Variable contracts: declare the values that cross an activity boundary

[m2ux]

Summary

Fifty-five values were produced by one activity and consulted by another with no contract at either
end. Each is now declared: the write on the activity that produces it, the read on the activity that
consults it.

They were invisible until now because the guard holding the corpus to its contracts narrowed both
its derived reads and its derived writes to the workflow's declared namespace — and that namespace is
assembled from the declarations being checked, so a name nobody declared dropped out of both sides at
once. The paired server change in #502 fixes that and reports this shape as undeclared-crossing.

Stacked on #500 so the two can be reviewed apart and land together. Base is
workflow/496-activity-exits.

How it surfaced

A smoke run of work-package with a real worker failed its session-contract assertion: the run wrote
prior_feedback_triage and rating_cap while exiting start-work-package, which declared neither.
start-work-package binds review-existing-feedback, whose outputs those are; submit-for-review
binds review-summary, whose prose reads both. Nothing declared either, so nothing static could see
it and only the run could.

What is declared

79 findings, 55 values, 7 workflows — work-package 19, remediate-vuln 17,
substrate-node-security-audit 17, workflow-design 11, midnight-system-review 7,
workflow-authoring 7, prism-evaluate 1.

Each write carries the description the producing technique already gives that output, so the
declaration and the operation say the same thing about the value.

Where a read is reached before its producer runs, the write carries a default. 54 of the
declarations sit on activities that consult a value earlier in the run order than the activity
producing it, or on a loop-back — requirements at 29 sites, changed_files at 10,
review_summary at 5. The default means such a reader finds the empty value rather than nothing.

remediate-vuln owns two values outright. It opens on its own start rather than
work-package's start-work-package, so the review-mode values that opener produces have no
producer in it. Declaring the write upstream left this workflow with a reader and no writer, which
is the borrowed-activity seam #491 named. It now declares both as the empty constants they are in a
workflow that remediates a vulnerability and never reviews a pull request.

Descriptions keep their words and drop their links. 13 descriptions taken from technique files
carried relative markdown links that resolve from techniques/ and not from activities/; one of
them broke check:resource-anchors.

Verification

Verified against the paired server branch: all 30 guards pass with the new family at hard zero, the
1,097-test suite passes, and the walk snapshots are unchanged apart from the corpus SHA stamp —
declaring a contract moves no path.

The original defect is confirmed fixed on the original evidence: check-session-contract over the
saved session from the failed smoke run reports 23 write(s) measured … OK.

Non-goals

This declares the crossings that exist rather than redesigning the flows that make them. Where a
value arguably should not cross an activity boundary at all, that is a separate question.

substrate-node-security-audit produces and consults both dispatch_results and
dispatched_results, so both are declared. That two names this close coexist is worth its own look.

🤖 Generated with Claude Code