okstra 0.163.2 → 0.164.0

package/runtime/skills/okstra-run/SKILL.md

@@ -41,28 +41,29 @@ Every non-terminal `next` carries a `progress` object (`done` / `aborted` omit i
 
 On `ok: false`, re-prompt with the same `current.step` using the error message. The wizard never advances on validation failure; the user retries the same step. **`current` may be `null`** when the current step itself cannot render (e.g. the approved plan's Stage Map is corrupt) — that case is terminal: show `error` and stop, the user must fix the plan file before retrying. Never re-prompt off a `null` `current`.
 
-The wizard tells you *which UI to use* via `kind` (and the optional `multi` flag on `pick`):
-
-- `kind: "pick"` + `presentation: "numbered-text"` → do not call `AskUserQuestion`. Render every option as a numbered Markdown list in its original order, then consume the user's next message as the answer. Submit that message unchanged with `--answer`; the wizard accepts a 1-based number, an exact option value, or an exact option label and resolves it to the canonical value. An invalid, out-of-range, or ambiguous answer returns `ok: false` and must re-prompt the same complete list.
-- `kind: "pick"` + `multi: false` (default) → render `AskUserQuestion` with `label`, `options[].label`, and `multiSelect: false`. Use the chosen `options[].value` (single string) as the answer.
-- `kind: "pick"` + `multi: true` → render `AskUserQuestion` with `label`, `options[].label`, and `multiSelect: true`. Join the chosen `options[].value` entries with `,` into a single CSV string and submit that as `--answer "csv,values"`. If the user selects nothing, still submit `--answer ""` — the wizard will reply `ok: false` and re-prompt the same step (do not skip the call).
-- `kind: "pick_group"` → render a SINGLE `AskUserQuestion` whose questions array maps 1:1 to the wizard's `questions[]`. For each entry use `questions[].label`, `questions[].options[].label`, and `multiSelect: questions[].multi`. Collect the user's chosen `options[].value` per tab, build a JSON object keyed by each `questions[].step`, and submit it as a single literal `--answer '{"lead_model":"opus","claude_model":"default",...}'`. A tab the user leaves at its default still gets its `"default"`/`""` value in the JSON. Never split a `pick_group` into multiple `AskUserQuestion` calls — the wizard already capped it at 4 tabs and emits any remainder as the next prompt.
-- `kind: "text"` → write `label` as a plain text message and consume the user's NEXT message as the answer.
+The wizard tells you which relay operation to use via `next.interaction.kind`. Step 1 loads the current registered host's relay contract. Use the matching entry under its `interactions` object exactly; if the entry is absent, stop instead of inventing a host function or falling back silently. The only exception is the explicit `Legacy text relay compatibility` mapping selected in Step 1 when the preflight response has no `relayContract`.
+
+- `native-single` → use the current registered host's relay contract for its native single-select function. Pass every option in its original order and submit the selected `options[].value`.
+- `native-multi` → use the relay contract's native multi-select function. Pass every option in its original order and submit the selected values as one CSV answer; submit an empty selection as `--answer ""`.
+- `native-group` → use the relay contract's native grouped-question function once. Preserve every question and option, then submit one JSON object keyed by `questions[].step`; when a grouped question is multi-select, its step value is the selected option values joined as one CSV string, not a JSON array.
+- `numbered-single` → render every option as a 1-based numbered Markdown list and submit the user's next message unchanged.
+- `numbered-multi` → render every option as a 1-based numbered Markdown list and submit the user's comma-separated reply unchanged.
+- `sequential-group` → render every question in order, preserve each complete option list, collect every answer, and submit one JSON object keyed by `questions[].step`.
+- `plain-text` → write `label` as plain text and submit the user's next message unchanged.
 - `kind: "done"` → input collection finished; move to Step 5.
 - `kind: "aborted"` → the user picked abort; the wizard is terminally cancelled. Tell the user on one short line that the run setup was aborted, delete the state file (`rm` with the literal path), and stop this skill — do NOT call `render-args` or `render-bundle` (the wizard rejects `render-args` on an aborted state).
 
+Submit the answer shape required by `interaction.answerProtocol`; do not add normalization that the protocol does not request. Invalid, out-of-range, or ambiguous answers return `ok: false` and must re-render the same complete interaction.
+
 The final `confirm` step is a normal `pick` step with three options — `Proceed` / `Edit` / `Abort`(abort) — and is rendered the same way (no special handling). `Edit` rewinds to any earlier step (including `base-ref`); `Abort` terminally cancels the wizard. The branch/worktree decision the run will actually use (for `implementation`, the **stage worktree** — not the task-key directory) is folded into the Step 4 confirmation summary block as a `worktree` line, so there is no separate branch-confirm prompt.
 
