codex-workflow-v2 2.0.0-beta.13.8 → 2.0.0-beta.14

package/src/alpha6/root-cause-replan-carryover.ts

@@ -0,0 +1,491 @@
+import { stepStartPhase } from '../domain/step-start-admission.js';
+import type {
+  AuthorizationEvent,
+  StepStatus,
+  RemediationEvent,
+  RootCauseReplanDirtyCarryoverCompatibility,
+  TaskHandoffEvent,
+  TaskState,
+} from '../contracts.js';
+import { normalizePlanKnowledgeBinding, readVerifiedPlanArtifact } from '../domain/plan-semantics.js';
+import { pathAllowed } from '../domain/validation.js';
+import { hashCanonical } from '../lifecycle/fingerprint.js';
+import { changedFiles, currentBranch, gitIsAncestor, headCommit } from '../repository.js';
+import { validateTaskHistory } from '../git.js';
+import type { FileStateStore } from '../state/store.js';
+import { assertMechanicalFeasibilityFresh } from './mechanical-feasibility.js';
+import { hashDirtyWorktree } from './downstream-proof.js';
+import { hashCompletedSteps, hashExecutionAuthorization } from './preexecution-replan.js';
+import { readCurrentPlanRiskAudit, readPlanRiskAuditEvents } from './plan-risk.js';
+import { deriveRollingCauseDecision, readRemediationEvents } from './remediation.js';
+import { readTaskC1Posture, readTaskHandoffEvents } from './handoff.js';
+import { sha256Hex } from './store-sidecars.js';
+
+/** Phase applicability only; history, scope and writer authority still require their own proofs. */
+export function isRootCauseReplacementStart(status: StepStatus | undefined, hasDirtyFiles: boolean): boolean {
+  return stepStartPhase(status, hasDirtyFiles) === 'planned-dirty';
+}
+
+export interface RootCauseReplanDirtyCarryoverAssessment {
+  applicable: boolean;
+  eligible: boolean;
+  compatibility: RootCauseReplanDirtyCarryoverCompatibility | null;
+  blockers: string[];
+  requiredActor?: string;
+}
+
+export function matchesTerminalCorrectiveYield(
+  event: TaskHandoffEvent,
+  terminal: RemediationEvent,
+  taskId: string,
+): boolean {
+  const executionTaskRevision = terminal.failureEvidence.executionTaskRevision;
+  if (executionTaskRevision === undefined) return false;
+  return event.eventType === 'yield'
+    && event.taskId === taskId
+    && event.taskRevision === executionTaskRevision + 1
+    && event.eventId === `HOF-${sha256Hex([
+      'checks-failed-root-cause-replan-pause-v1',
+      taskId,
+      String(executionTaskRevision),
+      terminal.eventHash,
+      event.actor,
+    ].join('\0'))}`;
+}
+
+/**
+ * Proves that dirty bytes from the terminal repeated-cause failure survived one semantic
+ * corrective Plan replacement and are already inside the replacement Step's declared scope.
+ * This proof never grants or appends an allowedWrite.
