@lumenflow/cli 3.9.2 → 3.9.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumenflow/cli",
-  "version": "3.9.2",
+  "version": "3.9.5",
   "description": "Command-line interface for LumenFlow workflow framework",
   "keywords": [
     "lumenflow",
@@ -180,13 +180,13 @@
     "xstate": "^5.28.0",
     "yaml": "^2.8.2",
     "zod": "^4.3.6",
-    "@lumenflow/agent": "3.9.2",
-    "@lumenflow/control-plane-sdk": "3.9.2",
-    "@lumenflow/kernel": "3.9.2",
-    "@lumenflow/initiatives": "3.9.2",
-    "@lumenflow/memory": "3.9.2",
-    "@lumenflow/core": "3.9.2",
-    "@lumenflow/metrics": "3.9.2"
+    "@lumenflow/agent": "3.9.5",
+    "@lumenflow/initiatives": "3.9.5",
+    "@lumenflow/kernel": "3.9.5",
+    "@lumenflow/memory": "3.9.5",
+    "@lumenflow/control-plane-sdk": "3.9.5",
+    "@lumenflow/metrics": "3.9.5",
+    "@lumenflow/core": "3.9.5"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^4.0.18",

package/packs/sidekick/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> @lumenflow/packs-sidekick@3.9.1 build /home/tom/source/hellmai/lumenflow-dev/packages/@lumenflow/packs/sidekick
+> @lumenflow/packs-sidekick@3.9.4 build /home/tom/source/hellmai/lumenflow-dev/packages/@lumenflow/packs/sidekick
 > tsc
 

package/packs/sidekick/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumenflow/packs-sidekick",
-  "version": "3.9.2",
+  "version": "3.9.5",
   "description": "Sidekick personal assistant pack for LumenFlow — 16 tools for task management, typed memory, channels, routines, and audit",
   "keywords": [
     "lumenflow",

package/packs/software-delivery/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> @lumenflow/packs-software-delivery@3.9.1 build /home/tom/source/hellmai/lumenflow-dev/packages/@lumenflow/packs/software-delivery
+> @lumenflow/packs-software-delivery@3.9.4 build /home/tom/source/hellmai/lumenflow-dev/packages/@lumenflow/packs/software-delivery
 > tsc
 

package/packs/software-delivery/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumenflow/packs-software-delivery",
-  "version": "3.9.2",
+  "version": "3.9.5",
   "description": "Software delivery pack for LumenFlow — work units, gates, lanes, initiatives, and agent coordination",
   "keywords": [
     "lumenflow",

package/templates/core/LUMENFLOW.md.template

@@ -230,30 +230,30 @@ For the full worktree lifecycle (parallel execution, bootstrap, isolation guaran
 
 > **Complete CLI reference (100+ commands):** See [quick-ref-commands.md](docs/04-operations/_frameworks/lumenflow/agent/onboarding/quick-ref-commands.md). Always run `<command> --help` for the authoritative option list.
 
