feat: migrate missing harnesses, templates, and workflows from agent-runtimes

Brings the framework CRS repo up to date with all content that was
living in agent-runtimes (local-dev fallback) but hadn't been promoted.

New composites: feature-delivery-loop, integration-direct, scaffolding-repo,
sonnet-impl-narrow, sonnet-manager, test-writing-repo

New contexts: integration/v1, scaffolding/v1, sonnet-manager/v1, z-ai/v1,
airouter/v1/bin (anthropic-compat-wrapper.sh), cp-harness/v1/init.sh

New task-templates: sonnet-integrator.yaml, workflow/* (17 typed workflow
task templates for the Epic 1 pipeline)

Updated: agent-repo/v1/finalize.sh — adds AR-38/F97 empty-deliverable audit
(SKIP_BRANCH_PUSH support, boilerplate-path filtering, ci_metadata.json flag)

Also adds MEMORY.md index and memory/ topic files for the framework repo.

task-templates/sonnet-integrator.yaml

@@ -0,0 +1,14 @@
+name: sonnet-integrator
+description: "Sonnet integrator — cherry-picks from coding fork and pushes directly to main. No fork persistence."
+model: sonnet
+harness: code-sonnet-direct/v1
+requires_tags: [claude-code, coding-agent, git-access]
+required_params: [repo_url]
+defaults:
+  timeout: 1800
+pre_actions:
+  - type: clone
+    repo: "{{ repo_url }}"
+    branch: main
+    depth: 1
+    clone_path: /workspace/project

task-templates/workflow/airouter-impl-narrow@1.yaml

@@ -0,0 +1,25 @@
+name: airouter-impl-narrow
+version: 1
+description: Single-file impl of a tagged spec requirement against existing tests, airouter in worktree
+runtime: code-airouter-tdd-repo
+input:
+  state: test-validated
+  tags_required: [airouter-eligible]
+  tags_forbidden: [security-sensitive, multi-file, algorithmic-large]
+  required_artifacts: [test_file, impl_skeleton, prompt_pack]
+output:
+  state: impl-green
+scope_budget:
+  files_modified_max: 1
+  lines_diff_max: 80
+  wall_clock_seconds_max: 1800
+nodes:
+  - id: agent
+    kind: agent
+    template: code-airouter-tdd-repo
+    prompt: "Implement the failing test. Test file: ${artifacts.test_file}. Skeleton: ${artifacts.impl_skeleton}."
+escalation:
+  fixture_broken: fix-test-fixture-sonnet
+  contract_ambiguous: review-spec-opus
+  scope_exceeded: replan-spec-opus
+  agent_bailed: airouter-impl-narrow

task-templates/workflow/airouter-impl-ready@1.yaml

@@ -0,0 +1,26 @@
+name: airouter-impl-ready
+version: 1
+description: Single-file impl of a tagged spec requirement against pre-validated tests, airouter in worktree
+runtime: code-airouter-tdd-repo
+input:
+  state: scaffolded
+  tags_required: [airouter-eligible]
+  tags_forbidden: [security-sensitive, multi-file, algorithmic-large]
+  required_artifacts: []
+output:
+  state: impl-green
+scope_budget:
+  files_modified_max: 1
+  lines_diff_max: 80
+  wall_clock_seconds_max: 1800
+nodes:
+  - id: agent
+    kind: agent
+    template: code-airouter-tdd-repo
+    labels: [airouter]
+    prompt: "Implement the failing test. Test files: ${metadata.automation.test_files}. Spec IDs: ${metadata.automation.spec_ids}."
+escalation:
+  fixture_broken: fix-test-fixture-sonnet
+  contract_ambiguous: review-spec-opus
+  scope_exceeded: replan-spec-opus
+  agent_bailed: airouter-impl-ready

