codex-workflow-v2 2.0.0-beta.1 → 2.0.0-beta.2

package/docs/development-flow.md

@@ -40,6 +40,11 @@ failed checks, or any manual/unrecorded Worker commit block completion.
 If the current Plan Risk Audit marks the Step for strict review, the atomic commit is still
 created by core, but the Step remains non-terminal and `next` routes to `task step-review`
 until commit-bound strict review and reviewer attestation pass.
+Use the exact claimant or required actor from `next` as `--actor`; the independent reviewer
+runs inside Core and is not supplied as the CLI actor.
+When `next` includes `gitMutationPolicy`, obtain bounded permission for that exact Git-writing
+transition before the first call instead of probing and retrying after a `.git/index.lock`
+failure. For `task start`, this applies only when invoking `--workspace-owner local`.
 
 After a Step changes approved project knowledge, the Delivery Coordinator reconciles and
 reapproves the Project Knowledge Map, then runs `task knowledge-rebind` between Steps. The
@@ -58,7 +63,9 @@ additions under Milestone autonomy; every unsafe source-set, category, scope, au
 conflict change is rejected.
 
 Submission requires a clean, auditable Task history and records evidence for the exact
-Task head. `task review-launch` starts a separate read-only reviewer. A passing fresh review
+Task head. `task review-launch` starts a separate read-only reviewer and atomically records its
+result. If C1 handoff is active, keep `--actor` equal to the current claimant or required actor
+from `next`; the reviewer identity remains internal to the compound route. A passing fresh review
 permits Result creation. Human final acceptance binds Brief, Plan, Result, evidence, and
 the accepted head. Base advancement forces synchronization, checks, review, and acceptance
 to be repeated before merge.
@@ -97,7 +104,12 @@ may finish while an amendment awaits authorization.
 
 During initial planning, all linked Tasks may be materialized before one complete
 `milestone plan-set`; no execution is available until the Plan classifies every reverse
-membership. After that boundary, semantic changes use human-only
+membership. Repository `next` returns `milestone initial-assembly` both before Task 1 and between
+linked Tasks. Its `linked-task-assembly` option explicitly permits `discovery start` and
+`discovery materialize`; after the first linked Task exists, its closing option permits one
+complete `milestone plan-set`. A failed
+`status` or `next` is not permission to call the closing command directly. After that boundary,
+semantic changes use human-only
 `milestone scope-change-prepare` and `milestone scope-change-apply`. A previously issued
 Milestone Autonomy Contract may instead use `milestone autonomy-evolve` for membership-only
 changes while the outcome, success signal, acceptance, checks, discovery, and base branch
@@ -128,6 +140,9 @@ With an eligible `milestone.final_accept` grant, `next` additionally returns
 `delegatedApprovalOptions`. The delegate may then use the current `MSA-*` code in the same
 turn because the earlier grant-issuance turn is the controlling user decision. Without such
 an option, the ordinary later-message human gate remains mandatory.
+Pass `--delegation-grant` only when the same `next` response exposes an exact eligible
+`delegatedApprovalOptions` entry for that transition. Ordinary C1 handoff, claim, run,
+step-complete, step-review, merge, and sync-base do not consume a Milestone approval grant.
 
 The Milestone coordinator keeps implementation out of its long-lived context: every required
 Task runs in a dedicated user-visible Task chat. The Milestone chat owns ordering, exact

package/docs/release.md

@@ -15,12 +15,14 @@ Before tagging a release:
 5. `npm run plugin:check`
 6. `npm run release:check`
 7. validate `plugins/codex-workflow-gateway` with the Codex plugin validator
+8. validate the append-only real-agent log with
+   `node scripts/validate-lifecycle-transcript.mjs --file <lifecycle-log.jsonl>`
 
 The downstream smoke packs the actual tarball, installs it into an empty temporary project,
 runs the packaged CLI handshake, and proves installation created none of `.codex`, `.tasks`,
 `.increments`, or `.memory-bank` in that project.
 
-For beta.1, the release gate also relies on `npm run release:check` to fail if:
+For beta.2, the release gate also relies on `npm run release:check` to fail if:
 
 - canonical entity schema 2 shapes drift;
 - protocol 1 compatibility is no longer additive;
@@ -30,6 +32,11 @@ For beta.1, the release gate also relies on `npm run release:check` to fail if:
   proof-obligation capabilities and schemas are absent from the packaged surface;
 - terminal Task replacement, project-level transaction recovery, secret-safe lock diagnostics,
   version/base diagnostics, or serialized maintainer validation are missing.
+- truthful initial-assembly navigation capability is absent from the packaged surface.
+
+The separate lifecycle transcript validator fails if the real-agent log contains a mutation that
+bypasses failed `status`/`next`, an unadvertised or failed mutation, an unresolved syntax-only
+retry, or missing post-mutation checkpoints.
 
