okstra 0.164.0 → 0.165.0

package/runtime/validators/validate-run.py

@@ -66,7 +66,7 @@ from okstra_ctl.report_translation import (  # noqa: E402
     HANGUL_PROSE_LIMIT,
     hangul_share,
 )
-from okstra_ctl.stage_citations import cited_stage_numbers  # noqa: E402
+from okstra_ctl.stage_citations import enumerated_stage_numbers  # noqa: E402
 from okstra_ctl.incremental_scope import (  # noqa: E402
     coverage_row_blocked_on,
     stages_for_clarification,
@@ -3133,6 +3133,7 @@ def validate_final_report_data(
     # Called here rather than from a task-type branch: four profiles raise
     # clarification rows, and the gate scopes itself by task type internally.
     _validate_clarification_options(data, failures)
+    _validate_open_approval_blocker_provenance(data, failures)
 
     task_type = (data.get("header") or {}).get("taskType")
     _validate_verifier_fail_blocks_verdict(data, failures)
@@ -4126,6 +4127,80 @@ def _validate_option_set(
             )
 
 
+def _validate_open_approval_blocker_provenance(
+    data: dict, failures: list[str]
+) -> None:
+    """An open approval blocker records who raised it and what the lead did about it.
+
+    A lead can foresee a blocker, write it into the report as a
+    `blocks: approval` row, and let the run finish — the row then withholds
+    approval until a separate user-response cycle answers it. That path cost a
+    full planning run: the user pointed at a reduction document and said "remove
+    what it flags", the lead read that document's own "user decision required"
+    note as outranking the instruction, and told the report writer to raise the
+    item instead of applying it. The two verifiers then agreed unanimously that
+    it was a user decision — not an independent finding, but the lead's own
+    instruction returning to it. The run spent its whole self-fix budget on a
+    gate no round could clear, because the thing blocking it was already
+    answered before the run started.
+
+    `origin` names who produced the row, so a lead-authored blocker can no
+    longer arrive dressed as a worker consensus. `userConfirmation` records what
+    the lead did before writing it. Neither is required on a row the user has
+    already answered (`answered` / `resolved`) — the record is in `userInput`.
+
+    The one shape rejected outright is a lead-directed blocker raised with no
+    interactive session: with nobody to ask, a defect the lead itself surfaced
+    belongs in `## 5. Missing Information and Risks` as a Working Assumption,
+    the same outlet the surviving planner-fixable items already use. Blocking a
+    plan on the lead's own judgment, in a run where that judgment cannot be put
+    to the user, only defers the work to a re-run.
+    """
+    for row in data.get("clarificationItems") or []:
+        if not isinstance(row, dict):
+            continue
+        if row.get("blocks") != "approval" or row.get("status") != "open":
+            continue
+        row_id = str(row.get("id") or "<unknown>")
+        origin = row.get("origin")
+        confirmation = row.get("userConfirmation")
+        if not origin:
+            failures.append(
+                f"final-report data.json: clarification `{row_id}` is an open "
+                "approval blocker with no `origin`. Record who raised it — "
+                "`worker-finding` (an analyser or verifier reached it "
+                "independently), `material-gap` (the brief and the codebase "
+                "both leave it unanswered), or `lead-directed` (the lead's own "
+                "judgment, including anything the lead instructed a worker to "
+                "raise). A lead-authored blocker recorded as a worker consensus "
+                "is how a run blocks on a question the user already answered."
+            )
+        if not confirmation:
+            failures.append(
+                f"final-report data.json: clarification `{row_id}` is an open "
+                "approval blocker with no `userConfirmation`. Record what "
+                "happened before the row was written — `asked-and-answered`, "
+                "`asked-awaiting`, or `deferred-no-interactive-session`. "
+                "Withholding approval is the most expensive thing a report can "
+                "do to a run; doing it without recording whether the user was "
+                "ever asked leaves the next run unable to tell a real blocker "
+                "from a question nobody put to them."
+            )
+        if (
+            origin == "lead-directed"
+            and confirmation == "deferred-no-interactive-session"
+        ):
+            failures.append(
+                f"final-report data.json: clarification `{row_id}` blocks "
+                "approval on the lead's own judgment (`origin: lead-directed`) "
+                "in a run with no interactive session to answer it. Record it "
+                "as a Working Assumption in `## 5. Missing Information and "
+                "Risks` and let the plan proceed — that is the outlet surviving "
+                "planner-fixable items already use. A blocker nobody can answer "
+                "inside this run only moves the work to a re-run."
+            )
+
+
 def _has_clarification_backtrace(
     row_id: str, plan_items: object, coverage: object
 ) -> bool:
@@ -6347,10 +6422,14 @@ def _validate_requirement_provenance(
 # Deliberately not `_COVERED_BY_STAGE_REF_RE`: the two directions disagree on
 # what "no match" means — forward treats it as nothing to verify and passes,
 # reverse treats it as nothing cited and orphans every stage — so the reverse
-# reader must cover `Stages 1, 2`, `Stages 1-3` and `Stage 1 and 2` too. The
-# grammar is shared with the incremental-scope back-trace, which resolves the
-# same citations in the opposite direction.
-_cited_stage_numbers = cited_stage_numbers
+# reader must cover `Stages 1, 2` and `Stage 1 and 2` too.
+#
+# It reads hand-enumerated numbers only. A range's interior is deliberately NOT
+# coverage evidence: one `Stages 1-64` cell would otherwise stamp every stage in
+# the map while the planner confirmed none of them. The incremental-scope
+# back-trace keeps the widening reader (`cited_stage_numbers`) because "could
+# this answer reach stage 5" is the opposite question and must over-approximate.
+_enumerated_stage_numbers = enumerated_stage_numbers
 
