codex-workflow-v2 2.0.0-beta.7 → 2.0.0-beta.9

package/docs/autonomy-guardrails.md

@@ -139,16 +139,16 @@ A host-generated `codex_delegation` envelope containing routing provenance such
 not carry completed parent turns. The coordinator reads the title back after creation and explicitly
 renames it when the supplied title was omitted or normalized.
 
-Chat titles are deterministic and supplied explicitly:
+Chat titles are allocated atomically by the project registry; sidebar counts and `count + 1` are
+not valid numbering sources. Primary forms are:
 
 ```text
-M<NN> · Coordinator · <Milestone title> · <MS-ID>
-M<NN>/T<NN> · <Task title> · <TASK-ID>
+#NNN · M<NN> · Coord · <Milestone title> · <MS-ID>
+#NNN · M<NN>/T<NN> · Task · <Task title> · <TASK-ID>
 ```
 
-The ordinal and semantic title come first for sidebar readability; the full ID prevents ambiguous
-identity. Generic, inherited, or duplicate titles are invalid dispatch state and must be renamed
-and re-verified before the Task receives work.
+The sequence and membership ordinal come first; the full ID prevents ambiguous identity. Exact
+readback is mandatory and only registry-supplied deterministic fallbacks may be used.
 
 Autonomy also requires active supervision. After just-in-time dispatch, the Milestone coordinator
 keeps a bounded `wait_threads` loop for the routed Task, inspects completion/attention, and verifies

package/docs/delegated-approval.md

@@ -124,12 +124,14 @@ membership ordinal, Task revision/title, Brief/Plan bindings, requirements/accep
 scope/checks/stop conditions, маршрут status -> next --task <exact Task ID> и тот же actor/DGR-ID
 только когда они требуются. Не передавай transcript этого чата, sibling Tasks, recovery narrative,
 reasoning, confirmation codes, handoff credentials или writer tokens.
-Title обязателен: M<NN>/T<NN> · <Task title> · <TASK-ID>. До dispatch проверь уникальность
-Task-ID-to-thread mapping, прочитай title обратно и проверь Task-only input. Служебный
+Title обязателен и выделяется проектным registry:
+#NNN · M<NN>/T<NN> · Task · <Task title> · <TASK-ID>. До dispatch проверь уникальность
+Task-ID-to-thread mapping, выполни exact registry readback и проверь Task-only input. Служебный
 codex_delegation envelope с source_thread_id допустим, parent turns/transcript запрещены. Если
 title отсутствует или изменён, явно переименуй и перепроверь. Ошибка create_thread не разрешает
 fallback на fork_thread.
-Если title обрезан, сокращай только semantic title, но сохрани полный ordinal и entity ID. В
+Если readback изменён, применяй только deterministic fallback registry; полный `#NNN`, ordinal и
+entity ID сохраняются. В
 TaskContextPacket потребуй закрытый secret-free CoordinatorReport на terminal/attention boundary:
 Task ID, observed revision/status, outcome, next action, requiresUser, blocker class,
 commits/checks/review evidence; никаких confirmation/handoff/writer bearer values.

package/docs/development-flow.md

@@ -150,10 +150,10 @@ delegated transitions, merge observation, cross-Task validation, and final accep
 
 The coordinator creates that chat as a new standalone Codex task, never as a fork/handoff of its
 own thread, and sends only a fresh TaskContextPacket for the exact Task. It creates or reuses the
-chat just before dispatch, not as an empty membership placeholder. Titles are explicit and
-deterministic: `M<NN> · Coordinator · <Milestone title> · <MS-ID>` and `M<NN>/T<NN> · <Task
-title> · <TASK-ID>`, where the Task ordinal comes from approved membership order. Duplicate,
-generic, inherited, or unverified titles block dispatch.
+chat just before dispatch, not as an empty membership placeholder. The project registry allocates
+one monotonic `#NNN` and builds `#NNN · M<NN> · Coord · <Milestone title> · <MS-ID>` or
+`#NNN · M<NN>/T<NN> · Task · <Task title> · <TASK-ID>`; the Task ordinal still comes from approved
+membership order. Exact readback and registry-owned fallback are mandatory.
 
