docs: govern authenticated lifecycle overflow recovery

[Niko4417]

Closes #170

Scope

• Accepted issue: Decision: Recover authenticated lifecycle suffix overflow without weakening the bound #170
• Accepted planning-contract version: v1
• Automated readiness record: Decision: Recover authenticated lifecycle suffix overflow without weakening the bound #170 (comment)
• Actual source branch: codex/170-lifecycle-overflow-decision
• Accepted target branch: dev
• Parent epic and Quality Envelope rows: Epic: Contract-as-Code migration and lifecycle activation cutover (ADR-0003/ADR-0004) #49; repository governance, lifecycle liveness,
  authority containment, bounded recovery, and evidence integrity
• Change classification: architecture/governance
• Product decision, finding, or incident: issue Decision: Recover authenticated lifecycle suffix overflow without weakening the bound #170; issue Exact migration inventory, one-time reconciliation, and activation orchestration #52 has an authenticated 16-record
  genesis suffix with no checkpoint and fails closed as record-live-suffix-overflow
• In scope: ADR-0011/ADR-0012 overflow-recovery amendment, lifecycle/quality/activation projections,
  and deterministic governance contract tests
• Out of scope: workflow or lifecycle implementation, activation, a recovery command, issue Exact migration inventory, one-time reconciliation, and activation orchestration #52
  mutation, new principals or dependencies, repository settings, and every merge effect
• Native targets, contracts, or trust boundaries affected: protected lifecycle record protocol,
  direct plain-issue maintainer recovery ingress, 15-record normal bound, 200-request recovery bound,
  and human-only dev

Product and architecture alignment

• The implemented contract version and fingerprint match the automated readiness record; no
  semantic planning change was absorbed during implementation.
• The change follows the Decision Addendum, CONTEXT.md, accepted ADRs, and the issue Quality
  Plan.
• Existing Keiko material was used only after a recorded Reuse Assessment, or the issue records
  why Existing Keiko evidence is not applicable.
• This greenfield change creates no mandatory build-time or runtime dependency on Existing
  Keiko.
• Product authority, policy, evidence, and privileged effects remain in their owning Native
  layer.
• Any durable architecture change is recorded in an ADR.

Existing Keiko evidence is not applicable: this is a repository-owned Native governance and
GitHub-provider recovery protocol decision.

Acceptance criteria and evidence

Acceptance criterion	Evidence	Exact head or artifact	Result
AC1 — equal option evaluation	Issue #170 frozen four-option decision matrix and readiness fingerprint 450630bcbdea07635d6dd825a72679be9d5103d02beeafa1eae5a1e1dd244537	b70ca08cefe62826d539b6592e44cf994fe9cb18	Complete
AC2 — reproducible recommendation	Issue #170 v1: Option A scores 480/500 and is the only option satisfying all non-negotiables	b70ca08cefe62826d539b6592e44cf994fe9cb18	Complete
AC3 — exact governed recovery	ADR-0011/0012 plus lifecycle, gate, and activation projections; bounded contract test	b70ca08cefe62826d539b6592e44cf994fe9cb18	Complete
AC4 — inert decision only	Complete diff contains five documentation files and quality/contract.test.mjs; no workflow, implementation, dependency, or setting mutation	b70ca08cefe62826d539b6592e44cf994fe9cb18	Complete

Acceptance journey evidence

• Applicability: Not applicable — repository governance decision with no desktop surface.

• Automated checks exercise user-visible outcomes rather than incidental implementation
  details. Not applicable because the accepted issue has no user-visible outcome; governance
  behavior is pinned through deterministic contract tests.

• Required failure, recovery, accessibility, visual, and platform observations are settled.
  Failure/recovery boundaries are contract-tested; accessibility and visual evidence are not
  applicable; protected GitHub Actions is the authoritative implementation platform.

Quality Plan settlement

• Applicable positive, negative, boundary, failure, cancellation, and recovery behavior is
  covered.
• The actually wired production composition was tested where this change crosses layers.
• Applicable security, accessibility, performance, resource, visual, and platform evidence is
  attached or linked.
• Excluded quality areas retain the rationale accepted in the issue.
• Secrets, credentials, raw customer content, private endpoints, and PII are absent from source,
  tests, logs, evidence, artifacts, issues, and this pull request.

This ADR-only decision changes no wired production composition. Security/resource/platform
constraints are pinned by the exact-16, checkpoint-plus-16 denial, request-200/request-201,
null-effect, replay, principal, activation, and dev boundary checks. Accessibility, visual,
performance, cancellation, and desktop behavior are not applicable.

Verification

• npm ci --ignore-scripts
• npm run quality
• npm audit --audit-level=high
• Every declared native target-specific gate passed on its authoritative platform.
• I reviewed the complete diff against requirements, contracts, trust boundaries, and failure
  modes.

