cool-workflow 0.2.0 → 0.2.2

package/scripts/purity-baseline.json

@@ -0,0 +1,68 @@
+{
+  "builtinViolations": {
+    "core/state/run-paths.ts": [
+      "node:fs"
+    ],
+    "core/trust/telemetry-attestation.ts": [
+      "node:fs"
+    ]
+  },
+  "clockEnvCounts": {
+    "core/multi-agent/candidate-scoring.ts": {
+      "new Date()": 1
+    },
+    "core/pipeline/runner.ts": {
+      "new Date()": 1
+    },
+    "core/state/migrations.ts": {
+      "process.cwd()": 1
+    },
+    "core/state/state-explosion/digest.ts": {
+      "new Date()": 1
+    },
+    "core/state/state-explosion/graph.ts": {
+      "new Date()": 1
+    },
+    "core/state/state-explosion/report.ts": {
+      "new Date()": 1
+    },
+    "core/state/state-node.ts": {
+      "new Date()": 5
+    },
+    "core/trust/evidence-grounding.ts": {
+      "process.env": 3
+    }
+  },
+  "layerViolations": {
+    "core/capability-table.ts": [
+      "../wiring/capability-table"
+    ],
+    "wiring/capability-table/exec-backend.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/multi-agent.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/pipeline.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/registry-core.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/reporting.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/scheduling-registry.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/state.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/trust-ledger.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/workflow-apps.ts": [
+      "../../cli/io"
+    ]
+  }
+}

