cowork-flow 1.0.0 → 1.1.3

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## 1.1.3 - 2026-08-30
+
+> **版本内容载体说明**：1.1.1（守卫修复批次）与 1.1.2（Review 基线 diff）章节内容随本 1.1.3 首次进入 npm 分发——三个批次同属一个发布周期，章节按批次序号记录，包内容以最新版本号为载体（与 1.1.0 承载 1.0.0 章节内容同一惯例）。
+
+### 规则表数据化（scope-rules 单源）
+
+- 新增 `.cowork-flow/spec/runtime/scope-rules.json`：scope 过滤规则（allowedTypes/wildcardChars/rejectedSegments/driveLetterPattern/trailingSlashRejectedTypes）与 stage-contract 限制（budget/scopeLimit/specLimit/verifyLimit）从三份复制实现下沉为单一数据文件。
+- Python（context_paths/fact_view）与 zcode/opencode JS 镜像运行时消费同一文件；文件缺失/畸形降级到与默认内容逐字一致的内嵌默认（默认等价由 tests/test_scope_rules.py 与 selfcheck 锁定）。
+- 规则可真实改变行为：wildcardChars 置空 → 通配条目进入 Scope；budget 调小 → 预算降级路径触发。
+- 修复预算兜底 1 字节超限：裁剪切分与闭标签间的换行预留。
+- **CI 修复（delegated 注入崩溃）**：zcode delegated 分支不再以空输入对象重新发现项目根（`findProjectRoot({})`），改为复用 main 已解析的工作流根——在无 `.cowork-flow/` 的目录（干净 checkout、非项目目录）触发 delegated prompt 不再 `join(null)` 崩溃；对应的注入测试显式指定 spawn 工作目录，消除对测试运行 cwd 的隐式依赖（干净 checkout 下此前必红，实测 dev 推送 CI 双平台失败）。
+- **CI 修复（Windows git 降级）**：`git` 二进制不可用（PATH 缺失/未安装）时 `_run_git_command` 捕获 OSError 按 rc!=0 降级——`current_head` 视为无头（不写 baseline）、变更集收集降级 status-only，`task start` 不再崩溃（Windows 的 CreateProcess 在 PATH 缺失时不回退，清空环境的会话测试此前必红；macOS execvp 有默认 PATH 兜底故本地绿）。
+
+## 1.1.2 - 2026-08-30
+
+### Review 基线 diff（堵住提交绕行面）
+
+- **基线记录**：`task start`（进入 in_progress）在 task.json `meta.baselineCommit` 记录当前 HEAD，且永不滑动（重复/幂等 start 不覆盖）——任务期间的审查窗口从激活时刻起固定。
+- **变更集合并**：review 门禁以 `baseline..HEAD` diff 与 working-tree status 的并集去重作为变更集——agent 中途 `git commit` 越界文件后，review 的 `unlisted_changed_file` 仍会触发（此前提交即从 status 消失，形成无痕通道）。
+- **降级语义**：无 git 仓库 / HEAD 不存在 / 基线缺失 / diff 失败（如 rebase 孤儿化）→ 降级 status-only，与旧行为一致，不产生错误 blocker。
+- **契约重开**：task-review SKILL 输入语义写明基线变更集与降级行为；已审查任务的增量重审聚焦自基线以来的变化，证据要求不变。
+
+## 1.1.1 - 2026-08-30
+
+### 守卫修复批次（对抗评审后落地）
+
+- **hook 崩溃修复**：implement.jsonl 含 `./` 前缀条目时 zcode/opencode 双宿主 hook 从 `TypeError: Assignment to constant variable` 崩溃（整个上下文注入丢失）改为正常输出——`const`→`let` 两处 + 回归 fixture。
+- **stage-contract 预算降级**：超限输入不再产出未闭合的畸形块；按 Verify → Specs → Scope 条目（至少 1 条）逐级降级，收尾标签与 Gates 行恒在；三线同构算法。
+- **MCP 路径隔离**：`task_scope`/`task_specs` 拒绝仓库外路径（`../`、绝对路径）返回 `task-outside-repo`；无 id 的 JSON-RPC 通知（含 initialize/ping/tools/list）不再响应。
+- **JS 白名单语义对齐**：zcode/opencode 过滤规则与 Python `normalize_context_file_scope_entry` 一致（非法 type、`../`、绝对路径、盘符、通配符一律丢弃）——editScopeWarning 与 Scope 行不再对 gate 会标记越界的文件静默放行；spec 指针同规则过滤。
