Docs Council Execution Releases P0 P0 R0 Stage0 State Contract

Canonical source: docs/council/execution/releases/P0-P0-R0-STAGE0-STATE-CONTRACT.md · Snapshot commit: 6b8b70b72148

P0/R0 Stage 0 state contract

• Effective: 2026-08-15
• Revised: 2026-08-16
• Scope: the eight bounded P0/R0 task records; all 50 R1-R10 tasks remain frozen
• Authority: local/public Stage 0 control-plane repair under existing issue PC-001 only
• Current deployment state: Unknown — private read authority pending

Baseline truth

The complete current task population is 58 Incomplete; 45 Hold + 13 Historical non-authorizing; 0 Ready; 0 execution-allowed. AUD-001, PC-001, and PRD-R0-001 are historical/non-authorizing inside the bounded eight. Their prior planning or control evidence can never become a staged execution approval.

Stage 0 changes control mechanics and repairs stale public facts. It does not start an R0 action, access a private target, admit authentic content, deploy software, accept a release, or change a delivery status. The five substantive tasks eligible for future staged decisions are exactly SPK-R0-001, UX-R0-001, ARCH-R0-001, ENG-R0-001, and REL-R0-001.

Separate vocabularies

Dimension	Closed values	Meaning
Task status	Backlog, Next, In progress, Done	Roadmap delivery status only
Artifact readiness	Incomplete, Ready	Six-artifact dossier state only
Execution decision	Hold, Historical non-authorizing, Ready to prepare — Gate A, Ready to execute — Gate B, Ready to accept — Gate B	Gate outcome, always qualified
Issue state	Open, Closed	GitHub issue lifecycle only
Execution permission	executionAllowed=false, executionAllowed=true	Exact Gate B/runtime result only
Control review	Hold, Accepted for merge	Normal control-candidate publication only; never task approval
Stage state	the lifecycle below	One bounded action unit only

An unqualified Ready, Approved, Complete, or Done is prohibited. A verified stage does not imply task acceptance, task Done, deployment, release, or production.

Gate A — ready to prepare

Gate A binds one substantive R0 task, one immutable stage ID, one intended later scope/action pair, one exact proposal candidate, the six task proposal artifacts, current dependency-entry evidence, five distinct role-bound Council seats, and no open decision, blocker, or veto.

Its only positive result is preparationAllowed=true with the visible decision Ready to prepare — Gate A. Its immutable bounds are local, public, fictional, and synthetic. It always returns executionAllowed=false, cannot satisfy a private owner action, cannot mutate an external system, and cannot retroactively authorize how an implementation candidate was produced.

Gate B — ready to execute or accept

Gate B binds one substantive R0 task, one P0-STAGE-* ID, one scope/action pair, one execute or accept kind, one exact implementation/evidence candidate, one accepted Gate A predecessor and its canonical digest, one sequence number, one predecessor receipt (except the first stage), one P0-IDEMP-* key, the exact reviewed stage-definition digest and module ID/bytes, one passing record for every stage-scoped requirement, independent executed QA, rollback plan/snapshot/rehearsal evidence, current dependencies and owner actions, exact private authority where due, five full-context stage seats, and a later immutable append-only stage publication. Each task has one linear chain: stage sequences are unique and contiguous from 1, and every later runtime definition names the immediately prior approved stage plus that stage's exact verified-complete receipt digest; branches, skips, reused sequence values, and predecessor laundering fail closed. The registry is globally append-only from activation main 2dc4d05cdeca8cb9aeacf393076f6c6f946ff62b: one single-parent empty genesis is followed by exact-prefix preparation and stage arrays across every parent edge, with exactly one introduction of every record ID. The accepted preparation record and the stage record each have their own first-containing single-parent registry-only publication commit; unrelated publication deltas, rewrites, removals, delete-then-restore, duplicate branch publication, or self-reference fail closed. Required-check validation uses the committed PR HEAD; runtime separately repeats the same global proof at freshly fetched exact main. Legacy task-wide approvals or seats never substitute.

The existing task evaluator remains fail-closed for composite task-wide approvals. Only the reviewed stage evaluator may replace task-wide cardinality with exactly one stage pair. Direct task-wide approval of a composite task continues to fail. A single code-owned exception exists only inside Gate B for an ordinary Project Status/issue-state/canonical-status-label stage ending in -DELIVERY-TRANSITION: it must bind delivery-control/delivery-status-transition, module ID p0.delivery-transition, and the regular-blob reviewed tools/P0-delivery-transition.mjs candidate bytes. Neither P0-OA-001 nor P0-OA-002 is due for that closed delivery-status action. Actual workflow configuration or another non-delivery mutation is outside the exception and, if separately authorized at all, uses private-execution/project-workflow-mutation with current private authority and P0-OA-002. The stage ID is an ephemeral runtime binding and is rejected by the persisted readiness-state schema. This exception does not alter the ordinary task, milestone, or global compatibility maps.

