cool-workflow 0.2.1 → 0.2.2

package/docs/run-retention-reclamation.7.md

@@ -265,3 +265,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.2.0
 
 0.2.1
+
+0.2.2

package/docs/security-trust-hardening.7.md

@@ -51,6 +51,34 @@ The agent host must still make certain of OS-level read isolation, write isolati
 limits on process execution, limits on network, and environment filtering.
 The audit layer lets you look at that boundary; it is not a kernel.
 
+## Requiring Attested Telemetry
+
+`CW_REQUIRE_ATTESTED_TELEMETRY=1` (or `--require-attested-telemetry`, or a
+durable `agent-config.json` field) is an opt-in, off-by-default gate: once
+on, CW refuses to accept ANY worker result whose usage telemetry is not
+cryptographically `attested` — a delegated hop whose signature does not
+verify, and now also a MANUAL accept (`cw worker output`, `cw result`) that
+carries no delegation telemetry at all. The manual shape used to slip past
+the gate silently; it is now blocked the same way, with its own code
+(`telemetry-missing-blocked`, distinct from a present-but-unverified hop's
+`telemetry-unattested-blocked`).
+
+An operator who genuinely needs to accept an unattested manual result under
+the require flag passes `--allow-unattested` (MCP: `allowUnattested`). This
+is never silent: it writes a `telemetry.gate-override` trust-audit event
+(`decision: "allowed"`, `source: "operator"`) into the same hash-chained log
+every other audit decision goes through, so the override itself is part of
+the auditable record, not a hole in it.
+
+A result-cache hit (the drive loop replaying a previously accepted result) is
+never re-blocked by this gate — the underlying result was already gated (or
+overridden) at its first acceptance. When the require flag is on, a cache
+accept still records a `telemetry.cache-accept` event, so the audit trail
+shows which accepts came from a fresh hop and which from the cache.
+
+With the require flag off (the default), none of this changes: a plain
+`cw worker output` / `cw result` behaves exactly as before.
+
 ## CLI
 
 ```bash
@@ -67,6 +95,8 @@ node scripts/cw.js audit decision <run-id> <worker-id> --path <path>
 node scripts/cw.js audit decision <run-id> <worker-id> --command "npm test"
 node scripts/cw.js audit decision <run-id> <worker-id> --network example.com
 node scripts/cw.js audit decision <run-id> <worker-id> --env SECRET_NAME
+node scripts/cw.js worker output <run-id> <worker-id> <result-file> [--allow-unattested]
+node scripts/cw.js result <run-id> <task-id> <result-file> [--allow-unattested]
 ```
 
