codex-workflow-v2 2.0.0-alpha.6.2 → 2.0.0-alpha.7.1

package/docs/validation-report.md

@@ -1,69 +1,56 @@
 # V2 Alpha Validation Report
 
-Release candidate `2.0.0-alpha.6.2` was validated on 2026-08-14 with Node.js 20.12.2 as a
-narrow backport from the `2.0.0-alpha.6.1` backport line, itself based on published
-`2.0.0-alpha.6`.
+Release candidate `2.0.0-alpha.7` was validated on 2026-08-14 with Node.js 24.17.0.
 
-- `npm run typecheck`, `npm run build`, `npm test`, `npm run validate`, `npm run plugin:check`,
-  `npm run smoke:downstream`, `npm run release:check`, and `npm run pack:check` passed in the
-  sequential backport validation.
-- The final sequential full suite passed `89/89` on 2026-08-14.
-- The package test script runs test files sequentially; the unsupported
-  `--test-force-exit` flag was removed.
-- Plan Risk Audit coverage includes the combined `plan-set --risk-audit-file` path, atomic
-  rejection before Task/Plan acceptance, distinct planner/auditor identities, exact current
-  Step-set equality, concrete failure modes, executable evidence binding, coupled
-  migration/recovery rationale, blocking split/stop decisions, and adoption-aware
-  remaining-scope bootstrap handling.
-- Strict high-risk Step Review coverage includes workflow-owned completion commits,
-  `task step-review` routing, commit-bound reviewer attestation, and fail-closed rejection of
-  stale, malformed, unverified, and wrong-commit review evidence.
-- Alpha.6.1 rescue coverage reproduces the production deadlock with an exact alpha.6
-  dependency, stale Knowledge binding, pending strict review, claimed C1 posture, and both
-  active and stale bound leases. The single rescue action preserves the original lease,
-  exposes no plaintext token, completes review with the exact claimant/token, and fails closed
-  for a wrong actor or token. Ordinary `task step-review` remains blocked by stale Knowledge.
-- Guarded remediation coverage includes the per-Step circuit breaker: two ordinary retries
-  allowed, the third gated by a separate decision plus full independently audited corrective
-  Plan, an explicit corrective run envelope, a hard stop after a third failed corrective
-  review, and stop/redirection handling for `split-required` and `stop-escalate`. Knowledge
-  rebind and reauthorization preserve this breaker posture.
-- Signal_v4 rescue coverage includes exact alpha.6 dependency/HEAD/Task/review-history
-  matching, mutation-free preflight, active and stale bound leases without token disclosure,
-  wrong actor/token ordering before heartbeat, scope-preserving decision plus full Plan apply,
-  dirty/advanced checkout rejection, malformed/missing review evidence, and unrelated leases.
-- Milestone coverage includes human-only scope-change prepare/apply, journaled recovery of
-  `state.json`, `plan.json`, and `scope-change-events.jsonl`, plus membership-integrity
-  blocking for stale or contradictory Milestone/Task state, including reverse detection of a
-  live linked Task missing from required/waived/cancelled membership.
-- `C1` coordination coverage includes the full prepared bundle, one-time and expiring claim
-  token, Task/Plan/Knowledge/Milestone bindings, exact expected-next prompt, optional grant,
-  target-only claim, claimant-only mutation, mandatory claim before Milestone Task start,
-  lease-token binding, and terminal evidence-bound handback.
-- Adoption coverage includes sidecar-only `state adoption-prepare` and `state adoption-apply`,
-  automatic posture initialization for fresh alpha.6 projects, preservation of terminal
-  Milestones and Tasks, preservation of completed and skipped legacy Steps, and execution
-  blocking until posture is present.
-- Compatibility checks passed for `protocolVersion: 1`, `STATE_SCHEMA_VERSION: 2`, unchanged
-  canonical Task and Milestone shapes, and unchanged delegated transition allow-list.
-- Gateway handshake coverage includes the alpha.6 capabilities:
-  `plan-risk-audit-sidecar-v1`, `step-strict-review-sidecar-v1`,
