Enforce constitution delegation policies at spawn time

[tylerreckart]

Phase C2 leftover from ROADMAP Phase 5: constitutions can declare runtime spawn gates so the model cannot /agent forge (or re-delegate past a per-agent depth) just by ignoring the prompt.

What

Optional delegation object on Constitution:

Field	Default	Role
max_depth	global 2	Child depth this agent may spawn to (0..2; must not exceed the hard cap)
allowed_callees	empty = unrestricted	Primary allowlist
denied_callees	empty = unrestricted	Optional denylist (e.g. forbid forge without listing the roster)
max_subtree_tokens / max_subtree_usd	unlimited	Delegated-work cap for the current top-level turn (not max_tokens)

Unknown/malformed policy fields throw at parse (admit fail closed). Stock agents/*.json omit the block, so today’s roster is unchanged.

Enforcement

Same fail-closed ERR: posture as the existing depth >= 2 guard, in:

• make_invoker (/agent)
• make_parallel_invoker (/parallel)
• run_ephemeral (JIT ensure covers, caller = index, child depth 1)

Caller policy applies when spawning (index cannot send work to a forbidden callee). The child’s own max_depth applies when it tries to re-delegate or when it would run deeper than it is allowed. Budget denial stops further spawn; the in-flight child is not killed mid-turn.

Presence review does not consult this gate (still fail-open, cannot halt).

Tests

• Parse + fail-closed unknown fields + stock starters (unit_constitution)
• Orchestrator spawn denial without a live LLM (unit_delegation): forbidden callee, max_depth 0/1, budget exceeded, /agent, /parallel, JIT run_ephemeral

Docs

New delegation policies; constitution / writ / reconcile / architecture / SSE / create-agent schema; ROADMAP checkbox + “Consitutions” typo; CHANGELOG.