cool-workflow 0.1.91 → 0.1.93

package/apps/architecture-review/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review",
   "title": "Architecture Review",
   "summary": "Map a repository architecture, assess risks, verify important findings, and synthesize an evidence-backed verdict.",
-  "version": "0.1.91",
+  "version": "0.1.93",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/architecture-review-fast/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review-fast",
   "title": "Architecture Review Fast",
   "summary": "Run a shorter architecture review with parallel map and assess phases for faster first results.",
-  "version": "0.1.91",
+  "version": "0.1.93",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/architecture-review-fast/workflow.js

@@ -100,7 +100,14 @@ module.exports = ({ workflow, phase, parallel, agent, artifact, input }) => {
             "Confirm real risks, downgrade unsupported claims, and list exact file paths, commands, logs, or unknowns.",
             "The cw:result evidence array must cite durable locators."
           ].join(" "),
-          strongOptions("Evidence verifier", { requiresEvidence: true })
+          strongOptions("Evidence verifier", {
+            requiresEvidence: true,
+            // Cache the (expensive, ~146s live) verification by source digest +
+            // ALL upstream phase result digests. A hit only when source AND every
+            // Map/Assess output are byte-identical; the cached result still passes
+            // worker-output validation (requiresEvidence stays enforced).
+            resultCache: sourceContextResultCache({ includeCompletedResults: "previous-phases" })
+          })
         )
       ]),
       phase("Verdict", [
@@ -113,7 +120,13 @@ module.exports = ({ workflow, phase, parallel, agent, artifact, input }) => {
             "State when the full architecture-review app should be scheduled as a background routine.",
             "The cw:result evidence array must support the final verdict."
           ].join(" "),
-          strongOptions("Fast verdict synthesizer", { requiresEvidence: true })
+          strongOptions("Fast verdict synthesizer", {
+            requiresEvidence: true,
+            // Cache the (~294s live, largest phase) synthesis by source digest +
+            // all upstream (Map/Assess/Verify) result digests. Busts on any
+            // upstream change; cached verdict re-passes evidence validation.
+            resultCache: sourceContextResultCache({ includeCompletedResults: "previous-phases" })
+          })
         )
       ])
     ]

package/apps/end-to-end-golden-path/app.json

@@ -3,7 +3,7 @@
   "id": "end-to-end-golden-path",
   "title": "End-to-End Golden Path",
   "summary": "Deterministic one-worker workflow app for proving the CW integration chain.",
-  "version": "0.1.91",
+  "version": "0.1.93",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/pr-review-fix-ci/app.json

@@ -3,7 +3,7 @@
   "id": "pr-review-fix-ci",
   "title": "PR Review Fix CI",
   "summary": "Review a pull request or branch, inspect CI failures, diagnose actionable issues, optionally patch, verify, and summarize with evidence.",
-  "version": "0.1.91",
+  "version": "0.1.93",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/release-cut/app.json

@@ -3,7 +3,7 @@
   "id": "release-cut",
   "title": "Release Cut",
   "summary": "Prepare a release with checklist discipline: version checks, changelog, tests, packaging, release notes, and final verification.",
-  "version": "0.1.91",
+  "version": "0.1.93",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/research-synthesis/app.json

@@ -3,7 +3,7 @@
   "id": "research-synthesis",
   "title": "Research Synthesis",
   "summary": "Split a research question into claims, investigate sources, cross-check evidence, verify claims, and synthesize a concise answer.",
-  "version": "0.1.91",
+  "version": "0.1.93",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/research-synthesis/workflow.js

@@ -41,7 +41,7 @@ module.exports = ({ workflow, phase, agent, artifact, input }) => {
       phase("Investigate", [
         agent(
           "investigate:primary-sources",
-          "Investigate primary or official sources first from {{source}} for {{question}}. Return source titles, dates, authors or publishers, durable locators, key claims, and uncertainty. Mark missing retrieval needs explicitly.",
+          "Investigate primary or official sources first from {{source}} for {{question}}. The local files in your working directory are also possible primary sources: list them first, then read the ones that help and cite their paths. Return source titles, dates, authors or publishers, durable locators (a local file path with optional :line, or a URL), key claims, and uncertainty. Mark missing retrieval needs explicitly.",
           { sandboxProfileId: "readonly" }
         ),
         agent(

