fix(development-system): enforce checkpoint transitions

Validate every successor against the predecessor’s sole next action in addition to standalone schema and lineage checks. This prevents structurally valid records from skipping required edits, reviews, gates, delivery, or CI-monitoring transitions.

Make passing-stage tests advance sequentially, add a skipped-gate regression, document the transition guarantee, and bump the plugin patch version.

Refs: 20260901-xige

Author: jwilger

.agents/plugins/marketplace.json

@@ -10,7 +10,7 @@
         "source": "local",
         "path": "./plugins/development-system"
       },
-      "version": "6.2.3",
+      "version": "6.2.4",
       "policy": {
         "installation": "AVAILABLE",
         "authentication": "ON_INSTALL"

README.md

@@ -22,7 +22,7 @@ user-managed MCPs that need compatibility review.
 
 | Plugin                                                     | Harness | Description                                                                                          | Version |
 | ---------------------------------------------------------- | ------- | ---------------------------------------------------------------------------------------------------- | ------- |
-| [development-system](plugins/development-system/README.md) | Codex   | Advisory repository setup and structured multi-agent review with reusable native services for Tiber. | 6.2.3   |
+| [development-system](plugins/development-system/README.md) | Codex   | Advisory repository setup and structured multi-agent review with reusable native services for Tiber. | 6.2.4   |
 
 ## Using the marketplace (Codex)
 

plugins/development-system/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "development-system",
-  "version": "6.2.3",
+  "version": "6.2.4",
   "description": "John's consolidated development workflow, engineering standards, worktree, task, review, and agentic-system tooling.",
   "author": {
     "name": "John Wilger",

plugins/development-system/scripts/write-local-checkpoint.sh

@@ -168,13 +168,68 @@ if [[ -e $target ]]; then
   [[ $expected_generation -eq $((current_generation + 1)) ]] || { echo "stale checkpoint generation" >&2; exit 3; }
   [[ $expected_predecessor == "$current_predecessor" ]] || { echo "stale checkpoint predecessor" >&2; exit 3; }
   [[ $proposed_baseline == "$current_baseline" ]] || { echo "checkpoint baseline does not match predecessor" >&2; exit 3; }
-  current_ci=$(sed -n 's/^checkpoint-v1 //p' "$target" | jq -c '.ci.runs')
-  proposed_ci=$(tail -c +15 "$candidate" | jq -c '.ci.runs')
+  current_record=$(sed -n 's/^checkpoint-v1 //p' "$target")
+  proposed_record=$(tail -c +15 "$candidate")
+  current_ci=$(jq -c '.ci.runs' <<<"$current_record")
+  proposed_ci=$(jq -c '.ci.runs' <<<"$proposed_record")
   jq -en --argjson current "$current_ci" --argjson proposed "$proposed_ci" \
     '$proposed[0:($current | length)] == $current' >/dev/null || {
       echo "checkpoint CI observations do not preserve predecessor history" >&2
       exit 3
     }
+  jq -en --argjson current "$current_record" --argjson proposed "$proposed_record" '
+    def passing($action):
+      $proposed.state == "passing-awaiting-gates-or-review" and
+      $proposed.next_action == $action;
+    def remediation_result:
+      $proposed.state == "failing" or
+      (passing("lightweight-review") and
+       $proposed.gates.lightweight_review_receipt == null and
+       $proposed.gates.fast_gate_receipt == null);
+    if ($current.next_action | test("^(causal-edit|rewrite-invalid-test): \\S")) then
+      remediation_result
+    elif $current.next_action == "lightweight-review" then
+      passing("fast-gate") and
+      $proposed.test == $current.test and
+      ($proposed.gates.lightweight_review_receipt | type == "string") and
+      $proposed.gates.fast_gate_receipt == null
+    elif $current.next_action == "fast-gate" then
+      passing("commit-or-record-local-snapshot") and
+      $proposed.test == $current.test and
+      $proposed.gates.lightweight_review_receipt == $current.gates.lightweight_review_receipt and
+      ($proposed.gates.fast_gate_receipt | type == "string")
+    elif $current.next_action == "commit-or-record-local-snapshot" then
+      $proposed.test == $current.test and
+      $proposed.gates.lightweight_review_receipt == $current.gates.lightweight_review_receipt and
+      $proposed.gates.fast_gate_receipt == $current.gates.fast_gate_receipt and
+      (($proposed.state == "committed" and $proposed.next_action == "verify-exact-commit") or
+       ($proposed.state == "pushed-or-delivery-mode-equivalent" and
+        $proposed.delivery.mode == "local-only" and $proposed.next_action == "terminal-review"))
+    elif $current.next_action == "verify-exact-commit" then
+      $proposed.state == "committed" and
+      ($proposed.next_action | IN("repair-exact-identity-verification", "push", "record-local-delivery"))
+    elif $current.next_action == "repair-exact-identity-verification" then
+      $proposed.state == "committed" and $proposed.next_action == "verify-exact-commit"
+    elif $current.next_action == "push" then
+      $proposed.state == "pushed-or-delivery-mode-equivalent" and
+      $proposed.next_action == "register-exact-sha-ci-monitor"
+    elif $current.next_action == "record-local-delivery" then
+      $proposed.state == "pushed-or-delivery-mode-equivalent" and
+      $proposed.delivery.mode == "local-only" and $proposed.next_action == "terminal-review"
+    elif ($current.next_action | IN("register-exact-sha-ci-monitor", "monitor-exact-sha-ci", "enter-ci-recovery")) then
+      $proposed.state == "pushed-or-delivery-mode-equivalent" and
+      ($proposed.next_action | IN("register-exact-sha-ci-monitor", "monitor-exact-sha-ci", "enter-ci-recovery", "terminal-review"))
+    elif $current.next_action == "terminal-review" then
+      remediation_result
+    else
+      ($proposed | del(.generation, .predecessor_sha256, .next_action)) ==
+      ($current | del(.generation, .predecessor_sha256, .next_action)) and
+      ($proposed.next_action | test("^(causal-edit|rewrite-invalid-test): \\S"))
+    end
+  ' >/dev/null || {
+    echo "successor does not perform predecessor next_action" >&2
+    exit 3
+  }
 else
   [[ $expected_generation -eq 0 && $expected_predecessor == null ]] || { echo "missing checkpoint predecessor" >&2; exit 3; }
 fi

