codex-workflow-v2 2.0.0-beta.1 → 2.0.0-beta.10

package/references/state-machine.md

@@ -63,7 +63,10 @@ human turn boundary.
 
 During initial planning, all linked Tasks may be materialized before one complete
 `milestone plan-set`; execution remains blocked until every reverse membership is classified.
-After that boundary, semantic updates use human-only `milestone scope-change-prepare` and
+`next` returns `milestone initial-assembly` before Task 1 and after every safe linked-Task
+materialization, with explicit `discovery start` and `discovery materialize` commands. After at
+least one linked Task exists, it also exposes the closing `milestone plan-set` command. Failed navigation is fail-closed and cannot be treated as an
+expected assembly signal. After that boundary, semantic updates use human-only `milestone scope-change-prepare` and
 `milestone scope-change-apply`. A human-confirmed, expiring Milestone Autonomy Contract may
 use `milestone autonomy-evolve` only for membership changes while outcome, success signal,
 acceptance, checks, discovery, and base branch remain fixed. It may also approve Project Memory

package/roles/delivery-coordinator.md

@@ -24,6 +24,45 @@ Own state transitions, dispatch envelopes, evidence collection, and recovery gui
 - A Milestone coordinator creates one dedicated user-visible Codex Task chat for each required
   Task. The Milestone chat owns ordering, exact delegated approvals, merge observation,
   validation, and final acceptance; it does not accumulate implementation for every Task.
+- Create that Task chat as a new standalone Codex task, never by forking, handing off, or continuing
+  the Milestone chat. Supply only the exact Task context packet from current Workflow state. Parent
+  history, sibling Tasks, recovery narrative, reasoning traces, confirmation codes, handoff
+  credentials, and writer tokens are forbidden in the Task prompt. A chat-creation failure blocks
+  dispatch; it is never permission to fall back to a fork.
+- Allocate every Coordinator, Task, Step/Final Review, Corrective Audit, and Plan Audit title with
+  the project chat registry. It owns the monotonic `#NNN`, compact format, exact readback, and
+  deterministic fallback; never use `count + 1`. Primary Coordinator/Task forms are
+  `#NNN · M<NN> · Coord · <Milestone title> · <MS-ID>` and
+  `#NNN · M<NN>/T<NN> · Task · <Task title> · <TASK-ID>`. Verify the
+  Task-only input after creation, and keep one unique Task-ID-to-thread mapping. A host-generated
+  routing envelope with `source_thread_id` is allowed; copied parent turns are not. Always read the
+  title through registry readback, then use only its returned fallback when omitted or normalized;
+  do not create a duplicate chat for the same Task.
+  Derive `T<NN>` from approved membership order and create the chat just before dispatch, not as an
+  inherited or empty placeholder. During `AUTO` Discovery use `M<NN> · Coordinator · Discovery`,
+  then rename it to the exact Milestone title and ID immediately after materialization.
+- Emit a Task progress table after every significant Step/review boundary. Emit the read-only
+  `milestone progress` projection at resume, Task boundaries, and membership changes; keep
+  cancelled/replacement Tasks as distinct rows such as `T03 cancelled → T08 replacement`.
+- Treat Task-chat creation as dispatch, not completion. Keep the Milestone coordinator turn active
+  and supervise the exact dispatched Task with bounded `wait_threads` calls, preserving the latest
+  cursor. On completion or attention, inspect the Task chat, then run repository `status` followed
+  by fresh `next`; Task output is evidence, never lifecycle authority.
+- Require each Task chat to return a closed non-secret CoordinatorReport at terminal or attention
+  boundaries. `wait_threads` is only the wakeup signal; always use `read_thread` for the full report
+  before comparing it with Workflow state.
+- When the same Task remains nonterminal and fresh navigation provides a non-human continuation,
+  resume that same chat with `send_message_to_thread`. Ask the user only for a real human/semantic
+  gate, external permission, unrecoverable integrity conflict, or exhausted infrastructure retry.
+  Do not create another Task chat merely because the existing one is idle or finished.
+- Do not end the Milestone coordinator turn with a dispatched nonterminal Task except at a requested
+  checkpoint or genuine blocker. Record the Task/thread/host/title/cursor mapping and fresh
+  lifecycle status so a later turn can reconcile through `list_threads`, `read_thread`, `status`,
+  and `next` without duplicate dispatch. A Task chat completion does not automatically wake its
+  coordinator.
+- Dispatch the next required Task only after Core confirms the prior Task terminal and merged. Each
+  Task chat supervises its own external Reviewer chats; after every required Task is merged, the
+  Milestone coordinator performs validation and the exact final-acceptance transition.
 - Before authorizing a high-risk Plan, require the Technical Planner's migration/concurrency/
   restart/crash/provider risk review and failure-specific checks.
 - After a second failed independent Task review, require a separate corrective Plan Auditor

