@tacuchi/agent-workflow-cli 25.6.1 → 25.7.0

package/dist/domain/sql-lexer.js

@@ -0,0 +1,227 @@
+/** PostgreSQL lexical scan shared by the serve-db read-only policy and the sql-mutation-guard hook. */
+export function scanSql(sql) {
+    const state = createSqlScanState();
+    while (state.index < sql.length) {
+        if (!scanSqlCharacter(sql, state))
+            return { ok: false };
+    }
+    flushSqlToken(state);
+    closeStatement(state, sql.length);
+    return state.blockCommentDepth === 0
+        ? {
+            ok: true,
+            tokens: state.tokens,
+            semicolons: state.semicolons,
+            contentAfterSemicolon: state.contentAfterSemicolon,
+            statements: state.statements,
+        }
+        : { ok: false };
+}
+function createSqlScanState() {
+    return {
+        tokens: [],
+        index: 0,
+        semicolons: 0,
+        contentAfterSemicolon: false,
+        token: "",
+        blockCommentDepth: 0,
+        statements: [],
+        statement: openStatement(0),
+    };
+}
+function openStatement(start) {
+    return { start, end: start, tokens: [], marks: [] };
+}
+function closeStatement(state, end) {
+    state.statement.end = end;
+    state.statements.push(state.statement);
+    state.statement = openStatement(end + 1);
+}
+function mark(state, value) {
+    if (!state.statement.marks.includes(value))
+        state.statement.marks.push(value);
+}
+function scanSqlCharacter(sql, state) {
+    if (state.blockCommentDepth > 0) {
+        consumeBlockComment(sql, state);
+        return true;
+    }
+    const char = sql[state.index] ?? "";
+    const next = sql[state.index + 1] ?? "";
+    if (consumeSqlComment(sql, state, char, next))
+        return true;
+    markContentAfterSemicolon(state, char, next);
+    const literal = consumeSqlLiteral(sql, state, char);
+    if (literal !== undefined)
+        return literal;
+    consumePlainSqlCharacter(state, char);
+    state.index += 1;
+    return true;
+}
+function consumeSqlComment(sql, state, char, next) {
+    if (char === "-" && next === "-") {
+        consumeLineComment(sql, state);
+        return true;
+    }
+    if (char !== "/" || next !== "*")
+        return false;
+    flushSqlToken(state);
+    openBlockComment(sql, state);
+    return true;
+}
+/** MySQL runs the body of a `/*! … *\/` comment as SQL. */
+function openBlockComment(sql, state) {
+    if (sql[state.index + 2] === "!")
+        mark(state, "executable-comment");
+    state.blockCommentDepth += 1;
+    state.index += 2;
+}
+/** Returns undefined when the current byte remains regular SQL punctuation. */
+function consumeSqlLiteral(sql, state, char) {
+    if (char === "'" || char === '"')
+        return consumeQuotedSql(sql, state, char);
+    if (char !== "$" || !canOpenDollarQuoted(sql, state))
+        return undefined;
+    const dollarQuoted = consumeDollarQuotedSql(sql, state);
+    if (dollarQuoted === "consumed")
+        return true;
+    return dollarQuoted === "unterminated" ? false : undefined;
+}
+function consumePlainSqlCharacter(state, char) {
+    if (/[A-Za-z0-9_]/.test(char)) {
+        state.token += char;
+        return;
+    }
+    flushSqlToken(state);
+    if (char === ";") {
+        state.semicolons += 1;
+        closeStatement(state, state.index);
+    }
+    else if (char === "(" || char === ")" || char === ",") {
+        state.statement.tokens.push(char);
+    }
+    else if (char === "#") {
+        mark(state, "hash");
+    }
+    else if (char === "`") {
+        mark(state, "backtick");
+    }
+}
+function consumeBlockComment(sql, state) {
+    const char = sql[state.index] ?? "";
+    const next = sql[state.index + 1] ?? "";
+    if (char === "/" && next === "*") {
+        openBlockComment(sql, state);
+        return;
+    }
+    if (char === "*" && next === "/") {
+        state.blockCommentDepth -= 1;
+        state.index += 2;
+        return;
+    }
+    state.index += 1;
+}
+function consumeLineComment(sql, state) {
+    flushSqlToken(state);
+    state.index += 2;
+    while (state.index < sql.length && sql[state.index] !== "\n" && sql[state.index] !== "\r") {
+        state.index += 1;
+    }
+}
+function markContentAfterSemicolon(state, char, next) {
+    if (state.semicolons === 0 || /\s/.test(char) || char === ";")
+        return;
+    if ((char === "-" && next === "-") || (char === "/" && next === "*"))
+        return;
+    state.contentAfterSemicolon = true;
+}
+function consumeQuotedSql(sql, state, quote) {
+    // PostgreSQL's ordinary string literals and quoted identifiers escape a
+    // quote by doubling it. Backslashes escape only E'...' strings under the
+    // default standard_conforming_strings setting, so treating every backslash
+    // as an escape could hide a closing quote and a second statement.
+    const allowsBackslashEscapes = quote === "'" && state.token.toUpperCase() === "E";
+    flushSqlToken(state);
+    const next = skipQuoted(sql, state.index, quote, allowsBackslashEscapes);
+    if (next < 0)
+        return false;
+    // MySQL, and PostgreSQL with standard_conforming_strings off, read `\'` as
+    // an escaped quote: the literal would end somewhere else.
+    if (!allowsBackslashEscapes && sql.slice(state.index, next).includes(`\\${quote}`)) {
+        mark(state, "backslash-quote");
+    }
+    state.index = next;
+    return true;
+}
+function consumeDollarQuotedSql(sql, state) {
+    const opener = readDollarTag(sql, state.index);
+    if (opener === undefined)
+        return "not-dollar-quoted";
+    flushSqlToken(state);
+    // An opener without its own closer is invalid PostgreSQL. Refuse it at the
+    // first one rather than resuming at each subsequent `$tag$`; otherwise many
+    // distinct unterminated tags make repeated suffix scans quadratic below the
+    // 1 MiB input cap.
+    const close = sql.indexOf(opener.tag, opener.afterOpen);
+    if (close < 0)
+        return "unterminated";
+    state.index = close + opener.tag.length;
+    return "consumed";
+}
+/** PostgreSQL requires a delimiter after an identifier to be whitespace-separated. */
+function canOpenDollarQuoted(sql, state) {
+    if (state.token.length > 0)
+        return false;
+    const previous = state.index === 0 ? undefined : sql[state.index - 1];
+    // A quoted identifier is also an identifier even though it was intentionally
+    // omitted from `tokens`; without this fence `"name$tag$` could hide the
+    // remainder from the single-statement scan.
+    return previous === undefined || (previous !== '"' && !isIdentifierContinuation(previous));
+}
+function isIdentifierContinuation(char) {
+    return /[A-Za-z0-9_$]/.test(char) || char.charCodeAt(0) >= 0x80;
+}
+function flushSqlToken(state) {
+    if (state.token.length === 0)
+        return;
+    const word = state.token.toUpperCase();
+    state.tokens.push(word);
+    state.statement.tokens.push(word);
+    state.token = "";
+}
+function skipQuoted(sql, start, quote, allowsBackslashEscapes) {
+    let index = start + 1;
+    while (index < sql.length) {
+        if (sql[index] === quote) {
+            if (sql[index + 1] === quote) {
+                index += 2;
+                continue;
+            }
+            return index + 1;
+        }
+        if (allowsBackslashEscapes && sql[index] === "\\") {
+            index += 2;
+        }
+        else {
+            index += 1;
+        }
+    }
+    return -1;
+}
+function readDollarTag(sql, start) {
+    if (sql[start] !== "$")
+        return undefined;
+    const next = sql[start + 1];
+    if (next === "$")
+        return { tag: "$$", afterOpen: start + 2 };
+    if (next === undefined || !/[A-Za-z_]/.test(next))
+        return undefined;
+    let end = start + 2;
+    while (end < sql.length && /[A-Za-z0-9_]/.test(sql[end] ?? ""))
+        end += 1;
+    if (sql[end] !== "$")
+        return undefined;
+    const tag = sql.slice(start, end + 1);
+    return { tag, afterOpen: end + 1 };
+}
+//# sourceMappingURL=sql-lexer.js.map

