cool-workflow 0.1.91 → 0.1.92

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cool-workflow",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
-  "version": "0.1.91",
+  "version": "0.1.92",
   "author": {
     "name": "COOLWHITE LLC"
   },

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.91",
+  "version": "0.1.92",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
   "author": {
     "name": "COOLWHITE LLC"

package/README.md

@@ -1,3 +1,4 @@
+<!-- AUTO-GENERATED from /README.md by scripts/sync-readme.js — edit the root README, then run `npm run sync:readme`. DO NOT edit this file directly. -->
 <div align="center">
 
 # Cool Workflow
@@ -10,16 +11,11 @@
 [![provenance](https://img.shields.io/badge/npm-provenance-3178C6?style=flat-square)](https://www.npmjs.com/package/cool-workflow)
 [![release](https://img.shields.io/github/v/tag/coo1white/cool-workflow?style=flat-square&label=release&color=brightgreen&sort=semver)](https://github.com/coo1white/cool-workflow/tags)
 [![license](https://img.shields.io/badge/license-BSD--2--Clause-blue?style=flat-square)](https://github.com/coo1white/cool-workflow/blob/main/LICENSE)
-![MCP](https://img.shields.io/badge/MCP-native-8A2BE2?style=flat-square)
-![runtime](https://img.shields.io/badge/runtime-TypeScript%20%C2%B7%20Node-3178C6?style=flat-square)
 
-<img src="https://raw.githubusercontent.com/coo1white/cool-workflow/main/docs/assets/cool-workflow-readme-promo.png" alt="Cool Workflow turns AI agent repo questions into saved, cited, tamper-evident reports." width="100%">
+<img src="https://raw.githubusercontent.com/coo1white/cool-workflow/main/docs/assets/cw-hero.svg" alt="Your AI report, already proven — cw demo tamper forges a signed report three ways (ledger, signature, result) and catches every one offline with only the public key." width="100%">
 
 </div>
 
-> An auditable agent-workflow control-plane — **delegate, don't execute**.
-> `plan → dispatch → record → verify → commit → report`
-
 ## Install
 
 ```bash
@@ -38,7 +34,7 @@ cw demo tamper
 # → VERDICT: tamper-evidence holds ✓
 ```
 
-### 2. Run a review on your code — one command
+### 2. Ask a question — your code, or any folder — one command
 
 ```bash
 cw -q "What are the main risks here?"
@@ -53,47 +49,80 @@ cw -q "What are the security risks?" -codex
 cw -q "What are the security risks?" -deepseek
 ```
 
-Review a project **from any directory** — no `cd` needed — by pointing at its folder:
+`claude`, `codex`, `gemini`, and `opencode` are auto-detected on PATH (no flag needed);
+`-deepseek` picks the DeepSeek builtin — no env vars needed.
+
+**Not just code.** Point CW at a folder of docs, notes, or papers and it reads the files
+there as sources, then gives you the same saved, cited report:
 
 ```bash
-cw -q "What are the risks?" -dir /path/to/project   # -d / --dir / --repo are equivalent
+cw quickstart research-synthesis --repo /path/to/papers \
+  --question "What do these papers conclude?"
+```
+
+As the agent works you get a **calm, Claude-Code-style live view** — a compact rolling window that
+updates in place instead of an endless wall:
+
+```text
+● Read(execution-backend.ts)
+  ⎿ 910 lines
+● Grep(spawnSync)
+  ⎿ 17 matches
+✶ Searching worker-isolation.ts… (3s)
 ```
 
-Or review a **remote repo by URL** — CW clones it for you, then reviews the checkout
-(`-l` / `--link`, or just pass the URL to `-dir`/`--repo`):
+Each tool folds to a `● ToolName(arg)` line with a dim `⎿` result summary; older steps fold away (the
+window stays a few rows) and the worker collapses to one line when done. It's compact by default
+(reasoning hidden) — add `--verbose` for the full narration, `--full` to also print the report inline,
+or `--no-color` to drop ANSI (`NO_COLOR` / `FORCE_COLOR` are honored too). The complete narration +
+tool I/O is always saved to a per-worker `transcript.md` next to the result, and the cursor is
+restored cleanly on Ctrl-C.
+
+Review a project **from any directory** — no `cd` needed — by pointing at its folder
+(`-d` / `--dir` / `--repo` are equivalent):
+
+```bash
+cw -q "What are the risks?" -dir /path/to/project
+```
+
+Or review a **remote repo by URL** — CW clones it, then reviews the checkout (`-l` / `--link`,
+or pass the URL straight to `-dir`/`--repo`):
 
 ```bash
 cw -q "What are the risks?" --link https://github.com/owner/repo
 cw -q "What are the risks?" --link git@gitlab.com:owner/repo.git --ref v1.2.0
 ```
 
