resolveInstance carries the organization's workflows, plus the given
project's, the project's winning by name; the key is added only when
there is one, so an organization without workflows digests as before.
The prompt renders them under one fixed heading, "## Organization
workflows", after the contract and persona and before "## This
session". The chief of staff and roles holding task.create or
task.assign see every step; a role a step names sees only its own
steps; any other role sees nothing. Each workflow is one JSON line
between <workflows-data> markers with <, >, &, line separators, C1
controls and bidi overrides escaped, so no title, description or step
role can start a heading or close the block. The section says
workflows grant nothing and the contract and rails win. The contract
text is unchanged.
jason.woltje
4bd260457e