Fix WOR-126 schema-owned orchestration review authority

.gitignore

@@ -10,6 +10,7 @@ design/
 # IDE / editors
 .air/
 .cursor/
+.codegraph/
 .idea/
 .vscode/
 *.swp

AGENTS.md

@@ -2,6 +2,24 @@
 # Work Bundle RULE START
 # ========================
 # Work Bundle
+## Unconditional agent boundaries
+
+These two boundaries apply to every agent, every task, and every workflow without exception:
+
+1. **DO NOT OVERENGINEER.** Implement only the requested behavior in its existing owner with the smallest sufficient change. Do not add speculative abstractions, gates, recovery systems, or repeated work without a concrete requirement.
+2. **MAKE NO MISTAKES.** Verify assumptions against actual authority and source, check the affected behavior before claiming success, and correct discovered errors at their owning layer. Never guess, conceal uncertainty, fabricate evidence, or claim unverified completion. This is a mandatory working discipline, not permission to promise infallibility or add endless verification loops.
+
+## Evidence-first change principle
+
+Before or during evidence exploration, every agent must:
+
+1. Locate the feature in the codebase.
+2. Find its corresponding design purpose and decisions in the knowledge base.
+3. Find its corresponding orchestration evidence—specification, plan, and handoff—and Git history. Use that lineage to understand why each implementation was created, whether it introduced the defect, and whether it is a valid basis for the current user purpose.
+4. If a legacy implementation introduced the defect, prefer reverting or correcting that implementation over adding another patch around it.
+5. If a legacy implementation introduced the intended feature, understand its design and make the fewest updates necessary to satisfy the current request.
+6. In either case, use available source-navigation tools—including CodeGraph when indexed, `rg`, `grep`, and equivalent tools—to find related references and update them consistently.
+
 purpose:
 - Seeing this rule means that you are working with the `work-bundle` toolkit, it provides skills and rules to finish a bunch of works, including:
   - Work bundle skills: `/wb-*`, provide skills to manage a project as a `work-bundle` adapted workspace.
@@ -26,10 +44,8 @@ must:
 - resolve `work_bundle_root` from `$work_bundle_config_root/bootstrap.yaml` -> `work_bundle_root`
 - resolve project registry from `$work_bundle_config_root/bootstrap.yaml` -> `project_registry`
 - resolve skill registry from `$work_bundle_config_root/bootstrap.yaml` -> `skill_registry`
-- resolve effective `prefer_subagent` as `.work-bundle/project.yaml` -> `prefer_subagent`, then `$work_bundle_config_root/bootstrap.yaml` -> `prefer_subagent`, then `false`
 - before material implementation, establish or consume one Truth Basis containing purpose, as-is evidence, accepted decision authority, expected delta, and conflict status; after preflight and source grounding, lightweight planning runs one bounded `ks-what-is-helpful` gateway and records accepted authority or evidence-backed `none relevant`, while heavy execution compiles carried authority without executor retrieval
 - after each meaningful validated move, record a knowledge disposition of `none`, `update`, `supersede`, or `reclassify`; the lightweight completion owner resolves its approved `ks-*` follow-up, while heavy executors return task-local evidence only and final orchestration review owns heavy-path persistence follow-up
-- treat `prefer_subagent` as permission to prefer sub-agent scheduling only when normal execution safety, write-scope, dependency, and fallback checks pass
 - use `work_bundle_root` only for toolkit assets, builtin skills, builtin rules, and references
 - use `work_bundle_config_root` only for non-project runtime state produced by tool use
 - resolve workspace-owned metadata, rules, knowledge, orchestration, `AGENTS.md`, `script/index.yaml`, and `credentials/credentials.yaml` from `workspace_root` in both workspace modes
@@ -50,7 +66,6 @@ must_not:
 - treat utility discovery as permission to execute a script
 - inspect or transfer credential values through chat, prompts, subagent messages, tool arguments/results, terminal output, logs, handoffs, knowledge, or orchestration artifacts
 - infer registry paths without reading `bootstrap.yaml` when registry access is required
-- let `prefer_subagent` bypass repository preflight, sub-agent capability checks, disjoint write-scope checks, dependency checks, or single-agent fallback
 - treat rule-store scope (`toolkit`, `global`, `project`) as separate from rule area directories such as `work-bundle`, `keep-summarizing`, and `orchestration`
 
