codex-workflow-v2 2.0.0-beta.4 → 2.0.0-beta.5

package/dist/src/workflow.js

@@ -9,20 +9,21 @@ import { pathAllowed, validatePlan } from './domain/validation.js';
 import { WorkflowError } from './errors.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
-import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
+import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
 import { appendCorrectiveDecisionEvent, appendRemediationEvent, appendRemediationModeRecovery, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, } from './alpha6/remediation.js';
 import { assessMilestoneInitialAssembly, applyMilestoneScopeChangeTransaction, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
 import { applyProjectTransaction, recoverProjectTransactions, runRollbackProjectTransaction, } from './beta1/project-transaction.js';
-import { buildCurrentStrictStepReviewCycle, ensurePendingStrictStepReview, isStepReviewRequired, recordStrictStepReview, } from './alpha6/review.js';
+import { buildCurrentStrictStepReviewCycle, countUnverifiedStrictStepReviews, ensurePendingStrictStepReview, isStepReviewRequired, recordStrictStepReview, } from './alpha6/review.js';
 import { applyMilestoneAutonomyContract, assertAutonomousPlanEvolution, prepareMilestoneAutonomyContract, readMilestoneAutonomyEvents, requireActiveMilestoneAutonomy, } from './alpha7/autonomy.js';
 import { appendCorrectiveDecisionRecovery, readValidatedCorrectiveDecisionRecoveryForNavigation, requireCorrectiveDecisionRecoveryForRun, } from './alpha7/corrective-recovery.js';
 import { applyKnowledgeSelections, hashKnowledgeMap, inspectKnowledgeMap, normalizeRelativePath, reconcileKnowledgeMap, scanProjectKnowledge, selectKnowledgeSources, } from './memory.js';
 import { canonicalJsonStringify, sha256Hex } from './alpha6/store-sidecars.js';
+import { ensureDirectory } from './fs-utils.js';
 import { commitStep, mergeTaskBranch, runChecks, startLocalTaskBranch, syncBaseIntoTask, validateTaskHistory, } from './git.js';
 import { changedFiles, currentBranch, gitIsAncestor, headCommit, isClean, resolveRepositoryIdentity, runGit, } from './repository.js';
-import { launchStrictStepReviewer } from './reviewer.js';
+import { launchStrictStepReviewer, prepareExternalStrictStepReviewPacket, prepareExternalStrictTaskReviewPacket, strictReviewInputHash, validateExternalStrictStepReviewInput, validateExternalStrictTaskReviewInput, } from './reviewer.js';
 import { listCoreTaskOperationMutexes, inspectWriterLease as inspectRawWriterLease, toPublicWriterLease, WriterLockManager, } from './state/lock.js';
 import { FileStateStore } from './state/store.js';
 import { inspectCorrectiveReplanTaskTransactions } from './state/corrective-replan-transaction.js';
@@ -33,6 +34,7 @@ import { inspectWorkflowObservationBoundary, } from './observation.js';
 import { createEntityId } from './ulid.js';
 import { PACKAGE_VERSION } from './version.js';
 import { correctiveReplanBlockedNavigation, correctiveReplanNavigation, evaluateTaskCorrectiveReplanAvailability, evaluateTaskCorrectiveReplanCandidate, identifyCorrectiveReplanPosture, prepareCorrectiveReplanCandidate, TASK_CORRECTIVE_REPLAN_TRANSITION_ID, } from './lifecycle/corrective-replan.js';
+const MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES = 2;
 export class WorkflowService {
     store;
     now;
@@ -71,6 +73,11 @@ export class WorkflowService {
         const projectFile = path.join(projectRoot, 'project.json');
         const projectAlreadyRegistered = existsSync(projectFile);
         if (!projectAlreadyRegistered) {
+            // The registration posture is a sidecar under the project root. A completely
+            // fresh CODEX_WORKFLOW_STATE_HOME has no project directory yet, so establish
+            // only that directory before writing the posture; project.json remains the
+            // final registration record written below.
