cool-workflow 0.1.87 → 0.1.89

package/dist/orchestrator.js

@@ -800,10 +800,20 @@ function parseArgv(argv) {
                 positionals.push(rest[restIndex]);
             break;
         }
-        if (!token.startsWith("--")) {
+        if (!token.startsWith("-")) {
             positionals.push(token);
             continue;
         }
+        if (!token.startsWith("--")) {
+            // Single-dash short flag aliases: -q → question, -r → repo, -a → agent-command, -h → help, -v → version
+            const shortMap = { q: "question", r: "repo", a: "agent-command", h: "help", v: "version" };
+            const flag = token.slice(1);
+            // Handle combined short flags like -qr (not common but safe to ignore)
+            const key = shortMap[flag] || flag;
+            const val = rest[index + 1] && !rest[index + 1].startsWith("-") ? rest[++index] : true;
+            appendOption(options, key, val);
+            continue;
+        }
         const withoutPrefix = token.slice(2);
         const equalsIndex = withoutPrefix.indexOf("=");
         let key;
@@ -829,7 +839,7 @@ exports.KNOWN_COMMANDS = new Set([
     "history", "audit-run", "multi-agent", "topology", "summary", "blackboard",
     "coordinator", "metrics", "operator", "sched", "gc", "telemetry",
     "migration", "demo", "workbench", "approve", "reject", "comment", "handoff",
-    "graph", "eval"
+    "graph", "eval", "version", "update", "fix"
 ]);
 /** Levenshtein distance between two short strings. */
 function levenshtein(a, b) {
@@ -913,85 +923,46 @@ function formatInfo(appId, data) {
     return lines.join("\n");
 }
 function formatHelp() {
+    // Help is written to stdout, so color must key off stdout (not the term default).
+    const out = process.stdout;
+    const moreCommands = ("list search info init plan status next dispatch result state commit report app " +
+        "sandbox backend contract node feedback worker audit candidate review loop schedule " +
+        "routine registry run queue history quickstart audit-run multi-agent topology summary " +
+        "blackboard coordinator metrics operator sched gc telemetry migration demo workbench " +
+        "approve reject comment handoff graph eval man version update fix").split(" ");
+    // Wrap the command list into clean, indented, pipe-joined lines (<=76 cols) instead of
+    // one 400-char line that wraps raggedly and merges with the next shell prompt. Pipe-joined
+    // (no internal spaces) keeps it parseable by the CLI/MCP parity help-token check.
+    const wrapped = [];
+    let line = "  ";
+    for (const cmd of moreCommands) {
+        const sep = line.length > 2 ? "|" : "";
+        if (line.length + sep.length + cmd.length > 76) {
+            wrapped.push(line);
+            line = "  ";
+        }
+        line += (line.length > 2 ? "|" : "") + cmd;
+    }
+    if (line.length > 2)
+        wrapped.push(line);
     return [
-        (0, term_1.bold)("Cool Workflow"),
-        "",
-        "  Quick start (one command — plan → drive → report):",
-        "    cw quickstart [app] --repo . --question \"...\" --agent-command builtin:claude",
-        "      (--preview for a dry run without an agent; --bundle for a portable sealed report)",
-        "",
-        (0, term_1.bold)("Getting Started"),
-        "  list                          List available workflow apps",
-        "  search <keyword>              Search workflows by title or description",
-        "  info <app-id> [--json]         Show what a workflow app does and how to run it",
-        "  doctor [--json] [--onramp] [--fix]  Check setup (--fix for consolidated fix commands)",
-        "  init <id> [--title T]         Create a new workflow app",
-        "  quickstart [app] [...]        Plan → drive → report in one command",
-        "  demo tamper|bundle            Prove trust checks work (30s, no agent needed)",
-        "  man <topic>                   Show a man page (e.g. cw man release-tooling)",
-        "",
-        (0, term_1.bold)("Run Management"),
-        "  plan <id> [--repo P] [--question Q]   Create a new run plan",
-        "  quickstart|audit-run [app] [...]       Plan → drive → report in one command",
-        "  status <run-id> [--json] [--brief]    Show run status (--brief for compact summary)",
-        "  next <run-id> [--limit N]             Show pending dispatch tasks",
-        "  dispatch <run-id> [--limit N]         Dispatch tasks to workers",
-        "  result <run-id> <task-id> <file>      Record a task result",
-        "  state check <run-id> [--write]        Validate run state",
-        "  commit <run-id> <mode> [...]          Record a gated commit",
-        "  report <run-id> [--show|--summary]    Show the report (or bundle/verify-bundle)",
