cowork-flow 0.0.35 → 0.0.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "0.0.35",
+  "version": "0.0.36",
   "description": "CLI for installing and maintaining cowork-flow collaboration templates.",
   "type": "module",
   "bin": {

package/src/commands/install-zcode-plugin.js

@@ -105,6 +105,20 @@ export async function runInstallZCodePlugin(args = []) {
   // Copy plugin runtime (.zcode-plugin/, hooks/, runtime/, scaffold/) from .zcode/
   await cp(pluginSrc, destDir, { recursive: true });
 
+  // Sync package.json version to scaffold/.version so the plugin-only launcher
+  // can resolve the correct versioned plugin cache path at runtime.
+  const scaffoldVersionPath = join(destDir, "scaffold", ".cowork-flow", ".version");
+  await writeFile(scaffoldVersionPath, `${version}\n`, "utf8");
+
+  // Sync canonical scripts from main template (single source of truth).
+  // The .zcode/hooks/runtime/scripts/ copy is stale; overwrite with the
+  // authoritative version from template/.cowork-flow/scripts/.
+  const mainScriptsSrc = join(templateRoot, ".cowork-flow", "scripts");
+  const pluginScriptsDest = join(destDir, "hooks", "runtime", "scripts");
+  if (await pathExists(mainScriptsSrc)) {
+    await cp(mainScriptsSrc, pluginScriptsDest, { recursive: true, force: true });
+  }
+
   // Copy canonical skills into the plugin cache so plugin.json "skills" resolves.
   await cp(skillsSrc, join(destDir, "skills"), { recursive: true, force: true });
 

package/template/.codex/agents/cowork-check.toml

@@ -26,7 +26,7 @@ the task.
 
 Load context before checking:
 1. Read the task directory from the bound runtime context.
-2. Read `<task>/prd.md`.
+2. Read `<task>/decision-anchor.md`.
 3. Read the plan file linked from this task (check `<task>/task.json` `relatedFiles` for a plan path, or search `.cowork-flow/plans/` for a plan file referencing this task directory). Use the plan's Verify commands and Expected results as the checklist for each step.
 4. Read `<task>/check.jsonl`.
 5. Read `git diff`.

package/template/.codex/agents/cowork-implement.toml

@@ -26,7 +26,7 @@ the task.
 
 Load context before editing:
 1. Read the task directory from the bound runtime context.
-2. Read `<task>/prd.md`.
+2. Read `<task>/decision-anchor.md`.
 3. Read `<task>/info.md` if present.
 4. Read `<task>/implement.jsonl`.
 5. Read each JSONL `file` entry.

package/template/.cowork-flow/.version

@@ -1 +1 @@
-0.0.35
+0.0.36

package/template/.cowork-flow/scripts/commands/task.py

@@ -433,22 +433,38 @@ def _skill_path(name: str, repo_root: Path | None = None) -> str:
     return f"{DIR_AGENTS}/skills/{name}/SKILL.md"
 
