writing-workbench/docs/invocation-policy.md

Invocation Policy

Formal Output Requires Real Invocation

Formal output includes:

• reviewer report;
• lead writer outline repair;
• lead writer draft;
• specialist analysis used for a user decision.

Formal output must come from a real sub-session, thread, tool invocation, or explicitly approved external execution path.

CCPE Participant Preflight

Before invoking any CCPE participant, read the single external CCPE interface:

1. C:\Users\wangq\Documents\Codex\ccpe-system\Interface.md

Then follow that interface to the consumer setup contract. Read protocol, Runtime, Agent, Lite, or Skill files only when the interface and consumer setup contract require them for the current task.

Writing Workbench maintains root-level CCPE infrastructure:

• ccpe/agent-registry.yaml: binds each participant ID and display name to a canonical_artifact_path;
• ccpe/invocation-policy.md: records the workbench invocation and acceptance policy;
• audit/<participant-display-name>/rS.R/agent-invocation-packet.md: records the formal participant startup packet for that run;
• audit/<participant-display-name>/rS.R/prompt-to-send.md: contains the prompt or wrapper actually sent to the real participant carrier;
• audit/<participant-display-name>/rS.R/returned-output.md: saved only after the real participant returns.

The controller must verify that the canonical artifact is readable, or paste the full canonical artifact into prompt-to-send.md before task context. If the canonical artifact is missing or unreadable, stop with blocked_missing_canonical_artifact.

The task prompt is task context only. It must not replace the canonical role, tone, judgment method, or output structure.

Controller May Do

The controller session may:

• prepare context packs;
• create review briefs;
• route source files;
• resolve participants through ccpe/agent-registry.yaml;
• create agent-invocation-packet.md and prompt-to-send.md;
• launch or coordinate sub-sessions;
• summarize returned formal outputs;
• copy or move returned formal outputs into their contracted audit directories without rewriting their judgment;
• update project records;
• ask the user for decisions.

Controller Must Not Do

The controller session must not:

• impersonate a reviewer or lead writer;
• create a formal report without real invocation;
• invoke a CCPE participant by display name alone;
• launch a CCPE participant before binding the name to a readable canonical artifact;
• treat agent-invocation-packet.md as executed output;
• treat a prompt draft as an executed report;
• advance the project after its own recommendation;
• hide uncertainty about missing capability.

Missing Capability

If a required agent, skill, or runtime is unavailable:

1. Create a supplier ticket in requirements/ccpe/ or requirements/skills-vault/.
2. Set project state to blocked_waiting_capability.
3. Stop until the user confirms the capability is ready.

Simulation

Simulation is allowed only for planning and must be labeled:

simulation_only: true
formal_output: false
excluded_from_synthesis: true

Reviewer Audit Run Contract

Reviewer audit runs use the project-root layout:

audit/<reviewer-id>/rS.R/

rS.R encodes reviewer session and session-local round. For example, r1.1 is the first round in the first reviewer thread, r1.2 is the second round continuing that same thread, and r2.1 is the first round in a newly started reviewer thread.

Each run directory must contain:

• agent-invocation-packet.md: participant ID, canonical artifact path, carrier metadata, input files, output contract, and runtime acceptance rule;
• run-metadata.json: reviewer ID, round ID, child thread ID, prompt mode, continuation mode, source prompt path or reviewed target, canonical artifact path, packet path, prompt path, and output path;
• prompt-to-send.md: the exact wrapper prompt or instruction sent to the reviewer thread, including the instruction to load the canonical artifact before task context;
• returned-output.md: the formal reviewer output from the real child thread.

audit/audit-log.md is the project-level index of reviewer runs. It records the reviewer, round, child thread ID, whether the run continued a prior thread, prompt mode, source prompt path, and returned-output path.

For continued reviews, reuse the same child thread ID and increment only the round part. For restarted reviews, create a new child thread, increment the session part, reset the round part to .1, and record the new thread ID.

Acceptance Rule

A CCPE participant run is accepted as formal output only when:

• the root-level registry binds the participant to a canonical artifact;
• the canonical artifact was readable or pasted before task context;
• agent-invocation-packet.md exists for the run;
• a real participant carrier was launched and recorded;
• returned-output.md exists only after the participant returned;
• returned metadata or run metadata says simulation_only: false.

Packet-only and prompt-only states are blocked handoff states, not execution evidence.