codex-workflow-v2 2.0.0-alpha.7.2.1 → 2.0.0-beta.2

package/docs/stable-release-defect-register.md

@@ -0,0 +1,597 @@
+# Stable Release Defect Register
+
+This register captures defects and operational gaps found while running the
+alpha.7 line against the `signal_v4` Milestone 3 lifecycle. It is intentionally
+separate from implementation briefs: an item stays here until it is either
+verified fixed by a regression test or explicitly classified as downstream-only.
+
+Last reviewed: 2026-08-15.
+
+## Severity and status
+
+- **Confirmed** means the behavior was reproduced from package or downstream evidence.
+- **Investigation** means the risk is concrete, but the package defect boundary is not yet proven.
+- **Closed-regression** means a patch exists; the stable release must retain its regression coverage.
+- **Downstream** means the finding belongs to `signal_v4`, not to the workflow package.
+
+## Beta.2 closure candidates
+
+### WF-STABLE-009 — initial assembly creates a state rejected by `status` and `next`
+
+- Status: Closed-regression in beta.2
+- Severity: Critical
+- Area: Milestone initial assembly, reverse membership, repository navigation
+- Evidence: both the beta.1 real-agent E2E and the live read-only `signal_v4` reincarnation
+  materialized a first linked planning Task successfully, after which `status` and `next` returned
+  `MILESTONE_SCOPE_INCOMPLETE` for the intentionally repairable pre-Plan membership gap.
+- Risk: the documented seven-Task initial assembly cannot follow authoritative `next`; agents must
+  either stop before work begins or bypass navigation and invalidate lifecycle evidence.
+- Closure evidence: centralized initial-assembly assessment, deterministic fresh/adopted/unsafe
+  regressions, exact copied `signal_v4` snapshot replay, and real-agent seven-Task assembly all pass;
+  strict reverse-membership blocking remains active outside the exact predicate.
+
+### WF-STABLE-010 — beta.1 release E2E continued after failed `next`
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: Critical
+- Area: release evidence, real-agent transcript validation
+- Evidence: the beta.1 final E2E transcript contains failed `status` and `next` calls with
+  `MILESTONE_SCOPE_INCOMPLETE`; the Delegate labelled the gap expected, invoked direct
+  `milestone plan-set`, and the final audit still accepted the run despite the Brief explicitly
+  declaring a `next` bypass invalid.
+- Risk: a real-agent run can conceal a Core lifecycle defect and produce a false release
+  recommendation.
+- Candidate evidence: the append-only transcript validator rejects navigation bypasses,
+  unadvertised mutations, failed non-retryable mutations, unresolved syntax retries, and
+  unterminated harness invocations. Final-21 passed the complete validator with `250/250` events.
+
+### WF-STABLE-011 — pending Task review `next` names a non-autonomous primitive
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: Task final review, truthful navigation, real-agent evidence
+- Evidence: the first beta.2 real-agent diagnostic run reached a submitted Task with pending review;
+  `next` returned `task review-record`, while the packaged and successfully executed autonomous
+  command was `task review-launch`.
+- Risk: an agent following the exact autonomous route appears to bypass authoritative navigation,
+  while an agent following the literal response must manufacture reviewer output instead of using
+  the isolated reviewer launcher.
+- Candidate evidence: deterministic navigation regressions prove exact `task review-launch` while
+  preserving `task result-set` after a passed review. Final-21 completed strict Step review and the
+  final independent Task review without a rejected lifecycle mutation.
+
+### WF-STABLE-012 — Core-owned Git transitions omit the sandbox permission contract
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: Task execution, truthful navigation, Codex sandbox integration
+- Evidence: the rebuilt beta.2 real-agent E2E followed `next.action = task step-complete`; Core ran
+  its owned checks and then failed non-mutating at `git add` because `.git/index.lock` was denied.
+  The exact same transition succeeded after a bounded Git-metadata escalation.
+- Risk: a nominally autonomous Milestone learns required authority only by failing a lifecycle
+  mutation. This creates noisy retry history, invalidates clean release transcripts, and can strand
+  less capable agents despite a valid Plan and grant.
+- Candidate evidence: positive and negative navigation regressions cover the four local Git-writing
+  transitions and absence on read-only/external routes. Final-21 consumed the policy before local
+  start, Step completion, and Core merge without a rejected lifecycle mutation.
+
+### WF-STABLE-013 — strict reviewer can wait indefinitely or fail before launch
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: Critical
+- Area: strict Step review, final Task review, non-interactive Codex subprocess lifecycle
+- Evidence: beta.2 `real-agent-release-final-6` left two `task step-review` parents and two nested
+  `codex exec` reviewers alive for more than five minutes at unchanged Task revision `6`. Neither
+  invocation returned a terminal success or failure result.
