cool-workflow 0.2.0 → 0.2.2

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cool-workflow",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "author": {
     "name": "COOLWHITE LLC"
   },

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
   "author": {
     "name": "COOLWHITE LLC"

package/README.md

@@ -64,16 +64,18 @@ cw demo tamper
 ### 2 · Ask a question about your code — one command
 
 ```bash
-cw -q "What are the main risks here?"
+cw -q "How does auth work end-to-end here?"
 ```
 
-CW auto-detects the current repo and the first agent on your `PATH`. Pin a specific one with a flag
-(`-claude`, `-codex`, `-gemini`, `-deepseek`). Point it anywhere — no `cd` required — or review a
-**remote repo by URL** and CW clones, snapshots, and reviews the checkout:
+Any question works, not only a risk audit — architecture questions, "is it safe to change X",
+"what would break if Y rotated" all get a direct, cited answer. CW auto-detects the current repo
+and the first agent on your `PATH`. Pin a specific one with a flag (`-claude`, `-codex`, `-gemini`,
+`-deepseek`). Point it anywhere — no `cd` required — or review a **remote repo by URL** and CW
+clones, snapshots, and reviews the checkout:
 
 ```bash
 cw -q "What are the security risks?" -dir /path/to/project
-cw -q "What are the risks?" --link https://github.com/owner/repo
+cw -q "Is it safe to swap this queue for Redis?" --link https://github.com/owner/repo
 ```
 
 **Not just code.** Aim CW at a folder of docs, notes, or papers and it reads them as sources for the

package/apps/architecture-review/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review",
   "title": "Architecture Review",
   "summary": "Map a repository architecture, assess risks, verify important findings, and synthesize an evidence-backed verdict.",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "author": "COOLWHITE LLC",
   "inputs": [
     {
@@ -16,7 +16,7 @@
       "name": "question",
       "type": "string",
       "required": true,
-      "description": "Architecture question or decision to review."
+      "description": "Architecture question or decision to review. Every phase scopes its work to this question - not only a fixed risk list."
     },
     {
       "name": "invariant",

