codex-workflow-v2 2.0.0-beta.2 → 2.0.0-beta.4

package/docs/lifecycle/state-machine-stabilization.md

@@ -0,0 +1,641 @@
+# Lifecycle State-Machine Stabilization Brief
+
+## Coordination status
+
+- Status: approved and in progress
+- Baseline package: `codex-workflow-v2@2.0.0-beta.2`
+- Baseline tag: `v2.0.0-beta.2`
+- Baseline commit: `70ddc8e6bd1ec5fabcb15ad046fed6b28dc472da`
+- Working branch: `codex/state-machine-stabilization`
+- Coordination source: this document
+- Runtime semantic source: the machine-readable guarded-transition catalog to be introduced by this work
+- User-owned, out of scope: `.idea/`, `env.telegram.hook`
+- External read-only evidence: `/Users/home-pc/htdocs/projects/signal_v4` and its Workflow state
+
+This document is a coordination ledger. It must not become an independently maintained copy of runtime transition semantics. Transition matrices, rights matrices, diagrams, traceability, and executable navigation documentation should be generated from the runtime catalog wherever practical.
+
+## Objective
+
+Stabilize Workflow by replacing distributed lifecycle decision logic with one typed, guarded-transition model that is shared by mutation authorization, `next`, CLI contracts, authority evaluation, model-based exploration, generated documentation, and compatibility assessment.
+
+The product outcome is autonomous execution of a human-approved Discovery:
+
+1. A free-form Discovery is compiled into a materialized candidate Plan.
+2. A fresh independent Plan Validator checks the candidate before authorization.
+3. Technical findings inside the accepted semantic scope are resolved without human involvement.
+4. A Human principal authorizes the exact validated Plan hash or grants an exact delegated capability.
+5. A Milestone Coordinator chat coordinates the Milestone.
+6. A Delegate Coordinator creates one user-visible Task chat per Task.
+7. Each Task is decomposed into bounded Steps with immediate verification and evidence.
+8. Independent Result Review runs at Task completion by default. Independent Step Review is used only at declared or structurally triggered checkpoints.
+9. Passed review may lead to automatic acceptance only through an explicit state-bound grant.
+
+## Non-goals
+
+- Rewriting the persistence layer as a new event-sourced Core.
+- Treating JSON Schema as a full transition language.
+- Building a universal lifecycle graph-diff migrator.
+- Guessing a new Plan, a nearest lifecycle node, wider authority, or new grants during update.
+- Reopening terminal entities.
+- Making every Step a separate aggregate, chat, authorization tree, or remediation state machine.
+- Adding lifecycle machinery for speculative future cases that are not justified by a transition, invariant, defect, or adverse witness.
+- Mutating external `signal_v4` Workflow state.
+
+## Approved architecture decisions
+
+### AD-01: Typed executable guarded-transition catalog
+
+The canonical model is a typed executable catalog, not a metadata-only registry and not a full event-sourced rewrite.
+
+Each definition has a stable semantic transition ID and a semantic fingerprint. The catalog owns:
+
+- entity and scope;
+- command/action and exact input contract;
+- source lifecycle posture;
+- ordered guards;
+- actor and authority contract;
+- required revision, hashes, HEAD, grant, token, lease, or confirmation binding;
+- declared state, sidecar, artifact, Git, and lease effects;
+- authorization preservation, invalidation, or supersession;
+- atomicity and recovery classification;
+- non-mutating failure guarantee;
+- idempotency contract;
+- navigation kind, priority, and mode;
+- historical defect and test traceability;
+- executor adapter.
+
+Complex predicates remain typed, pure guard functions with stable guard IDs. They are referenced by catalog definitions rather than encoded in a large JSON rules DSL.
+
+### AD-02: Pure evaluation before effects
+
+The control path is divided into:
+
+1. mutation-free snapshot load;
+2. pure transition evaluation;
+3. effect adapter execution;
+4. postcondition/readback verification.
+
+`status`, `next`, model exploration, and target-version compatibility assessment must not invoke implicit registration, recovery, adoption, cache preparation, or other writes.
+
+### AD-03: Typed navigation
+
+Navigation is a discriminated union:
+
+- `executable` — one exact transition ID with complete bindings;
+- `choice` — multiple fully evaluable alternatives;
+- `human-gate` — a semantic or authority decision reserved for a human principal;
+- `wait` — an external condition is expected to change;
+- `repair` — an explicit bounded recovery transition is available;
+- `blocked` — no catalog transition is presently executable.
+
+Explanatory text is allowed, but executable navigation must never be identified by free-form text.
+
+Primary invariant:
+
+> For every reachable state, when `next` advertises an exact transition, executing that transition with the advertised bindings and authority cannot receive a permanent `TRANSITION_BLOCKED`. Only external races such as a stale revision, changed Git HEAD, lease ownership change, or expiry are permitted.
+
+### AD-04: Role and authority are separate
+
+Role describes responsibility and eligibility. Authority comes from a Principal issuing an exact Capability to an Actor, presented through a Credential and executed at a declared boundary.
+
+No role name grants mutation authority by itself.
+
+### AD-05: Plan validation precedes authorization
+
+Materialization creates a content-addressed candidate, not execution authority. A fresh independent Plan Validator receives the candidate, exact repository/architecture evidence, and no private Planner reasoning. Human or delegated authorization is bound to the independently validated candidate hash.
+
+### AD-06: Milestone, Task, and Step execution boundaries
+
+- One Milestone has one Milestone Coordinator chat.
+- Each Task has one separate user-visible Task chat created by a Delegate Coordinator under an exact dispatch capability.
+- Planner, Plan Validator, Worker helpers, and Result Reviewer may use fresh isolated internal agent contexts without creating additional user-visible chats.
+- A Step remains a first-class child entity with stable ID, dependency edges, status, allowed writes, checks, commit/evidence, and review-checkpoint policy.
+- A Step is not an independently authorized aggregate and does not receive its own chat or parallel remediation lifecycle.
+
+Every Step receives immediate machine verification. Independent Step Review is enabled only for a declared irreversible/security/integration checkpoint or a cataloged structural deviation. Independent Result Review is mandatory at Task completion.
+
+### AD-07: Earliest detection policy
+
+Every material final-review finding is classified by the earliest gate that could have detected it:
+
+- candidate Plan Validation;
+- Step verification;
+- declared Step review checkpoint;
+- Task integration review only.
+
+If an earlier gate could have detected it, the finding is also a Workflow process defect with regression evidence. Target metric: `avoidable-late-findings = 0` over the adverse corpus.
+
+### AD-08: Evolution uses epoch plus content identity
+
+The version dimensions are distinct:
+
+- `packageVersion` — distributed artifact;
+- `stateSchemaVersion` — serialized state shape;
+- `protocolVersion` — CLI/API/navigation envelope compatibility;
+- `lifecycleEpoch` — lifecycle semantic compatibility family;
+- `catalogHash` — exact guarded-transition catalog identity;
+- per-transition `semanticFingerprint` — exact transition semantics.
+
+Typed navigation requires a protocol version change. A semantic transition change must stale or supersede credentials bound to the old fingerprint unless an official compatibility descriptor proves semantic identity.
+
+### AD-09: Evolutionary stabilization with a control-plane rewrite
+
+Preserve Task/Milestone/Discovery formats where compatible, state revisions, hashes, append-only evidence chains, Git helpers, locks/leases, transaction journals, and suitable effect implementations.
+
+Systematically replace the orchestration layer: navigation, dispatch, guard evaluation, authority evaluation, read-only loading, lifecycle compatibility, and overly stateful Step remediation.
+
+The current planning estimate is to preserve roughly 65–75% of persistence/domain primitives and substantially restructure 25–35% of the Workflow control plane. This is an architecture estimate, not a line-count commitment.
+
+### AD-10: Complete transition admission, not partial availability metadata
+
+The recurrence of catalog/runtime admission drift in I-01 and AU-00 triggers the anti-loop rule. No additional transition family may be cataloged until the definition contract separates and machine-identifies:
+
+1. observation/readiness guards evaluated without effects;
+2. exact authority and credential presentation guards;
+3. operator-input and candidate-content guards;
+4. effect-adapter preconditions that can change only through external races;
+5. declared effects and postconditions.
+
+For a candidate-bearing transition, availability may expose candidate guards as pending, but every permanent executor rejection must already have a stable guard ID, declared required input/binding, and negative evidence. The effect adapter may reject only a declared external race, integrity failure, or postcondition failure; it may not introduce hidden lifecycle policy.
+
+`task.plan.corrective-replan` must therefore include requirements/acceptance preservation, Knowledge binding/targets, mandatory replacement Plan Risk Audit and auditor binding, semantic Plan change, guarded-Step retention, authority presentation, and every other current `TRANSITION_BLOCKED` predicate before staging. Its sidecar effect must match the actual required input: an optional audit cannot back an unconditional catalog effect.
+
+The mutation entrypoint must accept and verify the advertised transition ID, semantic fingerprint, actor, scope, revision, current Plan hash, guarded Step, corrective-decision event, and bounded expiry rather than deriving an apparently presented credential from current state.
+
+### AD-11: Lease credentials cannot self-resurrect or mutate on failed admission
+
+- An expired, well-formed writer lease is never renewed and requires explicit stale-lock repair.
+- A malformed lease is not guessed to be stale or automatically removed; it produces a structured corrupt-state stop and requires bounded recovery.
+- Claim/handoff/run policy and supplied credentials are validated before heartbeat or other lease mutation.
+- Failed admission does not extend a lease.
+- Lock roots and files are trusted-root/no-symlink checked immediately before reads and destructive effects.
+- CLI success projection searches supplied bearer substrings as well as credential-shaped fields; exact issuance receipts remain the only exception.
+
+### AD-12: Corrective replan is prepared before it is executable
+
+An observer-neutral `next` cannot advertise corrective replan as executable while actor, replacement Plan, Plan Validation, Risk Audit, or exact human authority are missing. It returns a typed `human-gate` with the transition identity and required preparation contract.
+
+A candidate-aware, mutation-free preparation query evaluates every observation, authority, candidate, and adapter-precondition guard. Only a result with zero failed and zero pending guards may return `executable`. The preparation result contains a public, non-secret, SHA-256 state-bound execution receipt and a human confirmation gate for the exact candidate. The receipt proves exact binding and freshness inside the accepted trusted-local v2 boundary; it is not authentication and is not a bearer secret.
+
+The exact candidate requires:
+
+- a rendered replacement Plan preserving Task requirements, acceptance, terminal Step history, and the guarded remediation Step;
+- a fresh passed Plan Validation attestation from an isolated validator distinct from the Planner;
+- a mandatory replacement Plan Risk Audit with exact candidate/Brief/Knowledge/Step bindings and an independent Risk Auditor;
+- normalized actor identity and eligible planning/coordinator role, neither of which grants authority by itself;
+- a human confirmation code bound to transition ID/fingerprint/catalog hash/epoch, Task revision and hashes, corrective decision and remediation tail, candidate/validation/audit hashes, actor, Git HEAD, and expiry.
+
+Corrective replan requires no running Step, active C1 claim, or writer lease. The current public lifecycle cannot release a non-terminal C1 claim: terminal `task handback` is not a valid substitute. A companion exact `task.coordination.corrective-yield` transition is therefore a necessary prerequisite in the same bounded vertical sequence. It suspends ownership without deleting the Task chat or history, and it cannot authorize Plan mutation. No unrelated transition family may be added in I-07.
+
+Execution receives rather than derives the receipt, recomputes it under a narrow boundary, and may reject after admission only for declared race, integrity, or postcondition failures. Plan, Task state, validation/audit evidence, execution evidence, and coordination effects require journaled exact replay. Existing execution authorization, C1 claim, writer lease, or legacy grant never expands to the replacement Plan.
+
+### AD-13: Release readiness is derived from executable semantics
+
+A transition definition cannot become release-ready by changing maturity or completeness labels. Runtime semantic identity, definition quality, and evidence readiness are separate machine concepts:
+
+- `runtimeSemanticFingerprint` covers only executable semantics and therefore does not change when evidence, rollout maturity, or editorial documentation changes;
+- a definition/readiness manifest may separately hash completeness, evidence, limitations, and release disposition;
+- catalog identity used by execution receipts is derived from runtime semantic fingerprints, not self-asserted readiness labels;
+- release readiness is computed by a registered machine profile that validates authority, inputs and projections, guard/evaluator bindings, ordered effects, postconditions, atomicity, idempotency, recovery, and coverage; an empty catalog is not release-ready.
+
+Set-valued fields are canonically sorted before hashing. Ordered fields are declared explicitly and used only where order is semantic, including guard evaluation and effect/recovery phase graphs. Authority, SoD, forbidden combinations, conditional effects, races, and recovery cannot rely on prose or unresolved strings: every reference is versioned, registered, and validated for referential integrity. Missing identities and unresolved policies fail closed.
+
+### AD-14: Semantic compilation and package release evidence are separate gates
+
+The second recurrence of I07A-R01..R07 after a green I07-A2 test run proves that a string registry plus a generic cross-field validator is not sufficient. It can enumerate requirements while leaving the requirement-to-evaluator link incomplete. The anti-loop rule therefore stops local validator patches.
+
+The next substrate revision must use a bounded executable semantic compiler:
+
+- every release rule has a stable ID/version and an actual registered pure evaluator;
+- a release profile is valid only when every required rule resolves to exactly one evaluator and the evaluator reports a deterministic result;
+- transition descriptors remain machine-readable inputs to those evaluators; no generic expression language or second Workflow DSL is introduced;
+- static semantic readiness covers definition, authority, effect, race, identity, replay, and recovery coherence;
+- package release evidence is evaluated separately by the release-check boundary and cannot be satisfied by caller-provided self-hashed JSON;
+- persisted evidence may be reported only through a registered producer bound to an actual test-result/artifact manifest inside the documented trusted CI/local release boundary.
