feat(workflow): cpw-smoke@1 one-node cp_write template for Option C smoke run (690b330f)

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

harnesses/composites/code-airouter-deepseekv4flash-tdd-repo-hatchmate/v1/harness.yaml

@@ -0,0 +1,20 @@
+kind: composite
+name: code-airouter-deepseekv4flash-tdd-repo-hatchmate
+version: 1
+description: "Airouter DeepSeek V4 Flash code agent (hatchmate fork) — adds gitea-ssh-hatchmate for write access to hatchmate/hatchmate-agents. Use this for hatchmate work; the un-suffixed composite uses the shared ai-enablement key which has no access to the hatchmate org."
+
+# Inherits airouter context's label gate — only the airouter dispatcher
+# advertises this composite (see dispatcher/poller._collect_supported_harnesses).
+requires_labels: [airouter]
+
+layers:
+  - context: deepseek-code-methodology/v1
+  - context: best-practices/v1
+  - context: airouter/v1
+  - context: gitea-ssh/v1
+  - context: gitea-ssh-hatchmate/v1
+  - context: agent-repo/v1
+  - context: tdd-protect/v1
+  - context: tdd-gate/v1
+  - capability: python-dev/v1
+  - capability: tdd-file-lock/v1

harnesses/composites/code-haiku-tdd-repo-hatchmate/v1/harness.yaml

@@ -0,0 +1,15 @@
+kind: composite
+name: code-haiku-tdd-repo-hatchmate
+version: 1
+description: "Haiku code agent (hatchmate fork) — adds gitea-ssh-hatchmate for write access to hatchmate/hatchmate-agents. Use this for hatchmate work; the un-suffixed composite uses the shared ai-enablement key which has no access to the hatchmate org."
+
+layers:
+  - context: code-methodology/v1
+  - context: anthropic-cloud-paul-oauth/v1
+  - context: gitea-ssh/v1
+  - context: gitea-ssh-hatchmate/v1
+  - context: agent-repo/v1
+  - context: tdd-protect/v1
+  - context: tdd-gate/v1
+  - capability: python-dev/v1
+  - capability: tdd-file-lock/v1

harnesses/composites/code-sonnet-tdd-repo-hatchmate/v1/harness.yaml

@@ -0,0 +1,15 @@
+kind: composite
+name: code-sonnet-tdd-repo-hatchmate
+version: 1
+description: "Sonnet code agent (hatchmate fork) — adds gitea-ssh-hatchmate for write access to hatchmate/hatchmate-agents. Use this for hatchmate work; the un-suffixed composite uses the shared ai-enablement key which has no access to the hatchmate org."
+
+layers:
+  - context: code-methodology/v1
+  - context: anthropic-cloud-paul-oauth/v1
+  - context: gitea-ssh/v1
+  - context: gitea-ssh-hatchmate/v1
+  - context: agent-repo/v1
+  - context: tdd-protect/v1
+  - context: tdd-gate/v1
+  - capability: python-dev/v1
+  - capability: tdd-file-lock/v1

harnesses/composites/workflow-script-nocp/v1/harness.yaml

@@ -0,0 +1,16 @@
+kind: composite
+name: workflow-script-nocp
+version: 1
+description: "Internal composite for kind: script nodes with cp_write=false (typed-workflows WF-COMP-31b, Option C). Brings the shared-variables filesystem context and the read-only project-repo clone, and NO CP credential: it layers neither cp-service-token/v1 (the AU-51 internal bearer) nor cp-write-token/v1 (the AU-55 per-step write token). Its only forge credential is repo-readonly/v1's read-only deploy key. Not model-bearing; the compiled shape is cli=\"shell\", params.cmd=<cmd>."
+
+# Top-down order (WF-COMP-31b / WF-COMP-34): shared-variables first, repo-readonly
+# LAST so its clone runs after the variable wiring and before the script starts.
+# Never gitea-ssh/v1 (bug 45a48685). repo-readonly/v1 cannot be dropped: the
+# entrypoint V2 guard trips when AGENT_REPO_URL is set and /workspace/project is
+# missing, and every shipped script template declares agent_repo.
+layers:
+  # spec/workflow-variables.md WV-19 / spec/harness.md HD-14 — agent-facing
+  # /variables/ context; provides the [shared-variables] tag.
+  - context: shared-variables/v1
+  # spec/typed-workflows.md WF-COMP-34 — read-only project-repo clone.
+  - context: repo-readonly/v1

harnesses/composites/workflow-script-write/v1/harness.yaml

@@ -0,0 +1,16 @@
+kind: composite
+name: workflow-script-write
+version: 1
+description: "Internal composite for kind: script nodes with cp_write=true (typed-workflows WF-COMP-31c, Option C). Brings the shared-variables filesystem context, the AU-55 per-step CP write token (cp-write-token/v1 sets CP_WRITE_TOKEN_FILE; the dispatcher delivers the wfcw_ file into the script container only, AU-55b) and the read-only project-repo clone. Omits cp-service-token/v1: a cp_write=true container gets the AU-55 token only, never the AU-51 internal bearer. Not model-bearing; the compiled shape is cli=\"shell\", params.cmd=<cmd>."
+
+# Top-down order (WF-COMP-31c / WF-COMP-34): shared-variables, cp-write-token,
+# repo-readonly LAST. Never gitea-ssh/v1 (bug 45a48685) and never
+# cp-service-token/v1.
+layers:
+  # spec/workflow-variables.md WV-19 / spec/harness.md HD-14.
+  - context: shared-variables/v1
+  # spec/authentication.md AU-55 / AU-55b — env-only layer; exports
+  # CP_WRITE_TOKEN_FILE=/run/agent/cp-write-token/token.
+  - context: cp-write-token/v1
+  # spec/typed-workflows.md WF-COMP-34 — read-only project-repo clone.
+  - context: repo-readonly/v1

harnesses/composites/workflow-script/v1/harness.yaml

@@ -0,0 +1,35 @@
+kind: composite
+name: workflow-script
+version: 1
+description: "Internal composite for the flag-on kind: script path (typed-workflows WF-COMP-31 / workflow-variables WV-19). Brings the shared-variables filesystem context AND the AU-51 CP write credential (cp-service-token/v1 sets CP_SERVICE_TOKEN_FILE in the entrypoint process env before shell_runner runs). NOT a model-bearing composite — the kind: script compiled shape is cli=\"shell\", params.cmd=<cmd>; this composite provides the harness layers that path needs and nothing else."
+
+# Order matters only for HC-6 env last-writer-wins / HC-8 git identity. The two
+# layers here have disjoint env vars (shared-variables sets WORKFLOW_VARIABLES_*
+# paths, cp-service-token sets CP_SERVICE_TOKEN_FILE) and no overlapping git
+# identity, so the listed order has no observable merge effect — both layers
+# reach the script-node container either way.
+layers:
+  # spec/workflow-variables.md WV-19 / spec/harness.md HD-14 — agent-facing
+  # /variables/ context (CLAUDE.md mounted at /opt/harness/context/shared-variables/CLAUDE.md)
+  # plus WORKFLOW_VARIABLES_ROOT=/variables and templated WORKFLOW_VARIABLES_SELF=<step_path>.
+  # Provides the [shared-variables] tag used by the dispatcher's extra_layers injection.
+  - context: shared-variables/v1
+  # spec/typed-workflows.md WF-COMP-31 "AU-51 credential env seam" — this layer's
+  # init.sh restages the ESO-mounted CP-service-token secret (root-owned mode 0400)
+  # to an agent-owned 0600 copy at /run/agent/cp-service-token/token and exports
+  # CP_SERVICE_TOKEN_FILE pointing at it. Verified: env.CP_SERVICE_TOKEN_FILE is set
+  # on the entrypoint process environment before shell_runner runs (entrypoint reads
+  # os.environ via env=os.environ.copy() in subprocess.run at entrypoint/runners/shell.py:73,
+  # so the same credential channel an agent node gets reaches a script node unchanged).
+  - context: cp-service-token/v1
+  # spec/typed-workflows.md WF-COMP-34 (bug 3bee78fa, 2026-10-02) — read-only
+  # project-repo clone for harness-path kind: script nodes. Layered LAST so
+  # its clone runs after the two AU-51 wiring layers and before the script
+  # starts (init.sh order: shared-variables -> cp-service-token -> repo-readonly).
+  # When AGENT_REPO_URL is unset (the pre-fix runtime, or any template that
+  # does not declare agent_repo) this layer is a no-op; the V2 guard
+  # (entrypoint/entrypoint.py:901-906) does NOT trip because the unset case
+  # is a no-op there too. Layered-in instead of layering agent-repo/v1
+  # because that context's fork management and push side effects are wrong
+  # for a read-only script node (see bug item body).
+  - context: repo-readonly/v1

harnesses/contexts/agent-repo/v1/init.sh

@@ -75,7 +75,7 @@ if [ -n "${AGENT_REPO_URL:-}" ] && [ -n "${AGENT_BRANCH:-}" ]; then
             # finalize.sh to merge into ci_metadata.json (AR-25). Falls back
             # to the legacy inline AR-14a logic if the CLI is unavailable.
             mkdir -p /workspace/.agent-output
-            AR39_OUT=$(python3 -m entrypoint.agent_repo_base select-base \
+            AR39_OUT=$(python3 /opt/agent/agent_repo_base.py select-base \
                 --workdir /workspace/project \
                 --branch "$AGENT_BRANCH" \
                 --upstream-url "${AGENT_UPSTREAM_REPO_URL:-}" \