-        "  graph <run-id> [--json]               Show operator graph",
-        "",
-        (0, term_1.bold)("Inspection & Diagnostics"),
-        "  operator status|report <run-id> [--json]   Human-friendly operator panel",
-        "  metrics show|summary <run-id> [--json]     Cost and usage metrics",
-        "  telemetry verify <run-id> [--pubkey P]     Verify tamper-evident telemetry",
-        "  migration list|check|prove [target]        Schema migration tools",
-        "  gc plan|run|verify [run-id]                Garbage collection",
-        "",
-        (0, term_1.bold)("Audit & Trust"),
-        "  audit summary|worker|provenance|multi-agent|... <run-id>   Trust audit operations",
-        "  candidate list|register|score|rank|select|reject <run-id>  Candidate management",
-        "  node list|show|graph|snapshot|diff|replay|verify <run-id>  State-node inspection",
-        "  eval snapshot|replay|compare|score|gate|report             Eval/replay harness",
-        "",
-        (0, term_1.bold)("Multi‑Agent & Collaboration"),
-        "  multi-agent run|status|step|blackboard|score|... <run-id>   Multi-agent coordination",
-        "  topology list|show|validate|apply|summary|graph              Topology management",
-        "  blackboard summary|graph|resolve|topic|message|... <run-id>  Blackboard workspace",
-        "  coordinator summary|decision <run-id>                        Coordinator interface",
-        "  summary refresh|show <run-id>                                State explosion summaries",
-        "  approve|reject|comment <kind> <run-id> <id> [--reason T]    Team approval actions",
-        "  handoff <kind> <run-id> <id> [--to ROLE]                    Team handoff",
-        "  review status|policy <run-id> [--json]                      Review status",
+        (0, term_1.bold)("Cool Workflow", out),
         "",
-        (0, term_1.bold)("Run Registry & Scheduling"),
-        "  run search|list|show|resume|archive|export|import <id>   Cross-repo run management",
-        "  registry refresh|show [--scope repo|home] [--json]       Run registry index",
-        "  queue add|list|drain|show [queue-id]                     Work queue operations",
-        "  history [--scope repo|home] [--json]                     Run history",
-        "  schedule create|list|due|complete|...                    Scheduled tasks",
-        "  routine create|fire|list|events|delete                   Event-driven triggers",
-        "  sched plan|lease|release|complete|...                    Lease-based scheduling",
-        "  loop --prompt T [--interval-minutes N]                   Continuous loop runner",
+        "  -q \"question\" [-claude|-codex|-deepseek]  Ask a question, get a report",
+        "  version                                   Show version",
+        "  update                                    Update to latest release",
+        "  doctor                                    Check setup",
+        "  fix                                       Show fix commands for setup issues",
         "",
-        (0, term_1.bold)("Developer & Workspace"),
-        "  app list|show|validate|init|package|run [id|path]    Workflow app management",
-        "  sandbox list|show|validate|choose|resolve [id]       Sandbox profiles",
-        "  backend list|show|probe [id]                         Agent execution backends",
-        "  contract show <run-id> [id]                          Run contract view",
-        "  worker list|summary|show|manifest|output|... <id>    Worker operations",
-        "  feedback list|show|summary|collect|task|resolve <id> Feedback loop",
-        "  workbench serve [--port N] | view <run-id>           Optional localhost workbench",
+        (0, term_1.bold)("Flags", out),
+        "  -q, --question TEXT    The task or question to answer",
+        "  -r, --repo PATH        Target repository path (default: .)",
+        "  -claude                Use Claude agent",
+        "  -codex                 Use Codex agent",
+        "  -deepseek              Use DeepSeek (via opencode)",
         "",
-        (0, term_1.bold)("Common Flags"),
-        "  --json, --format json     Machine-readable JSON output",
-        "  --repo PATH               Target repository path",
-        "  --question TEXT           The task or question to answer",
-        "  --agent-command CMD       Agent backend (e.g. builtin:claude, builtin:codex)",
-        "  --scope repo|home         Scope for cross-repo operations",
-        "  --cwd PATH                Working directory override",
-        ""
+        (0, term_1.bold)("More commands", out),
+        ...wrapped
     ].join("\n");
 }
 function appendOption(options, key, value) {

