cool-workflow 0.1.87 → 0.1.88

package/docs/readme-v0.1.87-full.md

@@ -0,0 +1,301 @@
+<div align="center">
+
+# Cool Workflow
+
+**Point an AI coding agent at a repo, get a saved report with real citations — not a chat message you lose.**
+
+[![CI](https://img.shields.io/github/actions/workflow/status/coo1white/cool-workflow/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/coo1white/cool-workflow/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/cool-workflow?style=flat-square&label=npm&color=cb3837)](https://www.npmjs.com/package/cool-workflow)
+[![downloads](https://img.shields.io/npm/dm/cool-workflow?style=flat-square&label=downloads)](https://www.npmjs.com/package/cool-workflow)
+[![provenance](https://img.shields.io/badge/npm-provenance-3178C6?style=flat-square)](https://www.npmjs.com/package/cool-workflow)
+[![release](https://img.shields.io/github/v/tag/coo1white/cool-workflow?style=flat-square&label=release&color=brightgreen&sort=semver)](https://github.com/coo1white/cool-workflow/tags)
+[![license](https://img.shields.io/badge/license-BSD--2--Clause-blue?style=flat-square)](LICENSE)
+
+<img src="docs/assets/cool-workflow-readme-promo.png" alt="Cool Workflow turns AI agent repo questions into saved, cited, tamper-evident reports." width="100%">
+
+</div>
+
+## What is this, really?
+
+You put a question to an AI coding agent, it gives an answer in the chat, and
+then the answer is gone. Next week you put the same question and have to start
+all over again.
+
+**Cool Workflow (CW) makes that lost question into a kept job.** You point it at
+a code store with a question like *"what are the security risks here?"* It runs
+your AI agent over all the code in ordered steps and puts a **report file** on
+disk — every point backed by an exact `file.js:42` pointer to the line. You are
+able to run it again, give it to others, and even give proof that the report was
+not changed by anyone.
+
+```
+        you ask once                          CW gives you
+   "what are the risks in my repo?"     →   a saved report.md with
+                                              cited findings, repeatable
+```
+
+It does **not** run the AI model itself. You give your own agent (for one, the
+`claude` command line) and CW keeps it working, makes a record of what took
+place, and checks the answer. Take CW as the *project manager*, and your agent
+as the *worker*.
+
+> New to this? You're in the right place — this README is a step-by-step start.
+> Deeper/advanced docs live in the [wiki](https://github.com/coo1white/cool-workflow/wiki).
+
+---
+
+## Project rule
+
+CW should stay a small, trusted tool, not a platform.
+
+```text
+ask simple -> run simple -> verify simple -> resume simple
+```
+
+The engineering base is FreeBSD-like: POLA first, fail closed, no silent
+fallback, stdout as data, stderr as diagnostics, and documented stable
+surfaces. The user-facing spirit is close to Homebrew: a small command
+surface, a strong `doctor` check, and clear next steps when a run is
+blocked or a report does not verify.
+
+That means CW should hide orchestration detail behind clear commands,
+keep `.cw/` state open to check, make recovery boring, and prefer a
+small tool that can be trusted over a broad agent platform.
+
+---
+
+## What you need
+
+1. **Node.js** (v18+). Make a check with `node --version`.
+2. **An AI agent on the command line.** The most simple is **Claude Code** —
+   after you put it in you will have a `claude` command. Make a check with
+   `claude --version`. (CW also works with `codex`, or any command/HTTP agent —
+   but make your start with `claude`.)
+
+> No agent yet? You are still able to **see CW work** (next part, step 1)
+> without one. The full report needs an agent, because CW never makes a call to
+> a model itself.
+
+---
+
+## Quick start (3 steps)
+
+### 1. See it run — no install, no agent, no API key
+
+```bash
+npx cool-workflow demo tamper
