okstra 0.174.0 → 0.176.0

package/runtime/python/okstra_ctl/ports/host_model.py

@@ -2,7 +2,10 @@
 from __future__ import annotations
 
 from dataclasses import dataclass
-from typing import Protocol
+from typing import Literal, Protocol
+
+from okstra_ctl.domain.provider import HostModelBinding
+from okstra_ctl.domain.worker_exec import WorkerWriteCapability
 
 
 class HostModelBindingError(ValueError):
@@ -13,48 +16,76 @@ class HostModelBindingError(ValueError):
 class HostModelBindingRequest:
     host_runtime: str
     provider: str
-    model: str
+    model_ref: str
+    version_kind: Literal["pinned", "channel"]
     model_execution_value: str
     runner: str
+    resolved_execution_value: str | None = None
+    worker_write_capability: WorkerWriteCapability | None = None
+
+    @property
+    def execution_value(self) -> str:
+        return self.resolved_execution_value or self.model_execution_value
 
 
 class HostModelBindingPort(Protocol):
-    def resolve(self, request: HostModelBindingRequest) -> str | None: ...
+    def resolve(self, request: HostModelBindingRequest) -> HostModelBinding: ...
+
+
+def _cli_binding(request: HostModelBindingRequest) -> HostModelBinding:
+    return HostModelBinding(
+        runner=request.runner,
+        catalog_execution_value=request.model_execution_value,
+        resolved_execution_value=request.execution_value,
+        host_model_value=None,
+        binding_fidelity="exact",
+        worker_write_capability=request.worker_write_capability,
+    )
 
 
 class FailClosedHostModelBindingPort:
     def __init__(self, host_runtime: str) -> None:
         self._host_runtime = host_runtime
 
-    def resolve(self, request: HostModelBindingRequest) -> str | None:
+    def resolve(self, request: HostModelBindingRequest) -> HostModelBinding:
         if request.runner == "cli-wrapper":
-            return None
+            return _cli_binding(request)
         raise HostModelBindingError(
             "unsupported host model: "
             f"host={self._host_runtime!r}, provider={request.provider!r}, "
-            f"model={request.model_execution_value!r}"
+            f"model={request.execution_value!r}"
         )
 
 
 class NativeExecutionValueHostModelBindingPort:
-    """Explicit policy for hosts whose native API accepts provider CLI values."""
+    """Binding for hosts whose native API accepts provider execution values."""
 
     def __init__(self, host_runtime: str, native_provider: str) -> None:
         self._host_runtime = host_runtime
         self._native_provider = native_provider
 
-    def resolve(self, request: HostModelBindingRequest) -> str | None:
+    def resolve(self, request: HostModelBindingRequest) -> HostModelBinding:
         if request.runner == "cli-wrapper":
-            return None
-        if (
-            request.runner != "native-session"
-            or request.host_runtime != self._host_runtime
-            or request.provider != self._native_provider
-            or not request.model_execution_value.strip()
-        ):
+            return _cli_binding(request)
+        if not self._supports_native(request):
             raise HostModelBindingError(
                 "unsupported host model: "
                 f"host={request.host_runtime!r}, provider={request.provider!r}, "
-                f"model={request.model_execution_value!r}"
+                f"model={request.execution_value!r}"
             )
-        return request.model_execution_value
+        return HostModelBinding(
+            runner=request.runner,
+            catalog_execution_value=request.model_execution_value,
+            resolved_execution_value=request.execution_value,
+            host_model_value=request.execution_value,
+            binding_fidelity="exact",
+            worker_write_capability=request.worker_write_capability,
+        )
+
+    def _supports_native(self, request: HostModelBindingRequest) -> bool:
+        return (
+            request.runner == "native-session"
+            and request.host_runtime == self._host_runtime
+            and request.provider == self._native_provider
+            and bool(request.execution_value.strip())
+        )

package/runtime/python/okstra_ctl/ports/worker_dispatch.py

@@ -5,6 +5,8 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Literal, Protocol
 
