flow-workflows 0.65.0-rc.1 → 0.65.0-rc.2

package/adapters/codex/CORE.md

@@ -17,6 +17,14 @@ Every `$flow-*` command assumes these rules. They are stated once, here, so a co
 carries what is specific to its phase. Read this once per session; a command that says "load
 `flow-core`" means this file.
 
+**This file belongs to flow `0.65.0-rc.2`.** Compare it once, at the start of the session, against
+`version` in `~/.claude/flow/.claude-plugin/plugin.json`. The two differing means the session
+is running a **mixture** — the commands from one copy of the plugin, these shared rules from another
+— which is exactly what happens when a branch or a release candidate is loaded over an installed
+copy that stays enabled: the harness resolves a command from the one and a skill from the other,
+silently. Name both numbers at the first stop and say which half is which; a rule this file adds and
+a command relies on is simply absent in that session, and nothing else will report it.
+
 ## 0. Effective FLOW config — base plus harness overlay
 
 - Read `FLOW.md` at the repo root as the base, then the optional overlay for the harness running

package/adapters/codex/skills/flow-bug-review/SKILL.md

@@ -28,8 +28,8 @@ Read `~/.claude/flow/CORE.codex.md` first (shared rules: `FLOW.md` step 0, model
 - **A premise left open by `fix` §2.2 is an input to this review, not a note.** Every row of "Premises the fix depends on" whose verdict is `unsettled` enters §5 as an **ambiguous finding** and is named in §7 whether or not that gate opened — in a bug it is usually the claim that the root cause was the whole cause, which is exactly what the regression test cannot prove.
 - Require `fix` in `phases_done`; for `size` ≥ S also require `validate`.
 - `git diff` shows no changes → warn and stop.
-- **Gather the material once, not once per reviewer.** `npx flow-workflows bundle --checks` prints
-  one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
+- **Gather the material once, not once per reviewer.** `npx flow-workflows@<version> bundle --checks`
+  prints one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
   in full, the raw output of `quality.static_analysis`, and the work's handoff — in a single call.
   Read that instead of rediscovering it, and **pass it to the briefs of §2-§5**: a panel where every
   member runs its own `git diff` and opens the same files pays for that material once per agent, and
@@ -39,8 +39,15 @@ Read `~/.claude/flow/CORE.codex.md` first (shared rules: `FLOW.md` step 0, model
   What is not optional is the `Review path` line of §7: a round that skipped the pack and one that
   used it are indistinguishable from the artifact otherwise, which is how a phase quietly stops
   paying for itself.
+- **`<version>` is this plugin's own, in every `flow-workflows` call on this page.** Read it once
+  from `version` in `~/.claude/flow/.claude-plugin/plugin.json` and substitute it. Left
+  unpinned, the fetcher resolves whatever the registry calls newest, which while a release candidate
+  is under test is the **previous** release: the page then describes subcommands and flags the CLI
+  that actually runs does not carry, every call exits non-zero, and the round takes the documented
+  fallback for a reason nobody can see. The version the plugin asks for and the version that answers
+  are the same number by construction, or the `Review path` line of §8 says which one failed.
 - **`agents.exec_cmd` set → the panel runs from the CLI.** Not a choice to weigh: run
-  `npx flow-workflows review`, which spawns that command once per role over the pack above — **one
+  `npx flow-workflows@<version> review`, which spawns that command once per role over the pack above — **one
   turn each instead of an agentic loop each** — and returns the findings already deduplicated, with
   the reviewers it dropped for `agents.budget_max` named. Exactly three things send the round to the
   agentic panel below: the key is empty (the default — nothing changes without it), the CLI is

package/adapters/codex/skills/flow-doctor/SKILL.md

@@ -226,12 +226,22 @@ refuse) · **degraded** (it runs, quietly worse than the config promises), plus
   numbers with the count of panel members `quality.review_skill`/`quality.reviewers` defines, so
   the widest command's cost is visible before it is paid, not after.
 - **The `flow-workflows` CLI, which `review` reaches for before it composes a panel**:
-  `npx flow-workflows --version` answers, and the number matches this plugin's. Unreachable — no
-  node, no network, a machine that installs nothing — is **not** a failure: say so in one line, and
-  that the review falls back to reading the diff from git, paying for that material once per
-  reviewer. A version *behind* the plugin's is the one that misleads, because the commands then
-  describe flags the installed CLI does not have: report both numbers and let the reader decide.
-  This is the only check here about something no install step of ours puts on the machine.
+  `npx flow-workflows@<version> --version` answers, with `<version>` read from `version` in
+  `~/.claude/flow/.claude-plugin/plugin.json` — the same pin `review` uses, so the number that
+  answers cannot be behind the plugin's. Unreachable — no node, no network, a machine that installs
+  nothing — is **not** a failure: say so in one line, and that the review falls back to reading the
+  diff from git, paying for that material once per reviewer. What this check catches is a pin that
+  **cannot be fetched at all**: a candidate withdrawn from the registry, or a plugin loaded from a
+  branch whose version was never published, where every `flow-workflows` call will fail for the whole
+  session. Report the version asked for and what came back. This is the only check here about
+  something no install step of ours puts on the machine.
+- **The plugin is one copy, not two.** The version in `~/.claude/flow/.claude-plugin/plugin.json`
+  and the one the loaded `flow-core` states (its opening lines) are the same number. They differ →
+  this session resolves its commands from one copy of the plugin and its shared rules from another,
+  which is what loading a branch or a candidate over an installed copy does when the installed one is
+  left enabled. Name both numbers and the fix: disable the installed plugin for the session, or stop
+  loading the second copy. A mixture is worth a `warn` rather than a `fail` — everything still runs,
+  which is precisely why it goes unnoticed.
 - The `flow-core` skill file exists under the plugin root: `~/.claude/flow/CORE.codex.md`.
   Missing → every phase command runs without its shared rules; fix: reinstall or update the plugin.
 