+            ensureDirectory(projectRoot);
             initializeProjectRegistrationAdoption(this.store, {
                 projectId: identity.projectId,
                 repositoryIdentity: identity,
@@ -969,7 +976,7 @@ export class WorkflowService {
             resultHash,
             evidenceHash,
             headCommit: currentHead,
-            reason: `Confirmed with ${gate.confirmationCode}.`,
+            reason: 'Milestone final acceptance confirmed against the current validated state.',
             authorizationMode: delegation ? 'delegated' : 'human',
             ...(delegation ? { delegation } : {}),
         };
@@ -1416,7 +1423,7 @@ export class WorkflowService {
             claimTokenAvailable: false,
         };
     }
-    handoffTask(repository, taskId, expectedRevision, actor, targetActor, reason, writerToken = null, grantId = null, expiresAt = null) {
+    handoffTask(repository, taskId, expectedRevision, actor, targetActor, reason, writerToken = null, grantId = null, expiresAt = null, replacePending = false) {
         const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1475,6 +1482,7 @@ export class WorkflowService {
                 expectedNext: String(nextForTask(task).action ?? 'task show'),
                 grantId,
                 expiresAt: expiresAt ?? new Date(this.now().getTime() + 24 * 60 * 60 * 1000).toISOString(),
+                replacePending,
             }, this.now());
             releaseLease();
             return { task, event: prepared.event, bundle: prepared.bundle };
@@ -1542,6 +1550,43 @@ export class WorkflowService {
             throw error;
         }
     }
+    replaceClaimedWriterCredential(repository, taskId, expectedRevision, actor) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        const normalizedActor = actor.trim();
+        if (!normalizedActor)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Writer credential replacement actor is required.');
+        const posture = readTaskC1Posture(this.store, task);
+        const navigation = this.taskGitNavigationOverride(task) ?? nextForTask(task);
+        const action = String(navigation.action);
+        const currentLease = context.locks.inspect(taskId);
+        const writerTokenContract = writerTokenContractForAction(action, posture.state === 'claimed');
+        const requiredActor = writerTokenContract
+            ? this.writerCredentialRecoveryActor(task, action, posture.state === 'claimed' ? posture.claimant : null, currentLease?.owner ?? null)
+            : null;
+        if (!requiredActor || requiredActor !== normalizedActor) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} writer credential replacement requires the exact advertised recovery actor.`, {
+                taskId,
+                posture: posture.state,
+                claimant: posture.state === 'claimed' ? posture.claimant : null,
+                actor: normalizedActor,
+                requiredActor,
+                nextAction: action,
+            });
+        }
+        const lease = currentLease
+            ? context.locks.replaceCredential(taskId, normalizedActor)
+            : context.locks.acquire(taskId, normalizedActor);
+        if (posture.state === 'claimed') {
+            appendTaskWriterCredentialReplacement(this.store, task, normalizedActor, lease.token, this.now());
+        }
+        return {
+            task,
+            lease: toPublicWriterLease(lease, this.now()),
+            writerCredential: { disposition: 'issued', token: lease.token },
+        };
+    }
     handbackTask(repository, taskId, expectedRevision, actor, reason, writerToken = null, limitations = [], recommendedNext = 'Coordinator reviews the terminal Task result and recorded evidence.') {
         const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
@@ -1636,6 +1681,7 @@ export class WorkflowService {
             throw new WorkflowError('TRANSITION_BLOCKED', `${stepId} cannot start from ${step.status}.`);
         }
         const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        let resumesCorrectiveReplan = false;
         if (remediationHistoryForStep.length > 0 && (!planRiskAudit || !isStepReviewRequired(task, stepId, planRiskAudit.reviewRequiredStepIds))) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Step ${stepId} has remediation history but is no longer marked for guarded review by the current Plan Risk Audit; execution is blocked until the audit and Step posture are reconciled.`, {
                 taskId,
@@ -1650,20 +1696,21 @@ export class WorkflowService {
                 && guardedPosture.correctiveDecision.planHash !== task.planHash
                 ? guardedPosture.correctiveDecision
                 : null;
-            const recovery = staleDecision
+            const recovery = staleDecision?.decision === 'continue-fix'
                 ? requireCorrectiveDecisionRecoveryForRun(this.store, task, stepId, actor, writerToken)
                 : null;
-            assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit, recovery?.correctiveDecisionEventId ?? null);
+            const gate = assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit, recovery?.correctiveDecisionEventId ?? null);
+            resumesCorrectiveReplan = gate.posture === 'replan-ready';
         }
         const knowledgeMap = this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
