cool-workflow 0.1.84 → 0.1.86

package/dist/run-export.js

@@ -16,19 +16,26 @@ exports.importRun = importRun;
 exports.verifyImportedRun = verifyImportedRun;
 exports.inspectArchive = inspectArchive;
 exports.importManifestPath = importManifestPath;
+exports.verifyReportBundle = verifyReportBundle;
 const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const state_1 = require("./state");
 const version_1 = require("./version");
 const telemetry_ledger_1 = require("./telemetry-ledger");
+const telemetry_attestation_1 = require("./telemetry-attestation");
 const trust_audit_1 = require("./trust-audit");
 const compare_1 = require("./compare");
 /** Export a run to a portable JSON archive with run-local bytes and digests. */
-function exportRun(run, outputPath) {
+function exportRun(run, outputPath, options = {}) {
     const exportedAt = new Date().toISOString();
     const files = collectArchiveFiles(run);
     const manifestSha256 = digestManifest(files);
+    // Embed ONLY a public key. resolveTrustPublicKey normalizes an inline PEM or a
+    // file path down to inline PEM bytes so the archive is self-contained; a value
+    // that resolves to nothing (bad path) yields no trust block rather than a throw.
+    const trustPublicKeyPem = (0, telemetry_attestation_1.resolveTrustPublicKey)(options.trustPublicKey);
     const exported = {
         schemaVersion: 1,
         exportedAt,
@@ -39,6 +46,7 @@ function exportRun(run, outputPath) {
             fileCount: files.length,
             manifestSha256
         },
+        ...(trustPublicKeyPem ? { trust: { publicKeyPem: trustPublicKeyPem, algorithm: "ed25519" } } : {}),
         // Legacy field retained so old readers still find an artifact-ish list.
         artifacts: files
             .filter((file) => file.role === "artifact")
@@ -62,6 +70,7 @@ function exportRun(run, outputPath) {
         artifactCount: files.filter((file) => file.role === "artifact").length,
         auditFileCount: files.filter((file) => file.role === "audit").length,
         telemetryIncluded: files.some((file) => file.role === "telemetry"),
+        trustKeyEmbedded: Boolean(trustPublicKeyPem),
         manifestSha256,
         archiveSha256
     };
@@ -276,6 +285,135 @@ function inspectArchive(archivePath) {
 function importManifestPath(run) {
     return node_path_1.default.join(run.paths.runDir, "import-manifest.json");
 }
+/** Verify a portable run bundle OFFLINE and SELF-CONTAINED: prove the archive bytes,
+ *  the telemetry hash chain, the trust-audit chain, and (with the bundle's embedded
+ *  public key) the ed25519 signatures — WITHOUT a source repo, a pre-existing .cw
+ *  tree, or an out-of-band key. Reuses the existing import + restore-verify path: it
+ *  restores into an auto-cleaned tmpdir so a stranger's machine is left untouched.
+ *  Never throws — every failure is a structured check and a false `ok` (exit-1 worthy).
+ *
+ *  Key precedence is bundle > argument > environment, so the artifact verifies the
+ *  same on any machine; only when the bundle omits a key do the override/env apply. */
+function verifyReportBundle(archivePath, options = {}) {
+    const inspect = inspectArchive(archivePath);
+    const failedChecks = inspect.checks
+        .filter((check) => !check.pass)
+        .map((check) => ({ name: check.name, code: check.code }));
+    const base = {
+        schemaVersion: 1,
+        archivePath,
+        runId: inspect.runId,
+        ok: false,
+        archiveOk: inspect.ok,
+        telemetryVerified: false,
+        trustAuditVerified: false,
+        trustKeySource: "none",
+        signatureKeyProvided: false,
+        signaturesChecked: 0,
+        signaturesReverified: 0,
+        signaturesFailed: 0,
+        failedChecks
+    };
+    // A bundle that is not even a supported archive cannot be restored — report the
+    // inspection failure and stop (fail-closed, no tmpdir, nothing written).
+    if (!inspect.schemaSupported)
+        return base;
+    // Read the embedded trust key (and, if requested, the report bytes) straight from
+    // the archive JSON. inspectArchive already proved the bytes parse + digest-match.
+    let bundleKey;
+    let reportContent;
+    try {
+        const raw = JSON.parse(node_fs_1.default.readFileSync(archivePath, "utf8"));
+        bundleKey = raw.trust?.publicKeyPem;
+        if (options.extractReportTo) {
+            const reportFile = (raw.files || []).find((file) => file.relativePath === "report.md");
