okstra 0.145.0 → 0.146.0

package/runtime/skills/okstra-setup/references/project-config.md

@@ -121,7 +121,7 @@ and `validators/validate-run.py::_validate_conformance`.
   over-narrow one lets an undeclared surface through — tune to the repo's real
   db/http/io file naming.
 
-## C. Project-local Claude settings symlink (automatic — diagnostics only)
+## C. Project-local Claude settings symlink and workspace trust
 
 `okstra setup` (and `okstra run` on its first invocation per project)
 provisions `<PROJECT_ROOT>/.claude/settings.local.json` as a symlink to
@@ -131,9 +131,18 @@ permission rules required for the codex/antigravity worker wrappers:
 - `Bash($HOME/.okstra/bin/okstra-codex-exec.sh:*)`
 - `Bash($HOME/.okstra/bin/okstra-antigravity-exec.sh:*)`
 
-Claude Code automatically loads `.claude/settings.local.json` inside that
-project, so okstra workers dispatched from **any** Claude Code session are
-allowed to run their wrapper scripts without further configuration.
+Claude Code loads `.claude/settings.local.json` inside that project after the
+project has been trusted. When setup creates this file during an already-open
+Claude Code session, newly dispatched worker processes can each encounter the
+workspace-trust prompt before that host session has accepted the project.
+
+`/okstra-run` therefore checks the **host runtime** before starting its wizard.
+For a Claude Code host with pending trust, it stops before any worker dispatch
+and asks the user to close the session, reopen the project, accept the single
+workspace-trust prompt, and rerun `/okstra-run`. This is not a per-worker or
+per-provider approval: selecting Claude, Codex, or Antigravity workers does not
+change the host-runtime check. Codex and external hosts do not read Claude Code
+workspace state.
 
 If a non-symlink `.claude/settings.local.json` already exists, setup backs it
 up to `.claude/settings.local.json.bak.<timestamp>` before installing the

package/runtime/validators/lib/fixtures.sh

@@ -501,7 +501,7 @@ if lead_sid:
             progress_lines.append(
                 f"PROGRESS: phase-5-collect worker={worker_id}-worker status=completed"
             )
-    progress_lines.append("PROGRESS: phase-batch-cleanup panes=1 teammates=1")
+    progress_lines.append("PROGRESS: phase-batch-cleanup panes=1")
     progress_lines.append("PROGRESS: phase-6-synthesis dispatching report-writer-worker")
     progress_lines.append("PROGRESS: phase-7-persist updating manifests")
     records = [

package/runtime/validators/validate-run.py

@@ -566,7 +566,7 @@ def _grilling_log_path_from_prompts(
             continue
         try:
             text = record.path.read_text(encoding="utf-8")
-        except OSError:
+        except (OSError, UnicodeError):
             continue
         matches = [
             line.strip()[len(header):].strip().strip("`")
@@ -6354,6 +6354,52 @@ def _validate_forbidden_actions(
     failures.extend(f"forbidden-action: {v}" for v in violations)
 
 
+_PHASE_BOUNDARY_ERROR_MARKERS = (
+    "phase boundary",
+    "forbidden action",
+    "forbidden-action",
+    "reverify ran ",
+    "reverify executed ",
+    "crossed phase",
+)
+
+
+def _validate_phase_boundary_error_log(
+    run_dir: Path,
+    task_type: str,
+    failures: list[str],
+) -> None:
+    """Fail a run when its error log records a phase-boundary violation."""
+    logs_dir = run_dir / "logs"
+    if not logs_dir.is_dir():
+        return
+    for log_path in sorted(logs_dir.glob("errors-*.jsonl")):
+        try:
+            lines = log_path.read_text(encoding="utf-8").splitlines()
+        except OSError:
+            continue
+        for raw in lines:
+            try:
+                record = json.loads(raw)
+            except json.JSONDecodeError:
+                continue
+            if not isinstance(record, Mapping):
+                continue
+            if record.get("errorType") != "contract-violation":
+                continue
+            if record.get("phase") != task_type:
+                continue
+            message = str(record.get("message") or "").strip()
+            boundary_type = str(
+                record.get("violationType") or record.get("contractBoundary") or ""
+            ).strip()
+            boundary_recorded = boundary_type == "phase-boundary" or any(
+                marker in message.lower() for marker in _PHASE_BOUNDARY_ERROR_MARKERS
+            )
+            if boundary_recorded:
+                failures.append(f"phase-boundary: {message or 'recorded violation'}")
+
+
 _CONVERGENCE_INTERMEDIATE_PREFIXES = (
     "convergence-groups-",
     "convergence-work-",
@@ -7122,6 +7168,11 @@ def main() -> int:
     validate_team_state_usage(team_state, failures)
 
