codex-workflow-v2 2.0.0-beta.12.3 → 2.0.0-beta.12.5

package/README.md

@@ -43,7 +43,7 @@ cross-machine synchronization are not part of its contract.
 Node.js 22 or newer is required. Consumers pin the exact package version:
 
 ```bash
-npm install --save-dev --save-exact codex-workflow-v2@2.0.0-beta.12.3
+npm install --save-dev --save-exact codex-workflow-v2@2.0.0-beta.12.5
 npx codex-workflow gateway handshake --repo .
 npx codex-workflow doctor --repo .
 ```
@@ -187,7 +187,7 @@ sidecars:
   `corrective-replan-executions.jsonl`, `step-review-events.jsonl`,
   `reviewer-attestations.jsonl`, `remediation-events.jsonl`,
   `corrective-decisions.jsonl`, `corrective-decision-recoveries.jsonl`,
-  `remediation-mode-recoveries.jsonl`, `handoffs.jsonl`
+  `remediation-mode-recoveries.jsonl`, `downstream-proof-invalidations.jsonl`, `handoffs.jsonl`
 - milestone: `scope-change-events.jsonl`, `autonomy-contract-events.jsonl`
 
 Milestone scope-change recovery also uses Milestone-local `.transactions/` journal files.
@@ -214,6 +214,19 @@ definition, Git HEAD, manifest hash, and complete dirty-file set. The recovery r
 journaled corrective-replan path. It does not edit the Plan, run a second failing attempt, widen
 `allowedWrites`, or modify the worktree.
 
+When an active downstream proof exposes a required change in files owned by a completed transitive
+predecessor Step, fresh `next` advertises `task downstream-proof-recover` instead of the impossible
+`task step-complete`. The lease-bound transaction preserves worktree and HEAD, invalidates only the
+affected predecessor completion evidence, retains its commits as historical `invalidatedStepCommits`, yields
+C1, and returns the same Task to ordinary planning. A fresh replacement Plan, Plan Risk Audit, and
+execution authorization are required. Unrelated dirty files, non-predecessor ownership, unregistered
+history, or damaged invalidation evidence fail closed.
+
+Docker socket `EPERM`/permission errors observed inside a sandbox are access-boundary evidence, not
+daemon-failure evidence. The gateway repeats the exact read-only probe or Plan check once with
+sandbox escalation without consuming a remediation/infra retry. Docker Desktop restart or image
+mutation requires separate authority and an escalated probe that actually proves daemon failure.
+
 For a terminal split, follow the [canonical replacement stop procedure](docs/split-required-recovery.md).
 P04-A intentionally disables structural replacement; P04-B/P05 must define the topology-preserving
 transaction before the route can be used.
@@ -302,10 +315,11 @@ alpha regressions that must not recur are tracked in the
 - [Chat-only development guide](docs/pdf/codex-workflow-v2-chat-only-guide-ru.pdf)
 - [Deep technical reference](docs/pdf/codex-workflow-v2-technical-reference-ru.pdf)
 
-These beta.12.3 documents cover delegated Discovery, Milestone Autonomy Contract issuance,
+These beta.12.5 documents cover delegated Discovery, Milestone Autonomy Contract issuance,
 dependency-aware Task routing, C1 credential handling, external-sealed reviews, bounded
 Plan-integrity recovery, Task-local dependency provenance recovery, the human-confirmed legacy
-attempt-four stop override (including append-only multi-rebind and dependency-only HEAD continuation), and the P04-A
+attempt-four stop override (including append-only multi-rebind, dependency-only HEAD continuation,
+and evidence-accounted post-audit recovery revisions), and the P04-A
 structural-replacement stop boundary. Their reviewable
 sources live in [`docs/pdf/sources`](docs/pdf/sources), and `npm run docs:pdf:check` proves the
 tracked binaries were generated from the current source and package version. The PDFs remain

package/dist/src/alpha6/downstream-proof.d.ts

@@ -0,0 +1,29 @@
+import type { DownstreamProofInvalidationEvent, TaskState } from '../contracts.js';
+import type { FileStateStore } from '../state/store.js';
+export interface DownstreamProofInvalidatedStep {
