harness-everything 0.8.0 → 0.8.1

package/plugins/harness-everything/skills/harness-everything/scripts/kernel-router-core.js

@@ -0,0 +1,263 @@
+#!/usr/bin/env node
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const {
+  createDegradedRouterContract,
+  validateRouterContract,
+} = require('./router-contract');
+const { applyEnsemblePolicy } = require('./ensemble-policy');
+
+/**
+ * Harness Kernel Router
+ *
+ * tier-router remains the human-readable classifier/guide detector. The
+ * kernel consumes its versioned side-channel JSON contract instead of
+ * scraping human-readable stdout. Phase 2 selects an execution topology, but
+ * the router still only emits a plan: executors retain responsibility for
+ * spawning agents, creating workspaces, running tools, and enforcing gates.
+ * Phase 4 attaches ensemble-review only as a post-selection modifier.
+ */
+
+const INVARIANT_TEXT = {
+  'scope-lock': 'Route before execution: stay inside the authorized task/repository scope.',
+  'verify-before-claim': 'Verify before claim: completion claims require objective evidence appropriate to the change.',
+  'replan-after-repeated-failure': 'Re-plan on repetition: after 3 same-signature failures, stop micro-retrying and zoom out/re-diagnose.',
+  'evaluate-suggestions-before-skip': 'Evaluate before skip: read each suggested skill\'s complete SKILL.md entry/basic flow before omitting it.',
+  'loop-budget': 'Stop iterative-single when its explicit iteration budget is exhausted.',
+  'objective-verification': 'Use an objective check for iterative work; self-critique alone is not verification.',
+  'stage-contracts': 'Fable stages must have explicit stage contracts and pass conditions.',
+  'cold-verification': 'Fable delivery requires a cold/independent verifier where specified.',
+  'parallel-scope-contract': 'Parallel work requires declared independent scopes and non-overlapping/read-only writes.',
+  'synthesis-barrier': 'Do not claim parallel completion until all workstreams reach the synthesis barrier.',
+  'handoff-contracts': 'Multi-agent workspace work uses orchestrator-owned handoff contracts; workers do not form a peer mesh.',
+  'workspace-state': 'Durable workspace state remains scoped to the workspace and existing state conventions.',
+  'pre-action-approval': 'Irreversible/external side effects require approval before the exact payload executes.',
+  'preserve-disagreement': 'Ensemble synthesis must retain unresolved minority positions and evidence gaps.',
+  'independent-ensemble-verifier': 'Ensemble delivery requires a verifier independent from the candidate identities; agreement alone is not proof.',
+  'isolated-worktree-before-mutation': 'Major engineering must mutate only inside a verified Git worktree; unavailable isolation means blocked.',
+};
+
+const SKILL_TEXT = {
+  'tdd': 'tdd: useful for behavioral changes where executable tests can drive the implementation.',
+  'verification-loop': 'verification-loop: useful for systematic build/lint/test/diff evidence before delivery.',
+  'fable-mode': 'fable-mode / fable-discipline: useful for macro planning or deliberate multi-agent decomposition.',
+  'fable-discipline': null,
+  'multi-agent-workspace': 'multi-agent-workspace: useful when durable bounded delegation, handoffs, or workspace memory are required.',
+};
+
+function sanitizeClassifierOutput(stdout) {
+  const lines = String(stdout || '').split(/\r?\n/);
+  const filtered = [];
+  let skipLegacyContinuation = false;
+
+  for (const line of lines) {
+    if (line.includes('=> BASE EXECUTION LOOP:')) {
+      skipLegacyContinuation = true;
+      continue;
+    }
+    if (skipLegacyContinuation && line.includes('Track exactly ONE item in-progress')) {
+      skipLegacyContinuation = false;
+      continue;
+    }
+    skipLegacyContinuation = false;
+    filtered.push(line);
+  }
+
