cool-workflow 0.1.84 → 0.1.85

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cool-workflow",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
-  "version": "0.1.84",
+  "version": "0.1.85",
   "author": {
     "name": "COOLWHITE LLC"
   },

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.84",
+  "version": "0.1.85",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
   "author": {
     "name": "COOLWHITE LLC"

package/README.md

@@ -710,3 +710,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 This release removes local user path text from saved release review input and adds a scan that keeps those words out of tracked files.
+
+v0.1.85

package/apps/architecture-review/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review",
   "title": "Architecture Review",
   "summary": "Map a repository architecture, assess risks, verify important findings, and synthesize an evidence-backed verdict.",
-  "version": "0.1.84",
+  "version": "0.1.85",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/architecture-review-fast/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review-fast",
   "title": "Architecture Review Fast",
   "summary": "Run a shorter architecture review with parallel map and assess phases for faster first results.",
-  "version": "0.1.84",
+  "version": "0.1.85",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/end-to-end-golden-path/app.json

@@ -3,7 +3,7 @@
   "id": "end-to-end-golden-path",
   "title": "End-to-End Golden Path",
   "summary": "Deterministic one-worker workflow app for proving the CW integration chain.",
-  "version": "0.1.84",
+  "version": "0.1.85",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/pr-review-fix-ci/app.json

@@ -3,7 +3,7 @@
   "id": "pr-review-fix-ci",
   "title": "PR Review Fix CI",
   "summary": "Review a pull request or branch, inspect CI failures, diagnose actionable issues, optionally patch, verify, and summarize with evidence.",
-  "version": "0.1.84",
+  "version": "0.1.85",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/release-cut/app.json

@@ -3,7 +3,7 @@
   "id": "release-cut",
   "title": "Release Cut",
   "summary": "Prepare a release with checklist discipline: version checks, changelog, tests, packaging, release notes, and final verification.",
-  "version": "0.1.84",
+  "version": "0.1.85",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/research-synthesis/app.json

@@ -3,7 +3,7 @@
   "id": "research-synthesis",
   "title": "Research Synthesis",
   "summary": "Split a research question into claims, investigate sources, cross-check evidence, verify claims, and synthesize a concise answer.",
-  "version": "0.1.84",
+  "version": "0.1.85",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/dist/capability-core.js

