codex-workflow-v2 2.0.0-beta.1 → 2.0.0-beta.10

package/docs/updating-existing-project.md

@@ -29,9 +29,29 @@ adoption posture.
 используйте внешний точный runner alpha.7 только для `update rescue-preflight`. Продолжать
 можно лишь при `eligible=true`; допустимы только перечисленные им `locks repair` и
 `task step-review`. Этот путь не меняет dependency и не разрешает другие команды alpha.7.
+Для `task step-review` используйте lifecycle-actor из `next` или rescue-preflight; это claimant
+или required actor, а не identity независимого reviewer-процесса.
 После terminal review выполните обычный Knowledge reconcile/rebind, доведите Task до безопасной
 границы и только затем обновляйте package/lock обычным способом.
 
+### Исключение beta.10 для retained reviewed commit
+
+Если corrective replan уже убрал evidence завершённой попытки из текущего Step, но её product
+commit остался в Git между `baseCommit` и новым dependency-only HEAD, beta.10 может штатно принять
+такую историю. Это допустимо только при полной криптографически целостной strict-review цепочке с
+решением `passed` и verified reviewer attestation. Pending/failed review, отдельный `evidence.json`,
+повреждённый sidecar или неизвестный product commit не подходят.
+
+Не регистрируйте сохранённый product commit вручную в `systemCommits`. После установки beta.10
+выполните свежий `next`; продолжайте только если он рекламирует
+`update dependency-provenance-recover`. Затем последовательно выполните read-only
+`update dependency-provenance-preflight`, проверьте `eligible=true`, точные Task revision/HEAD,
+пустой `blockers` и ожидаемый список `retainedHistoricalCommits`, и только после этого вызывайте
+рекламируемый recover с той же revision. Успешный recover записывает dependency HEAD в
+`systemCommits`, а исторические reviewed product commits — отдельно в recovery evidence. После
+него обязательны последовательные `status` и `next`; выполняйте возвращённый Knowledge reconcile
+или `task context-refresh`, если manifest/lock сделали Knowledge Map stale.
+
 ## 1. Подготовьте отдельный чат обновления
 
 Не обновляйте пакет во время выполняющегося Worker Step. Дождитесь завершения текущего ответа
@@ -78,6 +98,15 @@ plugin за пределами workspace. Это ожидаемая границ
 8. `update preflight` до изменения подтвердил чистую lifecycle-границу.
 9. Для alpha.6 существующий schema 2 проект либо уже имеет `adoption-posture.jsonl`,
    либо `next`/`status` требуют `state adoption-prepare` и затем `state adoption-apply`.
+10. При переходе с protocol v1 на v2 неизменённый и криптографически целостный adoption sidecar
+    остаётся читаемым как legacy evidence. Runtime не переписывает его автоматически; неизвестная
+    версия или смешанная protocol-цепочка считаются повреждением state.
+
+Protocol v2 меняет navigation/CLI corrective-replan и lifecycle epoch, но не Task state schema.
+До обновления не должно быть `in_progress` Step, writer lease, Core Task operation mutex или
+незавершённого corrective Task journal. Такие состояния требуют штатного completion/repair старой
+версией; переносить или удалять journal вручную нельзя. Старые grants/receipts не получают authority
+в epoch 2 — новый corrective replan всегда проходит новый prepare/human-gate/execute цикл.
 
 Изменение `projectId`, исчезновение сущностей или ошибка unsupported state schema — причина
 остановиться. Не соглашайтесь на «починку» удалением state. Агент должен вернуть dependency к
@@ -224,14 +253,40 @@ Grant сам не запускает агента и не прикрепляет
 `next.delegatedApprovalOptions`. Внутренние Worker и Independent Reviewer grant не используют:
 его применяет координатор после получения их evidence.
 