-Works with GitHub, GitLab, Bitbucket, self-hosted git, `ssh://`, and `file://` — **and with
-downloadable archives** (`.tar.gz`/`.tgz`/`.tar`/`.zip`, e.g. a GitHub "Download ZIP" link),
-which are fetched, extracted, and snapshotted into a local repo before review. The clone is
-cached under `~/.local/state/cool-workflow/clones/` and reused on the next question (`--refresh`
-re-fetches; manage with `cw clones list` / `cw clones gc`). The report records the exact origin —
-`Source: <url>@<commit>` — and a tamper-evident `source.clone` event you can re-prove with
-`cw audit verify`. A private repo with no credentials **fails closed** (it never hangs on a
-prompt). Validate without fetching: `cw -q "…" --link <url> --check`.
+GitHub, GitLab, Bitbucket, self-hosted git, `ssh://`, and `file://` all work — as do downloadable
+archives (`.tar.gz`/`.tgz`/`.tar`/`.zip`), fetched + extracted + snapshotted before review. The clone is cached
+under `~/.local/state/cool-workflow/clones/` and reused next time (`--refresh` re-fetches; `cw clones
+list`/`gc` manage it). The report records `Source: <url>@<commit>` plus a tamper-evident
+`source.clone` event (`cw audit verify`). A credential-less private repo **fails closed** — it never
+hangs on a prompt. Preview without fetching: `cw -q "…" --link <url> --check`.
 
-As it runs you see CW's own phases tick by, then a clean summary — no env vars needed:
+CW's own phases tick by as it runs, then it prints a clean summary — a **compact findings table**
+(id / severity / classification, not the full prose), the report path, and where the per-worker
+transcripts live:
 
 ```text
 ==> Map ✓ (6/6)
-==> Assess ✓ (6/6)
 ==> Verdict ✓
 
+Findings: 3 — 2×P1, 1×P2
+
 ✓ Report: /path/to/project/.cw/runs/<run-id>/report.md
   ✓ Status: complete — 14/14
+  Transcript: /path/to/project/.cw/runs/<run-id>/
   Next: cw report <run-id> --show
 ```
 
-If something is off, the error hands you the next move — e.g. `Try: cw doctor` when no
-agent is configured. Pipe-clean: with `--json`, stdout is pure data and all of this chrome
-goes to stderr (TTY only).
+If something is off, the error names the next move (e.g. `Try: cw doctor`). With `--json`,
+stdout is pure data — all of this chrome goes to stderr (TTY only).
 
