Variable contracts: declare the values that cross an activity boundary

midnight-system-review/activities/01-scope-intake.yaml

@@ -25,6 +25,9 @@ variables:
       type: boolean
       description: Whether a runnable midnight-node binary is available; gates runtime and SCALE-metadata probes
       defaultValue: false
+    - name: pr_number
+      type: string
+      description: The pull request number.
 required: true
 techniques:
   - variable-binding

midnight-system-review/activities/02-area-derivation.yaml

@@ -9,6 +9,9 @@ variables:
     - probe_budget_per_area
     - target_repo_path
   writes:
+    - name: investigation_areas
+      type: array
+      description: The amended area list, re-emitted for the next approval pass and for the area-probe loop.
     - name: plan_approved
       type: boolean
       description: Investigation-plan gate — set by the investigation-plan-approved checkpoint's approve option

midnight-system-review/activities/03-evidence-probes.yaml

@@ -6,11 +6,16 @@ variables:
   reads:
     - cargo_available
     - gitnexus_available
+    - investigation_areas
     - node_binary_available
     - plan_approved
     - planning_folder_path
     - probe_budget_per_area
     - target_repo_path
+  writes:
+    - name: candidate_findings
+      type: array
+      description: All candidate findings aggregated across areas in area order, each tied to its area and anchors — the adjudication input.
 required: true
 techniques:
   - scatter-gather

midnight-system-review/activities/04-finding-adjudication.yaml

@@ -4,8 +4,13 @@ name: Finding Adjudication
 description: Grade every finding candidate from the evidence log against the rubric and adjudicate each into the findings register.
 variables:
   reads:
+    - candidate_findings
     - planning_folder_path
     - target_repo_path
+  writes:
+    - name: accepted_findings
+      type: array
+      description: The accepted subset in area order — the only findings the verdict computation reads.
 required: true
 steps:
   - kind: action

midnight-system-review/activities/05-verdict-and-report.yaml

@@ -4,10 +4,15 @@ name: Verdict and Report
 description: Compute the merge-readiness verdict from accepted findings, render the review report with per-area accounting, and secure verdict sign-off.
 variables:
   reads:
+    - accepted_findings
     - has_pr_surface
+    - investigation_areas
     - planning_folder_path
     - target_repo_path
   writes:
+    - name: merge_readiness_verdict
+      type: number
+      description: The 1-5 verdict per the rubric scale (1 = not merge-ready, 5 = merge-ready).
     - name: plan_approved
       type: boolean
       description: Investigation-plan gate — set by the investigation-plan-approved checkpoint's approve option
@@ -16,6 +21,13 @@ variables:
       type: boolean
       description: Publish gate — set by the publish-decision checkpoint's approve option
       defaultValue: false
+    - name: review_summary
+      type: string
+      description: The rendered review text destined for the pull request — posted verbatim by the publish operation, byte-for-byte what sign-off approved.
+      defaultValue: ""
+    - name: review_type
+      type: string
+      description: The verdict-derived review action — `approve`, `request-changes`, or `comment` — per the rubric's verdict-to-review-type mapping. Always emitted, whether or not the run publishes.
 required: true
 steps:
   - kind: action

midnight-system-review/activities/06-publish-review.yaml

@@ -5,8 +5,12 @@ description: Post the signed-off review to the pull request and record the publi
 variables:
   reads:
     - has_pr_surface
+    - merge_readiness_verdict
     - planning_folder_path
+    - pr_number
     - publish_requested
+    - review_summary
+    - review_type
     - target_repo_path
 required: false
 steps:

prism-evaluate/activities/00-scope-definition.yaml

@@ -30,6 +30,9 @@ variables:
       type: boolean
       description: Whether the user confirmed the evaluation scope
       defaultValue: false
+    - name: target_name
+      type: string
+      description: The target's base name.
     - name: target_path
       type: string
       description: Path to the document, proposal, codebase, or artifact set to evaluate

prism-evaluate/activities/06-apply-mitigations.yaml

@@ -9,6 +9,7 @@ variables:
     - evaluation_output_path
     - evaluation_target_type
     - mitigation_plan_path
+    - target_name
     - target_path
   writes:
     - name: evaluation_findings

remediate-vuln/workflow.yaml

@@ -27,6 +27,17 @@ techniques:
   activity:
     - variable-binding
 variables:
+  # This workflow opens on its own `start` rather than work-package's `start-work-package`, so the
+  # review-mode values that opener produces have no producer here. It never reviews an existing PR,
+  # so they are constants, owned by the file that runs the borrowed activity reading them.
+  - name: prior_feedback_triage
+    type: object
+    description: Triage of a reviewed PR's prior feedback. Always empty here — this workflow remediates a vulnerability rather than reviewing a pull request.
+    defaultValue: {}
+  - name: rating_cap
+    type: string
+    description: Ceiling a review's Overall Rating may not exceed. Always empty here — this workflow remediates a vulnerability and issues no review rating to cap.
+    defaultValue: ""
   - name: target_path
     type: string
     description: Private checkout for edits, builds, and pushes to the security remote.

