okstra 0.127.0 → 0.128.0

package/docs/architecture/storage-model.md

@@ -21,6 +21,7 @@ The task manifest, task index, instruction set, runs, and history are collected
 │   ├── analysis-material.md
 │   ├── reference-expectations.md
 │   ├── task-brief.md
+│   ├── verification-target.md         # final-verification only; canonical target snapshot
 │   ├── directive.txt                  # optional (mirrors --directive)
 │   ├── final-report-schema.json
 │   ├── final-report-template.md
@@ -106,6 +107,8 @@ The resolved run directory collects execution history. It divides its contents i
 Worker prompt history is retained not under `/tmp`, but always as a canonical artifact under `prompts/` for the current run.
 Unlike before, `analysis-profile.md`, `analysis-material.md`, `reference-expectations.md`, `task-brief.md`, skill copies, and `final-report-template.md` are not duplicated for every run.
 These materials retain canonical copies in `instruction-set/` under the stable task root.
+For `final-verification`, `verification-target.md` is also stable-task instruction-set state. Prepare owns the snapshot and stores its project-relative path plus SHA-256 digest in task/run manifests and active-run context. Initial analysis prompts carry the compact worktree/scope/base/head/path/digest identity and read this sidecar on demand instead of copying its diff stat.
+Each wrapper `<prompt>.log` beside a persisted `<prompt>.md` is a growing execution transcript, not another prompt snapshot. `okstra log-report` pairs the siblings and reports prompt/transcript bytes separately while keeping the legacy log-oriented `sizeBytes` and `totalBytes` fields.
 When the same non-stage task type runs again, it reuses the same `runs/<task-type>/` run directory. Reruns of `implementation` and single-stage `final-verification` reuse their resolved `runs/<task-type>/stage-<N>/` run directories. In both cases, existing artifacts are not overwritten because run-level filenames are separated by `-<task-type>-<seq>` suffixes within type-specific subdirectories. Because `<seq>` is scanned independently for each category directory (`manifests/`, `prompts/`, `reports/`, `status/`, `state/`, `sessions/`, `worker-results/`) beneath the resolved run directory, values may differ by category even within the same run.
 If flat legacy artifacts remain at the top level of a task-type run directory, the next execution automatically moves them into the corresponding type-specific subdirectories.
 
@@ -262,6 +265,7 @@ Main contents:
 - expected report relative path
 - expected status relative path
 - prompt snapshot relative path
+- final-verification target snapshot relative path and digest (empty for other task types)
 - `worker prompt directory relative path`
 - `worker prompt relative path by worker id`
 - current run status
@@ -299,14 +303,17 @@ After `okstra` runs, Claude should follow this default sequence when reading the
 3. Read `task-manifest.json`.
 4. If the current `state/active-run-context-<task-type>-<seq>.json` exists, read it as the primary input for lead Phase 1. This file is a compact intake that reconstructs run artifact paths from `identity` + `pathHints` clues. If it does not exist, fall back to the current `manifests/run-manifest-<task-type>-<seq>.json` and `team-state`.
 5. Read `instruction-set/analysis-profile.md` and `instruction-set/analysis-packet.md`.
+   For final-verification, use the compact target identity from active context and open `instruction-set/verification-target.md` only when its full mapping or diff stat is needed.
 6. Read `task-index.md` only when a quick summary is needed.
 7. Lazily read `analysis-material.md`, `reference-expectations.md`, `task-brief.md`, and `final-report-template.md` when the packet is insufficient or when source citations/report writing require them.
 8. Consult `history/timeline.json` and previous run results if necessary.
 9. As `Claude lead`, organize roles according to the current run's worker roster (`Claude worker`, `Codex worker`, and `Report writer worker` by default; `Antigravity worker` only when explicitly included).
 10. Save each selected worker prompt under the current run's `prompts/` directory at the assigned worker prompt history path before dispatching the worker.
-14. Collect a result or terminal status for each required worker.
-15. Unless the brief requires a more specific format, write the final Markdown report using the `final-report-template.md` structure.
-16. Save the result directly to `reports/final-report-<task-type>-<seq>.md` for the current run and, if necessary, update `status/final-<task-type>-<seq>.status`, `manifests/run-manifest-<task-type>-<seq>.json`, `task-manifest.json`, and `task-index.md` to match the current state.
+    Every selected final-verification initial analysis worker receives the same full-core semantic body. Dispatch and Phase 7 validate compactness and normalized equality; report-writer and `-reverify-r<N>-` prompts are separate audiences.
+11. In convergence Round 0, classify matching semantic/ticket-set findings as full consensus and queue only single-worker findings. Reverify each queued finding through other workers only; lightweight reverify does not reload the original bundle.
+12. Collect a result or terminal status for each required worker.
+13. Unless the brief requires a more specific format, write the final Markdown report using the `final-report-template.md` structure.
+14. Save the result directly to `reports/final-report-<task-type>-<seq>.md` for the current run and, if necessary, update `status/final-<task-type>-<seq>.status`, `manifests/run-manifest-<task-type>-<seq>.json`, `task-manifest.json`, and `task-index.md` to match the current state.
 
 Recommended worker status values:
 

package/docs/architecture.md

@@ -84,7 +84,7 @@ okstra's prepare responsibilities are consolidated in a single Python entry poin
 - Resolves task-brief / clarification-response paths (cwd first → PROJECT_ROOT fallback)
 - Computes the stable task root and all paths/sequences inside a per-task mutex (`~/.okstra/.locks/<task-key>.lock`), then persists them to `<run-dir>/manifests/run-context-<seq>.json`
 - Persists user input to `<run-dir>/manifests/run-inputs-<seq>.json`
-- Renders the instruction set (`analysis-profile.md`, `analysis-packet.md`, `analysis-material.md`, `task-brief.md`, `reference-expectations.md`, `final-report-template.md`, `final-report-schema.json`, optional `clarification-response.md`, optional `directive.txt`, `claude-execution-prompt.md`) and writes a run prompt snapshot
+- Renders the instruction set (`analysis-profile.md`, `analysis-packet.md`, `analysis-material.md`, `task-brief.md`, `reference-expectations.md`, `final-report-template.md`, `final-report-schema.json`, optional `clarification-response.md`, optional `directive.txt`, final-verification-only `verification-target.md`, `claude-execution-prompt.md`) and writes a run prompt snapshot
 - Updates `task-manifest.json`, `task-index.md`, `run-manifest-*.json`, `history/timeline.json`, and `discovery/{latest-task,task-catalog}.json`
 - Writes a preassigned Claude session ID and `sessions/claude-resume-*.sh` (unless `--render-only` is used)
 - Records record_start in the central indexes (`~/.okstra/{active,recent}.jsonl`, `projects/<id>/{index.jsonl, meta.json}`)
@@ -304,6 +304,16 @@ The standard `okstra` workflow applies the following team contract consistently
 - Every attempted worker (`completed`, `timeout`, `error`) must have an assigned worker prompt history file under the current run's `prompts/` directory.
 - An unnamed generic parallel worker is not accepted as a substitute for a required role.
 
+### Final-verification prompt and re-verification boundaries
+
+Final-verification uses one shared full-core responsibility for every selected initial analysis worker. Provider/model diversity supplies independent observations of the same requirements; it does not split acceptance criteria into disjoint worker scopes. `analysis-packet.md` carries the worker-facing verification procedure, while report-only deliverable and self-review guidance stays with the report writer.
+
+At final-verification entry, `prepare_task_bundle()` snapshots the resolved worktree, verification scope, base ref, head ref, implementation/stage report mapping, and diff stat into `instruction-set/verification-target.md`. It records the sidecar's project-relative path and `sha256:<hex>` digest in the task/run manifest and active-run context. Initial prompts carry only six compact target identity headers plus one `analysis-packet.md` path; workers open the target sidecar on demand. The coding-preflight anchor remains implementation-only, regardless of whether an initial pane is displayed with the role `verifier`.
+
+All selected initial prompt bodies must normalize to the same semantic content. One optional shared `## Run-specific directive` is bounded to 40 nonblank lines, and larger material is placed in the instruction set. `dispatch_core.py` and `codex_dispatch.py` enforce this before process launch; Phase 7 `validators/validate-run.py` applies the same `worker_prompt_contract.py` rules to the persisted initial prompt paths. Report-writer and `-reverify-r<N>-` prompts are outside this initial-prompt gate.
+
+The convergence algorithm is unchanged: Round 0 immediately classifies findings with matching semantics and ticket sets from two or more workers as `full-consensus`; only single-worker findings enter the verification queue. For worker W, `items_for_W` excludes findings originating from W, and resolved findings are removed permanently. Lightweight reverify receives only that current batch and its embedded evidence, not the original analysis packet/profile/brief/instruction set. The report writer does not vote, and terminal worker non-results are recorded as `verification-error`, never fabricated as `DISAGREE`.
+
 ## Stable task identity
 
 `okstra` uses the following combination as its basic identifier:
@@ -733,6 +743,7 @@ Errors that occur while workers (Claude/Codex/Antigravity worker, Report writer,
 ### Live-log mirror (codex / antigravity wrapper)
 
 - On every dispatch, `scripts/okstra-codex-exec.sh` and `scripts/okstra-antigravity-exec.sh` create a `<prompt>.log` sidecar next to the prompt path and mirror stdout there through a named FIFO (which keeps the CLI a single addressable PID for the idle watchdog). stderr is appended to the same file, preserving the subagent stderr-capture contract, and the file is truncated on each dispatch. This solves the problem where a calling subagent polls `BashOutput` every 60 seconds, leaving users unable to detect a stalled state during long-running work such as large-codebase scans in analysis or cargo / pytest in implementation.
+- The `.log` is an execution transcript containing wrapper/CLI output, not the original prompt. `okstra log-report` pairs it with the sibling persisted `.md` prompt and reports `transcriptBytes`, `promptBytes`, and their ratio separately. The compatibility fields `path`, `sizeBytes`, and `totalBytes` continue to mean transcript data, so existing consumers and transcript-size ordering remain stable.
 - **Per-block cap on the codex log copy** (`okstra_log_mirror` in `scripts/okstra-codex-exec.sh`): workers read their required inputs end-to-end per the Worker Preamble's *Reading rules*, so a single report read can dump 170KB+ into the log and observed sidecars reach 8MB. The mirror keeps the first `log_block_line_cap` (120) lines of each output block and replaces the remainder with a `[okstra log-mirror] N line(s) elided` marker, draining every 500 elided lines so the idle watchdog keeps seeing writes. **Only the log copy is capped** — the stdout passthrough stays byte-identical, so the dispatching subagent's `BashOutput` and Phase 5 synthesis are unaffected (`tests-js/codex-log-mirror.test.mjs` asserts that byte-identity). The marker set is codex-specific; the claude wrapper emits `--output-format=stream-json` and does not share this filter.
 - When tmux is reachable in the lead environment, the wrapper automatically splits a sibling pane and runs `tail -F <log-path>`. The trace-pane title appends `-tail` to the caller (worker) pane title: `<cli>-<role>-<pid>-tail` (for example, `codex-worker-93421-tail`). At the same time, the caller (worker) pane title is set to `<cli>-<role>-<pid>`. `<pid>` is the wrapper's own PID, so multiple workers with the same role spawned concurrently remain distinguishable, and operators can visually map `<caller> ↔ <caller>-tail`. **Caller-pane resolution**—because the Claude Code Bash tool now removes both `$TMUX` and `$TMUX_PANE` from the environment, the wrapper does not depend on environment variables. It (1) derives `<RUN_DIR>` as `dirname(dirname(prompt_path))` from the prompt path (paths.py SSOT), and (2) reads `<RUN_DIR>/state/lead-pane.id`, written once by the lead in its foreground pane, as the split anchor. This remains reliable for background dispatches, unlike active-pane guessing, even if the user changes panes. If the file is absent or the pane is stale, it falls back to `tmux display-message -p '#{pane_id}'` (the active pane). The trace split explicitly anchors to that caller pane with `-t`. The role is the wrapper's fifth optional positional argument and defaults to `worker`. The caller pane title is captured and restored by an EXIT trap, preventing stale titles across dispatches. Focus returns to the caller pane, and the trace pane remains after CLI exit so its scrollback is available. All paths silently degrade when tmux is unreachable, splitting fails, or tmux is outdated.
 - **Run-scoped tagging for cleanup**: A trace pane's `tail -F` is a child of the tmux shell and survives Claude's exit. The wrapper tags each spawned pane with `tmux set-option -p @okstra_trace_run=<RUN_DIR>`, and `okstra-trace-cleanup.sh` discovers panes server-wide from that tag via `tmux list-panes -a` and runs `tmux kill-pane`. It requires neither tmux environment variables nor a pane-ID registry. Because the tag is run-scoped, it does not kill trace panes from other simultaneous okstra runs. Cleanup has two entry forms: the lead invokes it with `--run-dir <RUN_DIR>` to clean traces and worker-agent panes for that run, or the `hooks.SessionEnd` entry in `templates/reports/settings.template.json` invokes it with `--reap` to clean all trace panes tagged below `$CLAUDE_PROJECT_DIR/.okstra/` when no single run directory exists at session end. Missing tmux and stale pane IDs silently degrade.

