cool-workflow 0.1.95 → 0.1.96

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cool-workflow",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
-  "version": "0.1.95",
+  "version": "0.1.96",
   "author": {
     "name": "COOLWHITE LLC"
   },

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.95",
+  "version": "0.1.96",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
   "author": {
     "name": "COOLWHITE LLC"

package/apps/architecture-review/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review",
   "title": "Architecture Review",
   "summary": "Map a repository architecture, assess risks, verify important findings, and synthesize an evidence-backed verdict.",
-  "version": "0.1.95",
+  "version": "0.1.96",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/architecture-review/workflow.js

@@ -1,4 +1,4 @@
-module.exports = ({ workflow, phase, agent, artifact, input }) => {
+module.exports = ({ workflow, phase, parallel, agent, artifact, input }) => {
   const inputs = [
     input("repo", {
       type: "path",
@@ -33,7 +33,7 @@ module.exports = ({ workflow, phase, agent, artifact, input }) => {
     inputs,
     sandboxProfiles: ["readonly"],
     phases: [
-      phase("Map", [
+      parallel("Map", [
         agent(
           "map:server-api",
           "Map server/API entrypoints, request flows, service boundaries, auth surfaces, and owned state in {{repo}} for {{question}}. Focus: {{focus}}. Invariants: {{invariant}}. Return inspected files, dependencies, invariants, and candidate risks.",
@@ -65,7 +65,7 @@ module.exports = ({ workflow, phase, agent, artifact, input }) => {
           { sandboxProfileId: "readonly" }
         )
       ]),
-      phase("Assess", [
+      parallel("Assess", [
         agent(
           "assess:security",
           "Assess mapper findings through a security lens. Separate real, conditional, non-issue, and unknown risks with evidence, falsifiers, and exact files or config keys.",

package/apps/architecture-review-fast/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review-fast",
   "title": "Architecture Review Fast",
   "summary": "Run a shorter architecture review with parallel map and assess phases for faster first results.",
-  "version": "0.1.95",
+  "version": "0.1.96",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/end-to-end-golden-path/app.json

@@ -3,7 +3,7 @@
   "id": "end-to-end-golden-path",
   "title": "End-to-End Golden Path",
   "summary": "Deterministic one-worker workflow app for proving the CW integration chain.",
-  "version": "0.1.95",
+  "version": "0.1.96",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/pr-review-fix-ci/app.json

@@ -3,7 +3,7 @@
   "id": "pr-review-fix-ci",
   "title": "PR Review Fix CI",
   "summary": "Review a pull request or branch, inspect CI failures, diagnose actionable issues, optionally patch, verify, and summarize with evidence.",
-  "version": "0.1.95",
+  "version": "0.1.96",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/release-cut/app.json

@@ -3,7 +3,7 @@
   "id": "release-cut",
   "title": "Release Cut",
   "summary": "Prepare a release with checklist discipline: version checks, changelog, tests, packaging, release notes, and final verification.",
-  "version": "0.1.95",
+  "version": "0.1.96",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/research-synthesis/app.json

@@ -3,7 +3,7 @@
   "id": "research-synthesis",
   "title": "Research Synthesis",
   "summary": "Split a research question into claims, investigate sources, cross-check evidence, verify claims, and synthesize a concise answer.",
-  "version": "0.1.95",
+  "version": "0.1.96",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/dist/agent-config.js

@@ -31,6 +31,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const run_registry_1 = require("./run-registry");
 const execution_backend_1 = require("./execution-backend");
+const state_1 = require("./state");
 exports.AGENT_CONFIG_SCHEMA_VERSION = 1;
 function agentConfigPath(env = process.env) {
     return node_path_1.default.join((0, run_registry_1.resolveCwHome)(env), "agent-config.json");
@@ -260,7 +261,7 @@ function setAgentConfigFile(patch, env = process.env) {
     const stored = redacted(merged);
     const file = agentConfigPath(env);
     node_fs_1.default.mkdirSync(node_path_1.default.dirname(file), { recursive: true });
-    node_fs_1.default.writeFileSync(file, `${JSON.stringify(stored, null, 2)}\n`, "utf8");
+    (0, state_1.writeJson)(file, stored);
     return stored;
 }
 /** Read-only, deterministic projection of the effective config (secret-stripped).

