codex-workflow-v2 2.0.0-alpha.6 → 2.0.0-alpha.7

package/dist/src/workflow.js

@@ -3,17 +3,19 @@ import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { PROTOCOL_VERSION, STATE_SCHEMA_VERSION, } from './contracts.js';
 import { renderBrief, renderPlan, renderResult } from './artifacts.js';
-import { assertDelegationCanAuthorize, delegationCanAuthorize, hashDelegationPolicy, prepareDelegationGrantGate, } from './delegation.js';
+import { assertDelegationCanAuthorize, hashDelegationPolicy, prepareDelegationGrantGate, } from './delegation.js';
 import { assessDiscovery, mergeUnique } from './domain/discovery.js';
 import { pathAllowed, validatePlan } from './domain/validation.js';
 import { WorkflowError } from './errors.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
-import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, assertTaskMutationAllowedByC1, readTaskC1Posture, } from './alpha6/handoff.js';
+import { inspectLocalDependency } from './diagnostics.js';
+import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
-import { appendCorrectiveDecisionEvent, appendRemediationEvent, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, findFailedGuardedStepRequiringCorrectiveDecision, readCorrectiveDecisionEvents, readRemediationEvents, } from './alpha6/remediation.js';
+import { appendCorrectiveDecisionEvent, appendRemediationEvent, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findFailedGuardedStepRequiringCorrectiveDecision, readCorrectiveDecisionEvents, readRemediationEvents, } from './alpha6/remediation.js';
 import { applyMilestoneScopeChangeTransaction, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
 import { buildCurrentStrictStepReviewCycle, ensurePendingStrictStepReview, isStepReviewRequired, recordStrictStepReview, } from './alpha6/review.js';
+import { applyMilestoneAutonomyContract, assertAutonomousPlanEvolution, prepareMilestoneAutonomyContract, readMilestoneAutonomyEvents, requireActiveMilestoneAutonomy, } from './alpha7/autonomy.js';
 import { applyKnowledgeSelections, hashKnowledgeMap, inspectKnowledgeMap, normalizeRelativePath, reconcileKnowledgeMap, scanProjectKnowledge, selectKnowledgeSources, } from './memory.js';
 import { canonicalJsonStringify, sha256Hex } from './alpha6/store-sidecars.js';
 import { commitStep, mergeTaskBranch, runChecks, startLocalTaskBranch, syncBaseIntoTask, validateTaskHistory, } from './git.js';
@@ -182,7 +184,12 @@ export class WorkflowService {
         if (!title.trim())
             throw new WorkflowError('INVALID_ARGUMENT', 'Task title is required.');
         if (milestoneId) {
-            const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
+            // A Milestone is assembled from independently materialized Task discoveries. During
+            // that bounded assembly window the reverse-membership set is intentionally incomplete;
+            // execution remains unavailable until one complete initial Milestone Plan classifies
+            // every linked Task. The scope-change reader preserves every other integrity check while
+            // allowing exactly that repairable reverse gap.
