codex-workflow-v2 2.0.0-beta.12 → 2.0.0-beta.12.10

package/docs/autonomy-guardrails.md

@@ -24,6 +24,30 @@ and self-contradictory classifications. `split-required` and `stop-escalate` blo
 authorization. The sidecar, not informal Plan prose, is
 the source of truth for which Steps require strict review.
 
+## Audited remediation topology
+
+A current pre-execution `stop-escalate` may prove that the Plan is blocked by a missing upstream
+capability rather than by an implementation defect inside the Task. Beta.12.10 handles only this
+shape without a new human approval. Repository `next` first requires one ordinary Discovery whose
+facts, scope, constraints, and acceptance describe the exact missing capability. When ready, it
+advertises `milestone remediation-materialize` with the blocked Task/Milestone revisions, audit
+binding, and required predecessor frontier.
+
+The transition is safe by construction rather than by agent judgment. Its input cannot supply a
+replacement Milestone outcome, success signal, acceptance, checks, or arbitrary membership graph.
+Core appends one required Task, copies the blocked Task's exact direct predecessor frontier, adds
+the remediation Task as one new dependency of the blocked Task, and changes nothing else. It runs
+under an idle, clean observation boundary and records one hash-chained `audited-remediation`
+scope-change event. Reuse of the same Plan Risk Audit is rejected.
+
+The previous current Milestone execution authorization and exact blocking audit derive a new
+`corrective-derived` Milestone execution authorization. While that authority remains current,
+`next.correctiveDerivedApproval` may authorize and finally accept required Tasks using the exact
+derived actor, without a human or delegation grant. This does not bypass Plan Risk Audit,
+mechanical feasibility, C1 handoff, Step checks/commits, strict review, Task review, dependency
+runnability, clean-Git requirements, or final Milestone acceptance. Any later arbitrary scope
+change supersedes this authority.
+
 Guarded categories cover:
 
 - forward database or state migrations;
@@ -74,7 +98,50 @@ default. `replan` is accepted only with `planConflict.planClause`, `whyFixCannot
 `minimalPlanChange`; Core retains that evidence in the hash-chained Step-review event and routes
 the failed Step to `task plan-set`. Replan may change implementation Steps only. Explicit historical
 `continue-fix`, `replan-required`, `split-required`, and `stop-escalate` decisions remain readable;
-an explicit split or stop still outranks ordinary execution.
+an explicit split or stop still outranks ordinary execution except for the narrow beta.11
+attempt-four stop compatibility route below.
+
+### Human-confirmed beta.11 attempt-four stop compatibility
+
+Beta.12.1 can resume one historical shape that beta.11 stopped mechanically: the same failed
+guarded Step has exactly two `ordinary` remediation events, one `corrective` third event, an exact
+attempt-3 `continue-fix` decision, and an attempt-4 `stop-escalate` decision under the unchanged
+Plan. Fresh `next` advertises `task stop-override-prepare` only for that shape and only on a clean
+local Task branch with no Step in progress, writer lease, Task transaction, or Core operation.
+
+Preparation is read-only and binds Task revision, Step, both corrective decisions, all three
+remediation events, Plan hash, Git HEAD, package version, actor, and reason to an `SOO-*`
+confirmation code. In a later explicit user turn, invoke `task stop-override-apply` with the same
+inputs and code. Apply appends `stop-escalate-overrides.jsonl`; it never deletes or rewrites the
+original stop. A stale binding, wrong code, duplicate/conflicting override, or damaged hash chain
+fails before continuation. Delegation is not accepted for this Human gate.
+
+This is not a general stop reversal. It does not apply to `split-required`, semantic Plan drift, a
+different attempt ordinal, missing attempt-3 continue authority, or an agent-authored semantic stop
+outside the beta.11 policy shape. After a valid append, attempt four returns to the normal `task run`
+then strict-review cycle; review quality and all later corrective decisions remain unchanged.
+
+Beta.12.4 also handles the case where the accepted third attempt changed approved Project Knowledge
+and package self-updates added later refreshes: the already-applied override may be followed by one
+or more ordinary delegated `task context-refresh` transitions before attempt four starts. A fresh
+`next` resumes `task run` only when Core can prove all of the following together: the same exact
+three-event remediation history and stop override remain hash-valid; every adjacent Plan differs
+only in its canonical Knowledge Map binding line; the Knowledge rebinds and mechanical Plan Risk
+Audit rebounds form one contiguous source-to-current chain; and the refreshed approval plus current
+execution authorization share the valid delegated authority. If Git HEAD advanced, every
+intervening commit must have one exact registered dependency-provenance recovery, one parent, a
+`systemCommits` binding, and exactly the `package.json`/`package-lock.json` diff. The proof is derived
+from existing append-only evidence, so this route does not create a second recovery journal.
+Missing evidence, semantic Plan change, an unregistered/product commit, a broken chain, or damaged
+chronology routes to `doctor` rather than weakening the generic two-attempt corrective recovery gate.
+
+If fresh navigation performs the final content refresh before the matching dependency-provenance
+recovery, that later administrative recovery may advance the Task revision without invalidating the
+mechanical audit. Core accepts the revision only when the exact count of post-audit recovery records
+fully explains the difference: each record must belong to the already verified single-parent Git
+chain, remain ordered, bind a Workflow system commit, and preserve the exact two-file dependency
+diff. A bare greater revision, unrelated Task write, duplicate record, damaged parent, product
+commit, or unverified recovery remains blocked.
 
 ### First-failure Plan-integrity recovery
 
@@ -98,6 +165,29 @@ validation, Risk Audit, Human confirmation, journaled execution, readback, and r
 authorization. Other check failures use the normal continuable remediation route; they do not
 receive the narrow Plan-integrity shortcut, but attempt count alone never stops them.
 
+### Downstream-proof predecessor recovery
+
+Core prevents `task step-complete` when the active proof Step has dirty files outside its own
+`allowedWrites`. A bounded recovery is advertised only when every such file belongs to a completed
+transitive predecessor, the branch and registered Git history are exact, the active Step has no
+completion evidence, and no unrelated path exists. The atomic transition preserves product files
+and HEAD, moves invalidated predecessor commits into historical `invalidatedStepCommits`, clears stale Step
+evidence, supersedes execution authority, yields C1, and routes the same Task to ordinary `plan-set`.
+The route grants no authority to change Task objective, requirements, acceptance, or Milestone
+topology.
+
+The beta.12.7 compatibility repair for an accidental post-invalidation Knowledge rebind is similarly
+non-semantic. It may restore `needs_fix` and preserve an exact dirty-worktree binding, but it cannot
+approve a replacement Plan, infer new requirements, or treat preserved bytes as completed evidence.
+After any required Knowledge refresh, the full unfinished remainder is planned again. Carryover into
+execution is valid only when one newly authorized Step owns every bound path and the current
+HEAD/path/content hashes still match; checks and strict review retain their ordinary authority.
+
+Docker permission diagnostics are classified before consuming retry authority. Sandbox `EPERM` or
+permission denial gets one exact escalated rerun of the health probe/Plan check. It is not an infra
+failure and cannot authorize a Docker Desktop restart or image substitution. Only an escalated
+invocation that reaches Docker and proves daemon unavailability establishes that failure class.
+
 ## Atomic context refresh
 
 When `next` returns top-level `action: task context-refresh` with an exact option, a

package/docs/decisions.md

@@ -97,3 +97,17 @@ This document closes the requirement gaps identified during the V2 design review
 19. **Derived independent actors.** Core derives stable Task Worker and corrective Auditor
     actors from Task identity. This removes name-selection pauses without weakening C1 claim,
     lease, or auditor-independence checks.
+20. **Stop-override authority survives mechanical update chains.** The exact Human-confirmed
+    beta.11 attempt-four override remains valid across any contiguous append-only sequence of
+    content-only Plan rebinds. Every adjacent immutable Plan, Knowledge rebind, and mechanical
+    Plan Risk Audit rebound must agree. Git HEAD may advance only through a contiguous chain of
+    already registered dependency-provenance commits, each single-parent and limited to
+    `package.json` plus `package-lock.json`. Semantic Plan drift, product commits, missing
+    provenance, or broken chronology still fails closed; generic corrective-decision recovery
+    remains direct and is not widened.
+21. **Administrative revision continuity is evidence-accounted.** A dependency-provenance
+    recovery recorded after the current mechanical Plan Risk Audit may explain exactly one later
+    Task revision without invalidating an already applied stop override. Core counts only ordered
+    recovery records from the independently verified override-to-authorization Git chain and
+    requires the resulting expected revision to equal the current Task revision. Unexplained
+    revisions and damaged provenance remain blocked; this is not a general `revision >=` rule.

package/docs/delegated-approval.md

@@ -90,7 +90,12 @@ uses the grant and passes `--delegation-grant` to the Core transition.
 
 Ordinary semantic Milestone scope changes remain journaled, human-only lifecycle actions. A
 contract delegate may evolve only the membership graph inside the cryptographically bound
-semantic scope.
+semantic scope. The separate beta.12.10 `milestone remediation-materialize` route is not delegation
+and does not widen this allow-list: Core derives it only from a current blocking Plan Risk Audit and
+a previously authorized active Milestone. Its topology effect is fixed to one new required upstream
+Task plus one dependency edge, with all Milestone semantics preserved. The resulting
+`corrective-derived` Task approvals remain valid only while that exact derived Milestone authority
+is current; final Milestone acceptance is unaffected.
 
 ### Milestone delegate prompt
 

package/docs/development-flow.md

@@ -76,8 +76,10 @@ Submission requires a clean, auditable Task history and records evidence for the
 Task head. `task review-launch` starts a separate read-only reviewer and atomically records its
 result. If C1 handoff is active, keep `--actor` equal to the current claimant or required actor
 from `next`; the reviewer identity remains internal to the compound route. A passing fresh review
-permits Result creation. Human final acceptance binds Brief, Plan, Result, evidence, and
-the accepted head. Base advancement forces synchronization, checks, review, and acceptance
+permits Result creation. Final Task acceptance binds Brief, Plan, Result, evidence, and
+the accepted head. It is human/delegated by default; a Task covered by the current audited-remediation
+Milestone authority uses the exact `correctiveDerivedApproval` actor returned by `next` without a
+new human gate. Base advancement forces synchronization, checks, review, and acceptance
 to be repeated before merge.
 
 The Technical Planner performs a risk review before authorization. Migration work includes a
@@ -99,7 +101,36 @@ the exact evidence-bound early `replan-required` posture; it never edits source,
 Continue through the advertised corrective yield and corrective replan rather than calling
 `task run` again.
 
-Execution authorization and final acceptance use the human path by default. If the user has
+If a later proof Step leaves changes both in its own scope and in files owned by a completed
+transitive predecessor, fresh `next` advertises `task downstream-proof-recover` instead of
+`task step-complete`. The command preserves the dirty worktree and HEAD, append-only records the
+invalidated predecessor completion, yields its C1 lease, and returns the same Task to `task plan-set`.
+The replacement Plan must cover the unfinished remainder and pass a fresh Risk Audit and execution
+authorization. Do not stash, reset, commit, or recreate the Task around this route.
+
+If the repository is still on a package version that cannot advertise that route, beta.12.6 has
+one update-only bridge. After exact dependency-only commits have aligned the active Milestone base
+and Task branch, `update downstream-proof-dependency-recover` validates recorded history at the
+candidate parent, binds the active proof dirty set by content hash, and registers only the Task
+dependency commit. Product bytes and Step state remain unchanged; fresh `next` must then advertise
+the ordinary `task downstream-proof-recover`. This is not a general dirty-update permission.
+
+If beta.12.6 already performed that recovery but a subsequent Knowledge approval mechanically
+rebound its rejected Plan, use only the beta.12.7 stranded-replan bridge advertised by fresh `next`.
+The source preflight runs before dependency transport and binds the exact beta.12.6 Task revision,
+HEAD, dirty paths, and content hash. After dependency-only base/Task commits and provenance recovery,
+`task downstream-proof-replan-recover` restores `needs_fix`. Reconcile/approve stale Project Knowledge,
+then replace the full unfinished Plan. The preserved dirty set may enter execution only through one
+new Step whose `allowedWrites` owns every path and whose fresh `next` reports validated carryover.
+Completing that Step still requires its checks, Core-owned commit, and any guarded strict review.
+
+A sandboxed Docker `EPERM`, `operation not permitted`, or `permission denied` result is not a failed
+daemon check. Re-run the exact probe/check once with sandbox escalation without consuming a retry.
+Restart Docker Desktop only with separate authorization after the escalated call reaches Docker and
+proves the daemon unavailable.
+
+Execution authorization and final acceptance use the human path by default. The only Core-derived
+exception is a current audited-remediation Milestone authority described below. If the user has
 previously issued an active delegation grant for the exact transition and scope, the named
 delegate may perform that transition with `--delegation-grant`. The event keeps the delegate
 as actor and separately records the principal and policy hash. Expired, revoked, wrong-scope,
@@ -141,6 +172,30 @@ journaled recovery across `state.json`, `plan.json`, and `scope-change-events.js
 Plan uses the same recovery machinery for its exact two-file `state.json` + `plan.json` commit and
 does not manufacture a scope-change event.
 
+There is one narrower route for a confirmed pre-execution topology defect. When the current Plan
+Risk Audit for an unstarted required Task records `stop-escalate`, repository `next` routes through
+a remediation Discovery and then `milestone remediation-materialize`. Core accepts no free-form
+Milestone Plan. It atomically:
+
+- consumes one ready Discovery and creates one new required remediation Task;
+- makes that Task inherit the blocked Task's exact direct predecessor frontier, all already merged;
+- adds exactly one dependency edge from the blocked Task to the remediation Task;
+- preserves Milestone outcome, success signal, acceptance, checks, prior memberships, discovery,
+  and base branch;
+- binds the scope-change sidecar to the exact rejected Task revision, Brief/Plan hashes, and
+  `stop-escalate` audit event/hash;
+- supersedes the old execution authorization and records a `corrective-derived` replacement bound
+  to the prior authorization and audit.
+
+No confirmation code or human approval is used for this route. It is idempotent per audit and
+rejects dirty checkout, active/stale leases, pending operations, a started Task, a non-current
+audit, a changed predecessor frontier, a non-merged predecessor, or any attempt to change Milestone
+semantics. Repository `next` prioritizes the remediation Task. After it merges, `next` returns the
+original Task to `task plan-set`; its replacement Plan and Risk Audit are evaluated normally.
+Current required Tasks may use the exact `correctiveDerivedApproval.actor` returned by `next` for
+Task execution authorization and final acceptance. Worker handoff, checks, commits, strict review,
+and final Milestone acceptance remain ordinary independent gates.
+
 A Milestone has no integration branch. Validation requires all required Tasks to be
 `merged`, checks the current clean base branch, and writes evidence plus Result. Final
 acceptance binds those artifacts to the unchanged base HEAD. Cancellation records a reason
@@ -193,11 +248,11 @@ wake a coordinator that has already ended its turn.
 
 | Participant | Responsible for | Cannot decide |
 | --- | --- | --- |
-| User / principal | map classifications, direct approvals, delegation policy and revocation, scope changes | implementation evidence |
+| User / principal | map classifications, direct approvals, delegation policy and revocation, arbitrary scope changes | implementation evidence |
 | Delegate | only transitions explicitly allowed by an active grant | grant creation, expansion, impersonating the principal |
 | Scope Lead | discovery, facts, unknowns, Task/Milestone recommendation | production edits |
 | Technical Planner | requirements mapping, Steps, checks, knowledge impact | authorization |
-| Delivery Coordinator | valid transitions, dispatch, evidence collection | scope expansion |
+| Delivery Coordinator | valid transitions, dispatch, evidence collection, exact audited-remediation route | arbitrary scope expansion |
 | Worker | one dispatched Step within allowed paths | adjacent Steps or Plan changes |
 | Independent Reviewer | isolated comparison of requirements, diff, checks, and evidence | fixes or acceptance |
 | Core CLI | state, revisions, hashes, locks, Git mechanics, diagnostics | semantic product choices |

package/docs/pdf/sources/codex-workflow-v2-architecture-ru.md

@@ -1,10 +1,10 @@
 ---
-title: Codex Workflow V2: архитектура beta.12
+title: Codex Workflow V2: архитектура beta.12.10
 subtitle: Источники истины, lifecycle, роли, delegation, зависимости Tasks и границы доверия
 part: Часть 1 из 3 | Архитектура
 document_version: 2.0
-date: 27 августа 2026
-subject: Архитектура и границы Codex Workflow V2 beta.12
+date: 31 августа 2026
+subject: Архитектура и границы Codex Workflow V2 beta.12.10
 ---
 
 # 1. Назначение и граница системы
@@ -18,7 +18,7 @@ Codex Workflow V2 - локальный state machine поверх Codex App, Git
 Система рассчитана на одного пользователя и одну машину. Она не предоставляет distributed locking,
 криптографическую идентификацию actor string или безопасную синхронизацию state между компьютерами.
 
-## 1.1. Что beta.12 гарантирует
+## 1.1. Что beta.12.10 гарантирует
 
 - exact project-local npm package и совместимый handshake до lifecycle действий;
 - Discovery до materialization Task или Milestone;
@@ -26,11 +26,22 @@ Codex Workflow V2 - локальный state machine поверх Codex App, Git
 - mechanical-feasibility проверку поддерживаемых форм Plan до новой Task authorization;
 - явный Milestone dependency DAG и один общий runnable predicate для routing, handoff, claim и start;
 - один C1 writer lease, секретные one-time credentials и Core-owned Step commits;
+- lease-free Human final-acceptance gate: `task result-set` проверяет и освобождает active writer
+  lease, а после acceptance merge получает новый credential только через fresh recovery route;
 - external-sealed Step/Task review в отдельных Codex tasks;
 - state-bound human gates либо ранее выданные bounded delegation contracts;
 - journaled recovery для составных переходов и fail-closed поведение при drift/corruption.
-
-## 1.2. Что beta.12 не гарантирует
+- bounded recovery, когда downstream proof требует изменить уже завершённый predecessor Step:
+  worktree и HEAD сохраняются, stale completion authority снимается, та же Task возвращается в planning.
+- bounded compatibility recovery, если beta.12.6 после этого recovery ошибочно rebind-нула отвергнутый
+  Plan: exact dirty bytes сохраняются до нового consolidated Step, а Knowledge refresh не отменяет `plan-set`.
+- corrective Plan сохраняет authority исключённых completed Step commits, а beta.12.9 bounded recovery
+  исправляет уже stranded state только при passed strict review и прежнем hash-bound final acceptance.
+- pre-execution `stop-escalate`, доказавший отсутствующую upstream capability, может materialize ровно
+  один additive remediation Task без нового Human gate; Core сохраняет Milestone semantics и выводит
+  authority из текущей Milestone authorization и exact audit evidence.
+
+## 1.2. Что beta.12.10 не гарантирует
 
 - правильность продуктовой идеи или автоматически выбранного provider Task;
 - semantic sufficiency Plan, если точные факты нельзя доказать поддерживаемым analyzer;
@@ -106,6 +117,11 @@ Discovery -> materialize -> Plan -> Plan Risk Audit
 -> final acceptance -> merge
 ```
 
+`task result-set` является последним execution lease-bound переходом. Он требует рекламируемый
+writer token, освобождает lease до `awaiting_final_acceptance` и тем самым допускает неограниченную
+по времени Human pause без stale-lock блокировки repository. После acceptance прежний token не
+переиспользуется: fresh `next` выдаёт bounded `task writer-credential-replace` для merge.
+
 Fresh Task authorization записывает versioned mechanical-feasibility evidence. Analyzer может
 выдать `blocked`, `pass` или `unverified`. `unverified` не означает semantic approval; он означает,
 что поддерживаемая точная грамматика не доказала противоречие.
@@ -218,17 +234,91 @@ Failed review не ограничивает число попыток. Попы
 `route=replan` допустим только с точным Plan conflict и меняет лишь implementation Steps, не objective,
 requirements или acceptance. Explicit `split-required` и `stop-escalate` остаются stop/redirect decisions.
 
+Beta.12.1 добавила одну append-only compatibility оговорку: beta.11 attempt-four
+`stop-escalate` после exact `ordinary, ordinary, corrective` и prior attempt-3 `continue-fix` можно
+возобновить через read-only `stop-override-prepare` и отдельный Human-confirmed
+`stop-override-apply`. Исходный stop сохраняется, `split-required` не подходит, а stale revision,
+Plan, HEAD, lease, transaction или повреждённая chain блокируют переход. Попытка 4 снова проходит
+обычный `task run` и новый strict review.
+
+Beta.12.4 сохраняет этот override при последовательности delegated `task context-refresh`, если
+каждая версия Plan изменилась только в canonical Knowledge Map binding. Core проверяет весь
+contiguous rebind/audit chain, mechanical equivalence каждого Plan Risk Audit, общую delegated
+authority и корректную chronology. Git HEAD может продвинуться только через последовательность
+зарегистрированных dependency-provenance commits, каждый из которых меняет ровно package.json и
+package-lock.json. При утрате claimed writer lease используется только одновременно рекламируемый
+`task writer-credential-replace`; semantic Plan drift, разрыв chain или любой другой commit
+возвращают `doctor`.
+
+Если последний dependency-provenance recovery записан уже после mechanical audit, он объясняет
+ровно один дополнительный Task revision. Core требует, чтобы audit boundary плюс количество
+проверенных post-audit recoveries точно равнялись current revision; произвольное увеличение
+revision, неверный parent или повреждённая provenance остаются blocker.
+
+Dependency-provenance recovery beta.12.1 также сохраняет ранее закоммиченные Task-local поля
+manifest/lock, даже если base их не содержит. Candidate остаётся dependency-only: после удаления
+только Workflow dependency parent и HEAD обязаны совпасть по всем product-owned полям.
+
 beta.11 `task plan-integrity-recover` существует для одного первого checks-failed legacy/late case:
 отсутствует exact root npm script и текущий Step не может изменить package.json. Recovery не меняет
 worktree или Plan и не создаёт synthetic second failure; он записывает bound `replan-required`.
 
+beta.12.6 различает другой случай: активный downstream proof оставил изменения в собственном scope и
+показал необходимость исправить completed transitive predecessor. Fresh `next` вместо невозможного
+`step-complete` рекламирует `task downstream-proof-recover`. Atomic transition сохраняет dirty files и
+HEAD, переносит predecessor commits в historical `invalidatedStepCommits`, очищает только stale Step evidence,
+yield C1 и возвращает ту же Task к новому Plan/risk audit/authorization. Unrelated dirty file,
+non-predecessor ownership, повреждённый journal или unregistered commit fail closed.
+
+Если старая версия не может установить этот fix из-за running Step/dirty preflight, beta.12.6
+добавляет отдельный update bridge. После двух exact dependency-only commits на active base и Task
+branch Core проверяет Task history на `HEAD^`, candidate на `HEAD`, все version surfaces, отсутствие
+leases/transactions, predecessor ownership и content hash dirty set. Переход регистрирует только
+dependency commit, не меняет product bytes/Step и делает обычный `task downstream-proof-recover`
+достижимым до manifest-induced Knowledge refresh. Это не общее разрешение dirty update.
+
+beta.12.7 закрывает следующий доказанный Signal case: beta.12.6 уже выполнила downstream-proof
+invalidation, но последующее Project Knowledge approval механически вернуло старый двух-Step Plan в
+`awaiting_execution_authorization`. Read-only `update downstream-proof-replan-update-preflight`
+сначала связывает exact beta.12.6 revision, HEAD, шесть dirty paths и content hash. После двух
+dependency-only commits `update downstream-proof-replan-dependency-preflight/recover` регистрирует
+только новый Workflow HEAD. `task downstream-proof-replan-recover` затем атомарно возвращает ту же
+Task в `needs_fix`; stale Knowledge можно reconciliate/approve, но fresh `next` всё равно требует
+новый `task plan-set`. Новый Plan может передать сохранённые bytes только одному Step, который владеет
+всем dirty set. `task run` принимает carryover лишь при exact HEAD/path/hash match, после чего Step
+проходит обычные checks, Core-owned commit и strict review.
+
+beta.12.9 закрывает исторический provenance gap corrective replan. Новые replan transitions автоматически
+переносят evidence commits исключённых Steps в `invalidatedStepCommits`. Для уже существующего gap Core
+требует один неожиданный commit, complete passed strict-review chain, verified reviewer attestation и
+совпадающий прежний final acceptance. Если пакет уже зарегистрирован, recovery меняет только Task state.
+Если exact beta.12.9 dependency commit ещё находится в HEAD, отдельный update compatibility route
+регистрирует dependency и historical authority одной revision. Оба пути сохраняют dirty bytes текущего
+Step, не переписывают Git и завершаются fresh обычным `step-complete` flow.
+
+beta.12.10 закрывает иной класс тупика до начала выполнения. Если current Plan Risk Audit required Task
+записал `stop-escalate`, потому что нужной upstream capability нет в scope этой Task, Core рекламирует
+audited remediation. Coordinator сначала формализует capability обычным Discovery. Затем одна Project
+transaction append-only создаёт required remediation Task на exact merged predecessor frontier исходной
+Task, добавляет dependency blocked -> remediation и сохраняет все Milestone semantic fields и старые
+memberships. Scope-change event связан с Task revision, Brief/Plan и audit hashes; повторное применение
+того же audit невозможно. Текущая Milestone execution authorization и audit выводят
+`corrective-derived` authority для Task authorize/accept без нового Human gate. Remediation Task проходит
+обычный Plan, audit, C1, commits и reviews. После её merge исходная Task обязана заменить отвергнутый Plan,
+пройти fresh audit и продолжить Step. Final Milestone acceptance не выводится автоматически.
+
+Docker socket `EPERM` в sandbox не является доказательством сломанного daemon. Gateway один раз
+повторяет exact health probe или Plan check с sandbox escalation без расходования remediation attempt.
+Restart Docker Desktop требует отдельного разрешения и допустим только после escalated daemon failure.
+
 > **Стоп P04-A:** `split-required` возвращает `STRUCTURAL_REPLACEMENT_REQUIRED` и `structuralReplacementAvailable=false`. Нельзя вызывать retained replacement command, потреблять replacement Discovery или вручную менять topology. Продолжение возможно только после P04-B/P05.
 
 # 10. Operational checklist
 
 - exact package version установлен, bundled gateway соответствует release и переустановлен;
-- handshake подтверждает protocol 2, state schema 2 и beta.12 capabilities;
+- handshake подтверждает protocol 2, state schema 2 и beta.12.10 capabilities;
 - каждый mutation следует свежему `status -> next` и exact option contract;
+- Docker permission failure сначала классифицируется как sandbox boundary, а не как infra retry;
 - semantic unknowns и human gates не маскируются delegation;
 - Task chats создаёт coordinator, credentials остаются только в памяти;
 - dependencies, progress и review posture берутся из Core projections;

package/docs/pdf/sources/codex-workflow-v2-chat-only-guide-ru.md

@@ -1,13 +1,13 @@
 ---
 title: Codex Workflow V2: delegated chat-only guide
-subtitle: Актуальный beta.12 путь от нового Discovery до принятого Milestone без ручного CLI
+subtitle: Актуальный beta.12.10 путь от нового Discovery до принятого Milestone без ручного CLI
 part: Часть 2 из 3 | Практика
 document_version: 2.0
-date: 27 августа 2026
-subject: Практическое руководство по delegated Discovery и Milestone в Workflow V2 beta.12
+date: 31 августа 2026
+subject: Практическое руководство по delegated Discovery и Milestone в Workflow V2 beta.12.10
 ---
 
-# 1. Рабочая модель beta.12
+# 1. Рабочая модель beta.12.10
 
 Пользователь работает в одном Codex Project и формулирует продуктовый outcome. Coordinator выполняет
 CLI, создаёт отдельные Task/Reviewer chats и ведёт supervision loop. Workflow Core остаётся authority
@@ -40,7 +40,7 @@ Blocking unknown, scope change, grant issuance или unrecoverable integrity co
 # 2. Подготовка проекта перед новым Discovery
 
 1. Убедитесь, что checkout чистый и выбран правильный repository root.
-2. Установите beta.12 как точную devDependency после публикации release.
+2. Установите beta.12.10 как точную devDependency после публикации release.
 3. Обновите и переустановите bundled `codex-workflow-gateway` этого release.
 4. Проверьте, что declared и installed package versions равны.
 5. Запустите новый Coordinator chat, не fork старого Milestone conversation.
@@ -56,7 +56,7 @@ AGENTS.md
 -> doctor только как дополнительная диагностика
 ```
 
-Handshake beta.12 должен сообщать `packageVersion=2.0.0-beta.12`, `protocolVersion=2`,
+Handshake beta.12.10 должен сообщать `packageVersion=2.0.0-beta.12.10`, `protocolVersion=2`,
 `stateSchemaVersion=2`, dependency DAG, initial Plan transaction, mechanical feasibility,
 Milestone autonomy и structural replacement disabled capabilities.
 
@@ -72,6 +72,7 @@ Milestone autonomy и structural replacement disabled capabilities.
 | Complete initial Milestone Plan | Human `MAC-*` confirmation | Выдать bounded Milestone autonomy grant |
 | Task execution | C1 handoff/claim и Core routing | Не использует approval grant как writer credential |
 | Semantic change | Human scope-change gate | Outcome, success signal, checks, acceptance, discovery, base |
+| Audited pre-execution remediation | Core-derived, без нового Human gate | Только один upstream Task и одна dependency edge; semantic fields неизменны |
 
 ## 3.1. Опциональный bootstrap DGR для AUTO
 
@@ -116,7 +117,7 @@ delegate, scope, transitions и expiry. DGR передаётся только е
 ```text
 НОВЫЙ COORDINATOR CHAT
 
-Проведи новый Milestone через Codex Workflow V2 beta.12 в delegated режиме.
+Проведи новый Milestone через Codex Workflow V2 beta.12.10 в delegated режиме.
 Repository: <ABSOLUTE-REPOSITORY-ROOT>.
 Milestone ID: AUTO.
 Delegate actor: agent:milestone-coordinator.
@@ -242,6 +243,10 @@ Credential и approval grant решают разные задачи.
 4. Claim проверяет dependency binding и возвращает `writerLeaseReceipt`.
 5. `task run` принимает active writer credential согласно `next.writerTokenContract` и обновляет lease.
 6. `task step-complete`, review record и другие guarded mutations используют только рекламируемый option.
+7. После passed final review `task result-set` использует active writer token и освобождает lease до
+   `awaiting_final_acceptance`; Human gate не должен удерживать credential.
+8. После acceptance старый token не используется: fresh `next` рекламирует
+   `task writer-credential-replace`, затем разрешает merge или merge confirmation.
 
 Нельзя искать token в later payload fields, писать его в prompt/report/evidence или заменять redacted
 fingerprint. Потеря token не разрешает новый handoff либо lease acquisition вне fresh recovery route.
@@ -293,17 +298,66 @@ Task chat записывает его только при совпадении p
 | Состояние | Действие |
 |---|---|
 | First proven impossible npm check после legacy/late authorization | Только рекламируемый `task plan-integrity-recover` |
+| Downstream proof требует изменить completed predecessor | Только `task downstream-proof-recover`, затем новый Plan/risk audit/authorization в той же Task |
 | Failed guarded review | Та же Task: исправление и новый strict review без attempt hard stop |
 | Finding `route=fix` | Продолжить тот же Step; count остаётся диагностикой |
 | Finding `route=replan` с exact Plan conflict | `task plan-set`, меняются только implementation Steps |
 | `split-required` | Stop: `STRUCTURAL_REPLACEMENT_REQUIRED`, никаких replacement writes |
-| Explicit `stop-escalate` | Terminal user attention |
+| Старая версия + active downstream proof блокируют update | Только beta.12.6 exact dependency commits и advertised `update downstream-proof-dependency-recover` |
+| После downstream recovery beta.12.6 вернула отвергнутый Plan через Knowledge rebind | Только beta.12.7 replan update bridge, затем recovery и новый consolidated Plan той же Task |
+| Corrective Plan потерял authority ранее принятого Step commit | Только advertised beta.12.9 historical-Step preflight/recovery; без rebase/reset и без новой Task |
+| Exact beta.11 attempt-four `stop-escalate` | Только advertised prepare, затем отдельный Human-confirmed apply; исходный stop сохраняется |
+| Pre-execution `stop-escalate` + `auditedRemediation` | Discovery -> `milestone remediation-materialize` -> новый upstream Task -> merge -> replan исходной Task |
+| Любой другой explicit `stop-escalate` | Terminal user attention |
 | Stale dependency binding | Новый handoff/claim только по fresh `next` |
 | Review seal drift | Discard review и создать fresh packet |
 
 Plan-integrity recovery не редактирует Plan, package.json или worktree и не синтезирует второй failure.
 P04-A не переносит completed Steps и не rewires dependencies при split.
 
+Audited remediation beta.12.10 не является generic scope-change. Coordinator использует только exact
+route из fresh `next`: создаёт Discovery для доказанной отсутствующей upstream capability, доводит его
+до ready и вызывает `milestone remediation-materialize` с текущими revisions и exact
+`requiredPredecessorTaskIds`. Core не принимает новый Milestone Plan: сохраняет outcome/success signal,
+acceptance/checks и старые memberships, append-only добавляет один required Task и делает исходную Task
+зависимой от него. Новый Task получает приоритет. Его `task authorize` и `task accept` используют только
+`correctiveDerivedApproval.actor` с `humanApprovalRequired=false`; Worker, checks, commits и reviews
+остаются обычными. После merge fresh `next` возвращает исходную Task к `task plan-set`, свежему Risk
+Audit и как минимум следующему Step. Dirty checkout, lease/transaction, stale audit, started Task,
+неполный predecessor frontier или повторное использование audit означают hard stop.
+
+`task downstream-proof-recover` также не редактирует product files и не создаёт новую Task. Он сохраняет
+dirty worktree/HEAD, append-only фиксирует invalidated predecessor evidence, освобождает C1 и возвращает
+текущую Task к `task plan-set`. Если fresh `next` не рекламирует этот переход, вызывать его нельзя.
+
+Если этот переход доступен только после update, не stash/reset product work. Обновите active base в
+отдельном worktree и текущую Task branch двумя отдельными commits только `package.json`/lock, установите
+beta.12.6 и требуйте от fresh `next` `update downstream-proof-dependency-recover`. Read-only preflight
+должен вернуть `eligible=true`, exact `HEAD`/`HEAD^`, Task revision, пустые blockers и content-hash
+binding dirty set. Recover регистрирует только dependency HEAD; следующий fresh `next` должен вернуть
+обычный `task downstream-proof-recover`. Любой иной diff/history/dirty path/lease означает stop.
+
+Для beta.12.9 historical-Step blocker обновите base в отдельном worktree и Task branch двумя commits
+только package/lock. После install продолжайте лишь при advertised `update historical-step-dependency-recover`
+и preflight, связавшем HEAD/parent, passed+accepted historical SHA, Plan/Step, dirty hash и отсутствие lease.
+Recover сохраняет product bytes; затем обязательны `status -> next -> task step-complete`. Если package
+уже зарегистрирован, используйте advertised `task historical-step-provenance-preflight/recover`.
+
+Для exact beta.12.6 stranded-replan shape сначала нужен eligible read-only source preflight с exact
+revision/HEAD/dirty hash. Затем два beta.12.7 dependency-only commits и advertised dependency/replan
+recoveries. После Knowledge refresh `next` обязан остаться на `task plan-set`; новый единый Step должен
+владеть всем dirty set, а `task run` требует `downstreamProofCarryover.state=validated`.
+
+Ошибка Docker socket/CLI `EPERM`, `operation not permitted` или `permission denied` в sandbox не считается
+падением daemon и не расходует retry. Повторите exact read-only probe или Plan check один раз с sandbox
+escalation. Не перезапускайте Docker Desktop и не меняйте image без отдельного разрешения и подтверждённого
+escalated daemon failure.
+
+После stop override выполняйте только advertised context/dependency recoveries и каждый раз повторяйте
+`status -> next`; attempt 4 требует `stopOverrideContextRebind.state=validated`. Lost credential
+восстанавливает только advertised exact claimant route. Semantic drift, broken chain, необъяснённый HEAD
+или revision означают stop; продолжение разрешено только когда fresh `next` сам вернул `task run`.
+
 # 12. Milestone final acceptance
 
 После merge всех required Tasks Coordinator проверяет clean base HEAD и выполняет рекламируемую
@@ -321,7 +375,7 @@ Task/project DGR. `dependencyBinding` для standalone handoff равен null.
 
 # 14. Итоговый checklist пользователя
 
-- beta.12 exact package и новый bundled gateway установлены;
+- beta.12.10 exact package и новый bundled gateway установлены;
 - новый Coordinator chat не является fork старого Milestone;
 - bootstrap DGR, если нужен, выдан отдельным exact human confirmation;
 - Discovery не materialized при blocking unknowns;
@@ -330,5 +384,10 @@ Task/project DGR. `dependencyBinding` для standalone handoff равен null.
 - Coordinator сам создаёт и supervises Task/Reviewer chats;
 - credentials не появились в prompts, reports или files;
 - каждый transition пришёл из fresh `next`;
+- beta.11 stop override, если рекламировался, прошёл отдельные prepare и user-confirmed apply без journal rewrite;
+- downstream predecessor recovery, если рекламировался, сохранил worktree и завершился новым Plan authority;
+- active-proof package bridge, если понадобился, зарегистрировал только exact dependency HEAD перед recovery;
+- stranded-replan bridge, если понадобился, завершился новым Plan и полным Step checks/review, а не только сменой navigation;
+- historical-Step recovery, если рекламировался, сохранил exact accepted commit и довёл текущий Step до обычного `step-complete` без history rewrite;
 - split-required остановился без replacement mutations;
 - Milestone validation и final acceptance связаны с текущим clean base HEAD.