okstra 0.173.0 → 0.175.1

package/runtime/validators/validate-run.py

@@ -43,14 +43,16 @@ from okstra_project.dirs import tasks_root as _okstra_tasks_root  # noqa: E402
 from okstra_project.resolver import resolve_architecture  # noqa: E402
 
 from okstra_ctl.conformance import (  # noqa: E402
-    CAPABILITY_WHITELIST,
     detect_surfaces,
     evaluate_conformance,
     manifest_required_surfaces,
+    normalize_conformance_script as _normalize_conformance_script,
+    parse_conformance_tests as _parse_conformance_tests,
     qa_result_from_dict,
     validate_conformance_manifest,
 )
 from okstra_ctl.paths import RunRef  # noqa: E402
+from okstra_ctl.report_contract import CURRENT_REPORT_SCHEMA_VERSION  # noqa: E402
 from okstra_ctl.domain.host import HostNotRegistered  # noqa: E402
 from okstra_ctl.registry.host_registry import default_host_registry  # noqa: E402
 from okstra_ctl.build_tools import (  # noqa: E402
@@ -120,15 +122,21 @@ from okstra_ctl.worker_prompt_contract import (  # noqa: E402
     PromptRecord,
     validate_initial_prompt_records,
 )
+from okstra_ctl.domain.role import RoleCatalogError, role_for_duty  # noqa: E402
 from okstra_ctl.agent_invocation import (  # noqa: E402
     AgentInvocationError,
     agent_model_assignment_from_payload,
+    invocation_execution_identity_from_manifest,
     verify_agent_invocation,
 )
+from okstra_ctl.execution_identity import ExecutionManifestError  # noqa: E402
+from okstra_ctl.execution_manifest import (  # noqa: E402
+    validate_execution_manifest_payload,
+)
 from okstra_ctl.lead_events import LeadEventParseError, read_lead_events  # noqa: E402
 from okstra_ctl.worker_audit_ledger import (  # noqa: E402
     READING_CONFIRMATION_HEADING_RE,
-    check_worker_results_audit,
+    worker_results_audit_findings,
 )
 from validate_analysis_report import validate_analysis_report  # noqa: E402
 from okstra_ctl.convergence_engine import (  # noqa: E402
@@ -141,7 +149,7 @@ from okstra_ctl.convergence_provenance import (  # noqa: E402
 
 TERMINAL_STATUSES = {"completed", "timeout", "error", "not-run"}
 ATTEMPTED_STATUSES = {"completed", "timeout", "error"}
-WORKER_DISPATCH_MODES = {"cli-wrapper", "mixed", "tmux-pane"}
+WORKER_DISPATCH_MODES = {"cli-wrapper", "mixed"}
 _AGENT_DISPATCH_DIGEST_KEYS = (
     "catalogDigest",
     "assignmentDigest",
@@ -149,6 +157,30 @@ _AGENT_DISPATCH_DIGEST_KEYS = (
     "instructionDigest",
     "promptDigest",
 )
+_V2_AGENT_DISPATCH_IDENTITY_KEYS = (
+    "participantRef",
+    "roleExecutionRef",
+    "executionLabel",
+    "dutyId",
+    "invocationRef",
+)
+
+
+def _validate_execution_identity_v2(
+    run_manifest: Mapping[str, Any],
+    failures: list[str],
+) -> None:
+    version = run_manifest.get("schemaVersion")
+    identity_version = run_manifest.get("executionIdentityVersion")
+    if version in {1, "1", "1.0"} and identity_version is None:
+        return
+    if version != "2.0" or identity_version != 2:
+        failures.append("execution identity v2: mixed execution identity version")
+        return
+    try:
+        validate_execution_manifest_payload(run_manifest)
+    except ExecutionManifestError as exc:
+        failures.append(f"execution identity v2: {exc}")
 
 
 def _validate_agent_dispatch_contract(
@@ -167,6 +199,28 @@ def _validate_agent_dispatch_contract(
     if not isinstance(assignments, Mapping):
         failures.append("agent invocation metadata is missing: invocationAssignments")
         return
+    manifest_version = run_manifest.get("schemaVersion")
+    execution_identity_version = run_manifest.get("executionIdentityVersion")
+    if manifest_version == "2.0" and execution_identity_version == 2:
+        uses_v2_identity = True
+    elif (
+        manifest_version in {None, 1, "1", "1.0"}
+        and execution_identity_version is None
+    ):
+        uses_v2_identity = False
+    else:
+        failures.append("agent dispatch contract mixes v1 and v2 execution identity")
+        return
+    canonical_invocations = {
+        row.get("invocationRef"): row
+        for row in run_manifest.get("invocations") or []
+        if isinstance(row, Mapping)
+    } if uses_v2_identity else {}
+    canonical_attempts = {
+        (row.get("invocationRef"), row.get("attempt"))
+        for row in run_manifest.get("attempts") or []
+        if isinstance(row, Mapping)
+    } if uses_v2_identity else set()
     worker_dispatches = [
         row for row in (team_state.get("workerDispatches") or [])
         if isinstance(row, Mapping) and row.get("invocationId")
@@ -177,13 +231,15 @@ def _validate_agent_dispatch_contract(
     ]
     dispatches = [*worker_dispatches, *agent_dispatches]
     ids: dict[str, Mapping[str, Any]] = {}
+    seen_dispatch_ids: set[str] = set()
     for row in dispatches:
         dispatch_id = str(row.get("dispatchId") or "").strip()
         missing = [
             key for key in (
-                "dispatchId", "workerId", "audience", "invocationId",
+                "dispatchId", "audience", "invocationId",
                 "assignmentRef", "promptMetadataPath", "modelExecutionValue",
                 "enforcementMode", *_AGENT_DISPATCH_DIGEST_KEYS,
+                *(_V2_AGENT_DISPATCH_IDENTITY_KEYS if uses_v2_identity else ("workerId",)),
             )
             if not str(row.get(key) or "").strip()
         ]
@@ -193,10 +249,43 @@ def _validate_agent_dispatch_contract(
                 + ", ".join(missing)
             )
             continue
-        if dispatch_id in ids:
+        if uses_v2_identity:
+            if "workerId" in row or row.get("executionIdentityVersion") != 2:
+                failures.append(
+                    f"agent dispatch {dispatch_id} mixes v1 and v2 execution identity"
+                )
+                continue
+            attempt = row.get("attempt")
+            if (
+                not isinstance(attempt, int)
+                or isinstance(attempt, bool)
+                or attempt < 1
+            ):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: v2 attempt must be positive"
+                )
+                continue
+            if dispatch_id != f"{row['invocationId']}:attempt-{attempt}":
+                failures.append(
+                    f"agent dispatch {dispatch_id}: dispatchId does not match v2 attempt"
+                )
+                continue
+        elif any(
+            key in row
+            for key in (
+                "executionIdentityVersion",
+                "attempt",
+                *_V2_AGENT_DISPATCH_IDENTITY_KEYS,
+            )
+        ):
+            failures.append(
+                f"agent dispatch {dispatch_id} mixes v1 and v2 execution identity"
+            )
+            continue
+        if dispatch_id in seen_dispatch_ids:
             failures.append(f"agent dispatch ID is duplicated: {dispatch_id}")
             continue
-        ids[dispatch_id] = row
+        seen_dispatch_ids.add(dispatch_id)
         assignment_ref = str(row["assignmentRef"])
         try:
             assignment = agent_model_assignment_from_payload(
@@ -205,6 +294,118 @@ def _validate_agent_dispatch_contract(
         except AgentInvocationError as exc:
             failures.append(f"agent dispatch {dispatch_id}: {exc}")
             continue
+        execution_identity = None
+        if uses_v2_identity:
+            try:
+                execution_identity = invocation_execution_identity_from_manifest(
+                    run_manifest,
+                    assignment=assignment,
+                    assignment_ref=assignment_ref,
+                    duty_id=str(row["dutyId"]),
+                )
+            except AgentInvocationError as exc:
+                failures.append(f"agent dispatch {dispatch_id}: {exc}")
+                continue
+            if (
+                execution_identity is None
+                or row.get("participantRef") != execution_identity.participant_ref
+                or row.get("roleExecutionRef") != execution_identity.role_execution_ref
+            ):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: v2 identity does not match "
+                    "a canonical role execution"
+                )
+                continue
+            if row.get("executionLabel") != execution_identity.execution_label:
+                failures.append(
+                    f"agent dispatch {dispatch_id}: executionLabel does not match "
+                    "canonical role execution"
+                )
+                continue
+            dispatch_kind = row.get("dispatchKind") or row.get("kind")
+            if not isinstance(dispatch_kind, str) or not dispatch_kind:
+                failures.append(
+                    f"agent dispatch {dispatch_id}: dispatchKind is missing"
+                )
+                continue
+            invocation = canonical_invocations.get(row.get("invocationRef"))
+            if not isinstance(invocation, Mapping) or any((
+                invocation.get("participantRef") != row.get("participantRef"),
+                invocation.get("roleExecutionRef") != row.get("roleExecutionRef"),
+                invocation.get("dutyId") != row.get("dutyId"),
+                invocation.get("dispatchKind") != dispatch_kind,
+                invocation.get("inputDigest") != row.get("promptDigest"),
+                )):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: does not match canonical invocation"
+                )
+                continue
+            if row.get("writePolicyDigest") != invocation.get("writePolicyDigest"):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: writePolicyDigest does not "
+                    "match canonical invocation"
+                )
+                continue
+            if row.get("writeEnforcement") != invocation.get("writeEnforcement"):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: writeEnforcement does not "
+                    "match canonical invocation"
+                )
+                continue
+            mutation_mode = invocation.get("writeEnforcement", {}).get(
+                "mutationAudit"
+            ) if isinstance(invocation.get("writeEnforcement"), Mapping) else None
+            snapshot_value = row.get("mutationAuditSnapshotPath")
+            if mutation_mode == "batch" and not (
+                isinstance(snapshot_value, str) and snapshot_value.strip()
+            ):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: mutation audit snapshot is missing"
+                )
+                continue
+            if mutation_mode == "none" and snapshot_value not in (None, ""):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: exact-path dispatch has a "
+                    "mutation audit snapshot"
+                )
+                continue
+            if (row.get("invocationRef"), attempt) not in canonical_attempts:
+                failures.append(
+                    f"agent dispatch {dispatch_id}: has no canonical invocation attempt"
+                )
+                continue
+            status_path_raw = row.get("statusSidecarPath")
+            if isinstance(status_path_raw, str) and status_path_raw.strip():
+                status_path = _resolve_prompt_record_path(
+                    project_root, status_path_raw
+                )
+                try:
+                    status = json.loads(status_path.read_text(encoding="utf-8"))
+                except (OSError, json.JSONDecodeError):
+                    failures.append(
+                        f"agent dispatch {dispatch_id}: wrapper status is missing or invalid"
+                    )
+                    continue
+                status_identity = {
+                    key: status.get(key)
+                    for key in (*_V2_AGENT_DISPATCH_IDENTITY_KEYS, "attempt")
+                } if isinstance(status, Mapping) else {}
+                dispatch_identity = {
+                    key: row.get(key)
+                    for key in (*_V2_AGENT_DISPATCH_IDENTITY_KEYS, "attempt")
+                }
+                if (
+                    not isinstance(status, Mapping)
+                    or status.get("schemaVersion") != "2.0"
+                    or status.get("executionIdentityVersion") != 2
+                    or status_identity != dispatch_identity
+                ):
+                    failures.append(
+                        f"agent dispatch {dispatch_id}: wrapper status identity "
+                        "does not match dispatch"
+                    )
+                    continue
+        ids[dispatch_id] = row
         metadata_path = _resolve_prompt_record_path(
             project_root, str(row["promptMetadataPath"])
         )
@@ -214,9 +415,20 @@ def _validate_agent_dispatch_contract(
             expected_run_manifest_path=run_manifest_path,
             expected_assignment=assignment,
             expected_invocation_id=str(row["invocationId"]),
-            expected_worker_id=str(row["workerId"]),
+            expected_worker_id=(
+                None if uses_v2_identity else str(row["workerId"])
+            ),
             expected_assignment_ref=assignment_ref,
             expected_audience=str(row["audience"]),
+            expected_participant_ref=(
+                str(row["participantRef"]) if uses_v2_identity else None
+            ),
+            expected_role_execution_ref=(
+                str(row["roleExecutionRef"]) if uses_v2_identity else None
+            ),
+            expected_invocation_ref=(
+                str(row["invocationRef"]) if uses_v2_identity else None
+            ),
         )
         failures.extend(
             f"agent dispatch {dispatch_id}: {error}" for error in errors
@@ -256,10 +468,23 @@ def _validate_agent_dispatch_contract(
                 else "host-native prompt delivery cannot be marked verified"
             )
 
-    lead_ids = {
-        dispatch_id for dispatch_id, row in ids.items()
-        if row.get("audience") == "lead" and row.get("workerId") == "lead"
-    }
+    if uses_v2_identity:
+        role_executions = {
+            row.get("roleExecutionRef"): row
+            for row in run_manifest.get("roleExecutions") or []
+            if isinstance(row, Mapping)
+        }
+        lead_ids = {
+            dispatch_id for dispatch_id, row in ids.items()
+            if row.get("audience") == "lead"
+            and isinstance(role_executions.get(row.get("roleExecutionRef")), Mapping)
+            and role_executions[row["roleExecutionRef"]].get("role") == "leader"
+        }
+    else:
+        lead_ids = {
+            dispatch_id for dispatch_id, row in ids.items()
+            if row.get("audience") == "lead" and row.get("workerId") == "lead"
+        }
     if not lead_ids:
         failures.append("accepted lead result has no lead dispatch record")
 
@@ -275,6 +500,22 @@ def _validate_agent_dispatch_contract(
         if dispatch_id not in ids or not result_path:
             failures.append("agent result link has no matching dispatch record")
             continue
+        if uses_v2_identity:
+            dispatch = ids[dispatch_id]
+            identity_keys = (*_V2_AGENT_DISPATCH_IDENTITY_KEYS, "attempt")
+            link_identity = {key: link.get(key) for key in identity_keys}
+            dispatch_identity = {key: dispatch.get(key) for key in identity_keys}
+            if "workerId" in link or link_identity != dispatch_identity:
+                failures.append(
+                    f"agent result link identity does not match dispatch: {dispatch_id}"
+                )
+                continue
+        elif any(
+            key in link
+            for key in (*_V2_AGENT_DISPATCH_IDENTITY_KEYS, "attempt")
+        ):
+            failures.append("agent result link mixes v1 and v2 execution identity")
+            continue
         dispatch_link_counts[dispatch_id] = dispatch_link_counts.get(dispatch_id, 0) + 1
         previous = paths.setdefault(result_path, dispatch_id)
         if previous != dispatch_id:
@@ -294,7 +535,11 @@ def _validate_agent_dispatch_contract(
         worker_result = str(worker.get("resultPath") or "").strip()
         worker_dispatch_ids = {
             dispatch_id for dispatch_id, row in ids.items()
-            if row.get("workerId") == worker_id
+            if (
+                row.get("assignmentRef") == f"initial/{worker_id}"
+                if uses_v2_identity
+                else row.get("workerId") == worker_id
+            )
         }
         if worker_id and not worker_dispatch_ids:
             failures.append(
@@ -588,13 +833,16 @@ def update_validation_metadata(
     validation_status: str,
     failures: list[str],
     report_data: Mapping[str, Any] | None = None,
+    advisories: list[str] | None = None,
 ) -> None:
     checked_at = utc_now()
+    advisories = list(advisories or [])
 
     team_state.setdefault("validator", {})
     team_state["validator"]["status"] = validation_status
     team_state["validator"]["lastValidatedAt"] = checked_at
     team_state["validator"]["failures"] = failures
+    team_state["validator"]["advisories"] = advisories
 
     run_manifest.setdefault("validation", {})
     run_manifest["validation"]["required"] = True
@@ -602,6 +850,8 @@ def update_validation_metadata(
     run_manifest["validation"]["lastCheckedAt"] = checked_at
     run_manifest["validation"]["passed"] = validation_status == "passed"
     run_manifest["validation"]["failures"] = failures
+    # Reported, not blocking — a passing run can carry these.
+    run_manifest["validation"]["advisories"] = advisories
     run_manifest["status"] = (
         "completed" if validation_status == "passed" else "contract-violated"
     )
@@ -707,35 +957,127 @@ def _persisted_prompt_records(
     project_root: Path,
     selected_ids: set[str],
     team_state: dict,
-) -> list[PromptRecord]:
-    dispatches = team_state.get("workerDispatches")
-    source = dispatches if isinstance(dispatches, list) and dispatches else (
-        team_state.get("workers") or []
+    run_manifest: Mapping[str, Any],
+) -> tuple[list[PromptRecord], list[str]]:
+    uses_v2_identity = (
+        run_manifest.get("schemaVersion") == "2.0"
+        and run_manifest.get("executionIdentityVersion") == 2
     )
+    dispatches = team_state.get("workerDispatches")
+    if uses_v2_identity:
+        source = [
+            *(dispatches if isinstance(dispatches, list) else []),
+            *(
+                team_state.get("agentDispatches")
+                if isinstance(team_state.get("agentDispatches"), list)
+                else []
+            ),
+        ]
+    else:
+        source = dispatches if isinstance(dispatches, list) and dispatches else (
+            team_state.get("workers") or []
+        )
     records: list[PromptRecord] = []
     seen: set[tuple[str, str, str]] = set()
+    errors: list[str] = []
+    role_executions = {
+        str(row.get("roleExecutionRef") or ""): row
+        for row in run_manifest.get("roleExecutions") or []
+        if isinstance(row, Mapping)
+    } if uses_v2_identity else {}
     for worker in source:
         if not isinstance(worker, dict):
             continue
-        worker_id = str(worker.get("workerId") or "").strip()
+        assignment_ref = str(worker.get("assignmentRef") or "").strip()
+        worker_id = (
+            assignment_ref.removeprefix("initial/")
+            if uses_v2_identity and assignment_ref.startswith("initial/")
+            else str(worker.get("workerId") or "").strip()
+        )
         prompt_value = str(worker.get("promptPath") or "").strip()
-        if worker_id not in selected_ids or not prompt_value:
+        if worker_id not in selected_ids:
             continue
-        dispatch_kind = str(worker.get("kind") or "").strip()
+        if not prompt_value:
+            errors.append(f"{worker_id}: persisted initial prompt path is missing")
+            continue
+        dispatch_kind = str(
+            worker.get("kind") or worker.get("dispatchKind") or ""
+        ).strip()
         if not dispatch_kind:
             dispatch_kind = _fallback_dispatch_kind(prompt_value)
+        duty_id = ""
+        if uses_v2_identity:
+            execution = role_executions.get(
+                str(worker.get("roleExecutionRef") or "").strip()
+            )
+            participant_ref = str(worker.get("participantRef") or "").strip()
+            duty_id = str(worker.get("dutyId") or "").strip()
+            audience = str(worker.get("audience") or "").strip()
+            assignments = run_manifest.get("invocationAssignments")
+            assignment = (
+                assignments.get(assignment_ref)
+                if isinstance(assignments, Mapping)
+                else None
+            )
+            if not isinstance(execution, Mapping):
+                errors.append(
+                    f"{worker_id}: persisted prompt has unknown roleExecutionRef"
+                )
+                continue
+            try:
+                expected_role = role_for_duty(duty_id)
+            except RoleCatalogError as exc:
+                errors.append(f"{worker_id}: {exc}")
+                continue
+            if (
+                execution.get("participantRef") != participant_ref
+                or execution.get("role") != expected_role
+                or execution.get("executionLabel") != worker.get("executionLabel")
+                or not isinstance(assignment, Mapping)
+                or execution.get("provider") != assignment.get("provider")
+                or not isinstance(execution.get("binding"), Mapping)
+                or execution["binding"].get("resolvedExecutionValue")
+                != assignment.get("modelExecutionValue")
+            ):
+                errors.append(
+                    f"{worker_id}: persisted prompt identity does not match role execution"
+                )
+                continue
+            if audience != duty_id:
+                errors.append(
+                    f"{worker_id}: persisted prompt audience does not match duty"
+                )
+                continue
         identity = (worker_id, dispatch_kind, prompt_value)
         if identity in seen:
             continue
         seen.add(identity)
+        metadata_value = str(worker.get("promptMetadataPath") or "").strip()
         records.append(
             PromptRecord(
                 worker_id=worker_id,
                 dispatch_kind=dispatch_kind,
                 path=_resolve_prompt_record_path(project_root, prompt_value),
+                expected_model=(
+                    str(worker.get("modelExecutionValue") or "").strip() or None
+                    if uses_v2_identity else None
+                ),
+                metadata_path=(
+                    _resolve_prompt_record_path(project_root, metadata_value)
+                    if uses_v2_identity and metadata_value else None
+                ),
+                expected_duty_audience=(duty_id if uses_v2_identity else None),
             )
         )
-    return records
+    if uses_v2_identity:
+        recorded_ids = {record.worker_id for record in records}
+        missing_ids = sorted(selected_ids - recorded_ids)
+        if missing_ids:
+            errors.append(
+                "no persisted initial prompt records for selected role executions: "
+                + ", ".join(missing_ids)
+            )
+    return records, errors
 
 
 def _markdown_section(text: str, heading: str) -> str:
@@ -861,15 +1203,16 @@ def _validate_initial_analysis_prompts(
     team_state = data.get("teamState") or {}
     manifest = dict(run_manifest)
     manifest["taskType"] = task_type
-    records = _persisted_prompt_records(
+    records, collection_errors = _persisted_prompt_records(
         project_root=project_root,
         selected_ids=selected_ids,
         team_state=team_state,
+        run_manifest=run_manifest,
     )
-    errors = validate_initial_prompt_records(
+    errors = [*collection_errors, *validate_initial_prompt_records(
         manifest=manifest,
         records=records,
-    )
+    )]
     if task_type == "improvement-discovery":
         errors.extend(
             _validate_improvement_primary_assignments(
@@ -1682,35 +2025,6 @@ def _approved_plan_stage_entry(
     }
 
 
-_CONFORMANCE_TESTS_RE = re.compile(
-    r"^(?P<script>\S+)\s+\(requires=\[(?P<requires>[^\]]+)\]\)$"
-)
-
-
-def _normalize_conformance_script(script: str) -> str:
-    prefix = "<task_root>/"
-    return script[len(prefix):] if script.startswith(prefix) else script
-
-
-def _parse_conformance_tests(value: object) -> tuple[str, frozenset[str]] | None:
-    """Parse `<script> (requires=[cap,...])` from a stage declaration."""
-    if not isinstance(value, str):
-        return None
-    match = _CONFORMANCE_TESTS_RE.fullmatch(value.strip())
-    if match is None:
-        return None
-    script = _normalize_conformance_script(match.group("script"))
-    capabilities = [part.strip() for part in match.group("requires").split(",")]
-    if (
-        not script
-        or any(not capability for capability in capabilities)
-        or len(set(capabilities)) != len(capabilities)
-        or any(capability not in CAPABILITY_WHITELIST for capability in capabilities)
-    ):
-        return None
-    return script, frozenset(capabilities)
-
-
 def _approved_plan_conformance_manifest(
     approved_plan_path: Path,
     task_root: Path,
@@ -2355,7 +2669,7 @@ def _validate_selfmock(report_path: Path, failures: list[str]) -> None:
     read the flat `self-mock.json`.
 
     Only the implementation template renders the §5.7.3 diff summary
-    (`templates/reports/final-report.template.md:589`); a final-verification report
+    (`templates/reports/final-report-v2.template.md:589`); a final-verification report
     quotes the diff as a blockquote instead, so this gate is vacuous there by
     design — self-mock is enforced at the implementation stage, and
     final-verification is a read-only re-verify that adds no test files.
@@ -2665,22 +2979,30 @@ def _report_run_seq(report_path: Path) -> str | None:
 
 
 def validate_worker_results_audit(
-    report_path: Path, task_type: str, failures: list[str]
+    report_path: Path,
+    task_type: str,
+    failures: list[str],
+    advisories: list[str] | None = None,
 ) -> None:
     """Enforce the worker audit sidecar contract at Phase 7.
 
     The rules themselves live in `okstra_ctl.worker_audit_ledger` so that
     `okstra worker-audit-check` can apply the identical checks mid-run, while
-    the worker session is still alive and can fix its own citations. All this
-    wrapper adds is the Phase 7 anchor: the run directory and this run's seq,
-    both read off the report path.
+    the worker session is still alive and can fix its own citations. This
+    wrapper adds the Phase 7 anchor — the run directory and this run's seq, both
+    read off the report path — and routes the citation-ledger findings to
+    *advisories*, which do not fail the run. Mid-run the worker can still fix a
+    citation; at Phase 7 the only remedy left is to void a finished run over a
+    spelling, so the finding is reported instead.
     """
-    failures.extend(check_worker_results_audit(
+    blocking, ledger = worker_results_audit_findings(
         # `report_path` is `runs/<task-type>/reports/final-report-...md`.
         report_path.parent.parent,
         task_type,
         _report_run_seq(report_path),
-    ))
+    )
+    failures.extend(blocking)
+    (advisories if advisories is not None else failures).extend(ledger)
 
 
 def validate_team_state_usage(team_state: dict, failures: list[str]) -> None:
@@ -2717,65 +3039,6 @@ def validate_team_state_usage(team_state: dict, failures: list[str]) -> None:
                 )
 
 
-PLANNING_REQUIRED_SECTIONS = (
-    "Option Candidates",
-    "Trade-off",
-    "Recommended Option",
-    "Stage Map",
-    "Stepwise Execution Order",
-    "Dependency",
-    "Validation Checklist",
-    "Rollback",
-    "Requirement Coverage",
-    "Plan Body Verification",
-    "Cross-Project Dependencies",
-    "Decision Drafts",
-)
-
-# §5.7 implementation deliverables — substring scan against report body.
-IMPLEMENTATION_REQUIRED_SECTIONS = (
-    "Approved Plan Reference",
-    "Commit List",
-    "Diff Summary",
-    "Out-of-plan Edits",
-    "Stage Sidecar Evidence",
-    "Validation Evidence",
-    "Verifier Results",
-    "Rollback Verification",
-    "Manual User Test (Draft)",
-    "Routing Recommendation",
-)
-
-# §5.8 final-verification deliverables — substring scan against report body.
-FINAL_VERIFICATION_REQUIRED_SECTIONS = (
-    "Source Implementation Report",
-    "Acceptance Blockers",
-    "Residual Risk",
-    "Validation Evidence",
-    "Read-only Command Log",
-    "Conditional Acceptance Conditions",
-    "Manual User Test Results",
-    "Routing Recommendation",
-    "Could-Not-Verify Roll-up",
-)
-
-# Allowed Verdict Token vocabulary, by task-type. `release-handoff` is
-# author-tagged but reads its entry gate from final-verification's report
-# and renders `not-applicable` itself.
-FINAL_VERIFICATION_VERDICT_TOKENS = (
-    "accepted",
-    "conditional-accept",
-    "blocked",
-)
-
-# `## 7. Final Verdict` Verdict Token cell — captures the value between
-# backticks on the `Verdict Token` row. Tolerant to extra column whitespace
-# and to leading bold/italic markers in the label cell.
-_FINAL_VERDICT_TOKEN_RE = re.compile(
-    r"^\|[ \t]*\*{0,2}Verdict Token\*{0,2}[ \t]*\|[ \t]*`(?P<value>[^`\n]*)`",
-    re.MULTILINE,
-)
-
 # Verdict Card Verdict Token row (top-of-report at-a-glance). Same shape
 # as `_FINAL_VERDICT_TOKEN_RE` but matched against the first occurrence in
 # the Verdict Card block, scoped to the body between `## Verdict Card`
@@ -2786,23 +3049,6 @@ _VERDICT_CARD_BLOCK_RE = re.compile(
     re.DOTALL | re.MULTILINE,
 )
 
-# `## 7. Final Verdict` block scope — used to scope the Verdict Token
-# regex so that we don't accidentally match a Verdict Token row that
-# lives in the Verdict Card or anywhere else.
-_FINAL_VERDICT_BLOCK_RE = re.compile(
-    r"^##[ \t]+7\.[ \t]+Final Verdict" + _HEADING_TAIL
-    + r"\n(?P<body>.*?)(?=^##[ \t]|\Z)",
-    re.DOTALL | re.MULTILINE,
-)
-
-# `## 5.6 Release Handoff Deliverables` and `## 5.6.6 Merge Conflict
-# Probe` are required when task-type == release-handoff. The probe sub-
-# section was retro-added to the template; old runs that predate it ship
-# without it, but new runs must include it.
-_MERGE_CONFLICT_PROBE_HEADING_RE = re.compile(
-    r"^###[ \t]+5\.6\.6[ \t]+Merge Conflict Probe\b", re.MULTILINE
-)
-
 PLAN_VERIFY_GATE_VALUES = (
     "passed",
     "passed-with-dissent",
@@ -2810,207 +3056,10 @@ PLAN_VERIFY_GATE_VALUES = (
     "aborted-non-result",
 )
 
-# `Gate result:` line in §5.5.9 of the final report — captures the value
-# token that follows. Tolerates arbitrary markdown formatting between the
-# label and the value (backticks for inline code, double-asterisks for
-# bold, colons, hyphens, whitespace). The captured value is then
-# validated against `PLAN_VERIFY_GATE_VALUES` below so typo'd or unknown
-# values surface as their own failure rather than silently no-matching.
-_GATE_RESULT_RE = re.compile(
-    r"Gate result[^A-Za-z\n]+(?P<value>[a-z][a-z\-]+)",
-    re.IGNORECASE,
-)
-
-# §5.5.9 Plan Body Verification section body — scopes the gate-result search
-# so an earlier prose mention of "Gate result" elsewhere in the report cannot
-# hijack the authoritative value. Matched from the `Plan Body Verification`
-# heading to the next heading (or end-of-file).
-_PLAN_BODY_VERIFICATION_BLOCK_RE = re.compile(
-    r"^#{2,}[ \t][^\n]*\bPlan Body Verification\b[^\n]*\n"
-    r"(?P<body>.*?)(?=^#{2,}[ \t]|\Z)",
-    re.DOTALL | re.MULTILINE,
-)
-
-# Frontmatter approval flag — `approved: true|false` line inside the
-# leading `---` YAML block. Mirrors `APPROVED_FRONTMATTER_PATTERN` in
-# scripts/okstra_ctl/run.py.
-_APPROVED_FRONTMATTER_RE = re.compile(
-    r"^approved:[ \t]+(true|false)[ \t]*$",
-    re.IGNORECASE | re.MULTILINE,
-)
 # Tolerate a leading UTF-8 BOM and/or blank lines before the opening `---`
 # so a hand-edited or differently-rendered report does not silently bypass
 # the approved-frontmatter gate (the `.match` would otherwise return None).
 _FRONTMATTER_BLOCK_RE = re.compile(r"\A\ufeff?\s*---\n(.*?)\n---\n", re.DOTALL)
-_REQUIREMENT_COVERAGE_HEADING_RE = re.compile(
-    r"^###[ \t]+(?:5\.5\.8[ \t]+)?Requirement Coverage\b",
-    re.IGNORECASE | re.MULTILINE,
-)
-_NEXT_THIRD_LEVEL_HEADING_RE = re.compile(r"^###[ \t]+", re.MULTILINE)
-
-
-def _extract_final_verdict_token(content: str) -> str | None:
-    """Return the `Verdict Token` cell value from the `## 7. Final Verdict`
-    block, or None when the row is absent. Scoped to §7 so the Verdict
-    Card row (which has the same shape) does not shadow the authoritative
-    value.
-    """
-    block = _FINAL_VERDICT_BLOCK_RE.search(content)
-    if block is None:
-        return None
-    match = _FINAL_VERDICT_TOKEN_RE.search(block.group("body"))
-    if match is None:
-        return None
-    return match.group("value")
-
-
-# 렌더러는 ID 정의 셀(`<a id="r-001"></a>R-001`)에도 스크롤 앵커를 넣는다.
-# 셀 정규화 때 그 빈 앵커를 벗겨야 ID 컬럼이 bare 토큰으로 읽힌다
-# (clarification_items._CELL_ANCHOR_RE 와 동형).
-_CELL_ANCHOR_RE = re.compile(r'<a id="[^"]*"></a>')
-
-
-def _split_markdown_row(line: str) -> list[str]:
-    return [
-        _CELL_ANCHOR_RE.sub("", cell).strip().strip("`").strip()
-        for cell in _split_pipe_row(line)
-    ]
-
-
-def _append_requirement_coverage_failures(
-    content: str,
-    gate_value: str,
-    failures: list[str],
-) -> None:
-    """Validate implementation-planning §5.5.8 requirement coverage.
-
-    The table is intentionally lightweight: it cannot prove semantic truth, but
-    it makes requirement-to-plan mapping explicit and blocks publishable plans
-    that admit uncovered requirements.
-    """
-    heading = _REQUIREMENT_COVERAGE_HEADING_RE.search(content)
-    if heading is None:
-        failures.append(
-            "implementation-planning report is missing `Requirement Coverage` "
-            "section — every task-brief requirement must map to option/stage/step."
-        )
-        return
-
-    rest = content[heading.end():]
-    next_heading = _NEXT_THIRD_LEVEL_HEADING_RE.search(rest)
-    section = rest[: next_heading.start()] if next_heading else rest
-    lines = section.splitlines()
-
-    header_idx = -1
-    headers: list[str] = []
-    for idx, line in enumerate(lines):
-        if not line.lstrip().startswith("|"):
-            continue
-        cells = [c.lower() for c in _split_markdown_row(line)]
-        if "id" in cells and "requirement" in cells and "status" in cells:
-            header_idx = idx
-            headers = cells
-            break
-    if header_idx < 0:
-        failures.append(
-            "implementation-planning Requirement Coverage section has no table "
-            "with `ID`, `Requirement`, and `Status` columns."
-        )
-        return
-
-    id_col = headers.index("id")
-    status_col = headers.index("status")
-    rows: list[tuple[str, str]] = []
-    body_started = False
-    for line in lines[header_idx + 1:]:
-        if not line.lstrip().startswith("|"):
-            if body_started:
-                break
-            continue
-        if _is_markdown_separator(line):
-            body_started = True
-            continue
-        if not body_started:
-            continue
-        cells = _split_markdown_row(line)
-        if max(id_col, status_col) >= len(cells):
-            failures.append(
-                "implementation-planning Requirement Coverage table has a "
-                f"malformed row: `{line.strip()}`"
-            )
-            continue
-        rows.append((cells[id_col], cells[status_col].lower()))
-
-    if not rows:
-        failures.append(
-            "implementation-planning Requirement Coverage table has no data rows."
-        )
-        return
-
-    for row_id, status in rows:
-        # `status` is already lower-cased at parse time, so the blocker form
-        # arrives as `blocked c-001`; match lower-case here even though the
-        # canonical authored form (and the remedy message) is `blocked C-NNN`.
-        if not re.fullmatch(
-            r"covered|gap|blocked c-\d{3,}|"
-            r"documented-deviation — refs: (?:c-\d{3,}|d-\d{4,})"
-            r"(?:, (?:c-\d{3,}|d-\d{4,}))*; approval: "
-            r"(?:accepted|blocked c-\d{3,})",
-            status,
-        ):
-            failures.append(
-                "implementation-planning Requirement Coverage row "
-                f"`{row_id}` has invalid Status `{status}`; expected "
-                "`covered`, `gap`, `blocked C-NNN`, or a rendered "
-                "`documented-deviation` disposition."
-            )
-
-    if gate_value in ("passed", "passed-with-dissent"):
-        uncovered = [
-            f"{row_id} ({status})"
-            for row_id, status in rows
-            if status != "covered"
-            and not status.endswith("; approval: accepted")
-        ]
-        if uncovered:
-            failures.append(
-                "implementation-planning Gate result is publishable but "
-                "Requirement Coverage has uncovered row(s): "
-                + ", ".join(uncovered)
-            )
-def _extract_verdict_card_token(content: str) -> str | None:
-    """Return the `Verdict Token` cell from the Verdict Card block."""
-    block = _VERDICT_CARD_BLOCK_RE.search(content)
-    if block is None:
-        return None
-    match = _FINAL_VERDICT_TOKEN_RE.search(block.group("body"))
-    if match is None:
-        return None
-    return match.group("value")
-
-
-def _validate_verdict_card_consistency(content: str, failures: list[str]) -> None:
-    """Verdict Card is a non-authoritative index of §7. If both blocks
-    carry a Verdict Token row, the values MUST byte-match (modulo case
-    and surrounding whitespace) — divergence is a contract violation per
-    `report-writer` SKILL.md "Authoring Contract".
-    """
-    card_value = _extract_verdict_card_token(content)
-    final_value = _extract_final_verdict_token(content)
-    if card_value is None or final_value is None:
-        # Missing-Card and missing-§7 are surfaced by other checks; this
-        # function only enforces the consistency contract between the two.
-        return
-    if card_value.strip().lower() != final_value.strip().lower():
-        failures.append(
-            "Verdict Card `Verdict Token` value "
-            f"`{card_value}` does not match `## 7. Final Verdict` value "
-            f"`{final_value}` — the Card is a non-authoritative index and "
-            "MUST byte-match §7. Either fix the Card or update §7; do not "
-            "ship divergent values."
-        )
-
-
 def _validate_verdict_card_fields(data: dict, failures: list[str]) -> None:
     """`verdictCard.direction` must byte-match its authoritative home in §7.
 
@@ -3337,9 +3386,8 @@ def validate_final_report_data(
     The data.json is the source-of-truth that the renderer reads to
     produce the markdown. If schema validation passes here, the rendered
     markdown is guaranteed to contain every section / row the contract
-    requires (the template loops over the data). The downstream
-    substring checks in ``validate_phase_boundary`` are kept as a safety
-    net but are expected to be redundant.
+    requires (the template loops over the data), so the schema is the
+    only place the deliverable contract is enforced.
 
     Missing data.json is reported as a single failure rather than a
     cascade of substring failures — that points the writer at the right
@@ -3381,6 +3429,13 @@ def validate_final_report_data(
         return data
 
     manifest = run_manifest or {}
+    if data.get("executionIdentityVersion") == 2 or data.get("executionRoles"):
+        try:
+            from okstra_ctl.report_contract import assert_execution_roles_match_manifest
+
+            assert_execution_roles_match_manifest(data, manifest)
+        except ValueError as exc:
+            failures.append(str(exc))
     _validate_approval_context(data, manifest, failures, report_path)
     _validate_activity_contract_plan_limits(data, manifest, failures)
 
@@ -3674,7 +3729,17 @@ _ADVISORY_ONLY_KINDS = {"d"}
 # Stop reasons that justify promoting a still-broken planner-fixable item to the
 # user: the self-fix budget ran out, or a round produced no net resolution so
 # further rounds would repeat themselves.
-_SELF_FIX_EXHAUSTED_REASONS = frozenset({"max-rounds-reached", "no-progress"})
+#
+# `cause-group-recurrence` is the legacy spelling of that same exhaustion
+# (plan-body-verification.md "Loop termination"). A pre-activity-contract report
+# carrying it is a report whose loop stopped because the cause kept recurring —
+# refusing it here left such a run with no exit at all: the loop may not run
+# again, and the surviving item may not be promoted either.
+# `_validate_activity_contract_plan_limits` still forbids a NEW v1 run from
+# emitting it, so this admits the legacy shape without reopening it.
+_SELF_FIX_EXHAUSTED_REASONS = frozenset(
+    {"max-rounds-reached", "no-progress", "cause-group-recurrence"}
+)
 
 
 def _is_variation_point_item(item: dict) -> bool:
@@ -5059,10 +5124,11 @@ def _items_resolved_in_round(plan_items: object, round_number: int) -> set[str]:
 def _detect_self_fix_recurrence(pbv: dict) -> list[str]:
     """Rounds that re-target ground the previous round already worked, unresolved.
 
-    `no-progress` counts resolutions, which a round can claim while its
-    correction introduces the next round's defect — the observed shape was two
-    rounds spent on one identical seven-item set. Repeating the previous
-    round's *unresolved* remainder is the earlier signal.
+    `no-progress` is judged at the round's end from what it resolved. Repeating
+    the previous round's *unresolved* remainder is the same conclusion reached
+    one dispatch earlier — the observed shape was two rounds spent on one
+    identical seven-item set. This names that shape so the loop can exit on it
+    rather than paying for the round that proves it.
 
     Advisory only. Narrowing onto what the last round genuinely left open is
     legitimate progress, and the rule separating that from re-digging the same
@@ -5091,8 +5157,8 @@ def _detect_self_fix_recurrence(pbv: dict) -> list[str]:
                 f"self-fix round {round_number} re-targets only items round "
                 f"{round_number - 1} left unresolved ({', '.join(sorted(current))}) "
                 "— the previous round's correction did not move this cause. "
-                "Consider exiting with `cause-group-recurrence` instead of "
-                "spending the remaining budget on the same ground."
+                "Consider exiting with `no-progress` instead of spending the "
+                "remaining budget on the same ground."
             )
     return warnings
 
@@ -7394,7 +7460,7 @@ def _validate_unverified_critic_gaps_recorded(data: dict, failures: list[str]) -
 
 
 # Allowed `fixability` values, mirroring the schema enum
-# (schemas/final-report-v1.0.schema.json planItems[].verdicts[].fixability).
+# (schemas/final-report-v2.0.schema.json planItems[].verdicts[].fixability).
 _FIXABILITY_VALUES = frozenset({"planner-fixable", "needs-user-input"})
 
 
@@ -8015,14 +8081,13 @@ def _load_stage_validator():
 def _append_stage_data_failures(data: Mapping[str, Any], failures: list[str]) -> None:
     """Run the stage relationship checks that schema v2 cannot express.
 
-    `_append_stage_structure_failures` scans rendered Markdown and sits after
-    the v2 early return in `validate_phase_boundary`, so for a v2 report the
-    depends-on DAG, parallel-stage file safety, RED→GREEN ordering, and the
-    TDD-exemption vocabulary had nothing enforcing them. The same validator
-    owns both modes so the rule vocabulary stays defined once.
+    The depends-on DAG, parallel-stage file safety, RED→GREEN ordering, and
+    the TDD-exemption vocabulary are relationships between stages, which a
+    JSON Schema cannot state. They are enforced here, against the data.json,
+    by the same validator that owns the rule vocabulary.
     """
-    if (data or {}).get("schemaVersion") != "2.0":
-        return  # v1 reports are covered by the Markdown scan.
+    if (data or {}).get("schemaVersion") != CURRENT_REPORT_SCHEMA_VERSION:
+        return  # Schema validation already rejected an unknown version.
     planning = (data or {}).get("implementationPlanning")
     if not isinstance(planning, Mapping):
         return  # Schema validation already reported the missing block.
@@ -8037,157 +8102,6 @@ def _append_stage_data_failures(data: Mapping[str, Any], failures: list[str]) ->
         )
 
 
-def _append_stage_structure_failures(content: str, failures: list[str]) -> None:
-    """Enforce the Stage Map structural contract at the implementation-planning
-    boundary. Without this, a plan missing `## 5.5 Stage Map` passes the
-    planning gate, gets approved, and only fails later at the `implementation`
-    entry (validators/validate-implementation-plan-stages.py via
-    prepare_task_bundle). Running the same validator here moves the failure to
-    produce-time."""
-    mod = _load_stage_validator()
-    if mod is None:  # pragma: no cover — repo/runtime always ship the file
-        failures.append(f"cannot load Stage Map validator at {_STAGE_VALIDATOR_PATH}")
-        return
-    for e in mod.collect_validation_errors(content):
-        failures.append(
-            f"implementation-planning Stage Map structure invalid "
-            f"[{e.code} stage={e.stage}]: {e.message}"
-        )
-
-
-def validate_phase_boundary(
-    task_type: str,
-    report_path: Path,
-    failures: list[str],
-    *,
-    report_data: Mapping[str, Any] | None = None,
-) -> None:
-    """Phase-specific contract checks.
-
-    For `implementation-planning` runs, the final report must contain the
-    required deliverable sections; absence indicates a planning run that
-    skipped its core outputs (or an implementation run that ran under the
-    wrong task type).
-
-    Additionally enforces the Plan Body Verification gate (§5.5.9):
-    - gate ∈ {passed, passed-with-dissent} → top-level Approval checkbox
-      MUST be present.
-    - gate ∈ {blocked-by-disagreement, aborted-non-result} → checkbox
-      MUST be absent (lead converted findings into Clarification rows
-      instead of opening the gate).
-    """
-    if (report_data or {}).get("schemaVersion") == "2.0":
-        return
-    if not report_path.exists():
-        return
-    content = report_path.read_text()
-
-    # Verdict Card vs §7. Final Verdict Verdict Token consistency. The Card
-    # is a non-authoritative index; divergence is a contract violation.
-    _validate_verdict_card_consistency(content, failures)
-
-    if task_type == "implementation":
-        for needle in IMPLEMENTATION_REQUIRED_SECTIONS:
-            if needle not in content:
-                failures.append(
-                    "implementation report is missing required §5.7 "
-                    f"deliverable section: `{needle}`"
-                )
-
-    if task_type == "final-verification":
-        for needle in FINAL_VERIFICATION_REQUIRED_SECTIONS:
-            if needle not in content:
-                failures.append(
-                    "final-verification report is missing required §5.8 "
-                    f"deliverable section: `{needle}`"
-                )
-        token_value = _extract_final_verdict_token(content)
-        if token_value is None:
-            failures.append(
-                "final-verification report `## 7. Final Verdict` table is "
-                "missing the `Verdict Token` row — required by the release-"
-                "handoff entry gate."
-            )
-        elif token_value.strip().lower() not in FINAL_VERIFICATION_VERDICT_TOKENS:
-            failures.append(
-                "final-verification report `Verdict Token` value "
-                f"`{token_value}` is not one of "
-                f"{', '.join(FINAL_VERIFICATION_VERDICT_TOKENS)}."
-            )
-
-    if task_type == "release-handoff":
-        if _MERGE_CONFLICT_PROBE_HEADING_RE.search(content) is None:
-            failures.append(
-                "release-handoff report is missing `### 5.6.6 Merge Conflict "
-                "Probe` sub-section — required by the release-handoff profile "
-                "(self-review 6, merge-conflict probe audit). When the run is "
-                "`local checkout` / `skip`, record the single line `- Not run "
-                "(user picked local checkout or skip).` under the heading."
-            )
-
-    if task_type != "implementation-planning":
-        return
-    for needle in PLANNING_REQUIRED_SECTIONS:
-        if needle not in content:
-            failures.append(
-                "implementation-planning report is missing required section: "
-                f"`{needle}`"
-            )
-
-    # Scope the gate-result search to the §5.5.9 Plan Body Verification block
-    # so an earlier prose mention of "Gate result" cannot hijack the value.
-    pbv_block = _PLAN_BODY_VERIFICATION_BLOCK_RE.search(content)
-    gate_match = (
-        _GATE_RESULT_RE.search(pbv_block.group("body")) if pbv_block else None
-    )
-    if gate_match is None:
-        # The `Plan Body Verification` heading check above already covers
-        # the wholly-missing case; a heading present without a `Gate result`
-        # line is its own contract violation.
-        if "Plan Body Verification" in content:
-            failures.append(
-                "implementation-planning report has `Plan Body Verification` "
-                "section but no `Gate result:` line — required by §5.5.9."
-            )
-        return
-    gate_value = gate_match.group("value").strip().lower()
-    if gate_value not in PLAN_VERIFY_GATE_VALUES:
-        failures.append(
-            "implementation-planning report `Gate result` value "
-            f"`{gate_value}` is not one of "
-            f"{', '.join(PLAN_VERIFY_GATE_VALUES)}."
-        )
-        return
-    fm_block = _FRONTMATTER_BLOCK_RE.match(content)
-    fm_match = (
-        _APPROVED_FRONTMATTER_RE.search(fm_block.group(1)) if fm_block else None
-    )
-    if gate_value in ("passed", "passed-with-dissent") and fm_match is None:
-        failures.append(
-            "implementation-planning report Gate result is "
-            f"`{gate_value}` but the frontmatter `approved:` field is missing — "
-            "render `approved: false` so the user (or `--approve`) can flip it."
-        )
-    if (
-        gate_value in ("blocked-by-disagreement", "aborted-non-result")
-        and fm_match is not None
-        and fm_match.group(1).lower() == "true"
-    ):
-        failures.append(
-            "implementation-planning report Gate result is "
-            f"`{gate_value}` but the frontmatter has `approved: true` — gate "
-            "must NOT publish a pre-approved plan when verification did not pass."
-        )
-
-    _append_requirement_coverage_failures(content, gate_value, failures)
-
-    # Only a publishable plan (gate passed) can be flipped to `approved: true`
-    # and reach the `implementation` entry, so the Stage Map structure is
-    # enforced only here — a blocked/aborted plan may legitimately be incomplete.
-    if gate_value in ("passed", "passed-with-dissent"):
-        _append_stage_structure_failures(content, failures)
-
-
 def _brief_path_from_manifest(task_manifest: dict, project_root: Path) -> Path:
     """This run's brief, or a non-existent path when the manifest names none.
 
@@ -8351,11 +8265,16 @@ def _validate_session_conformance(
     task_type: str,
     claude_projects_dir: str | None,
     failures: list[str],
+    advisories: list[str] | None = None,
 ) -> None:
     """prompts/lead/okstra-lead-contract.md의 PROGRESS / activity / heartbeat /
     implementation entry guard 사후 검사를 위임하고 실패를
     ``session-conformance: `` 접두로 folding 한다. 설계:
     docs/superpowers/specs/2026-06-10-blocking-contract-posthoc-conformance-design.md
+
+    PROGRESS 서술 라인 누락은 ``result.advisories`` 로 돌아오며 run 을
+    실패시키지 않는다 — 그 라인을 쓸 세션은 이 검사가 도는 시점에 이미 끝나 있어
+    남은 구제책이 phase 폐기뿐이다.
     """
     _validators_dir = Path(__file__).resolve().parent
     if str(_validators_dir) not in sys.path:
@@ -8377,6 +8296,9 @@ def _validate_session_conformance(
         claude_projects_dir=Path(claude_projects_dir) if claude_projects_dir else None,
     )
     failures.extend(f"session-conformance: {err}" for err in result.errors)
+    (advisories if advisories is not None else failures).extend(
+        f"session-conformance: {note}" for note in result.advisories
+    )
 
 
 def _validate_forbidden_actions(
@@ -9130,8 +9052,21 @@ def main() -> int:
             print(f"validate-run: Phase 7 auto-recovery skipped — {msg}", file=sys.stderr)
 
     failures: list[str] = []
+    # Findings that are reported but do not fail the run.
+    #
+    # The line is whether a remedy still exists at Phase 7. A defect in the
+    # report is fixable — re-author it and re-render. A defect in what a
+    # *finished session* wrote down is not: the worker that would restate its
+    # citation and the lead pane that would emit its PROGRESS line have both
+    # ended, so the only remaining move is to void the phase. That blocks the
+    # next phase without establishing that any conclusion in the report is
+    # wrong. Those findings are surfaced and carried in the run manifest
+    # instead — currently the worker citation ledger and the PROGRESS narration
+    # lines.
+    advisories: list[str] = []
     if autofix_state == "accuracy-failed":
         failures.extend(autofix_messages)
+    _validate_execution_identity_v2(run_manifest, failures)
     contract = extract_contract(run_manifest, task_manifest, failures)
     concurrent_run_authorized = bool(
         (run_manifest.get("concurrentRun") or {}).get("detected")
@@ -9190,19 +9125,13 @@ def main() -> int:
     )
     validate_team_state_usage(team_state, failures)
 
-    validate_phase_boundary(
-        task_type,
-        report_path,
-        failures,
-        report_data=validation_data,
-    )
     _validate_phase_boundary_error_log(
         report_path.parent.parent,
         task_type,
         failures,
     )
     if task_type:
-        validate_worker_results_audit(report_path, task_type, failures)
+        validate_worker_results_audit(report_path, task_type, failures, advisories)
         _validate_session_conformance(
             team_state,
             team_state_path,
@@ -9212,6 +9141,7 @@ def main() -> int:
             task_type,
             args.claude_projects_dir,
             failures,
+            advisories,
         )
         _validate_forbidden_actions(
             team_state,
@@ -9309,6 +9239,7 @@ def main() -> int:
         validation_status,
         failures,
         report_data=validation_data,
+        advisories=advisories,
     )
 
     write_json(team_state_path, team_state)
@@ -9335,10 +9266,14 @@ def main() -> int:
             + "\n"
         )
 
+    for note in advisories:
+        print(f"validate-run: advisory — {note}", file=sys.stderr)
+
     result = {
         "validationStatus": validation_status,
         "finalRunStatus": run_manifest.get("status"),
         "failures": failures,
+        "advisories": advisories,
         "teamStatePath": str(team_state_path),
         "reportPath": str(report_path),
     }