codex-workflow-v2 2.0.0-beta.1 → 2.0.0-beta.2

package/docs/autonomy-guardrails.md

@@ -48,6 +48,9 @@ If the current Plan Risk Audit marks a Step for strict review, `task step-comple
 creates the workflow-owned commit, but the Step stays non-terminal and `next` routes to
 `task step-review`. Canonical completion is recorded only after the strict review and the
 reviewer attestation both bind to that exact completion commit.
+When `next` advertises `task step-review`, pass the exact claimant or required actor as
+`--actor`; the isolated reviewer identity is created inside Core and must not be substituted
+into the mutation actor slot.
 
 Invalid or stale review sidecars fail closed. The workflow blocks downstream acceptance and
 normal continuation when review evidence is malformed, unverified, or commit-mismatched.
@@ -151,7 +154,11 @@ current `MSA-*` code. Without that option the ordinary later-message human gate
 ## Bounded Milestone autonomy and C1 handoff
 
 Initial assembly may materialize every linked Task before one complete `milestone plan-set`;
-the Milestone cannot execute until all reverse memberships are classified. Ordinary semantic
+the Milestone cannot execute until all reverse memberships are classified. During that exact
+window `next` returns non-executable `milestone initial-assembly` navigation with explicit
+linked-Task Discovery/materialization options; the closing Plan option appears after the first
+linked Task exists. A failed navigation call must not
+be bypassed with a direct Plan command. Ordinary semantic
 scope change remains explicit and human-only through `milestone scope-change-prepare` and
 `milestone scope-change-apply`.
 

package/docs/beta2-initial-assembly-navigation-brief.md

@@ -0,0 +1,616 @@
+# codex-workflow-v2 2.0.0-beta.2 — Initial Assembly Navigation Stabilization
+
+Status: implementation and release verification complete; independently audited and recommended for release
+Date: 2026-08-15
+Base: published `v2.0.0-beta.1` (`2062c636756560c879b8645b67800d55792be576`)
+Development rule: Workflow V2 is not used to plan, authorize, implement, test, or audit this release.
+
+## Objective
+
+Produce one unreleased `2.0.0-beta.2` candidate that makes Milestone initial assembly a truthful,
+recoverable lifecycle state. A successful linked-Task materialization must never create a state that
+`status` or `next` rejects merely because the complete initial Milestone membership Plan has not yet
+been recorded.
+
+The candidate also makes release evidence fail closed: a real-agent run is invalid when the agent
+continues with a different lifecycle mutation after a failed `status` or `next`.
+
+No tag, push, npm publication, or live `signal_v4` mutation is authorized by this Brief.
+
+## Confirmed defects
+
+### WF-STABLE-009 — initial assembly creates a state rejected by repository navigation
+
+- Status: Confirmed
+- Severity: Critical / release-blocking
+- Area: Milestone initial assembly, membership integrity, `status`, `next`
+- Reproduction:
+  1. materialize a planning Milestone without an initial Plan;
+  2. materialize the first linked planning Task;
+  3. call repository `status` or `next`;
+  4. Core returns `MILESTONE_SCOPE_INCOMPLETE` for the intentionally repairable reverse membership.
+- Contradiction:
+  - `materializeTask` explicitly permits the bounded reverse-membership gap;
+  - documentation says all linked Tasks may be materialized before one complete `milestone plan-set`;
+  - strict repository navigation rejects the same intermediate state.
+- Exact downstream evidence:
+  - live read-only project: `/Users/home-pc/htdocs/projects/signal_v4`;
+  - new Milestone: `MS-01M02SC6XTM49P0427DXE3D3GD`, planning revision 1;
+  - first linked Task: `TASK-01M02SE0R0TNT4Z89P0KFACHY8`, planning revision 1;
+  - old Milestone `MS-01M00VYB46R56Z563WYCPDEVEA` is cancelled revision 4 and remains historical.
+
+### WF-STABLE-010 — release E2E accepted a lifecycle bypass after failed `next`
+
+- Status: Confirmed
+- Severity: Critical / release-process invalidation
+- Area: real-agent validation, transcript audit, release recommendation
+- Evidence:
+  - beta.1 real-agent E2E received `MILESTONE_SCOPE_INCOMPLETE` from both `status` and `next`
+    immediately after Task materialization;
+  - the agent described the gap as expected and continued directly to `milestone plan-set`;
+  - the beta.1 Brief declared an E2E invalid if it bypassed `next`;
+  - the final audit nevertheless reported no material requirement gap.
+- Consequence: beta.1 release recommendation is withdrawn for `signal_v4` Milestone reincarnation.
+
+### WF-STABLE-011 — pending Task review navigation advertised the wrong executable route
+
+- Status: Confirmed during the first beta.2 real-agent diagnostic run
+- Severity: High / release-blocking until replayed
+- Area: truthful `next`, independent Task review, transcript validation
+- Reproduction:
+  1. submit a Task whose final independent review is pending;
+  2. call repository `next`;
+  3. Core advertises low-level `task review-record`;
+  4. the packaged autonomous route is the compound `task review-launch`, which launches the
+     isolated reviewer and records its bound result in one command.
