codex-workflow-v2 2.0.0-alpha.6 → 2.0.0-alpha.7

package/docs/autonomy-guardrails.md

@@ -1,11 +1,11 @@
 # Autonomous Development Guardrails
 
 These rules keep delegated execution autonomous without turning approval into a rubber stamp.
-Alpha.6 adds no persistent canonical state fields and keeps `stateSchemaVersion: 2`.
+Alpha.7 adds no persistent canonical entity fields and keeps `stateSchemaVersion: 2`.
 
 ## Plan Risk Audit
 
-Before execution authorization, every alpha.6 Task needs a current Plan Risk Audit sidecar
+Before execution authorization, every alpha.7 Task needs a current Plan Risk Audit sidecar
 bound to the current Brief, Plan, and approved Knowledge Map. This is mandatory even when all
 Steps are unguarded and the decision is `approved`.
 
@@ -15,6 +15,8 @@ The payload must classify every current Step exactly once and declare:
 - `decision`: `approved`, `approved-with-rationale`, `split-required`, or `stop-escalate`
 - per-Step guarded categories, concrete `failureModes`, and `reviewRequired`
 - `requiredEvidence` entries that exactly match executable checks in that Step
+- one proof obligation per guarded failure mode, with a hostile counterexample, expected safe
+  result, and evidence that exactly matches `requiredEvidence`
 - `splitRationale` when migration is intentionally coupled to recovery or runtime composition
 
 The workflow rejects omitted Steps, extra Steps, duplicate classifications, stale bindings,
@@ -70,13 +72,15 @@ path. The Auditor must differ from the failed-review author and cover every late
 `replan-required`, `split-required`, and `stop-escalate` are stop decisions: Core does not
 start another implementation loop.
 
-For alpha.6 guarded Steps, remediation attempts are also tracked in
+For guarded Steps, remediation attempts are also tracked in
 `remediation-events.jsonl`. Two ordinary remediation attempts are allowed. A third ordinary
 retry is blocked until `task corrective-decision` records a current corrective decision in
 `corrective-decisions.jsonl`. `continue-fix` allows bounded continuation; the other decisions
 stop or redirect ordinary execution. If that third, corrective remediation review also fails,
 Core enters a hard stop: a fourth run and another `continue-fix`/`replan-required` decision are
-rejected. Only `split-required` or `stop-escalate` may be recorded.
+rejected. Only `split-required` or `stop-escalate` may be recorded. At the corrective boundary,
+`next` derives a distinct `agent:corrective-auditor:<task-id>` actor; selecting that actor is not
+a human approval, while auditor independence remains mandatory.
 
 ## Content-only context refresh
 
@@ -113,7 +117,13 @@ An expired lease is also a blocker until the ordinary explicit stale-lock repair
 The command is read-only and reports every blocker. It does not install a package or migrate
 state. When `stateSchemaVersion` remains `2`, the external project state is reused unchanged.
 Existing schema 2 projects then use `state adoption-prepare` and `state adoption-apply`; they
-do not use `state migrate` for alpha.6 adoption.
+do not use `state migrate` for schema-2 adoption.
+
+Alpha.7 also exposes `update rescue-preflight` for one narrow alpha.6 deadlock: a pending strict
+review whose completion commit changed canonical knowledge while Knowledge rebind is forbidden
+by the still-in-progress Step. Eligibility requires an exact alpha.6 dependency, one pending
+review, exact clean completion HEAD, valid history, and no active lease. The command is read-only
+and returns only stale-lock repair plus strict-review actions.
 
 ## Milestone closure
 
@@ -123,15 +133,26 @@ compare Result, evidence, Plan hash, and validated HEAD. A delegate may accept o
 exact `milestone.final_accept` option, must remain the recorded actor, and must pass the
 current `MSA-*` code. Without that option the ordinary later-message human gate applies.
 
-## Human-only Milestone scope change and C1 handoff
+## Bounded Milestone autonomy and C1 handoff
+
+Initial assembly may materialize every linked Task before one complete `milestone plan-set`;
+the Milestone cannot execute until all reverse memberships are classified. Ordinary semantic
+scope change remains explicit and human-only through `milestone scope-change-prepare` and
+`milestone scope-change-apply`.
 
