@haposoft/cafekit 0.16.0-rc.3 → 0.16.0-rc.5

package/bin/__tests__/validator-grounding.test.js

@@ -11,21 +11,49 @@ const ROOT = path.resolve(__dirname, '../..');
 const VALIDATOR = path.join(ROOT, 'src/claude/scripts/validate-spec-output.cjs');
 const GROUNDING = path.join(ROOT, 'src/claude/scripts/spec-ground.cjs');
 const SCAFFOLD = path.join(ROOT, 'src/claude/scripts/spec-scaffold.cjs');
+const AUTHORING_VALIDATION = path.join(ROOT, 'src/claude/scripts/spec-authoring-validation.cjs');
 const RESOLVER = path.join(ROOT, 'src/claude/scripts/spec-resolver.cjs');
 const POLICY = require(path.join(ROOT, 'src/claude/scripts/workflow-policy.cjs'));
 const SPEC_RESOLVER = require(RESOLVER);
+const { normalizeCodexBody } = require(path.join(ROOT, 'bin/lib/codex-install.js'));
+const { copyClaudeTestRuntime } = require('./test-runtime-dependency-closure.cjs');
 
 function write(filePath, content) {
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
   fs.writeFileSync(filePath, content);
 }
 
+function writeRaw(filePath, content) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, content);
+}
+
+function copyCodexRuntime(adapterRoot, entrypoints) {
+  const files = copyClaudeTestRuntime(ROOT, adapterRoot, entrypoints);
+  for (const relative of files) {
+    if (!/\.(?:cjs|js)$/.test(relative)) continue;
+    const target = path.join(adapterRoot, relative);
+    writeRaw(
+      target,
+      normalizeCodexBody(fs.readFileSync(target, 'utf8'), `src/claude/${relative}`),
+    );
+  }
+  return files;
+}
+
 function run(script, args, cwd, options = {}) {
+  const fixtureRoot = script === VALIDATOR && typeof args[0] === 'string'
+    ? path.dirname(path.dirname(path.resolve(args[0])))
+    : null;
   return spawnSync(process.execPath, [script, ...args], {
     cwd,
     encoding: 'utf8',
     ...options,
-    env: options.env ? { ...process.env, ...options.env } : process.env,
+    env: {
+      ...process.env,
+      ...(fixtureRoot ? { HOME: path.join(fixtureRoot, '.home'), USERPROFILE: path.join(fixtureRoot, '.home') } : {}),
+      ...(options.env || {}),
+    },
   });
 }
 
@@ -49,33 +77,208 @@ function snapshotTree(root) {
   return entries.sort().join('\n');
 }
 
-function task({ file = 'task-R1-01-one.md', mapping = '1.1', related = '`src/one.js` | Modify', extra = '' } = {}) {
-  return `# Task R1-01: One\n\n## Context\n- Existing source.\n\n## Constraints\n- Keep scope.\n\n## Steps\n- [ ] Update source\n  - _Requirements: ${mapping}_\n\n## Requirements\n- 1.1 — One behavior\n\n## Related Files\n| Path | Action | Description |\n|---|---|---|\n| ${related} | Source | test |\n\n## Completion Criteria\n- [ ] Behavior works.\n\n## Evidence\n- Runtime reachability verification\n  - Entrypoint/caller: src/one.js\n\n## Risk Assessment\n| Risk | Severity | Mitigation |\n|---|---|---|\n| None | Low | Tests |\n${extra}`;
+function task({
+  id = 'R1-01',
+  mapping = '1.1',
+  related = '`src/one.js` | Modify',
+  relatedRows = null,
+  dependencies = 'none',
+  status = 'pending',
+  parallel = false,
+  extra = '',
+} = {}) {
+  const relatedPath = related.match(/`([^`]+)`/)?.[1] || 'src/one.js';
+  const action = related.match(/\|\s*([A-Za-z]+)\b/i)?.[1] || 'Modify';
+  const acceptanceId = mapping.match(/\d+\.\d+/)?.[0];
+  const lifecycleRows = relatedRows === null ? (action.toLowerCase() === 'modify'
+    ? `| \`${relatedPath}\` | Read | Inspect existing implementation |\n| ${related} | Update implementation |`
+    : `| ${related} | Apply declared lifecycle action |`) : relatedRows;
+  return `# Task ${id}: One\n\n**Status:** ${status}\n\n## Outcome\n\nCalling the real fixture entrypoint returns status value 1.\n\n## Scope and Typed Anchors\n\n- **In scope:** Implement the mapped observable behavior.\n- **Out of scope:** Unrelated runtime behavior.\n- **Contracts/Invariants:** none\n- **Canonical design anchors consumed:** A-D-01\n\n| ID | Type | Target | Role |\n|---|---|---|---|\n| A-${id}-01 | command | \`node --test test/one.test.js\` | planned verification command |\n\n## Changes\n\n- [ ] ${parallel ? '(P) ' : ''}Update the source boundary and preserve its negative path.${mapping ? ` _Requirements: ${mapping}_` : ''}\n\n## Acceptance\n\n${acceptanceId ? `- **R${acceptanceId}:**` : '-'} Calling \`${relatedPath}\` returns an observable result with status value 1.\n\n## Dependencies\n\n- ${dependencies}\n\n## Verification Plan\n\n- **Command:** \`node --test test/one.test.js\`\n- **Expected:** exit code 0 and one assertion for status value 1\n- **Negative path:** invalid input returns a deterministic error result\n- **Reachability:** \`${relatedPath}\` is invoked by the focused test\n\n## Related Files\n\n| Path | Action | Description |\n|---|---|---|---|\n${lifecycleRows}\n${extra}`;
+}
+
+function legacyWorkflowPolicy(lane = 'Standard') {
+  const proofObligations = lane === 'Critical'
+    ? ['needsInspection', 'needsExecutionProof', 'needsIndependentAudit', 'needsResearchGrounding']
+    : ['needsInspection', 'needsExecutionProof'];
+  return {
+    version: '1',
+    lane,
+    automatic_lane: lane,
+    risks: lane === 'Critical' ? ['auth'] : [],
+    artifact_profile: lane === 'Critical' ? 'strict' : 'bounded',
+    proof_obligations: proofObligations,
+    actor_needs: proofObligations.map((obligation) => ({
+      capability: {
+        needsInspection: 'inspection',
+        needsExecutionProof: 'execution-proof',
+        needsIndependentAudit: 'audit',
+        needsResearchGrounding: 'research-grounding',
+      }[obligation],
+      independence: obligation === 'needsIndependentAudit' ? 'independent' : 'same-session',
+    })),
+    override_receipt: null,
+  };
+}
+
+function legacyTask({ relatedRows = '| `src/one.js` | Read | Inspect existing behavior |', extra = '' } = {}) {
+  return `# Task R1-01: One\n\n**Status:** pending\n**Dependencies:** none\n\n## Context\n\nThe existing fixture service returns one deterministic result.\n\n## Constraints\n\nPreserve the stable result contract and its invalid-input behavior.\n\n## Steps\n\n- [ ] Inspect the declared boundary and preserve status value 1. _Requirements: 1.1_\n\n## Requirements\n\n- 1.1 — Return status value 1 from the fixture service.\n\n## Related Files\n\n| Path | Action | Description |\n|---|---|---|\n${relatedRows}\n\n## Completion Criteria\n\n- Calling \`src/one.js\` returns result status value 1.\n\n## Evidence\n\n- **Command:** \`node --test test/one.test.js\`\n- **Expected:** exit code 0 and status value 1\n- **Inspect:** \`src/one.js\` runtime result\n- Runtime reachability verification\n  - **Entrypoint/caller:** \`src/one.js\`\n\n## Risk Assessment\n\n| Risk | Severity | Mitigation |\n|---|---|---|\n| regression | low | focused test |\n${extra}`;
+}
+
+function lifecycleTimestamps({ tasks = true, research = false, review = false } = {}) {
+  return {
+    init: '2026-08-11T00:00:00+07:00',
+    requirements_done: '2026-08-11T00:01:00+07:00',
+    research_done: research ? '2026-08-11T00:02:00+07:00' : null,
+    design_done: '2026-08-11T00:03:00+07:00',
+    tasks_done: tasks ? '2026-08-11T00:04:00+07:00' : null,
+    code_done: null,
+    test_done: null,
+    review_done: review ? '2026-08-11T00:05:00+07:00' : null,
+    validation_done: '2026-08-11T00:06:00+07:00',
+  };
+}
+
+function semanticReviewNotRun() {
+  return {
+    status: 'not-run', reviewed_artifact_digest: null, reviewed_criteria: [], counterexamples: [],
+  };
+}
+
+function semanticDigest(specDir) {
+  const result = run(VALIDATOR, [specDir, '--semantic-digest'], ROOT);
+  assert.equal(result.status, 0, output(result));
+  return result.stdout.trim();
+}
+
+function completeSemanticReview(specDir, independence = 'same-session') {
+  const statePath = path.join(specDir, 'spec.json');
+  const state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
+  state.validation = isPlainObjectForTest(state.validation) ? state.validation : {};
+  state.validation.semantic_review = {
+    status: 'completed',
+    reviewed_artifact_digest: semanticDigest(specDir),
+    reviewed_criteria: ['R1.1'],
+    counterexamples: [{
+      criterion: 'R1.1',
+      scenario: 'The fixture receives invalid input at its runtime boundary.',
+      expected: 'The fixture returns the deterministic negative-path result.',
+      design_reference: 'D1',
+    }],
+  };
+  write(statePath, JSON.stringify(state, null, 2));
+  if (independence === 'independent') {
+    const root = path.dirname(path.dirname(specDir));
+    const featureName = state.feature_name;
+    const claim = `CAFEKIT_SEMANTIC_REVIEW_ATTESTATION ${JSON.stringify({
+      feature_name: featureName,
+      spec_file: path.relative(root, statePath),
+      semantic_digest: state.validation.semantic_review.reviewed_artifact_digest,
+      verdict: 'PASS',
+    })}`;
+    const result = spawnSync(process.execPath, [path.join(ROOT, 'src/claude/hooks/semantic-review-authority.cjs')], {
+      cwd: root,
+      env: { ...process.env, HOME: path.join(root, '.home'), USERPROFILE: path.join(root, '.home'), PROJECT_ROOT: root },
+      input: JSON.stringify({ hook_event_name: 'SubagentStop', session_id: 'host-session', agent_id: 'review-agent', agent_type: 'code_auditor', last_assistant_message: claim, cwd: root }),
+      encoding: 'utf8',
+    });
+    assert.equal(result.status, 0, output(result));
+    assert.equal(result.stderr, '');
+  }
+  return state;
+}
+
+function isPlainObjectForTest(value) {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+
+function obligationClosureBlock(obligation) {
+  const consumers = obligation.consumer_tasks.length > 0
+    ? obligation.consumer_tasks.join(', ')
+    : 'none';
+  return `<!-- implementation-obligation:${obligation.id} -->\n- Requirements: ${obligation.requirements.join(', ')}\n- Canonical state: ${obligation.canonical_state}\n- Authority: ${obligation.authority}\n- Recovery: ${obligation.recovery}\n- Owner task: ${obligation.owner_task}\n- Consumers: ${consumers}\n- Verification: ${obligation.verification}\n- Evidence: ${obligation.evidence}\n`;
+}
+
+function executionClosure(obligation) {
+  return `\n## Execution Closure\n\n${obligationClosureBlock(obligation)}`;
+}
+
+function executionClosureTable(obligation) {
+  const consumers = obligation.consumer_tasks.length > 0
+    ? obligation.consumer_tasks.join(', ')
+    : 'none';
+  return `\n## Execution Closure\n\n<!-- implementation-obligation:${obligation.id} -->\n` +
+    '| Obligation ID / Requirements | Canonical State | Authority | Crash / Retry Recovery | Owner Task | Consumer Tasks / Dependency Order | Verification / Evidence |\n' +
+    '|---|---|---|---|---|---|---|\n' +
+    `| ${obligation.id} / ${obligation.requirements.join(', ')} | ${obligation.canonical_state} | ${obligation.authority} | ${obligation.recovery} | \`${obligation.owner_task}\` | ${consumers} | \`${obligation.verification}\` → ${obligation.evidence} |\n`;
+}
+
+function criticalNoObligationDesign() {
+  return designFixture() +
+    '## Execution Closure\n\n' +
+    'N/A — this fixture has no cross-task state, retry, migration, or authority obligation.\n';
+}
+
+function designFixture() {
+  return '# Design\n\n## Boundary\n\nThe `src/one.js` module owns the fixture behavior and returns one deterministic result.\n\n' +
+    '## Typed Anchors\n\n| ID | Type | Target | Role |\n|---|---|---|---|\n' +
+    '| A-D-01 | file | `src/one.js` | existing owner and runtime entrypoint |\n\n' +
+    '## Decisions and Invariants\n\n### D1 — Stable result\n\n- **Decision:** Return status value 1.\n- **Negative path:** Invalid input returns a deterministic error.\n- **Anchors:** A-D-01\n\n' +
+    '## Verification\n\n| Requirement | Proof target | Expected result | Negative path / reachability |\n|---|---|---|---|\n' +
+    '| R1.1 | `node --test test/one.test.js` | exit code 0 and status value 1 | invalid input through `src/one.js` |\n\n';
+}
+
+function designFixture21() {
+  return '# Design\n\n## Boundary\n\nThe `src/one.js` module owns the fixture behavior and returns one deterministic result.\n\n' +
+    '## Typed Anchors\n\n| ID | Type | Target | Role | Access | Action |\n|---|---|---|---|---|---|\n' +
+    '| A-D-01 | file | `src/one.js` | runtime entrypoint | read | read |\n' +
+    '| A-D-02 | command | `node --test test/one.test.js` | proof command | read | read |\n\n' +
+    '## Decisions and Invariants\n\n### D1 — Stable result\n\nReturn status value 1 and reject invalid input.\n\n' +
+    '### I1 — Invalid-state invariant\n\nInvalid input never reports the success status.\n\n' +
+    '### C1 — Result contract\n\nThe result contains one numeric status.\n\n' +
+    '## Verification Definitions\n\n' +
+    '- **V1**: Subject criteria R1.1; Subject owner A-D-01; Proof criteria R1.2; Proof owner A-D-02; Evidence anchor A-D-02; Decision refs D1, I1, C1; Method command `node --test test/one.test.js`; Expected exit code 0 and status value 1; Negative/failure invalid input returns a deterministic error; Reachability/grounding entrypoint `src/one.js` via A-D-01, A-D-02.\n';
 }
 
 function createSpec(root, options = {}) {
-  const specDir = path.join(root, options.name || 'spec');
+  const featureName = options.name || 'spec';
+  const specDir = path.join(root, 'specs', featureName);
   const taskPath = 'tasks/task-R1-01-one.md';
-  write(path.join(specDir, 'requirements.md'), options.requirements || '# Requirements\n\n### Requirement 1: One\n\n- **R1.1** Do one thing.\n');
-  write(path.join(specDir, 'design.md'), options.design || '# Design\n');
-  write(path.join(specDir, 'research.md'), '# Research\n\n## Evidence Summary\n- Internal evidence.\n');
-  write(path.join(specDir, 'feature-receipt.md'), '# Feature Verification Receipt\n\nVerification: PENDING\n\nStatus: in_progress\n');
+  write(
+    path.join(specDir, 'requirements.md'),
+    options.requirements || '# Requirements\n\n### Requirement 1: One\n\n- **R1.1** When input arrives, the service shall return one deterministic result.\n',
+  );
+  write(
+    path.join(specDir, 'design.md'),
+    options.design || designFixture(),
+  );
   write(path.join(specDir, taskPath), options.task || task());
+  write(path.join(root, 'test/one.test.js'), "'use strict';\n// Separate proof artifact for fixture validation.\n");
   write(path.join(specDir, 'spec.json'), JSON.stringify({
     schema_version: '2.0',
-    feature_name: 'fixture',
+    feature_name: featureName,
+    created_at: '2026-08-11T00:00:00+07:00',
+    updated_at: '2026-08-11T00:05:00+07:00',
+    language: 'en',
     status: 'in_progress',
     current_phase: 'tasks',
     scope_lock: { source: 'fixture', in_scope: ['1'], out_of_scope: [], expansion_policy: 'requires-user-approval' },
+    coordination: {
+      tasks_required: true,
+      phases_required: false,
+      reason: 'task_topology',
+      task_triggers: ['separate_proof'],
+    },
     task_files: [taskPath],
     task_registry: {
       [taskPath]: {
         id: 'R1-01', title: 'One', status: 'pending', dependencies: [], blocker: null,
         started_at: null, completed_at: null, last_updated_at: null,
+        artifacts: ['test/one.test.js'],
       },
     },
     approvals: { requirements: { generated: true, agent_validated: true, user_approved: true }, design: { generated: true, agent_validated: true, user_approved: true }, tasks: { generated: true, agent_validated: true, user_approved: true } },
-    validation: { status: 'not-run' },
+    validation: { status: 'not-run', semantic_review: semanticReviewNotRun() },
+    timestamps: { ...lifecycleTimestamps(), validation_done: null },
     ready_for_implementation: false,
     workflow_policy: POLICY.workflowPolicySnapshot({ riskSignals: {} }),
     ...(options.spec || {}),
@@ -86,29 +289,67 @@ function createSpec(root, options = {}) {
 function createBoundedSpec(root, name = 'bounded') {
   const specDir = path.join(root, name);
   const policy = POLICY.workflowPolicySnapshot({ riskSignals: {} });
-  write(path.join(specDir, 'requirements.md'), '# Requirements\n\nBounded requirements are filled by the feature owner.\n');
-  write(path.join(specDir, 'design.md'), '# Design\n\nBounded design is filled by the feature owner.\n');
-  write(path.join(specDir, 'feature-receipt.md'), '# Feature Verification Receipt\n\nVerification: PENDING\n\nStatus: in_progress\n\nBlocker: awaiting execution proof\n');
+  write(path.join(specDir, 'requirements.md'), '# Requirements\n\n### Requirement 1: One\n\n- **R1.1** When input arrives, the service shall return status value 1.\n');
+  write(path.join(specDir, 'design.md'), designFixture());
   write(path.join(specDir, 'spec.json'), JSON.stringify({
     schema_version: '2.0',
     feature_name: name,
+    created_at: '2026-08-11T00:00:00+07:00',
+    updated_at: '2026-08-11T00:03:00+07:00',
     status: 'in_progress',
     current_phase: 'design',
     scope_lock: { source: 'fixture', in_scope: [], out_of_scope: [], expansion_policy: 'requires-user-approval' },
+    coordination: { tasks_required: false, phases_required: false, reason: 'taskless_requested' },
     approvals: {
       requirements: { generated: true, agent_validated: true, user_approved: false },
       design: { generated: true, agent_validated: true, user_approved: false },
     },
-    validation: { status: 'not-run' },
+    validation: { status: 'not-run', semantic_review: semanticReviewNotRun() },
+    timestamps: { ...lifecycleTimestamps({ tasks: false }), validation_done: null },
     ready_for_implementation: false,
     workflow_policy: policy,
   }, null, 2));
   return specDir;
 }
 
-function createPolicyOnlySpec(root, name, policy) {
+function legacyTasklessSpec20State(name, policy) {
+  return {
+    schema_version: '2.0',
+    feature_name: name,
+    created_at: '2026-08-11T00:00:00+07:00',
+    updated_at: '2026-08-11T00:03:00+07:00',
+    language: 'en',
+    status: 'in_progress',
+    current_phase: 'design',
+    scope_lock: {
+      source: 'legacy fixture',
+      in_scope: [],
+      out_of_scope: [],
+      expansion_policy: 'requires-user-approval',
+    },
+    coordination: {
+      tasks_required: false,
+      phases_required: false,
+      reason: 'taskless_requested',
+    },
+    validation: { status: 'not-run', semantic_review: semanticReviewNotRun() },
+    timestamps: { ...lifecycleTimestamps({ tasks: false }), validation_done: null },
+    ready_for_implementation: false,
+    workflow_policy: policy,
+  };
+}
+
+function createLegacyTasklessSpec20(root, name, policy) {
   const specDir = path.join(root, 'specs', name);
-  write(path.join(specDir, 'spec.json'), JSON.stringify({ workflow_policy: policy }, null, 2));
+  write(
+    path.join(specDir, 'requirements.md'),
+    '# Requirements\n\n### Requirement 1: Legacy baseline\n\n- **R1.1** The fixture shall preserve one deterministic result.\n',
+  );
+  write(path.join(specDir, 'design.md'), designFixture());
+  write(
+    path.join(specDir, 'spec.json'),
+    JSON.stringify(legacyTasklessSpec20State(name, policy), null, 2),
+  );
   return specDir;
 }
 
