codex-workflow-v2 2.0.0-beta.12.14 → 2.0.0-beta.12.16

package/docs/validation-report.md

@@ -1,112 +1,127 @@
-# V2 beta.12.14 Validation Report
+# V2 beta.12.16 Validation Report
 
-Release candidate `2.0.0-beta.12.14` was validated on 2026-08-31 (Europe/Moscow) with
+Release candidate `2.0.0-beta.12.16` was validated on 2026-08-31 (Europe/Moscow) with
 Node.js 24.17.0.
 
 ## Automated release evidence
 
-- A clean `npm ci` completed from the exact lockfile and reported zero vulnerabilities. The first
-  sandboxed attempt failed only on registry DNS (`ENOTFOUND`); the exact network-enabled retry passed.
-- `npm run validate` passed typecheck and `349/349` sequential tests with no failures, skips,
-  cancellations or todos in 2,224,925.03 ms.
-- The new regression case completes a corrective-replan transaction, rewrites its self-bound
-  identity and phase chain to the exact beta.12.12 historical tuple, and proves observation remains
-  clean. An unknown tuple and the same historical tuple on a pending transaction both remain
-  `journal-invalid`.
-- The full suite still includes the beta.12.13 Signal-shaped E2E: repeated selector-contract
-  failures, consecutive dependency-only updates, exact carried compatibility, source/target
-  Knowledge separation, corrective replan, fresh authorization/C1, selector-bearing validation,
-  Core Step commit and strict Step review.
-- `npm run test:signal-remediation-e2e` passed `2/2`; `npm run
-  test:signal-t03-replan-e2e` passed `1/1`; and `npm run test:signal-t04-recovery` passed `11/11`.
-- Package dry-run passed with 281 files (approximately 1.1 MB packed and 4.3 MB unpacked), and the
-  disposable downstream installation returned `ok=true` for the exact beta.12.14 tarball.
-- `npm run plugin:check`, `npm run docs:pdf:check`,
-  `RELEASE_TAG=v2.0.0-beta.12.14 npm run release:check`, and `git diff --check` all passed. PDF
-  freshness reported an empty stale set and exact beta.12.14 package binding.
-
-## Live Signal reproduction
-
-The beta.12.13 package was published and installed into Signal through one dependency-only commit
-`51e5e61b39ff9a234dcc9ccb80d81da710570f55`. Declared, locked, installed, Task-branch and `main`
-versions all became exact `2.0.0-beta.12.13`; the three uncommitted STEP-001 product files retained
-their original SHA-256 values.
-
-Fresh beta.12.13 handshake succeeded with protocol/state schema `2/2`, but read-only `status` failed
-closed with `TASK_TRANSACTION_INTEGRITY_FAILED`. It identified exactly three `journal-invalid`
-completed Task transactions:
-
-- `TASK-01M0HVJ4S7GF6JNCNDHPMAVG8Y` / `c66a4bf6b4e67c2b406cccd8229e827a96b7c99e5609d9e025b835817c45e523`;
-- `TASK-01M0HVNAWGQGSSXCDJ4DDGEZXV` / `52838ab5e81da7e471a377ff29828f0ad5326bcb20581c9ee65387e617e1446d`;
-- `TASK-01M0WXJ2GHGYRH86HR7FMKWSTS` / `d5024dc6ab5b2d85da57b6c7d44b8927e0c1558e890ee434f3911712f6faa56a`.
-
-All three were terminal corrective-replan transactions created by the prior 28-field binding model.
-Their exact common identity was manifest SHA-256
-`edab7ee7ac4018e759f5fc702a11a0fd113ef4f2cf8ed8fa823a59fde3012a1a`, runtime fingerprint
-`bd4e7a0ddfcb6abc0c5eb107775e6aea7e08c4606dda4d945d77af8a4520710d`, and catalog hash
-`fa1d11860d4f07978c3b8e85d1f91cd3d15b17284b05f41e05d462d3bb092aed`.
-
-The beta.12.14 implementation was built locally and its transaction observer was run read-only
-against the real Signal external state. It returned `pending=0`, `corrupt=0`. No state, journal,
-sidecar, Git history or product file was modified by this reproduction.
+- A clean `npm ci` completed from the exact lockfile and reported zero vulnerabilities.
+- `npm run validate` passed typecheck and `352/352` sequential tests with no failures, skips,
+  cancellations or todos in 2,166,261.797 ms.