Additional affected checks and concise results:

node --test quality/contract.test.mjs: 65 passed, 0 failed
npm run quality: complete control-plane and native suite passed on the immutable signed commit
control-plane coverage: lines 94.85%, branches 88.17%, functions 94.85%
frontend coverage: lines 95.92%, branches 94.26%, functions 90.24%
frontend tests: 30 passed; workspace contract: 3 passed
native tests: application 4, macOS host 45, UI port 9; all passed
npm audit --audit-level=high: 0 vulnerabilities

Independent audit and findings

• Audit scope and dimensions: exact-head local and remote contract, Sonar, CodeQL, dependency,
  security, signature, and review-thread audit over scope, protocol completeness, authority, request
  arithmetic, failure complements, and rollout boundaries; every known finding is resolved on the
  signed current head; the two latest findings are resolved on this exact head; the fresh
  exact-head Codex review reports no major issues; Gitar and Keiko for Quality are advisory under the current liveness policy
• Audited commit: b70ca08cefe62826d539b6592e44cf994fe9cb18

Confirmed finding	Evidence	Disposition	Settlement evidence or follow-up
Superseded checkpoint authentication used current rather than frozen generation inputs	Codex thread	Resolved	Frozen-generation plus stable superseding-observation projection on exact head
Recovery budget did not reserve complete checkpoint publication	Codex thread	Resolved	Closed 108 + 60 + 6 + 26 = 200 request allocation and static/runtime denial tests
Canonical schema rule omitted the exact v2 exception	Codex thread	Resolved	The sole record-v2 exception and both closed auxiliary-v2 exceptions are declared and contract-pinned
Interrupted v2 publication had no forward recovery path	Codex thread	Resolved	Target remains unconsumed; fresh command can bind at most four strictly incomplete candidates in the successful compacted prefix
Candidate-attestation checks exceeded the recovery request budget	Codex thread	Resolved	Subject-qualified inventory responses carry their bundles; first-pass 68 + 40 = 108 and second-pass 36 + 24 = 60 accounting are contract-pinned
Superseded checkpoints contradicted the complete producer-set schema	Codex thread	Resolved	Sole closed partial producer-set exception accepts only authenticated pre-fence results, including the empty set
Anchorless interrupted comments lacked an immutable writer locator	Codex thread	Resolved	Exact pre-comment locator artifact, subject, digest, attestation, protected run, and terminal-job binding are schema- and contract-pinned
A second fact change could strand a superseded fence	Codex thread	Resolved	The final encoded read-back observation is the sole durable witness; further pre-comment changes restart the stable final read under the same frozen generation and fence
An attested stale checkpoint had no terminal settlement path	Codex thread	Resolved	A valid anchored checkpoint remains a null-effect historical settlement after later fact changes; unavailable or mismatched immutable bindings still fail closed
Overflow v2 discarded authenticated pre-fence producer results	Codex thread	Resolved	The v2 record contains exactly the authenticated pre-fence producer subset, including empty only when no result preceded the fence
Publication budget omitted fresh locator verification	Codex thread	Resolved	Six calls verify the writer job, inventory, metadata, downloaded canonical locator bytes, and attestation bundle within the closed 26-call budget
Overflow checkpoint members lacked canonical ordering	Codex thread	Resolved	The 16-record prefix is predecessor-ordered and quarantined candidates are numeric-comment-ID ordered with duplicate identities rejected
Locator identity did not bind the candidate record body	Codex thread	Resolved	A non-circular candidate-record projection digest now binds every intended v2 field except the locator pair, which the artifact and attestation bind independently
Carried producer results were incorrectly rebound to the superseding fence	Codex thread	Resolved	Each carried result remains bound to its unique authenticated original producer-owning fence in the frozen predecessor chain and is never rebound to the superseding fence
Recovery accounting assumed one bulk attestation call unsupported by the provider	Codex thread	Resolved	Both 84-call passes now account for one subject-qualified provider request per digest, with matching bundles returned in that response and no invented bulk endpoint
Locator-attestation digest lacked an exact canonical preimage	Codex thread	Resolved	A versioned canonical auxiliary identity binds normalized subject, certificate, SLSA, protected-workflow, and writer-job claims; provider wrapper bytes remain verification input rather than hashed identity
Pre-locator writer-job lookup was outside the publication budget	Codex thread	Resolved	The protected job read moves before locator construction and remains one of six locator-verification calls in the closed 26-call publication budget
Per-candidate locator-artifact inventories were absent from recovery accounting	Codex thread	Resolved	The first pass uses 108 calls and the metadata-only stable second pass 60, with every candidate comment, locator, optional anchor, attestation subject, and terminal job accounted
Anchor artifact digest lacked an exact byte preimage	Codex thread	Resolved	The digest is the SHA-256 of the safely extracted sole canonical anchor file bytes and must equal the recomputed auxiliary identity; archive and transport bytes are excluded
Inert rollout text did not authorize the required pre-activation overflow implementation	Codex thread	Resolved	A separate accepted defect issue may implement only issue #52's null-effect v2 transition/read-back checkpoint after hostile-complement evidence; ordinary lifecycle remains inert and dev remains human-only
Ordinary superseded checkpoint fields were underdetermined	Codex thread	Resolved	The complete v1 projection now fixes equal states, invalidation ownership, null effect identity, and superseded outcome/reason while retaining all existing v1 fields
Post-checkpoint supersession could exhaust the non-checkpoint limit before settlement	Codex thread	Resolved	A three-record reserve places the terminal fence at 13, permits an immediate checkpoint or exact settlement at 14, and reserves record 15 for the recovery checkpoint
Stored locator bytes were not downloaded before being treated as verified	Codex thread	Resolved	Six-call locator verification downloads and safely extracts the immutable artifact, then reproduces its canonical identity and candidate projection before comment creation
An interrupted reserved checkpoint publication had no bounded forward path	Codex thread	Resolved	The three-record reserve permits one authenticated phase/fence settlement at 14 and a recovery-owned null-effect v1 checkpoint at 15 only after stable proof that attestation submission was skipped
