cool-workflow 0.2.1 → 0.2.3

package/scripts/version-sync-check.js

@@ -20,7 +20,7 @@ const repoRoot = path.resolve(pluginRoot, "..", "..");
 // CI checks out HEAD, so HEAD === the tree it is releasing.
 //
 // Fallback to the filesystem only when we cannot read from HEAD: not a git work
-// tree, or the path is not tracked at HEAD (e.g. the gitignored package-lock).
+// tree, or the path is not tracked at HEAD.
 // node + git only — no ripgrep (CI portability rule).
 const insideGitWorkTree = (() => {
   const r = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], { cwd: repoRoot, encoding: "utf8" });
@@ -36,7 +36,7 @@ function readReleaseSource(relativePath) {
       maxBuffer: 1024 * 1024 * 32
     });
     if (r.status === 0) return { text: r.stdout, exists: true, fromHead: true };
-    // Not tracked at HEAD — fall through to the working tree (e.g. package-lock).
+    // Not tracked at HEAD — fall through to the working tree.
   }
   const abs = path.join(repoRoot, relativePath);
   if (!fs.existsSync(abs)) return { text: null, exists: false, fromHead: false };
@@ -56,9 +56,14 @@ const canonicalApps = CANONICAL_APP_IDS;
 function main() {
   const checks = [];
   checkJson("plugins/cool-workflow/package.json", "version", VERSION, checks);
-  // package-lock.json is a gitignored install artifact (the documented install
-  // uses `npm install --no-package-lock`), so only validate it when present.
+  // package-lock.json is tracked now, but the documented install still works
+  // without it (`npm install --no-package-lock`), so only validate it when
+  // present. Check BOTH version fields: the top-level one and the root-package
+  // entry packages[""].version — the second one is the field npm keeps in step
+  // with package.json on `npm install`, and it is the one that went stale
+  // (0.1.97) through the v0.2.0/v0.2.1 cuts while only the first was checked.
   checkJsonIfPresent("plugins/cool-workflow/package-lock.json", "version", VERSION, checks);
+  checkNestedJsonIfPresent("plugins/cool-workflow/package-lock.json", ["packages", "", "version"], VERSION, checks);
   checkJson("plugins/cool-workflow/.codex-plugin/plugin.json", "version", VERSION, checks);
   checkJson("plugins/cool-workflow/server.json", "version", VERSION, checks);
   checkNestedJson("plugins/cool-workflow/server.json", ["packages", 0, "version"], VERSION, checks);
@@ -160,7 +165,7 @@ function main() {
   checkIncludes("plugins/cool-workflow/docs/run-retention-reclamation.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "run-retention-reclamation.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/run-retention-reclamation-smoke.js", "run-retention-reclamation-smoke", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "gc.plan", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/scheduling-registry.ts", "gc.plan", checks);
   checkIncludes("plugins/cool-workflow/docs/durable-state-and-locking.7.md", "Durable State & Locking", checks);
   checkIncludes("plugins/cool-workflow/docs/durable-state-and-locking.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "durable-state-and-locking.7.md", checks);
@@ -168,33 +173,37 @@ function main() {
   checkIncludes("plugins/cool-workflow/src/shell/fs-atomic.ts", "withFileLock", checks);
   checkIncludes("plugins/cool-workflow/src/shell/drive.ts", "driveStep", checks);
   checkIncludes("plugins/cool-workflow/dist/shell/drive.js", "driveStep", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "run.drive", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/pipeline.ts", "run.drive", checks);
   checkIncludes("plugins/cool-workflow/src/shell/collaboration-io.ts", "deriveReviewState", checks);
