cowork-flow 1.9.2 → 2.0.0

package/template/.cowork-flow/scripts/services/lifecycle_checks.py

@@ -46,13 +46,8 @@ PROTECTED_WORKFLOW_PATTERNS = (
 )
 
 # A recorded exemption names what it waived: the flag that allowed it, the
-# actor who applied it, and the concrete items. The item list is capped so a
-# pathological repo cannot turn one completion into pages of output, and a
-# single command is clipped so one long declaration cannot do the same.
-SPEC_EXEMPTION_FLAG = "--allow-unchecked"
+# actor who applied it, and the concrete items.
 EVIDENCE_EXEMPTION_FLAG = "--allow-missing-evidence"
-SPEC_EXEMPTION_ITEM_LIMIT = 10
-SPEC_EXEMPTION_COMMAND_LIMIT = 80
 
 
 @dataclass(frozen=True)
@@ -71,9 +66,7 @@ class LifecycleCheckResult:
     stage: str
     blockers: tuple[str, ...] = ()
     issues: tuple[LifecycleCheckIssue, ...] = ()
-    spec_check: dict | None = None
     evidence_exemption: dict | None = None
-    spec_exemption: dict | None = None
 
     def __post_init__(self) -> None:
         if self.issues and not self.blockers:
@@ -124,20 +117,9 @@ class LifecycleCheckRunner:
         task_dir: Path,
         *,
         allow_spec_file_modifications: bool | None = None,
-        allow_unchecked_specs: bool | None = None,
         allow_missing_evidence: bool | None = None,
         execution_policy: LifecycleExecutionPolicy | None = None,
     ) -> LifecycleCheckResult:
-        spec_report = _spec_check_report(self.repo_root)
-        allow_unchecked = (
-            bool(allow_unchecked_specs)
-            if allow_unchecked_specs is not None
-            else _policy_allows_unchecked(execution_policy)
-        )
-        spec_issues = _spec_check_completion_issues(
-            spec_report,
-            allow_unchecked_specs=allow_unchecked,
-        )
         ac_issues, evidence_exemption = _ac_evidence_completion_facts(
             task_dir,
             allow_missing_evidence=(
@@ -161,15 +143,9 @@ class LifecycleCheckRunner:
                     self.repo_root,
                     task_dir,
                 ))
-                + list(spec_issues)
                 + list(ac_issues)
             ),
-            spec_check=spec_report,
             evidence_exemption=evidence_exemption,
-            spec_exemption=_spec_check_exemption(
-                spec_report,
-                allow_unchecked_specs=allow_unchecked,
-            ),
         )
 
 
@@ -182,12 +158,6 @@ def _policy_allows_spec_changes(
     return bool(allow_spec_file_modifications)
 
 
-def _policy_allows_unchecked(
-    execution_policy: LifecycleExecutionPolicy | None,
-) -> bool:
-    return bool(execution_policy is not None and execution_policy.allow_unchecked_specs)
-
-
 def _policy_allows_missing_evidence(
     execution_policy: LifecycleExecutionPolicy | None,
 ) -> bool:
@@ -299,83 +269,6 @@ def _ac_evidence_completion_facts(
     return issues, exemption
 
