cool-workflow 0.1.84 → 0.1.85

package/dist/telemetry-demo.js

@@ -22,12 +22,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.formatTelemetryVerify = formatTelemetryVerify;
 exports.formatTamperDemo = formatTamperDemo;
 exports.runTamperDemo = runTamperDemo;
+exports.runBundleDemo = runBundleDemo;
+exports.formatBundleDemo = formatBundleDemo;
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const telemetry_ledger_1 = require("./telemetry-ledger");
 const telemetry_attestation_1 = require("./telemetry-attestation");
+const run_export_1 = require("./run-export");
+const state_1 = require("./state");
 const execution_backend_1 = require("./execution-backend");
 /** Human-facing render of `telemetry verify <run>`. */
 function formatTelemetryVerify(r) {
@@ -164,3 +168,118 @@ function runTamperDemo(options = {}) {
         layers.every((l) => l.before.verified && !l.after.verified && l.failures.length > 0);
     return { schemaVersion: 1, runId, workers: HOPS.length, trustKey: "ephemeral-ed25519", baseline, layers, proven };
 }
+function runBundleDemo(options = {}) {
+    const workdir = options.dir || node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), "cw-bundle-demo-"));
+    node_fs_1.default.mkdirSync(workdir, { recursive: true });
+    const runId = "demo-bundle-run";
+    const runDir = node_path_1.default.join(workdir, ".cw", "runs", runId);
+    const paths = (0, state_1.createRunPaths)(runDir);
+    (0, state_1.ensureRunDirs)(paths);
+    const { publicKey, privateKey } = node_crypto_1.default.generateKeyPairSync("ed25519");
+    const publicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
+    const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+    // Build a real signed ledger + a cited report, the way an attested run would.
+    const ledgerRun = { id: runId, paths };
+    for (const hop of HOPS) {
+        const ctx = { runId, taskId: hop.taskId, promptDigest: hop.promptDigest };
+        (0, telemetry_ledger_1.appendTelemetryAttestation)(ledgerRun, {
+            workerId: hop.workerId,
+            taskId: hop.taskId,
+            promptDigest: hop.promptDigest,
+            reportedUsage: hop.usage,
+            usageSignature: hop.attestation === "attested" ? (0, telemetry_attestation_1.signTelemetry)(hop.usage, privateKeyPem, ctx) : undefined,
+            attestation: hop.attestation,
+            now: DEMO_NOW
+        });
+    }
+    node_fs_1.default.writeFileSync(node_path_1.default.join(runDir, "report.md"), "# Architecture review\n\nRisk: src/server.js:18 — unauthenticated route.\n", "utf8");
+    const attestedCount = HOPS.filter((h) => h.attestation === "attested").length;
+    const fullRun = {
+        schemaVersion: 1, id: runId, createdAt: DEMO_NOW, updatedAt: DEMO_NOW, cwd: workdir,
+        workflow: { id: "demo", title: "Demo", summary: "", limits: { maxAgents: 1, maxConcurrentAgents: 1 } },
+        inputs: { question: "what are the risks?" }, loopStage: "interpret",
+        phases: [], tasks: [], dispatches: [], commits: [], paths, nodes: [], contracts: []
+    };
+    (0, state_1.saveCheckpoint)(fullRun);
+    const ledgerFile = (0, telemetry_ledger_1.telemetryLedgerPath)(ledgerRun);
+    const cleanLedger = node_fs_1.default.readFileSync(ledgerFile, "utf8");
+    const exportSealed = (out) => { (0, run_export_1.exportRun)(fullRun, out, { trustPublicKey: publicKeyPem }); };
+    // Baseline: a clean sealed bundle verifies offline; the embedded key reverifies
+    // every signed hop.
+    const cleanBundle = node_path_1.default.join(workdir, "clean.cwrun.json");
+    exportSealed(cleanBundle);
+    const clean = (0, run_export_1.verifyReportBundle)(cleanBundle);
+    const baseline = { ok: clean.ok, telemetryVerified: clean.telemetryVerified, signaturesReverified: clean.signaturesReverified };
+    const layers = [];
+    // CHAIN forgery: flip record[1]'s verdict and reseal its recordHash; record[2]'s
+    // prevHash still points at the original hash, so the chain breaks — even though
+    // every archive file digest (computed at export over the tampered bytes) is valid.
+    // This is exactly what inspect-archive alone cannot catch.
+    {
+        const j = JSON.parse(cleanLedger);
+        j.records[1].attestation = "attested";
+        const { recordHash: _drop, ...rest } = j.records[1];
