codex-workflow-v2 2.0.0-beta.13.8 → 2.0.0-beta.14

package/docs/validation-report.md

@@ -1,182 +0,0 @@
-# V2 beta.13.1 Validation Report
-
-Release candidate `2.0.0-beta.13.1` was validated during 2026-09-02--03 (Europe/Moscow) with
-Node.js 24.17.0.
-
-## beta.13.1 post-publication compatibility correction
-
-After published beta.13 was installed dependency-only into the clean Signal `main` checkout,
-declared, locked and installed versions and registry integrity matched, but the first compact
-`status` failed before navigation. The loader had applied the new structural production-edge rule
-to the first markerless beta.12.19 PRA for `TASK-01M1B79C660YMNSRRZ236NTR1T`; that historical Task
-contains neither `requiresProductionEdges` nor `productionEdges`. This was a runtime compatibility
-defect, not corrupt Signal state.
-
-beta.13.1 makes the authority prospective and Plan-bound. New ordinary and atomic
-corrective-replan PRA writers persist one hash-chained marker. Stored structural validation runs only
-for the current Plan when either that marker or the new Task fields establish the boundary.
-Markerless pre-authority events remain hash/shape validated and readable, while marker-bearing
-current events still fail closed if Task structural fields are removed. A source-built read-only
-probe against the untouched real Signal external state changed the exact failing observation into
-the expected `project-memory reconcile` route with the retained-historical frozen-M3 cancellation
-option. The focused production-edge and corrective-replan executor suites passed `14/14` before
-the full release gate. The compatibility gate does not claim signed provenance against a privileged
-rewrite of the entire local Task and self-hashed chain; it proves ordinary read compatibility and
-fail-closed partial mismatch within the existing trusted-local-state model.
-
-## Automated release evidence
-
-- A clean `npm ci` completed from the exact lockfile. A network-enabled `npm audit --json` reported
-  zero vulnerabilities at every severity across all eight installed dependencies.
-- `npm run validate` passed typecheck and `409/409` sequential tests with no failures, skips,
-  cancellations or todos in 2,761,796.900458 ms.
-- `npm run test:signal-t10-check-support-e2e` passed `8/8` after the final clean install in
-  203,155.332125 ms. It covers an impossible selector-less check, machine-derived support scope,
-  Knowledge rebind, historical evidence reuse and exact compatibility from both beta.12.11 and
-  beta.12.15 into beta.13.
-- `npm run test:signal-remediation-e2e` passed `2/2` in 9,220.225709 ms. The audited remediation
-  adds the required upstream Task and resumes the original Task through a later Step without
-  auto-approving unrelated Knowledge drift.
-- `npm run test:signal-t03-replan-e2e` passed `1/1` in 45,253.2055 ms. The Signal-shaped flow
-  recovers an accidental rebind, replans and completes the consolidated guarded Step.
-- `npm run test:signal-t04-recovery` passed `11/11` in 22,021.439625 ms. It preserves only exact
-  reviewed Step provenance and rejects pending, corrupt, unrelated or stale recovery evidence.
-- `npm run pack:check` produced the exact `2.0.0-beta.13.1` tarball with 309 files, package size
-  1.2 MB and unpacked size 4.8 MB. It includes the shared gateway-handshake module and the
-  hash-verifiable reviewer runtime build manifest.
-- `npm run smoke:downstream` packed the release, installed it into an empty project and returned
-  `ok=true`. The first sandboxed attempt could not resolve the npm registry; the identical
-  network-enabled invocation passed.
-- `npm run plugin:check`, `npm run docs:pdf:check`, `npm run typecheck` and `git diff --check` all
-  passed. The PDF checker reported no stale generated document. `npm run release:check` passed
-  `104/104` tests in 298,521.790541 ms and returned the exact package/version assertion.