package/dist/run-export.js

@@ -26,6 +26,7 @@ const version_1 = require("./version");
 const telemetry_ledger_1 = require("./telemetry-ledger");
 const telemetry_attestation_1 = require("./telemetry-attestation");
 const trust_audit_1 = require("./trust-audit");
+const execution_backend_1 = require("./execution-backend");
 const compare_1 = require("./compare");
 /** Export a run to a portable JSON archive with run-local bytes and digests. */
 function exportRun(run, outputPath, options = {}) {
@@ -84,9 +85,21 @@ function importRun(exportPath, targetDir) {
     const archiveSha256 = sha256Bytes(node_fs_1.default.readFileSync(exportPath));
     const files = normalizeArchiveFiles(raw);
     verifyArchiveFileDigests(files, raw.integrity);
+    if (!raw.run || typeof raw.run !== "object") {
+        throw new Error("Invalid run export: missing run object");
+    }
+    // The run id from the archive becomes a directory name under the target's
+    // runs root; a crafted id like "../../etc" would otherwise escape it. Refuse
+    // any id that is not a single safe path segment, then assert containment as
+    // defense-in-depth (catches a symlinked runs root too) before any write.
+    const runId = (0, state_1.assertSafeRunId)(raw.run.id);
+    const runsRoot = node_path_1.default.join(targetDir, ".cw", "runs");
+    const runDir = node_path_1.default.join(runsRoot, runId);
+    if (!(0, state_1.isContainedPath)(runDir, runsRoot)) {
+        throw new Error(`Run id escapes the runs directory: ${JSON.stringify(raw.run.id)}`);
+    }
     const oldRunDir = raw.run.paths.runDir;
     const oldCwd = raw.run.cwd;
-    const runDir = node_path_1.default.join(targetDir, ".cw", "runs", raw.run.id);
     const paths = (0, state_1.createRunPaths)(runDir);
     (0, state_1.ensureRunDirs)(paths);
     for (const file of files) {
@@ -294,6 +307,28 @@ function importManifestPath(run) {
  *
  *  Key precedence is bundle > argument > environment, so the artifact verifies the
  *  same on any machine; only when the bundle omits a key do the override/env apply. */
+/** True when report.md embeds `expected` (the trimmed result) at the task's OWN
+ *  section, exactly as orchestrator/report.ts renderResults emits it: a
+ *  `### <taskId>` heading, a `Result: <path>` line, then the result body — and the
+ *  body STARTS WITH `expected`. Anchoring to the section (not a whole-file substring)
+ *  means a decoy copy buried elsewhere does not satisfy it; matching from the heading
+ *  forward (rather than to the next heading) means a result body that itself contains
+ *  `###` cannot break the bound. The `Result:` path is matched loosely since it is
+ *  host-specific (rebased on import). */
+function reportSectionEmbedsResult(reportMd, taskId, expected) {
+    const needle = `### ${taskId}\n`;
+    // Walk EVERY `### <taskId>` occurrence — not just the first — so a stray heading
+    // inside an earlier task's result body (which is not followed by the `Result:`
+    // structure) is skipped rather than mis-anchoring the check (a false positive on a
+    // legitimate, fully-signed bundle whose findings contain markdown headings).
+    for (let from = reportMd.indexOf(needle); from >= 0; from = reportMd.indexOf(needle, from + 1)) {
+        const after = reportMd.slice(from);
+        const prefix = after.match(/^### [^\n]*\n\nResult: [^\n]*\n\n/);
+        if (prefix && after.slice(prefix[0].length).startsWith(expected))
+            return true;
+    }
+    return false;
+}
 function verifyReportBundle(archivePath, options = {}) {
     const inspect = inspectArchive(archivePath);
     const failedChecks = inspect.checks
@@ -312,6 +347,8 @@ function verifyReportBundle(archivePath, options = {}) {
         signaturesChecked: 0,
         signaturesReverified: 0,
         signaturesFailed: 0,
+        trustLevel: "unsigned",
+        reportFindingsVerified: false,
         failedChecks
     };
     // A bundle that is not even a supported archive cannot be restored — report the
@@ -348,6 +385,8 @@ function verifyReportBundle(archivePath, options = {}) {
     let signaturesChecked = 0;
     let signaturesReverified = 0;
     let signaturesFailed = 0;
+    let signaturesResultBound = 0;
+    let reportFindingsOk = true;
     let reportExtractedTo;
     try {
         // Restore into the throwaway tree. importRun digest-checks every file and throws
@@ -370,9 +409,48 @@ function verifyReportBundle(archivePath, options = {}) {
         signaturesChecked = sig.checked;
         signaturesReverified = sig.reverified;
         signaturesFailed = sig.failed;
+        signaturesResultBound = sig.resultBound.length;
         for (const check of sig.checks)
             if (!check.pass)
                 failedChecks.push({ name: check.name, code: check.code });
+        // Report ⇄ result ⇄ signature cross-check — three links so the agent's findings
+        // cannot be altered undetected on a signed bundle. CRUCIALLY this is driven by
+        // sig.resultBound (the records whose signature actually COVERED the result
+        // digest), NOT the run.tasks list — run.tasks is in the archive but bound by
+        // nothing (not the manifest digest, the chain, or the signature), so iterating it
