cowork-flow 1.9.2 → 2.1.0

package/template/.cowork-flow/scripts/services/fact_view.py

@@ -19,7 +19,7 @@ from typing import Any
 
 GOAL_TRUNCATE = 300
 VERIFY_COMMAND_TRUNCATE = 120
-VERIFY_COMMAND_MAX = 5
+VERIFY_COMMAND_MAX = 10
 SCOPE_BOUNDARY_TRUNCATE = 160
 ANCHOR_SECTIONS = ("目标", "验收标准", "被拒方案", "验证命令", "范围边界")
 ACCEPTANCE_RE = re.compile(
@@ -225,12 +225,12 @@ def spec_entries_for_task(
 
 STAGE_CONTRACT_SCOPE_LIMIT = 8
 STAGE_CONTRACT_SPECS_LIMIT = 4
-STAGE_CONTRACT_VERIFY_LIMIT = 3
-STAGE_CONTRACT_BUDGET = 1200
+STAGE_CONTRACT_VERIFY_LIMIT = 10
+STAGE_CONTRACT_BUDGET = 3400
 GATES_TEXT = (
     "Gates: edits outside Scope are review blockers; CLAUDE.md and workflow "
     "files are protected; spec/ edits may be allowed by review policy; "
-    "scope is agent-mutable (self-declared via task context add)"
+    "scope is agent-mutable (declare more in implement.jsonl)"
 )
 # Delegated subtasks render the parent scope as a read-only
 # reference: a child must not believe it can self-declare
@@ -257,11 +257,14 @@ def _fit_stage_contract(
     budget: int = STAGE_CONTRACT_BUDGET,
 ) -> list[str]:
     """Degrade an over-budget block without ever emitting a malformed one:
-    the closing tag and the guard rows (Scope/Gates) always survive. Order:
-    1) drop removable rows (Specs/Verify) from the tail; 2) shrink Scope
-    entries one by one (min 1); 3) last-resort codepoint cut that keeps the
-    closing tag. Single renderer: the host shims transport this output
-    unchanged, so the row-role rules and the drop order live here only."""
+    the opening tag, the closing tag and the guard rows (Scope/Gates) always
+    survive intact. Order: 1) drop removable rows (Specs/Verify) from the
+    tail; 2) shrink Scope entries one by one (min 1); 3) `_cut_scope_rows`
+    shortens the Scope rows' own text, and nothing else -- it returns None
+    when even that cannot keep the block usable, and the block is then
+    returned as is, over budget (guards and parseability outrank it).
+    Single renderer: the host shims transport this output unchanged, so the
+    row-role rules and the drop order live here only."""
     if len("\n".join(lines)) <= budget:
         return lines
     removable = [
@@ -289,18 +292,43 @@ def _fit_stage_contract(
         lines = candidate
     if len("\n".join(lines)) <= budget:
         return lines
-    closing = lines[-1]
-    # The final join inserts one newline between the cut body
-    # and the closing tag; reserve it so the block stays
-    # within budget byte-for-byte.
-    room = budget - len(closing) - 1
-    body = "\n".join(lines[:-1])
-    if len(body) <= room:
-        return lines
-    head = body[:room].rstrip()
-    if not head:
-        return lines
-    return [head, closing]
+    cut = _cut_scope_rows(lines, budget)
+    return lines if cut is None else cut
+
+
+def _cut_scope_rows(lines: list[str], budget: int) -> list[str] | None:
+    """Last resort: shorten the text of every Scope row so the block fits.
+
+    Returns None -- the caller then returns the block whole and lets it
+    exceed the budget -- in three cases: there is no Scope row to cut at all
+    (a shape the renderer never emits), the fixed rows plus a minimal
+    `Scope: X` row do not fit, or the cut would shave a `Scope: ` label off a
+    row (`rstrip` landing inside the entry's leading whitespace). A body-wide
+    cut is never allowed: it would truncate the tag every consumer matches
+    on, and a label-less row counts as a dropped guard row. The floor is not
+    redundant with the label check -- a negative `room` slices from the row's
+    tail, so without it a long row would go through chopped and still over
+    budget. Guard rows and parseability outrank the budget.
+    """
+    fixed = [line for line in lines if not line.startswith("Scope:")]
+    scope_count = len(lines) - len(fixed)
+    if scope_count == 0:
+        return None
+    # Every Scope row is shortened to the same width, so the room left after
+    # the fixed rows and the separators is shared between them.
+    room = (budget - len("\n".join(fixed)) - scope_count) // scope_count
+    if room < len("Scope: ") + 1:
+        return None
+    cut = [
+        line[:room].rstrip() if line.startswith("Scope:") else line
+        for line in lines
+    ]
+    if any(
+        original.startswith("Scope:") and not shortened.startswith("Scope: ")
+        for original, shortened in zip(lines, cut)
+    ):
+        return None
+    return cut
 