package/scripts/purity-gate.js

@@ -0,0 +1,239 @@
+#!/usr/bin/env node
+"use strict";
+
+// purity-gate — fail closed if src/ crosses a layer boundary the rebuild
+// docs claim is enforced, or if src/core/** reads an impure primitive
+// (node:fs/child_process/net/http, process.env, process.cwd(), Date.now(),
+// new Date(), Math.random()), beyond a committed, itemized baseline.
+//
+// Why this exists: docs/rebuild/PLAN.md and AGENTS.md both describe core/
+// as pure (no IO) and shell/ as the only impure layer, and say this is
+// "enforced by a lint rule". No such lint exists anywhere in scripts/ or
+// package.json — only `tsc --noEmit`, which does not check import
+// direction. The one place the rule is already broken is the hub itself:
+// core/capability-table.ts imports ~30 things from ../shell.
+//
+// This is a RATCHET, not a clean-slate rule (matching dist-drift-check.js's
+// and version-sync-check.js's style: node + git only, no new dependency).
+// scripts/purity-baseline.json lists every violation that exists TODAY.
+// The gate fails on:
+//   - a violation NOT in the baseline (a NEW break), and
+//   - a baseline entry that no longer matches reality (STALE — either the
+//     violation was fixed, in which case delete the entry, or the count
+//     changed, in which case update it consciously).
+// Fail-closed both directions, same as dist-drift-check.js's added/changed/
+// removed three-way diff.
+//
+// Layers (by top-level directory under src/):
+//   core/**   -> may only import core/** (+ node:path, node:crypto)
+//   shell/**  -> may import core/** or shell/**
+//   wiring/** -> may import core/**, shell/**, or wiring/** (not yet used;
+//               reserved for the capability-table split)
+//   cli/**    -> may import core/**, shell/**, or cli/** (never mcp/**)
+//   mcp/**    -> may import core/**, shell/**, or mcp/** (never cli/**)
+//
+// Approach: a plain-text specifier scan (import/export-from/require), not a
+// real TS parser — this codebase uses only those three forms, verified
+// against every current violation this baseline lists.
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const packageDir = path.resolve(__dirname, "..");
+const srcDir = path.join(packageDir, "src");
+const baselinePath = path.join(__dirname, "purity-baseline.json");
+
+const CORE_ALLOWED_BUILTINS = new Set(["node:path", "node:crypto"]);
+const IMPURE_PATTERNS = ["process.env", "process.cwd()", "Date.now()", "new Date()", "Math.random()"];
+
+const ALLOWED_TARGET_LAYERS = {
+  core: new Set(["core"]),
+  shell: new Set(["core", "shell"]),
+  wiring: new Set(["core", "shell", "wiring"]),
+  cli: new Set(["core", "shell", "cli"]),
+  mcp: new Set(["core", "shell", "mcp"]),
+  other: new Set(["core", "shell", "wiring", "cli", "mcp", "other"]),
+};
+
+function layerOf(relPath) {
+  if (relPath.startsWith("core/")) return "core";
+  if (relPath.startsWith("shell/")) return "shell";
+  if (relPath.startsWith("wiring/")) return "wiring";
+  if (relPath.startsWith("cli/") || relPath === "cli") return "cli";
+  if (relPath.startsWith("mcp/") || relPath === "mcp-server") return "mcp";
+  return "other";
+}
+
+function listTsFiles(dir) {
+  const out = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...listTsFiles(full));
+    else if (entry.name.endsWith(".ts")) out.push(full);
+  }
+  return out;
+}
+
+// This codebase's file-header comments routinely quote the EXACT patterns
+// this gate looks for, in prose explaining why a file is pure (e.g. "never
+// a top-level `require(\"node:fs\")`", "no fs, no process.env, no clock").
+// A naive text scan reads those quotes as violations. Strip `//` and
+// `/* */` comments before scanning (string/template literal contents are
+// left untouched, so a real `from "..."` clause is never damaged); newlines
+// are preserved so extractSpecifiers' `(?:^|\n)` anchor still lines up.
+function stripComments(text) {
+  let out = "";
+  let mode = "code"; // "code" | "line" | "block" | quote character
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    const c2 = text[i + 1];
+    if (mode === "line") {
+      if (c === "\n") { mode = "code"; out += c; }
+      continue;
+    }
+    if (mode === "block") {
+      if (c === "*" && c2 === "/") { mode = "code"; i++; continue; }
+      if (c === "\n") out += c;
+      continue;
+    }
+    if (mode === '"' || mode === "'" || mode === "`") {
+      out += c;
+      if (c === "\\") { out += c2 ?? ""; i++; continue; }
+      if (c === mode) mode = "code";
+      continue;
+    }
+    if (c === "/" && c2 === "/") { mode = "line"; i++; continue; }
+    if (c === "/" && c2 === "*") { mode = "block"; i++; continue; }
+    if (c === '"' || c === "'" || c === "`") { mode = c; out += c; continue; }
+    out += c;
+  }
+  return out;
+}
+
+// Every `from "spec"` (import or export-from, type or value — a type-only
+// import still names a module, so it counts the same way a real dependency
+// scan would) plus every `require("spec")`. Non-greedy across `from` finds
+// each import's own clause without needing a real parser.
