feat(workflow): tasked execution loop replaces role_pipeline

role_pipeline.toml is now analyst → architect → decomposer → loop(claim →
implement → review) → done. The decomposer (require_task_decompose) breaks
the design into a task graph; the implementer stage claims the next ready
task on entry (claim_task = true, kernel-driven) with writes auto-scoped to
the task's affected_paths and propose_scope as the operator-approved widen
valve. The loop is gated by the tasks_ready predicate.

Loop precedence rides the resolver's by-id transition ordering (review-1/2/3)
to avoid composite all_of/not conditions in the flat TOML schema: changes →
implementer, approved+tasks_ready → implementer, else → done.

TomlWorkflowLoader gains a claim_task stage field (→ claimTask metadata) and
extracts the metadata build into StageSection.toMetadata. RolePipelineWorkflowTest
rewritten for the tasked graph.

examples/workflows/role_pipeline.toml

@@ -1,13 +1,20 @@
-# Role pipeline: analyst → architect → brief_echo → planner → implementer ⇄ reviewer
+# Role pipeline: analyst → architect → decomposer → ⟲(claim → implement → review)⟲ → done
 #
-# Each stage produces a typed artifact that the next stage `needs`, so work flows forward
-# without a human relaying notes. The decision journal (pinned into every stage's context)
-# carries steering/approvals/verdicts across the whole run, so the reviewer sees the same
-# ground truth as the planner.
+# The architect's design is broken into a task graph by the decomposer, then a single loop
+# drains those tasks one at a time. Each implementer entry deterministically CLAIMS the next
+# ready task (claim_task = true) — the kernel picks it, not the LLM — and injects that task's
+# acceptance criteria + blockers as L0 context. While a task is claimed, file writes are
+# auto-scoped to its affected_paths; the implementer widens scope only via propose_scope
+# (operator-approved). The loop is gated by the tasks_ready predicate, so it exits when the
+# board is drained.
 #
-# The implementer⇄reviewer loop is gated by review_report.verdict:
-#   approved          → done
-#   changes_requested → back to implementer (capped by implementer.max_retries, then escalates)
+# Loop control depends on transition ORDERING. The resolver evaluates a stage's outgoing
+# transitions sorted by transition id and takes the first whose condition holds, so the
+# reviewer edges are named review-1/2/3 to force this precedence:
+#   1. review-1-changes  (verdict ≠ approved)            → implementer  (fix the current task)
+#   2. review-2-more     (tasks_ready)                   → implementer  (approved: claim next)
+#   3. review-3-done     (always_true, fallthrough)      → done         (approved + board empty)
+# This avoids needing composite (all_of/not) conditions in the flat TOML schema.
 #
 # Requires these artifact kinds in ~/.config/correx/config.toml (schemas under docs/schemas/):
 #   [[artifacts]]
@@ -15,11 +22,7 @@
 #   [[artifacts]]
 #   id = "design";        schema_path = "schemas/design.json";        llm_emitted = true
 #   [[artifacts]]
-#   id = "impl_plan";     schema_path = "schemas/impl_plan.json";     llm_emitted = true
-#   [[artifacts]]
 #   id = "review_report"; schema_path = "schemas/review_report.json"; llm_emitted = true
-#   [[artifacts]]
-#   id = "brief_echo";    schema_path = "schemas/brief_echo.json";    llm_emitted = true
 #
 # Prompt files (prompts/*.md, relative to this workflow) must exist for a real run.
 
@@ -47,61 +50,42 @@ produces = [{ name = "design", kind = "design" }]
 token_budget = 16384
 max_retries = 2
 
-# 3a. Before planning: echo the analyst brief back as a structured artifact.
-#     The brief_echo gate diffs the restatement against the original analysis;
-#     on divergence (dropped requirements or hallucinated files) it fails the
-#     stage (retryable) so the pipeline cannot reach plan generation on a misread brief.
+# 3. Break the design into a task graph via task_decompose. require_task_decompose is a
+#    deterministic kernel gate: stage_complete is blocked until task_decompose (or task_create
+#    for a trivial single-task request) returns. Each child carries acceptance_criteria and
+#    affected_paths — those drive the per-task L0 context and the per-task write scope below.
 [[stages]]
-id = "brief_echo"
-prompt = "prompts/brief_echo.md"
-needs = ["analysis"]
-produces = [{ name = "brief_echo", kind = "brief_echo" }]
-brief_echo = true
-token_budget = 8192
-max_retries = 2
-
-# 3b. Break the design into ordered, verifiable steps.
-[[stages]]
-id = "planner"
-prompt = "prompts/planner.md"
+id = "decomposer"
+prompt = "prompts/task_planner.md"
 needs = ["design"]
-produces = [{ name = "impl_plan", kind = "impl_plan" }]
+allowed_tools = ["file_read", "ShellTool", "task_search", "task_context", "task_decompose", "task_create"]
+require_task_decompose = true
 token_budget = 16384
 max_retries = 2
 