   checkIncludes("plugins/cool-workflow/dist/shell/collaboration-io.js", "deriveReviewState", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "review.status", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/multi-agent.ts", "review.status", checks);
   checkIncludes("plugins/cool-workflow/src/shell/observability.ts", "deriveMetricsReport", checks);
   checkIncludes("plugins/cool-workflow/dist/shell/observability.js", "deriveMetricsReport", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "metrics.show", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/reporting.ts", "metrics.show", checks);
   checkIncludes("plugins/cool-workflow/manifest/pricing.policy.json", "schemaVersion", checks);
   checkIncludes("plugins/cool-workflow/src/shell/workbench.ts", "buildWorkbenchRunView", checks);
   checkIncludes("plugins/cool-workflow/dist/shell/workbench.js", "buildWorkbenchRunView", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "workbench.view", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/reporting.ts", "workbench.view", checks);
   checkIncludes("plugins/cool-workflow/src/shell/execution-backend/registry.ts", "ExecutionBackend", checks);
   checkIncludes("plugins/cool-workflow/dist/shell/execution-backend/registry.js", "ExecutionBackend", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "backend.list", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/exec-backend.ts", "backend.list", checks);
   checkIncludes("plugins/cool-workflow/src/shell/run-registry-io.ts", "RunRegistry", checks);
   checkIncludes("plugins/cool-workflow/dist/shell/run-registry-io.js", "RunRegistry", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "registry.refresh", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/scheduling-registry.ts", "registry.refresh", checks);
   checkIncludes("plugins/cool-workflow/package.json", "parity:check", checks);
   checkIncludes("plugins/cool-workflow/scripts/parity-check.js", "buildParityReport", checks);
   checkIncludes("plugins/cool-workflow/test/cli-mcp-parity-smoke.js", "cli-mcp-parity-smoke", checks);
-  checkIncludes("plugins/cool-workflow/src/core/capability-table.ts", "export const REGISTRY", checks);
+  checkIncludes("plugins/cool-workflow/src/wiring/capability-table/registry-core.ts", "export const REGISTRY", checks);
   checkIncludes("plugins/cool-workflow/src/shell/pipeline-cli.ts", "planSummary", checks);
   checkIncludes("plugins/cool-workflow/dist/core/capability-table.js", "REGISTRY", checks);
   checkIncludes("plugins/cool-workflow/docs/multi-agent-runtime-core.7.md", "Multi-Agent Runtime Core", checks);
   checkIncludes("plugins/cool-workflow/docs/dogfood-one-real-repo.7.md", "Dogfood One Real Repo", checks);
   checkIncludes("plugins/cool-workflow/docs/getting-started.md", "npm run release:check", checks);
   checkIncludes("plugins/cool-workflow/package.json", "eval:replay", checks);
+  checkIncludes("plugins/cool-workflow/docs/trust-audit-anchor.7.md", "Trust Audit Anchor", checks);
+  checkIncludes("plugins/cool-workflow/docs/trust-audit-anchor.7.md", VERSION, checks);
+  checkIncludes("plugins/cool-workflow/docs/index.md", "trust-audit-anchor.7.md", checks);
+  checkIncludes("plugins/cool-workflow/test/trust-audit-anchor-smoke.js", "trust-audit-anchor-smoke", checks);
   checkIncludes("plugins/cool-workflow/docs/release-and-migration.7.md", VERSION, checks);
   checkIncludes("CHANGELOG.md", `## ${VERSION}`, checks);
   checkIncludes("RELEASE.md", VERSION, checks);
@@ -227,6 +236,18 @@ function checkNestedJson(relativePath, keyPath, expected, checks) {
   checks.push({ path: relativePath, key: keyPath.join("."), value });
 }
 
