Roll Out Brand Refresh

Paste this into an assistant that can read the web, such as Claude, ChatGPT or Cursor. It reads the specification and the current LangGraph documentation, then writes two files: the graph, and a note on what did not survive the translation. Read the note first. What a runtime cannot express is the part worth arguing about, and this process is a draft to argue with.

Convert the business process below into a runnable LangGraph graph:
one Python file with a TypedDict state, a StateGraph, nodes, edges,
conditional edges and a checkpointer.

The document is a reference process written to the Agent Processes
specification. Read the specification before you start, because it defines
terms that look ordinary and are not:

  https://agentcatalog.com/spec/agent-processes

Sections 6 (the phase graph), 6.5.1 (exception edges), 6.7.1 (deviations),
7 (automation) and 8 (handoffs) are the ones this conversion turns on.

Then read the current documentation for the primitives you will need, rather
than relying on what you remember of the API:

  https://docs.langchain.com/oss/python/langgraph/interrupts
    interrupt() and Command(resume=), which is how a gate stops a run
  https://reference.langchain.com/python/langgraph/graph/state/StateGraph
    StateGraph, add_edge, add_conditional_edges, defer

WHAT THE DOCUMENT ASKS FOR

These hold wherever the process lands, and they matter more than style.

1. Each phase under `phases:` becomes one step, and keeps its name.

2. `after:` gives the edges. `after: a + b` is a join and waits for BOTH.
   Reading it as "either" is the defect the specification calls out by name.

3. Every handoff carries a key in square brackets. Each key becomes one field
   on the run's state, named exactly as the key with hyphens turned into
   underscores, and the sentence beside it becomes that field's comment. The key
   is the stable name; the sentence is prose that may be rewritten.

4. A phase MUST NOT begin before its inbound handoff exists. Where that is
   checkable, check it in the step rather than assuming it.

5. `automation: never` is a gate a person signs. The run stops there and does
   not continue until a person's decision comes back. Do not turn one into a
   notification, a log line, or an automatic transition, whatever the queue
   looks like.

6. Each line under `deviations:` is a backward or sideways edge, returning to
   the phase named on the right. The key in brackets names it, and that name
   belongs in the code.

7. A phase whose `after:` reads like "X or Y, whichever could not finish" is an
   exception edge: it is entered when those phases FAIL, not when they succeed.
   Do not wire it as an ordinary successor.

8. Anything in angle brackets is a blank the adopting organization fills in.
   Leave each one as a named constant at the top of the file with a TODO. Do not
   invent a value, a threshold or a date.

9. Record the document's `from:` line at the top of the file, so it says which
   reference process and which version it was generated from.

10. Run-scoped lines under `run-scoped:` are work that runs alongside the whole
    process rather than at one point in it, and a run may not close while one is
    unfinished. Say in the code what you did about them, including if the answer
    is that the runtime has nowhere to put them.

HOW THAT LOOKS IN LANGGRAPH

11. A phase is a node added with `add_node`, under the phase's own name.

12. The state is a TypedDict. Each handoff key is one field on it.

13. A join is the trap. `add_edge(["a", "b"], "c")` looks right and releases
    once: when a backward edge re-enters ONE arm, the joined node never runs
    again, and the run ends early reporting success rather than raising. Mark the
    joined node `defer=True` and re-check inside it that both inbound handoffs
    exist.

14. A gate is `interrupt()` inside the node, resumed with `Command(resume=...)`.
    The platform lets anything at all call resume, so require the resumed value to
    name a person and a date and refuse anything else. Say in the fidelity note
    that this proves only that whoever resumed typed a name, because
    `Command(resume=True)` from a scheduled job is indistinguishable from a person
    signing.

15. A deviation is `add_conditional_edges` with a routing function named after
    the key in brackets.

16. Pass a durable checkpointer rather than taking the in-memory default. The
    gates wait days, and the default loses every paused run on restart.

17. Leave every phase body unimplemented, raising until somebody registers an
    implementation. The automation level is a blank, so writing a body would
    answer on the adopter's behalf whether an agent may do that work.

Produce a second file alongside it, `FIDELITY.md`, and treat it as the more
important of the two. The code is for whoever builds this. The fidelity note
is for whoever has to decide whether this platform suits the process at all,
and that is usually a different person who will never read the code.

It has three parts.

**What came across.** Briefly: how many phases became steps, how many handoff
keys became state fields, which gates stop the run, which deviations became
edges. Counts and names, not reassurance.

**What did not, and what was done instead.** One entry per gap. For each one,
say what the document requires, what the platform can actually express, what
you did in its place, and what breaks if somebody later removes your
workaround. This last part matters most: a workaround nobody understands is a
workaround somebody deletes.

**What a person still has to decide.** The blanks are not a translation
failure, they are the point of a reference process, so list what has to be
filled in before this could run against anything real, and say which of those
choices the platform constrains.

Write it in plain English for somebody who has not read the specification, and
do not soften it. A translation of a reference process is a draft to argue
with, not a build artifact, and the honest account of what was lost is the most
useful thing you will produce.

