okstra 0.173.0 → 0.175.1

package/runtime/python/okstra_ctl/mutation_recovery.py

@@ -0,0 +1,293 @@
+"""Mutation recovery decisions after sealed or unsealed implementer attempts."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Literal, Mapping, Sequence
+
+from .attempt_evidence import AttemptEvidenceSeal, _sha
+from .dispatch_state import build_dispatch_id
+from .execution_identity import ExecutionManifestError
+from .execution_manifest import (
+    _replace_manifest,
+    _write_manifest_over_existing,
+    read_execution_manifest,
+)
+from .run_context import task_mutex
+
+
+class MutationRecoveryError(ValueError):
+    """Raised when a recovery decision cannot be recorded or applied."""
+
+
+@dataclass(frozen=True)
+class MutationRecoveryInput:
+    manifest_path: Path
+    source_invocation_ref: str
+    source_attempt_ref: str
+    source_evidence_seal_ref: str | None
+    original_baseline_digest: str
+    terminal_source_diff_digest: str
+    terminal_git_chain_digest: str
+    verifier_role_execution_ref: str | None
+    verifier_invocation_ref: str | None
+    verifier_participant_ref: str | None
+    implementer_participant_ref: str
+    recovered_evidence_refs: tuple[Mapping[str, Any], ...]
+    recovered_out_of_plan_edits: tuple[Mapping[str, Any], ...]
+    current_source_diff_digest: str
+    current_git_chain_digest: str
+
+
+@dataclass(frozen=True)
+class MutationRecoveryDecision:
+    recovery_ref: str
+    source_invocation_ref: str
+    source_attempt_ref: str
+    source_evidence_seal_ref: str | None
+    original_baseline_digest: str
+    terminal_source_diff_digest: str
+    terminal_git_chain_digest: str
+    verifier_role_execution_ref: str | None
+    verifier_invocation_ref: str | None
+    recovered_evidence_refs: tuple[Mapping[str, Any], ...]
+    recovered_out_of_plan_edits: tuple[Mapping[str, Any], ...]
+    unmet_obligations: tuple[str, ...]
+    decision: Literal["carry-forward", "reject", "cleanup-confirmed"]
+    reason: str = ""
+
+    def to_payload(self) -> dict[str, Any]:
+        return {
+            "recoveryRef": self.recovery_ref,
+            "sourceInvocationRef": self.source_invocation_ref,
+            "sourceAttemptRef": self.source_attempt_ref,
+            "sourceEvidenceSealRef": self.source_evidence_seal_ref,
+            "originalBaselineDigest": self.original_baseline_digest,
+            "terminalSourceDiffDigest": self.terminal_source_diff_digest,
+            "terminalGitChainDigest": self.terminal_git_chain_digest,
+            "verifierRoleExecutionRef": self.verifier_role_execution_ref,
+            "verifierInvocationRef": self.verifier_invocation_ref,
+            "recoveredEvidenceRefs": [dict(row) for row in self.recovered_evidence_refs],
+            "recoveredOutOfPlanEdits": [
+                dict(row) for row in self.recovered_out_of_plan_edits
+            ],
+            "unmetObligations": list(self.unmet_obligations),
+            "decision": self.decision,
+            "reason": self.reason,
+        }
+
+    @classmethod
+    def from_payload(cls, payload: Mapping[str, Any]) -> "MutationRecoveryDecision":
+        return cls(
+            recovery_ref=str(payload["recoveryRef"]),
+            source_invocation_ref=str(payload["sourceInvocationRef"]),
+            source_attempt_ref=str(payload["sourceAttemptRef"]),
+            source_evidence_seal_ref=payload.get("sourceEvidenceSealRef"),
+            original_baseline_digest=str(payload.get("originalBaselineDigest") or ""),
+            terminal_source_diff_digest=str(
+                payload.get("terminalSourceDiffDigest") or ""
+            ),
+            terminal_git_chain_digest=str(payload.get("terminalGitChainDigest") or ""),
+            verifier_role_execution_ref=payload.get("verifierRoleExecutionRef"),
+            verifier_invocation_ref=payload.get("verifierInvocationRef"),
+            recovered_evidence_refs=tuple(payload.get("recoveredEvidenceRefs") or ()),
+            recovered_out_of_plan_edits=tuple(
+                payload.get("recoveredOutOfPlanEdits") or ()
+            ),
+            unmet_obligations=tuple(payload.get("unmetObligations") or ()),