 ### 3. Open the report
 
+The command prints the report path. For example:
+
 ```bash
 cat .cw/runs/<run-id>/report.md
 # → findings with clickable file.ts:42 pointers for every claim
@@ -112,7 +141,7 @@ cw fix                            # show fix commands for setup issues
 |---|---|
 | `architecture-review` | Map a repo, rank risks, back every claim with evidence |
 | `pr-review-fix-ci` | Review a pull request, suggest fixes, verify CI |
-| `research-synthesis` | Answer a question with fact-backed research |
+| `research-synthesis` | Answer a question over a local folder of files — your own docs, notes, or papers, not only code |
 | `release-cut` | Run a gated, reviewed release |
 
 **Multi-agent, when you need it.** Fan work out across agents with built-in topologies,
@@ -120,8 +149,13 @@ compose flows (a task can run a whole child workflow with `subWorkflow`, or a `l
 can keep iterating until a predicate or a token budget says stop) — and re-run fast:
 `cw run <app> --drive --incremental` reuses every step whose inputs didn't change.
 
+<div align="center">
+<img src="https://raw.githubusercontent.com/coo1white/cool-workflow/main/docs/assets/topologies.svg" alt="Built-in multi-agent topologies: map-reduce (fan out, fold in), debate (argue then draw a verdict), and judge-panel (N independent judges score one candidate)." width="92%">
+</div>
+
 CW also has an **MCP** surface — **Claude Desktop, Cursor, and VS Code call CW as a tool**, so
 your agent can plan a run, drive it, and verify a report without leaving the editor.
+See the [wiki](https://github.com/coo1white/cool-workflow/wiki).
 
 ## Can I Trust the Report?
 
@@ -133,7 +167,6 @@ and the check fails. CW holds no private key — the agent signs, CW only verifi
 ```bash
 cw demo tamper                              # proves it in 30s — edits a signed result, watch it fail
 cw telemetry verify <run-id>                # checks a real run
-cw audit verify <run-id>                    # re-proves the trust-audit hash chain
 ```
 
 Give the report to another person — they need nothing but the file:
@@ -148,369 +181,38 @@ cw report verify-bundle report.cwrun.json \
 This attests the agent's **signed findings** — not that the report holds nothing else, and not that
 none were left out. CW has no key to sign the rendered report, and a determined re-chainer can drop a
 signed finding entirely — so check the findings you act on against the signed results. For exactly
-what is and is not proven, see the [Trust Model](docs/trust-model.md).
+what is and is not proven, see the [Trust Model](https://github.com/coo1white/cool-workflow/blob/main/plugins/cool-workflow/docs/trust-model.md).
 
 ## Troubleshooting
 
 | Problem | Fix |
 |---|---|
 | No agent found | Run `cw doctor` — it shows which agents are on your machine |
-| `status: blocked` | CW failing closed (it never makes up a result). Set `CW_AGENT_COMMAND=builtin:claude` or pass `-claude`; `cw doctor` names the exact reason |
-| `claude: command not found` | Install Claude Code (`npm install -g @anthropic-ai/claude-code`) and run again |
+| `status: blocked` | Set `CW_AGENT_COMMAND=builtin:claude` or pass `-claude` |
+| `claude: command not found` | Install Claude Code and run again |
 | Where is my report? | `<repo>/.cw/runs/<id>/report.md` |
-| Preflight before a spawn | `cw quickstart --check` — a zero-write check |
-
----
-
-The rest of this README is the **developer / operator reference**: the build loop, repo
-structure, the full command surface, scheduling, and the result-envelope contract.
-
-## Developer Loop
-
-Use the shortest check that fits the change (from `plugins/cool-workflow/`):
-
-```bash
-cd plugins/cool-workflow
-npm run build
-node test/<nearest-smoke>.js
-npm run test:fast
-```
-
-For a source checkout, `cw doctor --onramp --changed-from origin/main` gives the
-nearest smoke tests and release gate commands for the current change. Before a
-release, run `npm run release:check`.
-
-## Structure
-
-```text
-cool-workflow
-  skills/cool-workflow/SKILL.md
-  src/
-  dist/
-  scripts/cw.js
-  workflows/architecture-review.workflow.js
-  workflows/research-synthesis.workflow.js
-  apps/architecture-review/app.json
-  apps/end-to-end-golden-path/app.json
