codex-workflow-v2 2.0.0-beta.12.4 → 2.0.0-beta.12.5

package/docs/autonomy-guardrails.md

@@ -141,6 +141,22 @@ validation, Risk Audit, Human confirmation, journaled execution, readback, and r
 authorization. Other check failures use the normal continuable remediation route; they do not
 receive the narrow Plan-integrity shortcut, but attempt count alone never stops them.
 
+### Downstream-proof predecessor recovery
+
+Core prevents `task step-complete` when the active proof Step has dirty files outside its own
+`allowedWrites`. A bounded recovery is advertised only when every such file belongs to a completed
+transitive predecessor, the branch and registered Git history are exact, the active Step has no
+completion evidence, and no unrelated path exists. The atomic transition preserves product files
+and HEAD, moves invalidated predecessor commits into historical `invalidatedStepCommits`, clears stale Step
+evidence, supersedes execution authority, yields C1, and routes the same Task to ordinary `plan-set`.
+The route grants no authority to change Task objective, requirements, acceptance, or Milestone
+topology.
+
+Docker permission diagnostics are classified before consuming retry authority. Sandbox `EPERM` or
+permission denial gets one exact escalated rerun of the health probe/Plan check. It is not an infra
+failure and cannot authorize a Docker Desktop restart or image substitution. Only an escalated
+invocation that reaches Docker and proves daemon unavailability establishes that failure class.
+
 ## Atomic context refresh
 
 When `next` returns top-level `action: task context-refresh` with an exact option, a

package/docs/development-flow.md

@@ -99,6 +99,18 @@ the exact evidence-bound early `replan-required` posture; it never edits source,
 Continue through the advertised corrective yield and corrective replan rather than calling
 `task run` again.
 
+If a later proof Step leaves changes both in its own scope and in files owned by a completed
+transitive predecessor, fresh `next` advertises `task downstream-proof-recover` instead of
+`task step-complete`. The command preserves the dirty worktree and HEAD, append-only records the
+invalidated predecessor completion, yields its C1 lease, and returns the same Task to `task plan-set`.
+The replacement Plan must cover the unfinished remainder and pass a fresh Risk Audit and execution
+authorization. Do not stash, reset, commit, or recreate the Task around this route.
+
+A sandboxed Docker `EPERM`, `operation not permitted`, or `permission denied` result is not a failed
+daemon check. Re-run the exact probe/check once with sandbox escalation without consuming a retry.
+Restart Docker Desktop only with separate authorization after the escalated call reaches Docker and
+proves the daemon unavailable.
+
 Execution authorization and final acceptance use the human path by default. If the user has
 previously issued an active delegation grant for the exact transition and scope, the named
 delegate may perform that transition with `--delegation-grant`. The event keeps the delegate

package/docs/pdf/sources/codex-workflow-v2-architecture-ru.md

@@ -1,10 +1,10 @@
 ---
-title: Codex Workflow V2: архитектура beta.12.4
+title: Codex Workflow V2: архитектура beta.12.5
 subtitle: Источники истины, lifecycle, роли, delegation, зависимости Tasks и границы доверия
 part: Часть 1 из 3 | Архитектура
 document_version: 2.0
-date: 28 августа 2026
-subject: Архитектура и границы Codex Workflow V2 beta.12.4
+date: 29 августа 2026
+subject: Архитектура и границы Codex Workflow V2 beta.12.5
 ---
 
 # 1. Назначение и граница системы
@@ -18,7 +18,7 @@ Codex Workflow V2 - локальный state machine поверх Codex App, Git
 Система рассчитана на одного пользователя и одну машину. Она не предоставляет distributed locking,
 криптографическую идентификацию actor string или безопасную синхронизацию state между компьютерами.
 
-## 1.1. Что beta.12.4 гарантирует
+## 1.1. Что beta.12.5 гарантирует
 
 - exact project-local npm package и совместимый handshake до lifecycle действий;
 - Discovery до materialization Task или Milestone;
@@ -29,8 +29,10 @@ Codex Workflow V2 - локальный state machine поверх Codex App, Git
 - external-sealed Step/Task review в отдельных Codex tasks;
 - state-bound human gates либо ранее выданные bounded delegation contracts;
 - journaled recovery для составных переходов и fail-closed поведение при drift/corruption.
+- bounded recovery, когда downstream proof требует изменить уже завершённый predecessor Step:
+  worktree и HEAD сохраняются, stale completion authority снимается, та же Task возвращается в planning.
 
