codex-workflow-v2 2.0.0-beta.12.8 → 2.0.0-beta.13

package/dist/src/cli.js

@@ -4,106 +4,45 @@ import path from 'node:path';
 import process from 'node:process';
 import { defaultTaskWorkerActor } from './alpha6/handoff.js';
 import { assertCliSuccessCredentialSafety, projectCliErrorMessage, projectCliErrorValue, UnsafeCredentialOutputError, } from './credential-output.js';
+import { assertNoLegacyCredentialArguments, consumeCredentialReference, issueCredentialReference, resolveCredentialReference, } from './credential-transport.js';
 import { integrationDiagnostics } from './diagnostics.js';
 import { WorkflowError } from './errors.js';
 import { prepareGraphView } from './graph.js';
 import { migrateState } from './migration.js';
 import { changedFiles, currentBranch, isClean, resolveRepositoryIdentity } from './repository.js';
 import { launchStrictReviewer } from './reviewer.js';
-import { WorkflowService } from './workflow.js';
-import { PACKAGE_NAME, PACKAGE_VERSION } from './version.js';
-import { PROTOCOL_VERSION, STATE_SCHEMA_VERSION } from './contracts.js';
-const CLI_ACTIONS = {
-    gateway: ['handshake'],
-    update: [
-        'preflight',
-        'rescue-preflight',
-        'dependency-provenance-preflight',
-        'dependency-provenance-recover',
-        'downstream-proof-dependency-preflight',
-        'downstream-proof-dependency-recover',
-        'downstream-proof-replan-update-preflight',
-        'downstream-proof-replan-dependency-preflight',
-        'downstream-proof-replan-dependency-recover',
-    ],
-    delegation: ['prepare', 'grant', 'list', 'show', 'revoke'],
-    'project-memory': ['scan', 'show', 'status', 'approve', 'reconcile'],
-    state: ['migrate', 'adoption-prepare', 'adoption-apply'],
-    graph: ['prepare', 'status', 'refresh-request', 'bind', 'fallback'],
-    discovery: ['start', 'update', 'show', 'materialize'],
-    task: [
-        'show',
-        'replacement-materialize',
-        'plan-set',
-        'knowledge-rebind',
-        'context-refresh',
-        'authorize',
-        'plan-risk-audit',
-        'start',
-        'run',
-        'step-complete',
-        'submit',
-        'review-record',
-        'review-launch',
-        'review-packet',
-        'review-sealed-record',
-        'step-review',
-        'step-review-packet',
-        'step-review-record',
-        'corrective-decision-recover',
-        'remediation-mode-recover',
-        'plan-integrity-recover',
-        'downstream-proof-recover',
-        'downstream-proof-replan-recover',
-        'stop-override-prepare',
-        'stop-override-apply',
-        'corrective-decision',
-        'corrective-yield',
-        'corrective-yield-recover',
-        'corrective-replan-prepare',
-        'corrective-replan-confirm',
-        'corrective-replan-execute',
-        'corrective-replan-recover',
-        'handoff',
-        'handoff-prepare',
-        'handoff-replace',
-        'handoff-show',
-        'claim',
-        'writer-credential-replace',
-        'handback',
-        'handback-create',
-        'result-set',
-        'accept',
-        'sync-base',
-        'merge',
-        'merge-confirm',
-    ],
-    milestone: [
-        'recover',
-        'show',
-        'progress',
-        'plan-set',
-        'scope-change-prepare',
-        'scope-change-apply',
-        'autonomy-prepare',
-        'autonomy-grant',
-        'autonomy-evolve',
-        'authorize',
-        'validate',
-        'accept',
-        'cancel',
-    ],
-    locks: ['inspect', 'repair'],
-};
+import { WorkflowService, } from './workflow.js';
+import { gatewayHandshake } from './gateway-handshake.js';
+import { CLI_ACTIONS } from './cli-actions.js';
 const CLI_HELP_SPECS = {
+    'milestone remediation-materialize': {
+        requiredOptions: ['--id', '--expected-revision', '--task', '--expected-task-revision', '--file'],
+        optionalOptions: ['--repo', '--json'],
+    },
     'update dependency-provenance-preflight': {
         requiredOptions: ['--id'],
         optionalOptions: ['--repo', '--json'],
     },
+    'task historical-step-provenance-preflight': {
+        requiredOptions: ['--id'],
+        optionalOptions: ['--repo', '--json'],
+    },
+    'task historical-step-provenance-recover': {
+        requiredOptions: ['--id', '--expected-revision', '--commit', '--actor', '--reason'],
+        optionalOptions: ['--repo', '--json'],
+    },
     'update dependency-provenance-recover': {
         requiredOptions: ['--id', '--expected-revision', '--actor', '--reason'],
         optionalOptions: ['--repo', '--json'],
     },
+    'update historical-step-dependency-preflight': {
+        requiredOptions: ['--id'],
+        optionalOptions: ['--repo', '--json'],
+    },
+    'update historical-step-dependency-recover': {
+        requiredOptions: ['--id', '--expected-revision', '--actor', '--reason'],
+        optionalOptions: ['--repo', '--json'],
+    },
     'update downstream-proof-dependency-preflight': {
         requiredOptions: ['--id'],
         optionalOptions: ['--repo', '--json'],
@@ -124,6 +63,18 @@ const CLI_HELP_SPECS = {
         requiredOptions: ['--id', '--expected-revision', '--actor', '--reason'],