+- Required correction:
+  - advertise exact `task review-launch` for pending or unverified Task review;
+  - retain `task result-set` after a passed review;
+  - keep the C1 claimant as the lifecycle `--actor` for strict Step review while Core launches the
+    independent reviewer internally;
+  - rerun the full real-agent Milestone on a rebuilt candidate rather than altering the diagnostic
+    transcript.
+
+### WF-STABLE-012 — Git-writing Core transitions do not advertise their permission boundary
+
+- Status: Confirmed during the rebuilt beta.2 real-agent run
+- Severity: High / autonomy and evidence blocker
+- Area: truthful `next`, Codex sandbox permissions, Core-owned Git transitions
+- Reproduction:
+  1. run a guarded Step in a disposable Git repository under the normal Codex sandbox;
+  2. follow `next.action = task step-complete` literally;
+  3. Core reaches its owned `git add`, but the first invocation is denied while creating
+     `.git/index.lock`;
+  4. the same semantic transition succeeds only after the coordinator retries with bounded Git
+     metadata permission.
+- Required correction:
+  - `next` must expose a machine-readable permission policy before every Core transition that will
+    write Git metadata (`task start` for local ownership, `task step-complete`, local `task merge`,
+    and local `task sync-base`);
+  - the gateway must request that bounded permission before the first invocation, not learn it from
+    a failed mutation;
+  - do not expose the policy for read-only transitions or external merge confirmation;
+  - a Milestone grant is passed only when the exact current `delegatedApprovalOptions` offers it for
+    that transition; ordinary C1 handoff preparation is not a delegated approval transition.
+
+### WF-STABLE-013 — strict reviewer subprocess can remain indeterminate or fail before launch
+
+- Status: Confirmed during `real-agent-release-final-6`
+- Severity: Critical / release-blocking
+- Reproduction A: two exact `task step-review` calls at Task revision `6` each launched an isolated
+  `codex exec`, returned no terminal mutation result, and remained alive concurrently for more than
+  five minutes.
+- Reproduction B: `real-agent-release-final-10` proved that placing the global
+  `--ask-for-approval never` option after `exec` is rejected by the real Codex CLI with status `2`.
+  Two ordinary remediation attempts were therefore consumed by launch failures before the run was
+  stopped; final-10 is retained as immutable diagnostic evidence.
+- Required correction:
+  - make reviewer approval policy explicitly non-interactive so the intentional denied-write probe
+    cannot wait for human approval;
+  - place global CLI options before the `exec` subcommand and regression-test their exact order;
+  - enforce a host-side execution deadline and return terminal fail-closed `unverified` evidence on
+    timeout/process failure;
+  - never allow an unbounded reviewer subprocess to keep an exact lifecycle mutation indeterminate.
+
+### WF-STABLE-014 — transcript validation ignores unterminated mutation invocations
+
+- Status: Confirmed during `real-agent-release-final-6`
+- Severity: Critical / release-process invalidation
+- Reproduction: the validator returned PASS for a transcript containing `task step-review`
+  invocation commentary with no terminal mutation event, a subsequent status/next, and duplicate
+  re-entry at the unchanged revision.
+- Required correction:
+  - pair every harness lifecycle invocation with its exact terminal navigation, mutation, or
+    read-only observation result;
+  - fail closed when handshake, doctor, Knowledge status, autonomy preparation, or another
+    read-only observation fails or remains indeterminate;
+  - reject EOF, another command, or duplicate re-entry while an invocation is unresolved;
+  - retain immutable failed-run evidence and prove the old final-6 transcript is now rejected.
+
+### WF-STABLE-015 — Task Plan navigation omits exact required ID inclusion
+
+- Status: Confirmed during `real-agent-release-final-11`
+- Severity: High / release-blocking autonomy defect
+- Reproduction: after clean initial assembly and delegated Milestone authorization, `next` returned
+  only `task plan-set` for the required Task. The Delegate produced semantic acceptance statements
+  but omitted exact Task acceptance ID `AC-001`; Core correctly rejected the Plan before writing.
+- Required correction:
+  - expose the exact Task requirement and acceptance IDs in the same `next` response that advertises
+    `task plan-set`;
+  - bind that contract to the current Brief hash and active Knowledge Map revision/hash;
+  - keep the existing exact-inclusion validation fail closed;
+  - synchronize the gateway so the Technical Planner consumes this machine-readable contract.
+
+### WF-STABLE-016 — Git-completion navigation omits its required writer lease input
+
+- Status: Confirmed during `real-agent-release-final-12`
+- Severity: High / release-blocking autonomy defect
+- Reproduction: the Delegate completed implementation, strict Step review, Task review, result, and
+  delegated Task acceptance. `next` then advertised `task merge` and its Git mutation policy, but
+  did not advertise the mandatory `--writer-token`; the first merge call was rejected before write.