@@ -117,19 +358,236 @@ function output(result) {
 }
 
 function completeScaffoldedSpec(specDir) {
-  const taskPath = path.join(specDir, 'tasks', 'task-R1-01-artifact.md');
-  let taskText = fs.readFileSync(taskPath, 'utf8')
-    .replace(/\{\{[^}\n]+\}\}/g, 'filled')
-    .replace(/_Requirements:\s*[^_]+_/g, '_Requirements: 1.1_')
-    .replace(/\| `filled` \| Create \/ Modify \/ Delete \| filled \|/g, '| `src/one.js` | Read | inspect source |')
-    .replace('Entrypoint/caller: filled', 'Entrypoint/caller: src/one.js');
-  fs.writeFileSync(taskPath, taskText);
+  const state = JSON.parse(fs.readFileSync(path.join(specDir, 'spec.json'), 'utf8'));
+  for (const [index, taskFile] of (state.task_files || []).entries()) {
+    const entry = state.task_registry[taskFile];
+    write(path.join(specDir, taskFile), task({
+      id: entry.id,
+      related: `\`src/${index === 0 ? 'one' : `task-${index + 1}`}.js\` | Read`,
+      dependencies: entry.dependencies.length > 0 ? entry.dependencies.join(',') : 'none',
+    }));
+  }
   write(path.join(specDir, 'requirements.md'), '# Requirements\n\n### Requirement 1: Artifact\n\n- **R1.1** The task is verifiable.\n');
-  write(path.join(specDir, 'design.md'), '# Design\n');
-  write(path.join(specDir, 'research.md'), '# Research\n\n## Evidence Summary\n- Producer fixture.\n');
-  return JSON.parse(fs.readFileSync(path.join(specDir, 'spec.json'), 'utf8'));
+  write(
+    path.join(specDir, 'design.md'),
+    state.workflow_policy?.assurance_level === 'Strict' ? criticalNoObligationDesign() : designFixture(),
+  );
+  if (state.research === 'research.md') {
+    write(path.join(specDir, 'research.md'), '# Research\n\n## Evidence Summary\n- Producer fixture.\n');
+  }
+  return state;
+}
+
+test('canonical legacy v2.0 taskless migration fixture is valid without execution evidence', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-legacy-taskless-baseline-'));
+  try {
+    const specDir = createLegacyTasklessSpec20(
+      root,
+      'legacy-taskless-baseline',
+      POLICY.workflowPolicySnapshot({ riskSignals: {} }),
+    );
+    const state = JSON.parse(fs.readFileSync(path.join(specDir, 'spec.json'), 'utf8'));
+    assert.equal(state.schema_version, '2.0');
+    assert.equal(state.ready_for_implementation, false);
+    assert.equal(Object.hasOwn(state, 'task_files'), false);
+    assert.equal(Object.hasOwn(state, 'task_registry'), false);
+    assert.equal(fs.existsSync(path.join(specDir, 'research.md')), false);
+    assert.equal(fs.existsSync(path.join(specDir, 'receipts')), false);
+    state.override_receipt = { legacy: true };
+    write(path.join(specDir, 'spec.json'), JSON.stringify(state, null, 2));
+    const validation = run(VALIDATOR, [specDir], ROOT);
+    assert.equal(validation.status, 0, output(validation));
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+function completeScaffoldedSpec21(specDir) {
+  const statePath = path.join(specDir, 'spec.json');
+  let state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
+  const fixtureRoot = path.dirname(path.dirname(specDir));
+  const criteria = (state.task_files || []).map((_, index) => `R1.${index + 1}`);
+  write(path.join(fixtureRoot, 'test/one.test.js'), "require('node:test')('one', () => {});\n");
+  fs.mkdirSync(path.join(fixtureRoot, 'artifacts'), { recursive: true });
+  for (const [index, taskFile] of (state.task_files || []).entries()) {
+    const entry = state.task_registry[taskFile];
+    const ownedPath = `src/task-${index + 1}.js`;
+    const criterion = criteria[index];
+    const taskRole = index === 0 ? 'subject' : 'verifier';
+    write(path.join(fixtureRoot, ownedPath), 'module.exports = { status: 1 };\n');
+    write(path.join(specDir, taskFile), `# Task ${entry.id}: ${entry.title}
+**Status:** pending
+
+## Outcome
+Return observable status value 1 through the real fixture entrypoint.
+
+## Scope
+- **In scope:** Exact behavior for ${ownedPath}.
+- **Out of scope:** Unrelated runtime behavior.
+
+## Anchors and Ownership
+| ID | Type | Target | Role | Access | Action |
+|---|---|---|---|---|---|
+| A-${entry.id}-01 | file | \`${ownedPath}\` | owner | write | modify |
+${taskRole === 'verifier' ? `| A-${entry.id}-02 | artifact | \`artifacts/${entry.id}.json\` | verifier | write | create |` : ''}
+
+## Changes
+- [ ] ${taskRole === 'verifier' ? 'Implement the separate proof behavior.' : 'Implement the exact owned behavior.'} _Requirements: ${criterion.slice(1)}_
+
+## Acceptance
+- **${criterion}:** ${taskRole === 'verifier' ? 'The focused proof reports status value 1 and rejects an invalid result.' : 'The fixture returns status value 1 and rejects invalid input.'}
+
+## Dependencies
+- ${entry.dependencies.length > 0 ? entry.dependencies.join(', ') : 'none'}
+
+## Verification Plan
+- **Verification ref:** V1
+- **Task role:** ${taskRole}
+- **Command:** \`node --test test/one.test.js\`
+- **Expected:** Exit code 0 and exact status value 1.
+- **Negative path:** Invalid input returns rejected state.
+- **Reachability:** \`${ownedPath}\`
+`);
+  }
+  write(path.join(specDir, 'requirements.md'), `# Requirements
+
+### Requirement 1: Artifact
+
+${criteria.map((criterion, index) => `- **${criterion}**: Task ${index + 1} shall expose its distinct observable status or proof outcome and reject invalid input.`).join('\n')}
+`);
+  write(path.join(specDir, 'design.md'), `# Design
+
+## Architecture
+The fixture entrypoint delegates to the owned task boundary.
+
+## Typed Anchors
+| ID | Type | Target | Role | Access | Action |
+|---|---|---|---|---|---|
+| A-D-01 | command | \`node --test test/one.test.js\` | verification command | read | read |
+
+## Canonical Contracts & Invariants
+### D1 — Delegation decision
+The entrypoint delegates exactly once.
+### I1 — Invalid-state invariant
+Invalid input never returns status value 1.
+### C1 — Result contract
+The result contains a numeric status.
+### T1 — Artifact transition
+The transition records success, failure, and recovery states.
+
+## Verification Definitions
+- **V1**: Subject criteria ${criteria[0]}; Subject owner ${state.task_registry[state.task_files[0]].id}; Proof criteria ${criteria.slice(1).join(', ')}; Proof owner ${state.task_registry[state.task_files[1]].id}; Evidence anchor A-${state.task_registry[state.task_files[1]].id}-02; Decision refs D1, I1, C1; Method command \`node --test test/one.test.js\`; Expected exit code 0 and exact status value 1; Negative/failure invalid input returns rejected state; Reachability/grounding entrypoint \`src/task-1.js\` via A-D-01, A-${state.task_registry[state.task_files[1]].id}-02.
+`);
+  const promoted = run(
+    SCAFFOLD,
+    [path.basename(specDir), '--sync-semantic-model'],
+    path.dirname(path.dirname(specDir)),
+  );
+  assert.equal(promoted.status, 0, output(promoted));
+  // I21: `validated` is never hand-authored here. The real C16 coordinator is
+  // the only writer, and it flips the enums only after its own clean
+  // validator+grounder pass, writing the matching digest receipt in the same
+  // atomic replace. Routing the fixture through it keeps this helper honest and
+  // exercises the production path end to end.
+  const authored = run(AUTHORING_VALIDATION, [specDir, '--root', fixtureRoot], fixtureRoot);
+  assert.equal(authored.status, 0, output(authored));
+  state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
+  assert.equal(state.authoring.requirements, 'validated');
+  assert.equal(state.authoring.design, 'validated');
+  state.validation.status = 'completed';
+  state.validation.semantic_review = {
+    status: 'completed', semantic_digest: null, verdict: 'PASS', lifecycle_disposition: 'CONTINUE',
+    findings: [], unresolved_decisions: [],
+    graph_coverage: [
+      'criterion_local', 'cross_criterion', 'runtime_path',
+      'assumption_provenance', 'compatibility_migration',
+    ].map((surface) => ({ surface, covered: true, notes: `${surface} reviewed against the fixture topology.` })),
+    repair_round: 0,
+    reviewed_criteria: criteria,
+    counterexamples: criteria.map((criterion, index) => ({
+      criterion, case_kind: index % 2 === 0 ? 'failure' : 'adversarial',
+      scenario: `Task ${index + 1} receives a distinct malformed status payload at its declared boundary.`,
+      expected: `Task ${index + 1} rejects that payload without publishing its distinct success outcome.`,
+      decision_refs: ['D1', 'I1', 'C1'], verification_ref: 'V1',
+    })),
+    reviewer_evidence: {
+      assurance: 'Routine',
+      summary: 'Fixture reviewer confirmed every criterion, counterexample, and reachability anchor.',
+    },
+  };
+  write(statePath, JSON.stringify(state, null, 2));
+  state.validation.semantic_review.semantic_digest = semanticDigest(specDir);
+  state.ready_for_implementation = true;
+  write(statePath, JSON.stringify(state, null, 2));
+  return state;
 }
 
+test('Codex installer transform preserves all owned spec assets with idempotent runtime parity', () => {
+  for (const relative of [
+    'src/claude/skills/specs/SKILL.md',
+    'src/claude/skills/specs/rules/tasks-generation.md',
+    'src/claude/skills/specs/rules/design-principles.md',
+    'src/claude/skills/specs/references/review.md',
+    'src/claude/skills/specs/templates/design.md',
+    'src/claude/skills/specs/templates/task.md',
+    'src/claude/scripts/spec-scaffold.cjs',
+    'src/claude/scripts/spec-receipt.cjs',
+    'src/claude/scripts/validate-spec-output.cjs',
+  ]) {
+    const source = fs.readFileSync(path.join(ROOT, relative), 'utf8');
+    const transformed = normalizeCodexBody(source, relative);
+    assert.equal(normalizeCodexBody(transformed, relative), transformed, `${relative} must normalize idempotently`);
+    assert.doesNotMatch(transformed, /node \.claude\/scripts\//, `${relative} retained a Claude executable path`);
+    if (/node \.claude\/scripts\//.test(source)) {
+      assert.match(transformed, /node \.codex\/scripts\//, `${relative} lost its Codex executable path`);
+    }
+    if (/implementation-obligation:/.test(source)) {
+      assert.match(transformed, /implementation-obligation:/, `${relative} lost closure semantics`);
+    }
+  }
+
+  const skill = fs.readFileSync(path.join(ROOT, 'src/claude/skills/specs/SKILL.md'), 'utf8');
+  const review = fs.readFileSync(path.join(ROOT, 'src/claude/skills/specs/references/review.md'), 'utf8');
+  const designRules = fs.readFileSync(path.join(ROOT, 'src/claude/skills/specs/rules/design-principles.md'), 'utf8');
+  const taskRules = fs.readFileSync(path.join(ROOT, 'src/claude/skills/specs/rules/tasks-generation.md'), 'utf8');
+  assert.match(skill, /\| `Compact` \| `spec\.json`, `requirements\.md`, `design\.md` \| only on a research trigger \| only on a typed topology trigger \|/);
+  assert.match(skill, /\| `Full` \| `spec\.json`, `requirements\.md`, `design\.md` \| only on a research trigger \| only on a typed topology trigger \|/);
+  assert.doesNotMatch(review, /Standard[^\n]{0,100}(?:must not|forbidden|never)[^\n]{0,60}tasks?/i);
+  assert.match(designRules, /## Conditional detail[\s\S]*Migration:[\s\S]*only when existing state or public contracts change/);
+  assert.match(taskRules, /distinct ownership, a durable[\s\S]{0,180}parallel coordination/);
+  assert.match(taskRules, /receipts\/<task-basename>\.md|execution closeout/);
+
+  const parityRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-codex-validator-parity-'));
+  try {
+    const installedScripts = path.join(parityRoot, '.codex/scripts');
+    const installedValidator = path.join(installedScripts, 'validate-spec-output.cjs');
+    copyCodexRuntime(path.dirname(installedScripts), ['scripts/validate-spec-output.cjs']);
+
+    const scaffolded = run(SCAFFOLD, ['runtime-parity'], parityRoot);
+    assert.equal(scaffolded.status, 0, output(scaffolded));
+    const specDir = path.join(parityRoot, 'specs/runtime-parity');
+    write(path.join(specDir, 'requirements.md'), '# Requirements\n\n### Requirement 1: One\n\n- **R1.1** The runtime shall return status value 1.\n- **R1.2** The proof shall reject an invalid status result.\n');
+    write(path.join(specDir, 'design.md'), designFixture21());
+    const promoted = run(SCAFFOLD, ['runtime-parity', '--sync-semantic-model'], parityRoot);
+    assert.equal(promoted.status, 0, output(promoted));
+    const sourcePending = run(VALIDATOR, [specDir], ROOT);
+    const codexPending = run(installedValidator, [specDir], ROOT);
+    assert.equal(sourcePending.status, 0, output(sourcePending));
+    assert.equal(codexPending.status, sourcePending.status, output(codexPending));
+
+    const statePath = path.join(specDir, 'spec.json');
+    const state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
+    state.status = 'paused';
+    writeRaw(statePath, JSON.stringify(state, null, 2));
+    const sourceDonePending = run(VALIDATOR, [specDir], ROOT);
+    const codexDonePending = run(installedValidator, [specDir], ROOT);
+    assert.equal(sourceDonePending.status, 0, output(sourceDonePending));
+    assert.equal(codexDonePending.status, sourceDonePending.status, output(codexDonePending));
+  } finally {
+    fs.rmSync(parityRoot, { recursive: true, force: true });
+  }
+});
+
 test('resolver binds feature identity and rejects cross-feature spec aliases', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-resolver-identity-'));
   try {
@@ -193,17 +651,47 @@ test('validator rejects non-Markdown task artifacts instead of ignoring them', (
   }
 });
 
-test('validator never treats a completed feature receipt as execution authority', () => {
+test('validator keeps authoring receipt-free and validates taskless execution closeout proof', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-feature-receipt-'));
   try {
-    const specDir = createBoundedSpec(root, 'completed-feature-receipt');
+    const specDir = createBoundedSpec(root, 'weak-completed-feature-receipt');
     write(path.join(specDir, 'feature-receipt.md'), [
       '# Feature Verification Receipt', '', 'Verification: PASS',
       'Command: npm test', 'Exit: 0', 'Base: a', 'Head: b',
     ].join('\n'));
-    const result = run(VALIDATOR, [specDir], ROOT);
-    assert.notEqual(result.status, 0);
-    assert.match(output(result), /feature-receipt\.md: informational only/);
+    const premature = run(VALIDATOR, [specDir], ROOT);
+    assert.notEqual(premature.status, 0);
+    assert.match(output(premature), /completed execution receipt is valid only on terminal status done, never for readiness/);
+
+    const weakSpecPath = path.join(specDir, 'spec.json');
+    const weakSpec = JSON.parse(fs.readFileSync(weakSpecPath, 'utf8'));
+    weakSpec.status = 'done';
+    weakSpec.current_phase = 'done';
+    write(weakSpecPath, JSON.stringify(weakSpec, null, 2));
+    const weak = run(VALIDATOR, [specDir], ROOT);
+    assert.notEqual(weak.status, 0);
+    assert.match(output(weak), /completed proof and spec\.json must both use status done/);
+    assert.match(output(weak), /observable expected result/);
+    assert.match(output(weak), /distinct 40- or 64-hex Base and Head bindings/);
+
+    const completedDir = createBoundedSpec(root, 'completed-feature-receipt');
+    const completedSpecPath = path.join(completedDir, 'spec.json');
+    const completedSpec = JSON.parse(fs.readFileSync(completedSpecPath, 'utf8'));
+    completedSpec.status = 'done';
+    completedSpec.current_phase = 'done';
+    write(completedSpecPath, JSON.stringify(completedSpec, null, 2));
+    write(path.join(completedDir, 'feature-receipt.md'), [
+      '# Feature Verification Receipt', '', 'Verification: PASS', 'Status: done',
+      'Command: `node --test test/one.test.js`',
+      'Expected result: exit code 0 and one test passes',
+      'Observed result: exit code 0 and one test passed',
+      'Artifact/runtime proof: `src/one.js` persisted state value 1',
+      `Base: ${'a'.repeat(40)}`,
+      `Head: ${'b'.repeat(40)}`,
+    ].join('\n'));
+    const completed = run(VALIDATOR, [completedDir], ROOT);
+    assert.equal(completed.status, 0, output(completed));
+
   } finally {
     fs.rmSync(root, { recursive: true, force: true });
   }
@@ -222,7 +710,10 @@ test('validator rejects required and optional spec artifacts that symlink outsid
     assert.match(output(requiredResult), /requirements\.md: symlink is not allowed/);
 
     const optional = createSpec(root, { name: 'optional-artifact-link' });
-    fs.unlinkSync(path.join(optional, 'research.md'));
+    const optionalSpecPath = path.join(optional, 'spec.json');
+    const optionalSpec = JSON.parse(fs.readFileSync(optionalSpecPath, 'utf8'));
+    optionalSpec.research = 'research.md';
+    write(optionalSpecPath, JSON.stringify(optionalSpec, null, 2));
     write(path.join(external, 'research.md'), '# External research\n');
     fs.symlinkSync(path.join(external, 'research.md'), path.join(optional, 'research.md'));
     const optionalResult = run(VALIDATOR, [optional], ROOT);
@@ -230,7 +721,6 @@ test('validator rejects required and optional spec artifacts that symlink outsid
     assert.match(output(optionalResult), /research\.md: symlink is not allowed/);
 
     const bounded = createBoundedSpec(root, 'receipt-artifact-link');
-    fs.unlinkSync(path.join(bounded, 'feature-receipt.md'));
     write(path.join(external, 'feature-receipt.md'), '# External receipt\n');
     fs.symlinkSync(path.join(external, 'feature-receipt.md'), path.join(bounded, 'feature-receipt.md'));
     const boundedResult = run(VALIDATOR, [bounded], ROOT);
@@ -242,7 +732,7 @@ test('validator rejects required and optional spec artifacts that symlink outsid
   }
 });
 