package/apps/architecture-review/workflow.js

@@ -8,7 +8,7 @@ module.exports = ({ workflow, phase, parallel, agent, artifact, input }) => {
     input("question", {
       type: "string",
       required: true,
-      description: "Architecture question or decision to review."
+      description: "Architecture question or decision to review. Every phase scopes its work to this question - not only a fixed risk list."
     }),
     input("invariant", {
       type: "string",
@@ -41,54 +41,54 @@ module.exports = ({ workflow, phase, parallel, agent, artifact, input }) => {
         ),
         agent(
           "map:web-client",
-          "Map web/client/UI boundaries, local state, backend dependencies, build/runtime assumptions, and candidate risks in {{repo}}. Focus: {{focus}}. Return exact files and commands that informed the map.",
+          "Map web/client/UI boundaries, local state, backend dependencies, build/runtime assumptions, and candidate risks in {{repo}} as they relate to {{question}}. Focus: {{focus}}. Invariants: {{invariant}}. Return exact files and commands that informed the map.",
           { sandboxProfileId: "readonly" }
         ),
         agent(
           "map:db-security",
-          "Map database, persistence, migrations, secrets, auth, permissions, and security-sensitive paths in {{repo}}. Return candidate risks with file paths, config names, and uncertainty boundaries.",
+          "Map database, persistence, migrations, secrets, auth, permissions, and security-sensitive paths in {{repo}} as they relate to {{question}}. Focus: {{focus}}. Invariants: {{invariant}}. Return candidate risks with file paths, config names, and uncertainty boundaries.",
           { sandboxProfileId: "readonly" }
         ),
         agent(
           "map:deploy-config",
-          "Map deployment, CI, package scripts, Docker or compose files, reverse proxies, environment config, supervision, and operational assumptions. Return concrete files and release or runtime risks.",
+          "Map deployment, CI, package scripts, Docker or compose files, reverse proxies, environment config, supervision, and operational assumptions in {{repo}} as they relate to {{question}}. Focus: {{focus}}. Invariants: {{invariant}}. Return concrete files and release or runtime risks.",
           { sandboxProfileId: "readonly" }
         ),
         agent(
           "map:jobs-operators",
-          "Map background jobs, admin/operator surfaces, queues, scheduled work, generated files, state transitions, and failure recovery paths. Identify missing or non-applicable areas explicitly.",
+          "Map background jobs, admin/operator surfaces, queues, scheduled work, generated files, state transitions, and failure recovery paths in {{repo}} as they relate to {{question}}. Focus: {{focus}}. Invariants: {{invariant}}. Identify missing or non-applicable areas explicitly.",
           { sandboxProfileId: "readonly" }
         ),
         agent(
           "map:transport-core",
-          "Map protocol, daemon, transport, rendering, networking, worker isolation, or core engine boundaries when present. If absent, explain why with inspected evidence.",
+          "Map protocol, daemon, transport, rendering, networking, worker isolation, or core engine boundaries when present in {{repo}}, as they relate to {{question}}. Focus: {{focus}}. Invariants: {{invariant}}. If absent, explain why with inspected evidence.",
           { sandboxProfileId: "readonly" }
         )
       ]),
       parallel("Assess", [
         agent(
           "assess:security",
-          "Assess mapper findings through a security lens. Separate real, conditional, non-issue, and unknown risks with evidence, falsifiers, and exact files or config keys.",
+          "Assess mapper findings through a security lens as they relate to {{question}}. Focus: {{focus}}. Invariants: {{invariant}}. Separate real, conditional, non-issue, and unknown risks with evidence, falsifiers, and exact files or config keys.",
           { sandboxProfileId: "readonly" }
         ),
         agent(
           "assess:data-correctness",
-          "Assess data correctness, schema drift, persistence invariants, concurrency, transactions, cache behavior, and state corruption risks. Tie every important claim to inspected evidence.",
+          "Assess data correctness, schema drift, persistence invariants, concurrency, transactions, cache behavior, and state corruption risks as they relate to {{question}}. Focus: {{focus}}. Invariants: {{invariant}}. Tie every important claim to inspected evidence.",
           { sandboxProfileId: "readonly" }
         ),
         agent(
           "assess:failure-modes",
-          "Assess startup, shutdown, retries, partial failure, dependency outage, backup/restore, release rollback, and recovery behavior. Identify deterministic commands that could verify the claims.",
+          "Assess startup, shutdown, retries, partial failure, dependency outage, backup/restore, release rollback, and recovery behavior as they relate to {{question}}. Focus: {{focus}}. Invariants: {{invariant}}. Identify deterministic commands that could verify the claims.",
           { sandboxProfileId: "readonly" }
         ),
         agent(
           "assess:scale-ops",
-          "Assess scale, operational complexity, observability, configuration, packaging, deployment, and maintenance risks. Include exact files, scripts, or missing controls.",
+          "Assess scale, operational complexity, observability, configuration, packaging, deployment, and maintenance risks as they relate to {{question}}. Focus: {{focus}}. Invariants: {{invariant}}. Include exact files, scripts, or missing controls.",
           { sandboxProfileId: "readonly" }
         ),
         agent(
           "assess:maintainability",
-          "Assess module boundaries, ownership clarity, coupling, extensibility, testability, and future change risk. Distinguish architectural risks from style preferences.",
+          "Assess module boundaries, ownership clarity, coupling, extensibility, testability, and future change risk as they relate to {{question}}. Focus: {{focus}}. Invariants: {{invariant}}. Distinguish architectural risks from style preferences.",
           { sandboxProfileId: "readonly" }
         ),
         agent(
@@ -100,7 +100,7 @@ module.exports = ({ workflow, phase, parallel, agent, artifact, input }) => {
       phase("Verify", [
         agent(
           "verify:p0-p2-risks",
-          "Re-open evidence for every candidate P0/P1/P2 risk. Confirm real risks, downgrade unsupported concerns, and list exact file paths, commands, logs, or unknowns. The cw:result evidence array must cite durable locators.",
+          "Re-open evidence for every candidate P0/P1/P2 risk found so far, judged against {{question}}. Confirm real risks, downgrade unsupported concerns, and list exact file paths, commands, logs, or unknowns. The cw:result evidence array must cite durable locators.",
           { requiresEvidence: true, sandboxProfileId: "readonly" }
         )
       ]),

package/apps/architecture-review-fast/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review-fast",
   "title": "Architecture Review Fast",
   "summary": "Run a shorter architecture review with parallel map and assess phases for faster first results.",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/end-to-end-golden-path/app.json