package/docs/cli.md

@@ -639,6 +639,7 @@ The `okstra` Node CLI (`bin/okstra`) provides both installer/admin commands and
 | `okstra manager <init\|discover-projects\|new\|task>` | Public CLI for grouping cross-project okstra tasks into manager-owned context. `new project`, `new task-group`, and `new task` create manager plans; `task assign`, `task note`, `task sync`, `task status`, and `task run` manage per-project assignments and snapshots. `new project --project-root` accepts only existing directories and performs setup-equivalent registration only if `.okstra/project.json` is absent. Public documentation uses the full `project-id:task-group:task-id` child task key; when child task IDs differ within the same manager task, select the exact child with `--child-task-id`. `task run` does not execute the child lead directly; it returns `prepared` launch metadata/event and a child launch-context packet as JSON |
 | `okstra rollup [--task-group <group>] [--project-root <dir>] [--cwd <dir>]` | Read-only backend for the okstra-rollup skill. For every catalog task, or one task group, it emits JSON with per-task run counts, raw duration in ms, error counts, latest report paths, group totals, and status/category/phase distributions. Omitting `--task-group` targets the whole project catalog. The caller skill formats raw ms as HH:MM:SS and synthesizes report prose. Use the `okstra inspect` family for a single-task drill-down |
 | `okstra usage-report [--days <positive-int>] [--project-root <dir>] [--cwd <dir>] [--json]` | Read-only backend for the okstra-usage skill. Defaults to the whole current project's last 30 days and emits task-type run coverage, raw/billable tokens, known USD cost, CPU-sum milliseconds, wall-clock milliseconds, unavailable reason counts, and unmatched pricing models |
+| `okstra log-report [--project-root <dir>] [--cwd <dir>] [--top <N>] [--json]` | Read-only inventory of wrapper transcript `.log` files and their sibling prompt `.md` files. Each ranked entry preserves `path` / `sizeBytes` for compatibility and also reports `transcriptPath`, `transcriptBytes`, `promptPath`, `promptBytes`, and `transcriptToPromptRatio`; totals distinguish prompt bytes from transcript bytes and count paired files. Ranking remains transcript-size descending |
 | `okstra recap <assemble\|record\|note> <task-root\|task-key> …` | Backend for the okstra-inspect `recap` facet. `assemble` is read-only and prints a JSON summary of phase transitions across a task's runs. `record --kind <summary\|qa> --mode <artifact\|code> --answer <text> [--question <text>] [--citation <path:line> …]` appends one line to `<task-root>/recap/recap-log.jsonl` and never mutates other artifacts. `note --kind <verification-evidence\|decision-draft\|analysis-note> --slug <topic> --purpose <text> --scope-note <text> (--body <markdown>\|--body-file <path>)` writes an agent-authored note to `<task-root>/notes/` and prints its path plus the `--clarification-response` argument for feeding it into a later run |
 | `okstra user-response <list\|show\|write> …` | Backend for the `/okstra-user-response` skill: answer a task's open clarification questions in-session and write the response sidecar. `list --home <dir> --project <id> [--limit <n>]` finds reports with open questions; `show --report <md>` reads one report's questions; `write --report <md> --answers <json> [--approval <json>] [--task-key <key>]` writes the sidecar. Each answer carries a `disposition` of `answer` or `reframe`; a `reframe` is carried into the next run as a re-scoped brief. JSON output; exit 0 ok / 1 error |
 | `okstra pr <template\|branches\|gen> …` | Backend for the okstra-pr-gen skill. Git-only—no project registration required. `template list\|show <name\|default>\|add --name <name> (--content <text>\|--file <path>)\|path` manages PR body templates under `~/.okstra/template/pr/` (bundled fallback `src/commands/pr/default.md`); `branches` recommends a base branch; `gen --base <ref> [--template <name\|default>]` emits a JSON bundle of the template plus `<base>..HEAD` commits and `<base>...HEAD` diffstat |

package/docs/project-structure-overview.md

@@ -219,7 +219,7 @@ Important modules:
 
 | Module | Role |
 |---|---|
-| `run.py` | `prepare_task_bundle()` single authority and CLI parser |
+| `run.py` | `prepare_task_bundle()` single authority and CLI parser; for final-verification it also owns `verification-target.md` snapshot/digest materialization before manifests and prompts are rendered |
 | `implementation_stage.py` | `implementation` single-stage run orchestration — read the Stage Lifecycle Snapshot → pick an available Stage Map entry → provision an isolated stage worktree → publish the selected stage as run context (extracted from `run.py`) |
 | `stage_targets.py` | Stage readiness/verification policy SSOT — from the Stage Lifecycle Snapshot (`consumers.jsonl` ledger + carry sidecar backfill + active registry reservation) it decides which stage is runnable, which commit it branches from, and what final-verification checks. `order_stage_closure` topologically sorts (Kahn) the dependency closure of the wizard's multi-selected stage set to produce the unattended `chain-stages` chaining order |
 | `stage_fix_carry.py` | fix-run carry derivation for a re-run on an `implementation` stage whose latest final-report data.json carries verifier `FAIL` verdicts — collects the previous report path, previous run HEAD, failed verifiers, carried blocking findings, and a routing recommendation, which `run.py` renders into the analysis profile through the `{{FIX_RUN_CONTEXT}}` token. A first run, or a re-run after `PASS`, yields no carry and renders the token empty |
@@ -251,7 +251,7 @@ Important modules:
 | `run_index_row.py` | single reference point for creating / slimming / hydrating a `~/.okstra` run-index row — runId SSOT, preserves projectId raw |
 | `error_report.py`, `error_log_core.py`, `error_zip.py` | backend for the okstra-inspect errors/error-zip facets — `error_log_core` is the read-only core that globs/parses/aggregates `errors-*.jsonl`, `error_report` renders the errors facet, and `error_zip` collects cross-project run directories, allowlist-anonymizes, aggregates clusters, and produces a zip |
 | `worker_heartbeat.py`, `worker_liveness.py` | `worker_heartbeat` is the single definition of the `- PROGRESS:` heartbeat line shape and its 5-minute (+60s grace) cadence budget, shared by the Phase 7 audit (`validators/validate_session_conformance.py`) and the live probe; `worker_liveness` backs `okstra worker-liveness`, reporting a pending worker as `stalled` (heartbeat past the budget) or `did-not-launch` (no wrapper `.log`/`.status.json` past the launch grace) |
-| `log_report.py`, `time_report.py` | read-side backend for the okstra-inspect logs/time facets (`okstra log-report` is the wrapper sidecar log inventory, `okstra time-report` is per-task time aggregation) |
+| `log_report.py`, `time_report.py` | read-side backend for the okstra-inspect logs/time facets (`okstra log-report` pairs each wrapper transcript `.log` with its sibling prompt `.md` and reports both byte counts without changing legacy transcript-size fields; `okstra time-report` is per-task time aggregation) |
 | `rollup.py` | read-side backend for the okstra-rollup skill — fans the catalog out per task-group (or the whole project) and deterministically aggregates each task's run count, elapsed time (raw ms), error count, and latest report path, plus group-level totals/status, category, and phase distribution. Reuses the `time_report`/`error_log_core` functions and delegates report-body synthesis to the skill |
 | `usage_report.py` | Read-only okstra-usage backend — scans the whole current project's recent run timelines, defaults to 30 days, and returns task-type coverage, raw/billable tokens, known USD cost, CPU-sum and wall-clock milliseconds, unavailable reason counts, and unmatched pricing models |
 | `json_registry.py` | shared flock + atomic JSON persistence for small okstra registries (`registry_lock`/`load_registry_json`/`save_registry_json`) — shared by `container_registry` and `worktree_registry` |
@@ -268,9 +268,9 @@ Important modules:
 | `manager_store.py` | Manager-owned state mutation — project membership, task planning, assignment, directives, event append |
 | `manager_sync.py` | One-way child project `.okstra` snapshot reader; corrupt child state becomes row-level `error` so other children continue |
 | `manager_launch.py` | Child launch packet and manager child context renderer; records `prepared` launch metadata/events without changing project-local task state |
-| `dispatch_core.py` | Backend-neutral worker dispatch core — worker execution/collection logic shared by any lead runtime (Claude/Codex/external) |
-| `codex_dispatch.py` | Codex lead CLI-worker dispatcher — the `okstra codex-dispatch` backend. Reads the run manifest to run the Codex-side supported worker subset and performs token-usage substitution, view render, follow-up, and validation |
-| `analysis_packet.py` | assembles the compact analysis-worker input packet for a task run (error-analysis phase worker input) |
+| `dispatch_core.py` | Backend-neutral worker dispatch core — worker execution/collection logic shared by any lead runtime (Claude/Codex/external); gates selected final-verification initial prompts through the shared compact/equality contract before launch |
+| `codex_dispatch.py` | Codex lead CLI-worker dispatcher — the `okstra codex-dispatch` backend. Reads the run manifest to run the Codex-side supported worker subset, applies the same final-verification initial-prompt gate, and performs token-usage substitution, view render, follow-up, and validation |
+| `analysis_packet.py` | assembles the compact analysis-worker input packet for a task run; final-verification packets include worker verification procedure but omit report-only deliverable/self-review guidance |
 | `context_cost.py` | read-side context-cost estimator for a prepared okstra task bundle (the `okstra context-cost` backend) |
 | `schema_excerpt.py` | generates a task-type-scoped excerpt of the final-report schema — a schema reduction to inject into the worker/lead prompt |
 | `work_categories.py` | requirements-discovery work-category (domain) **SSOT** (`is_valid_category`) — the work-category allowlist is defined only here |
@@ -278,7 +278,8 @@ Important modules:
 | `lead_runtime.py` | lead runtime metadata shared by the render and prepare paths (`LeadRuntimeInfo`) |
 | `lead_events.py` | structured JSONL events emitted by non-Claude lead runtimes |
 | `team_reconcile.py` | stale team-member reconciliation at run-end teardown |
-| `worker_prompt_headers.py` | shared rendering of the worker prompt anchor header (`worker_prompt_headers`) |
+| `worker_prompt_headers.py` | shared rendering of phase-aware worker prompt anchors (`worker_prompt_headers`): coding-preflight only for implementation and compact target identity for final-verification |
+| `worker_prompt_contract.py` | deterministic compact initial final-verification prompt validator and normalized cross-worker equality SSOT, reused by dispatch adapters and the Phase 7 persisted-artifact validator |
 | `wrapper_status.py` | worker wrapper status sidecar reader — the host-side reader of the sidecar written by `okstra-wrapper-status.py` (the heartbeat writer) |
 | `task_target.py` | shared helper resolving `task-key → (task_root, project_root)` (`resolve_task_root`) |
 | `graphify_cmd.py` | scope wrapper for the okstra-graphify skill — `resolve_scope` + `assemble` + `okstra graphify` subcommand dispatch. Forces the corpus to `.okstra` and outputs to `.okstra/graph/` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.127.0",
+  "version": "0.128.0",
   "description": "Multi-agent cross-verification orchestrator runtime + Claude Code skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.127.0",
-  "builtAt": "2026-07-20T14:29:59.831Z",
+  "package": "0.128.0",
+  "builtAt": "2026-07-20T15:52:59.156Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/prompts/lead/convergence.md

