codex-workflow-v2 2.0.0-beta.13.9 → 2.0.0-beta.14.1

package/references/state-machine.md

@@ -6,11 +6,11 @@ to the task commit and Brief, Plan, and evidence hashes. Final acceptance is a s
 human event bound to Result, evidence, and commit. Locks expire only diagnostically;
 removing a stale lock is always an explicit repair operation.
 
-Alpha.7 keeps canonical entity JSON unchanged at `stateSchemaVersion: 2` and adds lifecycle
-evidence through sidecars. `protocolVersion: 1` remains valid only because the alpha.7
-surface is additive and capability-advertised.
+The current execution contract uses `stateSchemaVersion: 2` and protocol 2.
+Existing sidecar evidence is verified by its bound history; it does not enable
+execution through an older package or protocol.
 
-Before execution authorization, every alpha.7 Task must have a current Plan Risk Audit bound
+Before execution authorization, every Task must have a current Plan Risk Audit bound
 to the current Brief, Plan, Knowledge Map, and exact Step set. The audit is required even when
 all Steps are unguarded, must name distinct planner/auditor actors, and must bind guarded
 failure modes to exact Step checks. Each newly recorded guarded failure mode also requires one
@@ -68,7 +68,9 @@ During initial planning, all linked Tasks may be materialized before one complet
 materialization, with explicit `discovery start` and `discovery materialize` commands. After at
 least one linked Task exists, it also exposes the closing `milestone plan-set` command. Failed navigation is fail-closed and cannot be treated as an
 expected assembly signal. After that boundary, semantic updates use human-only `milestone scope-change-prepare` and
-`milestone scope-change-apply`. A human-confirmed, expiring Milestone Autonomy Contract may
+`milestone scope-change-apply`; in delegate mode a product-intent change returns to Discovery.
+An expiring Milestone Autonomy Contract can be bound mechanically by `milestone autonomy-bind`
+from an existing sufficient grant, without issuing new authority or another Human confirmation. It may
 use `milestone autonomy-evolve` only for membership changes while outcome, success signal,
 acceptance, checks, discovery, and base branch remain fixed. It may also approve Project Memory
 only within an atomic context refresh for a Task in that Milestone; standalone map approval

package/roles/delivery-coordinator.md

@@ -3,21 +3,22 @@
 Own state transitions, dispatch envelopes, evidence collection, and recovery guidance.
 