 
 def _stage_contract_lines(

package/template/.cowork-flow/scripts/services/lifecycle_checks.py

@@ -46,13 +46,8 @@ PROTECTED_WORKFLOW_PATTERNS = (
 )
 
 # A recorded exemption names what it waived: the flag that allowed it, the
-# actor who applied it, and the concrete items. The item list is capped so a
-# pathological repo cannot turn one completion into pages of output, and a
-# single command is clipped so one long declaration cannot do the same.
-SPEC_EXEMPTION_FLAG = "--allow-unchecked"
+# actor who applied it, and the concrete items.
 EVIDENCE_EXEMPTION_FLAG = "--allow-missing-evidence"
-SPEC_EXEMPTION_ITEM_LIMIT = 10
-SPEC_EXEMPTION_COMMAND_LIMIT = 80
 
 
 @dataclass(frozen=True)
@@ -71,9 +66,7 @@ class LifecycleCheckResult:
     stage: str
     blockers: tuple[str, ...] = ()
     issues: tuple[LifecycleCheckIssue, ...] = ()
-    spec_check: dict | None = None
     evidence_exemption: dict | None = None
-    spec_exemption: dict | None = None
 
     def __post_init__(self) -> None:
         if self.issues and not self.blockers:
@@ -124,20 +117,9 @@ class LifecycleCheckRunner:
         task_dir: Path,
         *,
         allow_spec_file_modifications: bool | None = None,
-        allow_unchecked_specs: bool | None = None,
         allow_missing_evidence: bool | None = None,
         execution_policy: LifecycleExecutionPolicy | None = None,
     ) -> LifecycleCheckResult:
-        spec_report = _spec_check_report(self.repo_root)
-        allow_unchecked = (
-            bool(allow_unchecked_specs)
-            if allow_unchecked_specs is not None
-            else _policy_allows_unchecked(execution_policy)
-        )
-        spec_issues = _spec_check_completion_issues(
-            spec_report,
-            allow_unchecked_specs=allow_unchecked,
-        )
         ac_issues, evidence_exemption = _ac_evidence_completion_facts(
             task_dir,
             allow_missing_evidence=(
@@ -161,15 +143,9 @@ class LifecycleCheckRunner:
                     self.repo_root,
                     task_dir,
                 ))
-                + list(spec_issues)
                 + list(ac_issues)
             ),
-            spec_check=spec_report,
             evidence_exemption=evidence_exemption,
-            spec_exemption=_spec_check_exemption(
-                spec_report,
-                allow_unchecked_specs=allow_unchecked,
-            ),
         )
 
 
@@ -182,12 +158,6 @@ def _policy_allows_spec_changes(
     return bool(allow_spec_file_modifications)
 
 
-def _policy_allows_unchecked(
-    execution_policy: LifecycleExecutionPolicy | None,
-) -> bool:
-    return bool(execution_policy is not None and execution_policy.allow_unchecked_specs)
-
-
 def _policy_allows_missing_evidence(
     execution_policy: LifecycleExecutionPolicy | None,
 ) -> bool:
@@ -299,83 +269,6 @@ def _ac_evidence_completion_facts(
     return issues, exemption
 
