cool-workflow 0.1.78 → 0.1.80

package/scripts/architecture-review-fast.js

@@ -0,0 +1,362 @@
+#!/usr/bin/env node
+"use strict";
+
+// architecture-review-fast — userland accelerator wrapper.
+//
+// Mechanism only: prepare one cached JSONL source context, pass its digest into
+// the opt-in fast app, then optionally create a background schedule for the full
+// architecture-review app. The model still runs only through CW's external agent
+// backend; this script imports no model SDK and holds no key.
+
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+const pluginRoot = path.resolve(__dirname, "..");
+const repoRoot = path.resolve(pluginRoot, "..", "..");
+const node = process.execPath;
+const cw = path.join(pluginRoot, "scripts", "cw.js");
+const sourceContext = path.join(pluginRoot, "scripts", "source-context.js");
+
+function main() {
+  const started = nowNs();
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) return usage(0);
+
+  const repo = path.resolve(required(args.repo, "repo"));
+  const question = required(args.question, "question");
+  const requestedProfile = stringArg(args.profile);
+  const ref = stringArg(args.ref) || "HEAD";
+  const requestedProfileFile = stringArg(args.profileFile || args["profile-file"]);
+  const defaultExternalProfile = !requestedProfile && !requestedProfileFile && repo !== repoRoot;
+  const profile = defaultExternalProfile ? "repo" : requestedProfile || "core";
+  const cacheDir = path.resolve(stringArg(args.cacheDir || args["cache-dir"]) || path.join(repo, ".cw", "cache", "source-context"));
+  const contextOut = path.resolve(stringArg(args.contextOut || args["context-out"]) || path.join(repo, ".cw", "context", `${profile}-source.jsonl`));
+  const profileFile = defaultExternalProfile ? writeDefaultRepoProfile(repo, contextOut) : requestedProfileFile;
+  const includeMetrics = truthy(args.metrics);
+  const fastModel = stringArg(args.fastModel || args["fast-model"]);
+  const strongModel = stringArg(args.strongModel || args["strong-model"]);
+  const modelEnv = modelPolicyEnv(fastModel, strongModel);
+
+  const contextExport = timed(() => exportSourceContext({
+    repo,
+    profile,
+    ref,
+    profileFile,
+    cacheDir
+  }));
+  const contextText = contextExport.value;
+  assertNonEmptySourceContext(contextText, profile, repo);
+  fs.mkdirSync(path.dirname(contextOut), { recursive: true });
+  fs.writeFileSync(contextOut, contextText, "utf8");
+  const digest = `sha256:${crypto.createHash("sha256").update(contextText, "utf8").digest("hex")}`;
+
+  const reviewArgs = [
+    "quickstart",
+    "architecture-review-fast",
+    "--repo",
+    repo,
+    "--question",
+    question,
+    "--sourceContext",
+    contextOut,
+    "--sourceContextDigest",
+    digest
+  ];
+  appendRepeated(reviewArgs, "--invariant", args.invariant);
+  appendOption(reviewArgs, "--focus", args.focus);
+  appendPassThrough(reviewArgs, args, [
+    "agent-command",
+    "agentCommand",
+    "agent-endpoint",
+    "agentEndpoint",
+    "agent-model",
+    "agentModel",
+    "agent-timeout-ms",
+    "agentTimeoutMs",
+    "once",
+    "preview",
+    "now"
+  ]);
+
+  const fastReviewRun = timed(() => runCwJson(reviewArgs, repo, modelEnv));
+  const fastReview = fastReviewRun.value;
+  const sourceContextMeta = {
+    path: contextOut,
+    digest,
+    profile,
+    ref,
+    cacheDir
+  };
+  const fullReviewScheduleRun = truthy(args.scheduleFull || args["schedule-full"])
+    ? timed(() => scheduleFullReview(repo, question, args, fastReview, sourceContextMeta))
+    : undefined;
+  const fullReviewSchedule = fullReviewScheduleRun?.value;
+
+  writeJson({
+    schemaVersion: 1,
+    appId: "architecture-review-fast",
+    sourceContext: sourceContextMeta,
+    fastReview,
+    ...(fastModel || strongModel ? { modelPolicy: { ...(fastModel ? { fastModel } : {}), ...(strongModel ? { strongModel } : {}) } } : {}),
+    ...(fullReviewSchedule ? { fullReviewSchedule } : {}),
+    ...(includeMetrics ? { metrics: buildMetrics(started, contextText, contextExport.elapsedMs, fastReview, fastReviewRun.elapsedMs, fullReviewScheduleRun?.elapsedMs) } : {})