+- Additional evidence: beta.2 `real-agent-release-final-10` exposed an integration error in the
+  first correction: the global `--ask-for-approval never` option was placed after `exec`, which the
+  real Codex CLI rejected with status `2`. Two launch failures consumed the two ordinary
+  remediation attempts before the run was stopped.
+- Root cause: the strict reviewer used inherited/default approval behavior despite intentionally
+  probing a denied write, the synchronous subprocess had no host-side deadline, and the initial
+  correction did not test the real CLI's global-option ordering contract.
+- Risk: an autonomous Milestone can hang forever inside Core before review evidence exists; a retry
+  can create a second concurrent reviewer for the same Step/revision.
+- Candidate evidence: strict reviewers now place `approval=never` before the `exec` subcommand,
+  retain read-only sandboxing, and have a fixed host-side execution deadline that returns terminal
+  `unverified` evidence on timeout. Focused tests assert the exact global-option ordering as well as
+  deadline propagation and timeout fail-closed behavior. Final-21 completed both strict reviewer
+  invocations under the non-interactive, ephemeral, ignore-config/rules, read-only contract.
+
+### WF-STABLE-014 — transcript validator accepts a started mutation with no terminal result
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: Critical
+- Area: release evidence, append-only harness transcript, indeterminate mutation recovery
+- Evidence: the incomplete `real-agent-release-final-6` transcript originally returned PASS with
+  `181` checked events even though two `task step-review` commentaries had no matching mutation
+  result and the Task remained at revision `6`. Final-8 then exposed the same class for read-only
+  commands: successful `milestone autonomy-prepare` had no terminal observation event, so the
+  wrapper log alone could not distinguish success, failure, or interruption.
+- Risk: a hung or externally interrupted mutation can be presented as valid release evidence; an
+  agent may re-enter the same semantic transition without knowing whether the first process is
+  still active.
+- Candidate evidence: the validator pairs trusted-harness invocation commentary with the exact
+  terminal navigation, mutation, or read-only observation result; rejects failed observations,
+  EOF with a pending invocation, and any second command before the pending invocation resolves.
+  Immutable final-6 and final-8 transcripts are retained as diagnostic evidence and rejected for
+  their respective stranded invocations.
+
+### WF-STABLE-015 — `task plan-set` navigation omits its exact inclusion contract
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: Task planning navigation, autonomous Plan construction, fail-before-write usability
+- Evidence: the Delegate followed `next.action = task plan-set` and produced substantive acceptance
+  statements, but Core rejected the first Plan because it did not contain the opaque Task acceptance
+  ID `AC-001` as an exact array member. The Task remained planning at revision `1`; the transcript
+  correctly rejected the run as failed release evidence.
+- Root cause: Core validates exact Task requirement and acceptance ID inclusion, while `next`
+  previously exposed only the action and revision. The machine-readable precondition was visible
+  only indirectly in large status/Brief output and was not part of the exact transition contract.
+- Candidate evidence: every `task plan-set` navigation now returns `taskPlanContract` with exact
+  required requirement IDs, acceptance IDs, current risks, Brief hash, and current Knowledge Map binding. The
+  packaged gateway requires planners to copy those exact IDs before adding semantic detail.
+
+### WF-STABLE-016 — Git-completion navigation omits the required writer lease input
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: Task completion/merge navigation, writer lease continuity, autonomous execution
+- Evidence: after successful implementation, strict Step review, Task review, result, and delegated
+  acceptance, `next` advertised `task merge` plus `gitMutationPolicy`. The Delegate followed that
+  response without `--writer-token`; the CLI rejected the invocation before any mutation.
+- Root cause: the mandatory writer lease was enforced by each transition but absent from the exact
+  machine-readable navigation contract. The gateway therefore had no local precondition telling it
+  to retain and pass the sensitive lease on the first call.
+- Candidate evidence: `next` returns a non-secret `writerTokenContract` for `task step-complete`,
+  `task submit`, `task merge`, and `task merge-confirm`, and omits it for non-consuming adjacent
+  transitions. The packaged gateway treats it as a first-call precondition and never prints or
+  persists the token.
+
+### WF-STABLE-017 — subcommand `--help` is treated as a lifecycle mutation
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: CLI command discovery, autonomous execution, release transcript integrity
+- Evidence: after clean seven-Task assembly and an active owner autonomy grant, the real Delegate
+  invoked `milestone authorize --help`. The CLI dispatched the underlying lifecycle operation and
+  rejected it with `INVALID_ARGUMENT: Missing required option --id` before any state write.
+- Root cause: CLI dispatch had no early help route; parsed `--help` remained an unused option while
+  noun/action matching entered the ordinary mutation implementation.
