codex-workflow-v2 2.0.0-beta.13.5 → 2.0.0-beta.13.7

package/dist/src/workflow.js

@@ -3,7 +3,7 @@ import { appendFileSync, existsSync, lstatSync, readFileSync, readdirSync } from
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { PROTOCOL_VERSION, STATE_SCHEMA_VERSION, } from './contracts.js';
-import { inspectBoundedWorkflowDependencyCommit, inspectDependencyKnowledgeRefresh, inspectDependencyProvenanceRecovery, } from './dependency-provenance.js';
+import { inspectBoundedWorkflowDependencyCommit, inspectDependencyKnowledgeRefresh, inspectDependencyProvenanceRecovery, workflowDependencyVersionAt, } from './dependency-provenance.js';
 import { inspectHistoricalStepProvenanceRecovery, omittedStepEvidenceCommits, } from './historical-step-provenance.js';
 import { renderBrief, renderPlan, renderResult } from './artifacts.js';
 import { assertDelegationCanAuthorize, hashDelegationPolicy, prepareDelegationGrantGate, } from './delegation.js';
@@ -15,11 +15,12 @@ import { WorkflowError } from './errors.js';
 import { withObservedRouteMetadata } from './observed-routes.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
-import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, prepareTaskCorrectiveYield, readTaskC1Posture, } from './alpha6/handoff.js';
+import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, prepareTaskCorrectiveYield, readTaskC1Posture, readTaskHandoffEvents, } from './alpha6/handoff.js';
 import { assessDownstreamProofCarryover, assessDownstreamProofReplanRecovery, assessDownstreamProofRecovery, downstreamProofInvalidationSidecar, downstreamProofReplanRecoverySidecar, prepareDownstreamProofInvalidation, prepareDownstreamProofReplanRecovery, readDownstreamProofInvalidations, readDownstreamProofReplanRecoveries, hashDirtyWorktree, } from './alpha6/downstream-proof.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, buildCandidatePlanRiskAuditEvent, buildPlanRiskAuditEvent, readCurrentPlanRiskAudit, readPlanRiskAuditEvents, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
 import { hashCompletedSteps, hashExecutionAuthorization, preparePreExecutionReplanEvent, preExecutionReplanSidecar, readCurrentPreExecutionReplan, } from './alpha6/preexecution-replan.js';
+import { assessRootCauseReplanDirtyCarryover, matchesTerminalCorrectiveYield, } from './alpha6/root-cause-replan-carryover.js';
 import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationModeRecovery, appendStopEscalateOverride, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, effectiveStepAllowedWrites, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, deriveRollingCauseDecision, deriveCurrentCauseDecisionForTask, prepareRemediationEvent, prepareStopEscalateOverride, stopEscalateOverrideDecisionEventIds, } from './alpha6/remediation.js';
 import { assessPlanIntegrityRecovery, defaultPlanIntegrityRecoveryActor, } from './alpha6/plan-integrity.js';
 import { mechanicalCauseBindings, normalizeMechanicalFailures, } from './alpha6/remediation-cause.js';
@@ -2756,11 +2757,15 @@ export class WorkflowService {
         const planIntegrityDirtyCarryover = step.status === 'planned' && dirty.length > 0
             ? this.assessPostRebindCheckSupportDirtyCarryover(context.identity.repositoryRoot, task, stepId)
             : null;
+        const rootCauseReplanDirtyCarryover = step.status === 'planned' && dirty.length > 0
+            ? this.assessCurrentRootCauseReplanDirtyCarryover(context.identity.repositoryRoot, task, stepId)
+            : null;
         if (step.status === 'planned'
             && dirty.length > 0
             && !resumesCorrectiveReplan
             && !downstreamProofCarryover?.eligible
-            && !planIntegrityDirtyCarryover?.eligible) {
+            && !planIntegrityDirtyCarryover?.eligible
+            && !rootCauseReplanDirtyCarryover?.eligible) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} must start from a clean checkout.`, {
                 changedFiles: dirty,
                 ...(downstreamProofCarryover?.applicable
@@ -2769,6 +2774,9 @@ export class WorkflowService {
                 ...(planIntegrityDirtyCarryover?.applicable
                     ? { planIntegrityDirtyCarryoverBlockers: planIntegrityDirtyCarryover.blockers }
                     : {}),
+                ...(rootCauseReplanDirtyCarryover?.applicable
+                    ? { rootCauseReplanDirtyCarryoverBlockers: rootCauseReplanDirtyCarryover.blockers }
+                    : {}),
             });
         }
         const dirtyOutsideStep = dirty.filter((file) => !pathAllowed(file, allowedWrites));
@@ -4174,7 +4182,299 @@ export class WorkflowService {
         const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
         if (!task)
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        return this.inspectDependencyProvenanceCandidate(snapshot, task);
+        const candidate = inspectBoundedWorkflowDependencyCommit(snapshot.identity.repositoryRoot, headCommit(snapshot.identity.repositoryRoot));
+        const carryover = this.assessCurrentRootCauseReplanDirtyCarryover(snapshot.identity.repositoryRoot, task, undefined, candidate?.parentCommitSha);
+        const preflight = this.inspectDependencyProvenanceCandidate(snapshot, task, null, null, null, null, carryover.eligible ? carryover.compatibility : null);
+        if (!preflight.rootCauseReplan)
+            return preflight;
+        let baseTip = null;
+        let baseDependency = null;
+        try {
+            baseTip = runGit(snapshot.identity.repositoryRoot, ['rev-parse', task.baseBranch]);
+            baseDependency = inspectBoundedWorkflowDependencyCommit(snapshot.identity.repositoryRoot, baseTip);
+        }
+        catch {
+            // The blocker below keeps a missing or unreadable base reference fail closed.
