chore: restore workflow task reports

.superpowers/sdd/task-2-report.md

@@ -0,0 +1,92 @@
+# Task 2 Report
+
+## Scope
+
+Implemented fail-closed contract and `$ref` validation for
+`wf_contract_manifest.manifest_from_openrpc()` without changing the Task 1
+public interface. JSON Schema keywords remain opaque; validation is limited to
+the OpenRPC envelope, normalized operation/component values, and their `$ref`
+graph.
+
+## TDD Evidence
+
+- Added tests for unsupported OpenRPC versions, malformed envelopes, duplicate
+  methods, malformed dotted names, invalid parameters, invalid result shapes,
+  and non-component success results.
+- Added tests for external, unsupported-local, unsupported-component,
+  dangling, and escaped component references.
+- Added a passing nested schema reference case while retaining the existing
+  error-component reference assertion.
+- Ran the new tests before implementation: 10 cases failed for the intended
+  missing validation behaviors; existing Task 1 coverage remained green.
+
+## Implementation
+
+- Pins `$.openrpc` to `1.2.6`.
+- Rejects duplicate method names at the later method path.
+- Uses the strict `malformed dotted method name` diagnostic.
+- Requires success results to be exactly a local `components/schemas` `$ref`
+  object.
+- Walks every operation parameter/result/error and every normalized component,
+  recursively inspecting only `$ref` values.
+- Rejects external refs, unsupported namespaces, escaped component keys, and
+  dangling refs; forward refs are accepted after the complete manifest is
+  assembled.
+
+## Verification
+
+```text
+39 passed in 0.10s
+ruff check: All checks passed!
+basedpyright --level error: 0 errors, 0 warnings, 0 notes
+git diff --check: passed (only Git line-ending warnings)
+```
+
+## Commit
+
+The Task 2 commit is recorded by the final response after the final verification
+and scope audit.
+
+## Concerns
+
+None identified.
+
+## Task 2 Review Fixes
+
+### Findings Addressed
+
+1. Reference validation now runs against operations in original source order,
+   and reports `$.methods[index]...` paths before deterministic lexical sorting.
+   A regression test uses the source order `workflow.zeta.run`, then
+   `workflow.alpha.inspect`, and asserts the exact later ref path.
+2. Success result validation now checks raw mapping keys before `_schema()`
+   removes `title`, so a valid `$ref` plus an extra `title` is rejected.
+3. The malformed-contract mutation table now uses the typed
+   `DocumentMutation` Protocol instead of an `Any` mutation annotation.
+
+### TDD Evidence
+
+- Review regression tests were run before implementation: 2 failed as
+  intended, one for the title-stripping acceptance and one for the sorted
+  operation path.
+- After implementation, all 41 focused normalization tests passed.
+
+### Fix Verification
+
+```text
+.venv\Scripts\python.exe -m pytest tests\wf_contract_manifest\test_normalize.py -n 0 -q
+41 passed in 0.13s
+
+.venv\Scripts\ruff.exe check src\wf_contract_manifest tests\wf_contract_manifest
+All checks passed!
+
+.venv\Scripts\basedpyright.exe --level error src\wf_contract_manifest tests\wf_contract_manifest
+0 errors, 0 warnings, 0 notes
+
+git diff --check
+passed (only Git line-ending warnings)
+```
+
+### Fix Concerns
+
+None identified.

.superpowers/sdd/task-4-report.md

@@ -0,0 +1,43 @@
+# Task 4 Report
+
+## Scope
+
+Implemented the workflow contract manifest module CLI and checked in the manifest artifact required by Task 4.
+
+Created:
+
+- `src/wf_contract_manifest/__main__.py`
+- `tests/wf_contract_manifest/test_cli.py`
+- `contracts/workflow-api.manifest.json`, generated by `python -m wf_contract_manifest write`
+
+The CLI supports only the module commands `write` and `check`; no project script was added.
+
+## TDD Evidence
+
+The CLI tests were written before the production module. The required RED run failed during collection with:
+
+`ModuleNotFoundError: No module named 'wf_contract_manifest.__main__'`
+
+After implementing the module CLI, the CLI test file passed with `3 passed`.
+
+## Verification
+
+- CLI tests: `3 passed`
+- All manifest tests: `51 passed`
+- Ruff: `All checks passed!`
+- basedpyright: `0 errors, 0 warnings, 0 notes`
+- `git diff --check`: passed
+- Module generation: wrote `contracts/workflow-api.manifest.json`
+- Module drift check: checked the generated manifest successfully
+- Independent bounded JSON assertions:
+  - operations: `70`
+  - component schemas: `126`
+  - component errors: `1`
+  - first method: `workflow.admin.auth.delete`
+  - last method: `workflow.sources.list`
+
+## Review And Concerns
+
+The CLI follows the exact Task 4 interface and catches the manifest, drift, and value errors specified by the brief. The generated JSON was not hand-edited. No Task 4 concerns remain.
+
+The worktree contained a pre-existing staged deletion of `.superpowers/sdd/task-2-report.md`; it was preserved and excluded from the Task 4 staging set.

.superpowers/sdd/task-5-report.md

@@ -0,0 +1,45 @@
+# Task 5 Report
+
+## Scope
+
+Added the committed workflow contract manifest drift gate, updated the live
+contract documentation, and archived the active workflow contract manifest
+implementation plan after verification.
+
+## TDD Evidence
+
+The committed-manifest test was added before the drift demonstration. The
+required PowerShell `try/finally` run appended one byte to
+`contracts/workflow-api.manifest.json`; pytest failed with
+`ManifestDriftError` and the guidance to run
+`python -m wf_contract_manifest write`. The `finally` block restored the exact
+original bytes, and an explicit byte comparison passed.
+
+The restored drift gate then passed with `1 passed`.
+
+## Changes
+
+- Added `tests/wf_contract_manifest/test_committed_manifest.py`.
+- Documented the checked transport-neutral inventory, drift command, authored
+  authorization/metadata/Effect boundaries, and next TypeScript parity slice in
+  `ISSUES.md`.
+- Added the manifest package and module commands to `docs/project_map.md`.
+- Added the completed manifest milestone and honest next-slice statement to
+  `docs/current_roadmap.md`.
+- Archived the plan at
+  `docs/historical/superpowers/plans/2026-08-01-workflow-contract-manifest.md`.
+
+## Verification
+
+- Scoped manifest and OpenRPC tests: `117 passed`.
+- `python -m wf_contract_manifest check`: passed without rewriting the artifact.
+- Ruff: `All checks passed!`
+- basedpyright: `0 errors, 0 warnings, 0 notes`.
+- `git diff --check`: passed; Git emitted only LF/CRLF inspection warnings.
+
+## Concerns
+
+The independent two-axis final review was intentionally not run. The
+controller is expected to dispatch it after the Task 5 commit. TypeScript
+parity, browser authorization, operation metadata, and Effect implementation
+boundaries were not modified.