+  });
+}
+
+function exportSourceContext(options) {
+  const argv = [
+    sourceContext,
+    "export",
+    "--profile",
+    options.profile,
+    "--ref",
+    options.ref,
+    "--repo-root",
+    options.repo,
+    "--cache-dir",
+    options.cacheDir
+  ];
+  if (options.profileFile) argv.push("--profile-file", path.resolve(options.profileFile));
+  const result = spawnSync(node, argv, {
+    cwd: repoRoot,
+    encoding: "utf8",
+    maxBuffer: 1024 * 1024 * 128
+  });
+  if (result.status !== 0) die(result.stderr || result.stdout || "source context export failed");
+  return result.stdout;
+}
+
+function writeDefaultRepoProfile(repo, contextOut) {
+  const file = path.join(path.dirname(contextOut), "repo-source-profile.json");
+  const profile = {
+    schemaVersion: 1,
+    profiles: {
+      repo: {
+        description: "Default external repository profile for architecture-review-fast.",
+        maxLines: 50000,
+        include: [
+          "README.md",
+          "README.*",
+          "package.json",
+          "tsconfig.json",
+          "pyproject.toml",
+          "Cargo.toml",
+          "go.mod",
+          ".github/**",
+          "src/**",
+          "lib/**",
+          "app/**",
+          "apps/**",
+          "bin/**",
+          "scripts/**",
+          "docs/**",
+          "test/**",
+          "tests/**"
+        ],
+        exclude: [
+          ".cw/**",
+          "dist/**",
+          "build/**",
+          "coverage/**",
+          "node_modules/**",
+          "vendor/**",
+          "target/**",
+          "docs/assets/**",
+          "assets/**",
+          "public/**"
+        ]
+      }
+    }
+  };
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${JSON.stringify(profile, null, 2)}\n`, "utf8");
+  return file;
+}
+
+function assertNonEmptySourceContext(text, profile, repo) {
+  const records = text.trim() ? text.trim().split(/\n/).filter(Boolean).length : 0;
+  if (records > 0) return;
+  die([
+    `source context profile "${profile}" exported zero records for ${repo}`,
+    "pass --profile-file with include rules for this repository, or choose a profile that matches tracked text files"
+  ].join("; "));
+}
+
+function scheduleFullReview(repo, question, args, fastReview, sourceContextMeta) {
+  const delayMinutes = stringArg(args.fullDelayMinutes || args["full-delay-minutes"]) || "1";
+  const prompt = [
+    `Run full architecture-review for ${repo}.`,
+    `Question: ${question}`,
+    args.focus ? `Focus: ${args.focus}` : "",
+    `Fast review run: ${fastReview?.runId || "unknown"}.`,
+    fastReview?.reportPath ? `Fast review report: ${fastReview.reportPath}.` : "",
+    `Fast review status: ${fastReview?.status || "unknown"} (${fastReview?.completedWorkers || 0}/${fastReview?.plannedWorkers || 0} workers completed).`,
+    `Source context: ${sourceContextMeta.path} (${sourceContextMeta.digest}, profile ${sourceContextMeta.profile}, ref ${sourceContextMeta.ref}).`,
+    "Use the completed architecture-review-fast report as the foreground triage result; write the full review report path and digest when the background review finishes."
+  ].filter(Boolean).join(" ");
+  return runCwJson([
+    "schedule",
+    "create",
+    "--cwd",
+    repo,
+    "--kind",
+    "reminder",
+    "--delayMinutes",
+    delayMinutes,
+    "--maxRuns",
+    "1",
+    "--workflowId",
+    "architecture-review",
+    "--prompt",
+    prompt
+  ], repo);
+}
+
+function runCwJson(args, cwd, extraEnv = {}) {
+  const result = spawnSync(node, [cw, ...args], {
+    cwd,
+    encoding: "utf8",
+    env: { ...process.env, ...extraEnv },
+    maxBuffer: 1024 * 1024 * 64
+  });
+  if (result.status !== 0) die(result.stderr || result.stdout || `cw ${args.join(" ")} failed`);
+  try {
+    return JSON.parse(result.stdout);
+  } catch (error) {
+    die(`cw returned non-JSON output: ${error.message}`);
+  }
+}
+
+function parseArgs(argv) {
+  const args = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith("--")) {
+      (args._ ||= []).push(token);
+      continue;
+    }
+    const raw = token.slice(2);