+        }
+        const bridgeBlockers = [
+            ...(preflight.dependencyCommits.length !== 1
+                ? ['Corrective carryover recovery requires exactly one Task dependency-only commit.'] : []),
+            ...(preflight.parentCommitSha !== preflight.rootCauseReplan.sourceHeadCommit
+                ? ['Corrective carryover dependency parent must equal the bound source HEAD.'] : []),
+            ...(preflight.parentCommitSha
+                && workflowDependencyVersionAt(snapshot.identity.repositoryRoot, preflight.parentCommitSha) !== '2.0.0-beta.13.6'
+                ? ['Corrective carryover dependency parent must declare exact source beta.13.6.'] : []),
+            ...(preflight.dependencyCommits.at(-1)?.packageVersion !== PACKAGE_VERSION
+                ? [`Corrective carryover dependency commit must declare exact target ${PACKAGE_VERSION}.`] : []),
+            ...(!baseDependency
+                || baseDependency.commitSha !== baseTip
+                || baseDependency.packageVersion !== PACKAGE_VERSION
+                || workflowDependencyVersionAt(snapshot.identity.repositoryRoot, baseDependency.parentCommitSha)
+                    !== workflowDependencyVersionAt(snapshot.identity.repositoryRoot, preflight.parentCommitSha ?? '')
+                ? ['Corrective carryover Milestone-base tip must be one dependency-only commit with the same exact source and runtime target.'] : []),
+        ];
+        return bridgeBlockers.length === 0
+            ? preflight
+            : {
+                ...preflight,
+                eligible: false,
+                action: null,
+                commitSha: null,
+                parentCommitSha: null,
+                blockers: [...new Set([...preflight.blockers, ...bridgeBlockers])],
+            };
+    }
+    correctiveCarryoverUpdatePreflight(repository, taskId, candidate = null) {
+        const snapshot = this.observationSnapshot(repository);
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
+        const sourceVersion = '2.0.0-beta.13.6';
+        const targetVersion = '2.0.0-beta.13.7';
+        const sourceSurfaces = {
+            declared: versions.declared,
+            locked: versions.locked,
+            installed: versions.installed,
+            currentBranch: versions.currentBranch,
+            baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
+        };
+        const c1 = readTaskC1Posture(this.store, task);
+        if (c1.state !== 'claimed') {
+            return this.consumedCarryoverSourceRecoveryPreflight(snapshot, task, sourceSurfaces, candidate);
+        }
+        const assessment = this.assessCurrentRootCauseReplanDirtyCarryover(snapshot.identity.repositoryRoot, task);
+        const now = this.now().getTime();
+        const activeLeases = snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) > now);
+        const staleLeases = snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) <= now);
+        const transactionCount = snapshot.observation.pendingProjectTransactions.length
+            + snapshot.observation.pendingMilestoneTransactions.length
+            + snapshot.observation.pendingTaskTransactions.length;
+        const authorizationBlockers = [];
+        if (assessment.eligible) {
+            try {
+                this.assertExecutionAuthorizationFresh(task, snapshot.identity.repositoryRoot);
+            }
+            catch (error) {
+                authorizationBlockers.push(error instanceof Error ? error.message : String(error));
+            }
+        }
+        const baseBlockers = [
+            ...assessment.blockers,
+            ...authorizationBlockers,
+            ...(PACKAGE_VERSION !== targetVersion ? [`Runner must be the exact ${targetVersion} compatibility target.`] : []),
+            ...Object.entries(sourceSurfaces)
+                .filter(([, version]) => version !== sourceVersion)
+                .map(([surface]) => `${surface} Workflow version must equal the exact ${sourceVersion} source.`),
+            ...observationPreflightBlockers(snapshot.observation),
+            ...(transactionCount > 0 ? ['No pending Workflow transaction may exist.'] : []),
+            ...(snapshot.observation.corruptTaskTransactions.length > 0 ? ['No corrupt Task transaction may exist.'] : []),
+            ...(snapshot.observation.coreTaskOperations.length > 0 ? ['No Core Task operation may exist.'] : []),
+            ...(c1.state !== 'claimed' || assessment.compatibility?.claimant !== c1.claimant
+                ? ['The exact original Worker C1 claim must remain current.'] : []),
+            ...(activeLeases.length > 0 ? ['No live writer lease may exist during corrective carryover transport.'] : []),
+            ...(staleLeases.some((lease) => lease.entityId !== task.id
+                || c1.state !== 'claimed' || lease.owner !== c1.claimant
+                || createHash('sha256').update(lease.token).digest('hex') !== c1.writerLeaseTokenHash)
