diff --git a/workflows/drive-cloud.yaml b/workflows/drive-cloud.yaml
index 04670a1dd..a44fb0c58 100644
--- a/workflows/drive-cloud.yaml
+++ b/workflows/drive-cloud.yaml
@@ -179,10 +179,19 @@ workflows:
     dependsOn:
     - assess-gate-1
     maxIterations: 3
-    task: "Read ops/NEXT.md, AGENTS.md, and the relevant parts of\ndocs/RFC-0001-everything-is-a-relayflow.md.\
-      \ Implement exactly that\nwork package \u2014 nothing more. Run the definition-of-done commands\n\
-      yourself and iterate until they pass. Keep files small and\nsingle-purpose. End with BUILD_DONE\
-      \ only when the definition of done\npasses locally; paste the passing output.\n"
+    task: "Before touching your work package, prepare this sandbox: build the\nkernel binary that sdk/tests/live-kernel.test.ts\
+      \ exec's via\nops/cargo.sh's RELAYFLOWD_BIN, and restore +x on preflight fixtures\nthat the sandbox\
+      \ strips. Run these three commands (subshells so cd\nsurvives if you invoke them as separate tool\
+      \ calls):\n\n    chmod +x ops/cargo.sh\n    ( cd kernel && sh ../ops/cargo.sh build )\n    find\
+      \ testdata/preflight -type f -name '*-cli' -exec chmod +x {} +\n\nEach must succeed. Do NOT swallow\
+      \ errors with `|| true` \u2014 a silent\nskip here reproduces the \"19 SDK failures\" PR #63 explicitly\
+      \ reported\nin its ops/NEEDS_HUMAN.md. Paste the last 5 lines of the kernel\nbuild's output in your\
+      \ summary; if the build itself fails, report\nthe captured failure output and STOP without BUILD_DONE.\
+      \ Kernel\nrepair is out of scope per ops/NEXT.md \u2014 do not attempt it here.\n\nThen implement\
+      \ the work package: read ops/NEXT.md, AGENTS.md, and\nthe relevant parts of docs/RFC-0001-everything-is-a-relayflow.md.\n\
+      Implement exactly that work package \u2014 nothing more. Run the\ndefinition-of-done commands yourself\
+      \ and iterate until they pass.\nKeep files small and single-purpose. End with BUILD_DONE only when\n\
+      the definition of done passes locally; paste the passing output.\n"
     verification:
       type: output_contains
       value: BUILD_DONE
diff --git a/workflows/drive.yaml b/workflows/drive.yaml
index 9dd5523e2..e2818be86 100644
--- a/workflows/drive.yaml
+++ b/workflows/drive.yaml
@@ -274,12 +274,29 @@ workflows:
         dependsOn: [assess-gate]
         maxIterations: 3
         task: |
-          Read ops/NEXT.md, AGENTS.md, and the relevant parts of
-          docs/RFC-0001-everything-is-a-relayflow.md. Implement exactly that
-          work package — nothing more. Run the definition-of-done commands
-          yourself and iterate until they pass. Keep files small and
-          single-purpose. End with BUILD_DONE only when the definition of done
-          passes locally; paste the passing output.
+          Before touching your work package, prepare this sandbox: build the
+          kernel binary that sdk/tests/live-kernel.test.ts exec's via
+          ops/cargo.sh's RELAYFLOWD_BIN, and restore +x on preflight fixtures
+          that the sandbox strips. Run these three commands (subshells so cd
+          survives if you invoke them as separate tool calls):
+
+              chmod +x ops/cargo.sh
+              ( cd kernel && sh ../ops/cargo.sh build )
+              find testdata/preflight -type f -name '*-cli' -exec chmod +x {} +
+
+          Each must succeed. Do NOT swallow errors with `|| true` — a silent
+          skip here reproduces the "19 SDK failures" PR #63 explicitly reported
+          in its ops/NEEDS_HUMAN.md. Paste the last 5 lines of the kernel
+          build's output in your summary; if the build itself fails, report
+          the captured failure output and STOP without BUILD_DONE. Kernel
+          repair is out of scope per ops/NEXT.md — do not attempt it here.
+
+          Then implement the work package: read ops/NEXT.md, AGENTS.md, and
+          the relevant parts of docs/RFC-0001-everything-is-a-relayflow.md.
+          Implement exactly that work package — nothing more. Run the
+          definition-of-done commands yourself and iterate until they pass.
+          Keep files small and single-purpose. End with BUILD_DONE only when
+          the definition of done passes locally; paste the passing output.
         verification:
           type: output_contains
           value: BUILD_DONE