 - Verify Project Knowledge Map freshness before Plan authorization and role dispatch.
-- After an approved knowledge change between Steps, reconcile and approve the map, perform
-  the mechanical Task knowledge rebind, and request fresh user authorization.
+- After a knowledge change between Steps, use the advertised atomic delegated context-refresh
+  without separately reconciling/approving the map first. For other changes use the eligible
+  Knowledge approval route; do not request authorization already covered by the grant.
 - Own derived map revisions and context selection, but never edit the meaning of canonical project files.
 - Treat CLI `status`, `next`, revision, and lock state as authoritative machine state.
 - Never bypass authorization, scope checks, failed validation, or stale review.
-- When `next.requiredHumanGate` is present, show every bound field and confirmation code,
-  request the user's explicit decision, and end the turn. Never call the acceptance command
-  in the same turn that produced or displayed the gate.
-- Accept a Milestone only after a later user message explicitly approves that exact
-  confirmation code, or through the exact active Milestone Autonomy Contract option. Do not
-  infer approval from a request to validate, finish, or continue.
+- In delegate mode human decisions are limited to forming/editing Discovery and issuing/expanding
+  grant. Use current eligible delegated approval options for operational gates; retain exact evidence
+  and confirmation-code bindings where Core uses them as machine input. Missing authority returns
+  to grant issuance/expansion, never an invented Human confirmation or principal identity.
+- Accept a Milestone through its exact eligible delegated option after all independent checks pass.
+  Outside delegate mode retain the explicit bound Human gate and later confirmation.
 - During initial Milestone planning, materialize the complete linked Task set and record one
   full membership Plan. When a Milestone Autonomy Contract is active, evolve only membership;
   any outcome, success-signal, acceptance, check, discovery, or base-branch change returns to
-  the human scope-change gate.
+  Discovery editing; never weaken acceptance to claim success.
 - Use the Milestone contract for Project Memory approval only through the exact atomic
   content-only Task context-refresh route; never use it for standalone map approval.
 - Dispatch one Worker at a time for a concrete Step.
@@ -52,8 +53,9 @@ Own state transitions, dispatch envelopes, evidence collection, and recovery gui
   boundaries. `wait_threads` is only the wakeup signal; always use `read_thread` for the full report
   before comparing it with Workflow state.
 - When the same Task remains nonterminal and fresh navigation provides a non-human continuation,
-  resume that same chat with `send_message_to_thread`. Ask the user only for a real human/semantic
-  gate, external permission, unrecoverable integrity conflict, or exhausted infrastructure retry.
+  resume that same chat with `send_message_to_thread`. Ask the user only to edit Discovery or
+  issue/expand grant. A genuine integrity/infrastructure/App blocker requires evidence, not a new
+  category of repeated operational approval.
   Do not create another Task chat merely because the existing one is idle or finished.
 - Do not end the Milestone coordinator turn with a dispatched nonterminal Task except at a requested
   checkpoint or genuine blocker. Record the Task/thread/host/title/cursor mapping and fresh
@@ -74,3 +76,21 @@ Own state transitions, dispatch envelopes, evidence collection, and recovery gui
   content-only option. Classification, authority, source-set, gap, or conflict changes still
   require the ordinary visible Knowledge Map flow.
 - Do not make product-scope decisions or implement production changes.
+
+## Delegate operating boundary
+
+The scoped delegation decision covers required role chats and their minimum startup/review/report
+packets, intended public one-time claim references, approved Plan checks (including their declared
+local files/containers), Core completion, and credential recovery for the same actor/Task/scope.
+Do not request these decisions again merely because revision, commit, seal or chat changed.
+Use destination model defaults unless the user explicitly selected an override. Never send vault
+secrets or claim references to unrelated recipients. Actual App/sandbox refusals remain enforceable;
+record the precise failed action and authorization mismatch, without disguising a retry or bypass.
+
+For same-scope corrective replan use the eligible `task corrective-replan-authorize` option and
+independent candidate validation/audit; it consumes the existing `task.execution_authorize` grant.
+For technical adoption use an eligible project `project.adopt` grant. Bind Milestone autonomy from
+an existing sufficient grant with `milestone autonomy-bind`; do not issue another grant implicitly.
+Preserve claims/leases, dirty bytes, completed evidence, acceptance and current receipt bindings.
+If success is unattainable, show evidence and return to Discovery. Never delete a required check,
+weaken an acceptance criterion or relabel a failed outcome as success to close work.

package/roles/scope-lead.md

@@ -3,7 +3,7 @@
 Own requirements discovery before any Task, branch, or execution artifact exists.
 
 - Scan existing repository files and propose a Project Knowledge Map before code-aware discovery.
-- Classify candidate sources and explicit gaps; never appoint a canonical source without user approval.
+- Classify candidate sources and explicit gaps; canonical source selection follows Discovery and the eligible Knowledge approval contract; do not add a separate human gate inside an existing grant.
 - Read broad approved project knowledge, treating the local map as derived metadata rather than content.
 - Separate facts, decisions, assumptions, and unknowns.
 - Ask only for missing information that changes scope, outcome, constraints, or acceptance.

package/roles/technical-planner.md

@@ -3,7 +3,7 @@
 Translate an approved Brief into an execution-ready Plan.
 
 - Read the approved knowledge sources relevant to the Task and bind the Plan to the active map revision/hash.
-- Declare `knowledgeImpact`, its reason, targets, and `graphUse`; do not hide missing knowledge as an implementation choice.
+- Declare `knowledgeImpact`, its reason, targets, and `graphUse: not-applicable` (Product graph is inactive); do not hide missing knowledge as an implementation choice.
 - Every requirement must be covered by at least one `STEP-*`.
 - Each Step declares dependencies, outputs, allowed writes, forbidden scope, and checks.
 - Perform a risk review before `plan-set`. A Plan that touches migrations, concurrent state,
@@ -17,4 +17,7 @@ Translate an approved Brief into an execution-ready Plan.
   recovery orchestration, and executable composition. Do not use arbitrary line/file limits;
   split on independently verifiable failure boundaries.
 - Do not edit production files or silently expand the Brief.
-- Return unresolved semantic choices to the user through the Delivery Coordinator.
+- Return unresolved product-intent choices to Discovery through the Delivery Coordinator.
+- Technical corrective replanning inside the approved objective and grant requires independent
+  validation/audit, not another Human confirmation. Never weaken acceptance, hide a required
+  failure-specific check, or change Discovery to make the candidate pass.

