codex-workflow-v2 2.0.0-alpha.7.2 → 2.0.0-alpha.7.2.1

package/docs/alpha7.2.1-remediation-recovery-brief.md

@@ -0,0 +1,86 @@
+# Codex Workflow V2 2.0.0-alpha.7.2.1 — remediation recovery brief
+
+## Source and scope
+
+Source release: `v2.0.0-alpha.7.2` at
+`1d5b09f0116ea241b9b5f71c0fa3320ac4318891`.
+
+This is a narrow lifecycle patch. It does not change product scope, Milestone
+semantics, the three-attempt guarded-review limit, or historical events in
+place. `signal_v4` is read-only evidence and must be replayed only from a copy
+of its workflow state.
+
+## Reproduced defects
+
+### D1 — recovered third attempt is recorded as ordinary
+
+After two ordinary failures, an authorized `continue-fix`, a Knowledge-only
+Plan rebind, and alpha.7.2 corrective recovery, `task run` correctly permits
+attempt ordinal 3. If that run later fails checks or strict review, the failure
+writer loses the recovery binding and appends remediation ordinal 3 with
+`mode=ordinary`. The same Core then rejects its own event as `STATE_CORRUPT`.
+
+Exact production evidence:
+
+- Task `TASK-01M00W190K3V3HM68Q3QVSH1AY`;
+- Step `STEP-002-FORMALIZATION-CONTRACTS`;
+- corrective decision `CRD-01M011B4MM5R1FZG2DSDRHVXJ4`;
+- recovery `CDR-01M01ST9ENGH4F3W5TRJ9EC53C`;
+- malformed remediation `RME-01M01TBQ4P5KR24J51WTMT79DY`;
+- ordinal `3`, stored mode `ordinary`, required effective mode `corrective`.
+
+### D2 — `next` advertises an impossible context refresh
+
+With an active Step and Knowledge drift from its uncommitted allowed writes,
+`next` may advertise delegated `task context-refresh`, while the transition
+correctly rejects any refresh during `Step=in_progress`. The truthful action is
+the active Step action (`task step-complete`, then strict review). Knowledge
+refresh follows only after the Step becomes terminal.
+
+## Required behavior
+
+1. Every guarded failure writer (`checks-failed`, `review-failed`, and
+   `review-unverified`, including retry/idempotence paths) must preserve the
+   exact validated corrective-recovery binding and record ordinal 3 as
+   `corrective`.
+2. Alpha.7.2 legacy state with exactly the D1 shape must have one explicit,
+   append-only recovery transition. The original remediation event and its
+   hash chain remain byte-for-byte unchanged.
+3. The recovery event binds the exact Task, Step, Task revision, malformed
+   remediation ID/hash, corrective decision ID/hash, corrective recovery
+   ID/hash, ordinal, Plan hash, actor, and mode correction
+   `ordinary -> corrective`.
+4. Recovery validation and authority checks occur before the first write.
+   Failure is non-mutating; identical retry is idempotent; conflicting or
+   duplicate recovery fails closed.
+5. After recovery, `next` must expose the existing guarded hard stop with only
+   `split-required` and `stop-escalate`. A fourth remediation run remains
+   prohibited.
+6. Any other ordinal, mode, decision, Plan, event-chain, review evidence,
+   recovery evidence, actor/token, Task/Step status, or duplicate shape is not
+   recoverable.
+7. While a Step is active, `next` must return its executable Step action and
+   must not advertise `task context-refresh` or standalone Project Knowledge
+   work that the exact transition ordering rejects.
+
+## Deterministic evidence
+
+- Future path: two failures → recovered continue-fix → run → failed checks and
+  failed/unverified strict-review variants → ordinal 3 is corrective. Failed
+  checks/review reach hard stop; unverified isolation permits only strict-review
+  retry for the same completion commit and never another run.
+- Legacy path: copy exact malformed alpha.7.2 state → `next` advertises the
+  explicit recovery → recovery append → identical retry is idempotent →
+  original files unchanged except the new recovery sidecar → `next` advertises
+  hard stop, never `task run`.
+- Negative cases cover mismatched IDs/hashes/revision/actor/token, missing or
+  ambiguous recovery, broken event chains, non-ordinal-3 events, and repeated
+  conflicting recovery.
+- Navigation parity: active Step plus eligible Knowledge drift returns
+  `task step-complete`; after completion it returns strict review before any
+  context refresh.
+
+## Release boundary
+
+Stop after full deterministic validation, exact disposable `signal_v4` replay,
+and self-review. Do not tag, push, publish, or mutate `signal_v4`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-alpha.7.2",
+  "version": "2.0.0-alpha.7.2.1",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",

package/schemas/remediation-mode-recovery-event.schema.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://codex-workflow.local/schemas/remediation-mode-recovery-event.schema.json",
+  "title": "Codex Workflow V2 Remediation Mode Recovery Event",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "eventId", "taskId", "stepId", "taskRevision", "remediationEventId",
+    "remediationEventHash", "correctiveDecisionEventId", "correctiveDecisionEventHash",
+    "correctiveDecisionRecoveryEventId", "correctiveDecisionRecoveryEventHash",
+    "attemptOrdinal", "planHash", "actor", "c1ClaimEventHash",
+    "writerLeaseTokenHash", "fromMode", "toMode", "reason",
+    "previousEventHash", "recordedAt", "eventHash"
+  ],
+  "properties": {
+    "eventId": { "type": "string", "pattern": "^RMR-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "taskId": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "stepId": { "type": "string", "pattern": "^STEP-[0-9]{3}(?:-[A-Z0-9-]+)?$" },
+    "taskRevision": { "type": "integer", "minimum": 1 },
+    "remediationEventId": { "type": "string", "pattern": "^RME-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "remediationEventHash": { "$ref": "#/$defs/hash64" },
+    "correctiveDecisionEventId": { "type": "string", "pattern": "^CRD-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "correctiveDecisionEventHash": { "$ref": "#/$defs/hash64" },
+    "correctiveDecisionRecoveryEventId": { "type": "string", "pattern": "^CDR-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "correctiveDecisionRecoveryEventHash": { "$ref": "#/$defs/hash64" },
+    "attemptOrdinal": { "const": 3 },
+    "planHash": { "$ref": "#/$defs/hash64" },
+    "actor": { "type": "string", "minLength": 1 },
+    "c1ClaimEventHash": { "$ref": "#/$defs/nullableHash64" },
+    "writerLeaseTokenHash": { "$ref": "#/$defs/nullableHash64" },
+    "fromMode": { "const": "ordinary" },
+    "toMode": { "const": "corrective" },
+    "reason": { "const": "alpha7.2-recovered-continue-fix-mode-omission" },
+    "previousEventHash": { "$ref": "#/$defs/nullableHash64" },
+    "recordedAt": { "type": "string", "format": "date-time" },
+    "eventHash": { "$ref": "#/$defs/hash64" }
+  },
+  "$defs": {
+    "hash64": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "nullableHash64": { "type": ["string", "null"], "pattern": "^[a-f0-9]{64}$" }
+  }
+}