package/adapters/codex/skills/flow-feat-review/SKILL.md

@@ -28,8 +28,8 @@ Mandatory review phase. **`$flow-feat-ship` cannot run without passing through h
 - **A premise left open by `build` §2.1bis is an input to this review, not a note.** Every row of "Premises the change depends on" whose verdict is `unsettled` enters §6 as an **ambiguous finding** (it rests, by construction, on code outside the diff) and is named in §7 whether or not the gate opened. A premise the build could not settle and the review does not mention is one the MR/PR ships as a fact.
 - Require `build` in `phases_done`. **In a multi-MR/PR work** (`meta.json.mrs` has >1 entry) require `build` in the **current `in_progress` MR/PR's** own `phases_done` (its `mrs[]` entry) — a previous MR/PR's `build` does not count. If missing, send the user to `$flow-feat-build` and stop.
 - Check that `git diff` has real changes. None → warn and stop.
-- **Gather the material once, not once per reviewer.** `npx flow-workflows bundle --checks` prints
-  one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
+- **Gather the material once, not once per reviewer.** `npx flow-workflows@<version> bundle --checks`
+  prints one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
   in full, the raw output of `quality.static_analysis`, and the work's handoff — in a single call.
   Read that instead of rediscovering it, and **pass it to the briefs of §2-§6**: a panel where every
   member runs its own `git diff` and opens the same files pays for that material once per agent, and
@@ -39,8 +39,15 @@ Mandatory review phase. **`$flow-feat-ship` cannot run without passing through h
   What is not optional is the `Review path` line of §8: a round that skipped the pack and one that
   used it are indistinguishable from the artifact otherwise, which is how a phase quietly stops
   paying for itself.
+- **`<version>` is this plugin's own, in every `flow-workflows` call on this page.** Read it once
+  from `version` in `~/.claude/flow/.claude-plugin/plugin.json` and substitute it. Left
+  unpinned, the fetcher resolves whatever the registry calls newest, which while a release candidate
+  is under test is the **previous** release: the page then describes subcommands and flags the CLI
+  that actually runs does not carry, every call exits non-zero, and the round takes the documented
+  fallback for a reason nobody can see. The version the plugin asks for and the version that answers
+  are the same number by construction, or the `Review path` line of §8 says which one failed.
 - **`agents.exec_cmd` set → the panel runs from the CLI.** Not a choice to weigh: run
-  `npx flow-workflows review`, which spawns that command once per role over the pack above — **one
+  `npx flow-workflows@<version> review`, which spawns that command once per role over the pack above — **one
   turn each instead of an agentic loop each** — and returns the findings already deduplicated, with
   the reviewers it dropped for `agents.budget_max` named. Exactly three things send the round to the
   agentic panel below: the key is empty (the default — nothing changes without it), the CLI is

package/adapters/gemini/CORE.md

@@ -16,6 +16,14 @@ Every `/flow:*` command assumes these rules. They are stated once, here, so a co
 carries what is specific to its phase. Read this once per session; a command that says "load
 `flow-core`" means this file.
 