+ */
+export function assessRootCauseReplanDirtyCarryover(
+  store: FileStateStore,
+  repositoryRoot: string,
+  task: TaskState,
+  stepId: string,
+  options: {
+    historyHead?: string;
+    binding?: RootCauseReplanDirtyCarryoverCompatibility | null;
+  } = {},
+): RootCauseReplanDirtyCarryoverAssessment {
+  const historyHead = options.historyHead ?? options.binding?.sourceHeadCommit ?? headCommit(repositoryRoot);
+  const step = task.steps.find((candidate) => candidate.id === stepId) ?? null;
+  const allStepEvents = readRemediationEvents(store, task)
+    .filter((event) => event.stepId === stepId && event.failureKind === 'checks-failed');
+  const applicable = Boolean(step && task.planHash && allStepEvents.length >= 2);
+  if (!applicable || !step || !task.planHash) {
+    return { applicable, eligible: false, compatibility: null, blockers: [] };
+  }
+
+  const blockers: string[] = [];
+  const dirtyFiles = changedFiles(repositoryRoot).sort();
+  if (task.status !== 'ready') blockers.push('The replacement Task must be execution-authorized and ready.');
+  if (step.status !== 'planned' || step.evidence !== null) {
+    blockers.push(`The replacement Step ${stepId} must be planned with no execution evidence.`);
+  }
+  if (task.steps.some((candidate) => candidate.status === 'in_progress')) blockers.push('No Step may be in progress.');
+  if (task.workspaceOwner !== 'local') blockers.push('Corrective carryover requires the recorded local Task workspace.');
+  if (!task.taskBranch || currentBranch(repositoryRoot) !== task.taskBranch) {
+    blockers.push('Current branch must equal the recorded Task branch.');
+  }
+  if (dirtyFiles.length === 0) blockers.push('Corrective carryover requires retained dirty product bytes.');
+  const outsideAllowed = dirtyFiles.filter((file) => !pathAllowed(file, step.allowedWrites));
+  const forbidden = dirtyFiles.filter((file) => pathAllowed(file, step.forbiddenScope));
+  if (outsideAllowed.length > 0) blockers.push(`Dirty files fall outside ${stepId} allowedWrites: ${outsideAllowed.join(', ')}`);
+  if (forbidden.length > 0) blockers.push(`Dirty files intersect ${stepId} forbiddenScope: ${forbidden.join(', ')}`);
+  const incompleteDependencies = step.dependencies.filter((dependency) =>
+    !['completed', 'skipped'].includes(task.steps.find((candidate) => candidate.id === dependency)?.status ?? 'blocked'));
+  if (incompleteDependencies.length > 0) blockers.push(`Replacement Step dependencies are incomplete: ${incompleteDependencies.join(', ')}`);
+
+  const audits = readPlanRiskAuditEvents(store, task);
+  const eventPlan = (event: RemediationEvent): { planHash: string; semanticHash: string } | null => {
+    const revision = event.failureEvidence.executionTaskRevision;
+    if (revision === undefined) return null;
+    const planHash = [...audits].reverse().find((audit) => audit.taskRevision <= revision)?.planHash ?? null;
+    if (!planHash || !task.planHash) return null;
+    try {
+      return {
+        planHash,
+        semanticHash: normalizePlanKnowledgeBinding(
+          readVerifiedPlanArtifact(store.taskRoot(task.projectId, task.id), planHash, task.planHash),
+          `remediation ${event.eventId}`,
+        ).semanticHash,
+      };
+    } catch {
+      return null;
+    }
+  };
+  const terminal = allStepEvents.at(-1)!;
+  const terminalPlan = eventPlan(terminal);
+  const sourcePlanHash = terminalPlan?.planHash ?? null;
+  if (!sourcePlanHash || sourcePlanHash === task.planHash) {
+    blockers.push('The terminal repeated-cause event must resolve to one replaced source Plan.');
+  }
+  let cycleStart = allStepEvents.length - 1;
+  while (cycleStart > 0
+    && eventPlan(allStepEvents[cycleStart - 1]!)?.semanticHash === terminalPlan?.semanticHash) cycleStart -= 1;
+  const sourceCycle = allStepEvents.slice(cycleStart);
+  const priorEvents = allStepEvents.slice(0, cycleStart);
+  if (!terminalPlan || sourceCycle.some((event) => eventPlan(event)?.semanticHash !== terminalPlan.semanticHash)) {
+    blockers.push('The source remediation cycle has ambiguous Plan bindings.');
+  }
+  if (deriveRollingCauseDecision(sourceCycle, priorEvents) !== 'root-cause-replan') {
+    blockers.push('The source cycle does not end in a repeated authoritative mechanical cause.');
+  }
+  const priorFingerprints = new Set([...priorEvents, ...sourceCycle.slice(0, -1)]