package/dist/dispatch.js

@@ -202,15 +202,16 @@ function formatDispatchTask(task) {
     };
 }
 // Deterministic dispatch id (replay-determinism self-audit): the wall-clock stamp
-// is an edge timestamp (stripped on replay), but the former Math.random() suffix
-// made every dispatch mint a non-reproducible id. The suffix is now a per-run
-// sequence — the count of dispatches already allocated on this run — so re-running
-// the same workflow yields byte-identical dispatch ids while each dispatch within a
-// run still gets a distinct, monotonically increasing id. Mirrors the de-clock done
-// for worker ids in src/worker-isolation/paths.ts.
+// is an edge timestamp for human readability. Set CW_DETERMINISTIC_RUN_IDS=1 to
+// use a content-hash-based id without wall-clock, so re-running the same workflow
+// yields byte-identical dispatch ids. The suffix is a per-run sequence, so each
+// dispatch still gets a distinct, monotonically increasing id.
 function createDispatchId(run) {
     const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
     const seq = (run.dispatches?.length || 0) + 1;
+    if (/^(1|true|yes|on)$/i.test(process.env.CW_DETERMINISTIC_RUN_IDS || "")) {
+        return `dispatch-${String(seq).padStart(4, "0")}`;
+    }
     return `dispatch-${stamp}-${String(seq).padStart(4, "0")}`;
 }
 // H7: persist a CUSTOM sandbox profile DEFINITION (loaded from a FILE at dispatch)
@@ -240,5 +241,10 @@ function persistCustomSandboxProfile(run, requested) {
     if (!definition || typeof definition !== "object" || typeof definition.id !== "string" || !definition.id)
         return;
     run.customSandboxProfiles = run.customSandboxProfiles || {};
+    const previous = run.customSandboxProfiles[definition.id];
+    if (previous && JSON.stringify(previous) !== JSON.stringify(definition)) {
+        throw new Error(`Sandbox profile id collision: "${definition.id}" is already defined by a different custom profile ` +
+            `(source: ${absolute}). Use a unique id in each custom profile file.`);
+    }
     run.customSandboxProfiles[definition.id] = definition;
 }

package/dist/evidence-grounding.js

@@ -27,15 +27,14 @@ const node_path_1 = __importDefault(require("node:path"));
 // are all legitimate — so we cannot require "must be a file that exists" by
 // default without breaking cross-repo, URL, and runtime-token evidence. Instead:
 //
-//  1. DEFAULT (pure, deterministic): require evidence to be GROUNDED — a URL, a
-//     path-like locator, or a `namespace:value` token. This rejects bare prose
-//     ("x", "anything", "HIGH severity") while accepting every shape CW itself
-//     emits. Being a pure function of the string, it is replay-safe.
+//  1. DEFAULT: require evidence to be GROUNDED — a URL, a path-like locator, or
+//     a `namespace:value` token. This rejects bare prose ("x", "anything",
+//     "HIGH severity") while accepting every shape CW itself emits. Being a pure
+//     function of the string, it is replay-safe.
 //
-//  2. OPT-IN (CW_REQUIRE_RESOLVABLE_EVIDENCE=1): additionally resolve path-like
-//     locators against the run's base dirs and fail closed if a file locator does
-//     not exist on disk. Off by default because the resolving cwd is context-
-//     dependent; on for self-audit / compliance where evidence MUST be checkable.
+//  2. DEFAULT (v0.1.95): file-style evidence locators MUST also exist on disk.
+//     CW_REQUIRE_RESOLVABLE_EVIDENCE=0 restores the prior shape-only behavior.
+//     CW_REQUIRE_RESOLVABLE_EVIDENCE=url additionally requires URL reachability.
 // ---------------------------------------------------------------------------
 const URL_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
 const PATH_SEP_RE = /[\\/]/;
@@ -63,14 +62,20 @@ function hasGroundedEvidence(evidence) {
     return Array.isArray(evidence) && evidence.some((entry) => isGroundedEvidence(entry));
 }
 /** Whether opt-in strict resolution is requested via the environment.
- *  Set CW_REQUIRE_RESOLVABLE_EVIDENCE=1 for file resolution, =url for
- *  URL reachability checks too (v0.1.63). */
+ *  Enabled by DEFAULT (v0.1.95): file-style evidence locators MUST exist on disk.
+ *  Set CW_REQUIRE_RESOLVABLE_EVIDENCE=0 to restore the prior shape-only check.
+ *  Set CW_REQUIRE_RESOLVABLE_EVIDENCE=url for URL reachability checks too. */
 function requireResolvableEvidence() {
-    return /^(1|true|yes|on)$/i.test(process.env.CW_REQUIRE_RESOLVABLE_EVIDENCE || "");
+    const raw = process.env.CW_REQUIRE_RESOLVABLE_EVIDENCE;
+    if (raw === undefined || raw === null || raw === "")
+        return true;
+    if (/^(0|false|no|off)$/i.test(raw))
+        return false;
+    return true;
 }
-/** Whether URL reachability checks are enabled in strict mode (v0.1.63). */
+/** Whether URL reachability checks are enabled (v0.1.63). Always opt-in. */
 function requireUrlReachability() {
-    return requireResolvableEvidence() || /url/i.test(process.env.CW_REQUIRE_RESOLVABLE_EVIDENCE || "");
+    return /url/i.test(process.env.CW_REQUIRE_RESOLVABLE_EVIDENCE || "");
 }
 function classify(raw) {
     const value = raw.trim();