Here is the process document.

```
PROCESS: brand refresh                id: <team>/brand-refresh   v1
from: ref/mkt/brand-refresh v1
owner: <who>                          effective: <date>
trigger: a new identity is approved by <who>, at the version they
         approved
         watch: record=<the new identity> system=<where it is approved>
                change=<an identity is approved at a version>
concurrency: one run at a time - two transitions at once leave nobody
             able to say which identity is current
goal: every surface, asset, template and registration carrying the new
      identity at its issued version, or recorded as staying on the
      old identity with the reason it was left
phases:
  take-in-identity   - human: what the new identity changes, what it
                       covers, and what it leaves alone
                       owner: standards-keeper
                       after: trigger
                       automation: <level>
  issue-version      - human: the approved identity becomes a numbered
                       version of the brand guidelines
                       owner: standards-keeper
                       after: take-in-identity
                       automation: <level>
  tell-the-readers   - runs decide-and-announce: every process that
                       reads the standard hears what changed and from
                       when
                       owner: standards-keeper
                       after: issue-version
                       by: <days>        automation: <level>
  read-baseline      - human: what people recognize and what they say
                       the organization stands for, read before the
                       switch so the later reading has a comparison
                       owner: study-manager
                       after: take-in-identity
                       by: <weeks>       automation: <level>
  build-inventory    - runs collect-and-report: every page, template,
                       asset and standing send, built from what is
                       actually live rather than from a list
                       owner: content-librarian
                       after: issue-version
                       by: <days>        automation: <level>
  find-registrations - runs collect-and-report: the domains, handles,
                       listings, memberships and marks the
                       organization holds with outside parties
                       owner: supplier-manager
                       after: issue-version
                       by: <days>        automation: <level>
  score-surfaces     - runs assessment: every surface on the inventory
                       scored against the version now in force
                       owner: brand-check
                       after: build-inventory
                       by: <days>        automation: <level>
  decide-surfaces    - convenes decide-and-announce: each surface gets
                       one of remake, replace, retire, or leave under
                       the version it was made under
                       owner: content-librarian
                       after: score-surfaces + find-registrations
                       automation: <level>
  check-capacity     - human: the agents the transition needs, the
                       weeks it takes, the money it draws, and the
                       committed work it would displace
                       owner: capacity-manager
                       after: decide-surfaces
                       by: <days>        automation: <level>
  set-switch-date    - convenes decide-and-announce: the day the
                       identity goes public, which surfaces change
                       before it, and which change after
                       owner: decision-coordinator
                       after: check-capacity
                       by: <date>        automation: never
  brief-the-work     - convenes briefing: what each surface needs and
                       when it is due, heard by every agent at once
                       owner: content-librarian
                       after: set-switch-date
                       automation: <level>
  rebuild-templates  - runs build-by-talent: the page templates, the
                       email templates and the document templates,
                       rebuilt before anything made from them
                       owner: creative-producer
                       after: brief-the-work
                       by: <days>        automation: <level>
  remake-assets      - runs build-by-talent: the logos, the images and
                       the video, at every size already in use
                       owner: creative-producer
                       after: rebuild-templates
                       by: <weeks>       automation: <level>
  rewrite-words      - human: the names, the boilerplate and the
                       descriptions the new identity changed
                       owner: copywriter
                       after: rebuild-templates
                       by: <weeks>       automation: <level>
  register-marks     - human: the domains, handles and marks the new
                       identity needs, searched and registered before
                       anything goes out on them
                       owner: supplier-manager
                       after: set-switch-date
                       by: <weeks>       automation: never
  get-sign-offs      - convenes approval: brand, legal and rights
                       sign, as named signers, against a version of
                       the templates and the remade material
                       owner: <your legal role>
                       after: rebuild-templates + remake-assets +
                              rewrite-words
                       by: <days>        automation: never
  check-material     - runs assessment: contrast, alt text, heading
                       order, links and addresses, against the
                       accessibility standard at its version
                       owner: accessibility-check
                       after: get-sign-offs
                       by: <days>        automation: <level>
  stage-changes      - human: the approved templates and material
                       built into the properties as drafts, with
                       previews, still not serving
                       owner: web-producer
                       after: check-material
                       by: <days>        automation: <level>
  switch-properties  - human: the named owner says go and the site,
                       the templates and the sending system change
                       over in the order that was set
                       owner: web-producer
                       after: stage-changes + register-marks
                       automation: <level>
  change-profiles    - human: the profiles, listings and partner pages
                       the organization does not serve itself
                       owner: supplier-manager
                       after: switch-properties
                       by: <days>        automation: <level>
  announce           - human: the announcement goes out once the
                       properties already show the new identity
                       owner: comms-manager
                       after: switch-properties
                       automation: <level>
  sweep              - runs assessment: what still carries the old
                       identity, on the organization's own surfaces
                       and on other people's
                       owner: brand-check
                       after: change-profiles + announce
                       by: <weeks>       automation: <level>
  retire-old         - human: the old files come out of the asset
                       store, and the version they belong to is marked
                       as no longer current and left readable
                       owner: standards-keeper
                       after: sweep
                       by: <days>        automation: <level>
  read-again         - runs collect-and-report: the same study, worded
                       the same way, set beside the baseline
                       owner: study-manager
                       after: retire-old + read-baseline
                       by: <weeks>       automation: <level>
  report-transition  - runs collect-and-report: what changed, what was
                       left on the old identity, what it cost, and
                       what the numbers did
                       owner: content-librarian
                       after: retire-old + read-again
                       by: <weeks>       automation: <level>
  record-learnings   - convenes debrief: what to repeat, what to avoid
                       owner: standards-keeper
                       after: report-transition
                       automation: <level>
run-scoped:
  status   - runs roll-call                  owner: capacity-manager
             every: <cadence>
             from: brief-the-work   until: sweep
  spend    - runs allocate-and-reconcile     owner: budget-keeper
             from: check-capacity   until: run close
  coverage - runs collect-and-report         owner: coverage-monitor
             every: <cadence>
             from: announce   until: run close
handoffs:
  take-in-identity -> issue-version [approved-identity]: the identity
    as it was approved, and what it changes in the standard now in
    force
  take-in-identity -> read-baseline [baseline-questions]: what the
    study has to be able to say afterwards, so the questions are
    written before the switch
  issue-version -> tell-the-readers [issued-version]: the numbered
    version, what changed in it, and the date it applies from
  issue-version -> build-inventory / find-registrations [new-version]:
    the version every surface is about to be read against
  build-inventory -> score-surfaces [surface-inventory]: the inventory
    at a version, with every surface carrying where it lives, who owns
    it, and the date it last changed
  find-registrations -> decide-surfaces [registrations]: every domain,
    handle, listing and mark, with its owner, its renewal date, and
    the notice a change needs
  score-surfaces -> decide-surfaces [surface-scores]: a verdict per
    surface against the new version, with the rule behind every
    failure
  decide-surfaces -> check-capacity [surface-decisions]: the surfaces
    to remake, replace and retire, each with what it will take
  check-capacity -> set-switch-date [transition-cost]: what the
    transition needs, what room is left in the period, and what a date
    would displace
  set-switch-date -> brief-the-work [switch-date-and-order]: the
    switch date, the surfaces that have to change before it, and the
    order they change in
  set-switch-date -> register-marks [names-to-register]: the names,
    domains and handles the new identity needs, and the date they have
    to be held by
  brief-the-work -> rebuild-templates [template-brief]: what each
    template has to become, as every agent heard it
  rebuild-templates -> remake-assets / rewrite-words [templates]: the
    templates at a version, with the sizes, the safe areas and the
    character counts the material has to fit
  remake-assets -> get-sign-offs [remade-assets]: the remade set at a
    version, naming the old asset each piece replaces
  rewrite-words -> get-sign-offs [rewritten-wording]: the changed
    wording at a version, with the old wording beside it
  get-sign-offs -> check-material [signed-material]: the approved
    material at the signed version. A later change voids the approval
    and sign-offs run again
  check-material -> stage-changes [material-scores]: the scored list,
    with the rule behind every failure and what it could not test
  stage-changes -> switch-properties [staged-properties]: every
    property built and previewed, with the order the switch fires in
  register-marks -> switch-properties [held-names]: the names, domains
    and marks the organization now holds, with the date each was
    secured
  switch-properties -> change-profiles / announce [what-went-live]:
    what went live, at which version, at what time, and who said go
  change-profiles -> sweep [changed-profiles]: every profile and
    listing that changed, and every one that could not be changed with
    the reason
  sweep -> retire-old [old-identity-remainder]: what still carries the
    old identity, where it is, and whether the organization can change
    it
  retire-old -> read-again [retirement-date]: the date the old version
    stopped being current, so the reading afterwards knows what it is
    measuring
  read-baseline -> read-again [baseline-reading]: the questions at the
    version they were asked at, and the responses behind the baseline
  read-again -> report-transition [second-reading]: the second reading
    beside the baseline, with the statistician saying whether the
    difference is larger than the noise in the measurement
  report-transition -> record-learnings [the-report]: the account of
    the transition, as delivered
deviations:
  check-capacity -> decide-surfaces [plan-does-not-fit]: the
    transition does not fit the period, so the surfaces are decided
    again against what the department can carry
  register-marks -> take-in-identity [mark-already-held]: somebody
    else holds the name, the handle or the mark, so the identity goes
    back to the people who approved it
  get-sign-offs -> remake-assets [asset-changes]: a signer comes back
    with changes to the remade assets
  get-sign-offs -> rewrite-words [wording-changes]: a signer comes
    back with changes to the rewritten wording
  check-material -> issue-version [colors-fail-contrast]: the new
    colors fail the contrast rule, which no producing agent can fix,
    so the question goes back to the standard
  check-material -> remake-assets [material-failures]: the check finds
    failures in the remade material, so the material is made again
  sweep -> build-inventory [inventory-missed-a-surface]: the sweep
    finds a surface the inventory never held, so the inventory is
    built again at a new version
  sweep -> remake-assets [still-on-old-identity]: a surface still
    carries the old identity, so the material for it is made again
bindings:
  roster:  <who holds each role - agents claiming the abstract agents
           above, and named people for the brand owner, leadership,
           legal and rights>
  systems: the standards store (write), the content inventory (write),
           the asset store (write), the CMS (write),
           redirects and address settings (write),
           the sending system (write),
           the supplier and registration record (write),
           the book of work (write), the budget record (write),
           the study record (write), the response record (write),
           the coverage record (write), the review record (write),
           analytics platforms (read),
           the notification channel (write)
  data:    brand guidelines <version>, <your claims register>
           <version>, <your accessibility standard> <version>,
           the identity as it was approved,
           the inventory at the version the transition was decided
           from
policy:
  every surface on the inventory gets a recorded answer, and a surface
    left on the old identity carries the reason it was left
  an issued version is never edited. A change goes out as a new
    version, and the version it replaces stays readable
  work signed under the old version is judged against that version
    until <who> says otherwise
  nothing publishes on a name, a domain or a mark the organization
    does not hold
  sign-off is a human gate and is never delegated to an agent
  anything changed after sign-off goes back through sign-offs
  every address a renamed page held keeps pointing at a page, and the
    redirect is set before the old address stops serving
  the old identity's files leave the asset store only after the
    switch, and the versions that came down stay readable
  a surface with a known accessibility failure goes live only when
    <who> accepts the failure in writing, and the acceptance is
    recorded
measures:
  cycle time: <target> from the approved identity to the switch date
  coverage: <share> of the surfaces on the inventory carrying the new
            version <weeks> after the switch
  remainder: the count of surfaces still on the old identity,
             restated every <cadence> until <who> accepts the number
  quality gate: nothing goes live unsigned, no address is left broken,
                and nothing goes out on a name the organization does
                not hold
```

Paste this into an assistant that can read the web, such as Claude, ChatGPT or Cursor. It reads the specification and the current Agent Framework documentation, then writes two files: the workflow, and a note on what did not survive the translation. Read the note first. What a runtime cannot express is the part worth arguing about, and this process is a draft to argue with.

Convert the business process below into a runnable Microsoft Agent Framework workflow:
one Python file with Executor classes, a WorkflowBuilder, typed edges,
request_info gates and durable checkpoint storage.

The document is a reference process written to the Agent Processes
specification. Read the specification before you start, because it defines
terms that look ordinary and are not:

  https://agentcatalog.com/spec/agent-processes

Sections 6 (the phase graph), 6.5.1 (exception edges), 6.7.1 (deviations),
7 (automation) and 8 (handoffs) are the ones this conversion turns on.

Then read the current documentation for the primitives you will need, rather
than relying on what you remember of the API:

  https://learn.microsoft.com/en-us/agent-framework/workflows/human-in-the-loop
    ctx.request_info, @response_handler, and answering a parked run later
  https://learn.microsoft.com/en-us/agent-framework/workflows/checkpoints
    what a checkpoint holds, and allowed_checkpoint_types
  https://learn.microsoft.com/en-us/agent-framework/concepts/workflows/edges
    add_edge with condition, add_fan_in_edges, add_switch_case_edge_group
  https://learn.microsoft.com/en-us/agent-framework/concepts/workflows/state
    ctx.set_state and ctx.get_state as they actually are today

WHAT THE DOCUMENT ASKS FOR

These hold wherever the process lands, and they matter more than style.

1. Each phase under `phases:` becomes one step, and keeps its name.

2. `after:` gives the edges. `after: a + b` is a join and waits for BOTH.
   Reading it as "either" is the defect the specification calls out by name.

3. Every handoff carries a key in square brackets. Each key becomes one field
   on the run's state, named exactly as the key with hyphens turned into
   underscores, and the sentence beside it becomes that field's comment. The key
   is the stable name; the sentence is prose that may be rewritten.

4. A phase MUST NOT begin before its inbound handoff exists. Where that is
   checkable, check it in the step rather than assuming it.

5. `automation: never` is a gate a person signs. The run stops there and does
   not continue until a person's decision comes back. Do not turn one into a
   notification, a log line, or an automatic transition, whatever the queue
   looks like.

6. Each line under `deviations:` is a backward or sideways edge, returning to
   the phase named on the right. The key in brackets names it, and that name
   belongs in the code.