-  `step-remediation-circuit-breaker-sidecar-v1`, `milestone-scope-change-sidecar-v1`,
-  `milestone-membership-integrity-v1`, `task-c1-handoff-sidecar-v1`, and
-  `alpha6-adoption-posture-v1`, `alpha6-c1-strict-review-rescue-v1`, and
-  `alpha6-corrective-rescue-signal-v4`, plus strengthened contracts advertised as
-  `semantic-plan-risk-audit-v2`, `guarded-remediation-hard-stop-v1`,
-  `milestone-reverse-membership-integrity-v1`, and `task-c1-handoff-bundle-v2`.
-- npm dry-run packaging produced `codex-workflow-v2-2.0.0-alpha.6.2.tgz` with runtime, schemas,
-  references, docs, and plugin source. Downstream installation and the packaged CLI handshake
-  passed, and the install created none of `.codex`, `.tasks`, `.increments`, or
-  `.memory-bank` in the temporary project.
-- Release checks require the dedicated `backport-alpha6` npm dist-tag, so publishing this
-  version cannot move the alpha.7-owned `next` tag.
+- TypeScript typecheck and build passed.
+- The authoritative sequential suite passed `86/86` with `--test-concurrency=1`. An earlier
+  ordinary parallel run also passed its then-current `85/85` suite, but CLI subprocess
+  contention made one test take 165 seconds; the final sequential exit is the release evidence.
+- `npm run pack:check`, `npm run smoke:downstream`, `npm run release:check`,
+  `npm run plugin:check`, and `git diff --check` passed. Packaging and downstream smoke used
+  an isolated temporary npm cache because the user cache contains pre-existing root-owned
+  entries.
+- The repository-level `tools/tests/codex-workflow-regression.mjs` update/install regression
+  completed with `status: PASS`.
+- Dry-run packaging produced `codex-workflow-v2-2.0.0-alpha.7.tgz` with 139 files; downstream
+  installation and packaged CLI handshake passed.
+
+Alpha.7 regression coverage includes:
+
+- pending strict Step Review outranks Knowledge Map reconcile/rebind after a knowledge-changing
+  completion commit; review succeeds against the exact historical approved binding even while
+  the current map is stale, and rebind remains mandatory before the next Step;
+- read-only alpha.6 rescue-preflight rejects active leases and accepts only one exact pending
+  strict-review candidate on the clean recorded completion HEAD;
+- seven linked Tasks can be materialized during initial Milestone assembly and classified by
+  one complete initial Plan without repeated scope-change approvals;
+- one maximum-72-hour Milestone Autonomy Contract issues the existing Task/Milestone approval
+  permissions, permits Project Memory approval only inside an atomic content-only Task context
+  refresh, permits journaled membership-only evolution, requires reauthorization, and rejects
+  both standalone Project Memory approval and semantic scope drift; a later human semantic
+  change invalidates future uses of the autonomy grant;
+- C1 Worker and corrective Auditor actors are deterministically derived while claim, lease,
+  handoff, and reviewer/auditor independence checks remain fail-closed;
+- every newly recorded guarded Plan Risk Audit requires an exact proof obligation per failure
+  mode: hostile counterexample, expected safe result, and executable evidence command;
+  historical alpha.6 audits remain readable for recovery only;
+- existing Milestone journal recovery, reverse-membership integrity, delegation, adoption,
+  Knowledge Map, graph, strict reviewer, Git ownership, and remediation hard-stop tests remain
+  green.
+
+Compatibility claims verified:
+
+- `protocolVersion: 1` and `STATE_SCHEMA_VERSION: 2` remain unchanged;
+- canonical Task and Milestone schemas remain byte-identical;
+- the generic delegated transition allow-list remains unchanged;
+- new evidence is additive through `autonomy-contract-events.jsonl`, optional autonomous
+  fields on scope-change events, and optional proof obligations on Plan Risk Audit events;
+- the gateway handshake advertises alpha.7 rescue, initial assembly, autonomy, derived actor,
+  corrective routing, and proof-obligation capabilities.
 
