codex-workflow-v2 2.0.0-beta.13 → 2.0.0-beta.13.10

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -92,6 +92,109 @@ active writer token when the C1 contract requires it. The recovery records only
 `task run` merely to manufacture the second failure, and never invoke this recovery for a generic
 test failure, a writable manifest, or unconfined changes.
 
+When fresh `next` includes `preExecutionReplanOption.state=eligible`, an independent Plan auditor
+may stop a `ready` Task before its next Step because the current implementation Plan is obstructed.
+Use only `task preexecution-replan` with the exact advertised Task revision, Brief hash, Plan hash,
+current Plan Risk Audit event hash, and HEAD. The audit file must be a genuine independent
+`stop-escalate` replacement audit: its planner remains the original planner, its auditor is the
+transition actor, and it retains current guarded categories, review requirements, failure modes,
+evidence commands, and proof bindings while recording the obstruction. This transition requires a
+clean checkout with no Step in progress, C1 posture, or writer lease. It appends immutable audit and
+provenance records, supersedes only current execution authorization, preserves completed Step
+authority and existing delegation scope, and does not require a new approval. After success, run
+sequential `status` then `next`; Core must advertise ordinary `task plan-set`, not audited-remediation
+topology. Submit a semantically changed Plan with the exact Task objective, requirements, and
+acceptance, preserve completed Steps and prior safety boundaries, attach a fresh Plan Risk Audit,
+then obtain fresh execution authorization. Never append an approved audit to the unchanged Plan,
+rebind context around the marker, invent a failure/corrective cause, or invoke the command when the
+option is absent or blocked.
+
+For this route, Core treats each `(Step ID, failureMode, evidence)` tuple as the immutable proof
+binding. It does not claim to understand whether revised `counterexample` or `expectedResult` prose
+is semantically stronger. Changing that prose therefore requires an independent
+`approved-with-rationale` audit, a changed substantive summary, and an explicit rationale; the
+earlier audit remains immutable history for human review.
+
+When the exact beta.13.6 package reports validated root-cause corrective-replan dirty
+carryover, the retained work belongs to a previously failed execution of the same Task.
+Use the fresh advertised `task run` only with the current writer credential and exact
+Task/Step bindings. Core must verify the repeated mechanical cause, historical Plan,
+replacement Plan and independent PRA, authorization, completed evidence, HEAD, dirty
+paths and content hash. Every retained path must already be allowed by the new Step
+and remain outside forbidden scope. A changed binding or blocked assessment is a hard
+stop; never clean, stash, reset, manually commit, or edit state to make it eligible.
+
+The beta.13.8 consumed-carryover compatibility profile also permits the exact
+published external beta.13.8 runner to execute only the read-only
+`update corrective-carryover-preflight --id <TASK-ID>` against a coherent beta.13.6
+repository. A completed, verified Step's carryover remains historical evidence;
+it must not override a later Step's repeated-cause recovery route.
+
+When `sourceRecovery.eligible=true`, execute only its exact `action` with the
+repository-installed beta.13.6 CLI. This narrow compatibility response, not the
+old source `next`, authorizes the source navigation repair. It may expose only
+`task plan-set`, `task handoff-prepare`, or `task claim`, bound to the current
+Task revision, Plan, completed history, terminal failure HEAD/dirty hash and
+corrective-yield actor. For Plan replacement, prepare the exact candidate Plan
+and independent PRA files, then pass them as `--file` and `--risk-audit-file`
+to this read-only preflight. Without both inputs no source mutation is authorized.
+Require the returned candidate Plan and input hashes; execute source `task plan-set`
+with those same unchanged files and verify its resulting Plan hash. Core rejects
+candidate inputs that omit or alter any completed Step before source mutation.
+Source execution
+authorization retains its ordinary human or exact eligible delegation gate.
+Use only the returned original Worker for handoff and claim. After every source
+mutation run source `status` then `next`, and repeat the target preflight before
+another compatibility action. `sourceRecovery` never authorizes transport or
+`task run`; top-level `eligible` remains false until transport itself is proved.
+
+Once the replacement Plan is authorized and that same Worker has claimed it,
+the preflight may expose the exact expired-lease repair described below. Never
+force-release a live lease. Require a fresh top-level `eligible=true` before
+dependency transport. beta.13.8 accepts one dependency-only commit on each of
+the Task and Milestone base, with the same exact source beta.13.6 and target
+beta.13.8. After installing the target, use its ordinary advertised
+dependency provenance recovery, atomic context refresh and original-Worker
+credential recovery. This profile permits no external state mutation, installed
+code patch, wider product commit, changed dirty bytes, or approval substitution.
+
+The exact beta.13.9 runner supports the same bounded consumed-carryover profile
+with beta.13.6 as its source and beta.13.9 as its pinned target. Require the
+returned version bindings and all the same source-recovery and transport proofs.
+Historical beta.13.8 evidence is not proof for a beta.13.9 invocation.
+
+The historical beta.13.7 runner retains its own exact beta.13.6-to-beta.13.7 profile.
+The current beta.13.8 profile does not admit a beta.13.7 source or an in-progress
+Step and cannot be used to bypass the ordinary safe update boundary.
+
+The historical beta.13.6 corrective-carryover update compatibility profile permits its exact
+external runner to execute only the read-only
+`update corrective-carryover-preflight --id <TASK-ID>` against a repository coherently
+pinned to beta.13.5. This is an explicit compatibility inspection, not permission to
+run ordinary transitions with an external or unpublished package. An active writer
+lease blocks transport. Wait for natural expiry. The target compatibility preflight
+may then return only an exact source-package stale-lease repair, after validating the
+sole expired Task lease, its original claimant, Task/Plan/PRA/authorization/HEAD and
+dirty-work bindings. This narrowly scoped preflight action is the authority for that
+source-package repair; do not describe it as an action advertised by the old source
+`next`. An active lease, another lease or any other blocker forbids the repair and
+transport. Never force-release a live lease. Preserve the original C1 claimant and
+hash-bound ownership event, log the preflight and exact repair, then run sequential
+source `status` and `next` and repeat the target preflight.
+
+After repair, require a fresh preflight with `eligible=true`, no blockers, and exact
+Task revision, source HEAD, replacement Plan/PRA/authorization, dirty paths/hash and
+original C1 ownership. Transport only the exact target dependency in `package.json`
+and `package-lock.json`: one commit on the Milestone base in a separate worktree and
+one at Task HEAD, leaving every product byte unchanged. Install the repository-local
+target, then follow fresh navigation through the existing
+`update dependency-provenance-recover` only when it advertises the matching carryover
+binding. Use current bounded credential recovery for the original Worker, and obtain
+fresh validated carryover before `task run`. Unknown history, wider commits, version
+misalignment, changed product bytes, different ownership, pending operations or missing
+bindings stop the update. This profile creates no scope or approval authority and does
+not authorize editing the installed package or Workflow state files.
+
 When fresh `next` advertises `task downstream-proof-recover`, the active proof Step has produced
 uncommitted files inside its own `allowedWrites` and has also exposed required changes owned by one
 or more completed transitive predecessor Steps. Do not invoke `task step-complete`: its scope is
@@ -278,22 +381,32 @@ because the sandboxed call returned a permission error; those actions require th
 authorization and evidence.
 