+- **delegated 只读 scope**：子代理注入包删除 `Scope: subagent` 行；stage-contract 以父任务 scope `[read-only]` 变体呈现，Gates 话术同步（不再暗示子代理可自声明 scope）。
+- **异常降级可诊断**：锚点文件非法 UTF-8 时 stage-contract 保留 Scope/Gates 仅丢 Verify（此前整块静默消失）；非例行异常在 stderr 留痕。
+- **review 门禁补洞**：implement.jsonl 缺失时 review 产生 `missing_implement_jsonl_file_scope` blocker（此前静默放行，删除 manifest 即绕过白名单）。
+- **矩阵化跨端测试**：`test/fixtures/stage-contract-matrix.json` 单一数据文件驱动三线（python/zcode/opencode）逐字节相等断言，覆盖规范/`./` 前缀/非法边界/超限/emoji/缺锚点/空 scope/delegated 8 类用例；zcode hooks.json matcher（Bash|Edit|Write|MultiEdit）由模板测试锁定；新增 Python 侧矩阵断言。
+- dev_type 畸形值（非字符串）在 task_specs 中按缺省降级；spec 指针忽略 directory 条目；normalizeScopePath 带 trim；zcode 生命周期刷新正则对齐 dsh（task|subagent|resume）。
+- 契约文档如实化：context-injection.md 不再声称三线结构恒等/always emitted，改为差异表 + 矩阵锁定范围 + 残余缺口清单（matcher 依赖 ZCode 运行时工具名、JS 过滤为规则移植）。
+
+## 1.1.0 - 2026-08-29
+
+> **版本内容错位说明**：npm registry 上的 1.0.0 tarball 发布于 2026-08-26（仅含发版脚本修复之前的代码）。1.0.0 段下述的里程碑描述以本 1.1.0 为其实际发布载体——阶段 0-3 的全部内容自本版本起进入 npm 分发。
+
+### 方向落地（阶段 0-3，详见 1.0.0 段与 docs/direction.md）
+
+- 阶段 0：README 定位改写为「运行时上下文与协作事实层」；注入协议契约 `spec/contracts/context-injection.md`；契约指纹序列化三线统一 + slim 全覆盖 + 跨 host 一致性测试。
+- 阶段 1：`run state [task] --json` 事实视图；`<workflow-state>` 属性事实头 + `<decision-anchor>` 决策要点注入（三线一致）。
+- 阶段 2：`executor` 归属、冲突拦截与 `--takeover`、无会话 CI start、`subagent evidence` 证据位。
+- 阶段 3：`run mcp-state` 无依赖 MCP stdio 只读服务（`task_state` / `task_list`）+ `spec/contracts/fact-layer-access.md` 接入契约。
+- MCP 全局入口：`cowork-flow mcp-state` 透传命令——MCP 客户端全局注册一次即可服务所有 cowork-flow 项目。
+
 ## 1.0.0 - 2026-08-26
 
 首个稳定主线发布：核心流程契约、会话模型与宿主矩阵在此版本冻结，后续改动进入语义化版本约束。
@@ -17,6 +66,13 @@
 - 交互式平台选择器与平台检测断言随五宿主矩阵更新。
 - release.sh 容错：`--version` 精确模式在版本文件已全部就位（干净工作树）时，`git commit` 的 no-op 空提交不再中止脚本，继续 tag 与 publish；其余 commit 失败仍立即中止。新增回归测试覆盖两条路径。
 - release.sh 容错：目标发布 tag 已存在且指向当前 HEAD 时跳过创建并继续 publish（上次运行 tag 后 publish 未完成的重跑场景）；指向其它提交则中止报错。新增回归测试覆盖两条路径。
+- 方向收敛（阶段 0）：README 定位改为「运行时上下文与协作事实层」；新增注入协议契约 `spec/contracts/context-injection.md`（事件时机矩阵、digest 形态规则、序列化规范）；契约指纹序列化三线统一（zcode/opencode 稳定排序 + Python 紧凑分隔符，跨 host 指纹一致性测试锁定）；Python 线补 slim（SessionStart 全量 / 后续单行指纹，无事件 host 按会话文件首次判定）；codex 事件名读取；opencode 首次全量后续单行；dsh 会话开始全量、生命周期命令后单行刷新。
+- 事实层 API 化（阶段 1a）：新增 `./.cowork-flow/run state [task] --json` 事实视图——聚合 task.json（含 `_state` 修订）、decision-anchor 结构化要点（目标/验收项/被拒方案名）、plan 绑定、绑定会话与受信快照；无绑定输出 `task: null` 供机器分支。
