cool-workflow 0.1.96 → 0.1.98

package/docs/project-index.md

@@ -1,15 +1,15 @@
 # Cool Workflow Project Index
 
-Generated from the current repository code on 2026-06-28 by `npm run sync:project-index`.
+Generated from the current repository code on 2026-07-03 by `npm run sync:project-index`.
 
 ## Snapshot
 
 - Package: `cool-workflow`
-- Version: `0.1.96`
-- Source modules: `68`
+- Version: `0.1.98`
+- Source modules: `69`
 - Workflow apps: `8`
-- Docs: `53`
-- Smoke tests: `158`
+- Docs: `61`
+- Smoke tests: `172`
 - Repository: https://github.com/coo1white/cool-workflow
 
 ## Architecture
@@ -93,6 +93,7 @@ multi-agent host -> topology -> blackboard/coordinator
 - [evidence-reasoning.ts](../src/evidence-reasoning.ts)
 - [execution-backend.ts](../src/execution-backend.ts)
 - [gates.ts](../src/gates.ts)
+- [ledger.ts](../src/ledger.ts)
 - [loop-expansion.ts](../src/loop-expansion.ts)
 - [mcp-surface.ts](../src/mcp-surface.ts)
 - [multi-agent-eval.ts](../src/multi-agent-eval.ts)
@@ -145,14 +146,20 @@ multi-agent host -> topology -> blackboard/coordinator
 - [Contract Migration Tooling](contract-migration-tooling.7.md)
 - [Control-Plane Scheduling](control-plane-scheduling.7.md)
 - [Coordinator / Blackboard](coordinator-blackboard.7.md)
+- [Cross-Agent Handoff Ledger](cross-agent-ledger.7.md)
+- [DEMO(7)](demo.7.md)
+- [DOCTOR(7)](doctor.7.md)
 - [Dogfood One Real Repo](dogfood-one-real-repo.7.md)
 - [Durable State & Locking](durable-state-and-locking.7.md)
 - [End-to-End Golden Path](end-to-end-golden-path.7.md)
 - [ERROR-FEEDBACK(7)](error-feedback.7.md)
 - [Evidence Adoption Reasoning Chain](evidence-adoption-reasoning-chain.7.md)
 - [EXECUTION-BACKENDS(7)](execution-backends.7.md)
+- [FIX(7)](fix.7.md)
 - [Getting Started](getting-started.md)
+- [Handoff ledger — shared-repo setup (T2a)](handoff-setup.md)
 - [Cool Workflow Docs](index.md)
+- [INIT(7)](init.7.md)
 - [MCP App Surface](mcp-app-surface.7.md)
 - [Multi-Agent CLI + MCP Surface](multi-agent-cli-mcp-surface.7.md)
 - [Multi-Agent Eval & Replay Harness](multi-agent-eval-replay-harness.7.md)
@@ -164,6 +171,7 @@ multi-agent host -> topology -> blackboard/coordinator
 - [Observability + Cost Accounting](observability-cost-accounting.7.md)
 - [Operator UX](operator-ux.7.md)
 - [PIPELINE-RUNNER(7)](pipeline-runner.7.md)
+- [PIPELINE-VERBS(7)](pipeline-verbs.7.md)
 - [Cool Workflow Project Index](project-index.md)
 - [Cool Workflow](readme-v0.1.87-full.md)
 - [Real Execution Backend Integrations](real-execution-backends.7.md)
@@ -172,6 +180,7 @@ multi-agent host -> topology -> blackboard/coordinator
 - [Release Tooling](release-tooling.7.md)
 - [Remote-Source Review (`--link`)](remote-source-review.7.md)
 - [Verifiable Report Bundle](report-verifiable-bundle.7.md)
+- [ROUTINE(7)](routine.7.md)
 - [Routines](routines.md)
 - [Run Registry / Control Plane](run-registry-control-plane.7.md)
 - [Run Retention & Provable Reclamation](run-retention-reclamation.7.md)
@@ -196,6 +205,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 
 - [agent-config-atomic-write-smoke.js](../test/agent-config-atomic-write-smoke.js)
 - [agent-delegation-drive-smoke.js](../test/agent-delegation-drive-smoke.js)
+- [agent-stream-gate-smoke.js](../test/agent-stream-gate-smoke.js)
 - [append-run-node-no-realloc-smoke.js](../test/append-run-node-no-realloc-smoke.js)
 - [architecture-review-fast-automation-smoke.js](../test/architecture-review-fast-automation-smoke.js)
 - [architecture-review-fast-phase-cache-smoke.js](../test/architecture-review-fast-phase-cache-smoke.js)
@@ -203,6 +213,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [artifact-integrity-smoke.js](../test/artifact-integrity-smoke.js)
 - [audit-verify-smoke.js](../test/audit-verify-smoke.js)
 - [backend-registry-smoke.js](../test/backend-registry-smoke.js)
+- [batch-output-overflow-smoke.js](../test/batch-output-overflow-smoke.js)
 - [blackboard-state-explosion-management-smoke.js](../test/blackboard-state-explosion-management-smoke.js)
 - [block-unapproved-tag-smoke.js](../test/block-unapproved-tag-smoke.js)
 - [budget-scaling-loop-smoke.js](../test/budget-scaling-loop-smoke.js)