@@ -40,6 +40,8 @@ exports.runExportArchive = runExportArchive;
 exports.runImportArchive = runImportArchive;
 exports.runInspectArchive = runInspectArchive;
 exports.runVerifyImport = runVerifyImport;
+exports.reportBundle = reportBundle;
+exports.runVerifyReportBundle = runVerifyReportBundle;
 exports.queueAdd = queueAdd;
 exports.queueList = queueList;
 exports.queueDrain = queueDrain;
@@ -69,6 +71,7 @@ exports.isRecord = isRecord;
 exports.telemetryVerify = telemetryVerify;
 exports.auditVerify = auditVerify;
 exports.demoTamper = demoTamper;
+exports.demoBundle = demoBundle;
 const drive_1 = require("./drive");
 const agent_config_1 = require("./agent-config");
 const run_registry_1 = require("./run-registry");
@@ -277,7 +280,11 @@ function runRerun(reg, runId, args) {
 function runExportArchive(runner, runId, args) {
     const base = invocationCwd(args);
     const output = optionalString(args.output || args.path || args.archive) || `${runId}.cwrun.json`;
-    return (0, run_export_1.exportRun)(runner.withBaseDir(optionalString(args.cwd)).loadRun(runId), node_path_1.default.resolve(base, output));
+    // Optionally seal in the operator's PUBLIC trust key so the bundle re-verifies
+    // offline. Default falls back to the same env the verify gate reads, so a single
+    // configured key both attests at record-time and travels with the export.
+    const trustPublicKey = optionalString(args["with-trust-key"] || args.withTrustKey || args.trustKey || args.pubkey) || process.env.CW_AGENT_ATTEST_PUBKEY;
+    return (0, run_export_1.exportRun)(runner.withBaseDir(optionalString(args.cwd)).loadRun(runId), node_path_1.default.resolve(base, output), { trustPublicKey });
 }
 function runImportArchive(runner, args) {
     const base = invocationCwd(args);
@@ -303,6 +310,48 @@ function runInspectArchive(_runner, args) {
 function runVerifyImport(runner, runId, args) {
     return (0, run_export_1.verifyImportedRun)(runner.withBaseDir(optionalString(args.cwd)).loadRun(runId));
 }
+// Produce-and-prove: export a run to a portable bundle sealed with the operator's
+// trust key (defaulting to CW_AGENT_ATTEST_PUBKEY, same as `run export`), then
+// IMMEDIATELY verify the artifact offline the way a recipient will. The producer
+// learns now — fail-closed — whether the bundle a client will check is actually
+// verifiable (e.g. an unconfigured attest key yields an unverifiable bundle). Pure
+// composition of runExportArchive + verifyReportBundle; spawns nothing, writes only
+// the archive (and, with --extract-report, the human report) that `run export` would.
+function reportBundle(runner, runId, args) {
+    const exported = runExportArchive(runner, runId, args);
+    const base = invocationCwd(args);
+    const extractReportTo = optionalString(args["extract-report"] || args.extractReport || args.extractReportTo);
+    const verification = (0, run_export_1.verifyReportBundle)(exported.path, {
+        pubkey: optionalString(args.pubkey || args.pubKey || args.publicKey),
+        extractReportTo: extractReportTo ? node_path_1.default.resolve(base, extractReportTo) : undefined,
+        strictSignatures: Boolean(args["strict-signatures"] || args.strictSignatures || args.strictSigs)
+    });
+    return {
+        schemaVersion: 1,
+        runId,
+        archivePath: exported.path,
+        trustKeyEmbedded: exported.trustKeyEmbedded,
+        reportExtractedTo: verification.reportExtractedTo,
+        verification,
+        ok: verification.ok
+    };
+}
+// Read-only: verify a portable run bundle OFFLINE and self-contained (archive bytes
+// + telemetry chain + trust-audit chain + embedded-key signatures). The runner is
+// unused — verification restores into its own throwaway tmpdir and writes nothing to
+// any registry — but kept for dispatch-signature symmetry with the other run verbs.
+function runVerifyReportBundle(_runner, args) {
+    const base = invocationCwd(args);
+    const archive = optionalString(args.archive || args.path || args.file || args.bundle);
+    if (!archive)
+        throw new Error("report verify-bundle requires a bundle path (positional, --archive, --path, --file, or --bundle)");
+    const extractReportTo = optionalString(args["extract-report"] || args.extractReport || args.extractReportTo);
+    return (0, run_export_1.verifyReportBundle)(node_path_1.default.resolve(base, archive), {