plugins/development-system/skills/development-workflow/SKILL.md

@@ -67,8 +67,12 @@ same-directory candidate, then validates and publishes that exact candidate.
 It reads the current complete record and requires the candidate's
 `generation` to equal the current generation plus one and its
 `predecessor_sha256` to equal SHA-256 of the exact current `checkpoint-v1` line;
-the bootstrap record uses generation zero and a null predecessor. Reject a
-missing or stale predecessor without replacing the current record. The helper
+the bootstrap record uses generation zero and a null predecessor. It also
+requires the candidate to perform the predecessor's exact `next_action`, so a
+schema-valid record cannot skip or reorder an edit, test, review, gate,
+verification, delivery, CI-monitoring, recovery, or terminal-review transition.
+Reject a missing, stale, or action-incompatible predecessor without replacing
+the current record. The helper
 flushes the private candidate,
 recomputes the complete worktree identity and rejects publication if it changed
 since validation, atomically renames the stable record over the target, flushes

scripts/tests/development-discipline-plugin.bats

@@ -187,23 +187,35 @@ setup() {
   run bash -c 'cd "$1" && "$2" legacy-upgrade 2 "$3" "$4"' _ "$repo" "$writer" "$legacy_predecessor" "$stale"
   [ "$status" -eq 0 ]
 