substrate-node-security-audit/activities/02-reconnaissance.yaml

@@ -4,7 +4,22 @@ name: Reconnaissance
 description: Run codebase reconnaissance and security decomposition.
 variables:
   reads:
+    - agent_roster
     - planning_folder_path
+  writes:
+    - name: agent_roster
+      type: array
+      description: Roster of agents to dispatch, with per-agent group assignment and supplementary files.
+      defaultValue: []
+    - name: dispatched_results
+      type: array
+      description: Array of `{ id, result }` in `{worker_briefs}` order. `result` is the harness agent output text (or structured payload when the worker returned one). Completeness counts live on gather-results.
+    - name: domain_map
+      type: object
+      description: Structured domain map partitioned by crate, ready for sub-agent distribution.
+    - name: worker_briefs
+      type: array
+      description: Ordered `{ id, description, prompt }` array produced by compose operations for the next meta dispatch step.
 required: true
 techniques:
   - scatter-gather

substrate-node-security-audit/activities/03-primary-audit.yaml

@@ -4,12 +4,19 @@ name: Primary Audit
 description: Multi-agent primary audit via concurrent dispatch with verification and merge.
 variables:
   reads:
+    - agent_roster
     - planning_folder_path
   writes:
     - name: dispatch_complete
       type: boolean
       description: Phase 1b dispatch gate — every assigned agent dispatched and returned; gates report-generation entry
       defaultValue: false
+    - name: dispatch_results
+      type: array
+      description: Collected results from all dispatched sub-agents.
+    - name: dispatched_results
+      type: array
+      description: Array of `{ id, result }` in `{worker_briefs}` order. `result` is the harness agent output text (or structured payload when the worker returned one). Completeness counts live on gather-results.
     - name: merge_complete
       type: boolean
       description: Phase 1b merge gate — set from the merge sub-agent's reconciliation; gates report-generation entry
@@ -18,6 +25,12 @@ variables:
       type: boolean
       description: Phase 1b verification gate — set from the verification sub-agent's output; gates report-generation entry
       defaultValue: false
+    - name: verification_report
+      type: string
+      description: Scan completeness verification with gaps and re-scan recommendations
+    - name: worker_briefs
+      type: array
+      description: Ordered `{ id, description, prompt }` array produced by compose operations for the next meta dispatch step.
 required: true
 techniques:
   - scatter-gather

substrate-node-security-audit/activities/04-adversarial-verification.yaml

@@ -4,8 +4,13 @@ name: Adversarial Verification
 description: Adversarially verify PASS items from the primary audit.
 variables:
   reads:
+    - dispatch_results
     - file_inventory
     - planning_folder_path
+  writes:
+    - name: decomposition_results
+      type: array
+      description: Decomposition table with per-instance verification results.
 required: true
 steps:
   - kind: action

substrate-node-security-audit/activities/05-report-generation.yaml

@@ -4,14 +4,27 @@ name: Report Generation
 description: Consolidate findings into the final audit report.
 variables:
   reads:
+    - decomposition_results
     - dispatch_complete
+    - dispatch_results
+    - domain_map
     - ensemble_enabled
     - has_reference_report
     - merge_complete
     - planning_folder_path
+    - reconciliation_table
     - target_commit
     - target_submodule
     - verification_complete
+    - verification_report
+  writes:
+    - name: reconciliation_table
+      type: object
+      description: Per-agent finding-count reconciliation, carrying an `unaccounted` count that is zero when the merge is lossless.
+      defaultValue: {}
+    - name: verification_report
+      type: string
+      description: Scan completeness verification with gaps and re-scan recommendations
 required: true
 steps:
   - kind: action

substrate-node-security-audit/activities/06-ensemble-pass.yaml

@@ -8,6 +8,11 @@ variables:
     - planning_folder_path
     - target_commit
     - target_submodule
+  writes:
+    - name: reconciliation_table
+      type: object
+      description: Per-agent finding-count reconciliation, carrying an `unaccounted` count that is zero when the merge is lossless.
+      defaultValue: {}
 required: false
 steps:
   - kind: technique

substrate-node-security-audit/activities/10-sub-crate-review.yaml

@@ -6,6 +6,16 @@ variables:
   reads:
     - gitnexus_available
     - planning_folder_path
+  writes:
+    - name: storage_lifecycle
+      type: object
+      description: Storage lifecycle pairing table with optional invariant comparison.
+    - name: verdict_matrix
+      type: object
+      description: Complete verdict matrix and coverage attestation.
+    - name: verification_report
+      type: string
+      description: Scan completeness verification with gaps and re-scan recommendations
 required: false
 steps:
   - kind: technique

substrate-node-security-audit/activities/11-sub-static-analysis.yaml

@@ -6,6 +6,10 @@ variables:
   reads:
     - gitnexus_available
     - planning_folder_path
+  writes:
+    - name: storage_lifecycle
+      type: object
+      description: Storage lifecycle pairing table with optional invariant comparison.
 required: false
 steps:
   - kind: technique