+    const eq = raw.indexOf("=");
+    const key = eq >= 0 ? raw.slice(0, eq) : raw;
+    const value = eq >= 0 ? raw.slice(eq + 1) : argv[index + 1] && !argv[index + 1].startsWith("--") ? argv[++index] : true;
+    if (args[key] === undefined) args[key] = value;
+    else if (Array.isArray(args[key])) args[key].push(value);
+    else args[key] = [args[key], value];
+  }
+  return args;
+}
+
+function appendPassThrough(argv, args, keys) {
+  for (const key of keys) {
+    if (args[key] === undefined) continue;
+    const flag = key.includes("-") ? `--${key}` : `--${key}`;
+    if (args[key] === true) argv.push(flag);
+    else appendRepeated(argv, flag, args[key]);
+  }
+}
+
+function appendRepeated(argv, flag, value) {
+  if (value === undefined || value === false) return;
+  const values = Array.isArray(value) ? value : [value];
+  for (const entry of values) argv.push(flag, String(entry));
+}
+
+function appendOption(argv, flag, value) {
+  if (value === undefined || value === false || value === true || value === "") return;
+  argv.push(flag, String(value));
+}
+
+function required(value, name) {
+  const text = stringArg(value);
+  if (!text) die(`missing required --${name}`);
+  return text;
+}
+
+function stringArg(value) {
+  if (value === undefined || value === null || value === true || value === false) return "";
+  return Array.isArray(value) ? String(value[value.length - 1] || "") : String(value);
+}
+
+function truthy(value) {
+  return value === true || value === "true" || value === "1" || value === "yes";
+}
+
+function modelPolicyEnv(fastModel, strongModel) {
+  return {
+    ...(fastModel ? { CW_ARCHITECTURE_REVIEW_FAST_MODEL: fastModel } : {}),
+    ...(strongModel ? { CW_ARCHITECTURE_REVIEW_STRONG_MODEL: strongModel } : {})
+  };
+}
+
+function nowNs() {
+  return process.hrtime.bigint();
+}
+
+function elapsedMs(started) {
+  return Number((process.hrtime.bigint() - started) / 1000000n);
+}
+
+function timed(fn) {
+  const started = nowNs();
+  const value = fn();
+  return { value, elapsedMs: elapsedMs(started) };
+}
+
+function buildMetrics(started, contextText, sourceContextElapsedMs, fastReview, fastReviewElapsedMs, fullReviewScheduleElapsedMs) {
+  const steps = Array.isArray(fastReview?.steps) ? fastReview.steps : [];
+  const handleKinds = countBy(steps.map((step) => step && step.handleKind).filter(Boolean));
+  const actions = countBy(steps.map((step) => step && step.action).filter(Boolean));
+  return {
+    totalElapsedMs: elapsedMs(started),
+    sourceContext: {
+      elapsedMs: sourceContextElapsedMs,
+      bytes: Buffer.byteLength(contextText, "utf8")
+    },
+    fastReview: {
+      elapsedMs: fastReviewElapsedMs,
+      status: fastReview?.status,
+      plannedWorkers: fastReview?.plannedWorkers,
+      completedWorkers: fastReview?.completedWorkers,
+      steps: steps.length,
+      actions,
+      handleKinds,
+      resultCacheHits: Number(handleKinds["result-cache"] || 0),
+      agentSpawns: steps.filter((step) => step && step.backendId === "agent" && step.handleKind && step.handleKind !== "result-cache").length
+    },
+    ...(fullReviewScheduleElapsedMs === undefined ? {} : { fullReviewSchedule: { elapsedMs: fullReviewScheduleElapsedMs } })
+  };
+}
+
+function countBy(values) {
+  const counts = {};
+  for (const value of values) counts[String(value)] = (counts[String(value)] || 0) + 1;
+  return counts;
+}
+
+function writeJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+
+function usage(code) {
+  process.stderr.write([
+    "usage:",
+    "  node scripts/architecture-review-fast.js --repo PATH --question TEXT [--agent-command CMD]",
+    "",
+    "options:",
+    "  --profile core --ref HEAD --profile-file PATH --cache-dir DIR --context-out PATH",
+    "  --fast-model MODEL --strong-model MODEL",
+    "  --invariant TEXT --focus TEXT --preview --once",
+    "  --schedule-full [--full-delay-minutes N]",
+    "  --metrics"
+  ].join("\n") + "\n");
+  process.exitCode = code;
+}
+
+function die(message) {
+  process.stderr.write(`architecture-review-fast: ${String(message).trim()}\n`);
+  process.exit(1);
+}
+
+main();