package/dist/execution-backend/probes.js

@@ -22,6 +22,7 @@ exports.probeAgentBackend = probeAgentBackend;
 //
 // Readiness probe. Deterministic given the host (PATH + configured env).
 const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
 const util_1 = require("./util");
 function probeNodeBackend() {
     const ok = (0, util_1.hasExecutable)("node");
@@ -63,20 +64,35 @@ function probeContainerBackend() {
         reason: docker || podman ? undefined : "no container runtime (docker/podman) found; supply --image to delegate explicitly"
     };
 }
+function delegateChildExists() {
+    return node_fs_1.default.existsSync(node_path_1.default.resolve(__dirname, "..", "..", "scripts", "children", "http-delegate-child.js"));
+}
 function probeRemoteBackend() {
     const endpoint = (process.env.CW_REMOTE_ENDPOINT || "").trim();
+    const scriptOk = delegateChildExists();
+    const checks = [
+        { name: "endpoint", ok: Boolean(endpoint), detail: endpoint ? "CW_REMOTE_ENDPOINT configured" : "CW_REMOTE_ENDPOINT not set" },
+        { name: "delegate-child-script", ok: scriptOk, detail: scriptOk ? "http-delegate-child.js found" : "http-delegate-child.js missing — reinstall cool-workflow" }
+    ];
+    const readiness = !endpoint ? "unverified" : !scriptOk ? "unavailable" : "ready";
     return {
-        checks: [{ name: "endpoint", ok: Boolean(endpoint), detail: endpoint ? "CW_REMOTE_ENDPOINT configured" : "CW_REMOTE_ENDPOINT not set" }],
-        readiness: endpoint ? "ready" : "unverified",
-        reason: endpoint ? undefined : "no remote endpoint configured (set CW_REMOTE_ENDPOINT or pass --endpoint)"
+        checks,
+        readiness,
+        reason: readiness === "ready" ? undefined : !endpoint ? "no remote endpoint configured (set CW_REMOTE_ENDPOINT or pass --endpoint)" : "delegate child script is missing"
     };
 }
 function probeCiBackend() {
     const endpoint = (process.env.CW_CI_ENDPOINT || "").trim();
+    const scriptOk = delegateChildExists();
+    const checks = [
+        { name: "ci-endpoint", ok: Boolean(endpoint), detail: endpoint ? "CW_CI_ENDPOINT configured" : "CW_CI_ENDPOINT not set" },
+        { name: "delegate-child-script", ok: scriptOk, detail: scriptOk ? "http-delegate-child.js found" : "http-delegate-child.js missing — reinstall cool-workflow" }
+    ];
+    const readiness = !endpoint ? "unverified" : !scriptOk ? "unavailable" : "ready";
     return {
-        checks: [{ name: "ci-endpoint", ok: Boolean(endpoint), detail: endpoint ? "CW_CI_ENDPOINT configured" : "CW_CI_ENDPOINT not set" }],
-        readiness: endpoint ? "ready" : "unverified",
-        reason: endpoint ? undefined : "no CI job target configured (set CW_CI_ENDPOINT or pass --job)"
+        checks,
+        readiness,
+        reason: readiness === "ready" ? undefined : !endpoint ? "no CI job target configured (set CW_CI_ENDPOINT or pass --job)" : "delegate child script is missing"
     };
 }
 function probeAgentBackend() {