+        j.records[1].recordHash = (0, telemetry_ledger_1.computeRecordHash)(rest);
+        node_fs_1.default.writeFileSync(ledgerFile, JSON.stringify(j, null, 2));
+        const forged = node_path_1.default.join(workdir, "forged-chain.cwrun.json");
+        exportSealed(forged);
+        const after = (0, run_export_1.verifyReportBundle)(forged);
+        node_fs_1.default.writeFileSync(ledgerFile, cleanLedger);
+        layers.push({
+            layer: "chain",
+            tamper: `forged record[1] verdict "unattested" -> "attested" and resealed its recordHash; the archive's own file digests stay valid`,
+            before: { ok: clean.ok, detail: `${clean.signaturesReverified} signed hop(s) reverify; chain intact` },
+            after: { ok: after.ok, detail: after.telemetryVerified ? "telemetry chain still verified (UNDETECTED!)" : "the embedded hash chain broke at the next record" },
+            failures: after.ok ? [] : after.failedChecks.map((c) => `${c.name}: ${c.code}`)
+        });
+    }
+    // SIGNATURE forgery: inflate the last attested hop's reported tokens and reseal its
+    // usage digest + recordHash so the chain AND archive digests still verify; only the
+    // ed25519 signature (over the original usage) no longer matches the inflated number.
+    {
+        const j = JSON.parse(cleanLedger);
+        const idx = j.records.length - 1;
+        j.records[idx].reportedUsage = { ...j.records[idx].reportedUsage, output_tokens: j.records[idx].reportedUsage.output_tokens * 10 };
+        j.records[idx].reportedUsageDigest = (0, telemetry_ledger_1.reportedUsageDigest)(j.records[idx].reportedUsage);
+        const { recordHash: _drop, ...rest } = j.records[idx];
+        j.records[idx].recordHash = (0, telemetry_ledger_1.computeRecordHash)(rest);
+        node_fs_1.default.writeFileSync(ledgerFile, JSON.stringify(j, null, 2));
+        const forged = node_path_1.default.join(workdir, "forged-sig.cwrun.json");
+        exportSealed(forged);
+        const after = (0, run_export_1.verifyReportBundle)(forged);
+        node_fs_1.default.writeFileSync(ledgerFile, cleanLedger);
+        layers.push({
+            layer: "signature",
+            tamper: `inflated the last attested hop's output_tokens 10x and resealed its digest + recordHash; the chain stays valid`,
+            before: { ok: clean.ok, detail: `the embedded public key reverifies the original signature` },
+            after: { ok: after.ok, detail: after.signaturesFailed > 0 ? `${after.signaturesFailed} signature(s) failed ed25519 reverify` : "signature still verified (UNDETECTED!)" },
+            failures: after.ok ? [] : after.failedChecks.map((c) => `${c.name}: ${c.code}`)
+        });
+    }
+    if (!options.keepDir && !options.dir)
+        node_fs_1.default.rmSync(workdir, { recursive: true, force: true });
+    const proven = baseline.ok &&
+        baseline.telemetryVerified &&
+        baseline.signaturesReverified === attestedCount &&
+        layers.every((l) => l.before.ok && !l.after.ok && l.failures.length > 0);
+    return { schemaVersion: 1, runId, workers: HOPS.length, trustKey: "ephemeral-ed25519", baseline, layers, proven };
+}
+function formatBundleDemo(r) {
+    const lines = [];
+    lines.push(`cw demo bundle — portable-bundle verification proof (hermetic, ${r.trustKey} key)`);
+    lines.push("");
+    lines.push(`▶ Exported a sealed report bundle: ${r.workers} hops, public key embedded`);
+    lines.push(`  ${r.baseline.ok ? "✓" : "✗"} bundle verifies offline   ${r.baseline.signaturesReverified} signed hop(s) reverify with only the embedded public key`);
+    for (const l of r.layers) {
+        lines.push("");
+        lines.push(`▶ ${l.layer.toUpperCase()} forgery`);
+        lines.push(`  edit:   ${l.tamper}`);
+        lines.push(`  before: ${l.before.ok ? "✓ verifies" : "✗"} — ${l.before.detail}`);
+        lines.push(`  after:  ${l.after.ok ? "✓ (UNDETECTED!)" : "✗ DETECTED"} — ${l.after.detail}`);
+    }
+    lines.push("");
+    lines.push(r.proven
+        ? "VERDICT: bundle verification holds ✓ — every forgery caught offline with only the bundle's embedded public key. No repo, no server, no key handed over."
+        : "VERDICT: PROOF FAILED ✗ — a forged bundle verified. This is a regression in the bundle guarantee.");
+    return lines.join("\n");
+}