+- 注入结构化（阶段 1b）：`<workflow-state>` 升级为属性事实头（`task`/`status`/`source` 进开标签，body 保留人读面包屑），三线一致并在协议契约冻结；planning/in_progress/review 状态下三线注入紧凑 `<decision-anchor>` 决策要点块（Python 复用 fact_view 解析单源），completed 终态与缺文件不注入。
+- 多执行者语义（阶段 2）：task.json 增加 `executor` 归属（start 写入会话 key 或显式 `--executor`）；执行者冲突 fail-closed（`LIFECYCLE-EXECUTOR-001`，幂等重跑同样拦截），`--takeover` 显式接管并覆写归属（含已激活任务的幂等接管）；`--executor` 允许无会话 CI/无头 start（不建会话绑定）；子代理运行时上下文新增 `evidence` 证据位（`subagent evidence <id> --note [--artifact]`，CAS 保护、closed 可补记、不影响任务状态机）；`run state` 人读摘要透出 Executor。
+- 生态适配（阶段 3）：新增 `./.cowork-flow/run mcp-state`——无依赖 MCP stdio 只读服务（newline-delimited JSON-RPC 2.0），工具 `task_state`（事实视图）与 `task_list`（活动任务概览）；接入契约 `spec/contracts/fact-layer-access.md` 冻结只读保证与"不自创跨 agent 协议、adapter 保持薄"立场，写路径仍独占于 CLI 门禁链。
+- 实现阶段守卫三件套：MCP `task_scope`/`task_specs` 只读工具（越界判定与规范清单，宿主无关、Python 单源）；`<stage-contract>` 实现契约块三线注入（编辑白名单/规范入口/门禁预告/任务自声明验证命令，≤1200 字符，跨宿主逐字相等测试锁定）；zcode 编辑越界实时警告（PostToolUse Edit/Write/MultiEdit 短路径，能力矩阵声明 `editScopeWarning`，其余宿主 fallback 到静态预告）。
+- MCP 全局入口：npm CLI 新增 `cowork-flow mcp-state` 透传命令——从 cwd 向上定位最近 `.cowork-flow/` 并以继承 stdio exec 该项目的 `run mcp-state`；MCP 客户端全局注册一次（`cowork-flow mcp-state`）即可服务所有 cowork-flow 项目，无需逐项目配置。
 
 ## 0.0.52 - 2026-08-26
 

package/README.md

@@ -1,16 +1,17 @@
 # cowork-flow
 
-> 项目协作流程模板 — 把需求、计划、实现、验证串成闭环。
+> 多主机 Agent 协作的运行时上下文与协作事实层 — 让任何主机上的任何 agent，在任何会话、任何时刻，从同一份权威事实起步。
 
 ## 一句话
 
-**cowork-flow 不写代码，它帮你建流程。** 把 `template/` 复制到目标项目，立刻获得任务流、规格治理、开发计划和会话记录骨架。
+**cowork-flow 不写代码，它给 agent 喂状态。** 把 `template/` 复制到目标项目，立刻获得运行时状态注入、任务生命周期、决策记录、规格契约与跨宿主的协作事实一致性。
 
 ## 当前能力
 
 | 领域 | 当前能力 |
 |---|---|
 | 任务流程 | `task next --json` 给出下一步 action，`task next --run` 只执行当前 action。 |
+| 事实接入 | `run state [task] --json` 事实视图；`run mcp-state` 无依赖 MCP 只读服务（`task_state` / `task_list`）供任何 MCP 客户端查询。 |
 | 运行健康 | `doctor` 诊断 runtime、host assets、Skill replica 和任务 hygiene，不推进生命周期。 |
 | Host 分发 | Host Asset Manifest 驱动 Codex / OpenCode / Claude Code / ZCode / DeepSeek Harness 资产和 obsolete 清理。 |
 | 批处理与讨论 | Batch 发布 Host action；Party Mode 只输出 advisory final facts。 |
@@ -24,6 +25,7 @@
 | 理解任务如何流转 | [任务流程](#任务流程) |
 | 处理故障或漂移 | [支持与故障诊断](#支持与故障诊断) |
 | 做发布前检查 | [发布](#发布)、[`CHANGELOG.md`](CHANGELOG.md) |
+| 了解项目方向与演进路线 | [`docs/direction.md`](docs/direction.md) |
 | 接入到自己项目 | [接入原则](#接入原则) |
 
 ## 适用 / 不适用
@@ -64,6 +66,10 @@ cowork-flow install-dsh-preset
 # 机器级安装实时 workflow-state 注入（推荐：不换预设，任意 DSH 会话生效）
 cowork-flow install-dsh-hook
 