+            decision=str(payload["decision"]),
+            reason=str(payload.get("reason") or ""),
+        )
+
+
+def _seal_for(manifest, seal_ref: str | None) -> AttemptEvidenceSeal | None:
+    if not seal_ref:
+        return None
+    row = next(
+        (
+            item
+            for item in manifest.attempt_evidence_seals
+            if item.get("sealRef") == seal_ref
+        ),
+        None,
+    )
+    return AttemptEvidenceSeal.from_payload(row) if row is not None else None
+
+
+def _verify_sealed_bytes(seal: AttemptEvidenceSeal) -> None:
+    stream_path = seal.host_event_stream.get("path")
+    if isinstance(stream_path, str) and stream_path:
+        data = Path(stream_path).read_bytes()
+        if _sha(data) != seal.host_event_stream.get("sha256"):
+            raise MutationRecoveryError("sealed bytes changed")
+        if len(data) != seal.host_event_stream.get("byteLength"):
+            raise MutationRecoveryError("sealed bytes changed")
+    for artifact in seal.artifacts:
+        path = Path(str(artifact["normalizedPath"]))
+        data = path.read_bytes() if path.is_file() else b""
+        if _sha(data) != artifact.get("sha256"):
+            raise MutationRecoveryError("sealed bytes changed")
+
+
+def evaluate_mutation_recovery(
+    recovery: MutationRecoveryInput,
+) -> MutationRecoveryDecision:
+    """Decide carry-forward or reject from sealed evidence."""
+    manifest = read_execution_manifest(recovery.manifest_path)
+    attempt = next(
+        (
+            row
+            for row in manifest.attempts
+            if build_dispatch_id(row.invocation_ref, row.attempt)
+            == recovery.source_attempt_ref
+        ),
+        None,
+    )
+    if attempt is None:
+        raise MutationRecoveryError("source attempt is unknown")
+    if attempt.status == "evidence-unsealed":
+        return MutationRecoveryDecision(
+            recovery_ref=f"recovery-reject-{attempt.attempt}",
+            source_invocation_ref=recovery.source_invocation_ref,
+            source_attempt_ref=recovery.source_attempt_ref,
+            source_evidence_seal_ref=None,
+            original_baseline_digest=recovery.original_baseline_digest,
+            terminal_source_diff_digest=recovery.terminal_source_diff_digest,
+            terminal_git_chain_digest=recovery.terminal_git_chain_digest,
+            verifier_role_execution_ref=None,
+            verifier_invocation_ref=None,
+            recovered_evidence_refs=(),
+            recovered_out_of_plan_edits=(),
+            unmet_obligations=("evidence-unsealed",),
+            decision="reject",
+            reason="evidence-unsealed",
+        )
+    unmet: list[str] = []
+    if not recovery.source_evidence_seal_ref:
+        unmet.append("missing-source-seal")
+    if not recovery.recovered_evidence_refs:
+        unmet.append("missing-host-tdd-events")
+    if (
+        recovery.verifier_participant_ref
+        and recovery.verifier_participant_ref == recovery.implementer_participant_ref
+    ):
+        unmet.append("verifier-not-independent")
+    if not recovery.verifier_invocation_ref:
+        unmet.append("missing-verifier-invocation")
+    recovered_paths = {
+        str(row.get("path"))
+        for row in recovery.recovered_out_of_plan_edits
+        if isinstance(row, Mapping) and row.get("path")
+    }
+    sealed = _seal_for(manifest, recovery.source_evidence_seal_ref)
+    if sealed is not None:
+        _verify_sealed_bytes(sealed)
+        if recovered_paths - set(sealed.changed_paths):
+            raise MutationRecoveryError("out-of-plan path set differs")
+        if recovered_paths:
+            raise MutationRecoveryError("out-of-plan path set differs")
+    if unmet:
+        return MutationRecoveryDecision(
+            recovery_ref=f"recovery-reject-{attempt.attempt}",
+            source_invocation_ref=recovery.source_invocation_ref,
+            source_attempt_ref=recovery.source_attempt_ref,
+            source_evidence_seal_ref=recovery.source_evidence_seal_ref,
+            original_baseline_digest=recovery.original_baseline_digest,
+            terminal_source_diff_digest=recovery.terminal_source_diff_digest,