+**This file belongs to flow `0.65.0-rc.2`.** Compare it once, at the start of the session, against
+`version` in `~/.claude/flow/.claude-plugin/plugin.json`. The two differing means the session
+is running a **mixture** — the commands from one copy of the plugin, these shared rules from another
+— which is exactly what happens when a branch or a release candidate is loaded over an installed
+copy that stays enabled: the harness resolves a command from the one and a skill from the other,
+silently. Name both numbers at the first stop and say which half is which; a rule this file adds and
+a command relies on is simply absent in that session, and nothing else will report it.
+
 ## 0. Effective FLOW config — base plus harness overlay
 
 - Read `FLOW.md` at the repo root as the base, then the optional overlay for the harness running

package/adapters/gemini/commands/flow/bug/review.toml

@@ -24,8 +24,8 @@ Read `~/.claude/flow/CORE.gemini.md` first (shared rules: `FLOW.md` step 0, mode
 - **A premise left open by `fix` §2.2 is an input to this review, not a note.** Every row of "Premises the fix depends on" whose verdict is `unsettled` enters §5 as an **ambiguous finding** and is named in §7 whether or not that gate opened — in a bug it is usually the claim that the root cause was the whole cause, which is exactly what the regression test cannot prove.
 - Require `fix` in `phases_done`; for `size` ≥ S also require `validate`.
 - `git diff` shows no changes → warn and stop.
-- **Gather the material once, not once per reviewer.** `npx flow-workflows bundle --checks` prints
-  one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
+- **Gather the material once, not once per reviewer.** `npx flow-workflows@<version> bundle --checks`
+  prints one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
   in full, the raw output of `quality.static_analysis`, and the work's handoff — in a single call.
   Read that instead of rediscovering it, and **pass it to the briefs of §2-§5**: a panel where every
   member runs its own `git diff` and opens the same files pays for that material once per agent, and
@@ -35,8 +35,15 @@ Read `~/.claude/flow/CORE.gemini.md` first (shared rules: `FLOW.md` step 0, mode
   What is not optional is the `Review path` line of §7: a round that skipped the pack and one that
   used it are indistinguishable from the artifact otherwise, which is how a phase quietly stops
   paying for itself.
+- **`<version>` is this plugin's own, in every `flow-workflows` call on this page.** Read it once
+  from `version` in `~/.claude/flow/.claude-plugin/plugin.json` and substitute it. Left
+  unpinned, the fetcher resolves whatever the registry calls newest, which while a release candidate
+  is under test is the **previous** release: the page then describes subcommands and flags the CLI
+  that actually runs does not carry, every call exits non-zero, and the round takes the documented
+  fallback for a reason nobody can see. The version the plugin asks for and the version that answers
+  are the same number by construction, or the `Review path` line of §8 says which one failed.
 - **`agents.exec_cmd` set → the panel runs from the CLI.** Not a choice to weigh: run
-  `npx flow-workflows review`, which spawns that command once per role over the pack above — **one
+  `npx flow-workflows@<version> review`, which spawns that command once per role over the pack above — **one
   turn each instead of an agentic loop each** — and returns the findings already deduplicated, with
   the reviewers it dropped for `agents.budget_max` named. Exactly three things send the round to the
   agentic panel below: the key is empty (the default — nothing changes without it), the CLI is

package/adapters/gemini/commands/flow/doctor.toml

@@ -222,12 +222,22 @@ refuse) · **degraded** (it runs, quietly worse than the config promises), plus
   numbers with the count of panel members `quality.review_skill`/`quality.reviewers` defines, so
   the widest command's cost is visible before it is paid, not after.
 - **The `flow-workflows` CLI, which `review` reaches for before it composes a panel**:
-  `npx flow-workflows --version` answers, and the number matches this plugin's. Unreachable — no
-  node, no network, a machine that installs nothing — is **not** a failure: say so in one line, and
-  that the review falls back to reading the diff from git, paying for that material once per
-  reviewer. A version *behind* the plugin's is the one that misleads, because the commands then
-  describe flags the installed CLI does not have: report both numbers and let the reader decide.
-  This is the only check here about something no install step of ours puts on the machine.
+  `npx flow-workflows@<version> --version` answers, with `<version>` read from `version` in
+  `~/.claude/flow/.claude-plugin/plugin.json` — the same pin `review` uses, so the number that
+  answers cannot be behind the plugin's. Unreachable — no node, no network, a machine that installs
+  nothing — is **not** a failure: say so in one line, and that the review falls back to reading the
+  diff from git, paying for that material once per reviewer. What this check catches is a pin that
+  **cannot be fetched at all**: a candidate withdrawn from the registry, or a plugin loaded from a
+  branch whose version was never published, where every `flow-workflows` call will fail for the whole
+  session. Report the version asked for and what came back. This is the only check here about
+  something no install step of ours puts on the machine.
+- **The plugin is one copy, not two.** The version in `~/.claude/flow/.claude-plugin/plugin.json`
+  and the one the loaded `flow-core` states (its opening lines) are the same number. They differ →
+  this session resolves its commands from one copy of the plugin and its shared rules from another,
+  which is what loading a branch or a candidate over an installed copy does when the installed one is
+  left enabled. Name both numbers and the fix: disable the installed plugin for the session, or stop
+  loading the second copy. A mixture is worth a `warn` rather than a `fail` — everything still runs,
+  which is precisely why it goes unnoticed.
 - The `flow-core` skill file exists under the plugin root: `~/.claude/flow/CORE.gemini.md`.
   Missing → every phase command runs without its shared rules; fix: reinstall or update the plugin.
 