         optionalOptions: ['--repo', '--json'],
     },
+    'update plan-integrity-update-preflight': {
+        requiredOptions: ['--id'],
+        optionalOptions: ['--repo', '--json'],
+    },
+    'update plan-integrity-dependency-preflight': {
+        requiredOptions: ['--id'],
+        optionalOptions: ['--repo', '--json'],
+    },
+    'update plan-integrity-dependency-recover': {
+        requiredOptions: ['--id', '--expected-revision', '--actor', '--reason'],
+        optionalOptions: ['--repo', '--json'],
+    },
     'milestone progress': {
         requiredOptions: ['--id'],
         optionalOptions: ['--repo', '--json'],
@@ -146,22 +97,34 @@ const CLI_HELP_SPECS = {
     },
     'task handoff-replace': {
         requiredOptions: ['--id', '--expected-revision', '--actor', '--target-actor', '--reason'],
-        optionalOptions: ['--delegation-grant', '--expires-at', '--repo', '--json'],
+        optionalOptions: ['--writer-credential-ref', '--delegation-grant', '--expires-at', '--repo', '--json'],
+    },
+    'task handoff': {
+        requiredOptions: ['--id', '--expected-revision', '--actor', '--reason'],
+        optionalOptions: ['--target-actor', '--writer-credential-ref', '--delegation-grant', '--expires-at', '--repo', '--json'],
+    },
+    'task handoff-prepare': {
+        requiredOptions: ['--id', '--expected-revision', '--actor', '--reason'],
+        optionalOptions: ['--target-actor', '--writer-credential-ref', '--delegation-grant', '--expires-at', '--repo', '--json'],
+    },
+    'task claim': {
+        requiredOptions: ['--id', '--expected-revision', '--actor', '--claim-credential-ref'],
+        optionalOptions: ['--writer-credential-ref', '--repo', '--json'],
     },
     'task writer-credential-replace': {
         requiredOptions: ['--id', '--expected-revision', '--actor'],
         optionalOptions: ['--repo', '--json'],
     },
     'task corrective-yield': {
-        requiredOptions: ['--id', '--expected-revision', '--actor', '--writer-token', '--reason'],
+        requiredOptions: ['--id', '--expected-revision', '--actor', '--writer-credential-ref', '--reason'],
         optionalOptions: ['--repo', '--json'],
     },
     'task plan-integrity-recover': {
         requiredOptions: ['--id', '--step', '--expected-revision', '--actor'],
-        optionalOptions: ['--writer-token', '--repo', '--json'],
+        optionalOptions: ['--writer-credential-ref', '--repo', '--json'],
     },
     'task downstream-proof-recover': {
-        requiredOptions: ['--id', '--expected-revision', '--actor', '--writer-token', '--reason'],
+        requiredOptions: ['--id', '--expected-revision', '--actor', '--writer-credential-ref', '--reason'],
         optionalOptions: ['--repo', '--json'],
     },
     'task downstream-proof-replan-recover': {
@@ -206,38 +169,38 @@ const CLI_HELP_SPECS = {
     },
     'task run': {
         requiredOptions: ['--id', '--step', '--expected-revision'],
-        optionalOptions: ['--owner', '--writer-token', '--repo', '--json'],
+        optionalOptions: ['--owner', '--writer-credential-ref', '--repo', '--json'],
     },
     'task step-complete': {
-        requiredOptions: ['--id', '--step', '--expected-revision', '--writer-token'],
+        requiredOptions: ['--id', '--step', '--expected-revision', '--writer-credential-ref'],
         optionalOptions: ['--note', '--actor', '--repo', '--json'],
     },
     'task submit': {
-        requiredOptions: ['--id', '--expected-revision', '--writer-token'],
+        requiredOptions: ['--id', '--expected-revision', '--writer-credential-ref'],
         optionalOptions: ['--actor', '--repo', '--json'],
     },
     'task review-launch': {
         requiredOptions: ['--id', '--expected-revision'],
-        optionalOptions: ['--actor', '--writer-token', '--repo', '--json'],
+        optionalOptions: ['--actor', '--writer-credential-ref', '--repo', '--json'],
     },
     'task review-packet': {
-        requiredOptions: ['--id', '--expected-revision'],
+        requiredOptions: ['--id', '--expected-revision', '--review-mode'],
         optionalOptions: ['--repo', '--json'],
     },
     'task review-sealed-record': {
         requiredOptions: ['--id', '--expected-revision', '--actor', '--file'],
-        optionalOptions: ['--writer-token', '--repo', '--json'],
+        optionalOptions: ['--writer-credential-ref', '--repo', '--json'],
     },
     'task step-review-packet': {
-        requiredOptions: ['--id', '--step', '--expected-revision'],
+        requiredOptions: ['--id', '--step', '--expected-revision', '--review-mode'],
         optionalOptions: ['--repo', '--json'],
     },
     'task step-review-record': {
         requiredOptions: ['--id', '--step', '--expected-revision', '--actor', '--file'],
-        optionalOptions: ['--writer-token', '--repo', '--json'],
+        optionalOptions: ['--writer-credential-ref', '--repo', '--json'],
     },
     'task result-set': {
-        requiredOptions: ['--id', '--expected-revision', '--summary', '--writer-token'],
+        requiredOptions: ['--id', '--expected-revision', '--summary', '--writer-credential-ref'],
         optionalOptions: ['--actor', '--limitation', '--repo', '--json'],
     },
     'task accept': {