-Milestone scope change beyond the initial empty planning posture is explicit and human-only:
-use `milestone scope-change-prepare` and `milestone scope-change-apply`. The change is
-journaled across `state.json`, `plan.json`, and `scope-change-events.jsonl`, and delegated
-approval never authorizes it.
+After the initial Plan, one human may approve a time-bound (maximum 72 hours) Milestone
+Autonomy Contract. It creates a milestone-scoped grant for Task/Milestone execution and final
+acceptance plus Project Memory approval only inside an atomic content-only Task context refresh
+for the same Milestone. Standalone Project Memory approval remains forbidden. The contract binds
+the immutable outcome, success signal, acceptance, checks, discovery, and base branch.
+`milestone autonomy-evolve` may only alter Task memberships; it records the
+agent actor plus the autonomy-contract event hash in the journaled scope-change sidecar and
+supersedes execution authorization. Any semantic drift, expiry, revocation, actor mismatch,
+or contract hash mismatch fails closed.
 
 `C1` handoff uses `task handoff-prepare`, `task claim --claim-token ...`, and terminal
-`task handback-create`. Preparation returns a one-time token and prompt bound to a stable
+`task handback-create`. When target actor is omitted, Core derives
+`agent:worker:<task-id>`. Preparation returns a one-time token and prompt bound to a stable
 `handoffId`, revision, Brief/Plan/Knowledge hashes, Milestone and Task display numbers,
 expected next action, delegate/grant, creation time, and expiry. Only the claim-token hash is
 stored; `task handoff-show` cannot recover it. Claim fails closed on expiry, actor, token,

package/docs/decisions.md

@@ -80,3 +80,19 @@ This document closes the requirement gaps identified during the V2 design review
 15. **Safe update preflight.** Dependency updates begin with a read-only preflight requiring
     a clean checkout, no running Step, and no active writer lease. It does not install,
     migrate, or mutate project state.
+16. **Strict-review recovery precedes Knowledge rebind.** A pending strict review is bound to
+    its immutable completion commit, Plan, and historical knowledge binding. It therefore
+    runs before a current-map rebind; the rebind remains mandatory before the next Step. A
+    read-only alpha.6 rescue profile exposes only this exact recovery shape.
+17. **Bounded Milestone autonomy.** Initial linked Tasks may be assembled before one complete
+    membership Plan. One human-confirmed, expiring Milestone contract may then authorize the
+    existing Task/Milestone approval transitions, guarded content-only Task context refresh,
+    and membership-only evolution. Standalone Project Memory approval remains forbidden.
+    Outcome, success signal, acceptance, checks, discovery, and base branch remain immutable;
+    semantic change stays human-only.
+18. **Planning proof obligations.** Every newly recorded guarded audit maps each failure mode
+    to one hostile counterexample, expected safe result, and exact executable Step check.
+    Historical alpha.6 audit events remain readable only to preserve safe lifecycle recovery.
+19. **Derived independent actors.** Core derives stable Task Worker and corrective Auditor
+    actors from Task identity. This removes name-selection pauses without weakening C1 claim,
+    lease, or auditor-independence checks.

package/docs/delegated-approval.md

@@ -52,12 +52,19 @@ delegation.transition
 acceptance still requires the current `MSA-*` code, preserving the revision/hash/HEAD binding;
 the pre-issued grant replaces only the later human-message requirement.
 
-Alpha.6 does not widen this allow-list. Delegated approval does not authorize:
+Alpha.7 does not widen the generic delegation allow-list. Generic delegated approval does not authorize:
 
 - `state adoption-apply`
 - `milestone scope-change-prepare`
 - `milestone scope-change-apply`
-- any replacement human gate for Milestone membership repair or scope decisions
+- semantic Milestone scope changes
+
+A separate `milestone autonomy-prepare` / `milestone autonomy-grant` contract issues one
+milestone-scoped grant over the existing Task/Milestone approval transitions, adds
+membership-only evolution authority, and permits Project Memory approval only as the guarded
+half of an atomic content-only Task context refresh in that Milestone. Standalone Project Memory
+approval remains project-scoped. The contract does not add a generic delegation transition:
+outcome, success signal, acceptance, checks, discovery, and base branch remain immutable.
 
 ## Starting a delegate chat
 
@@ -81,9 +88,9 @@ scope changes are not approval transitions: the delegate stops and asks the user
 Independent Reviewer roles may implement or review work, but the coordinating delegate alone
 uses the grant and passes `--delegation-grant` to the Core transition.
 
-This matters more in alpha.6 because Milestone scope changes are explicitly journaled,
-human-only lifecycle actions. A delegate may continue ordinary Milestone execution only inside
-the already approved scope.
+Ordinary semantic Milestone scope changes remain journaled, human-only lifecycle actions. A
+contract delegate may evolve only the membership graph inside the cryptographically bound
+semantic scope.
 
