feat(review): emit Step 3A's fan-out as a workflow instead of a roster

packages/cli/src/commands/review.test.ts

@@ -50,6 +50,7 @@ describe('reviewCommand', () => {
       'comment-status',
       'load-rules',
       'agent-prompt',
+      'emit-workflow',
       'build-test',
       'base-tree',
       'test-delta',

packages/cli/src/commands/review.ts

@@ -25,6 +25,7 @@ import { publishAssetsCommand } from './review/publish-assets.js';
 import { resolveAnchorsCommand } from './review/resolve-anchors.js';
 import { checkCoverageCommand } from './review/check-coverage.js';
 import { agentPromptCommand } from './review/agent-prompt.js';
+import { emitWorkflowCommand } from './review/emit-workflow.js';
 import { buildTestCommand } from './review/build-test.js';
 import { baseTreeCommand } from './review/base-tree.js';
 import { testDeltaCommand } from './review/test-delta.js';
@@ -57,6 +58,7 @@ export const reviewCommand: CommandModule = {
       .command(commentStatusCommand)
       .command(loadRulesCommand)
       .command(agentPromptCommand)
+      .command(emitWorkflowCommand)
       .command(buildTestCommand)
       .command(baseTreeCommand)
       .command(testDeltaCommand)
@@ -78,7 +80,7 @@ export const reviewCommand: CommandModule = {
       .command(cleanupCommand)
       .demandCommand(
         1,
-        'Specify a subcommand: run, parse-args, match-remote, fetch-pr, capture-local, plan-diff, repo-context, pr-context, comment-status, load-rules, agent-prompt, build-test, base-tree, test-delta, drive, mock-provider, extract-step, script-lint, resolve-anchors, check-coverage, cost-ledger, presubmit, test-efficacy, test-plan, findings, publish-assets, compose-review, save-artifact, submit, or cleanup.',
+        'Specify a subcommand: run, parse-args, match-remote, fetch-pr, capture-local, plan-diff, repo-context, pr-context, comment-status, load-rules, agent-prompt, emit-workflow, build-test, base-tree, test-delta, drive, mock-provider, extract-step, script-lint, resolve-anchors, check-coverage, cost-ledger, presubmit, test-efficacy, test-plan, findings, publish-assets, compose-review, save-artifact, submit, or cleanup.',
       )
       .version(false),
   handler: () => {

packages/cli/src/commands/review/agent-prompt.ts

@@ -1565,12 +1565,15 @@ export function findingsSection(
  * Build one agent's brief and launch prompt, write the brief beside the plan, and
  * return the key and the prompt for the caller to record and print.
  *
- * One body for both callers on purpose: the single-agent path and `--roster` must
- * emit byte-identical prompts for the same agent, because the delivery check
- * compares agents against records — a drift between the two paths would read as a
- * rewritten launch on a run that did everything right.
+ * One body for every caller on purpose: the single-agent path, `--roster` and
+ * `emit-workflow` must emit byte-identical prompts for the same agent, because
+ * the delivery check compares agents against records — a drift between the
+ * paths would read as a rewritten launch on a run that did everything right.
+ * Exported for that reason: a third caller that rebuilt this would be a second
+ * implementation of the invariant, and byte-parity would become something a
+ * test asserts rather than something the code cannot break.
  */
-function buildLaunch(
+export function buildLaunch(
   report: PlanReport,
   planPath: string,
   spec: {
@@ -1619,6 +1622,44 @@ function buildLaunch(
   return { key, prompt: buildChunkLaunchPrompt(report, id, briefFile) };
 }
 
