harness-everything 0.8.0 → 0.9.0

package/plugins/harness-everything/hooks/scripts/workflow-disposition.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { loadWorkflow, saveWorkflow, matchingRun, OPEN_STATES, ensureWorkflowBudget, recordBudgetEvent, resetWorkflowBudget, syncBudgetToRun } = require('./lib/workflow-runtime');
+const { getWorkspaceRoot, readCurrentSession } = require('./lib/harness-state');
+const { atomicWriteJson, readJson } = require('./lib/fable-contracts');
+
+const ALLOWED_ESCAPE_REASONS = new Set(['workflow-uncovered-scope', 'host-capability-unavailable']);
+
+function parseArgs(argv) {
+  const args = { command: argv[0] };
+  const flags = new Map([['--reason-code', 'reasonCode'], ['--scope', 'scope'], ['--evidence', 'evidence'], ['--session-id', 'sessionId'], ['--stage-id', 'stageId']]);
+  for (let i = 1; i < argv.length; i++) {
+    const key = flags.get(argv[i]);
+    if (!key || !argv[i + 1] || argv[i + 1].startsWith('--')) throw new Error('unknown or incomplete argument: ' + argv[i]);
+    args[key] = argv[++i];
+  }
+  return args;
+}
+
+function consumer() {
+  for (const relative of ['../../fable-mode/scripts/workflow-plan-consumer.js', '../../skills/fable-mode/scripts/workflow-plan-consumer.js']) {
+    const file = path.resolve(__dirname, relative);
+    if (fs.existsSync(file)) return require(file);
+  }
+  throw new Error('Fable consumer unavailable');
+}
+
+function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const sessionId = args.sessionId || readCurrentSession(getWorkspaceRoot());
+  if (!sessionId) throw new Error('no active Harness session; pass --session-id explicitly');
+  const context = loadWorkflow({ session_id: sessionId });
+  const { workflow } = context;
+  if (!workflow || !OPEN_STATES.has(workflow.state)) throw new Error('no unresolved workflow contract exists for this session');
+  if (args.command === 'start') {
+    if (!workflow.workflowId || !workflow.workflowPlan) throw new Error('legacy workflow lacks a correlated plan; cannot start it implicitly');
+    if (workflow.state === 'running') throw new Error('workflow already running; record a blocker before replanning');
+    const isReplan = workflow.revision > 0 || Boolean(workflow.runId);
+    if (isReplan) recordBudgetEvent(context, 'replan', { evidence: 'workflow-disposition:start' });
+    const plan = workflow.pendingPlan || workflow.workflowPlan;
+    if (!String(plan.strategy || '').startsWith('fable-')) {
+      workflow.revision++;
+      workflow.state = 'running';
+      delete workflow.blockReason;
+      ensureWorkflowBudget(workflow);
+      saveWorkflow(context);
+      process.stdout.write(JSON.stringify({ state: workflow.state, workflowId: workflow.workflowId, revision: workflow.revision }) + '\n');
+      return;
+    }
+    const stages = readJson(path.join(context.sessionDir, 'workflow-stages.json'));
+    if (!Array.isArray(stages) || !stages.length) throw new Error('write a non-empty workflow-stages.json stage array at the session path first');
+    if (stages.some(stage => !stage.checkCommand || !stage.passCondition)) throw new Error('every required stage needs an objective checkCommand and passCondition');
+    if (plan.verification?.independent && !stages.some(stage => stage.agent === 'fable-verifier' && stage.writeSet?.length === 0 &&
+        stages.filter(other => other !== stage).every(other => stage.dependsOn?.includes(other.stageId)))) {
+      throw new Error('independent verification requires a read-only fable-verifier stage depending on all other stages');
+    }
+    const run = consumer().prepareRun({
+      routerContract: { workflowPlan: plan }, stages, workspaceRoot: context.root,
+      sessionId, workflowId: workflow.workflowId,
+    });
+    workflow.workflowPlan = plan;
+    workflow.strategy = plan.strategy;
+    workflow.tier = plan.tier;
+    workflow.verification = plan.verification;
+    workflow.mutationIsolation = plan.mutationIsolation || workflow.mutationIsolation;
+    workflow.runId = run.runId;
+    workflow.revision++;
+    workflow.state = 'running';
+    workflow.escapes = [];
+    delete workflow.pendingPlan;