 
-def _spec_check_report(repo_root: Path) -> dict | None:
-    """Run the lifecycle-phase spec checks. A structural failure degrades to
-    an unchecked report — never to a silently passing gate."""
-    try:
-        from services.spec_check import run_checks
-    except Exception:  # pragma: no cover - import surface must stay lazy
-        return {"schemaVersion": 1, "phase": "lifecycle", "results": [],
-                "parseErrors": [], "summary": {"pass": 0, "violation": 0,
-                "unchecked": 1, "executorError": 1,
-                "classification": "executor-failure"}}
-    try:
-        return run_checks(repo_root, phase="lifecycle")
-    except Exception as error:  # fail closed: unchecked, not pass
-        return {"schemaVersion": 1, "phase": "lifecycle", "results": [],
-                "parseErrors": [], "summary": {"pass": 0, "violation": 0,
-                "unchecked": 1, "executorError": 1, "error": str(error),
-                "classification": "executor-failure"}}
-
-
-def _exemption_command(cmd: object) -> str:
-    """One declared command, clipped so a long line cannot swamp the output.
-
-    The clip never splits the first token: that token names the program, which
-    is the part that says what could not be verified.
-    """
-    text = " ".join(str(cmd or "").split())
-    if len(text) <= SPEC_EXEMPTION_COMMAND_LIMIT:
-        return text
-    head = text.split(" ", 1)[0]
-    return text[: max(SPEC_EXEMPTION_COMMAND_LIMIT, len(head))] + "…"
-
-
-def _unchecked_exemption_items(spec_report: dict) -> tuple[list[dict], bool]:
-    """The unchecked declarations, capped, plus whether anything was dropped."""
-    items = [
-        {
-            "spec": item.get("spec") or "?",
-            "cmd": _exemption_command(item.get("cmd")),
-        }
-        for item in spec_report.get("results") or []
-        if isinstance(item, dict) and item.get("status") == "unchecked"
-    ]
-    return items[:SPEC_EXEMPTION_ITEM_LIMIT], len(items) > SPEC_EXEMPTION_ITEM_LIMIT
-
-
-def _spec_check_exemption(
-    spec_report: dict | None,
-    *,
-    allow_unchecked_specs: bool,
-) -> dict | None:
-    """The exemption this completion applied, or None.
-
-    Single source for both the persisted telemetry and the delivery output:
-    a waived gate that is recorded but never shown reads as a clean pass, and
-    one that is shown as a bare count reads as a clean pass to whoever has to
-    check it afterwards. An executor failure is never exemptible, so it never
-    yields one.
-    """
-    if not spec_report or not allow_unchecked_specs:
-        return None
-    summary = spec_report.get("summary") or {}
-    if int(summary.get("executorError") or 0):
-        return None
-    unchecked = int(summary.get("unchecked") or 0)
-    if not unchecked:
-        return None
-    items, truncated = _unchecked_exemption_items(spec_report)
-    exemption = {
-        "unchecked": unchecked,
-        "uncheckedItems": items,
-        "flag": SPEC_EXEMPTION_FLAG,
-    }
-    if truncated:
-        exemption["truncated"] = True
-    return exemption
-
-
 def _actor_text(actor: object) -> str:
     """The recorded actor, or `null` — never a stand-in identity."""
     return "null" if actor is None else str(actor)
@@ -390,23 +283,6 @@ def exemption_report_lines(meta: dict | None) -> list[str]:
     """
     meta = meta if isinstance(meta, dict) else {}
     lines: list[str] = []
-    spec_exempt = meta.get("specCheckExempt")
-    if isinstance(spec_exempt, dict):
-        lines.append(
-            f"Exempted: {spec_exempt.get('unchecked', 0)} unchecked "
-            f"spec-check command(s) via {spec_exempt.get('flag')} "
-            "(recorded in task.json meta.specCheckExempt, "
-            f"by {_actor_text(spec_exempt.get('by'))})"
-        )
-        items = spec_exempt.get("uncheckedItems") or []
-        for item in items:
-            if isinstance(item, dict):
-                lines.append(f"  - {item.get('spec')}: {item.get('cmd')}")
-        if spec_exempt.get("truncated"):
-            lines.append(
-                f"  - (more than {len(items)} unchecked commands; the list is "
-                "truncated — see meta.specCheckExempt.uncheckedItems)"
-            )
     evidence_exempt = meta.get("evidenceExempt")
     if isinstance(evidence_exempt, dict):
         missing = evidence_exempt.get("missing") or []
@@ -436,103 +312,12 @@ def exemption_meta_payloads(
     such as the creator or assignee.
     """
     payloads: dict[str, dict] = {}
-    spec_exemption = getattr(check_result, "spec_exemption", None)
-    if spec_exemption:
-        payloads["specCheckExempt"] = {"by": executor, **spec_exemption}
     evidence_exemption = getattr(check_result, "evidence_exemption", None)
     if evidence_exemption:
         payloads["evidenceExempt"] = {"by": executor, **evidence_exemption}
     return payloads
 