+            if (reportFile)
+                reportContent = Buffer.from(reportFile.contentBase64, "base64").toString("utf8");
+        }
+    }
+    catch {
+        /* inspect already recorded the parse failure; treat key as absent */
+    }
+    const trustKeySource = bundleKey
+        ? "bundle"
+        : options.pubkey
+            ? "argument"
+            : process.env.CW_AGENT_ATTEST_PUBKEY
+                ? "environment"
+                : "none";
+    const trustKey = (0, telemetry_attestation_1.resolveTrustPublicKey)(bundleKey || options.pubkey || process.env.CW_AGENT_ATTEST_PUBKEY);
+    const tmpDir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), "cw-verify-bundle-"));
+    let telemetryVerified = false;
+    let trustAuditVerified = false;
+    let signaturesChecked = 0;
+    let signaturesReverified = 0;
+    let signaturesFailed = 0;
+    let reportExtractedTo;
+    try {
+        // Restore into the throwaway tree. importRun digest-checks every file and throws
+        // on the first mismatch (or on a stripped integrity block under
+        // CW_REQUIRE_ARCHIVE_INTEGRITY=1) — caught below as a failed "restore" check.
+        const imported = importRun(archivePath, tmpDir);
+        for (const check of imported.verification.checks) {
+            if (check.name === "telemetry-ledger")
+                telemetryVerified = check.pass;
+            if (check.name === "trust-audit")
+                trustAuditVerified = check.pass;
+            if (!check.pass)
+                failedChecks.push({ name: check.name, code: check.code });
+        }
+        // Independent ed25519 re-verification over the restored ledger using the bundle's
+        // own key (or override/env). With no key, attested records degrade to
+        // informational (signaturesFailed stays 0); the chain check above still gates ok.
+        const ledger = (0, telemetry_ledger_1.verifyTelemetryLedger)(imported.run);
+        const sig = (0, telemetry_attestation_1.verifyTelemetrySignatures)(ledger.records, trustKey);
+        signaturesChecked = sig.checked;
+        signaturesReverified = sig.reverified;
+        signaturesFailed = sig.failed;
+        for (const check of sig.checks)
+            if (!check.pass)
+                failedChecks.push({ name: check.name, code: check.code });
+        if (options.extractReportTo && reportContent !== undefined) {
+            reportExtractedTo = node_path_1.default.resolve(options.extractReportTo);
+            node_fs_1.default.writeFileSync(reportExtractedTo, reportContent);
+        }
+    }
+    catch (error) {
+        failedChecks.push({ name: "restore", code: messageOf(error) });
+    }
+    finally {
+        node_fs_1.default.rmSync(tmpDir, { recursive: true, force: true });
+    }
+    // Strict mode: a bundle that claims attested telemetry but offers no key to check
+    // it is unverifiable — refuse rather than green it.
+    const strictShortfall = Boolean(options.strictSignatures) && signaturesChecked > 0 && !trustKey;
+    if (strictShortfall)
+        failedChecks.push({ name: "signatures", code: "signature-key-required" });
+    // Extraction was requested but could not be fulfilled (no report.md in the bundle,
+    // or the write failed): fail closed rather than silently green a missing artifact —
+    // otherwise `report bundle <run> --extract-report r.md && send r.md` would ship
+    // nothing (or a stale file) with exit 0. A requested-but-absent output is a failure,
+    // not a no-op (distinct from extraction never being requested).
+    const extractShortfall = Boolean(options.extractReportTo) && !reportExtractedTo;
+    if (extractShortfall)
+        failedChecks.push({ name: "extract-report", code: "report-md-unavailable" });
+    return {
+        schemaVersion: 1,
+        archivePath,
+        runId: inspect.runId,
+        ok: inspect.ok && telemetryVerified && trustAuditVerified && signaturesFailed === 0 && !strictShortfall && !extractShortfall,
+        archiveOk: inspect.ok,
+        telemetryVerified,
+        trustAuditVerified,
+        trustKeySource,
+        signatureKeyProvided: Boolean(trustKey),
+        signaturesChecked,
+        signaturesReverified,
+        signaturesFailed,
+        reportExtractedTo,
+        failedChecks
+    };
+}
 function collectArchiveFiles(run) {
     const entries = new Map();
     for (const file of walkFiles(run.paths.runDir)) {