-test('Standard bounded readiness rejects scope and document placeholders but allows a pending receipt', () => {
+test('Standard bounded readiness requires canonical testable requirements and a concrete design boundary', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-standard-placeholders-'));
   try {
     const specDir = createBoundedSpec(root, 'standard-placeholders');
@@ -252,7 +742,8 @@ test('Standard bounded readiness rejects scope and document placeholders but all
     spec.approvals.requirements.user_approved = true;
     spec.approvals.design.user_approved = true;
     spec.validation = { status: 'completed' };
-    spec.timestamps = { validation_done: '2026-08-11T00:00:00+07:00' };
+    spec.updated_at = '2026-08-11T00:06:00+07:00';
+    spec.timestamps = lifecycleTimestamps({ tasks: false });
     spec.scope_lock.source = '{{PROJECT_DESCRIPTION}}';
     fs.writeFileSync(specPath, JSON.stringify(spec, null, 2));
     write(path.join(specDir, 'requirements.md'), '# Requirements\n\n{{REQUIREMENTS}}\n');
@@ -261,14 +752,36 @@ test('Standard bounded readiness rejects scope and document placeholders but all
     const rejected = run(VALIDATOR, [specDir], ROOT);
     assert.notEqual(rejected.status, 0);
     assert.match(output(rejected), /scope_lock\.source.*concrete scope source/);
-    assert.match(output(rejected), /requirements\.md: Standard bounded readiness rejects placeholders/);
-    assert.match(output(rejected), /design\.md: Standard bounded readiness rejects placeholders/);
+    assert.match(output(rejected), /requirements\.md: Standard readiness rejects placeholders/);
+    assert.match(output(rejected), /design\.md: Standard readiness rejects placeholders/);
     assert.doesNotMatch(output(rejected), /feature-receipt\.md: canonical feature receipt required/);
 
     spec.scope_lock.source = 'The bounded feature scope is the one described here';
     fs.writeFileSync(specPath, JSON.stringify(spec, null, 2));
     write(path.join(specDir, 'requirements.md'), '# Requirements\n\nThe bounded behavior is explicitly defined.\n');
     write(path.join(specDir, 'design.md'), '# Design\n\nThe bounded implementation boundary is explicitly defined.\n');
+    const generic = run(VALIDATOR, [specDir], ROOT);
+    assert.notEqual(generic.status, 0);
+    assert.match(output(generic), /canonical numeric requirement id/);
+    assert.match(output(generic), /testable acceptance criterion using RN\.M/);
+    assert.match(output(generic), /grounded path\/code identifier/);
+
+    write(
+      path.join(specDir, 'requirements.md'),
+      '# Requirements\n\n## Requirements\n\n### Requirement 1: Locale persistence\n\n' +
+      '- **R1.1** When a locale is saved, the CLI shall write the selected value to `.codex/runtime.json` and return exit code 0.\n',
+    );
+    write(
+      path.join(specDir, 'design.md'),
+      '# Design\n\n## Boundary\n\nThe `.codex/runtime.json` file is owned by `saveLocale`; the CLI calls it before returning success.\n\n' +
+      '## Typed Anchors\n\n| ID | Type | Target | Role |\n|---|---|---|---|\n' +
+      '| A-D-01 | file | `.codex/runtime.json` | locale persistence target |\n' +
+      '| A-D-02 | symbol | `src/runtime.js#saveLocale` | locale writer |\n\n' +
+      '## Decisions and Invariants\n\n### D1 — Persist selected locale\n\n- **Decision:** `saveLocale` writes the selected value.\n- **Negative path:** Invalid locale leaves state unchanged.\n- **Anchors:** A-D-01, A-D-02\n\n' +
+      '## Verification\n\n| Requirement | Proof target | Expected result | Negative path / reachability |\n|---|---|---|---|\n' +
+      '| R1.1 | `node --test test/runtime.test.js` | exit code 0 and saved locale | invalid locale through `saveLocale` |\n',
+    );
+    completeSemanticReview(specDir);
     const accepted = run(VALIDATOR, [specDir], ROOT);
     assert.equal(accepted.status, 0, output(accepted));
   } finally {
@@ -280,19 +793,29 @@ test('tasks-only validates the persisted policy before any filesystem mutation',
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-scaffold-tasks-only-preflight-'));
   try {
     const standardPolicy = POLICY.workflowPolicySnapshot({ riskSignals: {} });
+    const boundaries = JSON.stringify([{
+      id: 'B-OWN', type: 'ownership', tasks: ['R1-01'],
+      write_sets: { 'R1-01': ['src/one.js'] },
+    }]);
     const cases = [
-      ['malformed', '{', /existing spec\.json is invalid JSON/],
-      ['null-state', 'null', /existing spec\.json must contain a JSON object/],
-      ['missing-snapshot', JSON.stringify({}), /existing spec must contain a persisted workflow_policy/],
-      ['null-snapshot', JSON.stringify({ workflow_policy: null }), /existing workflow_policy is invalid/],
-      ['extra-field', JSON.stringify({ workflow_policy: { ...standardPolicy, extra: true } }), /existing workflow_policy is invalid/],
+      ['malformed', () => '{', /existing spec\.json is invalid JSON/],
+      ['null-state', () => 'null', /existing spec\.json must contain a JSON object/],
+      ['missing-snapshot', (state) => { delete state.workflow_policy; return JSON.stringify(state, null, 2); }, /existing spec must contain a persisted workflow_policy/],
+      ['null-snapshot', (state) => { state.workflow_policy = null; return JSON.stringify(state, null, 2); }, /existing workflow_policy is invalid/],
+      ['extra-field', (state) => {
+        state.workflow_policy = { ...standardPolicy, extra: true };
+        return JSON.stringify(state, null, 2);
+      }, /schema 2\.0 workflow_policy contains unsupported legacy authority field\(s\): extra/],
     ];
-    for (const [name, body, expected] of cases) {
-      const specDir = path.join(root, 'specs', name);
+    for (const [name, mutate, expected] of cases) {
+      const specDir = createLegacyTasklessSpec20(root, name, standardPolicy);
       const specPath = path.join(specDir, 'spec.json');
-      write(specPath, body);
+      const state = JSON.parse(fs.readFileSync(specPath, 'utf8'));
+      write(specPath, mutate(state));
       const before = fs.readFileSync(specPath, 'utf8');
-      const result = run(SCAFFOLD, [name, '--tasks', 'R1-01-one', '--tasks-only'], root);
+      const result = run(SCAFFOLD, [
+        name, '--tasks', 'R1-01-one', '--tasks-only', '--boundaries', boundaries,
+      ], root);
       assert.equal(result.status, 2, output(result));
       assert.match(output(result), expected);
       assert.equal(fs.readFileSync(specPath, 'utf8'), before);
@@ -314,6 +837,21 @@ test('scaffold accepts only one safe alphanumeric-starting feature segment', ()
       assert.match(output(result), /feature|safe relative|path segment/i);
       assert.equal(snapshotTree(root), before, `${feature} must not mutate the workspace`);
     }
+
+    const beforeFreshSequence = snapshotTree(root);
+    const badFreshSequence = run(SCAFFOLD, ['bad-fresh-sequence', '--tasks', 'R1-1-one'], root);
+    assert.equal(badFreshSequence.status, 2, output(badFreshSequence));
+    assert.match(output(badFreshSequence), /SEQ 2 digits/);
+    assert.equal(snapshotTree(root), beforeFreshSequence, 'one-digit fresh task sequence mutated the workspace');
+
+    createLegacyTasklessSpec20(root, 'bad-tasks-only-sequence', POLICY.workflowPolicySnapshot({ riskSignals: {} }));
+    const beforeTasksOnlySequence = snapshotTree(root);
+    const badTasksOnlySequence = run(SCAFFOLD, [
+      'bad-tasks-only-sequence', '--tasks', 'R1-1-one', '--tasks-only',
+    ], root);
+    assert.equal(badTasksOnlySequence.status, 2, output(badTasksOnlySequence));
+    assert.match(output(badTasksOnlySequence), /SEQ 2 digits/);
+    assert.equal(snapshotTree(root), beforeTasksOnlySequence, 'one-digit tasks-only sequence mutated the workspace');
   } finally {
     fs.rmSync(root, { recursive: true, force: true });
   }
@@ -328,9 +866,9 @@ test('validator requires a strict persisted workflow-policy snapshot and never f
       ['explicit-null', (state) => { state.workflow_policy = null; }, /workflow_policy must be an object/],
       ['malformed', (state) => { state.workflow_policy = { ...policy, proof_obligations: { needsExecutionProof: true } }; }, /proof_obligations must be an array/],
       ['extra-field', (state) => { state.workflow_policy = { ...policy, extra: true }; }, /workflow_policy fields must be exactly/],
-      ['lane-mismatch', (state) => { state.workflow_policy = { ...policy, lane: 'Standard', automatic_lane: 'Critical' }; }, /lane cannot be lower than automatic_lane/],
-      ['risk-mismatch', (state) => { state.workflow_policy = { ...policy, risks: ['auth'] }; }, /lane must be at least Critical for its risks/],
-      ['obligation-mismatch', (state) => { state.workflow_policy = { ...policy, proof_obligations: ['needsExecutionProof'], actor_needs: [{ capability: 'execution-proof', independence: 'same-session' }] }; }, /proof_obligations do not match lane and risks/],
+      ['lane-mismatch', (state) => { state.workflow_policy = { ...policy, lane: 'Critical', automatic_lane: 'Critical' }; }, /lane is not the derived compatibility lane|automatic_lane is not the derived compatibility lane/],
+      ['risk-mismatch', (state) => { state.workflow_policy = { ...policy, risks: ['auth'] }; }, /assurance_level must be at least Elevated/],
+      ['obligation-mismatch', (state) => { state.workflow_policy = { ...policy, proof_obligations: ['needsInspection', 'needsExecutionProof'], actor_needs: [{ capability: 'inspection', independence: 'same-session' }, { capability: 'execution-proof', independence: 'same-session' }] }; }, /proof_obligations do not match assurance_level and risks/],
     ];
     for (const [name, mutate, expected] of cases) {
       const specDir = createSpec(root, { name, spec: { workflow_policy: policy } });
@@ -357,7 +895,8 @@ test('validator requires a strict persisted workflow-policy snapshot and never f
           tasks: { generated: true, agent_validated: true, user_approved: true },
         },
         validation: { status: 'completed' },
-        timestamps: { validation_done: '2026-08-11T00:00:00+07:00' },
+        updated_at: '2026-08-11T00:06:00+07:00',
+        timestamps: lifecycleTimestamps(),
       },
     });
     const legacyBefore = snapshotTree(legacyDir);
@@ -388,40 +927,66 @@ test('tasks-only preflights malformed topology, duplicates, and symlinks without
       ['unsafe-research-path', { workflow_policy: policy, research: '../outside' }, /spec\.research must be a safe relative path/],
     ];
     for (const [name, state, expected] of cases) {
-      const specDir = createPolicyOnlySpec(root, name, policy);
-      write(path.join(specDir, 'spec.json'), JSON.stringify(state, null, 2));
+      const specDir = createLegacyTasklessSpec20(root, name, policy);
+      write(path.join(specDir, 'spec.json'), JSON.stringify({
+        ...legacyTasklessSpec20State(name, policy),
+        ...state,
+      }, null, 2));
+      for (const declaredTask of new Set(Array.isArray(state.task_files) ? state.task_files : [])) {
+        write(path.join(specDir, declaredTask), task());
+      }
+      const boundaryTasks = Array.isArray(state.task_files) && state.task_files.includes(taskPath)
+        ? ['R1-01', 'R1-02', 'R1-03'] : ['R1-02', 'R1-03'];
+      const boundaries = JSON.stringify([{
+        id: 'B-OWN', type: 'ownership', tasks: boundaryTasks,
+        write_sets: Object.fromEntries(boundaryTasks.map((id) => [id, [`src/${id.toLowerCase()}.js`]])),
+      }]);
       const before = snapshotTree(root);
-      const result = run(SCAFFOLD, [name, '--tasks', 'R1-02-two', '--tasks-only'], root);
+      const result = run(SCAFFOLD, [
+        name, '--tasks', 'R1-02-two,R1-03-three', '--tasks-only',
+        '--boundaries', boundaries,
+      ], root);
       assert.equal(result.status, 2, output(result));
       assert.match(output(result), expected);
       assert.equal(snapshotTree(root), before, `${name} mutated the existing topology`);
     }
 
-    const conflictDir = createPolicyOnlySpec(root, 'conflicting-duplicate', policy);
+    const conflictDir = createLegacyTasklessSpec20(root, 'conflicting-duplicate', policy);
     write(path.join(conflictDir, 'tasks/task-R1-01-one.md'), 'already filled\n');
     write(path.join(conflictDir, 'spec.json'), JSON.stringify({
-      workflow_policy: policy,
+      ...legacyTasklessSpec20State('conflicting-duplicate', policy),
       task_files: [taskPath],
       task_registry: { [taskPath]: { ...registryEntry, title: 'Conflicting title' } },
     }, null, 2));
     const conflictBefore = snapshotTree(root);
-    const conflict = run(SCAFFOLD, ['conflicting-duplicate', '--tasks', 'R1-01-one', '--tasks-only'], root);
+    const singleBoundary = JSON.stringify([{
+      id: 'B-OWN', type: 'ownership', tasks: ['R1-01'], write_sets: { 'R1-01': ['src/one.js'] },
+    }]);
+    const conflict = run(SCAFFOLD, [
+      'conflicting-duplicate', '--tasks', 'R1-01-one', '--tasks-only',
+      '--boundaries', singleBoundary,
+    ], root);
     assert.equal(conflict.status, 2, output(conflict));
     assert.match(output(conflict), /conflicting duplicate/);
     assert.equal(snapshotTree(root), conflictBefore);
 
-    const duplicateDir = createPolicyOnlySpec(root, 'duplicate-cli', policy);
+    const duplicateDir = createLegacyTasklessSpec20(root, 'duplicate-cli', policy);
     const duplicateBefore = snapshotTree(root);
-    const duplicate = run(SCAFFOLD, ['duplicate-cli', '--tasks', 'R1-01-one,R1-01-two', '--tasks-only'], root);
+    const duplicate = run(SCAFFOLD, [
+      'duplicate-cli', '--tasks', 'R1-01-one,R1-01-two', '--tasks-only',
+      '--boundaries', singleBoundary,
+    ], root);
     assert.equal(duplicate.status, 2, output(duplicate));
     assert.match(output(duplicate), /duplicate task id.*R1-01/);
     assert.equal(snapshotTree(root), duplicateBefore);
 
-    const symlinkDir = createPolicyOnlySpec(root, 'symlink-tasks', policy);
+    const symlinkDir = createLegacyTasklessSpec20(root, 'symlink-tasks', policy);
     const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-scaffold-symlink-target-'));
     fs.symlinkSync(outside, path.join(symlinkDir, 'tasks'), 'dir');
     const symlinkBefore = snapshotTree(root);
-    const symlinkResult = run(SCAFFOLD, ['symlink-tasks', '--tasks', 'R1-01-one', '--tasks-only'], root);
+    const symlinkResult = run(SCAFFOLD, [
+      'symlink-tasks', '--tasks', 'R1-01-one', '--tasks-only', '--boundaries', singleBoundary,
+    ], root);
     assert.equal(symlinkResult.status, 2, output(symlinkResult));
     assert.match(output(symlinkResult), /symlink/);
     assert.equal(snapshotTree(root), symlinkBefore);
@@ -435,11 +1000,14 @@ test('tasks-only commits transactionally and preserves exact bytes after an inje
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-scaffold-transaction-'));
   try {
     const policy = POLICY.workflowPolicySnapshot({ riskSignals: {} });
-    createPolicyOnlySpec(root, 'partial-write', policy);
+    createLegacyTasklessSpec20(root, 'partial-write', policy);
     const before = snapshotTree(root);
     const result = run(
       SCAFFOLD,
-      ['partial-write', '--tasks', 'R1-01-one,R1-02-two', '--tasks-only'],
+      ['partial-write', '--tasks', 'R1-01-one,R1-02-two', '--boundaries', JSON.stringify([{
+        id: 'B-OWN', type: 'ownership', tasks: ['R1-01', 'R1-02'],
+        write_sets: { 'R1-01': ['src/one.js'], 'R1-02': ['src/two.js'] },
+      }]), '--tasks-only'],
       root,
       { env: { CAFEKIT_SCAFFOLD_FAIL_AFTER_WRITES: '1' } },
     );
@@ -451,51 +1019,261 @@ test('tasks-only commits transactionally and preserves exact bytes after an inje
   }
 });
 