-
-## Release-candidate regressions found and closed
-
-The first complete candidate run reported `352/380` passing tests. A common precedence defect was
-found: explicit beta.13 unclassified reviewer findings (`causeBindings: []`) had been confused with
-legacy events where `causeBindings` is absent. The corrected contract keeps the former on the same
-Task, sends only a repeated authoritative cause to root-cause replan, and preserves an explicit
-current corrective decision over ordinary rolling continuation. Read-only remediation observation
-no longer requires a live bearer, while execution still requires exact actor and credential
-authority.
-
-The second complete run reported `375/380`. These five failures exposed three release-boundary
-defects that focused tests run before the version bump had missed:
-
-- Step comparison still admitted runtime-only fields into Plan semantics and could demote an
-  unchanged completed Step to `planned` during replan;
-- a synthetic pre-beta.13 remediation event retained the new `causeBindings` field and therefore
-  no longer represented legacy data;
-- the dependency compatibility preflight parsed only `beta.12.<patch>` runners, so the actual
-  beta.13 release candidate could not consume the supported beta.12.11+ recovery surface.
-
-Production Plan comparison now canonicalizes only executable Step fields in both ordinary and
-journaled replan paths. Legacy recovery remains limited to events where `causeBindings` is absent.
-Compatibility compares the beta train and patch and still requires an exact beta.12 source at or
-after beta.12.11, a newer runner, matching declared/locked/installed/base versions and every existing
-dirty, lease and evidence guard. Repeated focused and parallel regressions passed before the final
-candidate expansion.
-
-A later complete run of the expanded candidate reported `387/396`. It exposed four distinct issues
-rather than one product defect:
-
-- an autonomous-retry fixture was incorrectly labelled `runtime-composition` and therefore invoked
-  the new structural production-edge gate;
-- legacy stop-override fixtures accidentally retained native beta.13 cause bindings;
-- assertions still expected direct submit/merge after credential release and retained a completed
-  dependent Step after its predecessor was invalidated;
-- external sealed-review preflight spawned the full CLI graph with 15-second and 60-second deadlines;
-  under scheduler pressure a valid exact repository-local runtime could exhaust both deadlines and
-  produce a false infrastructure blocker.
-
-The first three were corrected only at their stale fixtures/expectations; production authority was
-not weakened. The reviewer defect was fixed structurally: CLI and preflight now share one pure
-gateway descriptor, and preflight synchronously loads the exact installed gateway, reviewer and
-workflow graph through Node after manifest/hash verification. It does not spawn a schedulable child,
-cache trust, install or build dependencies. Missing transitive dependencies, byte drift, unsafe paths,
-symlinks and contract mismatch remain fail-closed. Five concurrent preflights under eight CPU burners
-passed, and the exact five-file regression that had failed passed `88/88`. The final complete run then
-passed `399/399`.
-
-An independent agnostic release audit then reproduced one additional production defect in a long-lived
-process: after one successful preflight, Node's warm module cache could hide a subsequently deleted
-transitive dependency and still allow a sealed packet. The fix does not clear or reinterpret the module
-cache. Instead, every preflight now resolves the actual recursive dependency graph from each parent
-package using nested-first Node lookup and re-hashes exact package manifests plus every attested
-`.js`, `.cjs`, `.mjs`, `.json` and `.node` runtime file before any cached module can be trusted. Missing,
-tampered, conflicting, path-escaped or symlink-redirected state fails before load and before packet
-issuance. Exact Ajv runtime transitives are direct pins so the built attestation and npm layout are
-deterministic. Same-process ready-delete-fail-restore-ready, warm tamper, nested version conflict and
-stale nearer-copy regressions expanded the complete suite.
-
-A real native reviewer preflight then exposed an API-level Structured Output incompatibility: every
-declared object property must also be present in `required`. The reviewer schema now makes nullable
-optional semantics explicit, while the semantic parser still rejects absent or contradictory
-cause/plan-conflict evidence. The complete suite consequently reached `409/409`, and the expanded
-release check reached `104/104`.