package/schemas/adoption-posture-event.schema.json

@@ -30,7 +30,7 @@
     "eventType": { "enum": ["project-registration", "adoption-apply"] },
     "actor": { "type": ["string", "null"], "minLength": 1 },
     "packageVersion": { "type": "string", "minLength": 1 },
-    "protocolVersion": { "const": 1 },
+    "protocolVersion": { "enum": [1, 2] },
     "stateSchemaVersion": { "const": 2 },
     "adoptionBoundaryAt": { "type": "string", "format": "date-time" },
     "baselineDigestHash": { "$ref": "#/$defs/hash64" },

package/schemas/context-envelope.schema.json

@@ -25,7 +25,7 @@
     "knowledgeSources"
   ],
   "properties": {
-    "protocolVersion": { "const": 1 },
+    "protocolVersion": { "const": 2 },
     "packageVersion": { "type": "string" },
     "role": {
       "enum": ["scope-lead", "technical-planner", "delivery-coordinator", "worker", "independent-reviewer"]

package/schemas/corrective-replan-credentials.private.schema.json

@@ -0,0 +1,98 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "codex-workflow://schemas/private/corrective-replan-credentials/v1",
+  "$defs": {
+    "hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "id": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "time": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "ref": {
+      "type": "object", "additionalProperties": false,
+      "required": ["id", "version"],
+      "properties": { "id": { "$ref": "#/$defs/id" }, "version": { "const": 1 } }
+    },
+    "bindingValues": {
+      "type": "object", "additionalProperties": false,
+      "required": ["transitionId", "runtimeFingerprint", "catalogHash", "lifecycleEpoch", "taskId", "revision", "currentPlanHash", "briefHash", "knowledgeRevision", "knowledgeHash", "gitHead", "guardedStepId", "correctiveDecisionEventId", "correctiveDecisionHash", "attemptCount", "remediationTailHash", "candidatePlanHash", "candidateStepSetHash", "planAuthorIdentityHash", "planValidationHash", "planValidatorIdentityHash", "riskAuditHash", "riskAuditorIdentityHash", "actorIdentityHash", "actorRole", "humanPrincipalIdentityHash", "capabilityId", "capabilityVersion"],
+      "properties": {
+        "transitionId": { "const": "task.plan.corrective-replan" },
+        "runtimeFingerprint": { "$ref": "#/$defs/hash" }, "catalogHash": { "$ref": "#/$defs/hash" },
+        "lifecycleEpoch": { "const": 2 }, "taskId": { "$ref": "#/$defs/id" },
+        "revision": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "currentPlanHash": { "$ref": "#/$defs/hash" },
+        "briefHash": { "$ref": "#/$defs/hash" }, "knowledgeRevision": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+        "knowledgeHash": { "$ref": "#/$defs/hash" }, "gitHead": { "type": "string", "pattern": "^(?:[a-f0-9]{40}|[a-f0-9]{64})$" },
+        "guardedStepId": { "$ref": "#/$defs/id" }, "correctiveDecisionEventId": { "$ref": "#/$defs/id" },
+        "correctiveDecisionHash": { "$ref": "#/$defs/hash" }, "attemptCount": { "type": "integer", "minimum": 2, "maximum": 9007199254740991 },
+        "remediationTailHash": { "$ref": "#/$defs/hash" }, "candidatePlanHash": { "$ref": "#/$defs/hash" },
+        "candidateStepSetHash": { "$ref": "#/$defs/hash" }, "planAuthorIdentityHash": { "$ref": "#/$defs/hash" },
+        "planValidationHash": { "$ref": "#/$defs/hash" }, "planValidatorIdentityHash": { "$ref": "#/$defs/hash" },