-## 1.2. Что beta.12.4 не гарантирует
+## 1.2. Что beta.12.5 не гарантирует
 
 - правильность продуктовой идеи или автоматически выбранного provider Task;
 - semantic sufficiency Plan, если точные факты нельзя доказать поддерживаемым analyzer;
@@ -247,13 +249,25 @@ beta.11 `task plan-integrity-recover` существует для одного
 отсутствует exact root npm script и текущий Step не может изменить package.json. Recovery не меняет
 worktree или Plan и не создаёт synthetic second failure; он записывает bound `replan-required`.
 
+beta.12.5 различает другой случай: активный downstream proof оставил изменения в собственном scope и
+показал необходимость исправить completed transitive predecessor. Fresh `next` вместо невозможного
+`step-complete` рекламирует `task downstream-proof-recover`. Atomic transition сохраняет dirty files и
+HEAD, переносит predecessor commits в historical `invalidatedStepCommits`, очищает только stale Step evidence,
+yield C1 и возвращает ту же Task к новому Plan/risk audit/authorization. Unrelated dirty file,
+non-predecessor ownership, повреждённый journal или unregistered commit fail closed.
+
+Docker socket `EPERM` в sandbox не является доказательством сломанного daemon. Gateway один раз
+повторяет exact health probe или Plan check с sandbox escalation без расходования remediation attempt.
+Restart Docker Desktop требует отдельного разрешения и допустим только после escalated daemon failure.
+
 > **Стоп P04-A:** `split-required` возвращает `STRUCTURAL_REPLACEMENT_REQUIRED` и `structuralReplacementAvailable=false`. Нельзя вызывать retained replacement command, потреблять replacement Discovery или вручную менять topology. Продолжение возможно только после P04-B/P05.
 
 # 10. Operational checklist
 
 - exact package version установлен, bundled gateway соответствует release и переустановлен;
-- handshake подтверждает protocol 2, state schema 2 и beta.12.4 capabilities;
+- handshake подтверждает protocol 2, state schema 2 и beta.12.5 capabilities;
 - каждый mutation следует свежему `status -> next` и exact option contract;
+- Docker permission failure сначала классифицируется как sandbox boundary, а не как infra retry;
 - semantic unknowns и human gates не маскируются delegation;
 - Task chats создаёт coordinator, credentials остаются только в памяти;
 - dependencies, progress и review posture берутся из Core projections;

package/docs/pdf/sources/codex-workflow-v2-chat-only-guide-ru.md

@@ -1,13 +1,13 @@
 ---
 title: Codex Workflow V2: delegated chat-only guide
-subtitle: Актуальный beta.12.4 путь от нового Discovery до принятого Milestone без ручного CLI
+subtitle: Актуальный beta.12.5 путь от нового Discovery до принятого Milestone без ручного CLI
 part: Часть 2 из 3 | Практика
 document_version: 2.0
-date: 28 августа 2026
-subject: Практическое руководство по delegated Discovery и Milestone в Workflow V2 beta.12.4
+date: 29 августа 2026
+subject: Практическое руководство по delegated Discovery и Milestone в Workflow V2 beta.12.5
 ---
 
-# 1. Рабочая модель beta.12.4
+# 1. Рабочая модель beta.12.5
 
 Пользователь работает в одном Codex Project и формулирует продуктовый outcome. Coordinator выполняет
 CLI, создаёт отдельные Task/Reviewer chats и ведёт supervision loop. Workflow Core остаётся authority
@@ -40,7 +40,7 @@ Blocking unknown, scope change, grant issuance или unrecoverable integrity co
 # 2. Подготовка проекта перед новым Discovery
 
 1. Убедитесь, что checkout чистый и выбран правильный repository root.
-2. Установите beta.12.4 как точную devDependency после публикации release.
+2. Установите beta.12.5 как точную devDependency после публикации release.
 3. Обновите и переустановите bundled `codex-workflow-gateway` этого release.
 4. Проверьте, что declared и installed package versions равны.
 5. Запустите новый Coordinator chat, не fork старого Milestone conversation.
@@ -56,7 +56,7 @@ AGENTS.md
 -> doctor только как дополнительная диагностика
 ```
 
-Handshake beta.12.4 должен сообщать `packageVersion=2.0.0-beta.12.4`, `protocolVersion=2`,
+Handshake beta.12.5 должен сообщать `packageVersion=2.0.0-beta.12.5`, `protocolVersion=2`,
 `stateSchemaVersion=2`, dependency DAG, initial Plan transaction, mechanical feasibility,
 Milestone autonomy и structural replacement disabled capabilities.
 
@@ -116,7 +116,7 @@ delegate, scope, transitions и expiry. DGR передаётся только е
 ```text
 НОВЫЙ COORDINATOR CHAT
 