+                ? ['No unrelated or differently owned stale writer lease may exist.'] : []),
+            ...(staleLeases.length > 1 ? ['At most the exact corrective Task stale lease may exist.'] : []),
+        ];
+        const repairableStale = baseBlockers.length === 0 && staleLeases.length === 1
+            ? staleLeases[0]
+            : null;
+        const blockers = [
+            ...baseBlockers,
+            ...(repairableStale
+                ? ['Repair the exact expired claimant lease with source locks repair, then run status, next, and this preflight again.']
+                : []),
+        ];
+        const compatibility = assessment.compatibility;
+        return {
+            readOnly: true,
+            eligible: Boolean(assessment.eligible && compatibility && blockers.length === 0 && staleLeases.length === 0),
+            action: assessment.eligible && compatibility && blockers.length === 0 && staleLeases.length === 0
+                ? 'update corrective-carryover-transport'
+                : null,
+            projectId: task.projectId,
+            taskId: task.id,
+            taskRevision: task.revision,
+            stepId: compatibility?.stepId ?? null,
+            sourceVersion,
+            targetVersion,
+            sourceHeadCommit: compatibility?.sourceHeadCommit ?? null,
+            taskBranch: task.taskBranch,
+            baseBranch: task.baseBranch,
+            dirtyFiles: compatibility?.dirtyFiles ?? [],
+            dirtyWorktreeHash: compatibility?.dirtyWorktreeHash ?? null,
+            compatibilityHash: compatibility?.compatibilityHash ?? null,
+            c1Posture: c1.state === 'claimed' ? {
+                state: 'claimed',
+                claimant: c1.claimant,
+                claimEventId: compatibility?.c1ClaimEventId ?? null,
+                claimEventHash: compatibility?.c1ClaimEventHash ?? null,
+            } : null,
+            staleLeaseRepair: repairableStale ? [{
+                    action: 'locks repair',
+                    entityId: task.id,
+                    owner: repairableStale.owner,
+                    expiresAt: repairableStale.expiresAt,
+                }] : [],
+            requiredTransport: [
+                'Commit only package.json and package-lock.json on the active Milestone base.',
+                'Commit only the same dependency files on the Task branch while preserving the bound dirty bytes.',
+                'Install the exact target package, register dependency provenance, refresh context, replace the same Worker credential, then follow fresh next.',
+            ],
+            blockers,
+        };
+    }
+    consumedCarryoverSourceRecoveryPreflight(snapshot, task, sourceSurfaces, candidate) {
+        const repositoryRoot = snapshot.identity.repositoryRoot;
+        const sourceVersion = '2.0.0-beta.13.6';
+        const targetVersion = '2.0.0-beta.13.7';
+        const c1 = readTaskC1Posture(this.store, task);
+        const recorded = [...(task.dependencyProvenanceRecoveries ?? [])].reverse().find((record) => record.rootCauseReplan && task.systemCommits.includes(record.commitSha))?.rootCauseReplan;
+        const currentHead = headCommit(repositoryRoot);
+        const dirtyFiles = changedFiles(repositoryRoot).sort();
+        const dirtyWorktreeHash = hashDirtyWorktree(repositoryRoot, dirtyFiles);
+        const navigation = this.next(repositoryRoot, task.id);
+        const action = String(navigation.action);
+        const stepId = typeof navigation.stepId === 'string' ? navigation.stepId : null;
+        const step = task.steps.find((candidate) => candidate.id === stepId) ?? null;
+        const terminal = readRemediationEvents(this.store, task)
+            .filter((event) => event.stepId === stepId && event.failureKind === 'checks-failed').at(-1);
+        const matchingYields = readTaskHandoffEvents(this.store, task).filter((event) => terminal && matchesTerminalCorrectiveYield(event, terminal, task.id));
+        const yielded = matchingYields.length === 1 ? matchingYields[0] : null;
+        const assessment = this.assessCurrentRootCauseReplanDirtyCarryover(repositoryRoot, task, stepId ?? undefined);
+        const missingClaimOnly = assessment.blockers.length === 1
+            && assessment.blockers[0].startsWith('Corrective carryover requires the retained claimed C1');
+        const rollingWave = navigation.rollingWave;
+        const sourceActionAllowed = (action === 'task plan-set' && step?.status === 'failed'
+            && rollingWave?.state === 'root-cause-replan-required' && !assessment.applicable && c1.state === 'none')
+            || (action === 'task handoff-prepare' && step?.status === 'planned' && missingClaimOnly && c1.state === 'none')
+            || (action === 'task claim' && step?.status === 'planned' && missingClaimOnly
