v0.2.8

A user can now open a run report in a browser in one step with cw report --open, and a terminal quickstart opens it on its own at the end of the run.

---

Provenance & audit

• Reviewed commit: 66a96f4ee00b
• Independent reviewer verdict (committed): .cw-release/review-66a96f4ee00b8e0184676fcb1db9c1a08da5311e.verdict
• Full diff: v0.2.7...v0.2.8
• npm (provenance-attested): cool-workflow@0.2.8

Released through the gated flow: deterministic gate → independent release-reviewer (verdict above) → provenance-attested npm publish.

v0.2.7

One command. One saved report. Nothing left behind.

• Wrong folder? cw -q stops and tells you.
• Run stopped? cw --resume --run <id> picks it up.
• One bad worker no longer parks the run. It gets a second try.
• The run folder holds only what the run made. Zero empty directories.
• New: cw run link ties a run to its pull request. cw bands record --queue turns a metric breach into a work item.
• New agent: Muse Code.

Start here: User Guide. Everything else: v0.2.6...v0.2.7.

---

Provenance & audit

• Reviewed commit: 855264a70e07
• Independent reviewer verdict (committed): .cw-release/review-855264a70e07a12409d99e77586e18be822da635.verdict
• Full diff: v0.2.6...v0.2.7
• npm (provenance-attested): cool-workflow@0.2.7

Released through the gated flow: deterministic gate → independent release-reviewer (verdict above) → provenance-attested npm publish.

v0.2.6

A user can inspect a saved run through the Workbench without creating derived .cw files, while keeping the selected run and panel in the page address.

• Capability: The Workbench is a true read-only local view. A user can
  return to a saved run and inspect its graph, audit, metrics, and review facts
  without making new state files. The page keeps its selected run and panel.
• Implementation: Every Workbench panel now uses a no-persist projection
  for derived audit and metrics facts. An optional k6 proof drives all local
  page and API reads at 25, 100, 150, 200, and 250 RPS. The release control
  plane now owns the deterministic gate and gives local stderr facts on a
  failed child command. The reviewer checks semantic release risks only.
• Tests: The full k6 proof had no HTTP error or dropped work, p95 below
  15ms, p99 below 18ms, no .cw/ write, and a good read after load. Unit,
  smoke, parity, manifest, onramp, index, and release checks passed.
• Risk: Low. Default CLI and MCP report calls keep their durable write
  behavior. The new benchmark is opt-in and adds no runtime dependency.
  Invalid reviewer output stops a cut without a tag or a made-up approval.

---

Provenance & audit

• Reviewed commit: 43c4c401e38f
• Independent reviewer verdict (committed): .cw-release/review-43c4c401e38f6e598ec54957e852b070e64f689c.verdict
• Full diff: v0.2.5...v0.2.6
• npm (provenance-attested): cool-workflow@0.2.6

Released through the gated flow: deterministic gate → independent release-reviewer (verdict above) → provenance-attested npm publish.

v0.2.5

MCP clients now receive real typed tool-input schemas with required-field lists, when-to-use behavior hints, and protocol-version negotiation, and a drive round can run its endpoint agents concurrently via --concurrency.