-Проведи новый Milestone через Codex Workflow V2 beta.12.4 в delegated режиме.
+Проведи новый Milestone через Codex Workflow V2 beta.12.5 в delegated режиме.
 Repository: <ABSOLUTE-REPOSITORY-ROOT>.
 Milestone ID: AUTO.
 Delegate actor: agent:milestone-coordinator.
@@ -293,6 +293,7 @@ Task chat записывает его только при совпадении p
 | Состояние | Действие |
 |---|---|
 | First proven impossible npm check после legacy/late authorization | Только рекламируемый `task plan-integrity-recover` |
+| Downstream proof требует изменить completed predecessor | Только `task downstream-proof-recover`, затем новый Plan/risk audit/authorization в той же Task |
 | Failed guarded review | Та же Task: исправление и новый strict review без attempt hard stop |
 | Finding `route=fix` | Продолжить тот же Step; count остаётся диагностикой |
 | Finding `route=replan` с exact Plan conflict | `task plan-set`, меняются только implementation Steps |
@@ -305,6 +306,15 @@ Task chat записывает его только при совпадении p
 Plan-integrity recovery не редактирует Plan, package.json или worktree и не синтезирует второй failure.
 P04-A не переносит completed Steps и не rewires dependencies при split.
 
+`task downstream-proof-recover` также не редактирует product files и не создаёт новую Task. Он сохраняет
+dirty worktree/HEAD, append-only фиксирует invalidated predecessor evidence, освобождает C1 и возвращает
+текущую Task к `task plan-set`. Если fresh `next` не рекламирует этот переход, вызывать его нельзя.
+
+Ошибка Docker socket/CLI `EPERM`, `operation not permitted` или `permission denied` в sandbox не считается
+падением daemon и не расходует retry. Повторите exact read-only probe или Plan check один раз с sandbox
+escalation. Не перезапускайте Docker Desktop и не меняйте image без отдельного разрешения и подтверждённого
+escalated daemon failure.
+
 Если после применённого stop override `next` рекламирует delegated `task context-refresh` или
 `update dependency-provenance-recover`, выполните только этот advertised atomic/recovery переход и
 снова запросите `status -> next`. Таких механических refresh/update циклов может быть несколько.
@@ -335,7 +345,7 @@ Task/project DGR. `dependencyBinding` для standalone handoff равен null.
 
 # 14. Итоговый checklist пользователя
 
-- beta.12.4 exact package и новый bundled gateway установлены;
+- beta.12.5 exact package и новый bundled gateway установлены;
 - новый Coordinator chat не является fork старого Milestone;
 - bootstrap DGR, если нужен, выдан отдельным exact human confirmation;
 - Discovery не materialized при blocking unknowns;
@@ -345,5 +355,6 @@ Task/project DGR. `dependencyBinding` для standalone handoff равен null.
 - credentials не появились в prompts, reports или files;
 - каждый transition пришёл из fresh `next`;
 - beta.11 stop override, если рекламировался, прошёл отдельные prepare и user-confirmed apply без journal rewrite;
+- downstream predecessor recovery, если рекламировался, сохранил worktree и завершился новым Plan authority;
 - split-required остановился без replacement mutations;
 - Milestone validation и final acceptance связаны с текущим clean base HEAD.

package/docs/pdf/sources/codex-workflow-v2-technical-reference-ru.md

@@ -1,10 +1,10 @@
 ---
-title: Codex Workflow V2: технический справочник beta.12.4
+title: Codex Workflow V2: технический справочник beta.12.5
 subtitle: Protocol 2, state schema 2, transactions, credentials, dependency authority, review и recovery
 part: Часть 3 из 3 | Technical reference
 document_version: 2.0
-date: 28 августа 2026
-subject: Технический контракт Codex Workflow V2 beta.12.4
+date: 29 августа 2026
+subject: Технический контракт Codex Workflow V2 beta.12.5
 ---
 
 # 1. Runtime contract
@@ -13,9 +13,9 @@ Workflow V2 предоставляет локальные revisioned transitions
 и `value` либо структурированную ошибку с `code`, `message` и `details`. Chat, PDF и gateway не создают
 authority сами: mutating permission определяется runtime state и свежим `next`.
 
