codex-workflow-v2 2.0.0-beta.12.7 → 2.0.0-beta.12.9

package/docs/validation-report.md

@@ -1,110 +1,104 @@
-# V2 beta.12.7 Validation Report
+# V2 beta.12.9 Validation Report
 
-Release candidate `2.0.0-beta.12.7` was validated on 2026-08-29 (Europe/Moscow) with
+Release candidate `2.0.0-beta.12.9` was validated on 2026-08-30 (Europe/Moscow) with
 Node.js 24.17.0.
 
 ## Automated release evidence
 
-- `npm ci` completed from the lockfile with 0 reported vulnerabilities.
-- The final post-fix `npm run validate` passed typecheck and `338/338` sequential tests with no
-  failures, skips, cancellations, or todos in 1,641,977.92675 ms. The same suite also passed after
-  the clean install (`338/338` in 1,661,195.192667 ms) and before it (`338/338` in
-  1,347,257.496667 ms).
-- `npm run test:signal-t03-replan-e2e` independently passed the full Signal-shaped compatibility
-  scenario. The focused dependency-provenance, downstream-proof, and lifecycle-model suite passed
-  `23/23`.
-- The Signal-shaped E2E starts with the exact six-path ownership split and the beta.12.6 accidental
-  post-invalidation Knowledge rebind. It then proves: read-only source eligibility, two
-  dependency-only transport commits, `HEAD^`/`HEAD` provenance validation, bounded dependency
-  registration, atomic replan recovery, required Project Knowledge refresh, mandatory replacement
-  `plan-set`, one-Step dirty carryover admission, hostile concurrency and rollback/restart checks,
-  Core-owned Step commit, passed strict Step Review, and fresh navigation to `task submit`.
-- Negative regressions reject stale Plan rebind, unrelated dirty files, changed content hash,
-  unknown history, a wider dependency candidate, current legacy-Plan audit/authorization, extra Task
-  revisions, active lease, pending transaction, corrupted invalidation/recovery sidecars, and a
-  replacement Plan that does not give one Step authority over the complete dirty set.
-- `npm run pack:check` built the exact beta.12.7 package: 275 files, 1.0 MB packed and 4.1 MB
-  unpacked. The sandboxed attempt
-  could not write the user npm cache (`EPERM`); the exact authorized retry passed.
+- `npm ci` completed from the exact lockfile with 0 reported vulnerabilities.
+- `npm run validate` passed typecheck and `343/343` sequential tests with no failures, skips,
+  cancellations, or todos in 1,894,344.070542 ms.
+- The focused Signal-shaped E2E proves both recovery entry points. It preserves the active dirty
+  worktree and HEAD, registers the exact historical Step commit, reaches fresh
+  `task step-complete`, completes that Step with a new Core-owned commit, and validates the resulting
+  Task history.
+- Negative cases reject pending or damaged strict review, absent final acceptance, multiple or wrong
+  commits, unrelated dirty paths, changed dirty content, active/stale leases, transactions, version
+  divergence, and a dependency candidate wider than package/lock.
+- Corrective-replan executor tests prove that future replacement Plans retain evidence commits of
+  omitted completed Steps in `invalidatedStepCommits`.
+- `npm run pack:check` built the exact beta.12.9 package with 278 files, 1.0 MB packed and 4.1 MB
+  unpacked. The initial sandboxed invocation could not write the user npm cache (`EPERM`); the exact
+  authorized retry passed.
 - `npm run smoke:downstream` packed and installed the tarball in a disposable consumer project and
   returned `ok=true`. The sandboxed attempt could not resolve the npm registry (`ENOTFOUND`); the
   exact network-authorized retry passed.
-- `npm run plugin:check`, `npm run docs:pdf:check`, and exact
-  `RELEASE_TAG=v2.0.0-beta.12.7 npm run release:check` passed after the final source changes. The
-  bundled gateway cachebuster is `0.1.0+codex.20260829143747`.
-
-## Root causes corrected by beta.12.7
-
-- beta.12.6 correctly invalidated the completed migration predecessor and required a replacement
-  Plan. A later Project Knowledge approval nevertheless mechanically rebound the rejected two-Step
-  Plan and returned the Task to `awaiting_execution_authorization`. The required `plan-set` boundary
-  was therefore lost.
-- The stranded state could not be fixed by another review attempt: no Step was runnable and the
-  current Plan was the artifact whose authority had already been rejected. The defect was routing
-  and recovery authority, not insufficient implementation effort.
-- A one-transition repair was also insufficient. The full E2E exposed two additional dead ends:
-  the exact dependency-only update makes Project Knowledge stale before repair, and the ordinary
-  `task run` clean-checkout precondition rejected the deliberately preserved dirty bytes even after
-  a correct replacement Plan.
-- beta.12.7 adds a closed compatibility sequence. The external source preflight recognizes only the
-  exact beta.12.6 stranded shape. Dependency registration binds the update commit to the original
-  invalidation, rebound Plan, preserved HEAD, dirty paths, and content hash. Replan recovery returns
-  the same Task to `needs_fix` without requiring the now-stale live Knowledge Map to be active.
-- Project Knowledge can then be reconciled and approved, but refresh/rebind routing cannot replace
-  the mandatory `task plan-set`. The old Plan receives no execution authority.
-- Dirty bytes are not adopted as completed evidence. After a fresh Plan Risk Audit and execution
-  authorization, `task run` permits carryover only when one planned Step owns every bound path and
-  current HEAD/path/content hashes exactly match the recovery event. All ordinary checks, Core Git
