codex-workflow-v2 2.0.0-beta.12.13 → 2.0.0-beta.12.15

package/docs/pdf/sources/codex-workflow-v2-architecture-ru.md

@@ -1,10 +1,10 @@
 ---
-title: Codex Workflow V2: архитектура beta.12.13
+title: Codex Workflow V2: архитектура beta.12.15
 subtitle: Источники истины, lifecycle, роли, delegation, зависимости Tasks и границы доверия
 part: Часть 1 из 3 | Архитектура
 document_version: 2.0
 date: 31 августа 2026
-subject: Архитектура и границы Codex Workflow V2 beta.12.13
+subject: Архитектура и границы Codex Workflow V2 beta.12.15
 ---
 
 # 1. Назначение и граница системы
@@ -18,7 +18,7 @@ Codex Workflow V2 - локальный state machine поверх Codex App, Git
 Система рассчитана на одного пользователя и одну машину. Она не предоставляет distributed locking,
 криптографическую идентификацию actor string или безопасную синхронизацию state между компьютерами.
 
-## 1.1. Что beta.12.13 гарантирует
+## 1.1. Что beta.12.15 гарантирует
 
 - exact project-local npm package и совместимый handshake до lifecycle действий;
 - Discovery до materialization Task или Milestone;
@@ -41,7 +41,7 @@ Codex Workflow V2 - локальный state machine поверх Codex App, Git
   один additive remediation Task без нового Human gate; Core сохраняет Milestone semantics и выводит
   authority из текущей Milestone authorization и exact audit evidence.
 
-## 1.2. Что beta.12.13 не гарантирует
+## 1.2. Что beta.12.15 не гарантирует
 
 - правильность продуктовой идеи или автоматически выбранного provider Task;
 - semantic sufficiency Plan, если точные факты нельзя доказать поддерживаемым analyzer;
@@ -323,13 +323,19 @@ manifest/runner hashes, HEAD и dirty allowlist. Exact beta.12.11 update bridge
 Результат — один `replan-required` decision и обычный corrective replan с исполняемой check command;
 повтор старой команды, ручной commit product files и state editing не допускаются.
 
-beta.12.13 устраняет следующий доказанный разрыв этого пути. Corrective-replan credential раздельно
+beta.12.15 устраняет следующий доказанный разрыв этого пути. Corrective-replan credential раздельно
 связывает исходную Knowledge revision/hash Task и целевую active Knowledge revision/hash replacement
 Plan. Различие разрешено только при exact Plan-integrity dependency recovery: текущий system commit,
 package version, failed Step, Plan, полная remediation history, dirty file set и их bytes должны
-совпасть. Следующее dependency-only обновление после corrective yield может перенести ту же compatibility
-на новый HEAD только при точном parent commit и неизменном worktree. Completed corrective-yield journal
+совпасть. Один или несколько последовательных dependency-only updates после corrective yield могут
+перенести ту же compatibility на новый HEAD: Core идёт назад до последнего зарегистрированного system
+commit, проверяет каждый промежуточный commit как exact manifest/lock-only Workflow pin update и
+атомарно регистрирует всю цепочку. Любой product diff, разрыв parent chain или изменённый worktree
+fail-closed. Completed corrective-yield journal
 остаётся историческим prefix-доказательством и не блокирует последующие append-only handoff events.
+Completed corrective-replan journal также остаётся читаемым после эволюции binding manifest, но только
+если его завершённый manifest/runtime/catalog tuple есть в append-only historical registry. Pending и
+неизвестные identity по-прежнему fail-closed, поэтому compatibility не выдаёт новую authority.
 
 Docker socket `EPERM` в sandbox не является доказательством сломанного daemon. Gateway один раз
 повторяет exact health probe или Plan check с sandbox escalation без расходования remediation attempt.
@@ -340,7 +346,7 @@ Restart Docker Desktop требует отдельного разрешения
 # 10. Operational checklist
 