-| Параметр beta.12.4 | Значение |
+| Параметр beta.12.5 | Значение |
 |---|---|
-| npm package | `codex-workflow-v2@2.0.0-beta.12.4` |
+| npm package | `codex-workflow-v2@2.0.0-beta.12.5` |
 | protocolVersion | 2 |
 | stateSchemaVersion | 2 |
 | lifecycle epoch | 2 |
@@ -37,7 +37,7 @@ Gateway выполняет:
 5. вызов только package-local `dist/src/cli.js --repo <root>`;
 6. `gateway handshake` до lifecycle действий.
 
-Ключевые beta.12.4 capabilities:
+Ключевые beta.12.5 capabilities:
 
 | Группа | Capabilities |
 |---|---|
@@ -46,7 +46,7 @@ Gateway выполняет:
 | Task planning | Plan Risk Audit, proof obligations, mechanical feasibility |
 | C1 | handoff sidecar, handoff bundle, derived Worker actor, credential replacement |
 | Reviews | strict reviewer, Step strict review, continuable remediation, evidence-bound fix/replan routing |
-| Recovery | Task-local dependency provenance, plan integrity, remediation mode, legacy stop override, append-only stop-rebind chain, corrective yield/replan journals |
+| Recovery | Task-local dependency provenance, plan integrity, downstream-proof predecessor invalidation, remediation mode, legacy stop override, append-only stop-rebind chain, corrective yield/replan journals |
 | Replacement | `structural-task-replacement-disabled-v1` |
 
 Handshake incompatibility прекращает работу. Запуск global package, `latest`, mutable range или соседней
@@ -316,7 +316,7 @@ fresh `next` через corrective yield и обычный Human-confirmed repla
 P01-A предотвращает поддерживаемые contradictions до fresh authorization. beta.11 path остаётся для
 pre-P01 authorizations и late/unsupported exact recovery cases.
 
-# 13.1. beta.12.4 compatibility transitions
+# 13.1. beta.12.5 compatibility transitions
 
 `update dependency-provenance-recover` больше не требует полного равенства Task manifest/lock с base.
 Base остаётся version authority, а parent/HEAD candidate сравниваются без единственных Workflow
@@ -345,6 +345,20 @@ diff. Semantic drift, иной commit или разрыв chain fail closed. Pro
 из уже проверенной override-to-authorization Git chain. Формула должна точно равняться current Task
 revision; unrelated write, duplicate, неверный parent или product commit блокируют continuation.
 
+# 13.2. Downstream-proof predecessor recovery
+
+Если active Step изменяет только собственный proof artifact, обычный `task step-complete` сохраняется.
+Если dirty set дополнительно содержит файлы completed transitive predecessor, Core проверяет branch,
+зарегистрированную Git history, dependency closure и ownership каждого такого файла. При точном совпадении
+fresh `next` рекламирует lease-bound `task downstream-proof-recover` вместо заведомо невозможного commit.
+
+Одна project transaction сохраняет worktree и HEAD, append-only записывает
+`downstream-proof-invalidations.jsonl`, переносит invalidated completion commits в `invalidatedStepCommits`, очищает
+их Step evidence, блокирует proof Step, supersede execution authorization, yield C1 и удаляет lease.
+Следующий action — обычный `task plan-set` той же Task. Replacement Plan обязан заново охватить unfinished
+remainder и пройти fresh Plan Risk Audit и execution authorization. Unrelated/non-predecessor file,
+strict-review evidence, unregistered commit, branch mismatch или damaged sidecar возвращают `doctor`.
+
 # 14. P04-A structural replacement boundary
 
 Command shape `task replacement-materialize` retained только для compatibility diagnostics. Любая попытка
@@ -399,10 +413,15 @@ Graph является навигационным индексом, не Project
 | `GIT_PRECONDITION_FAILED` | Branch/base/clean/history mismatch | Штатная Git recovery/sync route |
 | `COMMAND_FAILED` | Git/check/provider process failed | Сохранить evidence и устранить concrete cause |
 
+Docker socket/CLI `EPERM`, `operation not permitted` или `permission denied` внутри sandbox классифицируется
+как execution-boundary access, не как `COMMAND_FAILED` daemon. Exact read-only probe или Plan check один раз
+повторяется с escalation и не расходует remediation/infra retry. Restart Docker Desktop или image mutation
+без отдельного разрешения запрещены; daemon failure подтверждает только escalated invocation.
+
 После каждой successful mutation обязателен sequential `status`, затем fresh `next`. Failed status/next
 не разрешает direct mutation. Syntax help read-only и не заменяет navigation authority.
 