 
 # Statuses under which a row asserts the plan does work for the requirement.
@@ -6387,14 +6466,16 @@ def _validate_stage_has_requirement(data: dict, failures: list[str]) -> None:
             continue
         if not _COVERAGE_CLAIMING_STATUS_RE.match(str(row.get("status") or "").strip()):
             continue
-        cited |= _cited_stage_numbers(str(row.get("coveredBy") or ""))
+        cited |= _enumerated_stage_numbers(str(row.get("coveredBy") or ""))
 
     for orphan in sorted(stage_numbers - cited):
         failures.append(
             f"final-report data.json: Stage {orphan} is cited by no requirementCoverage "
             "row — it traces back to nothing the brief asked for. Either cite the "
             "requirement it serves, or drop it and raise it as a `Blocks=approval` "
-            "clarification (profile: scope provenance)."
+            "clarification (profile: scope provenance). A range cites only its "
+            "endpoints here: write `Stages 1, 2, 3` rather than `Stages 1-3`, so each "
+            "stage this requirement covers is one the planner named."
         )
 
 

package/runtime/validators/validate_session_conformance.py

@@ -457,6 +457,61 @@ def _plan_body_rounds_ran(run_dir: Path, suffix: str | None) -> int:
     return rounds if isinstance(rounds, int) and rounds > 0 else 0
 
 
+def _ids_reported_as_asked(report_path: Path) -> list[str]:
+    """리포트가 "사용자에게 물었다"고 기록한 열린 승인 차단 행의 id."""
+    name = report_path.name
+    if not name.endswith(".md"):
+        return []
+    data_path = report_path.with_name(name.removesuffix(".md") + ".data.json")
+    try:
+        doc = json.loads(data_path.read_text())
+    except (OSError, json.JSONDecodeError):
+        return []
+    if not isinstance(doc, dict):
+        return []
+    asked: list[str] = []
+    for row in doc.get("clarificationItems") or []:
+        if not isinstance(row, dict):
+            continue
+        if row.get("blocks") != "approval" or row.get("status") != "open":
+            continue
+        if not str(row.get("userConfirmation") or "").startswith("asked-"):
+            continue
+        row_id = str(row.get("id") or "").strip()
+        if row_id:
+            asked.append(row_id)
+    return asked
+
+
+def _check_user_confirm_checkpoints(
+    by_phase: dict[str, list[tuple[str, str]]],
+    asked_ids: list[str],
+    errors: list[str],
+) -> None:
+    """"물어봤다"는 리포트의 기록에는 물어본 흔적이 세션에 남아 있어야 한다.
+
+    승인을 막는 행은 run 하나를 통째로 대기 상태로 만든다. 그런 행을 세우기 전에
+    사용자에게 그 자리에서 묻는 것이 계약인데, 그 이행 여부를 리포트의 자기 신고
+    말고는 확인할 길이 없었다. 한 번은 리드가 차단이 생길 것을 미리 예측해 말해
+    놓고도 묻지 않은 채 행으로 만들었고, run 은 사용자가 이미 답해 둔 질문 앞에서
+    self-fix 예산을 전부 썼다. 체크포인트가 그 격차를 좁힌다 — 세션에 질문이 남지
+    않았다면 리드는 묻지 않은 것이다."""
+    if not asked_ids:
+        return
+    detail = "prompts/lead/okstra-lead-contract.md 'User confirmation before an approval blocker'"
+    asked_lines = " ".join(line for _ts, line in by_phase.get("user-confirm", []))
+    for row_id in asked_ids:
+        if row_id in asked_lines:
+            continue
+        errors.append(
+            f"PROGRESS checkpoint missing: `user-confirm {row_id}` — the final "
+            f"report records `{row_id}` as an approval blocker the user was "
+            "asked about, but no such line exists in this run's evidence. Either "
+            "ask before writing the row, or record what actually happened "
+            f"(`deferred-no-interactive-session`) ({detail})."
+        )
+
+
 def _phase_mentions_worker(lines: list[tuple[str, str]], needles: list[str]) -> bool:
     return any(needle in _norm(line) for _ts, line in lines for needle in needles)
 