package/dist/telemetry-demo.js

@@ -22,12 +22,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.formatTelemetryVerify = formatTelemetryVerify;
 exports.formatTamperDemo = formatTamperDemo;
 exports.runTamperDemo = runTamperDemo;
+exports.runBundleDemo = runBundleDemo;
+exports.formatBundleDemo = formatBundleDemo;
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const telemetry_ledger_1 = require("./telemetry-ledger");
 const telemetry_attestation_1 = require("./telemetry-attestation");
+const run_export_1 = require("./run-export");
+const state_1 = require("./state");
 const execution_backend_1 = require("./execution-backend");
 /** Human-facing render of `telemetry verify <run>`. */
 function formatTelemetryVerify(r) {
@@ -164,3 +168,118 @@ function runTamperDemo(options = {}) {
         layers.every((l) => l.before.verified && !l.after.verified && l.failures.length > 0);
     return { schemaVersion: 1, runId, workers: HOPS.length, trustKey: "ephemeral-ed25519", baseline, layers, proven };
 }
+function runBundleDemo(options = {}) {
+    const workdir = options.dir || node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), "cw-bundle-demo-"));
+    node_fs_1.default.mkdirSync(workdir, { recursive: true });
+    const runId = "demo-bundle-run";
+    const runDir = node_path_1.default.join(workdir, ".cw", "runs", runId);
+    const paths = (0, state_1.createRunPaths)(runDir);
+    (0, state_1.ensureRunDirs)(paths);
+    const { publicKey, privateKey } = node_crypto_1.default.generateKeyPairSync("ed25519");
+    const publicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
+    const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+    // Build a real signed ledger + a cited report, the way an attested run would.
+    const ledgerRun = { id: runId, paths };
+    for (const hop of HOPS) {
+        const ctx = { runId, taskId: hop.taskId, promptDigest: hop.promptDigest };
+        (0, telemetry_ledger_1.appendTelemetryAttestation)(ledgerRun, {
+            workerId: hop.workerId,
+            taskId: hop.taskId,
+            promptDigest: hop.promptDigest,
+            reportedUsage: hop.usage,
+            usageSignature: hop.attestation === "attested" ? (0, telemetry_attestation_1.signTelemetry)(hop.usage, privateKeyPem, ctx) : undefined,
+            attestation: hop.attestation,
+            now: DEMO_NOW
+        });
+    }
+    node_fs_1.default.writeFileSync(node_path_1.default.join(runDir, "report.md"), "# Architecture review\n\nRisk: src/server.js:18 — unauthenticated route.\n", "utf8");
+    const attestedCount = HOPS.filter((h) => h.attestation === "attested").length;
+    const fullRun = {
+        schemaVersion: 1, id: runId, createdAt: DEMO_NOW, updatedAt: DEMO_NOW, cwd: workdir,
+        workflow: { id: "demo", title: "Demo", summary: "", limits: { maxAgents: 1, maxConcurrentAgents: 1 } },
+        inputs: { question: "what are the risks?" }, loopStage: "interpret",
+        phases: [], tasks: [], dispatches: [], commits: [], paths, nodes: [], contracts: []
+    };
+    (0, state_1.saveCheckpoint)(fullRun);
+    const ledgerFile = (0, telemetry_ledger_1.telemetryLedgerPath)(ledgerRun);
+    const cleanLedger = node_fs_1.default.readFileSync(ledgerFile, "utf8");
+    const exportSealed = (out) => { (0, run_export_1.exportRun)(fullRun, out, { trustPublicKey: publicKeyPem }); };
+    // Baseline: a clean sealed bundle verifies offline; the embedded key reverifies
+    // every signed hop.
+    const cleanBundle = node_path_1.default.join(workdir, "clean.cwrun.json");
+    exportSealed(cleanBundle);
+    const clean = (0, run_export_1.verifyReportBundle)(cleanBundle);
+    const baseline = { ok: clean.ok, telemetryVerified: clean.telemetryVerified, signaturesReverified: clean.signaturesReverified };
+    const layers = [];
+    // CHAIN forgery: flip record[1]'s verdict and reseal its recordHash; record[2]'s
+    // prevHash still points at the original hash, so the chain breaks — even though
+    // every archive file digest (computed at export over the tampered bytes) is valid.
+    // This is exactly what inspect-archive alone cannot catch.
+    {
+        const j = JSON.parse(cleanLedger);
+        j.records[1].attestation = "attested";
+        const { recordHash: _drop, ...rest } = j.records[1];