+            const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
             if (milestone.status === 'accepted' || milestone.status === 'cancelled') {
                 throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} is ${milestone.status}.`);
             }
@@ -401,6 +408,64 @@ export class WorkflowService {
             readTask: (taskId) => this.store.readTask(identity.projectId, taskId),
         });
     }
+    prepareMilestoneAutonomy(repository, milestoneId, expectedRevision, principal, delegate, expiresAt) {
+        const { identity } = this.context(repository);
+        const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
+        assertExpectedRevision(milestone, expectedRevision);
+        return prepareMilestoneAutonomyContract({
+            projectId: identity.projectId,
+            milestone,
+            principal,
+            delegate,
+            expiresAt,
+            now: this.now(),
+        });
+    }
+    grantMilestoneAutonomy(repository, milestoneId, expectedRevision, principal, delegate, expiresAt, confirmationCode) {
+        const { identity } = this.context(repository);
+        const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
+        assertExpectedRevision(milestone, expectedRevision);
+        return applyMilestoneAutonomyContract({
+            store: this.store,
+            projectId: identity.projectId,
+            milestone,
+            principal,
+            delegate,
+            expiresAt,
+            confirmationCode,
+            now: this.now(),
+        });
+    }
+    evolveMilestonePlanAutonomously(repository, milestoneId, expectedRevision, plan, actor) {
+        const { identity } = this.context(repository);
+        const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
+        assertExpectedRevision(milestone, expectedRevision);
+        assertMilestoneScopeChangeStatusAllowed(milestone);
+        const autonomy = requireActiveMilestoneAutonomy({
+            store: this.store,
+            projectId: identity.projectId,
+            milestone,
+            actor,
+            now: this.now(),
+        });
+        validateMilestonePlan(plan);
+        assertAutonomousPlanEvolution(milestone, plan, autonomy.contract);
+        const prepared = prepareMilestoneScopeChangeCandidate({
+            milestone,
+            plan,
+            readTask: (taskId) => this.store.readTask(identity.projectId, taskId),
+            actor,
+            autonomyContractEventHash: autonomy.contract.eventHash,
+        });
+        return applyMilestoneScopeChangeTransaction({
+            store: this.store,
+            milestone,
+            expectedRevision,
+            prepared,
+            now: this.now(),
+            readTask: (taskId) => this.store.readTask(identity.projectId, taskId),
+        });
+    }
     authorizeMilestone(repository, milestoneId, expectedRevision, actor, reason = '', delegationGrantId = null) {
         const { identity } = this.context(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
@@ -823,10 +888,10 @@ export class WorkflowService {
                 throw new WorkflowError('TRANSITION_BLOCKED', 'Automatic Task context refresh requires a previously approved map with content-only drift.', { currentStatus: currentMap.status, inspectedStatus: inspectedMap.status });
             }
             assertContentOnlyKnowledgeRefresh(currentMap, inspectedMap);
-            this.delegatedAuthorization(identity.projectId, delegationGrantId, 'project_memory.approve', actor, inspectedMap);
+            this.delegatedAuthorization(identity.projectId, delegationGrantId, 'project_memory.approve', actor, inspectedMap, task.id);
             knowledgeMap = this.reconcileKnowledgeMap(repository, currentMap.revision);
             transitions.push('project-memory reconcile');
-            knowledgeMap = this.approveKnowledgeMap(repository, knowledgeMap.revision, [], actor, delegationGrantId);
+            knowledgeMap = this.approveKnowledgeMapForTaskRefresh(repository, knowledgeMap.revision, [], actor, delegationGrantId, task.id);
             transitions.push('project-memory approve');
         }
         const knowledgeMapHash = hashKnowledgeMap(knowledgeMap);
@@ -1230,9 +1295,13 @@ export class WorkflowService {
     taskContext(repository, taskId, role) {
         const { identity } = this.context(repository);
         const task = this.store.readTask(identity.projectId, taskId);
+        const historicalStrictReview = role === 'independent-reviewer'
+            && task.steps.some((step) => step.status === 'in_progress' && step.evidence !== null);
         const knowledgeMap = task.knowledgeMapRevision === null