+        "riskAuditHash": { "$ref": "#/$defs/hash" }, "riskAuditorIdentityHash": { "$ref": "#/$defs/hash" },
+        "actorIdentityHash": { "$ref": "#/$defs/hash" }, "actorRole": { "enum": ["delivery-coordinator", "technical-planner"] },
+        "humanPrincipalIdentityHash": { "$ref": "#/$defs/hash" }, "capabilityId": { "const": "capability.task.corrective-replan" },
+        "capabilityVersion": { "const": 1 }
+      }
+    },
+    "correctiveReplanBindingV1": {
+      "type": "object", "additionalProperties": false,
+      "required": ["schemaVersion", "manifestRef", "manifestSha256", "values", "capability", "bindingSha256"],
+      "properties": {
+        "schemaVersion": { "const": 1 },
+        "manifestRef": { "$ref": "#/$defs/ref" }, "manifestSha256": { "$ref": "#/$defs/hash" },
+        "values": { "$ref": "#/$defs/bindingValues" },
+        "capability": {
+          "type": "object", "additionalProperties": false,
+          "required": ["id", "version", "issuer", "source", "scope", "delegation"],
+          "properties": {
+            "id": { "const": "capability.task.corrective-replan" }, "version": { "const": 1 },
+            "issuer": { "type": "object", "additionalProperties": false, "required": ["kind", "identityHash"], "properties": { "kind": { "const": "human" }, "identityHash": { "$ref": "#/$defs/hash" } } },
+            "source": { "const": "human-confirmation" },
+            "scope": { "type": "object", "additionalProperties": false, "required": ["transitionId", "taskId", "candidatePlanHash", "manifestSha256"], "properties": { "transitionId": { "const": "task.plan.corrective-replan" }, "taskId": { "$ref": "#/$defs/id" }, "candidatePlanHash": { "$ref": "#/$defs/hash" }, "manifestSha256": { "$ref": "#/$defs/hash" } } },
+            "delegation": { "const": "forbidden" }
+          }
+        },
+        "bindingSha256": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "validationSource": {
+      "type": "object", "additionalProperties": false,
+      "required": ["taskId", "revision", "currentPlanHash", "briefHash", "knowledgeRevision", "knowledgeHash", "gitHead", "guardedStepId", "correctiveDecisionHash", "remediationTailHash"],
+      "properties": { "taskId": { "$ref": "#/$defs/id" }, "revision": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "currentPlanHash": { "$ref": "#/$defs/hash" }, "briefHash": { "$ref": "#/$defs/hash" }, "knowledgeRevision": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "knowledgeHash": { "$ref": "#/$defs/hash" }, "gitHead": { "type": "string", "pattern": "^(?:[a-f0-9]{40}|[a-f0-9]{64})$" }, "guardedStepId": { "$ref": "#/$defs/id" }, "correctiveDecisionHash": { "$ref": "#/$defs/hash" }, "remediationTailHash": { "$ref": "#/$defs/hash" } }
+    },
+    "passedCoverage": { "type": "object", "additionalProperties": false, "required": ["sourceHash", "coverageHash", "passed"], "properties": { "sourceHash": { "$ref": "#/$defs/hash" }, "coverageHash": { "$ref": "#/$defs/hash" }, "passed": { "const": true } } },
+    "finding": { "type": "object", "additionalProperties": false, "required": ["findingId", "severity", "requirementRef", "evidenceHash"], "properties": { "findingId": { "$ref": "#/$defs/id" }, "severity": { "enum": ["low", "medium", "high"] }, "requirementRef": { "$ref": "#/$defs/id" }, "evidenceHash": { "$ref": "#/$defs/hash" } } },
