intentdna 1.7.4 → 1.8.0

package/dist/cli/commands/workflow.js

@@ -0,0 +1,3053 @@
+/**
+ * dna workflow — draft-only workflow builder.
+ */
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { AUTHORING_PACKET_SCHEMA_VERSION, buildAuthoringPacket, createWorkflowDraft, createWorkflowEditPlan, createWorkflowEditPlanFromWorkflow, buildWorkflowDesignPacket, workflowDraftExamples, workflowDraftToTemplateYaml, appendSuggestionReviewReceipt, buildSuggestionReviewReceipt, findTerminalSuggestionReceipt, normalizeReviewDecision, sha256Canonical, suggestionBindingDigest, } from "../../workflow/index.js";
+import { parseYAML } from "../../schema/yaml-parser.js";
+import { findTemplateCatalogEntry } from "../../templates/catalog.js";
+import { TEMPLATE_MATCH_METADATA, WORKFLOW_ASSET_IDS, WORKFLOW_SUGGESTION_IDS, } from "../../templates/metadata.js";
+import { activeEvidenceFollowupReviewRoute, buildWorkflowAssetCandidateBacklog, buildWorkflowAssetEvidenceIndex, findWorkflowAsset, listWorkflowAssets, getWorkflowAssetMetadata, } from "../../assets/index.js";
+import { buildAssetSuggestions, runAssets } from "./assets.js";
+import { readOrganizationProfile, reviewOrganization } from "../../organization/index.js";
+const EXAMPLE_IDS = ["dev_pipeline", "evidence_review", "rewrite_governance"];
+const EDIT_OPERATIONS = ["insert_step", "add_verifier", "tighten_boundary", "split_step", "replace_role"];
+function normalizeExample(value) {
+    return EXAMPLE_IDS.includes(value) ? value : "rewrite_governance";
+}
+function normalizeStrictness(value) {
+    return value === "high" ? "high" : "standard";
+}
+function normalizeOperation(value) {
+    return EDIT_OPERATIONS.includes(value) ? value : "insert_step";
+}
+function inferEditOperation(instruction) {
+    const lower = instruction.toLowerCase();
+    if (/(verify|verifier|validation|validate|equivalence|test|check|证明|验证|校验)/i.test(lower)) {
+        return { operation: "add_verifier", reason: "instruction asks for verification or evidence checking", confidence: "high" };
+    }
+    if (/(boundary|guard|constraint|strict|tighten|scope|limit|gate|block|边界|约束|收紧|限制)/i.test(lower)) {
+        return { operation: "tighten_boundary", reason: "instruction asks to tighten a boundary or gate", confidence: "high" };
+    }
+    if (/(split|separate|divide|break into|拆分|分成)/i.test(lower)) {
+        return { operation: "split_step", reason: "instruction asks to split a step", confidence: "high" };
+    }
+    if (/(replace role|change role|switch role|改成.*role|角色.*替换|替换.*角色)/i.test(lower)) {
+        return { operation: "replace_role", reason: "instruction asks to replace a role", confidence: "medium" };
+    }
+    return { operation: "insert_step", reason: "default edit is inserting a new workflow step", confidence: "low" };
+}
+function workflowForExample(example) {
+    const exampleId = normalizeExample(example);
+    return workflowDraftExamples().find((entry) => entry.id === exampleId)?.workflow
+        ?? workflowDraftExamples()[0].workflow;
+}
+function termsFromText(value) {
+    return value
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .map((term) => term.trim())
+        .filter((term) => term.length >= 3)
+        .filter((term) => !["the", "and", "for", "with", "after", "before", "into", "from"].includes(term));
+}
+function stepMatchScore(instruction, step) {
+    const lower = instruction.toLowerCase();
+    const stepId = step.id.toLowerCase();
+    const stepIdPhrase = stepId.replace(/[-_]+/g, " ");
+    let score = 0;
+    if (keywordMatchesDescription(lower, stepId))
+        score += 8;
+    if (stepIdPhrase !== stepId && keywordMatchesDescription(lower, stepIdPhrase))
+        score += 8;
+    for (const term of termsFromText(step.id)) {
+        if (keywordMatchesDescription(lower, term))
+            score += 4;
+    }
+    for (const term of termsFromText(step.role)) {
+        if (keywordMatchesDescription(lower, term))
+            score += 2;
+    }
+    for (const term of termsFromText(`${step.description ?? ""} ${step.prompt ?? ""}`)) {
+        if (keywordMatchesDescription(lower, term))
+            score += 1;
+    }
+    return score;
+}
+function inferTargetStep(instruction, steps) {
+    const lower = instruction.toLowerCase();
+    const after = lower.match(/\b(?:after|before)\s+([a-z0-9_-]+)/);
+    if (after?.[1]) {
+        const referenced = steps.find((step) => step.id.toLowerCase() === after[1]);
+        if (referenced)
+            return { targetStep: referenced.id, reason: `instruction references ${after[0]}`, confidence: "high" };
+    }
+    const scored = steps
+        .map((step) => ({ step, score: stepMatchScore(instruction, step) }))
+        .filter((entry) => entry.score >= 3)
+        .sort((a, b) => b.score - a.score || steps.indexOf(a.step) - steps.indexOf(b.step));
+    if (scored[0]) {
+        return {
+            targetStep: scored[0].step.id,
+            reason: `instruction matches current workflow step ${scored[0].step.id}`,
+            confidence: scored[0].score >= 8 ? "high" : "medium",
+        };
+    }
+    const fallback = steps.at(-1);
+    return fallback
+        ? { targetStep: fallback.id, reason: `no direct step match; defaulting to last workflow step ${fallback.id}`, confidence: "low" }
+        : { confidence: "low" };
+}
+function inferRole(operation, instruction) {
+    const lower = instruction.toLowerCase();
+    const explicitRole = lower.match(/\b(?:role|as|to)\s+([a-z][a-z0-9_-]{2,})\b/);
+    if (operation === "replace_role" && explicitRole?.[1]) {
+        return { role: explicitRole[1], reason: `instruction names role ${explicitRole[1]}`, confidence: "high" };
+    }
+    if (operation === "add_verifier")
+        return { role: "verifier", reason: "verifier edit uses verifier role", confidence: "high" };
+    if (operation === "tighten_boundary")
+        return { role: "architect", reason: "boundary edits usually belong to architecture/governance role", confidence: "medium" };
+    if (/(review|审查|复核)/i.test(lower))
+        return { role: "reviewer", reason: "instruction references review", confidence: "medium" };
+    if (/(test|qa|验证|测试)/i.test(lower))
+        return { role: "test-engineer", reason: "instruction references tests", confidence: "medium" };
+    if (/(plan|intent|需求|计划)/i.test(lower))
+        return { role: "planner", reason: "instruction references planning or intent", confidence: "medium" };
+    return { confidence: "low" };
+}
+function mergeConfidence(values) {
+    if (values.includes("low"))
+        return "low";
+    if (values.includes("medium"))
+        return "medium";
+    return "high";
+}
+function buildEditInput(params) {
+    const operationInferred = inferEditOperation(params.instruction);
+    const operation = params.operation ? normalizeOperation(params.operation) : operationInferred.operation;
+    const targetWorkflow = params.workflow ?? workflowForExample(params.example);
+    const targetInferred = inferTargetStep(params.instruction, targetWorkflow.steps);
+    const roleInferred = inferRole(operation, params.instruction);
+    const reasons = [];
+    if (!params.operation)
+        reasons.push(`operation inferred: ${operationInferred.reason}`);
+    if (!params.targetStep && targetInferred.reason)
+        reasons.push(`target step inferred: ${targetInferred.reason}`);
+    if (!params.role && roleInferred.reason)
+        reasons.push(`role inferred: ${roleInferred.reason}`);
+    return {
+        exampleId: normalizeExample(params.example),
+        goal: params.instruction,
+        strictness: normalizeStrictness(params.strictness),
+        operation,
+        instruction: params.instruction,
+        targetStep: params.targetStep ?? targetInferred.targetStep,
+        role: params.role ?? roleInferred.role,
+        source: params.fromTemplate ? `template:${params.fromTemplate}` : undefined,
+        inference: {
+            operation: params.operation ? "explicit" : "inferred",
+            targetStep: params.targetStep ? "explicit" : targetInferred.targetStep ? "inferred" : "default",
+            role: params.role ? "explicit" : roleInferred.role ? "inferred" : "default",
+            confidence: mergeConfidence([
+                params.operation ? "high" : operationInferred.confidence,
+                params.targetStep ? "high" : targetInferred.confidence,
+                params.role ? "high" : roleInferred.confidence,
+            ]),
+            reasons,
+        },
+    };
+}
+function normalizeSuggestionId(value) {
+    return value?.trim() || "template-model-verifier";
+}
+function normalizeTemplateName(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "workflow-draft";
+}
+function templateIdForAsset(assetName) {
+    return `template_${assetName.replaceAll("-", "_")}`;
+}
+function commandQuote(value) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function suggestedDraftTemplateName(value) {
+    const normalized = normalizeTemplateName(value);
+    const truncated = normalized.length > 48 ? normalized.slice(0, 48).replace(/-+$/g, "") : normalized;
+    return truncated || "workflow-draft";
+}
+function defaultSyncCommand(target) {
+    const normalized = target.toLowerCase();
+    if (normalized === "codex")
+        return "dna sync --codex";
+    if (normalized === "claude" || normalized === "claude-code")
+        return "dna sync";
+    return `dna sync --target ${normalized}`;
+}
+function templateNameFromPlanSource(source) {
+    if (!source)
+        return undefined;
+    const parts = source.split(":");
+    if ((parts[0] === "template" || parts[0] === "suggestions") && parts[1])
+        return parts[1];
+    return source;
+}
+function editOperationUseWhen(operation) {
+    switch (operation) {
+        case "insert_step": return "add a new human or agent step into the workflow";
+        case "add_verifier": return "add proof, test, equivalence, or evidence checking";
+        case "tighten_boundary": return "make a step stricter with a blocking checkpoint";
+        case "split_step": return "separate one broad step into prepare and execute steps";
+        case "replace_role": return "change who owns an existing step";
+    }
+}
+function routeEditTargetStep(description, selectedAsset) {
+    const steps = selectedAsset?.workflows.flatMap((workflow) => workflow.steps) ?? [];
+    return inferTargetStep(description, steps).targetStep ?? "STEP_ID";
+}
+function buildWorkflowRouteEditOperations(params) {
+    const targetStep = routeEditTargetStep(params.description, params.selectedAsset);
+    return EDIT_OPERATIONS.map((operation) => ({
+        operation,
+        useWhen: editOperationUseWhen(operation),
+        targetStep,
+        command: `dna workflow edit-plan "Describe the reviewed workflow change" --from-template ${params.selectedAssetName} --operation ${operation} --target-step ${targetStep} --save-template ${params.nextVersion}`,
+        writes: true,
+    }));
+}
+function stepIds(workflow) {
+    return workflow.steps.map((step) => step.id);
+}
+function successors(workflow, targetStep) {
+    return workflow.steps
+        .filter((step) => (step.depends_on ?? []).includes(targetStep))
+        .map((step) => step.id);
+}
+function buildChangePreview(plan, params) {
+    const baseIds = new Set(stepIds(plan.base_workflow));
+    const proposedIds = new Set(stepIds(plan.proposed_workflow));
+    const target = plan.operations[0]?.target ?? plan.input.targetStep ?? "workflow";
+    const addedSteps = plan.proposed_workflow.steps
+        .filter((step) => !baseIds.has(step.id))
+        .map((step) => ({
+        id: step.id,
+        role: step.role,
+        after: step.depends_on ?? [],
+    }));
+    const removedSteps = plan.base_workflow.steps
+        .filter((step) => !proposedIds.has(step.id))
+        .map((step) => step.id);
+    return {
+        baseStepCount: plan.base_workflow.steps.length,
+        proposedStepCount: plan.proposed_workflow.steps.length,
+        addedSteps,
+        removedSteps,
+        targetBefore: successors(plan.base_workflow, target),
+        targetAfter: successors(plan.proposed_workflow, target),
+        suggestedNext: params.saveTemplate
+            ? "Review the saved draft diff, then run asset adoption and organization binding only after manager approval."
