codex-workflow-v2 2.0.0-beta.13.3 → 2.0.0-beta.13.5

package/docs/pdf/sources/codex-workflow-v2-architecture-ru.md

@@ -463,7 +463,7 @@ Restart Docker Desktop требует отдельного разрешения
 # 10. Operational checklist
 
 - exact package version установлен, bundled gateway соответствует release и переустановлен;
-- handshake подтверждает `packageVersion=2.0.0-beta.13.3`, protocol 2, state schema 2 и beta.13
+- handshake подтверждает `packageVersion=2.0.0-beta.13.5`, protocol 2, state schema 2 и beta.13
   capabilities;
 - routine observation начинается с компактного `status`; `status --full` запрашивается только для
   расследования, которому действительно нужна полная historical projection;

package/docs/pdf/sources/codex-workflow-v2-chat-only-guide-ru.md

@@ -57,7 +57,7 @@ AGENTS.md
 -> doctor только как дополнительная диагностика
 ```
 
-Handshake beta.13.1 должен сообщать `packageVersion=2.0.0-beta.13.3`, `protocolVersion=2`,
+Handshake beta.13.5 должен сообщать `packageVersion=2.0.0-beta.13.5`, `protocolVersion=2`,
 `stateSchemaVersion=2`, dependency DAG, initial Plan transaction, mechanical feasibility,
 Milestone autonomy, host-safe credential reference, failed-Step continuation transaction,
 cause-bound rolling refinement, structural production edge, compact status, reviewer runtime preflight,
@@ -482,7 +482,7 @@ Task/project DGR. `dependencyBinding` для standalone handoff равен null.
 # 14. Итоговый checklist пользователя
 
 - beta.13.1 exact package и новый bundled gateway установлены; handshake показывает
-  `packageVersion=2.0.0-beta.13.3`, protocol/state schema `2/2` и beta.13 capabilities;
+  `packageVersion=2.0.0-beta.13.5`, protocol/state schema `2/2` и beta.13 capabilities;
 - новый Coordinator chat не является fork старого Milestone;
 - bootstrap DGR, если нужен, выдан отдельным exact human confirmation;
 - Discovery не materialized при blocking unknowns;

package/docs/pdf/sources/codex-workflow-v2-technical-reference-ru.md

@@ -15,7 +15,7 @@ authority сами: mutating permission определяется runtime state
 
 | Параметр beta.13 | Значение |
 |---|---|
-| npm package | `codex-workflow-v2@2.0.0-beta.13.3` |
+| npm package | `codex-workflow-v2@2.0.0-beta.13.5` |
 | protocolVersion | 2 |
 | stateSchemaVersion | 2 |
 | lifecycle epoch | 2 |
@@ -767,7 +767,7 @@ dirty update.
 observed-route matrix/compact-status/reviewer-runtime tests, legacy compatibility regressions,
 `npm run test:signal-t10-check-support-e2e`, `npm run test:signal-remediation-e2e`,
 `npm run pack:check`, `npm run smoke:downstream`, `npm run plugin:check`, official plugin/skill validators,
-`npm run docs:pdf:check` и `npm run release:check` с exact `v2.0.0-beta.13.3` tag binding и append-only
+`npm run docs:pdf:check` и `npm run release:check` с exact `v2.0.0-beta.13.5` tag binding и append-only
 real-agent lifecycle log. Candidate проверяется из clean source checkout; missing built module не должен
 превращаться в stack trace, а обязан быть детерминированно собран или диагностирован release gate.
 

package/docs/release.md

@@ -4,6 +4,49 @@ The npm package is `codex-workflow-v2` with public visibility. Consumers must pi
 an exact version. Stable compatibility covers the latest minor release of the current
 major only; older minors are unsupported unless a release note explicitly says otherwise.
 
+## beta.13.5 preventive Plan correction before execution
+
+A newly discovered implementation Plan defect can require changing unfinished scope
+before its next Step runs. The preventive route withdraws the current execution
+authorization under an independent blocking Plan Risk Audit, then requires a corrected
+Plan, fresh independent audit and ordinary execution authorization. It must preserve
+the same Task, completed Step definitions and evidence, requirements, acceptance,
+review history and grants. It must not manufacture a failed run to unlock planning.
+
+Initial eligibility is deliberately limited to a coherent, clean, idle `ready` Task
+with no C1 ownership or writer lease. Stale bindings, existing ownership, incomplete
+review, unexpected Git history and damaged state must fail closed. Regression gates
+must prove authority withdrawal and actual same-Task continuation, plus rejection of
+attempts to change the objective, discard completed evidence or weaken guarded scope.
+
+Replacement Plan publication commits Task state, the current and immutable Plan artifacts,
+and its independent audit atomically. Pending correction blocks C1 handoff and dependency
+transport until the corrected Plan can be authorized. Proof bindings retain each Step,