-  apps/pr-review-fix-ci/app.json
-  apps/release-cut/app.json
-  apps/research-synthesis/app.json
-  apps/workflow-app-framework-demo/app.json
-  docs/index.md
-  docs/getting-started.md
-  docs/coordinator-blackboard.7.md
-  docs/multi-agent-runtime-core.7.md
-  docs/multi-agent-eval-replay-harness.7.md
-  docs/dogfood-one-real-repo.7.md
-  docs/release-and-migration.7.md
-  docs/agent-framework.md
-  docs/unix-principles.md
-  docs/mcp-app-surface.7.md
-  docs/operator-ux.7.md
-  docs/workflow-app-framework.7.md
-  docs/sandbox-profiles.7.md
-  docs/candidate-scoring.7.md
-  docs/verifier-gated-commit.7.md
-  docs/run-registry-control-plane.7.md
-  docs/execution-backends.7.md
-```
-
-## Commands
-
-Installed via npm, the bin is `cw` (alias `cool-workflow`): e.g. `cw list`,
-`cw quickstart …`. From a cloned source checkout, before `npm run build`, use the
-matching `node scripts/cw.js <cmd>` form shown in the examples below.
+| Need the old README? | See [docs/readme-v0.1.87-full.md](https://github.com/coo1white/cool-workflow/blob/main/plugins/cool-workflow/docs/readme-v0.1.87-full.md) |
 
-List bundled workflows:
+## How It Works
 
-```bash
-node scripts/cw.js list
-```
-
-List, inspect, validate, and create workflow apps:
-
-```bash
-node scripts/cw.js app list
-node scripts/cw.js app show architecture-review
-node scripts/cw.js app validate apps/architecture-review/app.json
-node scripts/cw.js app show pr-review-fix-ci
-node scripts/cw.js app show release-cut
-node scripts/cw.js app show research-synthesis
-node scripts/cw.js app show workflow-app-framework-demo
-node scripts/cw.js app validate apps/workflow-app-framework-demo/app.json
-node scripts/cw.js app validate end-to-end-golden-path
-node scripts/cw.js app package architecture-review
-node scripts/cw.js app init my-app --title "My App"
-```
-
-Compose flows from smaller verified ones (app-authoring surface, `workflow-api.ts`):
-
-- **Sub-workflow nesting** — a task can run a whole child app instead of one agent:
-  `subWorkflow(id, appId, { inputs?, bindResult? })`. The drive plans and drives the
-  child, then binds its report (or verdict result) back as the task's result, so the
-  parent's verifier/schema gate consumes it like any other. Leaf work stays external-agent
-  delegation at every depth; recursion is depth- and cycle-bounded, fail-closed.
-- **Bounded dynamic loops** — converge without unbounded recursion:
-  `loop(name, tasks, { maxRounds, until })` is a per-round template. After each round a
-  named, registered pure predicate (`until: { kind: "predicate", ref }`) decides whether to
-  append another round or stop, hard-capped at `maxRounds`; built-ins `no-new-findings` and
-  `single-round`. Or scale by budget — `until: { kind: "budget-target", target }` keeps
-  going while recorded (attested-only) usage stays under `target`, with the fail-closed
-  `limits.tokenBudget` cap as the absolute backstop. Predicates are registry refs (not
-  closures), so runs replay byte-identically; an unregistered predicate stops fail-closed.
-
-Create a reusable workflow script:
-
-```bash
-node scripts/cw.js init my-workflow --title "My Workflow"
-```
-
-Create a run:
-
-```bash
-node scripts/cw.js plan architecture-review \
-  --repo /path/to/repo \
-  --question "Is this architecture sound?" \
-  --invariant "single-box self-hosted"
-```
-
-Inspect a run as an operator:
-
-```bash
-node scripts/cw.js status <run-id>
-node scripts/cw.js status <run-id> --json
-node scripts/cw.js graph <run-id>
-node scripts/cw.js graph <run-id> --json
-node scripts/cw.js report <run-id> --show
-node scripts/cw.js topology summary <run-id>
-node scripts/cw.js topology graph <run-id>
-node scripts/cw.js worker summary <run-id>
-node scripts/cw.js multi-agent summary <run-id>
-node scripts/cw.js multi-agent graph <run-id>
-node scripts/cw.js candidate summary <run-id>
-node scripts/cw.js feedback summary <run-id>
-node scripts/cw.js commit summary <run-id>
-node scripts/cw.js state check <run-id>
-```
-
-MCP hosts can drive the same flow with JSON tools:
+CW is a small TypeScript tool with zero runtime deps. It drives your agent over a repo, or any