         const dirty = changedFiles(context.identity.repositoryRoot);
-        if (step.status === 'planned' && dirty.length > 0) {
+        if (step.status === 'planned' && dirty.length > 0 && !resumesCorrectiveReplan) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} must start from a clean checkout.`, {
                 changedFiles: dirty,
             });
         }
         const dirtyOutsideStep = dirty.filter((file) => !pathAllowed(file, step.allowedWrites));
-        if (step.status === 'failed' && dirtyOutsideStep.length > 0) {
+        if ((step.status === 'failed' || resumesCorrectiveReplan) && dirtyOutsideStep.length > 0) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} retry has changes outside allowedWrites.`, {
                 changedFiles: dirtyOutsideStep,
             });
@@ -1986,10 +2033,18 @@ export class WorkflowService {
                     resolution: currentCycle.resolution,
                 });
             }
-            assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit);
+            const infrastructureFailures = countUnverifiedStrictStepReviews(this.store, task, stepId);
+            if (infrastructureFailures >= MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Strict Step Review exhausted its bounded infrastructure retries.', {
+                    taskId: task.id,
+                    stepId,
+                    infrastructureFailures,
+                    requiredAction: 'Use an external sealed reviewer or run doctor; do not start another local reviewer process.',
+                });
+            }
         }
         else if (currentCycle.resolution !== 'pending') {
-            if (currentCycle.resolution === 'failed' || currentCycle.resolution === 'unverified') {
+            if (currentCycle.resolution === 'failed') {
                 if (!currentCycle.reviewRecordedEvent || !currentCycle.reviewerAttestationEvent) {
                     throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review recovery requires exact review and attestation sidecars.', {
                         taskId: task.id,
@@ -1997,7 +2052,7 @@ export class WorkflowService {
                         resolution: currentCycle.resolution,
                     });
                 }
-                appendRemediationEvent(this.store, task, stepId, currentCycle.resolution === 'failed' ? 'review-failed' : 'review-unverified', {
+                appendRemediationEvent(this.store, task, stepId, 'review-failed', {
                     completionCommit: currentCycle.reviewRecordedEvent.completionCommit,
                     checksHash: currentCycle.reviewRecordedEvent.checksHash,
                     reviewEventHash: currentCycle.reviewRecordedEvent.eventHash,
@@ -2015,7 +2070,7 @@ export class WorkflowService {
             reviewedCommit: launch.reviewedCommit,
             isolationResult: launch.verifiedIsolation ? 'verified' : 'unverified',
         }, this.now());
-        if (recorded.resolution === 'failed' || recorded.resolution === 'unverified') {
+        if (recorded.resolution === 'failed') {
             const reviewRecordedEvent = recorded.reviewRecordedEvent;
             const reviewerAttestationEvent = recorded.reviewerAttestationEvent;
             if (!reviewRecordedEvent || !reviewerAttestationEvent) {
@@ -2025,7 +2080,7 @@ export class WorkflowService {
                     resolution: recorded.resolution,
                 });
             }
-            appendRemediationEvent(this.store, task, stepId, recorded.resolution === 'failed' ? 'review-failed' : 'review-unverified', {
+            appendRemediationEvent(this.store, task, stepId, 'review-failed', {
                 completionCommit: reviewRecordedEvent.completionCommit,
                 checksHash: reviewRecordedEvent.checksHash,
                 reviewEventHash: reviewRecordedEvent.eventHash,
@@ -2034,6 +2089,130 @@ export class WorkflowService {
         }
         return this.store.writeTask(applyStrictStepReviewResolution(task, stepId, recorded.resolution, launch.review.summary), expectedRevision);
     }
+    prepareExternalStepReview(repository, taskId, stepId, expectedRevision) {
+        const identity = resolveRepositoryIdentity(repository);
+        const task = this.store.readTask(identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        if (task.status !== 'in_progress' && task.status !== 'blocked') {
+            throw new WorkflowError('TRANSITION_BLOCKED', `External Strict Step Review cannot run while task ${taskId} is ${task.status}.`);
+        }
+        const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        if (!planRiskAudit || !isStepReviewRequired(task, stepId, planRiskAudit.reviewRequiredStepIds)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Step ${stepId} is not marked for strict review by the current Plan Risk Audit.`);
+        }
+        const step = requireStep(task, stepId);
+        if (step.status !== 'in_progress' || !step.evidence) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `External Strict Step Review requires ${stepId} in progress with canonical evidence.`);
+        }
+        validateTaskHistory(identity.repositoryRoot, task);
+        if (!isClean(identity.repositoryRoot) || headCommit(identity.repositoryRoot) !== step.evidence.commitSha) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'External Strict Step Review requires a clean checkout at the completion commit.');
