Block model-policy migration completion when preserved guidance still authorizes autonomous xhigh

[BaseInfinity]

Problem

The updater correctly preserves customized policy surfaces, but it can still record the current model-policy schema as fully migrated while those preserved files contain autonomous xhigh guidance.

The #86 final review proved the false-attestation path:

• an AGENTS.md without trustworthy generated-file provenance is preserved byte-for-byte;
• customized START-SDLC.md / SDLC-LOOP.md / repo skill files can also be preserved;
• those files may still say Baseline reasoning: xhigh or Use xhigh reasoning by default for this repo.;
• update nevertheless sets manifest.model_profile.policy_schema_version to the latest schema, removes the legacy field, and converges without revisiting the unresolved policy conflict.

Preserving user customization is required. Claiming migration completion while effective repo guidance still authorizes autonomous xhigh is not.

Acceptance criteria

• Detect unresolved autonomous-effort guidance in every customized or untracked policy surface skipped during model-policy migration.
• Preserve customized files byte-for-byte unless the user explicitly selects replacement.
• Do not record the latest model-policy schema as complete while any skipped policy surface still conflicts with the High-only contract.
• Emit an explicit, actionable, repeatable unresolved-conflict result naming each path; a second update must not silently report convergence.
• Continue applying unrelated safe repairs without falsely certifying the policy migration, or fail before mutation if atomicity requires it; choose and document one deterministic contract.
• Distinguish structured selected-profile configuration from arbitrary persisted prose and keep explicit mixed-profile preservation intact.
• Add RED/GREEN regressions for missing generated provenance, customized generated docs, fully customized policy surfaces, and clean non-conflicting customization.
• Prove PowerShell parity: document/test that install.ps1 schema_version = 2 belongs to the model-profile file rather than manifest model-policy schema, and that PowerShell emits no legacy escalation_reasoning authority.
• Keep the fix(review): stop tool-free cross-model reviews when Claude invokes advisor #158 one-time exception consumed; require normal Sol High + Fable High review with no exception.
• Synchronize ROADMAP and the authoritative 1.0 milestone in this slice.

Evidence source

#86 final candidate 7cfa28ec0add78c706cd24f28b15a9e9e99d023b passed canonical 11/11, then the required reviewers converged after one reconciliation on a P1: schema migration completion is false when preserved policy still authorizes autonomous xhigh. The receipt is non-certifying and no retry is recommended.

Non-goals

• Do not overwrite customized policy files automatically.
• Do not normalize or ignore reviewer verdicts.
• Do not add another Enforce Sol High implementation and High-only planning/review #86 correction round or review exception.

[BaseInfinity]

Start checkpoint — decomposed current-main slice

Confidence: HIGH.

• Worktree: /Users/stefanayala/codex-sdlc-issue174
• Branch: fix/issue-174-truthful-policy-migration
• Base: origin/main at b7c8d4590a483afa0be61f1bb9ed4408d3b520cd
• GOALS.md: absent; GitHub milestone plus ROADMAP own scope/order.
• Dirty root checkout: out of scope and untouched.
• Frozen Enforce Sol High implementation and High-only planning/review #86 v2 candidate: retained exactly as non-certifying evidence; do not mutate or deliver it.
• Current implementation effort: Sol High per the live user decision.

Narrow contract

• Preserve customized policy files byte-for-byte.
• Inspect only skipped policy guidance surfaces (AGENTS, SDLC loop/start, repo sdlc skill) for autonomous default-effort conflicts; do not treat structured selected-profile metadata as arbitrary prose.
• If a skipped surface conflicts, apply unrelated safe repairs but leave the policy schema version pending, name every conflicting path, and repeat the actionable result on later updates.
• Once conflicts are manually resolved, the next update may record migration completion normally.
• Add an explicit PowerShell schema-ownership regression; install.ps1 model-profile schema v2 must not be confused with manifest policy schema.
• Synchronize ROADMAP/milestone, then one canonical 11/11 proof and normal Sol High + Fable High review. No exception.

TDD plan

1. Change the specialized-AGENTS migration regression to require preserved bytes, the old schema, and a repeatable manual-resolution result; run only that focused test RED.
2. Implement the smallest conflict detector and migration-record suppression; run focused GREEN.
3. Extend to customized/untracked policy surfaces and a non-conflicting customization control.
4. Self-review, canonical proof, required dual review, then candidate-bound delivery.

[BaseInfinity]

TDD RED

Focused command:

UPDATE_TEST_ONLY=specialized-agents-policy-conflict bash tests/test-update.sh

Result: expected 0 pass / 1 fail.

The unchanged updater preserved specialized AGENTS.md bytes but still planned and applied:

.codex-sdlc/manifest.json: model policy schema 1 -> record model policy migration completion

The new contract requires the old schema to remain, an AGENTS.md: autonomous effort conflict -> manual resolution required plan entry, and the same actionable pending result on the second update. No production implementation changed before this RED.