+folder of files, in saved, replayable stages — it plans the work, dispatches each task to your agent, records and
+verifies every result, then commits and renders the report — writing everything to disk as
+inspectable files. It never imports a model SDK or stores an API key.
 
-```text
-cw_app_run -> cw_dispatch -> cw_worker_manifest -> cw_worker_output
--> cw_candidate_register -> cw_candidate_score -> cw_candidate_select
--> cw_commit -> cw_operator_report
-```
-
-MCP also exposes topology tools:
-
-```text
-cw_topology_list
-cw_topology_show
-cw_topology_validate
-cw_topology_apply
-cw_topology_summary
-cw_topology_graph
-```
-
-List, inspect, validate, and apply official multi-agent topologies:
-
-```bash
-node scripts/cw.js topology list
-node scripts/cw.js topology show map-reduce
-node scripts/cw.js topology show debate
-node scripts/cw.js topology show judge-panel
-node scripts/cw.js topology validate map-reduce
-node scripts/cw.js topology apply <run-id> map-reduce --task <task-id> --mappers 2
-node scripts/cw.js topology apply <run-id> debate --id debate-round --rounds 2
-node scripts/cw.js topology apply <run-id> judge-panel --judgeCount 3
-node scripts/cw.js topology summary <run-id>
-node scripts/cw.js topology summary <run-id> --json
-node scripts/cw.js topology graph <run-id>
-node scripts/cw.js topology graph <run-id> --json
-node scripts/cw.js topology show <run-id> <topology-run-id>
-```
-
-Topology runs are kept under `.cw/runs/<run-id>/topologies/`, pointed to from
-`state.json`, put into operator status and graph output, and counted in the
-trust audit summary.
-
-Create a dispatch manifest for the current runnable phase:
-
-```bash
-node scripts/cw.js dispatch <run-id> --limit 6
-node scripts/cw.js dispatch <run-id> --sandbox readonly
-node scripts/cw.js dispatch <run-id> --multi-agent-run ma --multi-agent-group group --multi-agent-role role
-node scripts/cw.js dispatch <run-id> --multi-agent-fanout <fanout-id>
-```
-
-Inspect sandbox profiles:
-
-```bash
-node scripts/cw.js sandbox list
-node scripts/cw.js sandbox show readonly
-node scripts/cw.js sandbox validate ./site-sandbox.json
-```
-
-Record an agent result after a worker finishes:
-
-```bash
-node scripts/cw.js result <run-id> <task-id> path/to/result.md
-```
-
-Register, score, rank, and verifier-gate a candidate output:
-
-```bash
-node scripts/cw.js candidate register <run-id> --worker <worker-id>
-node scripts/cw.js candidate score <run-id> <candidate-id> \
-  --criterion correctness=4 \
-  --criterion evidence=4 \
-  --criterion fit=2 \
-  --maxTotal 10 \
-  --evidence /path/to/file.ts:42
-node scripts/cw.js candidate rank <run-id>
-node scripts/cw.js candidate select <run-id> <candidate-id> --reason "verified winner"
-```
-
-Create a deterministic state commit:
-
-```bash
-node scripts/cw.js commit <run-id> --verifier <node-id> --reason "verified result"
-node scripts/cw.js commit <run-id> --selection <selection-id> --reason "verified winner"
-node scripts/cw.js commit <run-id> --allow-unverified-checkpoint --reason "manual checkpoint"
-```
-
-The first two commands make verifier-gated committed state. The last command
-makes a clear non-gated checkpoint.
-
-Render a report:
-
-```bash
-node scripts/cw.js report <run-id>
-```
-
-Look after runs across repos with the control plane (derived, fail-closed registry):
-
-```bash
-node scripts/cw.js registry refresh --scope home
-node scripts/cw.js run search --app architecture-review --status failed
-node scripts/cw.js run show <run-id>
-node scripts/cw.js run resume <run-id>
-node scripts/cw.js run resume <run-id> --drive --incremental   # re-drive, reusing every step whose inputs are unchanged
-node scripts/cw.js run rerun <failed-run-id> --reason "retry"
-node scripts/cw.js run archive <run-id> --reason "old"
-node scripts/cw.js queue add --app release-cut --priority 10
-node scripts/cw.js queue list
-node scripts/cw.js queue drain --limit 1
-node scripts/cw.js history --scope home --json
-```
-
-Run the deterministic release golden path:
+<div align="center">
+<img src="https://raw.githubusercontent.com/coo1white/cool-workflow/main/docs/assets/pipeline.svg" alt="The CW pipeline: ask, plan, dispatch (fanning out to parallel agents), verify, commit, ending in a saved report.md with a clickable file.ts:42 citation. CW keeps the books; it never runs the model itself." width="100%">