     validate_phase_boundary(task_type, report_path, failures)
+    _validate_phase_boundary_error_log(
+        report_path.parent.parent,
+        task_type,
+        failures,
+    )
     if task_type:
         validate_worker_results_audit(report_path, task_type, failures)
         _validate_session_conformance(

package/runtime/validators/validate_analysis_report.py

@@ -296,6 +296,33 @@ def _required_worker_rows(data: dict, required_roles: tuple[str, ...]) -> list[d
     ]
 
 
+def _validate_execution_status_roles(
+    data: dict, required_roles: tuple[str, ...], errors: list[str]
+) -> bool:
+    """Validate exact labels and report whether verdict matching is unambiguous."""
+    actual_roles = {
+        str(row.get("role") or "")
+        for row in data.get("executionStatus") or []
+        if isinstance(row, dict)
+    }
+    expected_by_fold = {role.casefold(): role for role in required_roles}
+    verdict_roles_unambiguous = True
+    for actual_role in sorted(actual_roles):
+        expected_role = expected_by_fold.get(actual_role.casefold())
+        if expected_role is None or actual_role == expected_role:
+            continue
+        errors.append(
+            f"unknown executionStatus analysis role `{actual_role}`; "
+            f"expected exact role `{expected_role}`"
+        )
+        verdict_roles_unambiguous = False
+    for required_role in required_roles:
+        if required_role in actual_roles:
+            continue
+        errors.append(f"missing required analysis role `{required_role}`")
+    return verdict_roles_unambiguous
+
+
 def _scope_confirmation_status(
     run_manifest: dict, errors: list[str]
 ) -> str | None:
@@ -409,6 +436,9 @@ def validate_analysis_semantics(
     analysis_worker_roles = tuple(
         role for role in required_roles if role in _ANALYSIS_WORKER_ROLES
     )
+    verdict_roles_unambiguous = _validate_execution_status_roles(
+        data, analysis_worker_roles, errors
+    )
     _validate_all_current_code_evidence(task_type, data, errors)
     if task_type == "project-analysis":
         _validate_project_semantics(data, errors)
@@ -419,9 +449,10 @@ def validate_analysis_semantics(
     _validate_scope_before_dispatch(
         data, analysis_worker_roles, reporter_confirmation, errors
     )
-    _validate_analysis_verdict(
-        data, analysis_worker_roles, reporter_confirmation, errors
-    )
+    if verdict_roles_unambiguous:
+        _validate_analysis_verdict(
+            data, analysis_worker_roles, reporter_confirmation, errors
+        )
 
 
 def _actual_analysis_task_type(

package/src/cli-registry.mjs

@@ -101,16 +101,6 @@ export const COMMAND_REGISTRY = [
     category: "admin",
     summary: ["stage 들을 task 브랜치에 통합 머지하고 stage worktree 를 정리"],
   },
-  {
-    name: "phase-cleanup",
-    module: "./commands/execute/phase-cleanup.mjs",
-    export: "run",
-    category: "admin",
-    summary: [
-      "Reclaim the prior phase/batch's completed panes and list dismissible",
-      "teammates for the lead to shut down (tmux-aware)",
-    ],
-  },
   {
     name: "paths",
     module: "./commands/lifecycle/paths.mjs",
@@ -301,6 +291,13 @@ export const COMMAND_REGISTRY = [
     category: "introspection",
     summary: ["Dispatch CLI-backed workers for a prepared Codex run"],
   },
+  {
+    name: "worker-state",
+    module: "./commands/execute/worker-state.mjs",
+    export: "run",
+    category: "admin",
+    summary: ["Atomically transition persisted worker status"],
+  },
   {
     name: "team",
     module: "./commands/execute/team.mjs",

