cool-workflow 0.1.79 → 0.1.80

package/scripts/agents/claude-p-agent.js

@@ -5,27 +5,30 @@
 //
 // This is a CONFIG, NOT a CW dependency: CW spawns it out-of-process (argv-style,
 // shell:false, cwd = the target repo) and records its attested output; the model
-// runs in claude's process, never in CW. Node port of claude-p-agent.sh (which now
-// delegates here) so the documented onboarding path is portable (node-only repo
-// convention, Windows included).
+// runs in claude's process, never in CW.
 //
 // It fulfills ONE worker: read the worker's input.md ({{input}}), delegate the
 // analysis to headless claude READ-ONLY, persist claude's final markdown to the
-// worker's result.md ({{result}}), and forward claude's JSON (model + usage) on
-// stdout so CW records the agent-REPORTED model and token usage as provenance.
+// worker's result.md ({{result}}), and forward claude's JSON on STDOUT so CW
+// records the agent-reported provenance.
 //
-// READ-ONLY by design: claude gets NO Write tool. The architecture-review app
-// declares the `readonly` sandbox profile — the agent must not touch the repo.
-// This wrapper (the transport) writes the single result.md artifact itself, so
-// the worker completes WITHOUT granting the model file-write access.
+// LIVE OUTPUT (Unix discipline): default output is the legacy `--output-format
+// json` contract, forwarded verbatim on stdout. Set CW_AGENT_STREAM=1 to opt in
+// to claude `stream-json`; only then does this wrapper render a human-readable
+// trace to stderr, and only when stderr is a TTY. Diagnostics stay off stdout,
+// and vendor-specific stream parsing lives HERE in the wrapper (policy), not in
+// CW's core (which only forwards, never parses).
 //
-// Point CW at it (from plugins/cool-workflow/):
+// READ-ONLY by design: claude gets NO Write tool; the architecture-review app
+// declares the `readonly` sandbox profile. This wrapper (the transport) writes
+// the single result.md artifact itself, so the worker completes without granting
+// the model file-write access.
+//
+// Point CW at it (from plugins/cool-workflow/), or use the `builtin:claude` alias:
 //   CW_AGENT_COMMAND="node $(pwd)/scripts/agents/claude-p-agent.js {{input}} {{result}}"
-// or per-invocation:
-//   --agent-command "node $(pwd)/scripts/agents/claude-p-agent.js {{input}} {{result}}"
 
 const fs = require("node:fs");
-const { spawnSync } = require("node:child_process");
+const { spawn, spawnSync } = require("node:child_process");
 
 const inputPath = process.argv[2];
 const resultPath = process.argv[3];
@@ -63,42 +66,125 @@ HARD RULES (the result is REJECTED otherwise):
 - "classification", if present, MUST be one of: real, conditional, non-issue, unknown.
 - Any finding with "severity" P0, P1, or P2 MUST include a NON-EMPTY "evidence" array.
 - The top-level "evidence" array MUST be NON-EMPTY with REAL file:line locators from this repo.
-- If you have no structured findings, use "findings": [] (empty) — never omit a finding's id.
-`;
+- If you have no structured findings, use "findings": [] (empty) — never omit a finding's id.`;
 
 const prompt = `${fs.readFileSync(inputPath, "utf8")}\n${CONTRACT}`;
+const streamEnabled = process.env.CW_AGENT_STREAM === "1" && process.env.CW_NO_STREAM !== "1";
+const traceEnabled = streamEnabled && Boolean(process.stderr.isTTY);
 