+  return filtered.join('\n').replace(/\n{3,}/g, '\n\n').trimEnd();
+}
+
+function readStructuredContract(contractPath) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(contractPath, 'utf8'));
+    const validation = validateRouterContract(parsed);
+    if (!validation.valid) {
+      return createDegradedRouterContract(
+        'router-contract-invalid',
+        `Structured router contract failed validation: ${validation.errors.join('; ')}`,
+      );
+    }
+    return parsed;
+  } catch (err) {
+    return createDegradedRouterContract(
+      'router-contract-unavailable',
+      `Structured router contract unavailable: ${err.message}`,
+    );
+  }
+}
+
+function resolvePrompt(prompt, stdinPayload) {
+  if (prompt) return prompt;
+  if (!stdinPayload) return '';
+  try {
+    const payload = JSON.parse(stdinPayload);
+    return typeof payload.prompt === 'string' ? payload.prompt : '';
+  } catch (_) {
+    return '';
+  }
+}
+
+function printWorkflowPlan(plan) {
+  const visible = {
+    schemaVersion: plan.schemaVersion,
+    routingStatus: plan.routingStatus,
+    tier: plan.tier,
+    strategy: plan.strategy,
+    strategySelection: plan.strategySelection,
+    actionGate: plan.actionGate,
+    limits: plan.limits,
+    parallelism: plan.parallelism,
+    workspace: plan.workspace,
+    memory: plan.memory,
+    verification: plan.verification,
+    ensemble: plan.ensemble,
+    fallback: plan.fallback,
+    reasonCodes: plan.reasonCodes,
+    requiredInvariants: plan.requiredInvariants,
+    suggestedSkills: plan.suggestedSkills,
+    mutationIsolation: plan.mutationIsolation,
+  };
+  console.log(`\n=> ROUTER WORKFLOW PLAN (JSON): ${JSON.stringify(visible)}`);
+}
+
+function uniqueSuggestedSkills(plan) {
+  if (!Array.isArray(plan.suggestedSkills)) return [];
+  return [...new Set(plan.suggestedSkills.filter(skill => typeof skill === 'string' && skill.trim()))];
+}
+
+function enforceSuggestionEvaluation(plan) {
+  if (uniqueSuggestedSkills(plan).length === 0) return;
+  if (!Array.isArray(plan.requiredInvariants)) plan.requiredInvariants = [];
+  if (!plan.requiredInvariants.includes('evaluate-suggestions-before-skip')) {
+    plan.requiredInvariants.push('evaluate-suggestions-before-skip');
+  }
+}
+
+function displayTier(tier) {
+  if (tier === 'tier1') return 'Tier 1';
+  if (tier === 'tier2') return 'Tier 2';
+  if (tier === 'tier3') return 'Tier 3';
+  return tier || 'unclassified';
+}
+
+function printRoutingCheckpoint(plan) {
+  const invariants = Array.isArray(plan.requiredInvariants) ? plan.requiredInvariants : [];
+  const suggestions = uniqueSuggestedSkills(plan);
+
+  console.log('\n=> HARNESS ROUTING CHECKPOINT (REQUIRED VISIBLE STATE):');
+  console.log(`   - Tier: ${displayTier(plan.tier)}`);
+  console.log(`   - Strategy: ${plan.strategy || 'deferred'}`);
+  console.log(`   - Required invariants: ${invariants.length ? invariants.join(', ') : 'none'}`);
+  console.log(`   - Suggested skills: ${suggestions.length ? suggestions.join(', ') : 'none'}`);
+  if (suggestions.length > 0) {
+    console.log('   - Suggestion evaluation: MANDATORY. Before skipping any listed skill, read its complete SKILL.md entry and evaluate USE FOR, DO NOT USE FOR, workflow/basic flow, and hard rules.');
+    console.log('   - Skip evidence: do not reject from only the skill name, description, router summary, or a generic "routine/common task" judgement. If the entry cannot be resolved/read, mark it unresolved/unavailable rather than skipped.');
+    console.log('   - Suggestion disposition: individual skill applicability is conditional; the selected workflow is mandatory. Using one suggestion does not waive read-before-skip for other omitted suggestions. If all are not-applicable, state one brief flow-grounded reason.');
+  }
+}
+
+function printKernelContract(plan) {
+  console.log('\n=> REQUIRED HARNESS INVARIANTS:');
