cool-workflow 0.1.97 → 0.1.98

package/docs/handoff-setup.md

@@ -0,0 +1,120 @@
+# Handoff ledger — shared-repo setup (T2a)
+
+How to stand up the shared repo that carries `cw ledger` entries between two
+agents scoped to two separate repos (e.g. `cool-workflow` and `chime`), each
+running in its own cloud session. The verbs are documented in
+[cross-agent-ledger](cross-agent-ledger.7.md); this is the operator runbook.
+
+Examples are portable — replace `<owner>`, `<src-repo>`, and the paths with your
+own, and keep tokens in environment variables, never in files or commit text.
+
+## What only the operator can do
+
+- A cool-workflow-scoped web session cannot create the shared repo — the GitHub
+  integration returns `403 Resource not accessible by integration` for any repo
+  outside its scope. Create it yourself.
+- Scoping the two agent environments (or granting them git credentials) is a
+  Claude Code web-UI step; it cannot be done from inside a session.
+
+## Choosing a host: GitHub vs self-hosted (Gitea)
+
+The transport is git-host-agnostic — the kernel has no git logic, so any git
+remote works. The choice is about reachability and operations, not code.
+
+| | GitHub (private repo) | Self-hosted Gitea (your VPS) |
+|---|---|---|
+| Reachability from cloud sessions | github.com is in the default **Trusted** allowlist — works with no network-policy change | Your VPS host is **not** in the default allowlist — the environment's network access must be configured to permit it |
+| Scope wall | The GitHub MCP scope is per-repo; the ledger uses plain git (not MCP) so it works, but it runs against the grain of the scoping model | Not a GitHub repo at all, so the GitHub scope wall does not apply |
+| Limits / quota | Disable Actions on this repo (it needs no CI) so it burns no minutes; git push/pull is not API-rate-limited; ledger traffic is tiny | Fully self-controlled, unlimited |
+| Operations | Managed, backed up, zero maintenance | You run it: uptime, backups, TLS cert, patching |
+| Data location | GitHub's servers (private) | Your own hardware |
+
+**Recommendation.** Start on **GitHub private** — it is reachable out of the box
+and the quota worry is practically moot for tiny ledger traffic. Move to **Gitea**
+if you want full self-hosting AND have confirmed the cloud environment can reach
+your VPS through its network policy (the deciding prerequisite). Migrating later
+is only a change of git remote — no code change.
+
+## GitHub private — setup
+
+1. **Token.** GitHub → Settings → Developer settings → Personal access tokens →
+   Fine-grained. Repository access: only `<owner>/handoff`. Permissions:
+   Contents = Read and write. Copy the token.
+2. **Repo.** Create `<owner>/handoff`, private, initialized with a README. In
+   Settings → Actions → General, disable Actions (no CI needed → no minutes).
+3. **Environments.** In each agent environment (both the `cool-workflow` and the
+   `chime` environment), add an environment variable `GH_TOKEN=<token>` (`.env`
+   format, no quotes). A new session is required for it to take effect.
+4. **Optional** — put the clone in each environment's setup script so the ledger
+   is present at session start:
+   ```bash
+   #!/bin/bash
+   git clone https://oauth2:${GH_TOKEN}@github.com/<owner>/handoff.git /home/user/handoff || true
+   ```
+
+## Gitea (self-hosted) — setup
+
+Same shape, two extra prerequisites:
+
+1. Serve Gitea over HTTPS with a valid certificate (e.g. Let's Encrypt) so the
+   cloud VM's git can verify it.
+2. Configure the agent environment's **network access** to permit your VPS host —
+   the default Trusted allowlist does not include it. If the loop cannot reach
+   the VPS, it cannot run.
+3. Create a Gitea access token, store it as an environment variable, and clone
+   with an authenticated remote (`https://<user>:${GIT_TOKEN}@<vps-host>/<owner>/handoff.git`).
+
+## Directory convention
+
+Entries live under `ledger/` in the shared repo, one file per entry named by its
+id:
+
+```
+handoff/
+  ledger/
+    ldg-1de7c92172af1871.json
+    ldg-2315e4b33b9a812f.json
+```
+
+## The loop
+
+Producing side (propose a change, hand it over):
+
+```bash
+entry=$(cw ledger propose --from cool-workflow --to chime \
+  --title "Add retry" --rationale "flaky net" \
+  --files src/net.ts --diff "$(git -C <src-repo> diff)")
+id=$(printf '%s' "$entry" | jq -r .id)
+printf '%s\n' "$entry" > /home/user/handoff/ledger/$id.json
+git -C /home/user/handoff add ledger/$id.json
+git -C /home/user/handoff commit -m "propose $id"
+git -C /home/user/handoff push
+```
+
+Note the single `cw ledger propose` call captured into `$entry` — calling it
+twice would mint two different entries (each carries a fresh `createdAt`).
+
+Consuming side (verify the inbox, then act or review back):
+
+```bash
+git -C /home/user/handoff pull
+cw ledger list --dir /home/user/handoff/ledger && echo "inbox verified — safe to act"
+
+# hand a verdict back:
+entry=$(cw ledger review --from chime --to cool-workflow \
+  --target ldg-1de7c92172af1871 --verdict approved --findings "tests pass,scope ok")
+id=$(printf '%s' "$entry" | jq -r .id)
+printf '%s\n' "$entry" > /home/user/handoff/ledger/$id.json
+git -C /home/user/handoff add ledger/$id.json
+git -C /home/user/handoff commit -m "review $id"
+git -C /home/user/handoff push
+```
+
+## Notes
+
+- Keep private code out of a **public** handoff repo: omit `--diff` and reference
+  a commit/branch in the private source repo instead, so only metadata + a
+  pointer is exposed. On a private handoff repo, full diffs are fine.
+- The other side may build entries without `cw` as long as they match the
+  digest/id rules in [cross-agent-ledger](cross-agent-ledger.7.md); otherwise
+  `cw ledger verify` refuses them with `ledger-digest-mismatch`.