+    stepId: string;
+    evidenceCommit: string;
+    triggerFiles: string[];
+}
+export interface DownstreamProofRecoveryAssessment {
+    applicable: boolean;
+    eligible: boolean;
+    activeStepId: string | null;
+    dirtyFiles: string[];
+    outsideActiveStepFiles: string[];
+    invalidatedSteps: DownstreamProofInvalidatedStep[];
+    preservedHeadCommit: string | null;
+    blockers: string[];
+}
+export interface PreparedDownstreamProofInvalidation {
+    event: DownstreamProofInvalidationEvent;
+    postimage: string;
+}
+export declare function assessDownstreamProofRecovery(store: FileStateStore, repositoryRoot: string, task: TaskState): DownstreamProofRecoveryAssessment;
+export declare function prepareDownstreamProofInvalidation(store: FileStateStore, resultTask: TaskState, assessment: DownstreamProofRecoveryAssessment, input: {
+    previousTaskRevision: number;
+    actor: string;
+    reason: string;
+}, now: Date): PreparedDownstreamProofInvalidation;
+export declare function readDownstreamProofInvalidations(store: FileStateStore, task: TaskState): DownstreamProofInvalidationEvent[];
+export declare function downstreamProofInvalidationSidecar(): string;

package/dist/src/alpha6/downstream-proof.js

@@ -0,0 +1,249 @@
+import { WorkflowError } from '../errors.js';
+import { pathAllowed } from '../domain/validation.js';
+import { changedFiles, currentBranch, headCommit, } from '../repository.js';
+import { validateTaskHistory } from '../git.js';
+import { createUlid } from '../ulid.js';
+import { PACKAGE_VERSION } from '../version.js';
+import { prepareSidecarAppend } from './store-sidecars.js';
+const SIDECAR = 'downstream-proof-invalidations.jsonl';
+const HASH_64 = /^[a-f0-9]{64}$/;
+const GIT_HASH = /^[a-f0-9]{40}$/;
+const EVENT_ID = /^DPI-[0-9A-HJKMNP-TV-Z]{26}$/;
+export function assessDownstreamProofRecovery(store, repositoryRoot, task) {
+    readDownstreamProofInvalidations(store, task);
+    const activeStep = task.steps.find((step) => step.status === 'in_progress') ?? null;
+    if (task.status !== 'in_progress' || !activeStep)
+        return emptyAssessment();
+    const dirtyFiles = changedFiles(repositoryRoot).sort();
+    const outsideActiveStepFiles = dirtyFiles.filter((file) => !pathAllowed(file, activeStep.allowedWrites));
+    if (outsideActiveStepFiles.length === 0) {
+        return {
+            ...emptyAssessment(),
+            activeStepId: activeStep.id,
+            dirtyFiles,
+        };
+    }
+    const blockers = [];
+    if (task.workspaceOwner !== 'local') {
+        blockers.push('Recovery requires a local Task workspace because the dirty file set is repository-local evidence.');
+    }
+    if (!task.taskBranch || currentBranch(repositoryRoot) !== task.taskBranch) {
+        blockers.push(`Current branch must equal the recorded Task branch ${task.taskBranch ?? '<missing>'}.`);
+    }
+    if (!task.planHash)
+        blockers.push('Task has no current Plan hash.');
+    if (activeStep.evidence !== null) {
+        blockers.push(`Active Step ${activeStep.id} already has completion evidence and must use strict-review recovery.`);
+    }
+    const predecessorIds = transitivePredecessors(task, activeStep.id, blockers);
+    const seedIds = new Set();
+    for (const file of outsideActiveStepFiles) {
+        const owners = task.steps.filter((step) => step.status === 'completed'
+            && predecessorIds.has(step.id)
+            && pathAllowed(file, step.allowedWrites));
+        if (owners.length === 0) {
+            blockers.push(`${file} is outside ${activeStep.id} and is not owned by a completed transitive predecessor.`);
+            continue;
+        }
+        for (const owner of owners)
+            seedIds.add(owner.id);
+    }
+    const invalidatedIds = completedDependentClosure(task, seedIds, predecessorIds);
+    const invalidatedSteps = task.steps
+        .filter((step) => invalidatedIds.has(step.id))
+        .map((step) => {
