codex-workflow-v2 2.0.0-alpha.6 → 2.0.0-alpha.6.2

package/docs/decisions.md

@@ -80,3 +80,7 @@ This document closes the requirement gaps identified during the V2 design review
 15. **Safe update preflight.** Dependency updates begin with a read-only preflight requiring
     a clean checkout, no running Step, and no active writer lease. It does not install,
     migrate, or mutate project state.
+16. **Claimed-C1 rescue is one guarded transition.** The alpha.6.1 backport may bypass only
+    the stale Knowledge binding that blocks one exact pending strict review. It requires the
+    original claimant actor and writer token, preserves the lease, rechecks clean completion
+    HEAD and C1 bindings, and never composes stale-lock repair with review.

package/docs/release.md

@@ -31,3 +31,7 @@ Tag releases as `v<package-version>`. The tag workflow verifies the tag/package
 uses npm trusted publishing with public access. For a public GitHub repository and public
 package, npm trusted publishing generates provenance automatically. Publishing is never
 performed by local validation commands.
+
+The `2.0.0-alpha.6.x` backport line publishes with the dedicated `backport-alpha6`
+dist-tag (or by exact version). It must never move npm's `next` tag, which remains owned by
+the alpha.7 line.

package/docs/updating-existing-project.md

@@ -22,6 +22,46 @@ state schema. Совпадение `stateSchemaVersion` до и после об
 нужна. Для alpha.6 при `stateSchemaVersion: 2` применяется не migration, а sidecar-only
 adoption posture.
 
+## Исключение: claimed C1 strict-review deadlock в alpha.6
+
+Не обновляйте dependency, если alpha.6 Task уже имеет `in_progress` Step с completion evidence,
+pending strict review и stale Knowledge binding. Для такого состояния используйте внешний
+точный runner `2.0.0-alpha.6.1`; сам проект до завершения recovery остаётся закреплён на
+`2.0.0-alpha.6`.
+
+Сначала выполните только `update rescue-preflight`. Продолжать разрешено исключительно при
+`eligible=true` и одной exact action `update rescue-review`. Передайте returned Task ID, Step
+ID, revision, claimant actor и исходный bound writer token. Не выводите token в чат и не
+передавайте другому actor.
+
+Recovery не требует и не допускает предварительный `locks repair`: alpha.6.1 проверяет token
+сразу против существующего lease и C1 hash, затем сохраняет и heartbeat'ит тот же lease в
+единственной guarded review-команде. Active и stale lease допустимы только при exact binding.
+Неверный actor/token, dirty checkout, advanced HEAD, второй pending review
+или посторонний lease блокируют переход без изменения Task state.
+
+После successful review следуйте обычному `next`: reconcile/approve Knowledge Map, выполните
+knowledge rebind, свежую authorization и завершите Task. Только на безопасной lifecycle-границе
+запускайте обычное обновление dependency и gateway.
+
+## Исключение: signal_v4 после двух failed review в alpha.6
+
+Если точный alpha.6 state уже дошёл до Task revision 14/status `ready`, `STEP-001` имеет два
+distinct verified strict-review failure, remediation `attemptCount=2`, а corrective decision
+отсутствует, используйте только внешний runner `2.0.0-alpha.6.2`. Dependency проекта при этом
+остаётся точно `2.0.0-alpha.6`.
+
+Сначала выполните mutation-free `update corrective-rescue-preflight`. Он требует clean checkout
+на exact HEAD `5c63798cc7b8fbb5e1c8b26ebf93876bc642295a`, неизменные Brief/Plan/Milestone bindings,
+claimed C1 и ровно один token-bound lease. Stale lease допустим только при точном совпадении
+claimant/token binding; plaintext token команда не возвращает.
+
+При `eligible=true` команда `update corrective-rescue-apply` принимает исходный actor/token,
+полный corrective Plan, independent `continue-fix` decision audit и отдельный independent Plan
+audit. Она использует канонические переходы, heartbeat'ит существующий lease только после
+проверки actor/token и не удаляет его. Нельзя вручную редактировать state, Brief, Step 2,
+requirements/acceptance или Milestone scope.
+
 ## 1. Подготовьте отдельный чат обновления
 
 Не обновляйте пакет во время выполняющегося Worker Step. Дождитесь завершения текущего ответа

package/docs/validation-report.md

@@ -1,11 +1,15 @@
 # V2 Alpha Validation Report
 
-Release candidate `2.0.0-alpha.6` was validated through 2026-08-14 with Node.js 24.17.0.
+Release candidate `2.0.0-alpha.6.2` was validated on 2026-08-14 with Node.js 20.12.2 as a
+narrow backport from the `2.0.0-alpha.6.1` backport line, itself based on published
+`2.0.0-alpha.6`.
 