+# MCP 客户端接入（可选）：全局注册一次，任意项目查询任务事实
+# 各客户端配置样例见 docs/mcp-client-setup.md
+cowork-flow mcp-state
+
 # 维护者发布前检查
 npm run release:check
 ```
@@ -124,6 +130,7 @@ Skills 维护在 `template/skills/` 唯一源码，`init` / `sync` 时按目录
 | `install-dsh-preset` | 安装 DSH agent 预设到 `~/.dsh/.agent-presets/cowork-flow/`（整套 agent，可选） |
 | `install-dsh-hook` | 机器级注册 workflow-state hook 组合行到 `$DSH_HOME/cordis.patch.yml`（当前 DSH 的 agent 提示不收集 host 层 section，实时注入请用预设方式） |
 | `update [--dry-run]` | 升级 CLI 本身 |
+| `mcp-state` | 全局 MCP 事实入口：从 cwd 向上定位项目运行时并透传 `run mcp-state`（全局注册一次，所有 cowork-flow 项目通用） |
 
 ### init 选项
 
@@ -325,6 +332,8 @@ npm run release -- --version 0.1.0  # 精确发布指定版本（跳过自动 bu
 5. `git commit` + `git tag`
 6. `npm publish`
 
+**CI 发布通道（推荐）：** `scripts/release.sh --version <v>` 打好 tag 后，`gh release create v<v>` 触发 `.github/workflows/publish.yml`——Ubuntu/Windows 双平台全量门禁通过后自动 `npm publish`（需仓库 secret `NPM_TOKEN`，权限：publish）。
+
 - 发布说明维护在 `CHANGELOG.md`；发布前更新当前版本段落，并保留 `release:check` 和 `git diff --check` 证据。
 
 CI 的 PR 同时运行 Ubuntu core 与 Windows core；发布工作流要求 Ubuntu 与 Windows full verification 均成功后才执行 publish。测试 job 不接触 `NPM_TOKEN`，仅 publish job 使用该 secret。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "1.0.0",
+  "version": "1.1.3",
   "description": "CLI for installing and maintaining cowork-flow collaboration templates.",
   "type": "module",
   "bin": {

package/presets/dsh/plugins/workflow-state.js

@@ -51,6 +51,7 @@ import sys
 from pathlib import Path
 
 cwd = sys.argv[1]
+full_digest = len(sys.argv) > 2 and sys.argv[2] != "0"
 current = Path(cwd).resolve()
 root = None
 while True:
@@ -77,6 +78,7 @@ print(build_hook_context(
         "runtime_context_identity: formal subagent sessions bind before workflow-state injection\\n"
         "</dsh-runtime>",
     ),
+    session_start=full_digest,
 ))
 `;
 
@@ -127,11 +129,11 @@ function discoverCandidates() {
 }
 
 
-function tryPython(candidate, cwd) {
+function tryPython(candidate, cwd, full = true) {
   return new Promise((resolve) => {
     execFile(
       candidate.command,
-      [...candidate.args, '-c', PYTHON_PROTOCOL, cwd],
+      [...candidate.args, '-c', PYTHON_PROTOCOL, cwd, full ? '1' : '0'],
       EXEC_OPTIONS,
       (error, stdout) => {
         if (error) {
@@ -192,10 +194,12 @@ export async function findCoworkRoot(cwd) {
 
 /**
  * Produce the `<workflow-state>` hook context block for a workspace cwd.