+    delete workflow.blockReason;
+    ensureWorkflowBudget(workflow);
+  } else if (args.command === 'revision') {
+    recordBudgetEvent(context, 'revision', { evidence: args.evidence || 'workflow-disposition:revision' });
+  } else if (args.command === 'reset-budget') {
+    resetWorkflowBudget(context, args.evidence);
+  } else if (args.command === 'escape') {
+    if (!ALLOWED_ESCAPE_REASONS.has(args.reasonCode)) throw new Error('generic simple/routine/already-clear reasons are intentionally rejected');
+    if (!args.scope?.trim()) throw new Error('--scope is required');
+    if (!args.evidence?.trim()) throw new Error('--evidence is required');
+    const match = matchingRun(context);
+    if (!match || !match.run.stageIds.includes(args.stageId)) throw new Error('--stage-id must name a stage in the correlated active run');
+    const contract = readJson(path.join(match.runRoot, 'contracts', args.stageId + '.json'));
+    if (contract?.agent === 'fable-verifier') throw new Error('independent verification cannot be escaped; record BLOCKED when unavailable');
+    const disposition = {
+      status: 'escaped', stageId: args.stageId, runId: match.run.runId,
+      reasonCode: args.reasonCode, uncoveredScope: args.scope.trim(), evidence: args.evidence.trim(), recordedAt: new Date().toISOString(),
+    };
+    workflow.escapes = [...(workflow.escapes || []).filter(item => item.stageId !== args.stageId), disposition];
+    atomicWriteJson(path.join(match.runRoot, 'escapes', args.stageId + '.json'), disposition);
+    // Scope-limited exception; never change the entire workflow to escaped.
+  } else if (args.command === 'block') {
+    if (!args.evidence?.trim()) throw new Error('--evidence is required');
+    workflow.state = 'blocked';
+    workflow.blockReason = args.evidence.trim();
+  } else throw new Error('Usage: workflow-disposition.js <start|revision|reset-budget|escape|block> --session-id <id> [--stage-id <id> --reason-code <reason> --scope <scope> --evidence <evidence>]');
+  saveWorkflow(context);
+  syncBudgetToRun(context);
+  process.stdout.write(JSON.stringify({ state: workflow.state, workflowId: workflow.workflowId, runId: workflow.runId, revision: workflow.revision, escapes: workflow.escapes }) + '\n');
+}
+try { main(); } catch (error) { console.error('[Workflow Disposition] ' + error.message); process.exitCode = 2; }

package/plugins/harness-everything/hooks/scripts/workflow-gate.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+'use strict';
+
+const path = require('path');
+const fs = require('fs');
+const { loadWorkflow, saveWorkflow, isMajorWorkflow, matchingRun, recordBudgetEvent, readHookInput } = require('./lib/workflow-runtime');
+const { key, classifyShell, cwdOf, commandOf, mutationPaths, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
+
+const DIRECT = new Set(['Edit', 'Write', 'apply_patch']);
+const SHELL = new Set(['Bash', 'PowerShell', 'exec_command']);
+
+function isController(command, cwd) {
+  // One trusted local executable, literal arguments, no shell evaluation.
+  if (/[;&|`\r\n<>$(){}]/.test(command)) return false;
+  const match = command.match(/^node\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s+(start|escape|block)\b/);
+  return Boolean(match && key(path.resolve(cwd, match[1] || match[2] || match[3])) === key(path.join(__dirname, 'workflow-disposition.js')));
+}
+
+function decide(payload) {
+  if (!payload) return;
+  const tool = payload.tool_name || payload.tool;
+  if (!DIRECT.has(tool) && !SHELL.has(tool)) return;
+  const context = loadWorkflow(payload);
+  const { workflow, root, sessionDir } = context;
+  if (!workflow || workflow.state === 'deferred') return;
+  const cwd = cwdOf(payload, root);
+  const command = commandOf(payload);
+  const commandClass = SHELL.has(tool) ? classifyShell(command) : 'direct-mutation';
+  if (commandClass === 'read-only' || commandClass === 'worktree-setup') return;
+  if (SHELL.has(tool) && isController(command, cwd)) return;
+  // Only the stage specification is allowed before run entry. Other runtime
+  // state, including workflow-run.json, cannot use this bootstrap exception.