• Capability: A hardening-and-cleanup release from four audit campaigns (61 PRs, #441–#500). Release trust chain: the signed reviewer-verdict backstop is no longer bypassable — the verdict now binds the reviewed SHA in CI, the pubkey is pinned to main, the gate runs from main's tree (not the tag's own), two review-gate bypasses are closed, and CW_NEVER_FORWARD_ENV keeps CW's own secrets out of every spawned child, fail-closed. Robustness: 24 verified findings fixed — a run-scoped drive mutex, locked appends for messages.jsonl and the attestation ledger, a torn-tail merge guard, vendor-process reaping on agent timeout, hardened child termination, quiet EPIPE exits. Perf: commit snapshots stop copying the whole run, trust-audit appends go O(1) through a tail cache, and a drive round runs its endpoint agents concurrently. Also: real MCP tool input schemas, isError results, behavior hints and protocol-version negotiation; CLI and workbench UX fixes; a hard JS/TS-only policy with an enforcing gate (every shell script is now node); a repo slim-down (dead files deleted, doc drift fixed); npm now ships all four vendor plugin manifests (.gemini-plugin/, .opencode-plugin/ added); and a trust-audit lost-write race at log creation is fixed (#497).
• Implementation: The trust-chain work is in the release scripts and workflows (verdict-SHA binding, main-pinned pubkey) plus buildChildEnv's fail-closed env backstop. The lock and append fixes concentrate in shell/fs-atomic.ts (bounded backoff acquire), shell/coordinator-io.ts, shell/telemetry-ledger-io.ts, and shell/trust-audit.ts (tail cache; the missing-log create is now O_CREAT without O_TRUNC). MCP schema and hint work is in mcp-server.ts; the language gate is scripts/lang-policy-check.js.
• Tests: conformance 106/106, unit 169/169, full smoke suite 236/236 (up from 204 — every fix landed with its own pinning smoke). CI green on Node 18+22 × x64+arm64 for every PR.
• Risk: Low to moderate — the changes are fail-closed guards, lock serialization, perf work behind unchanged surfaces, and additive UX/docs; one packaging change (npm ships two more vendor manifest dirs, additive). No schema or --json shape changed. Zero new runtime dependencies.

---

Provenance & audit

• Reviewed commit: 4ed908af43dc
• Independent reviewer verdict (committed): .cw-release/review-4ed908af43dc3aba01304fd59cc11cf90facec12.verdict
• Full diff: v0.2.4...v0.2.5
• npm (provenance-attested): cool-workflow@0.2.5

Released through the gated flow: deterministic gate → independent release-reviewer (verdict above) → provenance-attested npm publish.

v0.2.4

A crashed or interrupted drive run now recovers cleanly — a mid-spawn SIGKILL no longer loses the round's dispatched work, the interrupt prints the exact cw run resume <id> --drive command, and cw gc reclaims superseded commit snapshots — while untrusted workflow-app code and an operator's env.deny are now enforced fail-closed.

• Capability: A trust-and-recovery hardening release, driven by an architecture self-review (1 P1 + 5 P2, PRs #432–#437). Workflow-app code outside CW's trusted roots is now blocked fail-closed (CW_ALLOW_EXTERNAL_APP_CODE=1 to opt in), and an appId can no longer path-traverse out of the apps root. env.deny is the final word for a spawned agent child — it beats inherit:true and the provider-key/USER re-add. A concurrent drive round's dispatch now survives a mid-batch SIGKILL. cw gc can reclaim superseded commit snapshots (--keep-commits to opt out; a reclaimed run downgrades to verify-only). An interrupted drive prints the literal cw run resume <id> --drive command, and resume honors --repo from any directory. Also: a one-command release (npm run release -- X.Y.Z — fail-fast preflight, tag-only push, resume on re-run), all 7 CodeQL alerts cleared, and 10 of 11 baselined core/shell layer waivers removed.
• Implementation: The trust gate and traversal bound live in shell/workflow-app-loader.ts; buildChildEnv/buildAgentChildEnv apply env.deny last; prepareConcurrentOutcomes saves one durable checkpoint before its batch spawns; shell/reclamation-io.ts gains a third freeable kind (commit-snapshot) with the dangling-reference proof extended to cover it; the pure arg-coercion helpers moved from cli/io.ts to core/util/cli-args.ts so wiring/ no longer imports cli/. Each fix went through a design-critique pass before implementation and an adversarial-review pass after.
• Tests: conformance 106/106, unit 161/161, full smoke suite 204/204. Every fix was proven red on the pre-fix build (real SIGKILL, real spawned children, real signals — via git stash) and green after.
• Risk: Low to moderate — the new gates are fail-closed and opt-out-able; one intentional behavior change (default gc run on an eligible run now also frees superseded commit snapshots; use --keep-commits for the old behavior). No schema or --json shape changed. Zero new runtime dependencies.