+
+The compiler must fail closed on unresolved nested registry references and must bind schema artifacts, rule implementations, authority tuples, exact lock/read projections, identity comparators, execution keys, recovery paths, and postcondition-to-effect coverage. Runtime catalog identity remains based only on executable semantics; evidence and release-manifest identity remain separate.
+
+Initial A3 architecture selected a typed compiler plus one closed TypeScript release-rule registry. I07-A3.1 and I07-A3.1b proved that this was still speculative generic infrastructure around one transition. AD-15 supersedes the generic runtime registry with exact family compilers while retaining the same requirements: a transition cannot select an easier policy; Workflow Core owns the compiler; the compiler issues private IR with real callables, deterministic diagnostics, runtime identity and static blockers; missing or duplicate bindings fail closed.
+
+The three gates are intentionally distinct:
+
+1. hard semantic compilation rejects contradictory or unresolved definitions while allowing an honest legacy partial definition;
+2. static semantic readiness evaluates exact authority, identity, lock, effect, replay, recovery, and limitation obligations without accepting evidence input;
+3. package release-check runs the test producer as a direct child inside the trusted local/CI boundary and binds the live result to Git/tree, package artifact, catalog/manifest hashes, versions, suites, counts, and runner identity.
+
+Persisted or caller-supplied evidence manifests are informational and cannot authorize publication. Remote signing/OIDC is out of scope until publication crosses an untrusted process or principal boundary. Because rejected A2 format was never published or persisted, A3 uses transition-definition/catalog format `3` with no A2 migrator; state schema, public protocol, lifecycle epoch, and runtime lifecycle behavior remain unchanged.
+
+Complexity boundary: A3 covers only shared compiler primitives plus `task.plan.corrective-replan` and its already approved future exact contract. A descriptor without an installed executable validator/evaluator/verifier/adapter is unavailable and cannot satisfy compilation or readiness. No plugin system, expression tree, arbitrary predicate language, universal schema metamodel, or unrelated transition family is allowed. I07-A3.1c reduced production code relative to frozen A3.1b, but its fresh audit still found five exact-family trust gaps. I07-A3.1d may add at most 50 production TypeScript lines over A3.1c and only to close immutable Core ownership, exact semantic-to-callable linkage, per-rule contexts, and input purity; exceeding that bound or restoring a generic environment is a stop-and-replan condition.
+
+### AD-15: Family compilers precede generic compiler infrastructure
+
+The machine-readable transition definition remains the runtime semantic source of truth, but a generic compiler is not justified by one partial transition. Each implemented transition family first receives an exact Core-owned compiler that binds the definition to its real guard, effect, schema, authority and recovery callables and emits one private compiler-issued IR. A new metadata row never creates executable semantics.
+
+Shared compiler primitives may be extracted only after at least two independent family compilers demonstrate the same invariant and a third family is concretely planned. Until then, transition-specific cross-links remain in the family compiler. This prevents a speculative registry, profile or inspection layer from becoming a second authority model.
+
+For the current slice, `task.plan.corrective-replan` owns the first family compiler. It must be deletion-first relative to I07-A3.1b, keep the public opaque Core API, and remove generic environment/profile/readiness surfaces. Static rules and readiness consume only its private non-serializable IR with actual callable references. Package evidence remains outside Core.
+
+### AD-16: Authority semantics activate only with real callables
+
+A3.2 installed no placeholder identity, capability, credential, clock, receipt, or projection row. CD-1 later supplied real closed schemas and opaque Core-issued credential handles, and CD-4 activates those exact callable objects through the compiler and public protocol-v2 path. The package still exposes no caller-provided registry, readiness profile, credential kernel, or authority-minting inspection seam.
+
+The semantic capability originates from an exact Human principal confirmation. Workflow Core may later construct and verify the public state-bound receipt, but it does not create the human authorization. Role is eligibility only. The exact static tuple requires a planning/coordinator actor, Human principal, Human-issued candidate-bound capability, forbidden delegation, supersession of prior Plan-bound authority, and three identity constraints: Plan author differs from Plan Validator, Plan author differs from Risk Auditor, and Plan author cannot authorize the same candidate as Human principal. Plan Validator and Risk Auditor may be the same independent reviewer; this avoids an unnecessary extra actor while preserving independence from the author.
+
+Receipt TTL and clock skew are enforced as 900,000 ms maximum TTL and 30,000 ms skew on a Workflow Core UTC clock. Human confirmation, receipt reconstruction, all 28 state/candidate bindings, SoD and prior-Plan authorization supersession are revalidated before intent. The acknowledgement remains a trusted-local same-principal Human gate, not a claim of remote cryptographic identity.
+
+### AD-17: Reliability is proven only by one real corrective vertical slice
+
+Standalone future reliability metadata is stopped after two rejected A3.3 rounds. Exact target ownership, replay, recovery and readback may be claimed only when the same candidate contains the real Plan Validation and confirmation/receipt schemas, the exact shared binding manifest, a Task-specific journal materializer owning serialized target bytes, a mutually exclusive Task operation lock, a central pending-journal observation gate, apply-or-confirm recovery and terminal readback.
+
+The vertical slice absorbs only the narrow B prerequisites for `task.coordination.corrective-yield` and `task.plan.corrective-replan`; it does not reopen a generic transition engine. It is implemented as private, independently testable CD-1 through CD-3 packets and one atomic CD-4 public activation. No intermediate packet advertises executable navigation or release readiness. Low-level path/snapshot/hash primitives may be reused from the Milestone journal, but its rollback/delete phase semantics and read-side auto-recovery are forbidden for Task corrective transactions.
+
+The exact replan transaction owns serialized preimages and postimages for `state.json`, `plan.md`, Plan Validation, Plan Risk Audit and execution evidence. Semantic Plan/audit hashes never substitute for file-byte digests. The Task CAS is the commit pivot; recovery is roll-forward only. Domain readback occurs before terminal completion, then the retained completed journal and all domain targets are reread before success. A nonterminal journal produces typed repair/wait observation and blocks normal Task reads and mutations without implicit recovery.
+
+CD-3 implemented that boundary privately. CD-4 now binds the same executor, receipt verifier, stored-event verifier, lock, journal, recovery and readback callables into the live compiler IR and exposes only the bounded WorkflowService/CLI operations. The replan executor revalidates the complete Core-owned snapshot under the same Task operation mutex, owns five exact postimages and performs apply-or-confirm roll-forward plus domain and terminal readback. Its companion corrective-yield executor writes one exact `yield` handoff event, atomically transfers the existing Writer lease slot to the Core operation mutex, preserves Task bytes and releases ownership through a separate fixed-target roll-forward journal. Both recovery paths are explicit and retain completed evidence.
+
+CD-4 sets public protocol and lifecycle epoch to `2` and transition-definition/catalog format to `4`, including `explicit-repair` recovery and pre-completion/post-terminal readback checkpoints. `STATE_SCHEMA_VERSION` remains `2`. Existing grants, receipts and catalog bindings never widen across the epoch change. Intact protocol-v1 adoption evidence remains readable without rewrite; unknown versions or a mixed-version evidence chain fail closed.
+
+## State dimensions for reachability
+
+The explorer must be exhaustive over semantic classes, bounded over cardinality, and sampled over arbitrary data and timing.
+
+| Dimension | Abstract values |
+| --- | --- |
+| Revision | matching, stale |
+| Hash binding | missing, current, stale, malformed |
+| Actor | human, valid delegate, claimant, other |
+| Lease | none, valid-owned, valid-other, stale |
+| Attempts | 0, 1, 2, 3+ |
+| Corrective posture | none, decision-needed, continue-fix, replan, split, stop, hard-stop, recovery-needed |
+| Knowledge binding | active, stale, awaiting approval, conflicting |
+| Git | clean-bound, clean-diverged, dirty, malformed |
+| Authorization | absent, current, stale, superseded |
+| Step dependencies | no dependencies, satisfied, blocked, malformed/cyclic representative |
+| Task representative | active, sibling-active, terminal, replacement/split representative |
+| Milestone representative | active, terminal, incomplete-required-set, scope-change representative |
+| Lifecycle binding | current, navigation-compatible, mechanically mappable, incompatible, missing/malformed |
+
+The explorer operates only on states reached from constructors and catalog transitions. It must not enumerate arbitrary raw JSON products.
+
+Required exploration outputs:
+
+- guard true/false coverage;
+- navigation priority conflict detection;
+- single-guard-negative generation;
+- one concrete witness for every abstract edge;
+- differential comparison between `next` and the canonical evaluator;
+- deterministic graph/report hash;
+- `advertised-but-rejected = 0`.
+
+## Role and authority matrix
+
+| Role / boundary | Responsibility | Required authority | Delegation and restrictions |
+| --- | --- | --- | --- |
+| Human principal | semantic scope, initial authorization, grant issuance/revocation, ambiguous decisions | trusted human interaction plus state-bound confirmation/grant | may grant only enumerated capabilities with scope and expiry; not Worker or Reviewer evidence |
+| Scope Lead | Discovery and outcome proposal | exact planning capability | cannot authorize execution solely by role |
+| Technical Planner | candidate Plan and coverage mapping | exact Plan-record capability | must differ from Plan Validator/Risk Auditor; cannot authorize own Plan |
+| Plan Validator | pre-execution architecture/completeness validation | read-only validation launch binding | cannot edit the candidate or invent scope; fresh isolated context required |
+| Milestone Coordinator | sequencing and Milestone progress | bounded Milestone coordination capabilities | no implicit acceptance or scope expansion |
+| Delegate Coordinator | create/bind Task chats and dispatch execution | exact Task dispatch/chat-create capability | cannot re-delegate or expand Plan/grant |
+| Worker | one Task/Step execution envelope | dispatch capability plus writer lease | limited to allowed writes; cannot modify Plan, authorization, or review records |
+| C1 claimant | temporary Task mutation ownership | one-time claim token plus writer lease | exact actor/entity binding; no parallel claimant |
+| Independent Reviewer | read-only implementation review | review launch binding and isolation attestation | cannot fix, accept, or close own finding |
+| Corrective Auditor | rare disposition after repeated failure | exact corrective-audit capability | not an always-on gate; must differ from Planner, Worker, and latest strict Reviewer |
+| Workflow Core | evaluate guards, apply effects, verify postconditions | internal system capability | cannot make semantic product choices |
+| Update/Migration Operator | target assessment and official bounded adoption/recovery | exact operator capability and target descriptor binding | no grant expansion, Plan guessing, nearest-node mapping, or operation during running Step/active lease |
+
+### Automatic acceptance grant
+
+Automatic Task or Milestone acceptance after passed review is opt-in and requires a separate exact grant:
+
+- Human principal is the issuer;
+- entity, validated Plan hash, lifecycle epoch, transition fingerprint, actor, scope, and expiry are bound;
+- passed independent review must bind the exact HEAD and evidence;
+- the grant is non-transitive and cannot be re-delegated;
+- semantic Plan changes, incompatible lifecycle changes, stale evidence, or changed reviewed HEAD supersede it.
+
+## Lifecycle and schema evolution policy
+
+### Compatibility classes
+
+| Change class | Automation | Required behavior |
+| --- | --- | --- |
+| Navigation-only | automatic | executable set, guards, effects, and authority fingerprints remain identical; no state write |
+| Additive invariant/adoption | explicit bounded adoption | official boundary and visible report; a newly blocking invariant requires a decision |
+| Mechanical node mapping | automatic only with proof | shipped exact 1:1 map, same semantics/history/authority, locked revalidation and readback |
+| Exact bounded defect recovery | official recovery ID only | exact preconditions/effects, idempotent journal, no general inference |
+| Semantic Plan/authority change | never automatic | structured stop, superseded execution authorization, new validated Plan and authority |
+| Removed, split, or ambiguous node | never automatic | read-only report and explicit pin/rollback, official recovery, replacement, cancellation, or wait |
+
+### Hard boundary
+
+The compatibility assessor is read-only and target-aware. It must not call the current mutating `context()` path.
+
+Update/adoption is blocked by:
+
+- an in-progress Step;
+- an active writer lease;
+- a stale lease until an explicit repair transition succeeds;
+- a dirty or malformed Git posture where the target policy requires clean binding;
+- an ambiguous/removed active node;
+- changed semantic Plan/authority without new authorization.
+
+Terminal entities are never reopened or mapped into executable nodes. Completed/skipped Steps and historical evidence are preserved. Existing grants never acquire new transition semantics automatically.
+
+The Core will not support arbitrary skip-upgrades or an unlimited backward-reader window. The compatibility descriptor must declare supported source epochs explicitly.
+
+### Structured compatibility report
+
+The report includes:
+
+- from/to package, state schema, protocol, lifecycle epoch, and catalog hash;
+- project identity and Git posture;
+- running Steps and leases;
+- active entity node mapping and changed semantic fingerprints;
+- authorization/grant disposition;
+- official recovery IDs and user choices;
+- `safeToInstall`, `safeToAdopt`, `mutationFree`, and report hash.
+
+## Implementation packets
+
+Packets are bounded. A packet owner may not widen scope without an Orchestrator disposition.