+failure mode and evidence association; revised proof prose requires an independent audit
+with an explicit rationale. Core does not determine whether natural-language proof claims
+are semantically stronger.
+
+External sealed-review CLI help specifies the complete envelope, including its nested
+review. Lifecycle validation admits one bounded expired-credential recovery between a
+review-input syntax refusal and retry, with unchanged sealed evidence and fresh sequential
+status/next bindings; unrelated or unbound mutations remain invalid.
+
+## beta.13.4 candidate: continuation after accepted corrective Plan
+
+This correction is included in beta.13.5; beta.13.4 was not published separately.
+
+The beta.13.3 first-conflict recovery stopped too early: after a replacement Plan
+was accepted and authorized, navigation still applied the old Plan's conflict to
+the now-planned Step. Release acceptance for this correction must exercise the
+complete same-Task sequence through fresh Plan Risk Audit, execution authorization,
+the existing Worker claim, actual Step execution, and another failed review.
+Reaching `task plan-set` alone is not sufficient evidence.
+
+An accepted semantic replacement must be distinguished from a Knowledge-only
+rebind using verified Plan artifacts and audit/review bindings. Historical failures
+and their global ordinals remain append-only. A missing or damaged artifact must
+not silently acknowledge a conflict, and a context refresh must not reopen execution.
+
 ## beta.13.3 explicit Plan conflict recovery
 
 A first independently recorded reviewer `route=replan` with a validated Plan conflict

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.13.3",
+  "version": "2.0.0-beta.13.5",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -92,6 +92,29 @@ active writer token when the C1 contract requires it. The recovery records only
 `task run` merely to manufacture the second failure, and never invoke this recovery for a generic
 test failure, a writable manifest, or unconfined changes.
 
+When fresh `next` includes `preExecutionReplanOption.state=eligible`, an independent Plan auditor
+may stop a `ready` Task before its next Step because the current implementation Plan is obstructed.
+Use only `task preexecution-replan` with the exact advertised Task revision, Brief hash, Plan hash,
+current Plan Risk Audit event hash, and HEAD. The audit file must be a genuine independent
+`stop-escalate` replacement audit: its planner remains the original planner, its auditor is the
+transition actor, and it retains current guarded categories, review requirements, failure modes,
+evidence commands, and proof bindings while recording the obstruction. This transition requires a
+clean checkout with no Step in progress, C1 posture, or writer lease. It appends immutable audit and
+provenance records, supersedes only current execution authorization, preserves completed Step
+authority and existing delegation scope, and does not require a new approval. After success, run
+sequential `status` then `next`; Core must advertise ordinary `task plan-set`, not audited-remediation
+topology. Submit a semantically changed Plan with the exact Task objective, requirements, and
+acceptance, preserve completed Steps and prior safety boundaries, attach a fresh Plan Risk Audit,
+then obtain fresh execution authorization. Never append an approved audit to the unchanged Plan,
+rebind context around the marker, invent a failure/corrective cause, or invoke the command when the
+option is absent or blocked.
+
+For this route, Core treats each `(Step ID, failureMode, evidence)` tuple as the immutable proof
+binding. It does not claim to understand whether revised `counterexample` or `expectedResult` prose
+is semantically stronger. Changing that prose therefore requires an independent
+`approved-with-rationale` audit, a changed substantive summary, and an explicit rationale; the
+earlier audit remains immutable history for human review.
+
 When fresh `next` advertises `task downstream-proof-recover`, the active proof Step has produced
 uncommitted files inside its own `allowedWrites` and has also exposed required changes owned by one
 or more completed transitive predecessor Steps. Do not invoke `task step-complete`: its scope is
@@ -586,7 +609,13 @@ When `next.strictStepReview.recommendedMode` is `external-sealed`, do not launch
 reviewer from inside a Codex App sandbox. Run the advertised read-only `task step-review-packet`,
 create a separate user-visible reviewer chat for that exact packet, and require one closed
 `ReviewInput` JSON result bound to its reviewed commit. The reviewer must not modify repository or
