cool-workflow 0.2.1 → 0.2.3

package/docs/operator-ux.7.md

@@ -10,7 +10,7 @@ deterministic summaries for people, while it keeps JSON for scripts and MCP.
 Human status is the default:
 
 ```bash
-node scripts/cw.js status <run-id>
+cw status <run-id>
 ```
 
 The status view gives you run id, workflow/app id and version, loop stage, active
@@ -21,8 +21,8 @@ path, and the next command it puts forward.
 Machine-readable status is still there for you:
 
 ```bash
-node scripts/cw.js status <run-id> --json
-node scripts/cw.js status <run-id> --format json
+cw status <run-id> --json
+cw status <run-id> --format json
 ```
 
 `CoolWorkflowRunner.status()` and MCP `cw_status` still give back structured
@@ -39,19 +39,19 @@ The things it puts forward are deterministic and use only commands that are in
 the CW CLI. Examples:
 
 ```text
-node scripts/cw.js dispatch <run-id> --limit 4
+cw dispatch <run-id> --limit 4
   reason: pending tasks are ready for the active phase
 
-node scripts/cw.js worker manifest <run-id> <worker-id>
+cw worker manifest <run-id> <worker-id>
   reason: running workers need their manifests inspected
 
-node scripts/cw.js feedback show <run-id> <feedback-id>
+cw feedback show <run-id> <feedback-id>
   reason: open feedback should be resolved before more dispatch
 
-node scripts/cw.js candidate register <run-id> --worker <worker-id>
+cw candidate register <run-id> --worker <worker-id>
   reason: a completed worker result has not been registered as a candidate
 
-node scripts/cw.js commit <run-id> --selection <selection-id>
+cw commit <run-id> --selection <selection-id>
   reason: a verified selected candidate is ready for a verifier-gated commit
 ```
 
@@ -63,15 +63,15 @@ work is done, the advisor points to `cw report <run-id> --show`.
 Use the top-level graph command for a small console map:
 
 ```bash
-node scripts/cw.js graph <run-id>
-node scripts/cw.js graph <run-id> --json
+cw graph <run-id>
+cw graph <run-id> --json
 ```
 
 The legacy node command still works:
 
 ```bash
-node scripts/cw.js node graph <run-id>
-node scripts/cw.js node graph <run-id> --json
+cw node graph <run-id>
+cw node graph <run-id> --json
 ```
 
 The human graph puts phases, tasks, dispatches, workers, result nodes,
@@ -90,10 +90,10 @@ v0.1.21 adds clear multi-agent operator views that answer who is dependent on
 whom, who is blocked, and which evidence went into the accepted result:
 
 ```bash
-node scripts/cw.js multi-agent graph <run-id>
-node scripts/cw.js multi-agent dependencies <run-id>
-node scripts/cw.js multi-agent failures <run-id>
-node scripts/cw.js multi-agent evidence <run-id>
+cw multi-agent graph <run-id>
+cw multi-agent dependencies <run-id>
+cw multi-agent failures <run-id>
+cw multi-agent evidence <run-id>
 ```
 
 The same derived model is in `status`, `report --show`, and
@@ -106,14 +106,14 @@ trace from agent membership to verifier-gated commit.
 `cw report` still writes the Markdown report file and prints its path:
 
 ```bash
-node scripts/cw.js report <run-id>
+cw report <run-id>
 ```
 
 Use `--show` or `--summary` when the operator needs a console report that is easy to read:
 
 ```bash
-node scripts/cw.js report <run-id> --show
-node scripts/cw.js report <run-id> --summary
+cw report <run-id> --show
+cw report <run-id> --summary
 ```
 