 ### Milestone delegate prompt
 

package/docs/development-flow.md

@@ -21,9 +21,9 @@ Materialization requires an observable outcome, scope, acceptance criteria, and
 blocking unknowns. No Task identifier or branch exists before this gate. Task authorization
 is hash-bound to Brief and Plan. Later Plan changes supersede it.
 
-In alpha.6, execution authorization also requires a current Plan Risk Audit bound to the same
+In alpha.7, execution authorization also requires a current Plan Risk Audit bound to the same
 Brief, Plan, Knowledge Map, and exact Step set. For existing schema 2 projects upgraded into
-alpha.6, execution additionally requires adoption posture first; remaining legacy scope then
+alpha.7, execution additionally requires adoption posture first; remaining legacy scope then
 uses a bootstrap audit over the preserved non-`completed`, non-`skipped` Steps only.
 The audit names a Plan author and independent auditor, binds each guarded failure mode to
 exact executable evidence, and blocks authorization on `split-required` or `stop-escalate`.
@@ -67,7 +67,7 @@ replay, and crash claims include restart/crash-window evidence; provider work in
 failure injection and hidden-default verification. After two failed independent reviews,
 another Plan requires a distinct corrective Auditor and `--corrective-audit-file`. Only a
 `continue-fix` audit may continue; replan, split, and stop decisions return to coordination.
-For guarded alpha.6 remediation, a third ordinary retry is blocked until a current
+For guarded remediation, a third ordinary retry is blocked until a current
 `task corrective-decision` exists for the same Step and Plan binding. If that corrective
 attempt fails review, the third failure is a hard stop and no fourth run is permitted.
 
@@ -93,10 +93,15 @@ and prevents new linked Tasks from starting. A Task that has started cannot be r
 it can be retained as waived/cancelled with history and reason. Tasks already in progress
 may finish while an amendment awaits authorization.
 
-After the initial empty planning posture, alpha.6 does not use ordinary `milestone plan-set`
-for scope changes. It uses human-only `milestone scope-change-prepare` and
-`milestone scope-change-apply`, with journaled recovery across `state.json`, `plan.json`, and
-`scope-change-events.jsonl`.
+During initial planning, all linked Tasks may be materialized before one complete
+`milestone plan-set`; no execution is available until the Plan classifies every reverse
+membership. After that boundary, semantic changes use human-only
+`milestone scope-change-prepare` and `milestone scope-change-apply`. A previously issued
+Milestone Autonomy Contract may instead use `milestone autonomy-evolve` for membership-only
+changes while the outcome, success signal, acceptance, checks, discovery, and base branch
+remain unchanged. The same contract may complete an atomic content-only Task context refresh
+without a new human gate, but cannot approve Project Memory independently. Both paths retain
+journaled recovery across `state.json`, `plan.json`, and `scope-change-events.jsonl`.
 
 A Milestone has no integration branch. Validation requires all required Tasks to be
 `merged`, checks the current clean base branch, and writes evidence plus Result. Final

package/docs/release.md

@@ -20,12 +20,14 @@ The downstream smoke packs the actual tarball, installs it into an empty tempora
 runs the packaged CLI handshake, and proves installation created none of `.codex`, `.tasks`,
 `.increments`, or `.memory-bank` in that project.
 
-For alpha.6, the release gate also relies on `npm run release:check` to fail if:
+For alpha.7, the release gate also relies on `npm run release:check` to fail if:
 
 - canonical entity schema 2 shapes drift;
 - protocol 1 compatibility is no longer additive;
 - the delegated transition allow-list expands;
-- alpha.6 adoption is presented as `state migrate` instead of posture sidecars.
+- schema-2 adoption is presented as `state migrate` instead of posture sidecars;
+- alpha.7 rescue, Milestone autonomy (including guarded content refresh), derived actor, or
+  proof-obligation capabilities and schemas are absent from the packaged surface.
 
 Tag releases as `v<package-version>`. The tag workflow verifies the tag/package match and
 uses npm trusted publishing with public access. For a public GitHub repository and public

package/docs/updating-existing-project.md

@@ -22,6 +22,16 @@ state schema. Совпадение `stateSchemaVersion` до и после об
 нужна. Для alpha.6 при `stateSchemaVersion: 2` применяется не migration, а sidecar-only
 adoption posture.
 