+        j.records[1].recordHash = (0, telemetry_ledger_1.computeRecordHash)(rest);
+        node_fs_1.default.writeFileSync(ledgerFile, JSON.stringify(j, null, 2));
+        const forged = node_path_1.default.join(workdir, "forged-chain.cwrun.json");
+        exportSealed(forged);
+        const after = (0, run_export_1.verifyReportBundle)(forged);
+        node_fs_1.default.writeFileSync(ledgerFile, cleanLedger);
+        layers.push({
+            layer: "chain",
+            tamper: `forged record[1] verdict "unattested" -> "attested" and resealed its recordHash; the archive's own file digests stay valid`,
+            before: { ok: clean.ok, detail: `${clean.signaturesReverified} signed hop(s) reverify; chain intact` },
+            after: { ok: after.ok, detail: after.telemetryVerified ? "telemetry chain still verified (UNDETECTED!)" : "the embedded hash chain broke at the next record" },
+            failures: after.ok ? [] : after.failedChecks.map((c) => `${c.name}: ${c.code}`)
+        });
+    }
+    // SIGNATURE forgery: inflate the last attested hop's reported tokens and reseal its
+    // usage digest + recordHash so the chain AND archive digests still verify; only the
+    // ed25519 signature (over the original usage) no longer matches the inflated number.
+    {
+        const j = JSON.parse(cleanLedger);
+        const idx = j.records.length - 1;
+        j.records[idx].reportedUsage = { ...j.records[idx].reportedUsage, output_tokens: j.records[idx].reportedUsage.output_tokens * 10 };
+        j.records[idx].reportedUsageDigest = (0, telemetry_ledger_1.reportedUsageDigest)(j.records[idx].reportedUsage);
+        const { recordHash: _drop, ...rest } = j.records[idx];
+        j.records[idx].recordHash = (0, telemetry_ledger_1.computeRecordHash)(rest);
+        node_fs_1.default.writeFileSync(ledgerFile, JSON.stringify(j, null, 2));
+        const forged = node_path_1.default.join(workdir, "forged-sig.cwrun.json");
+        exportSealed(forged);
+        const after = (0, run_export_1.verifyReportBundle)(forged);
+        node_fs_1.default.writeFileSync(ledgerFile, cleanLedger);
+        layers.push({
+            layer: "signature",
+            tamper: `inflated the last attested hop's output_tokens 10x and resealed its digest + recordHash; the chain stays valid`,
+            before: { ok: clean.ok, detail: `the embedded public key reverifies the original signature` },
+            after: { ok: after.ok, detail: after.signaturesFailed > 0 ? `${after.signaturesFailed} signature(s) failed ed25519 reverify` : "signature still verified (UNDETECTED!)" },
+            failures: after.ok ? [] : after.failedChecks.map((c) => `${c.name}: ${c.code}`)
+        });
+    }
+    if (!options.keepDir && !options.dir)
+        node_fs_1.default.rmSync(workdir, { recursive: true, force: true });
+    const proven = baseline.ok &&
+        baseline.telemetryVerified &&
+        baseline.signaturesReverified === attestedCount &&
+        layers.every((l) => l.before.ok && !l.after.ok && l.failures.length > 0);
+    return { schemaVersion: 1, runId, workers: HOPS.length, trustKey: "ephemeral-ed25519", baseline, layers, proven };
+}
+function formatBundleDemo(r) {
+    const lines = [];
+    lines.push(`cw demo bundle — portable-bundle verification proof (hermetic, ${r.trustKey} key)`);
+    lines.push("");
+    lines.push(`▶ Exported a sealed report bundle: ${r.workers} hops, public key embedded`);
+    lines.push(`  ${r.baseline.ok ? "✓" : "✗"} bundle verifies offline   ${r.baseline.signaturesReverified} signed hop(s) reverify with only the embedded public key`);
+    for (const l of r.layers) {
+        lines.push("");
+        lines.push(`▶ ${l.layer.toUpperCase()} forgery`);
+        lines.push(`  edit:   ${l.tamper}`);
+        lines.push(`  before: ${l.before.ok ? "✓ verifies" : "✗"} — ${l.before.detail}`);
+        lines.push(`  after:  ${l.after.ok ? "✓ (UNDETECTED!)" : "✗ DETECTED"} — ${l.after.detail}`);
+    }
+    lines.push("");
+    lines.push(r.proven
+        ? "VERDICT: bundle verification holds ✓ — every forgery caught offline with only the bundle's embedded public key. No repo, no server, no key handed over."
+        : "VERDICT: PROOF FAILED ✗ — a forged bundle verified. This is a regression in the bundle guarantee.");
+    return lines.join("\n");
+}