Fact drift after the reserved terminal fence could strand the generation	Codex thread	Resolved	The same reserved fence becomes the closed supersession predecessor; stable current facts refresh only its null-effect superseded checkpoint projection and no second fence is appended
Artifact-download redirects were not counted in recovery	Codex thread	Resolved	Every archive costs two calls; pass one downloads at most 24 immutable canonical files and pass two rereads every provider binding while reusing only those bounded bytes, preserving the exact 200-call ceiling
Ambiguous anchor-attestation submission could be retried	Codex thread	Resolved	Only an exact terminal job step of skipped proves non-submission; attempted, missing, failed, cancelled, timed-out, or unknown steps permit no retry, quarantine, checkpoint, or effect
An interrupted reserved-fence publication had no bounded forward path	Codex thread	Resolved	An exact version-2 fence-orphan settlement occupies record 13 after the 12 authenticated records, followed only by a recovery-owned null-effect checkpoint at record 14
The reserved-fence superseding witness was not durably persisted	Codex thread	Resolved	Two equal final reads must differ from the frozen generation, and the final encoded read-back source observation is the sole durable witness; later changes restart that read
Overflow accounting omitted workflow-run and referenced-workflow reads	Codex thread	Resolved	The effect-disabled exact-target hard-200 profile replaces those historical reads with verified GitHub-native protected caller/writer attestation claims plus one exact bound writer-job read; ordinary authentication is unchanged
The recovery-settlement schema changed version 1 incompatibly	Codex thread	Resolved	Version 1 is restored byte-for-byte as read-only compatibility; every new settlement uses an exact version-2 schema selected before parsing
Normal-mode accounting omitted artifact-download redirects	Codex thread	Resolved	Each of 16 redirect chains costs two calls, producing 109 per stable pass, 218 for two passes, and a hard ceiling of 232 with the existing 14 write/read-back calls
Recovery-settlement v2 lacked a parent record discriminator	Codex thread	Resolved	New settlements use phase/fence v2 with encoded settlement schema version 2; historical phase/fence v1 selects only byte-compatible settlement v1
Historical attestation evidence did not bind the top-level caller	Codex thread	Resolved	Exact claims now bind workflow_ref/workflow_sha to the protected caller and job_workflow_ref/job_workflow_sha to the reusable writer
Recovery-owned checkpoints could not retain partial producer results	Codex thread	Resolved	The exact settlement-following abandoned checkpoint carries only the authenticated pre-fence subset, including empty; no other abandoned checkpoint may omit a producer
The skipped attestation step lacked a canonical provider identity	Codex thread	Resolved	A closed workflow-to-step mapping fixes exact name, YAML ordinal, provider-visible number, and skipped conclusion in both stable reads
Historical coordinator records were assigned nonexistent job reads	Codex thread	Resolved	Successful coordinator records use their unique attested artifact-anchor correlation; exact job reads apply only to records and candidates that encode workflow_job_id
Recovery settlement and checkpoint authentication could fail after later current-fact drift	Codex thread	Resolved	Closed historical recovery authentication retains the frozen predecessor/orphan binding and stable settlement observation across later drift
Locator steps made the historical anchor-attestation ordinal stale for overflow v2	Codex thread	Resolved	The final overflow writer topology fixes locator steps at 3-6, comment/anchor at 7-8, and anchor attestation at ordinal 9/provider step 10 while retaining the historical mapping by protected commit
The global cardinality rule contradicted recovery-owned partial abandoned checkpoints	Codex thread	Resolved	The canonical schema declares the closed partial-cardinality exceptions, including the cursor-v4 checkpoint, and rejects every other incomplete producer set
Unlimited byte-identical copies exceeded the four-candidate authentication budget	Codex thread	Resolved	Four total comment copies are allowed; every copy consumes a full slot and its distinct anchor/attestation tuple is authenticated before grouping; a fifth fails closed
The four-copy cap did not distinguish historical interrupted candidates from the current prospective checkpoint publication	Codex thread	Resolved	The cap now applies to four historical interrupted copies before the current attempt; the single current publication is separately funded by the 26-request budget, becomes the authenticated record on success, and counts as historical on the next recovery if interrupted
Later byte-identical copies could lose their transient irrelevant classification after recovery	Codex thread	Resolved	Normal reconstruction now has one authenticated standing rule for at most four later exact-body replay shadows rooted in the lower-ID authenticated overflow v2 checkpoint; shadows require no extra provider calls, gain no record or authority status, and every mismatch or fifth shadow fails closed
Cursor recovery rejected replay shadows whose checkpoint lay beyond the normal window	Codex thread	Resolved	One serialized invocation retains every full member preimage across twice-stable pages and authenticates the lower-ID checkpoint before the sole final v4 claim and checkpoint
Cursor-resumed pages could discover replay shadows outside the initial window	Codex thread	Resolved	Every page may add shadows to one in-memory body group and four total; only the complete final v4 summary is persisted
Final replay of shadow pages could exceed the 150-request recovery ceiling	Codex thread	Resolved	One invocation double-reads at most 3 pages; the ordinary/genesis profile totals 146 calls and the overflow-v2-root profile totals 147, both under the hard 150 ceiling
Ordinary irrelevant page members were absent from the v3 summary	Codex thread	Resolved	The single invocation retains every full recovery-suffix-member preimage, including ordinary irrelevant comments, before publishing the complete final v4 summary
Overflow base records could lie outside the two-page discovery budget	Codex thread	Resolved	All 16 base comments must be present in the stable two-page first-pass window; an outside or missing base is unsupported and fails closed
Incomplete v1 cursor claims had no migration path	Codex thread	Resolved	Incomplete v1 and v3 claims are read-only and non-resumable; zero such claims across the complete every-issue 3-page-bounded activation inventory is required, otherwise exact-target human reconciliation is separately governed

