cool-workflow 0.2.1 → 0.2.3

package/docs/team-collaboration.7.md

@@ -258,3 +258,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.2.0
 
 0.2.1
+
+0.2.2
+
+0.2.3

package/docs/trust-audit-anchor.7.md

@@ -0,0 +1,71 @@
+# Trust Audit Anchor
+
+CW v0.2.1 adds the Trust Audit Anchor: a way to see when the END of a run's
+trust-audit log was cut off. The hash chain in `audit/events.jsonl` lets
+`cw audit verify` see an edited event, a removed middle event, a bad line, and
+a mixed-era forgery. But one tamper shape gets past a pure chain walk: take
+the last N lines off the file, and what is left is a shorter but fully
+consistent chain — verify stays green. The anchor closes that hole, and it
+does so without changing any old output byte.
+
+## Design Discipline
+
+- Mechanism, not policy: the kernel gives you two small parts — a read of the
+  chain head, and a check against a head you saved earlier. WHEN you save a
+  head (after a run, before you publish, at export time) is your policy.
+- Fail-closed: a saved head that is not on the chain, or an event count that
+  comes up short, makes verify exit non-zero with the distinct check code
+  `trust-audit-truncated`. A bad `--expect-head` / `--expect-count` value is
+  an error, never a check silently made weaker.
+- POLA: with no anchor flags, `cw audit verify` output is byte-for-byte what
+  it was before this feature (no `anchor` key, same checks, same exit rules).
+- Reuse: the anchor rides on the existing eventHash chain — no new file, no
+  new state, no new hash form. `cw audit head` is a read-only projection.
+- Parity: `audit.head` is on both front doors (`cw audit head` and the MCP
+  tool `cw_audit_head`); the anchor args are on both `cw audit verify` and
+  `cw_audit_verify` (`expectHead` / `expectCount`).
+
+## CLI
+
+```text
+node dist/cli.js audit head <run-id>
+# -> { "schemaVersion": 1, "runId": "...", "eventCount": 87,
+#      "headHash": "sha256:..." }
+
+node dist/cli.js audit verify <run-id> --expect-head <hash> --expect-count <n>
+# green: verified true, "anchor": { ..., "satisfied": true }, exit 0
+# cut tail: verified false, checks carry trust-audit-truncated, exit 1
+```
+
+The head is the hash the NEXT appended event will link from: the last event's
+`eventHash`, or the run's genesis hash when the log is empty. Save the pair
+`{headHash, eventCount}` somewhere the log's writer cannot reach — a CI
+variable, a note in your PR, the output of `cw run export` (the export
+manifest hashes the event log bytes, so an export IS an anchor in file form).
+
+## How the check works
+
+`verifyTrustAudit` walks the chain as before, and keeps the trail of head
+hashes it saw (genesis, then the hash after each event). With an anchor:
+
+- `expectCount`: the walked log must have at least that many events. Fewer =
+  `trust-audit-truncated` (check name `anchor-count`).
+- `expectHead`: the saved head must be ON the trail. A log that was cut and
+  then padded back with new events reaches the old count, but the new events
+  link from an earlier point — the old head is no longer on the trail, so
+  this still fails (check name `anchor-head`).
+
+## Compatibility
+
+Trust Audit Anchor is introduced in CW v0.2.1. Fields are additive and
+optional; older run state loads unchanged. A plain `cw audit verify` keeps
+its exact old output. The `anchor` key appears in the JSON only when the
+caller passed an anchor flag.
+
+## See Also
+
+security-trust-hardening(7), cli-mcp-parity(7), report-verifiable-bundle(7)
+
+0.2.2
+
+0.2.3

package/docs/unix-principles.md

@@ -214,7 +214,9 @@ never in core. Core may send a vendor's stream on; it never reads one apart.
 **Rule of Silence.** stdout is data, stderr is diagnostics, and a
 non-interactive run says nothing on success. Anything friendly to a person is TTY-gated
 and can be turned off; `--json` output is fixed and with nothing added so it goes together
-in pipes.
+in pipes. A broken pipe is not an error: when the reader at the other end
+goes away early (`cw list --json | head -1`), the CLI stops quietly with
+exit 0 — no stack trace, no error text (both `--json` and human output).
 