-Never invent additional questions. Never reorder. **Never drop, hide, or merge a `pick` / `pick_group` option** — render every `options[]` entry, including entries that carry a `(default)` / `(recommended)` suffix. Use an `AskUserQuestion` choice unless the wizard explicitly sets `presentation: "numbered-text"`; that presentation preserves overflow choices as a numbered Markdown list. Do NOT collapse a multi-option pick into a "recommended + Enter directly / Other" shortlist: the wizard's `options[]` array IS the complete, authoritative choice set. Example: if a pick's `options[]` carries N entries, render all N — never abbreviate a multi-option step down to one recommended value. The run-prompt recommendation rule (1–2 recommendations + Enter directly) applies ONLY to prompts this skill authors itself (e.g. the conformance-waiver picker), never to wizard-provided `options[]`. Never use `AskUserQuestion` for `text` prompts — the wizard explicitly chose `text` to avoid the picker-Other re-render lag.
+Never invent additional questions. **Never drop, hide, merge, reorder, or truncate** a `pick` / `pick_group` option — relay every `options[]` entry, including entries that carry a `(default)` / `(recommended)` suffix. Do not collapse a multi-option pick into a "recommended + Enter directly / Other" shortlist. The wizard's arrays are the complete authoritative choice sets, regardless of the current host UI's usual option limit. The run-prompt recommendation rule (1–2 recommendations + Enter directly) applies only to prompts this skill authors itself, never to wizard-provided options.
 
 ## Step 1: Preflight
 
-Resolve `<host-runtime>` from the host that is executing this skill. This is a harness capability declaration, never a `which`/`PATH` inference and never a worker-provider choice:
+Use the launcher's `OKSTRA_RUNTIME_HOST` value when it is present. Otherwise use the registered host ID that the current harness declares for this session. This is a harness capability declaration, never a worker-provider choice. Do not infer it from an executable or `PATH`, and do not silently substitute another host.
 
-- Claude Code host → `claude-code`
-- Codex host → `codex`
-- Antigravity CLI host → `antigravity`
-- other host → `external`
+Record the semantic functions that the live harness can actually perform. Always include `plain_text_input`. Record `native_single_select`, `native_multi_select`, or `native_question_group` only when the current harness exposes that function. Do not infer functions from the host ID; the effective declaration is computed from the relay contract after preflight.
 
 The host-native provider runs as the current lead session when its role is supported. Other selected providers run through their registered CLI wrappers. Claude remains only the model-policy default; it is not the process owner.
 