 
-def _spec_check_report(repo_root: Path) -> dict | None:
-    """Run the lifecycle-phase spec checks. A structural failure degrades to
-    an unchecked report — never to a silently passing gate."""
-    try:
-        from services.spec_check import run_checks
-    except Exception:  # pragma: no cover - import surface must stay lazy
-        return {"schemaVersion": 1, "phase": "lifecycle", "results": [],
-                "parseErrors": [], "summary": {"pass": 0, "violation": 0,
-                "unchecked": 1, "executorError": 1,
-                "classification": "executor-failure"}}
-    try:
-        return run_checks(repo_root, phase="lifecycle")
-    except Exception as error:  # fail closed: unchecked, not pass
-        return {"schemaVersion": 1, "phase": "lifecycle", "results": [],
-                "parseErrors": [], "summary": {"pass": 0, "violation": 0,
-                "unchecked": 1, "executorError": 1, "error": str(error),
-                "classification": "executor-failure"}}
-
-
-def _exemption_command(cmd: object) -> str:
-    """One declared command, clipped so a long line cannot swamp the output.
-
-    The clip never splits the first token: that token names the program, which
-    is the part that says what could not be verified.
-    """
-    text = " ".join(str(cmd or "").split())
-    if len(text) <= SPEC_EXEMPTION_COMMAND_LIMIT:
-        return text
-    head = text.split(" ", 1)[0]
-    return text[: max(SPEC_EXEMPTION_COMMAND_LIMIT, len(head))] + "…"
-
-
-def _unchecked_exemption_items(spec_report: dict) -> tuple[list[dict], bool]:
-    """The unchecked declarations, capped, plus whether anything was dropped."""
-    items = [
-        {
-            "spec": item.get("spec") or "?",
-            "cmd": _exemption_command(item.get("cmd")),
-        }
-        for item in spec_report.get("results") or []
-        if isinstance(item, dict) and item.get("status") == "unchecked"
-    ]
-    return items[:SPEC_EXEMPTION_ITEM_LIMIT], len(items) > SPEC_EXEMPTION_ITEM_LIMIT
-
-
-def _spec_check_exemption(
-    spec_report: dict | None,
-    *,
-    allow_unchecked_specs: bool,
-) -> dict | None:
-    """The exemption this completion applied, or None.
-
-    Single source for both the persisted telemetry and the delivery output:
-    a waived gate that is recorded but never shown reads as a clean pass, and
-    one that is shown as a bare count reads as a clean pass to whoever has to
-    check it afterwards. An executor failure is never exemptible, so it never
-    yields one.
-    """
-    if not spec_report or not allow_unchecked_specs:
-        return None
-    summary = spec_report.get("summary") or {}
-    if int(summary.get("executorError") or 0):
-        return None
-    unchecked = int(summary.get("unchecked") or 0)
-    if not unchecked:
-        return None
-    items, truncated = _unchecked_exemption_items(spec_report)
-    exemption = {
-        "unchecked": unchecked,
-        "uncheckedItems": items,
-        "flag": SPEC_EXEMPTION_FLAG,
-    }
-    if truncated:
-        exemption["truncated"] = True
-    return exemption
-
-
 def _actor_text(actor: object) -> str:
     """The recorded actor, or `null` — never a stand-in identity."""
     return "null" if actor is None else str(actor)
@@ -390,23 +283,6 @@ def exemption_report_lines(meta: dict | None) -> list[str]:
     """
     meta = meta if isinstance(meta, dict) else {}
     lines: list[str] = []
-    spec_exempt = meta.get("specCheckExempt")
-    if isinstance(spec_exempt, dict):
-        lines.append(
-            f"Exempted: {spec_exempt.get('unchecked', 0)} unchecked "
-            f"spec-check command(s) via {spec_exempt.get('flag')} "
-            "(recorded in task.json meta.specCheckExempt, "
-            f"by {_actor_text(spec_exempt.get('by'))})"
-        )
-        items = spec_exempt.get("uncheckedItems") or []
-        for item in items:
-            if isinstance(item, dict):
-                lines.append(f"  - {item.get('spec')}: {item.get('cmd')}")
-        if spec_exempt.get("truncated"):
-            lines.append(
-                f"  - (more than {len(items)} unchecked commands; the list is "
-                "truncated — see meta.specCheckExempt.uncheckedItems)"
-            )
     evidence_exempt = meta.get("evidenceExempt")
     if isinstance(evidence_exempt, dict):
         missing = evidence_exempt.get("missing") or []
@@ -436,103 +312,12 @@ def exemption_meta_payloads(
     such as the creator or assignee.
     """
     payloads: dict[str, dict] = {}
-    spec_exemption = getattr(check_result, "spec_exemption", None)
-    if spec_exemption:
-        payloads["specCheckExempt"] = {"by": executor, **spec_exemption}
     evidence_exemption = getattr(check_result, "evidence_exemption", None)
     if evidence_exemption:
         payloads["evidenceExempt"] = {"by": executor, **evidence_exemption}
     return payloads
 
