flow

Your working contract is the rules; their digest is injected at session start - read ${CLAUDE_PLUGIN_ROOT}/core/RULES.md in full only if that digest is not in your context. Read the plan, implement, and review stages from ${CLAUDE_PLUGIN_ROOT}/core/lifecycle.yaml - their artifacts and gates are authoritative and define the transitions below; do not hardcode them. This runner is a meta-command, not a lifecycle stage: it holds no stage logic of its own and hardcodes no agent list. Each stage's own SKILL.md owns its orchestration - agents, the red-green loop, the panel, the gates - so execute those procedures and never restate them.

Span: plan, then implement, then review, in one unattended session. Discuss stays manual because it is dialogic - the scoper and rubber-duck question the developer, so it cannot run unattended - and acceptance stays manual under the human-only gate. The runner chains neither.

1. Entry gate - require a pinned scope that carries criteria: bash ${CLAUDE_PLUGIN_ROOT}/bin/workspace.sh resolve --repo . to locate the active workspace (never mint; on ambiguity or no-active-task, surface the script's message and stop). If the resolved workspace has no scope.md, refuse and point the developer to /harmonia:discuss - the runner starts from an already-pinned scope and never mints or auto-scopes. With scope.md present, gate its criteria before any work: run bash ${CLAUDE_PLUGIN_ROOT}/bin/check-criteria.sh --workspace <resolved-workspace> --repo . and halt on a non-zero exit - a criteria-less or non-machine-checkable scope is refused up front and pointed to /harmonia:discuss, the same refusal as the no-scope path (the check writes a status-validated receipts/check-criteria.json; the implement gate re-runs it, redundant but harmless). With scope and criteria confirmed, clear this run's stale prior-run output before any transition runs by calling bash ${CLAUDE_PLUGIN_ROOT}/bin/workspace.sh clear-span --repo .; the subcommand names the span out-artifacts and confines the removal to the resolved workspace, so this runner does not restate that file list (it lives in bin/workspace.sh). scope.md is the pinned input and is never removed.
2. Plan: execute the plan stage per ${CLAUDE_PLUGIN_ROOT}/skills/plan/SKILL.md. Scope is present, so the scoper consumes and refines it and never re-mints. Before advancing, confirm the plan stage wrote its design.md out-artifact to the workspace; if it did not, halt and hand back.
3. Implement: execute the implement stage per ${CLAUDE_PLUGIN_ROOT}/skills/implement/SKILL.md. Its pre-implement gate runs check-criteria. Inspect that gate's signal directly: halt when receipts/check-criteria.json records a status other than pass, or when check-criteria exits non-zero. On that signal the criteria are not machine-checkable, so implement writes no code - a stop before any work begins, unlike the review halt in step 5 which stops after the work with verdict.md already on disk. Halt and hand back with the failing-criteria report and its receipt (receipts/check-criteria.json); do not advance.
4. Advance to review - unconditional: once the implement stage has written its boundary.md and diff-summary.md out-artifacts, advance to review whether the red-green loop completed or exited incomplete at its max_rounds cap. The cap is not a gate failure; the loop records the disagreement in the workspace for the review lead to arbitrate.
5. Review: execute the review stage per ${CLAUDE_PLUGIN_ROOT}/skills/review/SKILL.md. Take its verdict.md as authoritative. Halt on a failing review gate: if the verdict is not a pass because a criteria-run or receipts gate failed, or because a test-immutability violation was recorded, stop and hand back with verdict.md on disk. Never override the lead's verdict.
6. Stop before capture - hand back: the runner ends after review. It never writes the accepted marker and never runs bash ${CLAUDE_PLUGIN_ROOT}/bin/workspace.sh accept - acceptance is a human act. Never run accept on the developer's behalf. Hand back a summary telling the developer to exercise the built behavior, record acceptance via /harmonia:accept, then invoke /harmonia:capture as a separate manual act. The runner never enters capture.

Pass workspace paths, not prose recaps. Orchestrate only.