codex-workflow-v2 2.0.0-beta.10 → 2.0.0-beta.11

package/dist/src/workflow.js

@@ -13,8 +13,10 @@ import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.j
 import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
-import { appendCorrectiveDecisionEvent, appendRemediationEvent, appendRemediationModeRecovery, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, } from './alpha6/remediation.js';
-import { assessMilestoneInitialAssembly, applyMilestoneScopeChangeTransaction, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
+import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationEvent, appendRemediationModeRecovery, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, } from './alpha6/remediation.js';
+import { assessPlanIntegrityRecovery, defaultPlanIntegrityRecoveryActor, } from './alpha6/plan-integrity.js';
+import { assertMechanicalFeasibilityFresh, evaluateMechanicalFeasibility, hashMechanicalFeasibilityEvidence, } from './alpha6/mechanical-feasibility.js';
+import { assessMilestoneInitialAssembly, applyInitialMilestonePlanTransaction, applyMilestoneScopeChangeTransaction, assertMilestoneDependenciesDeclared, assertMilestoneTaskRunnable, assessMilestoneTaskDependencies, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
 import { applyProjectTransaction, recoverProjectTransactions, runRollbackProjectTransaction, } from './beta1/project-transaction.js';
 import { buildCurrentStrictStepReviewCycle, countUnverifiedStrictStepReviews, ensurePendingStrictStepReview, isStepReviewRequired, latestPassedVerifiedStepReviewEvent, recordStrictStepReview, verifiedHistoricalStepReviewCommits, } from './alpha6/review.js';
 import { applyMilestoneAutonomyContract, assertAutonomousPlanEvolution, prepareMilestoneAutonomyContract, readMilestoneAutonomyEvents, requireActiveMilestoneAutonomy, } from './alpha7/autonomy.js';
@@ -394,6 +396,32 @@ export class WorkflowService {
                 disposition: membership?.disposition ?? null,
             });
         }
+        const incidentDependencies = milestone.memberships.flatMap((candidate) => {
+            if (!Array.isArray(candidate.dependsOnTaskIds))
+                return [];
+            return [
+                ...(candidate.taskId === oldTask.id
+                    ? candidate.dependsOnTaskIds.map((predecessorTaskId) => ({
+                        predecessorTaskId,
+                        consumerTaskId: candidate.taskId,
+                    }))
+                    : []),
+                ...(candidate.dependsOnTaskIds.includes(oldTask.id)
+                    ? [{ predecessorTaskId: oldTask.id, consumerTaskId: candidate.taskId }]
+                    : []),
+            ];
+        });
+        if (structuralReplacementIsDisabled()) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Structural replacement is disabled until a topology-preserving replacement transaction is implemented.', {
+                diagnosticCode: 'STRUCTURAL_REPLACEMENT_REQUIRED',
+                milestoneId: milestone.id,
+                oldTaskId: oldTask.id,
+                incidentDependencies,
+                requiredAction: 'Materialize P04-B/P05 before replacing this split-required Task.',
+            });
+        }
+        /* P04-B retains the existing one-for-one transaction below as implementation evidence,
+           but this route must remain unreachable until dependency rewiring is specified. */
         const riskAudit = readCurrentPlanRiskAudit(this.store, oldTask);
         if (!riskAudit)
             throw new WorkflowError('STATE_CORRUPT', 'The terminal Task has no current Plan Risk Audit.');
@@ -503,9 +531,19 @@ export class WorkflowService {
             checks: milestone.checks,
             memberships: [
                 ...milestone.memberships.map((candidate) => candidate.taskId === oldTask.id
-                    ? { ...candidate, disposition: 'cancelled', reason: replacementReason }
-                    : candidate),
-                { taskId: replacementTaskId, disposition: 'required', reason: replacementReason },
+                    ? {
+                        ...candidate,
+                        disposition: 'cancelled',
+                        reason: replacementReason,
+                        dependsOnTaskIds: [...(candidate.dependsOnTaskIds ?? [])],
+                    }
+                    : { ...candidate, dependsOnTaskIds: [...(candidate.dependsOnTaskIds ?? [])] }),
+                {
+                    taskId: replacementTaskId,
+                    disposition: 'required',
+                    reason: replacementReason,
+                    dependsOnTaskIds: [...(membership.dependsOnTaskIds ?? [])],
+                },
             ],
         };
         if (autonomyContractEventHash) {
@@ -714,38 +752,15 @@ export class WorkflowService {
                 throw new WorkflowError('TRANSITION_BLOCKED', `Started Task ${task.id} cannot be removed from a Milestone.`);
             }
         }
-        const authorizations = milestone.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
-            ? { ...authorization, decision: 'superseded' }
-            : authorization);
-        const root = this.store.milestoneRoot(identity.projectId, milestoneId);
-        const stagedPlan = this.store.stageArtifact(root, 'plan.json', JSON.stringify({
-            outcome: normalized.outcome,
-            successSignal: normalized.successSignal,
-            acceptance: normalized.acceptance,
-            memberships: normalized.memberships,
-            checks: normalized.checks,
-        }, null, 2));
-        const candidate = {
-            ...milestone,
-            status: 'awaiting_execution_authorization',
-            outcome: normalized.outcome,
-            successSignal: normalized.successSignal,
-            acceptance: normalized.acceptance,
-            taskIds,
-            memberships: normalized.memberships,
-            checks: normalized.checks,
-            membershipRevision: milestone.membershipRevision + 1,