+- Candidate evidence: help is intercepted before repository/state construction, returns exit `0`
+  with a machine-readable `readOnly` response at top-level, noun, and action scopes, and never
+  requests mutation inputs or changes workflow state. Critical autonomous transitions expose exact
+  required and optional option lists. The transcript validator recognizes safe trusted-harness help
+  observations, rejects mutation-style help inputs, and requires a fresh successful `next` before
+  any subsequent mutation.
+
+### WF-STABLE-018 — credential-bearing receipts are buried after large Task payloads
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: C1 handoff, writer lease continuity, autonomous credential consumption
+- Evidence: the real Delegate completed initial assembly through `task handoff-prepare` with zero
+  rejected lifecycle calls, then reported that the one-time claim token was unavailable. The raw
+  successful CLI result proves that the token was emitted exactly once but was buried after roughly
+  5 KiB of Task/event data; the wrapper did not truncate stdout.
+- Root cause: credential-bearing values shared the same large compatibility payload as canonical
+  Task state and context. Although Core emitted the token correctly, the response supplied no
+  compact, prominent transfer receipt for an autonomous consumer.
+- Candidate evidence: `task handoff-prepare` now emits first-field `credentialHandoff`, and `task
+  run` emits first-field `writerLeaseReceipt`. Both name the intended next action, source, target or
+  owner, option, and sensitivity; the exact credential occurs once, while legacy payload data and
+  read-only responses contain no duplicate secret.
+
+### WF-STABLE-019 — claimed Task run requires a lease that navigation says will be issued later
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: C1 claim, writer lease continuity, truthful Task navigation
+- Evidence: the real Delegate consumed the first-field claim token and completed `task claim`, then
+  safely paused for bounded Git permission. After resume, Core-owned `task start` succeeded. The
+  following `next` advertised `task run` without a writer-token contract, and the exact call was
+  rejected because claimed posture already required the lease created by claim.
+- Root cause: the first writer-lease receipt was emitted by `task run`, but claimed posture requires
+  that same credential as an input to run. `task claim` returned the lease only inside its large
+  payload, while action-only navigation intentionally omitted `task run` from the writer contract.
+- Candidate evidence: `task claim` now emits first-field `writerLeaseReceipt` with `task run` as its
+  consuming action, and claimed `task run` navigation advertises the exact `--writer-token`
+  precondition. Unclaimed runs still acquire their initial lease without a token.
+
+### WF-STABLE-020 — transcript validator rejects safe top-level help
+
+- Status: Closed-regression in beta.2
+- Severity: High
+- Area: release transcript integrity, read-only CLI discovery
+- Evidence: phase 1 completed initial assembly, one complete Plan, and autonomy preparation with
+  zero rejected lifecycle calls. A successful trusted-harness top-level `--help` was immediately
+  followed by fresh successful `next`, but packaged validation returned
+  `Unsupported read-only observation`.
+- Root cause: CLI help semantics covered top-level, noun, and action scopes, while the transcript
+  recognizer's regular expression required at least one noun before `--help`.
+- Candidate evidence: the validator recognizes bare top-level `--help` as safe help, retains the
+  mandatory fresh-`next` barrier, and still rejects failed help or embedded mutation inputs.
+
+### WF-STABLE-021 — checkpoint guidance permits parallel invocations rejected by release validation
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: Critical
+- Area: gateway protocol, release transcript integrity, lifecycle checkpoints
+- Evidence: `real-agent-release-final-21` completed phase-1 initial assembly with no individually
+  rejected command, but four times started `next` before the paired `status` had emitted its
+  terminal result (or vice versa). The strict validator rejected the first overlap with
+  `INCOMPLETE_INVOCATION` at event index `29`, before owner grant or Task execution.
+- Root cause: the packaged gateway required both `status` and `next` after each boundary but did not
+  state that the first invocation must terminate before the second starts. Real agents may
+  parallelize independent-looking read-only calls, while the append-only validation contract
+  deliberately treats overlapping lifecycle invocations as indeterminate evidence.
+- Candidate evidence: Skill, protocol, recovery guide, and E2E Brief now require terminal
+  `status` followed by terminal `next` and explicitly prohibit parallel tool batches. An exact
+  transcript fixture proves that overlapping checkpoint starts remain rejected. The final clean
+  `real-agent-release-final-21` followed every `status` then `next` checkpoint sequentially through
+  final acceptance; the complete transcript validates at `250/250` with no overlap.
+
+### WF-STABLE-022 — raw real-agent evidence persists one-time C1 credentials
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: Critical
+- Area: real-agent evidence, C1 credentials, release security
+- Evidence: the corrected `real-agent-release-final-21` consumed credential-first handoff, claim,
+  and run receipts successfully, but Codex `exec --json` serialized the literal `--claim-token`,
+  `--writer-token`, and credential-bearing stdout into the raw session JSONL. The semantic lifecycle
+  log remained secret-free, but the raw diagnostic artifact contradicted the stated memory-only
+  handling rule.