-// Read-only analysis: NO Write tool, so claude cannot touch the repo. This wrapper
-// (the transport) persists claude's final markdown to the worker's result.md.
-// --output-format json so CW can read the agent-REPORTED model + usage from stdout
-// (the attested model; CW never uses CW_AGENT_MODEL as the attested model).
-const child = spawnSync("claude", ["-p", prompt, "--output-format", "json", "--allowedTools", "Read,Grep,Glob,Bash"], {
-  encoding: "utf8",
-  maxBuffer: 32 * 1024 * 1024,
-  shell: false
-});
-if (child.error) {
-  process.stderr.write(`claude spawn failed: ${child.error.message}\n`);
-  process.exit(1);
+if (!streamEnabled) {
+  // Legacy default: --output-format json and verbatim stdout forwarding. This is
+  // the public wrapper contract existing users already scripted against.
+  const child = spawnSync("claude", ["-p", prompt, "--output-format", "json", "--allowedTools", "Read,Grep,Glob,Bash"], {
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024,
+    shell: false
+  });
+  if (child.error) {
+    process.stderr.write(`claude spawn failed: ${child.error.message}\n`);
+    process.exit(1);
+  }
+  if (child.status !== 0) {
+    process.stderr.write(String(child.stderr || `claude exited ${child.status}`));
+    process.exit(child.status === null ? 1 : child.status);
+  }
+
+  const out = String(child.stdout || "");
+  let parsed;
+  try {
+    parsed = JSON.parse(out);
+  } catch (error) {
+    process.stderr.write(`claude output was not JSON: ${error.message}\n`);
+    process.exit(1);
+  }
+
+  fs.writeFileSync(resultPath, String(parsed.result || ""), "utf8");
+  process.stdout.write(out);
+  process.exit(0);
 }
-if (child.status !== 0) {
-  process.stderr.write(String(child.stderr || `claude exited ${child.status}`));
-  process.exit(child.status === null ? 1 : child.status);
+
+// Live trace → stderr only. Concise; one line per meaningful event.
+function trace(line) {
+  if (!traceEnabled) return;
+  process.stderr.write(`${line}\n`);
+}
+function shortInput(tool, input) {
+  if (!input || typeof input !== "object") return "";
+  const v = input.file_path || input.path || input.pattern || input.command || input.query || input.url || "";
+  const s = String(v).replace(/\s+/g, " ").trim();
+  return s ? ` ${s.length > 80 ? s.slice(0, 77) + "…" : s}` : "";
 }
 
-const out = String(child.stdout || "");
-let parsed;
-try {
-  parsed = JSON.parse(out);
-} catch (error) {
-  // Fail closed: no parsable agent JSON ⇒ no result.md ⇒ CW records a failed hop.
-  process.stderr.write(`claude output was not JSON: ${error.message}\n`);
-  process.exit(1);
+// stream-json so claude emits incremental NDJSON events we can render live, while
+// we reconstruct the single {model, usage, result} object CW consumes on stdout.
+const child = spawn(
+  "claude",
+  ["-p", prompt, "--output-format", "stream-json", "--verbose", "--allowedTools", "Read,Grep,Glob,Bash"],
+  { stdio: ["ignore", "pipe", "inherit"] } // claude's own stderr → straight through
+);
+
+let model;
+let usage;
+let resultText;
+let buf = "";
+
+trace("● claude: reading the repo (read-only)…");
+
+child.stdout.setEncoding("utf8");
+child.stdout.on("data", (chunk) => {
+  buf += chunk;
+  let nl;
+  while ((nl = buf.indexOf("\n")) >= 0) {
+    const line = buf.slice(0, nl).trim();
+    buf = buf.slice(nl + 1);
+    if (!line) continue;
+    let ev;
+    try {
+      ev = JSON.parse(line);
+    } catch {
+      continue; // not a complete JSON line; ignore (defensive)
+    }
+    renderEvent(ev);
+  }
+});
+
+function renderEvent(ev) {
+  if (ev.type === "assistant" && ev.message) {
+    if (!model && typeof ev.message.model === "string") model = ev.message.model;
+    for (const part of ev.message.content || []) {
+      if (part.type === "text" && part.text && part.text.trim()) {
+        trace(`  ${part.text.trim().replace(/\n+/g, "\n  ")}`);
+      } else if (part.type === "tool_use") {
+        trace(`  → ${part.name}${shortInput(part.name, part.input)}`);
+      }
+    }
+  } else if (ev.type === "system" && ev.subtype === "post_turn_summary" && ev.status_detail) {
+    trace(`  · ${ev.status_detail}`);
+  } else if (ev.type === "result") {
+    if (typeof ev.result === "string") resultText = ev.result;
+    if (ev.usage && typeof ev.usage === "object") usage = ev.usage;
+    if (ev.is_error) trace("  ✗ claude reported an error result");
+  }
 }
 