package/adapters/gemini/commands/flow/feat/review.toml

@@ -24,8 +24,8 @@ Mandatory review phase. **`/flow:feat:ship` cannot run without passing through h
 - **A premise left open by `build` §2.1bis is an input to this review, not a note.** Every row of "Premises the change depends on" whose verdict is `unsettled` enters §6 as an **ambiguous finding** (it rests, by construction, on code outside the diff) and is named in §7 whether or not the gate opened. A premise the build could not settle and the review does not mention is one the MR/PR ships as a fact.
 - Require `build` in `phases_done`. **In a multi-MR/PR work** (`meta.json.mrs` has >1 entry) require `build` in the **current `in_progress` MR/PR's** own `phases_done` (its `mrs[]` entry) — a previous MR/PR's `build` does not count. If missing, send the user to `/flow:feat:build` and stop.
 - Check that `git diff` has real changes. None → warn and stop.
-- **Gather the material once, not once per reviewer.** `npx flow-workflows bundle --checks` prints
-  one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
+- **Gather the material once, not once per reviewer.** `npx flow-workflows@<version> bundle --checks`
+  prints one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
   in full, the raw output of `quality.static_analysis`, and the work's handoff — in a single call.
   Read that instead of rediscovering it, and **pass it to the briefs of §2-§6**: a panel where every
   member runs its own `git diff` and opens the same files pays for that material once per agent, and
@@ -35,8 +35,15 @@ Mandatory review phase. **`/flow:feat:ship` cannot run without passing through h
   What is not optional is the `Review path` line of §8: a round that skipped the pack and one that
   used it are indistinguishable from the artifact otherwise, which is how a phase quietly stops
   paying for itself.
+- **`<version>` is this plugin's own, in every `flow-workflows` call on this page.** Read it once
+  from `version` in `~/.claude/flow/.claude-plugin/plugin.json` and substitute it. Left
+  unpinned, the fetcher resolves whatever the registry calls newest, which while a release candidate
+  is under test is the **previous** release: the page then describes subcommands and flags the CLI
+  that actually runs does not carry, every call exits non-zero, and the round takes the documented
+  fallback for a reason nobody can see. The version the plugin asks for and the version that answers
+  are the same number by construction, or the `Review path` line of §8 says which one failed.
 - **`agents.exec_cmd` set → the panel runs from the CLI.** Not a choice to weigh: run
-  `npx flow-workflows review`, which spawns that command once per role over the pack above — **one
+  `npx flow-workflows@<version> review`, which spawns that command once per role over the pack above — **one
   turn each instead of an agentic loop each** — and returns the findings already deduplicated, with
   the reviewers it dropped for `agents.budget_max` named. Exactly three things send the round to the
   agentic panel below: the key is empty (the default — nothing changes without it), the CLI is

package/adapters/hermes/CORE.md

@@ -17,6 +17,14 @@ Every `/flow-*` command assumes these rules. They are stated once, here, so a co
 carries what is specific to its phase. Read this once per session; a command that says "load
 `flow-core`" means this file.
 
+**This file belongs to flow `0.65.0-rc.2`.** Compare it once, at the start of the session, against
+`version` in `~/.claude/flow/.claude-plugin/plugin.json`. The two differing means the session
+is running a **mixture** — the commands from one copy of the plugin, these shared rules from another
+— which is exactly what happens when a branch or a release candidate is loaded over an installed
+copy that stays enabled: the harness resolves a command from the one and a skill from the other,
+silently. Name both numbers at the first stop and say which half is which; a rule this file adds and
+a command relies on is simply absent in that session, and nothing else will report it.
+
 ## 0. Effective FLOW config — base plus harness overlay
 
 - Read `FLOW.md` at the repo root as the base, then the optional overlay for the harness running