 
-def get_check_context(dev_type: str) -> list[dict]:
-    """Get check context entries. Injects spec guides per dev_type so the check agent
-    can verify compliance against project conventions."""
+def _discover_spec_files(repo_root: Path, dev_type: str) -> list[str]:
+    """动态发现 spec/<dev_type>/ 下的所有 .md 文件。
+
+    返回形如 ".cowork-flow/spec/backend/error-handling.md" 的相对路径列表，
+    可直接写入 check.jsonl 条目。dev_type="spec" 时返回 spec/index.md。
+    """
+    if dev_type == "spec":
+        return [f"{DIR_WORKFLOW}/{DIR_SPEC}/index.md"]
+
+    spec_dir = Path(repo_root) / DIR_WORKFLOW / DIR_SPEC / dev_type
+    if not spec_dir.is_dir():
+        return []
+    return sorted(
+        f"{DIR_WORKFLOW}/{DIR_SPEC}/{dev_type}/{p.name}"
+        for p in spec_dir.glob("*.md")
+        if p.is_file()
+    )
+
+
+def get_check_context(repo_root: Path, dev_type: str) -> list[dict]:
+    """Get check context entries.
+
+    Injects skill guides and **所有** spec 子文件，使 check agent 可以对照
+    .cowork-flow/spec/<dev_type>/ 的完整规范集逐项验证实现。
+    spec 文件通过 _discover_spec_files 动态发现，新增/删除 spec 文件无需改代码。
+    """
     base = [
         {"file": _skill_path("check"), "reason": "Quality, contract, and template consistency check"},
         {"file": _skill_path("finish-work"), "reason": "Finish, archive, and session recording gate"},
     ]
-    if dev_type in ("backend", "test"):
-        base.append({"file": f"{DIR_WORKFLOW}/{DIR_SPEC}/backend/index.md", "reason": "Verify backend spec compliance"})
-    elif dev_type == "frontend":
-        base.append({"file": f"{DIR_WORKFLOW}/{DIR_SPEC}/frontend/index.md", "reason": "Verify frontend spec compliance"})
-    elif dev_type == "fullstack":
-        base.append({"file": f"{DIR_WORKFLOW}/{DIR_SPEC}/backend/index.md", "reason": "Verify backend spec compliance"})
-        base.append({"file": f"{DIR_WORKFLOW}/{DIR_SPEC}/frontend/index.md", "reason": "Verify frontend spec compliance"})
-    elif dev_type == "spec":
-        base.append({"file": f"{DIR_WORKFLOW}/{DIR_SPEC}/index.md", "reason": "Verify spec compliance"})
+    for spec_file in _discover_spec_files(repo_root, dev_type):
+        base.append({"file": spec_file, "reason": f"Verify {Path(spec_file).name} compliance"})
     return base
 
 
@@ -740,7 +756,7 @@ def cmd_init_context(args: argparse.Namespace) -> int:
         _report_jsonl_skip(check_file, "already exists, skipping")
     else:
         print(colored("Creating check.jsonl...", Colors.CYAN))
-        check_entries = get_check_context(dev_type)
+        check_entries = get_check_context(repo_root, dev_type)
         _write_jsonl(check_file, check_entries)
         print(f"  {colored('[OK]', Colors.GREEN)} {len(check_entries)} entries")
 