 ## Rule Loading

bin/work-bundle-ci

@@ -13,6 +13,7 @@ PYTHON_VERSION = "3.13"
 PINNED_PACKAGES = (
     "pytest==9.1.1",
     "pyyaml==6.0.3",
+    "jsonschema==4.25.1",
     "sqlite-vec==0.1.9",
     "fastembed==0.8.0",
 )
@@ -31,6 +32,24 @@ def _emit_progress(message: str) -> None:
     print(message, flush=True)
 
 
+def _discovered_test_files(repo_root: Path) -> list[Path]:
+    completed = subprocess.run(
+        [
+            "git", "ls-files", "--cached", "--others", "--exclude-standard",
+            "tests/test_*.py",
+        ],
+        cwd=repo_root,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return [
+        repo_root / relative
+        for relative in completed.stdout.splitlines()
+        if (repo_root / relative).is_file()
+    ]
+
+
 def run_release_gate(
     repo_root: Path,
     *,
@@ -42,7 +61,7 @@ def run_release_gate(
     repo_root = repo_root.resolve()
     modules = sorted(
         _relative_test_path(repo_root, path)
-        for path in (test_files if test_files is not None else (repo_root / "tests").glob("test_*.py"))
+        for path in (test_files if test_files is not None else _discovered_test_files(repo_root))
     )
     failed_modules: list[str] = []
     environment = {**os.environ, "PYTHONDONTWRITEBYTECODE": "1"}

references/assets/infrastructure/contract/bootstrap-config-v1.schema.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://work-bundle.dev/schemas/infrastructure/bootstrap-config-v1",
+  "title": "WorkBundle bootstrap configuration v1",
+  "type": "object",
+  "additionalProperties": true,
+  "required": ["bootstrap_version", "authority", "work_bundle_root", "project_registry", "skill_registry"],
+  "properties": {
+    "bootstrap_version": {"const": "v1"},
+    "authority": {"const": "canonical"},
+    "work_bundle_root": {"type": "string", "minLength": 1},
+    "project_registry": {"type": "string", "minLength": 1},
+    "skill_registry": {"type": "string", "minLength": 1}
+  }
+}

references/assets/infrastructure/contract/infrastructure-schema-catalog-v1.yaml

@@ -0,0 +1,14 @@
+schema_version: 1
+families:
+  bootstrap-config:
+    version: 1
+    representation: yaml
+    schema: bootstrap-config-v1.schema.json
+  project-registry:
+    version: 1
+    representation: yaml
+    schema: project-registry-v1.schema.json
+  workspace-project-metadata:
+    version: 1
+    representation: yaml
+    schema: workspace-project-metadata-v4.schema.json

references/assets/infrastructure/contract/project-registry-v1.schema.json

@@ -0,0 +1,91 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://work-bundle.dev/schemas/infrastructure/project-registry-v1",
+  "title": "WorkBundle project registry v1",
+  "type": "object",
+  "additionalProperties": true,
+  "required": ["projects", "device_bindings"],
+  "properties": {
+    "registry_schema_version": {"const": 1},
+    "projects": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": true,
+        "required": ["slug"],
+        "properties": {
+          "slug": {"type": "string", "minLength": 1},
+          "aliases": {"type": "array", "items": {"type": "string"}}
+        }
+      }
+    },
+    "device_bindings": {
+      "type": "object",
+      "additionalProperties": {"$ref": "#/$defs/workspaceBinding"}
+    }
+  },
+  "$defs": {
+    "workspaceBinding": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": ["slug", "workspace_root", "repositories"],
+      "properties": {
+        "slug": {"type": "string", "minLength": 1},
+        "workspace_root": {"type": "string", "minLength": 1},
+        "repositories": {
+          "type": "object",
+          "additionalProperties": {"$ref": "#/$defs/repositoryBinding"}
+        }
+      }
+    },
+    "repositoryBinding": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": [
+        "project_root",
+        "checkout_kind",
+        "observed_branch",
+        "observed_head",
+        "observed_at",
+        "git_common_dir"
+      ],
+      "properties": {
+        "project_root": {"type": "string", "minLength": 1},
+        "checkout_kind": {"type": "string", "minLength": 1},
+        "observed_branch": {"type": "string"},
+        "observed_head": {"type": "string"},
+        "observed_at": {"type": "string", "minLength": 1},
+        "git_common_dir": {"type": "string"}
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {"checkout_kind": {"enum": ["manual", "unmaterialized-member"]}},
+            "required": ["checkout_kind"]
+          },
+          "then": {},
+          "else": {
+            "properties": {
+              "observed_branch": {"minLength": 1},
+              "observed_head": {"minLength": 1},
+              "git_common_dir": {"minLength": 1}
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {"checkout_kind": {"const": "unmaterialized-member"}},
+            "required": ["checkout_kind"]
+          },
+          "then": {
+            "properties": {
+              "observed_branch": {"const": ""},
+              "observed_head": {"const": ""},
+              "git_common_dir": {"const": ""}
+            }
+          }
+        }
+      ]
+    }
+  }
+}

