codex-workflow-v2 2.0.0-alpha.1 → 2.0.0-alpha.2

package/docs/project-memory.md

@@ -20,12 +20,15 @@ approves canonical/supporting choices. Conflicts and missing categories remain e
   by the Plan.
 - Independent Reviewer checks that required durable knowledge changes are present and bound
   to the reviewed commit.
-- Delivery Coordinator re-scans after relevant changes and blocks stale Plan bindings until
-  the map is reconciled and reapproved.
+- Delivery Coordinator re-scans after relevant changes, reconciles and reapproves the map,
+  then uses `task knowledge-rebind` before requesting fresh execution authorization.
 
 If any approved file changes, the derived map becomes stale. `project-memory reconcile`
-updates discovered metadata; changed classifications require user approval. If local state
-is lost, the map is rebuilt from repository files.
+updates discovered metadata; changed classifications require user approval. A knowledge
+rebind is mechanical: it may change only the Plan's map revision/hash, preserves every Step
+definition, status, and evidence record, records the old/new binding, supersedes execution
+authorization, and cannot run while a Step is in progress. If local state is lost, the map
+is rebuilt from repository files.
 
 ## Codebase graph
 

package/docs/validation-report.md

@@ -1,19 +1,22 @@
 # V2 Alpha Validation Report
 
-Validated on 2026-07-16 with Node.js 24.17.0 and Codex CLI 0.144.5.
+Release candidate `2.0.0-alpha.2` was validated on 2026-08-08 with Node.js 24.17.0.
 
 - TypeScript typecheck and build passed.
-- 32 unit/integration tests passed, including Task lifecycle, Milestone amendments and
-  acceptance, Project Knowledge Map staleness, graph binding, deterministic V1 snapshot,
-  symlink rejection, writer leases, and strict reviewer fail-closed behavior.
-- npm dry-run packaging included runtime, schemas, roles, references, docs, and personal
-  plugin source.
-- downstream tarball installation and packaged CLI handshake passed; installation created
-  none of the forbidden repository workflow directories.
-- plugin source passed both the repository release check and the Codex plugin validator.
-- a real ephemeral `codex exec` read-only probe attempted to create
-  `.codex-reviewer-write-probe`; the runtime denied it with `Operation not permitted`, the
-  file did not appear, and structured output reported `isolationProbe: "denied"`.
+- All 37 unit and integration tests passed. Coverage includes the complete Task lifecycle,
+  a Project Knowledge Map change between Steps, preservation of completed Step evidence,
+  mandatory reauthorization, the public `task knowledge-rebind` CLI route, no-op and active
+  Worker rejection, current gateway capability negotiation, and rejection of deprecated
+  state schema instead of migration.
+- Milestone amendments and acceptance, graph binding, deterministic V1 snapshot, symlink
+  rejection, writer leases, and strict reviewer fail-closed behavior also passed.
+- npm dry-run packaging produced `codex-workflow-v2-2.0.0-alpha.2.tgz` with runtime, schemas,
+  roles, references, docs, and plugin source.
+- Downstream installation from that tarball and the packaged CLI handshake passed; the
+  installation created none of the forbidden repository workflow directories.
+- Plugin validation and the repository release check passed for `2.0.0-alpha.2`.
 
