Lock the Workflow, Plan the Model Move, Bound the SSH Session