@@ -560,6 +615,7 @@ def _check_progress_checkpoints(
     team_state: dict,
     run_dir: Path,
     suffix: str | None,
+    report_path: Path,
     errors: list[str],
 ) -> None:
     by_phase: dict[str, list[tuple[str, str]]] = {}
@@ -622,6 +678,9 @@ def _check_progress_checkpoints(
     _check_plan_verify_cleanup_checkpoints(
         by_phase, _plan_body_rounds_ran(run_dir, suffix), errors
     )
+    _check_user_confirm_checkpoints(
+        by_phase, _ids_reported_as_asked(report_path), errors
+    )
 
 
 def _parse_iso(ts: str) -> datetime | None:
@@ -874,7 +933,9 @@ def validate_session_conformance(
     if error:
         result.errors.append(error)
         return result
-    _check_progress_checkpoints(evidence, team_state, run_dir, suffix, result.errors)
+    _check_progress_checkpoints(
+        evidence, team_state, run_dir, suffix, report_path, result.errors
+    )
     _check_cmux_adapter_read(evidence, team_state, result.errors)
     if task_type == "implementation":
         _check_implementation_entry_guard(

package/src/cli-registry.mjs

@@ -218,13 +218,6 @@ export const COMMAND_REGISTRY = [
     category: "introspection",
     summary: ["Bundle cross-project okstra error logs into a zip"],
   },
-  {
-    name: "error-issue",
-    module: "./commands/inspect/error-issue.mjs",
-    export: "run",
-    category: "introspection",
-    summary: ["Turn okstra run anomalies into GitHub issue candidates"],
-  },
   {
     name: "run-audit",
     module: "./commands/inspect/run-audit.mjs",

package/runtime/bin/okstra-wrapper-agy-stream.py

@@ -1,61 +0,0 @@
-#!/usr/bin/env python3
-"""Split `agy --output-format stream-json` output for okstra-antigravity-exec.sh.
-
-Everything agy emits is appended to the live log, so the log becomes an audit
-trail of what the worker actually did — which tools it called, on which paths,
-for how long. In the default `text` format agy prints only its closing summary,
-so an antigravity dispatch left ~2KB of self-report against codex's ~487KB of
-tool trace, and whether the worker ever opened the evidence it was asked to
-verify could not be checked from outside.
-
-stdout stays what the dispatcher's contract expects: the final response text
-only, so the subagent's captured output is unchanged by the format switch.
-"""
-from __future__ import annotations
-
-import json
-import sys
-
-
-def main() -> int:
-    if len(sys.argv) < 2:
-        print("usage: okstra-wrapper-agy-stream.py <log-path>", file=sys.stderr)
-        return 2
-    log_path = sys.argv[1]
-    final: str | None = None
-    # Lines agy emitted that are not stream-json events. Normally empty; kept so
-    # a non-JSON emitter (a stub, an older agy, a crash banner) still reaches
-    # stdout instead of being silently swallowed.
-    passthrough: list[str] = []
-    with open(log_path, "a", encoding="utf-8") as log:
-        for line in sys.stdin:
-            log.write(line)
-            log.flush()
-            stripped = line.strip()
-            if not stripped:
-                continue
-            try:
-                event = json.loads(stripped)
-            except json.JSONDecodeError:
-                passthrough.append(line)
-                continue
-            if isinstance(event, dict) and event.get("event") == "result":
-                result = event.get("result")
-                if isinstance(result, dict):
-                    final = result.get("response") or ""
-    if final is not None:
-        sys.stdout.write(final)
-    elif passthrough:
-        sys.stdout.writelines(passthrough)
-    else:
-        print(
-            "okstra-wrapper-agy-stream: no result event in agy output — "
-            f"see {log_path}",
-            file=sys.stderr,
-        )
-    sys.stdout.flush()
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())