cool-workflow 0.1.84 → 0.1.86

package/dist/capability-core.js

@@ -40,6 +40,8 @@ exports.runExportArchive = runExportArchive;
 exports.runImportArchive = runImportArchive;
 exports.runInspectArchive = runInspectArchive;
 exports.runVerifyImport = runVerifyImport;
+exports.reportBundle = reportBundle;
+exports.runVerifyReportBundle = runVerifyReportBundle;
 exports.queueAdd = queueAdd;
 exports.queueList = queueList;
 exports.queueDrain = queueDrain;
@@ -69,6 +71,7 @@ exports.isRecord = isRecord;
 exports.telemetryVerify = telemetryVerify;
 exports.auditVerify = auditVerify;
 exports.demoTamper = demoTamper;
+exports.demoBundle = demoBundle;
 const drive_1 = require("./drive");
 const agent_config_1 = require("./agent-config");
 const run_registry_1 = require("./run-registry");
@@ -176,8 +179,8 @@ function compactOperatorStatus(status) {
 // functions so `cw <cmd> --json` is byte-identical to `cw_<tool>`. Each accepts
 // the raw CLI options OR the raw MCP arguments and normalizes them identically,
 // then calls the single RunRegistry method. The registry is constructed from the
-// same resolved cwd on both surfaces (CLI: --cwd|process.cwd(); MCP chdir'd to
-// args.cwd), so repo/home roots line up.
+// same resolved cwd on both surfaces (CLI: --cwd|process.cwd(); MCP passes a
+// resolved cwd and scopes the runner), so repo/home roots line up.
 function runRegistryFor(args, planner) {
     return new run_registry_1.RunRegistry(String(args.cwd || process.cwd()), planner);
 }
@@ -277,7 +280,11 @@ function runRerun(reg, runId, args) {
 function runExportArchive(runner, runId, args) {
     const base = invocationCwd(args);
     const output = optionalString(args.output || args.path || args.archive) || `${runId}.cwrun.json`;
-    return (0, run_export_1.exportRun)(runner.withBaseDir(optionalString(args.cwd)).loadRun(runId), node_path_1.default.resolve(base, output));
+    // Optionally seal in the operator's PUBLIC trust key so the bundle re-verifies
+    // offline. Default falls back to the same env the verify gate reads, so a single
+    // configured key both attests at record-time and travels with the export.
+    const trustPublicKey = optionalString(args["with-trust-key"] || args.withTrustKey || args.trustKey || args.pubkey) || process.env.CW_AGENT_ATTEST_PUBKEY;
+    return (0, run_export_1.exportRun)(runner.withBaseDir(optionalString(args.cwd)).loadRun(runId), node_path_1.default.resolve(base, output), { trustPublicKey });
 }
 function runImportArchive(runner, args) {
     const base = invocationCwd(args);
@@ -303,6 +310,48 @@ function runInspectArchive(_runner, args) {
 function runVerifyImport(runner, runId, args) {
     return (0, run_export_1.verifyImportedRun)(runner.withBaseDir(optionalString(args.cwd)).loadRun(runId));
 }
+// Produce-and-prove: export a run to a portable bundle sealed with the operator's
+// trust key (defaulting to CW_AGENT_ATTEST_PUBKEY, same as `run export`), then
+// IMMEDIATELY verify the artifact offline the way a recipient will. The producer
+// learns now — fail-closed — whether the bundle a client will check is actually
+// verifiable (e.g. an unconfigured attest key yields an unverifiable bundle). Pure
+// composition of runExportArchive + verifyReportBundle; spawns nothing, writes only
+// the archive (and, with --extract-report, the human report) that `run export` would.
+function reportBundle(runner, runId, args) {
+    const exported = runExportArchive(runner, runId, args);
+    const base = invocationCwd(args);
+    const extractReportTo = optionalString(args["extract-report"] || args.extractReport || args.extractReportTo);
+    const verification = (0, run_export_1.verifyReportBundle)(exported.path, {
+        pubkey: optionalString(args.pubkey || args.pubKey || args.publicKey),
+        extractReportTo: extractReportTo ? node_path_1.default.resolve(base, extractReportTo) : undefined,
+        strictSignatures: Boolean(args["strict-signatures"] || args.strictSignatures || args.strictSigs)
+    });
+    return {
+        schemaVersion: 1,
+        runId,
+        archivePath: exported.path,
+        trustKeyEmbedded: exported.trustKeyEmbedded,
+        reportExtractedTo: verification.reportExtractedTo,
+        verification,
+        ok: verification.ok
+    };
+}
+// Read-only: verify a portable run bundle OFFLINE and self-contained (archive bytes
+// + telemetry chain + trust-audit chain + embedded-key signatures). The runner is
+// unused — verification restores into its own throwaway tmpdir and writes nothing to
+// any registry — but kept for dispatch-signature symmetry with the other run verbs.