@@ -3,7 +3,7 @@
   "id": "end-to-end-golden-path",
   "title": "End-to-End Golden Path",
   "summary": "Deterministic one-worker workflow app for proving the CW integration chain.",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/pr-review-fix-ci/app.json

@@ -3,7 +3,7 @@
   "id": "pr-review-fix-ci",
   "title": "PR Review Fix CI",
   "summary": "Review a pull request or branch, inspect CI failures, diagnose actionable issues, optionally patch, verify, and summarize with evidence.",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/release-cut/app.json

@@ -3,7 +3,7 @@
   "id": "release-cut",
   "title": "Release Cut",
   "summary": "Prepare a release with checklist discipline: version checks, changelog, tests, packaging, release notes, and final verification.",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/research-synthesis/app.json

@@ -3,7 +3,7 @@
   "id": "research-synthesis",
   "title": "Research Synthesis",
   "summary": "Split a research question into claims, investigate sources, cross-check evidence, verify claims, and synthesize a concise answer.",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/dist/cli/dispatch.js

@@ -1,7 +1,7 @@
 "use strict";
 // cli/dispatch.ts — the generic CLI executor over core/capability-table.ts.
 //
-// MILESTONE 2 (v2/PLAN.md build order, step 2; see the Revision note there
+// MILESTONE 2 (docs/rebuild/PLAN.md build order, step 2; see the Revision note there
 // for why this lands here, right after CLI parsing, instead of late).
 //
 // `dispatch(args)` first tries the CAPABILITY TABLE: it looks up the row
@@ -16,7 +16,7 @@
 // cli-argv-parsing.case.js and cli-exit-codes.case.js probe but that do
 // not yet have a real subsystem behind them (see each case's own
 // PLACEHOLDER comment for which future milestone owns it). Per the
-// Revision note in v2/PLAN.md, THIS file is never hand-extended again —
+// Revision note in docs/rebuild/PLAN.md, THIS file is never hand-extended again —
 // `dispatchLegacy`'s arms shrink to nothing as later milestones move each
 // one into a real capability-table row; nothing new is ever added here.
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -27,7 +27,6 @@ const capability_table_1 = require("../core/capability-table");
 const parseargv_1 = require("./parseargv");
 Object.defineProperty(exports, "KNOWN_COMMANDS", { enumerable: true, get: function () { return parseargv_1.KNOWN_COMMANDS; } });
 const io_1 = require("./io");
-const workflow_app_loader_1 = require("../shell/workflow-app-loader");
 function firstPositional(args, index = 0) {
     return args.positionals[index];
 }
@@ -75,26 +74,13 @@ function dispatchTable(args) {
     }
     return false;
 }
-// MILESTONE 12 (workflow-apps) — `search` filters the SAME real app
-// discovery `cw app list`/`cw list` use (shell/workflow-app-loader.ts),
-// by id/title/summary, matching `listApps` in the old build.
-function formatSearchResults(keyword, results) {
-    if (results.length === 0) {
-        return `No workflows matched "${keyword}".\n  Tip: cw list for all available workflows.`;
-    }
-    const lines = [`${results.length} workflow${results.length === 1 ? "" : "s"} matching "${keyword}"`];
-    for (const r of results) {
-        lines.push(`  ${r.id} — ${r.title}`);
-        const cut = r.summary.length > 120 ? `${r.summary.slice(0, 119)}…` : r.summary;
-        lines.push(`    ${cut}`);
-    }
-    lines.push("");
-    lines.push("Use cw info <id> for full details.");
-    return lines.join("\n");
-}
 /** The milestone-1 carry-over switch. See file header: never extended
  *  again — each arm here is replaced by a capability-table row when its
- *  own build-order milestone lands, not edited in place. */
+ *  own build-order milestone lands, not edited in place. Only entry-level
+ *  concerns live here now (bare help, and the two verbs a real
+ *  capability-table row can never fully own): every other verb this
+ *  switch used to carry is now a table row (see the NOTEs below) and
+ *  dispatchTable() above always matches it first. */
 function dispatchLegacy(args) {
     switch (args.command) {
         case "": {
@@ -114,38 +100,15 @@ function dispatchLegacy(args) {
         // NOTE: "version" is not an arm here — it is a real capability-table
         // row (core/capability-table.ts) that dispatchTable() above always
         // matches first, per the Revision note's "table rows, never a new
-        // switch arm" rule. Same for "list", "status", and "sandbox list".
-        // `search` filters the real app discovery by title/summary/id (see
-        // note above); MILESTONE 12.
-        case "search": {
-            const keyword = args.positionals.join(" ");
-            if (!keyword.trim()) {
-                throw new Error('Missing search keyword.\n  Tip: cw search architecture to find workflows about architecture.');
-            }
-            const lower = keyword.toLowerCase();
-            const results = (0, workflow_app_loader_1.listWorkflowApps)()
-                .filter((a) => String(a.title).toLowerCase().includes(lower) ||
-                String(a.summary).toLowerCase().includes(lower) ||