 Dispatch is followed by an explicit coordinator supervision loop. The Milestone chat waits on the
 one currently routed Task chat with bounded `wait_threads` calls, reads it when it completes or

package/docs/release.md

@@ -22,7 +22,7 @@ The downstream smoke packs the actual tarball, installs it into an empty tempora
 runs the packaged CLI handshake, and proves installation created none of `.codex`, `.tasks`,
 `.increments`, or `.memory-bank` in that project.
 
-For beta.7, the release gate also relies on `npm run release:check` to fail if:
+For beta.9, the release gate also relies on `npm run release:check` to fail if:
 
 - canonical entity schema 2 shapes drift;
 - protocol 2 is not the active public contract, or intact protocol-1 adoption evidence stops being readable through the bounded compatibility window;
@@ -37,6 +37,9 @@ For beta.7, the release gate also relies on `npm run release:check` to fail if:
   explicit recovery, or dual-readback capabilities are absent from the packaged surface.
 - scoped Task navigation, credential replacement recovery, or sealed external Task/Step review
   commands are absent from the packaged surface.
+- bounded dependency-provenance recovery or its rejection regressions are absent.
+- the read-only Milestone progress projection, replacement regression, project-monotonic chat
+  registry, title fallback/readback, or long-Cyrillic multi-attempt E2E evidence is absent.
 
 The separate lifecycle transcript validator fails if the real-agent log contains a mutation that
 bypasses failed `status`/`next`, an unadvertised or failed mutation, an unresolved syntax-only

package/docs/stable-release-defect-register.md

@@ -1,11 +1,11 @@
 # Stable Release Defect Register
 
 This register captures defects and operational gaps found while running the
-alpha.7 through beta.7 lines against the `signal_v4` Milestone 3 lifecycle. It is intentionally
+alpha.7 through beta.9 lines against the `signal_v4` Milestone 3 lifecycle. It is intentionally
 separate from implementation briefs: an item stays here until it is either
 verified fixed by a regression test or explicitly classified as downstream-only.
 
-Last reviewed: 2026-08-21.
+Last reviewed: 2026-08-22.
 
 ## Severity and status
 
@@ -16,6 +16,59 @@ Last reviewed: 2026-08-21.
 