package/dist/execution-backend.js

@@ -38,6 +38,7 @@ exports.requiredSandboxDimensions = requiredSandboxDimensions;
 exports.attestSandbox = attestSandbox;
 exports.probeBackend = probeBackend;
 exports.runBackend = runBackend;
+exports.delegateChildScript = delegateChildScript;
 exports.createExecutionBackend = createExecutionBackend;
 exports.backendListPayload = backendListPayload;
 exports.backendShowPayload = backendShowPayload;
@@ -404,12 +405,22 @@ function executeLocal(descriptor, policy, request, label, attestation) {
     // shell backend runs via /bin/sh -c; node/bun run the command directly
     // (bun is Node-compatible by default so evidence stays byte-stable with node).
     // spawnStyle comes from the registered driver, not a hardcoded id check.
+    const spawnStyle = getBackendDriver(descriptor.id)?.spawnStyle;
+    if (spawnStyle === "shell") {
+        // Shell injection guard: reject args that contain shell control characters
+        // (beyond template placeholders). The command itself is operator-configured.
+        const shellArg = [command, ...args].join(" ").replace(/\{\{[a-zA-Z0-9_.-]+\}\}/g, "");
+        if (/[;&|`$(){}<>!\n\r]/.test(shellArg)) {
+            throw new Error(`Shell backend refused: args contain shell control characters. ` +
+                `Use the node, bun, or agent backend instead for untrusted inputs.`);
+        }
+    }
     const isTTY = process.stderr.isTTY;
     const shortLabel = command.split("/").pop() || command;
     if (isTTY)
         process.stderr.write(`● Running ${shortLabel}...\n`);
     const startedAt = process.hrtime.bigint();
-    const result = getBackendDriver(descriptor.id)?.spawnStyle === "shell"
+    const result = spawnStyle === "shell"
         ? (0, node_child_process_1.spawnSync)([command, ...args].join(" "), { ...options, shell: true })
         : (0, node_child_process_1.spawnSync)(command, args, { ...options, shell: false });
     const elapsedMs = Number((process.hrtime.bigint() - startedAt) / 1000000n);
@@ -587,7 +598,17 @@ function runContainer(descriptor, policy, request, label, handle, attestation) {
 // portable and synchronous from CW's view. We spawn it BY PATH (shell:false). The
 // path is resolved from this compiled module (dist/execution-backend.js) up to the
 // package's `scripts/children/` dir, which package.json ships in "files".
-const HTTP_DELEGATE_CHILD_SCRIPT = node_path_1.default.resolve(__dirname, "..", "scripts", "children", "http-delegate-child.js");
+function delegateChildScript() {
+    const resolved = node_path_1.default.resolve(__dirname, "..", "scripts", "children", "http-delegate-child.js");
+    if (!node_fs_1.default.existsSync(resolved)) {
+        throw new Error(`Delegate child script not found at ${resolved}. ` +
+            `This indicates a broken installation — reinstall cool-workflow or ensure ` +
+            `"scripts/children/http-delegate-child.js" is shipped in the package.`);
+    }
+    return resolved;
+}
+/** The shared HTTP delegation child script path (resolved at import time). */
+const HTTP_DELEGATE_CHILD_SCRIPT = delegateChildScript();
 /** remote / ci — real HTTP delegation. POSTs the job to the configured endpoint
  *  (and polls a returned jobId) via a Node child, then records the runner's exit +
  *  stdout digest as canonical evidence. Fails closed when the endpoint is missing,
@@ -675,9 +696,17 @@ function runAgentProcess(descriptor, policy, request, label, handle, attestation
             // captured as data. CI/pipes stay silent. CW_AGENT_STREAM=0 or
             // CW_NO_STREAM=1 forces off; CW_AGENT_STREAM=1 forces on.
             const streamStderr = process.env.CW_AGENT_STREAM !== "0" && Boolean(process.stderr.isTTY) && process.env.CW_NO_STREAM !== "1";
+            // Build child env from sandbox policy as baseline (respects env.inherit/expose/deny),
+            // then re-allow CW_* + well-known API key env vars the agent needs.
+            const childEnv = buildChildEnv(policy);
+            for (const key of Object.keys(process.env)) {
+                if (/^(CW_|ANTHROPIC_|OPENAI_|GEMINI_|DEEPSEEK_|CODEX_|GOOGLE_|COHERE_|MISTRAL_|OLLAMA_|AZURE_|AWS_)/i.test(key)) {
+                    childEnv[key] = process.env[key];
+                }
+            }
             const child = (0, node_child_process_1.spawnSync)(resolved.binary, realArgs, {
                 cwd: request.cwd,
-                env: { ...process.env },
+                env: childEnv,
                 encoding: "utf8",
                 timeout: resolved.timeoutMs || 600000,
                 maxBuffer: 32 * 1024 * 1024,
@@ -896,7 +925,11 @@ function runtimeNote(descriptor) {
 }
 // ---- Probe cache (v0.1.60) — mechanism, not policy -----------------------
 const _probeCache = new Map();
-const PROBE_CACHE_TTL_MS = 60_000; // 60s
+const PROBE_CACHE_TTL_MS = (() => {
+    const raw = process.env.CW_PROBE_CACHE_TTL_MS;
+    const n = raw ? parseInt(raw, 10) : 60_000;
+    return Number.isFinite(n) && n >= 0 ? n : 60_000;
+})(); // default 60s; set CW_PROBE_CACHE_TTL_MS=0 to disable
 function cachedProbeBackend(id, context) {
     const key = `${id}:${context.cwd || ''}`;
     const cached = _probeCache.get(key);

