cool-workflow 0.1.86 → 0.1.88

package/docs/release-tooling.7.md

@@ -205,6 +205,14 @@ an ungated tag gives a plain caveat instead and warns on stderr — the notes ne
 claim a review that is not there. Test seam: `CW_RELEASE_FLOW_GH_CMD` puts a stub in place of the `gh`
 binary (spawned `shell:false`) so the smoke runs it offline.
 
+### npm publishing trust
+
+The `npm-publish` GitHub Action uses npm Trusted Publishing. GitHub gives the
+job a short OIDC token, npm checks that the request is from this repo and
+workflow, and npm adds provenance for the package. The workflow does not use a
+long-lived `NPM_TOKEN`, so no publish token with two-factor bypass is kept in
+GitHub secrets.
+
 0.1.51
 
 0.1.76
@@ -231,3 +239,11 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 0.1.85
 
 0.1.86
+
+## 0.1.87 (v0.1.87)
+
+npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+The release flow now captures the reviewer's verdict from agent stdout (`release-flow.js`), so the cut records the gate decision deterministically instead of relying on a hand-entered verdict; the kernel runtime stays untouched.

package/docs/report-verifiable-bundle.7.md

@@ -67,10 +67,42 @@ The POLICY is fail-closed and self-describing:
   with an embedded key verifies the same on any machine; the override/env only
   apply when the bundle omits a key.
 - `ok` is true only when the archive bytes, the telemetry chain, and the
-  trust-audit chain all verify AND no attested signature failed re-verification.
+  trust-audit chain all verify, no attested signature failed re-verification, AND
+  the report ⇄ result cross-check holds.
+- **Report ⇄ result ⇄ signature cross-check** (`reportFindingsVerified`) — the
+  FORWARD guarantee: every SIGNED finding is present in the report and unaltered.
+  Driven by the signature-verified, result-COVERING ledger records (not the archive's
+  `run.tasks` list, which is bound by nothing). For each such record: (1) its
+  `resultDigest` is anchored by the executor's ed25519 signature — a usage-only
+  (4-field) signature is excluded, so an injected digest is never trusted
+  (`coversResult` required); (2) the matching completed task's **restored result file
+  must hash to that signed digest** (`result-missing` / `result-digest-mismatch:<task>`
+  otherwise) — so an edited, missing, dropped, or substituted result is caught because
+  the signed digest does not move; (3) `report.md` embeds the result at the task's own
+  `### <taskId>` section, body-first (`report-result-mismatch:<task>` otherwise) — so
+  an edited report, or a decoy copy buried elsewhere, fails. Editing the report breaks
+  (3); editing the result breaks (2); editing **both** to one consistent lie still
+  breaks (2). Any failure ⇒ `report-findings`, `ok:false`.
+- **Scope (read this).** The guarantee is FORWARD only: each of the agent's *signed*
+  findings is in the report unaltered. It does **not** assert the report contains
+  *only* signed findings. CW holds no key to sign the rendered report (it delegates;
+  it never signs), and the telemetry ledger chain is self-recomputable, so the report
+  MAY carry additional **unsigned content** — prose, an executive summary, ordering,
+  or extra sections — and a determined local re-chainer can **omit** a signed finding
+  (a shorter, self-consistent history). Verify the findings you act on against the
+  signed results; do not read more into a green verdict than "the signed findings are
+  present and unaltered." Closing report-completeness fully needs an external
+  append-only anchor (declined by design here); see the [Trust Model](trust-model.md).
+- **Trust level** (`trustLevel`): `"signed"` means the agent's signed findings are
+  present and unaltered — at least one **result-covering** signature re-verified
+  against a key, none failed, and the forward cross-check held. A usage-only (4-field)
+  signature, an unverifiable one (no key), or a tampered signed finding all yield
+  `"unsigned"`. It attests the signed findings, **not** report exhaustiveness.
 - A bundle with attested telemetry but no available key DEGRADES by default
   (`signatureKeyProvided: false`, the intact chain still decides `ok`).
-  `--strict-signatures` refuses such a bundle instead.
+  `--strict-signatures` refuses such a bundle instead. `--require-signatures` is
+  stronger: it refuses any bundle whose `trustLevel` is `"unsigned"` (closing the
+  fail-open where an unsigned-but-intact bundle returned `ok: true`).
 - `--extract-report <path>` writes the bundle's `report.md` out for a human to
   read alongside the machine verdict. If extraction is requested but the bundle
   has no `report.md` (or the write fails), that is a failure, not a silent no-op:

