codex-workflow-v2 2.0.0-beta.12.8 → 2.0.0-beta.13

package/docs/validation-report.md

@@ -1,103 +1,161 @@
-# V2 beta.12.8 Validation Report
+# V2 beta.13 Validation Report
 
-Release candidate `2.0.0-beta.12.8` was validated on 2026-08-29 (Europe/Moscow) with
+Release candidate `2.0.0-beta.13` was validated during 2026-09-02--03 (Europe/Moscow) with
 Node.js 24.17.0.
 
 ## Automated release evidence
 
-- `npm ci` completed from the exact lockfile with 0 reported vulnerabilities.
-- `npm run validate` passed typecheck and `339/339` sequential tests with no failures, skips,
-  cancellations, or todos in 1,700,172.265375 ms.
-- The focused claimed-Task E2E passed independently. It covers sealed passed final review,
-  machine-readable `task result-set` writer-token navigation, rejection of a forged token without
-  Task/lease mutation, successful Result publication, lease-free `awaiting_final_acceptance`, Human
-  acceptance, fresh credential replacement, merge, and terminal lease release.
-- CLI help regression proves that `task result-set` requires `--writer-token` and exposes optional
-  `--actor` for the exact C1 claimant.
-- The full suite retained the Signal-shaped downstream replan E2E, Signal T04 retained-review
-  recovery, dependency provenance, Plan-integrity recovery, corrective replan, lock hostility,
-  transaction crash/recovery, Milestone dependency, strict-review, and credential-confinement gates.
-- `npm run pack:check` built the exact beta.12.8 package with 275 files, 1.0 MB packed and 4.1 MB
-  unpacked. The initial sandboxed invocation could not write the user npm cache (`EPERM`); the exact
-  authorized retry passed.
-- `npm run smoke:downstream` packed and installed the tarball in a disposable consumer project and
-  returned `ok=true`. The sandboxed attempt could not resolve the npm registry (`ENOTFOUND`); the
-  exact network-authorized retry passed.
-- `npm run plugin:check` passed for bundled gateway
-  `0.1.0+codex.20260829181421`. The plugin-creator manifest validator and skill quick validator also
-  passed using the system Python runtime that provides PyYAML.
-- `npm run docs:pdf:check` reported an empty stale set and exact beta.12.8 package binding.
-- `RELEASE_TAG=v2.0.0-beta.12.8 npm run release:check` and `git diff --check` passed.
-
-## Root cause corrected by beta.12.8
-
-`WorkflowService.setTaskResult` previously moved a reviewed Task from `validating` to
-`awaiting_final_acceptance` without accepting the active writer credential and without releasing
-the Task writer lease. Human final acceptance is intentionally unbounded, so an otherwise successful
-Task could wait until the lease expired. Repository-level `next` then truthfully returned
-`repair-required / STALE_WRITER_LEASE` instead of `task accept`.
-
-Increasing review or implementation attempts cannot correct this condition. The implementation and
-review had already passed; the defect was ownership lifetime crossing a Human pause.
-
-## Implemented lifecycle contract
-
-- `task result-set` now requires the active `--writer-token`; claimed C1 Tasks also pass the exact
-  claimant through `--actor`.
-- Core verifies the current revision, passed/fresh review, live writer credential, and C1 mutation
-  authority before staging Result.
-- Core releases the exact presented lease before committing the transition to
-  `awaiting_final_acceptance`. Human wait time therefore cannot create a new stale lease.
-- Fresh `next` advertises the writer-token contract and bounded credential recovery for
-  `task result-set` when needed.
-- `task accept` remains a credential-free Human/delegated approval transition. After acceptance,
-  fresh `next` advertises `task writer-credential-replace`; this acquires a new lease for local merge
-  or external merge confirmation. The pre-gate token is not reusable.
-- The public handshake exposes `task-human-gate-lease-release-v1`.
-
-## Exact Signal diagnosis evidence
-
-At diagnosis time the Signal project `/Users/home-pc/htdocs/projects/signal_v4` was on exact
-beta.12.7 with Task `TASK-01M0WXJAD4GZGVNRJ284ND95C6` at revision 126 and
-`awaiting_final_acceptance`. The Task checkout was clean at
-`f7ba8533314ee27f176968a6314bf3df40285ef2`; Final Task Review was `passed` with no findings.
-The Result hash was `89bbbaaef5d2b454ed7ed0e3d9f57484d36c9d86d596e009a32613701003496e`
-and Evidence hash was `85f3cb5c16e039ebf40971f88a4388fe1812ef37be8d6b195451aa6a73640c54`.
-Repository-level `next` returned only `locks repair` for the expired lease owned by the Task worker.
-
-The release process did not mutate Signal state or product files. The legacy lease must first be
-removed through that exact advertised repair route with revision, HEAD, review, Result, and Evidence
-readback. The agent must stop before `task accept`. Only after the repository is lease-free and
-`update preflight` is safe should Signal install beta.12.8 and continue through fresh navigation.
-
-## PDF release documentation evidence
-
-- All three tracked Russian PDFs were regenerated from the beta.12.8 Markdown sources.
