task(codex): authorize V2R1 G1 recovery candidate r2

.agent/tasks/codex/TASK-CODEX-V2R1-G1-FINAL-VERIFY-RETRY-20260715T010807UTC8.md

@@ -0,0 +1,79 @@
+---
+task_id: TASK-CODEX-V2R1-G1-FINAL-VERIFY-RETRY-20260715T010807UTC8
+owner: CODEX
+source_commit: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
+rejected_commits:
+  - 7a2f16ee72e944737a9f6995e511ef176413ae6b
+  - b1d3439ee9e66b5eed1c94595a22bc630d893b6e
+  - 38320044b54c172c28877a81f291478267dd7b9e
+  - 7fd63b55f27b23658ea26e2a39d949c7b1e91dda
+  - 71239b4d187e683e05fd22fc9d5df8ae324e3390
+candidate:
+  branch: work/codex/v2r1-g1-recovery-candidate-20260715T010807UTC8
+  exact_parent: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
+  sole_added_file: .agent/results/openclaw/RESULT-V2R1-G1-OPENCLAW-RECOVERY-CANDIDATE-20260715T010807UTC8.md
+  gates:
+    tests: "29+3"
+    conflict_count: 0
+    tracked_sqlite_count: 0
+    exact_four_webops_ignores: true
+    gitleaks_version: 8.30.1
+    gitleaks_git_findings: 0
+    gitleaks_dir_findings: 0
+    hmac: "39+39"
+    placeholder_count: 0
+  mandatory_result_fields:
+    - status
+    - commit
+    - tests
+    - cleanup_scan
+    - risk
+    - recommendation
+final_verification:
+  branch: review/codex/v2r1-g1-final-verify-retry-20260715T010807UTC8
+  sole_added_file: .agent/results/codex/RESULT-V2R1-G1-CODEX-FINAL-VERIFY-RETRY-20260713.md
+  required_fields:
+    - status
+    - source_commit
+    - candidate_commit
+    - qualifying_candidates
+    - placeholder_count
+    - mandatory_fields
+    - tests
+    - gitleaks
+    - hmac
+    - cleanup_scan
+    - rollback
+    - deployment
+    - workspace_clean
+    - risk
+    - recommendation
+prohibitions:
+  - force push
+  - code modification
+  - test modification
+  - configuration modification
+  - deployment modification
+  - merge
+  - tag
+  - baseline modification
+  - staging modification
+  - production modification
+failure_policy: fail_closed
+---
+
+# CODEX V2R1 G1 final verification retry
+
+Select and verify only a qualifying recovery candidate rooted at the fixed source commit. Reject every commit listed in `rejected_commits`. The candidate commit must have the exact parent and sole added file declared above and must pass every candidate gate. The final verification branch must add only its declared result file and must contain every required field.
+
+Do not modify code, tests, configuration, deployment state, baselines, staging, or production. Do not merge, tag, or force-push. On any mismatch, ambiguity, missing field, nonzero finding, dirty workspace, or failed gate, stop and report failure without advancing.
+
+## Execution amendment: recovery candidate r2
+
+- rejected_candidate: 78c22cbfb95cb252b671c5ffe3b34bf4944aee2d
+- rejection_reason: placeholder_count=1; exact angle-placeholder hit from the documented conflict regex
+- replacement_branch: work/codex/v2r1-g1-recovery-candidate-20260715T010807UTC8-r2
+- replacement_parent: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
+- sole_added_file: .agent/results/openclaw/RESULT-V2R1-G1-OPENCLAW-RECOVERY-CANDIDATE-20260715T010807UTC8.md
+- history_policy: no force push and no history rewrite
+- original_candidate_policy: retained and rejected