cool-workflow 0.2.2 → 0.2.4

package/scripts/verify-verdict-signature.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+"use strict";
+
+// verify-verdict-signature.js — verify an ed25519 signature over a committed
+// release verdict file, against the committed public key
+// (.cw-release/verdict-signing.pub). Portable (node + node:crypto only) so
+// CI (release-gate.yml, npm-publish.yml) and the local block-unapproved-tag.sh
+// hook can all shell out to the SAME check instead of three drifting copies.
+//
+// Exit 0: signature verifies. Exit 1: missing file, unreadable key, or a
+// signature that does not match (tampered verdict, wrong key, hand-written
+// verdict with no real signature). Never throws uncaught — callers rely on
+// the exit code alone, not stderr text.
+//
+// Usage: node verify-verdict-signature.js <verdict-file> <sig-file> <pubkey-file>
+
+const fs = require("node:fs");
+const crypto = require("node:crypto");
+
+function fail(message) {
+  process.stderr.write(`verify-verdict-signature: ${message}\n`);
+  process.exit(1);
+}
+
+const [, , verdictPath, sigPath, pubkeyPath] = process.argv;
+if (!verdictPath || !sigPath || !pubkeyPath) {
+  process.stderr.write("usage: verify-verdict-signature.js <verdict-file> <sig-file> <pubkey-file>\n");
+  process.exit(2);
+}
+
+let message;
+try {
+  message = fs.readFileSync(verdictPath);
+} catch (error) {
+  fail(`cannot read verdict file ${verdictPath}: ${error.message}`);
+}
+
+let signature;
+try {
+  signature = Buffer.from(fs.readFileSync(sigPath, "utf8").trim(), "base64");
+  if (signature.length === 0) fail(`signature file ${sigPath} is empty`);
+} catch (error) {
+  fail(`cannot read signature file ${sigPath}: ${error.message}`);
+}
+
+let publicKey;
+try {
+  publicKey = crypto.createPublicKey(fs.readFileSync(pubkeyPath, "utf8"));
+} catch (error) {
+  fail(`cannot read public key ${pubkeyPath}: ${error.message}`);
+}
+
+let ok = false;
+try {
+  ok = crypto.verify(null, message, publicKey, signature);
+} catch (error) {
+  fail(`verification error: ${error.message}`);
+}
+
+if (!ok) fail(`signature does not match ${verdictPath} (tampered, wrong key, or not a real signature)`);
+process.exit(0);