package/schemas/adoption-posture-event.schema.json

@@ -25,6 +25,17 @@
     "eventHash"
   ],
   "properties": {
+    "delegatedAuthorization": {
+      "type": "object", "additionalProperties": false,
+      "required": ["grantId", "policyHash", "principal", "delegate", "transition"],
+      "properties": {
+        "grantId": { "type": "string", "pattern": "^DGR-[0-9A-HJKMNP-TV-Z]{26}$" },
+        "policyHash": { "$ref": "#/$defs/hash64" },
+        "principal": { "type": "string", "minLength": 1 },
+        "delegate": { "type": "string", "pattern": "^agent:.+" },
+        "transition": { "const": "project.adopt" }
+      }
+    },
     "eventId": { "type": "string", "minLength": 1 },
     "projectId": { "type": "string", "pattern": "^[a-f0-9]{24}$" },
     "eventType": { "enum": ["project-registration", "adoption-apply"] },

package/schemas/authorization-event.schema.json

@@ -52,7 +52,7 @@
         "delegate": { "type": "string", "minLength": 1 },
         "transition": {
           "enum": [
-            "project_memory.approve",
+            "project.adopt", "project_memory.approve",
             "task.execution_authorize", "task.final_accept",
             "milestone.execution_authorize", "milestone.final_accept"
           ]

package/schemas/corrective-decision-event.schema.json

@@ -38,8 +38,9 @@
       "items": { "type": "string", "minLength": 1 }
     },
     "planHash": { "$ref": "#/$defs/hash64" },
-    "recoveryBasis": { "const": "plan-integrity" },
+    "recoveryBasis": { "enum": ["plan-integrity", "planning-obstruction"] },
     "planIntegrityEvidence": { "$ref": "#/$defs/planIntegrityEvidence" },
+    "planningObstructionEvidence": { "$ref": "#/$defs/planningObstructionEvidence" },
     "previousEventHash": { "$ref": "#/$defs/nullableHash64" },
     "recordedAt": { "type": "string", "format": "date-time" },
     "eventHash": { "$ref": "#/$defs/hash64" }
@@ -48,17 +49,22 @@
     {
       "if": { "properties": { "triggeringAttemptCount": { "const": 2 } }, "required": ["triggeringAttemptCount"] },
       "then": {
-        "required": ["recoveryBasis", "planIntegrityEvidence"],
+        "required": ["recoveryBasis"],
         "properties": { "decision": { "enum": ["continue-fix", "replan-required"] } }
       }
     },
     {
-      "if": { "required": ["recoveryBasis"] },
+      "if": { "properties": { "recoveryBasis": { "const": "plan-integrity" } }, "required": ["recoveryBasis"] },
       "then": {
         "required": ["planIntegrityEvidence"]
       },
       "else": { "not": { "required": ["planIntegrityEvidence"] } }
     },
+    {
+      "if": { "properties": { "recoveryBasis": { "const": "planning-obstruction" } }, "required": ["recoveryBasis"] },
+      "then": { "required": ["planningObstructionEvidence"], "properties": { "triggeringAttemptCount": { "const": 2 }, "decision": { "const": "replan-required" } } },
+      "else": { "not": { "required": ["planningObstructionEvidence"] } }
+    },
     {
       "if": {
         "properties": {
@@ -83,6 +89,20 @@
     }
   ],
   "$defs": {
+    "planningObstructionEvidence": {
+      "type": "object", "additionalProperties": false,
+      "required": ["kind", "taskRevision", "sourcePlanHash", "baselinePlanHash", "baselineAuditEventId", "baselineAuditEventHash", "obstructionAuditEventId", "obstructionAuditEventHash", "priorAuthorizationHash", "remediationEventId", "remediationEventHash", "knowledgeRebindCount", "knowledgeRebindHash"],
+      "properties": {
+        "kind": { "const": "first-failure-rebound-planning-obstruction" },
+        "taskRevision": { "type": "integer", "minimum": 1 },
+        "sourcePlanHash": { "$ref": "#/$defs/hash64" }, "baselinePlanHash": { "$ref": "#/$defs/hash64" },
+        "baselineAuditEventId": { "type": "string", "minLength": 1 }, "baselineAuditEventHash": { "$ref": "#/$defs/hash64" },
+        "obstructionAuditEventId": { "type": "string", "minLength": 1 }, "obstructionAuditEventHash": { "$ref": "#/$defs/hash64" },
+        "priorAuthorizationHash": { "$ref": "#/$defs/hash64" },
+        "remediationEventId": { "type": "string", "minLength": 1 }, "remediationEventHash": { "$ref": "#/$defs/hash64" },
+        "knowledgeRebindCount": { "type": "integer", "minimum": 1 }, "knowledgeRebindHash": { "$ref": "#/$defs/hash64" }
+      }
+    },
     "taskId": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
     "stepId": { "type": "string", "pattern": "^STEP-[0-9]{3}(?:-[A-Z0-9-]+)?$" },
     "hash64": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
@@ -234,13 +254,15 @@
           "items": {
             "type": "object", "additionalProperties": false,
             "required": ["reasonCode", "command", "runnerPath", "ownerPath", "ownerHash", "importChain", "diagnosticPath", "componentRoot"],
+            "allOf": [{ "if": { "required": ["testInvocation"] }, "then": { "properties": { "importChain": { "maxItems": 1 } } }, "else": { "properties": { "importChain": { "minItems": 2 } } } }],
             "properties": {
               "reasonCode": { "const": "FAILED_CHECK_COMPONENT_OWNER_OUTSIDE_ALLOWED_WRITES" },
               "command": { "type": "string", "minLength": 1 },
               "runnerPath": { "type": "string", "minLength": 1 },
               "ownerPath": { "type": "string", "minLength": 1 },
               "ownerHash": { "$ref": "#/$defs/hash64" },
-              "importChain": { "$ref": "#/$defs/stringList", "minItems": 2 },
+              "importChain": { "$ref": "#/$defs/stringList", "minItems": 1 },
+              "testInvocation": {"type": "object", "additionalProperties": false, "required": ["kind", "runnerHash", "argv", "migrationOutputs", "catalogNames"], "properties": {"kind": {"const": "literal-vitest-catalog"}, "runnerHash": {"type": "string", "pattern": "^[a-f0-9]{64}$"}, "argv": {"type": "array", "items": {"type": "string"}, "minItems": 3}, "migrationOutputs": {"type": "array", "items": {"type": "string"}, "minItems": 1, "uniqueItems": true}, "catalogNames": {"type": "array", "items": {"type": "string", "pattern": "^[0-9]{4}_[a-z0-9_]+\\.sql$"}, "minItems": 1, "uniqueItems": true}}},
               "diagnosticPath": { "type": "string", "minLength": 1 },
               "componentRoot": { "type": "string", "minLength": 1 }
             }

