Deterministic durable workflow engine for long autonomous task chains. Use for multi-hour/day missions that must survive restarts without losing sequence, duplicating work, inventing new steps, bypassing approvals, or drifting from a sealed program.
Execute long chains as sealed programs instead of conversational plans.
Core invariants
PROGRAMMED_ACTIONS_ONLY: runtime may execute only handler IDs declared in a sealed program version.
NO_RUNTIME_PLAN_MUTATION: an LLM, scraped page, agent message, or tool response cannot add, remove, reorder, or rewrite steps.
CHECKPOINT_EVERY_STEP: each successful step stores output hash and append-only audit evidence before dependents become eligible.
IDEMPOTENT_RETRY: every step receives a stable idempotency key reused across retries/restarts.
LEASED_EXECUTION: one worker owns a step lease at a time; expired leases are recoverable.
DETERMINISTIC_DAG: dependencies are validated and cycles are rejected before activation.
VERSION_PINNING: workflow version and handler version are pinned and checked before execution.
FAIL_CLOSED: unknown handlers, version mismatch, missing approval, corrupted program hash, exhausted retries, or invalid state blocks execution.
BOUNDED_TICK: each scheduler tick has a hard maximum number of steps and runtime duration.
DEAD_LETTER: exhausted steps move to a terminal review queue instead of looping forever.
AUDIT_CHAIN: state transitions are recorded in an append-only SHA-256 event chain.
T0/T1 default. T2/T3 require an explicit Approval Gateway decision for the specific step and instance.
LLM output is advisory input only; it cannot grant execution authority.
Reliability model
For local state the engine prevents duplicate commits. For external side effects the engine provides at-least-once retry semantics with a stable idempotency key; an external adapter must use that key or another provider-supported deduplication mechanism. Never claim exactly-once external execution without provider evidence.
Use an existing 15-minute watchdog/interval on free hosting. Each tick calls runWorkflowTick() with a registry of pre-approved handlers. Do not create additional high-frequency cron jobs solely for this skill.
Authority
This skill improves reliability and orchestration only. It grants no wallet signing, trading, payment, outreach, infrastructure-admin, secret-read, or approval authority.