+- The release-specific `npm run test:signal-t10-check-support-e2e` gate passed `6/6`. Its
+  Signal-shaped case reproduces the STEP-002 migration/check-support conflict, records one bounded
+  machine-derived scope extension, retries the same Step, passes checks and produces the Core-owned
+  Step commit without a Human replan.
+- Existing Signal compatibility gates remained green: `npm run test:signal-t04-recovery` passed
+  `11/11`, `npm run test:signal-t03-replan-e2e` passed `1/1`, and `npm run
+  test:signal-remediation-e2e` passed `2/2`.
+- Package dry-run passed with 284 files (approximately 1.1 MB packed and 4.4 MB unpacked). The
+  tarball contains the compiled `check-support-anchor` analyzer and its declaration/source map.
+- Disposable downstream installation returned `ok=true` for the exact beta.12.16 tarball. The first
+  sandboxed run failed only because registry DNS was unavailable; the exact network-enabled retry
+  passed.
+- `npm run plugin:check` passed. `npm run docs:pdf:check` reported `stale=[]` and the exact
+  beta.12.16 package binding.
+
+## Live Signal reproduction before installation
+
+The live repository was observed read-only at:
+
+- Task branch `codex/task-01m1b79c66-current-formalization-commit-and-provide`;
+- HEAD `f290d0875387283c368bedd03964fb423619db7b`;
+- repository-local package `codex-workflow-v2@2.0.0-beta.12.15`, protocol/schema `2/2`;
+- Task `TASK-01M1B79C660YMNSRRZ236NTR1T`, with the last recorded STEP-002 failure at Task revision
+  21.
+
+HEAD is the Core-owned STEP-001 commit. Its strict external review passed with sealed packet hash
+`c48658ce617bca58eddba4e11f43501eb87967d076e43bd4656f512ba256358f` and seal
+`31cfd03a8bd9f9ba21f067703db90da97102643901725718f3e88199e486d806`.
+
+The checkout still contains exactly the eight STEP-002 product paths present at the recorded
+`checks-failed` boundary:
+
+- `libs/processing-decision/ports/src/processing-persistence.ts`;
+- `libs/processing-decision/ports/src/index.ts`;
+- `libs/processing-decision/adapters/postgres/src/processing-evidence-transaction.ts`;
+- `libs/processing-decision/adapters/postgres/src/processing-evidence-transaction.spec.ts`;
+- `libs/processing-decision/adapters/postgres/src/processing-evidence-transaction.integration.spec.ts`;
+- `libs/processing-decision/adapters/postgres/migrations/0003_current_formalization_commits.sql`;
+- `libs/processing-decision/adapters/postgres/migrations/manifest.json`;
+- `libs/processing-decision/adapters/postgres/bootstrap/0000_roles_and_schema.sql`.
+
+Focused evidence and full affected validation passed for those product changes. The exact migration
+check failed because `tools/postgres/check-processing-migrations.ts` directly imports
+`tools/postgres/processing-migration-files.ts`, while the latter did not catalog the new migration
+and was outside STEP-002 `allowedWrites`. Repeating the approved check could not change that result.
+
+The beta.12.16 analyzer was then run read-only against this exact repository state. It derived one
+candidate and no broader scope:
+
+- runner: `tools/postgres/check-processing-migrations.ts`;
+- support authority: `tools/postgres/processing-migration-files.ts`;
+- expected output:
+  `libs/processing-decision/adapters/postgres/migrations/0003_current_formalization_commits.sql`;
+- reason: `CHECK_SUPPORT_ANCHOR_OUTSIDE_ALLOWED_WRITES`.
+
+Fresh beta.12.15 `status -> next` currently stops earlier at an expired writer lease and advertises
+only `locks repair`. No Signal lease, Workflow state, Git history, product file or chat was changed
+by this release-candidate reproduction. Live beta.12.16 recovery is intentionally not claimed until
+publication, installation, stale-lease repair and fresh repository-local readback.
 