 - exact package version установлен, bundled gateway соответствует release и переустановлен;
-- handshake подтверждает protocol 2, state schema 2 и beta.12.13 capabilities;
+- handshake подтверждает protocol 2, state schema 2 и beta.12.15 capabilities;
 - каждый mutation следует свежему `status -> next` и exact option contract;
 - Docker permission failure сначала классифицируется как sandbox boundary, а не как infra retry;
 - semantic unknowns и human gates не маскируются delegation;

package/docs/pdf/sources/codex-workflow-v2-chat-only-guide-ru.md

@@ -1,13 +1,13 @@
 ---
 title: Codex Workflow V2: delegated chat-only guide
-subtitle: Актуальный beta.12.13 путь от нового Discovery до принятого Milestone без ручного CLI
+subtitle: Актуальный beta.12.15 путь от нового Discovery до принятого Milestone без ручного CLI
 part: Часть 2 из 3 | Практика
 document_version: 2.0
 date: 31 августа 2026
-subject: Практическое руководство по delegated Discovery и Milestone в Workflow V2 beta.12.13
+subject: Практическое руководство по delegated Discovery и Milestone в Workflow V2 beta.12.15
 ---
 
-# 1. Рабочая модель beta.12.13
+# 1. Рабочая модель beta.12.15
 
 Пользователь работает в одном Codex Project и формулирует продуктовый outcome. Coordinator выполняет
 CLI, создаёт отдельные Task/Reviewer chats и ведёт supervision loop. Workflow Core остаётся authority
@@ -40,7 +40,7 @@ Blocking unknown, scope change, grant issuance или unrecoverable integrity co
 # 2. Подготовка проекта перед новым Discovery
 
 1. Убедитесь, что checkout чистый и выбран правильный repository root.
-2. Установите beta.12.13 как точную devDependency после публикации release.
+2. Установите beta.12.15 как точную devDependency после публикации release.
 3. Обновите и переустановите bundled `codex-workflow-gateway` этого release.
 4. Проверьте, что declared и installed package versions равны.
 5. Запустите новый Coordinator chat, не fork старого Milestone conversation.
@@ -56,7 +56,7 @@ AGENTS.md
 -> doctor только как дополнительная диагностика
 ```
 
-Handshake beta.12.13 должен сообщать `packageVersion=2.0.0-beta.12.13`, `protocolVersion=2`,
+Handshake beta.12.15 должен сообщать `packageVersion=2.0.0-beta.12.15`, `protocolVersion=2`,
 `stateSchemaVersion=2`, dependency DAG, initial Plan transaction, mechanical feasibility,
 Milestone autonomy и structural replacement disabled capabilities.
 
@@ -117,7 +117,7 @@ delegate, scope, transitions и expiry. DGR передаётся только е
 ```text
 НОВЫЙ COORDINATOR CHAT
 
-Проведи новый Milestone через Codex Workflow V2 beta.12.13 в delegated режиме.
+Проведи новый Milestone через Codex Workflow V2 beta.12.15 в delegated режиме.
 Repository: <ABSOLUTE-REPOSITORY-ROOT>.
 Milestone ID: AUTO.
 Delegate actor: agent:milestone-coordinator.
@@ -360,10 +360,17 @@ Knowledge refresh. Затем выполните advertised credential recovery,
 `task corrective-yield`. Replacement Plan меняет только неисполняемую check на
 `npm run validate:affected -- --files=<Step allowedWrites>` и проходит fresh Plan Risk Audit до нового run.
 
-Если update произошёл уже после `task corrective-yield`, beta.12.13 допускает только advertised
-`update plan-integrity-dependency-recover`: parent должен быть предыдущим зарегистрированным recovery
-commit, а failed Step, Plan, remediation IDs, dirty paths и dirty SHA-256 — полностью совпадать. После
-recovery снова запросите `status -> next`; ожидаемый route остаётся `task corrective-replan-prepare`.
+Если update произошёл уже после `task corrective-yield`, beta.12.15 допускает только advertised
+`update plan-integrity-dependency-recover`. Между последним зарегистрированным recovery commit и HEAD
+может быть один или несколько пропущенных package updates, но каждый обязан менять ровно
+`package.json`/`package-lock.json`, только exact Workflow pin и образовывать непрерывную parent chain.
+Core атомарно регистрирует всю доказанную цепочку; failed Step, Plan, remediation IDs, dirty paths и
+dirty SHA-256 должны полностью совпадать. После recovery снова запросите `status -> next`; ожидаемый
+route остаётся `task corrective-replan-prepare`.
+Если новый package сначала сообщает `TASK_TRANSACTION_INTEGRITY_FAILED` только для terminal
+corrective-replan journals предыдущего release, не repair/delete/edit state. beta.12.15 читает лишь
+точно зарегистрированные completed manifest/runtime/catalog tuples; pending либо неизвестный tuple
+остаётся блокером. После установки обязательно повторите handshake и последовательные `status -> next`.
 
