cool-workflow 0.1.78 → 0.1.80

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cool-workflow",
   "description": "Auditable workflow control-plane and orchestration runtime: TypeScript dispatch, evidence-gated verification, state commits, scheduling, routines, multi-agent coordination, and MCP. Delegates execution to external agents — never runs models.",
-  "version": "0.1.78",
+  "version": "0.1.80",
   "author": {
     "name": "COOLWHITE LLC"
   },

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.78",
+  "version": "0.1.80",
   "description": "Auditable workflow control-plane and orchestration runtime: TypeScript dispatch, evidence-gated verification, state commits, scheduling, routines, multi-agent coordination, and MCP. Delegates execution to external agents — never runs models.",
   "author": {
     "name": "COOLWHITE LLC"

package/README.md

@@ -8,6 +8,8 @@
 ```
 
 [![CI](https://img.shields.io/github/actions/workflow/status/coo1white/cool-workflow/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/coo1white/cool-workflow/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/cool-workflow?style=flat-square&label=npm&color=cb3837)](https://www.npmjs.com/package/cool-workflow)
+[![downloads](https://img.shields.io/npm/dm/cool-workflow?style=flat-square&label=downloads)](https://www.npmjs.com/package/cool-workflow)
 [![release](https://img.shields.io/github/v/tag/coo1white/cool-workflow?style=flat-square&label=release&color=brightgreen&sort=semver)](https://github.com/coo1white/cool-workflow/tags)
 [![license](https://img.shields.io/badge/license-BSD--2--Clause-blue?style=flat-square)](../../LICENSE)
 ![MCP](https://img.shields.io/badge/MCP-native-8A2BE2?style=flat-square)
@@ -631,8 +633,32 @@ CHANGELOG.md and RELEASE.md are content surfaces checked by the dogfood-release
 
 Auto-compaction hook moved from `saveCheckpoint()` to explicit `maybeCompactRun()` calls after major lifecycle mutations. Fixes test fixture fingerprint instability. Also fixes the dogfood-release version-sync pipeline: always use `npm run bump:version`, never hand-edit version.ts alone.
 
-v0.1.76
+## Control-plane naming (v0.1.76)
 
-v0.1.77
+Positioning consistency: every self-describing surface names CW an auditable workflow control-plane / Workflow App framework, not an "SDK" (which survives only in the red-line disclaimer "embeds no model SDK").
 
-v0.1.78
+## Workflow orchestration: Tracks 1–3 (v0.1.77)
+
+The orchestration vision landed in one release, all reviewer-gated:
+
+- **Track 1 — telemetry attestation**: each agent's reported token usage is verified against an operator ed25519 trust key (`attested`/`unattested`/`absent`, surfaced loudly), recorded in a tamper-evident hash-chained ledger; opt-in `require-attested-telemetry` fails closed on unverifiable usage.
+- **Track 2 — concurrent failure semantics**: a `parallel()` phase runs its agents concurrently with declared collapse rules — **collect-all** (a failing hop never aborts siblings) and **kill-on-timeout** (a hung agent is killed at its deadline and counted as one failure). 16 agents with a forced hang + crash + dirty-return complete with no deadlock and a replay-complete record.
+- **Track 3 — boundary contract**: per-task output `schema` validation (dependency-free, parks on mismatch), `limits.tokenBudget` enforced against recorded usage, and the one-way executor boundary welded into the type layer (a callable crossing it fails `npm run build`).
+
+## Working onboarding + npm distribution (v0.1.78)
+
+`--agent-command builtin:claude` resolves to a bundled read-only claude wrapper that completes workers with a real agent; the cross-directory quickstart crash is fixed; missing optional inputs no longer leak `{{name}}` into prompts. Published to npm (`cool-workflow`, bins `cw`/`cool-workflow`) with LICENSE and metadata. Live dogfood proof committed under `docs/dogfood/`.
+
+## Tamper-evidence demo (v0.1.79)
+
+`cw demo tamper` — a hermetic, one-command proof that a recorded telemetry verdict cannot be forged undetected: it builds a real ed25519-signed ledger, forges it at the ledger layer (verdict flip + recomputed local hash → the chain still breaks) and the signature layer (inflated tokens, reused signature → ed25519 rejects), all verified offline with only the public key. `cw telemetry verify <run>` is the operator-facing half (`cw_telemetry_verify` on MCP).
+
+## Opt-in live agent output during a drive (on main, ships next)
+
+Set `CW_AGENT_STREAM=1` to see each worker's live agent trace. The bundled claude wrapper (`builtin:claude` / `scripts/agents/claude-p-agent.js`) keeps the legacy `--output-format json` path by default; only the opt-in path runs claude in `--output-format stream-json` and renders a concise human trace (tool uses, assistant text, per-turn summaries) to **stderr**. CW core forwards that stderr to the operator's terminal only when `CW_AGENT_STREAM=1`, CW's own stderr is a TTY, and `CW_NO_STREAM` is not set; piped/CI runs stay silent (Rule of Silence). Core only forwards the stream, never parses it — vendor-specific rendering is the wrapper's concern (policy), not the kernel's (mechanism).