+        if (!step.evidence) {
+            blockers.push(`Completed predecessor ${step.id} has no completion evidence.`);
+        }
+        return {
+            stepId: step.id,
+            evidenceCommit: step.evidence?.commitSha ?? '',
+            triggerFiles: outsideActiveStepFiles.filter((file) => pathAllowed(file, step.allowedWrites)),
+        };
+    });
+    if (invalidatedSteps.length === 0)
+        blockers.push('No completed predecessor completion authority can be invalidated.');
+    try {
+        validateTaskHistory(repositoryRoot, task);
+    }
+    catch (error) {
+        blockers.push(error instanceof Error ? error.message : String(error));
+    }
+    return {
+        applicable: true,
+        eligible: blockers.length === 0,
+        activeStepId: activeStep.id,
+        dirtyFiles,
+        outsideActiveStepFiles,
+        invalidatedSteps,
+        preservedHeadCommit: headCommit(repositoryRoot),
+        blockers,
+    };
+}
+export function prepareDownstreamProofInvalidation(store, resultTask, assessment, input, now) {
+    if (!assessment.applicable || !assessment.eligible || !assessment.activeStepId || !assessment.preservedHeadCommit) {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Downstream proof recovery assessment is not eligible.', {
+            blockers: assessment.blockers,
+        });
+    }
+    const actor = normalizeRequired(input.actor, 'Recovery actor');
+    const reason = normalizeRequired(input.reason, 'Recovery reason');
+    if (!resultTask.planHash)
+        throw new WorkflowError('STATE_CORRUPT', 'Recovered Task has no Plan hash.');
+    if (resultTask.revision !== input.previousTaskRevision + 1) {
+        throw new WorkflowError('STATE_CONFLICT', 'Recovered Task revision does not advance exactly once.');
+    }
+    const events = readDownstreamProofInvalidations(store, resultTask);
+    const prepared = prepareSidecarAppend(events, {
+        eventId: `DPI-${createUlid(now.getTime())}`,
+        recordedAt: now.toISOString(),
+        taskId: resultTask.id,
+        previousTaskRevision: input.previousTaskRevision,
+        resultTaskRevision: resultTask.revision,
+        planHash: resultTask.planHash,
+        activeStepId: assessment.activeStepId,
+        invalidatedSteps: assessment.invalidatedSteps.map((step) => ({
+            stepId: step.stepId,
+            evidenceCommit: step.evidenceCommit,
+            triggerFiles: [...step.triggerFiles],
+        })),
+        dirtyFiles: [...assessment.dirtyFiles],
+        preservedHeadCommit: assessment.preservedHeadCommit,
+        actor,
+        reason,
+        packageVersion: PACKAGE_VERSION,
+    }, {
+        validateEvent: (event) => validateInvalidationEvent(event, resultTask),
+    });
+    return { event: prepared.event, postimage: prepared.content };
+}
+export function readDownstreamProofInvalidations(store, task) {
+    return store.readSidecarEvents(store.taskRoot(task.projectId, task.id), SIDECAR, { validateEvent: (event) => validateInvalidationEvent(event, task) });
+}
+export function downstreamProofInvalidationSidecar() {
+    return SIDECAR;
+}
+function emptyAssessment() {
+    return {
+        applicable: false,
+        eligible: false,
+        activeStepId: null,
+        dirtyFiles: [],
+        outsideActiveStepFiles: [],
+        invalidatedSteps: [],
+        preservedHeadCommit: null,
+        blockers: [],
+    };
+}
+function transitivePredecessors(task, stepId, blockers) {
+    const byId = new Map(task.steps.map((step) => [step.id, step]));
+    const result = new Set();
+    const visiting = new Set();
+    const visit = (candidateId) => {
+        if (result.has(candidateId))
+            return;
+        if (visiting.has(candidateId)) {
+            blockers.push(`Step dependency cycle reaches ${candidateId}.`);
+            return;
+        }
+        const candidate = byId.get(candidateId);
+        if (!candidate) {
+            blockers.push(`Step dependency references missing Step ${candidateId}.`);