| Recovery replay did not preserve its original starting boundary | Codex thread | Resolved | Recovery now double-reads the complete bounded history in one serialized invocation and writes no claim before the final authenticated root, so publication cannot invalidate a replay boundary |
| Cursor progress claims could consume the checkpoint reserve | Codex thread | Resolved | No intermediate progress claim is published; the sole final v4 claim admits one through 10 live records including the unique-genesis request, one through 9 after an ordinary-v1 root, or one through 8 after an overflow-v2 root; unique-genesis n = 1 is admitted and terminalized through v4 plus checkpoint, while checkpoint-root n = 0 alone is a no-op |
| Interrupted cursor terminalization had no forward settlement path | Codex thread | Resolved | Closed v2 reasons settle an interrupted final v4 at record n + 1 with checkpoint n + 2, or an interrupted cursor checkpoint at settlement n + 2 with checkpoint n + 3, for unique-genesis n = 1 through 10, ordinary-v1 n = 1 through 9, or overflow-v2 n = 1 through 8; unique-genesis n = 1 is terminalized and checkpoint n = 0 alone is a no-op |
| Recovery accounting omitted both terminalization publications | Codex thread | Resolved | The ordinary/genesis profile uses a 126-call core and totals 146; the overflow-v2-root profile includes both root-locator verification and original-command reauthentication, uses a 127-call core, and totals 147. Both include page and ingress calls and remain under the hard 150 ceiling |
| Activation audited only the disposable-probe manifest | Codex thread | Resolved | Two stable observations freeze the maximum issue number; every number from 1 through that maximum is classified, and every issue receives a complete bounded scan while PR/missing classifications are retained negative evidence |
| Reserve projections omitted the cursor-v3 exception | Codex thread | Resolved | All five projections admit complete cursor v4 at record n + 1 followed by checkpoint n + 2 for unique-genesis n = 1 through 10, ordinary-v1 n = 1 through 9, or overflow-v2 n = 1 through 8; unique-genesis n = 1 is terminalized, checkpoint n = 0 alone is a no-op, and the interrupted-publication settlement paths remain bounded |
| Historical incomplete v3 compatibility had no exact shape | Codex thread | Resolved | The read-only shape now fixes recovery phase, claimed outcome, non-null scan/accumulator/cursor, positive counts, incomplete flag, null settlement, and the exact bounded member/shadow summary |
| Final v3 publication preceded root authentication | Codex thread | Resolved | Checkpoint-rooted recovery authenticates the lower-ID checkpoint and greater shadow-ID relation; unique-genesis-rooted recovery requires an empty shadow summary and directly authenticates the complete genesis suffix before publishing the sole final v4 claim |
| Cursor checkpoint recovery omitted the fifteenth authentication tuple | Codex thread | Resolved | The ordinary/genesis maximum is twelve record/root/orphan tuples consuming 64 base authentication calls; two cursor-orphan writer reads and six original-command reauthentication calls, plus 26 provider-state and 28 publication calls, make the 126-call core, with 6 page and 14 ingress calls totaling 146 under 150 |
| Activation inventory could race a pre-amendment writer | Codex thread | Resolved | All older writers must be terminal; activation holds the existing repository-wide provider-budget serialization group through final complete-inventory revalidation and the durable authenticated receipt |
| Interrupted cursor publications below record 13 had no forward path | Codex thread | Resolved | The closed sequence applies to unique-genesis n = 1 through 10, ordinary-v1 n = 1 through 9, and overflow-v2 n = 1 through 8; unique-genesis n = 1 is terminalized and checkpoint n = 0 alone is a no-op: v4 or claim settlement is n + 1, the direct checkpoint or checkpoint settlement is n + 2, and the recovery checkpoint is n + 3 |