+
+| Packet | Owner | Scope | Exit evidence |
+| --- | --- | --- | --- |
+| OR-01 | Orchestrator | Brief, inventory ledger, packet boundaries, finding dispositions | this document and evidence links |
+| SM-01 | State-machine Implementer | transition types, definition schema, catalog scaffold, stable IDs/fingerprints | focused type/schema tests |
+| SM-02 | State-machine Implementer | mutation-free snapshot boundary and pure guard/evaluator primitives | non-mutation digest tests |
+| SM-03 | State-machine Implementer | CLI/mutation inventory and catalog retrofit in bounded slices | 100% classified route report |
+| SM-04 | State-machine Implementer | typed navigation generated from evaluator | navigation differential tests |
+| SM-05 | State-machine Implementer | role/authority contracts and credential confinement | hostile authority tests |
+| SM-06 | State-machine Implementer | Step verification/checkpoint simplification and WF-STABLE-024 correction through the model | adverse remediation tests |
+| MT-01 | Model/Test Owner | independent CLI/mutation/guard/sidecar/test inventory | machine-readable coverage inventory |
+| MT-02 | Model/Test Owner | WF defect witnesses, beginning with WF-STABLE-024 | concrete replay tests |
+| MT-03 | Model/Test Owner | abstract semantics, pruning, canonical state key, invariants | independent model tests |
+| MT-04 | Model/Test Owner | BFS explorer, guard/priority coverage, minimal counterexamples | deterministic reachability report |
+| MT-05 | Model/Test Owner | concrete witness compiler and `next` differential oracle | `advertised-but-rejected = 0` |
+| MT-06 | Model/Test Owner | single-negative, hostile, atomicity/crash boundaries | negative and recovery evidence |
+| EV-01 | State-machine Implementer | lifecycle descriptor and compatibility manifest | descriptor validation tests |
+| EV-02 | State-machine Implementer | true read-only target compatibility assessor | non-mutation and mapping tests |
+| EV-03 | State-machine Implementer | official bounded mapping/recovery executor | compatible/incompatible update E2E |
+| GEN-01 | Shared, Implementer owns generator | transition/rights matrix, statecharts, BPMN source, traceability | deterministic generated artifacts |
+| AU-01 | Agnostic Reviewer | read-only review of frozen candidate, Brief, diff, schemas, matrix slice, and evidence | findings with ID/severity/evidence/action |
+| I07-A | State-machine Implementer | structured transition-definition v2, exact schema parity, semantic fingerprint projection, deterministic catalog hash; no executor/navigation/protocol behavior | runtime/schema hostile fixtures and fingerprint/catalog-hash stability tests |
+| I07-A2 | State-machine Implementer | make the definition substrate executable and fail-closed: registered projections/policies, exact authority scope, ordered effects, typed SoD, derived readiness, and structured replay/recovery | hostile release-profile counterexamples, reference/graph integrity, runtime-fingerprint stability, independent schema review |
+| I07-A3 | State-machine Implementer | replace string-only readiness with an executable semantic compiler and separate verified package-release evidence; close residual R01..R07 without a generic rules DSL | rule-registry completeness, exact authority/lock/identity/recovery counterexamples, verified-evidence boundary, changed-evidence review |
+| I07-A3.1 | State-machine Implementer | compiler kernel, canonical IR, recursive executable registry closure, format 3, centralized set/order normalization | current partial compile-valid; unresolved refs, schema drift and hash golden vectors fail closed |
+| I07-A3.1b | State-machine Implementer | close the compiler trust boundary: explicit installed callable/schema bindings, opaque canonical IR provenance, frozen Core registry/profile, evidence-free rule context, and removal of authoritative compatibility bypasses | metadata-only rows, forged IR, same-ID semantic registry substitution, nominal payload schema and evidence-aware rule hostiles all fail closed |
+| I07-A3.1c | State-machine Implementer | deletion-first exact `task.plan.corrective-replan` family compiler behind the opaque Core API; remove speculative generic environment/profile/readiness machinery | private IR owns real callable refs; exact-one schema bindings; bounded rule contexts; unresolved refs fail closed; production LOC decreases |
+| I07-A3.1d | State-machine Implementer | close the five fresh exact-family findings without runtime behavior: immutable Core bundle and public definition, exact executable-family semantic contract, per-rule minimal contexts, Core-owned input clone | semantic-version/source/command/binding drift fails before handle; live inspection mutation cannot change Core; caller input remains untouched |
+| I07-A3.2 | State-machine Implementer | linked authorization paths, role-binding evaluator and constraint-specific identity comparators | each authority/SoD/forbidden tuple edge has a single-negative |
+| I07-A3.2a | State-machine Implementer | stage a private unavailable authority bundle with one role evaluator, three identity comparators and a diagnostic exact-tuple assessor; no receipt/presentation registry rows | callable closure hostiles, field/path authority single-negatives, role-not-authority, grant supersession and unchanged live runtime identity |
+| I07-A3.3 | State-machine Implementer | lock/resource scope, revalidation read supersets, exact projection-field execution key, effect/journal/recovery/postcondition linkage | hostile wrong-scope, removed-read, orphan-effect/phase and incomplete-key evidence |
+| I07-A3.4 | State-machine Implementer | compiler-derived obligations and exact executable release-rule coverage; remove runtime coverage-report authority | current partial static-ready=false; synthetic exact fixture true only with every rule binding; fake evidence has no effect |
+| I07-A3.5 | Model/Test Owner | independent compiler/static-readiness differential and A3 residual R01..R07 oracle | deterministic hard/static results and single-negatives for every executable rule |
+| I07-A3.6 | Release tooling owner | direct-child verified package evidence boundary; no manifest-to-permission API | stale/replayed/wrong-artifact/self-hashed evidence cannot pass; unchanged live run can pass |
+| I07-A3.7 | Agnostic Reviewer | fresh changed-evidence audit of compiler, rules, schemas, IR and candidate | no unresolved material finding before I07-B |
+| I07-B | State-machine Implementer | mutation-free corrective-yield/replan snapshots and complete observation/authority/candidate/precondition guards | every permanent blocker has one stable guard ID and positive/single-negative evidence |
+| I07-C | State-machine Implementer | protocol-v2 human-gate/prepare/executable union, Plan Validation and Risk Audit inputs, exact human confirmation and execution receipt | public prepare/execute authority, expiry, tamper, supersession, and live-lease non-mutation tests |
+| I07-D | State-machine Implementer | narrow lock plus journaled corrective-yield/replan effects and exact replay/recovery | injected crash at every write boundary, identical/conflicting replay, readback postconditions |
+| I07-T | Model/Test Owner | independent public differential and reachability witnesses for I07-B/C/D | zero pending guards for executable, `advertised-but-rejected = 0`, full rejection digests |
+| I07-CD1 | State-machine Implementer | real private Plan Validation, Human confirmation, execution-receipt and stored-event schemas; exact 28-row manifest; pure materializers/verifiers; no public issuance or executable route | closed-world schema, every manifest/TTL/identity/SoD/candidate tamper, exact callable/artifact binding, pinned legacy behavior |
+| I07-CD2 | State-machine Implementer | private Task-operation mutex, Task-specific journal store/materializer, exact-byte CAS and pending-journal observation boundary | lock exclusion, confined exact targets, journal corruption, zero-mutation observation, every target preimage/postimage/third-value witness |
+| I07-CD3 | State-machine Implementer | private journaled apply/recovery/replay with domain readback then terminal retained-journal readback; corrective-yield prerequisite | crash at every durable boundary, identical/conflicting replay, explicit repair, yield event/lease roll-forward, credential confinement |
+| I07-CD4 | State-machine Implementer | atomic public activation: complete admission, human-gate/prepare/execute/repair protocol-v2 routes, exact catalog callables, legacy corrective bypass disabled, epoch/format compatibility | public yield→prepare→confirm→execute E2E, all guard single-negatives, `advertised-but-rejected = 0`, compatibility/update blockers, two unchanged adverse runs |
+
+Production-file ownership is assigned before each implementation iteration. The Model/Test Owner may add independent test/model files and may read production files, but does not change the production catalog/evaluator. The Agnostic Reviewer remains read-only.
+
+## Iteration ledger
+
+| Iteration | Evidence hash / reason | Production packet | Model/test packet | Review state | Decision |
+| --- | --- | --- | --- | --- | --- |
+| I-00 | baseline `70ddc8e6...` | none | read-only diagnosis | completed | architecture approved; continue |
+| I-01 | `a9d80e0fcd06479ef9c556488575e4fb298c58b948e5744761f3ddc2c0e3b242` | SM-01 plus one WF-STABLE-024 vertical slice | MT-01, MT-02 | independent model evidence complete; agnostic audit deferred until candidate freeze | positive defect replay fixed; three semantic gaps dispositioned below |
+| I-02 | `43c61ba2d305b9c31e145a50bfebb0ae04246e78be7c618d6f3d4aa22a7ddedf` | phased evaluator, exact failed/no-running source posture, pre-effect candidate guards, semantic fingerprint projection | production differential negatives and complete state-root digests | completed by Implementer and independently confirmed by Model/Test Owner; Orchestrator typecheck and 13 focused tests green | close I01-001 through I01-003; continue to pure observation boundary only |
+| I-03 | `4614cbd60fc9536e876dbdcbff075d434c0fd4189cb399fd7f961d8395ddcca2` | lazy state construction, mutation-free observation snapshot, non-recovering Milestone integrity reader, structured blocked/legacy repair posture | 25 hostile observer witnesses plus implicit-write inventory and complete persistent digests | completed; Implementer full suite 193/193, combined evidence 40/40, Orchestrator typecheck and 40/40 focused green | close PRE-001 for `status`, `next`, and `updatePreflight`; continue with credential confinement and independent explorer groundwork |
+| I-04 | `75ef809f804aa36d605755501e5afd0ce403552900b71b8dc3243bb860f38a5b` | shared token-free lease projection for preflight/rescue/status/next/lock CLI outputs | recursive credential oracle plus finite abstract state key/BFS scaffold | completed; full suite 203/203, Orchestrator typecheck and 12/12 focused green | direct CLI observer leaks fixed; public raw authority API and explorer differential gaps dispositioned below |
+| I-05 | `80e162825cce2271623ae2296e7bf82becab48a3aaca8ae6d373a7f60b07b03f` | runtime-private mutation context, safe public lease adapters, issued-vs-renewed credentials, CLI success/error confinement | hostile public-export/renewal/error tests; distinct MT-03 advertisement/execution and seven-guard mapping | completed; frozen full suite 210/210, Orchestrator typecheck, public runtime probe, and 19/19 focused green | close I04-003/004/006/007/008 with bounded limitations; freeze for fresh agnostic checkpoint audit |
+| AU-00 | frozen candidate `80e16282...` | none; read-only | fresh-context review plus independent temporary-repository counterexamples | completed: 5 material, 7 major, 2 minor findings; verified typecheck and 57 focused tests | candidate rejected; repeated catalog-admission drift triggers AD-10 replan |
+| I-06 | `c9f9b7a79abdaddc2cc7eecb38eb10e4937a5729623f5a72a7b69210bddb76e8` | finite-expiry enforcement, claim prevalidation, deterministic trusted-path lock operations, embedded-secret rejection | 36 independent hostile/model tests; complete lease bytes/dev/inode/mtime and state digests | completed: full suite 219/219; typecheck and diff-check green; follow-up correctness review found one systemic admission-before-heartbeat gap and two explicit limitations | close AU00-005/006/012/014 at their exact scope; disposition I06-001 to I-07 instead of adding another route-local patch |
+| I-07 | design approved; implementation split below | AD-10/AD-12 definition, complete corrective-replan plus necessary corrective-yield sequence, shared admission-before-effect boundary | public `next`→prepare→executor differential, all runtime-gate single-negatives, and live-lease failure non-mutation | three independent read-only designs completed; I07-A ready | implement A without behavior first; B/C/D cannot claim executable closure until corrective-yield is publicly reachable |
+| I07-A | rejected after review | structured definitions/schema/fingerprint/catalog hash only; no navigation, executor, protocol, state, or authority behavior | typecheck; 21/21 focused catalog/schema/model tests; strict Draft 2020-12 hostile documents | implementation tests green, but independent read-only review found five material and two major substrate gaps | replan as I07-A2; do not start runtime admission work |