+            return;
+        }
+        visiting.add(candidateId);
+        for (const dependency of candidate.dependencies) {
+            visit(dependency);
+            result.add(dependency);
+        }
+        visiting.delete(candidateId);
+    };
+    visit(stepId);
+    result.delete(stepId);
+    return result;
+}
+function completedDependentClosure(task, seedIds, predecessorIds) {
+    const result = new Set(seedIds);
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const step of task.steps) {
+            if (step.status !== 'completed' || !predecessorIds.has(step.id) || result.has(step.id))
+                continue;
+            if (step.dependencies.some((dependency) => result.has(dependency))) {
+                result.add(step.id);
+                changed = true;
+            }
+        }
+    }
+    return result;
+}
+function validateInvalidationEvent(event, task) {
+    const expectedKeys = [
+        'activeStepId', 'actor', 'dirtyFiles', 'eventHash', 'eventId', 'invalidatedSteps', 'packageVersion',
+        'planHash', 'preservedHeadCommit', 'previousEventHash', 'previousTaskRevision', 'reason', 'recordedAt',
+        'resultTaskRevision', 'taskId',
+    ];
+    if (!event || typeof event !== 'object' || Array.isArray(event)
+        || JSON.stringify(Object.keys(event).sort()) !== JSON.stringify(expectedKeys.sort())) {
+        throw new WorkflowError('STATE_CORRUPT', 'Downstream proof invalidation event contains unexpected fields.');
+    }
+    if (typeof event.eventId !== 'string' || !EVENT_ID.test(event.eventId)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Downstream proof invalidation eventId is invalid.');
+    }
+    if (event.taskId !== task.id)
+        throw new WorkflowError('STATE_CORRUPT', 'Downstream proof invalidation Task identity mismatch.');
+    if (!Number.isInteger(event.previousTaskRevision) || event.previousTaskRevision < 1
+        || event.resultTaskRevision !== event.previousTaskRevision + 1
+        || event.resultTaskRevision > task.revision) {
+        throw new WorkflowError('STATE_CORRUPT', 'Downstream proof invalidation revision binding is invalid.');
+    }
+    if (typeof event.planHash !== 'string' || !HASH_64.test(event.planHash)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Downstream proof invalidation planHash is invalid.');
+    }
+    if (typeof event.preservedHeadCommit !== 'string' || !GIT_HASH.test(event.preservedHeadCommit)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Downstream proof invalidation preservedHeadCommit is invalid.');
+    }
+    for (const [value, label] of [
+        [event.activeStepId, 'activeStepId'],
+        [event.actor, 'actor'],
+        [event.reason, 'reason'],
+        [event.packageVersion, 'packageVersion'],
+    ]) {
+        if (typeof value !== 'string' || !value.trim()) {
+            throw new WorkflowError('STATE_CORRUPT', `Downstream proof invalidation ${label} is required.`);
+        }
+    }
+    if (!Array.isArray(event.dirtyFiles) || event.dirtyFiles.length === 0
+        || event.dirtyFiles.some((file) => typeof file !== 'string' || !file.trim())
+        || new Set(event.dirtyFiles).size !== event.dirtyFiles.length
+        || JSON.stringify(event.dirtyFiles) !== JSON.stringify([...event.dirtyFiles].sort())) {
+        throw new WorkflowError('STATE_CORRUPT', 'Downstream proof invalidation dirtyFiles are invalid.');
+    }
+    if (!Array.isArray(event.invalidatedSteps) || event.invalidatedSteps.length === 0) {
+        throw new WorkflowError('STATE_CORRUPT', 'Downstream proof invalidation must identify invalidated Steps.');
+    }
+    const stepIds = new Set();
+    for (const step of event.invalidatedSteps) {
+        if (!step || typeof step !== 'object' || Array.isArray(step)
+            || JSON.stringify(Object.keys(step).sort()) !== JSON.stringify(['evidenceCommit', 'stepId', 'triggerFiles'])) {