+  run bash -c 'cd "$1" && "$2" passing-sequence 0 null "$3"' _ "$repo" "$writer" "$first"
+  [ "$status" -eq 0 ]
+  case_target="$repo/.git/development-system/checkpoints/passing-sequence.latest"
+  case_predecessor=$(sha256sum "$case_target" | cut -d ' ' -f 1)
+  passing_generation=1
   for passing_case in lightweight fast commit; do
-    case_id="passing-$passing_case"
-    run bash -c 'cd "$1" && "$2" "$3" 0 null "$4"' _ "$repo" "$writer" "$case_id" "$first"
-    [ "$status" -eq 0 ]
-    case_target="$repo/.git/development-system/checkpoints/$case_id.latest"
-    case_predecessor=$(sha256sum "$case_target" | cut -d ' ' -f 1)
     case "$passing_case" in
       lightweight) light=null; fast=null; action=lightweight-review ;;
       fast) light='"review"'; fast=null; action=fast-gate ;;
       commit) light='"review"'; fast='"gate"'; action=commit-or-record-local-snapshot ;;
     esac
-    passing_json=$(jq -cn --arg predecessor "$case_predecessor" --arg head "$head_oid" --arg empty "$empty_sha" --arg action "$action" --argjson light "$light" --argjson fast "$fast" '{generation:1,predecessor_sha256:$predecessor,baseline_oid:$head,snapshot:{head_oid:$head,tracked_sha256:$empty,untracked_sha256:$empty},state:"passing-awaiting-gates-or-review",test:{command:"test",receipt_ref:"receipt",outcome:"pass",failure_kind:null},gates:{lightweight_review_receipt:$light,fast_gate_receipt:$fast,exact_identity_verification_receipt:null},delivery:null,ci:{runs:[],terminal_success_run_id:null},next_action:$action}')
+    passing_json=$(jq -cn --argjson generation "$passing_generation" --arg predecessor "$case_predecessor" --arg head "$head_oid" --arg empty "$empty_sha" --arg action "$action" --argjson light "$light" --argjson fast "$fast" '{generation:$generation,predecessor_sha256:$predecessor,baseline_oid:$head,snapshot:{head_oid:$head,tracked_sha256:$empty,untracked_sha256:$empty},state:"passing-awaiting-gates-or-review",test:{command:"test",receipt_ref:"receipt",outcome:"pass",failure_kind:null},gates:{lightweight_review_receipt:$light,fast_gate_receipt:$fast,exact_identity_verification_receipt:null},delivery:null,ci:{runs:[],terminal_success_run_id:null},next_action:$action}')
     printf 'checkpoint-v1 %s\n' "$passing_json" >"$stale"
-    run bash -c 'cd "$1" && "$2" "$3" 1 "$4" "$5"' _ "$repo" "$writer" "$case_id" "$case_predecessor" "$stale"
+    run bash -c 'cd "$1" && "$2" passing-sequence "$3" "$4" "$5"' _ "$repo" "$writer" "$passing_generation" "$case_predecessor" "$stale"
     [ "$status" -eq 0 ]
+    case_predecessor=$(sha256sum "$case_target" | cut -d ' ' -f 1)
+    passing_generation=$((passing_generation + 1))
   done
 