 The console report gives the same high-value status panels plus active and
@@ -124,25 +124,25 @@ pending tasks, evidence paths and locators, and resource inspection commands.
 The chief run resources have human summaries by default and JSON when you ask for it:
 
 ```bash
-node scripts/cw.js worker summary <run-id>
-node scripts/cw.js worker summary <run-id> --json
+cw worker summary <run-id>
+cw worker summary <run-id> --json
 
-node scripts/cw.js candidate summary <run-id>
-node scripts/cw.js candidate summary <run-id> --json
+cw candidate summary <run-id>
+cw candidate summary <run-id> --json
 
-node scripts/cw.js feedback summary <run-id>
-node scripts/cw.js feedback summary <run-id> --json
+cw feedback summary <run-id>
+cw feedback summary <run-id> --json
 
-node scripts/cw.js commit summary <run-id>
-node scripts/cw.js commit summary <run-id> --json
+cw commit summary <run-id>
+cw commit summary <run-id> --json
 
-node scripts/cw.js multi-agent summary <run-id>
-node scripts/cw.js multi-agent summary <run-id> --json
-node scripts/cw.js multi-agent graph <run-id>
-node scripts/cw.js multi-agent graph <run-id> --json
-node scripts/cw.js multi-agent dependencies <run-id>
-node scripts/cw.js multi-agent failures <run-id>
-node scripts/cw.js multi-agent evidence <run-id>
+cw multi-agent summary <run-id>
+cw multi-agent summary <run-id> --json
+cw multi-agent graph <run-id>
+cw multi-agent graph <run-id> --json
+cw multi-agent dependencies <run-id>
+cw multi-agent failures <run-id>
+cw multi-agent evidence <run-id>
 ```
 
 Worker summaries show allocated/running/verified/failed/rejected counts,

package/docs/pipeline-runner.7.md

@@ -93,10 +93,10 @@ commit stage.
 Commands that look at runs print stable JSON:
 
 ```text
-cw.js contract show <run-id> [contract-id]
-cw.js node list <run-id>
-cw.js node show <run-id> <node-id>
-cw.js node graph <run-id>
+cw contract show <run-id> [contract-id]
+cw node list <run-id>
+cw node show <run-id> <node-id>
+cw node graph <run-id>
 ```
 
 ## EXAMPLES

package/docs/project-index.md

@@ -1,15 +1,15 @@
 # Cool Workflow Project Index
 
-Generated from the current repository code on 2026-07-07 by `npm run sync:project-index`.
+Generated from the current repository code on 2026-07-10 by `npm run sync:project-index`.
 
 ## Snapshot
 
 - Package: `cool-workflow`
-- Version: `0.2.1`
-- Source modules: `129`
+- Version: `0.2.3`
+- Source modules: `148`
 - Workflow apps: `8`
-- Docs: `61`
-- Smoke tests: `178`
+- Docs: `62`
+- Smoke tests: `201`
 - Repository: https://github.com/coo1white/cool-workflow
 
 ## Architecture
@@ -82,8 +82,11 @@ multi-agent host -> topology -> blackboard/coordinator
 - [cli/entry.ts](../src/cli/entry.ts)
 - [cli/io.ts](../src/cli/io.ts)
 - [cli/parseargv.ts](../src/cli/parseargv.ts)
+- [core/capability-data.ts](../src/core/capability-data.ts)
 - [core/capability-table.ts](../src/core/capability-table.ts)
+- [core/format/completion.ts](../src/core/format/completion.ts)
 - [core/format/help.ts](../src/core/format/help.ts)
+- [core/format/safe-json.ts](../src/core/format/safe-json.ts)
 - [core/format/state-explosion-text.ts](../src/core/format/state-explosion-text.ts)
 - [core/hash.ts](../src/core/hash.ts)
 - [core/multi-agent/collaboration.ts](../src/core/multi-agent/collaboration.ts)
@@ -113,6 +116,10 @@ multi-agent host -> topology -> blackboard/coordinator
 - [core/trust/telemetry-ledger.ts](../src/core/trust/telemetry-ledger.ts)
 - [core/types.ts](../src/core/types.ts)
 - [core/types/boundary.ts](../src/core/types/boundary.ts)
+- [core/types/execution-backend.ts](../src/core/types/execution-backend.ts)
+- [core/types/observability.ts](../src/core/types/observability.ts)
+- [core/util/collate.ts](../src/core/util/collate.ts)
+- [core/util/numeric-flag.ts](../src/core/util/numeric-flag.ts)
 - [mcp/dispatch.ts](../src/mcp/dispatch.ts)
 - [mcp/server.ts](../src/mcp/server.ts)
 - [shell/agent-config.ts](../src/shell/agent-config.ts)
@@ -181,6 +188,18 @@ multi-agent host -> topology -> blackboard/coordinator
 - [shell/workbench-text.ts](../src/shell/workbench-text.ts)
 - [shell/workbench.ts](../src/shell/workbench.ts)
 - [shell/worker-cli.ts](../src/shell/worker-cli.ts)
+- [wiring/capability-table/basics.ts](../src/wiring/capability-table/basics.ts)
+- [wiring/capability-table/exec-backend.ts](../src/wiring/capability-table/exec-backend.ts)
+- [wiring/capability-table/index.ts](../src/wiring/capability-table/index.ts)
+- [wiring/capability-table/multi-agent.ts](../src/wiring/capability-table/multi-agent.ts)
+- [wiring/capability-table/parity.ts](../src/wiring/capability-table/parity.ts)
+- [wiring/capability-table/pipeline.ts](../src/wiring/capability-table/pipeline.ts)
+- [wiring/capability-table/registry-core.ts](../src/wiring/capability-table/registry-core.ts)
+- [wiring/capability-table/reporting.ts](../src/wiring/capability-table/reporting.ts)
+- [wiring/capability-table/scheduling-registry.ts](../src/wiring/capability-table/scheduling-registry.ts)
+- [wiring/capability-table/state.ts](../src/wiring/capability-table/state.ts)
+- [wiring/capability-table/trust-ledger.ts](../src/wiring/capability-table/trust-ledger.ts)
+- [wiring/capability-table/workflow-apps.ts](../src/wiring/capability-table/workflow-apps.ts)
 