7. A phase whose `after:` reads like "X or Y, whichever could not finish" is an
   exception edge: it is entered when those phases FAIL, not when they succeed.
   Do not wire it as an ordinary successor.

8. Anything in angle brackets is a blank the adopting organization fills in.
   Leave each one as a named constant at the top of the file with a TODO. Do not
   invent a value, a threshold or a date.

9. Record the document's `from:` line at the top of the file, so it says which
   reference process and which version it was generated from.

10. Run-scoped lines under `run-scoped:` are work that runs alongside the whole
    process rather than at one point in it, and a run may not close while one is
    unfinished. Say in the code what you did about them, including if the answer
    is that the runtime has nowhere to put them.

HOW THAT LOOKS IN MICROSOFT AGENT FRAMEWORK

11. Write for Python, and read those pages before writing a line. This API has
    moved: `set_shared_state`, `RequestInfoExecutor`, `RequestInfoMessage` and
    `send_responses_streaming` are all in the training data and none of them exist
    any more. The .NET workflow API differs in kind rather than in spelling, so a
    file written for one does not port by renaming.

12. A phase is a class deriving from `Executor` whose `super().__init__(id=...)`
    takes the phase name verbatim. The id is not cosmetic: a checkpoint stores a
    signature over the topology and the executor ids, so an id built from a run, a
    timestamp or a counter cannot be resumed into.

13. Give each phase a `@handler` method and move work on with
    `await ctx.send_message(...)`. A handler that returns without sending is a dead
    end: the branch stops, the run converges, and it reports success. So a phase
    you are deliberately leaving unimplemented must still send a placeholder
    onward. Do not stub with `raise NotImplementedError`, which fails the run
    instead of leaving it runnable.

14. `after: a` is `builder.add_edge(a, b)`. `after: a + b` is
    `builder.add_fan_in_edges([a, b], target)`, and the target's handler must be
    annotated `list[T]`, because a fan-in delivers one aggregated list rather than
    the separate messages. A handler typed for the single value is dropped as a
    mismatch with nothing raised.

15. The join is the trap here, and it is the opposite of LangGraph's. The
    barrier re-arms: it clears its buffer when it fires and then demands a fresh
    message from every source. So a deviation that re-enters ONE arm parks the
    run forever waiting for an arm that will not run again, and the workflow ends
    IDLE reporting success. Wherever a deviation re-enters one arm of a join,
    replace the barrier with an ordinary edge from each arm into a small executor
    that records each arrival with `ctx.set_state` and only forwards when every
    expected key is present, and say in a comment that putting `add_fan_in_edges`
    back reintroduces the stall.

16. A phase that is both a join target and a deviation target needs two
    handlers, one annotated `list[T]` for the barrier and one annotated `T` for the
    backward message. Write only the list handler and every backward edge into it
    is discarded as a type mismatch, silently.

17. `automation: never` is `await ctx.request_info(request_data=...,
    response_type=...)` inside the phase, answered by a `@response_handler` on the
    same executor whose annotations match those exact types. The run parks at
    `IDLE_WITH_PENDING_REQUESTS` and the host answers with
    `workflow.run(stream=True, responses={request_id: value})`. If no handler
    matches the pair, the framework logs a warning and parks anyway, so the gate
    reads as working right up until somebody asks why the approval did not take.

18. A gate is only a gate if the wait survives a restart, so pass
    `checkpoint_storage=FileCheckpointStorage(...)` to the builder. Checkpointing
    is off by default and `InMemoryCheckpointStorage` reads as configured while
    persisting nothing. Register every handoff payload type in
    `allowed_checkpoint_types`, or the first restore raises. Anything an executor
    keeps as an instance attribute is absent after a restore unless you export it
    from `on_checkpoint_save` and read it back in `on_checkpoint_restore`, and it
    comes back empty rather than missing.

19. Each line under `deviations:` is `builder.add_edge(source, earlier,
    condition=fn)` with `fn` named after the key. Cycles are legal and unchecked,
    but raise `max_iterations` well above its default of 100, because several live
    cycles will exhaust a budget sized for a straight line and fail with a message
    about convergence that reads like a broken graph. Keep the ordinary forward
    edge unconditional and add each deviation beside it: a condition that returns
    false is dropped with no event, so a forward path expressed as a condition
    dies silently on every normal run, which is most of them.

20. Handoff values go in `ctx.set_state(key, value)` and come back from
    `ctx.get_state(key)`, untyped and unchecked. A write is visible to its writer
    at once and to everyone else only in the next superstep, and two writers of one
    key in a superstep keep the last write. Never read a key in the same superstep
    another phase wrote it.

21. There are no timers, no deadlines and no scheduled wakes. Nothing in
    `run-scoped:` becomes an executor and `by:` has no expression at all, so write
    them as comments naming where they start and stop, and say plainly in the
    fidelity note that a run can close over an unfinished run-scoped line. Do not
    fake a deadline with a sleep inside a handler, which blocks the whole superstep
    barrier, and never let an expiring wait release a gate.

Produce a second file alongside it, `FIDELITY.md`, and treat it as the more
important of the two. The code is for whoever builds this. The fidelity note
is for whoever has to decide whether this platform suits the process at all,
and that is usually a different person who will never read the code.

It has three parts.

**What came across.** Briefly: how many phases became steps, how many handoff
keys became state fields, which gates stop the run, which deviations became
edges. Counts and names, not reassurance.

**What did not, and what was done instead.** One entry per gap. For each one,
say what the document requires, what the platform can actually express, what
you did in its place, and what breaks if somebody later removes your
workaround. This last part matters most: a workaround nobody understands is a
workaround somebody deletes.

**What a person still has to decide.** The blanks are not a translation
failure, they are the point of a reference process, so list what has to be
filled in before this could run against anything real, and say which of those
choices the platform constrains.

Write it in plain English for somebody who has not read the specification, and
do not soften it. A translation of a reference process is a draft to argue
with, not a build artifact, and the honest account of what was lost is the most
useful thing you will produce.

