writing-workbench/docs/invocation-policy.md

Invocation Policy

Formal Output Requires Real Invocation

Formal output includes:

• reviewer report;
• lead writer outline repair;
• lead writer draft;
• specialist analysis used for a user decision.

Formal output must come from a real sub-session, thread, tool invocation, or explicitly approved external execution path.

CCPE Participant Preflight

Before invoking any CCPE participant, read the single external CCPE interface:

1. C:\Users\wangq\Documents\Codex\ccpe-system\Interface.md

Then follow that interface to the consumer setup contract. Read protocol, Runtime, Agent, Lite, or Skill files only when the interface and consumer setup contract require them for the current task.

Writing Workbench maintains root-level CCPE infrastructure:

• ccpe/agent-registry.yaml: binds each participant ID and display name to a canonical_artifact_path;
• ccpe/invocation-policy.md: records the workbench invocation and acceptance policy;
• audit/<participant-display-name>/rS.R/agent-invocation-packet.md: records the formal participant startup packet for that run;
• audit/<participant-display-name>/rS.R/prompt-to-send.md: contains the prompt or wrapper actually sent to the real participant carrier;
• audit/<participant-display-name>/rS.R/returned-output.md: saved only after a real reviewer returns;
• editor/<participant-display-name>/rS.R/agent-invocation-packet.md: records a formal lead-writer startup packet;
• editor/<participant-display-name>/rS.R/prompt-to-send.md: contains the prompt or wrapper actually sent to the lead-writer carrier;
• editor/<participant-display-name>/rS.R/returned-output.md: saved only after a real lead writer returns.

The controller must verify that the canonical artifact is readable, or paste the full canonical artifact into prompt-to-send.md before task context. If the canonical artifact is missing or unreadable, stop with blocked_missing_canonical_artifact.

The task prompt is task context only. It must not replace the canonical role, tone, judgment method, or output structure.

Controller May Do

The controller session may:

• prepare context packs;
• create review briefs;
• route source files;
• resolve participants through ccpe/agent-registry.yaml;
• create agent-invocation-packet.md and prompt-to-send.md;
• launch or coordinate sub-sessions;
• summarize returned formal outputs;
• copy or move returned formal outputs into their contracted audit directories without rewriting their judgment;
• update project records;
• ask the user for decisions.

Controller Must Not Do

The controller session must not:

• impersonate a reviewer or lead writer;
• create a formal report without real invocation;
• invoke a CCPE participant by display name alone;
• launch a CCPE participant before binding the name to a readable canonical artifact;
• treat agent-invocation-packet.md as executed output;
• treat a prompt draft as an executed report;
• advance the project after its own recommendation;
• hide uncertainty about missing capability.

Missing Capability

If a required agent, skill, or runtime is unavailable:

1. Create a supplier ticket in requirements/ccpe/ or requirements/skills-vault/.
2. Set project state to blocked_waiting_capability.
3. Stop until the user confirms the capability is ready.

Simulation

Simulation is allowed only for planning and must be labeled:

simulation_only: true
formal_output: false
excluded_from_synthesis: true

Reviewer Audit Run Contract

Reviewer audit runs use the project-root layout:

audit/<reviewer-id>/rS.R/

rS.R encodes reviewer session and session-local round. For example, r1.1 is the first round in the first reviewer thread, r1.2 is the second round continuing that same thread, and r2.1 is the first round in a newly started reviewer thread.

Each run directory must contain:

• agent-invocation-packet.md: participant ID, canonical artifact path, carrier metadata, input files, output contract, and runtime acceptance rule;
• run-metadata.json: reviewer ID, round ID, child thread ID, prompt mode, continuation mode, source prompt path or reviewed target, canonical artifact path, packet path, prompt path, and output path;
• prompt-to-send.md: the exact wrapper prompt or instruction sent to the reviewer thread, including the instruction to load the canonical artifact before task context;
• returned-output.md: the formal reviewer output from the real child thread.

audit/audit-log.md is the project-level index of reviewer runs. It records the reviewer, round, child thread ID, whether the run continued a prior thread, prompt mode, source prompt path, and returned-output path.

For continued reviews, reuse the same child thread ID and increment only the round part. For restarted reviews, create a new child thread, increment the session part, reset the round part to .1, and record the new thread ID.

Reviewer prompts should use the participant's internalized review method instead of controller-authored scaffolding. The default fresh-thread prompt is: context file(s), outline file, and 评审提纲. The default continued-thread prompt is: context file(s), outline file, and 重新评审提纲. Add extra instructions only when the user explicitly provides them for that reviewer, and preserve those user instructions without expanding them into controller-authored review criteria.

Do not include Owner feedback files in reviewer inputs by default. Include them only when the user explicitly directs that the reviewer should receive that Owner feedback. By default, Owner feedback belongs to editor/lead-writer repair or synthesis runs.

When continuing a reviewer session, use the previous round's child thread and prior returned output for continuity. Do not resend large prior context by default; list it as available on demand unless the user explicitly asks for a full-context rerun or continuity is unavailable.

Lead Writer Run Contract

Lead writer runs use the project-root layout:

editor/<lead-writer-id>/rS.R/

rS.R encodes that lead writer's own session and session-local round. It is independent from every reviewer sequence.

Each run directory must contain:

• agent-invocation-packet.md: participant ID, canonical artifact path, carrier metadata, input files, output contract, and runtime acceptance rule;
• run-metadata.json: lead writer ID, round ID, child thread ID, continuation mode, task type, canonical artifact path, packet path, prompt path, and output path;
• prompt-to-send.md: the exact wrapper prompt or instruction sent to the lead-writer thread;
• returned-output.md: the formal lead-writer output from the real child thread.

editor/editor-log.md is the project-level index of lead-writer runs.

Lead-writer output is raw participant output. It may propose an outline, discuss direction, or draft a section, but it does not become a formal outline or draft until the Owner extracts or approves it into the project path such as outline/.

Acceptance Rule

A CCPE participant run is accepted as formal output only when:

• the root-level registry binds the participant to a canonical artifact;
• the canonical artifact was readable or pasted before task context;
• agent-invocation-packet.md exists for the run;
• a real participant carrier was launched and recorded;
• returned-output.md exists only after the participant returned;
• returned metadata or run metadata says simulation_only: false.

Packet-only and prompt-only states are blocked handoff states, not execution evidence.