+function checkNestedJsonIfPresent(relativePath, keyPath, expected, checks) {
+  const src = readReleaseSource(relativePath);
+  if (!src.exists) {
+    checks.push({ path: relativePath, key: keyPath.join("."), skipped: "absent" });
+    return;
+  }
+  let value = JSON.parse(src.text);
+  for (const key of keyPath) value = value?.[key];
+  assert.equal(value, expected, `${relativePath}.${keyPath.join(".")} must be ${expected}`);
+  checks.push({ path: relativePath, key: keyPath.join("."), value });
+}
+
 function checkJsonIfPresent(relativePath, key, expected, checks) {
   const src = readReleaseSource(relativePath);
   if (!src.exists) {

package/skills/cool-workflow/SKILL.md

@@ -62,16 +62,16 @@ Use this loop to explain workflow progress when reporting status.
 ## Operating Loop
 
 1. Pick or create a workflow.
-2. `node scripts/cw.js plan <workflow-id> ...` from the plugin root (or the
+2. `cw plan <workflow-id> ...` from the plugin root (or the
    absolute plugin script path).
-3. `node scripts/cw.js dispatch <run-id> --limit N` to create a dispatch
+3. `cw dispatch <run-id> --limit N` to create a dispatch
    manifest for the current phase. Add `--sandbox <profile-id>` when an explicit
    worker policy profile is needed.
 4. If — and only if — the user explicitly asked for agents, spawn one subagent
    per dispatched task with disjoint scopes.
 5. Save each subagent summary to `.cw/runs/<run-id>/results/<task-id>.md`.
-6. `node scripts/cw.js result <run-id> <task-id> <result-file>`.
-7. When all required work is complete, `node scripts/cw.js report <run-id>`.
+6. `cw result <run-id> <task-id> <result-file>`.
+7. When all required work is complete, `cw report <run-id>`.
 8. Synthesize the final user-facing answer from the report and verified
    evidence.
 
@@ -114,11 +114,11 @@ report chain. See `references/commands.md` for the exact invocations.
 ## Essential Commands
 
 ```bash
-node scripts/cw.js list
-node scripts/cw.js plan architecture-review --repo /path/to/repo --question "Is this architecture sound?"
-node scripts/cw.js dispatch <run-id> --limit 6
-node scripts/cw.js result <run-id> <task-id> /path/to/result.md
-node scripts/cw.js report <run-id> --show
+cw list
+cw plan architecture-review --repo /path/to/repo --question "Is this architecture sound?"
+cw dispatch <run-id> --limit 6
+cw result <run-id> <task-id> /path/to/result.md
+cw report <run-id> --show
 ```
 
 When working in this repository, the plugin root is `plugins/cool-workflow`.

package/skills/cool-workflow/references/commands.md

@@ -26,19 +26,20 @@ absolute plugin script path. Run data is written to `.cw/runs/<run-id>/` under
 ## Discovery & apps
 
 ```bash
-node scripts/cw.js list
-node scripts/cw.js app list
-node scripts/cw.js app show architecture-review
-node scripts/cw.js app show pr-review-fix-ci
-node scripts/cw.js app show release-cut
-node scripts/cw.js app show research-synthesis
-node scripts/cw.js app validate apps/architecture-review/app.json
-node scripts/cw.js app show workflow-app-framework-demo
-node scripts/cw.js app validate apps/workflow-app-framework-demo/app.json
-node scripts/cw.js app validate end-to-end-golden-path
-node scripts/cw.js app package workflow-app-framework-demo
-node scripts/cw.js app init my-app --title "My App"
-node scripts/cw.js init my-workflow --title "My Workflow"
+cw list
+cw search architecture
+cw app list
+cw app show architecture-review
+cw app show pr-review-fix-ci
+cw app show release-cut
+cw app show research-synthesis
+cw app validate apps/architecture-review/app.json
+cw app show workflow-app-framework-demo
+cw app validate apps/workflow-app-framework-demo/app.json
+cw app validate end-to-end-golden-path
+cw app package workflow-app-framework-demo
+cw app init my-app --title "My App"
+cw init my-workflow --title "My Workflow"
 ```
 
 The canonical app ids are `architecture-review`, `pr-review-fix-ci`,
@@ -62,16 +63,16 @@ harness; the reviewer is delegated via `CW_AGENT_COMMAND`/`CW_AGENT_ENDPOINT`
 ## Plan / dispatch / result / report
 
 ```bash
-node scripts/cw.js plan architecture-review --repo /path/to/repo --question "Is this architecture sound?"
-node scripts/cw.js status <run-id>
-node scripts/cw.js status <run-id> --json
-node scripts/cw.js graph <run-id>
-node scripts/cw.js graph <run-id> --json
-node scripts/cw.js dispatch <run-id> --limit 6
-node scripts/cw.js dispatch <run-id> --sandbox readonly
-node scripts/cw.js result <run-id> <task-id> /path/to/result.md
-node scripts/cw.js report <run-id>
-node scripts/cw.js report <run-id> --show
+cw plan architecture-review --repo /path/to/repo --question "Is this architecture sound?"
+cw status <run-id>
+cw status <run-id> --json
+cw graph <run-id>
+cw graph <run-id> --json
+cw dispatch <run-id> --limit 6
+cw dispatch <run-id> --sandbox readonly
+cw result <run-id> <task-id> /path/to/result.md
+cw report <run-id>
+cw report <run-id> --show
 ```
 