-This report validates the listed runtime versions. The strict reviewer remains fail-closed
-on other versions: inability to prove isolation records `unverified` and blocks acceptance.
+The strict reviewer implementation did not change in this release candidate. Its original
+2026-07-16 real Codex CLI isolation probe denied a repository write and returned
+`isolationProbe: "denied"`. The reviewer remains fail-closed: inability to prove isolation
+records `unverified` and blocks acceptance.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-alpha.1",
+  "version": "2.0.0-alpha.2",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -9,7 +9,8 @@ codex-workflow gateway handshake --repo <git-root>
 ```
 
 Require package name `codex-workflow-v2`, protocol version `1`, state
-schema version `1`, and the capabilities needed for the requested operation.
+schema version `2`, and the capabilities needed for the requested operation. Task execution
+that may cross a Project Knowledge Map revision requires `task-knowledge-rebind-v1`.
 
 ## Graph Refresh Request
 

package/references/state-machine.md

@@ -6,6 +6,13 @@ to the task commit and Brief, Plan, and evidence hashes. Final acceptance is a s
 human event bound to Result, evidence, and commit. Locks expire only diagnostically;
 removing a stale lock is always an explicit repair operation.
 
+When an approved Project Knowledge Map changes between Task Steps, the coordinator first
+reconciles and obtains approval for the new map, then uses `task knowledge-rebind`. This
+mechanical transition preserves Step definitions, runtime status, and evidence, records both
+bindings, supersedes execution authorization, and returns the Task to
+`awaiting_execution_authorization`. It cannot run while a Step is `in_progress` or while the
+Task is `blocked`; unrelated blocks must be resolved through their owning transition.
+
 Milestone authorization is bound to its Plan and membership revision. Plan amendments
 supersede authorization. Milestone validation and acceptance are bound to the current base
 HEAD; cancellation records intent but performs no Git reversal.

package/roles/delivery-coordinator.md

@@ -3,6 +3,8 @@
 Own state transitions, dispatch envelopes, evidence collection, and recovery guidance.
 
 - Verify Project Knowledge Map freshness before Plan authorization and role dispatch.
+- After an approved knowledge change between Steps, reconcile and approve the map, perform
+  the mechanical Task knowledge rebind, and request fresh user authorization.
 - Own derived map revisions and context selection, but never edit the meaning of canonical project files.
 - Treat CLI `status`, `next`, revision, and lock state as authoritative machine state.
 - Never bypass authorization, scope checks, failed validation, or stale review.

package/schemas/discovery.schema.json

@@ -5,7 +5,7 @@
   "type": "object",
   "required": ["schemaVersion", "revision", "id", "projectId", "kind", "status", "goal", "acceptance"],
   "properties": {
-    "schemaVersion": { "const": 1 },
+    "schemaVersion": { "const": 2 },
     "revision": { "type": "integer", "minimum": 1 },
     "id": { "type": "string", "pattern": "^DISC-[0-9A-HJKMNP-TV-Z]{26}$" },
     "projectId": { "type": "string", "pattern": "^[a-f0-9]{24}$" },

package/schemas/graph-binding.schema.json

@@ -6,7 +6,7 @@
   "additionalProperties": false,
   "required": ["schemaVersion", "revision", "id", "projectId", "kind", "graphKind", "provider", "rootFingerprint", "mode", "status", "observedAt", "evidenceHash", "previous"],
   "properties": {
-    "schemaVersion": { "const": 1 },
+    "schemaVersion": { "const": 2 },
     "revision": { "type": "integer", "minimum": 1 },
     "id": { "enum": ["GRAPH-product", "GRAPH-workflow"] },
     "projectId": { "type": "string", "pattern": "^[a-f0-9]{24}$" },

package/schemas/milestone.schema.json

@@ -11,7 +11,7 @@
     "evidenceHash", "acceptedHead", "cancellationReason"
   ],
   "properties": {
-    "schemaVersion": { "const": 1 },
+    "schemaVersion": { "const": 2 },
     "revision": { "type": "integer", "minimum": 1 },
     "id": { "type": "string", "pattern": "^MS-[0-9A-HJKMNP-TV-Z]{26}$" },
     "projectId": { "type": "string", "pattern": "^[a-f0-9]{24}$" },

package/schemas/project-knowledge-map.schema.json

@@ -6,7 +6,7 @@
   "additionalProperties": false,
   "required": ["schemaVersion", "revision", "id", "projectId", "kind", "status", "entries", "gaps", "conflicts", "approval"],
   "properties": {
-    "schemaVersion": { "const": 1 },
+    "schemaVersion": { "const": 2 },
     "revision": { "type": "integer", "minimum": 1 },
     "id": { "const": "PROJECT-KNOWLEDGE-MAP" },
     "projectId": { "type": "string", "pattern": "^[a-f0-9]{24}$" },

package/schemas/task.schema.json

@@ -3,9 +3,9 @@
   "$id": "https://codex-workflow.local/schemas/task.schema.json",
   "title": "Codex Workflow V2 Task State",
   "type": "object",
-  "required": ["schemaVersion", "revision", "id", "projectId", "kind", "status", "title", "knowledgeImpact", "knowledgeTargets", "knowledgeMapRevision", "knowledgeMapHash", "graphUse", "steps", "authorizations"],
+  "required": ["schemaVersion", "revision", "id", "projectId", "kind", "status", "title", "planObjective", "knowledgeImpact", "knowledgeTargets", "knowledgeMapRevision", "knowledgeMapHash", "graphUse", "steps", "authorizations", "knowledgeRebinds"],
   "properties": {
-    "schemaVersion": { "const": 1 },
+    "schemaVersion": { "const": 2 },
     "revision": { "type": "integer", "minimum": 1 },
     "id": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
     "projectId": { "type": "string", "pattern": "^[a-f0-9]{24}$" },
@@ -27,6 +27,7 @@
       ]
     },
     "title": { "type": "string", "minLength": 1 },
+    "planObjective": { "type": ["string", "null"] },
     "knowledgeImpact": { "enum": ["none", "update", "create", "retire", null] },
     "knowledgeImpactReason": { "type": ["string", "null"] },
     "knowledgeTargets": { "type": "array" },
@@ -34,6 +35,23 @@
     "knowledgeMapHash": { "type": ["string", "null"], "pattern": "^[a-f0-9]{64}$" },
     "graphUse": { "enum": ["code-aware", "not-applicable", null] },
     "steps": { "type": "array" },
-    "authorizations": { "type": "array" }
+    "authorizations": { "type": "array" },
+    "knowledgeRebinds": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["recordedAt", "fromKnowledgeMapRevision", "fromKnowledgeMapHash", "toKnowledgeMapRevision", "toKnowledgeMapHash", "previousPlanHash", "reboundPlanHash"],
+        "properties": {
+          "recordedAt": { "type": "string", "format": "date-time" },
+          "fromKnowledgeMapRevision": { "type": "integer", "minimum": 1 },
+          "fromKnowledgeMapHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "toKnowledgeMapRevision": { "type": "integer", "minimum": 1 },
+          "toKnowledgeMapHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "previousPlanHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "reboundPlanHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+        },
+        "additionalProperties": false
+      }
+    }
   }
 }