package/scripts/bump-version.js

@@ -93,6 +93,7 @@ function main() {
   //    version-sync-check.js asserts.
   const CANONICAL_APPS = [
     "architecture-review",
+    "architecture-review-fast",
     "end-to-end-golden-path",
     "pr-review-fix-ci",
     "release-cut",

package/scripts/canonical-apps.js

@@ -25,6 +25,23 @@ const canonicalApps = [
       "Workflow App framework"
     ]
   },
+  {
+    id: "architecture-review-fast",
+    args: (workspace) => [
+      "--repo",
+      workspace,
+      "--question",
+      "Can a user get a fast architecture answer?",
+      "--invariant",
+      "Full architecture-review remains available",
+      "--focus",
+      "Runtime speed",
+      "--sourceContext",
+      "",
+      "--sourceContextDigest",
+      ""
+    ]
+  },
   {
     id: "pr-review-fix-ci",
     args: (workspace) => [
@@ -65,7 +82,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.1.78",
+      "Cool Workflow v0.1.80",
       "--freshness",
       "as of release preparation"
     ]
@@ -85,14 +102,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.1.78");
+    assert.equal(summary.version, "0.1.80");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.1.78");
+    assert.equal(shown.app.version, "0.1.80");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -103,7 +120,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.1.78");
+    assert.equal(state.workflow.app.version, "0.1.80");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/coverage-gate.js

