harness-everything 0.30.9 → 0.31.0

package/plugins/harness-everything/scripts/lib/generated-skills.js

@@ -0,0 +1,78 @@
+'use strict';
+
+// Metadata-only lookup of self-evolved skills registered in Harness
+// manifests. The router uses it to emit step-input signals (ids only); the
+// workflow runtime uses it to resolve a declared binding id to its SKILL.md
+// once the declaring step is active. Nothing here reads or injects skill text.
+const fs = require('fs');
+const path = require('path');
+
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const STOP_TRIGGERS = new Set(['the', 'and', 'for', 'with', 'your', 'this', 'that', 'some', 'from', 'prevent', 'resolved']);
+
+function generatedManifestPaths(workspaceRoot, homeDir = process.env.HOME || process.env.USERPROFILE || '') {
+  const paths = [];
+  if (workspaceRoot) {
+    for (const platform of ['.claude', '.cursor', '.github', '.codex', '.continue']) {
+      paths.push(path.join(workspaceRoot, platform, 'harness-everything', 'manifest.json'));
+    }
+  }
+  if (homeDir) {
+    paths.push(path.join(homeDir, '.agents', 'harness-everything', 'manifest.json'));
+    paths.push(path.join(homeDir, '.claude', 'harness-everything', 'manifest.json'));
+  }
+  return paths;
+}
+
+function readGeneratedSkills(workspaceRoot, homeDir) {
+  const skills = new Map();
+  for (const manifestPath of generatedManifestPaths(workspaceRoot, homeDir)) {
+    let data;
+    try { data = JSON.parse(fs.readFileSync(manifestPath, 'utf8')); } catch (_) { continue; }
+    if (!Array.isArray(data?.generated)) continue;
+    for (const entry of data.generated) {
+      const id = typeof entry?.id === 'string' ? entry.id.trim() : '';
+      if (!SAFE_ID.test(id) || skills.has(id) || typeof entry.dirPath !== 'string' || !entry.dirPath.trim()) continue;
+      const dirPath = path.isAbsolute(entry.dirPath)
+        ? entry.dirPath
+        : path.resolve(workspaceRoot || path.dirname(manifestPath), entry.dirPath);
+      skills.set(id, {
+        id,
+        dirPath,
+        triggers: Array.isArray(entry.triggers) ? entry.triggers.filter(value => typeof value === 'string') : [],
+      });
+    }
+  }
+  return skills;
+}
+
+function triggerScore(promptLower, rawTrigger) {
+  const trigger = rawTrigger.toLowerCase().trim();
+  if (trigger.length < 2 || STOP_TRIGGERS.has(trigger)) return 0;
+  if (/[一-龥]/.test(trigger)) return promptLower.includes(trigger) ? trigger.length * 2 : 0;
+  const escaped = trigger.replace(/[-/\\^$*+?.()|[\]{}]/g, '\\$&');
+  if (!new RegExp(`\\b${escaped}\\b`, 'i').test(promptLower)) return 0;
+  return trigger.length >= 4 ? 3 : 1.5;
+}
+
+// Returns matching generated-skill ids, strongest match first.
+function matchGeneratedSkills(promptLower, skills) {
+  const matched = [];
+  for (const skill of skills.values()) {
+    const score = skill.triggers.reduce((total, trigger) => total + triggerScore(promptLower, trigger), 0);
+    if (score >= 3) matched.push({ id: skill.id, score });
+  }
+  return matched.sort((a, b) => b.score - a.score).map(item => item.id);
+}
+
+function findGeneratedSkill(id, workspaceRoot, homeDir) {
+  if (!SAFE_ID.test(id || '')) return null;
+  return readGeneratedSkills(workspaceRoot, homeDir).get(id) || null;
+}
+
+module.exports = {
+  generatedManifestPaths,
+  readGeneratedSkills,
+  matchGeneratedSkills,
+  findGeneratedSkill,
+};