@@ -28,6 +28,8 @@ This contract governs **Phase 5.5 (Convergence loop)** — a *lead operating pha
 
 When this contract says "queue" without qualifier, it means the *verification queue*: the set of findings that are still candidates for re-verification in subsequent rounds. The queue shrinks monotonically as findings get classified as `full-consensus`, `partial-consensus`, or `worker-unique`. Findings classified into any of these three categories MUST NOT appear in any subsequent round's reverify prompt, for any worker.
 
+An initial pane role `verifier` is still a Phase 4/5 analysis worker; it does not mean Phase 5.5 reverify. Only a queue-scoped dispatch whose prompt/result path carries `-reverify-r<N>-` performs the reverify step described by this contract.
+
 ## When to Use
 
 - When okstra lead Phase 5.5 (convergence loop) begins — immediately after all workers complete Phases 4 and 5
@@ -288,6 +290,8 @@ If none of the three is available, **abort the reverify dispatch for that role**
 
 Reverify prompts MUST NOT inject the Phase 2 `[Required reading]` clause:
 
+Lightweight reverify does not require the original `analysis-packet.md`, `analysis-profile.md`, `task-brief.md`, or instruction set. Its complete input is the receiving worker's current `items_for_W` batch and the evidence embedded in those findings.
+
 - **Lightweight mode**: the clause directly contradicts the "Do NOT re-analyze the original source materials" instruction below. Including it forces workers to re-read the entire instruction-set per round per worker (3 workers × 2 rounds × 5+ files in the worst case) for no quality gain.
 - **Full-reanalysis mode**: workers DO need to re-read source materials, but only the analysis-worker file list (no `final-report-template.md`). If lead chooses to inject a reading clause here, it MUST mirror the audience-scoped enumeration in [okstra-lead-contract](./okstra-lead-contract.md) Phase 2 (no template).
 

package/runtime/prompts/lead/okstra-lead-contract.md

@@ -208,6 +208,8 @@ These phases are governed by [team-contract](./team-contract.md). It is the cano
 - Worker output contract (sections 1–5 + optional Section 6; the Reading Confirmation block lives in the audit sidecar, never in the worker-results file — the preamble "Reading rules" section is canonical and the validator rejects violations), header standard, terminal statuses, errors-sidecar schema.
 - Token-usage tracking conventions.
 
+For `final-verification`, Lead persists initial analysis prompts with one shared semantic body. Any genuine run delta appears under exactly one `## Run-specific directive` heading and applies to every selected analysis worker; Lead never shards verification requirements by worker, provider, or model. If the shared directive would exceed 40 nonblank lines, Lead writes it into the instruction set and adds the same reference to `analysis-packet.md` before dispatch. Phase 7 validates the persisted initial analysis prompts through the shared prompt contract before the run can pass.
+
 `Report writer worker` is NOT an analysis worker. Do not dispatch it in Phase 4/5 alongside analysis workers. It is invoked only in Phase 6 — see [report-writer](./report-writer.md).
 
 ### Phase 3 — Runtime adapter setup (BLOCKING)

package/runtime/prompts/lead/team-contract.md

@@ -27,6 +27,8 @@ Okstra tasks use one lead plus the exact worker assignments selected in the prep
 
 **Dispatch-prompt invariant.** Lead's dispatch prompt body for Claude / Codex / Antigravity workers MUST be byte-identical except for the role label and any wrapper-specific path headers (e.g. `**Worktree:**`, `**Errors sidecar path:**`). Lead MUST NOT bias the brief by inserting per-worker emphasis sentences ("you focus on X") into the body. Bias-by-prompt reproduces the historical failure mode where Claude commented only on assumptions, Codex only on code paths, and Antigravity only on requirements — leaving convergence with nothing to converge on.
 
+Disjoint initial scopes are invalid triangulation. Every selected analysis worker owns the same common verification requirements; provider diversity supplies independent observations, not separate coverage slices. Do not shard the common scope by worker, provider, or model. Worker-specific depth belongs only in the non-voting Specialization Lens after the shared analysis is complete.
+
 ### Model Assignment Rules
 
 1. `resultContract.requiredWorkerRoles` in `task-manifest.json` (and the lead model metadata) is the canonical source. There is no role-level fallback — a missing assignment is a manifest defect, not a license to invent one.
@@ -63,7 +65,13 @@ Only workers selected from `recommendedWorkers` in `task-manifest.json` and `res
 
 Every worker prompt MUST start with the anchor headers rendered by `okstra_ctl.worker_prompt_headers.worker_prompt_headers()` (the generating SSOT — never hand-author or reorder them). Their meaning and extraction rules for workers are documented in the worker preamble §"Anchor headers". Phase-specific extra headers (implementation worktree, final-verification target snapshot, improvement-discovery grilling log) are listed there too.
 
-The body must include: role name, task type, task key, required bundle paths, assigned model, output contract, evidence handling rules, and any relevant config/deployment expectations from `reference-expectations.md`.
+The `**Coding preflight pack:**` anchor is emitted only when `taskType == implementation`. A pane display role named `verifier` during `final-verification` is still an initial analysis worker; it neither receives implementation conventions nor becomes a Phase 5.5 reverify dispatch. Reverify is identified by the `-reverify-r<N>-` prompt/result path contract in [convergence](./convergence.md).
+
+The body must include: role name, task type, task key, assigned model, output contract, evidence handling rules, and `analysis-packet.md` as the single primary analysis input. For `final-verification`, the compact target anchors and that packet path are sufficient; do not copy the full diff stat, source/fallback path inventory, profile sections, report-output sections, or lead self-review into the initial prompt.
+
+A `final-verification` prompt may contain one optional `## Run-specific directive` section for a true run delta. It is limited to 40 nonblank lines; the nonblank prompt body excluding common/target anchors is limited to 96 lines. Larger shared material belongs in the instruction set and analysis packet. Before initial dispatch, the selected adapter validates each prompt and requires byte-identical normalized analysis bodies after removing only worker/model/role and worker-specific artifact-path metadata.
+
+The Phase 7 run validator enforces the same rule against the persisted prompt paths recorded by the run manifest and team-state. `validators/validate-run.py` calls `_validate_final_verification_initial_prompts`, which delegates parsing and normalized equality to `okstra_ctl.worker_prompt_contract`; it ignores the report writer and `-reverify-r<N>-` prompts because they belong to different phases of the protocol. A dispatch-time bypass therefore remains a run-level contract violation.
 
 When a worker reads any project-relative path from the prompt, it MUST resolve it against `Project Root` (e.g. `<Project Root>/<Result Path>`) — never use bare relative paths that depend on cwd.
 
@@ -78,7 +86,7 @@ Send byte-identical dispatch prompts to every analysis worker per the "Dispatch-
 The lead does NOT inline `[Required reading]` or `[Error reporting]` blocks into worker prompts. Both contracts live in a single canonical file at `~/.okstra/templates/worker-prompt-preamble.md` (source: `templates/worker-prompt-preamble.md`). The lead injects the path via the `**Worker Preamble Path:**` anchor header and each worker Reads that file end-to-end before producing output.
 
 What the lead MUST still do per dispatch:
-- Inject the input file enumeration into the dispatch prompt body via an `## Inputs` section (or any heading the recipient agent expects), listing the actual project-relative primary inputs derived from the run's `instruction-set/`. For analysis workers, list `analysis-packet.md` as the required primary input and list task-brief / analysis-profile / analysis-material / reference-expectations / clarification-response as source/fallback paths only when useful. The preamble describes the rules; the lead provides the specific paths for THIS run.
+- Inject the input file enumeration into the dispatch prompt body via an `## Inputs` section (or any heading the recipient agent expects), listing the actual project-relative primary inputs derived from the run's `instruction-set/`. For `final-verification` analysis workers, list only `analysis-packet.md` as the primary input; source files are reached on demand through that packet. Other phases may list source/fallback paths when useful. The preamble describes the rules; the lead provides the specific paths for THIS run.
 - Inject the absolute `**Errors log path:**` and `**Errors sidecar path:**` anchor headers — workers cannot synthesize these paths.
 - Omit the preamble pointer for reverify dispatches (Phase 5.5 lightweight mode) — see [convergence](./convergence.md) "Reverify prompt: required-reading suppression".
 