package/dist/domain/sql-lexer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-lexer.js","sourceRoot":"","sources":["../../src/domain/sql-lexer.ts"],"names":[],"mappings":"AAAA,uGAAuG;AA8BvG,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,OAAO,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC;IACD,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,iBAAiB,KAAK,CAAC;QAClC,CAAC,CAAC;YACE,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B;QACH,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AACpB,CAAC;AAaD,SAAS,kBAAkB;IACzB,OAAO;QACL,MAAM,EAAE,EAAE;QACV,KAAK,EAAE,CAAC;QACR,UAAU,EAAE,CAAC;QACb,qBAAqB,EAAE,KAAK;QAC5B,KAAK,EAAE,EAAE;QACT,iBAAiB,EAAE,CAAC;QACpB,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,cAAc,CAAC,KAAmB,EAAE,GAAW;IACtD,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,GAAG,CAAC;IAC1B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC,KAAK,CAAC,SAAS,GAAG,aAAa,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,IAAI,CAAC,KAAmB,EAAE,KAAqB;IACtD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,KAAmB;IACxD,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAChC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,yBAAyB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC1C,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,KAAmB,EAAE,IAAY,EAAE,IAAY;IACrF,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/C,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2DAA2D;AAC3D,SAAS,gBAAgB,CAAC,GAAW,EAAE,KAAmB;IACxD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACpE,KAAK,CAAC,iBAAiB,IAAI,CAAC,CAAC;IAC7B,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,GAAW,EAAE,KAAmB,EAAE,IAAY;IACvE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5E,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvE,MAAM,YAAY,GAAG,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxD,IAAI,YAAY,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,YAAY,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAmB,EAAE,IAAY;IACjE,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;QACpB,OAAO;IACT,CAAC;IACD,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;QACtB,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;SAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACxD,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtB,CAAC;SAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,KAAmB;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjC,KAAK,CAAC,iBAAiB,IAAI,CAAC,CAAC;QAC7B,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACjB,OAAO;IACT,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW,EAAE,KAAmB;IAC1D,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1F,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAmB,EAAE,IAAY,EAAE,IAAY;IAChF,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO;IACtE,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO;IAC7E,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,KAAmB,EAAE,KAAgB;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,sBAAsB,GAAG,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC;IAClF,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACzE,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,2EAA2E;IAC3E,0DAA0D;IAC1D,IAAI,CAAC,sBAAsB,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC,EAAE,CAAC;QACnF,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;IACnB,OAAO,IAAI,CAAC;AACd,CAAC;AAID,SAAS,sBAAsB,CAAC,GAAW,EAAE,KAAmB;IAC9D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC;IACrD,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,mBAAmB;IACnB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC;IACrC,KAAK,CAAC,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;IACxC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,sFAAsF;AACtF,SAAS,mBAAmB,CAAC,GAAW,EAAE,KAAmB;IAC3D,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACtE,6EAA6E;IAC7E,wEAAwE;IACxE,4CAA4C;IAC5C,OAAO,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB;IACxC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,KAAa,EACb,KAAgB,EAChB,sBAA+B;IAE/B,IAAI,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;IACtB,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC7B,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,sBAAsB,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,KAAa;IAC/C,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;IAC7D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC;IACpB,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IACzE,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;AACrC,CAAC"}