-Рекомендуемые названия чатов:
+Все автоматически создаваемые чаты получают проектный монотонный номер из
+`plugins/codex-workflow-gateway/scripts/chat-registry.mjs`; `count + 1` запрещён. Основные формы:
 
 ```text
-NN - M2 delegated coordinator
-NN - M2/T1 delegated execution
-NN - Standalone delegated task
+#NNN · M<NN> · Coord · <Milestone title> · <MS-ID>
+#NNN · M<NN>/T<NN> · Task · <Task title> · <TASK-ID>
 ```
 
+Task-чат создавайте только как новую standalone Codex task (`create_thread`) в том же Project, а
+не как fork/handoff/продолжение Milestone-чата. В начальный prompt передавайте только exact
+TaskContextPacket: repository, точные Milestone/Task ID и ordinal, текущие Task revision/title,
+Brief/Plan bindings, Task requirements/acceptance, свежий маршрут `status -> next --task <Task
+ID>`, Task-local scope/checks/stop conditions и exact actor/grant ID при необходимости. Не
+переносите transcript Milestone-чата, историю recovery/approval, соседние Tasks, reasoning или
+confirmation/handoff/writer credentials.
+
+До создания проверьте, нет ли уже чата для exact Task ID. После создания передайте прочитанный
+title в registry readback и применяйте только возвращённый deterministic fallback. Title должен
+быть уникален и содержать exact `#NNN`, membership ordinal и ID. Input должен состоять из
+TaskContextPacket; допустима только добавленная Codex App служебная `codex_delegation`-обёртка с
+`source_thread_id`, но не parent turns или transcript. Если title отсутствует или нормализован
+неверно, переименуйте и перепроверьте. Ошибка `create_thread` допускает один
+последовательный retry после проверки списка, но не разрешает fallback на `fork_thread`.
+Создавайте или переиспользуйте Task-чат непосредственно перед dispatch этой Task, а не как пустой
+placeholder для всего membership; `T<NN>` берите только из утверждённого membership order.
+
+После dispatch Milestone-координатор не заканчивает turn: он ждёт exact Task-чат bounded-вызовами
+`wait_threads`, сохраняет cursor, читает completed/attention результат и обязательно сверяет его
+через `status -> next`. Recoverable non-human продолжение отправляется в тот же чат через
+`send_message_to_thread`; пользователь нужен только для mandatory human/semantic gate, внешнего
+разрешения, unrecoverable integrity conflict или исчерпанного infrastructure retry. Следующий
+Task-чат создаётся только после Core-подтверждения `terminal + merged`. Завершённый Task-чат сам по
+себе не доказывает terminal state и не пробуждает уже завершившийся coordinator turn.
+
 После завершения автономного окна попросите отдельный контрольный чат показать
 `delegation list`, использованные authorization events и отозвать ненужный широкий grant.
 