- * Empty string means "contribute nothing" (no root, hooks disabled, no
- * usable interpreter, or a broken runtime).
+ * `full` selects the digest shape: true (default) for the full contract
+ * block on session-start-like refreshes, false for the single fingerprint
+ * line on intra-turn refreshes. Empty string means "contribute nothing"
+ * (no root, hooks disabled, no usable interpreter, or a broken runtime).
  */
-export async function runWorkflowState(cwd) {
+export async function runWorkflowState(cwd, full = true) {
   if (hooksDisabled() || !cwd) {
     return '';
   }
@@ -212,14 +216,14 @@ export async function runWorkflowState(cwd) {
     return '';
   }
   if (workingPython !== null) {
-    const result = await tryPython(workingPython, cwd);
+    const result = await tryPython(workingPython, cwd, full);
     if (!result.missing) {
       return normalize(result.output);
     }
     workingPython = null;
   }
   for (const candidate of discoverCandidates()) {
-    const result = await tryPython(candidate, cwd);
+    const result = await tryPython(candidate, cwd, full);
     if (result.missing) {
       continue;
     }
@@ -231,11 +235,15 @@ export async function runWorkflowState(cwd) {
 
 
 export function apply(ctx) {
-  // One cache entry per agent: { text, inflight, queued }. The WeakMap key
-  // is the live Agent object the events and the assembly context both carry.
+  // One cache entry per agent: { text, inflight, queued, full }.
+  // `full` records the digest shape the next refresh should use: session
+  // starts and inbox claims re-inject the full contract block, intra-turn
+  // refreshes after lifecycle commands only repeat the fingerprint line.
+  // The WeakMap key is the live Agent object the events and the assembly
+  // context both carry.
   const states = new WeakMap();
 
-  const refresh = (agent) => {
+  const refresh = (agent, full = true) => {
     const cwd = agent && agent.cwd;
     if (!cwd) {
       return;
@@ -245,6 +253,7 @@ export function apply(ctx) {
       entry = { text: '', inflight: false, queued: false };
       states.set(agent, entry);
     }
+    entry.full = full;
     if (entry.inflight) {
       // A refresh arrived while one was running (e.g. several lifecycle
       // commands back to back). Re-run once after it settles so the latest
@@ -253,7 +262,7 @@ export function apply(ctx) {
       return;
     }
     entry.inflight = true;
-    runWorkflowState(cwd)
+    runWorkflowState(cwd, entry.full)
       .then((text) => {
         entry.text = text;
       })
@@ -264,21 +273,22 @@ export function apply(ctx) {
         entry.inflight = false;
         if (entry.queued) {
           entry.queued = false;
-          refresh(agent);
+          refresh(agent, entry.full);
         }
       });
   };
 
-  ctx.on('agent/session-start', (payload) => refresh(payload && payload.agent));
-  ctx.on('agent/inbox/claimed', (payload) => refresh(payload && payload.agent));
+  ctx.on('agent/session-start', (payload) => refresh(payload && payload.agent, true));
+  ctx.on('agent/inbox/claimed', (payload) => refresh(payload && payload.agent, true));
   // Intra-turn refresh: a lifecycle command just settled, so the next prompt
   // assembly should already see the new state instead of the stale block.
+  // Same-session refresh, so only the fingerprint line is repeated.
