richkuo/rk-skills/fable-dispatch

Fable dispatch

The caller owns the prompt, subagent type, and use of the result; this skill owns the path to Fable 5.1.

1. Detect the harness

Before dispatch, run [ -n "$CLAUDECODE" ] && echo claude-code || echo other. Never probe Cursor or Codex variables, and never infer the harness from an Agent-call error.

2. The fallback ladder

1. Claude Code ($CLAUDECODE set): the Agent tool with model: fable, per the caller's dispatch step and the Agent parameters below.
2. Other harness, and `command -v claude` succeeds: the section 3 shim, still Fable 5.1 at the intended effort.
3. Neither path, or a shim call that failed after the section 7 retry: the most capable model available, in order: (a) the harness's own subagent facility at its best model, keeping the caller's isolation pattern; (b) a completed shim result another model served, adopted per section 5; (c) no subagent facility: work inline in the main context and write nothing, keeping the caller's read-only promise. Report what failed and which model ran.

Agent parameters (every Agent call a family skill makes, workers included; callers point here and never restate this):

• Pass effort (the caller's tier, section 6) and run_in_background: false only when this session's Agent schema lists them; when the schema is not visible, pass both.
• On an input-validation error naming one, re-dispatch once without it and record the omission; this is not the section 7 retry. A dispatch without effort is a degradation section 6 reports, never a failure.
• When a background subagent sends a completion notification, wait for it before any step reads the result. The wait is never a failure.

3. The CLI shim

Write the prompt to a file and feed it on stdin; never interpolate it into the command line. The deny list is fixed:

DENY='Edit,Write,NotebookEdit,WebFetch,WebSearch,Skill,Agent,Task,Bash(git push*),Bash(git commit*),Bash(git branch*),Bash(git tag*),Bash(git checkout*),Bash(git switch*),Bash(git restore*),Bash(git reset*),Bash(git clean*),Bash(git stash*),Bash(git merge*),Bash(git rebase*),Bash(git cherry-pick*),Bash(git revert*),Bash(git am*),Bash(git apply*),Bash(git add*),Bash(git rm*),Bash(git mv*),Bash(git pull*),Bash(git worktree*),Bash(git submodule*),Bash(git notes*),Bash(git config*),Bash(git remote*),Bash(git update-ref*),Bash(git reflog*),Bash(git gc*),Bash(git prune*),Bash(git *--output*),Bash(git fetch*),Bash(git ls-remote*--u*),Bash(git ls-remote*--e*),Bash(git grep*--o*),Bash(git grep*O*),Bash(git -C*grep*--o*),Bash(git -C*grep*O*),Bash(gh issue comment*),Bash(gh issue edit*),Bash(gh issue create*),Bash(gh issue close*),Bash(gh issue reopen*),Bash(gh issue delete*),Bash(gh issue transfer*),Bash(gh issue pin*),Bash(gh issue unpin*),Bash(gh issue lock*),Bash(gh issue unlock*),Bash(gh issue develop*),Bash(gh pr create*),Bash(gh pr edit*),Bash(gh pr comment*),Bash(gh pr review*),Bash(gh pr merge*),Bash(gh pr close*),Bash(gh pr reopen*),Bash(gh pr ready*),Bash(gh pr checkout*),Bash(gh pr lock*),Bash(gh pr unlock*),Bash(gh api*),Bash(gh label create*),Bash(gh label edit*),Bash(gh label delete*),Bash(gh label clone*),Bash(gh release*),Bash(gh repo create*),Bash(gh repo edit*),Bash(gh repo delete*),Bash(gh repo fork*),Bash(gh repo sync*),Bash(gh repo rename*),Bash(gh repo archive*),Bash(gh workflow*),Bash(gh run*),Bash(gh secret*),Bash(gh variable*),Bash(gh gist*),Bash(gh cache*),Bash(gh project*),Bash(gh auth*),Bash(gh config*),Bash(gh extension*),Bash(gh alias*)'
 
claude -p --model fable --effort <tier> --output-format json \
  --restricted --tools "Read,Grep,Glob,Bash" \
  --strict-mcp-config \
  --permission-mode dontAsk --permission-prompts none \
  --disallowedTools "$DENY" \
  --allowedTools <read-only command list> \
  --add-dir <directories the procedure reads outside the working directory> \
  < <prompt-file>