 Для exact beta.12.6 stranded-replan shape сначала нужен eligible read-only source preflight с exact
 revision/HEAD/dirty hash. Затем два beta.12.7 dependency-only commits и advertised dependency/replan
@@ -397,7 +404,7 @@ Task/project DGR. `dependencyBinding` для standalone handoff равен null.
 
 # 14. Итоговый checklist пользователя
 
-- beta.12.13 exact package и новый bundled gateway установлены;
+- beta.12.15 exact package и новый bundled gateway установлены;
 - новый Coordinator chat не является fork старого Milestone;
 - bootstrap DGR, если нужен, выдан отдельным exact human confirmation;
 - Discovery не materialized при blocking unknowns;

package/docs/pdf/sources/codex-workflow-v2-technical-reference-ru.md

@@ -1,10 +1,10 @@
 ---
-title: Codex Workflow V2: технический справочник beta.12.13
+title: Codex Workflow V2: технический справочник beta.12.15
 subtitle: Protocol 2, state schema 2, transactions, credentials, dependency authority, review и recovery
 part: Часть 3 из 3 | Technical reference
 document_version: 2.0
 date: 31 августа 2026
-subject: Технический контракт Codex Workflow V2 beta.12.13
+subject: Технический контракт Codex Workflow V2 beta.12.15
 ---
 
 # 1. Runtime contract
@@ -13,9 +13,9 @@ Workflow V2 предоставляет локальные revisioned transitions
 и `value` либо структурированную ошибку с `code`, `message` и `details`. Chat, PDF и gateway не создают
 authority сами: mutating permission определяется runtime state и свежим `next`.
 
-| Параметр beta.12.13 | Значение |
+| Параметр beta.12.15 | Значение |
 |---|---|
-| npm package | `codex-workflow-v2@2.0.0-beta.12.13` |
+| npm package | `codex-workflow-v2@2.0.0-beta.12.15` |
 | protocolVersion | 2 |
 | stateSchemaVersion | 2 |
 | lifecycle epoch | 2 |
@@ -37,7 +37,7 @@ Gateway выполняет:
 5. вызов только package-local `dist/src/cli.js --repo <root>`;
 6. `gateway handshake` до lifecycle действий.
 
-Ключевые beta.12.13 capabilities:
+Ключевые beta.12.15 capabilities:
 
 | Группа | Capabilities |
 |---|---|
@@ -468,7 +468,7 @@ corrective-derived reconcile/approval; прочий drift fail-closed. Product b
 переносятся. Fresh route продолжается через credential replacement, `plan-integrity-recover`, yield и
 corrective replan с selector-bearing check.
 
-# 13.6. beta.12.13 source/target Knowledge binding
+# 13.6. beta.12.15 source/target Knowledge binding
 
 Corrective-replan receipt теперь включает две разные пары. `knowledgeRevision/knowledgeHash` связывает
 исходное состояние Task; `targetKnowledgeRevision/targetKnowledgeHash` связывает active Project
@@ -477,15 +477,25 @@ Knowledge Map и replacement Plan. Executor проверяет source под Tas
 
 Source и target могут различаться только при exact `dependencyProvenanceRecoveries.planIntegrity` для
 текущего HEAD и package version. Record обязан совпасть по Plan, failed Step, всей remediation event ID
-последовательности, dirty paths и повторно вычисленному dirty SHA-256. Для последовательного package
-update после corrective yield Core переносит compatibility лишь с зарегистрированного `HEAD^`; любое
-изменение product bytes, Step status, Plan, decision или C1 posture отключает route.
+последовательности, dirty paths и повторно вычисленному dirty SHA-256. После corrective yield Core может
+восстановить один или несколько ещё не зарегистрированных package updates: он просматривает trailing
+Git suffix от HEAD до последнего зарегистрированного system commit, проверяет каждый элемент как
+непрерывный manifest/lock-only exact Workflow pin update и одной Core mutation добавляет каждый commit
+и его фактическую package version в provenance history. Любое изменение product bytes, разрыв ancestry,
+Step status, Plan, decision или C1 posture отключает route.
 