+function extractSpecifiers(codeText) {
+  const specs = [];
+  const fromRe = /(?:^|\n)\s*(?:import|export)\s[\s\S]*?from\s+["']([^"']+)["']/g;
+  let m;
+  while ((m = fromRe.exec(codeText))) specs.push(m[1]);
+  const requireRe = /require\(\s*["']([^"']+)["']\s*\)/g;
+  while ((m = requireRe.exec(codeText))) specs.push(m[1]);
+  return specs;
+}
+
+function countOccurrences(text, needle) {
+  let count = 0;
+  let index = 0;
+  while ((index = text.indexOf(needle, index)) !== -1) {
+    count += 1;
+    index += needle.length;
+  }
+  return count;
+}
+
+function relSrcPath(absPath) {
+  return path.relative(srcDir, absPath).split(path.sep).join("/");
+}
+
+function scan() {
+  const layerViolations = {}; // relFile -> string[] (specs that cross a disallowed layer)
+  const builtinViolations = {}; // relFile -> string[] (banned node builtins imported from core)
+  const clockEnvCounts = {}; // relFile -> { pattern: count } (core only, count > 0)
+
+  for (const absFile of listTsFiles(srcDir)) {
+    const relFile = relSrcPath(absFile);
+    const fileLayer = layerOf(relFile.replace(/\.ts$/, ""));
+    const text = stripComments(fs.readFileSync(absFile, "utf8"));
+
+    for (const spec of extractSpecifiers(text)) {
+      if (spec.startsWith(".")) {
+        const targetAbs = path.resolve(path.dirname(absFile), spec);
+        const targetRel = relSrcPath(targetAbs);
+        const targetLayer = layerOf(targetRel);
+        if (!ALLOWED_TARGET_LAYERS[fileLayer].has(targetLayer)) {
+          (layerViolations[relFile] = layerViolations[relFile] || []).push(spec);
+        }
+      } else if (spec.startsWith("node:")) {
+        if (fileLayer === "core" && !CORE_ALLOWED_BUILTINS.has(spec)) {
+          (builtinViolations[relFile] = builtinViolations[relFile] || []).push(spec);
+        }
+      }
+      // Bare package specifiers (no "." or "node:" prefix): this package
+      // has zero runtime dependencies, so there are none to check.
+    }
+
+    if (fileLayer === "core") {
+      const counts = {};
+      for (const pattern of IMPURE_PATTERNS) {
+        const n = countOccurrences(text, pattern);
+        if (n > 0) counts[pattern] = n;
+      }
+      if (Object.keys(counts).length > 0) clockEnvCounts[relFile] = counts;
+    }
+  }
+
+  for (const bucket of [layerViolations, builtinViolations]) {
+    for (const file of Object.keys(bucket)) bucket[file] = [...new Set(bucket[file])].sort();
+  }
+  return { layerViolations, builtinViolations, clockEnvCounts };
+}
+
+function sortedKeys(obj) {
+  return Object.keys(obj).sort();
+}
+
+function diffListBuckets(actual, baseline, label, problems) {
+  const files = new Set([...sortedKeys(actual), ...sortedKeys(baseline)]);
+  for (const file of [...files].sort()) {
+    const actualList = actual[file] || [];
+    const baseList = baseline[file] || [];
+    const actualSet = new Set(actualList);
+    const baseSet = new Set(baseList);
+    const added = actualList.filter((s) => !baseSet.has(s));
+    const removed = baseList.filter((s) => !actualSet.has(s));
+    for (const spec of added) problems.push(`NEW ${label}: ${file} imports ${spec} (not in purity-baseline.json)`);
+    for (const spec of removed) problems.push(`STALE ${label} baseline entry: ${file} no longer imports ${spec} — delete it from purity-baseline.json`);
+  }
+}
+
+function diffCountBuckets(actual, baseline, problems) {
+  const files = new Set([...sortedKeys(actual), ...sortedKeys(baseline)]);
+  for (const file of [...files].sort()) {
+    const actualCounts = actual[file] || {};
+    const baseCounts = baseline[file] || {};
+    const patterns = new Set([...Object.keys(actualCounts), ...Object.keys(baseCounts)]);
+    for (const pattern of [...patterns].sort()) {
+      const a = actualCounts[pattern] || 0;
+      const b = baseCounts[pattern] || 0;
+      if (a !== b) {
+        problems.push(`clock/env count drift: ${file} has ${a} occurrence(s) of "${pattern}", purity-baseline.json expects ${b} — update the baseline consciously (this catches new AND removed occurrences)`);
+      }
+    }
+  }
+}
+
+function main() {
+  if (!fs.existsSync(baselinePath)) {
+    process.stderr.write(`purity gate: missing ${path.relative(packageDir, baselinePath)}\n`);
+    process.exit(1);
+  }
+  const baseline = JSON.parse(fs.readFileSync(baselinePath, "utf8"));
+  const actual = scan();
+
+  const problems = [];
+  diffListBuckets(actual.layerViolations, baseline.layerViolations || {}, "layer violation", problems);
+  diffListBuckets(actual.builtinViolations, baseline.builtinViolations || {}, "core builtin violation", problems);
+  diffCountBuckets(actual.clockEnvCounts, baseline.clockEnvCounts || {}, problems);
+
+  if (problems.length > 0) {
+    process.stderr.write(`purity gate: ${problems.length} problem(s)\n`);
+    for (const p of problems) process.stderr.write(`  ${p}\n`);
+    process.exit(1);
+  }
+  process.stdout.write("purity gate: src/ matches the committed baseline (no new core/shell layer breaks, no clock/env drift).\n");
+}
+
+main();

