okstra 0.153.0 → 0.154.1

package/docs/project-structure-overview.md

@@ -243,7 +243,7 @@ Important modules:
 | `build_tools.py` | allowlist SSOT for deciding whether a plan's command cell invokes the project build toolchain (`npm`/`pytest`/`cargo`/`gradle`/… behind transparent leaders like `sudo`/`env`). The planning worktree has no dependencies installed, so `validators/validate-run.py` uses this to warn (advisory) when a toolchain stage declares no install precondition. Intentionally an allowlist, not a denylist, so unknown tokens go undetected rather than firing on `grep`/`sed` in every plan |
 | `stage_citations.py` | shared grammar SSOT for reading the Stage Map stage numbers a prose cell cites (`Stages 1, 2, and 3`, ranges, etc.). One definition serves two readers that must not drift — the coverage check in `validators/validate-run.py` proving every stage traces to a requirement, and `incremental_scope.py`'s back-trace resolving which stages an answered clarification touches |
 | `self_mock_signals.py` | self-mock signal SSOT — language-keyed regexes (`SIGNALS`), the `EXT_TO_LANG` extension map, and the waiver-matching mechanics both gates share — `selfmock_path_key` (the one path-normalization), `waiver_entry_key` (the `(file, line, <discriminator>)` triple, with the hand-typed line coerced to `int`) and `partition_waived_entries` (the split into still-failing vs waived). Gate A passes the discriminator `signal`, gate B `mutant`; one definition means the two cannot disagree about whether a waiver matches a finding. The signals are each ported from a `prompts/coding-preflight/languages/<lang>.md` "Self-mock signals to refuse" bullet with the source `doc_keyword` retained so a drift guard fails when doc and module diverge. Patterns stay deliberately narrow (only the "stub the subject's own method, then assert the stub" shape and reaching into the subject's privates; subject identity is never inferred beyond the literal `sut` token). The static detector `validators/detect_self_mock.py`, the drift guard and `mutation_probe.py` MUST import from here; four documented shapes needing subject identity no regex has are left to the mutation gate (`mutation_probe.py`) |
-| `mutation_probe.py` | gate B of the self-mock gate — the tool-agnostic mutation probe. `ADAPTERS` maps an `EXT_TO_LANG` language key to an adapter (`ts_js` → Stryker, `rust` → cargo-mutants, `java`/`kotlin` → PIT, which reports `unsupported` because its SCM scoping is a Maven-only goal and the report↔path mapping is unverified). `run_probe` owns everything that must not differ between tools: production-source selection, the refusal to run on an empty target set, the requirement that the diff name EVERY changed source, the adapter result-shape check and the user-acknowledged waiver application; adapters only parse. `evaluate` counts a mutant only when it covers a line the diff added or modified, and records the pre-cap `survivedTotal` so a trimmed report cannot be fully waived to PASS. Anything that stops a real inspection — no adapter, tool not installed, unreadable report, unknown outcome word, no conclusive trial, a diff that misses a changed source — answers `unsupported(<reason>)`, never `PASS`. `classify_reason` is the 3-class SSOT (capability-gap / nothing-to-verify / integrity-inspection, unknown → integrity) read by BOTH the cross-language merge here and the blocking decision in `validators/validate-run.py` |
+| `mutation_probe.py` | gate B of the self-mock gate — the tool-agnostic mutation probe. `ADAPTERS` maps an `EXT_TO_LANG` language key to an adapter (`ts_js` → Stryker, `python` → Cosmic Ray, `rust` → cargo-mutants, `java`/`kotlin` → PIT, which reports `unsupported` because its SCM scoping is a Maven-only goal and the report↔path mapping is unverified). The Python adapter activates only when the worktree has both an installed `cosmic-ray` executable and `cosmic-ray.toml`; Okstra never installs it. It verifies that `module-path` covers every changed Python target and that no target is excluded, snapshots the configured Python source bytes and modes, restores them after every run, and filters the JSONL dump to diff-added lines. A completed session with no applicable operator on a changed line is `nothing-to-verify`; malformed configuration, command/report failures, incomplete trials, and failed source restoration are blocking `integrity-inspection` results. `run_probe` owns everything that must not differ between tools: production-source selection, the refusal to run on an empty target set, the requirement that the diff name EVERY changed source, the adapter result-shape check and the user-acknowledged waiver application; adapters only parse. `evaluate` counts a mutant only when it covers a line the diff added or modified, and records the pre-cap `survivedTotal` so a trimmed report cannot be fully waived to PASS. Anything that stops a real inspection — no adapter, tool not installed, unreadable report, unknown outcome word, no conclusive trial, a diff that misses a changed source — answers `unsupported(<reason>)`, never `PASS`. `classify_reason` is the 3-class SSOT (capability-gap / nothing-to-verify / integrity-inspection, unknown → integrity) read by BOTH the cross-language merge here and the blocking decision in `validators/validate-run.py` |
 | `run_context.py` | Per-task mutex, run context and run-input persistence; `consumers_mutex` helper for atomic `consumers.jsonl` writes |
