codex-workflow-v2 2.0.0-beta.1 → 2.0.0-beta.11

package/docs/autonomy-guardrails.md

@@ -48,6 +48,9 @@ If the current Plan Risk Audit marks a Step for strict review, `task step-comple
 creates the workflow-owned commit, but the Step stays non-terminal and `next` routes to
 `task step-review`. Canonical completion is recorded only after the strict review and the
 reviewer attestation both bind to that exact completion commit.
+When `next` advertises `task step-review`, pass the exact claimant or required actor as
+`--actor`; the isolated reviewer identity is created inside Core and must not be substituted
+into the mutation actor slot.
 
 Invalid or stale review sidecars fail closed. The workflow blocks downstream acceptance and
 normal continuation when review evidence is malformed, unverified, or commit-mismatched.
@@ -86,6 +89,27 @@ and only `split-required` or `stop-escalate` may be recorded. At the corrective
 `next` derives a distinct `agent:corrective-auditor:<task-id>` actor; selecting that actor is
 not a human approval, while auditor independence remains mandatory.
 
+### First-failure Plan-integrity recovery
+
+A mechanically impossible Plan check must not consume the second ordinary remediation attempt
+only to unlock corrective replan. After the first guarded `checks-failed` event, Core performs a
+read-only bounded assessment. `next` advertises `task plan-integrity-recover` only when all of the
+following are true:
+
+- the failed Step contains an exact root `npm run <script>` or `npm run-script <script>` check;
+- the named script is absent from the current root `package.json`;
+- `package.json` is outside the failed Step's `allowedWrites`;
+- exactly one ordinary `checks-failed` remediation event exists for the Step;
+- no corrective decision exists for its second-attempt binding;
+- every dirty file remains inside the Step's current `allowedWrites` and outside its
+  `forbiddenScope`.
+
+The recovery appends one hash-bound `replan-required` decision for attempt ordinal 2. It preserves
+the worktree and does not edit the Plan. A claimed C1 Task must present its current writer token and
+then follow `task corrective-yield`; the replacement Plan still requires the existing independent
+validation, Risk Audit, Human confirmation, journaled execution, readback, and renewed execution
+authorization. Other check failures retain the ordinary two-attempt breaker.
+
 ## Atomic context refresh
 
 When `next` returns top-level `action: task context-refresh` with an exact option, a
@@ -124,6 +148,38 @@ dedicated user-visible Task chat. A Task chat may use internal Worker and Review
 but only its delegate coordinator uses the grant. This prevents one long Milestone context
 from accumulating every implementation and review loop.
 
+The context boundary is literal: a Task chat is a new standalone Codex task created with an
+explicit Task-only prompt, never a fork or handoff of the Milestone chat. Its prompt contains the
+exact repository/Milestone/Task identifiers and fresh Task contract, but no parent transcript,
+sibling Task details, recovery narrative, reasoning trace, or bearer credential. Creation failure
+is a dispatch blocker, not permission to fork. The coordinator verifies one unique mapping from
+each Task ID to its thread and title before work begins.
+
+A host-generated `codex_delegation` envelope containing routing provenance such as
+`source_thread_id` is allowed; it must contain the TaskContextPacket as its complete input and must
+not carry completed parent turns. The coordinator reads the title back after creation and explicitly
+renames it when the supplied title was omitted or normalized.
+
+Chat titles are allocated atomically by the project registry; sidebar counts and `count + 1` are
+not valid numbering sources. Primary forms are:
+
+```text
+#NNN · M<NN> · Coord · <Milestone title> · <MS-ID>
+#NNN · M<NN>/T<NN> · Task · <Task title> · <TASK-ID>
+```
+
+The sequence and membership ordinal come first; the full ID prevents ambiguous identity. Exact
+readback is mandatory and only registry-supplied deterministic fallbacks may be used.
+
+Autonomy also requires active supervision. After just-in-time dispatch, the Milestone coordinator
+keeps a bounded `wait_threads` loop for the routed Task, inspects completion/attention, and verifies
+fresh Workflow `status -> next` before deciding what happened. It resumes a recoverable
+nonterminal Task in the same chat with `send_message_to_thread`; it does not shift ordinary
+implementation questions to the user. The coordinator may stop only for an exact human/semantic
+gate, exhausted infrastructure retry, unrecoverable integrity conflict, a user-requested
+checkpoint, or terminal Milestone closure. A finished chat is not proof of a terminal Task, and a
+child result does not automatically wake a coordinator turn that has already ended.
+
 ## Update boundary
 
 Before changing the exact npm version, run `update preflight`. A compatible update is safe
@@ -151,7 +207,11 @@ current `MSA-*` code. Without that option the ordinary later-message human gate
 ## Bounded Milestone autonomy and C1 handoff
 
 Initial assembly may materialize every linked Task before one complete `milestone plan-set`;
-the Milestone cannot execute until all reverse memberships are classified. Ordinary semantic
+the Milestone cannot execute until all reverse memberships are classified. During that exact
+window `next` returns non-executable `milestone initial-assembly` navigation with explicit
+linked-Task Discovery/materialization options; the closing Plan option appears after the first
+linked Task exists. A failed navigation call must not
+be bypassed with a direct Plan command. Ordinary semantic
 scope change remains explicit and human-only through `milestone scope-change-prepare` and
 `milestone scope-change-apply`.
 

package/docs/beta11-plan-integrity-recovery-brief.md

@@ -0,0 +1,38 @@
+# V2 beta.11 bounded Plan-integrity recovery
+
+## Problem
+
+A guarded Step may fail its first Core-owned completion because the approved Plan requires an
+exact root `npm run <script>` command, the script is absent, and the same Step cannot modify
+`package.json`. Re-advertising `task run` cannot succeed and consumes a second ordinary remediation
+attempt only to reach corrective replan.
+
+P01-A now rejects this contradiction before a fresh execution authorization when it is already
+provable at the selected evaluation HEAD. The beta.11 route remains necessary for pre-P01-A
+authorizations and contradictions that genuinely become observable only after execution starts.
+
+## Decision
+
+Add `task plan-integrity-recover` as a narrow explicit repair. Its read-side assessment proves one
+first `checks-failed` event, an absent root npm script, a manifest outside `allowedWrites`, and a
+worktree confined to the guarded Step. The mutation appends a hash-bound `replan-required`
+corrective decision for attempt ordinal 2. Existing C1 yield, corrective-replan Human gate,
+journal, recovery, readback, Plan validation, Risk Audit, and authorization supersession remain
+the only way to publish the replacement Plan.
+
+## Non-goals
+
+- No generic shell-command diagnosis.
+- No automatic Plan editing or inferred replacement command.
+- No `allowedWrites` expansion.
+- No second synthetic failure.
+- No bypass of C1 ownership, writer credentials, Human confirmation, independent validation, or
+  Risk Audit.
+- No recovery when dirty files escape the current Step boundary.
+
+## Required evidence
+
+The recovery event binds Task revision, Plan hash, failed remediation ID/hash, Step-definition
+hash, Git HEAD, root manifest hash, missing scripts, exact check commands, complete changed-file
+set, and a canonical conflict hash. Legacy corrective-decision events remain valid and retain the
+ordinary minimum of two failed attempts.