+                && c1.state === 'pending' && c1.targetActor === yielded?.actor);
+        const blockers = [
+            ...(PACKAGE_VERSION !== targetVersion ? [`Runner must be the exact ${targetVersion} compatibility target.`] : []),
+            ...Object.entries(sourceSurfaces).filter(([, version]) => version !== sourceVersion)
+                .map(([surface]) => `${surface} Workflow version must equal the exact ${sourceVersion} source.`),
+            ...observationPreflightBlockers(snapshot.observation),
+            ...(snapshot.leases.length > 0 ? ['No active or stale writer lease may exist before source recovery.'] : []),
+            ...(snapshot.observation.pendingProjectTransactions.length
+                + snapshot.observation.pendingMilestoneTransactions.length
+                + snapshot.observation.pendingTaskTransactions.length
+                + snapshot.observation.corruptTaskTransactions.length
+                + snapshot.observation.coreTaskOperations.length > 0 ? ['No pending or corrupt transaction or Core operation may exist.'] : []),
+            ...(!recorded || recorded.stepId === stepId
+                || task.steps.find((candidate) => candidate.id === recorded.stepId)?.status !== 'completed'
+                ? ['A different, verified completed Step must own the historical carryover binding.'] : []),
+            ...(!sourceActionAllowed ? ['No exact source Plan replacement or original-Worker handoff action is eligible.'] : []),
+            ...(!(task.status === 'ready' || (action === 'task plan-set' && task.status === 'needs_fix'))
+                || task.workspaceOwner !== 'local'
+                || currentBranch(repositoryRoot) !== task.taskBranch
+                || task.steps.some((candidate) => candidate.status === 'in_progress')
+                ? ['The Task must retain its local, no-running-Step source recovery boundary.'] : []),
+            ...(!step || dirtyFiles.length === 0
+                || dirtyFiles.some((file) => !pathAllowed(file, step.allowedWrites) || pathAllowed(file, step.forbiddenScope))
+                ? ['Retained dirty files must remain inside the exact current Step scope.'] : []),
+            ...(!terminal || terminal.failureEvidence.completionCommit !== currentHead
+                || terminal.failureEvidence.dirtyWorktreeHash !== dirtyWorktreeHash
+                ? ['The terminal repeated failure HEAD and dirty-byte binding must remain unchanged.'] : []),
+            ...(!yielded || !terminal || yielded.planHash === null
+                || !Number.isFinite(Date.parse(yielded.recordedAt))
+                || Date.parse(yielded.recordedAt) < Date.parse(terminal.recordedAt)
+                ? ['The terminal failure must retain its exact completed original-Worker corrective yield.'] : []),
+        ];
+        let candidateBinding = null;
+        if (action === 'task plan-set') {
+            if (!candidate) {
+                blockers.push('Source Plan replacement requires candidate Plan and independent Plan Risk Audit inputs.');
+            }
+            else {
+                try {
+                    validatePlan(candidate.plan);
+                    const retained = deriveCompletedStepCarryover(task, candidate.plan.steps);
+                    if (task.steps.some((completed) => completed.status === 'completed' && !retained.has(completed.id))) {
+                        throw new Error('Candidate must preserve every completed Step definition and its execution authority exactly.');
+                    }
+                    const correctiveStep = candidate.plan.steps.find((candidateStep) => candidateStep.id === stepId);
+                    if (!correctiveStep || dirtyFiles.some((file) => !pathAllowed(file, correctiveStep.allowedWrites) || pathAllowed(file, correctiveStep.forbiddenScope))) {
+                        throw new Error('Candidate must retain the exact failed Step and confine every dirty path to its replacement scope.');
+                    }
+                    if (correctiveStep.dependencies.some((dependency) => !retained.has(dependency))) {
+                        throw new Error('Candidate corrective Step dependencies must retain completed execution authority.');
+                    }
+                    if (candidate.plan.objective !== task.planObjective
+                        || canonicalJsonStringify(candidate.plan.requirements) !== canonicalJsonStringify(task.requirements)
+                        || canonicalJsonStringify(candidate.plan.acceptance) !== canonicalJsonStringify(task.acceptance)) {
+                        throw new Error('Candidate cannot change Task objective, requirements or acceptance.');
+                    }
+                    const map = this.assertKnowledgeMapBinding(repositoryRoot, task.projectId, candidate.plan.knowledgeMapRevision, candidate.plan.knowledgeMapHash);
+                    this.validateKnowledgeTargets(map, candidate.plan);