+- Root cause: raw Codex JSONL was redirected directly to evidence without a streaming redaction
+  boundary. A language-model tool call necessarily contains the CLI argument it invokes, even when
+  the agent does not echo the value in prose.
+- Candidate evidence: a streaming structural sanitizer removes exact credential fields and CLI
+  options before JSONL is persisted, preserves non-secret token metrics, and provides a fail-closed
+  post-run inspection mode. Deterministic tests cover command arguments, embedded receipt JSON,
+  structured receipts, and already-sanitized evidence. The final clean final-21 used the streaming
+  sanitizer from process start for both phases; fail-closed inspection reports zero credential
+  findings in both persisted raw JSONL artifacts.
+
+### WF-STABLE-023 — claimed strict-review navigation omits its writer lease precondition
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: Critical
+- Area: claimed C1 review, truthful navigation, writer lease continuity
+- Evidence: sanitized `real-agent-release-final-21` completed one guarded Step and its Core-owned
+  commit, then `next` advertised `task step-review` without `writerTokenContract`. The exact first
+  call was rejected non-mutating with `TRANSITION_BLOCKED` because claimed posture requires the
+  active lease token.
+- Root cause: navigation enumerated always-lease-bound completion actions and claimed `task run`,
+  but not the later claimed-C1 mutations that call the same handoff authorization predicate.
+- Candidate evidence: writer-token navigation is now posture-aware for every claimed-C1 action
+  that can consume an optional lease, including `task step-review` and `task review-launch`.
+  Regressions cover both claimed review boundaries while preserving token-free unclaimed review
+  navigation. The final clean final-21 exposed the contract and succeeded on the first call for
+  both `task step-review` and `task review-launch`, with zero rejected lifecycle mutations.
+
+## Beta.2 current evidence
+
+- The first `real-agent-release-final-21` is immutable diagnostic evidence for WF-STABLE-021: its
+  lifecycle commands individually succeeded, but packaged validation rejected four overlapping
+  checkpoint pairs. It stopped before owner grant and was not resumed.
+
+- Final clean `real-agent-release-final-21` used a rebuilt tarball with SHA-256
+  `24a7b69b0ada9d922946a8c0c593384d5806d58a35e04fae171d26f83585ac4f` and an isolated
+  `final21` marketplace/plugin cache. Phase 1 assembled exactly seven linked Tasks and stopped at
+  the autonomy gate; phase 2 completed the sole required guarded Task, strict Step review,
+  content-only context refresh, final review, delegated acceptance, Core merge, Milestone
+  validation, and delegated Milestone final acceptance. Task
+  `TASK-01M04B516YDHY5D1B78S2XEV0S` is `merged` at revision `14`; Milestone
+  `MS-01M04B42MC7VCEKTQ7K8ZYK0G1` is `accepted` at revision `5`; accepted head is
+  `64a2e58e030dfb95f5f5724fb1825b02143ffaa7`. Final `next` is repository idle with
+  `discovery start`. Transcript validation passes `250/250`, both credential scans report zero
+  findings, waived Tasks executed is zero, and rejected lifecycle mutations is zero.
+- Post-WF-STABLE-023 full sequential validation on Node `24.17.0` passed `153/153` in
+  `644031 ms`. Plugin check, release check, isolated-cache dry-pack, downstream smoke, root
+  workflow regression, and `git diff --check` passed. The E2E-tested pre-evidence-doc tarball SHA-1 is
+  `4519d05b31fa08b39f5f5f9f9e2b9f0e13941935`.
+
+- Post-WF-STABLE-020 sequential package validation passed `149/149` under Node `24.17.0`.
+  Current validation accepts the immutable `final-20` phase-1 transcript as `132/132`, while its
+  packaged pre-fix validator deterministically rejects it. Rebuilt package dry-pack, plugin check,
+  release check, downstream smoke, root regression, and `git diff --check` passed; dry-pack shasum
+  is `d5ca042dd1bb90e52c6d5313dafa6730e5d3795f`.
+- Post-WF-STABLE-019 sequential package validation passed `149/149` under Node `24.17.0`.
+  Rebuilt package dry-pack, plugin validation, release check, downstream smoke, root workflow
+  regression, and `git diff --check` all passed; dry-pack shasum is
+  `547166399294368c89ae7c581192cf81a6391638`.
+- Post-WF-STABLE-018 sequential package validation passed `147/147` under Node `24.17.0`.