 Operator UX is human-readable by default for `status`, `graph`, report
@@ -87,12 +88,12 @@ role, group, fanout/fanin, blackboard, coordinator, candidate, commit, and audit
 records — deterministic recipes, not hidden autonomous coordination.
 
 ```bash
-node scripts/cw.js topology list
-node scripts/cw.js topology show map-reduce
-node scripts/cw.js topology validate map-reduce
-node scripts/cw.js topology apply <run-id> map-reduce --task task-id --mapper-count 2
-node scripts/cw.js topology summary <run-id>
-node scripts/cw.js topology graph <run-id>
+cw topology list
+cw topology show map-reduce
+cw topology validate map-reduce
+cw topology apply <run-id> map-reduce --task task-id --mapper-count 2
+cw topology summary <run-id>
+cw topology graph <run-id>
 ```
 
 ## Multi-agent host surface
@@ -103,22 +104,22 @@ plumbing. It wraps the topology, multi-agent, blackboard, candidate, commit, and
 audit primitives; it does not replace them.
 
 ```bash
-node scripts/cw.js multi-agent run <run-id> --topology judge-panel --task task-id
-node scripts/cw.js multi-agent status <run-id>
-node scripts/cw.js multi-agent step <run-id> --sandbox readonly
-node scripts/cw.js multi-agent blackboard <run-id> summary
-node scripts/cw.js multi-agent score <run-id> candidate-id --criterion correctness=1 --evidence ref
-node scripts/cw.js multi-agent select <run-id> candidate-id --reason "verified winner"
+cw multi-agent run <run-id> --topology judge-panel --task task-id
+cw multi-agent status <run-id>
+cw multi-agent step <run-id> --sandbox readonly
+cw multi-agent blackboard <run-id> summary
+cw multi-agent score <run-id> candidate-id --criterion correctness=1 --evidence ref
+cw multi-agent select <run-id> candidate-id --reason "verified winner"
 ```
 
 Operator views (who depends on whom, who is blocked, which evidence was adopted):
 
 ```bash
-node scripts/cw.js multi-agent summary <run-id>
-node scripts/cw.js multi-agent graph <run-id>
-node scripts/cw.js multi-agent dependencies <run-id>
-node scripts/cw.js multi-agent failures <run-id>
-node scripts/cw.js multi-agent evidence <run-id>
+cw multi-agent summary <run-id>
+cw multi-agent graph <run-id>
+cw multi-agent dependencies <run-id>
+cw multi-agent failures <run-id>
+cw multi-agent evidence <run-id>
 ```
 
 State Explosion Management — when a run grows too large to read, use derived,
@@ -126,11 +127,11 @@ provenance-backed digests (they never delete raw records and fail closed when
 stale; every synthetic node carries source ids and an expansion command):
 
 ```bash
-node scripts/cw.js summary refresh <run-id>
-node scripts/cw.js summary show <run-id>
-node scripts/cw.js blackboard summarize <run-id>
-node scripts/cw.js multi-agent summarize <run-id>
-node scripts/cw.js multi-agent graph <run-id> --view compact|critical-path|failures|... [--focus <id>] [--depth <n>]
+cw summary refresh <run-id>
+cw summary show <run-id>
+cw blackboard summarize <run-id>
+cw multi-agent summarize <run-id>
+cw multi-agent graph <run-id> --view compact|critical-path|failures|... [--focus <id>] [--depth <n>]
 ```
 
 Trust / Policy / Audit — inspect role authority, message provenance, blackboard
@@ -138,11 +139,11 @@ write decisions, judge rationale, panel decisions, and why a result is trusted
 (missing policy/evidence/provenance/rationale fail closed):
 
 ```bash
-node scripts/cw.js audit multi-agent <run-id>
-node scripts/cw.js audit policy <run-id>
-node scripts/cw.js audit role <run-id>
-node scripts/cw.js audit blackboard <run-id>
-node scripts/cw.js audit judge <run-id>
+cw audit multi-agent <run-id>
+cw audit policy <run-id>
+cw audit role <run-id>
+cw audit blackboard <run-id>
+cw audit judge <run-id>
 ```
 