package/src/commands/execute/worker-state.mjs

@@ -0,0 +1,29 @@
+import { runPythonModule } from "../../lib/python-helper.mjs";
+
+const USAGE = `okstra worker-state — atomically transition persisted worker status
+
+Usage:
+  okstra worker-state transition --team-state <path> --worker <worker-id> \\
+    --status <in-progress|completed|timeout|error|not-run> \\
+    [--reason <text>] [--model <execution-value>]
+
+in-progress records startedAt and clears endedAt. completed, timeout, and error
+record endedAt. timeout, error, and not-run require --reason.
+`;
+
+export async function run(args) {
+  if (args.includes("--help") || args.includes("-h")) {
+    process.stdout.write(USAGE);
+    return 0;
+  }
+  if (args.length === 0) {
+    process.stdout.write(USAGE);
+    return 2;
+  }
+  const result = await runPythonModule({
+    module: "okstra_ctl.worker_state",
+    args,
+    stdio: "inherit-stdout",
+  });
+  return result.code;
+}

package/src/commands/inspect/worker-liveness.mjs

@@ -3,13 +3,15 @@ import { runPythonModule } from "../../lib/python-helper.mjs";
 const USAGE = `okstra worker-liveness — report whether pending workers are still alive
 
 Usage:
-  okstra worker-liveness [--audit <path>]... [--prompt <path>]...
+  okstra worker-liveness [--audit <path>]...
+                         [--team-state <path> --worker <worker-id>]...
                          [--max-idle <seconds>] [--launch-grace <seconds>] [--json]
 
 --audit   an in-process worker audit sidecar path; stale past the heartbeat cadence
           means the worker hung.
---prompt  a CLI-wrapper prompt-history path; no sibling .log or .status.json
-          past the launch grace means the wrapper never started.
+--team-state and --worker select a CLI-wrapper assignment. No prompt sibling
+          .log or .status.json past the launch grace means the wrapper never
+          started. The grace begins at workers[].startedAt, not prompt mtime.
 
 Output: JSON { ok, checkedAt, probes[], unhealthy[] }. Exit 1 when any worker is
 stalled or did not launch, so a poll loop can branch on the exit code. Read-only:

package/src/commands/lifecycle/preflight.mjs

@@ -3,6 +3,7 @@ import { runEnsureInstalled } from "./install.mjs";
 import { missingHelperScripts } from "../../lib/helper-scripts.mjs";
 import { resolveInstalledScript } from "../../lib/python-helper.mjs";
 import { resolvePaths } from "../../lib/paths.mjs";
+import { checkRuntimeReadiness } from "../../lib/runtime-readiness.mjs";
 
 const USAGE = `okstra preflight — one-call skill preflight (ensure-installed + check-project)
 
@@ -12,7 +13,7 @@ Usage:
 Runs the runtime freshness check (quietly reinstalling when stale), then
 verifies the target project has .okstra/project.json. Prints one JSON object:
 
-  ok: true   {ok, projectRoot, projectJsonPath, projectId}
+  ok: true   {ok, projectRoot, projectJsonPath, projectId, runtimeReadiness}
   ok: false  {ok, stage, reason, ...}
              stage: install | helper_scripts_missing | resolve |
                     project_json_missing | project_json_invalid |
@@ -25,7 +26,7 @@ Options:
   --json             Default output format (kept for symmetry).
 
 Exit codes:
-  0   runtime fresh and project registered
+  0   runtime fresh and project registered; inspect runtimeReadiness before dispatch
   1   runtime install failed, or project setup missing/invalid
   2   PROJECT_ROOT could not be resolved from cwd (pass --cwd), or bad flags
 `;
@@ -100,6 +101,15 @@ export async function run(args) {
   }
 
   const { code, payload } = await checkProject({ cwd: opts.cwd });
-  emit(payload);
+  if (code !== 0) {
+    emit(payload);
+    return code;
+  }
+
+  const runtimeReadiness = await checkRuntimeReadiness({
+    runtime: opts.runtime,
+    projectRoot: payload.projectRoot,
+  });
+  emit({ ...payload, runtimeReadiness });
   return code;
 }