@@ -245,11 +208,11 @@ const CLI_HELP_SPECS = {
         optionalOptions: ['--actor', '--delegation-grant', '--repo', '--json'],
     },
     'task merge': {
-        requiredOptions: ['--id', '--expected-revision', '--writer-token'],
+        requiredOptions: ['--id', '--expected-revision', '--writer-credential-ref'],
         optionalOptions: ['--actor', '--repo', '--json'],
     },
     'task merge-confirm': {
-        requiredOptions: ['--id', '--expected-revision', '--writer-token'],
+        requiredOptions: ['--id', '--expected-revision', '--writer-credential-ref'],
         optionalOptions: ['--actor', '--repo', '--json'],
     },
 };
@@ -278,6 +241,13 @@ function parseArguments(argv) {
 function option(args, name) {
     return args.options.get(name)?.at(-1);
 }
+function reviewMode(args) {
+    const value = required(args, 'review-mode');
+    if (value !== 'ordinary' && value !== 'security') {
+        throw new WorkflowError('INVALID_ARGUMENT', '--review-mode must be ordinary or security.');
+    }
+    return value;
+}
 function cliHelp(args) {
     const [noun, action] = args.positionals;
     if (!noun) {
@@ -299,9 +269,11 @@ function cliHelp(args) {
                 command: noun,
                 usage: noun === 'next'
                     ? 'codex-workflow next [--task <task-id>] [--repo <path>] [--json]'
-                    : `codex-workflow ${noun} [--repo <path>] [--json]`,
+                    : noun === 'status'
+                        ? 'codex-workflow status [--full] [--repo <path>] [--json]'
+                        : `codex-workflow ${noun} [--repo <path>] [--json]`,
                 requiredOptions: [],
-                optionalOptions: [...taskSelector, '--repo', '--json'],
+                optionalOptions: [...taskSelector, ...(noun === 'status' ? ['--full'] : []), '--repo', '--json'],
                 exactOptionContractAvailable: true,
             };
         }
@@ -401,66 +373,70 @@ function stdinJson() {
 function repository(args) {
     return path.resolve(option(args, 'repo') ?? '.');
 }
-function workflowCapabilities() {
-    return [
-        'project-memory-v1',
-        'graph-binding-v1',
-        'local-state-v1',
-        'milestone-lifecycle-v1',
-        'milestone-human-final-gate-v1',
-        'delegated-approval-v1',
-        'task-knowledge-rebind-v1',
-        'task-context-refresh-v1',
-        'corrective-plan-audit-v1',
-        'safe-update-preflight-v1',
-        'bounded-dependency-provenance-recovery-v1',
-        'task-local-dependency-provenance-recovery-v1',
-        'legacy-stop-escalate-override-v1',
-        'stop-override-context-rebind-v1',
-        'stop-override-context-rebind-chain-v1',
-        'stop-override-post-audit-dependency-revision-v1',
-        'retained-reviewed-history-recovery-v1',
-        'milestone-progress-projection-v1',
-        'bounded-plan-integrity-recovery-v1',
-        'downstream-proof-predecessor-recovery-v1',
-        'downstream-proof-replan-recovery-v1',
-        'active-downstream-proof-dependency-recovery-v1',
-        'downstream-proof-replan-update-recovery-v1',
-        'task-mechanical-feasibility-v1',
-        'task-human-gate-lease-release-v1',
-        'strict-reviewer-v1',
-        'legacy-snapshot-v1',
-        'plan-risk-audit-sidecar-v1',
-        'step-strict-review-sidecar-v1',
-        'step-remediation-circuit-breaker-sidecar-v1',
-        'milestone-scope-change-sidecar-v1',
-        'milestone-membership-integrity-v1',
-        'milestone-task-dependency-dag-v1',
-        'milestone-initial-plan-transaction-v1',
-        'task-c1-handoff-sidecar-v1',
-        'semantic-plan-risk-audit-v2',
-        'guarded-remediation-continuation-v1',
-        'milestone-reverse-membership-integrity-v1',
-        'task-c1-handoff-bundle-v2',
-        'alpha6-adoption-posture-v1',
-        'alpha6-strict-review-rescue-v1',
-        'milestone-initial-assembly-v1',
-        'milestone-initial-assembly-navigation-v2',
-        'milestone-autonomy-contract-v1',
-        'milestone-autonomy-content-refresh-v1',
-        'milestone-autonomous-membership-evolution-v1',
-        'task-c1-derived-worker-actor-v1',
-        'guarded-corrective-auditor-routing-v1',
-        'corrective-decision-context-recovery-v1',
-        'remediation-mode-recovery-v1',
-        'plan-proof-obligations-v1',
-        'structural-task-replacement-disabled-v1',
-        'project-composite-transaction-journal-v1',
-        'corrective-yield-journal-v1',
-        'corrective-replan-journal-v1',
-        'corrective-replan-human-gate-v1',
-        'corrective-replan-protocol-v2',
-    ];
+const WRITER_CREDENTIAL_ACTIONS = [
+    'task run',
+    'task step-complete',
+    'task submit',
+    'task review-record',
+    'task review-launch',
+    'task review-sealed-record',
+    'task step-review',
+    'task step-review-record',
+    'task corrective-decision-recover',
+    'task remediation-mode-recover',
+    'task plan-integrity-recover',
+    'task downstream-proof-recover',
+    'task corrective-decision',
+    'task corrective-yield',
+    'task handoff',
+    'task handoff-prepare',
+    'task handoff-replace',
+    'task claim',
+    'task handback',
+    'task handback-create',