 Denied audit decisions are put into audit files and joined to feedback/error

package/docs/state-explosion-management.7.md

@@ -322,3 +322,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.2.0
 
 0.2.1
+
+0.2.2

package/docs/team-collaboration.7.md

@@ -258,3 +258,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.2.0
 
 0.2.1
+
+0.2.2

package/docs/trust-audit-anchor.7.md

@@ -0,0 +1,69 @@
+# Trust Audit Anchor
+
+CW v0.2.1 adds the Trust Audit Anchor: a way to see when the END of a run's
+trust-audit log was cut off. The hash chain in `audit/events.jsonl` lets
+`cw audit verify` see an edited event, a removed middle event, a bad line, and
+a mixed-era forgery. But one tamper shape gets past a pure chain walk: take
+the last N lines off the file, and what is left is a shorter but fully
+consistent chain — verify stays green. The anchor closes that hole, and it
+does so without changing any old output byte.
+
+## Design Discipline
+
+- Mechanism, not policy: the kernel gives you two small parts — a read of the
+  chain head, and a check against a head you saved earlier. WHEN you save a
+  head (after a run, before you publish, at export time) is your policy.
+- Fail-closed: a saved head that is not on the chain, or an event count that
+  comes up short, makes verify exit non-zero with the distinct check code
+  `trust-audit-truncated`. A bad `--expect-head` / `--expect-count` value is
+  an error, never a check silently made weaker.
+- POLA: with no anchor flags, `cw audit verify` output is byte-for-byte what
+  it was before this feature (no `anchor` key, same checks, same exit rules).
+- Reuse: the anchor rides on the existing eventHash chain — no new file, no
+  new state, no new hash form. `cw audit head` is a read-only projection.
+- Parity: `audit.head` is on both front doors (`cw audit head` and the MCP
+  tool `cw_audit_head`); the anchor args are on both `cw audit verify` and
+  `cw_audit_verify` (`expectHead` / `expectCount`).
+
+## CLI
+
+```text
+node dist/cli.js audit head <run-id>
+# -> { "schemaVersion": 1, "runId": "...", "eventCount": 87,
+#      "headHash": "sha256:..." }
+
+node dist/cli.js audit verify <run-id> --expect-head <hash> --expect-count <n>
+# green: verified true, "anchor": { ..., "satisfied": true }, exit 0
+# cut tail: verified false, checks carry trust-audit-truncated, exit 1
+```
+
+The head is the hash the NEXT appended event will link from: the last event's
+`eventHash`, or the run's genesis hash when the log is empty. Save the pair
+`{headHash, eventCount}` somewhere the log's writer cannot reach — a CI
+variable, a note in your PR, the output of `cw run export` (the export
+manifest hashes the event log bytes, so an export IS an anchor in file form).
+
+## How the check works
+
+`verifyTrustAudit` walks the chain as before, and keeps the trail of head
+hashes it saw (genesis, then the hash after each event). With an anchor:
+
+- `expectCount`: the walked log must have at least that many events. Fewer =
+  `trust-audit-truncated` (check name `anchor-count`).
+- `expectHead`: the saved head must be ON the trail. A log that was cut and
+  then padded back with new events reaches the old count, but the new events
+  link from an earlier point — the old head is no longer on the trail, so
+  this still fails (check name `anchor-head`).
+
+## Compatibility
+
+Trust Audit Anchor is introduced in CW v0.2.1. Fields are additive and
+optional; older run state loads unchanged. A plain `cw audit verify` keeps
+its exact old output. The `anchor` key appears in the JSON only when the
+caller passed an anchor flag.
+
+## See Also
+
+security-trust-hardening(7), cli-mcp-parity(7), report-verifiable-bundle(7)
+
+0.2.2

package/docs/web-desktop-workbench.7.md

@@ -276,3 +276,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.2.0
 
 0.2.1
+
+0.2.2

package/manifest/plugin.manifest.json

@@ -2,7 +2,7 @@
   "_comment": "SINGLE SOURCE OF TRUTH for every vendor manifest. Edit THIS file, then run `npm run gen:manifests`. Do NOT hand-edit the generated vendor manifests (.claude-plugin/, .codex-plugin/, .agents/, .mcp.json) — `npm run gen:manifests -- --check` (run by release:check) will fail if they drift from this source.",
   "identity": {
     "name": "cool-workflow",
-    "version": "0.2.1",
+    "version": "0.2.2",
     "license": "BSD-2-Clause",
     "homepage": "https://github.com/coo1white/cool-workflow",
     "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "bin": {
     "cool-workflow": "scripts/cw.js",
     "cw": "scripts/cw.js"
@@ -43,6 +43,7 @@
     "build": "tsc -p tsconfig.json",
     "check": "tsc -p tsconfig.json --noEmit",
     "dist:check": "node scripts/dist-drift-check.js",
+    "purity:check": "node scripts/purity-gate.js",
     "golden-path": "node scripts/golden-path.js",
     "dogfood:release": "node scripts/dogfood-release.js",
     "canonical-apps": "node scripts/canonical-apps.js",
@@ -68,6 +69,7 @@
     "test:fast": "npm run build --if-present && node dist/cli.js version > /dev/null && node test/run-all.js --concurrency auto",
     "test:ci": "npm run build && node dist/cli.js version > /dev/null && node test/run-all.js --sample 55",
     "test:coverage": "node dist/cli.js version > /dev/null && node scripts/coverage-gate.js --concurrency auto",
+    "test:unit": "node dist/cli.js version > /dev/null && node test/run-unit.js",
     "eval:replay": "tsc -p tsconfig.json && node test/multi-agent-eval-replay-harness-smoke.js",
     "ci": "npm run build && npm run check && npm run test && npm run release:check",
     "validate:schema": "node scripts/validate-run-state-schema.js"

package/scripts/bump-version.js

@@ -46,6 +46,23 @@ function replaceFirstVersionField(absPath, next) {
   return true;
 }
 