references/assets/infrastructure/contract/workspace-project-metadata-v4.schema.json

@@ -0,0 +1,125 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://work-bundle.dev/schemas/infrastructure/workspace-project-metadata-v4",
+  "title": "Portable WorkBundle workspace project metadata v4",
+  "type": "object",
+  "additionalProperties": true,
+  "required": ["metadata_version", "authority", "workspace", "control_plane", "source_repositories"],
+  "properties": {
+    "metadata_version": {"const": 4},
+    "authority": {"const": "canonical"},
+    "workspace": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": ["id", "slug", "mode"],
+      "properties": {
+        "id": {"type": "string", "pattern": "^wb-[A-Za-z0-9][A-Za-z0-9._-]*$"},
+        "slug": {"type": "string", "minLength": 1},
+        "mode": {"enum": ["single-repository", "multi-repository", "composite"]}
+      }
+    },
+    "control_plane": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": ["schema_version", "repository", "sync_policy"],
+      "properties": {
+        "schema_version": {"const": 1},
+        "repository": {
+          "type": "object",
+          "additionalProperties": true,
+          "required": ["remote"],
+          "properties": {"remote": {"type": "string"}}
+        },
+        "sync_policy": {
+          "type": "object",
+          "additionalProperties": true,
+          "required": ["mode"],
+          "properties": {"mode": {"const": "manual"}}
+        }
+      }
+    },
+    "source_repositories": {
+      "type": "array",
+      "minItems": 1,
+      "items": {"$ref": "#/$defs/repository"}
+    }
+  },
+  "allOf": [
+    {"not": {"anyOf": [
+      {"required": ["workspace_root"]},
+      {"required": ["project_root"]},
+      {"required": ["observed_head"]},
+      {"required": ["observed_at"]},
+      {"required": ["observation_time"]},
+      {"required": ["git_common_dir"]}
+    ]}}
+  ],
+  "$defs": {
+    "repository": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": ["id", "role", "default_branch", "workspace_binding", "materialization", "operation_policy"],
+      "properties": {
+        "id": {"type": "string", "minLength": 1},
+        "role": {"type": "string", "minLength": 1},
+        "remote": {
+          "type": "object",
+          "additionalProperties": true,
+          "required": ["canonical"],
+          "properties": {
+            "canonical": {"type": ["string", "null"]},
+            "aliases": {"type": "array", "items": {"type": "string"}}
+          }
+        },
+        "locator": {
+          "type": "object",
+          "additionalProperties": true,
+          "required": ["type", "value"],
+          "properties": {
+            "type": {"type": "string", "minLength": 1},
+            "value": {"type": "string", "minLength": 1}
+          }
+        },
+        "default_branch": {"type": "string", "minLength": 1},
+        "workspace_binding": {
+          "oneOf": [
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["type"],
+              "properties": {"type": {"const": "root"}}
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["type", "name"],
+              "properties": {
+                "type": {"const": "member"},
+                "name": {"type": "string", "pattern": "^(?!\\.{1,2}$)[^/\\\\]+$"},
+                "path": {"type": "string", "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$)).+$"}
+              }
+            }
+          ]
+        },
+        "materialization": {
+          "type": "object",
+          "additionalProperties": true,
+          "required": ["required"],
+          "properties": {"required": {"type": "boolean"}}
+        },
+        "operation_policy": {"type": "string", "minLength": 1}
+      },
+      "anyOf": [{"required": ["remote"]}, {"required": ["locator"]}],
+      "allOf": [
+        {"not": {"anyOf": [
+          {"required": ["workspace_root"]},
+          {"required": ["project_root"]},
+          {"required": ["observed_head"]},
+          {"required": ["observed_at"]},
+          {"required": ["observation_time"]},
+          {"required": ["git_common_dir"]}
+        ]}}
+      ]
+    }
+  }
+}