             ? this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId)
-            : this.assertTaskKnowledgeBinding(identity.repositoryRoot, task);
+            : historicalStrictReview
+                ? this.strictReviewKnowledgeMap(identity.repositoryRoot, task)
+                : this.assertTaskKnowledgeBinding(identity.repositoryRoot, task);
         const root = this.store.taskRoot(task.projectId, task.id);
         const planRiskAudit = task.planHash && !['planning', 'merged', 'cancelled'].includes(task.status)
             ? readCurrentPlanRiskAudit(this.store, task)
@@ -1263,7 +1332,7 @@ export class WorkflowService {
         if (role === 'technical-planner') {
             return {
                 ...common,
-                objective: `Produce an execution-ready Plan for ${task.title}. Perform an explicit risk review before plan-set: migrations, concurrency, restart/replay, crash windows, and external-provider behavior require failure-specific checks in the original Plan.${planRiskReviewScope}`,
+                objective: `Produce an execution-ready Plan for ${task.title}. Perform an explicit risk review before plan-set: migrations, concurrency, restart/replay, crash windows, and external-provider behavior require failure-specific checks and executable proof obligations in the original Plan.${planRiskReviewScope}`,
                 resultSchema: {
                     type: 'object',
                     required: ['objective', 'requirements', 'acceptance', 'risks', 'steps'],
@@ -1274,6 +1343,7 @@ export class WorkflowService {
                     'Concurrency or cursor/state ownership is planned without deterministic race checks.',
                     'Restart, replay, or crash recovery is claimed without restart/crash-window evidence.',
                     'An external provider is used without failure-injection and hidden-default verification.',
+                    'A guarded failure mode lacks a hostile counterexample, expected safe result, or exact executable evidence command.',
                     'The safe risk slice crosses persistence, recovery orchestration, and executable composition and should be split.',
                 ],
             };
@@ -1398,7 +1468,6 @@ export class WorkflowService {
             throw new WorkflowError('TRANSITION_BLOCKED', `Strict Step Review cannot run while task ${taskId} is ${task.status}.`);
         }
         assertTaskBranch(context.identity.repositoryRoot, task);
-        this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
         const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
         if (!planRiskAudit || !isStepReviewRequired(task, stepId, planRiskAudit.reviewRequiredStepIds)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Step ${stepId} is not marked for strict review by the current Plan Risk Audit.`, {
@@ -1414,6 +1483,13 @@ export class WorkflowService {
                 stepStatus: step.status,
             });
         }
+        // A strict review is bound to the immutable completion commit, Task Plan, and the
+        // Knowledge Map revision that authorized the Step. Project knowledge commonly becomes
+        // stale because the completion commit itself changes a classified source. Requiring the
+        // *current* map here creates a deadlock: review cannot run before rebind, while rebind is
+        // intentionally forbidden until the in-progress Step becomes terminal. The pending
+        // strict-review binding below validates the historical Task context; a current-map rebind
+        // remains mandatory after the review finalizes the Step and before another Step can run.
         validateTaskHistory(context.identity.repositoryRoot, task);
         if (!isClean(context.identity.repositoryRoot)) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Strict Step Review requires a clean Task checkout.', {
@@ -1845,6 +1921,109 @@ export class WorkflowService {
             adoption,
         };
     }
+    alpha6StrictReviewRescuePreflight(repository) {
+        const context = this.context(repository);
+        const dependency = inspectLocalDependency(context.identity.repositoryRoot);
+        const tasks = context.store.listTasks(context.identity.projectId);
+        const leases = context.locks.list();
+        const now = this.now().getTime();
+        const activeLeases = leases.filter((lease) => Date.parse(lease.expiresAt) > now);
+        const staleLeases = leases.filter((lease) => Date.parse(lease.expiresAt) <= now);
+        const dirty = changedFiles(context.identity.repositoryRoot);
+        const currentHead = headCommit(context.identity.repositoryRoot);