package/scripts/release-check.js

@@ -39,6 +39,7 @@ const checks = [
         "docs/run-retention-reclamation.7.md",
         "docs/durable-state-and-locking.7.md",
         "docs/security-trust-hardening.7.md",
+        "docs/trust-audit-anchor.7.md",
         "../../CHANGELOG.md",
         "../../RELEASE.md"
       ]) {
@@ -58,6 +59,7 @@ const checks = [
   // `dist:check` builds from src/ AND fails closed if the committed dist/ drifted
   // from that fresh build — strictly stronger than a bare `npm run build`.
   { name: "dist freshness", command: ["npm", "run", "dist:check"] },
+  { name: "core/shell purity", command: ["npm", "run", "purity:check"] },
   { name: "type check", command: ["npm", "run", "check"] },
   { name: "onramp contract", command: ["npm", "run", "onramp:check"] },
   { name: "run-state schema consistency", command: ["node", "scripts/validate-run-state-schema.js"] },
@@ -66,6 +68,11 @@ const checks = [
   // (release-gate.sh) forces CW_TEST_CONCURRENCY=1 to stay sequential as the
   // deterministic backstop.
   { name: "tests", command: ["npm", "run", "test:ci"] },
+  // Pure core/ unit tests (test/*.test.js) — a separate suite from the smoke
+  // tests above (see test/run-unit.js's header). --skip-tests also skips
+  // this one, matching "tests": ci.yml runs test:unit directly, so this
+  // entry would just repeat it a second time in the release-check pass.
+  { name: "unit tests", command: ["npm", "run", "test:unit"] },
   { name: "canonical apps", command: ["npm", "run", "canonical-apps"] },
   { name: "golden path", command: ["npm", "run", "golden-path"] },
   { name: "CLI MCP parity", command: ["npm", "run", "parity:check"] },
@@ -88,7 +95,7 @@ function main() {
     process.stdout.write(`release:check ${check.name} ... `);
     const started = Date.now();
     try {
-      if (skipTests && check.name === "tests") {
+      if (skipTests && (check.name === "tests" || check.name === "unit tests")) {
         results.push({ name: check.name, ok: true, skipped: true, elapsedMs: 0 });
         process.stdout.write("skipped\n");
         continue;