+            terminal_git_chain_digest=recovery.terminal_git_chain_digest,
+            verifier_role_execution_ref=recovery.verifier_role_execution_ref,
+            verifier_invocation_ref=recovery.verifier_invocation_ref,
+            recovered_evidence_refs=recovery.recovered_evidence_refs,
+            recovered_out_of_plan_edits=recovery.recovered_out_of_plan_edits,
+            unmet_obligations=tuple(unmet),
+            decision="reject",
+            reason="unmet-obligations",
+        )
+    return MutationRecoveryDecision(
+        recovery_ref=f"recovery-carry-{attempt.attempt}",
+        source_invocation_ref=recovery.source_invocation_ref,
+        source_attempt_ref=recovery.source_attempt_ref,
+        source_evidence_seal_ref=recovery.source_evidence_seal_ref,
+        original_baseline_digest=recovery.original_baseline_digest,
+        terminal_source_diff_digest=recovery.terminal_source_diff_digest,
+        terminal_git_chain_digest=recovery.terminal_git_chain_digest,
+        verifier_role_execution_ref=recovery.verifier_role_execution_ref,
+        verifier_invocation_ref=recovery.verifier_invocation_ref,
+        recovered_evidence_refs=recovery.recovered_evidence_refs,
+        recovered_out_of_plan_edits=recovery.recovered_out_of_plan_edits,
+        unmet_obligations=(),
+        decision="carry-forward",
+        reason="",
+    )
+
+
+def confirm_mutation_cleanup(
+    manifest_path: Path,
+    recovery_ref: str,
+    *,
+    original_baseline_digest: str,
+    current_baseline_digest: str,
+    task_key: str,
+) -> MutationRecoveryDecision:
+    """Allow a new invocation after user cleanup matches the original baseline."""
+    if current_baseline_digest != original_baseline_digest:
+        raise MutationRecoveryError("cleanup does not restore the original baseline")
+    with task_mutex(task_key):
+        manifest = read_execution_manifest(manifest_path)
+        source = next(
+            (
+                MutationRecoveryDecision.from_payload(row)
+                for row in manifest.mutation_recovery_decisions
+                if row.get("recoveryRef") == recovery_ref
+            ),
+            None,
+        )
+        if source is None or source.decision != "reject":
+            raise MutationRecoveryError("cleanup requires a prior reject decision")
+        confirmed = MutationRecoveryDecision(
+            recovery_ref=f"{recovery_ref}-cleanup",
+            source_invocation_ref=source.source_invocation_ref,
+            source_attempt_ref=source.source_attempt_ref,
+            source_evidence_seal_ref=None,
+            original_baseline_digest=original_baseline_digest,
+            terminal_source_diff_digest="",
+            terminal_git_chain_digest="",
+            verifier_role_execution_ref=None,
+            verifier_invocation_ref=None,
+            recovered_evidence_refs=(),
+            recovered_out_of_plan_edits=(),
+            unmet_obligations=(),
+            decision="cleanup-confirmed",
+            reason="cleanup-confirmed",
+        )
+        updated = _replace_manifest(
+            manifest,
+            mutation_recovery_decisions=(
+                *manifest.mutation_recovery_decisions,
+                confirmed.to_payload(),
+            ),
+        )
+        _write_manifest_over_existing(manifest_path, updated)
+        return confirmed
+
+
+def start_new_invocation(recovery: MutationRecoveryInput) -> None:
+    """Refuse a new invocation while an unresolved mutation has no decision."""
+    manifest = read_execution_manifest(recovery.manifest_path)
+    unresolved = [
+        row
+        for row in manifest.attempts
+        if row.status in {"mutation-present-unresolved", "evidence-unsealed"}
+    ]
+    confirmed = {
+        row.get("sourceAttemptRef")
+        for row in manifest.mutation_recovery_decisions
+        if row.get("decision") in {"carry-forward", "cleanup-confirmed"}
+    }
+    pending = [
+        row
+        for row in unresolved
+        if build_dispatch_id(row.invocation_ref, row.attempt) not in confirmed
+    ]
+    if pending:
+        raise MutationRecoveryError("recovery decision required")

