cowork-flow 0.0.40 → 0.0.41

package/README.md

@@ -68,7 +68,7 @@ Skills 维护在 `template/skills/` 唯一源码，`init` 时按平台分发到
 | `codex` / `opencode` | `.agents/skills/` |
 | `claude-code` | `.claude/skills/` |
 
-分发动作：`batch-mode`、`brainstorming`、`break-loop`、`cowork-flow`、`party-mode`、`writing-plans`
+分发动作：`batch-mode`、`brainstorming`、`break-loop`、`cowork-flow`、`doubt-review`、`game-design`、`party-mode`、`writing-plans`
 
 ## CLI 命令
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "0.0.40",
+  "version": "0.0.41",
   "description": "CLI for installing and maintaining cowork-flow collaboration templates.",
   "type": "module",
   "bin": {

package/template/.cowork-flow/.version

@@ -1 +1 @@
-0.0.40
+0.0.41

package/template/.cowork-flow/spec/protocols/decision-review.md

@@ -2,18 +2,39 @@
 
 > Internal protocol enforced by workflow readiness; it is not a public Skill.
 
+## Purpose
+
+`decision-review` is the mandatory L2 evidence gate for non-trivial decisions.
+It preserves the adversarial doubt cycle from `doubt-review` while keeping the
+runtime authority in `decision-review.jsonl`.
+
 ## Enforcement
 
 - L2 tasks: mandatory before task start.
 - L0/L1 tasks: advisory and never blocked by missing decision review evidence.
 - The runtime authority is `decision-review.jsonl`; prose notes do not satisfy the gate.
 
+## Doubt Cycle
+
+Every accepted L2 decision review must be derived from this bounded cycle:
+
+1. CLAIM: state the decision and why being wrong would be costly.
+2. EXTRACT: isolate the minimal reviewable artifact or design statement.
+3. DOUBT: ask a fresh context to find problems in ARTIFACT + CONTRACT, not CLAIM.
+4. RECONCILE: classify each finding as contract misunderstanding, actionable,
+   accepted trade-off, or noise.
+5. STOP: stop after trivial or already-considered findings, three cycles, or the
+   user explicitly says enough.
+
+The reviewer receives ARTIFACT + CONTRACT, not CLAIM. CLAIM is recorded for
+traceability, but it must not bias the adversarial review prompt.
+
 ## Evidence
 
 Write one UTF-8 JSON object per line to `<task>/decision-review.jsonl`:
 
 ```json
-{"acceptanceId":"AC-007A","claim":"The selected direction is safe.","contract":"The invariant that must hold.","reviewerContext":"fresh","findings":[],"resolution":"accepted"}
+{"acceptanceId":"AC-007A","claim":"The selected direction is safe.","contract":"The invariant that must hold.","reviewerContext":"fresh","findings":[],"resolution":"accepted","artifact":"Focused diff or design statement reviewed via ARTIFACT + CONTRACT.","reconciliation":[],"cycleCount":1}
 ```
 
 Required fields:
@@ -25,4 +46,10 @@ Required fields:
 - `findings`: JSON array
 - `resolution`: exactly `accepted`
 
+Recommended fields:
+
+- `artifact`: minimal EXTRACT artifact reviewed.
+- `reconciliation`: how each finding was classified.
+- `cycleCount`: number of completed doubt cycles, never greater than 3.
+
 Missing, malformed, stale-context, or unaccepted records block L2 task start.

package/template/.cowork-flow/spec/protocols/spec-maintenance.md

@@ -8,6 +8,25 @@ Update `.cowork-flow/spec/` when a change introduces or changes a reusable comma
 
 Do not add one-off implementation narration. Prefer the narrowest existing spec and update its index when a new topic is introduced.
 
+## Choose Location
+
+- `backend/` or `frontend/`: implementation contracts, signatures, examples, validation behavior, and test points.
+- `guides/`: short thinking checklists and pointers to deeper specs.
+- `contracts/`: cross-agent, runtime, host-adapter, or persisted-state contracts.
+- `runtime/` or `schemas/`: machine-readable rules, registries, and schema-owned metadata.
+- `workflow.md` or `AGENTS.md`: process rules, phase gates, collaboration rules, or task routing behavior.
+
+## Write
+
+Keep each update concrete:
+
+- State the trigger and scope.
+- Show the contract or command shape.
+- Include good/bad cases when useful.
+- State tests or checks that protect the behavior.
+- Update the matching `index.md` when adding a new topic.
+- Check for duplicate guidance and remove stale wording before finishing.
+
 ## Output
 