-  ownership, and strict-review requirements remain in force.
-
-## Exact Signal project evidence
-
-- The Signal repository `/Users/home-pc/htdocs/projects/signal_v4` was inspected and exercised on
-  branch `codex/task-01m0wxjad4-processing-persistence-schema` at
-  `4606eaf98f3c5f1f0dec4c361f34e2abe9aefa66`.
-- Its Workflow remains on exact `2.0.0-beta.12.6`. Task
-  `TASK-01M0WXJAD4GZGVNRJ284ND95C6` remains revision 106 and
-  `awaiting_execution_authorization`; live Workflow state was not mutated by beta.12.7 validation.
-- The dirty set remains exactly six paths: five modified processing-migration files and untracked
-  `tools/postgres/run-processing-integration.ts`. After temporary hostile-test additions were
-  removed, the beta.12.7 source preflight returned `eligible=true`, empty blockers, the preserved
-  HEAD above, and dirty-worktree SHA-256
-  `1cbeb0ccb4883ade6f2ea751423385cf504f5c18e45473f40cb9a39ca850ece1`.
-- The real Signal PostgreSQL harness was temporarily extended with two concurrent migrators and a
-  forced mid-migration conflict followed by restart. `npm run processing:postgres:test` passed clean
-  bootstrap/repeat, advisory-lock serialization, transaction rollback with no partial ledger/schema,
-  unchanged restart convergence, tamper/order denial, catalog fingerprint, immutable evidence, and
-  least-privilege checks against the pinned PostgreSQL image.
-- Those temporary product changes were then removed exactly and the original runner bytes were
-  verified against a parallel Signal checkout before the recovery fingerprint was re-read. This
-  proves product feasibility without falsely presenting pre-authorized test bytes to Workflow.
-- This is strong live read-only entry evidence plus real product proof. It is not a claim that the
-  unpublished beta.12.7 package has already updated Signal or mutated its Task. Final live continuation
-  still requires release publication, exact dependency-only transport, and following fresh
-  project-local `next` through the tested sequence.
+- `npm run plugin:check` passed for bundled gateway
+  `0.1.0+codex.20260830183000`.
+- `npm run docs:pdf:check` reported an empty stale set and exact beta.12.9 package binding.
+- `RELEASE_TAG=v2.0.0-beta.12.9 npm run release:check`, JSON parsing and `git diff --check` passed.
+
+## Root cause corrected by beta.12.9
+
+The corrective-replan paths replaced `task.steps` but did not preserve evidence commits belonging to
+completed Steps omitted from the new Plan. Git correctly retained those commits, while Task history
+authority no longer named them. A later `task step-complete` therefore rejected a legitimate,
+previously reviewed and accepted commit as unregistered history.
+
+Increasing implementation or review attempts cannot correct this condition. The historical Step had
+already passed strict review and final acceptance; the defect was loss of provenance during Plan
+replacement.
+
+## Implemented lifecycle contract
+
+- Both legacy `setTaskPlan` and journaled corrective-replan execution now retain omitted completed
+  Step evidence commits in `invalidatedStepCommits`.
+- `task historical-step-provenance-preflight/recover` repairs an already-installed beta.12.9 state
+  only when Core proves exactly one omitted commit, one active Step, confined dirty paths, a complete
+  hash-valid passed strict Step Review chain, verified reviewer isolation, and matching prior
+  hash-bound final acceptance.
+- `update historical-step-dependency-preflight/recover` handles installation itself when the exact
+  beta.12.9 dependency-only commit is the unregistered HEAD. It binds `HEAD^`, dependency `HEAD`, all
+  version surfaces, active Plan/Step, historical SHA, dirty paths/content hash, and the absence of
+  leases or pending operations.
+- The update transition records the dependency commit and retained historical commit in one Task
+  revision. Neither recovery rewrites Git, changes product bytes, adopts the old completed Step into
+  the current Plan, or weakens ordinary strict review.
+- Fresh `next` advertises these routes before ordinary dependency recovery and returns to the normal
+  credential/`task step-complete` flow after successful registration.
+- The public handshake exposes `historical-step-provenance-recovery-v1`.
+
+## Exact Signal diagnosis evidence
+
+At release-candidate validation time the Signal project
+`/Users/home-pc/htdocs/projects/signal_v4` was on exact beta.12.8 with Task
+`TASK-01M0WXJAD4GZGVNRJ284ND95C6` at revision 136 and status `in_progress`. Current Plan hash was
+`1ba67296f352cb67fa4d46c3ec9cd2ee2f50059903a5fffc7b0b2198f6dbae4e`; HEAD was
+`272d6258e4ce169aa9f5cf2b5a4de29970d82eb7`.
+
+The active Step `STEP-004-DIRECT-LOGIN-PRIVILEGE-DENIAL` had exactly five dirty files, all inside its
+`allowedWrites`. Historical commit `f7ba8533314ee27f176968a6314bf3df40285ef2` had a passed strict
+Step Review and prior final acceptance, but was absent from current Step evidence and retained
+history authority. No active/stale lease, pending/corrupt transaction, or Core operation remained.
+Milestone progress was `2/8` merged Tasks and T04 remained blocked by T03.
+
+The recurring Signal audit automation that had created an unrelated dirty journal was paused, and
+its latest journal was archived outside the checkout with matching SHA-256. The release process did
+not rewrite Signal history or mutate its five product files. Live package transport and recovery are
+separate post-publication actions and must follow the exact advertised beta.12.9 route.
 