package/docs/validation-report.md

@@ -1,56 +1,85 @@
-# V2 Alpha Validation Report
-
-Release candidate `2.0.0-alpha.7` was validated on 2026-08-14 with Node.js 24.17.0.
-
-- TypeScript typecheck and build passed.
-- The authoritative sequential suite passed `86/86` with `--test-concurrency=1`. An earlier
-  ordinary parallel run also passed its then-current `85/85` suite, but CLI subprocess
-  contention made one test take 165 seconds; the final sequential exit is the release evidence.
-- `npm run pack:check`, `npm run smoke:downstream`, `npm run release:check`,
-  `npm run plugin:check`, and `git diff --check` passed. Packaging and downstream smoke used
-  an isolated temporary npm cache because the user cache contains pre-existing root-owned
-  entries.
-- The repository-level `tools/tests/codex-workflow-regression.mjs` update/install regression
-  completed with `status: PASS`.
-- Dry-run packaging produced `codex-workflow-v2-2.0.0-alpha.7.tgz` with 139 files; downstream
-  installation and packaged CLI handshake passed.
-
-Alpha.7 regression coverage includes:
-
-- pending strict Step Review outranks Knowledge Map reconcile/rebind after a knowledge-changing
-  completion commit; review succeeds against the exact historical approved binding even while
-  the current map is stale, and rebind remains mandatory before the next Step;
-- read-only alpha.6 rescue-preflight rejects active leases and accepts only one exact pending
-  strict-review candidate on the clean recorded completion HEAD;
-- seven linked Tasks can be materialized during initial Milestone assembly and classified by
-  one complete initial Plan without repeated scope-change approvals;
-- one maximum-72-hour Milestone Autonomy Contract issues the existing Task/Milestone approval
-  permissions, permits Project Memory approval only inside an atomic content-only Task context
-  refresh, permits journaled membership-only evolution, requires reauthorization, and rejects
-  both standalone Project Memory approval and semantic scope drift; a later human semantic
-  change invalidates future uses of the autonomy grant;
-- C1 Worker and corrective Auditor actors are deterministically derived while claim, lease,
-  handoff, and reviewer/auditor independence checks remain fail-closed;
-- every newly recorded guarded Plan Risk Audit requires an exact proof obligation per failure
-  mode: hostile counterexample, expected safe result, and executable evidence command;
-  historical alpha.6 audits remain readable for recovery only;
-- existing Milestone journal recovery, reverse-membership integrity, delegation, adoption,
-  Knowledge Map, graph, strict reviewer, Git ownership, and remediation hard-stop tests remain
-  green.
-
-Compatibility claims verified:
-
-- `protocolVersion: 1` and `STATE_SCHEMA_VERSION: 2` remain unchanged;
-- canonical Task and Milestone schemas remain byte-identical;
-- the generic delegated transition allow-list remains unchanged;
-- new evidence is additive through `autonomy-contract-events.jsonl`, optional autonomous
-  fields on scope-change events, and optional proof obligations on Plan Risk Audit events;
-- the gateway handshake advertises alpha.7 rescue, initial assembly, autonomy, derived actor,
-  corrective routing, and proof-obligation capabilities.
-
-Not claimed here:
-
-- no npm publication, Git tag, push, or downstream project mutation was performed;
-- no manual rewrite of external Workflow state is part of the recovery design;
-- the local package cannot cryptographically prove a real human identity or a physically
-  separate Codex task beyond the existing actor, process-isolation, sidecar, and lease evidence.
+# V2 beta.10 Validation Report
+
+Release candidate `2.0.0-beta.10` was validated on 2026-08-22 with Node.js 24.17.0.
+
+## Automated release evidence
+
+- `npm run validate` passed `297/297` sequential tests with no failures, skips,
+  cancellations, or todos. The exact Signal recovery tests also passed independently through
+  `npm run test:signal-t04-recovery` (`5/5`).
+- `npm run pack:check` passed with an isolated temporary npm cache. The tarball contains 247 files;
+  package size is 1.0 MB and unpacked size is 3.6 MB.
+- `npm run smoke:downstream` packed and installed the actual beta.10 tarball in an empty project,
+  then passed the packaged CLI handshake. The first sandboxed attempt was network-blocked while
+  fetching `ajv`; the authorized network retry passed.
+- `npm run plugin:check`, the plugin-creator structural validator, the skill validator,
+  `npm run release:check`, and `git diff --check` passed. The bundled plugin source cachebuster is
+  `0.1.0+codex.20260822140058`; the packaged installer produced and read back personal installation
+  `0.1.0+codex.20260822140239` with the beta.10 recovery instructions present in source and cache.
+
+## beta.10 retained-review recovery evidence
+
+- Recovery still requires one clean local Task branch whose final unregistered HEAD changes exactly
+  `package.json` and `package-lock.json`, with runtime, manifest, lock, installed package, current
+  branch, and Task base branch all aligned to beta.10. Running Steps, leases, transactions, Core
+  operations, product changes in the candidate, and base payload drift fail closed.
+- A product commit removed from the current Step by corrective replan is now admissible only when
+  Core derives it from the globally validated strict-review sidecars: an intact
+  `pending → review-recorded → attestation-verified` chain, `passed` decision, exact completion
+  commit, and verified reviewer isolation. Pending review and a corrupted event-hash chain fail
+  closed in dedicated regressions.
+- The dependency candidate is recorded in `systemCommits`. Historical reviewed product commits are
+  recorded separately in `dependencyProvenanceRecoveries[].retainedHistoricalCommits`; they are not
+  relabelled as Workflow system commits. Normal Git-history validation consumes both provenance
+  classes after recovery.
+- The release check pins the exact sanitized Signal fixture: project
+  `b06d0f18f790f4521a23c770`, Milestone `MS-01M0HVCBC9DM3XQAR82T4550DA`, Task
+  `TASK-01M0HVK4YDJ3W9X0N72TYNV8WK` revision 26, status
+  `awaiting_execution_authorization`, planned Step with null current evidence, recorded system
+  commits `d6cce722…` and `198de88…`, and retained passed-review commit `acdfc803…`.
+
+## Isolated exact Signal replay
+
+- The real Signal Git branch and Workflow state were copied to temporary isolated state plus two
+  temporary Git worktrees. The replay modelled the actual installed transition
+  `2.0.0-beta.7 → 2.0.0-beta.10`; it did not assume beta.9.
+- With an exact dependency-only candidate over `acdfc803…`, read-only preflight returned
+  `eligible=true`, no blockers, Task revision 26, and exactly one retained historical commit:
+  `acdfc80345d2d4cd9d42af17da246701c42f0969`.
+- Fresh `next` advertised only `update dependency-provenance-recover`. Recovery advanced the copied
+  Task `26 → 27`, preserved current corrective Plan/Step posture, appended the dependency candidate
+  to `systemCommits`, and persisted `acdfc803…` under `retainedHistoricalCommits`.
+- Sequential post-recovery `status → next` returned the normal actionable route
+  `task context-refresh`, because manifest/lock changed the derived Knowledge inputs. It did not
+  return `doctor` or another dependency recovery.
+- Temporary worktrees, branches, tarball, and copied Workflow state were deleted. Direct readback
+  then confirmed the real Signal repository remained clean at `acdfc803…` and the real Task remained
+  revision 26 with no dependency-provenance recovery record.
+
+## Progress, replacement, and chat evidence
+
+- The full suite retains the read-only Milestone progress projection and exact regression
+  `T03 cancelled → T08 replacement`, including stable membership/Step ordinals.
+- Automated chat-registry coverage still proves project-monotonic `#NNN`, all compact title
+  families, long Cyrillic readback/fallback, multiple review attempts, and atomic allocation.
+- The beta.9 live App E2E evidence remains valid for the unchanged title/registry implementation:
+  Tasks `01a02928-0436-7af2-a1b9-a969226d50d9`,
+  `01a02928-3d39-7673-8e08-6d4ed0f8d554`, and
+  `01a02928-58a0-7e03-b487-f8877b7f76d8` exercised Task, Step Review A1, and Step Review A2 with
+  exact deterministic fallback and readback before archival.
+
+## External App-runtime limitation retained
+
+Plugin CLI installation and cache readback passed. A currently open Codex task can still retain the
+skill path injected when that task started; loading the new personal plugin version requires a new
+Codex task. This is an App runtime/catalog lifetime boundary, not a package or Workflow-state
+failure.
+
+## Not claimed
+
+- No npm publication, Git tag, push, or release commit was performed by validation.
+- No real Signal Workflow mutation, package update, branch change, or manual external-state edit was
+  performed.
+- The isolated replay proves the exact recovery path before publication; a real Signal update must
+  still install the published beta.10 package and follow fresh project-local `handshake → doctor →
+  status → next → preflight → advertised recovery`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.1",
+  "version": "2.0.0-beta.10",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",
@@ -41,6 +41,7 @@
     "build": "npm run clean && tsc -p tsconfig.build.json && node scripts/mark-cli-executable.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "node scripts/with-validation-lock.mjs test",
+    "test:signal-t04-recovery": "node scripts/with-validation-lock.mjs test-signal-t04",
     "validate": "npm run typecheck && npm test",
     "pack:check": "npm run build && npm pack --dry-run",
     "smoke:downstream": "npm run build && node scripts/downstream-smoke.mjs",
@@ -48,6 +49,9 @@
     "release:check": "node scripts/release-check.mjs",
     "publish:release": "node scripts/publish.mjs"
   },
+  "dependencies": {
+    "ajv": "8.20.0"
+  },
   "devDependencies": {
     "@types/node": "24.10.1",
     "typescript": "5.9.3"

