Compose the supervised adversarial implementation workflow

[taras]

Story

As a user, I want the complete adversarial implementation loop to run under explicit supervision, so I retain product authority while deterministic XMD components own operational effects.

Current delivery state

Slice 2 is now the only open unit, and it is the composition itself. Its old three-PR sequence is collapsed: #577 shipped the durable workflow checkpoint at 1d528219, and #580 shipped the URL-addressed pull-request reads at f230e8fd. What remains is PR #181, which owns the complete composition and its evidence.

Implementation at exact PR #181 head 9ef6edcf205f57ba08cc84ba7a009919ed403957 exposed two defects in shipped prerequisites. Both are complete: #588 shipped ordinary proven non-force fast-forward advancement for <Git.Push /> through PR #594, and #589 restored continuation through durable effects inside generated XMD through PR #597. Slice 2 is active again on PR #181; after rebasing, AC3 and AC4 become positive acceptance cases rather than blocker diagnostics.

The shipped substrate now includes:

• retained workflow start/resume from Add the xmd workflow start/resume filesystem vertical slice #366;
• lifecycle ownership, inspection, cancellation and suspension from Add workflow inspection, cancellation, suspension, and deletion #367;
• named Repository/Worktree/Dir composition from Add named Repository and Worktree composition #293;
• typed durable answer delivery from Deliver answers to suspended workflows for later resumption #300's shipped slice in PR 📥 Deliver a typed answer to a suspended workflow run #479; and
• retained HTTP reads from 🌐 Fetch retained HTTP observations from Markdown #456; and
• deterministic local Git effects through Git.Commit from Add deterministic local Git workflow effects #294.

Every complete-loop effect the composition consumes is now shipped: Git.Push (#370, PR #495), PullRequest (#295, PRs #500/#504), the URL-addressed pull-request reads (#576, PR #580), deferred Issue (#296, PR #516), XMD-mediated workflow Agent turns and the authored observation loop (#302, PRs #549/#550), generated-XMD observation and mutation admission (#369, PRs #497/#572/#574), expression-prop undefined omission (#537, PR #541), and the durable checkpoint (#577). The Agent still receives no Workspace materialization, additionalDirectories, MCP server, native tool, credential or direct mutation channel. Portable adapter-level no-tool enforcement remains the non-blocking #496 follow-up.

PR #493 implemented slice 1: the boundary between retained workflow-definition identity and the authored stage components the root invokes.

Delivery slices

Slice 1: authorized workflow component bundle

Implement a closed workflow component bundle that lets a retained workflow definition invoke trusted Markdown component code without reintroducing a mutable repository component search path.

The first consumer is the adversarial workflow's stage components:

• InstructionFiles
• Discovery
• UserCheckpoint
• Planning
• Implementation

Those names become reachable under xmd workflow start and xmd workflow resume only when the trusted workflow host authorizes their exact component source as part of the workflow definition. Ordinary xmd run component resolution remains unchanged.

Slice 2: complete supervised adversarial composition

Compose the root workflow through discovery, handoff validation, planning convergence, authorization, XMD-mediated Agent observations and proposals, constrained generated XMD, local Git effects, explicit Push, PullRequest create/update, its URL-addressed evidence reads, review, deferred Issue creation, revision, and final acceptance — as one supervised run under xmd workflow start, typed answer delivery and explicit xmd workflow resume.

The composition remains owned by PR #181 and is active. Rebase it onto current main, convert AC3 and AC4 into successful end-to-end regressions, and complete the frozen matrix.

Scheduling, watchers and unattended resume are outside it. A resume stays an explicit act; the scheduling slice is #300's. This slice defines no additional persistence model, Agent authority model, Git-host reconciliation policy, or executor.

Slice 1 contract

xmd workflow start continues to establish an immutable workflow definition from Git. It executes bytes from the pinned commit, not from the caller's mutable working tree. The generic workflow component search path remains empty.

A workflow root may declare a closed component bundle in frontmatter:

workflow:
 components:
 InstructionFiles: ./InstructionFiles.md
 Discovery: ./Discovery.md
 UserCheckpoint: ./UserCheckpoint.md
 Planning: ./Planning.md
 Implementation: ./Implementation.md

The initial bundle admits only Markdown component files named explicitly in that map. Values are POSIX paths relative to the root document's directory in the same pinned Git tree. Absolute paths, parent traversal, globs, directories, URLs, TypeScript components, package imports, generated paths and duplicate names are refused. Names that are structural constructs, reserved host registrations, or core defaults are refused in this slice; the bundle exists for workflow-owned stage components, not for replacing language or security primitives.