package/dist/types/report-bundle.js

@@ -0,0 +1,6 @@
+"use strict";
+// Verifiable report bundle — result shapes shared across the run-export verifier,
+// the capability-core producer (reportBundle), and the quickstart auto-bundle field
+// on QuickstartResult. Kept in types/ (a leaf) so types/drive.ts can reference
+// ReportBundleResult without a types->core import cycle.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/types.js

@@ -28,6 +28,7 @@ __exportStar(require("./types/sandbox"), exports);
 __exportStar(require("./types/execution-backend"), exports);
 __exportStar(require("./types/boundary"), exports);
 __exportStar(require("./types/drive"), exports);
+__exportStar(require("./types/report-bundle"), exports);
 __exportStar(require("./types/multi-agent"), exports);
 __exportStar(require("./types/topology"), exports);
 __exportStar(require("./types/blackboard"), exports);

package/dist/version.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MIN_SUPPORTED_RUN_STATE_SCHEMA_VERSION = exports.LEGACY_RUN_STATE_SCHEMA_VERSION = exports.CURRENT_RUN_STATE_SCHEMA_VERSION = exports.WORKFLOW_APP_SCHEMA_VERSION = exports.CURRENT_COOL_WORKFLOW_VERSION = void 0;
-exports.CURRENT_COOL_WORKFLOW_VERSION = "0.1.84";
+exports.CURRENT_COOL_WORKFLOW_VERSION = "0.1.85";
 exports.WORKFLOW_APP_SCHEMA_VERSION = 1;
 exports.CURRENT_RUN_STATE_SCHEMA_VERSION = 1;
 exports.LEGACY_RUN_STATE_SCHEMA_VERSION = 0;

package/docs/agent-delegation-drive.7.md

@@ -270,3 +270,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/cli-mcp-parity.7.md

@@ -72,7 +72,7 @@ relationship. `identical` means `cw <cmd> --json` is equal to the `cw_<tool>`
 payload; `projected` means a declared divergence with a reason; `cli-only` marks
 a surface-specific capability with a recorded reason. The matrix is
 <!-- gen:parity:count -->
-machine-complete by design: 190 capabilities, 184 MCP tools.
+machine-complete by design: 193 capabilities, 186 MCP tools.
 <!-- /gen:parity:count -->
 