+    "disposition": { "type": "object", "additionalProperties": false, "required": ["findingId", "decision", "evidenceHash"], "properties": { "findingId": { "$ref": "#/$defs/id" }, "decision": { "enum": ["resolved", "accepted-documented-limitation"] }, "evidenceHash": { "$ref": "#/$defs/hash" } } },
+    "planValidationAttestationV1": {
+      "type": "object", "additionalProperties": false,
+      "required": ["schemaVersion", "attestationId", "bindingSha256", "source", "candidate", "requirements", "acceptance", "architecture", "planAuthor", "plannerContext", "validator", "validatorContext", "freshContext", "passed", "findings", "dispositions", "validatedAtMs", "expiresAtMs", "attestationHash"],
+      "properties": {
+        "schemaVersion": { "const": 1 }, "attestationId": { "$ref": "#/$defs/id" }, "bindingSha256": { "$ref": "#/$defs/hash" }, "source": { "$ref": "#/$defs/validationSource" },
+        "candidate": { "type": "object", "additionalProperties": false, "required": ["planHash", "stepSetHash"], "properties": { "planHash": { "$ref": "#/$defs/hash" }, "stepSetHash": { "$ref": "#/$defs/hash" } } },
+        "requirements": { "$ref": "#/$defs/passedCoverage" }, "acceptance": { "$ref": "#/$defs/passedCoverage" },
+        "architecture": { "type": "object", "additionalProperties": false, "required": ["sourceHash", "compatibilityHash", "passed"], "properties": { "sourceHash": { "$ref": "#/$defs/hash" }, "compatibilityHash": { "$ref": "#/$defs/hash" }, "passed": { "const": true } } },
+        "planAuthor": { "type": "object", "additionalProperties": false, "required": ["identityHash"], "properties": { "identityHash": { "$ref": "#/$defs/hash" } } },
+        "plannerContext": { "$ref": "#/$defs/context" }, "validator": { "type": "object", "additionalProperties": false, "required": ["identityHash"], "properties": { "identityHash": { "$ref": "#/$defs/hash" } } }, "validatorContext": { "$ref": "#/$defs/context" },
+        "freshContext": { "type": "object", "additionalProperties": false, "required": ["sourceSnapshotHash", "plannerContextHash", "validatorContextHash", "passed"], "properties": { "sourceSnapshotHash": { "$ref": "#/$defs/hash" }, "plannerContextHash": { "$ref": "#/$defs/hash" }, "validatorContextHash": { "$ref": "#/$defs/hash" }, "passed": { "const": true } } },
+        "passed": { "const": true }, "findings": { "type": "array", "maxItems": 128, "items": { "$ref": "#/$defs/finding" } }, "dispositions": { "type": "array", "maxItems": 128, "items": { "$ref": "#/$defs/disposition" } },
+        "validatedAtMs": { "$ref": "#/$defs/time" }, "expiresAtMs": { "$ref": "#/$defs/time" }, "attestationHash": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "context": { "type": "object", "additionalProperties": false, "required": ["contextHash", "capturedAtMs"], "properties": { "contextHash": { "$ref": "#/$defs/hash" }, "capturedAtMs": { "$ref": "#/$defs/time" } } },
+    "humanConfirmationInputV1": { "type": "object", "additionalProperties": false, "required": ["kind", "version", "challengeId", "confirmationCode"], "properties": { "kind": { "const": "corrective-replan-human-confirmation" }, "version": { "const": 1 }, "challengeId": { "$ref": "#/$defs/id" }, "confirmationCode": { "type": "string", "pattern": "^[0-9]{6}$" } } },
