Quest: Preserve planned XMD programs for explicit execution

[taras]

Quest outcome

Make an approved XMD program a portable source artifact that planning never
executes implicitly. Authors and command-line users decide explicitly whether,
where, and how often that program runs.

Plan produces a program.
Evaluate evaluates a program in the current XMD execution.
Run executes a program from the host/CLI.
Composition decides whether and when a planned program runs.

Common paths

Compose planning and evaluation directly in one document:

<Evaluate>
 <Plan>Prepare the release program and ask me to approve it.</Plan>
</Evaluate>

Preserve the approved source and evaluate it later:

<Plan as="plan">Prepare the release program and ask me to approve it.</Plan>

<Evaluate program={plan} />

Compose command-line planning with an ordinary run:

xmd plan "Prepare the release program." | xmd run -

Or save the artifact and execute the file independently:

xmd plan "Prepare the release program." --output release.md && xmd run release.md

In every path, approval completes the artifact. A later evaluation failure does
not invalidate or rewrite it.

Product boundaries

• <Plan> emits or captures exact approved source and never evaluates it.
• <Evaluate> has explicit complete-program forms while preserving Evaluate Agent-generated XMD through a constrained allowlist #369's
  restricted generated-fragment form unchanged.
• xmd plan produces source only and has no execution option.
• xmd run - reads and executes one complete stdin program through the ordinary
  run profile.
• Source names requested behavior but grants no authority. Evaluation receives
  only authority installed at its explicit site.
• Planning retention and program-evaluation retention are separate events with
  separate replay, failure, and cancellation histories.
• No <Run> component is introduced.

Planning instructions and review minimize residual autonomy while faithfully
representing the user's intent:

static value
-> deterministic operation
-> control flow
-> bounded human decision
-> bounded Agent judgment
-> autonomous Agent

Blocking stories and delivery order

The prerequisites are delivered:

1. Run <Plan> with <TestAgent> in Markdown tests #728 — run <Plan> with a deterministic <TestAgent> in Markdown
   tests.
2. Make <Plan> emit or capture approved XMD source #722 — make <Plan> a byte-exact text-producing component and prove its
   author-visible behavior through that Markdown test boundary.
3. Add standard-input programs to xmd run #723 — add complete stdin roots to xmd run.

The remaining stories may proceed in parallel:

4. Make <Evaluate> evaluate complete XMD programs #713 — evaluate complete XMD programs at an authored site while keeping
   restricted fragments closed.
5. Make xmd plan produce approved XMD source only #724 — remove implicit CLI execution now that exact Plan source and stdin
   composition are delivered.

The Quest completes only when all five stories are delivered. #676 later adds
planning-specific progress and a post-failure authorship journal, introducing
the long-form --verbose and --journal options together with their behavior;
it does not block this public source/execution separation. #679 evaluates
planning quality and the minimum-residual-autonomy rule against reference
workflows.

Acceptance map

Each end-to-end case has one owner:

• Run <Plan> with <TestAgent> in Markdown tests #728: Deterministic Markdown Plan.
• Make <Plan> emit or capture approved XMD source #722: Bare Plan, Captured Plan, Failed Plan, Plan replay, Changed Plan
  input.
• Make <Evaluate> evaluate complete XMD programs #713: Direct composition, Deferred composition, Program forms, Root props,
  Fragment compatibility, Authority, Evaluation replay, Changed evaluation
  source, Repeated evaluation.
• Add standard-input programs to xmd run #723: Stdin run.
• Make xmd plan produce approved XMD source only #724: CLI Plan, Removed option, Planning-only grammar.

The child stories name the discriminating negative control and focused evidence
for every case. Together they update architecture, specifications, component
syntax, CLI help, the homepage, npm and compiled distribution, and affected
tests without treating delivery CI as a prerequisite for an implementation-
feedback commit.

Delivered foundations and remaining documentation

• Closed Add the <Plan> component #660 / PR Add the <Plan> component to xmd run #685 supplies the packaged <Plan> authorship workflow.
• Closed Run <Plan> with <TestAgent> in Markdown tests #728 / PR ✨ Run <Plan> with <TestAgent> in Markdown tests (#728) #737 supplies deterministic Markdown Plan tests.
• Closed Make <Plan> emit or capture approved XMD source #722 / PR ✨ Make <Plan> emit or capture approved XMD source (#722) #739 supplies the exact emitted or captured Plan source.
• Closed Add standard-input programs to xmd run #723 / PR ✨ Add standard-input programs to xmd run (#723) #745 supplies complete stdin roots for xmd run.
• Closed Evaluate Agent-generated XMD through a constrained allowlist #369 supplies restricted generated-XMD evaluation.
• Closed Add xmd run -e "<inline document>" to run inline content without a file #76 supplies inline root-source handling that stdin extends.
• Make <Plan> expand inline by default #711 and draft PR ✨ Make <Plan> expand inline by default (#711) #720 are superseded because bare <Plan> no longer executes
  approved source and no privileged executable-source return disposition exists.
• Merged PR ✨ Add the xmd plan section to the homepage #719 remains historical. Make <Evaluate> evaluate complete XMD programs #713 owns its homepage
  <Plan>/<Evaluate> examples; Make xmd plan produce approved XMD source only #724 owns its xmd plan | xmd run - example.

Completion

The Quest is complete when:

• approved source is byte-identical whether emitted, captured, piped, or saved;
• no planning surface executes that source implicitly;
• current-execution evaluation supports paired and deferred complete programs,
  text and value roots, explicit props, current-site authority, durable replay,
  stale-input refusal, and independent repeated occurrences;
• restricted source evaluation remains exactly closed;
• stdin is a preflighted root with stable source identity and cwd-relative
  imports;
• removed CLI execution syntax gives a working migration rather than an alias;
  and
• all five blocking stories and their focused/distribution evidence are
  delivered.

Out of scope

• A <Run> component, independent child execution, or process isolation.
• Implicit consumption of any source-producing component's output.
• Widening generated-XMD source or granting authority from text.
• Exported workflow-run artifacts owned by Quest Quest: Export workflow runs as portable .xmd files #599.
• Static md eval fences owned by Execute XMD shown in Markdown code fences #418.