+
+v0.1.79
+
+## Fast Architecture Review (v0.1.80)
+
+Adds the opt-in fast architecture-review lane: scoped JSONL source contexts, diff-aware exports, reusable Map and Assess results, measurable wrapper metrics, actionable background full-review handoff, and userland model policy flags for routing fast/strong workers without changing the full review contract.

package/apps/architecture-review/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review",
   "title": "Architecture Review",
   "summary": "Map a repository architecture, assess risks, verify important findings, and synthesize an evidence-backed verdict.",
-  "version": "0.1.78",
+  "version": "0.1.80",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/architecture-review-fast/app.json

@@ -0,0 +1,64 @@
+{
+  "schemaVersion": 1,
+  "id": "architecture-review-fast",
+  "title": "Architecture Review Fast",
+  "summary": "Run a shorter architecture review with parallel map and assess phases for faster first results.",
+  "version": "0.1.80",
+  "author": "COOLWHITE LLC",
+  "inputs": [
+    {
+      "name": "repo",
+      "type": "path",
+      "required": true,
+      "description": "Repository path to inspect."
+    },
+    {
+      "name": "question",
+      "type": "string",
+      "required": true,
+      "description": "Architecture question or decision to review."
+    },
+    {
+      "name": "invariant",
+      "type": "string",
+      "repeated": true,
+      "description": "Invariant that must remain true."
+    },
+    {
+      "name": "focus",
+      "type": "string",
+      "description": "Optional subsystem, risk area, or file path to emphasize.",
+      "default": "the highest-risk runtime and operator paths"
+    },
+    {
+      "name": "sourceContext",
+      "type": "path",
+      "description": "Optional JSONL source context file generated by scripts/source-context.js export.",
+      "default": ""
+    },
+    {
+      "name": "sourceContextDigest",
+      "type": "string",
+      "description": "Optional digest or cache key for the supplied source context.",
+      "default": ""
+    }
+  ],
+  "sandboxProfiles": [
+    "readonly"
+  ],
+  "compatibility": {
+    "minVersion": "0.1.79",
+    "workflowSchemaVersion": 1,
+    "notes": "Opt-in fast architecture review app; the full architecture-review app remains unchanged."
+  },
+  "metadata": {
+    "canonical": true,
+    "domain": "software-architecture",
+    "mode": "fast",
+    "fullReviewApp": "architecture-review",
+    "maintainedAs": "official-userland"
+  },
+  "workflow": {
+    "entrypoint": "workflow.js"
+  }
+}

package/apps/architecture-review-fast/workflow.js

@@ -0,0 +1,153 @@
+const FAST_MODEL = modelHint("CW_ARCHITECTURE_REVIEW_FAST_MODEL");
+const STRONG_MODEL = modelHint("CW_ARCHITECTURE_REVIEW_STRONG_MODEL");
+
+module.exports = ({ workflow, phase, parallel, agent, artifact, input }) => {
+  const inputs = [
+    input("repo", {
+      type: "path",
+      required: true,
+      description: "Repository path to inspect."
+    }),
+    input("question", {
+      type: "string",
+      required: true,
+      description: "Architecture question or decision to review."
+    }),
+    input("invariant", {
+      type: "string",
+      repeated: true,
+      description: "Invariant that must remain true."
+    }),
+    input("focus", {
+      type: "string",
+      description: "Optional subsystem, risk area, or file path to emphasize.",
+      default: "the highest-risk runtime and operator paths"
+    }),
+    input("sourceContext", {
+      type: "path",
+      description: "Optional JSONL source context file generated by scripts/source-context.js export.",
+      default: ""
+    }),
+    input("sourceContextDigest", {
+      type: "string",
+      description: "Optional digest or cache key for the supplied source context.",
+      default: ""
+    })
+  ];
+
+  return workflow({
+    id: "architecture-review-fast",
+    title: "Architecture Review Fast",
+    summary: "Run a shorter architecture review with parallel map and assess phases for faster first results.",
+    limits: {
+      maxAgents: 12,
+      maxConcurrentAgents: 4
+    },
+    inputs,
+    sandboxProfiles: ["readonly"],
+    metadata: {
+      mode: "fast",
+      fullReviewApp: "architecture-review"
+    },
+    phases: [
+      parallel("Map", [
+        agent(
+          "map:runtime-surface",
+          [
+            "Fast-map the runtime architecture in {{repo}} for {{question}}.",
+            contextInstruction(),
+            "Focus: {{focus}}. Invariants: {{invariant}}.",
+            "Return the primary entrypoints, state stores, execution paths, and the exact files or commands inspected."