package/dist/node-snapshot.js

@@ -38,7 +38,7 @@ const pipeline_runner_1 = require("./pipeline-runner");
 const state_1 = require("./state");
 const multi_agent_eval_1 = require("./multi-agent-eval");
 const node_projection_1 = require("./node-projection");
-const state_explosion_1 = require("./state-explosion");
+const fingerprint_1 = require("./util/fingerprint");
 const validation_1 = require("./validation");
 exports.NODE_SNAPSHOT_SCHEMA_VERSION = 1;
 /** Structured fail-closed error (mirrors the PipelineContractError shape). */
@@ -75,7 +75,7 @@ function snapshotBody(node) {
 /** RAW fingerprint (NOT normalized): any transition (updatedAt/status) or
  *  artifact/evidence change flips it, which is how drift is detected. */
 function sourceFingerprint(node) {
-    return (0, state_explosion_1.fingerprintStrings)([
+    return (0, fingerprint_1.fingerprintStrings)([
         `node:${node.id}:${node.status}:${node.updatedAt}`,
         ...node.artifacts.map((artifact) => `artifact:${artifact.id}:${artifact.path}`),
         ...node.evidence.map((evidence) => `evidence:${evidence.id}:${evidence.path || ""}`)
@@ -203,7 +203,7 @@ function replayNodeSnapshot(run, snapshot, options = {}) {
         throw new NodeSnapshotError(freshness === "stale" ? "snapshot-stale" : "snapshot-absent", reason || `cannot replay a ${freshness} snapshot of node ${snapshot.nodeId}`, { freshness, details: { runId: run.id, nodeId: snapshot.nodeId } });
     }
     const body = (0, multi_agent_eval_1.normalizeValue)(snapshot.body);
-    const outputFingerprint = (0, state_explosion_1.fingerprintStrings)([(0, multi_agent_eval_1.replayStableStringify)(body)]);
+    const outputFingerprint = (0, fingerprint_1.fingerprintStrings)([(0, multi_agent_eval_1.replayStableStringify)(body)]);
     const replay = {
         schemaVersion: 1,
         replayId: `replay-${snapshot.snapshotId}-${outputFingerprint.replace("sha256:", "").slice(0, 8)}`,

package/dist/orchestrator/lifecycle-operations.js

@@ -599,12 +599,20 @@ function renderPrompt(prompt, inputs) {
 // worker ids in src/worker-isolation/paths.ts.
 let runIdSequence = 0;
 function createRunId(workflowId) {
+    // Use process.pid + monotonic counter for uniqueness (no wall-clock),
+    // but keep a second-resolution stamp for human readability in the id.
     const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
-    // The stamp is second-resolution, so several runs of the same workflowId minted
-    // within one second would otherwise hash to the SAME id. process.pid + a monotonic
-    // counter break the tie across BOTH same-process (counter) and concurrent-process
-    // (pid) minting — deterministic-by-environment, not a PRNG, so it keeps the
-    // replay-determinism intent; the id is an edge stamp stripped on replay anyway.
+    // Set CW_DETERMINISTIC_RUN_IDS=1 to use a content hash instead of wall-clock,
+    // so two plan() calls with the same inputs produce the same id (replay-safe).
+    if (/^(1|true|yes|on)$/i.test(process.env.CW_DETERMINISTIC_RUN_IDS || "")) {
+        runIdSequence += 1;
+        const suffix = node_crypto_1.default
+            .createHash("sha256")
+            .update(`${workflowId}:${process.pid}:${runIdSequence}`)
+            .digest("hex")
+            .slice(0, 6);
+        return `${workflowId}-${suffix}`;
+    }
     runIdSequence += 1;
     const suffix = node_crypto_1.default
         .createHash("sha256")

