# Codex Handoff Dry-Run Receipt V01

Issue: [#378](https://github.com/pinklon/ai-capability-discipline/issues/378)

References:

- [#356 GitHub Issues queue-backed agent work engine MVP](https://github.com/pinklon/ai-capability-discipline/issues/356)
- [PR #357 GitHub Issues queue-backed agent work engine MVP](https://github.com/pinklon/ai-capability-discipline/pull/357)
- [#358 Add read-only queue planner and parallelism report v01](https://github.com/pinklon/ai-capability-discipline/issues/358)
- [PR #359 Add read-only queue planner and parallelism report v01](https://github.com/pinklon/ai-capability-discipline/pull/359)
- [#360 Add GitHub issue-body work payload template v01](https://github.com/pinklon/ai-capability-discipline/issues/360)
- [PR #361 Add GitHub issue-body work payload template v01](https://github.com/pinklon/ai-capability-discipline/pull/361)
- [#362 Add live read-only GitHub issue export to committed planner fixture v01](https://github.com/pinklon/ai-capability-discipline/issues/362)
- [PR #363 Add live read-only GitHub issue export to committed planner fixture v01](https://github.com/pinklon/ai-capability-discipline/pull/363)
- [#364 Add exported-issue planner integration report v01](https://github.com/pinklon/ai-capability-discipline/issues/364)
- [PR #365 Add exported-issue planner integration report v01](https://github.com/pinklon/ai-capability-discipline/pull/365)
- [#366 Add human-mediated orchestration lane operating packet v01](https://github.com/pinklon/ai-capability-discipline/issues/366)
- [PR #367 Add human-mediated orchestration lane operating packet v01](https://github.com/pinklon/ai-capability-discipline/pull/367)
- [#368 Add human-mediated orchestration dry-run receipt v01](https://github.com/pinklon/ai-capability-discipline/issues/368)
- [PR #369 Add human-mediated orchestration dry-run receipt v01](https://github.com/pinklon/ai-capability-discipline/pull/369)
- [#370 Add orchestration architecture index v01](https://github.com/pinklon/ai-capability-discipline/issues/370)
- [PR #371 Add orchestration architecture index v01](https://github.com/pinklon/ai-capability-discipline/pull/371)
- [#372 Add controlled worker design packet v01](https://github.com/pinklon/ai-capability-discipline/issues/372)
- [PR #373 Add controlled worker design packet v01](https://github.com/pinklon/ai-capability-discipline/pull/373)
- [#374 Add parallel Codex lane dry-run packet v01](https://github.com/pinklon/ai-capability-discipline/issues/374)
- [PR #375 Add parallel Codex lane dry-run packet v01](https://github.com/pinklon/ai-capability-discipline/pull/375)
- [#376 Add Codex lane handoff packet template v01](https://github.com/pinklon/ai-capability-discipline/issues/376)
- [PR #377 Add Codex lane handoff packet template v01](https://github.com/pinklon/ai-capability-discipline/pull/377)

## Purpose And Non-Executable Boundary

This dry-run receipt proves that the Codex lane handoff packet template can be applied correctly to serial-lane and safe-parallel-lane work without asking Tony to run local commands.

It is manual, deterministic, non-executable, and human-mediated.

This receipt is static repo evidence. It is not a handoff-generation runtime, CLI, service, bot, script, worker, scheduler, webhook receiver, polling loop, external queue adapter, GitHub mutator, source registry mutator, Cloudflare controller, provider caller, runtime retriever, browser retriever, package-authority updater, Linear integration, Jira integration, custom database, MCP server, or MCP client.

No autonomous execution is implemented.

## Dry-Run Inputs

The dry run uses committed, deterministic inputs only:

- The Codex lane handoff packet template v01.
- The parallel Codex lane dry-run packet v01.
- The human-mediated orchestration lane operating packet v01.
- The landed orchestration architecture stack.
- Synthetic serial-lane and safe-parallel-lane work examples.
- Synthetic stop examples for failed sync, dirty worktree, residue, missing issue, superseded issue, and missing remote baseline.

Validation does not require live GitHub access. The focused validator reads only this document, the committed fixture, committed wiring files, context-pack output, and the validation receipt.