+        }
+        const envelope = this.taskContext(repository, taskId, 'independent-reviewer');
+        return prepareExternalStrictStepReviewPacket(identity.repositoryRoot, task, this.store.taskRoot(task.projectId, task.id), envelope, stepId, step.evidence);
+    }
+    recordExternalStepReview(repository, taskId, stepId, expectedRevision, input, actor, writerToken = null) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
+        this.assertTaskMutationAllowedByHandoff(task, actor, writerToken);
+        const packet = this.prepareExternalStepReview(repository, taskId, stepId, expectedRevision);
+        let review;
+        try {
+            review = validateExternalStrictStepReviewInput(input, packet);
+        }
+        catch (error) {
+            throw new WorkflowError('INVALID_ARGUMENT', error instanceof Error ? error.message : 'Invalid external strict review.');
+        }
+        if (review.reviewer.trim() === actor.trim()) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'The independent Step reviewer must differ from the lifecycle mutation actor.');
+        }
+        const currentCycle = buildCurrentStrictStepReviewCycle(this.store, task, stepId);
+        if (task.status === 'blocked' && currentCycle.resolution !== 'unverified') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'External sealed review rescue requires an unverified prior review cycle.', {
+                taskId,
+                stepId,
+                resolution: currentCycle.resolution,
+            });
+        }
+        const infrastructureFailures = countUnverifiedStrictStepReviews(this.store, task, stepId);
+        if (infrastructureFailures > MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'External sealed review rescue exceeded its bounded infrastructure history.', {
+                taskId,
+                stepId,
+                infrastructureFailures,
+            });
+        }
+        ensurePendingStrictStepReview(this.store, task, stepId, this.now());
+        const recorded = recordStrictStepReview(this.store, task, stepId, {
+            review,
+            reviewerOutputHash: strictReviewInputHash(review),
+            reviewedCommit: packet.reviewedCommit,
+            isolationResult: 'verified',
+        }, this.now());
+        if (recorded.resolution === 'failed') {
+            appendRemediationEvent(this.store, task, stepId, 'review-failed', {
+                completionCommit: recorded.reviewRecordedEvent.completionCommit,
+                checksHash: recorded.reviewRecordedEvent.checksHash,
+                reviewEventHash: recorded.reviewRecordedEvent.eventHash,
+                reviewerAttestationHash: recorded.reviewerAttestationEvent.eventHash,
+            }, readCurrentPlanRiskAudit(this.store, task), this.now());
+        }
+        const saved = this.store.writeTask(applyStrictStepReviewResolution(task, stepId, recorded.resolution, review.summary), expectedRevision);
+        return {
+            mode: 'external-sealed',
+            packetHash: packet.packetHash,
+            repositorySealHash: packet.repositorySealHash,
+            reviewerThreadId: input.reviewerThreadId,
+            task: saved,
+        };
+    }
+    prepareExternalTaskReview(repository, taskId, expectedRevision) {
+        const identity = resolveRepositoryIdentity(repository);
+        const task = this.store.readTask(identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        const retryingUnverified = task.status === 'blocked' && task.review.status === 'unverified';
+        if (task.status !== 'validating' && !retryingUnverified) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `External Strict Task Review cannot run while task ${taskId} is ${task.status}.`);
+        }
+        validateTaskHistory(identity.repositoryRoot, task);
+        assertTaskBranch(identity.repositoryRoot, task);
+        if (!isClean(identity.repositoryRoot)) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'External Strict Task Review requires a clean Task checkout.');
+        }
+        const taskRoot = this.store.taskRoot(task.projectId, task.id);
+        if (!task.evidenceHash || this.store.hashArtifact(taskRoot, 'evidence.json') !== task.evidenceHash) {
+            throw new WorkflowError('STATE_CORRUPT', 'External Strict Task Review requires the exact submitted evidence artifact.');
+        }
+        return prepareExternalStrictTaskReviewPacket(identity.repositoryRoot, task, taskRoot, this.taskContext(repository, taskId, 'independent-reviewer'));
+    }
+    recordExternalTaskReview(repository, taskId, expectedRevision, input, actor, writerToken = null) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
+        this.assertTaskMutationAllowedByHandoff(task, actor, writerToken);
+        const packet = this.prepareExternalTaskReview(repository, taskId, expectedRevision);
+        let review;
+        try {
+            review = validateExternalStrictTaskReviewInput(input, packet);
+        }
+        catch (error) {
+            throw new WorkflowError('INVALID_ARGUMENT', error instanceof Error ? error.message : 'Invalid external strict Task review.');
+        }
+        if (review.reviewer.trim() === actor.trim()) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'The independent Task reviewer must differ from the lifecycle mutation actor.');