package/docs/multi-agent-cli-mcp-surface.7.md

@@ -321,3 +321,5 @@ The host-facing surface tracks the CLI golden-path fixes (`cw -q` routing + repo
 0.1.96
 
 0.1.97
+
+0.1.98

package/docs/multi-agent-eval-replay-harness.7.md

@@ -347,3 +347,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.96
 
 0.1.97
+
+0.1.98

package/docs/multi-agent-operator-ux.7.md

@@ -359,3 +359,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.96
 
 0.1.97
+
+0.1.98

package/docs/node-snapshot-diff-replay.7.md

@@ -180,3 +180,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.96
 
 0.1.97
+
+0.1.98

package/docs/observability-cost-accounting.7.md

@@ -239,3 +239,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.96
 
 0.1.97
+
+0.1.98

package/docs/project-index.md

@@ -1,15 +1,15 @@
 # Cool Workflow Project Index
 
-Generated from the current repository code on 2026-06-30 by `npm run sync:project-index`.
+Generated from the current repository code on 2026-07-03 by `npm run sync:project-index`.
 
 ## Snapshot
 
 - Package: `cool-workflow`
-- Version: `0.1.97`
-- Source modules: `68`
+- Version: `0.1.98`
+- Source modules: `69`
 - Workflow apps: `8`
-- Docs: `59`
-- Smoke tests: `164`
+- Docs: `61`
+- Smoke tests: `172`
 - Repository: https://github.com/coo1white/cool-workflow
 