package/docs/run-registry-control-plane.7.md

@@ -177,6 +177,16 @@ whose top-level integrity block is *absent* — closing the legacy fail-open sea
 where a stripped-integrity archive imported unverified. Unset (the default) keeps
 legacy integrity-less archives byte-identical; the flag is mechanism, not policy.
 
+The archive's run id becomes a directory name under `DIR/.cw/runs/`, so import
+also refuses any run id that is not a single safe path segment (`[A-Za-z0-9._-]`,
+with no separator and not the `.` or `..` component) and asserts the resolved run
+directory stays inside the target's runs root — both *before* the directory is
+made — so a crafted id such as `../../etc` can never write outside the runs tree.
+(An embedded `..` such as `v1..2` is a safe directory name, not a traversal, and
+is allowed so a legitimately-minted run id always round-trips.) The same refusal
+protects `cw report verify-bundle`, which restores an untrusted bundle into a
+throwaway temporary directory.
+
 `run verify-import <run-id> [--cwd DIR]` reads the restore manifest again, works out
 every restored file digest again, checks the manifest digest, checks the telemetry
 ledger when one was restored, and proves the **trust-audit hash chain** again (the
@@ -412,3 +422,11 @@ No other change to this page in v0.1.84.
 0.1.85
 
 0.1.86
+
+## 0.1.87 (v0.1.87)
+
+npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+Security: archive import now refuses path-traversal run ids (`..`/absolute/separator-bearing ids) before any run dir is minted, closing a write-outside-the-registry vector; run resolution and the run-state schema are otherwise unchanged.

package/docs/run-retention-reclamation.7.md

@@ -212,3 +212,11 @@ No other change to this page in v0.1.84.
 0.1.85
 
 0.1.86
+
+## 0.1.87 (v0.1.87)
+
+npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+_No behavioral change in v0.1.88 (the tiered, append-only, cryptographically-verifiable reclamation transition is unchanged)._

package/docs/state-explosion-management.7.md

@@ -290,3 +290,11 @@ No other change to this page in v0.1.84.
 0.1.85
 
 0.1.86
+
+## 0.1.87 (v0.1.87)
+
+npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+_No behavioral change in v0.1.88 (the summarization/compaction layer and its fail-closed derived summaries are untouched)._

package/docs/team-collaboration.7.md

@@ -226,3 +226,11 @@ No other change to this page in v0.1.84.
 0.1.85
 
 0.1.86
+
+## 0.1.87 (v0.1.87)
+
+npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+_No behavioral change in v0.1.88 (the host-attested actor, append-only approvals/comments/handoffs, and the review gate that stacks on the verifier gate are unchanged)._

package/docs/trust-model.md

@@ -249,10 +249,12 @@ than the math will back up.
   signature mismatches fail closed. Mirrored as `cw_telemetry_verify` on the MCP
   surface.
 - `cw demo tamper` — a sealed, offline, one-command proof: it builds a real
-  ed25519-signed ledger and then fakes it two ways — flips a recorded verdict and
-  works out the *local* record hash again (the chain still breaks), and uses a
-  signature again over blown-up tokens (ed25519 turns it down). Everything is checked with
-  the public key only. The `✗ DETECTED` lines are the point.
+  ed25519-signed ledger and then fakes it three ways — flips a recorded verdict and
+  works out the *local* record hash again (the chain still breaks), uses a
+  signature again over blown-up tokens (ed25519 turns it down), and edits a signed
+  finding after signing so the re-derived sha256(result) no longer joins the
+  signature (the verify turns it down). Everything is checked with the public key
+  only. The `✗ DETECTED` lines are the point.
 - Re-run either with **only the public key** on a machine we do not control. If it
   does not come out the same, our integrity claim is false — hold us to it.
 