package/scripts/version-sync-check.js

@@ -106,68 +106,68 @@ function main() {
   // above (version.ts/dist/package.json/manifests/docs) still pin the release.
   checkIncludes("plugins/cool-workflow/docs/index.md", "release and migration", checks);
   checkIncludes("plugins/cool-workflow/docs/multi-agent-topologies.7.md", "Multi-Agent Topologies", checks);
-  checkIncludes("plugins/cool-workflow/docs/multi-agent-cli-mcp-surface.7.md", VERSION, checks);
-  checkIncludes("plugins/cool-workflow/docs/multi-agent-operator-ux.7.md", VERSION, checks);
-  checkIncludes("plugins/cool-workflow/docs/multi-agent-eval-replay-harness.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/multi-agent-cli-mcp-surface.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/multi-agent-operator-ux.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/multi-agent-eval-replay-harness.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/state-explosion-management.7.md", "State Explosion Management", checks);
-  checkIncludes("plugins/cool-workflow/docs/state-explosion-management.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/state-explosion-management.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/evidence-adoption-reasoning-chain.7.md", "Evidence Adoption Reasoning Chain", checks);
-  checkIncludes("plugins/cool-workflow/docs/evidence-adoption-reasoning-chain.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/evidence-adoption-reasoning-chain.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/coordinator-blackboard.7.md", "Coordinator / Blackboard", checks);
   checkIncludes("plugins/cool-workflow/docs/cli-mcp-parity.7.md", "CLI", checks);
-  checkIncludes("plugins/cool-workflow/docs/cli-mcp-parity.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/cli-mcp-parity.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "cli-mcp-parity.7.md", checks);
   checkIncludes("plugins/cool-workflow/docs/run-registry-control-plane.7.md", "Run Registry / Control Plane", checks);
-  checkIncludes("plugins/cool-workflow/docs/run-registry-control-plane.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/run-registry-control-plane.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "run-registry-control-plane.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/run-registry-control-plane-smoke.js", "run-registry-control-plane-smoke", checks);
   checkIncludes("plugins/cool-workflow/docs/execution-backends.7.md", "Execution Backends", checks);
-  checkIncludes("plugins/cool-workflow/docs/execution-backends.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/execution-backends.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "execution-backends.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/execution-backends-smoke.js", "execution-backends-smoke", checks);
   checkIncludes("plugins/cool-workflow/docs/web-desktop-workbench.7.md", "Web / Desktop Workbench", checks);
-  checkIncludes("plugins/cool-workflow/docs/web-desktop-workbench.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/web-desktop-workbench.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "web-desktop-workbench.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/web-desktop-workbench-smoke.js", "web-desktop-workbench-smoke", checks);
   checkIncludes("plugins/cool-workflow/docs/observability-cost-accounting.7.md", "Observability + Cost Accounting", checks);
-  checkIncludes("plugins/cool-workflow/docs/observability-cost-accounting.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/observability-cost-accounting.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "observability-cost-accounting.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/observability-cost-accounting-smoke.js", "observability-cost-accounting-smoke", checks);
   checkIncludes("plugins/cool-workflow/docs/team-collaboration.7.md", "Team Collaboration", checks);
-  checkIncludes("plugins/cool-workflow/docs/team-collaboration.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/team-collaboration.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "team-collaboration.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/team-collaboration-smoke.js", "team-collaboration-smoke", checks);
   checkIncludes("plugins/cool-workflow/docs/release-tooling.7.md", "Release Tooling", checks);
-  checkIncludes("plugins/cool-workflow/docs/release-tooling.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/release-tooling.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "release-tooling.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/release-tooling-smoke.js", "release-tooling-smoke", checks);
   checkIncludes("plugins/cool-workflow/docs/real-execution-backends.7.md", "Real Execution Backend Integrations", checks);
-  checkIncludes("plugins/cool-workflow/docs/real-execution-backends.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/real-execution-backends.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "real-execution-backends.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/real-execution-backends-smoke.js", "real-execution-backends-smoke", checks);
   checkIncludes("plugins/cool-workflow/docs/node-snapshot-diff-replay.7.md", "Node Snapshot / Diff / Replay", checks);
-  checkIncludes("plugins/cool-workflow/docs/node-snapshot-diff-replay.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/node-snapshot-diff-replay.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "node-snapshot-diff-replay.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/node-snapshot-diff-replay-smoke.js", "node-snapshot-diff-replay-smoke", checks);
   checkIncludes("plugins/cool-workflow/docs/contract-migration-tooling.7.md", "Contract Migration Tooling", checks);
-  checkIncludes("plugins/cool-workflow/docs/contract-migration-tooling.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/contract-migration-tooling.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "contract-migration-tooling.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/contract-migration-tooling-smoke.js", "contract-migration-tooling-smoke", checks);
   checkIncludes("plugins/cool-workflow/docs/control-plane-scheduling.7.md", "Control-Plane Scheduling", checks);
-  checkIncludes("plugins/cool-workflow/docs/control-plane-scheduling.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/control-plane-scheduling.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "control-plane-scheduling.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/control-plane-scheduling-smoke.js", "control-plane-scheduling-smoke", checks);
   checkIncludes("plugins/cool-workflow/docs/agent-delegation-drive.7.md", "Agent Delegation Drive", checks);
-  checkIncludes("plugins/cool-workflow/docs/agent-delegation-drive.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/agent-delegation-drive.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "agent-delegation-drive.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/agent-delegation-drive-smoke.js", "agent-delegation-drive-smoke", checks);
   checkIncludes("plugins/cool-workflow/docs/run-retention-reclamation.7.md", "Run Retention & Provable Reclamation", checks);
-  checkIncludes("plugins/cool-workflow/docs/run-retention-reclamation.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/run-retention-reclamation.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "run-retention-reclamation.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/run-retention-reclamation-smoke.js", "run-retention-reclamation-smoke", checks);
   checkIncludes("plugins/cool-workflow/src/wiring/capability-table/scheduling-registry.ts", "gc.plan", checks);
   checkIncludes("plugins/cool-workflow/docs/durable-state-and-locking.7.md", "Durable State & Locking", checks);
-  checkIncludes("plugins/cool-workflow/docs/durable-state-and-locking.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/durable-state-and-locking.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "durable-state-and-locking.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/durable-atomic-write-smoke.js", "durable-atomic-write-smoke", checks);
   checkIncludes("plugins/cool-workflow/src/shell/fs-atomic.ts", "withFileLock", checks);
@@ -201,12 +201,12 @@ function main() {
   checkIncludes("plugins/cool-workflow/docs/getting-started.md", "npm run release:check", checks);
   checkIncludes("plugins/cool-workflow/package.json", "eval:replay", checks);
   checkIncludes("plugins/cool-workflow/docs/trust-audit-anchor.7.md", "Trust Audit Anchor", checks);
-  checkIncludes("plugins/cool-workflow/docs/trust-audit-anchor.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/trust-audit-anchor.7.md", VERSION, checks);
   checkIncludes("plugins/cool-workflow/docs/index.md", "trust-audit-anchor.7.md", checks);
   checkIncludes("plugins/cool-workflow/test/trust-audit-anchor-smoke.js", "trust-audit-anchor-smoke", checks);
-  checkIncludes("plugins/cool-workflow/docs/release-and-migration.7.md", VERSION, checks);
+  checkIncludesOwnLine("plugins/cool-workflow/docs/release-and-migration.7.md", VERSION, checks);
   checkIncludes("CHANGELOG.md", `## ${VERSION}`, checks);
-  checkIncludes("RELEASE.md", VERSION, checks);
+  checkIncludesOwnLine("RELEASE.md", VERSION, checks);
   // Homebrew formula (repo root): git-tag formula. Homebrew scans the version
   // from the tag, so the tag is the single version surface to gate (an explicit
   // `version` line would be redundant and brew audit rejects it). bump-version.js
@@ -266,4 +266,21 @@ function checkIncludes(relativePath, needle, checks) {
   checks.push({ path: relativePath, includes: needle });
 }
 