 ## PDF release documentation evidence
 
-- Three tracked Russian PDFs were regenerated from current Markdown sources;
-  `npm run docs:pdf:check` reported an empty stale set.
-- All 28 pages were rendered and visually inspected: architecture is 8 pages, the delegated
-  chat-only guide is 9 pages, and the technical reference is 11 pages.
-- Titles, beta.12.7 version headers, Cyrillic glyphs, tables, code blocks, new recovery commands,
-  page edges, and footers show no visible clipping, overlap, or unreadable content.
+- All three tracked Russian PDFs were regenerated from the beta.12.9 Markdown sources.
+- Architecture is 8 pages, the delegated chat-only guide is 9 pages, and the technical reference is
+  12 pages. All pages were rendered to PNG contact sheets; changed recovery/update pages were also
+  inspected at full page resolution.
+- Titles, version headers, Cyrillic text, tables, command names, margins, page footers and section
+  transitions have no visible clipping, overlap, unreadable content, or orphaned tail page.
 
 ## Existing boundaries and non-claims
 
-- Structural replacement remains intentionally disabled. beta.12.7 does not implement P04-B,
-  topology rewiring, completed-Step adoption, or a wider delegation surface.
-- The new bridge is limited to the proven beta.12.6 invalidation-plus-accidental-rebind sequence.
-  It is not a general permission for dirty update, arbitrary Plan rollback, or manual state repair.
-- A negative Plan Risk Audit decision may truthfully return the same Task to planning, but no
-  automatic component decides product semantics or widens Task objective, requirements, acceptance,
-  or Milestone topology.
-- Git transport commits remain agent-executed operations on exact advertised boundaries. Runtime
-  does not create, amend, merge, reset, publish, tag, or push release history.
-- Validation performed no npm publication, Git commit, tag, remote push, Signal dependency update,
-  or local plugin reinstall. Those remain separate release/deployment actions.
-- Confidence is high for the implementation, package artifact, synthetic Workflow E2E, and real
-  PostgreSQL proof. Confidence in final live Signal continuation remains conditional on installing
-  the published exact package and observing the same project-local recovery sequence.
+- Recovery is intentionally unavailable for arbitrary or multiple commits, pending/failed review,
+  missing final acceptance, post-assessment drift, unrelated dirty paths, or active ownership.
+- Protocol version remains 2 and state schema remains 2; the optional audit fields are backward
+  compatible and no semantic migration is introduced.
+- Structural replacement remains disabled. beta.12.9 does not implement P04-B, topology rewiring,
+  completed-Step adoption, or a wider delegation surface.
+- No Git commit, tag, remote push, npm publication, Signal dependency transport, or Signal Task
+  completion is claimed by this pre-publication validation report.
+
+Confidence is high for the package implementation, prevention path, bounded legacy recovery,
+dependency-install compatibility, negative evidence gates, complete Step continuation, tarball,
+downstream installation, plugin and documentation. Live Signal confidence remains conditional on
+publishing beta.12.9, transporting only package/lock commits to its active base and Task branch, and
+following fresh project-local `status -> next` without manual history or state edits.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.12.7",
+  "version": "2.0.0-beta.12.9",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",