 ## Post-beta.5 open findings
 
+### WF-STABLE-030 — chat order and replacement progress are not observable
+
+- Status: Closed-regression in beta.9
+- Severity: High
+- Area: Codex App routing, title identity, Milestone supervision
+- Evidence: automatically created Task/reviewer titles had no project sequence, long semantic
+  segments were unpredictably shortened, and the Coordinator summary did not expose that cancelled
+  T03 had been replaced by a distinct T08.
+- Fix: the gateway owns one atomic project registry with non-reusable monotonic `#NNN`, six compact
+  title families, exact readback and deterministic fallback. Core exposes a read-only Milestone
+  progress projection; Task and Coordinator chats emit progress tables at defined boundaries.
+- Regression: concurrent allocations remain unique and monotonic; long Cyrillic titles and multiple
+  review attempts traverse fallback/readback; projection keeps `T03 cancelled → T08 replacement`
+  as two rows with exact Step status.
+
+### WF-STABLE-029 — dependency-only Workflow update strands an active Task
+
+- Status: Closed-regression in beta.9
+- Severity: Critical
+- Area: Git provenance integrity, package update, active Task recovery
+- Evidence: Signal T04 contained the beta.8 dependency update commit at HEAD after all recorded Task
+  commits. `task submit` correctly rejected the unregistered commit, but no bounded route could
+  classify it as Workflow-owned provenance.
+- Fix: fresh navigation advertises recovery only for one clean, local, dependency-only HEAD after
+  exact recorded history, with no Step/lease/transaction activity and complete beta.9 alignment
+  across runtime, manifest, lock, install, Task branch, and Milestone base. Recovery only appends
+  that SHA to `systemCommits` with an audit record; it never mutates Git.
+- Regression: exact candidate succeeds and is idempotent; product-file contamination and stale-base
+  divergence fail closed.
+
+### WF-STABLE-028 — passed guarded Step strands later final Task-review remediation
+
+- Status: Closed-regression in beta.8
+- Severity: High
+- Area: guarded remediation breaker, final Task review, navigation/mutation agreement
+- Evidence: Signal Task `TASK-01M0HVK4YDJ3W9X0N72TYNV8WK` reached a verified passing third
+  sealed Step review after two ordinary failures and one independently authorized `continue-fix`.
+  A later final Task review found two new defects and `next` correctly advertised `task plan-set`,
+  but the mutation rejected the Plan because the already-consumed `continue-fix` event still
+  matched the current Plan. The suggested current-Plan retry was impossible because the guarded
+  Step was already `completed`.
+- Risk: a valid append-only review history can leave a nonterminal Task with no executable
+  transition even though its state is clean and navigation advertises a corrective Plan update.
+- Fix: a verified passing Step-review event now closes the preceding breaker cycle for that Step.
+  Resolved `continue-fix`, remediation, and decision events remain immutable evidence but do not
+  gate a later final Task-review remediation cycle. A changed guarded Step starts a fresh bounded
+  cycle under the replacement Plan Risk Audit; unresolved and failed cycles retain the existing
+  hard-stop behavior.
+- Regression: `tests/alpha7-remediation-replay.test.ts` reproduces the full sequence through two
+  failed sealed reviews, `continue-fix`, a verified pass, failed final Task review, atomic Plan and
+  Risk Audit replacement, execution authorization, and successful `task run` of the reopened
+  guarded Step while proving the historical sidecars are retained.
+
 ### WF-STABLE-027 — Milestone coordinator stops supervising after Task-chat dispatch
 
 - Status: Closed-regression in beta.7
@@ -56,6 +109,12 @@ Last reviewed: 2026-08-21.
 - Risk: routine Workflow starts produce a noisy, repeated failure. More importantly, if both cache
   generations remain present, a task may silently load stale gateway rules instead of failing,
   weakening exact-version routing and human-gate guarantees.
+- beta.9 live readback (2026-08-22): after the source was validated, copied through the packaged
+  installer, and `codex plugin add` reported installed root `0.1.0+codex.20260822110519`, three new
+  worktree Tasks were still injected with missing path `0.1.0+codex.20260822065726`. All three
+  found the actual cache only by read-only search and then verified beta.9 content. This rules out a
+  missed source copy or failed install and localizes the remaining defect to App catalog/runtime
+  invalidation.
 - Required closure:
   - determine whether the stale reference is emitted by the packaged installer/registration flow
     or retained by Codex App's skill catalog;

package/docs/updating-existing-project.md

@@ -235,11 +235,12 @@ Grant сам не запускает агента и не прикрепляет
 `next.delegatedApprovalOptions`. Внутренние Worker и Independent Reviewer grant не используют:
 его применяет координатор после получения их evidence.
 
-Обязательные названия чатов (передавайте title явно при создании):
+Все автоматически создаваемые чаты получают проектный монотонный номер из
+`plugins/codex-workflow-gateway/scripts/chat-registry.mjs`; `count + 1` запрещён. Основные формы:
 
 ```text
-M<NN> · Coordinator · <Milestone title> · <MS-ID>
-M<NN>/T<NN> · <Task title> · <TASK-ID>
+#NNN · M<NN> · Coord · <Milestone title> · <MS-ID>
+#NNN · M<NN>/T<NN> · Task · <Task title> · <TASK-ID>
 ```
 
 Task-чат создавайте только как новую standalone Codex task (`create_thread`) в том же Project, а
@@ -250,8 +251,9 @@ ID>`, Task-local scope/checks/stop conditions и exact actor/grant ID при н
 переносите transcript Milestone-чата, историю recovery/approval, соседние Tasks, reasoning или
 confirmation/handoff/writer credentials.
 