+### Исключение для lifecycle-дедлока alpha.6
+
+Обычный `update preflight` намеренно блокирует обновление при `in_progress` Step. Если alpha.6
+завис между completion commit, обязательным strict review и запрещённым Knowledge rebind,
+используйте внешний точный runner alpha.7 только для `update rescue-preflight`. Продолжать
+можно лишь при `eligible=true`; допустимы только перечисленные им `locks repair` и
+`task step-review`. Этот путь не меняет dependency и не разрешает другие команды alpha.7.
+После terminal review выполните обычный Knowledge reconcile/rebind, доведите Task до безопасной
+границы и только затем обновляйте package/lock обычным способом.
+
 ## 1. Подготовьте отдельный чат обновления
 
 Не обновляйте пакет во время выполняющегося Worker Step. Дождитесь завершения текущего ответа

package/docs/validation-report.md

@@ -1,51 +1,56 @@
 # V2 Alpha Validation Report
 
-Release candidate `2.0.0-alpha.6` was validated through 2026-08-14 with Node.js 24.17.0.
-
-- `npm run typecheck`, `npm run build`, `npm test`, `npm run validate`, `npm run plugin:check`,
-  `npm run smoke:downstream`, `npm run release:check`, and `npm run pack:check` passed in the
-  task evidence recorded for TASK-002.
-- The final sequential full suite passed `81/81` on 2026-08-14.
-- Plan Risk Audit coverage includes the combined `plan-set --risk-audit-file` path, atomic
-  rejection before Task/Plan acceptance, distinct planner/auditor identities, exact current
-  Step-set equality, concrete failure modes, executable evidence binding, coupled
-  migration/recovery rationale, blocking split/stop decisions, and adoption-aware
-  remaining-scope bootstrap handling.
-- Strict high-risk Step Review coverage includes workflow-owned completion commits,
-  `task step-review` routing, commit-bound reviewer attestation, and fail-closed rejection of
-  stale, malformed, unverified, and wrong-commit review evidence.
-- Guarded remediation coverage includes the per-Step circuit breaker: two ordinary retries
-  allowed, third gated by bounded `continue-fix`, a hard stop after a third failed corrective
-  review, and stop/redirection handling for `split-required` and `stop-escalate`.
-- Milestone coverage includes human-only scope-change prepare/apply, journaled recovery of
-  `state.json`, `plan.json`, and `scope-change-events.jsonl`, plus membership-integrity
-  blocking for stale or contradictory Milestone/Task state, including reverse detection of a
-  live linked Task missing from required/waived/cancelled membership.
-- `C1` coordination coverage includes the full prepared bundle, one-time and expiring claim
-  token, Task/Plan/Knowledge/Milestone bindings, exact expected-next prompt, optional grant,
-  target-only claim, claimant-only mutation, mandatory claim before Milestone Task start,
-  lease-token binding, and terminal evidence-bound handback.
-- Adoption coverage includes sidecar-only `state adoption-prepare` and `state adoption-apply`,
-  automatic posture initialization for fresh alpha.6 projects, preservation of terminal
-  Milestones and Tasks, preservation of completed and skipped legacy Steps, and execution
-  blocking until posture is present.
-- Compatibility checks passed for `protocolVersion: 1`, `STATE_SCHEMA_VERSION: 2`, unchanged
-  canonical Task and Milestone shapes, and unchanged delegated transition allow-list.
-- Gateway handshake coverage includes the alpha.6 capabilities:
-  `plan-risk-audit-sidecar-v1`, `step-strict-review-sidecar-v1`,
-  `step-remediation-circuit-breaker-sidecar-v1`, `milestone-scope-change-sidecar-v1`,
-  `milestone-membership-integrity-v1`, `task-c1-handoff-sidecar-v1`, and
-  `alpha6-adoption-posture-v1`, plus strengthened contracts advertised as
-  `semantic-plan-risk-audit-v2`, `guarded-remediation-hard-stop-v1`,
-  `milestone-reverse-membership-integrity-v1`, and `task-c1-handoff-bundle-v2`.
-- npm dry-run packaging produced `codex-workflow-v2-2.0.0-alpha.6.tgz` with runtime, schemas,
-  references, docs, and plugin source. Downstream installation and the packaged CLI handshake
-  passed, and the install created none of `.codex`, `.tasks`, `.increments`, or
-  `.memory-bank` in the temporary project.
+Release candidate `2.0.0-alpha.7` was validated on 2026-08-14 with Node.js 24.17.0.
+
+- TypeScript typecheck and build passed.
+- The authoritative sequential suite passed `86/86` with `--test-concurrency=1`. An earlier
+  ordinary parallel run also passed its then-current `85/85` suite, but CLI subprocess
+  contention made one test take 165 seconds; the final sequential exit is the release evidence.
+- `npm run pack:check`, `npm run smoke:downstream`, `npm run release:check`,
+  `npm run plugin:check`, and `git diff --check` passed. Packaging and downstream smoke used
+  an isolated temporary npm cache because the user cache contains pre-existing root-owned
+  entries.
+- The repository-level `tools/tests/codex-workflow-regression.mjs` update/install regression
+  completed with `status: PASS`.
+- Dry-run packaging produced `codex-workflow-v2-2.0.0-alpha.7.tgz` with 139 files; downstream
+  installation and packaged CLI handshake passed.
+
+Alpha.7 regression coverage includes:
+
+- pending strict Step Review outranks Knowledge Map reconcile/rebind after a knowledge-changing
+  completion commit; review succeeds against the exact historical approved binding even while
+  the current map is stale, and rebind remains mandatory before the next Step;
+- read-only alpha.6 rescue-preflight rejects active leases and accepts only one exact pending
+  strict-review candidate on the clean recorded completion HEAD;
+- seven linked Tasks can be materialized during initial Milestone assembly and classified by
+  one complete initial Plan without repeated scope-change approvals;
+- one maximum-72-hour Milestone Autonomy Contract issues the existing Task/Milestone approval
+  permissions, permits Project Memory approval only inside an atomic content-only Task context
+  refresh, permits journaled membership-only evolution, requires reauthorization, and rejects
+  both standalone Project Memory approval and semantic scope drift; a later human semantic
+  change invalidates future uses of the autonomy grant;
+- C1 Worker and corrective Auditor actors are deterministically derived while claim, lease,
+  handoff, and reviewer/auditor independence checks remain fail-closed;
+- every newly recorded guarded Plan Risk Audit requires an exact proof obligation per failure
+  mode: hostile counterexample, expected safe result, and executable evidence command;
+  historical alpha.6 audits remain readable for recovery only;
+- existing Milestone journal recovery, reverse-membership integrity, delegation, adoption,
+  Knowledge Map, graph, strict reviewer, Git ownership, and remediation hard-stop tests remain
+  green.
+
+Compatibility claims verified:
+
+- `protocolVersion: 1` and `STATE_SCHEMA_VERSION: 2` remain unchanged;
+- canonical Task and Milestone schemas remain byte-identical;
+- the generic delegated transition allow-list remains unchanged;
+- new evidence is additive through `autonomy-contract-events.jsonl`, optional autonomous
+  fields on scope-change events, and optional proof obligations on Plan Risk Audit events;
+- the gateway handshake advertises alpha.7 rescue, initial assembly, autonomy, derived actor,
+  corrective routing, and proof-obligation capabilities.
 