+function runVerifyReportBundle(_runner, args) {
+    const base = invocationCwd(args);
+    const archive = optionalString(args.archive || args.path || args.file || args.bundle);
+    if (!archive)
+        throw new Error("report verify-bundle requires a bundle path (positional, --archive, --path, --file, or --bundle)");
+    const extractReportTo = optionalString(args["extract-report"] || args.extractReport || args.extractReportTo);
+    return (0, run_export_1.verifyReportBundle)(node_path_1.default.resolve(base, archive), {
+        pubkey: optionalString(args.pubkey || args.pubKey || args.publicKey),
+        extractReportTo: extractReportTo ? node_path_1.default.resolve(base, extractReportTo) : undefined,
+        strictSignatures: Boolean(args["strict-signatures"] || args.strictSignatures || args.strictSigs)
+    });
+}
 function queueAdd(reg, args) {
     return reg.queueAdd({
         runId: optionalString(args.runId),
@@ -496,6 +545,8 @@ exports.QUICKSTART_DEFAULT_APP = "architecture-review";
 function quickstart(runner, args) {
     const appId = String(args.appId || args.app || args.workflowId || exports.QUICKSTART_DEFAULT_APP);
     const agentConfigured = Boolean((0, agent_config_1.resolveAgentConfig)(args).command || (0, agent_config_1.resolveAgentConfig)(args).endpoint);
+    if (isTrue(args.check))
+        return quickstartCheck(runner, appId, args, agentConfigured);
     // `--resume`: a discoverability flag over the existing continuation. With no
     // `--run`, advance exactly ONE step (reuse the `--once` path) and print a
     // copy-pasteable continue line; with `--run <id>`, continue that run to
@@ -534,6 +585,33 @@ function quickstart(runner, args) {
     const runRepoCwd = node_path_1.default.resolve(node_path_1.default.dirname(result.statePath), "..", "..", "..");
     const reportTarget = node_fs_1.default.existsSync(runRepoCwd) ? runRepoCwd : undefined;
     const reportPath = runner.withBaseDir(reportTarget).report(result.runId).path;
+    // --bundle: after a COMPLETE drive, seal the run into a portable, self-verified
+    // bundle so the one command yields a client-verifiable artifact. Pure composition
+    // of reportBundle() (export sealed + offline self-verify); spawns nothing. Gated on
+    // completion: a partial or blocked run is NEVER sealed (you must not ship an
+    // uncommitted artifact).
+    //
+    // Run-state resolution MUST anchor to the run's OWN repo (reportTarget): the README
+    // headline runs quickstart cross-directory (caller cwd != --repo), so a caller-cwd
+    // loadRun would not find the run. But operator-supplied OUTPUT paths
+    // (--output/--extract-report) and the default archive name resolve against the
+    // CALLER's cwd — so artifacts land where the operator ran the command (and `&&
+    // send out.md` works) and never pollute the analyzed repo's working tree, matching
+    // standalone `report bundle`. Pre-resolving to absolute makes path.resolve(base, …)
+    // inside reportBundle a no-op, so the run-repo cwd cannot reclaim them.
+    let bundle;
+    const wantsBundle = flag(args.bundle) === true;
+    if (wantsBundle && result.status === "complete") {
+        const callerBase = invocationCwd(args);
+        const outArg = optionalString(args.output || args.path || args.archive);
+        const extractArg = optionalString(args["extract-report"] || args.extractReport || args.extractReportTo);
+        bundle = reportBundle(runner, result.runId, {
+            ...args,
+            cwd: reportTarget,
+            output: node_path_1.default.resolve(callerBase, outArg || `${result.runId}.cwrun.json`),
+            ...(extractArg ? { "extract-report": node_path_1.default.resolve(callerBase, extractArg) } : {})
+        });
+    }
     let hint;
     if (!agentConfigured) {
         hint =
@@ -547,9 +625,14 @@ function quickstart(runner, args) {
     }
     else if (result.status === "in-progress") {
         hint = resume
-            ? `one step advanced — continue: cw quickstart ${appId} --run ${result.runId} --resume`
+            ? `one step advanced — continue: cw quickstart ${appId} --run ${result.runId} --resume${wantsBundle ? " --bundle" : ""}`
             : `one step advanced (--once) — continue: cw quickstart ${appId} --run ${result.runId} --once`;
     }
+    // --bundle on a run that didn't complete is a NO-OP, not silence: tell the operator
+    // why nothing was sealed (Rule of Silence permits a human-facing hint).