-# 4. Implement the plan. Writes files (jailed to the workspace). The loop target —
-#    max_retries here caps how many review→implement refinement rounds are allowed.
-#    Optional: a `writes` manifest (workspace-relative globs) hard-bounds where this
-#    stage may write — a FILE_WRITE outside it is blocked as scope creep. Left open
-#    here because the targets are task-specific; a task-scoped workflow would set e.g.
-#      writes = ["core/sessions/**", "testing/sessions/**"]
-#    Optional: `static_analysis` runs deterministic tools (compiler/detekt/formatters)
-#    against the patch BEFORE the reviewer (role-reliability §5). A non-clean command
-#    fails this stage retryably with its output fed back verbatim, so only static-clean
-#    code reaches the reviewer — the reviewer never spends inference on what tools catch
-#    for free. Commands are workspace-specific, so left commented; a Kotlin/Gradle repo
-#    would set e.g.
-#      static_analysis = ["./gradlew compileKotlin -q", "./gradlew detekt -q"]
+# 4. Implement one task. claim_task = true: on entry the kernel claims the next ready task
+#    (or re-surfaces the one already claimed on a review bounce) and injects its acceptance
+#    criteria as L0. Writes are auto-jailed to the claimed task's affected_paths; propose_scope
+#    is the operator-approved valve to widen that scope mid-task.
 [[stages]]
 id = "implementer"
 prompt = "prompts/implementer.md"
-needs = ["impl_plan"]
 produces = [{ name = "patch", kind = "file_written" }]
+claim_task = true
 allowed_tools = [
-    "file_read", "file_write", "file_edit", "ShellTool",
+    "file_read", "file_write", "file_edit", "ShellTool", "propose_scope",
     "task_create", "task_update", "task_context", "task_search",
 ]
-# static_analysis = ["./gradlew compileKotlin -q", "./gradlew detekt -q"]
 token_budget = 32768
 max_retries = 3
 
-# 5. Review the patch against the plan AND the analyst's acceptance criteria. The reviewer
-#    needs `analysis` so it judges the diff against concrete, pre-stated criteria (§5 narrow
-#    question) rather than whole files against taste.
+# 5. Review the patch against the claimed task's acceptance criteria and the analyst's brief.
+#    On approval the reviewer marks the task done via task_update — that drops it from the
+#    active claim so the next implementer entry claims a fresh task and the loop advances.
 [[stages]]
 id = "reviewer"
 prompt = "prompts/reviewer.md"
-needs = ["patch", "impl_plan", "analysis"]
+needs = ["patch", "analysis"]
 produces = [{ name = "review_report", kind = "review_report" }]
 allowed_tools = ["task_context", "task_update"]
 token_budget = 32768
@@ -117,25 +101,18 @@ condition_type = "artifact_validated"
 condition_artifact_id = "analysis"
 
 [[transitions]]
-id = "architect-to-brief-echo"
+id = "architect-to-decomposer"
 from = "architect"
-to = "brief_echo"
+to = "decomposer"
 condition_type = "artifact_validated"
 condition_artifact_id = "design"
 
+# Only proceed to implementation once the decomposer actually produced ready tasks.
 [[transitions]]
-id = "brief-echo-to-planner"
-from = "brief_echo"
-to = "planner"
-condition_type = "artifact_validated"
-condition_artifact_id = "brief_echo"
-
-[[transitions]]
-id = "planner-to-implementer"
-from = "planner"
+id = "decomposer-to-implementer"
+from = "decomposer"
 to = "implementer"
-condition_type = "artifact_validated"
-condition_artifact_id = "impl_plan"
+condition_type = "tasks_ready"
 
 [[transitions]]
 id = "implementer-to-reviewer"
@@ -144,20 +121,11 @@ to = "reviewer"
 condition_type = "artifact_validated"
 condition_artifact_id = "patch"
 
-# --- verdict-gated loop exit / re-entry ---
+# --- verdict + task-board gated loop (id order = evaluation precedence, see header) ---
 
+# 1. Changes requested → keep refining the current (still-claimed) task.
 [[transitions]]
-id = "review-approved"
-from = "reviewer"
-to = "done"
-condition_type = "artifact_field_equals"
-condition_artifact_id = "review_report"
-condition_field = "verdict"
-condition_value = "approved"
-condition_operator = "eq"
-
-[[transitions]]
-id = "review-changes-requested"
+id = "review-1-changes"
 from = "reviewer"
 to = "implementer"
 condition_type = "artifact_field_equals"
@@ -165,3 +133,17 @@ condition_artifact_id = "review_report"
 condition_field = "verdict"
 condition_value = "approved"
 condition_operator = "neq"
+
+# 2. Approved and tasks remain → claim the next one.
+[[transitions]]
+id = "review-2-more"
+from = "reviewer"
+to = "implementer"
+condition_type = "tasks_ready"
+
+# 3. Approved and the board is drained → done (fallthrough).
+[[transitions]]
+id = "review-3-done"
+from = "reviewer"
+to = "done"
+condition_type = "always_true"