[BaseInfinity]

Focused GREEN — truthful pending migration contract

Implementation now:

• inspects only skipped effective repo policy surfaces (AGENTS.md, SDLC-LOOP.md, START-SDLC.md, repo sdlc skill) during model-policy schema migration;
• distinguishes the structured selected profile from arbitrary persisted prose and keeps an explicit mixed selection valid;
• preserves customized/untracked bytes while naming every autonomous-effort conflict;
• applies unrelated safe repairs but restores the prior/missing policy schema when a conflict remains;
• repeats the actionable pending result on later updates instead of silently converging;
• fails closed if a skipped policy surface cannot be inspected;
• documents/tests that PowerShell schema_version = 2 is the model-profile.json payload schema and emits neither manifest policy_schema_version nor legacy escalation_reasoning authority.

TDD and focused proof:

• initial focused RED: 0/1 as previously checkpointed;
• conflict matrix GREEN: 5/5 (custom generated guidance, missing AGENTS provenance, untracked repo skill, fully customized conflict, clean customized control);
• full updater: 41/41;
• adapter: 115/115;
• packaging: 39/39;
• roadmap: 15/15;
• syntax plus git diff --check: GREEN.

ROADMAP now matches the authoritative milestone: 9 open / 15 closed, with #174 -> #86 -> #109 first. #79 remains the exact-candidate real Windows Codex Desktop + CLI gate, and #88 remains public artifact verification across both hosts.

Next: freeze the candidate, run the one canonical stamped 11/11 proof, then normal Sol High + Fable High review with no exception.

[BaseInfinity]

Canonical candidate proof — 11/11

Frozen candidate:

• base/head: b7c8d4590a483afa0be61f1bb9ed4408d3b520cd
• staged tree: 2636c7da25fcd9a19735112f938e050981012a6c
• patch SHA-256: 20b901eb0a8b066467d4c75ee6d3dc96a9333155c83d71062d37a1a4a9cd7618
• unstaged changes: none

Canonical stamped command:

node .codex/hooks/git-guard.cjs prove --reviewed --check "node scripts/run-proof-suite.cjs"

Result: 11/11 PASS.

• diff: 25ms
• adapter: 319.3s (115/115)
• packaging: 15.5s (39/39)
• npm: 77.8s
• skill: 1.8s
• release: 445ms
• roadmap: 2.3s (15/15)
• benchmark: 1.0s
• e2e: 20ms
• setup: 264.5s
• update: 710.2s (41/41)

The proof stamp is bound to this worktree fingerprint and expires at 2026-08-24T02:46:21.365Z. Next gate is the required normal Sol High + Fable High review over this unchanged candidate; no exception is available or requested.

[BaseInfinity]

Required dual review — non-certifying terminal outcome

The exact frozen candidate remained unchanged:

• tree: 2636c7da25fcd9a19735112f938e050981012a6c
• patch SHA-256: 20b901eb0a8b066467d4c75ee6d3dc96a9333155c83d71062d37a1a4a9cd7618
• canonical proof: 11/11 PASS

Normal Sol High + Fable High review stopped after 125.9s with:

• receipt status: partial
• certifying: false
• terminal state: INVALID_VERDICT
• classification: invalid_execution
• infrastructure failure: false
• transient: false
• retry recommended: false
• joint verdict: NOT CERTIFIED

Fable High used the required preferred Anthropic route and no tools, but returned only an interim statement that it would review and first look for the base repository. It did not emit the required final JSON object or exact verdict literal. This is invalid execution, not auth/quota/transport infrastructure, so it must not be retried or normalized.

Sol High was still running and was cancelled when the peer failed. It had not completed a valid verdict, so there is no completed peer result to preserve. The partial receipt and full private logs remain intact in Git metadata.

No commit, push, PR, delivery, or exception occurred. #174 remains frozen and non-certifying. The next action is a separate P0 blocker that makes the tool-free Fable prompt require an immediate final review from the complete supplied patch/context, without repository-inspection deferral; then #174 must resume from fresh current main with fresh proof and normal review.

[BaseInfinity]

Resume checkpoint — fresh current-main candidate after #175

Confidence: HIGH.

• Fresh worktree: /Users/stefanayala/codex-sdlc-issue174-v2
• Branch: fix/issue-174-truthful-policy-migration-v2
• Base: origin/main at 1e9ce83
• Require tool-free Fable to return the final review instead of deferring to repository inspection #175 merged via PR fix(review): require a final tool-free Fable response #177; pre-merge and post-merge Windows CI passed.
• Milestone is authoritative at 9 open / 16 closed with Block model-policy migration completion when preserved guidance still authorizes autonomous xhigh #174 first.
• Dirty root checkout remains out of scope and untouched.
• Previous Block model-policy migration completion when preserved guidance still authorizes autonomous xhigh #174 tree 2636c7da25fcd9a19735112f938e050981012a6c and its non-certifying receipt remain frozen; neither is being retried or delivered.