+function replaceLockfileVersions(absPath, next) {
+  // Move BOTH lockfile version fields with targeted string swaps, so the byte
+  // formatting npm wrote is kept as it is: the top-level "version" (the first
+  // one in the file) and the root-package entry `"": { "name": ..., "version": ... }`.
+  // Dependency entries are not touched — the second swap is keyed on the
+  // `"": {` root-package opening, which is present only once.
+  const text = fs.readFileSync(absPath, "utf8");
+  let updated = text.replace(/"version":\s*"[^"]*"/, `"version": "${next}"`);
+  updated = updated.replace(
+    /("":\s*\{\s*"name":\s*"[^"]*",\s*"version":\s*)"[^"]*"/,
+    `$1"${next}"`
+  );
+  if (updated === text) return false;
+  fs.writeFileSync(absPath, updated);
+  return true;
+}
+
 function setNestedVersion(absPath, next) {
   // For files where the first `"version"` is NOT the right one, parse + set.
   const json = JSON.parse(fs.readFileSync(absPath, "utf8"));
@@ -75,9 +92,13 @@ function main() {
   // 1. package.json (the single source of truth version:sync now reads from)
   if (replaceFirstVersionField(path.join(pluginRoot, "package.json"), next)) note("package.json");
 
-  // 2. package-lock.json (gitignored install artifact; only if present)
+  // 2. package-lock.json (tracked; only if present). The lockfile keeps the
+  //    version in TWO places: the top-level "version" and the root-package
+  //    entry packages[""].version. The old code moved only the first one, so
+  //    the root-package entry kept an old version till the next `npm install`
+  //    (the v0.1.97 drift seen after the v0.2.0/v0.2.1 cuts). Move both here.
   const lock = path.join(pluginRoot, "package-lock.json");
-  if (fs.existsSync(lock) && replaceFirstVersionField(lock, next)) note("package-lock.json");
+  if (fs.existsSync(lock) && replaceLockfileVersions(lock, next)) note("package-lock.json");
 
   // 2b. Official MCP Registry server metadata (top-level server version + npm package version).
   const serverJson = path.join(pluginRoot, "server.json");
@@ -218,6 +239,7 @@ function contentSurfaceFiles(next) {
     { path: "plugins/cool-workflow/docs/run-retention-reclamation.7.md",     needle: next, desc: "run retention doc" },
     { path: "plugins/cool-workflow/docs/durable-state-and-locking.7.md",     needle: next, desc: "durable state doc" },
     { path: "plugins/cool-workflow/docs/release-and-migration.7.md",         needle: next, desc: "release & migration doc" },
+    { path: "plugins/cool-workflow/docs/trust-audit-anchor.7.md",           needle: next, desc: "trust audit anchor doc" },
   ];
 }
 

package/scripts/canonical-apps.js

@@ -83,7 +83,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.2.1",
+      "Cool Workflow v0.2.2",
       "--freshness",
       "as of release preparation"
     ]
@@ -117,14 +117,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.2.1");
+    assert.equal(summary.version, "0.2.2");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.2.1");
+    assert.equal(shown.app.version, "0.2.2");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -135,7 +135,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.2.1");
+    assert.equal(state.workflow.app.version, "0.2.2");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/dogfood-release.js

@@ -6,7 +6,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { CoolWorkflowRunner } = require("../dist/shell/orchestrator.js");
 