package/docs/web-desktop-workbench.7.md

@@ -234,3 +234,11 @@ No other change to this page in v0.1.84.
 0.1.85
 
 0.1.86
+
+## 0.1.87 (v0.1.87)
+
+npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+_No behavioral change in v0.1.88 (the five operator surfaces and the registry cross-run entry are unchanged; the Workbench still derives everything from state the CLI/MCP already expose)._

package/manifest/plugin.manifest.json

@@ -2,7 +2,7 @@
   "_comment": "SINGLE SOURCE OF TRUTH for every vendor manifest. Edit THIS file, then run `npm run gen:manifests`. Do NOT hand-edit the generated vendor manifests (.claude-plugin/, .codex-plugin/, .agents/, .mcp.json) — `npm run gen:manifests -- --check` (run by release:check) will fail if they drift from this source.",
   "identity": {
     "name": "cool-workflow",
-    "version": "0.1.86",
+    "version": "0.1.88",
     "license": "BSD-2-Clause",
     "homepage": "https://github.com/coo1white/cool-workflow",
     "author": {

package/manifest/source-context-profiles.json

@@ -25,7 +25,7 @@
     },
     "runtime": {
       "description": "Runtime-kernel source context for state, orchestration, scheduling, execution, and shared types.",
-      "maxLines": 43000,
+      "maxLines": 44000,
       "include": [
         "plugins/cool-workflow/src/**",
         "plugins/cool-workflow/package.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.86",
+  "version": "0.1.88",
   "bin": {
     "cool-workflow": "scripts/cw.js",
     "cw": "scripts/cw.js"
@@ -16,6 +16,9 @@
   },
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
   "type": "commonjs",
+  "engines": {
+    "node": ">=18"
+  },
   "license": "BSD-2-Clause",
   "author": {
     "name": "COOLWHITE LLC"
@@ -57,10 +60,10 @@
     "onramp:check": "node scripts/onramp-check.js --check",
     "version:sync": "node scripts/version-sync-check.js",
     "release:check": "node scripts/release-check.js",
-    "test": "node dist/cli.js list && node test/run-all.js",
-    "test:fast": "npm run build --if-present && node dist/cli.js list && node test/run-all.js --concurrency auto",
-    "test:ci": "node dist/cli.js list && node test/run-all.js --concurrency auto",
-    "test:coverage": "node dist/cli.js list && node scripts/coverage-gate.js --concurrency auto",
+    "test": "node dist/cli.js version > /dev/null && node test/run-all.js",
+    "test:fast": "npm run build --if-present && node dist/cli.js version > /dev/null && node test/run-all.js --concurrency auto",
+    "test:ci": "node dist/cli.js version > /dev/null && node test/run-all.js --concurrency auto",
+    "test:coverage": "node dist/cli.js version > /dev/null && node scripts/coverage-gate.js --concurrency auto",
     "eval:replay": "tsc -p tsconfig.json && node test/multi-agent-eval-replay-harness-smoke.js",
     "ci": "npm run build && npm run check && npm run test && npm run release:check",
     "validate:schema": "node scripts/validate-run-state-schema.js"