@@ -86,7 +94,7 @@ Audience-scoped file enumeration (performance optimization — mandatory):
 
 | Recipient | Files the lead lists under `## Inputs` |
 |---|---|
-| Claude / Codex / Antigravity analysis workers | `analysis-packet.md` as primary input; source/fallback paths may be listed below it but are not automatic first-read files |
+| Claude / Codex / Antigravity analysis workers | `analysis-packet.md` as primary input; for `final-verification`, no source/fallback list is copied into the prompt |
 | Report writer worker (Phase 6) | task-brief, analysis-profile, analysis-material, reference-expectations, clarification-response (if carry-in), **plus** the instruction-set-local `final-report-template.md` (phase-stripped) and `final-report-schema.json` (per-task-type excerpt) — NOT the full `templates/reports/...` / `schemas/...` sources |
 | Reverify dispatches | none — the lead provides only the items to reverify |
 

package/runtime/prompts/profiles/final-verification.md

@@ -29,18 +29,22 @@
     - **whole-task is a mutating phase, not a read-only one.** On entry, whole-task mode auto-merges (with `--no-ff`) the done stages not yet merged into the task branch to create an integration commit, then removes the cleanupable stage worktrees, registry stage-keys, and stage branches. If a merge conflict occurs it reports the conflicting files and aborts (the user resolves them manually and retries). A stage worktree with uncommitted changes remaining is preserved. Therefore the "fully-merged, clean target" the entry gate above refers to is the state after this auto-integration step completes, and whole-task final-verification must be treated as a mutating phase that creates the integration commit.
   - **single-stage scope** (`--stage N`): prep verified stage N is `status:done` and its isolated stage worktree exists and is clean. Other stages' state is irrelevant. A single-stage run is a partial verification: it MUST NOT recommend plain `release-handoff`, but MAY recommend `release-handoff(stage-group)` when the verdict is `accepted` — the stage becomes PR-eligible for a stage-group handoff.
   - the lead still captures `git status --short` from the injected worktree to confirm the analysis ran against the delivered work-tree state; an unexpected divergence (dirty tree outside `.okstra/`, missing worktree) is a `tool-failure`, not a silent proceed.
+- Worker verification procedure:
+  - **Target confirmation:** verify the inline worktree, scope, base/head refs, target path, and digest against `verification-target.md` before analysis. Use the sidecar's stage/report mapping and complete diff stat; a missing sidecar, digest mismatch, dirty worktree outside `.okstra/`, or wrong head is a `tool-failure`, never a silent target reselection.
+  - **Evidence:** attach file:line, exact command + exit code, log excerpt, or MCP SELECT evidence to every finding. Mark a requirement as covered only when the cited artifact demonstrates it.
+  - **Tier 1 and Tier 2 read-only validation:** Tier 1 is the originating brief/approved plan `validation` set; Tier 2 is `<PROJECT_ROOT>/.okstra/project.json` `qaCommands`. Do not auto-detect commands from package manifests. A missing tier is `qa-command not configured: <category>`. Before execution, reject commands containing source/lockfile mutation tokens such as `--fix`, `--write`, ` -w`, ` -u`, `--snapshot-update`, `INSTA_UPDATE=<not-no>`, `cargo update`, or `npm install` without `ci`; record the exact denied token.
+  - **Tier 3 stage conformance:** read `<task_root>/qa/conformance-manifest.json`. In whole-task scope, run every non-exempt `entries[].runCommand` against the merged worktree; in single-stage scope, run only the matching `stageKey`. Use `qaEnv` only with a replica/test datastore, refresh `result-<stageKey>.json`, and interpret the exit code plus the last `QA-RESULT: PASS|FAIL` marker. Missing/non-PASS evidence is an acceptance-blocker recommendation. An exemption or user waiver is not executed; record its reason, and surface a waiver as a `conditional-accept` recommendation.
+  - **Manual user test:** read only the source implementation report's `implementation.manualUserTest`. Execute reproducible steps and record `pass`, `fail`, or `blocked` with observed evidence. Human-only or environment-unavailable steps remain `blocked` with the exact reason. Reaffirm an `applicable=false` exemption; do not execute planning `designPreparation` or manual-test PREP items directly.
+  - **Design-preparation carry-in:** read only source implementation report `missingInformation` rows whose `source` starts with `design-prep:`. Recommend `ifStillOpen: block` as an acceptance blocker and `ifStillOpen: follow-up` as residual risk. This phase does not read planning PREP sidecars directly or mutate planning snapshots.
+  - **Could-not-verify honesty:** use `not-configured`, `env-unavailable`, `rejected`, `gap`, or `blocked` as appropriate. Never convert unavailable evidence into an executed/pass claim.
+  - **Source-mutation prohibition:** verification may write only assigned okstra run artifacts. Do not edit source, schema, deployment, lockfile, or configuration files; route detected defects to a later phase.
 - Required deliverable shape (final report, in addition to the standard sections):
-  - **Source Implementation Report(s)**: the `VERIFICATION_TARGET` snapshot verbatim — verification scope, worktree path, base ref, the list of stages under verification, and one row per stage citing its originating implementation final-report (`report_path` from `consumers.jsonl`; render `(report_path unrecorded)` when absent). The lead injects this same snapshot into every analyser prompt (`**Verification scope:** / **Worktree:** / **Verification base ref:** / **Verification diff stat:**`); a worker that cannot confirm its analysis ran against that worktree's delivered diff (against `base ref`) MUST record a `tool-failure`.
+  - **Source Implementation Report(s)**: the `VERIFICATION_TARGET` snapshot verbatim — verification scope, worktree path, base/head refs, the list of stages under verification, and one row per stage citing its originating implementation final-report (`report_path` from `consumers.jsonl`; render `(report_path unrecorded)` when absent). Every analyser prompt carries the same compact target identity (`**Verification scope:** / **Worktree:** / **Verification base ref:** / **Verification head ref:** / **Verification target path:** / **Verification target digest:**`) and reads the sidecar on demand for the complete diff stat. A worker that cannot confirm its analysis ran against that worktree's delivered diff MUST record a `tool-failure`.
   - **Verdict vocabulary**: Section 7 (`Final Verdict`) MUST include a `Verdict Token` field whose value is exactly one of `accepted`, `conditional-accept`, or `blocked`. `conditional-accept` requires an explicit, exhaustive list of conditions; ambiguous verdicts ("looks good", "mostly ready") are not allowed. Each condition MUST be recorded as a row in the **Conditional Acceptance Conditions** deliverable (`id` `CA-NNN`, `condition`, `evidenceRequired`, `blocksReleaseHandoff`). The validator enforces verdict↔deliverable consistency: `accepted` ⇒ zero acceptance blockers, `blocked` ⇒ at least one, `conditional-accept` ⇒ at least one condition, and a `release-handoff` routing recommendation is allowed only when the verdict is `accepted`. **Any Acceptance Blocker therefore forces the verdict off `accepted` (to `conditional-accept` or `blocked`); the gates below cite this rule instead of restating the arithmetic.**
   - **Acceptance Blockers block** (under section 4): one row per blocker with `id`, `severity` (`critical` / `major` / `minor`), evidence (file path, log excerpt, or test output), and the recommended follow-up phase (`error-analysis` or `implementation-planning`). Empty block is acceptable and preferred — render the single line `- No acceptance blockers found.`
   - **Residual Risk block** (under section 4): risks that are not blockers but should be tracked, each with mitigation owner and a trigger that would escalate them to a blocker.
   - **Validation Evidence**: for every requirement in the originating plan or task brief, cite the artifact (commit SHA, test output, log line, MCP SELECT result) that demonstrates coverage. Paraphrased "verified" claims without an artifact are rejected.
   - **Read-only command log**: any pre-existing test/validation command touched during this run MUST be listed with its exact command line and one honest status — `executed` (ran; carries its exit code) / `env-unavailable` (should run but cannot in this environment — missing replica DB, container, or service; carries the reason, never a faked pass) / `not-configured` (no such qa-command tier) / `rejected` (a mutating/denied token — skipped, carries the denied token). A check that could not run locally is recorded as `env-unavailable` with the reason — never silently dropped and never reported as `executed` with an invented exit code. Mutating-command prohibition is the shared read-only boundary (see Non-goals); it is not restated per row.
-  - **Two-tier command lookup (shared with `implementation`):** when this phase performs its own independent re-validation, the command source is exactly the same two tiers `implementation` verifiers use — Tier 1 is the originating task brief / approved plan's `validation` set, Tier 2 is `<PROJECT_ROOT>/.okstra/project.json` under `qaCommands`. Auto-detecting tools from manifest files is forbidden; missing tiers are recorded as `qa-command not configured: <category>` rather than guessed. The `cmd` deny-list (`--fix`, `--write`, ` -w`, ` -u`, `--snapshot-update`, `INSTA_UPDATE=<not-no>`, `cargo update`, `npm install` without `ci`, etc.) is enforced identically. NOTE: runtime fail-fast validation (`okstra_ctl.qa_commands.validate_qa_commands`) only fires at `--task-type implementation` run-prep, so this phase MUST self-check each `qaCommands` entry against the deny-list before executing it — if a denied token is present, skip the command and record it as a `Read-only command log` line `qa-command rejected (denied token: <token>): <label>`.
-  - **Tier 3 — stage conformance scripts (whole-task union):** because this phase verifies the **integrated, merged** state, it re-runs conformance against that state rather than per-stage. Read the task-level manifest `<task_root>/qa/conformance-manifest.json` (the directory is the `TASK_QA_PATH` token) and, in **whole-task scope**, run the `runCommand` of **every** `entries[]` item against the merged worktree, refreshing each `<task_root>/qa/result-<stageKey>.json` (`{ "stageKey", "overall": "PASS"|"FAIL"|"MISSING", "ranAt", "requirements" }`). In **single-stage scope**, run only the entry whose `stageKey` matches the verified stage. An entry carrying an `exemption` or user `waiver` is NOT executed — record the skip and reason; a `waiver` becomes a `conditional-accept` condition surfaced in the section 7 Verdict (conformance left unverified by user acknowledgement). Each `runCommand` runs in the worktree cwd with `qaEnv` env (replica DB DSN / app base URL / env file) — **replica / test environment only**, never shared / staging / prod, and the same source/lockfile mutation deny-list applies (a conformance script MAY mutate only its `qaEnv` replica datastore). Interpret each result from the exit code + stdout `QA-RESULT: PASS|FAIL` (last wins) and `REQ <id>: PASS|FAIL: <reason>` lines; no `QA-RESULT` marker → `MISSING`. Any entry whose result is not `PASS` (including `MISSING` or a never-run/missing sidecar) is an **Acceptance Blocker** (`major`+). This is the same gate the `validate-run.py` Tier 3 check enforces on the result sidecars.
-  - **Manual user test results**: take each item from the source implementation report's §5.7.9 Manual User Test (Draft), execute the ones reproducible in this environment (e.g. `/okstra-container-build`, which runs `okstra container up`, then the documented steps), and record `result` (`pass` / `fail` / `blocked`) + observed value in §5.8.7 (data field `finalVerification.manualUserTest`). Steps that need human-only interaction this run cannot perform are recorded as `blocked` with the reason (handed to the user), never silently skipped. A failed manual test is an Acceptance Blocker. If the draft was an exemption (`applicable=false`), reaffirm the reason in one line (`applicable=false` + `exemptionReaffirm`).
-    For manual testing, read only the source implementation report's `implementation.manualUserTest`. Do not execute planning `designPreparation` / `manual-user-test` PREP items directly. The implementation report has already reconciled the approved seed with the actual diff. Record reproducible results; human-only or unavailable environments become `result: blocked` with the exact reason.
-  - **Non-manual design-preparation handoff**: read only source implementation report `missingInformation` rows whose `source` starts with `design-prep:`. Record `ifStillOpen: block` as an acceptance blocker and `ifStillOpen: follow-up` as residual risk. This phase does not read planning PREP sidecars directly, merge their inputs, or mutate the planning snapshot.
   - **Could-not-verify roll-up (§5.8.9)**: the template mechanically aggregates every not-confirmed check into one scannable list — `gap` requirement-coverage rows, `not-configured` / `env-unavailable` / `rejected` command rows, and `blocked` manual tests. You do not hand-author it, but you MUST give those rows their honest status so nothing unverified hides across sections: a check silently recorded as `executed`/`covered` will not surface in the roll-up. This is okstra's answer to "say what could not be verified this run."
   - **Routing recommendation**: the next safe phase — one of `release-handoff`, `done`, `error-analysis`, `implementation-planning` — tied to the verdict and blocker list. `release-handoff` is allowed ONLY when the Verdict Token is `accepted`. `release-handoff` is additionally allowed ONLY when the verification scope (the `Verification scope:` line of the injected `VERIFICATION_TARGET` block, recorded as the report's `verificationScope` field) is `whole-task`; a `single-stage` accepted run routes to `release-handoff(stage-group)` (or `implementation` / `done`); plain `release-handoff` remains whole-task-only. Enforcement: `validators/validate-run.py` rejects a `single-stage` report whose routing cites plain `release-handoff`.
   - **Verified-row recording** (single-stage scope only): when the Verdict Token is `accepted`, the lead MUST run `okstra handoff record-verified --plan-run-root <plan-run-root> --stage <N> --report-path <final-report.md path> --data-json <final-report data.json path>` and quote the command + exit code in the report. The helper re-validates taskType/scope/verdict from data.json, so a non-accepted or whole-task report is rejected at the tool layer.