Reconciliation onto current main:

• carried only the prior Block model-policy migration completion when preserved guidance still authorizes autonomous xhigh #174 production implementation and relevant updater/PowerShell regressions;
• retained the merged Require tool-free Fable to return the final review instead of deferring to repository inspection #175 prompt and invalid-output changes;
• excluded the stale prior ROADMAP/test-roadmap snapshot and synchronized both from live state;
• omitted the development-only UPDATE_TEST_ONLY environment selector so canonical proof cannot inherit a focused updater shortcut;
• recorded certified Require tool-free Fable to return the final review instead of deferring to repository inspection #175 follow-up Replace the grep-fragile canonical adapter focus-selector regression #176 in the 1.1 queue.

Plan:

1. verify syntax/diff and focused surfaces;
2. run current-main adapter, roadmap, packaging, and full updater proof;
3. self-review and freeze the exact candidate;
4. run one canonical 11/11 proof;
5. run normal Sol High + Fable High review with no exception;
6. deliver only if the exact candidate certifies, then verify pre/post-merge Windows.

No review exception is available or requested.

[BaseInfinity]

Fresh current-main candidate frozen for canonical proof

Candidate identity:

• base/HEAD: 1e9ce83
• staged tree: 659805fec0756479909f25869cfaa38005860dbc
• staged patch SHA-256: 9f65513f57897a5be3a621f8c3e3119aa5fb35fe86863c1705856f9dddd11a6e
• files: 9
• unstaged changes: none

Current-main reconciliation/focused evidence:

• preserved the prior Block model-policy migration completion when preserved guidance still authorizes autonomous xhigh #174 TDD contract while retaining merged Require tool-free Fable to return the final review instead of deferring to repository inspection #175 review behavior;
• omitted inherited updater focus selectors;
• adapter 115/115 PASS;
• packaging 39/39 PASS;
• ROADMAP 15/15 PASS at 9 open / 16 closed;
• release 20/20 PASS;
• updater 42/42 PASS before the final failure-path addition;
• syntax and git diff --check PASS.

Self-review added two bounded RED -> GREEN corrections:

1. RED: explicit prohibitions such as “Do not default to xhigh” were misclassified, and later same-line conflicts could be missed. GREEN: dedicated detector tests distinguish prohibition from authority and scan all claims.
2. RED: injected regeneration failure was not supervised and could not prove pending-schema restoration. GREEN: a test-only injected setup writes schema 4 then exits 42; update propagates 42, restores schema 1 via an EXIT guard, and preserves customized AGENTS bytes.

The canonical updater now contains 43 cases. Next: one canonical stamped 11/11 proof on this exact candidate, then normal Sol High + Fable High review with no exception.

[BaseInfinity]

Fresh current-main canonical proof — 11/11 PASS

Exact candidate:

• base/HEAD: 1e9ce83
• staged tree: 659805fec0756479909f25869cfaa38005860dbc
• staged patch SHA-256: 9f65513f57897a5be3a621f8c3e3119aa5fb35fe86863c1705856f9dddd11a6e
• unstaged changes: none

Canonical stamped command:

node .codex/hooks/git-guard.cjs prove --reviewed --check "node scripts/run-proof-suite.cjs"

Result: 11/11 PASS.

• diff: 20ms
• adapter: 300.9s (115/115)
• packaging: 14.5s (39/39)
• npm: 74.6s
• skill: 1.5s
• release: 393ms (20/20)
• roadmap: 2.1s (15/15)
• benchmark: 1.2s
• e2e: 18ms
• setup: 249.2s
• update: 677.9s (43/43)

The proof receipt is fresh, reviewed, and bound to this worktree fingerprint. Next gate is fresh normal Sol High + Fable High review over this unchanged current-main candidate. The previous #174 receipt remains non-certifying evidence only; no retry or exception is being used.

[BaseInfinity]

Fresh current-main required review — NOT CERTIFIED

The exact candidate remained unchanged:

• base: 1e9ce83
• tree: 659805fec0756479909f25869cfaa38005860dbc
• patch SHA-256: 9f65513f57897a5be3a621f8c3e3119aa5fb35fe86863c1705856f9dddd11a6e
• canonical proof: 11/11 PASS

Both required reviewers completed normally and reconciled once:

• Sol High: NOT CERTIFIED, confidence 99
• Fable High: NOT CERTIFIED, confidence 88
• classification: reviewer_verdict
• infrastructure failure: false
• transient: false
• retry recommended: false
• no commit, push, delivery, or exception

Agreed blockers:

1. P1: legacy authority such as “maximum: gpt-5.5 at xhigh for the whole slice” is not recognized, so preserved guidance can still be falsely certified.
2. P1/P2: untracked AGENTS.md, SDLC-LOOP.md, or START-SDLC.md can bypass the special-cased inspection queue.
3. P1 on macOS portability: the empty skipped-surface array needs a Bash 3.2-safe length guard.