package/scripts/agents/agent-adapter-core.js

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+"use strict";
+
+const fs = require("node:fs");
+
+const RESULT_CONTRACT = `
+=== HOW TO RETURN YOUR ANSWER (overrides any 'write to result.md' instruction above) ===
+You have NO file-write access. Do NOT attempt to write, create, or edit any file -
+result.md is persisted FOR YOU from your final message, so writing it yourself is
+neither needed nor possible. Use ONLY read-only tools (read files, grep, list).
+Respond with ONLY your FINAL answer as Markdown, and it MUST END WITH a fenced
+cw:result block that EXACTLY follows this schema:
+
+\`\`\`cw:result
+{
+  "summary": "one-paragraph direct answer",
+  "findings": [
+    {
+      "id": "unique-kebab-id",
+      "title": "short risk title",
+      "severity": "P0",
+      "classification": "real",
+      "evidence": ["path/to/file.ts:42"]
+    }
+  ],
+  "evidence": ["path/to/file.ts:42", "path/to/other.ts:10"]
+}
+\`\`\`
+
+HARD RULES (the result is REJECTED otherwise):
+- Every object in "findings" MUST have a unique "id" (non-empty string).
+- "classification", if present, MUST be one of: real, conditional, non-issue, unknown.
+- Any finding with "severity" P0, P1, or P2 MUST include a NON-EMPTY "evidence" array.
+- The top-level "evidence" array MUST be NON-EMPTY with REAL file:line locators from this repo.
+- If you have no structured findings, use "findings": [] (empty) - never omit a finding's id.`;
+
+function buildPrompt(inputPath) {
+  return `${fs.readFileSync(inputPath, "utf8")}\n${RESULT_CONTRACT}`;
+}
+
+function streamEnabled(env = process.env) {
+  return env.CW_AGENT_STREAM !== "0" && env.CW_NO_STREAM !== "1";
+}
+
+function traceEnabled(env = process.env, stderr = process.stderr) {
+  return streamEnabled(env) && Boolean(stderr.isTTY);
+}
+
+function trace(line, env = process.env, stderr = process.stderr) {
+  if (!traceEnabled(env, stderr)) return;
+  stderr.write(`${line}\n`);
+}
+
+function shortText(value, max = 100) {
+  const text = String(value || "").replace(/\s+/g, " ").trim();
+  if (!text) return "";
+  return text.length > max ? `${text.slice(0, max - 3)}...` : text;
+}
+
+function maybeObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+
+function firstString(...values) {
+  for (const value of values) if (typeof value === "string" && value.trim()) return value.trim();
+  return undefined;
+}
+
+function firstObject(...values) {
+  for (const value of values) {
+    const obj = maybeObject(value);
+    if (obj) return obj;
+  }
+  return undefined;
+}
+
+function modelFromEvent(ev) {
+  const msg = maybeObject(ev.message);
+  return firstString(ev.model, ev.model_id, ev.modelId, msg && msg.model, ev.provider_model);
+}
+
+function usageFromEvent(ev) {
+  const msg = maybeObject(ev.message);
+  return firstObject(ev.usage, ev.token_usage, ev.tokenUsage, msg && msg.usage);
+}
+
+function toolNameFromEvent(ev) {
+  const item = maybeObject(ev.item);
+  const call = maybeObject(ev.tool_call || ev.toolCall);
+  return firstString(ev.name, ev.tool, ev.tool_name, ev.toolName, item && item.name, call && call.name);
+}
+
+function toolArgFromEvent(ev) {
+  const input = maybeObject(ev.input) || maybeObject(ev.arguments) || maybeObject(ev.args) || maybeObject(ev.item && ev.item.input);
+  if (!input) return "";
+  return firstString(input.file_path, input.path, input.pattern, input.command, input.query, input.url, input.cmd) || "";
+}
+
+function textFromEvent(ev) {
+  const delta = maybeObject(ev.delta);
+  const msg = maybeObject(ev.message);
+  return firstString(ev.text, ev.delta, ev.content, ev.output, delta && delta.text, msg && msg.content);
+}
+
+function renderJsonEvent(provider, ev, state) {
+  if (!ev || typeof ev !== "object") return;
+  const model = modelFromEvent(ev);
+  if (model && !state.model) state.model = model;
+  const usage = usageFromEvent(ev);
+  if (usage) state.usage = usage;
+
+  const type = String(ev.type || ev.event || ev.kind || "");
+  const toolName = toolNameFromEvent(ev);
+  if (toolName || /tool|command/i.test(type)) {
+    const arg = shortText(toolArgFromEvent(ev), 80);
+    trace(`  -> ${toolName || type}${arg ? ` ${arg}` : ""}`);
+    return;
+  }
+
+  const text = textFromEvent(ev);
+  if (text && /assistant|message|delta|text|response|output/i.test(type || "text")) {
+    trace(`  ${shortText(text, 240)}`);
+  } else if (/turn|step|summary|status/i.test(type)) {
+    const status = firstString(ev.status, ev.status_detail, ev.summary, ev.message);
+    if (status) trace(`  . ${provider}: ${shortText(status, 160)}`);
+  }
+}
+
+function parseJsonLines(provider, chunk, state, onLine) {
+  state.buffer = `${state.buffer || ""}${chunk}`;
+  let nl;
+  while ((nl = state.buffer.indexOf("\n")) >= 0) {
+    const line = state.buffer.slice(0, nl).trim();
+    state.buffer = state.buffer.slice(nl + 1);
+    if (!line) continue;
+    if (onLine) onLine(line);
+    let ev;
+    try {
+      ev = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    renderJsonEvent(provider, ev, state);
+  }
+}
+
+function flushJsonLines(provider, state, onLine) {
+  const line = String(state.buffer || "").trim();
+  state.buffer = "";
+  if (!line) return;
+  if (onLine) onLine(line);
+  try {
+    renderJsonEvent(provider, JSON.parse(line), state);
+  } catch {
+    /* ignore incomplete/non-JSON tail */
+  }
+}
+
+function writeResult(resultPath, resultText) {
+  if (typeof resultText !== "string" || !resultText.trim()) {
+    throw new Error("agent produced no final result");
+  }
+  fs.writeFileSync(resultPath, resultText, "utf8");
+}
+
+function emitReport(model, usage, resultText) {
+  process.stdout.write(JSON.stringify({ model, usage, result: resultText }));
+}
+
+module.exports = {
+  RESULT_CONTRACT,
+  buildPrompt,
+  streamEnabled,
+  traceEnabled,
+  trace,
+  parseJsonLines,
+  flushJsonLines,
+  writeResult,
+  emitReport
+};