+  Rebuilt package dry-pack with isolated npm cache, plugin validation, release check, downstream
+  smoke, root workflow regression, and `git diff --check` all passed; package shasum is
+  `04571ca2f51f48661c984e8d16a2e32c336efe64`.
+- Final post-WF-STABLE-015 sequential package validation passed `141/141` under Node `24.17.0`.
+- Package archive, downstream smoke, plugin validation, release check, and root workflow regression
+  passed on the rebuilt candidate. One root-regression setup attempt lacked Node on the child-process
+  `PATH`; the authoritative rerun with the declared Node 24 environment passed.
+- Exact copied `signal_v4` snapshot replay passed without live-project or live-state writes.
+- Disposable final-6 phase 1 assembled seven Tasks and stopped cleanly at the autonomy boundary.
+  Phase 2 authorized and completed the guarded Step, then correctly stopped as invalid evidence
+  when strict Step review remained indeterminate.
+- Disposable final-11 assembled all seven Tasks and authorized the Milestone, then stopped on the
+  first rejected `task plan-set` because exact `AC-001` inclusion was not discoverable from `next`.
+  It is immutable diagnostic evidence for WF-STABLE-015, not release evidence.
+- Disposable final-12 reached delegated Task acceptance and `task merge`, then stopped on the first
+  rejected merge because `next` did not advertise mandatory `--writer-token`. It is immutable
+  diagnostic evidence for WF-STABLE-016, not release evidence.
+- Disposable final-13 passed clean bootstrap/preflight but the real Codex transport failed before
+  the first workflow action. It made no workflow mutation and is external diagnostic evidence, not
+  a package-defect or release signal.
+- Disposable final-16 cleared transport, completed initial assembly and the owner grant, then
+  stopped on the first rejected `milestone authorize --help`. It is immutable diagnostic evidence
+  for WF-STABLE-017, not release evidence.
+- Disposable final-17 completed seven-Task initial assembly with zero rejected mutations and proved
+  read-only help plus fresh `next`, but the packaged validator still rejected that help observation.
+  It stopped before owner grant and is immutable WF-STABLE-017 diagnostic evidence.
+- Disposable final-18 completed initial assembly through C1 handoff preparation with zero rejected
+  lifecycle calls. It then exposed WF-STABLE-018: the exact one-time claim token existed in complete
+  stdout but was buried after the large Task/event payload and was not retained by the Delegate.
+  The run is immutable diagnostic evidence and is not eligible for continuation or release evidence.
+- Disposable final-19 completed seven-Task assembly, delegated authorization, credential-first
+  handoff/claim, and bounded Core `task start`. It then exposed WF-STABLE-019 when claimed
+  `task run` was advertised without its already-bound lease precondition and was rejected once.
+  The run is immutable diagnostic evidence and is not eligible for continuation.
+- Disposable final-20 completed clean seven-Task phase-1 assembly and autonomy preparation with no
+  rejected lifecycle call, then exposed WF-STABLE-020 when transcript validation rejected safe
+  top-level help plus fresh `next`. No owner grant was issued; the run is immutable diagnostic
+  evidence and is not eligible for continuation.
+- The rebuilt tarball, fresh clean final-acceptance/idle E2E, transcript/security checks, and all
+  deterministic/package release gates are green. The independent source/evidence audit completed
+  with `PASS`, found no material blocker, and confirmed the beta.2 release recommendation.
+
+## Workflow findings closed for beta.1
+
+### WF-STABLE-001 — `locks repair` exposes a full writer token
+
+- Status: Closed-regression in beta.1
+- Severity: High
+- Area: lock recovery, CLI output, secret handling
+- Evidence: the `locks repair` result includes the complete credential-bearing writer token rather
+  than a redacted value or one-time bounded handoff.
+- Risk: a transcript, log, screenshot, or delegated agent output can disclose authority that permits
+  state mutation.
+- Stable-release requirement:
+  - never print the full token in ordinary JSON or human-readable output;
+  - return only a redacted fingerprint unless an explicit secure handoff channel is used;
+  - add CLI, JSON-envelope, logging, snapshot, and error-path tests proving no token leakage;
+  - preserve deterministic recovery and avoid making the token unrecoverable before ownership is
+    safely transferred.
+
+### WF-STABLE-002 — standalone Project Knowledge `next` is misleadingly attributed to a failed Task
+
+- Status: Closed-regression in beta.1
+- Severity: Medium
+- Area: `next`, Project Knowledge Map, remediation terminality
+- Signal replay evidence:
+  - Task `TASK-01M00W190K3V3HM68Q3QVSH1AY` is `needs_fix` with
+    `STEP-002-FORMALIZATION-CONTRACTS` failed and a `split-required` decision;
+  - after a top-level reconcile, `next` correctly returns scope `project-memory`, action
+    `project-memory approve`, revision `168`, but also returns that failed Task as `taskId`.