+    if (wantsBundle && result.status !== "complete") {
+        hint = `${hint ? `${hint} ` : ""}--bundle skipped: the run did not complete (status=${result.status}); no bundle was sealed.`;
+    }
     return {
         schemaVersion: 1,
         appId,
@@ -568,9 +651,138 @@ function quickstart(runner, args) {
         // Stamp resumedFrom ONLY when we continued an explicit run. Conditional spread
         // keeps the key absent on the default/fresh path (own-property absent + omitted
         // by JSON.stringify), so default output is byte-identical.
-        ...(resumeRunId ? { resumedFrom: resumeRunId } : {})
+        ...(resumeRunId ? { resumedFrom: resumeRunId } : {}),
+        // Same conditional-spread discipline: `bundle` is present only when --bundle ran
+        // on a completed drive, so the default (no --bundle) payload is byte-identical.
+        ...(bundle ? { bundle } : {})
+    };
+}
+function quickstartCheck(runner, appId, args, agentConfigured) {
+    const base = invocationCwd(args);
+    const repoArg = optionalString(args.repo) || base;
+    const repo = node_path_1.default.resolve(base, repoArg);
+    const checks = [];
+    try {
+        runner.showApp(appId);
+        checks.push({ name: "app", status: "ok", detail: `Workflow app ${appId} is available.` });
+    }
+    catch (error) {
+        checks.push({
+            name: "app",
+            status: "blocked",
+            detail: `Workflow app ${appId} is not available.`,
+            fix: "Run `cw app list` and choose one of the listed app ids."
+        });
+    }
+    let repoReadable = false;
+    let repoStateWritable = false;
+    try {
+        const stat = node_fs_1.default.statSync(repo);
+        repoReadable = stat.isDirectory();
+        if (!repoReadable)
+            throw new Error("not a directory");
+        node_fs_1.default.accessSync(repo, node_fs_1.default.constants.R_OK);
+        checks.push({ name: "repo", status: "ok", detail: `Repository path is readable (${repo}).` });
+    }
+    catch (error) {
+        checks.push({
+            name: "repo",
+            status: "blocked",
+            detail: `Repository path is not readable (${repo}).`,
+            fix: "Pass --repo PATH for a readable repository directory."
+        });
+    }
+    try {
+        const cwDir = node_path_1.default.join(repo, ".cw");
+        node_fs_1.default.accessSync(node_fs_1.default.existsSync(cwDir) ? cwDir : repo, node_fs_1.default.constants.W_OK);
+        repoStateWritable = repoReadable;
+        checks.push({ name: "repo-state", status: "ok", detail: "Run state location is writable." });
+    }
+    catch (error) {
+        checks.push({
+            name: "repo-state",
+            status: "blocked",
+            detail: "Run state location is not writable.",
+            fix: "Use a writable repo, fix directory permissions, or pass --repo to a writable checkout."
+        });
+    }
+    if (optionalString(args.question)) {
+        checks.push({ name: "question", status: "ok", detail: "Question is set." });
+    }
+    else {
+        checks.push({
+            name: "question",
+            status: "blocked",
+            detail: "Question is missing.",
+            fix: "Pass --question TEXT."
+        });
+    }
+    if (agentConfigured) {
+        checks.push({ name: "agent", status: "ok", detail: "Agent backend is configured." });
+    }
+    else {
+        checks.push({
+            name: "agent",
+            status: "blocked",
+            detail: "No agent backend is configured.",
+            fix: "Pass --agent-command \"claude -p\", set $CW_AGENT_COMMAND, or use --agent-command builtin:claude."
+        });
+    }
+    if (flag(args.bundle) === true) {
+        const trustKey = optionalString(args["with-trust-key"] || args.withTrustKey || args.trustKey || args.pubkey) || process.env.CW_AGENT_ATTEST_PUBKEY;
+        if (trustKey) {
+            checks.push({ name: "bundle-trust-key", status: "ok", detail: "Bundle trust public key is configured." });
+        }
+        else if (Boolean(args["strict-signatures"] || args.strictSignatures || args.strictSigs)) {
+            checks.push({
+                name: "bundle-trust-key",
+                status: "blocked",
+                detail: "Strict signature verification needs a public trust key.",
+                fix: "Pass --with-trust-key PATH or set $CW_AGENT_ATTEST_PUBKEY."