+                    const prepared = prepareCorrectiveReplanCandidate(task, candidate.plan);
+                    if (!task.planHash || normalizePlanKnowledgeBinding(prepared.planBytes, 'source recovery candidate').semanticHash
+                        === normalizePlanKnowledgeBinding(readVerifiedPlanArtifact(this.store.taskRoot(task.projectId, task.id), task.planHash, task.planHash), 'current failed Plan').semanticHash) {
+                        throw new Error('Candidate must change the failed Plan semantics before source recovery.');
+                    }
+                    if (!['approved', 'approved-with-rationale'].includes(candidate.planRiskAudit.decision)) {
+                        throw new Error('Source recovery candidate requires a positive independent Plan Risk Audit.');
+                    }
+                    const auditTask = {
+                        ...task, status: 'awaiting_execution_authorization', planHash: prepared.planHash,
+                        knowledgeMapRevision: candidate.plan.knowledgeMapRevision,
+                        knowledgeMapHash: candidate.plan.knowledgeMapHash,
+                        steps: candidate.plan.steps.map((candidateStep) => retained.get(candidateStep.id) ?? {
+                            ...candidateStep, status: 'planned', evidence: null, failurePause: null,
+                        }),
+                    };
+                    validatePlanRiskAuditCandidate(this.store, auditTask, candidate.planRiskAudit);
+                    candidateBinding = {
+                        candidatePlanHash: prepared.planHash,
+                        candidateInputHash: sha256Hex(canonicalJsonStringify(candidate.plan)),
+                        riskAuditInputHash: sha256Hex(canonicalJsonStringify(candidate.planRiskAudit)),
+                    };
+                }
+                catch (error) {
+                    blockers.push(error instanceof Error ? error.message : String(error));
+                }
+            }
+        }
+        try {
+            validateTaskHistory(repositoryRoot, task);
+            this.assertTaskKnowledgeBinding(repositoryRoot, task);
+            const sourceAudit = [...readPlanRiskAuditEvents(this.store, task)].reverse().find((event) => event.taskRevision <= (terminal?.failureEvidence.executionTaskRevision ?? -1));
+            if (!sourceAudit || !yielded?.planHash || !task.planHash
+                || normalizePlanKnowledgeBinding(readVerifiedPlanArtifact(this.store.taskRoot(task.projectId, task.id), sourceAudit.planHash, task.planHash), 'terminal source').semanticHash
+                    !== normalizePlanKnowledgeBinding(readVerifiedPlanArtifact(this.store.taskRoot(task.projectId, task.id), yielded.planHash, task.planHash), 'terminal corrective yield').semanticHash) {
+                throw new Error('Terminal failure and exact corrective yield must share a verified source Plan.');
+            }
+        }
+        catch (error) {
+            blockers.push(error instanceof Error ? error.message : String(error));
+        }
+        const binding = {
+            taskId: task.id, taskRevision: task.revision, stepId, briefHash: task.briefHash,
+            planHash: task.planHash, planRiskAuditEventHash: readCurrentPlanRiskAudit(this.store, task)?.audit.eventHash ?? null,
+            sourceHeadCommit: currentHead, dirtyFiles, dirtyWorktreeHash,
+            completedStepsHash: hashCompletedSteps(task), historicalCarryoverHash: recorded?.compatibilityHash ?? null,
+            terminalRemediationEventHash: terminal?.eventHash ?? null,
+            correctiveYieldEventHash: yielded?.eventHash ?? null, originalWorker: yielded?.actor ?? null,
+            c1Posture: c1.state,
+            candidateBinding,
+        };
+        return {
+            readOnly: true, eligible: false, sourceVersion, targetVersion, ...binding,
+            action: null, transportAllowed: false,
+            ...(action === 'task plan-set' ? { taskPlanContract: navigation.taskPlanContract } : {}),
+            compatibilityHash: sha256Hex(canonicalJsonStringify(binding)),
+            sourceRecovery: blockers.length === 0 ? {
+                eligible: true, action,
+                ...(action === 'task plan-set' ? { ...candidateBinding } : {}),
+                ...(action === 'task handoff-prepare' ? { targetActor: yielded.actor } : {}),
+                ...(action === 'task claim' ? { actor: yielded.actor } : {}),
+                instruction: 'Execute only this exact action with the installed source package; run source status then next and repeat this read-only preflight. Ordinary Plan Risk Audit and execution authorization retain their normal gates.',
+            } : null,
+            blockers,
+        };
     }
     historicalStepProvenanceRecoveryPreflight(repository, taskId) {
         const snapshot = this.observationSnapshot(repository);
@@ -4645,7 +4945,9 @@ export class WorkflowService {