package/scripts/version-sync-check.js

@@ -20,7 +20,7 @@ const repoRoot = path.resolve(pluginRoot, "..", "..");
 // CI checks out HEAD, so HEAD === the tree it is releasing.
 //
 // Fallback to the filesystem only when we cannot read from HEAD: not a git work
-// tree, or the path is not tracked at HEAD (e.g. the gitignored package-lock).
+// tree, or the path is not tracked at HEAD.
 // node + git only — no ripgrep (CI portability rule).
 const insideGitWorkTree = (() => {
   const r = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], { cwd: repoRoot, encoding: "utf8" });
@@ -36,7 +36,7 @@ function readReleaseSource(relativePath) {
       maxBuffer: 1024 * 1024 * 32
     });
     if (r.status === 0) return { text: r.stdout, exists: true, fromHead: true };
-    // Not tracked at HEAD — fall through to the working tree (e.g. package-lock).
+    // Not tracked at HEAD — fall through to the working tree.
   }
   const abs = path.join(repoRoot, relativePath);
   if (!fs.existsSync(abs)) return { text: null, exists: false, fromHead: false };
@@ -56,9 +56,14 @@ const canonicalApps = CANONICAL_APP_IDS;
 function main() {
   const checks = [];
   checkJson("plugins/cool-workflow/package.json", "version", VERSION, checks);
-  // package-lock.json is a gitignored install artifact (the documented install
-  // uses `npm install --no-package-lock`), so only validate it when present.
+  // package-lock.json is tracked now, but the documented install still works
+  // without it (`npm install --no-package-lock`), so only validate it when
+  // present. Check BOTH version fields: the top-level one and the root-package
+  // entry packages[""].version — the second one is the field npm keeps in step
+  // with package.json on `npm install`, and it is the one that went stale
+  // (0.1.97) through the v0.2.0/v0.2.1 cuts while only the first was checked.
   checkJsonIfPresent("plugins/cool-workflow/package-lock.json", "version", VERSION, checks);
+  checkNestedJsonIfPresent("plugins/cool-workflow/package-lock.json", ["packages", "", "version"], VERSION, checks);
   checkJson("plugins/cool-workflow/.codex-plugin/plugin.json", "version", VERSION, checks);
   checkJson("plugins/cool-workflow/server.json", "version", VERSION, checks);
   checkNestedJson("plugins/cool-workflow/server.json", ["packages", 0, "version"], VERSION, checks);
@@ -160,7 +165,7 @@ function main() {
   checkIncludes("plugins/cool-workflow/docs/run-retention-reclamation.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "run-retention-reclamation.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/run-retention-reclamation-smoke.js", "run-retention-reclamation-smoke", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "gc.plan", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/scheduling-registry.ts", "gc.plan", checks);
   checkIncludes("plugins/cool-workflow/docs/durable-state-and-locking.7.md", "Durable State & Locking", checks);
   checkIncludes("plugins/cool-workflow/docs/durable-state-and-locking.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "durable-state-and-locking.7.md", checks);
@@ -168,33 +173,37 @@ function main() {
   checkIncludes("plugins/cool-workflow/src/shell/fs-atomic.ts", "withFileLock", checks);
   checkIncludes("plugins/cool-workflow/src/shell/drive.ts", "driveStep", checks);
   checkIncludes("plugins/cool-workflow/dist/shell/drive.js", "driveStep", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "run.drive", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/pipeline.ts", "run.drive", checks);
   checkIncludes("plugins/cool-workflow/src/shell/collaboration-io.ts", "deriveReviewState", checks);
   checkIncludes("plugins/cool-workflow/dist/shell/collaboration-io.js", "deriveReviewState", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "review.status", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/multi-agent.ts", "review.status", checks);
   checkIncludes("plugins/cool-workflow/src/shell/observability.ts", "deriveMetricsReport", checks);
   checkIncludes("plugins/cool-workflow/dist/shell/observability.js", "deriveMetricsReport", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "metrics.show", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/reporting.ts", "metrics.show", checks);
   checkIncludes("plugins/cool-workflow/manifest/pricing.policy.json", "schemaVersion", checks);
   checkIncludes("plugins/cool-workflow/src/shell/workbench.ts", "buildWorkbenchRunView", checks);
   checkIncludes("plugins/cool-workflow/dist/shell/workbench.js", "buildWorkbenchRunView", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "workbench.view", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/reporting.ts", "workbench.view", checks);
   checkIncludes("plugins/cool-workflow/src/shell/execution-backend/registry.ts", "ExecutionBackend", checks);
   checkIncludes("plugins/cool-workflow/dist/shell/execution-backend/registry.js", "ExecutionBackend", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "backend.list", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/exec-backend.ts", "backend.list", checks);
   checkIncludes("plugins/cool-workflow/src/shell/run-registry-io.ts", "RunRegistry", checks);
   checkIncludes("plugins/cool-workflow/dist/shell/run-registry-io.js", "RunRegistry", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "registry.refresh", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/scheduling-registry.ts", "registry.refresh", checks);
   checkIncludes("plugins/cool-workflow/package.json", "parity:check", checks);
   checkIncludes("plugins/cool-workflow/scripts/parity-check.js", "buildParityReport", checks);
   checkIncludes("plugins/cool-workflow/test/cli-mcp-parity-smoke.js", "cli-mcp-parity-smoke", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "export const REGISTRY", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/registry-core.ts", "export const REGISTRY", checks);
   checkIncludes("plugins/cool-workflow/src/shell/pipeline-cli.ts", "planSummary", checks);
   checkIncludes("plugins/cool-workflow/dist/core/capability-table.js", "REGISTRY", checks);
   checkIncludes("plugins/cool-workflow/docs/multi-agent-runtime-core.7.md", "Multi-Agent Runtime Core", checks);
   checkIncludes("plugins/cool-workflow/docs/dogfood-one-real-repo.7.md", "Dogfood One Real Repo", checks);
   checkIncludes("plugins/cool-workflow/docs/getting-started.md", "npm run release:check", checks);
   checkIncludes("plugins/cool-workflow/package.json", "eval:replay", checks);
+  checkIncludes("plugins/cool-workflow/docs/trust-audit-anchor.7.md", "Trust Audit Anchor", checks);
+  checkIncludes("plugins/cool-workflow/docs/trust-audit-anchor.7.md", VERSION, checks);
+  checkIncludes("plugins/cool-workflow/docs/index.md", "trust-audit-anchor.7.md", checks);
+  checkIncludes("plugins/cool-workflow/test/trust-audit-anchor-smoke.js", "trust-audit-anchor-smoke", checks);
   checkIncludes("plugins/cool-workflow/docs/release-and-migration.7.md", VERSION, checks);
   checkIncludes("CHANGELOG.md", `## ${VERSION}`, checks);
   checkIncludes("RELEASE.md", VERSION, checks);
@@ -227,6 +236,18 @@ function checkNestedJson(relativePath, keyPath, expected, checks) {
   checks.push({ path: relativePath, key: keyPath.join("."), value });
 }
 