+        pubkey: optionalString(args.pubkey || args.pubKey || args.publicKey),
+        extractReportTo: extractReportTo ? node_path_1.default.resolve(base, extractReportTo) : undefined,
+        strictSignatures: Boolean(args["strict-signatures"] || args.strictSignatures || args.strictSigs)
+    });
+}
 function queueAdd(reg, args) {
     return reg.queueAdd({
         runId: optionalString(args.runId),
@@ -534,6 +583,33 @@ function quickstart(runner, args) {
     const runRepoCwd = node_path_1.default.resolve(node_path_1.default.dirname(result.statePath), "..", "..", "..");
     const reportTarget = node_fs_1.default.existsSync(runRepoCwd) ? runRepoCwd : undefined;
     const reportPath = runner.withBaseDir(reportTarget).report(result.runId).path;
+    // --bundle: after a COMPLETE drive, seal the run into a portable, self-verified
+    // bundle so the one command yields a client-verifiable artifact. Pure composition
+    // of reportBundle() (export sealed + offline self-verify); spawns nothing. Gated on
+    // completion: a partial or blocked run is NEVER sealed (you must not ship an
+    // uncommitted artifact).
+    //
+    // Run-state resolution MUST anchor to the run's OWN repo (reportTarget): the README
+    // headline runs quickstart cross-directory (caller cwd != --repo), so a caller-cwd
+    // loadRun would not find the run. But operator-supplied OUTPUT paths
+    // (--output/--extract-report) and the default archive name resolve against the
+    // CALLER's cwd — so artifacts land where the operator ran the command (and `&&
+    // send out.md` works) and never pollute the analyzed repo's working tree, matching
+    // standalone `report bundle`. Pre-resolving to absolute makes path.resolve(base, …)
+    // inside reportBundle a no-op, so the run-repo cwd cannot reclaim them.
+    let bundle;
+    const wantsBundle = flag(args.bundle) === true;
+    if (wantsBundle && result.status === "complete") {
+        const callerBase = invocationCwd(args);
+        const outArg = optionalString(args.output || args.path || args.archive);
+        const extractArg = optionalString(args["extract-report"] || args.extractReport || args.extractReportTo);
+        bundle = reportBundle(runner, result.runId, {
+            ...args,
+            cwd: reportTarget,
+            output: node_path_1.default.resolve(callerBase, outArg || `${result.runId}.cwrun.json`),
+            ...(extractArg ? { "extract-report": node_path_1.default.resolve(callerBase, extractArg) } : {})
+        });
+    }
     let hint;
     if (!agentConfigured) {
         hint =
@@ -550,6 +626,11 @@ function quickstart(runner, args) {
             ? `one step advanced — continue: cw quickstart ${appId} --run ${result.runId} --resume`
             : `one step advanced (--once) — continue: cw quickstart ${appId} --run ${result.runId} --once`;
     }
+    // --bundle on a run that didn't complete is a NO-OP, not silence: tell the operator
+    // why nothing was sealed (Rule of Silence permits a human-facing hint).
+    if (wantsBundle && result.status !== "complete") {
+        hint = `${hint ? `${hint} ` : ""}--bundle skipped: the run did not complete (status=${result.status}); no bundle was sealed.`;
+    }
     return {
         schemaVersion: 1,
         appId,
@@ -568,7 +649,10 @@ function quickstart(runner, args) {
         // Stamp resumedFrom ONLY when we continued an explicit run. Conditional spread
         // keeps the key absent on the default/fresh path (own-property absent + omitted
         // by JSON.stringify), so default output is byte-identical.
-        ...(resumeRunId ? { resumedFrom: resumeRunId } : {})
+        ...(resumeRunId ? { resumedFrom: resumeRunId } : {}),
+        // Same conditional-spread discipline: `bundle` is present only when --bundle ran
+        // on a completed drive, so the default (no --bundle) payload is byte-identical.
+        ...(bundle ? { bundle } : {})
     };
 }
 /** Read-only, deterministic projection of the effective agent config (secret-stripped). */
@@ -763,3 +847,6 @@ function auditVerify(runner, args) {
 function demoTamper(_runner, _args = {}) {
     return (0, telemetry_demo_1.runTamperDemo)();
 }
+function demoBundle(_runner, _args = {}) {
+    return (0, telemetry_demo_1.runBundleDemo)();
+}

