Release 2.11: phase packets and validation ladder

.agents/plugins/marketplace.json

@@ -9,7 +9,7 @@
       "source": {
         "source": "url",
         "url": "https://github.com/avksp/agent-lifecycle-kit.git",
-        "ref": "v2.10.0"
+        "ref": "v2.11.0"
       },
       "policy": {
         "installation": "AVAILABLE",

.claude-plugin/marketplace.json

@@ -9,10 +9,10 @@
       "source": {
         "source": "github",
         "repo": "avksp/agent-lifecycle-kit",
-        "ref": "v2.10.0"
+        "ref": "v2.11.0"
       },
       "description": "Reviewed SDD planning, budgeted execution, adapter conformance, implementation audit, and final proof.",
-      "version": "2.10.0",
+      "version": "2.11.0",
       "author": {
         "name": "Agent Lifecycle Kit contributors"
       },

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-lifecycle-kit",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "Provider-neutral lifecycle kit for reviewed SDD planning, budgeted execution, adapter conformance, independent audits, and final proof.",
   "author": {
     "name": "Agent Lifecycle Kit contributors"

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-lifecycle-kit",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "Provider-neutral lifecycle kit for reviewed SDD planning, budgeted execution, adapter conformance, independent audits, and final proof.",
   "author": {
     "name": "Agent Lifecycle Kit contributors",

.cursor-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "Provider-neutral lifecycle kit for reviewed SDD planning, budgeted execution, adapter conformance, independent audits, and final proof.",
-    "version": "2.10.0"
+    "version": "2.11.0"
   },
   "plugins": [
     {
       "name": "agent-lifecycle-kit",
       "source": ".",
       "description": "Reviewed SDD planning, budgeted execution, adapter conformance, implementation audit, and final proof.",
-      "version": "2.10.0",
+      "version": "2.11.0",
       "author": {
         "name": "Agent Lifecycle Kit contributors"
       },

.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-lifecycle-kit",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "Provider-neutral lifecycle kit for reviewed SDD planning, budgeted execution, adapter conformance, independent audits, and final proof.",
   "author": {
     "name": "Agent Lifecycle Kit contributors"

CHANGELOG.md

@@ -4,6 +4,18 @@
 
 - No changes yet.
 
+## 2.11.0 - 2026-08-31
+
+- Added bounded `agent-phase-packet.v1` projections for planning handoff,
+  implementation, independent task audit and remediation without creating new
+  workflow authority.
+- Added read-only `workflow validation-select` with digest-bound check
+  catalogs, command-free path profiles, a protected `RELEASE_FULL` floor and
+  exact full-validation receipt enforcement for opted-in finalization.
+- Preserved existing handoff, task snapshot and legacy finalization behavior;
+  added a separate comparable economics pair and release accounting for
+  version `2.11.0` without inventing unavailable token telemetry.
+
 ## 2.10.0 - 2026-08-31
 
 - Added bounded multi-transition `workflow continue --input-bundle` execution

README.md

@@ -21,7 +21,7 @@ ALK provides a verifiable finish for external-agent work with proportionate cont
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.10.0`, and common `agent-lifecycle version` errors.
+It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.11.0`, and common `agent-lifecycle version` errors.
 
 For a quick start, run:
 
@@ -47,7 +47,7 @@ agent-lifecycle start --adapter <adapter-id> --file task.md
 - The [system architecture](docs/architecture/system-architecture.md) page explains how the project is organized, and [project comparison](docs/reference/project-comparison.md) shows how it differs from similar tools.
 - Multiple-agent boundaries, workflow configuration, model choice, prompts, timeouts and retries are described in [workflow customization and execution controls](docs/reference/workflow-customization.md).
 - Create a local project profile with `agent-lifecycle project profile init`; see [project workflow profile](docs/reference/project-workflow-profile.md). Explain the selected profile, plan constraints and adapter capability lineage with [effective configuration](docs/reference/effective-configuration.md), [structured result qualification](docs/reference/structured-result-qualification.md) and [adapter action evidence](docs/reference/adapter-action-evidence.md). Add optional project-owned architecture and dependency evidence with [external verification checks](docs/reference/external-verification-checks.md), run longer specialized adapter work through [bounded external tool jobs](docs/reference/external-tool-jobs.md), track bounded terminology with [project domain language](docs/reference/project-domain-language.md), coordinate several runs with the read-only [multi-run attention view](docs/reference/multi-run-attention-view.md), or use the optional [security analysis profile](docs/reference/security-analysis-profile.md) for untrusted findings and independently verified remediation.
-- For long sessions, use [context checkpoints and compaction recovery](docs/reference/context-checkpoints.md). They preserve a bounded local continuation package without changing plan authority. Measure phases and releases with [release accounting](docs/reference/release-accounting.md), and cross session boundaries with the bounded [phase-to-session handoff](docs/guides/phase-session-handoff.md).
+- For long sessions, use [context checkpoints and compaction recovery](docs/reference/context-checkpoints.md). They preserve a bounded local continuation package without changing plan authority. Measure phases and releases with [release accounting](docs/reference/release-accounting.md), follow the bounded [phase-to-session handoff](docs/guides/phase-session-handoff.md) with [phase packets](docs/reference/phase-packets.md), and choose focused checks through the read-only [validation ladder](docs/reference/validation-ladder.md).
 ## What it gives you
 - A finish-oriented lifecycle: plan, execute, review, and prove the result.
 - One process for different CLIs: adapter-specific commands stay outside the

adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-lifecycle-kit",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "Lifecycle skills and adapter metadata for reviewed planning, budgeted execution, adapter conformance, audit, and final proof.",
   "author": {
     "name": "Agent Lifecycle Kit contributors"

adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-lifecycle-kit",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "Provider-neutral lifecycle kit and adapter metadata for reviewed planning, budgeted execution, adapter conformance, audit, and final proof.",
   "author": {
     "name": "Agent Lifecycle Kit contributors"

adapters/cursor/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-lifecycle-kit",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "Agent lifecycle planning, budgeted execution, adapter conformance, audit, and final proof for Cursor.",
   "author": {
     "name": "Agent Lifecycle Kit contributors"

docs/README.md

@@ -19,7 +19,7 @@ that result. It is host-neutral and does not depend on a source project.
 - [Commands by task](guides/commands-by-task.md)
 - [Runner migration for 2.x](guides/runner-migration-2.md)
 - Official PyPI package for Python 3.11-3.14:
-  `python -m pip install agent-lifecycle-kit==2.10.0` from
+  `python -m pip install agent-lifecycle-kit==2.11.0` from
   [agent-lifecycle-kit](https://pypi.org/project/agent-lifecycle-kit/).
 - One safe entrypoint: `agent-lifecycle start --adapter <adapter-id> --file task.md`.
 - [Quickstart](guides/quickstart.md)
@@ -37,6 +37,8 @@ that result. It is host-neutral and does not depend on a source project.
 - [Context checkpoints and compaction recovery](reference/context-checkpoints.md)
 - [Release accounting](reference/release-accounting.md)
 - [Phase-to-session handoff](guides/phase-session-handoff.md)
+- [Phase packets](reference/phase-packets.md)
+- [Validation ladder](reference/validation-ladder.md)
 - [Structured result qualification](reference/structured-result-qualification.md)
 - [Optional adapter lifecycle control](adapters/lifecycle-control.md)
 - [How ALK works for different tasks](guides/how-alk-works.md)

docs/guides/install-and-first-run.md

@@ -77,7 +77,7 @@ Use an isolated environment for a package installation as well.
 python3 -m venv ~/.venvs/alk
 source ~/.venvs/alk/bin/activate
 python -m pip install --upgrade pip
-python -m pip install agent-lifecycle-kit==2.10.0
+python -m pip install agent-lifecycle-kit==2.11.0
 python -m agent_lifecycle version
 agent-lifecycle version
 ```
@@ -88,7 +88,7 @@ agent-lifecycle version
 py -m venv "$HOME\venvs\alk"
 & "$HOME\venvs\alk\Scripts\Activate.ps1"
 python -m pip install --upgrade pip
-python -m pip install agent-lifecycle-kit==2.10.0
+python -m pip install agent-lifecycle-kit==2.11.0
 python -m agent_lifecycle version
 agent-lifecycle version
 ```
@@ -188,7 +188,7 @@ Choose one host and follow its adapter page. The common sequence is:
 Codex:
 
 ```bash
-codex plugin marketplace add avksp/agent-lifecycle-kit --ref v2.10.0
+codex plugin marketplace add avksp/agent-lifecycle-kit --ref v2.11.0
 codex plugin add agent-lifecycle-kit@agent-lifecycle-kit
 codex plugin list
 ```
@@ -227,6 +227,10 @@ no provider client or second lifecycle authority.
 Release 2.6 adds [release accounting](../reference/release-accounting.md) and a
 bounded [phase-to-session handoff](phase-session-handoff.md). Missing telemetry
 stays unavailable, and handoff artifacts do not replace workflow authority.
+Release 2.11 adds [bounded phase packets](../reference/phase-packets.md) and a
+read-only [validation ladder](../reference/validation-ladder.md). Focused
+selection improves feedback latency, while protected and release paths retain
+the complete validation floor.
 Before execution, create a reviewed final lock with
 `agent-lifecycle plan lock-create --manifest <path> --review <path>`; it fails
 rather than replacing an existing `plan.lock.json`. See the [CLI