+from okstra_ctl.domain.worker_exec import WorkerWriteCapability
+
 
 @dataclass(frozen=True)
 class WorkerDispatchRequest:
@@ -30,3 +32,5 @@ class WorkerDispatchPlan:
 
 class WorkerDispatchPort(Protocol):
     def build_plan(self, request: WorkerDispatchRequest) -> WorkerDispatchPlan: ...
+
+    def worker_write_capability(self) -> WorkerWriteCapability: ...

package/runtime/python/okstra_ctl/ports/worker_runtime.py

@@ -0,0 +1,26 @@
+"""Port for opening, closing, and signalling a worker execution surface."""
+from __future__ import annotations
+
+from typing import Protocol
+
+from ..domain.worker_runtime import (
+    ProgressEvent,
+    RuntimeHandle,
+    WorkerSpawnRequest,
+)
+
+
+class WorkerRuntimePort(Protocol):
+    surface: str
+
+    def spawn(self, request: WorkerSpawnRequest) -> RuntimeHandle: ...
+
+    def close(self, handle: RuntimeHandle) -> None: ...
+
+    def wait(self, handle: RuntimeHandle) -> int: ...
+
+    def terminate(self, handle: RuntimeHandle) -> None: ...
+
+    def notify(self, event: ProgressEvent) -> None: ...
+
+    def restore_lead(self) -> None: ...

package/runtime/python/okstra_ctl/recap.py

@@ -11,6 +11,7 @@ import json
 import sys
 from pathlib import Path
 
+from okstra_ctl import next_phase
 from okstra_ctl.clarification_items import sidecar_answers, user_response_sidecars
 from okstra_ctl.ids import slugify_task_segment
 from okstra_ctl.incremental_scope import preview_link_availability_for_report
@@ -108,7 +109,9 @@ def assemble_recap(task_root: Path, project_root: Path) -> dict:
             "fromPhase": prev_phase,
             "toPhase": cur,
             "lastCompletedPhase": snap.get("lastCompletedPhase", ""),
-            "nextRecommendedPhase": snap.get("nextRecommendedPhase", ""),
+            "nextRecommendedPhase": next_phase.promote(
+                snap.get("nextRecommendedPhase")
+            ),
             "reportPath": run.get("reportPath", ""),
         })
         prev_phase = cur

package/runtime/python/okstra_ctl/registry/provider_registry.py

@@ -46,7 +46,7 @@ class ProviderRegistry:
         return tuple(
             provider_id
             for provider_id, spec in self._providers.items()
-            if role in spec.supported_roles
+            if spec.supports_role(role)
         )
 
     @property
@@ -72,10 +72,14 @@ def _registry_for_roots(
 ) -> ProviderRegistry:
     discovered = ProviderRegistry.from_roots((bundled_root, user_root)).providers
     bundled_order = ("claude", "antigravity", "codex", "grok", "kimi")
-    ordered = {provider_id: discovered[provider_id] for provider_id in bundled_order}
+    ordered = {
+        provider_id: discovered[provider_id]
+        for provider_id in bundled_order
+        if provider_id in discovered
+    }
     ordered.update(
-        (provider_id, spec)
-        for provider_id, spec in discovered.items()
+        (provider_id, discovered[provider_id])
+        for provider_id in sorted(discovered)
         if provider_id not in ordered
     )
     return ProviderRegistry(ordered)

package/runtime/python/okstra_ctl/render.py

@@ -30,6 +30,7 @@ from okstra_project.dirs import TASK_MANIFEST_FILENAME, OKSTRA_DIR_NAME, project
 # render_task_manifest 가 동일한 리스트/딕셔너리를 로컬에 중복 정의했는데,
 # 이는 silent drift 위험이 있어 SSOT import 로 통합한다.
 from . import fix_cycles
+from . import next_phase
 from .analysis_inputs import ANALYSIS_TASK_TYPES
 from .application.resolve_assignment import (
     resolve_assignment_runner,
@@ -46,7 +47,7 @@ from .registry.provider_registry import default_provider_registry
 from .path_hints import compact_active_run_context, hydrate_run_context
 from .paths import task_timeline_file
 from .worker_artifacts import artifacts_from_context
-from .workflow import DEFAULT_NEXT_PHASE, PHASE_SEQUENCE
+from .workflow import PHASE_SEQUENCE
 
 
 class TokenRenderError(Exception):
@@ -84,6 +85,16 @@ def _write_json(path: Path, payload: dict) -> None:
     _write_text(path, json.dumps(payload, indent=2, ensure_ascii=False) + "\n")
 