-            authorizations,
-            planHash: stagedPlan.hash,
-            resultHash: null,
-            evidenceHash: null,
-            acceptedHead: null,
-            cancellationReason: null,
-        };
-        assertMilestoneMembershipIntegrity(candidate, (taskId) => this.store.readTask(identity.projectId, taskId), {}, () => this.store.listTasks(identity.projectId));
-        const saved = this.store.writeMilestone(candidate, expectedRevision);
-        this.store.publishArtifact(stagedPlan);
-        return saved;
+        return applyInitialMilestonePlanTransaction({
+            store: this.store,
+            milestone,
+            expectedRevision,
+            normalizedPlan: normalized,
+            now: this.now(),
+            readTask: (taskId) => this.store.readTask(identity.projectId, taskId),
+            listTasks: () => this.store.listTasks(identity.projectId),
+        });
     }
     prepareMilestoneScopeChange(repository, milestoneId, expectedRevision, plan, actor) {
         const { identity } = this.#mutationContext(repository);
@@ -854,6 +869,7 @@ export class WorkflowService {
         if (milestone.status !== 'awaiting_execution_authorization' || !milestone.planHash) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} is not awaiting authorization.`);
         }
+        assertMilestoneDependenciesDeclared(milestone);
         this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
         const root = this.store.milestoneRoot(identity.projectId, milestoneId);
         const planHash = this.store.hashArtifact(root, 'plan.json');
@@ -1397,7 +1413,24 @@ export class WorkflowService {
         const root = this.store.taskRoot(identity.projectId, taskId);
         const briefHash = this.store.hashArtifact(root, 'brief.md');
         const planHash = this.store.hashArtifact(root, 'plan.md');
+        if (task.briefHash !== briefHash || task.planHash !== planHash) {
+            throw new WorkflowError('STATE_CORRUPT', 'Task Plan authority does not match its stored artifacts.', {
+                taskId: task.id,
+                stateBriefHash: task.briefHash,
+                artifactBriefHash: briefHash,
+                statePlanHash: task.planHash,
+                artifactPlanHash: planHash,
+            });
+        }
         readCurrentPlanRiskAudit(this.store, task, { requireCurrentTaskRevision: true });
+        const mechanicalFeasibility = evaluateMechanicalFeasibility(identity.repositoryRoot, task, briefHash, planHash);
+        if (mechanicalFeasibility.decision === 'blocked') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Task Plan contains a proven mechanical contradiction.', {
+                diagnosticCode: 'MECHANICAL_PLAN_INFEASIBILITY',
+                mechanicalFeasibility,
+                requiredAction: 'task plan-set',
+            });
+        }
         const delegation = this.delegatedAuthorization(identity.projectId, delegationGrantId, 'task.execution_authorize', actor, task);
         const event = {
             kind: 'execution',
@@ -1407,11 +1440,12 @@ export class WorkflowService {
             briefHash,
             planHash,
             resultHash: null,
-            evidenceHash: null,
-            headCommit: null,
+            evidenceHash: hashMechanicalFeasibilityEvidence(mechanicalFeasibility),
+            headCommit: mechanicalFeasibility.evaluatedHead,
             reason,
             authorizationMode: delegation ? 'delegated' : 'human',
             ...(delegation ? { delegation } : {}),
+            mechanicalFeasibility,
         };
         return this.store.writeTask({ ...task, status: 'ready', briefHash, planHash, authorizations: [...task.authorizations, event] }, expectedRevision);
     }
@@ -1443,6 +1477,9 @@ export class WorkflowService {
         if (grantId)
             this.assertHandoffGrant(context.identity.projectId, task, targetActor, grantId);
         const milestone = task.milestoneId ? this.readMilestoneCurrent(task.projectId, task.milestoneId) : null;
+        const dependencyBinding = milestone
+            ? this.currentMilestoneDependencyBinding(milestone, task.id)
+            : null;
         const milestones = milestone ? this.listMilestonesCurrent(task.projectId) : [];
         const milestoneDisplayNumber = milestone
             ? milestones.findIndex((candidate) => candidate.id === milestone.id) + 1
@@ -1488,6 +1525,7 @@ export class WorkflowService {
                 writerToken: lease.token,
                 milestoneDisplayNumber,
                 taskDisplayNumber,
+                dependencyBinding,
                 expectedNext: String(nextForTask(task).action ?? 'task show'),
                 grantId,
                 expiresAt: expiresAt ?? new Date(this.now().getTime() + 24 * 60 * 60 * 1000).toISOString(),
@@ -1510,7 +1548,11 @@ export class WorkflowService {
         if (!normalizedActor) {
             throw new WorkflowError('INVALID_ARGUMENT', 'Claim actor is required.');
         }
-        const pendingHandoff = assertTaskClaimAllowed(this.store, task, normalizedActor, claimToken, this.now());
+        this.assertExecutionAuthorizationFresh(task, context.identity.repositoryRoot);
+        const dependencyBinding = task.milestoneId
+            ? this.currentMilestoneDependencyBinding(this.readMilestoneCurrent(task.projectId, task.milestoneId), task.id)
+            : null;
+        const pendingHandoff = assertTaskClaimAllowed(this.store, task, normalizedActor, claimToken, this.now(), dependencyBinding);
         if (pendingHandoff.latestEvent.grantId) {
             this.assertHandoffGrant(context.identity.projectId, task, normalizedActor, pendingHandoff.latestEvent.grantId);
         }
@@ -1543,7 +1585,7 @@ export class WorkflowService {
             lease = context.locks.acquire(taskId, normalizedActor);
         }
         try {
-            const event = appendTaskClaim(this.store, task, actor, claimToken, lease.token, this.now());