 ## Workflow Apps
 
@@ -251,6 +270,7 @@ multi-agent host -> topology -> blackboard/coordinator
 - [State Explosion Management](state-explosion-management.7.md)
 - [STATE-NODE(7)](state-node.7.md)
 - [Team Collaboration](team-collaboration.7.md)
+- [Trust Audit Anchor](trust-audit-anchor.7.md)
 - [Trust Model & Limitations](trust-model.md)
 - [Unix-Inspired Workflow Principles](unix-principles.md)
 - [Vendor Manifest Loadability](vendor-manifest-loadability.7.md)
@@ -286,6 +306,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [claude-p-agent-wrapper-smoke.js](../test/claude-p-agent-wrapper-smoke.js)
 - [cli-arg-parsing-smoke.js](../test/cli-arg-parsing-smoke.js)
 - [cli-command-surface-smoke.js](../test/cli-command-surface-smoke.js)
+- [cli-epipe-smoke.js](../test/cli-epipe-smoke.js)
 - [cli-format-smoke.js](../test/cli-format-smoke.js)
 - [cli-handler-clones-smoke.js](../test/cli-handler-clones-smoke.js)
 - [cli-handler-eval-node-smoke.js](../test/cli-handler-eval-node-smoke.js)
@@ -307,17 +328,22 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [contract-migration-tooling-smoke.js](../test/contract-migration-tooling-smoke.js)
 - [control-plane-scheduling-smoke.js](../test/control-plane-scheduling-smoke.js)
 - [coordinator-blackboard-smoke.js](../test/coordinator-blackboard-smoke.js)
+- [coordinator-topology-persist-dirty-tracking-smoke.js](../test/coordinator-topology-persist-dirty-tracking-smoke.js)
 - [cw-help-per-command-smoke.js](../test/cw-help-per-command-smoke.js)
 - [dead-export-removal-guard-smoke.js](../test/dead-export-removal-guard-smoke.js)
 - [deepseek-agent-wrapper-smoke.js](../test/deepseek-agent-wrapper-smoke.js)
 - [deferred-checkpoint-batching-smoke.js](../test/deferred-checkpoint-batching-smoke.js)
 - [demo-bundle-smoke.js](../test/demo-bundle-smoke.js)
 - [det-ids-b-smoke.js](../test/det-ids-b-smoke.js)
+- [dispatch-legacy-burndown-smoke.js](../test/dispatch-legacy-burndown-smoke.js)
+- [doctor-audit-integrity-repair-smoke.js](../test/doctor-audit-integrity-repair-smoke.js)
 - [doctor-smoke.js](../test/doctor-smoke.js)
 - [dogfood-architecture-review-smoke.js](../test/dogfood-architecture-review-smoke.js)
 - [dogfood-release-smoke.js](../test/dogfood-release-smoke.js)
+- [drive-async-real-signal-smoke.js](../test/drive-async-real-signal-smoke.js)
 - [drive-concurrency-flag-smoke.js](../test/drive-concurrency-flag-smoke.js)
 - [drive-exhaustion-blocked-smoke.js](../test/drive-exhaustion-blocked-smoke.js)
+- [drive-round-cache-serial-smoke.js](../test/drive-round-cache-serial-smoke.js)
 - [durable-atomic-write-smoke.js](../test/durable-atomic-write-smoke.js)
 - [end-to-end-demo-smoke.js](../test/end-to-end-demo-smoke.js)
 - [end-to-end-golden-path-smoke.js](../test/end-to-end-golden-path-smoke.js)
@@ -330,6 +356,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [execution-backends-smoke.js](../test/execution-backends-smoke.js)
 - [feedback-ops-unit-smoke.js](../test/feedback-ops-unit-smoke.js)
 - [freebsd-audit-fixes-smoke.js](../test/freebsd-audit-fixes-smoke.js)
+- [fs-atomic-lock-steal-race-smoke.js](../test/fs-atomic-lock-steal-race-smoke.js)