package/runtime/python/okstra_ctl/analysis_packet.py

@@ -41,8 +41,7 @@ PROFILE_SECTIONS_BY_TASK_TYPE = {
         "Self-review pass before finalising the report",
     ),
     "final-verification": (
-        "Required deliverable shape",
-        "Self-review pass before finalising the report",
+        "Worker verification procedure",
     ),
     "improvement-discovery": (
         "Phase 1.5 — Lead reflect-back grilling",
@@ -81,6 +80,7 @@ def build_analysis_packet(
     parts.extend(
         _intro_block(
             task_key,
+            task_type,
             instruction_set_relative_path,
             bool(clarification_response_path),
         )
@@ -113,6 +113,7 @@ def _packet_frontmatter(brief_text: str, task_key: str) -> str:
 
 def _intro_block(
     task_key: str,
+    task_type: str,
     instruction_set: str,
     has_clarification: bool,
 ) -> list[str]:
@@ -132,6 +133,10 @@ def _intro_block(
         f"- Analysis material: `{instruction_set}/analysis-material.md`",
         f"- Reference expectations: `{instruction_set}/reference-expectations.md`",
     ]
+    if task_type == "final-verification":
+        lines.append(
+            f"- Verification target: `{instruction_set}/verification-target.md`"
+        )
     if has_clarification:
         lines.append(
             f"- Clarification response: `{instruction_set}/clarification-response.md`"

package/runtime/python/okstra_ctl/codex_dispatch.py

@@ -27,6 +27,7 @@ from .path_hints import hydrate_active_run_context
 from .wrapper_status import status_path_for_prompt
 from .paths import task_dir
 from .worker_prompt_headers import WorkerPromptHeaderError, worker_prompt_headers
+from .worker_prompt_contract import validate_final_verification_prompt_paths
 
 
 SUPPORTED_CLI_WORKERS = {
@@ -182,6 +183,7 @@ def build_dispatch_plan(
         )
         for worker_id in selected_workers
     )
+    _validate_initial_final_verification_prompts(manifest, workers)
     return DispatchPlan(
         project_root=project_root,
         workspace_root=workspace_root,
@@ -193,6 +195,23 @@ def build_dispatch_plan(
     )
 
 
+def _validate_initial_final_verification_prompts(
+    manifest: Mapping[str, Any],
+    workers: Sequence[WorkerDispatch],
+) -> None:
+    if manifest.get("taskType") != "final-verification":
+        return
+    prompt_paths = {
+        worker.worker_id: worker.prompt_path
+        for worker in workers
+        if worker.worker_id != REPORT_WRITER_WORKER_ID
+        and "-reverify-r" not in worker.prompt_path.name
+    }
+    errors = validate_final_verification_prompt_paths(prompt_paths)
+    if errors:
+        raise DispatchError("final-verification prompt contract: " + "; ".join(errors))
+
+
 def dispatch_plan(plan: DispatchPlan) -> int:
     _set_dispatch_mode(plan.team_state_path, _dispatch_mode(plan.workers))
     for worker in plan.workers:
@@ -702,6 +721,13 @@ def _analysis_input_lines(
     manifest: Mapping[str, Any],
     active_context: Mapping[str, Any],
 ) -> list[str]:
+    if manifest.get("taskType") == "final-verification":
+        packet_path = _instruction_path(
+            manifest,
+            active_context,
+            "analysisPacketPath",
+        )
+        return _existing_input_lines((("Primary analysis packet", packet_path),))
     inputs = [
         ("Primary analysis packet", _instruction_path(manifest, active_context, "analysisPacketPath")),
         ("Task brief", _instruction_path(manifest, active_context, "taskBriefPath")),
@@ -800,7 +826,7 @@ def _worktree_headers(
 ) -> list[str]:
     task_type = _require_string(manifest, "taskType")
     worktree = _worktree_path(manifest, active_context)
-    if task_type not in {"implementation", "final-verification"} or not worktree:
+    if task_type != "implementation" or not worktree:
         return []
     headers = [f"**Worktree:** {worktree}"]
     if role == "executor":

package/runtime/python/okstra_ctl/dispatch_core.py

@@ -18,6 +18,7 @@ from .final_report_paths import (
 from .lead_events import LeadEvent, append_lead_event
 from .path_hints import hydrate_active_run_context
 from .worker_prompt_headers import WorkerPromptHeaderError, worker_prompt_headers
+from .worker_prompt_contract import validate_final_verification_prompt_paths
 from .wrapper_status import read_wrapper_status, status_path_for_prompt
 
 
@@ -183,6 +184,7 @@ def build_dispatch_plan(
         report_writer_model,
         options,
     )
+    _validate_initial_final_verification_prompts(manifest, jobs)
     return DispatchPlan(
         project_root=project_root,
         workspace_root=workspace_root.resolve(),
@@ -195,6 +197,24 @@ def build_dispatch_plan(
     )
 
 
+def _validate_initial_final_verification_prompts(
+    manifest: Mapping[str, Any],
+    jobs: Sequence[WorkerJob],
+) -> None:
+    if manifest.get("taskType") != "final-verification":
+        return
+    prompt_paths = {
+        job.worker_id: job.prompt_path
+        for job in jobs
+        if job.worker_id != REPORT_WRITER_WORKER_ID
+        and job.dispatch_kind == "initial"
+        and "-reverify-r" not in job.prompt_path.name
+    }
+    errors = validate_final_verification_prompt_paths(prompt_paths)
+    if errors:
+        raise DispatchError("final-verification prompt contract: " + "; ".join(errors))
+
+
 def dispatch_plan(plan: DispatchPlan, *, wait: bool = True) -> int:
     if wait:
         if any(job.backend == BACKEND_TMUX_PANE for job in plan.jobs):

package/runtime/python/okstra_ctl/log_report.py

@@ -53,6 +53,34 @@ def _per_task(files: list[dict]) -> list[dict]:
     return sorted(acc.values(), key=lambda a: a["totalBytes"], reverse=True)
 
 
+def _prompt_pair(log_path: Path, transcript_bytes: int) -> dict:
+    prompt_path = log_path.with_suffix(".md")
+    if not prompt_path.is_file():
+        return {
+            "transcriptPath": str(log_path),
+            "transcriptBytes": transcript_bytes,
+            "promptPath": "",
+            "promptBytes": 0,
+            "transcriptToPromptRatio": None,
+        }
+    try:
+        prompt_bytes = prompt_path.stat().st_size
+    except OSError:
+        prompt_bytes = 0
+    ratio = (
+        round(transcript_bytes / prompt_bytes, 2)
+        if prompt_bytes > 0
+        else None
+    )
+    return {
+        "transcriptPath": str(log_path),
+        "transcriptBytes": transcript_bytes,
+        "promptPath": str(prompt_path),
+        "promptBytes": prompt_bytes,
+        "transcriptToPromptRatio": ratio,
+    }
+
+
 def scan_logs(logs_root: Path, project_root: Path, top: int = 20) -> dict:
     project_id = _project_id(project_root)
     files: list[dict] = []
@@ -68,16 +96,27 @@ def scan_logs(logs_root: Path, project_root: Path, top: int = 20) -> dict:
                 continue
             meta = _parse(parts, p.stem)
             tk = f"{project_id}:{meta['taskGroup']}:{meta['taskId']}" if meta["taskGroup"] else ""
-            files.append({"path": str(p), "sizeBytes": size, "mtimeEpoch": mtime,
-                          "taskKey": tk, **meta})
+            files.append({
+                "path": str(p),
+                "sizeBytes": size,
+                "mtimeEpoch": mtime,
+                "taskKey": tk,
+                **meta,
+                **_prompt_pair(p, size),
+            })
     files.sort(key=lambda f: f["sizeBytes"], reverse=True)
     return {
         "logsRoot": str(logs_root),
         "topLargest": files[:top],
         "perTask": _per_task(files),
-        "totals": {"fileCount": len(files),
-                   "totalBytes": sum(f["sizeBytes"] for f in files),
-                   "taskCount": len({f["taskKey"] for f in files if f["taskKey"]})},
+        "totals": {
+            "fileCount": len(files),
+            "totalBytes": sum(f["sizeBytes"] for f in files),
+            "taskCount": len({f["taskKey"] for f in files if f["taskKey"]}),
+            "promptBytes": sum(f["promptBytes"] for f in files),
+            "transcriptBytes": sum(f["transcriptBytes"] for f in files),
+            "pairedFileCount": sum(1 for f in files if f["promptPath"]),
+        },
     }
 
 

package/runtime/python/okstra_ctl/path_hints.py

@@ -59,6 +59,7 @@ def compact_active_run_context(
         "inputs": _compact_active_inputs(payload),
         "workers": _compact_active_workers(payload),
         "executorWorktree": dict(_mapping(payload.get("executorWorktree"))),
+        "verificationTarget": dict(_mapping(payload.get("verificationTarget"))),
         "lazyReadPlan": dict(_mapping(payload.get("lazyReadPlan"))),
     }
 
@@ -99,6 +100,7 @@ def hydrate_active_run_context(payload: Mapping[str, Any]) -> dict[str, Any]:
             "codingPreflightDir": ctx.get("OKSTRA_CODING_PREFLIGHT_DIR", ""),
         },
         "executorWorktree": dict(_mapping(payload.get("executorWorktree"))),
+        "verificationTarget": dict(_mapping(payload.get("verificationTarget"))),
         "sourceArtifacts": _hydrate_active_source_artifacts(ctx),
         "lazyReadPlan": dict(_mapping(payload.get("lazyReadPlan"))),
     }
@@ -190,6 +192,7 @@ def _hydrate_active_instruction_set(
     clarification_response = ""
     if inputs.get("hasClarificationResponse"):
         clarification_response = f"{instruction_set}/clarification-response.md"
+    target = _mapping(payload.get("verificationTarget"))
     return {
         "path": instruction_set,
         "analysisPacketPath": ctx.get("ANALYSIS_PACKET_RELATIVE_PATH", ""),
@@ -200,6 +203,8 @@ def _hydrate_active_instruction_set(
         "clarificationResponsePath": clarification_response,
         "finalReportTemplatePath": ctx.get("FINAL_REPORT_TEMPLATE_RELATIVE_PATH", ""),
         "finalReportSchemaPath": ctx.get("FINAL_REPORT_SCHEMA_RELATIVE_PATH", ""),
+        "verificationTargetPath": str(target.get("path") or ""),
+        "verificationTargetDigest": str(target.get("digest") or ""),
     }
 