package/src/lib/runtime-readiness.mjs

@@ -0,0 +1,90 @@
+import { promises as fs } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+
+const WORKSPACE_TRUST_CHECK_ID = "workspace-trust";
+
+function ready(runtime, check) {
+  return { runtime, status: "ready", checks: check ? [check] : [] };
+}
+
+function blocked(runtime) {
+  return {
+    runtime,
+    status: "blocked",
+    checks: [{
+      id: WORKSPACE_TRUST_CHECK_ID,
+      status: "required",
+      action: "restart-and-trust",
+    }],
+  };
+}
+
+function unknown(runtime) {
+  return {
+    runtime,
+    status: "unknown",
+    checks: [{
+      id: WORKSPACE_TRUST_CHECK_ID,
+      status: "unavailable",
+      action: "open-project-and-trust",
+    }],
+  };
+}
+
+function isJsonObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+async function hasProjectSettings(projectRoot) {
+  try {
+    await fs.lstat(join(projectRoot, ".claude", "settings.local.json"));
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+async function checkClaudeCodeReadiness({ projectRoot, homeDir }) {
+  const runtime = "claude-code";
+  try {
+    if (!(await hasProjectSettings(projectRoot))) {
+      return ready(runtime, {
+        id: WORKSPACE_TRUST_CHECK_ID,
+        status: "not-applicable",
+      });
+    }
+
+    const rawState = await fs.readFile(join(homeDir, ".claude.json"), "utf8");
+    const state = JSON.parse(rawState);
+    if (!isJsonObject(state?.projects)) return unknown(runtime);
+
+    const projectState = state.projects[resolve(projectRoot)];
+    if (projectState === undefined) return blocked(runtime);
+    if (!isJsonObject(projectState)) return unknown(runtime);
+    if (projectState.hasTrustDialogAccepted === true) {
+      return ready(runtime, { id: WORKSPACE_TRUST_CHECK_ID, status: "accepted" });
+    }
+    if (projectState.hasTrustDialogAccepted === false
+        || projectState.hasTrustDialogAccepted === null
+        || projectState.hasTrustDialogAccepted === undefined) {
+      return blocked(runtime);
+    }
+    return unknown(runtime);
+  } catch {
+    return unknown(runtime);
+  }
+}
+
+export async function checkRuntimeReadiness({
+  runtime,
+  projectRoot,
+  homeDir = homedir(),
+}) {
+  const selectedRuntime = runtime ?? "auto";
+  if (selectedRuntime !== "claude-code") {
+    return ready(selectedRuntime);
+  }
+  return checkClaudeCodeReadiness({ projectRoot, homeDir });
+}