+            : "Run the save command if this preview is correct, then review the asset diff before adoption or sync.",
+    };
+}
+function buildEditGuidance(plan, params) {
+    const sourceTemplate = params.fromTemplate ?? templateNameFromPlanSource(plan.input.source) ?? "<template>";
+    const saveTemplate = params.saveTemplate;
+    const targetStep = plan.operations[0]?.target ?? plan.input.targetStep ?? plan.proposed_workflow.steps.at(-1)?.id ?? "workflow";
+    const instruction = commandQuote(plan.input.instruction);
+    const targetChoices = plan.base_workflow.steps.map((step) => step.id);
+    const operationChoices = EDIT_OPERATIONS.map((operation) => ({
+        operation,
+        useWhen: editOperationUseWhen(operation),
+        command: `dna workflow edit-plan ${instruction} --from-template ${sourceTemplate} --operation ${operation} --target-step ${targetStep}`,
+    }));
+    const reviewBase = saveTemplate ?? `${sourceTemplate}-v2`;
+    const reviewPath = [
+        saveTemplate
+            ? `dna assets diff ${sourceTemplate} ${saveTemplate}`
+            : `dna workflow edit-plan ${instruction} --from-template ${sourceTemplate} --save-template ${reviewBase}`,
+        `dna assets inspect ${reviewBase} --evidence`,
+        `dna assets adoption ${WORKFLOW_ASSET_IDS.verificationCommandRouting}`,
+        `record explicit manager rationale for dna assets diff ${sourceTemplate} ${reviewBase}`,
+        `dna assets adoption ${reviewBase}`,
+        `dna org bind --asset ${reviewBase} --status active --sync-target codex`,
+        "dna org rollout",
+    ];
+    return {
+        summary: `Interpreted as ${plan.input.operation} on ${targetStep}. Review the YAML preview before saving, adopting, or syncing.`,
+        changePreview: buildChangePreview(plan, params),
+        inferred: {
+            operation: plan.input.operation,
+            targetStep,
+            role: plan.input.role,
+            confidence: plan.input.inference?.confidence ?? "low",
+            reasons: plan.input.inference?.reasons ?? [],
+        },
+        operationChoices,
+        targetChoices,
+        reviewPath,
+        saveCommand: saveTemplate ? undefined : `dna workflow edit-plan ${instruction} --from-template ${sourceTemplate} --save-template ${reviewBase}`,
+        mutationBoundary: "Edit guidance is read-only. It does not save a template, adopt an asset, bind an organization, sync a harness, or deploy a surface unless an explicit follow-up command is run.",
+    };
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function keywordMatchesDescription(description, keyword) {
+    const normalizedKeyword = keyword.toLowerCase().trim();
+    if (!normalizedKeyword)
+        return false;
+    if (/^[a-z0-9 ]+$/.test(normalizedKeyword)) {
+        const pattern = normalizedKeyword.split(/\s+/).map(escapeRegExp).join("\\s+");
+        return new RegExp(`(^|[^a-z0-9])${pattern}($|[^a-z0-9])`).test(description);
+    }
+    return description.includes(normalizedKeyword);
+}
+function inferExample(description) {
+    const lower = description.toLowerCase();
+    if (["rewrite", "refactor", "migration", "migrate", "flutter", "logic equivalence", "重构", "迁移", "逻辑对等"].some((keyword) => lower.includes(keyword))) {
+        return "rewrite_governance";
+    }
+    if (["evidence", "review", "audit", "verify", "verification", "证据", "审查", "验证"].some((keyword) => lower.includes(keyword))) {
+        return "evidence_review";
+    }
+    return "dev_pipeline";
+}
+function metadataIntentSignals(description, template) {
+    const lower = description.toLowerCase();
+    return (template.intent_signals ?? [])
+        .filter((intentSignal) => intentSignal.keywords.some((keyword) => keywordMatchesDescription(lower, keyword)))
+        .map((intentSignal) => ({
+        signal: intentSignal.signal,
+        weight: intentSignal.weight,
+    }));
+}
+function assetRankingSignals(asset) {
+    if (!asset)
+        return [];
+    return [
+        asset.status === "dogfood_ready" ? "dogfood-ready" : undefined,
+        asset.evidence !== "unlinked" ? "evidence-linked" : undefined,
+        asset.cascade === "declared" ? "cascade-declared" : undefined,
+        asset.evolution === "preview_supported" ? "preview-evolution" : undefined,
+        asset.workflowCount > 1 ? "multi-workflow" : undefined,
+        asset.controllerCount > 0 ? "controller-backed" : undefined,
+    ].filter((signal) => signal !== undefined);
+}
+function intakeMatchScore(matchedKeywords, intentSignals, asset) {
+    let score = matchedKeywords.length;
+    if (asset?.status === "dogfood_ready")
+        score += 6;
+    if (asset?.evidence !== "unlinked")
+        score += 3;
+    if (asset?.cascade === "declared")
+        score += 1;
+    if (asset?.evolution === "preview_supported")
+        score += 1;
+    if ((asset?.workflowCount ?? 0) > 1)
+        score += 1;
+    if ((asset?.controllerCount ?? 0) > 0)
+        score += 1;
+    for (const signal of intentSignals)
+        score += signal.weight;
+    return score;
+}
+function workflowIntakeAsset(asset) {
+    const metadata = getWorkflowAssetMetadata(asset.name);
+    return {
+        name: asset.name,
+        source: asset.source,
+        status: asset.status.managementStatus,
+        evidence: asset.status.evidencePosture,
+        cascade: asset.status.cascadePosture,
+        evolution: asset.status.evolutionPosture,
+        configured: asset.status.configured,
+        workflowCount: asset.workflows.length,
+        controllerCount: asset.controllers.length,
+        positioning: asset.positioning ?? metadata?.positioning,
+        dogfood: metadata?.dogfood !== undefined,
+    };
+}
+async function matchWorkflowAssets(description, projectDir) {
+    const lower = description.toLowerCase();
+    const matches = [];
+    for (const template of TEMPLATE_MATCH_METADATA) {
+        const matchedKeywords = template.keywords.filter((keyword) => keywordMatchesDescription(lower, keyword));
+        if (matchedKeywords.length === 0)
+            continue;
+        const asset = await findWorkflowAsset(template.name, { projectDir });
+        const intakeAsset = asset ? workflowIntakeAsset(asset) : undefined;
+        const intentSignals = metadataIntentSignals(description, template);
+        const rankingSignals = [
+            ...intentSignals.map((signal) => signal.signal),
+            ...assetRankingSignals(intakeAsset),
+        ];
+        matches.push({
+            name: template.name,
+            displayName: template.name.replace(/-/g, " "),
+            score: intakeMatchScore(matchedKeywords, intentSignals, intakeAsset),
+            matchedKeywords,
+            rankingSignals,
+            asset: intakeAsset,
+        });
+    }
+    return matches.sort((a, b) => b.score - a.score || a.name.localeCompare(b.name));
+}
+function reusableAsset(match) {
+    return match?.asset?.status === "dogfood_ready" || match?.asset?.status === "asset_ready";
+}
+async function buildWorkflowIntake(description, projectDir) {
+    const matches = await matchWorkflowAssets(description, projectDir);
+    const best = matches[0];
+    const path = reusableAsset(best) ? "reuse_asset" : "draft_new_asset";
+    const example = inferExample(description);
+    const saveTemplate = suggestedDraftTemplateName(description);
+    const authoringPacketCommand = `dna workflow authoring-packet ${commandQuote(description)} --json`;
+    const draftCommand = `dna workflow draft ${commandQuote(description)} --example ${example} --strictness high --save-template ${saveTemplate}`;
+    const bestEvidence = best?.asset?.evidence === "dogfood_linked"
+        ? await buildWorkflowAssetEvidenceIndex(best.name, { projectDir })
+        : undefined;
+    const evidenceOpen = bestEvidence
+        ? bestEvidence.totals.continue > 0 || bestEvidence.totals.blocked > 0 || bestEvidence.totals.requestChanges > 0 || bestEvidence.totals.remaining > 0
+        : false;
+    const activeFollowup = best?.asset && evidenceOpen
+        ? activeEvidenceFollowupReviewRoute(best.name, await listWorkflowAssets({ projectDir }), bestEvidence)
+        : undefined;
+    const reuse = best?.asset
+        ? activeFollowup
+            ? [...new Set([
+                    "dna assets library",
+                    `dna assets lifecycle ${best.name}`,
+                    activeFollowup.currentCommand,
+                    activeFollowup.diffCommand,
+                    activeFollowup.adoptionCommand,
+                ])]
+            : [
+                "dna assets library",
+                `dna assets lineage ${best.name}`,
+                `dna assets inspect ${best.name} --evidence`,
+                `dna assets governance ${best.name}`,
+                `dna assets adoption ${best.name}`,
+            ]
+        : ["dna assets library"];
+    const draft = [
+        authoringPacketCommand,
+        draftCommand,
+        `dna workflow edit-plan "Describe the reviewed workflow change" --from-template ${saveTemplate} --save-template ${saveTemplate}-v2`,
+        `dna assets inspect ${saveTemplate} --evidence`,
+    ];
+    return {
+        mode: "workflow_intake",
+        input: { description },
+        recommendation: {
+            path,
+            asset: path === "reuse_asset" ? best?.name : undefined,
+            reason: path === "reuse_asset"
+                ? evidenceOpen
+                    ? `${best?.name} already looks like a managed workflow asset, but dogfood evidence is open; use lifecycle to save and review unfinished work before adoption or sync.`
+                    : `${best?.name} already looks like a managed workflow asset; inspect lineage and governance before adoption or sync.`
+                : "No reusable managed workflow asset was strong enough; use the authoring-packet agent loop to create a real C1 workflow asset. The old draft command is only an example-clone scaffold fallback.",
+        },
+        matches: matches.slice(0, 5),
+        draft: {
+            example,
+            strictness: "high",
+            saveTemplate,
+            command: draftCommand,
+            scaffold: true,
+            deprecatedPrimaryCreationPath: "dna workflow authoring-packet",
+            note: "Example-clone scaffold only; structure is not derived from the goal.",
+        },
+        authoringPacket: {
+            schemaVersion: AUTHORING_PACKET_SCHEMA_VERSION,
+            command: authoringPacketCommand,
+            primary: true,
+            boundary: "Read-only packet generation; dna treats the goal as opaque context and performs no goal modeling.",
+        },
+        reviewPath: {
+            reuse,
+            draft,
+        },
+        mutationBoundary: "Read-only intake; no DNA config, organization binding, runtime sync, dashboard state, or policy truth is changed.",
+        nextCommands: [...new Set([
+                ...(path === "reuse_asset" ? reuse : []),
+                ...(path === "draft_new_asset" ? [authoringPacketCommand] : []),
+                draftCommand,
+            ])],
+    };
+}
+function workflowEvidenceOpen(evidence) {
+    return evidence
+        ? evidence.totals.continue > 0 ||
+            evidence.totals.blocked > 0 ||
+            evidence.totals.requestChanges > 0 ||
+            evidence.totals.remaining > 0
+        : false;
+}
+function projectAssetBindingStatus(review, projectName, asset) {
+    if (!review)
+        return "missing";
+    const project = review.profile.projects.find((entry) => entry.name === projectName || entry.id === projectName) ?? review.profile.projects[0];
+    return project?.assets.find((binding) => binding.asset === asset)?.status ?? "missing";
+}
+function projectSyncTargets(review, projectName) {
+    if (!review)
+        return [];
+    const project = review.profile.projects.find((entry) => entry.name === projectName || entry.id === projectName) ?? review.profile.projects[0];
+    return project?.syncTargets ?? [];
+}
+function routePhase(phases, id) {
+    return phases.find((phase) => phase.id === id) ?? phases[0];
+}
+function buildWorkflowRouteGovernance(params) {
+    const selected = params.selectedAsset;
+    const next = params.nextAsset;
+    const previewAsset = next ?? selected;
+    const routeAsset = params.routeAsset ?? params.nextVersion;
+    return {
+        selectedAsset: {
+            name: params.selected,
+            found: selected !== undefined,
+            cascade: selected?.status.cascadePosture ?? "unknown",
+            evolution: selected?.status.evolutionPosture ?? "unknown",
+            evidence: selected?.status.evidencePosture ?? "unknown",
+            configured: selected?.status.configured === true,
+        },
+        nextAsset: {
+            name: routeAsset,
+            found: next !== undefined,
+            cascade: next?.status.cascadePosture ?? "unknown",
+            evolution: next?.status.evolutionPosture ?? "unknown",
+            evidence: next?.status.evidencePosture ?? "unknown",
+            configured: next?.status.configured === true,
+        },
+        cascadeCommand: `dna assets governance ${params.selected}`,
+        evolutionPreviewCommand: params.routeAsset
+            ? `dna evolve ${templateIdForAsset(params.routeAsset)}`
+            : previewAsset?.evolution.previewCommand ?? `dna evolve ${templateIdForAsset(params.nextVersion)}`,
+        improvementCommand: `dna assets suggestions ${routeAsset}`,
+        principle: "Cascade and evolution are governed in dna core: cascade composes inherited policy before sync, and evolution stays preview-first until evidence is reviewed.",
+        mutationBoundary: "Route governance is read-only. It does not apply markers, change inheritance, sync a harness, update dashboard state, or write Obsidian/wiki.",
+    };
+}
+function routeNeedsBehaviorLock(description, selected, selectedAsset) {
+    const haystack = [
+        description,
+        selected,
+        selectedAsset?.displayName,
+        selectedAsset?.positioning,
+        selectedAsset?.workflows.map((workflow) => `${workflow.name} ${workflow.description ?? ""}`).join(" "),
+    ].filter(Boolean).join(" ").toLowerCase();
+    return /(rewrite|refactor|migration|migrate|flutter|logic equivalence|behavior lock|behavior-preserving|重构|迁移|逻辑对等|行为锁定|行为保持|精准改写)/i.test(haystack);
+}
+function buildWorkflowRouteCurrent(params) {
+    const completed = ["describe"];
+    const blockers = [];
+    if (params.source === "new_draft" && !params.selectedAsset) {
+        const phase = routePhase(params.phases, "asset");
+        blockers.push("No saved validated workflow asset exists yet for the selected route.");
+        return {
+            stage: phase.id,
+            command: phase.command,
+            writes: phase.writes,
+            reason: "Run the authoring-packet loop and save a validated workflow asset before planning edits, diff, organization binding, or runtime sync.",
+            completed,
+            blockers,
+        };
+    }
+    if (params.behaviorLockRequired)
+        completed.push("lock");
+    completed.push("asset");
+    completed.push("cascade");
+    if (params.activeFollowup) {
+        blockers.push(`Active dogfood evidence must be reviewed as saved unfinished work in ${params.activeFollowup.candidateAssetName} before generic version editing or sync; the source asset remains unchanged.`);
+        if (params.activeFollowup.status === "draft_reviewable") {
+            completed.push("edit");
+            return {
+                stage: "review",
+                command: params.activeFollowup.currentCommand,
+                writes: params.activeFollowup.currentWrites,
+                reason: `${params.activeFollowup.reason} Review the saved unfinished-work draft before generic version editing, rollout, sync, or evolution.`,
+                completed,
+                blockers,
+            };
+        }
+        const phase = routePhase(params.phases, "edit");
+        return {
+            stage: phase.id,
+            command: params.activeFollowup.currentCommand,
+            writes: params.activeFollowup.currentWrites,
+            reason: `${params.activeFollowup.reason} Handle the saved unfinished-work draft ${params.activeFollowup.candidateAssetName} before generic version editing, rollout, sync, or evolution.`,
+            completed,
+            blockers,
+        };
+    }
+    if (!params.nextAsset) {
+        const phase = routePhase(params.phases, "edit");
+        blockers.push("No next asset version exists yet for manager review.");
+        return {
+            stage: phase.id,
+            command: phase.command,
+            writes: phase.writes,
+            reason: "Create the reviewable next version before diff, adoption, org binding, or sync.",
+            completed,
+            blockers,
+        };
+    }
+    completed.push("edit");
+    if (params.bindingStatus !== "active") {
+        const phase = routePhase(params.phases, "review");
+        blockers.push("Next asset version exists but has not been accepted into the organization route.");
+        return {
+            stage: phase.id,
+            command: phase.command,
+            writes: phase.writes,
+            reason: "Review the asset version diff before organization binding, rollout, or runtime sync.",
+            completed,
+            blockers,
+        };
+    }
+    completed.push("review");
+    if (!params.hasOrganization) {
+        const phase = routePhase(params.phases, "organize");
+        blockers.push("No .dna/org.yaml profile exists for organization-managed rollout.");
+        return {
+            stage: phase.id,
+            command: phase.command,
+            writes: phase.writes,
+            reason: "Plan or create the organization/project binding before rollout and sync.",
+            completed,
+            blockers,
+        };
+    }
+    if (params.targets.length === 0) {
+        const phase = routePhase(params.phases, "organize");
+        blockers.push("No sync target is declared for the project.");
+        return {
+            stage: phase.id,
+            command: phase.command,
+            writes: phase.writes,
+            reason: "Bind the accepted asset version as active with a sync target before rollout.",
+            completed,
+            blockers,
+        };
+    }
+    completed.push("organize");
+    if (!params.configured) {
+        const phase = routePhase(params.phases, "configure");
+        blockers.push("The accepted asset version is organization-bound but missing project DNA config.");
+        return {
+            stage: phase.id,
+            command: phase.command,
+            writes: phase.writes,
+            reason: "Configure declared organization assets before rollout or runtime sync.",
+            completed,
+            blockers,
+        };
+    }
+    completed.push("configure");
+    const rollout = routePhase(params.phases, "rollout");
+    return {
+        stage: rollout.id,
+        command: rollout.command,
+        writes: rollout.writes,
+        reason: "The accepted asset version is active in the organization route; review rollout readiness before runtime sync.",
+        completed,
+        blockers,
+    };
+}
+function workflowRouteNextCommands(params) {
+    if (params.activeFollowup) {
+        return [...new Set([
+                params.current.command,
+                ...params.activeFollowup.reviewCommands,
+            ])].slice(0, 8);
+    }
+    return [...new Set([
+            params.current.command,
+            ...params.phases
+                .filter((phase) => phase.command !== params.current.command)
+                .filter((phase) => phase.id !== "lock" || params.behaviorLockRequired)
+                .map((phase) => phase.command),
+        ])].slice(0, 5);
+}
+function workflowRouteRisk(current) {
+    if (current.stage === "asset")
+        return "needs_draft";
+    if (current.stage === "edit")
+        return "needs_version";
+    if (current.stage === "review")
+        return "needs_manager_review";
+    if (current.stage === "organize") {
+        return current.blockers.some((blocker) => blocker.toLowerCase().includes("sync target"))
+            ? "needs_sync_target"
+            : "needs_organization";
+    }
+    if (current.stage === "configure")
+        return "needs_configuration";
+    if (current.stage === "rollout")
+        return "ready_for_rollout";
+    return "unknown";
+}
+function workflowRouteAllowedNow(current) {
+    if (current.stage === "asset") {
+        return [
+            `Start the authoring loop: ${current.command}.`,
+            "Use an external agent to generate YAML, then run dna validate before saving the asset.",
+            "Keep organization binding and runtime sync blocked until the asset exists.",
+        ];
+    }
+    if (current.stage === "edit") {
+        const activeFollowup = current.blockers.some((blocker) => blocker.includes("saved unfinished work"));
+        const createLabel = activeFollowup ? "Save the unfinished-work draft" : "Create the reviewable next version";
+        return [
+            `${createLabel}: ${current.command}.`,
+            "Review the version diff before adoption.",
+            "Keep organization binding and runtime sync blocked until the version exists.",
+        ];
+    }
+    if (current.stage === "review") {
+        return [
+            `Review the asset diff: ${current.command}.`,
+            "Adopt or bind only after the manager accepts the version.",
+            "Keep runtime sync blocked until the accepted version is organization-bound and configured.",
+        ];
+    }
+    if (current.stage === "organize") {
+        return [
+            `Plan the organization binding: ${current.command}.`,
+            "Make the accepted asset and sync target explicit in organization state.",
+            "Return to dna workflow route or dna org review before rollout.",
+        ];
+    }
+    if (current.stage === "configure") {
+        return [
+            `Review missing project configuration: ${current.command}.`,
+            "Apply configuration only after the plan is acceptable.",
+            "Return to rollout review before runtime sync.",
+        ];
+    }
+    if (current.stage === "rollout") {
+        return [
+            `Review rollout readiness: ${current.command}.`,
+            "Run the target sync command only after rollout stays ready.",
+            "Run dna release deploy-plan before any release claim; execute the printed Vercel deploy/readiness/URL verification commands only when it returns deployment_required or a confirmed deployment_conditional.",
+        ];
+    }
+    return [`Run the current route command: ${current.command}.`];
+}
+function workflowRouteBlockedNow(current) {
+    const blocked = [...current.blockers];
+    if (current.stage !== "rollout") {
+        blocked.push("Runtime sync is blocked until the route reaches rollout readiness.");
+        blocked.push("Vercel deployment is not a substitute for workflow review, organization rollout, or runtime sync.");
+    }
+    return blocked.length > 0
+        ? [...new Set(blocked)]
+        : ["No route-level blockers detected; still verify org rollout before runtime sync."];
+}
+function buildWorkflowRouteDecisionPacket(current) {
+    return {
+        currentState: `${current.stage}; completed=${current.completed.join(", ") || "none"}; blockers=${current.blockers.length}`,
+        primaryAction: current.command,
+        risk: workflowRouteRisk(current),
+        reason: current.reason,
+        allowedNow: workflowRouteAllowedNow(current),
+        blockedNow: workflowRouteBlockedNow(current),
+    };
+}
+function workflowRouteStatusSummary(current, phase) {
+    if (current.stage === "rollout") {
+        return `Current step: ${phase.label}. Run ${current.command}; only then should runtime sync, deploy-plan, improvement review, or evolution preview continue.`;
+    }
+    if (current.stage === "sync") {
+        return `Current step: ${phase.label}. Run ${current.command} only after organization rollout stays clear.`;
+    }
+    return `Current step: ${phase.label}. Run ${current.command} before moving to organization rollout, runtime sync, deployment, or evolution.`;
+}
+function buildWorkflowRouteStatus(params) {
+    const currentPhase = routePhase(params.phases, params.current.stage);
+    const blockedCommands = params.phases
+        .filter((phase) => phase.id !== params.current.stage && !params.current.completed.includes(phase.id))
+        .filter((phase) => phase.id === "sync" || phase.id === "deploy" || phase.id === "evolve")
+        .map((phase) => `${phase.label}: ${phase.command}`);
+    return {
+        readiness: params.decisionPacket.risk,
+        plainSummary: workflowRouteStatusSummary(params.current, currentPhase),
+        currentStep: {
+            id: currentPhase.id,
+            label: currentPhase.label,
+            owner: currentPhase.owner,
+            writes: params.current.writes,
+            command: params.current.command,
+        },
+        completed: params.current.completed,
+        blockers: params.current.blockers,
+        now: params.decisionPacket.allowedNow,
+        notYet: blockedCommands.length > 0
+            ? blockedCommands
+            : workflowRouteBlockedNow(params.current).filter((item) => item.toLowerCase().includes("blocked")),
+        evidenceLoop: [
+            params.improvementCommand,
+            params.evolutionPreviewCommand,
+            "Accepted improvement still returns through diff, adoption, organization rollout, runtime sync, and deploy-plan gates.",
+        ],
+    };
+}
+function buildWorkflowAuthoringChoices(params) {
+    const hasSelectedAsset = params.selectedAsset !== undefined;
+    const activeFollowup = params.activeFollowup;
+    const choices = [];
+    if (activeFollowup) {
+        const activeFollowupBoundary = `${activeFollowup.candidateAssetName} is a manager/dna_core review draft only; it does not replace, delete, auto-adopt, execute, create org_private visibility, or grant runtime authority for ${params.selectedAssetName}.`;
+        choices.push({
+            id: "active_followup",
+            label: activeFollowup.status === "draft_reviewable"
+                ? "Review the unfinished-work draft"
+                : activeFollowup.status === "draft_structural_drift"
+                    ? "Repair the unfinished-work draft"
+                    : activeFollowup.status === "draft_incomplete"
+                        ? "Inspect the unfinished-work draft"
+                        : "Save active dogfood evidence",
+            command: activeFollowup.currentCommand,
+            purpose: "Use the candidate-backed route when real dogfood evidence is still open, instead of drafting a generic version.",
+            writes: activeFollowup.currentWrites,
+            status: "recommended",
+            reason: `Open evidence on ${params.selectedAssetName} should be reviewed as ${activeFollowup.candidateAssetName} before adoption, sync, or evolution. ${activeFollowup.reason} ${activeFollowupBoundary}`,
+            next: activeFollowup.status === "draft_reviewable"
+                ? `Record manager rationale for ${activeFollowup.diffCommand}, then run ${activeFollowup.adoptionCommand}; organization binding and rollout stay later. ${activeFollowupBoundary}`
+                : `Review with ${activeFollowup.diffCommand}, record manager rationale, then continue to adoption and organization rollout. ${activeFollowupBoundary}`,
+        });
+    }
+    choices.push({
+        id: "reuse_asset",
+        label: "Reuse an existing workflow asset",
+        command: hasSelectedAsset ? `dna assets lifecycle ${params.selectedAssetName}` : "dna assets library",
+        purpose: "Inspect lineage, cascade, evidence, candidates, and adoption posture before creating or editing anything.",
+        writes: false,
+        status: activeFollowup ? "blocked" : hasSelectedAsset && params.source === "reused_asset" ? "available" : "available",
+        reason: activeFollowup
+            ? "Direct reuse is blocked by active dogfood evidence; inspect the asset but handle the follow-up first."