package/dist/types/report-bundle.js

@@ -0,0 +1,6 @@
+"use strict";
+// Verifiable report bundle — result shapes shared across the run-export verifier,
+// the capability-core producer (reportBundle), and the quickstart auto-bundle field
+// on QuickstartResult. Kept in types/ (a leaf) so types/drive.ts can reference
+// ReportBundleResult without a types->core import cycle.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/types.js

@@ -28,6 +28,7 @@ __exportStar(require("./types/sandbox"), exports);
 __exportStar(require("./types/execution-backend"), exports);
 __exportStar(require("./types/boundary"), exports);
 __exportStar(require("./types/drive"), exports);
+__exportStar(require("./types/report-bundle"), exports);
 __exportStar(require("./types/multi-agent"), exports);
 __exportStar(require("./types/topology"), exports);
 __exportStar(require("./types/blackboard"), exports);

package/dist/version.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MIN_SUPPORTED_RUN_STATE_SCHEMA_VERSION = exports.LEGACY_RUN_STATE_SCHEMA_VERSION = exports.CURRENT_RUN_STATE_SCHEMA_VERSION = exports.WORKFLOW_APP_SCHEMA_VERSION = exports.CURRENT_COOL_WORKFLOW_VERSION = void 0;
-exports.CURRENT_COOL_WORKFLOW_VERSION = "0.1.84";
+exports.CURRENT_COOL_WORKFLOW_VERSION = "0.1.86";
 exports.WORKFLOW_APP_SCHEMA_VERSION = 1;
 exports.CURRENT_RUN_STATE_SCHEMA_VERSION = 1;
 exports.LEGACY_RUN_STATE_SCHEMA_VERSION = 0;

package/dist/workbench-host.js

@@ -99,14 +99,7 @@ class WorkbenchHost {
             }
             const runMatch = /^\/api\/run\/([^/]+)$/.exec(route);
             if (runMatch) {
-                const previousCwd = process.cwd();
-                process.chdir(this.cwd);
-                try {
-                    return this.send(res, 200, (0, workbench_1.buildWorkbenchRunView)(this.runner, runMatch[1]));
-                }
-                finally {
-                    process.chdir(previousCwd);
-                }
+                return this.send(res, 200, (0, workbench_1.buildWorkbenchRunView)(this.runner.withBaseDir(this.cwd), runMatch[1]));
             }
             this.send(res, 404, { error: `no such read-only view: ${route}` });
         }

package/docs/agent-delegation-drive.7.md

@@ -128,6 +128,7 @@ node dist/cli.js backend agent config            # show the effective config (se
 node dist/cli.js backend probe agent --json      # ready iff configured, else unverified
 