Here is the process document.

```
PROCESS: brand refresh                id: <team>/brand-refresh   v1
from: ref/mkt/brand-refresh v1
owner: <who>                          effective: <date>
trigger: a new identity is approved by <who>, at the version they
         approved
         watch: record=<the new identity> system=<where it is approved>
                change=<an identity is approved at a version>
concurrency: one run at a time - two transitions at once leave nobody
             able to say which identity is current
goal: every surface, asset, template and registration carrying the new
      identity at its issued version, or recorded as staying on the
      old identity with the reason it was left
phases:
  take-in-identity   - human: what the new identity changes, what it
                       covers, and what it leaves alone
                       owner: standards-keeper
                       after: trigger
                       automation: <level>
  issue-version      - human: the approved identity becomes a numbered
                       version of the brand guidelines
                       owner: standards-keeper
                       after: take-in-identity
                       automation: <level>
  tell-the-readers   - runs decide-and-announce: every process that
                       reads the standard hears what changed and from
                       when
                       owner: standards-keeper
                       after: issue-version
                       by: <days>        automation: <level>
  read-baseline      - human: what people recognize and what they say
                       the organization stands for, read before the
                       switch so the later reading has a comparison
                       owner: study-manager
                       after: take-in-identity
                       by: <weeks>       automation: <level>
  build-inventory    - runs collect-and-report: every page, template,
                       asset and standing send, built from what is
                       actually live rather than from a list
                       owner: content-librarian
                       after: issue-version
                       by: <days>        automation: <level>
  find-registrations - runs collect-and-report: the domains, handles,
                       listings, memberships and marks the
                       organization holds with outside parties
                       owner: supplier-manager
                       after: issue-version
                       by: <days>        automation: <level>
  score-surfaces     - runs assessment: every surface on the inventory
                       scored against the version now in force
                       owner: brand-check
                       after: build-inventory
                       by: <days>        automation: <level>
  decide-surfaces    - convenes decide-and-announce: each surface gets
                       one of remake, replace, retire, or leave under
                       the version it was made under
                       owner: content-librarian
                       after: score-surfaces + find-registrations
                       automation: <level>
  check-capacity     - human: the agents the transition needs, the
                       weeks it takes, the money it draws, and the
                       committed work it would displace
                       owner: capacity-manager
                       after: decide-surfaces
                       by: <days>        automation: <level>
  set-switch-date    - convenes decide-and-announce: the day the
                       identity goes public, which surfaces change
                       before it, and which change after
                       owner: decision-coordinator
                       after: check-capacity
                       by: <date>        automation: never
  brief-the-work     - convenes briefing: what each surface needs and
                       when it is due, heard by every agent at once
                       owner: content-librarian
                       after: set-switch-date
                       automation: <level>
  rebuild-templates  - runs build-by-talent: the page templates, the
                       email templates and the document templates,
                       rebuilt before anything made from them
                       owner: creative-producer
                       after: brief-the-work
                       by: <days>        automation: <level>
  remake-assets      - runs build-by-talent: the logos, the images and
                       the video, at every size already in use
                       owner: creative-producer
                       after: rebuild-templates
                       by: <weeks>       automation: <level>
  rewrite-words      - human: the names, the boilerplate and the
                       descriptions the new identity changed
                       owner: copywriter
                       after: rebuild-templates
                       by: <weeks>       automation: <level>
  register-marks     - human: the domains, handles and marks the new
                       identity needs, searched and registered before
                       anything goes out on them
                       owner: supplier-manager
                       after: set-switch-date
                       by: <weeks>       automation: never
  get-sign-offs      - convenes approval: brand, legal and rights
                       sign, as named signers, against a version of
                       the templates and the remade material
                       owner: <your legal role>
                       after: rebuild-templates + remake-assets +
                              rewrite-words
                       by: <days>        automation: never
  check-material     - runs assessment: contrast, alt text, heading
                       order, links and addresses, against the
                       accessibility standard at its version
                       owner: accessibility-check
                       after: get-sign-offs
                       by: <days>        automation: <level>
  stage-changes      - human: the approved templates and material
                       built into the properties as drafts, with
                       previews, still not serving
                       owner: web-producer
                       after: check-material
                       by: <days>        automation: <level>
  switch-properties  - human: the named owner says go and the site,
                       the templates and the sending system change
                       over in the order that was set
                       owner: web-producer
                       after: stage-changes + register-marks
                       automation: <level>
  change-profiles    - human: the profiles, listings and partner pages
                       the organization does not serve itself
                       owner: supplier-manager
                       after: switch-properties
                       by: <days>        automation: <level>
  announce           - human: the announcement goes out once the
                       properties already show the new identity
                       owner: comms-manager
                       after: switch-properties
                       automation: <level>
  sweep              - runs assessment: what still carries the old
                       identity, on the organization's own surfaces
                       and on other people's
                       owner: brand-check
                       after: change-profiles + announce
                       by: <weeks>       automation: <level>
  retire-old         - human: the old files come out of the asset
                       store, and the version they belong to is marked
                       as no longer current and left readable
                       owner: standards-keeper
                       after: sweep
                       by: <days>        automation: <level>
  read-again         - runs collect-and-report: the same study, worded
                       the same way, set beside the baseline
                       owner: study-manager
                       after: retire-old + read-baseline
                       by: <weeks>       automation: <level>
  report-transition  - runs collect-and-report: what changed, what was
                       left on the old identity, what it cost, and
                       what the numbers did
                       owner: content-librarian
                       after: retire-old + read-again
                       by: <weeks>       automation: <level>
  record-learnings   - convenes debrief: what to repeat, what to avoid
                       owner: standards-keeper
                       after: report-transition
                       automation: <level>
run-scoped:
  status   - runs roll-call                  owner: capacity-manager
             every: <cadence>
             from: brief-the-work   until: sweep
  spend    - runs allocate-and-reconcile     owner: budget-keeper
             from: check-capacity   until: run close
  coverage - runs collect-and-report         owner: coverage-monitor
             every: <cadence>
             from: announce   until: run close
handoffs:
  take-in-identity -> issue-version [approved-identity]: the identity
    as it was approved, and what it changes in the standard now in
    force
  take-in-identity -> read-baseline [baseline-questions]: what the
    study has to be able to say afterwards, so the questions are
    written before the switch
  issue-version -> tell-the-readers [issued-version]: the numbered
    version, what changed in it, and the date it applies from
  issue-version -> build-inventory / find-registrations [new-version]:
    the version every surface is about to be read against
  build-inventory -> score-surfaces [surface-inventory]: the inventory
    at a version, with every surface carrying where it lives, who owns
    it, and the date it last changed
  find-registrations -> decide-surfaces [registrations]: every domain,
    handle, listing and mark, with its owner, its renewal date, and
    the notice a change needs
  score-surfaces -> decide-surfaces [surface-scores]: a verdict per
    surface against the new version, with the rule behind every
    failure
  decide-surfaces -> check-capacity [surface-decisions]: the surfaces
    to remake, replace and retire, each with what it will take
  check-capacity -> set-switch-date [transition-cost]: what the
    transition needs, what room is left in the period, and what a date
    would displace
  set-switch-date -> brief-the-work [switch-date-and-order]: the
    switch date, the surfaces that have to change before it, and the
    order they change in
  set-switch-date -> register-marks [names-to-register]: the names,
    domains and handles the new identity needs, and the date they have
    to be held by
  brief-the-work -> rebuild-templates [template-brief]: what each
    template has to become, as every agent heard it
  rebuild-templates -> remake-assets / rewrite-words [templates]: the
    templates at a version, with the sizes, the safe areas and the
    character counts the material has to fit
  remake-assets -> get-sign-offs [remade-assets]: the remade set at a
    version, naming the old asset each piece replaces
  rewrite-words -> get-sign-offs [rewritten-wording]: the changed
    wording at a version, with the old wording beside it
  get-sign-offs -> check-material [signed-material]: the approved
    material at the signed version. A later change voids the approval
    and sign-offs run again
  check-material -> stage-changes [material-scores]: the scored list,
    with the rule behind every failure and what it could not test
  stage-changes -> switch-properties [staged-properties]: every
    property built and previewed, with the order the switch fires in
  register-marks -> switch-properties [held-names]: the names, domains
    and marks the organization now holds, with the date each was
    secured
  switch-properties -> change-profiles / announce [what-went-live]:
    what went live, at which version, at what time, and who said go
  change-profiles -> sweep [changed-profiles]: every profile and
    listing that changed, and every one that could not be changed with
    the reason
  sweep -> retire-old [old-identity-remainder]: what still carries the
    old identity, where it is, and whether the organization can change
    it
  retire-old -> read-again [retirement-date]: the date the old version
    stopped being current, so the reading afterwards knows what it is
    measuring
  read-baseline -> read-again [baseline-reading]: the questions at the
    version they were asked at, and the responses behind the baseline
  read-again -> report-transition [second-reading]: the second reading
    beside the baseline, with the statistician saying whether the
    difference is larger than the noise in the measurement
  report-transition -> record-learnings [the-report]: the account of
    the transition, as delivered
deviations:
  check-capacity -> decide-surfaces [plan-does-not-fit]: the
    transition does not fit the period, so the surfaces are decided
    again against what the department can carry
  register-marks -> take-in-identity [mark-already-held]: somebody
    else holds the name, the handle or the mark, so the identity goes
    back to the people who approved it
  get-sign-offs -> remake-assets [asset-changes]: a signer comes back
    with changes to the remade assets
  get-sign-offs -> rewrite-words [wording-changes]: a signer comes
    back with changes to the rewritten wording
  check-material -> issue-version [colors-fail-contrast]: the new
    colors fail the contrast rule, which no producing agent can fix,
    so the question goes back to the standard
  check-material -> remake-assets [material-failures]: the check finds
    failures in the remade material, so the material is made again
  sweep -> build-inventory [inventory-missed-a-surface]: the sweep
    finds a surface the inventory never held, so the inventory is
    built again at a new version
  sweep -> remake-assets [still-on-old-identity]: a surface still
    carries the old identity, so the material for it is made again
bindings:
  roster:  <who holds each role - agents claiming the abstract agents
           above, and named people for the brand owner, leadership,
           legal and rights>
  systems: the standards store (write), the content inventory (write),
           the asset store (write), the CMS (write),
           redirects and address settings (write),
           the sending system (write),
           the supplier and registration record (write),
           the book of work (write), the budget record (write),
           the study record (write), the response record (write),
           the coverage record (write), the review record (write),
           analytics platforms (read),
           the notification channel (write)
  data:    brand guidelines <version>, <your claims register>
           <version>, <your accessibility standard> <version>,
           the identity as it was approved,
           the inventory at the version the transition was decided
           from
policy:
  every surface on the inventory gets a recorded answer, and a surface
    left on the old identity carries the reason it was left
  an issued version is never edited. A change goes out as a new
    version, and the version it replaces stays readable
  work signed under the old version is judged against that version
    until <who> says otherwise
  nothing publishes on a name, a domain or a mark the organization
    does not hold
  sign-off is a human gate and is never delegated to an agent
  anything changed after sign-off goes back through sign-offs
  every address a renamed page held keeps pointing at a page, and the
    redirect is set before the old address stops serving
  the old identity's files leave the asset store only after the
    switch, and the versions that came down stay readable
  a surface with a known accessibility failure goes live only when
    <who> accepts the failure in writing, and the acceptance is
    recorded
measures:
  cycle time: <target> from the approved identity to the switch date
  coverage: <share> of the surfaces on the inventory carrying the new
            version <weeks> after the switch
  remainder: the count of surfaces still on the old identity,
             restated every <cadence> until <who> accepts the number
  quality gate: nothing goes live unsigned, no address is left broken,
                and nothing goes out on a name the organization does
                not hold
```

Paste this into an assistant that can read the web, such as Claude, ChatGPT or Cursor. It reads the specification and the current CrewAI documentation, then writes two files: the flow, and a note on what did not survive the translation. Read the note first. What a runtime cannot express is the part worth arguing about, and this process is a draft to argue with.

Convert the business process below into a runnable CrewAI Flow:
one Python file with a Pydantic state model, one Flow subclass, @start,
@listen, @router and a durable human feedback provider.

The document is a reference process written to the Agent Processes
specification. Read the specification before you start, because it defines
terms that look ordinary and are not:

  https://agentcatalog.com/spec/agent-processes

Sections 6 (the phase graph), 6.5.1 (exception edges), 6.7.1 (deviations),
7 (automation) and 8 (handoffs) are the ones this conversion turns on.

Then read the current documentation for the primitives you will need, rather
than relying on what you remember of the API:

  https://docs.crewai.com/en/concepts/flows
    Flow, @start, @listen, @router, and_, or_, state, kickoff, plot
  https://docs.crewai.com/en/learn/human-feedback-in-flows
    @human_feedback, the provider protocol, from_pending and resume
  https://docs.crewai.com/en/guides/flows/mastering-flow-state
    @persist and what persistence actually promises, which is less than it sounds

WHAT THE DOCUMENT ASKS FOR

These hold wherever the process lands, and they matter more than style.