package/dist/capability-registry.js

@@ -345,15 +345,17 @@ const BUILTIN_CAPABILITIES = [
     { capability: "run.import", summary: "Restore a portable run archive into a target repo and verify restored file digests.", entry: "runImportArchive", surface: "both", cli: { path: ["run", "import"], jsonMode: "default" }, mcp: { tool: "cw_run_import", requiredArgs: ["archive|path|file"] } },
     { capability: "run.verify-import", summary: "Verify an imported run against its restore manifest and telemetry chain.", entry: "runVerifyImport", surface: "both", cli: { path: ["run", "verify-import"], jsonMode: "default" }, mcp: { tool: "cw_run_verify_import", requiredArgs: ["runId"] } },
     { capability: "run.inspect-archive", summary: "Read-only integrity inspection of a portable run archive without importing it.", entry: "runInspectArchive", surface: "both", cli: { path: ["run", "inspect-archive"], jsonMode: "default" }, mcp: { tool: "cw_run_inspect_archive", requiredArgs: ["archive|path|file"] } },
+    { capability: "report.verify-bundle", summary: "Offline self-contained verify of a portable run bundle: archive bytes + telemetry chain + trust-audit chain + embedded-key signatures.", entry: "runVerifyReportBundle", surface: "both", cli: { path: ["report", "verify-bundle"], caseTokens: ["report"], jsonMode: "default" }, mcp: { tool: "cw_report_verify_bundle", requiredArgs: ["archive|path|file|bundle"] } },
+    { capability: "report.bundle", summary: "Produce-and-prove: export a run to a portable bundle sealed with the trust key, then self-verify it offline (fail-closed) so the producer knows it is verifiable before shipping.", entry: "reportBundle", surface: "both", cli: { path: ["report", "bundle"], caseTokens: ["report"], jsonMode: "default" }, mcp: { tool: "cw_report_bundle", requiredArgs: ["runId"] } },
     { capability: "run.drive", summary: "Preview the next agent-delegation drive step for a run (read-only, deterministic).", entry: "runDrivePreview", surface: "both", cli: { path: ["run", "drive"], caseTokens: ["run", "drive"], jsonMode: "default" }, mcp: { tool: "cw_run_drive" } },
     { capability: "run.drive.step", summary: "Drive a run by delegating each worker to the agent backend (plan->dispatch->fulfill->accept->commit; --once for one step).", entry: "runDrive", surface: "both", cli: { path: ["run", "drive"], caseTokens: ["run", "drive"], jsonMode: "default" }, mcp: { tool: "cw_run_drive_step" }, payloadIdentical: false, reason: "Mutating: advances the run by spawning the external agent per worker and recording attested output — not a read probe. CLI (--drive/--step) and MCP route through the same drive() core." },
     {
         capability: "quickstart",
-        summary: "ONE-COMMAND quickstart: plan(app, default architecture-review) -> run --drive -> report in a single invocation (--preview for a read-only dry run).",
+        summary: "ONE-COMMAND quickstart: plan(app, default architecture-review) -> run --drive -> report in a single invocation (--preview for a read-only dry run; --bundle [--with-trust-key K] seals a completed run into a self-verified portable bundle).",
         entry: "quickstart",
         surface: "cli-only",
         cli: { path: ["quickstart"], caseTokens: ["quickstart", "audit-run"], jsonMode: "default" },
-        reason: "CLI UX convenience layer (newcomer first value in one command) over the existing run.drive.step + report verbs; it spawns nothing new and delegates worker execution to the operator's agent backend. MCP hosts compose the same outcome from cw_run_drive_step + cw_report. `audit-run` is a CLI-only alias of the same wrapper."
+        reason: "CLI UX convenience layer (newcomer first value in one command) over the existing run.drive.step + report verbs; it spawns nothing new and delegates worker execution to the operator's agent backend. MCP hosts compose the same outcome from cw_run_drive_step + cw_report (+ cw_report_bundle for --bundle). `audit-run` is a CLI-only alias of the same wrapper."
     },
     { capability: "queue.add", summary: "Enqueue a pending/planned run with explicit ordering policy.", entry: "runRegistry.queueAdd", surface: "both", cli: { path: ["queue", "add"], jsonMode: "default" }, mcp: { tool: "cw_queue_add" } },
     { capability: "queue.list", summary: "List the durable run queue in policy order.", entry: "runRegistry.queueList", surface: "both", cli: { path: ["queue", "list"], jsonMode: "flag" }, mcp: { tool: "cw_queue_list" } },
@@ -377,6 +379,7 @@ const BUILTIN_CAPABILITIES = [
     { capability: "gc.verify", summary: "Re-prove a reclaimed run: skeleton-complete, tombstone chain untampered, artifacts reconstructable.", entry: "gcVerify", surface: "both", cli: { path: ["gc", "verify"], caseTokens: ["gc", "verify"], jsonMode: "flag" }, mcp: { tool: "cw_gc_verify", requiredArgs: ["runId"] } },
     { capability: "telemetry.verify", summary: "Re-prove a run's telemetry attestation ledger offline: chain linkage + independent hash recompute, and (with --pubkey / CW_AGENT_ATTEST_PUBKEY) re-verify each attested hop's ed25519 signature against the public key.", entry: "telemetryVerify", surface: "both", cli: { path: ["telemetry", "verify"], caseTokens: ["telemetry"], jsonMode: "flag" }, mcp: { tool: "cw_telemetry_verify", requiredArgs: ["runId"] } },
     { capability: "demo.tamper", summary: "Prove tamper-evidence: build a signed telemetry ledger, forge it, watch verification fail offline.", entry: "demoTamper", surface: "cli-only", cli: { path: ["demo", "tamper"], caseTokens: ["demo", "tamper"], jsonMode: "flag" }, reason: "Human-facing demonstration (operator/newcomer onboarding); the underlying integrity check is exposed programmatically as the both-surface telemetry.verify. No agent or MCP client needs to invoke a demo." },
+    { capability: "demo.bundle", summary: "Prove portable-bundle verification: export a sealed report bundle, forge it two ways, watch report verify-bundle catch both offline with only the embedded public key.", entry: "demoBundle", surface: "cli-only", cli: { path: ["demo", "bundle"], caseTokens: ["demo", "bundle"], jsonMode: "flag" }, reason: "Human-facing demonstration (operator/newcomer onboarding); the underlying integrity check is exposed programmatically as the both-surface report.verify-bundle. No agent or MCP client needs to invoke a demo." },
     { capability: "history", summary: "Read a cross-repo unified run timeline (newest first).", entry: "runRegistry.history", surface: "both", cli: { path: ["history"], jsonMode: "flag" }, mcp: { tool: "cw_history" } },
     // ---- web / desktop workbench (v0.1.30) ----------------------------------
     // A THIRD FRONT DOOR — a read-only renderer, not a new brain. Both verbs route
@@ -589,6 +592,8 @@ const PAYLOAD_PROBE_DEFERRED_GROUPS = [
             "run.import",
             "run.verify-import",
             "run.inspect-archive",
+            "report.verify-bundle",
+            "report.bundle",
             "queue.add",
             "queue.list",
             "queue.drain",