package/template/.cowork-flow/spec/runtime/rules.json

@@ -61,18 +61,6 @@
       "source_excerpt": "L2（结构性）",
       "enforcement": "validate_rules"
     },
-    {
-      "id": "R-WF-006",
-      "type": "phase_gate",
-      "severity": "warn",
-      "scope": "implement",
-      "condition": "实现前必须有失败测试（行为变化场景）",
-      "message": "Implementation without failing test for behavior change",
-      "fix_hint": "先编写失败测试，再实现功能，确保测试在实现后通过",
-      "source_file": ".cowork-flow/workflow.md",
-      "source_excerpt": "先写能失败的测试",
-      "enforcement": "tdd_evidence"
-    },
     {
       "id": "R-WF-007",
       "type": "phase_gate",
@@ -86,63 +74,39 @@
       "enforcement": "validate_rules"
     },
     {
-      "id": "R-AG-001",
-      "type": "forbidden_action",
+      "id": "R-WF-008",
+      "type": "phase_gate",
       "severity": "block",
-      "scope": "all",
-      "condition": "子代理不派发其他代理",
-      "message": "Subagent attempted to dispatch another agent",
-      "fix_hint": "子代理是叶子执行者，不能派发、等待、列出或取消其他代理",
-      "source_file": "AGENTS.md",
-      "source_excerpt": "cowork-* 固定代理是叶子执行者",
-      "enforcement": "host_contract"
+      "scope": "task_start",
+      "condition": "任务必须有 decision-anchor.md 且包含目标和验收标准章节",
+      "message": "Drift prevention: decision-anchor.md is missing or incomplete",
+      "fix_hint": "创建 <task-dir>/decision-anchor.md，至少包含 ## 目标和 ## 验收标准",
+      "source_file": ".cowork-flow/spec/contracts/decision-anchor.md",
+      "source_excerpt": "每个任务必须有决策锚点",
+      "enforcement": "validate_rules"
     },
     {
       "id": "R-AG-002",
       "type": "forbidden_action",
       "severity": "block",
-      "scope": "all",
-      "condition": "子代理不修改规格文件",
+      "scope": "implement",
+      "condition": "不修改规格文件",
       "message": "Subagent attempted to modify spec files",
       "fix_hint": "规格文件只能由主会话修改，子代理应专注于实现任务",
-      "source_file": "AGENTS.md",
+      "source_file": ".cowork-flow/spec/contracts/subagent-dispatch.md",
       "source_excerpt": "cowork-* 固定代理是叶子执行者",
       "enforcement": "validate_implementation"
     },
-    {
-      "id": "R-AG-003",
-      "type": "forbidden_action",
-      "severity": "block",
-      "scope": "all",
-      "condition": "子代理不操作 Git",
-      "message": "Subagent attempted to operate Git",
-      "fix_hint": "Git 操作只能由主会话执行，子代理应专注于代码实现",
-      "source_file": "AGENTS.md",
-      "source_excerpt": "cowork-* 固定代理是叶子执行者",
-      "enforcement": "host_contract"
-    },
-    {
-      "id": "R-AG-004",
-      "type": "forbidden_action",
-      "severity": "block",
-      "scope": "all",
-      "condition": "子代理不提交/归档",
-      "message": "Subagent attempted to commit or archive",
-      "fix_hint": "提交和归档只能由主会话执行，子代理应专注于代码实现",
-      "source_file": "AGENTS.md",
-      "source_excerpt": "cowork-* 固定代理是叶子执行者",
-      "enforcement": "host_contract"
-    },
     {
       "id": "R-AG-005",
       "type": "forbidden_action",
       "severity": "block",
       "scope": "implement",
-      "condition": "不添加未要求的功能",
-      "message": "Unrequested feature introduced",
-      "fix_hint": "只实现 PRD 中明确要求的功能，不添加额外功能",
-      "source_file": "AGENTS.md",
-      "source_excerpt": "不添加未要求的功能",
+      "condition": "不修改 implement.jsonl 允许范围外的文件",
+      "message": "Modified file not in implement.jsonl allowed list",
+      "fix_hint": "通过 ./.cowork-flow/run task add-context <dir> implement <path> <reason> 登记所有需要修改的文件",
+      "source_file": ".cowork-flow/spec/contracts/decision-anchor.md",
+      "source_excerpt": "implement.jsonl 是任务的权威文件白名单",
       "enforcement": "validate_implementation"
     },
     {
@@ -156,78 +120,6 @@
       "source_file": "AGENTS.md",
       "source_excerpt": "不为一次性代码做抽象",
       "enforcement": "validate_implementation"
-    },
-    {
-      "id": "R-AG-007",
-      "type": "forbidden_action",
-      "severity": "block",
-      "scope": "implement",
-      "condition": "不顺手重构无关模块",
-      "message": "Unrelated module refactored during implementation",
-      "fix_hint": "只修改与当前任务直接相关的代码，不扩大改动范围",
-      "source_file": "AGENTS.md",
-      "source_excerpt": "不顺手重构无关模块",
-      "enforcement": "host_contract"
-    },
-    {
-      "id": "R-WF-008",
-      "type": "phase_gate",
-      "severity": "warn",
-      "scope": "task_start",
-      "condition": "L2 任务的关键决策应有 doubt-review 记录",
-      "message": "Missing doubt-review for L2 non-trivial decision",
-      "fix_hint": "在 <task>/doubt-review.md 中为每个非平凡决策完成 5-step doubt cycle",
-      "source_file": ".cowork-flow/spec/contracts/subagent-dispatch.md",
-      "source_excerpt": "doubt-review is a mandatory sub-step of before-dev gate for L2",
-      "enforcement": "validate_rules"
-    },
-    {
-      "id": "R-WF-009",
-      "type": "phase_gate",
-      "severity": "warn",
-      "scope": "check",
-      "condition": "Bug fix must have regression test that fails without the fix",
-      "message": "Bug fix lacks regression test or modifies existing test to pass",
-      "fix_hint": "Record red-green evidence in tdd.jsonl; test must fail without the fix and pass with the fix",
-      "source_file": ".cowork-flow/workflow.md",
-      "source_excerpt": "先写能失败的测试",
-      "enforcement": "tdd_evidence"
-    },
-    {
-      "id": "R-WF-010",
-      "type": "phase_gate",
-      "severity": "block",
-      "scope": "all",
-      "condition": "Batch mode requires explicit user approval before starting",
-      "message": "Batch mode started without explicit user approval",
-      "fix_hint": "用户必须在 writing-plans 结束时明确说 'approved' + 'auto' 才能进入批模式",
-      "source_file": ".cowork-flow/workflow.md",
-      "source_excerpt": "用户是流程的最终决策者",
-      "enforcement": "host_contract"
-    },
-    {
-      "id": "R-AG-008",
-      "type": "forbidden_action",
-      "severity": "warn",
-      "scope": "check",
-      "condition": "Simplification must preserve observable behavior",
-      "message": "Simplification appears to change observable behavior",
-      "fix_hint": "简化不应改变测试结果。如果测试需要修改才能通过，行为已变——还原或重写测试",
-      "source_file": ".cowork-flow/workflow.md",
-      "source_excerpt": "外科手术式改动: 只改必须改的",
-      "enforcement": "metadata_only"
-    },
-    {
-      "id": "R-WF-011",
-      "type": "phase_gate",
-      "severity": "warn",
-      "scope": "all",
-      "condition": "Archive should happen before final commit to avoid committing unreviewed code",
-      "message": "Uncommitted changes detected. Archive the task first, then commit the archived result.",
-      "fix_hint": "Run './.cowork-flow/run task archive <name>' first. Then commit the archive result.",
-      "source_file": ".cowork-flow/workflow.md",
-      "source_excerpt": "归档后再提交",
-      "enforcement": "validate_rules"
     }
   ]
 }