 <!-- gen:parity:table -->
@@ -236,6 +236,8 @@ machine-complete by design: 190 capabilities, 184 MCP tools.
 | `run.import` | `cw run import` | `cw_run_import` | `runImportArchive` | both | identical |
 | `run.verify-import` | `cw run verify-import` | `cw_run_verify_import` | `runVerifyImport` | both | identical |
 | `run.inspect-archive` | `cw run inspect-archive` | `cw_run_inspect_archive` | `runInspectArchive` | both | identical |
+| `report.verify-bundle` | `cw report verify-bundle` | `cw_report_verify_bundle` | `runVerifyReportBundle` | both | identical |
+| `report.bundle` | `cw report bundle` | `cw_report_bundle` | `reportBundle` | both | identical |
 | `run.drive` | `cw run drive` | `cw_run_drive` | `runDrivePreview` | both | identical |
 | `run.drive.step` | `cw run drive` | `cw_run_drive_step` | `runDrive` | both | projected |
 | `quickstart` | `cw quickstart` | `—` | `quickstart` | cli-only | cli-only |
@@ -256,6 +258,7 @@ machine-complete by design: 190 capabilities, 184 MCP tools.
 | `gc.verify` | `cw gc verify` | `cw_gc_verify` | `gcVerify` | both | identical |
 | `telemetry.verify` | `cw telemetry verify` | `cw_telemetry_verify` | `telemetryVerify` | both | identical |
 | `demo.tamper` | `cw demo tamper` | `—` | `demoTamper` | cli-only | cli-only |
+| `demo.bundle` | `cw demo bundle` | `—` | `demoBundle` | cli-only | cli-only |
 | `history` | `cw history` | `cw_history` | `runRegistry.history` | both | identical |
 | `workbench.view` | `cw workbench view` | `cw_workbench_view` | `buildWorkbenchRunView` | both | identical |
 | `workbench.serve` | `cw workbench serve` | `cw_workbench_serve` | `buildWorkbenchServeDescriptor` | both | projected |
@@ -282,14 +285,15 @@ A capability may be on one surface only, but never without word of it — it mus
 carry a recorded reason in the registry.
 
 <!-- gen:parity:cliOnly -->
-Six capabilities are CLI-only:
+Seven capabilities are CLI-only:
 
 - `help` — Human help text. MCP hosts enumerate capabilities via tools/list, not a help command.
 - `doctor` — Environment diagnostics are inherently local to the CLI host — Node version, $PATH, $CW_HOME/cwd writability. An MCP client diagnosing the server process's environment is not meaningful; agents already receive the same readiness facts in their typed results (e.g. status: blocked, agentConfigured). Inspired by `brew doctor`.
 - `loop` — Convenience alias of `schedule create` with kind=loop. MCP hosts use cw_schedule_create with kind=loop.
 - `schedule daemon` — Long-running desktop daemon process, not a request/response tool. MCP hosts drive ticks via cw_schedule_due + cw_schedule_run_now.
-- `quickstart` — CLI UX convenience layer (newcomer first value in one command) over the existing run.drive.step + report verbs; it spawns nothing new and delegates worker execution to the operator's agent backend. MCP hosts compose the same outcome from cw_run_drive_step + cw_report. `audit-run` is a CLI-only alias of the same wrapper.
+- `quickstart` — CLI UX convenience layer (newcomer first value in one command) over the existing run.drive.step + report verbs; it spawns nothing new and delegates worker execution to the operator's agent backend. MCP hosts compose the same outcome from cw_run_drive_step + cw_report (+ cw_report_bundle for --bundle). `audit-run` is a CLI-only alias of the same wrapper.
 - `demo tamper` — Human-facing demonstration (operator/newcomer onboarding); the underlying integrity check is exposed programmatically as the both-surface telemetry.verify. No agent or MCP client needs to invoke a demo.
+- `demo bundle` — Human-facing demonstration (operator/newcomer onboarding); the underlying integrity check is exposed programmatically as the both-surface report.verify-bundle. No agent or MCP client needs to invoke a demo.
 <!-- /gen:parity:cliOnly -->
 
 <!-- gen:parity:projected -->
@@ -466,3 +470,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/contract-migration-tooling.7.md

@@ -141,3 +141,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/control-plane-scheduling.7.md

@@ -125,3 +125,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/durable-state-and-locking.7.md

@@ -124,3 +124,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/evidence-adoption-reasoning-chain.7.md

@@ -285,3 +285,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/execution-backends.7.md