+```
+
+This gives proof of CW's chief trick in 30 seconds (more on that
+[below](#can-i-trust-the-report)). If you see `VERDICT: tamper-evidence holds ✓`,
+all is working.
+
+Not sure what to run next?
+
+```bash
+npx cool-workflow doctor --onramp
+```
+
+This prints the short path for a first run, the fast checks for source work, and
+the full gate to use before a release.
+
+From a source checkout, use:
+
+```bash
+cd plugins/cool-workflow
+node scripts/cw.js doctor --onramp --changed-from origin/main
+```
+
+### 2. Check, then run a real review on your own repo
+
+First make a zero-write check. It does not make a run, write `.cw/`, or call
+your agent:
+
+```bash
+npx cool-workflow quickstart architecture-review --check \
+  --repo /path/to/your/project \
+  --question "What are the main risks in this codebase?" \
+  --agent-command builtin:claude
+```
+
+If the check is good, run the review:
+
+```bash
+npx cool-workflow quickstart architecture-review \
+  --repo /path/to/your/project \
+  --question "What are the main risks in this codebase?" \
+  --agent-command builtin:claude
+```
+
+If the report has to go to someone else, make the checked bundle in the same
+run:
+
+```bash
+npx cool-workflow quickstart architecture-review \
+  --repo /path/to/your/project \
+  --question "What are the main risks in this codebase?" \
+  --agent-command builtin:claude \
+  --bundle
+```
+
+- `--repo` — the folder you have a wish to get looked at.
+- `--question` — what you have a wish to be certain of.
+- `--agent-command builtin:claude` — make use of the Claude wrapper that comes
+  with it (read-only; it never makes changes to your code).
+- `--agent-command builtin:codex` — make use of the Codex wrapper that comes
+  with it (read-only; it never makes changes to your code).
+
+CW makes a plan of the work, keeps your agent working over your repo in steps,
+and gives out where it kept the report. For a living view in the window while
+every worker is at work, take it up with `CW_AGENT_STREAM=1`; the view goes to
+stderr only and the kept answer is not changed.
+
+> **No agent put in place?** CW comes to a safe stop and says so
+> (`status: blocked`) — it never makes up an answer. Put in `claude` and run it
+> again.
+
+### 3. Read the report
+
+```bash
+cat /path/to/your/project/.cw/runs/<run-id>/report.md
+```
+
+You get a short account, ordered points, and **clickable pointers** like
+`src/server.js:18` for every point made — so you are able to make a check of
+each one yourself.
+
+---
+
+## Install it (optional)
+
+`npx` is ever working with no need to put it in. To get the short `cw` command
+everywhere:
+
+```bash
+npm install -g cool-workflow      # then use:  cw …   instead of  npx cool-workflow …
+```
+
+---
+
+## What else can it do?
+
+CW comes with a number of ready-made "jobs" (run `cw list` to see them all):
+
+| Command | What it does |
+|---|---|
+| `architecture-review` | Make a map of a repo's structure and put its true risks in order, with facts. |
+| `pr-review-fix-ci` | Go over a pull request, put forward fixes, make a check of CI. |
+| `research-synthesis` | Get together and make into one a fact-backed answer to a question. |
+| `release-cut` | Keep a gated, gone-over release moving. |
+
+It also puts the same acts out over **MCP**, so editors like Claude Desktop /
+Cursor / VS Code are able to make a call to CW as a tool. See the
+[wiki](https://github.com/coo1white/cool-workflow/wiki) for that and for
+multi-agent runs.
+
+---
+
+## Can I trust the report?
+
+This is what makes CW not the same as the rest. Because CW only *gives the work
+over* to your agent, it keeps a record of every step that makes any false change
+come to light: every agent's given token use is signed by secret-key science and
+chained by hash, so **changing the record after the fact has the chain broken** —
+and anyone is able to make the check again offline with only a public key.