 - `npm run typecheck`, `npm run build`, `npm test`, `npm run validate`, `npm run plugin:check`,
   `npm run smoke:downstream`, `npm run release:check`, and `npm run pack:check` passed in the
-  task evidence recorded for TASK-002.
-- The final sequential full suite passed `81/81` on 2026-08-14.
+  sequential backport validation.
+- The final sequential full suite passed `89/89` on 2026-08-14.
+- The package test script runs test files sequentially; the unsupported
+  `--test-force-exit` flag was removed.
 - Plan Risk Audit coverage includes the combined `plan-set --risk-audit-file` path, atomic
   rejection before Task/Plan acceptance, distinct planner/auditor identities, exact current
   Step-set equality, concrete failure modes, executable evidence binding, coupled
@@ -14,9 +18,20 @@ Release candidate `2.0.0-alpha.6` was validated through 2026-08-14 with Node.js
 - Strict high-risk Step Review coverage includes workflow-owned completion commits,
   `task step-review` routing, commit-bound reviewer attestation, and fail-closed rejection of
   stale, malformed, unverified, and wrong-commit review evidence.
+- Alpha.6.1 rescue coverage reproduces the production deadlock with an exact alpha.6
+  dependency, stale Knowledge binding, pending strict review, claimed C1 posture, and both
+  active and stale bound leases. The single rescue action preserves the original lease,
+  exposes no plaintext token, completes review with the exact claimant/token, and fails closed
+  for a wrong actor or token. Ordinary `task step-review` remains blocked by stale Knowledge.
 - Guarded remediation coverage includes the per-Step circuit breaker: two ordinary retries
-  allowed, third gated by bounded `continue-fix`, a hard stop after a third failed corrective
-  review, and stop/redirection handling for `split-required` and `stop-escalate`.
+  allowed, the third gated by a separate decision plus full independently audited corrective
+  Plan, an explicit corrective run envelope, a hard stop after a third failed corrective
+  review, and stop/redirection handling for `split-required` and `stop-escalate`. Knowledge
+  rebind and reauthorization preserve this breaker posture.
+- Signal_v4 rescue coverage includes exact alpha.6 dependency/HEAD/Task/review-history
+  matching, mutation-free preflight, active and stale bound leases without token disclosure,
+  wrong actor/token ordering before heartbeat, scope-preserving decision plus full Plan apply,
+  dirty/advanced checkout rejection, malformed/missing review evidence, and unrelated leases.
 - Milestone coverage includes human-only scope-change prepare/apply, journaled recovery of
   `state.json`, `plan.json`, and `scope-change-events.jsonl`, plus membership-integrity
   blocking for stale or contradictory Milestone/Task state, including reverse detection of a
@@ -35,13 +50,16 @@ Release candidate `2.0.0-alpha.6` was validated through 2026-08-14 with Node.js
   `plan-risk-audit-sidecar-v1`, `step-strict-review-sidecar-v1`,
   `step-remediation-circuit-breaker-sidecar-v1`, `milestone-scope-change-sidecar-v1`,
   `milestone-membership-integrity-v1`, `task-c1-handoff-sidecar-v1`, and
-  `alpha6-adoption-posture-v1`, plus strengthened contracts advertised as
+  `alpha6-adoption-posture-v1`, `alpha6-c1-strict-review-rescue-v1`, and
+  `alpha6-corrective-rescue-signal-v4`, plus strengthened contracts advertised as
   `semantic-plan-risk-audit-v2`, `guarded-remediation-hard-stop-v1`,
   `milestone-reverse-membership-integrity-v1`, and `task-c1-handoff-bundle-v2`.
-- npm dry-run packaging produced `codex-workflow-v2-2.0.0-alpha.6.tgz` with runtime, schemas,
+- npm dry-run packaging produced `codex-workflow-v2-2.0.0-alpha.6.2.tgz` with runtime, schemas,
   references, docs, and plugin source. Downstream installation and the packaged CLI handshake
   passed, and the install created none of `.codex`, `.tasks`, `.increments`, or
   `.memory-bank` in the temporary project.
+- Release checks require the dedicated `backport-alpha6` npm dist-tag, so publishing this
+  version cannot move the alpha.7-owned `next` tag.
 