-// Persist the AGENT's final markdown to the worker's result.md for CW's separate
-// acceptance layer. CW is only the transport; the content is the agent's.
-fs.writeFileSync(resultPath, String(parsed.result || ""), "utf8");
+child.on("error", (err) => {
+  process.stderr.write(`claude spawn failed: ${err.message}\n`);
+  process.exit(1);
+});
 
-// Hand the agent's JSON (model + usage + result) back to CW on stdout.
-process.stdout.write(out);
+child.on("close", (code) => {
+  if (code !== 0) {
+    process.stderr.write(`claude exited ${code === null ? "(timeout/killed)" : code}\n`);
+    process.exit(code === null ? 1 : code);
+  }
+  if (typeof resultText !== "string") {
+    // Fail closed: no result event ⇒ no result.md ⇒ CW records a failed hop.
+    process.stderr.write("claude produced no result event — refusing to fabricate a result\n");
+    process.exit(1);
+  }
+  // Persist the AGENT's final markdown to the worker's result.md (CW is transport).
+  fs.writeFileSync(resultPath, resultText, "utf8");
+  trace("● done — result captured");
+  // The single JSON CW consumes on STDOUT (data channel): model + usage + result.
+  process.stdout.write(JSON.stringify({ model, usage, result: resultText }));
+});