package/template/.cowork-flow/spec/schemas/rules.schema.json

@@ -67,8 +67,8 @@
           },
           "enforcement": {
             "type": "string",
-            "enum": ["validate_rules", "validate_implementation", "tdd_evidence", "host_contract", "metadata_only"],
-            "description": "Runtime or contract surface responsible for enforcing or carrying this rule"
+            "enum": ["validate_rules", "validate_implementation"],
+            "description": "Runtime surface responsible for enforcing this rule. Must have a corresponding validator module."
           }
         },
         "additionalProperties": false

package/template/.zcode/.zcode-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "0.0.35",
+  "version": "0.0.36",
   "description": "AI 协作工作流引擎：任务生命周期、子代理调度、门禁与状态注入。将 cowork-flow 的完整工作流带入 ZCode。",
   "author": {
     "name": "fisklikewater"

package/template/.zcode/hooks/inject-context.js

@@ -5,14 +5,39 @@
  * Output: ZCode/Claude Code hook format (stdout JSON).
  */
 
-import { readFileSync, existsSync, readdirSync, mkdirSync, copyFileSync } from "fs";
-import { join, dirname } from "path";
+import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync, copyFileSync } from "fs";
+import { join, dirname, basename } from "path";
 import { createHash } from "crypto";
 
 const SCAFFOLD_DIR = join(import.meta.dirname, "..", "scaffold");
 const DIR_WORKFLOW = ".cowork-flow";
 const FILE_TASK_JSON = "task.json";
 
+// Derive the installed plugin version from this hook's location in the cache.
+// Path: hooks/inject-context.js -> .. = <cache>/<version>/
+const PLUGIN_VERSION = basename(dirname(dirname(import.meta.dirname)));
+
+// ---------------------------------------------------------------------------
+// Version sync
+// ---------------------------------------------------------------------------
+function syncPluginVersion(targetDir) {
+  if (!PLUGIN_VERSION) return;
+  const versionFile = join(targetDir, DIR_WORKFLOW, ".version");
+  let current = "";
+  try {
+    current = readFileSync(versionFile, "utf8").trim();
+  } catch {
+    current = "";
+  }
+  if (current === PLUGIN_VERSION) return;
+  try {
+    mkdirSync(dirname(versionFile), { recursive: true });
+    writeFileSync(versionFile, `${PLUGIN_VERSION}\n`, "utf8");
+  } catch {
+    /* skip — non-fatal */
+  }
+}
+
 const TAG_RE = /\[workflow-state:([A-Za-z0-9_-]+)\]\s*\n(.*?)\n\s*\[\/workflow-state:\1\]/gs;
 const RUNTIME_CONTEXT_PROMPT_RE = /^\s*cowork_runtime_context_id\s*:\s*([A-Za-z0-9._-]+)\s*$/gim;
 const DEFAULT_CONTRACT_REGISTRY = {
@@ -338,6 +363,11 @@ function main() {
   const copied = envDir ? scaffoldProject(envDir) : [];
   const effectiveRoot = repoRoot || (envDir && existsSync(join(envDir, DIR_WORKFLOW)) ? envDir : null);
 