@@ -72,15 +73,61 @@ Run one Bash tool call (Bash invocation rule from the top of this file applies):
 okstra preflight --runtime <host-runtime> --json
 ```
 
-Parse the stdout JSON. `ok: false` (or `okstra` not on `PATH` at all) → tell the user: "okstra not set up — run `/okstra-setup` first." Then stop. If the call fails with `unknown command: preflight`, the `okstra` binary on PATH predates this skill — tell the user to update it (`npm i -g okstra@latest`), then stop (`/okstra-setup` does not update the binary). Do **not** try to invoke `npx -y okstra@latest ...` as a fallback — `npx` is not on the literal-token allow-list and will force a confirmation prompt on every wizard call afterward. Every subsequent `okstra <subcmd>` call self-bootstraps its Python path, so never `export PYTHONPATH=...`.
+Parse the stdout JSON. If `ok: false` with `stage: runtime_readiness`, show `runtimeReadiness.status` and every readiness check, including each adapter-provided `action`, then stop before Step 2. Do not relabel a host login, license, daemon, trust, or other readiness failure as missing Okstra setup. Any other `ok: false` response (or `okstra` not on `PATH` at all) → tell the user: "okstra not set up — run `/okstra-setup` first." Then stop. If the call fails with `unknown command: preflight`, the `okstra` binary on PATH predates this skill — tell the user to update it (`npm i -g okstra@latest`), then stop (`/okstra-setup` does not update the binary). Do **not** try to invoke `npx -y okstra@latest ...` as a fallback — `npx` is not on the literal-token allow-list and will force a confirmation prompt on every wizard call afterward. Every subsequent `okstra <subcmd>` call self-bootstraps its Python path, so never `export PYTHONPATH=...`.
+
+When `runtimeReadiness` is present on an `ok: true` response, require `runtimeReadiness.status: ready` before Step 2. These checks come from the selected host adapter and are independent of worker-provider choices. A `blocked` or `unknown` status is a host readiness failure regardless of check IDs: show the status and checks, then stop before Step 2. Any other readiness status is unrecognized runtime output: show it and stop before Step 2 instead of guessing that the host is ready.
+
+For a ready response, read the absolute file path in `runtimeReadiness.relayContract` with the current host's file-read primitive. Do not derive the path from the host ID or search `PATH`. In that file, find the `Wizard interaction relay` JSON block, require `schemaVersion: 1` and `runtime` equal to `runtimeReadiness.runtime`, then take its `semanticFunctions` allowlist and intersect it with the functions the live harness exposes. Pass only that intersection to Step 2; `plain_text_input` must be present. Keep the parsed `interactions` object for Step 3's function/input/response conversion. An unreadable file, malformed block, runtime mismatch, absent `plain_text_input`, or later interaction kind missing from the object is a host relay contract failure: show the problem and stop rather than guessing.
+
+If `runtimeReadiness` is absent, preserve compatibility with an older preflight response: carry `projectRoot` and `projectId` into Step 2 and treat it as a response with no `relayContract`. If readiness exists but `relayContract` is absent, also enter the compatibility branch below. In that branch only, declare `plain_text_input` and keep its built-in `interactions` mapping for Step 3; do not assume a native tool from the host ID. The existing `unknown command: preflight` branch remains the authoritative stale-CLI failure.
 
-On `ok: true`, inspect `runtimeReadiness.checks` for the check whose `id` is `workspace-trust`. This check is host-specific and independent of the selected worker providers.
+### Legacy text relay compatibility
+
+Use this built-in mapping only when the successful preflight response omitted `relayContract`. It is not a fallback for an unreadable, malformed, mismatched, or incomplete relay contract. If a present relay contract omits the wizard's interaction kind, keep the fail-closed rule above and stop.
+
+```json
+{
+  "scope": "preflight-response-without-relayContract-only",
+  "semanticFunctions": ["plain_text_input"],
+  "interactions": {
+    "numbered-single": {
+      "function": "host-text",
+      "input": {
+        "question": "label-with-progress",
+        "options": "all-in-original-order-as-numbered-markdown-label-and-description"
+      },
+      "response": { "source": "next-message", "submit": "raw" }
+    },
+    "numbered-multi": {
+      "function": "host-text",
+      "input": {
+        "question": "label-with-progress",
+        "options": "all-in-original-order-as-numbered-markdown-label-and-description"
+      },
+      "response": { "source": "next-message", "submit": "raw" }
+    },
+    "sequential-group": {
+      "function": "host-text",
+      "input": {
+        "questions": "all-one-at-a-time-in-original-order",
+        "question": "label-with-progress",
+        "options": "all-in-original-order-as-numbered-markdown-label-and-description"
+      },
+      "response": {
+        "source": "next-message-by-question-position",
+        "submit": "compact-step-json-raw"
+      }
+    },
+    "plain-text": {
+      "function": "host-text",
+      "input": { "question": "label-with-progress" },
+      "response": { "source": "next-message", "submit": "raw" }
+    }
+  }
+}
+```
 
-- On `claude-code`, `status: required` with `action: restart-and-trust` → tell the user: "Claude Code must trust `<projectRoot>` before Okstra can dispatch workers. Close this session, reopen that project in Claude Code, choose `Yes, I trust this folder`, then run `/okstra-run` again." Then stop before Step 2. Never start the wizard or dispatch a worker from this session.
-- On `claude-code`, `status: unavailable` → tell the user that Claude Code workspace trust could not be verified, ask them to open `<projectRoot>` directly in Claude Code and complete any trust prompt, then run `/okstra-run` again. Then stop before Step 2.
-- `status: accepted` or `status: not-applicable` → carry `projectRoot` and `projectId` as literal strings into Step 2.
-- If `runtimeReadiness` is absent, preserve compatibility with an older preflight response: carry `projectRoot` and `projectId` into Step 2. The existing `unknown command: preflight` branch remains the authoritative stale-CLI failure.
-- Any other `workspace-trust` status is unrecognized runtime output: show the status and stop before Step 2 instead of guessing that trust exists.
+For numbered interactions, render every option as a 1-based Markdown item containing its label followed by its description verbatim, in original order. For `sequential-group`, ask every question in order and build one compact JSON object keyed by `questions[].step`. Submit each user message unchanged; the wizard owns numbered and grouped normalization.
 
 ## Step 2: Initialize the wizard
 
@@ -99,7 +146,10 @@ okstra wizard init \
   --state-file /var/folders/.../okstra-wizard.AbCd.json \
   --project-root /abs/path/to/project \
   --project-id   my-project-id \
-  --host-runtime <host-runtime>
+  --host-runtime <host-runtime> \
+  --entry-mode current-session \
+  --available-function plain_text_input \
+  --available-function <each-additional-function-in-the-effective-intersection>
 ```
 
 Output: the same `{ok, next}` JSON described above. The first `next` is always `step: "task_pick"`.
@@ -108,12 +158,7 @@ Output: the same `{ok, next}` JSON described above. The first `next` is always `
 
 Repeat until `next.kind == "done"` (or `"aborted"` — terminal cancel, see "How the wizard talks to you"):
 