package/scripts/agents/builtin-templates.json

@@ -2,6 +2,10 @@
   "schemaVersion": 1,
   "comment": "Builtin agent-delegation templates as DATA, not a hand-edited kernel TS literal (FreeBSD-audit L15). Each entry maps a vendor name to the wrapper script in THIS directory that `builtin:<name>` (or CW_AGENT_COMMAND=builtin:<name>) resolves to. Adding a vendor is a content/distribution step: drop a wrapper script here + add a line below — NO kernel edit. Still pure config: the wrapper is an out-of-process delegation script; CW never imports or calls a model API.",
   "templates": {
-    "claude": "claude-p-agent.js"
+    "claude": "claude-p-agent.js",
+    "codex": "codex-agent.js",
+    "gemini": "gemini-agent.js",
+    "opencode": "opencode-agent.js",
+    "deepseek": "opencode-agent.js"
   }
 }

package/scripts/agents/claude-p-agent.js

@@ -29,6 +29,11 @@
 
 const fs = require("node:fs");
 const { spawn, spawnSync } = require("node:child_process");
+// Share the ONE canonical result contract with the codex/gemini/opencode
+// wrappers instead of carrying a private copy. A drifted inline copy (ASCII
+// hyphens silently became em-dashes here) meant claude was sent a different
+// instruction text than the other providers for the same contract.
+const { buildPrompt } = require("./agent-adapter-core");
 
 const inputPath = process.argv[2];
 const resultPath = process.argv[3];
@@ -37,39 +42,8 @@ if (!inputPath || !resultPath) {
   process.exit(2);
 }
 