 Not claimed here:
 
-- no final release publish;
-- no final task audit beyond the recorded subtask evidence;
-- no new real-Codex isolation probe beyond the existing fail-closed strict-reviewer
-  implementation and its automated coverage.
+- no npm publication, Git tag, push, or downstream project mutation was performed;
+- no manual rewrite of external Workflow state is part of the recovery design;
+- the local package cannot cryptographically prove a real human identity or a physically
+  separate Codex task beyond the existing actor, process-isolation, sidecar, and lease evidence.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-alpha.6",
+  "version": "2.0.0-alpha.7",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -40,8 +40,15 @@ Current capability set:
 - `milestone-reverse-membership-integrity-v1`
 - `task-c1-handoff-bundle-v2`
 - `alpha6-adoption-posture-v1`
-
-Protocol `1` and schema `2` remain valid only because alpha.6 is additive. The gateway must
+- `alpha6-strict-review-rescue-v1`
+- `milestone-initial-assembly-v1`
+- `milestone-autonomy-contract-v1`
+- `milestone-autonomous-membership-evolution-v1`
+- `task-c1-derived-worker-actor-v1`
+- `guarded-corrective-auditor-routing-v1`
+- `plan-proof-obligations-v1`
+
+Protocol `1` and schema `2` remain valid only because alpha.7 is additive. The gateway must
 not claim compatibility if canonical entity shapes or non-additive command semantics change.
 
 ## Alpha.6 adoption posture
@@ -86,7 +93,7 @@ workflow state manually; recovery remains coordinator-controlled.
 
 ## Plan Risk Audit and remediation breaker
 
-Before `task authorize`, every new alpha.6 Task requires:
+Before `task authorize`, every new alpha.7 Task requires:
 
 ```text
 codex-workflow task plan-risk-audit --repo <git-root> \
@@ -94,7 +101,8 @@ codex-workflow task plan-risk-audit --repo <git-root> \
 ```
 
 The audit must classify every current Step exactly once, name distinct planner/auditor
-actors, and bind guarded failure modes to exact Step checks. Use `decision=approved` for an
+actors, bind guarded failure modes to exact Step checks, and map each guarded failure mode to
+one hostile counterexample, expected safe result, and exact executable evidence command. Use `decision=approved` for an
 unguarded Plan. Missing, stale, `split-required`, or `stop-escalate` evidence blocks
 authorization.
 