+            });
+        }
+        else {
+            checks.push({
+                name: "bundle-trust-key",
+                status: "warn",
+                detail: "No public trust key is configured; unsigned or unkeyed bundles may verify with reduced signature proof.",
+                fix: "Pass --with-trust-key PATH to embed the public key."
+            });
+        }
+    }
+    const ok = checks.every((check) => check.status !== "blocked") && repoStateWritable;
+    return {
+        schemaVersion: 1,
+        mode: "check",
+        ok,
+        appId,
+        repo,
+        checks,
+        nextCommand: quickstartNextCommand(appId, repo, args)
     };
 }
+function quickstartNextCommand(appId, repo, args) {
+    const parts = ["cw", "quickstart", shellWord(appId), "--repo", shellWord(repo)];
+    const question = optionalString(args.question);
+    if (question)
+        parts.push("--question", shellWord(question));
+    const command = optionalString(args.agentCommand || args["agent-command"]);
+    if (command)
+        parts.push("--agent-command", shellWord(command));
+    if (flag(args.bundle) === true)
+        parts.push("--bundle");
+    const trustKey = optionalString(args["with-trust-key"] || args.withTrustKey || args.trustKey);
+    if (trustKey)
+        parts.push("--with-trust-key", shellWord(trustKey));
+    if (Boolean(args["strict-signatures"] || args.strictSignatures || args.strictSigs))
+        parts.push("--strict-signatures");
+    return parts.join(" ");
+}
+function shellWord(value) {
+    if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(value))
+        return value;
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
 /** Read-only, deterministic projection of the effective agent config (secret-stripped). */
 function backendAgentConfigShow(args) {
     return (0, agent_config_1.agentConfigShow)(args);
@@ -763,3 +975,6 @@ function auditVerify(runner, args) {
 function demoTamper(_runner, _args = {}) {
     return (0, telemetry_demo_1.runTamperDemo)();
 }
+function demoBundle(_runner, _args = {}) {
+    return (0, telemetry_demo_1.runBundleDemo)();
+}

package/dist/capability-registry.js

@@ -31,11 +31,13 @@ exports.mcpCapabilityForId = mcpCapabilityForId;
 exports.mcpRequiredArgsForTool = mcpRequiredArgsForTool;
 exports.mcpToolDefinition = mcpToolDefinition;
 exports.declaredCliTokens = declaredCliTokens;
+exports.declaredCliHelpTokens = declaredCliHelpTokens;
 exports.requiresReason = requiresReason;
 exports.isPayloadProbeOptOut = isPayloadProbeOptOut;
 exports.payloadIdenticalCapabilities = payloadIdenticalCapabilities;
 exports.payloadProbeTargets = payloadProbeTargets;
 exports.deferredPayloadProbeCapabilities = deferredPayloadProbeCapabilities;
+exports.buildPayloadProbePlan = buildPayloadProbePlan;
 exports.payloadProbePlan = payloadProbePlan;
 exports.buildParityReport = buildParityReport;
 // ---------------------------------------------------------------------------
@@ -345,15 +347,17 @@ const BUILTIN_CAPABILITIES = [
     { capability: "run.import", summary: "Restore a portable run archive into a target repo and verify restored file digests.", entry: "runImportArchive", surface: "both", cli: { path: ["run", "import"], jsonMode: "default" }, mcp: { tool: "cw_run_import", requiredArgs: ["archive|path|file"] } },
     { capability: "run.verify-import", summary: "Verify an imported run against its restore manifest and telemetry chain.", entry: "runVerifyImport", surface: "both", cli: { path: ["run", "verify-import"], jsonMode: "default" }, mcp: { tool: "cw_run_verify_import", requiredArgs: ["runId"] } },
     { capability: "run.inspect-archive", summary: "Read-only integrity inspection of a portable run archive without importing it.", entry: "runInspectArchive", surface: "both", cli: { path: ["run", "inspect-archive"], jsonMode: "default" }, mcp: { tool: "cw_run_inspect_archive", requiredArgs: ["archive|path|file"] } },
+    { capability: "report.verify-bundle", summary: "Offline self-contained verify of a portable run bundle: archive bytes + telemetry chain + trust-audit chain + embedded-key signatures.", entry: "runVerifyReportBundle", surface: "both", cli: { path: ["report", "verify-bundle"], caseTokens: ["report"], jsonMode: "default" }, mcp: { tool: "cw_report_verify_bundle", requiredArgs: ["archive|path|file|bundle"] } },
+    { capability: "report.bundle", summary: "Produce-and-prove: export a run to a portable bundle sealed with the trust key, then self-verify it offline (fail-closed) so the producer knows it is verifiable before shipping.", entry: "reportBundle", surface: "both", cli: { path: ["report", "bundle"], caseTokens: ["report"], jsonMode: "default" }, mcp: { tool: "cw_report_bundle", requiredArgs: ["runId"] } },
