codex-workflow-v2 2.0.0-beta.13 → 2.0.0-beta.13.2

package/docs/beta13.2-signal-review-recovery.md

@@ -0,0 +1,38 @@
+# beta.13.2: pending-review recovery
+
+## Confirmed failure
+
+Signal M04 T01 completed the product changes for STEP-002 on beta.13.1, but its
+required independent Step review could not be prepared. The cumulative Task diff
+was 2,236,058 bytes, exceeding the default synchronous Git output buffer. The
+checkout remained clean and the completion commit remained recorded; review had
+not passed.
+
+After the writer lease expired, repository navigation preferred delegated
+Knowledge context refresh over the pending review's credential recovery. The
+context-refresh executor correctly rejected the still-in-progress Step. Thus
+navigation advertised an action its executor could not perform. Ordinary package
+update was also blocked by the in-progress Step.
+
+## Required recovery guarantees
+
+- Large Step and final Task review inputs are complete or fail explicitly; Git
+  errors have bounded diagnostics rather than dumping the input corpus.
+- Pending review and its exact writer credential recovery remain ahead of
+  Knowledge refresh. Refresh during a running Step stays forbidden.
+- Installation recovery validates the source version, exact Task/Plan/Step and
+  completion commit, clean checkout, recorded Git history, review journal, and
+  absence of active ownership or transactions.
+- Dependency transport preserves product bytes and the original reviewed commit.
+  Pending review never establishes passed-review provenance.
+- The original required review, delegated context refresh, Task acceptance and
+  merge remain mandatory after recovery. Grants are not broadened or renewed.
+
+## Release acceptance
+
+The package regression suite must cover oversized review inputs and the combined
+pending-review, expired-lease and stale-Knowledge state, including rejection of
+unsafe recovery candidates. Release validation also requires the ordinary package
+and external-review lifecycle gates. Actual Signal recovery must pass the blocked
+Step review and reach a subsequent executable lifecycle boundary; green fixture
+tests alone do not establish that the production Milestone has resumed.

package/docs/pdf/sources/codex-workflow-v2-architecture-ru.md

@@ -307,6 +307,14 @@ Task независимая PRA-классификация consumer как `runt
 one-Step runtime не требует искусственного predecessor. Это структурная admission-проверка, а не
 доказательство product truth и не реализация Step-validity authority P02.
 
+Beta.13.1 делает эту authority prospective и Plan-bound. Markerless PRA, созданная до появления
+production-edge contract, читается без ретроактивной проверки отсутствующих полей, но только пока и PRA,
+и Task не заявляют новую authority. Обычная новая PRA и atomic corrective replan записывают hash-chained
+marker `required-v1`; content-only knowledge rebind сохраняет production edges у native Task, а у
+действительно legacy Task сохраняет markerless posture. Миграция или ручное переписывание state не нужны.
+Граница доверия остаётся repository-local state: это не криптографическая защита от полного
+привилегированного переписывания всей hash chain.
+
 Versioned observed-route matrix v2 связывает все 13 Signal-observed route classes с unique priority и
 одним exact production-transition witness либо real terminal observation на класс. Это class-level
 доказательство: action-level metadata отдельно различает `executable-witnessed`, `unwitnessed` и
@@ -455,7 +463,7 @@ Restart Docker Desktop требует отдельного разрешения
 # 10. Operational checklist
 
 - exact package version установлен, bundled gateway соответствует release и переустановлен;
-- handshake подтверждает `packageVersion=2.0.0-beta.13`, protocol 2, state schema 2 и beta.13
+- handshake подтверждает `packageVersion=2.0.0-beta.13.2`, protocol 2, state schema 2 и beta.13
   capabilities;
 - routine observation начинается с компактного `status`; `status --full` запрашивается только для
   расследования, которому действительно нужна полная historical projection;

package/docs/pdf/sources/codex-workflow-v2-chat-only-guide-ru.md

@@ -57,7 +57,7 @@ AGENTS.md
 -> doctor только как дополнительная диагностика
 ```
 
-Handshake beta.13 должен сообщать `packageVersion=2.0.0-beta.13`, `protocolVersion=2`,
+Handshake beta.13.1 должен сообщать `packageVersion=2.0.0-beta.13.2`, `protocolVersion=2`,
 `stateSchemaVersion=2`, dependency DAG, initial Plan transaction, mechanical feasibility,
 Milestone autonomy, host-safe credential reference, failed-Step continuation transaction,
 cause-bound rolling refinement, structural production edge, compact status, reviewer runtime preflight,
@@ -282,6 +282,12 @@ effective scope той же Task только внутри затронутой
 requirements, acceptance или security boundary. Это structural admission: оно не доказывает product
 truth, не заменяет фактический check/review и не заявляет реализацию P02 Step-validity authority.