+  // Always refresh .version so plugin upgrades propagate to existing projects
+  if (effectiveRoot) {
+    syncPluginVersion(effectiveRoot);
+  }
+
   if (!effectiveRoot) {
     context = `<workflow-state>
 Status: not_initialized

package/template/.zcode/scaffold/.cowork-flow/.version

@@ -1 +1 @@
-0.0.30
+0.0.35

package/template/.zcode/scaffold/.cowork-flow/run

@@ -1,11 +1,30 @@
 #!/bin/sh
+# cowork-flow run launcher (ZCode plugin edition)
+# Delegates to the plugin cache runtime — no local scripts/ required.
 set -u
 
 MIN_PYTHON_LABEL="Python 3.9+"
 VERSION_CHECK='import sys; raise SystemExit(0 if sys.version_info >= (3, 9) else 1)'
-WORKFLOW_DIR=$(CDPATH= cd "$(dirname "$0")" && pwd) || exit 1
-RUNNER_SCRIPT="$WORKFLOW_DIR/scripts/run.py"
 
+VERSION_FILE=$(dirname "$0")/.version
+VERSION="$(cat "$VERSION_FILE" 2>/dev/null | tr -d '\r')"
+
+if [ -z "$VERSION" ]; then
+  echo "Error: cannot determine cowork-flow version (.version missing)" >&2
+  exit 127
+fi
+
+ZCODE_BASE="${ZCODE_HOME:-$HOME/.zcode}"
+RUNNER="$ZCODE_BASE/cli/plugins/cache/zcode-plugins-official/cowork-flow/$VERSION/hooks/runtime/scripts/run.py"
+
+if [ ! -f "$RUNNER" ]; then
+  echo "Error: cowork-flow plugin runtime not found at:" >&2
+  echo "  $RUNNER" >&2
+  echo "Install the ZCode plugin or run 'cowork-flow init' for standalone." >&2
+  exit 127
+fi
+
+# --- Python interpreter discovery ----------------------------------------
 candidate_is_valid() {
   candidate_cmd=$1
   candidate_arg=${2:-}
@@ -73,7 +92,7 @@ select_python() {
 select_python
 
 if [ -n "$SELECTED_PYTHON_ARG" ]; then
-  exec "$SELECTED_PYTHON" "$SELECTED_PYTHON_ARG" "$RUNNER_SCRIPT" "$@"
+  exec "$SELECTED_PYTHON" "$SELECTED_PYTHON_ARG" "$RUNNER" "$@"
 fi
 
-exec "$SELECTED_PYTHON" "$RUNNER_SCRIPT" "$@"
+exec "$SELECTED_PYTHON" "$RUNNER" "$@"

package/template/.zcode/scaffold/.cowork-flow/run.cmd

@@ -1,10 +1,33 @@
 @echo off
+rem cowork-flow run launcher (ZCode plugin edition)
+rem Delegates to the plugin cache runtime — no local scripts/ required.
 setlocal EnableExtensions
 
 set "MIN_PYTHON_LABEL=Python 3.9+"
 set "VERSION_CHECK=import sys; raise SystemExit(0 if sys.version_info >= (3, 9) else 1)"
-set "WORKFLOW_DIR=%~dp0"
-set "RUNNER_SCRIPT=%WORKFLOW_DIR%scripts\run.py"
+
+set "VERSION_FILE=%~dp0.version"
+set "VERSION="
+for /f "usebackq delims=" %%A in ("%VERSION_FILE%") do set "VERSION=%%A"
+
+if "%VERSION%"=="" (
+  echo Error: cannot determine cowork-flow version (.version missing) >&2
+  exit /b 127
+)
+
+set "ZCODE_BASE=%ZCODE_HOME%"
+if "%ZCODE_BASE%"=="" set "ZCODE_BASE=%USERPROFILE%\.zcode"
+
+set "RUNNER=%ZCODE_BASE%\cli\plugins\cache\zcode-plugins-official\cowork-flow\%VERSION%\hooks\runtime\scripts\run.py"
+
+if not exist "%RUNNER%" (
+  echo Error: cowork-flow plugin runtime not found at: >&2
+  echo   %RUNNER% >&2
+  echo Install the ZCode plugin or run 'cowork-flow init' for standalone. >&2
+  exit /b 127
+)
+
+rem --- Python interpreter discovery ----------------------------------------
 set "SELECTED_PYTHON="
 set "SELECTED_PYTHON_ARG="
 