package/dist/cli/command-surface.js

@@ -91,7 +91,14 @@ async function runCli(argv = process.argv.slice(2)) {
             // fails closed (status=blocked) when none is set. No new executor/scheduler.
             const [appId] = args.positionals;
             const runId = optionalArg(args.options.run) || optionalArg(args.options.runId);
-            printJson((0, capability_core_1.quickstart)(runner, { ...args.options, ...(appId ? { appId } : {}), ...(runId ? { runId } : {}) }));
+            const qs = (0, capability_core_1.quickstart)(runner, { ...args.options, ...(appId ? { appId } : {}), ...(runId ? { runId } : {}) });
+            printJson(qs);
+            // Fail closed: if --bundle produced an artifact that does not self-verify, exit
+            // non-zero so `cw quickstart ... --bundle && send-to-client` cannot ship a report
+            // whose bundle a client could not verify. Mirrors `report bundle`.
+            if (qs.bundle && qs.bundle.ok === false) {
+                process.exitCode = 1;
+            }
             return;
         }
         case "plan": {
@@ -151,6 +158,29 @@ async function runCli(argv = process.argv.slice(2)) {
             printJson(runner.commit(required(args.positionals[0], "run id"), args.options));
             return;
         case "report": {
+            // `report verify-bundle <path>` is the offline self-contained bundle verifier;
+            // `report bundle <run-id>` exports a sealed bundle and self-verifies it;
+            // every other `report <run-id>` form prints/inspects a local run's report.
+            if (args.positionals[0] === "verify-bundle") {
+                const result = (0, capability_core_1.runVerifyReportBundle)(runner, { ...args.options, archive: args.positionals[1] || args.options.archive || args.options.path || args.options.file || args.options.bundle });
+                printJson(result);
+                // Fail closed: a forged/edited/corrupt bundle verifies false — surface it
+                // through the exit code so `cw report verify-bundle <file> && ship` cannot
+                // pass on a lie. Mirrors run inspect-archive / telemetry verify.
+                if (!result.ok)
+                    process.exitCode = 1;
+                return;
+            }
+            if (args.positionals[0] === "bundle") {
+                const result = (0, capability_core_1.reportBundle)(runner, required(args.positionals[1] || optionalArg(args.options.runId || args.options.run), "run id"), args.options);
+                printJson(result);
+                // Fail closed: never report a "bundle made" success if the artifact does not
+                // self-verify — so `cw report bundle <run> && send-to-client` cannot ship an
+                // unverifiable report (e.g. no trust key under --strict-signatures).
+                if (!result.ok)
+                    process.exitCode = 1;
+                return;
+            }
             const runId = required(args.positionals[0], "run id");
             const report = runner.report(runId);
             if (wantsJson(args.options)) {
@@ -1250,8 +1280,20 @@ async function runCli(argv = process.argv.slice(2)) {
                         process.exitCode = 1;
                     return;
                 }
+                case "bundle": {
+                    const result = (0, capability_core_1.demoBundle)(runner, args.options);
+                    if (wantsJson(args.options))
+                        printJson(result);
+                    else
+                        process.stdout.write(`${(0, telemetry_demo_1.formatBundleDemo)(result)}\n`);
+                    // Fail closed: a forged bundle that verified would be a regression in the
+                    // bundle guarantee — exit nonzero so the demo can never green it.
+                    if (!result.proven)
+                        process.exitCode = 1;
+                    return;
+                }
                 default:
-                    throw new Error("Usage: cw.js demo tamper [--json]");
+                    throw new Error("Usage: cw.js demo tamper|bundle [--json]");
             }
         }
         case "workbench": {