+            : hasSelectedAsset
+                ? `${params.selectedAssetName} is available as the base workflow asset.`
+                : "No strong reusable asset is selected; browse the library before drafting if unsure.",
+        next: activeFollowup ? activeFollowup.currentCommand : params.editCommand,
+    });
+    choices.push({
+        id: "draft_new_asset",
+        label: "Author a new workflow asset",
+        command: params.newDraftCommand,
+        purpose: "Use the C3 authoring packet so an external agent can interview, generate YAML, and loop on dna validate without dna pretending to model intent.",
+        writes: false,
+        status: params.source === "new_draft" ? "recommended" : "available",
+        reason: params.source === "new_draft"
+            ? "No reusable managed workflow asset was strong enough; start the authoring-packet loop before any edit, review, organization binding, or sync."
+            : "Use this only when the reusable asset is not the right work method. The old draft command is an example-clone scaffold fallback.",
+        next: "Generate YAML with the external agent, run dna validate until clean, save under .dna/templates, then inspect the asset before adoption.",
+    });
+    choices.push({
+        id: "edit_existing_asset",
+        label: "Edit the selected workflow asset",
+        command: params.editCommand,
+        purpose: "Adjust steps, roles, boundaries, handoffs, or verifiers through a reviewable edit plan.",
+        writes: true,
+        status: params.current.stage === "edit" && !activeFollowup ? "recommended" : hasSelectedAsset ? "available" : "blocked",
+        reason: hasSelectedAsset
+            ? "The selected asset can be edited into a reviewable next version without mutating the original."
+            : "Save or choose a workflow asset before editing it.",
+        next: "Run asset diff, adoption review, organization binding, rollout, then sync only after gates pass.",
+    });
+    return choices;
+}
+function userPathStatus(params) {
+    if (params.phaseIds.includes(params.current.stage))
+        return "current";
+    if (params.phaseIds.every((id) => params.current.completed.includes(id)))
+        return "done";
+    return "later";
+}
+function buildWorkflowRouteUserPath(params) {
+    const phase = (id) => routePhase(params.phases, id);
+    const shapeCommand = params.activeFollowup?.currentCommand ?? phase("edit").command;
+    const reviewAsset = params.activeFollowup?.candidateAssetName ?? params.nextVersion;
+    const syncPhase = phase("sync");
+    const releasePhase = phase("deploy");
+    const improvementPhase = phase("improve");
+    const improvementCommand = params.activeFollowup
+        ? `dna assets suggestions ${params.activeFollowup.candidateAssetName}`
+        : improvementPhase.command;
+    const distributeCommand = params.activeFollowup
+        ? params.activeFollowup.bindCommand
+        : params.current.stage === "rollout"
+            ? phase("rollout").command
+            : params.current.stage === "configure"
+                ? phase("configure").command
+                : phase("organize").command;
+    const distributeWrites = params.activeFollowup !== undefined;
+    const selectPhaseIds = params.behaviorLockRequired
+        ? ["lock", "asset"]
+        : ["asset"];
+    const distributePhaseIds = ["organize", "configure", "rollout", "sync", "deploy"];
+    return [
+        {
+            id: "describe",
+            label: "Describe the workflow",
+            command: phase("describe").command,
+            purpose: "Start from natural language and let dna recommend reuse or the external-agent authoring path; no canvas is required.",
+            owner: "user",
+            writes: false,
+            status: userPathStatus({ current: params.current, phaseIds: ["describe"] }),
+            phaseIds: ["describe"],
+        },
+        {
+            id: "select_asset",
+            label: params.source === "new_draft" ? "Create a reviewable asset" : "Select a reusable asset",
+            command: phase("asset").command,
+            purpose: params.source === "new_draft"
+                ? "Run the authoring packet, validate the external agent's YAML, and save only after explicit human confirmation."
+                : "Inspect the matched asset and its evidence before changing or distributing it.",
+            owner: "dna_core",
+            writes: phase("asset").writes,
+            status: userPathStatus({ current: params.current, phaseIds: selectPhaseIds }),
+            phaseIds: selectPhaseIds,
+        },
+        {
+            id: "govern_asset",
+            label: "Review governance",
+            command: phase("cascade").command,
+            purpose: "Check cascade inheritance, evidence posture, and preview-first evolution before edits or adoption.",
+            owner: "dna_core",
+            writes: false,
+            status: userPathStatus({ current: params.current, phaseIds: ["cascade"] }),
+            phaseIds: ["cascade"],
+        },
+        {
+            id: "shape_asset",
+            label: params.activeFollowup
+                ? params.activeFollowup.status === "draft_reviewable"
+                    ? "Review unfinished-work draft"
+                    : params.activeFollowup.status === "draft_structural_drift"
+                        ? "Repair unfinished-work draft"
+                        : "Save unfinished-work draft"
+                : "Shape the next asset version",
+            command: shapeCommand,
+            purpose: params.activeFollowup
+                ? `Handle the saved unfinished-work draft ${params.activeFollowup.candidateAssetName} through its current review route before generic edits, rollout, sync, or evolution.`
+                : "Adjust steps, roles, boundaries, handoffs, or verifiers through a reviewable edit plan.",
+            owner: "dna_core",
+            writes: params.activeFollowup?.currentWrites ?? true,
+            status: userPathStatus({ current: params.current, phaseIds: ["edit"] }),
+            phaseIds: ["edit"],
+        },
+        {
+            id: "manager_review",
+            label: "Manager reviews the asset",
+            command: params.activeFollowup
+                ? params.activeFollowup.diffCommand
+                : phase("review").command,
+            purpose: "Review the asset diff/adoption posture before accepting it into the organization route.",
+            owner: "manager",
+            writes: false,
+            status: userPathStatus({ current: params.current, phaseIds: ["review"] }),
+            phaseIds: ["review"],
+        },
+        {
+            id: "distribute",
+            label: "Roll out and sync",
+            command: distributeCommand,
+            purpose: `Bind the accepted asset, configure declared assets, review rollout, then sync to ${params.syncTarget}; run ${params.releaseCommand} only for web/public surface changes.`,
+            owner: params.current.stage === "configure" ? "dna_core" : "manager",
+            writes: distributeWrites,
+            status: userPathStatus({ current: params.current, phaseIds: distributePhaseIds }),
+            phaseIds: distributePhaseIds,
+        },
+        {
+            id: "improve",
+            label: "Improve from run evidence",
+            command: improvementCommand,
+            purpose: `After runtime use, convert evidence into reviewed suggestions and preview evolution; ${releasePhase.command} and ${syncPhase.command} stay separate gates.`,
+            owner: "dna_core",
+            writes: false,
+            status: userPathStatus({ current: params.current, phaseIds: ["improve", "evolve"] }),
+            phaseIds: ["improve", "evolve"],
+        },
+    ];
+}
+function personalPhaseStatus(current, phase) {
+    if (phase === "describe")
+        return "done";
+    if (phase === "draft") {
+        if (current.stage === "asset")
+            return "current";
+        return current.completed.includes("asset") ? "done" : "later";
+    }
+    if (phase === "validate") {
+        if (["cascade", "edit", "review", "verify"].includes(current.stage))
+            return "current";
+        if (current.completed.includes("review"))
+            return "done";
+        return current.completed.includes("asset") ? "current" : "later";
+    }
+    if (current.stage === "sync" || current.stage === "run" || current.stage === "rollout")
+        return "current";
+    return current.completed.includes("review") ? "current" : "later";
+}
+function buildPersonalRoutePhases(params) {
+    return [
+        {
+            id: "describe",
+            label: "Describe",
+            command: `dna workflow intake ${commandQuote(params.description)}`,
+            purpose: "Describe the working method and get a reuse-or-author recommendation.",
+            writes: false,
+            owner: "user",
+        },
+        {
+            id: "draft",
+            label: "Author asset",
+            command: params.draftCommand,
+            purpose: "Use the C3 authoring packet and validate loop to create or select a workflow asset in the shared C1 format.",
+            writes: false,
+            owner: "dna_core",
+        },
+        {
+            id: "validate",
+            label: "Validate",
+            command: params.validateCommand,
+            purpose: "Inspect evidence, governance, or diff output before treating the asset as usable.",
+            writes: false,
+            owner: "dna_core",
+        },
+        {
+            id: "run",
+            label: "Run",
+            command: params.syncCommand,
+            purpose: "Sync the selected runtime surface only after the local asset is validated.",
+            writes: true,
+            owner: "runtime",
+        },
+    ];
+}
+function buildPersonalRouteUserPath(params) {
+    return params.phases.map((phase) => ({
+        id: phase.id,
+        label: phase.label,
+        command: phase.command,
+        purpose: phase.purpose,
+        owner: phase.owner,
+        writes: phase.writes,
+        status: personalPhaseStatus(params.current, phase.id),
+        phaseIds: [phase.id],
+    }));
+}
+function buildWorkflowRouteReviewPath(params) {
+    if (params.activeFollowup) {
+        const phaseById = new Map(params.phases.map((phase) => [phase.id, phase]));
+        const maybeLock = params.behaviorLockRequired ? [phaseById.get("lock")?.command] : [];
+        return [...new Set([
+                params.current.command,
+                phaseById.get("describe")?.command,
+                ...maybeLock,
+                phaseById.get("asset")?.command,
+                phaseById.get("cascade")?.command,
+                params.activeFollowup.diffCommand,
+                phaseById.get("verify")?.command,
+                `record explicit manager rationale for ${params.activeFollowup.diffCommand}`,
+                params.activeFollowup.adoptionCommand,
+                params.activeFollowup.bindCommand,
+                params.activeFollowup.rolloutCommand,
+                phaseById.get("sync")?.command,
+                phaseById.get("deploy")?.command,
+                `dna assets suggestions ${params.activeFollowup.candidateAssetName}`,
+                phaseById.get("evolve")?.command,
+            ].filter((command) => command !== undefined))];
+    }
+    const phaseOrder = [
+        "describe",
+        "lock",
+        "asset",
+        "cascade",
+        "edit",
+        "review",
+        "verify",
+        "organize",
+        "configure",
+        "rollout",
+        "sync",
+        "deploy",
+        "improve",
+        "evolve",
+    ];
+    const includePhase = (phase) => phase.id !== "lock" || params.behaviorLockRequired;
+    const phaseById = new Map(params.phases.map((phase) => [phase.id, phase]));
+    const ordered = phaseOrder
+        .map((id) => phaseById.get(id))
+        .filter((phase) => phase !== undefined)
+        .filter(includePhase)
+        .map((phase) => phase.command);
+    return [...new Set([params.current.command, ...ordered])];
+}
+function buildWorkflowAlternateEditPath(params) {
+    if (!params.activeFollowup)
+        return [];
+    const ids = ["edit", "review", "verify", "organize"];
+    const phaseById = new Map(params.phases.map((phase) => [phase.id, phase]));
+    return ids
+        .map((id) => phaseById.get(id)?.command)
+        .filter((command) => command !== undefined);
+}
+async function buildWorkflowAuthoringRoute(opts) {
+    const description = opts.goal?.trim() ?? "";
+    const intake = await buildWorkflowIntake(description, opts.projectDir);
+    const projectDir = opts.projectDir ?? process.cwd();
+    const organization = opts.name?.trim() || "My Org";
+    const project = opts.project?.trim() || "Workflow Project";
+    const syncTarget = opts.syncTarget?.trim() || "codex";
+    const forcedAsset = opts.fromTemplate?.trim() || undefined;
+    const reusable = intake.recommendation.path === "reuse_asset" && intake.recommendation.asset;
+    const source = forcedAsset || reusable ? "reused_asset" : "new_draft";
+    const draftTemplate = normalizeTemplateName(opts.saveTemplate || (source === "reused_asset" ? `${forcedAsset ?? intake.recommendation.asset}-v2` : intake.draft.saveTemplate));
+    const selected = source === "reused_asset" ? forcedAsset ?? intake.recommendation.asset ?? draftTemplate : draftTemplate;
+    const nextVersion = source === "reused_asset" ? draftTemplate : `${draftTemplate}-v2`;
+    const orgDescription = commandQuote(project);
+    const orgName = commandQuote(organization);
+    const projectName = commandQuote(project);
+    const selectedAssetName = selected;
+    const syncCommand = defaultSyncCommand(syncTarget);
+    const authoringPacketCommand = `dna workflow authoring-packet ${commandQuote(description)} --json`;
+    const scaffoldCommand = `dna workflow draft ${commandQuote(description)} --example ${intake.draft.example} --strictness high --save-template ${draftTemplate}`;
+    const draftCommand = source === "new_draft"
+        ? authoringPacketCommand
+        : `dna assets lineage ${selectedAssetName}`;
+    const behaviorLockRequired = routeNeedsBehaviorLock(description, selectedAssetName);
+    const editCommand = `dna workflow edit-plan "Describe the reviewed workflow change" --from-template ${selectedAssetName} --save-template ${nextVersion}`;
+    const reviewCommand = `dna assets diff ${selectedAssetName} ${nextVersion}`;
+    const bindAsset = nextVersion;
+    const orgPhases = [
+        {
+            id: "describe",
+            label: "Describe the work",
+            command: `dna workflow intake ${commandQuote(description)}`,
+            purpose: "Turn a natural-language working method into a reuse-or-author recommendation without drawing a canvas.",
+            writes: false,
+            owner: "user",
+        },
+        {
+            id: "lock",
+            label: "Lock behavior as evidence",
+            command: "dna assets adoption flutter-behavior-lock",
+            purpose: "For risky rewrite or refactor work, capture source behavior as docs/tests before changing workflow structure or runtime state.",
+            writes: false,
+            owner: "dna_core",
+            requiredWhen: "risky_rewrite_or_refactor",
+        },
+        {
+            id: "asset",
+            label: source === "reused_asset" ? "Inspect reusable asset" : "Author workflow asset",
+            command: draftCommand,
+            purpose: source === "reused_asset"
+                ? "Understand the selected asset lineage, cascade, evidence, and evolution route before editing or adoption."
