cool-workflow 0.1.95 → 0.1.96

package/docs/cli-mcp-parity.7.md

@@ -549,3 +549,5 @@ CLI golden-path fixes: `cw -q "…"` routes the question (was read as an app id
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/contract-migration-tooling.7.md

@@ -167,3 +167,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/control-plane-scheduling.7.md

@@ -151,3 +151,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/durable-state-and-locking.7.md

@@ -150,3 +150,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/evidence-adoption-reasoning-chain.7.md

@@ -311,3 +311,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/execution-backends.7.md

@@ -341,3 +341,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/multi-agent-cli-mcp-surface.7.md

@@ -317,3 +317,5 @@ The host-facing surface tracks the CLI golden-path fixes (`cw -q` routing + repo
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/multi-agent-eval-replay-harness.7.md

@@ -343,3 +343,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/multi-agent-operator-ux.7.md

@@ -355,3 +355,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/node-snapshot-diff-replay.7.md

@@ -176,3 +176,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/observability-cost-accounting.7.md

@@ -235,3 +235,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/project-index.md

@@ -1,15 +1,15 @@
 # Cool Workflow Project Index
 
-Generated from the current repository code on 2026-06-27 by `npm run sync:project-index`.
+Generated from the current repository code on 2026-06-28 by `npm run sync:project-index`.
 
 ## Snapshot
 
 - Package: `cool-workflow`
-- Version: `0.1.95`
+- Version: `0.1.96`
 - Source modules: `68`
 - Workflow apps: `8`
 - Docs: `53`
-- Smoke tests: `154`
+- Smoke tests: `158`
 - Repository: https://github.com/coo1white/cool-workflow
 
 ## Architecture
@@ -194,6 +194,7 @@ multi-agent host -> topology -> blackboard/coordinator
 
 Smoke tests mirror the public contracts. The high-signal suites are:
 
+- [agent-config-atomic-write-smoke.js](../test/agent-config-atomic-write-smoke.js)
 - [agent-delegation-drive-smoke.js](../test/agent-delegation-drive-smoke.js)
 - [append-run-node-no-realloc-smoke.js](../test/append-run-node-no-realloc-smoke.js)
 - [architecture-review-fast-automation-smoke.js](../test/architecture-review-fast-automation-smoke.js)
@@ -224,6 +225,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [cli-render-smoke.js](../test/cli-render-smoke.js)
 - [clones-gc-smoke.js](../test/clones-gc-smoke.js)
 - [codex-agent-wrapper-smoke.js](../test/codex-agent-wrapper-smoke.js)
+- [collaboration-ops-unit-smoke.js](../test/collaboration-ops-unit-smoke.js)
 - [concurrency-default-smoke.js](../test/concurrency-default-smoke.js)
 - [concurrent-failure-semantics-smoke.js](../test/concurrent-failure-semantics-smoke.js)
 - [concurrent-workflow-dsl-smoke.js](../test/concurrent-workflow-dsl-smoke.js)
@@ -248,6 +250,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [execution-backend-agent-smoke.js](../test/execution-backend-agent-smoke.js)
 - [execution-backend-ci-smoke.js](../test/execution-backend-ci-smoke.js)
 - [execution-backends-smoke.js](../test/execution-backends-smoke.js)
+- [feedback-ops-unit-smoke.js](../test/feedback-ops-unit-smoke.js)
 - [freebsd-audit-fixes-smoke.js](../test/freebsd-audit-fixes-smoke.js)
 - [gemini-agent-wrapper-smoke.js](../test/gemini-agent-wrapper-smoke.js)
 - [gemini-opencode-agent-wrapper-smoke.js](../test/gemini-opencode-agent-wrapper-smoke.js)
@@ -257,6 +260,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [loop-bounded-expansion-smoke.js](../test/loop-bounded-expansion-smoke.js)
 - [mcp-app-surface-smoke.js](../test/mcp-app-surface-smoke.js)
 - [mcp-surface-registry-smoke.js](../test/mcp-surface-registry-smoke.js)
+- [mcp-tool-call-coverage-smoke.js](../test/mcp-tool-call-coverage-smoke.js)
 - [multi-agent-cli-mcp-surface-smoke.js](../test/multi-agent-cli-mcp-surface-smoke.js)
 - [multi-agent-eval-determinism-regression-smoke.js](../test/multi-agent-eval-determinism-regression-smoke.js)
 - [multi-agent-eval-replay-harness-smoke.js](../test/multi-agent-eval-replay-harness-smoke.js)

package/docs/real-execution-backends.7.md

@@ -183,3 +183,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/release-and-migration.7.md