+          ].join(" "),
+          fastOptions("Runtime surface mapper", { resultCache: sourceContextResultCache() })
+        ),
+        agent(
+          "map:operator-surface",
+          [
+            "Fast-map operator, CI, deployment, test, release, and background-job surfaces in {{repo}} for {{question}}.",
+            contextInstruction(),
+            "Focus: {{focus}}. Return concrete files, scripts, configs, missing areas, and candidate runtime bottlenecks."
+          ].join(" "),
+          fastOptions("Operator surface mapper", { resultCache: sourceContextResultCache() })
+        )
+      ]),
+      parallel("Assess", [
+        agent(
+          "assess:risks",
+          [
+            "Assess the fast map for real P0/P1/P2 architecture and correctness risks.",
+            "Separate confirmed risks, conditional risks, non-issues, and unknowns.",
+            "Tie every important claim to inspected evidence and the invariants {{invariant}}."
+          ].join(" "),
+          fastOptions("Risk assessor", { resultCache: sourceContextResultCache({ includeCompletedResults: "previous-phases" }) })
+        ),
+        agent(
+          "assess:runtime-speed",
+          [
+            "Assess runtime speed and user-wait risk for {{question}}.",
+            "Look for serial agent work, repeated repository scanning, missing cache keys, oversized prompts, and long foreground jobs.",
+            "Recommend mechanisms that preserve POLA, stdout/stderr discipline, and zero runtime dependencies."
+          ].join(" "),
+          fastOptions("Runtime speed assessor", { resultCache: sourceContextResultCache({ includeCompletedResults: "previous-phases" }) })
+        )
+      ]),
+      phase("Verify", [
+        agent(
+          "verify:p0-p2-risks",
+          [
+            "Re-open evidence for every candidate P0/P1/P2 risk from the fast assessment.",
+            "Confirm real risks, downgrade unsupported claims, and list exact file paths, commands, logs, or unknowns.",
+            "The cw:result evidence array must cite durable locators."
+          ].join(" "),
+          strongOptions("Evidence verifier", { requiresEvidence: true })
+        )
+      ]),
+      phase("Verdict", [
+        artifact(
+          "verdict:fast-synthesis",
+          [
+            "Synthesize a fast architecture verdict for {{question}}.",
+            "Include a short answer, compact architecture map, ranked risks, speed recommendations, non-issues, and evidence links.",
+            "State when the full architecture-review app should be scheduled as a background routine.",
+            "The cw:result evidence array must support the final verdict."
+          ].join(" "),
+          strongOptions("Fast verdict synthesizer", { requiresEvidence: true })
+        )
+      ])
+    ]
+  });
+};
+
+function fastOptions(label, extra) {
+  return taskOptions(label, FAST_MODEL, extra);
+}
+
+function strongOptions(label, extra) {
+  return taskOptions(label, STRONG_MODEL, extra);
+}
+
+function taskOptions(label, model, extra) {
+  return {
+    label,
+    sandboxProfileId: "readonly",
+    ...(model ? { model } : {}),
+    ...(extra || {})
+  };
+}
+
+function modelHint(name) {
+  const value = String(process.env[name] || "").trim();
+  return value || undefined;
+}
+
+function contextInstruction() {
+  return [
+    "If {{sourceContext}} is non-empty, read that JSONL source context first and treat {{sourceContextDigest}} as its cache/digest hint.",
+    "If the supplied context is missing, unreadable, or obviously stale, say so explicitly instead of guessing.",
+    "If no source context is supplied, inspect {{repo}} directly."