+                : "Create a real workflow asset through the C3 authoring packet, external agent generation, dna validate loop, and explicit human save.",
+            writes: false,
+            owner: "dna_core",
+        },
+        {
+            id: "cascade",
+            label: "Review cascade governance",
+            command: `dna assets governance ${selectedAssetName}`,
+            purpose: "Check inherited layers, evidence posture, and preview-first evolution before edit, diff, organization binding, or sync.",
+            writes: false,
+            owner: "dna_core",
+        },
+        {
+            id: "edit",
+            label: "Plan edits",
+            command: editCommand,
+            purpose: "Adjust steps, roles, boundaries, handoffs, and verifiers through an operation-based edit plan.",
+            writes: true,
+            owner: "dna_core",
+        },
+        {
+            id: "review",
+            label: "Review asset version",
+            command: reviewCommand,
+            purpose: "Let a manager review the draft or version diff before it becomes an organization binding.",
+            writes: false,
+            owner: "manager",
+        },
+        {
+            id: "verify",
+            label: "Route verification command",
+            command: `dna assets adoption ${WORKFLOW_ASSET_IDS.verificationCommandRouting}`,
+            purpose: "Plan and review the authoritative command root/scope before accepting verification evidence for completion, rollout, or sync.",
+            writes: false,
+            owner: "dna_core",
+            requiredWhen: "verification_root_or_scope_is_ambiguous",
+        },
+        {
+            id: "organize",
+            label: "Bind to organization",
+            command: `dna org intake ${orgDescription} --name ${orgName} --project ${projectName} --asset ${bindAsset} --sync-target ${syncTarget}`,
+            purpose: "Plan organization/project binding before writing .dna/org.yaml or changing rollout state.",
+            writes: false,
+            owner: "manager",
+        },
+        {
+            id: "configure",
+            label: "Configure declared assets",
+            command: "dna org configure-plan",
+            purpose: "List or apply explicit dna init commands for organization-declared assets missing project config before rollout.",
+            writes: false,
+            owner: "dna_core",
+        },
+        {
+            id: "rollout",
+            label: "Review rollout",
+            command: "dna org rollout",
+            purpose: "Check configured assets, evidence gates, blockers, and allowed sync commands before distribution.",
+            writes: false,
+            owner: "manager",
+        },
+        {
+            id: "sync",
+            label: "Sync runtime surface",
+            command: syncCommand,
+            purpose: "Compile and install the accepted governance asset into the selected harness surface.",
+            writes: true,
+            owner: "runtime",
+        },
+        {
+            id: "deploy",
+            label: "Deploy if public surface changed",
+            command: "dna release deploy-plan",
+            purpose: "Decide whether release needs Vercel CLI deployment; run the printed deploy, readiness wait, and deployed URL verification commands only for deployment_required or a confirmed deployment_conditional.",
+            writes: false,
+            owner: "release",
+        },
+        {
+            id: "improve",
+            label: "Improve from evidence",
+            command: `dna assets suggestions ${bindAsset}`,
+            purpose: "Convert dogfood/runtime evidence into human-reviewed improvement suggestions instead of automatic mutation.",
+            writes: false,
+            owner: "dna_core",
+        },
+        {
+            id: "evolve",
+            label: "Preview self-evolution",
+            command: `dna evolve ${templateIdForAsset(bindAsset)}`,
+            purpose: "Preview outcome-derived marker changes; mutation remains explicit through dna sync --evolve after review.",
+            writes: false,
+            owner: "dna_core",
+            requiredWhen: "execution_outcomes_recorded",
+        },
+    ];
+    const [selectedAsset, profile, selectedEvidence, assets] = await Promise.all([
+        findWorkflowAsset(selectedAssetName, { projectDir }),
+        readOrganizationProfile({ projectDir }),
+        buildWorkflowAssetEvidenceIndex(selectedAssetName, { projectDir }),
+        listWorkflowAssets({ projectDir }),
+    ]);
+    const orgReview = profile.profile ? await reviewOrganization({ projectDir }) : undefined;
+    const activeFollowup = workflowEvidenceOpen(selectedEvidence)
+        ? activeEvidenceFollowupReviewRoute(selectedAssetName, assets, selectedEvidence)
+        : undefined;
+    const routeAssetName = activeFollowup?.candidateAssetName ?? bindAsset;
+    const nextAsset = activeFollowup?.candidateAsset ?? await findWorkflowAsset(bindAsset, { projectDir });
+    const finalBehaviorLockRequired = routeNeedsBehaviorLock(description, selectedAssetName, selectedAsset) || behaviorLockRequired;
+    const governance = buildWorkflowRouteGovernance({
+        selected: selectedAssetName,
+        nextVersion,
+        selectedAsset,
+        nextAsset,
+        routeAsset: activeFollowup?.candidateAssetName,
+    });
+    const evolvePhase = orgPhases.find((phase) => phase.id === "evolve");
+    if (evolvePhase)
+        evolvePhase.command = governance.evolutionPreviewCommand;
+    const improvePhase = orgPhases.find((phase) => phase.id === "improve");
+    if (improvePhase)
+        improvePhase.command = governance.improvementCommand;
+    const current = buildWorkflowRouteCurrent({
+        phases: orgPhases,
+        source,
+        selectedAsset,
+        nextAsset,
+        activeFollowup,
+        hasOrganization: profile.profile !== undefined,
+        bindingStatus: projectAssetBindingStatus(orgReview, project, routeAssetName),
+        configured: nextAsset?.status.configured === true,
+        targets: projectSyncTargets(orgReview, project),
+        behaviorLockRequired: finalBehaviorLockRequired,
+    });
+    const decisionPacket = buildWorkflowRouteDecisionPacket(current);
+    const status = buildWorkflowRouteStatus({
+        current,
+        phases: orgPhases,
+        decisionPacket,
+        improvementCommand: governance.improvementCommand,
+        evolutionPreviewCommand: governance.evolutionPreviewCommand,
+    });
+    const orgSpine = ["describe", "lock", "asset", "cascade", "edit", "review", "verify", "organize", "configure", "rollout", "sync", "deploy", "improve", "evolve"];
+    const personalSpine = ["describe", "draft", "validate", "run"];
+    const validateCommand = source === "new_draft"
+        ? `dna validate ${join(projectDir, ".dna", "templates", `${selectedAssetName}.dna.yaml`)}`
+        : current.stage === "review" || current.stage === "edit" || current.stage === "verify"
+            ? current.command
+            : `dna assets inspect ${routeAssetName} --evidence`;
+    const personalPhases = buildPersonalRoutePhases({
+        description,
+        draftCommand,
+        validateCommand,
+        syncCommand,
+    });
+    const orgPath = buildWorkflowRouteUserPath({
+        current,
+        phases: orgPhases,
+        source,
+        selectedAssetName,
+        nextVersion,
+        activeFollowup,
+        behaviorLockRequired: finalBehaviorLockRequired,
+        syncTarget,
+        releaseCommand: "dna release deploy-plan",
+    });
+    const personalPath = buildPersonalRouteUserPath({ current, phases: personalPhases });
+    const orgView = opts.org === true;
+    const orgNextCommands = workflowRouteNextCommands({
+        current,
+        phases: orgPhases,
+        behaviorLockRequired: finalBehaviorLockRequired,
+        activeFollowup,
+    });
+    const personalNextCommands = [...new Set([
+            current.command,
+            ...(source === "new_draft" ? [scaffoldCommand] : []),
+            `dna workflow route ${commandQuote(description)} --org --name ${orgName} --project ${projectName} --sync-target ${syncTarget}`,
+        ])].slice(0, 4);
+    return {
+        mode: "workflow_authoring_route",
+        scope: orgView ? "organization" : "personal",
+        input: {
+            description,
+            organization,
+            project,
+            syncTarget,
+            forcedAsset,
+        },
+        recommendation: intake.recommendation,
+        asset: {
+            selected: selectedAssetName,
+            source,
+            draftTemplate,
+            nextVersion,
+        },
+        choices: buildWorkflowAuthoringChoices({
+            source,
+            selectedAssetName,
+            selectedAsset,
+            newDraftCommand: authoringPacketCommand,
+            editCommand,
+            activeFollowup,
+            current,
+        }),
+        userPath: orgView ? orgPath : personalPath,
+        orgPath,
+        governance,
+        spine: orgView ? orgSpine : personalSpine,
+        orgSpine,
+        phases: orgView ? orgPhases : personalPhases,
+        orgPhases,
+        current,
+        status,
+        decisionPacket,
+        reviewPath: buildWorkflowRouteReviewPath({
+            current,
+            phases: orgPhases,
+            behaviorLockRequired: finalBehaviorLockRequired,
+            selectedAssetName,
+            activeFollowup,
+            syncTarget,
+        }),
+        alternateEditPath: buildWorkflowAlternateEditPath({
+            activeFollowup,
+            phases: orgPhases,
+        }),
+        editOperations: buildWorkflowRouteEditOperations({
+            description,
+            selectedAssetName,
+            nextVersion,
+            selectedAsset,
+        }),
+        checkpoints: [
+            "No canvas is required; the user describes the workflow in natural language.",
+            "Risky rewrite and refactor routes start by locking behavior evidence before workflow edits.",
+            "Drafting and edit planning remain review-only until an explicit save/apply command runs.",
+            "Organization binding happens before runtime sync.",
+            "Project DNA config is explicit; organization-bound assets go through configure-plan before rollout.",
+            "Verification routing confirms command root, scope, and machine evidence before evidence review, completion, rollout, or sync.",
+            "Cascade and evolution are visible route gates, not hidden harness behavior.",
+            "Evolution is preview-first; marker mutation requires explicit dna sync --evolve after review.",
+            "Dashboard remains a read-only projection of this route.",
+            "Obsidian/wiki remains internal project memory, not product runtime truth.",
+            "Vercel deployment and deployed URL verification run only when dna release deploy-plan returns deployment_required, or deployment_conditional is explicitly confirmed for external review.",
+        ],
+        mutationBoundary: "Read-only authoring route; it does not create templates, bind organizations, sync runtimes, deploy web surfaces, mutate evolution markers, or write dashboard state.",
+        nextCommands: orgView ? orgNextCommands : personalNextCommands,
+    };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseWorkflow(value) {
+    if (!isRecord(value) || typeof value.name !== "string" || !Array.isArray(value.steps))
+        return undefined;
+    return value;
+}
+function workflowMapFromTemplateYaml(parsed) {
+    const workflows = {};
+    if (!isRecord(parsed))
+        return workflows;
+    const singular = parseWorkflow(parsed.workflow);
+    if (singular)
+        workflows.workflow = singular;
+    if (isRecord(parsed.workflows)) {
+        for (const [key, value] of Object.entries(parsed.workflows)) {
+            const workflow = parseWorkflow(value);
+            if (workflow)
+                workflows[key] = workflow;
+        }
+    }
+    return workflows;
+}
+function selectWorkflow(params) {
+    const entries = Object.entries(params.workflows);
+    if (entries.length === 0)
+        return {};
+    const requested = params.requested?.trim();
+    if (requested && params.workflows[requested])
+        return { workflow: params.workflows[requested], workflowId: requested };
+    if (requested)
+        return { requestedMissing: requested };
+    if (params.targetStep) {
+        const matched = entries.find(([, workflow]) => workflow.steps.some((step) => step.id === params.targetStep));
+        if (matched)
+            return { workflow: matched[1], workflowId: matched[0] };
+    }
+    return { workflow: entries[0][1], workflowId: entries[0][0], fallback: true };
+}
+function sourceWithWorkflow(prefix, templateName, workflowId, suffix) {
+    const parts = [prefix, templateName];
+    if (workflowId && workflowId !== "workflow")
+        parts.push(workflowId);
+    if (suffix)
+        parts.push(suffix);
+    return parts.join(":");
+}
+async function currentSuggestionReviewSnapshot(params) {
+    const asset = await findWorkflowAsset(params.assetName, { projectDir: params.projectDir });
+    if (!asset)
+        return undefined;
+    const evidence = await buildWorkflowAssetEvidenceIndex(asset.name, { projectDir: params.projectDir });
+    if (!evidence)
+        return undefined;
+    const assets = await listWorkflowAssets({ projectDir: params.projectDir });
+    const review = buildAssetSuggestions(asset, evidence, assets);
+    const suggestion = review.suggestions.find((entry) => entry.id === params.suggestionId);
+    if (!suggestion)
+        return undefined;
+    return {
+        asset: asset.name,
+        workflowId: params.workflowId,
+        suggestion,
+    };
+}
+function writeSuggestionReviewReceipt(receipt, path) {
+    process.stderr.write("Workflow suggestion review receipt\n");
+    process.stderr.write(`Decision: ${receipt.decision}\n`);
+    process.stderr.write(`Asset: ${receipt.asset}\n`);
+    process.stderr.write(`Workflow: ${receipt.workflow_id}\n`);
+    process.stderr.write(`Suggestion: ${receipt.suggestion_id}\n`);
+    process.stderr.write(`Suggestion digest: ${receipt.suggestion_digest}\n`);
+    process.stderr.write(`Binding digest: ${receipt.binding_digest}\n`);
+    process.stderr.write(`Receipt path: ${path}\n`);
+    process.stderr.write(`Mutation: writes this local review receipt only; it does not edit workflow assets, mutate policy, adopt assets, bind organizations, or sync runtimes. ${receipt.decision === "accept" ? "Acceptance authorizes the matching improve-from-suggestions route only" : "This decision blocks improve-from-suggestions for this binding"}.\n`);
+}
+function recordValue(value, key) {
+    if (!isRecord(value))
+        return undefined;
+    const child = value[key];
+    return isRecord(child) ? child : undefined;
+}
+function workflowRoles(workflow) {
+    return new Set((workflow?.steps ?? []).map((step) => step.role).filter((role) => role.length > 0));
+}
+function controllerMatchesWorkflow(controller, workflowId) {
+    return controller.workflow === workflowId ||
+        controller.fix_workflow === workflowId ||
+        controller.diagnosis_workflow === workflowId;
+}
+function controllerWorkflowIds(controller) {
+    return [controller.workflow, controller.fix_workflow, controller.diagnosis_workflow]
+        .filter((value) => typeof value === "string" && value.length > 0);
+}
+function controllerRoleIds(controller) {
+    const roles = recordValue(controller, "roles");
+    if (!roles)
+        return [];
+    return Object.values(roles).filter((value) => typeof value === "string" && value.length > 0);
+}
+function defaultRoleDefinition(roleId) {
+    if (roleId === "verifier") {
+        return {
+            description: "Verifies workflow evidence before downstream review or completion claims.",
+            tool_permissions: {
+                allow: ["Read", "Grep", "Glob", "Bash", "Write"],
+                deny: ["Edit", "NotebookEdit"],
+            },
+            scope: {
+                read: ["**/*", ".dna/**", "docs/**"],
+                write: [".dna/fix-progress/**", ".dna/evidence-review/**"],
+            },
+            instructions: [