 - [gemini-agent-wrapper-smoke.js](../test/gemini-agent-wrapper-smoke.js)
 - [gemini-opencode-agent-wrapper-smoke.js](../test/gemini-opencode-agent-wrapper-smoke.js)
 - [h7-custom-profile-persist-smoke.js](../test/h7-custom-profile-persist-smoke.js)
@@ -339,9 +366,11 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [ledger-resolution-smoke.js](../test/ledger-resolution-smoke.js)
 - [ledger-verify-smoke.js](../test/ledger-verify-smoke.js)
 - [loop-bounded-expansion-smoke.js](../test/loop-bounded-expansion-smoke.js)
+- [man-run-registry-traversal-smoke.js](../test/man-run-registry-traversal-smoke.js)
 - [mcp-app-surface-smoke.js](../test/mcp-app-surface-smoke.js)
 - [mcp-surface-registry-smoke.js](../test/mcp-surface-registry-smoke.js)
 - [mcp-tool-call-coverage-smoke.js](../test/mcp-tool-call-coverage-smoke.js)
+- [mcp-untrusted-content-advisory-smoke.js](../test/mcp-untrusted-content-advisory-smoke.js)
 - [metrics-summary-limit-smoke.js](../test/metrics-summary-limit-smoke.js)
 - [multi-agent-cli-mcp-surface-smoke.js](../test/multi-agent-cli-mcp-surface-smoke.js)
 - [multi-agent-eval-determinism-regression-smoke.js](../test/multi-agent-eval-determinism-regression-smoke.js)
@@ -349,6 +378,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [multi-agent-eval-replay-smoke.js](../test/multi-agent-eval-replay-smoke.js)
 - [multi-agent-operator-ux-smoke.js](../test/multi-agent-operator-ux-smoke.js)
 - [multi-agent-runtime-core-smoke.js](../test/multi-agent-runtime-core-smoke.js)
+- [multi-agent-state-lock-concurrency-smoke.js](../test/multi-agent-state-lock-concurrency-smoke.js)
 - [multi-agent-topologies-debate-smoke.js](../test/multi-agent-topologies-debate-smoke.js)
 - [multi-agent-topologies-judge-panel-smoke.js](../test/multi-agent-topologies-judge-panel-smoke.js)
 - [multi-agent-topologies-map-reduce-smoke.js](../test/multi-agent-topologies-map-reduce-smoke.js)
@@ -357,6 +387,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [node-snapshot-diff-replay-smoke.js](../test/node-snapshot-diff-replay-smoke.js)
 - [npm-global-install-smoke.js](../test/npm-global-install-smoke.js)
 - [npm-trusted-publish-smoke.js](../test/npm-trusted-publish-smoke.js)
+- [numeric-flag-parsing-smoke.js](../test/numeric-flag-parsing-smoke.js)
 - [observability-cost-accounting-smoke.js](../test/observability-cost-accounting-smoke.js)
 - [one-way-boundary-smoke.js](../test/one-way-boundary-smoke.js)
 - [onramp-check-smoke.js](../test/onramp-check-smoke.js)
@@ -383,6 +414,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [readme-trust-claim-smoke.js](../test/readme-trust-claim-smoke.js)
 - [real-execution-backends-smoke.js](../test/real-execution-backends-smoke.js)
 - [registry-corrupt-fail-closed-smoke.js](../test/registry-corrupt-fail-closed-smoke.js)
+- [registry-corrupt-state-distinct-error-smoke.js](../test/registry-corrupt-state-distinct-error-smoke.js)
 - [release-check-skip-smoke.js](../test/release-check-skip-smoke.js)
 - [release-flow-smoke.js](../test/release-flow-smoke.js)
 - [release-gate-smoke.js](../test/release-gate-smoke.js)