@@ -228,6 +239,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [collaboration-ops-unit-smoke.js](../test/collaboration-ops-unit-smoke.js)
 - [concurrency-default-smoke.js](../test/concurrency-default-smoke.js)
 - [concurrent-failure-semantics-smoke.js](../test/concurrent-failure-semantics-smoke.js)
+- [concurrent-subworkflow-cache-nesting-smoke.js](../test/concurrent-subworkflow-cache-nesting-smoke.js)
 - [concurrent-workflow-dsl-smoke.js](../test/concurrent-workflow-dsl-smoke.js)
 - [contract-migration-tooling-smoke.js](../test/contract-migration-tooling-smoke.js)
 - [control-plane-scheduling-smoke.js](../test/control-plane-scheduling-smoke.js)
@@ -235,11 +247,14 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [cw-help-per-command-smoke.js](../test/cw-help-per-command-smoke.js)
 - [dead-export-removal-guard-smoke.js](../test/dead-export-removal-guard-smoke.js)
 - [deepseek-agent-wrapper-smoke.js](../test/deepseek-agent-wrapper-smoke.js)
+- [deferred-checkpoint-batching-smoke.js](../test/deferred-checkpoint-batching-smoke.js)
 - [demo-bundle-smoke.js](../test/demo-bundle-smoke.js)
 - [det-ids-b-smoke.js](../test/det-ids-b-smoke.js)
 - [doctor-smoke.js](../test/doctor-smoke.js)
 - [dogfood-architecture-review-smoke.js](../test/dogfood-architecture-review-smoke.js)
 - [dogfood-release-smoke.js](../test/dogfood-release-smoke.js)
+- [drive-concurrency-flag-smoke.js](../test/drive-concurrency-flag-smoke.js)
+- [drive-exhaustion-blocked-smoke.js](../test/drive-exhaustion-blocked-smoke.js)
 - [durable-atomic-write-smoke.js](../test/durable-atomic-write-smoke.js)
 - [end-to-end-demo-smoke.js](../test/end-to-end-demo-smoke.js)
 - [end-to-end-golden-path-smoke.js](../test/end-to-end-golden-path-smoke.js)
@@ -257,6 +272,9 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [h7-custom-profile-persist-smoke.js](../test/h7-custom-profile-persist-smoke.js)
 - [headline-commands-smoke.js](../test/headline-commands-smoke.js)
 - [incremental-resume-smoke.js](../test/incremental-resume-smoke.js)
+- [ledger-apply-smoke.js](../test/ledger-apply-smoke.js)
+- [ledger-resolution-smoke.js](../test/ledger-resolution-smoke.js)
+- [ledger-verify-smoke.js](../test/ledger-verify-smoke.js)
 - [loop-bounded-expansion-smoke.js](../test/loop-bounded-expansion-smoke.js)
 - [mcp-app-surface-smoke.js](../test/mcp-app-surface-smoke.js)
 - [mcp-surface-registry-smoke.js](../test/mcp-surface-registry-smoke.js)
@@ -282,6 +300,9 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [operator-ux-smoke.js](../test/operator-ux-smoke.js)
 - [parallel-onramp-smoke.js](../test/parallel-onramp-smoke.js)
 - [parity-doc-sync-smoke.js](../test/parity-doc-sync-smoke.js)
+- [parse-guard-smoke.js](../test/parse-guard-smoke.js)
+- [parse-hardening-round2-smoke.js](../test/parse-hardening-round2-smoke.js)
+- [path-containment-smoke.js](../test/path-containment-smoke.js)
 - [pdca-blackboard-loop-smoke.js](../test/pdca-blackboard-loop-smoke.js)
 - [pii-redaction-smoke.js](../test/pii-redaction-smoke.js)
 - [pipeline-auto-advance-smoke.js](../test/pipeline-auto-advance-smoke.js)
@@ -300,6 +321,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [release-check-skip-smoke.js](../test/release-check-skip-smoke.js)
 - [release-flow-smoke.js](../test/release-flow-smoke.js)
 - [release-gate-smoke.js](../test/release-gate-smoke.js)
+- [release-pipeline-hygiene-smoke.js](../test/release-pipeline-hygiene-smoke.js)
 - [release-tooling-smoke.js](../test/release-tooling-smoke.js)
 - [remote-link-archive-smoke.js](../test/remote-link-archive-smoke.js)
 - [remote-link-git-smoke.js](../test/remote-link-git-smoke.js)
@@ -323,6 +345,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [run-resume-drive-smoke.js](../test/run-resume-drive-smoke.js)
 - [run-retention-reclamation-smoke.js](../test/run-retention-reclamation-smoke.js)
 - [sample-determinism-smoke.js](../test/sample-determinism-smoke.js)
+- [sandbox-env-batch-hardening-smoke.js](../test/sandbox-env-batch-hardening-smoke.js)
 - [sandbox-profile-smoke.js](../test/sandbox-profile-smoke.js)
 - [sched-policy-validation-smoke.js](../test/sched-policy-validation-smoke.js)
 - [schedule-routine-daemon-smoke.js](../test/schedule-routine-daemon-smoke.js)