+  const targets = DIRECT.has(tool) ? mutationPaths(payload) : [];
+  const spec = path.join(sessionDir, 'workflow-stages.json');
+  const specStat = fs.existsSync(spec) ? fs.lstatSync(spec) : null;
+  if ((!specStat || (specStat.isFile() && !specStat.isSymbolicLink() && specStat.nlink === 1)) &&
+      targets.length && targets.every(target => key(path.resolve(cwd, target)) === key(spec))) return;
+  if (['blocked', 'failed'].includes(workflow.state)) throw new Error('workflow is BLOCKED; replan through the controller before mutation');
+  if (isMajorWorkflow(workflow)) {
+    const isolatedRoot = linkedWorktree(cwd, root);
+    if (!isolatedRoot) throw new Error('Git worktree isolation is required before mutation. Enter a linked worktree; unavailable isolation means BLOCKED, never in-place fallback.');
+    if (DIRECT.has(tool)) assertTargets(payload, cwd, isolatedRoot);
+    else assertShellScope(command, cwd, isolatedRoot);
+  }
+  if (workflow.state === 'satisfied') throw new Error('workflow is already satisfied; submit a new task before further mutation');
+  if (String(workflow.strategy || '').startsWith('fable-') && !matchingRun(context)) {
+    throw new Error('selected Fable workflow has no correlated run. Write workflow-stages.json at the displayed session path, then use workflow-disposition.js start.');
+  }
+  if (workflow.strategy === 'iterative-single') {
+    recordBudgetEvent(context, 'iteration', { evidence: `${tool}:${commandClass}` });
+  }
+  workflow.lastMutationAt = Date.now();
+  saveWorkflow(context);
+}
+
+readHookInput(decide);

package/plugins/harness-everything/hooks/scripts/workflow-stop-gate.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+'use strict';
+
+const path = require('path');
+const { readJson } = require('./lib/fable-contracts');
+const { loadWorkflow, saveWorkflow, matchingRun, unresolvedStages, readHookInput } = require('./lib/workflow-runtime');
+
+function decide(payload) {
+  if (!payload) return;
+  const context = loadWorkflow(payload);
+  const { workflow, sessionDir } = context;
+  if (!workflow || ['deferred', 'satisfied'].includes(workflow.state)) return;
+  if (workflow.state === 'blocked') {
+    console.error('[Workflow Completion Gate] BLOCKED: report the unresolved work; completion has not been verified.');
+    return;
+  }
+  let unresolved = [];
+  if (String(workflow.strategy || '').startsWith('fable-')) {
+    const match = matchingRun(context);
+    unresolved = match ? unresolvedStages(match, workflow) : ['correlated-run-missing'];
+  } else {
+    const handoff = readJson(path.join(sessionDir, 'handoff-state.json'));
+    const lastEdit = Math.max(workflow.lastMutationAt || 0, handoff?.lastEditAt || 0);
+    if (lastEdit && ((handoff?.lastVerifyAt || 0) < lastEdit || handoff?.lastVerifyExitCode !== 0)) unresolved = ['verification-after-edit-missing'];
+  }
+  if (unresolved.length) {
+    workflow.unresolved = unresolved;
+    if (payload.stop_hook_active) {
+      // Do not loop forever or pretend the retry satisfied the contract.
+      workflow.state = 'blocked';
+      workflow.blockReason = 'unresolved-stop-retry';
+      saveWorkflow(context);
+      console.error('[Workflow Completion Gate] BLOCKED: ' + unresolved.join(', ') + '. Report the blocker; this is not completion.');
+      return;
+    }
+    saveWorkflow(context);
+    throw new Error('Cannot complete: unresolved workflow obligations: ' + unresolved.join(', '));
+  }
+  workflow.state = 'satisfied';
+  workflow.resolvedAt = new Date().toISOString();
+  workflow.unresolved = [];
+  saveWorkflow(context);
+}
+readHookInput(decide);

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/scripts/lib/advisory-text.js

@@ -1,6 +1,5 @@
-// Prompt-injection-only guidance for platforms with no hook/execution
-// mechanism (Cursor, Copilot, Codex, Continue, Hermes). Single source of
-// truth for the advisory block.
+// Prompt-injection guidance for integration paths where Harness cannot prove
+// lifecycle-hook enforcement. Single source of truth for advisory blocks.
