codex-workflow-v2 2.0.0-beta.12.2 → 2.0.0-beta.12.4

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -1,6 +1,6 @@
 # Gateway Protocol V2
 
-## beta.12.2 compatibility transitions and continuable remediation
+## beta.12.4 compatibility transitions and continuable remediation
 
 - When fresh `next` advertises `task plan-integrity-recover`, consume its exact Task revision,
   Step, actor, and writer-token contract. This route is valid only for the Core-derived
@@ -20,11 +20,16 @@
   shape. `task stop-override-apply` requires the same Task revision, Step, actor, reason, Plan, HEAD,
   evidence binding, and returned `SOO-*` code in a later user turn. It appends evidence without
   deleting `stop-escalate`; it never applies to `split-required`.
-- After an applied stop override, one ordinary delegated `task context-refresh` may rebind the Plan
-  before attempt four. Fresh `next` returns `task run` only when Core validates an exact direct
-  Knowledge rebind, a mechanically equivalent Plan Risk Audit rebound, shared delegated authority,
-  append-only chronology, and the same Git HEAD. If C1 remains claimed but the lease was lost at the
-  Human boundary, use only the simultaneously advertised `task writer-credential-replace` action.
+- After an applied stop override, one or more ordinary delegated `task context-refresh` transitions
+  may rebind the Plan before attempt four. Fresh `next` returns `task run` only when Core validates
+  the complete contiguous Plan/rebind/audit chain, mechanical equivalence at every hop, shared
+  delegated authority, and append-only chronology. HEAD may differ from the override only when every
+  intervening commit is an exact registered dependency-provenance recovery changing only
+  `package.json` and `package-lock.json`. If C1 remains claimed but the lease was lost at the Human
+  boundary, use only the simultaneously advertised `task writer-credential-replace` action.
+  A provenance recovery recorded after the final context-refresh audit may explain exactly one
+  additional Task revision only when it belongs to that verified Git chain. Any unexplained
+  revision remains a `doctor` boundary.
 - `milestone progress --id <MS-ID>` is a read-only projection and the sole source for Coordinator
   progress tables. It preserves cancelled/replacement Tasks as distinct membership rows.
 - `scripts/chat-registry.mjs` atomically allocates project-monotonic `#NNN`, builds all six title
@@ -63,6 +68,8 @@ Current capability set:
 - `task-local-dependency-provenance-recovery-v1`
 - `legacy-stop-escalate-override-v1`
 - `stop-override-context-rebind-v1`
+- `stop-override-context-rebind-chain-v1`
+- `stop-override-post-audit-dependency-revision-v1`
 - `retained-reviewed-history-recovery-v1`
 - `milestone-progress-projection-v1`
 - `strict-reviewer-v1`

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -109,7 +109,7 @@ command shape or consuming a replacement Discovery. Never rebind, refresh, repla
 resume, cancel, or manually replace the historical Task. Continue only after a later P04-B/P05
 package explicitly advertises a topology-preserving replacement capability.
 
-When beta.12.2 `next` advertises `task stop-override-prepare`, the route is limited to the exact
+When beta.12.4 `next` advertises `task stop-override-prepare`, the route is limited to the exact
 beta.11 attempt-four policy stop: two ordinary failures, one corrective failure, a matching
 attempt-3 `continue-fix`, and a matching attempt-4 `stop-escalate` under the unchanged Plan. Invoke
 prepare with the exact Task/Step/revision, explicit human actor, and user-supplied reason. It is
@@ -120,12 +120,20 @@ evidence changes. Successful apply preserves the original stop, appends
 `stop-escalate-overrides.jsonl`, and requires fresh sequential `status` then `next` before attempt
 four runs through the normal strict-review cycle.
 
-After an applied override, one ordinary delegated `task context-refresh` may change only the Plan's
-canonical Knowledge Map binding. Continue only when fresh `next` advertises `task run` with
-`stopOverrideContextRebind.state=validated` for the exact override and stop decision. If C1 remains
-claimed but the lease was lost at the Human boundary, first use the simultaneously advertised
-`task writer-credential-replace` action for the exact claimant. A doctor route, semantic Plan drift,
-second rebind, different HEAD, missing delegated authority, or damaged chronology is a hard stop.
+After an applied override, one or more ordinary delegated `task context-refresh` transitions may
+change only the Plan's canonical Knowledge Map binding. A package update may also advance HEAD, but
+only through the exact `update dependency-provenance-recover` route advertised by fresh `next`.
+Continue only when fresh `next` advertises `task run` with
+`stopOverrideContextRebind.state=validated` for the exact override and stop decision. Core verifies
+the complete source-to-current Plan/audit/rebind chain and, when HEAD changed, every intervening Git
+commit as registered dependency-only provenance. If C1 remains claimed but the lease was lost at
+the Human boundary, first use the simultaneously advertised `task writer-credential-replace`
+action for the exact claimant. A doctor route, semantic Plan drift, an unregistered or non-dependency
+commit, missing delegated authority, a broken chain, or damaged chronology is a hard stop.
+When advertised navigation records dependency provenance after the final context-refresh audit,
+Core may account for exactly one Task revision per ordered verified recovery. Never infer this
+compatibility from revision arithmetic alone: continue only when fresh `next` returns the validated
+`task run` route. An unrelated extra revision remains a hard stop.
 
 When `next` returns `milestone initial-assembly`, execution is unavailable. Follow only the
 advertised `linked-task-assembly.commands` (`discovery start` and `discovery materialize`) until all