+  ].join(" ");
+}
+
+function sourceContextResultCache(extra) {
+  return { mode: "read-write", keyInput: "sourceContextDigest", ...(extra || {}) };
+}

package/apps/end-to-end-golden-path/app.json

@@ -3,7 +3,7 @@
   "id": "end-to-end-golden-path",
   "title": "End-to-End Golden Path",
   "summary": "Deterministic one-worker workflow app for proving the CW integration chain.",
-  "version": "0.1.78",
+  "version": "0.1.80",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/pr-review-fix-ci/app.json

@@ -3,7 +3,7 @@
   "id": "pr-review-fix-ci",
   "title": "PR Review Fix CI",
   "summary": "Review a pull request or branch, inspect CI failures, diagnose actionable issues, optionally patch, verify, and summarize with evidence.",
-  "version": "0.1.78",
+  "version": "0.1.80",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/release-cut/app.json

@@ -3,7 +3,7 @@
   "id": "release-cut",
   "title": "Release Cut",
   "summary": "Prepare a release with checklist discipline: version checks, changelog, tests, packaging, release notes, and final verification.",
-  "version": "0.1.78",
+  "version": "0.1.80",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/research-synthesis/app.json

@@ -3,7 +3,7 @@
   "id": "research-synthesis",
   "title": "Research Synthesis",
   "summary": "Split a research question into claims, investigate sources, cross-check evidence, verify claims, and synthesize a concise answer.",
-  "version": "0.1.78",
+  "version": "0.1.80",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/dist/capability-core.js

@@ -35,6 +35,9 @@ exports.runShow = runShow;
 exports.runResume = runResume;
 exports.runArchive = runArchive;
 exports.runRerun = runRerun;
+exports.runExportArchive = runExportArchive;
+exports.runImportArchive = runImportArchive;
+exports.runVerifyImport = runVerifyImport;
 exports.queueAdd = queueAdd;
 exports.queueList = queueList;
 exports.queueDrain = queueDrain;
@@ -61,12 +64,17 @@ exports.sandboxProfileIdFrom = sandboxProfileIdFrom;
 exports.withoutRuntimeKeys = withoutRuntimeKeys;
 exports.optionalString = optionalString;
 exports.isRecord = isRecord;
+exports.telemetryVerify = telemetryVerify;
+exports.demoTamper = demoTamper;
 const capability_registry_1 = require("./capability-registry");
 const drive_1 = require("./drive");
 const agent_config_1 = require("./agent-config");
 const run_registry_1 = require("./run-registry");
 const observability_1 = require("./observability");
+const telemetry_ledger_1 = require("./telemetry-ledger");
+const telemetry_demo_1 = require("./telemetry-demo");
 const state_1 = require("./state");
+const run_export_1 = require("./run-export");
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const scheduling_1 = require("./scheduling");
@@ -190,6 +198,19 @@ function flag(value) {
         return false;
     return Boolean(value);
 }
+function withInvocationCwd(args, fn) {
+    const cwd = optionalString(args.cwd);
+    if (!cwd)
+        return fn();
+    const previous = process.cwd();
+    process.chdir(cwd);
+    try {
+        return fn();
+    }
+    finally {
+        process.chdir(previous);
+    }
+}
 function runRegistryRefresh(reg, args) {
     return reg.refresh({ scope: scopeOf(args, "repo") });
 }
@@ -247,6 +268,27 @@ function runArchive(reg, runId, args) {
 function runRerun(reg, runId, args) {
     return reg.rerun(runId, { scope: scopeOf(args, "home"), reason: optionalString(args.reason) });
 }
+function runExportArchive(runner, runId, args) {
+    return withInvocationCwd(args, () => {
+        const output = optionalString(args.output || args.path || args.archive) || `${runId}.cwrun.json`;
+        return (0, run_export_1.exportRun)(runner.loadRun(runId), node_path_1.default.resolve(output));
+    });
+}
+function runImportArchive(runner, args) {
+    return withInvocationCwd(args, () => {
+        const archive = optionalString(args.archive || args.path || args.file);
+        if (!archive)
+            throw new Error("run import requires an archive path (positional, --archive, --path, or --file)");
+        const target = optionalString(args.target || args.repo || args.cwd) || process.cwd();
+        const imported = (0, run_export_1.importRun)(node_path_1.default.resolve(archive), node_path_1.default.resolve(target));
+        const registry = new run_registry_1.RunRegistry(node_path_1.default.resolve(target), runner);
+        const registryReport = registry.refresh({ scope: "repo" });
+        return { ...imported, registry: registryReport };
+    });
+}
+function runVerifyImport(runner, runId, args) {
+    return withInvocationCwd(args, () => (0, run_export_1.verifyImportedRun)(runner.loadRun(runId)));
+}
 function queueAdd(reg, args) {
     return reg.queueAdd({
         runId: optionalString(args.runId),
@@ -628,3 +670,32 @@ function optionalString(value) {
 function isRecord(value) {
     return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
+// ---- telemetry attestation: read-only ledger verification (Track 1) --------
+// Re-prove a run's telemetry chain offline: prevHash linkage + independent per-
+// record hash recompute (never trusts the stored hash). The auditable claim made
+// inspectable on demand — anyone can run this; a forged/edited record fails it.
+function telemetryVerify(runner, args) {
+    const runId = optionalString(args.runId || args.run);
+    if (!runId)
+        throw new Error("telemetry verify requires a run id (cw telemetry verify <run-id>)");
+    const run = runner.loadRun(runId);
+    const v = (0, telemetry_ledger_1.verifyTelemetryLedger)(run);
+    return {
+        schemaVersion: 1,
+        runId: run.id,
+        present: v.present,
+        verified: v.verified,
+        records: v.records.length,
+        attested: v.attested,
+        unattested: v.unattested,
+        absent: v.absent,
+        failedChecks: v.checks.filter((c) => !c.pass).map((c) => ({ name: c.name, code: c.code }))
+    };
+}
+// ---- demo: tamper-evidence (the one-command proof) -------------------------
+// Hermetic, deterministic-shape: builds a real ed25519-signed telemetry ledger,
+// then forges it two ways and shows both tamper-evidence layers catch it. CLI-only
+// (a human-facing demonstration; the underlying verify is the telemetry.verify verb).