+
+See it for yourself — the `demo tamper` from step 1 makes a false record in two
+ways and gets both:
+
+```text
+▶ LEDGER tamper
+  after:  ✗ DETECTED — the hash chain caught it: chain-link[2]: telemetry-chain-broken
+▶ SIGNATURE tamper
+  after:  ✗ DETECTED — signature does not match reported usage
+VERDICT: tamper-evidence holds ✓ — every forgery caught offline, with only the public key.
+```
+
+On a true run, make a check of any run's record yourself:
+
+```bash
+cw telemetry verify <run-id>
+```
+
+CW makes use of this on its own code — see the kept living-run proof in
+[`plugins/cool-workflow/docs/dogfood/`](plugins/cool-workflow/docs/dogfood/).
+
+The plain point: *the thing that uses up the tokens is not the thing that keeps
+the books.* That keeping-apart is normal in account-keeping — CW gives it to AI
+agents.
+
+---
+
+## Hand the report to someone — they can check it on their own
+
+A report you keep on your own machine is one thing. A report you can **give to
+someone** who then makes the check themselves is what you are really after. Add
+`--bundle` to the one command and CW seals the finished run into a single,
+self-checking file:
+
+```bash
+npx cool-workflow quickstart architecture-review \
+  --repo /path/to/your/project --question "What are the main risks?" \
+  --agent-command builtin:claude --bundle --with-trust-key ./trust-pub.pem
+```
+
+This puts a `report.cwrun.json` file **where you are** (not in the looked-at
+repo). The one file holds the report, the `file.js:42` pointers, the signed and
+hash-chained record, **and the public key**.
+
+Give that file to anyone. With no need for your repo, your keys given over on the
+side, or a put-in past `npx`, they make the check on their own — offline, with
+only the file:
+
+```bash
+npx cool-workflow report verify-bundle report.cwrun.json
+```
+
+If the bundle was changed in any way after the fact — the record, a signature, or
+the bytes — the check says so and comes to a stop (it gives back `ok: false` and a
+non-zero code), so a bundle you send on can never be a quiet lie. CW still never
+runs the model itself; it only keeps the books and makes the check.
+
+Want to see the whole thing in 30 seconds, with no agent and no key of your own?
+
+```bash
+npx cool-workflow demo bundle
+```
+
+It makes a real sealed bundle, makes two false changes to it, and shows the check
+getting **both** — offline, with only the public key the bundle carries.
+
+---
+
+## Troubleshooting
+
+| Problem | Fix |
+|---|---|
+| `status: blocked`, `agentConfigured: false` | No agent is in place. Put in `claude` (or give `--agent-command`). |
+| `claude: command not found` | Put in Claude Code so the `claude` command is there, then run again. |
+| Want to see the plan without running the AI | Put in `--preview` — it gives the steps and starts nothing. |
+| Want a live agent trace | Put `CW_AGENT_STREAM=1`. It is stderr-only, TTY-gated, and `CW_NO_STREAM=1` puts it off. |
+| Where did my report go? | The command gives out `reportPath`; it is under `<your-repo>/.cw/runs/<id>/report.md`. |
+
+---
+
+## How it works (one paragraph)
+
+CW is a small TypeScript/Node run-time that needs no other parts. It makes a
+record of the agent loop out in the open — *plan → dispatch → record → verify →
+commit → report* — as long-lasting files on disk, so a run is open to looking-at
+and able to be played again in place of a chat you let go. It never puts a model
+SDK inside and keeps no API key; your put-in-place agent does the thinking, CW
+does the book-keeping and the checking. For the structure, multi-agent
+working-together, execution backends, and the full CLI/MCP face, see the
+**[wiki](https://github.com/coo1white/cool-workflow/wiki)** and
+[`plugins/cool-workflow/docs/`](plugins/cool-workflow/docs/).
+
+---
+
+## License
+
+BSD-2-Clause. See [LICENSE](LICENSE). Built by COOLWHITE LLC.