+  for (const invariant of plan.requiredInvariants || []) {
+    console.log(`   - ${invariant}: ${INVARIANT_TEXT[invariant] || 'Required by the selected workflow plan.'}`);
+  }
+
+  console.log('\n=> WORKFLOW SKILLS (EVALUATE APPLICABILITY — SELECTED WORKFLOW IS MANDATORY):');
+  if (Array.isArray(plan.suggestedSkills) && plan.suggestedSkills.length > 0) {
+    const emitted = new Set();
+    for (const skill of plan.suggestedSkills) {
+      if (emitted.has(skill)) continue;
+      const text = Object.prototype.hasOwnProperty.call(SKILL_TEXT, skill) ? SKILL_TEXT[skill] : `${skill}: evaluate applicability inside the selected topology.`;
+      if (text) console.log(`   - ${text}`);
+      emitted.add(skill);
+      if (skill === 'fable-mode') emitted.add('fable-discipline');
+    }
+    console.log('   - Read-before-skip: evaluate every suggested skill entry before omission; adopting one suggestion does not waive evaluation of the others.');
+    if (plan.strategy && plan.strategy.startsWith('fable-')) {
+      console.log('   - Fable is not a universal pipeline, but a selected Fable topology must be entered and resolved before completion.');
+    }
+  } else if (plan.strategy === 'direct-single') {
+    console.log('   - No domain skill was suggested. Prefer the bounded direct path and load a focused skill only when it adds value.');
+  } else if (plan.strategySelection === 'deferred') {
+    console.log('   - Strategy is deferred/unclassified. Do not infer triviality; choose the smallest justified approach from task evidence.');
+  } else {
+    console.log('   - No additional skill suggestion from the workflow plan.');
+  }
+
+  if (plan.ensemble) {
+    console.log(`\n=> ENSEMBLE REVIEW: bounded to ${plan.ensemble.maxCandidates} candidates; synthesis=${plan.ensemble.synthesis}; verifier=${plan.ensemble.verifier}. Preserve minority positions and do not claim improvement without paired evidence.`);
+  }
+
+  if (plan.actionGate && plan.actionGate.required) {
+    console.log(`\n=> ACTION GATE REQUIRED: ${plan.actionGate.reasonCodes.join(', ')}; disposition=${plan.actionGate.disposition}. The router only declares this requirement; execution must not bypass approval.`);
+  }
+
+  if (plan.fallback && plan.fallback.disposition !== 'none') {
+    console.log(`\n=> ROUTING FALLBACK: ${plan.fallback.disposition}/${plan.fallback.mode}; ${plan.fallback.reasonCodes.join(', ')}.`);
+  }
+
+  if (plan.routingStatus === 'degraded') {
+    console.log('\n=> ROUTING DEGRADATION: Structured routing is degraded. Keep the strategy deferred unless independent evidence supports a route; do not silently downgrade to Tier 1/direct execution.');
+  }
+
+  console.log('\n=> ORCHESTRATION POLICY: Mandatory applicable workflow. The selected topology is an execution contract; the model controls HOW to satisfy it. Escape requires explicit uncovered scope and evidence; covered obligations remain mandatory.');
+}
+
+function route(prompt, stdinPayload) {
+  const classifierPath = path.join(__dirname, 'tier-router.js');
+  const contractPath = path.join(os.tmpdir(), `harness-router-${process.pid}-${crypto.randomUUID()}.json`);
+  const args = prompt ? [classifierPath, prompt] : [classifierPath];
+  const result = spawnSync(process.execPath, args, {
+    input: prompt ? undefined : stdinPayload,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      HARNESS_ROUTER_CONTRACT_PATH: contractPath,
+    },
+  });
+
+  if (result.error) {
+    console.error(`[Harness Kernel] Failed to execute tier-router.js: ${result.error.message}`);
+    process.exit(1);
+  }
+
+  const contract = readStructuredContract(contractPath);
+  applyEnsemblePolicy(contract, resolvePrompt(prompt, stdinPayload));
+  enforceSuggestionEvaluation(contract.workflowPlan);
+  try {
+    fs.rmSync(contractPath, { force: true });
+  } catch (err) {
+    // Temporary contract cleanup is best effort only.