+    "receiptValidation": { "type": "object", "additionalProperties": false, "required": ["attestationId", "attestationHash", "planValidationHash", "snapshotBindingHash", "planAuthorIdentityHash", "planValidatorIdentityHash", "findingsHash", "dispositionsHash", "validatedAtMs", "expiresAtMs"], "properties": { "attestationId": { "$ref": "#/$defs/id" }, "attestationHash": { "$ref": "#/$defs/hash" }, "planValidationHash": { "$ref": "#/$defs/hash" }, "snapshotBindingHash": { "$ref": "#/$defs/hash" }, "planAuthorIdentityHash": { "$ref": "#/$defs/hash" }, "planValidatorIdentityHash": { "$ref": "#/$defs/hash" }, "findingsHash": { "$ref": "#/$defs/hash" }, "dispositionsHash": { "$ref": "#/$defs/hash" }, "validatedAtMs": { "$ref": "#/$defs/time" }, "expiresAtMs": { "$ref": "#/$defs/time" } } },
+    "correctiveReplanReceiptV1": {
+      "type": "object", "additionalProperties": false,
+      "required": ["schemaVersion", "receiptId", "domain", "binding", "validation", "audit", "human", "supersession", "issuedAtMs", "expiresAtMs", "domainHash", "receiptHash"],
+      "properties": {
+        "schemaVersion": { "const": 1 }, "receiptId": { "$ref": "#/$defs/id" }, "domain": { "const": "codex-workflow/corrective-replan-receipt/v1" }, "binding": { "$ref": "#/$defs/correctiveReplanBindingV1" }, "validation": { "$ref": "#/$defs/receiptValidation" },
+        "audit": { "type": "object", "additionalProperties": false, "required": ["riskAuditHash", "riskAuditorIdentityHash"], "properties": { "riskAuditHash": { "$ref": "#/$defs/hash" }, "riskAuditorIdentityHash": { "$ref": "#/$defs/hash" } } },
+        "human": { "type": "object", "additionalProperties": false, "required": ["challengeId", "challengeHash", "humanPrincipalIdentityHash", "confirmedAtMs"], "properties": { "challengeId": { "$ref": "#/$defs/id" }, "challengeHash": { "$ref": "#/$defs/hash" }, "humanPrincipalIdentityHash": { "$ref": "#/$defs/hash" }, "confirmedAtMs": { "$ref": "#/$defs/time" } } },
+        "supersession": { "type": "object", "additionalProperties": false, "required": ["priorGrantHash", "disposition"], "properties": { "priorGrantHash": { "$ref": "#/$defs/hash" }, "disposition": { "const": "superseded" } } },
+        "issuedAtMs": { "$ref": "#/$defs/time" }, "expiresAtMs": { "$ref": "#/$defs/time" }, "domainHash": { "$ref": "#/$defs/hash" }, "receiptHash": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "storedPlanValidationEventV1": {
+      "type": "object", "additionalProperties": false,
+      "required": ["schemaVersion", "eventId", "previousEventHash", "taskId", "candidatePlanHash", "attestationId", "attestationHash", "receiptId", "receiptHash", "receiptDomainHash", "challengeId", "challengeHash", "recordedAt", "recordedAtMs", "eventHash"],
+      "properties": { "schemaVersion": { "const": 1 }, "eventId": { "$ref": "#/$defs/id" }, "previousEventHash": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/hash" }] }, "taskId": { "$ref": "#/$defs/id" }, "candidatePlanHash": { "$ref": "#/$defs/hash" }, "attestationId": { "$ref": "#/$defs/id" }, "attestationHash": { "$ref": "#/$defs/hash" }, "receiptId": { "$ref": "#/$defs/id" }, "receiptHash": { "$ref": "#/$defs/hash" }, "receiptDomainHash": { "$ref": "#/$defs/hash" }, "challengeId": { "$ref": "#/$defs/id" }, "challengeHash": { "$ref": "#/$defs/hash" }, "recordedAt": { "type": "string", "format": "date-time" }, "recordedAtMs": { "$ref": "#/$defs/time" }, "eventHash": { "$ref": "#/$defs/hash" } }
+    }
+  }
+}