package/runtime/python/okstra_ctl/phase_cleanup.py

@@ -1,235 +0,0 @@
-"""Phase-transition resource cleanup orchestrator.
-
-Reuses the existing pane-reclaim (okstra-trace-cleanup.sh) and teammate-reconcile
-(okstra-team-reconcile.sh) primitives; this module only decides tmux-vs-in-process
-mode, finds the prior run dir, and sequences the two scripts. It never
-re-implements pane kill or completion detection.
-"""
-from __future__ import annotations
-
-import argparse
-import json
-import subprocess
-import sys
-from pathlib import Path
-from typing import Callable, Optional
-
-from okstra_project import StateError, parse_task_key
-
-from .paths import RunRef, okstra_home
-from .tmux import resolve_caller_pane, tmux_available
-
-_TRACE_SCRIPT = "okstra-trace-cleanup.sh"
-_RECONCILE_SCRIPT = "okstra-team-reconcile.sh"
-_MODE_TMUX = "tmux"
-_MODE_IN_PROCESS = "in-process"
-_RUNNER_TIMEOUT_SECONDS = 10
-
-
-def _recorded_lead_pane(prev_run_dir: Optional[Path]) -> Optional[str]:
-    """The pane the prior run's lead recorded, or None when unrecorded.
-
-    '<run_dir>/state/lead-pane.id' is written once at run start by the lead
-    adapter: a non-empty pane id means that run was inside a tmux pane, an empty
-    (0-byte) file means the run resolved to in-process. This on-disk fact
-    outlives the cleanup process's own context, which -- when okstra runs as a
-    daemon child -- can no longer walk its ancestry back to a pane.
-    """
-    if prev_run_dir is None:
-        return None
-    try:
-        return (prev_run_dir / "state" / "lead-pane.id").read_text().strip()
-    except OSError:
-        return None
-
-
-def resolve_mode(
-    *,
-    prev_run_dir: Optional[Path] = None,
-    pane_probe: Callable[[], str] = resolve_caller_pane,
-    tmux_probe: Callable[[], bool] = tmux_available,
-) -> str:
-    """'tmux' when the prior run had a pane to reclaim, else 'in-process'.
-
-    The prior run's recorded lead pane is authoritative: it captured that run's
-    tmux-ness at run start and survives a cleanup process that can no longer walk
-    its ancestry to a pane (daemon child). Only when nothing was recorded does
-    this fall back to the live ancestor-walk probe.
-    """
-    recorded = _recorded_lead_pane(prev_run_dir)
-    if recorded is not None:
-        return _MODE_TMUX if recorded else _MODE_IN_PROCESS
-    if pane_probe():
-        return _MODE_TMUX
-    if prev_run_dir is not None and tmux_probe():
-        # A prior run exists to reclaim from, but neither its recording nor the
-        # live probe could confirm tmux -- yet tmux is reachable. Surface the
-        # ambiguity instead of silently skipping pane reclaim.
-        sys.stderr.write(
-            "phase-cleanup: prior run has no recorded lead pane and no caller "
-            "pane could be resolved, but tmux is reachable; treating as "
-            "in-process and skipping pane reclaim\n"
-        )
-    return _MODE_IN_PROCESS
-
-
-def resolve_prev_run_dir(
-    *,
-    run_dir: Optional[str],
-    project_root: Path,
-    task_group: str,
-    task_id: str,
-) -> Optional[Path]:
-    """Explicit --run-dir wins; otherwise the newest completed run across phases.
-
-    Auto-discovery walks both FLAT runs/<type>/reports/ and staged
-    runs/<type>/stage-N/reports/ (implementation / final-verification), so a
-    staged prior run is found without an explicit run_dir; --run-dir still
-    overrides when a specific prior run is wanted.
-    """
-    if run_dir:
-        return Path(run_dir)
-    ref = RunRef.latest_across(
-        Path(project_root), task_group, task_id, include_stages=True
-    )
-    return ref.run_dir if ref is not None else None
-
-
-def _default_runner(cmd: list[str]) -> str:
-    # Cleanup must never block the next phase, so a spawn failure or a missing
-    # script degrades to "nothing to report" instead of propagating.
-    try:
-        proc = subprocess.run(
-            cmd,
-            capture_output=True,
-            text=True,
-            check=False,
-            timeout=_RUNNER_TIMEOUT_SECONDS,
-        )
-        return proc.stdout
-    except (OSError, subprocess.SubprocessError):
-        return ""
-
-
-def _script_path(name: str) -> str:
-    # repo layout: scripts/<name>; installed layout: ~/.okstra/bin/<name>
-    candidates = [
-        Path(__file__).resolve().parent.parent / name,
-        okstra_home() / "bin" / name,
-    ]
-    for candidate in candidates:
-        if candidate.is_file():
-            return str(candidate)
-    return str(candidates[-1])  # a missing script is tolerated by _default_runner
-
-
-def _reclaim_panes(prev_run_dir: Path, runner: Callable[[list[str]], str]) -> int:
-    listing = runner(
-        [
-            _script_path(_TRACE_SCRIPT),
-            "--run-dir",
-            str(prev_run_dir),
-            "--reclaim-completed",
-            "--list",
-        ]
-    )
-    count = len([ln for ln in listing.splitlines() if ln.strip()])
-    runner(
-        [_script_path(_TRACE_SCRIPT), "--run-dir", str(prev_run_dir), "--reclaim-completed"]
-    )
-    return count
-
-
-def _dismissible_teammates(
-    project_root: Path,
-    runner: Callable[[list[str]], str],
-    fallback_team: str = "",
-) -> list[str]:
-    # The live team dir is keyed by the current session id, which Claude Code
-    # re-issues on resume/compaction; without the caller's label the resolver
-    # finds no live roster and reports nothing to dismiss.
-    cmd = [_script_path(_RECONCILE_SCRIPT), "--project-root", str(project_root)]
-    if fallback_team:
-        cmd += ["--fallback-team", fallback_team]
-    out = runner(cmd)
-    prefix = "dismissible-member:"
-    return [ln[len(prefix):].strip() for ln in out.splitlines() if ln.startswith(prefix)]
-
-
-def run_cleanup(
-    *,
-    mode: str,
-    prev_run_dir: Optional[Path],
-    project_root: Path,
-    runner: Callable[[list[str]], str] = _default_runner,
-    fallback_team: str = "",
-) -> dict:
-    # Cleanup is performed here (real pane kill + reconcile), not merely logged;
-    # the CLI's execution IS the enforcement (a caller cannot emit a "cleaned"
-    # line without this actually running).
-    panes = 0
-    if mode == _MODE_TMUX and prev_run_dir is not None:
-        panes = _reclaim_panes(prev_run_dir, runner)
-    teammates = _dismissible_teammates(project_root, runner, fallback_team)
-    return {"mode": mode, "panesReclaimed": panes, "dismissibleTeammates": teammates}
-
-
-def main(argv: list[str]) -> int:
-    ap = argparse.ArgumentParser(prog="okstra phase-cleanup")
-    ap.add_argument(
-        "--task-key",
-        help="finds the newest completed run across phases, including staged "
-             "(implementation / final-verification) stage-N runs",
-    )
-    ap.add_argument("--run-dir")
-    ap.add_argument("--project-root", required=True)
-    ap.add_argument(
-        "--fallback-team",
-        default="",
-        help="team label to resolve the roster from when the live session dir is "
-             "gone (session id re-issued by resume/compaction)",
-    )
-    ap.add_argument("--json", action="store_true")
-    args = ap.parse_args(argv)
-
-    task_group = task_id = ""
-    if args.task_key:
-        try:
-            _pid, task_group, task_id = parse_task_key(args.task_key)
-        except StateError as exc:
-            sys.stderr.write(f"phase-cleanup: {exc}\n")
-            return 0
-
-    prev = resolve_prev_run_dir(
-        run_dir=args.run_dir,
-        project_root=Path(args.project_root),
-        task_group=task_group,
-        task_id=task_id,
-    )
-    if prev is None and not args.run_dir:
-        sys.stderr.write(
-            "phase-cleanup: no prior run found for auto-discovery "
-            "(normal on a task's first phase); pass --run-dir to point at a "
-            "specific prior run\n"
-        )
-    result = run_cleanup(
-        mode=resolve_mode(prev_run_dir=prev),
-        prev_run_dir=prev,
-        project_root=Path(args.project_root),
-        fallback_team=args.fallback_team,
-    )
-    if args.json:
-        sys.stdout.write(json.dumps(result) + "\n")
-    else:
-        sys.stdout.write(f"mode: {result['mode']}\n")
-        sys.stdout.write(f"panes-reclaimed: {result['panesReclaimed']}\n")
-        sys.stdout.write(
-            "dismissible-teammates: "
-            + ", ".join(result["dismissibleTeammates"])
-            + "\n"
-        )
-    return 0  # cleanup never blocks the next phase
-
-
-if __name__ == "__main__":
-    raise SystemExit(main(sys.argv[1:]))