@@ -409,6 +441,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [run-restore-failclosed-smoke.js](../test/run-restore-failclosed-smoke.js)
 - [run-resume-drive-smoke.js](../test/run-resume-drive-smoke.js)
 - [run-retention-reclamation-smoke.js](../test/run-retention-reclamation-smoke.js)
+- [run-state-lock-concurrency-smoke.js](../test/run-state-lock-concurrency-smoke.js)
 - [sample-determinism-smoke.js](../test/sample-determinism-smoke.js)
 - [sandbox-env-batch-hardening-smoke.js](../test/sandbox-env-batch-hardening-smoke.js)
 - [sandbox-profile-smoke.js](../test/sandbox-profile-smoke.js)
@@ -418,10 +451,14 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [schema-validation-smoke.js](../test/schema-validation-smoke.js)
 - [security-trust-hardening-smoke.js](../test/security-trust-hardening-smoke.js)
 - [self-audit-hardening-smoke.js](../test/self-audit-hardening-smoke.js)
+- [sigint-sigterm-drive-loop-smoke.js](../test/sigint-sigterm-drive-loop-smoke.js)
+- [smoke-duration-scheduling-smoke.js](../test/smoke-duration-scheduling-smoke.js)
 - [source-context-batch-smoke.js](../test/source-context-batch-smoke.js)
 - [source-context-profile-smoke.js](../test/source-context-profile-smoke.js)
 - [state-node-smoke.js](../test/state-node-smoke.js)
+- [status-run-flag-smoke.js](../test/status-run-flag-smoke.js)
 - [sub-workflow-nesting-smoke.js](../test/sub-workflow-nesting-smoke.js)
+- [summary-show-no-checkpoint-write-smoke.js](../test/summary-show-no-checkpoint-write-smoke.js)
 - [surface-explicit-cwd-smoke.js](../test/surface-explicit-cwd-smoke.js)
 - [tamper-evidence-demo-smoke.js](../test/tamper-evidence-demo-smoke.js)
 - [team-collaboration-smoke.js](../test/team-collaboration-smoke.js)
@@ -432,11 +469,17 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [telemetry-metrics-coverage-smoke.js](../test/telemetry-metrics-coverage-smoke.js)
 - [telemetry-verify-signatures-smoke.js](../test/telemetry-verify-signatures-smoke.js)
 - [token-budget-enforcement-smoke.js](../test/token-budget-enforcement-smoke.js)
+- [trust-audit-anchor-smoke.js](../test/trust-audit-anchor-smoke.js)
+- [trust-audit-append-lock-concurrency-smoke.js](../test/trust-audit-append-lock-concurrency-smoke.js)
+- [trust-audit-append-tail-cache-smoke.js](../test/trust-audit-append-tail-cache-smoke.js)
 - [vendor-manifest-load-smoke.js](../test/vendor-manifest-load-smoke.js)
 - [vendor-preflight-smoke.js](../test/vendor-preflight-smoke.js)
+- [verdict-signing-workflow-smoke.js](../test/verdict-signing-workflow-smoke.js)
 - [verifier-gated-commit-smoke.js](../test/verifier-gated-commit-smoke.js)
+- [verify-bump-reproduction-smoke.js](../test/verify-bump-reproduction-smoke.js)
 - [verify-import-audit-chain-smoke.js](../test/verify-import-audit-chain-smoke.js)
 - [web-desktop-workbench-smoke.js](../test/web-desktop-workbench-smoke.js)
+- [wiring-lazy-shell-imports-smoke.js](../test/wiring-lazy-shell-imports-smoke.js)
 - [worker-accept-path-architecture-smoke.js](../test/worker-accept-path-architecture-smoke.js)
 - [worker-isolation-smoke.js](../test/worker-isolation-smoke.js)
 - [worker-retry-count-smoke.js](../test/worker-retry-count-smoke.js)