package/docs/real-execution-backends.7.md

@@ -165,3 +165,7 @@ No other change to this page in v0.1.84.
 ## 0.1.87 (v0.1.87)
 
 npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+_No behavioral change in v0.1.88 (the container/remote/ci delegating integrations and their canonical evidence are unchanged; the streaming-default and incremental-resume work this release lives in the agent execution path and the drive, not in these backends)._

package/docs/release-and-migration.7.md

@@ -305,3 +305,7 @@ No other change to this page in v0.1.84.
 ## 0.1.87 (v0.1.87)
 
 npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+_No behavioral change in v0.1.88 (`release:check` and the durable run-state compatibility/`state check` path are unchanged; this release's release-flow verdict-capture work lives in the Release Tooling scripts, not in the release-check or migration discipline)._

package/docs/release-tooling.7.md

@@ -243,3 +243,7 @@ Loaders fail closed on corrupt state; store writes are made safe under more than
 ## 0.1.87 (v0.1.87)
 
 npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+The release flow now captures the reviewer's verdict from agent stdout (`release-flow.js`), so the cut records the gate decision deterministically instead of relying on a hand-entered verdict; the kernel runtime stays untouched.

package/docs/report-verifiable-bundle.7.md

@@ -67,10 +67,42 @@ The POLICY is fail-closed and self-describing:
   with an embedded key verifies the same on any machine; the override/env only
   apply when the bundle omits a key.
 - `ok` is true only when the archive bytes, the telemetry chain, and the
-  trust-audit chain all verify AND no attested signature failed re-verification.
+  trust-audit chain all verify, no attested signature failed re-verification, AND
+  the report ⇄ result cross-check holds.
+- **Report ⇄ result ⇄ signature cross-check** (`reportFindingsVerified`) — the
+  FORWARD guarantee: every SIGNED finding is present in the report and unaltered.
+  Driven by the signature-verified, result-COVERING ledger records (not the archive's
+  `run.tasks` list, which is bound by nothing). For each such record: (1) its
+  `resultDigest` is anchored by the executor's ed25519 signature — a usage-only
+  (4-field) signature is excluded, so an injected digest is never trusted
+  (`coversResult` required); (2) the matching completed task's **restored result file
+  must hash to that signed digest** (`result-missing` / `result-digest-mismatch:<task>`
+  otherwise) — so an edited, missing, dropped, or substituted result is caught because
+  the signed digest does not move; (3) `report.md` embeds the result at the task's own
+  `### <taskId>` section, body-first (`report-result-mismatch:<task>` otherwise) — so
+  an edited report, or a decoy copy buried elsewhere, fails. Editing the report breaks
+  (3); editing the result breaks (2); editing **both** to one consistent lie still
+  breaks (2). Any failure ⇒ `report-findings`, `ok:false`.
+- **Scope (read this).** The guarantee is FORWARD only: each of the agent's *signed*
+  findings is in the report unaltered. It does **not** assert the report contains
+  *only* signed findings. CW holds no key to sign the rendered report (it delegates;
+  it never signs), and the telemetry ledger chain is self-recomputable, so the report
+  MAY carry additional **unsigned content** — prose, an executive summary, ordering,
+  or extra sections — and a determined local re-chainer can **omit** a signed finding
+  (a shorter, self-consistent history). Verify the findings you act on against the
+  signed results; do not read more into a green verdict than "the signed findings are
+  present and unaltered." Closing report-completeness fully needs an external
+  append-only anchor (declined by design here); see the [Trust Model](trust-model.md).
+- **Trust level** (`trustLevel`): `"signed"` means the agent's signed findings are
+  present and unaltered — at least one **result-covering** signature re-verified
+  against a key, none failed, and the forward cross-check held. A usage-only (4-field)
+  signature, an unverifiable one (no key), or a tampered signed finding all yield
+  `"unsigned"`. It attests the signed findings, **not** report exhaustiveness.
 - A bundle with attested telemetry but no available key DEGRADES by default
   (`signatureKeyProvided: false`, the intact chain still decides `ok`).
-  `--strict-signatures` refuses such a bundle instead.
+  `--strict-signatures` refuses such a bundle instead. `--require-signatures` is
+  stronger: it refuses any bundle whose `trustLevel` is `"unsigned"` (closing the
+  fail-open where an unsigned-but-intact bundle returned `ok: true`).
 - `--extract-report <path>` writes the bundle's `report.md` out for a human to
   read alongside the machine verdict. If extraction is requested but the bundle
   has no `report.md` (or the write fails), that is a failure, not a silent no-op:

package/docs/run-registry-control-plane.7.md

@@ -177,6 +177,16 @@ whose top-level integrity block is *absent* — closing the legacy fail-open sea
 where a stripped-integrity archive imported unverified. Unset (the default) keeps
 legacy integrity-less archives byte-identical; the flag is mechanism, not policy.
 