+  }
+
+  return { contract, sanitized: sanitizeClassifierOutput(result.stdout), stderr: result.stderr, status: result.status };
+}
+
+function run(prompt, stdinPayload) {
+  const result = route(prompt, stdinPayload);
+  if (result.sanitized) console.log(result.sanitized);
+  if (result.stderr) process.stderr.write(result.stderr);
+  printWorkflowPlan(result.contract.workflowPlan);
+  printRoutingCheckpoint(result.contract.workflowPlan);
+  printKernelContract(result.contract.workflowPlan);
+
+  if (result.status !== 0) process.exit(result.status === null ? 1 : result.status);
+}
+
+if (require.main === module) {
+const prompt = process.argv.slice(2).join(' ');
+if (prompt) {
+  run(prompt, null);
+} else if (process.stdin.isTTY) {
+  run('', null);
+} else {
+  let input = '';
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', chunk => { input += chunk; });
+  process.stdin.on('end', () => run('', input));
+}
+}
+
+module.exports = { route, printWorkflowPlan, printRoutingCheckpoint, printKernelContract };

package/plugins/harness-everything/skills/harness-everything/scripts/kernel-router.js

@@ -1,252 +1,124 @@
 #!/usr/bin/env node
+'use strict';
+
 const crypto = require('crypto');
 const fs = require('fs');
-const os = require('os');
 const path = require('path');
-const { spawnSync } = require('child_process');
-const {
-  createDegradedRouterContract,
-  validateRouterContract,
-} = require('./router-contract');
-const { applyEnsemblePolicy } = require('./ensemble-policy');
-
-/**
- * Harness Kernel Router
- *
- * tier-router remains the human-readable classifier/guide detector. The
- * kernel consumes its versioned side-channel JSON contract instead of
- * scraping human-readable stdout. Phase 2 selects an execution topology, but
- * the router still only emits a plan: executors retain responsibility for
- * spawning agents, creating workspaces, running tools, and enforcing gates.
- * Phase 4 attaches ensemble-review only as a post-selection modifier.
- */
-
-const INVARIANT_TEXT = {
-  'scope-lock': 'Route before execution: stay inside the authorized task/repository scope.',
-  'verify-before-claim': 'Verify before claim: completion claims require objective evidence appropriate to the change.',
-  'replan-after-repeated-failure': 'Re-plan on repetition: after 3 same-signature failures, stop micro-retrying and zoom out/re-diagnose.',
-  'evaluate-suggestions-before-skip': 'Evaluate before skip: read each suggested skill\'s complete SKILL.md entry/basic flow before omitting it.',
-  'loop-budget': 'Stop iterative-single when its explicit iteration budget is exhausted.',
-  'objective-verification': 'Use an objective check for iterative work; self-critique alone is not verification.',
-  'stage-contracts': 'Fable stages must have explicit stage contracts and pass conditions.',
-  'cold-verification': 'Fable delivery requires a cold/independent verifier where specified.',
-  'parallel-scope-contract': 'Parallel work requires declared independent scopes and non-overlapping/read-only writes.',
-  'synthesis-barrier': 'Do not claim parallel completion until all workstreams reach the synthesis barrier.',
-  'handoff-contracts': 'Multi-agent workspace work uses orchestrator-owned handoff contracts; workers do not form a peer mesh.',
-  'workspace-state': 'Durable workspace state remains scoped to the workspace and existing state conventions.',
-  'pre-action-approval': 'Irreversible/external side effects require approval before the exact payload executes.',
-  'preserve-disagreement': 'Ensemble synthesis must retain unresolved minority positions and evidence gaps.',
-  'independent-ensemble-verifier': 'Ensemble delivery requires a verifier independent from the candidate identities; agreement alone is not proof.',
-};
-
-const SKILL_TEXT = {