+// A bare version number (e.g. "0.2.4") can appear anywhere in a doc's
+// prose — an example command, a cross-reference — without the doc's own
+// version-history footer (a blank-line-separated list, one release per
+// line, appended by bump-version.js's --content step) actually having
+// been updated. A plain substring check would silently pass on the
+// coincidental prose match and never notice the real footer line is
+// missing (found live: v0.2.4's bump left release-tooling.7.md's footer
+// stuck at 0.2.3, masked by an unrelated "npm run release -- 0.2.4"
+// example a few lines up). Require the needle on its own line instead.
+function checkIncludesOwnLine(relativePath, needle, checks) {
+  const src = readReleaseSource(relativePath);
+  assert.ok(src.exists, `${relativePath} must exist`);
+  const hasOwnLine = src.text.split("\n").some((line) => line.trim() === needle);
+  assert.ok(hasOwnLine, `${relativePath} must include ${needle} as its own line (not just as a substring)`);
+  checks.push({ path: relativePath, includesOwnLine: needle });
+}
+
 main();

package/skills/cool-workflow/SKILL.md

@@ -62,16 +62,16 @@ Use this loop to explain workflow progress when reporting status.
 ## Operating Loop
 
 1. Pick or create a workflow.
-2. `node scripts/cw.js plan <workflow-id> ...` from the plugin root (or the
+2. `cw plan <workflow-id> ...` from the plugin root (or the
    absolute plugin script path).
-3. `node scripts/cw.js dispatch <run-id> --limit N` to create a dispatch
+3. `cw dispatch <run-id> --limit N` to create a dispatch
    manifest for the current phase. Add `--sandbox <profile-id>` when an explicit
    worker policy profile is needed.
 4. If — and only if — the user explicitly asked for agents, spawn one subagent
    per dispatched task with disjoint scopes.
 5. Save each subagent summary to `.cw/runs/<run-id>/results/<task-id>.md`.
-6. `node scripts/cw.js result <run-id> <task-id> <result-file>`.
-7. When all required work is complete, `node scripts/cw.js report <run-id>`.
+6. `cw result <run-id> <task-id> <result-file>`.
+7. When all required work is complete, `cw report <run-id>`.
 8. Synthesize the final user-facing answer from the report and verified
    evidence.
 