@@ -315,3 +315,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/index.md

@@ -37,6 +37,7 @@ Read these in order when you are new to CW:
 32. [Run Retention & Provable Reclamation](run-retention-reclamation.7.md) - tiered, append-only, cryptographically-verifiable disk reclamation over the v0.1.28 archive overlay: seal the audit skeleton, free the reconstructable/scratch bulk, and prove it via a hash-chained tombstone; `gc plan|run|verify`, write-ahead + fail-closed, explicit capability downgrade.
 33. [Durable State & Locking](durable-state-and-locking.7.md) - atomic (temp→rename) writes for every authoritative store with fsync-durability for the audit-essential ones, plus a portable stale-stealing file lock serializing the cross-process read-modify-write stores (home queue, archive overlay, reclamation chain); closes the prior verdict's non-atomic/unlocked P1.
 34. [Source Context Profiles](source-context-profiles.7.md) - opt-in JSONL source exports for AI context slimming, with profile policy in manifest data and manifest records proving every included or omitted tracked file.
+35. [Verifiable Report Bundle](report-verifiable-bundle.7.md) - embed the operator's ed25519 public key into a portable run archive so anyone can `report verify-bundle` it OFFLINE and self-contained (archive bytes + telemetry chain + trust-audit chain + signatures); `report bundle` produces-and-proves in one command. Fail-closed, no repo/key/install beyond npx.
 
 CW is the base system. Workflow apps are userland. Release and migration rules
 must keep that line clear: stable contracts, clear compatibility checks, and

package/docs/multi-agent-cli-mcp-surface.7.md

@@ -283,3 +283,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/multi-agent-eval-replay-harness.7.md

@@ -317,3 +317,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/multi-agent-operator-ux.7.md

@@ -329,3 +329,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/node-snapshot-diff-replay.7.md

@@ -150,3 +150,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/observability-cost-accounting.7.md

@@ -209,3 +209,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/project-index.md

@@ -1,15 +1,15 @@
 # Cool Workflow Project Index
 
-Generated from the current repository code on 2026-06-17 by `npm run sync:project-index`.
+Generated from the current repository code on 2026-06-18 by `npm run sync:project-index`.
 
 ## Snapshot
 
 - Package: `cool-workflow`
-- Version: `0.1.84`
+- Version: `0.1.85`
 - Source modules: `62`
 - Workflow apps: `7`
-- Docs: `49`
-- Smoke tests: `97`
+- Docs: `50`
+- Smoke tests: `101`
 - Repository: https://github.com/coo1white/cool-workflow
 
 ## Architecture
@@ -161,6 +161,7 @@ multi-agent host -> topology -> blackboard/coordinator
 - [Real Execution Backend Integrations](real-execution-backends.7.md)
 - [Release And Migration Discipline](release-and-migration.7.md)
 - [Release Tooling](release-tooling.7.md)
+- [Verifiable Report Bundle](report-verifiable-bundle.7.md)
 - [Routines](routines.md)
 - [Run Registry / Control Plane](run-registry-control-plane.7.md)
 - [Run Retention & Provable Reclamation](run-retention-reclamation.7.md)
@@ -202,6 +203,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [contract-migration-tooling-smoke.js](../test/contract-migration-tooling-smoke.js)
 - [control-plane-scheduling-smoke.js](../test/control-plane-scheduling-smoke.js)
 - [coordinator-blackboard-smoke.js](../test/coordinator-blackboard-smoke.js)
+- [demo-bundle-smoke.js](../test/demo-bundle-smoke.js)
 - [det-ids-b-smoke.js](../test/det-ids-b-smoke.js)
 - [doctor-smoke.js](../test/doctor-smoke.js)
 - [dogfood-release-smoke.js](../test/dogfood-release-smoke.js)
@@ -236,12 +238,15 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [pipeline-auto-advance-smoke.js](../test/pipeline-auto-advance-smoke.js)
 - [pipeline-runner-smoke.js](../test/pipeline-runner-smoke.js)
 - [project-index-sync-smoke.js](../test/project-index-sync-smoke.js)
+- [quickstart-bundle-smoke.js](../test/quickstart-bundle-smoke.js)
 - [quickstart-smoke.js](../test/quickstart-smoke.js)
 - [real-execution-backends-smoke.js](../test/real-execution-backends-smoke.js)
 - [registry-corrupt-fail-closed-smoke.js](../test/registry-corrupt-fail-closed-smoke.js)
 - [release-flow-smoke.js](../test/release-flow-smoke.js)
 - [release-gate-smoke.js](../test/release-gate-smoke.js)
 - [release-tooling-smoke.js](../test/release-tooling-smoke.js)
+- [report-bundle-smoke.js](../test/report-bundle-smoke.js)
+- [report-verify-bundle-smoke.js](../test/report-verify-bundle-smoke.js)
 - [result-normalize-smoke.js](../test/result-normalize-smoke.js)
 - [robustness-failclosed-smoke.js](../test/robustness-failclosed-smoke.js)
 - [robustness-hardening-smoke.js](../test/robustness-hardening-smoke.js)