 Full `npm test` and `npm run validate` invocations share destructive build outputs and are therefore
 single-owner operations. A concurrent invocation fails immediately with

package/docs/split-required-recovery.md

@@ -23,14 +23,15 @@ Continue the active Milestone through the package-local codex-workflow-v2 Core o
    create/link the replacement Task, change both memberships, supersede Milestone execution
    authorization, and leave the Milestone awaiting reauthorization. Do not perform a separate
    scope change for these effects.
-5. Run `status` and `next`. Verify: old Task `cancelled`; old membership `cancelled`; new Task
+5. Run `status`, wait for terminal success, then run `next`; never issue the pair in parallel.
+   Verify: old Task `cancelled`; old membership `cancelled`; new Task
    `planning` and `replacementForTaskId` points to the old Task; new membership `required`;
    Milestone `awaiting_execution_authorization`. If any relation is missing, stop and run `doctor`.
-6. Follow the exact `next` transition to reauthorize the changed Milestone. Run `status` and `next`
-   again. Do not reuse the historical Task's Plan or authorization.
+6. Follow the exact `next` transition to reauthorize the changed Milestone. Run `status` to
+   terminal success and then `next` again. Do not reuse the historical Task's Plan or authorization.
 7. Plan the replacement Task from its own Brief, record the required Plan Risk Audit, authorize it,
    prepare and claim its C1 handoff, and execute only the exact Step returned by `next`. Run
-   `status` and `next` after every state boundary.
+   sequential `status` then `next` checkpoints after every state boundary.
 8. Complete review, final acceptance, merge, remaining required Tasks, Milestone validation, and
    Milestone final acceptance through exact Core transitions. Never create a fourth remediation
    attempt for the historical Task.

package/docs/stable-release-defect-register.md

@@ -14,6 +14,335 @@ Last reviewed: 2026-08-15.
 - **Closed-regression** means a patch exists; the stable release must retain its regression coverage.
 - **Downstream** means the finding belongs to `signal_v4`, not to the workflow package.
 
