docs: refresh README and repository metadata

.agents/work.toml

@@ -1,26 +1,24 @@
 version = 1
 
 [[step]]
-id = "enforce-attribution-messages"
+id = "refresh-readme-metadata"
 status = "complete"
 blocked_by = []
 user_problem = """
-The complete-history gate rejects foreign authors and Co-Authored-By lines, but other generated attribution footers can pass. Pull-request titles and bodies rely only on guidance.
+The README, Cargo package metadata, and GitHub description still name the former repository or describe the removed plan-heavy default. Readers cannot tell which workflow agent-flow now scaffolds or where execution isolation comes from.
 """
 change = """
-Use one structural attribution policy for commit messages and pull-request metadata. Reject attribution trailers and known generated footer forms without banning ordinary discussion of agent tools.
+Make the README and package metadata describe the current repository and bounded default workflow. State that role separation is a workflow rule and that the external harness supplies process and filesystem isolation. Prepare one concise GitHub description that matches the reviewed documentation.
 """
 acceptance = [
-  "The exact raw author allowlist, complete-history scan, shallow-history refusal and every Co-Authored-By rejection remain unchanged.",
-  "One deterministic classifier rejects structural attribution trailers and known generated footer forms for Claude, GPT or Codex, Gemini and Copilot.",
-  "The same classifier checks reachable commit messages and pull-request titles and bodies.",
-  "Pull-request metadata is parsed from the GitHub event file without shell evaluation, and a missing or malformed event fails when the check expects a pull request.",
-  "A pull-request title or body edit triggers the required quality workflow again.",
-  "Normal technical discussion of model names and attribution detection remains valid when it is not itself an attribution line.",
-  "Failures name the commit or pull-request field and the broken rule without echoing untrusted message content.",
-  "Scratch cases prove Claude, GPT or Codex, Gemini and Copilot forms, safe mentions, event parsing, push behaviour and the existing history rules.",
-  "The shared just ci gate, protected quality job, existing reset checks and complete-history attribution check pass.",
+  "The README uses the current repository URL, clone directory, badge links, and issue route.",
+  "The README removes the temporary rename section and points durable rename history to the changelog.",
+  "The README describes the bounded default workflow and separates logical roles from harness-supplied execution isolation.",
+  "The Cargo package repository and description match the current product and repository.",
+  "The changelog does not depend on a removed README section for current rename information.",
+  "The GitHub repository description matches the reviewed product description.",
+  "The required repository checks pass without unrelated documentation changes.",
 ]
 why_next = """
-The repository history is correct, but deterministic prevention must cover the message surfaces that current guidance alone cannot enforce.
+The repository rename is complete, but the primary documentation and metadata still send readers to the former name and describe removed defaults. Correct them before the historical intent audit uses current documentation as product evidence.
 """

CHANGELOG.md

@@ -12,6 +12,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bounded `next` reads that work file directly, deterministically lists all active units, and emits one selected action without legacy ledger or resume prose. An all-complete file may omit `selected_action` and yields an explicit completed result.
 - Bounded `validate` and `status` now check and project the real work state, including closed statuses, dependencies, size and step limits, selected-action rules, and the all-complete terminal state; self-authored review records do not affect the result.
 - Existing plan, metrics, workflow, render, resume, audit, custom-pack, and checks interfaces remain available through their explicit legacy or opt-in paths; projects without `.agents/work.toml` retain the legacy fallback.
+- The README and the Cargo package metadata name the current repository, <https://github.com/nothingnesses/agent-flow>. The badge, the badge link, the clone commands, the `repository` field, and the issue route all pointed at the former `nothingnesses/agent-scaffold` path, which no longer serves this project. The package description now names the bounded workflow the default scaffolds rather than a structured workflow in general.
+- THE README'S "The `agent-flow` rename" SECTION IS REMOVED, and this entry replaces it as the current statement of the rename. The 0.0.3 entry below is the durable record of what the rename changed and of what to run to upgrade from 0.0.2, and the README's installation section now points there. The 0.0.2 and 0.0.3 entries name that README section as the authoritative statement including the contact route: both are left exactly as published, so read this entry in place of the pointer. THE CONTACT ROUTE for the freed `agent-scaffold` crate name is an issue at <https://github.com/nothingnesses/agent-flow/issues>. The facts those entries relied on the section for are unchanged: `agent-scaffold` stops at 0.0.2, every published `agent-scaffold` version stays installable and un-yanked, and the `agent-scaffold` name is free for whoever wants to reclaim it.
+- The README states what the tool does not do. It scaffolds the role contracts in `.agents/prompts/` and the state in `.agents/work.toml`, and its read-only commands project them. It launches no agent, spawns no process, and creates no git worktree to run a role in, and it enforces no separation of processes, filesystems, networks, credentials, or tool access between roles, so two roles the workflow draws apart may execute in one process over one working tree. The harness or external runner supplies that isolation, and the independence of a product review with it. The one worktree the tool does create is unrelated to roles: `agent-flow checks` runs lint and format commands in a throwaway worktree so an in-place formatter cannot mutate the live tree.
 