docs/guides/phase-session-handoff.md

@@ -18,6 +18,8 @@ agent-lifecycle plan snapshot \
 agent-lifecycle plan handoff \
   --manifest work/plans/release/plan.manifest.json \
   --snapshot work/release/plan-snapshot.json \
+  --lock work/plans/release/plan.lock.json \
+  --phase-packet-out work/release/planning-phase-packet.json \
   --max-workstreams 12 \
   --target-tokens 4096 \
   --out work/release/plan-handoff.json
@@ -68,13 +70,32 @@ transition, such as `workflow task-start`, with expected state and source
 revision. The worker reads its task packet, writes only owned paths, captures a
 fresh `workflow task-snapshot`, and submits `workflow task-result`.
 
+A new session can receive a separate bounded implementation packet without
+changing the ordinary task-change-set output:
+
+```bash
+agent-lifecycle workflow task-snapshot \
+  --state work/release/run.state.json \
+  --task WS-01 \
+  --manifest work/plans/release/plan.manifest.json \
+  --lock work/plans/release/plan.lock.json \
+  --phase-packet-purpose IMPLEMENTATION \
+  --phase-packet-out work/release/WS-01/implementation-phase-packet.json \
+  --out work/release/WS-01/task-change-set.json
+```
+
 ## Independent audit session
 
 Give the reviewer the frozen manifest and lock, task packet, fresh change set,
 task result and criterion-specific evidence. Do not give the reviewer the
 worker's hidden reasoning or ask it to infer acceptance from a summary. The
 reviewer returns a review with its own identity and run id.
 
+After `task-result`, repeat `workflow task-snapshot` with
+`--phase-packet-purpose TASK_AUDIT`. ALK projects the immutable change set
+bound to the committed result. For a started retry use `REMEDIATION`; the
+packet includes prior receipt digests, open finding IDs and remaining attempts.
+
 `workflow task-review-apply`, `workflow task-accept` and `workflow task-rework`
 are authority-bearing transitions. An operator invokes them only with a valid,
 independent review bound to the current task attempt and source revision.

docs/reference/cli.md

@@ -28,7 +28,7 @@ Python 3.11-3.14 is supported. Install the exact release from the official
 [PyPI project](https://pypi.org/project/agent-lifecycle-kit/):
 
 ```bash
-  python -m pip install agent-lifecycle-kit==2.10.0
+  python -m pip install agent-lifecycle-kit==2.11.0
 ```
 
 ## Task evidence identity
@@ -328,7 +328,14 @@ language](project-domain-language.md).
 - `agent-lifecycle workflow task-start`: open a bounded task attempt.
 - `agent-lifecycle workflow task-snapshot`: compute the current task-scoped
   Git file set and content digests without changing workflow state. Put the
-  returned `claim` object in the task result before `task-result`.
+  returned `claim` object in the task result before `task-result`. Add the
+  all-or-none `--manifest`, `--lock`, `--phase-packet-purpose` and
+  `--phase-packet-out` options to emit a separate bounded
+  `agent-phase-packet.v1` for implementation, task audit or remediation.
+- `agent-lifecycle workflow validation-select --state ... --task ...
+  --manifest ... --lock ... --snapshot ... [--out ...]`: select frozen check
+  IDs without executing commands or mutating state. Legacy and protected-path
+  cases conservatively select `RELEASE_FULL`.
 - `agent-lifecycle workflow task-result`: submit implementation evidence.
 - `agent-lifecycle workflow task-rework`: after an independent review or
   implementation audit returns `REWORK`, archive the current attempt and move
@@ -353,7 +360,9 @@ language](project-domain-language.md).
   completion gate binding is required. Add
   `--final-implementation-audit <final-implementation-audit.json>` when final
   implementation audit is mandatory, and `--review-mesh-quorum <path>` when an
-  opted-in plan requires final-audit quorum.
+  opted-in plan requires final-audit quorum. An opted-in validation-ladder plan
+  also requires `--release-full-receipt <release-full.json>` with exact current
+  plan, lock, source, tree and catalog lineage.
 - `workflow run`, `workflow task-result`, `workflow task-accept`,
   `workflow task-review-apply`, `workflow final-audit-outcome` and
   `workflow finalize` are the only workflow commands with managed progress