 Every Host reports `specUpdates` as one of:

package/template/.cowork-flow/spec/protocols/tdd.md

@@ -28,3 +28,16 @@ Write one JSON object per line to `<task>/tdd.jsonl` with:
 - `greenCommand`, `greenExitCode`, `broaderVerification`
 
 Only docs/comment/format-only work may use a documented `exemption`.
+
+## Anti-Rationalization
+
+The following excuses do not exempt the TDD evidence requirement:
+
+| Excuse | Why It Fails | Required Alternative |
+|---|---|---|
+| "This logic is simple, no test needed" | Simple logic still breaks on edge cases and later edits. | Write the smallest behavior test for the acceptance ID. |
+| "Other tests already cover this" | Invisible coverage is not red-green evidence. | Point to the exact redCommand and acceptanceId in `tdd.jsonl`. |
+| "I'll add tests after implementation" | Post-implementation tests are not a red-green cycle. | Red first, then green; record both commands. |
+| "It looks correct" | Visual inspection misses scenarios that tests can pin down. | Turn the expected behavior and edge case into assertions. |
+| "I've written similar tests" | Similar structure is not the same behavior. | Re-run the redCommand for this acceptanceId. |
+| "This is internal only" | Internal behavior still affects callers and workflow state. | Test through the public entry point, or directly test the internal contract when that is the narrowest stable surface. |

package/template/.cowork-flow/spec/runtime/host-assets.json

@@ -190,7 +190,6 @@
       ".agents/skills/before-dev",
       ".agents/skills/check",
       ".agents/skills/continue",
-      ".agents/skills/doubt-review",
       ".agents/skills/entry-boundary",
       ".agents/skills/finish-work",
       ".agents/skills/party-mode-v2",
@@ -201,7 +200,6 @@
       ".claude/skills/before-dev",
       ".claude/skills/check",
       ".claude/skills/continue",
-      ".claude/skills/doubt-review",
       ".claude/skills/entry-boundary",
       ".claude/skills/finish-work",
       ".claude/skills/party-mode-v2",

package/template/.cowork-flow/spec/runtime/skill-registry.json

@@ -149,12 +149,40 @@
       "source": ".cowork-flow/spec/protocols/decision-review.md",
       "managedPaths": []
     },
+    {
+      "id": "doubt-review",
+      "displayName": "Doubt Review",
+      "aliases": [
+        "adversarial-review"
+      ],
+      "kind": "protocol",
+      "visibility": "public",
+      "status": "active",
+      "statuses": [
+        "planning",
+        "in_progress",
+        "review",
+        "delegated_subtask"
+      ],
+      "intents": [
+        "doubt_review"
+      ],
+      "enforcement": "advisory",
+      "runtimeGate": null,
+      "runtimeCommand": null,
+      "evidenceArtifact": "decision-review.jsonl",
+      "source": "skills/doubt-review/SKILL.md",
+      "managedPaths": [
+        ".agents/skills/doubt-review/",
+        ".claude/skills/doubt-review/"
+      ]
+    },
     {
       "id": "game-design",
       "displayName": "Game Design",
       "aliases": [],
       "kind": "domain",
-      "visibility": "internal",
+      "visibility": "public",
       "status": "active",
       "statuses": [
         "planning",

package/template/.zcode/.zcode-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "0.0.40",
+  "version": "0.0.41",
   "description": "AI 协作工作流引擎：任务生命周期、子代理调度、门禁与状态注入。将 cowork-flow 的完整工作流带入 ZCode。",
   "author": {
     "name": "fisklikewater"