-  'tdd': 'tdd: useful for behavioral changes where executable tests can drive the implementation.',
-  'verification-loop': 'verification-loop: useful for systematic build/lint/test/diff evidence before delivery.',
-  'fable-mode': 'fable-mode / fable-discipline: useful for macro planning or deliberate multi-agent decomposition.',
-  'fable-discipline': null,
-  'multi-agent-workspace': 'multi-agent-workspace: useful when durable bounded delegation, handoffs, or workspace memory are required.',
-};
+const core = require('./kernel-router-core');
 
-function sanitizeClassifierOutput(stdout) {
-  const lines = String(stdout || '').split(/\r?\n/);
-  const filtered = [];
-  let skipLegacyContinuation = false;
-
-  for (const line of lines) {
-    if (line.includes('=> BASE EXECUTION LOOP:')) {
-      skipLegacyContinuation = true;
-      continue;
-    }
-    if (skipLegacyContinuation && line.includes('Track exactly ONE item in-progress')) {
-      skipLegacyContinuation = false;
-      continue;
-    }
-    skipLegacyContinuation = false;
-    filtered.push(line);
+function loadRuntime() {
+  for (const prefix of ['../..', '../../..']) {
+    const candidate = path.resolve(__dirname, prefix, 'hooks/scripts/lib/workflow-runtime.js');
+    if (fs.existsSync(candidate)) return { runtime: require(candidate), hooksRoot: path.dirname(path.dirname(candidate)) };
   }
-
-  return filtered.join('\n').replace(/\n{3,}/g, '\n\n').trimEnd();
+  throw new Error('workflow runtime unavailable in this installation');
 }
 
-function readStructuredContract(contractPath) {
-  try {
-    const parsed = JSON.parse(fs.readFileSync(contractPath, 'utf8'));
-    const validation = validateRouterContract(parsed);
-    if (!validation.valid) {
-      return createDegradedRouterContract(
-        'router-contract-invalid',
-        `Structured router contract failed validation: ${validation.errors.join('; ')}`,
-      );
+function persistWorkflow(plan, payload, prompt) {
+  if (!payload || !(payload.session_id || payload.sessionId)) return null;
+  const { runtime, hooksRoot } = loadRuntime();
+  const context = runtime.loadWorkflow(payload);
+  const { writeCurrentSession } = require(path.join(hooksRoot, 'lib/harness-state'));
+  writeCurrentSession(context.root, context.sessionId);
+  if (context.workflow && runtime.OPEN_STATES.has(context.workflow.state)) {
+    if (!context.workflow.workflowPlan) throw new Error('legacy unresolved workflow needs explicit migration; refusing to replace its obligations');
+    // Steering/status prompts cannot drop an unresolved execution contract.
+    // Stronger new work is retained as a pending route until explicit replan.
+    if (runtime.isMajorWorkflow(plan) && !runtime.isMajorWorkflow(context.workflow)) {
+      context.workflow.state = 'blocked';
+      context.workflow.pendingPlan = plan;
+      context.workflow.blockReason = 'stronger-route-requires-replan';
+      context.workflow.mutationIsolation = plan.mutationIsolation;
     }
-    return parsed;
-  } catch (err) {
-    return createDegradedRouterContract(
-      'router-contract-unavailable',
-      `Structured router contract unavailable: ${err.message}`,
-    );
-  }
-}
-
-function resolvePrompt(prompt, stdinPayload) {
-  if (prompt) return prompt;
-  if (!stdinPayload) return '';
-  try {
-    const payload = JSON.parse(stdinPayload);
-    return typeof payload.prompt === 'string' ? payload.prompt : '';
-  } catch (_) {
-    return '';
+    context.workflow.lastPromptHash = crypto.createHash('sha256').update(prompt).digest('hex').slice(0, 24);
+    runtime.saveWorkflow(context);
+    return { ...context, hooksRoot, retained: true };
   }
-}
-
-function printWorkflowPlan(plan) {
-  const visible = {
-    schemaVersion: plan.schemaVersion,
-    routingStatus: plan.routingStatus,
+  const selected = plan.strategySelection === 'selected' && Boolean(plan.strategy);