 ## Architecture
@@ -93,6 +93,7 @@ multi-agent host -> topology -> blackboard/coordinator
 - [evidence-reasoning.ts](../src/evidence-reasoning.ts)
 - [execution-backend.ts](../src/execution-backend.ts)
 - [gates.ts](../src/gates.ts)
+- [ledger.ts](../src/ledger.ts)
 - [loop-expansion.ts](../src/loop-expansion.ts)
 - [mcp-surface.ts](../src/mcp-surface.ts)
 - [multi-agent-eval.ts](../src/multi-agent-eval.ts)
@@ -145,6 +146,7 @@ multi-agent host -> topology -> blackboard/coordinator
 - [Contract Migration Tooling](contract-migration-tooling.7.md)
 - [Control-Plane Scheduling](control-plane-scheduling.7.md)
 - [Coordinator / Blackboard](coordinator-blackboard.7.md)
+- [Cross-Agent Handoff Ledger](cross-agent-ledger.7.md)
 - [DEMO(7)](demo.7.md)
 - [DOCTOR(7)](doctor.7.md)
 - [Dogfood One Real Repo](dogfood-one-real-repo.7.md)
@@ -155,6 +157,7 @@ multi-agent host -> topology -> blackboard/coordinator
 - [EXECUTION-BACKENDS(7)](execution-backends.7.md)
 - [FIX(7)](fix.7.md)
 - [Getting Started](getting-started.md)
+- [Handoff ledger — shared-repo setup (T2a)](handoff-setup.md)
 - [Cool Workflow Docs](index.md)
 - [INIT(7)](init.7.md)
 - [MCP App Surface](mcp-app-surface.7.md)
@@ -210,6 +213,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [artifact-integrity-smoke.js](../test/artifact-integrity-smoke.js)
 - [audit-verify-smoke.js](../test/audit-verify-smoke.js)
 - [backend-registry-smoke.js](../test/backend-registry-smoke.js)
+- [batch-output-overflow-smoke.js](../test/batch-output-overflow-smoke.js)
 - [blackboard-state-explosion-management-smoke.js](../test/blackboard-state-explosion-management-smoke.js)
 - [block-unapproved-tag-smoke.js](../test/block-unapproved-tag-smoke.js)
 - [budget-scaling-loop-smoke.js](../test/budget-scaling-loop-smoke.js)
@@ -235,6 +239,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [collaboration-ops-unit-smoke.js](../test/collaboration-ops-unit-smoke.js)
 - [concurrency-default-smoke.js](../test/concurrency-default-smoke.js)
 - [concurrent-failure-semantics-smoke.js](../test/concurrent-failure-semantics-smoke.js)
+- [concurrent-subworkflow-cache-nesting-smoke.js](../test/concurrent-subworkflow-cache-nesting-smoke.js)
 - [concurrent-workflow-dsl-smoke.js](../test/concurrent-workflow-dsl-smoke.js)
 - [contract-migration-tooling-smoke.js](../test/contract-migration-tooling-smoke.js)
 - [control-plane-scheduling-smoke.js](../test/control-plane-scheduling-smoke.js)
@@ -242,11 +247,14 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [cw-help-per-command-smoke.js](../test/cw-help-per-command-smoke.js)
 - [dead-export-removal-guard-smoke.js](../test/dead-export-removal-guard-smoke.js)
 - [deepseek-agent-wrapper-smoke.js](../test/deepseek-agent-wrapper-smoke.js)
+- [deferred-checkpoint-batching-smoke.js](../test/deferred-checkpoint-batching-smoke.js)
 - [demo-bundle-smoke.js](../test/demo-bundle-smoke.js)
 - [det-ids-b-smoke.js](../test/det-ids-b-smoke.js)
 - [doctor-smoke.js](../test/doctor-smoke.js)
 - [dogfood-architecture-review-smoke.js](../test/dogfood-architecture-review-smoke.js)
 - [dogfood-release-smoke.js](../test/dogfood-release-smoke.js)
+- [drive-concurrency-flag-smoke.js](../test/drive-concurrency-flag-smoke.js)
+- [drive-exhaustion-blocked-smoke.js](../test/drive-exhaustion-blocked-smoke.js)
 - [durable-atomic-write-smoke.js](../test/durable-atomic-write-smoke.js)
 - [end-to-end-demo-smoke.js](../test/end-to-end-demo-smoke.js)
 - [end-to-end-golden-path-smoke.js](../test/end-to-end-golden-path-smoke.js)
@@ -264,6 +272,9 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [h7-custom-profile-persist-smoke.js](../test/h7-custom-profile-persist-smoke.js)
 - [headline-commands-smoke.js](../test/headline-commands-smoke.js)
 - [incremental-resume-smoke.js](../test/incremental-resume-smoke.js)
+- [ledger-apply-smoke.js](../test/ledger-apply-smoke.js)
+- [ledger-resolution-smoke.js](../test/ledger-resolution-smoke.js)
+- [ledger-verify-smoke.js](../test/ledger-verify-smoke.js)
 - [loop-bounded-expansion-smoke.js](../test/loop-bounded-expansion-smoke.js)
 - [mcp-app-surface-smoke.js](../test/mcp-app-surface-smoke.js)
 - [mcp-surface-registry-smoke.js](../test/mcp-surface-registry-smoke.js)