 **Fail closed, conservative defaults.** Backends not yet configured probe as
 `unverified`, telemetry that cannot be verified is made known loudly (or turned away in strict

package/docs/verifier-gated-commit.7.md

@@ -114,7 +114,7 @@ commit-selection-not-verified
 commit-verifier-linkage-mismatch
 ```
 
-Use `cw.js feedback list <run-id>` and `cw.js node graph <run-id>` to look at
+Use `cw feedback list <run-id>` and `cw node graph <run-id>` to look at
 the failed transition.
 
 ## CANDIDATES

package/docs/web-desktop-workbench.7.md

@@ -276,3 +276,7 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.2.0
 
 0.2.1
+
+0.2.2
+
+0.2.3

package/docs/workflow-app-framework.7.md

@@ -16,13 +16,13 @@ const {
 ```
 
 ```bash
-node scripts/cw.js app list
-node scripts/cw.js app show workflow-app-framework-demo
-node scripts/cw.js app validate apps/workflow-app-framework-demo/app.json
-node scripts/cw.js app show architecture-review
+cw app list
+cw app show workflow-app-framework-demo
+cw app validate apps/workflow-app-framework-demo/app.json
+cw app show architecture-review
 npm run canonical-apps
-node scripts/cw.js app init my-app --title "My App"
-node scripts/cw.js plan my-app --question "What should happen?"
+cw app init my-app --title "My App"
+cw plan my-app --question "What should happen?"
 ```
 
 ## Description
@@ -170,7 +170,7 @@ App loading fails closed. CW checks:
 - sandbox profile references on the app, workflow, and tasks
 - compatibility limits against the current CW runtime
 
-`cw.js app validate` prints a structured result. Apps that are not valid return nonzero:
+`cw app validate` prints a structured result. Apps that are not valid return nonzero:
 
 ```json
 {
@@ -190,14 +190,14 @@ CW does not quietly change broken apps into workflows that can run.
 ## CLI
 