 Not claimed here:
 
-- no final release publish;
-- no final task audit beyond the recorded subtask evidence;
-- no new real-Codex isolation probe beyond the existing fail-closed strict-reviewer
-  implementation and its automated coverage.
+- no npm publication, Git tag, push, or downstream project mutation was performed;
+- no manual rewrite of external Workflow state is part of the recovery design;
+- the local package cannot cryptographically prove a real human identity or a physically
+  separate Codex task beyond the existing actor, process-isolation, sidecar, and lease evidence.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-alpha.6.2",
+  "version": "2.0.0-alpha.7.1",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "clean": "node --eval \"import('node:fs').then(({rmSync}) => { rmSync('dist', {recursive:true, force:true}); rmSync('.test-dist', {recursive:true, force:true}); })\"",
     "build": "npm run clean && tsc -p tsconfig.build.json && node scripts/mark-cli-executable.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "npm run build && tsc -p tsconfig.test.json && node --test --test-concurrency=1 .test-dist/tests/*.test.js",
+    "test": "npm run build && tsc -p tsconfig.test.json && node --test .test-dist/tests/*.test.js",
     "validate": "npm run typecheck && npm test",
     "pack:check": "npm run build && npm pack --dry-run",
     "smoke:downstream": "npm run build && node scripts/downstream-smoke.mjs",

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -40,8 +40,15 @@ Current capability set:
 - `milestone-reverse-membership-integrity-v1`
 - `task-c1-handoff-bundle-v2`
 - `alpha6-adoption-posture-v1`
-
-Protocol `1` and schema `2` remain valid only because alpha.6 is additive. The gateway must
+- `alpha6-strict-review-rescue-v1`
+- `milestone-initial-assembly-v1`
+- `milestone-autonomy-contract-v1`
+- `milestone-autonomous-membership-evolution-v1`
+- `task-c1-derived-worker-actor-v1`
+- `guarded-corrective-auditor-routing-v1`
+- `plan-proof-obligations-v1`
+
+Protocol `1` and schema `2` remain valid only because alpha.7 is additive. The gateway must
 not claim compatibility if canonical entity shapes or non-additive command semantics change.
 
 ## Alpha.6 adoption posture
@@ -86,7 +93,7 @@ workflow state manually; recovery remains coordinator-controlled.
 
 ## Plan Risk Audit and remediation breaker
 
-Before `task authorize`, every new alpha.6 Task requires:
+Before `task authorize`, every new alpha.7 Task requires:
 
 ```text
 codex-workflow task plan-risk-audit --repo <git-root> \
@@ -94,7 +101,8 @@ codex-workflow task plan-risk-audit --repo <git-root> \
 ```
 
 The audit must classify every current Step exactly once, name distinct planner/auditor
-actors, and bind guarded failure modes to exact Step checks. Use `decision=approved` for an
+actors, bind guarded failure modes to exact Step checks, and map each guarded failure mode to
+one hostile counterexample, expected safe result, and exact executable evidence command. Use `decision=approved` for an
 unguarded Plan. Missing, stale, `split-required`, or `stop-escalate` evidence blocks
 authorization.
 
@@ -113,17 +121,23 @@ fourth run is prohibited; only split or stop may be recorded.
 
 ## Context refresh
 
+Before `task plan-set`, compare exact Step `allowedWrites` and expected output paths with scanner
+classifications. A planned new scanner-visible Knowledge file must be declared with
+`knowledgeImpact: create` and an exact path/category `knowledgeTargets` entry. Wildcards,
+directories, and inferred authority are not declarations; only Core may decide whether the final
+diff is eligible for delegated refresh.
+
 Use `task context-refresh` only when the same `next` response exposes `contextRefresh` for the
 exact grant. Pass Task revision, map revision, delegate actor, and grant ID. The composite
-operation is restricted to content-hash-only drift and records the ordinary delegated map and
-Task authorization evidence. Any semantic map change remains on the normal visible path.
+operation accepts content-hash-only drift and, under a Milestone Autonomy Grant, an exact
+supporting-source addition predeclared by the current execution-authorized Task Plan. Core checks
+the full fail-closed predicate; do not reconstruct it in the gateway. When `next` instead returns
+`contextRefreshBlocked.unsafeDifferences`, keep the change on the normal visible Knowledge path.
 
 Before updating the installed package, run `update preflight`. Continue only for `safe=true`.
-
-Alpha.6.1 adds one compatibility exception before package update: an exact alpha.6 claimed-C1
-pending strict review with stale Knowledge may use external `update rescue-preflight` followed
-by its single `update rescue-review` action. The action must preserve the original lease and
-prove its bound actor/token; `locks repair` is forbidden before this review.
+For an alpha.6 project trapped between a pending strict review and forbidden Knowledge rebind,
+an exact external alpha.7 runner may run `update rescue-preflight`. Continue only for
+`eligible=true` and only with the returned lock-repair and strict-review actions.
 