-1. **Render** the prompt according to `kind` (and `multi` for pick). **Always append the progress marker to the rendered question label** (the `AskUserQuestion` question text, or the `text`-prompt message): suffix it with ` (<next.progress.label>)` — render `progress.label` exactly as the wizard sent it, never recompute it. Example: label `Step 8/11 · 3 steps remaining` → `Select a model (Step 8/11 · 3 steps remaining)`. Re-prompts after `ok: false` reuse `current.progress.label` the same way. The progress marker is presentation-only — never send it back to the wizard as part of an answer.
-   - `pick` + `presentation: "numbered-text"` → plain text containing `label`, followed by every option as a numbered Markdown list. Consume the user's next message verbatim as the answer string.
-   - `pick` + `multi: false` → `AskUserQuestion` with `multiSelect: false`, `label`, and `options`. The user's chosen option's `value` is the answer string.
-   - `pick` + `multi: true` → `AskUserQuestion` with `multiSelect: true`, `label`, and `options`. Join the selected `value`s with `,` into a single literal CSV string (e.g. `"claude,codex,grok,kimi"`) and submit it as one `--answer` value. Empty selection submits `--answer ""` and the wizard re-prompts.
-   - `pick_group` → one `AskUserQuestion` with one question per `questions[]` entry (tab). Map each tab's selected `value` back by `questions[].step`, assemble a JSON object, and submit it as a single literal `--answer '<json>'`.
-   - `text` → plain text message containing `label`. Consume the user's next reply verbatim as the answer string (empty reply = empty string).
+1. **Render** the prompt according to `next.interaction.kind` using the relay rules above. **Always append the progress marker to the rendered question label**: suffix it with ` (<next.progress.label>)` — render `progress.label` exactly as the wizard sent it, never recompute it. Example: label `Step 8/11 · 3 steps remaining` → `Select a model (Step 8/11 · 3 steps remaining)`. Re-prompts after `ok: false` reuse `current.progress.label` the same way. The progress marker is presentation-only — never send it back to the wizard as part of an answer.
 2. **Submit** the answer — call `okstra wizard step` with the literal state-file path from Step 2 and the literal user answer (no shell variables, no `$(...)`):
    ```bash
    okstra wizard step --state-file /var/folders/.../okstra-wizard.AbCd.json --answer preprod
@@ -217,7 +262,7 @@ okstra render-bundle \
 
 The python function underneath is mutex-protected (`~/.okstra/.locks/<task-key>.lock`), writes `run-context-*.json` + `run-inputs-*.json` + all manifests + discovery files, and registers the run in `~/.okstra/recent.jsonl` with status `prepared`.
 
-You can delete the literal state-file path after this point — its job is done. Invoke `rm` with the literal path (e.g. `rm /var/folders/.../okstra-wizard.AbCd.json`), not a shell variable.
+You can delete the literal state-file path after this point — its job is done. Invoke `command rm` with the literal path (e.g. `command rm /var/folders/.../okstra-wizard.AbCd.json`), not a shell variable. `command` is what keeps a `rm='rm -i'` alias from turning this into a confirmation prompt nobody is there to answer.
 
 <!-- BEGIN FRAGMENT: host-orchestration-implementation -->
 ## Host orchestration rules — implementation

package/runtime/templates/implementation-worker-preamble.md

@@ -31,7 +31,7 @@ When `**Evidence ledger:** required-v1` is present, append one canonical row to
 
 - Evidence read: `<project-relative path without a line suffix>`
 
-Every file citation in the result MUST use backticks and a line suffix, for example `src/config/env.ts:1-22`. A cited path without a matching ledger row fails Phase 7 in `validators/validate-run.py` `validate_worker_results_audit()`. Do not add a row for a file you did not open.
+Every file citation in the result MUST use backticks, a line suffix, and the same project-relative path its ledger row carries — for example `src/config/env.ts:1-22`. A bare filename (`env.ts:1-22`) does not match its row and fails exactly like a file you never opened, however many times you cited the full path earlier. A cited path without a matching ledger row fails Phase 7 in `validators/validate-run.py` `validate_worker_results_audit()`. Do not add a row for a file you did not open.
 
 ## Anchor headers
 

package/runtime/templates/reports/final-report.template.md

@@ -380,10 +380,10 @@ Carried-forward plan items retain their prior verdicts verbatim; each such item
 
 ### Stepwise Execution Order
 
-| step | action | files | command | expected |
-|------|--------|-------|---------|----------|
+| step | action | files | command | outcome | expected |
+|------|--------|-------|---------|---------|----------|
 {% for row in stage.stepwiseExecution -%}
-| {{ row.step | mdcell }} | {{ row.action | mdcell }} | `{{ row.files | mdcell }}` | `{{ row.command | mdcell }}` | {{ row.expected | mdcell }} |
+| {{ row.step | mdcell }} | {{ row.action | mdcell }} | `{{ row.files | mdcell }}` | `{{ row.command | mdcell }}` | {{ row.outcome | mdcell }} | {{ row.expectedDetail | mdcell }} |
 {% endfor %}
 
 ### Stage Exit Contract

package/runtime/templates/reports/html/i18n/en.json

@@ -297,7 +297,9 @@
       "topic": "Topic",
       "why": "Why",
       "open-decisions-before-approval": "Open decisions before approval",
-      "no-open-decision-is-holding-approval": "No open decision is holding approval."
+      "no-open-decision-is-holding-approval": "No open decision is holding approval.",
+      "uniform-verifier-label": "Uniform verifier",
+      "uniform-verifier-legend": "This verifier answered the same verdict to every item it voted on, so this round's refutation signal came from its peers alone — the gate above reads as a wider cross-check than it was. A unanimous round is a legitimate outcome; confirm from the worker's audit sidecar that it actually opened the cited evidence."
     },
     "implementation": {
       "what-was-delivered": "What was delivered",