+    .flatMap((event) => event.causeBindings?.filter((cause) => cause.authority === 'mechanical')
+      .map((cause) => cause.causeFingerprint) ?? []));
+  const repeated = [...new Set(terminal.causeBindings
+    ?.filter((cause) => cause.authority === 'mechanical' && !cause.planConflict && priorFingerprints.has(cause.causeFingerprint))
+    .map((cause) => cause.causeFingerprint) ?? [])];
+  if (repeated.length !== 1) blockers.push('The terminal failure must identify exactly one repeated mechanical cause.');
+  if (terminal.failureEvidence.executionTaskRevision === undefined) {
+    blockers.push('The terminal failure is missing its execution Task revision.');
+  }
+  if (!terminal.failureEvidence.dirtyWorktreeHash) blockers.push('The terminal failure is missing its dirty-worktree hash.');
+  if (terminal.failureEvidence.completionCommit !== historyHead) {
+    blockers.push('Repository HEAD changed after the terminal repeated-cause failure.');
+  }
+  try {
+    if ((task.invalidatedStepCommits ?? []).length > 0) {
+      throw new Error('Legacy carryover cannot time-classify invalidated completed-Step commits.');
+    }
+    const sourceHistoryTask: TaskState = {
+      ...task,
+      systemCommits: task.systemCommits.filter((commit) => gitIsAncestor(repositoryRoot, commit, historyHead)),
+      dependencyProvenanceRecoveries: (task.dependencyProvenanceRecoveries ?? []).filter((record) =>
+        gitIsAncestor(repositoryRoot, record.commitSha, historyHead)),
+    };
+    validateTaskHistory(repositoryRoot, sourceHistoryTask, historyHead);
+  } catch (error) {
+    blockers.push(`Completed Step authority is not exactly retained at the source boundary: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  let dirtyWorktreeHash: string | null = null;
+  try {
+    dirtyWorktreeHash = hashDirtyWorktree(repositoryRoot, dirtyFiles);
+    if (dirtyWorktreeHash !== terminal.failureEvidence.dirtyWorktreeHash) {
+      blockers.push('Dirty paths or bytes changed after the terminal repeated-cause failure.');
+    }
+  } catch (error) {
+    blockers.push(error instanceof Error ? error.message : String(error));
+  }
+
+  const replacementAuthorityPlanHash = options.binding?.replacementPlanHash ?? task.planHash;
+  let sourcePlanSemanticHash: string | null = null;
+  let replacementPlanSemanticHash: string | null = null;
+  try {
+    if (!sourcePlanHash) throw new Error('Source Plan hash is unavailable.');
+    sourcePlanSemanticHash = normalizePlanKnowledgeBinding(
+      readVerifiedPlanArtifact(store.taskRoot(task.projectId, task.id), sourcePlanHash, task.planHash),
+      'root-cause source',
+    ).semanticHash;
+    replacementPlanSemanticHash = normalizePlanKnowledgeBinding(
+      readVerifiedPlanArtifact(store.taskRoot(task.projectId, task.id), replacementAuthorityPlanHash, task.planHash),
+      'root-cause replacement',
+    ).semanticHash;
+    if (sourcePlanSemanticHash === replacementPlanSemanticHash) {
+      blockers.push('Corrective carryover requires a semantic replacement Plan.');
+    }
+    const currentSemanticHash = normalizePlanKnowledgeBinding(
+      readVerifiedPlanArtifact(store.taskRoot(task.projectId, task.id), task.planHash, task.planHash),
+      'current corrective Plan',
+    ).semanticHash;
+    if (currentSemanticHash !== replacementPlanSemanticHash) {
+      blockers.push('The current Plan is not a knowledge-only descendant of the corrective replacement Plan.');
+    }
+  } catch (error) {
+    blockers.push(error instanceof Error ? error.message : String(error));
+  }
+
+  let currentAudit: ReturnType<typeof readCurrentPlanRiskAudit> = null;
+  let replacementSourceAudit: ReturnType<typeof readPlanRiskAuditEvents>[number] | null = null;
+  try {
+    currentAudit = readCurrentPlanRiskAudit(store, task);
+    const sourceAudit = options.binding
+      ? audits.find((audit) => audit.eventId === options.binding!.replacementPlanRiskAuditEventId
+        && audit.eventHash === options.binding!.replacementPlanRiskAuditEventHash
+        && audit.planHash === options.binding!.replacementPlanHash) ?? null
+      : currentAudit?.audit ?? null;
+    replacementSourceAudit = sourceAudit;
+    if (!currentAudit || currentAudit.audit.planHash !== task.planHash
+      || !currentAudit.reviewRequiredStepIds.includes(stepId)