 | `path_hints.py` | Compact path-hint persistence + legacy context hydration — stores `run-context` / `active-run-context` in the schemaVersion `2.0` `identity` + `pathHints` compact schema, and hydrates the legacy flat path keys (`RUN_MANIFEST_RELATIVE_PATH`, `TEAM_STATE_PATH`, etc.) in memory the moment the host-side reader reads them |
 | `consumers.py` | Append-only `consumers.jsonl` writer + reader — records which `implementation` runs consumed which `implementation-planning` stage |
@@ -386,7 +386,7 @@ Optional (v1.0 backward-compatible) top-level keys:
 | `validate-schedule.py` | Schedule section/order/code validation |
 | `validate-implementation-plan-stages.py` | enforces the Stage Map structure — checks the S1–S8 rules (`## 5.5 Stage Map` + `## 5.5.<i> Stage <i>` sections, ≤ 8 steps per stage, etc.) |
 | `validate_improvement_report.py` | enforces the 11-item contract of the improvement-discovery final-report. Automatically invoked by `validate-run.py` when `task_type == "improvement-discovery"` |
-| `detect_self_mock.py` | self-mock detector — runs BOTH gates and writes the run's sidecar. Gate A (static) scans the changed TEST files for SUT-stub signals (patterns imported from the SSOT `scripts/okstra_ctl/self_mock_signals.py`, never redefined here), matching each file as one whole-file string so multi-line signals are caught. Writes a `qa/self-mock[-stage-<N>].json` sidecar and prints `QA-RESULT: PASS|FAIL` as its last line (exit 0 = no hits, exit 1 = at least one hit). The sidecar records `scannedFiles`/`skippedFiles` so the gate can prove every changed test file was actually scanned (a run that skips them cannot pass on empty input). An optional `--waivers <path>` moves hits matching `(file,line,signal)` from `staticDetect.hits` to `staticDetect.waived` (each carrying the user's `reason`/`acknowledgedBy`) and records the file as `waiverSource`. Gate B (mutation) runs in the same call: `--changed-file` takes the stage's WHOLE changed set (each adapter selects its own production sources out of it), `--diff` and `--worktree` scope it, and `scripts/okstra_ctl/mutation_probe.py` writes the result into the sidecar's `mutation` block; the received set is recorded as `changedFiles` so the gate can prove gate B was not handed an empty input. `overall` and the exit code follow BOTH gates — a mutation FAIL with a clean static scan still exits 1. The same `--waivers` file feeds both (gate A reads its `signal` entries, gate B its `mutant` ones). Its verdict feeds the fail-closed `_validate_selfmock` gate in `validate-run.py` (implementation / final-verification): a diff that touches test files with no readable PASS sidecar blocks the run; a `waived` entry missing `reason`/`acknowledgedBy`, or a `waiverSource` that is not the task's own `qa/self-mock-waivers.json`, also blocks |
+| `detect_self_mock.py` | self-mock detector — runs BOTH gates and writes the run's sidecar. Gate A (static) scans the changed TEST files for SUT-stub signals (patterns imported from the SSOT `scripts/okstra_ctl/self_mock_signals.py`, never redefined here), matching each file as one whole-file string so multi-line signals are caught. Python strings and comments are token-masked without changing line positions before those regexes run, so examples in docstrings and comments do not become findings while executable `patch.object(self, ...)` and `sut._private` accesses remain detectable. Writes a `qa/self-mock[-stage-<N>].json` sidecar and prints `QA-RESULT: PASS|FAIL` as its last line (exit 0 = no hits, exit 1 = at least one hit). The sidecar records `scannedFiles`/`skippedFiles` so the gate can prove every changed test file was actually scanned (a run that skips them cannot pass on empty input). An optional `--waivers <path>` moves hits matching `(file,line,signal)` from `staticDetect.hits` to `staticDetect.waived` (each carrying the user's `reason`/`acknowledgedBy`) and records the file as `waiverSource`. Gate B (mutation) runs in the same call: `--changed-file` takes the stage's WHOLE changed set (each adapter selects its own production sources out of it), `--diff` and `--worktree` scope it, and `scripts/okstra_ctl/mutation_probe.py` writes the result into the sidecar's `mutation` block; the received set is recorded as `changedFiles` so the gate can prove gate B was not handed an empty input. `overall` and the exit code follow BOTH gates — a mutation FAIL with a clean static scan still exits 1. The same `--waivers` file feeds both (gate A reads its `signal` entries, gate B its `mutant` ones). Its verdict feeds the fail-closed `_validate_selfmock` gate in `validate-run.py` (implementation / final-verification): a diff that touches test files with no readable PASS sidecar blocks the run; a `waived` entry missing `reason`/`acknowledgedBy`, or a `waiverSource` that is not the task's own `qa/self-mock-waivers.json`, also blocks |
 | `validate-workflow.sh` | End-to-end fixture workflow validation |
 | `lib/*.sh` | Shared shell validator helpers and fixtures |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.153.0",
+  "version": "0.154.1",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.153.0",
-  "builtAt": "2026-08-05T13:40:55.050Z",
+  "package": "0.154.1",
+  "builtAt": "2026-08-05T18:07:27.600Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/python/okstra_ctl/clarification_items.py