-| Command                   | Description                                            |
-| ------------------------- | ------------------------------------------------------ |
-| `pnpm wu:create`          | Create new WU spec                                     |
-| `pnpm wu:claim`           | Claim WU, update canonical state, create worktree      |
-| `pnpm wu:prep`            | Run gates in worktree, prep for wu:done                |
-| `pnpm wu:done`            | Complete WU (merge, stamp, cleanup)                    |
-| `pnpm wu:status`          | Show WU status, location, and valid commands           |
-| `pnpm wu:recover`         | Analyze and fix WU state inconsistencies               |
-| `pnpm wu:block`           | Block WU (transitions to blocked, frees lane)          |
-| `pnpm wu:unblock`         | Unblock WU (transitions to in_progress)                |
-| `pnpm wu:release`         | Release orphaned WU (in_progress to ready for reclaim) |
-| `pnpm wu:brief`           | Generate handoff prompt + record evidence              |
-| `pnpm wu:delegate`        | Generate prompt + record delegation lineage            |
-| `pnpm wu:escalate`        | Show or resolve WU escalation status                   |
-| `pnpm wu:delete`          | Delete WU spec and cleanup                             |
-| `pnpm gates`              | Run quality gates (`--docs-only` for docs WUs)         |
-| `pnpm lumenflow:commands` | List all public commands (primary + alias + legacy)    |
-| `pnpm docs:generate`      | Regenerate CLI/config reference docs from source       |
-| `pnpm docs:validate`      | Verify generated docs are up-to-date                   |
-| `pnpm lane:status`        | Show lane lifecycle status + next step                 |
-| `pnpm lane:setup`         | Create/update draft lane artifacts                     |
-| `pnpm lane:validate`      | Validate lane artifacts before lock                    |
-| `pnpm lane:lock`          | Lock lane lifecycle for delivery WUs                   |
-| `pnpm mem:checkpoint`     | Save memory checkpoint                                 |
+| Command                   | Description                                               |
+| ------------------------- | --------------------------------------------------------- |
+| `pnpm wu:create`          | Create new WU spec                                        |
+| `pnpm wu:claim`           | Claim WU, update canonical state, create worktree         |
+| `pnpm wu:prep`            | Run gates in worktree, prep for wu:done                   |
+| `pnpm wu:done`            | Complete WU (merge, stamp, cleanup)                       |
+| `pnpm wu:status`          | Show WU status, location, and valid commands              |
+| `pnpm wu:recover`         | Analyze and fix WU state inconsistencies                  |
+| `pnpm wu:block`           | Block WU (transitions to blocked, frees lane)             |
+| `pnpm wu:unblock`         | Unblock WU (transitions to in_progress)                   |
+| `pnpm wu:release`         | Release orphaned WU (in_progress to ready for reclaim)    |
+| `pnpm wu:brief`           | Generate handoff prompt + record evidence                 |
+| `pnpm wu:delegate`        | Generate prompt + record lineage + brief hash attestation |
+| `pnpm wu:escalate`        | Show or resolve WU escalation status                      |
+| `pnpm wu:delete`          | Delete WU spec and cleanup                                |
+| `pnpm gates`              | Run quality gates (`--docs-only` for docs WUs)            |
+| `pnpm lumenflow:commands` | List all public commands (primary + alias + legacy)       |
+| `pnpm docs:generate`      | Regenerate CLI/config reference docs from source          |
+| `pnpm docs:validate`      | Verify generated docs are up-to-date                      |
+| `pnpm lane:status`        | Show lane lifecycle status + next step                    |
+| `pnpm lane:setup`         | Create/update draft lane artifacts                        |
+| `pnpm lane:validate`      | Validate lane artifacts before lock                       |
+| `pnpm lane:lock`          | Lock lane lifecycle for delivery WUs                      |
+| `pnpm mem:checkpoint`     | Save memory checkpoint                                    |
 
 Commands include **context-aware validation** that checks location, WU status, and git state. When validation fails, commands provide copy-paste ready fix commands. Configure in `workspace.yaml` under `software_delivery.experimental.context_validation`.
 The Starlight CLI reference page is intentionally curated to primary commands; use `pnpm lumenflow:commands` for complete discovery.

package/templates/core/ai/onboarding/agent-invocation-guide.md.template

@@ -106,8 +106,17 @@ This is useful when:
 
 `wu:delegate` records **delegation intent**: that a brief was generated for a target WU with explicit parent lineage.
 
+It also stores **brief attestation metadata** (SHA-256 prompt hash, client, timestamp, prompt length) for the generated handoff payload.
+
 It does **not** by itself prove pickup or execution. Pickup/execution confirmation comes from lifecycle evidence (claim/completion events, checkpoints, signals, and final `wu:done`).
 