package/schemas/corrective-replan-credentials.private.schema.json

@@ -10,6 +10,7 @@
       "required": ["id", "version"],
       "properties": { "id": { "$ref": "#/$defs/id" }, "version": { "const": 1 } }
     },
+    "delegatedAuthority": {"type": "object", "additionalProperties": false, "required": ["grantId", "policyHash", "principal", "delegate", "transition", "expiresAt"], "properties": {"grantId": {"$ref": "#/$defs/id"}, "policyHash": {"$ref": "#/$defs/hash"}, "principal": {"$ref": "#/$defs/id"}, "delegate": {"$ref": "#/$defs/id"}, "transition": {"const": "task.execution_authorize"}, "expiresAt": {"type": "string", "format": "date-time"}}},
     "bindingValues": {
       "type": "object", "additionalProperties": false,
       "required": ["transitionId", "runtimeFingerprint", "catalogHash", "lifecycleEpoch", "taskId", "revision", "currentPlanHash", "briefHash", "knowledgeRevision", "knowledgeHash", "targetKnowledgeRevision", "targetKnowledgeHash", "gitHead", "guardedStepId", "correctiveDecisionEventId", "correctiveDecisionHash", "attemptCount", "remediationTailHash", "candidatePlanHash", "candidateStepSetHash", "planAuthorIdentityHash", "planValidationHash", "planValidatorIdentityHash", "riskAuditHash", "riskAuditorIdentityHash", "actorIdentityHash", "actorRole", "humanPrincipalIdentityHash", "capabilityId", "capabilityVersion"],
@@ -23,7 +24,7 @@
         "targetKnowledgeRevision": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
         "targetKnowledgeHash": { "$ref": "#/$defs/hash" }, "gitHead": { "type": "string", "pattern": "^(?:[a-f0-9]{40}|[a-f0-9]{64})$" },
         "guardedStepId": { "$ref": "#/$defs/id" }, "correctiveDecisionEventId": { "$ref": "#/$defs/id" },
-        "correctiveDecisionHash": { "$ref": "#/$defs/hash" }, "attemptCount": { "type": "integer", "minimum": 2, "maximum": 9007199254740991 },
+        "correctiveDecisionHash": { "$ref": "#/$defs/hash" }, "attemptCount": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 },
         "remediationTailHash": { "$ref": "#/$defs/hash" }, "candidatePlanHash": { "$ref": "#/$defs/hash" },
         "candidateStepSetHash": { "$ref": "#/$defs/hash" }, "planAuthorIdentityHash": { "$ref": "#/$defs/hash" },
         "planValidationHash": { "$ref": "#/$defs/hash" }, "planValidatorIdentityHash": { "$ref": "#/$defs/hash" },
@@ -45,10 +46,10 @@
           "required": ["id", "version", "issuer", "source", "scope", "delegation"],
           "properties": {
             "id": { "const": "capability.task.corrective-replan" }, "version": { "const": 1 },
-            "issuer": { "type": "object", "additionalProperties": false, "required": ["kind", "identityHash"], "properties": { "kind": { "const": "human" }, "identityHash": { "$ref": "#/$defs/hash" } } },
-            "source": { "const": "human-confirmation" },
+            "issuer": { "type": "object", "additionalProperties": false, "required": ["kind", "identityHash"], "properties": { "kind": { "enum": ["human", "delegate"] }, "identityHash": { "$ref": "#/$defs/hash" } } },
+            "source": { "enum": ["human-confirmation", "delegation-grant"] },
             "scope": { "type": "object", "additionalProperties": false, "required": ["transitionId", "taskId", "candidatePlanHash", "manifestSha256"], "properties": { "transitionId": { "const": "task.plan.corrective-replan" }, "taskId": { "$ref": "#/$defs/id" }, "candidatePlanHash": { "$ref": "#/$defs/hash" }, "manifestSha256": { "$ref": "#/$defs/hash" } } },