-Workflow state. Then run only the advertised `task step-review-record` with the unchanged packet
+Workflow state. The `--file` passed to `task step-review-record` must be the full
+`ExternalStrictStepReviewInput` envelope: top-level `protocol`, `packetHash`,
+`repositorySealHash`, `reviewerThreadId`, and `reviewMode` (`ordinary` or `security`), plus the
+nested `review` object containing `status`, `reviewer`, `summary`, and `findings`. Copy both hashes
+and the mode from the packet; do not flatten `review`, and do not pass `--review-mode` to the record
+command because it reads the mode from the JSON file. Run `task step-review-record --help` for a
+complete minimal example. Then run only the advertised `task step-review-record` with the unchanged packet
 and repository-seal hashes, the separate reviewer thread ID, the lifecycle actor from `next`, and
 the active writer token when required. Never author the independent review in the Worker or
 Delivery Coordinator chat, never alter the packet, and never treat an unverified local reviewer
@@ -597,7 +626,11 @@ When `next.strictTaskReview.recommendedMode` is `external-sealed`, apply the sam
 the final submitted-Task review. Run the advertised read-only `task review-packet`, send the exact
 packet to a separate user-visible Independent Reviewer chat, and accept only a closed `ReviewInput`
 bound to the unchanged packet and repository-seal hashes. Record it only through the advertised
-`task review-sealed-record`, using the lifecycle actor from `next` and the active writer token when
+`task review-sealed-record`. Its `--file` must be the analogous full
+`ExternalStrictTaskReviewInput` envelope using protocol
+`codex-workflow-external-strict-task-review-v1`, the packet and repository-seal hashes,
+`reviewerThreadId`, top-level `reviewMode`, and nested `review`; its `--help` contains a minimal
+example. Use the lifecycle actor from `next` and the active writer token when
 required. Do not call `task review-launch` from inside a Codex App sandbox, do not use the Worker or
 Delivery Coordinator as reviewer, and discard the result if a fresh packet changes either hash.
 

package/schemas/preexecution-replan-event.schema.json

@@ -0,0 +1,45 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://codex-workflow.local/schemas/preexecution-replan-event.schema.json",
+  "title": "Codex Workflow V2 Pre-execution Replan Event",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "eventId", "taskId", "sourceTaskRevision", "resultTaskRevision", "briefHash",
+    "sourcePlanHash", "knowledgeMapRevision", "knowledgeMapHash",
+    "sourcePlanRiskAuditEventId", "sourcePlanRiskAuditEventHash",
+    "obstructionPlanRiskAuditEventId", "obstructionPlanRiskAuditEventHash",
+    "sourceExecutionAuthorizationHash", "sourceHeadCommit", "completedStepIds",
+    "completedStepsHash", "actor", "reason", "recordedAt", "previousEventHash", "eventHash"
+  ],
+  "properties": {
+    "eventId": { "type": "string", "pattern": "^PER-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "taskId": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "sourceTaskRevision": { "type": "integer", "minimum": 1 },
+    "resultTaskRevision": { "type": "integer", "minimum": 2 },
+    "briefHash": { "$ref": "#/$defs/hash64" },
+    "sourcePlanHash": { "$ref": "#/$defs/hash64" },
+    "knowledgeMapRevision": { "type": "integer", "minimum": 1 },
+    "knowledgeMapHash": { "$ref": "#/$defs/hash64" },
+    "sourcePlanRiskAuditEventId": { "type": "string", "pattern": "^PRA-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "sourcePlanRiskAuditEventHash": { "$ref": "#/$defs/hash64" },
+    "obstructionPlanRiskAuditEventId": { "type": "string", "pattern": "^PRA-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "obstructionPlanRiskAuditEventHash": { "$ref": "#/$defs/hash64" },
+    "sourceExecutionAuthorizationHash": { "$ref": "#/$defs/hash64" },
+    "sourceHeadCommit": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+    "completedStepIds": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string", "pattern": "^STEP-[0-9]{3}(?:-[A-Z0-9-]+)?$" }
+    },
+    "completedStepsHash": { "$ref": "#/$defs/hash64" },
+    "actor": { "type": "string", "minLength": 1 },
+    "reason": { "type": "string", "minLength": 1, "maxLength": 2048 },
+    "recordedAt": { "type": "string", "format": "date-time" },
+    "previousEventHash": { "anyOf": [{ "$ref": "#/$defs/hash64" }, { "type": "null" }] },
+    "eventHash": { "$ref": "#/$defs/hash64" }
+  },
+  "$defs": {
+    "hash64": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+  }
+}