@@ -114,11 +114,11 @@ report chain. See `references/commands.md` for the exact invocations.
 ## Essential Commands
 
 ```bash
-node scripts/cw.js list
-node scripts/cw.js plan architecture-review --repo /path/to/repo --question "Is this architecture sound?"
-node scripts/cw.js dispatch <run-id> --limit 6
-node scripts/cw.js result <run-id> <task-id> /path/to/result.md
-node scripts/cw.js report <run-id> --show
+cw list
+cw plan architecture-review --repo /path/to/repo --question "Is this architecture sound?"
+cw dispatch <run-id> --limit 6
+cw result <run-id> <task-id> /path/to/result.md
+cw report <run-id> --show
 ```
 
 When working in this repository, the plugin root is `plugins/cool-workflow`.

package/skills/cool-workflow/references/commands.md

@@ -26,19 +26,20 @@ absolute plugin script path. Run data is written to `.cw/runs/<run-id>/` under
 ## Discovery & apps
 
 ```bash
-node scripts/cw.js list
-node scripts/cw.js app list
-node scripts/cw.js app show architecture-review
-node scripts/cw.js app show pr-review-fix-ci
-node scripts/cw.js app show release-cut
-node scripts/cw.js app show research-synthesis
-node scripts/cw.js app validate apps/architecture-review/app.json
-node scripts/cw.js app show workflow-app-framework-demo
-node scripts/cw.js app validate apps/workflow-app-framework-demo/app.json
-node scripts/cw.js app validate end-to-end-golden-path
-node scripts/cw.js app package workflow-app-framework-demo
-node scripts/cw.js app init my-app --title "My App"
-node scripts/cw.js init my-workflow --title "My Workflow"
+cw list
+cw search architecture
+cw app list
+cw app show architecture-review
+cw app show pr-review-fix-ci
+cw app show release-cut
+cw app show research-synthesis
+cw app validate apps/architecture-review/app.json
+cw app show workflow-app-framework-demo
+cw app validate apps/workflow-app-framework-demo/app.json
+cw app validate end-to-end-golden-path
+cw app package workflow-app-framework-demo
+cw app init my-app --title "My App"
+cw init my-workflow --title "My Workflow"
 ```
 
 The canonical app ids are `architecture-review`, `pr-review-fix-ci`,
@@ -62,16 +63,16 @@ harness; the reviewer is delegated via `CW_AGENT_COMMAND`/`CW_AGENT_ENDPOINT`
 ## Plan / dispatch / result / report
 
 ```bash
-node scripts/cw.js plan architecture-review --repo /path/to/repo --question "Is this architecture sound?"
-node scripts/cw.js status <run-id>
-node scripts/cw.js status <run-id> --json
-node scripts/cw.js graph <run-id>
-node scripts/cw.js graph <run-id> --json
-node scripts/cw.js dispatch <run-id> --limit 6
-node scripts/cw.js dispatch <run-id> --sandbox readonly
-node scripts/cw.js result <run-id> <task-id> /path/to/result.md
-node scripts/cw.js report <run-id>
-node scripts/cw.js report <run-id> --show
+cw plan architecture-review --repo /path/to/repo --question "Is this architecture sound?"
+cw status <run-id>
+cw status <run-id> --json
+cw graph <run-id>
+cw graph <run-id> --json
+cw dispatch <run-id> --limit 6
+cw dispatch <run-id> --sandbox readonly
+cw result <run-id> <task-id> /path/to/result.md
+cw report <run-id>
+cw report <run-id> --show
 ```
 
 Operator UX is human-readable by default for `status`, `graph`, report
@@ -87,12 +88,12 @@ role, group, fanout/fanin, blackboard, coordinator, candidate, commit, and audit
 records — deterministic recipes, not hidden autonomous coordination.
 
 ```bash
-node scripts/cw.js topology list
-node scripts/cw.js topology show map-reduce
-node scripts/cw.js topology validate map-reduce
-node scripts/cw.js topology apply <run-id> map-reduce --task task-id --mapper-count 2
-node scripts/cw.js topology summary <run-id>
-node scripts/cw.js topology graph <run-id>
+cw topology list
+cw topology show map-reduce
+cw topology validate map-reduce
+cw topology apply <run-id> map-reduce --task task-id --mapper-count 2
+cw topology summary <run-id>
+cw topology graph <run-id>
 ```
 