---

Provenance & audit

• Reviewed commit: b050147ace26
• Independent reviewer verdict (committed): .cw-release/review-b050147ace2675c8d714847591283d59352d3900.verdict
• Full diff: v0.2.3...v0.2.4
• npm (provenance-attested): cool-workflow@0.2.4

Released through the gated flow: deterministic gate → independent release-reviewer (verdict above) → provenance-attested npm publish.

v0.2.3

CW is now safe to run from many concurrent processes — state.json, the scheduler policy file, and the trust-audit log no longer lose updates or double-mint queue ids under a race, a Ctrl-C/SIGTERM mid-drive stops cleanly and resumes to completion, and a stuck agent times out and is SIGKILLed instead of hanging.

• Capability: A many-process safety release. Ten verified concurrency/robustness bugs are fixed: state.json, the sched policy file, and the trust-audit log no longer lose updates under concurrent writers; withFileLock's stale-lock steal is race-free end to end (pid-liveness gate, single-winner link(2) acquire, and a serialized steal guard — each step forced by a real CI failure); two processes can no longer mint the same queue id and break through maxConcurrent; a chained trust-audit event with a dropped prevEventHash now fails closed; a stuck agent is SIGKILLed and reported as a real timeout instead of "failed to spawn"; an escape-heavy batch job fails alone instead of ENOBUFSing every sibling; and cw <verb> --json | head -1 exits quietly instead of an unhandled EPIPE crash. CLI polish: cw completion <bash|zsh|fish>, a documented --quiet flag, --json in top-level help, grouped "More commands", a cw doctor onramp pointer, a friendlier bare cw quickstart, and structured workbench panels with a light theme. Security/CI: ed25519-signed release verdicts, CodeQL + gitleaks scanning, SHA-pinned workflow actions, and labeled stored text in MCP results.
• Implementation: The lock work is concentrated in shell/fs-atomic.ts — acquire by hard-linking a per-attempt temp file onto the lock path, steal only while holding a single-winner <lock>.steal guard with the verdict pinned to the judged inode+mtime. Every queue/policy mutator in scheduling-io.ts / run-registry-io.ts now runs its whole read-modify-write inside withFileLock, and queue ids are checked against the queue's own current entries under that same lock. The agent backend passes killSignal: "SIGKILL" and classifies ETIMEDOUT honestly; the batch child caps the SERIALIZED NDJSON line (33MB), not just raw stdout; one process-level stdout/stderr 'error' listener in cli/entry.ts handles EPIPE for every writer.
• Tests: conformance 106/106, unit 160/160, full smoke suite green with 91.6% line coverage (floor 80%). The lock fixes were measured, not argued: an artificial-load stress rig (24 processes, 6-core load) reproduced each residual race red before its fix and ran 60/60 trials clean after.
• Risk: Low to moderate — the fixes are fail-closed guards and lock serialization on existing surfaces; no schema, exit code, or --json shape changed, and the new CLI surfaces are additive. Zero new runtime dependencies.

---

Provenance & audit

• Reviewed commit: 35de8b2e98cc
• Independent reviewer verdict (committed): .cw-release/review-35de8b2e98cc783d0c0d1849f3567de1ba9c48f7.verdict
• Full diff: v0.2.2...v0.2.3
• npm (provenance-attested): cool-workflow@0.2.3

Released through the gated flow: deterministic gate → independent release-reviewer (verdict above) → provenance-attested npm publish.

v0.2.2

Ships three closed trust/safety gaps (audit tail-truncation now caught by cw audit head --expect-head/--expect-count, the manual-accept telemetry side door now blocked under --require-attested-telemetry with an audited --allow-unattested override, and a whole-cycle state.json lock that stops concurrent result recordings from dropping a task's completion), plus locale-pinned replay determinism and cw search as a real declared capability.