+        }
+        const saved = this.recordReview(repository, taskId, expectedRevision, review, actor, writerToken);
+        return {
+            mode: 'external-sealed',
+            packetHash: packet.packetHash,
+            repositorySealHash: packet.repositorySealHash,
+            reviewerThreadId: input.reviewerThreadId,
+            task: saved,
+        };
+    }
     submitTask(repository, taskId, expectedRevision, writerToken, actor) {
         const context = this.#mutationContext(repository);
         const lease = context.locks.heartbeat(taskId, writerToken);
@@ -2586,21 +2765,13 @@ export class WorkflowService {
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
         if (!allowAtomicTaskRefresh && current.status === 'active' && current.approval) {
             const milestonesById = new Map(this.listMilestonesCurrent(identity.projectId).map((milestone) => [milestone.id, milestone]));
-            const activeTask = this.store
-                .listTasks(identity.projectId)
-                .find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
-            if (activeTask?.planHash
-                && taskCanRebindKnowledge(activeTask)
-                && !this.taskHasTerminalCorrectiveDecision(activeTask)) {
-                const inspected = inspectKnowledgeMap(current, scanned);
-                const assessment = assessDelegatedKnowledgeRefresh(current, inspected, activeTask, this.store.hashArtifact(this.store.taskRoot(identity.projectId, activeTask.id), 'plan.md'));
-                if (assessment.eligible
-                    && this.delegatedContextRefreshOptions(identity.projectId, activeTask, inspected, assessment.mode).length > 0) {
-                    throw new WorkflowError('TRANSITION_BLOCKED', 'Standalone Project Knowledge reconcile would strand an authorized Task context refresh.', {
-                        taskId: activeTask.id,
-                        requiredAction: 'Run the exact task context-refresh action returned by next.',
-                    });
-                }
+            const inspected = inspectKnowledgeMap(current, scanned);
+            const refreshOwner = this.findDelegatedContextRefreshOwner(identity.projectId, this.store.listTasks(identity.projectId), milestonesById, current, inspected);
+            if (refreshOwner) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Standalone Project Knowledge reconcile would strand an authorized Task context refresh.', {
+                    taskId: refreshOwner.task.id,
+                    requiredAction: 'Run the exact task context-refresh action returned by next.',
+                });
             }
         }
         return this.store.writeKnowledgeMap(reconcileKnowledgeMap(current, scanned), expectedRevision);
@@ -2629,7 +2800,7 @@ export class WorkflowService {
         const existing = this.readGraphBindingOrNull(identity.projectId, graphKind);
         return this.store.writeGraphBinding(fallbackGraphBinding(identity.projectId, request, reason, existing, this.now()), expectedRevision);
     }
-    next(repository) {
+    next(repository, taskId = null) {
         const status = this.status(repository);
         if (status.observation.kind === 'blocked') {
             return {
@@ -2743,14 +2914,75 @@ export class WorkflowService {
         });
         const repositoryRoot = resolveRepositoryIdentity(repository).repositoryRoot;
         const milestonesById = new Map(status.milestones.map((milestone) => [milestone.id, milestone]));
-        const activeTask = status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
+        const requestedTask = taskId === null
+            ? null
+            : status.tasks.find((task) => task.id === taskId) ?? null;
+        if (taskId !== null && !requestedTask) {
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        }
+        if (requestedTask && !taskIsActionableFromRepositoryNext(requestedTask, milestonesById)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Task ${requestedTask.id} is not actionable from repository next.`, {
+                taskId: requestedTask.id,
+                taskStatus: requestedTask.status,
+                milestoneId: requestedTask.milestoneId,
+            });
+        }
+        const activeTask = requestedTask
+            ?? status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
         if (activeTask) {
-            const activePlanRiskAudit = activeTask.planHash
-                ? readCurrentPlanRiskAudit(this.store, activeTask)
+            const activeTaskMilestone = activeTask.milestoneId
+                ? milestonesById.get(activeTask.milestoneId) ?? null
                 : null;
+            const milestoneCancellationSafe = Boolean(activeTaskMilestone
+                && !activeTask.steps.some((step) => step.status === 'in_progress')
+                && status.observation.leases.length === 0
+                && status.observation.coreTaskOperations.length === 0
+                && status.observation.pendingProjectTransactions.length === 0
+                && status.observation.pendingMilestoneTransactions.length === 0
+                && status.observation.pendingTaskTransactions.length === 0
+                && status.observation.corruptTaskTransactions.length === 0);
+            const withMilestoneCancellation = (value) => (milestoneCancellationSafe