   ctx.on('tools/result', (exec) => {
     const agent = exec && exec.agent;
     if (!agent || !isLifecycleCommand(exec && exec.arguments)) {
       return;
     }
-    refresh(agent);
+    refresh(agent, false);
   });
 
   ctx.effect(() => ctx.systemPrompt.section({

package/src/cli.js

@@ -6,6 +6,7 @@ import { runInit } from './commands/init.js';
 import { runInstallDshHook } from './commands/install-dsh-hook.js';
 import { runInstallDshPreset } from './commands/install-dsh-preset.js';
 import { runInstallZCodePlugin } from './commands/install-zcode-plugin.js';
+import { runMcpState } from './commands/mcp-state.js';
 import { runSourceRefresh } from './commands/source-refresh.js';
 import { runSync } from './commands/sync.js';
 import { runUpdate } from './commands/update.js';
@@ -21,6 +22,7 @@ Usage:
   cowork-flow update
   cowork-flow sync [target] [--dry-run] [--force]
   cowork-flow source-refresh [target] [--dry-run]
+  cowork-flow mcp-state
   cowork-flow --version
   cowork-flow --help
 `;
@@ -199,6 +201,10 @@ export async function main(argv = process.argv.slice(2), options = {}) {
       return await runInstallDshHook(args);
     }
 
+    if (command === 'mcp-state') {
+      return await runMcpState(args);
+    }
+
     io.writeErr(`Unknown command: ${command}\n`);
     return 1;
   } catch (error) {

package/src/commands/mcp-state.js

@@ -0,0 +1,66 @@
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const DIR_WORKFLOW = '.cowork-flow';
+
+function defaultIo() {
+  return {
+    writeOut(message) {
+      process.stdout.write(message);
+    },
+    writeErr(message) {
+      process.stderr.write(message);
+    },
+  };
+}
+
+function findNearestWorkflowRoot(startDir) {
+  let current = resolve(startDir);
+  // Same semantics as the MCP server's root resolution (get_repo_root):
+  // walk up to the nearest directory containing .cowork-flow/, so a client
+  // launching the globally registered server inside any project subdirectory
+  // still lands on the right facts.
+  for (;;) {
+    if (existsSync(join(current, DIR_WORKFLOW))) {
+      return current;
+    }
+    const parent = resolve(current, '..');
+    if (parent === current) {
+      return null;
+    }
+    current = parent;
+  }
+}
+
+export async function runMcpState(args, options = {}) {
+  const io = options.io ?? defaultIo();  const root = findNearestWorkflowRoot(process.cwd());
+  if (root === null) {
+    io.writeErr(
+      'Error: no .cowork-flow/ found from the current directory; '
+        + 'run this inside a cowork-flow project.\n'
+    );
+    return 1;
+  }
+
+  const runnerName = process.platform === 'win32' ? 'run.cmd' : 'run';
+  const runner = join(root, DIR_WORKFLOW, runnerName);
+  if (!existsSync(runner)) {
+    io.writeErr(`Error: workflow runner not found: ${runner}\n`);
+    return 1;
+  }
+
+  return await new Promise((resolveExit) => {
+    const child = spawn(runner, ['mcp-state', ...args], {
+      stdio: 'inherit',
+      cwd: root,
+    });
+    child.on('error', (error) => {
+      io.writeErr(`Error: failed to launch ${runner}: ${error.message}\n`);
+      resolveExit(1);
+    });
+    child.on('exit', (code) => {
+      resolveExit(code ?? 1);
+    });
+  });
+}

package/template/.claude/hooks/inject-workflow-state.py

@@ -63,6 +63,11 @@ def main() -> int:
     sys.path.insert(0, str(scripts_dir))
     from adapters.host.workflow_state_hook import build_hook_context
 
+    event_name = (
+        hook_input.get("hook_event_name")
+        or hook_input.get("hookEventName")
+        or "UserPromptSubmit"
+    )
     context = build_hook_context(
         root,
         hook_input,
@@ -75,11 +80,7 @@ def main() -> int:
                 "</claude-code-runtime>"
             ),
         ),
-    )
-    event_name = (
-        hook_input.get("hook_event_name")
-        or hook_input.get("hookEventName")
-        or "UserPromptSubmit"
+        session_start=(event_name == "SessionStart"),
     )
     print(
         json.dumps(

package/template/.codex/hooks/inject-workflow-state.py

@@ -61,6 +61,11 @@ def main() -> int:
     )
 
     dispatch_mode = codex_dispatch_mode(root)
+    event_name = (
+        hook_input.get("hook_event_name")
+        or hook_input.get("hookEventName")
+        or "UserPromptSubmit"
+    )
     context = build_hook_context(
         root,
         hook_input,
@@ -77,12 +82,15 @@ def main() -> int:
                 "</codex-runtime>"
             ),
         ),
+        # Codex registers UserPromptSubmit only, so event_name carries no
+        # session-start signal; build_hook_context falls back to the session
+        # state file probe (full on first injection, slim afterwards).
