/suede-graph-flo-xr

name: suede-graph-flo-xr
description: "Suede AI multi-file shipping workflow (Suede Thought Graph shipping search) for one repo change: generates competing implementation plans, scores and prunes them, refutes the survivors, aggregates compatible lanes, selects one winner, then builds it in an isolated worktree behind a sandboxed gate and writes a handoff file. Use when competing implementation plans need one evidence-gated selection before any build. Halts on hazards, collisions, budget exhaustion, or no safe winner. Reads production; never deploys. NOT FOR: bulk independent work (use a separate private worker-fleet pass); reviewing or grading an existing diff (use suede-code); CI or branch-protection wiring (use suede-ci-gate); copy-only shipping (use suede-ship-copy)."

Suede Graph Flo XR

Use the bundled `workflows/suede-graph-flo-xr.js` workflow to search competing plans for one multi-file repository change. It makes an evidence-backed selection before any implementation lane mutates the worktree.

Intake and budget gate

Before launch, require all three inputs:

• **Repo**: an absolute repository path. Relative paths and `~` fail closed.
• **Scope**: the requested multi-file change, including any protected paths or

constraints.

• **Budget**: `light`, `standard`, or `deep`.

Also detect and pass optional context when available: `deploys` (whether the repo has a deploy surface), `liveUrl` (the read-only production surface), and `vault` (the external decision/handoff context path). Their absence does not block a non-deploying repository, but do not silently discard known values.

When the user names a model for the workers (`workerModel`: `sonnet`, `opus`, `haiku`, or `fable`), pass it: every worker call then runs on that model while orchestration stays on the session model. Omitted, workers inherit the session model silently; if the session sits on an expensive model and the user did not choose it for workers, say so before launch instead of letting the default decide. A run can spend up to 200 worker calls, so an unchosen inherited model is a cost decision nobody made.

If repo or scope is missing, halt. Report the missing input in one line, offer to provide the repo path, describe the desired change, or route a one-file edit to direct implementation, then wait for the user's choice.

State the selected range and projected worst-case calls before launching: `light` projects and permits **55**, `standard` projects and permits **110**, and `deep` projects and permits **200** total agent calls. Do not infer a budget from scope or silently raise a ceiling. If the user has not chosen one, ask and wait.

Runtime prerequisites

The bundled JavaScript workflow is a Claude Code workflow for macOS. It requires `sandbox-exec` and the six registered `suede-graph-flo-xr-*` agent profiles. Install the full `suede-skills` plugin, the `suede-agent-workflows` plugin, or use this repository's `install.sh`, which copies the profiles into `~/.claude/agents`.

Claude Workflow exposes no Node `process` global, so the workflow cannot infer its package namespace. The calling skill must derive it from how this skill was invoked and pass it on every launch. When the invoked name carries a plugin prefix, `agentNamespace` is that prefix verbatim: `suede-skills` from the full plugin, `suede-agent-workflows` from the focused orchestration plugin. A bare invoked name with no prefix, installed by `install.sh` or copied by hand, takes the empty string. This is runtime context, not a user choice. A missing or unknown value fails before the first agent call.

The workflow also cannot locate its own bundled helper scripts. Pass `helperDir`: the absolute path of the invoked skill's `workflows/helpers` directory (for this install, `<skill base directory>/workflows/helpers`). The clamped Bash commands run these `.cjs` helpers: the per-spawn clamp cannot verify a rule that is multi-line or longer than roughly 400 characters, so inline `node -e` payloads are not usable. A missing or whitespace-containing path fails before the first agent call; a missing helper file surfaces as the Scout setup failure. Payload-carrying helper invocations are admitted by pinned prefixes (helper path plus worktree, temp root, or base SHA) rather than exact strings; each helper validates its remaining argv, and the diff attestations, not the clamp, remain the check that what was applied matches the selected bundle.

The selected patch reaches the applier as bounded base64 chunks staged into the run's private temp root, because the clamp verifier cannot parse a command carrying a multi-kilobyte inline payload. Each append carries its offset and an FNV-1a checksum, and `--apply` verifies total length and payload checksum before decoding, so a mistyped chunk fails fast with a retry instruction instead of producing a corrupt patch.

A skill-folder-only install, a generic skills-CLI install, and the Codex plugin do not by themselves register or execute Claude Workflow agent profiles. In those environments, treat this file as the orchestration contract and route the change to direct implementation; do not claim the bundled workflow ran. To enable it in Claude Code after a manual single-skill copy, also copy the skill's bundled `agents/suede-graph-flo-xr-*.md` files into `~/.claude/agents` and restart Claude Code.

The requested Scout setup command probes `/usr/bin/sandbox-exec` as its first subprocess, before fetch or worktree creation. If that command is invoked and the probe fails, Scout reports failure before its setup mutation. The returned Scout evidence is still a model attestation, not a host execution receipt. Gate also holds on any later reported sandbox rejection. Never retry an acceptance command outside the sandbox to turn that hold into a pass.

Run the graph search

Invoke:

Workflow({
  scriptPath: "skills/suede-graph-flo-xr/workflows/suede-graph-flo-xr.js",
  args: { repo, scope, agentBudget, agentNamespace