harnesses/contexts/cp-write-token/v1/harness.yaml

@@ -0,0 +1,25 @@
+kind: context
+name: cp-write-token
+version: 1
+description: "Per-step scoped CP write token (AU-55, Option C): points CP_WRITE_TOKEN_FILE at the wfcw_ bearer the dispatcher delivers into the script container only (spec/typed-workflows.md WF-COMP-31c, spec/authentication.md AU-55b)"
+requires: []
+provides: []
+
+# AU-55b delivery: the token does NOT exist at manifest-submit time, so it is
+# NOT a secrets_required / ESO mount and NOT under /variables/. The dispatcher
+# mints it at dispatch (mint_step_tokens, scope='cp_write') and delivers it
+# into the script container ONLY:
+#   - Kubernetes: item `cp-write-token` of the per-task wfvars-<task_id>-<gen8>
+#     Secret, projected at the path below (mode 0440 + pod fsGroup, so the
+#     non-root agent uid can read it).
+#   - Docker: create -> put_archive -> start on the script container (never the
+#     wfvars-* data volume).
+# This layer therefore carries env only: no init script, no secrets_required,
+# no files. It must stay that way; a secrets_required entry here would make the
+# dispatcher wait on an ESO secret that never exists.
+#
+# The token is only valid on the two AU-57 routes for the run's own item
+# (PATCH / GET /v1/work-items/{id}). It is NOT the AU-51 internal bearer;
+# cp-service-token/v1 is deliberately not layered alongside it.
+env:
+  CP_WRITE_TOKEN_FILE: /run/agent/cp-write-token/token

harnesses/contexts/gitea-ssh-hatchmate/v1/harness.yaml

@@ -23,6 +23,6 @@ scripts:
 
 secrets_required:
   - name: gitea-ssh-hatchmate
-    account_ref: "hatchmate.space:platform"
+    account_ref: "hatchmate.space:hatchmate"
     mount_path: /run/agent/secrets/gitea-ssh-hatchmate
     mode: "0400"

harnesses/contexts/repo-readonly/v1/harness.yaml

@@ -0,0 +1,39 @@
+kind: context
+name: repo-readonly
+version: 1
+description: "Read-only project-repo clone for harness-path kind: script nodes (spec/typed-workflows.md WF-COMP-34, bug 3bee78fa). Clones AGENT_REPO_URL (the upstream project repo URL emitted by the WF-COMP-34 compiler emission as payload.agent_repo.url and propagated to the container env by the dispatcher) into /workspace/project at its default branch. No fork management, no AR-39 select-base, no scratchpad directory, no .gitignore munging, no finalize.sh push. The script node reads repo files only; it never writes back through a fork. Distinct from agent-repo/v1 (the agent-node branch-per-task fork-management context) on every one of those axes."
+requires: []
+provides: []
+
+# HC-11: read-only layer. No push target; the credential below is a read-only
+# deploy key (Gitea key id 20 on skynet/agent-runtimes), so a script node
+# cannot write even if its code tries (bug 45a48685).
+write_targets: []
+
+# WF-COMP-34: this layer's init.sh is the read-only clone. It only runs
+# when AGENT_REPO_URL is set; the unset case is a no-op (a script node
+# whose template omits agent_repo keeps its pre-fix silent empty workspace
+# runtime exactly, verified by
+# tests/test_entrypoint.py::TestV2WorkspaceAssertions::test_v2_no_agent_repo_url_skips_workspace_check).
+#
+# AGENT_WORKING_DIR=/workspace/project is the env var
+# entrypoint.py:_apply_working_dir reads (entrypoint/entrypoint.py:908-916),
+# and the path entrypoint/runners/shell.py:67 sets as the subprocess cwd
+# when context["workspace"] is unset and no clone action ran.
+env:
+  AGENT_WORKING_DIR: /workspace/project
+
+scripts:
+  init: "./init.sh"
+
+ssh_hosts:
+  - alias: gitea.oreillyit.nz-ai-enablement
+    hostname: gitea.oreillyit.nz
+    user: git
+    identity_secret: GITEA_SSH_KEY
+
+secrets_required:
+  - name: gitea-ssh-readonly
+    account_ref: "platform-readonly.space:platform"
+    mount_path: /run/agent/secrets/gitea-ssh-readonly
+    mode: "0400"

harnesses/contexts/repo-readonly/v1/init.sh

@@ -0,0 +1,92 @@
+#!/bin/bash
+# repo-readonly init — read-only project-repo clone for harness-path
+# kind: script nodes (spec/typed-workflows.md WF-COMP-34, bug 3bee78fa).
+#
+# Threat model: the script node is invoked by entrypoint/runners/shell.py
+# with cwd=context["workspace"]; the existing entrypoint paths set
+# context["workspace"] to /workspace/project from AGENT_WORKING_DIR
+# (the env var this init.sh exports via its harness.yaml env field).
+# The init.sh MUST clone AGENT_REPO_URL (the upstream project repo URL
+# emitted by the WF-COMP-34 compiler emission as payload.agent_repo.url
+# and propagated to the container env by the dispatcher) into
+# /workspace/project at its default branch — read-only, no fork, no push,
+# no AR-39 select-base, no scratchpad, no .gitignore munging.
+#
+# Bug discovered live 2026-10-02 (bug 3bee78fa, run
+# 9a368e71-d6ab-4185-a98c-9b31d41bb4b5): without this layer, every
+# harness-path kind: script node ran with /workspace/project missing,
+# so any preflight that read repo files (e.g. preflight-test-collection
+# invoking pytest --collect-only tests/test_k8s_gc.py) saw an empty cwd
+# and either reported zero files or failed with the upstream tool's own
+# misconfig error. The WF-COMP-34 compiler emission (this repo's
+# controlplane/typed_workflows/compiler.py, bug 3bee78fa) writes
+# payload.agent_repo onto every harness-path script node's manifest, so
+# the URL reaches the env when the template (or the node) declares
+# agent_repo. This init.sh is the other half — the layer that actually
+# clones it.
+
+set -euo pipefail
+
+echo "=== repo-readonly/v1 init.sh ==="
+
+# WF-COMP-34 unset-case contract: if AGENT_REPO_URL is unset, this is a
+# no-op. The script node keeps its pre-fix silent empty workspace
+# runtime exactly — a template that omits agent_repo does not get a
+# surprise clone. The entrypoint V2 guard (entrypoint/entrypoint.py:901-906)
+# only fires when AGENT_REPO_URL IS set; the unset case is a no-op on
+# both sides (no clone here, no V2 trip there), so the legacy
+# script_on_harness=False path's observable behaviour is preserved
+# verbatim.
+if [ -z "${AGENT_REPO_URL:-}" ]; then
+    echo "AGENT_REPO_URL unset; no clone (WF-COMP-34 unset-case contract)."
+    exit 0
+fi
+
+# If the clone target already has content (e.g. a previous layer cloned
+# into it), skip — never clobber. The check is on NON-EMPTY, not on
+# existence: entrypoint/harness_init.py always pre-creates an empty
+# /workspace/project, so a bare -d test skipped the clone every time
+# (bug eede60c3). git clone into an existing empty directory is valid.
+if [ -d /workspace/project ] && [ -n "$(ls -A /workspace/project 2>/dev/null)" ]; then
+    echo "/workspace/project already populated; skipping clone."
+    exit 0
+fi
+
+# Stage the ESO-mounted read-only deploy key where the harness-init
+# ~/.ssh/config IdentityFile expects it (same destination gitea-ssh/v1 used;
+# that layer is no longer part of workflow-script/v1 — bug 45a48685).
+SSH_KEY_SRC="/run/agent/secrets/gitea-ssh-readonly/private_key"
+SSH_KEY_DST="/home/agent/.ssh/gitea-oreillyit-nz-ai-enablement"
+if [ ! -r "$SSH_KEY_SRC" ]; then
+    echo "ERROR: read-only SSH key not found at $SSH_KEY_SRC — ESO ExternalSecret not Ready?" >&2
+    exit 1
+fi
+mkdir -p /home/agent/.ssh
+install -m 0600 -o agent -g agent "$SSH_KEY_SRC" "$SSH_KEY_DST"
+
+mkdir -p /workspace
+
+echo "Cloning (read-only): $AGENT_REPO_URL -> /workspace/project"
+# Read-only clone: no checkout of a task branch, no push target, no
+# remote operations beyond the initial clone. --depth 1 is enough —
+# a script node reads files, not history. If history is needed later,
+# the spec can be amended; today every preflight is a pytest --collect-only
+# or a prettier --check or similar that does not need commit ancestry.
+if git clone --depth 1 "$AGENT_REPO_URL" /workspace/project; then
+    echo "Cloned $AGENT_REPO_URL to /workspace/project"
+else
+    # Loud failure: a harness-path script node that declares agent_repo
+    # and finds the clone fails SHOULD fail the task at init time, not
+    # silently leave /workspace/project missing for the V2 guard to
+    # catch 26 seconds later (that failure mode is the symptom this
+    # bug was filed for).
+    echo "ERROR: Failed to clone $AGENT_REPO_URL" >&2
+    exit 1
+fi
+
+# Strip any symlinks (security: prevent /proc/1/environ exfiltration;
+# mirrors agent-repo/v1's defence).
+find /workspace/project -type l -exec rm {} \; 2>/dev/null || true
+
+echo "AGENT_WORKING_DIR=${AGENT_WORKING_DIR:-/workspace/project}"
+echo "=== repo-readonly/v1 init.sh complete ==="