+- Required correction:
+  - expose a machine-readable `writerTokenContract` on every navigation action that requires the
+    active writer lease: `task step-complete`, `task submit`, `task merge`, and `task merge-confirm`;
+  - identify the exact option and source without exposing, logging, or persisting the token value;
+  - omit the contract from adjacent transitions that do not consume the lease;
+  - synchronize the gateway so the contract is consumed before the first transition call.
+
+### WF-STABLE-017 — subcommand help is dispatched as a lifecycle mutation
+
+- Status: Confirmed during `real-agent-release-final-16`
+- Severity: High / release-blocking autonomy defect
+- Reproduction: after successful real-agent initial assembly and owner autonomy grant, the Delegate
+  requested standard command discovery with `milestone authorize --help`. The CLI entered the
+  mutation dispatcher, required `--id`, and returned `INVALID_ARGUMENT`, invalidating the clean run.
+- Required correction:
+  - intercept `--help` before repository/state construction and lifecycle dispatch;
+  - support top-level, noun-level, and action-level help with exit `0`;
+  - return a machine-readable `readOnly` help response and exact option contracts where declared;
+  - never require lifecycle mutation inputs or write workflow state in help mode;
+  - treat help as a read-only observation in real-agent evidence, not a mutation attempt;
+  - require a fresh successful `next` after help and before any lifecycle mutation.
+
+### WF-STABLE-018 — credential-bearing receipts are buried after large Task payloads
+
+- Status: Confirmed during `real-agent-release-final-18`
+- Severity: High / release-blocking autonomy defect
+- Reproduction: the Delegate completed initial assembly, the owner grant, Milestone authorization,
+  Task planning/authorization, and C1 handoff preparation with zero rejected lifecycle calls. The
+  one-time claim token was present exactly once in the full successful CLI JSON, but only after
+  roughly 5 KiB of Task/event data. The Delegate incorrectly concluded that the harness had lost
+  the token and stopped rather than issuing `task claim`.
+- Required correction:
+  - emit claim and writer-lease credentials in a compact first field of the successful CLI value;
+  - attach explicit action, option, source, target/owner, and sensitivity metadata;
+  - retain the existing Task, event, bundle, lease, and envelope information without duplicating
+    the credential in those large structures;
+  - never re-expose either credential through `status`, `next`, or `task handoff-show`;
+  - synchronize the gateway so a Delegate consumes the first receipt before interpreting the
+    remaining payload.
+
+### WF-STABLE-019 — claimed Task run requires a lease that navigation says will be issued later
+
+- Status: Confirmed during `real-agent-release-final-19`
+- Severity: High / release-blocking autonomy defect
+- Reproduction: credential-first C1 handoff and `task claim` both succeeded, followed by a safe
+  stop before bounded Core Git permission. After resume, `task start` succeeded, but `next`
+  advertised `task run` without a writer-token contract. Core then rejected that exact run because
+  claimed C1 posture already required the lease created by `task claim`; the existing compact
+  receipt was available only after a successful run and therefore could not satisfy its own
+  precondition.
+- Required correction:
+  - `task claim` emits the newly bound lease as a first-field `writerLeaseReceipt` exactly once;
+  - its receipt declares `task run --writer-token` as the next consuming action;
+  - `next` exposes `writerTokenContract` for `task run` only when claimed C1 posture requires it;
+  - ordinary unclaimed `task run` remains able to acquire its first lease without a token;
+  - `task run` continues to return the refreshed receipt for later lease-bound transitions.
+
+### WF-STABLE-020 — transcript validator rejects safe top-level help
+
+- Status: Confirmed during `real-agent-release-final-20`
+- Severity: High / release-blocking evidence defect
+- Reproduction: phase 1 completed all seven-Task assembly mutations, the complete Milestone Plan,
+  and autonomy preparation with zero rejected lifecycle calls. The trusted harness recorded one
+  successful top-level `workflow --help`, immediately followed by fresh successful `next`.
+  Packaged transcript validation rejected the otherwise clean evidence as an unsupported read-only
+  observation.
+- Required correction:
+  - recognize successful top-level `--help` as the same safe read-only observation class as noun
+    and action help;
+  - require a fresh successful `next` before any subsequent mutation;
+  - reject failed top-level help, lifecycle mutation inputs embedded in help, and missing fresh
+    navigation without weakening invocation pairing or failure latching.
+
+## Required semantics
+
+### Initial assembly predicate
+
+A reverse membership may be treated as repairable only when all of the following hold:
+
+1. the Milestone is `planning`;
+2. `planHash` is null;
+3. `membershipRevision` is `0`;
+4. current memberships and `taskIds` are empty;
+5. no Milestone execution authorization exists;
+6. every reverse-orphan Task points to this Milestone;
+7. every reverse-orphan Task is an unstarted planning Task with no workspace, branch, Plan,
+   execution authorization, started Step, result, evidence, or merge commit;
+8. no scope-change transaction, completed scope-change event, autonomy contract, or
+   autonomy-evolution evidence exists.