| Direct cursor checkpoints lacked a valid producer-cardinality rule | Codex thread | Resolved | Cursor v4 admits only one internally valid open generation over the closed unique-genesis, ordinary-v1, or overflow-v2 ranges; the abandoned checkpoint carries the exact authenticated producer subset, and both root-only cases are no-ops |
| Cursor recovery omitted producer-job reads from request accounting | Codex thread | Resolved | The unique-genesis/ordinary-v1 profile permits twelve tuples and 146 calls; the overflow-v2-root profile permits eleven tuples, includes root-locator verification and original-command reauthentication, and reaches 147 calls under the hard 150 ceiling |
| Normal reconstruction omitted overflow-v2 locator authentication | Codex thread | Resolved | Normal mode includes up to three producer-job reads: 112 calls for an ordinary-v1-root pass, 118 for an overflow-v2-root pass, 236 for two stable passes, and 250 including publication |
| Quality-gate projection reversed canonical settlement field order | Codex thread | Resolved | Settlement identity now precedes settlement schema version in ADR, projection, and contract test |
| Quality-gate projection omitted phase/fence v3 from the closed exception list | Codex thread | Resolved | The projection and contract test declare exactly four schema-version exceptions, including historical incomplete cursor v3 and complete cursor-recovery phase/fence v4 |

| Cursor recovery omitted overflow-v2-root locator reads | Codex thread | Resolved | The closed overflow-v2-root profile admits at most eleven tuples, includes six root-locator reads and six original-command reauthentication calls, and totals 127 core plus 6 page plus 14 ingress = 147 under 150 |
| The three-page cap contradicted a successful more-than-100-page activation probe | Codex thread | Resolved | Issue #55 now probes explicit deep-history refusal before page 4; it no longer requires an impossible successful recovery beyond the hard cap |

| Normal reconstruction omitted producer-job reads | Codex thread | Resolved | Up to three exact producer-job reads produce 112 calls for an ordinary-v1-root pass, 118 for an overflow-v2-root pass, 236 for two stable passes, and a hard 250 ceiling with publication |
| The activation probe still implied successful recovery beyond the three-page cap | Codex thread | Resolved | Issue #55 now proves bounded three-page recovery plus explicit refusal before page 4, including the more-than-100-page hostile case |
| Cursor completion unconditionally required a checkpoint at a genesis root | Codex thread | Resolved | Checkpoint-rooted recovery authenticates the lower checkpoint and shadows; unique-genesis recovery requires an empty shadow projection and authenticates the complete genesis suffix directly |
| Direct cursor terminalization lacked a fact-drift authentication projection | Codex thread | Resolved | Direct v4 and its immediate checkpoint bind the frozen open generation, authorized request, twice-stable observation, immutable members, and producer subset across later current-fact drift |