package/template/skills/doubt-review/SKILL.md

@@ -0,0 +1,125 @@
+---
+name: doubt-review
+description: Use when the user asks for adversarial review, doubt review, or a fresh skeptical pass on a non-trivial implementation decision, design direction, or correctness claim. Use when correctness matters more than speed, the code is unfamiliar, or hidden assumptions could break the work.
+---
+
+# Doubt Review
+
+Use this Skill to stress-test a decision while course correction is still cheap. It is the public, user-callable companion to the internal `decision-review` protocol; it does not replace runtime gates or final implementation review.
+
+## Apply When
+
+- The user explicitly asks for doubt review, adversarial review, or a skeptical pass.
+- A decision changes branching logic, module boundaries, shared state, ordering, idempotency, or other invariants the type system cannot verify.
+- You are about to claim behavioral correctness for unfamiliar or high-stakes code.
+- An L2 task needs `decision-review.jsonl` evidence before implementation starts.
+
+## Skip When
+
+- The change is mechanical: formatting, file moves, or obvious one-line edits.
+- You are only reading or summarizing existing code.
+- The user explicitly prioritizes speed over verification.
+
+## The 5-Step Doubt Cycle
+
+### 1. CLAIM
+
+Write a clear 2-3 line decision:
+
+```text
+CLAIM: "<one-sentence decision>"
+WHY THIS MATTERS: <why this being wrong would be costly>
+```
+
+If you cannot state the claim briefly, keep researching until the decision is concrete.
+
+### 2. EXTRACT
+
+Create the smallest reviewable artifact:
+
+- Code: a focused diff, function, or test case, not a whole file.
+- Design: 3-5 sentences plus the constraints that must hold.
+- Remove author reasoning; the reviewer should see the input, not the conclusion.
+
+### 3. DOUBT
+
+Ask for problems, not confirmation:
+
+```text
+Find problems with this artifact. Assume the author is overconfident. Look for:
+- Undeclared assumptions
+- Unhandled edge cases
+- Hidden coupling or shared state
+- Violated contract scenarios
+- Broken existing conventions
+- Failure modes under unexpected input
+
+Do not confirm. Do not summarize. Find problems, or explicitly state that no problems were found after review.
+
+ARTIFACT: <paste artifact>
+CONTRACT: <paste constraints>
+```
+
+Pass only ARTIFACT + CONTRACT, not CLAIM. Including CLAIM biases the reviewer toward agreement.
+
+You cannot spawn a fresh-context reviewer from within a subagent context. If doubt is required while inside a subagent, surface back to the main session so the review can run from a genuinely fresh context.
+
+### 4. RECONCILE
+
+Classify every finding in this order:
+
+1. Contract misunderstanding: fix the contract, then reclassify.
+2. Valid and actionable: modify the artifact, then restart the doubt cycle.
+3. Valid but accepted trade-off: record the trade-off explicitly.
+4. Noise: record and exclude it.
+
+### 5. STOP
+
+Stop when one condition is met:
+
+- The next round produces only trivial or already-considered findings.
+- Three cycles complete; report remaining substantive findings instead of starting a fourth cycle.
+- The user says enough.
+
+Substantive findings after three cycles mean the artifact is too large or immature. Return to EXTRACT and split it.
+
+## Evidence
+
+For L2 readiness, record accepted decisions in `<task>/decision-review.jsonl` using the internal `decision-review` protocol. At minimum, evidence must include `acceptanceId`, `claim`, `contract`, `reviewerContext`, `findings`, and `resolution`.
+
+## Common Rationalizations
+
+| Excuse | Why It Fails | Better Approach |
+|---|---|---|
+| "I'm confident, skip doubt" | Confidence is where blind spots hide. | Write a 2-line CLAIM and pass the artifact to fresh-context review. |
+| "Spawning a reviewer is expensive" | Debugging a bad decision after implementation costs more. | Run one bounded doubt cycle now. |
+| "Review will catch it later" | Final review catches completed artifacts; doubt catches direction errors while they are cheap. | Run doubt before committing to the direction. |
+| "Doubting every step causes delay" | Doubt only applies to non-trivial decisions. | Use the Apply When / Skip When sections to decide. |
+| "Reviewer disagrees, so I am wrong" | Reviewer output is information, not authority. | Classify each finding through RECONCILE. |
+
+## Relationship to Current Workflow
+
+- `decision-review`: internal mandatory L2 gate; write accepted evidence to `decision-review.jsonl`.
+- `review-protocol`: final implementation review; it does not replace in-flight doubt.
+- `cowork-flow`: public router; it decides whether to load this Skill or the internal protocol.
+- `TDD`: a failing test is doubt made concrete when the risk is executable behavior.
+- `break-loop`: use when doubt exposes a real failure mode but the fix path keeps looping.
+
+## Red Flags
+
+- Skipping doubt because you feel confident.
+- Passing CLAIM to the reviewer.
+- Treating reviewer output as authoritative instead of reconciling it.
+- Looping past three cycles.
+- Calling the review adversarial while asking whether the artifact "looks good".
+- Running another cycle against an unchanged artifact.
+- Getting substantive findings twice but classifying none as actionable.
+- Treating this Skill as a replacement for `decision-review.jsonl` or final review.
+
+## Verification
+
+- Every non-trivial decision has a CLAIM record.
+- Every non-trivial artifact receives at least one fresh-context review.
+- Reviewer receives ARTIFACT + CONTRACT (not CLAIM).
+- Findings are classified instead of rubber-stamped.
+- Stop conditions are satisfied before proceeding.