+
+The exception closes permanently after the first complete `milestone plan-set`, after any linked
+Task starts, or after the Milestone leaves initial planning. It must not be reopened by Plan changes,
+revisions, cancellation, recovery, or manual-looking legacy shapes.
+
+### Truthful navigation
+
+During the exact initial-assembly predicate:
+
+- `status` succeeds and identifies the repairable assembly state;
+- `next` does not report corruption or require a semantic scope change;
+- `next` explicitly permits continued linked-Task Discovery/materialization and also identifies
+  complete initial `milestone plan-set` as the closing transition after at least one linked Task
+  exists; an empty Milestone must not advertise a Plan transition that Core rejects;
+- no Task execution, handoff, start, authorization, or Milestone autonomy grant is actionable before
+  the complete initial Plan classifies every reverse membership;
+- the response must not imply that the first linked Task is sufficient when the coordinator has
+  declared more raw Task inputs.
+
+Outside that predicate, the existing reverse-membership detector remains strict.
+
+### Failure and durability
+
+- Every validation must happen before the first canonical write.
+- Rejected calls are non-mutating.
+- Existing project-transaction recovery remains authoritative.
+- No recovery path may edit historical events or silently classify a Task.
+
+## Systemic transition invariant
+
+For every public lifecycle mutation covered by deterministic tests:
+
+1. a successful mutation produces a state accepted by `status` and `next`;
+2. an exact action advertised by `next` either succeeds against the bound revision/state or returns a
+   documented non-mutating concurrency/precondition conflict;
+3. a command must never intentionally create a state that only a direct command bypass can repair;
+4. terminal/corrective decisions continue to outrank Knowledge navigation and execution;
+5. tests cover the pair `mutation -> status -> next`, not only the mutation in isolation.
+
+The audit must review at least initial assembly, context refresh, corrective decisions,
+split-required replacement, cancellation, membership evolution, handoff/start, Step review and
+remediation, merge, validation, and final acceptance.
+
+## Deterministic acceptance
+
+1. Fresh Milestone: materialize seven linked Tasks; after every Task call terminal `status` and
+   then terminal `next`, never concurrently;
+   record one complete initial Plan; no scope-change approval is used.
+2. Adopted alpha.6/schema-2 project: repeat the same seven-Task sequence with an active adoption
+   posture and verify identical navigation.
+3. Exact current `signal_v4` snapshot replay: cancelled historical Milestone plus one partially
+   assembled new Milestone/Task continues through Tasks 2–7 without rewriting existing state.
+4. After initial Plan, a new unclassified live Task still yields `MILESTONE_SCOPE_INCOMPLETE`.
+5. Started/workspace-owned/planned/authorized orphan Tasks never qualify for the exception.
+6. Semantic Plan change, terminal Milestone state, stale revision, damaged plan agreement, corrupt
+   adoption posture, and incomplete transactions remain blocked before writes.
+7. Repeated `status`/`next` during assembly is idempotent and non-mutating.
+8. Existing beta.1 regressions remain green.
+9. Pending Task final review advertises exact `task review-launch`; the compound transition is
+   accepted by the transcript validator without an alias or direct-command bypass.
+10. Every Core-owned Git-writing action advertises its bounded permission requirement before the
+    first invocation; read-only and external-confirm actions do not.
+
+## Real-agent acceptance
+
+Use an isolated disposable project and copied, non-authoritative `signal_v4` workflow evidence.
+The real Delegate must:
+
+1. perform the beta.1/beta.2 handshake and read-only preflight;
+2. start from the exact partial reincarnation shape (new planning Milestone plus one linked planning
+   Task, no Plan);
+3. materialize the remaining six Tasks from the retained raw Brief/Plan inputs;
+4. call `status` to terminal completion and only then top-level `next` after every lifecycle
+   boundary; never launch the checkpoint pair concurrently;
+5. create one complete seven-membership Milestone Plan; for this disposable lifecycle-only run,
+   exactly one thin guarded fixture Task is `required` and the other six memberships are `waived`
+   with explicit reasons because implementing `signal_v4` product scope outside `signal_v4` is
+   forbidden; the deterministic replay separately proves seven `required` memberships;
+6. create Task Plans and risk-audit evidence without product-scope expansion;
+7. obtain one exact Milestone autonomy grant at the intended human boundary;
+8. complete at least one guarded Task and complete the disposable Milestone through final accept;
+9. finish with repository `idle`.
+
+The E2E is invalid if any lifecycle `status` or `next` fails and the agent then performs a different
+lifecycle mutation, or if a second checkpoint invocation starts before the first emits its terminal
+result. A syntax-only, pre-write CLI error may be retried only with the same semantic operation and
+unchanged expected revision.