package/scripts/architecture-review-fast.js

@@ -0,0 +1,362 @@
+#!/usr/bin/env node
+"use strict";
+
+// architecture-review-fast — userland accelerator wrapper.
+//
+// Mechanism only: prepare one cached JSONL source context, pass its digest into
+// the opt-in fast app, then optionally create a background schedule for the full
+// architecture-review app. The model still runs only through CW's external agent
+// backend; this script imports no model SDK and holds no key.
+
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+const pluginRoot = path.resolve(__dirname, "..");
+const repoRoot = path.resolve(pluginRoot, "..", "..");
+const node = process.execPath;
+const cw = path.join(pluginRoot, "scripts", "cw.js");
+const sourceContext = path.join(pluginRoot, "scripts", "source-context.js");
+
+function main() {
+  const started = nowNs();
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) return usage(0);
+
+  const repo = path.resolve(required(args.repo, "repo"));
+  const question = required(args.question, "question");
+  const requestedProfile = stringArg(args.profile);
+  const ref = stringArg(args.ref) || "HEAD";
+  const requestedProfileFile = stringArg(args.profileFile || args["profile-file"]);
+  const defaultExternalProfile = !requestedProfile && !requestedProfileFile && repo !== repoRoot;
+  const profile = defaultExternalProfile ? "repo" : requestedProfile || "core";
+  const cacheDir = path.resolve(stringArg(args.cacheDir || args["cache-dir"]) || path.join(repo, ".cw", "cache", "source-context"));
+  const contextOut = path.resolve(stringArg(args.contextOut || args["context-out"]) || path.join(repo, ".cw", "context", `${profile}-source.jsonl`));
+  const profileFile = defaultExternalProfile ? writeDefaultRepoProfile(repo, contextOut) : requestedProfileFile;
+  const includeMetrics = truthy(args.metrics);
+  const fastModel = stringArg(args.fastModel || args["fast-model"]);
+  const strongModel = stringArg(args.strongModel || args["strong-model"]);
+  const modelEnv = modelPolicyEnv(fastModel, strongModel);
+
+  const contextExport = timed(() => exportSourceContext({
+    repo,
+    profile,
+    ref,
+    profileFile,
+    cacheDir
+  }));
+  const contextText = contextExport.value;
+  assertNonEmptySourceContext(contextText, profile, repo);
+  fs.mkdirSync(path.dirname(contextOut), { recursive: true });
+  fs.writeFileSync(contextOut, contextText, "utf8");
+  const digest = `sha256:${crypto.createHash("sha256").update(contextText, "utf8").digest("hex")}`;
+
+  const reviewArgs = [
+    "quickstart",
+    "architecture-review-fast",
+    "--repo",
+    repo,
+    "--question",
+    question,
+    "--sourceContext",
+    contextOut,
+    "--sourceContextDigest",
+    digest
+  ];
+  appendRepeated(reviewArgs, "--invariant", args.invariant);
+  appendOption(reviewArgs, "--focus", args.focus);
+  appendPassThrough(reviewArgs, args, [
+    "agent-command",
+    "agentCommand",
+    "agent-endpoint",
+    "agentEndpoint",
+    "agent-model",
+    "agentModel",
+    "agent-timeout-ms",
+    "agentTimeoutMs",
+    "once",
+    "preview",
+    "now"
+  ]);
+
+  const fastReviewRun = timed(() => runCwJson(reviewArgs, repo, modelEnv));
+  const fastReview = fastReviewRun.value;
+  const sourceContextMeta = {
+    path: contextOut,
+    digest,
+    profile,
+    ref,
+    cacheDir
+  };
+  const fullReviewScheduleRun = truthy(args.scheduleFull || args["schedule-full"])
+    ? timed(() => scheduleFullReview(repo, question, args, fastReview, sourceContextMeta))
+    : undefined;
+  const fullReviewSchedule = fullReviewScheduleRun?.value;
+
+  writeJson({
+    schemaVersion: 1,
+    appId: "architecture-review-fast",
+    sourceContext: sourceContextMeta,
+    fastReview,
+    ...(fastModel || strongModel ? { modelPolicy: { ...(fastModel ? { fastModel } : {}), ...(strongModel ? { strongModel } : {}) } } : {}),
+    ...(fullReviewSchedule ? { fullReviewSchedule } : {}),
+    ...(includeMetrics ? { metrics: buildMetrics(started, contextText, contextExport.elapsedMs, fastReview, fastReviewRun.elapsedMs, fullReviewScheduleRun?.elapsedMs) } : {})
+  });
+}
+
+function exportSourceContext(options) {
+  const argv = [
+    sourceContext,
+    "export",
+    "--profile",
+    options.profile,
+    "--ref",
+    options.ref,
+    "--repo-root",
+    options.repo,
+    "--cache-dir",
+    options.cacheDir
+  ];
+  if (options.profileFile) argv.push("--profile-file", path.resolve(options.profileFile));
+  const result = spawnSync(node, argv, {
+    cwd: repoRoot,
+    encoding: "utf8",
+    maxBuffer: 1024 * 1024 * 128
+  });
+  if (result.status !== 0) die(result.stderr || result.stdout || "source context export failed");
+  return result.stdout;
+}
+
+function writeDefaultRepoProfile(repo, contextOut) {
+  const file = path.join(path.dirname(contextOut), "repo-source-profile.json");
+  const profile = {
+    schemaVersion: 1,
+    profiles: {
+      repo: {
+        description: "Default external repository profile for architecture-review-fast.",
+        maxLines: 50000,
+        include: [
+          "README.md",
+          "README.*",
+          "package.json",
+          "tsconfig.json",
+          "pyproject.toml",
+          "Cargo.toml",
+          "go.mod",
+          ".github/**",
+          "src/**",
+          "lib/**",
+          "app/**",
+          "apps/**",
+          "bin/**",
+          "scripts/**",
+          "docs/**",
+          "test/**",
+          "tests/**"
+        ],
+        exclude: [
+          ".cw/**",
+          "dist/**",
+          "build/**",
+          "coverage/**",
+          "node_modules/**",
+          "vendor/**",
+          "target/**",
+          "docs/assets/**",
+          "assets/**",
+          "public/**"
+        ]
+      }
+    }
+  };
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${JSON.stringify(profile, null, 2)}\n`, "utf8");
+  return file;
+}
+
+function assertNonEmptySourceContext(text, profile, repo) {
+  const records = text.trim() ? text.trim().split(/\n/).filter(Boolean).length : 0;
+  if (records > 0) return;
+  die([
+    `source context profile "${profile}" exported zero records for ${repo}`,