package/runtime/python/okstra_ctl/pane_reclaim.py

@@ -1,5 +1,13 @@
-"""완료(terminal) worker 판정 — pane 회수용. 판정 SSOT 는
-wrapper_status.read_wrapper_status 이며 여기서 재사용한다."""
+"""활성 run 스코프 조회 — pane 정리 의무를 어느 run 에 걸지 고르는 데 쓴다.
+
+호출자는 `SessionStart(compact)` 훅(`okstra-compact-reminder.sh`) 하나다. 압축
+직후 리드에게 "이 run 의 완료 teammate pane 을 라운드 경계마다 회수하라"는 의무를
+재주입할 때, 그 대상이 되는 이 프로젝트의 진행 중 run 을 여기서 찾는다.
+
+완료 판정(`is_completed_status`)과 프로젝트 무관 전체 조회(`active_run_dirs`)도
+여기 있었으나, 그것을 쓰던 `okstra-trace-cleanup.sh --reclaim-completed` 와
+`okstra-subagent-reclaim.sh` 가 제거되면서 함께 사라졌다.
+"""
 from __future__ import annotations
 
 import json
@@ -8,12 +16,6 @@ from pathlib import Path
 
 from .paths import resolve_under_root
 from .reconcile import NON_TERMINAL_RECENT_STATUSES
-from .wrapper_status import read_wrapper_status
-
-
-def is_completed_status(status_path: str) -> bool:
-    status = read_wrapper_status(Path(status_path))
-    return status is not None and status.is_terminal
 
 
 def _iter_active_run_dirs(home: Path):
@@ -30,9 +32,9 @@ def _iter_active_run_dirs(home: Path):
             row = json.loads(line)
         except json.JSONDecodeError:
             continue
-        # 회수 대상(진행 중) 집합은 reconcile 의 NON_TERMINAL_RECENT_STATUSES 가
-        # SSOT. reserving 은 아직 run-dir 산출물이 없어(= 회수할 pane 이 없어) 이
-        # 집합에 들어있지 않으므로 자연히 제외된다(allowlist).
+        # 대상(진행 중) 집합은 reconcile 의 NON_TERMINAL_RECENT_STATUSES 가
+        # SSOT. reserving 은 아직 run-dir 산출물이 없어 이 집합에 들어있지
+        # 않으므로 자연히 제외된다(allowlist).
         if row.get("status") not in NON_TERMINAL_RECENT_STATUSES:
             continue
         run_dir = resolve_under_root(row.get("projectRoot"), row.get("runDirRel"))
@@ -40,11 +42,6 @@ def _iter_active_run_dirs(home: Path):
             yield row.get("projectRoot"), run_dir
 
 
-def active_run_dirs(home: Path) -> list[Path]:
-    """active.jsonl 의 진행 중 run 들의 절대 run-dir 목록."""
-    return [run_dir for _project_root, run_dir in _iter_active_run_dirs(home)]
-
-
 def active_run_dirs_for_project(home: Path, cwd: Path) -> list[Path]:
     """진행 중 run 중 projectRoot 이 cwd(또는 그 상위)인 것의 절대 run-dir 목록.
     SessionStart(compact) 훅이 이 프로젝트의 run 에만 리마인더를 걸도록 스코프한다."""
@@ -63,16 +60,10 @@ def active_run_dirs_for_project(home: Path, cwd: Path) -> list[Path]:
 
 
 def main(argv: list[str]) -> int:
-    if len(argv) == 2 and argv[0] == "--active-dirs":
-        for run_dir in active_run_dirs(Path(argv[1])):
-            print(run_dir)
-        return 0
     if len(argv) == 3 and argv[0] == "--active-dirs-for":
         for run_dir in active_run_dirs_for_project(Path(argv[1]), Path(argv[2])):
             print(run_dir)
         return 0
-    if len(argv) == 1:
-        return 0 if is_completed_status(argv[0]) else 1
     return 1
 
 