package/src/commands/execute/phase-cleanup.mjs

@@ -1,38 +0,0 @@
-import { runPythonModule } from "../../lib/python-helper.mjs";
-
-const USAGE = `okstra phase-cleanup — reclaim the prior phase/batch's completed panes and teammates
-
-Usage:
-  okstra phase-cleanup --project-root <dir> [--task-key <k>] [--run-dir <dir>]
-                       [--fallback-team <label>] [--json]
-
---task-key   project-id:task-group:task-id — finds the newest completed run
-             across phases, including staged (implementation / final-
-             verification) stage-N runs.
---run-dir    explicit prior run dir (wins over --task-key).
---fallback-team
-             the live team label (session-<lead-session-prefix>) so teammate
-             reconcile still finds the roster after a session-id re-issue
-             (resume/compaction); omit and it resolves the current live
-             session only.
-
-Reclaims only completed tmux panes (lead pane and in-flight workers are preserved),
-and prints the dismissible-teammate names for the lead to shut down. In a non-tmux
-session no panes exist, so it skips pane reclaim and only reconciles teammates.
-A cleanup failure never blocks the next phase (the worker returns 0); a malformed
-invocation still exits non-zero.
-`;
-
-export async function run(args) {
-  if (args.includes("--help") || args.includes("-h")) {
-    process.stdout.write(USAGE);
-    return 0;
-  }
-
-  const result = await runPythonModule({
-    module: "okstra_ctl.phase_cleanup",
-    args,
-    stdio: "inherit-stdout",
-  });
-  return result.code;
-}