package/docs/real-execution-backends.7.md

@@ -187,3 +187,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.96
 
 0.1.97
+
+0.1.98

package/docs/release-and-migration.7.md

@@ -327,3 +327,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.96
 
 0.1.97
+
+0.1.98

package/docs/release-tooling.7.md

@@ -290,3 +290,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.96
 
 0.1.97
+
+0.1.98

package/docs/run-registry-control-plane.7.md

@@ -470,3 +470,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.96
 
 0.1.97
+
+0.1.98

package/docs/run-retention-reclamation.7.md

@@ -238,3 +238,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.96
 
 0.1.97
+
+0.1.98

package/docs/state-explosion-management.7.md

@@ -316,3 +316,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.96
 
 0.1.97
+
+0.1.98

package/docs/team-collaboration.7.md

@@ -252,3 +252,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.96
 
 0.1.97
+
+0.1.98

package/docs/web-desktop-workbench.7.md

@@ -260,3 +260,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.96
 
 0.1.97
+
+0.1.98

package/manifest/plugin.manifest.json

@@ -2,7 +2,7 @@
   "_comment": "SINGLE SOURCE OF TRUTH for every vendor manifest. Edit THIS file, then run `npm run gen:manifests`. Do NOT hand-edit the generated vendor manifests (.claude-plugin/, .codex-plugin/, .agents/, .mcp.json) — `npm run gen:manifests -- --check` (run by release:check) will fail if they drift from this source.",
   "identity": {
     "name": "cool-workflow",
-    "version": "0.1.97",
+    "version": "0.1.98",
     "license": "BSD-2-Clause",
     "homepage": "https://github.com/coo1white/cool-workflow",
     "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.97",
+  "version": "0.1.98",
   "bin": {
     "cool-workflow": "scripts/cw.js",
     "cw": "scripts/cw.js"

package/scripts/agents/codex-agent.js

@@ -21,6 +21,16 @@
 // per-run override that does NOT touch the user's interactive codex. Tune with
 // CW_CODEX_REASONING_EFFORT (default "low"); set it to "medium"/"high" to opt back
 // into more thinking.
+//
+// REVIEW MODE: the default low-effort / read-only sandbox is right for a fast
+// delegated worker or a liveness probe — but WRONG for an independent RELEASE
+// reviewer, which must actually RE-RUN the gate (build, tests, regenerate dist)
+// to earn its verdict. A read-only sandbox can't execute that gate, so the model
+// is structurally unable to verify and tends to fabricate a REJECTED. The release
+// path therefore sets CW_RELEASE_REVIEW=1 (a vendor-agnostic signal from
+// release-flow.js): on that signal this wrapper raises reasoning to "high" and
+// opens the sandbox to "workspace-write" so codex can run the gate it is judging.
+// Explicit CW_CODEX_REASONING_EFFORT / CW_CODEX_SANDBOX always win over the signal.
 
 const fs = require("node:fs");
 const os = require("node:os");
@@ -80,11 +90,31 @@ function recordJsonLine(line) {
   }
 }
 
-render.action("codex: reading the repo (read-only)…");
+// A release review (CW_RELEASE_REVIEW=1) must execute the gate it judges, so it
+// needs both stronger reasoning and a sandbox that can write inside the workspace.
+// Explicit env overrides win; otherwise the review signal lifts the fast defaults.
+const reviewMode = process.env.CW_RELEASE_REVIEW === "1";
 