 
-def _spec_check_parse_error_issue(parse_errors: list) -> LifecycleCheckIssue | None:
-    """The blocking fact for declarations the parser could not read."""
-    if not parse_errors:
-        return None
-    details = []
-    for item in parse_errors:
-        if isinstance(item, dict):
-            spec = item.get("spec") or "?"
-            error = item.get("error") or "unknown parse error"
-            details.append(f"{spec}: {error}")
-    suffix = "; ".join(details[:3])
-    return LifecycleCheckIssue(
-        code="SPEC-CHECK-PARSE-ERROR",
-        message=(
-            f"spec checks report {len(parse_errors)} parse error(s)"
-            + (f": {suffix}" if suffix else "")
-        ),
-    )
-
-
-def _spec_check_executor_issue(summary: dict) -> LifecycleCheckIssue | None:
-    """The blocking fact for a spec-check executor that never ran.
-
-    Not waivable: --allow-unchecked exempts a command that could not run, not
-    an executor that is broken. The `unchecked: 1` in a degraded report is a
-    placeholder for "no verdict", so it never becomes a finding of its own.
-    """
-    if not int(summary.get("executorError") or 0):
-        return None
-    return LifecycleCheckIssue(
-        code="SPEC-CHECK-EXECUTOR-ERROR",
-        message=(
-            "spec-check executor failed; the declared checks did not run, so "
-            "this is not an exemption-eligible unchecked result — fix the "
-            "spec-check executor and rerun"
-        ),
-    )
-
-
-def _spec_check_completion_issues(
-    spec_report: dict | None,
-    *,
-    allow_unchecked_specs: bool,
-) -> list[LifecycleCheckIssue]:
-    if not spec_report:
-        return []
-    summary = spec_report.get("summary") or {}
-    issues: list[LifecycleCheckIssue] = []
-    parse_error_issue = _spec_check_parse_error_issue(
-        spec_report.get("parseErrors") or []
-    )
-    if parse_error_issue is not None:
-        issues.append(parse_error_issue)
-    executor_issue = _spec_check_executor_issue(summary)
-    if executor_issue is not None:
-        issues.append(executor_issue)
-    violation = int(summary.get("violation") or 0)
-    unchecked = int(summary.get("unchecked") or 0)
-    if violation:
-        first_lines = []
-        for item in spec_report.get("results") or []:
-            if item.get("status") == "violation":
-                detail = item.get("firstViolationLine") or item.get("reason") or ""
-                first_lines.append(f"{item.get('spec')}: {detail}")
-        issues.append(
-            LifecycleCheckIssue(
-                code="SPEC-CHECK-VIOLATION",
-                message=(
-                    "spec checks report "
-                    f"{violation} violation(s): {'; '.join(first_lines[:3])}"
-                ),
-            )
-        )
-    if unchecked and executor_issue is None and not allow_unchecked_specs:
-        issues.append(
-            LifecycleCheckIssue(
-                code="SPEC-CHECK-UNCHECKED",
-                message=(
-                    f"spec checks report {unchecked} unchecked command(s) "
-                    "(missing/timeout); rerun spec-check, or pass "
-                    "--allow-unchecked to complete with the exemption recorded"
-                ),
-            )
-        )
-    return issues
-
-
-
 def task_changed_paths(repo_root: Path, task_dir: Path) -> tuple[list[str], bool]:
     """Review change set for one task: baseline..HEAD merged with the
     working tree, plus whether the snapshot degraded to status-only."""