-До создания проверьте, нет ли уже чата для exact Task ID. После создания обязательно прочитайте
-title обратно: он должен быть уникален и содержать exact ordinal/ID. Input должен состоять из
+До создания проверьте, нет ли уже чата для exact Task ID. После создания передайте прочитанный
+title в registry readback и применяйте только возвращённый deterministic fallback. Title должен
+быть уникален и содержать exact `#NNN`, membership ordinal и ID. Input должен состоять из
 TaskContextPacket; допустима только добавленная Codex App служебная `codex_delegation`-обёртка с
 `source_thread_id`, но не parent turns или transcript. Если title отсутствует или нормализован
 неверно, переименуйте и перепроверьте. Ошибка `create_thread` допускает один

package/docs/validation-report.md

@@ -1,56 +1,70 @@
-# V2 Alpha Validation Report
-
-Release candidate `2.0.0-alpha.7` was validated on 2026-08-14 with Node.js 24.17.0.
-
-- TypeScript typecheck and build passed.
-- The authoritative sequential suite passed `86/86` with `--test-concurrency=1`. An earlier
-  ordinary parallel run also passed its then-current `85/85` suite, but CLI subprocess
-  contention made one test take 165 seconds; the final sequential exit is the release evidence.
-- `npm run pack:check`, `npm run smoke:downstream`, `npm run release:check`,
-  `npm run plugin:check`, and `git diff --check` passed. Packaging and downstream smoke used
-  an isolated temporary npm cache because the user cache contains pre-existing root-owned
-  entries.
-- The repository-level `tools/tests/codex-workflow-regression.mjs` update/install regression
-  completed with `status: PASS`.
-- Dry-run packaging produced `codex-workflow-v2-2.0.0-alpha.7.tgz` with 139 files; downstream
-  installation and packaged CLI handshake passed.
-
-Alpha.7 regression coverage includes:
-
-- pending strict Step Review outranks Knowledge Map reconcile/rebind after a knowledge-changing
-  completion commit; review succeeds against the exact historical approved binding even while
-  the current map is stale, and rebind remains mandatory before the next Step;
-- read-only alpha.6 rescue-preflight rejects active leases and accepts only one exact pending
-  strict-review candidate on the clean recorded completion HEAD;
-- seven linked Tasks can be materialized during initial Milestone assembly and classified by
-  one complete initial Plan without repeated scope-change approvals;
-- one maximum-72-hour Milestone Autonomy Contract issues the existing Task/Milestone approval
-  permissions, permits Project Memory approval only inside an atomic content-only Task context
-  refresh, permits journaled membership-only evolution, requires reauthorization, and rejects
-  both standalone Project Memory approval and semantic scope drift; a later human semantic
-  change invalidates future uses of the autonomy grant;
-- C1 Worker and corrective Auditor actors are deterministically derived while claim, lease,
-  handoff, and reviewer/auditor independence checks remain fail-closed;
-- every newly recorded guarded Plan Risk Audit requires an exact proof obligation per failure
-  mode: hostile counterexample, expected safe result, and executable evidence command;
-  historical alpha.6 audits remain readable for recovery only;
-- existing Milestone journal recovery, reverse-membership integrity, delegation, adoption,
-  Knowledge Map, graph, strict reviewer, Git ownership, and remediation hard-stop tests remain
-  green.
-
-Compatibility claims verified:
-
-- `protocolVersion: 1` and `STATE_SCHEMA_VERSION: 2` remain unchanged;
-- canonical Task and Milestone schemas remain byte-identical;
-- the generic delegated transition allow-list remains unchanged;
-- new evidence is additive through `autonomy-contract-events.jsonl`, optional autonomous
-  fields on scope-change events, and optional proof obligations on Plan Risk Audit events;
-- the gateway handshake advertises alpha.7 rescue, initial assembly, autonomy, derived actor,
-  corrective routing, and proof-obligation capabilities.
-
-Not claimed here:
-
-- no npm publication, Git tag, push, or downstream project mutation was performed;
-- no manual rewrite of external Workflow state is part of the recovery design;
-- the local package cannot cryptographically prove a real human identity or a physically
-  separate Codex task beyond the existing actor, process-isolation, sidecar, and lease evidence.
+# V2 beta.9 Validation Report
+
+Release candidate `2.0.0-beta.9` was validated on 2026-08-22 with Node.js 24.17.0.