 ## Multi-agent host surface
@@ -103,22 +104,22 @@ plumbing. It wraps the topology, multi-agent, blackboard, candidate, commit, and
 audit primitives; it does not replace them.
 
 ```bash
-node scripts/cw.js multi-agent run <run-id> --topology judge-panel --task task-id
-node scripts/cw.js multi-agent status <run-id>
-node scripts/cw.js multi-agent step <run-id> --sandbox readonly
-node scripts/cw.js multi-agent blackboard <run-id> summary
-node scripts/cw.js multi-agent score <run-id> candidate-id --criterion correctness=1 --evidence ref
-node scripts/cw.js multi-agent select <run-id> candidate-id --reason "verified winner"
+cw multi-agent run <run-id> --topology judge-panel --task task-id
+cw multi-agent status <run-id>
+cw multi-agent step <run-id> --sandbox readonly
+cw multi-agent blackboard <run-id> summary
+cw multi-agent score <run-id> candidate-id --criterion correctness=1 --evidence ref
+cw multi-agent select <run-id> candidate-id --reason "verified winner"
 ```
 
 Operator views (who depends on whom, who is blocked, which evidence was adopted):
 
 ```bash
-node scripts/cw.js multi-agent summary <run-id>
-node scripts/cw.js multi-agent graph <run-id>
-node scripts/cw.js multi-agent dependencies <run-id>
-node scripts/cw.js multi-agent failures <run-id>
-node scripts/cw.js multi-agent evidence <run-id>
+cw multi-agent summary <run-id>
+cw multi-agent graph <run-id>
+cw multi-agent dependencies <run-id>
+cw multi-agent failures <run-id>
+cw multi-agent evidence <run-id>
 ```
 
 State Explosion Management — when a run grows too large to read, use derived,
@@ -126,11 +127,11 @@ provenance-backed digests (they never delete raw records and fail closed when
 stale; every synthetic node carries source ids and an expansion command):
 
 ```bash
-node scripts/cw.js summary refresh <run-id>
-node scripts/cw.js summary show <run-id>
-node scripts/cw.js blackboard summarize <run-id>
-node scripts/cw.js multi-agent summarize <run-id>
-node scripts/cw.js multi-agent graph <run-id> --view compact|critical-path|failures|... [--focus <id>] [--depth <n>]
+cw summary refresh <run-id>
+cw summary show <run-id>
+cw blackboard summarize <run-id>
+cw multi-agent summarize <run-id>
+cw multi-agent graph <run-id> --view compact|critical-path|failures|... [--focus <id>] [--depth <n>]
 ```
 
 Trust / Policy / Audit — inspect role authority, message provenance, blackboard
@@ -138,11 +139,11 @@ write decisions, judge rationale, panel decisions, and why a result is trusted
 (missing policy/evidence/provenance/rationale fail closed):
 
 ```bash
-node scripts/cw.js audit multi-agent <run-id>
-node scripts/cw.js audit policy <run-id>
-node scripts/cw.js audit role <run-id>
-node scripts/cw.js audit blackboard <run-id>
-node scripts/cw.js audit judge <run-id>
+cw audit multi-agent <run-id>
+cw audit policy <run-id>
+cw audit role <run-id>
+cw audit blackboard <run-id>
+cw audit judge <run-id>
 ```
 
 ## Multi-agent low-level state
@@ -154,12 +155,12 @@ transitions, duplicate memberships, ambiguous dispatch attachment, and missing
 fanin evidence fail closed.
 
 ```bash
-node scripts/cw.js multi-agent run <run-id> --id ma --objective "coordinated work"
-node scripts/cw.js multi-agent role <run-id> role --multi-agent-run ma --responsibility "do work" --required-evidence "result evidence"
-node scripts/cw.js multi-agent group <run-id> group --multi-agent-run ma --task task-id
-node scripts/cw.js multi-agent fanout <run-id> fanout --group group --reason "split work" --role role --task task-id
-node scripts/cw.js dispatch <run-id> --multi-agent-run ma --multi-agent-group group --multi-agent-role role --multi-agent-fanout fanout
-node scripts/cw.js multi-agent fanin <run-id> fanin --group group --fanout fanout --required-role role
+cw multi-agent run <run-id> --id ma --objective "coordinated work"
+cw multi-agent role <run-id> role --multi-agent-run ma --responsibility "do work" --required-evidence "result evidence"
+cw multi-agent group <run-id> group --multi-agent-run ma --task task-id
+cw multi-agent fanout <run-id> fanout --group group --reason "split work" --role role --task task-id
+cw dispatch <run-id> --multi-agent-run ma --multi-agent-group group --multi-agent-role role --multi-agent-fanout fanout
+cw multi-agent fanin <run-id> fanin --group group --fanout fanout --required-role role
 ```
 