 Completed corrective-yield transaction проверяет неизменный canonical yield event как prefix текущей
 append-only handoff history. Это сохраняет tamper detection, но разрешает новый handoff после успешного
 corrective replan. E2E release gate проходит prepare/confirm/execute, authorization, handoff/claim,
 selector-bearing Step completion commit и strict Step review.
 
+Completed corrective-replan transaction сохраняет authority identity своего release. Текущий manifest
+обязателен для любой pending/in-flight transaction; completed journal может использовать только exact
+tuple из append-only registry: manifest SHA-256, runtime fingerprint и catalog hash. Неизвестный tuple,
+legacy tuple у незавершённой transaction, повреждённый intent/phase chain или owned target остаётся
+`journal-invalid`. Это позволяет читать terminal beta.12.12 history после расширения binding manifest,
+не превращая legacy identity в новую execution authority.
+
 # 14. P04-A structural replacement boundary
 
 Command shape `task replacement-materialize` retained только для compatibility diagnostics. Любая попытка
@@ -548,7 +558,7 @@ Docker socket/CLI `EPERM`, `operation not permitted` или `permission denied`
 После каждой successful mutation обязателен sequential `status`, затем fresh `next`. Failed status/next
 не разрешает direct mutation. Syntax help read-only и не заменяет navigation authority.
 
-# 18. Public command surface beta.12.13
+# 18. Public command surface beta.12.15
 
 | Область | Actions |
 |---|---|
@@ -569,15 +579,17 @@ Docker socket/CLI `EPERM`, `operation not permitted` или `permission denied`
 Exact options берутся из fresh `next`; command help используется только когда
 `exactOptionContractAvailable=false` или syntax действительно неизвестен.
 
+<!-- pagebreak -->
+
 # 19. Release и package update gates
 
 Перед package update project-local `update preflight` должен вернуть `safe=true`: clean checkout, нет
 running Step и active/stale writer lease. Исключения — документированный alpha.7 rescue, beta.12.6
 active-downstream-proof bridge, beta.12.7 exact stranded-replan bridge, beta.12.9 historical-Step
-dependency bridge и beta.12.13 Plan-integrity bridge; все они fail-closed и не дают общего разрешения
+dependency bridge и beta.12.15 Plan-integrity bridge; все они fail-closed и не дают общего разрешения
 dirty update.
 
-Перед beta.12.13 tag обязательны `npm ci`, `npm run validate`, `npm run test:signal-remediation-e2e`, `npm run pack:check`,
+Перед beta.12.15 tag обязательны `npm ci`, `npm run validate`, `npm run test:signal-remediation-e2e`, `npm run pack:check`,
 `npm run smoke:downstream`, `npm run plugin:check`, official plugin/skill validators,
 `npm run docs:pdf:check`, `npm run release:check` с exact tag binding и validation
 append-only real-agent lifecycle log.

package/docs/validation-report.md

@@ -1,134 +1,107 @@
-# V2 beta.12.13 Validation Report
+# V2 beta.12.15 Validation Report
 
-Release candidate `2.0.0-beta.12.13` was validated on 2026-08-31 (Europe/Moscow) with
+Release candidate `2.0.0-beta.12.15` was validated on 2026-08-31 (Europe/Moscow) with
 Node.js 24.17.0.
 