harnesses/contexts/shared-variables/v1/CLAUDE.md

@@ -0,0 +1,146 @@
+# Shared Variables Context
+
+Your container is running with the **shared variables filesystem** mounted at `/variables/`.
+This is the only way you read a step's inputs and return its outputs to the control
+plane — there is no API to call, no credential to hold, no env var to substitute.
+You write plain files under your own step folder; the CP picks them up.
+
+Normative source: `spec/workflow-variables.md` (WV-1..6a). This document summarises
+the contract; when in doubt, the spec wins.
+
+## What is where
+
+```
+/variables/
+  workflow/                       # run inputs, frozen at dispatch time (WV-8)
+    run-id
+    template
+    item.uuid
+    item.title
+    item.label
+    item.flow-state
+    artifacts.<key>               # per WorkflowInput.required_artifacts
+  <step>/                         # this step's OWN folder — write outputs here
+  <loop-id>_<n>/<step>/           # loop body node in iteration n (n is 1-based)
+  .self                           # path to your own step folder (read-only)
+  .done                           # completion marker, written by the entrypoint
+```
+
+You only write under your OWN folder. The pack sidecar walks that folder after you
+exit and returns its contents to the CP. Earlier loop iterations' results and your
+direct `depends_on` dependencies' outputs are also under `/variables/`, pre-filled
+when your container started — you only READ those.
+
+## Two env vars are set for you
+
+- `WORKFLOW_VARIABLES_ROOT` — always `/variables`.
+- `WORKFLOW_VARIABLES_SELF` — the path to your own step folder
+  (e.g. `/variables/judge` for a top-level node named `judge`, or
+  `/variables/review-loop_2/judge` for loop iteration 2's `judge` node).
+
+Neither ever contains a value. Both are paths only. Treat both as read-only inputs.
+
+## Key naming (the contract you'll be checked against)
+
+- A variable's key is the joined, lowercased path from `/variables/` to the leaf
+  file, with `.` as the separator.
+  `/variables/judge/VERDICT` ↔ `judge.verdict`.
+  `/variables/review-loop_2/judge/findings/HIGH` ↔ `review-loop_2.judge.findings.high`.
+- **Leaf files are UPPERCASE** on disk by convention; folders stay lowercase.
+  Lookup via the helpers and the CP API is case-insensitive.
+- Each path segment, after lowercasing, must match `^[a-z0-9][a-z0-9_-]{0,63}$`.
+  Maximum depth is 8 segments. Dotfiles, symlinks, FIFOs, sockets, and devices are
+  skipped with a warning (never read or followed).
+- Two leaf files at the same level whose names lowercase to the same key → both
+  rejected at pack time as `invalid_output_key`.
+- **Reserved names** that cannot be used as step or loop ids (case-insensitive):
+  `workflow`, `while`, `for`, `foreach`, `loop`, `until`, `do`, `repeat`, `if`,
+  `else`, `elif`, `elseif`, `then`, `switch`, `case`, `default`, `when`, `break`,
+  `continue`, `return`, `goto`, `yield`, `try`, `catch`, `except`, `finally`,
+  `raise`, `throw`, `and`, `or`, `not`, `xor`, `in`, `is`, `true`, `false`,
+  `null`, `none`, `nil`, `yes`, `no`, `on`, `off`. The full list lives in
+  `controlplane/typed_workflows/reserved_ids.py` and may grow by spec amendment.
+- Step/loop ids are restricted to lowercase letters, digits, `-` and `_`, starting
+  with a letter; no trailing `_<digits>` (reserved for loop-iteration suffixes).
+
+## What you can see (visibility)
+
+- `workflow.*` — always. These are the run inputs, frozen for the life of the run
+  (later item changes are not reflected here; pass them on through step outputs).
+- The outputs of each of your **direct** `depends_on` nodes (the same set the
+  manifest DAG wires you to) — not transitive.
+- Inside a loop body, **every prior iteration's** outputs for **every** step in
+  the loop — not just the immediately preceding one. So iteration 2 sees what
+  iterations 1, 2, … of every loop body node wrote. Iteration 1 sees only its
+  direct dependencies.
+- Nothing else. Your own folder is always created, even if empty.
+
+## Declared outputs
+
+If your node's template declares `outputs: [<key>, ...]`, those are the keys you
+are expected to write. Any file actually present under your step folder is
+accepted regardless — `outputs:` is for policy and tooling, not an allowlist.
+A missing declared output produces a warning by default (configurable per-project
+to fail the step with `variables_missing_output`).
+
+## Values
+
+- **Strings only.** JSON is supported as a string value — you parse it yourself;
+  the CP never interprets a value's structure.
+- Per-value cap is configurable (`max_value_bytes`, default 1 MiB). Per-step cap
+  (`max_step_bytes`) and per-step file count (`max_step_files`) also apply.
+- Values are data — never substituted into prompts, commands, or environment
+  variables by the CP. Don't put values in shell; read them through the helpers
+  or the CLI.
+
+## Helpers (use these, not shell)
+
+A Python package is pre-installed in your image at `/opt/agent/variables/` and a
+CLI at `/usr/local/bin/wfvar`. Both are stdlib-only.
+
+```python
+from variables import load, save, keys
+
+value = load("verdict")                    # load from your own folder
+save("verdict", "CLEAN")                   # write into your own folder
+keys()                                     # list keys under your own folder
+keys(prefix="judge.")                      # narrow by prefix (read-only access)
+```
+
+```bash
+wfvar get VERDICT                 # print the value, NO trailing newline
+wfvar set VERDICT CLEAN           # write into your own folder
+wfvar list                        # list your own keys
+wfvar path                        # print your own step folder (same as $WORKFLOW_VARIABLES_SELF)
+wfvar get judge.findings.high     # read another step's output (visibility permitting)
+```
+
+Exit codes: `0` ok, `1` not found (key is valid but absent), `2` invalid key or
+usage, `3` value exceeds per-value limit, `4` write attempted outside your own
+step. Do not wrap `wfvar get` with extra shell that strips newlines — it prints
+exactly the stored bytes.
+
+**Don't write plan-like content with `wfvar set <key> <body>`** — argv breaks on
+shell quoting and truncates at ARG_MAX. For multi-line / quoting-sensitive bodies
+(e.g. the decompose plan files at `/variables/<node>/items/<local_id>`), use your
+file-write tool or a heredoc with a terminator that cannot occur in the body,
+writing directly into `/variables/<node>/...`.
+
+## Safety
+
+The pack sidecar reads your step folder with strict traversal protections
+(`O_NOFOLLOW`, `S_ISREG` checks, size caps, 4 KiB marker cap). It does not follow
+symlinks you might drop in. A symlink at any level is silently skipped with a
+warning — never assume it will be read.
+
+## What you must NOT do
+
+- Do not read or write outside your own step folder under `/variables/`.
+- Do not call out to the CP API directly — the helpers and the pack sidecar
+  handle all variable transport.
+- Do not assume `/variables/` exists in an unstamped container — it doesn't.
+- Do not write to `/variables/.done` — the entrypoint owns that marker; it is
+  written for you after `run_finalize_phase` returns, whether you exited 0, non-zero,
+  or via SIGTERM.
+- Do not store values in env vars, command lines, or prompts — values are data,
+  and data doesn't go there.

harnesses/contexts/shared-variables/v1/harness.yaml

@@ -0,0 +1,20 @@
+kind: context
+name: shared-variables
+version: 1
+description: "Workflow variables filesystem contract — /variables/ layout, key naming, helpers and CLI for CP-held step inputs/outputs (spec/workflow-variables.md WV-19; injected per-task via HD-14 extra_layers)"
+requires: []
+provides: [shared-variables]
+
+# WV-20: both env vars are set by THIS harness layer (not the entrypoint, not
+# the container backend). WORKFLOW_VARIABLES_ROOT is static; WORKFLOW_VARIABLES_SELF
+# is templated by the composer at harness-composition time on the dispatcher,
+# substituting the node's resolved step_path (the SAME value WV-15 derives at mint
+# time). A task with no shared-variables/v1 layer (unstamped) has neither env var
+# set, and /variables does not exist for it at all.
+env:
+  WORKFLOW_VARIABLES_ROOT: /variables
+  WORKFLOW_VARIABLES_SELF: "{{ step_path }}"
+
+context_files:
+  - source: ./CLAUDE.md
+    target: /opt/harness/context/shared-variables/CLAUDE.md

models/airouter-qwen3.yaml

@@ -6,7 +6,7 @@ endpoint:
   api_key_env: AIROUTER_API_KEY
 runner: agentic
 default_flags:
-  model: "Qwen3.6"
+  model: "Qwen3.8"  # live airouter id (c3551e3a); 3.6 was stale
 provider_context_ref: "airouter/v1"
 provider_secret_ref: "AIROUTER_API_KEY"
 session_capable: false

task-templates/workflow/_archived/bug-ancestor-auto-advance@1.yaml

@@ -31,9 +31,10 @@ nodes:
   - id: parent-link-check
     kind: script
     cmd: scripts/workflow/parent-link-check
+    cp_write: false
     on_fail: refuse_dispatch
     runtime_env:
-      CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
+      CP_URL: "https://agents.oreillyit.nz/api"
       WORKFLOW_ITEM_UUID: "${item.uuid}"
       PARENT_LINK_TAG: auto-resolve-bugs
       PARENT_LINK_RELATION: parent
@@ -42,30 +43,39 @@ nodes:
   - id: tag-ai-resolve
     kind: script
     cmd: scripts/workflow/tag-set
+    cp_write: true
     depends_on: [parent-link-check]
     on_fail: escalate
     runtime_env:
-      CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
+      CP_URL: "https://agents.oreillyit.nz/api"
       WORKFLOW_ITEM_UUID: "${item.uuid}"
       TAG_SET_ADD: ai-resolve
   # Advance the bug; R2 then dispatches bug-verify-sonnet@1 at verify-pending.
   - id: state-tx
     kind: script
     cmd: scripts/workflow/state-tx
+    cp_write: true
     depends_on: [tag-ai-resolve]
     on_fail: escalate
     runtime_env:
-      CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
+      CP_URL: "https://agents.oreillyit.nz/api"
       STATE_TX_NEW_STATE: verify-pending
-# NOTE (script-node credentials, M43): kind: script nodes are harness-exempt
-# (WF-COMP-6) but now carry the AU-51 internal-service bearer token by
-# default — see spec/typed-workflows.md WF-COMP-26. The compiler emits
-# `secrets_required: [CP_SERVICE_TOKEN]` and
-# `runtime_env.CP_SERVICE_TOKEN_FILE=/run/secrets/CP_SERVICE_TOKEN` on
-# every script node; the dispatcher's `_run_script_task` legacy-key
-# branch mounts the dispatcher-process-env CP_SERVICE_TOKEN value as a
-# file. All three nodes above read it via
-# `open(os.environ["CP_SERVICE_TOKEN_FILE"]).read().strip()`. Each script
-# still resolves its own actor identity (OIDC_IDENTITY_EMAIL or
+      STATE_TX_FROM_STATES: "pending,open"
+# NOTE (script-node credentials): kind: script nodes are harness-exempt
+# (WF-COMP-6), but the flag-on script path composes the workflow-script/v1
+# composite (shared-variables/v1 + cp-service-token/v1; WF-COMP-31). The
+# cp-service-token/v1 layer restages the AU-51 internal-service bearer token
+# and exports CP_SERVICE_TOKEN_FILE=/run/agent/cp-service-token/token, which
+# all three nodes above read via
+# `open(os.environ["CP_SERVICE_TOKEN_FILE"]).read().strip()`. The legacy
+# WF-COMP-26 mount (`secrets_required: [CP_SERVICE_TOKEN]` and
+# `runtime_env.CP_SERVICE_TOKEN_FILE=/run/secrets/CP_SERVICE_TOKEN`, backed by
+# the dispatcher's legacy-key branch) is removed (WF-COMP-33 step 10). Each
+# script still resolves its own actor identity (OIDC_IDENTITY_EMAIL or
 # CP_Caller-Identity header — see scripts/workflow/tag-set and
 # parent-link-check) for the write envelope.
+#
+# STATE_TX_FROM_STATES on the state-tx node is the compare-and-set guard: the
+# live flow_state must be one of the listed states (or already the target),
+# else state-tx exits 2 (unexpected_current_state). pending,open mirror
+# `input.state` + `escalation_input_states`.