@@ -395,11 +395,39 @@ def scan_clarification_blockers(
     report_path: Path, blocking_values: frozenset[str]
 ) -> ClarificationScan:
     """Shared fail-closed clarification walk for both gates above — schema-v2
-    reads its rows from the data sibling, schema-v1 from the §1 table."""
+    reads its rows from the data sibling, schema-v1 from the §1 table, and the
+    user's `user-responses/` sidecar outranks whatever the report says about
+    those rows."""
     v2_scan = _scan_v2_blockers(report_path, blocking_values)
-    if v2_scan is not None:
-        return v2_scan
-    return scan_section_1_blockers(_read_report_text(report_path), blocking_values)
+    scan = (
+        v2_scan if v2_scan is not None
+        else scan_section_1_blockers(_read_report_text(report_path), blocking_values)
+    )
+    return _resolve_blockers_answered_by_user(report_path, scan)
+
+
+def _resolve_blockers_answered_by_user(
+    report_path: Path, scan: ClarificationScan
+) -> ClarificationScan:
+    """사용자가 사이드카로 답한 행을 blocker 에서 뺀 스캔.
+
+    답의 정본은 사용자의 `user-responses/` 사이드카다. 리포트의 `Status` 는 그
+    run 이 스스로 적어둔 값이고, 답이 사이드카로만 들어오는 경로(HTML 뷰의
+    `Export user response`, `okstra user-response write`)에서는 갱신되지
+    않는다 — 게이트가 리포트만 보면 사용자가 답을 다 채운 뒤에도 같은 항목이
+    영원히 미해결로 남아 다음 phase 를 막는다.
+
+    fail-closed 는 그대로다: 행 자체를 못 읽은 스캔(`unreadable_reason`)은
+    어떤 id 가 blocker 인지 모르는 상태이므로 사이드카로 덮지 않는다.
+    """
+    if scan.unreadable_reason is not None or not scan.blockers:
+        return scan
+    answers = sidecar_answers(report_path)
+    if not answers:
+        return scan
+    return ClarificationScan(
+        [b for b in scan.blockers if b.row_id not in answers], None
+    )
 
 
 def scan_section_1_blockers(
@@ -587,11 +615,20 @@ def _sidecars_for_attachment(source: Path) -> list[Path]:
     return sorted([*ordinary, *selected])
 
 
-def _sidecar_answers(source: Path) -> dict[str, str]:
+def sidecar_answers(source: Path) -> dict[str, str]:
     """`user-responses/` 사이드카들의 답변을 `{clarification-id: value}` 로 모은다.
 
-    같은 id 가 여러 사이드카에 나오면 이름순 마지막(최신 seq)이 이긴다. `value`
-    가 빈 항목은 담지 않는다. `user_response` 를 지연 import 해 순환 참조를 피한다.
+    사용자가 답한 항목이 무엇인지 아는 단일 참조점 — carry-in 병합도, 승인
+    게이트도, 스킬의 열린 항목 목록도 전부 이 한 곳을 본다.
+
+    `disposition` 이 `answer` 인 항목만 답으로 센다. `reframe` 은 "다음 run 에서
+    다시 물어달라" 이지 답이 아니므로(`skills/okstra-user-response/SKILL.md` 의
+    "A reframe is not an answer") 답 집합에서 빠져야 게이트가 그 항목을 계속
+    미해결로 잡는다.
+
+    같은 id 가 여러 사이드카에 나오면 이름순 마지막(최신 seq)이 이긴다 — 최신이
+    reframe 이거나 값이 비면 앞선 답을 지운다. 그래야 답을 물렀을 때 그 항목이
+    미해결로 돌아온다. `user_response` 를 지연 import 해 순환 참조를 피한다.
     """
     from okstra_ctl.user_response import parse_user_response_entries
 
@@ -600,8 +637,10 @@ def _sidecar_answers(source: Path) -> dict[str, str]:
         for entry in parse_user_response_entries(
             sidecar.read_text(encoding="utf-8")
         ):
-            if entry.value:
+            if entry.value and entry.disposition == "answer":
                 answers[entry.response_id] = entry.value
+            else:
+                answers.pop(entry.response_id, None)
     return answers
 