 # drive a real repo end-to-end (zero hand-written result.md)
+node dist/cli.js quickstart architecture-review --check --repo /path/to/repo --question "Is the design sound?" --agent-command "node $(pwd)/scripts/agents/claude-p-agent.js {{input}} {{result}}"
 node dist/cli.js run architecture-review --drive --repo /path/to/repo --question "Is the design sound?"
 node dist/cli.js run architecture-review --drive --once --repo /path/to/repo --question "..."   # one step
 node dist/cli.js run drive <run-id> --json       # read-only preview of the next step
@@ -135,12 +136,22 @@ node dist/cli.js run drive <run-id> --json       # read-only preview of the next
 # quickstart --resume: a guided stop-then-resume a newcomer can WITNESS in <5 min
 node dist/cli.js quickstart --resume --repo /path/to/repo --question "..."   # advances ONE step, prints a continue line
 node dist/cli.js quickstart --run <run-id> --resume                          # continues that run to completion
+node dist/cli.js quickstart --run <run-id> --resume --bundle                  # continues, then seals a completed run
 ```
 
+`quickstart --check` is a zero-write preflight. It does not make a run, write
+`.cw/`, call the agent, write a report, or commit. It checks the app id, repo,
+question, agent config, and (with `--bundle`) the trust-key shape, then gives the
+next command to run. A blocked check exits non-zero, so scripts may use it as a
+gate before a real run.
+
 `quickstart --resume` with no `--run` drives a single step and prints a
 copy-pasteable `cw quickstart --run <id> --resume` continue line; run it again with
 the `--run <id>` to finish. The continuing invocation echoes `resumedFrom: <id>`.
 Bare `quickstart` (no `--resume`) is unchanged — it drives straight to the end.
+When `--bundle` is present on the fresh resume step, no bundle is sealed until
+the run is complete; the continue line keeps `--bundle` so the second command
+finishes and seals the report.
 
 For faster first results, use the opt-in fast app in place of changing the full
 review contract:
@@ -171,9 +182,15 @@ an Assess cache hit. A cache hit still goes through `recordWorkerOutput`
 validation; a corrupt cached result parks/fails closed rather than spawning a
 quiet fallback.
 
+Verify and Verdict also get the source-context instruction so they do not have to
+start by scanning the repo again. They are not result-cached; they still have to
+cite evidence and make the final check from the accepted Map and Assess work.
+
 `--metrics` is diagnostic and opt-in. It adds elapsed milliseconds, step counts,
-agent-spawn counts, and `result-cache` hit counts to the wrapper JSON payload;
-without it, the wrapper's default output shape stays unchanged.
+agent-spawn counts, `result-cache` hit counts, source-context bytes/digest, and
+one row per driven task with phase, task id, elapsed time, and spawn/cache state
+to the wrapper JSON payload; without it, the wrapper's default output shape stays
+unchanged.
 
 `{{manifest}}`, `{{input}}`, `{{result}}`, `{{workerDir}}`, `{{model}}`, and
 `{{prompt}}` are put into DISCRETE argv elements (never a shell-interpreted
@@ -270,3 +287,7 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85
+
+0.1.86

package/docs/cli-mcp-parity.7.md

@@ -64,6 +64,16 @@ ISO timestamps from the moment of generation. The `--json` payload is the
 contract, and it is the same bytes the MCP tool gives back. The human text view
 is policy put on top; it never changes the payload.
 
+Some payload checks need more than `cwd` or `runId`. The registry may name a
+scenario probe for a safe local case. A scenario gets two new temp workspaces,
+one for CLI and one for MCP, sets up the same state, runs one capability through
+each door, and then compares the payload after taking out temp roots, run ids,
+time stamps, and chain hashes that are made by that workspace. This is used for
+local deterministic work such as app show/validate/package, topology
+show/validate/apply/summary/graph, sandbox show/validate/choose/resolve, state
+summary refresh/show, `plan`, `approve`, `reject`, `comment.add`, `handoff`, and
+`review.policy`.
+
 ## The Parity Matrix
 
 The matrix below is made from the live registry — one row per capability,
@@ -72,7 +82,7 @@ relationship. `identical` means `cw <cmd> --json` is equal to the `cw_<tool>`
 payload; `projected` means a declared divergence with a reason; `cli-only` marks
 a surface-specific capability with a recorded reason. The matrix is
 <!-- gen:parity:count -->
-machine-complete by design: 190 capabilities, 184 MCP tools.
+machine-complete by design: 193 capabilities, 186 MCP tools.
 <!-- /gen:parity:count -->
 
 <!-- gen:parity:table -->
@@ -236,6 +246,8 @@ machine-complete by design: 190 capabilities, 184 MCP tools.
 | `run.import` | `cw run import` | `cw_run_import` | `runImportArchive` | both | identical |
 | `run.verify-import` | `cw run verify-import` | `cw_run_verify_import` | `runVerifyImport` | both | identical |
 | `run.inspect-archive` | `cw run inspect-archive` | `cw_run_inspect_archive` | `runInspectArchive` | both | identical |
+| `report.verify-bundle` | `cw report verify-bundle` | `cw_report_verify_bundle` | `runVerifyReportBundle` | both | identical |
+| `report.bundle` | `cw report bundle` | `cw_report_bundle` | `reportBundle` | both | identical |