+  run bash -c 'cd "$1" && "$2" skipped-gates 0 null "$3"' _ "$repo" "$writer" "$first"
+  [ "$status" -eq 0 ]
+  skipped_target="$repo/.git/development-system/checkpoints/skipped-gates.latest"
+  skipped_predecessor=$(sha256sum "$skipped_target" | cut -d ' ' -f 1)
+  skipped_json=$(printf '%s' "$passing_json" | jq -c --arg predecessor "$skipped_predecessor" '.generation = 1 | .predecessor_sha256 = $predecessor')
+  printf 'checkpoint-v1 %s\n' "$skipped_json" >"$stale"
+  run bash -c 'cd "$1" && "$2" skipped-gates 1 "$3" "$4"' _ "$repo" "$writer" "$skipped_predecessor" "$stale"
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"successor does not perform predecessor next_action"* ]]
+
   invalid_passing_json=$(jq -cn --arg predecessor "$predecessor" --arg head "$head_oid" --arg empty "$empty_sha" '{generation:1,predecessor_sha256:$predecessor,baseline_oid:$head,snapshot:{head_oid:$head,tracked_sha256:$empty,untracked_sha256:$empty},state:"passing-awaiting-gates-or-review",test:{command:"test",receipt_ref:"receipt",outcome:"pass",failure_kind:null},gates:{lightweight_review_receipt:null,fast_gate_receipt:"gate",exact_identity_verification_receipt:null},delivery:null,ci:{runs:[],terminal_success_run_id:null},next_action:"lightweight-review"}')
   printf 'checkpoint-v1 %s\n' "$invalid_passing_json" >"$stale"
   run bash -c 'cd "$1" && "$2" work-item 1 "$3" "$4"' _ "$repo" "$writer" "$predecessor" "$stale"
@@ -246,6 +258,8 @@ setup() {
   run bash -c 'cd "$1" && "$2" remote-ci 0 null "$3"' _ "$repo" "$writer" "$stale"
   [ "$status" -eq 0 ]
   remote_target="$repo/.git/development-system/checkpoints/remote-ci.latest"
+  remote_ready_json=$(jq -cn --arg head "$head_oid" --arg empty "$empty_sha" '{generation:0,predecessor_sha256:null,baseline_oid:$head,snapshot:{head_oid:$head,tracked_sha256:$empty,untracked_sha256:$empty},state:"pushed-or-delivery-mode-equivalent",test:{command:"test",receipt_ref:"receipt",outcome:"pass",failure_kind:null},gates:{lightweight_review_receipt:"review",fast_gate_receipt:"gate",exact_identity_verification_receipt:{receipt_ref:"verification",outcome:"pass"}},delivery:{mode:"direct-to-trunk",commit_oid:$head,pushed_oid:$head,local_snapshot:null},ci:{runs:[],terminal_success_run_id:null},next_action:"register-exact-sha-ci-monitor"}')
+  printf 'checkpoint-v1 %s\n' "$remote_ready_json" >"$remote_target"
   remote_predecessor=$(sha256sum "$remote_target" | cut -d ' ' -f 1)
   remote_failure_json=$(jq -cn --arg predecessor "$remote_predecessor" --arg head "$head_oid" --arg empty "$empty_sha" '{generation:1,predecessor_sha256:$predecessor,baseline_oid:$head,snapshot:{head_oid:$head,tracked_sha256:$empty,untracked_sha256:$empty},state:"pushed-or-delivery-mode-equivalent",test:{command:"test",receipt_ref:"receipt",outcome:"pass",failure_kind:null},gates:{lightweight_review_receipt:"review",fast_gate_receipt:"gate",exact_identity_verification_receipt:{receipt_ref:"verification",outcome:"pass"}},delivery:{mode:"direct-to-trunk",commit_oid:$head,pushed_oid:$head,local_snapshot:null},ci:{runs:[{provider:"ci",run_id:"failed",commit_oid:$head,status:"failure"}],terminal_success_run_id:null},next_action:"edit"}')
   printf 'checkpoint-v1 %s\n' "$remote_failure_json" >"$stale"
@@ -274,6 +288,7 @@ setup() {
   run bash -c 'cd "$1" && "$2" cross-commit-ci 0 null "$3"' _ "$repo" "$writer" "$stale"
   [ "$status" -eq 0 ]
   cross_commit_target="$repo/.git/development-system/checkpoints/cross-commit-ci.latest"
+  printf 'checkpoint-v1 %s\n' "$remote_ready_json" >"$cross_commit_target"
   cross_commit_predecessor=$(sha256sum "$cross_commit_target" | cut -d ' ' -f 1)
   retained_older_ci_json=$(jq -cn --arg predecessor "$cross_commit_predecessor" --arg head "$head_oid" --arg empty "$empty_sha" '{generation:1,predecessor_sha256:$predecessor,baseline_oid:$head,snapshot:{head_oid:$head,tracked_sha256:$empty,untracked_sha256:$empty},state:"pushed-or-delivery-mode-equivalent",test:{command:"test",receipt_ref:"receipt",outcome:"pass",failure_kind:null},gates:{lightweight_review_receipt:"review",fast_gate_receipt:"gate",exact_identity_verification_receipt:{receipt_ref:"verification",outcome:"pass"}},delivery:{mode:"direct-to-trunk",commit_oid:$head,pushed_oid:$head,local_snapshot:null},ci:{runs:[{provider:"ci",run_id:"older-success",commit_oid:"1111111111111111111111111111111111111111",status:"success"}],terminal_success_run_id:null},next_action:"register-exact-sha-ci-monitor"}')
   printf 'checkpoint-v1 %s\n' "$retained_older_ci_json" >"$stale"