 
+def _execution_identity(ctx: Mapping[str, object]) -> dict:
+    raw = ctx.get("EXECUTION_IDENTITY_JSON")
+    if not isinstance(raw, str) or not raw.strip():
+        return {}
+    payload = json.loads(raw)
+    if not isinstance(payload, dict):
+        raise TokenRenderError("EXECUTION_IDENTITY_JSON must contain an object")
+    return payload
+
+
 def _lead_runtime(ctx: dict) -> str:
     return ctx.get("LEAD_RUNTIME", "") or "claude-code"
 
@@ -377,10 +388,14 @@ def _agent_contract(ctx: dict) -> dict:
     return parsed
 
 
-def _executor_contract(ctx: dict) -> dict:
+def _executor_contract(ctx: dict) -> dict | None:
     runner = ctx.get("EXECUTOR_RUNNER", "")
     dispatch_mode = ctx.get("EXECUTOR_DISPATCH_MODE", "")
     host_model_value = ctx.get("EXECUTOR_HOST_MODEL_VALUE") or None
+    if not runner and not ctx.get("EXECUTOR_PROVIDER"):
+        if ctx.get("TASK_TYPE") == "implementation":
+            raise ValueError("implementation executor assignment is required")
+        return None
     expected_mode = {
         "native-session": "host-native",
         "cli-wrapper": "worker-dispatch",
@@ -549,9 +564,10 @@ def _active_workflow(ctx: dict) -> dict:
         "currentPhase": ctx.get("WORKFLOW_CURRENT_PHASE", ""),
         "currentPhaseState": ctx.get("WORKFLOW_CURRENT_PHASE_STATE", ""),
         "lastCompletedPhase": ctx.get("WORKFLOW_LAST_COMPLETED_PHASE", ""),
-        "nextRecommendedPhase": ctx.get("WORKFLOW_NEXT_RECOMMENDED_PHASE", ""),
+        "nextRecommendedPhase": next_phase.promote(
+            ctx.get("WORKFLOW_NEXT_RECOMMENDED_PHASE")
+        ),
         "awaitingApproval": ctx.get("WORKFLOW_AWAITING_APPROVAL", "false") == "true",
-        "routingStatus": ctx.get("WORKFLOW_ROUTING_STATUS", ""),
         "allowedOutputs": ctx.get("PHASE_ALLOWED_OUTPUTS", ""),
         "forbiddenActions": ctx.get("PHASE_FORBIDDEN_ACTIONS", ""),
     }
@@ -903,15 +919,14 @@ def render_task_catalog_discovery(output_path: str, ctx: dict) -> None:
                 "lastCompletedPhase": (workflow or {}).get("lastCompletedPhase", "")
                 if isinstance(workflow, dict)
                 else "",
-                "nextRecommendedPhase": (workflow or {}).get("nextRecommendedPhase", "")
-                if isinstance(workflow, dict)
-                else "",
+                "nextRecommendedPhase": next_phase.promote(
+                    (workflow or {}).get("nextRecommendedPhase")
+                    if isinstance(workflow, dict)
+                    else None
+                ),
                 "awaitingApproval": (workflow or {}).get("awaitingApproval", False)
                 if isinstance(workflow, dict)
                 else False,
-                "routingStatus": (workflow or {}).get("routingStatus", "")
-                if isinstance(workflow, dict)
-                else "",
                 "taskRootPath": s(manifest, "taskRootPath") or rel(task_root),
                 "taskManifestPath": s(manifest, "taskManifestPath")
                 or rel(manifest_path),
@@ -1177,27 +1192,31 @@ def _derive_phase_states(existing_workflow: dict, ctx: dict) -> tuple[dict, str,
 