-const TARGET_VERSION = "0.2.1";
+const TARGET_VERSION = "0.2.2";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");

package/scripts/golden-path.js

@@ -33,7 +33,7 @@ function main() {
     const appValidation = runJson(["app", "validate", "end-to-end-golden-path"], pluginRoot);
     assert.equal(appValidation.valid, true);
     assert.equal(appValidation.summary.id, "end-to-end-golden-path");
-    assert.equal(appValidation.summary.version, "0.2.1");
+    assert.equal(appValidation.summary.version, "0.2.2");
 
     const plan = runJson(
       [
@@ -42,7 +42,7 @@ function main() {
         "--repo",
         tmp,
         "--question",
-        "Prove the deterministic v0.2.1 end-to-end golden path."
+        "Prove the deterministic v0.2.2 end-to-end golden path."
       ],
       pluginRoot
     );
@@ -52,7 +52,7 @@ function main() {
 
     let state = readJson(plan.statePath);
     assert.equal(state.workflow.app.id, "end-to-end-golden-path");
-    assert.equal(state.workflow.app.version, "0.2.1");
+    assert.equal(state.workflow.app.version, "0.2.2");
     assert.equal(state.loopStage, "interpret");
 
     const dispatch = runJson(["dispatch", plan.runId, "--limit", "1", "--sandbox", "readonly"], tmp);
@@ -195,7 +195,7 @@ function main() {
     assert.equal(reportPath, plan.reportPath);
     assert.ok(fs.existsSync(reportPath));
     const report = fs.readFileSync(reportPath, "utf8");
-    assert.match(report, /Workflow App: end-to-end-golden-path@0\.2\.1/);
+    assert.match(report, /Workflow App: end-to-end-golden-path@0\.2\.2/);
     assert.match(report, /## Candidates/);
     assert.match(report, /## Trust Audit/);
     assert.match(report, /## Acceptance Rationale/);

package/scripts/purity-baseline.json

@@ -0,0 +1,68 @@
+{
+  "builtinViolations": {
+    "core/state/run-paths.ts": [
+      "node:fs"
+    ],
+    "core/trust/telemetry-attestation.ts": [
+      "node:fs"
+    ]
+  },
+  "clockEnvCounts": {
+    "core/multi-agent/candidate-scoring.ts": {
+      "new Date()": 1
+    },
+    "core/pipeline/runner.ts": {
+      "new Date()": 1
+    },
+    "core/state/migrations.ts": {
+      "process.cwd()": 1
+    },
+    "core/state/state-explosion/digest.ts": {
+      "new Date()": 1
+    },
+    "core/state/state-explosion/graph.ts": {
+      "new Date()": 1
+    },
+    "core/state/state-explosion/report.ts": {
+      "new Date()": 1
+    },
+    "core/state/state-node.ts": {
+      "new Date()": 5
+    },
+    "core/trust/evidence-grounding.ts": {
+      "process.env": 3
+    }
+  },
+  "layerViolations": {
+    "core/capability-table.ts": [
+      "../wiring/capability-table"
+    ],
+    "wiring/capability-table/exec-backend.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/multi-agent.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/pipeline.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/registry-core.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/reporting.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/scheduling-registry.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/state.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/trust-ledger.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/workflow-apps.ts": [
+      "../../cli/io"
+    ]
+  }
+}

