Add the parent-owned depth-one Codex development lifecycle state machine

[Punisheroot]

Context

Needle already persists change requests, patch revisions, verification
artifacts, repair state, approvals, and journaled apply records. The current
verified-change path is deliberately linear, but it is not a configurable
parent-owned development lifecycle. There is no durable state machine for the
bounded sequence explore -> implement -> test -> review -> verify -> apply,
and review is not represented as a phase distinct from the independent
verifier. The roadmap explicitly requires the parent to own transitions,
budgets, dependencies, and final apply; workers must not create a worker tree.

Expected outcome

A depth-one, fail-closed lifecycle state machine coordinates typed artifacts and
role-profile revisions across the six phases. The parent runtime is the only
component allowed to advance or cancel a lifecycle. Review and verifier phases
have separate inputs and outputs, test execution is policy-bound, and apply is
possible only after an explicit approval against the latest verified revision.
Every transition is persisted as an auditable event and survives restart.

Scope

• Define lifecycle identity, phase/state enum, transition event, terminal
  outcome, parent budget, cancellation, and bounded artifact references in the
  runtime/core domain. Use the existing change ID/source snapshot and profile
  revision as immutable anchors.
• Implement a transition table for exactly
  explore -> implement -> test -> review -> verify -> apply, with explicit
  failure, cancellation, inconclusive, repair, and rollback edges. Reject
  skips, cycles, duplicate phase completion, stale revisions, missing required
  artifacts, and depth greater than one.
• Persist lifecycle state and append-only events transactionally in SQLite.
  Events include phase, profile revision digest, source/patch/verification
  identities, bounded reason/status, and timestamps; raw transcripts and
  credentials are not stored.
• Make review a distinct parent-owned phase that consumes the patch and
  acceptance criteria without being the verifier, and make verify consume a
  fresh checkout plus certified test context without the patcher transcript.
• Enforce parent-owned budgets, concurrency, cancellation, one repair limit,
  and explicit approval before active-worktree apply. Workers return typed
  artifacts and cannot transition the lifecycle or spawn children.
• Add a deterministic transition-matrix test suite, restart/recovery tests, and
  adversarial tests for illegal transitions, stale source, missing evidence,
  duplicate events, and nested-worker attempts.

Non-goals

• Implementing Codex process wiring ("Wire the parent-owned lifecycle executor
  to the current Codex primitives") or lifecycle read UI ("Add lifecycle read
  API and run-timeline control-plane UI").
• Running another host, allowing workers to spawn workers, or adding fan-out,
  retries without an explicit budget, or unbounded loops.
• Changing the existing artifact/cache proof kernel or making active apply
  automatic.
• Committing, staging, merging, pushing, opening PRs, or publishing results.

Acceptance criteria

• The state machine accepts only the declared depth-one phase order and
  explicit terminal/repair edges; all illegal, skipped, cyclic, or nested
  transitions return a typed error and leave state unchanged.
• Parent-owned state, budgets, cancellation, profile revision, source
  snapshot, and artifact references are persisted atomically with each
  transition; replay after process restart yields the same state.
• review and verify have distinct typed payloads and provenance; a
  review result cannot satisfy verifier evidence, and a verifier cannot
  consume a patcher transcript.
• test can execute only a parent-selected, trusted, certified bounded
  command; unavailable or failed evidence makes the lifecycle
  inconclusive/rejected, never verified.
• apply requires the latest patch revision, canonical verified artifact,
  unchanged source snapshot, explicit user approval, and the current state
  digest; no automatic active-worktree write occurs on a failed check.
• At most one repair transaction can be reserved and consumed; concurrent
  repair/apply requests are serialized and duplicate reservations fail.
• Events and terminal records are bounded, redacted, digest-addressed, and
  queryable without exposing credentials, absolute paths, or raw transcripts.
• Transition, restart, cancellation, stale-digest, and nested-worker tests
  pass without provider calls.

Validation

cd crates/needle-app/web
npm ci
npm run build
cd ../../..

cargo test --locked -p needle-core
cargo test --locked -p needle-runtime
cargo test --locked -p needle-platform-codex --test patcher_offline
cargo test --locked --workspace
cargo test --locked -p needle-app

The needle-app regression runs above after the embedded frontend build when
the state/event response is composed by that binary.

Starting points

• crates/needle-runtime/src/store.rs:628-724 - current change-state digest
  and prepared_change persistence boundary.
• crates/needle-runtime/src/store/changes.rs:41-425 - request/prepared,
  failure, repair, verification, and attempt event writes.
• crates/needle-runtime/src/store/changes.rs:638-836 - transactional apply
  begin/finish and state transitions.
• crates/needle-runtime/src/changes.rs:128-267 - verified apply, rollback,
  and pending-apply recovery primitives.
• crates/needle-core/src/change.rs:101-162 - canonical ChangeRequest and
  acceptance/allowed-path identity.
• docs/ROADMAP.md (Milestone 2), docs/ARCHITECTURE.md (trust boundaries),
  and docs/VERIFIED_CHANGES.md - parent ownership, isolation, and explicit
  apply requirements.

Dependencies

#1, Canonical revisioned Codex role-profile domain and SQLite
persistence provides the
profile revision anchor. The state/event contract defined here is consumed by
"Wire the parent-owned lifecycle executor to the current Codex primitives" and
"Add lifecycle read API and run-timeline control-plane UI".
Existing patch, verify, repair, and apply primitives remain the implementation
substrate; do not fork a second change journal.

Ownership and risk

The runtime maintainer owns the transition contract and persistence. This is a
high-risk correctness boundary: a skipped review, verifier conflation, nested
worker, or stale apply can bypass the safety model. Keep transition checks
centralized, transactional, and independently testable; expected blast radius
is core/runtime state and event persistence plus focused app integration.