package/adapters/hermes/skills/flow-bug-review/SKILL.md

@@ -28,8 +28,8 @@ Read `~/.claude/flow/CORE.hermes.md` first (shared rules: `FLOW.md` step 0, mode
 - **A premise left open by `fix` §2.2 is an input to this review, not a note.** Every row of "Premises the fix depends on" whose verdict is `unsettled` enters §5 as an **ambiguous finding** and is named in §7 whether or not that gate opened — in a bug it is usually the claim that the root cause was the whole cause, which is exactly what the regression test cannot prove.
 - Require `fix` in `phases_done`; for `size` ≥ S also require `validate`.
 - `git diff` shows no changes → warn and stop.
-- **Gather the material once, not once per reviewer.** `npx flow-workflows bundle --checks` prints
-  one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
+- **Gather the material once, not once per reviewer.** `npx flow-workflows@<version> bundle --checks`
+  prints one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
   in full, the raw output of `quality.static_analysis`, and the work's handoff — in a single call.
   Read that instead of rediscovering it, and **pass it to the briefs of §2-§5**: a panel where every
   member runs its own `git diff` and opens the same files pays for that material once per agent, and
@@ -39,8 +39,15 @@ Read `~/.claude/flow/CORE.hermes.md` first (shared rules: `FLOW.md` step 0, mode
   What is not optional is the `Review path` line of §7: a round that skipped the pack and one that
   used it are indistinguishable from the artifact otherwise, which is how a phase quietly stops
   paying for itself.
+- **`<version>` is this plugin's own, in every `flow-workflows` call on this page.** Read it once
+  from `version` in `~/.claude/flow/.claude-plugin/plugin.json` and substitute it. Left
+  unpinned, the fetcher resolves whatever the registry calls newest, which while a release candidate
+  is under test is the **previous** release: the page then describes subcommands and flags the CLI
+  that actually runs does not carry, every call exits non-zero, and the round takes the documented
+  fallback for a reason nobody can see. The version the plugin asks for and the version that answers
+  are the same number by construction, or the `Review path` line of §8 says which one failed.
 - **`agents.exec_cmd` set → the panel runs from the CLI.** Not a choice to weigh: run
-  `npx flow-workflows review`, which spawns that command once per role over the pack above — **one
+  `npx flow-workflows@<version> review`, which spawns that command once per role over the pack above — **one
   turn each instead of an agentic loop each** — and returns the findings already deduplicated, with
   the reviewers it dropped for `agents.budget_max` named. Exactly three things send the round to the
   agentic panel below: the key is empty (the default — nothing changes without it), the CLI is

package/adapters/hermes/skills/flow-doctor/SKILL.md

@@ -226,12 +226,22 @@ refuse) · **degraded** (it runs, quietly worse than the config promises), plus
   numbers with the count of panel members `quality.review_skill`/`quality.reviewers` defines, so
   the widest command's cost is visible before it is paid, not after.
 - **The `flow-workflows` CLI, which `review` reaches for before it composes a panel**:
-  `npx flow-workflows --version` answers, and the number matches this plugin's. Unreachable — no
-  node, no network, a machine that installs nothing — is **not** a failure: say so in one line, and
-  that the review falls back to reading the diff from git, paying for that material once per
-  reviewer. A version *behind* the plugin's is the one that misleads, because the commands then
-  describe flags the installed CLI does not have: report both numbers and let the reader decide.
-  This is the only check here about something no install step of ours puts on the machine.
+  `npx flow-workflows@<version> --version` answers, with `<version>` read from `version` in
+  `~/.claude/flow/.claude-plugin/plugin.json` — the same pin `review` uses, so the number that
+  answers cannot be behind the plugin's. Unreachable — no node, no network, a machine that installs
+  nothing — is **not** a failure: say so in one line, and that the review falls back to reading the
+  diff from git, paying for that material once per reviewer. What this check catches is a pin that
+  **cannot be fetched at all**: a candidate withdrawn from the registry, or a plugin loaded from a
+  branch whose version was never published, where every `flow-workflows` call will fail for the whole
+  session. Report the version asked for and what came back. This is the only check here about
+  something no install step of ours puts on the machine.
+- **The plugin is one copy, not two.** The version in `~/.claude/flow/.claude-plugin/plugin.json`
+  and the one the loaded `flow-core` states (its opening lines) are the same number. They differ →
+  this session resolves its commands from one copy of the plugin and its shared rules from another,
+  which is what loading a branch or a candidate over an installed copy does when the installed one is
+  left enabled. Name both numbers and the fix: disable the installed plugin for the session, or stop
+  loading the second copy. A mixture is worth a `warn` rather than a `fail` — everything still runs,
+  which is precisely why it goes unnoticed.
 - The `flow-core` skill file exists under the plugin root: `~/.claude/flow/CORE.hermes.md`.
   Missing → every phase command runs without its shared rules; fix: reinstall or update the plugin.
 