+    'task result-set',
+    'task merge',
+    'task merge-confirm',
+];
+function credentialToken(workflow, repo, args, kind, action, entityId, actor, requiredReference) {
+    const optionName = kind === 'writer-lease' ? 'writer-credential-ref' : 'claim-credential-ref';
+    const reference = option(args, optionName);
+    if (!reference) {
+        if (requiredReference) {
+            throw new WorkflowError('INVALID_ARGUMENT', `Missing required option --${optionName}.`);
+        }
+        return null;
+    }
+    const identity = resolveRepositoryIdentity(repo);
+    return resolveCredentialReference({
+        stateRoot: workflow.store.root,
+        projectId: identity.projectId,
+        reference,
+        kind,
+        entityId,
+        actor,
+        action,
+    }).token;
+}
+function writerCredentialReceipt(workflow, repo, taskId, actor, token, expiresAt) {
+    const identity = resolveRepositoryIdentity(repo);
+    return issueCredentialReference({
+        stateRoot: workflow.store.root,
+        projectId: identity.projectId,
+        entityId: taskId,
+        actor,
+        kind: 'writer-lease',
+        token,
+        allowedActions: WRITER_CREDENTIAL_ACTIONS,
+        expiresAt,
+        oneTime: false,
+    });
+}
+function consumeCredentialOption(workflow, repo, args, optionName) {
+    const reference = option(args, optionName);
+    if (!reference)
+        return;
+    consumeCredentialReference(workflow.store.root, resolveRepositoryIdentity(repo).projectId, reference);
 }
 async function dispatch(args) {
     const [noun, action] = args.positionals;
@@ -468,13 +444,7 @@ async function dispatch(args) {
         return cliHelp(args);
     const repo = repository(args);
     if (noun === 'gateway' && action === 'handshake') {
-        return {
-            packageName: PACKAGE_NAME,
-            packageVersion: PACKAGE_VERSION,
-            protocolVersion: PROTOCOL_VERSION,
-            stateSchemaVersion: STATE_SCHEMA_VERSION,
-            capabilities: workflowCapabilities(),
-        };
+        return gatewayHandshake();
     }
     const workflow = new WorkflowService();
     if (noun === 'doctor') {
@@ -499,7 +469,7 @@ async function dispatch(args) {
         };
     }
     if (noun === 'status')
-        return workflow.status(repo);
+        return args.options.has('full') ? workflow.status(repo) : workflow.compactStatus(repo);
     if (noun === 'next')
         return workflow.next(repo, option(args, 'task') ?? null);
     if (noun === 'update' && action === 'preflight')
@@ -510,9 +480,21 @@ async function dispatch(args) {
     if (noun === 'update' && action === 'dependency-provenance-preflight') {
         return workflow.dependencyProvenanceRecoveryPreflight(repo, required(args, 'id'));
     }
+    if (noun === 'task' && action === 'historical-step-provenance-preflight') {
+        return workflow.historicalStepProvenanceRecoveryPreflight(repo, required(args, 'id'));
+    }
+    if (noun === 'task' && action === 'historical-step-provenance-recover') {
+        return workflow.recoverHistoricalStepProvenance(repo, required(args, 'id'), revision(args), required(args, 'commit'), required(args, 'actor'), required(args, 'reason'));
+    }
     if (noun === 'update' && action === 'dependency-provenance-recover') {
         return workflow.recoverDependencyProvenance(repo, required(args, 'id'), revision(args), required(args, 'actor'), required(args, 'reason'));
     }
+    if (noun === 'update' && action === 'historical-step-dependency-preflight') {
+        return workflow.historicalStepDependencyRecoveryPreflight(repo, required(args, 'id'));
+    }
+    if (noun === 'update' && action === 'historical-step-dependency-recover') {
+        return workflow.recoverHistoricalStepDependencyProvenance(repo, required(args, 'id'), revision(args), required(args, 'actor'), required(args, 'reason'));
+    }
     if (noun === 'update' && action === 'downstream-proof-dependency-preflight') {
         return workflow.activeDownstreamProofDependencyRecoveryPreflight(repo, required(args, 'id'));
     }
@@ -528,6 +510,15 @@ async function dispatch(args) {
     if (noun === 'update' && action === 'downstream-proof-replan-dependency-recover') {
         return workflow.recoverDownstreamProofReplanDependencyProvenance(repo, required(args, 'id'), revision(args), required(args, 'actor'), required(args, 'reason'));
     }
+    if (noun === 'update' && action === 'plan-integrity-update-preflight') {
+        return workflow.planIntegrityUpdatePreflight(repo, required(args, 'id'));
+    }
+    if (noun === 'update' && action === 'plan-integrity-dependency-preflight') {
+        return workflow.planIntegrityDependencyRecoveryPreflight(repo, required(args, 'id'));
+    }
+    if (noun === 'update' && action === 'plan-integrity-dependency-recover') {
+        return workflow.recoverPlanIntegrityDependencyProvenance(repo, required(args, 'id'), revision(args), required(args, 'actor'), required(args, 'reason'));
+    }
     if (noun === 'delegation' && action === 'prepare') {
         return workflow.prepareDelegation(repo, jsonFile(args));
     }
@@ -688,7 +679,9 @@ async function dispatch(args) {