package/plugins/codex-workflow-gateway/.codex-plugin/plugin.json

@@ -1,12 +1,17 @@
 {
   "name": "codex-workflow-gateway",
-  "version": "0.1.0",
+  "version": "0.1.0+codex.20260822140058",
   "description": "Thin personal Codex gateway for exact project-local Codex Workflow V2 packages and codebase-memory-mcp.",
   "author": {
     "name": "Codex Workflow Maintainers"
   },
   "license": "MIT",
-  "keywords": ["codex", "workflow", "codebase-memory", "gateway"],
+  "keywords": [
+    "codex",
+    "workflow",
+    "codebase-memory",
+    "gateway"
+  ],
   "skills": "./skills/",
   "interface": {
     "displayName": "Codex Workflow Gateway",
@@ -14,7 +19,9 @@
     "longDescription": "Resolves the exact project-local Codex Workflow V2 package, delegates workflow semantics to its CLI, and maintains derived codebase-memory graph bindings with explicit fallback evidence.",
     "developerName": "Codex Workflow Maintainers",
     "category": "Productivity",
-    "capabilities": ["Interactive"],
+    "capabilities": [
+      "Interactive"
+    ],
     "defaultPrompt": [
       "Show the next valid Codex Workflow V2 action.",
       "Refresh the project code graph for planning.",

