[Proxicon]

Problem

The beta.29 owner campaign reproduced successful job-definition update and parameter-add confirmations whose exact retry returned job_etag_mismatch. Mutable version validation ran before recorded-outcome reconciliation. Source review found the same ordering problem for successful run cancellation after termination and run deletion after tombstoning.

Changes

• Authenticate an existing confirmation with a nonconsuming replay lookup before mutable definition/run-state validation, including a second reconciliation lookup when validation races a completed confirmation.
• Preserve the original job ID, resulting version and added item ID for new definition receipts, and the original run ID/action-result state for new cancel/delete receipts.
• Resolve current ownership through dedicated read-only tombstone-aware queries. Retain current tenant, principal, client, resource, instance, target, policy, plan and expiry checks, plus cancellation gateway/capability admission.
• Return successful replays without another mutation, cancellation request or accepted-operation audit. Keep fresh invalid/stale plans unconsumed and document the authorized current-state fallback for legacy ID-only receipts.
• Set the shared product version to 0.1.1-beta.30 and update the canonical owner campaign and release notes.

Addresses #333 and #334. #334 is a source-review finding, separate from beta.29's one owner-observed defect. Release-delivery closure will be recorded after distribution verification. Owner acceptance remains tracked by #282, #294 and their existing child issues.

Validation

• Reproduced [beta.30][P2] Reconcile successful job-run cancel and delete confirmations after state transitions #334 before the fix: the existing 11 run tests passed and both new exact cancel/delete replays failed with job_run_action_invalid.
• Combined focused Debug regressions: 65 executed, 65 passed, zero failed or skipped across the existing job endpoint, run endpoint, job-store and confirmation-service groups; accepted by verify-mtp-trx.py.
• The new endpoint regressions verify original-result fidelity after later changes/deletion, no repeated persistence/audits/cancellation, fresh-invalid nonconsumption and current-admission denials.
• Independent source review found no concrete blocker.
• Product version verification passed for all 22 projects; documentation layout/local links, public disclosure, diff checks and Slopwatch passed.
• Hosted PR/main validation and the existing release/publication workflows provide compilation, PostgreSQL/component regressions and distribution integrity. No local Release build or container publication was performed.

Acceptance boundary

This repair adds no migration or release-specific workflow. Native fixture preparation, selected-consumer identity, the eight actual prompt workflows, fresh functional/secret-policy checks, the exact isolated 240-call hour and original cleanup remain owner-campaign work. Distribution verification must not claim these unexecuted checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-19T09:37:03.494013Z	e8a7191	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Proxicon]

Final beta.29 audit received before beta.30 publication

The owner supplied a later final audit after the checkpoint used by this PR. It expands the confirmed findings to five P2 replay defects. The existing #333 repair is still applicable and has now been reproduced across all eight definition update/parameter/step operations in both owner tenants. #334 remains an additional source-review finding.

Four additional final-audit repairs are being tracked and implemented: script deletion replay (script_not_found); policy replace/disable/revoke replay (operator_policy_version_conflict); artifact cleanup replay (artifact_already_cleaned); and deleted-job ownership resolution rejecting exact deletion replay at the local delegation boundary (local_delegation_binding_mismatch). The last finding requires real HTTP exchange coverage, beyond the direct endpoint tests in this PR.

The beta.30 delivery target must include the final-audit repair PR before tagging/publication. Do not interpret this merged first-checkpoint PR as completion of the final five-defect report. Existing published tags/assets remain immutable. Owner deployment and production acceptance remain in #294; all private source evidence stays private.

[Proxicon]

Release allocation update: beta.30 was tagged at the merged first-checkpoint source before the final-audit additions were integrated. Preserve that published tag and its distribution history. The next complete corrective target is beta.31: it retains this PR's job definition/run-action replay fixes and adds #336, #337, #338 and #339 from the final beta.29 audit. Current authority and owner acceptance remain open in #294/#305.