task-templates/workflow/feature-delivery-loop@1.yaml

@@ -0,0 +1,36 @@
+name: feature-delivery-loop
+version: 1
+description: |
+  Orchestrator workflow for delivering a feature-tagged item end-to-end. Reads
+  the item's workflow_state and workflow_history, lists eligible child workflows,
+  picks one via policy-pick, dispatches it, waits for completion, then loops.
+  Emits ACL request-handoff when policy-pick returns no match or when an outcome
+  triggers an escalation that is not yet implemented.
+runtime: feature-delivery-loop
+input:
+  state: ready
+  required_artifacts: []
+output:
+  state: impl-green
+scope_budget:
+  # The orchestrator runner does not directly modify code; child workflows do.
+  # The schema requires positive minimums, so set the loop's own budget to 1/1
+  # — child workflow scope budgets are enforced separately during their dispatch.
+  files_modified_max: 1
+  lines_diff_max: 1
+  wall_clock_seconds_max: 7200
+nodes:
+  - id: policy-pick
+    kind: script
+    cmd: scripts/workflow/policy-pick
+    on_fail: escalate
+  - id: agent
+    kind: agent
+    template: feature-delivery-loop
+    runtime_config:
+      runner: feature_delivery_loop
+    prompt: "Drive the eligibility-pick-dispatch-wait loop for item ${item.uuid} until it reaches a terminal state."
+escalation:
+  policy_pick_no_match: blocked-pending-handoff
+  scope_exceeded: replan-spec-opus
+  agent_bailed: feature-delivery-loop

task-templates/workflow/frozen-fixture-emit@1.yaml

@@ -0,0 +1,23 @@
+name: frozen-fixture-emit
+version: 1
+description: Emit frozen test fixtures for test-needed items
+runtime: script
+input:
+  state: scoped-tagged
+  tags_required: [test-needed]
+  required_artifacts: [impl_skeleton]
+output:
+  state: test-skeleton-ready
+scope_budget:
+  files_modified_max: 2
+  lines_diff_max: 200
+  wall_clock_seconds_max: 600
+nodes:
+  - id: frozen-fixture-emit
+    kind: script
+    cmd: scripts/workflow/frozen-fixture-emit
+    on_fail: refuse_dispatch
+  - id: state-tx
+    kind: script
+    cmd: scripts/workflow/state-tx
+    on_fail: continue

task-templates/workflow/impl-review-sonnet@1.yaml

@@ -0,0 +1,32 @@
+name: impl-review-sonnet
+version: 1
+description: Code review of implementation using Sonnet code-review
+runtime: best-practices-airouter-repo
+input:
+  state: integrated
+  tags_forbidden: []
+  required_artifacts: []
+output:
+  state: impl-reviewed
+scope_budget:
+  files_modified_max: 1
+  lines_diff_max: 80
+  wall_clock_seconds_max: 1200
+nodes:
+  - id: agent
+    kind: agent
+    template: best-practices-airouter-repo
+    prompt: |
+      Code-review the implementation for the following task.
+
+      **Title**: ${artifacts.item_title}
+
+      Review all changed Python files in the workspace (compare against main branch).
+      Check for:
+      1. Correctness against the spec requirements
+      2. Test coverage for new code paths
+      3. Security issues (injection, auth bypass, data leaks)
+      4. Performance or concurrency bugs
+
+      Write your review to /workspace/.agent-output/review.md with a PASS or
+      REWORK verdict. If REWORK, list specific changes required.

task-templates/workflow/integration@1.yaml

@@ -0,0 +1,39 @@
+name: integration
+version: 1
+description: Cherry-pick coding output from agent fork to main and verify test suite (WT-PIPE-5)
+runtime: integration-direct
+input:
+  state: impl-green
+  tags_forbidden: []
+  required_artifacts: []
+output:
+  state: integrated
+scope_budget:
+  files_modified_max: 20
+  lines_diff_max: 2000
+  wall_clock_seconds_max: 3600
+nodes:
+  - id: agent
+    kind: agent
+    template: integration-direct
+    prompt: |
+      You are the integration gate for this work item.
+
+      Work item UUID: ${item.uuid}
+      Work item title: ${item.title}
+      Spec IDs: ${metadata.automation.spec_ids}
+      Test files: ${metadata.automation.test_files}
+      Coding agent branch: ${metadata.automation.last_coder_branch}
+      Agent fork: git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git
+
+      Task:
+      1. Fetch and cherry-pick commits from the coding agent's branch (see integration context)
+      2. Run: python -m pytest ${metadata.automation.test_files} -x -v
+      3. If green: git push origin main, then exit 0
+      4. If red or conflict: write failure reason to ci_metadata.json and exit non-zero
+
+      Branch discovery: if last_coder_branch is empty, list agent fork branches
+      and find the one most recently working on this item (UUID in commit message or
+      branch name matches known patterns for this project's task IDs).
+
+      NEVER push if tests are red. Better to fail here than to break main.