     { capability: "run.drive", summary: "Preview the next agent-delegation drive step for a run (read-only, deterministic).", entry: "runDrivePreview", surface: "both", cli: { path: ["run", "drive"], caseTokens: ["run", "drive"], jsonMode: "default" }, mcp: { tool: "cw_run_drive" } },
     { capability: "run.drive.step", summary: "Drive a run by delegating each worker to the agent backend (plan->dispatch->fulfill->accept->commit; --once for one step).", entry: "runDrive", surface: "both", cli: { path: ["run", "drive"], caseTokens: ["run", "drive"], jsonMode: "default" }, mcp: { tool: "cw_run_drive_step" }, payloadIdentical: false, reason: "Mutating: advances the run by spawning the external agent per worker and recording attested output — not a read probe. CLI (--drive/--step) and MCP route through the same drive() core." },
     {
         capability: "quickstart",
-        summary: "ONE-COMMAND quickstart: plan(app, default architecture-review) -> run --drive -> report in a single invocation (--preview for a read-only dry run).",
+        summary: "ONE-COMMAND quickstart: --check preflights without writes; otherwise plan(app, default architecture-review) -> run --drive -> report in a single invocation (--preview for a read-only dry run; --bundle [--with-trust-key K] seals a completed run into a self-verified portable bundle).",
         entry: "quickstart",
         surface: "cli-only",
         cli: { path: ["quickstart"], caseTokens: ["quickstart", "audit-run"], jsonMode: "default" },
-        reason: "CLI UX convenience layer (newcomer first value in one command) over the existing run.drive.step + report verbs; it spawns nothing new and delegates worker execution to the operator's agent backend. MCP hosts compose the same outcome from cw_run_drive_step + cw_report. `audit-run` is a CLI-only alias of the same wrapper."
+        reason: "CLI UX convenience layer (newcomer first value in one command) over the existing run.drive.step + report verbs; it spawns nothing new and delegates worker execution to the operator's agent backend. MCP hosts compose the same outcome from cw_run_drive_step + cw_report (+ cw_report_bundle for --bundle). `audit-run` is a CLI-only alias of the same wrapper."
     },
     { capability: "queue.add", summary: "Enqueue a pending/planned run with explicit ordering policy.", entry: "runRegistry.queueAdd", surface: "both", cli: { path: ["queue", "add"], jsonMode: "default" }, mcp: { tool: "cw_queue_add" } },
     { capability: "queue.list", summary: "List the durable run queue in policy order.", entry: "runRegistry.queueList", surface: "both", cli: { path: ["queue", "list"], jsonMode: "flag" }, mcp: { tool: "cw_queue_list" } },
@@ -377,6 +381,7 @@ const BUILTIN_CAPABILITIES = [
     { capability: "gc.verify", summary: "Re-prove a reclaimed run: skeleton-complete, tombstone chain untampered, artifacts reconstructable.", entry: "gcVerify", surface: "both", cli: { path: ["gc", "verify"], caseTokens: ["gc", "verify"], jsonMode: "flag" }, mcp: { tool: "cw_gc_verify", requiredArgs: ["runId"] } },
     { capability: "telemetry.verify", summary: "Re-prove a run's telemetry attestation ledger offline: chain linkage + independent hash recompute, and (with --pubkey / CW_AGENT_ATTEST_PUBKEY) re-verify each attested hop's ed25519 signature against the public key.", entry: "telemetryVerify", surface: "both", cli: { path: ["telemetry", "verify"], caseTokens: ["telemetry"], jsonMode: "flag" }, mcp: { tool: "cw_telemetry_verify", requiredArgs: ["runId"] } },
     { capability: "demo.tamper", summary: "Prove tamper-evidence: build a signed telemetry ledger, forge it, watch verification fail offline.", entry: "demoTamper", surface: "cli-only", cli: { path: ["demo", "tamper"], caseTokens: ["demo", "tamper"], jsonMode: "flag" }, reason: "Human-facing demonstration (operator/newcomer onboarding); the underlying integrity check is exposed programmatically as the both-surface telemetry.verify. No agent or MCP client needs to invoke a demo." },
+    { capability: "demo.bundle", summary: "Prove portable-bundle verification: export a sealed report bundle, forge it two ways, watch report verify-bundle catch both offline with only the embedded public key.", entry: "demoBundle", surface: "cli-only", cli: { path: ["demo", "bundle"], caseTokens: ["demo", "bundle"], jsonMode: "flag" }, reason: "Human-facing demonstration (operator/newcomer onboarding); the underlying integrity check is exposed programmatically as the both-surface report.verify-bundle. No agent or MCP client needs to invoke a demo." },
