Add safe role-based workflow launch

.github/workflows/ci.yml

@@ -25,10 +25,10 @@ jobs:
       - run: npm run build:dist
       - name: Verify reproducible distribution
         run: |
-          shasum -a 256 $(git ls-files dist) > /tmp/dist-before.sha256
+          node scripts/verify-release-artifacts.mjs dist-manifest dist /tmp/dist-before.tsv
           npm run build:dist
-          shasum -a 256 $(git ls-files dist) > /tmp/dist-after.sha256
-          diff /tmp/dist-before.sha256 /tmp/dist-after.sha256
+          node scripts/verify-release-artifacts.mjs dist-manifest dist /tmp/dist-after.tsv
+          diff /tmp/dist-before.tsv /tmp/dist-after.tsv
       - name: Verify Git-installable package includes workflow distribution
         run: |
           npm pack --dry-run --json --ignore-scripts > package-manifest.json
@@ -52,35 +52,4 @@ jobs:
       - name: Install exact commit in isolated prefix
         shell: bash
         run: |
-          set -euo pipefail
-          SANDBOX="$(mktemp -d)"
-          REAL_HOME="$HOME"
-          REAL_PREFIX="$(npm prefix -g)"
-          BEFORE_PROFILES="$(for f in .zshrc .bashrc .bash_profile .profile; do test -e "$REAL_HOME/$f" && shasum -a 256 "$REAL_HOME/$f" || true; done)"
-          snapshot_tree() { node --input-type=module -e 'import fs from "node:fs"; import path from "node:path"; import crypto from "node:crypto"; const root=process.argv[1]; const rows=[]; function walk(p){for(const name of fs.readdirSync(p).sort()){const f=path.join(p,name); const s=fs.lstatSync(f); const rel=path.relative(root,f); if(s.isDirectory()){rows.push(`d ${rel} ${s.mode}`); walk(f);} else if(s.isSymbolicLink()) rows.push(`l ${rel} ${fs.readlinkSync(f)}`); else rows.push(`f ${rel} ${s.mode} ${s.size} ${crypto.createHash("sha256").update(fs.readFileSync(f)).digest("hex")}`);}} walk(root); process.stdout.write(rows.join("\n"));' "$1"; }
-          snapshot_optional() { test -e "$1" && snapshot_tree "$1" || true; }
-          BEFORE_PREFIX="$(snapshot_tree "$REAL_PREFIX")"
-          BEFORE_CLAUDE="$(snapshot_optional "$REAL_HOME/.claude")"
-          BEFORE_CODEX="$(snapshot_optional "$REAL_HOME/.codex")"
-          export HOME="$SANDBOX/home"
-          export XDG_CONFIG_HOME="$SANDBOX/xdg-config"
-          export XDG_CACHE_HOME="$SANDBOX/xdg-cache"
-          export NPM_CONFIG_CACHE="$SANDBOX/npm-cache"
-          export NPM_CONFIG_USERCONFIG="$SANDBOX/npmrc"
-          TEMP_PREFIX="$SANDBOX/prefix"
-          mkdir -p "$HOME" "$XDG_CONFIG_HOME" "$XDG_CACHE_HOME" "$TEMP_PREFIX" "$NPM_CONFIG_CACHE"
-          npm install -g "git+https://github.com/Thibault1818/ORCH.git#$GITHUB_SHA" --prefix "$TEMP_PREFIX"
-          export PATH="$TEMP_PREFIX/bin:$PATH"
-          orch --version
-          orch --help
-          orch init "$SANDBOX/project" --adapter codex
-          (cd "$SANDBOX/project" && orch workflow --help)
-          (cd "$SANDBOX/project" && orch workflow doctor)
-          orch setup
-          test ! -e "$HOME/.claude"
-          test ! -e "$HOME/.codex"
-          test "$BEFORE_PROFILES" = "$(for f in .zshrc .bashrc .bash_profile .profile; do test -e "$REAL_HOME/$f" && shasum -a 256 "$REAL_HOME/$f" || true; done)"
-          test "$BEFORE_PREFIX" = "$(snapshot_tree "$REAL_PREFIX")"
-          test "$BEFORE_CLAUDE" = "$(snapshot_optional "$REAL_HOME/.claude")"
-          test "$BEFORE_CODEX" = "$(snapshot_optional "$REAL_HOME/.codex")"
-          rm -rf "$SANDBOX"
+          bash scripts/ci-git-install.sh