 When `next` includes `writerTokenContract`, treat it as an exact first-call precondition. Retain
-the active writer lease from the first-field `writerLeaseReceipt` returned by `task run` and pass it using the advertised `option` for that
-transition. The token is sensitive: never print, summarize, persist, or substitute a redacted
-fingerprint. Stop before mutation if the active lease is unavailable. This input contract is
-independent from `gitMutationPolicy`; satisfy both when both are present.
-
-On successful `task handoff-prepare`, consume the first-field `credentialHandoff` before reading
-the Task/event/bundle payload. Retain its one-time token only in working memory and use it exactly
-once with the declared `action` and `option` for the declared `targetActor`. Successful `task claim`
-returns a first-field `writerLeaseReceipt`; retain that lease and pass it to claimed `task run` when
-the fresh `next.writerTokenContract` requires it. Successful `task run` returns the refreshed
-`writerLeaseReceipt`; retain it only until Core releases that lease.
-Never search later payload fields for either credential and never copy credentials into evidence.
+the `writerCredentialReference` returned by `task run`, `task claim`, or
+`task writer-credential-replace`, including its public `credentialRef`, actor, allowed actions and
+`expiresAt`. Pass the reference using the advertised `--writer-credential-ref` option. The secret
+stays in the local vault: never read, print, copy, or edit vault records or substitute a redacted
+token. This input contract is independent from `gitMutationPolicy`; satisfy both when present.
+
+Before every credential-consuming mutation, especially after an independent review or a pause,
+compare the held reference's `expiresAt` with the current time and verify its actor/action binding.
+A live or renewed lease does not extend an existing reference's expiry; `reuse-reference` is not
+permission to reuse an expired reference. If the reference is expired, missing, consumed, or its
+validity cannot be established, use only the simultaneously advertised
+`next.writerCredentialRecovery` action with its exact Task, revision and `requiredActor` before
+attempting the blocked mutation. Follow successful replacement with `status` then `next`, retain
+the newly returned reference and expiry, and discard the prior reference. If recovery is not
+advertised, stop before mutation. Never extend expiry manually or retry with the old reference.
+
+Successful `task handoff-prepare` returns a one-time `claimCredentialReference`; use its
+`credentialRef` with the declared `--claim-credential-ref` option for `task claim` and the bound
+actor. Successful claim consumes that reference. A renewed claim/run may return
+`writerCredential.disposition=renewed` without a new reference; the held reference must still
+satisfy its own expiry and binding checks. Never search later payload fields for raw tokens and
+never copy credentials into evidence.
 
