v0.2.4

A crashed or interrupted drive run now recovers cleanly — a mid-spawn SIGKILL no longer loses the round's dispatched work, the interrupt prints the exact cw run resume <id> --drive command, and cw gc reclaims superseded commit snapshots — while untrusted workflow-app code and an operator's env.deny are now enforced fail-closed.

• Capability: A trust-and-recovery hardening release, driven by an architecture self-review (1 P1 + 5 P2, PRs #432–#437). Workflow-app code outside CW's trusted roots is now blocked fail-closed (CW_ALLOW_EXTERNAL_APP_CODE=1 to opt in), and an appId can no longer path-traverse out of the apps root. env.deny is the final word for a spawned agent child — it beats inherit:true and the provider-key/USER re-add. A concurrent drive round's dispatch now survives a mid-batch SIGKILL. cw gc can reclaim superseded commit snapshots (--keep-commits to opt out; a reclaimed run downgrades to verify-only). An interrupted drive prints the literal cw run resume <id> --drive command, and resume honors --repo from any directory. Also: a one-command release (npm run release -- X.Y.Z — fail-fast preflight, tag-only push, resume on re-run), all 7 CodeQL alerts cleared, and 10 of 11 baselined core/shell layer waivers removed.
• Implementation: The trust gate and traversal bound live in shell/workflow-app-loader.ts; buildChildEnv/buildAgentChildEnv apply env.deny last; prepareConcurrentOutcomes saves one durable checkpoint before its batch spawns; shell/reclamation-io.ts gains a third freeable kind (commit-snapshot) with the dangling-reference proof extended to cover it; the pure arg-coercion helpers moved from cli/io.ts to core/util/cli-args.ts so wiring/ no longer imports cli/. Each fix went through a design-critique pass before implementation and an adversarial-review pass after.
• Tests: conformance 106/106, unit 161/161, full smoke suite 204/204. Every fix was proven red on the pre-fix build (real SIGKILL, real spawned children, real signals — via git stash) and green after.
• Risk: Low to moderate — the new gates are fail-closed and opt-out-able; one intentional behavior change (default gc run on an eligible run now also frees superseded commit snapshots; use --keep-commits for the old behavior). No schema or --json shape changed. Zero new runtime dependencies.

---

Provenance & audit

• Reviewed commit: b050147ace26
• Independent reviewer verdict (committed): .cw-release/review-b050147ace2675c8d714847591283d59352d3900.verdict
• Full diff: v0.2.3...v0.2.4
• npm (provenance-attested): cool-workflow@0.2.4

Released through the gated flow: deterministic gate → independent release-reviewer (verdict above) → provenance-attested npm publish.