@@ -323,3 +323,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/release-tooling.7.md

@@ -85,6 +85,22 @@ The dogfood release smoke and the architecture-review dogfood smoke are separate
 test files. The split keeps the same release and agent-drive proof, but lets
 `test:ci` schedule the two long checks in parallel.
 
+## PR CI Merge Notes
+
+When a PR is ready, list open PRs by creation time and merge the oldest ready
+one first. After each merge, check the next PR again; a new main commit may make
+it need a rebase.
+
+If main moved after the PR branch was made, replay the PR commits on top of the
+new main in a clean worktree. Keep local unrelated changes out of the rebase and
+out of the PR.
+
+Treat CI as the source of truth for what blocks the merge. Read the failed step
+first, fix only that drift, then push again. A common drift is the npm README:
+when `readme-sync-smoke.js` says the package README is stale, run
+`npm run sync:readme`, add only `plugins/cool-workflow/README.md`, and let CI run
+again.
+
 ## Boundary
 
 Release Tooling touches only the build/release surfaces. It adds no runtime
@@ -270,3 +286,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/routines.md

@@ -64,6 +64,36 @@ report path and digest.
 The `--metrics` flag is not required and it gives back foreground time used plus
 agent-spawn and result-cache-hit counts for the fast run.
 
+## PDCA Blackboard Development Lessons
+
+When a task asks for agents to work together, first try the parts CW already
+has:
+
+- workflow apps give the work shape
+- worker output gives checked facts
+- the blackboard gives shared state
+- MCP gives tool access to the same state
+- smoke tests prove the loop
+
+Do not make a new MCP server when the existing server can show the same run
+state. Add a workflow app first, then prove the app with one smoke that uses
+both CLI and MCP.
+
+For a three-agent loop, keep the order plain:
+
+```text
+plan -> build -> audit -> next action
+```
+
+Each agent should write one blackboard message and, when there is a result
+file, one artifact ref. Take a snapshot after the audit and after the next
+action. If audit evidence is missing, let the worker evidence gate refuse the
+result instead of adding a new policy layer.
+
+Before a PR, base the branch on `origin/main`, run the generated-doc checks,
+and sync generated docs when the gate says they are stale. This keeps unrelated
+local commits and generated README/index drift out of the work.
+
 ## Boundary
 
 CW v0.1.1 does not give managed cloud infrastructure. It gives a local

package/docs/run-registry-control-plane.7.md

@@ -466,3 +466,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/run-retention-reclamation.7.md

@@ -234,3 +234,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/sandbox-profiles.7.md

@@ -26,6 +26,21 @@ normalization, worker result acceptance, and durable feedback for denied worker
 output. The agent host has to do OS-level file access, process execution,
 network access, and environment filtering.
 