 
+В beta.13.1 production-edge authority применяется prospective. Новые ordinary/corrective PRA получают
+hash-chained marker `required-v1`. Markerless PRA и Task без production-edge fields считаются legacy и не
+переписываются; content-only refresh сохраняет эту posture. Для native Task refresh обязан сохранить exact
+`requiresProductionEdges`, `productionEdges[]` и строку edge в новом Plan artifact. Не редактируй state
+вручную: после update следуй только fresh advertised reconcile/context-refresh route.
+
 # 9. Atomic context refresh
 
 Когда top-level `next.action` равен `task context-refresh`, нельзя сначала выполнять standalone
@@ -475,8 +481,8 @@ Task/project DGR. `dependencyBinding` для standalone handoff равен null.
 
 # 14. Итоговый checklist пользователя
 
-- beta.13 exact package и новый bundled gateway установлены; handshake показывает
-  `packageVersion=2.0.0-beta.13`, protocol/state schema `2/2` и beta.13 capabilities;
+- beta.13.1 exact package и новый bundled gateway установлены; handshake показывает
+  `packageVersion=2.0.0-beta.13.2`, protocol/state schema `2/2` и beta.13 capabilities;
 - новый Coordinator chat не является fork старого Milestone;
 - bootstrap DGR, если нужен, выдан отдельным exact human confirmation;
 - Discovery не materialized при blocking unknowns;

package/docs/pdf/sources/codex-workflow-v2-technical-reference-ru.md

@@ -15,7 +15,7 @@ authority сами: mutating permission определяется runtime state
 
 | Параметр beta.13 | Значение |
 |---|---|
-| npm package | `codex-workflow-v2@2.0.0-beta.13` |
+| npm package | `codex-workflow-v2@2.0.0-beta.13.2` |
 | protocolVersion | 2 |
 | stateSchemaVersion | 2 |
 | lifecycle epoch | 2 |
@@ -228,6 +228,13 @@ requirements, acceptance и security boundary. Отдельно независи
 Эти механизмы проверяют структурную форму и не утверждают product truth. Они не заменяют Plan Risk Audit,
 Milestone authorization, фактический check result или не реализованную Step-validity authority P02.
 
+Beta.13.1 вводит prospective, Plan-bound compatibility boundary. Новые ordinary PRA и atomic corrective
+replan связывают `structuralProductionEdgeAuthority=required-v1` с hash chain. Историческая markerless PRA
+не получает новую семантику задним числом, если текущая Task также не содержит production-edge fields.
+Content-only knowledge rebind сохраняет exact native fields и rendered edge, а для такой legacy Task
+сохраняет markerless posture. Это устраняет необходимость state migration; repository-local state остаётся
+доверенной границей и не защищает от полного привилегированного переписывания всей chain.
+
 # 9. C1 handoff и writer lease
 
 ## 9.1. Dependency binding
@@ -760,7 +767,7 @@ dirty update.
 observed-route matrix/compact-status/reviewer-runtime tests, legacy compatibility regressions,
 `npm run test:signal-t10-check-support-e2e`, `npm run test:signal-remediation-e2e`,
 `npm run pack:check`, `npm run smoke:downstream`, `npm run plugin:check`, official plugin/skill validators,
-`npm run docs:pdf:check` и `npm run release:check` с exact `v2.0.0-beta.13` tag binding и append-only
+`npm run docs:pdf:check` и `npm run release:check` с exact `v2.0.0-beta.13.2` tag binding и append-only
 real-agent lifecycle log. Candidate проверяется из clean source checkout; missing built module не должен
 превращаться в stack trace, а обязан быть детерминированно собран или диагностирован release gate.