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@tacuchi/agent-workflow-cli",
-  "version": "25.6.1",
+  "version": "25.7.0",
   "description": "Runtime CLI for Workline — the stages + loops + artifacts system for agent work. Bundles the universal `w` skill set under `skills/w/` (slash commands `/w:*`: spec-new/spec-refine, plan-new/plan-exec, quick, persist, workspace-init, export-*); `self install --target <host>` copies SKILL + commands + hooks into the host. Pluggable capability skills resolve through `.workflow/skills.toml`. Namespace auto-detected from any `.<ns>/sessions/` dir in CWD; default `workflow`.",
   "type": "module",
   "bin": {
     "agent-workflow": "dist/cli/main.js",
     "aw": "dist/cli/main.js"
   },
-  "files": ["dist", "skills", "LICENSE", "README.md"],
+  "files": ["dist", "skills", "LICENSE", "README.md", "CHANGELOG.md"],
   "scripts": {
     "build": "node scripts/clean-dist.mjs && tsc",
     "build:watch": "node scripts/clean-dist.mjs && tsc --watch",

package/skills/w/SKILL.md

@@ -1,14 +1,13 @@
 ---
 name: w
 description: >-
-  Orientation skill for Workline (`w` = *workline*), the whole system — built-in
-  default for the `overview` role. Load this to understand the model end-to-end: the 3-layer
-  architecture (commands → loops → sessions/artifacts) plus the docs/ zone, the 3
-  flows (SPEC / PLAN / QUICK), the `/w:` commands, the 5 loops and their chassis, the
-  `export-*` family, the composable capability skills + `.workflow/skills.toml`
-  binding cascade, and the 6 hard invariants. Use whenever an agent (or human) needs
-  to know how the pieces fit, where a deliverable should land, or which command/loop/
-  skill to reach for.
+  Orientation skill for Workline (`w` = *workline*), default for the `overview`
+  role. Load it to understand the whole model: the 3 layers (commands → loops →
+  sessions/artifacts) plus docs/, the 3 flows (SPEC / PLAN / QUICK), the `/w:`
+  commands, the 5 loops and their chassis, the `export-*` family, the capability
+  skills + `.workflow/skills.toml` cascade, and the 6 hard invariants. Use it to
+  know how the pieces fit, where a deliverable lands, or which command/loop/skill
+  to reach for.
 ---
 
 # w — Workline overview
@@ -111,7 +110,7 @@ The flows are **composable with host-native work, never exclusive**. The host is
 - `/w:quick` — starts `quick-loop` (shortcut, no `docs/`; escalates live to SPEC when the objective exceeds a quick).
 - `/w:export-scripts` · `/w:export-manuals` · `/w:export-diagrams` · `/w:export-reports` — promote artifacts to `docs/`.
 
-### Transversal skills (no flow) — `/w:status` · `/w:doctor` · `/w:fix-git` · `/w:generate-launch` · `/w:persist` · `/w:resume`
+### Transversal skills (no flow) — `/w:status` · `/w:doctor` · `/w:fix-git` · `/w:generate-launch` · `/w:persist` · `/w:resume` · `/w:recall`
 
 **Flow-independent invocable** skills: triggered with `/w:` like any command, but they do **not** belong to SPEC/PLAN/QUICK, do **not** manage `docs/`, and do **not** count in **6 flow commands / 5 loops**. *(In the bundle they are packaged under `commands/` so `/w:` can invoke them; in the design they are the `workflow-skills/` category.)*
 
@@ -120,6 +119,7 @@ The flows are **composable with host-native work, never exclusive**. The host is
 - `/w:fix-git` — resolves an in-progress merge's conflicts in any repo (identifies origin↔destination, analyzes intent, *structured-choice* on ambiguity). No session, never touches `docs/`; git-safe; backed by `aw merge-state`.
 - `/w:generate-launch` — (re)generates the per-source launch scripts (`.workflow/launch/<alias>/`) by detecting each source's stack; idempotent (preserves hand-edited scripts, `--force` overwrites). Complements the launch flow's on-demand generation. No session, never touches `docs/`; backed by `aw generate-launch`.
 - `/w:persist` — persists work **already done in this conversation** (an analysis, conclusions, a plan) into `docs/`: classifies its shape and routes it — analysis/conclusions → `docs/research/` · requirement-shaped → spec draft (`spec-new` procedure) · plan-shaped → plan adoption (`plan-new` mode 4) — with `## Origin` + attribution (host · model · date) and the anti-duplicate check. Never creates sessions; the host→`docs/` counterpart of `export-*` (which stays the only session→`docs/` path).
+- `/w:recall` — reports what the other hosts' curated memory learned about Workline (backed by `aw host-memory`, which only reads), contrasts each learning against the installed CLI and doctrine, applies what still holds in the session and offers to save it in the current host's own memory, with its origin mark, only after confirmation. Never writes another host's memory.
 - `/w:resume` — read-only: composes `/w:status` for a prioritized summary of pending work (workline signals + host context) and proposes how to continue via structured-choice, routed to the target command (`spec-refine` / `plan-new` / `plan-exec` / reopen); an optional artifact argument (spec/plan/session) skips the survey and gets its exact re-entry route. Writes nothing; the actionable sibling of `/w:status`.
 
 ### The loops (Layer 2)

package/skills/w/commands/README.md

@@ -27,6 +27,7 @@ Every invoked directory is a usable implicit workspace. The closest ancestor wit
 | [`generate-launch`](generate-launch.md) | (Re)generates the per-source launch scripts (`.workflow/launch/<alias>/`) | single-pass (transversal) |
 | [`persist`](persist.md) | Persists in-conversation work into `docs/` (classify → `research` · spec draft · plan adoption) | single-pass (transversal) |
 | [`resume`](resume.md) | Summary (composes `/status`) + proposes how to resume pending work | single-pass (transversal) |
+| [`recall`](recall.md) | What the other hosts learned about Workline: contrasted, applied, offered for saving | single-pass (transversal) |
 | [`export-scripts`](export-scripts.md) | Promotes session SQL migrations to `docs/scripts/` | single-pass, read-only |
 | [`export-manuals`](export-manuals.md) | Generates manuals in `docs/manuals/` | single-pass, read-only |
 | [`export-diagrams`](export-diagrams.md) | Generates C4/mermaid diagrams in `docs/diagrams/` | single-pass, read-only |
@@ -34,7 +35,7 @@ Every invoked directory is a usable implicit workspace. The closest ancestor wit
 
