---
name: gpt-workflow
description: Use when main coordinator must run a multi-task ask-gpt Pro implementation, fresh review, correction, integration, landing, deployment, and proof workflow through pinned GPT model roles.
argument-hint: "<objective|plan-path> [task IDs]"
---

# GPT Workflow

audience: AI coding agents first.

Main session is sole orchestrator. Pin every decision before dispatch. Workers execute; workers NEVER orchestrate.

Read `/gpt-orchestrator` first. It owns current ask-gpt CLI, packaging, send queue, conversation recovery, hostile artifact validation, ledger states, and delivery mechanics. This skill adds strict model roles, immutable review identity, correction routing, and landing authority. Do NOT duplicate or weaken `/gpt-orchestrator`.

## Hard boundary

Main coordinator MUST author:

1. task decomposition;
2. dependencies and wave order;
3. exact allowed/read-only files;
4. immutable baseline commit/tree;
5. task package and implementation prompt;
6. acceptance commands;
7. review package and rubric;
8. correction brief;
9. integration and deployment contract.

Subagents MUST NOT invoke `cdx`, Codex, ask-gpt, Factory, Workflow, Agent, cursor, or any other offload mechanism unless main explicitly launches a Luna transport call defined below. Ordinary subagents execute one bounded task directly, report evidence, then stop.

```text
DO NOT: worker decomposes objective → dispatches children → chooses architecture
TARGET: main pins task/package/prompt → worker executes exact contract → main validates receipt
```

## Roles

| Role | Model | Authority |
|---|---|---|
| Coordinator | main session | Sole decomposition, scheduling, package/prompt authoring, evidence validation, correction routing |
| Implementation transport | GPT-5.6 Luna, max | Mechanically send one pinned ask-gpt Pro prompt; reconcile identity; download and validate bytes |
| Review transport | separate GPT-5.6 Luna, max | Mechanically send one fresh pinned ask-gpt Pro review; retrieve and validate verdict bytes |
| Correction transport | GPT-5.6 Luna, max | Mechanically resume original implementation conversation with coordinator-authored correction package |
| Integrator | GPT-5.6 Terra, medium | Apply one approved immutable delta to refreshed main; resolve semantic conflicts; verify, land, deploy, prove |

Luna MUST NOT design, decompose, review, fix, apply, integrate, land, or interpret model output. Terra MUST NOT dispatch children, bypass review, broaden scope, or weaken gates.

## Capacity and queue

- Maximum eight concurrent worker calls.
- ALL new and resumed ask-gpt prompts share ONE main-owned send queue.
- Keep confirmed prompt starts 55–75 seconds apart.
- Downloads/list/search need no spacing.
- Never let each Luna run an independent timer or dispatcher.
- Generation/review MAY overlap only for disjoint tasks.
- Application/landing MUST serialize when files, contracts, migrations, or runtime targets overlap.

## Task envelope

Before implementation dispatch, ledger MUST record:

```text
Task ID:
Acceptance:
Allowed files:
Read-only files:
Dependencies:
Baseline commit:
Baseline tree:
Package path/SHA-256/inventory:
Implementation prompt SHA-256:
Worker:
State:
Current receipt:
Next executable action:
```

Missing field → `BLOCKED`. Never ask Luna to fill it.

## Implementation transport

Main launches one Luna call with exact package path/hash/inventory and exact operational prompt. Luna MUST:

1. verify package identity and safety;
2. wait for main-owned send slot;
3. send exactly one `ask-gpt --effort pro` prompt;
4. record conversation ID, URL, account, executing identity, send time, output/error paths;
5. reconcile wrapper failure before any retry;
6. download real attachments into fresh quarantine;
7. validate archives/scripts as hostile per `/gpt-orchestrator`;
8. return transport facts only.

Luna MUST NOT apply generated files. Model prose is not artifact evidence.

## Immutable review package

Main builds review package AFTER artifact validation. Include:

- authoritative `TASK.md` and applicable instructions;
- immutable baseline source bound to `BASELINE_COMMIT` and `BASELINE_TREE`;
- candidate source bound to `CANDIDATE_TREE`;
- binary-safe `baseline..candidate` diff and `DIFF_SHA256`;
- changed-path manifest and `CHANGED_PATHS_SHA256`;
- implementation conversation ID;
- implementation artifact SHA-256 and inventory;
- mechanical archive-validation receipt;
- exact review rubric and verdict schema.