+| I07-A2 | rejected after changed-evidence review | format-v2 registry/descriptors; derived readiness; authority/input/read refs; ordered effect/race graph; structured reliability; runtime/readiness hash split | typecheck; 30/30 focused tests; deterministic semantic report `61f055cb3c85c0260c084cf8c4e1bf213c6d35e94775da274c8c31284349d8ae` | tests green, but independent static review found residual fail-open counterexamples in every R01..R07 class | anti-loop stop; preserve useful substrate, replan compiler/evidence boundary as I07-A3 |
+| I07-A3 | design approved; implementation not started | typed compiler + closed executable rules; static readiness separated from direct-child package evidence; format 3; no behavior/protocol/state changes | independent hostile oracle fixed before production edits; bounded compiler packets and changed-evidence review | Implementer and Model/Test Owner independently recommend the same three-gate boundary | begin A3.1 only after Model/Test oracle files are frozen; no A2 local patching |
+| I07-A3.1 | rejected after changed-evidence review | format-3 compiler scaffold, executable release-rule functions, recursive closure, Ajv definition artifact, runtime/manifest hash split, static readiness | Implementer and Model/Test Owner independently green: typecheck, build/import/package smoke and 39/39 focused tests; deterministic schema/compiler/static hashes | review found four material and two major compiler-boundary bypasses despite green evidence | fix F01-F06 in bounded I07-A3.1b; do not start authority/runtime packets |
+| I07-A3.1b | rejected after fresh changed-evidence review | explicit real callable table, opaque WeakMap Core handle, bounded Ajv payload artifacts, frozen environment, canonical provenance, immutable readiness; no Workflow/CLI/state/protocol behavior | Implementer and Model/Test Owner independently green: typecheck/build/test compile, 47/47 focused tests, payload hostiles, immutable readiness and forgery rejection | fresh reviewer found that readiness still bypassed the post-hoc IR, schema resolution was not exact-one/provenance-complete, rule context retained coverage/editorial registry families, and raw fingerprints skipped unresolved refs | anti-loop replan to deletion-first exact family compiler I07-A3.1c; no additive repair on the +399 boundary |
+| I07-A3.1c | rejected after fresh changed-evidence review | deletion-first exact corrective-replan family compiler; opaque Core API; generic compiler/environment/readiness removal; 3,470 production TS LOC, 1,569 below A3.1b | Implementer and Model/Test Owner independently green: typecheck/build/test compile, 43/43 focused tests, built-root export and Core smoke | fresh reviewer found three material, one major and one minor exact-family boundary defects despite green evidence | fix AR01-AR05 in bounded I07-A3.1d; runtime packets and full regression remain paused |
+| I07-A3.1d | completed after A3.1d2 re-audit | exact executable semantic contract; recursively immutable installed bundle and public definition; exact nested per-rule contexts; clone-before-freeze compiler input; raw root hash surface removed | independent typecheck/build/test compile; 47/47 focused; built-root 4-required/25-forbidden probe; genuine Core smoke; two changed-evidence reviews; full regression 253/253 | source/schema/test/package manifest SHA-256 `57d05b40b3c1b719b36ba4c42b4f2b11829a53619264adbc65ac7c46916a0800`; Model SHA-256 `5b4c34bb41ff4c07d443a746b8145e8ede74cb1c326390940cab3459e4452b12`; production 3,505 TS LOC (+35 to A3.1c) | AR01-AR05 and R01/R02 closed; static exact-family compiler boundary accepted; continue only to A3.2 |
+| I07-A3.2a | completed after A3.2a3 re-audit | private unavailable authority bundle; canonical actor-role evaluator and three constraint-specific comparators; diagnostic-only closed-world exact tuple; no credential/presentation/runtime behavior | independent typecheck/build/test compile; 51/51 focused; built-root/Core smoke; pinned pre-A3.2 identity; fresh authority review 0 material/major/minor; full regression 257/257 | candidate manifest before final correction SHA-256 `eb192eab1c0f658ba0bfdf1f356d112a945aa30e5d3e45efb7d7e3d6692db0df`; authority Model SHA-256 `8fc41819b2300ece9d8623661b9d24dbae0fdead2cdc0b6f2e01434695fed0f6`; authority bundle SHA-256 `f1552c17f20996b8eb5f9c55575b5b0df2bbb3a9eda810337063c0f1fe2014b8`; +162 TS | static authority staging accepted; credential/runtime activation remains C; continue only to A3.3 |
+| I07-A3.3 | stopped after two rejected changed-evidence rounds | round 1: partial private reliability checker; round 2: typed immutable v2 blueprint, shared 28-row manifest and exhaustive closed-world oracle; no runtime wiring | both rounds independently green at 55/55 focused with pinned live identity; v2 manifest `3ce1bf3c8dfd6fc34579958fe36c4a33a43691729588f498813e0c3b4b9dfefa`, build `1cb88025bc8a9a0437590b24be2a05d49dad94acb2fcf2da0d67a541f0ab73cd`, report `68151c05617910020d684ddce992d89e4f8d135c7b0f3ac773d9596029521ff7` | round 1: four material/two major fail-open gaps; round 2: two material/two major/one minor because the canonical blueprint itself used wrong byte digests/sidecar preconditions and impossible terminal readback order | anti-loop stop: remove the unaccepted static reliability implementation and merge exact target ownership/linkage with real C/D schemas, journal writer, recovery and readback call paths |
+| I07-CD1 round 1 | rejected after fresh changed-evidence review | private 28-row manifest, five Ajv schema artifacts and seven pure credential functions; no public/live activation | independent typecheck/build/test compile; 56/56 focused; built-root/Core smoke; pinned live identity; deterministic frozen closure | four material and one major finding: caller self-certified expected context/Core ownership, receipt omitted exact cross-links/time admission, authority consumed only manifest field names, real call paths skipped closed schema enforcement, and validation finding/time rules were incomplete | delete the self-certified callable chain; replace it with a private Core-issued kernel using opaque WeakMap provenance and trusted captured ports before any CD-2 work |
+| I07-CD1 round 2 | rejected after fresh changed-evidence review | replacement private Core credential kernel with captured trusted ports, opaque WeakMap handles, exact shared manifest object and five real Ajv artifacts; no public/live activation | typecheck/build/test compile; 56/56 focused; built-root/Core smoke; pinned live identity; package-private kernel boundary | three material, one major and one minor finding: receipt freshness did not cover the full current snapshot or verification time, caller could backdate Human confirmation after challenge expiry, single-use was per handle rather than semantic preparation, malformed nested inputs/closure were not total or bounded, and Git canonicalization accepted 41–63 hex characters | bounded in-place round-3 correction before acceptance: full snapshot freshness at issuance/verification, Core-owned confirmation time, semantic issuance key, total bounded envelopes/closure and exact Git length; keep execution linkage honestly pending CD-2 |
+| I07-CD1 round 3 | rejected after fresh changed-evidence review | full snapshot-binding freshness, Core-owned confirmation/event time, per-kernel semantic issuance key, bounded malformed envelopes and total non-aliasing closure; no public/live activation | Orchestrator typecheck/build/test compile, 56/56 focused and full 262/262; independent typecheck/build/test compile, 56/56, built-root/Core smoke, pinned live identity and deterministic 5/5/7 closure | two material and two major findings: Plan Validation repeatedly read and later froze caller-owned draft values, semantic issuance remained a permanent tombstone after expiry, Proxy/accessor closure input could still throw, and local depth/width checks lacked one global work/byte budget | deletion-first round-4 correction: one owned accessor-free bounded draft snapshot, expiring generation-aware preparation state, total descriptor-safe closure and global work/cardinality budgets; CD-2 remains blocked |
+| I07-CD1 round 4 | rejected after fresh changed-evidence review | one descriptor-safe Core-owned Plan Validation input snapshot; exact depth/node/UTF-8 budgets; expiring per-kernel preparation generations; superseded old handles; total descriptor-safe bounded closure; no public/live activation | typecheck/build/test compile; 56/56 focused; full 262/262; built-root/Core smoke; pinned live identity | no material finding remained, but one major closure-confinement defect reflected caller-controlled row IDs into diagnostic path/ref/message and admitted unbounded ID strings | bounded closure-only round-4a correction: validate semantic IDs before exact scans and address unknown rows only by stable collection index with fixed non-caller diagnostics |
+| I07-CD1 round 4a | completed after fresh changed-evidence review | secret-free indexed closure extras; exact missing/duplicate/substituted closure diagnostics; all round-4 owned-input, generation, totality and budget corrections retained; private kernel remains `available-unwired` with execution linkage `pending-cd2` | Orchestrator typecheck/build/test compile, 56/56 focused, built-root 4-required/26-forbidden probe, genuine Core smoke and final full 262/262; independent typecheck/build/test compile, 56/56, root/Core/credential no-echo probes; fresh review `0 material / 0 major / 0 minor` | final credential Model SHA-256 `469c85247b497926b52a7e736202dcdb417494309a2f282f3affc87536ecf35d`; scoped 150-file candidate SHA-256 `4e120b7ded6d0fecae8d02906b9dda594e523303dab115e03a0e7193f99c835a`; manifest `edab7ee7ac4018e759f5fc702a11a0fd113ef4f2cf8ed8fa823a59fde3012a1a`; closure `3cbf139bc017d0fc87338a6c67dc04617de9ae2e1aafde5c712d8c9b3f7cf0b4` | accept CD-1 private credential kernel only; release readiness and public execution remain false; proceed next only to CD-2 storage/mutex/journal packet |
+| I07-CD2 | implementation and validation complete; fresh independent changed-evidence review pending | private same-slot Core Task mutex with opaque inode-bound handle; exact five-target preimage/postimage ownership; durable intent/phase hash chains; apply-or-confirm Task CAS; completed-target readback; pending/corrupt/orphan observation and central Task store gate; execution linkage advances to `pending-cd3` | pinned Node 24.17 typecheck/build/test compile; CD-2 oracle 4/4; combined focused 100/100 then final affected 61/61; built-root private-boundary/Core smoke; full regression 266/266; diff-check | live serialized/runtime/catalog/readiness pins unchanged; no public executor, recovery command, protocol/epoch/catalog activation or readiness reduction | retain runtime exclusivity, stale-lock recovery, target application, receipt-handle linkage, replay and dual terminal readback as CD-3/CD-4 blockers; do not call the transition executable |
+| I07-CD3 | implementation and validation complete; fresh independent changed-evidence review pending | private receipt-bound five-target corrective-replan executor/recovery/replay; exact state-before-publish roll-forward and dual readback; separate fixed-target corrective-yield journal with Writer-to-Core same-slot transfer; central pending-yield observation gate; no public activation | pinned Node 24.17 typecheck/build/test compile; replan/storage/yield focused 13/13; expanded affected 91/91 before final hardening; final full regression 275/275; built-root private-boundary/Core smoke; diff-check | live serialized SHA `626035488c83bb12091d1b5af959635c9af473f5a2d9e47817c70be4c5f58311`, runtime fingerprint `c8de50fcfd869327156afc1a676e87cd8684b25ce95c307f876b119ad3f082a8`, runtime catalog `3491e5d21c5d71385aefa62a62561b694e3ba41debfd31132cb26c05f7e4938b`, readiness report `742f40c20b81f34761fc3ec1c839aa81770e07f1deda33a4b2439297a195ad91`; static readiness and exact 11 blockers unchanged | keep both executors private and `pending-cd4`; CD-4 must atomically add protocol-v2 navigation/CLI, lifecycle epoch/catalog v4 activation, public repair, complete differential evidence and removal of the legacy corrective mutation bypass |
+| I07-CD4 | implementation and local changed-evidence hardening complete; independent external sign-off pending | protocol-v2 public yield/prepare/confirm/execute/repair; epoch 2 and definition/catalog format 4; active exact callable linkage; legacy corrective `task plan-set` disabled; protocol-v1 adoption evidence has a bounded read-only compatibility window; public candidate/input budgets, pending-journal admission and non-C1 writer-lease navigation now fail closed | pinned Node 24.17 affected 111/111 and full regression 279/279; built-root 4-required/26-forbidden; genuine Core `staticReady=true`; package dry-run, downstream smoke, plugin and release checks green; unchanged-candidate public CLI yield→prepare→confirm→execute→replay repeated green; legacy bypass, wrong confirmation, pending journal, oversized input and known active non-C1 lease are non-mutating | serialized SHA `6070765ab24dd24641a35ee3b3ed64a9dc9e89d705425f80918ad4500bd57800`; runtime fingerprint `bd4e7a0ddfcb6abc0c5eb107775e6aea7e08c4606dda4d945d77af8a4520710d`; runtime catalog `fa1d11860d4f07978c3b8e85d1f91cd3d15b17284b05f41e05d462d3bb092aed`; readiness report `c7fa9e19a453ee27915cfca298c65f548e992f22c01fec99460daa36cc12948d`; no static blockers | keep the candidate frozen for independent external changed-evidence sign-off; do not claim broad catalog completeness or stable release before that sign-off |
+
+No new implementation round starts until every finding from the prior round has a disposition.