+test('tasks-only migration derives only absent feature identity and rejects present conflicts atomically', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-scaffold-legacy-identity-'));
+  const policy = POLICY.workflowPolicySnapshot({ riskSignals: {} });
+  const boundaries = JSON.stringify([{
+    id: 'B-OWN', type: 'ownership', tasks: ['R1-01', 'R1-02'],
+    write_sets: { 'R1-01': ['src/one.js'], 'R1-02': ['src/two.js'] },
+  }]);
+  const migrate = (feature) => run(SCAFFOLD, [
+    feature, '--tasks', 'R1-01-one,R1-02-two', '--tasks-only', '--boundaries', boundaries,
+  ], root);
+  try {
+    const absentFeature = 'legacy-identity-absent';
+    const absentDir = createLegacyTasklessSpec20(root, absentFeature, policy);
+    const absentPath = path.join(absentDir, 'spec.json');
+    const absentState = JSON.parse(fs.readFileSync(absentPath, 'utf8'));
+    delete absentState.feature_name;
+    write(absentPath, JSON.stringify(absentState, null, 2));
+
+    const migrated = migrate(absentFeature);
+    assert.equal(migrated.status, 0, output(migrated));
+    const canonical = JSON.parse(fs.readFileSync(absentPath, 'utf8'));
+    assert.equal(canonical.schema_version, '2.1');
+    assert.equal(canonical.feature_name, absentFeature);
+    assert.equal(canonical.created_at, '2026-08-11T00:00:00+07:00');
+    assert.equal(canonical.language, 'en');
+    assert.equal(canonical.status, 'in_progress');
+    assert.deepEqual(canonical.scope_lock, absentState.scope_lock);
+    assert.deepEqual(canonical.authoring, {
+      requirements: 'draft', design: 'draft', research: 'absent', tasks: 'draft',
+    });
+    assert.equal(canonical.ready_for_implementation, false);
+    assert.equal(canonical.validation.status, 'not-run');
+    assert.equal(canonical.validation.semantic_review.status, 'not-run');
+    assert.equal(Object.hasOwn(canonical, 'research'), false);
+    assert.equal(fs.existsSync(path.join(absentDir, 'research.md')), false);
+    assert.equal(fs.existsSync(path.join(absentDir, 'receipts')), false);
+    assert.equal(fs.existsSync(path.join(absentDir, 'reports')), false);
+    for (const entry of Object.values(canonical.task_registry)) {
+      assert.deepEqual(
+        [entry.status, entry.blocker, entry.started_at, entry.completed_at, entry.last_updated_at],
+        ['pending', null, null, null, null],
+      );
+    }
+
+    for (const [label, featureName] of [
+      ['empty', ''], ['non-string', 42], ['different', 'another-feature'],
+    ]) {
+      const feature = `legacy-identity-${label}`;
+      const specDir = createLegacyTasklessSpec20(root, feature, policy);
+      const specPath = path.join(specDir, 'spec.json');
+      const state = JSON.parse(fs.readFileSync(specPath, 'utf8'));
+      state.feature_name = featureName;
+      write(specPath, JSON.stringify(state, null, 2));
+      const before = snapshotTree(specDir);
+      const rejected = migrate(feature);
+      assert.equal(rejected.status, 2, `${label}: ${output(rejected)}`);
+      assert.match(output(rejected), /feature_name conflicts with the scaffold feature identity/);
+      assert.equal(snapshotTree(specDir), before, `${label} identity rejection mutated the fixture`);
+    }
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('fresh scaffold rolls back authority rejection and injected partial writes without deleting pre-existing content', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-scaffold-fresh-transaction-'));
+  try {
+    const codexRoot = path.join(root, '.codex');
+    const installedScripts = path.join(codexRoot, 'scripts');
+    const installedHooks = path.join(codexRoot, 'hooks');
+    const installedTemplates = path.join(codexRoot, 'skills/specs/templates');
+    fs.mkdirSync(installedScripts, { recursive: true });
+    fs.mkdirSync(installedHooks, { recursive: true });
+    fs.mkdirSync(path.dirname(installedTemplates), { recursive: true });
+    fs.cpSync(path.join(ROOT, 'src/claude/skills/specs/templates'), installedTemplates, { recursive: true });
+    copyCodexRuntime(codexRoot, ['scripts/spec-scaffold.cjs']);
+    write(path.join(installedHooks, 'completion-authority-state.cjs'), 'module.exports = {};\n');
+    write(
+      path.join(installedHooks, 'completion-authority-check.cjs'),
+      'module.exports = { observePolicyBaseline() { return { ok: false, reason: "fixture authority reject" }; } };\n',
+    );
+    write(path.join(root, 'specs/keep.txt'), 'pre-existing\n');
+
+    const beforeAuthority = snapshotTree(root);
+    const authority = run(
+      path.join(installedScripts, 'spec-scaffold.cjs'),
+      ['authority-reject', '--lane', 'Standard'],
+      root,
+    );
+    assert.equal(authority.status, 2, output(authority));
+    assert.match(output(authority), /fixture authority reject.*transaction rolled back/);
+    assert.equal(snapshotTree(root), beforeAuthority);
+    assert.equal(fs.existsSync(path.join(root, 'specs/authority-reject')), false);
+
+    write(
+      path.join(installedHooks, 'completion-authority-check.cjs'),
+      'module.exports = { observePolicyBaseline() { return { ok: true }; } };\n',
+    );
+    const seeded = run(
+      path.join(installedScripts, 'spec-scaffold.cjs'),
+      ['tasks-authority', '--lane', 'Standard'],
+      root,
+    );
+    assert.equal(seeded.status, 0, output(seeded));
+    write(
+      path.join(installedHooks, 'completion-authority-check.cjs'),
+      'module.exports = { observePolicyBaseline() { return { ok: false, reason: "fixture tasks-only authority reject" }; } };\n',
+    );
+    const beforeTasksAuthority = snapshotTree(root);
+    const tasksAuthority = run(
+      path.join(installedScripts, 'spec-scaffold.cjs'),
+      ['tasks-authority', '--tasks', 'R1-01-one,R1-02-two', '--tasks-only',
+        '--boundaries', JSON.stringify([{
+          id: 'B-OWN', type: 'ownership', tasks: ['R1-01', 'R1-02'],
+          write_sets: { 'R1-01': ['src/one.js'], 'R1-02': ['src/two.js'] },
+        }])],
+      root,
+    );
+    assert.equal(tasksAuthority.status, 2, output(tasksAuthority));
+    assert.match(output(tasksAuthority), /fixture tasks-only authority reject.*transaction rolled back/);
+    assert.equal(snapshotTree(root), beforeTasksAuthority);
+    assert.equal(fs.existsSync(path.join(root, 'specs/tasks-authority/tasks/task-R1-01-one.md')), false);
+
+    const beforeInjected = snapshotTree(root);
+    const injected = run(
+      SCAFFOLD,
+      ['fresh-injected', '--lane', 'Standard'],
+      root,
+      { env: { CAFEKIT_SCAFFOLD_FAIL_AFTER_WRITES: '2' } },
+    );
+    assert.equal(injected.status, 2, output(injected));
+    assert.match(output(injected), /injected failure.*transaction rolled back/);
+    assert.equal(snapshotTree(root), beforeInjected);
+    assert.equal(fs.readFileSync(path.join(root, 'specs/keep.txt'), 'utf8'), 'pre-existing\n');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('installed Codex scaffold rejects a symlinked template parent before creating a spec', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-scaffold-template-symlink-'));
+  const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-template-outside-'));
+  try {
+    const codexRoot = path.join(root, '.codex');
+    copyCodexRuntime(codexRoot, ['scripts/spec-scaffold.cjs']);
+    write(
+      path.join(codexRoot, 'hooks/completion-authority-check.cjs'),
+      'module.exports = { observePolicyBaseline() { return { ok: true }; } };\n',
+    );
+    write(path.join(codexRoot, 'hooks/completion-authority-state.cjs'), 'module.exports = {};\n');
+    fs.cpSync(path.join(ROOT, 'src/claude/skills/specs/templates'), outside, { recursive: true });
+    const templatesParent = path.join(root, '.agents/skills/specs');
+    fs.mkdirSync(templatesParent, { recursive: true });
+    fs.symlinkSync(outside, path.join(templatesParent, 'templates'));
+
+    const result = run(
+      path.join(codexRoot, 'scripts/spec-scaffold.cjs'),
+      ['template-parent-escape', '--lane', 'Standard'],
+      root,
+    );
+    assert.equal(result.status, 2, output(result));
+    assert.match(output(result), /template check failed|symlink component rejected/i);
+    assert.equal(fs.existsSync(path.join(root, 'specs/template-parent-escape')), false);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+    fs.rmSync(outside, { recursive: true, force: true });
+  }
+});
+
 test('tasks-only is idempotent for an identical task request and preserves the snapshot bytes', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-scaffold-idempotent-'));
   try {
     const policy = POLICY.workflowPolicySnapshot({ riskSignals: {} });
-    createPolicyOnlySpec(root, 'idempotent', policy);
-    const first = run(SCAFFOLD, ['idempotent', '--tasks', 'R1-01-one', '--tasks-only'], root);
+    createLegacyTasklessSpec20(root, 'idempotent', policy);
+    const boundaryArgs = ['--boundaries', JSON.stringify([{
+      id: 'B-OWN', type: 'ownership', tasks: ['R1-01', 'R1-02'],
+      write_sets: { 'R1-01': ['src/one.js'], 'R1-02': ['src/two.js'] },
+    }])];
+    const idempotentArgs = ['idempotent', '--tasks', 'R1-01-one,R1-02-two', '--tasks-only', ...boundaryArgs];
+    const first = run(SCAFFOLD, idempotentArgs, root);
     assert.equal(first.status, 0, output(first));
     const beforeSecond = snapshotTree(root);
-    const second = run(SCAFFOLD, ['idempotent', '--tasks', 'R1-01-one', '--tasks-only'], root);
+    const second = run(SCAFFOLD, idempotentArgs, root);
     assert.equal(second.status, 0, output(second));
     assert.match(output(second), /0 new task stub\(s\)/);
     assert.equal(snapshotTree(root), beforeSecond);
+
+    const artifactBase = run(SCAFFOLD, ['idempotent-artifact', '--lane', 'Standard'], root);
+    assert.equal(artifactBase.status, 0, output(artifactBase));
+    const proofArgs = ['--boundaries', JSON.stringify([{
+      id: 'B-V', type: 'proof', subject: 'R1-01', verifier: 'R1-02',
+      verification_ref: 'V1', artifact_anchor: 'A-R1-02-02',
+    }])];
+    const artifactArgs = [
+      'idempotent-artifact', '--tasks', 'R1-01-one,R1-02-two', '--tasks-only', ...proofArgs,
+    ];
+    const artifactFirst = run(SCAFFOLD, artifactArgs, root);
+    assert.equal(artifactFirst.status, 0, output(artifactFirst));
+    const artifactDir = path.join(root, 'specs/idempotent-artifact');
+    completeScaffoldedSpec21(artifactDir);
+    const artifactValidation = run(VALIDATOR, [artifactDir], ROOT);
+    assert.equal(artifactValidation.status, 0, output(artifactValidation));
+    const beforeArtifactSecond = snapshotTree(root);
+    const artifactSecond = run(SCAFFOLD, artifactArgs, root);
+    assert.equal(artifactSecond.status, 0, output(artifactSecond));
+    assert.match(output(artifactSecond), /0 new task stub\(s\)/);
+    assert.equal(snapshotTree(root), beforeArtifactSecond);
   } finally {
     fs.rmSync(root, { recursive: true, force: true });
   }
 });
 
-test('tasks-only consumes the policy snapshot and escalates Standard auth monotonically', () => {
+test('tasks-only consumes the policy snapshot and escalates auth to Elevated monotonically', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-scaffold-tasks-only-policy-'));
   try {
-    const specDir = createPolicyOnlySpec(root, 'existing', POLICY.workflowPolicySnapshot({ riskSignals: {} }));
+    const specDir = createLegacyTasklessSpec20(root, 'existing', POLICY.workflowPolicySnapshot({ riskSignals: {} }));
+    const boundaries = JSON.stringify([{
+      id: 'B-OWN', type: 'ownership', tasks: ['R1-01', 'R1-02'],
+      write_sets: { 'R1-01': ['src/auth.js'], 'R1-02': ['src/next.js'] },
+    }]);
     const escalated = run(SCAFFOLD, [
-      'existing', '--tasks', 'R1-01-auth', '--risks', 'auth', '--tasks-only',
+      'existing', '--tasks', 'R1-01-auth,R1-02-next', '--risks', 'auth', '--tasks-only',
+      '--boundaries', boundaries,
     ], root);
     assert.equal(escalated.status, 0, output(escalated));
-    assert.match(output(escalated), /1 new task stub\(s\)/);
-    assert.match(output(escalated), /research\.md created for needsResearchGrounding/);
+    assert.match(output(escalated), /2 new task stub\(s\)/);
+    assert.doesNotMatch(output(escalated), /research\.md created/);
     const first = JSON.parse(fs.readFileSync(path.join(specDir, 'spec.json'), 'utf8'));
-    assert.equal(first.workflow_policy.lane, 'Critical');
+    assert.equal(POLICY.readWorkflowPolicySnapshot(first).lane, 'Standard');
+    assert.equal(POLICY.readWorkflowPolicySnapshot(first).assurance_level, 'Elevated');
     assert.deepEqual(first.workflow_policy.risks, ['auth']);
-    assert.equal(first.workflow_policy.artifact_profile, 'strict');
-    assert.ok(first.workflow_policy.proof_obligations.includes('needsResearchGrounding'));
-    assert.equal(fs.existsSync(path.join(specDir, 'research.md')), true);
+    assert.equal(POLICY.readWorkflowPolicySnapshot(first).artifact_profile, 'bounded');
+    assert.equal(POLICY.readWorkflowPolicySnapshot(first).proof_obligations.includes('needsResearchGrounding'), false);
+    assert.equal(fs.existsSync(path.join(specDir, 'research.md')), false);
     assert.equal(fs.existsSync(path.join(specDir, 'reports')), false);
 
     const policyBytes = JSON.stringify(first.workflow_policy);
-    const noNewRisk = run(SCAFFOLD, ['existing', '--tasks', 'R1-02-next', '--tasks-only'], root);
+    const noNewRisk = run(SCAFFOLD, [
+      'existing', '--tasks', 'R1-01-auth,R1-02-next', '--tasks-only', '--boundaries', boundaries,
+    ], root);
     assert.equal(noNewRisk.status, 0, output(noNewRisk));
-    assert.match(output(noNewRisk), /1 new task stub\(s\)/);
+    assert.match(output(noNewRisk), /0 new task stub\(s\)/);
     const second = JSON.parse(fs.readFileSync(path.join(specDir, 'spec.json'), 'utf8'));
     assert.equal(JSON.stringify(second.workflow_policy), policyBytes);
 
     const beforeRejectedLane = fs.readFileSync(path.join(specDir, 'spec.json'), 'utf8');
+    const rejectedBoundaries = JSON.stringify([{
+      id: 'B-OWN', type: 'ownership', tasks: ['R1-01', 'R1-02', 'R1-03'],
+      write_sets: {
+        'R1-01': ['src/auth.js'], 'R1-02': ['src/next.js'], 'R1-03': ['src/invalid.js'],
+      },
+    }]);
     const rejectedLane = run(SCAFFOLD, [
-      'existing', '--tasks', 'R1-03-invalid', '--lane', 'Standard', '--tasks-only',
+      'existing', '--tasks', 'R1-03-invalid', '--lane', 'Critical', '--tasks-only',
+      '--boundaries', rejectedBoundaries,
     ], root);
     assert.equal(rejectedLane.status, 2, output(rejectedLane));
     assert.match(output(rejectedLane), /does not match persisted workflow_policy\.lane/);
@@ -506,54 +1284,25 @@ test('tasks-only consumes the policy snapshot and escalates Standard auth monoto
   }
 });
 
-test('scaffold emits bounded artifacts on demand without default research or reports ceremony', () => {
+test('scaffold emits minimal 2.1 artifacts without default research or reports ceremony', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-scaffold-artifact-profile-'));
   try {
     const standardDefault = run(SCAFFOLD, ['standard-default', '--lane', 'Standard'], root);
     assert.equal(standardDefault.status, 0, output(standardDefault));
     const standardDir = path.join(root, 'specs', 'standard-default');
     assert.deepEqual(fs.readdirSync(standardDir).sort(), [
-      'design.md', 'feature-receipt.md', 'requirements.md', 'spec.json',
+      'design.md', 'requirements.md', 'spec.json',
     ]);
 
-    for (const args of [
-      ['standard-tasks', '--lane', 'Standard', '--tasks', 'R1-01-one'],
-      ['critical-no-research', '--lane', 'Critical', '--tasks', 'R1-01-one'],
-    ]) {
-      const result = run(SCAFFOLD, args, root);
-      assert.equal(result.status, 0, output(result));
-      const specDir = path.join(root, 'specs', args[0]);
-      assert.equal(fs.existsSync(path.join(specDir, 'research.md')), false);
-      assert.equal(fs.existsSync(path.join(specDir, 'reports')), false);
-      assert.equal(fs.existsSync(path.join(specDir, 'tasks/task-R1-01-one.md')), true);
-    }
-
-    for (const [name, risk] of [['critical-auth-case', 'Auth'], ['critical-auth-alias', 'authentication']]) {
-      const result = run(SCAFFOLD, [name, '--risks', risk, '--tasks', 'R1-01-one'], root);
-      assert.equal(result.status, 0, output(result));
-      const specDir = path.join(root, 'specs', name);
-      const spec = JSON.parse(fs.readFileSync(path.join(specDir, 'spec.json'), 'utf8'));
-      assert.equal(spec.workflow_policy.lane, 'Critical');
-      assert.equal(fs.existsSync(path.join(specDir, 'research.md')), true);
-    }
-
-    const unknown = run(SCAFFOLD, ['unknown-risk', '--risks', 'unclassified-risk'], root);
-    assert.equal(unknown.status, 0, output(unknown));
-    const unknownSpec = JSON.parse(fs.readFileSync(path.join(root, 'specs/unknown-risk/spec.json'), 'utf8'));
-    assert.equal(unknownSpec.workflow_policy.lane, 'Standard');
-    assert.equal(fs.existsSync(path.join(root, 'specs/unknown-risk/research.md')), false);
-
-    const authTemplate = run(SCAFFOLD, [
-      'critical-auth-template', '--risks', 'auth', '--tasks', 'R1-01-artifact',
-    ], root);
-    assert.equal(authTemplate.status, 0, output(authTemplate));
-    const authTemplateDir = path.join(root, 'specs', 'critical-auth-template');
-    const unfilled = run(VALIDATOR, [authTemplateDir], ROOT);
-    assert.notEqual(unfilled.status, 0);
-    assert.match(output(unfilled), /Evidence Summary must contain concrete evidence/);
-    completeScaffoldedSpec(authTemplateDir);
-    const filled = run(VALIDATOR, [authTemplateDir], ROOT);
-    assert.equal(filled.status, 0, output(filled));
+    const strict = run(SCAFFOLD, ['strict-taskless', '--risks', 'auth', '--assurance-level', 'Strict'], root);
+    assert.equal(strict.status, 0, output(strict));
+    const strictDir = path.join(root, 'specs', 'strict-taskless');
+    const strictSpec = JSON.parse(fs.readFileSync(path.join(strictDir, 'spec.json'), 'utf8'));
+    assert.equal(strictSpec.schema_version, '2.1');
+    assert.equal(POLICY.readWorkflowPolicySnapshot(strictSpec).lane, 'Critical');
+    assert.equal(strictSpec.authoring.tasks, 'absent');
+    assert.equal(fs.existsSync(path.join(strictDir, 'research.md')), false);
+    assert.equal(fs.existsSync(path.join(strictDir, 'reports')), false);
   } finally {
     fs.rmSync(root, { recursive: true, force: true });
   }
@@ -562,7 +1311,7 @@ test('scaffold emits bounded artifacts on demand without default research or rep
 test('strict validator requires numeric IDs, rejects phantom mappings, and grounds research content', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-strict-grounding-'));
   try {
-    const strictPolicy = POLICY.workflowPolicySnapshot({ riskSignals: { auth: true } });
+    const strictPolicy = POLICY.workflowPolicySnapshot({ riskSignals: { auth: true }, assurance_level: 'Strict' });
     const noIds = createSpec(root, {
       name: 'no-numeric-ids',
       requirements: '# Requirements\n\nThe behavior has no numeric identifier.\n',
@@ -572,6 +1321,15 @@ test('strict validator requires numeric IDs, rejects phantom mappings, and groun
     assert.notEqual(noIdsResult.status, 0);
     assert.match(output(noIdsResult), /strict workflow requires numeric requirement IDs/);
 
+    const legacyDialect = createSpec(root, {
+      name: 'legacy-req-dialect',
+      requirements: '# Requirements\n\n## Requirements\n\n### REQ-01: One\n\n- **REQ-01.1** The service shall return one result.\n',
+      spec: { workflow_policy: strictPolicy },
+    });
+    const legacyDialectResult = run(VALIDATOR, [legacyDialect], ROOT);
+    assert.notEqual(legacyDialectResult.status, 0);
+    assert.match(output(legacyDialectResult), /REQ-01 is not a canonical requirement id/);
+
     const phantom = createSpec(root, {
       name: 'phantom-mapping',
       task: task({ mapping: '9.1' }),
@@ -584,7 +1342,8 @@ test('strict validator requires numeric IDs, rejects phantom mappings, and groun
     const researchPlaceholder = createSpec(root, {
       name: 'research-placeholder',
       task: task({ related: '`src/strict-only.js` | Read' }),
-      spec: { workflow_policy: strictPolicy },
+      design: criticalNoObligationDesign(),
+      spec: { workflow_policy: strictPolicy, research: 'research.md' },
     });
     write(path.join(researchPlaceholder, 'research.md'), '# Research\n\n## Evidence Summary\n- TBD\n');
     const placeholderResult = run(VALIDATOR, [researchPlaceholder], ROOT);
@@ -599,7 +1358,211 @@ test('strict validator requires numeric IDs, rejects phantom mappings, and groun
   }
 });
 