package/runtime/templates/reports/html/i18n/ko.json

@@ -297,7 +297,9 @@
       "topic": "주제",
       "why": "이유",
       "open-decisions-before-approval": "승인 전에 남은 결정",
-      "no-open-decision-is-holding-approval": "승인을 막는 미결 결정이 없습니다."
+      "no-open-decision-is-holding-approval": "승인을 막는 미결 결정이 없습니다.",
+      "uniform-verifier-label": "단일 판정 검증자",
+      "uniform-verifier-legend": "이 검증자는 자기가 투표한 모든 항목에 같은 판정을 냈습니다. 그래서 이번 라운드의 반증 신호는 나머지 검증자에게서만 나왔고, 위의 게이트 값은 실제보다 넓은 교차 검증처럼 읽힙니다. 만장일치도 정당한 결과이므로, 그 워커의 audit 사이드카에서 인용한 근거를 실제로 열어봤는지 확인하십시오."
     },
     "implementation": {
       "what-was-delivered": "무엇을 만들었나",

package/runtime/templates/reports/html/tasks/implementation-planning.template.html

@@ -69,7 +69,7 @@
   <h2>{{ t('tasks.implementation-planning.plan-body-verification') }}</h2>
   <p><strong>{{ t('tasks.implementation-planning.verdict') }}</strong> — {{ planning.planBodyVerification.gateResult | inline_code }} ({{ planning.planBodyVerification.roundCount }} rounds{% if planning.planBodyVerification.get("selfFixRoundsApplied") is not none %}, {{ planning.planBodyVerification.selfFixRoundsApplied }} self-fix rounds{% if planning.planBodyVerification.get("selfFixStopReason") %} · {{ planning.planBodyVerification.selfFixStopReason | inline_code }}{% endif %}{% endif %})</p>
   {% if planning.planBodyVerification.get("gateBlockedBy") %}<p><strong>{{ t('tasks.implementation-planning.what-it-blocked') }}</strong> — {{ planning.planBodyVerification.gateBlockedBy | join(", ") | inline_code }}</p>{% endif %}
-  {% if planning.planBodyVerification.get("uniformVerifiers") %}<p><strong>{{ t('implementationPlanning.planBodyUniformVerifierLabel') }}</strong> — {% for u in planning.planBodyVerification.uniformVerifiers %}{{ u.worker | inline_code }} → {{ u.verdict | inline_code }} ({{ u.itemCount }}){% if not loop.last %}, {% endif %}{% endfor %}<br><small>{{ t('implementationPlanning.planBodyUniformVerifierLegend') }}</small></p>{% endif %}
+  {% if planning.planBodyVerification.get("uniformVerifiers") %}<p><strong>{{ t('tasks.implementation-planning.uniform-verifier-label') }}</strong> — {% for u in planning.planBodyVerification.uniformVerifiers %}{{ u.worker | inline_code }} → {{ u.verdict | inline_code }} ({{ u.itemCount }}){% if not loop.last %}, {% endif %}{% endfor %}<br><small>{{ t('tasks.implementation-planning.uniform-verifier-legend') }}</small></p>{% endif %}
   <table><thead><tr><th>{{ t('tasks.implementation-planning.plan-item') }}</th><th>{{ t('tasks.implementation-planning.subject') }}</th></tr></thead><tbody>{% for row in planning.planBodyVerification.planItems %}<tr id="id-{{ row.id }}">{{ row_key(pairs=[("ID", row.id), ("Source section", row.sourceSection)]) }}<td>{{ row.subject | inline_code }}</td></tr>{% endfor %}</tbody></table>
   {% if planning.planBodyVerification.get("dissentLog") %}<h3>{{ t('tasks.implementation-planning.dissent-left-standing') }}</h3>
   <table><thead><tr><th>{{ t('tasks.implementation-planning.subject') }}</th><th>{{ t('tasks.implementation-planning.body') }}</th></tr></thead><tbody>{% for row in planning.planBodyVerification.dissentLog %}<tr>{{ row_key(pairs=[("Subject", row.planItem), ("Worker", row.workerRole)]) }}<td>{{ row.body | inline_code }}</td></tr>{% endfor %}</tbody></table>{% endif %}

package/runtime/templates/worker-prompt-preamble.md

@@ -29,7 +29,7 @@ When `**Evidence ledger:** required-v1` is present, append one canonical row to
 
 - Evidence read: `<project-relative path without a line suffix>`
 
-Every file citation in the result MUST use backticks and a line suffix, for example `src/config/env.ts:1-22`. A cited path without a matching ledger row fails Phase 7 in `validators/validate-run.py` `validate_worker_results_audit()`. Do not add a row for a file you did not open.
+Every file citation in the result MUST use backticks, a line suffix, and the same project-relative path its ledger row carries — for example `src/config/env.ts:1-22`. A bare filename (`env.ts:1-22`) does not match its row and fails exactly like a file you never opened, however many times you cited the full path earlier. A cited path without a matching ledger row fails Phase 7 in `validators/validate-run.py` `validate_worker_results_audit()`. Do not add a row for a file you did not open.
 