+        const pendingCandidates = [];
+        const malformedCandidates = [];
+        for (const task of tasks) {
+            if (task.status !== 'in_progress')
+                continue;
+            const planRiskAudit = task.planHash ? readCurrentPlanRiskAudit(this.store, task) : null;
+            if (!planRiskAudit)
+                continue;
+            for (const step of task.steps) {
+                if (step.status !== 'in_progress' || !step.evidence)
+                    continue;
+                if (!isStepReviewRequired(task, step.id, planRiskAudit.reviewRequiredStepIds))
+                    continue;
+                try {
+                    const cycle = buildCurrentStrictStepReviewCycle(this.store, task, step.id);
+                    if (cycle.resolution !== 'pending')
+                        continue;
+                    validateTaskHistory(context.identity.repositoryRoot, task);
+                    let knowledgeBindingStale = false;
+                    try {
+                        const storedKnowledgeMap = this.store.readKnowledgeMap(context.identity.projectId);
+                        const knowledgeMap = inspectKnowledgeMap(storedKnowledgeMap, scanProjectKnowledge(context.identity.repositoryRoot, context.identity.projectId, this.now()));
+                        knowledgeBindingStale = knowledgeMap.status !== 'active'
+                            || task.knowledgeMapRevision !== knowledgeMap.revision
+                            || task.knowledgeMapHash !== hashKnowledgeMap(knowledgeMap);
+                    }
+                    catch {
+                        knowledgeBindingStale = true;
+                    }
+                    pendingCandidates.push({
+                        taskId: task.id,
+                        taskRevision: task.revision,
+                        stepId: step.id,
+                        completionCommit: step.evidence.commitSha,
+                        currentHead,
+                        knowledgeBindingStale,
+                    });
+                }
+                catch (error) {
+                    malformedCandidates.push(error instanceof Error ? error.message : String(error));
+                }
+            }
+        }
+        const candidate = pendingCandidates.length === 1 ? pendingCandidates[0] : null;
+        const candidateLeaseIds = new Set(candidate ? [candidate.taskId] : []);
+        const blockers = [
+            ...(dependency.declared !== '2.0.0-alpha.6'
+                ? ['Project package.json must declare codex-workflow-v2 exactly at 2.0.0-alpha.6.']
+                : []),
+            ...(dirty.length > 0 ? ['Repository checkout is not clean.'] : []),
+            ...(activeLeases.length > 0 ? ['At least one writer lease is active.'] : []),
+            ...(pendingCandidates.length !== 1
+                ? [`Expected exactly one pending alpha.6 strict review; found ${pendingCandidates.length}.`]
+                : []),
+            ...(candidate && candidate.currentHead !== candidate.completionCommit
+                ? ['HEAD does not match the pending strict review completion commit.']
+                : []),
+            ...(staleLeases.some((lease) => !candidateLeaseIds.has(lease.entityId))
+                ? ['A stale writer lease exists outside the rescue Task.']
+                : []),
+            ...malformedCandidates.map((message) => `Pending strict review state is invalid: ${message}`),
+        ];
+        const eligible = blockers.length === 0 && candidate !== null;
+        const requiredActions = eligible
+            ? [
+                ...staleLeases.map((lease) => ({
+                    action: 'locks repair',
+                    entityId: lease.entityId,
+                })),
+                {
+                    action: 'task step-review',
+                    taskId: candidate.taskId,
+                    stepId: candidate.stepId,
+                    expectedRevision: candidate.taskRevision,
+                },
+            ]
+            : [];
+        return {
+            eligible,
+            mutationFree: true,
+            runnerPackageVersion: PACKAGE_VERSION,
+            requiredProjectPackageVersion: '2.0.0-alpha.6',
+            declaredProjectPackageVersion: dependency.declared,
+            projectId: context.identity.projectId,
+            repositoryRoot: context.identity.repositoryRoot,
+            clean: dirty.length === 0,
+            activeLeases,
+            staleLeases,
+            candidate,
+            blockers,
+            requiredActions,
+        };
+    }
     scanKnowledgeMap(repository) {