 

package/runtime/python/okstra_ctl/render.py

@@ -354,6 +354,8 @@ def _active_instruction_set(ctx: dict) -> dict:
         "clarificationResponsePath": clarification,
         "finalReportTemplatePath": ctx.get("FINAL_REPORT_TEMPLATE_RELATIVE_PATH", ""),
         "finalReportSchemaPath": ctx.get("FINAL_REPORT_SCHEMA_RELATIVE_PATH", ""),
+        "verificationTargetPath": ctx.get("VERIFICATION_TARGET_RELATIVE_PATH", ""),
+        "verificationTargetDigest": ctx.get("VERIFICATION_TARGET_DIGEST", ""),
     }
 
 
@@ -387,6 +389,19 @@ def _active_executor_worktree(ctx: dict) -> dict:
     }
 
 
+def _active_verification_target(ctx: dict) -> dict:
+    if ctx.get("TASK_TYPE") != "final-verification":
+        return {}
+    return {
+        "scope": ctx.get("VERIFICATION_SCOPE", ""),
+        "worktreePath": ctx.get("VERIFICATION_WORKTREE_PATH", ""),
+        "baseRef": ctx.get("VERIFICATION_BASE_REF", ""),
+        "headRef": ctx.get("VERIFICATION_HEAD_REF", ""),
+        "path": ctx.get("VERIFICATION_TARGET_RELATIVE_PATH", ""),
+        "digest": ctx.get("VERIFICATION_TARGET_DIGEST", ""),
+    }
+
+
 def _active_source_artifacts(ctx: dict) -> dict:
     return {
         "taskManifestPath": ctx.get("TASK_MANIFEST_RELATIVE_PATH", ""),
@@ -429,6 +444,7 @@ def render_active_run_context(active_context_path: str, ctx: dict) -> None:
         "errorLogs": _active_error_logs(ctx),
         "runtimeResources": _active_runtime_resources(ctx),
         "executorWorktree": _active_executor_worktree(ctx),
+        "verificationTarget": _active_verification_target(ctx),
         "sourceArtifacts": _active_source_artifacts(ctx),
         "lazyReadPlan": _active_lazy_read_plan(),
     }
@@ -1053,6 +1069,10 @@ def render_task_manifest(manifest_path: str, ctx: dict) -> None:
             "analysisMaterialPath": ctx.get("INSTRUCTION_SET_RELATIVE_PATH", "")
             + "/analysis-material.md",
             "analysisPacketPath": ctx.get("ANALYSIS_PACKET_RELATIVE_PATH", ""),
+            "verificationTargetPath": ctx.get(
+                "VERIFICATION_TARGET_RELATIVE_PATH", ""
+            ),
+            "verificationTargetDigest": ctx.get("VERIFICATION_TARGET_DIGEST", ""),
             "taskBriefCopyPath": ctx.get("INSTRUCTION_SET_RELATIVE_PATH", "")
             + "/task-brief.md",
             "referenceExpectationsPath": ctx.get(
@@ -1278,6 +1298,8 @@ def render_run_manifest(run_manifest_path: str, ctx: dict) -> None:
         "teamStatePath": ctx.get("TEAM_STATE_RELATIVE_PATH", ""),
         "activeRunContextPath": ctx.get("ACTIVE_RUN_CONTEXT_RELATIVE_PATH", ""),
         "analysisPacketPath": ctx.get("ANALYSIS_PACKET_RELATIVE_PATH", ""),
+        "verificationTargetPath": ctx.get("VERIFICATION_TARGET_RELATIVE_PATH", ""),
+        "verificationTargetDigest": ctx.get("VERIFICATION_TARGET_DIGEST", ""),
         "workerResultsDirectoryPath": ctx.get("WORKER_RESULTS_RELATIVE_PATH", ""),
         "reportTemplatePath": ctx.get("FINAL_REPORT_TEMPLATE_RELATIVE_PATH", ""),
         "validatorScriptPath": ctx.get("RUN_VALIDATOR_RELATIVE_PATH", ""),

package/runtime/python/okstra_ctl/run.py

@@ -16,6 +16,7 @@ state passing, and are read once at the start.
 from __future__ import annotations
 
 import importlib.util
+import hashlib
 import json
 import os
 import re
@@ -100,6 +101,7 @@ from . import implementation_stage as _implementation_stage
 from .stage_reconcile import (
     auto_reconcile_best_effort as _stage_auto_reconcile_best_effort,
 )
+from .work_categories import resolve_work_category
 from .worktree import (
     WorktreeProvision,
     provision_task_worktree,
@@ -1578,20 +1580,70 @@ def _reserve_final_verification_target(
 
     diff_stat = _git_out(target.worktree_path, "diff", "--stat",
                          f"{target.base}..{target.head}")
+    ctx["VERIFICATION_SCOPE"] = target.scope
+    ctx["VERIFICATION_WORKTREE_PATH"] = target.worktree_path
+    ctx["VERIFICATION_BASE_REF"] = target.base
+    ctx["VERIFICATION_HEAD_REF"] = target.head
+    ctx["VERIFICATION_TARGET"] = _format_verification_target(target, diff_stat)
+
+
+def _format_verification_target(
+    target: _stage_targets.FinalVerificationTarget,
+    diff_stat: str,
+) -> str:
     reports = "\n".join(
         f"  - stage {s}: `{rp or '(report_path unrecorded)'}`"
         for s, rp in zip(target.stages, target.reports)
     )
-    ctx["VERIFICATION_TARGET"] = (
+    return (
         f"- **Verification scope:** `{target.scope}`\n"
         f"- **Worktree:** `{target.worktree_path}`\n"
         f"- **Verification base ref:** `{target.base}`\n"
+        f"- **Verification head ref:** `{target.head}`\n"
         f"- **Stages under verification:** {target.stages}\n"
         f"- **Source implementation reports:**\n{reports}\n"
         f"- **Verification diff stat:**\n```\n{diff_stat}\n```"
     )
 
 
+def write_verification_target_snapshot(
+    instruction_set: Path,
+    target_markdown: str,
+) -> tuple[Path, str]:
+    """Persist one normalized final-verification target and return its digest."""
+    normalized = target_markdown.replace("\r\n", "\n").replace("\r", "\n")
+    normalized = normalized.rstrip() + "\n"
+    digest = "sha256:" + hashlib.sha256(normalized.encode("utf-8")).hexdigest()
+    path = instruction_set / "verification-target.md"
+    path.write_text(
+        normalized + f"- **Verification target digest:** `{digest}`\n",
+        encoding="utf-8",
+    )
+    return path, digest
+
+
+def _write_verification_target_artifact(
+    inp: PrepareInputs,
+    ctx: dict,
+    instruction_set: Path,
+) -> None:
+    if inp.task_type != "final-verification":
+        return
+    target_markdown = str(ctx.get("VERIFICATION_TARGET") or "")
+    if not target_markdown:
+        raise PrepareError("final-verification target snapshot is missing")
+    target_path, target_digest = write_verification_target_snapshot(
+        instruction_set,
+        target_markdown,
+    )
+    ctx["VERIFICATION_TARGET_PATH"] = str(target_path)
+    ctx["VERIFICATION_TARGET_RELATIVE_PATH"] = (
+        f"{ctx['INSTRUCTION_SET_RELATIVE_PATH']}/verification-target.md"
+    )
+    ctx["VERIFICATION_TARGET_DIGEST"] = target_digest
+    ctx["VERIFICATION_TARGET"] = target_path.read_text(encoding="utf-8")
+
+
 def _write_instruction_set_sources(
     inp: PrepareInputs, ctx: dict, profile_content: str, review_material: str
 ) -> Path:
@@ -1599,6 +1651,7 @@ def _write_instruction_set_sources(
     reference-expectations 를 기록하고 디렉터리 경로를 돌려준다."""
     instruction_set = Path(ctx["INSTRUCTION_SET_PATH"])
     instruction_set.mkdir(parents=True, exist_ok=True)
+    _write_verification_target_artifact(inp, ctx, instruction_set)
     profile_rendered = profile_content
     if inp.task_type == "implementation":
         profile_rendered += "\n\n{{DESIGN_PREP_CONTEXT}}\n\n{{FIX_RUN_CONTEXT}}"
@@ -1950,6 +2003,16 @@ def prepare_task_bundle(inp: PrepareInputs) -> PrepareOutputs:
     task_id_segment = slugify(inp.task_id)
     task_key = f"{inp.project_id}:{inp.task_group}:{inp.task_id}"
 
+    # Worktree branch namespace, workflow state and every rendered manifest read
+    # the same resolved value, so a phase invoked without --work-category still
+    # lands on the branch namespace the task was classified with.
+    inp.work_category = resolve_work_category(
+        inp.work_category,
+        project_root=project_root,
+        task_group=inp.task_group,
+        task_id=inp.task_id,
+    )
+
     # ---- task worktree provisioning (every phase, every task-type) ----
     # One worktree per task-key: requirements-discovery, error-analysis,
     # implementation-planning and implementation phases of the same task
@@ -2371,7 +2434,8 @@ def main(argv: list[str]) -> int:
         help=(
             "Work-category classification for this task "
             "(bugfix / feature / refactor / ops / improvement). "
-            "Falls back to `unknown` when omitted."
+            "When omitted, falls back to the category already recorded in "
+            "task-manifest.json, then to `feature`."
         ),
     )
     p.add_argument(

package/runtime/python/okstra_ctl/wizard.py

@@ -85,6 +85,7 @@ from okstra_ctl.worktree import (
     preview_worktree_decision,
 )
 from okstra_ctl.paths import task_dir, task_runs_dir
+from okstra_ctl.work_categories import resolve_work_category
 from okstra_ctl.run_context import latest_run_inputs
 from okstra_project.dirs import project_json_path
 from okstra_project.state import (
@@ -3126,6 +3127,17 @@ def _submit_fix_cycle_confirm(state: WizardState, value: str) -> Optional[str]:
     return f"fix-cycle: {v}"
 