 ## Automated release evidence
 
-- `npm ci` completed from the exact lockfile; the audit reported zero vulnerabilities.
-- The first full `npm run validate` passed 346 of 348 tests. The only two failures were exact
-  transition-definition identity pins intentionally changed by the two new Knowledge fields: the
-  serialized definition SHA-256 and the binding-manifest row count. The derived serialized digest,
-  runtime fingerprint, runtime catalog hash, and row count were recorded from the actual compiled
-  model; the focused authority suite then passed `4/4`.
-- The mandatory clean rerun of `npm run validate` passed typecheck and `348/348` sequential tests
-  with no failures, skips, cancellations, or todos in 2,131,076.63 ms.
-- The full suite includes a beta.12.13 Signal-shaped E2E: repeated selector-contract failures,
-  beta.12.12-like dependency recovery, a second package-only update, carried exact compatibility,
-  corrective replan against the active Knowledge Map, fresh authorization/C1, selector-bearing
-  validation, a Core Step commit, and strict Step review. It also proves that changed dirty bytes
-  make the carry preflight fail closed.
-- `npm run test:signal-remediation-e2e` passed `2/2`; `npm run
-  test:signal-t03-replan-e2e` passed `1/1`; and `npm run test:signal-t04-recovery` passed `11/11`.
-  Together they independently cover audited upstream remediation through a later Step, the
-  Signal-shaped accidental-rebind/replan path, bounded dependency recovery, and retained reviewed
-  Step provenance.
-- Package dry-run produced `codex-workflow-v2-2.0.0-beta.12.13.tgz` with 281 files (approximately
-  1.1 MB packed and 4.3 MB unpacked). The first invocation encountered the known root-owned user npm
-  cache (`EPERM`); the exact retry passed with an isolated temporary cache and no system permission
-  changes.
-- `npm run smoke:downstream` built and installed that tarball in a disposable consumer project and
-  returned `ok=true`. The sandboxed attempt could not resolve npm (`ENOTFOUND`); the same command
-  passed with approved network access.
-- `npm run plugin:check` passed for bundled gateway `0.1.0+codex.20260830183000`.
-- `npm run docs:pdf:check` reported an empty stale set and exact beta.12.13 package binding.
-- `RELEASE_TAG=v2.0.0-beta.12.13 npm run release:check` and `git diff --check` passed.
+- A clean `npm ci` completed from the exact lockfile and reported zero vulnerabilities.
+- The first full `npm run validate` run passed every behavioral assertion except two diagnostics
+  whose text still described the superseded one-commit boundary. The messages were corrected without
+  changing transition behavior. The second full run passed typecheck and `349/349` sequential tests
+  with no failures, skips, cancellations or todos in 2,169,018.255 ms.
+- The focused dependency-provenance suite passed `11/11`. It covers a two-commit unregistered
+  dependency suffix, exact oldest-to-newest recovery, per-commit package-version provenance and
+  fail-closed product/payload/ancestry drift.
+- `npm run test:signal-t04-recovery` passed `11/11`; `npm run
+  test:signal-t03-replan-e2e` passed `1/1`; and `npm run test:signal-remediation-e2e` passed `2/2`.
+- Package dry-run passed with 281 files (approximately 1.1 MB packed and 4.3 MB unpacked).
+- Disposable downstream installation returned `ok=true` for the exact beta.12.15 tarball. The first
+  sandboxed run failed only because registry DNS was unavailable; the exact network-enabled retry
+  passed.
+- `npm run plugin:check` and `npm run docs:pdf:check` passed. PDF freshness reported an empty stale
+  set and exact beta.12.15 package binding.
+
+## Live Signal reproduction
+
+Signal Task `TASK-01M1B79C660YMNSRRZ236NTR1T` is blocked after a completed corrective yield. Its
+three allowlisted STEP-001 product files remain uncommitted and unchanged. The repository contains
+two consecutive Workflow dependency-only commits that Core could not register:
+
+- beta.12.13: `51e5e61b39ff9a234dcc9ccb80d81da710570f55`;
+- beta.12.14: `96c3bd22e818873c1de59cd42b466efde0947d23`.
+
+Fresh beta.12.14 observation is otherwise coherent: no pending or corrupt transactions and no active
+leases. Nevertheless, `next` advertised dependency recovery while its preflight rejected the route
+because it expected the current update commit's parent to be an already registered system commit.
+The beta.12.13 parent could not be registered earlier because the beta.12.13 transaction-observation
+defect prevented all workflow commands before beta.12.14 was installed.
+
+The beta.12.15 implementation was built locally and run read-only against this exact Signal state.
+Preflight returned `eligible=true`, action `update plan-integrity-dependency-recover`, and the exact
+two-commit chain above in oldest-to-newest order. No Signal state, journal, sidecar, Git history or
+product file was modified by this reproduction.
 