+## Beta.2 closure candidates
+
+### WF-STABLE-009 — initial assembly creates a state rejected by `status` and `next`
+
+- Status: Closed-regression in beta.2
+- Severity: Critical
+- Area: Milestone initial assembly, reverse membership, repository navigation
+- Evidence: both the beta.1 real-agent E2E and the live read-only `signal_v4` reincarnation
+  materialized a first linked planning Task successfully, after which `status` and `next` returned
+  `MILESTONE_SCOPE_INCOMPLETE` for the intentionally repairable pre-Plan membership gap.
+- Risk: the documented seven-Task initial assembly cannot follow authoritative `next`; agents must
+  either stop before work begins or bypass navigation and invalidate lifecycle evidence.
+- Closure evidence: centralized initial-assembly assessment, deterministic fresh/adopted/unsafe
+  regressions, exact copied `signal_v4` snapshot replay, and real-agent seven-Task assembly all pass;
+  strict reverse-membership blocking remains active outside the exact predicate.
+
+### WF-STABLE-010 — beta.1 release E2E continued after failed `next`
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: Critical
+- Area: release evidence, real-agent transcript validation
+- Evidence: the beta.1 final E2E transcript contains failed `status` and `next` calls with
+  `MILESTONE_SCOPE_INCOMPLETE`; the Delegate labelled the gap expected, invoked direct
+  `milestone plan-set`, and the final audit still accepted the run despite the Brief explicitly
+  declaring a `next` bypass invalid.
+- Risk: a real-agent run can conceal a Core lifecycle defect and produce a false release
+  recommendation.
+- Candidate evidence: the append-only transcript validator rejects navigation bypasses,
+  unadvertised mutations, failed non-retryable mutations, unresolved syntax retries, and
+  unterminated harness invocations. Final-21 passed the complete validator with `250/250` events.
+
+### WF-STABLE-011 — pending Task review `next` names a non-autonomous primitive
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: Task final review, truthful navigation, real-agent evidence
+- Evidence: the first beta.2 real-agent diagnostic run reached a submitted Task with pending review;
+  `next` returned `task review-record`, while the packaged and successfully executed autonomous
+  command was `task review-launch`.
+- Risk: an agent following the exact autonomous route appears to bypass authoritative navigation,
+  while an agent following the literal response must manufacture reviewer output instead of using
+  the isolated reviewer launcher.
+- Candidate evidence: deterministic navigation regressions prove exact `task review-launch` while
+  preserving `task result-set` after a passed review. Final-21 completed strict Step review and the
+  final independent Task review without a rejected lifecycle mutation.
+
+### WF-STABLE-012 — Core-owned Git transitions omit the sandbox permission contract
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: Task execution, truthful navigation, Codex sandbox integration
+- Evidence: the rebuilt beta.2 real-agent E2E followed `next.action = task step-complete`; Core ran
+  its owned checks and then failed non-mutating at `git add` because `.git/index.lock` was denied.
+  The exact same transition succeeded after a bounded Git-metadata escalation.
+- Risk: a nominally autonomous Milestone learns required authority only by failing a lifecycle
+  mutation. This creates noisy retry history, invalidates clean release transcripts, and can strand
+  less capable agents despite a valid Plan and grant.
+- Candidate evidence: positive and negative navigation regressions cover the four local Git-writing
+  transitions and absence on read-only/external routes. Final-21 consumed the policy before local
+  start, Step completion, and Core merge without a rejected lifecycle mutation.
+
+### WF-STABLE-013 — strict reviewer can wait indefinitely or fail before launch
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: Critical
+- Area: strict Step review, final Task review, non-interactive Codex subprocess lifecycle
+- Evidence: beta.2 `real-agent-release-final-6` left two `task step-review` parents and two nested
+  `codex exec` reviewers alive for more than five minutes at unchanged Task revision `6`. Neither
+  invocation returned a terminal success or failure result.
+- Additional evidence: beta.2 `real-agent-release-final-10` exposed an integration error in the
+  first correction: the global `--ask-for-approval never` option was placed after `exec`, which the
+  real Codex CLI rejected with status `2`. Two launch failures consumed the two ordinary
+  remediation attempts before the run was stopped.
+- Root cause: the strict reviewer used inherited/default approval behavior despite intentionally
+  probing a denied write, the synchronous subprocess had no host-side deadline, and the initial
+  correction did not test the real CLI's global-option ordering contract.
+- Risk: an autonomous Milestone can hang forever inside Core before review evidence exists; a retry
+  can create a second concurrent reviewer for the same Step/revision.
+- Candidate evidence: strict reviewers now place `approval=never` before the `exec` subcommand,
+  retain read-only sandboxing, and have a fixed host-side execution deadline that returns terminal
+  `unverified` evidence on timeout. Focused tests assert the exact global-option ordering as well as
+  deadline propagation and timeout fail-closed behavior. Final-21 completed both strict reviewer
+  invocations under the non-interactive, ephemeral, ignore-config/rules, read-only contract.
+
+### WF-STABLE-014 — transcript validator accepts a started mutation with no terminal result
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: Critical
+- Area: release evidence, append-only harness transcript, indeterminate mutation recovery
+- Evidence: the incomplete `real-agent-release-final-6` transcript originally returned PASS with
+  `181` checked events even though two `task step-review` commentaries had no matching mutation
+  result and the Task remained at revision `6`. Final-8 then exposed the same class for read-only
+  commands: successful `milestone autonomy-prepare` had no terminal observation event, so the
+  wrapper log alone could not distinguish success, failure, or interruption.
+- Risk: a hung or externally interrupted mutation can be presented as valid release evidence; an
+  agent may re-enter the same semantic transition without knowing whether the first process is
+  still active.
+- Candidate evidence: the validator pairs trusted-harness invocation commentary with the exact
+  terminal navigation, mutation, or read-only observation result; rejects failed observations,
+  EOF with a pending invocation, and any second command before the pending invocation resolves.
+  Immutable final-6 and final-8 transcripts are retained as diagnostic evidence and rejected for
+  their respective stranded invocations.
+
+### WF-STABLE-015 — `task plan-set` navigation omits its exact inclusion contract
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: Task planning navigation, autonomous Plan construction, fail-before-write usability
+- Evidence: the Delegate followed `next.action = task plan-set` and produced substantive acceptance
+  statements, but Core rejected the first Plan because it did not contain the opaque Task acceptance
+  ID `AC-001` as an exact array member. The Task remained planning at revision `1`; the transcript
+  correctly rejected the run as failed release evidence.
+- Root cause: Core validates exact Task requirement and acceptance ID inclusion, while `next`
+  previously exposed only the action and revision. The machine-readable precondition was visible
+  only indirectly in large status/Brief output and was not part of the exact transition contract.
+- Candidate evidence: every `task plan-set` navigation now returns `taskPlanContract` with exact