+The archive's run id becomes a directory name under `DIR/.cw/runs/`, so import
+also refuses any run id that is not a single safe path segment (`[A-Za-z0-9._-]`,
+with no separator and not the `.` or `..` component) and asserts the resolved run
+directory stays inside the target's runs root — both *before* the directory is
+made — so a crafted id such as `../../etc` can never write outside the runs tree.
+(An embedded `..` such as `v1..2` is a safe directory name, not a traversal, and
+is allowed so a legitimately-minted run id always round-trips.) The same refusal
+protects `cw report verify-bundle`, which restores an untrusted bundle into a
+throwaway temporary directory.
+
 `run verify-import <run-id> [--cwd DIR]` reads the restore manifest again, works out
 every restored file digest again, checks the manifest digest, checks the telemetry
 ledger when one was restored, and proves the **trust-audit hash chain** again (the
@@ -416,3 +426,7 @@ No other change to this page in v0.1.84.
 ## 0.1.87 (v0.1.87)
 
 npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+Security: archive import now refuses path-traversal run ids (`..`/absolute/separator-bearing ids) before any run dir is minted, closing a write-outside-the-registry vector; run resolution and the run-state schema are otherwise unchanged.

package/docs/run-retention-reclamation.7.md

@@ -216,3 +216,7 @@ No other change to this page in v0.1.84.
 ## 0.1.87 (v0.1.87)
 
 npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+_No behavioral change in v0.1.88 (the tiered, append-only, cryptographically-verifiable reclamation transition is unchanged)._

package/docs/state-explosion-management.7.md

@@ -294,3 +294,7 @@ No other change to this page in v0.1.84.
 ## 0.1.87 (v0.1.87)
 
 npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+_No behavioral change in v0.1.88 (the summarization/compaction layer and its fail-closed derived summaries are untouched)._

package/docs/team-collaboration.7.md

@@ -230,3 +230,7 @@ No other change to this page in v0.1.84.
 ## 0.1.87 (v0.1.87)
 
 npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+_No behavioral change in v0.1.88 (the host-attested actor, append-only approvals/comments/handoffs, and the review gate that stacks on the verifier gate are unchanged)._

package/docs/trust-model.md

@@ -249,10 +249,12 @@ than the math will back up.
   signature mismatches fail closed. Mirrored as `cw_telemetry_verify` on the MCP
   surface.
 - `cw demo tamper` — a sealed, offline, one-command proof: it builds a real
-  ed25519-signed ledger and then fakes it two ways — flips a recorded verdict and
-  works out the *local* record hash again (the chain still breaks), and uses a
-  signature again over blown-up tokens (ed25519 turns it down). Everything is checked with
-  the public key only. The `✗ DETECTED` lines are the point.
+  ed25519-signed ledger and then fakes it three ways — flips a recorded verdict and
+  works out the *local* record hash again (the chain still breaks), uses a
+  signature again over blown-up tokens (ed25519 turns it down), and edits a signed
+  finding after signing so the re-derived sha256(result) no longer joins the
+  signature (the verify turns it down). Everything is checked with the public key
+  only. The `✗ DETECTED` lines are the point.
 - Re-run either with **only the public key** on a machine we do not control. If it
   does not come out the same, our integrity claim is false — hold us to it.
 

package/docs/web-desktop-workbench.7.md

@@ -238,3 +238,7 @@ No other change to this page in v0.1.84.
 ## 0.1.87 (v0.1.87)
 
 npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
+
+## 0.1.88 (v0.1.88)
+
+_No behavioral change in v0.1.88 (the five operator surfaces and the registry cross-run entry are unchanged; the Workbench still derives everything from state the CLI/MCP already expose)._

package/manifest/plugin.manifest.json

@@ -2,7 +2,7 @@
   "_comment": "SINGLE SOURCE OF TRUTH for every vendor manifest. Edit THIS file, then run `npm run gen:manifests`. Do NOT hand-edit the generated vendor manifests (.claude-plugin/, .codex-plugin/, .agents/, .mcp.json) — `npm run gen:manifests -- --check` (run by release:check) will fail if they drift from this source.",
   "identity": {
     "name": "cool-workflow",
-    "version": "0.1.87",
+    "version": "0.1.88",
     "license": "BSD-2-Clause",
     "homepage": "https://github.com/coo1white/cool-workflow",
     "author": {