+
+Raw Codex JSONL is diagnostic evidence, but credential-bearing CLI arguments and receipt payloads
+must be removed by the streaming evidence sanitizer before any session line is written to disk.
+Post-run evidence inspection must report zero unredacted `claimToken`, `writerToken`, generic
+receipt `token`, `--claim-token`, or `--writer-token` values. The lifecycle harness log remains the
+authoritative semantic transcript and never records credential values.
+
+Every claimed-C1 mutation that validates the claimant's active lease must expose
+`writerTokenContract` from `next`, including strict `task step-review` and final
+`task review-launch`. The contract is conditional on claimed posture; unclaimed review navigation
+remains token-free.
+
+The release-candidate E2E must also avoid preventable first-attempt failures: it uses
+`--expected-revision`, passes a delegation grant only when the exact current `next` offers it for
+that transition, and requests the advertised bounded Git permission before each Core-owned
+Git-writing transition. Earlier completed runs containing harness or permission retries remain
+immutable diagnostic evidence, not final release evidence.
+
+## Transcript validator
+
+Release evidence must include an automated validator over an append-only lifecycle event log emitted
+by the isolated harness wrapper around every project-local Workflow CLI invocation. The log must
+start with a schema/run/provenance record, capture the semantic command, bound revision, JSON result,
+and failure classification, and must not contain credentials. The final audit cross-checks the raw
+Codex session transcript against this log so a direct unwrapped lifecycle invocation invalidates the
+run. The validator fails when:
+
+- a failed `status`/`next` is followed by a different lifecycle mutation;
+- a mutation is not permitted by the last successful navigation response or explicit initial
+  assembly option;
+- a failed transition is described as expected and bypassed;
+- an invocation begins but does not produce its exact terminal result before another command or EOF;
+- the same mutation is re-entered while its prior process/result is indeterminate;
+- a non-retryable mutation fails, or a syntax-only failed mutation is left without its exact
+  successful same-operation/same-revision retry;
+- workflow-state is edited outside the package CLI/Core;
+- a historical ID, grant, lease, branch, or authorization is reused as current authority;
+- the run omits required `status`/`next` checkpoints.
+
+A hand-authored or agent-authored normalized log is not release evidence; deterministic unit fixtures
+may be synthetic, but the real E2E log must be produced by the harness wrapper.
+
+## Live project boundary and recovery recommendation
+
+`signal_v4`, its external workflow-state, current Milestones, Tasks, chats, branches, and product
+files are read-only during candidate development. After release approval, the intended recovery is
+to continue existing Milestone `MS-01M02SC6XTM49P0427DXE3D3GD`, retain first Task
+`TASK-01M02SE0R0TNT4Z89P0KFACHY8`, and materialize Tasks 2–7. A third reincarnation is not required
+unless replay proves the partial state semantically corrupt.
+
+## Implementation handoff contract — WF-STABLE-009
+
+This section is the formal implementation subtask artifact. It is intentionally embedded in the
+single beta.2 Brief so no competing task source of truth is created.
+
+### Inputs
+
+- Published beta.1 source at commit `2062c636756560c879b8645b67800d55792be576`.
+- Confirmed production contradiction between `materializeTask`, `readMilestoneForScopeChange`,
+  repository `status`/`next`, `listMilestonesCurrent`, and `assertMilestoneMembershipIntegrity`.
+- Required semantics, systemic invariant, deterministic acceptance, and live-project boundary in
+  this Brief.
+- Existing canonical Milestone/Task contracts and state schema must remain compatible.
+
+### Expected outputs
+
+- Production implementation in `src/workflow.ts`, `src/alpha6/milestone.ts`, and only directly
+  required `src/` contract/type files.
+- One exported or internally reusable exact initial-assembly assessment; do not duplicate the
+  predicate independently across readers and navigation.
+- `status` accepts an exact repairable initial assembly without weakening ordinary integrity.
+- `next` returns an explicit Milestone initial-assembly response containing:
+  - current Milestone ID/revision;
+  - current linked unclassified Task IDs;
+  - `executionAvailable: false`;
+  - an explicit option permitting another linked Task Discovery/materialization;
+  - after at least one linked Task exists, an explicit closing option for one complete initial
+    `milestone plan-set`.
+- Existing persisted schema remains unchanged unless an additive response-only contract type is
+  required.
+- Gateway handshake retains `milestone-initial-assembly-v1` for compatibility and adds
+  `milestone-initial-assembly-navigation-v2` for the truthful beta.2 contract.
+- Focused typecheck/build evidence.
+
+### Forbidden scope
+
+- Tests, package version, release scripts, Brief/register, `signal_v4`, external workflow-state,
+  tags, push, publication, or unrelated refactors.
+- Broadly disabling reverse-membership integrity.
+- Inferring planned Task count, silently classifying Tasks, creating membership records before
+  `milestone plan-set`, or allowing Task execution during assembly.
+- Using Workflow V2 for this implementation.