+            const event = appendTaskClaim(this.store, task, actor, claimToken, lease.token, this.now(), dependencyBinding);
             return {
                 task,
                 event,
@@ -1567,6 +1609,22 @@ export class WorkflowService {
         if (!normalizedActor)
             throw new WorkflowError('INVALID_ARGUMENT', 'Writer credential replacement actor is required.');
         const posture = readTaskC1Posture(this.store, task);
+        if (posture.state === 'claimed' && task.milestoneId) {
+            const dependencyBinding = this.currentMilestoneDependencyBinding(this.readMilestoneCurrent(task.projectId, task.milestoneId), task.id);
+            const claimedBinding = posture.latestEvent.dependencyBinding ?? null;
+            if (claimedBinding === null
+                || claimedBinding.milestoneRevision !== dependencyBinding.milestoneRevision
+                || claimedBinding.membershipRevision !== dependencyBinding.membershipRevision
+                || claimedBinding.milestonePlanHash !== dependencyBinding.milestonePlanHash) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Writer credential replacement requires a current Milestone dependency binding.', {
+                    diagnosticCode: 'MILESTONE_DEPENDENCY_BINDING_STALE',
+                    taskId: task.id,
+                    milestoneId: task.milestoneId,
+                    claimDependencyBinding: claimedBinding,
+                    currentDependencyBinding: dependencyBinding,
+                });
+            }
+        }
         const navigation = this.taskGitNavigationOverride(task) ?? nextForTask(task);
         const action = String(navigation.action);
         const currentLease = context.locks.inspect(taskId);
@@ -1615,17 +1673,10 @@ export class WorkflowService {
         this.requireExecutionAdoptionPosture(identity, taskId);
         if (task.status !== 'ready')
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} is ${task.status}.`);
-        this.assertExecutionAuthorizationFresh(task);
+        const executionAuthorization = this.assertExecutionAuthorizationFresh(task, identity.repositoryRoot);
         if (task.milestoneId) {
             const milestone = this.readMilestoneCurrent(identity.projectId, task.milestoneId);
-            const membership = milestone.memberships.find((candidate) => candidate.taskId === taskId);
-            if (milestone.status !== 'active' || membership?.disposition !== 'required') {
-                throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone-linked Task requires an active, authorized membership.', {
-                    milestoneId: milestone.id,
-                    milestoneStatus: milestone.status,
-                    disposition: membership?.disposition ?? null,
-                });
-            }
+            const dependencyBinding = this.currentMilestoneDependencyBinding(milestone, task.id);
             const handoffPosture = readTaskC1Posture(this.store, task);
             if (handoffPosture.state !== 'claimed') {
                 throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone-linked Task start requires a prepared and claimed C1 handoff bundle.', {
@@ -1635,6 +1686,20 @@ export class WorkflowService {
                     requiredAction: handoffPosture.state === 'pending' ? 'Claim the prepared handoff.' : 'Prepare and claim a C1 handoff.',
                 });
             }
+            const claimBinding = handoffPosture.latestEvent.dependencyBinding ?? null;
+            if (claimBinding === null
+                || claimBinding.milestoneRevision !== dependencyBinding.milestoneRevision
+                || claimBinding.membershipRevision !== dependencyBinding.membershipRevision
+                || claimBinding.milestonePlanHash !== dependencyBinding.milestonePlanHash) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone-linked Task start requires a current dependency-bound C1 claim.', {
+                    diagnosticCode: 'MILESTONE_DEPENDENCY_BINDING_STALE',
+                    taskId: task.id,
+                    milestoneId: milestone.id,
+                    claimDependencyBinding: handoffPosture.latestEvent.dependencyBinding ?? null,
+                    currentDependencyBinding: dependencyBinding,
+                    requiredAction: 'Prepare and claim a new C1 handoff from the current Milestone Plan.',
+                });
+            }
         }
         if (!isClean(identity.repositoryRoot)) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Task start requires a clean checkout.', {
@@ -1644,12 +1709,22 @@ export class WorkflowService {
         const branch = `codex/task-${task.id.slice(5, 15).toLowerCase()}-${task.slug}`;
         let baseCommit;
         let taskBranch;
+        const authorizedBaseCommit = executionAuthorization.mechanicalFeasibility?.sourceKind === 'pre-start-base'
+            ? executionAuthorization.mechanicalFeasibility.evaluatedHead
+            : null;
         if (workspaceOwner === 'local') {
-            baseCommit = startLocalTaskBranch(identity.repositoryRoot, branch, task.baseBranch);
+            baseCommit = startLocalTaskBranch(identity.repositoryRoot, branch, task.baseBranch, authorizedBaseCommit);
             taskBranch = branch;
         }
         else {
             baseCommit = runGit(identity.repositoryRoot, ['rev-parse', task.baseBranch]);
+            if (authorizedBaseCommit !== null && baseCommit !== authorizedBaseCommit) {
+                throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Task start base moved after execution authorization.', {
+                    baseBranch: task.baseBranch,
+                    authorizedBaseCommit,
+                    currentBaseCommit: baseCommit,
+                });
+            }
             taskBranch = currentBranch(identity.repositoryRoot);
             if (!taskBranch || taskBranch === task.baseBranch) {