+function demoTamper(_runner, _args = {}) {
+    return (0, telemetry_demo_1.runTamperDemo)();
+}

package/dist/capability-registry.js

@@ -215,13 +215,13 @@ const BUILTIN_CAPABILITIES = [
     { capability: "multi-agent.blackboard", summary: "Operate on the active multi-agent blackboard.", entry: "hostMultiAgentBlackboard", surface: "both", cli: { path: ["multi-agent", "blackboard"], jsonMode: "default" }, mcp: { tool: "cw_multi_agent_blackboard" } },
     { capability: "multi-agent.score", summary: "Score a candidate with evidence.", entry: "hostMultiAgentScore", surface: "both", cli: { path: ["multi-agent", "score"], jsonMode: "default" }, mcp: { tool: "cw_multi_agent_score" } },
     { capability: "multi-agent.select", summary: "Select a candidate with the verifier gate.", entry: "hostMultiAgentSelect", surface: "both", cli: { path: ["multi-agent", "select"], jsonMode: "default" }, mcp: { tool: "cw_multi_agent_select" } },
-    { capability: "multi-agent.summary", summary: "Read the multi-agent runtime summary.", entry: "multiAgentSummary", surface: "both", cli: { path: ["multi-agent", "summary"], jsonMode: "flag" }, mcp: { tool: "cw_multi_agent_summary" } },
+    { capability: "multi-agent.summary", summary: "Read the structured multi-agent runtime summary for a run.", entry: "multiAgentSummary", surface: "both", cli: { path: ["multi-agent", "summary"], jsonMode: "flag" }, mcp: { tool: "cw_multi_agent_summary" } },
     { capability: "multi-agent.summarize", summary: "Read the combined state-explosion report.", entry: "multiAgentSummarize", surface: "both", cli: { path: ["multi-agent", "summarize"], jsonMode: "flag" }, mcp: { tool: "cw_multi_agent_summarize" } },
-    { capability: "multi-agent.graph", summary: "Read the multi-agent operator graph.", entry: "multiAgentOperatorGraph", surface: "both", cli: { path: ["multi-agent", "graph"], jsonMode: "flag" }, mcp: { tool: "cw_multi_agent_graph" } },
+    { capability: "multi-agent.graph", summary: "Read the structured multi-agent operator graph for a run.", entry: "multiAgentOperatorGraph", surface: "both", cli: { path: ["multi-agent", "graph"], jsonMode: "flag" }, mcp: { tool: "cw_multi_agent_graph" } },
     { capability: "multi-agent.graph.compact", summary: "Read a compact/focused multi-agent graph view.", entry: "multiAgentGraphView", surface: "both", cli: { path: ["multi-agent", "graph"], caseTokens: ["multi-agent", "graph"], jsonMode: "flag" }, mcp: { tool: "cw_multi_agent_graph_compact" } },
-    { capability: "multi-agent.dependencies", summary: "Read derived multi-agent dependency edges.", entry: "multiAgentDependencies", surface: "both", cli: { path: ["multi-agent", "dependencies"], jsonMode: "flag" }, mcp: { tool: "cw_multi_agent_dependencies" } },
-    { capability: "multi-agent.failures", summary: "Read failed/blocked/rejected multi-agent records.", entry: "multiAgentFailures", surface: "both", cli: { path: ["multi-agent", "failures"], jsonMode: "flag" }, mcp: { tool: "cw_multi_agent_failures" } },
-    { capability: "multi-agent.evidence", summary: "Read evidence adoption status with rationaleStatus.", entry: "multiAgentEvidence", surface: "both", cli: { path: ["multi-agent", "evidence"], jsonMode: "flag" }, mcp: { tool: "cw_multi_agent_evidence" } },
+    { capability: "multi-agent.dependencies", summary: "Read derived multi-agent dependency edges for operator inspection.", entry: "multiAgentDependencies", surface: "both", cli: { path: ["multi-agent", "dependencies"], jsonMode: "flag" }, mcp: { tool: "cw_multi_agent_dependencies" } },
+    { capability: "multi-agent.failures", summary: "Read failed, blocked, rejected, and ambiguous multi-agent records.", entry: "multiAgentFailures", surface: "both", cli: { path: ["multi-agent", "failures"], jsonMode: "flag" }, mcp: { tool: "cw_multi_agent_failures" } },
+    { capability: "multi-agent.evidence", summary: "Read evidence adoption status from worker output through selection and commit. Each row carries a derived rationaleStatus (explained|unexplained|not-applicable).", entry: "multiAgentEvidence", surface: "both", cli: { path: ["multi-agent", "evidence"], jsonMode: "flag" }, mcp: { tool: "cw_multi_agent_evidence" } },
     { capability: "multi-agent.reasoning", summary: "Explain why each evidence item was adopted/rejected.", entry: "multiAgentReasoning", surface: "both", cli: { path: ["multi-agent", "reasoning"], jsonMode: "flag" }, mcp: { tool: "cw_evidence_reasoning" } },
     { capability: "multi-agent.reasoning.refresh", summary: "Refresh the durable evidence-reasoning index.", entry: "multiAgentReasoningRefresh", surface: "both", cli: { path: ["multi-agent", "reasoning"], caseTokens: ["multi-agent", "reasoning"], jsonMode: "default" }, mcp: { tool: "cw_evidence_reasoning_refresh" } },