1. Each phase under `phases:` becomes one step, and keeps its name.

2. `after:` gives the edges. `after: a + b` is a join and waits for BOTH.
   Reading it as "either" is the defect the specification calls out by name.

3. Every handoff carries a key in square brackets. Each key becomes one field
   on the run's state, named exactly as the key with hyphens turned into
   underscores, and the sentence beside it becomes that field's comment. The key
   is the stable name; the sentence is prose that may be rewritten.

4. A phase MUST NOT begin before its inbound handoff exists. Where that is
   checkable, check it in the step rather than assuming it.

5. `automation: never` is a gate a person signs. The run stops there and does
   not continue until a person's decision comes back. Do not turn one into a
   notification, a log line, or an automatic transition, whatever the queue
   looks like.

6. Each line under `deviations:` is a backward or sideways edge, returning to
   the phase named on the right. The key in brackets names it, and that name
   belongs in the code.

7. A phase whose `after:` reads like "X or Y, whichever could not finish" is an
   exception edge: it is entered when those phases FAIL, not when they succeed.
   Do not wire it as an ordinary successor.

8. Anything in angle brackets is a blank the adopting organization fills in.
   Leave each one as a named constant at the top of the file with a TODO. Do not
   invent a value, a threshold or a date.

9. Record the document's `from:` line at the top of the file, so it says which
   reference process and which version it was generated from.

10. Run-scoped lines under `run-scoped:` are work that runs alongside the whole
    process rather than at one point in it, and a run may not close while one is
    unfinished. Say in the code what you did about them, including if the answer
    is that the runtime has nowhere to put them.

HOW THAT LOOKS IN CREWAI FLOWS

11. Build a Flow, not a Crew. A Crew is a team of roles with no graph, no join,
    no persistence handle and no gate, and cannot express this document at all.
    Each phase is one method on a single `Flow` subclass, keeping its name with
    hyphens turned into underscores. A phase that genuinely needs role-based agents
    builds its own Crew inside its own method body, and the Flow stays the graph.

12. Declare the state as a Pydantic model bound as the type parameter,
    `class NegotiateTheAgreement(Flow[NegotiationState])`, and read and write
    `self.state.field`. Never use the untyped dict form: the handoff keys are this
    process's memory, and an untyped dict turns a misspelt key into a handoff that
    is silently absent. Keep the auto-injected `id` field, which is what every
    resume depends on.

13. `after: a` is `@listen(a)`. `after: a + b` is `@listen(and_(a, b))`. Never
    write `or_` where the document writes `+`.

14. Check every inbound handoff at the top of the method and raise if one is
    missing. `@listen` says when a method may run and says nothing about what is
    in hand when it does.

15. The join is the trap, and it is proven rather than theoretical. `and_()`
    empties its accumulator the moment it fires, so re-entering BOTH arms works
    forever, and re-entering ONE arm after it has fired leaves it holding a single
    trigger and waiting for the other for good. The cascade drains, CrewAI prints
    that the flow completed, and `kickoff()` returns normally. So for any joining
    phase that a deviation can send work back into, do not use `and_()` at all:
    make the join a `@router` that both arms trigger, which reads the state fields
    and emits its label only when every inbound handoff is present. A router is
    re-evaluated against durable state every time and is never suppressed by the
    once-fired set.

16. Do not write a phase as `@listen(or_(and_(a, b), "some_label"))`. There is
    one accumulator per listener, shared across every branch of its condition and
    wiped when any branch satisfies, so the label firing while the join is half
    full erases the arm that had already arrived.

17. `automation: never` is `@human_feedback(message=..., provider=...)` stacked
    under the method's `@listen`, with a provider whose `request_feedback` raises
    `HumanFeedbackPending`. The run then persists, returns that object from
    `kickoff()`, and a different process answers later with `from_pending(flow_id,
    persistence)` and `resume(text)`. Do not take the default `ConsoleProvider`,
    which calls `input()`: that gate exists only while somebody is watching a
    terminal, and a run started by a scheduler either hangs or takes an empty
    string.

18. Silence must not approve, and the platform's default is that it does. With
    `emit=[...]` set, an empty resume collapses to `default_outcome`, or to the
    first label when that is unset, with no model consulted and nobody named. Treat
    an empty or unrecognised answer as a refusal in your own router. And write the
    approver's name and the time onto the state yourself, because
    `HumanFeedbackResult` carries the text, the outcome and a timestamp but has no
    field for the person, which the specification requires.

19. Each line under `deviations:` is a `@router` named after the key, returning
    a label named after the same key, with the target subscribing as
    `@listen(or_(normal_trigger, "the_label"))`. Route rather than listen
    directly, because a router is re-evaluated on every cycle while a top-level
    `or_` listener is suppressed after it first fires.

20. An exception edge is a `try` and `except` around the failing phase's body,
    recording the failure on the state and emitting an exception label from a
    router. Wiring it as `@listen(or_(x, y))` fires when those phases SUCCEED, so
    the clearing phase would run on every healthy run.

21. An unimplemented phase is a method with the document's own sentence as its
    docstring and a bare `pass`, which is safe because listeners still fire on a
    `None` return. An unimplemented `@router` is not safe: returning `None` emits
    no label, every phase below it disappears from the run including the gates, and
    the flow reports success. A stub router must return a hard-coded label with a
    TODO beside it, or raise.

22. Turn persistence on with `@persist(SQLiteFlowPersistence(...))`, then treat
    every phase that performs a real act as something that will run twice.
    Persistence saves the state fields and nothing else, so a restart rehydrates
    the data and runs the graph again from `@start`: a flow that had already sent a
    written refusal sends a second one. Guard each acting phase with a state field
    it checks and sets.

23. There are no timers, no deadlines and no cadences, and `run-scoped:` has no
    counterpart at all. Put each `by:` value as a named constant, name the
    run-scoped lines in the module docstring as unimplemented obligations, and say
    in the fidelity note that no deadline in this document is enforced by anything.
    These absences produce no diagnostic whatsoever, which is exactly why they have
    to be written down.

Produce a second file alongside it, `FIDELITY.md`, and treat it as the more
important of the two. The code is for whoever builds this. The fidelity note
is for whoever has to decide whether this platform suits the process at all,
and that is usually a different person who will never read the code.

It has three parts.

**What came across.** Briefly: how many phases became steps, how many handoff
keys became state fields, which gates stop the run, which deviations became
edges. Counts and names, not reassurance.

**What did not, and what was done instead.** One entry per gap. For each one,
say what the document requires, what the platform can actually express, what
you did in its place, and what breaks if somebody later removes your
workaround. This last part matters most: a workaround nobody understands is a
workaround somebody deletes.

**What a person still has to decide.** The blanks are not a translation
failure, they are the point of a reference process, so list what has to be
filled in before this could run against anything real, and say which of those
choices the platform constrains.

Write it in plain English for somebody who has not read the specification, and
do not soften it. A translation of a reference process is a draft to argue
with, not a build artifact, and the honest account of what was lost is the most
useful thing you will produce.

