codex-workflow-v2 2.0.0-beta.13.5 → 2.0.0-beta.13.6

package/docs/release.md

@@ -4,6 +4,35 @@ The npm package is `codex-workflow-v2` with public visibility. Consumers must pi
 an exact version. Stable compatibility covers the latest minor release of the current
 major only; older minors are unsupported unless a release note explicitly says otherwise.
 
+## beta.13.6 candidate: preserve work across root-cause replan
+
+A repeated mechanical failure can legitimately yield the same Task to a replacement
+Plan while preserving uncommitted implementation. beta.13.5 authorizes that Plan but
+then rejects its planned Step because the checkout is dirty. Reaching planning or
+reauthorization therefore does not prove recovery.
+
+Acceptance for this candidate must exercise the complete repeated mechanical failure,
+automatic C1 yield, semantic replacement Plan, independent PRA, authorization, and
+same-Worker execution sequence with the original dirty bytes. The carryover assessment
+must bind the source remediation cycle, verified historical and current Plans, current
+PRA and authorization, completed evidence, HEAD, file set and content hash. Every carried
+path must already belong to the replacement Step and remain outside forbidden scope;
+carryover never expands scope or forgives unrelated work.
+
+Navigation and execution must use the same assessment. Changed bytes, paths, HEAD,
+Plan artifacts, audit/authorization evidence or ambiguous source history must fail
+closed before execution. Tests must continue beyond successful start through checks,
+Core commit and strict review, and reject each material binding mismatch.
+
+The stranded-source update must additionally prove a read-only compatibility preflight,
+no writer lease or pending Core operation, exact coherent source/target versions,
+dependency-only Task and Milestone-base commits, registration of the Task dependency
+commit after verification of the base transport, and unchanged product bytes. It must preserve the original Task and Worker and must not
+rely on manual product commits, stash/reset, installed-code edits or state-file edits.
+
+All ordinary release gates below apply. The user's one-time beta.13.5 CI-based release
+exception is consumed and is not evidence or an exception for this candidate.
+
 ## beta.13.5 preventive Plan correction before execution
 
 A newly discovered implementation Plan defect can require changing unfinished scope

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.13.5",
+  "version": "2.0.0-beta.13.6",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -115,6 +115,43 @@ is semantically stronger. Changing that prose therefore requires an independent
 `approved-with-rationale` audit, a changed substantive summary, and an explicit rationale; the
 earlier audit remains immutable history for human review.
 
+When the exact beta.13.6 package reports validated root-cause corrective-replan dirty
+carryover, the retained work belongs to a previously failed execution of the same Task.
+Use the fresh advertised `task run` only with the current writer credential and exact
+Task/Step bindings. Core must verify the repeated mechanical cause, historical Plan,
+replacement Plan and independent PRA, authorization, completed evidence, HEAD, dirty
+paths and content hash. Every retained path must already be allowed by the new Step
+and remain outside forbidden scope. A changed binding or blocked assessment is a hard
+stop; never clean, stash, reset, manually commit, or edit state to make it eligible.
+
+The beta.13.6 corrective-carryover update compatibility profile permits its exact
+external runner to execute only the read-only
+`update corrective-carryover-preflight --id <TASK-ID>` against a repository coherently
+pinned to beta.13.5. This is an explicit compatibility inspection, not permission to
+run ordinary transitions with an external or unpublished package. An active writer
+lease blocks transport. Wait for natural expiry. The target compatibility preflight
+may then return only an exact source-package stale-lease repair, after validating the
+sole expired Task lease, its original claimant, Task/Plan/PRA/authorization/HEAD and
+dirty-work bindings. This narrowly scoped preflight action is the authority for that
+source-package repair; do not describe it as an action advertised by the old source
+`next`. An active lease, another lease or any other blocker forbids the repair and
+transport. Never force-release a live lease. Preserve the original C1 claimant and
+hash-bound ownership event, log the preflight and exact repair, then run sequential
+source `status` and `next` and repeat the target preflight.
+
+After repair, require a fresh preflight with `eligible=true`, no blockers, and exact
+Task revision, source HEAD, replacement Plan/PRA/authorization, dirty paths/hash and
+original C1 ownership. Transport only the exact target dependency in `package.json`
+and `package-lock.json`: one commit on the Milestone base in a separate worktree and
+one at Task HEAD, leaving every product byte unchanged. Install the repository-local
+target, then follow fresh navigation through the existing
+`update dependency-provenance-recover` only when it advertises the matching carryover
+binding. Use current bounded credential recovery for the original Worker, and obtain
+fresh validated carryover before `task run`. Unknown history, wider commits, version
+misalignment, changed product bytes, different ownership, pending operations or missing
+bindings stop the update. This profile creates no scope or approval authority and does
+not authorize editing the installed package or Workflow state files.
+
 When fresh `next` advertises `task downstream-proof-recover`, the active proof Step has produced
 uncommitted files inside its own `allowedWrites` and has also exposed required changes owned by one
 or more completed transitive predecessor Steps. Do not invoke `task step-complete`: its scope is