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -1,4 +1,17 @@
-# Gateway Protocol V1
+# Gateway Protocol V2
+
+## beta.10 coordinator projections, retained review provenance, and chat registry
+
+- `update dependency-provenance-preflight --id <TASK-ID>` is read-only. The matching
+  `update dependency-provenance-recover --id <TASK-ID> --expected-revision <N> --actor <ACTOR>
+  --reason <TEXT>` is valid only when preflight and fresh `next` both advertise it. Historical
+  product commits absent from the current corrective Step are recognized only through intact passed
+  strict-review plus verified reviewer-attestation chains and remain separately auditable as
+  `retainedHistoricalCommits`.
+- `milestone progress --id <MS-ID>` is a read-only projection and the sole source for Coordinator
+  progress tables. It preserves cancelled/replacement Tasks as distinct membership rows.
+- `scripts/chat-registry.mjs` atomically allocates project-monotonic `#NNN`, builds all six title
+  families, verifies exact readback, supplies deterministic fallbacks, and binds the verified chat.
 
 ## Handshake
 
@@ -11,7 +24,7 @@ codex-workflow gateway handshake --repo <git-root>
 Require:
 
 - package name `codex-workflow-v2`
-- protocol version `1`
+- protocol version `2`
 - state schema version `2`
 - the capabilities needed for the requested operation
 
@@ -29,6 +42,9 @@ Current capability set:
 - `project-composite-transaction-journal-v1`
 - `corrective-plan-audit-v1`
 - `safe-update-preflight-v1`
+- `bounded-dependency-provenance-recovery-v1`
+- `retained-reviewed-history-recovery-v1`
+- `milestone-progress-projection-v1`
 - `strict-reviewer-v1`
 - `legacy-snapshot-v1`
 - `plan-risk-audit-sidecar-v1`
@@ -44,6 +60,7 @@ Current capability set:
 - `alpha6-adoption-posture-v1`
 - `alpha6-strict-review-rescue-v1`
 - `milestone-initial-assembly-v1`
+- `milestone-initial-assembly-navigation-v2`
 - `milestone-autonomy-contract-v1`
 - `milestone-autonomous-membership-evolution-v1`
 - `task-c1-derived-worker-actor-v1`
@@ -75,7 +92,9 @@ version, canonical entity summaries, and the current sidecar baseline hash. Adop
 
 ## Worker Step completion and strict Step Review
 
-`task run` dispatches one Step and returns its writer token and Worker envelope. The Worker
+`task run` dispatches one Step and returns a first-field `writerLeaseReceipt`, followed by the
+credential-free lease metadata, Task state, and Worker envelope. Consume the receipt before the
+remaining payload and retain its token only in working memory. The Worker
 must leave all changes uncommitted and must not stage, commit, amend, reset, rebase, or
 modify Git history.
 
@@ -84,11 +103,36 @@ While that Step is `in_progress`, repository-level `next` normally returns
 `workflow-core` ownership. The coordinator invokes that transition with the current revision
 and writer token. Core then runs configured checks, validates `allowedWrites`, stages the
 changes, creates the atomic commit, and records evidence.
+When `next` also includes `gitMutationPolicy`, obtain bounded permission for that exact
+Git-writing transition before the first call; do not probe and retry after a
+`.git/index.lock` failure. For `task start`, the policy applies only when the coordinator
+chooses `--workspace-owner local`.
+
+When `next` also includes `writerTokenContract`, the coordinator must retain the active writer
+lease from `writerLeaseReceipt` and pass it with the advertised option on the first transition call.
+The contract never contains the token value. Do not print, persist, reconstruct, or replace the
+token with a redacted fingerprint; stop before mutation when the active lease is unavailable.
+Satisfy this contract separately from any `gitMutationPolicy` on the same response.
+
+`codex-workflow <noun> [action] --help` is a read-only command-discovery route. It exits without
+constructing workflow state or validating lifecycle inputs. Use exact option lists only when the
+response says `exactOptionContractAvailable=true`; otherwise consult this packaged protocol. After
+help, obtain a fresh `next` before invoking the lifecycle transition.
 