         return workflow.startTask(repo, required(args, 'id'), revision(args), owner);
     }
     if (noun === 'task' && action === 'run') {
-        const outcome = workflow.runStep(repo, required(args, 'id'), required(args, 'step'), revision(args), option(args, 'owner') ?? 'worker', option(args, 'writer-token') ?? null);
+        const taskId = required(args, 'id');
+        const owner = option(args, 'owner') ?? 'worker';
+        const outcome = workflow.runStep(repo, taskId, required(args, 'step'), revision(args), owner, credentialToken(workflow, repo, args, 'writer-lease', 'task run', taskId, owner, false));
         const { writerToken, ...envelope } = outcome.envelope;
         if (outcome.writerCredential.disposition === 'issued' && !writerToken) {
             throw new WorkflowError('STATE_CORRUPT', 'Fresh task run credential issuance did not return its protocol-v1 writer token.');
@@ -699,16 +692,7 @@ async function dispatch(args) {
         return {
             writerCredential: { disposition: outcome.writerCredential.disposition },
             ...(writerToken ? {
-                writerLeaseReceipt: {
-                    token: writerToken,
-                    kind: 'writer-lease',
-                    owner: outcome.lease.owner,
-                    action: 'task step-complete',
-                    option: '--writer-token',
-                    source: 'task run',
-                    sensitive: true,
-                    oneTime: false,
-                },
+                writerCredentialReference: writerCredentialReceipt(workflow, repo, taskId, outcome.lease.owner, writerToken, outcome.lease.expiresAt),
             } : {}),
             task: outcome.task,
             lease: outcome.lease,
@@ -716,14 +700,16 @@ async function dispatch(args) {
         };
     }
     if (noun === 'task' && action === 'step-complete') {
-        return workflow.completeStep(repo, required(args, 'id'), required(args, 'step'), revision(args), required(args, 'writer-token'), repeated(args, 'note'), option(args, 'actor'));
+        const taskId = required(args, 'id');
+        return workflow.completeStep(repo, taskId, required(args, 'step'), revision(args), credentialToken(workflow, repo, args, 'writer-lease', 'task step-complete', taskId, option(args, 'actor') ?? null, true), repeated(args, 'note'), option(args, 'actor'));
     }
     if (noun === 'task' && action === 'submit') {
-        return workflow.submitTask(repo, required(args, 'id'), revision(args), required(args, 'writer-token'), option(args, 'actor'));
+        const taskId = required(args, 'id');
+        return workflow.submitTask(repo, taskId, revision(args), credentialToken(workflow, repo, args, 'writer-lease', 'task submit', taskId, option(args, 'actor') ?? null, true), option(args, 'actor'));
     }
     if (noun === 'task' && action === 'review-record') {
         const review = jsonFile(args);
-        return workflow.recordReview(repo, required(args, 'id'), revision(args), review, option(args, 'actor'), option(args, 'writer-token') ?? null);
+        return workflow.recordReview(repo, required(args, 'id'), revision(args), review, option(args, 'actor'), credentialToken(workflow, repo, args, 'writer-lease', 'task review-record', required(args, 'id'), option(args, 'actor') ?? null, false));
     }
     if (noun === 'task' && action === 'review-launch') {
         const identity = resolveRepositoryIdentity(repo);
@@ -740,37 +726,45 @@ async function dispatch(args) {
         const launch = launchStrictReviewer(identity.repositoryRoot, task, workflow.store.taskRoot(task.projectId, task.id), envelope);
         // The independent reviewer identity belongs to the strict reviewer payload. CLI --actor
         // remains the lifecycle mutation actor, such as the current C1 claimant.
-        const saved = workflow.recordReview(repo, id, expectedRevision, launch.review, option(args, 'actor'), option(args, 'writer-token') ?? null);
+        const saved = workflow.recordReview(repo, id, expectedRevision, launch.review, option(args, 'actor'), credentialToken(workflow, repo, args, 'writer-lease', 'task review-launch', id, option(args, 'actor') ?? null, false));
         return { launch, task: saved };
     }
     if (noun === 'task' && action === 'review-packet') {
-        return workflow.prepareExternalTaskReview(repo, required(args, 'id'), revision(args));
+        return workflow.prepareExternalTaskReview(repo, required(args, 'id'), revision(args), reviewMode(args));
     }
     if (noun === 'task' && action === 'review-sealed-record') {
-        return workflow.recordExternalTaskReview(repo, required(args, 'id'), revision(args), jsonFile(args), required(args, 'actor'), option(args, 'writer-token') ?? null);
+        return workflow.recordExternalTaskReview(repo, required(args, 'id'), revision(args), jsonFile(args), required(args, 'actor'), credentialToken(workflow, repo, args, 'writer-lease', 'task review-sealed-record', required(args, 'id'), required(args, 'actor'), false));
     }
     if (noun === 'task' && action === 'step-review') {
         // Strict Step Review launches and records the isolated reviewer inside Core. CLI --actor
         // remains the lifecycle actor from next, typically the active C1 claimant.