+        // would let an attacker silence the check by dropping/un-completing a task. The
+        // obligation comes from the chained+signed ledger record instead:
+        //   1. each bound record's resultDigest is anchored by the executor signature
+        //      (coversResult re-verified above) — a 4-field signature is excluded, so an
+        //      injected resultDigest is never trusted;
+        //   2. the matching completed task's RESTORED result file must hash to that signed
+        //      digest (a missing/un-completed task or edited/empty result is a forgery);
+        //   3. report.md must embed that result at the task's own `### <taskId>` section.
+        // Editing the report breaks link 3; editing the result breaks link 2; editing both
+        // to one consistent lie still breaks link 2 (the signed digest does not move);
+        // dropping the task fails link 2 (the signed obligation remains).
+        const reportPath = imported.run.paths.report;
+        const reportMd = reportPath && node_fs_1.default.existsSync(reportPath) ? node_fs_1.default.readFileSync(reportPath, "utf8") : "";
+        const completedById = new Map(imported.run.tasks.filter((task) => task.status === "completed").map((task) => [task.id, task]));
+        for (const bound of sig.resultBound) {
+            const failBound = (code) => {
+                reportFindingsOk = false;
+                failedChecks.push({ name: "report-findings", code: `${code}:${bound.taskId}` });
+            };
+            const task = completedById.get(bound.taskId);
+            if (!task || !task.resultPath || !node_fs_1.default.existsSync(task.resultPath)) {
+                failBound("result-missing");
+                continue;
+            }
+            const resultRaw = node_fs_1.default.readFileSync(task.resultPath, "utf8");
+            if ((0, execution_backend_1.sha256)(resultRaw) !== bound.resultDigest) {
+                failBound("result-digest-mismatch");
+                continue;
+            }
+            if (!reportSectionEmbedsResult(reportMd, bound.taskId, resultRaw.trim())) {
+                failBound("report-result-mismatch");
+            }
+        }
         if (options.extractReportTo && reportContent !== undefined) {
             reportExtractedTo = node_path_1.default.resolve(options.extractReportTo);
             node_fs_1.default.writeFileSync(reportExtractedTo, reportContent);
@@ -389,6 +467,23 @@ function verifyReportBundle(archivePath, options = {}) {
     const strictShortfall = Boolean(options.strictSignatures) && signaturesChecked > 0 && !trustKey;
     if (strictShortfall)
         failedChecks.push({ name: "signatures", code: "signature-key-required" });
+    // Trust level + requireSignatures — closes the prior fail-open. "signed" means the
+    // agent's SIGNED findings are present and unaltered: at least one result-COVERING
+    // signature re-verified against a key, none failed, and each signed result is
+    // faithfully embedded in report.md (the forward cross-check held). A usage-only
+    // (4-field) signature, an unverifiable one (no key), or a tampered signed finding
+    // all yield "unsigned". requireSignatures refuses "unsigned".
+    //
+    // SCOPE (honest): "signed" attests the SIGNED findings, NOT that the report is
+    // exhaustively signed. CW holds no key to sign the rendered report and the ledger
+    // chain is self-recomputable, so the report MAY carry additional unsigned content
+    // (prose, or extra sections), and a determined re-chainer can OMIT a signed
+    // finding. Verify findings against the signed results; full report-completeness
+    // needs an external anchor. See report-verifiable-bundle.7.md / trust-model.md.
+    const trustLevel = signaturesResultBound > 0 && signaturesFailed === 0 && reportFindingsOk ? "signed" : "unsigned";
+    const unsignedShortfall = Boolean(options.requireSignatures) && trustLevel === "unsigned";
+    if (unsignedShortfall)
+        failedChecks.push({ name: "signatures", code: "signatures-required" });
     // Extraction was requested but could not be fulfilled (no report.md in the bundle,
     // or the write failed): fail closed rather than silently green a missing artifact —
     // otherwise `report bundle <run> --extract-report r.md && send r.md` would ship
@@ -401,7 +496,14 @@ function verifyReportBundle(archivePath, options = {}) {
         schemaVersion: 1,
         archivePath,
         runId: inspect.runId,
-        ok: inspect.ok && telemetryVerified && trustAuditVerified && signaturesFailed === 0 && !strictShortfall && !extractShortfall,
+        ok: inspect.ok &&
+            telemetryVerified &&
+            trustAuditVerified &&
+            signaturesFailed === 0 &&
+            reportFindingsOk &&
+            !strictShortfall &&
+            !extractShortfall &&
+            !unsignedShortfall,
         archiveOk: inspect.ok,
         telemetryVerified,
         trustAuditVerified,
@@ -410,6 +512,8 @@ function verifyReportBundle(archivePath, options = {}) {
         signaturesChecked,
         signaturesReverified,
         signaturesFailed,
+        trustLevel,
+        reportFindingsVerified: reportFindingsOk,
         reportExtractedTo,
         failedChecks
     };