substrate-node-security-audit/activities/12-sub-toolkit-review.yaml

@@ -6,6 +6,10 @@ variables:
   reads:
     - gitnexus_available
     - planning_folder_path
+  writes:
+    - name: verdict_matrix
+      type: object
+      description: Complete verdict matrix and coverage attestation.
 required: false
 steps:
   - kind: technique

substrate-node-security-audit/activities/14-sub-output-verification.yaml

@@ -5,6 +5,10 @@ description: Mechanically validate primary-agent output completeness.
 variables:
   reads:
     - planning_folder_path
+  writes:
+    - name: verification_report
+      type: string
+      description: Scan completeness verification with gaps and re-scan recommendations
 required: false
 steps:
   - kind: technique

substrate-node-security-audit/activities/15-sub-structured-merge.yaml

@@ -5,6 +5,11 @@ description: Structured merge, deduplication, and severity scoring of agent find
 variables:
   reads:
     - planning_folder_path
+  writes:
+    - name: reconciliation_table
+      type: object
+      description: Per-agent finding-count reconciliation, carrying an `unaccounted` count that is zero when the merge is lossless.
+      defaultValue: {}
 required: false
 steps:
   - kind: technique

work-package/activities/01-start-work-package.yaml

@@ -13,6 +13,9 @@ variables:
     - jira_issue_key
     - planning_folder_path
     - pr_number
+    - problem_statement
+    - requirements
+    - review_summary
     - target_path
     - target_repo
     - user_request
@@ -121,9 +124,17 @@ variables:
       type: string
       description: URL of the pull request for this work package (alongside pr_number).
       defaultValue: ""
+    - name: prior_feedback_triage
+      type: object
+      description: Triage of the reviewed PR's existing comments and review threads, one row per thread with its Confirmed, Refuted or Superseded disposition and the author and class of the original. Written as an artifact and carried in the bag, so the review summary reads the same triage the file records.
+      defaultValue: {}
     - name: project_type
       type: string
       description: Detected project type (e.g. rust-substrate); used to gate rust-substrate-specific validation steps.
+    - name: rating_cap
+      type: string
+      description: The ceiling the Overall Rating may not exceed, derived from the triage. When any prior comment is a blocker-class concern left unaddressed by the PR, the cap is the request-changes tier; otherwise the cap is unset and the rating is governed solely by the review's own findings.
+      defaultValue: ""
     - name: review_mode_ambiguous
       type: boolean
       description: True when review vs create intent cannot be derived confidently from the request.
@@ -143,6 +154,9 @@ variables:
       type: boolean
       description: True when the target repo allows squash merges (allow_squash_merge=true from GitHub API).
       defaultValue: false
+    - name: stakeholder_overview
+      type: string
+      description: The two-paragraph plain-language overview written under `{readme_section_heading}` in the planning folder README.
     - name: target_path
       type: string
       description: Feature worktree path for edits, builds, and PR ops (not host_repo_path).

work-package/activities/02-design-philosophy.yaml

@@ -13,6 +13,8 @@ variables:
     - issue_record
     - planning_folder_path
     - pr_number
+    - problem_statement
+    - requirements
     - target_path
     - target_repo
   writes:
@@ -42,6 +44,10 @@ variables:
     - name: problem_complexity
       type: string
       description: Problem complexity assessed during design-philosophy (simple|moderate|complex).
+    - name: problem_statement
+      type: string
+      description: A clear problem definition with system understanding, impact assessment, success criteria, and constraints — understandable without prior context.
+      defaultValue: ""
     - name: problem_type
       type: string
       description: Problem or inventive-goal classification (e.g. defect, inventive-improvement).

work-package/activities/03-requirements-elicitation.yaml

@@ -12,7 +12,9 @@ variables:
     - needs_research
     - planning_folder_path
     - pr_number
+    - problem_statement
     - question_domains
+    - requirements
     - target_path
     - target_repo
   writes:
@@ -42,6 +44,10 @@ variables:
     - name: open_assumptions
       type: array
       description: Residual open assumptions after analyse-challenge for batch presentation and optional individual forEach drill-down.
+    - name: requirements
+      type: array
+      description: The captured requirements list elicited across the domains.
+      defaultValue: []
 required: false
 steps:
   - kind: technique

work-package/activities/04-research.yaml

@@ -13,9 +13,14 @@ variables:
     - needs_comprehension
     - planning_folder_path
     - pr_number
+    - problem_statement
+    - requirements
     - target_path
     - target_repo
   writes:
+    - name: assumption_review_presentation
+      type: object
+      description: Structured judgement-augmentation context for decision, shaped like the Open Assumptions entry fields of the assumptions log template (decision space, non-resolvability rationale, technical context, agent's position, reversibility) plus a link to the assumptions log.
     - name: context_scope
       type: string
       description: Provenance scope of AI-generated code in this work package.