 > **Intentional asymmetry:** in SPEC, `spec-new` generates the draft single-pass (no loop) and the loop lives in `spec-refine`; in PLAN, all 3 commands start loops. Total: **6 flow commands / 5 loops**.
 >
-> **Transversal (no flow):** `status`, `doctor`, `fix-git`, `generate-launch`, `persist` and `resume` belong to no SPEC/PLAN/QUICK flow and do not count in 6/5. In the design they are their own category (`workflow-skills/`); here they are packaged under `commands/` so `/w:` can invoke them — see [`../harness/HARNESS.md`](../harness/HARNESS.md) § *Command packaging*.
+> **Transversal (no flow):** `status`, `doctor`, `fix-git`, `generate-launch`, `persist`, `resume` and `recall` belong to no SPEC/PLAN/QUICK flow and do not count in 6/5. In the design they are their own category (`workflow-skills/`); here they are packaged under `commands/` so `/w:` can invoke them — see [`../harness/HARNESS.md`](../harness/HARNESS.md) § *Command packaging*.
 
 ## Schema of each command file
 

package/skills/w/commands/recall.md

@@ -0,0 +1,39 @@
+---
+description: Use when the user asks what other hosts learned about Workline, to apply what still holds and offer to save it.
+argument-hint: "(none)"
+allowed-tools:
+  [
+    "Bash",
+    "Read",
+    "Write",
+    "Edit",
+  ]
+---
+
+# recall — learnings from the other hosts
+
+Runs only when the person invokes it, never at session start. No loop, no session, no `docs/`.
+
+## Run
+
+1. `aw host-memory --json` — reads the other hosts' curated memory and writes nothing. Only Workline learnings come back; the rest is a count.
+2. **Report every row of `hosts`**: which memories were read, and which are absent, keep none of their own, are disabled or unreadable, each with its reason. With no entries, say which case it is — no other host's memory was found (no row is `read`), or it was read and holds nothing about Workline yet — and carry on.
+3. **Leave out working state** — a run log, a plan's progress, a session's status. Keep what holds beyond one run.
+4. **Contrast each learning** into one of three states:
+   - **possibly stale** — it carries a `stale` signal, or `aw <command> --help` or the installed doctrine contradicts it. Do not apply it;
+   - **current** — it holds against them. Apply it;
+   - **unverified** — nothing here can check it. Check it when its situation arises.
+5. **Apply in this session** what is current and serves the work at hand: when its situation arises, act on it instead of researching again.
+6. **Present each learning with its host and its date** (`date` null → say it carries none).
+7. **Flag what two or more hosts found separately** as a possible Workline defect: say so, open no flow. Copies never count — an entry whose `provenance` is `copy` is the same finding as its original.
+8. **Offer to save only what is current and absent** (`present_in_destination: false`): show what gets saved and where, `current_host.destination.path`. Canonical [option shape](../loops/CHASSIS.md#structured-choice-design--batching) and [host binding](../harness/HARNESS.md#harness-binding-matrix). Save nothing without confirmation.
+9. **Save through the host's own channel** — the one `destination.channel` names, following that host's memory rules — with its `origin_mark` copied verbatim, so the next reading knows the copy.
+10. **With `destination` null**, give its `destination_reason`: say this host has nowhere to save and offer nothing.
+
+> **Never write another host's memory.** Only the current host's destination is ever touched, and only after the person confirms.
+
+Degradation is declared, never silent: with no structured-choice, list the options as labeled markdown with the `flow` control among them.
+
+## More context
+
+`aw context-plan --command recall --root "${CLAUDE_PLUGIN_ROOT}/skills/w"` returns the extra documents a case needs; read exactly what it lists.

package/skills/w/context/MANIFEST.json

@@ -410,6 +410,10 @@
         }
       ]
     },
+    "recall": {
+      "core": ["commands/recall.md"],
+      "modules": [{ "path": "modules/PLAN-MODE.md", "signal": "plan-mode" }]
+    },
     "reset": {
       "core": ["commands/reset.md"],
       "modules": []