references/assets/keep-summarizing/workflow.md

@@ -20,11 +20,12 @@
     docs/
     spec/
     plan/
-    handoff/
+    result/
+    review/
 ```
 
 `<workspace-root>/.work-bundle/knowledge/` is the default durable source of truth for one managed workspace. A nested member cwd resolves upward to the containing workspace; source inspection remains scoped to that member `project_root`. Single-repository mode remains current with `workspace_root == project_root`. Legacy knowledge roots are readable only when explicitly selected for migration or read-only intake.
-Handoff artifacts live under `.work-bundle/orchestration/handoff/` and are not durable knowledge.
+Executor results and review artifacts live under `.work-bundle/orchestration/result/` and `.work-bundle/orchestration/review/`; they are not durable knowledge.
 
 ## V3 Lifecycle Authority Model
 

references/assets/orchestration/contract/accepted-task-result-v1.schema.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "accepted-task-result-v1", "type": "object",
+  "required": ["artifact_type", "schema_version", "id", "plan_id", "task_id", "product_identity", "product_sha256", "executor_result", "implementation_review", "validation_outcomes", "unresolved_material_defects", "knowledge_disposition", "knowledge_action", "date_created", "last_updated"],
+  "properties": {
+    "artifact_type": {"const": "accepted-task-result"}, "schema_version": {"const": 1}, "id": {"type": "string", "pattern": "^accepted-[a-z0-9][a-z0-9-]*$"},
+    "plan_id": {"type": "string", "pattern": "^plan-[a-z0-9][a-z0-9-]*$"}, "task_id": {"type": "string", "pattern": "^task-[a-z0-9][a-z0-9-]*$"},
+    "product_identity": {"type": "object", "required": ["kind", "sha256"], "properties": {"kind": {"enum": ["commit", "worktree"]}, "sha256": {"$ref": "#/$defs/sha"}}, "additionalProperties": false}, "product_sha256": {"$ref": "#/$defs/sha"},
+    "executor_result": {"$ref": "#/$defs/reference"}, "implementation_review": {"anyOf": [{"type": "null"}, {"$ref": "#/$defs/reference"}]},
+    "validation_outcomes": {"type": "array", "items": {"$ref": "#/$defs/observation"}}, "unresolved_material_defects": {"type": "array", "items": {"type": "string", "minLength": 1}},
+    "knowledge_disposition": {"$ref": "#/$defs/knowledge"}, "knowledge_action": {"enum": ["none", "update", "supersede", "reclassify"]},
+    "date_created": {"type": "string", "format": "date"}, "last_updated": {"type": "string", "format": "date"}
+  },
+  "$defs": {"sha": {"type": "string", "pattern": "^[0-9a-f]{64}$"}, "reference": {"type": "object", "required": ["id", "sha256"], "properties": {"id": {"type": "string", "minLength": 1}, "sha256": {"$ref": "#/$defs/sha"}}, "additionalProperties": false}, "observation": {"type": "object", "required": ["id", "result", "summary"], "properties": {"id": {"type": "string", "minLength": 1}, "result": {"enum": ["passed", "failed", "blocked", "not-run"]}, "summary": {"type": "string", "minLength": 1}}, "additionalProperties": false}, "knowledge": {"type": "object", "required": ["action", "reason"], "properties": {"action": {"enum": ["none", "update", "supersede", "reclassify"]}, "reason": {"type": "string", "minLength": 1}}, "additionalProperties": false}},
+  "additionalProperties": false
+}