 

package/docs/pending-review-update.md

@@ -0,0 +1,15 @@
+# Updating while a strict Step review is pending
+
+This narrow bridge supports source `codex-workflow-v2@2.0.0-beta.13.1` and the exact executing target package. It preserves the original completion commit, pending review chain, Plan and Knowledge authorization. It does not mark a review passed or bypass the following Knowledge refresh.
+
+Use only a verified, exact target package runner with capability `pending-strict-review-dependency-bridge-v1`. The source preflight checks its package/build manifest and runtime file hashes. Never use a mutable version range or a global runner. The target runner exception before installation permits only the read-only source preflight below. Use the installed source runner for an explicitly returned stale lease repair.
+
+1. Run the external target runner: `update pending-review-source-preflight --repo <repo> --id <Task> --json`. Save the complete JSON response outside the repository. If `staleLeaseRepair` names exactly this Task, use the **installed source** `locks repair --id <Task>` and rerun source preflight. The lock manager rechecks expiry; a live or unrelated lease is not repairable through this bridge. Do not transport until the fresh result has `eligible=true` and no blockers.
+2. Retain the exact source receipt. Create one dependency transport commit on its `baseBranch` at `baseHead`, using a separate temporary worktree. Create one on `taskBranch` at `completionCommit`. Each commit must have one parent, change exactly `package.json` and `package-lock.json`, and change only the exact Workflow dependency entries from source to target. Preserve all product-owned manifest/lock fields independently on each branch. Do not merge, amend, reset, rebase, copy the base manifest over Task changes, or transport product work.
+3. Install the exact target package in the Task repository. Use its repository-local runner for all remaining commands. Run `status`, then `next`; it must advertise `update pending-review-dependency-recover`. Run `update pending-review-dependency-preflight --id <Task> --file <source-receipt.json>`. Require `eligible=true` and no blockers.
+4. Run `update pending-review-dependency-recover --id <Task> --expected-revision <source-task-revision> --file <source-receipt.json> --actor <coordinator> --reason <substantive-reason>`. Both plain preflight results and CLI `{ok:true,value:...}` receipts are accepted. The receipt is not authority: recovery reconstructs every source binding from canonical Task, artifacts, strict-review sidecars and Git parent commits. It checks clean checkout, all target version surfaces, exact base transport, and absence of any writer lease or pending transaction/Core operation again.
+5. Recovery atomically registers the Task dependency commit in existing dependency provenance and writes the hash-chained `pending-review-updates.jsonl` sidecar. Task schema 2 is unchanged. It increments the Task revision but preserves the original pending event, product completion SHA and Step evidence. Repeating recovery is rejected rather than creating duplicate authority.
+6. Run `status`, then `next`. Recover the exact advertised C1 writer credential if necessary. Generate a fresh `task step-review-packet`; use an independent external sealed reviewer and record the unchanged result with `task step-review-record`. The packet binds the original product commit and includes revalidated transport evidence; its repository seal binds the current dependency HEAD. Any later HEAD, base, Plan, evidence, packet, or seal change fails closed. Local nested review retains its original HEAD guard.
+7. Follow fresh `status` and `next` after review. Under the original eligible Milestone Autonomy Grant, execute the advertised `task context-refresh` for predeclared supporting-source additions and dependency manifest drift. Then continue to the next normal Step or final Task boundary. Do not substitute standalone approval or manually edit state.
+
+A failed preflight is a stop for this bridge. Repair only a specifically documented obstruction, then rerun the read-only assessment; never edit the receipt to hide a blocker. A pending or corrupt transaction must be recovered through its ordinary exact route before retrying.

package/docs/release.md

@@ -4,6 +4,17 @@ The npm package is `codex-workflow-v2` with public visibility. Consumers must pi
 an exact version. Stable compatibility covers the latest minor release of the current
 major only; older minors are unsupported unless a release note explicitly says otherwise.