## Dry-Run Outputs

The dry run produces static evidence that a generated handoff packet must include:

- Remote baseline.
- Local repo path.
- Work issue.
- Required branch.
- Required commit message.
- Codex-owned sync.
- Stop conditions.
- Validation expectations.
- Draft PR behavior.
- No-automerge boundary.
- Closeout receipt requirements.
- Hard-boundary confirmations.

The dry run does not create a branch, create an issue, create a PR, edit an issue, edit a PR, comment on GitHub, mark a PR ready, merge a PR, apply `codex-automerge`, change labels, or trigger implementation.

## Serial-Lane Handoff Example

A valid serial-lane generated handoff contains one work issue, one branch, one commit message, one expected remote baseline, and one validation contract.

Required serial-lane fields:

| Field | Required dry-run value |
| --- | --- |
| Lane | `serial` |
| Repo path | `/Users/tonymalott/Developer/ai-capability-discipline-repo` |
| Work issue URL | Present and expected open |
| Remote baseline | Exact expected `main` SHA after sync |
| Exact PR head merged | Present when prerequisite work landed |
| Required branch | Unique issue branch |
| Required commit message | Exact owner-specified message |
| Codex-owned sync | Required |
| Tony local commands | Prohibited |
| Draft PR only | Required |
| `codex-automerge` | Prohibited |
| Closeout fields | Required |

Serial work stays serial. The handoff does not parallelize it and does not let planner output launch work.

## Safe-Parallel-Lane Handoff Example

A valid safe-parallel-lane generated handoff contains a separate child-ticket or owner-approved work issue, unique branch, isolated file scope, current claim and lease evidence, and the same Codex-owned sync and validation contract as a serial handoff.

Required safe-parallel fields:

| Field | Required dry-run value |
| --- | --- |
| Lane | `safe-parallel` |
| Child-ticket separation | Present |
| Branch separation | Present |
| File separation | Present |
| Claim and lease evidence | Current |
| Duplicate issue and PR check | Required before launch |
| Branch and file collision check | Required before launch |
| Codex-owned sync | Required |
| Tony local commands | Prohibited |
| Draft PR only | Required |
| `codex-automerge` | Prohibited |

Safe-parallel eligibility is evidence, not autonomous permission. Tony plus Codex still launch each lane manually.

## Failed-Sync Stop Example

If `git pull --ff-only origin main` fails, Codex stops before implementation.

The generated handoff must treat failed fast-forward sync as a stop condition, report the failure, and avoid branch creation, file edits, validation, PR creation, and closeout claims that imply implementation happened.

## Dirty-Worktree Stop Example

If `git status --short` is not clean after sync, Codex stops before implementation.

The generated handoff must require a clean worktree after sync and must not ask Tony to clean the worktree manually when Codex can inspect and report the state.

## Residue-Scan Stop Example

If the residue scan finds repo-controlled `__pycache__`, `.pyc`, or `.wrangler` entries outside `.git`, `.venv`, and `node_modules`, Codex stops before implementation.

The generated handoff must require this scan:

```bash
find . \
  -path ./.git -prune -o \
  -path ./.venv -prune -o \
  -path ./node_modules -prune -o \
  \( -type d -name __pycache__ -o -type f -name '*.pyc' -o -type d -name .wrangler \) \
  -print
```

## Missing Issue Stop Example

If the work issue is missing, inaccessible, or cannot be verified, Codex stops before implementation.

The generated handoff must require issue URL, issue number, title, expected open state, label expectations, and superseded-state handling.

## Superseded Issue Stop Example

If the work issue is superseded, Codex stops before implementation.

The generated handoff must not infer permission from a stale or superseded issue. Owner decision happens outside this receipt.

## Missing Remote Baseline Stop Example

If the handoff does not include an expected remote baseline SHA, Codex stops before implementation.

Missing remote baseline SHA stops implementation.

If local HEAD cannot resolve the expected remote baseline after fetch, Codex stops before implementation.

## Tony-Does-Not-Run-Local-Commands Proof

Tony does not run local commands.

The generated handoff must instruct Codex to run local Git, GitHub, validation, sync, cleanup, and residue checks itself when Codex can run them.