package/dist/state-node.js

@@ -164,10 +164,20 @@ function linkStateNodes(parent, child) {
     ];
 }
 function appendRunNode(run, node) {
-    const nodes = run.nodes || [];
+    // Mutate run.nodes in place rather than rebuilding the whole array on every
+    // append. The old code did `nodes.map(...)` / `[...nodes, node]` per call, so a
+    // run that appends N nodes allocated arrays of size 1..N — O(N^2) churn + GC on
+    // a hot path (every dispatch/result/blackboard node). In place: O(1) per append
+    // for the common new-node case, and the resulting array — content AND order — is
+    // byte-identical to before (push appends at the end, replace keeps the slot), so
+    // the persisted state.json is unchanged. appendRunNode is the only writer of
+    // run.nodes, so the array reference stays stable across a run.
+    const nodes = run.nodes || (run.nodes = []);
     const index = nodes.findIndex((candidate) => candidate.id === node.id);
-    const nextNodes = index >= 0 ? nodes.map((candidate) => (candidate.id === node.id ? node : candidate)) : [...nodes, node];
-    run.nodes = nextNodes;
+    if (index >= 0)
+        nodes[index] = node;
+    else
+        nodes.push(node);
     writeRunNode(run, node);
     return node;
 }

package/dist/state.js

@@ -19,6 +19,7 @@ exports.realResolve = realResolve;
 exports.isContainedPath = isContainedPath;
 exports.withFileLock = withFileLock;
 exports.safeFileName = safeFileName;
+exports.assertSafeRunId = assertSafeRunId;
 exports.hashArtifactFile = hashArtifactFile;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -293,6 +294,26 @@ function withFileLock(targetPath, fn) {
 function safeFileName(value) {
     return String(value).replace(/[^a-zA-Z0-9_.:-]+/g, "_");
 }
+/** Refuse a run id that is not a single safe path segment, so an id taken from
+ *  an untrusted source (an imported run archive / bundle) can never escape the
+ *  runs directory via a separator or a `..`/`.` component (path traversal). A
+ *  real run id is `${workflowId}-${stamp}-${suffix}` (createRunId), and a
+ *  workflow id is alnum-bounded [a-z0-9.-] (validateWorkflowId) — all within
+ *  [A-Za-z0-9._-]. Because the charset already forbids any separator, the whole
+ *  id is ONE path component, so the only values that could traverse are the
+ *  components `.` and `..` themselves; an embedded `..` (e.g. a workflow id like
+ *  `v1..2`) is a safe directory name and is allowed. A separator, an absolute
+ *  path, or an empty value is refused, fail-closed. Returns the id on success so
+ *  callers can use it inline. */
+function assertSafeRunId(value, context = "run id") {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`Invalid ${context}: expected a non-empty string`);
+    }
+    if (!/^[A-Za-z0-9._-]+$/.test(value) || value === "." || value === "..") {
+        throw new Error(`Unsafe ${context}: ${JSON.stringify(value)} must be a single path segment ([A-Za-z0-9._-], not '.' or '..')`);
+    }
+    return value;
+}
 /** Compute and set SHA256 + sizeBytes on a StateArtifact from its file path
  *  (v0.1.73). Fails silently when the file doesn't exist — does not throw. */
 function hashArtifactFile(artifact) {