package/adapters/hermes/skills/flow-feat-review/SKILL.md

@@ -28,8 +28,8 @@ Mandatory review phase. **`/flow-feat-ship` cannot run without passing through h
 - **A premise left open by `build` §2.1bis is an input to this review, not a note.** Every row of "Premises the change depends on" whose verdict is `unsettled` enters §6 as an **ambiguous finding** (it rests, by construction, on code outside the diff) and is named in §7 whether or not the gate opened. A premise the build could not settle and the review does not mention is one the MR/PR ships as a fact.
 - Require `build` in `phases_done`. **In a multi-MR/PR work** (`meta.json.mrs` has >1 entry) require `build` in the **current `in_progress` MR/PR's** own `phases_done` (its `mrs[]` entry) — a previous MR/PR's `build` does not count. If missing, send the user to `/flow-feat-build` and stop.
 - Check that `git diff` has real changes. None → warn and stop.
-- **Gather the material once, not once per reviewer.** `npx flow-workflows bundle --checks` prints
-  one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
+- **Gather the material once, not once per reviewer.** `npx flow-workflows@<version> bundle --checks`
+  prints one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
   in full, the raw output of `quality.static_analysis`, and the work's handoff — in a single call.
   Read that instead of rediscovering it, and **pass it to the briefs of §2-§6**: a panel where every
   member runs its own `git diff` and opens the same files pays for that material once per agent, and
@@ -39,8 +39,15 @@ Mandatory review phase. **`/flow-feat-ship` cannot run without passing through h
   What is not optional is the `Review path` line of §8: a round that skipped the pack and one that
   used it are indistinguishable from the artifact otherwise, which is how a phase quietly stops
   paying for itself.
+- **`<version>` is this plugin's own, in every `flow-workflows` call on this page.** Read it once
+  from `version` in `~/.claude/flow/.claude-plugin/plugin.json` and substitute it. Left
+  unpinned, the fetcher resolves whatever the registry calls newest, which while a release candidate
+  is under test is the **previous** release: the page then describes subcommands and flags the CLI
+  that actually runs does not carry, every call exits non-zero, and the round takes the documented
+  fallback for a reason nobody can see. The version the plugin asks for and the version that answers
+  are the same number by construction, or the `Review path` line of §8 says which one failed.
 - **`agents.exec_cmd` set → the panel runs from the CLI.** Not a choice to weigh: run
-  `npx flow-workflows review`, which spawns that command once per role over the pack above — **one
+  `npx flow-workflows@<version> review`, which spawns that command once per role over the pack above — **one
   turn each instead of an agentic loop each** — and returns the findings already deduplicated, with
   the reviewers it dropped for `agents.budget_max` named. Exactly three things send the round to the
   agentic panel below: the key is empty (the default — nothing changes without it), the CLI is

package/adapters/opencode/CORE.md

@@ -16,6 +16,14 @@ Every `/flow-*` command assumes these rules. They are stated once, here, so a co
 carries what is specific to its phase. Read this once per session; a command that says "load
 `flow-core`" means this file.
 
+**This file belongs to flow `0.65.0-rc.2`.** Compare it once, at the start of the session, against
+`version` in `~/.claude/flow/.claude-plugin/plugin.json`. The two differing means the session
+is running a **mixture** — the commands from one copy of the plugin, these shared rules from another
+— which is exactly what happens when a branch or a release candidate is loaded over an installed
+copy that stays enabled: the harness resolves a command from the one and a skill from the other,
+silently. Name both numbers at the first stop and say which half is which; a rule this file adds and
+a command relies on is simply absent in that session, and nothing else will report it.
+
 ## 0. Effective FLOW config — base plus harness overlay
 
 - Read `FLOW.md` at the repo root as the base, then the optional overlay for the harness running

package/adapters/opencode/commands/flow-bug-review.md

@@ -26,8 +26,8 @@ Read `~/.claude/flow/CORE.opencode.md` first (shared rules: `FLOW.md` step 0, mo
 - **A premise left open by `fix` §2.2 is an input to this review, not a note.** Every row of "Premises the fix depends on" whose verdict is `unsettled` enters §5 as an **ambiguous finding** and is named in §7 whether or not that gate opened — in a bug it is usually the claim that the root cause was the whole cause, which is exactly what the regression test cannot prove.
 - Require `fix` in `phases_done`; for `size` ≥ S also require `validate`.
 - `git diff` shows no changes → warn and stop.
-- **Gather the material once, not once per reviewer.** `npx flow-workflows bundle --checks` prints
-  one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
+- **Gather the material once, not once per reviewer.** `npx flow-workflows@<version> bundle --checks`
+  prints one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
   in full, the raw output of `quality.static_analysis`, and the work's handoff — in a single call.
   Read that instead of rediscovering it, and **pass it to the briefs of §2-§5**: a panel where every
   member runs its own `git diff` and opens the same files pays for that material once per agent, and
@@ -37,8 +37,15 @@ Read `~/.claude/flow/CORE.opencode.md` first (shared rules: `FLOW.md` step 0, mo
   What is not optional is the `Review path` line of §7: a round that skipped the pack and one that
   used it are indistinguishable from the artifact otherwise, which is how a phase quietly stops
   paying for itself.
+- **`<version>` is this plugin's own, in every `flow-workflows` call on this page.** Read it once
+  from `version` in `~/.claude/flow/.claude-plugin/plugin.json` and substitute it. Left
+  unpinned, the fetcher resolves whatever the registry calls newest, which while a release candidate
+  is under test is the **previous** release: the page then describes subcommands and flags the CLI
+  that actually runs does not carry, every call exits non-zero, and the round takes the documented
+  fallback for a reason nobody can see. The version the plugin asks for and the version that answers
+  are the same number by construction, or the `Review path` line of §8 says which one failed.
 - **`agents.exec_cmd` set → the panel runs from the CLI.** Not a choice to weigh: run
-  `npx flow-workflows review`, which spawns that command once per role over the pack above — **one
+  `npx flow-workflows@<version> review`, which spawns that command once per role over the pack above — **one
   turn each instead of an agentic loop each** — and returns the findings already deduplicated, with
   the reviewers it dropped for `agents.budget_max` named. Exactly three things send the round to the
   agentic panel below: the key is empty (the default — nothing changes without it), the CLI is

