw new Error('stage bindings are only available on Fable workflows');
+  if (context.workflow.state !== 'running') throw new Error('start the selected Fable workflow before resolving stage bindings');
+  const match = matchingRun(context);
+  if (!match || !match.run.stageIds.includes(args.stageId)) throw new Error('--stage-id must name a stage in the correlated active run');
+  if (!['loaded', 'not-needed', 'unavailable'].includes(args.disposition)) throw new Error('--disposition must be loaded, not-needed, or unavailable');
+  const evidence = String(args.evidence || '').trim();
+  if (!evidence) throw new Error('--evidence is required for every binding disposition');
+  const active = consumer().activeStageBindings(match.runRoot, context.workflow.escapes);
+  if (!active.some(stage => stage.stageId === args.stageId)) throw new Error('stage bindings may only be resolved for a dependency-ready active stage');
+  const contractPath = path.join(match.runRoot, 'contracts', `${args.stageId}.json`);
+  const contract = readJson(contractPath);
+  if (!contract || contract.runId !== match.run.runId || contract.stageId !== args.stageId) throw new Error('stage contract is missing or uncorrelated');
+  const binding = [...(contract.requiredBindings || []), ...(contract.optionalBindings || [])]
+    .find(item => item.id === args.bindingId);
+  if (!binding) throw new Error('--binding-id must name a binding declared on the stage');
+  const required = binding.required !== false;
+  if (required && args.disposition === 'not-needed') throw new Error('required bindings cannot be marked not-needed');
+  if (!required && args.disposition === 'unavailable') throw new Error('optional bindings require loaded or not-needed disposition');
+
+  let disposition = args.disposition;
+  let reasonCode = disposition === 'unavailable' ? String(args.reasonCode || 'binding-unavailable') : null;
+  let availability = disposition === 'unavailable' ? 'unavailable' : binding.availability;
+  if (disposition === 'loaded') {
+    const resolution = resolveBinding(binding, context.root);
+    availability = resolution.availability;
+    binding.resolvedPath = resolution.file;
+    if (resolution.availability !== 'available') {
+      disposition = 'unavailable';
+      reasonCode = resolution.availability === 'unknown' ? 'binding-path-unknown' : 'binding-path-missing';
+    }
+  }
+  binding.status = disposition;
+  binding.availability = availability;
+  binding.evidence = evidence;
+  binding.reasonCode = reasonCode;
+  binding.updatedAt = new Date().toISOString();
+  contract.updatedAt = binding.updatedAt;
+  atomicWriteJson(contractPath, contract);
+  return {
+    stageId: contract.stageId,
+    binding: { id: binding.id, required, status: binding.status, availability: binding.availability, path: binding.path, resolvedPath: binding.resolvedPath || null, reasonCode: binding.reasonCode },
+    activeStages: consumer().activeStageBindings(match.runRoot, context.workflow.escapes),
+  };
+}
+
+function activeStepCommandHints(sessionId, activeStep) {
+  if (!activeStep) return null;
+  const controller = path.resolve(__filename);
+  return {
+    resolveBinding: `node "${controller}" binding --session-id "${sessionId}" --step-id "${activeStep.id}" --binding-id "<active-binding-id>" --disposition <loaded|not-needed|unavailable> --evidence "<binding evidence>"`,
+    passStep: `node "${controller}" step --session-id "${sessionId}" --step-id "${activeStep.id}" --disposition pass --evidence "<completion evidence>"`,
+  };
+}
+
 function activatePlan(workflow, plan) {
   workflow.workflowPlan = plan;
   workflow.strategy = plan.strategy;