package/runtime/python/okstra_ctl/pane_title.py

@@ -0,0 +1,151 @@
+"""Lease pane titles from stored execution labels."""
+from __future__ import annotations
+
+import json
+import secrets
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Protocol
+
+
+class PaneTitleError(ValueError):
+    """Raised when a title lease cannot be acquired or released."""
+
+
+class PaneTitleBackend(Protocol):
+    def get_title(self, pane_id: str) -> str: ...
+    def set_title(self, pane_id: str, title: str) -> None: ...
+    def available(self) -> bool: ...
+
+
+@dataclass
+class MemoryPaneBackend:
+    titles: dict[str, str]
+    capable: bool = True
+
+    def get_title(self, pane_id: str) -> str:
+        return self.titles.get(pane_id, "")
+
+    def set_title(self, pane_id: str, title: str) -> None:
+        self.titles[pane_id] = title
+
+    def available(self) -> bool:
+        return self.capable
+
+
+@dataclass(frozen=True)
+class PaneTitleLease:
+    run_ref: str
+    participant_ref: str
+    role_execution_ref: str
+    invocation_ref: str | None
+    pane_backend: str
+    pane_id: str
+    previous_title: str
+    applied_title: str
+    owner_token: str
+    status: str
+
+
+class UnavailablePaneBackend:
+    def get_title(self, pane_id: str) -> str:
+        return ""
+
+    def set_title(self, pane_id: str, title: str) -> None:
+        return None
+
+    def available(self) -> bool:
+        return False
+
+
+def acquire_pane_title(
+    *,
+    backend: PaneTitleBackend,
+    pane_id: str,
+    execution_label: str,
+    run_ref: str,
+    participant_ref: str,
+    role_execution_ref: str,
+    invocation_ref: str | None = None,
+    pane_backend: str = "cmux",
+) -> PaneTitleLease:
+    if not backend.available():
+        return PaneTitleLease(
+            run_ref=run_ref,
+            participant_ref=participant_ref,
+            role_execution_ref=role_execution_ref,
+            invocation_ref=invocation_ref,
+            pane_backend=pane_backend,
+            pane_id=pane_id,
+            previous_title="",
+            applied_title=execution_label,
+            owner_token="",
+            status="not-applicable",
+        )
+    previous = backend.get_title(pane_id)
+    backend.set_title(pane_id, execution_label)
+    return PaneTitleLease(
+        run_ref=run_ref,
+        participant_ref=participant_ref,
+        role_execution_ref=role_execution_ref,
+        invocation_ref=invocation_ref,
+        pane_backend=pane_backend,
+        pane_id=pane_id,
+        previous_title=previous,
+        applied_title=execution_label,
+        owner_token=secrets.token_hex(8),
+        status="acquired",
+    )
+
+
+def release_pane_title(
+    lease: PaneTitleLease,
+    backend: PaneTitleBackend,
+    *,
+    owner_token: str,
+) -> PaneTitleLease:
+    if lease.status == "not-applicable":
+        return lease
+    if owner_token != lease.owner_token:
+        raise PaneTitleError("owner token does not match")
+    current = backend.get_title(lease.pane_id)
+    if current != lease.applied_title:
+        return PaneTitleLease(**{**lease.__dict__, "status": "manual-change-preserved"})
+    backend.set_title(lease.pane_id, lease.previous_title)
+    return PaneTitleLease(**{**lease.__dict__, "status": "released"})
+
+
+def cleanup_pane_title(
+    lease: PaneTitleLease, backend: PaneTitleBackend
+) -> PaneTitleLease:
+    if lease.status == "not-applicable":
+        return lease
+    backend.set_title(lease.pane_id, lease.previous_title)
+    return PaneTitleLease(**{**lease.__dict__, "status": "cleaned"})
+
+
+def main(argv: list[str] | None = None) -> int:
+    import argparse
+
+    parser = argparse.ArgumentParser(prog="okstra pane-title")
+    parser.add_argument("action", choices=("acquire", "release", "cleanup"))
+    parser.add_argument("--execution-label", default="")
+    parser.add_argument("--pane-id", default="")
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args(argv)
+    backend = UnavailablePaneBackend()
+    lease = acquire_pane_title(
+        backend=backend,
+        pane_id=args.pane_id or "none",
+        execution_label=args.execution_label or "unused",
+        run_ref="run",
+        participant_ref="participant",
+        role_execution_ref="role",
+    )
+    payload = {"status": lease.status, "appliedTitle": lease.applied_title}
+    print(json.dumps(payload, ensure_ascii=False))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/runtime/python/okstra_ctl/ports/host_model.py

@@ -2,7 +2,10 @@
 from __future__ import annotations
 
 from dataclasses import dataclass
-from typing import Protocol
+from typing import Literal, Protocol
+
+from okstra_ctl.domain.provider import HostModelBinding
+from okstra_ctl.domain.worker_exec import WorkerWriteCapability
 
 
 class HostModelBindingError(ValueError):
@@ -13,48 +16,76 @@ class HostModelBindingError(ValueError):
 class HostModelBindingRequest:
     host_runtime: str
     provider: str
-    model: str
+    model_ref: str
+    version_kind: Literal["pinned", "channel"]
     model_execution_value: str
     runner: str
+    resolved_execution_value: str | None = None
+    worker_write_capability: WorkerWriteCapability | None = None
+
+    @property
+    def execution_value(self) -> str:
+        return self.resolved_execution_value or self.model_execution_value
 