• Capability: Closes three trust/safety gaps — cw audit head catches audit-log tail-truncation, --require-attested-telemetry now blocks a manual accept with no delegation metadata at all (not just a mismatched one), and state.json is locked for the whole read-modify-write cycle so two processes can no longer drop one another's result. Also: every internal sort is now locale-pinned (a differing host LANG used to shift cache keys and eval-replay comparisons), cw search is a real declared capability, and three dead dispatchLegacy stubs are gone.
• Implementation: core/capability-table.ts (4,300+ lines) is split into a pure core/capability-data.ts plus a src/wiring/capability-table/ layer, backed by a new purity:check ratchet on the core/shell boundary. A restored test:unit layer (152 tests) runs alongside the smoke and conformance suites.
• Tests: test:gate 181/181, test:unit 153/153, conformance 104/104, purity:check and release:check green.
• Risk: Low to moderate — trust-gate/lock fixes are additive and fail-closed; the capability-table split is proven behaviorally byte-identical. Zero new runtime dependencies.

---

Provenance & audit

• Reviewed commit: a9a78134c972
• Independent reviewer verdict (committed): .cw-release/review-a9a78134c9729c4514dcb7a4a8fc56f5d1a93b57.verdict
• Full diff: v0.2.1...v0.2.2
• npm (provenance-attested): cool-workflow@0.2.2

Released through the gated flow: deterministic gate → independent release-reviewer (verdict above) → provenance-attested npm publish.

v0.2.1

What's Changed

• docs: archive v2 rebuild planning docs under docs/rebuild/ by @coo1white in #337
• chore(v2): remove the dead pre-cutover v2 package by @coo1white in #338
• fix: close queue.json and triggers.json lost-update races by @coo1white in #339
• docs: replace stale git-push publish example in RELEASE.md by @coo1white in #340
• feat: surface cw metrics summary's existing 50-run default via --limit by @coo1white in #341
• refactor: move routine.fire's payload-path read out of capability-table.ts by @coo1white in #342
• fix: Workbench UI root resolution + opt-in --require-token fail-closed by @coo1white in #343
• feat: add sandbox-enforceability doctor check + agent-env audit trail by @coo1white in #345
• docs: fix stale claim that cw --help isn't implemented by @coo1white in #344
• docs: make the CHANGELOG's v0.2.0 entry concise by @coo1white in #346
• Surface real agent-hop failures + make architecture-review question-aware by @coo1white in #347
• Forward USER to the agent backend's real spawned child by @coo1white in #348
• Close the duplicate USER-forwarding gap in the concurrent batch path by @coo1white in #349
• Generalize the shared result contract + onboarding examples beyond risk audit by @coo1white in #350
• release(v0.2.1): bump 0.2.0 -> 0.2.1 by @coo1white in #351
• docs: finish diversifying the remaining risk-only example questions by @coo1white in #352

Full Changelog: v0.2.0...v0.2.1

v0.2.0

You can now run ~50 verbs that were MCP-only — cw schedule|routine|queue|sched, cw run export|import|restore, cw gc run, cw registry show, and the multi-agent read verbs — straight from the cw CLI, on a from-scratch-rebuilt runtime whose external behavior is proven byte-for-byte unchanged by a 101-case conformance suite that passes on both the old and the new build.

• Capability: Cool Workflow's runtime is a from-scratch rebuild, cut over as the shipping product with byte-identical external behavior (a 101-case conformance suite holds 101/101 throughout). ~50 CLI verbs that were previously MCP-only — cw schedule|routine|queue|sched, cw run export|import|restore, cw gc run, cw registry show, and the multi-agent read verbs — are now on the CLI too.
• Implementation: A pure core/ (no IO) + impure shell/ (all IO) split, with one capability table driving both CLI and MCP dispatch, so a verb and its MCP peer can never drift. Two real bugs surfaced and were fixed: cw review policy silently dropped its CLI flags, and cw quickstart --bundle didn't fail closed on a bad bundle seal.
• Tests: 173/173 white-box smokes, 101/101 black-box conformance (held throughout the rebuild), 13/13 release gate, green CI on Node 18/22 × x86_64/ARM64.
• Risk: Higher-touch than usual (the whole runtime was rebuilt) but tightly gated — public CLI/MCP surface, --json, signing, and state format are all unchanged. Zero new runtime dependencies.