                 throw new WorkflowError('GIT_PRECONDITION_FAILED', `Externally owned execution requires a dedicated branch different from ${task.baseBranch}.`);
@@ -1668,7 +1743,7 @@ export class WorkflowService {
         if (!['ready', 'in_progress', 'needs_fix'].includes(task.status)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} cannot run a Step while ${task.status}.`);
         }
-        this.assertExecutionAuthorizationFresh(task);
+        this.assertExecutionAuthorizationFresh(task, context.identity.repositoryRoot);
         const currentPlanBlockingDecisions = readCorrectiveDecisionEvents(this.store, task)
             .filter((event) => event.planHash === task.planHash && event.decision !== 'continue-fix');
         if (currentPlanBlockingDecisions.length > 0) {
@@ -2304,7 +2379,7 @@ export class WorkflowService {
         if (!['ready', 'in_progress', 'needs_fix'].includes(task.status)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} cannot recover a corrective decision while ${task.status}.`);
         }
-        this.assertExecutionAuthorizationFresh(task);
+        this.assertExecutionAuthorizationFresh(task, context.identity.repositoryRoot);
         this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
         return appendCorrectiveDecisionRecovery(this.store, task, stepId, expectedRevision, actor, writerToken, this.now());
     }
@@ -2315,6 +2390,47 @@ export class WorkflowService {
         this.requireExecutionAdoptionPosture(context.identity, taskId);
         return appendRemediationModeRecovery(this.store, task, stepId, expectedRevision, actor, writerToken, this.now());
     }
+    recoverPlanIntegrity(repository, taskId, stepId, expectedRevision, actor, writerToken) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        this.requireExecutionAdoptionPosture(context.identity, taskId);
+        this.assertExecutionAuthorizationFresh(task, context.identity.repositoryRoot);
+        this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
+        assertTaskBranch(context.identity.repositoryRoot, task);
+        this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
+        this.assertTaskMutationAllowedByHandoff(task, actor, writerToken);
+        const handoff = readTaskC1Posture(this.store, task);
+        const requiredActor = handoff.state === 'claimed'
+            ? handoff.claimant
+            : defaultPlanIntegrityRecoveryActor(task.id);
+        if (actor.trim() !== requiredActor) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Plan-integrity recovery actor does not match the fresh Workflow route.', {
+                taskId,
+                stepId,
+                requiredActor,
+                actualActor: actor.trim(),
+            });
+        }
+        const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        if (!planRiskAudit || !isStepReviewRequired(task, stepId, planRiskAudit.reviewRequiredStepIds)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Plan-integrity recovery requires the failed Step to be guarded by the current Plan Risk Audit.', {
+                taskId,
+                stepId,
+            });
+        }
+        const assessment = assessPlanIntegrityRecovery(this.store, context.identity.repositoryRoot, task, stepId);
+        if (!assessment.applicable || !assessment.eligible || !assessment.evidence) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Bounded Plan-integrity recovery is not eligible for the current Task state.', {
+                taskId,
+                stepId,
+                applicable: assessment.applicable,
+                blockers: assessment.blockers,
+            });
+        }
+        const event = appendPlanIntegrityRecoveryDecision(this.store, task, stepId, defaultPlanIntegrityRecoveryActor(task.id), assessment.evidence, this.now());
+        return { assessment, event };
+    }
     recordStepCorrectiveDecision(repository, taskId, stepId, expectedRevision, correctiveAudit, actor, writerToken = null) {
         const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
@@ -2693,6 +2809,13 @@ export class WorkflowService {
             if (!task)
                 throw new WorkflowError('STATE_CORRUPT', `Milestone member ${membership.taskId} does not exist.`);
             const stepsCompleted = task.steps.filter((step) => ['completed', 'skipped'].includes(step.status)).length;
+            const dependency = assessMilestoneTaskDependencies(milestone, task.id, (candidateTaskId) => {
+                const candidate = tasksById.get(candidateTaskId);
+                if (!candidate)
+                    throw new WorkflowError('NOT_FOUND', `Task ${candidateTaskId} was not found.`);
+                return candidate;
+            });
+            const executionEligible = milestone.status === 'active' && !['merged', 'cancelled'].includes(task.status);
             return {
                 ordinal: `T${String(index + 1).padStart(2, '0')}`,
                 taskId: task.id,
@@ -2701,6 +2824,15 @@ export class WorkflowService {
                 revision: task.revision,
                 disposition: membership.disposition,
                 membershipReason: membership.reason,
+                dependencyState: dependency.dependencyState,
+                dependsOnTaskIds: dependency.dependsOnTaskIds,
+                unsatisfiedPredecessors: dependency.unsatisfiedPredecessors,
+                runnable: executionEligible && dependency.runnable,
+                dependencyBlockReason: !executionEligible
+                    ? milestone.status !== 'active'
+                        ? `Milestone is ${milestone.status}, not active.`
+                        : `Task is terminal (${task.status}).`
+                    : dependency.blockReason,
                 replacementForTaskId: task.replacementForTaskId ?? null,
                 replacedByTaskId: task.replacedByTaskId ?? null,
                 stepsCompleted,
@@ -3030,21 +3162,34 @@ export class WorkflowService {
         const repositoryRoot = resolveRepositoryIdentity(repository).repositoryRoot;