| Interrupted v3 recovery claims inherited authority from the generation request | Codex thread | Resolved | Complete phase/fence v4 carries distinct command-specific cursor authorization and target identities; both interruption settlements repeat the exact binding |
| Ordinary-v1 checkpoint roots incorrectly depended on overflow shadow evidence | Codex thread | Resolved | Recovery now has three closed root branches; ordinary v1 and genesis require explicit empty-shadow facts while overflow v2 alone authenticates the locator and greater shadow IDs |
| Cursor recovery authorization was not durably encoded | Codex thread | Resolved | The complete v4 claim stores non-null cursor_recovery_authorization_identity and cursor_recovery_target_identity; historical incomplete v3 remains read-only and has no such bytes |
| Cursor interruption accounting omitted two terminal writer-job reads | Codex thread | Resolved | Both budget profiles reserve two stable cursor-orphan writer-job reads and six original-command reauthentication calls; ordinary/genesis closes at 146 and overflow v2 at 147 after the corrected live-suffix ranges |
| The maintainer command changed the cursor target it authorized | Codex thread | Resolved | The command comment ID is an exclusive upper cutoff; existing stable ingress reads reproduce the historical prefix strictly before it without another provider request, and edits, deletion, instability, or boundary drift fail closed |
| The expanded cursor claim changed historical schema-v3 bytes incompatibly | Codex thread | Resolved | Historical v3 remains the exact three-field read-only decoder with no cursor-authority bytes; the complete six-field cursor claim is schema v4, and version dispatch cannot reinterpret v3 as v4 |
| Cursor-v4 authentication consumed the target before its checkpoint could settle | Codex thread | Resolved | V4 alone does not consume the target; only an authenticated direct or settlement-following checkpoint consumes it, while a fresh command authorizes the closed interrupted-publication settlement and its predecessor proof retains the original v4 authority and target |
| Quality-gate projection still described only the pre-split cursor schema | Signed correction | Resolved | The projection and deterministic test now enumerate all four record-version exceptions: two v2 forms, read-only historical cursor v3, and complete cursor v4 |
| Fresh settlement commands could recompute a different cursor target from their newer cutoff | Codex thread | Resolved | Settlement derives the target only from the authenticated original v4 claim; the fresh cutoff is ingress-only and cannot replace original recovery evidence |
| Complete cursor claims remained schema v3 in the quality-gate projection | Codex thread | Resolved | The exhaustive projection and regression test now require complete cursor v4 while retaining read-only legacy cursor v3 |
| Complete legacy v1 cursor claims were absent from the activation-blocking inventory | Codex thread | Resolved | Every v1 recovery scan with a non-null identity, incomplete or complete, is read-only and blocks activation; all new completion uses v4 |
| Cursor v4 lacked a deterministic original-command locator and reload budget | Codex thread | Resolved | V4 stores the authenticated command comment ID only as an untrusted locator, settlement repeats the complete six-request exact-comment authentication, and both bounded profiles remain below 150 requests |
| Unique-genesis cursor positions omitted the genesis request itself | Codex thread | Resolved | The live suffix cardinality now includes the genesis request; v4/checkpoint/settlement positions use n + 1 through n + 3 over the corrected closed ranges |
| Legacy v1 cursor compatibility admitted unspecified claim outcomes | Codex thread | Resolved | Incomplete and complete v1 recovery scans require claim_outcome exactly claimed; every other outcome or field combination is malformed |
| Historical original-command reauthentication depended on the newest-100 edge window | Codex thread | Resolved | A closed twice-stable six-request by-ID route authenticates the exact original command without loading newest-100 edges or recovering its cursor; every mismatch fails closed and the 146/147 ceilings remain unchanged |
| A cursor-discovered genesis request alone was a permanent no-op | Codex thread | Resolved | Unique-genesis n = 1 is admitted and terminalized through the same v4 plus null-effect checkpoint path; checkpoint n = 0 alone remains a no-op |

• Findings are evidence-cited; speculative observations are advisory rather than blockers.
• Every confirmed finding is resolved, explicitly accepted by an authorized human, or linked to
  a scoped follow-up that does not invalidate current acceptance.
• Verification and audit were repeated after the latest implementation or audit fix.

Integrated epic acceptance

• Applicability: Not applicable — this decision repairs lifecycle governance and does not deliver or change epic #49 product acceptance.
• Production-composition result: Not applicable; documentation and contract test only.
• Machine-enforced acceptance result: 65/65 governance contract tests and full local quality suite
  passed on the exact signed head.
• macOS evidence: full native quality suite, package, platform, security, signing, and tests passed.
• Windows evidence: no productive/native behavior changed; remote cross-platform smoke is required
  before handoff.
• Manual usability, accessibility, visual, signing, or packaging evidence: desktop observations are
  not applicable; immutable snapshot signing and packaging gates passed.

Delivery

• Target path: epic/standalone -> dev
• The target branch matches the delivery path accepted in the issue; no direct push, force
  push, gate bypass, finding dismissal, or authority widening occurred.
• Commits are signed and every required check is bound to the exact current head and expected
  producer.
• Advisory tools are not treated as required merge authority under the current quality-gate
  policy.
• Documentation, ADRs, contracts, known limitations, and follow-ups are current.
• A draft pull request was not promoted to Ready for Human Review before every required
  Acceptance Journey result and exact-head gate was complete.

For a child-issue pull request targeting its designated epic branch:

• The accepted issue authorizes this epic-branch target.
• Acceptance and audit evidence is complete, every applicable exact-head gate is green, and no
  blocking finding or review conversation remains.