package/adapters/opencode/commands/flow-doctor.md

@@ -224,12 +224,22 @@ refuse) · **degraded** (it runs, quietly worse than the config promises), plus
   numbers with the count of panel members `quality.review_skill`/`quality.reviewers` defines, so
   the widest command's cost is visible before it is paid, not after.
 - **The `flow-workflows` CLI, which `review` reaches for before it composes a panel**:
-  `npx flow-workflows --version` answers, and the number matches this plugin's. Unreachable — no
-  node, no network, a machine that installs nothing — is **not** a failure: say so in one line, and
-  that the review falls back to reading the diff from git, paying for that material once per
-  reviewer. A version *behind* the plugin's is the one that misleads, because the commands then
-  describe flags the installed CLI does not have: report both numbers and let the reader decide.
-  This is the only check here about something no install step of ours puts on the machine.
+  `npx flow-workflows@<version> --version` answers, with `<version>` read from `version` in
+  `~/.claude/flow/.claude-plugin/plugin.json` — the same pin `review` uses, so the number that
+  answers cannot be behind the plugin's. Unreachable — no node, no network, a machine that installs
+  nothing — is **not** a failure: say so in one line, and that the review falls back to reading the
+  diff from git, paying for that material once per reviewer. What this check catches is a pin that
+  **cannot be fetched at all**: a candidate withdrawn from the registry, or a plugin loaded from a
+  branch whose version was never published, where every `flow-workflows` call will fail for the whole
+  session. Report the version asked for and what came back. This is the only check here about
+  something no install step of ours puts on the machine.
+- **The plugin is one copy, not two.** The version in `~/.claude/flow/.claude-plugin/plugin.json`
+  and the one the loaded `flow-core` states (its opening lines) are the same number. They differ →
+  this session resolves its commands from one copy of the plugin and its shared rules from another,
+  which is what loading a branch or a candidate over an installed copy does when the installed one is
+  left enabled. Name both numbers and the fix: disable the installed plugin for the session, or stop
+  loading the second copy. A mixture is worth a `warn` rather than a `fail` — everything still runs,
+  which is precisely why it goes unnoticed.
 - The `flow-core` skill file exists under the plugin root: `~/.claude/flow/CORE.opencode.md`.
   Missing → every phase command runs without its shared rules; fix: reinstall or update the plugin.
 

package/adapters/opencode/commands/flow-feat-review.md

@@ -26,8 +26,8 @@ Mandatory review phase. **`/flow-feat-ship` cannot run without passing through h
 - **A premise left open by `build` §2.1bis is an input to this review, not a note.** Every row of "Premises the change depends on" whose verdict is `unsettled` enters §6 as an **ambiguous finding** (it rests, by construction, on code outside the diff) and is named in §7 whether or not the gate opened. A premise the build could not settle and the review does not mention is one the MR/PR ships as a fact.
 - Require `build` in `phases_done`. **In a multi-MR/PR work** (`meta.json.mrs` has >1 entry) require `build` in the **current `in_progress` MR/PR's** own `phases_done` (its `mrs[]` entry) — a previous MR/PR's `build` does not count. If missing, send the user to `/flow-feat-build` and stop.
 - Check that `git diff` has real changes. None → warn and stop.
-- **Gather the material once, not once per reviewer.** `npx flow-workflows bundle --checks` prints
-  one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
+- **Gather the material once, not once per reviewer.** `npx flow-workflows@<version> bundle --checks`
+  prints one context pack for this branch — worklist, the diff (minus `git.diff_exclude`), the changed files
   in full, the raw output of `quality.static_analysis`, and the work's handoff — in a single call.
   Read that instead of rediscovering it, and **pass it to the briefs of §2-§6**: a panel where every
   member runs its own `git diff` and opens the same files pays for that material once per agent, and
@@ -37,8 +37,15 @@ Mandatory review phase. **`/flow-feat-ship` cannot run without passing through h
   What is not optional is the `Review path` line of §8: a round that skipped the pack and one that
   used it are indistinguishable from the artifact otherwise, which is how a phase quietly stops
   paying for itself.
+- **`<version>` is this plugin's own, in every `flow-workflows` call on this page.** Read it once
+  from `version` in `~/.claude/flow/.claude-plugin/plugin.json` and substitute it. Left
+  unpinned, the fetcher resolves whatever the registry calls newest, which while a release candidate
+  is under test is the **previous** release: the page then describes subcommands and flags the CLI
+  that actually runs does not carry, every call exits non-zero, and the round takes the documented
+  fallback for a reason nobody can see. The version the plugin asks for and the version that answers
+  are the same number by construction, or the `Review path` line of §8 says which one failed.
 - **`agents.exec_cmd` set → the panel runs from the CLI.** Not a choice to weigh: run
-  `npx flow-workflows review`, which spawns that command once per role over the pack above — **one
+  `npx flow-workflows@<version> review`, which spawns that command once per role over the pack above — **one
   turn each instead of an agentic loop each** — and returns the findings already deduplicated, with
   the reviewers it dropped for `agents.budget_max` named. Exactly three things send the round to the
   agentic panel below: the key is empty (the default — nothing changes without it), the CLI is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flow-workflows",
-  "version": "0.65.0-rc.1",
+  "version": "0.65.0-rc.2",
   "description": "Guided feat/bug workflows (start→ship), post-deploy monitoring and multi-agent code review, stack-agnostic. Each repo uses a shared FLOW.md plus optional harness overlay.",
   "type": "module",
   "bin": {