+      || !sourceAudit
+      || sourceAudit.taskRevision <= (terminal.failureEvidence.executionTaskRevision ?? Number.MAX_SAFE_INTEGER)) {
+      blockers.push('A fresh replacement Plan Risk Audit must guard the exact corrective Step.');
+    }
+    if (sourceAudit && currentAudit
+      && JSON.stringify(sourceAudit.stepClassifications) !== JSON.stringify(currentAudit.audit.stepClassifications)) {
+      blockers.push('Context refresh changed the replacement Plan Risk Audit classifications or proof bindings.');
+    }
+    if (sourceAudit && currentAudit) {
+      assertContiguousKnowledgeRebindChain(
+        store.taskRoot(task.projectId, task.id),
+        task,
+        replacementAuthorityPlanHash,
+        task.planHash,
+        audits,
+        sourceAudit,
+        currentAudit.audit,
+      );
+    }
+  } catch (error) {
+    blockers.push(error instanceof Error ? error.message : String(error));
+  }
+
+  const authorization = [...task.authorizations].reverse().find((event) =>
+    event.kind === 'execution' && event.decision === 'approved') ?? null;
+  const sourceAuthorization = options.binding
+    ? task.authorizations.find((event) => hashExecutionAuthorization(
+        event.kind === 'execution' && event.decision === 'superseded'
+          ? { ...event, decision: 'approved' }
+          : event,
+      ) === options.binding!.executionAuthorizationHash
+      && event.planHash === options.binding!.replacementPlanHash
+      && event.headCommit === options.binding!.executionAuthorizationHead) ?? null
+    : authorization;
+  if (!authorization) {
+    blockers.push('The replacement Plan requires a current execution authorization.');
+  } else {
+    validateAuthorization(
+      store,
+      repositoryRoot,
+      task,
+      authorization,
+      options.binding ? headCommit(repositoryRoot) : historyHead,
+      blockers,
+    );
+  }
+  if (!sourceAuthorization) blockers.push('The original corrective execution authorization is missing from immutable Task history.');
+  if (task.steps.some((candidate) => candidate.status === 'completed' && !candidate.evidence)) {
+    blockers.push('Every retained completed Step must preserve its execution evidence.');
+  }
+
+  const c1Posture = readTaskC1Posture(store, task);
+  const handoffEvents = readTaskHandoffEvents(store, task);
+  const sourceTaskRevision = options.binding?.sourceTaskRevision ?? task.revision;
+  const latestClaim = [...handoffEvents].reverse().find((event) => event.eventType === 'claim') ?? null;
+  const replacementAuditTime = replacementSourceAudit ? Date.parse(replacementSourceAudit.recordedAt) : null;
+  const claimTime = latestClaim ? Date.parse(latestClaim.recordedAt) : null;
+  const claimEvent = latestClaim
+    && latestClaim.taskRevision === sourceTaskRevision
+    && latestClaim.planHash === replacementAuthorityPlanHash
+    && latestClaim.briefHash === task.briefHash
+    && (!replacementSourceAudit || (claimTime !== null && Number.isFinite(claimTime)
+      && replacementAuditTime !== null && Number.isFinite(replacementAuditTime)
+      && claimTime >= replacementAuditTime
+      && latestClaim.taskRevision > replacementSourceAudit.taskRevision))
+    ? latestClaim
+    : null;
+  const matchingCorrectiveYields = handoffEvents.filter((event) =>
+    matchesTerminalCorrectiveYield(event, terminal, task.id));
+  const correctiveYield = matchingCorrectiveYields.length === 1
+    && matchingCorrectiveYields[0]!.planHash !== null
+    && eventPlan(terminal)?.semanticHash === normalizePlanKnowledgeBinding(
+      readVerifiedPlanArtifact(
+        store.taskRoot(task.projectId, task.id),
+        matchingCorrectiveYields[0]!.planHash!,
+        task.planHash!,
+      ),
+      `corrective yield ${matchingCorrectiveYields[0]!.eventId}`,
+    ).semanticHash
+    && Number.isFinite(Date.parse(matchingCorrectiveYields[0]!.recordedAt))
+    && Number.isFinite(Date.parse(terminal.recordedAt))
+    && Date.parse(matchingCorrectiveYields[0]!.recordedAt) >= Date.parse(terminal.recordedAt)
+    && (!replacementSourceAudit || (replacementAuditTime !== null && Number.isFinite(replacementAuditTime)
+      && Date.parse(matchingCorrectiveYields[0]!.recordedAt) <= replacementAuditTime
+      && matchingCorrectiveYields[0]!.taskRevision < replacementSourceAudit.taskRevision))
+    ? matchingCorrectiveYields[0]!