+**IMPORTANT**: Under the default `node` backend, a sandbox profile's
+`execute`, `network`, and `env` policy is **attested, not enforced**. CW
+validates the policy, records it in the worker manifest, and attests that
+these limits were declared — but the actual enforcement of command execution
+restrictions, network isolation, and environment variable filtering is
+DELEGATED to the host runtime. For full enforcement, use the `container`
+backend (`--backend container`) with Docker/Podman, or apply OS-level
+sandboxing to the agent process. Without OS enforcement, a worker under a
+`locked-down` profile can still run arbitrary commands and access the network.
+
+CW also now (v0.1.95) applies `buildChildEnv(policy)` as a baseline for agent
+spawns — only `PATH`, `HOME`, explicit `expose` entries, and well-known
+`CW_*` + LLM provider API key environment variables pass through. The
+operator's other process environment is not inherited by default.
+
 The design goal is simple:
 
 ```text

package/docs/state-explosion-management.7.md

@@ -312,3 +312,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/team-collaboration.7.md

@@ -248,3 +248,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/docs/web-desktop-workbench.7.md

@@ -256,3 +256,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.94
 
 0.1.95
+
+0.1.96

package/manifest/plugin.manifest.json

@@ -2,7 +2,7 @@
   "_comment": "SINGLE SOURCE OF TRUTH for every vendor manifest. Edit THIS file, then run `npm run gen:manifests`. Do NOT hand-edit the generated vendor manifests (.claude-plugin/, .codex-plugin/, .agents/, .mcp.json) — `npm run gen:manifests -- --check` (run by release:check) will fail if they drift from this source.",
   "identity": {
     "name": "cool-workflow",
-    "version": "0.1.95",
+    "version": "0.1.96",
     "license": "BSD-2-Clause",
     "homepage": "https://github.com/coo1white/cool-workflow",
     "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.95",
+  "version": "0.1.96",
   "bin": {
     "cool-workflow": "scripts/cw.js",
     "cw": "scripts/cw.js"
@@ -62,9 +62,11 @@
     "onramp:check": "node scripts/onramp-check.js --check",
     "version:sync": "node scripts/version-sync-check.js",
     "release:check": "node scripts/release-check.js",
-    "test": "node dist/cli.js version > /dev/null && node test/run-all.js",
+    "test": "node dist/cli.js version > /dev/null && node test/run-all.js --fast --sample 35",
+    "test:full": "node dist/cli.js version > /dev/null && node test/run-all.js --sample 55",
+    "test:gate": "node dist/cli.js version > /dev/null && node test/run-all.js",
     "test:fast": "npm run build --if-present && node dist/cli.js version > /dev/null && node test/run-all.js --concurrency auto",
-    "test:ci": "node dist/cli.js version > /dev/null && node test/run-all.js --concurrency auto",
+    "test:ci": "npm run build && node dist/cli.js version > /dev/null && node test/run-all.js --sample 55",
     "test:coverage": "node dist/cli.js version > /dev/null && node scripts/coverage-gate.js --concurrency auto",
     "eval:replay": "tsc -p tsconfig.json && node test/multi-agent-eval-replay-harness-smoke.js",
     "ci": "npm run build && npm run check && npm run test && npm run release:check",

package/scripts/agents/agent-adapter-core.js

@@ -2,6 +2,7 @@
 "use strict";
 
 const fs = require("node:fs");
+const path = require("node:path");
 
 const RESULT_CONTRACT = `
 === HOW TO RETURN YOUR ANSWER (overrides any 'write to result.md' instruction above) ===
@@ -448,6 +449,25 @@ function emitReport(model, usage, resultText) {
   process.stdout.write(JSON.stringify({ model, usage, result: resultText }));
 }
 
+// Drop the failed agent's stderr beside the worker's result.md so a `failed (exit
+// 1)` is readable AFTER the fact. CW core keeps only the child's stdout + exit
+// code (byte-stable evidence), so without this the real reason — a relay 5xx, an
+// auth error, a killed run — is lost. The worker dir already has a `logs/` folder
+// (src/worker-isolation.ts); resultPath is `<workerDir>/result.md`, so its
+// `logs/agent-stderr.log` sibling is the natural home. Advisory only: never throws,