package/plugins/harness-everything/skills/fable-mode/CONTRACT-FORMAT.md

@@ -37,6 +37,8 @@ Every planned stage declares dependency and write scope before dispatch:
   "outputPath": "path/to/artifact-or-null",
   "dependsOn": ["stage-1"],
   "writeSet": ["src/auth", "tests/auth.test.js"],
+  "requiredBindings": [{ "id": "tdd", "path": "tdd/SKILL.md" }],
+  "optionalBindings": [{ "id": "security-review", "path": "security-review/SKILL.md" }],
   "checkCommand": "node --test tests/auth.test.js",
   "passCondition": "exit 0",
   "failureReturn": "failure summary + evidence + missing prerequisite"
@@ -48,6 +50,7 @@ Rules:
 - `stageId`, `goal`, `agent`, and `task` are required.
 - `dependsOn` is always explicit. Use `[]` for a root stage.
 - `writeSet` is always explicit. Use `[]` for a read-only stage.
+- `requiredBindings` and `optionalBindings` are optional arrays. Each entry is a stable `id` and may declare a concrete repository-relative `path`; paths reject absolute names, globs, and traversal. Availability is `available` only when the path resolves to a readable file: workspace references resolve only under the workspace, while recognized Harness bindings (a registered id at its registered path, or a skill id naming its own `<id>/SKILL.md`) also search installed Harness skill roots (`missing` otherwise; `unverified` when no hook runtime is installed). An id without a path resolves through self-evolved manifest metadata, else remains visible with unknown availability. A binding that does not resolve cannot be recorded as `loaded`.
 - `writeSet` contains concrete repository-relative path scopes, not globs,
   absolute paths, or `..` traversal.
 - a directory scope covers descendants; overlapping scopes cannot run in the
@@ -60,7 +63,7 @@ Rules:
 
 ## Workflow-plan consumer
 
-For a session with an active mandatory workflow, write the stage array to the router-displayed `workflow-stages.json` path and invoke its `workflow-disposition.js start --session-id <id>` command. This binds the run to the active `workflowId` and bound workspace even after entering a linked worktree. Every required stage needs an objective check, and an independent plan needs a read-only `fable-verifier` stage depending on all other stages. Stage results need observed worker identities and numeric exit codes; missing metadata is blocked/degraded, not success.
+For a session with an active mandatory workflow, write the stage array to the router-displayed `workflow-stages.json` path and invoke its `workflow-disposition.js start --session-id <id>` command. This binds the run to the active `workflowId` and bound workspace even after entering a linked worktree. The start/check output exposes bindings only for dependency-ready stages; future-stage paths stay undisclosed. Resolve an active binding with `workflow-disposition.js stage-binding --stage-id <id> --binding-id <id> --disposition loaded|not-needed|unavailable --evidence <evidence>`. A successful check with unresolved bindings records `binding-unresolved`; resolve them, then rerun the exact check before the stage can pass. This state is a reminder, not a tool or Stop lock. Every required stage needs an objective check, and an independent plan needs a read-only `fable-verifier` stage depending on all other stages. Stage results need observed worker identities and numeric exit codes; missing metadata is unresolved, not success.
 
 For standalone use without an active session contract, write the router contract and stage array to files and run:
 

package/plugins/harness-everything/skills/fable-mode/SKILL.md

@@ -4,7 +4,7 @@ description: "Stage large tasks through plans, named fable agents, failable chec
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.7
+  version: 0.31.0
 ---
 
 # Fable Mode
@@ -29,17 +29,15 @@ metadata:
 
 ## Select Operation First
 
-For explanation/profile-only lookup, read only `<this-skill-dir>/references/profile-lookup.md` and answer. No stage state, delegation, or selector source reads. Quoted aliases do not start Fable. Mixed execution retains its topology.
-
-Execution follows the workflow below.
+For explanation/profile-only lookup, read only `<this-skill-dir>/references/profile-lookup.md` and answer. No stage state, delegation, or selector source reads. Quoted aliases do not start Fable. Mixed execution retains its topology; execution follows the workflow below.
 
 ## Workflow
 
 1. Discover the runtime and lock the authorized file scope before edits.
-2. Set artifact/check per stage; advisory replans never halt. Rule-of-3 applies to 3 same-signature failures.
+2. Per stage, set artifact, check, and required/optional bindings; dependency-ready stages disclose them, passing once resolved. Gaps never lock tools or Stop; advisory replans never halt. Rule-of-3 covers same-signature failures.
 3. Resolve the requested behavior profile with `model-selector.js`; `opus`, `sonnet`/`sonnect`, and `haiku` are compatibility aliases, not model bindings.
-4. Delegate by profile: orchestrator coordinates, reasoning handles bounded judgment, mechanical handles low-ambiguity work, and workers never spawn workers.
-5. Treat the host runtime-model floor as advisory; record its status without blocking Fable solely for model choice.
-6. Run each stage check, cold-review high-stakes artifacts, and audit profile/runtime/fallback fields.
+4. Delegate by profile: orchestrator coordinates, reasoning takes bounded judgment, mechanical takes low-ambiguity work; workers never spawn workers.
+5. The host runtime-model floor is advisory; record it, never block on model choice alone.
+6. Run stage checks, cold-review high-stakes artifacts, and audit profile/runtime/fallback fields.
 