 ## Eval & replay
@@ -168,12 +169,12 @@ Use when a topology-backed multi-agent run needs release-gate evidence.
 Artifacts live under `.cw/evals/<suite-id>/` as plain JSON plus `report.md`.
 
 ```bash
-node scripts/cw.js eval snapshot <run-id> --id suite-id
-node scripts/cw.js eval replay .cw/evals/suite-id/snapshot.json
-node scripts/cw.js eval compare .cw/evals/suite-id/snapshot.json .cw/evals/suite-id/replay-run.json
-node scripts/cw.js eval score .cw/evals/suite-id/replay-run.json
-node scripts/cw.js eval gate .cw/evals/suite-id
-node scripts/cw.js eval report .cw/evals/suite-id/replay-run.json
+cw eval snapshot <run-id> --id suite-id
+cw eval replay .cw/evals/suite-id/snapshot.json
+cw eval compare .cw/evals/suite-id/snapshot.json .cw/evals/suite-id/replay-run.json
+cw eval score .cw/evals/suite-id/replay-run.json
+cw eval gate .cw/evals/suite-id
+cw eval report .cw/evals/suite-id/replay-run.json
 ```
 
 ## Blackboard & coordinator
@@ -183,14 +184,14 @@ context frames, artifact refs, snapshots, and coordinator decisions under
 `.cw/runs/<run-id>/blackboard/`.
 
 ```bash
-node scripts/cw.js blackboard summary <run-id>
-node scripts/cw.js blackboard topic create <run-id> --id topic --title "Shared context"
-node scripts/cw.js blackboard message post <run-id> --topic topic --body "message"
-node scripts/cw.js blackboard context put <run-id> --topic topic --kind fact --key finding --value "evidence-backed fact"
-node scripts/cw.js blackboard artifact add <run-id> --topic topic --path /path/to/result.md --kind worker-result
-node scripts/cw.js blackboard snapshot <run-id>
-node scripts/cw.js coordinator summary <run-id>
-node scripts/cw.js coordinator decision <run-id> --kind conflict-resolution --outcome accepted --reason "evidence supports this"
+cw blackboard summary <run-id>
+cw blackboard topic create <run-id> --id topic --title "Shared context"
+cw blackboard message post <run-id> --topic topic --body "message"
+cw blackboard context put <run-id> --topic topic --kind fact --key finding --value "evidence-backed fact"
+cw blackboard artifact add <run-id> --topic topic --path /path/to/result.md --kind worker-result
+cw blackboard snapshot <run-id>
+cw coordinator summary <run-id>
+cw coordinator decision <run-id> --kind conflict-resolution --outcome accepted --reason "evidence supports this"
 ```
 
 ## Sandbox profiles
@@ -201,10 +202,10 @@ CW enforces profile validation and worker result acceptance; the agent host
 enforces OS/process/network/environment controls.
 
 ```bash
-node scripts/cw.js sandbox list
-node scripts/cw.js sandbox show readonly
-node scripts/cw.js sandbox validate ./site-sandbox.json
-node scripts/cw.js worker manifest <run-id> <worker-id>
+cw sandbox list
+cw sandbox show readonly
+cw sandbox validate ./site-sandbox.json
+cw worker manifest <run-id> <worker-id>
 ```
 
 ## Commit, state & summaries
@@ -214,14 +215,14 @@ dry-runs migration and normalization; newer unsupported schemas fail closed and
 unknown user data is preserved.
 
 ```bash
-node scripts/cw.js commit <run-id> --verifier <node-id> --reason "verified result"
-node scripts/cw.js commit <run-id> --selection <selection-id> --reason "verified winner"
-node scripts/cw.js commit <run-id> --allow-unverified-checkpoint --reason "manual checkpoint"
-node scripts/cw.js worker summary <run-id>
-node scripts/cw.js candidate summary <run-id>
-node scripts/cw.js feedback summary <run-id>
-node scripts/cw.js commit summary <run-id>
-node scripts/cw.js state check <run-id>
+cw commit <run-id> --verifier <node-id> --reason "verified result"
+cw commit <run-id> --selection <selection-id> --reason "verified winner"
+cw commit <run-id> --allow-unverified-checkpoint --reason "manual checkpoint"
+cw worker summary <run-id>
+cw candidate summary <run-id>
+cw feedback summary <run-id>
+cw commit summary <run-id>
+cw state check <run-id>
 ```
 