-const CONTRACT = `
-=== HOW TO RETURN YOUR ANSWER (overrides any 'write to result.md' instruction above) ===
-You have NO file-write access. Do NOT attempt to write, create, or edit any file —
-result.md is persisted FOR YOU from your final message, so writing it yourself is
-neither needed nor possible. Use ONLY read-only tools (read files, grep, list).
-Respond with ONLY your FINAL answer as Markdown, and it MUST END WITH a fenced
-cw:result block that EXACTLY follows this schema:
-
-\`\`\`cw:result
-{
-  "summary": "one-paragraph direct answer",
-  "findings": [
-    {
-      "id": "unique-kebab-id",
-      "title": "short risk title",
-      "severity": "P0",
-      "classification": "real",
-      "evidence": ["path/to/file.ts:42"]
-    }
-  ],
-  "evidence": ["path/to/file.ts:42", "path/to/other.ts:10"]
-}
-\`\`\`
-
-HARD RULES (the result is REJECTED otherwise):
-- Every object in "findings" MUST have a unique "id" (non-empty string).
-- "classification", if present, MUST be one of: real, conditional, non-issue, unknown.
-- Any finding with "severity" P0, P1, or P2 MUST include a NON-EMPTY "evidence" array.
-- The top-level "evidence" array MUST be NON-EMPTY with REAL file:line locators from this repo.
-- If you have no structured findings, use "findings": [] (empty) — never omit a finding's id.`;
-
-const prompt = `${fs.readFileSync(inputPath, "utf8")}\n${CONTRACT}`;
-const streamEnabled = process.env.CW_AGENT_STREAM === "1" && process.env.CW_NO_STREAM !== "1";
+const prompt = buildPrompt(inputPath);
+const streamEnabled = process.env.CW_AGENT_STREAM !== "0" && process.env.CW_NO_STREAM !== "1";
 const traceEnabled = streamEnabled && Boolean(process.stderr.isTTY);
 