+
+## Reviewer findings
+
+| Finding ID | Severity | Requirement / invariant | Evidence | Required action | Disposition | Closure evidence |
+| --- | --- | --- | --- | --- | --- | --- |
+| PRE-001 | material | read-only observation | beta.2 `context()`, store/lock constructors, and Milestone integrity readers could recover/register/adopt/create directories | separate pure snapshot path | fixed for the three I-03 public observers; remaining read-only routes split below | construction plus `status`/`next`/`updatePreflight` preserve persistent state/worktree/Git semantic digests across 25 hostile witnesses |
+| PRE-002 | material | advertised transition must execute | WF-STABLE-024: `next` advertises `task plan-set` while `ready` blocks it | model and repair the exact transition posture | fixed for the exact transition slice | public positive replay green; independent source and candidate negative differentials green in I-02 |
+| PRE-003 | material | schema/runtime conformance | remediation schema omitted runtime `security-boundary` category | align runtime contract and add conformance test | fixed | Model/Test schema/runtime witness green |
+| PRE-004 | major | complete CLI classification | hidden/actionless `context` and incomplete exact CLI contracts | classify all dispatchable routes and aliases | split: static route/method/sidecar inventory complete; three primary observers proven pure; remaining diagnostic/read routes retain a separate retrofit obligation | `beta2-inventory.json` and `observation-write-inventory.json` assertions green |
+| I01-001 | material | no semantic Plan mutation while a Step is running | production source guard permitted `blocked + in_progress`, while the independent oracle required no running Step | restrict corrective replan to the exact failed-Step source; model unresolved review recovery as a separate repair posture | fixed in I-02 | typed blocked `next`, exact `source-posture`/`no-step-in-progress` guards, mutation rejection, and unchanged state-root digest |
+| I01-002 | material | catalog is the full admissibility source | semantic Plan change and guarded-Step retention were checked outside the canonical evaluator; metadata overstated `all-guards-before-effects` | add phased state/input guard evaluation, candidate bindings, and pre-staging execution evaluation | fixed for `task.plan.corrective-replan` in I-02 | unchanged and removed/renamed Step candidates reject in execution phase before staging; valid candidate remains green |
+| I01-003 | major | semantic fingerprint changes only with semantics | fingerprint included traceability evidence paths and relied on manual guard versioning | introduce a canonical semantic projection; exclude evidence/docs, include stable guard IDs and semantic versions | fixed in I-02 | evidence path/editorial changes are stable; guard version, authority, and effects changes alter fingerprint |
+| I01-004 | material | no implicit authority | legacy `task plan-set` remains actorless and the first catalog slice documents rather than removes that limitation | require actor/capability during authority retrofit without widening existing grants | fix in SM-05 after evaluator semantics stabilize | pending |
+| I02-001 | major | typed navigation must not overclaim execution admission | availability can advertise `kind: executable` while candidate-dependent guards remain explicitly pending | define protocol-v2 semantics and consumer behavior for availability-advertised versus execution-admitted transitions; reject consumers that ignore pending guards | fix in SM-04 before general catalog rollout | current envelope exposes `evaluationPhase` and exact `pendingInputGuardIds`; protocol and consumer conformance pending |
+| I02-002 | material | declared atomicity and recovery | corrective replan remains a non-transactional artifact/sidecar/state multi-write after all guards pass | add crash-boundary witnesses and either journal the adapter or retain a release-blocking limitation | split to MT-06 and the effect-adapter retrofit | pending |
+| I02-003 | major | explorer uses only reachable abstract states | hostile `blocked + in_progress` witness is store-injected; public-transition reachability of that exact corrupt/legacy posture is not proven | classify it as reachable legacy/recovery input or justify an unreachable exception separately from guard coverage | split to MT-03 reachability model | pending |
+| I03-001 | material | credential confinement | legacy top-level `updatePreflight.activeLeases` and `staleLeases` returned full `WriterLease`, including bearer token; token-free `observation.leases` alone did not close the leak | introduce a public token-free lease view and audit every read-only/repair output; retain tokens only at exact credential issuance/ownership boundaries | fixed for direct observer/diagnostic serialization in I-04; raw API split to I04-003 | recursive service/CLI credential oracle green; preflight and rescue-preflight project active/stale leases without token |
+| I03-002 | major | all declared observation failures are non-mutating | end-of-call digest cannot see a create-then-delete transient effect and intentionally excludes Git index/reflog read metadata | add dynamic filesystem mutation instrumentation for representative observer calls; keep Git read metadata as an explicit exclusion | split to MT-06 | persistent digest evidence green; dynamic instrumentation pending |
+| I03-003 | major | all read-only routes use the pure boundary | I-03 covers only `status`, `next`, and `updatePreflight`; `doctor`, prepare/show/status helpers, rescue preflight, graph reads, and direct CLI readers require separate proof | retrofit and prove every route classified read-only before the completeness gate | split to SM-03/MT-01 route slices | pending |
+| I03-004 | major | protocol/schema conformance | additive observation/navigation envelopes and nullable adoption have no published response schema and still travel under protocol v1 | define protocol-v2 response schemas and compatibility behavior before declaring typed navigation stable | fixed in CD-4 for the corrective-replan response family | strict public response schema, protocol 2, epoch 2 and read-only protocol-v1 adoption evidence compatibility are covered; unrelated response families retain their existing schemas |
+| I03-005 | major | observation consistency under races | the snapshot performs several filesystem reads without a cross-process lock, so an external writer can change evidence between reads | accept for observation only; every mutation/update adoption must re-evaluate under its write boundary and reject stale bindings | accepted documented limitation | external races are allowed by the primary invariant; execution revalidation remains a release gate |
+| I03-006 | material | existing recovery behavior remains reachable | I-02 catalog fallback initially bypassed remediation-mode recovery for a malformed legacy third attempt | reuse the existing recovery-candidate failover without adding new transition semantics | fixed during I-03 regression run | exact regression restored; full suite 193/193 |
+| I04-001 | high | credential confinement in update assessment | `update preflight` serialized live/stale bearer tokens through raw `WriterLease[]` | project through the shared public lease type | fixed in I-04 | active and stale service/CLI hostile serialization is bearer-free |
+| I04-002 | high | credential confinement in rescue assessment | `update rescue-preflight` repeated the raw lease serialization | use the same public projection | fixed in I-04 | rescue service/CLI hostile serialization is bearer-free |
+| I04-003 | high | published APIs must not expose raw credential stores | root exported `WriterLockManager`; public `WorkflowService.context().locks.inspect/list/repairStale` returned raw tokens | internalize mutation context/raw lock access and expose token-free public inspection/repair methods | fixed at the published API boundary in I-05 | package-root/runtime probe confirms no raw lock export or public context; safe inspect/repair methods and hostile tests green |
+| I04-004 | material | credential emitted only at acquisition | `task run`/`task claim` reprinted an already supplied token after heartbeat; service results duplicated it | return a discriminated `issued` versus `renewed` result; emit raw token exactly once only for a fresh acquire | fixed in I-05 | fresh run/claim emit one receipt; renewed run/claim emit none and the caller-owned credential remains usable |
+| I04-005 | material | Actor identity and grant handle threat boundary | DGR IDs are public audit handles while actor identity is caller-supplied inside the local boundary | document v2 as a trusted local Codex/user boundary; never claim cryptographic identity; keep exact actor/scope/expiry/fingerprint checks | accepted documented limitation for v2 | revisit only if remote/untrusted multi-tenant execution enters scope |
+| I04-006 | major | all CLI success/error output is credential-safe | generic CLI serializer had no safe-output chokepoint; paths relied on manual projections | add explicit output projections and an allowlist for exact issuance receipts; do not apply a blind token denylist | fixed for writer/claim credentials in I-05 | exact receipt allowlist, fail-closed success check, and sanitized error evidence green; future credential kinds remain I05-003 |
+| I04-007 | material | `advertised-but-rejected` is a real differential metric | MT-03 scaffold evaluated the same adapter twice, making zero tautological | split adapter APIs into advertise and execute/candidate evaluation; later bind them to public `next` and mutation in MT-05 | fixed at abstract-adapter level in I-05 | hostile invalid generator produces metric 1; valid generator produces 0; public service differential remains explicitly pending MT-05 |
+| I04-008 | major | abstract guard coverage maps to canonical transition semantics | scaffold used nine WF-024 oracle/model guard IDs while production catalog has seven phased guard IDs and broader allowed Task statuses | add an explicit oracle-to-catalog guard map; label exact-defect constraints separately | fixed for the current slice in I-05 | report contains exactly seven catalog guard IDs/phases; ready/exact-two WF-024 constraints are excluded from catalog coverage |
+| I05-001 | major | declared effect scope for explicit repair | `repairStaleWriterLease` still enters the general mutation context, which may recover project journals, register a project, or initialize adoption before deleting a stale lock | give lock repair a narrowly scoped effect adapter and make project recovery/registration explicit separate transitions | replan before cataloging lock repair | pending non-mutation/effect-scope digest |
+| I05-002 | major | complete read-only purity | several prepare/show/status helpers still use the general mutation context; I-03 only proved three primary observers | continue bounded read-route retrofit from I03-003; do not call a method read-only merely because its primary result is analytical | split to SM-03/MT-01 | pending per-route digest evidence |
+| I05-003 | major | credential-safe output remains extensible | CLI safety policy recognizes writer/claim credentials only; future grant/token kinds could bypass it if added without policy metadata/tests | make sensitivity/issuance projection part of the machine transition/input-output contract and fail CI for unclassified credential fields | fix during SM-05 catalog authority rollout | current writer/claim boundary green; no global credential-kind completeness claim |
+| I05-004 | major | protocol identity tracks envelope semantics | protocol v1 retains legacy `ContextEnvelope.writerToken`, now null on renewal and populated only on issuance | preserve as bounded security correction; protocol v2 must replace it with typed credential disposition and published response schemas | fixed for CD-4 corrective-replan outputs; legacy writer receipt remains an explicitly typed exact-issuance result | protocol 2 is active; corrective credentials/results are closed-schema and confirmation-code-free outside the prepare delivery |
+| I05-005 | major | model differential uses public behavior | MT-03 now compares distinct abstract functions but still does not call public `next` and the production mutation | retain `completenessClaim=false`; implement concrete replay/differential compiler in MT-05 | split to MT-05 | abstract hostile metric green; public differential pending |
+| AU00-001 | material | catalog is the complete admissibility source | requirements/acceptance, Knowledge and Plan Risk Audit gates remain outside the two pending candidate guards; changed retained Plan can be catalog-admitted then permanently rejected | stop local guard patches; implement AD-10 and move every permanent corrective-replan blocker into canonical admission | replan in I-07 | reviewer counterexample retained; pending complete public differentials |
+| AU00-002 | material | exact input/effect contract | catalog requires replacement risk audit and declares sidecar write, while service accepts `null` and succeeds without the write | make audit and auditor/hash bindings mandatory for this exact transition; effect unconditional or definition corrected | replan in I-07 | pending |
+| AU00-003 | material | role is not authority; execution presents exact bindings | actorless `setTaskPlan` recomputes transition bindings instead of requiring advertised ID/fingerprint/actor/capability | add exact bounded transition execution credential and verify under write boundary | replan in I-07/SM-05 | pending |
+| AU00-004 | material | pure evaluation before effects | corrective replan enters general mutation context before guards, allowing recovery/registration/adoption/lock-dir writes on rejection | mutation-free snapshot and full admission first; narrowly scoped adapter second | replan in I-07; related read-route work remains I05-002 | pending latent-journal/unregistered rejection digests |
+| AU00-005 | material | expired credential confinement | heartbeat checks token equality but not expiry and can resurrect a stale lease | reject expired lease before heartbeat; reject malformed expiry as corrupt state; require explicit repair only for a well-formed stale lease | fixed in I-06 | clock-advanced inspect/heartbeat/run/claim witnesses preserve state and lease bytes; malformed inspect/heartbeat/repair/run/claim return `STATE_CORRUPT`; full suite 219/219 |
+| AU00-006 | major | failed transition does not mutate lease | claim heartbeats an existing lease before claim-token/posture validation; failed claim extends expiry | validate before heartbeat or rollback renewal | fixed for claim in I-06; systemic route ordering is I06-001 | source order puts posture/actor/bindings/token/grant before lease renewal; complete state and lease bytes/dev/inode/mtime remain unchanged; live-lease duplicate probes remain required in I-07 |
+| AU00-007 | major | every read-only route is non-mutating | prepare/show/context/rescue/Knowledge readers still use mutation context; static labels overclaim purity | retrofit every read route through observation and add per-route evidence | fix in bounded SM-03/MT-01 slices after I-07 contract boundary | pending |
+| AU00-008 | major | typed navigation is versioned and schema-published | new navigation/observation and renewal semantics still travel under protocol v1 without response schemas | introduce protocol v2 schemas and compatibility policy | fixed for the CD-4 corrective vertical slice | protocol-v2 human-gate/credential/result schemas reject extras and epoch drift; CLI and WorkflowService public E2E are green |
+| AU00-009 | major | lifecycle epoch/catalog identity governs compatibility | epoch/fingerprint are not persisted, catalog hash absent, credentials not bound | lifecycle descriptor, catalog hash, persistence/adoption and supersession policy | fixed for the exact corrective-replan credential/execution family | receipt and journal bind epoch 2, runtime fingerprint, catalog hash and exact manifest; old credentials cannot widen; intact v1 adoption evidence is read-only compatible |
+| AU00-010 | major | production reachability/differential evidence | BFS remains one handwritten adapter and cannot detect public counterexamples | concrete witness compiler invoking public `next` and executor for every catalog edge | fix in MT-05 after I-07 | pending |
+| AU00-011 | major | semantic fingerprint includes executable authority/recovery semantics | projection omits SoD, forbidden combinations, idempotency and recovery because fields are prose | replace prose-only obligations with structured semantic IDs/versions and hash them | fix in I-07 transition-definition redesign | pending |
+| AU00-012 | major | explicit repair effects are confined to trusted root | direct lock inspect/repair can follow a symlinked lock root and unlink an external stale-looking file | trusted-root/no-symlink/no-follow validation plus identity recheck before unlink | fixed for deterministic path identity in I-06; syscall-gap limitation accepted as I06-002 | root identity swap and leaf symlink fail closed across inspect/heartbeat/release/repair; external bytes/inode and local link identity preserved |
+| AU00-013 | minor | transition schema/runtime parity | schema accepts invalid transition prefixes, roles and guard IDs and is not used to validate serialization | align enums/patterns and validate every serialized definition plus hostile documents | fix in I-07 | pending |
+| AU00-014 | minor | fail-closed CLI credential output | success scanner detects supplied secret only by exact string equality, not embedded substring | detect substrings except exact issuance value; derive future sensitivity from catalog metadata | substring case fixed in I-06; metadata integration remains I05-003 | unit hostile strings and full credential CLI regression green; exact fresh issuance allowance preserved |
+| I06-001 | major | every deterministic admission guard precedes lease effects | exact claim path is fixed, but `handoffTask` and claimed `runStep` still heartbeat before all handoff/actor/binding checks; a rejected call can extend a live lease | stop route-local heartbeat patches; introduce a shared pure admission result consumed by a narrowly scoped lease/effect adapter, then prove every credential consumer with live-lease non-mutation witnesses | replan in I-07 under AD-10/AD-11 | reviewer source evidence at `workflow.ts` handoff/run paths; pending structural implementation and public adverse tests |