     // ---- multi-agent lifecycle records --------------------------------------
@@ -285,7 +285,7 @@ const BUILTIN_CAPABILITIES = [
     { capability: "backend.agent.config.set", summary: "Set the durable agent delegation config (command-template/endpoint/model; API keys never written).", entry: "backendAgentConfigSet", surface: "both", cli: { path: ["backend", "agent", "config"], caseTokens: ["backend", "agent"], jsonMode: "default" }, mcp: { tool: "cw_backend_agent_config_set" }, payloadIdentical: false, reason: "Mutating: persists $CW_HOME/agent-config.json (secret-stripped) before returning the effective config; both surfaces perform the same write — it is a surface-mutating verb, not a read probe." },
     // ---- worker isolation ---------------------------------------------------
     { capability: "worker.list", summary: "List worker isolation scopes.", entry: "listWorkers", surface: "both", cli: { path: ["worker", "list"], jsonMode: "default" }, mcp: { tool: "cw_worker_list" } },
-    { capability: "worker.summary", summary: "Read the structured worker summary.", entry: "summarizeWorkerRecords", surface: "both", cli: { path: ["worker", "summary"], jsonMode: "flag" }, mcp: { tool: "cw_worker_summary" } },
+    { capability: "worker.summary", summary: "Read the structured worker summary for a run.", entry: "summarizeWorkerRecords", surface: "both", cli: { path: ["worker", "summary"], jsonMode: "flag" }, mcp: { tool: "cw_worker_summary" } },
     { capability: "worker.show", summary: "Show one worker isolation scope.", entry: "showWorker", surface: "both", cli: { path: ["worker", "show"], jsonMode: "default" }, mcp: { tool: "cw_worker_show" } },
     { capability: "worker.manifest", summary: "Write and return a worker manifest.", entry: "showWorkerManifest", surface: "both", cli: { path: ["worker", "manifest"], jsonMode: "default" }, mcp: { tool: "cw_worker_manifest" } },
     { capability: "worker.output", summary: "Record worker output.", entry: "recordWorkerOutput", surface: "both", cli: { path: ["worker", "output"], jsonMode: "default" }, mcp: { tool: "cw_worker_output" } },
@@ -299,12 +299,12 @@ const BUILTIN_CAPABILITIES = [
     { capability: "candidate.rank", summary: "Rank candidates with gates.", entry: "rankCandidates", surface: "both", cli: { path: ["candidate", "rank"], jsonMode: "default" }, mcp: { tool: "cw_candidate_rank" } },
     { capability: "candidate.select", summary: "Select a candidate with the verifier gate.", entry: "selectCandidate", surface: "both", cli: { path: ["candidate", "select"], jsonMode: "default" }, mcp: { tool: "cw_candidate_select" } },
     { capability: "candidate.reject", summary: "Reject a candidate with a reason.", entry: "rejectCandidate", surface: "both", cli: { path: ["candidate", "reject"], jsonMode: "default" }, mcp: { tool: "cw_candidate_reject" } },
-    { capability: "candidate.summary", summary: "Read the structured candidate summary.", entry: "summarizeCandidateOperatorRecords", surface: "both", cli: { path: ["candidate", "summary"], jsonMode: "flag" }, mcp: { tool: "cw_candidate_summary" } },
+    { capability: "candidate.summary", summary: "Read the structured candidate summary for a run.", entry: "summarizeCandidateOperatorRecords", surface: "both", cli: { path: ["candidate", "summary"], jsonMode: "flag" }, mcp: { tool: "cw_candidate_summary" } },
     // ---- feedback -----------------------------------------------------------
     { capability: "feedback.list", summary: "List run feedback records.", entry: "listFeedback", surface: "both", cli: { path: ["feedback", "list"], jsonMode: "default" }, mcp: { tool: "cw_feedback_list" } },
     { capability: "feedback.show", summary: "Show a run feedback record.", entry: "showFeedback", surface: "both", cli: { path: ["feedback", "show"], jsonMode: "default" }, mcp: { tool: "cw_feedback_show" } },
     { capability: "feedback.collect", summary: "Collect feedback from failed nodes.", entry: "collectFeedback", surface: "both", cli: { path: ["feedback", "collect"], jsonMode: "default" }, mcp: { tool: "cw_feedback_collect" } },
-    { capability: "feedback.summary", summary: "Read the structured feedback summary.", entry: "summarizeFeedbackRecords", surface: "both", cli: { path: ["feedback", "summary"], jsonMode: "flag" }, mcp: { tool: "cw_feedback_summary" } },
+    { capability: "feedback.summary", summary: "Read the structured feedback summary for a run.", entry: "summarizeFeedbackRecords", surface: "both", cli: { path: ["feedback", "summary"], jsonMode: "flag" }, mcp: { tool: "cw_feedback_summary" } },