+
+### Dependencies
+
+- The test owner independently owns deterministic/replay/transcript tests and may consume the
+  additive `next` response shape above.
+- Root coordinator owns package integration, full validation, E2E, versioning, and release evidence.
+- Existing adoption posture and transaction recovery remain authoritative dependencies; the change
+  must compose with both rather than bypass them.
+
+### Validation checkpoints
+
+| ID | Goal | Input | Expected result | Pass criteria | Fail criteria | Owner | Result artifact |
+|---|---|---|---|---|---|---|---|
+| IMP-1 | Centralize the safe exception | Planning Milestone plus only safe unstarted reverse-orphan Tasks | One exact initial-assembly assessment | All Brief predicate clauses checked once and reused | Different readers implement divergent predicates | State-machine implementer | Source diff |
+| IMP-2 | Preserve strict integrity | Planned/authorized/active/terminal Milestone or unsafe orphan | Existing strict error before writes | `MILESTONE_SCOPE_INCOMPLETE` or stricter canonical error remains | Any unsafe state is accepted as assembly | State-machine implementer | Focused tests/typecheck |
+| IMP-3 | Make reads truthful | Exact safe initial assembly | `status` succeeds without persistence | Repeated reads do not change revisions/artifacts/events | Read fails or mutates state | State-machine implementer | Focused test handoff |
+| IMP-4 | Make navigation truthful | Exact safe initial assembly | Explicit assembly action/options; execution unavailable | Response permits continued materialization and closing plan-set | Response only says plan-set, routes Task execution, or reports corruption | State-machine implementer | Response fixture/test handoff |
+| IMP-5 | Preserve plan closure | Complete initial Plan | Normal post-Plan routing | Initial exception no longer applies | Later orphan is silently tolerated | State-machine implementer | Existing reverse-orphan regression |
+| IMP-6 | Preserve compatibility | TypeScript contracts and compiled CLI | Typecheck/build pass | No persisted schema/protocol break | Schema drift or downstream compile failure | State-machine implementer | Command output summary |
+
+## Release gates
+
+Beta.2 may be recommended only when:
+
+- typecheck, build, full sequential tests, packaging, plugin, downstream smoke, release check, and
+  root regression pass;
+- deterministic exact-state replay passes;
+- real-agent seven-Task E2E reaches final acceptance and repository idle;
+- transcript validation passes independently;
+- an independent source/evidence audit has no unresolved material finding;
+- the diff contains no `signal_v4` product or live workflow-state mutation.
+
+Do not create a tag, push, or publish without separate user confirmation.
+
+## Implementation and validation evidence
+
+### Candidate result
+
+- Candidate version: `2.0.0-beta.2`.
+- Source base: published beta.1 commit `2062c636756560c879b8645b67800d55792be576`.
+- `WF-STABLE-009`: closed by one centralized, fail-closed initial-assembly assessment shared by
+  Milestone integrity reads and repository navigation. Exact safe assembly is visible through
+  `status`/`next`; execution remains unavailable; every unsafe reverse-membership shape retains the
+  canonical integrity error.
+- `WF-STABLE-010`: candidate implementation adds an append-only harness transcript and fail-closed validator. The
+  validator rejects navigation bypasses, unadvertised mutations, missing checkpoints, malformed
+  provenance, and different-operation continuation after a failed read.
+- `WF-STABLE-011`: candidate implementation advertises `task review-launch` for pending or unverified final Task
+  review, while preserving `task result-set` after a passed review and the existing independent
+  reviewer boundary.
+- `WF-STABLE-012`: candidate implementation adds machine-readable `gitMutationPolicy` navigation for local `task start`,
+  `task step-complete`, `task merge`, and `task sync-base`, plus gateway rules that request the
+  bounded Git permission before the first mutation and pass delegation grants only when the exact
+  current navigation response offers them.
+- `WF-STABLE-013`: candidate implementation makes strict reviewers explicitly non-interactive,
+  places the approval option in the real CLI's global position, and bounds execution by a host-side
+  deadline; timeout/process failure produces terminal unverified evidence.
+- `WF-STABLE-014`: candidate implementation pairs harness invocations with terminal navigation,
+  mutation, and read-only observation results and rejects incomplete, failed, stranded, or
+  re-entered invocations.
+- `WF-STABLE-015`: candidate implementation adds `taskPlanContract` to every Plan-setting
+  navigation with exact required requirement/acceptance IDs, current risks, Brief hash, and current Knowledge Map
+  binding; Core's exact inclusion validation remains unchanged.
+- `WF-STABLE-016`: candidate implementation adds `writerTokenContract` to every transition that
+  consumes the active writer lease, while keeping the credential itself secret and omitting the
+  contract from non-lease transitions.
+- `WF-STABLE-017`: candidate implementation intercepts top-level, noun, and action `--help` before
+  lifecycle dispatch, returns read-only machine-readable usage, and provides exact option contracts
+  for the critical autonomous Task/Milestone transitions. The transcript validator accepts only
+  safe trusted-harness help observations and requires a fresh successful `next` before mutation.