 const fs = require('fs');
 const path = require('path');
 
@@ -8,34 +7,36 @@ const MARKER = "Harness OS Guidance (Advisory)";
 
 const advisoryInstructions = [
   `\n# ${MARKER}`,
-  `This file is advisory only - this platform has no hook/execution mechanism to`,
-  `enforce it mechanically (unlike Claude Code's hook-based circuit breaker). Treat`,
-  `these as strong defaults, not guarantees.`,
+  `This surface cannot be assumed to mechanically enforce every Harness lifecycle transition.`,
+  `Treat the workflow contract below as required agent behavior, while keeping enforcement`,
+  `claims bounded by the host's verified capabilities.`,
   ``,
-  `## 🚦 MANDATORY ENTRY TRIAGE & ROUTING (ALWAYS RUN FIRST)`,
-  `Every time you receive a new software/project prompt, you MUST load the \`harness-everything\` skill and immediately do the following:`,
-  `1. Run \`npx github:dyphn1/Harness-everything next "<Brief summary of user's prompt>"\` (this prints the same routing recommendation kernel-router.js produces - it works from any directory and does not depend on where a local copy of the skill was installed). If the terminal is not available yet, apply the same routing contract from the loaded \`harness-everything\` skill instead of skipping this step.`,
-  `2. For EVERY suggested skill, resolve and read its complete \`SKILL.md\` entry before deciding to skip it. Evaluate \`USE FOR\`, \`DO NOT USE FOR\`, workflow/basic flow, and hard rules against the task. If the entry explicitly requires another document to decide applicability, read that required material too. Do not reject a suggestion from only its name, description, router summary, or because the task seems routine/common.`,
-  `3. After that evaluation, execution is advisory: use, combine, reorder, or skip skills as justified. Using one suggestion does not waive read-before-skip for the others. If a suggested skill cannot be resolved/read, mark it unresolved/unavailable instead of silently skipping it.`,
-  `4. Output a clear routing checkpoint near the beginning of your response/update:`,
+  `## 🚦 MANDATORY ENTRY TRIAGE & WORKFLOW ROUTING`,
+  `For every software/project prompt, load the \`harness-everything\` skill and establish the routing contract before mutation:`,
+  `1. Run \`npx github:dyphn1/Harness-everything next "<Brief summary of user's prompt>"\`. If terminal execution is unavailable, apply the same contract from the skill instead of skipping routing.`,
+  `2. For EVERY suggested skill, read its complete \`SKILL.md\` entry and resolve applicability from \`USE FOR\`, \`DO NOT USE FOR\`, workflow/basic flow, and hard rules. A name, description, router summary, or "routine/simple/already clear" judgement is not enough to omit it.`,
+  `3. The selected workflow topology is mandatory once applicable. Execute it to resolution; choose tools, reasoning, implementation technique, and decomposition freely inside it. Do not replace it with a direct path because you believe you can solve the task without the workflow.`,
+  `4. If the selected workflow genuinely cannot cover part of the task, record an explicit escape for the uncovered scope with evidence. Covered obligations remain mandatory. Host-capability loss must be surfaced, not silently converted into optional execution.`,
+  `5. Surface a compact checkpoint near the first progress update:`,
   `   \`\`\`markdown`,
   `   ## 🚦 Harness OS Routing Checkpoint`,
-  `   - **Active Tier**: Tier 1 (Trivial) | Tier 2 (Standard) | Tier 3 (Macro)`,
-  `   - **Rationale**: <1-sentence rationale from the router output>`,
+  `   - **Active Tier**: Tier 1 | Tier 2 | Tier 3 | unclassified`,
+  `   - **Strategy**: <selected/deferred strategy>`,
+  `   - **Workflow State**: <active | deferred | blocked | escaped>`,
   `   - **Required Invariants**: <router invariants>`,
-  `   - **Suggested Skills**: <deduplicated router suggestions or none>`,
-  `   - **Suggestion Evaluation**: <evaluated before skip | pending | unresolved/unavailable>`,
-  `   - **Disposition**: <skills used, or skipped all after evaluation with a brief flow-grounded reason>`,
+  `   - **Suggested Skills**: <deduplicated suggestions or none>`,
+  `   - **Applicability**: <use | not-applicable + reason | unresolved/unavailable>`,
+  `   - **Escape**: <none | reason + uncovered scope + evidence>`,
   `   \`\`\``,
   ``,
-  `## 🤖 COGNITIVE COMPLIANCE (NO SILENT DEGRADES FOR NEW FEATURES)`,
-  `- **Newly Added Features / Extensions**: Do not silently collapse a task that introduces new logic, a new API endpoint, or a new file/module into a trivial direct-edit path. Route it first and justify the tier from task evidence.`,