 ## C1 handoff
 
@@ -132,7 +146,7 @@ prove its bound actor/token; `locks repair` is forbidden before this review.
 ```text
 codex-workflow task handoff-prepare --repo <git-root> --id <TASK-ID> \
   --expected-revision <REVISION> --actor <CURRENT-ACTOR> \
-  --target-actor <TARGET-ACTOR> --reason <TEXT> [--writer-token <TOKEN>] \
+  [--target-actor <TARGET-ACTOR>] --reason <TEXT> [--writer-token <TOKEN>] \
   [--delegation-grant <GRANT>] [--expires-at <ISO-TIMESTAMP>]
 codex-workflow task handoff-show --repo <git-root> --id <TASK-ID>
 codex-workflow task claim --repo <git-root> --id <TASK-ID> \
@@ -146,9 +160,31 @@ codex-workflow task handback-create --repo <git-root> --id <TASK-ID> \
 While a handoff is pending, `next` blocks the previous action behind `task claim`. While
 claimed, only the claimant may mutate the Task, and lease-bound mutations must present the
 bound writer token. Milestone-linked Tasks must be claimed before start, and handback is
-terminal and evidence-bound. No thread id is required or accepted as authority.
+terminal and evidence-bound. When target actor is omitted, Core derives
+`agent:worker:<task-id>`. No thread id is required or accepted as authority.
+
+## Milestone assembly, autonomy, and human gate
+
+During initial planning, materialize every linked Task and then call `milestone plan-set` once
+with the complete membership. Execution is blocked while reverse membership is incomplete.
+
+After that Plan, one human may prepare and grant a maximum-72-hour Milestone Autonomy Contract:
+
+```text
+codex-workflow milestone autonomy-prepare --repo <git-root> --id <MS-ID> \
+  --expected-revision <REVISION> --principal <HUMAN> --delegate <AGENT> --expires-at <ISO>
+codex-workflow milestone autonomy-grant --repo <git-root> --id <MS-ID> \
+  --expected-revision <REVISION> --principal <HUMAN> --delegate <AGENT> --expires-at <ISO> \
+  --confirmation-code <MAC-CODE>
+```
 
-## Milestone scope change and human gate
+The contract issues a milestone-scoped grant for the existing Task/Milestone approval transitions
+and Project Memory approval only inside an atomic Task context refresh for the same Milestone.
+That composite path covers content-only drift plus exact Plan-bounded supporting-source additions;
+it cannot approve Project Memory independently. `milestone autonomy-evolve --file
+<plan.json>` is permitted only when outcome, success signal, acceptance, checks, discovery, and
+base branch still match the contract. It journals agent actor plus contract evidence and requires
+reauthorization afterward.
 
 After the initial empty planning posture, Milestone scope updates use:
 
@@ -160,7 +196,7 @@ codex-workflow milestone scope-change-apply --repo <git-root> \
   --confirmation-code <MSC-CODE> --file <plan.json>
 ```
 
-This path is human-only. Delegated approval never authorizes it.
+This ordinary semantic-change path is human-only. Generic delegated approval never authorizes it.
 
 At `awaiting_final_acceptance`, `next` returns `requiredHumanGate` with kind
 `milestone_final_acceptance`, Milestone ID, revision, Plan/Result/evidence hashes, validated
@@ -188,8 +224,8 @@ as `--delegation-grant`. The resulting authorization event records the grant and
 For `milestone.final_accept`, also pass the current `MSA-*` code; the existing grant replaces
 the later-message requirement, not the state binding.
 
-Delegated approval does not cover adoption apply, Milestone scope change, or any other new
-human-only alpha.6 action.
+Delegated approval does not cover adoption apply or the ordinary semantic Milestone scope-change
+path. Membership-only evolution requires the separate Milestone Autonomy Contract.
 
 ## Graph Refresh Request
 

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -27,6 +27,11 @@ files, or MCP ADR storage as a fallback.
 6. Run `gateway handshake` before other actions. Stop on package, protocol, or
    state-schema incompatibility.
 