 When a passed final Task review routes to `task result-set`, pass the active writer credential and,
 for claimed C1 posture, the exact claimant as `--actor`. A successful `result-set` consumes that
-execution lease before entering `awaiting_final_acceptance`; never reuse the old token and never
+execution lease before entering `awaiting_final_acceptance`; never reuse the old reference and never
 leave or manufacture a lease while waiting for the Human decision. After `task accept`, follow fresh
 `next`: local merge or external merge confirmation normally advertises
 `task writer-credential-replace`, which acquires a new bounded lease for the exact recovery actor.
@@ -319,9 +432,11 @@ A Milestone chat and its Task chats are separate user-visible execution contexts
 conversation. Create every Task chat as a brand-new Codex task with `create_thread`, an explicit
 Task-only prompt, and an explicit title. Never use `fork_thread`, thread handoff, or a continuation
 of the Milestone chat to create a Task chat: those paths carry parent history into the child. A
-failure to create a new task is a routing blocker. Check the thread list for an already-created
-exact Task ID, retry `create_thread` once sequentially when none exists, and then stop; never fall
-back to a fork.
+confirmed failure to create a new task is a routing blocker. A pending `clientThreadId`, timeout,
+lost response, or absence from `list_threads` does not establish failure and never permits a
+second creation. Persist the attempt before calling the App, resolve its actual ID and confirm
+it with `read_thread`; never fall back to a fork. Read and follow
+`../../references/chat-dispatch.md` for the executable dispatch/recovery and model-selection contract.
 
 Codex App may wrap the supplied prompt in a host-generated `codex_delegation` envelope containing
 only routing provenance such as `source_thread_id`. That envelope is permitted and is not parent
@@ -366,6 +481,22 @@ chat type, Milestone/Task/Step membership ordinals, semantic title, authoritativ
 review attempt. Use returned `requestedTitle` verbatim. Never derive its prefix from
 `list_threads`, sidebar order, a count, or `count + 1`: allocation atomically reserves the
 project-wide monotonically increasing `#NNN`, and an abandoned number is never reused.
+Allocation reuses an existing matching reservation. For a new dispatch, call `dispatch-begin`
+with the closed packet and explicit model request, then call the App exactly once only when
+`createAllowed=true`, using returned `createArgs` unchanged. Record the full result via
+`dispatch-result`, resolve/read back via `dispatch-discover` and `dispatch-observe`, and bind.
+After restart use `dispatch-status`; an unresolved creation cannot be abandoned to create another.
+For legacy reservations without a dispatch marker, first reconcile existing App/source evidence;
+absence of the new marker does not prove no earlier creation occurred.
+
+When the user authorizes model selection, use the versioned role/phase/complexity matrix rather
+than coordinator inheritance. Both `model` and App `thinking` must be explicit in create arguments.
+Use the destination host's current supported model/effort catalog; no guessed aliases or silent
+fallback. Before a materially different phase, `model-select` returns explicit follow-up settings
+for the same bound thread. Routine lifecycle work should not retain planning/review reasoning by
+accident; security-sensitive and complex work must not be classified as routine to save tokens.
+Without user authorization for model selection, do not manufacture it from a registry field;
+resolve that policy choice before starting a new dispatch.
 