-# 18. Public command surface beta.12.4
+# 18. Public command surface beta.12.5
 
 | Область | Actions |
 |---|---|
@@ -417,7 +436,7 @@ Graph является навигационным индексом, не Project
 | Task execution | `start`, `run`, `step-complete`, `submit`, `result-set`, `accept`, `sync-base`, `merge`, `merge-confirm` |
 | C1 | `handoff[-prepare/-replace/-show]`, `claim`, `writer-credential-replace`, `handback[-create]` |
 | Review | review/step-review packet, launch, sealed record и record actions |
-| Corrective | decision/recovery, plan-integrity, remediation-mode, stop-override prepare/apply, yield и corrective-replan actions |
+| Corrective | decision/recovery, plan-integrity, downstream-proof-recover, remediation-mode, stop-override prepare/apply, yield и corrective-replan actions |
 | Replacement | `replacement-materialize` retained, но всегда disabled в P04-A |
 
 Exact options берутся из fresh `next`; command help используется только когда
@@ -429,7 +448,7 @@ Exact options берутся из fresh `next`; command help используе
 running Step и active/stale writer lease. External runner допустим только в документированной rescue
 compatibility форме.
 
-Перед beta.12.4 tag release repository выполняет:
+Перед beta.12.5 tag release repository выполняет:
 
 1. `npm ci`;
 2. `npm run validate`;

package/docs/release.md

@@ -27,7 +27,7 @@ The PDF check deterministically regenerates all three Russian documents from
 `docs/pdf/sources`, binds the visible package version to the root manifest, and fails when any
 tracked PDF is stale. Source and binary PDFs are one release unit.
 
-For beta.12.4, the release gate also relies on `npm run release:check` to fail if:
+For beta.12.5, the release gate also relies on `npm run release:check` to fail if:
 
 - canonical entity schema 2 shapes drift;
 - protocol 2 is not the active public contract, or intact protocol-1 adoption evidence stops being readable through the bounded compatibility window;
@@ -50,6 +50,12 @@ For beta.12.4, the release gate also relies on `npm run release:check` to fail i
   registry, title fallback/readback, or long-Cyrillic multi-attempt E2E evidence is absent.
 - bounded first-failure Plan-integrity recovery, exact failed-remediation/manifest/worktree
   bindings, or the no-synthetic-second-failure regression is absent.
+- downstream proof cannot invalidate only completed transitive-predecessor authority while
+  preserving worktree/HEAD, yielding C1, and returning the same Task to fresh planning; or unrelated
+  dirty files and damaged invalidation evidence do not fail closed.
+- bundled gateway guidance treats Docker socket `EPERM` as daemon failure, consumes a remediation
+  attempt before one exact escalated probe, or recommends restarting Docker Desktop without separate
+  authority.
 - the P04-A Milestone dependency/initial-Plan transaction capabilities or the P01-A mechanical
   feasibility capability is absent from the packaged handshake.
 - continuable guarded remediation or evidence-bound `fix`/`replan` review routing is absent, or a

package/docs/validation-report.md

@@ -1,98 +1,101 @@
-# V2 beta.12.4 Validation Report
+# V2 beta.12.5 Validation Report
 
-Release candidate `2.0.0-beta.12.4` was validated on 2026-08-28 (Europe/Moscow) with
+Release candidate `2.0.0-beta.12.5` was validated on 2026-08-29 (Europe/Moscow) with
 Node.js 24.17.0.
 