@@ -129,11 +190,14 @@ function main() {
       delete workflow.blockReason;
       const obligations = materializeExecutionObligations(context, plan);
       saveWorkflow(context);
+      const activeStep = activeStepSnapshot(obligations);
       process.stdout.write(JSON.stringify({
         state: workflow.state,
         workflowId: workflow.workflowId,
         revision: workflow.revision,
         obligations: obligations ? obligations.obligations.map(item => ({ id: item.id, status: item.status })) : [],
+        activeStep,
+        activeStepCommands: activeStepCommandHints(sessionId, activeStep),
       }) + '\n');
       return;
     }
@@ -156,6 +220,11 @@ function main() {
     workflow.escapes = [];
     delete workflow.pendingPlan;
     delete workflow.blockReason;
+  } else if (args.command === 'stage-binding') {
+    const result = stageBindingDisposition(context, args);
+    saveWorkflow(context);
+    process.stdout.write(JSON.stringify({ state: workflow.state, workflowId: workflow.workflowId, runId: workflow.runId, ...result }) + '\n');
+    return;
   } else if (args.command === 'obligation') {
     if (String(workflow.strategy || '').startsWith('fable-')) throw new Error('Fable workflows use correlated stage contracts, not generic execution obligations');
     if (workflow.state !== 'running') throw new Error('start the selected workflow before recording execution obligation dispositions');
@@ -175,6 +244,46 @@ function main() {
       },
     }) + '\n');
     return;
+  } else if (args.command === 'binding') {
+    if (String(workflow.strategy || '').startsWith('fable-')) throw new Error('Fable workflows use correlated stage contracts, not generic step bindings');
+    if (workflow.state !== 'running') throw new Error('start the selected workflow before resolving step bindings');
+    const result = updateBinding(context, args.stepId, args.bindingId, args.disposition, {
+      evidence: args.evidence,
+      reasonCode: args.reasonCode,
+    });
+    process.stdout.write(JSON.stringify({
+      state: workflow.state,
+      workflowId: workflow.workflowId,
+      binding: {
+        id: result.binding.id,
+        status: result.binding.status,
+        availability: result.binding.availability,
+        resolvedPath: result.binding.resolvedPath || null,
+        evidence: result.binding.evidence,
+      },
+      activeStep: result.activeStep,
+      activeStepCommands: activeStepCommandHints(sessionId, result.activeStep),
+    }) + '\n');
+    return;
+  } else if (args.command === 'step') {
+    if (String(workflow.strategy || '').startsWith('fable-')) throw new Error('Fable workflows use correlated stage contracts, not generic step dispositions');
+    if (workflow.state !== 'running') throw new Error('start the selected workflow before recording step dispositions');
+    const result = updateStep(context, args.stepId, args.disposition, {
+      evidence: args.evidence,
+      reasonCode: args.reasonCode,
+    });
+    process.stdout.write(JSON.stringify({
+      state: workflow.state,
+      workflowId: workflow.workflowId,
+      step: {
+        id: result.step.id,
+        status: result.step.status,
+        evidence: result.step.evidence,
+      },
+      activeStep: result.activeStep,
+      activeStepCommands: activeStepCommandHints(sessionId, result.activeStep),
+    }) + '\n');
+    return;
   } else if (args.command === 'revision') {
     console.error('[Workflow Reminder] Revision requested; no hard revision budget is enforced.');
   } else if (args.command === 'escape') {
@@ -198,7 +307,12 @@ function main() {
   } else throw new Error(usage());
 