 
 def _derive_next_recommended_phase(
-    current_phase: str, current_phase_state: str, existing_workflow: dict, ctx: dict
-) -> str:
-    """canonical next phase 를 deterministic 하게 결정한다.
-
-    `current_phase` 가 terminal-success(`completed`) 가 아니면 그 자리에 머무르도록
-    recommend 한다. `prepared` / `in-progress` / `blocked` / `error` /
-    `contract-violated` 상태에서 다음 phase 로 미리 advance 하면 wizard(와 사람)
-    가 현재 phase 를 끝난 것으로 오인한다. (Historical bug: implementation 이
-    `prepared` 상태로 provision 됐을 때 wizard 가 `final-verification` 을 기본
-    task_type 으로 추천했다.)"""
-    canonical_next = DEFAULT_NEXT_PHASE.get(current_phase) or ctx.get(
-        "WORKFLOW_NEXT_RECOMMENDED_PHASE", "unknown"
+    existing_workflow: dict, current_phase_state: str
+) -> dict:
+    """prepare 시점의 포인터를 만든다.
+
+    대상 phase 는 리드가 정한다. prepare 는 그 값을 보존하고 진행 가능 여부만
+    내린다 — 실행이 아직 안 끝났는데 다음을 제안하면 위저드가 현재 phase 를
+    끝난 것으로 오인한다. (기록된 사례: implementation 이 `prepared` 로
+    준비됐을 때 위저드가 `final-verification` 을 기본 task_type 으로 추천했다.)
+
+    현재 phase 가 `completed` 면 그 오인이 성립하지 않으므로 포인터를 승격만 해서
+    그대로 돌려준다. 내리는 대상도 `ready` 하나뿐이다 — `pending` · `blocked` ·
+    `terminal` 은 애초에 착수를 부르지 않는 상태라 내려봐야 얻는 것이 없고,
+    리드가 판단해 적은 `blocked`(사람이 봐야 하는 상태)와 `terminal`(생애주기
+    종료)을 `pending`("아직 아무도 정하지 않음")으로 지워버린다.
+    """
+    pointer = next_phase.promote(existing_workflow.get("nextRecommendedPhase"))
+    if current_phase_state == "completed":
+        return pointer
+    if pointer["status"] != next_phase.STATUS_READY:
+        return pointer
+    return next_phase.make(
+        phase=pointer["phase"],
+        status=next_phase.STATUS_PENDING,
+        rationale=pointer["rationale"],
     )
-    existing_next = existing_workflow.get("nextRecommendedPhase") or ""
-    if current_phase_state not in {"completed"}:
-        # 아직 끝나지 않음 — 같은 phase 를 추천한다. sequence 상 더 앞을 가리키는
-        # stale existing_next 는 무시하고, 같은 current_phase 를 가리키는 값만 존중.
-        return current_phase
-    if existing_next and existing_next != current_phase:
-        return existing_next
-    return canonical_next
 