package/docs/real-execution-backends.7.md

@@ -193,3 +193,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.2.0
 
 0.2.1
+
+0.2.2
+
+0.2.3

package/docs/release-and-migration.7.md

@@ -9,7 +9,7 @@ Maintainers cutting CW releases should use `npm run release:check` from
 files can check compatibility with:
 
 ```bash
-node scripts/cw.js state check <run-id>
+cw state check <run-id>
 ```
 
 Use `--state /path/to/state.json` when checking a state file outside the
@@ -333,3 +333,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.2.0
 
 0.2.1
+
+0.2.2
+
+0.2.3

package/docs/release-tooling.7.md

@@ -296,3 +296,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.2.0
 
 0.2.1
+
+0.2.2
+
+0.2.3

package/docs/routines.md

@@ -15,7 +15,7 @@ CW keeps routine data in:
 Create an API trigger:
 
 ```bash
-node scripts/cw.js routine create \
+cw routine create \
   --kind api \
   --prompt "Handle this API event."
 ```
@@ -23,7 +23,7 @@ node scripts/cw.js routine create \
 Create a GitHub trigger:
 
 ```bash
-node scripts/cw.js routine create \
+cw routine create \
   --kind github \
   --prompt "Review this GitHub event." \
   --match '{"action":"opened"}'
@@ -32,13 +32,13 @@ node scripts/cw.js routine create \
 Fire a trigger from a payload file:
 
 ```bash
-node scripts/cw.js routine fire github payload.json
+cw routine fire github payload.json
 ```
 
 Inspect events:
 
 ```bash
-node scripts/cw.js routine events
+cw routine events
 ```
 
 ## Long Architecture Reviews

package/docs/run-registry-control-plane.7.md

@@ -251,25 +251,25 @@ freshness, and provenance back to its `.cw/runs/<id>/`. Filter with `--app` and
 ## CLI
 
 ```text
-node scripts/cw.js registry refresh [--scope repo|home] [--json]
-node scripts/cw.js registry show [--scope repo|home] [--json]
-node scripts/cw.js run search [--app ID] [--status STATE] [--text Q] [--repo PATH] [--since ISO] [--until ISO] [--limit N] [--offset N] [--scope repo|home] [--json]
-node scripts/cw.js run list [--scope repo|home] [--json]
-node scripts/cw.js run show <run-id> [--scope repo|home] [--json]
-node scripts/cw.js run resume <run-id> [--limit N] [--drive [--once]] [--json]
-node scripts/cw.js run archive <run-id> [--reason TEXT] [--unarchive]
-node scripts/cw.js run archive --older-than-days N [--state completed --state failed]
-node scripts/cw.js run rerun <run-id> [--reason TEXT]
-node scripts/cw.js run export <run-id> --output PATH
-node scripts/cw.js run import PATH --target DIR
-node scripts/cw.js run verify-import <run-id> [--cwd DIR]
-node scripts/cw.js run inspect-archive PATH [--json]
-node scripts/cw.js run restore PATH --target DIR [--json]
-node scripts/cw.js queue add [--app ID|--workflow ID|--runId ID] [--repo PATH] [--priority N] [--note TEXT]
-node scripts/cw.js queue list [--status STATE] [--repo PATH] [--json]
-node scripts/cw.js queue show <queue-id>
-node scripts/cw.js queue drain [--limit N] [--repo PATH]
-node scripts/cw.js history [--app ID] [--status STATE] [--limit N] [--offset N] [--scope repo|home] [--json]
+cw registry refresh [--scope repo|home] [--json]
+cw registry show [--scope repo|home] [--json]
+cw run search [--app ID] [--status STATE] [--text Q] [--repo PATH] [--since ISO] [--until ISO] [--limit N] [--offset N] [--scope repo|home] [--json]
+cw run list [--scope repo|home] [--json]
+cw run show <run-id> [--scope repo|home] [--json]
+cw run resume <run-id> [--limit N] [--drive [--once]] [--json]
+cw run archive <run-id> [--reason TEXT] [--unarchive]
+cw run archive --older-than-days N [--state completed --state failed]
+cw run rerun <run-id> [--reason TEXT]
+cw run export <run-id> --output PATH
+cw run import PATH --target DIR
+cw run verify-import <run-id> [--cwd DIR]
+cw run inspect-archive PATH [--json]
+cw run restore PATH --target DIR [--json]
+cw queue add [--app ID|--workflow ID|--runId ID] [--repo PATH] [--priority N] [--note TEXT]
+cw queue list [--status STATE] [--repo PATH] [--json]
+cw queue show <queue-id>
+cw queue drain [--limit N] [--repo PATH]
+cw history [--app ID] [--status STATE] [--limit N] [--offset N] [--scope repo|home] [--json]
 ```
 
 Read commands print short human panels by default (lifecycle, freshness, counts,
@@ -476,3 +476,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.2.0
 
 0.2.1
+
+0.2.2
+
+0.2.3

package/docs/run-retention-reclamation.7.md

@@ -265,3 +265,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.2.0
 
 0.2.1
+
+0.2.2
+
+0.2.3

package/docs/scheduled-tasks.md

@@ -14,7 +14,7 @@ CW keeps schedules in:
 Make a `/loop`-ready schedule:
 