+/**
+ * Every launch the plan's roster requires, built through `buildLaunch` and
+ * matched to the roster's keys under one guard.
+ *
+ * The roster is what coverage holds the run to, and the key is what the
+ * records and briefs are written under. They are derived in two files, and if
+ * they ever disagree, every delivery check downstream reads "brief never
+ * reached an agent" on a run that did everything right. Both dispatchers —
+ * `--roster` and `emit-workflow` — consume this one mapping so the guard
+ * exists once; a caller that rebuilt the loop would be a second implementation
+ * of the invariant.
+ */
+export function buildRosterLaunches(
+  report: PlanReport,
+  planPath: string,
+  rules?: string,
+): Array<{ req: RequiredAgent; key: string; prompt: string }> {
+  const roster = requiredAgents(report as RosterPlan);
+  return roster.map((req) => {
+    const { key, prompt } = buildLaunch(
+      report,
+      planPath,
+      req.role === 'chunk'
+        ? { chunk: req.chunk }
+        : { role: req.role, file: req.file },
+      rules,
+    );
+    if (key !== req.key) {
+      throw new Error(
+        `built "${key}" where the roster requires "${req.key}" — the ` +
+          'record could never be matched to the requirement. This is a bug ' +
+          'in the CLI, not in the call.',
+      );
+    }
+    return { req, key, prompt };
+  });
+}
+
 /**
  * The digest that keys a findings role's record and brief: the identity of the
  * launch material the key must tell apart — the findings list AND the effective
@@ -1712,7 +1753,7 @@ function findingsFileFor(
  * paste to an agent as if the CLI wrote it. Control characters are flattened to
  * spaces, and the separator glyph is stripped so a name cannot imitate one.
  */
-function rosterLabel(req: RequiredAgent): string {
+export function rosterLabel(req: RequiredAgent): string {
   if (req.role === 'chunk') return `chunk ${req.chunk}`;
   // The brief's label already reads `Agent 1a: Line-by-line correctness`; the
   // rebuild hint downstream names roles, so keep the id visible when the label
@@ -1737,29 +1778,10 @@ function runRoster(report: PlanReport, planPath: string, rules?: string): void {
   // The roster reads `plan.effort` (written by the capturing command), so a
   // `medium` plan builds the reduced set here without an `--effort` flag — and
   // `check-coverage` holds the run to that same set from the same field.
-  const roster = requiredAgents(report as RosterPlan);
-  const blocks = roster.map((req, i) => {
-    const { key, prompt } = buildLaunch(
-      report,
-      planPath,
-      req.role === 'chunk'
-        ? { chunk: req.chunk }
-        : { role: req.role, file: req.file },
-      rules,
-    );
-    // The roster is what coverage checks; the key is what this command records
-    // under. They are derived in two files, and if they ever disagree, every
-    // delivery check downstream reads "brief never reached an agent" on a run
-    // that did everything right. Refuse to hand out prompts that cannot match.
-    if (key !== req.key) {
-      throw new Error(
-        `agent-prompt: --roster built "${key}" where the roster requires ` +
-          `"${req.key}" — the record could never be matched to the requirement. ` +
-          'This is a bug in the CLI, not in the call.',
-      );
-    }
+  const launches = buildRosterLaunches(report, planPath, rules);
+  const blocks = launches.map(({ req, key, prompt }, i) => {
     recordPrompt(planPath, key, prompt);
-    return `───── agent ${i + 1} of ${roster.length} — ${rosterLabel(req)} ─────\n\n${prompt}`;
+    return `───── agent ${i + 1} of ${launches.length} — ${rosterLabel(req)} ─────\n\n${prompt}`;
   });
   // Worktree-mode reviews: remind the orchestrator of the exact Agent tool
   // parameters at the point of action. A run that passed both `working_dir`
@@ -1792,20 +1814,20 @@ function runRoster(report: PlanReport, planPath: string, rules?: string): void {
     `block VERBATIM.`;
   writeStdoutLine(
     [
-      `${roster.length} agents required. Launch one agent per block below, ` +
+      `${launches.length} agents required. Launch one agent per block below, ` +
         `passing its block VERBATIM — copy, do not retype. The ───── lines are ` +
         `separators, not part of any prompt. This is the same roster ` +
         `\`check-coverage\` reads out of the plan: a block you skip or reword is ` +
         `a dimension nobody reviewed. Blocks are numbered \`agent k of ` +
-        `${roster.length}\` and the output ends with an end-of-roster line — if ` +
+        `${launches.length}\` and the output ends with an end-of-roster line — if ` +
         `either is missing, this output was truncated in transit: every prompt ` +
         `is also recorded on disk, so rebuild just the missing blocks with ` +
         `--chunk <id>, or --role <r> (--file <path> for an invariant agent), ` +
         `plus the same --rules this call was given.` +
         descNote +
         paramNote,
       ...blocks,
-      `───── end of roster — ${roster.length} agents ─────`,
+      `───── end of roster — ${launches.length} agents ─────`,
     ].join('\n\n'),
   );
 }