-test('spec-ready accepts pending execution evidence without an audit receipt', () => {
+test('validator rejects unsupported or duplicate structured requirement IDs without mining incidental prose', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-requirement-inventory-'));
+  try {
+    const unsupportedHeading = createSpec(root, {
+      name: 'unsupported-heading',
+      requirements: '# Requirements\n\n### R1A: One\n\n- **R1.1** The service shall return status value 1.\n',
+    });
+    let result = run(VALIDATOR, [unsupportedHeading], ROOT);
+    assert.notEqual(result.status, 0);
+    assert.match(output(result), /unsupported requirement id R1A/);
+
+    const unsupportedCriterion = createSpec(root, {
+      name: 'unsupported-criterion',
+      requirements: '# Requirements\n\n### Requirement 1: One\n\n- **R1-1** The service shall return status value 1.\n',
+    });
+    result = run(VALIDATOR, [unsupportedCriterion], ROOT);
+    assert.notEqual(result.status, 0);
+    assert.match(output(result), /unsupported acceptance criterion id R1-1/);
+
+    const duplicates = createSpec(root, {
+      name: 'duplicate-inventory',
+      requirements: '# Requirements\n\n### Requirement 1: First\n\n- **R1.1** The service shall return status value 1.\n\n' +
+        '### R1: Duplicate\n\n- **R1.1** The service shall return status value 2.\n',
+    });
+    result = run(VALIDATOR, [duplicates], ROOT);
+    assert.notEqual(result.status, 0);
+    assert.match(output(result), /duplicate canonical requirement id R1/);
+    assert.match(output(result), /duplicate canonical acceptance criterion id R1\.1/);
+
+    const incidental = createSpec(root, {
+      name: 'incidental-rfc-adr-and-reference',
+      task: task({ related: '`src/one.js` | Read' }),
+      requirements: '# Requirements\n\n### Requirement 1: One\n\n' +
+        '- **R1.1** The service shall return one deterministic result with status value 1.\n\n' +
+        'See RFC 9110, ADR-001, and R7.2 for historical context only.\n',
+    });
+    result = run(VALIDATOR, [incidental], ROOT);
+    assert.equal(result.status, 0, output(result));
+
+    const ignoredSyntax = createSpec(root, {
+      name: 'ignored-fenced-and-commented-inventory',
+      task: task({ related: '`src/one.js` | Read' }),
+      requirements: '# Requirements\n\n### Requirement 1: One\n\n' +
+        '- **R1.1** The service shall return one deterministic result with status value 1.\n\n' +
+        '<!-- ### Requirement 1: commented duplicate\n- **R1.1** commented duplicate -->\n\n' +
+        '```markdown\n### Requirement 1: example duplicate\n- **R1.1** example duplicate\n```\n',
+    });
+    result = run(VALIDATOR, [ignoredSyntax], ROOT);
+    assert.equal(result.status, 0, output(result));
+
+    for (const [name, heading] of [
+      ['numeric-heading', '### 1: One'],
+      ['bracket-heading', '### [R1]: One'],
+    ]) {
+      const invalidHeading = createSpec(root, {
+        name,
+        requirements: `# Requirements\n\n${heading}\n\n- **R1.1** The service shall return status value 1.\n`,
+      });
+      result = run(VALIDATOR, [invalidHeading], ROOT);
+      assert.notEqual(result.status, 0);
+      assert.match(output(result), /unsupported requirement id/);
+    }
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('validator requires substantive Specs v2 task semantics and planned executable proof', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-task-semantics-'));
+  try {
+    const invalid = createSpec(root, { name: 'weak-task-semantics' });
+    const weakTask = task({ related: '`src/one.js` | Read' })
+      .replace('Calling the real fixture entrypoint returns status value 1.', 'TBD')
+      .replace('- **In scope:** Implement the mapped observable behavior.', '- **In scope:** TBD')
+      .replace('- **Out of scope:** Unrelated runtime behavior.', '- **Out of scope:** N/A')
+      .replace('- **R1.1:** Calling `src/one.js` returns an observable result with status value 1.', '- **R1.1:** Works')
+      .replace('| A-R1-01-01 | command | `node --test test/one.test.js` |', '| A-R1-01-01 | command | `npm run fixture-check` |')
+      .replace('- **Command:** `node --test test/one.test.js`', '- **Command:** run tests')
+      .replace('exit code 0 and one assertion for status value 1', 'looks good')
+      .replace('invalid input returns a deterministic error result', 'TBD')
+      .replace('`src/one.js` is invoked by the focused test', 'TBD');
+    writeRaw(path.join(invalid, 'tasks/task-R1-01-one.md'), weakTask);
+    const rejected = run(VALIDATOR, [invalid], ROOT);
+    assert.notEqual(rejected.status, 0);
+    assert.match(output(rejected), /Outcome must be substantive/);
+    assert.match(output(rejected), /Verification Plan requires a command-shaped invocation or justified N\/A/);
+    assert.match(output(rejected), /Verification Plan requires an observable Expected result/);
+    assert.match(output(rejected), /Verification Plan requires a negative-path disposition/);
+    assert.match(output(rejected), /Verification Plan requires a concrete reachability target or justified N\/A/);
+
+    const emptyExecution = createSpec(root, {
+      name: 'empty-steps-mapping-only-requirements',
+      task: task({ related: '`src/empty.js` | Read' })
+        .replace(/## Changes\n[\s\S]*?\n## Acceptance/, '## Changes\n\n## Acceptance'),
+    });
+    const emptyExecutionResult = run(VALIDATOR, [emptyExecution], ROOT);
+    assert.notEqual(emptyExecutionResult.status, 0);
+    assert.match(output(emptyExecutionResult), /Changes must be substantive|Changes must contain at least one substantive actionable checkbox/);
+
+    const justified = createSpec(root, {
+      name: 'justified-command-na',
+      task: task({ related: '`src/static-contract.js` | Read' }).replace(
+        '- **Command:** `node --test test/one.test.js`',
+        '- Command: N/A — no executable runtime exists because this task only inspects a static contract',
+      ),
+    });
+    const accepted = run(VALIDATOR, [justified], ROOT);
+    assert.equal(accepted.status, 0, output(accepted));
+
+    const projectSpecific = createSpec(root, {
+      name: 'project-specific-command-shape',
+      task: task({ related: '`src/project-specific.js` | Read' })
+        .replace('node --test test/one.test.js', 'npm run project-specific-check'),
+    });
+    const projectSpecificResult = run(VALIDATOR, [projectSpecific], ROOT);
+    assert.equal(projectSpecificResult.status, 0, output(projectSpecificResult));
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('all ready non-Direct specs require semantic design and coherent authoring timestamps', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-ready-lifecycle-'));
+
+  function readyFixture(name, mutate = () => {}) {
+    const specDir = createSpec(root, {
+      name,
+      task: task({ related: '`src/one.js` | Read' }),
+      spec: { workflow_policy: POLICY.workflowPolicySnapshot({ riskSignals: {} }) },
+    });
+    const specPath = path.join(specDir, 'spec.json');
+    const state = JSON.parse(fs.readFileSync(specPath, 'utf8'));
+    state.ready_for_implementation = true;
+    state.validation = { status: 'completed' };
+    state.updated_at = '2026-08-11T00:06:00+07:00';
+    state.timestamps = lifecycleTimestamps();
+    mutate(state, specDir);
+    write(specPath, JSON.stringify(state, null, 2));
+    completeSemanticReview(
+      specDir,
+      state.workflow_policy.assurance_level === 'Strict' ? 'independent' : 'same-session',
+    );
+    return specDir;
+  }
+
+  try {
+    const critical = readyFixture('critical-generic-design', (state, specDir) => {
+      state.workflow_policy = POLICY.workflowPolicySnapshot({ riskSignals: { auth: true }, assurance_level: 'Strict' });
+      state.timestamps = lifecycleTimestamps({ research: true });
+      write(path.join(specDir, 'design.md'), '# Design\n\n## Architecture\n\nThe implementation boundary is defined and appropriate.\n');
+    });
+    let result = run(VALIDATOR, [critical], ROOT);
+    assert.notEqual(result.status, 0);
+    assert.match(output(result), /design\.md: Critical readiness requires a grounded path\/code identifier/);
+
+    const strictAuthoring = readyFixture('critical-one-task-authoring', (state, specDir) => {
+      state.workflow_policy = POLICY.workflowPolicySnapshot({ riskSignals: { auth: true }, assurance_level: 'Strict' });
+      state.timestamps = lifecycleTimestamps({ research: true });
+      write(path.join(specDir, 'design.md'), criticalNoObligationDesign());
+    });
+    result = run(VALIDATOR, [strictAuthoring], ROOT);
+    assert.equal(result.status, 0, output(result));
+
+    const invalidCases = [
+      ['boolean-created-at', (state) => { state.created_at = true; }, /created_at: must be an ISO 8601 timestamp|created_at: ready handoff requires/],
+      ['boolean-task-time', (state) => { state.timestamps.tasks_done = true; }, /timestamps\.tasks_done: must be null or an ISO 8601 timestamp|ready handoff requires/],
+      ['missing-validation-time', (state) => { delete state.timestamps.validation_done; }, /timestamps\.validation_done: ready handoff requires/],
+      ['reversed-phase-time', (state) => { state.timestamps.design_done = '2026-08-11T00:00:30+07:00'; }, /final lifecycle timestamps must be ordered/],
+      ['mismatched-final-state', (state) => { state.updated_at = '2026-08-11T00:07:00+07:00'; }, /updated_at must describe the same final state/],
+    ];
+    for (const [name, mutate, expected] of invalidCases) {
+      const specDir = readyFixture(name, mutate);
+      result = run(VALIDATOR, [specDir], ROOT);
+      assert.notEqual(result.status, 0, `${name} unexpectedly passed`);
+      assert.match(output(result), expected);
+    }
+
+    const reviewDir = readyFixture('five-task-review-time', (state, specDir) => {
+      state.design_context = { validation_recommended: true };
+      for (let index = 2; index <= 5; index += 1) {
+        const taskPath = `tasks/task-R1-0${index}-review.md`;
+        state.task_files.push(taskPath);
+        state.task_registry[taskPath] = {
+          id: `R1-0${index}`, title: `Review ${index}`, status: 'pending', dependencies: [], blocker: null,
+          started_at: null, completed_at: null, last_updated_at: null,
+        };
+        write(path.join(specDir, taskPath), task({ id: `R1-0${index}`, related: `\`src/review-${index}.js\` | Read` }));
+      }
+    });
+    result = run(VALIDATOR, [reviewDir], ROOT);
+    assert.notEqual(result.status, 0);
+    assert.match(output(result), /timestamps\.review_done: required after validation for a large task graph/);
+
+    const reviewPath = path.join(reviewDir, 'spec.json');
+    const reviewState = JSON.parse(fs.readFileSync(reviewPath, 'utf8'));
+    reviewState.timestamps.review_done = '2026-08-11T00:05:00+07:00';
+    write(reviewPath, JSON.stringify(reviewState, null, 2));
+    result = run(VALIDATOR, [reviewDir], ROOT);
+    assert.equal(result.status, 0, output(result));
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('spec-ready excludes execution receipts while preserving Strict review state', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-spec-ready-'));
   try {
     const standardDir = createSpec(root, {
@@ -614,19 +1577,20 @@ test('spec-ready accepts pending execution evidence without an audit receipt', (
           tasks: { generated: true, agent_validated: true, user_approved: true },
         },
         validation: { status: 'completed' },
-        timestamps: { validation_done: '2026-08-11T00:00:00+07:00' },
+        updated_at: '2026-08-11T00:06:00+07:00',
+        timestamps: lifecycleTimestamps(),
       },
     });
-    write(path.join(standardDir, 'feature-receipt.md'), '# Feature Verification Receipt\n\nVerification: PENDING\n\nStatus: in_progress\n');
-    write(path.join(standardDir, 'tasks/task-R1-01-one.md'), `${fs.readFileSync(path.join(standardDir, 'tasks/task-R1-01-one.md'), 'utf8')}\nVerification: PENDING\n`);
+    completeSemanticReview(standardDir);
     const standardResult = run(VALIDATOR, [standardDir], ROOT);
     assert.equal(standardResult.status, 0, output(standardResult));
 
     const criticalDir = createSpec(root, {
       name: 'pending-critical',
       task: task({ related: '`src/pending-only.js` | Read' }),
+      design: criticalNoObligationDesign(),
       spec: {
-        workflow_policy: POLICY.workflowPolicySnapshot({ riskSignals: { auth: true } }),
+        workflow_policy: POLICY.workflowPolicySnapshot({ riskSignals: { auth: true }, assurance_level: 'Strict' }),
         ready_for_implementation: true,
         approvals: {
           requirements: { generated: true, agent_validated: true, user_approved: true },
@@ -634,9 +1598,11 @@ test('spec-ready accepts pending execution evidence without an audit receipt', (
           tasks: { generated: true, agent_validated: true, user_approved: true },
         },
         validation: { status: 'completed' },
-        timestamps: { validation_done: '2026-08-11T00:00:00+07:00' },
+        updated_at: '2026-08-11T00:06:00+07:00',
+        timestamps: lifecycleTimestamps({ research: true, review: true }),
       },
     });
+    completeSemanticReview(criticalDir, 'independent');
     const criticalResult = run(VALIDATOR, [criticalDir], ROOT);
     assert.equal(criticalResult.status, 0, output(criticalResult));
   } finally {
@@ -644,7 +1610,7 @@ test('spec-ready accepts pending execution evidence without an audit receipt', (
   }
 });
 
-test('P1 bounded Standard validates without a task registry and fails closed on receipt or policy shape errors', () => {
+test('Specs v2 Compact validates without task registry or premature receipt and fails closed on policy shape errors', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-bounded-'));
   try {
     const specDir = createBoundedSpec(root);
@@ -655,12 +1621,11 @@ test('P1 bounded Standard validates without a task registry and fails closed on
     assert.equal(Object.hasOwn(persisted, 'task_files'), false);
     assert.equal(Object.hasOwn(persisted, 'task_registry'), false);
 
-    fs.unlinkSync(path.join(specDir, 'feature-receipt.md'));
-    const missingReceipt = run(VALIDATOR, [specDir], ROOT);
-    assert.notEqual(missingReceipt.status, 0);
-    assert.match(output(missingReceipt), /feature-receipt\.md: required/);
-
     write(path.join(specDir, 'feature-receipt.md'), '# Feature Verification Receipt\n\nVerification: PENDING\n\nStatus: in_progress\n\nBlocker: awaiting execution proof\n');
+    const prematureReceipt = run(VALIDATOR, [specDir], ROOT);
+    assert.notEqual(prematureReceipt.status, 0);
+    assert.match(output(prematureReceipt), /premature execution receipt/);
+    fs.unlinkSync(path.join(specDir, 'feature-receipt.md'));
     const malformed = JSON.parse(fs.readFileSync(path.join(specDir, 'spec.json'), 'utf8'));
     malformed.workflow_policy.extra = true;
     fs.writeFileSync(path.join(specDir, 'spec.json'), JSON.stringify(malformed, null, 2));
@@ -672,7 +1637,7 @@ test('P1 bounded Standard validates without a task registry and fails closed on
   }
 });
 
-test('P1 Standard scaffold remains bounded while Critical risk requires a task bundle', () => {
+test('Specs v2 scaffold keeps planning artifacts independent from assurance and task topology', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-scaffold-lanes-'));
   try {
     const scaffoldSource = fs.readFileSync(SCAFFOLD, 'utf8');
@@ -687,75 +1652,89 @@ test('P1 Standard scaffold remains bounded while Critical risk requires a task b
     assert.equal(standard.status, 0, output(standard));
     const standardDir = path.join(root, 'specs', 'bounded-standard');
     const standardSpec = JSON.parse(fs.readFileSync(path.join(standardDir, 'spec.json'), 'utf8'));
-    assert.equal(standardSpec.workflow_policy.lane, 'Standard');
-    assert.deepEqual(standardSpec.workflow_policy.proof_obligations, ['needsInspection', 'needsExecutionProof']);
+    assert.equal(POLICY.readWorkflowPolicySnapshot(standardSpec).lane, 'Standard');
+    assert.deepEqual(POLICY.readWorkflowPolicySnapshot(standardSpec).proof_obligations, ['needsExecutionProof']);
     assert.equal(fs.existsSync(path.join(standardDir, 'tasks')), false);
     assert.equal(fs.existsSync(path.join(standardDir, 'task_registry')), false);
+    assert.equal(standardSpec.validation.semantic_review.status, 'not-run');
+    assert.equal(fs.existsSync(path.join(standardDir, 'semantic-review.md')), false);
+    write(path.join(standardDir, 'requirements.md'), '# Requirements\n\n### Requirement 1: One\n\n- **R1.1** The scaffolded command shall return status value 1.\n- **R1.2** The proof shall reject an invalid status result.\n');
+    write(path.join(standardDir, 'design.md'), designFixture21());
+    const standardPromoted = run(SCAFFOLD, ['bounded-standard', '--sync-semantic-model'], root);
+    assert.equal(standardPromoted.status, 0, output(standardPromoted));
     const standardValidation = run(VALIDATOR, [standardDir], ROOT);
     assert.equal(standardValidation.status, 0, output(standardValidation));
 
-    const critical = run(SCAFFOLD, ['critical-risk', '--risks', 'auth'], root);
-    assert.equal(critical.status, 2, output(critical));
-    assert.match(output(critical), /Critical workflow policy requires a task bundle/);
+    const elevated = run(SCAFFOLD, ['elevated-risk', '--risks', 'auth'], root);
+    assert.equal(elevated.status, 0, output(elevated));
+    const elevatedTaskless = JSON.parse(fs.readFileSync(path.join(root, 'specs/elevated-risk/spec.json'), 'utf8'));
+    assert.equal(elevatedTaskless.workflow_policy.planning_depth, 'Compact');
+    assert.equal(elevatedTaskless.workflow_policy.assurance_level, 'Elevated');
+    assert.equal(elevatedTaskless.workflow_policy.classified_minimum.assurance_level, 'Elevated');
+    assert.deepEqual(elevatedTaskless.coordination, { boundaries: [] });
+    assert.equal(fs.existsSync(path.join(root, 'specs/elevated-risk/research.md')), false);
+    assert.equal(elevatedTaskless.validation.semantic_review.status, 'not-run');
+    assert.equal(elevatedTaskless.authoring.tasks, 'absent');
+
+    const strict = run(SCAFFOLD, ['strict-opt-in', '--risks', 'auth', '--assurance-level', 'Strict'], root);
+    assert.equal(strict.status, 0, output(strict));
+    const strictTaskless = JSON.parse(fs.readFileSync(path.join(root, 'specs/strict-opt-in/spec.json'), 'utf8'));
+    assert.equal(strictTaskless.workflow_policy.assurance_level, 'Strict');
+    assert.equal(strictTaskless.workflow_policy.classified_minimum.assurance_level, 'Elevated');
+    assert.equal(strictTaskless.authoring.tasks, 'absent');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
 
-    const criticalHappy = run(SCAFFOLD, [
-      'critical-happy',
-      '--risks', 'auth',
-      '--tasks', 'R1-01-artifact',
+test('Full phase scaffold fills canonical 2.1 artifacts and passes E2E validation', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-scaffold-full-phase-'));
+  try {
+    const phase = [{
+      id: 'delivery',
+      task_ids: ['R1-01', 'R1-02'],
+      entry_condition: 'requirements and design are approved',
+      exit_condition: 'task verification plan is complete',
+      owner_boundary: 'B-T',
+    }];
+    const result = run(SCAFFOLD, [
+      'full-phase', '--planning-depth', 'Full', '--tasks', 'R1-01-artifact,R1-02-consumer',
+      '--boundaries', JSON.stringify([{
+        id: 'B-T', type: 'transition', design_ref: 'T1', owner: 'R1-01', consumers: ['R1-02'],
+        precondition: 'Input is ready for transition', postcondition: 'Output is durably complete',
+        failure: 'Failure state is recorded', recovery: 'Recovery resumes from recorded state',
+      }]), '--phases', JSON.stringify(phase),
     ], root);
-    assert.equal(criticalHappy.status, 0, output(criticalHappy));
-    const criticalDir = path.join(root, 'specs', 'critical-happy');
-    const criticalSpec = JSON.parse(fs.readFileSync(path.join(criticalDir, 'spec.json'), 'utf8'));
-    assert.equal(criticalSpec.workflow_policy.lane, 'Critical');
-    assert.equal(criticalSpec.workflow_policy.artifact_profile, 'strict');
-    assert.deepEqual(criticalSpec.workflow_policy.proof_obligations, [
-      'needsInspection',
-      'needsExecutionProof',
-      'needsIndependentAudit',
-      'needsResearchGrounding',
-    ]);
-    assert.deepEqual(criticalSpec.task_files, ['tasks/task-R1-01-artifact.md']);
-    assert.equal(fs.existsSync(path.join(criticalDir, 'research.md')), true);
-    completeScaffoldedSpec(criticalDir);
-    const criticalValidation = run(VALIDATOR, [criticalDir], ROOT);
-    assert.equal(criticalValidation.status, 0, output(criticalValidation));
+    assert.equal(result.status, 0, output(result));
+    const specDir = path.join(root, 'specs/full-phase');
+    const spec = JSON.parse(fs.readFileSync(path.join(specDir, 'spec.json'), 'utf8'));
+    assert.deepEqual(spec.coordination.phases, phase);
+    assert.equal(spec.coordination.boundaries[0].type, 'transition');
+    completeScaffoldedSpec21(specDir);
+    const validation = run(VALIDATOR, [specDir], ROOT);
+    assert.equal(validation.status, 0, output(validation));
   } finally {
     fs.rmSync(root, { recursive: true, force: true });
   }
 });
 
-test('producer scaffold emits optional artifacts and validator accepts or rejects the canonical shape', () => {
+test('producer scaffold projects typed dependency deliverable into registry edges', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-artifacts-'));
   try {
-    const ordinary = run(SCAFFOLD, ['ordinary', '--tasks', 'R1-01-artifact'], root);
+    const ordinary = run(SCAFFOLD, [
+      'ordinary', '--tasks', 'R1-01-artifact,R1-02-consumer',
+      '--boundaries', JSON.stringify([{
+        id: 'B-D', type: 'dependency', producer: 'R1-01', consumer: 'R1-02',
+        deliverable: 'artifacts/output.json',
+      }]),
+    ], root);
     assert.equal(ordinary.status, 0, output(ordinary));
     const ordinarySpec = JSON.parse(fs.readFileSync(path.join(root, 'specs/ordinary/spec.json'), 'utf8'));
     assert.equal(Object.hasOwn(ordinarySpec.task_registry['tasks/task-R1-01-artifact.md'], 'artifacts'), false);
-    completeScaffoldedSpec(path.join(root, 'specs/ordinary'));
-    const ordinaryAfterFill = run(VALIDATOR, [path.join(root, 'specs/ordinary')], ROOT);
-    assert.equal(ordinaryAfterFill.status, 0, output(ordinaryAfterFill));
-
-    const declared = run(SCAFFOLD, [
-      'declared',
-      '--tasks',
-      'R1-01-artifact',
-      '--artifacts',
-      JSON.stringify({ 'R1-01-artifact': ['dist/output.js'] }),
-    ], root);
-    assert.equal(declared.status, 0, output(declared));
-    const declaredDir = path.join(root, 'specs/declared');
-    const declaredSpec = completeScaffoldedSpec(declaredDir);
-    assert.deepEqual(declaredSpec.task_registry['tasks/task-R1-01-artifact.md'].artifacts, ['dist/output.js']);
-    const declaredValidation = run(VALIDATOR, [declaredDir], ROOT);
-    assert.equal(declaredValidation.status, 0, output(declaredValidation));
-
-    const malformedPath = path.join(declaredDir, 'spec.json');
-    const malformedSpec = JSON.parse(fs.readFileSync(malformedPath, 'utf8'));
-    malformedSpec.task_registry['tasks/task-R1-01-artifact.md'].artifacts = ['../outside'];
-    fs.writeFileSync(malformedPath, JSON.stringify(malformedSpec, null, 2));
-    const malformedValidation = run(VALIDATOR, [declaredDir], ROOT);
-    assert.notEqual(malformedValidation.status, 0);
-    assert.match(output(malformedValidation), /task_registry.*artifacts.*safe relative path/);
+    assert.deepEqual(ordinarySpec.task_registry['tasks/task-R1-02-consumer.md'].dependencies, [
+      'tasks/task-R1-01-artifact.md',
+    ]);
+    assert.equal(ordinarySpec.coordination.boundaries[0].deliverable, 'artifacts/output.json');
   } finally {
     fs.rmSync(root, { recursive: true, force: true });
   }
@@ -784,46 +1763,84 @@ test('validator rejects missing explicit requirement and sub-criterion mappings'
     const partialResult = run(VALIDATOR, [partial], ROOT);
     assert.notEqual(partialResult.status, 0);
     assert.match(output(partialResult), /R1\.2: acceptance criterion not covered/);
+
+    const standardUnknown = createSpec(root, {
+      name: 'standard-unknown-mapping',
+      task: task({ mapping: '1.1, 9.1' }),
+      spec: { workflow_policy: POLICY.workflowPolicySnapshot({ riskSignals: {} }) },
+    });
+    const standardUnknownResult = run(VALIDATOR, [standardUnknown], ROOT);
+    assert.notEqual(standardUnknownResult.status, 0);
+    assert.match(output(standardUnknownResult), /references unknown requirement R9/);
   } finally {
     fs.rmSync(root, { recursive: true, force: true });
   }
 });
 