 ```bash
-node scripts/cw.js app list
-node scripts/cw.js app show <app-id>
-node scripts/cw.js app validate <path-or-app-id>
-node scripts/cw.js app init <app-id> --title "Title"
-node scripts/cw.js app package <app-id> --output app.cwapp.json
+cw app list
+cw app show <app-id>
+cw app validate <path-or-app-id>
+cw app init <app-id> --title "Title"
+cw app package <app-id> --output app.cwapp.json
 ```
 
-`cw.js list`, `cw.js init`, and `cw.js plan` still work the same way. `list` shows
+`cw list`, `cw init`, and `cw plan` still work the same way. `list` shows
 legacy workflow files and first-class app directories. `plan` takes either
 kind by id.
 

package/manifest/plugin.manifest.json

@@ -2,7 +2,7 @@
   "_comment": "SINGLE SOURCE OF TRUTH for every vendor manifest. Edit THIS file, then run `npm run gen:manifests`. Do NOT hand-edit the generated vendor manifests (.claude-plugin/, .codex-plugin/, .agents/, .mcp.json) — `npm run gen:manifests -- --check` (run by release:check) will fail if they drift from this source.",
   "identity": {
     "name": "cool-workflow",
-    "version": "0.2.1",
+    "version": "0.2.3",
     "license": "BSD-2-Clause",
     "homepage": "https://github.com/coo1white/cool-workflow",
     "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "bin": {
     "cool-workflow": "scripts/cw.js",
     "cw": "scripts/cw.js"
@@ -43,6 +43,7 @@
     "build": "tsc -p tsconfig.json",
     "check": "tsc -p tsconfig.json --noEmit",
     "dist:check": "node scripts/dist-drift-check.js",
+    "purity:check": "node scripts/purity-gate.js",
     "golden-path": "node scripts/golden-path.js",
     "dogfood:release": "node scripts/dogfood-release.js",
     "canonical-apps": "node scripts/canonical-apps.js",
@@ -68,12 +69,13 @@
     "test:fast": "npm run build --if-present && node dist/cli.js version > /dev/null && node test/run-all.js --concurrency auto",
     "test:ci": "npm run build && node dist/cli.js version > /dev/null && node test/run-all.js --sample 55",
     "test:coverage": "node dist/cli.js version > /dev/null && node scripts/coverage-gate.js --concurrency auto",
+    "test:unit": "node dist/cli.js version > /dev/null && node test/run-unit.js",
     "eval:replay": "tsc -p tsconfig.json && node test/multi-agent-eval-replay-harness-smoke.js",
     "ci": "npm run build && npm run check && npm run test && npm run release:check",
     "validate:schema": "node scripts/validate-run-state-schema.js"
   },
   "devDependencies": {
-    "@types/node": "^24.0.0",
+    "@types/node": "^26.1.1",
     "typescript": "^5.9.0"
   },
   "keywords": [

package/scripts/agents/claude-p-agent.js

@@ -50,7 +50,7 @@ const traceEnabled = streamEnabled && Boolean(process.stderr.isTTY);
 if (!streamEnabled) {
   // Legacy default: --output-format json and verbatim stdout forwarding. This is
   // the public wrapper contract existing users already scripted against.
-  const child = spawnSync("claude", ["-p", prompt, "--output-format", "json", "--allowedTools", "Read,Grep,Glob,Bash"], {
+  const child = spawnSync("claude", ["-p", prompt, "--output-format", "json", "--allowedTools", "Read,Grep,Glob"], {
     encoding: "utf8",
     maxBuffer: 32 * 1024 * 1024,
     shell: false
@@ -100,7 +100,7 @@ const transcriptPath = path.join(path.dirname(resultPath), "transcript.md");
 // non-zero exit.
 const child = spawn(
   "claude",
-  ["-p", prompt, "--output-format", "stream-json", "--verbose", "--allowedTools", "Read,Grep,Glob,Bash"],
+  ["-p", prompt, "--output-format", "stream-json", "--verbose", "--allowedTools", "Read,Grep,Glob"],
   { stdio: ["ignore", "pipe", "pipe"] }
 );
 

package/scripts/block-unapproved-tag.sh

@@ -4,6 +4,9 @@
 # require BOTH markers for the current HEAD sha:
 #   .cw-release/gate-<sha>.ok        (written by release-gate.sh)
 #   .cw-release/review-<sha>.verdict (written by the release-reviewer agent, must contain APPROVED)
+# If .cw-release/verdict-signing.pub is committed (scripts/verdict-keygen.js),