+- `WF-STABLE-018`: candidate implementation emits a credential-first `credentialHandoff` receipt
+  from `task handoff-prepare` and a credential-first `writerLeaseReceipt` from `task run`. Each
+  secret occurs exactly once in stdout; large compatibility payloads remain available without a
+  duplicate credential, and read-only follow-up commands do not expose it.
+- `WF-STABLE-019`: candidate implementation emits a credential-first `writerLeaseReceipt` from
+  `task claim` and adds a claimed-posture-only `writerTokenContract` to `task run` navigation. The
+  successful run refreshes the same receipt for Step completion; ordinary unclaimed runs remain
+  token-free on their first call.
+- `WF-STABLE-020`: candidate transcript validation accepts trusted successful top-level `--help`
+  as read-only while preserving failed-help rejection, mutation-input rejection, and the mandatory
+  fresh-`next` barrier before lifecycle mutation.
+
+### Deterministic checks
+
+- Post-WF-STABLE-020 sequential validation on Node `24.17.0`: `149/149` passed in
+  `641672 ms`. The current validator also accepts the immutable `final-20` phase-1 transcript as
+  `132/132`, while its packaged pre-fix validator rejects the same evidence.
+- Rebuilt package dry-pack, plugin validation, release check, downstream install smoke, root
+  workflow regression, and `git diff --check`: passed. Dry-pack shasum:
+  `d5ca042dd1bb90e52c6d5313dafa6730e5d3795f`.
+- Post-WF-STABLE-023 sequential validation on Node `24.17.0`: `153/153` passed in
+  `644031 ms`, including claimed `task step-review` and `task review-launch` writer-token
+  navigation. Plugin validation, release check, isolated-cache dry-pack, downstream install smoke,
+  root workflow regression, and `git diff --check` passed. E2E-tested pre-evidence-doc tarball SHA-1:
+  `4519d05b31fa08b39f5f5f9f9e2b9f0e13941935`.
+- Post-WF-STABLE-019 sequential validation on Node `24.17.0`: `149/149` passed in
+  `610434 ms`, including claim receipt, claimed-run navigation, and refreshed run receipt.
+- Rebuilt package dry-pack, plugin validation, release check, downstream install smoke, root
+  workflow regression, and `git diff --check`: passed. Dry-pack shasum:
+  `547166399294368c89ae7c581192cf81a6391638`.
+- Post-WF-STABLE-018 sequential validation on Node `24.17.0`: `147/147` passed in
+  `594990 ms`, including credential-first CLI integration coverage and the complete lifecycle
+  regression set.
+- Rebuilt package dry-pack (isolated npm cache), plugin validation, release check, downstream
+  install smoke, root workflow regression, and `git diff --check`: passed. Rebuilt package shasum:
+  `04571ca2f51f48661c984e8d16a2e32c336efe64`.
+
+- Post-WF-STABLE-015 sequential validation on Node `24.17.0`: `141/141` passed.
+- Rebuilt package archive, plugin validation, release check, downstream smoke, root workflow
+  regression, and `git diff --check`: passed.
+
+- Pre-WF-STABLE-013/014 full sequential package validation: `135/135` passed.
+- Focused strict-reviewer and transcript-validator suites after the final WF-STABLE-013/014
+  extension: `15/15` passed.
+- Final focused strict-reviewer validation after correcting the real CLI global-option order:
+  `4/4` passed.
+- Final full sequential package validation on Node `24.17.0`: `139/139` passed, including the
+  reviewer ordering regression and lifecycle transcript validator.
+- Final package/release gates passed: `pack:check`, `plugin:check`, `release:check`,
+  `smoke:downstream`, and the root workflow regression. The first dry-pack attempt encountered
+  pre-existing permission damage in the global npm cache; the isolated-cache rerun passed and did
+  not require changing user-directory ownership.
+- Exact copied `signal_v4` snapshot replay: passed without writing to the live project or its live
+  external workflow-state. Replay evidence:
+  `test-runs/2.0.0-beta.2/signal-snapshot-replay/evidence/exact-snapshot-replay.json`.
+
+### Real-agent Milestone evidence
+
+- `real-agent-release-final-6` phase 1 is valid partial evidence: exact dependency/doctor passed,
+  seven Tasks were assembled with zero failed mutations, and execution stopped at the autonomy
+  boundary.
+- Phase 2 is immutable diagnostic evidence, not release evidence. It reached guarded Step commit
+  `35b03177377ff5f3b95bb5325dbd0233e910853b`, then left two strict-review invocations without
+  terminal results at Task revision `6`.
+- The rebuilt validator rejects that exact transcript with `INCOMPLETE_INVOCATION` at the first
+  stranded `task step-review`.