+                ? {
+                    ...value,
+                    milestoneCancellationOption: {
+                        command: 'milestone cancel',
+                        milestoneId: activeTaskMilestone.id,
+                        expectedRevision: activeTaskMilestone.revision,
+                        reasonRequired: true,
+                        taskDisposition: 'retained-historical',
+                    },
+                }
+                : value);
+            let activePlanRiskAudit = null;
+            let planRiskAuditRecovery = null;
+            if (activeTask.planHash) {
+                try {
+                    activePlanRiskAudit = readCurrentPlanRiskAudit(this.store, activeTask);
+                }
+                catch (error) {
+                    if (!(error instanceof WorkflowError) || error.code !== 'TRANSITION_BLOCKED')
+                        throw error;
+                    planRiskAuditRecovery = {
+                        scope: 'task',
+                        id: activeTask.id,
+                        status: activeTask.status,
+                        action: 'task plan-risk-audit',
+                        revision: activeTask.revision,
+                        planRiskAuditRecovery: {
+                            state: 'required',
+                            reason: error.message,
+                            currentBriefHash: activeTask.briefHash,
+                            currentPlanHash: activeTask.planHash,
+                            knowledgeMapRevision: activeTask.knowledgeMapRevision,
+                            knowledgeMapHash: activeTask.knowledgeMapHash,
+                        },
+                    };
+                }
+            }
             const taskNext = activeTask.status === 'planning'
                 ? null
-                : this.nextForTaskWithDelegation(status.projectId, activeTask, activePlanRiskAudit);
+                : planRiskAuditRecovery
+                    ?? this.nextForTaskWithDelegation(status.projectId, activeTask, activePlanRiskAudit);
             // Active Step work must outrank Project Knowledge refresh/rebind. Both completion and
             // strict review are executable while context refresh correctly remains forbidden.
             const hardStop = taskNext?.action === 'task corrective-decision'
@@ -2762,12 +2994,27 @@ export class WorkflowService {
                 || hardStop
                 || terminalCorrectiveDecision === 'split-required'
                 || terminalCorrectiveDecision === 'stop-escalate') {
-                return withAdoption(taskNext);
+                return withAdoption(withMilestoneCancellation(taskNext));
             }
             if (!taskCanRebindKnowledge(activeTask) && activeTask.status !== 'planning') {
-                return withAdoption(taskNext);
+                return withAdoption(withMilestoneCancellation(taskNext));
+            }
+            let knowledgeMap;
+            try {
+                knowledgeMap = this.knowledgeMapStatus(repository);
+            }
+            catch (error) {
+                if (!(error instanceof WorkflowError) || error.code !== 'NOT_FOUND')
+                    throw error;
+                return withAdoption(withMilestoneCancellation({
+                    scope: 'project-memory',
+                    status: 'missing',
+                    action: 'project-memory scan',
+                    stalenessOriginTaskId: activeTask.id,
+                    authorizesTask: false,
+                    provenanceNotice: 'This Task identifier is diagnostic provenance only; the Project Knowledge action does not authorize or resume it.',
+                }));
             }
-            const knowledgeMap = this.knowledgeMapStatus(repository);
             if (knowledgeMap.status !== 'active' || !knowledgeMap.approval) {
                 const action = knowledgeMap.status === 'stale' ? 'project-memory reconcile' : 'project-memory approve';
                 const delegatedApprovalOptions = action === 'project-memory approve'
@@ -2783,7 +3030,17 @@ export class WorkflowService {
                 const contextRefreshOptions = action === 'project-memory reconcile' && refreshAssessment?.eligible
                     ? this.delegatedContextRefreshOptions(status.projectId, activeTask, knowledgeMap, refreshAssessment.mode)
                     : [];
-                return withAdoption({
+                if (requestedTask && action === 'project-memory reconcile' && contextRefreshOptions.length === 0) {
+                    const refreshOwner = this.findDelegatedContextRefreshOwner(status.projectId, status.tasks, milestonesById, storedKnowledgeMap, knowledgeMap);
+                    if (refreshOwner && refreshOwner.task.id !== requestedTask.id) {
+                        throw new WorkflowError('TRANSITION_BLOCKED', `Task ${requestedTask.id} cannot be selected while Task ${refreshOwner.task.id} requires an atomic context refresh.`, {
+                            taskId: requestedTask.id,
+                            blockingTaskId: refreshOwner.task.id,
+                            requiredAction: 'Run repository next and its exact task context-refresh action first.',
+                        });
+                    }
+                }
+                return withAdoption(withMilestoneCancellation({