package/skills/w/harness/HARNESS.md

@@ -36,7 +36,7 @@ The capabilities the harness layer depends on, with their universal fallback (wh
 | **procedure-loading** | load a loop's/command's doctrine | the AI **reads the `.md`** of the loop and follows it (read-and-follow) |
 | **structured-choice** | ask the human ≤3 content questions **+ always** a `flow` control (`Compactar`/`Cerrar`); every option has a semantic label + one-sentence functional explanation/example | the host's own tool when the turn offers it; else the **`structured_choice`** tool of Workline's own MCP server, which renders the host's native selector by elicitation (only where the catalog declares it with dated evidence); else **labeled markdown** in chat, answered by label or by ratifying all first options with `Aceptar recomendaciones` |
 | **compaction** | shrink the context without losing the thread (+ a context-pressure **signal** for the chassis' self-regulation) | write `CHECKPOINT` and ask the user to restart the context and resume (resume keys off `CHECKPOINT`) |
-| **subagent-dispatch** | *(optional)* parallelize research breadth | **inline sequential** research in the same session (the default anyway) |
+| **subagent-dispatch** | *(optional)* run the three stages the chassis admits — parallel research in the refine and planning loops, independent implementation units in the code loops, the code loops' final review — and the on-demand follow-up after close | the same cases **inline, in sequence** in the main thread; `plan-exec`'s review becomes a clean re-read its report declares (optional in `quick`) |
 | **persistent-context** | the `WORKSPACE` block + conventions always present | the repo's context file (standard **`AGENTS.md`**; `CLAUDE.md` on Claude Code) |
 | **host-memory** | *(optional)* recover state/pending work from the host's accessible history — a **second source** after the workline signals | recent **git** / **`docs/`** signals + (in `/resume`) **ask the user**; plus Workline's own `.workflow/CHECKPOINT` via `aw resume-summary` |
 | **web-research** | *(optional)* search/fetch external online evidence inside a consented ideation round (spec-refine § *Ideation gate*) | **offline ideation** (own knowledge + workspace + repos) — the loop **declares** the web was unavailable |
@@ -56,10 +56,14 @@ own target explicitly; environment detection is the fallback, while a shared
 - A deterministic tranche dispatches **zero** model workers, subagents and
   external processes. `aw flow advance` exhausts it locally until the first
   semantic, human, authorization, execution, blocked or final frontier.
-- A semantic tranche is inline by default. It may use subagents only for three
-  or more independent partitions with no dependency and no overlapping writes;
-  then the CLI caps them at **3** (at most **4** model workers including the
-  coordinator). Human and authorization frontiers never fan out.
+- A semantic tranche is inline by default. Subagents fit only the three stages
+  of the chassis rule (`../loops/CHASSIS.md`, *Subagents — admitted per stage*):
+  parallel research in `spec-refine`, `plan-new` and `plan-refine`; independent
+  implementation units in `plan-exec` and `quick`; the code loops' final review.
+  Research and implementation need three or more independent partitions with no
+  dependency and no overlapping writes, capped at **3** (at most **4** model
+  workers including the coordinator); the final review does not depend on that
+  threshold. Human and authorization frontiers never fan out.
 - An execution frontier has one external invocation at a time and returns its
   actual evidence; it is not a request to run more agents.
 - Token usage is recorded only when the host supplies a real count. Bytes,

package/skills/w/hooks/README.md

@@ -14,28 +14,39 @@
 | `PreCompact` | `checkpoint-write` | Writes `CHECKPOINT.md` before the host compacts. **Never blocks the compaction.** |
 | `PostCompact` | `resume-summary` | Recovers **the conversation's own** loop state after a compact. |
 
-> **Conversation identity (spec 011).** The three lifecycle hooks act on **one**
-> session — the conversation's own — never on "the first active one" and never
-> on all of them. They resolve it with the canonical precedence: explicit
-> `--code` → the conversation's durable association → the sole active session.
-> The identity travels in the hook payload's `session_id` (read from stdin) or
-> in `AW_CONTEXT_ID`; two signals naming different conversations fail with
-> `CONTEXT_ID_CONFLICT` instead of picking one. The association lives in
-> `.workflow/sessions/.bindings.json` keyed by the SHA-256 of that id — the raw
-> value is never persisted.
+> **Conversation identity (spec 011, spec 056).** The three lifecycle hooks act
+> on **one** session — the conversation's own — never on "the first active one"
+> and never on all of them. They resolve it as every write does: explicit
+> `--code` → the conversation's durable association. A write **never** falls back
+> to the sole active session: it may be another conversation's line, so with no
+> identity and an active session it refuses with `SESSION_UNBOUND`, lists the
+> active sessions and asks for `--code <NNN>`. Only reads keep that fallback. The identity travels in the
+> hook payload's `session_id` (read from stdin) or in `AW_CONTEXT_ID`; two
+> signals naming different conversations fail with `CONTEXT_ID_CONFLICT` instead
+> of picking one. The association lives in `.workflow/sessions/.bindings.json`
+> keyed by the SHA-256 of that id — the raw value is never persisted. Hosts that
+> give the agent's commands no id associate nothing, so there the CHECKPOINT is
+> always written with `aw checkpoint-write --code <NNN>`.
 >
 > **An unresolved session never holds a compaction back.** `PreCompact` always
 > exits **0**. It used to exit 2 on an ambiguity so a person could name the
 > session first, and that trapped the conversation: the remedy it printed does
 > not always bind the conversation, so the next `/compact` blocked again. Now the
 > host's compaction completes, Workline reports `continuity: "degraded"` with
-> `primary_session: null`, and — whenever there is a candidate that could adopt
-> it — parks a **refuge checkpoint** in `.workflow/sessions/.refuge/` naming the
-> reason, the candidates and the way out. `PostCompact` reports it as `refuge`,
-> and the first `checkpoint-write` that does resolve the session (typically
-> `--code <NNN>`) folds it into that session's `CHECKPOINT.md` and removes it.
-> The refuge names its conversation by the SHA-256 of the id, like the
-> association registry. Per-host installation and transport belong to spec 010.
+> `primary_session: null`, says so on stderr (`PreCompact` and `SessionEnd`) and
+> parks a **refuge checkpoint** in `.workflow/sessions/.refuge/` naming the
+> reason, the **active** candidates and the way out — none at all when no
+> session is active. `PostCompact` reports it as `refuge`.
+>
+> **Who adopts a refuge.** Its own conversation, into whichever session its next
+> `checkpoint-write` or `SessionEnd` resolves. Anybody else only with `--code` on one of its candidates, and only
+> when nobody else can claim it: it has no conversation, the invocation carries
+> no id, or it is older than 24 hours. Adopting folds it into that session's
+> `CHECKPOINT.md` and removes it. A refuge nobody can adopt any more — no active
+> candidate, and no conversation or past the 24 hours — is swept on the next
+> lifecycle write and listed in `refuges_swept`. The refuge names its
+> conversation by the SHA-256 of the id, like the association registry.
+> Per-host installation and transport belong to spec 010.
 