+The sole exception is the alpha.7 `update rescue-preflight` compatibility profile. An exact
+external alpha.7 runner may inspect a project still pinned to alpha.6 only when this read-only
+command reports `eligible=true`. Execute only its returned stale-lock repair and strict-review
+actions; do not use the external runner for any other transition or dependency mutation.
+
 If any step fails, report the concrete diagnostic. Do not load workflow
 semantics from this skill.
 
@@ -38,9 +43,19 @@ classifications, hashes, gaps, conflicts, and approval evidence.
 
 Do not create a memory directory or write project files during scan.
 
+Before `task plan-set`, the Technical Planner compares every exact `allowedWrites` and expected
+output path with the package scanner classifications. If the Plan will create a file that the
+scanner will treat as Project Knowledge (for example a test or documentation source), declare
+`knowledgeImpact: create` and one `knowledgeTargets` entry with that exact normalized path and
+scanner category. Do not replace the path with a wildcard or directory, do not infer or assign
+authority, and do not claim delegated-refresh eligibility; Core decides eligibility from the
+resulting repository diff and current authorization state.
+
 When `next` exposes an exact delegated `contextRefresh`, use `task context-refresh` only for
-the returned Task/map revisions, actor, and grant. Never use it when the source set,
-classification, authority, gaps, or conflicts changed.
+the returned Task/map revisions, actor, and grant. A source-set change is eligible only when
+Core identifies it as a Plan-bounded supporting-source addition under the same Milestone
+Autonomy Grant. Never infer eligibility from the Plan yourself; if Core returns
+`contextRefreshBlocked.unsafeDifferences`, use the ordinary visible Knowledge Map flow.
 
 ## Product Or Workflow Graph Refresh
 
@@ -103,20 +118,29 @@ option is returned, follow the ordinary human-gate rule above. Knowledge Map app
 delegable only through an explicit project-scoped `project_memory.approve` permission. Scope
 changes, grant issuance, and grant expansion are never delegated by `delegated-approval-v1`.
 
+For an entire Milestone, prefer one bounded `milestone autonomy-prepare` gate after the complete
+initial membership Plan exists. Show principal, delegate, expiry, semantic-scope hash, policy
+hash, and `MAC-*` code, then stop. A later exact approval permits `milestone autonomy-grant`.
+The resulting grant covers the existing Task/Milestone approval transitions and the Project
+Memory approval portion of an atomic Task context refresh for the same Milestone. Besides
+content-only drift, Core may accept exact supporting-source additions predeclared by the current
+execution-authorized Task Plan; unsafe differences remain blocked. The contract never permits
+standalone Project Memory approval. It also permits `milestone autonomy-evolve`
+only for membership changes; any change to outcome, success signal, acceptance, checks,
+discovery, or base branch requires the ordinary human scope-change gate. Never self-renew or
+replace the contract.
+
 After two failed Task reviews, follow `next.correctivePlanGate`: obtain a distinct read-only
 corrective Auditor result and pass it through `--corrective-audit-file`. Do not continue for
 replan, split, or stop decisions.
 
+When `next` returns a derived C1 Worker or corrective Auditor actor, use that exact actor without
+asking the user to name one. Derivation removes a routing pause; handoff claim, writer lease,
+strict review, and auditor-independence checks remain mandatory.
+
 Before an npm package update, run the project-local `update preflight` and stop unless it
 returns `safe=true` with a clean checkout, no running Step, and no active writer lease.
 
-For a project still pinned exactly to `2.0.0-alpha.6` with one claimed-C1 pending strict review
-blocked by stale Project Knowledge, do not update the dependency and do not repair the lease.
-Resolve the exact external `2.0.0-alpha.6.1` runner, run its read-only `update rescue-preflight`,
-and continue only for `eligible=true` with the single returned `update rescue-review` action.
-Use the exact claimant and original bound writer token without printing the token. Stop on any
-binding mismatch or additional blocker.
-
 ## Stop Conditions
 
 - Dependency version is missing, ranged, or differs from the installed package.

package/references/state-machine.md

@@ -6,14 +6,15 @@ to the task commit and Brief, Plan, and evidence hashes. Final acceptance is a s
 human event bound to Result, evidence, and commit. Locks expire only diagnostically;
 removing a stale lock is always an explicit repair operation.
 