.gitignore

@@ -10,8 +10,11 @@ node_modules/
 # Test coverage
 coverage/
 
-# Internal docs
+# Internal docs except the release procedure
 docs/
+!docs/
+docs/*
+!docs/RELEASING.md
 
 # Landing pages
 landing/
@@ -41,5 +44,4 @@ npm-debug.log*
 .playwright-mcp
 archive
 
-docs
 .env.local

CHANGELOG.md

@@ -3,12 +3,26 @@
 All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Plan3
+
+### Changed
+
+- Reframed the dedicated workflow around Supervisor, Implementer, optional Adviser, and Reviewer roles, with an immutable launch roster and audited binding rotation only at a paused boundary.
+- Added check discovery and the TTY launch wizard, launch summaries, project/global presets, direct mode, and an adaptive default that uses no Adviser with a zero call cap.
+- Expanded `workflow doctor` and status output with capability reasons, roster revisions, role usage, Adviser budget, checks, and blockers.
+
+### Security
+
+- Workflow launch validates a meaningful trusted check before any LLM invocation; noninteractive launch requires an explicit acceptance path such as `--yes --check "npm run test"`.
+- Every enabled workflow role receives prompts through stdin. Grok and Antigravity remain disabled and fail closed because secure stdin prompt transport is unproven.
+- Native resume remains opt-in pending an end-to-end continuation probe; the default is a durable passport handoff.
+
 ## 1.1.0-th.1 (2026-08-03)
 
 ### Added
 
-- Recoverable direct Codex-Opus workflow with strict phase-valid actions, compact versioned passports, immutable artifacts, invocation receipts, native continuation detection, and audited passport handoffs.
-- Adaptive and direct modes. Adaptive permits at most one stateless, low-authority Fable consultation; direct prohibits Fable completely.
+- Recoverable dedicated workflow with strict phase-valid wire actions, compact versioned passports, immutable artifacts, invocation receipts, native continuation detection, and audited passport handoffs.
+- Adaptive and direct modes. Adaptive can permit one stateless, low-authority Adviser consultation when configured; direct prohibits an Adviser completely.
 - Safe `orch setup`, workflow doctor/status/log/artifact commands, explicit session rotation, hard Fable call caps, role-specific execution profiles, and per-role usage accounting.
 - Fake Claude/Codex executable tests, restart reconciliation tests, real Git worktree and stale-evidence tests, and exact-SHA installation CI on macOS/Linux with Node 20/24.
 - Journaled passport updates, monotonic workflow revisions, idempotent worktree preparation, and durable check/merge receipts that prevent duplicate side effects after restart.

IMPLEMENTATION_STATUS.md

@@ -2,20 +2,32 @@
 
 ## Architecture
 
-ORCH uses layered domain, application, infrastructure, and CLI/TUI modules. The dedicated workflow domain persists strict contracts, bounded versioned passports, session modes, usage, immutable artifacts, and events under `.orchestry/workflows/`. `WorkflowEngine` coordinates injected Codex, Fable, Opus, and Git ports independently from the generic goal state machine.
+ORCH uses layered domain, application, infrastructure, and CLI/TUI modules. The dedicated workflow domain persists strict contracts, bounded versioned passports, semantic-role rosters, session modes, usage, immutable artifacts, and events in controller-owned external state. `WorkflowEngine` coordinates Supervisor, Implementer, optional Adviser, Reviewer, and Git ports independently from the generic goal state machine. Legacy Codex/Fable/Opus phase and action identifiers remain in schema-v2 wire state for compatibility.
+
+The multi-provider branch adds a workflow-driver registry and a separate schema-v3 governance evidence layer. Governance v3 stores immutable binding snapshots, decomposition DAGs, exact candidate evidence, check bindings, independent review votes, quorum results, integration receipts, and human approvals. The generic orchestrator remains the parallel task scheduler. Executable tasks use isolated, no-hardlink Git clones outside the repository; shared workspace execution is rejected because it cannot defer changes for approval.
 