-test('validator rejects unknown, missing, and divergent contract copies', () => {
+test('v1 adapter rejects unknown, missing, and divergent contract copies', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-contract-'));
-  const design = '# Design\n\n<!-- contract:PAYLOAD -->\n```json\n{ "id": 1 }\n```\n';
-  try {
-    const unknown = createSpec(root, {
-      name: 'unknown', design,
-      task: task({ extra: 'Contracts: MISSING\n' }),
+  const design = `${designFixture()}<!-- contract:PAYLOAD -->\n\`\`\`json\n{ "id": 1 }\n\`\`\`\n`;
+  function contractFixture(name, { designText = design, extra = '' } = {}) {
+    return createSpec(root, {
+      name,
+      design: designText,
+      task: legacyTask({ extra }),
+      spec: { workflow_policy: legacyWorkflowPolicy() },
     });
+  }
+  try {
+    const unknown = contractFixture('unknown', { extra: 'Contracts: MISSING\n' });
     let result = run(VALIDATOR, [unknown], ROOT);
     assert.notEqual(result.status, 0);
     assert.match(output(result), /unknown contract "MISSING"/);
 
-    const noCanonical = createSpec(root, {
-      name: 'no-canonical',
-      task: task({ extra: 'Contracts: PAYLOAD\n' }),
+    const noCanonical = contractFixture('no-canonical', {
+      designText: designFixture(),
+      extra: 'Contracts: PAYLOAD\n',
     });
     result = run(VALIDATOR, [noCanonical], ROOT);
     assert.notEqual(result.status, 0);
     assert.match(output(result), /defines no canonical contract blocks/);
 
-    const missing = createSpec(root, {
-      name: 'missing', design,
-      task: task({ extra: 'Contracts: PAYLOAD\n' }),
-    });
+    const missing = contractFixture('missing', { extra: 'Contracts: PAYLOAD\n' });
     result = run(VALIDATOR, [missing], ROOT);
     assert.notEqual(result.status, 0);
     assert.match(output(result), /contract "PAYLOAD" is missing/);
 
-    const divergent = createSpec(root, {
-      name: 'divergent', design,
-      task: task({ extra: 'Contracts: PAYLOAD\n\n```json\n{ "id": 2 }\n```\n' }),
+    const divergent = contractFixture('divergent', {
+      extra: 'Contracts: PAYLOAD\n\n```json\n{ "id": 2 }\n```\n',
     });
     result = run(VALIDATOR, [divergent], ROOT);
     assert.notEqual(result.status, 0);
     assert.match(output(result), /contract "PAYLOAD" body diverges/);
+
+    const duplicateDesign = contractFixture('duplicate-design-contract', {
+      designText: `${design}\n<!-- contract:PAYLOAD -->\n\`\`\`json\n{ "id": 1 }\n\`\`\`\n`,
+    });
+    result = run(VALIDATOR, [duplicateDesign], ROOT);
+    assert.notEqual(result.status, 0);
+    assert.match(output(result), /duplicate canonical contract definition "PAYLOAD"/);
+
+    const repeatedDeclaration = contractFixture('repeated-task-contract-line', {
+      extra: 'Contracts: PAYLOAD\nContracts: PAYLOAD\n\n```json\n{ "id": 1 }\n```\n',
+    });
+    result = run(VALIDATOR, [repeatedDeclaration], ROOT);
+    assert.notEqual(result.status, 0);
+    assert.match(output(result), /Contracts declaration must appear at most once/);
+
+    const duplicateName = contractFixture('duplicate-task-contract-name', {
+      extra: 'Contracts: PAYLOAD, PAYLOAD\n\n```json\n{ "id": 1 }\n```\n',
+    });
+    result = run(VALIDATOR, [duplicateName], ROOT);
+    assert.notEqual(result.status, 0);
+    assert.match(output(result), /Contracts declaration contains duplicate name "PAYLOAD"/);
+
+    const orphanTagged = contractFixture('orphan-tagged-contract', {
+      extra: '<!-- contract:PAYLOAD -->\n```json\n{ "id": 1 }\n```\n',
+    });
+    result = run(VALIDATOR, [orphanTagged], ROOT);
+    assert.notEqual(result.status, 0);
+    assert.match(output(result), /must declare it on one Contracts: line/);
   } finally {
     fs.rmSync(root, { recursive: true, force: true });
   }
@@ -841,8 +1858,8 @@ test('validator rejects invalid ready approval and validation transitions', () =
     });
     const result = run(VALIDATOR, [specDir], ROOT);
     assert.notEqual(result.status, 0);
-    assert.match(output(result), /requires generated and agent_validated and user_approved requirements evidence/);
-    assert.match(output(result), /requires generated and agent_validated and user_approved design evidence/);
+    assert.match(output(result), /requires generated and agent_validated requirements evidence/);
+    assert.match(output(result), /requires generated and agent_validated design evidence/);
     assert.match(output(result), /validation evidence is incomplete/);
 
     // Legacy approved field must fail closed with migration guidance
@@ -875,6 +1892,37 @@ test('validator rejects invalid ready approval and validation transitions', () =
   }
 });
 
+test('validator rejects precise square-bracket placeholders without flagging links or checkboxes', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-square-placeholders-'));
+  try {
+    for (const [name, placeholder] of [
+      ['specific-value', '[specific value]'],
+      ['target-users', '[target users]'],
+      ['component-name', '[Component Name]'],
+    ]) {
+      const specDir = createSpec(root, {
+        name,
+        task: task({ related: '`src/placeholder.js` | Read' }).replace(
+          'Implement the mapped observable behavior.',
+          `Implement the mapped ${placeholder} behavior.`,
+        ),
+      });
+      const result = run(VALIDATOR, [specDir], ROOT);
+      assert.notEqual(result.status, 0);
+      assert.match(output(result), /unresolved square-bracket placeholder/);
+    }
+
+    const safe = createSpec(root, {
+      name: 'safe-link-checkbox',
+      task: `${task({ related: '`src/safe.js` | Read' })}\n[Component Name](https://example.invalid)\n- [ ] Keep this real checkbox.\n`,
+    });
+    const safeResult = run(VALIDATOR, [safe], ROOT);
+    assert.equal(safeResult.status, 0, output(safeResult));
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test('validator rejects malformed Related Files and dependency topology', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-shape-'));
   try {
@@ -886,7 +1934,8 @@ test('validator rejects malformed Related Files and dependency topology', () =>
     ]) {
       const specDir = createSpec(root, {
         name,
-        task: related ? task({ related }) : task({ related: 'Path | Action | Description\n|---|---|---|' }),
+        task: legacyTask({ relatedRows: related ? `| ${related} | Invalid fixture row |` : '' }),
+        spec: { workflow_policy: legacyWorkflowPolicy() },
       });
       const result = run(VALIDATOR, [specDir], ROOT);
       assert.notEqual(result.status, 0);
@@ -896,10 +1945,19 @@ test('validator rejects malformed Related Files and dependency topology', () =>
     const cycle = createSpec(root, { name: 'cycle' });
     const statePath = path.join(cycle, 'spec.json');
     const state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
+    state.coordination.task_triggers = ['distinct_ownership', 'real_dependency'];
     state.task_files.push('tasks/task-R1-02-two.md');
     state.task_registry['tasks/task-R1-01-one.md'].dependencies = ['tasks/task-R1-02-two.md'];
     state.task_registry['tasks/task-R1-02-two.md'] = { id: 'R1-02', title: 'Two', status: 'pending', dependencies: ['tasks/task-R1-01-one.md'], blocker: null, started_at: null, completed_at: null, last_updated_at: null };
-    write(path.join(cycle, 'tasks/task-R1-02-two.md'), task({ related: '`src/two.js` | Modify' }));
+    write(path.join(cycle, 'tasks/task-R1-01-one.md'), task({
+      related: '`src/one.js` | Read',
+      dependencies: 'tasks/task-R1-02-two.md',
+    }));
+    write(path.join(cycle, 'tasks/task-R1-02-two.md'), task({
+      id: 'R1-02',
+      related: '`src/two.js` | Read',
+      dependencies: 'tasks/task-R1-01-one.md',
+    }));
     write(statePath, JSON.stringify(state, null, 2));
     const cycleResult = run(VALIDATOR, [cycle], ROOT);
     assert.notEqual(cycleResult.status, 0);
@@ -913,7 +1971,11 @@ test('validator rejects malformed Related Files and dependency topology', () =>
     const orderingState = JSON.parse(fs.readFileSync(orderingStatePath, 'utf8'));
     orderingState.task_files.push('tasks/task-R1-02-two.md');
     orderingState.task_registry['tasks/task-R1-02-two.md'] = { id: 'R1-02', title: 'Two', status: 'pending', dependencies: [], blocker: null, started_at: null, completed_at: null, last_updated_at: null };
-    write(path.join(ordering, 'tasks/task-R1-02-two.md'), task({ related: '`src/generated.js` | Modify' }));
+    write(path.join(ordering, 'tasks/task-R1-02-two.md'), task({
+      id: 'R1-02',
+      related: '`src/generated.js` | Modify',
+      relatedRows: '| `src/generated.js` | Modify | Consume generated implementation |',
+    }));
     write(orderingStatePath, JSON.stringify(orderingState, null, 2));
     const orderingResult = run(VALIDATOR, [ordering], ROOT);
     assert.notEqual(orderingResult.status, 0);
@@ -923,6 +1985,608 @@ test('validator rejects malformed Related Files and dependency topology', () =>
   }
 });
 