+| I06-002 | major | filesystem effect confinement is stated within the actual execution boundary | portable Node lacks `openat`/`unlinkat` directory-handle operations, leaving a final path replacement interval after dev/inode recheck | retain no-follow and immediate identity checks; document v2 trusted-local OS boundary; require native/platform-specific adapter only if hostile same-principal filesystem concurrency enters scope | accepted documented limitation for v2 | deterministic root/leaf identity swaps are covered; no claim of kernel-atomic confinement against the same OS principal |
+| I06-003 | major | negative evidence must exercise the intended guard ordering | the independent invalid/used/wrong/no-posture claim loop uses an advanced clock after the one-minute test lease, so expiry can mask a future ordering regression even though current source order is correct | repeat each deterministic claim rejection with a live lease and unchanged bytes/dev/inode/mtime; extend the same oracle to handoff/run under I06-001 | fix in I-07 Model/Test packet before production admission changes | current source order and expired-clock evidence are valid but not sufficient for the broader ordering release gate |
+| I07-D01 | material | an advertised source posture has one satisfiable input contract | `needs_fix + failed Task review + two or more review attempts + current replan-required` appears to require `correctiveAudit` in one branch and forbid any supplied `correctiveAudit` in another | prove public reachability; if reachable, exact replan treats the recorded decision as source evidence and forbids the legacy audit input; if unreachable, classify as legacy/recovery input with typed blocked/repair | investigate and resolve in I07-B before executable navigation | source contradiction confirmed; public reachability pending independent witness |
+| I07-D02 | material | every required source posture is publicly reachable | approved replan requires C1/lease released, but current non-terminal claimed Task cannot use terminal-only `task handback` | add exact `task.coordination.corrective-yield` prerequisite with claimant/token authority, no running Step, append-only evidence and lease release; do not let it authorize Plan mutation | fixed in CD-3/CD-4 | public WorkflowService/CLI yield→prepare→execute witness preserves Task bytes, appends exact evidence and releases the same-slot lease |
+| I07-D03 | material | `executable` means zero failed and zero pending guards | current evaluator computes `allowed` from failed guards only and permits executable navigation with known pending candidate guards | retain separate `available` and `executable` predicates; plain next is human-gate, candidate-aware prepare alone may issue executable receipt | fixed in CD-4 protocol-v2 navigation | availability exposes eight pending execution guards; only candidate-bound prepare/confirmation plus under-lock admission can execute; abstract advertised-but-rejected is zero |
+| I07-D04 | material | independent Plan Validation precedes authorization | no runtime Plan Validation attestation is bound to a corrective replacement candidate; documentation alone cannot enforce AD-05 | add a fresh isolated validation envelope/attestation, exact candidate/architecture bindings, covered findings, isolation evidence and expiry; journal the passed evidence with the Plan | fixed in CD-1/CD-4 | real Ajv-bound attestation, identity isolation, findings/dispositions, expiry and exact candidate/source bindings are verified and journaled before Plan publication |
+| I07A-R01 | material | release readiness is derived, not self-asserted | A2 removed readiness labels, but profile `requiredRuleIds` and coverage kinds are still strings disconnected from executable checks; self-hashed evidence is not test proof | register exact executable rule evaluators and move verified evidence to the package release boundary; empty/unimplemented rules fail closed | replan in I07-A3 | residual changed-evidence review: profile/evaluator and producer gaps confirmed |
+| I07A-R02 | material | exact authority scope is machine-bound | A2 models receipt fields, but principal/basis/kind, capability issuer/scope/source, credential issuer/presentation, eligible role claim and Plan-author binding are not cross-linked | compile and verify one exact authority tuple with role eligibility guard and complete candidate/authority receipt projection | replan in I07-A3 | residual authority tuple counterexamples retained |
+| I07A-R03 | material | effect order and admission linkage are explicit | A2 adds an ordered DAG, but exclusive lock scope and under-lock revalidation read supersets are not proven | register exact lock scope and require revalidation reads to cover canonical race and guard reads before first effect | replan in I07-A3 | empty/wrong scope and removed-read single-negatives required |
+| I07A-R04 | material | SoD and forbidden combinations fail closed | A2 registers identity operands, but verifier refs are not constraint-specific and forbidden combinations can use a non-enforcing verifier without readiness failure | bind an executable comparator/evaluator to exact constraint ID/operands/relation/rule/missing-identity behavior; cover SoD and forbidden rules equally | replan in I07-A3 | residual verifier-none/wrong-operands counterexamples retained |
+| I07A-R05 | major | inputs and read sets are registered semantics | A2 refs remain partly nominal: schema entries lack artifact/digest/validator, nested adapter refs are incompletely closed, fingerprint closure skips unknown refs, and schema vocabulary is manually duplicated | bind immutable schema artifacts and validators, validate every nested ref, fail closed in fingerprint closure, and generate or exhaustively parity-check schema vocabulary | replan in I07-A3 | no JSON predicate DSL; changed-evidence registry closure findings retained |
+| I07A-R06 | major | runtime fingerprint changes only with executable semantics | A2 separates runtime/readiness identity, but same-projection slices with different fields remain order-sensitive | normalize projection slices by projection plus normalized field set and add same-projection permutation evidence | fix in I07-A3 | localized hash bug, but held with the architecture packet by anti-loop |
+| I07A-R07 | material | replay and recovery are executable contracts | A2 structures reliability, but execution-key fields are projection-unqualified/incomplete; failure guarantee, recovery-chain reachability and effect-to-postcondition coverage remain unchecked | use exact projection-field keys; complete the authority/candidate execution key; execute reliability rules for nonmutation, journal/recovery paths and postcondition-effect coverage | replan in I07-A3 | residual replay/recovery counterexamples retained |
+| I07A3.1-F01 | material | a registry descriptor is not an implementation | A3.1 auto-generated bindings were replaced in A3.1b by an explicit table containing the seven real guard functions, `setTaskPlan`, raw `readTask` and hash functions | retain exact callable identity inside the private family IR; no metadata-derived binding path | fixed in A3.1b; preserve in I07-A3.1c | 47/47 focused evidence and fresh source review confirm no auto-mint path |
+| I07A3.1-F02 | material | static readiness consumes compiler-issued canonical IR only | A3.1b closed public structural forgery with a WeakMap handle, but computed readiness before constructing a post-hoc canonical IR; the IR was provenance evidence rather than the evaluator input | one exact family compiler must issue private IR with actual callables and rule inputs; readiness consumes only that IR; remove structural/generic evaluator | replan and fix in I07-A3.1c | fresh reviewer exact call-order/source counterexample; trusted-local forgery is closed but the architecture invariant remains open |
+| I07A3.1-F03 | material | Workflow Core owns the exact semantic registry and profile | A3.1b froze the Core environment and made injected compilation diagnostic-only | exact family compiler accepts no environment/profile/evidence and owns its installed bundle | fixed in A3.1b; simplify in I07-A3.1c | same-ID substitution hostiles and source review confirm injected values cannot mint a Core handle |
+| I07A3.1-F04 | material | referenced payload schemas have exactly one installed artifact and validator | A3.1b installed seven real Ajv payload validators, but generic lookup used first-match `.find`, validator implementation/subschema identity was absent from private IR and provenance | exact family schema resolver requires exactly one artifact and validator and binds schema ID/version, digest, subschema, validator implementation ID/version and callable | replan and fix in I07-A3.1c; runtime invocation remains B/C/D | fresh reviewer duplicate/subschema counterexample; payload positive/hostile tests alone are insufficient |
+| I07A3.1-F05 | major | static semantic rules cannot consume release evidence | A3.1b removed definition evidence from the rule definition, but still passed the full registry including coverage profiles/producers and editorial descriptions | each family rule receives a minimal deep-frozen field-allowlisted context; no full registry, readiness, evidence, traceability, documentation or descriptions | replan and fix in I07-A3.1c | fresh reviewer typed counterexample and independent oracle redesign |
+| I07A3.1-F06 | major | one authoritative compiler path owns semantic validity and fingerprints | diagnostic hashes cannot forge the WeakMap handle, but raw public fingerprint silently skipped unknown refs and remained easy to misinterpret as authoritative validity | unresolved refs fail closed; remove raw identity/standalone readiness helpers from root exports and retain only explicit non-authoritative diagnostics if still needed | replan and fix in I07-A3.1c before stable | fresh reviewer unknown-guard-ref counterexample; authority bypass is closed but API correctness remains open |
+| I07A3.1B-P01 | minor | iteration evidence is attributable to a frozen candidate | A3.1 and A3.1b were never committed, so exact packet delta cannot be reconstructed from Git; reconstructed production delta reached the +399 stop boundary | record the limitation, reject additive repair, and make I07-A3.1c net-negative with exact before/after scoped manifest and ledger evidence | accepted documented limitation for A3.1b; fix provenance prospectively in I07-A3.1c | fresh reviewer provenance finding; no claim of exact A3.1-to-A3.1b diff is retained |
+| I07A3.1C-AR01 | material | metadata cannot mint executable semantics without an exact callable binding | a descriptor can increment a guard semantic version or drift command/source semantics, refresh hashes, and receive the unchanged installed callable table | bind the complete executable family projection and each ordered semantic slot to exactly one installed callable/version; reject any drift before issuing a handle | fixed in I07-A3.1d | semantic-version/source/command/order and missing/extra/substituted binding hostiles green; fresh source re-audit confirms exact slots |
+| I07A3.1C-AR02 | material | Core-installed authority objects are immutable and closure-private | inspection re-exports the live semantic registry and payload artifact/validator arrays used by Core identity checks | recursively freeze the canonical bundle at module initialization; inspection may expose only immutable installed objects or non-authoritative projections | fixed in I07-A3.1d | recursive mutation hostiles cover registry, schema documents, arrays, validators, rules and transition bindings; Core result unchanged |
+| I07A3.1C-AR03 | material | exported executable definition cannot drift after fingerprinting | the public definition, metadata, guard array and evaluator holders are mutable while their fingerprint is cached | freeze the definition graph before export/fingerprint use and serialize cloned data rather than catalog-owned references | fixed in I07-A3.1d | public definition/catalog mutation attempts fail; detached serialization and stable fingerprint replay green |
+| I07A3.1C-AR04 | major | each static rule receives only its own minimal immutable context | one full context is attached to every rule and evaluation always passes the first rule's context | use a rule-specific allowlisted projector and invoke each installed callable with its own bound context | fixed in I07-A3.1d2 | five exact nested context shapes, deep freeze, binding-specific consumption and wrong-first-context hostile green |
+| I07A3.1C-AR05 | minor | compilation does not mutate caller-owned input | private IR deep-freezes the original descriptor by reference | clone/canonicalize after validation and freeze only the Core-owned representation | fixed in I07-A3.1d | caller tree remains unfrozen/byte-equal and later mutation cannot alter issued IR or readiness |
+| I07A3.1D-R01 | major | each static rule receives only fields its callable reads | A3.1d split contexts by rule but still copied entire nested guard, admission and reliability sections | replace the generic section projector with five exact nested projectors and evaluate each binding with its own frozen context | fixed in I07-A3.1d2 | independent exact-shape oracle green; final source re-audit found no residual overprojection |
+| I07A3.1D-R02 | minor | exact transition binding includes its own version | diagnostic exact-binding compared implementation identity but omitted top-level binding `version` | compare the exact binding version and reject drift before issuance | fixed in I07-A3.1d2 | version-2 hostile is non-issuable with path-specific `core.transition-binding.semantic-mismatch` |
+| I07A3.2-R01 | material | authority readiness is exact field-linked semantics, not presence/count | the accepted static rule accepts arbitrary nonempty capability/credential/comparator arrays and roles | introduce a field/path exact family assessor for actor, principal, capability, delegation, ownership, constraints and supersession | fixed in I07-A3.2a3 | exact root/nested closed-world allowlists, three unique constraints and full 28-field binding pass table-driven single-negatives; live definition remains static-false |
+| I07A3.2-R02 | material | human confirmation and public receipt are distinct required authority inputs | current required inputs mention a future receipt but not an exact confirmation input | reserve two-input presentation for C; A3.2a must keep exact-credential/runtime-enforcement blockers and may not claim completion | split: static tuple in A3.2a; presentation in C | no confirmation/receipt placeholder descriptors permitted in A3.2a |
+| I07A3.2-R03 | material | authority descriptors resolve to actual pure callables | no installed role evaluator, comparator, verifier or clock exists | install only the real pure role evaluator and three constraint-specific comparators as a private unavailable bundle; verifier/clock wait for C | fixed in I07-A3.2a3 | canonical identity truth tables and exact missing/duplicate/wrapped/substituted object-identity closure green |
+| I07A3.2-R04 | material | SoD/forbidden rules are exact tuples | live definition and registry contain no comparator tuples | assess author/validator, author/risk-auditor and author/human-principal constraints with exact operands/relation/missing/enforcement | fixed in I07-A3.2a3 | exactly three unique closed-world constraints; Validator and Risk Auditor may be the same independent reviewer; no role-only comparator |
+| I07A3.2-R05 | material | prior Plan-bound authority cannot survive semantic Plan replacement | legacy grants are not bound to Plan hash/fingerprint/epoch and current effects preserve grants generically | statically require exact candidate-bound capability, forbidden delegation and execution-authorization supersession; runtime invalidation remains C/D | static half fixed in A3.2a3; effects remain C/D | authority-none/supersede-old-Plan grant oracle green; no current grant acquires replacement-Plan authority |
+| I07A3.2-R06 | major | authority callable semantic identity supersedes receipts on change | authority callable closure is currently compiler provenance only | bind exact callable ID/version/object identity in the private authority bundle and require version bump for any semantic replacement; receipt supersession waits for C | static half fixed in A3.2a3; activate in C | frozen projected bundle hash and implementation-version sensitivity green; live runtime fingerprint/catalog remain pinned |
+| I07A3.3-F01 | material | unavailable reliability semantics are exact closed-world callable-bound input | A3.3 accepted extra semantic bindings, ignored fragment binding refs and left contract/version/transition/lock/revalidation/hash/nested fields unchecked | replace partial field probes with one typed canonical exact-family IR; require exact-one binding set and reject all undeclared fields before assessment | replan A3.3 replacement | changed-evidence counterexamples accepted unknown binding, wrong transition/lock/hash and nested extras while reporting valid linkage |
+| I07A3.3-F02 | material | effect-to-phase bijection uses the actual exact effect and phase vectors | A3.3 omitted effect ID/ordinal/resource/count, phase ID/ordinal/next/count and their cross-links | compare complete typed vectors, then derive uniqueness, dependency, cardinality and exact effect-to-phase coverage from those vectors | replan A3.3 replacement | changed-evidence counterexamples changed commit effect/resource and appended effects/phases without rejection |
+| I07A3.3-F03 | material | recovery/readback/apply-or-confirm are executable exact-family topology | recovery ignored mode/operation/terminal/step identity; readback ignored adapter/lock/order/postcondition identity, reads, comparator and count | include complete recovery/readback vectors in the immutable IR and validate every cross-link against actual effects/phases and exact truth semantics | replan A3.3 replacement | changed-evidence counterexamples accepted delete recovery, unknown readback, unlocked readback and always-true comparators |