 
 def _derive_latest_pointers(existing: dict, ctx: dict, current_report_relative: str) -> dict:
@@ -1306,14 +1325,11 @@ def render_task_manifest(manifest_path: str, ctx: dict) -> None:
         "WORKFLOW_WORK_CATEGORY", "unknown"
     )
     next_recommended_phase = _derive_next_recommended_phase(
-        current_phase, current_phase_state, existing_workflow, ctx
+        existing_workflow, current_phase_state
     )
     last_completed_phase = existing_workflow.get("lastCompletedPhase") or ctx.get(
         "WORKFLOW_LAST_COMPLETED_PHASE", ""
     )
-    routing_status = existing_workflow.get("routingStatus") or ctx.get(
-        "WORKFLOW_ROUTING_STATUS", "not-applicable"
-    )
     awaiting_approval = existing_workflow.get("awaitingApproval")
     if not isinstance(awaiting_approval, bool):
         awaiting_approval = ctx.get("WORKFLOW_AWAITING_APPROVAL", "false") == "true"
@@ -1326,8 +1342,14 @@ def render_task_manifest(manifest_path: str, ctx: dict) -> None:
     latest_team_state_relative = pointers["latestTeamStatePath"]
     latest_resume_command_relative = pointers["latestResumeCommandPath"]
     convergence_block = _build_convergence_block(ctx)
+    execution_identity = _execution_identity(ctx)
+    existing_v2 = (
+        existing.get("schemaVersion") == "2.0"
+        and existing.get("executionIdentityVersion") == 2
+    )
+    writes_v2 = execution_identity.get("executionIdentityVersion") == 2
     payload = {
-        "schemaVersion": "1.0",
+        "schemaVersion": "2.0" if existing_v2 or writes_v2 else "1.0",
         "projectId": ctx.get("PROJECT_ID", ""),
         "taskGroup": ctx.get("TASK_GROUP", ""),
         "taskId": ctx.get("TASK_ID", ""),
@@ -1379,7 +1401,6 @@ def render_task_manifest(manifest_path: str, ctx: dict) -> None:
             "lastCompletedPhase": last_completed_phase,
             "nextRecommendedPhase": next_recommended_phase,
             "awaitingApproval": awaiting_approval,
-            "routingStatus": routing_status,
             "lastSafeCheckpoint": last_safe_checkpoint,
         },
         "artifacts": {
@@ -1487,6 +1508,12 @@ def render_task_manifest(manifest_path: str, ctx: dict) -> None:
             "sessionId": ctx.get("CLAUDE_SESSION_ID", ""),
             "resumeCommandPath": ctx.get("CLAUDE_RESUME_COMMAND_RELATIVE_PATH", ""),
         }
+    if existing_v2 or writes_v2:
+        existing_index = existing.get("roleExecutionIndex")
+        payload["executionIdentityVersion"] = 2
+        payload["roleExecutionIndex"] = (
+            list(existing_index) if isinstance(existing_index, list) else []
+        )
     _write_json(path, payload)
 
 
@@ -1608,8 +1635,9 @@ def render_run_manifest(run_manifest_path: str, ctx: dict) -> None:
         for s in str(ctx.get("CONCURRENT_RUN_STAGES", "") or "").split(",")
         if s.strip().isdigit()
     ]
+    execution_identity = _execution_identity(ctx)
     payload = {
-        "schemaVersion": "1.0",
+        "schemaVersion": execution_identity.get("schemaVersion", "1.0"),
         "okstraVersion": ctx.get("OKSTRA_VERSION", ""),
         "projectId": ctx.get("PROJECT_ID", ""),
         "taskGroup": ctx.get("TASK_GROUP", ""),
@@ -1719,16 +1747,13 @@ def render_run_manifest(run_manifest_path: str, ctx: dict) -> None:
             "lastCompletedPhase": workflow.get(
                 "lastCompletedPhase", ctx.get("WORKFLOW_LAST_COMPLETED_PHASE", "")
             ),
-            "nextRecommendedPhase": workflow.get(
-                "nextRecommendedPhase", ctx.get("WORKFLOW_NEXT_RECOMMENDED_PHASE", "")
+            "nextRecommendedPhase": next_phase.promote(
+                workflow.get("nextRecommendedPhase")
             ),
             "awaitingApproval": workflow.get(
                 "awaitingApproval",
                 ctx.get("WORKFLOW_AWAITING_APPROVAL", "false") == "true",
             ),
-            "routingStatus": workflow.get(
-                "routingStatus", ctx.get("WORKFLOW_ROUTING_STATUS", "")
-            ),
             "lastSafeCheckpoint": workflow.get("lastSafeCheckpoint", {}),
         },
         "teamContract": {
@@ -1783,6 +1808,7 @@ def render_run_manifest(run_manifest_path: str, ctx: dict) -> None:
     )
     if _lead_runtime(ctx) == "claude-code":
         payload["claudeSessionId"] = ctx.get("CLAUDE_SESSION_ID", "")
+    payload.update(execution_identity)
     _guard_invocation_manifest_rewrite(existing_run_manifest, payload)
     _write_json(Path(run_manifest_path), payload)
 