package/manifest/source-context-profiles.json

@@ -25,7 +25,7 @@
     },
     "runtime": {
       "description": "Runtime-kernel source context for state, orchestration, scheduling, execution, and shared types.",
-      "maxLines": 43000,
+      "maxLines": 44000,
       "include": [
         "plugins/cool-workflow/src/**",
         "plugins/cool-workflow/package.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.87",
+  "version": "0.1.88",
   "bin": {
     "cool-workflow": "scripts/cw.js",
     "cw": "scripts/cw.js"
@@ -16,6 +16,9 @@
   },
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
   "type": "commonjs",
+  "engines": {
+    "node": ">=18"
+  },
   "license": "BSD-2-Clause",
   "author": {
     "name": "COOLWHITE LLC"
@@ -57,10 +60,10 @@
     "onramp:check": "node scripts/onramp-check.js --check",
     "version:sync": "node scripts/version-sync-check.js",
     "release:check": "node scripts/release-check.js",
-    "test": "node dist/cli.js list && node test/run-all.js",
-    "test:fast": "npm run build --if-present && node dist/cli.js list && node test/run-all.js --concurrency auto",
-    "test:ci": "node dist/cli.js list && node test/run-all.js --concurrency auto",
-    "test:coverage": "node dist/cli.js list && node scripts/coverage-gate.js --concurrency auto",
+    "test": "node dist/cli.js version > /dev/null && node test/run-all.js",
+    "test:fast": "npm run build --if-present && node dist/cli.js version > /dev/null && node test/run-all.js --concurrency auto",
+    "test:ci": "node dist/cli.js version > /dev/null && node test/run-all.js --concurrency auto",
+    "test:coverage": "node dist/cli.js version > /dev/null && node scripts/coverage-gate.js --concurrency auto",
     "eval:replay": "tsc -p tsconfig.json && node test/multi-agent-eval-replay-harness-smoke.js",
     "ci": "npm run build && npm run check && npm run test && npm run release:check",
     "validate:schema": "node scripts/validate-run-state-schema.js"

package/scripts/agents/agent-adapter-core.js

@@ -39,7 +39,7 @@ function buildPrompt(inputPath) {
 }
 
 function streamEnabled(env = process.env) {
-  return env.CW_AGENT_STREAM === "1" && env.CW_NO_STREAM !== "1";
+  return env.CW_AGENT_STREAM !== "0" && env.CW_NO_STREAM !== "1";
 }
 
 function traceEnabled(env = process.env, stderr = process.stderr) {

package/scripts/agents/builtin-templates.json

@@ -5,6 +5,7 @@
     "claude": "claude-p-agent.js",
     "codex": "codex-agent.js",
     "gemini": "gemini-agent.js",
-    "opencode": "opencode-agent.js"
+    "opencode": "opencode-agent.js",
+    "deepseek": "opencode-agent.js"
   }
 }

package/scripts/agents/claude-p-agent.js

@@ -29,6 +29,11 @@
 
 const fs = require("node:fs");
 const { spawn, spawnSync } = require("node:child_process");
+// Share the ONE canonical result contract with the codex/gemini/opencode
+// wrappers instead of carrying a private copy. A drifted inline copy (ASCII
+// hyphens silently became em-dashes here) meant claude was sent a different
+// instruction text than the other providers for the same contract.
+const { buildPrompt } = require("./agent-adapter-core");
 
 const inputPath = process.argv[2];
 const resultPath = process.argv[3];
@@ -37,39 +42,8 @@ if (!inputPath || !resultPath) {
   process.exit(2);
 }
 