package/docs/real-execution-backends.7.md

@@ -157,3 +157,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/release-and-migration.7.md

@@ -297,3 +297,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/release-tooling.7.md

@@ -213,3 +213,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 `release-flow` now writes reviewer input with repo-local paths, so local user home names do not enter the saved review prompt.
+
+0.1.85

package/docs/report-verifiable-bundle.7.md

@@ -0,0 +1,123 @@
+# Verifiable Report Bundle
+
+CW v0.1.85 adds the Verifiable Report Bundle: a way to hand someone a run's report
+that they can check themselves, OFFLINE, with one command — no source repo, no
+pre-existing `.cw` tree, and no key passed on the side.
+
+Before this, a run could be exported to a portable `<id>.cwrun.json` archive
+([Run Registry / Control Plane](run-registry-control-plane.7.md)) and its bytes
+re-proven with `cw run inspect-archive`. But two things stopped a stranger from
+fully verifying it:
+
+- The ed25519 PUBLIC key that re-checks the signed telemetry came only from
+  `--pubkey` or the `CW_AGENT_ATTEST_PUBKEY` environment variable — it did not
+  travel with the archive.
+- `inspect-archive` proves the archive's own file digests, not the telemetry hash
+  chain or the signatures. Re-proving those meant `cw run import` into a real
+  `.cw` tree and then `cw run verify-import` — too much to ask of a recipient.
+
+The Verifiable Report Bundle closes both gaps without a new archive format.
+
+## Mechanism vs Policy
+
+The MECHANISM is three small additions to the existing export/verify path:
+
+1. `cw run export <run> --with-trust-key <pem-or-path>` embeds the operator's
+   ed25519 PUBLIC key into the archive under a new optional `trust` block
+   (`{ publicKeyPem, algorithm: "ed25519" }`). Only a public key is ever embedded;
+   CW never exports a private key. The flag defaults to `CW_AGENT_ATTEST_PUBKEY`,
+   so one configured key both attests at record-time and travels with the export.
+   A raw inline PEM begins with `-----`, which the CLI parses as a flag — so the
+   CLI form takes a key FILE PATH; an inline PEM is accepted programmatically and
+   via the environment variable.
+
+2. `cw report verify-bundle <bundle>` verifies the bundle SELF-CONTAINED and
+   OFFLINE. It reuses the existing verifiers end to end: `inspectArchive` for the
+   archive bytes, then a restore into a throwaway temp dir (auto-removed) so
+   `verifyImportedRun` re-proves the telemetry hash chain and the trust-audit
+   chain, then `verifyTelemetrySignatures` re-runs ed25519 over each attested hop
+   using the key the bundle carries. It writes nothing to any registry.
+
+3. `cw report bundle <run>` is the PRODUCER counterpart: it exports a sealed
+   bundle (step 1) and then immediately self-verifies it (step 2), returning the
+   archive path and the verification verdict together. It fails closed — a solo
+   operator never hands off a report whose bundle does not verify (for example, no
+   trust key configured under `--strict-signatures`). `--extract-report` also
+   writes the human-readable `report.md` next to the bundle so the shippable pair
+   is produced in one command. It is pure composition; it spawns nothing.
+
+`cw quickstart <app> --bundle [--with-trust-key K]` folds step 3 into the
+one-command entry: after the drive reaches `status: complete`, it seals the run
+with `reportBundle` (anchored to the run's own repo) and returns the verdict as
+`result.bundle`. It is gated on completion — a blocked/partial run is **never**
+sealed (the operator gets a `hint`, not a half-shipped artifact) — and the CLI
+exits non-zero when `result.bundle.ok` is false. `quickstart` stays `cli-only`;
+MCP hosts compose `cw_run_drive_step` + `cw_report_bundle` for the same outcome.
+