   saveWorkflow(context);
-  process.stdout.write(JSON.stringify({ state: workflow.state, workflowId: workflow.workflowId, runId: workflow.runId, revision: workflow.revision, escapes: workflow.escapes }) + '\n');
+  const match = matchingRun(context);
+  process.stdout.write(JSON.stringify({
+    state: workflow.state, workflowId: workflow.workflowId, runId: workflow.runId,
+    revision: workflow.revision, escapes: workflow.escapes,
+    activeStages: match && String(workflow.strategy || '').startsWith('fable-') ? consumer().activeStageBindings(match.runRoot, workflow.escapes) : undefined,
+  }) + '\n');
 }
 
 try { main(); } catch (error) { console.error('[Workflow Disposition] ' + error.message); process.exitCode = 2; }

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.30.10",
+  "version": "0.31.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/scripts/lib/advisory-text.js

@@ -12,7 +12,7 @@ const advisoryInstructions = [
   `## 🚦 ENTRY TRIAGE & SEMANTIC CONTRACT`,
   `For software/project work, load the \`harness-everything\` skill and establish routing context before broad mutation:`,
   `1. MUST route before broad mutation; run \`npx github:dyphn1/Harness-everything next "<Brief summary of user's prompt>"\` when terminal execution is available and no equivalent routing state was injected.`,
-  `2. MUST read/evaluate EVERY suggested skill. If applicable, MUST follow its core contract; if not-applicable, keep a flow-grounded reason.`,
+  `2. MUST decompose Tier 2/3 work into ordered requirement steps with required/optional knowledge bindings. Load only active-step bindings; required bindings and applicable skill core contracts MUST resolve before the step passes.`,
   `3. Selected-topology required obligations are MUSTs. Implementation tactics MAY adapt; numeric iteration/revision/replan/worker values MAY guide planning but never hard-block.`,
   `4. MUST verify before claiming completion. Tier-3/Fable broad mutation MUST resolve isolation: linked worktree or explicit degraded fallback.`,
   `5. Use the routing checkpoint only as internal source state for the first Harness Status; do not render a competing progress block.`,
@@ -148,7 +148,7 @@ function buildCodexGlobalContent() {
     `- MUST establish relevant environment/host facts before relying on environment-sensitive behavior.`,
     `- For software/project work, MUST establish routing before broad mutation; use \`npx github:dyphn1/Harness-everything next "<summary>"\` when terminal execution is available and routing state was not already injected.`,
     `- For non-trivial work, MUST render one Markdown \`### 🚦 Harness Status\` with bullet-aligned bold \`Current\`, \`Read / Evidence\`, \`Next\`, and optional \`Risk / Blocked\`; repeat it at major phase/direction boundaries and before final completion.`,
-    `- MUST read/evaluate every suggested skill; applicable skill core contracts MUST be followed, while not-applicable needs a flow-grounded reason.`,
+    `- MUST declare required/optional skills and references on ordered steps; load only active bindings and follow applicable skill core contracts before the step passes.`,
     `- Selected-topology required obligations are MUSTs; implementation tactics MAY adapt and numeric planning values MAY guide but never hard-block.`,
     `- Do not impose a universal TODO/TDD/Fable sequence; use the smallest useful topology plus applicable skills.`,
     `- MUST verify before declaring done; a reminder-only host mechanism does not make verification optional.`,