+</div>
 
-```bash
-npm run dogfood:release
-npm run release:check
-npm run canonical-apps
-npm run golden-path
-npm run fixture-compat
-npm run version:sync
-npm test
-```
+`ask simple → run simple → verify simple → resume simple`
 
-Run data lives under `.cw/runs/<run-id>/` in `--cwd`, or in `--repo` when
-`--cwd` is left out.
+For the full API, multi-agent topologies, execution backends, and the CLI/MCP surface,
+see the [wiki](https://github.com/coo1white/cool-workflow/wiki).
 
-Build the TypeScript runtime:
-
-```bash
-npm install --no-package-lock
-npm run build
-```
-
-See [docs/agent-framework.md](docs/agent-framework.md) for the developer contract.
-See [docs/index.md](docs/index.md) for a docs map.
-See [docs/getting-started.md](docs/getting-started.md) for a clone-to-run path.
-See [docs/release-and-migration.7.md](docs/release-and-migration.7.md) for
-release and migration discipline.
-See [docs/dogfood-one-real-repo.7.md](docs/dogfood-one-real-repo.7.md) for the
-real-repository dogfood release proof.
-See [docs/operator-ux.7.md](docs/operator-ux.7.md) for the operator command
-surface.
-See [docs/workflow-app-framework.7.md](docs/workflow-app-framework.7.md) for the app
-contract.
-See [docs/canonical-workflow-apps.7.md](docs/canonical-workflow-apps.7.md) for
-the canonical app matrix.
-See [docs/candidate-scoring.7.md](docs/candidate-scoring.7.md) for the
-candidate scoring file contract.
-See [docs/verifier-gated-commit.7.md](docs/verifier-gated-commit.7.md) for the
-commit gate contract.
-See [docs/sandbox-profiles.7.md](docs/sandbox-profiles.7.md) for the sandbox
-profile contract.
-See [docs/end-to-end-golden-path.7.md](docs/end-to-end-golden-path.7.md) for
-the release golden path contract.
-See [docs/run-registry-control-plane.7.md](docs/run-registry-control-plane.7.md)
-for the cross-repo run registry / control plane contract.
+CW dogfoods its own release process — every cut runs the `release-cut` workflow against this
+repo. See the [full README](https://github.com/coo1white/cool-workflow/blob/main/plugins/cool-workflow/docs/readme-v0.1.87-full.md) for the
+pre-v0.1.87 reference.
 
 ## License
 
-CW is released under the BSD-2-Clause License.
-
-## Scheduled Tasks
-
-```bash
-node scripts/cw.js loop --intervalMinutes 30 --prompt "Continue this workflow."
-node scripts/cw.js schedule create --kind loop --intervalMinutes 30 --prompt "Continue this workflow."
-node scripts/cw.js schedule due
-node scripts/cw.js schedule pause <schedule-id>
-node scripts/cw.js schedule resume <schedule-id>
-node scripts/cw.js schedule run-now <schedule-id>
-node scripts/cw.js schedule history <schedule-id>
-node scripts/cw.js schedule daemon --once
-```
-
-See [docs/scheduled-tasks.md](docs/scheduled-tasks.md).
-
-## Routine-Style Triggers
-
-```bash
-node scripts/cw.js routine create --kind api --prompt "Handle this API event."
-node scripts/cw.js routine create --kind github --prompt "Handle this GitHub event."
-node scripts/cw.js routine fire api payload.json
-node scripts/cw.js routine events
-```
-
-## Result Envelope
-
-Verification and synthesis tasks need a structured result block:
-
-````text
-```cw:result
-{
-  "summary": "short summary",
-  "findings": [
-    {
-      "id": "risk-1",
-      "classification": "real",
-      "severity": "P1",
-      "evidence": ["/absolute/path/file.ts:42"]
-    }
-  ],
-  "evidence": ["/absolute/path/file.ts:42"]
-}
-```
-````
-
-## 0.1.89 (v0.1.89)
-
-Headline golden-path fixes: `cw -q "question"` asks the question (was read as an app id), auto-detects the cwd as the repo (run anywhere, no `--repo`/`cd`), and `cw help` renders a clean wrapped command list with a trailing newline; plus a vendor-agnostic UI/UX prevention gate (a headline-command smoke + a real `npm install -g` run-from-anywhere smoke) so a CLI-surface regression can't ship invisibly again.
-
-## 0.1.88 (v0.1.88)
-