+test('scaffold validates one dependency map before writes and persists canonical registry edges', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-scaffold-dependencies-'));
+  const taskList = 'R1-01-owner,R1-02-consumer';
+  const dependencyMap = JSON.stringify([{
+    id: 'B-D', type: 'dependency', producer: 'R1-01', consumer: 'R1-02',
+    deliverable: 'artifacts/owner-output.json',
+  }]);
+  try {
+    const standard = run(SCAFFOLD, [
+      'dependency-positive', '--lane', 'Standard', '--tasks', taskList,
+      '--boundaries', dependencyMap,
+    ], root);
+    assert.equal(standard.status, 0, output(standard));
+    const standardDir = path.join(root, 'specs/dependency-positive');
+    const standardSpec = JSON.parse(fs.readFileSync(path.join(standardDir, 'spec.json'), 'utf8'));
+    assert.deepEqual(
+      standardSpec.task_registry['tasks/task-R1-02-consumer.md'].dependencies,
+      ['tasks/task-R1-01-owner.md'],
+    );
+    assert.deepEqual(standardSpec.coordination.boundaries, JSON.parse(dependencyMap));
+    const standardTask = fs.readFileSync(
+      path.join(standardDir, 'tasks/task-R1-02-consumer.md'),
+      'utf8',
+    );
+    assert.doesNotMatch(standardTask, /^## Execution Closure/m);
+    assert.doesNotMatch(
+      fs.readFileSync(path.join(standardDir, 'design.md'), 'utf8'),
+      /^## Execution Closure/m,
+    );
+
+    const invalid = run(SCAFFOLD, [
+      'dependency-invalid', '--tasks', taskList, '--boundaries', JSON.stringify([{
+        id: 'B-D', type: 'dependency', producer: 'R1-01', consumer: 'R1-02',
+      }]),
+    ], root);
+    assert.equal(invalid.status, 2, output(invalid));
+    assert.match(output(invalid), /fields must be exactly.*deliverable|dependency fields must be exactly/);
+    assert.equal(fs.existsSync(path.join(root, 'specs/dependency-invalid')), false);
+
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('task-level (P) requires dependency-free and non-overlapping task ownership', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-parallel-'));
+  const ownerPath = 'tasks/task-R1-01-one.md';
+  const siblingPath = 'tasks/task-R1-02-two.md';
+
+  function parallelFixture(name, { dependency = false, overlap = false } = {}) {
+    const ownerTask = task({
+      related: overlap ? '`src/shared.js` | Read' : '`src/parallel-a.js` | Read',
+      relatedRows: overlap
+        ? '| `src/shared.js` | Read | Inspect existing |\n| `src/shared.js` | Modify | Update owned behavior |'
+        : null,
+      parallel: true,
+    });
+    const specDir = createSpec(root, { name, task: ownerTask });
+    const statePath = path.join(specDir, 'spec.json');
+    const state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
+    state.coordination.task_triggers = dependency
+      ? ['parallel_coordination', 'real_dependency', 'separate_proof']
+      : ['parallel_coordination', 'separate_proof'];
+    state.task_files.push(siblingPath);
+    state.task_registry[siblingPath] = {
+      id: 'R1-02', title: 'Two', status: 'pending',
+      dependencies: dependency ? [ownerPath] : [],
+      blocker: null, started_at: null, completed_at: null, last_updated_at: null,
+    };
+    const sibling = task({
+      id: 'R1-02',
+      related: overlap ? '`src/shared.js` | Read' : '`src/parallel-b.js` | Read',
+      dependencies: dependency ? ownerPath : 'none',
+      parallel: dependency,
+    });
+    write(path.join(specDir, siblingPath), sibling);
+    write(statePath, JSON.stringify(state, null, 2));
+    return specDir;
+  }
+
+  try {
+    const valid = parallelFixture('parallel-valid');
+    assert.equal(run(VALIDATOR, [valid], ROOT).status, 0);
+
+    const dependency = parallelFixture('parallel-dependency', { dependency: true });
+    const dependencyResult = run(VALIDATOR, [dependency], ROOT);
+    assert.notEqual(dependencyResult.status, 0);
+    assert.match(output(dependencyResult), /task-level \(P\) cannot declare sibling dependencies/);
+
+    const overlap = parallelFixture('parallel-overlap', { overlap: true });
+    const overlapResult = run(VALIDATOR, [overlap], ROOT);
+    assert.notEqual(overlapResult.status, 0);
+    assert.match(output(overlapResult), /task-level \(P\) has Related Files contention on src\/shared\.js/);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('validator rejects dependency drift and non-canonical readiness statuses', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-readiness-'));
+  const ownerPath = 'tasks/task-R1-01-one.md';
+  const consumerPath = 'tasks/task-R1-02-two.md';
+  try {
+    const driftDir = createSpec(root, {
+      name: 'dependency-aligned',
+      task: task({ related: '`src/owner.js` | Read' }),
+    });
+    const driftStatePath = path.join(driftDir, 'spec.json');
+    const driftState = JSON.parse(fs.readFileSync(driftStatePath, 'utf8'));
+    driftState.coordination.task_triggers = ['real_dependency', 'separate_proof'];
+    driftState.task_files.push(consumerPath);
+    driftState.task_registry[consumerPath] = {
+      id: 'R1-02', title: 'Two', status: 'pending', dependencies: [ownerPath], blocker: null,
+      started_at: null, completed_at: null, last_updated_at: null,
+    };
+    write(
+      path.join(driftDir, consumerPath),
+      task({
+        id: 'R1-02',
+        related: '`src/consumer.js` | Read',
+        dependencies: ownerPath,
+      }),
+    );
+    write(driftStatePath, JSON.stringify(driftState, null, 2));
+    const aligned = run(VALIDATOR, [driftDir], ROOT);
+    assert.equal(aligned.status, 0, output(aligned));
+
+    const consumerFile = path.join(driftDir, consumerPath);
+    write(
+      consumerFile,
+      fs.readFileSync(consumerFile, 'utf8').replace(
+        `- ${ownerPath}\n\n## Verification Plan`,
+        '- none\n\n## Verification Plan',
+      ),
+    );
+    const drifted = run(VALIDATOR, [driftDir], ROOT);
+    assert.notEqual(drifted.status, 0);
+    assert.match(output(drifted), /dependency drift between spec\.json task_registry/);
+
+    const duplicateHeader = createSpec(root, {
+      name: 'duplicate-dependency-section',
+      task: `${task({ related: '`src/duplicate.js` | Read' })}\n## Dependencies\n\n- none\n`,
+    });
+    const duplicateHeaderResult = run(VALIDATOR, [duplicateHeader], ROOT);
+    assert.notEqual(duplicateHeaderResult.status, 0);
+    assert.match(output(duplicateHeaderResult), /machine-read section Dependencies.*must appear at most once/);
+
+    const duplicateSections = createSpec(root, {
+      name: 'duplicate-machine-sections',
+      task: `${task({ related: '`src/duplicate-sections.js` | Read' })}\n` +
+        '## Verification Plan\n- **Command:** `npm test`\n\n' +
+        '## Acceptance\n- **R1.1:** conflicting duplicate mapping\n',
+    });
+    const duplicateSectionsResult = run(VALIDATOR, [duplicateSections], ROOT);
+    assert.notEqual(duplicateSectionsResult.status, 0);
+    assert.match(output(duplicateSectionsResult), /machine-read section Verification Plan.*must appear at most once/);
+    assert.match(output(duplicateSectionsResult), /machine-read section Acceptance.*must appear at most once/);
+
+    const ordinary = createSpec(root, {
+      name: 'ordinary-in-progress',
+      task: task({ related: '`src/ordinary.js` | Read', status: 'in_progress' }),
+      spec: {
+        task_registry: {
+          [ownerPath]: {
+            id: 'R1-01', title: 'One', status: 'in_progress', dependencies: [], blocker: null,
+            started_at: '2026-08-12T00:00:00+07:00', completed_at: null,
+            last_updated_at: '2026-08-12T00:01:00+07:00',
+            artifacts: ['test/one.test.js'],
+          },
+        },
+      },
+    });
+    const ordinaryResult = run(VALIDATOR, [ordinary], ROOT);
+    assert.equal(ordinaryResult.status, 0, output(ordinaryResult));
+
+    const ordinaryStatePath = path.join(ordinary, 'spec.json');
+    const ordinaryState = JSON.parse(fs.readFileSync(ordinaryStatePath, 'utf8'));
+    const ordinaryTaskPath = path.join(ordinary, ownerPath);
+    write(
+      ordinaryTaskPath,
+      fs.readFileSync(ordinaryTaskPath, 'utf8')
+        .replace(/\n## Dependencies\n[\s\S]*?(?=\n## Verification Plan)/, ''),
+    );
+    ordinaryState.ready_for_implementation = true;
+    ordinaryState.validation = { status: 'completed' };
+    ordinaryState.timestamps = { validation_done: '2026-08-12T00:00:00+07:00' };
+    write(ordinaryStatePath, JSON.stringify(ordinaryState, null, 2));
+    const readyWithoutHeader = run(VALIDATOR, [ordinary], ROOT);
+    assert.notEqual(readyWithoutHeader.status, 0);
+    assert.match(output(readyWithoutHeader), /missing Dependencies/);
+
+    const invalidCases = [
+      ['bad-ready-type', (state) => { state.ready_for_implementation = 'true'; }, /ready_for_implementation: must be a boolean/],
+      ['bad-spec-status', (state) => { state.status = 'ready'; }, /spec\.json\.status: must be one of/],
+      ['bad-task-status', (state) => { state.task_registry[ownerPath].status = 'ready'; }, /task_registry.*status: must be one of/],
+      ['bad-validation-shape', (state) => { state.validation = 'not-run'; }, /validation: must be an object/],
+      [
+        'registry-id-path-drift',
+        (state) => { state.task_registry[ownerPath].id = 'R9-99'; },
+        /task_registry id must match path-derived id R1-01/,
+      ],
+      [
+        'markdown-heading-id-drift',
+        (_state, specDir) => {
+          const taskFile = path.join(specDir, ownerPath);
+          write(taskFile, fs.readFileSync(taskFile, 'utf8').replace('# Task R1-01:', '# Task R9-99:'));
+        },
+        /Markdown heading id R9-99 must match path-derived id R1-01/,
+      ],
+      [
+        'registry-markdown-status-drift',
+        (state) => {
+          state.task_registry[ownerPath].status = 'done';
+          state.task_registry[ownerPath].started_at = '2026-08-12T00:00:00+07:00';
+          state.task_registry[ownerPath].completed_at = '2026-08-12T00:01:00+07:00';
+          state.task_registry[ownerPath].last_updated_at = '2026-08-12T00:01:00+07:00';
+        },
+        /status drift between spec\.json task_registry done and Markdown Status header pending/,
+      ],
+      [
+        'done-missing-lifecycle-timestamps',
+        (state, specDir) => {
+          state.task_registry[ownerPath].status = 'done';
+          const taskFile = path.join(specDir, ownerPath);
+          write(taskFile, fs.readFileSync(taskFile, 'utf8').replace('**Status:** pending', '**Status:** done'));
+        },
+        /done status requires started_at, completed_at, and last_updated_at timestamps/,
+      ],
+      [
+        'blocked-missing-blocker',
+        (state, specDir) => {
+          state.task_registry[ownerPath].status = 'blocked';
+          state.task_registry[ownerPath].last_updated_at = '2026-08-12T00:01:00+07:00';
+          const taskFile = path.join(specDir, ownerPath);
+          write(taskFile, fs.readFileSync(taskFile, 'utf8').replace('**Status:** pending', '**Status:** blocked'));
+        },
+        /blocked status requires a non-empty blocker/,
+      ],
+      [
+        'in-progress-with-blocker',
+        (state, specDir) => {
+          state.task_registry[ownerPath].status = 'in_progress';
+          state.task_registry[ownerPath].blocker = 'waiting on owner';
+          state.task_registry[ownerPath].started_at = '2026-08-12T00:00:00+07:00';
+          state.task_registry[ownerPath].last_updated_at = '2026-08-12T00:01:00+07:00';
+          const taskFile = path.join(specDir, ownerPath);
+          write(taskFile, fs.readFileSync(taskFile, 'utf8').replace('**Status:** pending', '**Status:** in_progress'));
+        },
+        /in_progress status requires blocker null/,
+      ],
+      [
+        'in-progress-reversed-timestamps',
+        (state, specDir) => {
+          state.task_registry[ownerPath].status = 'in_progress';
+          state.task_registry[ownerPath].started_at = '2026-08-12T00:02:00+07:00';
+          state.task_registry[ownerPath].last_updated_at = '2026-08-12T00:01:00+07:00';
+          const taskFile = path.join(specDir, ownerPath);
+          write(taskFile, fs.readFileSync(taskFile, 'utf8').replace('**Status:** pending', '**Status:** in_progress'));
+        },
+        /in_progress timestamps must satisfy started_at <= last_updated_at/,
+      ],
+      [
+        'started-blocked-reversed-timestamps',
+        (state, specDir) => {
+          state.task_registry[ownerPath].status = 'blocked';
+          state.task_registry[ownerPath].blocker = 'waiting for the declared external authority';
+          state.task_registry[ownerPath].started_at = '2026-08-12T00:02:00+07:00';
+          state.task_registry[ownerPath].last_updated_at = '2026-08-12T00:01:00+07:00';
+          const taskFile = path.join(specDir, ownerPath);
+          write(taskFile, fs.readFileSync(taskFile, 'utf8').replace('**Status:** pending', '**Status:** blocked'));
+        },
+        /started blocked timestamps must satisfy started_at <= last_updated_at/,
+      ],
+      [
+        'bad-validation-status',
+        (state) => {
+          state.ready_for_implementation = true;
+          state.validation = { status: 'ready' };
+          state.timestamps = { validation_done: '2026-08-12T00:00:00+07:00' };
+        },
+        /validation\.status: must be one of|requires validation\.status completed/,
+      ],
+      [
+        'blocked-ready',
+        (state, specDir) => {
+          state.ready_for_implementation = true;
+          state.status = 'blocked';
+          state.blocker = 'owner unavailable';
+          state.validation = { status: 'completed' };
+          state.timestamps = { validation_done: '2026-08-12T00:00:00+07:00' };
+          state.task_registry[ownerPath].status = 'blocked';
+          const taskFile = path.join(specDir, ownerPath);
+          write(taskFile, fs.readFileSync(taskFile, 'utf8').replace('**Status:** pending', '**Status:** blocked'));
+        },
+        /cannot be blocked while ready_for_implementation is true/,
+      ],
+    ];
+    for (const [name, mutate, expected] of invalidCases) {
+      const specDir = createSpec(root, {
+        name,
+        task: task({ related: '`src/status.js` | Read' }),
+      });
+      const specPath = path.join(specDir, 'spec.json');
+      const state = JSON.parse(fs.readFileSync(specPath, 'utf8'));
+      mutate(state, specDir);
+      write(specPath, JSON.stringify(state, null, 2));
+      const result = run(VALIDATOR, [specDir], ROOT);
+      assert.notEqual(result.status, 0, `${name} unexpectedly passed`);
+      assert.match(output(result), expected);
+    }
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('v1 Critical implementation obligations validate ownership, references, closure, and proof', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-obligations-'));
+  const ownerPath = 'tasks/task-R1-01-one.md';
+  const consumerPath = 'tasks/task-R1-02-two.md';
+  const criticalPolicy = legacyWorkflowPolicy('Critical');
+
+  function makeFixture(name, mutate = () => {}, policy = criticalPolicy) {
+    const obligation = {
+      id: 'canonical-transition',
+      requirements: ['R1.1'],
+      canonical_state: 'Persisted transition state and allowed values',
+      authority: 'Owner module is the sole transition authority',
+      recovery: 'Retry reconciles the persisted state before continuing',
+      owner_task: ownerPath,
+      consumer_tasks: [consumerPath],
+      verification: 'node --test focused.test.js',
+      evidence: 'Exit 0 and the declared state transition is observed',
+    };
+    const specDir = createSpec(root, {
+      name,
+      task: task({ related: '`src/owner.js` | Read' }),
+      spec: { workflow_policy: policy },
+    });
+    const specPath = path.join(specDir, 'spec.json');
+    write(path.join(specDir, 'research.md'), '# Research\n\n## Evidence Summary\n\n- The auth-risk fixture requires independent grounding before implementation.\n');
+    const state = JSON.parse(fs.readFileSync(specPath, 'utf8'));
+    state.task_files.push(consumerPath);
+    state.task_registry[consumerPath] = {
+      id: 'R1-02', title: 'Two', status: 'pending', dependencies: [ownerPath], blocker: null,
+      started_at: null, completed_at: null, last_updated_at: null,
+    };
+    write(
+      path.join(specDir, consumerPath),
+      task({
+        id: 'R1-02',
+        related: '`src/consumer.js` | Read',
+        dependencies: ownerPath,
+        extra: executionClosure(obligation),
+      })
+        .replace('# Task R1-01: One', '# Task R1-02: Two'),
+    );
+    const ownerFile = path.join(specDir, ownerPath);
+    write(
+      ownerFile,
+      `${fs.readFileSync(ownerFile, 'utf8')}${executionClosure(obligation)}`,
+    );
+    const designFile = path.join(specDir, 'design.md');
+    write(
+      designFile,
+      `${fs.readFileSync(designFile, 'utf8')}${executionClosure(obligation)}`,
+    );
+    state.implementation_obligations = [obligation];
+    mutate(state, specDir);
+    write(specPath, JSON.stringify(state, null, 2));
+    return specDir;
+  }
+
+  try {
+    const omitted = createSpec(root, {
+      name: 'critical-omitted-obligation-decision',
+      spec: { workflow_policy: criticalPolicy },
+    });
+    write(path.join(omitted, 'research.md'), '# Research\n\n## Evidence Summary\n\n- The auth-risk fixture requires independent grounding before implementation.\n');
+    const omittedResult = run(VALIDATOR, [omitted], ROOT);
+    assert.notEqual(omittedResult.status, 0);
+    assert.match(output(omittedResult), /Critical scope must declare non-empty.*or one justified N\/A/);
+
+    const valid = makeFixture('valid-obligation');
+    const validResult = run(VALIDATOR, [valid], ROOT);
+    assert.equal(validResult.status, 0, output(validResult));
+
+    const tableClosure = makeFixture('valid-table-closure', (state, specDir) => {
+      const designFile = path.join(specDir, 'design.md');
+      const designPrefix = fs.readFileSync(designFile, 'utf8').split('\n## Execution Closure\n')[0];
+      write(designFile, `${designPrefix}${executionClosureTable(state.implementation_obligations[0])}`);
+    });
+    const tableClosureResult = run(VALIDATOR, [tableClosure], ROOT);
+    assert.equal(tableClosureResult.status, 0, output(tableClosureResult));
+
+    const swapped = makeFixture('marker-local-swapped-obligations', (state, specDir) => {
+      const first = state.implementation_obligations[0];
+      const second = {
+        ...first,
+        id: 'secondary-transition',
+        canonical_state: 'Secondary persisted state and terminal values',
+        authority: 'Secondary module is the sole transition authority',
+        recovery: 'Restart rolls the secondary state back before retry',
+        verification: 'node --test secondary-focused.test.js',
+        evidence: 'Exit 0 and the secondary persisted transition is observed',
+      };
+      state.implementation_obligations.push(second);
+      for (const taskFile of [ownerPath, consumerPath]) {
+        const filePath = path.join(specDir, taskFile);
+        write(filePath, `${fs.readFileSync(filePath, 'utf8')}\n${obligationClosureBlock(second)}`);
+      }
+      const designFile = path.join(specDir, 'design.md');
+      const designPrefix = fs.readFileSync(designFile, 'utf8').split('\n## Execution Closure\n')[0];
+      const firstWithSecondValues = { ...second, id: first.id };
+      const secondWithFirstValues = { ...first, id: second.id };
+      write(
+        designFile,
+        `${designPrefix}\n## Execution Closure\n\n` +
+          `${obligationClosureBlock(firstWithSecondValues)}\n${obligationClosureBlock(secondWithFirstValues)}`,
+      );
+    });
+    const swappedResult = run(VALIDATOR, [swapped], ROOT);
+    assert.notEqual(swappedResult.status, 0);
+    assert.match(output(swappedResult), /marker-local field/);
+
+    const cases = [
+      [
+        'standard-only-rejected',
+        () => {},
+        legacyWorkflowPolicy(),
+        /allowed only for Critical workflow policy/,
+      ],
+      [
+        'owner-must-be-one-task',
+        (state) => { state.implementation_obligations[0].owner_task = [ownerPath]; },
+        criticalPolicy,
+        /owner_task: must name exactly one registered task/,
+      ],
+      [
+        'unknown-requirement',
+        (state) => { state.implementation_obligations[0].requirements = ['R9.1']; },
+        criticalPolicy,
+        /unknown requirement reference R9\.1/,
+      ],
+      [
+        'unknown-consumer',
+        (state) => { state.implementation_obligations[0].consumer_tasks = ['tasks/task-R1-99-missing.md']; },
+        criticalPolicy,
+        /unknown task reference tasks\/task-R1-99-missing\.md/,
+      ],
+      [
+        'missing-dependency-closure',
+        (state, specDir) => {
+          state.task_registry[consumerPath].dependencies = [];
+          const taskFile = path.join(specDir, consumerPath);
+          write(
+            taskFile,
+            fs.readFileSync(taskFile, 'utf8').replace(
+              `- ${ownerPath}\n\n## Verification Plan`,
+              '- none\n\n## Verification Plan',
+            ),
+          );
+        },
+        criticalPolicy,
+        /must depend on owner tasks\/task-R1-01-one\.md/,
+      ],
+      [
+        'missing-proof',
+        (state) => {
+          state.implementation_obligations[0].verification = 'TBD';
+          state.implementation_obligations[0].evidence = 'PENDING';
+        },
+        criticalPolicy,
+        /verification: must be an executable command|evidence: must name an observable result/,
+      ],
+      [
+        'missing-state-authority-recovery',
+        (state) => {
+          delete state.implementation_obligations[0].canonical_state;
+          state.implementation_obligations[0].authority = 'authority';
+          state.implementation_obligations[0].recovery = 'recovery';
+        },
+        criticalPolicy,
+        /canonical_state: must be concrete|authority: must be concrete|recovery: must be concrete/,
+      ],
+      [
+        'missing-design-correspondence',
+        (_state, specDir) => {
+          const designFile = path.join(specDir, 'design.md');
+          write(
+            designFile,
+            fs.readFileSync(designFile, 'utf8').replace(
+              '\n<!-- implementation-obligation:canonical-transition -->\n',
+              '\n',
+            ),
+          );
+        },
+        criticalPolicy,
+        /design\.md: missing implementation obligation marker canonical-transition/,
+      ],
+      [
+        'missing-owner-correspondence',
+        (_state, specDir) => {
+          const ownerFile = path.join(specDir, ownerPath);
+          write(
+            ownerFile,
+            fs.readFileSync(ownerFile, 'utf8').replace(
+              '\n<!-- implementation-obligation:canonical-transition -->\n',
+              '\n',
+            ),
+          );
+        },
+        criticalPolicy,
+        /task-R1-01-one\.md: missing implementation obligation marker canonical-transition/,
+      ],
+      [
+        'marker-outside-execution-closure',
+        (_state, specDir) => {
+          const designFile = path.join(specDir, 'design.md');
+          const body = fs.readFileSync(designFile, 'utf8')
+            .replace('\n<!-- implementation-obligation:canonical-transition -->\n', '\n');
+          write(designFile, `${body}\n## Outside Closure\n\n<!-- implementation-obligation:canonical-transition -->\n`);
+        },
+        criticalPolicy,
+        /implementation obligation marker canonical-transition must be inside Execution Closure/,
+      ],
+      [
+        'duplicate-closure-marker',
+        (_state, specDir) => {
+          const designFile = path.join(specDir, 'design.md');
+          write(
+            designFile,
+            fs.readFileSync(designFile, 'utf8').replace(
+              '<!-- implementation-obligation:canonical-transition -->',
+              '<!-- implementation-obligation:canonical-transition -->\n<!-- implementation-obligation:canonical-transition -->',
+            ),
+          );
+        },
+        criticalPolicy,
+        /duplicate implementation obligation marker canonical-transition/,
+      ],
+      [
+        'duplicate-execution-closure',
+        (_state, specDir) => {
+          const designFile = path.join(specDir, 'design.md');
+          write(designFile, `${fs.readFileSync(designFile, 'utf8')}\n## Execution Closure\n\nNo duplicate allowed.\n`);
+        },
+        criticalPolicy,
+        /implementation obligation markers require exactly one Execution Closure section/,
+      ],
+      [
+        'closure-json-drift',
+        (_state, specDir) => {
+          const ownerFile = path.join(specDir, ownerPath);
+          write(
+            ownerFile,
+            fs.readFileSync(ownerFile, 'utf8').replace(
+              'Persisted transition state and allowed values',
+              'A divergent local transition description',
+            ),
+          );
+        },
+        criticalPolicy,
+        /task-R1-01-one\.md: Execution Closure for canonical-transition must mirror spec\.json canonical_state/,
+      ],
+      [
+        'closure-requirements-drift',
+        (_state, specDir) => {
+          const designFile = path.join(specDir, 'design.md');
+          write(
+            designFile,
+            fs.readFileSync(designFile, 'utf8').replace('- Requirements: R1.1', '- Requirements: R9.1'),
+          );
+        },
+        criticalPolicy,
+        /design\.md: Execution Closure for canonical-transition must mirror spec\.json requirements/,
+      ],
+      [
+        'duplicate-obligation-id',
+        (state) => {
+          state.implementation_obligations.push({ ...state.implementation_obligations[0] });
+        },
+        criticalPolicy,
+        /duplicate obligation id canonical-transition/,
+      ],
+      [
+        'whitespace-obligation-id',
+        (state) => { state.implementation_obligations[0].id = ' canonical-transition '; },
+        criticalPolicy,
+        /must be lowercase without surrounding whitespace/,
+      ],
+    ];
+    for (const [name, mutate, policy, expected] of cases) {
+      const specDir = makeFixture(name, mutate, policy);
+      const result = run(VALIDATOR, [specDir], ROOT);
+      assert.notEqual(result.status, 0, `${name} unexpectedly passed`);
+      assert.match(output(result), expected);
+    }
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test('grounding rejects empty sections, unsafe paths, unsupported actions, and zero-match globs', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-grounding-'));
   try {
@@ -958,7 +2622,10 @@ test('validator enforces Read before Modify for existing implementation', () =>
     // Existing file Modify without preceding Read must fail
     const missingRead = createSpec(root, {
       name: 'missing-read',
-      task: task({ related: '`src/existing.js` | Modify' }),
+      task: task({
+        related: '`src/existing.js` | Modify',
+        relatedRows: '| `src/existing.js` | Modify | Update existing implementation |',
+      }),
     });
     const missingResult = run(VALIDATOR, [missingRead], ROOT);
     assert.notEqual(missingResult.status, 0);
@@ -967,7 +2634,7 @@ test('validator enforces Read before Modify for existing implementation', () =>
     // Same path with Read in same task earlier row should pass
     const withReadSameTask = createSpec(root, {
       name: 'with-read-same',
-      task: `# Task R1-01: One\n\n## Context\n- Existing.\n\n## Constraints\n- Keep.\n\n## Steps\n- [ ] Update\n  - _Requirements: 1.1_\n\n## Requirements\n- 1.1 — One\n\n## Related Files\n| Path | Action | Description |\n|---|---|---|\n| \`src/existing.js\` | Read | Inspect existing |\n| \`src/existing.js\` | Modify | Update |\n\n## Completion Criteria\n- [ ] Works\n\n## Evidence\n- Runtime reachability verification\n  - Entrypoint/caller: src/existing.js\n\n## Risk Assessment\n| Risk | Severity | Mitigation |\n|---|---|---|\n| None | Low | Tests |\n`,
+      task: task({ related: '`src/existing.js` | Modify' }),
     });
     const sameResult = run(VALIDATOR, [withReadSameTask], ROOT);
     assert.equal(sameResult.status, 0, output(sameResult));
@@ -979,8 +2646,13 @@ test('validator enforces Read before Modify for existing implementation', () =>
     depState.task_files.push('tasks/task-R1-02-two.md');
     depState.task_registry['tasks/task-R1-02-two.md'] = { id: 'R1-02', title: 'Two', status: 'pending', dependencies: [], blocker: null, started_at: null, completed_at: null, last_updated_at: null };
     // Task 1 has Read, Task 2 modifies without depending
-    write(path.join(depRead, 'tasks/task-R1-01-one.md'), `# Task R1-01: One\n\n## Context\n- X\n\n## Constraints\n- Y\n\n## Steps\n- [ ] Read\n  - _Requirements: 1.1_\n\n## Requirements\n- 1.1 — One\n\n## Related Files\n| Path | Action | Description |\n|---|---|---|\n| \`src/existing.js\` | Read | Inspect |\n\n## Completion Criteria\n- [ ] Works\n\n## Evidence\n- Runtime reachability verification\n  - Entrypoint/caller: src/existing.js\n\n## Risk Assessment\n| Risk | Severity | Mitigation |\n|---|---|---|\n| None | Low | Tests |\n`);
-    write(path.join(depRead, 'tasks/task-R1-02-two.md'), task({ related: '`src/existing.js` | Modify' }));
+    write(path.join(depRead, 'tasks/task-R1-01-one.md'), task({ related: '`src/existing.js` | Read' }));
+    write(path.join(depRead, 'tasks/task-R1-02-two.md'), task({
+      id: 'R1-02',
+      related: '`src/existing.js` | Modify',
+      relatedRows: '| `src/existing.js` | Modify | Update existing implementation |',
+      dependencies: 'tasks/task-R1-01-one.md',
+    }));
     write(depStatePath, JSON.stringify(depState, null, 2));
     const depMissingResult = run(VALIDATOR, [depRead], ROOT);
     assert.notEqual(depMissingResult.status, 0);
@@ -988,6 +2660,7 @@ test('validator enforces Read before Modify for existing implementation', () =>
 