Here is the process document.

```
PROCESS: brand refresh                id: <team>/brand-refresh   v1
from: ref/mkt/brand-refresh v1
owner: <who>                          effective: <date>
trigger: a new identity is approved by <who>, at the version they
         approved
         watch: record=<the new identity> system=<where it is approved>
                change=<an identity is approved at a version>
concurrency: one run at a time - two transitions at once leave nobody
             able to say which identity is current
goal: every surface, asset, template and registration carrying the new
      identity at its issued version, or recorded as staying on the
      old identity with the reason it was left
phases:
  take-in-identity   - human: what the new identity changes, what it
                       covers, and what it leaves alone
                       owner: standards-keeper
                       after: trigger
                       automation: <level>
  issue-version      - human: the approved identity becomes a numbered
                       version of the brand guidelines
                       owner: standards-keeper
                       after: take-in-identity
                       automation: <level>
  tell-the-readers   - runs decide-and-announce: every process that
                       reads the standard hears what changed and from
                       when
                       owner: standards-keeper
                       after: issue-version
                       by: <days>        automation: <level>
  read-baseline      - human: what people recognize and what they say
                       the organization stands for, read before the
                       switch so the later reading has a comparison
                       owner: study-manager
                       after: take-in-identity
                       by: <weeks>       automation: <level>
  build-inventory    - runs collect-and-report: every page, template,
                       asset and standing send, built from what is
                       actually live rather than from a list
                       owner: content-librarian
                       after: issue-version
                       by: <days>        automation: <level>
  find-registrations - runs collect-and-report: the domains, handles,
                       listings, memberships and marks the
                       organization holds with outside parties
                       owner: supplier-manager
                       after: issue-version
                       by: <days>        automation: <level>
  score-surfaces     - runs assessment: every surface on the inventory
                       scored against the version now in force
                       owner: brand-check
                       after: build-inventory
                       by: <days>        automation: <level>
  decide-surfaces    - convenes decide-and-announce: each surface gets
                       one of remake, replace, retire, or leave under
                       the version it was made under
                       owner: content-librarian
                       after: score-surfaces + find-registrations
                       automation: <level>
  check-capacity     - human: the agents the transition needs, the
                       weeks it takes, the money it draws, and the
                       committed work it would displace
                       owner: capacity-manager
                       after: decide-surfaces
                       by: <days>        automation: <level>
  set-switch-date    - convenes decide-and-announce: the day the
                       identity goes public, which surfaces change
                       before it, and which change after
                       owner: decision-coordinator
                       after: check-capacity
                       by: <date>        automation: never
  brief-the-work     - convenes briefing: what each surface needs and
                       when it is due, heard by every agent at once
                       owner: content-librarian
                       after: set-switch-date
                       automation: <level>
  rebuild-templates  - runs build-by-talent: the page templates, the
                       email templates and the document templates,
                       rebuilt before anything made from them
                       owner: creative-producer
                       after: brief-the-work
                       by: <days>        automation: <level>
  remake-assets      - runs build-by-talent: the logos, the images and
                       the video, at every size already in use
                       owner: creative-producer
                       after: rebuild-templates
                       by: <weeks>       automation: <level>
  rewrite-words      - human: the names, the boilerplate and the
                       descriptions the new identity changed
                       owner: copywriter
                       after: rebuild-templates
                       by: <weeks>       automation: <level>
  register-marks     - human: the domains, handles and marks the new
                       identity needs, searched and registered before
                       anything goes out on them
                       owner: supplier-manager
                       after: set-switch-date
                       by: <weeks>       automation: never
  get-sign-offs      - convenes approval: brand, legal and rights
                       sign, as named signers, against a version of
                       the templates and the remade material
                       owner: <your legal role>
                       after: rebuild-templates + remake-assets +
                              rewrite-words
                       by: <days>        automation: never
  check-material     - runs assessment: contrast, alt text, heading
                       order, links and addresses, against the
                       accessibility standard at its version
                       owner: accessibility-check
                       after: get-sign-offs
                       by: <days>        automation: <level>
  stage-changes      - human: the approved templates and material
                       built into the properties as drafts, with
                       previews, still not serving
                       owner: web-producer
                       after: check-material
                       by: <days>        automation: <level>
  switch-properties  - human: the named owner says go and the site,
                       the templates and the sending system change
                       over in the order that was set
                       owner: web-producer
                       after: stage-changes + register-marks
                       automation: <level>
  change-profiles    - human: the profiles, listings and partner pages
                       the organization does not serve itself
                       owner: supplier-manager
                       after: switch-properties
                       by: <days>        automation: <level>
  announce           - human: the announcement goes out once the
                       properties already show the new identity
                       owner: comms-manager
                       after: switch-properties
                       automation: <level>
  sweep              - runs assessment: what still carries the old
                       identity, on the organization's own surfaces
                       and on other people's
                       owner: brand-check
                       after: change-profiles + announce
                       by: <weeks>       automation: <level>
  retire-old         - human: the old files come out of the asset
                       store, and the version they belong to is marked
                       as no longer current and left readable
                       owner: standards-keeper
                       after: sweep
                       by: <days>        automation: <level>
  read-again         - runs collect-and-report: the same study, worded
                       the same way, set beside the baseline
                       owner: study-manager
                       after: retire-old + read-baseline
                       by: <weeks>       automation: <level>
  report-transition  - runs collect-and-report: what changed, what was
                       left on the old identity, what it cost, and
                       what the numbers did
                       owner: content-librarian
                       after: retire-old + read-again
                       by: <weeks>       automation: <level>
  record-learnings   - convenes debrief: what to repeat, what to avoid
                       owner: standards-keeper
                       after: report-transition
                       automation: <level>
run-scoped:
  status   - runs roll-call                  owner: capacity-manager
             every: <cadence>
             from: brief-the-work   until: sweep
  spend    - runs allocate-and-reconcile     owner: budget-keeper
             from: check-capacity   until: run close
  coverage - runs collect-and-report         owner: coverage-monitor
             every: <cadence>
             from: announce   until: run close
handoffs:
  take-in-identity -> issue-version [approved-identity]: the identity
    as it was approved, and what it changes in the standard now in
    force
  take-in-identity -> read-baseline [baseline-questions]: what the
    study has to be able to say afterwards, so the questions are
    written before the switch
  issue-version -> tell-the-readers [issued-version]: the numbered
    version, what changed in it, and the date it applies from
  issue-version -> build-inventory / find-registrations [new-version]:
    the version every surface is about to be read against
  build-inventory -> score-surfaces [surface-inventory]: the inventory
    at a version, with every surface carrying where it lives, who owns
    it, and the date it last changed
  find-registrations -> decide-surfaces [registrations]: every domain,
    handle, listing and mark, with its owner, its renewal date, and
    the notice a change needs
  score-surfaces -> decide-surfaces [surface-scores]: a verdict per
    surface against the new version, with the rule behind every
    failure
  decide-surfaces -> check-capacity [surface-decisions]: the surfaces
    to remake, replace and retire, each with what it will take
  check-capacity -> set-switch-date [transition-cost]: what the
    transition needs, what room is left in the period, and what a date
    would displace
  set-switch-date -> brief-the-work [switch-date-and-order]: the
    switch date, the surfaces that have to change before it, and the
    order they change in
  set-switch-date -> register-marks [names-to-register]: the names,
    domains and handles the new identity needs, and the date they have
    to be held by
  brief-the-work -> rebuild-templates [template-brief]: what each
    template has to become, as every agent heard it
  rebuild-templates -> remake-assets / rewrite-words [templates]: the
    templates at a version, with the sizes, the safe areas and the
    character counts the material has to fit
  remake-assets -> get-sign-offs [remade-assets]: the remade set at a
    version, naming the old asset each piece replaces
  rewrite-words -> get-sign-offs [rewritten-wording]: the changed
    wording at a version, with the old wording beside it
  get-sign-offs -> check-material [signed-material]: the approved
    material at the signed version. A later change voids the approval
    and sign-offs run again
  check-material -> stage-changes [material-scores]: the scored list,
    with the rule behind every failure and what it could not test
  stage-changes -> switch-properties [staged-properties]: every
    property built and previewed, with the order the switch fires in
  register-marks -> switch-properties [held-names]: the names, domains
    and marks the organization now holds, with the date each was
    secured
  switch-properties -> change-profiles / announce [what-went-live]:
    what went live, at which version, at what time, and who said go
  change-profiles -> sweep [changed-profiles]: every profile and
    listing that changed, and every one that could not be changed with
    the reason
  sweep -> retire-old [old-identity-remainder]: what still carries the
    old identity, where it is, and whether the organization can change
    it
  retire-old -> read-again [retirement-date]: the date the old version
    stopped being current, so the reading afterwards knows what it is
    measuring
  read-baseline -> read-again [baseline-reading]: the questions at the
    version they were asked at, and the responses behind the baseline
  read-again -> report-transition [second-reading]: the second reading
    beside the baseline, with the statistician saying whether the
    difference is larger than the noise in the measurement
  report-transition -> record-learnings [the-report]: the account of
    the transition, as delivered
deviations:
  check-capacity -> decide-surfaces [plan-does-not-fit]: the
    transition does not fit the period, so the surfaces are decided
    again against what the department can carry
  register-marks -> take-in-identity [mark-already-held]: somebody
    else holds the name, the handle or the mark, so the identity goes
    back to the people who approved it
  get-sign-offs -> remake-assets [asset-changes]: a signer comes back
    with changes to the remade assets
  get-sign-offs -> rewrite-words [wording-changes]: a signer comes
    back with changes to the rewritten wording
  check-material -> issue-version [colors-fail-contrast]: the new
    colors fail the contrast rule, which no producing agent can fix,
    so the question goes back to the standard
  check-material -> remake-assets [material-failures]: the check finds
    failures in the remade material, so the material is made again
  sweep -> build-inventory [inventory-missed-a-surface]: the sweep
    finds a surface the inventory never held, so the inventory is
    built again at a new version
  sweep -> remake-assets [still-on-old-identity]: a surface still
    carries the old identity, so the material for it is made again
bindings:
  roster:  <who holds each role - agents claiming the abstract agents
           above, and named people for the brand owner, leadership,
           legal and rights>
  systems: the standards store (write), the content inventory (write),
           the asset store (write), the CMS (write),
           redirects and address settings (write),
           the sending system (write),
           the supplier and registration record (write),
           the book of work (write), the budget record (write),
           the study record (write), the response record (write),
           the coverage record (write), the review record (write),
           analytics platforms (read),
           the notification channel (write)
  data:    brand guidelines <version>, <your claims register>
           <version>, <your accessibility standard> <version>,
           the identity as it was approved,
           the inventory at the version the transition was decided
           from
policy:
  every surface on the inventory gets a recorded answer, and a surface
    left on the old identity carries the reason it was left
  an issued version is never edited. A change goes out as a new
    version, and the version it replaces stays readable
  work signed under the old version is judged against that version
    until <who> says otherwise
  nothing publishes on a name, a domain or a mark the organization
    does not hold
  sign-off is a human gate and is never delegated to an agent
  anything changed after sign-off goes back through sign-offs
  every address a renamed page held keeps pointing at a page, and the
    redirect is set before the old address stops serving
  the old identity's files leave the asset store only after the
    switch, and the versions that came down stay readable
  a surface with a known accessibility failure goes live only when
    <who> accepts the failure in writing, and the acceptance is
    recorded
measures:
  cycle time: <target> from the approved identity to the switch date
  coverage: <share> of the surfaces on the inventory carrying the new
            version <weeks> after the switch
  remainder: the count of surfaces still on the old identity,
             restated every <cadence> until <who> accepts the number
  quality gate: nothing goes live unsigned, no address is left broken,
                and nothing goes out on a name the organization does
                not hold
```

Paste this into an assistant that can read the web, such as Claude, ChatGPT or Cursor. It reads the specification and the current ADK documentation, then writes two files: the workflow, and a note on what did not survive the translation. Read the note first. What a runtime cannot express is the part worth arguing about, and this process is a draft to argue with.

Convert the business process below into a runnable Google ADK workflow:
one Python file with a Workflow, nodes, routed edges, a JoinNode,
RequestInput gates and a persisting session service.

