feature-factory 0.7.1 → 0.7.2

package/WORKFLOW.md

@@ -1,8 +1,17 @@
 # Feature Factory — host-neutral workflow
 
 This document is the authoritative, host-neutral feature-factory workflow. It is not a discoverable
-skill by itself. A host integration must ship its own `SKILL.md`, place an exact copy of this file next
-to that skill as `WORKFLOW.md`, and require the run driver to read it completely before any effect.
+skill by itself. A host integration must ship its own `SKILL.md` and place an exact copy of this file next
+to that skill as `WORKFLOW.md`.
+
+**Where the driver reads this file from, and when.** `factory init` stages an exact copy into the run
+directory and returns its path as `workflow`. The driver reads THAT copy, completely, before any state read,
+dispatch, gate, or factory command other than `init` itself — admission and the `init` invocation are
+specified by the host `SKILL.md`, everything after them here. A host whose agents may read outside the
+workspace may instead read the copy beside its skill; a host that denies such reads must use the staged copy,
+because the packaged one is unreadable there and a run that depends on it fails on a permission refusal
+rather than on anything about the work. Either way the bytes are identical, and a driver that cannot read
+either copy stops without effects.
 
 The host adapter owns only invocation admission, placement, session identity, specialist dispatch, and
 result delivery. This workflow owns the durable chain, gates, repository lifecycle, evidence rules, and

package/bin/factory.js

@@ -17,7 +17,7 @@ import { assertPublicationReady, assertReviewBinding, observeMergeProof, readEvi
 import { readRepositoryConfig, RepositoryConfigError } from "../observe/repository-config.js";
 import { reverifyRepair } from "../observe/repair-reverification.js";
 import { archiveReviewAttempt } from "../state/review-archive.js";
-import { writeProtectedJsonAtomic } from "../core/atomic-write.js";
+import { writeProtectedFileAtomic, writeProtectedJsonAtomic } from "../core/atomic-write.js";
 import { enforceEffectivePushTarget } from "../core/effective-push.js";
 import { resolveSpawnExecutable } from "../core/executable.js";
 import { dispatchInitPublication } from "./init-publication.js";
@@ -1336,9 +1336,21 @@ export async function dispatchInit(positional, flags, operations = INIT_OPERATIO
   } catch (error) {
     throw new CliError(`final manifest validation failed for sandbox '${S}'; sandbox was retained`, { cause: error });
   }
+  // `external_directory` is denied for every agent and the canonical workflow ships outside the workspace, so
+  // without this the driver cannot perform the read its own contract requires; the only other way past it is
+  // `--auto`, which blanket-approves every permission ask. Protected writer, not a copy: `bootstrap` has run
+  // repository-controlled commands by now, so a planted destination symlink would redirect a plain write out
+  // of the sandbox, and `assertSafeTarget` rechecks immediately before the rename. Before publication, so a
+  // failure aborts init while a retry is still possible.
+  const workflowBytes = readFileSync(new URL("../WORKFLOW.md", import.meta.url));
+  await writeProtectedFileAtomic(runDir, "WORKFLOW.md", workflowBytes);
+  const workflow = joinPath(runDir, "WORKFLOW.md");
+  if (!readFileSync(workflow).equals(workflowBytes)) {
+    throw new CliError(`staged workflow at '${workflow}' does not match the canonical copy; sandbox was retained`);
+  }
   const { observedRun } = await dispatchInitPublication({ runDir, sandboxPath: S, candidate: run, finalGuard: proveContainedBranch });
   return emit(flags, {
-    run_id: observedRun.run_id, run_dir: runDir, sandbox_path: proof.sandboxPath,
+    run_id: observedRun.run_id, run_dir: runDir, workflow, sandbox_path: proof.sandboxPath,
     branch: observedRun.branch, worktree: observedRun.worktree, pr_base: observedRun.pr_base,
     status: observedRun.status, mode: observedRun.mode,
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "feature-factory",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Durable, observed control plane for /feature runs. Host-agnostic: no opencode dependency.",
   "type": "module",
   "license": "MIT",