+- Risk: an agent or operator can interpret a standalone project approval as permission to refresh or
+  resume the terminal remediation path.
+- Stable-release requirement:
+  - standalone Project Knowledge actions must not look like Task execution actions;
+  - either omit `taskId` or expose it under an explicit non-authorizing field such as
+    `triggerTaskId`/`stalenessOriginTaskId`;
+  - state clearly that approval cannot authorize, refresh, or resume the referenced Task;
+  - add a replay for `split-required -> main branch reconcile -> standalone approval next`.
+
+### WF-STABLE-003 — terminal `split-required` is routed into unsafe Knowledge rebind
+
+- Status: Closed-regression in beta.1
+- Severity: Critical
+- Area: corrective terminal decisions, Milestone membership evolution, `next`
+- Signal replay evidence:
+  - after human approval of Project Knowledge Map revision `169`, exact `next` returns
+    `task knowledge-rebind` for `TASK-01M00W190K3V3HM68Q3QVSH1AY` at revision `28`;
+  - the Task is `needs_fix`, its guarded Step is failed, and its current corrective decision is
+    `split-required`;
+  - `taskCanRebindKnowledge` accepts every `needs_fix` Task without checking a hard-blocking
+    corrective decision;
+  - repository `next` lets Knowledge Map rebind override the Task-level `doctor` result for the
+    `split-required` posture;
+  - `rebindTaskKnowledge` changes the Plan hash, sets status to
+    `awaiting_execution_authorization`, clears review/block state, and supersedes execution
+    authorization without preserving the terminal decision on the rebound Plan;
+  - no Task cancellation transition exists, and a started Task remains repository-actionable while
+    its Milestone is active even if membership disposition is changed.
+- Risk: following exact `next` can detach the new Plan hash from the recorded `split-required`
+  decision and make the failed Task appear authorizable again. Ignoring `next` to create or
+  reclassify a replacement Task cannot remove the started failed Task from repository routing.
+- Stable-release requirement:
+  - reject `knowledge-rebind` and `context-refresh` before the first write when the current
+    corrective posture is `split-required` or `stop-escalate`;
+  - keep terminal corrective decisions effective across Project Knowledge changes without
+    rebinding or rewriting the historical Task Plan;
+  - provide one unambiguous replacement route with explicit old/new Task relationship;
+  - require atomic or journal-recoverable membership evolution;
+  - prevent both orphan replacement Tasks and a still-required terminal Task;
+  - make repository `next` return that replacement route rather than `knowledge-rebind`;
+  - add deterministic and real-agent E2E coverage for
+    `split-required -> Project Knowledge approval -> replacement -> Milestone continuation`.
+
+### WF-STABLE-004 — workflow package upgrades can remain stranded on a Task branch
+
+- Status: Closed-regression in beta.1
+- Severity: Medium
+- Area: update instructions, branch ownership, Milestone base verification
+- Evidence: dependency commit `3f45abc88f7b85091c484d0b84f4c96d1dfeb045` pinned
+  `codex-workflow-v2@2.0.0-alpha.7.2.1` only on the failed Task branch while local `main`, the
+  Milestone base, remained on alpha.7.1. Recovery required a manually scoped cherry-pick producing
+  `fabd1c868a9baa74c7ef273bf0272753c7927812` on local `main`.
+- Risk: diagnostics run with one package version while Milestone creation or replacement work starts
+  from another, invalidating assumptions and repeating already-fixed lifecycle failures.
+- Stable-release requirement:
+  - update preflight and documentation must distinguish current worktree version from Milestone base
+    branch version;
+  - provide an explicit dependency-only landing check before lifecycle work continues;
+  - fail closed when declared, locked, installed, current-branch, and base-branch versions diverge;
+  - never suggest merging unrelated product commits to transport a workflow dependency update.
+
+### WF-STABLE-005 — agent guidance did not make replacement membership evolution explicit
+
+- Status: Closed-regression in beta.1
+- Severity: Medium
+- Area: recovery prompts, operator guidance
+- Evidence: the generated post-approval prompt said to create a thin required replacement Task but
+  did not explicitly require reclassification of the old failed membership and Milestone
+  reauthorization through exact Core transitions.
+- Risk: correct package primitives can still be used in the wrong order, recreating an apparently
+  active but non-completable Milestone.
+- Stable-release requirement:
+  - ship a canonical `split-required` operator/delegate recovery prompt;
+  - require sequential terminal `status` then terminal `next` after every state boundary;
+  - distinguish Task creation, replacement linkage, membership evolution, and execution
+  reauthorization;
+- prohibit manual state editing and resumption of the failed Step.
