FACTUAL ACTIVITY RECORD · An activity record based on work that took place
Making Pencil work a safe lifecycle
Combining document identity, official export, saving, ownership-aware shutdown, and runtime reset in one contract
Purpose
Design work in Pencil Desktop needed a consistent state contract to prevent editing the wrong document, weak physical-export evidence, discarded unsaved changes, and GUI runtimes left running.
The goal was to fix the authoring surface and make the sequence from preflight through saving, export, and shutdown reproducible, with safe stopping behavior for failures and approval waits.
Implementation
.agents/skills/pencil-design-workflow/SKILL.md defined a bounded lifecycle that moved through preflight, launch/connect, identity-check, work, export, verify/save, and teardown. A later state could not begin before its prerequisites were satisfied, and waiting work could not manipulate the same artifact concurrently through another surface.
Authoring was fixed to Pencil Desktop plus MCP. Read, write, and export operations could not begin until the active document's physical .pen path matched the canonical path. When Desktop or MCP was unavailable, the workflow returned waiting or a blocker instead of switching to an IDE extension, CLI, or headless path.
Physical export used Computer Use to operate Pencil Desktop's official Export UI while keeping the same identity-checked document active. The format, scale, and output path were fixed in advance, followed by checks of the output file, dimensions, frame mapping, and visual acceptance. MCP screenshots and base64 results could support layout checks but not substitute for physical evidence.
- After Computer Use started, record Pencil's running state with
list_apps()before the first app-state read. - Classify launch ownership as
user-owned,task-owned, orunknown, and do not close when ownership of unsaved changes is unclear. - Only a saved, task-owned app can receive a normal quit while Computer Use remains active; afterward, confirm the stopped state with
list_apps()without invoking a state read that could relaunch it. - Run
mcp__node_repl__js_reset({})exactly once as the final operation and do not reuse Computer Use afterward. If the tool is absent or fails, report a blocker instead of claiming cleanup.
Desktop UI export allowed at most one diagnostic retry after obtaining fresh state and correcting one evidence-backed cause. Repeated errors, operations without identity, and surface switching stopped with preservation checks. Direct access to .pen content through shell, generic file tools, or scripts was also prohibited.
The agent definition, CEO prompt, operating guidance, handoff examples, and verification checklist were synchronized to the same contract. Inspection found outdated surface guidance, incorrect teardown ordering, a missing direct-access prohibition, and an undefined runtime-reset step. These were corrected, including a fail-closed condition for an unavailable reset tool.
1. `preflight`: repository、branch、対象file、Task acceptance、Pencil Desktop / MCP availabilityを確認する
2. `launch/connect`: Pencil Desktopを起動しMCPへ接続する
3. `identity-check`: active documentと対象physical `.pen`が一致することを確認する
4. `work`: Task scope内のread / authoring / layout確認を行う
5. `export`: Taskで要求された時だけDesktop公式Export UIをComputer Useで操作して書き出す
6. `verify/save`: physical outputと保存済み`.pen`を検証する
7. `teardown`: Computer Use runtimeを維持したままtask-owned Pencil Desktopを先に終了確認し、その後GUI automation runtimeをcleanup / resetするRendering diagram…
What was confirmed
Verification results
The fixed Pencil Desktop plus MCP surface, document identity, official Export UI, explicit saving, and safe teardown were applied as one state contract.
The project and agent TOMLs parsed successfully while retaining nine agents, a thread cap of 12, and delegation depth of one.
Cross-file checks for the reset contract and fail-closed condition, negative searches for obsolete surfaces and ambiguous cleanup guidance, the secret scan, and the diff check passed.
At the cutoff, the workflow and operating guidance had been applied to the target. Product-specific design changes and execution of every failure path in a live Pencil session were outside this Activity.
Basis for completion
The work was complete when the start-to-shutdown states, physical export, saving, ownership, retry, and runtime-reset contracts were aligned across configuration, Skill, and operating guidance; syntax, search, and diff checks passed; and the result was applied to the target.