+    "pass --profile-file with include rules for this repository, or choose a profile that matches tracked text files"
+  ].join("; "));
+}
+
+function scheduleFullReview(repo, question, args, fastReview, sourceContextMeta) {
+  const delayMinutes = stringArg(args.fullDelayMinutes || args["full-delay-minutes"]) || "1";
+  const prompt = [
+    `Run full architecture-review for ${repo}.`,
+    `Question: ${question}`,
+    args.focus ? `Focus: ${args.focus}` : "",
+    `Fast review run: ${fastReview?.runId || "unknown"}.`,
+    fastReview?.reportPath ? `Fast review report: ${fastReview.reportPath}.` : "",
+    `Fast review status: ${fastReview?.status || "unknown"} (${fastReview?.completedWorkers || 0}/${fastReview?.plannedWorkers || 0} workers completed).`,
+    `Source context: ${sourceContextMeta.path} (${sourceContextMeta.digest}, profile ${sourceContextMeta.profile}, ref ${sourceContextMeta.ref}).`,
+    "Use the completed architecture-review-fast report as the foreground triage result; write the full review report path and digest when the background review finishes."
+  ].filter(Boolean).join(" ");
+  return runCwJson([
+    "schedule",
+    "create",
+    "--cwd",
+    repo,
+    "--kind",
+    "reminder",
+    "--delayMinutes",
+    delayMinutes,
+    "--maxRuns",
+    "1",
+    "--workflowId",
+    "architecture-review",
+    "--prompt",
+    prompt
+  ], repo);
+}
+
+function runCwJson(args, cwd, extraEnv = {}) {
+  const result = spawnSync(node, [cw, ...args], {
+    cwd,
+    encoding: "utf8",
+    env: { ...process.env, ...extraEnv },
+    maxBuffer: 1024 * 1024 * 64
+  });
+  if (result.status !== 0) die(result.stderr || result.stdout || `cw ${args.join(" ")} failed`);
+  try {
+    return JSON.parse(result.stdout);
+  } catch (error) {
+    die(`cw returned non-JSON output: ${error.message}`);
+  }
+}
+
+function parseArgs(argv) {
+  const args = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith("--")) {
+      (args._ ||= []).push(token);
+      continue;
+    }
+    const raw = token.slice(2);
+    const eq = raw.indexOf("=");
+    const key = eq >= 0 ? raw.slice(0, eq) : raw;
+    const value = eq >= 0 ? raw.slice(eq + 1) : argv[index + 1] && !argv[index + 1].startsWith("--") ? argv[++index] : true;
+    if (args[key] === undefined) args[key] = value;
+    else if (Array.isArray(args[key])) args[key].push(value);
+    else args[key] = [args[key], value];
+  }
+  return args;
+}
+
+function appendPassThrough(argv, args, keys) {
+  for (const key of keys) {
+    if (args[key] === undefined) continue;
+    const flag = key.includes("-") ? `--${key}` : `--${key}`;
+    if (args[key] === true) argv.push(flag);
+    else appendRepeated(argv, flag, args[key]);
+  }
+}
+
+function appendRepeated(argv, flag, value) {
+  if (value === undefined || value === false) return;
+  const values = Array.isArray(value) ? value : [value];
+  for (const entry of values) argv.push(flag, String(entry));
+}
+
+function appendOption(argv, flag, value) {
+  if (value === undefined || value === false || value === true || value === "") return;
+  argv.push(flag, String(value));
+}
+
+function required(value, name) {
+  const text = stringArg(value);
+  if (!text) die(`missing required --${name}`);
+  return text;
+}
+
+function stringArg(value) {
+  if (value === undefined || value === null || value === true || value === false) return "";
+  return Array.isArray(value) ? String(value[value.length - 1] || "") : String(value);
+}
+
+function truthy(value) {
+  return value === true || value === "true" || value === "1" || value === "yes";
+}
+
+function modelPolicyEnv(fastModel, strongModel) {
+  return {
+    ...(fastModel ? { CW_ARCHITECTURE_REVIEW_FAST_MODEL: fastModel } : {}),
+    ...(strongModel ? { CW_ARCHITECTURE_REVIEW_STRONG_MODEL: strongModel } : {})
+  };
+}
+
+function nowNs() {
+  return process.hrtime.bigint();
+}
+
+function elapsedMs(started) {
+  return Number((process.hrtime.bigint() - started) / 1000000n);
+}
+
+function timed(fn) {
+  const started = nowNs();
+  const value = fn();
+  return { value, elapsedMs: elapsedMs(started) };
+}
+
+function buildMetrics(started, contextText, sourceContextElapsedMs, fastReview, fastReviewElapsedMs, fullReviewScheduleElapsedMs) {
+  const steps = Array.isArray(fastReview?.steps) ? fastReview.steps : [];
+  const handleKinds = countBy(steps.map((step) => step && step.handleKind).filter(Boolean));
+  const actions = countBy(steps.map((step) => step && step.action).filter(Boolean));
+  return {
+    totalElapsedMs: elapsedMs(started),
+    sourceContext: {
+      elapsedMs: sourceContextElapsedMs,
+      bytes: Buffer.byteLength(contextText, "utf8")
+    },
+    fastReview: {
+      elapsedMs: fastReviewElapsedMs,
+      status: fastReview?.status,
+      plannedWorkers: fastReview?.plannedWorkers,
+      completedWorkers: fastReview?.completedWorkers,
+      steps: steps.length,
+      actions,
+      handleKinds,
+      resultCacheHits: Number(handleKinds["result-cache"] || 0),
+      agentSpawns: steps.filter((step) => step && step.backendId === "agent" && step.handleKind && step.handleKind !== "result-cache").length
+    },
+    ...(fullReviewScheduleElapsedMs === undefined ? {} : { fullReviewSchedule: { elapsedMs: fullReviewScheduleElapsedMs } })
+  };
+}
+
+function countBy(values) {
+  const counts = {};
+  for (const value of values) counts[String(value)] = (counts[String(value)] || 0) + 1;
+  return counts;
+}
+
+function writeJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+
+function usage(code) {
+  process.stderr.write([
+    "usage:",
+    "  node scripts/architecture-review-fast.js --repo PATH --question TEXT [--agent-command CMD]",
+    "",
+    "options:",
+    "  --profile core --ref HEAD --profile-file PATH --cache-dir DIR --context-out PATH",
+    "  --fast-model MODEL --strong-model MODEL",
+    "  --invariant TEXT --focus TEXT --preview --once",
+    "  --schedule-full [--full-delay-minutes N]",
+    "  --metrics"
+  ].join("\n") + "\n");
+  process.exitCode = code;
+}
+
+function die(message) {
+  process.stderr.write(`architecture-review-fast: ${String(message).trim()}\n`);
+  process.exit(1);
+}
+
+main();