 // Cap codex's reasoning effort for CW runs (speed) — overrides config.toml for
-// THIS invocation only. Default "low"; CW_CODEX_REASONING_EFFORT opts back up.
-const effort = process.env.CW_CODEX_REASONING_EFFORT || "low";
+// THIS invocation only. Default "low"; CW_CODEX_REASONING_EFFORT opts back up, and
+// a release review defaults to "high".
+const effort = process.env.CW_CODEX_REASONING_EFFORT || (reviewMode ? "high" : "low");
+
+// Sandbox: read-only is the POLA default (a worker/probe only reads). A release
+// review opens to workspace-write so codex can build/test/regenerate the gate.
+// CW_CODEX_SANDBOX overrides both; an unknown value fails closed (never silently
+// downgraded to read-only, which would re-create the can't-verify failure mode).
+const SANDBOX_MODES = new Set(["read-only", "workspace-write", "danger-full-access"]);
+const sandbox = process.env.CW_CODEX_SANDBOX || (reviewMode ? "workspace-write" : "read-only");
+if (!SANDBOX_MODES.has(sandbox)) {
+  process.stderr.write(
+    `codex-agent: invalid CW_CODEX_SANDBOX="${sandbox}" — expected one of ${[...SANDBOX_MODES].join(", ")}\n`
+  );
+  process.exit(2);
+}
+
+render.action(`codex: reading the repo (${sandbox})…`);
+
 const args = [
   "exec",
   "--json",
@@ -93,7 +123,7 @@ const args = [
   "--output-last-message",
   finalPath,
   "--sandbox",
-  "read-only",
+  sandbox,
   "--color",
   "never",
   "-"

package/scripts/canonical-apps.js

@@ -83,7 +83,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.1.97",
+      "Cool Workflow v0.1.98",
       "--freshness",
       "as of release preparation"
     ]
@@ -117,14 +117,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.1.97");
+    assert.equal(summary.version, "0.1.98");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.1.97");
+    assert.equal(shown.app.version, "0.1.98");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -135,7 +135,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.1.97");
+    assert.equal(state.workflow.app.version, "0.1.98");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/children/batch-delegate-child.js

@@ -8,13 +8,19 @@
 //
 // Reads jobs JSON on stdin, spawns ALL concurrently (shell:false, inherited env —
 // the agent's own credentials resolve; CW never reads them), per-job SIGTERM at
-// timeoutMs + SIGKILL at +5s, caps each captured stdout at 32MB, and prints the
-// outcome array when every job has settled. stderr is drained (a full pipe must
-// never wedge a child). A kill yields exitCode null — the no-exit-code refusal.
+// timeoutMs + SIGKILL at +5s, caps each captured stdout at 32MB. Streams ONE
+// NDJSON line per job — `{i, spawnError?, exitCode, stdout}\n` — the INSTANT
+// that job settles (not once at the end): the parent's spawnSync call has its
+// own combined-output cap, so writing incrementally means a job whose line
+// already flushed keeps its real outcome even if a LATER job's output pushes
+// the combined stream over that cap and the whole child gets killed. `i` is
+// the job's index (settle order is concurrent, not submission order — the
+// parent cannot infer which line belongs to which job without it). stderr is
+// drained (a full pipe must never wedge a child). A kill yields exitCode null
+// — the no-exit-code refusal.
 //
 // THE RED LINE: this child only `spawn`s the operator-resolved agent binary with
-// shell:false. It imports NO model SDK and reads NO credentials. Behavior MUST
-// stay byte-identical to the previous embedded string.
+// shell:false. It imports NO model SDK and reads NO credentials.
 