 Deep dive: <this-skill-dir>/references/model-matrix.md

package/plugins/harness-everything/skills/fable-mode/agents/fable-orchestrator.md

@@ -45,6 +45,12 @@ first. Every stage declares `stageId`, goal, named agent, self-contained task,
 expected output, `dependsOn`, and `writeSet` per
 `fable-mode/CONTRACT-FORMAT.md`. `dependsOn: []` means no prerequisite;
 `writeSet: []` means read-only. Workers never widen their own write set.
+Declare stage-specific `requiredBindings` and `optionalBindings` in the same
+contract. The consumer/start/check output exposes paths only for dependency-ready
+stages; never preload bindings from future stages. Resolve active bindings with
+`workflow-disposition.js stage-binding` and evidence before passing the stage.
+If its objective check passes while bindings remain unresolved, the contract
+records `binding-unresolved`; resolve the bindings and rerun that exact check.
 
 Pass the router contract and stage array through
 `fable-mode/scripts/workflow-plan-consumer.js` before spawning anything. Use the
@@ -97,10 +103,11 @@ that stage's check before continuing.
 The run-scoped contract already exists before execution. When its exact
 `checkCommand` runs, `contract-test.js` correlates it to one
 `planId/runId/stageId`, updates that contract, and writes
-`evidence/<stageId>.json`. If the command is ambiguous across runs, none of the
-contracts is updated and the ambiguity must be resolved. Before delivery,
+`evidence/<stageId>.json`. A `pass` requires both an objective check and
+resolved declared bindings. If the command is ambiguous across runs, none of
+the contracts is updated and the ambiguity must be resolved. Before delivery,
 confirm every check-bearing contract in this run is `pass`; `planned`,
-`running`, `pending`, or `fail` is not delivery evidence.
+`running`, `pending`, `fail`, or `binding-unresolved` is not delivery evidence.
 
 The subagent scope guard separately compares worker changes to the immutable
 `writeSet` snapshot captured at burst start. An in-scope change is not proof of

package/plugins/harness-everything/skills/fable-mode/execution-guardrails/SKILL.md

@@ -4,7 +4,7 @@ description: "Reference guardrails for verified warnings and safe replacements;
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.7
+  version: 0.31.0
 ---
 
 # Execution Guardrails

package/plugins/harness-everything/skills/fable-mode/fable-haiku/SKILL.md

@@ -4,7 +4,7 @@ description: "Reference mechanical behavior profile (legacy alias haiku) for bul
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.7
+  version: 0.31.0
 ---
 
 # Fable Mode — Haiku

package/plugins/harness-everything/skills/fable-mode/fable-opus/SKILL.md

@@ -4,7 +4,7 @@ description: "Reference orchestrator behavior profile (legacy alias opus) for st
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.7
+  version: 0.31.0
 ---
 
 # Fable Mode — Opus

package/plugins/harness-everything/skills/fable-mode/fable-sonnet/SKILL.md

@@ -4,7 +4,7 @@ description: "Reference reasoning behavior profile (legacy alias sonnet/sonnect)
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.7
+  version: 0.31.0
 ---
 
 # Fable Mode — Sonnet

package/plugins/harness-everything/skills/fable-mode/scripts/workflow-plan-consumer.js

@@ -63,7 +63,7 @@ function normalizeWritePath(value) {
   if (typeof value !== 'string' || !value.trim()) throw new Error('writeSet entries must be non-empty strings');
   let normalized = value.trim().replace(/\\/g, '/').replace(/^\.\//, '');
   normalized = normalized.replace(/\/+$/g, '');
-  if (!normalized || normalized.startsWith('/') || /^[A-Za-z]:\//.test(normalized)) {
+  if (!normalized || normalized.startsWith('/') || /^[A-Za-z]:/.test(normalized)) {
     throw new Error(`writeSet paths must be repository-relative: ${value}`);
   }
   const parts = normalized.split('/');
@@ -76,6 +76,95 @@ function normalizeWritePath(value) {
   return normalized;
 }
 