     { capability: "feedback.task", summary: "Create a correction task for feedback.", entry: "createFeedbackTask", surface: "both", cli: { path: ["feedback", "task"], jsonMode: "default" }, mcp: { tool: "cw_feedback_task" } },
     { capability: "feedback.resolve", summary: "Resolve or reject feedback.", entry: "resolveFeedback", surface: "both", cli: { path: ["feedback", "resolve"], jsonMode: "default" }, mcp: { tool: "cw_feedback_resolve" } },
     // ---- scheduling ---------------------------------------------------------
@@ -344,6 +344,9 @@ const BUILTIN_CAPABILITIES = [
     { capability: "run.resume", summary: "Resolve a run by id and continue it from durable state.", entry: "runRegistry.resume", surface: "both", cli: { path: ["run", "resume"], jsonMode: "flag" }, mcp: { tool: "cw_run_resume" } },
     { capability: "run.archive", summary: "Archive/unarchive a run (overlay mark; never deletes source).", entry: "runRegistry.archive", surface: "both", cli: { path: ["run", "archive"], jsonMode: "default" }, mcp: { tool: "cw_run_archive" } },
     { capability: "run.rerun", summary: "Re-run a failed run as a NEW run linked to the original by provenance.", entry: "runRegistry.rerun", surface: "both", cli: { path: ["run", "rerun"], jsonMode: "default" }, mcp: { tool: "cw_run_rerun" } },
+    { capability: "run.export", summary: "Export a run to a portable archive with run-local files and digest integrity.", entry: "runExportArchive", surface: "both", cli: { path: ["run", "export"], jsonMode: "default" }, mcp: { tool: "cw_run_export" } },
+    { capability: "run.import", summary: "Restore a portable run archive into a target repo and verify restored file digests.", entry: "runImportArchive", surface: "both", cli: { path: ["run", "import"], jsonMode: "default" }, mcp: { tool: "cw_run_import" } },
+    { capability: "run.verify-import", summary: "Verify an imported run against its restore manifest and telemetry chain.", entry: "runVerifyImport", surface: "both", cli: { path: ["run", "verify-import"], jsonMode: "default" }, mcp: { tool: "cw_run_verify_import" } },
     { capability: "run.drive", summary: "Preview the next agent-delegation drive step for a run (read-only, deterministic).", entry: "runDrivePreview", surface: "both", cli: { path: ["run", "drive"], caseTokens: ["run", "drive"], jsonMode: "default" }, mcp: { tool: "cw_run_drive" } },
     { capability: "run.drive.step", summary: "Drive a run by delegating each worker to the agent backend (plan->dispatch->fulfill->accept->commit; --once for one step).", entry: "runDrive", surface: "both", cli: { path: ["run", "drive"], caseTokens: ["run", "drive"], jsonMode: "default" }, mcp: { tool: "cw_run_drive_step" }, payloadIdentical: false, reason: "Mutating: advances the run by spawning the external agent per worker and recording attested output — not a read probe. CLI (--drive/--step) and MCP route through the same drive() core." },
     {
@@ -374,6 +377,8 @@ const BUILTIN_CAPABILITIES = [
     { capability: "gc.plan", summary: "Dry-run plan of run reclamation (per-kind bytes + capability downgrade); frees nothing.", entry: "gcPlan", surface: "both", cli: { path: ["gc", "plan"], caseTokens: ["gc", "plan"], jsonMode: "flag" }, mcp: { tool: "cw_gc_plan" } },
     { capability: "gc.run", summary: "Execute the write-ahead reclamation transaction (skeleton -> tombstone -> fsync -> free).", entry: "gcRun", surface: "both", cli: { path: ["gc", "run"], caseTokens: ["gc", "run"], jsonMode: "flag" }, mcp: { tool: "cw_gc_run" }, payloadIdentical: false, reason: "Mutating: frees disk and appends a tombstone; both surfaces perform the identical transaction but the payload reports now-derived bytesFreed/tombstone." },
     { capability: "gc.verify", summary: "Re-prove a reclaimed run: skeleton-complete, tombstone chain untampered, artifacts reconstructable.", entry: "gcVerify", surface: "both", cli: { path: ["gc", "verify"], caseTokens: ["gc", "verify"], jsonMode: "flag" }, mcp: { tool: "cw_gc_verify" } },
+    { capability: "telemetry.verify", summary: "Re-prove a run's telemetry attestation ledger offline (chain linkage + independent hash recompute).", entry: "telemetryVerify", surface: "both", cli: { path: ["telemetry", "verify"], caseTokens: ["telemetry"], jsonMode: "flag" }, mcp: { tool: "cw_telemetry_verify" } },
+    { capability: "demo.tamper", summary: "Prove tamper-evidence: build a signed telemetry ledger, forge it, watch verification fail offline.", entry: "demoTamper", surface: "cli-only", cli: { path: ["demo", "tamper"], caseTokens: ["demo", "tamper"], jsonMode: "flag" }, reason: "Human-facing demonstration (operator/newcomer onboarding); the underlying integrity check is exposed programmatically as the both-surface telemetry.verify. No agent or MCP client needs to invoke a demo." },