+                "Run the smallest meaningful verification command for the current workflow step.",
+                "Record command, result, evidence paths, remaining failures, and blockers.",
+                "Do not claim completion without fresh evidence.",
+            ],
+        };
+    }
+    return {
+        description: `Generated role placeholder for ${roleId}; review and tighten before adoption.`,
+        tool_permissions: {
+            allow: ["Read", "Grep", "Glob", "Bash"],
+            deny: ["Edit", "Write", "NotebookEdit"],
+        },
+        scope: {
+            read: ["**/*"],
+            write: [],
+        },
+        instructions: [
+            "Review this generated role before runtime sync.",
+            "Keep permissions minimal until the workflow asset is adopted.",
+        ],
+    };
+}
+function templateContextFromParsed(parsed, workflowId, proposedWorkflow, opts = {}) {
+    if (!isRecord(parsed) || !workflowId)
+        return undefined;
+    const sourceWorkflows = recordValue(parsed, "workflows");
+    const sourceRoles = recordValue(parsed, "roles");
+    const sourceControllers = recordValue(parsed, "controllers");
+    if (!sourceWorkflows && !sourceRoles && !sourceControllers)
+        return undefined;
+    const workflowIds = new Set(opts.preserveAllWorkflows && sourceWorkflows ? Object.keys(sourceWorkflows) : [workflowId]);
+    workflowIds.add(workflowId);
+    const controllers = {};
+    if (sourceControllers) {
+        for (const [controllerId, controller] of Object.entries(sourceControllers)) {
+            if (!isRecord(controller))
+                continue;
+            if (!opts.preserveAllWorkflows && !controllerMatchesWorkflow(controller, workflowId))
+                continue;
+            controllers[controllerId] = controller;
+            for (const id of controllerWorkflowIds(controller))
+                workflowIds.add(id);
+        }
+    }
+    const workflows = {};
+    for (const id of workflowIds) {
+        const sourceWorkflow = sourceWorkflows?.[id];
+        const parsedWorkflow = id === workflowId ? proposedWorkflow : parseWorkflow(sourceWorkflow);
+        if (parsedWorkflow)
+            workflows[id] = parsedWorkflow;
+    }
+    if (Object.keys(workflows).length === 0)
+        workflows[workflowId] = proposedWorkflow;
+    const roleIds = new Set();
+    for (const workflow of Object.values(workflows)) {
+        for (const role of workflowRoles(workflow))
+            roleIds.add(role);
+    }
+    for (const controller of Object.values(controllers)) {
+        if (!isRecord(controller))
+            continue;
+        for (const role of controllerRoleIds(controller))
+            roleIds.add(role);
+    }
+    const roles = {};
+    if (sourceRoles) {
+        for (const roleId of roleIds) {
+            if (sourceRoles[roleId] !== undefined)
+                roles[roleId] = sourceRoles[roleId];
+        }
+    }
+    for (const roleId of roleIds) {
+        if (roles[roleId] === undefined)
+            roles[roleId] = defaultRoleDefinition(roleId);
+    }
+    const extraSections = {};
+    for (const key of ["variables", "context_files", "verifier_policy"]) {
+        if (parsed[key] !== undefined)
+            extraSections[key] = parsed[key];
+    }
+    return {
+        workflowId,
+        workflows,
+        roles: Object.keys(roles).length > 0 ? roles : undefined,
+        controllers: Object.keys(controllers).length > 0 ? controllers : undefined,
+        extraSections: Object.keys(extraSections).length > 0 ? extraSections : undefined,
+    };
+}
+async function loadWorkflowFromTemplate(name, projectDir) {
+    const template = await findTemplateCatalogEntry(name, { projectDir });
+    if (!template)
+        return { templateName: name, workflows: {} };
+    const parsed = parseYAML(await readFile(template.path, "utf-8"));
+    return {
+        templateName: template.name,
+        workflows: workflowMapFromTemplateYaml(parsed),
+        path: template.path,
+        parsed,
+    };
+}
+function writeExamples() {
+    process.stderr.write("Workflow draft examples:\n");
+    for (const example of workflowDraftExamples()) {
+        process.stderr.write(`  - ${example.id}: ${example.label} — ${example.summary}\n`);
+    }
+}
+function writeWorkflowIntake(packet) {
+    process.stderr.write("Workflow intake\n");
+    process.stderr.write(`Mode: ${packet.mode}\n`);
+    process.stderr.write(`Goal: ${packet.input.description}\n`);
+    process.stderr.write(`Recommended path: ${packet.recommendation.path}\n`);
+    if (packet.recommendation.asset)
+        process.stderr.write(`Recommended asset: ${packet.recommendation.asset}\n`);
+    process.stderr.write(`Reason: ${packet.recommendation.reason}\n`);
+    process.stderr.write(`Mutation boundary: ${packet.mutationBoundary}\n`);
+    process.stderr.write("\nBest matches:\n");
+    if (packet.matches.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const match of packet.matches) {
+            process.stderr.write(`  - ${match.name} score=${match.score} matched=${match.matchedKeywords.join(", ")}\n`);
+            if (match.rankingSignals.length > 0)
+                process.stderr.write(`    ranking: ${match.rankingSignals.join(", ")}\n`);
+            if (match.asset) {
+                process.stderr.write(`    asset: ${match.asset.status}, evidence=${match.asset.evidence}, cascade=${match.asset.cascade}, evolution=${match.asset.evolution}${match.asset.dogfood ? ", dogfood" : ""}\n`);
+                if (match.asset.positioning)
+                    process.stderr.write(`    why: ${match.asset.positioning}\n`);
+            }
+            else {
+                process.stderr.write("    asset: not found in current template catalog\n");
+            }
+        }
+    }
+    process.stderr.write("\nReuse review path:\n");
+    for (const command of packet.reviewPath.reuse)
+        process.stderr.write(`  - ${command}\n`);
+    process.stderr.write("\nAuthoring path:\n");
+    process.stderr.write(`  - primary: ${packet.authoringPacket.command}\n`);
+    process.stderr.write(`  - packet schema: ${packet.authoringPacket.schemaVersion}\n`);
+    process.stderr.write(`  - boundary: ${packet.authoringPacket.boundary}\n`);
+    process.stderr.write("  - scaffold fallback only:\n");
+    process.stderr.write(`  - example: ${packet.draft.example}\n`);
+    process.stderr.write(`  - save template: ${packet.draft.saveTemplate}\n`);
+    process.stderr.write(`  - note: ${packet.draft.note}\n`);
+    for (const command of packet.reviewPath.draft)
+        process.stderr.write(`  - ${command}\n`);
+    process.stderr.write("\nNext commands:\n");
+    for (const command of packet.nextCommands)
+        process.stderr.write(`  - ${command}\n`);
+}
+function writeWorkflowAuthoringRoute(route) {
+    process.stderr.write("Workflow authoring route\n");
+    process.stderr.write(`Mode: ${route.mode}\n`);
+    process.stderr.write(`Scope: ${route.scope}\n`);
+    process.stderr.write(`Goal: ${route.input.description}\n`);
+    process.stderr.write(`Sync target: ${route.input.syncTarget}\n`);
+    process.stderr.write(`Recommended path: ${route.recommendation.path}\n`);
+    if (route.recommendation.asset)
+        process.stderr.write(`Recommended asset: ${route.recommendation.asset}\n`);
+    process.stderr.write(`Selected asset: ${route.asset.selected} (${route.asset.source})\n`);
+    process.stderr.write(`Current stage: ${route.current.stage}\n`);
+    process.stderr.write(`Current command: ${route.current.command}\n`);
+    process.stderr.write(`Mutation boundary: ${route.mutationBoundary}\n`);
+    if (route.scope === "personal") {
+        process.stderr.write("\nPersonal path:\n");
+        process.stderr.write(`  ${route.userPath.map((step) => step.label).join(" -> ")}\n`);
+        for (const step of route.userPath) {
+            process.stderr.write(`  - ${step.id}: ${step.status}; ${step.command}\n`);
+        }
+        if (route.current.blockers.length > 0) {
+            process.stderr.write("\nCurrent blockers:\n");
+            for (const blocker of route.current.blockers.slice(0, 3))
+                process.stderr.write(`  - ${blocker}\n`);
+        }
+        process.stderr.write("\nNext commands:\n");
+        for (const command of route.nextCommands)
+            process.stderr.write(`  - ${command}\n`);
+        process.stderr.write("  - rerun with --org for organization rollout, configure, deploy, improve, and evolution gates\n");
+        return;
+    }
+    process.stderr.write(`Organization: ${route.input.organization}\n`);
+    process.stderr.write(`Project: ${route.input.project}\n`);
+    process.stderr.write(`Draft template: ${route.asset.draftTemplate}\n`);
+    process.stderr.write(`Next version: ${route.asset.nextVersion}\n`);
+    process.stderr.write(`Cascade: ${route.governance.selectedAsset.cascade} -> ${route.governance.nextAsset.cascade}\n`);
+    process.stderr.write(`Evolution: ${route.governance.selectedAsset.evolution} -> ${route.governance.nextAsset.evolution}\n`);
+    process.stderr.write(`Evidence: ${route.governance.selectedAsset.evidence} -> ${route.governance.nextAsset.evidence}\n`);
+    process.stderr.write(`Current reason: ${route.current.reason}\n`);
+    process.stderr.write(`Current writes: ${route.current.writes ? "yes" : "no"}\n`);
+    process.stderr.write("\nAuthoring choices:\n");
+    for (const choice of route.choices) {
+        process.stderr.write(`  - ${choice.id}: ${choice.status} writes=${choice.writes ? "yes" : "no"}\n`);
+        process.stderr.write(`    ${choice.command}\n`);
+        process.stderr.write(`    why: ${choice.reason}\n`);
+        process.stderr.write(`    next: ${choice.next}\n`);
+    }
+    process.stderr.write("\nUser path:\n");
+    for (const step of route.userPath) {
+        process.stderr.write(`  - ${step.id}: ${step.status} owner=${step.owner} writes=${step.writes ? "yes" : "no"}\n`);
+        process.stderr.write(`    ${step.command}\n`);
+        process.stderr.write(`    why: ${step.purpose}\n`);
+    }
+    process.stderr.write("\nStatus:\n");
+    process.stderr.write(`  summary: ${route.status.plainSummary}\n`);
+    process.stderr.write(`  readiness: ${route.status.readiness}\n`);
+    process.stderr.write(`  current step: ${route.status.currentStep.id} (${route.status.currentStep.owner}; writes: ${route.status.currentStep.writes ? "yes" : "no"})\n`);
+    process.stderr.write("  do now:\n");
+    for (const item of route.status.now)
+        process.stderr.write(`    - ${item}\n`);
+    process.stderr.write("  not yet:\n");
+    for (const item of route.status.notYet)
+        process.stderr.write(`    - ${item}\n`);
+    process.stderr.write("  evidence loop:\n");
+    for (const item of route.status.evidenceLoop)
+        process.stderr.write(`    - ${item}\n`);
+    process.stderr.write("\nDecision packet:\n");
+    process.stderr.write(`  current: ${route.decisionPacket.currentState}\n`);
+    process.stderr.write(`  primary action: ${route.decisionPacket.primaryAction}\n`);
+    process.stderr.write(`  risk: ${route.decisionPacket.risk}\n`);
+    process.stderr.write(`  reason: ${route.decisionPacket.reason}\n`);
+    process.stderr.write("  allowed now:\n");
+    for (const item of route.decisionPacket.allowedNow)
+        process.stderr.write(`    - ${item}\n`);
+    process.stderr.write("  blocked now:\n");
+    for (const item of route.decisionPacket.blockedNow)
+        process.stderr.write(`    - ${item}\n`);
+    process.stderr.write("\nReview path:\n");
+    for (const command of route.reviewPath)
+        process.stderr.write(`  - ${command}\n`);
+    if (route.alternateEditPath.length > 0) {
+        process.stderr.write("\nAlternate edit path:\n");
+        for (const command of route.alternateEditPath)
+            process.stderr.write(`  - ${command}\n`);
+    }
+    process.stderr.write("\nEdit operations:\n");
+    for (const choice of route.editOperations) {
+        process.stderr.write(`  - ${choice.operation}: ${choice.useWhen} (target: ${choice.targetStep}; writes: ${choice.writes ? "yes" : "no"})\n`);
+        process.stderr.write(`    ${choice.command}\n`);
+    }
+    process.stderr.write("\nSpine:\n");
+    process.stderr.write(`  ${route.spine.join(" -> ")}\n`);
+    process.stderr.write("\nPhases:\n");
+    for (const phase of route.phases) {
+        process.stderr.write(`  - ${phase.id}. ${phase.label}\n`);
+        process.stderr.write(`    command: ${phase.command}\n`);
+        process.stderr.write(`    owner: ${phase.owner}; writes: ${phase.writes ? "yes" : "no"}\n`);
+        process.stderr.write(`    why: ${phase.purpose}\n`);
+    }
+    process.stderr.write("\nCheckpoints:\n");
+    for (const checkpoint of route.checkpoints)
+        process.stderr.write(`  - ${checkpoint}\n`);
+    process.stderr.write("\nGovernance route:\n");
+    process.stderr.write(`  - principle: ${route.governance.principle}\n`);
+    process.stderr.write(`  - cascade review: ${route.governance.cascadeCommand}\n`);
+    process.stderr.write(`  - evolution preview: ${route.governance.evolutionPreviewCommand}\n`);
+    process.stderr.write(`  - improvement review: ${route.governance.improvementCommand}\n`);
+    process.stderr.write(`  - boundary: ${route.governance.mutationBoundary}\n`);
+    if (route.current.blockers.length > 0) {
+        process.stderr.write("\nCurrent blockers:\n");
+        for (const blocker of route.current.blockers)
+            process.stderr.write(`  - ${blocker}\n`);
+    }
+    process.stderr.write("\nNext commands:\n");
+    for (const command of route.nextCommands)
+        process.stderr.write(`  - ${command}\n`);
+}
+function writeAuthoringFields(label, fields) {
+    process.stderr.write(`  ${label}:\n`);
+    for (const field of fields) {
+        const allowed = field.allowed_values?.length ? `; allowed=${field.allowed_values.join("|")}` : "";
+        const notes = field.notes ? `; ${field.notes}` : "";
+        process.stderr.write(`    - ${field.name}: ${field.type}; ${field.required ? "required" : "optional"}${allowed}${notes}\n`);
+    }
+}
+function writeAuthoringPacket(packet) {
+    process.stderr.write("Workflow authoring packet\n");
+    process.stderr.write(`Schema: ${packet.schema_version}\n`);
+    process.stderr.write(`Project root: ${packet.project_context.root}\n`);
+    if (packet.goal_context) {
+        process.stderr.write(`Goal context: ${packet.goal_context.raw}\n`);
+        process.stderr.write("Goal handling: opaque context only; no goal modeling.\n");
+    }
+    process.stderr.write(`Runtime authority: ${packet.runtime_authority}\n`);
+    process.stderr.write(`Mutation performed: ${packet.mutation_performed}\n`);
+    process.stderr.write(`Network performed: ${packet.network_performed}\n`);
+    process.stderr.write("\nAsset contract:\n");
+    process.stderr.write(`  - source: ${packet.asset_contract.source}\n`);
+    process.stderr.write(`  - required: ${packet.asset_contract.required_fields.join(", ")}\n`);
+    process.stderr.write(`  - recommended: ${packet.asset_contract.recommended_fields.join(", ")}\n`);
+    process.stderr.write(`  - validation shell required: ${packet.asset_contract.validation_required_fields.join(", ")}\n`);
+    process.stderr.write(`  - project templates: ${packet.asset_contract.directory_protocol.project_templates}\n`);
+    process.stderr.write(`  - candidate staging: ${packet.asset_contract.directory_protocol.candidate_staging}\n`);
+    for (const note of packet.asset_contract.validation_notes)
+        process.stderr.write(`  - validation note: ${note}\n`);
+    process.stderr.write("\nSchema constraints:\n");
+    process.stderr.write(`  - source: ${packet.schema_constraints.source}\n`);
+    writeAuthoringFields("workflow fields", packet.schema_constraints.workflow);
+    writeAuthoringFields("step fields", packet.schema_constraints.step);
+    writeAuthoringFields("role fields", packet.schema_constraints.role);
+    writeAuthoringFields("role tool_permissions fields", packet.schema_constraints.tool_permissions);
+    writeAuthoringFields("role scope fields", packet.schema_constraints.scope);
+    writeAuthoringFields("handoff artifact fields", packet.schema_constraints.handoff_artifact.fields);
+    writeAuthoringFields("checkpoint fields", packet.schema_constraints.checkpoint.fields);