+// The resolver ships with the hook runtime. A Skills-only install has no hook
+// runtime, so declared paths stay `unverified` instead of claiming availability.
+function bindingResolver() {
+  for (const relative of ['../../hooks/scripts/lib/binding-resolver.js', '../../../hooks/scripts/lib/binding-resolver.js']) {
+    const file = path.resolve(__dirname, relative);
+    if (fs.existsSync(file)) return require(file);
+  }
+  return null;
+}
+
+function resolveStageBindingAvailability(bindings, workspaceRoot) {
+  const resolver = bindingResolver();
+  for (const binding of bindings) {
+    const resolution = resolver
+      ? resolver.resolveBinding(binding, workspaceRoot)
+      : { availability: binding.path ? 'unverified' : 'unknown', file: null };
+    binding.availability = resolution.availability;
+    binding.resolvedPath = resolution.file;
+  }
+}
+
+function normalizeBindings(values, label, required) {
+  if (values === undefined) return [];
+  if (!Array.isArray(values)) throw new Error(`${label} must be an array`);
+  const seen = new Set();
+  return values.map(raw => {
+    const value = typeof raw === 'string' ? { id: raw } : raw;
+    if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`${label} entries must be ids or objects`);
+    const id = sanitizeId(value.id, `${label}.id`);
+    if (seen.has(id)) throw new Error(`${label} contains duplicate binding: ${id}`);
+    seen.add(id);
+    const bindingPath = value.path === undefined || value.path === null || value.path === ''
+      ? null
+      : normalizeWritePath(value.path);
+    return {
+      id,
+      required,
+      path: bindingPath,
+      status: 'pending',
+      availability: bindingPath ? 'unverified' : 'unknown',
+      resolvedPath: null,
+      evidence: null,
+      reasonCode: null,
+      updatedAt: null,
+    };
+  });
+}
+
+function activeStageBindings(runRoot, escapes = []) {
+  const run = readJson(path.join(runRoot, 'run.json'));
+  if (!run || !Array.isArray(run.stageIds)) return [];
+  const contractsDir = path.join(runRoot, 'contracts');
+  const stages = new Map();
+  for (const stageId of run.stageIds) {
+    const stage = readJson(path.join(contractsDir, `${stageId}.json`));
+    if (stage && stage.runId === run.runId && stage.stageId === stageId) stages.set(stageId, stage);
+  }
+  const escapedIds = new Set((escapes || []).filter(item => item?.runId === run.runId && item?.evidence && item?.uncoveredScope &&
+    ['workflow-uncovered-scope', 'host-capability-unavailable'].includes(item.reasonCode))
+    .map(item => item.stageId));
+  const stagePassed = stage => stage?.status === 'pass' &&
+    (stage.requiredBindings || []).every(binding => binding.status === 'loaded') &&
+    (stage.optionalBindings || []).every(binding => ['loaded', 'not-needed'].includes(binding.status));
+  const bindingsResolved = stage =>
+    (stage.requiredBindings || []).every(binding => binding.status === 'loaded') &&
+    (stage.optionalBindings || []).every(binding => ['loaded', 'not-needed'].includes(binding.status));
+  return run.stageIds
+    .map(stageId => stages.get(stageId))
+    .filter(stage => stage && !escapedIds.has(stage.stageId) &&
+      (['planned', 'running', 'fail', 'binding-unresolved'].includes(stage.status) ||
+        (stage.status === 'pass' && !bindingsResolved(stage))) &&
+      (stage.dependsOn || []).every(id => stagePassed(stages.get(id)) || escapedIds.has(id)))
+    .map(stage => ({
+      stageId: stage.stageId,
+      goal: stage.goal,
+      status: stage.status === 'pass' && !bindingsResolved(stage) ? 'binding-unresolved' : stage.status,
+      requiredBindings: (stage.requiredBindings || []).map(binding => ({
+        id: binding.id, status: binding.status, availability: binding.availability, path: binding.path, resolvedPath: binding.resolvedPath || null,
+      })),
+      optionalBindings: (stage.optionalBindings || []).map(binding => ({
+        id: binding.id, status: binding.status, availability: binding.availability, path: binding.path, resolvedPath: binding.resolvedPath || null,
+      })),
+    }));
+}
+
+function readJson(filePath) {
+  try { return JSON.parse(fs.readFileSync(filePath, 'utf8')); } catch (_) { return null; }
+}
+
 function normalizeStage(raw) {
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('stage must be an object');
   const stageId = sanitizeId(raw.stageId, 'stageId');
@@ -87,6 +176,12 @@ function normalizeStage(raw) {
 