 
-def _spec_check_parse_error_issue(parse_errors: list) -> LifecycleCheckIssue | None:
-    """The blocking fact for declarations the parser could not read."""
-    if not parse_errors:
-        return None
-    details = []
-    for item in parse_errors:
-        if isinstance(item, dict):
-            spec = item.get("spec") or "?"
-            error = item.get("error") or "unknown parse error"
-            details.append(f"{spec}: {error}")
-    suffix = "; ".join(details[:3])
-    return LifecycleCheckIssue(
-        code="SPEC-CHECK-PARSE-ERROR",
-        message=(
-            f"spec checks report {len(parse_errors)} parse error(s)"
-            + (f": {suffix}" if suffix else "")
-        ),
-    )
-
-
-def _spec_check_executor_issue(summary: dict) -> LifecycleCheckIssue | None:
-    """The blocking fact for a spec-check executor that never ran.
-
-    Not waivable: --allow-unchecked exempts a command that could not run, not
-    an executor that is broken. The `unchecked: 1` in a degraded report is a
-    placeholder for "no verdict", so it never becomes a finding of its own.
-    """
-    if not int(summary.get("executorError") or 0):
-        return None
-    return LifecycleCheckIssue(
-        code="SPEC-CHECK-EXECUTOR-ERROR",
-        message=(
-            "spec-check executor failed; the declared checks did not run, so "
-            "this is not an exemption-eligible unchecked result — fix the "
-            "spec-check executor and rerun"
-        ),
-    )
-
-
-def _spec_check_completion_issues(
-    spec_report: dict | None,
-    *,
-    allow_unchecked_specs: bool,
-) -> list[LifecycleCheckIssue]:
-    if not spec_report:
-        return []
-    summary = spec_report.get("summary") or {}
-    issues: list[LifecycleCheckIssue] = []
-    parse_error_issue = _spec_check_parse_error_issue(
-        spec_report.get("parseErrors") or []
-    )
-    if parse_error_issue is not None:
-        issues.append(parse_error_issue)
-    executor_issue = _spec_check_executor_issue(summary)
-    if executor_issue is not None:
-        issues.append(executor_issue)
-    violation = int(summary.get("violation") or 0)
-    unchecked = int(summary.get("unchecked") or 0)
-    if violation:
-        first_lines = []
-        for item in spec_report.get("results") or []:
-            if item.get("status") == "violation":
-                detail = item.get("firstViolationLine") or item.get("reason") or ""
-                first_lines.append(f"{item.get('spec')}: {detail}")
-        issues.append(
-            LifecycleCheckIssue(
-                code="SPEC-CHECK-VIOLATION",
-                message=(
-                    "spec checks report "
-                    f"{violation} violation(s): {'; '.join(first_lines[:3])}"
-                ),
-            )
-        )
-    if unchecked and executor_issue is None and not allow_unchecked_specs:
-        issues.append(
-            LifecycleCheckIssue(
-                code="SPEC-CHECK-UNCHECKED",
-                message=(
-                    f"spec checks report {unchecked} unchecked command(s) "
-                    "(missing/timeout); rerun spec-check, or pass "
-                    "--allow-unchecked to complete with the exemption recorded"
-                ),
-            )
-        )
-    return issues
-
-
-
 def task_changed_paths(repo_root: Path, task_dir: Path) -> tuple[list[str], bool]:
     """Review change set for one task: baseline..HEAD merged with the
     working tree, plus whether the snapshot degraded to status-only."""

package/template/.cowork-flow/scripts/services/lifecycle_policy.py

@@ -35,7 +35,6 @@ class LifecycleExecutionPolicy:
 
     execution_scope: str
     allow_spec_file_modifications: bool
-    allow_unchecked_specs: bool = False
     allow_missing_evidence: bool = False
 