Stage lifecycle

Machine state	Visible label	Authority consequence
declared	Declared — no authority	No preparation or execution
ready	Ready to prepare — Gate A, Ready to execute — Gate B, or Ready to accept — Gate B	Only the exact named gate action
running	Running	Lock held; exact source, authority, and deadline remain active
verification-pending	Action finished — verification pending	No success claim; no ordinary replay
recovery-required	Recovery required	Only reconcile, forward recovery, or reviewed rollback
rolling-back	Rolling back	Lock held until rollback verification settles
verified-complete	Verified stage complete	Terminal and non-replayable; task status is unchanged until a separate transition
verified-rolled-back	Verified stage rolled back	Terminal and non-replayable
cancelled-before-mutation	Cancelled before mutation	Terminal only with positive no-mutation proof
blocked-no-mutation	Blocked — no mutation	Terminal only with positive no-mutation proof
expired-before-mutation	Authority expired before mutation	Terminal only with positive no-mutation proof

A timeout or failure after possible mutation is never successful. The in-process lane accepts only the synchronously captured seven-field request whose callback is the exact code-owned function bound to the reviewed module ID/path/mode/hash, trusted-public-synthetic-no-native-io-v1 profile, and SHA-256 capability-review evidence; the Stage 0 callback allowlist is empty. After holding the durable global lock and durably recording running, it freshly rechecks the predecessor, exact-main Gate B, and every authority deadline, takes the actual start time, and only then invokes the callback. Expiry or authority movement becomes a durable no-mutation terminal without invocation; the primordial timer starts from that fresh time. The frozen context supplies all six identities, source/candidate revisions, capped deadline, and AbortSignal. Dynamic console/process stdout/stderr interception is a guardrail, not a sandbox: attempted ordinary writes are suppressed/digested/rejected and bindings restore in finally. Eligible code has static evidence of no saved writer, direct/native FD or stream, subprocess/worker, background-output path, or sensitive/private raw material; anything needing those capabilities is serializable-only. Deadline abort retains both locks until the callback Promise settles; non-settlement is fail-stuck. Any unexpected post-start failure must append durable recovery/terminal state or retain the stage lock; a readable failed-append tail permits release only after exact regular-file/non-symlink and inode checks, explicit tail-file fsync, full hash-chain/same-tail reread, and event-directory fsync. The serializable lane synchronously captures its exact six-field identity and never rereads caller state, and supports reviewed definition/Gate-B windows from one second through four hours while the callback stays capped at five minutes. It rechecks before spawning an inert launcher, arms settlement/cancellation immediately when that child exists and before any await, then—after child identity and durable child lock-record fsync—freshly rechecks the predecessor, exact-main Gate B, and all initial/fresh/current deadlines immediately before the first LAUNCH_SIGNAL byte. Expiry or movement terminates the waiting launcher with zero module calls and only then durably terminalizes no-mutation; replay does not spawn again. The serializable lane remains Stopping while the complete process tree settles. Either lane becomes recovery-required after possible mutation unless forward recovery or rollback is verified, and neither releases its lock while work may remain alive. After callback/child settlement and after each outcome-verifier pass, the runner freshly rechecks the deadline, exact main, and Gate B; it repeats that full check immediately before appending success. A later reconciliation never re-executes a terminal stage: it revalidates the receipt and current append-only stage history, permits only expected evolution of the start-time source revision, registry digest, and source fingerprint, and rejects any change to the immutable predecessor, preparation, candidate, dossier, stage-approval, definition, or module binding.

Any newly readable tail after a post-start append failure—including verification-pending—is not durable evidence by itself and cannot become a predecessor for recovery. The runner validates the exact tail as a regular non-symlink file, fsyncs that exact file, rereads and validates the full hash chain and identical tail, and only then fsyncs the event directory; any failure retains the stage lock without appending dependent recovery.

Public operator receipt

Every authorized terminal or recovery public-safe stage result is ordered and text-labelled. It contains only the task ID, stage ID, gate kind, scope/action, exact source SHA, dossier digest, predecessor receipt digest, idempotency key, authority deadline/status, stage state, mutation/no-mutation statement, opaque rollback snapshot reference, immediate verification, quiescent verification, terminal receipt digest and attempt, stable result code, consequence, and one next action. Pre-authorization denials remain smaller closed-schema results and carry no execution detail.