+            throw new WorkflowError('STATE_CORRUPT', 'Downstream proof invalidated Step contains unexpected fields.');
+        }
+        if (typeof step.stepId !== 'string' || !step.stepId.trim() || stepIds.has(step.stepId)
+            || typeof step.evidenceCommit !== 'string' || !GIT_HASH.test(step.evidenceCommit)
+            || !(task.invalidatedStepCommits ?? []).includes(step.evidenceCommit)
+            || !Array.isArray(step.triggerFiles)
+            || new Set(step.triggerFiles).size !== step.triggerFiles.length
+            || step.triggerFiles.some((file) => typeof file !== 'string' || !event.dirtyFiles.includes(file))) {
+            throw new WorkflowError('STATE_CORRUPT', 'Downstream proof invalidated Step evidence is invalid.');
+        }
+        stepIds.add(step.stepId);
+    }
+}
+function normalizeRequired(value, label) {
+    if (typeof value !== 'string' || !value.trim()) {
+        throw new WorkflowError('INVALID_ARGUMENT', `${label} is required.`);
+    }
+    return value.trim();
+}
+//# sourceMappingURL=downstream-proof.js.map

package/dist/src/alpha6/downstream-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"downstream-proof.js","sourceRoot":"","sources":["../../../src/alpha6/downstream-proof.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,OAAO,GAAG,sCAAsC,CAAC;AACvD,MAAM,OAAO,GAAG,gBAAgB,CAAC;AACjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAClC,MAAM,QAAQ,GAAG,8BAA8B,CAAC;AAwBhD,MAAM,UAAU,6BAA6B,CAC3C,KAAqB,EACrB,cAAsB,EACtB,IAAe;IAEf,gCAAgC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,IAAI,CAAC;IACpF,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,EAAE,CAAC;IAE3E,MAAM,UAAU,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,sBAAsB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IACzG,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,GAAG,eAAe,EAAE;YACpB,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,UAAU;SACX,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,mGAAmG,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,sDAAsD,IAAI,CAAC,UAAU,IAAI,WAAW,GAAG,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACpE,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,eAAe,UAAU,CAAC,EAAE,uEAAuE,CAAC,CAAC;IACrH,CAAC;IAED,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACxC,IAAI,CAAC,MAAM,KAAK,WAAW;eACxB,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;eAC3B,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CACzC,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,eAAe,UAAU,CAAC,EAAE,0DAA0D,CAAC,CAAC;YAC7G,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,cAAc,GAAG,yBAAyB,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK;SAChC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAC7C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,EAAE,8BAA8B,CAAC,CAAC;QAChF,CAAC;QACD,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE;YAC9C,YAAY,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;SAC7F,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IAEtH,IAAI,CAAC;QACH,mBAAmB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,UAAU;QACV,sBAAsB;QACtB,gBAAgB;QAChB,mBAAmB,EAAE,UAAU,CAAC,cAAc,CAAC;QAC/C,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAAqB,EACrB,UAAqB,EACrB,UAA6C,EAC7C,KAIC,EACD,GAAS;IAET,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;QAClH,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,uDAAuD,EAAE;YACrG,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACvG,IAAI,UAAU,CAAC,QAAQ,KAAK,KAAK,CAAC,oBAAoB,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,wDAAwD,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,MAAM,GAAG,gCAAgC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,oBAAoB,CAAmC,MAAM,EAAE;QAC9E,OAAO,EAAE,OAAO,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE;QAC3C,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;QAC7B,MAAM,EAAE,UAAU,CAAC,EAAE;QACrB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,kBAAkB,EAAE,UAAU,CAAC,QAAQ;QACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;SACrC,CAAC,CAAC;QACH,