-const CONTRACT = `
-=== HOW TO RETURN YOUR ANSWER (overrides any 'write to result.md' instruction above) ===
-You have NO file-write access. Do NOT attempt to write, create, or edit any file —
-result.md is persisted FOR YOU from your final message, so writing it yourself is
-neither needed nor possible. Use ONLY read-only tools (read files, grep, list).
-Respond with ONLY your FINAL answer as Markdown, and it MUST END WITH a fenced
-cw:result block that EXACTLY follows this schema:
-
-\`\`\`cw:result
-{
-  "summary": "one-paragraph direct answer",
-  "findings": [
-    {
-      "id": "unique-kebab-id",
-      "title": "short risk title",
-      "severity": "P0",
-      "classification": "real",
-      "evidence": ["path/to/file.ts:42"]
-    }
-  ],
-  "evidence": ["path/to/file.ts:42", "path/to/other.ts:10"]
-}
-\`\`\`
-
-HARD RULES (the result is REJECTED otherwise):
-- Every object in "findings" MUST have a unique "id" (non-empty string).
-- "classification", if present, MUST be one of: real, conditional, non-issue, unknown.
-- Any finding with "severity" P0, P1, or P2 MUST include a NON-EMPTY "evidence" array.
-- The top-level "evidence" array MUST be NON-EMPTY with REAL file:line locators from this repo.
-- If you have no structured findings, use "findings": [] (empty) — never omit a finding's id.`;
-
-const prompt = `${fs.readFileSync(inputPath, "utf8")}\n${CONTRACT}`;
-const streamEnabled = process.env.CW_AGENT_STREAM === "1" && process.env.CW_NO_STREAM !== "1";
+const prompt = buildPrompt(inputPath);
+const streamEnabled = process.env.CW_AGENT_STREAM !== "0" && process.env.CW_NO_STREAM !== "1";
 const traceEnabled = streamEnabled && Boolean(process.stderr.isTTY);
 
 if (!streamEnabled) {

package/scripts/agents/codex-agent.js

@@ -86,7 +86,7 @@ child.stdout.on("data", (chunk) => {
 child.stderr.setEncoding("utf8");
 child.stderr.on("data", (chunk) => {
   childStderr += chunk;
-  if (process.env.CW_AGENT_STREAM === "1" && process.env.CW_NO_STREAM !== "1" && process.stderr.isTTY) {
+  if (process.env.CW_AGENT_STREAM !== "0" && process.env.CW_NO_STREAM !== "1" && process.stderr.isTTY) {
     process.stderr.write(chunk);
   }
 });

package/scripts/agents/cw-attest-wrap.js

@@ -120,10 +120,18 @@ function main() {
     if (report && report.usage && privateKey && manifest) {
       const inputPath = manifest.inputPath;
       const promptDigest = inputPath && fs.existsSync(inputPath) ? sha256(fs.readFileSync(inputPath, "utf8")) : sha256(manifest.prompt || "");
+      // Bind the agent's RESULT into the signature too, so editing the findings —
+      // not just the usage — is detected. The inner agent ran synchronously, so
+      // result.md is on disk now; CW digests the SAME bytes at intake (raw file,
+      // shared sha256). Absent/unreadable ⇒ sign without it (a 4-field signature
+      // CW still verifies — back-compat).
+      const resultPath = manifest.resultPath;
+      const resultDigest = resultPath && fs.existsSync(resultPath) ? sha256(fs.readFileSync(resultPath, "utf8")) : undefined;
       const signature = ta.signTelemetry(report.usage, privateKey, {
         runId: manifest.runId,
         taskId: manifest.taskId,
-        promptDigest
+        promptDigest,
+        ...(resultDigest ? { resultDigest } : {})
       });
       out = JSON.stringify({ ...report, usageSignature: signature });
     } else if (report) {

package/scripts/agents/gemini-agent.js

@@ -75,7 +75,7 @@ child.stdout.on("data", (chunk) => {
 child.stderr.setEncoding("utf8");
 child.stderr.on("data", (chunk) => {
   childStderr += chunk;
-  if (process.env.CW_AGENT_STREAM === "1" && process.env.CW_NO_STREAM !== "1" && process.stderr.isTTY) {
+  if (process.env.CW_AGENT_STREAM !== "0" && process.env.CW_NO_STREAM !== "1" && process.stderr.isTTY) {
     process.stderr.write(chunk);
   }
 });

package/scripts/agents/opencode-agent.js

@@ -79,7 +79,7 @@ child.stdout.on("data", (chunk) => {
 child.stderr.setEncoding("utf8");
 child.stderr.on("data", (chunk) => {
   childStderr += chunk;
-  if (process.env.CW_AGENT_STREAM === "1" && process.env.CW_NO_STREAM !== "1" && process.stderr.isTTY) {
+  if (process.env.CW_AGENT_STREAM !== "0" && process.env.CW_NO_STREAM !== "1" && process.stderr.isTTY) {
     process.stderr.write(chunk);
   }
 });