 ## Multi-agent low-level state
@@ -154,12 +155,12 @@ transitions, duplicate memberships, ambiguous dispatch attachment, and missing
 fanin evidence fail closed.
 
 ```bash
-node scripts/cw.js multi-agent run <run-id> --id ma --objective "coordinated work"
-node scripts/cw.js multi-agent role <run-id> role --multi-agent-run ma --responsibility "do work" --required-evidence "result evidence"
-node scripts/cw.js multi-agent group <run-id> group --multi-agent-run ma --task task-id
-node scripts/cw.js multi-agent fanout <run-id> fanout --group group --reason "split work" --role role --task task-id
-node scripts/cw.js dispatch <run-id> --multi-agent-run ma --multi-agent-group group --multi-agent-role role --multi-agent-fanout fanout
-node scripts/cw.js multi-agent fanin <run-id> fanin --group group --fanout fanout --required-role role
+cw multi-agent run <run-id> --id ma --objective "coordinated work"
+cw multi-agent role <run-id> role --multi-agent-run ma --responsibility "do work" --required-evidence "result evidence"
+cw multi-agent group <run-id> group --multi-agent-run ma --task task-id
+cw multi-agent fanout <run-id> fanout --group group --reason "split work" --role role --task task-id
+cw dispatch <run-id> --multi-agent-run ma --multi-agent-group group --multi-agent-role role --multi-agent-fanout fanout
+cw multi-agent fanin <run-id> fanin --group group --fanout fanout --required-role role
 ```
 
 ## Eval & replay
@@ -168,12 +169,12 @@ Use when a topology-backed multi-agent run needs release-gate evidence.
 Artifacts live under `.cw/evals/<suite-id>/` as plain JSON plus `report.md`.
 
 ```bash
-node scripts/cw.js eval snapshot <run-id> --id suite-id
-node scripts/cw.js eval replay .cw/evals/suite-id/snapshot.json
-node scripts/cw.js eval compare .cw/evals/suite-id/snapshot.json .cw/evals/suite-id/replay-run.json
-node scripts/cw.js eval score .cw/evals/suite-id/replay-run.json
-node scripts/cw.js eval gate .cw/evals/suite-id
-node scripts/cw.js eval report .cw/evals/suite-id/replay-run.json
+cw eval snapshot <run-id> --id suite-id
+cw eval replay .cw/evals/suite-id/snapshot.json
+cw eval compare .cw/evals/suite-id/snapshot.json .cw/evals/suite-id/replay-run.json
+cw eval score .cw/evals/suite-id/replay-run.json
+cw eval gate .cw/evals/suite-id
+cw eval report .cw/evals/suite-id/replay-run.json
 ```
 
 ## Blackboard & coordinator
@@ -183,14 +184,14 @@ context frames, artifact refs, snapshots, and coordinator decisions under
 `.cw/runs/<run-id>/blackboard/`.
 
 ```bash
-node scripts/cw.js blackboard summary <run-id>
-node scripts/cw.js blackboard topic create <run-id> --id topic --title "Shared context"
-node scripts/cw.js blackboard message post <run-id> --topic topic --body "message"
-node scripts/cw.js blackboard context put <run-id> --topic topic --kind fact --key finding --value "evidence-backed fact"
-node scripts/cw.js blackboard artifact add <run-id> --topic topic --path /path/to/result.md --kind worker-result
-node scripts/cw.js blackboard snapshot <run-id>
-node scripts/cw.js coordinator summary <run-id>
-node scripts/cw.js coordinator decision <run-id> --kind conflict-resolution --outcome accepted --reason "evidence supports this"
+cw blackboard summary <run-id>
+cw blackboard topic create <run-id> --id topic --title "Shared context"
+cw blackboard message post <run-id> --topic topic --body "message"
+cw blackboard context put <run-id> --topic topic --kind fact --key finding --value "evidence-backed fact"
+cw blackboard artifact add <run-id> --topic topic --path /path/to/result.md --kind worker-result
+cw blackboard snapshot <run-id>
+cw coordinator summary <run-id>
+cw coordinator decision <run-id> --kind conflict-resolution --outcome accepted --reason "evidence supports this"
 ```
 
 ## Sandbox profiles
@@ -201,10 +202,10 @@ CW enforces profile validation and worker result acceptance; the agent host
 enforces OS/process/network/environment controls.
 
 ```bash
-node scripts/cw.js sandbox list
-node scripts/cw.js sandbox show readonly
-node scripts/cw.js sandbox validate ./site-sandbox.json
-node scripts/cw.js worker manifest <run-id> <worker-id>
+cw sandbox list
+cw sandbox show readonly
+cw sandbox validate ./site-sandbox.json
+cw worker manifest <run-id> <worker-id>
 ```
 