+# also requires a valid ed25519 signature on the verdict (its .sig sidecar) —
+# opt-in, backward compatible with repos that haven't set up signing yet.
 # Exit 2 blocks the tool call; stderr is fed back to the agent.
 set -uo pipefail
 
@@ -16,8 +19,12 @@ INPUT="$(cat)"
 CMD="$(printf '%s' "$INPUT" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{process.stdout.write(String(JSON.parse(s)?.tool_input?.command||""))}catch{process.stdout.write("")}})' 2>/dev/null)"
 [[ -z "$CMD" ]] && exit 0
 
-# Only care about tag creation / tag push
-if ! printf '%s' "$CMD" | grep -qE 'git\s+tag\s+(-a\s+)?v|git\s+push\b.*(--tags|refs/tags)'; then
+# Only care about tag creation / tag push. Widened from the original pattern,
+# which missed the single most natural bypass form: `git push origin v0.2.3`
+# (a bare tag-shaped ref, no --tags flag and no refs/tags/ prefix) matched
+# neither side of the old alternation. Also now tolerates a global flag before
+# the tag subcommand (`git -C dir tag ...`) and the `--annotate` long form.
+if ! printf '%s' "$CMD" | grep -qE 'git(\s+-[A-Za-z]+\s+\S+)*\s+tag\s+(-a\s+|--annotate\s+)?v[0-9]|git\s+push\b.*(--tags|refs/tags|[[:space:]]v[0-9])'; then
   exit 0
 fi
 
@@ -36,4 +43,18 @@ if [[ ! -f "$VERDICT" ]] || ! grep -q '^APPROVED' "$VERDICT"; then
   exit 2
 fi
 
+# Once .cw-release/verdict-signing.pub is committed (see scripts/verdict-keygen.js),
+# also require a valid ed25519 signature on the verdict — closing the gap this grep
+# alone can't: a plain APPROVED text match can't tell a real reviewer verdict from
+# one typed by hand. Absent that public key, this block is a no-op (unchanged,
+# grep-only behavior).
+PUBKEY="$REPO_ROOT/.cw-release/verdict-signing.pub"
+if [[ -f "$PUBKEY" ]]; then
+  SIG="$VERDICT.sig"
+  if [[ ! -f "$SIG" ]] || ! node "$REPO_ROOT/plugins/cool-workflow/scripts/verify-verdict-signature.js" "$VERDICT" "$SIG" "$PUBKEY" >/dev/null 2>&1; then
+    echo "BLOCKED: verdict for HEAD $SHA has no valid signature, but verdict-signing.pub is committed so one is required. Do not hand-write or hand-sign a verdict — obtain a real reviewer approval via release-flow.js with CW_RELEASE_VERDICT_PRIVKEY set." >&2
+    exit 2
+  fi
+fi
+
 exit 0

package/scripts/bump-version.js

@@ -46,6 +46,23 @@ function replaceFirstVersionField(absPath, next) {
   return true;
 }
 
+function replaceLockfileVersions(absPath, next) {
+  // Move BOTH lockfile version fields with targeted string swaps, so the byte
+  // formatting npm wrote is kept as it is: the top-level "version" (the first
+  // one in the file) and the root-package entry `"": { "name": ..., "version": ... }`.
+  // Dependency entries are not touched — the second swap is keyed on the
+  // `"": {` root-package opening, which is present only once.
+  const text = fs.readFileSync(absPath, "utf8");
+  let updated = text.replace(/"version":\s*"[^"]*"/, `"version": "${next}"`);
+  updated = updated.replace(
+    /("":\s*\{\s*"name":\s*"[^"]*",\s*"version":\s*)"[^"]*"/,
+    `$1"${next}"`
+  );
+  if (updated === text) return false;
+  fs.writeFileSync(absPath, updated);
+  return true;
+}
+
 function setNestedVersion(absPath, next) {
   // For files where the first `"version"` is NOT the right one, parse + set.
   const json = JSON.parse(fs.readFileSync(absPath, "utf8"));
@@ -75,9 +92,13 @@ function main() {
   // 1. package.json (the single source of truth version:sync now reads from)
   if (replaceFirstVersionField(path.join(pluginRoot, "package.json"), next)) note("package.json");
 
-  // 2. package-lock.json (gitignored install artifact; only if present)
+  // 2. package-lock.json (tracked; only if present). The lockfile keeps the
+  //    version in TWO places: the top-level "version" and the root-package
+  //    entry packages[""].version. The old code moved only the first one, so
+  //    the root-package entry kept an old version till the next `npm install`
+  //    (the v0.1.97 drift seen after the v0.2.0/v0.2.1 cuts). Move both here.