@@ -1795,6 +1821,11 @@ _MODEL_ASSIGNMENT_KEYS = {
     "hostRuntime",
     "hostModelValue",
 }
+_V2_INVOCATION_IDENTITY_KEYS = {
+    "participantRef",
+    "roleExecutionRef",
+    "dutyId",
+}
 _AGENT_CONTRACT_KEYS = {
     "schemaVersion",
     "dutyRootPath",
@@ -1860,11 +1891,8 @@ def _validate_invocation_manifest(payload: Mapping[str, object]) -> None:
         or not assignments
     ):
         raise ValueError("incomplete invocation manifest")
-    if any(
-        not isinstance(item, Mapping) or set(item) != _MODEL_ASSIGNMENT_KEYS
-        for item in assignments.values()
-    ):
-        raise ValueError("incomplete invocation manifest assignments")
+    _invocation_manifest_identity_version(payload)
+    _validate_invocation_assignment_shapes(assignments)
     _validate_compatibility_projections(payload, assignments)
     for key in (
         item
@@ -1901,13 +1929,17 @@ def _validate_compatibility_projections(
     workers = payload.get("workerAssignments")
     if not isinstance(lead, Mapping) or not isinstance(workers, list):
         raise ValueError("incomplete invocation manifest compatibility projection")
-    if _model_projection(lead) != assignments.get("lead"):
+    if _model_projection(lead) != _model_projection_from_assignment(
+        assignments.get("lead")
+    ):
         raise ValueError("immutable invocation manifest lead projection drift")
     for worker in workers:
         if not isinstance(worker, Mapping):
             raise ValueError("incomplete invocation manifest worker projection")
         reference = f"initial/{worker.get('workerId', '')}"
-        if _model_projection(worker) != assignments.get(reference):
+        if _model_projection(worker) != _model_projection_from_assignment(
+            assignments.get(reference)
+        ):
             raise ValueError("immutable invocation manifest worker projection drift")
 
 
@@ -1915,6 +1947,40 @@ def _model_projection(value: Mapping[str, object]) -> dict[str, object]:
     return {key: value.get(key) for key in _MODEL_ASSIGNMENT_KEYS}
 