     { capability: "history", summary: "Read a cross-repo unified run timeline (newest first).", entry: "runRegistry.history", surface: "both", cli: { path: ["history"], jsonMode: "flag" }, mcp: { tool: "cw_history" } },
     // ---- web / desktop workbench (v0.1.30) ----------------------------------
     // A THIRD FRONT DOOR — a read-only renderer, not a new brain. Both verbs route

package/dist/cli.js

@@ -10,6 +10,7 @@ const orchestrator_1 = require("./orchestrator");
 const capability_registry_1 = require("./capability-registry");
 const capability_core_1 = require("./capability-core");
 const observability_1 = require("./observability");
+const telemetry_demo_1 = require("./telemetry-demo");
 const run_registry_1 = require("./run-registry");
 const daemon_1 = require("./daemon");
 const scheduler_1 = require("./scheduler");
@@ -1063,10 +1064,19 @@ async function main() {
                 case "rerun":
                     printJson((0, capability_core_1.runRerun)(registry, required(id, "run id"), args.options));
                     return;
+                case "export":
+                    printJson((0, capability_core_1.runExportArchive)(runner, required(id || optionalArg(args.options.runId || args.options.run), "run id"), args.options));
+                    return;
+                case "import":
+                    printJson((0, capability_core_1.runImportArchive)(runner, { ...args.options, archive: id || args.options.archive || args.options.path }));
+                    return;
+                case "verify-import":
+                    printJson((0, capability_core_1.runVerifyImport)(runner, required(id || optionalArg(args.options.runId || args.options.run), "run id"), args.options));
+                    return;
                 default:
                     if (await tryDispatchCli(args, runner))
                         return;
-                    throw new Error("Usage: cw.js run search|list|show|resume|archive|rerun|drive [run-id] [--scope repo|home] [--json]  |  cw.js run <app> --drive [--once] [--repo R --question Q]");
+                    throw new Error("Usage: cw.js run search|list|show|resume|archive|rerun|drive|export|import|verify-import [run-id|archive] [--scope repo|home] [--json]  |  cw.js run <app> --drive [--once] [--repo R --question Q]");
             }
         }
         case "queue": {
@@ -1179,6 +1189,44 @@ async function main() {
                 process.stdout.write(`${(0, run_registry_1.formatHistory)(result)}\n`);
             return;
         }
+        case "telemetry": {
+            const [subcommand, id] = args.positionals;
+            switch (subcommand) {
+                case "verify": {
+                    const result = (0, capability_core_1.telemetryVerify)(runner, { ...args.options, runId: id || args.options.runId || args.options.run });
+                    if (wantsJson(args.options))
+                        printJson(result);
+                    else
+                        process.stdout.write(`${(0, telemetry_demo_1.formatTelemetryVerify)(result)}\n`);
+                    return;
+                }
+                default:
+                    if (await tryDispatchCli(args, runner))
+                        return;
+                    throw new Error("Usage: cw.js telemetry verify <run-id> [--json]");
+            }
+        }
+        case "demo": {
+            const [subcommand] = args.positionals;
+            switch (subcommand) {
+                case "tamper": {
+                    const result = (0, capability_core_1.demoTamper)(runner, args.options);
+                    if (wantsJson(args.options))
+                        printJson(result);
+                    else
+                        process.stdout.write(`${(0, telemetry_demo_1.formatTamperDemo)(result)}\n`);
+                    // Fail closed: if the proof did not hold (a tamper went undetected),
+                    // exit nonzero so the demo can never green a broken guarantee.
+                    if (!result.proven)
+                        process.exitCode = 1;
+                    return;
+                }
+                default:
+                    if (await tryDispatchCli(args, runner))
+                        return;
+                    throw new Error("Usage: cw.js demo tamper [--json]");
+            }
+        }
         case "workbench": {
             const [subcommand, runId] = args.positionals;
             switch (subcommand) {