   const dependsOn = [...new Set(raw.dependsOn.map(value => sanitizeId(value, `${stageId}.dependsOn`)))];
   const writeSet = [...new Set(raw.writeSet.map(normalizeWritePath))].sort();
+  const requiredBindings = normalizeBindings(raw.requiredBindings, `${stageId}.requiredBindings`, true);
+  const optionalBindings = normalizeBindings(raw.optionalBindings, `${stageId}.optionalBindings`, false);
+  const bindingIds = new Set(requiredBindings.map(binding => binding.id));
+  for (const binding of optionalBindings) {
+    if (bindingIds.has(binding.id)) throw new Error(`${stageId}: binding cannot be both required and optional: ${binding.id}`);
+  }
 
   return {
     stageId,
@@ -98,6 +193,8 @@ function normalizeStage(raw) {
     outputPath: raw.outputPath === undefined ? null : raw.outputPath,
     dependsOn,
     writeSet,
+    requiredBindings,
+    optionalBindings,
     checkCommand: typeof raw.checkCommand === 'string' && raw.checkCommand.trim() ? raw.checkCommand.trim() : null,
     passCondition: typeof raw.passCondition === 'string' && raw.passCondition.trim() ? raw.passCondition.trim() : null,
     failureReturn: typeof raw.failureReturn === 'string' && raw.failureReturn.trim()
@@ -236,6 +333,7 @@ function prepareRun({ routerContract, stages, workspaceRoot, runId, sessionId =
   fs.mkdirSync(evidenceDir, { recursive: true });
 
   for (const stage of normalizedStages) {
+    resolveStageBindingAvailability([...stage.requiredBindings, ...stage.optionalBindings], root);
     atomicWriteJson(path.join(contractsDir, `${stage.stageId}.json`), {
       schemaVersion: STAGE_CONTRACT_VERSION,
       planId,
@@ -319,7 +417,7 @@ if (require.main === module) {
       runId: args.runId,
       sessionId: args.sessionId || null,
     });
-    process.stdout.write(`${JSON.stringify(manifest)}\n`);
+    process.stdout.write(`${JSON.stringify({ ...manifest, activeStages: activeStageBindings(manifest.runRoot) })}\n`);
   } catch (err) {
     console.error(`[FABLE PLAN CONSUMER] ${err.message}`);
     process.exit(2);
@@ -328,6 +426,7 @@ if (require.main === module) {
 
 module.exports = {
   STAGE_CONTRACT_VERSION,
+  activeStageBindings,
   derivePlanId,
   getWorkspaceKey,
   getWorkspaceStateRoot,

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: harness-everything
-description: "Route software/project work through Harness: classify tier/topology, resolve suggested skills, apply semantic obligations, and keep tactics flexible. Use for software triage/routing/re-routing; not general Q&A or non-software writing."
+description: "Route software/project work through Harness: classify tier/topology, compose active-step knowledge bindings, apply semantic obligations, and keep tactics flexible. Use for software triage/routing/re-routing; not general Q&A or non-software writing."
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.6
+  version: 0.31.0
 ---
 
 # Harness Everything
@@ -20,16 +20,17 @@ metadata:
 1. **Route (MUST)** — scope/tier plus selected/deferred topology.
 2. **Verify (MUST)** — objective evidence via `verify-gate.js --json`.
 3. **Zoom out (MUST)** — after 3 same-signature failures, use `zoom-out`.
-4. **Resolve suggestions (MUST)** — evaluate each suggested `SKILL.md`; run applicable core contracts or retain a flow-grounded reason.
+4. **Bind knowledge by step (MUST)** — ordered steps declare required/optional skills/references; only the active step's bindings load and resolve.
 5. **Surface status (MUST)** — non-trivial work renders `### 🚦 Harness Status` with bold `Current`, `Read / Evidence`, `Next`; `Risk / Blocked` optional.
 6. **Keep agency** — required obligations are MUST; tactics MAY adapt. Numeric planning MAY guide, never hard-stop; only Rule-of-3 reflection and explicit user/host permission boundaries may block.
 7. **Windows PowerShell (MUST)** — `Get-Content -Encoding UTF8 -Raw`; npm `.cmd` shims (`npx.cmd`); never weaken `ExecutionPolicy`.
 
