---
name: long-task-workflow
description: Author, preflight, execute, resume, verify, or close one complete Single-Goal Delivery Contract in the currently selected host execution Goal and workspace. Use only when explicitly invoked or a valid common-dir active authority binding exists.
---

# Single-Goal Long-Task Workflow

## Boundaries

Use one currently selected host execution Goal, one repository, one selected verification workspace, one complete Contract and one Final Gate. This workflow never creates, invokes or manages a scheduler, agent runtime, App Server, branch/worktree fan-out, merge, push, PR, deployment, legacy orchestration chain, matrix, verdict or second Contract plan. The parent Goal owns Source, Contract, Authority, architecture, Context writeback, integration, current-candidate checks, formal verification, Final Gate, close and completion. Harness never allocates, schedules, retries or recovers delegated workers; their reports are not Progress, Evidence or proof, and every result must converge into the selected verification workspace before verification counts. Never activate from task size alone.

That Goal is host/user-selected; Harness does not create, persist or reconnect a Goal identifier. Compaction may continue inside it; a later physical Goal/session restores semantic state through `resume`, not a prior Turn. With a valid binding, run `ty-context long-task resume <workdir>`, then directly load the installed `long-task-workflow` Skill; recovery needs no implicit invocation.

The host/user owns model selection. Exactly one unconditional terminal-turn checkpoint follows the first Authority Lock before implementation. Harness neither switches nor verifies the model, persists checkpoint/acknowledgement/route state, nor creates a model scheduler, automatic switch or native-Goal completion state. Do not otherwise pause a healthy Goal solely to change models.

A Codex-root `long-task` install may expose fixed package-owned `long_task_implementation` with child agents disabled. It is static, stateless, non-Authority and post-checkpoint; install proves neither selection nor effective model/reasoning/tier. Profile and spawn never set `service_tier`. Exact-call or capability failure returns a packet to the parent; never infer it, use a generic child, or add tiers/retry/scheduling.

`long-task-delivery-v2` is the active Contract schema. `delivery-contract.yaml` is the root authoring file. New authoring uses inline Outcomes; existing `outcome_files` are compatibility only. Legacy split-delivery commands are non-executing.

## Controlling Objective

Prevent false completion inside declared authority. Given complete and accurate Source, a meaning-preserving Contract projection, complete applicability and the admitted-observer boundary, `AcceptedDeliveryTerminal` implies no declared machine-observable drift remains. Machine completion requires package-admitted Actual and Harness-owned comparison; unsupported proof remains blocking External Confirmation. Implementation may drift or require rework, but every declared requirement, Fact, proof obligation and independently falsifiable AC stays traceable, and every unproved item blocks or qualifies completion.

Complete Source is not a prose or current-code ceiling. Material non-UI meaning uses the finest independently decidable standard and custom semantic Facts plus every required proof method. For selected design resources, Agent implementation, acceptance and testing fully conform to every material Fact in declared scope and conditions; formal input therefore uses complete canonical acquisition, Census, atomic Fact/proof closure and exact production-target evidence. Deliberately partial design input remains an explicitly scoped constraint or blocking unresolved input; incomplete implementation-source acquisition is blocking, and an exact target requires layout and pixel Facts for every declared condition. `UI symbolic V2 is explicit opt-in; V1 remains the default.` Non-UI symbolic admission remains out of scope; machine-observer and verifier/runner trust-boundary closure is mandatory rather than deferred Provider/P0 work. Read the Source, Contract and Evidence references for the exact V1/V2 authoring and proof rules.

Only fresh evidence from the complete current final snapshot may create machine acceptance. Exactly fresh `machine_accepted` with no pending External Confirmation is `AcceptedDeliveryTerminal`; `machine_accepted_external_pending` proves only declared machine scope. Progress is repair evidence only and never acceptance authority. Final Gate is the sole Long-Task Engineering Quality Conformance and Architecture Conformance carrier, and it proves only the declared, falsifiable, project-check-bound set—not overall code quality. This adds no quality Boolean, matrix, Source aspect, Claim/risk kind, Contract field, second Gate, state or Receipt, and no separate default Contract Conformance closure runs.