 
@@ -106,20 +105,17 @@ def resolve_execution_policy(
     execution_context: ExecutionContext | None = None,
     *,
     allow_spec_file_modifications: bool | None = None,
-    allow_unchecked_specs: bool | None = None,
     allow_missing_evidence: bool | None = None,
 ) -> LifecycleExecutionPolicy:
     """Resolve lifecycle scope capability from execution facts."""
     if execution_context is None:
         if (
             allow_spec_file_modifications is not None
-            or allow_unchecked_specs is not None
             or allow_missing_evidence is not None
         ):
             return LifecycleExecutionPolicy(
                 execution_scope="explicit",
                 allow_spec_file_modifications=bool(allow_spec_file_modifications),
-                allow_unchecked_specs=bool(allow_unchecked_specs),
                 allow_missing_evidence=bool(allow_missing_evidence),
             )
         execution_context = ExecutionContext()
@@ -133,7 +129,6 @@ def resolve_execution_policy(
     return LifecycleExecutionPolicy(
         execution_scope=execution_context.mode,
         allow_spec_file_modifications=allowed,
-        allow_unchecked_specs=bool(allow_unchecked_specs),
         allow_missing_evidence=bool(allow_missing_evidence),
     )
 

package/template/.cowork-flow/scripts/services/task_gate_profiles.py

@@ -64,7 +64,7 @@ def is_light_task(task_data: dict) -> bool:
 
     A light task still runs under the strict profile: it skips the review
     receipt, the acceptance-evidence and the dev_type gates, and nothing
-    else. The spec-check, file-scope and acceptance-row gates stay in force,
+    else. The file-scope and acceptance-row gates stay in force,
     so this is a narrower reading list rather than an exemption channel.
     """
     if resolve_gate_profile(task_data) != GATE_PROFILE_STRICT:

package/template/.cowork-flow/scripts/services/task_lifecycle.py

@@ -234,7 +234,6 @@ class TaskLifecycleService:
         *,
         completed_at: str | None = None,
         allow_spec_file_modifications: bool | None = None,
-        allow_unchecked_specs: bool = False,
         allow_missing_evidence: bool = False,
         execution_context: object | None = None,
     ) -> LifecycleResult:
@@ -243,7 +242,6 @@ class TaskLifecycleService:
             task,
             completed_at=completed_at,
             allow_spec_file_modifications=allow_spec_file_modifications,
-            allow_unchecked_specs=allow_unchecked_specs,
             allow_missing_evidence=allow_missing_evidence,
             execution_context=execution_context,
         )
@@ -255,7 +253,6 @@ class TaskLifecycleService:
         *,
         preflight: Preflight | None = None,
         allow_spec_file_modifications: bool | None = None,
-        allow_unchecked_specs: bool = False,
         allow_missing_evidence: bool = False,
         completed_at: str | None = None,
         execution_context: object | None = None,
@@ -268,7 +265,6 @@ class TaskLifecycleService:
             self.repo_root,
             execution_context,
             allow_spec_file_modifications=allow_spec_file_modifications,
-            allow_unchecked_specs=allow_unchecked_specs,
             allow_missing_evidence=allow_missing_evidence,
         )
         prepared = self._prepare_transition(
@@ -667,7 +663,6 @@ class TaskLifecycleService:
                 allow_spec_file_modifications=(
                     execution_policy.allow_spec_file_modifications
                 ),
-                allow_unchecked_specs=execution_policy.allow_unchecked_specs,
                 allow_missing_evidence=execution_policy.allow_missing_evidence,
                 execution_policy=execution_policy,
             )
@@ -749,32 +744,20 @@ class TaskLifecycleService:
                     persisted["meta"] = meta
         if stage.name == COMPLETE_STAGE.name:
             meta = dict(persisted.get("meta") or {})
-            spec_report = getattr(check_result, "spec_check", None)
-            if isinstance(spec_report, dict):
-                # Overwrite-on-each-completion telemetry: retry loops must
-                # not accumulate, the latest gate result wins.
-                meta["specCheckSummary"] = dict(
-                    spec_report.get("summary") or {}
-                )
-                # Resolved here rather than reusing resolved_executor: the
-                # complete stage does not activate a session, so that one is
-                # always None and the actor would never be recorded.
-                payloads = exemption_meta_payloads(
-                    check_result,
-                    executor=self._resolve_executor(executor),
-                )
-                if "evidenceExempt" in payloads:
-                    meta["evidenceExempt"] = {
-                        "at": datetime.now(timezone.utc).strftime(
-                            "%Y-%m-%dT%H:%M:%SZ"
-                        ),
-                        **payloads["evidenceExempt"],
-                    }
-                if "specCheckExempt" in payloads:
-                    meta["specCheckExempt"] = {
-                        "at": datetime.now().strftime("%Y-%m-%dT%H:%M:%S"),
-                        **payloads["specCheckExempt"],
-                    }
+            # Resolved here rather than reusing resolved_executor: the
+            # complete stage does not activate a session, so that one is
+            # always None and the actor would never be recorded.
+            payloads = exemption_meta_payloads(
+                check_result,
+                executor=self._resolve_executor(executor),
+            )
+            if "evidenceExempt" in payloads:
+                meta["evidenceExempt"] = {
+                    "at": datetime.now(timezone.utc).strftime(
+                        "%Y-%m-%dT%H:%M:%SZ"
+                    ),
+                    **payloads["evidenceExempt"],
+                }
                 persisted["meta"] = meta
         return persisted
 