+  const now = Date.now();
+  context.workflow = {
+    schemaVersion: 2,
+    workflowId: crypto.randomUUID(),
+    createdAt: new Date(now).toISOString(),
+    createdAtMs: now,
+    sessionId: context.sessionId,
+    promptHash: crypto.createHash('sha256').update(prompt).digest('hex').slice(0, 24),
     tier: plan.tier,
     strategy: plan.strategy,
     strategySelection: plan.strategySelection,
-    actionGate: plan.actionGate,
-    limits: plan.limits,
-    parallelism: plan.parallelism,
-    workspace: plan.workspace,
-    memory: plan.memory,
+    requiredInvariants: plan.requiredInvariants || [],
+    suggestedSkills: plan.suggestedSkills || [],
     verification: plan.verification,
-    ensemble: plan.ensemble,
-    fallback: plan.fallback,
-    reasonCodes: plan.reasonCodes,
+    mutationIsolation: plan.mutationIsolation || { required: false },
+    workflowPlan: plan,
+    state: plan.fallback?.disposition === 'blocked' ? 'blocked' : selected ? 'pending' : 'deferred',
+    runId: null,
+    revision: 0,
+    escapes: [],
+    enforcement: {
+      mode: 'mandatory-applicable-workflow',
+      escapePolicy: 'scoped-evidence-only',
+      reasoningPolicy: 'model-controls-how',
+    },
   };
-  console.log(`\n=> ROUTER WORKFLOW PLAN (JSON): ${JSON.stringify(visible)}`);
+  runtime.saveWorkflow(context);
+  return { ...context, hooksRoot, retained: false };
 }
 
-function uniqueSuggestedSkills(plan) {
-  if (!Array.isArray(plan.suggestedSkills)) return [];
-  return [...new Set(plan.suggestedSkills.filter(skill => typeof skill === 'string' && skill.trim()))];
-}
-
-function enforceSuggestionEvaluation(plan) {
-  if (uniqueSuggestedSkills(plan).length === 0) return;
-  if (!Array.isArray(plan.requiredInvariants)) plan.requiredInvariants = [];
-  if (!plan.requiredInvariants.includes('evaluate-suggestions-before-skip')) {
-    plan.requiredInvariants.push('evaluate-suggestions-before-skip');
+function run(raw) {
+  const promptArg = process.argv.slice(2).join(' ');
+  let payload = null;
+  if (raw.trim()) {
+    try { payload = JSON.parse(raw); } catch (_) { console.error('[Workflow Router] Invalid hook payload; lifecycle persistence unavailable.'); }
   }
-}
-
-function displayTier(tier) {
-  if (tier === 'tier1') return 'Tier 1';
-  if (tier === 'tier2') return 'Tier 2';
-  if (tier === 'tier3') return 'Tier 3';
-  return tier || 'unclassified';
-}
-
-function printRoutingCheckpoint(plan) {
-  const invariants = Array.isArray(plan.requiredInvariants) ? plan.requiredInvariants : [];
-  const suggestions = uniqueSuggestedSkills(plan);
-
-  console.log('\n=> HARNESS ROUTING CHECKPOINT (REQUIRED VISIBLE STATE):');
-  console.log(`   - Tier: ${displayTier(plan.tier)}`);
-  console.log(`   - Strategy: ${plan.strategy || 'deferred'}`);
-  console.log(`   - Required invariants: ${invariants.length ? invariants.join(', ') : 'none'}`);
-  console.log(`   - Suggested skills: ${suggestions.length ? suggestions.join(', ') : 'none'}`);
-  if (suggestions.length > 0) {
-    console.log('   - Suggestion evaluation: MANDATORY. Before skipping any listed skill, read its complete SKILL.md entry and evaluate USE FOR, DO NOT USE FOR, workflow/basic flow, and hard rules.');
-    console.log('   - Skip evidence: do not reject from only the skill name, description, router summary, or a generic "routine/common task" judgement. If the entry cannot be resolved/read, mark it unresolved/unavailable rather than skipped.');
-    console.log('   - Suggestion disposition: execution is advisory after evaluation. Using one suggestion does not waive read-before-skip for other omitted suggestions. If all are skipped after evaluation, state one brief reason grounded in the evaluated flows in the first visible progress/update message.');
-  }
-}
-