 ## Workflow
 1. Reuse kernel output or run `node "<this-skill-dir>/scripts/kernel-router.js" "<prompt summary>"`.
-2. Keep the routing checkpoint internal.
-3. Resolve suggestions as `use`, `not-applicable`, or `unresolved`.
-4. Complete selected-topology invariants/stages/checks.
-5. Tier-3/Fable broad mutation MUST use a linked worktree or explicit degraded fallback.
+2. Keep the routing checkpoint internal; knowledge signals feed planning, not document selection.
+3. Decompose ordered requirement steps, with their bindings, before execution.
+4. Required active-step bindings and applicable core contracts MUST resolve before the step passes; unknown/unavailable stays visible.
+5. Complete selected-topology invariants/stages/checks; Fable exposes only dependency-ready stage bindings.
+6. Tier-3/Fable broad mutation MUST use a linked worktree or explicit degraded fallback.
 
 Deep dive: <this-skill-dir>/references/triage-and-tiers.md

package/plugins/harness-everything/skills/harness-everything/references/router-workflow-plan.md

@@ -104,22 +104,27 @@ Irreversible or external side-effect intent (for example destructive database ch
 
 This does not choose a topology and does not itself enforce the gate. Phase 5 owns PreToolUse enforcement. The router only declares the invariant so any eventual executor must preserve it.
 
-## Invariants vs advisory skills
+## Invariants vs knowledge signals
 
-`requiredInvariants` and `suggestedSkills` are separate plan fields. The kernel prints both separately and consumes them from the structured plan instead of reconstructing suggestions from tier.
+`requiredInvariants` and `knowledgeSignals` have separate roles. Invariants state semantic MUSTs; normalized knowledge signals help decompose requirements but never select document paths. `suggestedSkills` remains an empty compatibility field and is not populated from topology or keywords.
 
 Examples:
 
 - `loop-awareness` and `objective-verification` are mandatory for `iterative-single`, on top of the base `scope-lock`, `verify-before-claim`, and `replan-after-repeated-failure`;
-- `tdd` and `verification-loop` remain advisory skill suggestions;
+- TDD and verification-loop bindings are declared on behavior-change and verification steps, respectively;
 - `stage-contracts` and `cold-verification` are mandatory for Fable topologies;
-- `multi-agent-workspace` is suggested only when the selected topology actually requires durable workspace behavior.
+- domain skills and references are bound only to steps that need them;
+- `fable-multi-agent-workspace` selects durable workspace behavior without globally loading a skill path.
 
 There is no universal `TODO → TDD → verification` pipeline.
 
-## Guide deduplication
+## Binding and disclosure rule
 
-Knowledge-guide recommendations are deduplicated by the referenced guide path, not by full line text. If two routing groups describe `security-review/SKILL.md` differently, the path is still emitted once.
+Each ordered requirement or Fable stage may declare `requiredBindings` and `optionalBindings` by stable id and concrete repository-relative path. Only the active requirement or dependency-ready stage exposes its paths. Required bindings must resolve before that step/stage passes; unknown required bindings remain visible and unresolved. Future-step paths and keyword-matched documents are never preloaded.
+
+For single-agent steps, `workflow-disposition.js start`, `binding`, and `step` return command templates for resolving the current binding and passing the active step. Retained workflow reminders print the same commands. Record the binding evidence before the step disposition; the next step and its paths are disclosed only after the current step passes.
+
+In typed-step mode, the aggregate `execute` and `verify` obligations resolve from their corresponding passed steps. A verification-only plan records an explicit no-execution disposition for `execute`; it still requires the verification binding, step evidence, and objective check.
 