+function checkNestedJsonIfPresent(relativePath, keyPath, expected, checks) {
+  const src = readReleaseSource(relativePath);
+  if (!src.exists) {
+    checks.push({ path: relativePath, key: keyPath.join("."), skipped: "absent" });
+    return;
+  }
+  let value = JSON.parse(src.text);
+  for (const key of keyPath) value = value?.[key];
+  assert.equal(value, expected, `${relativePath}.${keyPath.join(".")} must be ${expected}`);
+  checks.push({ path: relativePath, key: keyPath.join("."), value });
+}
+
 function checkJsonIfPresent(relativePath, key, expected, checks) {
   const src = readReleaseSource(relativePath);
   if (!src.exists) {

package/workflows/README.md

@@ -0,0 +1,19 @@
+# workflows/ — legacy compatibility surface (pinned, do not remove)
+
+`architecture-review.workflow.js` and `research-synthesis.workflow.js` are
+the old, pre-`apps/` workflow-file format. The real, current homes for
+these two workflows are `apps/architecture-review/` and
+`apps/research-synthesis/` — these files exist ONLY so an id from before
+the `apps/` format still resolves.
+
+This is deliberate duplication, not drift to clean up: each file here
+registers its OWN distinct id (`legacy-architecture-review`,
+`legacy-research-synthesis`), pinned by
+`v2/conformance/cases/multiagent-app-list.case.js` and
+`plugins/cool-workflow/test/workflow-app-framework-smoke.js`. `cw list` /
+`cw app list` show both the real app and its legacy id side by side
+(`src/shell/workflow-app-loader.ts` discovers both roots).
+
+Per this project's own POLA rule, removing or thinning either file would
+change `cw list`'s output bytes — that is a breaking change, only doable
+behind a major-version break, not a routine cleanup.