         const inspectCurrentKnowledgeMap = () => inspectKnowledgeMap(this.store.readKnowledgeMap(status.projectId), scanProjectKnowledge(repositoryRoot, status.projectId, this.now()));
         const milestonesById = new Map(status.milestones.map((milestone) => [milestone.id, milestone]));
+        const tasksById = new Map(status.tasks.map((task) => [task.id, task]));
         const requestedTask = taskId === null
             ? null
             : status.tasks.find((task) => task.id === taskId) ?? null;
         if (taskId !== null && !requestedTask) {
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
         }
-        if (requestedTask && !taskIsActionableFromRepositoryNext(requestedTask, milestonesById)) {
+        if (requestedTask && !taskIsActionableFromRepositoryNext(requestedTask, milestonesById, tasksById)) {
+            const requestedMilestone = requestedTask.milestoneId
+                ? milestonesById.get(requestedTask.milestoneId) ?? null
+                : null;
+            const dependency = requestedMilestone
+                ? assessMilestoneTaskDependencies(requestedMilestone, requestedTask.id, (candidateTaskId) => {
+                    const candidate = tasksById.get(candidateTaskId);
+                    if (!candidate)
+                        throw new WorkflowError('NOT_FOUND', `Task ${candidateTaskId} was not found.`);
+                    return candidate;
+                })
+                : null;
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${requestedTask.id} is not actionable from repository next.`, {
                 taskId: requestedTask.id,
                 taskStatus: requestedTask.status,
                 milestoneId: requestedTask.milestoneId,
+                ...(dependency ? { dependency } : {}),
             });
         }
         const activeTask = requestedTask
-            ?? status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
+            ?? status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById, tasksById));
         if (activeTask) {
             const dependencyRecovery = this.dependencyProvenanceRecoveryPreflight(repositoryRoot, activeTask.id);
             if (dependencyRecovery.eligible) {
@@ -3109,7 +3254,7 @@ export class WorkflowService {
             const taskNext = activeTask.status === 'planning'
                 ? null
                 : planRiskAuditRecovery
-                    ?? this.nextForTaskWithDelegation(status.projectId, activeTask, activePlanRiskAudit);
+                    ?? this.nextForTaskWithDelegation(status.projectId, repositoryRoot, activeTask, activePlanRiskAudit);
             // Active Step work must outrank Project Knowledge refresh/rebind. Both completion and
             // strict review are executable while context refresh correctly remains forbidden.
             const hardStop = taskNext?.action === 'task corrective-decision'
@@ -3118,6 +3263,8 @@ export class WorkflowService {
             if (taskNext?.action === 'task step-complete'
                 || taskNext?.action === 'task step-review'
                 || taskNext?.action === 'task remediation-mode-recover'
+                || taskNext?.action === 'task plan-integrity-recover'
+                || taskNext?.blockedAction === 'task plan-integrity-recover'
                 || hardStop
                 || terminalCorrectiveDecision === 'split-required'
                 || terminalCorrectiveDecision === 'stop-escalate') {
@@ -3216,7 +3363,7 @@ export class WorkflowService {
                     knowledgeMapHash,
                 }));
             }
-            return withAdoption(withMilestoneCancellation(taskNext ?? this.nextForTaskWithDelegation(status.projectId, activeTask, null)));
+            return withAdoption(withMilestoneCancellation(taskNext ?? this.nextForTaskWithDelegation(status.projectId, repositoryRoot, activeTask, null)));
         }
         let repositoryKnowledgeMap;
         try {
@@ -3351,7 +3498,21 @@ export class WorkflowService {
                                 .filter((membership) => membership.disposition === 'required')
                                 .map((membership) => {
                                 const task = status.tasks.find((candidate) => candidate.id === membership.taskId);
-                                return { taskId: membership.taskId, status: task?.status ?? 'missing' };
+                                const dependency = assessMilestoneTaskDependencies(activeMilestone, membership.taskId, (candidateTaskId) => {
+                                    const candidate = status.tasks.find((taskCandidate) => taskCandidate.id === candidateTaskId);
+                                    if (!candidate)
+                                        throw new WorkflowError('NOT_FOUND', `Task ${candidateTaskId} was not found.`);
+                                    return candidate;
+                                });
+                                return {
+                                    taskId: membership.taskId,
+                                    status: task?.status ?? 'missing',
+                                    dependencyState: dependency.dependencyState,
+                                    dependsOnTaskIds: dependency.dependsOnTaskIds,
+                                    unsatisfiedPredecessors: dependency.unsatisfiedPredecessors,
+                                    runnable: Boolean(task && !['merged', 'cancelled'].includes(task.status) && dependency.runnable),
+                                    dependencyBlockReason: dependency.blockReason,
+                                };
                             }),
                         },
                     }
@@ -3474,7 +3635,21 @@ export class WorkflowService {
             }
         }
     }
-    nextForTaskWithDelegation(projectId, task, planRiskAudit = null) {
+    currentMilestoneDependencyBinding(milestone, taskId) {
+        assertMilestoneTaskRunnable(milestone, taskId, (candidateTaskId) => this.store.readTask(milestone.projectId, candidateTaskId));