This authority exists only for a fully eligible child-issue pull request targeting its exact
accepted epic/** branch. Epic and standalone pull requests remain human-only deliveries to dev.
For that child-issue delivery, an agent may use the existing authenticated maintainer credential
only through the repository-owned guarded operation after complete current evidence and
status: ready for human review are revalidated. The guard persists a durable single-flight
compare-and-set claim for target/base serialization before any provider submission. The target/base
serialization uniqueness key consists only of repository, exact accepted target, and observed
current base. The immutable per-operation record binds issue, contract, readiness, pull request,
exact head, and request identity. Distinct request identities cannot create another serialization
claim. Two distinct child-issue pull requests for the same exact accepted target and observed base
contend on that one key; only one may reach provider submission. It submits at most once, explicitly
passes the exact revalidated head SHA as the provider request's sha parameter, and explicitly
sends merge_method: squash. It never uses provider auto-merge and verifies that the exact target
tip is the reported squash commit, whose sole parent is the observed base and whose tree equals the
observed head tree. An ambiguous claim remains blocked with no retry until explicit human
reconciliation using exact refs, the squash commit, its parent, and the observed trees. A new request
identity is permitted only after explicit terminal settlement or human reconciliation and fresh
revalidation. GitHub cannot distinguish shared-identity agent and human actions. An agent must never
merge, enable auto-merge, enqueue, push, or update dev, main, or release/**; guard
unavailability selects human-only child integration.

The canonical status: ready for human review state cannot truthfully exist as merge authority
before the signed Contract-as-Code activation. The guarded operation is therefore unavailable
before activation and makes no provider merge request. Protected dev is the sole policy source
and derives exactly three availability states. disabled applies before activation. probe-only
immediately after activation permits effects solely for Issue #55's frozen disposable-probe
manifest and exact issue, pull request, target, head, base, request, and operation identities.
enabled requires protected Contract-as-Code to consume an expected-producer exact-head live-proof
receipt and status bound to the signed activation commit, frozen manifest, and complete
successfully settled matrix. That evidence is consumed input, not independent authority. Missing,
stale, failed, wrong-producer, mismatched, incomplete, or ambiguous evidence remains probe-only
or disabled; no caller input or repository variable promotes it. An absent main ref is denial
evidence and is never created for a probe.

For an epic or standalone pull request targeting dev, complete only by Niko or Oscharko. Agents
must leave this subsection untouched, stop at Ready for Human Review, and must not enable
auto-merge.

• Authorized maintainer:
• Reviewed head commit:
• I reviewed the linked issue and pull request, including scope, acceptance criteria, Quality
  Plan, evidence, checks, findings, conversations, and residual risks on the commit above.
• I am manually initiating the merge into dev; no automated actor is performing it.

Residual risks and follow-ups

• Issue Defect: Upgrade transitive PostCSS past GHSA-fxqj-rqcc-2cmp #173 was closed by merged PR fix(deps): upgrade transitive PostCSS past advisory #175; its PostCSS and generated supply-chain evidence update is incorporated in this exact head.
• A separately governed defect issue must implement the amendment and recover issue Exact migration inventory, one-time reconciliation, and activation orchestration #52 before PR
  Governance: add exact migration inventory and dry-run orchestration #168 can be fully requalified.
• Issue Signed activation switch, in-flight continuity, and integrated acceptance #55 remains the sole activation owner and must prove the complete live positive and hostile
  complement before enabling lifecycle effects.
• Provider availability and immutable artifact retention remain external operational dependencies;
  every unavailable or ambiguous read fails closed.

[Niko4417]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1f64b5bb96

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review — please review exact head 240d7277ec3524730c00b94fd384aebc84e4a137 against accepted issue #170 v1, ADR invariants, lifecycle safety, and the sacred dev boundary.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 240d7277ec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review — please review exact head 4cb6e8b. Re-audit the authenticated overflow-recovery authority, exact 200-request accounting including publication, sole schema-v2 exceptions, interrupted-publication recovery and bounded incomplete-candidate quarantine, fail-closed complements, and inert pre-activation/dev boundaries. The four earlier Codex findings have been addressed on this head; please report any remaining issue rather than relying on the stale-head review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4cb6e8b9fb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review exact head fd66f5f

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fd66f5f354

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review\n\nPlease review exact signed head 03d2714e1aa8b08c8c6809f16eafa6af409a7142, including the overflow-recovery amendments and settlements linked in the audit table.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 03d2714e1a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fc9722dcaf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

Submitting the accumulated exact-head settlement replies; no approval or merge authority is asserted.