     )
     print(
         json.dumps(
             {
                 "hookSpecificOutput": {
-                    "hookEventName": "UserPromptSubmit",
+                    "hookEventName": event_name,
                     "additionalContext": context,
                 }
             },

package/template/.cowork-flow/.version

@@ -1 +1 @@
-1.0.0
+1.1.3

package/template/.cowork-flow/adapters/claude-code/adapter.yaml

@@ -13,6 +13,7 @@ capabilities:
   runtimeContextDispatch: native
   runtimeContextBinding: shim
   runtimeContextCleanup: native
+  editScopeWarning: unsupported
 dispatch:
   primitive: subagent
   agentsPath: .claude/agents

package/template/.cowork-flow/adapters/codex/adapter.yaml

@@ -13,6 +13,7 @@ capabilities:
   runtimeContextDispatch: native
   runtimeContextBinding: shim
   runtimeContextCleanup: native
+  editScopeWarning: unsupported
 dispatch:
   primitive: spawn_agent
   forkTurns: none

package/template/.cowork-flow/adapters/dsh/adapter.yaml

@@ -13,6 +13,7 @@ capabilities:
   runtimeContextDispatch: native
   runtimeContextBinding: shim
   runtimeContextCleanup: shim
+  editScopeWarning: unsupported
 dispatch:
   primitive: subagent
   skillsPath: .agents/skills

package/template/.cowork-flow/adapters/opencode/adapter.yaml

@@ -13,6 +13,7 @@ capabilities:
   runtimeContextDispatch: native
   runtimeContextBinding: shim
   runtimeContextCleanup: native
+  editScopeWarning: unsupported
 dispatch:
   primitive: task
   agentsPath: .opencode/agents

package/template/.cowork-flow/adapters/zcode/adapter.yaml

@@ -13,6 +13,7 @@ capabilities:
   runtimeContextDispatch: native
   runtimeContextBinding: shim
   runtimeContextCleanup: native
+  editScopeWarning: plugin
 dispatch:
   primitive: subagent
   agentsPath: .zcode/agents

package/template/.cowork-flow/scripts/adapters/cli/state.py

@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""`run state [task] [--json]` — the fact-layer read entry.
+
+Assembles one machine-readable fact view per task (task.json, decision-anchor
+essentials, plan binding, bound sessions, trusted snapshot). See
+services/fact_view.py and docs/direction.md stage 1.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+if __package__:
+    from . import _bootstrap as _bootstrap  # noqa: F401
+else:
+    import _bootstrap  # noqa: F401
+
+from infra.paths import get_repo_root
+from runtime.session_state import get_active_task
+from services.fact_view import build_fact_view
+from services.task_repository import TaskRepository, TaskRepositoryError
+
+
+def _human_summary(view: dict) -> str:
+    task = view.get("task") or {}
+    lines = [
+        f"Task: {view.get('taskPath')}",
+        f"Status: {task.get('status')}",
+    ]
+    executor = task.get("executor")
+    if executor:
+        lines.append(f"Executor: {executor}")
+    anchor = view.get("decisionAnchor") or {}
+    if anchor.get("exists"):
+        goal = anchor.get("goal") or ""
+        lines.append(f"Goal: {goal.splitlines()[0] if goal else ''}")
+        criteria = anchor.get("acceptanceCriteria") or []
+        lines.append(f"Acceptance criteria: {len(criteria)}")
+        rejected = anchor.get("rejectedOptions") or []
+        if rejected:
+            lines.append(f"Rejected options: {len(rejected)}")
+    plan = view.get("plan") or {}
+    if plan.get("bound"):
+        lines.append(f"Plan: {plan.get('file')}")
+    sessions = view.get("sessions") or []
+    lines.append(f"Bound sessions: {len(sessions)}")
+    snapshot = view.get("snapshot")
+    lines.append(
+        f"Snapshot: {snapshot.get('status') if snapshot else 'none'}"
+    )
+    return "\n".join(lines)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        prog="state",
+        description="Show the fact view for a task (machine-readable with --json).",
+    )
+    parser.add_argument(
+        "task",
+        nargs="?",
+        default=None,
+        help="Task directory or name; defaults to the session-bound active task.",
+    )
+    parser.add_argument(
+        "--json",
+        action="store_true",
+        dest="as_json",
+        help="Print the fact view as JSON.",
+    )