+  required requirement IDs, acceptance IDs, current risks, Brief hash, and current Knowledge Map binding. The
+  packaged gateway requires planners to copy those exact IDs before adding semantic detail.
+
+### WF-STABLE-016 — Git-completion navigation omits the required writer lease input
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: Task completion/merge navigation, writer lease continuity, autonomous execution
+- Evidence: after successful implementation, strict Step review, Task review, result, and delegated
+  acceptance, `next` advertised `task merge` plus `gitMutationPolicy`. The Delegate followed that
+  response without `--writer-token`; the CLI rejected the invocation before any mutation.
+- Root cause: the mandatory writer lease was enforced by each transition but absent from the exact
+  machine-readable navigation contract. The gateway therefore had no local precondition telling it
+  to retain and pass the sensitive lease on the first call.
+- Candidate evidence: `next` returns a non-secret `writerTokenContract` for `task step-complete`,
+  `task submit`, `task merge`, and `task merge-confirm`, and omits it for non-consuming adjacent
+  transitions. The packaged gateway treats it as a first-call precondition and never prints or
+  persists the token.
+
+### WF-STABLE-017 — subcommand `--help` is treated as a lifecycle mutation
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: CLI command discovery, autonomous execution, release transcript integrity
+- Evidence: after clean seven-Task assembly and an active owner autonomy grant, the real Delegate
+  invoked `milestone authorize --help`. The CLI dispatched the underlying lifecycle operation and
+  rejected it with `INVALID_ARGUMENT: Missing required option --id` before any state write.
+- Root cause: CLI dispatch had no early help route; parsed `--help` remained an unused option while
+  noun/action matching entered the ordinary mutation implementation.
+- Candidate evidence: help is intercepted before repository/state construction, returns exit `0`
+  with a machine-readable `readOnly` response at top-level, noun, and action scopes, and never
+  requests mutation inputs or changes workflow state. Critical autonomous transitions expose exact
+  required and optional option lists. The transcript validator recognizes safe trusted-harness help
+  observations, rejects mutation-style help inputs, and requires a fresh successful `next` before
+  any subsequent mutation.
+
+### WF-STABLE-018 — credential-bearing receipts are buried after large Task payloads
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: C1 handoff, writer lease continuity, autonomous credential consumption
+- Evidence: the real Delegate completed initial assembly through `task handoff-prepare` with zero
+  rejected lifecycle calls, then reported that the one-time claim token was unavailable. The raw
+  successful CLI result proves that the token was emitted exactly once but was buried after roughly
+  5 KiB of Task/event data; the wrapper did not truncate stdout.
+- Root cause: credential-bearing values shared the same large compatibility payload as canonical
+  Task state and context. Although Core emitted the token correctly, the response supplied no
+  compact, prominent transfer receipt for an autonomous consumer.
+- Candidate evidence: `task handoff-prepare` now emits first-field `credentialHandoff`, and `task
+  run` emits first-field `writerLeaseReceipt`. Both name the intended next action, source, target or
+  owner, option, and sensitivity; the exact credential occurs once, while legacy payload data and
+  read-only responses contain no duplicate secret.
+
+### WF-STABLE-019 — claimed Task run requires a lease that navigation says will be issued later
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: High
+- Area: C1 claim, writer lease continuity, truthful Task navigation
+- Evidence: the real Delegate consumed the first-field claim token and completed `task claim`, then
+  safely paused for bounded Git permission. After resume, Core-owned `task start` succeeded. The
+  following `next` advertised `task run` without a writer-token contract, and the exact call was
+  rejected because claimed posture already required the lease created by claim.
+- Root cause: the first writer-lease receipt was emitted by `task run`, but claimed posture requires
+  that same credential as an input to run. `task claim` returned the lease only inside its large
+  payload, while action-only navigation intentionally omitted `task run` from the writer contract.
+- Candidate evidence: `task claim` now emits first-field `writerLeaseReceipt` with `task run` as its
+  consuming action, and claimed `task run` navigation advertises the exact `--writer-token`
+  precondition. Unclaimed runs still acquire their initial lease without a token.
+
+### WF-STABLE-020 — transcript validator rejects safe top-level help
+
+- Status: Closed-regression in beta.2
+- Severity: High
+- Area: release transcript integrity, read-only CLI discovery
+- Evidence: phase 1 completed initial assembly, one complete Plan, and autonomy preparation with
+  zero rejected lifecycle calls. A successful trusted-harness top-level `--help` was immediately
+  followed by fresh successful `next`, but packaged validation returned
+  `Unsupported read-only observation`.
+- Root cause: CLI help semantics covered top-level, noun, and action scopes, while the transcript
+  recognizer's regular expression required at least one noun before `--help`.
+- Candidate evidence: the validator recognizes bare top-level `--help` as safe help, retains the
+  mandatory fresh-`next` barrier, and still rejects failed help or embedded mutation inputs.
+
+### WF-STABLE-021 — checkpoint guidance permits parallel invocations rejected by release validation
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: Critical
+- Area: gateway protocol, release transcript integrity, lifecycle checkpoints
+- Evidence: `real-agent-release-final-21` completed phase-1 initial assembly with no individually
+  rejected command, but four times started `next` before the paired `status` had emitted its
+  terminal result (or vice versa). The strict validator rejected the first overlap with
+  `INCOMPLETE_INVOCATION` at event index `29`, before owner grant or Task execution.
+- Root cause: the packaged gateway required both `status` and `next` after each boundary but did not
+  state that the first invocation must terminate before the second starts. Real agents may
+  parallelize independent-looking read-only calls, while the append-only validation contract
+  deliberately treats overlapping lifecycle invocations as indeterminate evidence.
+- Candidate evidence: Skill, protocol, recovery guide, and E2E Brief now require terminal
+  `status` followed by terminal `next` and explicitly prohibit parallel tool batches. An exact
+  transcript fixture proves that overlapping checkpoint starts remain rejected. The final clean
+  `real-agent-release-final-21` followed every `status` then `next` checkpoint sequentially through
+  final acceptance; the complete transcript validates at `250/250` with no overlap.
+
+### WF-STABLE-022 — raw real-agent evidence persists one-time C1 credentials
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: Critical
+- Area: real-agent evidence, C1 credentials, release security
+- Evidence: the corrected `real-agent-release-final-21` consumed credential-first handoff, claim,
+  and run receipts successfully, but Codex `exec --json` serialized the literal `--claim-token`,
+  `--writer-token`, and credential-bearing stdout into the raw session JSONL. The semantic lifecycle
+  log remained secret-free, but the raw diagnostic artifact contradicted the stated memory-only
+  handling rule.
+- Root cause: raw Codex JSONL was redirected directly to evidence without a streaming redaction
+  boundary. A language-model tool call necessarily contains the CLI argument it invokes, even when