On start, the trusted workflow host reads the root and every declared component from the same pinned commit, validates every component declaration, and constructs a normalized bundle:

• component name;
• canonical repository-relative component path;
• component source hash; and
• the retained component source needed for durable selection and replay.

That normalized bundle is part of workflow-definition identity. Compatible reuse compares it with the run ID, descriptor, definition base and normalized props. A caller-selected run ID with a different bundle is an incompatible definition reuse, even when the root path and props are unchanged.

On resume, the host reconstructs the same bundle from retained definition metadata and the pinned Git object, verifies the retained hashes, and installs only that bundle for the live execution. A current checkout file with the same name or path is ignored. Missing, unreadable, changed, incompatible or unauthorized component code is refused before that code executes or advances the workflow.

Bundle installation is a trusted-host operation, not public middleware. It gives the document no capability to authorize more code. Public middleware, props, eval bindings, generated source, and a same-name file in the mutable checkout may refuse or narrow behavior, but cannot add bundle entries, replace retained component source, or widen what code is authorized to execute.

Retained component-selection history must agree with the authorized bundle. A replay that tries to restore a component selection outside the retained bundle, with a mismatched source hash, or with a mutable-checkout path in place of retained source is refused before component code executes or any later durable effect appends.

The bundle is not generated-XMD admission. A generated fragment still cannot name these components, Fetch, or any other component until #369 admits pinned identities and exact bounded requests.

Material choices still use #367 suspension and #300 typed answer delivery. Delivering an answer records it without executing the workflow. Continuation occurs only through the ordinary explicit resume path, which acquires the executor lock and claims the retained answer durably. Automatic scheduling remains #300's later slice.

Do not add file watchers, unattended arbitration, a second executor authority, or a generic workflow component search path here.

Acceptance: slice 1

• xmd workflow start accepts a root-declared closed component bundle and records the normalized bundle in workflow-definition identity.
• xmd workflow resume reconstructs and validates the same retained bundle before any bundled component executes.
• A workflow root can invoke InstructionFiles, Discovery, UserCheckpoint, Planning, and Implementation from trusted bundle source under start and resume.
• The bundle reads component source from the pinned definition commit, never from mutable checkout content beside the retained root.
• Compatible reuse of a caller-selected run ID requires the same normalized component bundle; a changed component path, source hash, name set, or root-relative declaration is refused as incompatible definition reuse.
• Retained-history admission refuses component selections outside the retained bundle or with mismatched retained source before executing component code or appending later durable effects.
• Missing, unreadable, malformed, schema-invalid, incompatible, duplicate, escaping, non-Markdown, structural-name, reserved-name, and core-default-name bundle entries are refused before component code executes.
• Ordinary xmd run component resolution is unchanged.
• Workflow execution gains no generic repository component search path.
• Public middleware, props, eval bindings, generated source, or same-name checkout files cannot add, replace, or widen authorized component code.
• Generated-XMD admission remains unchanged and still belongs to Evaluate Agent-generated XMD through a constrained allowlist #369.
• Delivering an answer alone starts no execution; continuation still occurs only after explicit resume acquires the executor lock.
• Focused tests use fixtures that exercise start, resume, compatible reuse, retained-history admission, mutable-checkout substitution, and refusal-before-execution. The ✨ Compose and certify the supervised adversarial implementation workflow #181 workflow documents consume the bundle when they are present on the implementation branch, but slice 1 does not require the complete adversarial loop to run.
• Architecture and workflow/executable-MDX specifications describe the bundle identity, authority, replay, failure and compatibility boundaries in present tense.

Acceptance: later complete composition

• One supervised WorkflowRun reaches final acceptance across process interruption using retained suspension, typed answer delivery and explicit resume. Scheduled resume is Deliver answers to suspended workflows for later resumption #300's later slice and is not part of this acceptance.
• Failed plan and pull-request verdicts return prescriptive prompts to the responsible retained Agent context.
• Material choices suspend for user authority and never default to approval; only the exact validated retained answer may continue that request.
• Agents receive no Workspace materialization or additional directories; XMD performs every admitted observation and mutation. The initial adapter-level tool suppression guarantee is limited as recorded by Run workflow Agents through XMD-mediated observations #302 and Require ACP adapters to enforce tool-free workflow Agent sessions #496.
• Two repositories can participate through explicit named Repository/Worktree composition.
• Commit, Push, PullRequest, and deferred Issue remain distinct durable or reconciled effects.
• Every declared artifact and effect result is available to a later execution without manual copy/paste or hidden transcript state.
• Failure and cancellation halt live resources while retaining explicit recoverable or terminal state.
• No automatic watcher, unattended arbitration, or alternative executor authority is introduced by this composition story.