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC;QACtC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,KAAK;QACL,MAAM;QACN,cAAc,EAAE,eAAe;KAChC,EAAE;QACD,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,yBAAyB,CAAC,KAAK,EAAE,UAAU,CAAC;KACvE,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAqB,EACrB,IAAe;IAEf,OAAO,KAAK,CAAC,iBAAiB,CAC5B,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,EACvC,OAAO,EACP,EAAE,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,yBAAyB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe;IACtB,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,EAAE;QACd,sBAAsB,EAAE,EAAE;QAC1B,gBAAgB,EAAE,EAAE;QACpB,mBAAmB,EAAE,IAAI;QACzB,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAe,EAAE,MAAc,EAAE,QAAkB;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,WAAmB,EAAQ,EAAE;QAC1C,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,OAAO;QACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,iCAAiC,WAAW,GAAG,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,2CAA2C,WAAW,GAAG,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1B,KAAK,MAAM,UAAU,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YAChD,KAAK,CAAC,UAAU,CAAC,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzB,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,CAAC;IACd,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAe,EACf,OAA4B,EAC5B,cAAmC;IAEnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,OAAO,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,SAAS;YACjG,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBACnE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAuC,EAAE,IAAe;IACzF,MAAM,YAAY,GAAG;QACnB,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,gBAAgB;QACnG,UAAU,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,QAAQ,EAAE,YAAY;QACtG,oBAAoB,EAAE,QAAQ;KAC/B,CAAC;IACF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WAC1D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,iEAAiE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;IAChI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC;WAC9E,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAAC,oBAAoB,GAAG,CAAC;WAC3D,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,4DAA4D,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,+DAA+D,CAAC,CAAC;IAC5G,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC;QACpC,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;QACtB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;QACxB,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC;KAChC,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,iCAAiC,KAAK,eAAe,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;WAChE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;WACzE,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,MAAM;WAC1D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,gEAAgE,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;eACvD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,gBAAgB,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YAC/G,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,+DAA+D,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;eACjF,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;eAC9E,CAAC,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC;eAClE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;eACjC,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,CAAC,MAAM;eAC5D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,wDAAwD,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/src/alpha7/corrective-recovery.js

@@ -275,8 +275,9 @@ function assessStopOverrideContextRebind(store, task, stepId, stopDecision, reme
         });
     }
     assertCorrectiveAuditorIndependence(store, task, stepId, stopDecision.auditor);
-    const rebindEvidence = assessAppendOnlyContextPlanRebindEvidence(store, task, stepId, stopDecision, { allowTaskRevisionAdvance: step.status === 'in_progress' });
-    requireStopOverrideHeadContinuity(repositoryRoot, task, override, rebindEvidence.authorization);