• Guards. The read-only --allowedTools list is the gate. Only the allowlist stops a form the deny list does not name, such as git -C <path> push, and an entry ending in * admits every form after its prefix: check a command's options before listing it. Allow a ref-writing command with no safe wildcard, such as git symbolic-ref, only as the one exact read the procedure runs. Bash(git fetch*) is denied and never allow-listed.
• Never pass --dangerously-skip-permissions, --allow-dangerously-skip-permissions, a --permission-mode other than dontAsk, --bare, or --no-session-persistence. A CLI that rejects a flag in the block fails the call (section 5); never drop an isolation flag.
• `--add-dir`: the directory of each file the subagent reads outside the checkout. For fable-validate and fable-new-issue: the resolved skill folder's parent, and its realpath parent when it is a symlink; for a conversation-derived fable-new-issue summary, also the scratchpad directory. Omit the flag when there is none.
• `--allowedTools`: every read-only command the procedure runs; never a bare Bash, Bash(*), or an edit, comment, or push command. A missing entry lands in .permission_denials and the result is incomplete. For an empty list (a file-only reader), omit the flag and its value, as for an unused --add-dir; --resume keeps an omitted flag omitted.
• fable-validate (validate-issue steps 0 to 8 at BASE): "Bash(gh repo view <REPO> --json defaultBranchRef --jq .defaultBranchRef.name)" "Bash(gh issue view <N> --repo <REPO> --json title,body,comments,updatedAt)" "Bash(git rev-parse *)" "Bash(git show *)" "Bash(git grep *)" "Bash(git log *)" "Bash(git symbolic-ref --short refs/remotes/origin/HEAD)" "Bash(git check-ref-format *)", plus "Bash(git ls-remote --heads origin refs/heads/<target>)" with the validated target only when a targetBranch is named and REPO is the checkout's origin. Otherwise there is no ls-remote entry, and a cross-repository target is reported as unchecked in the verdict.
• Planning list, for a planner or advisor that reads history (fableplan, fable-advisor step 2): "Bash(git log *)" "Bash(git show *)" "Bash(git grep *)" "Bash(git rev-parse *)".
• Both one-shot reviewers read only the diff in their prompt and take the empty list. Other callers name their list at their dispatch step.
• Every gh entry is an exact form with the caller's resolved <REPO> and <N> and no wildcard. The caller runs any search the subagent needs and embeds the output in the untrusted-data block.
• The prompt lists each allowed gh command, and any git ls-remote entry, verbatim with resolved values, unquoted and in that field order, and says to run exactly those strings. It says to write git grep patterns in lowercase with -i and read a capital-O path with git show.
• `gh api` is never allow-listed. The caller runs a needed gh api read (validate-issue step 1's timeline query) before dispatch and embeds the output as untrusted data (section 7).
• Caller-run fetch. validate-issue step 0 and new-issue step 2 fetch before they pin or trace origin/$DEFAULT. On both paths, when REPO is the checkout's origin, the caller resolves DEFAULT (the target branch, else gh repo view "$REPO" --json defaultBranchRef --jq .defaultBranchRef.name) and runs git fetch origin "$DEFAULT" itself before the section 7 snapshot. The prompt says the fetch is done: the subagent skips that step, treats origin/$DEFAULT as freshly fetched, and never runs git fetch; a failed caller fetch is named in the prompt as the procedure's failed-fetch limitation. For another repository, the caller runs no fetch and names no fetch limitation.
• Cross-repository clone. When validate-issue step 0 or new-issue step 1 traces another repository's issue, the caller (fable-validate, fable-new-issue) resolves REPO, creates an empty scratch directory <clone-dir>, and adds exactly these entries, nothing broader: "Bash(git clone --no-tags -- https://github.com/<owner>/<repo>.git <clone-dir>)" "Bash(git -C <clone-dir> show *)" "Bash(git -C <clone-dir> grep *)" "Bash(git -C <clone-dir> log *)" "Bash(git -C <clone-dir> rev-parse *)", and --add-dir <clone-dir>. The prompt says the fresh clone needs no fetch (trace origin/$DEFAULT as cloned) and lists the clone command and each git -C <clone-dir> read verbatim with the resolved <clone-dir>, allowing no other form. Omit all of this when REPO is the checkout's origin.
• --effort is the tier (section 6): high by default, xhigh only when the user asked for it or stamped it.
• Auth. --restricted drops an apiKeyHelper or env credential in the user settings file; such a user passes --settings <file> holding only those keys, never permissions, hooks, or MCP servers.
• Timeout. Set the host's maximum Bash timeout, or run the CLI in the background with output to a file and poll for exit.

4. Parse the result

--output-format json prints one object:

• .result: the output (plan, verdict, or draft).
• .is_error: true means the call failed.
• .modelUsage: keys name each model that served, with token counts. Never assume the requested model ran.
• .session_id: section 8 checks it against its UUID.
• .permission_denials: non-empty means a blocked command. A deny-list denial (a capital O in a git grep, for example): report it, with no entry and no re-run. A denied read the procedure needs: add its --allowedTools entry or --add-dir directory and re-run once; a read the caller runs itself (a search or gh api read) gets no entry. A denied write means the read-only rule failed and section 3 stopped it: report the command and never allow-list a write.

5. Shim failure and substitution

A shim call fails on a non-zero exit or .is_error true. After the section 7 retry, fall to ladder step 3 and report the failure and the downgrade.

Substitution: exit zero and .is_error false, but no .modelUsage key contains fable (any case), or the Fable key lacks the largest output-token count. A helper model with a smaller count is no substitution; name it in the report. Adopt a substituted run's output, a finished product of the dominant model, as the ladder step-3 result, and report the substitution and the downgrade; a re-run lands on the same substitute. Never present an adopted result as Fable's.

6. Attribution

The footer, any heading that names a model, and the report name the model that served: on the shim, the one section 5 finds dominant; on the Agent path, Fable 5.1 unless ladder step 3 substituted another.

The effort is the tier passed and accepted: --effort on the shim, or the Agent effort parameter when section 2 passed it. When the harness exposes no effort parameter, or section 2 re-dispatched without it, the footer carries the requested tier and the report states in one line that the tier was not honored; never guess the session's tier.

A caller states its tier once (high by default, else the stamped or user-requested tier) and records the model that served, the tier, and whether it was honored. Every heading, footer, and report line about the dispatch fills from those values, never from a literal model name or tier. A footer that names the session itself (the executor or session model of fable-advisor step 7 and fable-orchestrate step 7) fills the model and effort from what the session observes, writes unknown for a value the harness does not expose, and never writes a tier the session did not observe.

The harness field is Claude Code only when $CLAUDECODE is set, else the running harness's name (Cursor, Codex), on the shim path too.

7. Dispatch hygiene, every caller

Callers cite this section at their dispatch step and add only their own deltas.