task-templates/workflow/airouter-impl-narrow@1.yaml

@@ -23,6 +23,8 @@ nodes:
       # see the same tree). Without AGENT_REPO_URL the agent-repo layer never
       # clones and the agent's output evaporates (E2E 2026-07-04).
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
     prompt: "Implement the failing test. Test file: ${artifacts.test_file}. Skeleton: ${artifacts.impl_skeleton}."
 escalation:

task-templates/workflow/airouter-impl-ready@1.yaml

@@ -22,6 +22,8 @@ nodes:
       # see the same tree). Without AGENT_REPO_URL the agent-repo layer never
       # clones and the agent's output evaporates (E2E 2026-07-04).
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
     labels: [airouter]
     prompt: |

task-templates/workflow/bug-verify-sonnet@1.yaml

@@ -35,8 +35,10 @@ nodes:
     model: sonnet
     runtime_env:
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "bug-verify/${item.uuid}"
-      CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
+      CP_URL: "https://agents.oreillyit.nz/api"
     prompt: |
       The agent-runtimes project repo is cloned at /workspace/project.
       Change to that directory before doing any work.

task-templates/workflow/bug-verify-sonnet@2.yaml

@@ -0,0 +1,107 @@
+name: bug-verify-sonnet
+version: 2
+description: Read-only verification of an ai-resolve-tagged bug using Sonnet planning (CP-side apply-verified self-transition; WF-COMP-25)
+runtime: planning-sonnet-repo
+input:
+  state: verify-pending
+  tags_required: [ai-resolve]
+  tags_forbidden: []
+  required_artifacts: []
+output:
+  # WF-COMP-25 / WF-COMP-33 — the CP resolves this pipe-separated string as
+  # the closed verdict set; the literal value is NEVER PATCHed. The agent's
+  # packed `verdict` value (see `outputs: [verdict]` on node `agent`) is
+  # what gets PATCHed onto the run's item `flow_state`.
+  state: 'verified|rejected'
+scope_budget:
+  files_modified_max: 1
+  lines_diff_max: 400
+  wall_clock_seconds_max: 1800
+nodes:
+  # WF-COMP-25 / WF-COMP-25a — the agent's only side effect is its
+  # declared output `verdict` (one of the two closed values); the CP
+  # applies the flow_state change. The agent does NOT call the CP and
+  # does NOT read any internal-service CP credential file.
+  - id: agent
+    kind: agent
+    outputs: [verdict]
+    template: planning-sonnet-repo
+    model: sonnet
+    runtime_env:
+      AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
+      AGENT_BRANCH: "bug-verify/${item.uuid}"
+      CP_URL: "https://agents.oreillyit.nz/api"
+    prompt: |
+      The agent-runtimes project repo is cloned at /workspace/project.
+      Change to that directory before doing any work.
+
+      Verify the following bug report. This is a READ-ONLY investigation —
+      do NOT modify any source code. Your only file changes are the
+      verification artifact described below.
+
+      **Title**: ${item.title}
+
+      **Bug report**:
+      ${item.body}
+
+      Steps:
+        1. cd /workspace/project
+        2. Investigate the codebase to determine whether the reported bug
+           is real, reproducible, and correctly diagnosed. Do not make
+           code changes — this is verification, not a fix.
+        3. Write your findings to
+           spec/bugs/<slug>-verification.md (derive <slug> from this
+           item's own slug) with exactly these sections, in order:
+             - `## Reproduction` — concrete steps or evidence confirming
+               (or failing to confirm) the reported symptom
+             - `## Root-Cause Hypothesis` — the mechanism you believe
+               causes it, with file/line references
+             - `## Verdict` — exactly one of `verified` or `rejected`
+             - `## Rationale` — why you reached that verdict
+        4. Commit and push the verification artifact on this branch.
+
+      DELIVERING THE VERDICT — read carefully.
+
+      This node's declared output is the literal key `verdict`. The CP
+      reads your packed `verdict` value and PATCHes this work item's own
+      `flow_state` with it (`spec/typed-workflows.md` WF-COMP-25 / 25a,
+      `spec/workflow-variables.md` WV-36). You do NOT call the CP, you
+      do NOT run `cp-cli planner items update`, and you do NOT read any
+      internal-service CP credential file (the path that the legacy
+      `@1` flow used for its CP write is no longer mounted into your
+      container). The CP applies your verdict when `finalize_run` runs.
+
+      The closed verdict vocabulary is exactly two strings:
+          verified
+          rejected
+
+      Any other value — including an empty string, `VERIFIED`, `verified `,
+      `Verified`, `verify`, or a sentence — is rejected by WF-COMP-25a as
+      `self_transition_verdict_outside_set` and the run surfaces to a
+      human via `request_decision`. Do not invent a third outcome.
+
+      Write the verdict to your step folder with a quoted heredoc whose
+      terminator cannot occur in the body — example for verdict
+      `verified`:
+
+        cat > /variables/agent/verdict <<'__VERDICT_END__'
+        verified
+        __VERDICT_END__
+
+      The file MUST be strict UTF-8 with LF line endings; no trailing
+      whitespace; no header line; no body. A file that is not exactly the
+      one-line verdict (with optional final LF) is rejected as
+      `self_transition_verdict_outside_set` and surfaces to a human.
+
+      Do NOT use `wfvar set verdict <body>` — it passes the body as argv
+      and breaks on shell quoting.
+
+      Workflow:
+        1. Investigate.
+        2. Decide `verified` or `rejected`. Record it in
+           `## Verdict` of the verification artifact AND in
+           `/variables/agent/verdict` — the two MUST agree.
+        3. Commit and push the verification artifact.
+        4. Call task_complete. Do NOT PATCH the CP yourself.

task-templates/workflow/cpw-smoke@1.yaml

@@ -0,0 +1,26 @@
+name: cpw-smoke
+version: 1
+description: One-node cp_write smoke test for Option C (AU-55 per-step write token); exercises workflow-script-write/v1 end to end on a throwaway item
+runtime: script
+input:
+  state: scoped-tagged
+  tags_required: []
+  required_artifacts: []
+output:
+  state: test-skeleton-ready
+scope_budget:
+  files_modified_max: 1
+  lines_diff_max: 1
+  wall_clock_seconds_max: 300
+agent_repo:
+  url: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+nodes:
+  - id: state-tx
+    kind: script
+    cmd: scripts/workflow/state-tx
+    cp_write: true
+    on_fail: refuse_dispatch
+    runtime_env:
+      CP_URL: "https://agents.oreillyit.nz/api"
+      STATE_TX_NEW_STATE: test-skeleton-ready
+      STATE_TX_FROM_STATES: scoped-tagged

task-templates/workflow/direct-impl-sonnet@1.yaml

@@ -23,6 +23,8 @@ nodes:
     template: code-sonnet-tdd-repo
     runtime_env:
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
     prompt: |
       Implement the scope described in this work item. The description lists

task-templates/workflow/fable-impl-ready@1.yaml

@@ -18,5 +18,7 @@ nodes:
     template: code-fable-tdd-repo
     runtime_env:
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
     prompt: "Implement the task. ${metadata.automation.test_files}${metadata.automation.spec_ids}Task description: ${artifacts.item_title}. ${artifacts.item_body}"

task-templates/workflow/feature-delivery-loop@1.yaml

@@ -23,6 +23,7 @@ nodes:
   - id: policy-pick
     kind: script
     cmd: scripts/workflow/policy-pick
+    cp_write: false
     on_fail: escalate
   - id: agent
     kind: agent

task-templates/workflow/frozen-fixture-emit@1.yaml

@@ -12,12 +12,20 @@ scope_budget:
   files_modified_max: 2
   lines_diff_max: 200
   wall_clock_seconds_max: 600
+agent_repo:
+  url: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
 nodes:
   - id: frozen-fixture-emit
     kind: script
     cmd: scripts/workflow/frozen-fixture-emit
+    cp_write: false
     on_fail: refuse_dispatch
   - id: state-tx
     kind: script
     cmd: scripts/workflow/state-tx
+    cp_write: true
     on_fail: continue
+    runtime_env:
+      CP_URL: "https://agents.oreillyit.nz/api"
+      STATE_TX_NEW_STATE: test-skeleton-ready
+      STATE_TX_FROM_STATES: scoped-tagged

task-templates/workflow/minimax-impl-ready@1.yaml

@@ -18,5 +18,7 @@ nodes:
     template: code-minimax-tdd-repo
     runtime_env:
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
     prompt: "Implement the task. ${metadata.automation.test_files}${metadata.automation.spec_ids}Task description: ${artifacts.item_title}. ${artifacts.item_body}"

task-templates/workflow/opus-impl-ready@1.yaml

@@ -22,5 +22,7 @@ nodes:
       # see the same tree). Without AGENT_REPO_URL the agent-repo layer never
       # clones and the agent's output evaporates (E2E 2026-07-04).
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
     prompt: "Implement the task. ${metadata.automation.test_files}${metadata.automation.spec_ids}Task description: ${artifacts.item_title}. ${artifacts.item_body}"

task-templates/workflow/plan-review-loop@1.yaml

@@ -22,6 +22,8 @@ nodes:
     model: claude-opus-5
     runtime_env:
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
     prompt: |
       The agent-runtimes project repo is cloned at /workspace/project.
@@ -117,6 +119,7 @@ nodes:
   - id: judge-gate
     kind: script
     cmd: scripts/workflow/verdict-gate
+    cp_write: false
     depends_on: [judge-haiku]
 loop:
   body: [review-opus, review-minimax, improve-sonnet, judge-haiku, judge-gate]

task-templates/workflow/review-spec-arch-airouter@1.yaml

@@ -21,6 +21,8 @@ nodes:
     labels: [airouter]
     runtime_env:
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "spec/${item.uuid}"
     prompt: |
       The agent-runtimes project repo is cloned at /workspace/project.