 ## Root cause corrected
 
-beta.12.13 expanded the live corrective-replan binding manifest from 28 to 30 fields so source Task
-Knowledge and target replacement-Plan Knowledge could differ under exact Plan-integrity compatibility.
-The transaction journal validator compared every stored journal with only the current manifest hash.
-Consequently, already completed and otherwise intact beta.12.12 transactions became unreadable after
-the legitimate manifest evolution.
-
-The problem was not corrupted Signal state and not a missing repair operation. It was missing
-versioned read compatibility for consumed, terminal Core transaction authority. Repairing, deleting or
-rewriting those journals would have destroyed evidence and hidden the product defect.
-
-## Implemented compatibility contract
-
-- The current binding manifest remains mandatory for every new, pending or in-flight
-  corrective-replan transaction.
-- An append-only registry records exact historical completed identities as a three-value tuple:
-  manifest SHA-256, runtime semantic fingerprint and runtime catalog hash.
-- A non-current identity is accepted only when the journal phase is `completed` and the full tuple is
-  present in that registry.
-- Existing schema validation, path identity, intent hash, phase hash chain, target inventory, owned
-  preimage/postimage digests, sidecar anchors, completion result and canonical-target readback remain
-  mandatory. Historical registration bypasses none of them.
-- Unknown tuples and historical tuples on nonterminal transactions remain fail closed. A historical
-  completed journal is read evidence only; it cannot mint a new receipt, resume execution or become
-  current transition authority.
-- Protocol and state schema remain `2/2`; no state migration or repair command is required.
-
-## Existing beta.12.13 contract retained
-
-- Corrective-replan credentials still separate source `knowledgeRevision`/`knowledgeHash` from target
-  `targetKnowledgeRevision`/`targetKnowledgeHash`.
-- Source/target difference still requires an exact current Plan-integrity recovery matching HEAD,
-  package version, system commit, Plan, failed Step, full remediation history, dirty paths and dirty
-  worktree hash.
-- Consecutive package-only updates can still carry compatibility only from one exact registered
-  recovery at `HEAD^`, with unchanged product bytes and no C1 posture.
-- Completed corrective-yield journals still require their owned event bytes to be an exact prefix of
-  a valid current append-only handoff history.
+Mechanical feasibility treated the migration, manifest and bootstrap files as the Step's complete
+output boundary, but did not model the repository-local module imported by the approved migration
+check as execution authority. That support module owns the exact migration list and SHA-256 catalog;
+therefore the new migration cannot pass its check until the support module changes as well.
+
+This is not a semantic Plan error and not evidence that the product implementation must be
+discarded. The missing path is mechanically derivable from executable code and exact file anchors.
+The old runtime nevertheless routed the first confirmed failure back to ordinary `task run`, where
+the Worker remained forbidden from editing the only file that could make the approved check pass.
+
+## Implemented contract
+
+- New analyzer `wf2.check-support-anchor@1` recognizes only a root `npm run` check, its
+  repository-local Node/tsx runner, one direct relative static import, and a support module whose
+  migration filename family plus SHA/catalog anchors bind an exact Plan-declared migration output.
+- For a future Plan, execution authorization fails closed when the producing Step does not own that
+  exact support path. This prevents the invalid scope from reaching execution.
+- For an already running guarded Step, the first exact `checks-failed` event may advertise `task
+  plan-integrity-recover`. Recovery revalidates Plan, Step, HEAD, complete dirty set, runner/support
+  hashes, direct import, missing declared output and existing evidence under the Workflow lock.
+- Recovery appends one `continue-fix` decision with the exact `scopeExtensions` path. It does not
+  change the Plan hash, product bytes, Git history or review result and does not synthesize a second
+  failed attempt.
+- Worker envelope, retry boundary, Core commit, downstream proof, corrective-replan worktree guard
+  and strict review packet all use the same effective Step scope. The original allowedWrites remain
+  canonical and the append-only decision is visible as derived authority.
+- The existing missing-script and selector-required cases retain `replan-required` and their
+  Human-confirmed corrective-replan route. Indirect imports, dynamic shell, unsupported syntax,
+  forbidden paths, unrelated dirty files, missing SHA/catalog anchors and multiple ambiguous
+  candidates remain fail-closed.
 
 ## PDF release documentation evidence
 
-- All three tracked Russian PDFs were regenerated from beta.12.14 sources.
-- Architecture is 9 pages, delegated chat-only guide is 10 pages, and technical reference is 14
-  pages. All 33 pages were rendered and visually inspected; the release-gate appendix has an explicit
-  page boundary, and no clipping, overlap or unreadable content was observed.
+- All three tracked Russian PDFs were regenerated from beta.12.16 sources.
+- Architecture is 9 pages, delegated chat-only guide is 10 pages, and technical reference is 15
+  pages. All 34 rendered pages were visually inspected; no clipping, overlap or unreadable content
+  was observed.
 