Review MUST NOT use a moving worktree, narration-only summary, unverified generated file, or unspecified base.

Before send, review Luna verifies every identity/hash. Any mismatch → `BLOCKED`.

```text
DO NOT: “review files in this worktree”
TARGET: “review BASELINE_TREE X → CANDIDATE_TREE Y; diff SHA-256 Z; allowed paths A”
```

## Fresh review

Use a separate Luna/max transport and a FRESH ask-gpt Pro conversation. Reviewer receives only coordinator-built review package. Reviewer MUST:

1. bind verdict to task, baseline, candidate, diff, and artifact hashes;
2. review only changed allowed paths;
3. report concrete scenario, defect, file/line, and required fix;
4. never edit or run tests;
5. return real downloadable verdict bytes; no prose fallback.

Main independently checks Luna receipt and verdict identity against local Git/artifact evidence.

## Correction loop

Blocking finding → `CORRECTION_REQUIRED`.

1. Main verifies finding.
2. Main authors bounded correction package with exact finding, current candidate diff, failed evidence, preserved correct files, and required delta.
3. Correction Luna RESUMES original implementation conversation. Never start fresh by default.
4. Download replacement into fresh quarantine; repeat hostile validation.
5. Main constructs new candidate tree, diff, hashes, and changed manifest.
6. Separate Luna drives another FRESH ask-gpt Pro review.
7. Repeat until approved or proven irrecoverable.

Never let Luna invent correction text. Never let reviewer output patch source.

## Local verification

Reviewer approval is necessary, never sufficient. Main assigns direct deterministic verification. Generated test claims are untrusted.

- Run focused regression first.
- Run project-native required gates.
- Address every error, warning, notice, and security-gate line.
- Model-backed verification MUST use project-approved fixture wrapper.
- Changed local diff MUST still equal reviewed candidate identity.

Verification delta → fresh review.

## Terra integration and landing

Main assigns one Terra/medium worker one approved task. Terra receives immutable reviewed package, latest-main integration contract, exact commands, and allowed paths.

Terra MUST:

1. fetch canonical remote and create fresh task-owned worktree;
2. verify reviewed baseline/candidate/diff identities;
3. apply only approved semantic delta;
4. resolve semantic conflicts from current contracts/tests;
5. stop and return `CORRECTION_REQUIRED` when current main changes behavior or required diff;
6. run deterministic focused/full gates without warnings;
7. commit only allowed files;
8. invoke repository guarded landing command;
9. refresh/revalidate if main moves;
10. deploy/install through canonical path;
11. prove installed SHA and real owner-visible entrypoint;
12. record rollback and exact receipt.

Terra MUST NOT hand-type merge/push cascades, force, suppress signals, or decide that an unreviewed integration delta is “close enough.”

## Completion

`DONE` requires:

- reviewed immutable artifact;
- local deterministic clean verification;
- landed canonical commit;
- canonical deploy/install/arm;
- installed-entrypoint proof;
- ledger receipt with exact identities;
- preserved recovery path;
- no unowned child/process/conversation.

Local commit, green worktree, reviewer approval, or deployment claim alone is NOT done.

## Agent death and handoff

Process death NEVER means cancellation. Before stop/compaction, persist:

- assigned tasks;
- child process/conversation identities;
- WIP paths/refs;
- package/artifact hashes;
- last receipt and blocker;
- next executable action.

Replacement reconstructs from transcript, task registry, plans, artifacts, and prior output before new work. Never restart from scratch solely because worker disappeared.

## Maintenance

Update this skill when a real run proves a generalized workflow defect.

1. Record failure and correction in durable plan/ledger.
2. Confirm lesson applies beyond one task.
3. Main authors minimal skill change and deterministic contract test.
4. Independent review checks no authority drift.
5. Install live, invoke, guarded-land, deploy, and byte-verify.

NEVER self-edit from model opinion, one-off preference, or unverified narration.

## Stop conditions

Stop affected lane, preserve evidence, continue independent lanes when:

- task/package/review identity mismatch;
- active conversation identity unresolved;
- missing or unsafe attachment;
- scope overlap lacks one writer;
- baseline moved and semantic equivalence is unproved;
- warning/gate/security finding remains;
- deploy/runtime proof fails;
- worker attempts orchestration or offloading outside pinned Luna transport role.