   const lock = path.join(pluginRoot, "package-lock.json");
-  if (fs.existsSync(lock) && replaceFirstVersionField(lock, next)) note("package-lock.json");
+  if (fs.existsSync(lock) && replaceLockfileVersions(lock, next)) note("package-lock.json");
 
   // 2b. Official MCP Registry server metadata (top-level server version + npm package version).
   const serverJson = path.join(pluginRoot, "server.json");
@@ -218,6 +239,7 @@ function contentSurfaceFiles(next) {
     { path: "plugins/cool-workflow/docs/run-retention-reclamation.7.md",     needle: next, desc: "run retention doc" },
     { path: "plugins/cool-workflow/docs/durable-state-and-locking.7.md",     needle: next, desc: "durable state doc" },
     { path: "plugins/cool-workflow/docs/release-and-migration.7.md",         needle: next, desc: "release & migration doc" },
+    { path: "plugins/cool-workflow/docs/trust-audit-anchor.7.md",           needle: next, desc: "trust audit anchor doc" },
   ];
 }
 

package/scripts/canonical-apps.js

@@ -83,7 +83,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.2.1",
+      "Cool Workflow v0.2.3",
       "--freshness",
       "as of release preparation"
     ]
@@ -117,14 +117,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.2.1");
+    assert.equal(summary.version, "0.2.3");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.2.1");
+    assert.equal(shown.app.version, "0.2.3");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -135,7 +135,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.2.1");
+    assert.equal(state.workflow.app.version, "0.2.3");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/children/batch-delegate-child.js

@@ -8,7 +8,8 @@
 //
 // Reads jobs JSON on stdin, spawns ALL concurrently (shell:false, inherited env —
 // the agent's own credentials resolve; CW never reads them), per-job SIGTERM at
-// timeoutMs + SIGKILL at +5s, caps each captured stdout at 32MB. Streams ONE
+// timeoutMs + SIGKILL at +5s, caps each captured stdout at 32MB RAW and each
+// written NDJSON line at 33MB SERIALIZED (see LINE_CAP below). Streams ONE
 // NDJSON line per job — `{i, spawnError?, exitCode, stdout}\n` — the INSTANT
 // that job settles (not once at the end): the parent's spawnSync call has its
 // own combined-output cap, so writing incrementally means a job whose line
@@ -21,6 +22,34 @@
 //
 // THE RED LINE: this child only `spawn`s the operator-resolved agent binary with
 // shell:false. It imports NO model SDK and reads NO credentials.
+//
+// A direct kill of THIS process (e.g. the parent's spawnSync `timeout` option,
+// or a signal that reaches this child but not the grandchildren it spawned)
+// used to orphan every still-running job -- no SIGINT/SIGTERM handler existed
+// here, so the kernel default (instant termination) left them running with no
+// one left to reap them. Now the first stop signal forwards SIGTERM to every
+// still-tracked child (same escalation shape the per-job timeout below
+// already uses) and lets each one's own `close` handler settle it normally;
+// a second signal escalates straight to SIGKILL and exits immediately.
+const children = new Set();
+function killAllChildren(signal) {
+  for (const child of children) {
+    try { child.kill(signal); } catch {}
+  }
+}
+let stopSignalReceived = false;
+function onStopSignal(signal) {
+  if (stopSignalReceived) {
+    killAllChildren("SIGKILL");
+    process.exit(signal === "SIGINT" ? 130 : 143);
+    return;
+  }
+  stopSignalReceived = true;
+  killAllChildren("SIGTERM");
+  setTimeout(() => killAllChildren("SIGKILL"), 5000).unref();
+}
+process.on("SIGINT", () => onStopSignal("SIGINT"));
+process.on("SIGTERM", () => onStopSignal("SIGTERM"));
 
 const { spawn } = require("node:child_process");
 let raw = "";
@@ -37,6 +66,16 @@ process.stdin.on("end", () => {
   }
   if (!jobs.length) { process.stdout.write("[]"); return; }
   const CAP = 32 * 1024 * 1024;
+  // The parent (runAgentBatchOutcomes) grants maxBuffer = 34MB PER JOB for
