Agent Workflow 0.3.3 — parent worker access and verified skills

Agent Workflow 0.3.3 delivers the worker access and failure reporting fixes found while preparing PlanetForge workflows.

• New runs capture explicit parent filesystem, network and approval authority, and automatically provision original enabled native plugin/skill roots. Explicit restricted mode remains available.
• Selected skills require observed native initial main-resource reads. A post-model check rejects removed/changed selected sources; saved catalog identity blocks resume/restart with changed capabilities.
• Windows uses the packaged Microsoft Public Trust signed job helper, with source/binary, approved-profile and timestamp verification. The 0.3.2 Session 0 behavior is preserved.
• Capture and retained diff bounds rise to 512 MiB. Metadata/previews remain bounded, with integrity verification and reviewed replay.
• Startup failures retain diagnostic and dashboard evidence. Workflow authoring explicitly covers skill selection, tool prerequisites, live observation and recovery boundaries.

Validation: 485 local tests, package check, smoke, clean production-only installation and zero production dependency vulnerabilities. The installed final package passed command-only parent-policy doctor with zero inference requests and confirmed owned-job cleanup. Native acceptance observed all eight required initial skill reads; signed artifact identities were independently reviewed. Required Windows PR and tag verification passed before publication.

Windows CI exposed two additional fixes: verified short-name aliases are accepted by filesystem identity, and the signature verifier binds its required Windows built-in PowerShell modules. Verifier command failures are distinguished from returned signature rejections. Trust policy and the 15-second verification deadline are unchanged.

Parent authority is an explicit coordinator assertion. Full-access worktrees organize review; host-only connections are not cloned. Source checks detect drift rather than prevent cache deletion. Full skill-body pagination and instruction compliance remain unverified, and live skill grants are unsupported. Paired authoring drafts failed planning acceptance and are not used for delivery. PlanetForge's nine objectives remain unaccepted; this release delivers the workflow prerequisites.

The attached acceptance receipt records source/runtime identities and scoped evidence. Earlier failures are preserved. The test fixture's outer runner budget changed from 10 to 60 seconds; production subprocess deadlines did not change.