+Because the README headline runs quickstart cross-directory (your shell cwd is not
+the `--repo`), the run is resolved from its own repo, but the bundle's OUTPUT —
+the `.cwrun.json` and any `--extract-report` — lands in **your cwd**, not the
+analyzed repo (so `cw quickstart … --bundle --extract-report out.md && send out.md`
+works and the repo's working tree is never polluted). `result.bundle.archivePath`
+and `result.bundle.reportExtractedTo` report the absolute paths.
+
+The POLICY is fail-closed and self-describing:
+
+- Key precedence is **bundle > `--pubkey` > `CW_AGENT_ATTEST_PUBKEY`**, so a bundle
+  with an embedded key verifies the same on any machine; the override/env only
+  apply when the bundle omits a key.
+- `ok` is true only when the archive bytes, the telemetry chain, and the
+  trust-audit chain all verify AND no attested signature failed re-verification.
+- A bundle with attested telemetry but no available key DEGRADES by default
+  (`signatureKeyProvided: false`, the intact chain still decides `ok`).
+  `--strict-signatures` refuses such a bundle instead.
+- `--extract-report <path>` writes the bundle's `report.md` out for a human to
+  read alongside the machine verdict. If extraction is requested but the bundle
+  has no `report.md` (or the write fails), that is a failure, not a silent no-op:
+  a `extract-report` / `report-md-unavailable` check is recorded and `ok` is
+  false — so a producer never ships a green verdict with no report attached.
+
+## Fail closed
+
+`cw report verify-bundle` exits non-zero whenever `ok` is false, so
+`cw report verify-bundle <file> && ship` cannot pass on a forgery. This holds even
+for a telemetry chain forged so that every archive file digest still matches: the
+file-digest layer (`inspect-archive`) would wave it through, but the embedded hash
+chain breaks at the next record and the signature re-verification rejects inflated
+usage. A missing, unreadable, or schema-unsupported bundle is also `ok: false`.
+
+## Usage
+
+```
+# See it in 30 seconds, hermetic — no agent, no API key, no repo:
+npx cool-workflow demo bundle
+#   -> builds a sealed bundle, forges it two ways, and shows verify-bundle
+#      catching both offline with only the embedded public key.
+
+# Run the review AND get a shippable, client-verifiable bundle from ONE command:
+cw quickstart architecture-review --repo . --question "What are the risks?" \
+  --agent-command "claude -p" --bundle --with-trust-key ./trust-pub.pem
+#   -> after the drive COMPLETES, the run is sealed into a self-verified bundle and
+#      the verdict is folded into the quickstart JSON (result.bundle). Exits non-zero
+#      if that bundle would not verify. A run that did not complete is never sealed.
+
+# Produce-and-prove from an existing run: export sealed + self-verify + emit the report.
+cw report bundle <run-id> --with-trust-key ./trust-pub.pem \
+  --output report.cwrun.json --extract-report report.md
+#   -> exits non-zero if the produced bundle would not verify (don't ship it).
+
+# Or the two steps separately:
+cw run export <run-id> --with-trust-key ./trust-pub.pem --output report.cwrun.json
+
+# Anyone, anywhere, offline — no repo, no key handed over, no install beyond npx:
+npx cool-workflow report verify-bundle report.cwrun.json
+npx cool-workflow report verify-bundle report.cwrun.json --extract-report report.md
+npx cool-workflow report verify-bundle report.cwrun.json --strict-signatures --json
+```
+
+The same capability is on the MCP surface as `cw_report_verify_bundle`, so an agent
+host re-verifies a bundle through the identical core entry.
+
+See also [Security / Trust Hardening](security-trust-hardening.7.md) and the trust
+model's honest ceiling: a signature proves non-repudiable attribution to the key
+holder, not ground-truth measurement.