-                String(a.id).toLowerCase().includes(lower))
-                .map((a) => ({ id: String(a.id), title: String(a.title), summary: String(a.summary) }));
-            if ((0, io_1.wantsJson)(args.options)) {
-                (0, io_1.printJson)(results);
-            }
-            else {
-                process.stdout.write(`${formatSearchResults(keyword, results)}\n`);
-            }
-            return;
-        }
+        // switch arm" rule. Same for "list", "status", "sandbox list", and
+        // "search" (a cli-only row, hiddenFromHelp, so `cw help search` keeps
+        // its existing "Unknown command" text).
         // NOTE: "plan" and "quickstart" are not arms here any more — both are
         // now real capability-table rows (core/capability-table.ts, milestone
         // 6+7) that dispatchTable() above always matches first.
-        // PLACEHOLDER (milestone 3/6, state kernel + pipeline) — real `next`
-        // loads run state and returns dispatchable tasks; this milestone only
-        // reproduces the io.required missing-run-id refusal.
-        case "next": {
-            const runId = (0, io_1.required)((0, io_1.optionalArg)(firstPositional(args)), "run id");
-            throw new Error(`next is not implemented in this milestone (runId=${runId})`);
-        }
+        // NOTE: "next" is not an arm here any more — it is a real
+        // capability-table row (core/capability-table.ts) that dispatchTable()
+        // above always matches first.
         // MILESTONE 8 — `ledger propose|review|verify|apply|list` are now
         // real capability-table rows (core/capability-table.ts) that
         // dispatchTable() above always matches first; this arm is reached
@@ -157,30 +120,9 @@ function dispatchLegacy(args) {
         case "ledger": {
             throw new Error("Usage: cw ledger propose|review|verify|apply|list [options]");
         }
-        // PLACEHOLDER (milestone 10, scheduling/gc) — real `gc verify` checks
-        // whether a run's disk footprint was actually reclaimed; a run that
-        // was never reclaimed is not a failure (exit 0), which is exactly the
-        // shape this stub reproduces for an unresolvable run id.
-        case "gc": {
-            const sub = firstPositional(args);
-            if (sub === "verify") {
-                const runId = (0, io_1.optionalArg)(firstPositional(args, 1));
-                const payload = {
-                    schemaVersion: 1,
-                    runId: runId ?? null,
-                    reclaimed: false,
-                    verified: false,
-                    tier: "live",
-                    capability: "re-runnable",
-                    chainLength: 0,
-                    checks: [{ name: "located", pass: false, code: "not-reclaimed", detail: "run source not found" }],
-                    nextAction: "node scripts/cw.js registry refresh --scope home",
-                };
-                (0, io_1.printJson)(payload);
-                return;
-            }
-            throw new Error(`gc ${sub ?? ""} is not implemented in this milestone`);
-        }
+        // NOTE: "gc" is not an arm here any more — gc.plan/gc.run/gc.verify
+        // are now real capability-table rows (core/capability-table.ts) that
+        // dispatchTable() above always matches first.
         // NOTE: "run" is not an arm here any more — run.drive.step/run.drive
         // are now real capability-table rows (core/capability-table.ts,
         // milestone 6+7) that dispatchTable() above always matches first
@@ -196,20 +138,10 @@ function dispatchLegacy(args) {
         // (core/capability-table.ts, milestone 9) that dispatchTable() above
         // always matches first, per the Revision note's "table rows, never a
         // new switch arm" rule.
-        // PLACEHOLDER (milestone 3/4, state kernel + contract-migration) —
-        // real `migration check`/`prove` resolve a run id or file target; the
-        // missing-target refusal is the only shape this milestone reproduces.
-        case "migration": {
-            const sub = firstPositional(args);
-            if (sub === "check" || sub === "prove") {
-                const target = (0, io_1.optionalArg)(firstPositional(args, 1));
-                if (!target) {
-                    throw new Error('Missing target (run-id or state/app file).\n  Tip: find run ids with "cw run list" or create one with "cw quickstart"');
-                }
-                throw new Error(`migration ${sub} is not implemented in this milestone`);
-            }
-            throw new Error(`migration ${sub ?? ""} is not implemented in this milestone`);
-        }
+        // NOTE: "migration" is not an arm here any more — migration.list/
+        // check/prove are now real capability-table rows
+        // (core/capability-table.ts) that dispatchTable() above always
+        // matches first.
         // NOTE: "report" is not an arm here any more — report/report.bundle/
         // report.verify-bundle are now real capability-table rows
         // (core/capability-table.ts, milestones 8/11) that dispatchTable()