package/dist/capability-core.js

@@ -40,6 +40,7 @@ exports.runExportArchive = runExportArchive;
 exports.runImportArchive = runImportArchive;
 exports.runInspectArchive = runInspectArchive;
 exports.runVerifyImport = runVerifyImport;
+exports.runRestoreArchive = runRestoreArchive;
 exports.reportBundle = reportBundle;
 exports.runVerifyReportBundle = runVerifyReportBundle;
 exports.queueAdd = queueAdd;
@@ -313,6 +314,52 @@ function runInspectArchive(_runner, args) {
 function runVerifyImport(runner, runId, args) {
     return (0, run_export_1.verifyImportedRun)(runner.withBaseDir(optionalString(args.cwd)).loadRun(runId));
 }
+// Fail-closed atomic restore of a portable run archive. `run import` runs a
+// verification (importRun returns it as ImportResult.verification) but does NOT
+// fail on it — it exits 0 even when the telemetry-ledger or trust-audit hash chain
+// does not verify, so a chain-tampered run imports with a fabricated success.
+// `run restore` closes that gap in ONE step: it integrity-INSPECTS the archive
+// FIRST (writing nothing), refuses a bad bundle before any import, then IMPORTS
+// and REUSES importRun's verification verdict — reporting ok:true ONLY when verify
+// passes. Pure composition of the existing functions (inspectArchive + importRun,
+// whose own verification we reuse); no new crypto or IO logic, and no second
+// re-hash. The CLI/MCP surfaces map ok:false to exit 1.
+function runRestoreArchive(runner, args) {
+    const base = invocationCwd(args);
+    const archive = optionalString(args.archive || args.path || args.file);
+    if (!archive)
+        throw new Error("run restore requires an archive path (positional, --archive, --path, or --file)");
+    const resolvedArchive = node_path_1.default.resolve(base, archive);
+    const target = node_path_1.default.resolve(base, optionalString(args.target || args.repo || args.cwd) || base);
+    // (1) Integrity-inspect FIRST — read-only, writes nothing. A bad bundle is
+    // refused here, before any import touches the target tree (no partial restore).
+    const inspect = (0, run_export_1.inspectArchive)(resolvedArchive);
+    if (!inspect.ok) {
+        return { schemaVersion: 1, ok: false, target, inspect, imported: null, verify: null, registry: null };
+    }
+    // (2) Intact: import + refresh the target registry (mirrors runImportArchive).
+    const imported = (0, run_export_1.importRun)(resolvedArchive, target);
+    const registry = new run_registry_1.RunRegistry(target, runner.withBaseDir(target));
+    const registryReport = registry.refresh({ scope: "repo" });
+    // (3) REUSE the verification importRun already ran — it re-proves the same
+    // restored files PLUS the telemetry-ledger and trust-audit hash chains, but
+    // returns the verdict WITHOUT throwing. We do NOT re-run verifyImportedRun (that
+    // would re-hash every file a second time for no new information). The gap restore
+    // closes is exactly that `run import` ships this verdict and exits 0 even when it
+    // is false — restore fails-closed on it below (CLI maps ok:false → exit 1).
+    const verify = imported.verification;
+    return {
+        schemaVersion: 1,
+        // inspect.ok is guaranteed true here — the corrupt-archive case early-returned
+        // above — so the verdict is purely verify.ok (the telemetry/trust-audit chain).
+        ok: verify.ok,
+        target,
+        inspect,
+        imported: { ...imported, registry: registryReport },
+        verify,
+        registry: registryReport
+    };
+}
 // Produce-and-prove: export a run to a portable bundle sealed with the operator's
 // trust key (defaulting to CW_AGENT_ATTEST_PUBKEY, same as `run export`), then
 // IMMEDIATELY verify the artifact offline the way a recipient will. The producer

package/dist/capability-registry.js

@@ -395,6 +395,7 @@ const BUILTIN_CAPABILITIES = [
     { capability: "run.import", summary: "Restore a portable run archive into a target repo and verify restored file digests.", entry: "runImportArchive", surface: "both", cli: { path: ["run", "import"], jsonMode: "default" }, mcp: { tool: "cw_run_import", requiredArgs: ["archive|path|file"] } },
     { capability: "run.verify-import", summary: "Verify an imported run against its restore manifest and telemetry chain.", entry: "runVerifyImport", surface: "both", cli: { path: ["run", "verify-import"], jsonMode: "default" }, mcp: { tool: "cw_run_verify_import", requiredArgs: ["runId"] } },
     { capability: "run.inspect-archive", summary: "Read-only integrity inspection of a portable run archive without importing it.", entry: "runInspectArchive", surface: "both", cli: { path: ["run", "inspect-archive"], jsonMode: "default" }, mcp: { tool: "cw_run_inspect_archive", requiredArgs: ["archive|path|file"] } },
+    { capability: "run.restore", summary: "Fail-closed restore of a portable run archive: integrity-inspect, import, and verify in one step; refuses anything that does not verify.", entry: "runRestoreArchive", surface: "both", cli: { path: ["run", "restore"], jsonMode: "default" }, mcp: { tool: "cw_run_restore", requiredArgs: ["archive|path|file"] } },
     { capability: "report.verify-bundle", summary: "Offline self-contained verify of a portable run bundle: archive bytes + telemetry chain + trust-audit chain + embedded-key signatures.", entry: "runVerifyReportBundle", surface: "both", cli: { path: ["report", "verify-bundle"], caseTokens: ["report"], jsonMode: "default" }, mcp: { tool: "cw_report_verify_bundle", requiredArgs: ["archive|path|file|bundle"] } },
     { capability: "report.bundle", summary: "Produce-and-prove: export a run to a portable bundle sealed with the trust key, then self-verify it offline (fail-closed) so the producer knows it is verifiable before shipping.", entry: "reportBundle", surface: "both", cli: { path: ["report", "bundle"], caseTokens: ["report"], jsonMode: "default" }, mcp: { tool: "cw_report_bundle", requiredArgs: ["runId"] } },
     { capability: "run.drive", summary: "Preview the next agent-delegation drive step for a run (read-only, deterministic).", entry: "runDrivePreview", surface: "both", cli: { path: ["run", "drive"], caseTokens: ["run", "drive"], jsonMode: "default" }, mcp: { tool: "cw_run_drive" } },
@@ -655,6 +656,7 @@ const PAYLOAD_PROBE_DEFERRED_GROUPS = [
             "run.import",
             "run.verify-import",
             "run.inspect-archive",
+            "run.restore",
             "report.verify-bundle",
             "report.bundle",
             "queue.add",