package/docs/run-registry-control-plane.7.md

@@ -408,3 +408,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/run-retention-reclamation.7.md

@@ -208,3 +208,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/state-explosion-management.7.md

@@ -286,3 +286,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/team-collaboration.7.md

@@ -222,3 +222,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/docs/web-desktop-workbench.7.md

@@ -230,3 +230,5 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85

package/manifest/plugin.manifest.json

@@ -2,7 +2,7 @@
   "_comment": "SINGLE SOURCE OF TRUTH for every vendor manifest. Edit THIS file, then run `npm run gen:manifests`. Do NOT hand-edit the generated vendor manifests (.claude-plugin/, .codex-plugin/, .agents/, .mcp.json) — `npm run gen:manifests -- --check` (run by release:check) will fail if they drift from this source.",
   "identity": {
     "name": "cool-workflow",
-    "version": "0.1.84",
+    "version": "0.1.85",
     "license": "BSD-2-Clause",
     "homepage": "https://github.com/coo1white/cool-workflow",
     "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.84",
+  "version": "0.1.85",
   "bin": {
     "cool-workflow": "scripts/cw.js",
     "cw": "scripts/cw.js"

package/scripts/canonical-apps.js

@@ -83,7 +83,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.1.84",
+      "Cool Workflow v0.1.85",
       "--freshness",
       "as of release preparation"
     ]
@@ -117,14 +117,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.1.84");
+    assert.equal(summary.version, "0.1.85");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.1.84");
+    assert.equal(shown.app.version, "0.1.85");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -135,7 +135,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.1.84");
+    assert.equal(state.workflow.app.version, "0.1.85");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/dogfood-release.js

@@ -5,7 +5,7 @@ const { spawnSync } = require("node:child_process");
 const fs = require("node:fs");
 const path = require("node:path");
 
-const TARGET_VERSION = "0.1.84";
+const TARGET_VERSION = "0.1.85";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");

package/scripts/golden-path.js

@@ -33,7 +33,7 @@ function main() {
     const appValidation = runJson(["app", "validate", "end-to-end-golden-path"], pluginRoot);
     assert.equal(appValidation.valid, true);
     assert.equal(appValidation.summary.id, "end-to-end-golden-path");
-    assert.equal(appValidation.summary.version, "0.1.84");
+    assert.equal(appValidation.summary.version, "0.1.85");
 
     const plan = runJson(
       [
@@ -42,7 +42,7 @@ function main() {
         "--repo",
         tmp,
         "--question",
-        "Prove the deterministic v0.1.84 end-to-end golden path."
+        "Prove the deterministic v0.1.85 end-to-end golden path."
       ],
       pluginRoot
     );
@@ -52,7 +52,7 @@ function main() {
 
     let state = readJson(plan.statePath);
     assert.equal(state.workflow.app.id, "end-to-end-golden-path");
-    assert.equal(state.workflow.app.version, "0.1.84");
+    assert.equal(state.workflow.app.version, "0.1.85");
     assert.equal(state.loopStage, "interpret");
 
     const dispatch = runJson(["dispatch", plan.runId, "--limit", "1", "--sandbox", "readonly"], tmp);
@@ -195,7 +195,7 @@ function main() {
     assert.equal(reportPath, plan.reportPath);
     assert.ok(fs.existsSync(reportPath));
     const report = fs.readFileSync(reportPath, "utf8");
-    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.84/);
+    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.85/);
     assert.match(report, /## Candidates/);
     assert.match(report, /## Trust Audit/);
     assert.match(report, /## Acceptance Rationale/);