 ```bash
-node scripts/cw.js loop \
+cw loop \
   --intervalMinutes 30 \
   --prompt "Check this workflow and continue if work is due."
 ```
@@ -22,7 +22,7 @@ node scripts/cw.js loop \
 Make a loop:
 
 ```bash
-node scripts/cw.js schedule create \
+cw schedule create \
   --kind loop \
   --intervalMinutes 30 \
   --prompt "Check this workflow and continue if work is due."
@@ -31,7 +31,7 @@ node scripts/cw.js schedule create \
 Make a cron schedule:
 
 ```bash
-node scripts/cw.js schedule create \
+cw schedule create \
   --kind cron \
   --cron "*/15 * * * *" \
   --prompt "Run the due workflow scan."
@@ -40,7 +40,7 @@ node scripts/cw.js schedule create \
 Make a reminder:
 
 ```bash
-node scripts/cw.js schedule create \
+cw schedule create \
   --kind reminder \
   --delayMinutes 60 \
   --prompt "Remind me to inspect the report."
@@ -49,26 +49,26 @@ node scripts/cw.js schedule create \
 List and look through:
 
 ```bash
-node scripts/cw.js schedule list
-node scripts/cw.js schedule due
-node scripts/cw.js schedule complete <schedule-id>
-node scripts/cw.js schedule pause <schedule-id>
-node scripts/cw.js schedule resume <schedule-id>
-node scripts/cw.js schedule run-now <schedule-id>
-node scripts/cw.js schedule history <schedule-id>
-node scripts/cw.js schedule delete <schedule-id>
+cw schedule list
+cw schedule due
+cw schedule complete <schedule-id>
+cw schedule pause <schedule-id>
+cw schedule resume <schedule-id>
+cw schedule run-now <schedule-id>
+cw schedule history <schedule-id>
+cw schedule delete <schedule-id>
 ```
 
 Run the local desktop-like daemon one time:
 
 ```bash
-node scripts/cw.js schedule daemon --once
+cw schedule daemon --once
 ```
 
 Run it without stopping:
 
 ```bash
-node scripts/cw.js schedule daemon --intervalSeconds 60
+cw schedule daemon --intervalSeconds 60
 ```
 
 ## Notes

package/docs/security-trust-hardening.7.md

@@ -51,22 +51,52 @@ The agent host must still make certain of OS-level read isolation, write isolati
 limits on process execution, limits on network, and environment filtering.
 The audit layer lets you look at that boundary; it is not a kernel.
 