                     scope: contextRefreshOptions.length > 0 ? 'task' : 'project-memory',
                     status: knowledgeMap.status,
                     action: contextRefreshOptions.length > 0 ? 'task context-refresh' : action,
@@ -2815,14 +3072,14 @@ export class WorkflowService {
                             },
                         }
                         : {}),
-                });
+                }));
             }
             const knowledgeMapHash = hashKnowledgeMap(knowledgeMap);
             if (taskCanRebindKnowledge(activeTask) &&
                 activeTask.planHash &&
                 (activeTask.knowledgeMapRevision !== knowledgeMap.revision ||
                     activeTask.knowledgeMapHash !== knowledgeMapHash)) {
-                return withAdoption({
+                return withAdoption(withMilestoneCancellation({
                     scope: 'task',
                     id: activeTask.id,
                     status: activeTask.status,
@@ -2830,9 +3087,9 @@ export class WorkflowService {
                     revision: activeTask.revision,
                     knowledgeMapRevision: knowledgeMap.revision,
                     knowledgeMapHash,
-                });
+                }));
             }
-            return withAdoption(taskNext ?? this.nextForTaskWithDelegation(status.projectId, activeTask, null));
+            return withAdoption(withMilestoneCancellation(taskNext ?? this.nextForTaskWithDelegation(status.projectId, activeTask, null)));
         }
         const activeMilestone = status.milestones.find((milestone) => !['accepted', 'cancelled'].includes(milestone.status));
         if (activeMilestone) {
@@ -2911,6 +3168,19 @@ export class WorkflowService {
                 status: activeMilestone.status,
                 action: nextForMilestone(activeMilestone),
                 revision: activeMilestone.revision,
+                ...(activeMilestone.status === 'awaiting_execution_authorization' && activeMilestone.planHash
+                    ? {
+                        milestoneAuthorizationOptions: [
+                            { action: 'milestone authorize', mode: 'direct-human' },
+                            {
+                                action: 'milestone autonomy-prepare',
+                                mode: 'delegated',
+                                requiresExactHumanConfirmation: true,
+                                maximumDurationHours: 72,
+                            },
+                        ],
+                    }
+                    : {}),
                 ...(activeMilestone.status === 'active'
                     ? {
                         completionPolicy: {
@@ -3092,6 +3362,11 @@ export class WorkflowService {
                 return buildCurrentStrictStepReviewCycle(this.store, task, step.id).resolution === 'unverified';
             }) ?? null
             : null;
+        const strictReviewInfrastructureFailures = strictStepReviewStep
+            ? countUnverifiedStrictStepReviews(this.store, task, strictStepReviewStep.id)
+            : 0;
+        const strictTaskReviewRequired = (task.status === 'validating' && task.review.status === 'pending')
+            || (task.status === 'blocked' && task.review.status === 'unverified');
         const handoffOverlay = handoffPosture.state === 'pending'
             ? {
                 action: 'task claim',
@@ -3100,6 +3375,15 @@ export class WorkflowService {
                     state: 'pending',
                     targetActor: handoffPosture.targetActor,
                     eventId: handoffPosture.latestEvent.eventId,
+                    credentialRecovery: {
+                        action: 'task handoff-replace',
+                        when: 'claim credential is unavailable',
+                        requiredActor: handoffPosture.latestEvent.actor,
+                        targetActor: handoffPosture.targetActor,
+                        grantId: handoffPosture.latestEvent.grantId,
+                        expectedRevision: task.revision,
+                        invalidatesPriorCredential: true,
+                    },
                 },
             }
             : handoffPosture.state === 'claimed'
@@ -3361,6 +3645,30 @@ export class WorkflowService {
                     strictStepReview: {
                         reviewRequired: true,
                         completionCommit: strictStepReviewStep.evidence.commitSha,
+                        infrastructureFailures: strictReviewInfrastructureFailures,
+                        maxLocalInfrastructureFailures: MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES,
+                        recommendedMode: 'external-sealed',
+                        externalSealedReview: {
+                            packetCommand: 'task step-review-packet',
+                            recordCommand: 'task step-review-record',
+                            reviewerMustUseSeparateChat: true,
+                            repositorySealRequired: true,
+                        },
+                    },
+                }
+                : {}),
+            ...(strictTaskReviewRequired
+                ? {
+                    strictTaskReview: {
+                        reviewRequired: true,
+                        localInfrastructureFailureObserved: task.review.status === 'unverified',