 ## Anchor headers (lead-injected, BLOCKING)
 

package/runtime/validators/validate-implementation-plan-stages.py

@@ -235,8 +235,14 @@ def _check_slice_tdd(text: str, stages: List[StageMapStage]) -> List[ValidationE
 
 
 def _check_red_green_steps(section: str, stage_number: int) -> List[ValidationError]:
-    """S10c: RED-first + later GREEN, with each step's `expected` cell matching
-    its prefix (RED → FAIL, GREEN → PASS). Only certain violations fire."""
+    """S10c: RED-first + later GREEN, with each step's `outcome` cell matching
+    its prefix (RED → FAIL, GREEN → PASS).
+
+    `outcome` is its own column, holding one of two words; the sentence about
+    what that looks like lives in `expected` beside it. Written as one cell the
+    author had to bury a literal token inside prose, and the rule fired on
+    fourteen rows of one measured plan whose prose was correct throughout.
+    """
     rows = _effective_step_rows(section)
     steps = [(r[1], r[4]) for r in rows if len(r) > 4]
     actions = [a for a, _ in steps]
@@ -248,16 +254,14 @@ def _check_red_green_steps(section: str, stage_number: int) -> List[ValidationEr
             "S10c: first step action must start with 'RED:' and some "
             "step action with 'GREEN:', or add a 'TDD exemption:' line"))
         return errs
-    for action, expected in steps:
-        exp = expected.upper()
-        if action.startswith("RED:") and "FAIL" not in exp:
+    for action, outcome in steps:
+        cell = outcome.strip().upper()
+        if action.startswith("RED:") and cell != "FAIL":
             errs.append(ValidationError("S10", stage_number,
-                "S10c: 'RED:' step's expected cell must read FAIL, got "
-                f"'{expected}'"))
-        elif action.startswith("GREEN:") and "PASS" not in exp:
+                f"S10c: 'RED:' step's outcome cell must be FAIL, got '{outcome}'"))
+        elif action.startswith("GREEN:") and cell != "PASS":
             errs.append(ValidationError("S10", stage_number,
-                "S10c: 'GREEN:' step's expected cell must read PASS, got "
-                f"'{expected}'"))
+                f"S10c: 'GREEN:' step's outcome cell must be PASS, got '{outcome}'"))
     return errs
 
 
@@ -432,18 +436,9 @@ def _check_data_slice_tdd(stage: dict) -> List[ValidationError]:
         return [ValidationError("S10", number,
             "S10c: first stepwiseExecution action must start with 'RED:' and "
             "some action with 'GREEN:', or declare a 'tddExemption'")]
-
-    errs: List[ValidationError] = []
-    for step in steps:
-        action = str(step.get("action") or "")
-        expected = str(step.get("expected") or "")
-        if action.startswith("RED:") and "FAIL" not in expected.upper():
-            errs.append(ValidationError("S10", number,
-                f"S10c: 'RED:' step's expected must read FAIL, got '{expected}'"))
-        elif action.startswith("GREEN:") and "PASS" not in expected.upper():
-            errs.append(ValidationError("S10", number,
-                f"S10c: 'GREEN:' step's expected must read PASS, got '{expected}'"))
-    return errs
+    # Whether each row's own `outcome` agrees with its RED/GREEN prefix is a
+    # schema conditional now (`StageStepRow.allOf`), not a string search here.
+    return []
 
 
 def _check_data_step_counts(

package/runtime/validators/validate-report-views.py

@@ -23,7 +23,6 @@ per line to stderr.
 from __future__ import annotations
 
 import argparse
-import hashlib
 import json
 import re
 import sys
@@ -40,9 +39,7 @@ from okstra_ctl.clarification_items import (  # noqa: E402
 )
 from okstra_ctl.report_views import (  # noqa: E402
     analysis_review_context,
-    extract_html_digest,
     plan_approval_context,
-    source_digest,
 )
 from okstra_ctl.report_view_artifacts import html_view_path  # noqa: E402
 from okstra_ctl.final_report_paths import final_report_data_path  # noqa: E402
@@ -76,15 +73,6 @@ def _main_body(html_text: str) -> str:
     return match.group("body")
 
 
-def _sha256(path: Path) -> str:
-    return hashlib.sha256(path.read_bytes()).hexdigest()
-
-
-def _digest_from_run_meta(html_text: str, key: str) -> str:
-    match = re.search(rf'"{re.escape(key)}"\s*:\s*"([0-9a-f]{{64}})"', html_text)
-    return match.group(1) if match else ""
-
-
 def _load_v2_data(report_path: Path) -> tuple[Path, dict] | None:
     data_path = final_report_data_path(report_path)
     if not data_path.is_file():
@@ -106,17 +94,6 @@ def _validate_v2(report_path: Path, data_path: Path, data: dict) -> list[str]:
     main_body = _main_body(html_text)
     failures: list[str] = []
 