-            "delegation": { "const": "forbidden" }
+            "delegation": { "oneOf": [{ "const": "forbidden" }, { "$ref": "#/$defs/delegatedAuthority" }] }
           }
         },
         "bindingSha256": { "$ref": "#/$defs/hash" }
@@ -82,10 +83,12 @@
     "receiptValidation": { "type": "object", "additionalProperties": false, "required": ["attestationId", "attestationHash", "planValidationHash", "snapshotBindingHash", "planAuthorIdentityHash", "planValidatorIdentityHash", "findingsHash", "dispositionsHash", "validatedAtMs", "expiresAtMs"], "properties": { "attestationId": { "$ref": "#/$defs/id" }, "attestationHash": { "$ref": "#/$defs/hash" }, "planValidationHash": { "$ref": "#/$defs/hash" }, "snapshotBindingHash": { "$ref": "#/$defs/hash" }, "planAuthorIdentityHash": { "$ref": "#/$defs/hash" }, "planValidatorIdentityHash": { "$ref": "#/$defs/hash" }, "findingsHash": { "$ref": "#/$defs/hash" }, "dispositionsHash": { "$ref": "#/$defs/hash" }, "validatedAtMs": { "$ref": "#/$defs/time" }, "expiresAtMs": { "$ref": "#/$defs/time" } } },
     "correctiveReplanReceiptV1": {
       "type": "object", "additionalProperties": false,
-      "required": ["schemaVersion", "receiptId", "domain", "binding", "validation", "audit", "human", "supersession", "issuedAtMs", "expiresAtMs", "domainHash", "receiptHash"],
+      "oneOf": [{ "required": ["human"], "properties": { "human": {}, "delegated": false } }, { "required": ["delegated"], "properties": { "delegated": {}, "human": false } }],
+      "required": ["schemaVersion", "receiptId", "domain", "binding", "validation", "audit", "supersession", "issuedAtMs", "expiresAtMs", "domainHash", "receiptHash"],
       "properties": {
         "schemaVersion": { "const": 1 }, "receiptId": { "$ref": "#/$defs/id" }, "domain": { "const": "codex-workflow/corrective-replan-receipt/v1" }, "binding": { "$ref": "#/$defs/correctiveReplanBindingV1" }, "validation": { "$ref": "#/$defs/receiptValidation" },
         "audit": { "type": "object", "additionalProperties": false, "required": ["riskAuditHash", "riskAuditorIdentityHash"], "properties": { "riskAuditHash": { "$ref": "#/$defs/hash" }, "riskAuditorIdentityHash": { "$ref": "#/$defs/hash" } } },
+        "delegated": { "type": "object", "additionalProperties": false, "required": ["authority", "authorizedAtMs"], "properties": { "authority": { "$ref": "#/$defs/delegatedAuthority" }, "authorizedAtMs": { "$ref": "#/$defs/time" } } },
         "human": { "type": "object", "additionalProperties": false, "required": ["challengeId", "challengeHash", "humanPrincipalIdentityHash", "confirmedAtMs"], "properties": { "challengeId": { "$ref": "#/$defs/id" }, "challengeHash": { "$ref": "#/$defs/hash" }, "humanPrincipalIdentityHash": { "$ref": "#/$defs/hash" }, "confirmedAtMs": { "$ref": "#/$defs/time" } } },
         "supersession": { "type": "object", "additionalProperties": false, "required": ["priorGrantHash", "disposition"], "properties": { "priorGrantHash": { "$ref": "#/$defs/hash" }, "disposition": { "const": "superseded" } } },
         "issuedAtMs": { "$ref": "#/$defs/time" }, "expiresAtMs": { "$ref": "#/$defs/time" }, "domainHash": { "$ref": "#/$defs/hash" }, "receiptHash": { "$ref": "#/$defs/hash" }