package/docs/real-execution-backends.7.md

@@ -185,3 +185,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.95
 
 0.1.96
+
+0.1.97
+
+0.1.98

package/docs/release-and-migration.7.md

@@ -325,3 +325,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.95
 
 0.1.96
+
+0.1.97
+
+0.1.98

package/docs/release-tooling.7.md

@@ -288,3 +288,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.95
 
 0.1.96
+
+0.1.97
+
+0.1.98

package/docs/routine.7.md

@@ -0,0 +1,73 @@
+# ROUTINE(7)
+
+## NAME
+
+`cw routine` — make and manage trigger-based workflow routines
+
+## SYNOPSIS
+
+```text
+node dist/cli.js routine create --kind api|github --prompt PROMPT [--match JSON]
+node dist/cli.js routine list [--kind KIND]
+node dist/cli.js routine delete <trigger-id>
+node dist/cli.js routine fire <kind> <payload-file>
+node dist/cli.js routine events [<trigger-id>]
+```
+
+## DESCRIPTION
+
+`cw routine` is the local trigger bridge for CW. It lets you make named
+triggers that fire when something happens — an API event, a GitHub webhook, or
+another outside signal. Each trigger carries a prompt template; when fired,
+the prompt gets filled with the event data and handed to an agent host.
+
+CW keeps routine data in:
+
+```text
+.cw/routines/triggers.json
+.cw/routines/payloads/
+```
+
+CW itself does not run a web server or listen for webhooks. The routine bridge
+is a local data store that can be joined to GitHub Actions, webhooks, cron, or
+a small HTTP adapter.
+
+## COMMANDS
+
+**create**
+: Make a new trigger. `--kind` is `api` or `github`. `--prompt` is the prompt
+template the agent will see. `--match` is an optional JSON object that filters
+events (for example, `{"action":"opened"}` for GitHub pull requests).
+
+**list**
+: List all triggers, or filter by kind with `--kind`.
+
+**delete**
+: Remove a trigger by its id.
+
+**fire**
+: Record an event against a trigger. Give the trigger kind and a path to a
+JSON payload file. CW matches the payload against the trigger's match rules
+and fills out the prompt.
+
+**events**
+: List the events that have been recorded for a trigger.
+
+## FILES
+
+```text
+.cw/routines/triggers.json
+.cw/routines/payloads/<event-id>.json
+```
+
+## EXIT CODES
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | Command done |
+| 1 | Error (bad arguments, missing trigger, etc.) |
+
+## SEE ALSO
+
+cw sched — durable run-queue scheduling for workflow runs
+control-plane-scheduling.7.md — the full scheduling and run management design