Raw stdout/stderr, private paths, targets, accounts, topology, identifiers, secrets, authentic content, and raw responses are prohibited from the public result. The in-process callback may return only its exact closed completion/evidence receipt; extra fields fail closed. Ordinary dynamic console/process stdout/stderr attempts are suppressed, represented only by non-empty digests, and force recovery-required, but this same-realm guardrail is not claimed to mediate saved bindings, direct/native FDs, direct streams, subprocesses, or background work; those capabilities make the callback ineligible. Serializable raw execution streams go directly to approved private custody where a later private stage explicitly authorizes that custody.

Delivery transition boundary

Status transition is a separate reviewed Gate B stage, never a side effect of readiness or sync. Gate A authorizes no external delivery mutation: this prohibition includes Backlog to Next. Every permitted edge requires a full immutable Gate B authorization whose task-bound stage ID ends in -DELIVERY-TRANSITION, whose scope/action is exactly delivery-control/delivery-status-transition, and whose module binding is exactly the code-owned p0.delivery-transition module. Neither P0-OA-001 nor P0-OA-002 is due for changing only Project Status, issue state, and the one canonical status:* label. Generic local-synthetic/synthetic-foundation authority cannot mutate those delivery surfaces. Actual workflow configuration or another non-delivery mutation is excluded; it remains separately gated as private-execution/project-workflow-mutation with current private authority and P0-OA-002. Backlog to Next and Next to In progress use the qualified execute decision, while In progress to Done uses the qualified accept decision. One invocation targets one substantive R0 task and one declared from/to edge. The historical three may be validated but cannot transition. A reviewed dry-run binds exactly the existing Project Status, issue Open/Closed state, replacement of exactly one canonical status label, the Gate B rollback snapshot reference, the recovery-plan digest, and the immutable frozen-50 snapshot digest while preserving every other byte/value.

Before any external call, the runner reconstructs the one canonical edge, exact three operations, exact inverse rollback, protected/forbidden surfaces, Gate B vocabulary, both projection snapshot digests, rollback snapshot reference, recovery-plan digest, and frozen-snapshot digest from the reviewed plan; a recomputed envelope digest cannot make a semantically altered plan valid. It then creates each saga/lock directory level durably by syncing the parent after every new entry, fsyncs every event file and its containing directory, and acquires a durable per-task lock with a unique invocation-owner nonce. Any concurrent invocation for that task is rejected, including one carrying the same plan digest, so neither same-plan nor cross-plan callers can race through saga handling. The lock remains pinned through uncertain or stale recovery and is released only after verified apply or verified rollback; stale-lock takeover is a separate reviewed recovery action and is disabled in Stage 0.

After the first mutation, ordinary retry/cancel is unavailable; only persisted-saga reconciliation or rollback is permitted. A future trusted adapter must prove exact 50-task live parity before the first external operation, after every forward or rollback operation, at the immediate and two quiescent success/rollback boundaries, throughout recovery, and on terminal replay. Success remains verification-pending until exact-main, that frozen-50 parity, the trusted stage authorization, and the exact target projection all pass immediately and at two one-second quiescent boundaries. A restart reads the hash-chained saga and rolls any partial three-operation state back to the exact preimage. Rollback is not terminal until that preimage and frozen parity pass one immediate and two timed-quiescent checks, and every later rolled-back replay repeats those checks before reporting the terminal state. Titles, bodies, milestones, non-status labels, non-status fields, items, field definitions, views, workflows, non-delivery records, and every R1-R10 record remain outside this mutation boundary. Stage 0 production apply remains disabled.

Frozen-scope invariant

Every generator, operational transition resolution, transition, rollback, CI run, workbook build, Wiki build, and terminal reconciliation must compare all 50 R1-R10 tasks with docs/project/P0-R1-R10-FREEZE-SNAPSHOT.json. The pure Stage 0 delivery-plan builder is mutation-free and has no live adapter: it binds the immutable snapshot digest but does not claim a live comparison. Any later operational resolver/apply must supply the trusted exact-50 adapter checks above; production apply is disabled until that closed adapter exists. Per-task artifacts, states, issues, Project values, approvals, evidence, permission, and authored/user-visible semantics must remain exact. Only the four explicitly named aggregate projections may carry independently explained deterministic provenance churn.