 
+## beta.13.2 review recovery gate
+
+The patch preserves protocol 2 and canonical entity schema 2. In addition to the
+ordinary release gates, `release:check` executes the large-diff, pending-review
+update, supporting-source refresh and Task guard regressions. Acceptance requires
+complete external-sealed Step and Task packets above 2 MiB, explicit bounded
+failure above the Git output limit, exact credential recovery before Knowledge
+refresh, and a Signal-shaped delegated update followed by actual review,
+context refresh and the next ordinary Step. A source preflight alone is not
+recovery completion. See `beta13.2-signal-review-recovery.md`.
+
 ## Release gate
 
 Before tagging a release:
@@ -83,6 +94,15 @@ surface and fails unless all of these release contracts remain present:
   coordinator-replacement facts without claiming Codex App scheduling, chat mutation, consent, or
   atomic App effects.
 
+For beta.13.1 the same gate additionally verifies the post-publish compatibility boundary. A
+markerless pre-authority PRA whose Task has no production-edge fields remains readable and does not
+turn an intact beta.12 state into `STATE_CORRUPT`. Both ordinary and atomic corrective-replan PRA
+writers persist `structuralProductionEdgeAuthority=required-v1`; that hash-chained marker keeps the
+current-Plan structural gate fail-closed even if Task fields are removed. An audit belonging to an
+older Plan is never revalidated against a later Plan's Step/edge graph. This is not signed
+provenance: a privileged rewrite of the complete local Task and self-hashed chain remains outside
+the local-state trust model.
+
 For beta.12.19, the release gate also relies on `npm run release:check` to fail if:
 
 - canonical entity schema 2 shapes drift;

package/docs/updating-existing-project.md

@@ -22,23 +22,45 @@ state schema. Совпадение `stateSchemaVersion` до и после об
 нужна. Для alpha.6 при `stateSchemaVersion: 2` применяется не migration, а sidecar-only
 adoption posture.
 
+### beta.13.1: legacy PRA compatibility after beta.13
+
+`2.0.0-beta.13.1` preserves the beta.13 protocol/schema `2/2` and adds no state migration. The
+structural production-edge rule is prospective: every newly written ordinary or atomic
+corrective-replan PRA receives the hash-chained `structuralProductionEdgeAuthority=required-v1`
+marker, and its current Plan must satisfy the edge contract. A markerless PRA and Task written
+before that authority existed remain readable; Workflow must not reinterpret their historical
+`runtime-composition` classification as proof that their old Plan contained beta.13 fields.
+Historical PRA events from an earlier Plan are hash/shape validated but are not compared with the
+current Plan's edges. This compatibility rule never edits, migrates or silently approves external
+state. A later Plan/PRA recorded by beta.13.1 must satisfy the full structural boundary.
+
+This does not add signed provenance to local Workflow state. A full privileged rewrite of Task
+state and its complete self-hashed sidecar chain remains outside the trust model; repository rules
+continue to prohibit manual state edits. The regression proves compatibility and fail-closed
+partial mismatch, not authenticity against the machine owner.
+
+The normal safe-update sequence below targets exact `2.0.0-beta.13.1`. It is also the supported
+patch path from beta.13 when `status` or `next` reports `STATE_CORRUPT` solely because a markerless
+pre-beta.13 PRA lacks production-edge fields: run the old-version read-only preflight first, install
+the patch dependency-only, and resume from a fresh handshake. Never edit the PRA sidecar manually.
+
 ### beta.13: coherent continuation and host-safe credentials
 
-`2.0.0-beta.13` сохраняет `protocolVersion: 2` и `stateSchemaVersion: 2`; отдельная state migration
+`2.0.0-beta.13.1` сохраняет `protocolVersion: 2` и `stateSchemaVersion: 2`; отдельная state migration
 для перехода с beta.12.19 не нужна. Обновление выполняется только на безопасной границе обычного
 `update preflight`: нет running Step, active/stale writer lease, незавершённой transaction/Core
 operation и неучтённых dirty product bytes. Если хотя бы одно условие не выполнено, сначала
-завершите advertised recovery текущей repository-local версией; установка beta.13 сама по себе не
+завершите advertised recovery текущей repository-local версией; установка beta.13.1 сама по себе не
 является recovery-route и не разрешает переносить или редактировать внешний state.