 ## Commit, state & summaries
@@ -214,14 +215,14 @@ dry-runs migration and normalization; newer unsupported schemas fail closed and
 unknown user data is preserved.
 
 ```bash
-node scripts/cw.js commit <run-id> --verifier <node-id> --reason "verified result"
-node scripts/cw.js commit <run-id> --selection <selection-id> --reason "verified winner"
-node scripts/cw.js commit <run-id> --allow-unverified-checkpoint --reason "manual checkpoint"
-node scripts/cw.js worker summary <run-id>
-node scripts/cw.js candidate summary <run-id>
-node scripts/cw.js feedback summary <run-id>
-node scripts/cw.js commit summary <run-id>
-node scripts/cw.js state check <run-id>
+cw commit <run-id> --verifier <node-id> --reason "verified result"
+cw commit <run-id> --selection <selection-id> --reason "verified winner"
+cw commit <run-id> --allow-unverified-checkpoint --reason "manual checkpoint"
+cw worker summary <run-id>
+cw candidate summary <run-id>
+cw feedback summary <run-id>
+cw commit summary <run-id>
+cw state check <run-id>
 ```
 
 ## Scheduling & routines
@@ -232,12 +233,12 @@ prompt is handled. `routine create`/`routine fire` handle API/GitHub trigger
 events.
 
 ```bash
-node scripts/cw.js loop --intervalMinutes 30 --prompt "Continue this workflow."
-node scripts/cw.js schedule create --kind loop --intervalMinutes 30 --prompt "Continue this workflow."
-node scripts/cw.js schedule due
-node scripts/cw.js schedule daemon --once
-node scripts/cw.js routine create --kind github --prompt "Handle this GitHub event."
-node scripts/cw.js routine fire github payload.json
+cw loop --intervalMinutes 30 --prompt "Continue this workflow."
+cw schedule create --kind loop --intervalMinutes 30 --prompt "Continue this workflow."
+cw schedule due
+cw schedule daemon --once
+cw routine create --kind github --prompt "Handle this GitHub event."
+cw routine fire github payload.json
 ```
 
 ## Release & maintenance npm scripts

package/ui/workbench/app.css

@@ -12,6 +12,20 @@
   --absent: #d29922;
   --bad: #f85149;
 }
+@media (prefers-color-scheme: light) {
+  :root {
+    --bg: #f6f7f9;
+    --panel: #ffffff;
+    --panel-2: #eef0f4;
+    --ink: #1b1f27;
+    --muted: #5b6472;
+    --line: #d7dce4;
+    --accent: #1a6fd6;
+    --present: #1a7f37;
+    --absent: #9a6700;
+    --bad: #cf222e;
+  }
+}
 * { box-sizing: border-box; }
 body {
   margin: 0;
@@ -45,8 +59,17 @@ input[type="search"] {
 }
 .run-list li:hover { border-color: var(--accent); }
 .run-list li.active { border-color: var(--accent); background: var(--panel-2); }
-.run-list .rid { font-family: ui-monospace, monospace; font-size: 12px; }
+.run-list .rid { font-family: ui-monospace, monospace; font-size: 12px; display: flex; align-items: center; gap: 6px; }
 .run-list .meta { color: var(--muted); font-size: 11px; margin-top: 2px; }
+.status-dot {
+  display: inline-block; width: 8px; height: 8px; border-radius: 50%; flex: none;
+  background: var(--muted);
+}
+.status-dot.running { background: var(--accent); }
+.status-dot.completed { background: var(--present); }
+.status-dot.queued, .status-dot.archived, .status-dot.reclaimed { background: var(--muted); }
+.status-dot.blocked { background: var(--absent); }
+.status-dot.failed { background: var(--bad); }
 .detail { overflow-y: auto; padding: 16px 20px; }
 .detail .empty { color: var(--muted); }
 .tabs { display: flex; gap: 6px; flex-wrap: wrap; border-bottom: 1px solid var(--line); padding-bottom: 8px; margin-bottom: 12px; }
@@ -74,3 +97,16 @@ pre.json {
 .kv { display: flex; gap: 16px; flex-wrap: wrap; padding: 8px 12px; font-size: 12px; color: var(--muted); }
 .kv b { color: var(--ink); font-weight: 600; }
 .err { color: var(--bad); }
+.struct-block { padding: 10px 12px; border-top: 1px solid var(--line); }
+.struct-block:first-child { border-top: none; }
+.struct-block .struct-title { font-size: 11px; text-transform: uppercase; letter-spacing: 0.04em; color: var(--muted); margin-bottom: 6px; }
+.struct-table { width: 100%; border-collapse: collapse; font-size: 12px; }
+.struct-table th, .struct-table td {
+  text-align: left; padding: 4px 8px; border-bottom: 1px solid var(--line);
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace; vertical-align: top;
+}
+.struct-table th { color: var(--muted); font-weight: 400; }
+.struct-edges { list-style: none; margin: 0; padding: 0; font-size: 12px; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
+.struct-edges li { padding: 3px 0; }
+.struct-edges .arrow { color: var(--muted); padding: 0 6px; }
+.struct-empty { color: var(--muted); font-size: 12px; }