package/template/.cowork-flow/scripts/services/lifecycle_policy.py

@@ -35,7 +35,6 @@ class LifecycleExecutionPolicy:
 
     execution_scope: str
     allow_spec_file_modifications: bool
-    allow_unchecked_specs: bool = False
     allow_missing_evidence: bool = False
 
 
@@ -106,20 +105,17 @@ def resolve_execution_policy(
     execution_context: ExecutionContext | None = None,
     *,
     allow_spec_file_modifications: bool | None = None,
-    allow_unchecked_specs: bool | None = None,
     allow_missing_evidence: bool | None = None,
 ) -> LifecycleExecutionPolicy:
     """Resolve lifecycle scope capability from execution facts."""
     if execution_context is None:
         if (
             allow_spec_file_modifications is not None
-            or allow_unchecked_specs is not None
             or allow_missing_evidence is not None
         ):
             return LifecycleExecutionPolicy(
                 execution_scope="explicit",
                 allow_spec_file_modifications=bool(allow_spec_file_modifications),
-                allow_unchecked_specs=bool(allow_unchecked_specs),
                 allow_missing_evidence=bool(allow_missing_evidence),
             )
         execution_context = ExecutionContext()
@@ -133,7 +129,6 @@ def resolve_execution_policy(
     return LifecycleExecutionPolicy(
         execution_scope=execution_context.mode,
         allow_spec_file_modifications=allowed,
-        allow_unchecked_specs=bool(allow_unchecked_specs),
         allow_missing_evidence=bool(allow_missing_evidence),
     )
 

package/template/.cowork-flow/scripts/services/task_gate_profiles.py

@@ -64,7 +64,7 @@ def is_light_task(task_data: dict) -> bool:
 
     A light task still runs under the strict profile: it skips the review
     receipt, the acceptance-evidence and the dev_type gates, and nothing
-    else. The spec-check, file-scope and acceptance-row gates stay in force,
+    else. The file-scope and acceptance-row gates stay in force,
     so this is a narrower reading list rather than an exemption channel.
     """
     if resolve_gate_profile(task_data) != GATE_PROFILE_STRICT:

package/template/.cowork-flow/scripts/services/task_lifecycle.py

@@ -234,7 +234,6 @@ class TaskLifecycleService:
         *,
         completed_at: str | None = None,
         allow_spec_file_modifications: bool | None = None,
-        allow_unchecked_specs: bool = False,
         allow_missing_evidence: bool = False,
         execution_context: object | None = None,
     ) -> LifecycleResult:
@@ -243,7 +242,6 @@ class TaskLifecycleService:
             task,
             completed_at=completed_at,
             allow_spec_file_modifications=allow_spec_file_modifications,
-            allow_unchecked_specs=allow_unchecked_specs,
             allow_missing_evidence=allow_missing_evidence,
             execution_context=execution_context,
         )
@@ -255,7 +253,6 @@ class TaskLifecycleService:
         *,
         preflight: Preflight | None = None,
         allow_spec_file_modifications: bool | None = None,
-        allow_unchecked_specs: bool = False,
         allow_missing_evidence: bool = False,
         completed_at: str | None = None,
         execution_context: object | None = None,
@@ -268,7 +265,6 @@ class TaskLifecycleService:
             self.repo_root,
             execution_context,
             allow_spec_file_modifications=allow_spec_file_modifications,
-            allow_unchecked_specs=allow_unchecked_specs,
             allow_missing_evidence=allow_missing_evidence,
         )
         prepared = self._prepare_transition(
@@ -667,7 +663,6 @@ class TaskLifecycleService:
                 allow_spec_file_modifications=(
                     execution_policy.allow_spec_file_modifications
                 ),
-                allow_unchecked_specs=execution_policy.allow_unchecked_specs,
                 allow_missing_evidence=execution_policy.allow_missing_evidence,
                 execution_policy=execution_policy,
             )
@@ -749,32 +744,20 @@ class TaskLifecycleService:
                     persisted["meta"] = meta
         if stage.name == COMPLETE_STAGE.name:
             meta = dict(persisted.get("meta") or {})
-            spec_report = getattr(check_result, "spec_check", None)
-            if isinstance(spec_report, dict):
-                # Overwrite-on-each-completion telemetry: retry loops must
-                # not accumulate, the latest gate result wins.
-                meta["specCheckSummary"] = dict(
-                    spec_report.get("summary") or {}
-                )
-                # Resolved here rather than reusing resolved_executor: the
-                # complete stage does not activate a session, so that one is
-                # always None and the actor would never be recorded.
-                payloads = exemption_meta_payloads(
-                    check_result,
-                    executor=self._resolve_executor(executor),
-                )
-                if "evidenceExempt" in payloads:
-                    meta["evidenceExempt"] = {
-                        "at": datetime.now(timezone.utc).strftime(
-                            "%Y-%m-%dT%H:%M:%SZ"
-                        ),
-                        **payloads["evidenceExempt"],
-                    }
-                if "specCheckExempt" in payloads:
-                    meta["specCheckExempt"] = {
-                        "at": datetime.now().strftime("%Y-%m-%dT%H:%M:%S"),
-                        **payloads["specCheckExempt"],
-                    }
+            # Resolved here rather than reusing resolved_executor: the
+            # complete stage does not activate a session, so that one is
+            # always None and the actor would never be recorded.
+            payloads = exemption_meta_payloads(
+                check_result,
+                executor=self._resolve_executor(executor),
+            )
+            if "evidenceExempt" in payloads:
+                meta["evidenceExempt"] = {
+                    "at": datetime.now(timezone.utc).strftime(
+                        "%Y-%m-%dT%H:%M:%SZ"
+                    ),
+                    **payloads["evidenceExempt"],
+                }
                 persisted["meta"] = meta
         return persisted
 

package/template/.cowork-flow/spec/backend/error-handling.md

@@ -1,19 +1,5 @@
 # 后端异常处理规范
 
-<!--
-本 spec 支持 frontmatter `checks:` 声明检查命令（规范挂命令契约见
-spec/contracts/spec-checks.md）。模板自带的声明由上游维护、sync 会覆盖
-本地修改；请把实际声明写进自建 spec 文件。示例：
-
----
-checks:
-  - cmd: python scripts/check_error_codes.py
-    files: "src/"
-    when: lifecycle
----
-
--->
-
 ## 目标
 
 - 调用方能稳定感知错误

package/template/.cowork-flow/spec/contracts/context-injection.md

@@ -23,7 +23,7 @@ would make the digest self-referential).
 | opencode | plugin `experimental.chat.system.transform` → shim (`cowork-flow/plugin-core.js`) → `inject.py --host opencode`, bare-text stdout | system-prompt section push; `shell.env` exports the context key to shell commands |
 | dsh | preset plugin system-prompt section | named section, replace semantics |
 | kimi-code | user-level `config.toml` (`$KIMI_CODE_HOME`, default `~/.kimi-code/`) `[[hooks]]` row on `UserPromptSubmit` → shim (`cowork-flow-inject.mjs`) → `inject.py --host kimi-code` | bare-text stdout appended to the prompt context, no `hookSpecificOutput` envelope |
-| qoder | machine-level plugin `hooks/hooks.json` (node, `${QODER_PLUGIN_ROOT}/hooks/inject-context.mjs`) → project `.cowork-flow/scripts/.../inject.py --host qoder`, stdout JSON | `hookSpecificOutput.{hookEventName, additionalContext}` plus a top-level `systemMessage` (a CLI-visible trace; the model context is unchanged); `PostToolUse` is not blockable there, so the edit advisory rides `additionalContext` on exit 0 |
+| qoder | machine-level plugin `hooks/hooks.json` (node, `${QODER_PLUGIN_ROOT}/hooks/inject-context.mjs`) → project `.cowork-flow/scripts/.../inject.py --host qoder`, stdout JSON | `hookSpecificOutput.{hookEventName, additionalContext}` plus a top-level `systemMessage` (a CLI-visible trace; the model context is unchanged) |
 