 
 class HostModelBindingPort(Protocol):
-    def resolve(self, request: HostModelBindingRequest) -> str | None: ...
+    def resolve(self, request: HostModelBindingRequest) -> HostModelBinding: ...
+
+
+def _cli_binding(request: HostModelBindingRequest) -> HostModelBinding:
+    return HostModelBinding(
+        runner=request.runner,
+        catalog_execution_value=request.model_execution_value,
+        resolved_execution_value=request.execution_value,
+        host_model_value=None,
+        binding_fidelity="exact",
+        worker_write_capability=request.worker_write_capability,
+    )
 
 
 class FailClosedHostModelBindingPort:
     def __init__(self, host_runtime: str) -> None:
         self._host_runtime = host_runtime
 
-    def resolve(self, request: HostModelBindingRequest) -> str | None:
+    def resolve(self, request: HostModelBindingRequest) -> HostModelBinding:
         if request.runner == "cli-wrapper":
-            return None
+            return _cli_binding(request)
         raise HostModelBindingError(
             "unsupported host model: "
             f"host={self._host_runtime!r}, provider={request.provider!r}, "
-            f"model={request.model_execution_value!r}"
+            f"model={request.execution_value!r}"
         )
 
 
 class NativeExecutionValueHostModelBindingPort:
-    """Explicit policy for hosts whose native API accepts provider CLI values."""
+    """Binding for hosts whose native API accepts provider execution values."""
 
     def __init__(self, host_runtime: str, native_provider: str) -> None:
         self._host_runtime = host_runtime
         self._native_provider = native_provider
 
-    def resolve(self, request: HostModelBindingRequest) -> str | None:
+    def resolve(self, request: HostModelBindingRequest) -> HostModelBinding:
         if request.runner == "cli-wrapper":
-            return None
-        if (
-            request.runner != "native-session"
-            or request.host_runtime != self._host_runtime
-            or request.provider != self._native_provider
-            or not request.model_execution_value.strip()
-        ):
+            return _cli_binding(request)
+        if not self._supports_native(request):
             raise HostModelBindingError(
                 "unsupported host model: "
                 f"host={request.host_runtime!r}, provider={request.provider!r}, "
-                f"model={request.model_execution_value!r}"
+                f"model={request.execution_value!r}"
             )
-        return request.model_execution_value
+        return HostModelBinding(
+            runner=request.runner,
+            catalog_execution_value=request.model_execution_value,
+            resolved_execution_value=request.execution_value,
+            host_model_value=request.execution_value,
+            binding_fidelity="exact",
+            worker_write_capability=request.worker_write_capability,
+        )
+
+    def _supports_native(self, request: HostModelBindingRequest) -> bool:
+        return (
+            request.runner == "native-session"
+            and request.host_runtime == self._host_runtime
+            and request.provider == self._native_provider
+            and bool(request.execution_value.strip())
+        )

package/runtime/python/okstra_ctl/ports/worker_dispatch.py

@@ -5,6 +5,8 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Literal, Protocol
 
+from okstra_ctl.domain.worker_exec import WorkerWriteCapability
+
 
 @dataclass(frozen=True)
 class WorkerDispatchRequest:
@@ -30,3 +32,5 @@ class WorkerDispatchPlan:
 
 class WorkerDispatchPort(Protocol):
     def build_plan(self, request: WorkerDispatchRequest) -> WorkerDispatchPlan: ...
+
+    def worker_write_capability(self) -> WorkerWriteCapability: ...

package/runtime/python/okstra_ctl/registry/provider_registry.py

@@ -46,7 +46,7 @@ class ProviderRegistry:
         return tuple(
             provider_id
             for provider_id, spec in self._providers.items()
-            if role in spec.supported_roles
+            if spec.supports_role(role)
         )
 
     @property
@@ -72,10 +72,14 @@ def _registry_for_roots(
 ) -> ProviderRegistry:
     discovered = ProviderRegistry.from_roots((bundled_root, user_root)).providers
     bundled_order = ("claude", "antigravity", "codex", "grok", "kimi")
-    ordered = {provider_id: discovered[provider_id] for provider_id in bundled_order}
+    ordered = {
+        provider_id: discovered[provider_id]
+        for provider_id in bundled_order
+        if provider_id in discovered
+    }
     ordered.update(
-        (provider_id, spec)
-        for provider_id, spec in discovered.items()
+        (provider_id, discovered[provider_id])
+        for provider_id in sorted(discovered)
         if provider_id not in ordered
     )
     return ProviderRegistry(ordered)