 ## Automated release evidence
 
-- `npm ci` completed from the lockfile with 0 reported vulnerabilities.
-- The final `npm run validate` passed typecheck and `328/328` sequential tests with no failures,
-  skips, cancellations, or todos in 1,348,269.052041 ms.
-- The suite includes the beta.12.4 real-order replay (`stop override -> context refresh -> base
-  transport -> dependency provenance recovery -> task run`) and two fail-closed controls: an
-  unexplained Task revision and damaged post-audit dependency provenance. Existing beta.12.3
-  chained rebind, Signal T04, five-cycle remediation, transaction, credential, observer-purity,
-  dependency DAG, transition-catalog, and lifecycle transcript tests also remained green.
-- `npm run pack:check` built the exact beta.12.4 package and reported a 270-file tarball. The first
-  sandboxed attempt could not write the existing npm cache (`EPERM`); the authorized retry using
-  the same source passed.
-- `npm run smoke:downstream` packed and installed the tarball in a clean temporary project and
-  passed its packaged handshake. The sandboxed attempt could not resolve the npm registry for AJV;
-  the authorized network retry using the same source passed.
-- `npm run plugin:check`, the official Codex plugin validator, the gateway skill validator,
-  `npm run docs:pdf:check`, exact `RELEASE_TAG=v2.0.0-beta.12.4 npm run release:check`, and
-  `git diff --check` passed. The bundled gateway cachebuster is
-  `0.1.0+codex.20260828064343`.
+- The pre-install `npm run validate` passed typecheck and `332/332` sequential tests with no
+  failures, skips, cancellations, or todos in 1,313,147.293583 ms.
+- `npm ci` then completed from the lockfile with 0 reported vulnerabilities. The clean-install
+  `npm run validate` independently passed the same `332/332` tests in 1,312,649.239333 ms.
+- A final credential-recovery review then added one mapping and one regression test for an eligible
+  claimed C1 recovery whose writer lease is absent. Post-change typecheck and the focused
+  downstream-proof, CLI-help, and lifecycle-model suite passed `15/15`; the final full
+  `npm run validate` passed `333/333` tests with no failures, skips, cancellations, or todos in
+  1,321,160.33825 ms.
+- The suite covers the beta.12.5 downstream-proof recovery, exact lifecycle inventory, C1 yield,
+  one-writer concurrency, transaction crash boundaries, tampered sidecars, unrelated dirty files,
+  ordinary active-Step completion, existing Signal T04 recovery, dependency DAG, observer purity,
+  credential secrecy, corrective replay, and Milestone validation/acceptance.
+- `npm run pack:check` built the exact beta.12.5 package: 274 files, 995.1 kB packed and 3.9 MB
+  unpacked. The first sandboxed attempt could not write the user npm cache (`EPERM`); the exact
+  authorized retry passed and included the new runtime module and public schema.
+- `npm run smoke:downstream` packed and installed the tarball in a disposable consumer project and
+  returned `ok=true`. The sandboxed attempt could not resolve the npm registry (`ENOTFOUND`); the
+  exact network-authorized retry passed.
+- `npm run plugin:check`, `npm run docs:pdf:check`, exact
+  `RELEASE_TAG=v2.0.0-beta.12.5 npm run release:check`, and `git diff --check` passed. The bundled
+  gateway cachebuster remains `0.1.0+codex.20260828064343`.
 
 ## Root cause and bounded correction
 
-- beta.12.3 validated the chained Knowledge-only Plan rebind and the exact Git
-  dependency-provenance chain, but retained the older Task-revision predicate
-  `reboundAudit.taskRevision + 1 === task.revision` for a failed Step.
-- Signal's actual install flow created the last mechanical Plan Risk Audit at Task revision 22,
-  wrote the atomic context-refresh result at revision 23, then registered one advertised
-  dependency-provenance recovery at revision 24. The old predicate therefore rejected valid,
-  already-verified administrative evidence at the next navigation step.
-- beta.12.4 derives the exact authorization boundary as
-  `reboundAudit.taskRevision + 1 + verifiedPostAuditRecoveries.length`. Only recovery records from
-  the already validated stop-override-to-authorization Git chain count. Each record must remain
-  ordered, single-parent, present in `systemCommits`, and an exact `package.json` plus
-  `package-lock.json` Workflow dependency commit.
-- This is not a permissive `revision >=` rule. An unrelated state write, duplicate or malformed
-  recovery, wrong parent, product-file change, semantic Plan drift, or broken chronology still
-  routes to diagnostics.
+- A downstream executable proof can demonstrate that a completed predecessor Step must change.
+  The existing navigation still advertised `task step-complete`, but that command correctly
+  rejected predecessor-owned dirty files. Repeating the command or increasing remediation attempts
+  could not solve the authority contradiction: predecessor completion evidence remained canonical
+  while the proof required changing its output.
+- beta.12.5 adds `task downstream-proof-recover`. It is advertised only when every dirty file
+  outside the active Step belongs to a completed transitive predecessor, Task branch/Plan/history
+  bindings are exact, the active Step has no completion evidence, and the Task uses a local
+  workspace. Unrelated files, damaged history, a branch mismatch, a malformed audit journal, or an
+  unregistered commit fail closed to `doctor`.
+- One crash-recoverable project transaction preserves worktree bytes and HEAD, append-only records
+  `downstream-proof-invalidations.jsonl`, moves invalidated product commits to historical
+  `invalidatedStepCommits`, clears stale Step/review/execution authority, yields claimed C1, removes
+  the writer lease, and returns the same Task to ordinary `task plan-set`.
+- No completed-Step adoption or synthetic replacement Task is performed. The replacement Plan must
+  re-cover the unfinished proof and invalidated predecessor work, then pass normal audit,
+  authorization, execution, and review again.
 