 ## Boundaries and non-claims
 
-- The historical registry is not a wildcard, schema migration, state repair or permission to accept
-  arbitrary old bytes. Each prior identity must be added explicitly and tested.
-- The patch does not weaken pending transaction recovery, current Core authority, dirty-worktree
-  boundaries, review gates or product checks.
-- This report does not claim commit/tag/push, npm publication, live beta.12.14 installation, dependency
-  recovery or STEP-001 completion before each operation receives its own readback.
-
-Confidence is high for historical completed-journal compatibility because the focused test, full
-349-test gate and read-only real Signal state inspection agree. End-to-end confidence remains
-conditional on publication, exact Signal installation, fresh repository-local `status -> next`, and
-completion of the blocked STEP-001 through Core-advertised routes.
+- The patch is not autonomous semantic replanning and does not permit a Worker to add an arbitrary
+  file after a failed check.
+- Scope augmentation is limited to one exact mechanically proved support authority for the current
+  migration-file family. A broader or ambiguous dependency remains an ordinary Plan conflict.
+- The patch does not weaken dirty-worktree, forbidden-scope, Plan identity, C1 authority, checks,
+  Core-owned commit or sealed strict-review gates.
+- This report does not claim commit/tag/push, npm publication, live beta.12.16 installation, live
+  STEP-002 recovery, STEP-002 commit/review, Task merge or Milestone completion before those
+  operations receive their own readback.
+
+Confidence is high for the bounded analyzer, preventive authorization and runtime recovery because
+the full 352-test gate, release-specific Signal E2E, legacy Signal gates and read-only live candidate
+agree. End-to-end confidence for the active Signal Task remains conditional on publication, exact
+repository-local installation, advertised stale-lease repair, fresh `status -> next`, Core recovery,
+the real approved checks and a new sealed external review packet.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.12.14",
+  "version": "2.0.0-beta.12.16",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",
@@ -49,6 +49,7 @@
     "test:signal-t04-recovery": "node scripts/with-validation-lock.mjs test-signal-t04",
     "test:signal-t03-replan-e2e": "node scripts/with-validation-lock.mjs test-signal-t03-replan",
     "test:signal-remediation-e2e": "node scripts/with-validation-lock.mjs test-signal-remediation-topology",
+    "test:signal-t10-check-support-e2e": "node scripts/with-validation-lock.mjs test-signal-t10-check-support",
     "validate": "npm run typecheck && npm test",
     "pack:check": "npm run build && npm pack --dry-run",
     "smoke:downstream": "npm run build && node scripts/downstream-smoke.mjs",

package/schemas/authorization-event.schema.json

@@ -98,7 +98,7 @@
       "required": ["analyzerId", "analyzerVersion"],
       "properties": {
         "analyzerId": {
-          "enum": ["wf2.root-npm-script", "wf2.exact-output-path", "wf2.exact-predecessor-path"]
+          "enum": ["wf2.root-npm-script", "wf2.root-npm-script-arguments", "wf2.check-support-anchor", "wf2.exact-output-path", "wf2.exact-predecessor-path"]
         },
         "analyzerVersion": { "const": 1 }
       }
@@ -111,7 +111,7 @@
       ],
       "properties": {
         "analyzerId": {
-          "enum": ["wf2.root-npm-script", "wf2.exact-output-path", "wf2.exact-predecessor-path"]
+          "enum": ["wf2.root-npm-script", "wf2.root-npm-script-arguments", "wf2.check-support-anchor", "wf2.exact-output-path", "wf2.exact-predecessor-path"]
         },
         "analyzerVersion": { "const": 1 },
         "result": { "enum": ["pass", "blocked", "unverified"] },