Anti-Degradation Assurance protects coverage, false-negative resistance, fail-closed Authority and final-snapshot proof before cost. Purpose replacement requires a project-owner design-purpose decision and replacement proof. `F = Implementation Freedom Boundary` leaves methods, feedback, packet decomposition and dynamic count Goal-owned within Source/Contract/safety. After the checkpoint, identify packets before profile/capacity. Each is `independently_safe`, has `positive_expected_parallel_benefit` and `bounded_input_and_output`, is `parent_integratable`, and the set is pairwise `owner_disjoint`, `path_disjoint` and `source_of_truth_disjoint`. Unless explicit user/host policy prohibits agents, make actual host calls for multiple exact workers with `agent_type: long_task_implementation`; intent is not delegation and only call or explicit capability results establish profile/capacity. Count stays dynamic.

Select one zero-start reason by the Workflow Contract's ordered first-match rule: policy prohibition -> insufficient base candidates -> disjointness conflict -> coordination cost -> actual exact-spawn capacity failure -> other exact-worker unavailability. Unknown capacity is not insufficiency. Once any exact worker starts, later profile/capacity failure is partial delegation rather than a parent-only reason: keep that worker, return the rest to the parent and report the cause; use no generic substitute or retry. A type mismatch returns its packet. Never override `service_tier` or claim unobservable inheritance. Add no development phase/method Gate, fixed count/Outcome mapping, allocator/scheduler, queue/DAG/registry/proof or persistent delegation state.

Each worker gets one self-contained packet containing its goal, allowed owners and paths, forbidden paths, relevant Source, Contract and Context references, implementation entrypoints, checks, expected return format and known dependency/integration risk. Before dispatch, the parent reads `git status --short` and `git diff --name-only` non-persistently. Workers only implement/check; truth, Authority, spawning, worktrees and acceptance remain parent-owned. `PreToolUse` denies non-exact creation and freshly checks visible profile parity; `SubagentStart` reinforces type without proving trust, effective execution or load atomicity. After return, the parent inspects the actual diff and integrates results only after comparing actual changed paths and the final working-tree diff with the union of packet envelopes. This proves path-envelope conformance, not per-line actor attribution; unexplained/overlapping/out-of-envelope/shared-owner changes block integration and Final Gate.

## Progressive Reference Loading

Read the reference for the current activity completely. These four one-level references are detailed guidance, not new artifacts, stages or authority:

- For raw, mixed, attachment-heavy, incomplete or conversation-only inputs, read [`references/source-authoring.md`](references/source-authoring.md) alongside Contract authoring. It owns Source inventory, synthesis/refinement, provenance, preference/research decisions, complete semantic input expansion, selected-resource intake and marker convergence inside the same Draft loop.
- Before creating or structurally revising Source markers, Outcomes, requirements, Controls, obligations, applicability, architecture boundaries, paths, Bindings, Assertions or risk, read [`references/contract-authoring.md`](references/contract-authoring.md). It owns the exact Contract projection and structural closure rules, including selected-design V1/V2 authoring.
- Before creating or repairing Checks, runners, Observations, proof surfaces, Counterfactuals, Population/environment probes or selected-design evidence, read [`references/evidence-design.md`](references/evidence-design.md). It owns exact execution evidence, sensitivity and Oracle boundaries.
- Before Preflight, Compile, the one-time model checkpoint, protected revision, resume, targeted verify, Final Gate, Stop, close or abandon, read [`references/authority-lifecycle.md`](references/authority-lifecycle.md). It owns command and lifecycle detail.

Do not copy reference detail into another Skill, plan or state file. The same `delivery-contract.yaml`, active authority and current workspace remain the only lifecycle surfaces.

## Contract Draft And Outcome Decomposition

Every external initial proposal, selected design resource, ordinary planning document or other material input enters the same non-authoritative `delivery-contract.yaml` Draft immediately. Inventory, Source-quality synthesis/refinement, provenance, markers, repository binding and Contract mapping converge in one `long-task-workflow` lifecycle and need not be completed in one response. Conversation-only material becomes exactly one project-native Markdown Source. Do not create a Source-authoring phase, standalone Contract Draft Skill, Draft Receipt, Authoring State, draft schema/CLI/runtime state, handoff or second plan.

A Draft Outcome is an Outcome before Authority Lock, not a new schema field or runtime entity. Decompose only vertical, independently observable, decidable and target-verifiable results whose dependencies and owner boundary can be stated. `depends_on` and Stage gates express acceptance and intermediate-proof readiness, never implementation permission. Do not split for response/YAML/file length, implementation layer, module/file count, Agent capacity, Worker assignment or desired parallelism.

> Outcome decomposes execution and diagnosis, not completion authority.