 if (!streamEnabled) {

package/scripts/agents/codex-agent.js

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+"use strict";
+
+// codex-agent.js - Codex CLI adapter for CW Agent Delegation Drive.
+//
+// This is a CONFIG wrapper, not a CW runtime dependency. CW spawns this script
+// out-of-process; this script spawns `codex exec` out-of-process. Vendor JSONL
+// parsing stays here in userland policy. CW core only captures stdout and, when
+// opted in, forwards stderr.
+//
+// Contract:
+//   argv[2] = {{input}}   worker input.md
+//   argv[3] = {{result}}  worker result.md to persist
+//
+// stdout: one JSON object { model, usage, result } for CW provenance.
+// stderr: optional live trace when CW_AGENT_STREAM=1 and attached to a TTY.
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawn } = require("node:child_process");
+const {
+  buildPrompt,
+  emitReport,
+  flushJsonLines,
+  parseJsonLines,
+  trace,
+  writeResult
+} = require("./agent-adapter-core");
+
+const inputPath = process.argv[2];
+const resultPath = process.argv[3];
+if (!inputPath || !resultPath) {
+  process.stderr.write("usage: codex-agent.js <inputPath> <resultPath>  (CW substitutes {{input}} {{result}})\n");
+  process.exit(2);
+}
+
+const finalPath = path.join(path.dirname(resultPath), `.codex-last-message-${process.pid}.md`);
+try {
+  fs.rmSync(finalPath, { force: true });
+} catch {
+  /* best effort */
+}
+
+const prompt = buildPrompt(inputPath);
+const state = { provider: "codex", buffer: "", model: undefined, usage: undefined };
+const capturedStdout = [];
+let childStderr = "";
+function recordJsonLine(line) {
+  capturedStdout.push(line);
+  try {
+    JSON.parse(line);
+  } catch {
+    state.invalidJson = true;
+  }
+}
+
+trace("* codex: reading the repo (read-only)...");
+
+const args = [
+  "exec",
+  "--json",
+  "--output-last-message",
+  finalPath,
+  "--sandbox",
+  "read-only",
+  "--ask-for-approval",
+  "never",
+  "--color",
+  "never",
+  "-"
+];
+
+const child = spawn("codex", args, {
+  stdio: ["pipe", "pipe", "pipe"],
+  shell: false
+});
+
+child.stdin.setDefaultEncoding("utf8");
+child.stdin.end(prompt);
+
+child.stdout.setEncoding("utf8");
+child.stdout.on("data", (chunk) => {
+  parseJsonLines("codex", chunk, state, recordJsonLine);
+});
+
+child.stderr.setEncoding("utf8");
+child.stderr.on("data", (chunk) => {
+  childStderr += chunk;
+  if (process.env.CW_AGENT_STREAM !== "0" && process.env.CW_NO_STREAM !== "1" && process.stderr.isTTY) {
+    process.stderr.write(chunk);
+  }
+});
+
+child.on("error", (error) => {
+  process.stderr.write(`codex spawn failed: ${error.message}\n`);
+  process.exit(1);
+});
+
+child.on("close", (code) => {
+  flushJsonLines("codex", state, recordJsonLine);
+  if (code !== 0) {
+    const detail = childStderr.trim() || `codex exited ${code === null ? "(timeout/killed)" : code}`;
+    process.stderr.write(`${detail}\n`);
+    process.exit(code === null ? 1 : code);
+  }
+  if (state.invalidJson) {
+    process.stderr.write("codex --json produced a non-JSONL stdout line - refusing to trust the result\n");
+    process.exit(1);
+  }
+
+  let resultText = "";
+  try {
+    resultText = fs.readFileSync(finalPath, "utf8");
+  } catch {
+    process.stderr.write("codex produced no final output file - refusing to fabricate a result\n");
+    process.exit(1);
+  } finally {
+    try {
+      fs.rmSync(finalPath, { force: true });
+    } catch {
+      /* best effort */
+    }
+  }
+
+  try {
+    writeResult(resultPath, resultText);
+  } catch (error) {
+    process.stderr.write(`codex produced no final result: ${error.message}\n`);
+    process.exit(1);
+  }
+
+  trace("* done - result captured");
+  emitReport(state.model, state.usage, resultText);
+});

package/scripts/agents/cw-attest-wrap.js

@@ -120,10 +120,18 @@ function main() {
     if (report && report.usage && privateKey && manifest) {
       const inputPath = manifest.inputPath;
       const promptDigest = inputPath && fs.existsSync(inputPath) ? sha256(fs.readFileSync(inputPath, "utf8")) : sha256(manifest.prompt || "");
+      // Bind the agent's RESULT into the signature too, so editing the findings —
+      // not just the usage — is detected. The inner agent ran synchronously, so
+      // result.md is on disk now; CW digests the SAME bytes at intake (raw file,
+      // shared sha256). Absent/unreadable ⇒ sign without it (a 4-field signature
+      // CW still verifies — back-compat).
+      const resultPath = manifest.resultPath;
+      const resultDigest = resultPath && fs.existsSync(resultPath) ? sha256(fs.readFileSync(resultPath, "utf8")) : undefined;
       const signature = ta.signTelemetry(report.usage, privateKey, {
         runId: manifest.runId,
         taskId: manifest.taskId,
-        promptDigest
+        promptDigest,
+        ...(resultDigest ? { resultDigest } : {})
       });
       out = JSON.stringify({ ...report, usageSignature: signature });
     } else if (report) {