The document is a reference process written to the Agent Processes
specification. Read the specification before you start, because it defines
terms that look ordinary and are not:

  https://agentcatalog.com/spec/agent-processes

Sections 6 (the phase graph), 6.5.1 (exception edges), 6.7.1 (deviations),
7 (automation) and 8 (handoffs) are the ones this conversion turns on.

Then read the current documentation for the primitives you will need, rather
than relying on what you remember of the API:

  https://adk.dev/graphs/routes/
    nodes, tuple chains, Event(route=), JoinNode, back-edges
  https://adk.dev/graphs/human-input/
    RequestInput and the rerun_on_resume handoff
  https://adk.dev/runtime/resume/
    ResumabilityConfig, resuming by invocation id, at-least-once tools
  https://adk.dev/graphs/data-handling/
    Event.output against state, and the selector syntax in instructions

WHAT THE DOCUMENT ASKS FOR

These hold wherever the process lands, and they matter more than style.

1. Each phase under `phases:` becomes one step, and keeps its name.

2. `after:` gives the edges. `after: a + b` is a join and waits for BOTH.
   Reading it as "either" is the defect the specification calls out by name.

3. Every handoff carries a key in square brackets. Each key becomes one field
   on the run's state, named exactly as the key with hyphens turned into
   underscores, and the sentence beside it becomes that field's comment. The key
   is the stable name; the sentence is prose that may be rewritten.

4. A phase MUST NOT begin before its inbound handoff exists. Where that is
   checkable, check it in the step rather than assuming it.

5. `automation: never` is a gate a person signs. The run stops there and does
   not continue until a person's decision comes back. Do not turn one into a
   notification, a log line, or an automatic transition, whatever the queue
   looks like.

6. Each line under `deviations:` is a backward or sideways edge, returning to
   the phase named on the right. The key in brackets names it, and that name
   belongs in the code.

7. A phase whose `after:` reads like "X or Y, whichever could not finish" is an
   exception edge: it is entered when those phases FAIL, not when they succeed.
   Do not wire it as an ordinary successor.

8. Anything in angle brackets is a blank the adopting organization fills in.
   Leave each one as a named constant at the top of the file with a TODO. Do not
   invent a value, a threshold or a date.

9. Record the document's `from:` line at the top of the file, so it says which
   reference process and which version it was generated from.

10. Run-scoped lines under `run-scoped:` are work that runs alongside the whole
    process rather than at one point in it, and a run may not close while one is
    unfinished. Say in the code what you did about them, including if the answer
    is that the runtime has nowhere to put them.

HOW THAT LOOKS IN GOOGLE ADK

11. Build a `Workflow` from `google.adk.workflow`, and pin `google-adk>=2.0` in
    a comment. Do not use `SequentialAgent`, `ParallelAgent` or `LoopAgent`: they
    are deprecated in favour of the graph, and they carry their own defects around
    state and control flow. The documentation moved to adk.dev, and anything you
    remember about nesting agents rather than drawing a graph is out of date.

12. Each phase is one node keeping its name. Take the node kind from how the
    phase resolves rather than from taste: a `human:` or `system:` phase is a plain
    Python function node, and a `runs` or `convenes` phase is an `Agent`.

13. `after:` gives the edges, written as tuple chains in `edges=[...]`, and the
    trigger is the `"START"` keyword. Take the order only from `after:` lines and
    never from the order the phases are listed in.

14. `after: a + b` is a `JoinNode`, and it must be guarded, because this is the
    worst trap of any runtime here. The join fires when every static predecessor is
    marked COMPLETED, nothing ever un-completes a node, and stored outputs are
    never cleared. So after a deviation re-runs one arm, the join fires the instant
    that arm finishes and hands the next phase LAST PASS'S value for every arm that
    did not re-run. It does not stall, it proceeds with stale data, and nothing
    logs. Stamp each arm's output with a pass counter or a content hash, and have
    the phase after the join compare the stamps and refuse to run when they
    disagree.

15. Each line under `deviations:` is a routed back-edge: a router after the
    phase on the left returning `Event(route=...)`, named after the key in
    brackets, with one arm going back to the phase on the right and one going
    forward. An unconditional cycle raises at construction, which is the one place
    this model checks your work. Nothing budgets a routed cycle, so add your own
    count and stop rather than looping forever.

16. Give every router an explicit `DEFAULT_ROUTE` arm, and route it to a phase
    that stops and asks a person. A route value matching no key writes a log
    warning, ends that branch, and lets the run finish reporting success with the
    rest of the process never having happened.

17. `automation: never` is a `RequestInput` node of its own, never an `Agent`
    asking a question. Decorate it `@node(rerun_on_resume=False)` and yield
    `RequestInput(message=..., payload=..., response_schema=...)`, so the run
    stops, persists, and delivers the person's answer to the node's successor as
    its typed input. A resumed workflow runs its tools at least once, so any
    irreversible act needs its own duplicate guard.

18. Make the gates durable or say plainly that they are not. Wrap the graph in
    `App(..., resumability_config=ResumabilityConfig(is_resumable=True))` and pass
    a persisting session service, never the in-memory one. Note in the file that
    the command line and the web UI cannot resume a run, so whoever releases these
    gates needs an operator surface that somebody has to write.

19. Every `Agent` in the graph gets `mode="single_turn"` and no `sub_agents`.
    A non-empty `sub_agents` list silently adds a transfer tool, and a model that
    uses it runs a different agent in this node's place while the graph's outgoing
    edge fires on schedule regardless: the topology is honoured perfectly and the
    work belongs to somebody else.

20. Model failure as a route, not as an exception. A node that raises does not
    propagate: the failure is caught, recorded, and shuts the workflow down without
    raising to the caller. So a phase that can fail catches its own failure and
    returns `Event(route="could-not-finish")`, and the exception phase hangs off
    that arm.

21. Keep every blank as a named module-level constant and never interpolate one
    into an `instruction=` string. Angle brackets and curly braces are ADK's own
    data selector syntax inside instructions, so a blank pasted verbatim stops
    being a blank and becomes a selector.

22. `by:` and `not-before:` have no expression, and `@node(timeout=)` is not
    one: it is an in-process wall clock that cancels the node and, because failures
    are swallowed, ends the run silently rather than recording a missed deadline.
    Nothing in `run-scoped:` has an expression either, and it must not be faked as
    an ordinary node, because a node has to be reached and has to finish before
    anything downstream starts, which is the opposite of what those lines mean.
    Leave both out of the graph and name them in the fidelity note.

Produce a second file alongside it, `FIDELITY.md`, and treat it as the more
important of the two. The code is for whoever builds this. The fidelity note
is for whoever has to decide whether this platform suits the process at all,
and that is usually a different person who will never read the code.

It has three parts.

**What came across.** Briefly: how many phases became steps, how many handoff
keys became state fields, which gates stop the run, which deviations became
edges. Counts and names, not reassurance.

**What did not, and what was done instead.** One entry per gap. For each one,
say what the document requires, what the platform can actually express, what
you did in its place, and what breaks if somebody later removes your
workaround. This last part matters most: a workaround nobody understands is a
workaround somebody deletes.

**What a person still has to decide.** The blanks are not a translation
failure, they are the point of a reference process, so list what has to be
filled in before this could run against anything real, and say which of those
choices the platform constrains.

Write it in plain English for somebody who has not read the specification, and
do not soften it. A translation of a reference process is a draft to argue
with, not a build artifact, and the honest account of what was lost is the most
useful thing you will produce.