package/schemas/task.schema.json

@@ -215,6 +215,61 @@
               }
             },
             "additionalProperties": false
+          },
+          "rootCauseReplan": {
+            "type": "object",
+            "required": [
+              "kind", "taskId", "sourceTaskRevision", "stepId", "sourcePlanHash",
+              "sourcePlanSemanticHash", "replacementPlanHash", "replacementPlanSemanticHash",
+              "sourceHeadCommit", "remediationEvents", "terminalRemediationEventId",
+              "terminalRemediationEventHash", "terminalExecutionTaskRevision",
+              "repeatedCauseFingerprint", "correctiveYieldEventId", "correctiveYieldEventHash",
+              "dirtyFiles", "dirtyWorktreeHash", "replacementPlanRiskAuditEventId",
+              "replacementPlanRiskAuditEventHash", "executionAuthorizationHash",
+              "executionAuthorizationHead", "completedStepsHash", "c1ClaimEventId",
+              "c1ClaimEventHash", "claimant", "compatibilityHash"
+            ],
+            "properties": {
+              "kind": { "const": "root-cause-corrective-replan-dirty-carryover" },
+              "taskId": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
+              "sourceTaskRevision": { "type": "integer", "minimum": 1 },
+              "stepId": { "type": "string", "pattern": "^STEP-[A-Z0-9][A-Z0-9-]{2,63}$" },
+              "sourcePlanHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "sourcePlanSemanticHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "replacementPlanHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "replacementPlanSemanticHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "sourceHeadCommit": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+              "remediationEvents": {
+                "type": "array", "minItems": 1,
+                "items": {
+                  "type": "object", "required": ["eventId", "eventHash", "attemptOrdinal"],
+                  "properties": {
+                    "eventId": { "type": "string", "pattern": "^RME-[0-9A-HJKMNP-TV-Z]{26}$" },
+                    "eventHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+                    "attemptOrdinal": { "type": "integer", "minimum": 1 }
+                  },
+                  "additionalProperties": false
+                }
+              },
+              "terminalRemediationEventId": { "type": "string", "pattern": "^RME-[0-9A-HJKMNP-TV-Z]{26}$" },
+              "terminalRemediationEventHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "terminalExecutionTaskRevision": { "type": "integer", "minimum": 1 },
+              "repeatedCauseFingerprint": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "correctiveYieldEventId": { "type": "string", "pattern": "^HOF-[a-f0-9]{64}$" },
+              "correctiveYieldEventHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "dirtyFiles": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+              "dirtyWorktreeHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "replacementPlanRiskAuditEventId": { "type": "string", "pattern": "^PRA-[0-9A-HJKMNP-TV-Z]{26}$" },
+              "replacementPlanRiskAuditEventHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "executionAuthorizationHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "executionAuthorizationHead": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+              "completedStepsHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "c1ClaimEventId": { "type": "string", "pattern": "^HOF-[0-9A-HJKMNP-TV-Z]{26}$" },
+              "c1ClaimEventHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "claimant": { "type": "string", "minLength": 1 },
+              "compatibilityHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+            },
+            "additionalProperties": false
           }
         },
         "additionalProperties": false