codex-workflow-v2 2.0.0-beta.13.1 → 2.0.0-beta.13.2

package/docs/beta13.2-signal-review-recovery.md

@@ -0,0 +1,38 @@
+# beta.13.2: pending-review recovery
+
+## Confirmed failure
+
+Signal M04 T01 completed the product changes for STEP-002 on beta.13.1, but its
+required independent Step review could not be prepared. The cumulative Task diff
+was 2,236,058 bytes, exceeding the default synchronous Git output buffer. The
+checkout remained clean and the completion commit remained recorded; review had
+not passed.
+
+After the writer lease expired, repository navigation preferred delegated
+Knowledge context refresh over the pending review's credential recovery. The
+context-refresh executor correctly rejected the still-in-progress Step. Thus
+navigation advertised an action its executor could not perform. Ordinary package
+update was also blocked by the in-progress Step.
+
+## Required recovery guarantees
+
+- Large Step and final Task review inputs are complete or fail explicitly; Git
+  errors have bounded diagnostics rather than dumping the input corpus.
+- Pending review and its exact writer credential recovery remain ahead of
+  Knowledge refresh. Refresh during a running Step stays forbidden.
+- Installation recovery validates the source version, exact Task/Plan/Step and
+  completion commit, clean checkout, recorded Git history, review journal, and
+  absence of active ownership or transactions.
+- Dependency transport preserves product bytes and the original reviewed commit.
+  Pending review never establishes passed-review provenance.
+- The original required review, delegated context refresh, Task acceptance and
+  merge remain mandatory after recovery. Grants are not broadened or renewed.
+
+## Release acceptance
+
+The package regression suite must cover oversized review inputs and the combined
+pending-review, expired-lease and stale-Knowledge state, including rejection of
+unsafe recovery candidates. Release validation also requires the ordinary package
+and external-review lifecycle gates. Actual Signal recovery must pass the blocked
+Step review and reach a subsequent executable lifecycle boundary; green fixture
+tests alone do not establish that the production Milestone has resumed.

package/docs/pdf/sources/codex-workflow-v2-architecture-ru.md

@@ -463,7 +463,7 @@ Restart Docker Desktop требует отдельного разрешения
 # 10. Operational checklist
 
 - exact package version установлен, bundled gateway соответствует release и переустановлен;
-- handshake подтверждает `packageVersion=2.0.0-beta.13.1`, protocol 2, state schema 2 и beta.13
+- handshake подтверждает `packageVersion=2.0.0-beta.13.2`, protocol 2, state schema 2 и beta.13
   capabilities;
 - routine observation начинается с компактного `status`; `status --full` запрашивается только для
   расследования, которому действительно нужна полная historical projection;

package/docs/pdf/sources/codex-workflow-v2-chat-only-guide-ru.md

@@ -57,7 +57,7 @@ AGENTS.md
 -> doctor только как дополнительная диагностика
 ```
 
-Handshake beta.13.1 должен сообщать `packageVersion=2.0.0-beta.13.1`, `protocolVersion=2`,
+Handshake beta.13.1 должен сообщать `packageVersion=2.0.0-beta.13.2`, `protocolVersion=2`,
 `stateSchemaVersion=2`, dependency DAG, initial Plan transaction, mechanical feasibility,
 Milestone autonomy, host-safe credential reference, failed-Step continuation transaction,
 cause-bound rolling refinement, structural production edge, compact status, reviewer runtime preflight,
@@ -482,7 +482,7 @@ Task/project DGR. `dependencyBinding` для standalone handoff равен null.
 # 14. Итоговый checklist пользователя
 
 - beta.13.1 exact package и новый bundled gateway установлены; handshake показывает
-  `packageVersion=2.0.0-beta.13.1`, protocol/state schema `2/2` и beta.13 capabilities;
+  `packageVersion=2.0.0-beta.13.2`, protocol/state schema `2/2` и beta.13 capabilities;
 - новый Coordinator chat не является fork старого Milestone;
 - bootstrap DGR, если нужен, выдан отдельным exact human confirmation;
 - Discovery не materialized при blocking unknowns;

package/docs/pdf/sources/codex-workflow-v2-technical-reference-ru.md

@@ -15,7 +15,7 @@ authority сами: mutating permission определяется runtime state
 
 | Параметр beta.13 | Значение |
 |---|---|
-| npm package | `codex-workflow-v2@2.0.0-beta.13.1` |
+| npm package | `codex-workflow-v2@2.0.0-beta.13.2` |
 | protocolVersion | 2 |
 | stateSchemaVersion | 2 |
 | lifecycle epoch | 2 |
@@ -767,7 +767,7 @@ dirty update.
 observed-route matrix/compact-status/reviewer-runtime tests, legacy compatibility regressions,
 `npm run test:signal-t10-check-support-e2e`, `npm run test:signal-remediation-e2e`,
 `npm run pack:check`, `npm run smoke:downstream`, `npm run plugin:check`, official plugin/skill validators,
-`npm run docs:pdf:check` и `npm run release:check` с exact `v2.0.0-beta.13.1` tag binding и append-only
+`npm run docs:pdf:check` и `npm run release:check` с exact `v2.0.0-beta.13.2` tag binding и append-only
 real-agent lifecycle log. Candidate проверяется из clean source checkout; missing built module не должен
 превращаться в stack trace, а обязан быть детерминированно собран или диагностирован release gate.
 

package/docs/pending-review-update.md

@@ -0,0 +1,15 @@
+# Updating while a strict Step review is pending
+
+This narrow bridge supports source `codex-workflow-v2@2.0.0-beta.13.1` and the exact executing target package. It preserves the original completion commit, pending review chain, Plan and Knowledge authorization. It does not mark a review passed or bypass the following Knowledge refresh.
+
+Use only a verified, exact target package runner with capability `pending-strict-review-dependency-bridge-v1`. The source preflight checks its package/build manifest and runtime file hashes. Never use a mutable version range or a global runner. The target runner exception before installation permits only the read-only source preflight below. Use the installed source runner for an explicitly returned stale lease repair.
+
+1. Run the external target runner: `update pending-review-source-preflight --repo <repo> --id <Task> --json`. Save the complete JSON response outside the repository. If `staleLeaseRepair` names exactly this Task, use the **installed source** `locks repair --id <Task>` and rerun source preflight. The lock manager rechecks expiry; a live or unrelated lease is not repairable through this bridge. Do not transport until the fresh result has `eligible=true` and no blockers.
+2. Retain the exact source receipt. Create one dependency transport commit on its `baseBranch` at `baseHead`, using a separate temporary worktree. Create one on `taskBranch` at `completionCommit`. Each commit must have one parent, change exactly `package.json` and `package-lock.json`, and change only the exact Workflow dependency entries from source to target. Preserve all product-owned manifest/lock fields independently on each branch. Do not merge, amend, reset, rebase, copy the base manifest over Task changes, or transport product work.
+3. Install the exact target package in the Task repository. Use its repository-local runner for all remaining commands. Run `status`, then `next`; it must advertise `update pending-review-dependency-recover`. Run `update pending-review-dependency-preflight --id <Task> --file <source-receipt.json>`. Require `eligible=true` and no blockers.
+4. Run `update pending-review-dependency-recover --id <Task> --expected-revision <source-task-revision> --file <source-receipt.json> --actor <coordinator> --reason <substantive-reason>`. Both plain preflight results and CLI `{ok:true,value:...}` receipts are accepted. The receipt is not authority: recovery reconstructs every source binding from canonical Task, artifacts, strict-review sidecars and Git parent commits. It checks clean checkout, all target version surfaces, exact base transport, and absence of any writer lease or pending transaction/Core operation again.
+5. Recovery atomically registers the Task dependency commit in existing dependency provenance and writes the hash-chained `pending-review-updates.jsonl` sidecar. Task schema 2 is unchanged. It increments the Task revision but preserves the original pending event, product completion SHA and Step evidence. Repeating recovery is rejected rather than creating duplicate authority.
+6. Run `status`, then `next`. Recover the exact advertised C1 writer credential if necessary. Generate a fresh `task step-review-packet`; use an independent external sealed reviewer and record the unchanged result with `task step-review-record`. The packet binds the original product commit and includes revalidated transport evidence; its repository seal binds the current dependency HEAD. Any later HEAD, base, Plan, evidence, packet, or seal change fails closed. Local nested review retains its original HEAD guard.
+7. Follow fresh `status` and `next` after review. Under the original eligible Milestone Autonomy Grant, execute the advertised `task context-refresh` for predeclared supporting-source additions and dependency manifest drift. Then continue to the next normal Step or final Task boundary. Do not substitute standalone approval or manually edit state.
+
+A failed preflight is a stop for this bridge. Repair only a specifically documented obstruction, then rerun the read-only assessment; never edit the receipt to hide a blocker. A pending or corrupt transaction must be recovered through its ordinary exact route before retrying.

package/docs/release.md

@@ -4,6 +4,17 @@ The npm package is `codex-workflow-v2` with public visibility. Consumers must pi
 an exact version. Stable compatibility covers the latest minor release of the current
 major only; older minors are unsupported unless a release note explicitly says otherwise.
 
+## beta.13.2 review recovery gate
+
+The patch preserves protocol 2 and canonical entity schema 2. In addition to the
+ordinary release gates, `release:check` executes the large-diff, pending-review
+update, supporting-source refresh and Task guard regressions. Acceptance requires
+complete external-sealed Step and Task packets above 2 MiB, explicit bounded
+failure above the Git output limit, exact credential recovery before Knowledge
+refresh, and a Signal-shaped delegated update followed by actual review,
+context refresh and the next ordinary Step. A source preflight alone is not
+recovery completion. See `beta13.2-signal-review-recovery.md`.
+
 ## Release gate
 
 Before tagging a release:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.13.1",
+  "version": "2.0.0-beta.13.2",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -56,6 +56,13 @@
   A provenance recovery recorded after the final context-refresh audit may explain exactly one
   additional Task revision only when it belongs to that verified Git chain. Any unexplained
   revision remains a `doctor` boundary.
+- Before a credential-consuming mutation, check the public `writerCredentialReference.expiresAt`
+  against the current time and its actor/action binding. Lease heartbeat or renewal does not
+  extend that reference's expiry. An expired, missing, consumed or unverifiable reference requires
+  the simultaneously advertised `next.writerCredentialRecovery` action with its exact Task,
+  revision and `requiredActor`, followed by fresh `status` and `next`; use the new reference.
+  If no recovery is advertised, stop before mutation. Never read or patch the vault, extend expiry
+  manually, or reuse the old reference. This check also applies after independent reviews and pauses.
 - `milestone progress --id <MS-ID>` is a read-only projection and the sole source for Coordinator
   progress tables. It preserves cancelled/replacement Tasks as distinct membership rows.
 - `scripts/chat-registry.mjs` atomically allocates project-monotonic `#NNN`, builds all six title

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -278,22 +278,32 @@ because the sandboxed call returned a permission error; those actions require th
 authorization and evidence.
 
 When `next` includes `writerTokenContract`, treat it as an exact first-call precondition. Retain
-the active writer lease from the first-field `writerLeaseReceipt` returned by `task run` and pass it using the advertised `option` for that
-transition. The token is sensitive: never print, summarize, persist, or substitute a redacted
-fingerprint. Stop before mutation if the active lease is unavailable. This input contract is
-independent from `gitMutationPolicy`; satisfy both when both are present.
-
-On successful `task handoff-prepare`, consume the first-field `credentialHandoff` before reading
-the Task/event/bundle payload. Retain its one-time token only in working memory and use it exactly
-once with the declared `action` and `option` for the declared `targetActor`. Successful `task claim`
-returns a first-field `writerLeaseReceipt`; retain that lease and pass it to claimed `task run` when
-the fresh `next.writerTokenContract` requires it. Successful `task run` returns the refreshed
-`writerLeaseReceipt`; retain it only until Core releases that lease.
-Never search later payload fields for either credential and never copy credentials into evidence.
+the `writerCredentialReference` returned by `task run`, `task claim`, or
+`task writer-credential-replace`, including its public `credentialRef`, actor, allowed actions and
+`expiresAt`. Pass the reference using the advertised `--writer-credential-ref` option. The secret
+stays in the local vault: never read, print, copy, or edit vault records or substitute a redacted
+token. This input contract is independent from `gitMutationPolicy`; satisfy both when present.
+
+Before every credential-consuming mutation, especially after an independent review or a pause,
+compare the held reference's `expiresAt` with the current time and verify its actor/action binding.
+A live or renewed lease does not extend an existing reference's expiry; `reuse-reference` is not
+permission to reuse an expired reference. If the reference is expired, missing, consumed, or its
+validity cannot be established, use only the simultaneously advertised
+`next.writerCredentialRecovery` action with its exact Task, revision and `requiredActor` before
+attempting the blocked mutation. Follow successful replacement with `status` then `next`, retain
+the newly returned reference and expiry, and discard the prior reference. If recovery is not
+advertised, stop before mutation. Never extend expiry manually or retry with the old reference.
+
+Successful `task handoff-prepare` returns a one-time `claimCredentialReference`; use its
+`credentialRef` with the declared `--claim-credential-ref` option for `task claim` and the bound
+actor. Successful claim consumes that reference. A renewed claim/run may return
+`writerCredential.disposition=renewed` without a new reference; the held reference must still
+satisfy its own expiry and binding checks. Never search later payload fields for raw tokens and
+never copy credentials into evidence.
 
 When a passed final Task review routes to `task result-set`, pass the active writer credential and,
 for claimed C1 posture, the exact claimant as `--actor`. A successful `result-set` consumes that
-execution lease before entering `awaiting_final_acceptance`; never reuse the old token and never
+execution lease before entering `awaiting_final_acceptance`; never reuse the old reference and never
 leave or manufacture a lease while waiting for the Human decision. After `task accept`, follow fresh
 `next`: local merge or external merge confirmation normally advertises
 `task writer-credential-replace`, which acquires a new bounded lease for the exact recovery actor.
@@ -571,6 +581,19 @@ When `next` returns a derived C1 Worker or corrective Auditor actor, use that ex
 asking the user to name one. Derivation removes a routing pause; handoff claim, writer lease,
 strict review, and auditor-independence checks remain mandatory.
 
+The beta.13.2 pending strict-review update exception is documented in
+`docs/pending-review-update.md` in the exact package. An exact external target runner may run
+only `update pending-review-source-preflight` against the known beta.13.1 source. Require its
+verified runtime build, exact Task/revision/Plan/HEAD/pending binding and no blockers. If it
+returns an exact stale Task lease repair, run that `locks repair` with the installed source and
+repeat preflight. Preserve the eligible receipt outside the checkout; transport only the two
+bound dependency commits on base and Task, then install the target locally. Fresh local `next`
+must advertise `update pending-review-dependency-recover`; run its matching read-only preflight
+with `--file <source-receipt>` before recovery. Recovery does not approve Knowledge or review.
+Use the original pending product SHA through the newly sealed external packet and record,
+then follow fresh credential/context-refresh/ordinary lifecycle actions. Never treat this as
+permission for other external-runner mutations, product transport, or manual state repair.
+
 Before an npm package update, run the project-local `update preflight` and stop unless it
 returns `safe=true` with a clean checkout, no running Step, and no active writer lease.