         const { identity } = this.context(repository);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
@@ -1869,11 +2048,14 @@ export class WorkflowService {
         return inspectKnowledgeMap(current, scanned);
     }
     approveKnowledgeMap(repository, expectedRevision, selections, actor, delegationGrantId = null) {
+        return this.approveKnowledgeMapForTaskRefresh(repository, expectedRevision, selections, actor, delegationGrantId, null);
+    }
+    approveKnowledgeMapForTaskRefresh(repository, expectedRevision, selections, actor, delegationGrantId, autonomyTaskId) {
         const { identity } = this.context(repository);
         const current = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(current, expectedRevision);
         const inspected = inspectKnowledgeMap(current, scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now()));
-        const delegation = this.delegatedAuthorization(identity.projectId, delegationGrantId, 'project_memory.approve', actor, inspected);
+        const delegation = this.delegatedAuthorization(identity.projectId, delegationGrantId, 'project_memory.approve', actor, inspected, autonomyTaskId);
         const approved = applyKnowledgeSelections(inspected, selections, actor, this.now());
         if (!approved.approval) {
             throw new WorkflowError('STATE_CORRUPT', 'Knowledge Map approval was not recorded.');
@@ -1942,11 +2124,20 @@ export class WorkflowService {
         const milestonesById = new Map(status.milestones.map((milestone) => [milestone.id, milestone]));
         const activeTask = status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
         if (activeTask) {
+            const activePlanRiskAudit = activeTask.planHash
+                ? readCurrentPlanRiskAudit(this.store, activeTask)
+                : null;
+            const taskNext = activeTask.status === 'planning'
+                ? null
+                : this.nextForTaskWithDelegation(status.projectId, activeTask, activePlanRiskAudit);
+            // Pending strict review is completion work for the already-recorded commit. It must
+            // outrank Project Knowledge refresh/rebind; otherwise the active Step makes the rebind
+            // returned by `next` impossible to execute.
+            if (taskNext?.action === 'task step-review') {
+                return withAdoption(taskNext);
+            }
             if (!taskCanRebindKnowledge(activeTask) && activeTask.status !== 'planning') {
-                const planRiskAudit = activeTask.planHash
-                    ? readCurrentPlanRiskAudit(this.store, activeTask)
-                    : null;
-                return withAdoption(this.nextForTaskWithDelegation(status.projectId, activeTask, planRiskAudit));
+                return withAdoption(taskNext);
             }
             const knowledgeMap = this.knowledgeMapStatus(repository);
             if (knowledgeMap.status !== 'active' || !knowledgeMap.approval) {
@@ -1994,10 +2185,7 @@ export class WorkflowService {
                     knowledgeMapHash,
                 });
             }
-            const planRiskAudit = activeTask.planHash && activeTask.status !== 'planning'
-                ? readCurrentPlanRiskAudit(this.store, activeTask)
-                : null;
-            return withAdoption(this.nextForTaskWithDelegation(status.projectId, activeTask, planRiskAudit));
+            return withAdoption(taskNext ?? this.nextForTaskWithDelegation(status.projectId, activeTask, null));
         }
         const activeMilestone = status.milestones.find((milestone) => !['accepted', 'cancelled'].includes(milestone.status));
         if (activeMilestone) {
@@ -2082,7 +2270,7 @@ export class WorkflowService {
         }
         return withAdoption({ scope: 'repository', status: 'idle', action: 'discovery start' });
     }
-    delegatedAuthorization(projectId, grantId, transition, actor, target) {
+    delegatedAuthorization(projectId, grantId, transition, actor, target, autonomyTaskId = null) {
         if (!grantId) {
             if (actor.trim().startsWith('agent:')) {
                 throw new WorkflowError('TRANSITION_BLOCKED', 'An agent actor requires an explicit delegated approval grant.');
@@ -2090,6 +2278,52 @@ export class WorkflowService {
             return null;
         }
         const grant = this.store.readDelegation(projectId, grantId);
+        if (grant.scope.kind === 'milestone') {
+            const autonomyContract = readMilestoneAutonomyEvents(this.store, projectId, grant.scope.id)
+                .find((event) => event.delegationGrantId === grant.id) ?? null;
+            if (autonomyContract) {