 const { spawn } = require("node:child_process");
 let raw = "";
@@ -30,17 +36,16 @@ process.stdin.on("end", () => {
     return;
   }
   if (!jobs.length) { process.stdout.write("[]"); return; }
-  const out = new Array(jobs.length);
-  let pending = jobs.length;
   const CAP = 32 * 1024 * 1024;
   jobs.forEach((job, i) => {
     let stdout = "";
+    let stdoutBytes = 0;
+    let stdoutTruncated = false;
     let settled = false;
     const settle = (o) => {
       if (settled) return;
       settled = true;
-      out[i] = o;
-      if (--pending === 0) process.stdout.write(JSON.stringify(out));
+      process.stdout.write(JSON.stringify({ i, ...o }) + "\n");
     };
     let child;
     try {
@@ -51,7 +56,18 @@ process.stdin.on("end", () => {
     }
     const term = setTimeout(() => { try { child.kill("SIGTERM"); } catch {} }, job.timeoutMs);
     const kill = setTimeout(() => { try { child.kill("SIGKILL"); } catch {} }, job.timeoutMs + 5000);
-    child.stdout.on("data", (d) => { if (stdout.length < CAP) stdout += d; });
+    child.stdout.on("data", (d) => {
+      const chunk = Buffer.isBuffer(d) ? d : Buffer.from(String(d));
+      stdoutBytes += chunk.length;
+      if (stdoutTruncated) return;
+      const remaining = CAP - Buffer.byteLength(stdout);
+      if (remaining <= 0 || chunk.length > remaining) {
+        stdoutTruncated = true;
+        if (remaining > 0) stdout += chunk.subarray(0, remaining).toString();
+        return;
+      }
+      stdout += chunk.toString();
+    });
     child.stderr.on("data", () => {});
     child.on("error", (error) => {
       clearTimeout(term); clearTimeout(kill);
@@ -59,6 +75,10 @@ process.stdin.on("end", () => {
     });
     child.on("close", (code) => {
       clearTimeout(term); clearTimeout(kill);
+      if (stdoutTruncated) {
+        settle({ spawnError: `stdout exceeded ${CAP} byte cap (${stdoutBytes} bytes)`, exitCode: null, stdout: "" });
+        return;
+      }
       settle({ exitCode: typeof code === "number" ? code : null, stdout });
     });
   });

package/scripts/dogfood-release.js

@@ -6,7 +6,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { CoolWorkflowRunner } = require("../dist/orchestrator.js");
 
-const TARGET_VERSION = "0.1.97";
+const TARGET_VERSION = "0.1.98";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");

package/scripts/golden-path.js

@@ -33,7 +33,7 @@ function main() {
     const appValidation = runJson(["app", "validate", "end-to-end-golden-path"], pluginRoot);
     assert.equal(appValidation.valid, true);
     assert.equal(appValidation.summary.id, "end-to-end-golden-path");
-    assert.equal(appValidation.summary.version, "0.1.97");
+    assert.equal(appValidation.summary.version, "0.1.98");
 
     const plan = runJson(
       [
@@ -42,7 +42,7 @@ function main() {
         "--repo",
         tmp,
         "--question",
-        "Prove the deterministic v0.1.97 end-to-end golden path."
+        "Prove the deterministic v0.1.98 end-to-end golden path."
       ],
       pluginRoot
     );
@@ -52,7 +52,7 @@ function main() {
 
     let state = readJson(plan.statePath);
     assert.equal(state.workflow.app.id, "end-to-end-golden-path");
-    assert.equal(state.workflow.app.version, "0.1.97");
+    assert.equal(state.workflow.app.version, "0.1.98");
     assert.equal(state.loopStage, "interpret");
 
     const dispatch = runJson(["dispatch", plan.runId, "--limit", "1", "--sandbox", "readonly"], tmp);
@@ -195,7 +195,7 @@ function main() {
     assert.equal(reportPath, plan.reportPath);
     assert.ok(fs.existsSync(reportPath));
     const report = fs.readFileSync(reportPath, "utf8");
-    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.97/);
+    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.98/);
     assert.match(report, /## Candidates/);
     assert.match(report, /## Trust Audit/);
     assert.match(report, /## Acceptance Rationale/);

package/scripts/release-flow.js

@@ -283,7 +283,13 @@ function delegateReview(resultPath, inputPath) {
     // the file takes precedence. stderr goes to the terminal for live output.
     const r = spawnSync(bin, args, {
       cwd: repoRoot,
-      env: { ...process.env },
+      // CW_RELEASE_REVIEW=1 is a vendor-agnostic signal that THIS spawn is a
+      // release verdict, not a fast worker turn. Wrappers that can re-run the gate
+      // (e.g. codex-agent.js) read it to raise reasoning effort and open an
+      // exec-capable sandbox — a read-only/low-effort reviewer can't execute the
+      // gate it judges and degrades to fabricated verdicts. Preflight liveness
+      // probes never set it, so they stay fast and read-only.
+      env: { ...process.env, CW_RELEASE_REVIEW: "1" },
       encoding: "utf8",
       timeout: cfg.timeoutMs || REVIEWER_TIMEOUT_MS,
       shell: false,