 The builder owns these compact title families; callers must not hand-compose variants:
 
@@ -387,7 +518,7 @@ Put `#NNN` and membership ordinals first so clipped sidebar titles remain distin
 inherit the parent title, use a generic title such as `Milestone recovery` / `Task execution`, or
 reuse one title for different entity IDs. Maintain the registry-backed
 `Task ID -> thread ID -> title` mapping in
-the Milestone chat. Before dispatch, verify from the thread list that the title contains the exact
+the Milestone chat. Before supervision, verify from actual `read_thread` evidence that the title contains the exact
 ordinal and entity ID, is unique, and the new chat input contains only its TaskContextPacket plus
 the permitted host routing envelope. Never trust the `create_thread` title argument without a
 readback: pass the observed title to registry `readback`. If it returns `renameRequired=true`,
@@ -396,6 +527,12 @@ compact the role while preserving `#NNN`, membership ordinals, attempt, and the
 Never invent another fallback or abbreviate the ID. Bind the verified entry to `threadId` and
 `hostId`; if all candidates fail, mark it blocked and stop routing. Visual sidebar clipping is
 harmless only when exact API readback still matches. Do not dispatch while title/context is wrong.
+Persist the single supervisor, cursor and next action using `supervision-record`. Large tool/CLI
+JSON must be saved completely to a private local file and parsed there, with only bounded non-secret
+summaries printed. For an uncertain mutation outcome, run fresh `status -> next` before recovery;
+never replay a mutation merely because displayed output was truncated. Review the exact serialized
+external-review envelope passed to Core, not a separately reconstructed object. Public CREF expiry
+is independent of lease expiry and must be checked before every credential-consuming transition.
 
 After every significant Task Step boundary—completion, failure, block, skip, sealed-review result,
 or corrective decision—the Task chat prints a compact Task progress Markdown table from fresh
@@ -525,10 +662,20 @@ delegable only through an explicit project-scoped `project_memory.approve` permi
 changes, grant issuance, and grant expansion are never delegated by `delegated-approval-v1`.
 
 For an entire Milestone, prefer one bounded `milestone autonomy-prepare` gate after the complete
-initial membership Plan exists. Show principal, delegate, expiry, semantic-scope hash, policy
+initial membership Plan exists. An explicitly human-requested full contract may also be prepared
+for an `active` Milestone, including after a previous contract expired or was revoked. This is
+new issuance, never automatic renewal. Fresh Task-first or repository `next` may expose
+`activeMilestoneAutonomyOptions`; these are optional preparation routes and do not replace the
+current Task action. Preparation still requires coherent state and active Project Knowledge.
+A generic grant does not become a full contract and is not automatically revoked. A still-valid
+full contract must first be explicitly revoked by its principal before a different one is issued.
+The new confirmation binds the current Milestone status, revision, Plan, semantic scope, policy,
+and previous contract/grant state; any change requires preparation and confirmation again.
+An exact successful retry returns the same grant; an old code cannot revive a revoked grant. Show principal, delegate, expiry, semantic-scope hash, policy
 hash, and `MAC-*` code, then stop. A later exact approval permits `milestone autonomy-grant`.
 Use the delegated path only when the same `next` response exposes
-`milestoneAuthorizationOptions[].action = "milestone autonomy-prepare"` and the user explicitly
+`milestoneAuthorizationOptions[].action = "milestone autonomy-prepare"` or an
+`activeMilestoneAutonomyOptions` entry for that exact Milestone, and the user explicitly
 requested delegated Milestone operation; otherwise follow the ordinary `milestone authorize`
 human gate.
 The resulting grant covers the existing Task/Milestone approval transitions and the Project
@@ -540,6 +687,18 @@ only for membership changes; any change to outcome, success signal, acceptance,
 discovery, or base branch requires the ordinary human scope-change gate. Never self-renew or
 replace the contract.
 