-function printKernelContract(plan) {
-  console.log('\n=> REQUIRED HARNESS INVARIANTS:');
-  for (const invariant of plan.requiredInvariants || []) {
-    console.log(`   - ${invariant}: ${INVARIANT_TEXT[invariant] || 'Required by the selected workflow plan.'}`);
+  const prompt = promptArg || (typeof payload?.prompt === 'string' ? payload.prompt : '');
+  const result = core.route(promptArg, raw || null);
+  let plan = result.contract.workflowPlan;
+  let persisted = null;
+  let failure = null;
+  try {
+    persisted = persistWorkflow(plan, payload, prompt);
+    if (persisted?.retained) plan = persisted.workflow.workflowPlan;
+  } catch (error) { failure = error; }
+  if (result.sanitized) console.log(result.sanitized);
+  if (result.stderr) process.stderr.write(result.stderr);
+  if (persisted?.retained) console.log('\n=> Retaining unresolved workflow from earlier prompts; the checkpoint below is the active execution contract.');
+  core.printWorkflowPlan(plan);
+  core.printRoutingCheckpoint(plan);
+  core.printKernelContract(plan);
+  console.log('\n=> WORKFLOW EXECUTION CONTRACT (MANDATORY WHEN SELECTED):');
+  console.log('   - State: ' + (persisted?.workflow.state || (plan.strategy ? 'unpersisted' : 'deferred')));
+  console.log('   - Selected workflow: ' + (plan.strategy || 'deferred'));
+  if (plan.strategySelection === 'selected') {
+    console.log('   - Execute the selected workflow to resolution. Reasoning and implementation remain flexible inside it.');
+    console.log('   - Completion requires the workflow obligations and objective verification to resolve.');
+    console.log('   - Generic simple/routine/already-clear reasons cannot waive the selected workflow.');
+    console.log('   - Tier 3 / Fable source and artifact mutations require Git worktree isolation; unavailable isolation means BLOCKED.');
+    console.log('   - Escape is limited to workflow-uncovered-scope or host-capability-unavailable, with stage, scope and evidence; other obligations remain mandatory.');
   }
-
-  console.log('\n=> SUGGESTED SKILLS (MANDATORY EVALUATION — ADVISORY EXECUTION):');
-  if (Array.isArray(plan.suggestedSkills) && plan.suggestedSkills.length > 0) {
-    const emitted = new Set();
-    for (const skill of plan.suggestedSkills) {
-      if (emitted.has(skill)) continue;
-      const text = Object.prototype.hasOwnProperty.call(SKILL_TEXT, skill) ? SKILL_TEXT[skill] : `${skill}: advisory for the selected topology.`;
-      if (text) console.log(`   - ${text}`);
-      emitted.add(skill);
-      if (skill === 'fable-mode') emitted.add('fable-discipline');
-    }
-    console.log('   - Read-before-skip: evaluate every suggested skill entry before omission; adopting one suggestion does not waive evaluation of the others.');
-    if (plan.strategy && plan.strategy.startsWith('fable-')) {
-      console.log('   - Use these selectively after evaluation; Tier 3/Fable does not create a universal skill pipeline.');
-    }
-  } else if (plan.strategy === 'direct-single') {
-    console.log('   - No domain skill was suggested. Prefer the bounded direct path and load a focused skill only when it adds value.');
-  } else if (plan.strategySelection === 'deferred') {
-    console.log('   - Strategy is deferred/unclassified. Do not infer triviality; choose the smallest justified approach from task evidence.');
+  if (persisted) {
+    const controller = path.join(persisted.hooksRoot, 'workflow-disposition.js');
+    console.log('   - Workflow id: ' + persisted.workflow.workflowId);
+    console.log('   - Stage specification: ' + path.join(persisted.sessionDir, 'workflow-stages.json'));
+    console.log('   - Enter/replan: node "' + controller + '" start --session-id "' + persisted.sessionId + '"');