package/scripts/purity-gate.js

@@ -0,0 +1,239 @@
+#!/usr/bin/env node
+"use strict";
+
+// purity-gate — fail closed if src/ crosses a layer boundary the rebuild
+// docs claim is enforced, or if src/core/** reads an impure primitive
+// (node:fs/child_process/net/http, process.env, process.cwd(), Date.now(),
+// new Date(), Math.random()), beyond a committed, itemized baseline.
+//
+// Why this exists: docs/rebuild/PLAN.md and AGENTS.md both describe core/
+// as pure (no IO) and shell/ as the only impure layer, and say this is
+// "enforced by a lint rule". No such lint exists anywhere in scripts/ or
+// package.json — only `tsc --noEmit`, which does not check import
+// direction. The one place the rule is already broken is the hub itself:
+// core/capability-table.ts imports ~30 things from ../shell.
+//
+// This is a RATCHET, not a clean-slate rule (matching dist-drift-check.js's
+// and version-sync-check.js's style: node + git only, no new dependency).
+// scripts/purity-baseline.json lists every violation that exists TODAY.
+// The gate fails on:
+//   - a violation NOT in the baseline (a NEW break), and
+//   - a baseline entry that no longer matches reality (STALE — either the
+//     violation was fixed, in which case delete the entry, or the count
+//     changed, in which case update it consciously).
+// Fail-closed both directions, same as dist-drift-check.js's added/changed/
+// removed three-way diff.
+//
+// Layers (by top-level directory under src/):
+//   core/**   -> may only import core/** (+ node:path, node:crypto)
+//   shell/**  -> may import core/** or shell/**
+//   wiring/** -> may import core/**, shell/**, or wiring/** (not yet used;
+//               reserved for the capability-table split)
+//   cli/**    -> may import core/**, shell/**, or cli/** (never mcp/**)
+//   mcp/**    -> may import core/**, shell/**, or mcp/** (never cli/**)
+//
+// Approach: a plain-text specifier scan (import/export-from/require), not a
+// real TS parser — this codebase uses only those three forms, verified
+// against every current violation this baseline lists.
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const packageDir = path.resolve(__dirname, "..");
+const srcDir = path.join(packageDir, "src");
+const baselinePath = path.join(__dirname, "purity-baseline.json");
+
+const CORE_ALLOWED_BUILTINS = new Set(["node:path", "node:crypto"]);
+const IMPURE_PATTERNS = ["process.env", "process.cwd()", "Date.now()", "new Date()", "Math.random()"];
+
+const ALLOWED_TARGET_LAYERS = {
+  core: new Set(["core"]),
+  shell: new Set(["core", "shell"]),
+  wiring: new Set(["core", "shell", "wiring"]),
+  cli: new Set(["core", "shell", "cli"]),
+  mcp: new Set(["core", "shell", "mcp"]),
+  other: new Set(["core", "shell", "wiring", "cli", "mcp", "other"]),
+};
+
+function layerOf(relPath) {
+  if (relPath.startsWith("core/")) return "core";
+  if (relPath.startsWith("shell/")) return "shell";
+  if (relPath.startsWith("wiring/")) return "wiring";
+  if (relPath.startsWith("cli/") || relPath === "cli") return "cli";
+  if (relPath.startsWith("mcp/") || relPath === "mcp-server") return "mcp";
+  return "other";
+}
+
+function listTsFiles(dir) {
+  const out = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...listTsFiles(full));
+    else if (entry.name.endsWith(".ts")) out.push(full);
+  }
+  return out;
+}
+
+// This codebase's file-header comments routinely quote the EXACT patterns
+// this gate looks for, in prose explaining why a file is pure (e.g. "never
+// a top-level `require(\"node:fs\")`", "no fs, no process.env, no clock").
+// A naive text scan reads those quotes as violations. Strip `//` and
+// `/* */` comments before scanning (string/template literal contents are
+// left untouched, so a real `from "..."` clause is never damaged); newlines
+// are preserved so extractSpecifiers' `(?:^|\n)` anchor still lines up.
+function stripComments(text) {
+  let out = "";
+  let mode = "code"; // "code" | "line" | "block" | quote character
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    const c2 = text[i + 1];
+    if (mode === "line") {
+      if (c === "\n") { mode = "code"; out += c; }
+      continue;
+    }
+    if (mode === "block") {
+      if (c === "*" && c2 === "/") { mode = "code"; i++; continue; }
+      if (c === "\n") out += c;
+      continue;
+    }
+    if (mode === '"' || mode === "'" || mode === "`") {
+      out += c;
+      if (c === "\\") { out += c2 ?? ""; i++; continue; }
+      if (c === mode) mode = "code";
+      continue;
+    }
+    if (c === "/" && c2 === "/") { mode = "line"; i++; continue; }
+    if (c === "/" && c2 === "*") { mode = "block"; i++; continue; }
+    if (c === '"' || c === "'" || c === "`") { mode = c; out += c; continue; }
+    out += c;
+  }
+  return out;
+}
+
+// Every `from "spec"` (import or export-from, type or value — a type-only
+// import still names a module, so it counts the same way a real dependency
+// scan would) plus every `require("spec")`. Non-greedy across `from` finds
+// each import's own clause without needing a real parser.