+    : null;
+  const unclaimed = terminal.failureEvidence.unclaimedExecutionBoundary;
+  const historicalPrefixIndex = unclaimed?.priorHandoffEventHash === null ? -1
+    : handoffEvents.findIndex(event => event.eventHash === unclaimed?.priorHandoffEventHash);
+  const historicalPrior = handoffEvents[historicalPrefixIndex];
+  const historicalNext = handoffEvents[historicalPrefixIndex + 1];
+  const validUnclaimed = Boolean(unclaimed
+    && (unclaimed.priorHandoffEventHash === null || historicalPrefixIndex >= 0)
+    && (!historicalPrior || (!['handoff', 'claim', 'credential-replace'].includes(historicalPrior.eventType)
+      && historicalPrior.taskRevision <= terminal.failureEvidence.executionTaskRevision!
+      && Date.parse(historicalPrior.recordedAt) <= Date.parse(terminal.recordedAt)))
+    && (!historicalNext || historicalNext.taskRevision > terminal.failureEvidence.executionTaskRevision!)
+    && matchingCorrectiveYields.length === 0);
+  if (unclaimed && !validUnclaimed) blockers.push('Native unclaimed execution receipt does not bind the exact historical no-C1 prefix.');
+  if (validUnclaimed && claimEvent && claimEvent.actor !== unclaimed!.actor) {
+    blockers.push('Corrective carryover must return to the same native unclaimed execution actor.');
+  }
+  if (c1Posture.state !== 'claimed' || !claimEvent || claimEvent.actor !== c1Posture.claimant) {
+    blockers.push('Corrective carryover requires the retained claimed C1 actor and its immutable claim event.');
+  }
+  if (!correctiveYield && !validUnclaimed) blockers.push('The terminal repeated cause is missing its completed corrective-yield boundary.');
+  if (correctiveYield && claimEvent
+    && (claimEvent.actor !== correctiveYield.actor
+      || c1Posture.state !== 'claimed'
+      || c1Posture.claimant !== correctiveYield.actor)) {
+    blockers.push('Corrective carryover must return to the same Worker that completed the terminal corrective yield.');
+  }
+
+  if (blockers.length > 0 || !sourcePlanHash || !sourcePlanSemanticHash || !replacementPlanSemanticHash
+    || !dirtyWorktreeHash || !currentAudit || !authorization || !sourceAuthorization
+    || terminal.failureEvidence.executionTaskRevision === undefined || repeated.length !== 1
+    || c1Posture.state !== 'claimed' || !claimEvent || (!correctiveYield && !validUnclaimed)) {
+    return { applicable: true, eligible: false, compatibility: null, blockers: [...new Set(blockers)],
+      ...(validUnclaimed ? { requiredActor: unclaimed!.actor } : {}) };
+  }
+  const base = {
+    kind: 'root-cause-corrective-replan-dirty-carryover' as const,
+    taskId: task.id,
+    sourceTaskRevision,
+    stepId,
+    sourcePlanHash,
+    sourcePlanSemanticHash,
+    replacementPlanHash: replacementAuthorityPlanHash,
+    replacementPlanSemanticHash,
+    sourceHeadCommit: terminal.failureEvidence.completionCommit,
+    remediationEvents: sourceCycle.map((event) => ({
+      eventId: event.eventId,
+      eventHash: event.eventHash,
+      attemptOrdinal: event.attemptOrdinal,
+    })),
+    terminalRemediationEventId: terminal.eventId,
+    terminalRemediationEventHash: terminal.eventHash,
+    terminalExecutionTaskRevision: terminal.failureEvidence.executionTaskRevision,
+    repeatedCauseFingerprint: repeated[0]!,
+    correctiveYieldEventId: correctiveYield?.eventId ?? null,
+    correctiveYieldEventHash: correctiveYield?.eventHash ?? null,