-Alpha.6 keeps canonical entity JSON unchanged at `stateSchemaVersion: 2` and adds lifecycle
-evidence through sidecars. `protocolVersion: 1` remains valid only because the alpha.6
+Alpha.7 keeps canonical entity JSON unchanged at `stateSchemaVersion: 2` and adds lifecycle
+evidence through sidecars. `protocolVersion: 1` remains valid only because the alpha.7
 surface is additive and capability-advertised.
 
-Before execution authorization, every alpha.6 Task must have a current Plan Risk Audit bound
+Before execution authorization, every alpha.7 Task must have a current Plan Risk Audit bound
 to the current Brief, Plan, Knowledge Map, and exact Step set. The audit is required even when
 all Steps are unguarded, must name distinct planner/auditor actors, and must bind guarded
-failure modes to exact Step checks. Missing, stale, inconsistent, `split-required`, or
+failure modes to exact Step checks. Each newly recorded guarded failure mode also requires one
+hostile counterexample, expected safe result, and exact evidence command. Missing, stale, inconsistent, `split-required`, or
 `stop-escalate` evidence blocks authorization.
 
 If the current Plan Risk Audit marks a Step for strict review, `task step-complete` still
@@ -36,11 +37,16 @@ bindings, supersedes execution authorization, and returns the Task to
 `awaiting_execution_authorization`. It cannot run while a Step is `in_progress` or while the
 Task is `blocked`; unrelated blocks must be resolved through their owning transition.
 
-For alpha.6 guarded remediation, two ordinary remediation attempts are allowed. A third
+For guarded remediation, two ordinary remediation attempts are allowed. Corrective posture is
+derived from the guarded Step, current Plan Risk Audit, remediation history, and
+corrective-decision history rather than from `Task.status` alone, so the same gate survives
+content-only Knowledge refresh, Task Knowledge rebind, and later reauthorization. A third
 ordinary retry is blocked until a current corrective decision exists for the same Step and
-Plan binding. `continue-fix` allows bounded continuation; `replan-required`,
-`split-required`, and `stop-escalate` stop ordinary execution. A failed third corrective
-attempt is a hard stop: no fourth run or new continue/replan decision is accepted.
+Plan binding. `continue-fix` allows exactly the third corrective attempt; `replan-required`
+requires an actual new Plan posture before execution; `split-required` and `stop-escalate`
+stop ordinary execution. A failed third corrective attempt is a hard stop: `next` must
+report the stop without throwing, no fourth run is allowed, and no new `continue-fix` or
+`replan-required` decision is accepted.
 
 Milestone authorization is bound to its Plan and membership revision. Plan amendments
 supersede authorization. Milestone validation and acceptance are bound to the current base
@@ -55,10 +61,21 @@ but the acceptance command still requires the current `MSA-*` code so the use re
 to the validated revision, hashes, and HEAD. Grant issuance itself always remains a prior
 human turn boundary.
 
-After the initial empty planning posture, Milestone scope updates no longer use ordinary
-`milestone plan-set`. They must go through `milestone scope-change-prepare` and
-`milestone scope-change-apply`, which journal `state.json`, `plan.json`, and
-`scope-change-events.jsonl` together and remain human-only. Membership integrity is validated
+During initial planning, all linked Tasks may be materialized before one complete
+`milestone plan-set`; execution remains blocked until every reverse membership is classified.
+After that boundary, semantic updates use human-only `milestone scope-change-prepare` and
+`milestone scope-change-apply`. A human-confirmed, expiring Milestone Autonomy Contract may
+use `milestone autonomy-evolve` only for membership changes while outcome, success signal,
+acceptance, checks, discovery, and base branch remain fixed. It may also approve Project Memory
+only within an atomic context refresh for a Task in that Milestone; standalone map approval
+remains forbidden. In addition to content-only drift, that composite transition may accept a new
+supporting source only when its exact normalized path and scanner category were declared by the
+current execution-authorized Task Plan under `knowledgeImpact: create`. The Task must belong to
+the grant's Milestone. Every added source must match the Plan, and removals, canonical additions,
+wildcard or directory targets, existing source category/scope/authority changes, gaps, and
+conflicts fail closed before any state write. `next` exposes the composite option only when the
+full predicate passes and otherwise reports concrete unsafe differences. Both update paths journal
+`state.json`, `plan.json`, and `scope-change-events.jsonl` together. Membership integrity is validated
 before scheduling, Task start, Milestone validation, scope change, and repository `next`.
 The same guard scans in reverse and blocks every live Task whose `milestoneId` is absent from
 the Milestone's required/waived/cancelled classification.
@@ -68,7 +85,8 @@ token and prompt bound to a stable handoff ID, revision, context hashes, Milesto
 delegate/grant, expected next action, and expiry. `task claim` validates those bindings and
 activates claimant-only mutation; terminal `task handback-create` returns result, evidence,
 review, knowledge, limitation, and recommended-next bindings. Milestone Tasks must be claimed
-before start. No part of this contract requires or proves a physically separate Codex thread.
+before start. If no target is supplied, Core derives `agent:worker:<task-id>`. No part of this
+contract requires or proves a physically separate Codex thread.
 