 > **What they enforce (host-level, blocking):** invariant **#4** (DB scripts-only) via `sql-mutation-guard` (blocks DML/DDL over MCP), and the *expected-branch* clause of **#5** via `branch-check` (blocks edits on the wrong branch). The rest of git-safe (`push`/`--amend`/`--no-verify`/`--force`) is **doctrinal** — `git-commit-advisor` only **warns**, it does not block; a host may add its own deny hook if it wants hard enforcement.
 >

package/skills/w/loops/CHASSIS.md

@@ -1,6 +1,6 @@
 # CHASSIS — the loop engine
 
-This document is the **common engine** of the Workline loops: the doctrine every loop runs underneath its deltas. **It is not a skill** — it is a referenced document: every loop orders it read from its `## Inherits`, **always, before its deltas**. If you edit the engine, edit it **here** — heirs never repeat it, they only reference it.
+The **common engine** of the Workline loops: every loop reads it from its `## Inherits`, **always, before its deltas**. Edit the engine **here**; heirs only reference it.
 
 > **When each step below happens is no longer this document's call:** the deterministic steps below are decided by the CLI (`aw flow advance`), not by this document. They consume no model worker, subagent or external process: the CLI advances them locally to the first real frontier. What stays is what each rule is FOR — the half no engine carries. Answering the frontier it stops at is `aw flow submit`, and its envelope — which fields each kind of frontier demands, and where each digest comes from — is **read** with `aw flow --help`, never guessed.
 
@@ -20,13 +20,13 @@ The two that edit code also apply [`CODE-POLICIES.md`](CODE-POLICIES.md).
 
 A loop **is a persistent objective**: it exists to fulfill the `SESSION.Objective` declared at start, and **it is not finished until the convergence gate confirms the objective was met**. Gap-driven iteration is the *method*; the artifacts are the *record*; the objective is the *frame*.
 
-"Don't stop until convergence" is sustained by the loop itself — its `repeat:` plus the convergence gate — never by a host hook, which is what makes it harness-agnostic. Each heir instantiates the frame: `spec-refine` pursues the spec; the plan loops pursue the plan up to their gate; `plan-exec` up to its final validation; `quick-loop` its prompt.
+"Don't stop until convergence" is sustained by the loop itself — its `repeat:` plus the convergence gate — never by a host hook, which is what makes it harness-agnostic.
 
-> **Inter-turn continuity.** The same `CHECKPOINT`+resume governs the **next prompt**: the objective persists **across turns**, not only within a run. The canonical rules (command = new work line · re-run = `create_or_resume` · bare prompt = continue the most recent session · reopening closed sessions · consented escalation) are the **single source** in [`../SKILL.md`](../SKILL.md) § *Operating context*; this engine executes them via *Compact / resume* (case 3).
+> **Inter-turn continuity.** The same `CHECKPOINT`+resume governs the **next prompt**: the objective persists **across turns**, not only within a run. Its canonical rules have their **single source** in [`../SKILL.md`](../SKILL.md) § *Operating context*; this engine executes them via *Compact / resume* (case 3).
 
 ## Verification-first
 
-The persistent objective needs a **checkable done-condition** — otherwise the loop cannot know when it is done (or chases a target it invented). That condition is **seeded BEFORE executing**, never improvised at the end: it is **generalized TDD**. Together with artifact-first (next section) these are the **two seeds** of every gap/phase: *how will I know it worked* + *what am I about to do*.
+The persistent objective needs a **checkable done-condition** — otherwise the loop cannot know when it is done (or chases a target it invented). That condition is **seeded BEFORE executing**, never improvised at the end: it is **generalized TDD**.
 
 **Where it lives:** in `SESSION.Success criteria` — a `[ ]` checklist of **falsifiable** criteria (that *can* fail). `CHECKPOINT.Pending/Completed` tracks the **red→green** progress. Two forms, by deliverable:
 
@@ -44,7 +44,7 @@ The persistent objective needs a **checkable done-condition** — otherwise the
 
 **Gate integrity (anti-gaming + independent verification).** The gate only counts if it is not gamed to pass. The loop does **not**: modify the check or loosen a `Success criterion` to force green; weaken, delete or skip tests/validations; use trivial or tautological asserts that always pass (the expected value comes from an independent source, never from the output itself); patch the test instead of fixing the cause (prefer fixing production code).
 
-Facing a real blocker it **stops and reports it** (→ `Open questions`/`BACKLOG`) instead of gaming the metric. The verdict counts **only the check's output, never the implementer's self-declaration**: when the deliverable warrants it, the final verification is an **independent** pass (subagent only when the CLI's independent-partition rule admits it, or a clean re-read) that does not assume the implementation is correct — *only command output counts*.
+Facing a real blocker it **stops and reports it** (→ `Open questions`/`BACKLOG`) instead of gaming the metric. The verdict counts **only the check's output, never the implementer's self-declaration**: when the deliverable warrants it, the final verification is an **independent** pass (a clean re-read in the main thread; in the code loops, `CODE-POLICIES.md`'s review) that does not assume the implementation is correct — *only command output counts*.
 
 **Minimality (anti-over-engineering).** Passing the criteria is **necessary, not sufficient**: the gate also rejects a deliverable **heavier than its `Success criteria` require** — YAGNI at the deliverable's altitude. A spec can be coherent yet over-specified; a plan sound yet over-engineered; a diff green yet padded with reinvented stdlib, speculative abstractions or dead flexibility. At its own altitude the gate asks the laziest-that-works questions:
 
@@ -62,7 +62,7 @@ The loop works **artifact-first**: the artifact is **seeded before** executing a
 2. **EXECUTE.** Resolve the gap / run the phase / edit the code.
 3. **AFTER — bring to actual state.** `CHECKPOINT.Pending → Completed`; `DECISION` records the non-obvious **as it is decided**; `BACKLOG` **only if** something is deferred/follow-up.
 
-> The artifact expresses the **intent** (before) and then the **result** (after), at **every** gap/phase boundary — not only on `Compactar`/`Cerrar`. Session artifacts are the run's live log; the spec/plan is the **guiding base**.
+> Session artifacts are the run's live log at **every** boundary, not only on `Compactar`/`Cerrar`; the spec/plan is the **guiding base**.
 