 | `run.drive` | `cw run drive` | `cw_run_drive` | `runDrivePreview` | both | identical |
 | `run.drive.step` | `cw run drive` | `cw_run_drive_step` | `runDrive` | both | projected |
 | `quickstart` | `cw quickstart` | `—` | `quickstart` | cli-only | cli-only |
@@ -256,6 +268,7 @@ machine-complete by design: 190 capabilities, 184 MCP tools.
 | `gc.verify` | `cw gc verify` | `cw_gc_verify` | `gcVerify` | both | identical |
 | `telemetry.verify` | `cw telemetry verify` | `cw_telemetry_verify` | `telemetryVerify` | both | identical |
 | `demo.tamper` | `cw demo tamper` | `—` | `demoTamper` | cli-only | cli-only |
+| `demo.bundle` | `cw demo bundle` | `—` | `demoBundle` | cli-only | cli-only |
 | `history` | `cw history` | `cw_history` | `runRegistry.history` | both | identical |
 | `workbench.view` | `cw workbench view` | `cw_workbench_view` | `buildWorkbenchRunView` | both | identical |
 | `workbench.serve` | `cw workbench serve` | `cw_workbench_serve` | `buildWorkbenchServeDescriptor` | both | projected |
@@ -282,14 +295,15 @@ A capability may be on one surface only, but never without word of it — it mus
 carry a recorded reason in the registry.
 
 <!-- gen:parity:cliOnly -->
-Six capabilities are CLI-only:
+Seven capabilities are CLI-only:
 
 - `help` — Human help text. MCP hosts enumerate capabilities via tools/list, not a help command.
 - `doctor` — Environment diagnostics are inherently local to the CLI host — Node version, $PATH, $CW_HOME/cwd writability. An MCP client diagnosing the server process's environment is not meaningful; agents already receive the same readiness facts in their typed results (e.g. status: blocked, agentConfigured). Inspired by `brew doctor`.
 - `loop` — Convenience alias of `schedule create` with kind=loop. MCP hosts use cw_schedule_create with kind=loop.
 - `schedule daemon` — Long-running desktop daemon process, not a request/response tool. MCP hosts drive ticks via cw_schedule_due + cw_schedule_run_now.
-- `quickstart` — CLI UX convenience layer (newcomer first value in one command) over the existing run.drive.step + report verbs; it spawns nothing new and delegates worker execution to the operator's agent backend. MCP hosts compose the same outcome from cw_run_drive_step + cw_report. `audit-run` is a CLI-only alias of the same wrapper.
+- `quickstart` — CLI UX convenience layer (newcomer first value in one command) over the existing run.drive.step + report verbs; it spawns nothing new and delegates worker execution to the operator's agent backend. MCP hosts compose the same outcome from cw_run_drive_step + cw_report (+ cw_report_bundle for --bundle). `audit-run` is a CLI-only alias of the same wrapper.
 - `demo tamper` — Human-facing demonstration (operator/newcomer onboarding); the underlying integrity check is exposed programmatically as the both-surface telemetry.verify. No agent or MCP client needs to invoke a demo.
+- `demo bundle` — Human-facing demonstration (operator/newcomer onboarding); the underlying integrity check is exposed programmatically as the both-surface report.verify-bundle. No agent or MCP client needs to invoke a demo.
 <!-- /gen:parity:cliOnly -->
 
 <!-- gen:parity:projected -->
@@ -328,10 +342,23 @@ of the rules above.
 registry ⇄ CLI ⇄ MCP coverage (every declared capability is found on its declared
 surfaces and nothing live is undeclared), makes sure `--json` output is equal to
 the MCP payload for every `payloadIdentical` capability, makes sure of the
-declared `commit` projection, and makes sure of fail-closed behavior by putting in
-drift — a peer taken away, an undeclared tool, an exception with no reason, a
-changed payload — and checking that the gate says no to each one. It is part of
-`npm test` and `npm run release:check`.
+declared `commit` projection, checks that safe write/multi-argument capabilities
+are named scenario probes rather than deferred work, and makes sure of
+fail-closed behavior by putting in drift — a peer taken away, an undeclared tool,
+an exception with no reason, a bad probe classification, a changed payload — and
+checking that the gate says no to each one. It is part of `npm test` and
+`npm run release:check`.
+
+The scenario probes now cover local worker/candidate/feedback read and write
+paths. They make temp runs, send out a worker, write a fixed `result.md`, score
+and pick a candidate, and make feedback from local state. No outside agent is
+run; the probe checks only that CLI and MCP carry the same JSON to the same CW
+core.
+
+They also cover local state-node read, snapshot, diff, replay, and replay-check
+paths from the same temp run. Snapshot and replay ids are made by CW, so the
+parity check sets aside only those made ids and timestamps before it compares the
+JSON.
 
 In CW, parity is not a custom; it is a built, declared, and kept property of the
 build. It is not done till it is put in the docs and tested.
@@ -466,3 +493,7 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85
+
+0.1.86

package/docs/contract-migration-tooling.7.md

@@ -141,3 +141,7 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85
+
+0.1.86

package/docs/control-plane-scheduling.7.md

@@ -125,3 +125,7 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85
+
+0.1.86

package/docs/dogfood-one-real-repo.7.md

@@ -89,12 +89,20 @@ report, and audit tools.
 