 Not claimed here:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-alpha.6",
+  "version": "2.0.0-alpha.6.2",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "clean": "node --eval \"import('node:fs').then(({rmSync}) => { rmSync('dist', {recursive:true, force:true}); rmSync('.test-dist', {recursive:true, force:true}); })\"",
     "build": "npm run clean && tsc -p tsconfig.build.json && node scripts/mark-cli-executable.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "npm run build && tsc -p tsconfig.test.json && node --test .test-dist/tests/*.test.js",
+    "test": "npm run build && tsc -p tsconfig.test.json && node --test --test-concurrency=1 .test-dist/tests/*.test.js",
     "validate": "npm run typecheck && npm test",
     "pack:check": "npm run build && npm pack --dry-run",
     "smoke:downstream": "npm run build && node scripts/downstream-smoke.mjs",

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -120,6 +120,11 @@ Task authorization evidence. Any semantic map change remains on the normal visib
 
 Before updating the installed package, run `update preflight`. Continue only for `safe=true`.
 
+Alpha.6.1 adds one compatibility exception before package update: an exact alpha.6 claimed-C1
+pending strict review with stale Knowledge may use external `update rescue-preflight` followed
+by its single `update rescue-review` action. The action must preserve the original lease and
+prove its bound actor/token; `locks repair` is forbidden before this review.
+
 ## C1 handoff
 
 `C1` coordination is machine-bound and local. Use:

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -110,6 +110,13 @@ replan, split, or stop decisions.
 Before an npm package update, run the project-local `update preflight` and stop unless it
 returns `safe=true` with a clean checkout, no running Step, and no active writer lease.
 
+For a project still pinned exactly to `2.0.0-alpha.6` with one claimed-C1 pending strict review
+blocked by stale Project Knowledge, do not update the dependency and do not repair the lease.
+Resolve the exact external `2.0.0-alpha.6.1` runner, run its read-only `update rescue-preflight`,
+and continue only for `eligible=true` with the single returned `update rescue-review` action.
+Use the exact claimant and original bound writer token without printing the token. Stop on any
+binding mismatch or additional blocker.
+
 ## Stop Conditions
 
 - Dependency version is missing, ranged, or differs from the installed package.

package/schemas/context-envelope.schema.json

@@ -43,6 +43,16 @@
     "stepId": { "type": "string", "pattern": "^STEP-[0-9]{3}(?:-[A-Z0-9-]+)?$" },
     "expectedRevision": { "type": "integer", "minimum": 1 },
     "writerToken": { "type": ["string", "null"] },
+    "remediation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["attemptOrdinal", "mode", "correctiveDecisionEventId"],
+      "properties": {
+        "attemptOrdinal": { "type": "integer", "minimum": 1, "maximum": 3 },
+        "mode": { "enum": ["ordinary", "corrective"] },
+        "correctiveDecisionEventId": { "type": ["string", "null"] }
+      }
+    },
     "knowledgeMap": {
       "type": "object",
       "additionalProperties": false,

package/schemas/corrective-plan-audit-record.schema.json

@@ -0,0 +1,47 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://codex-workflow.local/schemas/corrective-plan-audit-record.schema.json",
+  "title": "Codex Workflow V2 Alpha.6 Corrective Plan Audit Binding",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "recordedAt",
+    "taskId",
+    "taskRevision",
+    "stepId",
+    "triggeringAttemptCount",
+    "decisionEventId",
+    "decisionPlanHash",
+    "previousPlanHash",
+    "correctivePlanHash",
+    "failedReviewAttempts",
+    "auditor",
+    "summary",
+    "decision",
+    "reviewedFindingIds"
+  ],
+  "properties": {
+    "recordedAt": { "type": "string", "format": "date-time" },
+    "taskId": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "taskRevision": { "type": "integer", "minimum": 0 },
+    "stepId": { "type": "string", "pattern": "^STEP-[0-9]{3}(?:-[A-Z0-9-]+)?$" },
+    "triggeringAttemptCount": { "const": 3 },
+    "decisionEventId": { "type": "string", "minLength": 1 },
+    "decisionPlanHash": { "$ref": "#/$defs/hash64" },
+    "previousPlanHash": { "$ref": "#/$defs/hash64" },
+    "correctivePlanHash": { "$ref": "#/$defs/hash64" },
+    "failedReviewAttempts": { "const": 2 },
+    "auditor": { "type": "string", "minLength": 1 },
+    "summary": { "type": "string", "minLength": 1 },
+    "decision": { "const": "continue-fix" },
+    "reviewedFindingIds": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1 }
+    }
+  },
+  "$defs": {
+    "hash64": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+  }
+}