 ## Security Baseline
 
-Dangerous permission bypass and shell execution are disabled by default and require config plus `ORCHESTRY_ALLOW_DANGEROUS_EXECUTION=1`. Prompt transport, restricted child environments, redaction, no-persistence defaults, path/symlink checks, lifecycle-free installation, private package metadata, and absence of background npm installs are protected by `test/security/security-regression.test.ts`.
+All production subprocesses route through `CommandRunner`; only `ProcessManager` calls Node's process API. Executables resolve to canonical paths with SHA-256 descriptors and are verified before and after execution. Agent and check commands run under a deny-default macOS `sandbox-exec` profile. The profile limits writes to the isolated clone, permits only explicitly hashed executables, denies direct network access, and exposes an HTTP CONNECT proxy that allows only explicit model endpoints. Configure endpoint additions as comma-separated `host:port` values in `ORCHESTRY_MODEL_ENDPOINTS`; additional executable paths use `ORCHESTRY_EXECUTABLE_ALLOWLIST` with the platform path delimiter.
+
+Git uses isolated HOME/XDG configuration and disables system/global config, hooks, filters, fsmonitor, credential helpers, SSH helpers, external diff/text conversion, custom clone helpers, submodule checkout, and interactive prompts. Repository filter attributes are rejected before checkout. Workflow and generic task state live under a project-hash-specific external controller directory; isolated clones use a separate external root. Exact committed clone revisions are imported through temporary refs before merge.
+
+Model review cannot merge. Generic tasks remain in `review` after sandboxed checks and preserve exact base, commit, diff, path, and target evidence; only explicit CLI/TUI approval can recheck and merge that evidence. Schema-v2 workflows stop at `awaiting_approval`; `orch workflow approve` requires an interactive exact-commit challenge and persists approval bound to the target branch, base commit, reviewed commit, diff hash, and check artifact hash. Approval and merge require owner-tagged process groups to be terminated. Real-project execution requires a fresh, controller-HMAC-signed `orch workflow doctor` attestation bound to the current endpoint, executable, and sandbox policy. Schema-v3 records are controller-HMAC-authenticated; governed merges recompute candidate and integration Git evidence, require exact candidate composition and human approval, and update the target ref by compare-and-swap from the recorded base commit.
 
 ## Verification
 
-The workflow uses a schema-v2 direct Codex -> Opus -> Codex state machine. Deterministic fake adapters cover adaptive zero-Fable execution, direct mode, one optional advisory consultation, persisted fallback routing, direct correction cycles, phase-valid actions, monotonic revisions, journal recovery, completed-effect replay, ambiguous-effect blocking, stale commit/diff rejection, deterministic checks, and fail-closed merging. Native-boundary tests verify role-specific argv and stdin-only prompt transport. Legacy schema-v1 jobs remain inspectable but are blocked from unsafe resume. CI runs exact-commit Git installation in isolated prefixes on macOS and Linux with Node 20 and 24.
+The final local verification passed typecheck, 2,192 tests with 2 skipped, distribution build, zero dependency vulnerabilities, `git diff --check`, real Git clone/import integration tests, governance race tests, migration recovery tests, durable cross-process ownership tests, and real macOS adversarial sandbox tests. The adversarial suite verifies filesystem escape denial, direct-network denial, unpinned executable denial, process persistence cleanup, active-process approval blocking, policy drift, and signed-attestation forgery rejection. No paid model call was made.
+
+The real local doctor detects OpenCode 1.18.16 as compatible with the Implementer role. Codex, Claude, Grok, and Antigravity are not installed on this host and remain unavailable. No Ollama provider/model is currently visible through OpenCode.
 
