workflow: Allow non-SCE helpers in SCE workflows

SCE workflows now scope handoff prohibitions to SCE skills while allowing relevant
non-SCE helpers to return control to the active step without changing workflow invariants.
OpenCode permissions and generated-output contracts enforce the new orchestration rules.

Co-authored-by: SCE <sce@crocoder.dev>

Author: davidabram

config/pkl/base/workflow-brownfield.pkl

@@ -39,8 +39,8 @@ local titleAndPurpose = model.semanticReference.apply(
 
   Own this workflow from input parsing through its terminal user-visible response.
   Execute the phases below directly and in order. Phase statuses are internal state,
-  not inter-skill handoffs. Do not invoke another SCE skill, sibling package, or
-  workflow command. Follow the canonical workflow's steps, gates,
+  not inter-SCE workflow handoffs. Do not invoke another SCE skill, sibling SCE
+  package, or SCE workflow command. Follow the canonical workflow's steps, gates,
   and stops exactly as written: never invent, skip, reorder, or merge a step.
 
   \(scopeStatement)
@@ -58,6 +58,8 @@ local titleAndPurpose = model.semanticReference.apply(
   canonical workflow says to continue. Stop only at a user wait or terminal branch.
   Clarification and bootstrap waits resume this same skill in the same session.
   Never expose an internal phase result as the workflow's final response.
+
+  \(model.helperSkillCompositionRule)
   """ + "\n\n",
   scopeStatement + "\n\n"
 )
@@ -356,7 +358,7 @@ local renderSkillBody = (mode: model.WorkflowRenderMode) -> """
     - Never write a fact scoring below `50` as truth.
     - Never resolve a material contradiction without disclosing it.
     - Never write a confidence score, hash, timestamp, or date under `context/`.
-    - Never invoke another skill, sibling package, or workflow command.
+    - Never invoke another SCE skill, sibling SCE package, or SCE workflow command.
     - Never synchronize context, validate a plan, select or execute a task, or create
       a Git commit.
     - Never treat this workflow as recurring context maintenance.

config/pkl/base/workflow-change-to-plan.pkl

@@ -7,8 +7,8 @@ changeToPlanSkillBody = """
 
 Own this workflow from input parsing through its terminal user-visible response.
 Execute the phases below directly and in order. Phase statuses are internal state,
-not inter-skill handoffs. Do not invoke another SCE skill, sibling package, or
-workflow command. Follow the canonical workflow's steps, gates,
+not inter-SCE workflow handoffs. Do not invoke another SCE skill, sibling SCE
+package, or SCE workflow command. Follow the canonical workflow's steps, gates,
 and stops exactly as written: never invent, skip, reorder, or merge a step.
 
 ## Phase references
@@ -45,6 +45,8 @@ Approval, clarification, revision, failed-validation repair, and bootstrap waits
 resume this same skill in the same session. Never expose an internal phase result
 as the workflow's final response.
 
+\(model.helperSkillCompositionRule)
+
 ## Input
 
 `$ARGUMENTS` is the change request, in free-form prose.

config/pkl/base/workflow-commit.pkl

@@ -708,8 +708,8 @@ local commitSkillBody = """
 
 Own this workflow from input parsing through its terminal user-visible response.
 Execute the phases below directly and in order. Phase statuses are internal state,
-not inter-skill handoffs. Do not invoke another SCE skill, sibling package, or
-workflow command. Follow the canonical workflow's steps, gates,
+not inter-SCE workflow handoffs. Do not invoke another SCE skill, sibling SCE
+package, or SCE workflow command. Follow the canonical workflow's steps, gates,
 and stops exactly as written: never invent, skip, reorder, or merge a step.
 
 ## Phase reference
@@ -738,6 +738,8 @@ Approval, clarification, revision, failed-validation repair, and bootstrap waits
 resume this same skill in the same session. Never expose an internal phase result
 as the workflow's final response.
 