package/plugins/harness-everything/scripts/lib/generated-skills.js

@@ -0,0 +1,78 @@
+'use strict';
+
+// Metadata-only lookup of self-evolved skills registered in Harness
+// manifests. The router uses it to emit step-input signals (ids only); the
+// workflow runtime uses it to resolve a declared binding id to its SKILL.md
+// once the declaring step is active. Nothing here reads or injects skill text.
+const fs = require('fs');
+const path = require('path');
+
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const STOP_TRIGGERS = new Set(['the', 'and', 'for', 'with', 'your', 'this', 'that', 'some', 'from', 'prevent', 'resolved']);
+
+function generatedManifestPaths(workspaceRoot, homeDir = process.env.HOME || process.env.USERPROFILE || '') {
+  const paths = [];
+  if (workspaceRoot) {
+    for (const platform of ['.claude', '.cursor', '.github', '.codex', '.continue']) {
+      paths.push(path.join(workspaceRoot, platform, 'harness-everything', 'manifest.json'));
+    }
+  }
+  if (homeDir) {
+    paths.push(path.join(homeDir, '.agents', 'harness-everything', 'manifest.json'));
+    paths.push(path.join(homeDir, '.claude', 'harness-everything', 'manifest.json'));
+  }
+  return paths;
+}
+
+function readGeneratedSkills(workspaceRoot, homeDir) {
+  const skills = new Map();
+  for (const manifestPath of generatedManifestPaths(workspaceRoot, homeDir)) {
+    let data;
+    try { data = JSON.parse(fs.readFileSync(manifestPath, 'utf8')); } catch (_) { continue; }
+    if (!Array.isArray(data?.generated)) continue;
+    for (const entry of data.generated) {
+      const id = typeof entry?.id === 'string' ? entry.id.trim() : '';
+      if (!SAFE_ID.test(id) || skills.has(id) || typeof entry.dirPath !== 'string' || !entry.dirPath.trim()) continue;
+      const dirPath = path.isAbsolute(entry.dirPath)
+        ? entry.dirPath
+        : path.resolve(workspaceRoot || path.dirname(manifestPath), entry.dirPath);
+      skills.set(id, {
+        id,
+        dirPath,
+        triggers: Array.isArray(entry.triggers) ? entry.triggers.filter(value => typeof value === 'string') : [],
+      });
+    }
+  }
+  return skills;
+}
+
+function triggerScore(promptLower, rawTrigger) {
+  const trigger = rawTrigger.toLowerCase().trim();
+  if (trigger.length < 2 || STOP_TRIGGERS.has(trigger)) return 0;
+  if (/[一-龥]/.test(trigger)) return promptLower.includes(trigger) ? trigger.length * 2 : 0;
+  const escaped = trigger.replace(/[-/\\^$*+?.()|[\]{}]/g, '\\$&');
+  if (!new RegExp(`\\b${escaped}\\b`, 'i').test(promptLower)) return 0;
+  return trigger.length >= 4 ? 3 : 1.5;
+}
+
+// Returns matching generated-skill ids, strongest match first.
+function matchGeneratedSkills(promptLower, skills) {
+  const matched = [];
+  for (const skill of skills.values()) {
+    const score = skill.triggers.reduce((total, trigger) => total + triggerScore(promptLower, trigger), 0);
+    if (score >= 3) matched.push({ id: skill.id, score });
+  }
+  return matched.sort((a, b) => b.score - a.score).map(item => item.id);
+}
+
+function findGeneratedSkill(id, workspaceRoot, homeDir) {
+  if (!SAFE_ID.test(id || '')) return null;
+  return readGeneratedSkills(workspaceRoot, homeDir).get(id) || null;
+}
+
+module.exports = {
+  generatedManifestPaths,
+  readGeneratedSkills,
+  matchGeneratedSkills,
+  findGeneratedSkill,
+};

package/plugins/harness-everything/scripts/lib/verification-contract.js

@@ -303,6 +303,7 @@ function verificationCommandSet(cwd, options = {}) {
       contract,
       contractInvalid: false,
       commands: contract.checks.map(check => check.run),
+      checks: contract.checks.map(check => ({ run: check.run, cwd: check.cwd })),
       commitHookDeclared: contract.checks.some(check => /^pre-commit\s+/i.test(normalizeCommand(check.run))),
     };
   }
@@ -323,7 +324,75 @@ function verificationCommandSet(cwd, options = {}) {
   };
 }
 