-Orchestration-parity for the agent drive — inline `subWorkflow()` nesting, bounded dynamic `loop()` phases (a `predicate` or a `budget-target` token `until`), and `cw run --drive --incremental` step-level resume; the agent now signs its findings (result-bound ed25519) and `cw report verify-bundle --require-signatures` proves offline that every signed finding is in the report unaltered; CLI simplified to 6 commands with agent streaming on by default; path-traversal run ids refused on archive import.
-
-## 0.1.87 (v0.1.87)
-
-npm test parallel, 4-vendor wrappers (Claude/Codex/Gemini/OpenCode), Homebrew-style CLI UX (colors/did-you-mean/categorized help/error tips/cw info/cw search/cw man/doctor --fix), post-success summaries, agent execution timing
-
-v0.1.90
-
-v0.1.91
+BSD-2-Clause. Built by COOLWHITE LLC.

package/apps/architecture-review/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review",
   "title": "Architecture Review",
   "summary": "Map a repository architecture, assess risks, verify important findings, and synthesize an evidence-backed verdict.",
-  "version": "0.1.91",
+  "version": "0.1.92",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/architecture-review-fast/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review-fast",
   "title": "Architecture Review Fast",
   "summary": "Run a shorter architecture review with parallel map and assess phases for faster first results.",
-  "version": "0.1.91",
+  "version": "0.1.92",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/end-to-end-golden-path/app.json

@@ -3,7 +3,7 @@
   "id": "end-to-end-golden-path",
   "title": "End-to-End Golden Path",
   "summary": "Deterministic one-worker workflow app for proving the CW integration chain.",
-  "version": "0.1.91",
+  "version": "0.1.92",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/pr-review-fix-ci/app.json

@@ -3,7 +3,7 @@
   "id": "pr-review-fix-ci",
   "title": "PR Review Fix CI",
   "summary": "Review a pull request or branch, inspect CI failures, diagnose actionable issues, optionally patch, verify, and summarize with evidence.",
-  "version": "0.1.91",
+  "version": "0.1.92",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/release-cut/app.json

@@ -3,7 +3,7 @@
   "id": "release-cut",
   "title": "Release Cut",
   "summary": "Prepare a release with checklist discipline: version checks, changelog, tests, packaging, release notes, and final verification.",
-  "version": "0.1.91",
+  "version": "0.1.92",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/research-synthesis/app.json

@@ -3,7 +3,7 @@
   "id": "research-synthesis",
   "title": "Research Synthesis",
   "summary": "Split a research question into claims, investigate sources, cross-check evidence, verify claims, and synthesize a concise answer.",
-  "version": "0.1.91",
+  "version": "0.1.92",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/research-synthesis/workflow.js

@@ -41,7 +41,7 @@ module.exports = ({ workflow, phase, agent, artifact, input }) => {
       phase("Investigate", [
         agent(
           "investigate:primary-sources",
-          "Investigate primary or official sources first from {{source}} for {{question}}. Return source titles, dates, authors or publishers, durable locators, key claims, and uncertainty. Mark missing retrieval needs explicitly.",
+          "Investigate primary or official sources first from {{source}} for {{question}}. The local files in your working directory are also possible primary sources: list them first, then read the ones that help and cite their paths. Return source titles, dates, authors or publishers, durable locators (a local file path with optional :line, or a URL), key claims, and uncertainty. Mark missing retrieval needs explicitly.",
           { sandboxProfileId: "readonly" }
         ),
         agent(

package/dist/doctor.js

@@ -174,6 +174,7 @@ function formatDoctorReport(report) {
         lines.push("  1. cw demo tamper        — prove trust checks work (30s)");
         lines.push("  2. cw demo bundle         — prove portable bundles (30s)");
         lines.push('  3. cw -q "what risks?"     — your first real report (needs an agent)');
+        lines.push('     cw quickstart research-synthesis --repo <folder> --question "..."  — cited report over a docs/papers folder, not only code');
         lines.push("");
         lines.push("Onramp");
         lines.push(`  ${report.onramp.summary}`);