task-templates/workflow/merge@1.yaml

@@ -0,0 +1,27 @@
+name: merge
+version: 1
+description: Prepare a reviewed implementation for merge — runs pre-merge checks and marks item merge-ready
+runtime: best-practices-airouter-repo
+input:
+  state: impl-reviewed
+  tags_forbidden: []
+  required_artifacts: []
+output:
+  state: merge-ready
+scope_budget:
+  files_modified_max: 1
+  lines_diff_max: 200
+  wall_clock_seconds_max: 600
+nodes:
+  - id: agent
+    kind: agent
+    template: best-practices-airouter-repo
+    cli: agentic
+    model: Qwen3.6
+    labels: [airouter]
+    runtime_env:
+      AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_BRANCH: "spec/auto-draft"
+      AGENT_SKIP_BRANCH_PUSH: "true"
+      AGENT_EMPTY_DELIVERABLE_CHECK: "false"
+    prompt: "Review the implementation for '${item.title}' (project: ${item.project_id}). Write a concise merge checklist to /workspace/.agent-output/merge-checklist.md covering: (1) tests pass, (2) scope matches spec, (3) no regressions. End with MERGE_READY or NEEDS_REWORK."

task-templates/workflow/review-spec-arch-opus@1.yaml

@@ -0,0 +1,49 @@
+name: review-spec-arch-opus
+version: 1
+description: Architecture review of a spec draft
+runtime: best-practices-airouter-repo
+input:
+  state: spec-draft
+  tags_forbidden: [security-sensitive]
+  required_artifacts: [spec_file]
+output:
+  state: spec-reviewed-arch
+scope_budget:
+  files_modified_max: 2
+  lines_diff_max: 150
+  wall_clock_seconds_max: 1800
+nodes:
+  - id: agent
+    kind: agent
+    template: best-practices-airouter-repo
+    cli: agentic
+    model: Qwen3.6
+    labels: [airouter]
+    runtime_env:
+      AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_BRANCH: "spec/auto-draft"
+    prompt: |
+      The agent-runtimes project repo is cloned at /workspace/project.
+      Change to that directory before doing any work.
+
+      Review the spec draft for the following concept.
+
+      **Title**: ${item.title}
+
+      **Original concept**:
+      ${item.body}
+
+      Steps:
+      1. cd /workspace/project
+      2. Find the spec file: ls spec/ and look for a file matching the concept title slug
+      3. Read the spec file completely
+      4. Review it against architectural best practices:
+         - Are requirements testable and unambiguous?
+         - Are there security implications not addressed?
+         - Are interfaces and data contracts clearly defined?
+         - Are edge cases and failure modes covered?
+      5. Write your review findings to /workspace/.agent-output/review.md with a PASS or
+         REWORK verdict and specific findings
+      6. Call task_complete with "PASS" or "REWORK: <one-line reason>"
+escalation:
+  contract_ambiguous: review-spec-opus

task-templates/workflow/review-spec-security-opus@1.yaml

@@ -0,0 +1,18 @@
+name: review-spec-security-opus
+version: 1
+description: Security review of a spec draft using Opus security-review
+runtime: opus-security-review
+input:
+  state: spec-draft
+  tags_required: [security-sensitive]
+  required_artifacts: [spec_file]
+output:
+  state: spec-reviewed-security
+scope_budget:
+  files_modified_max: 5
+  lines_diff_max: 300
+  wall_clock_seconds_max: 3600
+nodes:
+  - id: agent
+    kind: agent
+    template: opus-security-review

task-templates/workflow/scaffold@1.yaml

@@ -0,0 +1,38 @@
+name: scaffold
+version: 1
+description: Write stub implementations satisfying test signatures before coding begins (WT-PIPE-3)
+runtime: scaffolding-repo
+input:
+  state: tests-written
+  tags_forbidden: []
+  required_artifacts: []
+output:
+  state: scaffolded
+scope_budget:
+  files_modified_max: 5
+  lines_diff_max: 300
+  wall_clock_seconds_max: 1800
+nodes:
+  - id: agent
+    kind: agent
+    template: scaffolding-repo
+    prompt: |
+      Write stub implementations for the following task.
+
+      Work item UUID: ${item.uuid}
+      Test files: ${metadata.automation.test_files}
+      Spec IDs: ${metadata.automation.spec_ids}
+      Task description: ${item.body}
+
+      Read the test files on the work branch to identify what functions, classes,
+      and modules need to exist. Write minimal stub implementations:
+      - Correct signatures and type hints
+      - Bodies: raise NotImplementedError("spec-id: description") — no real logic
+      - Minimal Pydantic model fields where needed
+
+      Verify stubs compile and tests still collect (they should remain xfail):
+        python -m py_compile <files>
+        python -m pytest --collect-only ${metadata.automation.test_files}
+
+      Commit and push to the work branch. The coding agent will implement
+      real logic on top of these stubs.