+
+## Automated release evidence
+
+- `npm run validate` passed `294/294` sequential tests with no failures, skips, cancellations, or
+  todos. This includes every historical lifecycle, authority, credential, adoption, Milestone,
+  strict-review, corrective-replan, Git ownership, and observation-purity regression.
+- `npm run pack:check` passed with an isolated temporary npm cache. The tarball contains 247 files,
+  including `dist/src/dependency-provenance.js` and the packaged plugin
+  `scripts/chat-registry.mjs`; package size is 1.0 MB and unpacked size is 3.6 MB.
+- `npm run smoke:downstream` packed and installed the actual beta.9 tarball in an empty project,
+  then passed the packaged CLI handshake. The first sandboxed attempt was network-blocked while
+  fetching `ajv`; the authorized network retry passed.
+- `npm run plugin:check`, the plugin-creator structural validator, and `npm run release:check`
+  passed. After final registry-integrity hardening, the source cachebuster is
+  `0.1.0+codex.20260822111400` and the personal marketplace installation is
+  `0.1.0+codex.20260822111422`.
+
+## beta.9 recovery evidence
+
+- One clean local Task branch with exactly one unregistered dependency-only HEAD is eligible only
+  after runtime, manifest, lock, installed package, current branch, and Milestone base all equal
+  beta.9 and no Step, lease, transaction, or Core operation is active.
+- Recovery records the exact HEAD in `systemCommits` with an audit record and does not create,
+  amend, reset, merge, or otherwise mutate Git history. An uncertain-response retry is idempotent.
+- A commit containing a product file, a candidate whose Milestone base remains stale, and a
+  same-version candidate whose dependency payload differs from the updated base all fail closed.
+
+## Progress and replacement evidence
+
+- `milestone progress --id <MS-ID>` is byte-pure and returns stable Task/Step ordinals, exact state,
+  required/completed counts, membership disposition, and replacement links.
+- The regression fixture retains eight rows and proves `T03 cancelled → T08 replacement` without
+  reusing the historical ordinal. T04 exposes exact S01/S02 status and completed counts.
+
+## Chat registry and live Codex App E2E
+
+- Automated tests cover all six title families, atomic concurrent allocation, non-reuse of
+  abandoned numbers, long Cyrillic semantic titles, multiple review attempts, exact readback,
+  deterministic fallback, and verified thread binding.
+- Live App Tasks `01a02928-0436-7af2-a1b9-a969226d50d9`,
+  `01a02928-3d39-7673-8e08-6d4ed0f8d554`, and
+  `01a02928-58a0-7e03-b487-f8877b7f76d8` exercised Task, Step Review A1, and Step Review A2.
+  Codex truncated every long primary title. Registry fallback converged to one exact Task title and
+  the compact exact reviewer titles `#004·M03/T04/S02·SR1·<TASK-ID>` and
+  `#005·M03/T04/S02·SR2·<TASK-ID>`, retaining full authoritative IDs. All three registry entries
+  were verified, bound to their thread/host IDs, completed read-only, and archived.
+- Every live Task found and validated the then-installed `…20260822110519` SKILL content, including
+  project-monotonic `#NNN`, compact review attempts, readback/fallback, and Task/Milestone progress
+  instructions.
+
+## External blocker retained
+
+The Codex App skill catalog still injected the stale pre-install path
+`0.1.0+codex.20260822065726` into all three newly created Tasks even though `codex plugin list` and
+the installed cache root reported `0.1.0+codex.20260822110519` at E2E time. The stale path no longer existed;
+the Tasks located the actual installation through a read-only cache search. This reproduces
+WF-STABLE-025 and is an App runtime/catalog invalidation defect, not a beta.9 package or registry
+failure. Therefore the live title/registry/content E2E passed, but automatic fresh skill-path
+injection remains blocked until the App runtime is restarted or its catalog invalidation is fixed.
+
+## Not claimed
+
+- No npm publication, Git tag, push, or Signal Workflow-state mutation was performed.
+- No manual rewrite of external Workflow state is part of dependency-provenance recovery.
+- A successful personal plugin reinstall does not by itself prove that the currently running Codex
+  App process invalidated its cached skill catalog; live readback is required and currently fails as
+  documented above.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.7",
+  "version": "2.0.0-beta.9",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",