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+"use strict";
+
+// coverage-gate — run the smoke suite under V8 coverage and fail closed when
+// line coverage of dist/ drops below the floor.
+//
+// Why this exists: nothing measured coverage, so a subsystem could ship dark.
+// It happened: scheduler.ts sat at 12.7% line coverage (only `schedule list`
+// was ever exercised) and no gate noticed. This script makes that class of
+// regression visible and blocking.
+//
+// MECHANISM (this file): spawn test/run-all.js with NODE_V8_COVERAGE set —
+// Node's built-in inspector coverage, inherited by every child process the
+// smokes spawn (CLI invocations, MCP server, workers), so the numbers reflect
+// the real end-to-end surface. Merge the per-process reports byte-wise
+// (covered-by-any-process wins), project onto executable lines of dist/**/*.js,
+// print the worst files, and compare the overall percentage to the floor.
+// node only — no c8, no dependency, same portability constraint as run-all.
+//
+// POLICY (flags/env): the floor. Default 80; override with --min <pct> or
+// CW_COVERAGE_MIN. Raise the default as gaps close — never lower it (ratchet).
+//
+// FAIL CLOSED: a failing suite fails the gate with the suite's exit code; zero
+// coverage reports found fails rather than passing vacuously.
+//
+// Usage: node scripts/coverage-gate.js [--min 80] [--concurrency <n|auto>]
+
+const { spawn } = require("node:child_process");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const SELF = path.basename(__filename);
+const packageDir = path.resolve(__dirname, "..");
+const distDir = path.join(packageDir, "dist");
+
+function flagValue(name) {
+  const args = process.argv.slice(2);
+  const eq = args.find((a) => a.startsWith(`${name}=`));
+  if (eq) return eq.slice(name.length + 1);
+  const i = args.indexOf(name);
+  return i >= 0 ? args[i + 1] : undefined;
+}
+
+const floor = Number(flagValue("--min") ?? process.env.CW_COVERAGE_MIN ?? 80);
+if (!Number.isFinite(floor) || floor < 0 || floor > 100) {
+  process.stderr.write(`${SELF}: invalid coverage floor — expected 0..100.\n`);
+  process.exit(1);
+}
+
+const covDir = fs.mkdtempSync(path.join(os.tmpdir(), "cw-coverage-"));
+
+function runSuite() {
+  return new Promise((resolve) => {
+    const args = [path.join(packageDir, "test", "run-all.js")];
+    const concurrency = flagValue("--concurrency");
+    if (concurrency) args.push("--concurrency", concurrency);
+    const child = spawn(process.execPath, args, {
+      cwd: packageDir,
+      stdio: "inherit",
+      env: { ...process.env, NODE_V8_COVERAGE: covDir }
+    });
+    child.on("close", (code) => resolve(code ?? 1));
+  });
+}
+
+// Merge per-process V8 reports for one file. Within a single process the
+// ranges nest (function range, then narrower uncovered branches), so paint
+// larger ranges first and let nested ranges override. Across processes a byte
+// is covered if ANY process covered it — a count-0 range in one process must
+// not erase another process's hit.
+function paintProcess(functions, length) {
+  const ranges = [];
+  for (const fn of functions || []) for (const range of fn.ranges || []) ranges.push(range);
+  ranges.sort((a, b) => (b.endOffset - b.startOffset) - (a.endOffset - a.startOffset));
+  const view = new Uint8Array(length); // 0 unreported, 1 covered, 2 uncovered
+  for (const range of ranges) {
+    view.fill(range.count > 0 ? 1 : 2, Math.max(0, range.startOffset), Math.min(range.endOffset, length));
+  }
+  return view;
+}
+
+// A line counts as executable unless it is blank, a comment, or a lone closer.
+// Heuristic, but applied uniformly — the ratchet compares like with like.
+function isExecutableLine(line) {
+  const t = line.trim();
+  return (
+    t.length > 0 && !t.startsWith("//") && !t.startsWith("/*") && !t.startsWith("*") &&
+    t !== "}" && t !== "};" && t !== "});"
+  );
+}
+
+function listDistFiles(dir) {
+  const out = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const p = path.join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...listDistFiles(p));
+    else if (entry.name.endsWith(".js")) out.push(p);
+  }
+  return out;
+}
+
+function aggregate() {
+  const reports = fs.readdirSync(covDir).filter((f) => f.endsWith(".json"));
+  if (reports.length === 0) {
+    process.stderr.write(`${SELF}: no V8 coverage reports produced — refusing to pass vacuously.\n`);
+    process.exit(1);
+  }
+  const covered = new Map(); // file -> Uint8Array, 1 = covered by any process
+  const uncovered = new Map(); // file -> Uint8Array, 1 = reported count-0 somewhere
+  const lengths = new Map();
+  for (const report of reports) {
+    let data;
+    try {
+      data = JSON.parse(fs.readFileSync(path.join(covDir, report), "utf8"));
+    } catch {
+      continue; // a process killed mid-write leaves a truncated report
+    }
+    for (const script of data.result || []) {
+      if (!script.url || !script.url.startsWith("file://")) continue;
+      const file = decodeURIComponent(script.url.slice("file://".length));
+      if (!file.startsWith(distDir + path.sep)) continue;
+      let length = lengths.get(file);
+      if (length === undefined) {
+        try {
+          length = fs.readFileSync(file, "utf8").length;
+        } catch {
+          continue;
+        }
+        lengths.set(file, length);
+        covered.set(file, new Uint8Array(length));
+        uncovered.set(file, new Uint8Array(length));
+      }
+      const view = paintProcess(script.functions, length);
+      const coveredBytes = covered.get(file);
+      const uncoveredBytes = uncovered.get(file);
+      for (let i = 0; i < length; i++) {
+        if (view[i] === 1) coveredBytes[i] = 1;
+        else if (view[i] === 2) uncoveredBytes[i] = 1;
+      }
+    }
+  }
+
+  const rows = [];
+  for (const file of listDistFiles(distDir)) {
+    const source = fs.readFileSync(file, "utf8");
+    const length = source.length;
+    const coveredBytes = covered.get(file) || new Uint8Array(length);
+    const uncoveredBytes = uncovered.get(file) || new Uint8Array(length);
+    const loaded = lengths.has(file);
+    let offset = 0;
+    let total = 0;
+    let hit = 0;
+    for (const line of source.split("\n")) {
+      if (isExecutableLine(line)) {
+        total += 1;
+        let lineCovered = false;
+        let lineReported = false;
+        for (let i = offset; i < offset + line.length; i++) {
+          if (coveredBytes[i]) {
+            lineCovered = true;
+            break;
+          }
+          if (uncoveredBytes[i]) lineReported = true;
+        }
+        // Unreported bytes in a loaded file are top-level code that ran at
+        // require time; in a never-loaded file nothing ran.
+        if (lineCovered || (loaded && !lineReported)) hit += 1;
+      }
+      offset += line.length + 1;
+    }
+    rows.push({ file: path.relative(distDir, file), total, hit, loaded });
+  }
+  return rows;
+}
+
+(async () => {
+  const suiteExit = await runSuite();
+  if (suiteExit !== 0) {
+    process.stderr.write(`${SELF}: smoke suite failed (exit ${suiteExit}) — coverage not evaluated.\n`);
+    process.exit(suiteExit);
+  }
+  const rows = aggregate();
+  let total = 0;
+  let hit = 0;
+  for (const row of rows) {
+    total += row.total;
+    hit += row.hit;
+  }
+  const overall = total ? (100 * hit) / total : 0;
+
+  rows.sort((a, b) => a.hit / Math.max(1, a.total) - b.hit / Math.max(1, b.total));
+  process.stdout.write(`\n${SELF}: line coverage of dist/ under the full smoke suite\n`);
+  process.stdout.write("  lowest-covered files:\n");
+  // Type-only modules compile to a 2-line "use strict" stub that is never
+  // require()d; they count toward the overall number but would bury the
+  // actionable entries in this list.
+  const actionable = rows.filter((row) => row.total > 5);
+  for (const row of actionable.slice(0, 10)) {
+    const pct = ((100 * row.hit) / Math.max(1, row.total)).toFixed(1).padStart(5);
+    process.stdout.write(`    ${pct}%  ${String(row.hit).padStart(5)}/${String(row.total).padEnd(5)} ${row.file}${row.loaded ? "" : "  (never loaded)"}\n`);
+  }
+  process.stdout.write(`  OVERALL: ${hit}/${total} executable lines = ${overall.toFixed(1)}% (floor ${floor}%)\n`);
+
+  fs.rmSync(covDir, { recursive: true, force: true });
+  if (overall < floor) {
+    process.stderr.write(`${SELF}: FAIL — overall coverage ${overall.toFixed(1)}% is below the ${floor}% floor.\n`);
+    process.exit(1);
+  }
+  process.stdout.write(`${SELF}: PASS — coverage holds the ${floor}% floor.\n`);
+})();