+When fresh `next` advertises `task corrective-decision` with
+`planningRecovery.authority = "planning-only"`, a started failed Step has a current
+blocking audit after a Knowledge-only Plan rebind. Core proves the historical approved
+safety baseline; the stopped audit does not authorize execution. Obtain the independent
+corrective decision against the returned bindings and preserve the exact original Worker
+credential/yield prerequisites. Follow the existing human-confirmed corrective-replan
+route, then fresh replacement Plan authorization. Never approve the obstructed Plan merely
+to unlock navigation, use ordinary `plan-set` to bypass the corrective gate, or create an
+upstream remediation Task for this already-started posture. `continue-fix` is unavailable
+for this planning-only route. A package update can require another Knowledge rebind and
+fresh blocking audit; do not rewrite or silently reuse a stale audit.
+
 Repeated failed Task reviews remain on the same Task and do not require a separate corrective
 Plan audit based only on count. Follow fresh `next`: ordinary findings default to `route=fix`;
 `route=replan` is valid only with the exact Plan clause, obstruction, and minimal Plan change
@@ -552,7 +711,13 @@ When `next.strictStepReview.recommendedMode` is `external-sealed`, do not launch
 reviewer from inside a Codex App sandbox. Run the advertised read-only `task step-review-packet`,
 create a separate user-visible reviewer chat for that exact packet, and require one closed
 `ReviewInput` JSON result bound to its reviewed commit. The reviewer must not modify repository or
-Workflow state. Then run only the advertised `task step-review-record` with the unchanged packet
+Workflow state. The `--file` passed to `task step-review-record` must be the full
+`ExternalStrictStepReviewInput` envelope: top-level `protocol`, `packetHash`,
+`repositorySealHash`, `reviewerThreadId`, and `reviewMode` (`ordinary` or `security`), plus the
+nested `review` object containing `status`, `reviewer`, `summary`, and `findings`. Copy both hashes
+and the mode from the packet; do not flatten `review`, and do not pass `--review-mode` to the record
+command because it reads the mode from the JSON file. Run `task step-review-record --help` for a
+complete minimal example. Then run only the advertised `task step-review-record` with the unchanged packet
 and repository-seal hashes, the separate reviewer thread ID, the lifecycle actor from `next`, and
 the active writer token when required. Never author the independent review in the Worker or
 Delivery Coordinator chat, never alter the packet, and never treat an unverified local reviewer
@@ -563,7 +728,11 @@ When `next.strictTaskReview.recommendedMode` is `external-sealed`, apply the sam
 the final submitted-Task review. Run the advertised read-only `task review-packet`, send the exact
 packet to a separate user-visible Independent Reviewer chat, and accept only a closed `ReviewInput`
 bound to the unchanged packet and repository-seal hashes. Record it only through the advertised
-`task review-sealed-record`, using the lifecycle actor from `next` and the active writer token when
+`task review-sealed-record`. Its `--file` must be the analogous full
+`ExternalStrictTaskReviewInput` envelope using protocol
+`codex-workflow-external-strict-task-review-v1`, the packet and repository-seal hashes,
+`reviewerThreadId`, top-level `reviewMode`, and nested `review`; its `--help` contains a minimal
+example. Use the lifecycle actor from `next` and the active writer token when
 required. Do not call `task review-launch` from inside a Codex App sandbox, do not use the Worker or
 Delivery Coordinator as reviewer, and discard the result if a fresh packet changes either hash.
 
@@ -571,6 +740,19 @@ When `next` returns a derived C1 Worker or corrective Auditor actor, use that ex
 asking the user to name one. Derivation removes a routing pause; handoff claim, writer lease,
 strict review, and auditor-independence checks remain mandatory.
 