 The qoder row carries one delta beyond the shared envelope: `systemMessage`,
 emitted only on the two injecting events (`SessionStart`, `UserPromptSubmit`)
@@ -49,10 +49,10 @@ ZCode, Kimi Code, OpenCode) are **fail-open**: they run in every workspace, so
 they meet project runtimes older than themselves, and a project-side failure — an
 argparse rejection of the host argument, a crash, a timeout — must not fail the
 event they only decorate. Each keeps the child's message on stderr (the host's
-run log) and completes the event with nothing injected. Exit-status blocking is reserved
-for the project-level edit gate (`spec_only_post_tool_use`, installed by
-`init` / `sync` for claude-code and codex): that wrapper sits next to the
-runtime it calls, so hook and runtime cannot skew.
+run log) and completes the event with nothing injected. Exit-status blocking
+was removed in 2.0.0: the project-level edit hooks (`init` / `sync` install
+them for claude-code and codex next to the runtime they call) are advisory as
+well and always exit 0.
 
 The string block inside every transport follows the same shape: an optional
 runtime preamble, the contract digest (full block or fingerprint line, see
@@ -260,7 +260,7 @@ review time:
 <stage-contract task=".cowork-flow/tasks/08-30-demo">
 Scope: src/demo.py; src/next.py (+1 more in implement.jsonl) [agent-mutable]
 Specs: .cowork-flow/spec/backend/index.md (+1 more)
-Gates: edits outside Scope are review blockers; CLAUDE.md and workflow files are protected; spec/ edits may be allowed by review policy; scope is agent-mutable (self-declared via task context add)
+Gates: edits outside Scope are review blockers; CLAUDE.md and workflow files are protected; spec/ edits may be allowed by review policy; scope is agent-mutable (declare more in implement.jsonl)
 Verify: npm run test:fast; python3 -m pytest tests/ -q
 </stage-contract>
 ```
@@ -270,38 +270,65 @@ Verify: npm run test:fast; python3 -m pytest tests/ -q
   absolute paths, drive letters, wildcards, unsupported types — authorize
   nothing and are dropped, matching `context_paths.normalize_context_file_scope_entry`),
   first 8 + `(+N more)`. The scope is **agent-mutable** on main
-  (`task context add` can extend it) — it is a self-declared boundary, not a
-  hard fence; the label says so. Delegated sessions inherit the parent
+  (appending a scope entry to `implement.jsonl` extends it) — it is a
+  self-declared boundary, not a hard fence; the label says so. Delegated
+  sessions inherit the parent
   task's scope and see it as `[read-only]` — the child must not believe it
   can self-declare scope on the parent's behalf.
 - **Specs**: `.cowork-flow/spec/` pointer entries from implement.jsonl
   (first 4, same canonicality filter as Scope). Read them before coding; the
-  full files are not injected.
+  full files are not injected. Once the task is `in_progress`, the line
+  upgrades to `Specs: <spec>(<h2 heading tree>); …`: at most 6 h2 entries,
+  each truncated to 24 characters with `();` characters stripped; a missing
+  file adds no annotation. The digest is an entry-name index, not the prose,
+  and is hard-capped by `scope-rules.json` `stageContract.budget`; over
+  budget the whole line yields. The python/zcode output comes from a single
+  Python entrypoint, locked by the `test/stage-contract.test.js` matrix;
+  opencode transports that same entrypoint's output, so byte-exact equality
+  holds by construction.
 - **Gates**: static preview text, identical on all hosts; the delegated
   variant replaces the self-declaration sentence with "scope is inherited
   from the parent task (read-only reference)".
-- **Verify**: `## 验证命令` lines from decision-anchor (first 3, 120 chars
+- **Verify**: `## 验证命令` lines from decision-anchor (first 10, 120 chars
   each) — the agent's own declared self-checks; omitted when none.