package/schemas/corrective-replan-execution-event.private.schema.json

@@ -0,0 +1,53 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "codex-workflow://schemas/private/corrective-replan-execution-event/v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion", "kind", "eventId", "previousEventHash", "recordedAt", "taskId", "taskRevision",
+    "taskStatus", "transitionId", "executionKeyHash", "runtimeFingerprint", "catalogHash", "lifecycleEpoch",
+    "bindingManifest", "bindingSha256", "receiptId", "receiptHash", "receiptDomainHash", "candidatePlanHash",
+    "planValidationEventHash", "planRiskAuditEventHash", "actorIdentityHash", "humanPrincipalIdentityHash",
+    "priorGrantHash", "taskStateSha256", "planBytesSha256", "eventHash"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "kind": { "const": "corrective-replan-execution-recorded" },
+    "eventId": { "type": "string", "pattern": "^CRE-[a-f0-9]{64}$" },
+    "previousEventHash": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/hash" }] },
+    "recordedAt": { "type": "string", "format": "date-time" },
+    "taskId": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "taskRevision": { "type": "integer", "minimum": 2, "maximum": 9007199254740991 },
+    "taskStatus": { "const": "awaiting_execution_authorization" },
+    "transitionId": { "const": "task.plan.corrective-replan" },
+    "executionKeyHash": { "$ref": "#/$defs/hash" },
+    "runtimeFingerprint": { "$ref": "#/$defs/hash" },
+    "catalogHash": { "$ref": "#/$defs/hash" },
+    "lifecycleEpoch": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 },
+    "bindingManifest": {
+      "type": "object", "additionalProperties": false,
+      "required": ["id", "version", "manifestSha256"],
+      "properties": {
+        "id": { "const": "binding-manifest.corrective-replan.exact-v1" },
+        "version": { "const": 1 },
+        "manifestSha256": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "bindingSha256": { "$ref": "#/$defs/hash" },
+    "receiptId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "receiptHash": { "$ref": "#/$defs/hash" },
+    "receiptDomainHash": { "$ref": "#/$defs/hash" },
+    "candidatePlanHash": { "$ref": "#/$defs/hash" },
+    "planValidationEventHash": { "$ref": "#/$defs/hash" },
+    "planRiskAuditEventHash": { "$ref": "#/$defs/hash" },
+    "actorIdentityHash": { "$ref": "#/$defs/hash" },
+    "humanPrincipalIdentityHash": { "$ref": "#/$defs/hash" },
+    "priorGrantHash": { "$ref": "#/$defs/hash" },
+    "taskStateSha256": { "$ref": "#/$defs/hash" },
+    "planBytesSha256": { "$ref": "#/$defs/hash" },
+    "eventHash": { "$ref": "#/$defs/hash" }
+  },
+  "$defs": {
+    "hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+  }
+}

