main

文件	最后提交记录	最后更新时间
src	fix(workflow-js): let task() start a writer without a declared scope task() refused a write-capable task (writeAuthority workspace_write/ worktree_write, or an implementer/builder/general/profile identity) unless it declared writeRoots, exactFiles or coordinationContracts, citing a refusal at the spawn boundary that no longer exists: the spawn boundary (`validate_spawn_write_contract`) claims the task's deliverables, or else the workspace root, exactly as for a plain Agent spawn. Both admission checks are removed, so `task({prompt, type: 'implementer'})` works like the Agent tool and Claude Code's Workflow `agent({prompt})`. Kept in the same function: read-only roles cannot declare write authority, worktree_write requires worktree: true, contradictory role/type identities are refused, and declared scopes are still normalized (no absolute paths, no `..`). The per-write claim check, ledger overlap refusal, shared- checkout peer gate and sandbox are unchanged; parallel scopeless writers now fail at spawn with the ledger's "claim disjoint sibling write_roots" contention error instead of at admission. docs/AUTOMATIC_WORKFLOWS.md states the new rule. Tests: codewhale-workflow-js --test vm_tests 79 passed, 0 failed (run with CODEWHALE_BUILD_LOCK=0 because build-lock.py could not write its lock file on the full volume); workflow-js --lib 12 passed; codewhale-localization 50 passed. task_write_authority_requires_bounded_coordination_scope is inverted into scopeless_write_tasks_dispatch_and_leave_scope_to_the_spawn_ boundary, and the no-scope cases leave the old fail-closed test, now task_read_only_roles_reject_write_escalation. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R9rJEoMuUSRWznU6QjkE7h	15 小时前
tests	fix(workflow-js): let task() start a writer without a declared scope task() refused a write-capable task (writeAuthority workspace_write/ worktree_write, or an implementer/builder/general/profile identity) unless it declared writeRoots, exactFiles or coordinationContracts, citing a refusal at the spawn boundary that no longer exists: the spawn boundary (`validate_spawn_write_contract`) claims the task's deliverables, or else the workspace root, exactly as for a plain Agent spawn. Both admission checks are removed, so `task({prompt, type: 'implementer'})` works like the Agent tool and Claude Code's Workflow `agent({prompt})`. Kept in the same function: read-only roles cannot declare write authority, worktree_write requires worktree: true, contradictory role/type identities are refused, and declared scopes are still normalized (no absolute paths, no `..`). The per-write claim check, ledger overlap refusal, shared- checkout peer gate and sandbox are unchanged; parallel scopeless writers now fail at spawn with the ledger's "claim disjoint sibling write_roots" contention error instead of at admission. docs/AUTOMATIC_WORKFLOWS.md states the new rule. Tests: codewhale-workflow-js --test vm_tests 79 passed, 0 failed (run with CODEWHALE_BUILD_LOCK=0 because build-lock.py could not write its lock file on the full volume); workflow-js --lib 12 passed; codewhale-localization 50 passed. task_write_authority_requires_bounded_coordination_scope is inverted into scopeless_write_tasks_dispatch_and_leave_scope_to_the_spawn_ boundary, and the no-scope cases leave the old fail-closed test, now task_read_only_roles_reject_write_escalation. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R9rJEoMuUSRWznU6QjkE7h	15 小时前
Cargo.toml	chore(lint): record CI -Dwarnings in [workspace.lints] The repo already treats rustc warnings as errors: every CI workflow sets `RUSTFLAGS: -Dwarnings`. That policy lived only in YAML, so a local `cargo check` without extra flags did not match the gate, and there was no `[workspace.lints]` table for member crates to inherit. This records the existing policy, not a new one: [workspace.lints.rust] warnings = "deny" Every workspace member now has `[lints] workspace = true`. No clippy lints are listed: CONTRIBUTING.md's `-A clippy::*` allow list and .cnb.yml's stricter `clippy -- -D warnings` would disagree, and adding either would change a lane rather than document it. Verified: cargo check --workspace --all-targets with RUSTFLAGS=-Dwarnings; cargo check -p codewhale-tui --lib --tests without RUSTFLAGS (the new table is enough to deny). Implemented with agent assistance. Signed-off-by: Hunter Bown <hmbown@gmail.com>	1 个月前