task-templates/workflow/review-spec-arch-opus@1.yaml

@@ -21,6 +21,8 @@ nodes:
     template: best-practices-fable-low-repo
     runtime_env:
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "spec/${item.uuid}"
     prompt: |
       The agent-runtimes project repo is cloned at /workspace/project.

task-templates/workflow/scope-decompose-sonnet@1.yaml

@@ -26,8 +26,10 @@ nodes:
     model: sonnet
     runtime_env:
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "spec/${item.uuid}"
-      CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
+      CP_URL: "https://agents.oreillyit.nz/api"
       # AR-38: this stage's deliverable is work items POSTed to the CP, not a
       # repo diff — the empty-deliverable audit would fail every success.
       AGENT_EMPTY_DELIVERABLE_CHECK: "false"

task-templates/workflow/scope-decompose-sonnet@2.yaml

@@ -0,0 +1,143 @@
+name: scope-decompose-sonnet
+version: 2
+description: Scope and decompose a spec into tagged tasks using Sonnet planning (CP-side apply-verified; WF-COMP-33 / WIA-47)
+runtime: spec-writing-sonnet-repo
+input:
+  state: spec-reviewed-arch
+  tags_forbidden: []
+  required_artifacts: []
+output:
+  state: scoped-tagged
+scope_budget:
+  files_modified_max: 10
+  lines_diff_max: 500
+  wall_clock_seconds_max: 2400
+nodes:
+  # WF-COMP-33 / WIA-47 / WV-36..37 — the agent's only side effect is the
+  # declared output `plan_manifest` plus the per-child item files under
+  # `items/<local_id>`; `finalize_run` reads, validates and applies them.
+  # The agent does NOT call the CP and does NOT read any internal-service
+  # CP credential file.
+  - id: agent
+    kind: agent
+    outputs: [plan_manifest]
+    template: spec-writing-sonnet-repo
+    model: sonnet
+    runtime_env:
+      AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_BRANCH: "spec/${item.uuid}"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
+      CP_URL: "https://agents.oreillyit.nz/api"
+      # The deliverable is a directory of plan files on disk — NOT a git diff.
+      AGENT_EMPTY_DELIVERABLE_CHECK: "false"
+    prompt: |
+      The agent-runtimes project repo is cloned at /workspace/project.
+      Change to that directory before doing any work.
+
+      Find the spec file in /workspace/project/spec/ (the spec was
+      written in an earlier pipeline stage — look for a file whose name matches
+      the concept title '${item.title}' as a slug, e.g. spec/<slug>.md).
+      Read that spec carefully.
+
+      YOUR ONLY DELIVERABLE FOR THIS STAGE IS THE DECOMPOSE PLAN. You do
+      NOT call the CP, you do NOT run `cp-cli planner items decompose`,
+      and you do NOT read any internal-service CP credential file (the
+      path that the legacy `@1` flow used for its CP write is no longer
+      mounted into your container). The CP applies your plan from disk
+      at finalize time (spec/work-items-api.md WIA-47..47g). This node's
+      declared output is the literal key `plan_manifest`; the CP packs
+      the manifest plus every per-child item file in the same step folder.
+
+      On-disk layout (every path is relative to your step folder):
+        /variables/agent/plan_manifest         # the manifest (plain text)
+        /variables/agent/items/<local_id>      # one item file per child
+
+      `<local_id>` matches `^[a-z0-9][a-z0-9-]{0,31}$` — lowercase letters,
+      digits, and hyphen; 1–32 characters; no underscore. Use the literal
+      `$root` as the parent header on every item; the CP substitutes the
+      real item UUID server-side (WV-36 / WIA-47e).
+
+      Write each item file with a quoted heredoc whose terminator cannot
+      occur in the body — example for a child `c1`:
+
+        cat > /variables/agent/items/c1 <<'__DECOMPOSE_ITEM_END__'
+        parent: $root
+        title: Implement payment service FP-1..3
+        spec_ids: FP-1,FP-2,FP-3
+        test_files: tests/payments/test_fp.py
+        tags: airouter-eligible
+        ---
+        Write the payment service implementation covering FP-1, FP-2, FP-3.
+
+        Acceptance criteria:
+          - FP-1: idempotent payment capture
+          - FP-2: refund flow
+        __DECOMPOSE_ITEM_END__
+
+      Do NOT use `wfvar set <key> <body>` for plan files — it passes the
+      body as argv and breaks on backticks, quotes and `$(...)` and
+      truncates at ARG_MAX. The file-write / heredoc path is byte-faithful.
+
+      Manifest format — first line exactly `decompose/v1`, then one
+      `local_id` per line, no blank lines, no header, no body. Example for
+      the three-item plan above:
+
+        decompose/v1
+        c1
+        c2
+        c3
+
+      Item header grammar (every line is `key: value`):
+        - closed header set: {parent, title, spec_ids, test_files, tags}
+        - `parent` and `title` are REQUIRED on every item
+        - `parent` MUST be the literal `$root` (a work-item UUID is rejected
+          as `parent_must_be_root` — privilege-escalation guard)
+        - `title` is 1–200 bytes UTF-8, unique within one plan compared
+          case- and whitespace-insensitively
+        - `spec_ids` and `test_files` are comma-separated, at most 50
+          entries each; `spec_ids` entries match `^[A-Z][A-Z0-9-]{0,31}$`
+          (e.g. `FP-1`, `WV-36`)
+        - `test_files` entries have no leading `/`, no `..` segment, no SP
+          or `,`, at most 250 bytes each (e.g.
+          `tests/payments/test_fp.py`)
+        - `tags` is optional; every tag MUST be exactly `airouter-eligible`
+          (the only tag in DECOMPOSE_AGENT_TAG_ALLOWLIST — anything else
+          is `tag_not_allowed`). Omit the `tags:` line for tasks Qwen3.6
+          cannot handle alone.
+        - `---` ends the header block; every byte after it to EOF is the
+          body, verbatim (printable ASCII + UTF-8 bytes 0x80–0xFF, plus
+          LF and TAB as the only permitted control bytes; CR is rejected).
+          The body must be ≤ 16,384 bytes UTF-8.
+        - one header per item, no duplicates (`duplicate_header`)
+        - unknown keys are rejected (`unknown_header`)
+        - the file MUST be strict UTF-8, LF line endings (CRLF is rejected)
+
+      Plan fan-out: 1–20 `local_id` lines in the manifest, exactly one
+      `items/<local_id>` file per manifest line (an orphan file or a
+      missing file fails the apply as `orphan_item_file` /
+      `manifest_entry_without_file`).
+
+      Title / slug uniqueness: every planned title must be unique within
+      the plan (`duplicate_title`); every planned slug
+      (`decompose_validation.slugify(title)`, lowercase, non-alphanum
+      runs collapsed to `-`, truncated to 80 chars) must also be unique
+      (`duplicate_slug`). Two titles that differ only in case / whitespace
+      are NOT distinct.
+
+      "airouter-eligible" is the only tag you may use. Do NOT emit
+      `auto-dispatch`, `integrated`, `ai-resolve` or `airouter-skip` —
+      the validator rejects those at apply time.
+
+      Workflow:
+        1. Read the spec carefully.
+        2. Decide the children (1–20). Draft a title, a one-paragraph
+           body, and the `spec_ids` / `test_files` for each.
+        3. Write `/variables/agent/plan_manifest` with a heredoc
+           (the heredoc terminator MUST be unique to that file — do not
+           reuse `__DECOMPOSE_ITEM_END__` across files).
+        4. Write each `/variables/agent/items/<local_id>` with a heredoc.
+        5. Confirm the manifest names exactly the files you wrote, and
+           that no extra `items/*` files exist (an orphan file fails the
+           apply).
+        6. Call task_complete. Do NOT PATCH the CP yourself.

task-templates/workflow/sonnet-impl-narrow@1.yaml

@@ -22,6 +22,8 @@ nodes:
       # see the same tree). Without AGENT_REPO_URL the agent-repo layer never
       # clones and the agent's output evaporates (E2E 2026-07-04).
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
     prompt: "Implement the failing test. Test file: ${artifacts.test_file}. Skeleton: ${artifacts.impl_skeleton}."
 escalation:

task-templates/workflow/sonnet-impl-ready@1.yaml

@@ -22,5 +22,7 @@ nodes:
       # see the same tree). Without AGENT_REPO_URL the agent-repo layer never
       # clones and the agent's output evaporates (E2E 2026-07-04).
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
     prompt: "Implement the task. ${metadata.automation.test_files}${metadata.automation.spec_ids}Task description: ${artifacts.item_title}. ${artifacts.item_body}"

task-templates/workflow/spec-draft-airouter@2.yaml

@@ -22,6 +22,8 @@ nodes:
     labels: [airouter]
     runtime_env:
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "spec/${item.uuid}"
     prompt: |
       The agent-runtimes project repo is cloned at /workspace/project.

task-templates/workflow/spec-draft-opus@1.yaml

@@ -22,6 +22,8 @@ nodes:
     template: spec-writing-fable-low-repo
     runtime_env:
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "spec/${item.uuid}"
     prompt: |
       The agent-runtimes project repo is cloned at /workspace/project.