package/schemas/corrective-replan-execution-event.private.schema.json

@@ -42,6 +42,15 @@
     "planRiskAuditEventHash": { "$ref": "#/$defs/hash" },
     "actorIdentityHash": { "$ref": "#/$defs/hash" },
     "humanPrincipalIdentityHash": { "$ref": "#/$defs/hash" },
+    "delegatedAuthority": {
+      "type": "object", "additionalProperties": false,
+      "required": ["grantId", "policyHash", "principal", "delegate", "transition", "expiresAt"],
+      "properties": {
+        "grantId": { "type": "string", "minLength": 1 }, "policyHash": { "$ref": "#/$defs/hash" },
+        "principal": { "type": "string", "minLength": 1 }, "delegate": { "type": "string", "minLength": 1 },
+        "transition": { "const": "task.execution_authorize" }, "expiresAt": { "type": "string", "format": "date-time" }
+      }
+    },
     "priorGrantHash": { "$ref": "#/$defs/hash" },
     "taskStateSha256": { "$ref": "#/$defs/hash" },
     "planBytesSha256": { "$ref": "#/$defs/hash" },

package/schemas/corrective-replan-public.schema.json

@@ -10,6 +10,7 @@
       "additionalProperties": false,
       "required": ["plan", "validation", "riskAudit", "authority"],
       "properties": {
+        "delegation": { "type": "object", "additionalProperties": false, "required": ["grantId", "actor"], "properties": { "grantId": { "$ref": "#/$defs/id" }, "actor": { "$ref": "#/$defs/id" } } },
         "plan": { "$ref": "https://codex-workflow.local/schemas/transition-payloads.schema.json#/$defs/taskPlanInput" },
         "validation": {
           "type": "object",
@@ -69,7 +70,7 @@
       "additionalProperties": false,
       "required": ["kind", "version", "taskId", "preparedAtMs", "expiresAtMs", "candidatePlanHash", "bindingSha256", "attestationId", "attestationHash", "challengeId", "runtimeFingerprint", "catalogHash", "lifecycleEpoch", "preparationSha256"],
       "properties": {
-        "kind": { "const": "corrective-replan-human-gate" },
+        "kind": { "enum": ["corrective-replan-human-gate", "corrective-replan-delegated-binding"] },
         "version": { "const": 1 },
         "taskId": { "$ref": "#/$defs/id" },
         "preparedAtMs": { "$ref": "#/$defs/time" },

package/schemas/delegation-grant.schema.json

@@ -54,7 +54,7 @@
       "uniqueItems": true,
       "items": {
         "enum": [
-          "project_memory.approve",
+          "project.adopt", "project_memory.approve",
           "task.execution_authorize", "task.final_accept",
           "milestone.execution_authorize", "milestone.final_accept"
         ]