+  // the COMBINED NDJSON stream it captures from this child. CAP above bounds
+  // each job's RAW stdout bytes, but the line written by settle() is the
+  // ESCAPED serialization — JSON escaping grows bytes (quotes and
+  // backslashes 2x, control chars up to 6x as \uXXXX), so a raw-capped
+  // stdout could still serialize into a line far past the parent's per-job
+  // budget, push the combined stream over maxBuffer, and ENOBUFS the WHOLE
+  // batch. LINE_CAP bounds the SERIALIZED line itself, held under the
+  // parent's 34MB per-job grant with a small safety margin.
+  const LINE_CAP = 33 * 1024 * 1024;
   jobs.forEach((job, i) => {
     let stdout = "";
     let stdoutBytes = 0;
@@ -45,7 +84,15 @@ process.stdin.on("end", () => {
     const settle = (o) => {
       if (settled) return;
       settled = true;
-      process.stdout.write(JSON.stringify({ i, ...o }) + "\n");
+      let line = JSON.stringify({ i, ...o }) + "\n";
+      const lineBytes = Buffer.byteLength(line);
+      if (lineBytes > LINE_CAP) {
+        // Same fail-closed shape as the raw-cap path in the close handler
+        // below: capped output is never evidence, so drop it entirely and
+        // name the cap — never ship a line the parent's buffer cannot hold.
+        line = JSON.stringify({ i, spawnError: `serialized stdout line exceeded ${LINE_CAP} byte cap (${lineBytes} bytes)`, exitCode: null, stdout: "" }) + "\n";
+      }
+      process.stdout.write(line);
     };
     let child;
     try {
@@ -54,6 +101,7 @@ process.stdin.on("end", () => {
       settle({ spawnError: String((error && error.message) || error), exitCode: null, stdout: "" });
       return;
     }
+    children.add(child);
     const term = setTimeout(() => { try { child.kill("SIGTERM"); } catch {} }, job.timeoutMs);
     const kill = setTimeout(() => { try { child.kill("SIGKILL"); } catch {} }, job.timeoutMs + 5000);
     child.stdout.on("data", (d) => {
@@ -71,10 +119,12 @@ process.stdin.on("end", () => {
     child.stderr.on("data", () => {});
     child.on("error", (error) => {
       clearTimeout(term); clearTimeout(kill);
+      children.delete(child);
       settle({ spawnError: String((error && error.message) || error), exitCode: null, stdout });
     });
     child.on("close", (code) => {
       clearTimeout(term); clearTimeout(kill);
+      children.delete(child);
       if (stdoutTruncated) {
         settle({ spawnError: `stdout exceeded ${CAP} byte cap (${stdoutBytes} bytes)`, exitCode: null, stdout: "" });
         return;

package/scripts/dogfood-release.js

@@ -6,7 +6,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { CoolWorkflowRunner } = require("../dist/shell/orchestrator.js");
 
-const TARGET_VERSION = "0.2.1";
+const TARGET_VERSION = "0.2.3";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");

package/scripts/fake-date-for-reproduction.js

@@ -0,0 +1,44 @@
+"use strict";
+
+// fake-date-for-reproduction.js — a Node `--require` preload used ONLY by
+// verify-bump-reproduction.sh. It pins `new Date()` (no-args construction)
+// and `Date.now()` to a fixed instant, read from CW_FAKE_DATE (an ISO date or
+// YYYY-MM-DD string). `new Date(explicit args)` is left untouched.
+//
+// WHY a runtime-level override, not an application-level env var: the
+// scratch worktree checks out the APPROVED PARENT commit and runs ITS OWN
+// copy of bump-version.js/sync-project-index.js — which, for every commit
+// that predates this mechanism (i.e. every real release ever cut so far),
+// has no idea any such override exists. An app-level env var a script has to
+// explicitly read is a no-op against code that doesn't know to read it — it
+// can only ever help releases cut AFTER the mechanism itself lands, making
+// "reproduce a past release" true only by calendar coincidence (confirmed:
+// re-running v0.2.0's real approved-parent/tagged pair on a day other than
+// its actual cut day fails with a date-only diff in project-index.md).