task-templates/workflow/spec-review-loop@1.yaml

@@ -27,6 +27,8 @@ nodes:
     model: claude-opus-5
     runtime_env:
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "spec/${item.uuid}"
     prompt: |
       The agent-runtimes project repo is cloned at /workspace/project.
@@ -127,6 +129,7 @@ nodes:
   - id: judge-gate
     kind: script
     cmd: scripts/workflow/verdict-gate
+    cp_write: false
     depends_on: [judge-haiku]
 loop:
   body: [review-opus, review-minimax, improve-sonnet, judge-haiku, judge-gate]

task-templates/workflow/test-validate@1.yaml

@@ -12,20 +12,30 @@ scope_budget:
   files_modified_max: 1
   lines_diff_max: 50
   wall_clock_seconds_max: 600
+agent_repo:
+  url: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
 nodes:
   - id: preflight-test-collection
     kind: script
     cmd: scripts/workflow/preflight-test-collection
+    cp_write: false
     on_fail: refuse_dispatch
   - id: preflight-fixture-lint
     kind: script
     cmd: scripts/workflow/preflight-fixture-lint
+    cp_write: false
     on_fail: refuse_dispatch
   - id: preflight-test-fail-mode
     kind: script
     cmd: scripts/workflow/preflight-test-fail-mode
+    cp_write: false
     on_fail: continue
   - id: state-tx
     kind: script
     cmd: scripts/workflow/state-tx
+    cp_write: true
     on_fail: continue
+    runtime_env:
+      CP_URL: "https://agents.oreillyit.nz/api"
+      STATE_TX_NEW_STATE: test-validated
+      STATE_TX_FROM_STATES: test-write-pending

task-templates/workflow/test-write-minimax@2.yaml

@@ -22,4 +22,6 @@ nodes:
       # see the same tree). Without AGENT_REPO_URL the agent-repo layer never
       # clones and the agent's output evaporates (E2E 2026-07-04).
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"

task-templates/workflow/test-write-review-loop@1.yaml

@@ -26,6 +26,8 @@ nodes:
       # WF-COMP-15: stage agents share one per-item work branch so their work
       # accumulates across iterations.
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
   - id: review-sonnet
     kind: agent
@@ -59,6 +61,7 @@ nodes:
   - id: review-gate
     kind: script
     cmd: scripts/workflow/verdict-gate
+    cp_write: false
     depends_on: [review-sonnet]
 loop:
   body: [write-minimax, review-sonnet, review-gate]

task-templates/workflow/test-write@1.yaml

@@ -22,6 +22,8 @@ nodes:
       # see the same tree). Without AGENT_REPO_URL the agent-repo layer never
       # clones and the agent's output evaporates (E2E 2026-07-04).
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
     prompt: |
       You are writing pytest tests for the following task.

tests/invariants/test_cp_write_field_set_correctly.py

@@ -0,0 +1,87 @@
+"""Every shipped kind: script node declares cp_write explicitly (WF-COMP-31d).
+
+``cp_write: true`` selects the workflow-script-write/v1 composite (AU-55
+per-step token); ``cp_write: false`` selects workflow-script-nocp/v1 (no CP
+credential). The declaration must match what the script actually does:
+state-tx / state-tx-verdict / tag-set write the run's own item (true); every
+other script, including parent-link-check and decompose-and-queue (whose
+routes the AU-57 credential cannot serve), is false.
+
+Archived templates are included: the explicit declaration is the audit pin.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+import yaml
+
+_DIR = Path(__file__).resolve().parents[2] / "task-templates"
+
+_CP_WRITE_TRUE = {"state-tx", "state-tx-verdict", "tag-set"}
+_CP_WRITE_FALSE = {
+    "verdict-gate", "policy-pick", "frozen-fixture-emit",
+    "preflight-test-collection", "preflight-fixture-lint", "preflight-test-fail-mode",
+    "parent-link-check", "decompose-and-queue",
+}
+
+
+def _script_nodes() -> list[tuple[str, str, dict]]:
+    out = []
+    for p in sorted(_DIR.rglob("*.yaml")):
+        doc = yaml.safe_load(p.read_text()) or {}
+        if not isinstance(doc, dict):
+            continue
+        for n in doc.get("nodes") or []:
+            if isinstance(n, dict) and n.get("kind") == "script":
+                out.append((str(p.relative_to(_DIR)), n["id"], n))
+    return out
+
+
+_NODES = _script_nodes()
+_IDS = [f"{f}::{nid}" for f, nid, _ in _NODES]
+
+
+def test_script_nodes_discovered():
+    files = {f for f, _, _ in _NODES}
+    assert {
+        "workflow/test-validate@1.yaml",
+        "workflow/frozen-fixture-emit@1.yaml",
+        "workflow/plan-review-loop@1.yaml",
+        "workflow/spec-review-loop@1.yaml",
+        "workflow/test-write-review-loop@1.yaml",
+        "workflow/feature-delivery-loop@1.yaml",
+        "workflow/_archived/bug-ancestor-auto-advance@1.yaml",
+    } <= files
+
+
+@pytest.mark.parametrize("fname,nid,node", _NODES, ids=_IDS)
+def test_script_node_declares_cp_write_explicitly_and_correctly(fname, nid, node):
+    assert "cp_write" in node, f"{fname}::{nid} must declare cp_write explicitly (WF-COMP-31d)"
+    assert isinstance(node["cp_write"], bool), f"{fname}::{nid} cp_write must be a bool"
+    script = node["cmd"].rsplit("/", 1)[-1]
+    assert script in _CP_WRITE_TRUE | _CP_WRITE_FALSE, (
+        f"{fname}::{nid} runs unclassified script {script!r}; classify it in "
+        "this test (does it call the CP?) and AU-57 before shipping"
+    )
+    assert node["cp_write"] is (script in _CP_WRITE_TRUE), (
+        f"{fname}::{nid}: cp_write must be {script in _CP_WRITE_TRUE} for {script}"
+    )
+
+
+def test_wf_comp_31d_cp_write_field_audit_per_framework_template():
+    """Spec WF-COMP-31d framework-repo test handle: pin the declarations."""
+    got = {(f, nid): n["cp_write"] for f, nid, n in _NODES}
+    assert got[("workflow/test-validate@1.yaml", "state-tx")] is True
+    assert got[("workflow/frozen-fixture-emit@1.yaml", "state-tx")] is True
+    assert got[("workflow/frozen-fixture-emit@1.yaml", "frozen-fixture-emit")] is False
+    for nid in ("preflight-test-collection", "preflight-fixture-lint", "preflight-test-fail-mode"):
+        assert got[("workflow/test-validate@1.yaml", nid)] is False
+    assert got[("workflow/plan-review-loop@1.yaml", "judge-gate")] is False
+    assert got[("workflow/spec-review-loop@1.yaml", "judge-gate")] is False
+    assert got[("workflow/test-write-review-loop@1.yaml", "review-gate")] is False
+    assert got[("workflow/feature-delivery-loop@1.yaml", "policy-pick")] is False
+    arch = "workflow/_archived/bug-ancestor-auto-advance@1.yaml"
+    assert got[(arch, "parent-link-check")] is False
+    assert got[(arch, "tag-ai-resolve")] is True
+    assert got[(arch, "state-tx")] is True

tests/invariants/test_cp_write_token_layer.py

@@ -0,0 +1,37 @@
+"""cp-write-token/v1 context: env-only layer (WF-COMP-31c, AU-55b).
+
+The per-step wfcw_ token is delivered by the dispatcher into the script
+container only (Secret projection on K8s, create -> put_archive -> start on
+Docker). The layer must therefore set the env contract and nothing else: no
+ESO secret mount, no init script, no context files.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+
+_ROOT = Path(__file__).resolve().parents[2] / "harnesses"
+
+
+def _load(kind_dir: str, name: str) -> dict:
+    return yaml.safe_load((_ROOT / kind_dir / name / "v1" / "harness.yaml").read_text())
+
+
+def test_cp_write_token_layer_sets_env_contract():
+    doc = _load("contexts", "cp-write-token")
+    assert doc["kind"] == "context"
+    assert doc["name"] == "cp-write-token"
+    assert doc["version"] == 1
+    assert doc["env"] == {"CP_WRITE_TOKEN_FILE": "/run/agent/cp-write-token/token"}
+
+
+def test_cp_write_token_layer_is_env_only():
+    doc = _load("contexts", "cp-write-token")
+    assert not doc.get("secrets_required"), "token is not an ESO mount (AU-55b)"
+    assert not doc.get("scripts"), "no init script: the backend delivers the file"
+    assert not doc.get("context_files")
+    assert not doc.get("write_targets")
+    assert doc.get("requires") == []
+    assert doc.get("provides") == []
+    assert not (_ROOT / "contexts" / "cp-write-token" / "v1" / "init.sh").exists()