@@ -119,6 +127,9 @@ operation is restricted to content-hash-only drift and records the ordinary dele
 Task authorization evidence. Any semantic map change remains on the normal visible path.
 
 Before updating the installed package, run `update preflight`. Continue only for `safe=true`.
+For an alpha.6 project trapped between a pending strict review and forbidden Knowledge rebind,
+an exact external alpha.7 runner may run `update rescue-preflight`. Continue only for
+`eligible=true` and only with the returned lock-repair and strict-review actions.
 
 ## C1 handoff
 
@@ -127,7 +138,7 @@ Before updating the installed package, run `update preflight`. Continue only for
 ```text
 codex-workflow task handoff-prepare --repo <git-root> --id <TASK-ID> \
   --expected-revision <REVISION> --actor <CURRENT-ACTOR> \
-  --target-actor <TARGET-ACTOR> --reason <TEXT> [--writer-token <TOKEN>] \
+  [--target-actor <TARGET-ACTOR>] --reason <TEXT> [--writer-token <TOKEN>] \
   [--delegation-grant <GRANT>] [--expires-at <ISO-TIMESTAMP>]
 codex-workflow task handoff-show --repo <git-root> --id <TASK-ID>
 codex-workflow task claim --repo <git-root> --id <TASK-ID> \
@@ -141,9 +152,30 @@ codex-workflow task handback-create --repo <git-root> --id <TASK-ID> \
 While a handoff is pending, `next` blocks the previous action behind `task claim`. While
 claimed, only the claimant may mutate the Task, and lease-bound mutations must present the
 bound writer token. Milestone-linked Tasks must be claimed before start, and handback is
-terminal and evidence-bound. No thread id is required or accepted as authority.
+terminal and evidence-bound. When target actor is omitted, Core derives
+`agent:worker:<task-id>`. No thread id is required or accepted as authority.
+
+## Milestone assembly, autonomy, and human gate
+
+During initial planning, materialize every linked Task and then call `milestone plan-set` once
+with the complete membership. Execution is blocked while reverse membership is incomplete.
+
+After that Plan, one human may prepare and grant a maximum-72-hour Milestone Autonomy Contract:
+
+```text
+codex-workflow milestone autonomy-prepare --repo <git-root> --id <MS-ID> \
+  --expected-revision <REVISION> --principal <HUMAN> --delegate <AGENT> --expires-at <ISO>
+codex-workflow milestone autonomy-grant --repo <git-root> --id <MS-ID> \
+  --expected-revision <REVISION> --principal <HUMAN> --delegate <AGENT> --expires-at <ISO> \
+  --confirmation-code <MAC-CODE>
+```
 
-## Milestone scope change and human gate
+The contract issues a milestone-scoped grant for the existing Task/Milestone approval transitions
+and Project Memory approval only inside an atomic content-only Task context refresh for the same
+Milestone. It cannot approve Project Memory independently. `milestone autonomy-evolve --file
+<plan.json>` is permitted only when outcome, success signal, acceptance, checks, discovery, and
+base branch still match the contract. It journals agent actor plus contract evidence and requires
+reauthorization afterward.
 
 After the initial empty planning posture, Milestone scope updates use:
 
@@ -155,7 +187,7 @@ codex-workflow milestone scope-change-apply --repo <git-root> \
   --confirmation-code <MSC-CODE> --file <plan.json>
 ```
 
-This path is human-only. Delegated approval never authorizes it.
+This ordinary semantic-change path is human-only. Generic delegated approval never authorizes it.
 
 At `awaiting_final_acceptance`, `next` returns `requiredHumanGate` with kind
 `milestone_final_acceptance`, Milestone ID, revision, Plan/Result/evidence hashes, validated
@@ -183,8 +215,8 @@ as `--delegation-grant`. The resulting authorization event records the grant and
 For `milestone.final_accept`, also pass the current `MSA-*` code; the existing grant replaces
 the later-message requirement, not the state binding.
 
-Delegated approval does not cover adoption apply, Milestone scope change, or any other new
-human-only alpha.6 action.
+Delegated approval does not cover adoption apply or the ordinary semantic Milestone scope-change
+path. Membership-only evolution requires the separate Milestone Autonomy Contract.
 