package/template/.cowork-flow/spec/backend/error-handling.md

@@ -1,19 +1,5 @@
 # 后端异常处理规范
 
-<!--
-本 spec 支持 frontmatter `checks:` 声明检查命令（规范挂命令契约见
-spec/contracts/spec-checks.md）。模板自带的声明由上游维护、sync 会覆盖
-本地修改；请把实际声明写进自建 spec 文件。示例：
-
----
-checks:
-  - cmd: python scripts/check_error_codes.py
-    files: "src/"
-    when: lifecycle
----
-
--->
-
 ## 目标
 
 - 调用方能稳定感知错误

package/template/.cowork-flow/spec/contracts/context-injection.md

@@ -23,7 +23,7 @@ would make the digest self-referential).
 | opencode | plugin `experimental.chat.system.transform` → shim (`cowork-flow/plugin-core.js`) → `inject.py --host opencode`, bare-text stdout | system-prompt section push; `shell.env` exports the context key to shell commands |
 | dsh | preset plugin system-prompt section | named section, replace semantics |
 | kimi-code | user-level `config.toml` (`$KIMI_CODE_HOME`, default `~/.kimi-code/`) `[[hooks]]` row on `UserPromptSubmit` → shim (`cowork-flow-inject.mjs`) → `inject.py --host kimi-code` | bare-text stdout appended to the prompt context, no `hookSpecificOutput` envelope |
-| qoder | machine-level plugin `hooks/hooks.json` (node, `${QODER_PLUGIN_ROOT}/hooks/inject-context.mjs`) → project `.cowork-flow/scripts/.../inject.py --host qoder`, stdout JSON | `hookSpecificOutput.{hookEventName, additionalContext}` plus a top-level `systemMessage` (a CLI-visible trace; the model context is unchanged); `PostToolUse` is not blockable there, so the edit advisory rides `additionalContext` on exit 0 |
+| qoder | machine-level plugin `hooks/hooks.json` (node, `${QODER_PLUGIN_ROOT}/hooks/inject-context.mjs`) → project `.cowork-flow/scripts/.../inject.py --host qoder`, stdout JSON | `hookSpecificOutput.{hookEventName, additionalContext}` plus a top-level `systemMessage` (a CLI-visible trace; the model context is unchanged) |
 