+## Requiring Attested Telemetry
+
+`CW_REQUIRE_ATTESTED_TELEMETRY=1` (or `--require-attested-telemetry`, or a
+durable `agent-config.json` field) is an opt-in, off-by-default gate: once
+on, CW refuses to accept ANY worker result whose usage telemetry is not
+cryptographically `attested` — a delegated hop whose signature does not
+verify, and now also a MANUAL accept (`cw worker output`, `cw result`) that
+carries no delegation telemetry at all. The manual shape used to slip past
+the gate silently; it is now blocked the same way, with its own code
+(`telemetry-missing-blocked`, distinct from a present-but-unverified hop's
+`telemetry-unattested-blocked`).
+
+An operator who genuinely needs to accept an unattested manual result under
+the require flag passes `--allow-unattested` (MCP: `allowUnattested`). This
+is never silent: it writes a `telemetry.gate-override` trust-audit event
+(`decision: "allowed"`, `source: "operator"`) into the same hash-chained log
+every other audit decision goes through, so the override itself is part of
+the auditable record, not a hole in it.
+
+A result-cache hit (the drive loop replaying a previously accepted result) is
+never re-blocked by this gate — the underlying result was already gated (or
+overridden) at its first acceptance. When the require flag is on, a cache
+accept still records a `telemetry.cache-accept` event, so the audit trail
+shows which accepts came from a fresh hop and which from the cache.
+
+With the require flag off (the default), none of this changes: a plain
+`cw worker output` / `cw result` behaves exactly as before.
+
 ## CLI
 
 ```bash
-node scripts/cw.js audit summary <run-id>
-node scripts/cw.js audit worker <run-id> <worker-id>
-node scripts/cw.js audit provenance <run-id> [--worker ID|--candidate ID|--commit ID]
-node scripts/cw.js audit multi-agent <run-id>
-node scripts/cw.js audit policy <run-id>
-node scripts/cw.js audit role <run-id> <role-id>
-node scripts/cw.js audit blackboard <run-id>
-node scripts/cw.js audit judge <run-id>
-node scripts/cw.js audit attest <run-id> --worker <worker-id> --hostEnforced true
-node scripts/cw.js audit decision <run-id> <worker-id> --path <path>
-node scripts/cw.js audit decision <run-id> <worker-id> --command "npm test"
-node scripts/cw.js audit decision <run-id> <worker-id> --network example.com
-node scripts/cw.js audit decision <run-id> <worker-id> --env SECRET_NAME
+cw audit summary <run-id>
+cw audit worker <run-id> <worker-id>
+cw audit provenance <run-id> [--worker ID|--candidate ID|--commit ID]
+cw audit multi-agent <run-id>
+cw audit policy <run-id>
+cw audit role <run-id> <role-id>
+cw audit blackboard <run-id>
+cw audit judge <run-id>
+cw audit attest <run-id> --worker <worker-id> --hostEnforced true
+cw audit decision <run-id> <worker-id> --path <path>
+cw audit decision <run-id> <worker-id> --command "npm test"
+cw audit decision <run-id> <worker-id> --network example.com
+cw audit decision <run-id> <worker-id> --env SECRET_NAME
+cw worker output <run-id> <worker-id> <result-file> [--allow-unattested]
+cw result <run-id> <task-id> <result-file> [--allow-unattested]
 ```
 
 Denied audit decisions are put into audit files and joined to feedback/error

package/docs/state-explosion-management.7.md

@@ -84,14 +84,14 @@ folded.
 ## CLI
 
 ```text
-node scripts/cw.js summary refresh <run-id> [--json] [--view <view> ...]
-node scripts/cw.js summary show <run-id> [--json]
-node scripts/cw.js blackboard summarize <run-id> [--json]
-node scripts/cw.js multi-agent summarize <run-id> [--json]
-node scripts/cw.js multi-agent graph <run-id> --view compact [--json]
-node scripts/cw.js multi-agent graph <run-id> --view critical-path [--json]
-node scripts/cw.js multi-agent graph <run-id> --focus <id> --depth <n> [--json]
-node scripts/cw.js report <run-id> --show
+cw summary refresh <run-id> [--json] [--view <view> ...]
+cw summary show <run-id> [--json]
+cw blackboard summarize <run-id> [--json]
+cw multi-agent summarize <run-id> [--json]
+cw multi-agent graph <run-id> --view compact [--json]
+cw multi-agent graph <run-id> --view critical-path [--json]
+cw multi-agent graph <run-id> --focus <id> --depth <n> [--json]
+cw report <run-id> --show
 ```
 
 Every command supports deterministic JSON with `--json` or `--format json`.
@@ -106,8 +106,8 @@ summaries and tells the operator how to look at the full data, for example:
 
 ```text
 Graph compacted: 420 nodes collapsed into 18 summary nodes
-Use: node scripts/cw.js multi-agent graph <run-id> --view full --json
-Use: node scripts/cw.js blackboard message list <run-id> --topic <topic-id>
+Use: cw multi-agent graph <run-id> --view full --json
+Use: cw blackboard message list <run-id> --topic <topic-id>
 ```
 
 ## MCP parity
@@ -322,3 +322,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.2.0
 
 0.2.1
+
+0.2.2
+
+0.2.3