package/plugins/codex-workflow-gateway/.codex-plugin/plugin.json

@@ -1,12 +1,17 @@
 {
   "name": "codex-workflow-gateway",
-  "version": "0.1.0",
+  "version": "0.1.0+codex.20260822111400",
   "description": "Thin personal Codex gateway for exact project-local Codex Workflow V2 packages and codebase-memory-mcp.",
   "author": {
     "name": "Codex Workflow Maintainers"
   },
   "license": "MIT",
-  "keywords": ["codex", "workflow", "codebase-memory", "gateway"],
+  "keywords": [
+    "codex",
+    "workflow",
+    "codebase-memory",
+    "gateway"
+  ],
   "skills": "./skills/",
   "interface": {
     "displayName": "Codex Workflow Gateway",
@@ -14,7 +19,9 @@
     "longDescription": "Resolves the exact project-local Codex Workflow V2 package, delegates workflow semantics to its CLI, and maintains derived codebase-memory graph bindings with explicit fallback evidence.",
     "developerName": "Codex Workflow Maintainers",
     "category": "Productivity",
-    "capabilities": ["Interactive"],
+    "capabilities": [
+      "Interactive"
+    ],
     "defaultPrompt": [
       "Show the next valid Codex Workflow V2 action.",
       "Refresh the project code graph for planning.",

package/plugins/codex-workflow-gateway/references/protocol.md

@@ -1,4 +1,14 @@
-# Gateway Protocol V1
+# Gateway Protocol V2
+
+## beta.9 coordinator projections and chat registry
+
+- `update dependency-provenance-preflight --id <TASK-ID>` is read-only. The matching
+  `update dependency-provenance-recover --id <TASK-ID> --expected-revision <N> --actor <ACTOR>
+  --reason <TEXT>` is valid only when preflight and fresh `next` both advertise it.
+- `milestone progress --id <MS-ID>` is a read-only projection and the sole source for Coordinator
+  progress tables. It preserves cancelled/replacement Tasks as distinct membership rows.
+- `scripts/chat-registry.mjs` atomically allocates project-monotonic `#NNN`, builds all six title
+  families, verifies exact readback, supplies deterministic fallbacks, and binds the verified chat.
 
 ## Handshake
 
@@ -11,7 +21,7 @@ codex-workflow gateway handshake --repo <git-root>
 Require:
 
 - package name `codex-workflow-v2`
-- protocol version `1`
+- protocol version `2`
 - state schema version `2`
 - the capabilities needed for the requested operation
 
@@ -29,6 +39,8 @@ Current capability set:
 - `project-composite-transaction-journal-v1`
 - `corrective-plan-audit-v1`
 - `safe-update-preflight-v1`
+- `bounded-dependency-provenance-recovery-v1`
+- `milestone-progress-projection-v1`
 - `strict-reviewer-v1`
 - `legacy-snapshot-v1`
 - `plan-risk-audit-sidecar-v1`