docs/reference/phase-packets.md

@@ -0,0 +1,65 @@
+# Phase packets
+
+Phase packets are bounded, purpose-specific projections for moving exact facts
+between model sessions. They reduce repeated context loading without creating a
+second workflow state or a second authority path.
+
+The envelope schema is `agent-phase-packet.v1`. Its purpose is one of:
+
+- `PLANNING_HANDOFF` for selected workstreams and dependency edges;
+- `IMPLEMENTATION` for one task attempt, scope, criteria and evidence;
+- `TASK_AUDIT` for the committed result, immutable change set and review facts;
+- `REMEDIATION` for the prior result/review, open findings and retry budget.
+
+Every packet is bound to the current plan, lock, source revision and relevant
+state revision. It also binds write scope, acceptance, evidence and active
+blockers with canonical digests. The rendered envelope is limited to 64 KiB.
+Required facts are never dropped to satisfy that limit.
+
+## Create packets
+
+Planning handoff keeps its existing output and writes the optional packet to a
+separate path:
+
+```bash
+agent-lifecycle plan handoff \
+  --manifest <plan.manifest.json> \
+  --snapshot <plan-snapshot.json> \
+  --lock <plan.lock.json> \
+  --phase-packet-out <planning-phase-packet.json> \
+  --out <plan-handoff.json>
+```
+
+Task packets are additional outputs of the read-only task snapshot route:
+
+```bash
+agent-lifecycle workflow task-snapshot \
+  --state <run.state.json> \
+  --task <task-id> \
+  --manifest <plan.manifest.json> \
+  --lock <plan.lock.json> \
+  --phase-packet-purpose IMPLEMENTATION \
+  --phase-packet-out <implementation-phase-packet.json> \
+  --out <task-change-set.json>
+```
+
+The four packet-specific task-snapshot options are all-or-none. Use
+`TASK_AUDIT` after a result is committed and `REMEDIATION` for a started retry.
+The ordinary handoff and task-change-set JSON remain unchanged when packet
+options are omitted.
+
+## Safety boundary
+
+Payloads are closed and recursively reject transcripts, prompts, credentials,
+cookies, secrets and authority-like fields. String values pass through the
+existing path and secret redaction controls. Failures use stable codes:
+
+- `phase-packet-required-fact-missing`;
+- `phase-packet-forbidden-content`;
+- `phase-packet-context-limit-exceeded`.
+
+Every envelope has `implementationAuthorized: false`, `proofAuthority: none`
+and `productionPromotionClaimed: false`. A packet cannot start work, accept a
+task, freeze a plan, satisfy a review or promote a release. The current lock,
+workflow state and normal authority-bearing transitions remain authoritative.
+

docs/reference/public-contracts.md

@@ -41,6 +41,15 @@ Stable schema ids:
 - `agent-goal-record.v1`
 - `agent-objective-snapshot.v1`
 - `agent-workflow-state.v4`
+- `agent-phase-packet.v1`
+- `agent-phase-planning-handoff-payload.v1`
+- `agent-phase-implementation-payload.v1`
+- `agent-phase-task-audit-payload.v1`
+- `agent-phase-remediation-payload.v1`
+- `agent-validation-check-catalog.v1`
+- `agent-validation-ladder-profile.v1`
+- `agent-validation-selection.v1`
+- `agent-release-full-validation-receipt.v1`
 - `agent-workflow-continuation-action.v1`
 - `agent-workflow-continuation-receipt.v1`
 - `agent-workflow-continuation-input-bundle.v1`
@@ -168,6 +177,14 @@ Plan completeness validation checks the selected SDD tier before audit, so
 small plans can stay compact while risky S2 work still has requirements,
 acceptance, evidence routes, ownership, budgets, context limits and final gates.
 
+Phase packets are bounded projections for planning handoff, implementation,
+task audit and remediation. They keep exact digest lineage and explicitly carry
+no implementation, proof or promotion authority. The validation ladder is an
+optional frozen mapping from changed paths to exact catalog check IDs. Its
+selector is read-only and command-free; legacy, unmatched and protected-path
+cases select `RELEASE_FULL`, and opted-in finalization requires a fresh full
+validation receipt.
+
 Planning launch profiles are exact-version, local and fail closed. Profile
 generation or a version probe does not establish
 `PLANNING_ONLY_QUALIFIED`; that claim requires accepted live evidence for the