package/dist/mcp-surface.js

@@ -365,6 +365,10 @@ function callTool(name, args) {
                 return (0, capability_core_1.runVerifyImport)(runner, String(args.runId || ""), args);
             case "cw_run_inspect_archive":
                 return (0, capability_core_1.runInspectArchive)(runner, args);
+            case "cw_report_verify_bundle":
+                return (0, capability_core_1.runVerifyReportBundle)(runner, args);
+            case "cw_report_bundle":
+                return (0, capability_core_1.reportBundle)(runner, String(args.runId || ""), args);
             case "cw_run_drive":
                 return (0, capability_core_1.runDrivePreview)(runner, args);
             case "cw_run_drive_step":
@@ -1251,7 +1255,9 @@ function toolDefinitions() {
             cwd: stringSchema("Repo workspace containing .cw/runs/<run-id>"),
             output: stringSchema("Archive output path"),
             path: stringSchema("Alias for output"),
-            archive: stringSchema("Alias for output")
+            archive: stringSchema("Alias for output"),
+            trustKey: stringSchema("Optional ed25519 PUBLIC key (inline PEM or path) to embed so the bundle re-verifies offline; defaults to CW_AGENT_ATTEST_PUBKEY"),
+            withTrustKey: stringSchema("Alias for trustKey")
         }),
         capabilityTool("run.import", "Restore a portable run archive into a target repo and immediately verify restored file digests.", {
             archive: stringSchema("Archive path"),
@@ -1271,6 +1277,26 @@ function toolDefinitions() {
             file: stringSchema("Alias for archive"),
             cwd: stringSchema("Invocation workspace")
         }),
+        capabilityTool("report.verify-bundle", "Offline, self-contained verify of a portable run bundle: proves the archive bytes, the telemetry hash chain, the trust-audit chain, and (with the bundle's embedded public key) the ed25519 signatures — no source repo, no pre-existing .cw tree, no out-of-band key. Restores into a throwaway tmpdir and writes nothing. A forged or edited bundle fails it. Peer of `cw report verify-bundle`.", {
+            archive: stringSchema("Bundle (.cwrun.json) path"),
+            path: stringSchema("Alias for archive"),
+            file: stringSchema("Alias for archive"),
+            bundle: stringSchema("Alias for archive"),
+            pubkey: stringSchema("Optional public key (inline PEM or path); used only when the bundle embeds no trust key"),
+            extractReport: stringSchema("Optional path to write the bundle's report.md to"),
+            strictSignatures: booleanSchema("Fail when the bundle claims attested telemetry but no key is available to re-verify it"),
+            cwd: stringSchema("Invocation workspace")
+        }),
+        capabilityTool("report.bundle", "Produce-and-prove: export a run to a portable bundle sealed with the operator's ed25519 public key (defaults to CW_AGENT_ATTEST_PUBKEY), then immediately self-verify it offline the way a recipient will. Fail-closed: the producer learns now whether the artifact is verifiable before shipping it. Peer of `cw report bundle`.", {
+            runId: stringSchema("Run id to bundle"),
+            cwd: stringSchema("Repo workspace containing .cw/runs/<run-id>"),
+            output: stringSchema("Bundle output path"),
+            path: stringSchema("Alias for output"),
+            trustKey: stringSchema("Optional ed25519 PUBLIC key (inline PEM or path) to seal; defaults to CW_AGENT_ATTEST_PUBKEY"),
+            withTrustKey: stringSchema("Alias for trustKey"),
+            extractReport: stringSchema("Optional path to also write the human-readable report.md to"),
+            strictSignatures: booleanSchema("Refuse to call the bundle ok if attested telemetry cannot be re-verified (no key)")
+        }),
         capabilityTool("run.drive", "Preview the next agent-delegation drive step for a run (read-only, deterministic). Counts come from state; no spawn, no mutation.", {
             runId: stringSchema("Run id to preview"),
             cwd: stringSchema("Run workspace")