     // If Modify task depends on Read task, should pass
     depState.task_registry['tasks/task-R1-02-two.md'].dependencies = ['tasks/task-R1-01-one.md'];
+    depState.coordination.task_triggers = ['real_dependency', 'separate_proof'];
     write(depStatePath, JSON.stringify(depState, null, 2));
     const depPass = run(VALIDATOR, [depRead], ROOT);
     assert.equal(depPass.status, 0, output(depPass));
@@ -1018,17 +2691,22 @@ test('validator rejects reachability without concrete anchor and accepts with pa
   }
 });
 
-test('validator fails closed when 5+ tasks have no contract blocks', () => {
+test('validator keeps contract blocks opt-in regardless of task count', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-contract-closed-'));
   try {
     const specDir = createSpec(root, { name: 'five-no-contract' });
     const statePath = path.join(specDir, 'spec.json');
     const state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
+    state.design_context = { validation_recommended: true };
     for (let i = 2; i <= 5; i += 1) {
       const taskFile = `tasks/task-R1-0${i}-extra.md`;
       state.task_files.push(taskFile);
       state.task_registry[taskFile] = { id: `R1-0${i}`, title: `Extra ${i}`, status: 'pending', dependencies: [], blocker: null, started_at: null, completed_at: null, last_updated_at: null };
-      write(path.join(specDir, taskFile), task({ related: '`src/extra.js` | Modify', mapping: '1.1' }));
+      write(path.join(specDir, taskFile), task({
+        id: `R1-0${i}`,
+        related: '`src/extra.js` | Modify',
+        mapping: '1.1',
+      }));
     }
     // Need to ensure each extra task has Read before Modify to avoid lifecycle error
     for (let i = 2; i <= 5; i += 1) {
@@ -1042,8 +2720,7 @@ test('validator fails closed when 5+ tasks have no contract blocks', () => {
     write(path.join(specDir, 'tasks/task-R1-01-one.md'), first);
     write(statePath, JSON.stringify(state, null, 2));
     const result = run(VALIDATOR, [specDir], ROOT);
-    assert.notEqual(result.status, 0);
-    assert.match(output(result), /5\+ task spec requires contract blocks/);
+    assert.equal(result.status, 0, output(result));
   } finally {
     fs.rmSync(root, { recursive: true, force: true });
   }
@@ -1085,7 +2762,10 @@ test('validator enforces Create before Read/Modify/Delete within same task and c
     // Same-task: Create after Read must fail (dead-code regression)
     const createAfterRead = createSpec(root, {
       name: 'create-after-read',
-      task: `# Task R1-01: One\n\n## Context\n- X\n\n## Constraints\n- Y\n\n## Steps\n- [ ] Do work\n  - _Requirements: 1.1_\n\n## Requirements\n- 1.1 — One\n\n## Related Files\n| Path | Action | Description |\n|---|---|---|\n| \`src/new.js\` | Read | Read before create |\n| \`src/new.js\` | Create | Create after read |\n\n## Completion Criteria\n- [ ] Works\n\n## Evidence\n- Runtime reachability verification\n  - Entrypoint/caller: src/new.js\n\n## Risk Assessment\n| Risk | Severity | Mitigation |\n|---|---|---|\n| None | Low | Tests |\n`,
+      task: task({
+        related: '`src/new.js` | Read',
+        relatedRows: '| `src/new.js` | Read | Read before create |\n| `src/new.js` | Create | Create after read |',
+      }),
     });
     const carResult = run(VALIDATOR, [createAfterRead], ROOT);
     assert.notEqual(carResult.status, 0);
@@ -1094,7 +2774,10 @@ test('validator enforces Create before Read/Modify/Delete within same task and c
     // Same-task: Create after Modify must fail
     const createAfterModify = createSpec(root, {
       name: 'create-after-modify',
-      task: `# Task R1-01: One\n\n## Context\n- X\n\n## Constraints\n- Y\n\n## Steps\n- [ ] Do work\n  - _Requirements: 1.1_\n\n## Requirements\n- 1.1 — One\n\n## Related Files\n| Path | Action | Description |\n|---|---|---|\n| \`src/new.js\` | Modify | Modify before create |\n| \`src/new.js\` | Create | Create after modify |\n\n## Completion Criteria\n- [ ] Works\n\n## Evidence\n- Runtime reachability verification\n  - Entrypoint/caller: src/new.js\n\n## Risk Assessment\n| Risk | Severity | Mitigation |\n|---|---|---|\n| None | Low | Tests |\n`,
+      task: task({
+        related: '`src/new.js` | Modify',
+        relatedRows: '| `src/new.js` | Modify | Modify before create |\n| `src/new.js` | Create | Create after modify |',
+      }),
     });
     const camResult = run(VALIDATOR, [createAfterModify], ROOT);
     assert.notEqual(camResult.status, 0);
@@ -1103,7 +2786,10 @@ test('validator enforces Create before Read/Modify/Delete within same task and c
     // Same-task: Create before Read/Modify must pass; repeated Reads must not be rejected
     const createBefore = createSpec(root, {
       name: 'create-before',
-      task: `# Task R1-01: One\n\n## Context\n- X\n\n## Constraints\n- Y\n\n## Steps\n- [ ] Do work\n  - _Requirements: 1.1_\n\n## Requirements\n- 1.1 — One\n\n## Related Files\n| Path | Action | Description |\n|---|---|---|\n| \`src/new.js\` | Create | Create first |\n| \`src/new.js\` | Read | Read after create |\n| \`src/new.js\` | Modify | Modify after create |\n| \`src/new.js\` | Read | Second read |\n\n## Completion Criteria\n- [ ] Works\n\n## Evidence\n- Runtime reachability verification\n  - Entrypoint/caller: src/new.js\n\n## Risk Assessment\n| Risk | Severity | Mitigation |\n|---|---|---|\n| None | Low | Tests |\n`,
+      task: task({
+        related: '`src/new.js` | Create',
+        relatedRows: '| `src/new.js` | Create | Create first |\n| `src/new.js` | Read | Read after create |\n| `src/new.js` | Modify | Modify after create |\n| `src/new.js` | Read | Second read |',
+      }),
     });
     const cbResult = run(VALIDATOR, [createBefore], ROOT);
     assert.equal(cbResult.status, 0, output(cbResult));
@@ -1111,7 +2797,10 @@ test('validator enforces Create before Read/Modify/Delete within same task and c
     // Valid same-task repeated reads without create must pass (not rejected unnecessarily)
     const repeatedReads = createSpec(root, {
       name: 'repeated-reads',
-      task: `# Task R1-01: One\n\n## Context\n- X\n\n## Constraints\n- Y\n\n## Steps\n- [ ] Do work\n  - _Requirements: 1.1_\n\n## Requirements\n- 1.1 — One\n\n## Related Files\n| Path | Action | Description |\n|---|---|---|\n| \`src/existing.js\` | Read | First read |\n| \`src/existing.js\` | Read | Second read |\n| \`src/existing.js\` | Modify | Modify after reads |\n\n## Completion Criteria\n- [ ] Works\n\n## Evidence\n- Runtime reachability verification\n  - Entrypoint/caller: src/existing.js\n\n## Risk Assessment\n| Risk | Severity | Mitigation |\n|---|---|---|\n| None | Low | Tests |\n`,
+      task: task({
+        related: '`src/existing.js` | Read',
+        relatedRows: '| `src/existing.js` | Read | First read |\n| `src/existing.js` | Read | Second read |\n| `src/existing.js` | Modify | Modify after reads |',
+      }),
     });
     const rrResult = run(VALIDATOR, [repeatedReads], ROOT);
     assert.equal(rrResult.status, 0, output(rrResult));
@@ -1121,10 +2810,13 @@ test('validator enforces Create before Read/Modify/Delete within same task and c
     const crossReadStatePath = path.join(crossRead, 'spec.json');
     const crossReadState = JSON.parse(fs.readFileSync(crossReadStatePath, 'utf8'));
     // Task1 creates src/gen.js
-    write(path.join(crossRead, 'tasks/task-R1-01-one.md'), `# Task R1-01: One\n\n## Context\n- X\n\n## Constraints\n- Y\n\n## Steps\n- [ ] Create\n  - _Requirements: 1.1_\n\n## Requirements\n- 1.1 — One\n\n## Related Files\n| Path | Action | Description |\n|---|---|---|\n| \`src/gen.js\` | Create | Create gen |\n\n## Completion Criteria\n- [ ] Works\n\n## Evidence\n- Runtime reachability verification\n  - Entrypoint/caller: src/gen.js\n\n## Risk Assessment\n| Risk | Severity | Mitigation |\n|---|---|---|\n| None | Low | Tests |\n`);
+    write(path.join(crossRead, 'tasks/task-R1-01-one.md'), task({ related: '`src/gen.js` | Create' }));
     crossReadState.task_files.push('tasks/task-R1-02-two.md');
     crossReadState.task_registry['tasks/task-R1-02-two.md'] = { id: 'R1-02', title: 'Two', status: 'pending', dependencies: [], blocker: null, started_at: null, completed_at: null, last_updated_at: null };
-    write(path.join(crossRead, 'tasks/task-R1-02-two.md'), `# Task R1-02: Two\n\n## Context\n- X\n\n## Constraints\n- Y\n\n## Steps\n- [ ] Read gen\n  - _Requirements: 1.1_\n\n## Requirements\n- 1.1 — One\n\n## Related Files\n| Path | Action | Description |\n|---|---|---|\n| \`src/gen.js\` | Read | Read gen without dep |\n\n## Completion Criteria\n- [ ] Works\n\n## Evidence\n- Runtime reachability verification\n  - Entrypoint/caller: src/gen.js\n\n## Risk Assessment\n| Risk | Severity | Mitigation |\n|---|---|---|\n| None | Low | Tests |\n`);
+    write(path.join(crossRead, 'tasks/task-R1-02-two.md'), task({
+      id: 'R1-02',
+      related: '`src/gen.js` | Read',
+    }));
     write(crossReadStatePath, JSON.stringify(crossReadState, null, 2));
     const crossReadFail = run(VALIDATOR, [crossRead], ROOT);
     assert.notEqual(crossReadFail.status, 0);
@@ -1132,6 +2824,13 @@ test('validator enforces Create before Read/Modify/Delete within same task and c
 
     // Cross-task Read with dependency must pass
     crossReadState.task_registry['tasks/task-R1-02-two.md'].dependencies = ['tasks/task-R1-01-one.md'];
+    crossReadState.coordination.task_triggers = ['real_dependency', 'separate_proof'];
+    const crossReadTaskPath = path.join(crossRead, 'tasks/task-R1-02-two.md');
+    write(crossReadTaskPath, task({
+      id: 'R1-02',
+      related: '`src/gen.js` | Read',
+      dependencies: 'tasks/task-R1-01-one.md',
+    }));
     write(crossReadStatePath, JSON.stringify(crossReadState, null, 2));
     const crossReadPass = run(VALIDATOR, [crossRead], ROOT);
     assert.equal(crossReadPass.status, 0, output(crossReadPass));
@@ -1140,15 +2839,27 @@ test('validator enforces Create before Read/Modify/Delete within same task and c
     const crossMod = createSpec(root, { name: 'cross-mod-base' });
     const crossModStatePath = path.join(crossMod, 'spec.json');
     const crossModState = JSON.parse(fs.readFileSync(crossModStatePath, 'utf8'));
-    write(path.join(crossMod, 'tasks/task-R1-01-one.md'), `# Task R1-01: One\n\n## Context\n- X\n\n## Constraints\n- Y\n\n## Steps\n- [ ] Create\n  - _Requirements: 1.1_\n\n## Requirements\n- 1.1 — One\n\n## Related Files\n| Path | Action | Description |\n|---|---|---|\n| \`src/gen2.js\` | Create | Create gen2 |\n\n## Completion Criteria\n- [ ] Works\n\n## Evidence\n- Runtime reachability verification\n  - Entrypoint/caller: src/gen2.js\n\n## Risk Assessment\n| Risk | Severity | Mitigation |\n|---|---|---|\n| None | Low | Tests |\n`);
+    write(path.join(crossMod, 'tasks/task-R1-01-one.md'), task({ related: '`src/gen2.js` | Create' }));
     crossModState.task_files.push('tasks/task-R1-02-two.md');
     crossModState.task_registry['tasks/task-R1-02-two.md'] = { id: 'R1-02', title: 'Two', status: 'pending', dependencies: [], blocker: null, started_at: null, completed_at: null, last_updated_at: null };
-    write(path.join(crossMod, 'tasks/task-R1-02-two.md'), `# Task R1-02: Two\n\n## Context\n- X\n\n## Constraints\n- Y\n\n## Steps\n- [ ] Modify gen2\n  - _Requirements: 1.1_\n\n## Requirements\n- 1.1 — One\n\n## Related Files\n| Path | Action | Description |\n|---|---|---|\n| \`src/gen2.js\` | Modify | Modify without dep |\n\n## Completion Criteria\n- [ ] Works\n\n## Evidence\n- Runtime reachability verification\n  - Entrypoint/caller: src/gen2.js\n\n## Risk Assessment\n| Risk | Severity | Mitigation |\n|---|---|---|\n| None | Low | Tests |\n`);
+    write(path.join(crossMod, 'tasks/task-R1-02-two.md'), task({
+      id: 'R1-02',
+      related: '`src/gen2.js` | Modify',
+      relatedRows: '| `src/gen2.js` | Modify | Modify without dependency |',
+    }));
     write(crossModStatePath, JSON.stringify(crossModState, null, 2));
     const crossModFail = run(VALIDATOR, [crossMod], ROOT);
     assert.notEqual(crossModFail.status, 0);
     assert.match(output(crossModFail), /modify of src\/gen2\.js must depend on creator/);
     crossModState.task_registry['tasks/task-R1-02-two.md'].dependencies = ['tasks/task-R1-01-one.md'];
+    crossModState.coordination.task_triggers = ['real_dependency', 'separate_proof'];
+    const crossModTaskPath = path.join(crossMod, 'tasks/task-R1-02-two.md');
+    write(crossModTaskPath, task({
+      id: 'R1-02',
+      related: '`src/gen2.js` | Modify',
+      relatedRows: '| `src/gen2.js` | Modify | Modify generated implementation |',
+      dependencies: 'tasks/task-R1-01-one.md',
+    }));
     write(crossModStatePath, JSON.stringify(crossModState, null, 2));
     const crossModPass = run(VALIDATOR, [crossMod], ROOT);
     assert.equal(crossModPass.status, 0, output(crossModPass));
@@ -1416,3 +3127,84 @@ test('benchmark validate handles empty and invalid evidence as not-ready/invalid
     fs.rmSync(root, { recursive: true, force: true });
   }
 });
+
+test('D12: semantic-firewall test discovery finds R0-01\'s required basenames in the real checkout', () => {
+  const DISCOVERY = require(path.join(ROOT, 'scripts/semantic-firewall-test-discovery.cjs'));
+  const testsDir = path.join(ROOT, 'bin/__tests__');
+  const discovered = DISCOVERY.discoverSemanticFirewallTests(testsDir);
+  assert.ok(discovered.includes('change-firewall.semantic-firewall.test.js'), 'change-firewall.semantic-firewall.test.js must be discovered');
+  assert.ok(discovered.includes('release-preflight.semantic-firewall.test.js'), 'release-preflight.semantic-firewall.test.js must be discovered');
+  assert.deepEqual(discovered, [...discovered].sort(), 'discovery must return sorted basenames');
+
+  const requiredOk = DISCOVERY.assertRequiredSemanticTests(testsDir, [
+    'change-firewall.semantic-firewall.test.js',
+    'release-preflight.semantic-firewall.test.js',
+  ]);
+  assert.equal(requiredOk.ok, true);
+  assert.deepEqual(requiredOk.missing, []);
+
+  const requiredMissing = DISCOVERY.assertRequiredSemanticTests(testsDir, ['does-not-exist.semantic-firewall.test.js']);
+  assert.equal(requiredMissing.ok, false);
+  assert.deepEqual(requiredMissing.missing, ['does-not-exist.semantic-firewall.test.js']);
+});
+
+test('D12: run-skill-self-tests.mjs sentinel exits nonzero immediately when a required semantic-firewall basename is missing', () => {
+  const RUNNER = path.join(ROOT, 'scripts/run-skill-self-tests.mjs');
+  const result = spawnSync(process.execPath, [
+    RUNNER, '--require-semantic-test', 'does-not-exist.semantic-firewall.test.js',
+  ], { cwd: ROOT, encoding: 'utf8', timeout: 15000 });
+  assert.notEqual(result.status, 0);
+  assert.match(`${result.stdout}${result.stderr}`, /required semantic-firewall test not discovered: does-not-exist\.semantic-firewall\.test\.js/);
+});
+
+test('R0-01 owned change-firewall contract surface (D1/C15) is reachable: every named export and owned anchor target exists', () => {
+  const CHANGE_FIREWALL = require(path.join(ROOT, 'src/claude/scripts/change-firewall.cjs'));
+  const requiredExports = [
+    'loadBaselineAuthority', 'assertBaselineUsable', 'bootstrapBaseline', 'advanceBaseline',
+    'deriveProtectedChangedPaths', 'computeProtectedTreeDigest', 'computeProposalDigest',
+    'computeCandidateDigest', 'assertHotspotChangeAllowed', 'createFreezeManifest',
+    'verifyFreezeManifest', 'invalidateFreeze', 'NO_CHANGE_ATTESTATION_DIGEST',
+    'loadFailureLedger', 'assertFailureLedgerUsable', 'openFailure', 'classifyFailure',
+    'reclassifyFailure', 'resolveFailure', 'computeFailureLedgerDigest', 'deriveFailureState',
+    'NO_FAILURES_ATTESTATION_DIGEST', 'createChangeFirewall', 'assertLegacyBridgeArtifact',
+  ];
+  for (const name of requiredExports) {
+    assert.ok(Object.prototype.hasOwnProperty.call(CHANGE_FIREWALL, name), `change-firewall.cjs must export ${name}`);
+  }
+
+  const ownedAnchorTargets = [
+    'src/claude/scripts/change-firewall.cjs',
+    'src/claude/scripts/spec-authoring-digest.cjs',
+    'benchmarks/change-proposal.schema.json',
+    'benchmarks/change-firewall-freeze.schema.json',
+    'benchmarks/release-baseline.schema.json',
+    'benchmarks/migration-manifest.json',
+    'benchmarks/bootstrap-attestation.schema.json',
+    'benchmarks/benchmark-failure-ledger.schema.json',
+    'scripts/release-preflight.mjs',
+    'scripts/benchmark-workflow.mjs',
+    'scripts/semantic-firewall-test-discovery.cjs',
+    'scripts/run-skill-self-tests.mjs',
+    'bin/__tests__/change-firewall.semantic-firewall.test.js',
+    'bin/__tests__/release-preflight.semantic-firewall.test.js',
+    'package.json',
+    '.gitignore',
+  ];
+  for (const relative of ownedAnchorTargets) {
+    assert.ok(fs.existsSync(path.join(ROOT, relative)), `owned anchor target must exist: ${relative}`);
+  }
+});
+
+test('D11/R1.14: the legacy-bridge precondition artifact is reachable and change-firewall.cjs asserts its exact schema', () => {
+  const CHANGE_FIREWALL = require(path.join(ROOT, 'src/claude/scripts/change-firewall.cjs'));
+  // The bridge artifact lives under the monorepo root's specs/ (change-firewall.cjs
+  // resolves its own production root the same way, via git from its own file
+  // location) -- ROOT here is packages/spec, one level below that root.
+  const MONOREPO_ROOT = path.resolve(ROOT, '..', '..');
+  const bridgePath = path.join(MONOREPO_ROOT, 'specs/cafekit-semantic-eval-firewall/reports/bootstrap-legacy-bridge-review.json');
+  assert.ok(fs.existsSync(bridgePath), 'the legacy-bridge artifact must exist before any R0-01 change-firewall assertion runs');
+  const parsed = CHANGE_FIREWALL.assertLegacyBridgeArtifact();
+  assert.equal(parsed.schema_version, '1');
+  assert.equal(parsed.verdict, 'PASS');
+  assert.equal(parsed.blocking_count, 0);
+});