package/docs/run-registry-control-plane.7.md

@@ -468,3 +468,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.95
 
 0.1.96
+
+0.1.97
+
+0.1.98

package/docs/run-retention-reclamation.7.md

@@ -236,3 +236,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.95
 
 0.1.96
+
+0.1.97
+
+0.1.98

package/docs/state-explosion-management.7.md

@@ -314,3 +314,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.95
 
 0.1.96
+
+0.1.97
+
+0.1.98

package/docs/team-collaboration.7.md

@@ -250,3 +250,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.95
 
 0.1.96
+
+0.1.97
+
+0.1.98

package/docs/web-desktop-workbench.7.md

@@ -258,3 +258,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.95
 
 0.1.96
+
+0.1.97
+
+0.1.98

package/manifest/README.md

@@ -1,11 +1,12 @@
 # Vendor Manifest Source of Truth
 
 Every agent host scans a different, hard-coded manifest directory
-(`.claude-plugin/`, `.codex-plugin/`, `.agents/`) with a different JSON shape.
-You cannot unify the directory or the schema — so we do not try. Instead, all
-vendor manifests are **generated** from one neutral source and point at the same
-shared runtime (`skills/`, `dist/`, `apps/`, the MCP server). No vendor forks the
-logic; each manifest is a thin adapter.
+(`.claude-plugin/`, `.codex-plugin/`, `.agents/`, `.gemini-plugin/`,
+`.opencode-plugin/`) with a different JSON shape. You cannot unify the directory
+or the schema — so we do not try. Instead, all vendor manifests are **generated**
+from one neutral source and point at the same shared runtime (`skills/`, `dist/`,
+`apps/`, the MCP server). No vendor forks the logic; each manifest is a thin
+adapter.
 
 This is the mechanism/policy split: shared assets are mechanism, per-vendor
 manifests are policy.
@@ -25,13 +26,18 @@ npm run gen:manifests -- --check   # fail (exit 1) if any generated file drifted
 
 ## Generated outputs (do NOT hand-edit)
 
+Five vendors are generated today. Paths are repo-root-relative.
+
 | Vendor | Marketplace | Plugin manifest | MCP config | MCP path var |
 | --- | --- | --- | --- | --- |
-| Claude Code | `../../../.claude-plugin/marketplace.json` | `../.claude-plugin/plugin.json` | `../.mcp.json` (auto-discovered) | `${CLAUDE_PLUGIN_ROOT}/` |
-| Codex / `.agents` | `../../../.agents/plugins/marketplace.json` | `../.codex-plugin/plugin.json` | `../.codex-plugin/mcp.json` | `./` |
-
-The two vendors read **different** MCP files, so the plugin-root path variable
-never collides.
+| Claude Code | `.claude-plugin/marketplace.json` | `plugins/cool-workflow/.claude-plugin/plugin.json` | `plugins/cool-workflow/.mcp.json` (auto-discovered) | `${CLAUDE_PLUGIN_ROOT}/` |
+| Codex | `.agents/plugins/marketplace.json` | `plugins/cool-workflow/.codex-plugin/plugin.json` | `plugins/cool-workflow/.codex-plugin/mcp.json` | `./` |
+| `.agents` | — | `.agents/plugins/cool-workflow/plugin.json` | `.agents/plugins/cool-workflow/mcp.json` | `./` |
+| Gemini | — | `plugins/cool-workflow/.gemini-plugin/plugin.json` | `plugins/cool-workflow/.gemini-plugin/mcp.json` | `./` |
+| OpenCode | — | `plugins/cool-workflow/.opencode-plugin/plugin.json` | `plugins/cool-workflow/.opencode-plugin/mcp.json` | `./` |
+
+Each vendor reads its **own** MCP file, so the plugin-root path variable never
+collides.
 