package/dist/run-export.js

@@ -16,19 +16,26 @@ exports.importRun = importRun;
 exports.verifyImportedRun = verifyImportedRun;
 exports.inspectArchive = inspectArchive;
 exports.importManifestPath = importManifestPath;
+exports.verifyReportBundle = verifyReportBundle;
 const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const state_1 = require("./state");
 const version_1 = require("./version");
 const telemetry_ledger_1 = require("./telemetry-ledger");
+const telemetry_attestation_1 = require("./telemetry-attestation");
 const trust_audit_1 = require("./trust-audit");
 const compare_1 = require("./compare");
 /** Export a run to a portable JSON archive with run-local bytes and digests. */
-function exportRun(run, outputPath) {
+function exportRun(run, outputPath, options = {}) {
     const exportedAt = new Date().toISOString();
     const files = collectArchiveFiles(run);
     const manifestSha256 = digestManifest(files);
+    // Embed ONLY a public key. resolveTrustPublicKey normalizes an inline PEM or a
+    // file path down to inline PEM bytes so the archive is self-contained; a value
+    // that resolves to nothing (bad path) yields no trust block rather than a throw.
+    const trustPublicKeyPem = (0, telemetry_attestation_1.resolveTrustPublicKey)(options.trustPublicKey);
     const exported = {
         schemaVersion: 1,
         exportedAt,
@@ -39,6 +46,7 @@ function exportRun(run, outputPath) {
             fileCount: files.length,
             manifestSha256
         },
+        ...(trustPublicKeyPem ? { trust: { publicKeyPem: trustPublicKeyPem, algorithm: "ed25519" } } : {}),
         // Legacy field retained so old readers still find an artifact-ish list.
         artifacts: files
             .filter((file) => file.role === "artifact")
@@ -62,6 +70,7 @@ function exportRun(run, outputPath) {
         artifactCount: files.filter((file) => file.role === "artifact").length,
         auditFileCount: files.filter((file) => file.role === "audit").length,
         telemetryIncluded: files.some((file) => file.role === "telemetry"),
+        trustKeyEmbedded: Boolean(trustPublicKeyPem),
         manifestSha256,
         archiveSha256
     };
@@ -276,6 +285,135 @@ function inspectArchive(archivePath) {
 function importManifestPath(run) {
     return node_path_1.default.join(run.paths.runDir, "import-manifest.json");
 }
+/** Verify a portable run bundle OFFLINE and SELF-CONTAINED: prove the archive bytes,
+ *  the telemetry hash chain, the trust-audit chain, and (with the bundle's embedded
+ *  public key) the ed25519 signatures — WITHOUT a source repo, a pre-existing .cw
+ *  tree, or an out-of-band key. Reuses the existing import + restore-verify path: it
+ *  restores into an auto-cleaned tmpdir so a stranger's machine is left untouched.
+ *  Never throws — every failure is a structured check and a false `ok` (exit-1 worthy).
+ *
+ *  Key precedence is bundle > argument > environment, so the artifact verifies the
+ *  same on any machine; only when the bundle omits a key do the override/env apply. */
+function verifyReportBundle(archivePath, options = {}) {
+    const inspect = inspectArchive(archivePath);
+    const failedChecks = inspect.checks
+        .filter((check) => !check.pass)
+        .map((check) => ({ name: check.name, code: check.code }));
+    const base = {
+        schemaVersion: 1,
+        archivePath,
+        runId: inspect.runId,
+        ok: false,
+        archiveOk: inspect.ok,
+        telemetryVerified: false,
+        trustAuditVerified: false,
+        trustKeySource: "none",
+        signatureKeyProvided: false,
+        signaturesChecked: 0,
+        signaturesReverified: 0,
+        signaturesFailed: 0,
+        failedChecks
+    };
+    // A bundle that is not even a supported archive cannot be restored — report the
+    // inspection failure and stop (fail-closed, no tmpdir, nothing written).
+    if (!inspect.schemaSupported)
+        return base;
+    // Read the embedded trust key (and, if requested, the report bytes) straight from
+    // the archive JSON. inspectArchive already proved the bytes parse + digest-match.
+    let bundleKey;
+    let reportContent;
+    try {
+        const raw = JSON.parse(node_fs_1.default.readFileSync(archivePath, "utf8"));
+        bundleKey = raw.trust?.publicKeyPem;
+        if (options.extractReportTo) {
+            const reportFile = (raw.files || []).find((file) => file.relativePath === "report.md");