 
+def _model_projection_from_assignment(value: object) -> dict[str, object] | None:
+    if not isinstance(value, Mapping) or not _MODEL_ASSIGNMENT_KEYS.issubset(value):
+        return None
+    return _model_projection(value)
+
+
+def _invocation_manifest_identity_version(payload: Mapping[str, object]) -> int:
+    schema = payload.get("schemaVersion")
+    identity = payload.get("executionIdentityVersion")
+    if schema == "2.0" and identity == 2:
+        return 2
+    if schema == "2.0" or identity is not None:
+        raise ValueError("invocation manifest mixes v1 and v2 execution identity")
+    if schema not in (None, 1, "1", "1.0"):
+        raise ValueError("unsupported invocation manifest execution identity version")
+    return 1
+
+
+def _validate_invocation_assignment_shapes(
+    assignments: Mapping[str, object],
+) -> None:
+    allowed = {frozenset(_MODEL_ASSIGNMENT_KEYS)}
+    for item in assignments.values():
+        if not isinstance(item, Mapping):
+            raise ValueError("incomplete invocation manifest assignments")
+        keys = set(item)
+        if keys & _V2_INVOCATION_IDENTITY_KEYS:
+            raise ValueError(
+                "invocation assignment duplicates v2 execution identity"
+            )
+        if frozenset(keys) not in allowed:
+            raise ValueError("incomplete invocation manifest assignments")
+
+
 def render_timeline(timeline_path: str, ctx: dict) -> None:
     task_manifest_path = Path(ctx.get("TASK_MANIFEST_PATH", ""))
     task_manifest = {}
@@ -1983,9 +2049,10 @@ def render_timeline(timeline_path: str, ctx: dict) -> None:
                 "currentPhaseState": workflow.get("currentPhaseState", ""),
                 "phaseStates": workflow.get("phaseStates", {}),
                 "lastCompletedPhase": workflow.get("lastCompletedPhase", ""),
-                "nextRecommendedPhase": workflow.get("nextRecommendedPhase", ""),
+                "nextRecommendedPhase": next_phase.promote(
+                    workflow.get("nextRecommendedPhase")
+                ),
                 "awaitingApproval": workflow.get("awaitingApproval", False),
-                "routingStatus": workflow.get("routingStatus", ""),
                 "lastSafeCheckpoint": workflow.get("lastSafeCheckpoint", {}),
             },
     }
@@ -2171,15 +2238,15 @@ def render_task_index(template_path: str, output_path: str, ctx: dict) -> None:
             "lastCompletedPhase", ctx.get("WORKFLOW_LAST_COMPLETED_PHASE", "")
         )
         or "--",
-        "{{WORKFLOW_NEXT_RECOMMENDED_PHASE}}": workflow.get(
-            "nextRecommendedPhase", ctx.get("WORKFLOW_NEXT_RECOMMENDED_PHASE", "")
-        ),
+        # 토큰은 사람이 읽는 한 줄이라 문자열이어야 한다. 포인터의 `status` 는
+        # 같은 페이지의 다른 줄이 아니라 소비자 로직이 읽는다.
+        "{{WORKFLOW_NEXT_RECOMMENDED_PHASE}}": next_phase.promote(
+            workflow.get("nextRecommendedPhase")
+        )["phase"]
+        or "--",
         "{{WORKFLOW_AWAITING_APPROVAL}}": "yes"
         if workflow.get("awaitingApproval", False)
         else "no",
-        "{{WORKFLOW_ROUTING_STATUS}}": workflow.get(
-            "routingStatus", ctx.get("WORKFLOW_ROUTING_STATUS", "")
-        ),
         "{{WORKFLOW_PHASE_STATE_LINES}}": "\n".join(phase_state_lines),
         "{{WORKFLOW_LAST_SAFE_CHECKPOINT_LINES}}": "\n".join(checkpoint_lines),
         "{{FIX_CYCLES_SUMMARY}}": _fix_cycles_index_line(task_manifest),

package/runtime/python/okstra_ctl/render_final_report.py

@@ -566,6 +566,8 @@ def _ai_markdown_context(data: dict, schema: dict | None) -> dict:
     context["md_rest"] = sections.rest
     context["md_has"] = sections.has
     context["md_claim"] = sections.mark_rendered
+    context["executionRolesTable"] = render_execution_roles_markdown(data)
+    context["executionIdentityVersion"] = data.get("executionIdentityVersion")
     return context
 
 
@@ -623,6 +625,23 @@ _OPTIONAL_ANALYSIS_DEFAULTS = (
 )
 
 
+def render_execution_roles_markdown(data: dict) -> str:
+    roles = data.get("executionRoles") or []
+    if data.get("executionIdentityVersion") != 2:
+        return "legacy execution roles"
+    lines = ["| Role | Label | Status |", "|---|---|---|"]
+    for row in roles:
+        lines.append(
+            f"| {row.get('role', '')} | {row.get('executionLabel', '')} | "
+            f"{row.get('status', '')} |"
+        )
+    return "\n".join(lines)
+
+
+def render_execution_roles_html(data: dict) -> str:
+    return render_execution_roles_markdown(data)
+
+
 def _with_optional_defaults(data: dict) -> dict:
     """Render context with schema-optional fields filled in.
 

package/runtime/python/okstra_ctl/report_contract.py

@@ -170,6 +170,45 @@ def html_template_for(task_type: str) -> str:
         raise ValueError(f"no task-specific html template for: {task_type}") from exc
 