The generated handoff is invalid if it asks Tony to run local commands, asks Tony to sync `main`, asks Tony to clean generated residue, asks Tony to run validation, or treats Tony as the local execution engine.

## Codex-Owned Local Sync Proof

Codex must run local sync and repo hygiene checks itself.

Every valid generated handoff must include:

```bash
cd <local_repo_path>
git checkout main
git fetch --prune origin
git pull --ff-only origin main
git branch --show-current
git rev-parse HEAD
git status --short
find . \
  -path ./.git -prune -o \
  -path ./.venv -prune -o \
  -path ./node_modules -prune -o \
  \( -type d -name __pycache__ -o -type f -name '*.pyc' -o -type d -name .wrangler \) \
  -print
```

Stale local `main` is repo hygiene, not an owner decision, unless fast-forward sync fails or the expected baseline cannot be resolved after fetch.

## Draft PR Only Proof

Each generated handoff must require a draft PR only.

Codex must not mark the PR ready, must not merge, and must not apply labels that imply automerge.

The PR body must include summary, changed files, validation, boundaries, and explicit no-autonomy confirmation.

## No-Automerge Proof

`codex-automerge` must not be applied unless Tony explicitly changes the boundary.

The generated handoff is invalid if it permits `codex-automerge`, applies `codex-automerge`, asks Codex to apply it, or omits the no-automerge closeout field.

## Closeout Receipt Completeness Proof

Each closeout must include:

- Issue URL.
- Draft PR URL.
- Branch name.
- Commit SHA.
- Final local branch.
- Final local HEAD.
- Worktree status.
- Residue scan result.
- Changed files.
- Validation commands and results.
- Sandboxed `run_all.py` result.
- Privileged local-server rerun result when required.
- PR draft state.
- PR label state.
- `codex-automerge` state.
- #269 and #271 state or no-reopen confirmation.
- Confirmation that no worker loop, webhook loop, scheduled loop, external queue, GitHub mutation behavior, source mutation, Cloudflare mutation, provider/runtime/browser/package-authority mutation, Linear/Jira/custom DB/MCP behavior, #269/#271 reopen, or `codex-automerge` was introduced.

## Relationship To Codex Lane Handoff Packet Template V01

The Codex lane handoff packet template v01 defines the required handoff fields, sync gates, validation expectations, draft PR behavior, no-automerge behavior, stop gates, and closeout fields.

This receipt proves that the template can be instantiated into valid serial-lane and safe-parallel-lane handoffs and that invalid handoffs are rejected when they ask Tony to run local commands, skip Codex-owned sync, treat stale local `main` as an owner decision before sync failure, allow `codex-automerge`, omit closeout fields, or allow autonomous behavior.

## Relationship To Parallel Codex Lane Dry-Run Packet V01

The parallel Codex lane dry-run packet v01 defines safe-parallel eligibility, child-ticket separation, branch separation, duplicate prevention, branch and file collision prevention, claim and lease evidence, validation per lane, merge sequencing, and closeout evidence.

This receipt applies those safe-parallel rules to generated handoff packets. It does not launch multiple Codex chats and does not create child issues or branches from planner output.

## Relationship To Human-Mediated Orchestration Lane Operating Packet V01

The human-mediated orchestration lane operating packet v01 defines manual lane interpretation for serial, safe-parallel, blocked, owner-decision, high-risk gated, rejected-before-planning, duplicate, collision, stale-claim, missing-claim, and conflicting-lease cases.

This receipt keeps that control plane intact. Tony plus Codex remain the human-mediated control plane, and generated handoffs remain launch collateral supplied by a human-mediated prompt.