 ## Determinism rule
 

package/plugins/harness-everything/skills/harness-everything/references/triage-and-tiers.md

@@ -14,10 +14,9 @@ flowchart TD
     K --> W{Workflow selected?}
     W -- No / deferred --> D[Preserve invariants<br/>choose smallest justified workflow]
     W -- Yes --> A[ACTIVE workflow contract]
-    A --> G{Suggested skills?}
-    G -- Yes --> R[Read each suggested SKILL.md<br/>resolve applicability]
-    G -- No --> E[Execute selected workflow]
-    R --> E
+    A --> P[Decompose requirements<br/>into ordered steps]
+    P --> B[Bind skills/references<br/>to each step]
+    B --> E[Execute active step only]
     E --> V{Required checks / stages resolved?}
     V -- Yes --> O([Claim completion])
     V -- No --> P[Diagnose / re-plan]
@@ -42,7 +41,7 @@ The kernel protects lifecycle obligations without micromanaging model reasoning.
 1. **Route before execution** — establish task scope/tier and the smallest justified topology.
 2. **Verify before claim** — completion requires objective evidence appropriate to the change.
 3. **Re-plan on repetition** — after three same-signature failures, stop micro-retrying and use a fresh diagnosis / `zoom-out`.
-4. **Evaluate before omission** — when the router suggests a skill, read its complete `SKILL.md` entry/basic flow before deciding applicability.
+4. **Bind knowledge by step** — compose ordered requirement steps and declare required/optional skills or references before execution.
 5. **Resolve selected workflow** — selected-topology required obligations are semantic MUSTs; implementation tactics MAY adapt where the contract allows.
 6. **Surface status** — non-trivial software/project work MUST use the single Harness Status format at required phase boundaries.
 
@@ -52,10 +51,10 @@ The model remains free to choose tools, implementation technique, decomposition
 
 - One universal `TODO → TDD → verification-loop` sequence for every Tier 2/3 task.
 - Multi-agent execution merely because a task is Tier 3.
-- Every router-suggested skill when its evaluated flow is objectively not applicable.
+- Every keyword-matched skill/reference regardless of whether an active requirement needs it.
 - Every optional deep-dive/reference linked from a skill.
 
-A suggested skill may resolve as `use`, `not-applicable`, or `unresolved/unavailable`. Resolution is a **MUST**. `not-applicable` needs a flow-grounded reason; a metadata-only or confidence-only judgement is insufficient. If disposition is `use`, the skill's core contract is a **MUST**. The selected **topology** is also a semantic execution contract; neither concept implies a persistent runtime lock.
+Keyword/domain matches are normalized planning signals, not document selectors. Each ordered step declares its required and optional skill/reference bindings; only the active step or dependency-ready Fable stage exposes those paths. Read a required skill's complete entry and follow its applicable core contract before the step passes. Required bindings without a known path remain visible and unresolved. Optional bindings resolve as loaded or not-needed. Hooks may remind, but missing bindings do not hard-block ordinary tools or Stop.
 