package/dist/orchestrator.js

@@ -56,6 +56,7 @@ const worker_isolation_1 = require("./worker-isolation");
 const sandbox_profile_1 = require("./sandbox-profile");
 const execution_backend_1 = require("./execution-backend");
 const operator_ux_1 = require("./operator-ux");
+const trust_audit_1 = require("./trust-audit");
 const multi_agent_1 = require("./multi-agent");
 const multi_agent_operator_ux_1 = require("./multi-agent-operator-ux");
 const multi_agent_eval_1 = require("./multi-agent-eval");
@@ -102,12 +103,29 @@ class CoolWorkflowRunner {
     // reads runs from disk per call (no in-memory run state), so withBaseDir hands back
     // a cheap scoped clone instead of mutating the global process cwd.
     baseDir;
+    // Per-request cache (v0.1.95): when set, loadRun memoizes by runId so the 17
+    // workbench sub-panels that each call loadRun independently share one read.
+    _requestCache;
     constructor({ pluginRoot, baseDir }) {
         this.pluginRoot = resolvePluginRoot(pluginRoot);
         this.workflowsDir = node_path_1.default.join(this.pluginRoot, "workflows");
         this.appsDir = node_path_1.default.join(this.pluginRoot, "apps");
         this.baseDir = baseDir ? node_path_1.default.resolve(baseDir) : undefined;
     }
+    /** Run fn with a per-request loadRun cache. All loadRun calls inside fn share
+     *  the same cached run state, collapsing 18 reads into 1. Returns fn's result
+     *  and clears the cache afterwards (never leaks between requests). */
+    loadWithCache(fn) {
+        this._requestCache = new Map();
+        (0, trust_audit_1.setAuditEventCache)(new Map());
+        try {
+            return fn(this);
+        }
+        finally {
+            this._requestCache = undefined;
+            (0, trust_audit_1.clearAuditEventCache)();
+        }
+    }
     /** Return a runner that resolves runs against `dir` instead of process.cwd(),
      *  WITHOUT chdir-ing the process (F7). Same instance when the dir is unchanged. */
     withBaseDir(dir) {
@@ -632,7 +650,14 @@ class CoolWorkflowRunner {
         return feedbackOps.resolveFeedback(this.loadRun(runId), feedbackId, options);
     }
     loadRun(runId) {
-        return (0, state_1.loadRunFromCwd)(runId, this.baseDir);
+        if (this._requestCache) {
+            const cached = this._requestCache.get(runId);
+            if (cached)
+                return cached;
+        }
+        const run = (0, state_1.loadRunFromCwd)(runId, this.baseDir);
+        this._requestCache?.set(runId, run);
+        return run;
     }
     invocationCwd() {
         return this.baseDir || process.cwd();

package/dist/reclamation.js

@@ -121,7 +121,10 @@ function loadReclamationLog(run) {
         return { schemaVersion: 1, runId: run.id, tombstones: [] };
     try {
         const parsed = JSON.parse(node_fs_1.default.readFileSync(file, "utf8"));
-        return { schemaVersion: 1, runId: run.id, tombstones: Array.isArray(parsed.tombstones) ? parsed.tombstones : [] };
+        if (!parsed || typeof parsed !== "object" || parsed.schemaVersion !== 1 || !Array.isArray(parsed.tombstones)) {
+            return { schemaVersion: 1, runId: run.id, tombstones: [] };
+        }
+        return { schemaVersion: 1, runId: run.id, tombstones: parsed.tombstones };
     }
     catch {
         // A malformed overlay must NOT brick the run — fail closed to an empty chain.
@@ -420,7 +423,10 @@ function planReclamation(run, policy = {}) {
                     catch {
                         continue; // unreadable snapshot → retain (fail closed)
                     }
-                    const node = (run.nodes || []).find((n) => n.id === snap.nodeId);
+                    if (!snap || typeof snap !== "object" || typeof snap.nodeId !== "string")
+                        continue;
+                    const nodeId = snap.nodeId;
+                    const node = (run.nodes || []).find((n) => n.id === nodeId);
                     if (!node)
                         continue; // source node gone → cannot reconstruct → retain
                     if (repointNodeIds.has(node.id))

package/dist/run-registry/derive.js

@@ -164,7 +164,10 @@ function loadReclaimedFromDir(runDir) {
         return { schemaVersion: 1, runId: "", tombstones: [] };
     try {
         const parsed = JSON.parse(node_fs_1.default.readFileSync(file, "utf8"));
-        return { schemaVersion: 1, runId: parsed.runId || "", tombstones: Array.isArray(parsed.tombstones) ? parsed.tombstones : [] };
+        if (!parsed || typeof parsed !== "object" || parsed.schemaVersion !== 1 || !Array.isArray(parsed.tombstones)) {
+            return { schemaVersion: 1, runId: "", tombstones: [] };
+        }
+        return { schemaVersion: 1, runId: String(parsed.runId || ""), tombstones: parsed.tombstones };
     }
     catch {
         return { schemaVersion: 1, runId: "", tombstones: [] };

package/dist/scheduler.js

@@ -274,21 +274,19 @@ function addJitter(date, jitterSeconds) {
     return new Date(date.getTime() + seconds * 1000);
 }
 // Deterministic schedule id (replay-determinism self-audit): the stamp is an edge
-// timestamp (recorded once), but the former Math.random() suffix made each
-// persisted schedule id non-reproducible. The suffix is now a content hash of the
-// schedule's deterministic identity (kind + the recorded stamp), so re-deriving the
-// id for a recorded schedule yields the byte-identical value while schedules created
-// at distinct instants still get distinct ids. Mirrors src/worker-isolation/paths.ts.
+// timestamp (recorded once). Set CW_DETERMINISTIC_RUN_IDS=1 to use a
+// content-hash-based id without wall-clock, so re-deriving the id for a recorded
+// schedule yields the byte-identical value. Distinct instants still get distinct
+// ids via the monotonic counter.
 let scheduleIdSequence = 0;
 function createScheduleId(kind) {
     const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
-    // Second-resolution stamp: two schedules of the same kind created within one
-    // second would otherwise collide on an identical id. process.pid + a monotonic
-    // counter break the tie across concurrent processes and within one process,
-    // deterministically (not a PRNG).
     scheduleIdSequence += 1;
-    const suffix = node_crypto_1.default.createHash("sha256").update(`${kind}:${stamp}:${process.pid}:${scheduleIdSequence}`).digest("hex").slice(0, 6);
-    return `${kind}-${stamp}-${suffix}`;
+    const deterministic = /^(1|true|yes|on)$/i.test(process.env.CW_DETERMINISTIC_RUN_IDS || "");
+    const suffix = node_crypto_1.default.createHash("sha256")
+        .update(deterministic ? `${kind}:${process.pid}:${scheduleIdSequence}` : `${kind}:${stamp}:${process.pid}:${scheduleIdSequence}`)
+        .digest("hex").slice(0, 6);
+    return deterministic ? `${kind}-${suffix}` : `${kind}-${stamp}-${suffix}`;
 }
 // Deterministic schedule-run (history) id — same rationale as createScheduleId. The
 // history record stamp differs from the owning schedule's, so the hashed identity
@@ -297,10 +295,12 @@ function createScheduleId(kind) {
 let scheduleRunIdSequence = 0;
 function createScheduleRunId(kind) {
     const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
-    // pid + counter break same-kind/same-second collisions (see createScheduleId).
     scheduleRunIdSequence += 1;
-    const suffix = node_crypto_1.default.createHash("sha256").update(`run:${kind}:${stamp}:${process.pid}:${scheduleRunIdSequence}`).digest("hex").slice(0, 6);
-    return `run-${kind}-${stamp}-${suffix}`;
+    const deterministic = /^(1|true|yes|on)$/i.test(process.env.CW_DETERMINISTIC_RUN_IDS || "");
+    const suffix = node_crypto_1.default.createHash("sha256")
+        .update(deterministic ? `run:${kind}:${process.pid}:${scheduleRunIdSequence}` : `run:${kind}:${stamp}:${process.pid}:${scheduleRunIdSequence}`)
+        .digest("hex").slice(0, 6);
+    return deterministic ? `run-${kind}-${suffix}` : `run-${kind}-${stamp}-${suffix}`;
 }
 function requiredString(value, name) {
     const text = stringOption(value);