-        return workflow.reviewStep(repo, required(args, 'id'), required(args, 'step'), revision(args), undefined, option(args, 'actor'), option(args, 'writer-token') ?? null);
+        return workflow.reviewStep(repo, required(args, 'id'), required(args, 'step'), revision(args), undefined, option(args, 'actor'), credentialToken(workflow, repo, args, 'writer-lease', 'task step-review', required(args, 'id'), option(args, 'actor') ?? null, false));
     }
     if (noun === 'task' && action === 'step-review-packet') {
-        return workflow.prepareExternalStepReview(repo, required(args, 'id'), required(args, 'step'), revision(args));
+        return workflow.prepareExternalStepReview(repo, required(args, 'id'), required(args, 'step'), revision(args), reviewMode(args));
     }
     if (noun === 'task' && action === 'step-review-record') {
-        return workflow.recordExternalStepReview(repo, required(args, 'id'), required(args, 'step'), revision(args), jsonFile(args), required(args, 'actor'), option(args, 'writer-token') ?? null);
+        return workflow.recordExternalStepReview(repo, required(args, 'id'), required(args, 'step'), revision(args), jsonFile(args), required(args, 'actor'), credentialToken(workflow, repo, args, 'writer-lease', 'task step-review-record', required(args, 'id'), required(args, 'actor'), false));
     }
     if (noun === 'task' && action === 'corrective-decision-recover') {
-        return workflow.recoverStepCorrectiveDecision(repo, required(args, 'id'), required(args, 'step'), revision(args), required(args, 'actor'), option(args, 'writer-token') ?? null);
+        const taskId = required(args, 'id');
+        const actor = required(args, 'actor');
+        return workflow.recoverStepCorrectiveDecision(repo, taskId, required(args, 'step'), revision(args), actor, credentialToken(workflow, repo, args, 'writer-lease', 'task corrective-decision-recover', taskId, actor, false));
     }
     if (noun === 'task' && action === 'remediation-mode-recover') {
-        return workflow.recoverRemediationMode(repo, required(args, 'id'), required(args, 'step'), revision(args), required(args, 'actor'), option(args, 'writer-token') ?? null);
+        const taskId = required(args, 'id');
+        const actor = required(args, 'actor');
+        return workflow.recoverRemediationMode(repo, taskId, required(args, 'step'), revision(args), actor, credentialToken(workflow, repo, args, 'writer-lease', 'task remediation-mode-recover', taskId, actor, false));
     }
     if (noun === 'task' && action === 'plan-integrity-recover') {
-        return workflow.recoverPlanIntegrity(repo, required(args, 'id'), required(args, 'step'), revision(args), required(args, 'actor'), option(args, 'writer-token') ?? null);
+        const taskId = required(args, 'id');
+        const actor = required(args, 'actor');
+        return workflow.recoverPlanIntegrity(repo, taskId, required(args, 'step'), revision(args), actor, credentialToken(workflow, repo, args, 'writer-lease', 'task plan-integrity-recover', taskId, actor, false));
     }
     if (noun === 'task' && action === 'downstream-proof-recover') {
-        return workflow.recoverDownstreamProof(repo, required(args, 'id'), revision(args), required(args, 'actor'), required(args, 'writer-token'), required(args, 'reason'));
+        const taskId = required(args, 'id');
+        const actor = required(args, 'actor');
+        return workflow.recoverDownstreamProof(repo, taskId, revision(args), actor, credentialToken(workflow, repo, args, 'writer-lease', 'task downstream-proof-recover', taskId, actor, true), required(args, 'reason'));
     }
     if (noun === 'task' && action === 'downstream-proof-replan-recover') {
         return workflow.recoverDownstreamProofReplan(repo, required(args, 'id'), revision(args), required(args, 'actor'), required(args, 'reason'));
@@ -782,10 +776,15 @@ async function dispatch(args) {
         return workflow.applyTaskStopOverride(repo, required(args, 'id'), required(args, 'step'), revision(args), required(args, 'actor'), required(args, 'reason'), required(args, 'confirmation-code'));
     }
     if (noun === 'task' && action === 'corrective-decision') {
-        return workflow.recordStepCorrectiveDecision(repo, required(args, 'id'), required(args, 'step'), revision(args), jsonFile(args), option(args, 'actor'), option(args, 'writer-token') ?? null);
+        const taskId = required(args, 'id');
+        return workflow.recordStepCorrectiveDecision(repo, taskId, required(args, 'step'), revision(args), jsonFile(args), option(args, 'actor'), credentialToken(workflow, repo, args, 'writer-lease', 'task corrective-decision', taskId, option(args, 'actor') ?? null, false));
     }
     if (noun === 'task' && action === 'corrective-yield') {
-        return workflow.executeCorrectiveYield(repo, required(args, 'id'), revision(args), required(args, 'actor'), required(args, 'writer-token'), required(args, 'reason'));
+        const taskId = required(args, 'id');
+        const actor = required(args, 'actor');
+        const outcome = workflow.executeCorrectiveYield(repo, taskId, revision(args), actor, credentialToken(workflow, repo, args, 'writer-lease', 'task corrective-yield', taskId, actor, true), required(args, 'reason'));
+        consumeCredentialOption(workflow, repo, args, 'writer-credential-ref');
+        return outcome;
     }
     if (noun === 'task' && action === 'corrective-yield-recover') {
         return workflow.recoverCorrectiveYield(repo, required(args, 'id'), required(args, 'transaction-id'));
@@ -804,21 +803,27 @@ async function dispatch(args) {
     }
     if (noun === 'task' && (action === 'handoff' || action === 'handoff-prepare' || action === 'handoff-replace')) {
         const replacePending = action === 'handoff-replace';
-        const outcome = workflow.handoffTask(repo, required(args, 'id'), revision(args), required(args, 'actor'), replacePending
+        const taskId = required(args, 'id');
+        const actor = required(args, 'actor');
+        const targetActor = replacePending
             ? required(args, 'target-actor')
-            : option(args, 'target-actor') ?? defaultTaskWorkerActor(required(args, 'id')), required(args, 'reason'), option(args, 'writer-token') ?? null, option(args, 'delegation-grant') ?? null, option(args, 'expires-at') ?? null, replacePending);
+            : option(args, 'target-actor') ?? defaultTaskWorkerActor(taskId);
+        const outcome = workflow.handoffTask(repo, taskId, revision(args), actor, targetActor, required(args, 'reason'), credentialToken(workflow, repo, args, 'writer-lease', `task ${action}`, taskId, actor, false), option(args, 'delegation-grant') ?? null, option(args, 'expires-at') ?? null, replacePending);
+        consumeCredentialOption(workflow, repo, args, 'writer-credential-ref');
         const { claimToken, ...bundle } = outcome.bundle;
+        const identity = resolveRepositoryIdentity(repo);
         return {
-            credentialHandoff: {
-                token: claimToken,
+            claimCredentialReference: issueCredentialReference({
+                stateRoot: workflow.store.root,
+                projectId: identity.projectId,
+                entityId: taskId,
+                actor: outcome.bundle.delegate,
                 kind: 'claim-token',
-                targetActor: outcome.bundle.delegate,
-                action: 'task claim',
-                option: '--claim-token',
-                source: replacePending ? 'task handoff-replace' : 'task handoff-prepare',
-                sensitive: true,
+                token: claimToken,
+                allowedActions: ['task claim'],
+                expiresAt: outcome.bundle.expiresAt,
                 oneTime: true,
-            },
+            }),
             task: outcome.task,
             event: outcome.event,
             bundle,
@@ -828,20 +833,15 @@ async function dispatch(args) {
         return workflow.showTaskHandoff(repo, required(args, 'id'));
     }
     if (noun === 'task' && action === 'claim') {
-        const outcome = workflow.claimTask(repo, required(args, 'id'), revision(args), required(args, 'actor'), required(args, 'claim-token'), option(args, 'writer-token') ?? null);
+        const taskId = required(args, 'id');
+        const actor = required(args, 'actor');
+        const claimToken = credentialToken(workflow, repo, args, 'claim-token', 'task claim', taskId, actor, true);
+        const outcome = workflow.claimTask(repo, taskId, revision(args), actor, claimToken, credentialToken(workflow, repo, args, 'writer-lease', 'task claim', taskId, actor, false));
+        consumeCredentialOption(workflow, repo, args, 'claim-credential-ref');
         return {
             writerCredential: { disposition: outcome.writerCredential.disposition },
             ...(outcome.writerCredential.disposition === 'issued' ? {
-                writerLeaseReceipt: {
-                    token: outcome.writerCredential.token,
-                    kind: 'writer-lease',
-                    owner: outcome.lease.owner,
-                    action: 'task run',
-                    option: '--writer-token',
-                    source: 'task claim',
-                    sensitive: true,
-                    oneTime: false,
-                },
+                writerCredentialReference: writerCredentialReceipt(workflow, repo, taskId, outcome.lease.owner, outcome.writerCredential.token, outcome.lease.expiresAt),
             } : {}),
             task: outcome.task,
             event: outcome.event,
@@ -849,27 +849,30 @@ async function dispatch(args) {
         };
     }
     if (noun === 'task' && action === 'writer-credential-replace') {
-        const outcome = workflow.replaceClaimedWriterCredential(repo, required(args, 'id'), revision(args), required(args, 'actor'));
+        const taskId = required(args, 'id');
+        const actor = required(args, 'actor');
+        const outcome = workflow.replaceClaimedWriterCredential(repo, taskId, revision(args), actor);
         return {
             writerCredential: { disposition: outcome.writerCredential.disposition },
-            writerLeaseReceipt: {
-                token: outcome.writerCredential.token,
-                kind: 'writer-lease',
-                source: 'task writer-credential-replace',
-                sensitive: true,
-                oneTime: false,
-            },
+            writerCredentialReference: writerCredentialReceipt(workflow, repo, taskId, outcome.lease.owner, outcome.writerCredential.token, outcome.lease.expiresAt),
             task: outcome.task,
             lease: outcome.lease,
         };
     }
     if (noun === 'task' && (action === 'handback' || action === 'handback-create')) {
-        return workflow.handbackTask(repo, required(args, 'id'), revision(args), required(args, 'actor'), required(args, 'reason'), option(args, 'writer-token') ?? null, repeated(args, 'limitation'), action === 'handback-create'
+        const taskId = required(args, 'id');
+        const actor = required(args, 'actor');
+        const outcome = workflow.handbackTask(repo, taskId, revision(args), actor, required(args, 'reason'), credentialToken(workflow, repo, args, 'writer-lease', `task ${action}`, taskId, actor, false), repeated(args, 'limitation'), action === 'handback-create'