package/schemas/corrective-replan-public.schema.json

@@ -0,0 +1,142 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "codex-workflow://schemas/public/corrective-replan/v2",
+  "$defs": {
+    "hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "id": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "time": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "candidateV1": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["plan", "validation", "riskAudit", "authority"],
+      "properties": {
+        "plan": { "$ref": "https://codex-workflow.local/schemas/transition-payloads.schema.json#/$defs/taskPlanInput" },
+        "validation": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["validatorContextHash", "findings", "dispositions"],
+          "properties": {
+            "validatorContextHash": { "$ref": "#/$defs/hash" },
+            "findings": {
+              "type": "array",
+              "maxItems": 128,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["findingId", "severity", "requirementRef", "evidenceHash"],
+                "properties": {
+                  "findingId": { "$ref": "#/$defs/id" },
+                  "severity": { "enum": ["low", "medium", "high"] },
+                  "requirementRef": { "$ref": "#/$defs/id" },
+                  "evidenceHash": { "$ref": "#/$defs/hash" }
+                }
+              }
+            },
+            "dispositions": {
+              "type": "array",
+              "maxItems": 128,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["findingId", "decision", "evidenceHash"],
+                "properties": {
+                  "findingId": { "$ref": "#/$defs/id" },
+                  "decision": { "enum": ["resolved", "accepted-documented-limitation"] },
+                  "evidenceHash": { "$ref": "#/$defs/hash" }
+                }
+              }
+            }
+          }
+        },
+        "riskAudit": { "$ref": "https://codex-workflow.local/schemas/transition-payloads.schema.json#/$defs/planRiskAuditInput" },
+        "authority": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["planAuthorIdentityHash", "planValidatorIdentityHash", "riskAuditorIdentityHash", "actorIdentityHash", "actorRole", "humanPrincipalIdentityHash"],
+          "properties": {
+            "planAuthorIdentityHash": { "$ref": "#/$defs/hash" },
+            "planValidatorIdentityHash": { "$ref": "#/$defs/hash" },
+            "riskAuditorIdentityHash": { "$ref": "#/$defs/hash" },
+            "actorIdentityHash": { "$ref": "#/$defs/hash" },
+            "actorRole": { "enum": ["delivery-coordinator", "technical-planner"] },
+            "humanPrincipalIdentityHash": { "$ref": "#/$defs/hash" }
+          }
+        }
+      }
+    },
+    "humanGateV1": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "version", "taskId", "preparedAtMs", "expiresAtMs", "candidatePlanHash", "bindingSha256", "attestationId", "attestationHash", "challengeId", "runtimeFingerprint", "catalogHash", "lifecycleEpoch", "preparationSha256"],
+      "properties": {
+        "kind": { "const": "corrective-replan-human-gate" },
+        "version": { "const": 1 },
+        "taskId": { "$ref": "#/$defs/id" },
+        "preparedAtMs": { "$ref": "#/$defs/time" },
+        "expiresAtMs": { "$ref": "#/$defs/time" },
+        "candidatePlanHash": { "$ref": "#/$defs/hash" },
+        "bindingSha256": { "$ref": "#/$defs/hash" },
+        "attestationId": { "$ref": "#/$defs/id" },
+        "attestationHash": { "$ref": "#/$defs/hash" },
+        "challengeId": { "$ref": "#/$defs/id" },
+        "runtimeFingerprint": { "$ref": "#/$defs/hash" },
+        "catalogHash": { "$ref": "#/$defs/hash" },
+        "lifecycleEpoch": { "const": 2 },
+        "preparationSha256": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "humanGateResultV1": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "gate", "delivery"],
+      "properties": {
+        "kind": { "const": "corrective-replan-human-gate-result" },
+        "gate": { "$ref": "#/$defs/humanGateV1" },
+        "delivery": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "version", "challengeId", "confirmationCode", "expiresAtMs"],
+          "properties": {
+            "kind": { "const": "corrective-replan-human-challenge-delivery" },
+            "version": { "const": 1 },
+            "challengeId": { "$ref": "#/$defs/id" },
+            "confirmationCode": { "type": "string", "pattern": "^[0-9]{6}$" },
+            "expiresAtMs": { "$ref": "#/$defs/time" }
+          }
+        }
+      }
+    },
+    "credentialV1": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "version", "gate", "receipt", "planValidationEvent"],
+      "properties": {
+        "kind": { "const": "corrective-replan-public-credential" },
+        "version": { "const": 1 },
+        "gate": { "$ref": "#/$defs/humanGateV1" },
+        "receipt": { "$ref": "codex-workflow://schemas/private/corrective-replan-credentials/v1#/$defs/correctiveReplanReceiptV1" },
+        "planValidationEvent": { "$ref": "codex-workflow://schemas/private/corrective-replan-credentials/v1#/$defs/storedPlanValidationEventV1" }
+      }
+    },
+    "executionResultV1": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "disposition", "taskId", "transactionId", "resultSha256"],
+      "properties": {
+        "kind": { "const": "corrective-replan-execution-result" },
+        "disposition": { "enum": ["executed", "recovered", "replayed"] },
+        "taskId": { "$ref": "#/$defs/id" },
+        "transactionId": { "$ref": "#/$defs/hash" },
+        "resultSha256": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "responseV2": {
+      "oneOf": [
+        { "$ref": "#/$defs/humanGateResultV1" },
+        { "$ref": "#/$defs/credentialV1" },
+        { "$ref": "#/$defs/executionResultV1" }
+      ]
+    }
+  },
+  "$ref": "#/$defs/responseV2"
+}