+`wu:done` now enforces, for initiative-governed and explicitly delegated WUs:
+
+- Delegation lineage exists
+- Claim-time pickup evidence exists
+- Delegation brief attestation exists
+- Attested prompt hash matches recorded `wu:brief` evidence for the target WU
+
 ---
 
 ## 2c) Self-Implementation Evidence-Only Flow (WU-2222)

package/templates/core/ai/onboarding/quick-ref-commands.md.template

@@ -133,7 +133,7 @@ files, no manual git, no WU ceremony. Only actual **code changes** need WUs.
 | `pnpm wu:brief --id WU-XXX --client <client>`   | Generate handoff prompt + record evidence (claimed workspace/branch)  |
 | `pnpm wu:brief --id WU-XXX --evidence-only`     | Record wu:brief evidence only (self-implementation, no prompt output) |
 | `pnpm wu:brief --id WU-XXX --no-context`        | Generate prompt without memory context injection                      |
-| `pnpm wu:delegate --id WU-XXX --parent-wu <P>`  | Generate prompt and record delegation lineage                         |
+| `pnpm wu:delegate --id WU-XXX --parent-wu <P>`  | Generate prompt, record lineage, and store brief hash attestation     |
 | `pnpm wu:sandbox --id WU-XXX -- <cmd>`          | Run command through hardened WU sandbox backend                       |
 
 ### WU Maintenance

package/templates/core/ai/onboarding/release-process.md.template

@@ -10,20 +10,20 @@ This document covers the complete release process for LumenFlow, including versi
 
 LumenFlow has several components that need to stay in sync:
 
-| Component      | Location                    | Deployment                          |
-| -------------- | --------------------------- | ----------------------------------- |
-| npm packages   | `packages/@lumenflow/*`     | Auto via GitHub Actions on tag push |
-| Starlight docs | `apps/docs/`                | Manual via Vercel CLI               |
-| Pack registry  | `apps/web/` + pack tarballs | Manual deploy + curl publish        |
+| Component      | Location                    | Deployment                                          |
+| -------------- | --------------------------- | --------------------------------------------------- |
+| npm packages   | `packages/@lumenflow/*`     | Auto via GitHub Actions on tag push (`publish.yml`) |
+| Starlight docs | `apps/docs/`                | Separate GitHub Actions workflow (`docs.yml`)       |
+| Pack registry  | `apps/web/` + pack tarballs | Manual deploy + curl publish                        |
 
 ---
 
 ## Release Command
 
-The `pnpm release` command automates the entire release process:
+The `pnpm release` command automates version bump + tagging, and optionally npm publish:
 
 ```bash
-pnpm release --release-version 1.3.0
+pnpm release --release-version 1.3.0 --skip-publish
 ```
 
 ### What It Does
@@ -34,7 +34,7 @@ pnpm release --release-version 1.3.0
 4. Bumps all `@lumenflow/*` package versions using micro-worktree isolation
 5. Builds all packages
 6. Creates and pushes git tag `vX.Y.Z`
-7. Publishes to npm
+7. Optionally publishes to npm (unless `--skip-publish`)
 
 ### Options
 
@@ -50,19 +50,16 @@ pnpm release --release-version 1.3.0
 ### Examples
 
 ```bash
-# Full release
-pnpm release --release-version 1.3.0
-
-# Preview what would happen
-pnpm release --release-version 1.3.0 --dry-run
-
 # Version bump and tag only (CI will publish)
 pnpm release --release-version 1.3.0 --skip-publish
+
+# Preview what would happen
+pnpm release --release-version 1.3.0 --skip-publish --dry-run
 ```
 