                     ? Boolean(record.historicalStepProvenance)
                     : recoveryMode === 'plan-integrity'
                         ? Boolean(record.planIntegrity)
-                        : Boolean(record.activeDownstreamProof) === recoveryMode));
+                        : recoveryMode === false && record.rootCauseReplan
+                            ? true
+                            : Boolean(record.activeDownstreamProof) === recoveryMode));
         if (prior && current.systemCommits.includes(currentHead))
             return current;
         assertExpectedRevision(current, expectedRevision);
@@ -4661,13 +4963,26 @@ export class WorkflowService {
                     ? this.planIntegrityDependencyRecoveryPreflight(repository, taskId)
                     : recoveryMode
                         ? this.activeDownstreamProofDependencyRecoveryPreflight(repository, taskId)
-                        : this.inspectDependencyProvenanceCandidate(snapshot, task);
+                        : this.dependencyProvenanceRecoveryPreflight(repository, taskId);
         if (!preflight.eligible || !preflight.commitSha || !preflight.parentCommitSha) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', 'The bounded dependency provenance recovery preflight failed.', {
                 taskId,
                 blockers: preflight.blockers,
             });
         }
+        if (preflight.rootCauseReplan) {
+            const posture = readTaskC1Posture(this.store, task);
+            if (posture.state !== 'claimed'
+                || posture.claimant !== preflight.rootCauseReplan.claimant
+                || normalizedActor !== posture.claimant) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Corrective carryover dependency recovery requires the exact retained C1 claimant actor.', {
+                    taskId,
+                    actor: normalizedActor,
+                    requiredActor: preflight.rootCauseReplan.claimant,
+                    posture: posture.state,
+                });
+            }
+        }
         const now = this.now();
         const recoveredRecords = preflight.dependencyCommits.map((dependencyCommit, index) => {
             const isTerminalCommit = index === preflight.dependencyCommits.length - 1;
@@ -4693,6 +5008,9 @@ export class WorkflowService {
                 ...(isTerminalCommit && preflight.planIntegrity
                     ? { planIntegrity: preflight.planIntegrity }
                     : {}),
+                ...(isTerminalCommit && preflight.rootCauseReplan
+                    ? { rootCauseReplan: preflight.rootCauseReplan }
+                    : {}),
             };
         });
         const nextTask = {
@@ -6039,6 +6357,9 @@ export class WorkflowService {
         }
         const next = this.taskGitNavigationOverride(task) ?? nextForTask(task);
         const nextStepId = typeof next.stepId === 'string' ? next.stepId : null;
+        const rootCauseStepId = nextStepId
+            ?? task.steps.find((candidate) => candidate.status === 'planned')?.id
+            ?? null;
         const downstreamProofCarryover = next.action === 'task run'
             && nextStepId
             && changedFiles(repositoryRoot).length > 0
@@ -6049,6 +6370,24 @@ export class WorkflowService {
             && changedFiles(repositoryRoot).length > 0
             ? this.assessPostRebindCheckSupportDirtyCarryover(repositoryRoot, task, nextStepId)
             : null;
+        let rootCauseReplanDirtyCarryover = ['task run', 'task handoff-prepare', 'task claim'].includes(String(next.action))
+            && rootCauseStepId
+            && changedFiles(repositoryRoot).length > 0
+            ? this.assessCurrentRootCauseReplanDirtyCarryover(repositoryRoot, task, rootCauseStepId)
+            : null;
+        if (rootCauseReplanDirtyCarryover?.eligible) {
+            try {
+                this.assertExecutionAuthorizationFresh(task, repositoryRoot);
+            }
+            catch (error) {
+                rootCauseReplanDirtyCarryover = {
+                    applicable: true,
+                    eligible: false,
+                    compatibility: null,
+                    blockers: [error instanceof Error ? error.message : String(error)],
+                };
+            }
+        }
         let mechanicalFeasibilityOverlay = {};
         if (task.status === 'awaiting_execution_authorization' && task.planHash) {
             try {
@@ -6678,7 +7017,7 @@ export class WorkflowService {
                         downstreamProofCarryover: {
                             state: 'validated',
                             invalidationEventId: downstreamProofCarryover.invalidationEventId,
-                            stepId: nextStepId,
+                            stepId: rootCauseStepId,
                             dirtyFiles: downstreamProofCarryover.dirtyFiles,