+- `real-agent-release-final-8` completed clean initial assembly, but is diagnostic rather than
+  release evidence because the harness omitted the terminal observation for successful
+  `milestone autonomy-prepare`; the raw session proves the gap and no grant was issued.
+- `real-agent-release-final-10` reached the guarded Step commit and then exposed a real-CLI
+  integration defect: `--ask-for-approval` was positioned after `exec`, so strict review exited
+  with status `2` twice. A third retry was correctly rejected after the ordinary remediation limit;
+  the run was stopped and remains immutable diagnostic evidence rather than release evidence.
+- `real-agent-release-final-11` completed clean seven-Task initial assembly and delegated Milestone
+  authorization, then stopped non-mutating on the first Task Plan because `AC-001` was omitted.
+  The transcript is retained as WF-STABLE-015 diagnostic evidence and must not be used for release.
+- `real-agent-release-final-12` completed Task implementation, strict Step review, final review,
+  result, and delegated Task acceptance, then stopped on the first `task merge` call because the
+  advertised navigation omitted mandatory `--writer-token`. The rejected invocation is retained as
+  WF-STABLE-016 diagnostic evidence and must not be resumed or used for release.
+- `real-agent-release-final-13` passed clean bootstrap and transcript preflight, but the real Codex
+  session failed transport before its first workflow action (`HTTP CONNECT 403` followed by HTTPS
+  connection failures). It made no workflow mutation and is retained only as external transport
+  diagnostic evidence.
+- `real-agent-release-final-16` cleared transport, completed clean seven-Task initial assembly, and
+  received the exact owner autonomy grant. Phase 2 then exposed WF-STABLE-017 when standard
+  `milestone authorize --help` was rejected as a mutation missing `--id`; the run stopped immediately
+  and remains immutable diagnostic evidence.
+- `real-agent-release-final-17` proved the corrected CLI and wrapper path in a real Delegate: noun
+  help succeeded read-only, fresh `next` followed, and seven-Task initial assembly completed with
+  zero rejected mutations. The packaged validator then rejected the otherwise valid help
+  observation, so the run stopped before owner grant and is retained as WF-STABLE-017 diagnostic
+  evidence rather than release evidence.
+- `real-agent-release-final-18` completed clean seven-Task assembly, the owner autonomy grant,
+  delegated Milestone authorization, required-Task planning/authorization, and C1 handoff prepare
+  with zero rejected lifecycle calls. Its complete CLI stdout contains the one-time claim token
+  exactly once, but only after roughly 5 KiB of Task/event payload. The Delegate failed to retain
+  it and stopped before `task claim`; the run is immutable WF-STABLE-018 diagnostic evidence and
+  must not be resumed using the credential retained in its isolated session transcript.
+- `real-agent-release-final-19` proved credential-first handoff/claim consumption, seven-Task
+  assembly, delegated authorization, and bounded Core `task start`. Its resumed Delegate then
+  followed `next` into `task run` without the lease that claim had already bound, producing one
+  non-mutating `TRANSITION_BLOCKED`. The run is immutable WF-STABLE-019 diagnostic evidence and
+  must not be resumed or repaired from transcript credentials.
+- `real-agent-release-final-20` completed seven-Task phase-1 assembly, Plan recording, and autonomy
+  preparation with zero rejected lifecycle calls. The packaged validator then rejected a safe
+  successful top-level help observation despite its required fresh `next`; no owner grant was
+  issued. The run is immutable WF-STABLE-020 diagnostic evidence and must not be continued.
+- Final clean `real-agent-release-final-21` used rebuilt tarball SHA-256
+  `24a7b69b0ada9d922946a8c0c593384d5806d58a35e04fae171d26f83585ac4f` and an isolated
+  installed gateway. Phase 1 assembled exactly seven linked Tasks and stopped at the exact autonomy
+  boundary. Phase 2 completed the one required guarded Task through Core commit
+  `14ac065e4cff859df7ea299da0693caefba2b5b8`, both strict reviews, atomic content-only context
+  refresh, delegated Task acceptance, Core merge, Milestone validation, and delegated Milestone
+  acceptance. Task `TASK-01M04B516YDHY5D1B78S2XEV0S` is `merged` revision `14`; Milestone
+  `MS-01M04B42MC7VCEKTQ7K8ZYK0G1` is `accepted` revision `5`; accepted head is
+  `64a2e58e030dfb95f5f5724fb1825b02143ffaa7`. Final `next` is repository idle with
+  `discovery start`. Transcript validation passes `250/250`; phase credential scans report zero
+  findings; rejected lifecycle mutations and executed waived Tasks are both zero.
+
+### Boundary and release status
+
+- No tag, push, or npm publication was performed.
+- The live `signal_v4` repository and its external workflow-state were not modified by candidate
+  development or replay.
+- Fresh real-agent final acceptance/idle, transcript validation, credential inspection, and all
+  deterministic/package release gates are green. The independent source/evidence audit completed
+  with `PASS` and no unresolved material finding; beta.2 is recommended for release.