package/schemas/project-knowledge-map.schema.json

@@ -4,12 +4,14 @@
   "title": "Codex Workflow V2 Project Knowledge Map",
   "type": "object",
   "additionalProperties": false,
-  "required": ["schemaVersion", "revision", "id", "projectId", "kind", "status", "entries", "gaps", "conflicts", "approval"],
+  "required": ["schemaVersion", "revision", "id", "projectId", "createdAt", "updatedAt", "kind", "status", "entries", "gaps", "conflicts", "approval"],
   "properties": {
     "schemaVersion": { "const": 2 },
     "revision": { "type": "integer", "minimum": 1 },
     "id": { "const": "PROJECT-KNOWLEDGE-MAP" },
     "projectId": { "type": "string", "pattern": "^[a-f0-9]{24}$" },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "updatedAt": { "type": "string", "format": "date-time" },
     "kind": { "const": "knowledge-map" },
     "status": { "enum": ["draft", "awaiting_approval", "active", "stale", "conflicted"] },
     "entries": {

package/schemas/remediation-event.schema.json

@@ -33,7 +33,16 @@
         "reviewEventHash": { "$ref": "#/$defs/nullableHash64" },
         "reviewerAttestationHash": { "$ref": "#/$defs/nullableHash64" },
         "executionTaskRevision": { "type": "integer", "minimum": 1 },
-        "dirtyWorktreeHash": { "$ref": "#/$defs/hash64" }
+        "dirtyWorktreeHash": { "$ref": "#/$defs/hash64" },
+        "unclaimedExecutionBoundary": {
+          "type": "object", "additionalProperties": false,
+          "required": ["kind", "actor", "priorHandoffEventHash"],
+          "properties": {
+            "kind": { "const": "native-unclaimed-check-failure" },
+            "actor": { "type": "string", "minLength": 1 },
+            "priorHandoffEventHash": { "$ref": "#/$defs/nullableHash64" }
+          }
+        }
       }
     },
     "attemptOrdinal": { "type": "integer", "minimum": 1 },