+| I07A3.3-F04 | material | durable intent owns every byte needed for deterministic roll-forward | intent preceded staging but contained only booleans/digest field names, not target bytes or durable refs, prior/result digests, CAS target and sidecar anchors | model exact Core-owned target records for Task, Plan, Validation and Risk Audit, each with destination, immutable bytes/ref, precondition and result digest/chain anchor; otherwise keep linkage invalid | replan A3.3 replacement; runtime writer remains D | crash immediately after intent had no recoverable source bytes despite claimed roll-forward topology |
+| I07A3.3-F05 | major | diagnostic identity binds the assessed input and installed implementation | report hash omitted fragment/binding input and compiler build identity remained the pre-A3.3 symbolic value | bind canonical fragment hash, exact installed bundle hash and inspection/compiler implementation version; keep the report explicitly non-authoritative | fix in A3.3 replacement | distinct accepted fragments could share a report hash; private IR changed without compiler identity change |
+| I07A3.3-F06 | major | authority candidate binding and reliability execution key share one source | A3.2 authority and A3.3 reliability independently duplicated the same 28 semantic members | define one private canonical binding manifest and derive authority binding names, ProjectionFieldRefs, revalidation/race reads and intent digest fields from it | fix in A3.3 replacement | both local assessors could remain green after one list drifted during lifecycle evolution |
+| I07A3.3V2-F01 | material | journal ownership uses exact stored bytes and byte-level preconditions/results | v2 used candidate Plan/input hashes as Task-state and stored-event byte digests, conflated stage/publish absence, omitted Task-state result digest/revision and sidecar previous/new chain anchors, and referenced unavailable inputs/projections/resources | define these records only with the actual C/D schemas and Core materializer; no shape-only ownership-valid claim | split and merge into C/D | typed closed-world oracle was green because it compared against a semantically wrong canonical blueprint |
+| I07A3.3V2-F02 | material | terminal readback observes only already-completed effects and validates journal integrity | v2 placed readback before completed-journal retain while a readback postcondition claimed retain already happened; intent/phase-chain integrity was not read back | implement explicit pre-completion domain readback plus terminal journal readback, or one final readback after terminal retain with recoverable failure posture | split and merge into D | impossible ordering was present in the canonical vector and therefore survived exhaustive structural hostiles |
+| I07A3.3V2-F03 | major | diagnostic request and binding identity fail closed and are set-canonical | unknown source and malformed binding input defaulted to installed data, null could throw, and binding permutation changed bundle/report identity | exact closed request union, total row validation, ID-keyed callable identity and canonical bundle projection | split with retired diagnostic; preserve requirements in D tests | direct source counterexamples; no Core/public authority bypass |
+| I07A3.3V2-F04 | major | authority consumes the same manifest identity and field mapping as reliability | authority imported derived binding IDs only, so projection/field remapping changed reliability identity but not authority tuple/bundle | C authority receipt/capability and D execution key must bind the same manifest ref/hash and literal field mapping | split across C/D | shared list existed, but manifest identity was not part of the authority report/bundle |
+| I07A3.3V2-F05 | minor | every collection declares keyed-set or ordered semantics | target/postcondition arrays were positional without ordinals while locator IDs were sorted without a locator template | use explicit IDs+canonical keyed sets or ordinals; locator path construction requires a registered template | split into C/D schema design | no current runtime/public effect; contract ambiguity only |
+| I07CD1-R01 | material | expected context and Core ownership originate independently of caller presentations | validation, challenge, receipt and event functions accepted both the subject and the values labelled expected/Core-owned from the same request | replace direct functions with a private kernel capturing trusted snapshot/clock/ID/code/tail ports and issuing opaque WeakMap-backed handles; inspection cannot mint or expose handles | replan CD-1 replacement | schema-valid hostile values became valid when the caller recomputed their expected hashes and timestamps |
+| I07CD1-R02 | material | receipt proves the exact capability, candidate, validation, confirmation, supersession and time tuple | binding cross-links, attestation/candidate linkage, genuine confirmation provenance and `validated <= confirmed <= issued < expires` were not enforced; receipt time input was unused | receipt issuance must require same-kernel genuine validation/confirmation handles, full binding/capability cross-links, Core-owned grant/time and explicit semantic hash domains | replan CD-1 replacement | internally inconsistent self-hashed bindings, foreign attestations, structural confirmation projections and expired issuance were accepted |
+| I07CD1-R03 | material | authority and execution consume the full shared manifest identity and mapping | authority imported only a derived set of 28 binding names; inspection merely exposed two aliases to the manifest and no execution consumer existed | bind authority to the exact manifest object/ref/hash/full row mapping and report execution linkage honestly pending until CD-2 | replan CD-1 replacement | projection, field and receipt-path drift preserved authority acceptance, repeating I07A3.3V2-F04 |
+| I07CD1-R04 | material | every installed schema and callable envelope is closed and used by its real path | stored-event paths skipped their Ajv artifact, receipt verification ignored closed-world extras, wrapper inputs accepted unknown fields and time checks allowed negative/fractional values | validate actual receipt/event artifacts on materialize and verify, exact-allowlist all operation envelopes, and require safe nonnegative integer times with total malformed-input results | replan CD-1 replacement | schema-invalid event values and receipt extras returned valid projections despite exact schema closure tests passing separately |
+| I07CD1-R05 | major | Plan Validation findings/dispositions and validity interval are exact | only finding uniqueness and disposition count were checked; orphan/duplicate dispositions and `expires < validated` could pass | require unique keyed-set equality between findings and dispositions, positive ordered validity interval and explicit planner/validator context-time policy | replan CD-1 replacement | equal-length wrong-ID disposition sets and inverted time intervals passed the first implementation |
+| I07CD1R2-F01 | material | receipt issuance and verification bind the full current Core snapshot, prior authorization and clock | issuance reread only `baseValues` and prior authorization, omitting `validationExpectation`; verification compared a genuine handle and bytes without rereading clock/current snapshot/grant | commit one canonical snapshot-binding hash over manifest, base values, full validation expectation and prior authorization; reread it at receipt issuance and verification and reject stale/expired/superseded receipts | replan CD-1 round 3 | changing only validation coverage/context after validation still issued a receipt; advancing the clock or changing state/grant after issuance still verified it |
+| I07CD1R2-F02 | material | Human confirmation time is Core-observed and challenge validity is checked against the current Core clock | caller supplied `confirmedAtMs`; an expired challenge could be accepted by backdating that field, and stored-event time was not ordered after receipt issuance | remove caller authority over confirmation audit time, set it from the captured Core clock, require `issuedAt <= now < expiresAt`, and enforce monotonic validation/challenge/confirmation/receipt/event ordering | replan CD-1 round 3 | correct code plus a backdated timestamp produced a genuine confirmation after challenge expiry |
+| I07CD1R2-F03 | material | one-time issuance is keyed by semantic preparation, not merely opaque handle identity | duplicate validation issuance for the same Task/snapshot/candidate created independent handles, challenges, receipts and sibling events sharing one previous tail | reserve a Core-owned semantic preparation key before issuing IDs/code; exact duplicates return a deterministic secret-free conflict/idempotent result; retain CD-2 tail CAS as an explicit pending blocker | replan CD-1 round 3 | two exact preparations reissued raw codes and bypassed per-handle WeakSet consumption |
+| I07CD1R2-F04 | major | every unknown envelope is total, bounded and preserves caller ownership | nested malformed draft values could throw during clone/hash before Ajv; arrays/strings/code lacked bounds; malformed closure overrides threw or were recursively frozen in caller-owned objects | validate bounded JSON/nested draft structure before clone/hash, add explicit size/code bounds, normalize all malformed input, and ensure closure never returns/freezes caller override objects | replan CD-1 round 3 | functions in nested findings and null/wrong-array closure inputs caused exceptions; unbounded inputs admitted excessive work |
+| I07CD1R2-F05 | minor | Git object IDs are exactly 40 or 64 lowercase hex characters | canonical predicate used `{40,64}` and therefore admitted lengths 41–63 before the final schema layer | use exact 40-or-64 alternation and cover 39/40/41/63/64/65 lengths | replan CD-1 round 3 | canonicalization and schema disagreed on intermediate Git lengths |
+| I07CD1R3-F01 | material | Plan Validation reads one Core-owned immutable draft snapshot and never freezes caller ownership | the kernel traversed, validated and later materialized the caller draft through repeated property reads; a stateful getter could change after validation, and accepted nested objects were frozen by reference | copy once through an accessor-free, plain, acyclic, globally bounded JSON copier before the first semantic read; validate/materialize/freeze only that owned tree; prove getter switching and caller mutability after success/failure | replan CD-1 round 4 | a getter could return trusted coverage during comparison and a different schema-valid coverage during attestation construction |
+| I07CD1R3-F02 | material | semantic single issuance expires or is explicitly superseded instead of becoming a permanent tombstone | the preparation map retained `true` forever after successful Plan Validation, while the only challenge/code delivery was also permanently single-use | store generation/status/expiry per semantic preparation; active duplicate remains secret-free conflict, expired generation permits new issuance before ID/code, and every old Plan/challenge handle becomes superseded | replan CD-1 round 4 | lost delivery or expired challenge left the exact Task/state/candidate unable to prepare again for the lifetime of the kernel |
+| I07CD1R3-F03 | major | diagnostic closure is total for every unknown object shape | Proxy traps and throwing accessors in the closure request or candidate rows escaped because property/prototype/collection reads were not enclosed by a total boundary | use descriptor-safe data-property inspection plus a final total wrapper that returns deterministic `closed:false` without exception text or caller references | replan CD-1 round 4 | a plain-looking object with a throwing `authorityBindingManifest` getter threw outside the diagnostic result |
+| I07CD1R3-F04 | major | malformed processing has one global work/byte budget in addition to local shape limits | the draft walker bounded depth and local width but not total nodes/string bytes; closure accepted arbitrarily long override arrays before repeated exact scans | apply one explicit node/string-byte budget to the owned draft copier and cap closure collection cardinality before identity scans while preserving deterministic exact diagnostics | replan CD-1 round 4 | a branching hostile tree or very large diagnostic collection could force unbounded traversal despite local limits |
+| I07CD1R4-F01 | major | diagnostic closure never reflects caller-controlled credential-like values or unbounded identifiers | canonical-extra diagnostics copied the hostile row ID into path, ref and message; a confirmation code, newline/path injection or oversized ID could be emitted | bound and validate row IDs before sorting/scanning; invalid IDs collapse to a fixed collection diagnostic; canonical extras use only the original bounded array index and fixed ref/message | fixed in CD-1 round 4a | per-collection code/newline/oversized and canonical-extra witnesses prove deterministic secret-free non-aliasing output; fresh review confirms no caller ID reaches diagnostic output |
+| I07CD1R4A-F01 | minor | exact closure diagnostics remain regression-protected after the no-echo fix | initial round-4a oracle covered invalid collections and extras but did not explicitly pin missing, duplicate and substitution behavior across all three collections | add a table-driven matrix for artifact, validator and function collections using trusted installed-ID paths, determinism and caller-ownership assertions | fixed in CD-1 round 4a | all three collections cover missing/duplicate plus substituted or callable-substituted; fresh read-only confirmation reports `0 material / 0 major / 0 minor` |
+| I07CD2-F01 | material | durable intent owns exact serialized preimages and postimages and cannot hide an incomplete completion | first CD-2 checkpoint stored only preimage digests and admitted `completed` before all five canonical targets matched | persist each exact preimage/postimage under the transaction root; bind them into the intent; require ordered target readback and a result hash before completion; revalidate retained completed journals | fixed in CD-2 candidate; independent confirmation pending | hostile owned-byte tamper, alien Task CAS, skipped/no-op phase and incomplete completion all fail closed; canonical targets remain unchanged on rejection |
+| I07CD2-F02 | material | every normal Task read/mutation observes a nonterminal Task journal without implicit recovery | initial observation integration covered `status`/`next`/preflight, while direct `FileStateStore.readTask`, listing, artifact and sidecar routes could bypass it | enforce the boundary in Task store reads/writes/artifacts/sidecars and repeat it after reads; reserve direct filesystem access for the exact transaction store | fixed in CD-2 candidate; independent confirmation pending | pending journal blocks direct Task/list/artifact access and the central Workflow mutation context with byte-identical state; observations remain read-only |
+| I07CD2-F03 | material | authority and storage consume the exact same 28-row manifest identity | initial transaction header accepted any syntactically valid manifest hash | import the sole CD-1 manifest singleton, compare its exact identity/hash and derive the journal projection from it | fixed in CD-2 candidate; independent confirmation pending | wrong manifest cannot create intent; credential marker advances honestly to `credential.execution-linkage.pending-cd3` rather than claiming executor wiring |
+| I07CD2-F04 | material | phase history commits the immutable admission/target contract | initial phase hashes covered only phase fields, so receipt/header/anchor replacement was not committed by the chain | add a domain-separated `intentSha256` over the exact header and five target records and include it in every phase-entry hash | fixed in CD-2 candidate; independent confirmation pending | header and owned-target tamper are rejected as `STATE_CORRUPT`; phase timestamps/order and sidecar anchors are revalidated |
+| I07CD2-F05 | major | Core mutex state is observable and cannot be structurally forged or silently replaced | a Core mutex before journal intent, or stale after a crash, was absent from observation; exact file recreation could preserve visible fields | bind opaque handles to the original lock inode, expose only a token-free Core-operation projection, and block orphan active/stale operations without advertising unavailable repair | fixed in CD-2 candidate; independent confirmation pending | Writer/Core mutual exclusion, forged/foreign/recreated handles, orphan observation and normal mutation blocking are covered; stale Core repair remains deliberately unavailable until CD-3 journal-aware recovery |
+| I07CD3-F01 | material | retained replan journals have one exact path identity and legal phase topology | a syntactically valid journal could be copied under another transaction directory, or have its phase entries rehashed into an impossible first/next phase while preserving the hash chain | bind journal identity to the requested transaction directory and Task root; validate the exact intent→ordered apply→published-readback→completed topology independently of the entry hashes | fixed in CD-3 candidate; independent confirmation pending | copied-directory and recomputed-illegal-phase hostiles both fail `STATE_CORRUPT`; all crash/recovery paths remain green |
+| I07CD3-F02 | major | executor request envelopes are read once from plain data properties and cannot run caller accessors | the outer replan request checked key names but did not reject accessors before reading Plan/Risk fields | require exact enumerable own data descriptors, reject symbols/Proxy/accessors before semantic reads, and retain the bounded owned JSON copy for Plan/Risk values | fixed in CD-3 candidate; independent confirmation pending | stateful Plan getter is rejected as `INVALID_ARGUMENT` with zero getter reads and no transaction intent |
+
+Valid dispositions are: `fix`, `replan`, `split`, `accepted documented limitation`, and `stop-escalate`.
