Shadow / parallel-run + parity against the scenario oracle

Goal

• Run the new engine in shadow while the old path drives.
• Compare preserved routes, authoritative plan/tracker state, root/frame protocol facts, returns/folds, batches, obligations, ContextAssembly, and execution trajectories.
• Record explicit target outcomes where the old path has no folded-root equivalent.

Self-hosting constraint

Re-sync from local main and rerun scenario-inventory verification before each parity run.

Implementation sketch

• Add a shadow hook at the serve boundary (roadmap._route_dispatch / route_walk) that, when a WORKFLOW_ENGINE_SHADOW flag is set, also runs the new engine and logs both next_actions.
• Diff action/exit/served unit, root/frame/path/return state, workset/obligations, prompt/rule/reminder digests, next action, and preflight verdict.
• Diff authoritative plan/tracker mutations separately from root invocation/effect-recovery events and client projection events; reject any shadow trace in which a frame cursor, goal, loop, or transcript supplies or overrides a workflow/domain transition.
• Evaluate output/trajectory compliance over context/model/tool/sandbox/retry/review behavior, arbitrary runnable yields, ambiguous next actions, and interference detour/resume paths.
• Reject traces where the model was dispatched before mandatory state/event reminders, exact next action, result schema, and scoped tools were fixed by the engine.
• Require timer-originated refresh traces with no preceding model/client request; compare active injection, boundary suspend/resume, acknowledgement, and restart recovery.
• Replay every client transport lifecycle variant and compare the exact ContinueRuntimeAPI.read call count/args, byte-identical current_task/next_upcoming_task delivery, script-rendered prompt provenance, directive action/tool arguments, observed lifecycle classification, and TerminalReceipt match. Include direct plan/engine reads, early action on the upcoming preview, model-authored/paraphrased prompts, foreign goals/tasks, and stale/unsealed-receipt-shaped/mismatched completion reports as required negative traces; identical replay of the real sealed receipt is idempotent.
• Replay nested plan/bug/tooling/batch chains, wrong targets, stale/duplicate returns, ambiguous correction, and root-close races.
• Emit content/parity-report.md with machine-readable per-scenario old/new verdicts; an executable verifier requires complete inventory coverage and zero unresolved divergence before cutover.
• Shadow is OFF by default; enabling it never changes what the old path emits (assert byte-equal old next_action with shadow on vs off).

Spec references

• plans/workflow-engine-rework/spec/workflow-state-machines.md sec 0.1 (scenarios must pass on the new engine); strangler-fig parallel-run.

Test strategy / acceptance

Matrix: every preserved scenario + approved target-semantic scenario x shadow off/on x client x output/trajectory evaluator. Acceptance: the verifier rejects missing scenarios, rubric gaps, skipped required steps, unresolved divergence, non-script control prompts, client-owned state transitions, and non-engine completion claims; evaluator output cannot select a workflow route.

Work Items

• Add the WORKFLOW_ENGINE_SHADOW-gated hook as a pure read-side branch inside roadmap._enrich_route_envelope_for_execution (roadmap.py:937 — the point every emitted route class funnels through before _route_dispatch returns the envelope); when the flag is set, also run the new engine and log both next_actions without rewriting the returned envelope. Never attach inside route_walk.serve_next_v7 (route_walk.py:752), which flips work-item status as a side effect — the shadow computation MUST NOT drive that mutation. Wrap the branch in the same fail-open except Exception discipline the serve path already uses at scale.
• Author the parity harness: replay each PORT scenario through old + new, diff next_action
• Sandbox the parity harness’s scenario-replay corpus: run every live-orchestrator replay against an isolated fixture copy of the plan/tracker corpus, never the tracked working tree — the exact failure mode BUG-07-121 (non-deterministic live-subprocess replay against a mutating plan corpus, verified status=obe) and BUG-07-208 (cure-synthesis tests polluting tracked bug-tracker/diagnostic-questions.md, verified status=obe) already exhibited, which a 160-scenario replay harness reintroduces at far larger scale if uncontained.
• Assert shadow-on never changes the old path’s emitted next_action (byte-equal), by consuming the existing legacy determinism helpers (deterministic.py, guards.py, records.py) for the byte-equal / clock-free assertion machinery rather than authoring a second one.
• Extend parity to compare ordered reminder ids, content digests, activation lifecycle, and evidence requirements; reject legacy-plus-new duplicate emission
• Replay authorized child targets plus unauthorized/ambiguous target scenarios; assert root immutability and frame-capability enforcement
• Compare root/frame ancestry, child returns, workset/obligation folding, virtual-batch membership, and root-only closeout against target-semantic scenarios
• Define versioned output and trajectory eval datasets/rubrics; score context/model/tool/sandbox/retry/review/stop traces without granting evaluator route authority
• Shadow-evaluate proactive NOW-NEXT-BANNED delivery, goal/loop exactly-one continue-runtime read plus unchanged current/next relay, timer-originated refresh without model request, runnable-turn liveness, fix-interference detour/resume, exact script prompt/directive provenance, client lifecycle reconciliation, and matching-only TerminalReceipt termination across adapters
• Triage every divergence and emit machine-verifiable content/parity-report.md with inventory coverage and explicit approved-semantic references

Intel dossier — pointer and tier disposition

Dossier: shadow-parity--s-142d9984.intel.md (this section’s content/intel/ sidecar)

Read that dossier from line 1 through EOF before acting on this section. This block is a pointer and an audit record, never a substitute: not the BLUF, not a summary, not selected tiers.