 
@@ -644,7 +683,7 @@ def clarification_response_with_sidecars(source: Path) -> str:
     """
     text = source.read_text(encoding="utf-8")
     section = attached_user_responses_section(source)
-    answers = _sidecar_answers(source)
+    answers = sidecar_answers(source)
     body = _clarification_carry_body(source, text, answers)
     if not section:
         return body
@@ -750,9 +789,13 @@ def _locate_user_input_column(lines: list[str]) -> tuple[int, int]:
 
 
 def _reconcile_row(line: str, ui_col: int, answers: dict[str, str]) -> str:
-    """답이 있고 open/answered 이며 `User input` 칸이 빈 행이면 답을 채우고 Status 를
-    resolved 로 바꾼 줄을, 그 외에는 원본 줄을 그대로 돌려준다. 이미 채워진 칸은
-    표에 든 값이 정본이므로 덮어쓰지 않는다.
+    """답이 있고 open/answered 인 행이면 `User input` 칸을 그 답으로 채우고 Status 를
+    resolved 로 바꾼 줄을, 그 외에는 원본 줄을 그대로 돌려준다.
+
+    칸에 이미 값이 있어도 사용자의 사이드카 답이 이긴다. 그 칸을 채우는 것은
+    run 자신(직전 렌더가 옮겨 적은 값)이고, 사용자가 나중에 답을 바꾸면 둘이
+    갈라진다 — 사용자가 쓴 쪽을 정본으로 삼지 않으면 run 이 자기가 적어둔 값으로
+    계속 되돌아간다.
 
     판정은 앵커/백틱을 벗긴 셀(`_split_pipe_row`)로 — 그래야 `_meta_id` 가 스크롤
     앵커의 소문자 slug 대신 진짜 대문자 ID 를 읽는다. 재조립은 원본 셀
@@ -764,7 +807,7 @@ def _reconcile_row(line: str, ui_col: int, answers: dict[str, str]) -> str:
     if item.status not in UNRESOLVED_STATUSES:
         return line
     raw = split_pipe_row(line)
-    if not (0 <= ui_col < len(raw) and raw[ui_col] == ""):
+    if not 0 <= ui_col < len(raw):
         return line
     raw[ui_col] = answers[item.row_id]
     raw[0] = _STATUS_RESOLVE_RE.sub(r"\1resolved", raw[0])
@@ -772,7 +815,7 @@ def _reconcile_row(line: str, ui_col: int, answers: dict[str, str]) -> str:
 
 
 def _reconcile_user_input(section: str, answers: dict[str, str]) -> str:
-    """§1 표에서 사이드카 답이 있는 미해결 행의 빈 `User input` 칸을 답으로 채우고
+    """§1 표에서 사이드카 답이 있는 미해결 행의 `User input` 칸을 답으로 채우고
     Status 를 resolved 로 바꾼 §1 본문을 돌려준다.
 
     답의 정본 위치를 §1 표 안으로 옮긴다 — 표만 읽는 승인 게이트·프롬프트

package/runtime/python/okstra_ctl/mutation_probe.py

@@ -61,16 +61,22 @@ branches and would pass by falling between them.
 
 `ADAPTERS` is keyed by the `self_mock_signals.EXT_TO_LANG` vocabulary — the same
 lang names gate A resolves a changed file to — so both gates answer to one set
-of language keys: `ts_js` (Stryker), `rust` (cargo-mutants), and `java`/`kotlin`
-(PIT, whose diff scoping is not wired up yet — see `PitAdapter`).
+of language keys: `ts_js` (Stryker), `python` (Cosmic Ray), `rust`
+(cargo-mutants), and `java`/`kotlin` (PIT, whose diff scoping is not wired up
+yet — see `PitAdapter`).
 """
 from __future__ import annotations
 
+import fnmatch
 import json
+import os
 import re
 import shutil
+import stat
 import subprocess
 import sys
+import tempfile
+import tomllib
 from pathlib import Path
 from typing import NamedTuple, Protocol
 