 
+def _preview_work_category(state: WizardState) -> str:
+    """okstra-run 경로는 --work-category 를 넘기지 않는다. prepare 가 쓰는 것과
+    같은 resolver 를 태워야 미리보기 브랜치명이 실제 생성 브랜치와 일치한다."""
+    return resolve_work_category(
+        "",
+        project_root=Path(state.project_root),
+        task_group=state.task_group,
+        task_id=state.task_id,
+    )
+
+
 def _worktree_preview_line(state: WizardState) -> Optional[str]:
     """confirm 직전 요약 블록에 넣을 worktree 미리보기 한 줄.
     final-verification 은 stage worktree 를 읽기 전용 재사용하므로 None."""
@@ -3138,9 +3150,7 @@ def _worktree_preview_line(state: WizardState) -> Optional[str]:
         project_id=state.project_id,
         task_group_segment=state.task_group,
         task_id_segment=state.task_id,
-        # okstra-run 경로는 --work-category 를 넘기지 않으므로 provision 도 ""(→ "task-" prefix)로
-        # 브랜치를 만든다. 이 미리보기 브랜치명은 실제 생성 브랜치와 정확히 일치한다.
-        work_category="",
+        work_category=_preview_work_category(state),
         base_ref=state.base_ref,
     )
     key = {
@@ -3167,7 +3177,8 @@ def _worktree_preview_line_impl(state: WizardState) -> str:
                     path=str(parent_dir))
     decision = preview_stage_worktree_decision(
         project_id=state.project_id, task_group_segment=state.task_group,
-        task_id_segment=state.task_id, work_category="",
+        task_id_segment=state.task_id,
+        work_category=_preview_work_category(state),
         stage_number=int(stage),
     )
     key = ("worktree_impl_reuse" if decision.status == "reused"

package/runtime/python/okstra_ctl/work_categories.py

@@ -8,6 +8,11 @@ profile / validators / wizard 는 이 모듈에서 enum 을 import 해야 한다
 """
 from __future__ import annotations
 
+import json
+from pathlib import Path
+
+from .paths import task_dir
+
 WORK_CATEGORIES: tuple[str, ...] = (
     "bugfix",
     "feature",
@@ -16,6 +21,38 @@ WORK_CATEGORIES: tuple[str, ...] = (
     "improvement",
 )
 
+DEFAULT_WORK_CATEGORY = "feature"
+
 
 def is_valid_category(value: str) -> bool:
     return value in WORK_CATEGORIES
+
+
+def recorded_work_category(project_root: Path, task_group: str, task_id: str) -> str:
+    """task-manifest.json 에 이미 기록된 work-category. 없거나 enum 밖이면 ""."""
+    manifest = task_dir(project_root, task_group, task_id) / "task-manifest.json"
+    try:
+        data = json.loads(manifest.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return ""
+    value = str(data.get("workCategory") or "").strip()
+    return value if is_valid_category(value) else ""
+
+
+def resolve_work_category(
+    explicit: str, *, project_root: Path, task_group: str, task_id: str
+) -> str:
+    """이번 run 이 실제로 쓸 work-category: 명시값 → task 에 기록된 분류 →
+    DEFAULT_WORK_CATEGORY.
+
+    requirements-discovery 가 분류를 task-manifest 에 기록해두면 이후 phase 는
+    `--work-category` 없이 실행돼도 같은 branch namespace 로 수렴한다. 어느 쪽도
+    없을 때 `unknown`(→ `task/` 접두) 대신 기본 분류로 떨어뜨린다.
+    """
+    value = (explicit or "").strip()
+    if value:
+        return value
+    return (
+        recorded_work_category(project_root, task_group, task_id)
+        or DEFAULT_WORK_CATEGORY
+    )

package/runtime/python/okstra_ctl/worker_prompt_contract.py

@@ -0,0 +1,223 @@
+"""Compact initial final-verification prompt contract."""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Mapping
+
+
+MAX_FINAL_VERIFICATION_DIRECTIVE_LINES = 40
+MAX_FINAL_VERIFICATION_BODY_LINES = 96
+
+_DIRECTIVE_HEADING = "## Run-specific directive"
+_PRIMARY_PACKET_RE = re.compile(
+    r"(?im)^-\s+Primary analysis packet:\s+`[^`\n]*analysis-packet\.md`\s*$"
+)
+_COPIED_SECTION_PATTERNS = (
+    ("Primary focus areas", re.compile(r"(?im)^(?:#{1,6}\s+|-\s+)Primary focus areas\b")),
+    (
+        "Required deliverable shape",
+        re.compile(r"(?im)^(?:#{1,6}\s+|-\s+)Required deliverable shape\b"),
+    ),
+    (
+        "Self-review pass",
+        re.compile(r"(?im)^(?:#{1,6}\s+|-\s+)Self-review pass\b"),
+    ),
+)
+_NON_BODY_PREFIXES = (
+    "**Project Root:**",
+    "**Prompt History Path:**",
+    "**Result Path:**",
+    "Assigned worker prompt history path:",
+    "**Worker Preamble Path:**",
+    "**Errors log path:**",
+    "**Errors sidecar path:**",
+    "**Read scope:**",
+    "**Worktree:**",
+    "**Verification scope:**",
+    "**Verification base ref:**",
+    "**Verification head ref:**",
+    "**Verification target path:**",
+    "**Verification target digest:**",
+)
+_REQUIRED_TARGET_PREFIXES = (
+    "**Worktree:**",
+    "**Verification scope:**",
+    "**Verification base ref:**",
+    "**Verification head ref:**",
+    "**Verification target path:**",
+    "**Verification target digest:**",
+)
+_WORKER_SPECIFIC_PREFIXES = (
+    "**Prompt History Path:**",
+    "**Result Path:**",
+    "Assigned worker prompt history path:",
+    "**Errors sidecar path:**",
+    "**Worker Result Path:**",
+    "**Model:**",
+    "**Pane role:**",
+)
+_WORKER_LABEL_RE = re.compile(
+    r"\b(?:Claude|Codex|Antigravity) worker\b",
+    re.IGNORECASE,
+)
+
+
+def validate_final_verification_initial_prompt(text: str) -> list[str]:
+    """Return deterministic compact-prompt contract violations."""
+    errors: list[str] = []
+    _reject_literal(
+        text,
+        "**Coding preflight pack:**",
+        "Coding preflight pack is forbidden for final-verification",
+        errors,
+    )
+    _reject_literal(
+        text,
+        "**Verification diff stat:**",
+        "inline Verification diff stat is forbidden; use verification-target.md",
+        errors,
+    )
+    _reject_literal(
+        text,
+        "## Source / fallback paths",
+        "Source / fallback paths is forbidden; use analysis-packet.md",
+        errors,
+    )
+    for label, pattern in _COPIED_SECTION_PATTERNS:
+        if pattern.search(text):
+            errors.append(f"copied {label} section is forbidden; use analysis-packet.md")
+    _validate_compact_target_identity(text, errors)
+    packet_count = len(_PRIMARY_PACKET_RE.findall(text))
+    if packet_count != 1:
+        errors.append(
+            "exactly one Primary analysis packet path is required "
+            f"(found {packet_count})"
+        )
+    directive_count = text.count(_DIRECTIVE_HEADING)
+    if directive_count > 1:
+        errors.append("at most one Run-specific directive section is allowed")
+    if directive_count == 1:
+        directive_lines = _directive_nonblank_lines(text)
+        if directive_lines > MAX_FINAL_VERIFICATION_DIRECTIVE_LINES:
+            errors.append(
+                "Run-specific directive exceeds "
+                f"{MAX_FINAL_VERIFICATION_DIRECTIVE_LINES} nonblank lines "
+                f"(found {directive_lines})"
+            )
+    body_lines = _body_nonblank_lines(text)
+    if body_lines > MAX_FINAL_VERIFICATION_BODY_LINES:
+        errors.append(
+            f"prompt body exceeds {MAX_FINAL_VERIFICATION_BODY_LINES} "
+            f"nonblank lines (found {body_lines})"
+        )
+    return errors
+
+
+def normalise_analysis_prompt(text: str) -> str:
+    """Remove only permitted worker identity, model, role, and path deltas."""
+    normalized: list[str] = []
+    for line in text.replace("\r\n", "\n").replace("\r", "\n").splitlines():
+        stripped = line.strip()
+        prefix = next(
+            (candidate for candidate in _WORKER_SPECIFIC_PREFIXES if stripped.startswith(candidate)),
+            "",
+        )
+        if prefix:
+            normalized.append(f"{prefix} <worker-specific>")
+            continue
+        normalized.append(_WORKER_LABEL_RE.sub("<analysis-worker>", line.rstrip()))
+    return "\n".join(normalized).strip() + "\n"
+
+
+def validate_analysis_prompt_set(prompts: Mapping[str, str]) -> list[str]:
+    """Require byte-identical normalized bodies for initial analysis workers."""
+    if len(prompts) < 2:
+        return []
+    normalized = {
+        worker_id: normalise_analysis_prompt(text)
+        for worker_id, text in sorted(prompts.items())
+    }
+    baseline_worker = next(iter(normalized))
+    baseline = normalized[baseline_worker]
+    different = [
+        worker_id
+        for worker_id, body in normalized.items()
+        if body != baseline
+    ]
+    if not different:
+        return []
+    workers = ", ".join([baseline_worker, *different])
+    return [f"normalized initial analysis prompts differ across workers: {workers}"]
+
+
+def validate_final_verification_prompt_paths(
+    prompt_paths: Mapping[str, Path],
+) -> list[str]:
+    """Validate persisted initial prompts and their normalized equality."""
+    prompts: dict[str, str] = {}
+    errors: list[str] = []
+    for worker_id, path in sorted(prompt_paths.items()):
+        try:
+            text = path.read_text(encoding="utf-8")
+        except OSError as exc:
+            errors.append(f"{worker_id}: cannot read prompt {path}: {exc}")
+            continue
+        prompts[worker_id] = text
+        errors.extend(
+            f"{worker_id}: {error}"
+            for error in validate_final_verification_initial_prompt(text)
+        )
+    errors.extend(validate_analysis_prompt_set(prompts))
+    return errors
+
+
+def _reject_literal(
+    text: str,
+    literal: str,
+    message: str,
+    errors: list[str],
+) -> None:
+    if literal in text:
+        errors.append(message)
+
+
+def _validate_compact_target_identity(text: str, errors: list[str]) -> None:
+    stripped_lines = [line.strip() for line in text.splitlines()]
+    for prefix in _REQUIRED_TARGET_PREFIXES:
+        matches = [line for line in stripped_lines if line.startswith(prefix)]
+        if len(matches) != 1 or not matches[0][len(prefix):].strip():
+            errors.append(f"exactly one non-empty {prefix} header is required")
+    scope_line = next(
+        (line for line in stripped_lines if line.startswith("**Verification scope:**")),
+        "",
+    )
+    scope = scope_line.removeprefix("**Verification scope:**").strip()
+    if scope and scope not in {"whole-task", "single-stage"}:
+        errors.append("Verification scope must be whole-task or single-stage")
+    digest_line = next(
+        (
+            line
+            for line in stripped_lines
+            if line.startswith("**Verification target digest:**")
+        ),
+        "",
+    )
+    digest = digest_line.removeprefix("**Verification target digest:**").strip()
+    if digest and not re.fullmatch(r"sha256:[0-9a-f]{64}", digest):
+        errors.append("Verification target digest must be sha256:<64 lowercase hex>")
+
+
+def _directive_nonblank_lines(text: str) -> int:
+    section = text.split(_DIRECTIVE_HEADING, 1)[1]
+    section = re.split(r"(?m)^##\s+", section, maxsplit=1)[0]
+    return sum(1 for line in section.splitlines() if line.strip())
+
+
+def _body_nonblank_lines(text: str) -> int:
+    return sum(
+        1
+        for line in text.splitlines()
+        if line.strip()
+        and not any(line.strip().startswith(prefix) for prefix in _NON_BODY_PREFIXES)
+    )