package/schemas/corrective-replan-task-transaction.private.schema.json

@@ -0,0 +1,151 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "codex-workflow://schemas/private/corrective-replan-task-transaction/v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion", "kind", "transactionId", "projectId", "taskId", "transitionId",
+    "executionKeyHash", "runtimeFingerprint", "catalogHash", "lifecycleEpoch", "bindingManifest",
+    "bindingSha256", "receiptHash", "actorIdentityHash", "humanPrincipalIdentityHash", "admittedAt",
+    "intentSha256", "phase", "phaseRevision", "nextTargetOrdinal", "targets", "phaseHistory", "completedResult",
+    "updatedAt"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "kind": { "const": "corrective-replan-task-transaction" },
+    "transactionId": { "$ref": "#/$defs/hash" },
+    "projectId": { "type": "string", "pattern": "^[a-f0-9]{24}$" },
+    "taskId": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "transitionId": { "const": "task.plan.corrective-replan" },
+    "executionKeyHash": { "$ref": "#/$defs/hash" },
+    "runtimeFingerprint": { "$ref": "#/$defs/hash" },
+    "catalogHash": { "$ref": "#/$defs/hash" },
+    "lifecycleEpoch": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 },
+    "bindingManifest": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "version", "manifestSha256"],
+      "properties": {
+        "id": { "const": "binding-manifest.corrective-replan.exact-v1" },
+        "version": { "const": 1 },
+        "manifestSha256": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "bindingSha256": { "$ref": "#/$defs/hash" },
+    "receiptHash": { "$ref": "#/$defs/hash" },
+    "actorIdentityHash": { "$ref": "#/$defs/hash" },
+    "humanPrincipalIdentityHash": { "$ref": "#/$defs/hash" },
+    "admittedAt": { "$ref": "#/$defs/time" },
+    "intentSha256": { "$ref": "#/$defs/hash" },
+    "phase": { "enum": ["intent", "applying", "published-pending-readback", "completed"] },
+    "phaseRevision": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 },
+    "nextTargetOrdinal": { "type": "integer", "minimum": 0, "maximum": 5 },
+    "targets": {
+      "type": "array",
+      "minItems": 5,
+      "maxItems": 5,
+      "items": { "$ref": "#/$defs/target" }
+    },
+    "phaseHistory": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 64,
+      "items": { "$ref": "#/$defs/phaseEntry" }
+    },
+    "completedResult": {
+      "oneOf": [
+        { "type": "null" },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["resultSha256"],
+          "properties": { "resultSha256": { "$ref": "#/$defs/hash" } }
+        }
+      ]
+    },
+    "updatedAt": { "$ref": "#/$defs/time" }
+  },
+  "$defs": {
+    "hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "time": { "type": "string", "format": "date-time" },
+    "snapshot": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["exists", "contentSha256", "byteLength", "contentPath"],
+      "properties": {
+        "exists": { "type": "boolean" },
+        "contentSha256": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/hash" }] },
+        "byteLength": { "type": "integer", "minimum": 0, "maximum": 268435456 },
+        "contentPath": { "oneOf": [{ "type": "null" }, { "type": "string", "pattern": "^preimages/[0-4]\\.bin$" }] }
+      }
+    },
+    "postimage": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["contentSha256", "byteLength", "contentPath"],
+      "properties": {
+        "contentSha256": { "$ref": "#/$defs/hash" },
+        "byteLength": { "type": "integer", "minimum": 1, "maximum": 268435456 },
+        "contentPath": { "type": "string", "pattern": "^targets/[0-4]\\.bin$" }
+      }
+    },
+    "sidecarAnchors": {
+      "oneOf": [
+        { "type": "null" },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["previousEventHash", "resultEventHash", "previousLineCount", "resultLineCount"],
+          "properties": {
+            "previousEventHash": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/hash" }] },
+            "resultEventHash": { "$ref": "#/$defs/hash" },
+            "previousLineCount": { "type": "integer", "minimum": 0 },
+            "resultLineCount": { "type": "integer", "minimum": 1 }
+          }
+        }
+      ]
+    },
+    "taskCas": {
+      "oneOf": [
+        { "type": "null" },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["expectedRevision", "resultRevision"],
+          "properties": {
+            "expectedRevision": { "type": "integer", "minimum": 1 },
+            "resultRevision": { "type": "integer", "minimum": 2 }
+          }
+        }
+      ]
+    },
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["targetId", "ordinal", "relativePath", "writeMode", "preimage", "postimage", "sidecarAnchors", "taskCas"],
+      "properties": {
+        "targetId": { "enum": ["task-state", "plan", "plan-validation", "plan-risk-audit", "execution-evidence"] },
+        "ordinal": { "type": "integer", "minimum": 0, "maximum": 4 },
+        "relativePath": { "enum": ["state.json", "plan.md", "plan-validations.jsonl", "plan-risk-audits.jsonl", "corrective-replan-executions.jsonl"] },
+        "writeMode": { "enum": ["replace-exact", "append-exact"] },
+        "preimage": { "$ref": "#/$defs/snapshot" },
+        "postimage": { "$ref": "#/$defs/postimage" },
+        "sidecarAnchors": { "$ref": "#/$defs/sidecarAnchors" },
+        "taskCas": { "$ref": "#/$defs/taskCas" }
+      }
+    },
+    "phaseEntry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sequence", "phase", "nextTargetOrdinal", "recordedAt", "previousEntryHash", "entryHash"],
+      "properties": {
+        "sequence": { "type": "integer", "minimum": 0, "maximum": 63 },
+        "phase": { "enum": ["intent", "applying", "published-pending-readback", "completed"] },
+        "nextTargetOrdinal": { "type": "integer", "minimum": 0, "maximum": 5 },
+        "recordedAt": { "$ref": "#/$defs/time" },
+        "previousEntryHash": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/hash" }] },
+        "entryHash": { "$ref": "#/$defs/hash" }
+      }
+    }
+  }
+}