@@ -413,6 +419,414 @@ class StrykerAdapter:
             return None
 
 
+COSMIC_RAY_CONFIG_PATH = Path("cosmic-ray.toml")
+
+_COSMIC_WORKER_OUTCOMES = (
+    "normal",
+    "abnormal",
+    "exception",
+    "no-test",
+    "skipped",
+)
+_COSMIC_TEST_OUTCOMES = ("killed", "survived", "incompetent", None)
+_COSMIC_CONCLUSIVE = ("killed", "survived")
+_COSMIC_SESSION_FAILURES = (
+    "init-failed",
+    "baseline-failed",
+    "exec-failed",
+    "dump-failed",
+)
+
+
+class SourceState(NamedTuple):
+    """Bytes and permissions Cosmic Ray must leave unchanged."""
+
+    data: bytes
+    mode: int
+
+
+class CosmicRayScope(NamedTuple):
+    """Validated configuration and every Python source it may mutate."""
+
+    config_path: Path
+    sources: tuple[Path, ...]
+
+
+class CosmicRayConfig(NamedTuple):
+    """The source roots and exclusions declared by ``cosmic-ray.toml``."""
+
+    module_paths: tuple[Path, ...]
+    excluded_patterns: tuple[str, ...]
+
+
+class CosmicRaySession(NamedTuple):
+    """The external CLI's dump, or the command that prevented one."""
+
+    dump_text: str | None
+    failure_reason: str | None
+
+
+class CosmicRayScopeError(ValueError):
+    """A stable unsupported reason for an unsafe or incomplete config scope."""
+
+    def __init__(self, reason: str):
+        super().__init__(reason)
+        self.reason = reason
+
+
+def _cosmic_ray_executable(worktree: Path | None) -> Path | None:
+    """Find an installed Cosmic Ray executable without starting a process."""
+    if worktree is None:
+        return None
+    root = Path(worktree)
+    local_paths = (
+        Path(".venv/bin/cosmic-ray"),
+        Path("venv/bin/cosmic-ray"),
+        Path(".venv/Scripts/cosmic-ray.exe"),
+        Path("venv/Scripts/cosmic-ray.exe"),
+    )
+    for relative in local_paths:
+        candidate = root / relative
+        if candidate.is_file() and os.access(candidate, os.X_OK):
+            return candidate
+    found = shutil.which("cosmic-ray")
+    return Path(found) if found else None
+
+
+def _is_within(path: Path, parent: Path) -> bool:
+    try:
+        path.relative_to(parent)
+        return True
+    except ValueError:
+        return False
+
+
+def _cosmic_config(config_path: Path, root: Path) -> CosmicRayConfig:
+    try:
+        data = tomllib.loads(config_path.read_text(encoding="utf-8"))
+    except (OSError, tomllib.TOMLDecodeError) as exc:
+        raise CosmicRayScopeError("config-unreadable") from exc
+    config = data.get("cosmic-ray")
+    raw = config.get("module-path") if isinstance(config, dict) else None
+    values = [raw] if isinstance(raw, str) else raw
+    if not isinstance(values, list) or not values:
+        raise CosmicRayScopeError("config-unreadable")
+    if any(not isinstance(value, str) or not value.strip() for value in values):
+        raise CosmicRayScopeError("config-unreadable")
+    paths = tuple(
+        (root / value).resolve()
+        if not Path(value).is_absolute()
+        else Path(value).resolve()
+        for value in values
+    )
+    if any(not _is_within(path, root) for path in paths):
+        raise CosmicRayScopeError("config-unreadable")
+    exclusions: list[str] = []
+    for key in ("excluded-modules", "exclude-modules"):
+        raw_exclusions = config.get(key, [])
+        if not isinstance(raw_exclusions, list) or any(
+            not isinstance(pattern, str) or not pattern.strip()
+            for pattern in raw_exclusions
+        ):
+            raise CosmicRayScopeError("config-unreadable")
+        exclusions.extend(raw_exclusions)
+    return CosmicRayConfig(paths, tuple(exclusions))
+
+
+def _cosmic_target_is_excluded(
+    target: Path,
+    root: Path,
+    patterns: tuple[str, ...],
+) -> bool:
+    relative = target.relative_to(root).as_posix()
+    return any(
+        fnmatch.fnmatchcase(relative, pattern) or Path(relative).match(pattern)
+        for pattern in patterns
+    )
+
+
+def _configured_cosmic_sources(
+    module_paths: tuple[Path, ...],
+    root: Path,
+) -> tuple[Path, ...]:
+    sources: set[Path] = set()
+    for module_path in module_paths:
+        if module_path.is_file() and module_path.suffix == ".py":
+            candidates = (module_path,)
+        elif module_path.is_dir():
+            candidates = tuple(module_path.rglob("*.py"))
+        else:
+            raise CosmicRayScopeError("config-unreadable")
+        for candidate in candidates:
+            if candidate.is_symlink():
+                raise CosmicRayScopeError("config-unreadable")
+            resolved = candidate.resolve()
+            if not _is_within(resolved, root) or not resolved.is_file():
+                raise CosmicRayScopeError("config-unreadable")
+            sources.add(resolved)
+    return tuple(sorted(sources))
+
+
+def _read_cosmic_ray_scope(worktree: Path, targets: list[Path]) -> CosmicRayScope:
+    root = Path(worktree).resolve()
+    config_path = root / COSMIC_RAY_CONFIG_PATH
+    config = _cosmic_config(config_path, root)
+    resolved_targets = tuple(
+        (root / target).resolve() if not target.is_absolute() else target.resolve()
+        for target in targets
+    )
+    if any(
+        not _is_within(target, root)
+        or _cosmic_target_is_excluded(target, root, config.excluded_patterns)
+        for target in resolved_targets
+    ):
+        raise CosmicRayScopeError("config-target-mismatch")
+    if any(
+        not any(
+            target == module_path
+            or (module_path.is_dir() and _is_within(target, module_path))
+            for module_path in config.module_paths
+        )
+        for target in resolved_targets
+    ):
+        raise CosmicRayScopeError("config-target-mismatch")
+    sources = _configured_cosmic_sources(config.module_paths, root)
+    if any(target not in sources for target in resolved_targets):
+        raise CosmicRayScopeError("config-target-mismatch")
+    return CosmicRayScope(config_path, sources)
+
+
+def _snapshot_source_state(sources: tuple[Path, ...]) -> dict[Path, SourceState]:
+    return {
+        path: SourceState(
+            path.read_bytes(),
+            stat.S_IMODE(path.stat(follow_symlinks=False).st_mode),
+        )
+        for path in sources
+    }
+
+
+def _restore_source_state(states: dict[Path, SourceState]) -> bool:
+    restored = True
+    for path, expected in states.items():
+        try:
+            if path.is_symlink() or (path.exists() and not path.is_file()):
+                restored = False
+                continue
+            if not path.exists() or path.read_bytes() != expected.data:
+                path.write_bytes(expected.data)
+            path.chmod(expected.mode)
+            actual = SourceState(
+                path.read_bytes(),
+                stat.S_IMODE(path.stat(follow_symlinks=False).st_mode),
+            )
+            restored = restored and actual == expected
+        except OSError:
+            restored = False
+    return restored
+
+
+def _run_cosmic_ray_session(
+    executable: Path,
+    config_path: Path,
+    session_path: Path,