 ## Exact Signal read-only proof
 
-- The final built beta.12.4 validator inspected Signal repository
-  `/Users/home-pc/htdocs/projects/signal_v4`, Task
-  `TASK-01M0WXJAD4GZGVNRJ284ND95C6`, and failed Step
-  `STEP-001-PROCESSING-MIGRATIONS` without mutating the repository or Workflow state.
-- The persisted state has Task revision 24, current Plan hash
-  `6a0c9b7a2a2ec11c9d6a9a24137dc17be1ecd18be42cf0188200942313776a50`, four Knowledge rebinds,
-  three dependency-provenance recoveries, applied override
-  `SOO-01M127VPRC5M5F3E3K7PS4MFJY`, and final rebound audit revision 22. Exactly one verified
-  recovery was recorded after that audit, so `22 + 1 + 1 = 24`.
-- A direct final-build `next --repo /Users/home-pc/htdocs/projects/signal_v4 --json` returned
-  `action=task run`, revision 24, the expected Step, and
-  `stopOverrideContextRebind.state=validated`. It also preserved the exact claimed C1 actor and
-  writer-credential recovery contract.
-- This proves compatibility with the currently persisted Signal M3 boundary. It does not prove
-  that future product implementation or strict reviews will pass.
+- The final built beta.12.5 classifier inspected Signal repository
+  `/Users/home-pc/htdocs/projects/signal_v4`, project
+  `b06d0f18f790f4521a23c770`, and Task
+  `TASK-01M0WXJAD4GZGVNRJ284ND95C6` without mutating repository or Workflow state.
+- Persisted Task revision is 103 on branch
+  `codex/task-01m0wxjad4-processing-persistence-schema`; active Step is
+  `STEP-002-REAL-POSTGRES-PROOF`. HEAD is
+  `88f8bf70d1591852ad90c976625430d4f20585ac`.
+- The classifier observed six dirty files. Five are outside the active Step and are owned by the
+  completed transitive predecessor `STEP-001-PROCESSING-MIGRATIONS`; the sixth,
+  `tools/postgres/run-processing-integration.ts`, belongs to the active proof Step. The predecessor
+  evidence commit equals the preserved HEAD.
+- The result was `applicable=true`, `eligible=true`, with no blockers. This proves that the exact
+  current Signal boundary has a bounded beta.12.5 transition. It does not prove that the replacement
+  Plan, product checks, strict review, or the remainder of Milestone 3 will pass.
 
-## Packaged, plugin, and transcript evidence
+## Sandbox-boundary prevention
 
-- Downstream smoke validated exact package resolution and the packaged beta.12.4 handshake in a
-  disposable installation.
-- The bundled gateway handshake reports package beta.12.4, protocol 2, state schema 2, and the new
-  `stop-override-post-audit-dependency-revision-v1` capability.
-- A temporary trusted-harness transcript recorded the final built `gateway handshake` invocation
-  and terminal result. `node scripts/validate-lifecycle-transcript.mjs` accepted both
-  post-provenance events. The log SHA-256 is
-  `4ec7d8cb105d901e82d1049c273c4f2ec8d22ea12e0116ed70cfa8ab703ea2eb`; the temporary log remains
-  outside the repository.
+- The bundled gateway now classifies Docker socket/CLI `EPERM`, `operation not permitted`, and
+  `permission denied` from a sandbox as an execution-boundary failure, not evidence that the daemon,
+  image, or product infrastructure is broken.
+- It permits one exact escalated read-only probe or Plan check without consuming a remediation or
+  infrastructure retry. Docker Desktop restart, daemon mutation, or image substitution still
+  requires separate authority and an actual escalated daemon failure.
+- Plugin validation pins this guidance. The release gates exercised analogous npm cache/network
+  sandbox boundaries, but no live Docker daemon failure was synthesized; Docker runtime behavior is
+  therefore documentation/gateway-contract evidence, not an end-to-end Docker test claim.
 
-The transcript proves release-time invocation/result discipline for the final CLI. It does not
-claim a product Milestone replay or lifecycle mutation. Compatibility is covered by the exact
-Signal read-only proof and deterministic integration tests above.
+## beta.12.5 PDF release documentation evidence
 