+  the agent does not echo the value in prose.
+- Candidate evidence: a streaming structural sanitizer removes exact credential fields and CLI
+  options before JSONL is persisted, preserves non-secret token metrics, and provides a fail-closed
+  post-run inspection mode. Deterministic tests cover command arguments, embedded receipt JSON,
+  structured receipts, and already-sanitized evidence. The final clean final-21 used the streaming
+  sanitizer from process start for both phases; fail-closed inspection reports zero credential
+  findings in both persisted raw JSONL artifacts.
+
+### WF-STABLE-023 — claimed strict-review navigation omits its writer lease precondition
+
+- Status: Closed-regression in beta.2; clean release E2E verified
+- Severity: Critical
+- Area: claimed C1 review, truthful navigation, writer lease continuity
+- Evidence: sanitized `real-agent-release-final-21` completed one guarded Step and its Core-owned
+  commit, then `next` advertised `task step-review` without `writerTokenContract`. The exact first
+  call was rejected non-mutating with `TRANSITION_BLOCKED` because claimed posture requires the
+  active lease token.
+- Root cause: navigation enumerated always-lease-bound completion actions and claimed `task run`,
+  but not the later claimed-C1 mutations that call the same handoff authorization predicate.
+- Candidate evidence: writer-token navigation is now posture-aware for every claimed-C1 action
+  that can consume an optional lease, including `task step-review` and `task review-launch`.
+  Regressions cover both claimed review boundaries while preserving token-free unclaimed review
+  navigation. The final clean final-21 exposed the contract and succeeded on the first call for
+  both `task step-review` and `task review-launch`, with zero rejected lifecycle mutations.
+
+## Beta.2 current evidence
+
+- The first `real-agent-release-final-21` is immutable diagnostic evidence for WF-STABLE-021: its
+  lifecycle commands individually succeeded, but packaged validation rejected four overlapping
+  checkpoint pairs. It stopped before owner grant and was not resumed.
+
+- Final clean `real-agent-release-final-21` used a rebuilt tarball with SHA-256
+  `24a7b69b0ada9d922946a8c0c593384d5806d58a35e04fae171d26f83585ac4f` and an isolated
+  `final21` marketplace/plugin cache. Phase 1 assembled exactly seven linked Tasks and stopped at
+  the autonomy gate; phase 2 completed the sole required guarded Task, strict Step review,
+  content-only context refresh, final review, delegated acceptance, Core merge, Milestone
+  validation, and delegated Milestone final acceptance. Task
+  `TASK-01M04B516YDHY5D1B78S2XEV0S` is `merged` at revision `14`; Milestone
+  `MS-01M04B42MC7VCEKTQ7K8ZYK0G1` is `accepted` at revision `5`; accepted head is
+  `64a2e58e030dfb95f5f5724fb1825b02143ffaa7`. Final `next` is repository idle with
+  `discovery start`. Transcript validation passes `250/250`, both credential scans report zero
+  findings, waived Tasks executed is zero, and rejected lifecycle mutations is zero.
+- Post-WF-STABLE-023 full sequential validation on Node `24.17.0` passed `153/153` in
+  `644031 ms`. Plugin check, release check, isolated-cache dry-pack, downstream smoke, root
+  workflow regression, and `git diff --check` passed. The E2E-tested pre-evidence-doc tarball SHA-1 is
+  `4519d05b31fa08b39f5f5f9f9e2b9f0e13941935`.
+
+- Post-WF-STABLE-020 sequential package validation passed `149/149` under Node `24.17.0`.
+  Current validation accepts the immutable `final-20` phase-1 transcript as `132/132`, while its
+  packaged pre-fix validator deterministically rejects it. Rebuilt package dry-pack, plugin check,
+  release check, downstream smoke, root regression, and `git diff --check` passed; dry-pack shasum
+  is `d5ca042dd1bb90e52c6d5313dafa6730e5d3795f`.
+- Post-WF-STABLE-019 sequential package validation passed `149/149` under Node `24.17.0`.
+  Rebuilt package dry-pack, plugin validation, release check, downstream smoke, root workflow
+  regression, and `git diff --check` all passed; dry-pack shasum is
+  `547166399294368c89ae7c581192cf81a6391638`.
+- Post-WF-STABLE-018 sequential package validation passed `147/147` under Node `24.17.0`.
+  Rebuilt package dry-pack with isolated npm cache, plugin validation, release check, downstream
+  smoke, root workflow regression, and `git diff --check` all passed; package shasum is
+  `04571ca2f51f48661c984e8d16a2e32c336efe64`.
+- Final post-WF-STABLE-015 sequential package validation passed `141/141` under Node `24.17.0`.
+- Package archive, downstream smoke, plugin validation, release check, and root workflow regression
+  passed on the rebuilt candidate. One root-regression setup attempt lacked Node on the child-process
+  `PATH`; the authoritative rerun with the declared Node 24 environment passed.
+- Exact copied `signal_v4` snapshot replay passed without live-project or live-state writes.
+- Disposable final-6 phase 1 assembled seven Tasks and stopped cleanly at the autonomy boundary.
+  Phase 2 authorized and completed the guarded Step, then correctly stopped as invalid evidence
+  when strict Step review remained indeterminate.
+- Disposable final-11 assembled all seven Tasks and authorized the Milestone, then stopped on the
+  first rejected `task plan-set` because exact `AC-001` inclusion was not discoverable from `next`.
+  It is immutable diagnostic evidence for WF-STABLE-015, not release evidence.
+- Disposable final-12 reached delegated Task acceptance and `task merge`, then stopped on the first
+  rejected merge because `next` did not advertise mandatory `--writer-token`. It is immutable
+  diagnostic evidence for WF-STABLE-016, not release evidence.
+- Disposable final-13 passed clean bootstrap/preflight but the real Codex transport failed before
+  the first workflow action. It made no workflow mutation and is external diagnostic evidence, not
+  a package-defect or release signal.
+- Disposable final-16 cleared transport, completed initial assembly and the owner grant, then
+  stopped on the first rejected `milestone authorize --help`. It is immutable diagnostic evidence
+  for WF-STABLE-017, not release evidence.
+- Disposable final-17 completed seven-Task initial assembly with zero rejected mutations and proved
+  read-only help plus fresh `next`, but the packaged validator still rejected that help observation.
+  It stopped before owner grant and is immutable WF-STABLE-017 diagnostic evidence.
+- Disposable final-18 completed initial assembly through C1 handoff preparation with zero rejected
+  lifecycle calls. It then exposed WF-STABLE-018: the exact one-time claim token existed in complete
+  stdout but was buried after the large Task/event payload and was not retained by the Delegate.
+  The run is immutable diagnostic evidence and is not eligible for continuation or release evidence.
+- Disposable final-19 completed seven-Task assembly, delegated authorization, credential-first
+  handoff/claim, and bounded Core `task start`. It then exposed WF-STABLE-019 when claimed
+  `task run` was advertised without its already-bound lease precondition and was rejected once.
+  The run is immutable diagnostic evidence and is not eligible for continuation.
+- Disposable final-20 completed clean seven-Task phase-1 assembly and autonomy preparation with no
+  rejected lifecycle call, then exposed WF-STABLE-020 when transcript validation rejected safe
+  top-level help plus fresh `next`. No owner grant was issued; the run is immutable diagnostic
+  evidence and is not eligible for continuation.
+- The rebuilt tarball, fresh clean final-acceptance/idle E2E, transcript/security checks, and all
+  deterministic/package release gates are green. The independent source/evidence audit completed
+  with `PASS`, found no material blocker, and confirmed the beta.2 release recommendation.
+
 ## Workflow findings closed for beta.1
 