Non-blocking review notes also identified the arbitrary-script test seam, EXIT-trap composition/naming, brittle PowerShell comment grep, and conservative negation behavior.

One bounded correction round now follows with tests first:

• legacy/automatic/multiline xhigh authority detection;
• clean no-skipped-surface migration and untracked core-surface preservation;
• replace arbitrary test script substitution with a boolean after-manifest failure injection;
• replace EXIT trap with explicit regeneration status capture and schema restoration;
• keep only the meaningful PowerShell negative-field assertion;
• add the Bash 3.2-safe array guard.

This receipt is preserved and will not be retried unchanged. Any corrected candidate requires fresh canonical proof and fresh normal dual review.

[BaseInfinity]

Corrected current-main candidate checkpoint (normal gates; no exception):

• Base/HEAD: 1e9ce83e7e33142a1c6150ad18fd70eb0cf14362
• Branch/worktree: fix/issue-174-truthful-policy-migration-v2 in /Users/stefanayala/codex-sdlc-issue174-v2
• Frozen staged tree: 10df83dbaa7300e1d844beaefa5d44fe1a760463
• Frozen patch SHA-256: 21950477e460b850c1d6c6d334535c89075f8cd1d9a0a3c8329a5b81f845abeb

One bounded correction round resolved the reconciled P1s from the prior non-certifying receipt: legacy whole-slice/automatic autonomous xhigh authority is detected; untracked AGENTS/SDLC-LOOP/START guidance cannot bypass inspection; empty skipped-surface expansion is safe on stock macOS Bash; setup-failure restoration uses a bounded boolean test injection and propagates the real status without an EXIT-trap override. Legacy test fixture text is assembled at runtime so the repo-wide stale-model guard remains strict.

Focused/broad proof is green on the frozen bytes:

• adapter: 115/115
• setup: 48/48
• updater: 44/44
• roadmap: 15/15
• standalone conflict detector, migration boundary, failure restoration, syntax, and diff checks: pass

Next: fresh canonical 11/11 on this exact tree, then required Sol High + Fable High dual review. Certification and delivery remain forbidden unless both reviewers complete normally and verdict rules pass. The #158 exception remains consumed.

[BaseInfinity]

Canonical candidate-bound proof passed on the unchanged frozen candidate.

• Tree: 10df83dbaa7300e1d844beaefa5d44fe1a760463
• Patch SHA-256: 21950477e460b850c1d6c6d334535c89075f8cd1d9a0a3c8329a5b81f845abeb
• Canonical proof: 11/11 PASS
  • diff 21ms
  • adapter 308.7s
  • packaging 14.6s
  • npm 73.7s
  • skill 1.6s
  • release 400ms
  • roadmap 2.1s
  • benchmark 582ms
  • e2e 19ms
  • setup 248.8s
  • updater 714.3s

The staged tree and patch hash were recomputed after proof and are unchanged. Starting required normal Sol High + Fable High dual review now; certification remains fail-closed unless both complete and reconciled verdict rules pass.

[BaseInfinity]

Required dual review completed normally and is NOT CERTIFIED. No commit, push, PR, merge, exception, or retry.

• Candidate tree: 10df83dbaa7300e1d844beaefa5d44fe1a760463
• Patch SHA-256: 21950477e460b850c1d6c6d334535c89075f8cd1d9a0a3c8329a5b81f845abeb
• Classification: reviewer_verdict
• Infrastructure failure: false
• Transient: false
• Retry recommended: false
• Sol High final: 99 confidence, NOT CERTIFIED
• Fable High final: 85 confidence, NOT CERTIFIED

Reconciled P1: the detector misses this repository’s own conditional autonomous-xhigh clauses (Escalate the difficult slice to xhigh ... when high leaves unresolved risk, plus equivalent AGENTS/template wording). A preserved skipped surface can therefore still be falsely attested as migrated.

Candidate-born P2s to include in the final bounded correction: restore the old schema after any failed regeneration while migration was pending, even when no prose conflict was detected; and do not treat benign high guidance as conflicting merely because a structured mixed profile has medium baseline. P3s are non-blocking and will be handled only if narrow or filed separately.

The SDLC contract permits one final (second) bounded corrective round. It will start with RED regressions against the exact base clauses and the no-conflict failure path. If P0/P1 remains after the next normal dual review, stop/decompose/escalate; do not waive or extend the loop. The #158 exception remains consumed.