+    args = parser.parse_args()
+
+    repo_root = get_repo_root()
+    target = args.task
+    if target is None:
+        active = get_active_task(repo_root)
+        target = active.task_path
+        if not target:
+            if args.as_json:
+                print(
+                    json.dumps(
+                        {
+                            "schemaVersion": 1,
+                            "task": None,
+                            "reason": "no-active-task",
+                        },
+                        ensure_ascii=False,
+                    )
+                )
+                return 0
+            print(
+                "No active task bound to this session; pass a task directory "
+                "or name.",
+                file=sys.stderr,
+            )
+            return 1
+
+    try:
+        task_dir = TaskRepository(repo_root).resolve(target)
+    except TaskRepositoryError as error:
+        print(f"Error: {error}", file=sys.stderr)
+        return 1
+
+    if not (Path(task_dir) / "task.json").is_file():
+        print(f"Error: task.json not found under {task_dir}", file=sys.stderr)
+        return 1
+
+    view = build_fact_view(repo_root, Path(task_dir))
+    if args.as_json:
+        print(json.dumps(view, ensure_ascii=False, indent=2))
+    else:
+        print(_human_summary(view))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/template/.cowork-flow/scripts/adapters/cli/subagent.py

@@ -273,6 +273,25 @@ def cmd_bind(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_evidence(args: argparse.Namespace) -> int:
+    repo_root = get_repo_root()
+    try:
+        context = RuntimeContextService(repo_root).evidence(
+            args.subagent_id,
+            note=args.note,
+            artifact=getattr(args, "artifact", None),
+        )
+    except RuntimeContextError as error:
+        _print_runtime_error(error)
+        return 1
+    if context is None:
+        print(f"Error: subagent not found: {args.subagent_id}", file=sys.stderr)
+        return 1
+    entries = context.get("evidence") or []
+    print(f"subagent {args.subagent_id} evidence entries={len(entries)}")
+    return 0
+
+
 def cmd_close(args: argparse.Namespace) -> int:
     repo_root = get_repo_root()
     try:
@@ -322,6 +341,15 @@ def build_parser() -> argparse.ArgumentParser:
     bind.add_argument("context_key")
     bind.set_defaults(func=cmd_bind)
 
+    evidence = subparsers.add_parser(
+        "evidence",
+        help="Append an evidence entry to a runtime context (does not move task status)",
+    )
+    evidence.add_argument("subagent_id")
+    evidence.add_argument("--note", required=True)
+    evidence.add_argument("--artifact", default=None)
+    evidence.set_defaults(func=cmd_evidence)
+
     close = subparsers.add_parser("close", help="Close subagent runtime context")
     close.add_argument("subagent_id")
     close.set_defaults(func=cmd_close)

package/template/.cowork-flow/scripts/adapters/cli/task.py

@@ -12,15 +12,17 @@ if __package__:
 else:
     import _bootstrap  # noqa: F401
 
+from services.context_discovery import (
+    get_implement_backend,
+    get_implement_base,
+    get_implement_frontend,
+    get_implement_spec,
+)
 from services.task_context import (
     detect_installed_platforms as _detect_installed_platforms,
     discover_spec_files as _discover_spec_files,
     get_check_context,
     get_debug_context,
-    get_implement_backend,
-    get_implement_base,
-    get_implement_frontend,
-    get_implement_spec,
     is_skill_path as _is_skill_path,
     iter_jsonl_lines as _iter_jsonl_lines,
     skill_path as _skill_path,

package/template/.cowork-flow/scripts/adapters/cli/task_lifecycle_commands.py

@@ -266,7 +266,11 @@ def cmd_start(args: argparse.Namespace) -> int:
     if getattr(args, "auto", False):
         return _run_auto_start(args, full_path, service)
 
-    result = service.start(full_path)
+    result = service.start(
+        full_path,
+        executor=getattr(args, "executor", None),
+        takeover=bool(getattr(args, "takeover", False)),
+    )
     if not result.ok:
         return _report_start_failure(result)