 ## Upstream Reconciliation
 
 The fork and upstream were fetched and compared before implementation. Changes restoring Cursor `--yolo`, shell convenience defaults, npm publishing, and other unsafe execution behavior were rejected. The later Pi terminal-failure fix was reviewed as safe but deferred because it is unrelated to this pipeline and changes a large adapter surface; no wholesale upstream merge was performed.
 
-## Limitation
+## Limitations
+
+Native resume remains disabled until an installed CLI passes a documented end-to-end continuation probe. Grok Build cannot be enabled until the real Grok CLI proves stdin-only prompt transport and structured completion. Local models remain `transport_only` until tool use, context, reliability, resource use, and locality are behaviorally qualified.
+
+Real-project mode currently requires macOS because `sandbox-exec` is the implemented containment backend. It fails closed on Linux and Windows until equivalent platform backends are implemented. Endpoint allowlisting uses a loopback controller proxy because macOS sandbox profiles cannot safely express dynamic DNS hostnames. Provider credentials still need to be supplied through each CLI's supported authenticated environment; the proxy does not store credentials.
 
-Native resume remains disabled until an installed CLI passes a documented end-to-end continuation probe. `orch workflow doctor` reports detected versions/options and identifies `passport_handoff` honestly. Model invocations, checks, and merge attempts use durable receipts; ambiguous external effects block permanently rather than risk duplication. `start` runs autonomously in the foreground after printing the recoverable job ID.
+The schema-v3 governance services and exact merge path are implemented and exported, but automatic materialization of a decomposition plan into parallel generic ORCH tasks and automatic collection of their branches into v3 candidate records is not yet wired into a single end-user CLI command. Until that scheduler bridge is implemented, use generic ORCH teams/tasks for parallel execution and the existing schema-v2 workflow for the fully automated single-Implementer path.

SECURITY.md

@@ -13,7 +13,9 @@ npm install -g "git+https://github.com/Thibault1818/ORCH.git#$AUDITED_COMMIT_SHA
 
 - Permission bypass and the shell adapter default to disabled.
 - Dangerous execution requires both the corresponding config flag and `ORCHESTRY_ALLOW_DANGEROUS_EXECUTION=1`.
-- Prompts are sent over stdin where supported, excluded from child environments, and not persisted by default.
+- Every enabled dedicated-workflow prompt is sent over stdin, excluded from child environments, and not persisted by default. Argv prompt transport is prohibited.
+- Grok and Antigravity workflow bindings are disabled and fail closed because secure stdin prompt transport has not been proven; installation or `--help` output alone does not establish compatibility.
+- Workflow start discovers or validates a meaningful trusted check before configuration can reach the engine. No Supervisor, Implementer, Adviser, or Reviewer LLM invocation occurs before that validation succeeds.
 - Child environments are allowlisted; persisted data and terminal output are redacted.
 - Worktree isolation, path containment, identifier validation, and symlink checks protect local state.
 - Installation has no consumer lifecycle script and never modifies user configuration.
@@ -22,6 +24,8 @@ npm install -g "git+https://github.com/Thibault1818/ORCH.git#$AUDITED_COMMIT_SHA
 
 These invariants are enforced by `test/security/security-regression.test.ts` and CI.
 
+`orch workflow doctor` reports transport and per-role capability reasons rather than inferring safety from a fake CLI or advertised flags. Native resume is a separate limitation: advertised resume support remains disabled unless the installed CLI passes an end-to-end continuation probe and `ORCHESTRY_ENABLE_NATIVE_RESUME=1` is set; otherwise workflows use `passport_handoff`.
+
 ## Reporting
 
 Do not open a public issue for a vulnerability. Use the fork's [private security advisory form](https://github.com/Thibault1818/ORCH/security/advisories/new) and include impact, reproduction steps, affected commit, OS, and Node.js version.