+                const contextTask = target.kind === 'knowledge-map' && autonomyTaskId
+                    ? this.store.readTask(projectId, autonomyTaskId)
+                    : null;
+                const milestone = target.kind === 'milestone'
+                    ? target
+                    : target.kind === 'task' && target.milestoneId === grant.scope.id
+                        ? this.store.readMilestone(projectId, grant.scope.id)
+                        : contextTask?.milestoneId === grant.scope.id
+                            ? this.store.readMilestone(projectId, grant.scope.id)
+                            : null;
+                if (!milestone) {
+                    throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone autonomy grant cannot authorize this target.');
+                }
+                const activeAutonomy = requireActiveMilestoneAutonomy({
+                    store: this.store,
+                    projectId,
+                    milestone,
+                    actor,
+                    now: this.now(),
+                });
+                if (activeAutonomy.grant.id !== grant.id) {
+                    throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone autonomy grant has been superseded.');
+                }
+                if (target.kind === 'knowledge-map') {
+                    if (transition !== 'project_memory.approve'
+                        || !contextTask
+                        || !taskCanRebindKnowledge(contextTask)) {
+                        throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone autonomy may approve Project Memory only inside a content-only Task context refresh.');
+                    }
+                    if (!grant.transitions.includes(transition)) {
+                        throw new WorkflowError('TRANSITION_BLOCKED', `Delegation ${grant.id} does not allow ${transition}.`);
+                    }
+                    return {
+                        grantId: grant.id,
+                        policyHash: grant.policyHash,
+                        principal: grant.principal,
+                        delegate: grant.delegate,
+                        transition,
+                    };
+                }
+            }
+        }
         return assertDelegationCanAuthorize(grant, transition, actor, target, this.now());
     }
     assertHandoffGrant(projectId, task, targetActor, grantId) {
@@ -2121,6 +2355,23 @@ export class WorkflowService {
                 grantExpiresAt: grant.expiresAt,
             });
         }
+        if (grant.scope.kind === 'milestone') {
+            const autonomyContract = readMilestoneAutonomyEvents(this.store, projectId, grant.scope.id)
+                .find((event) => event.delegationGrantId === grant.id) ?? null;
+            if (autonomyContract) {
+                const milestone = this.store.readMilestone(projectId, grant.scope.id);
+                const activeAutonomy = requireActiveMilestoneAutonomy({
+                    store: this.store,
+                    projectId,
+                    milestone,
+                    actor: targetActor,
+                    now: this.now(),
+                });
+                if (activeAutonomy.grant.id !== grant.id) {
+                    throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone autonomy grant has been superseded.');
+                }
+            }
+        }
     }
     nextForTaskWithDelegation(projectId, task, planRiskAudit = null) {
         const transition = task.status === 'awaiting_execution_authorization'
@@ -2132,6 +2383,9 @@ export class WorkflowService {
             ? this.delegatedApprovalOptions(projectId, transition, task)
             : [];
         const failedReviewAttempts = countFailedReviewAttempts(this.store.taskRoot(projectId, task.id));
+        const guardedCorrectiveGate = task.status === 'needs_fix' && planRiskAudit
+            ? findFailedGuardedStepRequiringCorrectiveDecision(this.store, task, planRiskAudit)
+            : null;
         const next = nextForTask(task);
         const handoffPosture = readTaskC1Posture(this.store, task);
         const strictStepReviewStep = planRiskAudit
@@ -2163,7 +2417,17 @@ export class WorkflowService {
                         requiredActor: handoffPosture.claimant,
                     },
                 }
-                : {};
+                : task.milestoneId && next.action === 'task start'
+                    ? {
+                        action: 'task handoff-prepare',
+                        blockedAction: next.action,
+                        c1Handoff: {
+                            state: 'required',