package/schemas/corrective-decision-event.schema.json

@@ -49,17 +49,32 @@
       "if": { "properties": { "triggeringAttemptCount": { "const": 2 } }, "required": ["triggeringAttemptCount"] },
       "then": {
         "required": ["recoveryBasis", "planIntegrityEvidence"],
-        "properties": { "decision": { "const": "replan-required" } }
+        "properties": { "decision": { "enum": ["continue-fix", "replan-required"] } }
       }
     },
     {
       "if": { "required": ["recoveryBasis"] },
       "then": {
-        "required": ["planIntegrityEvidence"],
-        "properties": { "decision": { "const": "replan-required" } }
+        "required": ["planIntegrityEvidence"]
       },
       "else": { "not": { "required": ["planIntegrityEvidence"] } }
     },
+    {
+      "if": {
+        "properties": {
+          "planIntegrityEvidence": {
+            "properties": { "kind": { "const": "check-support-anchor-outside-allowed-writes" } },
+            "required": ["kind"]
+          }
+        },
+        "required": ["planIntegrityEvidence"]
+      },
+      "then": { "properties": { "decision": { "const": "continue-fix" } } },
+      "else": {
+        "if": { "required": ["recoveryBasis"] },
+        "then": { "properties": { "decision": { "const": "replan-required" } } }
+      }
+    },
     {
       "anyOf": [
     { "properties": { "coveredFindingIds": { "minItems": 1 } } },
@@ -81,7 +96,8 @@
     "planIntegrityEvidence": {
       "oneOf": [
         { "$ref": "#/$defs/planIntegrityEvidenceV1" },
-        { "$ref": "#/$defs/planIntegrityEvidenceV2" }
+        { "$ref": "#/$defs/planIntegrityEvidenceV2" },
+        { "$ref": "#/$defs/planIntegrityEvidenceV3" }
       ]
     },
     "planIntegrityEvidenceV1": {
@@ -142,6 +158,53 @@
         "changedFiles": { "$ref": "#/$defs/stringList" },
         "conflictHash": { "$ref": "#/$defs/hash64" }
       }
+    },
+    "planIntegrityEvidenceV3": {
+      "type": "object", "additionalProperties": false,
+      "required": ["kind", "taskRevision", "remediationEvents", "manifestPath", "manifestHash", "gitHead", "stepDefinitionHash", "conflicts", "scopeExtensions", "changedFiles", "conflictHash"],
+      "properties": {
+        "kind": { "const": "check-support-anchor-outside-allowed-writes" },
+        "taskRevision": { "type": "integer", "minimum": 1 },
+        "remediationEvents": {
+          "type": "array", "minItems": 1,
+          "items": {
+            "type": "object", "additionalProperties": false,
+            "required": ["eventId", "eventHash", "attemptOrdinal"],
+            "properties": {
+              "eventId": { "type": "string", "minLength": 1 },
+              "eventHash": { "$ref": "#/$defs/hash64" },
+              "attemptOrdinal": { "type": "integer", "minimum": 1 }
+            }
+          }
+        },
+        "manifestPath": { "const": "package.json" },
+        "manifestHash": { "$ref": "#/$defs/nullableHash64" },
+        "gitHead": { "$ref": "#/$defs/gitOid" },
+        "stepDefinitionHash": { "$ref": "#/$defs/hash64" },
+        "conflicts": {
+          "type": "array", "minItems": 1,
+          "items": {
+            "type": "object", "additionalProperties": false,
+            "required": ["reasonCode", "script", "command", "scriptCommand", "runnerPath", "runnerHash", "supportPath", "supportHash", "importSpecifier", "expectedOutputPaths", "anchoredMigrationNames"],
+            "properties": {
+              "reasonCode": { "const": "CHECK_SUPPORT_ANCHOR_OUTSIDE_ALLOWED_WRITES" },
+              "script": { "type": "string", "minLength": 1 },
+              "command": { "type": "string", "minLength": 1 },
+              "scriptCommand": { "type": "string", "minLength": 1 },
+              "runnerPath": { "type": "string", "minLength": 1 },
+              "runnerHash": { "$ref": "#/$defs/hash64" },
+              "supportPath": { "type": "string", "minLength": 1 },
+              "supportHash": { "$ref": "#/$defs/hash64" },
+              "importSpecifier": { "type": "string", "minLength": 1 },
+              "expectedOutputPaths": { "$ref": "#/$defs/stringList", "minItems": 1 },
+              "anchoredMigrationNames": { "$ref": "#/$defs/stringList", "minItems": 1 }
+            }
+          }
+        },
+        "scopeExtensions": { "$ref": "#/$defs/stringList", "minItems": 1 },
+        "changedFiles": { "$ref": "#/$defs/stringList" },
+        "conflictHash": { "$ref": "#/$defs/hash64" }
+      }
     }
   }
 }