 ## Graph Refresh Request
 

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -27,6 +27,11 @@ files, or MCP ADR storage as a fallback.
 6. Run `gateway handshake` before other actions. Stop on package, protocol, or
    state-schema incompatibility.
 
+The sole exception is the alpha.7 `update rescue-preflight` compatibility profile. An exact
+external alpha.7 runner may inspect a project still pinned to alpha.6 only when this read-only
+command reports `eligible=true`. Execute only its returned stale-lock repair and strict-review
+actions; do not use the external runner for any other transition or dependency mutation.
+
 If any step fails, report the concrete diagnostic. Do not load workflow
 semantics from this skill.
 
@@ -103,10 +108,24 @@ option is returned, follow the ordinary human-gate rule above. Knowledge Map app
 delegable only through an explicit project-scoped `project_memory.approve` permission. Scope
 changes, grant issuance, and grant expansion are never delegated by `delegated-approval-v1`.
 
+For an entire Milestone, prefer one bounded `milestone autonomy-prepare` gate after the complete
+initial membership Plan exists. Show principal, delegate, expiry, semantic-scope hash, policy
+hash, and `MAC-*` code, then stop. A later exact approval permits `milestone autonomy-grant`.
+The resulting grant covers the existing Task/Milestone approval transitions and the Project
+Memory approval portion of an atomic content-only Task context refresh for the same Milestone;
+it never permits standalone Project Memory approval. It also permits `milestone autonomy-evolve`
+only for membership changes; any change to outcome, success signal, acceptance, checks,
+discovery, or base branch requires the ordinary human scope-change gate. Never self-renew or
+replace the contract.
+
 After two failed Task reviews, follow `next.correctivePlanGate`: obtain a distinct read-only
 corrective Auditor result and pass it through `--corrective-audit-file`. Do not continue for
 replan, split, or stop decisions.
 
+When `next` returns a derived C1 Worker or corrective Auditor actor, use that exact actor without
+asking the user to name one. Derivation removes a routing pause; handoff claim, writer lease,
+strict review, and auditor-independence checks remain mandatory.
+
 Before an npm package update, run the project-local `update preflight` and stop unless it
 returns `safe=true` with a clean checkout, no running Step, and no active writer lease.
 

package/references/state-machine.md

@@ -6,14 +6,15 @@ to the task commit and Brief, Plan, and evidence hashes. Final acceptance is a s
 human event bound to Result, evidence, and commit. Locks expire only diagnostically;
 removing a stale lock is always an explicit repair operation.
 
-Alpha.6 keeps canonical entity JSON unchanged at `stateSchemaVersion: 2` and adds lifecycle
-evidence through sidecars. `protocolVersion: 1` remains valid only because the alpha.6
+Alpha.7 keeps canonical entity JSON unchanged at `stateSchemaVersion: 2` and adds lifecycle
+evidence through sidecars. `protocolVersion: 1` remains valid only because the alpha.7
 surface is additive and capability-advertised.
 
-Before execution authorization, every alpha.6 Task must have a current Plan Risk Audit bound
+Before execution authorization, every alpha.7 Task must have a current Plan Risk Audit bound
 to the current Brief, Plan, Knowledge Map, and exact Step set. The audit is required even when
 all Steps are unguarded, must name distinct planner/auditor actors, and must bind guarded
-failure modes to exact Step checks. Missing, stale, inconsistent, `split-required`, or
+failure modes to exact Step checks. Each newly recorded guarded failure mode also requires one
+hostile counterexample, expected safe result, and exact evidence command. Missing, stale, inconsistent, `split-required`, or
 `stop-escalate` evidence blocks authorization.
 
 If the current Plan Risk Audit marks a Step for strict review, `task step-complete` still
@@ -36,7 +37,7 @@ bindings, supersedes execution authorization, and returns the Task to
 `awaiting_execution_authorization`. It cannot run while a Step is `in_progress` or while the
 Task is `blocked`; unrelated blocks must be resolved through their owning transition.
 
-For alpha.6 guarded remediation, two ordinary remediation attempts are allowed. A third
+For guarded remediation, two ordinary remediation attempts are allowed. A third
 ordinary retry is blocked until a current corrective decision exists for the same Step and
 Plan binding. `continue-fix` allows bounded continuation; `replan-required`,
 `split-required`, and `stop-escalate` stop ordinary execution. A failed third corrective
@@ -55,10 +56,15 @@ but the acceptance command still requires the current `MSA-*` code so the use re
 to the validated revision, hashes, and HEAD. Grant issuance itself always remains a prior
 human turn boundary.
 