+// Intercepting the Date GLOBAL, before any application code runs, works
+// identically regardless of which script version executes — old or new.
+//
+// Usage: NODE_OPTIONS="--require /path/to/this/file.js" CW_FAKE_DATE=2026-07-05 <command>
+
+const pinned = process.env.CW_FAKE_DATE;
+if (pinned) {
+  const fixedMs = new Date(pinned).getTime();
+  if (Number.isNaN(fixedMs)) {
+    process.stderr.write(`fake-date-for-reproduction: CW_FAKE_DATE is not a valid date: ${pinned}\n`);
+    process.exit(1);
+  }
+  const RealDate = Date;
+  class FakeDate extends RealDate {
+    constructor(...args) {
+      if (args.length === 0) {
+        super(fixedMs);
+      } else {
+        super(...args);
+      }
+    }
+    static now() {
+      return fixedMs;
+    }
+  }
+  global.Date = FakeDate;
+}

package/scripts/golden-path.js

@@ -33,7 +33,7 @@ function main() {
     const appValidation = runJson(["app", "validate", "end-to-end-golden-path"], pluginRoot);
     assert.equal(appValidation.valid, true);
     assert.equal(appValidation.summary.id, "end-to-end-golden-path");
-    assert.equal(appValidation.summary.version, "0.2.1");
+    assert.equal(appValidation.summary.version, "0.2.3");
 
     const plan = runJson(
       [
@@ -42,7 +42,7 @@ function main() {
         "--repo",
         tmp,
         "--question",
-        "Prove the deterministic v0.2.1 end-to-end golden path."
+        "Prove the deterministic v0.2.3 end-to-end golden path."
       ],
       pluginRoot
     );
@@ -52,7 +52,7 @@ function main() {
 
     let state = readJson(plan.statePath);
     assert.equal(state.workflow.app.id, "end-to-end-golden-path");
-    assert.equal(state.workflow.app.version, "0.2.1");
+    assert.equal(state.workflow.app.version, "0.2.3");
     assert.equal(state.loopStage, "interpret");
 
     const dispatch = runJson(["dispatch", plan.runId, "--limit", "1", "--sandbox", "readonly"], tmp);
@@ -195,7 +195,7 @@ function main() {
     assert.equal(reportPath, plan.reportPath);
     assert.ok(fs.existsSync(reportPath));
     const report = fs.readFileSync(reportPath, "utf8");
-    assert.match(report, /Workflow App: end-to-end-golden-path@0\.2\.1/);
+    assert.match(report, /Workflow App: end-to-end-golden-path@0\.2\.3/);
     assert.match(report, /## Candidates/);
     assert.match(report, /## Trust Audit/);
     assert.match(report, /## Acceptance Rationale/);

package/scripts/purity-baseline.json

@@ -0,0 +1,71 @@
+{
+  "builtinViolations": {
+    "core/state/run-paths.ts": [
+      "node:fs"
+    ],
+    "core/trust/telemetry-attestation.ts": [
+      "node:fs"
+    ]
+  },
+  "clockEnvCounts": {
+    "core/multi-agent/candidate-scoring.ts": {
+      "new Date()": 1
+    },
+    "core/pipeline/runner.ts": {
+      "new Date()": 1
+    },
+    "core/state/migrations.ts": {
+      "process.cwd()": 1
+    },
+    "core/state/state-explosion/digest.ts": {
+      "new Date()": 1
+    },
+    "core/state/state-explosion/graph.ts": {
+      "new Date()": 1
+    },
+    "core/state/state-explosion/report.ts": {
+      "new Date()": 1
+    },
+    "core/state/state-node.ts": {
+      "new Date()": 5
+    },
+    "core/trust/evidence-grounding.ts": {
+      "process.env": 3
+    }
+  },
+  "layerViolations": {
+    "core/capability-table.ts": [
+      "../wiring/capability-table"
+    ],
+    "wiring/capability-table/basics.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/exec-backend.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/multi-agent.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/pipeline.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/registry-core.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/reporting.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/scheduling-registry.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/state.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/trust-ledger.ts": [
+      "../../cli/io"
+    ],
+    "wiring/capability-table/workflow-apps.ts": [
+      "../../cli/io"
+    ]
+  }
+}