package/dist/telemetry-attestation.js

@@ -53,7 +53,11 @@ function canonicalTelemetryPayload(usage, ctx) {
         usage: usage ?? null,
         runId: ctx.runId,
         taskId: ctx.taskId,
-        promptDigest: ctx.promptDigest
+        promptDigest: ctx.promptDigest,
+        // Present ONLY when the signer covered the result. Omitting the key keeps the
+        // canonical bytes byte-identical to the original 4-field payload, so every
+        // pre-result-coverage signature still verifies (POLA / back-compat).
+        ...(ctx.resultDigest !== undefined ? { resultDigest: ctx.resultDigest } : {})
     });
 }
 function messageOf(error) {
@@ -110,16 +114,26 @@ function verifyTelemetryAttestation(usage, signatureB64, trustPublicKeyPem, ctx)
     catch {
         return { status: "unattested", reason: "signature is not valid base64" };
     }
-    const payload = Buffer.from(canonicalTelemetryPayload(usage, ctx), "utf8");
+    const matches = (c) => node_crypto_1.default.verify(null, Buffer.from(canonicalTelemetryPayload(usage, c), "utf8"), publicKey, signature);
     let ok = false;
+    let coversResult = false;
     try {
-        ok = node_crypto_1.default.verify(null, payload, publicKey, signature);
+        ok = matches(ctx);
+        // A match on the first arm (which carries resultDigest when CW has one) means
+        // the signature covered the result — the findings — not just the usage.
+        coversResult = ok && ctx.resultDigest !== undefined;
+        // Back-compat: a signer that predates result coverage signed only the 4-field
+        // payload, so on a miss retry WITHOUT resultDigest. A NEW signer who covered
+        // the result fails BOTH arms when the result is edited (its resultDigest no
+        // longer matches), so result tampering is still caught.
+        if (!ok && ctx.resultDigest !== undefined)
+            ok = matches({ ...ctx, resultDigest: undefined });
     }
     catch (error) {
         return { status: "unattested", reason: `verification error: ${messageOf(error)}` };
     }
     return ok
-        ? { status: "attested", algorithm: "ed25519" }
+        ? { status: "attested", algorithm: "ed25519", ...(coversResult ? { coversResult: true } : {}) }
         : { status: "unattested", reason: "signature does not match reported usage (tampered, replayed, or wrong key)" };
 }
 /** Resolve a trust key from a config value that is EITHER an inline PEM or a path
@@ -160,6 +174,7 @@ function stableDigest(value) {
 }
 function verifyTelemetrySignatures(records, trustPublicKeyPem) {
     const checks = [];
+    const resultBound = [];
     let checked = 0;
     let reverified = 0;
     let failed = 0;
@@ -190,11 +205,20 @@ function verifyTelemetrySignatures(records, trustPublicKeyPem) {
         const result = verifyTelemetryAttestation(record.reportedUsage, record.usageSignature, trustPublicKeyPem, {
             runId: record.runId,
             taskId: record.taskId,
-            promptDigest: record.promptDigest
+            promptDigest: record.promptDigest,
+            // Result-bound records carry the signed digest; verifyTelemetryAttestation
+            // reconstructs the 5-field payload (and falls back to 4-field for old records).
+            resultDigest: record.resultDigest
         });
         if (result.status === "attested") {
             reverified += 1;
             checks.push({ name: `signature[${i}]`, pass: true });
+            // Only a signature that actually COVERED the result digest anchors it — a
+            // 4-field fallback (coversResult false) must not let an injected resultDigest
+            // be trusted downstream.
+            if (result.coversResult && record.resultDigest) {
+                resultBound.push({ taskId: record.taskId, resultDigest: record.resultDigest });
+            }
         }
         else {
             failed += 1;
@@ -207,5 +231,5 @@ function verifyTelemetrySignatures(records, trustPublicKeyPem) {
             });
         }
     }
-    return { keyProvided: Boolean(trustPublicKeyPem), checked, reverified, failed, checks };
+    return { keyProvided: Boolean(trustPublicKeyPem), checked, reverified, failed, resultBound, checks };
 }