+
+### WF-STABLE-006 — composite context refresh has no multi-file crash-recovery journal
+
+- Status: Closed-regression in beta.1
+- Severity: High
+- Area: Project Knowledge refresh, Task rebind, delegated reauthorization, durability
+- Evidence: alpha.7.1 validates the complete transition before its first canonical write and uses
+  atomic replacement for each individual file, but the composite transition performs multiple file
+  writes without a transaction journal. A process or machine failure between those writes can leave
+  a partially applied cross-file transition.
+- Risk: the repository can be clean while Project Knowledge, Task binding, authorization, and audit
+  sidecars disagree after a crash. Prevalidation prevents logical rejection after the first write but
+  cannot recover an interrupted physical write sequence.
+- Stable-release requirement:
+  - introduce a project-local transaction journal or an equivalent recoverable commit protocol;
+  - define deterministic roll-forward/rollback semantics for every write boundary;
+  - make recovery idempotent and preserve append-only audit history;
+  - add crash-injection tests before and after each canonical and sidecar write;
+  - prove `doctor`, `status`, and `next` detect and route every interrupted legacy/candidate shape;
+  - never silently treat a partial refresh as authorized.
+
+### WF-STABLE-007 — full validation commands may race through shared build/clean outputs
+
+- Status: Closed-regression in beta.1
+- Severity: Medium if confirmed
+- Area: maintainer validation, reproducibility
+- Evidence: concurrent `npm test` and `npm run validate` runs stopped producing reliable completion
+  evidence after both reached shared test/build phases. A later sequential run continued normally.
+  The observed behavior is consistent with shared `build`/`clean` output contention, but the exact
+  cause has not been isolated.
+- Risk: maintainers can mistake a hung or corrupted concurrent run for passing release evidence, or
+  waste hours waiting on a validation process that cannot complete deterministically.
+- Verification required:
+  - reproduce with process-level tracing and isolated logs;
+  - identify shared directories, cleanup commands, ports, caches, and child processes;
+  - distinguish a package-script race from a test-runner or environment defect.
+- Stable-release requirement if confirmed:
+  - isolate run outputs/resources or enforce an explicit single-run lock with a clear diagnostic;
+  - ensure interruption cleans up child processes and resources;
+  - document whether concurrent full validation is supported;
+  - add a deterministic concurrency regression where practical.
+
+### WF-STABLE-008 — replacement Task local start required a manual base-branch switch
+
+- Status: Closed-regression in beta.1
+- Severity: Low
+- Area: local Task start, replacement autonomy, Git preconditions
+- Evidence: the final disposable E2E correctly materialized and reauthorized the replacement, but
+  its first `task start` was safely rejected because the clean checkout still pointed at the
+  cancelled Task branch instead of `main`; the Delegate recovered by switching branches and retrying.
+- Stable guard: local Task start resolves the exact declared base ref and creates the new Task branch
+  from that ref even when another clean Task branch is checked out. Dirty worktrees and external
+  ownership rules remain fail-closed.
+
+## Beta.1 closure evidence
+
+- `WF-STABLE-001`: CLI integration proves both inspection and stale repair return only a token
+  fingerprint and never the writer token.
+- `WF-STABLE-002`: repository navigation returns diagnostic provenance as
+  `stalenessOriginTaskId` with `authorizesTask: false`; eligible atomic refresh is a Task-scoped
+  top-level action.
+- `WF-STABLE-003`: deterministic terminal replay and the disposable real-agent Milestone prove
+  `split-required -> replacement -> reauthorization -> merge -> final acceptance`, with the old
+  Task cancelled, linked, immutable in history, and without a retained writer lease.
+- `WF-STABLE-004`: update-preflight regressions cover declared, locked, installed, current-branch,
+  and active Milestone base versions plus dependency-only transport guidance.
+- `WF-STABLE-005`: `docs/split-required-recovery.md` and the packaged gateway protocol define one
+  exact replacement ordering and prohibit manual membership/state mutation.
+- `WF-STABLE-006`: beta transaction regressions inject ordinary failure and dead-process exit at
+  every target-write boundary, then prove rollback or idempotent roll-forward, including file
+  deletion. Context refresh and replacement both use the project journal.
+- `WF-STABLE-007`: a deterministic second full-validation owner fails immediately with
+  `VALIDATION_ALREADY_RUNNING`; the sequential release suite completed normally.
+- `WF-STABLE-008`: the local branch-start regression begins on a clean historical Task branch and
+  proves the new Task branch is created from the exact `main` commit.
+
+## Downstream findings to retain as E2E fixtures
+
+### SIGNAL-M3-001 — stable identifier validation misses real U+0000 after line terminators
+
+- Status: Downstream confirmed defect
+- Owner: `signal_v4`
+- Workflow relevance: use as the thin replacement-Task fixture for validating `split-required`
+  recovery; do not implement the product fix in this repository.