+// never changes the exit code or the recorded evidence.
+function persistStderr(resultPath, text) {
+  const t = String(text || "").trim();
+  if (!t || !resultPath) return;
+  try {
+    const dir = path.join(path.dirname(resultPath), "logs");
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, "agent-stderr.log"), `${t}\n`, "utf8");
+  } catch {
+    /* advisory only — diagnostics must never break the run */
+  }
+}
+
 module.exports = {
   RESULT_CONTRACT,
   buildPrompt,
@@ -461,5 +481,6 @@ module.exports = {
   parseJsonLines,
   flushJsonLines,
   writeResult,
-  emitReport
+  emitReport,
+  persistStderr // save a failed agent's stderr to <workerDir>/logs/agent-stderr.log (shared by all wrappers)
 };

package/scripts/agents/claude-p-agent.js

@@ -34,7 +34,7 @@ const { spawn, spawnSync } = require("node:child_process");
 // wrappers instead of carrying a private copy. A drifted inline copy (ASCII
 // hyphens silently became em-dashes here) meant claude was sent a different
 // instruction text than the other providers for the same contract.
-const { buildPrompt, createRenderer, toolLabel, summarizeToolResult } = require("./agent-adapter-core");
+const { buildPrompt, createRenderer, persistStderr, toolLabel, summarizeToolResult } = require("./agent-adapter-core");
 
 const inputPath = process.argv[2];
 const resultPath = process.argv[3];
@@ -56,11 +56,14 @@ if (!streamEnabled) {
     shell: false
   });
   if (child.error) {
+    persistStderr(resultPath, `claude spawn failed: ${child.error.message}`);
     process.stderr.write(`claude spawn failed: ${child.error.message}\n`);
     process.exit(1);
   }
   if (child.status !== 0) {
-    process.stderr.write(String(child.stderr || `claude exited ${child.status}`));
+    const detail = String(child.stderr || `claude exited ${child.status}`);
+    persistStderr(resultPath, detail);
+    process.stderr.write(detail);
     process.exit(child.status === null ? 1 : child.status);
   }
 
@@ -69,6 +72,7 @@ if (!streamEnabled) {
   try {
     parsed = JSON.parse(out);
   } catch (error) {
+    persistStderr(resultPath, `claude output was not JSON: ${error.message}`);
     process.stderr.write(`claude output was not JSON: ${error.message}\n`);
     process.exit(1);
   }
@@ -166,6 +170,7 @@ function renderEvent(ev) {
 
 child.on("error", (err) => {
   render.finishLive(); // restore the terminal before exiting
+  persistStderr(resultPath, `claude spawn failed: ${err.message}`);
   process.stderr.write(`claude spawn failed: ${err.message}\n`);
   process.exit(1);
 });
@@ -174,12 +179,15 @@ child.on("close", (code) => {
   render.finishLive(); // stop the spinner + restore the cursor BEFORE any further output
   render.writeTranscript(transcriptPath); // full narration + tool I/O always saved
   if (code !== 0) {
+    const detail = childStderr.trim() || `claude exited ${code === null ? "(timeout/killed)" : code}`;
+    persistStderr(resultPath, detail);
     if (childStderr.trim()) process.stderr.write(`${childStderr.trim()}\n`);
     process.stderr.write(`claude exited ${code === null ? "(timeout/killed)" : code}\n`);
     process.exit(code === null ? 1 : code);
   }
   if (typeof resultText !== "string") {
     // Fail closed: no result event ⇒ no result.md ⇒ CW records a failed hop.
+    persistStderr(resultPath, childStderr.trim() || "claude produced no result event — refusing to fabricate a result");
     process.stderr.write("claude produced no result event — refusing to fabricate a result\n");
     process.exit(1);
   }

package/scripts/agents/codex-agent.js

@@ -14,6 +14,13 @@
 //
 // stdout: one JSON object { model, usage, result } for CW provenance.
 // stderr: optional live trace when CW_AGENT_STREAM=1 and attached to a TTY.
+//
+// SPEED: codex `exec` inherits the user's ~/.codex/config.toml, including a heavy
+// `model_reasoning_effort` (e.g. "high"), which makes every read/grep turn slow.
+// CW caps it for ITS runs only via `-c model_reasoning_effort=<effort>` — a
+// per-run override that does NOT touch the user's interactive codex. Tune with
+// CW_CODEX_REASONING_EFFORT (default "low"); set it to "medium"/"high" to opt back
+// into more thinking.
 