     { capability: "history", summary: "Read a cross-repo unified run timeline (newest first).", entry: "runRegistry.history", surface: "both", cli: { path: ["history"], jsonMode: "flag" }, mcp: { tool: "cw_history" } },
     // ---- web / desktop workbench (v0.1.30) ----------------------------------
     // A THIRD FRONT DOOR — a read-only renderer, not a new brain. Both verbs route
@@ -455,34 +460,63 @@ const RUN_PAYLOAD_PROBE_CAPABILITIES = [
     "gc.plan",
     "gc.verify"
 ];
+const SCENARIO_PAYLOAD_PROBE_CAPABILITIES = [
+    "plan",
+    "app.show",
+    "app.validate",
+    "app.package",
+    "topology.show",
+    "topology.validate",
+    "topology.apply",
+    "topology.summary",
+    "topology.graph",
+    "summary.refresh",
+    "summary.show",
+    "sandbox.show",
+    "sandbox.validate",
+    "sandbox.choose",
+    "sandbox.resolve",
+    "approve",
+    "reject",
+    "comment.add",
+    "handoff",
+    "review.policy",
+    "worker.list",
+    "worker.show",
+    "worker.manifest",
+    "worker.output",
+    "worker.fail",
+    "worker.validate",
+    "candidate.list",
+    "candidate.show",
+    "candidate.register",
+    "candidate.score",
+    "candidate.rank",
+    "candidate.select",
+    "candidate.reject",
+    "feedback.list",
+    "feedback.show",
+    "feedback.collect",
+    "feedback.task",
+    "feedback.resolve",
+    "node.show",
+    "node.snapshot",
+    "node.diff",
+    "node.replay",
+    "node.replay.verify"
+];
 const PAYLOAD_PROBE_DEFERRED_GROUPS = [
     {
         reason: "Not safe for the deterministic bootstrap parity probe yet: this capability needs extra target ids/files, mutates durable state, depends on external state, or needs a dedicated fixture beyond cwd/runId.",
         capabilities: [
             "init",
-            "plan",
             "dispatch",
             "result",
-            "app.show",
-            "app.validate",
             "app.init",
-            "app.package",
             "app.run",
-            "node.show",
-            "node.snapshot",
-            "node.diff",
-            "node.replay",
-            "node.replay.verify",
             "migration.list",
             "migration.check",
             "migration.prove",
-            "topology.show",
-            "topology.validate",
-            "topology.apply",
-            "topology.summary",
-            "topology.graph",
-            "summary.refresh",
-            "summary.show",
             "multi-agent.run",
             "multi-agent.status",
             "multi-agent.step",
@@ -539,30 +573,8 @@ const PAYLOAD_PROBE_DEFERRED_GROUPS = [
             "audit.judge",
             "audit.attest",
             "audit.decision",
-            "sandbox.show",
-            "sandbox.validate",
-            "sandbox.choose",
-            "sandbox.resolve",
             "backend.show",
             "backend.probe",
-            "worker.list",
-            "worker.show",
-            "worker.manifest",
-            "worker.output",
-            "worker.fail",
-            "worker.validate",
-            "candidate.list",
-            "candidate.show",
-            "candidate.register",
-            "candidate.score",
-            "candidate.rank",
-            "candidate.select",
-            "candidate.reject",
-            "feedback.list",
-            "feedback.show",
-            "feedback.collect",
-            "feedback.task",
-            "feedback.resolve",
             "schedule.create",
             "schedule.list",
             "schedule.delete",
@@ -589,6 +601,8 @@ const PAYLOAD_PROBE_DEFERRED_GROUPS = [
             "run.import",
             "run.verify-import",
             "run.inspect-archive",
+            "report.verify-bundle",
+            "report.bundle",
             "queue.add",
             "queue.list",
             "queue.drain",
@@ -602,12 +616,7 @@ const PAYLOAD_PROBE_DEFERRED_GROUPS = [
             "sched.policy.show",
             "sched.policy.set",
             "telemetry.verify",
-            "history",
-            "approve",
-            "reject",
-            "comment.add",
-            "handoff",
-            "review.policy"
+            "history"
         ]
     }
 ];
@@ -660,6 +669,24 @@ function declaredCliTokens() {
     }
     return [...tokens].sort();
 }
+/** The top-level CLI commands that should be visible in `cw help`. Subcommands
+ *  are intentionally collapsed to their first token; aliases such as audit-run
+ *  stay visible. */
+function declaredCliHelpTokens() {
+    const tokens = new Set();
+    for (const cap of exports.CAPABILITY_REGISTRY) {
+        if (!cap.cli)
+            continue;
+        const subcommandTokens = new Set(cap.cli.path.slice(1));
+        tokens.add(cap.cli.path[0]);