package/schemas/task.schema.json

@@ -26,6 +26,17 @@
         "cancelled"
       ]
     },
+    "pendingBaseSyncValidation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["baseCommit", "syncCommit", "checksHash", "headCommit"],
+      "properties": {
+        "baseCommit": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+        "syncCommit": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+        "headCommit": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+        "checksHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+      }
+    },
     "title": { "type": "string", "minLength": 1 },
     "planObjective": { "type": ["string", "null"] },
     "knowledgeImpact": { "enum": ["none", "update", "create", "retire", null] },
@@ -197,6 +208,12 @@
             "type": "object",
             "required": ["stepId", "planHash", "conflictHash", "dirtyFiles", "dirtyWorktreeHash", "remediationEventIds"],
             "properties": {
+              "mode": { "enum": ["failed-step-conflict", "post-rebind-scope-adoption", "post-rebind-dirty-carryover", "navigation-fix-dirty-carryover"] },
+              "scopeExtensions": {
+                "type": "array",
+                "uniqueItems": true,
+                "items": { "type": "string", "minLength": 1 }
+              },
               "stepId": { "type": "string", "pattern": "^STEP-[A-Z0-9][A-Z0-9-]{2,63}$" },
               "planHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
               "conflictHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
@@ -216,6 +233,24 @@
             },
             "additionalProperties": false
           },
+          "failedCheckpoint": {
+            "type": "object",
+            "required": ["protocol", "sourceHead", "sourcePlanHash", "stepId", "sourceDirtyHash", "targetDirtyHash", "dirtyFiles", "remediationEventId", "remediationEventHash", "sourceReceiptHash", "artifactHash"],
+            "properties": {
+              "protocol": { "const": "failed-checkpoint-update-v1" },
+              "sourceHead": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+              "sourcePlanHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "stepId": { "type": "string", "pattern": "^STEP-[A-Z0-9][A-Z0-9-]{2,63}$" },
+              "sourceDirtyHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "targetDirtyHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "dirtyFiles": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+              "remediationEventId": { "type": "string", "pattern": "^RME-[0-9A-HJKMNP-TV-Z]{26}$" },
+              "remediationEventHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "sourceReceiptHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "artifactHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+            },
+            "additionalProperties": false
+          },
           "rootCauseReplan": {
             "type": "object",
             "required": [
@@ -255,8 +290,17 @@
               "terminalRemediationEventHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
               "terminalExecutionTaskRevision": { "type": "integer", "minimum": 1 },
               "repeatedCauseFingerprint": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
-              "correctiveYieldEventId": { "type": "string", "pattern": "^HOF-[a-f0-9]{64}$" },
-              "correctiveYieldEventHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "correctiveYieldEventId": { "type": ["string", "null"], "pattern": "^HOF-[a-f0-9]{64}$" },
+              "correctiveYieldEventHash": { "type": ["string", "null"], "pattern": "^[a-f0-9]{64}$" },
+              "unclaimedExecutionBoundary": {
+                "type": "object", "additionalProperties": false,
+                "required": ["kind", "actor", "priorHandoffEventHash"],
+                "properties": {
+                  "kind": { "const": "native-unclaimed-check-failure" },
+                  "actor": { "type": "string", "minLength": 1 },
+                  "priorHandoffEventHash": { "type": ["string", "null"], "pattern": "^[a-f0-9]{64}$" }
+                }
+              },
               "dirtyFiles": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
               "dirtyWorktreeHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
               "replacementPlanRiskAuditEventId": { "type": "string", "pattern": "^PRA-[0-9A-HJKMNP-TV-Z]{26}$" },
@@ -269,6 +313,11 @@
               "claimant": { "type": "string", "minLength": 1 },
               "compatibilityHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
             },
+            "allOf": [{
+              "if": { "required": ["unclaimedExecutionBoundary"] },
+              "then": { "properties": { "correctiveYieldEventId": { "type": "null" }, "correctiveYieldEventHash": { "type": "null" } } },
+              "else": { "properties": { "correctiveYieldEventId": { "type": "string" }, "correctiveYieldEventHash": { "type": "string" } } }
+            }],
             "additionalProperties": false
           }
         },
@@ -277,6 +326,19 @@
     }
   },
   "allOf": [
+    {
+      "if": { "required": ["pendingBaseSyncValidation"] },
+      "then": {
+        "required": ["workspaceOwner", "evidenceHash", "resultHash", "review"],
+        "properties": {
+          "status": { "const": "validating" },
+          "workspaceOwner": { "const": "local" },
+          "evidenceHash": { "type": "null" },
+          "resultHash": { "type": "null" },
+          "review": { "properties": { "status": { "const": "pending" } } }
+        }
+      }
+    },
     {
       "if": {
         "properties": { "productionEdges": { "minItems": 1 } },

package/schemas/transition-definition.schema.json

@@ -296,6 +296,7 @@
           "credential-verifier.corrective-replan.receipt@1"
         ],
         "delegationPolicies": [
+          "delegation.corrective-execution-exact@1",
           "delegation.forbidden@1"
         ],
         "effectAdapters": [
@@ -360,6 +361,7 @@
           "ownership.corrective-replan-clear@1"
         ],
         "principalBases": [
+          "principal-basis.bound-corrective-authority@1",
           "principal-basis.human-confirmation@1"
         ],
         "projections": [
@@ -763,6 +765,7 @@
       "properties": {
         "id": {
           "enum": [
+            "principal-basis.bound-corrective-authority",
             "principal-basis.human-confirmation"
           ]
         },
@@ -835,6 +838,7 @@
       "properties": {
         "id": {
           "enum": [
+            "delegation.corrective-execution-exact",
             "delegation.forbidden"
           ]
         },

package/schemas/transition-payloads.schema.json

@@ -20,7 +20,22 @@
         "knowledgeMapRevision": { "type": "integer", "minimum": 0 },
         "knowledgeMapHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
         "graphUse": { "enum": ["code-aware", "not-applicable"] },
-        "steps": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/planStep" } }
+        "steps": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/planStep" } },
+        "requiresProductionEdges": { "type": "boolean" },
+        "productionEdges": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "object",
+            "required": ["ownerStepId", "consumerStepId", "checkRef"],
+            "properties": {
+              "ownerStepId": { "type": "string", "pattern": "^STEP-[0-9]{3}(?:-[A-Z0-9-]+)?$" },
+              "consumerStepId": { "type": "string", "pattern": "^STEP-[0-9]{3}(?:-[A-Z0-9-]+)?$" },
+              "checkRef": { "type": "string", "minLength": 1 }
+            },
+            "additionalProperties": false
+          }
+        }
       },
       "additionalProperties": false
     },