package/runtime/python/okstra_ctl/worker_prompt_headers.py

@@ -41,19 +41,48 @@ def worker_prompt_headers(
 ) -> list[str]:
     """Render the team-contract worker prompt anchor headers."""
     prompt_path = _resolve_project_path(project_root, prompt_rel)
-    return [
+    headers = [
         f"**Project Root:** {project_root}",
         f"**Prompt History Path:** {prompt_rel}",
         f"**Result Path:** {result_rel}",
         f"Assigned worker prompt history path: {prompt_path}",
         f"**Worker Preamble Path:** {_worker_preamble_path()}",
-        f"**Coding preflight pack:** {_coding_preflight_pack_path(active_context)}",
+    ]
+    if _string_value(manifest.get("taskType")) == "implementation":
+        headers.append(
+            f"**Coding preflight pack:** {_coding_preflight_pack_path(active_context)}"
+        )
+    headers.extend([
         f"**Errors log path:** {_errors_log_path(project_root, manifest, active_context)}",
         (
             f"**Errors sidecar path:** "
             f"{_worker_errors_sidecar_path(project_root, manifest, active_context, worker_id)}"
         ),
         READ_SCOPE_HEADER,
+    ])
+    if _string_value(manifest.get("taskType")) == "final-verification":
+        headers.extend(_final_verification_target_headers(active_context))
+    return headers
+
+
+def _final_verification_target_headers(
+    active_context: Mapping[str, Any],
+) -> list[str]:
+    target = active_context.get("verificationTarget")
+    if not isinstance(target, Mapping):
+        return []
+    fields = (
+        ("Worktree", "worktreePath"),
+        ("Verification scope", "scope"),
+        ("Verification base ref", "baseRef"),
+        ("Verification head ref", "headRef"),
+        ("Verification target path", "path"),
+        ("Verification target digest", "digest"),
+    )
+    return [
+        f"**{label}:** {_string_value(target.get(key))}"
+        for label, key in fields
+        if _string_value(target.get(key))
     ]
 
 

package/runtime/templates/worker-prompt-preamble.md

@@ -91,30 +91,37 @@ If a required header line is absent from the dispatch prompt, return `<SENTINEL_
 
 ## Anchor headers (lead-injected, BLOCKING)
 
-Every worker prompt MUST begin with these anchor headers, in this exact order, before any other content. Workers extract them verbatim.
+Every initial worker prompt MUST begin with the common anchor headers below in this exact order, before any other content. An `implementation` prompt inserts the implementation-only coding-preflight anchor at the documented position. Workers extract the anchors verbatim.
 
 1. `**Project Root:** <absolute-path>` — required so the worker can self-anchor without relying on inherited cwd.
 2. `**Prompt History Path:** <project-relative-path>`
 3. `**Result Path:** <project-relative-path>` — canonical destination for the worker's result file.
 4. `Assigned worker prompt history path: <absolute-path>` — same as the prompt-history path but resolved against `Project Root`. Codex / Antigravity wrapper subagents extract this exact line.
 5. `**Worker Preamble Path:** <absolute-path>` — points to THIS file. Workers Read it end-to-end before doing anything else.
-6. `**Coding preflight pack:** <absolute-path>` — points to the installed runtime resource pack under `<OKSTRA_HOME>/prompts/coding-preflight`. Implementation executors and verifiers use this to read `overview.md`, `clean-code.md`, and routed language/framework/architecture resources. Other worker roles may ignore it.
+6. `**Coding preflight pack:** <absolute-path>` — implementation-only; points to the installed runtime resource pack under `<OKSTRA_HOME>/prompts/coding-preflight`. It is present only when `taskType == implementation` and is absent from every non-implementation initial prompt. Implementation executors and implementation verifiers use it to read `overview.md`, `clean-code.md`, and routed language/framework/architecture resources. A pane display role named `verifier` does not activate this anchor in `final-verification`.
 7. `**Errors log path:** <absolute-path>` — run-level JSONL (see Error reporting above).
 8. `**Errors sidecar path:** <absolute-path>` — per-worker JSON (see Error reporting above).
 9. `**Read scope:** …` — restates the *Reading rules* allowlist inline. This file is anchor 5, a path the worker opens partway into its run; by then a host SessionStart hook or a global `CLAUDE.md` / `AGENTS.md` project-conditional has already pointed it at `graphify-out/`, skill catalogs, and similar non-okstra artifacts. Only the inline copy arrives before the worker's first tool call.
 
-**Exception — reverify dispatches.** A Phase 5.5 re-verification prompt (its `**Prompt History Path:**` carries a `-reverify-r<N>-` segment) deliberately omits anchors 5 and 6 and adds a `**Model:**` line — lightweight mode reads neither this file nor the preflight pack. The two errors-path anchors are NOT omitted; that gate applies to reverify prompts unchanged. The reverify anchor set is owned by `prompts/lead/convergence.md` "Required reverify-prompt anchor headers".
+**Exception — reverify dispatches.** A Phase 5.5 re-verification prompt (its `**Prompt History Path:**` carries a `-reverify-r<N>-` segment) deliberately omits anchor 5 and adds a `**Model:**` line — lightweight mode reads neither this file nor the implementation-only preflight pack. The two errors-path anchors are NOT omitted; that gate applies to reverify prompts unchanged. The reverify anchor set is owned by `prompts/lead/convergence.md` "Required reverify-prompt anchor headers".
 
 For the **implementation phase** specifically, the dispatched prompt MUST also include:
 
 - `**Worktree:** <absolute-path>` — the task worktree path.
 - `cwd for every mutating command: <absolute-path>` — same as Worktree path; used by codex / antigravity wrappers as `--add-dir` / `--include-directories`.
 
-For the **final-verification phase** specifically, the dispatched prompt MUST also include the verification target snapshot so every analyser verifies the SAME target the lead captured at the entry gate:
+For the **final-verification phase** specifically, the dispatched prompt MUST include the compact identity of the canonical verification-target sidecar so every analyser verifies the SAME target the lead captured at the entry gate:
 
 - `**Worktree:** <absolute-path>` — the checkout under verification (read-only).
+- `**Verification scope:** <whole-task|single-stage>` — the selected verification mode.
 - `**Verification base ref:** <base-ref>` — the implementation base for the diff.
-- `**Verification diff stat:** <git diff --stat output>` — the captured diff-stat that bounds the verification scope.
+- `**Verification head ref:** <head-ref>` — the exact delivered revision under verification.
+- `**Verification target path:** <project-relative-path>` — the canonical `instruction-set/verification-target.md` sidecar containing stages, source reports, and the complete captured diff stat.
+- `**Verification target digest:** sha256:<digest>` — the digest over the normalized snapshot body.
+
+Read the sidecar on demand when the full stage/report mapping or diff stat is needed. Do not copy its `Verification diff stat` block into the dispatch prompt.
+
+The initial analysis prompt may contain exactly one `## Run-specific directive` section only when the run has a shared delta not already captured by the packet. The section applies unchanged to every selected analysis worker and is limited to 40 nonblank lines. If it would be longer, the lead writes the shared material into the instruction set and adds its common reference to `analysis-packet.md`; workers must not accept provider-, model-, or worker-specific verification scopes.
 
 For the **improvement-discovery phase** specifically, the dispatched prompt MUST also include the resolved-scope log the lead wrote during Phase 1.5, so workers key off an explicit absolute path instead of re-deriving the run directory:
 

package/runtime/validators/validate-run.py

@@ -58,6 +58,9 @@ from okstra_ctl.design_surfaces import (  # noqa: E402
     detect_design_surfaces,
     expected_prep_plan_item_id,
 )
+from okstra_ctl.worker_prompt_contract import (  # noqa: E402
+    validate_final_verification_prompt_paths,
+)
 
 TERMINAL_STATUSES = {"completed", "timeout", "error", "not-run"}
 ATTEMPTED_STATUSES = {"completed", "timeout", "error"}
@@ -367,6 +370,48 @@ def effective_run_task_type(run_manifest: dict, task_manifest: dict) -> str:
     ).strip()
 
 
+def _validate_final_verification_initial_prompts(
+    data: dict,
+    failures: list[str],
+) -> None:
+    """Validate the selected initial analysis prompts persisted for the run."""
+    if data.get("taskType") != "final-verification":
+        return
+
+    run_manifest = data.get("runManifest") or {}
+    team_contract = run_manifest.get("teamContract") or {}
+    selected_workers = team_contract.get("requiredWorkerRoles") or []
+    selected_ids = {
+        str(worker.get("workerId") or "").strip()
+        for worker in selected_workers
+        if isinstance(worker, dict)
+    }
+    project_root = Path(data["projectRoot"])
+    team_state = data.get("teamState") or {}
+    prompt_paths: dict[str, Path] = {}
+    for worker in team_state.get("workers") or []:
+        if not isinstance(worker, dict):
+            continue
+        worker_id = str(worker.get("workerId") or "").strip()
+        prompt_value = str(worker.get("promptPath") or "").strip()
+        if (
+            worker_id not in selected_ids
+            or worker_id == "report-writer"
+            or not prompt_value
+            or "-reverify-r" in Path(prompt_value).name
+        ):
+            continue
+        prompt_path = Path(prompt_value)
+        prompt_paths[worker_id] = (
+            prompt_path if prompt_path.is_absolute() else project_root / prompt_path
+        )
+
+    errors = validate_final_verification_prompt_paths(prompt_paths)
+    failures.extend(
+        f"final-verification prompt contract: {error}" for error in errors
+    )
+
+
 def _is_legal_concurrent_run_skip(
     team_create: object, concurrent_run_authorized: bool
 ) -> bool:
@@ -3524,6 +3569,15 @@ def main() -> int:
     # contain every required section. Substring checks below are a
     # safety net for hand-edited or pre-v1.0 reports.
     task_type = effective_run_task_type(run_manifest, task_manifest)
+    _validate_final_verification_initial_prompts(
+        {
+            "taskType": task_type,
+            "projectRoot": project_root,
+            "runManifest": run_manifest,
+            "teamState": team_state,
+        },
+        failures,
+    )
     report_contracts = _normalize_report_contracts(
         run_manifest.get("reportContracts")
     )

package/src/commands/inspect/log-report.mjs

@@ -6,9 +6,11 @@ Usage:
   okstra log-report [--project-root <dir>] [--cwd <dir>] [--top <N>] [--json]
 
 Output: JSON { ok, projectRoot, logsRoot, topLargest[], perTask[], totals }.
-Scans <project-root>/.okstra/tasks/**/runs/*/prompts/*.log. Sizes are raw bytes
-and mtimes are epoch seconds — the caller formats KB/MB and ages. Read-only: it
-never deletes logs (cleanup commands stay in the skill).
+Scans <project-root>/.okstra/tasks/**/runs/*/prompts/*.log. Each entry reports
+the wrapper transcript as transcriptBytes and its sibling prompt Markdown as
+promptBytes; sizeBytes remains the transcript-size compatibility field. Sizes
+are raw bytes and mtimes are epoch seconds — the caller formats KB/MB and ages.
+Read-only: it never deletes logs (cleanup commands stay in the skill).
 `;
 
 export async function run(args) {