 ## Adding a new vendor (Cursor, Windsurf, …)
 

package/manifest/plugin.manifest.json

@@ -2,7 +2,7 @@
   "_comment": "SINGLE SOURCE OF TRUTH for every vendor manifest. Edit THIS file, then run `npm run gen:manifests`. Do NOT hand-edit the generated vendor manifests (.claude-plugin/, .codex-plugin/, .agents/, .mcp.json) — `npm run gen:manifests -- --check` (run by release:check) will fail if they drift from this source.",
   "identity": {
     "name": "cool-workflow",
-    "version": "0.1.96",
+    "version": "0.1.98",
     "license": "BSD-2-Clause",
     "homepage": "https://github.com/coo1white/cool-workflow",
     "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.96",
+  "version": "0.1.98",
   "bin": {
     "cool-workflow": "scripts/cw.js",
     "cw": "scripts/cw.js"

package/scripts/agents/agent-adapter-core.js

@@ -457,9 +457,12 @@ function emitReport(model, usage, resultText) {
 // `logs/agent-stderr.log` sibling is the natural home. Advisory only: never throws,
 // never changes the exit code or the recorded evidence.
 function persistStderr(resultPath, text) {
-  const t = String(text || "").trim();
+  let t = String(text || "").trim();
   if (!t || !resultPath) return;
   try {
+    t = String(t).replace(/\b(sk-[A-Za-z0-9_-]{20,}|ghp_[A-Za-z0-9]{20,}|xox[bprs]-[A-Za-z0-9-]{20,}|Bearer\s+\S+|Authorization:\s*\S+|api[_-]?key[=:]\s*\S+|token[=:]\s*\S+)/gi, (match) => match.slice(0, 4) + "***[REDACTED]");
+    const cap = 4096;
+    if (t.length > cap) t = t.slice(0, cap) + `\n  [truncated from ${t.length} bytes]`;
     const dir = path.join(path.dirname(resultPath), "logs");
     fs.mkdirSync(dir, { recursive: true });
     fs.writeFileSync(path.join(dir, "agent-stderr.log"), `${t}\n`, "utf8");

package/scripts/agents/codex-agent.js

@@ -21,6 +21,16 @@
 // per-run override that does NOT touch the user's interactive codex. Tune with
 // CW_CODEX_REASONING_EFFORT (default "low"); set it to "medium"/"high" to opt back
 // into more thinking.
+//
+// REVIEW MODE: the default low-effort / read-only sandbox is right for a fast
+// delegated worker or a liveness probe — but WRONG for an independent RELEASE
+// reviewer, which must actually RE-RUN the gate (build, tests, regenerate dist)
+// to earn its verdict. A read-only sandbox can't execute that gate, so the model
+// is structurally unable to verify and tends to fabricate a REJECTED. The release
+// path therefore sets CW_RELEASE_REVIEW=1 (a vendor-agnostic signal from
+// release-flow.js): on that signal this wrapper raises reasoning to "high" and
+// opens the sandbox to "workspace-write" so codex can run the gate it is judging.
+// Explicit CW_CODEX_REASONING_EFFORT / CW_CODEX_SANDBOX always win over the signal.
 
 const fs = require("node:fs");
 const os = require("node:os");
@@ -80,11 +90,31 @@ function recordJsonLine(line) {
   }
 }
 
-render.action("codex: reading the repo (read-only)…");
+// A release review (CW_RELEASE_REVIEW=1) must execute the gate it judges, so it
+// needs both stronger reasoning and a sandbox that can write inside the workspace.
+// Explicit env overrides win; otherwise the review signal lifts the fast defaults.
+const reviewMode = process.env.CW_RELEASE_REVIEW === "1";
 
 // Cap codex's reasoning effort for CW runs (speed) — overrides config.toml for
-// THIS invocation only. Default "low"; CW_CODEX_REASONING_EFFORT opts back up.
-const effort = process.env.CW_CODEX_REASONING_EFFORT || "low";
+// THIS invocation only. Default "low"; CW_CODEX_REASONING_EFFORT opts back up, and
+// a release review defaults to "high".
+const effort = process.env.CW_CODEX_REASONING_EFFORT || (reviewMode ? "high" : "low");
+
+// Sandbox: read-only is the POLA default (a worker/probe only reads). A release
+// review opens to workspace-write so codex can build/test/regenerate the gate.
+// CW_CODEX_SANDBOX overrides both; an unknown value fails closed (never silently
+// downgraded to read-only, which would re-create the can't-verify failure mode).
+const SANDBOX_MODES = new Set(["read-only", "workspace-write", "danger-full-access"]);
+const sandbox = process.env.CW_CODEX_SANDBOX || (reviewMode ? "workspace-write" : "read-only");
+if (!SANDBOX_MODES.has(sandbox)) {
+  process.stderr.write(
+    `codex-agent: invalid CW_CODEX_SANDBOX="${sandbox}" — expected one of ${[...SANDBOX_MODES].join(", ")}\n`
+  );
+  process.exit(2);
+}
+
+render.action(`codex: reading the repo (${sandbox})…`);
+
 const args = [
   "exec",
   "--json",
@@ -93,7 +123,7 @@ const args = [
   "--output-last-message",
   finalPath,
   "--sandbox",
-  "read-only",
+  sandbox,
   "--color",
   "never",
   "-"