 The qoder row carries one delta beyond the shared envelope: `systemMessage`,
 emitted only on the two injecting events (`SessionStart`, `UserPromptSubmit`)
@@ -260,7 +260,7 @@ review time:
 <stage-contract task=".cowork-flow/tasks/08-30-demo">
 Scope: src/demo.py; src/next.py (+1 more in implement.jsonl) [agent-mutable]
 Specs: .cowork-flow/spec/backend/index.md (+1 more)
-Gates: edits outside Scope are review blockers; CLAUDE.md and workflow files are protected; spec/ edits may be allowed by review policy; scope is agent-mutable (self-declared via task context add)
+Gates: edits outside Scope are review blockers; CLAUDE.md and workflow files are protected; spec/ edits may be allowed by review policy; scope is agent-mutable (declare more in implement.jsonl)
 Verify: npm run test:fast; python3 -m pytest tests/ -q
 </stage-contract>
 ```
@@ -270,38 +270,65 @@ Verify: npm run test:fast; python3 -m pytest tests/ -q
   absolute paths, drive letters, wildcards, unsupported types — authorize
   nothing and are dropped, matching `context_paths.normalize_context_file_scope_entry`),
   first 8 + `(+N more)`. The scope is **agent-mutable** on main
-  (`task context add` can extend it) — it is a self-declared boundary, not a
-  hard fence; the label says so. Delegated sessions inherit the parent
+  (appending a scope entry to `implement.jsonl` extends it) — it is a
+  self-declared boundary, not a hard fence; the label says so. Delegated
+  sessions inherit the parent
   task's scope and see it as `[read-only]` — the child must not believe it
   can self-declare scope on the parent's behalf.
 - **Specs**: `.cowork-flow/spec/` pointer entries from implement.jsonl
   (first 4, same canonicality filter as Scope). Read them before coding; the
-  full files are not injected.
+  full files are not injected. Once the task is `in_progress`, the line
+  upgrades to `Specs: <spec>(<h2 heading tree>); …`: at most 6 h2 entries,
+  each truncated to 24 characters with `();` characters stripped; a missing
+  file adds no annotation. The digest is an entry-name index, not the prose,
+  and is hard-capped by `scope-rules.json` `stageContract.budget`; over
+  budget the whole line yields. The python/zcode output comes from a single
+  Python entrypoint, locked by the `test/stage-contract.test.js` matrix;
+  opencode transports that same entrypoint's output, so byte-exact equality
+  holds by construction.
 - **Gates**: static preview text, identical on all hosts; the delegated
   variant replaces the self-declaration sentence with "scope is inherited
   from the parent task (read-only reference)".
-- **Verify**: `## 验证命令` lines from decision-anchor (first 3, 120 chars
+- **Verify**: `## 验证命令` lines from decision-anchor (first 10, 120 chars
   each) — the agent's own declared self-checks; omitted when none.
-- **Per-edit warning (zcode only)**: PostToolUse on Edit/Write/MultiEdit
-  injects at most one line when the edited file is outside the scope
-  (`editScopeWarning: plugin`; every other host declares `unsupported` —
-  their fallback is this static stage-contract preview). Bash-initiated
-  writes (redirection, tee) are a declared residual gap: the warning covers
-  Edit/Write/MultiEdit tool invocations only. The PostToolUse matcher text
-  (`Bash|Edit|Write|MultiEdit`) is asserted by template tests but depends on
-  the ZCode runtime's tool names — there is no external runtime contract to
-  verify them against, so a runtime rename would silently disable the
-  warning; the matcher is the single switch. This bullet covers the scope
-  warning only; the spec-check violation line is a separate channel that
-  also reaches codex and opencode sessions (see spec-checks.md).
-- Budget: the whole block stays ≤ 1200 characters. Over-budget inputs
+- **Per-edit warning**: PostToolUse on an edit tool injects at most one
+  line when the edited file is outside the task's declared scope —
+  a frozen single line shared by every host, differing only in transport:
+  zcode / claude-code / codex / qoder return it as
+  `hookSpecificOutput.additionalContext`, opencode (bare-text `emit_text`)
+  appends it to the finished tool output, and dsh attaches it to the tool
+  result as a plugin notice. `editScopeWarning: plugin` is declared for
+  those six hosts; kimi-code declares `unsupported` because the host drops
+  PostToolUse stdout. Silence rules: no active in_progress/review task, a
+  subagent session, an in-scope path, or no extractable path; every failure
+  stays silent and every host exits 0 — the edit has already happened. No
