fix: harden topology-satisfied handoff guidance v2

[Stahl-G]

Summary

• re-apply the reviewed topology-satisfied handoff hardening from fix: harden topology-satisfied handoff guidance #346 after the revert
• add structured forbidden replay actions for topology-satisfied Screener stages in handoff protocol
• make default topology handoff/runtime prompts explicitly forbid Screener delegation and stage-complete --stage screener
• keep strict topology as the independent Screener path

Review Context

• Re-applies reviewed commit 18bd6c6 as a fresh v2 PR instead of reusing the merged/reverted fix: harden topology-satisfied handoff guidance #346 state.
• This PR should be reviewed normally before merge.

Validation

• python3 -m pytest -q tests/test_start_commands.py tests/test_status_commands.py tests/test_hermes_adapter.py tests/test_subagent_first_contract.py tests/test_agent_config_generation.py
• python3 scripts/generate_agent_configs.py --check
• python3 scripts/check_product_baseline.py
• python3 scripts/check_release_consistency.py --no-tag
• git diff --check
• non-editable install + scripts/ci/smoke_packaged_topology_handoff.py

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 983dd64456

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restrict replay bans to satisfied target stages

When a workspace uses policy.role_topology=human_assisted, this helper also adds state stage-complete --stage analyst and --stage editor to the generated forbidden replay actions because it applies to every topology_satisfaction rule, not just Screener. That conflicts with the actual runtime path: configs/stage_specs.yaml marks analyst/editor as satisfied_by: writer, and the runtime advances human-assisted runs by completing stage-complete --stage analyst (see tests/test_runtime_state.py:3017). The resulting handoff tells operators not to run the transaction that freezes analyst_draft_snapshot and advances to auditor, so human-assisted runs can get stuck; please limit these forbidden actions to topology-satisfied downstream targets like Screener or derive them from the satisfier/trigger stage.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d7c4ba413

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Synchronize the checked-in Hermes skill

When adding this explicit default-topology replay ban to render_hermes_skill(), the repo-shipped Hermes skill assets were left unchanged: .agents/hermes-skills/multi-agent-brief-hermes/SKILL.md and its references/delegate-task-sequence.md still do not mention the new state stage-complete --stage screener prohibition. Source-clone Hermes users can load those checked-in skill files directly instead of reinstalling a freshly rendered skill, so they would continue to get the stale guidance this change is trying to harden; please update the checked-in Hermes skill/reference (and a contract test) as well.

Useful? React with 👍 / 👎.