 ### WF-STABLE-001 — `locks repair` exposes a full writer token
@@ -115,7 +444,7 @@ Last reviewed: 2026-08-15.
   active but non-completable Milestone.
 - Stable-release requirement:
   - ship a canonical `split-required` operator/delegate recovery prompt;
-  - require `status`/`next` after every state boundary;
+  - require sequential terminal `status` then terminal `next` after every state boundary;
   - distinguish Task creation, replacement linkage, membership evolution, and execution
   reauthorization;
 - prohibit manual state editing and resumption of the failed Step.

package/docs/updating-existing-project.md

@@ -29,6 +29,8 @@ adoption posture.
 используйте внешний точный runner alpha.7 только для `update rescue-preflight`. Продолжать
 можно лишь при `eligible=true`; допустимы только перечисленные им `locks repair` и
 `task step-review`. Этот путь не меняет dependency и не разрешает другие команды alpha.7.
+Для `task step-review` используйте lifecycle-actor из `next` или rescue-preflight; это claimant
+или required actor, а не identity независимого reviewer-процесса.
 После terminal review выполните обычный Knowledge reconcile/rebind, доведите Task до безопасной
 границы и только затем обновляйте package/lock обычным способом.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.1",
+  "version": "2.0.0-beta.2",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -44,6 +44,7 @@ Current capability set:
 - `alpha6-adoption-posture-v1`
 - `alpha6-strict-review-rescue-v1`
 - `milestone-initial-assembly-v1`
+- `milestone-initial-assembly-navigation-v2`
 - `milestone-autonomy-contract-v1`
 - `milestone-autonomous-membership-evolution-v1`
 - `task-c1-derived-worker-actor-v1`
@@ -75,7 +76,9 @@ version, canonical entity summaries, and the current sidecar baseline hash. Adop
 
 ## Worker Step completion and strict Step Review
 
-`task run` dispatches one Step and returns its writer token and Worker envelope. The Worker
+`task run` dispatches one Step and returns a first-field `writerLeaseReceipt`, followed by the
+credential-free lease metadata, Task state, and Worker envelope. Consume the receipt before the
+remaining payload and retain its token only in working memory. The Worker
 must leave all changes uncommitted and must not stage, commit, amend, reset, rebase, or
 modify Git history.
 