package/ui/workbench/app.js

@@ -62,20 +62,22 @@ async function loadIndex() {
   const reg = view.registry || {};
   const fresh = document.getElementById("registry-freshness");
   fresh.innerHTML = "";
-  fresh.append("registry ", freshnessBadge(reg.freshness), ` · scope ${view.scope}`);
+  fresh.append("registry ", freshnessBadge(reg.freshness && reg.freshness.status), ` · scope ${view.scope}`);
   const records = (view.runs && view.runs.records) || [];
   if (!records.length) {
     list.appendChild(el("li", { class: "muted", text: "no runs indexed in this scope" }));
     return;
   }
   for (const record of records) {
+    const lifecycle = record.lifecycle || record.status || "";
     const li = el("li", { class: state.activeRunId === record.runId ? "active" : "" }, [
-      el("div", { class: "rid", text: record.runId }),
+      el("div", { class: "rid" }, [
+        el("span", { class: `status-dot ${lifecycle}`, title: lifecycle || "unknown" }),
+        document.createTextNode(record.runId)
+      ]),
       el("div", {
         class: "meta",
-        text: [record.appId || record.workflowId, record.lifecycle || record.status, record.repo]
-          .filter(Boolean)
-          .join(" · ")
+        text: [record.appId || record.workflowId, lifecycle, record.repo].filter(Boolean).join(" · ")
       })
     ]);
     li.addEventListener("click", () => selectRun(record.runId));
@@ -138,13 +140,129 @@ function renderPanel(name, panel) {
   card.appendChild(head);
   card.appendChild(el("div", { class: "kv" }, [el("span", { class: "src", text: panel.cli }), el("span", { class: "src", text: panel.mcp })]));
   if (panel.status === "present") {
-    card.appendChild(el("pre", { class: "json", text: JSON.stringify(panel.data, null, 2) }));
+    card.appendChild(renderStructured(panel.data) || el("pre", { class: "json", text: JSON.stringify(panel.data, null, 2) }));
   } else {
     card.appendChild(el("div", { class: "absent-note", text: `absent — ${panel.error || "source unreadable"}` }));
   }
   return card;
 }
 