+    const rebindEvidence = assessAppendOnlyContextPlanRebindEvidence(store, task, stepId, stopDecision);
+    const verifiedHeadRecoveries = requireStopOverrideHeadContinuity(repositoryRoot, task, override, rebindEvidence.authorization);
+    requireEvidenceBoundAuditTaskRevision(task, rebindEvidence.reboundAudit, verifiedHeadRecoveries, step.status === 'in_progress');
     const stopAt = Date.parse(stopDecision.recordedAt);
     const overrideAt = Date.parse(override.recordedAt);
     const firstRebindAt = Date.parse(rebindEvidence.rebindChain[0].recordedAt);
@@ -373,7 +374,7 @@ function assessContextOnlyPlanRebindEvidence(store, task, stepId, sourceDecision
         autonomyContract,
     };
 }
-function assessAppendOnlyContextPlanRebindEvidence(store, task, stepId, sourceDecision, options = {}) {
+function assessAppendOnlyContextPlanRebindEvidence(store, task, stepId, sourceDecision) {
     if (!task.planHash || task.knowledgeMapRevision === null || !task.knowledgeMapHash) {
         throw new WorkflowError('STATE_CORRUPT', `Task ${task.id} is missing current Plan or Knowledge bindings.`);
     }
@@ -383,7 +384,7 @@ function assessAppendOnlyContextPlanRebindEvidence(store, task, stepId, sourceDe
     const planRiskAudits = readPlanRiskAuditEvents(store, task);
     const rebindChain = requireAppendOnlyRebindChain(task, sourceDecision, planRiskAudits);
     const planEvidence = comparePlanRebindChainArtifacts(store.taskRoot(task.projectId, task.id), sourceDecision.planHash, task.planHash, rebindChain);
-    const { sourceAudit, reboundAudit, auditChain } = requireMechanicalAuditReboundChain(task, sourceDecision, planRiskAudits, rebindChain, options.allowTaskRevisionAdvance ?? false);
+    const { sourceAudit, reboundAudit, auditChain } = requireMechanicalAuditReboundChain(task, sourceDecision, planRiskAudits, rebindChain);
     if (!reboundAudit.stepClassifications.some((classification) => classification.stepId === stepId && classification.reviewRequired)) {
         throw new WorkflowError('TRANSITION_BLOCKED', `Step ${stepId} is not guarded by the current Plan Risk Audit.`);
     }
@@ -611,7 +612,7 @@ function requireAppendOnlyRebindChain(task, decision, planRiskAudits) {
     }
     return chain;
 }
-function requireMechanicalAuditReboundChain(task, decision, events, rebindChain, allowTaskRevisionAdvance) {
+function requireMechanicalAuditReboundChain(task, decision, events, rebindChain) {
     const planHashes = [decision.planHash, ...rebindChain.map((record) => record.reboundPlanHash)];
     const auditChain = planHashes.map((planHash) => {
         const matches = events.filter((event) => event.planHash === planHash);
@@ -635,15 +636,6 @@ function requireMechanicalAuditReboundChain(task, decision, events, rebindChain,
         throw new WorkflowError('STATE_CORRUPT', 'Plan Risk Audit rebind chain does not end at the current append-only boundary.');
     }
     const reboundAudit = auditChain.at(-1);
-    const authorizedTaskRevision = reboundAudit.taskRevision + 1;
-    if ((!allowTaskRevisionAdvance && authorizedTaskRevision !== task.revision)
-        || (allowTaskRevisionAdvance && authorizedTaskRevision > task.revision)) {
-        throw new WorkflowError('STATE_CORRUPT', 'Mechanical rebound audit chain does not bind the required Task authorization boundary.', {
-            reboundAuditTaskRevision: reboundAudit.taskRevision,
-            currentTaskRevision: task.revision,
-            allowTaskRevisionAdvance,
-        });
-    }
     return { sourceAudit: auditChain[0], reboundAudit, auditChain };
 }
 function assertMechanicalAuditSuccessor(task, sourceAudit, reboundAudit) {
@@ -667,7 +659,7 @@ function requireStopOverrideHeadContinuity(repositoryRoot, task, override, autho
         throw new WorkflowError('TRANSITION_BLOCKED', 'Current execution authorization does not bind a Git HEAD.');
     }
     if (authorizedHead === override.headCommit)
-        return;