+        for (const token of cap.cli.caseTokens || []) {
+            if (!subcommandTokens.has(token))
+                tokens.add(token);
+        }
+    }
+    tokens.delete("help");
+    return [...tokens].sort();
+}
 /** Whether a descriptor MUST carry a reason (surface-specific or divergent). */
 function requiresReason(cap) {
     if (cap.surface !== "both")
@@ -694,27 +721,31 @@ function payloadIdenticalCapabilities() {
 function payloadProbeTargets() {
     return [
         ...GLOBAL_PAYLOAD_PROBE_CAPABILITIES.map((capability) => ({ capability, kind: "global" })),
-        ...RUN_PAYLOAD_PROBE_CAPABILITIES.map((capability) => ({ capability, kind: "run" }))
+        ...RUN_PAYLOAD_PROBE_CAPABILITIES.map((capability) => ({ capability, kind: "run" })),
+        ...SCENARIO_PAYLOAD_PROBE_CAPABILITIES.map((capability) => ({ capability, kind: "scenario" }))
     ];
 }
 function deferredPayloadProbeCapabilities() {
     return PAYLOAD_PROBE_DEFERRED_GROUPS.flatMap((group) => group.capabilities.map((capability) => ({ capability, reason: group.reason })));
 }
-function payloadProbePlan() {
+function buildPayloadProbePlan(targets, deferred) {
     const candidateIds = new Set(payloadIdenticalCapabilities().map((cap) => cap.capability));
     const counts = new Map();
-    const classified = [...payloadProbeTargets().map((entry) => entry.capability), ...deferredPayloadProbeCapabilities().map((entry) => entry.capability)];
+    const classified = [...targets.map((entry) => entry.capability), ...deferred.map((entry) => entry.capability)];
     for (const capability of classified)
         counts.set(capability, (counts.get(capability) || 0) + 1);
     const classifiedIds = new Set(classified);
     return {
-        targets: payloadProbeTargets(),
-        deferred: deferredPayloadProbeCapabilities(),
+        targets,
+        deferred,
         unclassified: [...candidateIds].filter((capability) => !classifiedIds.has(capability)).sort(),
         duplicateClassifications: [...counts.entries()].filter(([, count]) => count > 1).map(([capability]) => capability).sort(),
         invalidClassifications: [...classifiedIds].filter((capability) => !candidateIds.has(capability)).sort()
     };
 }
+function payloadProbePlan() {
+    return buildPayloadProbePlan(payloadProbeTargets(), deferredPayloadProbeCapabilities());
+}
 function lintRegistry() {
     const issues = [];
     const seenCaps = new Set();
@@ -750,10 +781,14 @@ function buildParityReport(input) {
     const actualTools = new Set(input.mcpTools);
     const declaredTokens = new Set(declaredCliTokens());
     const actualTokens = new Set(input.cliTokens);
+    const declaredHelpTokens = new Set(declaredCliHelpTokens());
+    const actualHelpTokens = new Set(input.helpTokens || []);
     const missingMcpTools = [...declaredTools].filter((tool) => !actualTools.has(tool)).sort();
     const undeclaredMcpTools = [...actualTools].filter((tool) => !declaredTools.has(tool)).sort();
     const missingCliTokens = [...declaredTokens].filter((token) => !actualTokens.has(token)).sort();
     const undeclaredCliTokens = [...actualTokens].filter((token) => !declaredTokens.has(token)).sort();
+    const helpMissingCliTokens = input.helpTokens ? [...declaredHelpTokens].filter((token) => !actualHelpTokens.has(token)).sort() : [];
+    const helpUndeclaredCliTokens = input.helpTokens ? [...actualHelpTokens].filter((token) => !declaredHelpTokens.has(token)).sort() : [];
     const reasonlessExceptions = exports.CAPABILITY_REGISTRY.filter((cap) => requiresReason(cap) && !(cap.reason && cap.reason.trim()))
         .map((cap) => cap.capability)
         .sort();
@@ -763,6 +798,8 @@ function buildParityReport(input) {
         undeclaredMcpTools.length === 0 &&
         missingCliTokens.length === 0 &&
         undeclaredCliTokens.length === 0 &&
+        helpMissingCliTokens.length === 0 &&
+        helpUndeclaredCliTokens.length === 0 &&
         reasonlessExceptions.length === 0 &&
         payloadPlan.unclassified.length === 0 &&
         payloadPlan.duplicateClassifications.length === 0 &&
@@ -775,6 +812,8 @@ function buildParityReport(input) {
         undeclaredMcpTools,
         missingCliTokens,
         undeclaredCliTokens,
+        helpMissingCliTokens,
+        helpUndeclaredCliTokens,
         reasonlessExceptions,
         payloadProbeUnclassified: payloadPlan.unclassified,
         payloadProbeDuplicateClassifications: payloadPlan.duplicateClassifications,

package/dist/cli/command-surface.js

@@ -91,7 +91,17 @@ async function runCli(argv = process.argv.slice(2)) {
             // fails closed (status=blocked) when none is set. No new executor/scheduler.