-    for key, path in (
-        ("source-data-sha256", data_path),
-        ("source-md-sha256", report_path),
-    ):
-        recorded = _digest_from_run_meta(html_text, key)
-        expected = _sha256(path)
-        if not recorded:
-            failures.append(f"html missing {key} in run-meta")
-        elif recorded != expected:
-            failures.append(f"stale html: {key} does not match current source")
-
     task_type = data.get("header", {}).get("taskType", "")
     if f'data-task-template="{task_type}"' not in html_text:
         failures.append(f"v2 html task template mismatch for {task_type}")
@@ -236,22 +213,6 @@ def validate(report_path: Path) -> list[str]:
     html_text = html_path.read_text(encoding="utf-8")
     html_body = _main_body(html_text)
 
-    # (2) source-digest staleness — html's run-meta source-sha256 must
-    # match the current MD's digest. Mismatch means the html was
-    # rendered against an older MD body and Phase 7 step 1.5 was not
-    # re-run.
-    expected_md_digest = source_digest(md)
-    html_digest = extract_html_digest(html_text)
-    if html_digest is None:
-        failures.append(
-            "html missing source-sha256 in run-meta — re-render with okstra render-views"
-        )
-    elif html_digest != expected_md_digest:
-        failures.append(
-            f"stale html: source-sha256 {html_digest[:12]}… does not match "
-            f"current MD {expected_md_digest[:12]}…"
-        )
-
     # (3) deliverable sections contain no form controls
     for chunk in _no_form_sections(html_body):
         if "<textarea" in chunk or "<input" in chunk or "<select" in chunk:

package/runtime/validators/validate-run.py

@@ -51,7 +51,8 @@ from okstra_ctl.conformance import (  # noqa: E402
     validate_conformance_manifest,
 )
 from okstra_ctl.paths import RunRef  # noqa: E402
-from okstra_ctl.lead_runtime import ARTIFACT_ONLY_LEAD_RUNTIMES  # noqa: E402
+from okstra_ctl.domain.host import HostNotRegistered  # noqa: E402
+from okstra_ctl.registry.host_registry import default_host_registry  # noqa: E402
 from okstra_ctl.build_tools import (  # noqa: E402
     command_invokes_build_tool,
     resolve_build_tool_tokens,
@@ -170,11 +171,11 @@ def _session_accounting(team_state: dict) -> str:
     value = str(adapter.get("sessionAccounting", "")).strip()
     if value:
         return value
-    return (
-        "artifact-only"
-        if team_state.get("leadRuntime") in ARTIFACT_ONLY_LEAD_RUNTIMES
-        else "claude-jsonl"
-    )
+    runtime = str(team_state.get("leadRuntime", "")).strip()
+    try:
+        return default_host_registry().resolve(runtime).descriptor.session_accounting
+    except HostNotRegistered:
+        return "claude-jsonl"
 
 
 
@@ -742,7 +743,7 @@ def validate_team_state(
         dispatch_mode = str(team_state.get("dispatchMode", "")).strip()
         if (
             dispatch_mode in WORKER_DISPATCH_MODES
-            or team_state.get("leadRuntime") in ARTIFACT_ONLY_LEAD_RUNTIMES
+            or _session_accounting(team_state) == "artifact-only"
         ):
             if dispatch_mode not in WORKER_DISPATCH_MODES:
                 expected = ", ".join(sorted(WORKER_DISPATCH_MODES))

package/runtime/validators/validate_session_conformance.py

@@ -39,7 +39,8 @@ from okstra_ctl.worker_heartbeat import (  # noqa: E402
     IN_STAGE_PREFIX,
     max_gap_seconds_after,
 )
-from okstra_ctl.lead_runtime import ARTIFACT_ONLY_LEAD_RUNTIMES  # noqa: E402
+from okstra_ctl.domain.host import HostNotRegistered  # noqa: E402
+from okstra_ctl.registry.host_registry import default_host_registry  # noqa: E402
 from okstra_ctl.wrapper_status import read_wrapper_status  # noqa: E402
 
 _DISPATCHED_STATUSES = {"completed", "timeout", "error", "in-progress"}
@@ -414,7 +415,11 @@ def _conformance_evidence_source(
             return None, f"unsupported sessionAccounting: `{accounting}`"
 
     legacy_runtime = str(team_state.get("leadRuntime", "") or "claude-code")
-    if legacy_runtime in ARTIFACT_ONLY_LEAD_RUNTIMES:
+    try:
+        accounting = default_host_registry().resolve(legacy_runtime).descriptor.session_accounting
+    except HostNotRegistered:
+        accounting = "claude-jsonl"
+    if accounting == "artifact-only":
         return "artifact-only", None
     return "claude-jsonl", None
 

package/src/commands/execute/render-bundle.mjs

@@ -1,6 +1,6 @@
 import { runPythonModule } from "../../lib/python-helper.mjs";
 import { resolvePaths } from "../../lib/paths.mjs";
-import { resolveRuntime } from "../../lib/runtime-resolver.mjs";
+import { resolveRuntime } from "../../lib/host-registry-client.mjs";
 
 const USAGE = `okstra render-bundle — preview the task bundle without launching a lead
 