 
 Точный путь обновления:
 
 1. Старой repository-local версией зафиксируйте `handshake`, `status`, `next` и read-only
    `update preflight`; продолжайте только при `safe=true`.
-2. Установите exact `codex-workflow-v2@2.0.0-beta.13` без диапазона и измените только
+2. Установите exact `codex-workflow-v2@2.0.0-beta.13.1` без диапазона и измените только
    `package.json` и lock-файл.
 3. Новой repository-local версией подтвердите совпадение declared, locked и installed
-   `2.0.0-beta.13`, прежний `projectId`, protocol/schema `2/2`, затем выполните `handshake`,
+   `2.0.0-beta.13.1`, прежний `projectId`, protocol/schema `2/2`, затем выполните `handshake`,
    `doctor`, компактный `status` и `next`.
 4. Обновите персональный `codex-workflow-gateway` только штатным installer из установленного
    exact пакета и продолжайте работу в новом чате, который загрузит новую skill-инструкцию.

package/docs/validation-report.md

@@ -1,13 +1,34 @@
-# V2 beta.13 Validation Report
+# V2 beta.13.1 Validation Report
 
-Release candidate `2.0.0-beta.13` was validated during 2026-09-02--03 (Europe/Moscow) with
+Release candidate `2.0.0-beta.13.1` was validated during 2026-09-02--03 (Europe/Moscow) with
 Node.js 24.17.0.
 
+## beta.13.1 post-publication compatibility correction
+
+After published beta.13 was installed dependency-only into the clean Signal `main` checkout,
+declared, locked and installed versions and registry integrity matched, but the first compact
+`status` failed before navigation. The loader had applied the new structural production-edge rule
+to the first markerless beta.12.19 PRA for `TASK-01M1B79C660YMNSRRZ236NTR1T`; that historical Task
+contains neither `requiresProductionEdges` nor `productionEdges`. This was a runtime compatibility
+defect, not corrupt Signal state.
+
+beta.13.1 makes the authority prospective and Plan-bound. New ordinary and atomic
+corrective-replan PRA writers persist one hash-chained marker. Stored structural validation runs only
+for the current Plan when either that marker or the new Task fields establish the boundary.
+Markerless pre-authority events remain hash/shape validated and readable, while marker-bearing
+current events still fail closed if Task structural fields are removed. A source-built read-only
+probe against the untouched real Signal external state changed the exact failing observation into
+the expected `project-memory reconcile` route with the retained-historical frozen-M3 cancellation
+option. The focused production-edge and corrective-replan executor suites passed `14/14` before
+the full release gate. The compatibility gate does not claim signed provenance against a privileged
+rewrite of the entire local Task and self-hashed chain; it proves ordinary read compatibility and
+fail-closed partial mismatch within the existing trusted-local-state model.
+
 ## Automated release evidence
 
 - A clean `npm ci` completed from the exact lockfile. A network-enabled `npm audit --json` reported
   zero vulnerabilities at every severity across all eight installed dependencies.
-- `npm run validate` passed typecheck and `408/408` sequential tests with no failures, skips,
+- `npm run validate` passed typecheck and `409/409` sequential tests with no failures, skips,
   cancellations or todos in 2,761,796.900458 ms.
 - `npm run test:signal-t10-check-support-e2e` passed `8/8` after the final clean install in
   203,155.332125 ms. It covers an impossible selector-less check, machine-derived support scope,
@@ -20,7 +41,7 @@ Node.js 24.17.0.
   recovers an accidental rebind, replans and completes the consolidated guarded Step.
 - `npm run test:signal-t04-recovery` passed `11/11` in 22,021.439625 ms. It preserves only exact
   reviewed Step provenance and rejects pending, corrupt, unrelated or stale recovery evidence.
-- `npm run pack:check` produced the exact `2.0.0-beta.13` tarball with 309 files, package size
+- `npm run pack:check` produced the exact `2.0.0-beta.13.1` tarball with 309 files, package size
   1.2 MB and unpacked size 4.8 MB. It includes the shared gateway-handshake module and the
   hash-verifiable reviewer runtime build manifest.
 - `npm run smoke:downstream` packed the release, installed it into an empty project and returned
@@ -28,7 +49,7 @@ Node.js 24.17.0.
   network-enabled invocation passed.