 
+def execution_roles_from_manifest(manifest: dict) -> list[dict]:
+    """Copy the exact RoleExecution set. Do not invent rows."""
+    if int(manifest.get("executionIdentityVersion") or 0) != 2:
+        return []
+    roles = []
+    for row in manifest.get("roleExecutions") or []:
+        if not isinstance(row, dict):
+            continue
+        roles.append({
+            "roleExecutionRef": row.get("roleExecutionRef"),
+            "role": row.get("role"),
+            "provider": row.get("provider"),
+            "modelRef": row.get("modelRef"),
+            "ordinal": row.get("ordinal"),
+            "executionLabel": row.get("executionLabel"),
+            "status": row.get("status"),
+        })
+    return roles
+
+
+def apply_execution_roles(data: dict, manifest: dict) -> dict:
+    """Copy the manifest RoleExecution set onto a final-report payload."""
+    updated = dict(data)
+    if int(manifest.get("executionIdentityVersion") or 0) != 2:
+        return updated
+    updated["executionIdentityVersion"] = 2
+    updated["executionRoles"] = execution_roles_from_manifest(manifest)
+    return updated
+
+
+def assert_execution_roles_match_manifest(report: dict, manifest: dict) -> None:
+    report_refs = {row.get("roleExecutionRef") for row in report.get("executionRoles") or []}
+    manifest_refs = {
+        row.get("roleExecutionRef") for row in manifest.get("roleExecutions") or []
+    }
+    if report_refs != manifest_refs:
+        raise ValueError("report executionRoles must equal manifest roleExecutions")
+
+
 def markdown_template_for(task_type: str) -> str:
     try:
         return TASK_TYPE_MARKDOWN_TEMPLATE[task_type]

package/runtime/python/okstra_ctl/report_finalize.py

@@ -38,6 +38,7 @@ from pathlib import Path
 from typing import Any, Callable, Mapping, Sequence
 
 from .agent_activity import ActivityProjectionError, project_agent_activity
+from .report_contract import apply_execution_roles
 from .dispatch_state import DispatchError, link_agent_dispatch_result
 from .final_report_paths import final_report_data_path, final_report_markdown_path
 from .paths import task_dir, task_manifest_file
@@ -388,6 +389,7 @@ def run_finalize(
     steps: list[dict[str, Any]] = []
     deferred = ""
     try:
+        write_execution_roles(ctx)
         commands = build_commands(ctx)
     except FinalizeError as exc:
         return {"ok": False, "reason": str(exc), "steps": steps}
@@ -465,6 +467,20 @@ def run_finalize(
     return {"ok": True, "reason": "", "steps": steps}
 
 
+def write_execution_roles(ctx: FinalizeContext) -> None:
+    """Write the exact manifest role set onto the final-report data.json."""
+    if not ctx.data_path.is_file() or not ctx.manifest_path.is_file():
+        return
+    manifest = _load_manifest(ctx.manifest_path)
+    data = _load_manifest(ctx.data_path)
+    updated = apply_execution_roles(dict(data), dict(manifest))
+    if updated == data:
+        return
+    tmp = ctx.data_path.with_suffix(ctx.data_path.suffix + ".tmp")
+    tmp.write_text(json.dumps(updated, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+    tmp.replace(ctx.data_path)
+
+
 def _link_lead_result_for_validation(ctx: FinalizeContext) -> None:
     """Link the lead-authored synthesis artifact before Phase 7 validation."""
     manifest = _load_manifest(ctx.manifest_path)

package/runtime/python/okstra_ctl/report_html/render.py

@@ -155,6 +155,7 @@ def render_v2_html_view(
         # Every task type ends with the same run-cost section, so it is bound
         # here rather than in ten view models that would each rebuild it.
         "runUsage": run_usage(data),
+        "executionRoles": data.get("executionRoles") or [],
         "css": (root / "html/assets/base.css").read_text(encoding="utf-8"),
         "js": response_js + "\n" + base_js,
     }