package/dist/telemetry-demo.js

@@ -6,13 +6,17 @@
 // Fully hermetic + deterministic: generates an EPHEMERAL ed25519 keypair, builds
 // a REAL telemetry ledger through the production append API (appendTelemetryAttestation
 // + signTelemetry — byte-identical to what a live attested run writes), then
-// demonstrates BOTH tamper-evidence layers catching a forgery:
+// demonstrates all THREE tamper-evidence layers catching a forgery:
 //   A) LEDGER layer — flip a recorded verdict on disk (unattested -> attested, the
 //      canonical "forge a green record" attack) -> verifyTelemetryLedger recomputes
 //      every hash independently, so the edited record's hash mismatches AND every
 //      record after it breaks the chain (cascade).
 //   B) SIGNATURE layer — inflate the reported tokens but keep the original ed25519
 //      signature -> verifyTelemetryAttestation rejects it ("signature does not match").
+//   C) RESULT layer — edit the agent's SIGNED FINDING after signing. The executor
+//      binds sha256(result.md) into the ed25519 payload; CW re-derives the digest
+//      from the result file at verify time, so an edited finding no longer joins the
+//      signature. This is the threat a usage-only signature never covered.
 //
 // No model, no network, no API key, no second repo — runs in a private tmpdir.
 var __importDefault = (this && this.__importDefault) || function (mod) {
@@ -161,6 +165,30 @@ function runTamperDemo(options = {}) {
         after: { verified: sigCheck.status === "attested", detail: sigCheck.reason || sigCheck.status },
         failures: sigCheck.status === "attested" ? [] : [`signature: ${sigCheck.reason}`]
     });
+    // 3c. RESULT layer — the REAL threat the result-bound signature closes: the agent's
+    //     signed FINDING is edited after signing. The executor binds sha256(result.md)
+    //     into the ed25519 payload (a 5-field, result-COVERING signature); CW re-derives
+    //     the digest from the result file at verify time. An edited finding hashes to a
+    //     different digest, so the signature joins neither the 5-field nor the 4-field
+    //     payload and the verify rejects it. A usage-only signature never covered this.
+    const findingSigned = "Finding: auth bypass in login() — severity HIGH";
+    const findingEdited = findingSigned.replace("HIGH", "LOW");
+    const resultCtx = { runId, taskId: target.hop.taskId, promptDigest: target.hop.promptDigest };
+    const resultSignature = (0, telemetry_attestation_1.signTelemetry)(target.hop.usage, privateKeyPem, { ...resultCtx, resultDigest: (0, execution_backend_1.sha256)(findingSigned) });
+    // Baseline: the signed finding verifies, and the signature actually COVERED the result.
+    const resultClean = (0, telemetry_attestation_1.verifyTelemetryAttestation)(target.hop.usage, resultSignature, publicKeyPem, { ...resultCtx, resultDigest: (0, execution_backend_1.sha256)(findingSigned) });
+    // Tamper: CW re-derives the digest from the EDITED finding -> no longer the signed digest.
+    const resultCheck = (0, telemetry_attestation_1.verifyTelemetryAttestation)(target.hop.usage, resultSignature, publicKeyPem, { ...resultCtx, resultDigest: (0, execution_backend_1.sha256)(findingEdited) });
+    layers.push({
+        layer: "result",
+        tamper: `edited the agent's signed finding "severity HIGH" -> "severity LOW" after it was signed`,
+        before: {
+            verified: resultClean.status === "attested" && resultClean.coversResult === true,
+            detail: `the signed finding verifies — ed25519 binds usage + sha256(result), result-covering`
+        },
+        after: { verified: resultCheck.status === "attested", detail: resultCheck.reason || resultCheck.status },
+        failures: resultCheck.status === "attested" ? [] : [`result: ${resultCheck.reason}`]
+    });
     if (!options.keepDir && !options.dir)
         node_fs_1.default.rmSync(runDir, { recursive: true, force: true });
     const proven = baseline.ledgerVerified &&