+    console.log('   - Escape one declared stage: node "' + controller + '" escape --session-id "' + persisted.sessionId + '" --stage-id "<id>" --reason-code workflow-uncovered-scope --scope "<uncovered scope>" --evidence "<evidence>"');
   } else {
-    console.log('   - No additional skill suggestion from the workflow plan.');
-  }
-
-  if (plan.ensemble) {
-    console.log(`\n=> ENSEMBLE REVIEW: bounded to ${plan.ensemble.maxCandidates} candidates; synthesis=${plan.ensemble.synthesis}; verifier=${plan.ensemble.verifier}. Preserve minority positions and do not claim improvement without paired evidence.`);
-  }
-
-  if (plan.actionGate && plan.actionGate.required) {
-    console.log(`\n=> ACTION GATE REQUIRED: ${plan.actionGate.reasonCodes.join(', ')}; disposition=${plan.actionGate.disposition}. The router only declares this requirement; execution must not bypass approval.`);
-  }
-
-  if (plan.fallback && plan.fallback.disposition !== 'none') {
-    console.log(`\n=> ROUTING FALLBACK: ${plan.fallback.disposition}/${plan.fallback.mode}; ${plan.fallback.reasonCodes.join(', ')}.`);
-  }
-
-  if (plan.routingStatus === 'degraded') {
-    console.log('\n=> ROUTING DEGRADATION: Structured routing is degraded. Keep the strategy deferred unless independent evidence supports a route; do not silently downgrade to Tier 1/direct execution.');
+    console.log('   - Runtime state was not persisted; host enforcement is unavailable/unknown, not proven hard enforcement.');
   }
-
-  console.log('\n=> ORCHESTRATION POLICY: Do not enforce workflow order. Enforce workflow invariants from the plan. Suggested-skill evaluation is mandatory; execution remains advisory after evaluation. The router plans; execution components execute.');
-}
-
-function run(prompt, stdinPayload) {
-  const classifierPath = path.join(__dirname, 'tier-router.js');
-  const contractPath = path.join(os.tmpdir(), `harness-router-${process.pid}-${crypto.randomUUID()}.json`);
-  const args = prompt ? [classifierPath, prompt] : [classifierPath];
-  const result = spawnSync(process.execPath, args, {
-    input: prompt ? undefined : stdinPayload,
-    encoding: 'utf8',
-    env: {
-      ...process.env,
-      HARNESS_ROUTER_CONTRACT_PATH: contractPath,
-    },
-  });
-
-  if (result.error) {
-    console.error(`[Harness Kernel] Failed to execute tier-router.js: ${result.error.message}`);
-    process.exit(1);
-  }
-
-  const sanitized = sanitizeClassifierOutput(result.stdout);
-  if (sanitized) console.log(sanitized);
-  if (result.stderr) process.stderr.write(result.stderr);
-
-  const contract = readStructuredContract(contractPath);
-  applyEnsemblePolicy(contract, resolvePrompt(prompt, stdinPayload));
-  enforceSuggestionEvaluation(contract.workflowPlan);
-  try {
-    fs.rmSync(contractPath, { force: true });
-  } catch (err) {
-    // Temporary contract cleanup is best effort only.
-  }
-
-  printWorkflowPlan(contract.workflowPlan);
-  printRoutingCheckpoint(contract.workflowPlan);
-  printKernelContract(contract.workflowPlan);
-
-  if (result.status !== 0) process.exit(result.status === null ? 1 : result.status);
+  if (failure) {
+    console.error('[Workflow Router] ' + failure.message);
+    process.exitCode = 2;
+  } else if (result.status !== 0) process.exitCode = result.status || 1;
 }
 
-const prompt = process.argv.slice(2).join(' ');
-if (prompt) {
-  run(prompt, null);
-} else if (process.stdin.isTTY) {
-  run('', null);
-} else {
+if (process.argv.length > 2 || process.stdin.isTTY) run('');
+else {
   let input = '';
+  let finished = false;
+  const finish = () => { if (finished) return; finished = true; clearTimeout(timeout); run(input); };
+  const timeout = setTimeout(finish, 500);
   process.stdin.setEncoding('utf8');
   process.stdin.on('data', chunk => { input += chunk; });
-  process.stdin.on('end', () => run('', input));
+  process.stdin.on('end', finish);
+  process.stdin.on('error', finish);
 }