Test the adversarial planning workflow with shipped components

[taras]

Story

As a workflow author, I want InstructionFiles, Discovery, UserCheckpoint, and Planning to execute against shipped components, so orchestration starts from proven document logic.

Scope

Use stub Agents and document-supplied Answers in one process and one contextual working directory. Do not require WorkflowRun persistence, Repository/Worktree, Git, Git-host, or Worker Shell effects.

Exercise the current target documents from PR #181 after #292 has synchronized the relevant document logic. The PR does not need to merge before this proof; the proof is evidence required to merge it.

The documents use the namespaced props contract from #305. Do not build this proof against the bare-prop behavior that #305 removes.

Settled Agent authority boundary

This proof does not give an Agent a checkout. A workflow Agent receives no Workspace checkout or read-only materialization, no Workspace or host path as its cwd, no ACP additionalDirectories, and no <Agent.AddDir>. Do not install a test component or stub that simulates any of them.

Repository observations reach an Agent only as data produced by host-admitted XMD effects. In this proof, InstructionFiles supplies the exact repository-relative instruction paths and contents through ordinary XMD file operations, and Discovery and Planning receive that captured result as a value. General multi-turn repository observation remains the bounded request/result loop owned by #302 and admitted by #369; this proof neither invents its public Markdown spelling nor substitutes direct filesystem access for it.

#290 proves the document-level orchestration around supplied values. It does not prove the live #302 Agent-session integration or #369 generated-XMD admission boundary.

Settled exhaustion behavior

Exhausting the bounded planning attempts is neither convergence nor ordinary successful completion. Planning returns a distinct exhausted outcome, starts no implementation or later durable effect, and asks the composed workflow to suspend durably for user direction.

The durable workflow records the exhaustion reason and the material the user needs, releases its executor, and resumes only from explicit user direction. Resume never interprets exhaustion, silence, or an unchanged verdict as approval. #290 proves the document-level boundary without requiring workflow persistence; #367 owns durable suspension and executor release when the workflow is composed.

Acceptance and evidence matrix

#	Criterion	Sufficient focused evidence	Discrimination
1	Exact instruction paths and contents reach Discovery and both Planning prompts only as results of host-admitted XMD file effects; no Agent receives Workspace materialization, a checkout/host path, directory registration, or ACP additionalDirectories.	Exercise the real InstructionFiles, Discovery, and Planning documents with fixture instructions. Capture the complete public root-provider trace: factory options, Agent selection, session selection, prompt text, and prompt options. Assert the exact repository-relative instruction paths and exact contents occur in all three relevant prompts, the execution's absolute fixture/work directory occurs in none of the Agent-facing inputs, the stage schemas and invocations carry no worktree prop, and no <Agent.AddDir> implementation or test stub exists.	Dropping or summarizing instruction content fails the prompt scenarios. Injecting the execution's absolute path into any Agent-facing input fails the trace assertion. A source sweep fails if Agent.AddDir, additionalDirectories, direct-checkout wording, or a stage worktree prop returns. The logical repository-relative paths are allowed only because they are part of the InstructionFiles result supplied as prompt data.
2	Malformed Agent JSON receives only the bounded correction attempts shown in the documents.	Keep the existing malformed Planning-verdict and UserCheckpoint-assessment scenarios: initial malformed reply, two malformed corrections, then the final Parse failure quoting the third malformed reply.	A third correction exhausts the scenario instead of producing the asserted Parse failure.
3	A failed planner verdict returns a prescriptive revision prompt to the same implementor conversation.	Keep the ordered implementor scenario that constrains the exact review, revision prompt, and checkpoint record, with the revision as implementor turn 2 and the revised plan as turn 3.	A different session, reordered turn, omitted field, or paraphrase fails the scenario.
4	Material choices reach UserCheckpoint and cannot become implicit approval.	Keep the non-delegating authored Answers case for requiresUser: true, and the separate requiresUser: false case that proves an explicit continue decision.	A missing answer cannot fall through to a provider; a decline must remain proceed: false; absence is never inferred as approval.
5	A passing verdict exits the planning loop.	Keep the one-turn implementor scenario and assert the returned true/true gate inputs.	A second plan or revision prompt exhausts the scenario.
6	Exhausting the authored five attempts returns a distinct exhausted outcome, starts no implementation or later effect, and is not convergence or success.	Drive the real Planning component through the public root-provider seam with five ordered plan/verdict/assessment/revision rounds. Assert the complete twenty-entry turn/session sequence, the exact round-five material, the decision.proceed: true / verdictPassed: false pair, and zero calls to a sentinel later effect behind the production gate. Keep max={5} and the fixed test timeout unchanged.	Misrouting any non-final turn changes the exact sequence. Removing either gate operand runs the sentinel. Fewer or more iterations changes the call count or final material.
7	Tests discriminate every claimed branch and ordering.	Retain the existing negative controls and mutation checks for prompt contents, sessions, ordering, the production gate, and the Agent-authority trace added by criterion 1.	Each mutation must fail for the claim it is meant to distinguish and pass again after restoration.

The matrix does not require a live Agent, a synthetic observation-loop component, or an implementation of #302/#369. If executing a stage requires a public composition shape those issues have not recorded, leave that gap attributed to #302 and obtain an explicit architecture amendment before adding markup or host mechanics.

Dependencies

• Make the adversarial implementation workflow accurately describe its behavior #292 must first synchronize the document sections under test; PR ✨ Compose and certify the supervised adversarial implementation workflow #181 remains open while the proof is integrated.
• Run workflow Agents through XMD-mediated observations #302 owns the workflow Agent session and bounded observation request/result turn loop. It explicitly excludes Workspace materialization, host paths, ACP additionalDirectories, and <Agent.AddDir>.
• Evaluate Agent-generated XMD through a constrained allowlist #369 owns generated-XMD parsing, admission, execution, retention, and replay. Its read-only slice supplies the only general repository-observation boundary Run workflow Agents through XMD-mediated observations #302 may consume.
• Namespace Markdown props under the props binding #305 supplies namespaced props.
• Add workflow inspection, cancellation, suspension, and deletion #367 supplies durable suspension and executor release for the later composed workflow; it is not required for this document-logic proof.
• End goal: ✨ Compose and certify the supervised adversarial implementation workflow #181.