+- Required downstream acceptance: reject real U+0000 in every position, including immediately after
+  line terminators, without weakening other stable-identifier rules.
+
+### SIGNAL-M3-002 — Project Knowledge has an unresolved `ownership` gap
+
+- Status: Downstream gap, currently non-blocking
+- Owner: `signal_v4`
+- Evidence: candidate Knowledge Map revision `168`, hash
+  `8d775d82fb1aec85322a923ecf62053453160376033f45bd3c7e2a8c2588d51d`, reports no conflicts
+  and one missing `ownership` category source.
+- Rule: do not expand the NUL replacement Task to fix this gap. Track it as separate project
+  documentation work.
+
+### SIGNAL-M3-003 — local `main` has no configured `origin`
+
+- Status: Downstream operational risk
+- Owner: `signal_v4`
+- Evidence: local `main` is at `fabd1c868a9baa74c7ef273bf0272753c7927812`, but `git ls-remote
+  --heads origin main` fails because `origin` is not configured.
+- Risk: a local dependency correction may be mistaken for a shared or durable project update.
+- Rule: resolve repository remote/backup policy separately; do not let workflow lifecycle commands
+  infer permission to publish.
+
+## Closed alpha.7 regressions that must not recur
+
+### WF-REG-001 — context-only Knowledge Map rebinding invalidated `continue-fix`
+
+- Status: Closed-regression in alpha.7.2
+- Stable guard: semantic Plan equality must preserve an authorized `continue-fix`; semantic changes
+  must invalidate it; recovery remains append-only and non-mutating on failure.
+
+### WF-REG-002 — recovered corrective decision still produced `TOKEN_RECOVERY_NO_GO`
+
+- Status: Closed-regression in alpha.7.2.1
+- Stable guard: an append-only remediation-mode recovery must restore the exact allowed transition
+  without a fourth remediation run, duplicate decision, manual state edit, or writer-lease bypass.
+
+### WF-REG-003 — delegated creation of exact Plan-declared supporting Knowledge sources was blocked
+
+- Status: Closed-regression in alpha.7.1
+- Stable guard: only exact normalized Plan-declared supporting sources with
+  `knowledgeImpact=create` may be added; wildcard, directory, canonical, unauthorized, removal,
+  category/authority changes, gaps, and conflicts remain blocked before the first write.
+
+### WF-REG-004 — E2E history contained a spurious review failure from the harness
+
+- Status: Closed-regression in alpha.7.1 E2E evidence
+- Stable guard: fresh real-agent E2E evidence must separate harness/setup failures from lifecycle
+  review attempts and must not pollute the Task remediation history.
+
+### WF-REG-005 — `next` offered work that the exact transition would reject
+
+- Status: Closed-regression in alpha.7.2
+- Stable guard: `next` must use the same binding, recovery, terminal-decision, and corruption
+  predicates as the exact mutating transition. If the transition is guaranteed to reject, `next`
+  must return the recovery/blocking action instead of a Task run.
+
+## Stable-release exit rule
+
+The stable release is not ready while any Confirmed workflow finding above is open. Investigation
+items must be either reproduced and fixed or closed with recorded evidence that Core already provides
+the required safe semantics. Downstream findings do not block the package by themselves, but the NUL
+fixture must complete the real-agent replacement path through final Milestone acceptance.

package/docs/updating-existing-project.md

@@ -29,6 +29,8 @@ adoption posture.
 используйте внешний точный runner alpha.7 только для `update rescue-preflight`. Продолжать
 можно лишь при `eligible=true`; допустимы только перечисленные им `locks repair` и
 `task step-review`. Этот путь не меняет dependency и не разрешает другие команды alpha.7.
+Для `task step-review` используйте lifecycle-actor из `next` или rescue-preflight; это claimant
+или required actor, а не identity независимого reviewer-процесса.
 После terminal review выполните обычный Knowledge reconcile/rebind, доведите Task до безопасной
 границы и только затем обновляйте package/lock обычным способом.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-alpha.7.2.1",
+  "version": "2.0.0-beta.2",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "clean": "node --eval \"import('node:fs').then(({rmSync}) => { rmSync('dist', {recursive:true, force:true}); rmSync('.test-dist', {recursive:true, force:true}); })\"",
     "build": "npm run clean && tsc -p tsconfig.build.json && node scripts/mark-cli-executable.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "npm run build && tsc -p tsconfig.test.json && node --test .test-dist/tests/*.test.js",
+    "test": "node scripts/with-validation-lock.mjs test",
     "validate": "npm run typecheck && npm test",
     "pack:check": "npm run build && npm pack --dry-run",
     "smoke:downstream": "npm run build && node scripts/downstream-smoke.mjs",