package/scripts/canonical-apps.js

@@ -83,7 +83,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.1.96",
+      "Cool Workflow v0.1.98",
       "--freshness",
       "as of release preparation"
     ]
@@ -117,14 +117,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.1.96");
+    assert.equal(summary.version, "0.1.98");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.1.96");
+    assert.equal(shown.app.version, "0.1.98");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -135,7 +135,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.1.96");
+    assert.equal(state.workflow.app.version, "0.1.98");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/children/batch-delegate-child.js

@@ -8,43 +8,66 @@
 //
 // Reads jobs JSON on stdin, spawns ALL concurrently (shell:false, inherited env —
 // the agent's own credentials resolve; CW never reads them), per-job SIGTERM at
-// timeoutMs + SIGKILL at +5s, caps each captured stdout at 32MB, and prints the
-// outcome array when every job has settled. stderr is drained (a full pipe must
-// never wedge a child). A kill yields exitCode null — the no-exit-code refusal.
+// timeoutMs + SIGKILL at +5s, caps each captured stdout at 32MB. Streams ONE
+// NDJSON line per job — `{i, spawnError?, exitCode, stdout}\n` — the INSTANT
+// that job settles (not once at the end): the parent's spawnSync call has its
+// own combined-output cap, so writing incrementally means a job whose line
+// already flushed keeps its real outcome even if a LATER job's output pushes
+// the combined stream over that cap and the whole child gets killed. `i` is
+// the job's index (settle order is concurrent, not submission order — the
+// parent cannot infer which line belongs to which job without it). stderr is
+// drained (a full pipe must never wedge a child). A kill yields exitCode null
+// — the no-exit-code refusal.
 //
 // THE RED LINE: this child only `spawn`s the operator-resolved agent binary with
-// shell:false. It imports NO model SDK and reads NO credentials. Behavior MUST
-// stay byte-identical to the previous embedded string.
+// shell:false. It imports NO model SDK and reads NO credentials.
 