+The beta.13.2 pending strict-review update exception is documented in
+`docs/pending-review-update.md` in the exact package. An exact external target runner may run
+only `update pending-review-source-preflight` against the known beta.13.1 source. Require its
+verified runtime build, exact Task/revision/Plan/HEAD/pending binding and no blockers. If it
+returns an exact stale Task lease repair, run that `locks repair` with the installed source and
+repeat preflight. Preserve the eligible receipt outside the checkout; transport only the two
+bound dependency commits on base and Task, then install the target locally. Fresh local `next`
+must advertise `update pending-review-dependency-recover`; run its matching read-only preflight
+with `--file <source-receipt>` before recovery. Recovery does not approve Knowledge or review.
+Use the original pending product SHA through the newly sealed external packet and record,
+then follow fresh credential/context-refresh/ordinary lifecycle actions. Never treat this as
+permission for other external-runner mutations, product transport, or manual state repair.
+
 Before an npm package update, run the project-local `update preflight` and stop unless it
 returns `safe=true` with a clean checkout, no running Step, and no active writer lease.
 
@@ -585,3 +767,18 @@ returns `safe=true` with a clean checkout, no running Step, and no active writer
 - A lifecycle `status` or `next` failed; do not continue with a different lifecycle mutation.
 - A human gate was emitted but the user has not approved its exact confirmation code in a
   later message and no exact eligible delegated approval option exists.
+
+## Explain an implementation change before escalating
+
+Before a product write by a tracked Worker, run the packaged registry `dispatch-context-check`
+using fresh App readback, the actual write root and the branch from the current Task. Resolve
+checkout mismatch without duplicate dispatch or silent canonical-checkout writes. A matching
+context is not a filesystem permission or writer credential.
+
+When a fix needs additional files, the route is unclear, or an external operation was denied,
+use read-only `change explain --task <exact Task ID> --file <closed proposal JSON>` as documented
+in `docs/change-model.md`. Present all known blocking layers together. Never relabel an external
+permission refusal as a missing grant. `requiresUser: null` is unknown, not blanket approval.
+For an exact Core-derived check-support amendment, follow the existing advertised recovery and
+fresh next; do not manually widen allowedWrites or issue new authority. Membership, semantic
+scope and Knowledge refresh retain their separate existing routes and evidence requirements.

package/schemas/plan-risk-audit-event.schema.json

@@ -35,6 +35,7 @@
     "summary": { "type": "string", "minLength": 1 },
     "decision": { "enum": ["approved", "approved-with-rationale", "split-required", "stop-escalate"] },
     "splitRationale": { "type": ["string", "null"], "minLength": 1 },
+    "structuralProductionEdgeAuthority": { "const": "required-v1" },
     "stepClassifications": {
       "type": "array",
       "minItems": 1,

package/schemas/preexecution-replan-event.schema.json

@@ -0,0 +1,45 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://codex-workflow.local/schemas/preexecution-replan-event.schema.json",
+  "title": "Codex Workflow V2 Pre-execution Replan Event",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "eventId", "taskId", "sourceTaskRevision", "resultTaskRevision", "briefHash",
+    "sourcePlanHash", "knowledgeMapRevision", "knowledgeMapHash",
+    "sourcePlanRiskAuditEventId", "sourcePlanRiskAuditEventHash",
+    "obstructionPlanRiskAuditEventId", "obstructionPlanRiskAuditEventHash",
+    "sourceExecutionAuthorizationHash", "sourceHeadCommit", "completedStepIds",
+    "completedStepsHash", "actor", "reason", "recordedAt", "previousEventHash", "eventHash"
+  ],
+  "properties": {
+    "eventId": { "type": "string", "pattern": "^PER-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "taskId": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "sourceTaskRevision": { "type": "integer", "minimum": 1 },
+    "resultTaskRevision": { "type": "integer", "minimum": 2 },
+    "briefHash": { "$ref": "#/$defs/hash64" },
+    "sourcePlanHash": { "$ref": "#/$defs/hash64" },
+    "knowledgeMapRevision": { "type": "integer", "minimum": 1 },
+    "knowledgeMapHash": { "$ref": "#/$defs/hash64" },
+    "sourcePlanRiskAuditEventId": { "type": "string", "pattern": "^PRA-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "sourcePlanRiskAuditEventHash": { "$ref": "#/$defs/hash64" },
+    "obstructionPlanRiskAuditEventId": { "type": "string", "pattern": "^PRA-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "obstructionPlanRiskAuditEventHash": { "$ref": "#/$defs/hash64" },
+    "sourceExecutionAuthorizationHash": { "$ref": "#/$defs/hash64" },
+    "sourceHeadCommit": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+    "completedStepIds": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string", "pattern": "^STEP-[0-9]{3}(?:-[A-Z0-9-]+)?$" }
+    },
+    "completedStepsHash": { "$ref": "#/$defs/hash64" },
+    "actor": { "type": "string", "minLength": 1 },
+    "reason": { "type": "string", "minLength": 1, "maxLength": 2048 },
+    "recordedAt": { "type": "string", "format": "date-time" },
+    "previousEventHash": { "anyOf": [{ "$ref": "#/$defs/hash64" }, { "type": "null" }] },
+    "eventHash": { "$ref": "#/$defs/hash64" }
+  },
+  "$defs": {
+    "hash64": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+  }
+}