-## beta.12.4 PDF release documentation evidence
-
-- Three tracked Russian PDFs were deterministically regenerated from reviewable Markdown sources
-  under `docs/pdf/sources`; `npm run docs:pdf:check` reported an empty stale set.
-- All 26 pages were rendered and visually inspected: architecture is 7 pages, the delegated
-  chat-only guide is 8 pages, and the technical reference is 11 pages. Full-size inspection of the
-  three changed compatibility pages found no clipped, overlapping, or unreadable content.
-- Visible titles, headers, package commands, capabilities, and release gates identify beta.12.4.
-  The documents state the exact evidence-bound revision formula and its fail-closed boundary.
+- Three tracked Russian PDFs were regenerated from Markdown sources; `npm run docs:pdf:check`
+  reported an empty stale set.
+- All 27 pages were rendered and visually inspected: architecture is 7 pages, the delegated
+  chat-only guide is 9 pages, and the technical reference is 11 pages. The changed recovery,
+  Docker-boundary, command-surface, and release pages have no visible clipping, overlap, or
+  unreadable content.
+- Visible titles, headers, commands, capabilities, and release gates identify beta.12.5.
 
 ## Existing boundaries and non-claims
 
-- The generic stale `continue-fix` recovery predicate is unchanged. The compatibility route does
-  not reverse a semantic stop or authorize arbitrary Git/state history.
-- Structural replacement remains intentionally disabled. beta.12.4 does not implement P04-B,
+- Structural replacement remains intentionally disabled. beta.12.5 does not implement P04-B,
   topology rewiring, completed-Step adoption, or a wider delegation surface.
+- Recovery requires exact one-writer/C1 authority and a fresh `next`; it does not authorize manual
+  state edits, arbitrary Git history, unrelated dirty files, or automatic approval.
 - Validation performed no Signal mutation, npm publication, Git commit, tag, remote push, or local
-  plugin reinstall. Those are separate release actions after these gates.
-- A consumer must install the published exact beta.12.4 package, update/reinstall the bundled
-  gateway, and use fresh project-local `handshake -> doctor -> status -> next` navigation.
+  plugin reinstall. Those remain separate release actions.
+- A consumer must install the published exact beta.12.5 package, reinstall the bundled gateway, and
+  follow fresh project-local `handshake -> doctor -> status -> next` navigation before invoking the
+  advertised recovery.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.12.4",
+  "version": "2.0.0-beta.12.5",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -1,6 +1,6 @@
 # Gateway Protocol V2
 
-## beta.12.4 compatibility transitions and continuable remediation
+## beta.12.5 compatibility transitions and continuable remediation
 
 - When fresh `next` advertises `task plan-integrity-recover`, consume its exact Task revision,
   Step, actor, and writer-token contract. This route is valid only for the Core-derived
@@ -8,6 +8,13 @@
   It records a replan posture without changing Plan or product files; corrective yield and the
   existing state-bound corrective-replan Human gate remain mandatory.
 
+- When fresh `next` advertises `task downstream-proof-recover`, Core has proved that every dirty
+  file outside the active Step belongs to a completed transitive predecessor and that recorded Git
+  history is intact. Invoke the exact lease-bound transition once. It preserves product files and
+  HEAD, invalidates stale predecessor completion authority with an append-only event, yields C1,
+  and routes the same Task to ordinary `task plan-set`. The replacement Plan, risk audit, and
+  execution authorization are fresh authority; no Task or Milestone recreation is involved.
+
 - `update dependency-provenance-preflight --id <TASK-ID>` is read-only. The matching
   `update dependency-provenance-recover --id <TASK-ID> --expected-revision <N> --actor <ACTOR>
   --reason <TEXT>` is valid only when preflight and fresh `next` both advertise it. Historical
@@ -100,6 +107,7 @@ Current capability set:
 - `remediation-mode-recovery-v1`
 - `plan-proof-obligations-v1`
 - `bounded-plan-integrity-recovery-v1`
+- `downstream-proof-predecessor-recovery-v1`
 - `corrective-yield-journal-v1`
 - `corrective-replan-journal-v1`
 - `corrective-replan-human-gate-v1`
@@ -175,6 +183,13 @@ actor through `--actor`; reviewer identity remains internal to the route.
 An unrecorded commit is Git history drift. Stop instead of adding another commit or editing
 workflow state manually; recovery remains coordinator-controlled.
 
+If a Docker proof fails with `EPERM`, `operation not permitted`, or `permission denied` at the
+Docker socket/CLI boundary, classify it as sandbox access, not daemon failure. Re-run the exact
+read-only health probe or Plan command once with sandbox escalation; do not charge an infrastructure
+retry. Restarting Docker Desktop or pulling another image is forbidden on this evidence alone. A
+Docker infrastructure failure exists only when an escalated call reaches Docker and independently
+proves the daemon unavailable.
+
 ## Plan Risk Audit and remediation breaker
 
 Before `task authorize`, every new alpha.7 Task requires: