okstra 0.173.0 → 0.175.1

package/runtime/schemas/convergence-groups-v2.0.schema.json

@@ -0,0 +1,128 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://okstra.dev/schemas/convergence-groups-v2.0.json",
+  "title": "OKSTRA Convergence Grouped Input (v2.0)",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "executionIdentityVersion",
+    "taskKey",
+    "runManifestPath",
+    "config",
+    "workers",
+    "groups"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "2.0" },
+    "executionIdentityVersion": { "const": 2 },
+    "taskKey": { "type": "string", "pattern": "\\S" },
+    "runManifestPath": {
+      "type": "string",
+      "pattern": "^\\.okstra/(?!\\.{1,2}(?:/|$))(?!.*?/\\.{1,2}(?:/|$))[^/\\\\\\r\\n]+(?:/[^/\\\\\\r\\n]+)*$"
+    },
+    "config": { "$ref": "#/$defs/Config" },
+    "workers": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/Worker" }
+    },
+    "groups": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/Group" }
+    }
+  },
+  "$defs": {
+    "Config": {
+      "type": "object",
+      "required": ["enabled", "adversarial", "maxRounds", "effectiveMaxRounds", "verificationMode"],
+      "additionalProperties": false,
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "adversarial": { "type": "boolean" },
+        "maxRounds": { "type": "integer", "minimum": 1, "maximum": 3 },
+        "effectiveMaxRounds": { "type": "integer", "minimum": 1, "maximum": 3 },
+        "verificationMode": { "enum": ["lightweight", "full-reanalysis"] }
+      }
+    },
+    "Worker": {
+      "type": "object",
+      "required": [
+        "workerId",
+        "audience",
+        "participantRef",
+        "sourceRoleExecutionRef"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "workerId": { "type": "string", "pattern": "\\S" },
+        "audience": { "enum": ["analysis", "report-writer"] },
+        "participantRef": { "type": "string", "pattern": "\\S" },
+        "sourceRoleExecutionRef": { "type": "string", "pattern": "\\S" }
+      }
+    },
+    "Group": {
+      "type": "object",
+      "required": ["findingId", "summary", "category", "ticketIds", "originWorker", "originEvidence", "discoveredBy", "sourceItems"],
+      "additionalProperties": false,
+      "properties": {
+        "findingId": { "type": "string", "pattern": "\\S" },
+        "summary": { "type": "string", "pattern": "\\S" },
+        "category": { "type": "string", "pattern": "\\S" },
+        "ticketIds": {
+          "type": "array",
+          "items": { "type": "string", "pattern": "\\S" }
+        },
+        "originWorker": { "type": "string", "pattern": "\\S" },
+        "originEvidence": { "type": "string", "pattern": "\\S" },
+        "evidenceArtifacts": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/EvidenceArtifact" }
+        },
+        "discoveredBy": {
+          "type": "object",
+          "minProperties": 1,
+          "additionalProperties": { "$ref": "#/$defs/Discovery" }
+        },
+        "sourceItems": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/SourceItem" }
+        }
+      }
+    },
+    "EvidenceArtifact": {
+      "type": "object",
+      "required": ["path", "sha256", "command", "environment"],
+      "additionalProperties": false,
+      "properties": {
+        "path": {
+          "type": "string",
+          "pattern": "^\\.okstra/(?!\\.{1,2}(?:/|$))(?!.*?/\\.{1,2}(?:/|$))[^/\\\\\\r\\n]+(?:/[^/\\\\\\r\\n]+)*$"
+        },
+        "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+        "command": { "type": "string", "pattern": "\\S" },
+        "environment": { "type": "string", "pattern": "\\S" }
+      }
+    },
+    "Discovery": {
+      "type": "object",
+      "required": ["itemId", "evidence"],
+      "additionalProperties": false,
+      "properties": {
+        "itemId": { "type": "string", "pattern": "\\S" },
+        "evidence": { "type": "string", "pattern": "\\S" }
+      }
+    },
+    "SourceItem": {
+      "type": "object",
+      "required": ["worker", "itemId"],
+      "additionalProperties": false,
+      "properties": {
+        "worker": { "type": "string", "pattern": "\\S" },
+        "itemId": { "type": "string", "pattern": "\\S" }
+      }
+    }
+  }
+}

package/runtime/schemas/execution-manifest-v2.schema.json

@@ -0,0 +1,340 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://okstra.dev/schemas/execution-manifest-v2.json",
+  "title": "OKSTRA Execution Manifest (v2)",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "executionIdentityVersion",
+    "entryMode",
+    "participantAssignments",
+    "roleExecutions",
+    "invocations",
+    "attempts",
+    "attemptEvidenceSeals",
+    "mutationRecoveryDecisions"
+  ],
+  "properties": {
+    "schemaVersion": {"const": "2.0"},
+    "executionIdentityVersion": {"const": 2},
+    "entryMode": {"enum": ["current-session", "new-session"]},
+    "participantAssignments": {
+      "type": "array",
+      "items": {"$ref": "#/$defs/ParticipantAssignment"}
+    },
+    "roleExecutions": {
+      "type": "array",
+      "items": {"$ref": "#/$defs/RoleExecution"}
+    },
+    "invocations": {
+      "type": "array",
+      "items": {"$ref": "#/$defs/Invocation"}
+    },
+    "attempts": {
+      "type": "array",
+      "items": {"$ref": "#/$defs/Attempt"}
+    },
+    "attemptEvidenceSeals": {
+      "type": "array",
+      "items": {"$ref": "#/$defs/AttemptEvidenceSeal"}
+    },
+    "mutationRecoveryDecisions": {
+      "type": "array",
+      "items": {"$ref": "#/$defs/MutationRecoveryDecision"}
+    }
+  },
+  "additionalProperties": true,
+  "$defs": {
+    "Digest": {
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "NullableDigest": {
+      "type": ["string", "null"],
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "WorkerWriteCapability": {
+      "type": ["object", "null"],
+      "required": ["maxBoundaryPrecision"],
+      "properties": {
+        "maxBoundaryPrecision": {
+          "enum": ["exact-path", "directory-boundary", "none"]
+        }
+      },
+      "additionalProperties": false
+    },
+    "ParticipantAssignment": {
+      "type": "object",
+      "required": [
+        "participantRef",
+        "provider",
+        "modelRef",
+        "modelId",
+        "runner",
+        "hostRuntime",
+        "hostModelValue",
+        "sessionRef",
+        "windowRef",
+        "workerWriteCapability",
+        "entryMode",
+        "status"
+      ],
+      "properties": {
+        "participantRef": {"type": "string", "pattern": "\\S"},
+        "provider": {"type": "string", "pattern": "\\S"},
+        "modelRef": {"type": ["string", "null"]},
+        "modelId": {"type": "string", "pattern": "\\S"},
+        "runner": {"type": "string", "pattern": "\\S"},
+        "hostRuntime": {"type": "string", "pattern": "\\S"},
+        "hostModelValue": {"type": ["string", "null"]},
+        "sessionRef": {"type": ["string", "null"]},
+        "windowRef": {"type": ["string", "null"]},
+        "workerWriteCapability": {"$ref": "#/$defs/WorkerWriteCapability"},
+        "entryMode": {"enum": ["current-session", "new-session"]},
+        "status": {"type": "string", "pattern": "\\S"}
+      },
+      "additionalProperties": false
+    },
+    "HostModelBinding": {
+      "type": ["object", "null"],
+      "required": [
+        "runner",
+        "catalogExecutionValue",
+        "resolvedExecutionValue",
+        "hostModelValue",
+        "bindingFidelity",
+        "workerWriteCapability"
+      ],
+      "properties": {
+        "runner": {"type": "string", "pattern": "\\S"},
+        "catalogExecutionValue": {"type": "string"},
+        "resolvedExecutionValue": {"type": "string"},
+        "hostModelValue": {"type": ["string", "null"]},
+        "bindingFidelity": {"enum": ["exact", "channel", "unsupported"]},
+        "workerWriteCapability": {"$ref": "#/$defs/WorkerWriteCapability"}
+      },
+      "additionalProperties": false
+    },
+    "ServedModelAttestation": {
+      "type": "object",
+      "required": ["observedModel", "normalizedModelRef", "level", "source"],
+      "properties": {
+        "observedModel": {"type": ["string", "null"]},
+        "normalizedModelRef": {"type": ["string", "null"]},
+        "level": {"enum": ["exact", "channel", "unknown"]},
+        "source": {
+          "enum": ["provider-output", "native-api", "cli-handoff", "unavailable"]
+        }
+      },
+      "additionalProperties": false
+    },
+    "WritePolicy": {
+      "type": "object",
+      "required": ["artifactPolicy", "sourcePolicy", "gitPolicy", "auxiliaryPolicy"],
+      "properties": {
+        "artifactPolicy": {
+          "type": "object",
+          "required": ["allowedRoot", "allowedPaths"],
+          "properties": {
+            "allowedRoot": {"type": "string", "pattern": "^/"},
+            "allowedPaths": {"type": "array", "items": {"type": "string", "pattern": "\\S"}, "minItems": 1, "uniqueItems": true}
+          },
+          "additionalProperties": false
+        },
+        "sourcePolicy": {
+          "type": "object",
+          "required": ["mode", "allowedRoot", "plannedPaths", "protectedPaths"],
+          "properties": {
+            "mode": {"enum": ["source-readonly", "project-mutation"]},
+            "allowedRoot": {"type": "string", "pattern": "^/"},
+            "plannedPaths": {"type": "array", "items": {"type": "string", "pattern": "\\S"}, "uniqueItems": true},
+            "protectedPaths": {"type": "array", "items": {"type": "string", "pattern": "\\S"}, "uniqueItems": true}
+          },
+          "additionalProperties": false
+        },
+        "gitPolicy": {
+          "type": "object",
+          "required": ["mode"],
+          "properties": {
+            "mode": {"enum": ["disabled", "fast-forward-descendant-chain"]},
+            "worktreeGitDir": {"type": "string", "pattern": "^/"},
+            "gitCommonDir": {"type": "string", "pattern": "^/"},
+            "expectedBaseCommit": {"type": "string", "pattern": "\\S"},
+            "allowedBranchRef": {"type": "string", "pattern": "^refs/heads/"},
+            "commitMode": {"const": "fast-forward-descendant-chain"}
+          },
+          "additionalProperties": false
+        },
+        "auxiliaryPolicy": {
+          "type": "object",
+          "required": ["scratchRoots", "generatedPaths", "externalRoots"],
+          "properties": {
+            "scratchRoots": {"type": "array", "items": {"type": "string", "pattern": "^/"}, "uniqueItems": true},
+            "generatedPaths": {"type": "array", "items": {"type": "string", "pattern": "\\S"}, "uniqueItems": true},
+            "externalRoots": {"type": "array", "items": {"type": "string", "pattern": "^/"}, "uniqueItems": true}
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "WriteEnforcement": {
+      "type": "object",
+      "required": ["boundaryPrecision", "mutationAudit", "attribution", "auditedRoots", "observationCoverage", "unobservedWriteSurfaces"],
+      "properties": {
+        "boundaryPrecision": {"enum": ["exact-path", "directory-boundary", "none"]},
+        "mutationAudit": {"enum": ["none", "batch"]},
+        "attribution": {"enum": ["call", "batch-unattributed"]},
+        "auditedRoots": {"type": "array", "items": {"type": "string", "pattern": "^/"}, "minItems": 1, "uniqueItems": true},
+        "observationCoverage": {"enum": ["complete", "scoped", "partial"]},
+        "unobservedWriteSurfaces": {"type": "array", "items": {"type": "string", "pattern": "\\S"}, "uniqueItems": true}
+      },
+      "additionalProperties": false
+    },
+    "RoleExecution": {
+      "type": "object",
+      "required": [
+        "roleExecutionRef",
+        "participantRef",
+        "sourceRoleExecutionRef",
+        "role",
+        "provider",
+        "modelRef",
+        "modelId",
+        "ordinal",
+        "executionLabel",
+        "modelSpecDigest",
+        "binding",
+        "servedModelAttestation",
+        "status"
+      ],
+      "properties": {
+        "roleExecutionRef": {"type": "string", "pattern": "\\S"},
+        "participantRef": {"type": "string", "pattern": "\\S"},
+        "sourceRoleExecutionRef": {"type": ["string", "null"]},
+        "role": {"type": "string", "pattern": "\\S"},
+        "provider": {"type": "string", "pattern": "\\S"},
+        "modelRef": {"type": ["string", "null"]},
+        "modelId": {"type": "string", "pattern": "\\S"},
+        "ordinal": {"type": "integer", "minimum": 1},
+        "executionLabel": {"type": "string", "pattern": "\\S"},
+        "modelSpecDigest": {"$ref": "#/$defs/NullableDigest"},
+        "binding": {"$ref": "#/$defs/HostModelBinding"},
+        "servedModelAttestation": {"$ref": "#/$defs/ServedModelAttestation"},
+        "status": {"type": "string", "pattern": "\\S"}
+      },
+      "additionalProperties": false
+    },
+    "Invocation": {
+      "type": "object",
+      "required": [
+        "invocationRef",
+        "participantRef",
+        "roleExecutionRef",
+        "sourceInvocationRef",
+        "recoveryRef",
+        "dutyId",
+        "dispatchKind",
+        "round",
+        "inputDigest",
+        "writePolicy",
+        "writePolicyDigest",
+        "writeEnforcement"
+      ],
+      "properties": {
+        "invocationRef": {"type": "string", "pattern": "\\S"},
+        "participantRef": {"type": "string", "pattern": "\\S"},
+        "roleExecutionRef": {"type": "string", "pattern": "\\S"},
+        "sourceInvocationRef": {"type": ["string", "null"]},
+        "recoveryRef": {"type": ["string", "null"]},
+        "dutyId": {"type": "string", "pattern": "\\S"},
+        "dispatchKind": {"type": "string", "pattern": "\\S"},
+        "round": {"type": "integer", "minimum": 1},
+        "inputDigest": {"$ref": "#/$defs/Digest"},
+        "writePolicy": {"$ref": "#/$defs/WritePolicy"},
+        "writePolicyDigest": {"$ref": "#/$defs/Digest"},
+        "writeEnforcement": {"$ref": "#/$defs/WriteEnforcement"}
+      },
+      "additionalProperties": false
+    },
+    "Attempt": {
+      "type": "object",
+      "required": [
+        "invocationRef",
+        "attempt",
+        "startedAt",
+        "finishedAt",
+        "status",
+        "resultPath",
+        "errorPath",
+        "changeSummary",
+        "evidenceSealRef"
+      ],
+      "properties": {
+        "invocationRef": {"type": "string", "pattern": "\\S"},
+        "attempt": {"type": "integer", "minimum": 1},
+        "startedAt": {"type": "string", "pattern": "\\S"},
+        "finishedAt": {"type": ["string", "null"]},
+        "status": {"type": "string", "pattern": "\\S"},
+        "resultPath": {"type": ["string", "null"]},
+        "errorPath": {"type": ["string", "null"]},
+        "changeSummary": {"type": "object"},
+        "evidenceSealRef": {"type": ["string", "null"]}
+      },
+      "additionalProperties": false
+    },
+    "AttemptEvidenceSeal": {
+      "type": "object",
+      "required": [
+        "sealRef",
+        "attemptRef",
+        "capturedAt",
+        "sourceDiffDigest",
+        "gitProjectionDigest",
+        "changedPaths",
+        "hostEventStream",
+        "artifacts"
+      ],
+      "properties": {
+        "sealRef": {"type": "string", "pattern": "\\S"},
+        "attemptRef": {"type": "string", "pattern": "\\S"},
+        "capturedAt": {"type": "string", "pattern": "\\S"},
+        "sourceDiffDigest": {"$ref": "#/$defs/Digest"},
+        "gitProjectionDigest": {"$ref": "#/$defs/Digest"},
+        "changedPaths": {"type": "array", "items": {"type": "string"}},
+        "hostEventStream": {"type": "object"},
+        "hostEventStreamRef": {"type": ["string", "null"]},
+        "artifacts": {"type": "array", "items": {"type": "object"}}
+      },
+      "additionalProperties": true
+    },
+    "MutationRecoveryDecision": {
+      "type": "object",
+      "required": [
+        "recoveryRef",
+        "sourceInvocationRef",
+        "sourceAttemptRef",
+        "decision"
+      ],
+      "properties": {
+        "recoveryRef": {"type": "string", "pattern": "\\S"},
+        "sourceInvocationRef": {"type": "string"},
+        "sourceAttemptRef": {"type": "string"},
+        "sourceEvidenceSealRef": {"type": ["string", "null"]},
+        "originalBaselineDigest": {"type": "string"},
+        "terminalSourceDiffDigest": {"type": "string"},
+        "terminalGitChainDigest": {"type": "string"},
+        "verifierRoleExecutionRef": {"type": ["string", "null"]},
+        "verifierInvocationRef": {"type": ["string", "null"]},
+        "recoveredEvidenceRefs": {"type": "array"},
+        "recoveredOutOfPlanEdits": {"type": "array"},
+        "unmetObligations": {"type": "array", "items": {"type": "string"}},
+        "decision": {
+          "enum": ["carry-forward", "reject", "cleanup-confirmed"]
+        },
+        "reason": {"type": "string"}
+      },
+      "additionalProperties": true
+    }
+  }
+}

package/runtime/schemas/final-report-v2.0.schema.json

@@ -29,6 +29,31 @@
       "const": "2.0",
       "description": "Schema version. Renderer refuses to process unknown versions."
     },
+    "executionIdentityVersion": {
+      "type": "integer",
+      "enum": [1, 2]
+    },
+    "executionRoles": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "roleExecutionRef",
+          "role",
+          "executionLabel"
+        ],
+        "properties": {
+          "roleExecutionRef": {"type": "string"},
+          "role": {"type": "string"},
+          "provider": {"type": "string"},
+          "modelRef": {"type": ["string", "null"]},
+          "ordinal": {"type": "integer"},
+          "executionLabel": {"type": "string"},
+          "status": {"type": "string"}
+        },
+        "additionalProperties": true
+      }
+    },
     "humanSummary": {
       "$ref": "#/$defs/HumanSummary"
     },

package/runtime/skills/okstra-run/SKILL.md

@@ -220,9 +220,9 @@ When `next.kind == "done"`, fetch the public wizard outcome:
 okstra wizard outcome --state-file /var/folders/.../okstra-wizard.AbCd.json
 ```
 
-Output: `{ok: true, outcome: {renderArgs: {...}, orchestration: {chainStages: "..."}, persistActions: [...], confirmationText: "..."}}`.
+Output: `{ok: true, outcome: {renderArgv: ["--lead-runtime", "...", ...], renderArgs: {...}, orchestration: {chainStages: "..."}, persistActions: [...], confirmationText: "..."}}`.
 
-`renderArgs` holds only flags `okstra render-bundle` accepts, which is what makes the pass-everything rule below safe. `orchestration` holds signals this skill acts on itself — never pass its entries to `render-bundle`.
+`renderArgv` is the canonical ordered `okstra render-bundle` argument list. Pass its tokens verbatim and in order. Repeated `--role-count` and `--role-model` flags are intentional. `renderArgs` is a compatibility and inspection view only; do not reconstruct an invocation from it. `orchestration` holds signals this skill acts on itself — never pass its entries to `render-bundle`.
 
 Run every `outcome.persistActions[]` entry BEFORE `render-bundle`. The only supported action is:
 
@@ -243,19 +243,19 @@ Before rendering the next phase's bundle — and between worker rounds within a
 
 Before you ask the user for any approval, clarification, or decision after workers have been dispatched, run the same reclaim first: `$HOME/.okstra/bin/okstra-trace-cleanup.sh --list --run-dir "<RUN_DIR>" [--keep report-writer-worker]` to count the panes, then the same command without `--list` to close them, emit `PROGRESS: phase-gate-cleanup panes=<n>`, and `TaskStop` each completed worker. A `TaskStop` by itself idles the task but leaves the pane open — the `trace-cleanup` call is what actually closes it. This keeps a user gate from being shown while finished worker panes remain; in-flight workers and an in-flight report writer are preserved.
 
-Build the `okstra render-bundle` invocation from `outcome.renderArgs`, passing each key as `--<key>` and the value verbatim (including empty strings — they are intentional `use phase default` markers).
+Build the `okstra render-bundle` invocation from `outcome.renderArgv`, passing every token verbatim and in order (including empty strings — they are intentional `use phase default` markers).
 
-Analysis sidetracks therefore forward wizard-owned entries such as `--analysis-target "<args.analysis-target>"` and `--evidence-inputs "<args.evidence-inputs>"` when those keys are present. These are examples of the generic mapping rule, not a separate hard-coded argument list.
+Analysis sidetracks therefore forward wizard-owned tokens such as `--analysis-target "<value>"` and `--evidence-inputs "<value>"` when they are present. These are examples of the verbatim token rule, not a separate hard-coded argument list.
 
-Step 3's empty-answer and escaping rules apply verbatim: every flag whose value is the empty string MUST still be passed explicitly as `--<key> ""` (e.g. `--workers ""`, `--directive ""`) — `render-bundle` distinguishes "flag absent" from "flag present with empty value", and the wizard's intent is always the latter.
+Step 3's empty-answer and escaping rules apply verbatim: every flag in `renderArgv` whose following value is the empty string MUST still be passed explicitly (e.g. `--workers ""`, `--directive ""`) — `render-bundle` distinguishes "flag absent" from "flag present with empty value", and the wizard's intent is always the latter.
 
-Add `--lead-runtime <host-runtime>` from Step 1. Pass every `outcome.renderArgs` entry exactly once; do not enumerate a fixed provider list in this skill because the wizard and provider registry own those keys. If `renderArgs` ever contains `lead-runtime`, replace it with the Step 1 host value rather than emitting the flag twice.
+`renderArgv` already contains exactly one `--lead-runtime <host-runtime>` pair. Do not add or replace it. Do not enumerate a fixed provider list in this skill because the wizard and role model pool own the ordered tokens.
 
 ```bash
 okstra render-bundle \
-  --lead-runtime <host-runtime> \
-  --<first-renderArgs-key> "<first-renderArgs-value>" \
-  --<each-remaining-renderArgs-key> "<corresponding-value>"
+  <outcome.renderArgv token 1> \
+  <outcome.renderArgv token 2> \
+  <each remaining outcome.renderArgv token in order>
 ```
 
 `render-bundle` auto-supplies `--workspace-root` and forces `--render-only`. Stdout prints `okstra task root:`, `okstra instruction-set:`, `okstra run manifest:`, and the full rendered lead prompt. Parse the labelled lines for `TASK_ROOT`, `INSTRUCTION_SET_PATH`, and `RUN_MANIFEST_PATH`. Also watch for an optional `okstra concurrent-run stages:` label line — present only when a concurrent run is detected (see "Concurrent-run detection branch" below).

package/runtime/skills/okstra-setup/references/project-config.md

@@ -16,6 +16,17 @@ shared state. The built-in default is `.project-docs`, `.scratch`,
 okstra-owned context and writes still stay under `<PROJECT_ROOT>/.okstra/**`
 unless the task brief explicitly authorizes a non-okstra path.
 
+`.claude` is the one entry materialised as a real directory whose children are
+symlinked one by one, instead of a single symlink for the whole directory. git
+does not follow a symlink, so a symlinked directory is one file to it, and a
+project that ignores host config by its contents (`.claude/*`) matches every
+child but never the bare `.claude` path — the directory would be invisible in
+the main checkout and `?? .claude` in the task worktree. Linking the children
+reproduces the main checkout's shape, so the project's own ignore rules decide
+the outcome in both places. The other entries stay whole-directory symlinks
+because okstra writes into them, and the directory symlink is what makes a
+newly created top-level entry land in the main checkout.
+
 To override per-project, add a `worktreeSyncDirs` array to `project.json`.