 ### Authentication
 
-For npm publish, set one of these environment variables:
+For direct CLI npm publish (without `--skip-publish`), set one of these environment variables:
 
 ```bash
 export NPM_TOKEN=<your-npm-token>
@@ -179,8 +176,11 @@ The `.github/workflows/publish.yml` workflow:
 
 1. Checks out the tagged commit
 2. Installs dependencies
-3. Builds all packages
-4. Publishes to npm with `pnpm -r publish --access public`
+3. Builds publishable workspace packages only (`./packages/**`)
+4. Publishes to npm with `pnpm -r --filter "./packages/**" publish --access public --no-git-checks`
+5. Creates the GitHub release object (`gh release create ... --generate-notes`)
+
+`publish.yml` intentionally does **not** build `apps/docs` or `apps/web`, so docs/tooling dependencies cannot block npm publishing.
 
 ### Required Secrets
 
@@ -226,9 +226,25 @@ The public docs at <https://lumenflow.dev> are built from `apps/docs/`.
 
 **Automatic Generation:** CLI and config reference docs are automatically generated from code. See [Automatic Docs Generation](./docs-generation.md) for details on the single-source-of-truth pattern.
 
+### Build Workflow
+
+Starlight docs build in a separate workflow: `.github/workflows/docs.yml`.
+
+Trigger:
+
+- Tag push (`v*`)
+- Manual run (`workflow_dispatch`)
+
+The workflow:
+
+1. Installs D2 (`astro-d2` prerequisite)
+2. Builds docs with `pnpm --filter @lumenflow/docs build`
+3. Uploads `apps/docs/dist` as a workflow artifact
+4. Deploys to Vercel when `VERCEL_TOKEN`, `VERCEL_ORG_ID`, and `VERCEL_PROJECT_ID` secrets are configured
+
 ### Deployment
 
-Starlight docs are deployed **manually** via Vercel CLI:
+Production deploy is still manual via Vercel CLI:
 
 ```bash
 cd apps/docs
@@ -368,17 +384,17 @@ The `@lumenflow/docs` package requires `d2` (diagramming tool) which is not avai
 
 ### Release Steps (Automated)
 
-Use the release command for the standard workflow:
+Use this as the standard workflow:
 
 ```bash
 # Preview first
-pnpm release --release-version 1.3.0 --dry-run
+pnpm release --release-version 1.3.0 --skip-publish --dry-run
 
-# Execute release
-pnpm release --release-version 1.3.0
+# Execute (version bump + tag, publish delegated to GitHub Actions)
+pnpm release --release-version 1.3.0 --skip-publish
 ```
 
-This handles version bump, build, tag, and npm publish automatically.
+This handles version bump and tag locally; GitHub Actions handles npm publish, docs build, and GitHub release creation.
 
 ### Release Steps (Manual)
 
@@ -398,21 +414,22 @@ If you need more control:
    git push origin v1.3.0
    ```
 
-3. **Verify npm publish**
+3. **Verify npm publish + GitHub release**
 
    ```bash
    gh run list --workflow=publish.yml --limit 1
    # Wait for completion, then verify
    npm view @lumenflow/cli version
+   gh release view v1.3.0
    ```
 
-4. **Create GitHub release**
+4. **Verify docs workflow** (if docs changed)
 
    ```bash
-   gh release create v1.3.0 --title "v1.3.0 - Title" --notes "Release notes..."
+   gh run list --workflow=docs.yml --limit 1
    ```
 
-5. **Deploy Starlight docs** (if content changed)
+5. **Deploy Starlight docs** (if content changed and you are deploying manually)
 
    ```bash
    cd apps/docs && pnpm build && vercel --prod
@@ -428,13 +445,13 @@ If you need more control:
 
 ## Keeping Components in Sync
 
-| Change Type      | npm           | Docs   | Packs   |
-| ---------------- | ------------- | ------ | ------- |
-| Bug fix in CLI   | Tag + publish | Auto\* | No      |
-| New CLI command  | Tag + publish | Auto\* | No      |
-| Pack changes     | Tag + publish | No     | Publish |
-| Docs-only update | No            | Deploy | No      |
-| Full release     | Tag + publish | Deploy | Publish |
+| Change Type      | npm           | Docs                    | Packs   |
+| ---------------- | ------------- | ----------------------- | ------- |
+| Bug fix in CLI   | Tag + publish | Auto\*                  | No      |
+| New CLI command  | Tag + publish | Auto\*                  | No      |
+| Pack changes     | Tag + publish | No                      | Publish |
+| Docs-only update | No            | Build workflow + deploy | No      |
+| Full release     | Tag + publish | Build workflow + deploy | Publish |
 
 \* CLI/config reference docs regenerate automatically during `wu:done` when trigger files change. See [Automatic Docs Generation](./docs-generation.md).