tests/invariants/test_state_tx_runtime_env.py

@@ -0,0 +1,116 @@
+"""state-tx script nodes must declare CP_URL, STATE_TX_NEW_STATE and STATE_TX_FROM_STATES.
+
+scripts/workflow/state-tx fails with exit 2 when any is missing
+(from_states_missing for STATE_TX_FROM_STATES).
+CP_SERVICE_TOKEN_FILE is supplied by the workflow-script/v1 composite, not
+runtime_env, and must not be declared here. STATE_TX_NEW_STATE must equal the
+template's own output.state. STATE_TX_FROM_STATES is a comma list of acceptable
+current flow_states and must be non-empty.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+import yaml
+
+_DIR = Path(__file__).resolve().parents[2] / "task-templates" / "workflow"
+
+# Every template with a state-tx node, discovered from disk so new @N variants
+# are covered automatically.
+_NAMES = sorted(
+    p.name
+    for p in _DIR.glob("*.yaml")
+    if any(
+        n.get("cmd") == "scripts/workflow/state-tx"
+        for n in (yaml.safe_load(p.read_text()).get("nodes") or [])
+    )
+)
+
+
+def test_state_tx_templates_discovered():
+    assert {
+        "test-validate@1.yaml",
+        "frozen-fixture-emit@1.yaml",
+    } <= set(_NAMES)
+    assert "bug-ancestor-auto-advance@1.yaml" not in _NAMES  # archived (WT-ANC-15)
+
+
+@pytest.mark.parametrize("name", _NAMES)
+def test_state_tx_node_declares_required_runtime_env(name):
+    doc = yaml.safe_load((_DIR / name).read_text())
+    nodes = [n for n in doc["nodes"] if n.get("cmd") == "scripts/workflow/state-tx"]
+    assert len(nodes) == 1
+    env = nodes[0].get("runtime_env") or {}
+    assert env.get("CP_URL")
+    assert env.get("STATE_TX_NEW_STATE") == doc["output"]["state"]
+    assert "CP_SERVICE_TOKEN_FILE" not in env
+    assert not any(k.startswith("OIDC_") for k in env)
+
+
+@pytest.mark.parametrize("name", _NAMES)
+def test_state_tx_node_declares_from_states(name):
+    doc = yaml.safe_load((_DIR / name).read_text())
+    nodes = [n for n in doc["nodes"] if n.get("cmd") == "scripts/workflow/state-tx"]
+    env = nodes[0].get("runtime_env") or {}
+    raw = env.get("STATE_TX_FROM_STATES")
+    assert isinstance(raw, str) and raw.strip()
+    states = [s.strip() for s in raw.split(",")]
+    assert all(states), f"empty entry in STATE_TX_FROM_STATES {raw!r}"
+    assert doc["output"]["state"] not in states
+    # The template's own input state must be an acceptable from-state.
+    assert doc["input"]["state"] in states
+
+
+# ---------------------------------------------------------------------------
+# CP_URL must be the ingress form, never the in-cluster Service on :8100.
+#
+# The deploy repo's networkpolicy-cp-internal-traefik-only.yaml admits :8100 only
+# from dashboard / git-planner-backend / cert-expiry-checker and the traefik and
+# cms-proxy namespaces. Agent/script pods are dropped, so a template pointing
+# CP_URL at svc.cluster.local:8100 times out (30s) and, with on_fail: continue,
+# silently loses the transition. The workflow scripts join CP_URL + "/v1/...",
+# so the /api ingress path prefix is preserved.
+# ---------------------------------------------------------------------------
+
+CP_URL_INGRESS = "https://agents.oreillyit.nz/api"
+_FORBIDDEN_CP_URL_MARKERS = ("svc.cluster.local:8100", "controlplane.agent-runtimes.svc")
+
+_ALL_TEMPLATES = sorted(_DIR.glob("*.yaml"))
+
+
+def _cp_url_values(path: Path) -> list[str]:
+    doc = yaml.safe_load(path.read_text())
+    return [
+        (n.get("runtime_env") or {})["CP_URL"]
+        for n in (doc.get("nodes") or [])
+        if "CP_URL" in (n.get("runtime_env") or {})
+    ]
+
+
+def test_cp_url_templates_discovered():
+    names = {p.name for p in _ALL_TEMPLATES if _cp_url_values(p)}
+    assert {
+        "test-validate@1.yaml",
+        "frozen-fixture-emit@1.yaml",
+        "scope-decompose-sonnet@1.yaml",
+        "scope-decompose-sonnet@2.yaml",
+        "bug-verify-sonnet@1.yaml",
+        "bug-verify-sonnet@2.yaml",
+    } <= names
+
+
+@pytest.mark.parametrize("path", _ALL_TEMPLATES, ids=lambda p: p.name)
+def test_cp_url_is_ingress_not_in_cluster_service(path):
+    for value in _cp_url_values(path):
+        assert not any(m in value for m in _FORBIDDEN_CP_URL_MARKERS), (
+            f"{path.name}: CP_URL={value!r} targets the in-cluster CP service; agent pods "
+            "are blocked on :8100 by NetworkPolicy"
+        )
+        assert value == CP_URL_INGRESS, f"{path.name}: CP_URL={value!r}"
+
+
+@pytest.mark.parametrize("path", _ALL_TEMPLATES, ids=lambda p: p.name)
+def test_no_template_mentions_in_cluster_cp_service(path):
+    text = path.read_text()
+    assert not any(m in text for m in _FORBIDDEN_CP_URL_MARKERS)

tests/invariants/test_workflow_script_composite_layers.py

@@ -0,0 +1,35 @@
+"""workflow-script/v1 composite: exact layer order and credential env export.
+
+Script nodes get their CP write credential only through this composite
+(the legacy WF-COMP-26 mount is removed), so the layering is load-bearing.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+
+_ROOT = Path(__file__).resolve().parents[2] / "harnesses"
+
+
+def _load(kind_dir: str, name: str) -> dict:
+    return yaml.safe_load((_ROOT / kind_dir / name / "v1" / "harness.yaml").read_text())
+
+
+def test_workflow_script_layers_shared_variables_cp_service_token_repo_readonly():
+    doc = _load("composites", "workflow-script")
+    assert doc["layers"] == [
+        {"context": "shared-variables/v1"},
+        {"context": "cp-service-token/v1"},
+        {"context": "repo-readonly/v1"},
+    ]
+
+
+def test_workflow_script_env_exports_cp_service_token_file():
+    doc = _load("composites", "workflow-script")
+    env: dict = dict(doc.get("env") or {})
+    for layer in doc["layers"]:
+        (kind, ref), = layer.items()
+        name = ref.split("/")[0]
+        env.update(_load(kind + "s", name).get("env") or {})
+    assert env["CP_SERVICE_TOKEN_FILE"] == "/run/agent/cp-service-token/token"