task-templates/workflow/scope-decompose-sonnet@1.yaml

@@ -0,0 +1,68 @@
+name: scope-decompose-sonnet
+version: 1
+description: Scope and decompose a spec into tagged tasks using Sonnet planning
+runtime: spec-writing-airouter-repo
+input:
+  state: spec-reviewed-arch
+  tags_forbidden: []
+  required_artifacts: []
+output:
+  state: scoped-tagged
+scope_budget:
+  files_modified_max: 10
+  lines_diff_max: 500
+  wall_clock_seconds_max: 2400
+nodes:
+  - id: agent
+    kind: agent
+    template: spec-writing-airouter-repo
+    cli: agentic
+    model: Qwen3.6
+    labels: [airouter]
+    runtime_env:
+      AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_BRANCH: "spec/auto-draft"
+      CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
+    prompt: |
+      The agent-runtimes project repo is cloned at /workspace/project.
+      Change to that directory before doing any work.
+
+      Find the spec file in /workspace/project/spec/ (the spec was
+      written in an earlier pipeline stage — look for a file whose name matches
+      the concept title '${item.title}' as a slug, e.g. spec/<slug>.md).
+      Read that spec carefully.
+
+      Write a decomposition plan to /workspace/.agent-output/decompose.json with
+      exactly this structure:
+      {
+        "project_id": "${item.project_id}",
+        "space_id": "${item.space_id}",
+        "parent_item_uuid": "${item.uuid}",
+        "tasks": [
+          {
+            "title": "...",
+            "description": "...",
+            "flow_state": "needs-tests",
+            "spec_ids": ["WT-EVAL-1", "..."],
+            "test_files": ["tests/triggers/test_schema.py", "..."],
+            "tags": ["airouter-eligible"]
+          }
+        ]
+      }
+
+      Include "airouter-eligible" in tags only for single-file, self-contained
+      tasks that Qwen3.6 can handle alone. Omit tags for complex multi-file tasks.
+
+      After writing decompose.json, run this Python command to create the work items:
+
+      python3 -c "
+      import sys, os
+      sys.path.insert(0, '/opt/agent')
+      cp_url = os.environ.get('CP_URL', 'http://controlplane.agent-runtimes.svc.cluster.local:8100').rstrip('/')
+      from actions.decompose_work_items import decompose_work_items_action
+      decompose_work_items_action(
+          {'cp_url': cp_url, 'plan_path': '/workspace/.agent-output/decompose.json'},
+          {}
+      )
+      print('decompose_work_items: done')
+      "

task-templates/workflow/sonnet-impl-narrow@1.yaml

@@ -0,0 +1,22 @@
+name: sonnet-impl-narrow
+version: 1
+description: Single-file impl of a tagged spec requirement against existing tests, sonnet in worktree
+runtime: sonnet-impl-narrow
+input:
+  state: test-validated
+  tags_forbidden: [security-sensitive, multi-file, algorithmic-large]
+  required_artifacts: [test_file, impl_skeleton, prompt_pack]
+output:
+  state: impl-green
+scope_budget:
+  files_modified_max: 1
+  lines_diff_max: 80
+  wall_clock_seconds_max: 1800
+nodes:
+  - id: agent
+    kind: agent
+    template: code-sonnet-tdd-repo
+    prompt: "Implement the failing test. Test file: ${artifacts.test_file}. Skeleton: ${artifacts.impl_skeleton}."
+escalation:
+  scope_exceeded: replan-spec-opus
+  agent_bailed: sonnet-impl-narrow

task-templates/workflow/sonnet-impl-ready@1.yaml

@@ -0,0 +1,19 @@
+name: sonnet-impl-ready
+version: 1
+description: Single-file impl of a tagged spec requirement against pre-validated tests, Sonnet in worktree (escalation from airouter)
+runtime: code-sonnet-tdd-repo
+input:
+  state: scaffolded
+  tags_forbidden: [security-sensitive, multi-file, algorithmic-large]
+  required_artifacts: []
+output:
+  state: impl-green
+scope_budget:
+  files_modified_max: 3
+  lines_diff_max: 200
+  wall_clock_seconds_max: 1800
+nodes:
+  - id: agent
+    kind: agent
+    template: code-sonnet-tdd-repo
+    prompt: "Implement the task. ${metadata.automation.test_files}${metadata.automation.spec_ids}Task description: ${artifacts.item_title}. ${artifacts.item_body}"