+                            recommendedTargetActor: defaultTaskWorkerActor(task.id),
+                            targetActorDerived: true,
+                        },
+                    }
+                    : {};
         const result = {
             ...next,
             ...handoffOverlay,
@@ -2204,6 +2468,21 @@ export class WorkflowService {
                     },
                 }
                 : {}),
+            ...(guardedCorrectiveGate
+                ? {
+                    action: 'task corrective-decision',
+                    stepId: guardedCorrectiveGate.stepId,
+                    correctiveDecisionGate: {
+                        attemptCount: guardedCorrectiveGate.attemptCount,
+                        recommendedAuditor: defaultCorrectiveAuditorActor(task.id),
+                        auditorDerived: true,
+                        auditorMustDifferFromLatestStrictReviewer: true,
+                        allowedDecision: 'continue-fix',
+                        escalationDecisions: ['replan-required', 'split-required', 'stop-escalate'],
+                        humanApprovalRequired: false,
+                    },
+                }
+                : {}),
             ...(delegatedApprovalOptions.length > 0 ? { delegatedApprovalOptions } : {}),
         };
         if (handoffPosture.state === 'pending') {
@@ -2217,7 +2496,16 @@ export class WorkflowService {
     }
     delegatedApprovalOptions(projectId, transition, target) {
         return this.store.listDelegations(projectId)
-            .filter((grant) => delegationCanAuthorize(grant, transition, target, this.now()))
+            .filter((grant) => {
+            try {
+                return Boolean(this.delegatedAuthorization(projectId, grant.id, transition, grant.delegate, target));
+            }
+            catch (error) {
+                if (error instanceof WorkflowError && error.code === 'TRANSITION_BLOCKED')
+                    return false;
+                throw error;
+            }
+        })
             .map((grant) => ({
             grantId: grant.id,
             principal: grant.principal,
@@ -2230,8 +2518,17 @@ export class WorkflowService {
     }
     delegatedContextRefreshOptions(projectId, task, knowledgeMap) {
         return this.store.listDelegations(projectId)
-            .filter((grant) => delegationCanAuthorize(grant, 'project_memory.approve', knowledgeMap, this.now()))
-            .filter((grant) => delegationCanAuthorize(grant, 'task.execution_authorize', task, this.now()))
+            .filter((grant) => {
+            try {
+                return Boolean(this.delegatedAuthorization(projectId, grant.id, 'project_memory.approve', grant.delegate, knowledgeMap, task.id)
+                    && this.delegatedAuthorization(projectId, grant.id, 'task.execution_authorize', grant.delegate, task));
+            }
+            catch (error) {
+                if (error instanceof WorkflowError && error.code === 'TRANSITION_BLOCKED')
+                    return false;
+                throw error;
+            }
+        })
             .map((grant) => ({
             grantId: grant.id,
             principal: grant.principal,
@@ -2371,6 +2668,28 @@ export class WorkflowService {
         }
         return inspected;
     }
+    strictReviewKnowledgeMap(repositoryRoot, task) {
+        const stored = this.store.readKnowledgeMap(task.projectId);
+        const inspected = inspectKnowledgeMap(stored, scanProjectKnowledge(repositoryRoot, task.projectId, this.now()));
+        if (inspected.status === 'active' && inspected.approval)
+            return inspected;
+        const storedHash = hashKnowledgeMap(stored);
+        if (stored.status === 'active'
+            && stored.approval
+            && task.knowledgeMapRevision === stored.revision
+            && task.knowledgeMapHash === storedHash
+            && stored.approval.mapHash === storedHash) {
+            return stored;
+        }
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Strict Step Review has neither a current active Knowledge Map nor its exact historical Task binding.', {
+            taskId: task.id,
+            inspectedStatus: inspected.status,
+            taskKnowledgeMapRevision: task.knowledgeMapRevision,
+            storedKnowledgeMapRevision: stored.revision,
+            taskKnowledgeMapHash: task.knowledgeMapHash,
+            storedKnowledgeMapHash: storedHash,
+        });
+    }
     inspectAdoptionPreparation(identity, tasks, milestones) {
         const locks = new WriterLockManager(this.store.lockRoot(identity.projectId), this.now);
         const currentPosture = readCurrentAdoptionPosture(this.store, identity.projectId);