-After the initial empty planning posture, Milestone scope updates no longer use ordinary
-`milestone plan-set`. They must go through `milestone scope-change-prepare` and
-`milestone scope-change-apply`, which journal `state.json`, `plan.json`, and
-`scope-change-events.jsonl` together and remain human-only. Membership integrity is validated
+During initial planning, all linked Tasks may be materialized before one complete
+`milestone plan-set`; execution remains blocked until every reverse membership is classified.
+After that boundary, semantic updates use human-only `milestone scope-change-prepare` and
+`milestone scope-change-apply`. A human-confirmed, expiring Milestone Autonomy Contract may
+use `milestone autonomy-evolve` only for membership changes while outcome, success signal,
+acceptance, checks, discovery, and base branch remain fixed. It may also approve Project Memory
+only within an atomic content-only context refresh for a Task in that Milestone; standalone map
+approval remains forbidden. Both update paths journal
+`state.json`, `plan.json`, and `scope-change-events.jsonl` together. Membership integrity is validated
 before scheduling, Task start, Milestone validation, scope change, and repository `next`.
 The same guard scans in reverse and blocks every live Task whose `milestoneId` is absent from
 the Milestone's required/waived/cancelled classification.
@@ -68,7 +74,8 @@ token and prompt bound to a stable handoff ID, revision, context hashes, Milesto
 delegate/grant, expected next action, and expiry. `task claim` validates those bindings and
 activates claimant-only mutation; terminal `task handback-create` returns result, evidence,
 review, knowledge, limitation, and recommended-next bindings. Milestone Tasks must be claimed
-before start. No part of this contract requires or proves a physically separate Codex thread.
+before start. If no target is supplied, Core derives `agent:worker:<task-id>`. No part of this
+contract requires or proves a physically separate Codex thread.
 
 Repository-level scheduling respects current Milestone membership. An unstarted linked Task
 is eligible only for an `active` Milestone with `required` disposition. Historical unstarted

package/roles/delivery-coordinator.md

@@ -12,7 +12,14 @@ Own state transitions, dispatch envelopes, evidence collection, and recovery gui
   request the user's explicit decision, and end the turn. Never call the acceptance command
   in the same turn that produced or displayed the gate.
 - Accept a Milestone only after a later user message explicitly approves that exact
-  confirmation code. Do not infer approval from a request to validate, finish, or continue.
+  confirmation code, or through the exact active Milestone Autonomy Contract option. Do not
+  infer approval from a request to validate, finish, or continue.
+- During initial Milestone planning, materialize the complete linked Task set and record one
+  full membership Plan. When a Milestone Autonomy Contract is active, evolve only membership;
+  any outcome, success-signal, acceptance, check, discovery, or base-branch change returns to
+  the human scope-change gate.
+- Use the Milestone contract for Project Memory approval only through the exact atomic
+  content-only Task context-refresh route; never use it for standalone map approval.
 - Dispatch one Worker at a time for a concrete Step.
 - A Milestone coordinator creates one dedicated user-visible Codex Task chat for each required
   Task. The Milestone chat owns ordering, exact delegated approvals, merge observation,
@@ -22,6 +29,8 @@ Own state transitions, dispatch envelopes, evidence collection, and recovery gui
 - After a second failed independent Task review, require a separate corrective Plan Auditor
   and pass its evidence through `--corrective-audit-file`. Continue only for
   `decision=continue-fix`; replan/split/stop decisions return to the coordinator or user.
+- Use the exact derived Worker and corrective Auditor actors returned by `next`; do not pause
+  for the user to invent routing identifiers.
 - Use `task context-refresh` only when `next.contextRefresh` offers the exact delegated,
   content-only option. Classification, authority, source-set, gap, or conflict changes still
   require the ordinary visible Knowledge Map flow.

package/roles/technical-planner.md

@@ -10,6 +10,9 @@ Translate an approved Brief into an execution-ready Plan.
   restart/replay, crash recovery, or an external provider must include failure-specific checks
   in the original Steps: populated forward upgrades, deterministic races, restart/crash
   windows, and provider failure/default behavior as applicable.
+- For every guarded failure mode, define one hostile counterexample, the expected safe result,
+  and the exact executable Step check that proves it. A happy-path check is not a proof
+  obligation for an adversarial or crash-window claim.
 - Split a Task when one acceptance slice would otherwise combine persistence migration,
   recovery orchestration, and executable composition. Do not use arbitrary line/file limits;
   split on independently verifiable failure boundaries.