 ```bash
 node test/dogfood-release-smoke.js
+node test/dogfood-architecture-review-smoke.js
 ```
 
 The smoke test runs `scripts/dogfood-release.js --smoke --json`. It still
 uses the real repository, `release-cut`, worker manifests, trust audit records,
 candidate scoring, selection, verifier-gated commit, and a report, but keeps the
-command set smaller so it does not do recursive release checking.
+command set smaller so it does not do recursive release checking. Smoke mode
+does not run `canonical-apps` or `golden-path`; `npm test` runs those checks as
+separate smokes.
+
+The architecture-review smoke runs beside it. That smoke uses a stub agent to
+drive the real `architecture-review` app to a report and audit proof. Keeping it
+as a second smoke lets the parallel gate run both dogfood halves at the same
+time while keeping the same proof.
 
 ## Promote To Real Release Actions
 

package/docs/durable-state-and-locking.7.md

@@ -124,3 +124,7 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85
+
+0.1.86

package/docs/evidence-adoption-reasoning-chain.7.md

@@ -285,3 +285,7 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85
+
+0.1.86

package/docs/execution-backends.7.md

@@ -315,3 +315,7 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## Privacy Release (v0.1.84)
 
 No other change to this page in v0.1.84.
+
+0.1.85
+
+0.1.86

package/docs/getting-started.md

@@ -17,6 +17,8 @@ start a run:
 ```bash
 node scripts/cw.js doctor          # human-readable
 node scripts/cw.js doctor --json   # stable payload for scripts
+node scripts/cw.js doctor --onramp # short path for users and code work
+node scripts/cw.js doctor --onramp --changed-from origin/main
 ```
 
 It checks the Node version (v18+), whether an agent backend is set up (and its
@@ -26,6 +28,22 @@ read-only — it makes nothing on disk. It exits non-zero only on a blocking
 problem; a missing agent is a warning (you are still able to run `demo` and
 `--preview`).
 
+Use `--onramp` when you are not certain what to do next. It keeps the main path
+small:
+
+1. `cw demo tamper` - prove the trust check with no agent.
+2. `cw quickstart architecture-review --check ...` - check a real run with no
+   writes.
+3. `cw quickstart architecture-review ...` - make the report.
+4. `cw quickstart architecture-review ... --bundle` - make a portable report
+   file for another person.
+5. `cw report verify-bundle report.cwrun.json` - check that file offline.
+6. `npm run test:fast` - use the fast code check while you work.
+7. `npm run release:check` - use the full gate only when the batch is ready.
+
+Add `--changed-from origin/main` in a source checkout to get the nearest smoke
+tests and guard checks for your current change.
+
 Make a run with a canonical workflow app:
 
 ```bash
@@ -73,17 +91,37 @@ node scripts/cw.js eval report .cw/evals/<suite-id>/replay-run.json
 node scripts/cw.js report <run-id> --show
 ```
 
-Run the deterministic regression commands. They give the same result every time:
+Run the smallest check that fits the change:
 
 ```bash
 npm run check
-npm test
+npm run build
+node test/<nearest-smoke>.js
+npm run onramp:check
+npm run test:fast
+npm test                    # slow serial backstop
 npm run canonical-apps
 npm run golden-path
 npm run eval:replay
 npm run fixture-compat
 ```
 
+When a test run is slow, make a read-only timing report:
+
+```bash
+npm run test:ci -- --json-summary /tmp/cw-test-summary.json
+```
+
+Use the `slowest` list in that file to choose one test-speed cycle. This is a
+guide, not a release gate.
+
+For a CLI or MCP surface change, also run:
+
+```bash
+npm run parity:check
+npm run gen:manifests -- --check
+```
+
 Before you cut a release, run the full dry-run gate:
 
 ```bash