                             dirtyWorktreeHash: downstreamProofCarryover.dirtyWorktreeHash,
                             meaning: 'The replacement Step may adopt exactly these preserved uncommitted bytes on task run.',
@@ -6718,6 +7057,52 @@ export class WorkflowService {
                         },
                     }
                 : {}),
+            ...(rootCauseReplanDirtyCarryover?.applicable
+                ? rootCauseReplanDirtyCarryover.eligible && rootCauseReplanDirtyCarryover.compatibility
+                    ? {
+                        action: 'task run',
+                        rootCauseReplanDirtyCarryover: {
+                            state: 'validated',
+                            stepId: nextStepId,
+                            compatibilityHash: rootCauseReplanDirtyCarryover.compatibility.compatibilityHash,
+                            dirtyFiles: rootCauseReplanDirtyCarryover.compatibility.dirtyFiles,
+                            dirtyWorktreeHash: rootCauseReplanDirtyCarryover.compatibility.dirtyWorktreeHash,
+                            meaning: 'The replacement Step may adopt the exact retained root-cause failure bytes.',
+                        },
+                    }
+                    : rootCauseReplanDirtyCarryover.blockers.length === 1
+                        && rootCauseReplanDirtyCarryover.blockers[0]?.startsWith('Corrective carryover requires the retained claimed C1')
+                        ? handoffPosture.state === 'none'
+                            ? {
+                                action: 'task handoff-prepare',
+                                blockedAction: 'task run',
+                                rootCauseReplanDirtyCarryover: {
+                                    state: 'awaiting-c1',
+                                    stepId: rootCauseStepId,
+                                    requiredActor: defaultTaskWorkerActor(task.id),
+                                },
+                            }
+                            : handoffPosture.state === 'pending'
+                                ? {}
+                                : {
+                                    action: 'doctor',
+                                    blockedAction: 'task run',
+                                    rootCauseReplanDirtyCarryover: {
+                                        state: 'blocked',
+                                        stepId: rootCauseStepId,
+                                        blockers: rootCauseReplanDirtyCarryover.blockers,
+                                    },
+                                }
+                        : {
+                            action: 'doctor',
+                            blockedAction: 'task run',
+                            rootCauseReplanDirtyCarryover: {
+                                state: 'blocked',
+                                stepId: rootCauseStepId,
+                                blockers: rootCauseReplanDirtyCarryover.blockers,
+                            },
+                        }
+                : {}),
             ...(delegatedApprovalOptions.length > 0 ? { delegatedApprovalOptions } : {}),
             ...(correctiveDerivedAuthority && correctiveDerivedActor
                 ? {
@@ -6734,7 +7119,10 @@ export class WorkflowService {
                 }
                 : {}),
         };
-        if (handoffPosture.state === 'pending') {
+        const rootCauseAllowsPendingClaim = !rootCauseReplanDirtyCarryover?.applicable
+            || (rootCauseReplanDirtyCarryover.blockers.length === 1
+                && rootCauseReplanDirtyCarryover.blockers[0]?.startsWith('Corrective carryover requires the retained claimed C1'));
+        if (handoffPosture.state === 'pending' && rootCauseAllowsPendingClaim) {
             return this.withTaskNavigationContracts(task, {
                 ...result,
                 action: 'task claim',
@@ -7256,7 +7644,7 @@ export class WorkflowService {
             blockers,
         };
     }
-    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null, downstreamProofReplan = null, historicalStepProvenance = null, planIntegrity = null) {
+    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null, downstreamProofReplan = null, historicalStepProvenance = null, planIntegrity = null, rootCauseReplan = null) {
         const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
         const now = this.now().getTime();
         return inspectDependencyProvenanceRecovery(snapshot.identity.repositoryRoot, task, {
@@ -7276,7 +7664,89 @@ export class WorkflowService {
                 currentBranch: versions.currentBranch,
                 baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
             },
-        }, activeDownstreamProof, downstreamProofReplan, historicalStepProvenance, planIntegrity);
+        }, activeDownstreamProof, downstreamProofReplan, historicalStepProvenance, planIntegrity, rootCauseReplan);