 const fs = require("node:fs");
 const os = require("node:os");
@@ -25,6 +32,7 @@ const {
   emitReport,
   flushJsonLines,
   parseJsonLines,
+  persistStderr,
   writeResult
 } = require("./agent-adapter-core");
 
@@ -74,9 +82,14 @@ function recordJsonLine(line) {
 
 render.action("codex: reading the repo (read-only)…");
 
+// Cap codex's reasoning effort for CW runs (speed) — overrides config.toml for
+// THIS invocation only. Default "low"; CW_CODEX_REASONING_EFFORT opts back up.
+const effort = process.env.CW_CODEX_REASONING_EFFORT || "low";
 const args = [
   "exec",
   "--json",
+  "-c",
+  `model_reasoning_effort=${effort}`,
   "--output-last-message",
   finalPath,
   "--sandbox",
@@ -108,6 +121,7 @@ child.stderr.on("data", (chunk) => {
 
 child.on("error", (error) => {
   render.finishLive();
+  persistStderr(resultPath, `codex spawn failed: ${error.message}`);
   process.stderr.write(`codex spawn failed: ${error.message}\n`);
   process.exit(1);
 });
@@ -118,11 +132,14 @@ child.on("close", (code) => {
   render.writeTranscript(transcriptPath);
   if (code !== 0) {
     const detail = childStderr.trim() || `codex exited ${code === null ? "(timeout/killed)" : code}`;
+    persistStderr(resultPath, detail);
     process.stderr.write(`${detail}\n`);
     process.exit(code === null ? 1 : code);
   }
   if (state.invalidJson) {
-    process.stderr.write("codex --json produced a non-JSONL stdout line - refusing to trust the result\n");
+    const detail = "codex --json produced a non-JSONL stdout line - refusing to trust the result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
@@ -130,7 +147,9 @@ child.on("close", (code) => {
   try {
     resultText = fs.readFileSync(finalPath, "utf8");
   } catch {
-    process.stderr.write("codex produced no final output file - refusing to fabricate a result\n");
+    const detail = "codex produced no final output file - refusing to fabricate a result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   } finally {
     try {
@@ -143,6 +162,7 @@ child.on("close", (code) => {
   try {
     writeResult(resultPath, resultText);
   } catch (error) {
+    persistStderr(resultPath, `codex produced no final result: ${error.message}`);
     process.stderr.write(`codex produced no final result: ${error.message}\n`);
     process.exit(1);
   }

package/scripts/agents/gemini-agent.js

@@ -22,6 +22,7 @@ const {
   emitReport,
   flushJsonLines,
   parseJsonLines,
+  persistStderr,
   writeResult
 } = require("./agent-adapter-core");
 
@@ -83,6 +84,7 @@ child.stderr.on("data", (chunk) => {
 
 child.on("error", (error) => {
   render.finishLive();
+  persistStderr(resultPath, `gemini spawn failed: ${error.message}`);
   process.stderr.write(`gemini spawn failed: ${error.message}\n`);
   process.exit(1);
 });
@@ -93,23 +95,29 @@ child.on("close", (code) => {
   render.writeTranscript(transcriptPath);
   if (code !== 0) {
     const detail = childStderr.trim() || `gemini exited ${code === null ? "(timeout/killed)" : code}`;
+    persistStderr(resultPath, detail);
     process.stderr.write(`${detail}\n`);
     process.exit(code === null ? 1 : code);
   }
   if (state.invalidJson) {
-    process.stderr.write("gemini --output-format stream-json produced a non-JSONL stdout line - refusing to trust the result\n");
+    const detail = "gemini --output-format stream-json produced a non-JSONL stdout line - refusing to trust the result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
   const resultText = state.finalResult || state.textFragments.join("\n\n");
   if (!resultText.trim()) {
-    process.stderr.write("gemini produced no result text - refusing to fabricate a result\n");
+    const detail = "gemini produced no result text - refusing to fabricate a result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
   try {
     writeResult(resultPath, resultText);
   } catch (error) {
+    persistStderr(resultPath, `gemini produced no final result: ${error.message}`);
     process.stderr.write(`gemini produced no final result: ${error.message}\n`);
     process.exit(1);
   }

package/scripts/agents/opencode-agent.js

@@ -27,6 +27,7 @@ const {
   emitReport,
   flushJsonLines,
   parseJsonLines,