 ## Scheduling & routines
@@ -232,12 +233,12 @@ prompt is handled. `routine create`/`routine fire` handle API/GitHub trigger
 events.
 
 ```bash
-node scripts/cw.js loop --intervalMinutes 30 --prompt "Continue this workflow."
-node scripts/cw.js schedule create --kind loop --intervalMinutes 30 --prompt "Continue this workflow."
-node scripts/cw.js schedule due
-node scripts/cw.js schedule daemon --once
-node scripts/cw.js routine create --kind github --prompt "Handle this GitHub event."
-node scripts/cw.js routine fire github payload.json
+cw loop --intervalMinutes 30 --prompt "Continue this workflow."
+cw schedule create --kind loop --intervalMinutes 30 --prompt "Continue this workflow."
+cw schedule due
+cw schedule daemon --once
+cw routine create --kind github --prompt "Handle this GitHub event."
+cw routine fire github payload.json
 ```
 
 ## Release & maintenance npm scripts

package/ui/workbench/app.css

@@ -12,6 +12,20 @@
   --absent: #d29922;
   --bad: #f85149;
 }
+@media (prefers-color-scheme: light) {
+  :root {
+    --bg: #f6f7f9;
+    --panel: #ffffff;
+    --panel-2: #eef0f4;
+    --ink: #1b1f27;
+    --muted: #5b6472;
+    --line: #d7dce4;
+    --accent: #1a6fd6;
+    --present: #1a7f37;
+    --absent: #9a6700;
+    --bad: #cf222e;
+  }
+}
 * { box-sizing: border-box; }
 body {
   margin: 0;
@@ -45,8 +59,17 @@ input[type="search"] {
 }
 .run-list li:hover { border-color: var(--accent); }
 .run-list li.active { border-color: var(--accent); background: var(--panel-2); }
-.run-list .rid { font-family: ui-monospace, monospace; font-size: 12px; }
+.run-list .rid { font-family: ui-monospace, monospace; font-size: 12px; display: flex; align-items: center; gap: 6px; }
 .run-list .meta { color: var(--muted); font-size: 11px; margin-top: 2px; }
+.status-dot {
+  display: inline-block; width: 8px; height: 8px; border-radius: 50%; flex: none;
+  background: var(--muted);
+}
+.status-dot.running { background: var(--accent); }
+.status-dot.completed { background: var(--present); }
+.status-dot.queued, .status-dot.archived, .status-dot.reclaimed { background: var(--muted); }
+.status-dot.blocked { background: var(--absent); }
+.status-dot.failed { background: var(--bad); }
 .detail { overflow-y: auto; padding: 16px 20px; }
 .detail .empty { color: var(--muted); }
 .tabs { display: flex; gap: 6px; flex-wrap: wrap; border-bottom: 1px solid var(--line); padding-bottom: 8px; margin-bottom: 12px; }
@@ -74,3 +97,16 @@ pre.json {
 .kv { display: flex; gap: 16px; flex-wrap: wrap; padding: 8px 12px; font-size: 12px; color: var(--muted); }
 .kv b { color: var(--ink); font-weight: 600; }
 .err { color: var(--bad); }
+.struct-block { padding: 10px 12px; border-top: 1px solid var(--line); }
+.struct-block:first-child { border-top: none; }
+.struct-block .struct-title { font-size: 11px; text-transform: uppercase; letter-spacing: 0.04em; color: var(--muted); margin-bottom: 6px; }
+.struct-table { width: 100%; border-collapse: collapse; font-size: 12px; }
+.struct-table th, .struct-table td {
+  text-align: left; padding: 4px 8px; border-bottom: 1px solid var(--line);
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace; vertical-align: top;
+}
+.struct-table th { color: var(--muted); font-weight: 400; }
+.struct-edges { list-style: none; margin: 0; padding: 0; font-size: 12px; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
+.struct-edges li { padding: 3px 0; }
+.struct-edges .arrow { color: var(--muted); padding: 0 6px; }
+.struct-empty { color: var(--muted); font-size: 12px; }