+    worktree: Path,
+) -> CosmicRaySession:
+    root = Path(worktree)
+    try:
+        config_arg = str(config_path.relative_to(root))
+    except ValueError:
+        config_arg = str(config_path)
+    commands = (
+        ("init", [str(executable), "init", config_arg, str(session_path)]),
+        (
+            "baseline",
+            [str(executable), "baseline", "--report", config_arg, str(session_path)],
+        ),
+        ("exec", [str(executable), "exec", config_arg, str(session_path)]),
+        ("dump", [str(executable), "dump", str(session_path)]),
+    )
+    for verb, argv in commands:
+        try:
+            completed = subprocess.run(
+                argv,
+                cwd=str(root),
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+        except OSError:
+            return CosmicRaySession(None, f"{verb}-failed")
+        if completed.returncode != 0:
+            return CosmicRaySession(None, f"{verb}-failed")
+        if verb == "dump":
+            return CosmicRaySession(completed.stdout, None)
+    return CosmicRaySession(None, "dump-failed")
+
+
+def _cosmic_diff_file(diff: object, worktree: Path) -> str | None:
+    if not isinstance(diff, list) or any(not isinstance(line, str) for line in diff):
+        return None
+    new_paths = [line[4:].split("\t", 1)[0] for line in diff if line.startswith("+++ ")]
+    if len(new_paths) != 1 or new_paths[0] == "/dev/null":
+        return None
+    raw = new_paths[0]
+    if raw.startswith("b/"):
+        raw = raw[2:]
+    candidate = Path(raw)
+    root = Path(worktree).resolve()
+    if candidate.is_absolute():
+        resolved = candidate.resolve()
+    else:
+        if ".." in candidate.parts:
+            return None
+        absolute_style = (Path("/") / candidate).resolve()
+        resolved = (
+            absolute_style if _is_within(absolute_style, root) else root / candidate
+        )
+    if not _is_within(resolved, root):
+        return None
+    return str(resolved.relative_to(root))
+
+
+def _parse_cosmic_ray_dump(
+    dump_text: str,
+    diff_path: Path | None,
+    worktree: Path,
+) -> ParsedReport | None:
+    scope = read_diff(diff_path)
+    if scope is None:
+        return None
+    survivors: list[dict] = []
+    observed = 0
+    conclusive = 0
+    for raw in dump_text.splitlines():
+        if not raw.strip():
+            continue
+        try:
+            row = json.loads(raw)
+        except json.JSONDecodeError:
+            return None
+        if not isinstance(row, dict):
+            return None
+        worker = row.get("worker_outcome")
+        outcome = row.get("test_outcome")
+        file = _cosmic_diff_file(row.get("diff"), worktree)
+        line = _coerce_line(row.get("line_number"))
+        operator = row.get("operator")
+        occurrence = row.get("occurrence")
+        if (
+            worker not in _COSMIC_WORKER_OUTCOMES
+            or outcome not in _COSMIC_TEST_OUTCOMES
+        ):
+            return None
+        if worker == "normal" and outcome is None:
+            return None
+        if file is None or line is None or line < 1:
+            return None
+        if not isinstance(operator, str) or not operator.strip():
+            return None
+        if not isinstance(occurrence, int) or isinstance(occurrence, bool):
+            return None
+        if line not in scope.touched.get(selfmock_path_key(file), ()):
+            continue
+        observed += 1
+        if worker == "normal" and outcome in _COSMIC_CONCLUSIVE:
+            conclusive += 1
+        if worker == "normal" and outcome == "survived":
+            survivors.append(
+                {
+                    "file": file,
+                    "line": line,
+                    "mutant": f"{operator}#{occurrence}",
+                    "status": outcome,
+                }
+            )
+    return ParsedReport(survivors, conclusive, observed)
+
+
+def _cosmic_session_verdict(
+    session: CosmicRaySession,
+    diff_path: Path | None,
+    worktree: Path,
+    tool: str,
+) -> ProbeResult:
+    if not isinstance(session, CosmicRaySession):
+        return unsupported("report-unparsed", tool=tool)
+    if session.failure_reason is not None:
+        if session.failure_reason not in _COSMIC_SESSION_FAILURES:
+            return unsupported("report-unparsed", tool=tool)
+        return unsupported(session.failure_reason, tool=tool)
+    if not isinstance(session.dump_text, str):
+        return unsupported("report-unparsed", tool=tool)
+    parsed = _parse_cosmic_ray_dump(session.dump_text, diff_path, worktree)
+    if parsed is None:
+        return unsupported("report-unparsed", tool=tool)
+    if parsed.observed == 0:
+        return unsupported("no-mutable-changed-lines", tool=tool)
+    return _verdict_from_parsed(parsed, diff_path, worktree, tool)
+
+
+class CosmicRayAdapter:
+    """Gate B for Python, wrapping an explicitly configured Cosmic Ray CLI."""
+
+    name = "cosmic-ray"
+
+    def __init__(self, runner=_run_cosmic_ray_session):
+        self._runner = runner
+
+    def is_declared(self, worktree: Path | None) -> bool:
+        if worktree is None:
+            return False
+        root = Path(worktree)
+        return (root / COSMIC_RAY_CONFIG_PATH).is_file() and (
+            _cosmic_ray_executable(root) is not None
+        )
+
+    def run(
+        self,
+        targets: list[Path],
+        diff_path: Path | None,
+        worktree: Path | None,
+    ) -> ProbeResult:
+        if worktree is None:
+            return unsupported("config-unreadable", tool=self.name)
+        root = Path(worktree)
+        executable = _cosmic_ray_executable(root)
+        if executable is None:
+            return unsupported("tool-not-declared", tool=self.name)
+        try:
+            scope = _read_cosmic_ray_scope(root, targets)
+            states = _snapshot_source_state(scope.sources)
+        except CosmicRayScopeError as exc:
+            return unsupported(exc.reason, tool=self.name)
+        except OSError:
+            return unsupported("source-integrity-failed", tool=self.name)
+        result: ProbeResult
+        try:
+            with tempfile.TemporaryDirectory(prefix="okstra-cosmic-ray-") as temp_dir:
+                session_path = Path(temp_dir) / "session.sqlite"
+                session = self._runner(
+                    executable,
+                    scope.config_path,
+                    session_path,
+                    root,
+                )
+                result = _cosmic_session_verdict(
+                    session,
+                    diff_path,
+                    root,
+                    self.name,
+                )
+        except OSError:
+            result = unsupported("exec-failed", tool=self.name)
+        finally:
+            sources_restored = _restore_source_state(states)
+        if not sources_restored:
+            return unsupported("source-integrity-failed", tool=self.name)
+        return result
+
+
 CARGO_OUTCOMES_PATH = Path("mutants.out/outcomes.json")
 