+\(model.helperSkillCompositionRule)
+
 ## Input
 
 `$ARGUMENTS` is optional. Split it into two parts before invoking the skill:

config/pkl/base/workflow-content.pkl

@@ -169,6 +169,15 @@ hidden commandBanner = (workflowName: String) -> packageOnlyBlock.apply("\(workf
 hidden inlinePhaseBody = (phaseBody: WorkflowBody) ->
   compositeOnlyBlock.apply(phaseBody.render.apply("composite"))
 
+/// Non-SCE skills may help with work inside the active workflow step without
+/// becoming an alternate owner of the workflow's control flow.
+helperSkillCompositionRule = """
+Relevant non-SCE skills may be used as helper capabilities during the active step.
+They are not workflow handoffs: when a helper returns, control returns to the active
+step. Helper use must preserve the canonical phase order, gates, waits, writes,
+validation, stops, and terminal user-visible output.
+"""
+
 /// Canonical composite workflow bodies and package-local references for the
 /// four phase-based workflows. Target renderers add only supported entrypoint
 /// frontmatter; all operational and persisted-document content remains
@@ -180,9 +189,9 @@ nextTaskSkillBody = """
 
 Own this workflow from input parsing through its terminal user-visible response.
 Execute the phases below directly and in order. Phase statuses are internal state,
-not inter-skill handoffs. Do not invoke another SCE skill, sibling package, or
-workflow command except `sce-decision`, and invoke `sce-decision` only from the
-successful context-synchronization decision gate. Follow the canonical workflow's steps, gates,
+not inter-SCE workflow handoffs. Do not invoke another SCE skill, sibling SCE
+package, or SCE workflow command except `sce-decision`, and invoke `sce-decision`
+only from the successful context-synchronization decision gate. Follow the canonical workflow's steps, gates,
 and stops exactly as written: never invent, skip, reorder, or merge a step.
 
 ## Phase references
@@ -219,6 +228,8 @@ Approval, clarification, revision, failed-validation repair, and bootstrap waits
 resume this same skill in the same session. Never expose an internal phase result
 as the workflow's final response.
 
+\(helperSkillCompositionRule)
+
 ## Input
 
 Parse `$ARGUMENTS` into three positional parts before invoking any phase:
@@ -342,9 +353,9 @@ validateSkillBody = """
 
 Own this workflow from input parsing through its terminal user-visible response.
 Execute the phases below directly and in order. Phase statuses are internal state,
-not inter-skill handoffs. Do not invoke another SCE skill, sibling package, or
-workflow command except `sce-decision`, and invoke `sce-decision` only from the
-successful context-synchronization decision gate. Follow the canonical workflow's steps, gates,
+not inter-SCE workflow handoffs. Do not invoke another SCE skill, sibling SCE
+package, or SCE workflow command except `sce-decision`, and invoke `sce-decision`
+only from the successful context-synchronization decision gate. Follow the canonical workflow's steps, gates,
 and stops exactly as written: never invent, skip, reorder, or merge a step.
 
 ## Phase references
@@ -381,6 +392,8 @@ Approval, clarification, revision, failed-validation repair, and bootstrap waits
 resume this same skill in the same session. Never expose an internal phase result
 as the workflow's final response.
 
+\(helperSkillCompositionRule)
+
 ## Input
 
 `$ARGUMENTS` is the plan name or plan path.

config/pkl/base/workflow-context-sync.pkl

@@ -416,8 +416,9 @@ local taskRoleData = new SyncRole {
     - Create the context root. `sce setup --bootstrap-context` owns that.
     - Narrate changed files as documentation. Feature existence is the only reason
       to document a change that introduced no other durable knowledge.
-    - Invoke any sibling skill except `sce-decision`, or invoke `sce-decision`
-      outside the decision gate in successful context synchronization.
+    - Invoke any sibling SCE skill, sibling SCE package, or SCE workflow command
+      except `sce-decision`, or invoke `sce-decision` outside the decision gate in
+      successful context synchronization.
     - Delete a context file that has uncommitted changes.
     - \(returnExecutionStyleResult.render.apply(mode)).
     """
@@ -749,8 +750,9 @@ local planRoleData = new SyncRole {
     - Create the context root. `sce setup --bootstrap-context` owns that.
     - Narrate changed files as documentation. Feature existence is the only reason
       to document a change that introduced no other durable knowledge.
-    - Invoke any sibling skill except `sce-decision`, or invoke `sce-decision`
-      outside the decision gate in successful context synchronization.
+    - Invoke any sibling SCE skill, sibling SCE package, or SCE workflow command
+      except `sce-decision`, or invoke `sce-decision` outside the decision gate in
+      successful context synchronization.
     - Delete a context file that has uncommitted changes.
     - \(returnInternalState.render.apply(mode)).
     """
@@ -1390,8 +1392,9 @@ Do not:
 - Create the context root. `sce setup --bootstrap-context` owns that.
 - Narrate changed files as documentation. Feature existence is the only reason to
   document a change that introduced no other durable knowledge.
-- Invoke any sibling skill except `sce-decision`, or invoke `sce-decision`
-  outside the decision gate in successful context synchronization.
+- Invoke any sibling SCE skill, sibling SCE package, or SCE workflow command
+  except `sce-decision`, or invoke `sce-decision` outside the decision gate in
+  successful context synchronization.
 - Delete a context file that has uncommitted changes.
 - Return an execution-style internal state.
 """