@@ -84,11 +87,36 @@ While that Step is `in_progress`, repository-level `next` normally returns
 `workflow-core` ownership. The coordinator invokes that transition with the current revision
 and writer token. Core then runs configured checks, validates `allowedWrites`, stages the
 changes, creates the atomic commit, and records evidence.
+When `next` also includes `gitMutationPolicy`, obtain bounded permission for that exact
+Git-writing transition before the first call; do not probe and retry after a
+`.git/index.lock` failure. For `task start`, the policy applies only when the coordinator
+chooses `--workspace-owner local`.
+
+When `next` also includes `writerTokenContract`, the coordinator must retain the active writer
+lease from `writerLeaseReceipt` and pass it with the advertised option on the first transition call.
+The contract never contains the token value. Do not print, persist, reconstruct, or replace the
+token with a redacted fingerprint; stop before mutation when the active lease is unavailable.
+Satisfy this contract separately from any `gitMutationPolicy` on the same response.
+
+`codex-workflow <noun> [action] --help` is a read-only command-discovery route. It exits without
+constructing workflow state or validating lifecycle inputs. Use exact option lists only when the
+response says `exactOptionContractAvailable=true`; otherwise consult this packaged protocol. After
+help, obtain a fresh `next` before invoking the lifecycle transition.
 
 If the current Plan Risk Audit marks that Step for strict review, the commit is still
 workflow-owned, but `next` then returns `action: "task step-review"` with the same `stepId`
 and the exact `completionCommit`. Canonical Step completion remains blocked until the strict
 review and reviewer attestation sidecars verify against that exact commit.
+Invoke `task step-review` with the same lifecycle actor advertised by `next`
+(`c1Handoff.claimant` or `requiredActor` when present). The isolated reviewer is launched
+inside Core; do not substitute the reviewer identity into `--actor`. In claimed C1 posture,
+`next.writerTokenContract` is mandatory for both `task step-review` and the later
+`task review-launch`; pass the retained active lease on the first call of each exact action.
+
+After submission, a pending Task review is advertised as `action: "task review-launch"`, not
+`task review-record`. That compound route launches the read-only reviewer and atomically
+records the returned review. If claimant-bound mutation is active, pass the same lifecycle
+actor through `--actor`; reviewer identity remains internal to the route.
 
 An unrecorded commit is Git history drift. Stop instead of adding another commit or editing
 workflow state manually; recovery remains coordinator-controlled.
@@ -129,6 +157,12 @@ classifications. A planned new scanner-visible Knowledge file must be declared w
 directories, and inferred authority are not declarations; only Core may decide whether the final
 diff is eligible for delegated refresh.
 
+For every `task plan-set` navigation, consume `next.taskPlanContract` before building the Plan.
+Its `requiredRequirementIds` and `requiredAcceptanceIds` are exact-membership preconditions, not
+descriptive hints. Preserve each ID verbatim in the corresponding Plan array and use the returned
+Brief hash plus Knowledge Map revision/hash as the planning binding. Missing or stale contract data
+is a stop condition.
+
 Use `task context-refresh` only when the same `next` response returns it as the top-level action and
 exposes `contextRefresh` for the exact grant. Pass Task revision, map revision, delegate actor, and
 grant ID. Never run standalone `project-memory reconcile` first; Core blocks that non-atomic route
@@ -166,11 +200,28 @@ claimed, only the claimant may mutate the Task, and lease-bound mutations must p
 bound writer token. Milestone-linked Tasks must be claimed before start, and handback is
 terminal and evidence-bound. When target actor is omitted, Core derives
 `agent:worker:<task-id>`. No thread id is required or accepted as authority.
+The successful prepare response begins with `credentialHandoff`. Consume that receipt before the
+Task/event/bundle payload, retain its token only in working memory, and pass it exactly once to the
+declared `task claim --claim-token` action for the declared target actor. The later bundle remains
+contextual and intentionally contains no second copy of the claim token.
+The successful claim response then begins with `writerLeaseReceipt`. Retain that token only in
+working memory. In claimed C1 posture, fresh `next` exposes `writerTokenContract` on `task run`;
+pass the receipt token through its declared `--writer-token` option on the first run call. The
+successful run returns the refreshed writer receipt for later lease-bound transitions.
 
 ## Milestone assembly, autonomy, and human gate
 
 During initial planning, materialize every linked Task and then call `milestone plan-set` once
 with the complete membership. Execution is blocked while reverse membership is incomplete.
+Before Task 1 and between linked Tasks, follow top-level `next.action = "milestone initial-assembly"`.
+Its `linked-task-assembly.commands` permit `discovery start` and `discovery materialize`; after the
+first linked Task exists, the separate closing option permits `milestone plan-set`. If `status` or `next` fails, stop: never label
+the gap expected and invoke `milestone plan-set` directly.
+
+Every required navigation checkpoint is strictly sequential: start `status`, wait until its
+terminal result is recorded, then start `next` and wait for its terminal result. Never issue the
+pair concurrently or through a parallel tool call. The trusted transcript validator treats a
+second invocation before the first terminal result as indeterminate release evidence.
 
 After that Plan, one human may prepare and grant a maximum-72-hour Milestone Autonomy Contract:
 
@@ -227,6 +278,10 @@ transition matches the requested command, with the named delegate as actor and t
 as `--delegation-grant`. The resulting authorization event records the grant and both actors.
 For `milestone.final_accept`, also pass the current `MSA-*` code; the existing grant replaces
 the later-message requirement, not the state binding.
+Do not pass `--delegation-grant` to ordinary C1 handoff, claim, run, step-complete,
+step-review, merge, or sync-base calls. Those transitions are not authorized by a Milestone
+approval grant unless the same `next` response explicitly advertises an eligible grant for the
+exact transition.
 