Dependencies

Slice 1: authorized workflow component bundle

• Add the xmd workflow start/resume filesystem vertical slice #366 and Add workflow inspection, cancellation, suspension, and deletion #367 supply retained workflow execution, lifecycle ownership, suspension and explicit resume.
• Store WorkflowRuns and filtered journals in SQLite #291/Commit Workspace mutations and journal results atomically #365 supply retained run lookup, filtered durable journal and Workspace replay substrate.
• Add named Repository and Worktree composition #293 supplies Repository/Worktree/Dir composition for consumers that execute after bundled components become reachable.
• Deliver answers to suspended workflows for later resumption #300's typed durable answer-delivery slice is shipped by PR 📥 Deliver a typed answer to a suspended workflow run #479; scheduling remains later.
• 🌐 Fetch retained HTTP observations from Markdown #456 supplies retained reviews, comments and checks through <Fetch> while Agents remain network-denied.
• ✨ Compose and certify the supervised adversarial implementation workflow #181/Test the adversarial planning workflow with shipped components #290 supply the living adversarial workflow consumer, but the focused bundle implementation may use fixtures and does not require the complete loop to run.

Later complete composition

All of these are shipped:

• Add deterministic local Git workflow effects #294 supplies Git.Commit (PR 📝 Record exactly what a document staged, with the message it composed #483); Add a deterministic Git.Push workflow effect #370 supplies the initial Git.Push delivery (PR 🚀 Publish the current branch to its origin with <Git.Push> #495), and Allow <Git.Push /> to advance an existing branch by proven non-force fast-forward #588 supplies proven non-force fast-forward advancement of an existing branch (PR ✨ Advance a branch a run already published, when the remote is behind it #594).
• Add a deterministic PullRequest workflow effect #295 supplies PullRequest (PRs 📝 Settle PullRequest handoff contract #500, 🔀 Create or bring up to date one pull request for the published branch #504); Read complete pull-request review evidence from a workflow #576 supplies the URL-addressed <PullRequest.Reviews>, <PullRequest.Comments> and <PullRequest.Checks> (PR 🔎 Let a workflow read the objections a pull request already holds #580).
• Add provider-neutral Issue read and upsert workflow effects #296 supplies deferred Issue (PR 🎫 Read and file issues from a document #516).
• Evaluate Agent-generated XMD through a constrained allowlist #369 slice 1 supplies constrained read-only observation admission (PR 🤖 Run Agent-generated XMD through a constrained allowlist #497); Run workflow Agents through XMD-mediated observations #302 consumes it for retained XMD-mediated Agent turns and the authored observation loop (PRs 🔐 Give a workflow Agent an empty room and a session it can come back to #549, 🔎 Let an agent ask to see something, and see only that #550), still without Workspace materializations or ACP additionalDirectories; Evaluate Agent-generated XMD through a constrained allowlist #369's mutation slice supplies the constrained proposal path (PRs 🔐 Admit generated writes by class and authored form #572, 🗑️ Let a generated fragment remove one file it names #574), and Resume through durable effects performed inside generated XMD #589 restores replay through durable effects nested inside generated XMD (PR 🌱 Hold a generated admission to a retained root basis, not the run's frozen past #597).
• Omit expression props that evaluate to undefined #537 supplies expression-prop undefined omission (PR ✨ Leave out a prop whose expression produced nothing (#537) #541).
• ⏸️ Ask a person from a workflow, and wait for the answer durably #577 supplies the durable workflow checkpoint.

Remaining and deliberately outside this slice:

• Require ACP adapters to enforce tool-free workflow Agent sessions #496 owns portable adapter-level no-tool enforcement and does not block composition.
• Deliver answers to suspended workflows for later resumption #300's scheduling slice follows this issue's composed consumer.

End goal: #181.

Out of scope

• A generic workflow component search path.
• Loading component code from the mutable checkout on resume.
• TypeScript component bundles, package component bundles, imports, globs or directory bundles.
• Replacing structural constructs, reserved host registrations or core defaults through the workflow bundle.
• Generated-XMD admission of bundled components or Fetch; Evaluate Agent-generated XMD through a constrained allowlist #369 owns that later proof.
• Automatically resuming as part of answer delivery.
• File watchers, branch watchers, unattended iteration arbitration or a public remote-host selector.
• Replacing the executor lock, lifecycle state machine, journal secret policy, suspension identity, Git-host reconciliation contract, or Agent authority model.
• Portable ACP adapter-level no-tool enforcement; Require ACP adapters to enforce tool-free workflow Agent sessions #496 owns that non-blocking hardening.