config/pkl/base/workflow-handover.pkl

@@ -29,15 +29,17 @@ local titleAndPurpose = model.packageOnlyBlock.apply("""
     user-visible response. This is a two-mode, single-pass workflow: writer mode
     captures the current session and repository state as one durable handover
     document; loader mode reads back an existing handover for continuation in
-    another session. Neither mode invokes another skill, sibling package, or
-    workflow command, and neither mode waits for user input mid-run.
+    another session. Neither mode invokes another SCE skill, sibling SCE package, or
+    SCE workflow command, and neither mode waits for user input mid-run.
 
     ## User-visible output
 
     Use `references/output.md` for every terminal response. Render no raw internal
     state. The reference contains only human-visible Markdown layouts.
     User-visible output is limited to those layouts: never invent a layout, and
     never wrap one in an added preamble, commentary, summary, or extra section.
+
+    \(model.helperSkillCompositionRule)
     """)
 
 local renderPersistedFormatBody = """
@@ -220,7 +222,7 @@ local renderSkillBody = (mode: model.WorkflowRenderMode) -> """
       one handover document it writes.
     - Loader mode never edits a file, writes a new file, or changes plan or task
       state.
-    - Never invoke another skill, sibling package, or workflow command.
+    - Never invoke another SCE skill, sibling SCE package, or SCE workflow command.
     - Never treat a file outside `context/handovers/`, or a non-Markdown file, as a
       loadable handover.
     - Never create the `context/` root; `sce setup --bootstrap-context` owns that.

config/pkl/check-generated.sh

@@ -96,6 +96,18 @@ expect_pkl_fixture_failure \
 expect_pkl_fixture_failure \
   "config/pkl/renderers/fixtures/output-dedup-check.pkl" \
   "generated SKILL.md reproduces a references/output.md fenced layout verbatim"
+expect_pkl_fixture_failure \
+  "config/pkl/renderers/fixtures/unscoped-skill-prohibition-check.pkl" \
+  "generated workflow skill contains an unscoped skill prohibition"
+expect_pkl_fixture_failure \
+  "config/pkl/renderers/fixtures/missing-helper-skill-rule-check.pkl" \
+  "generated workflow skill is missing the required helper-skill composition rule"
+expect_pkl_fixture_failure \
+  "config/pkl/renderers/fixtures/opencode-arbitrary-sce-permission-check.pkl" \
+  "OpenCode skill permissions must reject arbitrary SCE permissions"
+expect_pkl_fixture_failure \
+  "config/pkl/renderers/fixtures/opencode-skill-permission-order-check.pkl" \
+  "OpenCode skill permissions must preserve the wildcard, deny, and explicit-allow order"
 
 "$producer" "$repo_root" "$generated_input_root"
 generated_root="$generated_input_root/pkl-generated"

config/pkl/renderers/fixtures/blank-line-run-check.pkl

@@ -11,4 +11,4 @@ local documentsWithBlankLineRun = new Mapping {
 result = if (
   documentsWithBlankLineRun.every((_, text) -> !text.contains("\n\n\n"))
 ) "negative fixture unexpectedly contained no blank-line run"
-else error("generated workflow document contains two or more consecutive blank lines")
+else throw("generated workflow document contains two or more consecutive blank lines")

config/pkl/renderers/fixtures/extra-artifact-check.pkl

@@ -11,4 +11,4 @@ result = if (
   artifactsWithExtraPath.length == contract.expectedArtifactPaths.length
   && contract.expectedArtifactPaths.every((path, _) -> artifactsWithExtraPath.containsKey(path))
 ) "negative fixture unexpectedly matched"
-else error("generated artifact inventory does not match the exact expected path contract")
+else throw("generated artifact inventory does not match the exact expected path contract")

config/pkl/renderers/fixtures/forbidden-workflow-reference-check.pkl

@@ -11,4 +11,4 @@ local documentsWithForbiddenReference = new Mapping {
 result = if (
   documentsWithForbiddenReference.every((_, text) -> !text.contains("sce-plan-review"))
 ) "negative fixture unexpectedly contained no forbidden reference"
-else error("generated workflow document contains a forbidden sibling-package reference or unresolved internalization token")
+else throw("generated workflow document contains a forbidden sibling-package reference or unresolved internalization token")