+        if (!milestone.planHash) {
+            throw new WorkflowError('STATE_CORRUPT', `Active Milestone ${milestone.id} has no Plan hash.`, {
+                milestoneId: milestone.id,
+                taskId,
+            });
+        }
+        return {
+            milestoneRevision: milestone.revision,
+            membershipRevision: milestone.membershipRevision,
+            milestonePlanHash: milestone.planHash,
+        };
+    }
+    nextForTaskWithDelegation(projectId, repositoryRoot, task, planRiskAudit = null) {
         const transition = task.status === 'awaiting_execution_authorization'
             ? 'task.execution_authorize'
             : task.status === 'awaiting_final_acceptance'
@@ -3510,7 +3685,59 @@ export class WorkflowService {
             }
         }
         const next = this.taskGitNavigationOverride(task) ?? nextForTask(task);
+        let mechanicalFeasibilityOverlay = {};
+        if (task.status === 'awaiting_execution_authorization' && task.planHash) {
+            try {
+                const taskRoot = this.store.taskRoot(projectId, task.id);
+                const briefHash = this.store.hashArtifact(taskRoot, 'brief.md');
+                const planHash = this.store.hashArtifact(taskRoot, 'plan.md');
+                if (task.briefHash !== briefHash || task.planHash !== planHash) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Task Plan authority does not match its stored artifacts.', {
+                        taskId: task.id,
+                        stateBriefHash: task.briefHash,
+                        artifactBriefHash: briefHash,
+                        statePlanHash: task.planHash,
+                        artifactPlanHash: planHash,
+                    });
+                }
+                const mechanicalFeasibility = evaluateMechanicalFeasibility(repositoryRoot, task, briefHash, planHash);
+                mechanicalFeasibilityOverlay = mechanicalFeasibility.decision === 'blocked'
+                    ? {
+                        action: 'task plan-set',
+                        blockedAction: 'task authorize',
+                        mechanicalFeasibility,
+                        mechanicalFeasibilityGate: {
+                            state: 'blocked',
+                            diagnosticCode: 'MECHANICAL_PLAN_INFEASIBILITY',
+                            requiredAction: 'Replace the current Plan through task plan-set, then request fresh execution authorization.',
+                        },
+                    }
+                    : {
+                        mechanicalFeasibility,
+                        mechanicalFeasibilityGate: {
+                            state: 'clear',
+                            meaning: 'No supported analyzer proved infeasibility; semantic sufficiency is not asserted.',
+                        },
+                    };
+            }
+            catch (error) {
+                mechanicalFeasibilityOverlay = {
+                    action: 'doctor',
+                    blockedAction: 'task authorize',
+                    mechanicalFeasibilityGate: {
+                        state: 'unavailable',
+                        diagnosticCode: error instanceof WorkflowError ? error.code : 'UNKNOWN_ERROR',
+                        reason: error instanceof Error ? error.message : String(error),
+                        requiredAction: 'Restore the exact Plan/source authority before execution authorization.',
+                    },
+                };
+            }
+        }
         const handoffPosture = readTaskC1Posture(this.store, task);
+        const failedStep = task.steps.find((step) => step.status === 'failed') ?? null;
+        const planIntegrityAssessment = !remediationModeRecovery && planRiskAudit && failedStep
+            ? assessPlanIntegrityRecovery(this.store, repositoryRoot, task, failedStep.id)
+            : null;
         const strictStepReviewStep = planRiskAudit
             ? task.steps.find((step) => {
                 if (step.status !== 'in_progress' || !step.evidence || !planRiskAudit.reviewRequiredStepIds.includes(step.id)) {
@@ -3623,6 +3850,39 @@ export class WorkflowService {
                 };
         };
         let guardedCorrectiveOverlay = {};
+        if (planIntegrityAssessment?.applicable) {
+            const requiredActor = handoffPosture.state === 'claimed'
+                ? handoffPosture.claimant
+                : defaultPlanIntegrityRecoveryActor(task.id);
+            guardedCorrectiveOverlay = planIntegrityAssessment.eligible
+                ? {
+                    action: 'task plan-integrity-recover',
+                    blockedAction: 'task run',
+                    stepId: planIntegrityAssessment.stepId,
+                    planIntegrityRecovery: {
+                        state: 'eligible',
+                        reasonCode: 'MISSING_NPM_SCRIPT_OUTSIDE_ALLOWED_WRITES',
+                        expectedRevision: task.revision,
+                        requiredActor,
+                        evidence: planIntegrityAssessment.evidence,
+                        boundedEffect: 'record-replan-required-decision',
+                        preservesWorktree: true,
+                    },
+                }
+                : {
+                    action: 'doctor',
+                    blockedAction: 'task plan-integrity-recover',
+                    stepId: planIntegrityAssessment.stepId,
+                    planIntegrityRecovery: {
+                        state: 'blocked',
+                        reasonCode: 'PLAN_INTEGRITY_RECOVERY_BLOCKED',
+                        expectedRevision: task.revision,
+                        requiredActor,
+                        blockers: planIntegrityAssessment.blockers,
+                        evidence: planIntegrityAssessment.evidence,
+                    },
+                };
+        }
         if (remediationModeRecovery) {