## Lifecycle Summary

1. Read the request, real Source, relevant Context, repository owners and selected design resources. Before formal Compile and the first implementation edit, surface one repository-bound `Architecture Deliberation`: owner/extension point/source of truth, dependencies and lifecycle, selected and rejected alternatives, future-change challenge, debt disposition, forbidden shortcuts, project-owned Checks and triggered quality attributes or concrete preservation. Put durable conclusions in owning Context and material falsifiable delivery conclusions in real marked Source plus existing Contract fields. Decide `Context Delta: none|required`.
2. Open the one Contract Draft immediately. When inputs need Source repair, read Source authoring and Contract authoring together; preserve at least one real `source_path`, complete all required semantic/design closure and repair every `decision_required` item without inventing product meaning.
3. Run read-only `ty-context long-task preflight <workdir>`, repair the same Draft, then run formal Compile only when Source, Context, Contract, repository scope and proof bindings are ready. Compile creates the first Authority Lock; Preflight creates no Authority, Progress, Receipt or state.
4. On the first Compile result with `execution_model_checkpoint.required: true`, do no product implementation, edit, build or test; end the turn. Tell a Chinese-speaking user exactly `处理好模型更换后，请仅回复：模型切换卡点解除，继续`; in English use `After handling the model change, reply exactly: model checkpoint cleared, continue`. Generic continuation does not satisfy this managed prompt protocol. Harness observes neither the next host message nor the model change, so this is no machine unlock or attestation. Later Compile returns `required: false` without repeating the pause.
5. After continuation, begin Goal-owned rolling implementation and apply Delegation Suitability above. Qualifying work gets actual multiple exact `long_task_implementation` calls; otherwise record one admitted solo reason. Keep coupled work in the parent. Refresh Context Delta and Architecture Deliberation when durable scope, ownership, dependency, design, quality or debt changes.
6. Use targeted verification only when its expected localization value exceeds cost. If authority changes, keep the same Draft and follow protected revision; mechanically bounded repairs may auto-adopt, while semantic weakening or unknown change requires the exact user decision. Adoption returns to rolling implementation and is never completion.
7. Complete Context, implementation and project tests, create the clean candidate required by the lifecycle reference, then run the one source-recompiled current-snapshot Final Gate. Stop/close and any native Goal completion remain subject to the exact lifecycle and veto rules in the Authority reference.

## Rolling Execution

Apply packet-first above. Outcomes/Stages govern acceptance, not edits; coherent-owner packets may cross them. Parent retains Authority, packet selection, Context, integration and verification; proof-bearing changes converge into the selected verification workspace.

The derived Frontier is only an acceptance/verification and diagnosis projection. Use `verify --explain [--outcome/--check]` for a read-only cost preview and targeted `verify --outcome/--check` for optional feedback. `progress_stale` is a freshness fact; refresh only before an intermediate decision relies on that Progress. Continuing implementation and entering Final Gate need no targeted refresh because Final Gate ignores Progress and reruns all required Checks. Do not add another model-switch pause, trigger queue, implementation gate, per-edit rebuild rule or per-platform progress state.

When implementation discovers a blocker, classify it under the existing protected-revision rules. Difficulty or delay never makes machine-verifiable scope external and never removes Source. Keep exact revision identity, old-Authority continuity, compare-and-swap adoption, evidence invalidation and the complete Final Gate; use the lifecycle reference for diagnosis, decision transport, approval and adoption.

## Final Authority And Handoff

Final Gate recompiles Source authority, freezes and rechecks the complete protected current snapshot, reruns every declared Check and sensitivity control and rejects any protected-input, workspace/tree or Active Authority drift. It never trusts historical Progress, Receipt, compiled cache, delegated report or Agent judgment. Before invoking native Goal completion, perform the required veto-only comparison of current user/Goal meaning with accepted marked Source; mismatch returns to Source/Contract repair and creates no second Gate or proof.

Report implementation/risk, Architecture and Engineering Quality Conformance, Claim Coverage, Stage/target/Gate results, acceptance scope, pending External Confirmations, Context and blockers. Use verifier terms and state boundaries honestly: undeclared/inaccurate Source and unsound project Oracles are not mechanically repaired; Final Gate proves only declared machine authority and its project-check-bound quality set; the host/user owns the native Goal/model; worker injection and reports are not acceptance inputs. The observer remains Level 3; `observed_lifecycle_*` facts cannot replace complete total-cost ROI or the independent audit required for Level 4.