+function extractSpecifiers(codeText) {
+  const specs = [];
+  const fromRe = /(?:^|\n)\s*(?:import|export)\s[\s\S]*?from\s+["']([^"']+)["']/g;
+  let m;
+  while ((m = fromRe.exec(codeText))) specs.push(m[1]);
+  const requireRe = /require\(\s*["']([^"']+)["']\s*\)/g;
+  while ((m = requireRe.exec(codeText))) specs.push(m[1]);
+  return specs;
+}
+
+function countOccurrences(text, needle) {
+  let count = 0;
+  let index = 0;
+  while ((index = text.indexOf(needle, index)) !== -1) {
+    count += 1;
+    index += needle.length;
+  }
+  return count;
+}
+
+function relSrcPath(absPath) {
+  return path.relative(srcDir, absPath).split(path.sep).join("/");
+}
+
+function scan() {
+  const layerViolations = {}; // relFile -> string[] (specs that cross a disallowed layer)
+  const builtinViolations = {}; // relFile -> string[] (banned node builtins imported from core)
+  const clockEnvCounts = {}; // relFile -> { pattern: count } (core only, count > 0)
+
+  for (const absFile of listTsFiles(srcDir)) {
+    const relFile = relSrcPath(absFile);
+    const fileLayer = layerOf(relFile.replace(/\.ts$/, ""));
+    const text = stripComments(fs.readFileSync(absFile, "utf8"));
+
+    for (const spec of extractSpecifiers(text)) {
+      if (spec.startsWith(".")) {
+        const targetAbs = path.resolve(path.dirname(absFile), spec);
+        const targetRel = relSrcPath(targetAbs);
+        const targetLayer = layerOf(targetRel);
+        if (!ALLOWED_TARGET_LAYERS[fileLayer].has(targetLayer)) {
+          (layerViolations[relFile] = layerViolations[relFile] || []).push(spec);
+        }
+      } else if (spec.startsWith("node:")) {
+        if (fileLayer === "core" && !CORE_ALLOWED_BUILTINS.has(spec)) {
+          (builtinViolations[relFile] = builtinViolations[relFile] || []).push(spec);
+        }
+      }
+      // Bare package specifiers (no "." or "node:" prefix): this package
+      // has zero runtime dependencies, so there are none to check.
+    }
+
+    if (fileLayer === "core") {
+      const counts = {};
+      for (const pattern of IMPURE_PATTERNS) {
+        const n = countOccurrences(text, pattern);
+        if (n > 0) counts[pattern] = n;
+      }
+      if (Object.keys(counts).length > 0) clockEnvCounts[relFile] = counts;
+    }
+  }
+
+  for (const bucket of [layerViolations, builtinViolations]) {
+    for (const file of Object.keys(bucket)) bucket[file] = [...new Set(bucket[file])].sort();
+  }
+  return { layerViolations, builtinViolations, clockEnvCounts };
+}
+
+function sortedKeys(obj) {
+  return Object.keys(obj).sort();
+}
+
+function diffListBuckets(actual, baseline, label, problems) {
+  const files = new Set([...sortedKeys(actual), ...sortedKeys(baseline)]);
+  for (const file of [...files].sort()) {
+    const actualList = actual[file] || [];
+    const baseList = baseline[file] || [];
+    const actualSet = new Set(actualList);
+    const baseSet = new Set(baseList);
+    const added = actualList.filter((s) => !baseSet.has(s));
+    const removed = baseList.filter((s) => !actualSet.has(s));
+    for (const spec of added) problems.push(`NEW ${label}: ${file} imports ${spec} (not in purity-baseline.json)`);
+    for (const spec of removed) problems.push(`STALE ${label} baseline entry: ${file} no longer imports ${spec} — delete it from purity-baseline.json`);
+  }
+}
+
+function diffCountBuckets(actual, baseline, problems) {
+  const files = new Set([...sortedKeys(actual), ...sortedKeys(baseline)]);
+  for (const file of [...files].sort()) {
+    const actualCounts = actual[file] || {};
+    const baseCounts = baseline[file] || {};
+    const patterns = new Set([...Object.keys(actualCounts), ...Object.keys(baseCounts)]);
+    for (const pattern of [...patterns].sort()) {
+      const a = actualCounts[pattern] || 0;
+      const b = baseCounts[pattern] || 0;
+      if (a !== b) {
+        problems.push(`clock/env count drift: ${file} has ${a} occurrence(s) of "${pattern}", purity-baseline.json expects ${b} — update the baseline consciously (this catches new AND removed occurrences)`);
+      }
+    }
+  }
+}
+
+function main() {
+  if (!fs.existsSync(baselinePath)) {
+    process.stderr.write(`purity gate: missing ${path.relative(packageDir, baselinePath)}\n`);
+    process.exit(1);
+  }
+  const baseline = JSON.parse(fs.readFileSync(baselinePath, "utf8"));
+  const actual = scan();
+
+  const problems = [];
+  diffListBuckets(actual.layerViolations, baseline.layerViolations || {}, "layer violation", problems);
+  diffListBuckets(actual.builtinViolations, baseline.builtinViolations || {}, "core builtin violation", problems);
+  diffCountBuckets(actual.clockEnvCounts, baseline.clockEnvCounts || {}, problems);
+
+  if (problems.length > 0) {
+    process.stderr.write(`purity gate: ${problems.length} problem(s)\n`);
+    for (const p of problems) process.stderr.write(`  ${p}\n`);
+    process.exit(1);
+  }
+  process.stdout.write("purity gate: src/ matches the committed baseline (no new core/shell layer breaks, no clock/env drift).\n");
+}
+
+main();