 ## [0.0.4] - 2026-08-18
 

Cargo.toml

@@ -4,8 +4,8 @@ version = "0.0.4"
 edition = "2021"
 rust-version = "1.88"
 license = "BlueOak-1.0.0"
-description = "Validate a structured agent workflow, project its state, and scaffold one to start."
-repository = "https://github.com/nothingnesses/agent-scaffold"
+description = "Scaffold a bounded agent delivery workflow into a project, then validate and project its state."
+repository = "https://github.com/nothingnesses/agent-flow"
 readme = "README.md"
 keywords = ["agent", "workflow", "ai", "scaffold", "template"]
 categories = ["command-line-utilities", "development-tools"]

README.md

@@ -1,14 +1,10 @@
 # agent-flow
 
-[![crates.io](https://img.shields.io/crates/v/agent-flow.svg)](https://crates.io/crates/agent-flow) [![GitHub License](https://img.shields.io/github/license/nothingnesses/agent-scaffold?color=blue)](https://github.com/nothingnesses/agent-scaffold/blob/main/LICENSE)
+[![crates.io](https://img.shields.io/crates/v/agent-flow.svg)](https://crates.io/crates/agent-flow) [![GitHub License](https://img.shields.io/github/license/nothingnesses/agent-flow?color=blue)](https://github.com/nothingnesses/agent-flow/blob/main/LICENSE)
 
 A small command-line tool that scaffolds a bounded agent delivery workflow into a project. The built-in pack creates one compact work file, one implementation-branch workflow, and role prompts for implementation, independent product review, conditional triage, one scoped fix, and one focused verification.
 
-## The `agent-flow` rename
-
-This project was published as `agent-scaffold` up to 0.0.2. From 0.0.3 it is published as `agent-flow` at <https://crates.io/crates/agent-flow>, and that is the crate to install. The binary is called `agent-flow` too, so every command below that once read `agent-scaffold <verb>` now reads `agent-flow <verb>`; the subcommands and their flags are unchanged. `agent-scaffold` stops at 0.0.2, and every published `agent-scaffold` version stays installable and un-yanked, so anything already depending on it keeps working.
-
-The `agent-scaffold` name is free for whoever wants to reclaim it. To ask for it, open an issue on <https://github.com/nothingnesses/agent-scaffold>, this project's repository.
+Those files are a written contract and the state that goes with it. The tool writes them and projects what they say. It starts no agent and runs no delivery pass for you. See [Roles are contracts, not isolation](#roles-are-contracts-not-isolation) for where execution, and the isolation around it, come from.
 
 ## Motivations
 
@@ -65,6 +61,16 @@ flowchart LR
 
 There is no plan review or convergence loop. Review findings cannot broaden the selected action's acceptance criteria. A missing independent reviewer, an out-of-scope finding, an unsafe fix, or a failed focused verification stops the workflow and returns the decision to the human.
 
+### Roles are contracts, not isolation
+
+The five passes above are logical roles: prose contracts in `.agents/prompts/`, read against the state in `.agents/work.toml`. agent-flow scaffolds those contracts and that state, and its read-only commands project them. It does that and nothing more.
+
+It does not launch an agent, spawn a process, or create a git worktree to run a role in, and it enforces no separation of processes, filesystems, networks, credentials, or tool access between roles. Two roles the diagram draws apart may well execute in one process, over one working tree, with one set of credentials. Nothing in the tool prevents that, and nothing in the tool detects it.
+
+The agent harness or external runner you drive the roles with is what supplies that isolation, and it is also what makes an independent product review independent: the tool cannot tell an independent reviewer from the implementer wearing a second hat. Choose a harness whose separation you trust, and treat the role prompts as the contract it executes against.
+
+One command does use a worktree, and it is unrelated to roles: `agent-flow checks` runs the configured lint and format commands inside a throwaway git worktree, so an in-place formatter cannot mutate the live tree.
+
 ## Installation
 
 agent-flow is a standalone Rust binary that runs without Nix. Install the latest release from crates.io:
@@ -73,11 +79,13 @@ agent-flow is a standalone Rust binary that runs without Nix. Install the latest
 cargo install agent-flow
 ```
 
+Up to 0.0.2 the crate and the binary were called `agent-scaffold`. The 0.0.3 entry in [CHANGELOG.md](CHANGELOG.md) is the durable record of that rename, including what to run to upgrade from 0.0.2. Every published `agent-scaffold` version stays installable and un-yanked, and the `agent-scaffold` crate name is free for whoever wants to reclaim it. To ask for it, open an issue at <https://github.com/nothingnesses/agent-flow/issues>, this project's issue tracker.
+
 Or build from source with a recent Rust toolchain (Rust 1.88 or newer):
 
 ```sh
-git clone https://github.com/nothingnesses/agent-scaffold
-cd agent-scaffold
+git clone https://github.com/nothingnesses/agent-flow
+cd agent-flow
 
 # Install the `agent-flow` binary into ~/.cargo/bin:
 cargo install --path .