-  `- **Tier 2 / Tier 3 Suggestions**: There is NO universal TODO/TDD/Fable sequence. Router suggestions are mandatory to evaluate by reading their skill entry, but optional to execute after that evaluation. Choose the smallest applicable set.`,
-  `- **Pre-Completion Verification Gate**: Before telling the human the task is done, run \`npx github:dyphn1/Harness-everything verify\` in the project root. If it exits non-zero, fix the failures and run it again before declaring completion. On Claude Code this same check can be mechanically enforced by a stop hook; here nothing blocks you from skipping it, so treat it as a real requirement, not a suggestion.`,
-  `- **Memory Summarization (Self-Evolve)**: When the task produces a reusable verified lesson, use the \`self-evolve\` flow to persist it; do not manufacture memory for routine work.`,
-  `- **Environment Discovery**: Discover the environment (OS, shell, package manager) before running commands - don't assume.`,
-  `- **Rule of 3**: If the same error repeats 3 times in a row, STOP retrying. Explain what's failing and use a fresh diagnosis / zoom-out instead of continuing to guess.`,
-  `- **Prefer Editing**: Prefer editing over rewriting; commit logically complete chunks rather than one giant diff.`,
+  `## 🤖 COGNITIVE COMPLIANCE`,
+  `- **No universal skill pipeline**: do not force every task through TODO/TDD/Fable. The router selects the smallest sufficient topology; suggested skills are resolved for applicability.`,
+  `- **Applicable skill flow**: reading a skill is not permission to discard it when its workflow actually applies.`,
+  `- **Pre-completion verification**: before declaring done, run \`npx github:dyphn1/Harness-everything verify\` in the project root and fix failures. An instruction-only host may not block you mechanically, but the requirement remains part of the contract.`,
+  `- **Rule of 3**: after 3 same-signature failures, stop micro-retrying and use a fresh diagnosis / zoom-out.`,
+  `- **Environment discovery**: discover OS, shell, package manager/runtime, and host capability before relying on them.`,
+  `- **Memory / self-evolve**: persist only verified reusable lessons; use escape/replan/recovery evidence to improve workflow coverage rather than bypassing the active workflow.`,
+  `- **Prefer editing**: prefer targeted edits and logically complete commits over broad rewrites.`,
   ``
 ].join('\n');
 
@@ -70,30 +71,27 @@ function injectAdvisoryText(targetFile, header, label) {
 function removeAdvisoryText(targetFile) {
   if (!fs.existsSync(targetFile)) return;
   try {
-    let content = fs.readFileSync(targetFile, 'utf8');
+    const content = fs.readFileSync(targetFile, 'utf8');
     const markerIndex = content.indexOf(MARKER);
-    if (markerIndex !== -1) {
-      let cleanContent = content;
-      const hashMarkerIndex = content.lastIndexOf('#', markerIndex);
-      if (hashMarkerIndex !== -1) cleanContent = content.substring(0, hashMarkerIndex).trim() + '\n';
-      else cleanContent = content.substring(0, markerIndex).trim() + '\n';
+    if (markerIndex === -1) return;
+    let cleanContent = content;
+    const hashMarkerIndex = content.lastIndexOf('#', markerIndex);
+    if (hashMarkerIndex !== -1) cleanContent = content.substring(0, hashMarkerIndex).trim() + '\n';
+    else cleanContent = content.substring(0, markerIndex).trim() + '\n';
 
-      const lines = cleanContent.trim().split('\n').map(l => l.trim()).filter(l => l !== '');
-      if (lines.length === 0 || (lines.length === 1 && (lines[0] === '# Cursor Project Rules' || lines[0] === '# AGENTS.md' || lines[0] === '# Copilot Instructions' || lines[0] === '# .hermes.md'))) {
-        fs.unlinkSync(targetFile);
-        console.log(`  ✅ Removed empty advisory file: ${targetFile}`);
-      } else {
-        fs.writeFileSync(targetFile, cleanContent.trim() + '\n', 'utf8');
-        console.log(`  ✅ Removed Harness guidance from: ${targetFile}`);
-      }
+    const lines = cleanContent.trim().split('\n').map(l => l.trim()).filter(Boolean);
+    if (lines.length === 0 || (lines.length === 1 && ['# Cursor Project Rules', '# AGENTS.md', '# Copilot Instructions', '# .hermes.md'].includes(lines[0]))) {
+      fs.unlinkSync(targetFile);
+      console.log(`  ✅ Removed empty advisory file: ${targetFile}`);
+    } else {
+      fs.writeFileSync(targetFile, cleanContent.trim() + '\n', 'utf8');
+      console.log(`  ✅ Removed Harness guidance from: ${targetFile}`);
     }
   } catch (e) {
     console.warn(`  ⚠️ Error removing advisory text from ${targetFile}: ${e.message}`);
   }
 }
 
-// Continue gets a dedicated rule file. If a user already owns that exact
-// path, do not replace it just because Harness chose the same filename.