 const { spawn } = require("node:child_process");
 let raw = "";
+const MAX_STDIN_BYTES = 32 * 1024 * 1024;
 process.stdin.setEncoding("utf8");
-process.stdin.on("data", (d) => (raw += d));
+process.stdin.on("data", (d) => { if (raw.length < MAX_STDIN_BYTES) raw += d; });
 process.stdin.on("end", () => {
-  const jobs = JSON.parse(raw);
+  let jobs;
+  try {
+    jobs = JSON.parse(raw);
+  } catch (e) {
+    process.stdout.write(JSON.stringify([{ spawnError: `invalid stdin JSON: ${String(e && e.message || e)}`, exitCode: null, stdout: "" }]));
+    return;
+  }
   if (!jobs.length) { process.stdout.write("[]"); return; }
-  const out = new Array(jobs.length);
-  let pending = jobs.length;
   const CAP = 32 * 1024 * 1024;
   jobs.forEach((job, i) => {
     let stdout = "";
+    let stdoutBytes = 0;
+    let stdoutTruncated = false;
     let settled = false;
     const settle = (o) => {
       if (settled) return;
       settled = true;
-      out[i] = o;
-      if (--pending === 0) process.stdout.write(JSON.stringify(out));
+      process.stdout.write(JSON.stringify({ i, ...o }) + "\n");
     };
     let child;
     try {
-      child = spawn(job.binary, job.args, { cwd: job.cwd, env: process.env, shell: false });
+      child = spawn(job.binary, job.args, { cwd: job.cwd, env: job.env || process.env, shell: false });
     } catch (error) {
       settle({ spawnError: String((error && error.message) || error), exitCode: null, stdout: "" });
       return;
     }
     const term = setTimeout(() => { try { child.kill("SIGTERM"); } catch {} }, job.timeoutMs);
     const kill = setTimeout(() => { try { child.kill("SIGKILL"); } catch {} }, job.timeoutMs + 5000);
-    child.stdout.on("data", (d) => { if (stdout.length < CAP) stdout += d; });
+    child.stdout.on("data", (d) => {
+      const chunk = Buffer.isBuffer(d) ? d : Buffer.from(String(d));
+      stdoutBytes += chunk.length;
+      if (stdoutTruncated) return;
+      const remaining = CAP - Buffer.byteLength(stdout);
+      if (remaining <= 0 || chunk.length > remaining) {
+        stdoutTruncated = true;
+        if (remaining > 0) stdout += chunk.subarray(0, remaining).toString();
+        return;
+      }
+      stdout += chunk.toString();
+    });
     child.stderr.on("data", () => {});
     child.on("error", (error) => {
       clearTimeout(term); clearTimeout(kill);
@@ -52,6 +75,10 @@ process.stdin.on("end", () => {
     });
     child.on("close", (code) => {
       clearTimeout(term); clearTimeout(kill);
+      if (stdoutTruncated) {
+        settle({ spawnError: `stdout exceeded ${CAP} byte cap (${stdoutBytes} bytes)`, exitCode: null, stdout: "" });
+        return;
+      }
       settle({ exitCode: typeof code === "number" ? code : null, stdout });
     });
   });

package/scripts/children/http-delegate-child.js

@@ -15,7 +15,8 @@
 // API request. Behavior MUST stay byte-identical to the previous embedded string.
 
 (async () => {
-  const read = () => new Promise((res) => { let b = ""; process.stdin.on("data", (c) => (b += c)); process.stdin.on("end", () => res(b)); });
+  const MAX_STDIN_BYTES = 32 * 1024 * 1024;
+  const read = () => new Promise((res) => { let b = ""; process.stdin.on("data", (c) => { if (b.length < MAX_STDIN_BYTES) b += c; }); process.stdin.on("end", () => res(b)); });
   try {
     const job = JSON.parse((await read()) || "{}");
     const endpoint = process.env.CW_DELEGATE_ENDPOINT;

package/scripts/dogfood-release.js

@@ -6,7 +6,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { CoolWorkflowRunner } = require("../dist/orchestrator.js");
 
-const TARGET_VERSION = "0.1.96";
+const TARGET_VERSION = "0.1.98";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");

package/scripts/golden-path.js

@@ -33,7 +33,7 @@ function main() {
     const appValidation = runJson(["app", "validate", "end-to-end-golden-path"], pluginRoot);
     assert.equal(appValidation.valid, true);
     assert.equal(appValidation.summary.id, "end-to-end-golden-path");
-    assert.equal(appValidation.summary.version, "0.1.96");
+    assert.equal(appValidation.summary.version, "0.1.98");
 
     const plan = runJson(
       [
@@ -42,7 +42,7 @@ function main() {
         "--repo",
         tmp,
         "--question",
-        "Prove the deterministic v0.1.96 end-to-end golden path."
+        "Prove the deterministic v0.1.98 end-to-end golden path."
       ],
       pluginRoot
     );
@@ -52,7 +52,7 @@ function main() {
 
     let state = readJson(plan.statePath);
     assert.equal(state.workflow.app.id, "end-to-end-golden-path");
-    assert.equal(state.workflow.app.version, "0.1.96");
+    assert.equal(state.workflow.app.version, "0.1.98");
     assert.equal(state.loopStage, "interpret");
 
     const dispatch = runJson(["dispatch", plan.runId, "--limit", "1", "--sandbox", "readonly"], tmp);
@@ -195,7 +195,7 @@ function main() {
     assert.equal(reportPath, plan.reportPath);
     assert.ok(fs.existsSync(reportPath));
     const report = fs.readFileSync(reportPath, "utf8");
-    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.96/);
+    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.98/);
     assert.match(report, /## Candidates/);
     assert.match(report, /## Trust Audit/);
     assert.match(report, /## Acceptance Rationale/);