             guardedCorrectiveOverlay = {
                 action: 'task remediation-mode-recover',
@@ -3726,13 +3986,29 @@ export class WorkflowService {
                     {
                         const replacementDiscoveries = this.store.listDiscoveries(projectId)
                             .filter((discovery) => discovery.status === 'ready_to_materialize');
-                        const replacementDiscovery = replacementDiscoveries.length === 1 ? replacementDiscoveries[0] : null;
                         const replacementMilestone = task.milestoneId
                             ? this.store.readMilestone(projectId, task.milestoneId)
                             : null;
+                        const incidentDependencies = replacementMilestone
+                            ? replacementMilestone.memberships.flatMap((membership) => {
+                                if (!Array.isArray(membership.dependsOnTaskIds))
+                                    return [];
+                                return [
+                                    ...(membership.taskId === task.id
+                                        ? membership.dependsOnTaskIds.map((predecessorTaskId) => ({
+                                            predecessorTaskId,
+                                            consumerTaskId: membership.taskId,
+                                        }))
+                                        : []),
+                                    ...(membership.dependsOnTaskIds.includes(task.id)
+                                        ? [{ predecessorTaskId: task.id, consumerTaskId: membership.taskId }]
+                                        : []),
+                                ];
+                            })
+                            : [];
                         guardedCorrectiveOverlay = {
-                            action: replacementDiscovery ? 'task replacement-materialize' : 'discovery start',
-                            ...(replacementDiscovery ? {} : { blockedAction: 'task replacement-materialize' }),
+                            action: 'doctor',
+                            blockedAction: 'task replacement-materialize',
                             stepId: guardedCorrectivePosture.stepId,
                             correctiveDecisionGate: {
                                 attemptCount: guardedCorrectivePosture.attemptCount,
@@ -3746,29 +4022,17 @@ export class WorkflowService {
                                 requiredDiscoveryStatus: 'ready_to_materialize',
                                 oldMembershipDisposition: 'cancelled',
                                 replacementMembershipDisposition: 'required',
-                                transaction: 'journal-recoverable',
+                                transaction: 'disabled',
+                                retainedImplementation: 'journal-recoverable-1-to-1',
+                                diagnosticCode: 'STRUCTURAL_REPLACEMENT_REQUIRED',
+                                structuralReplacementAvailable: false,
+                                incidentDependencies,
                                 discoveryCandidates: replacementDiscoveries.map((discovery) => ({
                                     id: discovery.id,
                                     revision: discovery.revision,
                                     goal: discovery.goal,
                                 })),
-                                ...(replacementDiscovery && replacementMilestone
-                                    ? {
-                                        exactTransition: {
-                                            command: 'task replacement-materialize',
-                                            taskId: task.id,
-                                            expectedTaskRevision: task.revision,
-                                            discoveryId: replacementDiscovery.id,
-                                            expectedDiscoveryRevision: replacementDiscovery.revision,
-                                            milestoneId: replacementMilestone.id,
-                                            expectedMilestoneRevision: replacementMilestone.revision,
-                                        },
-                                    }
-                                    : {
-                                        requiredAction: replacementDiscoveries.length === 0
-                                            ? 'Create and complete one thin replacement Discovery, then run next again.'
-                                            : 'Select exactly one ready replacement Discovery explicitly; next will not guess between candidates.',
-                                    }),
+                                requiredAction: 'Materialize P04-B/P05 before replacing this split-required Task.',
                             },
                         };
                     }
@@ -3854,6 +4118,7 @@ export class WorkflowService {
                 }
                 : {}),
             ...guardedCorrectiveOverlay,
+            ...mechanicalFeasibilityOverlay,
             ...(delegatedApprovalOptions.length > 0 ? { delegatedApprovalOptions } : {}),
         };
         if (handoffPosture.state === 'pending') {
@@ -3967,8 +4232,9 @@ export class WorkflowService {
         }));
     }
     findDelegatedContextRefreshOwner(projectId, tasks, milestonesById, approved, inspected) {
+        const tasksById = new Map(tasks.map((task) => [task.id, task]));
         for (const task of tasks) {
-            if (!taskIsActionableFromRepositoryNext(task, milestonesById)
+            if (!taskIsActionableFromRepositoryNext(task, milestonesById, tasksById)
                 || !task.planHash
                 || !taskCanRebindKnowledge(task)
                 || this.taskHasTerminalCorrectiveDecision(task))
@@ -4007,7 +4273,7 @@ export class WorkflowService {
         if (policy.scope.kind === 'milestone')
             this.store.readMilestone(projectId, policy.scope.id);