[Niko4417]

@codex review

Please review exact signed head ad6220bfb6c31ffb0c53d62a900fb28bf9c70df4 against accepted issue #170 v1 and the sacred dev boundary. Re-audit the exact 200-request recovery/publication accounting, pre-locator writer-job binding, per-candidate locator inventories, canonical anchor digest, pre-activation defect authority, complete ordinary superseded-checkpoint projection, and the two-record terminalization reserve. All known findings are evidence-cited in the PR audit table and have concrete thread settlements; report any remaining defect rather than relying on a prior head.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ad6220bfb6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 07ebc095c1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

Please review exact head 30a81343b74523931f61432f24621f2a937af357 after the five latest findings were addressed.

[Niko4417]

@codex review

Please review exact signed head 6b931ccb9c40c091e955cf07026de5635ec388bf after the four latest P1 settlements:

• cursor v3 now durably binds distinct command authorization and incomplete-scan target identities;
• normal and interrupted completion use three closed root branches (overflow v2, ordinary v1, unique genesis);
• both cursor-orphan writer-job reads are explicitly budgeted;
• the overflow-v2 maximum is reduced to nine live records/twelve tuples, closing at 146 requests while ordinary/genesis closes at 150.

Please report any remaining actionable finding on this exact head.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6b931ccb9c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review Please perform a fresh full review of exact signed head a73a4fe against accepted issue #170 v1 and the complete six-file decision diff. Re-audit the pre-command cursor cutoff, strict legacy v3 and complete v4 schema split, deferred target consumption and both interruption-settlement paths, unchanged provider budgets, fail-closed complements, inert activation, and the human-only dev boundary. The three latest findings are fixed, evidence-cited, and resolved; report any remaining defect rather than relying on a prior-head review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a73a4fe2db

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review Please perform a fresh full review of exact signed head 999a597 against accepted issue #170 v1 and the complete six-file decision diff. Re-audit settlement commands against the original v4 cutoff and target, the strict v1/v3/v4 legacy and completion dispositions, the four schema-version exceptions, all five normative projections, unchanged request budgets, inert activation, and the human-only dev boundary. All known findings are evidence-cited and resolved; report any remaining actionable defect on this exact head.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 999a597c60

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

Please perform the final full review of exact signed head 999a597. All prior review threads are resolved with exact-head evidence, the complete local quality bar is green, all required remote checks are green, and Sonar reports zero open issues. Re-audit the complete six-file decision diff, especially original-v4 target preservation for settlement retries and the blocking disposition of every legacy complete or incomplete v1 cursor claim. Report any remaining actionable defect.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 999a597c60

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

[Niko4417]

@codex review

Please perform a fresh full review of exact signed head 66a43411e9d430ad590e547e3d185642e3adb3ba against accepted issue #170 v1 and the complete six-file decision diff. Re-audit the persisted original-command locator and independent six-request reauthentication, corrected genesis-inclusive n ranges and record positions, exact legacy v1 cursor outcomes, both hard-150 request profiles (146 ordinary/genesis and 147 overflow-v2), all five normative projections, inert activation, and the human-only dev boundary. All known review threads are resolved and the PR audit table is current; report any remaining actionable defect on this exact head.

[Niko4417]

@codex review

Please perform a fresh full review of exact signed head 66a4341 against accepted issue #170 v1 and the complete six-file decision diff. Re-audit the new untrusted original-command comment-ID locator and complete six-request reauthentication, the revised 146/147 request ceilings, genesis-inclusive n indexing and closed record positions, exact claimed outcome for both accepted legacy v1 cursor shapes, all five normative projections, inert activation, and the human-only dev boundary. All known review threads are resolved with exact-head evidence; report any remaining actionable defect.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 66a43411e9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review — please review exact signed head b70ca08 against accepted issue #170 v1 and the sacred dev boundary. Re-audit the closed historical-v4 six-request original-command reauthentication route, including history beyond the newest-100 edge window, and unique-genesis n = 1 terminalization. All known review threads are resolved and the updated audit table cites their exact settlements; report any remaining defect rather than relying on a stale-head review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: b70ca08cef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

Please perform a fresh full review of exact signed head b70ca08cefe62826d539b6592e44cf994fe9cb18, including the two latest settlements: original-command reauthentication beyond the newest-100 window and terminalization of unique-genesis n = 1. Review the complete PR against accepted issue #170 v1, bounded request arithmetic, authentication/authorization separation, fail-closed complements, schema compatibility, all five governance projections, and the sacred-dev boundary. Please report any remaining actionable finding as an inline review thread.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: b70ca08cef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review — final ready-state audit of exact signed head b70ca08. Please recheck the accepted issue #170 v1 scope, all ADR/lifecycle projections, the historical-v4 by-ID reauthentication route, unique-genesis n = 1 terminalization, bounded request arithmetic, inert rollout, and sacred dev boundary. Report any remaining issue.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: b70ca08cef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".