 function installContinueRule(targetFile, label) {
   const dir = path.dirname(targetFile);
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
@@ -103,7 +101,7 @@ function installContinueRule(targetFile, label) {
     `---`,
     `name: Harness OS Guidance`,
     `alwaysApply: true`,
-    `description: "Harness OS routing, circuit-breaker awareness, and environment-discovery guidance (advisory only on Continue - no hook mechanism)"`,
+    `description: "Harness OS routing and workflow guidance (instruction-governed on Continue unless a lifecycle mechanism is independently verified)"`,
     `---`,
     advisoryInstructions.replace(/^\n/, '')
   ].join('\n');
@@ -139,25 +137,24 @@ function buildCopilotGlobalContent() {
 function buildCodexGlobalContent() {
   return [
     `---`,
-    `description: "Harness OS Guidance - Global custom agent for orchestrating multi-agent workflows"`,
+    `description: "Harness OS Guidance - Global custom agent for orchestrating software workflows"`,
     `name: "Harness"`,
     `user-invocable: true`,
     `---`,
     `# AGENTS.md`,
     ``,
     `# ${MARKER}`,
-    `This file is advisory only - this platform has no hook/execution mechanism to`,
-    `enforce it mechanically. Treat these as strong defaults, not guarantees.`,
+    `This instruction surface cannot be assumed to provide hard lifecycle blocking.`,
     ``,
-    `- Discover the environment (OS, shell, package manager) before running commands - don't assume.`,
+    `- Discover the environment and host capabilities before relying on them.`,
     `- For software/project work, run \`npx github:dyphn1/Harness-everything next "<summary>"\` before mutation and surface the routing checkpoint.`,
-    `- For EVERY suggested skill, read its complete \`SKILL.md\` entry/basic flow before skipping it. Evaluate \`USE FOR\`, \`DO NOT USE FOR\`, workflow, and hard rules; do not skip from the name/description/router summary alone.`,
-    `- Suggested-skill execution remains optional after evaluation. Using one suggestion does not waive evaluation of the other omitted suggestions; unreadable suggestions are unresolved/unavailable, not silently skipped.`,
-    `- Do not impose a universal TODO/TDD/Fable sequence. Choose the smallest applicable skill set after evaluation.`,
-    `- Before declaring a task done, run \`npx github:dyphn1/Harness-everything verify\` and fix any failures`,
-    `  it reports - nothing here blocks you from skipping this, so treat it as a real requirement.`,
-    `- If the same error repeats 3 times in a row, STOP retrying and use a fresh diagnosis / zoom-out.`,
-    `- Prefer editing over rewriting; commit logically complete chunks rather than one giant diff.`,
+    `- Read every suggested skill's complete \`SKILL.md\` entry before resolving applicability; do not omit it from metadata or confidence alone.`,
+    `- Execute the selected workflow topology to resolution. The model controls HOW inside the topology, not WHETHER the selected topology exists.`,
+    `- Do not impose a universal TODO/TDD/Fable sequence; use the smallest selected topology plus applicable skills.`,
+    `- Escape only for genuinely uncovered workflow scope and record reason + scope + evidence.`,
+    `- Before declaring done, run \`npx github:dyphn1/Harness-everything verify\` and fix failures.`,
+    `- After 3 same-signature failures, stop retrying and use a fresh diagnosis / zoom-out.`,
+    `- Prefer targeted edits and logically complete commits.`,
     ``
   ].join('\n');
 }
@@ -173,4 +170,4 @@ module.exports = {
   removeContinueRule,
   buildCopilotGlobalContent,
   buildCodexGlobalContent,
-};
+};

package/plugins/harness-everything/skills/fable-mode/CONTRACT-FORMAT.md

@@ -59,7 +59,9 @@ Rules:
 
 ## Workflow-plan consumer
 
-Before dispatch, write the router contract and stage array to files and run:
+For a session with an active mandatory workflow, write the stage array to the router-displayed `workflow-stages.json` path and invoke its `workflow-disposition.js start --session-id <id>` command. This binds the run to the active `workflowId` and bound workspace even after entering a linked worktree. Every required stage needs an objective check, and an independent plan needs a read-only `fable-verifier` stage depending on all other stages. Stage results need observed worker identities and numeric exit codes; missing metadata is blocked/degraded, not success.
+
+For standalone use without an active session contract, write the router contract and stage array to files and run:
 
 ```bash
 node fable-mode/scripts/workflow-plan-consumer.js \

package/plugins/harness-everything/skills/fable-mode/SKILL.md

@@ -4,7 +4,7 @@ description: "Stage large, multi-source or multi-session tasks through a written
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.9.0
 ---
 
 # Fable Mode (v3)

package/plugins/harness-everything/skills/fable-mode/agents/fable-orchestrator.md

@@ -53,9 +53,10 @@ overlap reject dispatch instead of becoming a verbal warning.