 ## Root cause corrected
 
-Signal Task `TASK-01M1B79C660YMNSRRZ236NTR1T` retained its three allowlisted Worker files and reached
-a legitimate `corrective-replan-prepare` route after beta.12.12 recovery. Preparation still failed:
-the Task source Plan remained bound to the older Project Knowledge Map, while the only admissible
-replacement Plan correctly bound the newer active map created by the package-only Knowledge refresh.
-The public corrective-replan path required those two bindings to be identical, so no candidate could
-satisfy both constraints.
-
-A further release update exposed two related continuity gaps:
-
-1. Plan-integrity dependency recovery could derive compatibility only from a currently detectable
-   invalid-check assessment. After the first recovery and `replan-required` decision, a second
-   package-only update could no longer reconstruct the already registered exact compatibility.
-2. A completed corrective-yield journal required the whole current handoff sidecar to equal the
-   yield-owned bytes forever. A later valid append-only handoff therefore made historical readback
-   fail even though the original yielded entry was intact.
-
-The defect was not insufficient Worker effort, an invalid product implementation, or a need to
-increase attempts. It was an over-constrained source/target Knowledge identity plus incomplete
-append-only continuity across consecutive Workflow updates.
-
-## Implemented lifecycle contract
-
-- Corrective-replan credentials now bind two distinct pairs. `knowledgeRevision`/`knowledgeHash`
-  identify the unchanged source Task/Plan state under the Core lock;
-  `targetKnowledgeRevision`/`targetKnowledgeHash` identify the active Project Knowledge Map that the
-  candidate Plan, new Plan Risk Audit, and materialized Task state must bind.
-- Source and target Knowledge may differ only when the Task contains one exact current
-  Plan-integrity dependency-provenance recovery. It must match the current HEAD and package version,
-  a Workflow-owned system commit, current Plan and failed Step, the complete remediation-event list,
-  exact dirty paths, and a freshly recomputed dirty-worktree hash. Otherwise preparation remains
-  fail closed.
-- A consecutive package-only update may carry compatibility from exactly one prior registered
-  recovery on `HEAD^`. Carry is admitted only when the current Task still has the same Plan, failed
-  Step, full remediation history, dirty paths and bytes, one `replan-required` decision, and no C1
-  posture. It cannot infer compatibility from prose or widen the product boundary.
-- The corrective-replan private credential schema and binding manifest contain 30 exact fields.
-  Their serialized definition digest, runtime semantic fingerprint, and runtime catalog hash are
-  pinned by the authority-model suite.
-- A completed corrective-yield journal now proves that its owned handoff bytes remain an exact prefix
-  of the current canonical append-only history and validates the entire current JSONL chain. Pending
-  and in-flight phases retain exact-byte equality. Truncation, prefix mutation, or malformed appended
-  history still fails closed.
-- Protocol and state schema remain `2/2`; no lifecycle-state migration is required.
-
-## Signal-shaped and negative evidence
-
-The new synthetic E2E reproduces the live boundary instead of testing a helper in isolation:
-
-- an active failed guarded Step with repeated selector-contract failures and three allowlisted dirty
-  product files;
-- an existing beta.12.12 Plan-integrity recovery and `replan-required` decision;
-- a subsequent exact package-only beta.12.13 update while the Task source Knowledge remains older
-  than the active Project Knowledge Map;
-- reconstruction of exact compatibility from `HEAD^` without modifying product bytes;
-- corrective replan whose source binding remains old and whose candidate target binding is current;
-- new execution authorization and C1 cycle;
-- the selector-bearing `validate:affected -- --files=...` check;
-- successful Step completion through a Workflow-owned Core commit and strict Step review.
-
-Negative coverage rejects changed dirty bytes, wider dirty scope, the wrong parent/system commit,
-stale Plan or Step, incomplete remediation history, a non-`replan-required` decision, active C1,
-unregistered Knowledge drift, truncated historical handoff bytes, mutated historical bytes, and
-malformed appended handoff history.
-
-Live Signal mutation remains post-publication work. Installation must preserve the three current
-Worker files, transport only package/lock through the advertised update compatibility route, use a
-fresh repository-local handshake/status/next before each mutation, and follow only Core-advertised
-actions. No manual Workflow-state edit, history rewrite, Task cancellation, duplicate Task, or
-replacement Milestone is authorized by this release.
+The beta.12.14 carried-compatibility and dependency-recovery logic assumed a single unregistered
+Workflow update at `HEAD`, with an already registered parent at `HEAD^`. That assumption is false
+when an earlier release was installable but its recovery route was unreachable because observation
+itself failed. Installing the observer fix then creates a bounded consecutive suffix of two
+unregistered dependency-only commits.
+
+The resulting blocker was not invalid Signal product work, a stale lease or corrupt Core state. It
+was an incomplete dependency-provenance boundary: navigation advertised a route that the route's own
+single-hop preflight could never accept.
+
+## Implemented compatibility contract
+
+- Preflight discovers the complete trailing unregistered suffix after the exact recorded Task
+  history instead of assuming one commit.
+- Every suffix element must form an uninterrupted parent chain and change exactly `package.json` and
+  `package-lock.json`, only as an exact `codex-workflow-v2` pin update. Product bytes, additional
+  dependency changes, merge ancestry and unexplained commits remain blockers.
+- The terminal suffix commit must match the declared, locked and installed package version.
+- Carried Plan-integrity compatibility is derived by walking through the bounded suffix to the last
+  registered system commit. The original recovery, failed Step, Plan, remediation history, dirty
+  allowlist, dirty SHA-256, C1 posture and completed corrective-yield history must still match.
+- Recovery atomically registers the entire chain in `systemCommits` and appends one provenance record
+  per commit using that commit's actual package version. Partial registration is not permitted.
+- A failed atomic recovery leaves all Core state unchanged. No product file, Plan, Step, lease,
+  review or Git history is edited by this route.
+- Protocol and state schema remain `2/2`; no migration or manual state repair is required.
+
+## Existing beta.12.14 contract retained
+
+- Current binding manifests remain mandatory for pending and in-flight corrective-replan
+  transactions.
+- Historical manifest/runtime/catalog identities are accepted only for exact registered completed
+  journals and cannot create new authority.
+- Corrective-replan credentials still separate source Task Knowledge from target replacement-Plan
+  Knowledge.
+- Completed corrective-yield journals still require their canonical event bytes to be an exact prefix
+  of the append-only handoff history.
+- After dependency recovery, the blocked Task must still pass normal corrective-replan preparation,
+  confirmation, execution, fresh authorization/C1, selector-bearing checks, Core-owned Step commit and
+  strict external review.
 