+    writeAuthoringFields("transition fields", packet.schema_constraints.transition);
+    writeAuthoringFields("retry_policy fields", packet.schema_constraints.retry_policy);
+    process.stderr.write("\nRed lines:\n");
+    for (const line of packet.red_lines)
+        process.stderr.write(`  - ${line}\n`);
+    process.stderr.write("\nInterview protocol:\n");
+    for (const item of packet.interview_protocol) {
+        process.stderr.write(`  - ${item.id}: ${item.question}\n`);
+        process.stderr.write(`    output: ${item.required_output}\n`);
+    }
+    process.stderr.write("\nValidate loop:\n");
+    for (const step of packet.validate_loop) {
+        process.stderr.write(`  - ${step.owner} writes=${step.writes ? "yes" : "no"}: ${step.step}\n`);
+        if (step.command)
+            process.stderr.write(`    command: ${step.command}\n`);
+        if (step.repeat_until)
+            process.stderr.write(`    until: ${step.repeat_until}\n`);
+    }
+    process.stderr.write("\nHandoff boundary:\n");
+    for (const boundary of packet.handoff_boundary)
+        process.stderr.write(`  - ${boundary}\n`);
+    process.stderr.write("\nExamples loaded from real templates:\n");
+    for (const example of packet.examples) {
+        process.stderr.write(`  - ${example.name} (${example.content_hash})\n`);
+        process.stderr.write(`    source: ${example.source_path}\n`);
+        process.stderr.write(`    annotation: ${example.annotation}\n`);
+        process.stderr.write(`    workflows: ${example.workflow_keys.join(", ") || "none"}; roles: ${example.role_keys.join(", ") || "none"}\n`);
+        process.stderr.write("    complete YAML:\n");
+        for (const line of example.yaml.trimEnd().split("\n"))
+            process.stderr.write(`      ${line}\n`);
+    }
+    process.stderr.write("\nNext commands:\n");
+    for (const command of packet.next_commands)
+        process.stderr.write(`  - ${command}\n`);
+    process.stderr.write("\nThe --json mode carries the same complete contract as structured data.\n");
+}
+function writeDraft(draft) {
+    process.stderr.write("Workflow draft\n");
+    process.stderr.write(`Mode: ${draft.mode}\n`);
+    process.stderr.write("Positioning: example-clone scaffold; structure is not derived from the goal.\n");
+    process.stderr.write("Primary creation path: dna workflow authoring-packet\n");
+    process.stderr.write(`Example: ${draft.input.exampleId}\n`);
+    process.stderr.write(`Goal: ${draft.input.goal}\n`);
+    process.stderr.write(`Strictness: ${draft.input.strictness}\n`);
+    process.stderr.write(`Workflow: ${draft.workflow.name}\n`);
+    process.stderr.write(`Steps: ${draft.validation.preview.step_count}\n`);
+    process.stderr.write(`Retry max: ${draft.validation.preview.retry_max}\n`);
+    process.stderr.write(`Write path: ${draft.validation.preview.write_path}\n`);
+    process.stderr.write(`Validation: ${draft.validation.ok ? "ok" : "failed"}\n`);
+    writeDesignPacket(draft.design_packet);
+    process.stderr.write("\nSteps:\n");
+    for (const step of draft.workflow.steps) {
+        const deps = step.depends_on && step.depends_on.length > 0 ? ` after=${step.depends_on.join(",")}` : "";
+        process.stderr.write(`  - ${step.id} -> ${step.role}${deps}`);
+        if (step.description)
+            process.stderr.write(` — ${step.description}`);
+        process.stderr.write("\n");
+    }
+    process.stderr.write("\nValidation messages:\n");
+    for (const message of draft.validation.messages) {
+        process.stderr.write(`  - [${message.severity}] ${message.path}: ${message.message}\n`);
+    }
+    process.stderr.write("\nSafe flow:\n");
+    for (const item of draft.safe_flow)
+        process.stderr.write(`  - ${item}\n`);
+    process.stderr.write("\nForbidden:\n");
+    for (const item of draft.forbidden)
+        process.stderr.write(`  - ${item}\n`);
+    process.stderr.write("\nYAML preview:\n");
+    process.stderr.write(draft.yaml);
+}
+function writeDesignPacket(packet) {
+    process.stderr.write("\nWorkflow design packet:\n");
+    process.stderr.write(`  - workflow: ${packet.workflow}\n`);
+    process.stderr.write(`  - step count: ${packet.stepCount}\n`);
+    process.stderr.write(`  - editable operations: ${packet.editableOperations.join(", ")}\n`);
+    process.stderr.write(`  - mutation boundary: ${packet.mutationBoundary}\n`);
+    process.stderr.write(`  - prompt: ${packet.userPrompt}\n`);
+    process.stderr.write("  - review commands:\n");
+    for (const command of packet.reviewCommands)
+        process.stderr.write(`    - ${command}\n`);
+    process.stderr.write("  - adoption commands:\n");
+    for (const command of packet.adoptionCommands)
+        process.stderr.write(`    - ${command}\n`);
+}
+async function saveDraftTemplate(params) {
+    const projectDir = params.projectDir ?? process.cwd();
+    const templateName = normalizeTemplateName(params.name);
+    const templatesDir = join(projectDir, ".dna", "templates");
+    const path = join(templatesDir, `${templateName}.dna.yaml`);
+    const yaml = workflowDraftToTemplateYaml({
+        templateName,
+        workflow: params.draft.workflow,
+        generatedAt: params.draft.generated_at,
+        lineage: params.lineage,
+        evidence: params.evidence,
+        templateContext: params.templateContext,
+    });
+    await mkdir(templatesDir, { recursive: true });
+    await writeFile(path, yaml, { encoding: "utf-8", flag: params.force ? "w" : "wx" });
+    return { templateName, path, yaml };
+}
+function evidenceLinkKey(link) {
+    return `${link.kind}:${link.path}`;
+}
+function uniqueTemplateEvidenceLinks(links) {
+    const seen = new Set();
+    const unique = [];
+    for (const link of links) {
+        const key = evidenceLinkKey(link);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        unique.push(link);
+    }
+    return unique;
+}
+function toTemplateEvidenceLink(link) {
+    return {
+        label: link.label,
+        path: link.path,
+        kind: link.kind,
+        description: link.description,
+    };
+}
+function candidateTemplateLineage(candidate) {
+    return {
+        generatedFrom: "workflow_candidate",
+        sourceAsset: candidate.sourceAsset,
+        sourceCandidate: candidate.id,
+        sourceEvidence: candidate.evidence,
+    };
+}
+function candidateTemplateEvidence(candidate) {
+    const metadata = getWorkflowAssetMetadata(candidate.sourceAsset);
+    const links = [];
+    if (metadata?.dogfood) {
+        links.push({
+            label: `Active dogfood evidence: ${candidate.sourceAsset}`,
+            path: join(metadata.dogfood.projectPath, metadata.dogfood.progressDir ?? ".dna/fix-progress"),
+            kind: "dogfood",
+            description: candidate.type === "active_evidence_followup"
+                ? `Saved unfinished-work draft from ${candidate.sourceAsset}: ${candidate.evidence}`
+                : `Candidate ${candidate.id}: ${candidate.evidence}`,
+        });
+    }
+    links.push(...(metadata?.evidence ?? []).map(toTemplateEvidenceLink));
+    return uniqueTemplateEvidenceLinks(links);
+}
+function suggestionTemplateLineage(params) {
+    return {
+        generatedFrom: "workflow_suggestion",
+        sourceAsset: params.sourceAsset,
+        sourceSuggestion: params.suggestionId,
+        sourceEvidence: `suggestion:${params.suggestionId}`,
+    };
+}
+function suggestionTemplateEvidence(params) {
+    if (params.suggestionId !== WORKFLOW_SUGGESTION_IDS.c5CapturedRunFacts)
+        return [];
+    return [{
+            label: `C5 captured run facts: ${params.sourceAsset}`,
+            path: ".dna/evidence/capture",
+            kind: "reference",
+            description: "Review local C5 JSONL facts with dna assets evidence before adopting this draft.",
+        }];
+}
+function savedDesignPacket(templateName, workflow, goal) {
+    return buildWorkflowDesignPacket({ templateName, workflow, goal });
+}
+function writeSavedTemplate(result, packet, options) {
+    process.stderr.write(`Saved workflow asset draft: ${result.path}\n`);
+    if (options?.scaffold) {
+        process.stderr.write("Positioning: example-clone scaffold; structure is not derived from the goal.\n");
+        process.stderr.write("Primary creation path: dna workflow authoring-packet\n");
+    }
+    process.stderr.write("Review before runtime use.\n");
+    if (packet)
+        writeDesignPacket(packet);
+    process.stderr.write("\nNext commands:\n");
+    process.stderr.write(`  - dna assets inspect ${result.templateName} --evidence\n`);
+    process.stderr.write(`  - dna init --template ${result.templateName}\n`);
+    process.stderr.write("  - dna assets review\n");
+}
+function writeExistingDraftRoute(templateName, sourceTemplate) {
+    const normalized = normalizeTemplateName(templateName);
+    process.stderr.write(`Workflow asset draft already exists: ${normalized}\n`);
+    process.stderr.write("Review the existing draft before overwriting it.\n");
+    process.stderr.write("\nReview path:\n");
+    process.stderr.write(`  - dna assets inspect ${normalized} --evidence\n`);
+    if (sourceTemplate && sourceTemplate !== normalized) {
+        process.stderr.write(`  - dna assets diff ${sourceTemplate} ${normalized}\n`);
+    }
+    process.stderr.write("  - record explicit manager rationale for the diff before adoption or organization binding\n");
+    process.stderr.write(`  - dna assets adoption ${normalized}\n`);
+    process.stderr.write(`  - dna org bind --asset ${normalized} --status active --sync-target codex\n`);
+    process.stderr.write("\nOverwrite only after review:\n");
+    process.stderr.write(`  - add --force to the save command if this draft should be replaced\n`);
+}
+function writeMissingWorkflowSelection(params) {
+    process.stderr.write(`Workflow not found in template: ${params.requested}\n`);
+    process.stderr.write(`Template: ${params.templatePath}\n`);
+    process.stderr.write(`Available workflows: ${params.available.length > 0 ? params.available.join(", ") : "none"}\n`);
+}
+function suggestionToEditInput(params) {
+    if (params.suggestionId === WORKFLOW_SUGGESTION_IDS.modelVerifier) {
+        return {
+            operation: "add_verifier",
+            targetStep: "fix_bugs",
+            role: "verifier",
+            instruction: "Add a verifier for model behavior locks and placeholder assertion replacement.",
+        };
+    }
+    if (params.suggestionId === WORKFLOW_SUGGESTION_IDS.blockedTriage) {
+        return {
+            operation: "tighten_boundary",
+            targetStep: "review_changes",
+            role: "fix_reviewer",
+            instruction: "Require explicit blocked, skipped, or intentionally deferred scope triage before review completion.",
+        };
+    }
+    if (params.suggestionId === WORKFLOW_SUGGESTION_IDS.c5CapturedRunFacts) {
+        return {
+            operation: "tighten_boundary",
+            targetStep: "verify_report",
+            role: "fix_reviewer",
+            instruction: "Require explicit C5 captured run fact review, evidence refs, and manager rationale before changing the workflow asset.",
+        };
+    }
+    return {
+        operation: "add_verifier",
+        targetStep: "fix_bugs",
+        role: "verifier",
+        instruction: params.fallbackInstruction || `Review suggestion ${params.suggestionId} for ${params.assetName} before changing the workflow asset.`,
+    };
+}
+function writeSuggestionEditPlan(params) {
+    process.stderr.write("Workflow improvement from suggestions\n");
+    process.stderr.write(`Mode: ${params.plan.mode}\n`);
+    process.stderr.write(`Source asset: ${params.fromTemplate}\n`);
+    if (params.workflowId)
+        process.stderr.write(`Selected workflow: ${params.workflowId}\n`);
+    process.stderr.write(`Suggestion: ${params.suggestionId}\n`);
+    process.stderr.write("Mutation: none; this is a reviewable edit plan only.\n");
+    writeEditPlan(params.plan);
+}
+function writeCandidateReviewOnly(candidate) {
+    process.stderr.write("Workflow candidate action\n");
+    process.stderr.write(`Candidate: ${candidate.id}\n`);
+    process.stderr.write(`Title: ${candidate.title}\n`);
+    process.stderr.write(`Source asset: ${candidate.sourceAsset}\n`);
+    process.stderr.write(`Candidate asset: ${candidate.candidateAssetName}\n`);
+    process.stderr.write(`Action: ${candidate.action.kind}\n`);
+    process.stderr.write(`Reason: ${candidate.rationale}\n`);
+    process.stderr.write(`Evidence: ${candidate.evidence}\n`);
+    process.stderr.write(`Mutation boundary: ${candidate.mutationBoundary}\n`);
+    if (candidate.continuityBoundary)
+        process.stderr.write(`Continuity boundary: ${candidate.continuityBoundary}\n`);
+    process.stderr.write("\nThis candidate does not create a new workflow draft.\n");
+    if (candidate.action.kind === "review") {
+        process.stderr.write(`Review command: ${candidate.action.command}\n`);
+        process.stderr.write(`Review reason: ${candidate.action.reason}\n`);
+    }
+    process.stderr.write("\nNext commands:\n");
+    for (const command of candidate.reviewCommands)
+        process.stderr.write(`  - ${command}\n`);
+}
+function candidateReviewPacket(params) {
+    const inspect = `dna assets inspect ${params.templateName} --evidence`;
+    const diff = `dna assets diff ${params.candidate.sourceAsset} ${params.templateName}`;
+    const adoption = `dna assets adoption ${params.templateName}`;
+    const bind = `dna org bind --asset ${params.templateName} --status active --sync-target codex`;
+    const rollout = "dna org rollout";
+    return {
+        currentState: params.savedPath
+            ? `draft_saved:${params.templateName}`
+            : `draft_preview:${params.templateName}`,
+        primaryAction: inspect,
+        reason: params.candidate.type === "active_evidence_followup"
+            ? "The candidate is now a saved unfinished-work draft. It preserves the source asset and must be inspected and diffed before adoption, organization binding, rollout, runtime sync, or evolution."
+            : "The candidate is now a reviewable workflow asset draft. Inspect and diff it before adoption, organization binding, rollout, runtime sync, or evolution.",
+        continuityBoundary: params.candidate.continuityBoundary,
+        allowedNow: [
+            params.candidate.type === "active_evidence_followup"
+                ? `Inspect the saved unfinished-work draft: ${inspect}.`
+                : `Inspect the saved draft: ${inspect}.`,
+            `Compare it against the source asset: ${diff}.`,
+            `Record explicit manager rationale for the diff before adoption or organization binding.`,
+            `Run adoption review only after the diff is acceptable: ${adoption}.`,
+        ],
+        blockedNow: [
+            "Runtime sync is blocked until the draft is reviewed, adopted, organization-bound, configured if needed, and rollout-ready.",
+            "Evolution marker mutation is blocked while active dogfood evidence remains open.",
+            "Vercel deployment is not a substitute for workflow review, organization rollout, or runtime sync.",
+        ],
+        reviewPath: [inspect, diff, "record explicit manager rationale for the diff before adoption or organization binding", adoption, bind, rollout],
+    };
+}
+function suggestionReviewPacket(params) {
+    const evidence = `dna assets evidence ${params.sourceAsset} --json`;
+    const inspect = `dna assets inspect ${params.templateName} --evidence`;
+    const diff = `dna assets diff ${params.sourceAsset} ${params.templateName}`;
+    const adoption = `dna assets adoption ${params.templateName}`;
+    const bind = `dna org bind --asset ${params.templateName} --status active --sync-target codex`;
+    const rollout = "dna org rollout";
+    const c5 = params.suggestionId === WORKFLOW_SUGGESTION_IDS.c5CapturedRunFacts;
+    return {
+        currentState: params.savedPath
+            ? `draft_saved:${params.templateName}`
+            : `draft_preview:${params.templateName}`,
+        primaryAction: evidence,
+        reason: c5
+            ? "The C5 suggestion is now a saved workflow draft. Review captured local run facts, inspect the draft, and diff it against the source asset before adoption, organization binding, rollout, or runtime sync."