tests/invariants/test_workflow_script_composite_resolves.py

@@ -0,0 +1,227 @@
+"""Workflow-script harness composition invariant (spec/typed-workflows.md WF-COMP-31
++ spec/workflow-variables.md WV-19 + spec/harness.md HD-14).
+
+The two new framework layers — ``harnesses/contexts/shared-variables/v1/`` and
+``harnesses/composites/workflow-script/v1/`` — must exist on the tree, must parse,
+and the composite must resolve every layer it references to a real file on disk.
+This test guards against the most common regression: a missing or renamed layer
+that would only surface at the dispatcher's ``compose_harness`` call, where it
+costs an entire task's worth of wasted dispatch round-trip.
+
+Spec: /home/paul/dev/claude/projects/agent-runtimes/spec/workflow-variables.md
+      (WV-19, WV-20, WF-COMP-31), spec/harness.md (HD-14).
+
+Not committed by the authoring agent per its instructions — written here so it
+can run locally against the current tree.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+import yaml
+
+_HARNESSES_ROOT = Path(__file__).resolve().parents[2] / "harnesses"
+
+# Composite layer entries use the singular kind as the dict key. The kind maps
+# to a top-level directory by adding "s".
+_KIND_TO_DIR = {
+    "context": "contexts",
+    "capability": "capabilities",
+    "composite": "composites",
+}
+
+
+def _load_layer(kind_dir: str, name: str) -> dict:
+    p = _HARNESSES_ROOT / kind_dir / name / "v1" / "harness.yaml"
+    return yaml.safe_load(p.read_text(encoding="utf-8"))
+
+
+def test_shared_variables_layer_exists_and_parses():
+    """``harnesses/contexts/shared-variables/v1/harness.yaml`` must exist,
+    parse as YAML, and carry ``provides: [shared-variables]`` (the HD-14 tag).
+
+    Spec: spec/workflow-variables.md WV-19; spec/harness.md HD-14.
+    """
+    parsed = _load_layer("contexts", "shared-variables")
+    assert parsed["kind"] == "context"
+    assert parsed["name"] == "shared-variables"
+    assert parsed["version"] == 1
+    assert parsed["provides"] == ["shared-variables"], (
+        "WV-19: provides MUST contain the 'shared-variables' tag — HD-14's "
+        "extra_layers dedup key, and the tag the dispatcher's payload-marker "
+        "injection matches against."
+    )
+    # WV-20: this layer's OWN env: declaration sets the two WORKFLOW_VARIABLES_*
+    # vars (NOT the entrypoint, NOT the container backend).
+    env = parsed["env"]
+    assert env["WORKFLOW_VARIABLES_ROOT"] == "/variables"
+    assert "WORKFLOW_VARIABLES_SELF" in env, (
+        "WV-20: WORKFLOW_VARIABLES_SELF must be set by the layer's env: "
+        "(templated per-node at harness-composition time on the dispatcher)"
+    )
+    # Agent-facing context: a CLAUDE.md must be mounted under /opt/harness/context/.
+    files = parsed.get("context_files", [])
+    targets = [f["target"] for f in files]
+    assert any(t.startswith("/opt/harness/context/shared-variables/") for t in targets), (
+        "WV-19: agent-facing context must be mounted under /opt/harness/context/"
+        "(the HC-7 namespacing point) so the agent sees it at startup."
+    )
+
+
+def test_shared_variables_claude_md_present_and_substantial():
+    """The agent-facing CLAUDE.md must be a non-trivial markdown document
+    (HC-7 says it is read by the agent, not a placeholder).
+
+    Spec: spec/workflow-variables.md WV-19; spec/harness.md HC-7.
+    """
+    md = _HARNESSES_ROOT / "contexts" / "shared-variables" / "v1" / "CLAUDE.md"
+    assert md.exists(), "WV-19: shared-variables/v1 must ship a CLAUDE.md"
+    text = md.read_text(encoding="utf-8")
+    assert text.count("\n") >= 30, (
+        f"WV-19: the CLAUDE.md must explain the /variables/ contract to the "
+        f"agent — got {text.count(chr(10))} lines, expected >=30."
+    )
+    # Spot-check the four high-value pieces of content the agent MUST see:
+    assert "/variables/" in text, "must explain the filesystem root"
+    assert "WORKFLOW_VARIABLES_SELF" in text, "must document the env vars"
+    assert "wfvar" in text, "must point at the CLI helper (WV-21)"
+    assert "reserved" in text.lower(), "must list the reserved-name families (WV-6)"
+
+
+def test_workflow_script_composite_resolves():
+    """``harnesses/composites/workflow-script/v1/harness.yaml`` must declare
+    exactly the two layers the spec names (WF-COMP-31) and every referenced
+    file must exist on disk.
+
+    Spec: spec/typed-workflows.md WF-COMP-31 ("Internal composite layered from
+    ``shared-variables/v1`` + ``cp-service-token/v1``").
+    """
+    parsed = _load_layer("composites", "workflow-script")
+    assert parsed["kind"] == "composite"
+    assert parsed["name"] == "workflow-script"
+    assert parsed["version"] == 1
+    assert isinstance(parsed["layers"], list) and len(parsed["layers"]) >= 2, (
+        "WF-COMP-31: the composite must layer at least shared-variables/v1 + "
+        "cp-service-token/v1; missing one breaks the credential env seam."
+    )
+
+    refs = []
+    for layer in parsed["layers"]:
+        assert isinstance(layer, dict) and len(layer) == 1, (
+            f"each layer entry must be a single-key dict (kind: ref), got {layer}"
+        )
+        kind_name, ref = next(iter(layer.items()))
+        assert kind_name in _KIND_TO_DIR, f"unknown layer kind {kind_name!r}"
+        assert "/" in ref, f"layer ref must be '<name>/v<N>', got {ref!r}"
+        name, ver = ref.split("/")
+        assert ver.startswith("v") and ver[1:].isdigit(), (
+            f"layer ref version must match v<N>, got {ver!r}"
+        )
+        kind_dir = _KIND_TO_DIR[kind_name]
+        layer_path = _HARNESSES_ROOT / kind_dir / name / ver / "harness.yaml"
+        assert layer_path.exists(), (
+            f"WF-COMP-31: composite references a layer that does not exist on "
+            f"the tree: {layer_path.relative_to(_HARNESSES_ROOT)}"
+        )
+        layer_data = yaml.safe_load(layer_path.read_text(encoding="utf-8"))
+        assert layer_data["name"] == name, (
+            f"name mismatch in {layer_path}: file says {layer_data['name']!r}, "
+            f"ref says {name!r}"
+        )
+        refs.append((kind_name, name, ver, layer_data))
+
+    # WF-COMP-31: the two SPECIFIED layers must both be present.
+    ref_names = {(kind, name) for kind, name, _, _ in refs}
+    assert ("context", "shared-variables") in ref_names, (
+        "WF-COMP-31: workflow-script/v1 MUST layer shared-variables/v1 "
+        "(WV-19 — the agent-facing /variables/ contract)"
+    )
+    assert ("context", "cp-service-token") in ref_names, (
+        "WF-COMP-31 / AU-51 credential env seam: workflow-script/v1 MUST "
+        "layer cp-service-token/v1 so CP_SERVICE_TOKEN_FILE is in the "
+        "entrypoint process env before shell_runner runs."
+    )
+
+
+def test_workflow_script_composite_brings_no_model_or_endpoint_layer():
+    """``kind: script`` nodes run via the shell runner — the composite MUST
+    NOT bring agent-only layers (no model, endpoint, CLAUDE.md context that
+    drives the agent runner, etc.). This is a structural regression gate: a
+    future refactor that adds e.g. ``anthropic-cloud-paul-oauth/v1`` here
+    would silently widen the script-node attack surface.
+
+    Spec: spec/typed-workflows.md WF-COMP-31 ("the flag-on kind: script
+    harness ... MUST NOT bring agent-only layers").
+    """
+    parsed = _load_layer("composites", "workflow-script")
+    forbidden_substrings = (
+        # cloud-auth contexts the agent runner needs
+        "anthropic-cloud", "minimax", "qwen-code", "deepseek-code",
+        "alibaba-model-studio", "fable-low-effort", "z-ai",
+        # the model-bearing capability / context layers
+        "code-methodology", "spec-writing", "planning", "integration",
+        # harness composites that bundle a model
+        "code-", "planning-", "spec-writing-", "best-practices-",
+        "sonnet-", "opus-", "minimax-", "haiku-", "airouter-", "fable-",
+    )
+    layer_names = [
+        next(iter(layer.values())).split("/")[0]
+        for layer in parsed["layers"]
+    ]
+    bad = [
+        n for n in layer_names
+        if any(sub in n for sub in forbidden_substrings)
+    ]
+    assert not bad, (
+        f"WF-COMP-31: workflow-script/v1 MUST NOT bring agent-only layers; "
+        f"found: {bad}"
+    )
+
+
+def test_cp_service_token_layer_already_sets_cp_service_token_file_env():
+    """WF-COMP-31 'AU-51 credential env seam': cp-service-token/v1 must set
+    ``CP_SERVICE_TOKEN_FILE`` in its env: declaration (the layer's init.sh
+    restages the ESO-mounted secret to an agent-readable 0600 copy at the
+    path CP_SERVICE_TOKEN_FILE points at). Verified here at the YAML level
+    rather than at runtime — the spec's claim is structural.
+
+    Spec: spec/typed-workflows.md WF-COMP-31; spec/harness.md AU-51/AU-51b
+    (bug b3a96acc).
+    """
+    parsed = _load_layer("contexts", "cp-service-token")
+    env = parsed["env"]
+    assert "CP_SERVICE_TOKEN_FILE" in env, (
+        "WF-COMP-31 'AU-51 credential env seam': cp-service-token/v1 must "
+        "declare CP_SERVICE_TOKEN_FILE in its env: block; without it the "
+        "shell_runner subprocess does not inherit the AU-51 credential."
+    )
+    fpath = env["CP_SERVICE_TOKEN_FILE"]
+    assert fpath.endswith("/token"), (
+        f"CP_SERVICE_TOKEN_FILE must point at the restaged 0600 file, not "
+        f"the raw 0400 ESO mount — got {fpath!r}"
+    )
+
+
+def test_workflow_script_composite_forge_credentials_are_read_only():
+    """Any layer in workflow-script/v1 that carries a forge credential MUST
+    declare ``write_targets: []`` (HC-11): a script node may read the project
+    repo but never push. The write-capable gitea-ssh/v1 layer must not be
+    present (bug 45a48685).
+
+    Spec: spec/harness.md HC-11, spec/typed-workflows.md WF-COMP-34.
+    """
+    parsed = _load_layer("composites", "workflow-script")
+    from tests.invariants.forge_credentials import _layer_has_forge_credentials
+
+    for layer in parsed["layers"]:
+        kind_name, ref = next(iter(layer.items()))
+        name = ref.split("/")[0]
+        assert name != "gitea-ssh", "workflow-script/v1 must not layer the write-capable gitea-ssh/v1 (bug 45a48685)"
+        kind_dir = _KIND_TO_DIR[kind_name]
+        sub = _load_layer(kind_dir, name)
+        if _layer_has_forge_credentials(sub):
+            assert sub.get("write_targets") == [], (
+                f"workflow-script/v1's layer {name} carries a forge credential "
+                f"but does not declare write_targets: [] (HC-11 read-only)."
+            )

tests/invariants/test_workflow_script_option_c_composites.py

@@ -0,0 +1,94 @@
+"""workflow-script-nocp/v1 and workflow-script-write/v1 (Option C, WF-COMP-31b/31c).
+
+Layer order is load-bearing: shared-variables first, repo-readonly LAST
+(WF-COMP-34), and neither composite may carry the AU-51 internal bearer
+(cp-service-token/v1) or the write-capable gitea-ssh/v1. Only the write
+composite carries the AU-55 per-step token layer.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+import yaml
+
+from tests.invariants.forge_credentials import _layer_has_forge_credentials
+
+_ROOT = Path(__file__).resolve().parents[2] / "harnesses"
+_KIND_TO_DIR = {"context": "contexts", "capability": "capabilities", "composite": "composites"}
+
+_NOCP = [{"context": "shared-variables/v1"}, {"context": "repo-readonly/v1"}]
+_WRITE = [
+    {"context": "shared-variables/v1"},
+    {"context": "cp-write-token/v1"},
+    {"context": "repo-readonly/v1"},
+]
+
+
+def _load(kind_dir: str, name: str) -> dict:
+    return yaml.safe_load((_ROOT / kind_dir / name / "v1" / "harness.yaml").read_text())
+
+
+def _merged_env(doc: dict) -> dict:
+    env: dict = dict(doc.get("env") or {})
+    for layer in doc["layers"]:
+        (kind, ref), = layer.items()
+        env.update(_load(_KIND_TO_DIR[kind], ref.split("/")[0]).get("env") or {})
+    return env
+
+
+@pytest.mark.parametrize(
+    "name,expected", [("workflow-script-nocp", _NOCP), ("workflow-script-write", _WRITE)]
+)
+def test_composite_layers_exact_order_repo_readonly_last(name, expected):
+    doc = _load("composites", name)
+    assert doc["kind"] == "composite"
+    assert doc["name"] == name
+    assert doc["version"] == 1
+    assert doc["layers"] == expected
+    assert doc["layers"][-1] == {"context": "repo-readonly/v1"}
+
+
+@pytest.mark.parametrize("name", ["workflow-script-nocp", "workflow-script-write"])
+def test_composite_never_carries_internal_bearer_or_write_capable_forge_key(name):
+    doc = _load("composites", name)
+    names = [next(iter(layer.values())).split("/")[0] for layer in doc["layers"]]
+    assert "cp-service-token" not in names
+    assert "gitea-ssh" not in names
+    for layer in doc["layers"]:
+        (kind, ref), = layer.items()
+        sub = _load(_KIND_TO_DIR[kind], ref.split("/")[0])
+        if _layer_has_forge_credentials(sub):
+            assert sub.get("write_targets") == [], f"{ref} must be read-only (HC-11)"
+
+
+@pytest.mark.parametrize("name", ["workflow-script-nocp", "workflow-script-write"])
+def test_every_referenced_layer_exists_and_names_match(name):
+    doc = _load("composites", name)
+    for layer in doc["layers"]:
+        (kind, ref), = layer.items()
+        lname, ver = ref.split("/")
+        path = _ROOT / _KIND_TO_DIR[kind] / lname / ver / "harness.yaml"
+        assert path.exists(), path
+        assert yaml.safe_load(path.read_text())["name"] == lname
+
+
+def test_nocp_composite_exports_no_cp_credential_env():
+    env = _merged_env(_load("composites", "workflow-script-nocp"))
+    assert "CP_SERVICE_TOKEN_FILE" not in env
+    assert "CP_WRITE_TOKEN_FILE" not in env
+    assert env["WORKFLOW_VARIABLES_ROOT"] == "/variables"
+
+
+def test_write_composite_env_contract():
+    env = _merged_env(_load("composites", "workflow-script-write"))
+    assert env["CP_WRITE_TOKEN_FILE"] == "/run/agent/cp-write-token/token"
+    assert "CP_SERVICE_TOKEN_FILE" not in env
+    assert env["WORKFLOW_VARIABLES_ROOT"] == "/variables"
+
+
+def test_workflow_script_write_composite_layers_and_env_contract():
+    """Spec WF-COMP-31c test handle (framework repo)."""
+    doc = _load("composites", "workflow-script-write")
+    assert doc["layers"] == _WRITE
+    assert _merged_env(doc)["CP_WRITE_TOKEN_FILE"] == "/run/agent/cp-write-token/token"