             ? required(args, 'recommended-next')
             : option(args, 'recommended-next') ?? 'Coordinator reviews the terminal Task result and recorded evidence.');
+        consumeCredentialOption(workflow, repo, args, 'writer-credential-ref');
+        return outcome;
     }
     if (noun === 'task' && action === 'result-set') {
-        return workflow.setTaskResult(repo, required(args, 'id'), revision(args), required(args, 'summary'), repeated(args, 'limitation'), required(args, 'writer-token'), option(args, 'actor'));
+        const taskId = required(args, 'id');
+        const outcome = workflow.setTaskResult(repo, taskId, revision(args), required(args, 'summary'), repeated(args, 'limitation'), credentialToken(workflow, repo, args, 'writer-lease', 'task result-set', taskId, option(args, 'actor') ?? null, true), option(args, 'actor'));
+        consumeCredentialOption(workflow, repo, args, 'writer-credential-ref');
+        return outcome;
     }
     if (noun === 'task' && action === 'accept') {
         return workflow.acceptTask(repo, required(args, 'id'), revision(args), option(args, 'actor') ?? 'user', option(args, 'delegation-grant') ?? null);
@@ -878,10 +881,16 @@ async function dispatch(args) {
         return workflow.syncTaskBase(repo, required(args, 'id'), revision(args));
     }
     if (noun === 'task' && action === 'merge') {
-        return workflow.mergeTask(repo, required(args, 'id'), revision(args), required(args, 'writer-token'), option(args, 'actor'));
+        const taskId = required(args, 'id');
+        const outcome = workflow.mergeTask(repo, taskId, revision(args), credentialToken(workflow, repo, args, 'writer-lease', 'task merge', taskId, option(args, 'actor') ?? null, true), option(args, 'actor'));
+        consumeCredentialOption(workflow, repo, args, 'writer-credential-ref');
+        return outcome;
     }
     if (noun === 'task' && action === 'merge-confirm') {
-        return workflow.confirmExternalMerge(repo, required(args, 'id'), revision(args), required(args, 'writer-token'), option(args, 'actor'));
+        const taskId = required(args, 'id');
+        const outcome = workflow.confirmExternalMerge(repo, taskId, revision(args), credentialToken(workflow, repo, args, 'writer-lease', 'task merge-confirm', taskId, option(args, 'actor') ?? null, true), option(args, 'actor'));
+        consumeCredentialOption(workflow, repo, args, 'writer-credential-ref');
+        return outcome;
     }
     if (noun === 'milestone' && action === 'show') {
         const identity = resolveRepositoryIdentity(repo);
@@ -893,6 +902,9 @@ async function dispatch(args) {
     if (noun === 'milestone' && action === 'plan-set') {
         return workflow.setMilestonePlan(repo, required(args, 'id'), revision(args), jsonFile(args));
     }
+    if (noun === 'milestone' && action === 'remediation-materialize') {
+        return workflow.materializeAuditedRemediationTask(repo, required(args, 'id'), revision(args), required(args, 'task'), positiveIntegerOption(args, 'expected-task-revision'), jsonFile(args));
+    }
     if (noun === 'milestone' && action === 'scope-change-prepare') {
         return workflow.prepareMilestoneScopeChange(repo, required(args, 'id'), revision(args), jsonFile(args), required(args, 'actor'));
     }
@@ -932,30 +944,8 @@ async function dispatch(args) {
         hint: 'Use doctor, status, next, update preflight, state <action>, delegation <action>, project-memory <action>, discovery <action>, task <action>, milestone <action>, or locks <action>.',
     });
 }
-function credentialAllowancesForResult(args, value) {
-    const [noun, action] = args.positionals;
-    if (!isRecord(value))
-        return [];
-    if (noun === 'task' && (action === 'run' || action === 'claim' || action === 'writer-credential-replace')) {
-        const disposition = isRecord(value.writerCredential) ? value.writerCredential.disposition : null;
-        const receipt = isRecord(value.writerLeaseReceipt) ? value.writerLeaseReceipt : null;
-        if (disposition === 'issued'
-            && receipt?.kind === 'writer-lease'
-            && receipt.source === `task ${action}`
-            && receipt.sensitive === true) {
-            return [{ path: '$.writerLeaseReceipt.token' }];
-        }
-        return [];
-    }
-    if (noun === 'task' && (action === 'handoff' || action === 'handoff-prepare' || action === 'handoff-replace')) {
-        const receipt = isRecord(value.credentialHandoff) ? value.credentialHandoff : null;
-        if (receipt?.kind === 'claim-token'
-            && receipt.source === (action === 'handoff-replace' ? 'task handoff-replace' : 'task handoff-prepare')
-            && receipt.sensitive === true
-            && receipt.oneTime === true) {
-            return [{ path: '$.credentialHandoff.token' }];
-        }
-    }
+function credentialAllowancesForResult(_args, _value) {
+    // Beta 13 has no CLI issuance allowance: the host receives reference metadata only.
     return [];
 }
 function rawCredentialInputs(argv) {
@@ -979,6 +969,7 @@ async function main() {
     const sensitiveInputs = rawCredentialInputs(argv);
     try {
         const args = parseArguments(argv);
+        assertNoLegacyCredentialArguments(new Set(args.options.keys()));
         const value = await dispatch(args);
         assertCliSuccessCredentialSafety(value, credentialAllowancesForResult(args, value), sensitiveInputs);
         process.stdout.write(`${JSON.stringify({ ok: true, value }, null, 2)}\n`);