+            if (reportFile)
+                reportContent = Buffer.from(reportFile.contentBase64, "base64").toString("utf8");
+        }
+    }
+    catch {
+        /* inspect already recorded the parse failure; treat key as absent */
+    }
+    const trustKeySource = bundleKey
+        ? "bundle"
+        : options.pubkey
+            ? "argument"
+            : process.env.CW_AGENT_ATTEST_PUBKEY
+                ? "environment"
+                : "none";
+    const trustKey = (0, telemetry_attestation_1.resolveTrustPublicKey)(bundleKey || options.pubkey || process.env.CW_AGENT_ATTEST_PUBKEY);
+    const tmpDir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), "cw-verify-bundle-"));
+    let telemetryVerified = false;
+    let trustAuditVerified = false;
+    let signaturesChecked = 0;
+    let signaturesReverified = 0;
+    let signaturesFailed = 0;
+    let reportExtractedTo;
+    try {
+        // Restore into the throwaway tree. importRun digest-checks every file and throws
+        // on the first mismatch (or on a stripped integrity block under
+        // CW_REQUIRE_ARCHIVE_INTEGRITY=1) — caught below as a failed "restore" check.
+        const imported = importRun(archivePath, tmpDir);
+        for (const check of imported.verification.checks) {
+            if (check.name === "telemetry-ledger")
+                telemetryVerified = check.pass;
+            if (check.name === "trust-audit")
+                trustAuditVerified = check.pass;
+            if (!check.pass)
+                failedChecks.push({ name: check.name, code: check.code });
+        }
+        // Independent ed25519 re-verification over the restored ledger using the bundle's
+        // own key (or override/env). With no key, attested records degrade to
+        // informational (signaturesFailed stays 0); the chain check above still gates ok.
+        const ledger = (0, telemetry_ledger_1.verifyTelemetryLedger)(imported.run);
+        const sig = (0, telemetry_attestation_1.verifyTelemetrySignatures)(ledger.records, trustKey);
+        signaturesChecked = sig.checked;
+        signaturesReverified = sig.reverified;
+        signaturesFailed = sig.failed;
+        for (const check of sig.checks)
+            if (!check.pass)
+                failedChecks.push({ name: check.name, code: check.code });
+        if (options.extractReportTo && reportContent !== undefined) {
+            reportExtractedTo = node_path_1.default.resolve(options.extractReportTo);
+            node_fs_1.default.writeFileSync(reportExtractedTo, reportContent);
+        }
+    }
+    catch (error) {
+        failedChecks.push({ name: "restore", code: messageOf(error) });
+    }
+    finally {
+        node_fs_1.default.rmSync(tmpDir, { recursive: true, force: true });
+    }
+    // Strict mode: a bundle that claims attested telemetry but offers no key to check
+    // it is unverifiable — refuse rather than green it.
+    const strictShortfall = Boolean(options.strictSignatures) && signaturesChecked > 0 && !trustKey;
+    if (strictShortfall)
+        failedChecks.push({ name: "signatures", code: "signature-key-required" });
+    // Extraction was requested but could not be fulfilled (no report.md in the bundle,
+    // or the write failed): fail closed rather than silently green a missing artifact —
+    // otherwise `report bundle <run> --extract-report r.md && send r.md` would ship
+    // nothing (or a stale file) with exit 0. A requested-but-absent output is a failure,
+    // not a no-op (distinct from extraction never being requested).
+    const extractShortfall = Boolean(options.extractReportTo) && !reportExtractedTo;
+    if (extractShortfall)
+        failedChecks.push({ name: "extract-report", code: "report-md-unavailable" });
+    return {
+        schemaVersion: 1,
+        archivePath,
+        runId: inspect.runId,
+        ok: inspect.ok && telemetryVerified && trustAuditVerified && signaturesFailed === 0 && !strictShortfall && !extractShortfall,
+        archiveOk: inspect.ok,
+        telemetryVerified,
+        trustAuditVerified,
+        trustKeySource,
+        signatureKeyProvided: Boolean(trustKey),
+        signaturesChecked,
+        signaturesReverified,
+        signaturesFailed,
+        reportExtractedTo,
+        failedChecks
+    };
+}
 function collectArchiveFiles(run) {
     const entries = new Map();
     for (const file of walkFiles(run.paths.runDir)) {