+    }
+    assessCurrentRootCauseReplanDirtyCarryover(repositoryRoot, task, stepId, historyHead) {
+        const recordedRecovery = [...(task.dependencyProvenanceRecoveries ?? [])].reverse().find((record) => record.rootCauseReplan
+            && task.systemCommits.includes(record.commitSha)) ?? null;
+        const recorded = recordedRecovery?.rootCauseReplan ?? null;
+        if (recorded) {
+            const recordedStep = task.steps.find((candidate) => candidate.id === recorded.stepId) ?? null;
+            if (!recordedStep) {
+                return {
+                    applicable: true,
+                    eligible: false,
+                    compatibility: null,
+                    blockers: [`Recorded corrective carryover Step ${recorded.stepId} is missing from the current Plan.`],
+                };
+            }
+            if (recordedStep.status === 'completed') {
+                const blockers = [];
+                if (!recordedStep.evidence) {
+                    blockers.push(`Completed corrective carryover Step ${recorded.stepId} has no execution evidence.`);
+                }
+                try {
+                    validateTaskHistory(repositoryRoot, task, historyHead);
+                    const sourceAudit = readPlanRiskAuditEvents(this.store, task).find((event) => event.eventId === recorded.replacementPlanRiskAuditEventId
+                        && event.eventHash === recorded.replacementPlanRiskAuditEventHash) ?? null;
+                    const classification = sourceAudit?.stepClassifications.find((candidate) => candidate.stepId === recorded.stepId) ?? null;
+                    if (!sourceAudit || !classification) {
+                        blockers.push('Completed corrective carryover Step lost its exact replacement Plan Risk Audit binding.');
+                    }
+                    else if (classification.reviewRequired
+                        && recordedStep.evidence
+                        && !verifiedHistoricalStepReviewBindings(this.store, task).some((binding) => binding.stepId === recorded.stepId
+                            && binding.commitSha === recordedStep.evidence.commitSha)) {
+                        blockers.push(`Completed corrective carryover Step ${recorded.stepId} lacks verified strict-review proof.`);
+                    }
+                }
+                catch (error) {
+                    blockers.push(error instanceof Error ? error.message : String(error));
+                }
+                if (blockers.length > 0) {
+                    return {
+                        applicable: true,
+                        eligible: false,
+                        compatibility: null,
+                        blockers: [...new Set(blockers)],
+                    };
+                }
+                // A reviewed, history-valid completed Step consumed this carryover. Keep its
+                // immutable recovery record, but let later Steps use their own lifecycle route.
+            }
+            else {
+                if (stepId && stepId !== recorded.stepId) {
+                    return {
+                        applicable: true,
+                        eligible: false,
+                        compatibility: null,
+                        blockers: [`Recorded corrective carryover is bound to ${recorded.stepId}, not requested ${stepId}.`],
+                    };
+                }
+                return assessRootCauseReplanDirtyCarryover(this.store, repositoryRoot, task, recorded.stepId, {
+                    binding: recorded,
+                });
+            }
+        }
+        const candidates = task.steps
+            .filter((step) => step.status === 'planned' && (!stepId || step.id === stepId))
+            .flatMap((step) => [...new Set(readRemediationEvents(this.store, task)
+                .filter((event) => event.stepId === step.id && event.failureKind === 'checks-failed')
+                .map((event) => event.failureEvidence.completionCommit))]
+            .map((historyHead) => assessRootCauseReplanDirtyCarryover(this.store, repositoryRoot, task, step.id, { historyHead })))
+            .filter((assessment) => assessment.applicable);
+        const eligible = candidates.filter((assessment) => assessment.eligible && assessment.compatibility);
+        if (eligible.length === 1)
+            return eligible[0];
+        return {
+            applicable: candidates.length > 0,
+            eligible: false,
+            compatibility: null,
+            blockers: [...new Set([
+                    ...candidates.flatMap((assessment) => assessment.blockers),
+                    ...(eligible.length > 1 ? ['Corrective carryover history resolved to more than one eligible boundary.'] : []),
+                ])],
+        };
     }
     inspectHistoricalStepProvenanceCandidate(snapshot, task, options = {}) {
         const now = this.now().getTime();