+            : "The suggestion is now a saved workflow draft. Review source evidence, inspect the draft, and diff it against the source asset before adoption, organization binding, rollout, or runtime sync.",
+        allowedNow: [
+            `Review source evidence: ${evidence}.`,
+            `Inspect the saved draft: ${inspect}.`,
+            `Compare it against the source asset: ${diff}.`,
+            "Record explicit manager rationale for the diff before adoption or organization binding.",
+            `Run adoption review only after the diff is acceptable: ${adoption}.`,
+        ],
+        blockedNow: [
+            "Runtime sync is blocked until the draft is reviewed, adopted, organization-bound, configured if needed, and rollout-ready.",
+            "Suggestion evidence cannot directly promote, adopt, bind, sync, upload, or mutate the workflow asset.",
+            "Online, marketplace, and Supabase can project or distribute assets only; they do not perform runtime allow/warn/block/validate.",
+        ],
+        reviewPath: [evidence, inspect, diff, "record explicit manager rationale for the diff before adoption or organization binding", adoption, bind, rollout],
+    };
+}
+function candidateSavedDesignPacket(params) {
+    const base = savedDesignPacket(params.templateName, params.workflow, params.goal);
+    const reviewPacket = candidateReviewPacket({
+        candidate: params.candidate,
+        templateName: params.templateName,
+    });
+    return {
+        ...base,
+        reviewCommands: reviewPacket.reviewPath.slice(0, 4),
+        adoptionCommands: [...reviewPacket.reviewPath.slice(4), "dna sync --codex"],
+        mutationBoundary: [
+            base.mutationBoundary,
+            reviewPacket.reason,
+            reviewPacket.continuityBoundary,
+        ].filter(Boolean).join(" "),
+    };
+}
+function suggestionSavedDesignPacket(params) {
+    const base = savedDesignPacket(params.templateName, params.workflow, params.goal);
+    const reviewPacket = suggestionReviewPacket({
+        sourceAsset: params.sourceAsset,
+        suggestionId: params.suggestionId,
+        templateName: params.templateName,
+    });
+    return {
+        ...base,
+        reviewCommands: reviewPacket.reviewPath.slice(0, 5),
+        adoptionCommands: [...reviewPacket.reviewPath.slice(5), "dna sync --codex"],
+        mutationBoundary: [
+            base.mutationBoundary,
+            reviewPacket.reason,
+            "The saved draft is not adopted, organization-bound, synced, uploaded, or treated as runtime policy truth by this command.",
+        ].join(" "),
+    };
+}
+function writeCandidateReviewPacket(packet) {
+    process.stderr.write("\nCandidate review packet:\n");
+    process.stderr.write(`  current: ${packet.currentState}\n`);
+    process.stderr.write(`  primary action: ${packet.primaryAction}\n`);
+    process.stderr.write(`  reason: ${packet.reason}\n`);
+    if (packet.continuityBoundary)
+        process.stderr.write(`  continuity boundary: ${packet.continuityBoundary}\n`);
+    process.stderr.write("  allowed now:\n");
+    for (const item of packet.allowedNow)
+        process.stderr.write(`    - ${item}\n`);
+    process.stderr.write("  blocked now:\n");
+    for (const item of packet.blockedNow)
+        process.stderr.write(`    - ${item}\n`);
+    process.stderr.write("  review path:\n");
+    for (const command of packet.reviewPath)
+        process.stderr.write(`    - ${command}\n`);
+}
+function writeSuggestionReviewPacket(packet) {
+    process.stderr.write("\nSuggestion review packet:\n");
+    process.stderr.write(`  current: ${packet.currentState}\n`);
+    process.stderr.write(`  primary action: ${packet.primaryAction}\n`);
+    process.stderr.write(`  reason: ${packet.reason}\n`);
+    process.stderr.write("  allowed now:\n");
+    for (const item of packet.allowedNow)
+        process.stderr.write(`    - ${item}\n`);
+    process.stderr.write("  blocked now:\n");
+    for (const item of packet.blockedNow)
+        process.stderr.write(`    - ${item}\n`);
+    process.stderr.write("  review path:\n");
+    for (const command of packet.reviewPath)
+        process.stderr.write(`    - ${command}\n`);
+}
+function writeSuggestionSavedTemplate(params) {
+    process.stderr.write(`Saved workflow asset draft: ${params.saved.path}\n`);
+    process.stderr.write("Review before runtime use.\n");
+    writeDesignPacket(suggestionSavedDesignPacket({
+        sourceAsset: params.sourceAsset,
+        suggestionId: params.suggestionId,
+        templateName: params.saved.templateName,
+        workflow: params.workflow,
+        goal: params.goal,
+    }));
+    const reviewPacket = suggestionReviewPacket({
+        sourceAsset: params.sourceAsset,
+        suggestionId: params.suggestionId,
+        templateName: params.saved.templateName,
+        savedPath: params.saved.path,
+    });
+    writeSuggestionReviewPacket(reviewPacket);
+    process.stderr.write("\nNext commands:\n");
+    for (const command of reviewPacket.reviewPath)
+        process.stderr.write(`  - ${command}\n`);
+}
+function writeCandidateDraft(params) {
+    process.stderr.write("Workflow from candidate\n");
+    process.stderr.write(`Candidate: ${params.candidate.id}\n`);
+    process.stderr.write(`Title: ${params.candidate.title}\n`);
+    process.stderr.write(`Source asset: ${params.candidate.sourceAsset}\n`);
+    process.stderr.write(`Candidate asset: ${params.candidate.candidateAssetName}\n`);
+    process.stderr.write(`Action: ${params.candidate.action.kind}\n`);
+    process.stderr.write(`Evidence: ${params.candidate.evidence}\n`);
+    process.stderr.write(`Rationale: ${params.candidate.rationale}\n`);
+    process.stderr.write(`Mutation boundary: ${params.candidate.mutationBoundary}\n`);
+    if (params.saved) {
+        process.stderr.write(`\nSaved workflow asset draft: ${params.saved.path}\n`);
+        process.stderr.write("Review before runtime use.\n");
+        const workflow = params.plan?.proposed_workflow ?? params.draft?.workflow;
+        const goal = params.plan?.input.goal ?? params.draft?.input.goal;
+        if (workflow && goal) {
+            writeDesignPacket(candidateSavedDesignPacket({
+                candidate: params.candidate,
+                templateName: params.saved.templateName,
+                workflow,
+                goal,
+            }));
+        }
+        writeCandidateReviewPacket(candidateReviewPacket({
+            candidate: params.candidate,
+            templateName: params.saved.templateName,
+            savedPath: params.saved.path,
+        }));
+    }
+    else if (params.plan) {
+        writeEditPlan(params.plan);
+    }
+    else if (params.draft) {
+        writeDraft(params.draft);
+    }
+    process.stderr.write("\nNext commands:\n");
+    const nextCommands = params.saved
+        ? candidateReviewPacket({
+            candidate: params.candidate,
+            templateName: params.saved.templateName,
+            savedPath: params.saved.path,
+        }).reviewPath
+        : params.candidate.reviewCommands;
+    for (const command of nextCommands)
+        process.stderr.write(`  - ${command}\n`);
+}
+function writeEditPlan(plan) {
+    process.stderr.write("Workflow edit plan\n");
+    process.stderr.write(`Mode: ${plan.mode}\n`);
+    process.stderr.write(`Example: ${plan.input.exampleId}\n`);
+    if (plan.input.source)
+        process.stderr.write(`Source: ${plan.input.source}\n`);
+    process.stderr.write(`Goal: ${plan.input.goal}\n`);
+    process.stderr.write(`Operation: ${plan.input.operation}\n`);
+    const resolvedTarget = plan.operations[0]?.target;
+    if (plan.input.targetStep)
+        process.stderr.write(`Requested target step: ${plan.input.targetStep}\n`);
+    if (resolvedTarget && resolvedTarget !== plan.input.targetStep)
+        process.stderr.write(`Resolved target step: ${resolvedTarget}\n`);
+    if (plan.input.inference) {
+        process.stderr.write(`Inference: confidence=${plan.input.inference.confidence} operation=${plan.input.inference.operation} target=${plan.input.inference.targetStep} role=${plan.input.inference.role}\n`);
+        for (const reason of plan.input.inference.reasons)
+            process.stderr.write(`  - ${reason}\n`);
+    }
+    process.stderr.write(`Instruction: ${plan.input.instruction}\n`);
+    process.stderr.write(`Validation: ${plan.validation.ok ? "ok" : "failed"}\n`);
+    writeDesignPacket(plan.design_packet);
+    writeEditGuidance(buildEditGuidance(plan, {
+        fromTemplate: templateNameFromPlanSource(plan.input.source),
+    }));
+    process.stderr.write("\nOperations:\n");
+    for (const operation of plan.operations) {
+        process.stderr.write(`  - ${operation.operation} on ${operation.target}: ${operation.summary}\n`);
+    }
+    process.stderr.write("\nProposed steps:\n");
+    for (const step of plan.proposed_workflow.steps) {
+        const deps = step.depends_on && step.depends_on.length > 0 ? ` after=${step.depends_on.join(",")}` : "";
+        process.stderr.write(`  - ${step.id} -> ${step.role}${deps}`);
+        if (step.description)
+            process.stderr.write(` — ${step.description}`);
+        process.stderr.write("\n");
+    }
+    process.stderr.write("\nValidation messages:\n");
+    for (const message of plan.validation.messages) {
+        process.stderr.write(`  - [${message.severity}] ${message.path}: ${message.message}\n`);
+    }
+    process.stderr.write("\nSafe flow:\n");
+    for (const item of plan.safe_flow)
+        process.stderr.write(`  - ${item}\n`);
+    process.stderr.write("\nForbidden:\n");
+    for (const item of plan.forbidden)
+        process.stderr.write(`  - ${item}\n`);
+    process.stderr.write("\nYAML preview:\n");
+    process.stderr.write(plan.yaml);
+}
+function writeEditGuidance(guidance) {
+    process.stderr.write("\nEdit guidance:\n");
+    process.stderr.write(`  - summary: ${guidance.summary}\n`);
+    process.stderr.write("  - change preview:\n");
+    process.stderr.write(`    - steps: ${guidance.changePreview.baseStepCount} -> ${guidance.changePreview.proposedStepCount}\n`);
+    process.stderr.write(`    - added steps: ${guidance.changePreview.addedSteps.length > 0 ? guidance.changePreview.addedSteps.map((step) => `${step.id}(${step.role}) after=${step.after.join(",") || "none"}`).join("; ") : "none"}\n`);
+    process.stderr.write(`    - removed steps: ${guidance.changePreview.removedSteps.length > 0 ? guidance.changePreview.removedSteps.join(", ") : "none"}\n`);
+    process.stderr.write(`    - target successors: ${guidance.changePreview.targetBefore.length > 0 ? guidance.changePreview.targetBefore.join(",") : "none"} -> ${guidance.changePreview.targetAfter.length > 0 ? guidance.changePreview.targetAfter.join(",") : "none"}\n`);
+    process.stderr.write(`    - suggested next: ${guidance.changePreview.suggestedNext}\n`);
+    process.stderr.write(`  - inferred: operation=${guidance.inferred.operation} target=${guidance.inferred.targetStep}${guidance.inferred.role ? ` role=${guidance.inferred.role}` : ""} confidence=${guidance.inferred.confidence}\n`);
+    for (const reason of guidance.inferred.reasons)
+        process.stderr.write(`    - ${reason}\n`);
+    process.stderr.write(`  - mutation boundary: ${guidance.mutationBoundary}\n`);
+    process.stderr.write("  - target choices:\n");
+    for (const target of guidance.targetChoices)
+        process.stderr.write(`    - ${target}\n`);
+    process.stderr.write("  - operation choices:\n");
+    for (const choice of guidance.operationChoices) {
+        process.stderr.write(`    - ${choice.operation}: ${choice.useWhen}\n`);
+        process.stderr.write(`      ${choice.command}\n`);
+    }
+    if (guidance.saveCommand)
+        process.stderr.write(`  - save command: ${guidance.saveCommand}\n`);
+    process.stderr.write("  - review path:\n");
+    for (const command of guidance.reviewPath)
+        process.stderr.write(`    - ${command}\n`);
+}
+function planWithGuidance(plan, opts) {
+    return {
+        ...plan,
+        guidance: buildEditGuidance(plan, opts),
+    };
+}
+export async function runWorkflow(opts) {
+    const subcommand = opts.subcommand || "draft";
+    if (subcommand === "examples") {
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(workflowDraftExamples(), null, 2) + "\n");
+            return 0;
+        }
+        writeExamples();
+        return 0;
+    }
+    if (subcommand === "authoring-packet") {
+        const packet = await buildAuthoringPacket({
+            goal: opts.goal,
+            projectDir: opts.projectDir,
+        });
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(packet, null, 2) + "\n");
+            return 0;
+        }
+        writeAuthoringPacket(packet);
+        return 0;
+    }
+    if (subcommand === "intake") {
+        const goal = opts.goal?.trim() ?? "";
+        if (!goal) {
+            process.stderr.write("Usage: dna workflow intake <description> [--json]\n");
+            return 2;
+        }
+        const packet = await buildWorkflowIntake(goal, opts.projectDir);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(packet, null, 2) + "\n");
+            return 0;
+        }
+        writeWorkflowIntake(packet);
+        return 0;
+    }
+    if (subcommand === "route") {
+        const goal = opts.goal?.trim() ?? "";
+        if (!goal) {
+            process.stderr.write("Usage: dna workflow route <description> [--org] [--name <org>] [--project <project>] [--sync-target <target>] [--from-template <asset>] [--save-template <name>] [--json]\n");
+            return 2;
+        }
+        const route = await buildWorkflowAuthoringRoute({ ...opts, goal });
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(route, null, 2) + "\n");
+            return 0;
+        }
+        writeWorkflowAuthoringRoute(route);
+        return 0;
+    }
+    if (subcommand === "suggestions") {
+        const assetName = opts.goal?.trim() || opts.fromTemplate?.trim();
+        if (!assetName) {
+            process.stderr.write("Usage: dna workflow suggestions <asset> [--json]\n");
+            return 2;
+        }
+        return runAssets({
+            subcommand: "suggestions",
+            name: assetName,
+            projectDir: opts.projectDir,
+            json: opts.json,
+        });
+    }
+    if (subcommand === "mine") {
+        const assetName = opts.goal?.trim() || opts.fromTemplate?.trim();
+        return runAssets({
+            subcommand: "candidates",
+            name: assetName,
+            projectDir: opts.projectDir,
+            json: opts.json,
+        });
+    }
+    if (subcommand === "review-suggestion") {
+        const projectDir = opts.projectDir ?? process.cwd();
+        const fromTemplate = opts.fromTemplate?.trim();
+        const decision = normalizeReviewDecision(opts.decision ?? opts.goal);
+        const rawSuggestionId = opts.suggestion?.trim();
+        const suggestionId = rawSuggestionId ? normalizeSuggestionId(rawSuggestionId) : undefined;
+        const workflowId = opts.workflow?.trim();
+        if (!fromTemplate || !decision || !suggestionId) {
+            process.stderr.write("Usage: dna workflow review-suggestion --from-template <asset> --workflow <id> --suggestion <id> --decision accept|reject|defer [--json]\n");
+            return 2;
+        }
+        if (!workflowId) {
+            process.stderr.write("Usage: dna workflow review-suggestion --from-template <asset> --workflow <id> --suggestion <id> --decision accept|reject|defer [--json]\n");
+            return 2;
+        }
+        const loaded = await loadWorkflowFromTemplate(fromTemplate, projectDir);
+        if (!loaded.path) {
+            process.stderr.write(`Unknown workflow asset template: ${fromTemplate}\n`);
+            return 2;
+        }
+        if (!loaded.workflows[workflowId]) {
+            writeMissingWorkflowSelection({
+                requested: workflowId,
+                available: Object.keys(loaded.workflows),
+                templatePath: loaded.path,
+            });
+            return 2;
+        }
+        const snapshot = await currentSuggestionReviewSnapshot({
+            assetName: fromTemplate,
+            workflowId,
+            suggestionId,
+            projectDir,
+        });
+        if (!snapshot) {
+            process.stderr.write(`Suggestion not found for review: ${fromTemplate}/${workflowId}/${suggestionId}\n`);
+            return 2;
+        }
+        const receipt = buildSuggestionReviewReceipt({ snapshot, decision });
+        const persisted = await appendSuggestionReviewReceipt({ projectDir, receipt });
+        const effective = persisted.existing ?? receipt;
+        if (persisted.existing && persisted.existing.decision !== decision) {
+            process.stderr.write(`Suggestion review already terminal: ${persisted.existing.decision}\n`);
+            process.stderr.write(`Binding digest: ${persisted.existing.binding_digest}\n`);
+            return 2;
+        }
+        if (opts.json) {
+            process.stdout.write(JSON.stringify({
+                mode: "workflow_suggestion_review_receipt",
+                path: persisted.path,
+                receipt: effective,
+                existing: Boolean(persisted.existing),
+                nextCommand: effective.decision === "accept"
+                    ? `dna workflow improve-from-suggestions --from-template ${effective.asset} --workflow ${effective.workflow_id} --suggestion ${effective.suggestion_id}`
+                    : undefined,
+            }, null, 2) + "\n");
+            return 0;
+        }
+        writeSuggestionReviewReceipt(effective, persisted.path);
+        return 0;
+    }
+    if (subcommand === "draft") {
+        const goal = opts.goal?.trim() ?? "";
+        if (!goal) {
+            process.stderr.write("Usage: dna workflow draft <description> [--example rewrite_governance|dev_pipeline|evidence_review] [--strictness standard|high] [--json|--yaml]\n");
+            return 2;
+        }
+        const draft = createWorkflowDraft({
+            exampleId: normalizeExample(opts.example),
+            goal,
+            strictness: normalizeStrictness(opts.strictness),
+        });
+        if (opts.saveTemplate) {
+            try {
+                const result = await saveDraftTemplate({
+                    draft,
+                    name: opts.saveTemplate,
+                    projectDir: opts.projectDir,
+                    force: opts.force,
+                });
+                if (opts.json) {
+                    process.stdout.write(JSON.stringify({
+                        mode: "saved_workflow_asset_draft",
+                        templateName: result.templateName,
+                        path: result.path,
+                        designPacket: savedDesignPacket(result.templateName, draft.workflow, draft.input.goal),
+                        scaffold: draft.scaffold,
+                        draft,
+                    }, null, 2) + "\n");
+                    return 0;
+                }
+                writeSavedTemplate(result, savedDesignPacket(result.templateName, draft.workflow, draft.input.goal), { scaffold: true });
+                return 0;
+            }
+            catch (err) {
+                if (err && typeof err === "object" && "code" in err && err.code === "EEXIST") {
+                    writeExistingDraftRoute(opts.saveTemplate);
+                    return 2;
+                }
+                throw err;
+            }
+        }
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(draft, null, 2) + "\n");
+            return 0;
+        }
+        if (opts.yaml) {
+            process.stdout.write([
+                "# example-clone scaffold; structure is not derived from the goal",
+                "# primary creation path: dna workflow authoring-packet",
+                draft.yaml,
+            ].join("\n"));
+            return 0;
+        }
+        writeDraft(draft);
+        return 0;
+    }
+    if (subcommand === "edit-plan") {
+        const instruction = opts.goal?.trim() ?? "";
+        if (!instruction) {
+            process.stderr.write("Usage: dna workflow edit-plan <instruction> [--operation <override>] [--target-step <override>] [--role <override>] [--example <id>] [--json|--yaml]\n");
+            process.stderr.write("The CLI infers common edit operation, target step, and role from natural language; explicit options override inference.\n");
+            return 2;
+        }
+        const input = buildEditInput({
+            instruction,
+            example: opts.example,
+            strictness: opts.strictness,
+            operation: opts.operation,
+            targetStep: opts.targetStep,
+            role: opts.role,
+            fromTemplate: opts.fromTemplate,
+        });
+        let plan;
+        let templateContext;
+        if (opts.fromTemplate) {
+            const loaded = await loadWorkflowFromTemplate(opts.fromTemplate, opts.projectDir);
+            if (!loaded.path) {
+                process.stderr.write(`Unknown workflow asset template: ${opts.fromTemplate}\n`);
+                return 2;
+            }
+            if (Object.keys(loaded.workflows).length === 0) {
+                process.stderr.write(`Template has no workflow to edit: ${loaded.path}\n`);
+                return 2;
+            }
+            const selected = selectWorkflow({
+                workflows: loaded.workflows,
+                requested: opts.workflow,
+                targetStep: input.targetStep,
+            });
+            if (selected.requestedMissing) {
+                writeMissingWorkflowSelection({
+                    requested: selected.requestedMissing,
+                    available: Object.keys(loaded.workflows),