package/scripts/dogfood-release.js

@@ -5,7 +5,7 @@ const { spawnSync } = require("node:child_process");
 const fs = require("node:fs");
 const path = require("node:path");
 
-const TARGET_VERSION = "0.1.78";
+const TARGET_VERSION = "0.1.80";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");

package/scripts/golden-path.js

@@ -33,7 +33,7 @@ function main() {
     const appValidation = runJson(["app", "validate", "end-to-end-golden-path"], pluginRoot);
     assert.equal(appValidation.valid, true);
     assert.equal(appValidation.summary.id, "end-to-end-golden-path");
-    assert.equal(appValidation.summary.version, "0.1.78");
+    assert.equal(appValidation.summary.version, "0.1.80");
 
     const plan = runJson(
       [
@@ -42,7 +42,7 @@ function main() {
         "--repo",
         tmp,
         "--question",
-        "Prove the deterministic v0.1.78 end-to-end golden path."
+        "Prove the deterministic v0.1.80 end-to-end golden path."
       ],
       pluginRoot
     );
@@ -52,7 +52,7 @@ function main() {
 
     let state = readJson(plan.statePath);
     assert.equal(state.workflow.app.id, "end-to-end-golden-path");
-    assert.equal(state.workflow.app.version, "0.1.78");
+    assert.equal(state.workflow.app.version, "0.1.80");
     assert.equal(state.loopStage, "interpret");
 
     const dispatch = runJson(["dispatch", plan.runId, "--limit", "1", "--sandbox", "readonly"], tmp);
@@ -195,7 +195,7 @@ function main() {
     assert.equal(reportPath, plan.reportPath);
     assert.ok(fs.existsSync(reportPath));
     const report = fs.readFileSync(reportPath, "utf8");
-    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.78/);
+    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.80/);
     assert.match(report, /## Candidates/);
     assert.match(report, /## Trust Audit/);
     assert.match(report, /## Acceptance Rationale/);