package/scripts/release-check.js

@@ -39,6 +39,7 @@ const checks = [
         "docs/run-retention-reclamation.7.md",
         "docs/durable-state-and-locking.7.md",
         "docs/security-trust-hardening.7.md",
+        "docs/trust-audit-anchor.7.md",
         "../../CHANGELOG.md",
         "../../RELEASE.md"
       ]) {
@@ -58,6 +59,7 @@ const checks = [
   // `dist:check` builds from src/ AND fails closed if the committed dist/ drifted
   // from that fresh build — strictly stronger than a bare `npm run build`.
   { name: "dist freshness", command: ["npm", "run", "dist:check"] },
+  { name: "core/shell purity", command: ["npm", "run", "purity:check"] },
   { name: "type check", command: ["npm", "run", "check"] },
   { name: "onramp contract", command: ["npm", "run", "onramp:check"] },
   { name: "run-state schema consistency", command: ["node", "scripts/validate-run-state-schema.js"] },
@@ -66,6 +68,11 @@ const checks = [
   // (release-gate.sh) forces CW_TEST_CONCURRENCY=1 to stay sequential as the
   // deterministic backstop.
   { name: "tests", command: ["npm", "run", "test:ci"] },
+  // Pure core/ unit tests (test/*.test.js) — a separate suite from the smoke
+  // tests above (see test/run-unit.js's header). --skip-tests also skips
+  // this one, matching "tests": ci.yml runs test:unit directly, so this
+  // entry would just repeat it a second time in the release-check pass.
+  { name: "unit tests", command: ["npm", "run", "test:unit"] },
   { name: "canonical apps", command: ["npm", "run", "canonical-apps"] },
   { name: "golden path", command: ["npm", "run", "golden-path"] },
   { name: "CLI MCP parity", command: ["npm", "run", "parity:check"] },
@@ -88,7 +95,7 @@ function main() {
     process.stdout.write(`release:check ${check.name} ... `);
     const started = Date.now();
     try {
-      if (skipTests && check.name === "tests") {
+      if (skipTests && (check.name === "tests" || check.name === "unit tests")) {
         results.push({ name: check.name, ok: true, skipped: true, elapsedMs: 0 });
         process.stdout.write("skipped\n");
         continue;