 Repository-level scheduling respects current Milestone membership. An unstarted linked Task
 is eligible only for an `active` Milestone with `required` disposition. Historical unstarted

package/roles/delivery-coordinator.md

@@ -12,7 +12,14 @@ Own state transitions, dispatch envelopes, evidence collection, and recovery gui
   request the user's explicit decision, and end the turn. Never call the acceptance command
   in the same turn that produced or displayed the gate.
 - Accept a Milestone only after a later user message explicitly approves that exact
-  confirmation code. Do not infer approval from a request to validate, finish, or continue.
+  confirmation code, or through the exact active Milestone Autonomy Contract option. Do not
+  infer approval from a request to validate, finish, or continue.
+- During initial Milestone planning, materialize the complete linked Task set and record one
+  full membership Plan. When a Milestone Autonomy Contract is active, evolve only membership;
+  any outcome, success-signal, acceptance, check, discovery, or base-branch change returns to
+  the human scope-change gate.
+- Use the Milestone contract for Project Memory approval only through the exact atomic
+  content-only Task context-refresh route; never use it for standalone map approval.
 - Dispatch one Worker at a time for a concrete Step.
 - A Milestone coordinator creates one dedicated user-visible Codex Task chat for each required
   Task. The Milestone chat owns ordering, exact delegated approvals, merge observation,
@@ -22,6 +29,8 @@ Own state transitions, dispatch envelopes, evidence collection, and recovery gui
 - After a second failed independent Task review, require a separate corrective Plan Auditor
   and pass its evidence through `--corrective-audit-file`. Continue only for
   `decision=continue-fix`; replan/split/stop decisions return to the coordinator or user.
+- Use the exact derived Worker and corrective Auditor actors returned by `next`; do not pause
+  for the user to invent routing identifiers.
 - Use `task context-refresh` only when `next.contextRefresh` offers the exact delegated,
   content-only option. Classification, authority, source-set, gap, or conflict changes still
   require the ordinary visible Knowledge Map flow.

package/roles/technical-planner.md

@@ -10,6 +10,9 @@ Translate an approved Brief into an execution-ready Plan.
   restart/replay, crash recovery, or an external provider must include failure-specific checks
   in the original Steps: populated forward upgrades, deterministic races, restart/crash
   windows, and provider failure/default behavior as applicable.
+- For every guarded failure mode, define one hostile counterexample, the expected safe result,
+  and the exact executable Step check that proves it. A happy-path check is not a proof
+  obligation for an adversarial or crash-window claim.
 - Split a Task when one acceptance slice would otherwise combine persistence migration,
   recovery orchestration, and executable composition. Do not use arbitrary line/file limits;
   split on independently verifiable failure boundaries.

package/schemas/context-envelope.schema.json

@@ -43,16 +43,6 @@
     "stepId": { "type": "string", "pattern": "^STEP-[0-9]{3}(?:-[A-Z0-9-]+)?$" },
     "expectedRevision": { "type": "integer", "minimum": 1 },
     "writerToken": { "type": ["string", "null"] },
-    "remediation": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["attemptOrdinal", "mode", "correctiveDecisionEventId"],
-      "properties": {
-        "attemptOrdinal": { "type": "integer", "minimum": 1, "maximum": 3 },
-        "mode": { "enum": ["ordinary", "corrective"] },
-        "correctiveDecisionEventId": { "type": ["string", "null"] }
-      }
-    },
     "knowledgeMap": {
       "type": "object",
       "additionalProperties": false,