---

Provenance & audit

• Reviewed commit: c974dd8d61e7
• Independent reviewer verdict (committed): .cw-release/review-c974dd8d61e7a69e5aace07e768200ff4835b830.verdict
• Full diff: v0.1.98...v0.2.0
• npm (provenance-attested): cool-workflow@0.2.0

Released through the gated flow: deterministic gate → independent release-reviewer (verdict above) → provenance-attested npm publish.

v0.1.98

Two agents scoped to separate repos that share no filesystem can now hand each other a change proposal or review verdict as digest-sealed JSON and verify/apply/list it fail-closed via cw ledger on both the CLI and MCP.

• Capability: A new cw ledger verb lets two agents scoped to two separate repos — running as two separate sessions that share no filesystem — hand each other a change proposal or a review verdict as verifiable data, not chat. cw ledger propose / review print a self-contained JSON entry sealed with a sha256 content digest; cw ledger verify and cw ledger list --dir <d> check them fail-closed (a tampered, malformed, or unreadable entry exits non-zero), so cw ledger verify <file> && open-pr can never proceed on a lie. The exchange rides on any shared git host — GitHub or a self-hosted Gitea — because the kernel holds no git logic: writing is cw ledger propose > ledger/<id>.json plus your own git add/commit/push. --dir is repeatable, so cw ledger list --dir a --dir b … union-verifies several mirror directories (e.g. a GitHub clone plus Gitea mirrors in other regions) into ONE fail-closed inbox for redundancy/reachability. Every verb is on both the CLI and MCP (cw_ledger_propose|review|verify|list), so an agent can mint and check entries in-process.
• Implementation: New zero-dependency kernel module src/ledger.ts (only node:crypto): buildLedgerProposal/buildLedgerReview seal an entry with a digest over the key-sorted canonical JSON of every field except id/digest; the id is content-addressed (ldg- + the first 16 hex of the digest) and bound to the content — verifyLedgerEntry requires id === deriveId(digest) and fails closed with ledger-id-mismatch otherwise, so a spoofed or absent id cannot slip a forgery through the union's id-keyed de-duplication. unionLedgerEntries(dirs) de-dupes verified entries by that content-addressed id and sets allOk:false if any entry in any mirror fails. CLI handler src/cli/handlers/ledger.ts dispatches propose|review|verify|list (verify reads --file/stdin; a single --dir keeps byte-identical single-directory output, 2+ take the union shape — POLA); MCP routes the four cw_ledger_* tools through the same core (mcp/tool-call.ts + tool-definitions.ts), registered payloadIdentical:false (the entries are non-deterministic mints / directory reads). git stays entirely in userland. Man pages docs/cross-agent-ledger.7.md + operator runbook docs/handoff-setup.md (GitHub-vs-Gitea trade-off), design note docs/designs/handoff-ledger.md.
• Tests: New ledger-verify-smoke proves the propose/review round-trip; that a content-tampered entry, non-JSON bytes, a truncated entry, a forged-id and an id-less entry each exit 1 with the matching fail-closed code; --file + stdin transports; the git-transport inbox; the multi-mirror union (dedup across mirrors, single---dir POLA shape, a tampered mirror failing the whole batch, and a spoofed-id forgery unable to mask a legit entry). The two id-binding defects were found by an adversarial review of the union and fixed before merge. Verified end-to-end against a real private GitHub handoff repo (propose → push → list → allOk:true). build, check, parity:check, index:check, gen:manifests --check, dist:check, parity-doc-sync-smoke, mcp-tool-call-coverage-smoke all green.
• Risk: Low. cw ledger is a brand-new opt-in verb; no existing output, flag, exit code, or file layout changed (a single --dir is byte-identical to a plain single-directory listing, and cw handoff — an unrelated run/task ownership-transfer primitive — is untouched). Zero new runtime dependencies. The id-binding check is a fail-closed hardening. The cw:result / --json machine surfaces, signing, and the multi-agent red line are unchanged.

---

Provenance & audit

• Reviewed commit: c54b492485d7
• Independent reviewer verdict (committed): .cw-release/review-c54b492485d7032c370c0ec6ce046029c505a141.verdict
• Full diff: v0.1.97...v0.1.98
• npm (provenance-attested): cool-workflow@0.1.98

Released through the gated flow: deterministic gate → independent release-reviewer (verdict above) → provenance-attested npm publish.