## Relationship To Existing Orchestration Architecture Layers

| Existing layer | Relationship to this receipt |
| --- | --- |
| GitHub Issues queue-backed agent work engine MVP | Supplies work state, claim, lease, validation, and closeout vocabulary. |
| Read-only queue planner and parallelism report | Supplies serial and safe-parallel lane vocabulary. |
| GitHub issue-body work payload template | Supplies issue metadata expected by planner-readable work. |
| Read-only GitHub issue export fixture | Supplies committed fixture posture and invalid-payload handling. |
| Exported-issue planner integration report | Supplies advisory planner output that remains non-executing. |
| Human-mediated orchestration lane operating packet | Supplies manual lane interpretation and stop posture. |
| Human-mediated orchestration dry-run receipt | Supplies proof that lane interpretation stops safely. |
| Orchestration architecture index | Supplies the canonical map of landed orchestration layers. |
| Controlled worker design packet | Supplies the future worker boundary that remains unimplemented. |
| Parallel Codex lane dry-run packet | Supplies safe-parallel manual multi-Codex lane rules. |
| Codex lane handoff packet template | Supplies the packet fields this receipt tests. |

## What Is Proven

- Generated serial-lane handoffs require remote baseline, local repo path, work issue, branch, commit message, Codex-owned sync, validation expectations, draft PR only behavior, no-automerge behavior, and closeout fields.
- Generated safe-parallel-lane handoffs require those same fields plus child-ticket, branch, file, claim, lease, duplicate, and collision separation evidence.
- Failed sync, dirty worktree, residue, missing issue, superseded issue, and missing remote baseline examples stop before implementation.
- Tony does not run local commands.
- Codex-owned local sync is required.
- Stale local `main` is repo hygiene, not an owner decision, unless sync fails or the baseline cannot be resolved.
- Invalid handoffs are rejected when they permit autonomous behavior, GitHub mutation behavior, source mutation, Cloudflare mutation, provider/runtime/browser/package-authority mutation, Linear/Jira/custom DB/MCP behavior, or `codex-automerge`.

## What Is Not Proven

- Autonomous execution.
- Worker loop behavior.
- Polling behavior.
- Scheduled execution.
- Webhook-triggered execution.
- External queue integration.
- Live GitHub mutation.
- GitHub issue or PR mutation code.
- Handoff-generation runtime behavior.
- Source registry or source-set mutation.
- Cloudflare mutation.
- Provider/model/runtime/browser/package-authority mutation.
- Linear/Jira/custom DB/MCP behavior.
- #269 or #271 reopening.
- `codex-automerge`.

## Future Work That Remains Gated

Any future automation, worker identity, worker permissions, worker loop, queue adapter, webhook receiver, scheduler, GitHub write path, source mutation path, Cloudflare path, provider/runtime/browser/package-authority path, Linear/Jira/custom DB/MCP path, or handoff-generation runtime requires a separate issue, explicit owner approval, focused design, validation, receipts, and hard-boundary review.

## Forbidden Scope

This receipt does not implement and does not authorize:

- Autonomous worker.
- Worker loop.
- Polling.
- Scheduled execution.
- Webhook-triggered execution.
- External queue provider.
- Linear integration.
- Jira integration.
- Custom database behavior.
- MCP server behavior.
- MCP client behavior.
- Live GitHub issue or PR mutation behavior from receipt or validator logic.
- GitHub issue or PR mutation code in receipt or validator logic.
- Label, milestone, assignee, comment, issue state, PR state, branch state, or merge state mutation from receipt or validator logic.
- Handoff-generation runtime, CLI, service, bot, or script that changes repo behavior.
- Source registry mutation.
- Preview or Production source-set mutation.
- Cloudflare CLI or API use.
- Cloudflare Access or WAF change.
- Provider/model configuration change.
- Runtime retrieval semantics change.
- Browser-side provider calls.
- Browser-side current-source retrieval.
- Package-authority change.
- #269 reopening.
- #271 reopening.
- `codex-automerge`.

## Validation

Validation is deterministic and repo-local:

- `python3 -B validation/scripts/check_codex_handoff_dry_run_receipt.py`
- Related orchestration validators.
- Governance validators.
- `python3 -B validation/scripts/check_context_pack.py`
- `python3 -B validation/scripts/run_all.py`
- `git diff --check`
- Final residue scan for repo-controlled `__pycache__`, `.pyc`, and `.wrangler`, excluding `.git`, `.venv`, and `node_modules`.

If sandboxed `python3 -B validation/scripts/run_all.py` hits the known local static-server bind restriction in `check_published_site_contract.py`, Codex must rerun with the established local-server privilege path and document both results.