+                        recommendedMode: 'external-sealed',
+                        externalSealedReview: {
+                            packetCommand: 'task review-packet',
+                            recordCommand: 'task review-sealed-record',
+                            reviewerMustUseSeparateChat: true,
+                            repositorySealRequired: true,
+                        },
                     },
                 }
                 : {}),
@@ -3414,6 +3722,12 @@ export class WorkflowService {
             exactInclusionRequired: true,
             briefHash: task.briefHash,
             knowledgeMap: knowledgeSummary(map),
+            planRiskAuditContract: {
+                required: true,
+                option: '--risk-audit-file',
+                atomicWithPlanSet: true,
+                plannerAuditorSeparationRequired: true,
+            },
         };
     }
     assertTaskContextChangeAllowed(task) {
@@ -3493,6 +3807,22 @@ export class WorkflowService {
             policyHash: grant.policyHash,
         }));
     }
+    findDelegatedContextRefreshOwner(projectId, tasks, milestonesById, approved, inspected) {
+        for (const task of tasks) {
+            if (!taskIsActionableFromRepositoryNext(task, milestonesById)
+                || !task.planHash
+                || !taskCanRebindKnowledge(task)
+                || this.taskHasTerminalCorrectiveDecision(task))
+                continue;
+            const assessment = assessDelegatedKnowledgeRefresh(approved, inspected, task, this.store.hashArtifact(this.store.taskRoot(projectId, task.id), 'plan.md'));
+            if (!assessment.eligible)
+                continue;
+            const options = this.delegatedContextRefreshOptions(projectId, task, inspected, assessment.mode);
+            if (options.length > 0)
+                return { task, assessment, options };
+        }
+        return null;
+    }
     assertPlanBoundedSupportingSourceGrant(projectId, grantId, actor, task) {
         const grant = this.store.readDelegation(projectId, grantId);
         if (!task.milestoneId || grant.scope.kind !== 'milestone' || grant.scope.id !== task.milestoneId) {
@@ -3595,14 +3925,44 @@ export class WorkflowService {
         if (!action)
             return next;
         const policy = gitMutationPolicyForAction(task, action);
-        const claimedC1Posture = readTaskC1Posture(this.store, task).state === 'claimed';
+        const c1Posture = readTaskC1Posture(this.store, task);
+        const claimedC1Posture = c1Posture.state === 'claimed';
         const writerTokenContract = writerTokenContractForAction(action, claimedC1Posture);
+        const activeLease = writerTokenContract
+            ? inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root)
+            : null;
+        const writerCredentialRecoveryActor = this.writerCredentialRecoveryActor(task, action, claimedC1Posture ? c1Posture.claimant : null, activeLease?.owner ?? null);
+        const writerCredentialRecovery = writerTokenContract && writerCredentialRecoveryActor
+            ? {
+                action: 'task writer-credential-replace',
+                when: 'the active writer credential is unavailable',
+                requiredActor: writerCredentialRecoveryActor,
+                expectedRevision: task.revision,
+                invalidatesPriorCredential: true,
+                acquiresLeaseWhenAbsent: true,
+            }
+            : null;
         return {
             ...next,
             ...(policy ? { gitMutationPolicy: policy } : {}),
             ...(writerTokenContract ? { writerTokenContract } : {}),
+            ...(writerCredentialRecovery ? { writerCredentialRecovery } : {}),
         };
     }
+    writerCredentialRecoveryActor(task, action, claimedActor, activeLeaseOwner) {
+        if (claimedActor)
+            return claimedActor;
+        if (activeLeaseOwner)
+            return activeLeaseOwner;
+        const authorizationKind = ['task merge', 'task merge-confirm'].includes(action)
+            ? 'final_acceptance'
+            : ['task step-complete', 'task submit'].includes(action)
+                ? 'execution'
+                : null;
+        if (!authorizationKind)
+            return null;
+        return [...task.authorizations].reverse().find((authorization) => authorization.kind === authorizationKind && authorization.decision === 'approved')?.actor ?? null;
+    }
     describeMilestoneInitialAssembly(projectId, milestone, tasks) {
         const assessment = assessMilestoneInitialAssembly({
             store: this.store,
@@ -4373,8 +4733,10 @@ function writerTokenContractForAction(action, claimedC1Posture = false) {
     const claimedC1LeaseBound = [
         'task run',
         'task step-review',
+        'task step-review-record',
         'task review-record',
         'task review-launch',
+        'task review-sealed-record',
         'task corrective-decision-recover',
         'task remediation-mode-recover',
         'task corrective-decision',
@@ -4392,6 +4754,8 @@ function writerTokenContractForAction(action, claimedC1Posture = false) {
         option: '--writer-token',
         source: 'active-writer-lease',
         sensitive: true,
+        renewalDisposition: 'reuse-presented-token',
+        tokenReissuedOnRenewal: false,
     };
 }
 function observationPreflightBlockers(observation) {