+// Hosts such as Claude Code on Windows Bash may prefix a shell call with a
+// working-directory prelude: `cd <workspace> && <command>`. Recognize exactly
+// one such prelude lexically (never evaluating shell text) and only when the
+// target is an existing directory inside the repository root. Only spellings
+// whose Bash destination is stable are accepted: absolute paths or explicit
+// ./ and ../ relatives. Bare relatives are CDPATH-sensitive, and option-like
+// targets (-, --, -P ...) change cd semantics, so both fail closed. The remaining
+// command must be one plain command: no further control operators,
+// redirection, substitution, expansion, subshell, or background syntax.
+const CWD_PRELUDE_RE = /^cd\s+(?:"([^"]*)"|'([^']*)'|([A-Za-z0-9_./:@%+,-]+))\s*&&\s*([\s\S]+)$/;
+const UNSAFE_WRAPPED_RE = /[`$<>&|;()\r\n]/;
+const UNSAFE_DOUBLE_QUOTED_RE = /[$`!]|\\[\\"$`]|\\$/;
+
+function hostPathToNative(value, platform = process.platform) {
+  if (platform !== 'win32') return value;
+  const drive = value.match(/^\/([A-Za-z])(?:\/([\s\S]*))?$/);
+  return drive ? `${drive[1].toUpperCase()}:\\${(drive[2] || '').replace(/\//g, '\\')}` : value;
+}
+
+function stableCdTarget(target, platform = process.platform) {
+  if (target.startsWith('-')) return false;
+  if (/^\.\.?(?:\/|$)/.test(target)) return true;
+  if (platform === 'win32') {
+    if (/^\.\.?\\/.test(target) || /^[A-Za-z]:[\\/]/.test(target)) return true;
+    // Git Bash maps only /<drive>/... onto Windows paths; other absolute
+    // POSIX paths (/tmp, /usr) are MSYS mounts that Node cannot resolve alike.
+    return /^\/[A-Za-z](?:\/|$)/.test(target);
+  }
+  return target.startsWith('/');
+}
+
+function parseCwdPrelude(command, options = {}) {
+  const match = String(command || '').trim().match(CWD_PRELUDE_RE);
+  if (!match) return null;
+  const [, doubleQuoted, singleQuoted, bare, restRaw] = match;
+  const target = doubleQuoted ?? singleQuoted ?? bare;
+  const rest = restRaw.trim();
+  if (!target || !rest) return null;
+  if (doubleQuoted !== undefined && UNSAFE_DOUBLE_QUOTED_RE.test(target)) return null;
+  if (UNSAFE_WRAPPED_RE.test(rest) || hasControlOperators(rest)) return null;
+  if (!stableCdTarget(target, options.platform)) return null;
+
+  const cwd = path.resolve(options.cwd || process.cwd());
+  let resolved;
+  let root;
+  try {
+    resolved = fs.realpathSync.native(path.resolve(cwd, hostPathToNative(target, options.platform)));
+    if (!fs.statSync(resolved).isDirectory()) return null;
+    root = fs.realpathSync.native(path.resolve(options.root || findGitRoot(cwd)));
+  } catch (_) {
+    return null;
+  }
+  if (!within(root, resolved)) return null;
+  return { cwd: resolved, command: rest };
+}
+
 function isVerificationCommand(command, options = {}) {
+  const wrapped = parseCwdPrelude(command, options);
+  if (wrapped) return isPlainVerificationCommand(wrapped.command, { ...options, cwd: wrapped.cwd });
+  return isPlainVerificationCommand(command, options);
+}
+
+function cwdKey(dir) {
+  let resolved = path.resolve(dir);
+  try { resolved = fs.realpathSync.native(resolved); } catch (_) {}
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+
+function isPlainVerificationCommand(command, options = {}) {
   const cwd = path.resolve(options.cwd || process.cwd());
   const actual = normalizeCommand(command);
   if (!actual || hasControlOperators(actual)) return false;
@@ -333,8 +402,15 @@ function isVerificationCommand(command, options = {}) {
   if (isGitCommit(actual)) {
     return !!set.commitHookDeclared && !bypassesHooks(actual) && hasCommitHook(set.repoRoot);
   }
+  // A declared contract check counts only when it ran in its declared cwd;
+  // otherwise a matching command in another directory (e.g. a subproject)
+  // would be credited as the root check.
+  if (set.contract) {
+    const executed = cwdKey(cwd);
+    return set.checks.some(check => commandMatches(actual, check.run) && cwdKey(check.cwd) === executed);
+  }
   if (set.commands.some(expected => commandMatches(actual, expected))) return true;
-  return !set.contract && legacyVerificationCommand(actual);
+  return legacyVerificationCommand(actual);
 }
 
 module.exports = {
@@ -350,6 +426,7 @@ module.exports = {
   isVerificationCommand,
   legacyVerificationCommand,
   normalizeCommand,
+  parseCwdPrelude,
   readContract,
   resolveContained,
   verificationCommandSet,