package/plugins/codex-workflow-gateway/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-gateway",
-  "version": "0.1.0+codex.20260829143747",
+  "version": "0.1.0+codex.20260830183000",
   "description": "Thin personal Codex gateway for exact project-local Codex Workflow V2 packages and codebase-memory-mcp.",
   "author": {
     "name": "Codex Workflow Maintainers"

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -33,6 +33,15 @@
   `retainedHistoricalCommits`.
   Task-local manifest/lock fields from recorded history may differ from the base, but the candidate
   commit must preserve them exactly while changing only the Workflow dependency entries.
+- `task historical-step-provenance-preflight --id <TASK-ID>` is read-only. The matching
+  `task historical-step-provenance-recover` is available only for one unexpected product commit
+  with an intact passed strict-review chain, matching prior final acceptance, no lease or pending
+  operation, and dirty files confined to the current active Step. It retains historical authority
+  without changing Git, worktree bytes, or the current Plan.
+- `update historical-step-dependency-preflight/recover` handles the same proof when the beta.12.9
+  dependency-only commit is the unregistered HEAD. It binds the exact dependency candidate and the
+  reviewed historical Step commit in one recovery record, preserves active product bytes, and then
+  requires fresh `status` and `next`.
 - `task stop-override-prepare` is a read-only Human gate for the exact beta.11 attempt-four stop
   shape. `task stop-override-apply` requires the same Task revision, Step, actor, reason, Plan, HEAD,
   evidence binding, and returned `SOO-*` code in a later user turn. It appends evidence without
@@ -300,6 +309,12 @@ working memory. In claimed C1 posture, fresh `next` exposes `writerTokenContract
 pass the receipt token through its declared `--writer-token` option on the first run call. The
 successful run returns the refreshed writer receipt for later lease-bound transitions.
 
+`task result-set` is also lease-bound. It requires the active `--writer-token` and the exact C1
+claimant in `--actor` when the Task is claimed. Success releases the lease before the Task enters
+`awaiting_final_acceptance`; the token is no longer valid. The Human gate must therefore remain
+lease-free for an arbitrary amount of time. After acceptance, obtain the new merge credential only
+through the `writerCredentialRecovery` action advertised by fresh `next`.
+
 ## Milestone assembly, autonomy, and human gate
 
 During initial planning, materialize every linked Task and then call `milestone plan-set` once

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -50,6 +50,31 @@ pending/corrupt transaction. After success run sequential `status` then `next` a
 returned lifecycle action; Knowledge reconciliation or atomic Task context refresh may legitimately
 be next because the dependency files changed.
 