+  persistStderr,
   writeResult
 } = require("./agent-adapter-core");
 
@@ -136,6 +137,7 @@ child.stderr.on("data", (chunk) => {
 
 child.on("error", (error) => {
   render.finishLive();
+  persistStderr(resultPath, `opencode spawn failed: ${error.message}`);
   process.stderr.write(`opencode spawn failed: ${error.message}\n`);
   process.exit(1);
 });
@@ -146,23 +148,29 @@ child.on("close", (code) => {
   render.writeTranscript(transcriptPath);
   if (code !== 0) {
     const detail = childStderr.trim() || `opencode exited ${code === null ? "(timeout/killed)" : code}`;
+    persistStderr(resultPath, detail);
     process.stderr.write(`${detail}\n`);
     process.exit(code === null ? 1 : code);
   }
   if (state.invalidJson) {
-    process.stderr.write("opencode --format json produced a non-JSONL stdout line - refusing to trust the result\n");
+    const detail = "opencode --format json produced a non-JSONL stdout line - refusing to trust the result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
   const resultText = state.finalResult || state.lastMessageText || state.textFragments.join("\n\n");
   if (!resultText.trim()) {
-    process.stderr.write("opencode produced no result text - refusing to fabricate a result\n");
+    const detail = "opencode produced no result text - refusing to fabricate a result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
   try {
     writeResult(resultPath, resultText);
   } catch (error) {
+    persistStderr(resultPath, `opencode produced no final result: ${error.message}`);
     process.stderr.write(`opencode produced no final result: ${error.message}\n`);
     process.exit(1);
   }

package/scripts/canonical-apps.js

@@ -83,7 +83,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.1.95",
+      "Cool Workflow v0.1.96",
       "--freshness",
       "as of release preparation"
     ]
@@ -117,14 +117,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.1.95");
+    assert.equal(summary.version, "0.1.96");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.1.95");
+    assert.equal(shown.app.version, "0.1.96");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -135,7 +135,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.1.95");
+    assert.equal(state.workflow.app.version, "0.1.96");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/dogfood-release.js

@@ -6,7 +6,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { CoolWorkflowRunner } = require("../dist/orchestrator.js");
 
-const TARGET_VERSION = "0.1.95";
+const TARGET_VERSION = "0.1.96";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");

package/scripts/golden-path.js

@@ -33,7 +33,7 @@ function main() {
     const appValidation = runJson(["app", "validate", "end-to-end-golden-path"], pluginRoot);
     assert.equal(appValidation.valid, true);
     assert.equal(appValidation.summary.id, "end-to-end-golden-path");
-    assert.equal(appValidation.summary.version, "0.1.95");
+    assert.equal(appValidation.summary.version, "0.1.96");
 
     const plan = runJson(
       [
@@ -42,7 +42,7 @@ function main() {
         "--repo",
         tmp,
         "--question",
-        "Prove the deterministic v0.1.95 end-to-end golden path."
+        "Prove the deterministic v0.1.96 end-to-end golden path."
       ],
       pluginRoot
     );
@@ -52,7 +52,7 @@ function main() {
 
     let state = readJson(plan.statePath);
     assert.equal(state.workflow.app.id, "end-to-end-golden-path");
-    assert.equal(state.workflow.app.version, "0.1.95");
+    assert.equal(state.workflow.app.version, "0.1.96");
     assert.equal(state.loopStage, "interpret");
 
     const dispatch = runJson(["dispatch", plan.runId, "--limit", "1", "--sandbox", "readonly"], tmp);
@@ -195,7 +195,7 @@ function main() {
     assert.equal(reportPath, plan.reportPath);
     assert.ok(fs.existsSync(reportPath));
     const report = fs.readFileSync(reportPath, "utf8");
-    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.95/);
+    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.96/);
     assert.match(report, /## Candidates/);
     assert.match(report, /## Trust Audit/);
     assert.match(report, /## Acceptance Rationale/);