@@ -12,9 +35,9 @@ call :select_python
 if errorlevel 1 exit /b %ERRORLEVEL%
 
 if not "%SELECTED_PYTHON_ARG%"=="" (
-  "%SELECTED_PYTHON%" "%SELECTED_PYTHON_ARG%" "%RUNNER_SCRIPT%" %*
+  "%SELECTED_PYTHON%" "%SELECTED_PYTHON_ARG%" "%RUNNER%" %*
 ) else (
-  "%SELECTED_PYTHON%" "%RUNNER_SCRIPT%" %*
+  "%SELECTED_PYTHON%" "%RUNNER%" %*
 )
 exit /b %ERRORLEVEL%
 

package/template/.zcode/scaffold/.cowork-flow/spec/runtime/rules.json

@@ -61,18 +61,6 @@
       "source_excerpt": "L2（结构性）",
       "enforcement": "validate_rules"
     },
-    {
-      "id": "R-WF-006",
-      "type": "phase_gate",
-      "severity": "warn",
-      "scope": "implement",
-      "condition": "实现前必须有失败测试（行为变化场景）",
-      "message": "Implementation without failing test for behavior change",
-      "fix_hint": "先编写失败测试，再实现功能，确保测试在实现后通过",
-      "source_file": ".cowork-flow/workflow.md",
-      "source_excerpt": "先写能失败的测试",
-      "enforcement": "tdd_evidence"
-    },
     {
       "id": "R-WF-007",
       "type": "phase_gate",
@@ -86,63 +74,39 @@
       "enforcement": "validate_rules"
     },
     {
-      "id": "R-AG-001",
-      "type": "forbidden_action",
+      "id": "R-WF-008",
+      "type": "phase_gate",
       "severity": "block",
-      "scope": "all",
-      "condition": "子代理不派发其他代理",
-      "message": "Subagent attempted to dispatch another agent",
-      "fix_hint": "子代理是叶子执行者，不能派发、等待、列出或取消其他代理",
-      "source_file": "AGENTS.md",
-      "source_excerpt": "cowork-* 固定代理是叶子执行者",
-      "enforcement": "host_contract"
+      "scope": "task_start",
+      "condition": "任务必须有 decision-anchor.md 且包含目标和验收标准章节",
+      "message": "Drift prevention: decision-anchor.md is missing or incomplete",
+      "fix_hint": "创建 <task-dir>/decision-anchor.md，至少包含 ## 目标和 ## 验收标准",
+      "source_file": ".cowork-flow/spec/contracts/decision-anchor.md",
+      "source_excerpt": "每个任务必须有决策锚点",
+      "enforcement": "validate_rules"
     },
     {
       "id": "R-AG-002",
       "type": "forbidden_action",
       "severity": "block",
-      "scope": "all",
-      "condition": "子代理不修改规格文件",
+      "scope": "implement",
+      "condition": "不修改规格文件",
       "message": "Subagent attempted to modify spec files",
       "fix_hint": "规格文件只能由主会话修改，子代理应专注于实现任务",
-      "source_file": "AGENTS.md",
+      "source_file": ".cowork-flow/spec/contracts/subagent-dispatch.md",
       "source_excerpt": "cowork-* 固定代理是叶子执行者",
       "enforcement": "validate_implementation"
     },
-    {
-      "id": "R-AG-003",
-      "type": "forbidden_action",
-      "severity": "block",
-      "scope": "all",
-      "condition": "子代理不操作 Git",
-      "message": "Subagent attempted to operate Git",
-      "fix_hint": "Git 操作只能由主会话执行，子代理应专注于代码实现",
-      "source_file": "AGENTS.md",
-      "source_excerpt": "cowork-* 固定代理是叶子执行者",
-      "enforcement": "host_contract"
-    },
-    {
-      "id": "R-AG-004",
-      "type": "forbidden_action",
-      "severity": "block",
-      "scope": "all",
-      "condition": "子代理不提交/归档",
-      "message": "Subagent attempted to commit or archive",
-      "fix_hint": "提交和归档只能由主会话执行，子代理应专注于代码实现",
-      "source_file": "AGENTS.md",
-      "source_excerpt": "cowork-* 固定代理是叶子执行者",
-      "enforcement": "host_contract"
-    },
     {
       "id": "R-AG-005",
       "type": "forbidden_action",
       "severity": "block",
       "scope": "implement",
-      "condition": "不添加未要求的功能",
-      "message": "Unrequested feature introduced",
-      "fix_hint": "只实现 PRD 中明确要求的功能，不添加额外功能",
-      "source_file": "AGENTS.md",