+    ...(validUnclaimed ? { unclaimedExecutionBoundary: unclaimed! } : {}),
+    dirtyFiles,
+    dirtyWorktreeHash,
+    replacementPlanRiskAuditEventId: options.binding?.replacementPlanRiskAuditEventId ?? currentAudit.audit.eventId,
+    replacementPlanRiskAuditEventHash: options.binding?.replacementPlanRiskAuditEventHash ?? currentAudit.audit.eventHash,
+    executionAuthorizationHash: options.binding?.executionAuthorizationHash ?? hashExecutionAuthorization(sourceAuthorization),
+    executionAuthorizationHead: options.binding?.executionAuthorizationHead ?? sourceAuthorization.headCommit!,
+    completedStepsHash: hashCompletedSteps(task),
+    c1ClaimEventId: claimEvent.eventId,
+    c1ClaimEventHash: claimEvent.eventHash,
+    claimant: c1Posture.claimant,
+  };
+  const compatibility = { ...base, compatibilityHash: hashCanonical({
+    domain: 'codex-workflow/root-cause-corrective-replan-dirty-carryover/v1',
+    ...base,
+  }) };
+  if (options.binding && JSON.stringify(compatibility) !== JSON.stringify(options.binding)) {
+    return {
+      applicable: true,
+      eligible: false,
+      compatibility: null,
+      blockers: ['Recorded corrective carryover binding no longer matches the immutable Task, Plan, audit, authorization, C1, or dirty-byte evidence.'],
+    };
+  }
+  return {
+    applicable: true,
+    eligible: true,
+    compatibility,
+    blockers: [],
+  };
+}
+
+function assertContiguousKnowledgeRebindChain(
+  taskRoot: string,
+  task: TaskState,
+  sourcePlanHash: string,
+  currentPlanHash: string,
+  audits: ReturnType<typeof readPlanRiskAuditEvents>,
+  sourceAudit: NonNullable<ReturnType<typeof readPlanRiskAuditEvents>[number]>,
+  currentAudit: NonNullable<ReturnType<typeof readPlanRiskAuditEvents>[number]>,
+): void {
+  if (sourcePlanHash === currentPlanHash) {
+    if (sourceAudit.eventHash !== currentAudit.eventHash) {
+      throw new Error('Corrective source Plan has ambiguous current Plan Risk Audit authority.');
+    }
+    return;
+  }
+  for (let index = 0; index < task.knowledgeRebinds.length; index += 1) {
+    const timestamp = Date.parse(task.knowledgeRebinds[index]!.recordedAt);
+    if (!Number.isFinite(timestamp)
+      || (index > 0 && timestamp <= Date.parse(task.knowledgeRebinds[index - 1]!.recordedAt))) {
+      throw new Error('Task knowledge-rebind timestamps are not finite and strictly increasing.');
+    }
+  }
+  let expected = sourcePlanHash;
+  const seen = new Set<string>();
+  const start = task.knowledgeRebinds.findIndex((record) => record.previousPlanHash === sourcePlanHash);
+  if (start < 0) throw new Error('Corrective Plan has no append-only Knowledge rebind chain.');
+  const chain = task.knowledgeRebinds.slice(start);
+  for (const record of chain) {
+    if (record.previousPlanHash !== expected) {
+      throw new Error('Corrective Plan knowledge-rebind provenance forks or skips a Plan hash.');
+    }
+    if (seen.has(record.reboundPlanHash) || record.reboundPlanHash === record.previousPlanHash) {
+      throw new Error('Corrective Plan knowledge-rebind chain is cyclic.');
+    }
+    seen.add(record.reboundPlanHash);
+    const before = readVerifiedPlanArtifact(taskRoot, record.previousPlanHash, currentPlanHash);
+    const after = readVerifiedPlanArtifact(taskRoot, record.reboundPlanHash, currentPlanHash);
+    if (normalizePlanKnowledgeBinding(before, 'corrective rebind source').normalized