 ## PDF release documentation evidence
 
-- All three tracked Russian PDFs were regenerated from beta.12.13 Markdown sources.
-- Architecture remains 9 pages, the delegated chat-only guide 10 pages, and the technical reference
-  13 pages. All 32 pages were rendered and visually inspected; changed source/target Knowledge,
-  consecutive-update, and append-only yield sections were additionally checked at full resolution.
-- Titles, version bindings, Cyrillic text, tables, code blocks, margins and footers show no clipping,
-  overlap, or unreadable content.
-
-## Existing boundaries and non-claims
-
-- Compatibility is exact recovery authority, not general permission to rebind Knowledge, edit a
-  Plan, change product files, alter Milestone topology, adopt unrelated commits, or skip review.
-- The carry route supports a consecutive package-only update only when the previous recovery record
-  remains fully reproducible from current Git, Task and worktree evidence.
-- Historical corrective-yield readback accepts append-only continuation, not arbitrary sidecar drift.
-- The release does not make failing product logic pass, approve a broken check, increase retry limits,
-  or infer an executable selector. The replacement Plan must supply the exact selector-bearing command.
-- This report does not claim Git commit/tag/push, npm publication, live Signal installation, or Task
-  completion before those operations receive their own readbacks.
-
-Confidence is high for source/target Knowledge separation, consecutive-update compatibility,
-append-only yield continuity, Core authority closure, transaction recovery, package composition,
-downstream installation, gateway validation and documentation. Live Signal confidence remains
-conditional on exact publication, installation, fresh Core readback, and completion of the blocked
-Step through the advertised route.
+- All three tracked Russian PDFs were regenerated from beta.12.15 sources.
+- Architecture is 9 pages, delegated chat-only guide is 10 pages, and technical reference is 14
+  pages. All 33 rendered pages were visually inspected; no clipping, overlap or unreadable content
+  was observed.
+
+## Boundaries and non-claims
+
+- The suffix scan is not generic history adoption. Only the contiguous, exact Workflow-pin-only
+  prefix between registered Task history and current HEAD is eligible.
+- The patch does not weaken dirty-worktree boundaries, Plan identity, remediation evidence, C1
+  authority, checks or review gates.
+- This report does not claim commit/tag/push, npm publication, live beta.12.15 installation,
+  dependency recovery or STEP-001 completion before each operation receives its own readback.
+
+Confidence is high for consecutive dependency-provenance recovery because the focused tests, full
+349-test gate and read-only real Signal reproduction agree. End-to-end confidence remains conditional
+on publication, exact Signal installation, fresh repository-local `status -> next`, and completion of
+the blocked STEP-001 through Core-advertised routes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.12.13",
+  "version": "2.0.0-beta.12.15",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",