task-templates/workflow/spec-draft-opus@1.yaml

@@ -0,0 +1,47 @@
+name: spec-draft-opus
+version: 1
+description: Draft a spec from an idea using spec-writer agent
+runtime: spec-writing-airouter-repo
+input:
+  state: idea
+  tags_required: []
+  tags_forbidden: [security-sensitive]
+  required_artifacts: []
+output:
+  state: spec-draft
+scope_budget:
+  files_modified_max: 5
+  lines_diff_max: 300
+  wall_clock_seconds_max: 3600
+nodes:
+  - id: agent
+    kind: agent
+    template: spec-writing-airouter-repo
+    cli: agentic
+    model: Qwen3.6
+    labels: [airouter]
+    runtime_env:
+      AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_BRANCH: "spec/auto-draft"
+    prompt: |
+      The agent-runtimes project repo is cloned at /workspace/project.
+      Change to that directory before doing any work.
+
+      Draft a spec for the following concept and commit it to the repo.
+
+      **Title**: ${item.title}
+
+      ${item.body}
+
+      Steps:
+      1. cd /workspace/project
+      2. Read existing specs in spec/ to understand the format
+      3. Create a slug from the title (lowercase, hyphens instead of spaces)
+      4. Write the spec to spec/<slug>.md following the project spec format
+      5. git add spec/<slug>.md && git commit -m "spec: auto-draft ${item.title}" && git push
+      6. Call task_complete with a one-sentence summary
+
+      The spec should have numbered requirement IDs, clear acceptance criteria,
+      and error handling. Follow the format of existing specs in spec/.
+escalation:
+  scope_exceeded: replan-spec-opus

task-templates/workflow/test-validate@1.yaml

@@ -0,0 +1,31 @@
+name: test-validate
+version: 1
+description: Validate tests are runnable and non-failing by default
+runtime: script
+input:
+  state: test-write-pending
+  tags_required: []
+  required_artifacts: [test_file]
+output:
+  state: test-validated
+scope_budget:
+  files_modified_max: 1
+  lines_diff_max: 50
+  wall_clock_seconds_max: 600
+nodes:
+  - id: preflight-test-collection
+    kind: script
+    cmd: scripts/workflow/preflight-test-collection
+    on_fail: refuse_dispatch
+  - id: preflight-fixture-lint
+    kind: script
+    cmd: scripts/workflow/preflight-fixture-lint
+    on_fail: refuse_dispatch
+  - id: preflight-test-fail-mode
+    kind: script
+    cmd: scripts/workflow/preflight-test-fail-mode
+    on_fail: continue
+  - id: state-tx
+    kind: script
+    cmd: scripts/workflow/state-tx
+    on_fail: continue

task-templates/workflow/test-write-minimax@2.yaml

@@ -0,0 +1,18 @@
+name: test-write-minimax
+version: 2
+description: Write tests from skeletons using MiniMax test-writer
+runtime: minimax-test-writer
+input:
+  state: needs-tests
+  tags_required: [test-needed]
+  required_artifacts: [test_file]
+output:
+  state: test-write-pending
+scope_budget:
+  files_modified_max: 1
+  lines_diff_max: 150
+  wall_clock_seconds_max: 1200
+nodes:
+  - id: agent
+    kind: agent
+    template: minimax-test-writer

task-templates/workflow/test-write@1.yaml

@@ -0,0 +1,36 @@
+name: test-write
+version: 1
+description: Write xfail tests from spec before coding begins (model-agnostic, WT-PIPE-2)
+runtime: test-writing-repo
+input:
+  state: needs-tests
+  tags_forbidden: []
+  required_artifacts: []
+output:
+  state: tests-written
+scope_budget:
+  files_modified_max: 3
+  lines_diff_max: 400
+  wall_clock_seconds_max: 2400
+nodes:
+  - id: agent
+    kind: agent
+    template: test-writing-repo
+    prompt: |
+      You are writing pytest tests for the following task.
+
+      Work item UUID: ${item.uuid}
+      Spec IDs: ${metadata.automation.spec_ids}
+      Expected test files: ${metadata.automation.test_files}
+      Task description: ${item.body}
+
+      Rules:
+      - Write tests to exactly the files listed in test_files (create if missing, append if existing)
+      - Mark EVERY test @pytest.mark.xfail(strict=True, reason="<spec-id>: <description>")
+      - Tests must FAIL when the implementation does not exist yet
+      - Write minimal import stubs if needed to prevent ImportError — no real logic
+      - Run: python -m pytest --collect-only <test_file> to verify collection before committing
+      - Commit and push to the work branch
+
+      After writing tests, run the specified test files to confirm they are collected
+      and fail appropriately (xfail with strict=True).