package/dist/telemetry-ledger.js

@@ -94,6 +94,9 @@ function recordHashInput(record) {
         reportedUsageDigest: record.reportedUsageDigest,
         ...(record.reportedUsage !== undefined ? { reportedUsage: record.reportedUsage } : {}),
         usageSignature: record.usageSignature || null,
+        // Chain-bind resultDigest only when present, so a usage-only record's hash is
+        // byte-identical to a pre-result-coverage one (back-compat with old ledgers).
+        ...(record.resultDigest !== undefined ? { resultDigest: record.resultDigest } : {}),
         attestation: record.attestation,
         attestationReason: record.attestationReason || null,
         prevHash: record.prevHash
@@ -131,6 +134,9 @@ function appendTelemetryAttestation(run, input) {
         // signature can be independently re-verified offline at `telemetry verify`.
         ...(input.reportedUsage ? { reportedUsage: input.reportedUsage } : {}),
         usageSignature: input.usageSignature,
+        // Present only for a result-bound signature, so usage-only records are
+        // byte-identical (and their recordHash unchanged) — back-compat.
+        ...(input.resultDigest ? { resultDigest: input.resultDigest } : {}),
         attestation: input.attestation,
         attestationReason: input.attestationReason,
         prevHash

package/dist/version.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MIN_SUPPORTED_RUN_STATE_SCHEMA_VERSION = exports.LEGACY_RUN_STATE_SCHEMA_VERSION = exports.CURRENT_RUN_STATE_SCHEMA_VERSION = exports.WORKFLOW_APP_SCHEMA_VERSION = exports.CURRENT_COOL_WORKFLOW_VERSION = void 0;
-exports.CURRENT_COOL_WORKFLOW_VERSION = "0.1.87";
+exports.CURRENT_COOL_WORKFLOW_VERSION = "0.1.89";
 exports.WORKFLOW_APP_SCHEMA_VERSION = 1;
 exports.CURRENT_RUN_STATE_SCHEMA_VERSION = 1;
 exports.LEGACY_RUN_STATE_SCHEMA_VERSION = 0;

package/dist/worker-accept/telemetry-ledger.js

@@ -24,7 +24,12 @@ function attestWorkerDelegation(accept, deps) {
     // usage. Absent/invalid signature => `unattested`/`absent`, surfaced loudly,
     // NEVER silently recorded as trusted.
     const telemetry = options.agentDelegation
-        ? (0, telemetry_attestation_1.verifyTelemetryAttestation)(options.agentDelegation.reportedUsage, options.agentDelegation.usageSignature, (0, telemetry_attestation_1.resolveTrustPublicKey)(options.agentDelegation.usageTrustPublicKey), { runId: run.id, taskId: task.id, promptDigest: options.agentDelegation.promptDigest })
+        ? (0, telemetry_attestation_1.verifyTelemetryAttestation)(options.agentDelegation.reportedUsage, options.agentDelegation.usageSignature, (0, telemetry_attestation_1.resolveTrustPublicKey)(options.agentDelegation.usageTrustPublicKey), 
+        // resultDigest binds the agent's findings into the signature: CW recomputes
+        // the digest from the accepted result (the SAME raw bytes the executor
+        // signed) so a result edited after signing fails verification. A signer
+        // that did not cover the result still verifies (verifier back-compat).
+        { runId: run.id, taskId: task.id, promptDigest: options.agentDelegation.promptDigest, resultDigest: (0, execution_backend_1.sha256)(rawResult) })
         : undefined;
     // Track 1 fail-closed (Decision 2 — OPT-IN, off by default). When the operator
     // requires attested telemetry, a delegated hop whose verdict is not `attested`
@@ -59,7 +64,7 @@ function attestWorkerDelegation(accept, deps) {
  *  event can cross-link the record hash), then emits the worker.agent-delegation
  *  audit event. No-op for non-agent hops. */
 function recordWorkerDelegationLedger(accept, delegation) {
-    const { agentDelegation } = delegation;
+    const { agentDelegation, telemetry } = delegation;
     // The agent-hop attestation event — hung off worker.output, alongside
     // worker.backend. Recorded in trust-audit/provenance, NEVER in node evidence.
     if (!agentDelegation)
@@ -76,6 +81,11 @@ function recordWorkerDelegationLedger(accept, delegation) {
             promptDigest: agentDelegation.promptDigest,
             reportedUsage: agentDelegation.reportedUsage,
             usageSignature: agentDelegation.usageSignature,
+            // Store the signed result digest ONLY when the signature actually covered
+            // it, so the offline re-verifier (telemetry verify --pubkey / report verify)
+            // can reconstruct the 5-field payload. A usage-only signature stores none
+            // (its record stays byte-identical to a pre-result-coverage one).
+            resultDigest: telemetry?.coversResult ? agentDelegation.resultDigest : undefined,
             attestation: agentDelegation.usageAttestation,
             attestationReason: agentDelegation.usageAttestationReason
         })