 - `npm run plugin:check`, `npm run docs:pdf:check`, `npm run typecheck` and `git diff --check` all
   passed. The PDF checker reported no stale generated document. `npm run release:check` passed
-  `103/103` tests in 300,945.515375 ms and returned the exact package/version assertion.
+  `104/104` tests in 298,521.790541 ms and returned the exact package/version assertion.
 
 ## Release-candidate regressions found and closed
 
@@ -92,8 +113,8 @@ stale nearer-copy regressions expanded the complete suite.
 A real native reviewer preflight then exposed an API-level Structured Output incompatibility: every
 declared object property must also be present in `required`. The reviewer schema now makes nullable
 optional semantics explicit, while the semantic parser still rejects absent or contradictory
-cause/plan-conflict evidence. The complete suite consequently reached `408/408`, and the expanded
-release check reached `103/103`.
+cause/plan-conflict evidence. The complete suite consequently reached `409/409`, and the expanded
+release check reached `104/104`.
 
 The same real-agent exercise corrected the release proof boundary without weakening Core. A nested
 `codex exec` reviewer is not treated as independent production evidence: the Coordinator stops at a
@@ -154,8 +175,8 @@ mutation. This changes release-evidence interpretation only; it grants no lifecy
 - This report does not claim commit/tag/push, npm publication, installation into Signal or Milestone
   4 readiness until those operations receive exact readback.
 
-Confidence is high for package behavior and the stated compatibility boundary: the final `408/408`
-run, `103/103` release check, four Signal-shaped E2E suites, package/downstream smoke, CPU-saturation,
+Confidence is high for package behavior and the stated compatibility boundary: the final `409/409`
+run, `104/104` release check, four Signal-shaped E2E suites, package/downstream smoke, CPU-saturation,
 warm-cache and fail-closed negative cases agree. Live Signal readiness remains conditional on
 publication, exact repository-local installation, safe
 closure of the frozen Milestone 3 authority and a fresh read-only `status`/`next` observation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.13",
+  "version": "2.0.0-beta.13.2",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -56,6 +56,13 @@
   A provenance recovery recorded after the final context-refresh audit may explain exactly one
   additional Task revision only when it belongs to that verified Git chain. Any unexplained
   revision remains a `doctor` boundary.
+- Before a credential-consuming mutation, check the public `writerCredentialReference.expiresAt`
+  against the current time and its actor/action binding. Lease heartbeat or renewal does not
+  extend that reference's expiry. An expired, missing, consumed or unverifiable reference requires
+  the simultaneously advertised `next.writerCredentialRecovery` action with its exact Task,
+  revision and `requiredActor`, followed by fresh `status` and `next`; use the new reference.
+  If no recovery is advertised, stop before mutation. Never read or patch the vault, extend expiry
+  manually, or reuse the old reference. This check also applies after independent reviews and pauses.
 - `milestone progress --id <MS-ID>` is a read-only projection and the sole source for Coordinator
   progress tables. It preserves cancelled/replacement Tasks as distinct membership rows.
 - `scripts/chat-registry.mjs` atomically allocates project-monotonic `#NNN`, builds all six title

package/plugins/codex-workflow-gateway/skills/codex-workflow-gateway/SKILL.md

@@ -278,22 +278,32 @@ because the sandboxed call returned a permission error; those actions require th
 authorization and evidence.
 
 When `next` includes `writerTokenContract`, treat it as an exact first-call precondition. Retain
-the active writer lease from the first-field `writerLeaseReceipt` returned by `task run` and pass it using the advertised `option` for that
-transition. The token is sensitive: never print, summarize, persist, or substitute a redacted
-fingerprint. Stop before mutation if the active lease is unavailable. This input contract is
-independent from `gitMutationPolicy`; satisfy both when both are present.
-
-On successful `task handoff-prepare`, consume the first-field `credentialHandoff` before reading
-the Task/event/bundle payload. Retain its one-time token only in working memory and use it exactly
-once with the declared `action` and `option` for the declared `targetActor`. Successful `task claim`
-returns a first-field `writerLeaseReceipt`; retain that lease and pass it to claimed `task run` when
-the fresh `next.writerTokenContract` requires it. Successful `task run` returns the refreshed
-`writerLeaseReceipt`; retain it only until Core releases that lease.