 Delegated approval does not cover adoption apply or the ordinary semantic Milestone scope-change
 path. Membership-only evolution requires the separate Milestone Autonomy Contract.

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -51,6 +51,13 @@ scanner category. Do not replace the path with a wildcard or directory, do not i
 authority, and do not claim delegated-refresh eligibility; Core decides eligibility from the
 resulting repository diff and current authorization state.
 
+When `next.action` is `task plan-set` (including the corrective-audit variant), treat
+`next.taskPlanContract` as the exact transition precondition. Copy every
+`requiredRequirementIds` entry into Plan `requirements` and every `requiredAcceptanceIds` entry
+into Plan `acceptance` as exact array members; semantic prose may be added but cannot replace those
+IDs. Bind the Plan to the returned `briefHash` and active `knowledgeMap` revision/hash. Stop if the
+contract is absent or conflicts with the current Task/Knowledge state.
+
 When `next` returns top-level `action: task context-refresh`, use only that atomic action for
 the returned Task/map revisions, actor, and grant. Do not run standalone `project-memory reconcile`
 first: Core rejects it because it would create a human-approval gap and strand the Task. A
@@ -64,6 +71,39 @@ installed package. The only valid continuation is the exact `task replacement-ma
 transition (or creation of its one ready Discovery when requested). Never rebind, refresh, replan,
 authorize, or resume the historical Task, and never emulate the membership changes manually.
 
+When `next` returns `milestone initial-assembly`, execution is unavailable. Follow only the
+advertised `linked-task-assembly.commands` (`discovery start` and `discovery materialize`) until all
+intended linked Tasks exist. The closing `milestone plan-set` option appears only after at least one
+linked Task exists; use it once with the complete membership. After every boundary, run `status`,
+wait for its terminal success, and only then run `next`; never launch the checkpoint pair in
+parallel or in one parallel tool batch. If either fails, stop; do not
+describe the reverse-membership gap as expected and invoke a direct closing command.
+
+When `next` includes `gitMutationPolicy`, obtain bounded permission for that exact Git-writing
+transition before the first call. Do not probe and retry after a `.git/index.lock` failure.
+For `task start`, the policy applies only when choosing `--workspace-owner local`; for
+`task step-complete`, `task merge`, and `task sync-base`, the advertised transition itself
+writes Git metadata.
+
+When `next` includes `writerTokenContract`, treat it as an exact first-call precondition. Retain
+the active writer lease from the first-field `writerLeaseReceipt` returned by `task run` and pass it using the advertised `option` for that
+transition. The token is sensitive: never print, summarize, persist, or substitute a redacted
+fingerprint. Stop before mutation if the active lease is unavailable. This input contract is
+independent from `gitMutationPolicy`; satisfy both when both are present.
+
+On successful `task handoff-prepare`, consume the first-field `credentialHandoff` before reading
+the Task/event/bundle payload. Retain its one-time token only in working memory and use it exactly
+once with the declared `action` and `option` for the declared `targetActor`. Successful `task claim`
+returns a first-field `writerLeaseReceipt`; retain that lease and pass it to claimed `task run` when
+the fresh `next.writerTokenContract` requires it. Successful `task run` returns the refreshed
+`writerLeaseReceipt`; retain it only until Core releases that lease.
+Never search later payload fields for either credential and never copy credentials into evidence.
+
+Command discovery with `codex-workflow <noun> [action] --help` is read-only. Use it only when the
+exact invocation syntax is not already available from `next` and this protocol. Consume declared
+`requiredOptions` and `optionalOptions`; when `exactOptionContractAvailable=false`, consult the
+packaged protocol instead of guessing. Help never replaces a fresh `next` before mutation.
+
 ## Product Or Workflow Graph Refresh
 
 1. Run `graph refresh-request --kind product|workflow --mode moderate`.
@@ -118,6 +158,9 @@ Never create, broaden, renew, or replace a grant from an agent's own judgment. N
 the delegate as the user. When `next` exposes an eligible option, pass its grant ID through
 `--delegation-grant` and use the exact delegate string as `--actor`. The core remains the
 authority for status, expiry, scope, transition, and revocation checks.
+If the same `next` response does not expose an eligible option for that exact transition, do
+not pass `--delegation-grant`. Ordinary C1 handoff, claim, run, step-complete, step-review,
+merge, and sync-base do not inherit a Milestone approval grant.
 
 For delegated Milestone final acceptance, the current `MSA-*` code is still required, but a
 new user turn is not: the previously issued grant is the controlling decision. If no eligible
@@ -156,5 +199,6 @@ returns `safe=true` with a clean checkout, no running Step, and no active writer
 - A request changes before evidence is bound.
 - An action would make MCP or the local map authoritative project memory.
 - A requested mutation is not authorized by the package CLI state.
+- A lifecycle `status` or `next` failed; do not continue with a different lifecycle mutation.
 - A human gate was emitted but the user has not approved its exact confirmation code in a
   later message and no exact eligible delegated approval option exists.