+When beta.12.9 fresh `next` advertises `task historical-step-provenance-recover`, Core has found
+exactly one product commit that a corrective Plan omitted from current Step evidence even though the
+commit still has a complete hash-valid passed strict Step Review chain and a matching prior final
+acceptance. First run the advertised read-only `task historical-step-provenance-preflight --id
+<TASK-ID>` and require `eligible=true`, the exact Task revision/Plan/Brief/HEAD, the advertised
+commit SHA, no lease/transaction/Core operation, and dirty files confined to the one active Step's
+`allowedWrites`. Invoke recovery with that exact commit, actor, and a substantive reason. The
+transition records the commit as invalidated historical Step authority plus an audit record; it does
+not adopt the completed Step into the current Plan and does not create, remove, amend, reset, rebase,
+or merge Git commits. Reject multiple or arbitrary unexpected commits, pending/failed review,
+mismatched final acceptance, unrelated dirty files, or damaged sidecars. After success run
+sequential `status` then `next`; the active corrective Step should resume through its ordinary
+credential and `task step-complete` route.
+
+When beta.12.9 must itself be installed while this exact historical Step blocker is active, preserve
+the Task worktree and create only two dependency transport commits: one on the active Milestone base
+and one at Task-branch HEAD, each changing exactly `package.json` and `package-lock.json` to the exact
+beta.12.9 package. Do not switch the dirty Task checkout to update the base; use a separate temporary
+worktree. Install the repository-local target package, then require fresh `next` to advertise
+`update historical-step-dependency-recover`. Run the matching read-only preflight and require the
+exact dependency HEAD/parent, Task revision, active Step/Plan, retained historical SHA, dirty-file
+set and dirty-worktree hash, with no lease or pending operation. The matching recover registers both
+authorities without modifying product bytes or Git. After recovery run sequential `status` and
+`next`; do not substitute ordinary dependency recovery, manual state edits, rebase, reset, or amend.
+
 Beta.12.1 permits product-owned manifest/lock fields already present in the exact recorded Task
 history to differ from the Milestone base. Core compares candidate parent to candidate HEAD after
 removing only the Workflow dependency entries, so the dependency commit must preserve every such
@@ -226,6 +251,16 @@ the fresh `next.writerTokenContract` requires it. Successful `task run` returns
 `writerLeaseReceipt`; retain it only until Core releases that lease.
 Never search later payload fields for either credential and never copy credentials into evidence.
 
+When a passed final Task review routes to `task result-set`, pass the active writer credential and,
+for claimed C1 posture, the exact claimant as `--actor`. A successful `result-set` consumes that
+execution lease before entering `awaiting_final_acceptance`; never reuse the old token and never
+leave or manufacture a lease while waiting for the Human decision. After `task accept`, follow fresh
+`next`: local merge or external merge confirmation normally advertises
+`task writer-credential-replace`, which acquires a new bounded lease for the exact recovery actor.
+If a Task created under beta.12.7 or earlier is already at the Human gate with a stale lease, use
+only the exact `locks repair` route returned by repository-level `next`, verify that Task revision,
+review, Result/Evidence hashes, and HEAD did not change, and stop before acceptance.
+
 Command discovery with `codex-workflow <noun> [action] --help` is read-only. Use it only when the
 exact invocation syntax is not already available from `next` and this protocol. Consume declared
 `requiredOptions` and `optionalOptions`; when `exactOptionContractAvailable=false`, consult the

package/schemas/task.schema.json

@@ -60,6 +60,33 @@
       "uniqueItems": true,
       "items": { "type": "string", "pattern": "^[a-f0-9]{40}$" }
     },
+    "historicalStepProvenanceRecoveries": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "commitSha",
+          "actor",
+          "reason",
+          "recordedAt",
+          "sourceFinalAcceptanceRecordedAt",
+          "sourcePlanHash",
+          "sourceResultHash",
+          "sourceEvidenceHash"
+        ],
+        "properties": {
+          "commitSha": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+          "actor": { "type": "string", "minLength": 1 },
+          "reason": { "type": "string", "minLength": 1 },
+          "recordedAt": { "type": "string", "format": "date-time" },
+          "sourceFinalAcceptanceRecordedAt": { "type": "string", "format": "date-time" },
+          "sourcePlanHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "sourceResultHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "sourceEvidenceHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+        },
+        "additionalProperties": false
+      }
+    },
     "dependencyProvenanceRecoveries": {
       "type": "array",
       "items": {
@@ -134,6 +161,22 @@
               }
             },
             "additionalProperties": false
+          },
+          "historicalStepProvenance": {
+            "type": "object",
+            "required": ["activeStepId", "planHash", "dirtyFiles", "dirtyWorktreeHash", "retainedCommitSha"],
+            "properties": {
+              "activeStepId": { "type": "string", "pattern": "^STEP-[A-Z0-9][A-Z0-9-]{2,63}$" },
+              "planHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "dirtyFiles": {
+                "type": "array",
+                "uniqueItems": true,
+                "items": { "type": "string", "minLength": 1 }
+              },
+              "dirtyWorktreeHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "retainedCommitSha": { "type": "string", "pattern": "^[a-f0-9]{40}$" }
+            },
+            "additionalProperties": false
           }
         },
         "additionalProperties": false