 > **Fixed form (hard rule):** an artifact keeps its template's `##` headings **exactly** and is updated **in place** — appending a **duplicate heading** is a contract violation. A filled section **replaces** its `<!-- … -->` guidance comment. Canonical headings per artifact: its template under [`../artifacts/`](../artifacts/) (CHECKPOINT: `Completed` · `Pending / Next`; `Open questions` only while live doubts exist).
 
@@ -72,13 +72,13 @@ The common cycle — each heir instantiates it in its `## Sequence` with its own
 
 ## Internal sessions (managed) — one session per run
 
-The loop creates and manages its session under `.workflow/sessions/`; **the user never creates it**. **A single session per run**: it keeps progress live (`CHECKPOINT`) and enables resume. Artifacts: `SESSION.md` · `CHECKPOINT.md` (· `BACKLOG.md` only if something is deferred; code-editing loops add `DECISION` and `SCRIPTS.sql`). Each heir declares its descriptor and `Type` in its own `## Internal sessions`.
+The loop creates and manages its session under `.workflow/sessions/`; **the user never creates it**. **A single session per run**: it keeps progress live (`CHECKPOINT`) and enables resume. Artifacts: `SESSION.md` · `CHECKPOINT.md` (· `BACKLOG.md`; code-editing loops add `DECISION` and `SCRIPTS.sql`). Each heir declares its descriptor and `Type` in its own `## Internal sessions`.
 
 > The flow's input document (spec/plan) **never** goes inside a session; it lives in `docs/`.
 
-**CLI**: `aw session-create --type <type> --name <slug>-<flow> --objetivo "<one-line objective>"` opens it · `aw checkpoint-write` / `aw checkpoint-read` keep it resumable. **Closing it is the CLI's own move**, run at `finalize`: a loop never issues the close itself, and one issued mid-run leaves the next `advance`/`submit` standing on a closed session.
+**CLI**: `aw session-create --type <type> --name <slug>-<flow> --objetivo "<one-line objective>"` opens it · `aw checkpoint-write --code <NNN>` / `aw checkpoint-read` keep it resumable. **Closing it is the CLI's own move**, run at `finalize`: a loop never runs it, and one issued mid-run leaves the next `advance`/`submit` on a closed session.
 
-> The caller passes **only the descriptor** via `--name` — **never** a number; the CLI owns the global `NNN`. How it is assigned, how a session is located or reopened, and how a failed history upsert is repaired, are in the `sessions` module.
+> The caller passes **only the descriptor** via `--name` — **never** a number; the CLI owns the global `NNN`. Its assignment, locating or reopening a session and repairing a failed history upsert live in the `sessions` module.
 
 ## Ask-vs-research rule (the discriminator)
 
@@ -86,13 +86,18 @@ Which resolver a gap gets is the kind of thing it is, and the CLI classifies it:
 
 ## Research: autonomy, scope & failure
 
-Investigation is **inline**: an activity **inside the run's current session**, never a separate session. It writes its artifacts (`ANALYSIS-FILE` → `CONCLUSIONS`, + read-only `SCRIPTS.sql` if it queries DB) **into the session's own folder**.
+Investigation runs **inside the run's current session**, never a separate session. It writes its artifacts (`ANALYSIS-FILE` → `CONCLUSIONS`, + read-only `SCRIPTS.sql` if it queries DB) **into the session's own folder**.
 
-- **Autonomous**: the AI investigates inline and reports **without asking permission**. The human learns of it at integration time and keeps control via the `flow` control.
+- **Autonomous**: the AI investigates and reports **without asking permission**. The human keeps control via the `flow` control.
 - **Scope**: the current conversation (settled conclusions are reused, never re-derived) + workspace + associated repos + DB MCPs.
 - **DB rule** — the single exception to autonomy: it lives in the `db` module and is loaded **before** any query runs.
 - **Inconclusive research** (DB unavailable, insufficient evidence, unresolvable factual gap): the investigation closes **`inconclusive`** in `CONCLUSIONS` with its reason. The loop **degrades** the gap — to a human question, or failing that to the flow doc's `## Open questions` (the session's `BACKLOG` when the flow has no doc) — instead of re-firing it. Capping the attempts is the CLI's; declaring where a degraded gap GOES is doctrine's, because a gap dropped without a destination is this engine's promised convergence, faked.
 
+**Subagents — admitted per stage.** Only three cases inside a run: parallel research in `spec-refine`, `plan-new` and `plan-refine`; implementing independent units in `plan-exec` and `quick`; the code loops' final review.
+Research and implementation fan out only with **three or more independent** parts, at most **3** at a time. Independent means none uses another's result or writes what another writes; dependent units run in sequence.
+Everything else stays in the main thread: drafting, deciding, asking, shaping phases, persisting, updating state, resuming, integrating, committing and a document loop's closing verification. Capture (`spec-new`) keeps its total ban.
+This rule prevails over the host's mode and over any installed skill that orders agent orchestration; a host without subagents runs the same cases inline.
+
 ## Structured-choice (design & batching)
 
 **Canonical form:** *structured-choice* = **≤3 content questions + 1 `flow` control**, always. Each option is a **short semantic label + one functional sentence** (outcome/trade-off or simple example), never a positional code. The CLI builds it and refuses a question that does not hold this form. Present it with the richest current binding in [`HARNESS.md`](../harness/HARNESS.md); otherwise labeled markdown.
@@ -132,7 +137,6 @@ The engine above is what every run needs. The branches below apply only under th
 
 - `adopted` → [`../modules/ADOPTED-CONTEXT.md`](../modules/ADOPTED-CONTEXT.md) · `probe` → [`../modules/PROBE.md`](../modules/PROBE.md) · `db` → [`../modules/DB-RESEARCH-RULE.md`](../modules/DB-RESEARCH-RULE.md)
 - `compaction` → [`../modules/COMPACTION.md`](../modules/COMPACTION.md) · `sessions` → [`../modules/SESSION-NUMBERING.md`](../modules/SESSION-NUMBERING.md)
-- `code` → [`CODE-POLICIES.md`](CODE-POLICIES.md), which the two code-editing loops order read from their `## Inherits`
 
 ## Reference resolution (global layout rule) — and what the chassis is NOT
 

package/skills/w/loops/CODE-POLICIES.md

@@ -1,9 +1,8 @@
 # CODE-POLICIES — policies for code-editing loops
 
 They apply to **`plan-exec-loop`** (per effective batch) and **`quick-loop`** (the single task;
-**proportional** gate): each reads this doc with the chassis, and no document loop loads it. These
-policies own the DB scripts-only, safe Git and closing-review invariants; code loops keep only a
-short inline floor for advisory hosts.
+**proportional** gate), read with the chassis. They own the DB scripts-only, safe Git and
+closing-review invariants.
 
 ## Safe git — verified branch + proposed commits
 
@@ -17,7 +16,7 @@ its internal phases in one reviewed commit, and no batch may co-mingle with anot
 
 Concurrent flows never share a working tree: a run declares its sources and takes an **isolation
 unit** in each before writing — a worktree on its own branch
-(`aw worktree ensure | list | release`), where branch and commits are read. An edit outside is
+(`aw worktree ensure | list | release`). An edit outside is
 blocked naming the command that gets one, and at close `aw worktree integrate` merges each into
 the source's work branch; a conflict is reported, routed to `aw fix-git --path`, never alone.
 
@@ -29,16 +28,22 @@ After validation and before commits, the whole execution-unit diff passes a **cl
 gate**: an effective batch in plan-exec, or the proportional task in quick. Early `Cerrar` uses the
 same gate before any pending commit.
 
-- **Independent re-read** of the diff (subagent or clean re-read — the engine's *independent verification*: it does not assume the implementation is correct; *only command output counts*).
+- **Independent re-read** of the diff — the engine's *independent verification*: it does not assume the implementation is correct; *only command output counts*. In `quick` a subagent reviewer is optional; `plan-exec` requires a distinct one (its Delta 5).
 - **Apply the installed ambient conventions** relevant to the touched stack (code/stack standards, security, diff review, the workspace's own families) — the host **auto-discovers them by `description`**. Workline **names and binds no** concrete conventions skill: **it creates the moment; the installed skills fill it** (that is why review is **not a role** — see [`../roles/README.md`](../roles/README.md)). With no convention skills installed → minimal generic checklist: SOLID/early-return, clear names, DRY, no silenced errors, no secrets/PII, parametrized SQL, no dead code, + the plan's `Validations` (if any).
 - **Minimality lens** (floor — holds with **no external skill**; chassis § *Minimality*): re-read the diff for over-building. Flag `delete` (dead/speculative code), `stdlib` (reinvented standard library), `native` (a dep or code doing what the platform already does), `yagni` (one-implementation abstraction, config nobody sets, one-caller layer), `shrink` (same behavior, fewer lines). An installed ambient review skill *raises* this; it never lowers it.
 - **Test-value lens** (floor, next to minimality): every test the diff adds must demonstrate an observable behavior, protect a business rule, verify a contract, exercise a real integration or prevent a known regression. Flag `overtest` for the ones that only mirror structure — a test per class or method, mocked call chains, the same happy path re-asserted at every layer, trivial getters/setters/mappers, cases written for coverage, broad snapshots where a functional assertion is clearer. Bounded by *Gate integrity*: `overtest` prunes redundancy, **never** a check that guards behavior, a trust boundary, security or accessibility.
 - **Temporary simulation check** (only when the change carries one): stubs, fakes and in-memory adapters are **explicit and named as such** (`Stub…` / `Fake…`), they sit at the boundary the plan declares, and no configuration can select them in a production runtime. A simulation still active on the main path with no declared removal is a finding, not a detail.
-- **Tooling check** (`docs/tools`): did the run create **reusable auxiliary tooling** (support scripts/CLIs/generators/reusable configs — not product code, not session probes)? → the host applies the **ambient `creating-tools` skill** (auto-discovered by its `description`; Workline does not bind it) so the tool gets its home under `docs/tools/<slug>/` (README + run/output structure per that skill's contract + its index row). Host without such a skill → the loop still **never writes `docs/tools` itself**: **declare the gap** — the homeless tool goes to the plan's `Open questions` + `BACKLOG` (in quick, `BACKLOG`) — never silent.
+- **Tooling check** (`docs/tools`): did the run create **reusable auxiliary tooling** (support scripts/CLIs/generators/reusable configs — not product code, not session probes)? → the host applies the **ambient `creating-tools` skill** (auto-discovered; Workline does not bind it), which homes it under `docs/tools/<slug>/` per its contract. Host without such a skill → the loop still **never writes `docs/tools` itself**: **declare the gap** — the homeless tool goes to the plan's `Open questions` + `BACKLOG` (in quick, `BACKLOG`) — never silent.
 - **Findings**: **fix** them in the working tree and **re-run validation** (the gate does not replace the tests: it re-verifies after fixing), or **defer them justified** (→ the plan's `Open questions` + `BACKLOG`; in quick, `BACKLOG`); the non-obvious → `DECISION`. Gate integrity (see [`CHASSIS.md`](CHASSIS.md) § *Verification-first*): never weaken a check or lower a convention to pass.
 - **Artifact-first + verification-first**: seed `CHECKPOINT.Next = "review <batch/task>"`; Success
   criteria require the whole diff to pass before commits.
 
+**Close first, follow up on demand.** Before the commit only the validations and this review run;
+nothing waits on exploration. After commit and integration the report offers a parallel follow-up
+that probes what was delivered, in one line. It runs only if the user asks; its agents never modify
+the delivered work nor commit. Each finding comes back as a ready `/w:quick`, without reopening the
+closed document or session. A host without subagents runs it inline.
+
 ## Conditional modules
 
 - `db` — the DB scripts-only rule → `../modules/DB-SCRIPTS-ONLY.md`