@@ -18,7 +18,7 @@ Usage:
     [--analysis-target <text>] [--evidence-inputs <csv>] \\
     [--lead-model <m>] [--claude-model <m>] [--codex-model <m>] \\
     [--antigravity-model <m>] [--report-writer-model <m>] \\
-    [--lead-runtime claude-code|codex|antigravity|external] \\
+    [--lead-runtime auto|<host-id-or-alias>] \\
     [--related-tasks <list>] [--base-ref <ref>] \\
     [--clarification-response <path>] [--work-category <cat>] \\
     [--stage <auto|N>] [--stages <csv>] [--pr-template-path <path>] \\
@@ -26,7 +26,7 @@ Usage:
 
   --stage             implementation / final-verification only
   --stages            release-handoff only: PR stage bundle csv (empty = whole-task)
-  --lead-runtime      host-native lead adapter marker
+  --lead-runtime      registered host ID or alias
   --pr-template-path  release-handoff only
   --fix-cycle         entry phase only: record this re-entry of a done task as a
                       bug-fix cycle (yes opens/continues the cycle)
@@ -85,7 +85,7 @@ export async function run(args) {
   }
 
   const requestedRuntime = findFlagValue(args, "--lead-runtime") || "auto";
-  const runtimeResolution = resolveRuntime({
+  const runtimeResolution = await resolveRuntime({
     requestedRuntime,
     command: "render",
     env: process.env,

package/src/commands/execute/run.mjs

@@ -5,14 +5,14 @@ import { join } from "node:path";
 import { runEnsureInstalled } from "../lifecycle/install.mjs";
 import { runPythonModule } from "../../lib/python-helper.mjs";
 import { resolvePaths } from "../../lib/paths.mjs";
-import { resolveRuntime } from "../../lib/runtime-resolver.mjs";
+import { resolveRuntime } from "../../lib/host-registry-client.mjs";
 
 const USAGE = `okstra run — host-aware okstra execution front door
 
 Usage:
-  okstra run [claude|codex|antigravity|external] --project-root <dir> \\
+  okstra run [<host-id-or-alias>] --project-root <dir> \\
     --project-id <id> --task-group <tg> --task-id <tid> --task-type <type> \\
-    [--lead-runtime auto|claude-code|codex|antigravity|external] [--yes]
+    [--lead-runtime auto|<host-id-or-alias>] [--yes]
 
 The leading word selects the lead and is an alias for --lead-runtime, so
 'okstra run codex' starts a Codex lead. Naming a lead starts that CLI with the
@@ -21,22 +21,6 @@ team. Starting a lead whose CLI sandboxes itself asks for confirmation first,
 which --yes answers.
 `;
 
-// Leads okstra can start itself. `external` is not one: it names a harness
-// okstra does not own, so those runs are orchestrated rather than launched.
-const LAUNCHABLE_RUNTIMES = new Set(["claude-code", "codex", "antigravity"]);
-
-// The leading word users actually type. `claude` is the provider's name while
-// the runtime is `claude-code`; the rest coincide.
-const RUNTIME_ALIASES = new Map([
-  ["claude", "claude-code"],
-  ["claude-code", "claude-code"],
-  ["codex", "codex"],
-  ["antigravity", "antigravity"],
-  ["avg", "antigravity"],
-  ["agy", "antigravity"],
-  ["external", "external"],
-]);
-
 function flagValue(args, flag) {
   const equals = args.find((arg) => arg.startsWith(`${flag}=`));
   if (equals) return equals.slice(flag.length + 1);
@@ -46,8 +30,7 @@ function flagValue(args, flag) {
 
 export function positionalRuntime(args) {
   const first = args[0];
-  if (!first || first.startsWith("-")) return "";
-  return RUNTIME_ALIASES.get(first) || "";
+  return !first || first.startsWith("-") ? "" : first;
 }
 
 export function requestedRuntimeFromArgs(args) {
@@ -91,7 +74,7 @@ function renderArgs(args, resolution) {
 export function buildRunPlan({ args, paths, resolution, runManifestPath = "" }) {
   void paths;
   const projectRoot = projectRootFromArgs(args);
-  if (resolution.resolvedRuntime === "external") {
+  if (resolution.launchMode === "team") {
     return {
       ok: true,
       kind: "team",
@@ -104,7 +87,7 @@ export function buildRunPlan({ args, paths, resolution, runManifestPath = "" })
     };
   }
 
-  if (LAUNCHABLE_RUNTIMES.has(resolution.resolvedRuntime)) {
+  if (resolution.launchMode === "lead") {
     return {
       ok: true,
       kind: "launch-lead",
@@ -130,7 +113,7 @@ export function buildRunPlan({ args, paths, resolution, runManifestPath = "" })
     };
   }
 
-  return { ok: false, reason: `unsupported resolved runtime: ${resolution.resolvedRuntime}`, commands: [] };
+  return { ok: false, reason: `unsupported launch mode: ${resolution.launchMode}`, commands: [] };
 }
 
 async function ensureRuntime(requestedRuntime) {
@@ -182,7 +165,7 @@ export async function run(args) {
 
   const paths = await resolvePaths();
   const requestedRuntime = requestedRuntimeFromArgs(args);
-  const resolution = resolveRuntime({
+  const resolution = await resolveRuntime({
     requestedRuntime,
     command: "run",
     env: process.env,