+        return [];
     if (!gitIsAncestor(repositoryRoot, override.headCommit, authorizedHead)) {
         throw new WorkflowError('TRANSITION_BLOCKED', 'Current execution HEAD is not an append-only descendant of the stop-override HEAD.', {
             overrideHeadCommit: override.headCommit,
@@ -680,6 +672,9 @@ function requireStopOverrideHeadContinuity(repositoryRoot, task, override, autho
         throw new WorkflowError('STATE_CORRUPT', 'Git reports distinct stop-override and authorization HEADs without an intervening commit.');
     }
     let expectedParent = override.headCommit;
+    let previousRecoveryIndex = -1;
+    let previousRecoveryAt = Number.NEGATIVE_INFINITY;
+    const verifiedRecoveries = [];
     for (const commit of commits) {
         const matches = (task.dependencyProvenanceRecoveries ?? []).filter((record) => record.commitSha === commit);
         if (matches.length !== 1) {
@@ -689,12 +684,17 @@ function requireStopOverrideHeadContinuity(repositoryRoot, task, override, autho
             });
         }
         const recovery = matches[0];
+        const recoveryIndex = (task.dependencyProvenanceRecoveries ?? []).indexOf(recovery);
+        const recoveryAt = Date.parse(recovery.recordedAt);
         const parents = runGit(repositoryRoot, ['show', '-s', '--format=%P', commit]).split(/\s+/).filter(Boolean);
         const filesOutput = runGit(repositoryRoot, ['diff-tree', '--no-commit-id', '--name-only', '-r', commit]);
         const files = filesOutput ? filesOutput.split('\n').sort() : [];
         if (parents.length !== 1
             || parents[0] !== expectedParent
             || recovery.parentCommitSha !== expectedParent
+            || recoveryIndex <= previousRecoveryIndex
+            || !Number.isFinite(recoveryAt)
+            || recoveryAt <= previousRecoveryAt
             || recovery.packageName !== PACKAGE_NAME
             || canonicalJsonStringify(recovery.files) !== canonicalJsonStringify(['package-lock.json', 'package.json'])
             || canonicalJsonStringify(files) !== canonicalJsonStringify(['package-lock.json', 'package.json'])
@@ -707,11 +707,33 @@ function requireStopOverrideHeadContinuity(repositoryRoot, task, override, autho
                 files,
             });
         }
+        verifiedRecoveries.push(recovery);
+        previousRecoveryIndex = recoveryIndex;
+        previousRecoveryAt = recoveryAt;
         expectedParent = commit;
     }
     if (expectedParent !== authorizedHead) {
         throw new WorkflowError('STATE_CORRUPT', 'Dependency-provenance Git chain does not terminate at the authorized HEAD.');
     }
+    return verifiedRecoveries;
+}
+function requireEvidenceBoundAuditTaskRevision(task, reboundAudit, verifiedHeadRecoveries, allowTaskRevisionAdvance) {
+    const auditAt = Date.parse(reboundAudit.recordedAt);
+    if (!Number.isFinite(auditAt)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Current rebound Plan Risk Audit timestamp is invalid.');
+    }
+    const postAuditRecoveries = verifiedHeadRecoveries.filter((recovery) => Date.parse(recovery.recordedAt) > auditAt);
+    const evidenceBoundTaskRevision = reboundAudit.taskRevision + 1 + postAuditRecoveries.length;
+    if ((!allowTaskRevisionAdvance && evidenceBoundTaskRevision !== task.revision)
+        || (allowTaskRevisionAdvance && evidenceBoundTaskRevision > task.revision)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Mechanical rebound audit chain does not bind the evidence-accounted Task authorization boundary.', {
+            reboundAuditTaskRevision: reboundAudit.taskRevision,
+            currentTaskRevision: task.revision,
+            postAuditDependencyRecoveryCommits: postAuditRecoveries.map((recovery) => recovery.commitSha),
+            evidenceBoundTaskRevision,
+            allowTaskRevisionAdvance,
+        });
+    }
 }
 function assertRebindMatchesPlans(rebind, plans) {
     if (rebind.fromKnowledgeMapRevision !== plans.decisionBinding.revision