 Empty array disables the feature; the field is preserved across the runtime's
 auto-upserts (only `projectId`, `projectRoot`, `createdAt`, `updatedAt` are

package/runtime/templates/report-writer-prompt-preamble.md

@@ -22,6 +22,8 @@ Write `- PROGRESS: <stage> <ISO-8601-UTC>` there before reading and at least eve
 
 The generated prompt selects this file through `**Worker Preamble Path:**` and includes `**Worker Error Contract Path:**`, `**Audit sidecar path:**`, error paths, and read scope. It never includes `**Coding preflight pack:**`.
 
+The adjacent v2 prompt metadata supplies `participantRef`, `roleExecutionRef`, `executionLabel`, `invocationRef`, and `attempt`. Copy those values into report and audit identity fields without deriving them from the provider or model. Legacy v1 `workerId` is a read-only compatibility projection and is not written into v2 artifacts.
+
 ## Return message to the lead
 
 Begin the inline return with the exact `**Model:** Report writer worker, <modelExecutionValue>` line from the prompt, followed by the artifact status. Never invent or abbreviate the model.

package/runtime/templates/reports/final-report-v2.template.md

@@ -25,7 +25,7 @@ schema-version: {{ schemaVersion | yaml_scalar }}
   is a non-authoritative index of `finalVerdict`, which §Final Verdict already
   carries in full.
 -#}
-{{ md_claim("schemaVersion", "meta", "frontmatter", "header", "humanSummary", "verdictCard") }}
+{{ md_claim("schemaVersion", "meta", "frontmatter", "header", "humanSummary", "verdictCard", "executionRoles", "executionIdentityVersion") }}
 
 # {{ frontmatter.title }}
 
@@ -44,6 +44,12 @@ schema-version: {{ schemaVersion | yaml_scalar }}
 - Rationale IDs: {{ finalVerdict.rationaleRowIds | join(", ") }}
 - Blocking IDs: {{ aiBlockingIds | join(", ") if aiBlockingIds else "none" }}
 - Next step: {{ finalVerdict.nextStep }}
+{% if executionIdentityVersion == 2 %}
+
+## Execution Roles
+
+{{ executionRolesTable }}
+{% endif %}
 
 ## Decision Context
 

package/runtime/templates/reports/html/base.template.html

@@ -21,6 +21,27 @@
     </dl>
     <p class="lede">{{ humanSummary.headline | inline_code }}</p>
     <p>{{ humanSummary.outcome | inline_code }}</p>
+    {% if executionRoles %}
+    <section data-report-section="execution-roles">
+      <h2>{{ t('base.execution-roles') }}</h2>
+      <table>
+        <thead><tr>
+          <th scope="col">{{ t('base.role') }}</th>
+          <th scope="col">{{ t('base.execution-label') }}</th>
+          <th scope="col">{{ t('base.status') }}</th>
+        </tr></thead>
+        <tbody>
+          {% for row in executionRoles %}
+          <tr>
+            <td>{{ row.role }}</td>
+            <td><code>{{ row.executionLabel }}</code></td>
+            <td>{{ row.status }}</td>
+          </tr>
+          {% endfor %}
+        </tbody>
+      </table>
+    </section>
+    {% endif %}
   </header>
   <main id="main-content" data-report-role="human-main">
     {% block human_content %}{% endblock %}

package/runtime/templates/reports/html/i18n/en.json

@@ -96,6 +96,10 @@
     "skip-to-report-content": "Skip to report content",
     "contents": "Contents",
     "task": "Task",
+    "execution-roles": "Execution roles",
+    "role": "Role",
+    "execution-label": "Execution label",
+    "status": "Status",
     "task-key": "Task key",
     "written": "Written",
     "elapsed": "Elapsed",

package/runtime/templates/reports/html/i18n/ko.json

@@ -96,6 +96,10 @@
     "skip-to-report-content": "리포트 본문으로 건너뛰기",
     "contents": "목차",
     "task": "태스크",
+    "execution-roles": "실행 역할",
+    "role": "역할",
+    "execution-label": "실행 표지",
+    "status": "상태",
     "task-key": "태스크 키",
     "written": "작성",
     "elapsed": "소요 시간",