 ## 2. Routing Mechanism
 
@@ -67,28 +66,27 @@ node "<this-skill-dir>/scripts/kernel-router.js" "<brief prompt summary>"
 npx github:dyphn1/Harness-everything next "<brief prompt summary>"
 ```
 
-`kernel-router.js` delegates classification/guide discovery to `tier-router.js` and emits:
+`kernel-router.js` delegates classification/knowledge-signal detection to `tier-router.js` and emits:
 
 - classified tier + rationale,
 - structured workflow plan,
 - compact **Harness Routing Checkpoint**,
 - required invariants,
-- suggested skills whose applicability must be evaluated,
+- normalized knowledge signals that help compose requirement steps, not paths to read,
+- ordered requirement steps and their active required/optional bindings after planning,
 - **Workflow Contract** for the selected topology.
 
 If `UserPromptSubmit` already ran the kernel this turn, reuse that output. Do not infer a silent Tier 1/direct path from missing or degraded routing.
 
-### Suggestion applicability contract
+### Active binding contract
 
-For every router-suggested skill:
+- Before a selected Tier 2/3 workflow starts, decompose the request into ordered requirement steps and confirm the smallest sufficient topology.
+- Put a required skill/reference only on steps whose acceptance criteria need it; put optional knowledge on its actual consumer step.
+- Load/resolve only bindings for the active step. Do not print or preload future-step bindings.
+- A required binding MUST resolve as loaded before the step passes; optional bindings resolve as loaded or not-needed. Unknown/unavailable required bindings stay visible and unresolved.
+- Fable uses its existing dependency/write-set graph as the step graph. Only dependency-ready stage bindings are disclosed; unresolved bindings keep a successful check at `binding-unresolved` until they are resolved and that exact check is rerun.
 
-1. **MUST** read the complete `SKILL.md` entry.
-2. **MUST** evaluate `USE FOR`, `DO NOT USE FOR`, workflow/basic flow, and hard rules.
-3. Read extra material only when the entry explicitly requires it to decide applicability.
-4. **MUST** resolve the suggestion as `use`, `not-applicable`, or `unresolved/unavailable`.
-5. `use` means the skill's core contract **MUST** be followed; `not-applicable` **MUST** keep a flow-grounded reason.
-
-A name, description, router summary, tier label, or generic "routine/common task" judgement is not enough to mark a suggestion not applicable. Using one suggestion does not resolve the others automatically.
+The binding disposition is an execution contract, not proof that a real host loaded a file. Preserve a host/session trace before making live-host claims. Missing evidence stays a reminder and does not create a persistent Harness lock.
 
 ### Workflow escape contract
 
@@ -111,7 +109,7 @@ Default topology is normally `direct-single`. Keep the lifecycle minimal, but st
 
 Typical shape: specific feature/bug fix, multi-file coordination, behavioral change, focused benchmark/review.
 
-The router normally selects `iterative-single`: bounded reason/act work plus objective verification. It may surface `tdd`, `verification-loop`, `security-review`, `using-git-worktrees`, or other focused skills. Those suggestions are applicability decisions, not a universal sequence.
+The router normally selects `iterative-single`: bounded reason/act work plus objective verification. Compose ordered steps and bind TDD to behavior-change, verification-loop to verification, and domain references only to steps whose acceptance needs them. Keyword matches alone never select or load documents.
 
 When an evaluated skill is applicable, follow its workflow rather than reading it and then discarding it because the implementation seems obvious.
 
@@ -181,16 +179,16 @@ For software/project work, consume this internal runtime state when producing th
 - Strategy: <selected/deferred strategy>
 - Workflow state: <pending | running | satisfied | deferred | blocked>
 - Required invariants: <router invariants>
-- Suggested skills: <deduplicated suggestions or none>
-- Suggestion applicability: <use | not-applicable + reason | unresolved/unavailable>
+- Knowledge signals: <normalized planning inputs; not document paths>
+- Active step: <ordered requirement id/type, with only its declared bindings>
 - Escape: <none | reason + uncovered scope + evidence>
 ```
 
-The checkpoint is runtime/source state, not a competing user-facing template. Render user progress through the single Harness Status contract above. The key distinction is: **skill suggestions MUST resolve applicability; applicable skill core contracts and selected-topology obligations are MUSTs, while tactics MAY adapt.**
+The checkpoint is runtime/source state, not a competing user-facing template. Render user progress through the single Harness Status contract above. The key distinction is: **active required bindings and selected-topology obligations are MUSTs; unrelated future knowledge stays undisclosed, while tactics MAY adapt.**
 
 ## 8. Self-Healing and Dynamic Skills
 
-Self-heal, generated-skill discovery, knowledge-guide matching, and fact-audit behavior remain part of the runtime. Dynamic skill suggestions still require applicability evaluation.
+Self-heal and fact-audit behavior remain part of the runtime. Prompt keyword matches emit normalized knowledge signals plus candidate step-binding ids; they do not print skill/reference paths. Self-evolved skills registered in a manifest's `generated` entries are matched on metadata (triggers) only: matching ids surface as `SELF-EVOLVED SKILL SIGNALS`, and a step that declares such an id resolves its `SKILL.md` from the manifest only once that step is active.
 
 If bootstrap reports missing integration touchpoints:
 

package/plugins/harness-everything/skills/harness-everything/schemas/router-workflow-plan.schema.json

@@ -12,6 +12,7 @@
     "patterns",
     "requiredInvariants",
     "suggestedSkills",
+    "knowledgeSignals",
     "actionGate",
     "limits",
     "parallelism",
@@ -34,6 +35,7 @@
     "patterns": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
     "requiredInvariants": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
     "suggestedSkills": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+    "knowledgeSignals": { "type": "array", "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,63}$" }, "uniqueItems": true },
     "actionGate": {
       "type": "object",
       "required": ["required", "reasonCodes", "approver", "disposition"],