 
 The stage map remains a living orchestration document only inside those
 constraints. When new information invalidates it, re-plan and create revised
-stage contracts before dispatching new work. Replan budget: at most two full
-replans per run; a third means the task is ambiguous at the requirements level —
-return the ambiguity to the caller instead of burning stages. Scope rule:
+stage contracts before dispatching new work. Replan budget comes from `workflowPlan.limits.maxReplans` and is accounted by
+the runtime controller. Re-enter through `workflow-disposition.js start`; a
+third full replan under the default budget is machine-blocked as
+`replan-budget-exhausted` instead of being only an orchestration reminder. Scope rule:
 deliver the task as specified; new scope discovered mid-run is surfaced as a
 recommendation at delivery, not silently built.
 
@@ -75,10 +76,11 @@ spawn workers.
 
 For `fable-parallel`, spawn only stages in the same validated execution batch;
 never invent an additional parallel edge. A stage depending on another stage is
-not in the same ready batch. Cap concurrent workers at four — this remains
-Fable's single source of truth for the numeric worker cap. For other Fable
-strategies, serialize the returned batches unless a later validated plan says
-otherwise.
+not in the same ready batch. Never exceed `workflowPlan.limits.maxWorkers`. The router plan is the numeric
+source of truth; `workflow-plan-consumer.js` chunks ready sets to that cap and
+runtime worker leases enforce it when the host exposes stable worker IDs. For
+other Fable strategies, serialize the returned batches unless a later validated
+plan says otherwise.
 
 **3. Verify with a check that can fail — external artifacts only.** Each stage
 defines a pass condition an external artifact satisfies: a test that runs, a file

package/plugins/harness-everything/skills/fable-mode/execution-guardrails/SKILL.md

@@ -7,7 +7,7 @@ description: >-
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.9.0
 ---
 
 # Execution Guardrails

package/plugins/harness-everything/skills/fable-mode/fable-haiku/SKILL.md

@@ -4,7 +4,7 @@ description: "Run staged fable work on Haiku for bulk mechanical tasks with expl
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.9.0
 ---
 
 # Fable Mode — Haiku

package/plugins/harness-everything/skills/fable-mode/fable-opus/SKILL.md

@@ -4,7 +4,7 @@ description: "Run staged fable orchestration on Opus for cross-stage synthesis,
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.9.0
 ---
 
 # Fable Mode — Opus

package/plugins/harness-everything/skills/fable-mode/fable-sonnet/SKILL.md

@@ -4,7 +4,7 @@ description: "Run staged fable work on Sonnet for non-trivial implementation, re
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.9.0
 ---
 
 # Fable Mode — Sonnet

package/plugins/harness-everything/skills/fable-mode/scripts/workflow-plan-consumer.js

@@ -155,20 +155,23 @@ function validateParallelBatch(stages) {
   }
 }
 
-function dependencyBatches(stages, validateWrites) {
+function dependencyBatches(stages, validateWrites, maxBatchSize = Infinity) {
   const byId = new Map(stages.map(stage => [stage.stageId, stage]));
   const remaining = new Set(byId.keys());
   const completed = new Set();
   const batches = [];
+  const boundedSize = Number.isInteger(maxBatchSize) && maxBatchSize > 0 ? maxBatchSize : Infinity;
 
   while (remaining.size > 0) {
     const ready = [...remaining]
       .filter(stageId => byId.get(stageId).dependsOn.every(dep => completed.has(dep)))
       .sort();
     if (ready.length === 0) throw new Error('unresolved or cyclic dependency graph');
-    const batch = ready.map(stageId => byId.get(stageId));
-    if (validateWrites) validateParallelBatch(batch);
-    batches.push(batch.map(stage => stage.stageId));
+    const readyStages = ready.map(stageId => byId.get(stageId));
+    if (validateWrites) validateParallelBatch(readyStages);
+    for (let offset = 0; offset < readyStages.length; offset += boundedSize) {
+      batches.push(readyStages.slice(offset, offset + boundedSize).map(stage => stage.stageId));
+    }
     for (const stageId of ready) {
       remaining.delete(stageId);
       completed.add(stageId);
@@ -177,8 +180,8 @@ function dependencyBatches(stages, validateWrites) {
   return batches;
 }
 
-function topologicalBatches(stages) {
-  return dependencyBatches(stages, true);
