[intel352]

When the host registers Workflow skills but cannot read their shared contract, the main skill can continue using the broader upstream MCP surface. Repeat the 14-tool safety boundary in every main skill and require a bounded text-only response with Workflow MCP calls stopped when the contract is unavailable.

Keep the portable direct wfctl transport unchanged. Add a passive Codex policy example and Go-only maintainer support for retained-record auditing and the actual installed-file read prerequisite. The helper source version is 0.1.2 to distinguish it from the preserved 0.1.1 package; this creates no engine release, installation or authentication flow.

Validation

• Complete repository race suite with the existing CI-pinned Go 1.27.2: 153 packages passed, zero failures.
• Existing native root test bridge runs the final standalone helper suite successfully.
• Final standalone suite: 64 test/subtest passes across three packages; race, vet and Windows amd64 cross-compilation passed.
• Real official wfctl v0.87.0 smoke passed; the direct MCP manifest is unchanged.
• Retained real-record Go audit reproduces 75 attempts / 11 out-of-scope / 22 total contract-violating calls and exits 1 as expected.
• Repository lint and the new packages are clean with the official checksum-verified CI-pinned golangci-lint v2.14.0. Extra whole-standalone-module lint reports two existing smoke-client warnings in unchanged main.go, reproduced on the exact baseline with the same config.
• Root module tidy diff and complete Go build passed. No workflow/authority files or dependency pins changed.

Independent adversarial review resolved the supporting-file bounds, CLI I/O coverage and canonical tool-list parity findings; no open Critical or Important code-review issue remains. Doc-reconciliation: clean.

Acceptance limits

The prior 11-turn model run completed but did not establish clean acceptance. Offline replay finds 75 attempted MCP calls: 11 forbidden-name calls and 11 additional argument-contract violations. The committed fixture normalizes YAML/identifiers/statuses and is explicitly synthetic; actual session transcripts are not included.

The real isolated host filters discovery to the configured 14 names, but its owned contract read failed before cat with exit 71 / sandbox_apply_EPERM. The test driver wrapped app-server in Seatbelt before Codex tried to apply its command sandbox. Named command profiles do not replace equivalent whole-controller/MCP containment, and removing the outer policy is not proposed here. A separately contained disposable executor with reviewed isolation and passing no-auth canaries is required before another sign-in.

Patched model behavior, implicit selection, native call-time tool rejection, WebSocket health and GUI activation remain unverified. The earlier model transport fell back from UnknownIssuer WebSocket errors to HTTPS. No fresh OAuth/model/provider call, trust change, active-profile update or new engine release is part of this PR. The remaining one authorized test turn is preserved.