     }
-    assertExecutionAuthorizationFresh(task) {
+    assertExecutionAuthorizationFresh(task, repositoryRoot) {
         const root = this.store.taskRoot(task.projectId, task.id);
         const authorization = [...task.authorizations]
             .reverse()
@@ -4016,14 +4282,35 @@ export class WorkflowService {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Execution authorization is missing.');
         const briefHash = this.store.hashArtifact(root, 'brief.md');
         const planHash = this.store.hashArtifact(root, 'plan.md');
-        if (authorization.briefHash !== briefHash || authorization.planHash !== planHash) {
+        if (authorization.briefHash !== briefHash
+            || authorization.planHash !== planHash
+            || task.briefHash !== briefHash
+            || task.planHash !== planHash) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Execution authorization is stale.', {
                 authorizedBriefHash: authorization.briefHash,
                 currentBriefHash: briefHash,
                 authorizedPlanHash: authorization.planHash,
                 currentPlanHash: planHash,
+                stateBriefHash: task.briefHash,
+                statePlanHash: task.planHash,
+            });
+        }
+        const mechanicalFeasibility = authorization.mechanicalFeasibility;
+        if (!mechanicalFeasibility)
+            return authorization;
+        const evidenceHash = hashMechanicalFeasibilityEvidence(mechanicalFeasibility);
+        if (authorization.evidenceHash !== evidenceHash
+            || authorization.headCommit !== mechanicalFeasibility.evaluatedHead) {
+            throw new WorkflowError('STATE_CORRUPT', 'Mechanical-feasibility evidence does not match its authorization event.', {
+                taskId: task.id,
+                authorizedEvidenceHash: authorization.evidenceHash,
+                currentEvidenceHash: evidenceHash,
+                authorizedHeadCommit: authorization.headCommit,
+                evaluatedHead: mechanicalFeasibility.evaluatedHead,
             });
         }
+        assertMechanicalFeasibilityFresh(repositoryRoot, task, mechanicalFeasibility, briefHash, planHash);
+        return authorization;
     }
     assertMilestoneAuthorizationFresh(milestone) {
         const authorization = [...milestone.authorizations]
@@ -4744,12 +5031,25 @@ function validateMilestonePlan(plan) {
     if (plan.acceptance.length === 0 || plan.acceptance.some((value) => !value.trim())) {
         throw new WorkflowError('INVALID_ARGUMENT', 'Milestone acceptance must contain substantive entries.');
     }
-    if (plan.memberships.length === 0) {
+    if (!Array.isArray(plan.memberships) || plan.memberships.length === 0) {
         throw new WorkflowError('INVALID_ARGUMENT', 'Milestone requires at least one Task membership.');
     }
     for (const membership of plan.memberships) {
-        if (!membership.taskId.trim())
+        if (!membership || typeof membership !== 'object' || Array.isArray(membership)) {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Milestone membership must be an object.');
+        }
+        if (typeof membership.taskId !== 'string' || !membership.taskId.trim()) {
             throw new WorkflowError('INVALID_ARGUMENT', 'Milestone membership requires Task ID.');
+        }
+        if (typeof membership.reason !== 'string') {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Milestone membership reason must be a string.');
+        }
+        if (!Array.isArray(membership.dependsOnTaskIds)) {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Every Milestone membership must declare dependsOnTaskIds explicitly.');
+        }
+        if (membership.dependsOnTaskIds.some((taskId) => typeof taskId !== 'string' || !taskId.trim())) {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Milestone dependency IDs must be non-empty strings.');
+        }
         if (membership.disposition !== 'required' && !membership.reason.trim()) {
             throw new WorkflowError('INVALID_ARGUMENT', `Milestone ${membership.disposition} membership requires a reason.`);
         }
@@ -4779,7 +5079,7 @@ function taskCanRebindKnowledge(task) {
         'awaiting_final_acceptance',
     ].includes(task.status);
 }
-function taskIsActionableFromRepositoryNext(task, milestonesById) {
+function taskIsActionableFromRepositoryNext(task, milestonesById, tasksById) {
     if (task.status === 'merged' || task.status === 'cancelled')
         return false;
     if (!task.milestoneId)
@@ -4787,10 +5087,18 @@ function taskIsActionableFromRepositoryNext(task, milestonesById) {
     const milestone = milestonesById.get(task.milestoneId);
     if (!milestone)
         return false;
-    if (taskHasStarted(task))
-        return !['accepted', 'cancelled'].includes(milestone.status);
-    const membership = milestone.memberships.find((candidate) => candidate.taskId === task.id);
-    return milestone.status === 'active' && membership?.disposition === 'required';
+    if (milestone.status !== 'active')
+        return false;
+    const assessment = assessMilestoneTaskDependencies(milestone, task.id, (candidateTaskId) => {
+        const candidate = tasksById.get(candidateTaskId);
+        if (!candidate)
+            throw new WorkflowError('NOT_FOUND', `Task ${candidateTaskId} was not found.`);
+        return candidate;
+    });
+    return assessment.runnable;
+}
+function structuralReplacementIsDisabled() {
+    return true;
 }
 function milestoneFinalAcceptanceGate(milestone, headCommit) {
     if (!milestone.resultHash || !milestone.evidenceHash) {
@@ -4920,6 +5228,7 @@ function writerTokenContractForAction(action, claimedC1Posture = false) {
         'task review-sealed-record',
         'task corrective-decision-recover',
         'task remediation-mode-recover',
+        'task plan-integrity-recover',
         'task corrective-decision',
         'task corrective-yield',
         'task handoff',