+
+## Defect traceability
+
+The generated traceability manifest will map every `WF-STABLE-*` and `WF-REG-*` identifier to an invariant, transition ID, and positive/hostile evidence.
+
+Initial mandatory mapping:
+
+| Defect | Invariant | Transition area | Evidence status |
+| --- | --- | --- | --- |
+| WF-STABLE-024 | advertised exact transition is executable | `task.plan.corrective-replan` from ready failed guarded Step | positive concrete replay and source/candidate hostile differentials green for this slice |
+| All register entries | declared invariant per defect register | catalog inventory | pending MT-01/MT-02 |
+
+## Anti-loop rules
+
+- Every finding receives a disposition before another implementation round.
+- Review cannot repeat without a changed candidate/evidence hash or a documented reason.
+- If the same contradiction class recurs twice, stop local patching and return to the transition model and this Brief.
+- New ideas outside approved scope go to backlog and do not widen the active iteration.
+- Reviewer does not fix or close its own findings.
+- Orchestrator may close a finding only with changed evidence and independent confirmation appropriate to severity.
+- A material final-review finding that was detectable at an earlier gate creates a separate earliest-detection process finding.
+
+## Release gates
+
+- 100% of dispatchable CLI routes are classified as read-only, transition, alias, explicit repair, or external effect.
+- 100% of mutations resolve to a stable transition ID with guards, authority, effects, atomicity, failure guarantee, and recovery contract.
+- 0 executable free-form `next` actions exist outside the catalog.
+- 100% of guards have positive and single-negative evidence or a justified unreachable exception.
+- 0 undeclared navigation-priority conflicts exist outside typed `choice`.
+- `advertised-but-rejected = 0` over the reachable abstract graph and concrete differential suite.
+- Every reachable abstract edge has a concrete witness or an explicit justified exception.
+- Every `WF-STABLE-*` and `WF-REG-*` defect has `defect → invariant → transition → test` traceability.
+- Role/rights generation contains no implicit authority.
+- Terminality, binding freshness, corrective breaker, membership integrity, protocol seriality, credential confinement, and earliest detection are executable invariants.
+- Runtime-emitted canonical state and sidecars conform to the published schemas.
+- Every declared non-mutating failure preserves the complete observed-state digest.
+- Multi-write transitions have declared crash boundaries and tested recovery or an explicit release-blocking limitation.
+- The current regression suite remains green.
+- Adverse E2E covers happy path, two review failures, continue-fix, replan-required, split-required, context refresh, lease expiry/recovery, compatible package update, and incompatible lifecycle mapping.
+- Two final E2E runs pass without changing the candidate/evidence hash between runs.
+- Independent audit reports no unresolved material finding.
+
+## Current blockers
+
+- Only `task.plan.corrective-replan` is cataloged; no global completeness claim is permitted.
+- The CD-4 exact family is static-ready, but package release still requires the full suite, repeated unchanged-candidate adverse E2E, package-boundary/release checks and a fresh changed-evidence review.
+- Human confirmation is an audited same-principal acknowledgement inside the trusted-local v2 boundary; it is not remote authentication or a multi-user authorization protocol.
+- Protocol-v1 adoption evidence has one bounded read-only compatibility window because state schema remains 2. No generic epoch migration or skip-upgrade mechanism exists; unknown/mixed protocol evidence fails closed.
+- Several unrelated prepare/show/status routes still enter the general mutation context and lack per-route purity evidence; CD-4 does not expand its completeness claim to them.
+- Explicit stale-lock repair still inherits unrelated mutation-context effects until I05-001 is fixed.
+- The same admission-before-lease-effect defect remains in handoff and claimed-run routes; I06-001 requires one shared structural boundary in I-07 rather than more route-local patches.
+- Kernel-atomic path confinement against a concurrent process with the same OS principal is outside the v2 trusted-local boundary; deterministic no-follow/identity protection remains mandatory.
+- The finite explorer and public E2E cover the exact corrective slice only; they are not proof for unmodeled lifecycle families.
+
+## Stop/continue decision
+
+Decision: **the standalone A3.3 path remains retired; continue only the integrated CD-4 candidate through its final full-regression, package-boundary and fresh changed-evidence gates**. The exact corrective slice now contains the real authority inputs, target bytes, journal writer, recovery and both readbacks together; no broader catalog-completeness claim follows.
+
+Every AU-00 and I-06 finding now has a disposition. I-06 closes its exact expiry, claim, deterministic path, and output-confinement defects on a frozen candidate with 219/219 regression evidence. Its follow-up review also proves that failed-admission lease mutation is systemic: handoff and claimed-run still perform lease effects before all deterministic guards. Together with AU00-001/AU00-004, this is a repeated guard-versus-effect contradiction class. The anti-loop rule therefore prohibits another local method patch. I-07 must introduce one complete admission contract and a narrow effect adapter before any additional transition family enters the catalog. I06-003 adds live-lease ordering witnesses so expiry cannot mask regressions. No other transition family may enter the catalog before I-07 closes without material findings.
+
+I07-A introduced structured definitions, schema parity, fingerprints, catalog hashing, and honest `partial` readiness. Typecheck and 21 focused implementation/model tests passed, but read-only authority/evolution review found that the substrate itself still allowed readiness by labels and left authority scope, effect order, SoD, projections, runtime identity, and recovery underspecified. All seven findings are dispositioned `fix` in I07-A2. Runtime admission, protocol, and effect work remain paused until the revised substrate passes changed-evidence review.
+
+I07-A2 added format-v2 registered descriptors, ordered effects, structured reliability, derived blockers, and separate runtime/readiness hashes. Typecheck, strict schema validation, and 30 focused tests passed, but the repeat review proved that enumerated rule IDs were still not the executable source of readiness and that exact authority, lock/read coverage, identity enforcement, schema artifacts, and recovery chains remained only partially cross-validated. This is the second occurrence of the same declaration-versus-enforcement contradiction. AD-14 therefore prohibits another list of local `if` patches: I07-A3 must compile definitions through registered executable rules and must separate semantic readiness from verified package-release evidence.
+
+I07-A3.1 established a real Draft 2020-12 transition-definition artifact, recursive reference closure, executable release-rule functions, deterministic format-3 compilation, and an evidence-independent static report. Independent validation reproduced 39/39 focused passes and stable hashes. The changed-evidence reviewer then demonstrated that the implementation registry itself was still synthetic: a generic ID/version predicate was automatically assigned to every descriptor, and the compiler discarded provenance into a forgeable public structure. This is the same metadata-versus-execution contradiction at the implementation boundary, so the green suite does not close AD-14. I07-A3.1b is a bounded trust-boundary correction, not permission to expand authority/runtime behavior: explicit callables and schema validators, opaque canonical IR, frozen Core environment, evidence-free rule inputs, and a single authoritative compiler path only.
+
+I07-A3.1b replaced synthetic bindings with real callable identities, added bounded payload schemas, froze the Core environment and returned an opaque WeakMap-issued handle. Independent validation passed 47/47 focused tests. The fresh reviewer nevertheless proved that the canonical IR was still constructed after readiness, schema lookup remained first-match rather than exact-one, rule contexts retained coverage/editorial registry families, and raw fingerprints silently ignored unresolved refs. At the +399 reconstructed boundary another additive repair would violate both the complexity stop and the repeated-contradiction anti-loop rule. AD-15 therefore selects a net-negative exact family compiler and defers generic extraction until real transition families demonstrate commonality.
+
+I07-A3.1c removed the generic compiler environment and reduced production TypeScript from 5,039 to 3,470 lines. Independent focused validation passed 43/43 tests and verified the root export boundary. The next fresh review still demonstrated five bounded exact-family defects: descriptor semantic drift could reuse old callables, inspection exposed live installed objects, the exported executable definition was mutable after fingerprinting, readiness reused one overbroad context, and Core froze caller input by reference. These findings do not justify restoring generic infrastructure or starting runtime admission. I07-A3.1d is restricted to immutable ownership, exact binding, per-rule projection and input isolation with a +50 line hard ceiling.
+
+I07-A3.2a3 stages only real pure authority semantics: one role evaluator, three identity comparators and a diagnostic closed-world Human-principal/candidate-bound tuple. It deliberately adds no receipt, clock, verifier, registry row, public authority or executable path. Independent validation passed 51/51 focused tests; fresh authority review found no remaining material, major or minor finding; the full regression passed 257/257. The live serialized definition, runtime fingerprint and catalog hash remain pinned to their pre-A3.2 values. A3.3 is therefore the next permitted static packet; B/C/D remain paused.
+
+The first I07-A3.3 candidate added three real pure reliability callables and an unavailable diagnostic topology for a pending-Task journal, state-CAS commit pivot, roll-forward, replay and terminal readback. Both implementation and independent validation passed 55/55 focused tests and preserved the pinned serialized definition, runtime fingerprint and catalog hash. The fresh source review nevertheless demonstrated that the assessor compared only fragments of the declared exact contract, accepted extra bindings and graph nodes, omitted recovery/readback identity and claimed journal recovery without durable target ownership. This is another declaration-versus-enforcement recurrence. The replacement must delete the partial checker in favor of a single typed canonical IR, derive all authority/key/read fields from one manifest, bind the full assessed input into diagnostic identity and validate complete effect/phase/recovery/readback vectors plus their cross-links. Runtime wiring and public formats remain out of scope.
+
+I07-A3.3-v2 implemented that typed replacement and an exhaustive closed-world oracle. Mechanical completeness improved, but the next source review found that its canonical target ownership used candidate Plan and audit hashes where serialized Task/sidecar byte digests and chain anchors were required, and its terminal readback postcondition referenced journal retain before that effect executed. More static metadata cannot establish the missing bytes, event identities, writer behavior or crash recovery. The standalone A3.3 implementation is therefore retired. Its exact requirements become acceptance criteria for a bounded C/D vertical slice; that slice must introduce real Plan Validation/receipt inputs and a real task transaction materializer, pending-journal observation boundary, roll-forward adapter and post-terminal readback together. No release-readiness claim follows from either rejected A3.3 diagnostic.
+
+CD-1 through CD-3 supplied those real private boundaries. CD-4 activates them as one protocol-v2/epoch-2/format-4 exact family, publishes closed response schemas and CLI routes, disables the legacy corrective `task plan-set` bypass, and keeps explicit repair plus retained completed evidence. Static readiness is now derived true for the one genuine Core handle. This is candidate readiness, not stable-release approval: the final unchanged-candidate regression and independent changed-evidence review remain mandatory.
+
+## Release recommendation
+
+Current recommendation: **not releasable as stable**.
+
+Re-evaluate only after all release gates pass on an unchanged candidate and the independent audit has no material findings.