Here is the process document.

```
PROCESS: brand refresh                id: <team>/brand-refresh   v1
from: ref/mkt/brand-refresh v1
owner: <who>                          effective: <date>
trigger: a new identity is approved by <who>, at the version they
         approved
         watch: record=<the new identity> system=<where it is approved>
                change=<an identity is approved at a version>
concurrency: one run at a time - two transitions at once leave nobody
             able to say which identity is current
goal: every surface, asset, template and registration carrying the new
      identity at its issued version, or recorded as staying on the
      old identity with the reason it was left
phases:
  take-in-identity   - human: what the new identity changes, what it
                       covers, and what it leaves alone
                       owner: standards-keeper
                       after: trigger
                       automation: <level>
  issue-version      - human: the approved identity becomes a numbered
                       version of the brand guidelines
                       owner: standards-keeper
                       after: take-in-identity
                       automation: <level>
  tell-the-readers   - runs decide-and-announce: every process that
                       reads the standard hears what changed and from
                       when
                       owner: standards-keeper
                       after: issue-version
                       by: <days>        automation: <level>
  read-baseline      - human: what people recognize and what they say
                       the organization stands for, read before the
                       switch so the later reading has a comparison
                       owner: study-manager
                       after: take-in-identity
                       by: <weeks>       automation: <level>
  build-inventory    - runs collect-and-report: every page, template,
                       asset and standing send, built from what is
                       actually live rather than from a list
                       owner: content-librarian
                       after: issue-version
                       by: <days>        automation: <level>
  find-registrations - runs collect-and-report: the domains, handles,
                       listings, memberships and marks the
                       organization holds with outside parties
                       owner: supplier-manager
                       after: issue-version
                       by: <days>        automation: <level>
  score-surfaces     - runs assessment: every surface on the inventory
                       scored against the version now in force
                       owner: brand-check
                       after: build-inventory
                       by: <days>        automation: <level>
  decide-surfaces    - convenes decide-and-announce: each surface gets
                       one of remake, replace, retire, or leave under
                       the version it was made under
                       owner: content-librarian
                       after: score-surfaces + find-registrations
                       automation: <level>
  check-capacity     - human: the agents the transition needs, the
                       weeks it takes, the money it draws, and the
                       committed work it would displace
                       owner: capacity-manager
                       after: decide-surfaces
                       by: <days>        automation: <level>
  set-switch-date    - convenes decide-and-announce: the day the
                       identity goes public, which surfaces change
                       before it, and which change after
                       owner: decision-coordinator
                       after: check-capacity
                       by: <date>        automation: never
  brief-the-work     - convenes briefing: what each surface needs and
                       when it is due, heard by every agent at once
                       owner: content-librarian
                       after: set-switch-date
                       automation: <level>
  rebuild-templates  - runs build-by-talent: the page templates, the
                       email templates and the document templates,
                       rebuilt before anything made from them
                       owner: creative-producer
                       after: brief-the-work
                       by: <days>        automation: <level>
  remake-assets      - runs build-by-talent: the logos, the images and
                       the video, at every size already in use
                       owner: creative-producer
                       after: rebuild-templates
                       by: <weeks>       automation: <level>
  rewrite-words      - human: the names, the boilerplate and the
                       descriptions the new identity changed
                       owner: copywriter
                       after: rebuild-templates
                       by: <weeks>       automation: <level>
  register-marks     - human: the domains, handles and marks the new
                       identity needs, searched and registered before
                       anything goes out on them
                       owner: supplier-manager
                       after: set-switch-date
                       by: <weeks>       automation: never
  get-sign-offs      - convenes approval: brand, legal and rights
                       sign, as named signers, against a version of
                       the templates and the remade material
                       owner: <your legal role>
                       after: rebuild-templates + remake-assets +
                              rewrite-words
                       by: <days>        automation: never
  check-material     - runs assessment: contrast, alt text, heading
                       order, links and addresses, against the
                       accessibility standard at its version
                       owner: accessibility-check
                       after: get-sign-offs
                       by: <days>        automation: <level>
  stage-changes      - human: the approved templates and material
                       built into the properties as drafts, with
                       previews, still not serving
                       owner: web-producer
                       after: check-material
                       by: <days>        automation: <level>
  switch-properties  - human: the named owner says go and the site,
                       the templates and the sending system change
                       over in the order that was set
                       owner: web-producer
                       after: stage-changes + register-marks
                       automation: <level>
  change-profiles    - human: the profiles, listings and partner pages
                       the organization does not serve itself
                       owner: supplier-manager
                       after: switch-properties
                       by: <days>        automation: <level>
  announce           - human: the announcement goes out once the
                       properties already show the new identity
                       owner: comms-manager
                       after: switch-properties
                       automation: <level>
  sweep              - runs assessment: what still carries the old
                       identity, on the organization's own surfaces
                       and on other people's
                       owner: brand-check
                       after: change-profiles + announce
                       by: <weeks>       automation: <level>
  retire-old         - human: the old files come out of the asset
                       store, and the version they belong to is marked
                       as no longer current and left readable
                       owner: standards-keeper
                       after: sweep
                       by: <days>        automation: <level>
  read-again         - runs collect-and-report: the same study, worded
                       the same way, set beside the baseline
                       owner: study-manager
                       after: retire-old + read-baseline
                       by: <weeks>       automation: <level>
  report-transition  - runs collect-and-report: what changed, what was
                       left on the old identity, what it cost, and
                       what the numbers did
                       owner: content-librarian
                       after: retire-old + read-again
                       by: <weeks>       automation: <level>
  record-learnings   - convenes debrief: what to repeat, what to avoid
                       owner: standards-keeper
                       after: report-transition
                       automation: <level>
run-scoped:
  status   - runs roll-call                  owner: capacity-manager
             every: <cadence>
             from: brief-the-work   until: sweep
  spend    - runs allocate-and-reconcile     owner: budget-keeper
             from: check-capacity   until: run close
  coverage - runs collect-and-report         owner: coverage-monitor
             every: <cadence>
             from: announce   until: run close
handoffs:
  take-in-identity -> issue-version [approved-identity]: the identity
    as it was approved, and what it changes in the standard now in
    force
  take-in-identity -> read-baseline [baseline-questions]: what the
    study has to be able to say afterwards, so the questions are
    written before the switch
  issue-version -> tell-the-readers [issued-version]: the numbered
    version, what changed in it, and the date it applies from
  issue-version -> build-inventory / find-registrations [new-version]:
    the version every surface is about to be read against
  build-inventory -> score-surfaces [surface-inventory]: the inventory
    at a version, with every surface carrying where it lives, who owns
    it, and the date it last changed
  find-registrations -> decide-surfaces [registrations]: every domain,
    handle, listing and mark, with its owner, its renewal date, and
    the notice a change needs
  score-surfaces -> decide-surfaces [surface-scores]: a verdict per
    surface against the new version, with the rule behind every
    failure
  decide-surfaces -> check-capacity [surface-decisions]: the surfaces
    to remake, replace and retire, each with what it will take
  check-capacity -> set-switch-date [transition-cost]: what the
    transition needs, what room is left in the period, and what a date
    would displace
  set-switch-date -> brief-the-work [switch-date-and-order]: the
    switch date, the surfaces that have to change before it, and the
    order they change in
  set-switch-date -> register-marks [names-to-register]: the names,
    domains and handles the new identity needs, and the date they have
    to be held by
  brief-the-work -> rebuild-templates [template-brief]: what each
    template has to become, as every agent heard it
  rebuild-templates -> remake-assets / rewrite-words [templates]: the
    templates at a version, with the sizes, the safe areas and the
    character counts the material has to fit
  remake-assets -> get-sign-offs [remade-assets]: the remade set at a
    version, naming the old asset each piece replaces
  rewrite-words -> get-sign-offs [rewritten-wording]: the changed
    wording at a version, with the old wording beside it
  get-sign-offs -> check-material [signed-material]: the approved
    material at the signed version. A later change voids the approval
    and sign-offs run again
  check-material -> stage-changes [material-scores]: the scored list,
    with the rule behind every failure and what it could not test
  stage-changes -> switch-properties [staged-properties]: every
    property built and previewed, with the order the switch fires in
  register-marks -> switch-properties [held-names]: the names, domains
    and marks the organization now holds, with the date each was
    secured
  switch-properties -> change-profiles / announce [what-went-live]:
    what went live, at which version, at what time, and who said go
  change-profiles -> sweep [changed-profiles]: every profile and
    listing that changed, and every one that could not be changed with
    the reason
  sweep -> retire-old [old-identity-remainder]: what still carries the
    old identity, where it is, and whether the organization can change
    it
  retire-old -> read-again [retirement-date]: the date the old version
    stopped being current, so the reading afterwards knows what it is
    measuring
  read-baseline -> read-again [baseline-reading]: the questions at the
    version they were asked at, and the responses behind the baseline
  read-again -> report-transition [second-reading]: the second reading
    beside the baseline, with the statistician saying whether the
    difference is larger than the noise in the measurement
  report-transition -> record-learnings [the-report]: the account of
    the transition, as delivered
deviations:
  check-capacity -> decide-surfaces [plan-does-not-fit]: the
    transition does not fit the period, so the surfaces are decided
    again against what the department can carry
  register-marks -> take-in-identity [mark-already-held]: somebody
    else holds the name, the handle or the mark, so the identity goes
    back to the people who approved it
  get-sign-offs -> remake-assets [asset-changes]: a signer comes back
    with changes to the remade assets
  get-sign-offs -> rewrite-words [wording-changes]: a signer comes
    back with changes to the rewritten wording
  check-material -> issue-version [colors-fail-contrast]: the new
    colors fail the contrast rule, which no producing agent can fix,
    so the question goes back to the standard
  check-material -> remake-assets [material-failures]: the check finds
    failures in the remade material, so the material is made again
  sweep -> build-inventory [inventory-missed-a-surface]: the sweep
    finds a surface the inventory never held, so the inventory is
    built again at a new version
  sweep -> remake-assets [still-on-old-identity]: a surface still
    carries the old identity, so the material for it is made again
bindings:
  roster:  <who holds each role - agents claiming the abstract agents
           above, and named people for the brand owner, leadership,
           legal and rights>
  systems: the standards store (write), the content inventory (write),
           the asset store (write), the CMS (write),
           redirects and address settings (write),
           the sending system (write),
           the supplier and registration record (write),
           the book of work (write), the budget record (write),
           the study record (write), the response record (write),
           the coverage record (write), the review record (write),
           analytics platforms (read),
           the notification channel (write)
  data:    brand guidelines <version>, <your claims register>
           <version>, <your accessibility standard> <version>,
           the identity as it was approved,
           the inventory at the version the transition was decided
           from
policy:
  every surface on the inventory gets a recorded answer, and a surface
    left on the old identity carries the reason it was left
  an issued version is never edited. A change goes out as a new
    version, and the version it replaces stays readable
  work signed under the old version is judged against that version
    until <who> says otherwise
  nothing publishes on a name, a domain or a mark the organization
    does not hold
  sign-off is a human gate and is never delegated to an agent
  anything changed after sign-off goes back through sign-offs
  every address a renamed page held keeps pointing at a page, and the
    redirect is set before the old address stops serving
  the old identity's files leave the asset store only after the
    switch, and the versions that came down stay readable
  a surface with a known accessibility failure goes live only when
    <who> accepts the failure in writing, and the acceptance is
    recorded
measures:
  cycle time: <target> from the approved identity to the switch date
  coverage: <share> of the surfaces on the inventory carrying the new
            version <weeks> after the switch
  remainder: the count of surfaces still on the old identity,
             restated every <cadence> until <who> accepts the number
  quality gate: nothing goes live unsigned, no address is left broken,
                and nothing goes out on a name the organization does
                not hold
```