-- **Per-edit warning (zcode only)**: PostToolUse on Edit/Write/MultiEdit
-  injects at most one line when the edited file is outside the scope
-  (`editScopeWarning: plugin`; every other host declares `unsupported` —
-  their fallback is this static stage-contract preview). Bash-initiated
-  writes (redirection, tee) are a declared residual gap: the warning covers
-  Edit/Write/MultiEdit tool invocations only. The PostToolUse matcher text
-  (`Bash|Edit|Write|MultiEdit`) is asserted by template tests but depends on
-  the ZCode runtime's tool names — there is no external runtime contract to
-  verify them against, so a runtime rename would silently disable the
-  warning; the matcher is the single switch. This bullet covers the scope
-  warning only; the spec-check violation line is a separate channel that
-  also reaches codex and opencode sessions (see spec-checks.md).
-- Budget: the whole block stays ≤ 1200 characters. Over-budget inputs
+- **Per-edit warning**: PostToolUse on an edit tool injects at most one
+  line when the edited file is outside the task's declared scope —
+  a frozen single line shared by every host, differing only in transport:
+  zcode / claude-code / codex / qoder return it as
+  `hookSpecificOutput.additionalContext`, opencode (bare-text `emit_text`)
+  appends it to the finished tool output, and dsh attaches it to the tool
+  result as a plugin notice. `editScopeWarning: plugin` is declared for
+  those six hosts; kimi-code declares `unsupported` because the host drops
+  PostToolUse stdout. Silence rules: no active in_progress/review task, a
+  subagent session, an in-scope path, or no extractable path; every failure
+  stays silent and every host exits 0 — the edit has already happened. No
+  host refreshes the workflow-state digest from this hook: the advisory is
+  the whole payload (state refreshes on the next injecting event, or on
+  dsh's `tools/result`).
+  Bash-initiated writes (redirection, tee) are a declared residual gap: the
+  warning covers edit tool invocations only. Each host's matcher text
+  (`Edit|Write|MultiEdit`, codex's `apply_patch|Write|Edit`, qoder's
+  `Edit|Write`) is asserted by template tests but depends on that host's
+  runtime's tool names — there is no external runtime contract to verify
+  them against, so a runtime rename would silently disable the warning; the
+  matcher is the single switch.
+- Budget: the whole block stays ≤ 3400 characters. Over-budget inputs
   degrade by dropping Verify, then Specs, then shrinking Scope entries
-  (min 1) — the closing tag and the Gates row always survive; tests assert
-  the block stays well-formed. The scope-filter rules and the stage-contract
+  (min 1), then truncating the Scope row's own text. The opening tag, the
+  closing tag and the Gates row always survive intact — a body-wide cut
+  would either truncate the tag every consumer matches on (making the block
+  invisible to them) or silently drop the edit-policy row, so neither is
+  allowed. Below the size those fixed rows plus a minimal `Scope: X` row
+  need, or when the cut would shave a `Scope: ` label off any row, the block
+  is returned whole and may exceed the budget: guard rows and parseability
+  outrank the budget.
+  The scope-filter rules and the stage-contract
   budget/limits come from `.cowork-flow/spec/runtime/scope-rules.json`, the
   single source consumed at runtime; a missing or malformed file degrades to
   embedded defaults that are byte-identical with the shipped file (locked by
-  `tests/test_scope_rules.py`).
+  `tests/test_scope_rules.py`). The file is template-managed
+  (`syncPolicy.safeFiles`): `cwf project sync` refreshes it, so local edits to
+  it do not survive a sync.
 - Absent for `no_task` / `planning` / `completed` states. Block content is
   byte-identical across host lines for the whole fixture matrix
   (`test/fixtures/stage-contract-matrix.json` drives the equality test: