codex-workflow-v2 2.0.0-beta.13.14 → 2.0.0-beta.13.16

package/docs/pdf/sources/codex-workflow-v2-architecture-ru.md

@@ -463,7 +463,7 @@ Restart Docker Desktop требует отдельного разрешения
 # 10. Operational checklist
 
 - exact package version установлен, bundled gateway соответствует release и переустановлен;
-- handshake подтверждает `packageVersion=2.0.0-beta.13.14`, protocol 2, state schema 2 и beta.13
+- handshake подтверждает `packageVersion=2.0.0-beta.13.16`, protocol 2, state schema 2 и beta.13
   capabilities;
 - routine observation начинается с компактного `status`; `status --full` запрашивается только для
   расследования, которому действительно нужна полная historical projection;

package/docs/pdf/sources/codex-workflow-v2-chat-only-guide-ru.md

@@ -57,7 +57,7 @@ AGENTS.md
 -> doctor только как дополнительная диагностика
 ```
 
-Handshake beta.13.14 должен сообщать `packageVersion=2.0.0-beta.13.14`, `protocolVersion=2`,
+Handshake beta.13.15 должен сообщать `packageVersion=2.0.0-beta.13.16`, `protocolVersion=2`,
 `stateSchemaVersion=2`, dependency DAG, initial Plan transaction, mechanical feasibility,
 Milestone autonomy, host-safe credential reference, failed-Step continuation transaction,
 cause-bound rolling refinement, structural production edge, compact status, reviewer runtime preflight,
@@ -480,7 +480,7 @@ Task/project DGR. `dependencyBinding` для standalone handoff равен null.
 # 14. Итоговый checklist пользователя
 
 - beta.13.10 exact package и новый bundled gateway установлены; handshake показывает
-  `packageVersion=2.0.0-beta.13.14`, protocol/state schema `2/2` и beta.13 capabilities;
+  `packageVersion=2.0.0-beta.13.16`, protocol/state schema `2/2` и beta.13 capabilities;
 - новый Coordinator chat не является fork старого Milestone;
 - bootstrap DGR, если нужен, выдан отдельным exact human confirmation;
 - Discovery не materialized при blocking unknowns;

package/docs/pdf/sources/codex-workflow-v2-technical-reference-ru.md

@@ -15,7 +15,7 @@ authority сами: mutating permission определяется runtime state
 
 | Параметр beta.13 | Значение |
 |---|---|
-| npm package | `codex-workflow-v2@2.0.0-beta.13.14` |
+| npm package | `codex-workflow-v2@2.0.0-beta.13.16` |
 | protocolVersion | 2 |
 | stateSchemaVersion | 2 |
 | lifecycle epoch | 2 |
@@ -775,7 +775,7 @@ dirty update.
 observed-route matrix/compact-status/reviewer-runtime tests, legacy compatibility regressions,
 `npm run test:signal-t10-check-support-e2e`, `npm run test:signal-remediation-e2e`,
 `npm run pack:check`, `npm run smoke:downstream`, `npm run plugin:check`, official plugin/skill validators,
-`npm run docs:pdf:check` и `npm run release:check` с exact `v2.0.0-beta.13.14` tag binding и append-only
+`npm run docs:pdf:check` и `npm run release:check` с exact `v2.0.0-beta.13.16` tag binding и append-only
 real-agent lifecycle log. Candidate проверяется из clean source checkout; missing built module не должен
 превращаться в stack trace, а обязан быть детерминированно собран или диагностирован release gate.
 

package/docs/release.md

@@ -1,5 +1,54 @@
 # Release Policy
 
+## beta.13.15: retained failed checks and consistent corrective navigation
+
+Root-cause dirty carryover now requires one exact terminal corrective-yield witness and assesses
+only that terminal failed-check head. Older failed attempts can no longer turn a later review or
+corrective continuation into an unwitnessed `doctor` route. The regression includes the stopped
+Signal topology: multiple historical failures, no terminal corrective-yield witness, and ordinary
+writer recovery remaining visible.
+
+Core now emits a declarative `workflowBlockerRoute` only for a confirmed navigation dead end. The
+descriptor grants no effects. The originating Coordinator confirms the dead end and uses the
+packaged gateway to idempotently dispatch an exact-version patch chat in `codex-workflow-v2`.
+That patch chat owns diagnosis, implementation, verification, and publication; the Coordinator
+owns callback handling, the downstream update, and resuming the stopped product chat. Chat policy
+v2 selects only Mini, Luna, or Terra with low/medium effort; Sol, Astra, and high effort are
+excluded from automatic creation.
+
+The gateway now distinguishes approved Knowledge Map sources from codebase-memory indexes. Agents
+must route code discovery through the MCP project whose normalized root exactly matches the fresh
+Core graph request. The intent table separates product source, the exact installed workflow package,
+and a workflow-development checkout; stale/missing indexes are refreshed and direct code search
+requires a recorded MCP fallback. Workflow source support uses full indexing so plugin scripts and
+tests are not silently excluded.
+
+Captured check results are persisted in the existing failed-Step transaction with
+separate capture/check hashes and exact readback. Rollback covers the new artifact;
+legacy failures remain explicitly uncaptured. Private output can contain process
+secrets. The opt-in excerpt is best-effort redacted and never used as authority or
+published automatically in status. This release does not alter v1 cause semantics.
+
+Optional independent corrective decisions accept a clean checkout or an exact current
+failed-checkpoint file set and byte hash, bound to the verified remediation event,
+Task HEAD/history and effective allowed/forbidden scope. Navigation and executor share
+that boundary. C1 actor/credential, transaction, independent review and human corrective
+Plan gates remain mandatory. This is not scope-amendment authority or a generic dirty
+update transport. Required regressions cover distinct mechanical failures, dirty C1
+wrong/missing credentials, changed bytes, outside paths and altered immutable history.
+
+Previously unreleased dispatch changes distinguish sealed review roles from product
+writers without granting repository writes. Explicit zero-write reviews must avoid
+runtime-preflight APIs that create temporary caches. The shared carryover phase
+predicate retains planned-Step safety checks and avoids masking failed successors;
+both successful and failed replacement successor regressions remain required.
+
+The existing source13.6 consumed-carryover profile remains source-pinned; its exact
+current target and transcript validator additionally recognize beta13.15. No historical
+receipt or source-version predicate is rewritten. Full candidate CI, ordinary release
+checks and the documented real App boundary remain required before publication.
+
+
 ## beta.13.14: keep carryover navigation in its execution phase
 
 A retained root-cause carryover belongs to the start of a planned replacement

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.13.14",
+  "version": "2.0.0-beta.13.16",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",
@@ -28,6 +28,7 @@
   },
   "files": [
     "dist",
+    "src",
     "schemas",
     "templates",
     "roles",

package/plugins/codex-workflow-gateway/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-gateway",
-  "version": "0.1.0+codex.20260830183000",
+  "version": "0.1.0+codex.20260909130631",
   "description": "Thin personal Codex gateway for exact project-local Codex Workflow V2 packages and codebase-memory-mcp.",
   "author": {
     "name": "Codex Workflow Maintainers"

package/plugins/codex-workflow-gateway/references/chat-dispatch.md

@@ -31,7 +31,8 @@ those using real App/source evidence before using the new dispatch flow.
        "highRisk": false,
        "rationale": "New multi-file implementation plan with established requirements.",
        "availableModels": [
-         {"id": "gpt-5.6-sol", "reasoningEfforts": ["low", "medium", "high", "xhigh", "max", "ultra"]}
+         {"id": "gpt-5.6-terra", "reasoningEfforts": ["low", "medium", "high", "xhigh", "max", "ultra"]},
+         {"id": "gpt-5.6-luna", "reasoningEfforts": ["low", "medium", "high", "xhigh", "max"]}
        ]
      }
    }
@@ -98,12 +99,12 @@ cost/latency preference, not measured savings or guaranteed account availability
 | Work | Preferred model | App thinking | Compatible fallback |
 | --- | --- | --- | --- |
 | Routine mechanical transitions, formatting, retrieval | gpt-5.4-mini | low | gpt-5.6-luna / low |
-| Coordinator supervision; small implementation | gpt-5.6-luna | medium | gpt-5.6-terra / medium |
-| Standard implementation | gpt-5.6-terra | medium | gpt-5.6-sol / medium |
-| Task planning | gpt-5.6-sol | medium | gpt-6-astra / medium |
-| Routine Step review | gpt-5.6-terra | medium | gpt-5.6-sol / medium |
-| Standard Step review, final review, plan/corrective audit | gpt-5.6-sol | high | gpt-6-astra / high |
-| Complex work or high risk, any role | gpt-6-astra | high | gpt-5.6-sol / high |
+| Coordinator supervision; small implementation | gpt-5.6-luna | low | gpt-5.4-mini / medium |
+| Standard implementation | gpt-5.6-terra | low | gpt-5.6-luna / medium |
+| Task planning | gpt-5.6-terra | low | gpt-5.6-luna / medium |
+| Routine Step review | gpt-5.6-luna | low | gpt-5.4-mini / medium |
+| Standard Step review, final review, plan/corrective audit | gpt-5.6-terra | low | gpt-5.6-luna / medium |
+| Complex work or high risk, any role | gpt-5.6-terra | medium | gpt-5.6-luna / medium |
 
 `routine` means a small, well-specified change or mechanical action with an existing check;
 `standard` is ordinary multi-file work; `complex` covers new architecture, unresolved concurrency,
@@ -111,7 +112,9 @@ recovery/provenance or distributed state. Mark `highRisk` for authorization, sec
 paths, data-loss exposure or irreversible migrations. The coordinator records the concrete
 rationale; classification is a human/agent judgment, not an automatic risk detector. Unknown
 complexity is not routine. Review/audit role floors override a falsely mechanical phase. No
-automatic xhigh/max/ultra, and no escalation merely because a review failed or a tool timed out.
+automatic high/xhigh/max/ultra, and no escalation merely because a review failed or a tool timed out.
+The policy never selects `gpt-5.6-sol` or `gpt-6-astra`. A caller cannot bypass that ceiling by
+including either model or `high` effort in the destination catalog.
 
 The policy chooses only a listed supported pair. If neither preferred nor fallback pair is
 available, stop selection rather than silently inheriting the coordinator or lowering the review
@@ -121,8 +124,9 @@ https://developers.openai.com/api/docs/guides/latest-model
 
 For a phase change in an existing bound chat, call `model-select` with its same `threadId` and
 fresh `modelRequest`; copy the returned `followUpArgs` into `send_message_to_thread` with the
-closed follow-up prompt. For example, planning uses Sol/medium, implementation Terra/medium,
-then mechanical lifecycle work Mini/low. Do not create another Task just to switch model.
+closed follow-up prompt. For example, planning uses Terra/low, a complex implementation uses
+Terra/medium, then mechanical lifecycle work uses Mini/low. Do not create another Task just to
+switch model.
 Keep the previous selection unless the phase/risk/scope changes materially. The journal records
 requested settings; tool acceptance/runtime readback, when available, is required to claim the
 actual model used. A model change never changes role, scope, credentials or approval authority.
@@ -134,12 +138,37 @@ Choose local only for an explicit user request to execute in the saved checkout.
 child checkout, not an absolute path copied from the parent's prompt, is the write destination.
 `dispatch-observe` records it and refuses silent movement of a bound child.
 
-Before the first write, and after any branch/cwd change, use read-only `dispatch-context-check`
+For `task` and `coordinator` product/repository writes, before the first write and after any
+branch/cwd change, use read-only `dispatch-context-check`
 with a fresh App observation, `writeRoot`, and `expectedBranch` from the current Core Task.
 Require `matched=true`, then refresh Core next and writer authority. Mismatch means reconcile the
 same Worker context; it never permits another create, an indirect write or an automatic handoff.
 A matched context does not authorize external operations. See packaged `docs/change-model.md`.
 
+The explicit `step-review`, `final-review`, `corrective-audit`, and `plan-audit` roles instead
+receive a read-only review boundary. They verify the canonical repository and immutable commit,
+packet/seal or audit-request bindings, including before returning their result. A detached or
+differently branched App checkout does not require Task-branch reconciliation for reading that
+evidence. Reviewers must not modify product files, Git history, Workflow state, or invoke lifecycle
+mutations. A requested result artifact may be saved only outside all repository checkouts and under
+actual filesystem permissions. The prompt does not grant access. Model phase and prompt prose do
+not confer this role; unknown registry types remain rejected. Existing writer context checks and
+Core authority guards are unchanged.
+
+“Read-only” Workflow diagnostics mean no product or Core transitions, not necessarily zero
+filesystem writes. For example, `next` can invoke `prepareReviewerRuntimePreflight`, which creates
+an external runtime-cache directory and writes/removes `.write-probe`. In a normal review, inspect
+actual permissions before invoking diagnostics that use this cache; cache access grants no product
+write authority.
+
+An explicit user instruction prohibiting all writes takes precedence. For that review, reuse
+current, unchanged bound receipts and the prior successful handshake from the same session;
+inspect immutable files directly and avoid runtime-preflight APIs or other diagnostics with write
+side effects. Do not rerun `next` solely to obtain a fresh receipt under a zero-write instruction.
+If the available bindings cannot establish the required current evidence without writing, report
+the precise unverified boundary instead of claiming a write-free verification. Saving a report is
+also a write and requires explicit permission when all writes are prohibited.
+
 ### Existing legacy bindings
 
 `dispatch-context-check` also accepts an already bound legacy entry with no dispatch marker.

package/plugins/codex-workflow-gateway/references/codebase-memory-routing.md

@@ -0,0 +1,55 @@
+# Codebase-memory routing
+
+Knowledge Map and `codebase-memory-mcp` answer different questions. Knowledge Map records approved
+project knowledge sources and authority. The MCP graph indexes code structure for discovery,
+call/dependency tracing, and impact analysis. An approved Knowledge Map entry does not prove that
+an MCP project exists or is current.
+
+## Select by exact source root
+
+Obtain a fresh Core `graph status` request before choosing an MCP project. Match the request's
+absolute `sourceRoot` against `list_projects[].root_path` after path normalization. Names, basename
+similarity, an older repository generation, and a Knowledge Map path are not valid matches. Zero
+matches requires `index_repository` for that exact source root. More than one exact match is an
+integrity blocker until the duplicate is resolved. Call `index_status` on the selected project and
+refresh it when Core reports the binding missing/stale or its indexed HEAD/package manifest differs.
+
+This gateway governs workflow work only. It must not create, refresh, bind, or require the active
+product repository's graph. Product-code discovery remains under that repository's existing policy.
+
+Use this intent table:
+
+| Work being investigated | Active repository | Core graph kind | Expected source root |
+| --- | --- | --- | --- |
+| Installed workflow behavior blocking a product | product repository | `workflow` | exact installed `node_modules/codex-workflow-v2` package root returned by Core |
+| Workflow source implementation or release | `codex-workflow-v2` checkout/worktree | source checkout graph | that exact workflow source Git root |
+
+Never select Signal's product graph to explain package internals. When the requested work concerns
+product code, leave workflow graph routing and follow the product repository's own instructions.
+
+For workflow implementation/support, request `full` indexing so published TypeScript sources,
+plugin scripts, roles, references, and schemas are present. The npm package ships `src` specifically
+for this stable graph. Index an installed package only when its exact package root and version have
+no ready MCP project. Reuse that ready project for every later chat on the same immutable package
+version; do not refresh it per chat or per gateway read. A workflow source checkout is refreshed
+only when its Git HEAD changes. Bind installed-package evidence through Core before relying on it as
+current workflow evidence. Do not create or use a second workflow-cache source copy.
+
+## Discovery policy
+
+Use `get_architecture`, `search_graph`, `trace_path`, `query_graph`, and `get_code_snippet` for code
+discovery. Search the graph first and fetch only the selected symbols. Do not repeatedly scan or
+read whole source trees after an exact ready graph is available.
+
+Direct filesystem search is a recorded fallback, allowed only when:
+
+- MCP is unavailable after its normal retry boundary;
+- the exact source root cannot be indexed;
+- Core reports a stale/mismatched graph and refresh cannot complete; or
+- the target is a newly created, generated, ignored, or exact non-code artifact absent from the
+  graph.
+
+Record the failed MCP operation, selected source root, and fallback reason. A convenience preference
+or an overly broad graph result is not a fallback reason: narrow the graph query first. Git status,
+exact package resolution, and reading a specifically named authority artifact remain filesystem
+operations rather than code discovery.

package/plugins/codex-workflow-gateway/scripts/chat-dispatch.mjs

@@ -64,7 +64,13 @@ export function dispatchAction(action, entry, input = {}) {
     const selection = selectChatModel(entry.type, input.modelRequest);
     const id = randomUUID();
     const marker = `[workflow-dispatch:${id}:${hash(prompt)}]`;
-    const dispatchedPrompt = `${marker}\n${prompt}\nExecution boundary: use the actual child checkout returned by App readback. Before any write, reconcile it with the exact Task branch and run dispatch-context-check. A repository path in this packet is identity context, not authorization to write outside that checkout.`;
+    // Only the registry's explicit review/audit roles receive a read-only boundary.
+    // A model phase or packet prose cannot turn a product Worker into a reviewer.
+    const reviewRole = ['step-review', 'final-review', 'corrective-audit', 'plan-audit'].includes(entry.type);
+    const boundary = reviewRole
+      ? 'Review boundary: use the exact canonical repository and immutable commit, packet/seal or audit-request bindings supplied for this independent review. Verify those bindings before reading evidence and before returning the result; stop if they change. The App checkout may be detached or on another branch: do not switch it or require Task-branch dispatch-context-check for read-only inspection. Do not modify product files, Git history, or Workflow state, and do not invoke lifecycle mutations. Save the review result only to an explicitly requested artifact path outside all repository checkouts, under actual filesystem permissions; this instruction grants no filesystem access. A repository path identifies read evidence, never write authority.'
+      : 'Execution boundary: use the actual child checkout returned by App readback. Before any product or repository write, reconcile it with the exact Task branch and run dispatch-context-check. A repository path in this packet is identity context, not authorization to write outside that checkout.';
+    const dispatchedPrompt = `${marker}\n${prompt}\n${boundary}`;
     entry.dispatch = {
       version: 1, id, state: 'creating', appProjectId, hostId, repositoryRoot, gitDir, executionMode,
       promptPath, promptHash: hash(prompt), dispatchedPromptHash: hash(dispatchedPrompt), marker,

package/plugins/codex-workflow-gateway/scripts/chat-model-policy.mjs

@@ -1,15 +1,17 @@
 // Relative cost/latency policy, not a price list or an availability oracle.
-export const MODEL_POLICY_VERSION = 'chat-model-policy-v1';
+export const MODEL_POLICY_VERSION = 'chat-model-policy-v2';
 const PROFILES = {
   mechanical: [['gpt-5.4-mini', 'low'], ['gpt-5.6-luna', 'low']],
-  scoped: [['gpt-5.6-luna', 'medium'], ['gpt-5.6-terra', 'medium']],
-  implementation: [['gpt-5.6-terra', 'medium'], ['gpt-5.6-sol', 'medium']],
-  planning: [['gpt-5.6-sol', 'medium'], ['gpt-6-astra', 'medium']],
-  review: [['gpt-5.6-sol', 'high'], ['gpt-6-astra', 'high']],
-  'scoped-review': [['gpt-5.6-terra', 'medium'], ['gpt-5.6-sol', 'medium']],
-  complex: [['gpt-6-astra', 'high'], ['gpt-5.6-sol', 'high']],
+  scoped: [['gpt-5.6-luna', 'low'], ['gpt-5.4-mini', 'medium']],
+  implementation: [['gpt-5.6-terra', 'low'], ['gpt-5.6-luna', 'medium']],
+  planning: [['gpt-5.6-terra', 'low'], ['gpt-5.6-luna', 'medium']],
+  review: [['gpt-5.6-terra', 'low'], ['gpt-5.6-luna', 'medium']],
+  'scoped-review': [['gpt-5.6-luna', 'low'], ['gpt-5.4-mini', 'medium']],
+  complex: [['gpt-5.6-terra', 'medium'], ['gpt-5.6-luna', 'medium']],
 };
-const TYPES = ['coordinator', 'task', 'step-review', 'final-review', 'corrective-audit', 'plan-audit'];
+const TYPES = [
+  'coordinator', 'task', 'step-review', 'final-review', 'corrective-audit', 'plan-audit', 'workflow-blocker',
+];
 export function selectChatModel(type, request) {
   if (!TYPES.includes(type)) throw new Error('Unknown chat type.');
   if (!request || !['routine', 'standard', 'complex'].includes(request.complexity)

package/plugins/codex-workflow-gateway/scripts/chat-registry.mjs

@@ -14,7 +14,9 @@ import process from 'node:process';
 import { randomUUID } from 'node:crypto';
 import { dispatchAction, dispatchInput } from './chat-dispatch.mjs';
 
-const TYPES = new Set(['coordinator', 'task', 'step-review', 'final-review', 'corrective-audit', 'plan-audit']);
+const TYPES = new Set([
+  'coordinator', 'task', 'step-review', 'final-review', 'corrective-audit', 'plan-audit', 'workflow-blocker',
+]);
 const LOCK_STALE_MS = 30_000;
 const LOCK_WAIT_MS = 2_000;
 
@@ -26,9 +28,12 @@ export function allocateChat(options) {
     const sequence = registry.nextSequence;
     const reservationId = randomUUID();
     const candidates = buildTitleCandidates({ ...options, sequence });
+    const milestoneOrdinal = options.type === 'workflow-blocker'
+      ? null
+      : requiredOrdinal(options.milestoneOrdinal, 'M');
     const existing = registry.entries.find(entry => entry.status !== 'abandoned'
       && entry.type === options.type && entry.entityId === options.entityId
-      && entry.milestoneOrdinal === requiredOrdinal(options.milestoneOrdinal, 'M')
+      && entry.milestoneOrdinal === milestoneOrdinal
       && entry.taskOrdinal === optionalOrdinal(options.taskOrdinal, 'T')
       && entry.stepOrdinal === optionalOrdinal(options.stepOrdinal, 'S')
       && (['task', 'coordinator'].includes(options.type)
@@ -38,7 +43,7 @@ export function allocateChat(options) {
       sequence,
       reservationId,
       type: options.type,
-      milestoneOrdinal: requiredOrdinal(options.milestoneOrdinal, 'M'),
+      milestoneOrdinal,
       taskOrdinal: optionalOrdinal(options.taskOrdinal, 'T'),
       stepOrdinal: optionalOrdinal(options.stepOrdinal, 'S'),
       entityId: requiredText(options.entityId, 'entityId'),
@@ -191,6 +196,15 @@ export function showRegistry(options) {
 }
 
 export function buildTitleCandidates(options) {
+  if (options.type === 'workflow-blocker') {
+    const entityId = requiredText(options.entityId, 'entityId');
+    const semantic = compactWhitespace(requiredText(options.semanticTitle, 'semanticTitle'));
+    validateTypeBindings(options.type, null, null, entityId);
+    if (!/^\d+\.\d+\.\d+-beta(?:\.\d+)+$/u.test(semantic)) {
+      throw new Error('workflow-blocker title must be the exact target beta patch version.');
+    }
+    return [semantic];
+  }
   const prefix = `#${String(positiveInteger(options.sequence, 'sequence')).padStart(3, '0')}`;
   const milestone = requiredOrdinal(options.milestoneOrdinal, 'M');
   const task = optionalOrdinal(options.taskOrdinal, 'T');
@@ -331,11 +345,15 @@ function validateProjectId(projectId) {
 
 function validateTypeBindings(type, taskOrdinal, stepOrdinal, entityId) {
   if (!TYPES.has(type)) throw new Error(`Unsupported chat type: ${type}`);
-  if (type !== 'coordinator' && !taskOrdinal) throw new Error(`${type} requires a Task membership ordinal.`);
+  if (!['coordinator', 'workflow-blocker'].includes(type) && !taskOrdinal) {
+    throw new Error(`${type} requires a Task membership ordinal.`);
+  }
   if ((type === 'step-review' || type === 'corrective-audit') && !stepOrdinal) {
     throw new Error(`${type} requires a Step membership ordinal.`);
   }
-  const validEntity = type === 'coordinator'
+  const validEntity = type === 'workflow-blocker'
+    ? /^[a-f0-9]{64}$/u.test(entityId)
+    : type === 'coordinator'
     ? entityId === 'DISCOVERY' || /^MS-[0-9A-HJKMNP-TV-Z]{26}$/.test(entityId)
     : /^TASK-[0-9A-HJKMNP-TV-Z]{26}$/.test(entityId);
   if (!validEntity) throw new Error(`${type} requires its full authoritative entity ID.`);

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -15,6 +15,13 @@ repository.
 Never use a global workflow package, a mutable npm range, `latest`, V1 overlay
 files, or MCP ADR storage as a fallback.
 
+Read this skill once per chat/package revision; do not reopen it merely to recover details already
+captured in the current task context. For code discovery, first read
+`../../references/codebase-memory-routing.md` and follow its exact-source-root gate. Knowledge Map
+approval is not an MCP index. Use `codebase-memory-mcp` before filesystem code search, select the
+graph from fresh Core `graph status`, by exact `sourceRoot`, and record the documented fallback
+reason whenever direct code search is unavoidable.
+
 ## Resolve The Active Package
 
 1. Resolve the active Git root with `git rev-parse --show-toplevel`.
@@ -496,8 +503,8 @@ Task details, other Task Plans, unrelated repository analysis, reasoning traces,
 credentials. The new Task chat may read repository files and its own Workflow Task/Brief/Plan; it
 must not rely on the parent conversation as evidence or authority.
 
-Every automatically created Coordinator, Task, Step Review, Final Review, Corrective Audit, and
-Plan Audit chat must use the project registry/title builder at
+Every automatically created Coordinator, Task, Step Review, Final Review, Corrective Audit, Plan
+Audit, and Workflow Blocker chat must use the project registry/title builder at
 `../../scripts/chat-registry.mjs`. Before `create_thread`, call `allocate` with exact `projectId`,
 chat type, Milestone/Task/Step membership ordinals, semantic title, authoritative entity ID, and
 review attempt. Use returned `requestedTitle` verbatim. Never derive its prefix from
@@ -529,6 +536,7 @@ The builder owns these compact title families; callers must not hand-compose var
 #NNN · M<NN>/T<NN> · Final Review A<N> · <Task title> · <TASK-ID>
 #NNN · M<NN>/T<NN>/S<NN> · Corrective A<N> · <Step title> · <TASK-ID>
 #NNN · M<NN>/T<NN> · Plan Audit A<N> · <Task title> · <TASK-ID>
+<exact next beta patch version>                                      # Workflow Blocker
 ```
 
 When the Milestone ID is known, allocate and bind the coordinator chat before dispatch. During
@@ -618,20 +626,62 @@ transcripts. No chat may wait indefinitely for a child after ending its own turn
 cross-restart background orchestration requires a separate app wakeup/automation facility and is
 not implied by this skill.
 
+
+## Workflow Blocker Incident Route
+
+Core only describes this route. It does not create a chat, authorize repository changes, run a
+release, publish a package, update a downstream project, or message another chat. The originating
+Coordinator owns incident initiation and verifies that the new chat received its closed instructions.
+The patch chat in `codex-workflow-v2` owns diagnosis, implementation, verification, publication,
+and the callback to the Coordinator.
+
+Treat `next.workflowBlockerRoute.state=gateway-confirmation-required` as a candidate incident, not
+as an executable Core transition. Refresh `status` and `next` sequentially without mutation and
+continue this route only when the same `blockerId` remains, no executable Core action, repair
+transition, or Human gate exists, and the responsible product chat is not progressing the blocked
+action. If an ordinary route appears, use it and do not create a patch chat.
+
+For a confirmed incident, the Coordinator must:
+
+1. Resolve the exact `codex-workflow-v2` App project with `list_projects`; never hardcode an App
+   project ID or create the patch chat in the product project.
+2. Build the closed incident packet from the descriptor's `requiredPacketFields`, fresh status and
+   next hashes, bounded repository state, and the expected product continuation. Exclude bearer
+   credentials, confirmation codes, transcripts, and reasoning traces.
+3. Allocate `type=workflow-blocker` with `entityId=<blockerId>` and
+   `semanticTitle=<dispatch.title>`. This type has no Milestone/Task membership and its sole title
+   candidate is the exact beta version. Run the normal `dispatch-begin -> create_thread ->
+   dispatch-result -> dispatch-observe -> readback -> bind` sequence. Use the policy-selected
+   explicit model and effort; never inherit the Coordinator settings.
+4. Confirm once with `read_thread` that the created patch chat received the exact closed incident
+   packet and has started it. Do not poll, wait on, or supervise this chat. The patch chat must run
+   every remaining step autonomously and use `send_message_to_thread` to deliver the closed callback
+   to the originating Coordinator after the exact patch is published.
+5. When that callback arrives, verify the published artifact, follow the advertised downstream update route in the product
+   repository, rerun fresh `status -> next`, and continue the existing responsible product chat
+   with only that route and changed bindings. Do not replace the Coord or product chat solely
+   because a workflow incident occurred.
+
+The incident descriptor grants no Core mutation or publication authority. A callback claim does
+not replace package readback or fresh product navigation.
+
 ## Product Or Workflow Graph Refresh
 
-1. Run `graph refresh-request --kind product|workflow --mode moderate`.
-2. Use `codebase-memory-mcp` to list projects and match the request source root.
-3. Stop for user selection when more than one project remains plausible.
-4. Check `index_status`; call `index_repository` with the request source root,
-   mode, and `persistence: false` when missing or stale.
-5. Build evidence exactly as specified in `../../references/protocol.md`.
-6. Pipe `{ "request": ..., "evidence": ... }` to `graph bind --stdin`, passing
+Follow `../../references/codebase-memory-routing.md`. In particular, select only the MCP project
+whose normalized root exactly equals the fresh Core request's `sourceRoot`; never choose by name,
+repository generation, or Knowledge Map membership.
+
+1. Run `graph refresh-request --kind product|workflow --mode moderate|full` for the intended code.
+2. Use `codebase-memory-mcp` to list projects and exact-match the request source root.
+3. Check `index_status`; call `index_repository` with the request source root,
+   requested mode, and `persistence: false` when missing or stale.
+4. Build evidence exactly as specified in `../../references/protocol.md`.
+5. Pipe `{ "request": ..., "evidence": ... }` to `graph bind --stdin`, passing
    the current binding revision when one exists.
 
-When MCP is unavailable, run `graph fallback --kind ... --reason ...`. Continue
-with Git, direct file reads, and configured tests unless another requirement
-independently blocks the workflow.
+When MCP is unavailable after its normal retry boundary, run
+`graph fallback --kind ... --reason ...`. Only then use direct filesystem code discovery, while Git,
+exact package resolution, named authority artifacts, and configured tests retain their normal tools.
 
 ## Role Use
 
@@ -792,6 +842,22 @@ returns `safe=true` with a clean checkout, no running Step, and no active writer
 
 ## Explain an implementation change before escalating
 
+For registry `step-review`, `final-review`, `corrective-audit`, and `plan-audit` roles, inspect
+only the canonical repository and immutable commit/packet/seal or audit-request evidence. Verify
+those bindings before reading and returning the result. A detached or different App branch does
+not require Task-branch reconciliation for read-only review. Do not change product files, Git
+history or Workflow state, or invoke lifecycle mutations. Save an explicitly requested report only
+outside repository checkouts under actual filesystem permissions; the dispatch prompt grants no
+access. This review boundary does not apply to a Worker merely using a review-phase model.
+
+Read-only Workflow diagnostics are not necessarily write-free: `next` can prepare an external
+reviewer runtime cache and write/remove `.write-probe`. Check actual cache permissions for normal
+review diagnostics. When the user explicitly prohibits every write, reuse current bound receipts
+and the prior successful same-session handshake, read immutable evidence directly, and avoid
+runtime-preflight APIs. Do not rerun `next` or save an artifact under that prohibition; report any
+unverified current binding. The user's zero-write instruction controls. See
+`../../references/chat-dispatch.md` for the distinction.
+
 Before a product write by a tracked Worker, run the packaged registry `dispatch-context-check`
 using fresh App readback, the actual write root and the branch from the current Task. Resolve
 checkout mismatch without duplicate dispatch or silent canonical-checkout writes. A matching