 If the current Plan Risk Audit marks that Step for strict review, the commit is still
 workflow-owned, but `next` then returns `action: "task step-review"` with the same `stepId`
 and the exact `completionCommit`. Canonical Step completion remains blocked until the strict
 review and reviewer attestation sidecars verify against that exact commit.
+Invoke `task step-review` with the same lifecycle actor advertised by `next`
+(`c1Handoff.claimant` or `requiredActor` when present). The isolated reviewer is launched
+inside Core; do not substitute the reviewer identity into `--actor`. In claimed C1 posture,
+`next.writerTokenContract` is mandatory for both `task step-review` and the later
+`task review-launch`; pass the retained active lease on the first call of each exact action.
+
+After submission, a pending Task review is advertised as `action: "task review-launch"`, not
+`task review-record`. That compound route launches the read-only reviewer and atomically
+records the returned review. If claimant-bound mutation is active, pass the same lifecycle
+actor through `--actor`; reviewer identity remains internal to the route.
 
 An unrecorded commit is Git history drift. Stop instead of adding another commit or editing
 workflow state manually; recovery remains coordinator-controlled.
@@ -129,6 +173,12 @@ classifications. A planned new scanner-visible Knowledge file must be declared w
 directories, and inferred authority are not declarations; only Core may decide whether the final
 diff is eligible for delegated refresh.
 
+For every `task plan-set` navigation, consume `next.taskPlanContract` before building the Plan.
+Its `requiredRequirementIds` and `requiredAcceptanceIds` are exact-membership preconditions, not
+descriptive hints. Preserve each ID verbatim in the corresponding Plan array and use the returned
+Brief hash plus Knowledge Map revision/hash as the planning binding. Missing or stale contract data
+is a stop condition.
+
 Use `task context-refresh` only when the same `next` response returns it as the top-level action and
 exposes `contextRefresh` for the exact grant. Pass Task revision, map revision, delegate actor, and
 grant ID. Never run standalone `project-memory reconcile` first; Core blocks that non-atomic route
@@ -166,11 +216,28 @@ claimed, only the claimant may mutate the Task, and lease-bound mutations must p
 bound writer token. Milestone-linked Tasks must be claimed before start, and handback is
 terminal and evidence-bound. When target actor is omitted, Core derives
 `agent:worker:<task-id>`. No thread id is required or accepted as authority.
+The successful prepare response begins with `credentialHandoff`. Consume that receipt before the
+Task/event/bundle payload, retain its token only in working memory, and pass it exactly once to the
+declared `task claim --claim-token` action for the declared target actor. The later bundle remains
+contextual and intentionally contains no second copy of the claim token.
+The successful claim response then begins with `writerLeaseReceipt`. Retain that token only in
+working memory. In claimed C1 posture, fresh `next` exposes `writerTokenContract` on `task run`;
+pass the receipt token through its declared `--writer-token` option on the first run call. The
+successful run returns the refreshed writer receipt for later lease-bound transitions.
 
 ## Milestone assembly, autonomy, and human gate
 
 During initial planning, materialize every linked Task and then call `milestone plan-set` once
 with the complete membership. Execution is blocked while reverse membership is incomplete.
+Before Task 1 and between linked Tasks, follow top-level `next.action = "milestone initial-assembly"`.
+Its `linked-task-assembly.commands` permit `discovery start` and `discovery materialize`; after the
+first linked Task exists, the separate closing option permits `milestone plan-set`. If `status` or `next` fails, stop: never label
+the gap expected and invoke `milestone plan-set` directly.
+
+Every required navigation checkpoint is strictly sequential: start `status`, wait until its
+terminal result is recorded, then start `next` and wait for its terminal result. Never issue the
+pair concurrently or through a parallel tool call. The trusted transcript validator treats a
+second invocation before the first terminal result as indeterminate release evidence.
 
 After that Plan, one human may prepare and grant a maximum-72-hour Milestone Autonomy Contract:
 
@@ -227,6 +294,10 @@ transition matches the requested command, with the named delegate as actor and t
 as `--delegation-grant`. The resulting authorization event records the grant and both actors.
 For `milestone.final_accept`, also pass the current `MSA-*` code; the existing grant replaces
 the later-message requirement, not the state binding.
+Do not pass `--delegation-grant` to ordinary C1 handoff, claim, run, step-complete,
+step-review, merge, or sync-base calls. Those transitions are not authorized by a Milestone
+approval grant unless the same `next` response explicitly advertises an eligible grant for the
+exact transition.
 
 Delegated approval does not cover adoption apply or the ordinary semantic Milestone scope-change
 path. Membership-only evolution requires the separate Milestone Autonomy Contract.