-
-The same real-agent exercise corrected the release proof boundary without weakening Core. A nested
-`codex exec` reviewer is not treated as independent production evidence: the Coordinator stops at a
-read-only sealed packet, a distinct Codex App task performs each Step/Task review, and an external
-conductor binds the four-field review object to the packet hash, repository seal and actual reviewer
-task ID before the original persistent Coordinator resumes. The disposable release grant is limited
-to `task.execution_authorize` and `task.final_accept`; both authorizations, credential recovery and
-merge therefore use one delegate actor without an intermediate Human approval. A diagnostic harness
-attempt is never resumed or promoted after a failed binding.
-
-The first fully merged delegated fixture also found a fail-closed validator inventory gap:
-`discovery show` was logged as a mutation, so a harmless read between CLI help and fresh `next` was
-rejected as `HELP_REQUIRES_FRESH_NEXT`. The packaged transcript validator now classifies this command
-as a read-only observation and carries a regression for help -> read-only observation -> next ->
-mutation. This changes release-evidence interpretation only; it grants no lifecycle authority.
-
-## Implemented beta.13 contract
-
-- Failed Step checks and failed strict Step reviews enter an atomic continuation pause: evidence,
-  Task state and writer/C1 release either commit together or recover through the transaction journal.
-- Distinct normalized causes continue in the same Task without a numeric retry ceiling. A repeated
-  authoritative cause after a claimed fix requires root-cause replan; volatile output cannot create
-  a new cause identity.
-- Corrective replan preserves an unchanged completed Step and its reviewed commit only when every
-  dependency is also retained with the exact executable definition. A changed or omitted Step and
-  its transitive completed descendants are invalidated rather than silently adopted; independent
-  unchanged branches remain retained.
-- For multi-Step runtime composition, structural production edges are independently triggered by
-  the PRA classification rather than a planner-owned flag, and checked for a transitive owner,
-  consumer and exact executable consumer check. Simple one-Step runtime is exempt. This is bounded
-  structural authority, not a claim of full product-semantic correctness.
-- Writer credentials are stored in private local references and are never serialized as raw bearer
-  material in public CLI output, status, diagnostics or reviewer packets.
-- Compact status, reviewer runtime preflight, explicit review mode, App-owned operational preflight
-  and the observed Signal route matrix are packaged capabilities. Its class-level claim covers all
-  13 route classes observed in Signal with one exact production transition or terminal observation
-  per class. Action-level metadata remains explicit about witnessed, unwitnessed and unsupported
-  actions; unknown or malformed advertised actions fail closed.
-- Reviewer runtime preflight requires exact declared, locked and installed package versions, a
-  hash-verified build manifest, byte equality for the running/installed CLI, gateway, reviewer and
-  workflow entrypoints, and a disk-fresh recursive dependency attestation on every call. It loads the
-  exact installed runtime graph in-process only after that attestation and issues no sealed review
-  packet when any readiness or contract check fails.
-
-## Boundaries and non-claims
-
-- beta.13 does not introduce generic shadow-history import, completed-Step adoption from an
-  unrelated Task, or unchecked Workflow-state reconstruction.
-- P02 Step-validity authority, P03 generic context reuse and P04-B structural Task replacement remain
-  outside this release unless an exact implemented capability says otherwise.
-- App-owned effects such as chat creation, consent UI and polling remain outside Core. Core exposes
-  diagnostic preflights but does not claim those effects occurred.
-- The package tests prove the supported compatibility and lifecycle contracts. They do not prove a
-  future Milestone's product requirements or replace independent product review.
-- The required real-agent transcript is external release evidence bound to the final tarball and source
-  commit. This tracked report does not claim that gate before its append-only log, actual-agent
-  cross-check, product test, clean Git boundary and credential-residue checks have all passed.
-- This report does not claim commit/tag/push, npm publication, installation into Signal or Milestone
-  4 readiness until those operations receive exact readback.
-
-Confidence is high for package behavior and the stated compatibility boundary: the final `409/409`
-run, `104/104` release check, four Signal-shaped E2E suites, package/downstream smoke, CPU-saturation,
-warm-cache and fail-closed negative cases agree. Live Signal readiness remains conditional on
-publication, exact repository-local installation, safe
-closure of the frozen Milestone 3 authority and a fresh read-only `status`/`next` observation.