package/plugins/harness-everything/skills/fable-mode/CONTRACT-FORMAT.md

@@ -37,6 +37,8 @@ Every planned stage declares dependency and write scope before dispatch:
   "outputPath": "path/to/artifact-or-null",
   "dependsOn": ["stage-1"],
   "writeSet": ["src/auth", "tests/auth.test.js"],
+  "requiredBindings": [{ "id": "tdd", "path": "tdd/SKILL.md" }],
+  "optionalBindings": [{ "id": "security-review", "path": "security-review/SKILL.md" }],
   "checkCommand": "node --test tests/auth.test.js",
   "passCondition": "exit 0",
   "failureReturn": "failure summary + evidence + missing prerequisite"
@@ -48,6 +50,7 @@ Rules:
 - `stageId`, `goal`, `agent`, and `task` are required.
 - `dependsOn` is always explicit. Use `[]` for a root stage.
 - `writeSet` is always explicit. Use `[]` for a read-only stage.
+- `requiredBindings` and `optionalBindings` are optional arrays. Each entry is a stable `id` and may declare a concrete repository-relative `path`; paths reject absolute names, globs, and traversal. Availability is `available` only when the path resolves to a readable file: workspace references resolve only under the workspace, while recognized Harness bindings (a registered id at its registered path, or a skill id naming its own `<id>/SKILL.md`) also search installed Harness skill roots (`missing` otherwise; `unverified` when no hook runtime is installed). An id without a path resolves through self-evolved manifest metadata, else remains visible with unknown availability. A binding that does not resolve cannot be recorded as `loaded`.
 - `writeSet` contains concrete repository-relative path scopes, not globs,
   absolute paths, or `..` traversal.
 - a directory scope covers descendants; overlapping scopes cannot run in the
@@ -60,7 +63,7 @@ Rules:
 
 ## Workflow-plan consumer
 
-For a session with an active mandatory workflow, write the stage array to the router-displayed `workflow-stages.json` path and invoke its `workflow-disposition.js start --session-id <id>` command. This binds the run to the active `workflowId` and bound workspace even after entering a linked worktree. Every required stage needs an objective check, and an independent plan needs a read-only `fable-verifier` stage depending on all other stages. Stage results need observed worker identities and numeric exit codes; missing metadata is blocked/degraded, not success.
+For a session with an active mandatory workflow, write the stage array to the router-displayed `workflow-stages.json` path and invoke its `workflow-disposition.js start --session-id <id>` command. This binds the run to the active `workflowId` and bound workspace even after entering a linked worktree. The start/check output exposes bindings only for dependency-ready stages; future-stage paths stay undisclosed. Resolve an active binding with `workflow-disposition.js stage-binding --stage-id <id> --binding-id <id> --disposition loaded|not-needed|unavailable --evidence <evidence>`. A successful check with unresolved bindings records `binding-unresolved`; resolve them, then rerun the exact check before the stage can pass. This state is a reminder, not a tool or Stop lock. Every required stage needs an objective check, and an independent plan needs a read-only `fable-verifier` stage depending on all other stages. Stage results need observed worker identities and numeric exit codes; missing metadata is unresolved, not success.
 
 For standalone use without an active session contract, write the router contract and stage array to files and run:
 

package/plugins/harness-everything/skills/fable-mode/SKILL.md

@@ -4,7 +4,7 @@ description: "Stage large tasks through plans, named fable agents, failable chec
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.7
+  version: 0.31.0
 ---
 
 # Fable Mode
@@ -29,17 +29,15 @@ metadata:
 
 ## Select Operation First
 
-For explanation/profile-only lookup, read only `<this-skill-dir>/references/profile-lookup.md` and answer. No stage state, delegation, or selector source reads. Quoted aliases do not start Fable. Mixed execution retains its topology.
-
-Execution follows the workflow below.
+For explanation/profile-only lookup, read only `<this-skill-dir>/references/profile-lookup.md` and answer. No stage state, delegation, or selector source reads. Quoted aliases do not start Fable. Mixed execution retains its topology; execution follows the workflow below.
 