package/scripts/bump-version.js

@@ -93,6 +93,7 @@ function main() {
   //    version-sync-check.js asserts.
   const CANONICAL_APPS = [
     "architecture-review",
+    "architecture-review-fast",
     "end-to-end-golden-path",
     "pr-review-fix-ci",
     "release-cut",

package/scripts/canonical-apps.js

@@ -25,6 +25,23 @@ const canonicalApps = [
       "Workflow App framework"
     ]
   },
+  {
+    id: "architecture-review-fast",
+    args: (workspace) => [
+      "--repo",
+      workspace,
+      "--question",
+      "Can a user get a fast architecture answer?",
+      "--invariant",
+      "Full architecture-review remains available",
+      "--focus",
+      "Runtime speed",
+      "--sourceContext",
+      "",
+      "--sourceContextDigest",
+      ""
+    ]
+  },
   {
     id: "pr-review-fix-ci",
     args: (workspace) => [
@@ -65,7 +82,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.1.79",
+      "Cool Workflow v0.1.80",
       "--freshness",
       "as of release preparation"
     ]
@@ -85,14 +102,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.1.79");
+    assert.equal(summary.version, "0.1.80");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.1.79");
+    assert.equal(shown.app.version, "0.1.80");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -103,7 +120,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.1.79");
+    assert.equal(state.workflow.app.version, "0.1.80");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);