package/schemas/milestone-autonomy-event.schema.json

@@ -0,0 +1,45 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://codex-workflow.local/schemas/milestone-autonomy-event.schema.json",
+  "title": "Codex Workflow V2 Alpha.7 Milestone Autonomy Event",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "eventId",
+    "previousEventHash",
+    "recordedAt",
+    "eventHash",
+    "eventType",
+    "projectId",
+    "milestoneId",
+    "milestoneRevision",
+    "principal",
+    "delegate",
+    "issuedAt",
+    "expiresAt",
+    "semanticScopeHash",
+    "delegationGrantId",
+    "delegationPolicyHash"
+  ],
+  "properties": {
+    "eventId": { "type": "string", "pattern": "^MAC-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "previousEventHash": { "$ref": "#/$defs/nullableHash64" },
+    "recordedAt": { "type": "string", "format": "date-time" },
+    "eventHash": { "$ref": "#/$defs/hash64" },
+    "eventType": { "const": "issued" },
+    "projectId": { "type": "string", "minLength": 1 },
+    "milestoneId": { "type": "string", "pattern": "^MS-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "milestoneRevision": { "type": "integer", "minimum": 1 },
+    "principal": { "type": "string", "minLength": 1 },
+    "delegate": { "type": "string", "pattern": "^agent:.+" },
+    "issuedAt": { "type": "string", "format": "date-time" },
+    "expiresAt": { "type": "string", "format": "date-time" },
+    "semanticScopeHash": { "$ref": "#/$defs/hash64" },
+    "delegationGrantId": { "type": "string", "pattern": "^DGR-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "delegationPolicyHash": { "$ref": "#/$defs/hash64" }
+  },
+  "$defs": {
+    "hash64": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "nullableHash64": { "type": ["string", "null"], "pattern": "^[a-f0-9]{64}$" }
+  }
+}

package/schemas/milestone-scope-change-event.schema.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://codex-workflow.local/schemas/milestone-scope-change-event.schema.json",
-  "title": "Codex Workflow V2 Alpha.6 Milestone Scope Change Event",
+  "title": "Codex Workflow V2 Alpha.7 Milestone Scope Change Event",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -32,6 +32,8 @@
     "after": { "$ref": "#/$defs/scopeSnapshot" },
     "actor": { "type": "string", "minLength": 1 },
     "confirmationCodeBindingHash": { "$ref": "#/$defs/hash64" },
+    "authorizationMode": { "enum": ["human", "milestone-autonomy"] },
+    "autonomyContractEventHash": { "$ref": "#/$defs/nullableHash64" },
     "previousEventHash": { "$ref": "#/$defs/nullableHash64" },
     "recordedAt": { "type": "string", "format": "date-time" },
     "eventHash": { "$ref": "#/$defs/hash64" }

package/schemas/plan-risk-audit-event.schema.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://codex-workflow.local/schemas/plan-risk-audit-event.schema.json",
-  "title": "Codex Workflow V2 Alpha.6 Plan Risk Audit Event",
+  "title": "Codex Workflow V2 Alpha.7 Plan Risk Audit Event",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -65,7 +65,11 @@
         },
         "reviewRequired": { "type": "boolean" },
         "failureModes": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
-        "requiredEvidence": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1 } }
+        "requiredEvidence": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+        "proofObligations": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/proofObligation" }
+        }
       },
       "oneOf": [
         {
@@ -73,7 +77,8 @@
             "categories": { "maxItems": 0 },
             "reviewRequired": { "const": false },
             "failureModes": { "maxItems": 0 },
-            "requiredEvidence": { "maxItems": 0 }
+            "requiredEvidence": { "maxItems": 0 },
+            "proofObligations": { "maxItems": 0 }
           }
         },
         {
@@ -81,10 +86,22 @@
             "categories": { "minItems": 1 },
             "reviewRequired": { "const": true },
             "failureModes": { "minItems": 1 },
-            "requiredEvidence": { "minItems": 1 }
+            "requiredEvidence": { "minItems": 1 },
+            "proofObligations": { "minItems": 1 }
           }
         }
       ]
+    },
+    "proofObligation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["failureMode", "counterexample", "expectedResult", "evidence"],
+      "properties": {
+        "failureMode": { "type": "string", "minLength": 1 },
+        "counterexample": { "type": "string", "minLength": 1 },
+        "expectedResult": { "type": "string", "minLength": 1 },
+        "evidence": { "type": "string", "minLength": 1 }
+      }
     }
   }
 }