+function topologicalBatches(stages, maxWorkers) {
+  return dependencyBatches(stages, true, maxWorkers);
 }
 
 function sequentialBatches(stages) {
@@ -209,7 +212,7 @@ function atomicWriteJson(filePath, value) {
   fs.renameSync(tempPath, filePath);
 }
 
-function prepareRun({ routerContract, stages, workspaceRoot, runId, sessionId = null }) {
+function prepareRun({ routerContract, stages, workspaceRoot, runId, sessionId = null, workflowId = null }) {
   const plan = validateRouterPlan(routerContract);
   const normalizedStages = validateStageGraph(stages || []);
   if (normalizedStages.length === 0) throw new Error('at least one stage contract is required');
@@ -222,7 +225,7 @@ function prepareRun({ routerContract, stages, workspaceRoot, runId, sessionId =
   if (fs.existsSync(runRoot)) throw new Error(`runId already exists in this workspace: ${resolvedRunId}`);
 
   const batches = plan.strategy === 'fable-parallel'
-    ? topologicalBatches(normalizedStages)
+    ? topologicalBatches(normalizedStages, plan.limits && plan.limits.maxWorkers)
     : sequentialBatches(normalizedStages);
 
   const createdAt = new Date().toISOString();
@@ -237,6 +240,7 @@ function prepareRun({ routerContract, stages, workspaceRoot, runId, sessionId =
       planId,
       runId: resolvedRunId,
       sessionId: sessionId || null,
+      workflowId,
       workspaceRoot: root,
       ...stage,
       workerId: null,
@@ -252,6 +256,7 @@ function prepareRun({ routerContract, stages, workspaceRoot, runId, sessionId =
     planId,
     runId: resolvedRunId,
     sessionId: sessionId || null,
+    workflowId,
     workspaceRoot: root,
     workspaceKey: getWorkspaceKey(root),
     strategy: plan.strategy,

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through the Harness kernel: classify T
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.8.0
+  version: 0.9.0
 ---
 
 # Harness Everything
@@ -12,26 +12,27 @@ metadata:
 Kernel routing entry.
 
 ## USE FOR:
-- Software/project triage, re-routing, and suggested-skill evaluation.
+- Software/project triage, routing, re-routing, and workflow selection.
 - Work that names or matches another skill.
 
 ## DO NOT USE FOR:
 - General Q&A or non-software writing.
 
 ## Invariants
-1. **Route before execution** — establish scope/tier.
+1. **Route before execution** — establish scope/tier and the smallest applicable workflow.
 2. **Verify before claim** — require objective evidence.
 3. **Re-plan on repetition** — after 3 same-signature failures, use `zoom-out`.
-4. **Evaluate before skip** — read each suggested skill's complete `SKILL.md`.
-
-Tier guidance is not a fixed pipeline.
+4. **Evaluate before omission** — read each suggested skill's `SKILL.md` before deciding applicability.
+5. **Resolve selected workflow** — model confidence is not an escape condition.
 
 ## Workflow
 1. Reuse kernel output, or run `node "<this-skill-dir>/scripts/kernel-router.js" "<prompt summary>"`.
-2. Make the **Harness Routing Checkpoint** user-visible.
-3. For every suggestion, read its `SKILL.md`; evaluate `USE FOR`, `DO NOT USE FOR`, workflow/basic flow, and hard rules. Name, description, router summary, or "routine/common task" alone cannot justify skip. Read extra material only when explicitly required for applicability.
-4. Execution is advisory after evaluation. Unreadable suggestions are `unresolved/unavailable`. Using one suggestion does not waive evaluation of others. If all are skipped, give one brief flow-grounded reason.
+2. Surface the **Harness Routing Checkpoint**.
+3. Read each suggested `SKILL.md`; evaluate `USE FOR`, `DO NOT USE FOR`, workflow/basic flow, and hard rules. "Simple", "routine", names, or summaries alone cannot justify omission.
+4. Execute the selected workflow topology to resolution. Suggested skills are conditional on applicability; the selected topology is not advisory.
+5. If the workflow genuinely cannot represent part of the task, use the explicit escape with uncovered scope + evidence. Covered obligations remain mandatory.
+6. Complete only after applicable workflow obligations and objective verification resolve.
 
-**Rule:** mandatory evaluation, advisory execution; no fixed workflow order.
+**Rule:** mandatory applicable workflow; flexible reasoning/implementation inside it; evidence-backed escape only for uncovered scope.
 
 Deep dive: <this-skill-dir>/references/triage-and-tiers.md