package/plugins/flow/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "flow",
   "displayName": "Flow — guided dev workflows",
   "description": "Guided feat/bug workflows (start→ship), post-deploy monitoring and multi-agent code review, stack-agnostic. Each repo uses a shared FLOW.md plus optional harness overlay.",
-  "version": "0.65.0-rc.1",
+  "version": "0.65.0-rc.2",
   "author": {
     "name": "Alberto Vioque",
     "email": "mashware@gmail.com"

package/plugins/flow/CHANGELOG.md

@@ -11,7 +11,7 @@ The canonical, richest notes live in the [GitHub Releases](https://github.com/ma
 - **A round gathers its material once.** `npx flow-workflows bundle` prints one context pack — worklist, diff, changed files, the repo's own analysis output, the work's handoff — instead of every reviewer paying to rediscover it.
 - **The panel can run outside the agentic loop.** With `agents.exec_cmd` set, `npx flow-workflows review` runs one reviewer per role in **one turn each**, deduplicated — and that is what runs when the key is there, not one option among two.
 - **What a phase spent is written down.** `meta.json.cost[]` records the figure the harness reported, `"not reported"` when it reported none and never an estimate; `flow cost`, `/flow:work:status` and the review artifact read it back.
-- **A change can be run before it is tagged.** Release candidates publish under the `next` channel, so `latest` never moves for a candidate, and four ways to run a branch on a real repo are written down.
+- **A change can be run before it is tagged — and the candidate's own code is what runs.** Candidates publish under the `next` channel so `latest` never moves; the commands pin the CLI to the plugin's own version, so a candidate's commands can never be served by the previous release's CLI; and a session that has ended up with two copies of the plugin says so instead of running a mixture.
 - **Two claims stopped being promises.** The preflight now refuses a line that *depends* on one ecosystem, and a test pins the four answer shapes the review CLI has to unwrap.
 
 A phase costs turns times context. The API keeps no state, so ten calls spent finding out what
@@ -56,6 +56,24 @@ at all under `bin/`. And a change to the flow can now be installed before it is
 publishes under `next`, `claude --plugin-dir` loads a branch over the release you use daily, and npm
 serves a branch straight from git for the other harnesses.
 
+The first candidate then proved that last sentence half-true, in the only way that counts — a real
+work, driven end to end, on a real repo. Two things a page of prose could not have found. The
+commands call the CLI unpinned, so an unpinned fetch resolves the channel a candidate deliberately
+does not move: the candidate's own commands were served the **previous** release's CLI, `bundle` came
+back *"Unknown command"*, and the round took the documented fallback — correctly, silently, for a
+reason that had nothing to do with the machine. Every `flow-workflows` call now carries the plugin's
+own version, and the preflight refuses a tree where the manifest, the npm package and `flow-core`
+do not state the same number, because a pin is only worth having if the number it asks for was
+published. And loading a branch over an installed copy leaves **two** plugins of the same name: the
+session took its commands from the branch and its shared rules from the release, ran perfectly, and
+recorded the wrong thing. `flow-core` now states which version it belongs to, so any session can
+compare it against the plugin it is running and name both numbers at its first stop; `/flow:doctor`
+checks it outright, and `RELEASING.md` says to disable the installed copy rather than rely on either.
+
+What made all of this visible was the `Review path` line added above — a round that fell back and a
+round that did not are one line apart in the artifact, and without that line this release would have
+shipped believing its own notes.
+
 ## v0.64.0 — Announcing the next step was how the run ended  ·  2026-09-16
 
 **In short**