package/dist/schema-validate.js

@@ -12,8 +12,8 @@
 //   type (object|array|string|number|integer|boolean|null, or an array of them),
 //   enum, const, required, properties, additionalProperties (false), items.
 // Unsupported keywords ($ref, allOf/anyOf/oneOf, pattern, formats, numeric
-// bounds) are IGNORED — never silently "passed" as a constraint that wasn't
-// checked; a schema relying on them simply isn't enforced for those keywords.
+// bounds) are surfaced as WARNINGS (a constraint that wasn't checked), so the
+// operator can see their schema reliance is incomplete.
 // (If full JSON Schema is needed later, swap this module's impl for ajv behind
 // the same signature.)
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -52,6 +52,12 @@ function validateAgainstSchema(value, schema, path = "$") {
     const errors = [];
     if (!schema || typeof schema !== "object")
         return errors;
+    // Unsupported keywords — surface as diagnostics (Rule of Silence: stderr)
+    const UNSUPPORTED = new Set(["$ref", "allOf", "anyOf", "oneOf", "not", "pattern", "format", "minimum", "maximum", "minLength", "maxLength", "minItems", "maxItems", "uniqueItems", "contains", "if", "then", "else"]);
+    const unsupported = Object.keys(schema).filter((k) => UNSUPPORTED.has(k));
+    if (unsupported.length && process.stderr.isTTY) {
+        process.stderr.write(`[cw] schema at ${path}: unsupported keywords ignored: ${unsupported.join(", ")}\n`);
+    }
     // type
     if (schema.type !== undefined) {
         const types = Array.isArray(schema.type) ? schema.type.map(String) : [String(schema.type)];

package/dist/state-explosion/helpers.js

@@ -1,13 +1,9 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.fingerprintStrings = exports.fingerprintRecords = void 0;
 exports.isProtectedStatus = isProtectedStatus;
 exports.dominantStatus = dominantStatus;
 exports.parentMap = parentMap;
-exports.fingerprintRecords = fingerprintRecords;
-exports.fingerprintStrings = fingerprintStrings;
 exports.stableLine = stableLine;
 exports.sortKeys = sortKeys;
 exports.stripRunId = stripRunId;
@@ -15,14 +11,9 @@ exports.unique = unique;
 exports.byId = byId;
 exports.truncate = truncate;
 exports.slug = slug;
-// Pure, stateless helpers for the state-explosion derived-index layer —
-// status priority, fingerprinting, deterministic key-sorting, id/string
-// utilities. Carved out of state-explosion.ts (FreeBSD-audit god-module carve)
-// so the report/graph/digest builders no longer bundle the primitive helper
-// layer. Nothing here touches run state beyond its arguments; every function is
-// pure (`fingerprintStrings` is re-exported from state-explosion.ts to keep the
-// public surface byte-identical for importers).
-const node_crypto_1 = __importDefault(require("node:crypto"));
+const fingerprint_1 = require("../util/fingerprint");
+Object.defineProperty(exports, "fingerprintRecords", { enumerable: true, get: function () { return fingerprint_1.fingerprintRecords; } });
+Object.defineProperty(exports, "fingerprintStrings", { enumerable: true, get: function () { return fingerprint_1.fingerprintStrings; } });
 function isProtectedStatus(status) {
     return ["failed", "blocked", "rejected", "conflicting"].includes(status);
 }
@@ -41,14 +32,6 @@ function parentMap(edges) {
     }
     return parents;
 }
-function fingerprintRecords(records) {
-    return fingerprintStrings(records.map((r) => `${r.id}:${r.status || ""}`).sort());
-}
-function fingerprintStrings(values) {
-    const hash = node_crypto_1.default.createHash("sha256");
-    hash.update(JSON.stringify([...values].sort()));
-    return `sha256:${hash.digest("hex").slice(0, 32)}`;
-}
 function stableLine(value) {
     return JSON.stringify(sortKeys(value));
 }