-Never search later payload fields for either credential and never copy credentials into evidence.
+the `writerCredentialReference` returned by `task run`, `task claim`, or
+`task writer-credential-replace`, including its public `credentialRef`, actor, allowed actions and
+`expiresAt`. Pass the reference using the advertised `--writer-credential-ref` option. The secret
+stays in the local vault: never read, print, copy, or edit vault records or substitute a redacted
+token. This input contract is independent from `gitMutationPolicy`; satisfy both when present.
+
+Before every credential-consuming mutation, especially after an independent review or a pause,
+compare the held reference's `expiresAt` with the current time and verify its actor/action binding.
+A live or renewed lease does not extend an existing reference's expiry; `reuse-reference` is not
+permission to reuse an expired reference. If the reference is expired, missing, consumed, or its
+validity cannot be established, use only the simultaneously advertised
+`next.writerCredentialRecovery` action with its exact Task, revision and `requiredActor` before
+attempting the blocked mutation. Follow successful replacement with `status` then `next`, retain
+the newly returned reference and expiry, and discard the prior reference. If recovery is not
+advertised, stop before mutation. Never extend expiry manually or retry with the old reference.
+
+Successful `task handoff-prepare` returns a one-time `claimCredentialReference`; use its
+`credentialRef` with the declared `--claim-credential-ref` option for `task claim` and the bound
+actor. Successful claim consumes that reference. A renewed claim/run may return
+`writerCredential.disposition=renewed` without a new reference; the held reference must still
+satisfy its own expiry and binding checks. Never search later payload fields for raw tokens and
+never copy credentials into evidence.
 
 When a passed final Task review routes to `task result-set`, pass the active writer credential and,
 for claimed C1 posture, the exact claimant as `--actor`. A successful `result-set` consumes that
-execution lease before entering `awaiting_final_acceptance`; never reuse the old token and never
+execution lease before entering `awaiting_final_acceptance`; never reuse the old reference and never
 leave or manufacture a lease while waiting for the Human decision. After `task accept`, follow fresh
 `next`: local merge or external merge confirmation normally advertises
 `task writer-credential-replace`, which acquires a new bounded lease for the exact recovery actor.
@@ -571,6 +581,19 @@ When `next` returns a derived C1 Worker or corrective Auditor actor, use that ex
 asking the user to name one. Derivation removes a routing pause; handoff claim, writer lease,
 strict review, and auditor-independence checks remain mandatory.
 
+The beta.13.2 pending strict-review update exception is documented in
+`docs/pending-review-update.md` in the exact package. An exact external target runner may run
+only `update pending-review-source-preflight` against the known beta.13.1 source. Require its
+verified runtime build, exact Task/revision/Plan/HEAD/pending binding and no blockers. If it
+returns an exact stale Task lease repair, run that `locks repair` with the installed source and
+repeat preflight. Preserve the eligible receipt outside the checkout; transport only the two
+bound dependency commits on base and Task, then install the target locally. Fresh local `next`
+must advertise `update pending-review-dependency-recover`; run its matching read-only preflight
+with `--file <source-receipt>` before recovery. Recovery does not approve Knowledge or review.
+Use the original pending product SHA through the newly sealed external packet and record,
+then follow fresh credential/context-refresh/ordinary lifecycle actions. Never treat this as
+permission for other external-runner mutations, product transport, or manual state repair.
+
 Before an npm package update, run the project-local `update preflight` and stop unless it
 returns `safe=true` with a clean checkout, no running Step, and no active writer lease.
 

package/schemas/plan-risk-audit-event.schema.json

@@ -35,6 +35,7 @@
     "summary": { "type": "string", "minLength": 1 },
     "decision": { "enum": ["approved", "approved-with-rationale", "split-required", "stop-escalate"] },
     "splitRationale": { "type": ["string", "null"], "minLength": 1 },
+    "structuralProductionEdgeAuthority": { "const": "required-v1" },
     "stepClassifications": {
       "type": "array",
       "minItems": 1,