+// Purely presentational shape-detection: recognizes the two payload shapes
+// that recur across several capabilities (a nodes/edges graph, and one or
+// more TrustAuditEvent[] arrays) and tables them instead of dumping raw
+// JSON. Anything that doesn't match either shape falls back to the plain
+// JSON dump in renderPanel — no per-capability special-casing.
+function isNodeEdgeGraph(data) {
+  return !!data && Array.isArray(data.nodes) && Array.isArray(data.edges);
+}
+
+function isEventArray(value) {
+  return (
+    Array.isArray(value) &&
+    value.length > 0 &&
+    value.every((item) => item && typeof item === "object" && typeof item.kind === "string" && typeof item.decision === "string")
+  );
+}
+
+function renderStructured(data) {
+  if (isNodeEdgeGraph(data)) return renderGraph(data);
+  if (data && typeof data === "object" && !Array.isArray(data)) {
+    const eventKeys = Object.keys(data).filter((key) => isEventArray(data[key]));
+    if (eventKeys.length > 0) return renderEventGroups(data, eventKeys);
+  }
+  return null;
+}
+
+function renderGraph(data) {
+  const wrap = el("div");
+  const nodesBlock = el("div", { class: "struct-block" }, [el("div", { class: "struct-title", text: `nodes (${data.nodes.length})` })]);
+  if (data.nodes.length === 0) {
+    nodesBlock.appendChild(el("div", { class: "struct-empty", text: "none" }));
+  } else {
+    const table = el("table", { class: "struct-table" }, [
+      el("tr", {}, ["id", "kind", "status", "label"].map((h) => el("th", { text: h })))
+    ]);
+    for (const node of data.nodes) {
+      table.appendChild(
+        el("tr", {}, [
+          el("td", { text: node.id }),
+          el("td", { text: node.kind }),
+          el("td", { text: node.status }),
+          el("td", { text: node.label })
+        ])
+      );
+    }
+    nodesBlock.appendChild(table);
+  }
+  wrap.appendChild(nodesBlock);
+
+  const edgesBlock = el("div", { class: "struct-block" }, [el("div", { class: "struct-title", text: `edges (${data.edges.length})` })]);
+  if (data.edges.length === 0) {
+    edgesBlock.appendChild(el("div", { class: "struct-empty", text: "none" }));
+  } else {
+    const list = el("ul", { class: "struct-edges" });
+    for (const edge of data.edges) {
+      list.appendChild(
+        el("li", {}, [
+          document.createTextNode(edge.from),
+          el("span", { class: "arrow", text: edge.label ? `--${edge.label}-->` : "-->" }),
+          document.createTextNode(edge.to)
+        ])
+      );
+    }
+    edgesBlock.appendChild(list);
+  }
+  wrap.appendChild(edgesBlock);
+  return wrap;
+}
+
+function humanizeKey(key) {
+  return key.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase();
+}
+
+function renderEventGroups(data, confirmedEventKeys) {
+  // At least one sibling array on this object is confirmed TrustAuditEvent-
+  // shaped -- so its OTHER array fields that happen to be empty (e.g. a
+  // healthy `policyViolations: []`) are almost certainly the same family
+  // and read better as their own "(0)" table than buried in the raw
+  // "other fields" JSON below. An empty array can't self-identify by
+  // content, so this only widens the match within an already-confirmed
+  // object, never anywhere else.
+  const eventKeys = Object.keys(data).filter(
+    (key) => confirmedEventKeys.includes(key) || (Array.isArray(data[key]) && data[key].length === 0)
+  );
+  const wrap = el("div");
+  for (const key of eventKeys) {
+    const events = [...data[key]].sort((a, b) => String(a.createdAt || "").localeCompare(String(b.createdAt || "")));
+    const block = el("div", { class: "struct-block" }, [el("div", { class: "struct-title", text: `${humanizeKey(key)} (${events.length})` })]);
+    const table = el("table", { class: "struct-table" }, [
+      el("tr", {}, ["time", "kind", "decision", "source", "actor"].map((h) => el("th", { text: h })))
+    ]);
+    for (const event of events) {
+      table.appendChild(
+        el("tr", {}, [
+          el("td", { text: event.createdAt || "" }),
+          el("td", { text: event.kind || "" }),
+          el("td", { text: event.decision || "" }),
+          el("td", { text: event.source || "" }),
+          el("td", { text: event.actor || event.workerId || event.taskId || "" })
+        ])
+      );
+    }
+    block.appendChild(table);
+    wrap.appendChild(block);
+  }
+  const rest = Object.keys(data).filter((key) => !eventKeys.includes(key) && key !== "schemaVersion" && key !== "runId");
+  const restData = {};
+  for (const key of rest) restData[key] = data[key];
+  if (Object.keys(restData).length > 0) {
+    const block = el("div", { class: "struct-block" }, [el("div", { class: "struct-title", text: "other fields" })]);
+    block.appendChild(el("pre", { class: "json", text: JSON.stringify(restData, null, 2) }));
+    wrap.appendChild(block);
+  }
+  return wrap;
+}
+
 document.getElementById("refresh").addEventListener("click", loadIndex);
 document.getElementById("filter").addEventListener("input", debounce(loadIndex, 200));