 # cargo-mutants' own vocabulary: `caught` (a test failed, good), `missed` (no
@@ -665,6 +1079,7 @@ class PitAdapter:
 _PIT = PitAdapter()
 ADAPTERS: dict[str, Adapter] = {
     "ts_js": StrykerAdapter(),
+    "python": CosmicRayAdapter(),
     "rust": CargoMutantsAdapter(),
     "java": _PIT,
     "kotlin": _PIT,
@@ -1107,6 +1522,7 @@ CAPABILITY_GAP_REASONS = frozenset(
 NOTHING_TO_VERIFY_REASONS = frozenset(
     {
         "no-mutants-generated",
+        "no-mutable-changed-lines",
         "diff-adds-no-line",
     }
 )
@@ -1127,6 +1543,13 @@ INTEGRITY_INSPECTION_REASONS = frozenset(
         "report-unparsed",
         "adapter-malformed-status",
         "no-conclusive-mutants",
+        "config-unreadable",
+        "config-target-mismatch",
+        "init-failed",
+        "baseline-failed",
+        "exec-failed",
+        "dump-failed",
+        "source-integrity-failed",
     }
 )
 

package/runtime/python/okstra_ctl/user_response.py

@@ -27,6 +27,7 @@ from okstra_ctl.clarification_items import (
     read_clarification_rows,
     scan_open_user_input,
     section_1_present_but_unparsed,
+    sidecar_answers,
     _section_1_slice,
 )
 
@@ -545,10 +546,13 @@ def resolve_refs(report_text: str, refs: list[str]) -> list[dict]:
 
 def show_open_rows(report_path: Path) -> dict:
     text = report_path.read_text(encoding="utf-8")
+    # 사이드카에 답이 있는 행은 사용자가 이미 답한 것이다. 리포트의 `Status` 는
+    # 그 답을 반영하지 않으므로, 이걸 빼지 않으면 스킬이 같은 질문을 다시 묻는다.
+    answered = sidecar_answers(report_path)
     rows = []
     for r in read_clarification_rows(report_path):
         it = r["item"]
-        if it.status not in ("open", "answered"):
+        if it.status not in ("open", "answered") or it.row_id in answered:
             continue
         statement, expected = r["statement"], r["expected_form"]
         refs = sorted(set(_SECTION_REF_RE.findall(statement + " " + expected)))