             const [appId] = args.positionals;
             const runId = optionalArg(args.options.run) || optionalArg(args.options.runId);
-            printJson((0, capability_core_1.quickstart)(runner, { ...args.options, ...(appId ? { appId } : {}), ...(runId ? { runId } : {}) }));
+            const qs = (0, capability_core_1.quickstart)(runner, { ...args.options, ...(appId ? { appId } : {}), ...(runId ? { runId } : {}) });
+            printJson(qs);
+            if (qs.mode === "check" && qs.ok === false) {
+                process.exitCode = 1;
+            }
+            // Fail closed: if --bundle produced an artifact that does not self-verify, exit
+            // non-zero so `cw quickstart ... --bundle && send-to-client` cannot ship a report
+            // whose bundle a client could not verify. Mirrors `report bundle`.
+            if (qs.bundle && qs.bundle.ok === false) {
+                process.exitCode = 1;
+            }
             return;
         }
         case "plan": {
@@ -151,6 +161,29 @@ async function runCli(argv = process.argv.slice(2)) {
             printJson(runner.commit(required(args.positionals[0], "run id"), args.options));
             return;
         case "report": {
+            // `report verify-bundle <path>` is the offline self-contained bundle verifier;
+            // `report bundle <run-id>` exports a sealed bundle and self-verifies it;
+            // every other `report <run-id>` form prints/inspects a local run's report.
+            if (args.positionals[0] === "verify-bundle") {
+                const result = (0, capability_core_1.runVerifyReportBundle)(runner, { ...args.options, archive: args.positionals[1] || args.options.archive || args.options.path || args.options.file || args.options.bundle });
+                printJson(result);
+                // Fail closed: a forged/edited/corrupt bundle verifies false — surface it
+                // through the exit code so `cw report verify-bundle <file> && ship` cannot
+                // pass on a lie. Mirrors run inspect-archive / telemetry verify.
+                if (!result.ok)
+                    process.exitCode = 1;
+                return;
+            }
+            if (args.positionals[0] === "bundle") {
+                const result = (0, capability_core_1.reportBundle)(runner, required(args.positionals[1] || optionalArg(args.options.runId || args.options.run), "run id"), args.options);
+                printJson(result);
+                // Fail closed: never report a "bundle made" success if the artifact does not
+                // self-verify — so `cw report bundle <run> && send-to-client` cannot ship an
+                // unverifiable report (e.g. no trust key under --strict-signatures).
+                if (!result.ok)
+                    process.exitCode = 1;
+                return;
+            }
             const runId = required(args.positionals[0], "run id");
             const report = runner.report(runId);
             if (wantsJson(args.options)) {
@@ -1250,8 +1283,20 @@ async function runCli(argv = process.argv.slice(2)) {
                         process.exitCode = 1;
                     return;
                 }
+                case "bundle": {
+                    const result = (0, capability_core_1.demoBundle)(runner, args.options);
+                    if (wantsJson(args.options))
+                        printJson(result);
+                    else
+                        process.stdout.write(`${(0, telemetry_demo_1.formatBundleDemo)(result)}\n`);
+                    // Fail closed: a forged bundle that verified would be a regression in the
+                    // bundle guarantee — exit nonzero so the demo can never green it.
+                    if (!result.proven)
+                        process.exitCode = 1;
+                    return;
+                }
                 default:
-                    throw new Error("Usage: cw.js demo tamper [--json]");
+                    throw new Error("Usage: cw.js demo tamper|bundle [--json]");
             }
         }
         case "workbench": {