+      !== normalizePlanKnowledgeBinding(after, 'corrective rebind target').normalized) {
+      throw new Error('Corrective Plan rebind changed semantics beyond the Knowledge Map binding.');
+    }
+    expected = record.reboundPlanHash;
+  }
+  if (expected !== currentPlanHash) {
+    throw new Error('Corrective Plan knowledge-rebind provenance is not contiguous to the current Plan.');
+  }
+  const planHashes = [sourcePlanHash, ...chain.map((record) => record.reboundPlanHash)];
+  const auditChain = planHashes.map((planHash) => audits.filter((audit) => audit.planHash === planHash));
+  if (auditChain.some((matches) => matches.length !== 1)
+    || auditChain[0]![0]!.eventHash !== sourceAudit.eventHash
+    || auditChain.at(-1)![0]!.eventHash !== currentAudit.eventHash) {
+    throw new Error('Corrective Plan Risk Audit rebound chain is missing or ambiguous.');
+  }
+  const sourceAuditIndex = audits.indexOf(auditChain[0]![0]!);
+  if (sourceAuditIndex < 0
+    || sourceAuditIndex + auditChain.length !== audits.length
+    || auditChain.some((matches, index) => audits[sourceAuditIndex + index] !== matches[0])) {
+    throw new Error('Corrective Plan Risk Audit rebound evidence is not the contiguous current audit suffix.');
+  }
+  chain.forEach((record, index) => {
+    const before = auditChain[index]![0]!;
+    const after = auditChain[index + 1]![0]!;
+    const expectedSummary = `${before.summary} Rebound automatically after content-only Task context refresh.`;
+    if (before.knowledgeMapRevision !== record.fromKnowledgeMapRevision
+      || before.knowledgeMapHash !== record.fromKnowledgeMapHash
+      || after.knowledgeMapRevision !== record.toKnowledgeMapRevision
+      || after.knowledgeMapHash !== record.toKnowledgeMapHash
+      || after.previousEventHash !== before.eventHash
+      || after.taskId !== before.taskId
+      || after.briefHash !== before.briefHash
+      || after.briefHash !== task.briefHash
+      || before.planner !== after.planner
+      || before.auditor !== after.auditor
+      || before.decision !== after.decision
+      || before.splitRationale !== after.splitRationale
+      || after.summary !== expectedSummary
+      || before.structuralProductionEdgeAuthority !== after.structuralProductionEdgeAuthority
+      || JSON.stringify(before.stepClassifications) !== JSON.stringify(after.stepClassifications)) {
+      throw new Error('Corrective Plan Risk Audit rebound does not match a knowledge-only Plan hop.');
+    }
+  });
+}
+
+function validateAuthorization(
+  store: FileStateStore,
+  repositoryRoot: string,
+  task: TaskState,
+  authorization: AuthorizationEvent,
+  expectedHead: string,
+  blockers: string[],
+): void {
+  try {
+    const root = store.taskRoot(task.projectId, task.id);
+    const briefHash = store.hashArtifact(root, 'brief.md');
+    const planHash = store.hashArtifact(root, 'plan.md');
+    if (task.briefHash !== briefHash || task.planHash !== planHash
+      || authorization.briefHash !== briefHash || authorization.planHash !== planHash
+      || !authorization.mechanicalFeasibility || authorization.headCommit !== expectedHead) {
+      blockers.push('Execution authorization does not bind the current Brief, Plan, and HEAD.');
+      return;
+    }
+    assertMechanicalFeasibilityFresh(repositoryRoot, task, authorization.mechanicalFeasibility, briefHash, planHash);
+  } catch (error) {
+    blockers.push(error instanceof Error ? error.message : String(error));
+  }
+}