package/schemas/task.schema.json

@@ -215,6 +215,61 @@
               }
             },
             "additionalProperties": false
+          },
+          "rootCauseReplan": {
+            "type": "object",
+            "required": [
+              "kind", "taskId", "sourceTaskRevision", "stepId", "sourcePlanHash",
+              "sourcePlanSemanticHash", "replacementPlanHash", "replacementPlanSemanticHash",
+              "sourceHeadCommit", "remediationEvents", "terminalRemediationEventId",
+              "terminalRemediationEventHash", "terminalExecutionTaskRevision",
+              "repeatedCauseFingerprint", "correctiveYieldEventId", "correctiveYieldEventHash",
+              "dirtyFiles", "dirtyWorktreeHash", "replacementPlanRiskAuditEventId",
+              "replacementPlanRiskAuditEventHash", "executionAuthorizationHash",
+              "executionAuthorizationHead", "completedStepsHash", "c1ClaimEventId",
+              "c1ClaimEventHash", "claimant", "compatibilityHash"
+            ],
+            "properties": {
+              "kind": { "const": "root-cause-corrective-replan-dirty-carryover" },
+              "taskId": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
+              "sourceTaskRevision": { "type": "integer", "minimum": 1 },
+              "stepId": { "type": "string", "pattern": "^STEP-[A-Z0-9][A-Z0-9-]{2,63}$" },
+              "sourcePlanHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "sourcePlanSemanticHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "replacementPlanHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "replacementPlanSemanticHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "sourceHeadCommit": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+              "remediationEvents": {
+                "type": "array", "minItems": 1,
+                "items": {
+                  "type": "object", "required": ["eventId", "eventHash", "attemptOrdinal"],
+                  "properties": {
+                    "eventId": { "type": "string", "pattern": "^RME-[0-9A-HJKMNP-TV-Z]{26}$" },
+                    "eventHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+                    "attemptOrdinal": { "type": "integer", "minimum": 1 }
+                  },
+                  "additionalProperties": false
+                }
+              },
+              "terminalRemediationEventId": { "type": "string", "pattern": "^RME-[0-9A-HJKMNP-TV-Z]{26}$" },
+              "terminalRemediationEventHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "terminalExecutionTaskRevision": { "type": "integer", "minimum": 1 },
+              "repeatedCauseFingerprint": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "correctiveYieldEventId": { "type": "string", "pattern": "^HOF-[a-f0-9]{64}$" },
+              "correctiveYieldEventHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "dirtyFiles": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+              "dirtyWorktreeHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "replacementPlanRiskAuditEventId": { "type": "string", "pattern": "^PRA-[0-9A-HJKMNP-TV-Z]{26}$" },
+              "replacementPlanRiskAuditEventHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "executionAuthorizationHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "executionAuthorizationHead": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+              "completedStepsHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "c1ClaimEventId": { "type": "string", "pattern": "^HOF-[0-9A-HJKMNP-TV-Z]{26}$" },
+              "c1ClaimEventHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "claimant": { "type": "string", "minLength": 1 },
+              "compatibilityHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+            },
+            "additionalProperties": false
           }
         },
         "additionalProperties": false