+                    templatePath: loaded.path,
+                });
+                return 2;
+            }
+            if (!selected.workflow) {
+                process.stderr.write(`Template has no workflow to edit: ${loaded.path}\n`);
+                return 2;
+            }
+            const selectedInput = buildEditInput({
+                instruction,
+                example: opts.example,
+                strictness: opts.strictness,
+                operation: opts.operation,
+                targetStep: opts.targetStep,
+                role: opts.role,
+                fromTemplate: opts.fromTemplate,
+                workflow: selected.workflow,
+            });
+            plan = createWorkflowEditPlanFromWorkflow(selected.workflow, {
+                ...selectedInput,
+                source: sourceWithWorkflow("template", loaded.templateName, selected.workflowId),
+            });
+            templateContext = templateContextFromParsed(loaded.parsed, selected.workflowId, plan.proposed_workflow);
+        }
+        else {
+            plan = createWorkflowEditPlan(input);
+        }
+        if (opts.saveTemplate) {
+            try {
+                const result = await saveDraftTemplate({
+                    draft: {
+                        mode: "draft_only",
+                        generated_at: plan.generated_at,
+                        input: {
+                            exampleId: plan.input.exampleId,
+                            goal: plan.input.goal,
+                            strictness: plan.input.strictness,
+                        },
+                        workflow: plan.proposed_workflow,
+                        design_packet: plan.design_packet,
+                        yaml: plan.yaml,
+                        validation: plan.validation,
+                        safe_flow: plan.safe_flow,
+                        forbidden: plan.forbidden,
+                    },
+                    name: opts.saveTemplate,
+                    projectDir: opts.projectDir,
+                    force: opts.force,
+                    templateContext,
+                });
+                if (opts.json) {
+                    process.stdout.write(JSON.stringify({
+                        mode: "saved_workflow_edit_plan",
+                        templateName: result.templateName,
+                        path: result.path,
+                        designPacket: savedDesignPacket(result.templateName, plan.proposed_workflow, plan.input.goal),
+                        plan: planWithGuidance(plan, { fromTemplate: opts.fromTemplate, saveTemplate: result.templateName }),
+                    }, null, 2) + "\n");
+                    return 0;
+                }
+                writeSavedTemplate(result, savedDesignPacket(result.templateName, plan.proposed_workflow, plan.input.goal));
+                return 0;
+            }
+            catch (err) {
+                if (err && typeof err === "object" && "code" in err && err.code === "EEXIST") {
+                    writeExistingDraftRoute(opts.saveTemplate, opts.fromTemplate);
+                    return 2;
+                }
+                throw err;
+            }
+        }
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(planWithGuidance(plan, { fromTemplate: opts.fromTemplate, saveTemplate: opts.saveTemplate }), null, 2) + "\n");
+            return 0;
+        }
+        if (opts.yaml) {
+            process.stdout.write(plan.yaml);
+            return 0;
+        }
+        writeEditPlan(plan);
+        return 0;
+    }
+    if (subcommand === "improve-from-suggestions") {
+        const fromTemplate = opts.fromTemplate?.trim();
+        if (!fromTemplate) {
+            process.stderr.write("Usage: dna workflow improve-from-suggestions --from-template <asset> [--suggestion <id>] [--save-template <name>] [--json|--yaml]\n");
+            return 2;
+        }
+        const loaded = await loadWorkflowFromTemplate(fromTemplate, opts.projectDir);
+        if (!loaded.path) {
+            process.stderr.write(`Unknown workflow asset template: ${fromTemplate}\n`);
+            return 2;
+        }
+        if (Object.keys(loaded.workflows).length === 0) {
+            process.stderr.write(`Template has no workflow to edit: ${loaded.path}\n`);
+            return 2;
+        }
+        const evidence = await buildWorkflowAssetEvidenceIndex(loaded.templateName, { projectDir: opts.projectDir });
+        const suggestionId = normalizeSuggestionId(opts.suggestion ?? opts.goal);
+        const activeFocus = evidence?.modules.find((module) => module.verdict !== "PASS" ||
+            !module.moduleComplete ||
+            module.remainingCount > 0 ||
+            module.newRedCount > 0);
+        const inputShape = suggestionToEditInput({
+            suggestionId,
+            assetName: loaded.templateName,
+            fallbackInstruction: activeFocus?.nextRoundFocus ?? activeFocus?.failureReason ?? "",
+        });
+        const selected = selectWorkflow({
+            workflows: loaded.workflows,
+            requested: opts.workflow,
+            targetStep: inputShape.targetStep,
+        });
+        if (selected.requestedMissing) {
+            writeMissingWorkflowSelection({
+                requested: selected.requestedMissing,
+                available: Object.keys(loaded.workflows),
+                templatePath: loaded.path,
+            });
+            return 2;
+        }
+        if (!selected.workflow) {
+            process.stderr.write(`Template has no workflow to edit: ${loaded.path}\n`);
+            return 2;
+        }
+        const projectDir = opts.projectDir ?? process.cwd();
+        const snapshot = await currentSuggestionReviewSnapshot({
+            assetName: loaded.templateName,
+            workflowId: selected.workflowId ?? "workflow",
+            suggestionId,
+            projectDir,
+        });
+        if (!snapshot) {
+            process.stderr.write(`Suggestion not found or no longer current: ${loaded.templateName}/${selected.workflowId ?? "workflow"}/${suggestionId}\n`);
+            process.stderr.write("Run dna workflow suggestions and record a fresh accept receipt before improving from suggestions.\n");
+            return 2;
+        }
+        const suggestionDigest = sha256Canonical(snapshot.suggestion);
+        const bindingDigest = suggestionBindingDigest({
+            asset: snapshot.asset,
+            workflowId: snapshot.workflowId,
+            suggestionId,
+            suggestionDigest,
+            evidenceRefs: snapshot.suggestion.evidenceRefs ?? [],
+        });
+        const terminalReceipt = await findTerminalSuggestionReceipt({
+            projectDir,
+            asset: snapshot.asset,
+            workflowId: snapshot.workflowId,
+            suggestionId,
+            bindingDigest,
+        });
+        if (!terminalReceipt) {
+            process.stderr.write(`Missing K4 accept receipt for suggestion: ${snapshot.asset}/${snapshot.workflowId}/${suggestionId}\n`);
+            process.stderr.write(`Required binding digest: ${bindingDigest}\n`);
+            process.stderr.write(`Review first: dna workflow review-suggestion --from-template ${snapshot.asset} --workflow ${snapshot.workflowId} --suggestion ${suggestionId} --decision accept\n`);
+            return 2;
+        }
+        if (terminalReceipt.decision !== "accept") {
+            process.stderr.write(`Suggestion review decision blocks improvement: ${terminalReceipt.decision}\n`);
+            process.stderr.write(`Binding digest: ${bindingDigest}\n`);
+            return 2;
+        }
+        const source = sourceWithWorkflow("suggestions", loaded.templateName, selected.workflowId, suggestionId);
+        const plan = createWorkflowEditPlanFromWorkflow(selected.workflow, {
+            exampleId: "rewrite_governance",
+            goal: `Apply reviewed suggestion ${suggestionId} to ${loaded.templateName}`,
+            strictness: "high",
+            operation: inputShape.operation,
+            instruction: inputShape.instruction,
+            targetStep: inputShape.targetStep,
+            role: inputShape.role,
+            source,
+        });
+        const templateContext = templateContextFromParsed(loaded.parsed, selected.workflowId, plan.proposed_workflow);
+        if (opts.saveTemplate) {
+            try {
+                const result = await saveDraftTemplate({
+                    draft: {
+                        mode: "draft_only",
+                        generated_at: plan.generated_at,
+                        input: {
+                            exampleId: plan.input.exampleId,
+                            goal: plan.input.goal,
+                            strictness: plan.input.strictness,
+                        },
+                        workflow: plan.proposed_workflow,
+                        design_packet: plan.design_packet,
+                        yaml: plan.yaml,
+                        validation: plan.validation,
+                        safe_flow: plan.safe_flow,
+                        forbidden: plan.forbidden,
+                    },
+                    name: opts.saveTemplate,
+                    projectDir: opts.projectDir,
+                    force: opts.force,
+                    lineage: suggestionTemplateLineage({
+                        sourceAsset: loaded.templateName,
+                        suggestionId,
+                    }),
+                    evidence: suggestionTemplateEvidence({
+                        sourceAsset: loaded.templateName,
+                        suggestionId,
+                    }),
+                    templateContext,
+                });
+                const designPacket = suggestionSavedDesignPacket({
+                    sourceAsset: loaded.templateName,
+                    suggestionId,
+                    templateName: result.templateName,
+                    workflow: plan.proposed_workflow,
+                    goal: plan.input.goal,
+                });
+                const reviewPacket = suggestionReviewPacket({
+                    sourceAsset: loaded.templateName,
+                    suggestionId,
+                    templateName: result.templateName,
+                    savedPath: result.path,
+                });
+                if (opts.json) {
+                    process.stdout.write(JSON.stringify({
+                        mode: "saved_workflow_suggestion_edit_plan",
+                        suggestionId,
+                        workflowId: selected.workflowId,
+                        templateName: result.templateName,
+                        path: result.path,
+                        designPacket,
+                        reviewPacket,
+                        nextCommands: reviewPacket.reviewPath,
+                        plan,
+                    }, null, 2) + "\n");
+                    return 0;
+                }
+                writeSuggestionSavedTemplate({
+                    sourceAsset: loaded.templateName,
+                    suggestionId,
+                    workflow: plan.proposed_workflow,
+                    goal: plan.input.goal,
+                    saved: result,
+                });
+                return 0;
+            }
+            catch (err) {
+                if (err && typeof err === "object" && "code" in err && err.code === "EEXIST") {
+                    writeExistingDraftRoute(opts.saveTemplate, fromTemplate);
+                    return 2;
+                }
+                throw err;
+            }
+        }
+        if (opts.json) {
+            process.stdout.write(JSON.stringify({ mode: "workflow_suggestion_edit_plan", suggestionId, workflowId: selected.workflowId, plan }, null, 2) + "\n");
+            return 0;
+        }
+        if (opts.yaml) {
+            process.stdout.write(plan.yaml);
+            return 0;
+        }
+        writeSuggestionEditPlan({ plan, suggestionId, fromTemplate: loaded.templateName, workflowId: selected.workflowId });
+        return 0;
+    }
+    if (subcommand === "from-candidate") {
+        const candidateId = opts.goal?.trim() ?? opts.suggestion?.trim() ?? "";
+        const fromTemplate = opts.fromTemplate?.trim();
+        if (!candidateId || !fromTemplate) {
+            process.stderr.write("Usage: dna workflow from-candidate <candidate-id> --from-template <asset> [--save-template <name>] [--json|--yaml]\n");
+            return 2;
+        }
+        const backlog = await buildWorkflowAssetCandidateBacklog({ name: fromTemplate, projectDir: opts.projectDir });
+        if (!backlog) {
+            process.stderr.write(`Unknown workflow asset: ${fromTemplate}\n`);
+            return 2;
+        }
+        const candidate = backlog.candidates.find((entry) => entry.id === candidateId);
+        if (!candidate) {
+            process.stderr.write(`Unknown workflow candidate: ${candidateId}\n`);
+            process.stderr.write("Available candidates:\n");
+            for (const entry of backlog.candidates)
+                process.stderr.write(`  - ${entry.id}: ${entry.title}\n`);
+            return 2;
+        }
+        const saveTemplate = opts.saveTemplate?.trim() || undefined;
+        if (candidate.action.kind === "review") {
+            if (opts.json) {
+                process.stdout.write(JSON.stringify({
+                    mode: "workflow_candidate_review_only",
+                    candidate,
+                    nextCommands: candidate.reviewCommands,
+                    mutation: {
+                        writes: false,
+                        note: "This candidate requires review/adoption first and does not generate a workflow draft.",
+                    },
+                }, null, 2) + "\n");
+                return 0;
+            }
+            writeCandidateReviewOnly(candidate);
+            return 0;
+        }
+        if (candidate.action.kind === "draft") {
+            const draft = createWorkflowDraft({
+                exampleId: candidate.action.example,
+                goal: candidate.action.goal,
+                strictness: candidate.action.strictness,
+            });
+            const templateName = saveTemplate ?? candidate.action.saveTemplate;
+            if (saveTemplate) {
+                try {
+                    const result = await saveDraftTemplate({
+                        draft,
+                        name: templateName,
+                        projectDir: opts.projectDir,
+                        force: opts.force,
+                        lineage: candidateTemplateLineage(candidate),
+                        evidence: candidateTemplateEvidence(candidate),
+                    });
+                    if (opts.json) {
+                        const reviewPacket = candidateReviewPacket({
+                            candidate,
+                            templateName: result.templateName,
+                            savedPath: result.path,
+                        });
+                        process.stdout.write(JSON.stringify({
+                            mode: "saved_workflow_candidate_draft",
+                            candidate,
+                            templateName: result.templateName,
+                            path: result.path,
+                            designPacket: candidateSavedDesignPacket({
+                                candidate,
+                                templateName: result.templateName,
+                                workflow: draft.workflow,
+                                goal: draft.input.goal,
+                            }),
+                            reviewPacket,
+                            nextCommands: reviewPacket.reviewPath,
+                            draft,
+                        }, null, 2) + "\n");
+                        return 0;
+                    }
+                    writeCandidateDraft({ candidate, draft, saved: result });
+                    return 0;
+                }
+                catch (err) {
+                    if (err && typeof err === "object" && "code" in err && err.code === "EEXIST") {
+                        writeExistingDraftRoute(templateName, fromTemplate);
+                        return 2;
+                    }
+                    throw err;
+                }
+            }
+            if (opts.json) {
+                process.stdout.write(JSON.stringify({ mode: "workflow_candidate_draft", candidate, draft }, null, 2) + "\n");
+                return 0;
+            }
+            if (opts.yaml) {
+                process.stdout.write(draft.yaml);
+                return 0;
+            }
+            writeCandidateDraft({ candidate, draft });
+            return 0;
+        }
+        const loaded = await loadWorkflowFromTemplate(candidate.action.fromTemplate, opts.projectDir);
+        if (!loaded.path) {
+            process.stderr.write(`Unknown workflow asset template: ${candidate.action.fromTemplate}\n`);
+            return 2;
+        }
+        const selected = selectWorkflow({
+            workflows: loaded.workflows,
+            requested: candidate.action.workflow,
+            targetStep: candidate.action.targetStep,
+        });
+        if (selected.requestedMissing) {
+            writeMissingWorkflowSelection({
+                requested: selected.requestedMissing,
+                available: Object.keys(loaded.workflows),
+                templatePath: loaded.path,
+            });
+            return 2;
+        }
+        if (!selected.workflow) {
+            process.stderr.write(`Template has no workflow to edit: ${loaded.path}\n`);
+            return 2;
+        }
+        const plan = createWorkflowEditPlanFromWorkflow(selected.workflow, {
+            exampleId: "rewrite_governance",
+            goal: `Apply workflow candidate ${candidate.id} from ${candidate.sourceAsset}`,
+            strictness: "high",
+            operation: candidate.action.operation,
+            instruction: candidate.action.instruction,
+            targetStep: candidate.action.targetStep,
+            source: sourceWithWorkflow("candidate", loaded.templateName, selected.workflowId, candidate.id),
+        });
+        const templateContext = templateContextFromParsed(loaded.parsed, selected.workflowId, plan.proposed_workflow, {
+            preserveAllWorkflows: candidate.type === "active_evidence_followup",
+        });
+        const templateName = saveTemplate ?? candidate.action.saveTemplate;
+        if (saveTemplate) {
+            try {
+                const result = await saveDraftTemplate({
+                    draft: {
+                        mode: "draft_only",
+                        generated_at: plan.generated_at,
+                        input: {
+                            exampleId: plan.input.exampleId,
+                            goal: plan.input.goal,
+                            strictness: plan.input.strictness,
+                        },
+                        workflow: plan.proposed_workflow,
+                        design_packet: plan.design_packet,
+                        yaml: plan.yaml,
+                        validation: plan.validation,
+                        safe_flow: plan.safe_flow,
+                        forbidden: plan.forbidden,
+                    },
+                    name: templateName,
+                    projectDir: opts.projectDir,
+                    force: opts.force,
+                    lineage: candidateTemplateLineage(candidate),
+                    evidence: candidateTemplateEvidence(candidate),
+                    templateContext,
+                });
+                if (opts.json) {
+                    const reviewPacket = candidateReviewPacket({
+                        candidate,
+                        templateName: result.templateName,
+                        savedPath: result.path,
+                    });
+                    process.stdout.write(JSON.stringify({
+                        mode: "saved_workflow_candidate_edit_plan",
+                        candidate,
+                        workflowId: selected.workflowId,
+                        templateName: result.templateName,
+                        path: result.path,
+                        designPacket: candidateSavedDesignPacket({
+                            candidate,
+                            templateName: result.templateName,
+                            workflow: plan.proposed_workflow,
+                            goal: plan.input.goal,
+                        }),
+                        reviewPacket,
+                        nextCommands: reviewPacket.reviewPath,
+                        plan,
+                    }, null, 2) + "\n");
+                    return 0;
+                }
+                writeCandidateDraft({ candidate, plan, saved: result });
+                return 0;
+            }
+            catch (err) {
+                if (err && typeof err === "object" && "code" in err && err.code === "EEXIST") {
+                    writeExistingDraftRoute(templateName, candidate.action.fromTemplate);
+                    return 2;
+                }
+                throw err;
+            }
+        }
+        if (opts.json) {
+            process.stdout.write(JSON.stringify({ mode: "workflow_candidate_edit_plan", candidate, workflowId: selected.workflowId, plan }, null, 2) + "\n");
+            return 0;
+        }
+        if (opts.yaml) {
+            process.stdout.write(plan.yaml);
+            return 0;
+        }
+        writeCandidateDraft({ candidate, plan });
+        return 0;
+    }
+    process.stderr.write("Usage: dna workflow <examples|authoring-packet|intake|route|suggestions|mine|draft|edit-plan|review-suggestion|improve-from-suggestions|from-candidate> [description] [--json|--yaml]\n");
+    return 2;
+}