Suede Graph Flo Xr

Suede Graph Flo XR

Use the bundled workflows/suede-graph-flo-xr.js workflow to search competing plans for one multi-file repository change. It makes an evidence-backed selection before any implementation lane mutates the worktree.

Intake and budget gate

Before launch, require all three inputs:

• Repo: an absolute repository path. Relative paths and ~ fail closed.
• Scope: the requested multi-file change, including any protected paths or constraints.
• Budget: light, standard, or deep.

Also detect and pass optional context when available: deploys (whether the repo has a deploy surface), liveUrl (the read-only production surface), and vault (the external decision/handoff context path). Their absence does not block a non-deploying repository, but do not silently discard known values.

When the user names a model for the workers (workerModel: sonnet, opus, haiku, or fable), pass it: every worker call then runs on that model while orchestration stays on the session model. Omitted, workers inherit the session model silently; if the session sits on an expensive model and the user did not choose it for workers, say so before launch instead of letting the default decide. A run can spend up to 200 worker calls, so an unchosen inherited model is a cost decision nobody made.

If repo or scope is missing, halt. Report the missing input in one line, offer to provide the repo path, describe the desired change, or route a one-file edit to direct implementation, then wait for the user's choice.

State the selected range and projected worst-case calls before launching: light projects and permits 55, standard projects and permits 110, and deep projects and permits 200 total agent calls. Do not infer a budget from scope or silently raise a ceiling. If the user has not chosen one, ask and wait.

Runtime prerequisites

The bundled JavaScript workflow is a Claude Code workflow for macOS. It requires sandbox-exec and the six registered suede-graph-flo-xr-* agent profiles. Install the full suede-skills plugin, the suede-agent-workflows plugin, or use this repository's install.sh, which copies the profiles into ~/.claude/agents.

Claude Workflow exposes no Node process global, so the workflow cannot infer its package namespace. The calling skill must derive it from how this skill was invoked and pass it on every launch. When the invoked name carries a plugin prefix, agentNamespace is that prefix verbatim: suede-skills from the full plugin, suede-agent-workflows from the focused orchestration plugin. A bare invoked name with no prefix, installed by install.sh or copied by hand, takes the empty string. This is runtime context, not a user choice. A missing or unknown value fails before the first agent call.

The workflow also cannot locate its own bundled helper scripts. Pass helperDir: the absolute path of the invoked skill's workflows/helpers directory (for this install, <skill base directory>/workflows/helpers). The clamped Bash commands run these .cjs helpers: the per-spawn clamp cannot verify a rule that is multi-line or longer than roughly 400 characters, so inline node -e payloads are not usable. A missing or whitespace-containing path fails before the first agent call; a missing helper file surfaces as the Scout setup failure. Payload-carrying helper invocations are admitted by pinned prefixes (helper path plus worktree, temp root, or base SHA) rather than exact strings; each helper validates its remaining argv, and the diff attestations, not the clamp, remain the check that what was applied matches the selected bundle.

The selected patch reaches the applier as bounded base64 chunks staged into the run's private temp root, because the clamp verifier cannot parse a command carrying a multi-kilobyte inline payload. Each append carries its offset and an FNV-1a checksum, and --apply verifies total length and payload checksum before decoding, so a mistyped chunk fails fast with a retry instruction instead of producing a corrupt patch.

A skill-folder-only install, a generic skills-CLI install, and the Codex plugin do not by themselves register or execute Claude Workflow agent profiles. In those environments, treat this file as the orchestration contract and route the change to direct implementation; do not claim the bundled workflow ran. To enable it in Claude Code after a manual single-skill copy, also copy the skill's bundled agents/suede-graph-flo-xr-*.md files into ~/.claude/agents and restart Claude Code.

The requested Scout setup command probes /usr/bin/sandbox-exec as its first subprocess, before fetch or worktree creation. If that command is invoked and the probe fails, Scout reports failure before its setup mutation. The returned Scout evidence is still a model attestation, not a host execution receipt. Gate also holds on any later reported sandbox rejection. Never retry an acceptance command outside the sandbox to turn that hold into a pass.

Run the graph search

Invoke:

Workflow({
  scriptPath: "skills/suede-graph-flo-xr/workflows/suede-graph-flo-xr.js",
  args: { repo, scope, agentBudget, agentNamespace, helperDir, workerModel, deploys, liveUrl, vault }
})

The workflow executes these operations in dependency order:

1. Generate independent implementation plans from the scout and research evidence.
2. Score each plan for coverage, evidence, feasibility, safety, and efficiency.
3. KeepBestN deterministically prunes the scored beam.
4. Refute attacks the surviving plans with evidence-backed objections.
5. Improve repairs plans whose refutations are not fatal.
6. Aggregate combines compatible surviving lanes without merging conflicting file ownership.
7. Select chooses one deterministic winner.

Only the plan selected by Select may mutate files. Rejected, pruned, and unselected thoughts remain evidence only; never build them speculatively.

Boundaries

The workflow halts before the next agent call or entire mutating batch when its budget is exhausted; it does not undo mutations that completed earlier. It halts before any mutation unless an independent read-only verifier confirms a clean, registered origin/main worktree at one direct ${REPO}.worktrees/ship-* child with the same Git common directory and non-symlink candidate files whose realpaths remain inside it. Case-folded or Unicode-normalized path aliases fail closed before graph search. It also halts for a tracked secret, a live target worktree, a protected-WIP collision, a duplicate file owner, an overflowed safety manifest, or no selectable plan. Scout parses NUL-delimited Git porcelain so both sides of renames remain protected, parses lsof -Fn CWD fields with path-component boundaries, and never discards fresh dirty or live claims merely because committed history was cherry-landed. A selected Build or Fix result that is blocked, missing context, fails, or reports no changed path also halts before the next verification stage; a result that is done with stated concerns proceeds, and its concerns travel into the review stage and the handoff. Patch authors receive the whole scope checklist as contract context, so a name another lane pins is imported, not guessed. On a halt, name the blocker in one line and offer 2–4 applicable resolutions (for example: narrow scope, exempt protected WIP, resolve the collision, choose a higher budget, or provide missing context), and wait. Do not relaunch or mutate while halted.