+  host refreshes the workflow-state digest from this hook: the advisory is
+  the whole payload (state refreshes on the next injecting event, or on
+  dsh's `tools/result`).
+  Bash-initiated writes (redirection, tee) are a declared residual gap: the
+  warning covers edit tool invocations only. Each host's matcher text
+  (`Edit|Write|MultiEdit`, codex's `apply_patch|Write|Edit`, qoder's
+  `Edit|Write`) is asserted by template tests but depends on that host's
+  runtime's tool names — there is no external runtime contract to verify
+  them against, so a runtime rename would silently disable the warning; the
+  matcher is the single switch.
+- Budget: the whole block stays ≤ 3400 characters. Over-budget inputs
   degrade by dropping Verify, then Specs, then shrinking Scope entries
-  (min 1) — the closing tag and the Gates row always survive; tests assert
-  the block stays well-formed. The scope-filter rules and the stage-contract
+  (min 1), then truncating the Scope row's own text. The opening tag, the
+  closing tag and the Gates row always survive intact — a body-wide cut
+  would either truncate the tag every consumer matches on (making the block
+  invisible to them) or silently drop the edit-policy row, so neither is
+  allowed. Below the size those fixed rows plus a minimal `Scope: X` row
+  need, or when the cut would shave a `Scope: ` label off any row, the block
+  is returned whole and may exceed the budget: guard rows and parseability
+  outrank the budget.
+  The scope-filter rules and the stage-contract
   budget/limits come from `.cowork-flow/spec/runtime/scope-rules.json`, the
   single source consumed at runtime; a missing or malformed file degrades to
   embedded defaults that are byte-identical with the shipped file (locked by
-  `tests/test_scope_rules.py`).
+  `tests/test_scope_rules.py`). The file is template-managed
+  (`syncPolicy.safeFiles`): `cwf project sync` refreshes it, so local edits to
+  it do not survive a sync.
 - Absent for `no_task` / `planning` / `completed` states. Block content is
   byte-identical across host lines for the whole fixture matrix
   (`test/fixtures/stage-contract-matrix.json` drives the equality test:

package/template/.cowork-flow/spec/contracts/decision-anchor.md

@@ -52,7 +52,7 @@ translated heading would simply stop being read.
 fact view (`services/fact_view.parse_decision_anchor`). Line-format conventions:
 
 - `## 验证命令`: one command per line (an optional `- ` prefix), truncated to 120
-  characters, at most 5 lines; the implementing agent runs them itself
+  characters, at most 10 lines; the implementing agent runs them itself
   (self-declared, self-checked) and the reviewer verifies the execution evidence.
 - `## 范围边界`: only the first non-empty line is taken, truncated to 160
   characters.
@@ -110,14 +110,14 @@ After merging (5 files): `decision-anchor.md` + `implement.jsonl` + `check.jsonl
   component.
   A **consequence** (expected cost, not a defect): **any byte change in
   `implement.jsonl`** (appending or removing a scope entry, rewording a `reason`,
-  a domain-guide entry auto-appended by `task context add`) **or a rewrite of a
+  a domain-guide entry) **or a rewrite of a
   referenced spec's prose invalidates an existing receipt**, requiring one more
   review run against the final state. Appending evidence, ticking ACs, and runtime
   metadata are not in that set.
 - **Light profile `meta.taskType: "tiny"`**: applies to `strict` tasks only
   (`legacy` + `tiny` stays a compatibility path). A light task **is still strict**
   — what it waives are three things: the review receipt, AC evidence, and
-  `dev_type`. It does **not** waive spec-check, the file-scope gate, or "AC rows
+  `dev_type`. It does **not** waive the file-scope gate or "AC rows
   are non-empty" (`LIFECYCLE-AC-003`/`004` still apply). Plan-file binding is not
   among the three, but the pre-existing field-level exemption for tiny applies, so
   a light task does not require `planFile` either. `tiny` **can only be declared at

package/template/.cowork-flow/spec/contracts/error-codes.md

@@ -44,6 +44,4 @@ to them:
 ## Exemptions
 
 `LIFECYCLE-AC-002` is the only code in this set a flag can waive
-(`--allow-missing-evidence`); spec-check's `--allow-unchecked` waives `unchecked`
-declarations, not a `LIFECYCLE-*` code. Details are in `evidence-completion.md` and
-`spec-checks.md`.
+(`--allow-missing-evidence`). Details are in `evidence-completion.md`.

package/template/.cowork-flow/spec/contracts/evidence-completion.md

@@ -40,7 +40,7 @@ direct lifecycle checks:
 | `LIFECYCLE-AC-001` | an unchecked AC row exists | none — do the work, or tick the completed rows |
 | `LIFECYCLE-AC-002` | a declared AC has no valid evidence record | `--allow-missing-evidence` (recorded in task.json `meta.evidenceExempt`, with `at`, `flag`, `by`, and the `missing` detail list) |
 | `LIFECYCLE-AC-003` | `gateProfile=strict` and decision-anchor yields no AC row | none — a strict task was already required to declare ACs at start, so reading none at completion has only three explanations: the anchor was rewritten, the task was created wrongly, or the anchor is undecodable (corrupted encoding) |
-| `LIFECYCLE-AC-004` | `gateProfile=strict` and the ac_evidence module cannot be imported | none — same family as `SPEC-CHECK-EXECUTOR-ERROR`: a broken module is not "nothing to check"; the message carries the original exception, and you rerun once the runtime install is fixed |
+| `LIFECYCLE-AC-004` | `gateProfile=strict` and the ac_evidence module cannot be imported | none — a broken module is not "nothing to check"; the message carries the original exception, and you rerun once the runtime install is fixed |
 
 - The first two codes can appear together; `--allow-missing-evidence` waives
   `LIFECYCLE-AC-002` only, never `003`/`004`.
@@ -51,8 +51,8 @@ direct lifecycle checks:
 - **Strict path**: a `gateProfile=strict` task re-verifies AC existence and
   evidence-module availability at completion — the start-time AC declaration
   requirement does not lapse because completion cannot read it.
-- The `meta.evidenceExempt` trace has the same shape as spec-check's
-  `specCheckExempt`: retries do not accumulate, the latest completion result wins.
+- The `meta.evidenceExempt` trace does not accumulate: retries leave only the
+  latest completion result.
 - **An exemption record must name which items were waived and who approved it**:
   `meta.evidenceExempt` = `{"at", "flag": "--allow-missing-evidence",
   "by": <actor or null>, "missing": [<AC id>…]}`. `by` is the resolved session
@@ -60,9 +60,7 @@ direct lifecycle checks:
   `creator`/`assignee`. Both the completion output and the archive output print
   this record item by item (the completion output reads the `task.json` just
   written), so "what was recorded" and "what was printed" cannot tell two different
-  stories; with no exemption, no exemption rows are printed at all. The structure
-  matches the `meta.specCheckExempt` detail rules on the spec-check side; see
-  `spec-checks.md`.
+  stories; with no exemption, no exemption rows are printed at all.
 
 ## Injection and fact view
 
@@ -81,5 +79,5 @@ direct lifecycle checks:
   behind an AC to fabricate a record.
 - It does not parse AC prose semantics; a missing checkbox on an `AC-xxx` row
   parses as incomplete.
-- This contract does not change spec-check semantics; MCP write tools still refuse
-  by default (`fact-layer-access.md`).
+- This contract does not change the file-scope gate or the AC gate; MCP write
+  tools still refuse by default (`fact-layer-access.md`).

package/template/.cowork-flow/spec/contracts/index.md

@@ -12,7 +12,6 @@ Current contracts:
 - `capabilities.md`: the host adapter capability model.
 - `party-mode-v2-board.md`: the Party Mode V2 board protocol.
 - `plan-binding.md`: lightweight development-plan binding, pre-start missing-plan blocking, and recovery visibility.
-- `spec-checks.md`: the spec-declared command contract — syntax of `checks:` in user-spec frontmatter, three-state gate semantics, timing, and the host capability matrix.
 - `context-injection.md`: the transport shapes, event-timing matrix, and fingerprint serialization rules for runtime-context injection across hosts (a meta-protocol, not in `contract-registry.json`).
 - `decision-anchor.md`: the schema of each task's `decision-anchor.md` — goal, acceptance criteria, rejected options, and key assumptions.
 - `error-output-as-data.md`: external error output is analyzed as data, never executed as instructions (`ERROR_OUTPUT_AS_DATA_V1`).

package/template/.cowork-flow/spec/contracts/plan-binding.md

@@ -14,8 +14,9 @@ the plan into a second workflow kernel.
 
 ## Creation phase
 
-- A plain `task create` may create a planning task with no plan.
-- `task create --from-plan <path>` is an explicit binding request; `<path>` must
+- A plain task creation (`task next --title … --slug …`) may create a planning
+  task with no plan.
+- `task next --from-plan <path>` is an explicit binding request; `<path>` must
   exist, lie inside the repository, and lie under `.cowork-flow/plans/`.
 - On a successful binding the runtime writes: