refactor: decomposition WIP (orchestrator/server/execution-plan)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhFXmKe4WisSSPf9LrmmTg

examples/workflows/prompts/architect_freestyle.md

@@ -28,7 +28,9 @@ Emit a JSON object that validates against the `execution_plan` schema:
       "produces": "<unique artifact_id this stage emits, your choice of name>",
       "kind": "<one of the available artifact kinds listed in your context>",
       "needs": ["<artifact_id consumed from an earlier stage>"],
-      "tools": ["file_read", "file_write", "file_edit", "shell"]
+      "tools": ["file_read", "file_write", "file_edit", "shell"],
+      "writes": ["<workspace-relative path or glob this stage will write>"],
+      "touches": ["<glob the stage is confined to, e.g. frontend/**>"]
     }
   ],
   "edges": [
@@ -79,6 +81,14 @@ Emit a JSON object that validates against the `execution_plan` schema:
     decompose tasks here — task creation is out of scope for the plan.
 - Keep stages small and single-responsibility. Prefer more stages over large monolithic
   prompts.
+- **Declare `touches` to fence a stage to its area.** When a stage's job belongs to one part of
+  the tree (a frontend/client stage → `["frontend/**"]`; a stage that edits only the API layer →
+  `["apps/server/**"]`), list those globs in `touches`. Every concrete path the stage `writes`
+  must fall within its `touches`, or the plan is rejected at compile time. This is how you stop a
+  stage from silently widening past its intent — e.g. a "build the web approval **client**" stage
+  that also starts adding backend routes. Set `touches` narrowly on any stage whose scope is a
+  single area; omit it only for genuinely cross-cutting stages. If a change truly needs a
+  different area, give it its own stage that owns that area rather than widening an unrelated one.
 - **Prefer the real scaffolder over hand-writing config.** A stage that sets up a project should
   use the package manager's own generator — e.g. `npm create vite@latest <dir> -- --template
   react-ts` — because it produces a correct, complete, current file set (a hand-written