-      "source_excerpt": "不添加未要求的功能",
+      "condition": "不修改 implement.jsonl 允许范围外的文件",
+      "message": "Modified file not in implement.jsonl allowed list",
+      "fix_hint": "通过 ./.cowork-flow/run task add-context <dir> implement <path> <reason> 登记所有需要修改的文件",
+      "source_file": ".cowork-flow/spec/contracts/decision-anchor.md",
+      "source_excerpt": "implement.jsonl 是任务的权威文件白名单",
       "enforcement": "validate_implementation"
     },
     {
@@ -156,78 +120,6 @@
       "source_file": "AGENTS.md",
       "source_excerpt": "不为一次性代码做抽象",
       "enforcement": "validate_implementation"
-    },
-    {
-      "id": "R-AG-007",
-      "type": "forbidden_action",
-      "severity": "block",
-      "scope": "implement",
-      "condition": "不顺手重构无关模块",
-      "message": "Unrelated module refactored during implementation",
-      "fix_hint": "只修改与当前任务直接相关的代码，不扩大改动范围",
-      "source_file": "AGENTS.md",
-      "source_excerpt": "不顺手重构无关模块",
-      "enforcement": "host_contract"
-    },
-    {
-      "id": "R-WF-008",
-      "type": "phase_gate",
-      "severity": "warn",
-      "scope": "task_start",
-      "condition": "L2 任务的关键决策应有 doubt-review 记录",
-      "message": "Missing doubt-review for L2 non-trivial decision",
-      "fix_hint": "在 <task>/doubt-review.md 中为每个非平凡决策完成 5-step doubt cycle",
-      "source_file": ".cowork-flow/spec/contracts/subagent-dispatch.md",
-      "source_excerpt": "doubt-review is a mandatory sub-step of before-dev gate for L2",
-      "enforcement": "validate_rules"
-    },
-    {
-      "id": "R-WF-009",
-      "type": "phase_gate",
-      "severity": "warn",
-      "scope": "check",
-      "condition": "Bug fix must have regression test that fails without the fix",
-      "message": "Bug fix lacks regression test or modifies existing test to pass",
-      "fix_hint": "Record red-green evidence in tdd.jsonl; test must fail without the fix and pass with the fix",
-      "source_file": ".cowork-flow/workflow.md",
-      "source_excerpt": "先写能失败的测试",
-      "enforcement": "tdd_evidence"
-    },
-    {
-      "id": "R-WF-010",
-      "type": "phase_gate",
-      "severity": "block",
-      "scope": "all",
-      "condition": "Batch mode requires explicit user approval before starting",
-      "message": "Batch mode started without explicit user approval",
-      "fix_hint": "用户必须在 writing-plans 结束时明确说 'approved' + 'auto' 才能进入批模式",
-      "source_file": ".cowork-flow/workflow.md",
-      "source_excerpt": "用户是流程的最终决策者",
-      "enforcement": "host_contract"
-    },
-    {
-      "id": "R-AG-008",
-      "type": "forbidden_action",
-      "severity": "warn",
-      "scope": "check",
-      "condition": "Simplification must preserve observable behavior",
-      "message": "Simplification appears to change observable behavior",
-      "fix_hint": "简化不应改变测试结果。如果测试需要修改才能通过，行为已变——还原或重写测试",
-      "source_file": ".cowork-flow/workflow.md",
-      "source_excerpt": "外科手术式改动: 只改必须改的",
-      "enforcement": "metadata_only"
-    },
-    {
-      "id": "R-WF-011",
-      "type": "phase_gate",
-      "severity": "warn",
-      "scope": "all",
-      "condition": "Archive should happen before final commit to avoid committing unreviewed code",
-      "message": "Uncommitted changes detected. Archive the task first, then commit the archived result.",
-      "fix_hint": "Run './.cowork-flow/run task archive <name>' first. Then commit the archive result.",
-      "source_file": ".cowork-flow/workflow.md",
-      "source_excerpt": "归档后再提交",
-      "enforcement": "validate_rules"
     }
   ]
 }