-- Architecture is 8 pages, the delegated chat-only guide is 9 pages, and the technical reference is
-  11 pages. Every page was rendered to PNG and visually inspected.
-- Titles, version headers, Cyrillic text, tables, code blocks, Human-gate credential sequence,
-  release checklist, margins, and page footers have no visible clipping, overlap, orphaned tail page,
-  or unreadable content.
-
-## Existing boundaries and non-claims
-
-- beta.12.8 prevents new `result-set` transitions from retaining a lease. It does not silently delete
-  a stale lease created by beta.12.7 or earlier; legacy state uses explicit `locks repair`.
-- The patch does not auto-accept a Task, bypass final review, widen delegated approval, or turn an
-  expired bearer into authority.
-- Protocol version remains 2 and state schema remains 2; no semantic state migration is introduced.
-- Structural replacement remains intentionally disabled. beta.12.8 does not implement P04-B,
-  topology rewiring, completed-Step adoption, or a wider delegation surface.
-- No append-only real-agent lifecycle log was generated for this maintainer release turn because
-  the package Workflow did not orchestrate its own repository mutation. Transcript validator
-  semantics remain covered by the complete valid/invalid fixture suite; no synthetic log is
-  presented as real evidence.
-- Validation performed no npm publication, Git commit, tag, remote push, Signal dependency update,
-  Signal Task acceptance, or local personal-plugin reinstall. Those are separate release/deployment
-  actions.
-
-Confidence is high for the package implementation, negative credential behavior, complete claimed
-Task continuation, tarball, downstream installation, plugin, and documentation. Confidence that the
-live Signal Milestone will continue is conditional on completing the exact legacy stale-lease repair,
-observing a safe update preflight, installing the published beta.12.8 package, and following fresh
-project-local `status -> next` without skipping the Human gate.
+- A clean `npm ci` completed from the exact lockfile. A network-enabled `npm audit --json` reported
+  zero vulnerabilities at every severity across all eight installed dependencies.
+- `npm run validate` passed typecheck and `408/408` sequential tests with no failures, skips,
+  cancellations or todos in 2,761,796.900458 ms.
+- `npm run test:signal-t10-check-support-e2e` passed `8/8` after the final clean install in
+  203,155.332125 ms. It covers an impossible selector-less check, machine-derived support scope,
+  Knowledge rebind, historical evidence reuse and exact compatibility from both beta.12.11 and
+  beta.12.15 into beta.13.
+- `npm run test:signal-remediation-e2e` passed `2/2` in 9,220.225709 ms. The audited remediation
+  adds the required upstream Task and resumes the original Task through a later Step without
+  auto-approving unrelated Knowledge drift.
+- `npm run test:signal-t03-replan-e2e` passed `1/1` in 45,253.2055 ms. The Signal-shaped flow
+  recovers an accidental rebind, replans and completes the consolidated guarded Step.
+- `npm run test:signal-t04-recovery` passed `11/11` in 22,021.439625 ms. It preserves only exact
+  reviewed Step provenance and rejects pending, corrupt, unrelated or stale recovery evidence.
+- `npm run pack:check` produced the exact `2.0.0-beta.13` tarball with 309 files, package size
+  1.2 MB and unpacked size 4.8 MB. It includes the shared gateway-handshake module and the
+  hash-verifiable reviewer runtime build manifest.
+- `npm run smoke:downstream` packed the release, installed it into an empty project and returned
+  `ok=true`. The first sandboxed attempt could not resolve the npm registry; the identical
+  network-enabled invocation passed.
+- `npm run plugin:check`, `npm run docs:pdf:check`, `npm run typecheck` and `git diff --check` all
+  passed. The PDF checker reported no stale generated document. `npm run release:check` passed
+  `103/103` tests in 300,945.515375 ms and returned the exact package/version assertion.
+
+## Release-candidate regressions found and closed
+
+The first complete candidate run reported `352/380` passing tests. A common precedence defect was
+found: explicit beta.13 unclassified reviewer findings (`causeBindings: []`) had been confused with
+legacy events where `causeBindings` is absent. The corrected contract keeps the former on the same
+Task, sends only a repeated authoritative cause to root-cause replan, and preserves an explicit
+current corrective decision over ordinary rolling continuation. Read-only remediation observation
+no longer requires a live bearer, while execution still requires exact actor and credential
+authority.
+
+The second complete run reported `375/380`. These five failures exposed three release-boundary
+defects that focused tests run before the version bump had missed:
+
+- Step comparison still admitted runtime-only fields into Plan semantics and could demote an
+  unchanged completed Step to `planned` during replan;
+- a synthetic pre-beta.13 remediation event retained the new `causeBindings` field and therefore
+  no longer represented legacy data;
+- the dependency compatibility preflight parsed only `beta.12.<patch>` runners, so the actual
+  beta.13 release candidate could not consume the supported beta.12.11+ recovery surface.
+
+Production Plan comparison now canonicalizes only executable Step fields in both ordinary and
+journaled replan paths. Legacy recovery remains limited to events where `causeBindings` is absent.
+Compatibility compares the beta train and patch and still requires an exact beta.12 source at or
+after beta.12.11, a newer runner, matching declared/locked/installed/base versions and every existing
+dirty, lease and evidence guard. Repeated focused and parallel regressions passed before the final
+candidate expansion.
+
+A later complete run of the expanded candidate reported `387/396`. It exposed four distinct issues
+rather than one product defect:
+
+- an autonomous-retry fixture was incorrectly labelled `runtime-composition` and therefore invoked
+  the new structural production-edge gate;
+- legacy stop-override fixtures accidentally retained native beta.13 cause bindings;
+- assertions still expected direct submit/merge after credential release and retained a completed
+  dependent Step after its predecessor was invalidated;
+- external sealed-review preflight spawned the full CLI graph with 15-second and 60-second deadlines;
+  under scheduler pressure a valid exact repository-local runtime could exhaust both deadlines and
+  produce a false infrastructure blocker.
+
+The first three were corrected only at their stale fixtures/expectations; production authority was
+not weakened. The reviewer defect was fixed structurally: CLI and preflight now share one pure
+gateway descriptor, and preflight synchronously loads the exact installed gateway, reviewer and
+workflow graph through Node after manifest/hash verification. It does not spawn a schedulable child,
+cache trust, install or build dependencies. Missing transitive dependencies, byte drift, unsafe paths,
+symlinks and contract mismatch remain fail-closed. Five concurrent preflights under eight CPU burners
+passed, and the exact five-file regression that had failed passed `88/88`. The final complete run then
+passed `399/399`.
+
+An independent agnostic release audit then reproduced one additional production defect in a long-lived
+process: after one successful preflight, Node's warm module cache could hide a subsequently deleted
+transitive dependency and still allow a sealed packet. The fix does not clear or reinterpret the module
+cache. Instead, every preflight now resolves the actual recursive dependency graph from each parent
+package using nested-first Node lookup and re-hashes exact package manifests plus every attested
+`.js`, `.cjs`, `.mjs`, `.json` and `.node` runtime file before any cached module can be trusted. Missing,
+tampered, conflicting, path-escaped or symlink-redirected state fails before load and before packet
+issuance. Exact Ajv runtime transitives are direct pins so the built attestation and npm layout are
+deterministic. Same-process ready-delete-fail-restore-ready, warm tamper, nested version conflict and
+stale nearer-copy regressions expanded the complete suite.
+
+A real native reviewer preflight then exposed an API-level Structured Output incompatibility: every
+declared object property must also be present in `required`. The reviewer schema now makes nullable
+optional semantics explicit, while the semantic parser still rejects absent or contradictory
+cause/plan-conflict evidence. The complete suite consequently reached `408/408`, and the expanded
+release check reached `103/103`.
+
+The same real-agent exercise corrected the release proof boundary without weakening Core. A nested
+`codex exec` reviewer is not treated as independent production evidence: the Coordinator stops at a
+read-only sealed packet, a distinct Codex App task performs each Step/Task review, and an external
+conductor binds the four-field review object to the packet hash, repository seal and actual reviewer
+task ID before the original persistent Coordinator resumes. The disposable release grant is limited
+to `task.execution_authorize` and `task.final_accept`; both authorizations, credential recovery and
+merge therefore use one delegate actor without an intermediate Human approval. A diagnostic harness
+attempt is never resumed or promoted after a failed binding.
+
+The first fully merged delegated fixture also found a fail-closed validator inventory gap:
+`discovery show` was logged as a mutation, so a harmless read between CLI help and fresh `next` was
+rejected as `HELP_REQUIRES_FRESH_NEXT`. The packaged transcript validator now classifies this command
+as a read-only observation and carries a regression for help -> read-only observation -> next ->
+mutation. This changes release-evidence interpretation only; it grants no lifecycle authority.
+
+## Implemented beta.13 contract
+
+- Failed Step checks and failed strict Step reviews enter an atomic continuation pause: evidence,
+  Task state and writer/C1 release either commit together or recover through the transaction journal.
+- Distinct normalized causes continue in the same Task without a numeric retry ceiling. A repeated
+  authoritative cause after a claimed fix requires root-cause replan; volatile output cannot create
+  a new cause identity.
+- Corrective replan preserves an unchanged completed Step and its reviewed commit only when every
+  dependency is also retained with the exact executable definition. A changed or omitted Step and
+  its transitive completed descendants are invalidated rather than silently adopted; independent
+  unchanged branches remain retained.
+- For multi-Step runtime composition, structural production edges are independently triggered by
+  the PRA classification rather than a planner-owned flag, and checked for a transitive owner,
+  consumer and exact executable consumer check. Simple one-Step runtime is exempt. This is bounded
+  structural authority, not a claim of full product-semantic correctness.
+- Writer credentials are stored in private local references and are never serialized as raw bearer
+  material in public CLI output, status, diagnostics or reviewer packets.
+- Compact status, reviewer runtime preflight, explicit review mode, App-owned operational preflight
+  and the observed Signal route matrix are packaged capabilities. Its class-level claim covers all
+  13 route classes observed in Signal with one exact production transition or terminal observation
+  per class. Action-level metadata remains explicit about witnessed, unwitnessed and unsupported
+  actions; unknown or malformed advertised actions fail closed.
+- Reviewer runtime preflight requires exact declared, locked and installed package versions, a
+  hash-verified build manifest, byte equality for the running/installed CLI, gateway, reviewer and
+  workflow entrypoints, and a disk-fresh recursive dependency attestation on every call. It loads the
+  exact installed runtime graph in-process only after that attestation and issues no sealed review
+  packet when any readiness or contract check fails.
+
+## Boundaries and non-claims
+
+- beta.13 does not introduce generic shadow-history import, completed-Step adoption from an
+  unrelated Task, or unchecked Workflow-state reconstruction.
+- P02 Step-validity authority, P03 generic context reuse and P04-B structural Task replacement remain
+  outside this release unless an exact implemented capability says otherwise.
+- App-owned effects such as chat creation, consent UI and polling remain outside Core. Core exposes
+  diagnostic preflights but does not claim those effects occurred.
+- The package tests prove the supported compatibility and lifecycle contracts. They do not prove a
+  future Milestone's product requirements or replace independent product review.
+- The required real-agent transcript is external release evidence bound to the final tarball and source
+  commit. This tracked report does not claim that gate before its append-only log, actual-agent
+  cross-check, product test, clean Git boundary and credential-residue checks have all passed.
+- This report does not claim commit/tag/push, npm publication, installation into Signal or Milestone
+  4 readiness until those operations receive exact readback.
+
+Confidence is high for package behavior and the stated compatibility boundary: the final `408/408`
+run, `103/103` release check, four Signal-shaped E2E suites, package/downstream smoke, CPU-saturation,
+warm-cache and fail-closed negative cases agree. Live Signal readiness remains conditional on
+publication, exact repository-local installation, safe
+closure of the frozen Milestone 3 authority and a fresh read-only `status`/`next` observation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.12.8",
+  "version": "2.0.0-beta.13",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",
@@ -33,7 +33,10 @@
     "roles",
     "references",
     "plugins",
-    "docs",
+    "docs/*.md",
+    "docs/lifecycle",
+    "docs/pdf",
+    "docs/problem-briefs",
     "scripts/generate-pdf-docs.py",
     "scripts/run-pdf-docs.mjs",
     "README.md"
@@ -45,6 +48,8 @@
     "test": "node scripts/with-validation-lock.mjs test",
     "test:signal-t04-recovery": "node scripts/with-validation-lock.mjs test-signal-t04",
     "test:signal-t03-replan-e2e": "node scripts/with-validation-lock.mjs test-signal-t03-replan",
+    "test:signal-remediation-e2e": "node scripts/with-validation-lock.mjs test-signal-remediation-topology",
+    "test:signal-t10-check-support-e2e": "node scripts/with-validation-lock.mjs test-signal-t10-check-support",
     "validate": "npm run typecheck && npm test",
     "pack:check": "npm run build && npm pack --dry-run",
     "smoke:downstream": "npm run build && node scripts/downstream-smoke.mjs",
@@ -55,7 +60,11 @@
     "publish:release": "node scripts/publish.mjs"
   },
   "dependencies": {
-    "ajv": "8.20.0"
+    "ajv": "8.20.0",
+    "fast-deep-equal": "3.1.3",
+    "fast-uri": "3.1.7",
+    "json-schema-traverse": "1.0.0",
+    "require-from-string": "2.0.2"
   },
   "devDependencies": {
     "@types/node": "24.10.1",

package/plugins/codex-workflow-gateway/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-gateway",
-  "version": "0.1.0+codex.20260829181421",
+  "version": "0.1.0+codex.20260830183000",
   "description": "Thin personal Codex gateway for exact project-local Codex Workflow V2 packages and codebase-memory-mcp.",
   "author": {
     "name": "Codex Workflow Maintainers"

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -33,6 +33,15 @@
   `retainedHistoricalCommits`.
   Task-local manifest/lock fields from recorded history may differ from the base, but the candidate
   commit must preserve them exactly while changing only the Workflow dependency entries.
+- `task historical-step-provenance-preflight --id <TASK-ID>` is read-only. The matching
+  `task historical-step-provenance-recover` is available only for one unexpected product commit
+  with an intact passed strict-review chain, matching prior final acceptance, no lease or pending
+  operation, and dirty files confined to the current active Step. It retains historical authority
+  without changing Git, worktree bytes, or the current Plan.
+- `update historical-step-dependency-preflight/recover` handles the same proof when the beta.12.9
+  dependency-only commit is the unregistered HEAD. It binds the exact dependency candidate and the
+  reviewed historical Step commit in one recovery record, preserves active product bytes, and then
+  requires fresh `status` and `next`.
 - `task stop-override-prepare` is a read-only Human gate for the exact beta.11 attempt-four stop
   shape. `task stop-override-apply` requires the same Task revision, Step, actor, reason, Plan, HEAD,
   evidence binding, and returned `SOO-*` code in a later user turn. It appends evidence without

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -50,6 +50,31 @@ pending/corrupt transaction. After success run sequential `status` then `next` a
 returned lifecycle action; Knowledge reconciliation or atomic Task context refresh may legitimately
 be next because the dependency files changed.
 
+When beta.12.9 fresh `next` advertises `task historical-step-provenance-recover`, Core has found
+exactly one product commit that a corrective Plan omitted from current Step evidence even though the
+commit still has a complete hash-valid passed strict Step Review chain and a matching prior final
+acceptance. First run the advertised read-only `task historical-step-provenance-preflight --id
+<TASK-ID>` and require `eligible=true`, the exact Task revision/Plan/Brief/HEAD, the advertised
+commit SHA, no lease/transaction/Core operation, and dirty files confined to the one active Step's
+`allowedWrites`. Invoke recovery with that exact commit, actor, and a substantive reason. The
+transition records the commit as invalidated historical Step authority plus an audit record; it does
+not adopt the completed Step into the current Plan and does not create, remove, amend, reset, rebase,
+or merge Git commits. Reject multiple or arbitrary unexpected commits, pending/failed review,
+mismatched final acceptance, unrelated dirty files, or damaged sidecars. After success run
+sequential `status` then `next`; the active corrective Step should resume through its ordinary
+credential and `task step-complete` route.
+
+When beta.12.9 must itself be installed while this exact historical Step blocker is active, preserve
+the Task worktree and create only two dependency transport commits: one on the active Milestone base
+and one at Task-branch HEAD, each changing exactly `package.json` and `package-lock.json` to the exact
+beta.12.9 package. Do not switch the dirty Task checkout to update the base; use a separate temporary
+worktree. Install the repository-local target package, then require fresh `next` to advertise
+`update historical-step-dependency-recover`. Run the matching read-only preflight and require the
+exact dependency HEAD/parent, Task revision, active Step/Plan, retained historical SHA, dirty-file
+set and dirty-worktree hash, with no lease or pending operation. The matching recover registers both
+authorities without modifying product bytes or Git. After recovery run sequential `status` and
+`next`; do not substitute ordinary dependency recovery, manual state edits, rebase, reset, or amend.
+
 Beta.12.1 permits product-owned manifest/lock fields already present in the exact recorded Task
 history to differ from the Milestone base. Core compares candidate parent to candidate HEAD after
 removing only the Workflow dependency entries, so the dependency commit must preserve every such
@@ -107,6 +132,46 @@ into Plan `acceptance` as exact array members; semantic prose may be added but c
 IDs. Bind the Plan to the returned `briefHash` and active `knowledgeMap` revision/hash. Stop if the
 contract is absent or conflicts with the current Task/Knowledge state.
 
+When fresh repository `next` reports `planRiskAuditDecision.state=recorded-blocking`, decision
+`stop-escalate`, and an `auditedRemediation` object, do not retry authorization and do not invent a
+free-form Milestone scope change. Follow only the advertised route:
+
+1. If action is `discovery start`, create one Discovery for the exact missing upstream capability
+   proved by the audit. Preserve the current Milestone outcome, success signal, acceptance, checks,
+   and original Task scope. Resolve factual unknowns from repository evidence; a genuine unresolved
+   product decision remains a semantic blocker.
+2. If action is `discovery update`, complete that same remediation Discovery until it is
+   `ready_to_materialize`; do not reuse an unrelated Discovery.
+3. If action is `milestone remediation-materialize`, use its exact Milestone/Task revisions and
+   audit binding. The JSON input contains only `discoveryId`, `expectedDiscoveryRevision`, `title`,
+   and `predecessorTaskIds`; the predecessor list must exactly equal
+   `auditedRemediation.requiredPredecessorTaskIds`. No actor, confirmation code, delegation grant,
+   replacement Milestone Plan, or human approval is accepted.
+4. Run sequential `status` then repository `next`. Core must prioritize the new remediation Task.
+   Plan, audit, hand off, implement, review, accept, and merge it normally. At Task execution
+   authorization and final acceptance, use the exact `correctiveDerivedApproval.actor` returned by
+   fresh `next`; `humanApprovalRequired` must be false. Do not pass a delegation grant.
+5. After the remediation Task is `merged`, fresh `next` must return the original blocked Task to
+   `task plan-set` with `auditedRemediation.state=merged-replan-required`. Replace its rejected Plan,
+   record a fresh Risk Audit, use the same current derived approval only when advertised, and
+   continue through at least the next ordinary Step boundary.
+
+An exact package update may make the approved Knowledge Map stale while this route is active. Continue
+without a Human approval only when fresh `next` includes
+`auditedRemediation.dependencyKnowledgeRefresh.eligible=true`. Core must prove that `package.json` is
+the sole changed Knowledge source, every version surface equals the repository-local runtime, and every
+Git commit that changed the approved manifest content altered only the exact Workflow dependency in
+`package.json`/`package-lock.json`. Do not run standalone reconcile first. The refresh is committed
+atomically by `milestone remediation-materialize` with corrective-derived evidence. Any other Knowledge
+path, classification, gap, conflict, dirty checkout, unaligned version or wider commit returns to the
+ordinary explicit Knowledge flow.
+
+This is an idempotent, additive topology transition bound to one exact Plan Risk Audit. Dirty Git,
+any lease/transaction/Core operation, a started blocked Task, stale Task/Milestone/audit bindings,
+non-merged or non-exact predecessors, duplicate use of the audit, or any changed Milestone semantic
+field is a hard stop. Generic `stop-escalate` shapes without `auditedRemediation` remain terminal
+user attention. Final Milestone acceptance remains an ordinary human/delegated gate.
+
 When `next` returns top-level `action: task context-refresh`, use only that atomic action for
 the returned Task/map revisions, actor, and grant. Do not run standalone `project-memory reconcile`
 first: Core rejects it because it would create a human-approval gap and strand the Task. A
@@ -480,7 +545,8 @@ Plan audit based only on count. Follow fresh `next`: ordinary findings default t
 `route=replan` is valid only with the exact Plan clause, obstruction, and minimal Plan change
 retained by Core. A remediation Plan may change implementation Steps but must preserve the Task
 objective, requirements, and acceptance. Explicit split or stop decisions still stop ordinary
-continuation.
+continuation; only an exact Core-advertised audited-remediation route may turn a pre-execution
+`stop-escalate` into additive upstream work.
 
 When `next.strictStepReview.recommendedMode` is `external-sealed`, do not launch the nested local
 reviewer from inside a Codex App sandbox. Run the advertised read-only `task step-review-packet`,

package/schemas/authorization-event.schema.json

@@ -19,7 +19,7 @@
     "evidenceHash": { "$ref": "#/$defs/nullableHash" },
     "headCommit": { "$ref": "#/$defs/nullableHash" },
     "reason": { "type": "string" },
-    "authorizationMode": { "enum": ["human", "delegated"] },
+    "authorizationMode": { "enum": ["human", "delegated", "corrective-derived"] },
     "delegation": { "$ref": "#/$defs/delegation" },
     "mechanicalFeasibility": { "$ref": "#/$defs/mechanicalFeasibility" }
   },
@@ -30,6 +30,13 @@
         "required": ["authorizationMode"]
       },
       "then": { "required": ["delegation"] }
+    },
+    {
+      "if": {
+        "properties": { "authorizationMode": { "const": "corrective-derived" } },
+        "required": ["authorizationMode"]
+      },
+      "then": { "not": { "required": ["delegation"] } }
     }
   ],
   "$defs": {
@@ -91,7 +98,7 @@
       "required": ["analyzerId", "analyzerVersion"],
       "properties": {
         "analyzerId": {
-          "enum": ["wf2.root-npm-script", "wf2.exact-output-path", "wf2.exact-predecessor-path"]
+          "enum": ["wf2.root-npm-script", "wf2.root-npm-script-arguments", "wf2.check-support-anchor", "wf2.exact-output-path", "wf2.exact-predecessor-path"]
         },
         "analyzerVersion": { "const": 1 }
       }
@@ -104,7 +111,7 @@
       ],
       "properties": {
         "analyzerId": {
-          "enum": ["wf2.root-npm-script", "wf2.exact-output-path", "wf2.exact-predecessor-path"]
+          "enum": ["wf2.root-npm-script", "wf2.root-npm-script-arguments", "wf2.check-support-anchor", "wf2.exact-output-path", "wf2.exact-predecessor-path"]
         },
         "analyzerVersion": { "const": 1 },
         "result": { "enum": ["pass", "blocked", "unverified"] },