package/dist/cli/parseargv.js

@@ -2,7 +2,7 @@
 // cli/parseargv.ts — parseArgv, KNOWN_COMMANDS, suggestCommand.
 //
 // Pure. Byte-exact port of src/orchestrator.ts:789-887 in the old build.
-// See v2/PLAN.md byte-compat item 15 and SPEC/cli-surface.md "Argument
+// See docs/rebuild/PLAN.md byte-compat item 15 and SPEC/cli-surface.md "Argument
 // parsing (parseArgv)" / SPEC/orchestrator.md "Module-level exports".
 //
 // Rules (do not "clean up" — every one of these is pinned by a conformance
@@ -103,7 +103,10 @@ function parseArgv(argv) {
 /** src/orchestrator.ts:842-851 — every top-level command name, used for
  *  "did you mean". NOTE: this deliberately does NOT include "ledger" even
  *  though the dispatcher handles it and formatHelp lists it — a known,
- *  intentionally-preserved wart (see v2/PLAN.md "Kept byte-for-byte"). */
+ *  intentionally-preserved wart (see docs/rebuild/PLAN.md "Kept byte-for-byte").
+ *  NOTE: "update" is gone from the old capture's list on purpose: no code
+ *  was behind the verb in this build, so having it here made `cw update`
+ *  say "Did you mean: update?" — a hint that points at itself. */
 exports.KNOWN_COMMANDS = new Set([
     "help", "list", "doctor", "info", "search", "man", "init", "quickstart",
     "plan", "status", "next", "dispatch", "result", "state", "commit", "report",
@@ -112,7 +115,7 @@ exports.KNOWN_COMMANDS = new Set([
     "run", "queue", "clones", "orphans", "history", "audit-run", "multi-agent",
     "topology", "summary", "blackboard", "coordinator", "metrics", "operator",
     "sched", "gc", "telemetry", "migration", "demo", "workbench", "approve",
-    "reject", "comment", "handoff", "graph", "eval", "version", "update", "fix",
+    "reject", "comment", "handoff", "graph", "eval", "version", "fix",
 ]);
 /** Levenshtein edit distance between two strings. */
 function levenshtein(a, b) {