package/runtime/templates/reports/html/i18n/en.json

@@ -104,7 +104,9 @@
       "export-my-answers": "Export my answers",
       "at-the-foot-of-the-page": "at the foot of the page.",
       "answer-as": "Answer as",
-      "questions-waiting-on-you": "Questions waiting on you"
+      "questions-waiting-on-you": "Questions waiting on you",
+      "count-questions-waiting-on-you": "{count} questions waiting on you",
+      "your-answer-to-id": "Your answer to {id}"
     },
     "visualizations": {
       "component": "Component",

package/runtime/templates/reports/html/i18n/ko.json

@@ -104,7 +104,9 @@
       "export-my-answers": "내 답변 내보내기",
       "at-the-foot-of-the-page": "버튼을 누르세요.",
       "answer-as": "답변 형식",
-      "questions-waiting-on-you": "답변을 기다리는 질문"
+      "questions-waiting-on-you": "답변을 기다리는 질문",
+      "count-questions-waiting-on-you": "답변을 기다리는 질문 {count}건",
+      "your-answer-to-id": "{id}에 대한 답변"
     },
     "visualizations": {
       "component": "구성 요소",

package/runtime/templates/reports/html/macros/forms.html

@@ -33,14 +33,14 @@
 {% macro clarification_responses(items) -%}
 {% if items %}
 <section class="clarification-responses" aria-label="{{ t('macros.forms.questions-waiting-on-you') }}">
-  <h2>{{ items | length }} questions waiting on you</h2>
+  <h2>{{ t('macros.forms.count-questions-waiting-on-you') | replace('{count}', items | length) }}</h2>
   <p class="clarification-lede">{{ t('macros.forms.the-code-alone-could-not-settle-these-fill-i') }} <strong>{{ t('macros.forms.export-my-answers') }}</strong> {{ t('macros.forms.at-the-foot-of-the-page') }}</p>
   {% for row in items %}
   <article class="clarification-item" id="id-{{ row.id }}" data-response-id="{{ row.id }}" data-kind="{{ row.kind }}">
     <p class="eyebrow">{{ row.id }} · {{ row.kind }}</p>
     {{ row.statement | paragraphs }}
     <dl class="clarification-expected"><dt>{{ t('macros.forms.answer-as') }}</dt><dd>{{ row.expectedForm | inline_code }}</dd></dl>
-    <label for="response-{{ row.id }}">Your answer to {{ row.id }}</label>
+    <label for="response-{{ row.id }}">{{ t('macros.forms.your-answer-to-id') | replace('{id}', row.id) }}</label>
     <textarea id="response-{{ row.id }}" data-response-id="{{ row.id }}" rows="4">{{ row.userInput | default('') }}</textarea>
   </article>
   {% endfor %}

package/runtime/validators/detect_self_mock.py

@@ -41,8 +41,10 @@ redirecting ``--waivers`` at a self-authored file blocks instead of passing.
 from __future__ import annotations
 
 import argparse
+import io
 import json
 import sys
+import tokenize
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -91,16 +93,39 @@ def scannable_files(paths: list[Path]) -> list[Path]:
     return [p for p in paths if is_scannable(p)]
 
 
+def _mask_python_non_code(text: str) -> str:
+    """Blank Python strings and comments without moving any match positions."""
+    chars = list(text)
+    line_offsets = [0]
+    for line in text.splitlines(keepends=True):
+        line_offsets.append(line_offsets[-1] + len(line))
+    try:
+        tokens = tokenize.generate_tokens(io.StringIO(text).readline)
+        for token in tokens:
+            if token.type not in {tokenize.STRING, tokenize.COMMENT}:
+                continue
+            start = line_offsets[token.start[0] - 1] + token.start[1]
+            end = line_offsets[token.end[0] - 1] + token.end[1]
+            for index in range(start, end):
+                if chars[index] not in "\r\n":
+                    chars[index] = " "
+    except (tokenize.TokenError, IndentationError, SyntaxError):
+        # Broken source is scanned conservatively so a syntax error cannot hide a hit.
+        return text
+    return "".join(chars)
+
+
 def scan_files(paths: list[Path]) -> list[dict]:
     """Return one hit dict ``{file, line, signal}`` per signal match."""
     hits: list[dict] = []
     for p in scannable_files(paths):
         lang = EXT_TO_LANG[p.suffix]
         text = p.read_text(encoding="utf-8", errors="replace")
+        scan_text = _mask_python_non_code(text) if lang == "python" else text
         file_hits: list[dict] = []
         for sig in SIGNALS.get(lang, []):
-            for m in sig.pattern.finditer(text):
-                line = text[: m.start()].count("\n") + 1
+            for m in sig.pattern.finditer(scan_text):
+                line = scan_text[: m.start()].count("\n") + 1
                 file_hits.append({"file": str(p), "line": line, "signal": sig.name})
         hits.extend(sorted(file_hits, key=lambda h: (h["line"], h["signal"])))
     return hits