 ## Workflow
 
 1. Discover the runtime and lock the authorized file scope before edits.
-2. Set artifact/check per stage; advisory replans never halt. Rule-of-3 applies to 3 same-signature failures.
+2. Per stage, set artifact, check, and required/optional bindings; dependency-ready stages disclose them, passing once resolved. Gaps never lock tools or Stop; advisory replans never halt. Rule-of-3 covers same-signature failures.
 3. Resolve the requested behavior profile with `model-selector.js`; `opus`, `sonnet`/`sonnect`, and `haiku` are compatibility aliases, not model bindings.
-4. Delegate by profile: orchestrator coordinates, reasoning handles bounded judgment, mechanical handles low-ambiguity work, and workers never spawn workers.
-5. Treat the host runtime-model floor as advisory; record its status without blocking Fable solely for model choice.
-6. Run each stage check, cold-review high-stakes artifacts, and audit profile/runtime/fallback fields.
+4. Delegate by profile: orchestrator coordinates, reasoning takes bounded judgment, mechanical takes low-ambiguity work; workers never spawn workers.
+5. The host runtime-model floor is advisory; record it, never block on model choice alone.
+6. Run stage checks, cold-review high-stakes artifacts, and audit profile/runtime/fallback fields.
 
 Deep dive: <this-skill-dir>/references/model-matrix.md

package/plugins/harness-everything/skills/fable-mode/agents/fable-orchestrator.md

@@ -45,6 +45,12 @@ first. Every stage declares `stageId`, goal, named agent, self-contained task,
 expected output, `dependsOn`, and `writeSet` per
 `fable-mode/CONTRACT-FORMAT.md`. `dependsOn: []` means no prerequisite;
 `writeSet: []` means read-only. Workers never widen their own write set.
+Declare stage-specific `requiredBindings` and `optionalBindings` in the same
+contract. The consumer/start/check output exposes paths only for dependency-ready
+stages; never preload bindings from future stages. Resolve active bindings with
+`workflow-disposition.js stage-binding` and evidence before passing the stage.
+If its objective check passes while bindings remain unresolved, the contract
+records `binding-unresolved`; resolve the bindings and rerun that exact check.
 
 Pass the router contract and stage array through
 `fable-mode/scripts/workflow-plan-consumer.js` before spawning anything. Use the
@@ -97,10 +103,11 @@ that stage's check before continuing.
 The run-scoped contract already exists before execution. When its exact
 `checkCommand` runs, `contract-test.js` correlates it to one
 `planId/runId/stageId`, updates that contract, and writes
-`evidence/<stageId>.json`. If the command is ambiguous across runs, none of the
-contracts is updated and the ambiguity must be resolved. Before delivery,
+`evidence/<stageId>.json`. A `pass` requires both an objective check and
+resolved declared bindings. If the command is ambiguous across runs, none of
+the contracts is updated and the ambiguity must be resolved. Before delivery,
 confirm every check-bearing contract in this run is `pass`; `planned`,
-`running`, `pending`, or `fail` is not delivery evidence.
+`running`, `pending`, `fail`, or `binding-unresolved` is not delivery evidence.
 
 The subagent scope guard separately compares worker changes to the immutable
 `writeSet` snapshot captured at burst start. An in-scope change is not proof of

package/plugins/harness-everything/skills/fable-mode/execution-guardrails/SKILL.md

@@ -4,7 +4,7 @@ description: "Reference guardrails for verified warnings and safe replacements;
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.7
+  version: 0.31.0
 ---
 
 # Execution Guardrails

package/plugins/harness-everything/skills/fable-mode/fable-haiku/SKILL.md

@@ -4,7 +4,7 @@ description: "Reference mechanical behavior profile (legacy alias haiku) for bul
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.7
+  version: 0.31.0
 ---
 
 # Fable Mode — Haiku

package/plugins/harness-everything/skills/fable-mode/fable-opus/SKILL.md

@@ -4,7 +4,7 @@ description: "Reference orchestrator behavior profile (legacy alias opus) for st
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.7
+  version: 0.31.0
 ---
 
 # Fable Mode — Opus

package/plugins/harness-everything/skills/fable-mode/fable-sonnet/SKILL.md

@@ -4,7 +4,7 @@ description: "Reference reasoning behavior profile (legacy alias sonnet/sonnect)
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.7
+  version: 0.31.0
 ---
 
 # Fable Mode — Sonnet